From 3c1ec0f28789f305e9f2aa3d259471b849b51b48 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Wed, 13 Aug 2025 20:36:27 +0200 Subject: [PATCH 01/36] dynamic dns updates --- nix/modules/caddy/default.nix | 12 +++++++++ nix/modules/dns/default.nix | 22 ++++++++++++++- nix/modules/dns/noratrieb.dev.nix | 3 +++ nix/secrets/backup_s3_secret.age | Bin 772 -> 772 bytes nix/secrets/caddy_s3_key_secret.age | Bin 771 -> 771 bytes nix/secrets/docker_registry_password.age | 8 +++--- nix/secrets/forgejo_s3_key_secret.age | 9 ++++--- nix/secrets/garage_secrets.age | Bin 819 -> 819 bytes nix/secrets/generic_backup_password.age | 25 +++++++++--------- nix/secrets/grafana_admin_password.age | 9 +++---- nix/secrets/hugochat_db_password.age | Bin 339 -> 339 bytes nix/secrets/killua_env.age | Bin 293 -> 293 bytes nix/secrets/knot_dns_rfc2136_key_config.age | 10 +++++++ nix/secrets/knot_dns_rfc2136_key_envvar.age | Bin 0 -> 697 bytes nix/secrets/loki_env.age | Bin 326 -> 326 bytes nix/secrets/minio_env_file.age | 13 +++++---- nix/secrets/openolat_db_password.age | Bin 321 -> 321 bytes nix/secrets/pyroscope_s3_secret.age | Bin 336 -> 336 bytes nix/secrets/registry_htpasswd.age | Bin 278 -> 278 bytes nix/secrets/registry_s3_key_secret.age | Bin 364 -> 364 bytes nix/secrets/restic_backup.age | Bin 784 -> 784 bytes nix/secrets/s3_mc_admin_client.age | Bin 912 -> 912 bytes nix/secrets/secrets.nix | 2 ++ nix/secrets/upload_files_s3_secret.age | Bin 474 -> 474 bytes nix/secrets/wg_private_dns1.age | 8 +++--- nix/secrets/wg_private_dns2.age | Bin 256 -> 256 bytes nix/secrets/wg_private_vps1.age | 8 +++--- nix/secrets/wg_private_vps2.age | 11 +++----- nix/secrets/wg_private_vps3.age | 8 +++--- nix/secrets/wg_private_vps4.age | 10 +++---- nix/secrets/wg_private_vps5.age | 10 ++++--- nix/secrets/widetom_bot_token.age | 8 +++--- nix/secrets/widetom_config_toml.age | Bin 4006 -> 4006 bytes secrets-git-crypt/knot_dns_rfc2136_key_config | Bin 0 -> 134 bytes secrets-git-crypt/knot_dns_rfc2136_key_envvar | Bin 0 -> 67 bytes 35 files changed, 109 insertions(+), 67 deletions(-) create mode 100644 nix/secrets/knot_dns_rfc2136_key_config.age create mode 100644 nix/secrets/knot_dns_rfc2136_key_envvar.age create mode 100644 secrets-git-crypt/knot_dns_rfc2136_key_config create mode 100644 secrets-git-crypt/knot_dns_rfc2136_key_envvar diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix index bd5f448..3df164a 100644 --- a/nix/modules/caddy/default.nix +++ b/nix/modules/caddy/default.nix @@ -4,6 +4,7 @@ let caddy = pkgs.caddy.withPlugins { plugins = [ "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3" + "github.com/caddy-dns/rfc2136@v1.0.0" ]; hash = "sha256-HdCXbqrrGPZSdHv7bZvGz9T6loVbrfKydTbjTyt5Wt0="; }; @@ -47,6 +48,17 @@ in insecure true } + acme_dns rfc2136 { + key_name "test" + key_alg "hmac-sha256" + key "" + server "dns1.local:53" + } + + tls { + dns_challenge_override_domain "nilstrieb.dev" + } + servers { metrics } diff --git a/nix/modules/dns/default.nix b/nix/modules/dns/default.nix index 815eed0..7d1c858 100644 --- a/nix/modules/dns/default.nix +++ b/nix/modules/dns/default.nix @@ -1,6 +1,12 @@ -{ pkgs, lib, networkingConfig, ... }: +{ pkgs, lib, networkingConfig, config, ... }: let metricsPort = 9433; in { + age.secrets.knot_dns_rfc2136_key_config = { + file = + ../../secrets/knot_dns_rfc2136_key_config.age; + owner = "knot"; + }; + # get the package for the debugging tools environment.systemPackages = with pkgs; [ knot-dns ]; @@ -21,12 +27,25 @@ let metricsPort = 9433; in services.knot = { enable = true; + keyFiles = [ config.age.secrets.knot_dns_rfc2136_key_config.path ]; settingsFile = pkgs.writeTextFile { name = "knot.conf"; text = '' server: listen: 0.0.0.0@53 listen: ::@53 + + key: + - id: rfc2136-update + algorithm: hmac-sha256 + secret: QRpeYCJLokRWyzT/tWrxaly5Seb5yTkE6/Ub66edWds= + + acl: + - id: update_acl + address: 10.0.0.0/24 + key: rfc2136-update + action: update + update-type: [TXT] zone: - domain: noratrieb.dev @@ -35,6 +54,7 @@ let metricsPort = 9433; in - domain: nilstrieb.dev storage: /var/lib/knot/zones/ file: ${import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; }} + acl: update_acl log: - target: syslog any: info diff --git a/nix/modules/dns/noratrieb.dev.nix b/nix/modules/dns/noratrieb.dev.nix index b14b131..a618a6c 100644 --- a/nix/modules/dns/noratrieb.dev.nix +++ b/nix/modules/dns/noratrieb.dev.nix @@ -51,6 +51,9 @@ let ns1 = dns1; ns2 = dns2; + # --- ACME setup for caddy + _acme-challenge.CNAME = [ (cname "_acme-challenge.nilstrieb.dev.") ]; + # --- website stuff blog = vps1; www = vps1; diff --git a/nix/secrets/backup_s3_secret.age b/nix/secrets/backup_s3_secret.age index 4dccf37f8014f2d2f923bb9eb8c4ddbee3356845..1c0cfb76f787c1c7cb8b94a6e72b809dd7f17f33 100644 GIT binary patch delta 683 zcmZo+Yhjz9Qy*BCTjJ`TR1j%q8d_Xo;+q=i8I~2AUyvD6Sm@}TpXcUn>g-tJkslsz z!R3?Z9hvD@6_6Gg<`$^!6BghYV3t>zV;r97V(4t-mKj#z6mDVQ9poJm$)#(jP+Xj$ zo0?)|YHDbyU}+fUQJSt$VQE_E?NVS+nq+QSXy|Wh=vGwdmYflgV^*x6QIHxQ0DrBQBvvWW*Fx0>=7B@o$KNmTx^~nYLb=cYhal^ z@uPTnQC3h`QbAyav43i1jzvJaYp}neXHtQec4U@ecxX~~in)G)zQ2)WZg@7AYnZFP zmxXhHvumDLQl_avPKb75kdw2ai*cwys)tEnR8&|>X0U-@MSfB*9QjG)Xa_pJOX?ea*jN=yH2b0gE-!idsfA74v9 z7X#mtu&6vEpS)Bbf8(kuAA{^LOA}WUgCy6pqx4P9 zvIG1b3(^yd5?#_O3_N|gbaizVETZ%S-O{Rj%ZuF%OpPsF12VOZUA_E_jZ!O9%Y9M} z@`6(8D>F>=15$E5x#CvkN5=fzQ!rWRe!8Cc3;!9%;!3`(n|boQ9>bczpArtL=g*eO z$Zjh8BV1v5Fm=V+=SLFU%RVbizBK#AK9(|vONJYyxc8fUaP26WFD$H)tvCId!nyn} z9fy3|bvq|DowC0F;Dku;%Wu|>w_CqXKGpuI!(z&>4HZf+6n8w;`OJy|b9$8jt=9QOfn(3IVU8!H5?xpRRuI=fc6j_|?TlVy1t70>X~R@Se%-a=c-@olVoAwo9~erR#*~l>YE=q z@uPTnXnA%-xJN~HVPsIMZ)spbZg^=*mWiKbrFlqNiK|hBe@0S>L8WJiwtF#GL1md^ zac-EokAb;+igsXfscA`-TUx0}ZgzpQb5TY}exh@VQAC)2h)??Dct-JXqq6j>q+AbU z3v)xS$|C*paxdr1NZ&vo_o|{OA17^R^9VO%Z^Ke!Q@2pA^did=kEFEhqTpPYj39kC z3zI!c^bPs4$xq5>;i%6(h|jEXZ03bieh{33(&jf;X4tDG!L z1G7ydb0Y(zioNqo!}LwKbaizVOrx@jQ~X^#QzM*xy#fv0DvM1s0!=H-6D$4lii|Sd zeLPd^qXK-&voj)!xz6jJo7AZAXkzP&2d$sFcP#MUT`44d@r`g#T6f3)s#MdvbM+a6 zttMpNU6%fO!i0}*<#h~~lUuY`udxxl%5!PyMlbJYr;I(!!v!o$_s`Q!a`+d@v8PA* z>UYI_S~_?sYTPR2pcVc6tc_u?G4# diff --git a/nix/secrets/caddy_s3_key_secret.age b/nix/secrets/caddy_s3_key_secret.age index 00e655f5614dcd156863b0759db4e70f7b42af9f..2db341f1f194c42d2991aaf5372850b16e9bf028 100644 GIT binary patch delta 682 zcmZo>Yi66EQ(tN7m{nR5?onuvRWq>1h#F5FC}6 z&E*ju6{78Krd^!r9*`Sk>F8=$SY=+~mto=(;_RsAn`?_QbVQDK-7k?rMY=He6R9O~<0SQX$B;vVcc z@uPTnQj%MEesNM-Nl|%mwtq=hYI&(&vbIr5K(<-9c1ezRnMg8I z1JY8oJ@QOL%kz!(y@GtXbaizVN&~V3jl-Qn19L5k^W4Isit^18laq>r3cQ`o%T2r@ zyfP~4ErU%hLkz>pxf*Y@PI$R)=^x&WV&1b-Hr@2g`?_J)zxPv0*Pos8%U7PK+wj%0 zn77ArYxvC`HeX)6x=6CrF|qB*ZN1;FZ*`uDG_Jd{B3y3SU&j00{4ZOd*qqL--Wk35 z(T_Q0WohOA+5APe&v&>V^|PqRapL3&-Pf5aBbQ6R{9&f}dO}xv;>Ar3ufIOLcF5d9 XQMdl}Yi66EQ*YrGk)9XjTHx(xZkF%v=a>`ZSL~nRYFZMJR$LKLV(6Y78s<})>g(?2 z%jN0i8yRkqWfJP>;-PO=nq}k?VPvjfV6L5RQSRbv;u2w!Rg{=t;E^AY&ZTRoP+Xj$ zo0?)|YHDbyU}+fUQJSvc=I|B;+9cpP@0%;ToI`q>TZ~llM-y1 z@8|F3loRaAWg2SX=Iv!@;*@6Qlj&?x>Kjt%7~~pSCrk6&1se`%Djsh4+FPI63u%tvYgCzY>pS)aCE|k&$uBVFO4UR{TlD5^*zN8X7~A&hMx@N{2{YX+j9Ly zLzgEyJNy1_Ja ssh-ed25519 qM6TYg kxQujT+O6ZGlzTONdS/18DUVoxNapwtxitQo8GKr2hc -b7KjCjuvhmWcqNB6BvNruL17Ww6yWkVKjjm/MGd+jlE ---- q3EzroLr8b0T2gKQ4xUR67YOLSwFP1V8UxAnKY0PP24 -l0g1CXqi{Ttg͇߭ەߑEs5hxk- \ No newline at end of file +-> ssh-ed25519 qM6TYg py66rUtQIWm6K163vaJaoAseekNA70yQKMDH1FkWYVc +rP7T1akj7LmzIcJeoK+mq+GfOjWpnWFnSpUhIA9Vihc +--- UjRtQl6/Gz3QPiLhSyksrsRvFoCjiCKi4D0HdBb1dJY +q(mzhkH9:M>c=ά֦M L1 \ No newline at end of file diff --git a/nix/secrets/forgejo_s3_key_secret.age b/nix/secrets/forgejo_s3_key_secret.age index 9e4e8f3..fba1c4f 100644 --- a/nix/secrets/forgejo_s3_key_secret.age +++ b/nix/secrets/forgejo_s3_key_secret.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg yxVVZ7LOgN9NiKsl1+dN7Rp6Rsf0zlqb25Y6w43styk -gQ5g7TL8+lyGp0SxdcoRg0nTpu1w6WbZZK0ERyqRpkc ---- 5uKpMbkW4zZ035mNXCuty+64IZ360gly/ezxnwtRX/0 -ˁSϸ>q!O߷TCUҺ[*󅬟\w݋tcg? |B;"*dWv/vnqe \ No newline at end of file +-> ssh-ed25519 qM6TYg DlJpvGP2I1iGodnEufzr0qCAmmU6XiKbnNCRJmjPsHs +upNAkX1DPfs7AJi+/hUKKcehn7tTcR0knW8W+kP1u/k +--- ZEI6vM0+n33fVLPssJyEWYW/xNgoa0/2BIZeG3NzBrk +-r ` +gR/n|S\h}LRE@𚇂OjF"Vv-q˓xjf ­f=aI8Ѧl C \ No newline at end of file diff --git a/nix/secrets/garage_secrets.age b/nix/secrets/garage_secrets.age index d9d0ee252c173a1e5421132fa165f39680b1a3b9..de68b3e6869e28e5b15787a5b6aaa847d1bf18b2 100644 GIT binary patch delta 730 zcmdnYwwY~$PQ7WMTTwuzvA>^phEYI3SbBP4h-Xl$MPhoPpI@$_Yg%e{MpBe(p+}Hw zI#-}UNMc%qNk~OnmVZcYPKsetVt#g{yI-n#a9EJOpL0rPU`~}^xsOk=1(&X!LUD11 zZfc5=si~o*f~8@YM`^l(V`*rvd3b87i>ZaHxo>%zrCV8siGI1Ge@bOoluuBhWsrWc zWn@*PvxRFYS59!gyLq99N2Q^2P+@^Vad@ z#E;_PRY3*0rd65FM!unyemNlpk!hhBg`ST3WsYfHg_RZAX4x6pJ{iVgxfKRnq4`OM z{+=lrsZoXIK54;;m6nm&Nl}5WW3NcEuC@%AI_lWXyD=aB=wumTBt_le*3Nfi173(N-c3p%Fc8z2{6w0ugDJ!EikN1^!6#sEi3ji zNzU@A&ngTK&rHg7w&4@aqn-I6NrQKHeylDN49_Cvu;q0&L zQdE+jm&p9CUU@<0(8Y_~%kGDJh>0DS-*7vDcm0BES~u)vx1KB7IDwVp*2UKhkHp`c z`dYBWFe8-v@2x*CDyu{_{1rAGb$4|;&z6{H!S*QWq-Efj+n44DwMEV}ioU&6q5DvK zF~7@q>&hrWrRh8UIkMI&N^S1b`^pm}to=uL$Dy4o1W#&5^H=-aSNjq1bwQ2ad)0}? U<;LBvywzdz#HErBOm))-0Lo7eY5)KL delta 730 zcmdnYwwY~$PQ8y=L|~X#Wx0NcQFgh9QKo;Qaf)L_c}0$+XI@x{cSLHoX`n}_cX6n3 zI+t&*MOcJ~v9o7LQju3kp;K~Jim!)zu3@&hcU4J>NoJ8pVR)XKL8W)NFPE;JLUD11 zZfc5=si~o*f~8@YM`^l(Q9!CQCfafQGr)fq<((( z#E;_P6_t_hmImn_zLpUljuoC|M#*lW`r&0!#VJ1dW(7r#0fFg3-i|H-2BDE$5hfs4DaD^GGpE^7lPmFXgDawlo<=QVWUp3RMNP5A=nKu*oYcwxvzg)y|zVFwax&LR01W%u`j3$G&&M|H5wmSx|a3Z_)C#{70k2mtNZ) zvGLIR&}Y;4*8bXOcOgqKeha(HpLlCdQAN%~M8rEb1vtHHCl z9;3d;+U0Ab46>}}np~|6Nhy%nKGjg&@}|Nj^QhOwNk2aCzpuyPb&y9(WBIbmDdFE_ UdE?sy7Ivp61jo5Qc~I000En~@_5c6? diff --git a/nix/secrets/generic_backup_password.age b/nix/secrets/generic_backup_password.age index c666d43..1e0c2c4 100644 --- a/nix/secrets/generic_backup_password.age +++ b/nix/secrets/generic_backup_password.age @@ -1,14 +1,13 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg IBVFRlOVLHcuS6xa7UVGA1z9NTBtNwGbt94c/yTB8wE -T+VtsTngND9kAd6DAtksXN4xYs+E8JZSxDeOm+G23tc --> ssh-ed25519 91VHug nUkRwHgpn2i56NNY0VAuG+r3CX1rjt1M0ZVKj+ijwGo -ea8Ry6JIJlPOObY+v2Q5MkdcZqCeDLAOxC583WY38Hg --> ssh-ed25519 XzACZQ 7f+8YcecMvwnOgwxjRMUUUm9Sp4cyKpIZWWMDrrCtzg -Bqhd2kpuTg3Xchme5wHfg4zkuikeM4H9GdOZVUv+HZk --> ssh-ed25519 51bcvA DUk4CsGXhdj4uIqzYpoGmtHs5dnjIBUb0c9zj1DEum4 -hGe3j5Ycn/WVV5wgg+vZuh2KhnamHACkHrDWcVgkSjo --> ssh-ed25519 vT7ExA Zf67OkbMvOpgABZDuXw3U94KqX32VG8nnjo3Xmkbih0 -5K5fnBxkQDaYwuMPhyNU5ZrZLjkgknG7dzMzyuANMuU ---- Jon4j4/xeZqS/6KsWszsVOoVOgJgsPEKxmtC7PcocCA -솳~ -N+jK߬/]Ӡ!䂶.7\k~ ssh-ed25519 qM6TYg SrZQBYLsUcrDu6ds1fJAyjM+mHPpAW04U6yRqA/TjH8 +LZUTPquz+YNmlRWrXwY2fvXsVwOEM/uhzWcaf7WsY5o +-> ssh-ed25519 91VHug sVXnaD5sruvFKnPwldWzlH8KUIeZ/toWqYe/F2tfBX0 +CapfF55c1MvBDcDywNpnS4blYwD0HrPyrcncMRbl5lo +-> ssh-ed25519 XzACZQ WqU7ebK4SnCyxP4zxIdmMDAaH7mk2HpgvUwbFWhoNWs +wm0ZtnIQCKZW+WJIDtAIdOQkvp5LLyvTQ2vNFC7C26U +-> ssh-ed25519 51bcvA xtMa2mIZ7GHOFJEcpZjr13vOovJsyo9fMWAnm66pxEg +DqNSop7GSDMvsDzu9NK5ubf2xWMLX1fFLSiZUA42RUU +-> ssh-ed25519 vT7ExA 24tU87648MvZgbvt9PNWBUQsQBDyeBd2QV0jiKGMwWs +mSuA/G6ZjRYhG3TMGt8SQ8aqK8s9s81YBslBwQLr4Fg +--- sr5nQObjSdkQ+eILGm+p/nnD1XxrcCXwVY70INFlZMU +ʛ.)uT}nw?]4^jk*y"#ON*6}yI.7TS-R \ No newline at end of file diff --git a/nix/secrets/grafana_admin_password.age b/nix/secrets/grafana_admin_password.age index 59a4c17..f208dab 100644 --- a/nix/secrets/grafana_admin_password.age +++ b/nix/secrets/grafana_admin_password.age @@ -1,6 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 XzACZQ OeTS5wU4ac+Qh7s1PXbdFH3LDlRW1LV+qFtoVGI47XQ -JsixYPLzpnF45ODQH7nuVowXzwbNQi8lWx1Bp2YFVWc ---- MEG4bfGwoFRm9HizYdqtK7KApYhYH+QjAIEp7CpLznA -C/wC -Fz?MkrxN'NTzWb{Aj3X6mݲJ@OI{u?A,C d^ \ No newline at end of file +-> ssh-ed25519 XzACZQ 8I9FjYxsWRwFE9W5eUEA3CdAG1etcJsYrT/QIFTkf18 +bmwA4zP6sG54vh1l8tAW7i7g5L6y7bB6jj43YaGIC9U +--- c3xQGTTlsALUeTz+FbECQMUPmp4/PHTaosgDRzOIrk0 +9‡ ,$JE %2`ğK:a] ,TM>қx-yn|/+OZQWqh^]^̀$? \ No newline at end of file diff --git a/nix/secrets/hugochat_db_password.age b/nix/secrets/hugochat_db_password.age index f5e1cd01dd7d5b4e0af280999ded36584c31a78d..110f6719572dff4a80591201bbdc34af2743b614 100644 GIT binary patch delta 304 zcmcc2beU;_PJNiWnR8)IfN@H&Q>tsRV^OI=SxI1`QFxYTMr4_VQ%;Ien4hVWZ$L^# zIagIdL~dznZnAHBc2cEhPN`3(XOd}PoNnmJxR(h#HX}FJLRg`yCQ9y-DMZH;$lSQaWnF*KKdQB}B(Iki1 zDQxMlOddY6P~Ui??EE7&hoYQ9o6me=YPXNi%zdJzsbYOW{dd)x%O>2Ox~IBd@ODN` z`(b?j)r+W0|E-0tc?r(zt&Mvu{_b_qr0}q^%8sdL0~WCV)jBbyEnvZISIKZ8H}8Lf z+D+Gdxr}9hoYvONexkwRCK~7bRa#znvi}dEoBSshET5PuAN*+=%N*+^8f_Ps`0wnx HzQzgw zU$&`#m{*p$i%Y&ws9Tj!uA5`Ahe2tiiDzVXwyRfSWqoQ+aA;L#WigjRm9fh_LH&8k zyoK`(EDOU{KisxLisf7^gOcBr6DJStHa{8cw_)dnbv#prSGmoT(LSm;zBMKHkLeT?+oiNHpW~F z7g=E5Ci3R diff --git a/nix/secrets/killua_env.age b/nix/secrets/killua_env.age index 3ac6770437142fd8e75f73869d3ceaf93e8d66ec..e0ebd1e3e654160fa26ba220908da8296fad9b1f 100644 GIT binary patch delta 257 zcmZ3=w3KOrPQ9r|kawAnv0-UqfuVM=PhOdUX`y>gm{Fc%p@n}+X|}PuUqF7KV`yb~ zK37m=Ubu7Xi; zrHhYQu3=PVxVcYau7$a&evnhRadCKnp}D?=b83Epc~!ELNosk8emRwv_APoBvyS@2GORF5-Kgf(bdnRcX-W; z&^nfA@VDSwkcOMHxxdecSGSg&Utqib#_#IQa@<; delta 257 zcmZ3=w3KOrPQ9hSXJU9no}<2-bAgeeqp5$fS5;AneyX9Rk*Sw)Rd#+@rHfCxYea^T z30F?4c0^i1xN&NrziU=;rE#EnaB*U?eqL6op_hT7afC^wS$>Y0vw37hAeXMLu0m;! zdsU9VV}(<8iA!!oSh#6ffLElExoM=EwnsrxsD5dtL6yI2qQ767qa#<#ZsB_sE0*rN z(7%E$aOUIn(*mm}{1IT;@#n4c3aQ@cFkz**J7J%nMrGY$II!7M%d|g#`k91v5vnaS zvi ssh-ed25519 LZU5Eg rwUOiYywkv8pql/vl0b4K10Ic2oTijgDY3j2Y4e5elY +8HAY4fQqjST5LqwZQIw83Z3cLZqnziq/czDpkJ/ncaM +-> ssh-ed25519 5bWSnQ E6u+2wa3+f3iRxFCSa8evey5D703lNTGrsMT5hJhSGo +RRuKjTOOunRLD2re/Vy87maIkNLiFa0p0AugeYbGpEk +--- +5iOAG1dYXmUdxXY0dN8bhFpylZhVn90M0/OSbNTSL0 +("`4*7gY؝N9TpZ,2Uxw9UP| z3Q|1-Qw-2;D+@7qt#DL`NXyf%^0jaccS%nzNiD9ZbVFB@%FN0vOb^O-&5O*n2rv$glNGwnF^{L1ZCWN=x6*rws+>?rDL= c$9xmym&CvP`|{~Ex3cuWFCHO^LX-PL00GPCLI3~& literal 0 HcmV?d00001 diff --git a/nix/secrets/loki_env.age b/nix/secrets/loki_env.age index f55d3a3cf011d5697d3d0f3d9d39d33bc7803a66..2f5e05d5f475539e830ad34eadcf7a168bfea261 100644 GIT binary patch delta 291 zcmX@cbc|_&PQ9hSW1)VzZ;GXUXq17rM_`3VmQitDWmJ@9ghfDFU{OR_inDoSL4ie; zE0>2;S%rsVWn`GUepE!Zho_;rZ&E;Uuy?v~sil#xV|ij&W{!4_g;#oMD3`9Tu7XRZ zVRlJgM4EwRl(&I*kbi1OaaB>Id19nzSxH_%afzRYU%j`XVX~z~aUd7-<)yJ{g3W%n zC-`n&HG9wYN2ZU8wJdhLcdxE-X4hxnkYhVlap_oB(~?@HHUAyo!5e#%l0H@3-F{6!vMsgwbTj}q3wDnH delta 291 zcmX@cbc|_&PJM7hc(HSEK)80MYhY$#ez-}FPi~;IV@bJ*d4W-KvbT|&XOVwuK&YE* zK39r%QgBgvxM68(c}j-1zK_3)wpo?8Nm+ifg{8l7RDf?pps`tYj#*J!IhU@ku0lwv zQG}suX_RYueri!lnv+jOKuL0GRk*u>ARqmoAkjo`YTT!I2Sl~ul&vY(@9Z_s}zdd*9fc<*IHdy>*Hn=@TE#o$^62$ z54uZQ&EqP6?wmc-K1rg={FdG?))ju$&jjXKO;FU_r7H34MdZ4NhO_T$w*|yAKig&_ uUA~j|t ssh-ed25519 qM6TYg k3jtd2qoiQCsKZYJliH9ySFuO7CVQQ5Sv2ikFYcaD2c -TSIg6y4C2WaLQJUyNT3HQOj09VmKSkQxlsVlaDc+1tY --> ssh-ed25519 XzACZQ NZhP9TD5nYxBMgO1O3vDOITeh7qxq4vhjG7AppQmRlM -I1JiT8ISWLVUgoCphHSbhYvfssfP55NuBI2jclG3DVQ ---- 6UR3wbSTB/f0s8hP/YHaY9HFDpnLAts0yksKCv7p9BA -ig502LQkL -vÛB$5m #{_8j&+;Z-'ƒWHSыaf?56[t8&Z_/3B_4n \ No newline at end of file +-> ssh-ed25519 qM6TYg t4OIcjhlaEBxFFK/VibGcE0D5zb4LrMv0zS1vxMKxHA +/OIYeC0s9Jd5R6MaLQPHlgscrSkNwpdK1doADIZwmHE +-> ssh-ed25519 XzACZQ 7ieKRLiY3EzGlRcAzxnhzDQkUMmpNutUViBeMrSkWkM +qxeyBVm6aHDH7oQXDShuEqUGY9W8bp2vHfWvJEssfLg +--- RuCRpuvvN5pIBe4zMaF0X0J5oW2z9ytkSfwKdkQlqo4 +t9͆//d3fY.h dg",*T9~$xwxMHHQc9|Eu3KbTg?6f6WW9%HqDe$ink$z=SSE-6u0X}L z`xOcttDp7XdSb9U$1?Vq`~N4et6xX&zW-8Z+RlV8%2o?%W^L%+ef?kHrq7Q}iC=+HVZB#rh@qixRz8<|wt`f}{o~=w zyJr0ldc~l(>(ioD?q4R>`FB3uSQmP?Z?T%~L$Ob443D0#30|^y?K-z`wt$J1cW0an zy2kic$47Ls+Y2E{nJHQaZ94pn7g&jYEb=<@_-HBTwWi=EmYVQWm$oTfkUplaWG8#p p;f})Qvq%0{E;fH6{^VG_%DtnG$JPk*WR~45(zxCbYph!S6#(kyba4Ox diff --git a/nix/secrets/pyroscope_s3_secret.age b/nix/secrets/pyroscope_s3_secret.age index a2c7dd5a58639b5b736a1e0756ffd89c76cb7e5c..65db4ad53003cf3dd5cd39d3b8a8c6b9886d9b77 100644 GIT binary patch delta 301 zcmcb>bb)DtPJLKvSXfYYx_f4jo4$FFi@%$TVPc7!V~V$lWpH9hvVNAQr>CP&T5hpH zI#)qrL9wNur=wf0c4$a`ZfapkxvQUrQ$}%$TX4QlnRa++p-EYYSA}~>HkYohu7YD| zx>KO9fnQZghJk5BdTxogeonEGg-@_WNOrDgRis~TM17iXZk}IdK_r*S$E^xBK@!(n zO5b$F%G{5im}-1<@kZmNA@-QwtH5|^Ju_1#$`DE%|@AfouQ( delta 301 zcmcb>bb)DtPJK$cV|bNodXP(cqQ1LPK#6&&X>xIeQBtslXL_Y+R+W*vSBQ47S%{l) zAXk<}m6NuYYgvkyenEs`YG#Udeo?MPSYc4Oqot!|rGI*eNoZb3lu?#JHkYohu7Y`X zcA2F`ZdIX6N}g#!S-NFphCy;cv3E|owx2o=a3I$)ofj+L&2fuw z{-djYulPdBMjr{rON(b@Z`$^tB5zW$C&Z~ouc=3C{w F0sv|%ej@+? diff --git a/nix/secrets/registry_htpasswd.age b/nix/secrets/registry_htpasswd.age index de9e94aba7921b8ebbeff0e436749aec108abe2a..fedeb0326af831b574a80b52b7bd75bdffb0f530 100644 GIT binary patch delta 242 zcmbQnG>vJ3PJMBDVvv7IsIya0XjWo&W`2&5esHRfmw%aekwu0pa? zWR`z+R-Ppfc^g()tbGS(}8mbUN%k=9RXs?(4_8`LX~GWM8=e delta 242 zcmbQnG>vJ3PJLo-nV(m-k-LGHmq)t0f4O70b4jG9S9)bmp_5~zOK?Ppw_l`pd6G$P zK3AesM3H%xpMic@s7pwNvwK;dc79Tov6pA4K~lbVa;}L}Qn{OBW=gJMK9{bpu7Z*G~ke!BKjs$+# z#9YXJ?(d~3J@%U6laEg5oZImK#;qAM*reJ`UahIRm@J^=%yC}(XphI`+(6B5eA`*r vPG9L>sNBPE=<)de-$QxHtJlOGOT6>jeb?-bdNa4GAL0^HS&)>xMe+;)3khIH diff --git a/nix/secrets/registry_s3_key_secret.age b/nix/secrets/registry_s3_key_secret.age index fbd34507c893059b97c403ab184623ca2b21475c..8232f02e33ef2f5d6c3d998d8b8674d106da4eed 100644 GIT binary patch delta 329 zcmaFE^oD7IPQ7oEd1!V?qOo^&R-|i1xRZs8c1dY?rm1UiR-vO;WVw-vnX6M#a&AFh zK9_%~S6-@FRCcyUS$33@bAYRUexPMoNP%OzvzLiqrgvUou3<@@r%zx&F_*5cu0ob+ zq<&3U4+? z*QlidUp@%?ESNmMf=%J*rK{`z`Mpv4Rp@Yc)tf!1g)3P2!jf87Z<|}f!E4g5H?=l5 zDb)GPTi9i>EhalPMlQU|{9?tMlO0!*ZiQWzXnW;8Jvd@-*4%(YiM+P)Gb>)Moo;gA i`OXtT`{$oN6#scV6AMQMh+ zBbR4-PLRJrRbYyfsj+2-NpPi)MNW=cwtkwwp}BjAVMR)Ql6gs`OQ5TfCzr0Su0lk% zqqk2^vUaw)v1M7IacF2!iI;D=e`J+YURY$IM_6UPNqsh-NB>bbpB&q&&{|@^zDr*+T^*wwRU;EaO(O&F`mf@Cwon&n^mf4y<%ZcS;O5FfW9k4>>20f{4N$fQJQv& zdvRSvkW=ln*QUvZ-Xf7__-t7x<$wJ<^S_4@`y;keF1>{pi#aDInu{Mjlj^v$O8MUB j-e!Sqp0`$Rx%48f?uc)lUc(OeJKdAhf delta 695 zcmbQhHi2z|PJNkod8t!|Yo51qzYFVyjk$cDR{kVuqKy1(&X!LUD11 zZfc5=si~o*f~8@YM`^l(nVY$ji=}^hM1Z%CVRBihvs*-dm4$0SQI&C4Sz1xJWw2j? zN0nb*keg#MS7NH6uaRF~l%G+qiI2XgtFuvYX;P+}UrthvahRb=k-JBvc7Bqhp|g+Y z#E;_P0U55Dl~I`~ex?QC{^6-^0fqU_=|!G7+G%cvo*pIT$$74ce)(ZlhPl~XX3l;d z2ALr~QU1x{`9?vJepOXT`K4Y-uG(fM2C4p~-dV~1-sJ^`MyA=5;~B-n4e~RzOI*T( z4FmIx%uC$;-ThKhEmNFaoSc$ELL}0#efb z!i#-<^eggRl2VPr$`kd|N=%b;OOgtL3^ENSpJf!UH#Ug$GY&UQO%3rdFbFJ&D2*zx zv@pyxH}ERY^LBO*at}@MFYqca4s|o(N;5Dt_lqoYDl9Ea&nn1CEle{h@y^ciGD`C> z3er!k^sg!lNOU#JadHgg($&>fNODa#HY|$>_KwIk@XF8dbBqe{)K82s3Q0E34ogod zj|g|G&o_ZiAZEnx+)&2HXtRvXz9naBt=ii%{r`5iX-m@WZvx!cT zuzyN{lwI29=++rMq6R+?l$VytFkHE{`uHinn3q0zzIvOV?38T1>dyVmQdzFg;PK5V jU!G6?^1=76R`|1rol9@VcRHjsux*G5yPH8tph;OtQmAv5OPZNcjz_6~ zQc_W=qhVDtS6N1IkcD%Ef4F0^SxTr=R-}u6aB6OjrE`^`NpN7kerjk{Qm#*as8PP> z#E;_P0Twx-nI)0Qu6`92r3Sg~+6HAQL1h8PX2~8#DbC?0=}x(o;St^$+3Cq#Nd{iI z8J;EOp@n(LMSXli3|tIK3e(*3(t;}8Gx9wvB1#Rk-Hco(pJf!UugG)_)K5$H@eeRB$qjK$4NvsX z_DKqL4|Q`h4L0$yFfh$?&B-Z9b8-pf3i1gLOfvV&N;OL|&#^QOE-H^qjmS%O4=-@^ zHS+Q|%{5J{ayO1D$xJQh($&>fFfXh$Esm_PaJ5YF%gxBtF9`K>PuI^$w={{2$}1}K zE=hB*uP96`OZ4-~=khew)%VhPs=4W&(ldeE)2_H>GQ?aGoUr5VvtvHTb{PIxpgaG# z+tdQP@YBbGyXNbr`S46i{49DbOPcLhXdCXMC-Yx>u%@KZ!r^`;BTeQxi7+A z^@^iN0pHhi=Z;=--RGY7nDg&~uLmq=evL2Ma>Y2$67|ABX^2T-LW5`Wr6-H z^dc5WUzsrNV1wxm0lv&Lx^LEs=#{MSO1Hl+#%w1NdUew0r;5uS?K!nT@$2bS*6H&K zHGgdVJ-J4C_S)nBne?OO`L8&a>{<8rxP^b(Yw3^^sRCOaS?lkL}c}hSB85hh?F^w{~i2Re3;~ zMNomiw|+%AS7mChn~70oP(XlwdRDeiWw>c_X_m2jy0>|mZ*fGFvwviIx_(A#WomNy z#E;_PW@gFGennwE9;F6(>$^QO<`9=OFPN`-k9xf3D$;nar`i3D%UKw5i?#ZQjC0@ys;~B-n9ld=DJW8BH zL(K~_os3+4vJ)+G!xAl$lk&ntQnOQvjV(ew%~OMtEy@GAJRPHqNfa4E`!r&AOb6|^X&>~G>ym8f;pS4v zSo~(CP|vriVV`cB1sOJ1J#SdI`^XCo;l*5^CPhA|npJNwyFdILC QGgg&j4|ny?ch64&0ITUf>;M1& diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix index 8e25b6b..8209c40 100644 --- a/nix/secrets/secrets.nix +++ b/nix/secrets/secrets.nix @@ -28,6 +28,8 @@ in "pyroscope_s3_secret.age".publicKeys = [ vps3 ]; "restic_backup.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ]; "generic_backup_password.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ]; + "knot_dns_rfc2136_key_config.age".publicKeys = [ dns1 dns2 ]; + "knot_dns_rfc2136_key_envvar.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ]; "wg_private_dns1.age".publicKeys = [ dns1 ]; "wg_private_dns2.age".publicKeys = [ dns2 ]; "wg_private_vps1.age".publicKeys = [ vps1 ]; diff --git a/nix/secrets/upload_files_s3_secret.age b/nix/secrets/upload_files_s3_secret.age index 3bca9a4fadce6f01116ece8b34b25b714483809e..f976afd080b40e53b35c5331497e2064eb32691b 100644 GIT binary patch delta 440 zcmcb`e2aO4PJLuxpu7bB` zWpR40XPLW?uYs3uVPRl!RhnyrlVO=xu3=QJOS*fYNxh|8x@%Q-RW_IY_L=u*2u^=^ zR<2ISGr46&*w&s!Uw7=W*A6~+jMEJwoQV$6&51tdOOzLG2h<5 zi=if9TUSleN7)5E8)oXYT;f=K=KGu}C$Dz*bKR`$Je!2T@u;jynpiosX4-z1Q}|d6@5AvcE~LB`;CylS0hCBsvq&Q zTosZg?54)L_V=v%3HOY29Q`dXsws#3*}HtLrf_F`Ol4^D>lJcpGtAA-UAr8>bi-ZZ zp<(VFy9*ZGJ|_JFK0j_no_fEac+N{n=Ia8n3m7i164{v>J;_{&=koSLnT+W{67x;U z!xq`ex2B$bs;O~Cs#VrOc!fLj?}z8O{g?F#cH34aKHU;gTFY&!W+?qWH!;n+Rz)(z8@+nwVU*Z}~?wY)$8 diff --git a/nix/secrets/wg_private_dns1.age b/nix/secrets/wg_private_dns1.age index a54f3eb..6b10eba 100644 --- a/nix/secrets/wg_private_dns1.age +++ b/nix/secrets/wg_private_dns1.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 LZU5Eg o+MPatbYPM3sZq0MCqvvxlvKMQwlbajHURPQ+0g0qm8 -UUurAYkPWXCaow746EV4dAQ+qTJnHIehcorUmanBc+o ---- BV+bxd0OIc3J4uT39al2odyn8ScDpq58SiwnW5pvRj4 -T7W |fJ%"cq{TP~fv,;:免-Ϛ4a -u\L_-VH% \ No newline at end of file +-> ssh-ed25519 LZU5Eg 2I80UG4n18vxvqUJXwKeAPqelD83nX/n8XHi/XVq208 +mDoUzJu9KfUFyzJPoLPU+xhSbGesECEQZSSrc38HA54 +--- J9+vPA8z+/8jcO/V9iVZ3tWJF4TUe+nD6fmjH6f5dmc +st v@<(xEh]8e-$K00T!œ<"5 SC#FZ wab \ No newline at end of file diff --git a/nix/secrets/wg_private_dns2.age b/nix/secrets/wg_private_dns2.age index 64b2ad274dd5725d4edd1ebf5374b6e0da2ed66e..d713bf5602062686b7c688dba8d683cfd794160e 100644 GIT binary patch delta 220 zcmZo*YG9h6Qy*1TTojyFT%qq*8tCTg9b#G<;Nj`#Tw>yp6q;me8Q^Uk7330_=Uiyy z%T-jIo|KqpQ0(N9XlOARcu<}Q4m<3&ZVoXtKb}& zU+xnUnp>P@qHmg39O~$%pIzbTXPOpn6y{`PX&mL48tR%@=pI<<70I=7;m*P=KFd6> zdq*bS5Im`Q@9)_b9s9;5ro#JGwQpTrZ#_lSz+rhx|3mQx|K|?xSr!M#-`;yDzUQ^E XxLMfU%7Xd{!d0R1-`+OZ>be2|8;Mh0 delta 220 zcmZo*YG9h6Q=by*T&^8vSm>0b?d|4~?wXt%QdD3ZP?8v2SzK7=Z0?kAX=YK86KquO z%jFVLkZF{xpW~F`8 ssh-ed25519 qM6TYg yrPEC7nKTt4PKp+tbxOQhhSHkd3Y5U112Tr1Vj8NUjc -ke3GsnxeaGLvKNknBY8SQZj6zOh2c+CiCf3sZXyapn8 ---- 0VBTTW//qOcMYVLZ2jFekgouWeZx4h5JPW1H8Sa4bIs - &4'_Xr#X^dr TY%u!.v)eYޕG޿(APcwOf"ymq1eU \ No newline at end of file +-> ssh-ed25519 qM6TYg VKztNtIZQAJuwFI/DeAmW4RyaoGxMGpYmBPJRJYLzww +0zo3XFJ/tE5O+AFMhhJUP1iCpIgC/d1qr8qpJ1viPj0 +--- Wq8DPbQIPnB46bI0allcQdlFZIOGK8Bp1sAywezGVe8 +`8vM d(hy,V +=QX #Aq> Z6[AQ[f&zeu*v>dzĠ \ No newline at end of file diff --git a/nix/secrets/wg_private_vps2.age b/nix/secrets/wg_private_vps2.age index 4d30264..c83e0a1 100644 --- a/nix/secrets/wg_private_vps2.age +++ b/nix/secrets/wg_private_vps2.age @@ -1,8 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 91VHug cjq3el2rlJCWS3VwM5Dt22Ot/PoCdU5wJWTMosYQ6VE -w/IyVNNAObRJxpV162CojPRE8yYbXJj1kaCBoPo3rNk ---- EDM/kgV9ewXhMvrQfHDtPLl7W46VCbZL5ciBO/B+Iu8 - cL>&²=^$m T4& -ƧI) -c -LQi6RS +T@0= \ No newline at end of file +-> ssh-ed25519 91VHug YHHrtch+bKHxenRqMPSvqqby7odUGontauTfAfTAhlw +VDY1jPyeClwpg7Tq604rU+Po+nue7cBRqhIEdc8iiAk +--- mUabX/gruf9Erp4OeRmCEwd7KR2aTApviipXyCL1P+g + ɤR-Gu:7+"S5SS3\RpM?s0$@$) \ No newline at end of file diff --git a/nix/secrets/wg_private_vps3.age b/nix/secrets/wg_private_vps3.age index a63f54e..e98d0a5 100644 --- a/nix/secrets/wg_private_vps3.age +++ b/nix/secrets/wg_private_vps3.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 XzACZQ lm64+fQEWa9hF98cV/x1U3Mz+6zuM23dAV3XkwE7iz4 -7Rgqd13DThp/JLryCe5xTdXwDujaTj4viR2CBTdXYLs ---- pwebssA2O2VjzPFRAQ0/65+qiiF/MijCIIXexwH5mgk -\fv̤[ڟI[5*׷90'4+V;L~j ;S2yb \ No newline at end of file +-> ssh-ed25519 XzACZQ YPlkpgsyOotrVR/rKOrNqPSBcLYF2U+aZWtPzB8RsEs +zJkNWK8QjKC/DfvjrU8Js1p1ajm1fnrdcNr5g4+rTS4 +--- 7xKrN9yAcMbmvdQwchhkaT8CZTGguUTDPZ2LKxSxppY +qCkPe@}p2qUn!•W؂kZ襟3ޞе. ssh-ed25519 51bcvA mVJPirZJQxHgpX6CkMckYTpJk6HYN7CZYlUPPF1mYDM -XVZqovyalftEtV//FQM11Za+YAEMAuBTypcPQz1+G3E ---- 7QAtADWyWr8SY3jLLzKxPsedOLyasfLs4lK3nmhkOi0 -]JXtE)hSF -$2"Ta`Į{:= - \ No newline at end of file +-> ssh-ed25519 51bcvA kyLCrT3jFu1BszuLMnyP0ej1kL5OvnAu/R6vR+PtYWU +n70Krz1NA1BHhMrJQprm+LBBhY8AeQwI1PvHbF628OE +--- VbdM9HH1CM+4f6z/5oSId9DW6Gi1+q3IuCE6qPKg1mM +@TY(QLYGHGnk ,]&%UfMWqxJk_kh(y k|*=Ik \ No newline at end of file diff --git a/nix/secrets/wg_private_vps5.age b/nix/secrets/wg_private_vps5.age index cbd582e..e7eefdb 100644 --- a/nix/secrets/wg_private_vps5.age +++ b/nix/secrets/wg_private_vps5.age @@ -1,5 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 vT7ExA G9mqOZiAvq+ot4OUevoxvNPIkgWgS8KqMY76uGsxeGs -AMEwoZoFc+axirDc5q+FM3e76IedkxblC3vVqUjmPL8 ---- oXGSsFKfJRPvcU1X3zHN7M6vd0IxBpNowyh4sPesq3A -i3cMTN0}r"Зs~OrPFP`Q<%:73 \ No newline at end of file +-> ssh-ed25519 vT7ExA 2giKg2lnsURC0VqDT8Ibfn9jvkIJUOwIZkRN0Px8OSo +g3ZQzVSDVUl/BX3tAktgkFk5lVKgplZa+vtLYSd+RW8 +--- 9ZTtNf9EG2B6oDyWYST8QiNGQHdYgQ5PoHzEHwW2eY8 +М?M-b>[;^]v|. +IylMs|N5Uj +:ʦET \ No newline at end of file diff --git a/nix/secrets/widetom_bot_token.age b/nix/secrets/widetom_bot_token.age index e414467..15060a6 100644 --- a/nix/secrets/widetom_bot_token.age +++ b/nix/secrets/widetom_bot_token.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg oaTrhtYhEl2Za2fhNt0BgnjXPCkzo1Or9jsLLCnJhzA -Wk99OfMEXXG+cV1LEvC9wf0GeVgT1Z2GA0AtLYCRKD4 ---- 4U4dwN+tJ2LFpIjxEaoZ6HHV5QQU4kr0r0pDXKKcTgE -N]n?!|!:Ml* '?EM@r_ivo:Nilk8S(:֊R/0^xi[xC \ No newline at end of file +-> ssh-ed25519 qM6TYg Xds9FlVzv4E6ZFFTH6zZwG8ewomPq5R3S3/8jDN7zw0 +l1EWvQR0RK865mVQVuCFuo+02HTzrHHlsY9r+E2/Nfc +--- n9KSdsLECG7uH0yD5GsWC/1mTDMXi/JLDJ++oUycTEs +Lw-b}T6kXS ҢF3q4yhz?hS8b=1)P*{˺S>(V+1y#*iBS \ No newline at end of file diff --git a/nix/secrets/widetom_config_toml.age b/nix/secrets/widetom_config_toml.age index 4d13ac2e9e13ff37590f06995fd3836eb76b5e79..d5f7e6fc3cf62ee0cdda32411fb65e8550bd0d5c 100644 GIT binary patch delta 4000 zcmZ1`zf69DPQ7++WTZiolb?HdwxMT{TZX5TyQ^8UiAP~xQBg!-MrNo}pqqPHvYTH< zGMAgSueZNRa+ZO6WqH1~UrBDck6B@+f2ebSK}2SbN04__L{4P7OL$nMBbTnOu0mO1 zn7NO3sJFR~kEwQ*e`;}7MM_pmq_JmOfm5PKx_PdncD;#ZaB5nTV<^|3map@lChlk0 zr_BAeY|iojOB`Inlb!~t6|cLm}tqPQhn=1Uw-Z5NA zqwl=z6n`n}gtoacUFu)^%;t;peNx@&zj}GggS8S{eA1^fE%~M{)2}gc+SEJMU#3XS zoaJ4^*z-^_eQj&K_L4hO&r~V?|1)#L+@ndWX8iTvy4A@#eaX2`=L+|+JX`fV z>mLDmjT1F3_T00l%uTav{b`gfa>g^t#OoI4p|mH;o9k96s)zi@DLBnJBV8iSz)nFz zZ-rUzF`lGP2b*Wxn6JuwJaK{5`I{5MlT!cgT)DQ(xN%ksXJ?$p0h9VA#oN9beA`%c z@Ywb0>CO|FET=4ySf2j!?XtuzGc#&(FPC3_SMkQ#`xNuv%vA)_z$i7T{PZcN^Ih8}yEA8`84{}$Yrk|}77tWROFbE)R6S++moK|( z43b%vmA-hw9N>J#(IdUlJJ9;tlvCl8Uwv9-zGLZJi@vzVS7%$N&VD3t?(XDY`43rr zed{Imi=DRDS?V=K%xH4Z(Tg_0S59p$mT}o;H(h<}Jdc%bE;9tSiv~AbknxW>le7BX zrX!*$EmO3fKFFM^+|_oF(~Ft?!z!&~fBP3lpFNW+lzsM9#F0ILH)mbrHxB)Kb%|JA zS$yUEd9E9L_1Wzk7?^i05BDvSnj`f|VUwH6OC~j?`Z)==y+oK_bj|Z@-`XAdo7wgM z@BRmJZHpYHvne~@w4ZzPC---jrQzHP{+V10KU8;qynE|!(q>MRb9*FwmoE9Xsos$N zWn+WW>->YuXM9;zl&h3{z51eVi+ktlGg-3JR&6@6VU4KZC+nO0rp5PI@0}^Fe|zQc z)g6z2>|R=~IyvcF{r8t2HfYAJ->hBp#KvR2QL4(iCT*q6sDm>WHyb%hUUWORR^ZkB z=aMHf_Rm|rj?enDeTCDB2fGhmns!{)VbR>(oDDo-S7pQP0HDi#bi}tr?{qQ`Yiw zOf8PXK7Q(DlP`Sx>tYjG z*RHQS7m@n*+R6P}Wtb|g3#%f}8kcu(bDhrK|NqP7^|s%&RpWP7h>Oi>TC#ACdGxI_ z#ewC8Wg8qrwsxFbvAv`tN%(E+d(ZlElgqb1d4*UA$5q??mN_@;*_NcgH*TD|zKi|k zZl;R3`WK-mR@PKrGX1$Q?#0U4OC~Z-tlq$_wWs3ElrMMR3lv(#wZ7(>HTmA5-h&Do zHJ3)!9eyIl__J2upBsG6{= zuqs-PMVe_9Pc=)mH1m%`=BrN}kJTCsz2Y~E$17-8{yZLw)|JZGXI+8bDk_p(*8Sf)6#Q35>Cz{k5_&%tN-_WdP1qe zDlSP`n*qlB!_9q?vh_$yK{`> zTPzLu{j4lc_7r%>>+!ApP_;e!`T>=I-UY!2pB)PQo@1fCs40z$p}2K9M<)B3%67J6 z&y#$Y9B}$^+FC*E#^)thmTGu)t=?Q8zcMZ7(340(h3g7m56?>58Fy*#nOB82Q&M$g z+5`95?6T$!m04u6OYQ;N_UC*bPyK81;oZGYt4jUQkNtbY!m=ZCjYHM zsPbghHnrYa_pav7zAM?2>@P2xbwT-)T(d;EZt5*f&3_iW_Src_wLc`S9-rh|&sz3o zUH#=-(L0I${Uj&yyelFRD0Vnx_8=&-ZBm!gLsjYlOg`s=ZE#l z96ceICpOU~^<$vG$@%|M1zA>aEHPm>x*2x**P@U^TRwEDglcNN*tPM_%4<-L07 zW1;Llt~Qmw<@bLP{jhu8GPZk3&nHEw<%Wy&uQXQpZMXEy`@rMpnKP_kM(uj0_vYWu z2^>z6v-a?dyUMN>-}&t4l*8(K`hQ*iFVnbDOM24GN5?;_m(KUyU^J&PXE*CI^DCT| zljqJeIIwongc7@R^^SX0jS})2(;L8*k6Lb@F&|Nxj5sLJU2%yHm}cv5!kMjmwL1IN+F#Sk1s1w})t%pe;tNx%?zg_c)yLl-mP;_n z_wUiJ&XwJ8IzK6l-+jxC zxsF?oC>?v|{H*7q8f)P8*FLK&Ce2*@YuVZ}89_dJ>$yzJLk}<(KGr(var~L2OTpfb z%-BDr`fL$z?>arOE=U^`!$1&?du=j%}=Ga)GRRzy=wfYkZ1bTL>)~% z!5ti4P@2M2Ob?0}A`^A^FIlOLjLO##_%oY7>Kj$6C`Qkx#F}H#i z?@F;-`%uw&g5b*4(^885-oDIt?3E$Ij?`rHhEsx?7WESjUAwSp!>3Y?@ckWMOqZt3 zN`KjT@?2HM+KS3kck}=DhJ55@w|^b_F*||X!do!fbKlZEf<7_2lB&}d#GbsbrdF8f zc>3Q?hc?TwQ>H9M4_F`B2u?4GPEUQb|AhGuzvDJfZZ1Ck`FU90-bU8XvlrTms>@3L z+VxZ6!8^|UKD{#+>Jv3Lwab{Bezlagt6p%m`F3XbLlYnRT~% zZW`WAjXNoIV$u6)mp1s77|dRwx-`dwW%~uY>s%`mo46GvguP?F+lO$(KZ(%~QxQ`- zs{O6bO0cubSfNJGx$@=1$y454Bo0-O)aIS z$vL}o*WYQLy76j{o2YS`cJ6Ff()5|yPH+PFQ{IOHj zaeQTa@28Ua`4V@O~{Z?w%-N@-t3->jf$-c|^B{$Vu_NK$m$IpJOZW1kd%GV%q zp0E8-LvfzNIIl1H}&r-r%B?JaZI`oZ+*-{-A6Zz1PUt?E3eZOjbVZe5#iBTN0 zXH5OS`E26v#E^pux1z6DS{{A%Iq!e=cJI>Uoz>i@zs+*Ey5`b7;q4kbOuy7Um(|v* z47cQb&QSF=E5)y@;?G45ZvIP}(H@cB%um+ni|HPJk+J#Np$OKl2lXkPdzdyHm{!)c zNN(wC)xL?3O}7+@z1;PqIipOnkvr#xx^QCu8$P#|HJ>gy@4Ml=nRim%EGAo9MYZ?c z$(oDSKUY63?D{Du-{ZdF>6{npR`$Y`mBuHQUvL*WmzE&Cc23Arw#xFrre{xz&9-eR zd%!U#rZDtQW1@!hCcDaKA?M!KNA5ll@xJof)D5@RH}B3(vp9E&?fTw%veIkU&c9uA zb@h%tUU8yZzd1k4Tl&7@En~FcblzP5q9h~notpI>lbL4h*19958MHqU-dSzr(gs-=+k+-{HN}*+$PkDM} zF_(F0P@cPaa)ou0ob` zX=a4Jc22g7b5Kd5seg*Ifp4i_QdxOPU|3pVXsKbCe|@B7S)#s|k1v;Tch;YcI;;NI zd}-HLf4-FU@PGS9+fEjJ(c4|Pd}5F8d1i^&y*K5#w(cxlyn()Hg?>ziQ($u){I8*p1{+g{9 zxBdE~bF<>i;U}{#>o?yiley`=imm@ca$w#$p8jN$%0m+#{Bn3E^7Y~y=2@#$B%VgQ z=dSxK##&eR+4OAJp#>YHcCzf`jr_C0yHb6LBU|8k zra4b`I|)eDJ~3u@@Bgop=)B_Q+8C9O*9+O+vL9#(Th}oA9(VA`oWLXX(m&U5wOPe` zzpGD6z4Nl;bFiVg@MVFWqBfEr9-L1(uHeq>_xOGmJKM)s9||{D?@Gc3wa+hmxi)tTe zo&0}Y^S@sWO=YXtM7x$aC8@`Uy44qEw-`mvFD>C%w8y-?>?CJsWqrzC#@#cg>KvZ- za{Y>L(`xT2zYCGxd2?ShhfDdVb%v`{SIpiYbZWgt{j|Wli_CANJiEo-uX=0c`U$d+ z@0@VD(o(qgyu-Gh6DAsWMUJ}Oah`qq&inS*oa`SgrkpA3I9B~Oz5Q*+2H6x_g&uB| zU-fQJd*|3FvmCqZ+pFEebE`ecsxVSp=KNd%-?E-%OMdC(+<0~Iy?qDMN|g)cA-;?9 z`acFFC!UUOJ3XsLi}Wrz1&O1QM=$1?pB>yCEo#>W)3-dmp$roLx>)5(Ao<%0Kh zPtD3s`Y%;H@c(8g&+Nb~uO9a=Uk_X|xOdlLf{S%j{Z997X&&zt7P(q*F8+IA{n3Di z{jLw5M>{nN?wF$>(|Mj-{P$0;O=-HTZDShco;*MAy7a#ZS80GlZH&jcj+vRx6K#Ur z#gsVz#D**L{;PT8ByrH}E5p5vS&QAC$^W!1=<8WvFmKk%Ep1l(YrO7jNd&HmDbJTm z-jVSBom+}rbYwk~vHz!pd%XWwMt@;_-+snJB4c`nN3F?q0ifM0UW6sCC=A)z03y?KLlwWi>)xcY(m?b~a!7u-$byt%dE?}a&= zc6L|`rM#cM!9s9#kQZ?e?9?)5IRqhE5Te8;=LJH?X?FBM<-eP8q9oG$P3yvO?POwOJAe2mhz z2E^|yTV{FcbaFK#%TDG;>uNtF+*_k)w&G~Ou>zev>nF|j*qq19@q59u!&!0vy4dQ) zbC&V<3;t{MF!=JEoBvOS(7TeFuJcPCOaEA9X&*J!=bqW+dlC}14%OGx{~n+6;o&UF zU`IaHhNQle-!f)h?i79g=j6(BbJdy;AN{oK>e02o#Fsn7OMJU7GPm)nnQi?t(_Yi{ z(d)i{5M-ZQlcK!R!q9QzVV^lxmoztCdYZhP=XSlA*A#;zr*i&;s&uYC|G3(ImqpCc z4W4%^wksN*KD8)q$L+g#1R zh3?-jw-;+M%+W}BBJym(uG0Hqk~?$03-U#Kh|E(rtX`ki*kQYUDnp)mr}xPc&ugv| zA0{rJv->>r%F_DZJnqF4nRa@l-r2{Zt^OiOQ>9R5MS%bEe|^R3$1WHyQqHJspA@(D zz_Lw(VW!(2eygaK*qXKCu#;C#@z*!6US!u^O|$UhkyD;|CT6Y8%E$FfFYB7Do8mn4 z%Cm&0?;nVMQeSq+*JWd;mc-l3D-@Tno3mX}&*`Jbe&*5`Pv5rz3H3|ze%Xsew5`+4 zoVow}5yeXTum3qjuI_l1x~jtMZ()ViPl4bo>tZC%n6FfsvMO!U--$cVC{)(&t=jPP z&O*J+SBHuxhCeWw7u{>Q%yP@-{(B{L8C`-$3};QMo5$#Sc#49E&kX%t-?Yx;@w72k zr<6H*J+1n;=-uxHWs9As&*PkATAy*%xW;C>K4*#9smka_o&QSY*UfObDU|g*)8t(8 zB#D_!9k;?8e+UUT3D1=bUb!LtiVgp%JvmQGwobIJmS;C@F5(|p|np=J<=tbI}_0bpO)3_R| z*NDHBsTVgeDA}8>yYWZIemHkT!(rFQz$ssLzKr|UmsKyaJU_-*^QibXr?0B#7Tj209ib!< zl&2J`!+-VD&BvwJrR})m8heFybS=2qHT#sr?ttYn`i8=F_x>5LPbe^aGc#<@qH2ys z3f~l;Zk{RWf9~Ht1N}P(eO_<~u3Dd%##+~2#^~~+Z0C%+&SiC{!+tgAZ$IaKecu-@ zCwb`)Z&hZn*0=X29DRL2XYy?sxrU{y%%;!h3tp=#FRvzQ8$R=H{{7iMCOM^bT+Qm# zFAk0T5ay?^ENXs(<*pO!nw&a@dZBp-mtK}K+aT-p)iI;39-$HgVdL*yt&w90Jla`+MrKK5eb)FBi)K5n5e;Xkzut&+% ztKm(4K}fB6S5^iOSH5_XSL`Br!HS!%=bp|#W6R35`R(z5=(I*tfwMQxf2>;3>vZn< zyw!{kyjM%;uldhy)Dj^hTK}z}I7?gHt7ZOu?swNpLvPf?l$qI;tyt&rtt9!|@hFd+ z4{IYjSekAhOZ>d}=OTHr*L>xhm4Bt4nZHSX>*giP@AlZ4I^WzH*kk@!t@*{8wuUU&Bzrdb?)#$7Yp?$(*N)f5kJ+xL2KYwd{vyyWFOZ+|7sU+s{PK z;(TVVJZHQ3F20@Y-vs@q{>zxrDf&U?^RFG2VX|TdaXT9#mrwiXctgLOk-5z8WK85D zV=)(>1J}DNVuZzlcl|ro@bMMjN|wyhT)sG!B`-y0UonZcwGKLeemQ$>Mn#*uhk&Kn zfd@*d8>Y>-F8F)$ctO(lz}Zr(yj@sM=haU#^r_#ba{l9H5rG4DUUo=4eZjW=p!O?K z<0%453ws_Kr7w+}E|8-4_egLcZ^iLvJPbxRDjz1K-)FU-%Ax5f$D(0%e7<*Z-hp|Q zfr5+lIa<3C56#^4Hp*P-4~zE!e)YNLx|6%>|9yM3ZHE22>wY%>qNZpIc1=&e7+lDg!Vt%2mb-gWm&4{Hm{?b^R6^Kqr(I7>Ox@AiKxEI4-UBJ=uso`ofwi{~zq_+jBy^e^dZ zuhlv$jl*J|DZ6=_IJvC8Yb(3l-FU3)o9xuWw5~yd~cgnF03kv-J!9mGEY~*|5r~< zVjx?zSm~GiH+7TJ&(?>X)~j7}OCU;MYv|>y+~anF@^^Xe7Ht%^$Xw`NcsO?c(zBZ3 z^#_FPb3fYJTKZg?zdkU0p75qm2SVO{mYaGhCHda99EbKz`9iKQzOtOXrf=F|F;mOX z%;jDD{q}2ZTdPkyUbSpAi(VA>^I|Of{#z~2{Q3CSiLTS#bnf2#CXv2L^}ANw>^4%~ zA@V9MY5Ie!{M&ORT%H}dbz~9GU%_9~Hf-FP8FA(Fl?ei|FK*6Cm*!)!Z+)k{Zoja@ z%u9Q+@#hf|8`|a@lf7j0KNPhdaspR(h*v|^}iL5qrEpkrUtIj?uGGWEq z%1euMwj8iClPMDmc+x2n+;6*b#rG$M^=E}Ycxp;3G%h?HxbH%*+T!h#SFCUTxO{r= zuSd6Ig|-_pKJ!W3YrEuXb!OCR3x0|G3F^O#mubhSuNJu}YAxni`Km@PSBpPtmD<;6 zr!?`u^|J-PPMY-X$GROX@0|XB{N(mnT08%skZsd03pU?h_%EPb=*yb=Ua75uGt8IW_P@OBn@6GC zf(em<4?TX( z#u+}l>vs8Uy5wuo@oGPtwy9C!)Ne}*U2h!HqX+IveGw` zQCjz)VW{cMHT#M-8UI`I;7M-?HxujgrrMwr*P5O`%ieg)lSQ1>{7gZ->bpsTV)xxo zFPOem#o+w56UG920`AX^&Yybl_QN<;$#tgl?;50T`rGnz+Wegx<@bD@cP$~@N%NZ- E0Ojwq#{d8T diff --git a/secrets-git-crypt/knot_dns_rfc2136_key_config b/secrets-git-crypt/knot_dns_rfc2136_key_config new file mode 100644 index 0000000000000000000000000000000000000000..61b3a36d237bff406f13e3dc15ff34ebdc0012c5 GIT binary patch literal 134 zcmZQ@_Y83kiVO&0DC=SS8fm#-SoOQ-!ar;0Em}H7p{lfs_qU);taX0;{LRv<<9vlB z|HS|1?iX7n$sMqN?{pM41 sLJqIHtZyxOW5qeu8ysH*4xG5mpL+er+iRll^fS!=NEoy#e@g!a0PL$k&;S4c literal 0 HcmV?d00001 diff --git a/secrets-git-crypt/knot_dns_rfc2136_key_envvar b/secrets-git-crypt/knot_dns_rfc2136_key_envvar new file mode 100644 index 0000000000000000000000000000000000000000..5bb8e79a0efe14fc85b94c13d4e21a0e027b6d23 GIT binary patch literal 67 zcmZQ@_Y83kiVO&0@DY)CC2OB~;$l?&{>z*%_BCqVn`a&*6jiojaY*liOz)$9x)bN# ZdMsBP(sWKE@T2+LE%s+lc=TOw0syQv9}xfm literal 0 HcmV?d00001 From 6b97a5334487ab62f34c6edd6ec88cda5f672277 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Wed, 13 Aug 2025 21:31:45 +0200 Subject: [PATCH 02/36] move website to garage dynamic updates at any time without a nixos rebuild! --- nix/apps/website/default.nix | 28 +++++++++++------------ nix/modules/caddy/default.nix | 5 ++-- nix/modules/dns/noratrieb.dev.nix | 2 ++ nix/modules/garage/default.nix | 7 ++++++ nix/my-projects.json | 24 +++---------------- nix/secrets/backup_s3_secret.age | Bin 772 -> 772 bytes nix/secrets/caddy_s3_key_secret.age | Bin 771 -> 904 bytes nix/secrets/docker_registry_password.age | 8 +++---- nix/secrets/forgejo_s3_key_secret.age | 8 +++---- nix/secrets/garage_secrets.age | 26 ++++++++++----------- nix/secrets/generic_backup_password.age | Bin 692 -> 692 bytes nix/secrets/grafana_admin_password.age | 9 ++++---- nix/secrets/hugochat_db_password.age | Bin 339 -> 339 bytes nix/secrets/killua_env.age | Bin 293 -> 293 bytes nix/secrets/loki_env.age | Bin 326 -> 326 bytes nix/secrets/minio_env_file.age | 14 ++++++------ nix/secrets/openolat_db_password.age | Bin 321 -> 321 bytes nix/secrets/pyroscope_s3_secret.age | Bin 336 -> 336 bytes nix/secrets/registry_htpasswd.age | Bin 278 -> 278 bytes nix/secrets/registry_s3_key_secret.age | Bin 364 -> 364 bytes nix/secrets/restic_backup.age | Bin 784 -> 784 bytes nix/secrets/s3_mc_admin_client.age | Bin 912 -> 912 bytes nix/secrets/secrets.nix | 1 + nix/secrets/upload_files_s3_secret.age | Bin 474 -> 474 bytes nix/secrets/website_s3_key_write.age | 5 ++++ nix/secrets/wg_private_dns1.age | 9 ++++---- nix/secrets/wg_private_dns2.age | Bin 256 -> 256 bytes nix/secrets/wg_private_vps1.age | Bin 257 -> 257 bytes nix/secrets/wg_private_vps2.age | 12 ++++------ nix/secrets/wg_private_vps3.age | 8 +++---- nix/secrets/wg_private_vps4.age | 10 ++++---- nix/secrets/wg_private_vps5.age | Bin 256 -> 256 bytes nix/secrets/widetom_bot_token.age | 8 +++---- nix/secrets/widetom_config_toml.age | Bin 4006 -> 4006 bytes secrets-git-crypt/caddy_s3_key_secret | Bin 141 -> 274 bytes secrets-git-crypt/website_s3_key_write | Bin 0 -> 154 bytes 36 files changed, 88 insertions(+), 96 deletions(-) create mode 100644 nix/secrets/website_s3_key_write.age create mode 100644 secrets-git-crypt/website_s3_key_write diff --git a/nix/apps/website/default.nix b/nix/apps/website/default.nix index e61608c..a64a2ed 100644 --- a/nix/apps/website/default.nix +++ b/nix/apps/website/default.nix @@ -1,25 +1,23 @@ -{ pkgs, lib, my-projects-versions, ... }: -let - website = import (pkgs.fetchFromGitHub my-projects-versions.website.fetchFromGitHub); - blog = pkgs.fetchFromGitHub my-projects-versions.blog.fetchFromGitHub; - slides = pkgs.fetchFromGitHub my-projects-versions.slides.fetchFromGitHub; - website-build = website { inherit pkgs slides blog; }; -in -{ +{ ... }: { + services.caddy.globalConfig = '' + filesystem garage s3 { + bucket noratrieb.dev + region garage + endpoint http://localhost:3900 + use_path_style + } + ''; services.caddy.virtualHosts = { "noratrieb.dev" = { logFormat = ""; extraConfig = '' encode zstd gzip header -Last-Modified - root * ${import ../../packages/caddy-static-prepare { - name = "website"; - src = website-build; - inherit pkgs lib; - }} file_server { - etag_file_extensions .sha256 - precompressed zstd gzip br + fs garage + # TODO: run precompress script + # etag_file_extensions .sha256 + # precompressed zstd gzip br } ''; }; diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix index bd5f448..24d1418 100644 --- a/nix/modules/caddy/default.nix +++ b/nix/modules/caddy/default.nix @@ -4,8 +4,9 @@ let caddy = pkgs.caddy.withPlugins { plugins = [ "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3" + "github.com/sagikazarmark/caddy-fs-s3@v0.10.0" ]; - hash = "sha256-HdCXbqrrGPZSdHv7bZvGz9T6loVbrfKydTbjTyt5Wt0="; + hash = "sha256-wHxwRimtLCd/lhF5IQloAZoCfXgGEnkgeI77ObdG7cA="; }; in { @@ -25,7 +26,7 @@ in age.secrets.caddy_s3_key_secret.file = ../../secrets/caddy_s3_key_secret.age; - systemd.services.caddy.serviceConfig.EnvironmentFile = config.age.secrets.caddy_s3_key_secret.path; + systemd.services.caddy.serviceConfig.EnvironmentFile = [ config.age.secrets.caddy_s3_key_secret.path ]; systemd.services.caddy.after = [ "garage.service" ]; # the cert store depends on garage services.caddy = { enable = true; diff --git a/nix/modules/dns/noratrieb.dev.nix b/nix/modules/dns/noratrieb.dev.nix index b14b131..69c36a1 100644 --- a/nix/modules/dns/noratrieb.dev.nix +++ b/nix/modules/dns/noratrieb.dev.nix @@ -60,6 +60,8 @@ let }; }; + garage = combine [ vps1 vps2 vps3 vps4 ]; + # --- apps docker = vps1; hugo-chat = vps1 // { diff --git a/nix/modules/garage/default.nix b/nix/modules/garage/default.nix index d50d3c5..bec56ba 100644 --- a/nix/modules/garage/default.nix +++ b/nix/modules/garage/default.nix @@ -53,5 +53,12 @@ in }; environmentFile = config.age.secrets.garage_secrets.path; }; + services.caddy.virtualHosts."garage.noratrieb.dev" = { + logFormat = ""; + extraConfig = '' + encode zstd gzip + reverse_proxy * localhost:3900 + ''; + }; } diff --git a/nix/my-projects.json b/nix/my-projects.json index d17941d..aeeebce 100644 --- a/nix/my-projects.json +++ b/nix/my-projects.json @@ -1,29 +1,11 @@ { "website": { - "commit": "57c4a239da5d17eafde4ade165f3c6706639a9b4", + "commit": "bf24af343128c6ac4e4b7d1034315df28121dab5", "fetchFromGitHub": { "owner": "Noratrieb", "repo": "website", - "rev": "57c4a239da5d17eafde4ade165f3c6706639a9b4", - "hash": "sha256-or6mCQjbc7tWAzzAKQpznZv+2vWJMhyzqxBPwRE2HKw=" - } - }, - "blog": { - "commit": "ea2758dd10f29e8d66ca3f54d7303f2ac20005d2", - "fetchFromGitHub": { - "owner": "Noratrieb", - "repo": "blog", - "rev": "ea2758dd10f29e8d66ca3f54d7303f2ac20005d2", - "hash": "sha256-LvQ41eJzOvI7mLYDTvlFwGZ2TKrZO26rasydqnEZ/t4=" - } - }, - "slides": { - "commit": "0401f35c22b124b69447655f0c537badae9e223c", - "fetchFromGitHub": { - "owner": "Noratrieb", - "repo": "slides", - "rev": "0401f35c22b124b69447655f0c537badae9e223c", - "hash": "sha256-K1Me4wf/GSfoc1PGWVJygPyTVV8SXienxUrzXkdCrjQ=" + "rev": "bf24af343128c6ac4e4b7d1034315df28121dab5", + "hash": "sha256-lmOyHLWBCurLuN8J9sRCO082WRqL8+/OXN6W4Jq8W/8=" } }, "pretense": { diff --git a/nix/secrets/backup_s3_secret.age b/nix/secrets/backup_s3_secret.age index 4dccf37f8014f2d2f923bb9eb8c4ddbee3356845..58127545cf030cf06eadd4100182c0cff54d5ff6 100644 GIT binary patch delta 682 zcmZo+Yhjz9Qy-d?nWk-?X5dzwTvp*>kRMWD6jADG8d{X+6_gbf6qK4(o>!6->gXA4 z!DZr8;hg8DomgdL78qPyXjY~jX;$Q6TIFLNm>Lxjke%#Ylw4Vo=AY!6&ZTRoP+Xj$ zo0?)|YHDbyU}+fUQJSvc7oKRY9pP){>5}Ui5FBZt?^+P(XOQMx>XsW(;a}oiY~<=) zkW*%y5$vAN6_J#0mg^Rt?rmaHQR18!kQwBb>*$+S8WoY0>Xe#m9F`pwUR+gX=$k(A zgG6{*a%EVAi$z$eWoV*hTDVV!cace2L3%-eM_O2liF2`KWUxzxak`;Fo-bEKMxsx4 zVtJ8&WucF`Pq>LimA+X)wo!PRsYSV|iJN(ag_*m4p+Tf`mha?vM)7b*mn?(qsPy8b z^c0ty78O7^!io*(v(~OFpa?&%rs>-XDQHSmkw zXIdk0qw~kc=CU^-EHk{PKSnVh63clPi-1=;-h8Kxx%`fLu1^tU V-S0EaJ$YF__llI2P1{AE0RWek^Hu-= delta 682 zcmZo+Yhjz9Q(s}2m>y|b9$8jt=9QOfn(3IVU8!H5?xpRRuI=fc6j_|?TlVy1t70>X~R@Se%-a=c-@olVoAwo9~erR#*~l>YG3D zgG6{}d3Hp&M@4pFWKgPaX<$Kacxg(OiJxVqc}QA`t5Jl1MpB4DrDuq?dofo*Wtn4f zZkV}`fw_B%c3^U;X-Sn^TB%8Hc7d~VQAS99qH~H-M3{bvPx|C|M)7c?vh=E?Tn}Rl zb3?DnBK`7mFXzli-#{Pts-h?#Cv9i*2sdMI!%|~Yw@|M1BFhqwq_pg!;9QrCAbmFr zlR*E_kiZOQOY@|{RNu^~FrTE7l1j&{aNo&i8O7^OoI=ae4Wjamjh(Z7EkjF;4SjKiZcrewJnqUB7^jei-HrYoGeQN zvrQv&BLky~z4J@M^i8;Qb#)a?qq2%q{9Qa#BbDFYjlkj6KZ51uRSV&(lqE_!r8tr$_nY zhI3XLg`Quy*%t+-P4-#ys_A~H=8tFKODP+YdzTS>p5Do)95dTr8)pKt$E%;{O> W==8HX=+Xr4bu-pf8fcw%dI>tLUtQ=g&jk>lv?Wf0-+7hsTO1krG}Rl3SSPnN(6}kX@COUzX~x?H1{p z&y}AY=oRLZp{-vT7*gQlU+!E|nXPYJQC#I-Eoa0 z<8I&=6&Ml8rJd|=mS&M#T4GsQ=$ztHVeDGv=xXMgmRX$SpHX3C5|CnSTx4#X9h@3E z@uNhTb5Tx_OG$uhVQEmLnX_kAvW2N%c1d1PcxINdaX@5NkxQtnV?bG0MKV{CMP8-0 zW2v*dwsCQJh=HkhUcR4&Z$_R|WK^L~rbo7^hgpGNNuYVSfAZvbM)7c`>=HwRY)|*# zRFC2eGyRI(yrROApwK{{f((~1XJbnrkB|!I>_Gh_qin8{Lbu#BOG}Spzl`jBqwtLU zqyV?X67ve}EMv>i45QM*2m?d&bW2Ycr@+Z)8O7_}O_E)Lg7dR80wY}Yjf*V{3(H(f zolPyuGs^rteIg6WUERVQU4nuQDk8ZG+zkWDDvZsX(p*yuqWprh{EIzJJp5dXjSMSN zi}fw@i!$9as(iD|67#uqb#)aCGD5x5D)LhO1ANUqvdcXSL%h-}OaqDyLLx)c5}i#8 zi`?oBLQ{MK()B~RB!q4&q_cmNJoRMtu|sT;8-6WT+L!1kP$RQf-v0NAICU=xiP_e^ z|Jf!i(p+}Ch*_tlLsaL$?e5!#!BaY}F4YtJWR$+q>zLeuWp3Vf3>Lp8{?⋘myXR z0LjIdSDMCuFbizv-FQ->X7kr~=Z>{lwRE%{v!BtXQ!nH5Rri#DsLK!C+@JY2J&*7I zJGj&HnEAzt!Ob1ob!vK!e?R;S-Jl@l?V9A?qc*9h^WD|JTVLlmyU8RvKFoOD`u;`M zV&QbI9s%D;hmY4!*6Kdwe}B%3+V}2HqQgT`ZSL~nRYFZMJR$LKLV(6Y78s<})>g(?2 z%jN0i8yRkqWfJP>;-PO=nq}k?VPvjfV6L5RQSRbv;u2w!Rg{=t;E^AY&ZTRoP+Xj$ zo0?)|YHDbyU}+fUQJSvc=I|B;+9cpP@0%;ToI`q>TZ~llM-y1 z@8|F3loRaAWg2SX=Iv!@;*@6Qlj&?x>Kjt%7~~pSf9d9kN|O1_hSQd)X$x+7OvaB@Ll zPDZ7EL{e!*L`H5@a;a~McWzKwMN&jXk+!pIxKDV1t9giXVgBTJM)7b1Zxg=|?VQ50 zOar6Hykx_$q(n1=B>hmIyj)Y`poq|bh*Ap+!&3K@pkl75@X*M>luC2s%#g?&@3PR) zB%=%?Qv=5wW7D#*6w|`=aF@J{uoR!jJjcmr8O7@>65X;&$_$I#BdXGKEByi@{fj*; zO|sJ>&CLrvGSiAn!}C&8(;T&vLIb(XtNfFE3Jc4;stVoxeX0x#ODakevkk(64O4Rq z{QVrYE%c)TecZK^g37scb#)ce3WCxsD+4WpN)jV{vXVmbva|C{^Bp}soebQyogIy{ zT}|qfP5r~nlPXQPsuQ0D-1?@^xFH}fjVFx#8t;@y%c}2K(DCkJd`MPVIT| zVfCSx3%q6B7Py_``1<0~s@;W(tkxTC;(T=yYIF0071y*DSEOy)aym`nz8&A)HqK+= U7Y`l2#c|Ry_4-4lnlg=v0KvWaVE_OC diff --git a/nix/secrets/docker_registry_password.age b/nix/secrets/docker_registry_password.age index d673c45..9761e6f 100644 --- a/nix/secrets/docker_registry_password.age +++ b/nix/secrets/docker_registry_password.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg kxQujT+O6ZGlzTONdS/18DUVoxNapwtxitQo8GKr2hc -b7KjCjuvhmWcqNB6BvNruL17Ww6yWkVKjjm/MGd+jlE ---- q3EzroLr8b0T2gKQ4xUR67YOLSwFP1V8UxAnKY0PP24 -l0g1CXqi{Ttg͇߭ەߑEs5hxk- \ No newline at end of file +-> ssh-ed25519 qM6TYg aOAjlUp3G75gqvm+LVZhhAg45oJsobkyDTLY49b/zRU +pogMMIptbR/b1RKM3uJxEHT9WzSyZSHFQjAsNvcSAYU +--- t29inWsEHgMh0rx6BGbMBBvCy9wrhxqLmssWUBgZAxA +Izb"bD۩Pd@fŽveŗpk* e diff --git a/nix/secrets/forgejo_s3_key_secret.age b/nix/secrets/forgejo_s3_key_secret.age index 9e4e8f3..b08b423 100644 --- a/nix/secrets/forgejo_s3_key_secret.age +++ b/nix/secrets/forgejo_s3_key_secret.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg yxVVZ7LOgN9NiKsl1+dN7Rp6Rsf0zlqb25Y6w43styk -gQ5g7TL8+lyGp0SxdcoRg0nTpu1w6WbZZK0ERyqRpkc ---- 5uKpMbkW4zZ035mNXCuty+64IZ360gly/ezxnwtRX/0 -ˁSϸ>q!O߷TCUҺ[*󅬟\w݋tcg? |B;"*dWv/vnqe \ No newline at end of file +-> ssh-ed25519 qM6TYg QhiVyWtk2dq2YqG+wQFWaZLFHQo05mBd92IKwxMjqhQ +nOLu8KsLxTOKBGggph/qy3Y1sTsHoWFajEQ3XFf2ktA +--- x9n+BLZcUdhVJ1nkUWcYL2IFztoiItD0tI5AfScS68U +sj١H'ǁZĿo@ݶtowZ/Z #bU0+e`X\ M"y+ :^քC@U+L \ No newline at end of file diff --git a/nix/secrets/garage_secrets.age b/nix/secrets/garage_secrets.age index d9d0ee2..39b3bdd 100644 --- a/nix/secrets/garage_secrets.age +++ b/nix/secrets/garage_secrets.age @@ -1,14 +1,14 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg L6XQVJyw/T2kwH2iOa3dAxwxlAInVTKXek5QHUKsU3g -Mm8VXH3CITbrJTqBcjdMHGm1k7Kztd4irHqWnF0yKWM --> ssh-ed25519 91VHug 2PoHH6c5lVj6hfTH6+2NLzJcpXh20LgYgUHYrpY9Wg4 -iSaKgUoh0eSjeoiZ7mggn7LWV9C9xsM2foZrpJZY/ok --> ssh-ed25519 XzACZQ xyYG90gHM9XHAxIv2cFU/WvZsdLo6prAPQgRKADP0UY -XdiJz1Zmh3S+IvaOCZBqrF8DSWBrrqePjy+ZiEwuaSA --> ssh-ed25519 51bcvA IYyt435x3NPiTKDKCVb8dIK5naOSyU/Wh7dOLQ6SRAM -M0s39vyjDY24Mlb16UHy9lFEseaJxzZhtCvszKxwVSA --> ssh-ed25519 vT7ExA ZBvUjCU8vYFddKgNfnuROuiDnDXhitG6eR6ek4+1R1E -fiyuqamkakZ4t1MosIUqZaR0WEh7XVAwJiwH8lz3bsc ---- zvHNHd6bOMd0f3eIrl1qzyRh6zUe7G8mdrraYGtrnXU -%iFrљ`|)+ώܝSGNP>?E{֦mdadj`ԈVunZֻXU旽}>j_D_; 5Opa; -~4bwZ'70^2+wZ0j;4yTdp1'9 7Zsb.J *(yW _Pg`S^Gr \ No newline at end of file +-> ssh-ed25519 qM6TYg 1WRiwfAjRtvM4SNe0Kb39CNjo3HbOTAyFtqxLCtbmxs +IvaCCjpo61RBYwcUz/QPNFmxZaD+F48LIs6ojdBqxok +-> ssh-ed25519 91VHug 0FQFOLE2YZF5GGqcjaHap9t9z6xvyVkY3kzsUlU9cSI +j9hGw7d+UCkOaN4K/GGChDdQUsFDt0kw+bj/+QP6xiU +-> ssh-ed25519 XzACZQ tGQdswquRCp+iXrYXHLlg64DC/lor2QvgiWY10Shkg4 +ejl3+e9EVGyS+oP3161B0VdfXup9RPeyWI8wHJliHEw +-> ssh-ed25519 51bcvA La5y55eSktxwiIQaNOzEIh8QFTv7MvToPVNefwgpAFg +e+mKIU1sMXbQmZ2EUGEAAV4vdCIY24MM1/EGrNBn7+c +-> ssh-ed25519 vT7ExA McL/w6ZheS2TkmfyrTsdbdtT03hsHuqMx6VwpMtHDF4 +uBvctWaqmECReOwyW7rT/OsEn9b8qaivo4n5RQ3Cabg +--- AITRERll2MxhVYGt8EIbYSOlEDfCTfRm2/jvgvvPbqY +(CopvjI5le\<َ>6x$i%.OxQyrŗ7 +[%2DYđNTp& &.FL?Z[O(P@xj[)F \ No newline at end of file diff --git a/nix/secrets/generic_backup_password.age b/nix/secrets/generic_backup_password.age index c666d437f49353c054ff94377b0eafed1547d511..c5f7aa629c69660f8025476d041a0e3d102dec77 100644 GIT binary patch delta 600 zcmdnOx`lOuPQ8auWMV*sQF2JJx2vDFmwuFGUQn)ShG|uSxwng1K)H!)XmXj4d2Ugl zD_4qnuB)lLi<7%wl&MchP=>Q(Np`5Er%RHycSUwVj$v7OWo2?=aD}gbAeXM4LUD11 zZfc5=si~o*f~8@YM`^l(e@2N#nMIDVmtR>{MsS`}q+5`;Z&kKOT9sc`p>|<_UzSHm zWRz!Fp6_jz8M~FK9!T>7$w3(4f6s+LbCNs zN`uNOQiD@{Bct52EvrIGLi5Wj%*%}mQVRnjJc>;GU9!0fi+%kqDiig+{L}q?%?rF7 z^Fo3GJ+fU>vy<}OoIO+B{W7u&{Je53^IRvNWt6B7s!DbDFiNbf3aRi93(3&0swnVI zkEjatF%R)G@T;gO@pW`F^zbza_vA{l$jT0hNK2_QO3Y8rvIxq{N(?VB4KDVMa!v}( zk4!U2^70BWNw%!YPv_Fr)m2E$NDV424o~t;bu}qYbx961)z9`XaLdYx2+>X~%L&$Z z3Cjt{3W-Qf*H7m%SNyHI=3$F>`1xCFqBU~@Lgv0$v5c{s>zcZduzTz6-#@fMgl>y3 nOJq>B{hNIHbngsf#~LY)mcKhK0#4*e*1Rjz;(Vg|)#5Gy&5qFW delta 600 zcmdnOx`lOuPQ9m7m|IYef0&O)a%r$xMWT6Vn7gB4m8D;ZQ;A=>ds2y|NwR)rh?7OR zD_4kiSV?h6Ub>%)Wwv9AnTumdc5#HCNkwF_wyT9#RB(k$s(-GwyOD88GMBEMLUD11 zZfc5=si~o*f~8@YM`^l3UTAhuxkq|Io>8W$nV(;zfm@hksk?TOv2%oBQC5keuR&Cp zcb0Z$R=ImVS8Ad~P^Fodr&msZzkgDsc9~J2sc&{la#W#ns*8`Ke}%KDg>iVKv4uza z#E;@(=4sj%k;$pazGdZk{^{ivSwX&`p`p2!!38GCmEHxOQQ_gfE=5JoB~|HMPK6mM zM%e|WA?d~u$r-t+rsW=K=_Xa#rJ32Oz9t@)?kWCJVWDN(9#NCy7$w48LbFYri`^qK zQnE}+JqxQM3-aA_OFW8AQ}VJrokEigk}a#U3|(AHb4|E1+*6ISOe2%?^uxo#Ov}^L zwacPPGmN}5@)C1B9G$a0id@2z!_u>Zv+^gOWt6B-Gc)(kPVz1DFGzQEigGE9C^rtZ zH1RHsFg6Nvx5&%O$~TV4%}&b9FyJ!vHciWOs>lv>NsKHn^$p0V^b0kODvI*S%1+PD zb2m?^@~x^Yb@cNs4dv3+)m8Ay&ojv~(XU92Dh$>)^DYiAt||`m&kyrY_ew7gaP_Xp zEpZMo4@k~Wc6Q{t^`>p}^sSTXx>^Of7QOZB(a!SzcYn=%{rZOjv6mMpK55$4vq;aJ oBWCrqmh3v4?;q3H4?ABA(Oc!uIRBNv(WP362PJq}WT)N+0O{`1%K!iX diff --git a/nix/secrets/grafana_admin_password.age b/nix/secrets/grafana_admin_password.age index 59a4c17..363d61c 100644 --- a/nix/secrets/grafana_admin_password.age +++ b/nix/secrets/grafana_admin_password.age @@ -1,6 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 XzACZQ OeTS5wU4ac+Qh7s1PXbdFH3LDlRW1LV+qFtoVGI47XQ -JsixYPLzpnF45ODQH7nuVowXzwbNQi8lWx1Bp2YFVWc ---- MEG4bfGwoFRm9HizYdqtK7KApYhYH+QjAIEp7CpLznA -C/wC -Fz?MkrxN'NTzWb{Aj3X6mݲJ@OI{u?A,C d^ \ No newline at end of file +-> ssh-ed25519 XzACZQ kPs0o1RyOBiyicD/j76VTf+ZEF9qgl4OXGbsJKupwlM +s2z+UPLm1r+GUcKd3Mh+M+cOaCiGxtKwqTFlSoWQLeQ +--- 7+XH7gdCThNz812SwfS4V4xBacSGPoOhIJCt7NYR++s +ĝ X?+^DΙw{Cϸ1V]㒓w?%өkSߧ5NG)*- F2HA&Z=,*C'z- \ No newline at end of file diff --git a/nix/secrets/hugochat_db_password.age b/nix/secrets/hugochat_db_password.age index f5e1cd01dd7d5b4e0af280999ded36584c31a78d..bde5cd84a00b5f8bfa2a9e4ad01f936e1bdb3c89 100644 GIT binary patch delta 304 zcmcc2beU;_PJLOHMPiwcXHUev(;GrnXT;u8EUzWL{u)gmGZ5yHlQPYPw;j z0atRVyJvc#SCD?btA15dR8fwJlS^rSN}jf9h>wMDh-X2#c7{uMMwq{mE0?aWu7X!a zVR~9%K}DHkSx}U#MSi({SZ1oHxtV29c9Bz(hqk+4Sbb$`Nm5j(Wipq&*WKpckkFoV z$qW8#eWKL(*cN)<*PRg39DmF~U2`KxP{`vX6;Yk0gwky~ZYm!_4qmQ%>FBrknY4lQ zZ?~8=z5a2|&(Boud8!pMVaH>=KQn!zR3EjpFMRpoZ_CPn+W1N@-J7erMdCK;F3m2T zd|fQdMf3jM^FU(MI*jQtY2k(JRbw_RLdLBnOK2dR4(<7qicP6~l GFB zU$&`#m{*p$i%Y&ws9Tj!uA5`Ahe2tiiDzVXwyRfSWqoQ+aA;L#WigjRm9fh_LH&8k zyoK`(EDOU{KisxLisf7^gOcBr6DJStHa{8cw_)dnbv#prSGmoT(LSm;zBMKHkLeT?+oiNHpW~F z7g=E5Ci3R diff --git a/nix/secrets/killua_env.age b/nix/secrets/killua_env.age index 3ac6770437142fd8e75f73869d3ceaf93e8d66ec..1d8a07ee5aeb1d60e8828b9cf3900751ee900de8 100644 GIT binary patch delta 257 zcmZ3=w3KOrPQ9^5uyazWM`libp0l5cetCGJlWVG}drDZShgXVYQIuD3Kt*DtVP$Ag zHkVJBfooEldAUVcVyRPvPl11Uri)WqZoW&BW1@+LWtxj+PNYSFdzf#oCzr0Su7Xdg zv1g>Ac9xT0MQ(0@akhbTxk+A>Yf5^dwr{3!MR<0OPnD}@X+~*?sV|r2@7*7tr_K-v zzbKHHwtr*uMds^K0z5W{ORme`>%A88;y|+0o}!lC`pBDpH=i*)zxYM(=9|78sVbY} z+Y+L;9AJH^ka#Vq>T>q7zGQyq#k|J_QYLws@$3{?71sV~#cHdIA|hHHt_+vlCQo}E K)4!zjkTL+!%4VVf delta 257 zcmZ3=w3KOrPQ9hSXJU9no}<2-bAgeeqp5$fS5;AneyX9Rk*Sw)Rd#+@rHfCxYea^T z30F?4c0^i1xN&NrziU=;rE#EnaB*U?eqL6op_hT7afC^wS$>Y0vw37hAeXMLu0m;! zdsU9VV}(<8iA!!oSh#6ffLElExoM=EwnsrxsD5dtL6yI2qQ767qa#<#ZsB_sE0*rN z(7%E$aOUIn(*mm}{1IT;@#n4c3aQ@cFkz**J7J%nMrGY$II!7M%d|g#`k91v5vnaS zvicB*NPMWB9$ z30I^=R9T3zQ&3P*j&E|JcCt@WU_?q-VrW)YXt{r7W^q_lP*!PvxLa~yF_*5cu7aPb zwqJUorA3&RsaIJ}foGztXIZYci@#H9wn30tg?VC5XnjUiVt}V4^W}Xn z>KuQbT<|t*L-38nT!vc*H~otFz`K6FX)fEgO>ARqmoAkjo`YTT!I2Sl~ul&vY(@9Z_s}zdd*9fc<*IHdy>*Hn=@TE#o$^62$ z54uZQ&EqP6?wmc-K1rg={FdG?))ju$&jjXKO;FU_r7H34MdZ4NhO_T$w*|yAKig&_ uUA~j|t ssh-ed25519 qM6TYg k3jtd2qoiQCsKZYJliH9ySFuO7CVQQ5Sv2ikFYcaD2c -TSIg6y4C2WaLQJUyNT3HQOj09VmKSkQxlsVlaDc+1tY --> ssh-ed25519 XzACZQ NZhP9TD5nYxBMgO1O3vDOITeh7qxq4vhjG7AppQmRlM -I1JiT8ISWLVUgoCphHSbhYvfssfP55NuBI2jclG3DVQ ---- 6UR3wbSTB/f0s8hP/YHaY9HFDpnLAts0yksKCv7p9BA -ig502LQkL -vÛB$5m #{_8j&+;Z-'ƒWHSыaf?56[t8&Z_/3B_4n \ No newline at end of file +-> ssh-ed25519 qM6TYg rrAASuKrjVYunxCZCyiGI94hiIcnj5tCZgtrNwDM6Dk +drt/hxV1oD6F9km2P6ODRl48o7Z5DzNxZzGp475gJdk +-> ssh-ed25519 XzACZQ aC2p4JKStZyOBcAOxKMHm1CubsILvhLm0AADzYEPB1Q +rTIR+IXgD+65JmE+GNTmZUHYwjOasbHMyS8amWLr+6M +--- Lq0EHVDsbHi5jo6xHl8tu5lNmlm/4+gmQCXDzJ/RJ9c +A P #&h.$3hm/TߖilG٥\)&h ^HaQ;F>\ҬH%tF%ogxSaF|XwLgfټC +!' \ No newline at end of file diff --git a/nix/secrets/openolat_db_password.age b/nix/secrets/openolat_db_password.age index 4073e15563f547ce8ad0b7b2c7bb145fa195cf97..654f947d956260054b062932d1977567da1ef766 100644 GIT binary patch delta 286 zcmX@ebdYI+PQ7VKetMNrPP&OlR8>)`aZ+e`QLd9?ie*uiv9?n|p;Ml@afoY3l6Pcy zB$rvLp;LKQu7|gem#0aDM}=Fke`a=is$WQ;QAt&%lUs0NhEtALhw@o`F zGu1?MubKqRUV4Y+y6E5RJ@rnVrAuGxaykf2ux#zL&+)#$b+^22+&zv@=uC5oPUZxd8eL#r=-JILiXkS8E=2jN@V!cuaFz+RxsPB@UO!M o9l67+r#Z@gcdHhEx!ET2y+S(cX}PA`M(q)T+Dp2B==84!0B0C+_5c6? delta 286 zcmX@ebdYI+PJMP{Wk9fjlUtsDkV%wLfp1j4en3%3M!sROWw3{~ueW<-zDcNSRCr=| zIahd*uVH3rutj;HS7lC$Nl{vGQC6j4l}CwVwsxvPhL^9Yai)ofg<(cYB$uwPu0n2T zK(c#SRiS5Kq;FVyva7eHnSo<+gtkGRuc>Q}iC=+HVZB#rh@qixRz8<|wt`f}{o~=w zyJr0ldc~l(>(ioD?q4R>`FB3uSQmP?Z?T%~L$Ob443D0#30|^y?K-z`wt$J1cW0an zy2kic$47Ls+Y2E{nJHQaZ94pn7g&jYEb=<@_-HBTwWi=EmYVQWm$oTfkUplaWG8#p p;f})Qvq%0{E;fH6{^VG_%DtnG$JPk*WR~45(zxCbYph!S6#(kyba4Ox diff --git a/nix/secrets/pyroscope_s3_secret.age b/nix/secrets/pyroscope_s3_secret.age index a2c7dd5a58639b5b736a1e0756ffd89c76cb7e5c..ad31ff90a16b10d86cac0044c29b09b5c3edca01 100644 GIT binary patch delta 301 zcmcb>bb)DtPJN_LzPYw>wntc@d2obLK%|MAw|Qy4wy%CbMV3jjuSt??PF1RDRaCxf zHdl#Tfk#!STUKa(k#=TrL8)OyvY}(Pxlg%&q=9j$aY|M}n!a(FkH1N>E0?aWu7b8# zeo(frZ)9L`q+x(%v6D-xaZzfXrE67gMR0nFQ)swbRK0ddL`iUAb}^Tjo?e+l()vAf z%FIKrXRbT>X!fC|Cs)i=oOFG@7;Vyu@^LUY_j8IS_s7Tc*JVh(UjL3Wr1Hdx8Co%4 z4zQ$OSp0a-eAjt?Jib;gyc4IhtZ(CR$e8DJ*0r!>```5J4Pgx$+C3^Sf5cwyOUSc! z;Hio7o$02OB$%rWy>UX<{wHw?dLq(MmXU#Kst*_e Dfbb)DtPJK$cV|bNodXP(cqQ1LPK#6&&X>xIeQBtslXL_Y+R+W*vSBQ47S%{l) zAXk<}m6NuYYgvkyenEs`YG#Udeo?MPSYc4Oqot!|rGI*eNoZb3lu?#JHkYohu7Y`X zcA2F`ZdIX6N}g#!S-NFphCy;cv3E|owx2o=a3I$)ofj+L&2fuw z{-djYulPdBMjr{rON(b@Z`$^tB5zW$C&Z~ouc=3C{w F0sv|%ej@+? diff --git a/nix/secrets/registry_htpasswd.age b/nix/secrets/registry_htpasswd.age index de9e94aba7921b8ebbeff0e436749aec108abe2a..d52861cf49ff878a385036d2269cea696c0d8b3f 100644 GIT binary patch delta 242 zcmbQnG>vJ3PJNlNWq^B$c1U=xQ@UqmQfh{`L4d!BSCNaphigQ>aj|orp?RW9R;G8L zFPD3Szlpn#tE;I~q;sTKh=qqsT3&@&eyCriNw!&Jrg>I*RC2kIpSNLtHkYohu0la- zUQl4Two!0owu@Uu%Nx-Zw_<-Y>$T|X}7 z5Sv=OF4_F|M2@R=!pqX5%7A!mO+ZVAji#~Y$ vsoay>pK$W^v8L=J*3Bkr!QIFDf6sch#eSW}E7iNpqti=H9RC>qkTC)P_IhCh delta 242 zcmbQnG>vJ3PJLo-nV(m-k-LGHmq)t0f4O70b4jG9S9)bmp_5~zOK?Ppw_l`pd6G$P zK3AesM3H%xpMic@s7pwNvwK;dc79Tov6pA4K~lbVa;}L}Qn{OBW=gJMK9{bpu7Z*G~ke!BKjs$+# z#9YXJ?(d~3J@%U6laEg5oZImK#;qAM*reJ`UahIRm@J^=%yC}(XphI`+(6B5eA`*r vPG9L>sNBPE=<)de-$QxHtJlOGOT6>jeb?-bdNa4GAL0^HS&)>xMe+;)3khIH diff --git a/nix/secrets/registry_s3_key_secret.age b/nix/secrets/registry_s3_key_secret.age index fbd34507c893059b97c403ab184623ca2b21475c..4430ac3c7fb3c58f8fc85e6c5e374cf9040324ea 100644 GIT binary patch delta 329 zcmaFE^oD7IPJO6TL9$VpQJ7b1iEBn=epN=cyLNeTim6G3YetcOQGt1`nOSABSz=a} z1($wEXts;FK~{cFeneK1Ye{m1SD9h4g=cP2T0oU{uy1B~nTc_3u8XgkFPE;au7ahp zSx|6+W2J{lVxebRv59xFS!#H2WMN^NQ-zOyRGMo}Ree%rmWPvec{$hrf}jKJ%2LYb zQ$kCg?CG^iYWezl+Rj}OzP~=^*d>@tw+g(fYWHN$cJ-WA82aFi_D$zMn!DxxbuXXs zlk>WG%_T>({TDk|Mt}IhoMOD4 z_k!O%0r^d5*V{Vv^vQ`T)`t7aUM)DX;lO&PYMW_o~h*K6@ hc&FW;nw}G6TmLlm3a{9^N6)9lcAlyeGxgYX8vw4Iiq!xB delta 329 zcmaFE^oD7IPJL=cj+tqyPhLb~U~0ahnQ=yxWxhpKxnaJAhj+P`OQ>6#scV6AMQMh+ zBbR4-PLRJrRbYyfsj+2-NpPi)MNW=cwtkwwp}BjAVMR)Ql6gs`OQ5TfCzr0Su0lk% zqqk2^vUaw)v1M7IacF2!iI;D=e`J+YURY$IM_6UPNqsh-NB>bbpB&q&&{|@^zDr*+T^*wwRU;EaO(O&F`m{d5cBy$( zj-h36UV)PZSALR@lZSJKQC?DBYDQvOWMWBFvVWw1YGSZkXm+}9d5UGFVPZyMV|#R1-iCB@oCC5}#I?nR-K;~B-n0}36@oRV@% z(o;(#O#K7Xi~IvhoV9}^qr&nl+(NzFoXady+$vI|veS#Xii`b{^#c-3j7p;_TpYav z&9l4%vvTw+T--_{%rXiJ4IGV9oh_nFJd8sppJf!U&(SZ>s|OvZzYW$nnoG zuE=r=D|PnIO7%5JH7O5vNh>xFadETYO3zO&_Nk0a&9_XlEY3-@NOCD~@yZEwEl6}X zD|4&Nb}}-^ED6XrOL9u)($&>f$Z_&B&Ik?j@HEVEEG#Q44T}uOD$4T9&+|>x_6jly zFe!+tFR3aI@~%oP=8~{C`p5CbDy2>?rZ{8wiF+F(_blhs{&e(RfU%3tiNG6*DjFQq zp3kazQTJMNUw8GZyoU3$PNi0SHu{|;III2Mlru9HnJ lf9q?%(t)V`aSn3#;`dJF{dn}ncfFKvv$vn~Ej!G@4ggE&2fzRT delta 695 zcmbQhHi2z|PJNkod8t!|Yo51qzYFVyjk$cDR{kVuqKy1(&X!LUD11 zZfc5=si~o*f~8@YM`^l(nVY$ji=}^hM1Z%CVRBihvs*-dm4$0SQI&C4Sz1xJWw2j? zN0nb*keg#MS7NH6uaRF~l%G+qiI2XgtFuvYX;P+}UrthvahRb=k-JBvc7Bqhp|g+Y z#E;_P0U55Dl~I`~ex?QC{^6-^0fqU_=|!G7+G%cvo*pIT$$74ce)(ZlhPl~XX3l;d z2ALr~QU1x{`9?vJepOXT`K4Y-uG(fM2C4p~-dV~1-sJ^`MyA=5;~B-n4e~RzOI*T( z4FmIx%uC$;-ThKhEmNFaoSc$ELL}0#efb z!i#-<^eggRl2VPr$`kd|N=%b;OOgtL3^ENSpJf!UH#Ug$GY&UQO%3rdFbFJ&D2*zx zv@pyxH}ERY^LBO*at}@MFYqca4s|o(N;5Dt_lqoYDl9Ea&nn1CEle{h@y^ciGD`C> z3er!k^sg!lNOU#JadHgg($&>fNODa#HY|$>_KwIk@XF8dbBqe{)K82s3Q0E34ogod zj|g|G&o_ZiAZEnx+)&2HXtRvXz9naBt=ii%{r`5iX-m@WZvx!cT zuzyN{lwI29=++rMq6R+?l$VytFkHE{`uHinn3q0zzIvOV?38T1>dyVmQdzFg;PK5V jU!G6?^1=76R`|1rol9@VcRHjsux*G5J&GWJO9=wwsZ+p?7kSNvKO?R8)9aqDe|{ zlyPu+o_nq%SCUh5n6ZCBdPSvcu7!W7k5@^KiEChxQIv^SZd##dNJ)W@OGu`9M0$?n z#E;_P+Fp)19!Uk^iKZ1kPTG}b`IaFe`pKb@B{@k!o&|YP?xn?P**?ipff*)TnNH^A zmF3~Vkww0F70y11+397Lo}MAu22rUI#>wI3rp4~A5ov`5*-4I*;~B-nQ!)#k%l*?` z)0_fR!;*}HTpSaN9Zg*eOP%$N-HRhq%hKFa(u{Mnyq!$Ain2WmoGRSX(j3$Cje?4T z(!)K=s>+P>Bm4_8ay%@uLW?Y-0zDHA3`#5}pJf!U_bT#D_6;qs$}w>b^(r$isVFP( zwlpsH3=VfnFG}(;FA2`@EXz!;N)GnrDk?MZ2(G9I$u!6|Ni5At(hf>D&-IT;%JDHN zwf@HNacaE=OfbSX>>b@X!9_sBMIc1+4icJ)k3G0Mux zD9JLbPYv@f&(?Rd;9ASscJX3ysi`pY|cbnAm`pt1lfnhsa+k>Y~%dC$-bWDqN=C#A3<>zIeeW=c| zI~#Q1z#4|HZ4uMT%0w%ZPM38n>a_k-yr*-!;6Z#S`9dF>XD-@B8IW-ADTWeWyfenTA>GPp!Aflsd9{A+!71 zi6*D(Chq3?d|y6Q|GY_0r`#EX_vyR2UzbNu&f36n>fw#j8#5O>?zyd?zkKay*)J8J P~w(33r*PlL1 delta 824 zcmbQhK7oCLPJL)VSzu*Bc12Nzn@LGL}c}hSB85hh?F^w{~i2Re3;~ zMNomiw|+%AS7mChn~70oP(XlwdRDeiWw>c_X_m2jy0>|mZ*fGFvwviIx_(A#WomNy z#E;_PW@gFGennwE9;F6(>$^QO<`9=OFPN`-k9xf3D$;nar`i3D%UKw5i?#ZQjC0@ys;~B-n9ld=DJW8BH zL(K~_os3+4vJ)+G!xAl$lk&ntQnOQvjV(ew%~OMtEy@GAJRPHqNfa4E`!r&AOb6|^X&>~G>ym8f;pS4v zSo~(CP|vriVV`cB1sOJ1J#SdI`^XCo;l*5^CPhA|npJNwyFdILC QGgg&j4|ny?ch64&0ITUf>;M1& diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix index 8e25b6b..798b55b 100644 --- a/nix/secrets/secrets.nix +++ b/nix/secrets/secrets.nix @@ -28,6 +28,7 @@ in "pyroscope_s3_secret.age".publicKeys = [ vps3 ]; "restic_backup.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ]; "generic_backup_password.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ]; + "website_s3_key_write.age".publicKeys = [ vps1 ]; # only used by Noratrieb/website GHA "wg_private_dns1.age".publicKeys = [ dns1 ]; "wg_private_dns2.age".publicKeys = [ dns2 ]; "wg_private_vps1.age".publicKeys = [ vps1 ]; diff --git a/nix/secrets/upload_files_s3_secret.age b/nix/secrets/upload_files_s3_secret.age index 3bca9a4fadce6f01116ece8b34b25b714483809e..059b568152da93ec7c789dd7e91581e841fd1a55 100644 GIT binary patch delta 440 zcmcb`e2aO4PQ6!9a#^Kgu2E=4zM*S)wvk(AT9%VrdTM@FiMOe#QHh63i9xwvk-JBj zBUhF|q+_O6k*P<7r@31|U}l-Qsd0*LrjJo>SaO+Ppns5ImRnYVkB^&aGMBEdu7Y=J zM1WILm4RW2v%YCnX@q%sroUmTlYW4|NoAm4dPGH{W4%kDnQwVkl_yu!YyNFok>Ys| z%clN{G38?4AT&RhtB-ft0S4(cla&lOX4Q(ERH&KxXQkYQTUPJ3WTynr*t{%up3ti) zUK#qUt&;k*Kd^U7-Z9uUsdM6ng5>2_R%FaR5i9L}_tWg9onkAx4!z`knabGzd}Dd$ z#iXqjSH*+QH{{gS*FL;j%W#y}YGR|}V(|;he7oEqK3jFMaLWaeF9x0G6ff<1K4t5p zqh>cHzqng8<+3@~tam%zkaMNLxopl-5v{fFD{nm45npL>X$#Z&vpyX!tu-%hpQx9q z9KUwoYu%GPI+Ed@`hun}cK+FGKXY2sh5DX7Q?|-wF)!KSw{Yw2vc3I=Nq64+KD%_I w@$R=GP8*7gz0)0fRX7`xu+yUj`^00LCRf&c&j delta 440 zcmcb`e2aO4PJKjFm3D5jX{d8%X{2eswtiKiscS(bKR`$Je!2T@u;jynpiosX4-z1Q}|d6@5AvcE~LB`;CylS0hCBsvq&Q zTosZg?54)L_V=v%3HOY29Q`dXsws#3*}HtLrf_F`Ol4^D>lJcpGtAA-UAr8>bi-ZZ zp<(VFy9*ZGJ|_JFK0j_no_fEac+N{n=Ia8n3m7i164{v>J;_{&=koSLnT+W{67x;U z!xq`ex2B$bs;O~Cs#VrOc!fLj?}z8O{g?F#cH34aKHU;gTFY&!W+?qWH!;n+Rz)(z8@+nwVU*Z}~?wY)$8 diff --git a/nix/secrets/website_s3_key_write.age b/nix/secrets/website_s3_key_write.age new file mode 100644 index 0000000..4bccbd0 --- /dev/null +++ b/nix/secrets/website_s3_key_write.age @@ -0,0 +1,5 @@ +age-encryption.org/v1 +-> ssh-ed25519 qM6TYg 89WLUVxmODcP3iwW/dRLUO2/4Q3qmuFU8rqfWI2ENRk +o65QiUjc42lO+nMkmO/PWTBMdJAjTho/PUWDv6ymgw8 +--- LOxBuiZaR+Dp/x2IUucWqWGW454w5DcLzD3LzQE+jY8 +&M @fh ,'xw` ocQ56G'!y8>6XhyuvP3[|7KFC9zI8w_Yk5Z7?/H,u`jbԪYb?;\O[[]^ #ߣ \ No newline at end of file diff --git a/nix/secrets/wg_private_dns1.age b/nix/secrets/wg_private_dns1.age index a54f3eb..cfb217e 100644 --- a/nix/secrets/wg_private_dns1.age +++ b/nix/secrets/wg_private_dns1.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 LZU5Eg o+MPatbYPM3sZq0MCqvvxlvKMQwlbajHURPQ+0g0qm8 -UUurAYkPWXCaow746EV4dAQ+qTJnHIehcorUmanBc+o ---- BV+bxd0OIc3J4uT39al2odyn8ScDpq58SiwnW5pvRj4 -T7W |fJ%"cq{TP~fv,;:免-Ϛ4a -u\L_-VH% \ No newline at end of file +-> ssh-ed25519 LZU5Eg vEsVLUdg/m+EWIX6pdlKH3xPNRoEzQLG34SjUU3dP38 +OiTw/STEWVuZDmaSWuhUDjlty5NCXOYal9GrhitOgJA +--- acirsYbJtNaJGlfGf2Ukapl66fvaqQmaYcU0agfRjPg +Yy> +ZmNRVס,@q}{5zoep jز\wB&7 ) \ No newline at end of file diff --git a/nix/secrets/wg_private_dns2.age b/nix/secrets/wg_private_dns2.age index 64b2ad274dd5725d4edd1ebf5374b6e0da2ed66e..b712c1298cc07f86078e88e9c10290b448605615 100644 GIT binary patch delta 220 zcmZo*YG9h6Q?H-ol$7Nb>Z~1LSQV6OXcXXA8Rq3#l~S0Q6k(cbXz1<|kzG~loK=|a z$>r=zEr;2)_UoMz&mn&|K1%cZNUtB@a_ znig7;Vp@=!9#~au9-gi38Cg`E6_}M(5Ug#O8kt;?ADR|a8CVifRm_$B>$t~W!Bwdl zA^~$2MZb&{-epzQc>Vt-o6oQQtkp_kWWCm__VCS(YquX|8!mB7PWb+BXOQaj!xi@5 YL*5vv@8RDgaqRiyqLMd%4;cgi05)M*?*IS* delta 220 zcmZo*YG9h6Q=by*T&^8vSm>0b?d|4~?wXt%QdD3ZP?8v2SzK7=Z0?kAX=YK86KquO z%jFVLkZF{xpW~F`8R2)zerthDc6j~f)RFW0yW0;j)WLT)}A5aw#Xcm%d zz?GU~=$~s`o>82dZ5bA6o}5yW5~Ocv;FX>c9&8vgS)I%%!WVs}LLz zp5hl4TRdGJNvw;VoO zm5Pd;T5fi=(x3nT?r?P2$m=1NpXEPYsM0o?KcqWdO#0@OjO69cJ9lO>JiQS6`PE8} Y8}I(b{`f!L-lyPH;+1{rLAMtH0R5v?KL7v# delta 221 zcmZo|UH#k(%i4Q|9fLo#zy35gZtmWme^%VU(=xoavlqTpSfqnOKl#!KJIKt6&i3 z6cQ4yuV3h&>>C;86J?a;mYSWOUmBhoRbi50>J<=f80KLSoM@8dSP7c^`!yT`wl7S+bC%;vx&ItC@ie9W XqxZfpsXUu2_@MBB;qlbw&{f?4SqM@@ diff --git a/nix/secrets/wg_private_vps2.age b/nix/secrets/wg_private_vps2.age index 4d30264..a924ba5 100644 --- a/nix/secrets/wg_private_vps2.age +++ b/nix/secrets/wg_private_vps2.age @@ -1,8 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 91VHug cjq3el2rlJCWS3VwM5Dt22Ot/PoCdU5wJWTMosYQ6VE -w/IyVNNAObRJxpV162CojPRE8yYbXJj1kaCBoPo3rNk ---- EDM/kgV9ewXhMvrQfHDtPLl7W46VCbZL5ciBO/B+Iu8 - cL>&²=^$m T4& -ƧI) -c -LQi6RS +T@0= \ No newline at end of file +-> ssh-ed25519 91VHug DSVlC+Y9wXBRTPtMeyGNsqTGN6p2j9GDcJZyVoXqmRM +dCEnH6wtFCD4QaNf6Gph4Ic9mEwr+GukB7GBJiMKCsU +--- o8VhUzFXGMSoFL/zHICEjK4qr+HozGzGrx+R/FLCJbA +Ll[muu V\NǞ +/egPT >fZ}zK<L#IJ} \ No newline at end of file diff --git a/nix/secrets/wg_private_vps3.age b/nix/secrets/wg_private_vps3.age index a63f54e..341a7b2 100644 --- a/nix/secrets/wg_private_vps3.age +++ b/nix/secrets/wg_private_vps3.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 XzACZQ lm64+fQEWa9hF98cV/x1U3Mz+6zuM23dAV3XkwE7iz4 -7Rgqd13DThp/JLryCe5xTdXwDujaTj4viR2CBTdXYLs ---- pwebssA2O2VjzPFRAQ0/65+qiiF/MijCIIXexwH5mgk -\fv̤[ڟI[5*׷90'4+V;L~j ;S2yb \ No newline at end of file +-> ssh-ed25519 XzACZQ //MVwFVmv8J0fNDH35jA/wRYWEwBpTNeuqb22JDlQ1M +WxQNXyyaOwR+jbLEd6qul81Tcy5ZmC9xQzXLdokrdBM +--- 4hvQvXwTU3vuYYkO1cud43LbDvFKfzSY+HB0nEfQbGA +HʹTԖ,2ڵG2tI| 4jxz 7) iNw,IN ҄wbpnF VA \ No newline at end of file diff --git a/nix/secrets/wg_private_vps4.age b/nix/secrets/wg_private_vps4.age index dcf6aaf..cf963a0 100644 --- a/nix/secrets/wg_private_vps4.age +++ b/nix/secrets/wg_private_vps4.age @@ -1,7 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 51bcvA mVJPirZJQxHgpX6CkMckYTpJk6HYN7CZYlUPPF1mYDM -XVZqovyalftEtV//FQM11Za+YAEMAuBTypcPQz1+G3E ---- 7QAtADWyWr8SY3jLLzKxPsedOLyasfLs4lK3nmhkOi0 -]JXtE)hSF -$2"Ta`Į{:= - \ No newline at end of file +-> ssh-ed25519 51bcvA afHu7io35iOiA79ghD+kTKgaiLv7t4UDH3MY4vc57kE +ZW0xYUH9bqD3vFWvmWT0LMGdcbnqFHafdO0/EakU29k +--- oMTnoSLV3ZvjjEjIbJpFp37Twz7GbljLuhrPfyYzvVU +M9__:2b_%c ee>`uSJiQz\]$c[ӽVud4 \ No newline at end of file diff --git a/nix/secrets/wg_private_vps5.age b/nix/secrets/wg_private_vps5.age index cbd582eefb91d92862aa11af829e830312033c9d..25eb7b68df8fb5e1a688cf8fe0b564bb884c2282 100644 GIT binary patch delta 220 zcmZo*YG9h6Q*W85pI+haW9U=m7aHl|R1xLuuALN>=WXnr8SG&cP?BEY=M!FKnOo)* z$(3(Z7G4FeqrkrrZE%%!WVtKb`D zT9)EoURGd`R}~d$=~EDx8R|@JR=Q&;vQ}fMN2|i~3rc~^SOn&Er0vqP!v(uIK>Q3Dj?|WhIu{n_Tj(E^=~z~%onK<&ADUX0Us2{4;F+Bso*r!BUFaKWZdU4ET#@Qt z%;o6oTAm-3@0P5cSdm%el5AS2?dEHoYHsG4nvz|Sl;dn%7FHOVl^ft=!KJIKtB@bz z9$f6^o#qu3P?j8O7-3xH;b-n^R+eJmS>aURmtS6)5o%H#kXl@5?8qg%Xkn&+aic`z z()qu?Bv1eU>4vYI_>mAl1CHsPwM9x7rb`sh=vn?vh@khw@bK?t0 XkPn>7I%B=fE-}@oR^~s9pEm&jLo-qW diff --git a/nix/secrets/widetom_bot_token.age b/nix/secrets/widetom_bot_token.age index e414467..f65d2c0 100644 --- a/nix/secrets/widetom_bot_token.age +++ b/nix/secrets/widetom_bot_token.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg oaTrhtYhEl2Za2fhNt0BgnjXPCkzo1Or9jsLLCnJhzA -Wk99OfMEXXG+cV1LEvC9wf0GeVgT1Z2GA0AtLYCRKD4 ---- 4U4dwN+tJ2LFpIjxEaoZ6HHV5QQU4kr0r0pDXKKcTgE -N]n?!|!:Ml* '?EM@r_ivo:Nilk8S(:֊R/0^xi[xC \ No newline at end of file +-> ssh-ed25519 qM6TYg oOHHqlwmPvW9l6F125mS5u7iJ2hznWVpZrVh9Gs9SkQ +M8Xbif6Ts+upr+ri6X8H6JviwYhZhZsL41eMNCOIJo4 +--- PXmESo/wbek0iXWltDKEUzQFt8ehaYinWqzlm2nTPvg +`TKshiiO AD.sY9ٍf~FDG^yש՝va{m-P?TT`(P A<0 \ No newline at end of file diff --git a/nix/secrets/widetom_config_toml.age b/nix/secrets/widetom_config_toml.age index 4d13ac2e9e13ff37590f06995fd3836eb76b5e79..f02bb7bbd39d11a0f9f869fcec0c62a891f7dda4 100644 GIT binary patch delta 4000 zcmZ1`zf69DPJOP4i)pcURic}tm$q@fcA$H1SeBQmc3`nlXqC8Uv_>@iiuHyfth7;sk45LQ<`7CU#4+saB_HHHkYohu0oV= zu5qBLXIY?cP?||)USWx+c8OV*)jc1=Id{)QY)68U;An1!{aS`H$HmNvWDmHi)qED zD{p5{dC#e|+y213dWLydI$WG5e_+y`esFmJ%Vh=5jEogA-42qUW<7HMTpgNw@B`VjfA7BuEC+A?6D#X4o9wHfoOtqp@=ni9`F+A4`z)BB-l(bneK3A^Oq^Nn z{Y{G=DOw(k2`fHH z)|_m;th?UvV}1d{QK5$FGs6F7{1W1D*|WY_)^z9Top;mryndY7GDmjaZjD#E{}wgI zudaIApcnt(|JK}|Q$2k}Nvtooq}BhMX81g;@S^~iwU}cRYcTuIih8N3ryX1_N&cOE zuI0-6^DJ!5;w~q)`L;B3d{qxi*n0HQ=MJg&)&50KBtxwim*!0tbGXzM_gHpf^Svu8 zj?63GSiX6;jC3*oS*2YbXUj6~`_7zN^3S36c|}Tm{HA-?jyyDvVg9xI!E=f3PpYhe z^)r?(oU`lB$`AETos++Kt}!&fp1?4Dzx$ixZ|b*h-Q9b1343CyblC$x-cQ~C*|xR2 zW&cq;c=X~=^9`k)EcNWO6PNPTZoR|&))!m*+$0e%7+`A>+Tpd={T@OlW|9|64huycW^~!h6y9*AiFh8bZ;v?qsYw=}) zm1nv{em69gZ;6r?tG1R>NT_lPI%i_n`0)DFsm|he-IJL#tJbdzSg|*I^-}2>`7^?g zbKR(zCcN(Kv6#%eo@eqdZK+UX`Mve1-WKD_Wd}cs*4+-1vzk9+PV3aE-*=u^)!eOR z_C@FQ!FMZK-Lfy$2j=c)`s7@Zabl`QqF39$Lj}73A{Qn+`!2Qr$bt(tua|nSzL&h% zjrniNRNXj>8AYnkc?)hnsVRA}%zN`o?jsVNUFo|EYv$kl%Vrbu`^P$K?tg#WRxsbM zRGu=c(Xac8(@othwiQ#Bh`IIZ%UZ=cG(UKtvgVb(>w=_)mc4g2ynIogWoN4J6tF*VfeK_|EwI+wf$`50-{q`_o?`9J4I$?|t(-)e@SmbG4r>YCUegxa)q40RNMN zw@Yt!d|hC_yKcJ1xyI&Lvy!>z4YI5BZOfK_{@$2e|N8O0vi_N`riTRwa#bwsHr}#V zp#ExULYvX*sSXFa#LRZ=yx}PC{)|7=EYQKF$MB8tu82ZE)!?MHi~t*?^$Q}_)lcHJ8#V^+ed~UVpp&9J>Je+ z+MoY*aoM+(Ctn$T@^LWwKWm=-?`sQoXYHHDeemDm`V)b_+RhsV2RMD}dAsX6d(rY! zuVS7nFH1Zq?Z|&nzToTeo@upp9$R9ks|LAPhzG~;{t$CYIPoMTq7S##H$GY06eg~=;+A1?><+ctE=O zPj#I>xBiP*+g;N+b-Q_GL)0%lf3xC=10Scf;kqgNCwb3yi)Gx@9T>Nq^So6Q?}zhU zuYA)zE?(0-Un}|M$(#b$oV794@6WZRMoqu=S8&^b?EG1BqIYjh_w}p4sPR71iyjo&|# z@AJ^K{Zl)|>!Vyt;>Xid`htUI`;<>T^F7F5^UOQP=2!-@?2W1p+AYG&oVv$rdeh|2 z0}nqla6rwGBy?-T3a^0WN;{KWgqgf5P`RgO+wy3eb39$e~RJpZPD z#umG3`za|usy80JnymdcZb6cVr|Hx3<$QN;=y6HUHTic~PG+&Mh~t$>Y`5K_r>5s_ zI`}l=q*1_xB;~o^*Te>Ci``yR?ftjq`vFmt%;?hX*1zVRH~vv$Q@xbg&yCr&?$A4J z&wA&>U#3^w-t{9XJ6q(uWa%xP1Et^eE(B=p4Olvzr%7l%UuD zzx%&5GyWI#e{i$#Vz*G{&C=}_hp$bnmEt`6fO2@7tcvZ^ zt3_!`%Qs$T(XKzSUasf*uNUV`E;YGF_%Q{Azf>?~dd@tzSFPq6ULPf=NKJd&~U73Vu9yvm)OQL5&y5UOlIQr={FJ6 zFxwLQ$DWVf^x08&rMT7kie)k;RCJxVuHLQeA?mHCyf==X%( znK4@WQ<;nPo(~D8IrSHh#ONHgsLXX%%&BwZKXTeoUU!vSWu+ohS>M+- zX&O5@h_*f8lM$)^`l9OU;y1pt?#13!ed)j6dU}*#<;7Jc4eD`!3e7#@tRvdZ-Ob*! zx!leQl=z>so$tufOODzCp^sMw?U7P{)xs3Rx9;B7!nMtp-o7(1e(b!f`MK=rdF)CJ zjMMz;56rS!^iwhEq{xvv=hlEJGrV_iap<4<=jg2WdxIF}8(&&h*H{0}&hP4nW2>hG z?_9o8jCb|1{~<^ByJwc_)ktMlmpaXvxth_t>!9z8JfHRE`x2j|+Lk(p_o|ugDtNYE z{jHXcVx)=C&1o;s?Ohn6xPYZ7dcL{U+qBP@X8K$eG&h>^zG#yF($=Yqw}~BidUz(c zoA`!`v?Z&)mopm(Yus=Y;FvCZvOc_i>W_k!Qlh|(Ij`P?TDMTxEuVcxl7^~$dDw{uMmf3)u@{vuw!cmIEl zC%0;M-()k{ba`gr=IAvEJpSQxQk4!Qe36}`!)4&O`Qw!_ zf0ZhK@lcMCQoXsd^{7g{ibKvjo_&nEPMP z`1G(oqjoOerg&cURqY4n-F@+6ac1Myl3kAi_k0ZOyWD1}Tyy^43yE*X2}koXZ##2v}bK%()+pFT7ISSB^~%vuPyWPz|$KVSto8RzI~&r zK3$05ypBZ+GmDQ`?JTd2==;qQL zlm0GsUX^ftjc?a(+3>Uen_noOE#tn;@<%1;$((nK`eS@ozA0pq3f%SY(f(I|RQ+|6 zP4q5x_0(RurjftkQsFXBNAAMVy%(0JZ;xQGd*rq@gXMx`Xrm+R65ji1D-RaWv5mOf zs%Wn;!#9QR^L)+#`Ni5RjUCec>n}`tD(5EsXB&Sw$N$?0tb7dSlsG-#dqTa6Yl_s< z>HPmUojvkr8n=DH~sk-kjt~NaGUXgikhM6#5 zblv~uF)DwXlQmY?%wPTVyXcLDyH_sXayVjhaZm@7&#s*Fq0-5Re=HDo&R=R(FR8P$ zKH-x|Ux0z1wz2Ss?H%?~dghU>ir$$^ zaKPlR5@|Qjr)@GYBSH;Z@>TUSI(C- z(_NQdZO~>`Vfij{(egtYm!@~$(2Cxt$X7ezsI=tgopLWemqU-dSzr(gs-=+k+-{HN}*+$PkDM} zF_(F0P@cPaa)ou0ob` zX=a4Jc22g7b5Kd5seg*Ifp4i_QdxOPU|3pVXsKbCe|@B7S)#s|k1v;Tch;YcI;;NI zd}-HLf4-FU@PGS9+fEjJ(c4|Pd}5F8d1i^&y*K5#w(cxlyn()Hg?>ziQ($u){I8*p1{+g{9 zxBdE~bF<>i;U}{#>o?yiley`=imm@ca$w#$p8jN$%0m+#{Bn3E^7Y~y=2@#$B%VgQ z=dSxK##&eR+4OAJp#>YHcCzf`jr_C0yHb6LBU|8k zra4b`I|)eDJ~3u@@Bgop=)B_Q+8C9O*9+O+vL9#(Th}oA9(VA`oWLXX(m&U5wOPe` zzpGD6z4Nl;bFiVg@MVFWqBfEr9-L1(uHeq>_xOGmJKM)s9||{D?@Gc3wa+hmxi)tTe zo&0}Y^S@sWO=YXtM7x$aC8@`Uy44qEw-`mvFD>C%w8y-?>?CJsWqrzC#@#cg>KvZ- za{Y>L(`xT2zYCGxd2?ShhfDdVb%v`{SIpiYbZWgt{j|Wli_CANJiEo-uX=0c`U$d+ z@0@VD(o(qgyu-Gh6DAsWMUJ}Oah`qq&inS*oa`SgrkpA3I9B~Oz5Q*+2H6x_g&uB| zU-fQJd*|3FvmCqZ+pFEebE`ecsxVSp=KNd%-?E-%OMdC(+<0~Iy?qDMN|g)cA-;?9 z`acFFC!UUOJ3XsLi}Wrz1&O1QM=$1?pB>yCEo#>W)3-dmp$roLx>)5(Ao<%0Kh zPtD3s`Y%;H@c(8g&+Nb~uO9a=Uk_X|xOdlLf{S%j{Z997X&&zt7P(q*F8+IA{n3Di z{jLw5M>{nN?wF$>(|Mj-{P$0;O=-HTZDShco;*MAy7a#ZS80GlZH&jcj+vRx6K#Ur z#gsVz#D**L{;PT8ByrH}E5p5vS&QAC$^W!1=<8WvFmKk%Ep1l(YrO7jNd&HmDbJTm z-jVSBom+}rbYwk~vHz!pd%XWwMt@;_-+snJB4c`nN3F?q0ifM0UW6sCC=A)z03y?KLlwWi>)xcY(m?b~a!7u-$byt%dE?}a&= zc6L|`rM#cM!9s9#kQZ?e?9?)5IRqhE5Te8;=LJH?X?FBM<-eP8q9oG$P3yvO?POwOJAe2mhz z2E^|yTV{FcbaFK#%TDG;>uNtF+*_k)w&G~Ou>zev>nF|j*qq19@q59u!&!0vy4dQ) zbC&V<3;t{MF!=JEoBvOS(7TeFuJcPCOaEA9X&*J!=bqW+dlC}14%OGx{~n+6;o&UF zU`IaHhNQle-!f)h?i79g=j6(BbJdy;AN{oK>e02o#Fsn7OMJU7GPm)nnQi?t(_Yi{ z(d)i{5M-ZQlcK!R!q9QzVV^lxmoztCdYZhP=XSlA*A#;zr*i&;s&uYC|G3(ImqpCc z4W4%^wksN*KD8)q$L+g#1R zh3?-jw-;+M%+W}BBJym(uG0Hqk~?$03-U#Kh|E(rtX`ki*kQYUDnp)mr}xPc&ugv| zA0{rJv->>r%F_DZJnqF4nRa@l-r2{Zt^OiOQ>9R5MS%bEe|^R3$1WHyQqHJspA@(D zz_Lw(VW!(2eygaK*qXKCu#;C#@z*!6US!u^O|$UhkyD;|CT6Y8%E$FfFYB7Do8mn4 z%Cm&0?;nVMQeSq+*JWd;mc-l3D-@Tno3mX}&*`Jbe&*5`Pv5rz3H3|ze%Xsew5`+4 zoVow}5yeXTum3qjuI_l1x~jtMZ()ViPl4bo>tZC%n6FfsvMO!U--$cVC{)(&t=jPP z&O*J+SBHuxhCeWw7u{>Q%yP@-{(B{L8C`-$3};QMo5$#Sc#49E&kX%t-?Yx;@w72k zr<6H*J+1n;=-uxHWs9As&*PkATAy*%xW;C>K4*#9smka_o&QSY*UfObDU|g*)8t(8 zB#D_!9k;?8e+UUT3D1=bUb!LtiVgp%JvmQGwobIJmS;C@F5(|p|np=J<=tbI}_0bpO)3_R| z*NDHBsTVgeDA}8>yYWZIemHkT!(rFQz$ssLzKr|UmsKyaJU_-*^QibXr?0B#7Tj209ib!< zl&2J`!+-VD&BvwJrR})m8heFybS=2qHT#sr?ttYn`i8=F_x>5LPbe^aGc#<@qH2ys z3f~l;Zk{RWf9~Ht1N}P(eO_<~u3Dd%##+~2#^~~+Z0C%+&SiC{!+tgAZ$IaKecu-@ zCwb`)Z&hZn*0=X29DRL2XYy?sxrU{y%%;!h3tp=#FRvzQ8$R=H{{7iMCOM^bT+Qm# zFAk0T5ay?^ENXs(<*pO!nw&a@dZBp-mtK}K+aT-p)iI;39-$HgVdL*yt&w90Jla`+MrKK5eb)FBi)K5n5e;Xkzut&+% ztKm(4K}fB6S5^iOSH5_XSL`Br!HS!%=bp|#W6R35`R(z5=(I*tfwMQxf2>;3>vZn< zyw!{kyjM%;uldhy)Dj^hTK}z}I7?gHt7ZOu?swNpLvPf?l$qI;tyt&rtt9!|@hFd+ z4{IYjSekAhOZ>d}=OTHr*L>xhm4Bt4nZHSX>*giP@AlZ4I^WzH*kk@!t@*{8wuUU&Bzrdb?)#$7Yp?$(*N)f5kJ+xL2KYwd{vyyWFOZ+|7sU+s{PK z;(TVVJZHQ3F20@Y-vs@q{>zxrDf&U?^RFG2VX|TdaXT9#mrwiXctgLOk-5z8WK85D zV=)(>1J}DNVuZzlcl|ro@bMMjN|wyhT)sG!B`-y0UonZcwGKLeemQ$>Mn#*uhk&Kn zfd@*d8>Y>-F8F)$ctO(lz}Zr(yj@sM=haU#^r_#ba{l9H5rG4DUUo=4eZjW=p!O?K z<0%453ws_Kr7w+}E|8-4_egLcZ^iLvJPbxRDjz1K-)FU-%Ax5f$D(0%e7<*Z-hp|Q zfr5+lIa<3C56#^4Hp*P-4~zE!e)YNLx|6%>|9yM3ZHE22>wY%>qNZpIc1=&e7+lDg!Vt%2mb-gWm&4{Hm{?b^R6^Kqr(I7>Ox@AiKxEI4-UBJ=uso`ofwi{~zq_+jBy^e^dZ zuhlv$jl*J|DZ6=_IJvC8Yb(3l-FU3)o9xuWw5~yd~cgnF03kv-J!9mGEY~*|5r~< zVjx?zSm~GiH+7TJ&(?>X)~j7}OCU;MYv|>y+~anF@^^Xe7Ht%^$Xw`NcsO?c(zBZ3 z^#_FPb3fYJTKZg?zdkU0p75qm2SVO{mYaGhCHda99EbKz`9iKQzOtOXrf=F|F;mOX z%;jDD{q}2ZTdPkyUbSpAi(VA>^I|Of{#z~2{Q3CSiLTS#bnf2#CXv2L^}ANw>^4%~ zA@V9MY5Ie!{M&ORT%H}dbz~9GU%_9~Hf-FP8FA(Fl?ei|FK*6Cm*!)!Z+)k{Zoja@ z%u9Q+@#hf|8`|a@lf7j0KNPhdaspR(h*v|^}iL5qrEpkrUtIj?uGGWEq z%1euMwj8iClPMDmc+x2n+;6*b#rG$M^=E}Ycxp;3G%h?HxbH%*+T!h#SFCUTxO{r= zuSd6Ig|-_pKJ!W3YrEuXb!OCR3x0|G3F^O#mubhSuNJu}YAxni`Km@PSBpPtmD<;6 zr!?`u^|J-PPMY-X$GROX@0|XB{N(mnT08%skZsd03pU?h_%EPb=*yb=Ua75uGt8IW_P@OBn@6GC zf(em<4?TX( z#u+}l>vs8Uy5wuo@oGPtwy9C!)Ne}*U2h!HqX+IveGw` zQCjz)VW{cMHT#M-8UI`I;7M-?HxujgrrMwr*P5O`%ieg)lSQ1>{7gZ->bpsTV)xxo zFPOem#o+w56UG920`AX^&Yybl_QN<;$#tgl?;50T`rGnz+Wegx<@bD@cP$~@N%NZ- E0Ojwq#{d8T diff --git a/secrets-git-crypt/caddy_s3_key_secret b/secrets-git-crypt/caddy_s3_key_secret index 955a6d82302763ccfec8b11e3781c6d56231e372..63db25faa4dc8e326b53f4a0388b9834aed4927b 100644 GIT binary patch literal 274 zcmZQ@_Y83kiVO&02oU&rQTe}Ls>Q;xfc}p&s680jZIqzZ`ui j`BU+d=~3-3?w=mKys+=pH#7Ywe~xH8zJ0?ZEX@l58_I_w literal 141 zcmZQ@_Y83kiVO&0c*U(T-TsX2miy0(_~zOCw>g=~BI?1MCvj*h_r$&j@{-$j?qgmx zM}7sDQ;536s%i1EwooL^zq`%Twh@c!Jo{Qst3Qmq~`)3myxHMd;^056P0 AGXMYp diff --git a/secrets-git-crypt/website_s3_key_write b/secrets-git-crypt/website_s3_key_write new file mode 100644 index 0000000000000000000000000000000000000000..3ba1e609182de226a5a4d26b4e4d99e49dd786ef GIT binary patch literal 154 zcmZQ@_Y83kiVO&0*kxe!d~3C|?6luLPaJ+-{}Gs!>Tb?!5nwg{ALo-9`K%vKoD1CE zmdjJh#@|+W@Vv(_-5qYfE*|>PQMAtLTST?NrYi?!yO!1*7Vu}x|J-n#~ZOv zzwTeZVRfWj-rPbD+X=6VSN{=LTg$FzKJh4b@rk4DYDLzkgj&QBqb0Lf=}2zu%Ip{W M+`oLe+KTwu01~iC#sB~S literal 0 HcmV?d00001 From 9c688d469f87537612cae5ac1ce1590ad50bda2f Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Sun, 17 Aug 2025 22:19:56 +0200 Subject: [PATCH 03/36] Better caching for the blog --- nix/apps/website/default.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/nix/apps/website/default.nix b/nix/apps/website/default.nix index a64a2ed..1940e18 100644 --- a/nix/apps/website/default.nix +++ b/nix/apps/website/default.nix @@ -13,6 +13,10 @@ extraConfig = '' encode zstd gzip header -Last-Modified + + header /blog/css/* Cache-Control "max-age=31540000, immutable" + header /blog/fonts/* Cache-Control "max-age=31540000, immutable" + file_server { fs garage # TODO: run precompress script From 6206de09bbb8e8289d5989eed2bd5082909338eb Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Mon, 18 Aug 2025 21:10:44 +0200 Subject: [PATCH 04/36] update and better --- nix/apps/does-it-build/default.nix | 1 + nix/apps/widetom/default.nix | 1 + nix/nixpkgs.json | 4 ++-- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/nix/apps/does-it-build/default.nix b/nix/apps/does-it-build/default.nix index 7941ae7..a4dafa3 100644 --- a/nix/apps/does-it-build/default.nix +++ b/nix/apps/does-it-build/default.nix @@ -3,6 +3,7 @@ let does-it-build-base = (import (pkgs.fetchFromGitHub my-projects-versions.does-it-build.fetchFromGitHub)) { inherit pkgs; }; does-it-build = does-it-build-base.overrideAttrs (finalAttrs: previousAttrs: { DOES_IT_BUILD_OVERRIDE_VERSION = my-projects-versions.does-it-build.commit; + RUSTFLAGS = "-Cforce-frame-pointers=true"; }); in { diff --git a/nix/apps/widetom/default.nix b/nix/apps/widetom/default.nix index c7372fd..2ff0598 100644 --- a/nix/apps/widetom/default.nix +++ b/nix/apps/widetom/default.nix @@ -8,6 +8,7 @@ let meta = { mainProgram = "widertom"; }; + RUSTFLAGS = "-Cforce-frame-pointers=true"; }; in { diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json index e63baef..4d92766 100644 --- a/nix/nixpkgs.json +++ b/nix/nixpkgs.json @@ -1,5 +1,5 @@ { "channel": "nixos-25.05", - "lastUpdated": "2025-08-03T11:42:11.747Z", - "commit": "59e69648d345d6e8fef86158c555730fa12af9de" + "lastUpdated": "2025-08-18T18:47:54.435Z", + "commit": "48f4c982de68d966421d2b6f1ddbeb6227cc5ceb" } From d21158e2345543411adac971e1ba9f560d9d8909 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Mon, 18 Aug 2025 21:54:20 +0200 Subject: [PATCH 05/36] harden --- nix/apps/widetom/default.nix | 15 +++++++++++++++ nix/modules/default/default.nix | 16 ++++++++++++++++ 2 files changed, 31 insertions(+) diff --git a/nix/apps/widetom/default.nix b/nix/apps/widetom/default.nix index 2ff0598..d9fcc07 100644 --- a/nix/apps/widetom/default.nix +++ b/nix/apps/widetom/default.nix @@ -32,6 +32,21 @@ in serviceConfig = { DynamicUser = true; ExecStart = lib.getExe widetom; + PrivateDevices = true; + ProtectHome = true; + ProtectClock = true; + ProtectKernelLogs = true; + ProtectHostname = true; + ProtectKernelTunables = true; + CapabilityBoundingSet = ""; + ProtectProc = "noaccess"; + RestrictNamespaces = true; + MemoryDenyWriteExecute = true; + ProtectControlGroups = true; + ProtectKernelModules = true; + SystemCallArchitectures = ""; + SystemCallFilter = "@system-service"; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; }; }; diff --git a/nix/modules/default/default.nix b/nix/modules/default/default.nix index 4138af9..b14b5ab 100644 --- a/nix/modules/default/default.nix +++ b/nix/modules/default/default.nix @@ -188,6 +188,22 @@ in }; systemd.services.alloy.serviceConfig = { DynamicUser = lib.mkForce false; + PrivateDevices = true; + ProtectClock = true; + ProtectKernelLogs = true; + PrivateMounts = true; + ProtectControlGroups = true; + ProtectHostname = true; + LockPersonality = true; + ProtectKernelTunables = true; + ProtectSystem = true; + ProtectHome = true; + PrivateTmp = true; + NoNewPrivileges = true; + RestrictNamespaces = ""; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ]; + # TODO: find what's required for /proc/kallsyms (it should be CAP_SYSLOG!) + # CapabilityBoundingSet = "CAP_SYS_PTRACE CAP_BPF CAP_SYSLOG"; }; environment.etc."alloy/config.alloy".text = '' discovery.process "all" { From 12e01508a50f2eb7280dd0aba72fe2356b6f4cfd Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Wed, 20 Aug 2025 20:39:35 +0200 Subject: [PATCH 06/36] magic --- nix/apps/website/default.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/nix/apps/website/default.nix b/nix/apps/website/default.nix index 1940e18..1bdd91a 100644 --- a/nix/apps/website/default.nix +++ b/nix/apps/website/default.nix @@ -17,6 +17,12 @@ header /blog/css/* Cache-Control "max-age=31540000, immutable" header /blog/fonts/* Cache-Control "max-age=31540000, immutable" + @txt { + path / + not header Accept *text/html* + } + rewrite @txt /index.txt + file_server { fs garage # TODO: run precompress script From d5e2fdcdd3a95d4043bda09c849a2aa468409679 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Sat, 23 Aug 2025 21:07:42 +0200 Subject: [PATCH 07/36] remove unused dep --- nix/my-projects.json | 9 --------- 1 file changed, 9 deletions(-) diff --git a/nix/my-projects.json b/nix/my-projects.json index aeeebce..38f1dad 100644 --- a/nix/my-projects.json +++ b/nix/my-projects.json @@ -1,13 +1,4 @@ { - "website": { - "commit": "bf24af343128c6ac4e4b7d1034315df28121dab5", - "fetchFromGitHub": { - "owner": "Noratrieb", - "repo": "website", - "rev": "bf24af343128c6ac4e4b7d1034315df28121dab5", - "hash": "sha256-lmOyHLWBCurLuN8J9sRCO082WRqL8+/OXN6W4Jq8W/8=" - } - }, "pretense": { "commit": "270b01fc1118dfd713c1c41530d1a7d98f04527d", "fetchFromGitHub": { From 1353cdf0cd64146ecfc4d3be2ca6ea295ad4b322 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Fri, 12 Sep 2025 20:55:05 +0200 Subject: [PATCH 08/36] i'll chose to not question it --- nix/modules/caddy/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix index 24d1418..4c4e079 100644 --- a/nix/modules/caddy/default.nix +++ b/nix/modules/caddy/default.nix @@ -6,7 +6,7 @@ let "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3" "github.com/sagikazarmark/caddy-fs-s3@v0.10.0" ]; - hash = "sha256-wHxwRimtLCd/lhF5IQloAZoCfXgGEnkgeI77ObdG7cA="; + hash = "sha256-mBoHjvx7vcWepF4PdPqmHjoYrnCl487CD02kk9VeJWM="; }; in { From 925c0b7fe471001ef281a8e1662250926d126589 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Fri, 12 Sep 2025 20:55:17 +0200 Subject: [PATCH 09/36] update --- nix/my-projects.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nix/my-projects.json b/nix/my-projects.json index 38f1dad..f7a129a 100644 --- a/nix/my-projects.json +++ b/nix/my-projects.json @@ -18,12 +18,12 @@ } }, "does-it-build": { - "commit": "81790825173d87f89656f66f12a123bc99e2f6f1", + "commit": "b213eec65d2e1b38e1309d3a4cccedbb6d644dde", "fetchFromGitHub": { "owner": "Noratrieb", "repo": "does-it-build", - "rev": "81790825173d87f89656f66f12a123bc99e2f6f1", - "hash": "sha256-MCgGDd7Sg+BiG8L20Bbz8bHMB/Xuc1ztOVwv/b37BnQ=" + "rev": "b213eec65d2e1b38e1309d3a4cccedbb6d644dde", + "hash": "sha256-FkQNsBIUdDAtGWeI0mRZBn2lvBDIZ/LPuTGiTIhux5w=" } }, "upload.files.noratrieb.dev": { From f53dfd45bbdf9f989c6783430a8cb004870d4914 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Sun, 28 Sep 2025 12:55:44 +0200 Subject: [PATCH 10/36] update --- nix/apps/hugo-chat/default.nix | 1 + nix/modules/garage/default.nix | 2 +- nix/modules/prometheus/default.nix | 1 + nix/nixpkgs.json | 4 ++-- 4 files changed, 5 insertions(+), 3 deletions(-) diff --git a/nix/apps/hugo-chat/default.nix b/nix/apps/hugo-chat/default.nix index a62350c..986d9b7 100644 --- a/nix/apps/hugo-chat/default.nix +++ b/nix/apps/hugo-chat/default.nix @@ -9,6 +9,7 @@ let url = "https://github.com/C0RR1T/HugoChat/releases/download/2024-08-05/hugo-client.tar.xz"; sha256 = "sha256:121ai8q6bm7gp0pl1ajfk0k2nrfg05zid61i20z0j5gpb2qyhsib"; + stripRoot = false; }; in { diff --git a/nix/modules/garage/default.nix b/nix/modules/garage/default.nix index bec56ba..23e1cad 100644 --- a/nix/modules/garage/default.nix +++ b/nix/modules/garage/default.nix @@ -20,7 +20,7 @@ in }; services.garage = { enable = true; - package = pkgs.garage_2_0_0; + package = pkgs.garage_2_1_0; settings = { metadata_dir = "/var/lib/garage/meta"; data_dir = "/var/lib/garage/data"; diff --git a/nix/modules/prometheus/default.nix b/nix/modules/prometheus/default.nix index 334c311..d0e67a1 100644 --- a/nix/modules/prometheus/default.nix +++ b/nix/modules/prometheus/default.nix @@ -219,6 +219,7 @@ pyroscope = pkgs.fetchzip { url = "https://github.com/grafana/pyroscope/releases/download/v1.14.0/pyroscope_1.14.0_linux_amd64.tar.gz"; sha256 = "sha256:005539bp2a2kac8ff6vz77g0niav81rggha1bsfx454fw4dyli4y"; + stripRoot = false; }; pyroscopeConfig = { analytics.reporting_enabled = false; diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json index 4d92766..fbee18d 100644 --- a/nix/nixpkgs.json +++ b/nix/nixpkgs.json @@ -1,5 +1,5 @@ { "channel": "nixos-25.05", - "lastUpdated": "2025-08-18T18:47:54.435Z", - "commit": "48f4c982de68d966421d2b6f1ddbeb6227cc5ceb" + "lastUpdated": "2025-09-28T10:00:08.329Z", + "commit": "25e53aa156d47bad5082ff7618f5feb1f5e02d01" } From 4eb8087847e96b38ada27404dacab29c1e60cb63 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Mon, 29 Sep 2025 17:49:15 +0200 Subject: [PATCH 11/36] shorten proton ttl --- nix/modules/dns/noratrieb.dev.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/nix/modules/dns/noratrieb.dev.nix b/nix/modules/dns/noratrieb.dev.nix index 69c36a1..1173bb1 100644 --- a/nix/modules/dns/noratrieb.dev.nix +++ b/nix/modules/dns/noratrieb.dev.nix @@ -37,13 +37,14 @@ let TXT = [ "protonmail-verification=09106d260e40df267109be219d9c7b2759e808b5" - "v=spf1 include:_spf.protonmail.ch ~all" + "t-verify=dae826f2ae9f73a71cc247183616b6c9" # tuta verification + (ttl 60 "v=spf1 include:_spf.protonmail.ch ~all") ]; MX = [ - (mx.mx 10 "mail.protonmail.ch.") - (mx.mx 20 "mailsec.protonmail.ch.") + (ttl 60 (mx.mx 10 "mail.protonmail.ch.")) + (ttl 60 (mx.mx 20 "mailsec.protonmail.ch.")) ]; subdomains = { From d3bb071aae3a8d8f113568c98e7b6f596eabf7cc Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Mon, 29 Sep 2025 18:04:28 +0200 Subject: [PATCH 12/36] gamer --- nix/deploy/smoke-tests.sh | 7 +++---- nix/modules/dns/noratrieb.dev.nix | 16 ++++++++-------- 2 files changed, 11 insertions(+), 12 deletions(-) diff --git a/nix/deploy/smoke-tests.sh b/nix/deploy/smoke-tests.sh index 84107f9..5054a61 100755 --- a/nix/deploy/smoke-tests.sh +++ b/nix/deploy/smoke-tests.sh @@ -23,10 +23,9 @@ check_dig_answer A "nilstrieb.dev" "161.97.165.1" check_dig_answer NS noratrieb.dev "noratrieb.dev..*3600.*IN.*NS.*ns1.noratrieb.dev." # Mail stuff -check_dig_answer MX noratrieb.dev "mail.protonmail.ch." -check_dig_answer MX noratrieb.dev "mailsec.protonmail.ch." -check_dig_answer TXT noratrieb.dev "protonmail-verification=09106d260e40df267109be219d9c7b2759e808b5" -check_dig_answer TXT noratrieb.dev "v=spf1 include:_spf.protonmail.ch ~all" +check_dig_answer MX noratrieb.dev "mail.tutanota.de." +check_dig_answer TXT noratrieb.dev "t-verify=dae826f2ae9f73a71cc247183616b6c9" +check_dig_answer TXT noratrieb.dev "v=spf1 include:spf.tutanota.de -all" # Check HTTP responses http_hosts=( diff --git a/nix/modules/dns/noratrieb.dev.nix b/nix/modules/dns/noratrieb.dev.nix index 1173bb1..443234f 100644 --- a/nix/modules/dns/noratrieb.dev.nix +++ b/nix/modules/dns/noratrieb.dev.nix @@ -38,13 +38,11 @@ let TXT = [ "protonmail-verification=09106d260e40df267109be219d9c7b2759e808b5" "t-verify=dae826f2ae9f73a71cc247183616b6c9" # tuta verification - (ttl 60 "v=spf1 include:_spf.protonmail.ch ~all") + "v=spf1 include:spf.tutanota.de -all" ]; - MX = [ - (ttl 60 (mx.mx 10 "mail.protonmail.ch.")) - (ttl 60 (mx.mx 20 "mailsec.protonmail.ch.")) + (ttl 60 (mx.mx 10 "mail.tutanota.de.")) ]; subdomains = { @@ -92,13 +90,15 @@ let _atproto.TXT = [ "did=did:plc:pqyzoyxk7gfcbxk65mjyncyl" ]; # --- email + _mta-sts.CNAME = [ (cname "mta-sts.tutanota.de.") ]; + mta-sts.CNAME = [ (cname "mta-sts.tutanota.de.") ]; + _domainkey.subdomains = { - protonmail.CNAME = [ (cname "protonmail.domainkey.deenxxi4ieo32na6brazky2h7bt5ezko6vexdbvbzzbtj6oj43kca.domains.proton.ch.") ]; - protonmail2.CNAME = [ (cname "protonmail2.domainkey.deenxxi4ieo32na6brazky2h7bt5ezko6vexdbvbzzbtj6oj43kca.domains.proton.ch.") ]; - protonmail3.CNAME = [ (cname "protonmail3.domainkey.deenxxi4ieo32na6brazky2h7bt5ezko6vexdbvbzzbtj6oj43kca.domains.proton.ch.") ]; + s1.CNAME = [ (cname "s1.domainkey.tutanota.de.") ]; + s2.CNAME = [ (cname "s2.domainkey.tutanota.de.") ]; }; _dmarc.TXT = [ - "v=DMARC1; p=quarantine" + "v=DMARC1; p=quarantine; adkim=s" ]; # retired From 432fa7eb0e864378ae3665ca1b27ec374663709f Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Sun, 5 Oct 2025 12:06:06 +0200 Subject: [PATCH 13/36] update --- nix/my-projects.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nix/my-projects.json b/nix/my-projects.json index f7a129a..a98da10 100644 --- a/nix/my-projects.json +++ b/nix/my-projects.json @@ -18,12 +18,12 @@ } }, "does-it-build": { - "commit": "b213eec65d2e1b38e1309d3a4cccedbb6d644dde", + "commit": "6bff95d9bbf7b9bf5aae638a2ea4e9929ae1587e", "fetchFromGitHub": { "owner": "Noratrieb", "repo": "does-it-build", - "rev": "b213eec65d2e1b38e1309d3a4cccedbb6d644dde", - "hash": "sha256-FkQNsBIUdDAtGWeI0mRZBn2lvBDIZ/LPuTGiTIhux5w=" + "rev": "6bff95d9bbf7b9bf5aae638a2ea4e9929ae1587e", + "hash": "sha256-b2oTyMUjIroT8PMR5gZc4RuCnkhE341DWtSrZFhYIDU=" } }, "upload.files.noratrieb.dev": { From 56272d89e3b1381b806679a20f971769b4885759 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Fri, 24 Oct 2025 23:31:42 +0200 Subject: [PATCH 14/36] snowflake-proxy --- nix/hive.nix | 5 +++++ nix/modules/caddy/default.nix | 2 +- nix/modules/snowflake-proxy/default.nix | 3 +++ 3 files changed, 9 insertions(+), 1 deletion(-) create mode 100644 nix/modules/snowflake-proxy/default.nix diff --git a/nix/hive.nix b/nix/hive.nix index f31e3b2..796c822 100644 --- a/nix/hive.nix +++ b/nix/hive.nix @@ -179,6 +179,7 @@ ./modules/registry ./modules/backup ./modules/restic + ./modules/snowflake-proxy # apps ./apps/website @@ -201,6 +202,7 @@ ./modules/wg-mesh ./modules/caddy ./modules/garage + ./modules/snowflake-proxy ]; system.stateVersion = "23.11"; @@ -214,6 +216,7 @@ ./modules/caddy ./modules/garage ./modules/prometheus + ./modules/snowflake-proxy ./apps/website ]; @@ -229,6 +232,7 @@ ./modules/garage ./modules/backup ./modules/restic + ./modules/snowflake-proxy # apps ./apps/website @@ -284,6 +288,7 @@ ./modules/caddy ./modules/wg-mesh ./modules/garage + ./modules/snowflake-proxy ./apps/fakessh ]; diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix index 4c4e079..daca119 100644 --- a/nix/modules/caddy/default.nix +++ b/nix/modules/caddy/default.nix @@ -6,7 +6,7 @@ let "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3" "github.com/sagikazarmark/caddy-fs-s3@v0.10.0" ]; - hash = "sha256-mBoHjvx7vcWepF4PdPqmHjoYrnCl487CD02kk9VeJWM="; + hash = "sha256-onWUF2Ecd+LFprqY52U1AEvKhBIwKmI6eibeK03LpWM="; }; in { diff --git a/nix/modules/snowflake-proxy/default.nix b/nix/modules/snowflake-proxy/default.nix new file mode 100644 index 0000000..acc34c6 --- /dev/null +++ b/nix/modules/snowflake-proxy/default.nix @@ -0,0 +1,3 @@ +{ ... }: { + services.snowflake-proxy.enable = true; +} From 6cf0169b96eaa11000f9b65e9bf626c57397c788 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Sat, 1 Nov 2025 15:35:15 +0100 Subject: [PATCH 15/36] update --- nix/apps/widetom/default.nix | 2 +- nix/my-projects.json | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/nix/apps/widetom/default.nix b/nix/apps/widetom/default.nix index d9fcc07..a6e549a 100644 --- a/nix/apps/widetom/default.nix +++ b/nix/apps/widetom/default.nix @@ -4,7 +4,7 @@ let src = pkgs.fetchFromGitHub my-projects-versions.widetom.fetchFromGitHub; pname = "widetom"; version = "0.1.0"; - cargoHash = "sha256-AWbdPcDc+QOW7U/FYbqlIsg+3MwfggKCTCw1z/ZbSEE="; + cargoHash = "sha256-riQA+GviHMqiSvoRKcJhM3MGVEIv6urgYyvBZZd4fCc="; meta = { mainProgram = "widertom"; }; diff --git a/nix/my-projects.json b/nix/my-projects.json index a98da10..32a507d 100644 --- a/nix/my-projects.json +++ b/nix/my-projects.json @@ -18,12 +18,12 @@ } }, "does-it-build": { - "commit": "6bff95d9bbf7b9bf5aae638a2ea4e9929ae1587e", + "commit": "112420d22472087dba725cb1339cf5e6ff9af1f4", "fetchFromGitHub": { "owner": "Noratrieb", "repo": "does-it-build", - "rev": "6bff95d9bbf7b9bf5aae638a2ea4e9929ae1587e", - "hash": "sha256-b2oTyMUjIroT8PMR5gZc4RuCnkhE341DWtSrZFhYIDU=" + "rev": "112420d22472087dba725cb1339cf5e6ff9af1f4", + "hash": "sha256-co23mxD+iOtDSRt9eGukr/VTiuggo3ioWLJo6nTPBXo=" } }, "upload.files.noratrieb.dev": { @@ -45,12 +45,12 @@ } }, "widetom": { - "commit": "33d1738799618d72fe2b86896f766cbfea58dc76", + "commit": "387f6ff587b66186332cf5cfba90c966bba0695c", "fetchFromGitHub": { "owner": "Noratrieb", "repo": "widetom", - "rev": "33d1738799618d72fe2b86896f766cbfea58dc76", - "hash": "sha256-lSjlDozwKRLF62jsDaWo+8+rcQdeEgurEnuw00hk3o8=" + "rev": "387f6ff587b66186332cf5cfba90c966bba0695c", + "hash": "sha256-0PCal2czxBlgDh59TM7o94C9PG3a98YYUJ887/BYeEA=" } } } From bd9d44526a5583072a2cf74a2001bd47411d342b Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Mon, 10 Nov 2025 21:16:29 +0100 Subject: [PATCH 16/36] update does-it-build --- nix/apps/does-it-build/default.nix | 14 +++++++++-- nix/my-projects.json | 6 ++--- nix/secrets/backup_s3_secret.age | 26 +++++++++----------- nix/secrets/caddy_s3_key_secret.age | Bin 904 -> 904 bytes nix/secrets/docker_registry_password.age | 10 +++++--- nix/secrets/does_it_build_private_key.age | Bin 0 -> 1916 bytes nix/secrets/forgejo_s3_key_secret.age | 9 ++++--- nix/secrets/garage_secrets.age | 25 +++++++++---------- nix/secrets/generic_backup_password.age | Bin 692 -> 692 bytes nix/secrets/grafana_admin_password.age | Bin 282 -> 282 bytes nix/secrets/hugochat_db_password.age | Bin 339 -> 339 bytes nix/secrets/killua_env.age | Bin 293 -> 293 bytes nix/secrets/loki_env.age | Bin 326 -> 326 bytes nix/secrets/minio_env_file.age | 15 +++++------ nix/secrets/openolat_db_password.age | Bin 321 -> 321 bytes nix/secrets/pyroscope_s3_secret.age | 8 +++--- nix/secrets/registry_htpasswd.age | Bin 278 -> 278 bytes nix/secrets/registry_s3_key_secret.age | 8 +++--- nix/secrets/restic_backup.age | Bin 784 -> 784 bytes nix/secrets/s3_mc_admin_client.age | Bin 912 -> 912 bytes nix/secrets/secrets.nix | 1 + nix/secrets/upload_files_s3_secret.age | Bin 474 -> 474 bytes nix/secrets/website_s3_key_write.age | Bin 344 -> 344 bytes nix/secrets/wg_private_dns1.age | 9 +++---- nix/secrets/wg_private_dns2.age | 8 +++--- nix/secrets/wg_private_vps1.age | Bin 257 -> 257 bytes nix/secrets/wg_private_vps2.age | Bin 257 -> 257 bytes nix/secrets/wg_private_vps3.age | 8 +++--- nix/secrets/wg_private_vps4.age | 9 ++++--- nix/secrets/wg_private_vps5.age | Bin 256 -> 256 bytes nix/secrets/widetom_bot_token.age | 8 +++--- nix/secrets/widetom_config_toml.age | Bin 4006 -> 4006 bytes secrets-git-crypt/does_it_build_private_key | Bin 0 -> 1726 bytes 33 files changed, 88 insertions(+), 76 deletions(-) create mode 100644 nix/secrets/does_it_build_private_key.age create mode 100644 secrets-git-crypt/does_it_build_private_key diff --git a/nix/apps/does-it-build/default.nix b/nix/apps/does-it-build/default.nix index a4dafa3..10815c4 100644 --- a/nix/apps/does-it-build/default.nix +++ b/nix/apps/does-it-build/default.nix @@ -1,4 +1,4 @@ -{ pkgs, lib, my-projects-versions, ... }: +{ pkgs, lib, config, my-projects-versions, ... }: let does-it-build-base = (import (pkgs.fetchFromGitHub my-projects-versions.does-it-build.fetchFromGitHub)) { inherit pkgs; }; does-it-build = does-it-build-base.overrideAttrs (finalAttrs: previousAttrs: { @@ -7,6 +7,8 @@ let }); in { + age.secrets.does_it_build_private_key.file = ../../secrets/does_it_build_private_key.age; + services.caddy.virtualHosts = { "does-it-build.noratrieb.dev" = { logFormat = ""; @@ -36,7 +38,15 @@ in User = "does-it-build"; Group = "does-it-build"; ExecStart = "${lib.getExe' (does-it-build) "does-it-build" }"; - Environment = "DB_PATH=/var/lib/does-it-build/db.sqlite"; + Environment = [ + "DB_PATH=/var/lib/does-it-build/db.sqlite" + "GITHUB_SEND_PINGS=1" + "GITHUB_OWNER=Noratrieb" + "GITHUB_REPO=does-it-build-notifications" + "GITHUB_APP_ID=2263995" # https://github.com/settings/apps/does-it-build + ]; + # GITHUB_APP_PRIVATE_KEY=-----BEGIN RSA PRIVATE KEY-----... + EnvironmentFile = [ config.age.secrets.does_it_build_private_key.path ]; }; }; diff --git a/nix/my-projects.json b/nix/my-projects.json index 32a507d..fc8c335 100644 --- a/nix/my-projects.json +++ b/nix/my-projects.json @@ -18,12 +18,12 @@ } }, "does-it-build": { - "commit": "112420d22472087dba725cb1339cf5e6ff9af1f4", + "commit": "e4c69f17be6b7ae96d1845774250a1b11aef070f", "fetchFromGitHub": { "owner": "Noratrieb", "repo": "does-it-build", - "rev": "112420d22472087dba725cb1339cf5e6ff9af1f4", - "hash": "sha256-co23mxD+iOtDSRt9eGukr/VTiuggo3ioWLJo6nTPBXo=" + "rev": "e4c69f17be6b7ae96d1845774250a1b11aef070f", + "hash": "sha256-9voNfhTn614cDtit4W8FPWCXukqy7jUXLH0mHfzfxVE=" } }, "upload.files.noratrieb.dev": { diff --git a/nix/secrets/backup_s3_secret.age b/nix/secrets/backup_s3_secret.age index 5812754..1aba70f 100644 --- a/nix/secrets/backup_s3_secret.age +++ b/nix/secrets/backup_s3_secret.age @@ -1,15 +1,13 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg Ubif+7f0FscvxH0oTp2XuE5UrnJRjZRRejwntbUAIS8 -4LxCnF+az26QSsq6v+Y6rH5zL7QeZPPkcCrcytfObEg --> ssh-ed25519 91VHug NWa7+XM6IDmIPSY8/pQN0fCuFmXxOtKs2EKplv3hSGo -Xbo6mFWgK44xtCaPiRFmAMfuZXbeBem3VkZWszv1MgY --> ssh-ed25519 XzACZQ fcyVXD8Vu9Ua9fWLhKr4fpgpPHfVd4Cs9YSDx3g10nM -XhaLkawrOyqL7LW48z/6pk2Wf58w54F7x86G/q0YCjM --> ssh-ed25519 51bcvA ADj0kZgsbgdDZbb94lLsqAtXoVlTRhT4D5Fdcwx5B3A -cq5CkwbW7xM0MpKeUR08lLB0ibUlVnbe/JquxA9zF3A --> ssh-ed25519 vT7ExA lsVqsf2sBlghJzwzgY4u596374Dm+xnlS8Oz+R08gyw -xU3Be/Fb2ebXHszb702Qri7vH7m/lWzcrtVYt5D1Fsg ---- MfpuGafRuE5es9Uk9PXjwaDQK8QSXV7p30QR4cIiCso -RUe+3KcqIDNWE츂x|LSȍq8jXz-2y%%׍ -؉vTKf/*9-Js0hD8P,K3 -NIdLGc d \ No newline at end of file +-> ssh-ed25519 qM6TYg Iwzv4FA1pIES6SynmQejkarTCRc3xwqJhbPK+U197BI +0F6drTGs14E6tf0/eDcWu2y9b9yYLXjkAkHV0hT01MQ +-> ssh-ed25519 91VHug NhInO02XlDKVDYeEk+Y4jmaAG03YO1yy50R9vnUGPWU +0lgqjusLVxCLIQA8BSQveTNKEQf7uyEctRX+TDqipj4 +-> ssh-ed25519 XzACZQ vtBUTFyr4gjqcUsn3WCYOPspjnVwL19izhKYGX4kiy4 +bW6zwWar6COr58s/U6GJZsOPicAECUJr2VQZ0nOneF0 +-> ssh-ed25519 51bcvA itN8U0WXocUWmsO7Hy3a94j+aUyH83BN4iG9RK/9lCk +Eyuawwp7+bv9/f2UOihOqFLcETsFgPS+iJRrLID6jT0 +-> ssh-ed25519 vT7ExA tJoU7e9muJvOLU1a50SI7+KgbHYke/vaMn77u9gAyTw +p0Ofeh74R/UTpaBRDITNjwwXkUs/grBnsHiSvzUxCKU +--- EsDITASaNlbxImI3s/hCMpOM6Up4UrZgez1fTJlRT1M +:,ߐ n.|*#Ca%Iw$`&*XIQH3>sXNOtDhMW8t#$fV;E6ZmFrsN;pGrAbq#I zRO4iy5W_H!qO{`Vz$nMWlqwVNlHfpN;~ewEz>37OT!T=qZ2e^K%97$jeaHOLtPGPt z1B>$Tg0jG<3XBoxoOWkuLTwED-t~&xo&*4h~GbLs@+a*<4xT!y}b6C83z3~h;#aoQ!ur){oxV=!986K zGA9bcYtOve)?4ZrmG)oc!>>NO-J9cP*M81eRrJt<|3UZ~SH<67r_4GkUFR(?rMyBg zNIfWZMf3~5;K>g}XROn{ GED->rZ8+Zm delta 816 zcmeBR?_i&xQ=g&jk>lv?Wf0-+7hsTO1krG}Rl3SSPnN(6}kX@COUzX~x?H1{p z&y}AY=oRLZp{-vT7*gQlU+!E|nXPYJQC#I-Eoa0 z<8I&=6&Ml8rJd|=mS&M#T4GsQ=$ztHVeDGv=xXMgmRX$SpHX3C5|CnSTx4#X9h@3E z@uPTnk#kW_kxNN{Yhh_nq?xm4RkDStUv^1ePOclQ)E=3Po_t+ACHg<=j=fJB%^Gul0vuKG)qg5V!w>+e53G; z{GJhIC@3q!opD@+554MHMA(-NIc z3ya+94MJ0V0@C$Exg>;cE2Oi3lsxrh^|3>2ksE$3R@#^7C{QD_SKj{ji8ysH35nU( zzW>=KEYe(dyNFq*r9)Kb!0qnahQU)ht}fLR`(%{9(d(Gpfn{#qb_^E3CjQlUH{s33 zqyWjqmsgs`e=rMd=G}NwqGt2gcju0^ShaMt9kZX&rc*ED^HukhfT+t4-Q1t~Ha(B; z|2w$T^O*U?iNVbs+I4Drj(yWeRD+rcf%_?8Rkq1J9W`vp`}L0^){wxQ;E4d=U<(A>HX~46SY?s H8ixP?t3^72 diff --git a/nix/secrets/docker_registry_password.age b/nix/secrets/docker_registry_password.age index 9761e6f..602f634 100644 --- a/nix/secrets/docker_registry_password.age +++ b/nix/secrets/docker_registry_password.age @@ -1,5 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg aOAjlUp3G75gqvm+LVZhhAg45oJsobkyDTLY49b/zRU -pogMMIptbR/b1RKM3uJxEHT9WzSyZSHFQjAsNvcSAYU ---- t29inWsEHgMh0rx6BGbMBBvCy9wrhxqLmssWUBgZAxA -Izb"bD۩Pd@fŽveŗpk* e +-> ssh-ed25519 qM6TYg 8d5Jze4wRBsRqy+/ifnIMf5IhQZrn2Hs0k4/RCJoAko +IUgnzcCHmQhsrJfUuOG5s7nl98/X+ycpr0JWQeqc1Ps +--- dNJXPA7jEVJs5yQmvcaidVnJoN5pRMbh6okQsjjDabc +fe=XNvjT=-Dw^_dIh31;_Ka)&)#v7-0= zYS|4b@{<e2tfZ@p%wQkC?I_bN)a*{6NlaPRVO#@>*g2@}g?9OV|7 z_Rip1UAMj?u+{dy+0*U5y5&l*7OcD47x#`k+@Mi8RPw8%*h{v@`yUDH4S5o>-F|fk zZ}prT0>9@!d~x^XJjbG<4-F0{TvEmMHShf*eri(&)0>;W*!D9Y(tl96R_X1b`%kmi z-_o%CH~G+2hg&86UN(_B+5R7E+qf4PS8Q!j+RK%z_h@p~3+2QQ8yZyGXIXQ-*5H_5 zbUdtW&$3px7PX2e+5a>5<=pwcLy|GsRW>)hZL?WZuw?pjKBF6qd)-Rcud8G!nUShzC!AKc#`Kq_()`f-56>PJaylaB zyRUxg;@U?aYnKM>>1exGAgpZJc<#`Z7n43o2;5r|U7c*YIe%{Hiz|!gyxlF5JLhQp z11YD)8{QnSIcoWGg6bypFcHW{k@={N0zs%F2AULxZgxqf5K9Xp2 z`^-u6YqyGY3dK*gar>;~jup?VzZLDG)}tiqZI&Ol|LW7OXXcZ6R8F7&WMc8~)b$U& zMbhfbDUD_qvUSx8wX%YAqImfKhzd+LUiZPf!ET7A8Y$F7&cyL6pG!Uf^5 zbk1Mb&&jM$^fwJ-I(Wx+k&MFJH?xDjH_N-w(%!3 zum68O>XB@sqr|3*g7YJI7o6R)YU-Rr!6N2wuK&+ib#qeUy9KFBdL5s4XgD?sZsA_$ z8f^UZC>w+2zY}`j3fE+om5a96P7TfZ>(qk;=`GL7&%TX>$-C)@sXQkO{u%- zBAqq1f1jRsp{()0w6jDxXYFsRGnpYw`!-iS-td#9^5K8)EqU$V@7P{jUm(%>>CJ`> z+vaF4_#U%cY~?DxM{kzye*HnqtNrlxtp68RubOTlk=7WpQ>&EaV48l}?V?EM2kq|u zB{yBf{|Nk^*YEcG=dll$`4@fKJ+FRYRD{|-(QRtB^J+eKy2tkyym2U1 zCl;3$-->W__>#8ZOjKv~o4skf>w^^&#Y9}%w=U?8tUtN8GFr#e?VZ}vulMGClVfUl zcdz4lvc!(1FEf%{>{5L7t!s<;>Ezj#oeA`MqcUHa1*>ZpPyD3+XnS@UL{Y%n$ z-&f9Wf4O}oWU5~O^~_nOZkcIf%fUkV9X9JkU(8TdmpqW3!hBUN>eQ5g;DX*g`_3FU z|8qAf>A~;!8|OiE@8F%z^Ojqbmfq~$dgNVnvBm7qt6cQ1?U_Gi(zWY< zZ;Rbcd(nTp^up@^8L6f1RjZmOFW{MQ`ppzezQ&(&Q7i<+Ad7i=q=Q zxi?McM6%SdPIa7ryt=g_H}1%<%Ht+4q8sd2Eq_j;GF^&LHoqQ?+adS=R7wv sz>% literal 0 HcmV?d00001 diff --git a/nix/secrets/forgejo_s3_key_secret.age b/nix/secrets/forgejo_s3_key_secret.age index b08b423..2dc3b1a 100644 --- a/nix/secrets/forgejo_s3_key_secret.age +++ b/nix/secrets/forgejo_s3_key_secret.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg QhiVyWtk2dq2YqG+wQFWaZLFHQo05mBd92IKwxMjqhQ -nOLu8KsLxTOKBGggph/qy3Y1sTsHoWFajEQ3XFf2ktA ---- x9n+BLZcUdhVJ1nkUWcYL2IFztoiItD0tI5AfScS68U -sj١H'ǁZĿo@ݶtowZ/Z #bU0+e`X\ M"y+ :^քC@U+L \ No newline at end of file +-> ssh-ed25519 qM6TYg oDQzYAbe3UasUjgyw2AAtcYaID6nKD+j6C2R05R8Bw0 +NnPZ81p1PafEEfYHP+MafDdrhq83aJ2NuH8iYz2Uk/Q +--- FM0robN+6H2uAp+ASaCVxlLmD6xVp5oNHHAz1BE8/+A +6K(6F Ys#+\,\L:R@t糆Bp +.6> L}`QD 5Q-iӧF 1V \ No newline at end of file diff --git a/nix/secrets/garage_secrets.age b/nix/secrets/garage_secrets.age index 39b3bdd..96d1e66 100644 --- a/nix/secrets/garage_secrets.age +++ b/nix/secrets/garage_secrets.age @@ -1,14 +1,13 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg 1WRiwfAjRtvM4SNe0Kb39CNjo3HbOTAyFtqxLCtbmxs -IvaCCjpo61RBYwcUz/QPNFmxZaD+F48LIs6ojdBqxok --> ssh-ed25519 91VHug 0FQFOLE2YZF5GGqcjaHap9t9z6xvyVkY3kzsUlU9cSI -j9hGw7d+UCkOaN4K/GGChDdQUsFDt0kw+bj/+QP6xiU --> ssh-ed25519 XzACZQ tGQdswquRCp+iXrYXHLlg64DC/lor2QvgiWY10Shkg4 -ejl3+e9EVGyS+oP3161B0VdfXup9RPeyWI8wHJliHEw --> ssh-ed25519 51bcvA La5y55eSktxwiIQaNOzEIh8QFTv7MvToPVNefwgpAFg -e+mKIU1sMXbQmZ2EUGEAAV4vdCIY24MM1/EGrNBn7+c --> ssh-ed25519 vT7ExA McL/w6ZheS2TkmfyrTsdbdtT03hsHuqMx6VwpMtHDF4 -uBvctWaqmECReOwyW7rT/OsEn9b8qaivo4n5RQ3Cabg ---- AITRERll2MxhVYGt8EIbYSOlEDfCTfRm2/jvgvvPbqY -(CopvjI5le\<َ>6x$i%.OxQyrŗ7 -[%2DYđNTp& &.FL?Z[O(P@xj[)F \ No newline at end of file +-> ssh-ed25519 qM6TYg XH2/5yvGH0VhjebJyPu5BeIGIdjkSEtB0thG+wl1SBM +BoUFXhZy5rW2c1Ye/TrGpvTVwfZl6H/Y2nY5mjAAEdE +-> ssh-ed25519 91VHug Q0FVWn3sWTNvppfGixQInkvduYqkkH+r+iKpeHsGRBI +pSGWT07iyalzWqHWnw+tcC/izIuikRr8fOgthTInJiA +-> ssh-ed25519 XzACZQ gQVu4gindib9vfdcnyWhBw4NlVcArGajU/8rbh0lJTg +CYeMNZWQujKXbItZZUddyb/Wa2qDFnTw1iDc/t/NcCQ +-> ssh-ed25519 51bcvA YdIeRH95KTXoXVfhBN4y/rm03rC+9hLoj+addsf29Wk +rW0zqtUxujI9SZg9Fpku/RbOv5FdMc0Hwg+G+ED0gVA +-> ssh-ed25519 vT7ExA dIb7uhBqj1wJOr96JmKNE9nbiEuHUQFVYuojnXFxMGg +h+B/zv0n4xqaJqyuBv8K2+aUfSZYNk38peN25m4ON/A +--- T34nvRv3+nOaYfSCAsfQEWVY4cFsO8qAnZIOks+Ay0w +<]u/q|]c^w2D)[e :dSK\?GCx ꂞ(^k#r>(byW݃UJOjF59gba27O >i㷱?ؔ]dy4:*]$B &U}Y7c䭸jr돜D \ No newline at end of file diff --git a/nix/secrets/generic_backup_password.age b/nix/secrets/generic_backup_password.age index c5f7aa629c69660f8025476d041a0e3d102dec77..1e72b6f0f7da97ca730200de02ff6f85e44b27fc 100644 GIT binary patch delta 602 zcmdnOx`lOuPQ9ytWnNX1fq#K%lAm`_lwnp-Vz72pluLejhHtKWWOkWJseyl1c%fI8 zD_23jX;F}VdRln7laWcDU!rljX;@*nMZSfjyK7-cwuwPyU`R-XUuc@ECzr0BLUD11 zZfc5=si~o*f~8@YM`^l(zMr?Dze&2GOL&f1gF%LrS(R1JxlWk{p=Ksdnc1FP5uPsE z+U3dqNvQ>i?h(Ps?k*PIUgg0al@TVUp;<*CM)^TG8Tw(7?jFUH;~B-nLvo!gi-S!H za@>O}41$xRDk6)Fio>1r4MJ0kE0a?zBLlp{GqsDtLMsipDx-?BjogwV3JR0VBck$4 zb8<=zyfVuIEzK)K0)3n^UCJz+{PQb}Q_GSkpJf!U&ojtQbh5}v_b~Af53f2u?IEEGu&L)OM@z%y$XRjR*=iDRE8q%Sy=z4=6VY zH8hO~tTePVFHbTn=dutkT*PAeuiH4MqRy*JUsit7q(AIe&V_wUnUf(Vl<(Q(Np`5Er%RHycSUwVj$v7OWo2?=aD}gbAeXM4LUD11 zZfc5=si~o*f~8@YM`^l(e@2N#nMIDVmtR>{MsS`}q+5`;Z&kKOT9sc`p>|<_UzSHm zWRz!Fp6_jz8M~FK9$*%;~B-nLk;r+Lqf9k zOG<;vDpG?}eIujXvn{JaN<#C?E6mG{3Q`LLB0P#r{9UrS3X6UHEh-cBz5LVtea#EJ z9P>hg0zI-_Q?rxu-JCsB-TgAM3jDlsEc09^pJf!Uj|!?vb@wnztgH&D@DB^g(66c} z@J^4Y3iL4#@iXwNs3`GubTjnuH3|3RO0vkx4v9!hsWM8;PtLLk%F9X&FE9-*_KtE+ z3eAs9Gf49C3NT5wtjbU4($&>fNX$qLDlHCA@=bL$DNc1s4m8!z_AhYD%83ZkPAtm_ z)^`aD%*hIgNKMyI=Q3CPt-9u6i+A|>TWg{+Rn^v_gb# pi!V!LP__M=eEM|n3}eR{DUO!EJ1qiEd71PQACgSCxlvW~pJSnVWuYSz2mTiG`bAxvRTNm8olSg zHkYYaXu3tFi<^^UUVurqZ-AkTL6C7`VML*iM{<%|L1?gxxpq;mQ&@4n374*}u0oYT zRFQjrX1TVfd6utpa9Dbv1wY6SAJl5WN@laXf{`9(VmNk52+?p z+>V=VK2t8dC*SXy8$%8&yL#_Swrj1!JIyq{NqMjPh95c y5y||p(AKAUYu>U8nLD>;{yV+r>gjb(jzatH8gR9IQgQ4!|4S)1`_J^{<_`hV=VEmL delta 246 zcmbQmG>d71PJMPju|d9JP^G_9W@Towi++~5Sy)J#c9g4|Wnp@biGPH9Qn8nJX+e38 zFITZqm3C-=Pp)B+wtHx@cZ#uZhPJPEvVWp;rh7$+cX?rmTTXC(c%V;eAeXMLu7bIC zgok;0igQSYUzLTSQE+)$ut}Ing;Qd3uzNthe}<=*bAE}rUu2NBb}^Uu!XtC1aPE|d z_+r06d+o_M(KRmTW|mj)a=s>ae#c$I#;}bK7RE}>KL2>qHX!VuNp*O`MGOqoz>;NFVODx!05&m569Vu)uP(Z*tY8&&~jE6s?y!Fei1hSB;8u7a0q zl%cDouSr&(v#+*Am5a8ilSP!Xw`;z)MP6C5X`-Q*QN5#Yg{4nXkS|x2XwLRX;V|Rq zKRU;Sc`c8+YE1Soy0I%W*-!BNQ;RP9C954ePk;4sIu&qL;CQ_Lk;-+Cr$qBVU3s)N zTWwmfz!ZK5->-9{uRe-gGxxWhN@-e3?5l#H2RGtp{@Jp`{@F8O&Eq;xBg$WNY@KCg z%w{5|_ccsErR%BY3WdVz*vycIyszGuzPcLdm-glE`*!`3!J*|-eA|STRK!#rww+$j HtF{vW$EUev(;GrnXT;u8EUzWL{u)gmGZ5yHlQPYPw;j z0atRVyJvc#SCD?btA15dR8fwJlS^rSN}jf9h>wMDh-X2#c7{uMMwq{mE0?aWu7X!a zVR~9%K}DHkSx}U#MSi({SZ1oHxtV29c9Bz(hqk+4Sbb$`Nm5j(Wipq&*WKpckkFoV z$qW8#eWKL(*cN)<*PRg39DmF~U2`KxP{`vX6;Yk0gwky~ZYm!_4qmQ%>FBrknY4lQ zZ?~8=z5a2|&(Boud8!pMVaH>=KQn!zR3EjpFMRpoZ_CPn+W1N@-J7erMdCK;F3m2T zd|fQdMf3jM^FU(MI*jQtY2k(JRbw_RLdLBnOK2dR4(<7qicP6~l GFB!FrerPfhfBDRO%O$0hB#UKr1~N}} zHQuPG^!k17+J|Kc8hJ^vC+-$mJn7i=XlwO^6;D-4=AVkZS6G_Z5XT>GxzFs^w^L6) KSG?5x%?$u3nrcS? delta 257 zcmZ3=w3KOrPQ9^5uyazWM`libp0l5cetCGJlWVG}drDZShgXVYQIuD3Kt*DtVP$Ag zHkVJBfooEldAUVcVyRPvPl11Uri)WqZoW&BW1@+LWtxj+PNYSFdzf#oCzr0Su7Xdg zv1g>Ac9xT0MQ(0@akhbTxk+A>Yf5^dwr{3!MR<0OPnD}@X+~*?sV|r2@7*7tr_K-v zzbKHHwtr*uMds^K0z5W{ORme`>%A88;y|+0o}!lC`pBDpH=i*)zxYM(=9|78sVbY} z+Y+L;9AJH^ka#Vq>T>q7zGQyq#k|J_QYLws@$3{?71sV~#cHdIA|hHHt_+vlCQo}E K)4!zjkTL+!%4VVf diff --git a/nix/secrets/loki_env.age b/nix/secrets/loki_env.age index 3fa1a610fb1580412255543ee9f430574a383580..2c2ee277ce7b26b0f094ad946681329227659cc1 100644 GIT binary patch delta 291 zcmX@cbc|_&PQ68WvPW`GuA^m&pKqprNJenJV_wIsacdoiHVu9qib=pnSV~AQB-(detnp`xpqW>K`7VFGfNvdvKo23 zoo_epjkm0>$jb_H(Nul?`q$@8s&QZITHak*>g5=7aEgBvf8>*uX4iQV++KNkTyML# zV(|j0&NkVL`t6(a?q27*)zrQ3ecYx)7rRfL{$sxT>%(n_Vmn2)hAgtU{5Q?-%wy%x u9CQ91p3pFT%Y)KtnS1x1^_b4Kueez%T3p|HlP|c>;){0zYxV1Qfgb?ZKYwlj delta 291 zcmX@cbc|_&PQ6KDm3ES!k*RiSx}l+QvYBzAtFMuPagsq=j&`VXM5Iw>cB*NPMWB9$ z30I^=R9T3zQ&3P*j&E|JcCt@WU_?q-VrW)YXt{r7W^q_lP*!PvxLa~yF_*5cu7aPb zwqJUorA3&RsaIJ}foGztXIZYci@#H9wn30tg?VC5XnjUiVt}V4^W}Xn z>KuQbT<|t*L-38nT!vc*H~otFz`K6FX)fEgO ssh-ed25519 qM6TYg rrAASuKrjVYunxCZCyiGI94hiIcnj5tCZgtrNwDM6Dk -drt/hxV1oD6F9km2P6ODRl48o7Z5DzNxZzGp475gJdk --> ssh-ed25519 XzACZQ aC2p4JKStZyOBcAOxKMHm1CubsILvhLm0AADzYEPB1Q -rTIR+IXgD+65JmE+GNTmZUHYwjOasbHMyS8amWLr+6M ---- Lq0EHVDsbHi5jo6xHl8tu5lNmlm/4+gmQCXDzJ/RJ9c -A P #&h.$3hm/TߖilG٥\)&h ^HaQ;F>\ҬH%tF%ogxSaF|XwLgfټC -!' \ No newline at end of file +-> ssh-ed25519 qM6TYg LSDtwlm9BBqnpzsXoeCQnJ7YImkiMJvqfet0MROaBFA +h/efW4ApyMTnp/p+3tUa8RaMreI00/T5Q4Gh71lFeTk +-> ssh-ed25519 XzACZQ of8qdZPKfTtCKNMA+eHgX+WijYZHrHrzq0alH1mTJyE +rVW21YZw3kbe1TCQj/Ch1krrJt0o6PXThAV/eUbY8B8 +--- gWUT/+evFTR4ARdKZK01i8qgDCjt/EKnpKCAS5fCt1w +(H At_ï +5oJV.D̀#lGu#ɉK!-T~"ksҖoǣip1> +𗣫iD6yPOia$/]:dk]A3 \ No newline at end of file diff --git a/nix/secrets/openolat_db_password.age b/nix/secrets/openolat_db_password.age index 654f947d956260054b062932d1977567da1ef766..29aa8eeca436dabdb6d905ab1970c7dcf5f08dbf 100644 GIT binary patch delta 286 zcmX@ebdYI+PQAZhhPH*VuTMotzHhptUsj^Ap_@rzScR*JxnEdTL}H17S&&bbNuj%e zE0<+ikatCRa7wt5Q(3aUcX4=OQc|XAu6u@0YIay=h=qB0hI?K>nrT$1FPE;au0pQ9 zuWzVpcw(YOP-?lezq?tQzf)jAsfDk0LAsl7cxbVidA(m?a-OG2vIUpdnvI9LnVd(M_F&P)1F7rl3}NZ!^|?fWF?_2Dz+o`RJjXdi^S!w}lV0;At delta 286 zcmX@ebdYI+PQ7VKetMNrPP&OlR8>)`aZ+e`QLd9?ie*uiv9?n|p;Ml@afoY3l6Pcy zB$rvLp;LKQu7|gem#0aDM}=Fke`a=is$WQ;QAt&%lUs0NhEtALhw@o`F zGu1?MubKqRUV4Y+y6E5RJ@rnVrAuGxaykf2ux#zL&+)#$b+^22+&zv@=uC5oPUZxd8eL#r=-JILiXkS8E=2jN@V!cuaFz+RxsPB@UO!M o9l67+r#Z@gcdHhEx!ET2y+S(cX}PA`M(q)T+Dp2B==84!0B0C+_5c6? diff --git a/nix/secrets/pyroscope_s3_secret.age b/nix/secrets/pyroscope_s3_secret.age index ad31ff9..58f14dc 100644 --- a/nix/secrets/pyroscope_s3_secret.age +++ b/nix/secrets/pyroscope_s3_secret.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 XzACZQ YLo7+3kHVq7SX2PY4FK7uo+M/Pxj4cM4bElze5zZoEk -tFpHzUFjUor+ispu1xc1Ak7LwOY03U3djpf/3vLO4cE ---- +JoRkMMYQsY1P9sBDe3ren9EzmxSgtBUWFZ+tXtSqks -..v@bv7Ui‚6$B-L2*ZL@0) 㟮h TyȘ*\gУ㜟EN M:D @hBEqgkV(+$]ӎ`n;@ |ZMF"bmqU`Di\vjjg^ .Z9YQ&% \ No newline at end of file +-> ssh-ed25519 XzACZQ m7q/k7PLJpNDFEFxm1SNobF2abWhncqxWri+CbVqkCc +3NB/uTmOdkPH3N+kZrSep7u0A57KpQzI4tlzyT6Z5rg +--- cI9WvpISFVi7fXb5pcNgyu3rH+4L8o5dZUnAxhQ1x4Y +Wj;lx8m Šq߮X+MJSzա4`=8$9`}w~ډשa6t۫Jtu"|p`Tb("j:I5PrSd3%[ok!gc\6sd52%j \ No newline at end of file diff --git a/nix/secrets/registry_htpasswd.age b/nix/secrets/registry_htpasswd.age index d52861cf49ff878a385036d2269cea696c0d8b3f..a2098a673dc4d0ec9da553c12abe3fa34a7d4427 100644 GIT binary patch delta 242 zcmbQnG>vJ3PJKy;Wu$Yyp|6{{p}T&5nz43)nNwkrsaKhszK^G6o@roZxJPDySGHw( zAeVo+mse<3a-oNFN<=}Tqf1U%W|~E&cR{{kxu=sse!i2rMPQJLrC~spCzr0Su0mi? zzIIN2nP;U@hG&3laFs!Te^_Ovrkok%CxH@|Pgejx#utFK&I vGbJXA%07Lkv#&b!R=4l(%nKiGvfCWGwQSqjLW7wJM;<;uae3N8IoAvTb1PyF delta 242 zcmbQnG>vJ3PJNlNWq^B$c1U=xQ@UqmQfh{`L4d!BSCNaphigQ>aj|orp?RW9R;G8L zFPD3Szlpn#tE;I~q;sTKh=qqsT3&@&eyCriNw!&Jrg>I*RC2kIpSNLtHkYohu0la- zUQl4Two!0owu@Uu%Nx-Zw_<-Y>$T|X}7 z5Sv=OF4_F|M2@R=!pqX5%7A!mO+ZVAji#~Y$ vsoay>pK$W^v8L=J*3Bkr!QIFDf6sch#eSW}E7iNpqti=H9RC>qkTC)P_IhCh diff --git a/nix/secrets/registry_s3_key_secret.age b/nix/secrets/registry_s3_key_secret.age index 4430ac3..11c6e78 100644 --- a/nix/secrets/registry_s3_key_secret.age +++ b/nix/secrets/registry_s3_key_secret.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg UBpc2V2VJetEhYozhkG+wsd54xEhrOrp7m66yc6ajj8 -/TUkD70joloXjbEtcXJv1s8ImrfPz+SMiWv43mmDM6M ---- 936RSpAyH4aqIfs4Ks6eWSYqqfBxL/ZfElzbyjHB+ww -pR##dUt伍:b떹XMl>`7zIkEIqU+C) |A6щ[d0f.#ZדLL(n} ffGp Poͯ=!}WMpİ{<.^ҏ}}?X8 ߕglR=e ]~5H \ No newline at end of file +-> ssh-ed25519 qM6TYg zUespYByALhutVeTKDYRCXpskuwotOzfTjWCVtGcXTg +LxTqOV8sk6zOQv1eAIvSfUoeCfpus5lB4VwQV7joMks +--- bCKKLMK0Alw89Sh6HB4EW76P29aNUC5btlNFHDBTsQk +4mXA/u U}hz <5f2<jYO=FWIW%%8f~` vl@:1ľkYwaL:\:G㚢H٭rkbEbt/N}v-xMXܿtGRptǭ.hbԓ8x5LF"qaGlQwzpA!hGkxWr*?XJk+xfzV`WM}QDQ)7VW>-H zI#-gBYfzMFQCftjw@Y|{Yhk64d777(zq?C`eww9|zka%QVYqWhQc1b9FPE;JLUD11 zZfc5=si~o*f~8@YM`^l3Nw|fvewwRMm`|8{cD{Rtwp*29wrO&tQJG0VQCNAln|5VL zmYJWIcX4JqS9o|-QeJV0S(bUSrK^8HW|mu!g?WgfuccX(NkmR)hqQ(Z~}Lj8=xL&7W~lU)2lQ@nEmvZ^wpoD2fF!t#w>0xbfyogH)ilQKe6 z3v;~+N;178{lblNE4*_(-IIMBU9*DqgS;arpJf!U_scbN&r7KYam{qn_cu2%u#7VH zHw-pS3NKCZ2=MU8cJmBMNp_ENE)LG-%E>9oDMng($&>fFbhd>GAN7mjY_Y|PR}cG3@>o;@vR8XF)=bRb`L0Y zbPGzVcP|Z%D)q=Q;kt8V`d!iXljYXJK{md;>#iP4QM$NscJidBMYG>*UVpPsVrtj7 zR8^086C*x6*D3GkSKymkXLIjg`^H^o_sP5OJjNv_Dbm%iax0iK#N@T<7568;8R2&W zxnE2ZIoYcg`a483WdG?al^>_y-69=g!w?X_d409^4NJYuyX#+UG1yYf;dbZX!E;h) jlp+e$ZM1cQTlJEK`uvLC+_zLMoUCwID0grE?oS2)Vu$(% delta 695 zcmbQhHi2z|PJL!*MV4cRNpfjKmVbe^wn17|VQQF(K~-fyiAkY(dR}f+Nl;Z#Ku)%? zD_5m+ns;%snNPC2qpM}Ic50@#lbMsbzgKBNfRAgXQ({%PS88sGbD3F`FPE;JLUD11 zZfc5=si~o*f~8@YM`^l(p{d5cBy$( zj-h36UV)PZSALR@lZSJKQC?DBYDQvOWMWBFvVWw1YGSZkXm+}9d5UGFVPZyMV|#R1-iCB@oCC5}#I?nR-K;~B-n0}36@oRV@% z(o;(#O#K7Xi~IvhoV9}^qr&nl+(NzFoXady+$vI|veS#Xii`b{^#c-3j7p;_TpYav z&9l4%vvTw+T--_{%rXiJ4IGV9oh_nFJd8sppJf!U&(SZ>s|OvZzYW$nnoG zuE=r=D|PnIO7%5JH7O5vNh>xFadETYO3zO&_Nk0a&9_XlEY3-@NOCD~@yZEwEl6}X zD|4&Nb}}-^ED6XrOL9u)($&>f$Z_&B&Ik?j@HEVEEG#Q44T}uOD$4T9&+|>x_6jly zFe!+tFR3aI@~%oP=8~{C`p5CbDy2>?rZ{8wiF+F(_blhs{&e(RfU%3tiNG6*DjFQq zp3kazQTJMNUw8GZyoU3$PNi0SHu{|;III2Mlru9HnJ lf9q?%(t)V`aSn3#;`dJF{dn}ncfFKvv$vn~Ej!G@4ggE&2fzRT diff --git a/nix/secrets/s3_mc_admin_client.age b/nix/secrets/s3_mc_admin_client.age index 11992075007c682e20727d3cdefbc825d3988e24..17f25f5e6c998f2f28f6927bd621d1724ad15514 100644 GIT binary patch delta 824 zcmbQhK7oCLPJLx@Qoco^XHIxlfO()>m0v+chNWe2zGq~LtF}*7NMTMyOXh_X=sYRPe6%rh_+*8ibt|@AeXM4LUD11 zZfc5=si~o*f~8@YM`^l3Qg*O=saJkbaE`BeN?4`2yIZlRg==O+SfWv7L}GBDL1{^r zf38oFYhYzMS5{6{cA=w}X^5$RN>zk^d2+I^S)ymCrK3TJQD~55sk^I1a%g&nSC*IS z#E;_Psh)Y2;Z-RaMuyr3K`#EDMgdO#ZWg(z$!=~rDaobY8IEQ8iTNJhr5Pq%2KoV| zF2Vlc<&OE;QE47|W~K(oAx7n%nIVo9mRZ^%CVpNKe)(zU=1zf=;~B-nz4J}nU5pDX z43nKxwLQZvD@v0J+;crma>CQo^76yv-Hah zHTCr?Of)S@GdE6gOfd`0k2EjKE6DWa3i7E+F)Ar3^v?6rj<5_Vw5)J5&NlY3O!p4+ zs7fm^P0#bl$nZ7{PtGyn($&>fD9y}u3h@gr%6BdDG&P9Ia7(sG%PAz!q+DAx0pgg|eeM7{B!`er0DK0hgmb2OWgyGhMV-;PG9j@%( zFS2jevA@^z=4V(GWWFgh^N`$BJ=J~o^@*vg3j9lsNnNjh@6Mn7LuuxH&z=QoH=PbI zf3PklLan>>=sKBx-%YE&Z)@bcWz@X#ka?6&&;O-yDnYgU4N224C^B1hnl!o}irX~5 z%;e$oO%J#q=%2awm9ZhCcb@;(<@bvB@bS*het%!vO7Cv4(+;;3iM=MJOo!fc)*L;o zv^ge9z;Ac$@f&i*uk;`A)uvsKTpID|q^)w{{>0cJs5jVUwjt@eF>b478&t*vY4 QJ^CRo!PCC^UdWXB04^~^=l}o! delta 824 zcmbQhK7oCLPQ8UmQABQrk#|mhU}9O4c7Rh_R)J-vwt=s6nnkKXcv^69RFq?xc4lO@ zBbSS-i;0tIrH_wufxB6FMU=L8m2pT)WSECzu|=t6zImprS!9T%Z+WUoI+w1ULUD11 zZfc5=si~o*f~8@YM`^l(euj&uPqKDIx>J&GWJO9=wwsZ+p?7kSNvKO?R8)9aqDe|{ zlyPu+o_nq%SCUh5n6ZCBdPSvcu7!W7k5@^KiEChxQIv^SZd##dNJ)W@OGu`9M0$?n z#E;_P+Fp)19!Uk^iKZ1kPTG}b`IaFe`pKb@B{@k!o&|YP?xn?P**?ipff*)TnNH^A zmF3~Vkww0F70y11+397Lo}MAu22rUI#>wI3rp4~A5ov`5*-4I*;~B-nQ!)#k%l*?` z)0_fR!;*}HTpSaN9Zg*eOP%$N-HRhq%hKFa(u{Mnyq!$Ain2WmoGRSX(j3$Cje?4T z(!)K=s>+P>Bm4_8ay%@uLW?Y-0zDHA3`#5}pJf!U_bT#D_6;qs$}w>b^(r$isVFP( zwlpsH3=VfnFG}(;FA2`@EXz!;N)GnrDk?MZ2(G9I$u!6|Ni5At(hf>D&-IT;%JDHN zwf@HNacaE=OfbSX>>b@X!9_sBMIc1+4icJ)k3G0Mux zD9JLbPYv@f&(?Rd;9ASscJX3ysi`pY|cbnAm`pt1lfnhsa+k>Y~%dC$-bWDqN=C#A3<>zIeeW=c| zI~#Q1z#4|HZ4uMT%0w%ZPM38n>a_k-yr*-!;6Z#S`9dF>XD-@B8IW-ADTWeWyfenTA>GPp!Aflsd9{A+!71 zi6*D(Chq3?d|y6Q|GY_0r`#EX_vyR2UzbNu&f36n>fw#j8#5O>?zyd?zkKay*)J8J P~w(33r*PlL1 diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix index 798b55b..287aa86 100644 --- a/nix/secrets/secrets.nix +++ b/nix/secrets/secrets.nix @@ -29,6 +29,7 @@ in "restic_backup.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ]; "generic_backup_password.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ]; "website_s3_key_write.age".publicKeys = [ vps1 ]; # only used by Noratrieb/website GHA + "does_it_build_private_key.age".publicKeys = [ vps4 ]; "wg_private_dns1.age".publicKeys = [ dns1 ]; "wg_private_dns2.age".publicKeys = [ dns2 ]; "wg_private_vps1.age".publicKeys = [ vps1 ]; diff --git a/nix/secrets/upload_files_s3_secret.age b/nix/secrets/upload_files_s3_secret.age index 059b568152da93ec7c789dd7e91581e841fd1a55..255fdc33acfbdec71c529fff737f2aaa96c88522 100644 GIT binary patch delta 440 zcmcb`e2aO4PQ7KQrAb<8n0CHFMY36BUVd4Sr;&wgrdMf^WwJq9p`*5IhZnQM-rcX*(CW>%tssY`*EaY(7FZ%8F7{FF}3 z`_ha4#ZS}U@HA+n;)w|-e0!`lTX)I#({rSPKD)P_{t_h48;TY^-I>p_D)Y2U!11~pDIC%O9p1&| delta 440 zcmcb`e2aO4PQ6!9a#^Kgu2E=4zM*S)wvk(AT9%VrdTM@FiMOe#QHh63i9xwvk-JBj zBUhF|q+_O6k*P<7r@31|U}l-Qsd0*LrjJo>SaO+Ppns5ImRnYVkB^&aGMBEdu7Y=J zM1WILm4RW2v%YCnX@q%sroUmTlYW4|NoAm4dPGH{W4%kDnQwVkl_yu!YyNFok>Ys| z%clN{G38?4AT&RhtB-ft0S4(cla&lOX4Q(ERH&KxXQkYQTUPJ3WTynr*t{%up3ti) zUK#qUt&;k*Kd^U7-Z9uUsdM6ng5>2_R%FaR5i9L}_tWg9onkAx4!z`knabGzd}Dd$ z#iXqjSH*+QH{{gS*FL;j%W#y}YGR|}V(|;he7oEqK3jFMaLWaeF9x0G6ff<1K4t5p zqh>cHzqng8<+3@~tam%zkaMNLxopl-5v{fFD{nm45npL>X$#Z&vpyX!tu-%hpQx9q z9KUwoYu%GPI+Ed@`hun}cK+FGKXY2sh5DX7Q?|-wF)!KSw{Yw2vc3I=Nq64+KD%_I w@$R=GP8*7gz0)0fRX7`xu+yUj`^00LCRf&c&j diff --git a/nix/secrets/website_s3_key_write.age b/nix/secrets/website_s3_key_write.age index 4bccbd06a5bc0e2be0c3477030151493ab7015d4..c42418f0258f196ed9db80fae143904d4e823874 100644 GIT binary patch delta 309 zcmcb?bc1PvPQ6FCXPQsAM}${aL~@y#iNASvR(@Jmn0unPvtf>9NTrjrv5RGuTaIV8 z375WKmTz)oL6E<>kAF(r374*}u7aMIIW!>uMyjQ1Ht?y1Ko`3!9eg~)1uNU{NUN|{Ih?no&=eK`67e#&Z|MjN)+b*S7 zHXf%#S8+vi85DHtZEoIw#BUOJud23dWa5*VesY3uZnVDRGx~3O@XmF?w)`XR{9;#J N%~k$Z*jP=S1OOS>f4l$y delta 309 zcmcb?bc1PvPQ8U?xKC(UMXtX~a)5DWdANQ`kWZ+;k-kZwaba$$Tc|}*VOqGSk*i-& zHdnrxX<%k(RwL;D-;UGhUdvpHNq?+)7i3Wsi&C5{+27{@sW?SWfn}BY#L>5ukW#3dZo^`39WBSMOHL*C3I#bJ-@Q* z`RB+aj*VaUJ)Ew0-rjoNl7=5K{ ssh-ed25519 LZU5Eg vEsVLUdg/m+EWIX6pdlKH3xPNRoEzQLG34SjUU3dP38 -OiTw/STEWVuZDmaSWuhUDjlty5NCXOYal9GrhitOgJA ---- acirsYbJtNaJGlfGf2Ukapl66fvaqQmaYcU0agfRjPg -Yy> -ZmNRVס,@q}{5zoep jز\wB&7 ) \ No newline at end of file +-> ssh-ed25519 LZU5Eg T16scfWokKj/4TaHvplWuIdHCs/oR4t3V9x4hFo9yhU +h8RoAXndXCwUBskJlJTLWoXapWMUTF0yPnqUV9u7qt8 +--- qGJTnOXdnz8D9eA8AKtYarVa1l75x10SqjhsKchfQ+E +aҿ/}=7_r^rԕ?y"oؘ;U`*(Ztz7s ，$^k` \ No newline at end of file diff --git a/nix/secrets/wg_private_dns2.age b/nix/secrets/wg_private_dns2.age index b712c12..cfca638 100644 --- a/nix/secrets/wg_private_dns2.age +++ b/nix/secrets/wg_private_dns2.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 5bWSnQ /bBbjFUC+P1zRm12PNyVJIzdqibX5e11GDXkzuCjqgI -CNvbZZO266X7m8pyw2Q+E+Jvv1ZNB1pOY/Sf4OeaODM ---- oWefUtd5pmgQzs7Wk+IYrsjQjjpS+1eYcxofRyQtPzs -kHehP[]:z<*d֍&k1Ac`R%x?T2'rt0P \ No newline at end of file +-> ssh-ed25519 5bWSnQ eiSLsSWrjQldff9ZbhjhrvGgNGWxmxKu1JfsWmjo0Qg +cCLcVTC9hzN79cOMOuuOMo5VpwlBKraqxqeQuvVzqqU +--- bgLRe7t+KD2ehc2gAp4RERJ3nN5pGLA04L06KHVeQvw +ns4!nt3ܻ:#i? Jʷ '1d!? $/{uX6erL.][ \ No newline at end of file diff --git a/nix/secrets/wg_private_vps1.age b/nix/secrets/wg_private_vps1.age index 69f3e29247d62b5fa306aad81140c77280254255..ff02844e38aa68e204ff8326b04b01657cf651bc 100644 GIT binary patch delta 221 zcmZo+7iRQd#LzkZbPkn^79&<7Jc7D9Q z&Q)d*Vwsudlb_+`?h#OBU=ZPFY7|gX>Fycf9hh5ESm7UH=8>9WnV+Fw&ZVoXt5D@^ z9_e0GnpPH=oRVm0Vq_T};qCA3VVLQw@8V?OYHDQZ7UrZ~9-fq9lFa48+M6e^w0F^z z0KNZO1~2Y}FBH1Hf$wsc@T9YHAJ^Qz>a%U$DgT*QcO4R+S(F-}Q2J1Nr_tKXJ0E8- Z%sIY7y|Zu*SHyYIY@1hEhMQ-a0syTxQ=k9< delta 221 zcmZoR2)zerthDc6j~f)RFW0yW0;j)WLT)}A5aw#Xcm%d zz?GU~=$~s`o>82dZ5bA6o}5yW5~Ocv;FX>c9&8vgS)I%%!WVs}LLz zp5hl4TRdGJNvw;VoO zm5Pd;T5fi=(x3nT?r?P2$m=1NpXEPYsM0o?KcqWdO#0@OjO69cJ9lO>JiQS6`PE8} Y8}I(b{`f!L-lyPH;+1{rLAMtH0R5v?KL7v# diff --git a/nix/secrets/wg_private_vps2.age b/nix/secrets/wg_private_vps2.age index a924ba5d0cc9c8052dcc48b775f8f7f384ef2ea9..aa84c780699e849e07d41cd0a8c1b9e921f89a5c 100644 GIT binary patch delta 221 zcmZoyK~l^gDy8(bNg=I4}KaMTvUlXv`pt^x5!x}j0QDbK)c^nh delta 221 zcmZomuBW(kYVDPY?+M_|%B8ETtB`LI zmJwRz7UAw2obTqNU*+NH?3(3mQdp$zkzeIrDvRAY?TjD*khL#HA{AX Y?Tgb@FJ^mRw2^<~Geb<-)9Z0900cEup8x;= diff --git a/nix/secrets/wg_private_vps3.age b/nix/secrets/wg_private_vps3.age index 341a7b2..a874cea 100644 --- a/nix/secrets/wg_private_vps3.age +++ b/nix/secrets/wg_private_vps3.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 XzACZQ //MVwFVmv8J0fNDH35jA/wRYWEwBpTNeuqb22JDlQ1M -WxQNXyyaOwR+jbLEd6qul81Tcy5ZmC9xQzXLdokrdBM ---- 4hvQvXwTU3vuYYkO1cud43LbDvFKfzSY+HB0nEfQbGA -HʹTԖ,2ڵG2tI| 4jxz 7) iNw,IN ҄wbpnF VA \ No newline at end of file +-> ssh-ed25519 XzACZQ EsFwUOjtcoWVd5gJxu0vAfcXxGZovBBKcGuin+TE6kY +51vzn9SvfX8WCDe8f5dtblAhFykUIxLkvsNK6XjMSuQ +--- VTYLeqYga9RKPLxjB6JotAMC4StSGh9PNNnG3+kq6vs +]#A *R1*{TMڍíq2~pGJ#RWrWC ҷ# 3^͗ \ No newline at end of file diff --git a/nix/secrets/wg_private_vps4.age b/nix/secrets/wg_private_vps4.age index cf963a0..81426e6 100644 --- a/nix/secrets/wg_private_vps4.age +++ b/nix/secrets/wg_private_vps4.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 51bcvA afHu7io35iOiA79ghD+kTKgaiLv7t4UDH3MY4vc57kE -ZW0xYUH9bqD3vFWvmWT0LMGdcbnqFHafdO0/EakU29k ---- oMTnoSLV3ZvjjEjIbJpFp37Twz7GbljLuhrPfyYzvVU -M9__:2b_%c ee>`uSJiQz\]$c[ӽVud4 \ No newline at end of file +-> ssh-ed25519 51bcvA 14yVvUnmbYRhz0jbTEsj5bEZnJleq6ZT3NgOqVybzFk +F0cCQQhghlR3rHDEiBwIWdBXv6Cfac+JL9MArEXOHuY +--- bB7RaiP/rNyTpjpoa2qXmZw7RCa73b2FEy2WN+CTpfk +M):8&=$8.U7~j]QHC$^"˿ +WCZ#uA!dXpx"1c \ No newline at end of file diff --git a/nix/secrets/wg_private_vps5.age b/nix/secrets/wg_private_vps5.age index 25eb7b68df8fb5e1a688cf8fe0b564bb884c2282..6f2383b0459c1fe76f93a0d8620d856fb7ac1ec9 100644 GIT binary patch delta 220 zcmZo*YG9h6Q=gKXmaA>)YF^}Ko*9;2mE%)s>Xw$~Z<1qLo?05}Tw3Ymn-q{!?&(@y z&Q+A1SMKVQY@l80=$jf^73O4I;B4un@9R?OotGL=mXZ{iS>_oY91s$i&!wxYt5A^? z;plJSnQK(+9vWO3l9%h~5|LPHXl@*w?iE%LnUdlb8R}t{9Z_zOY{K=_NVP$2|C-s3 za%c1Qb_$1mlwIrRy}&2y8F9hlW3{%r|8TlJ*%@93T=WXnr8SG&cP?BEY=M!FKnOo)* z$(3(Z7G4FeqrkrrZE%%!WVtKb`D zT9)EoURGd`R}~d$=~EDx8R|@JR=Q&;vQ}fMN2|i~3rc~^SOn&Er0vqP!v(uIK>Q3Dj?|WhIu{n_ ssh-ed25519 qM6TYg oOHHqlwmPvW9l6F125mS5u7iJ2hznWVpZrVh9Gs9SkQ -M8Xbif6Ts+upr+ri6X8H6JviwYhZhZsL41eMNCOIJo4 ---- PXmESo/wbek0iXWltDKEUzQFt8ehaYinWqzlm2nTPvg -`TKshiiO AD.sY9ٍf~FDG^yש՝va{m-P?TT`(P A<0 \ No newline at end of file +-> ssh-ed25519 qM6TYg 47hyYUYzL2tHYd2ASQ9Ij87lqU3+Skcela0RcPK0iG0 +6r0oZsnmk4Zuk0QGqnmXcicMKlUMXvsJLzsqXmJCnZA +--- AQ8Yn+WuU1cSZ9UFeyG6xF6Jr8J8AhQ6FXJVA1MOPc0 +mj b3eYe6_Բl34Dsq41߭Z{G콺EQ޳539 a-,AGda0 \ No newline at end of file diff --git a/nix/secrets/widetom_config_toml.age b/nix/secrets/widetom_config_toml.age index f02bb7bbd39d11a0f9f869fcec0c62a891f7dda4..cf9ff8dd43d06bd4c1371b68bc18be371735cb8c 100644 GIT binary patch delta 4000 zcmZ1`zf69DPQ6owQAS~Sd2m@kQeKjOVQzR}l2=Z-VP<$hX0lmnzCnmvX+?mAVOUya zGFP&3c4T-(c5*;&W_DUyo=1vhpjS$Ecw%HlxQkg;NvXSsvqxcYpub;^1(&X_u7Yz( zWKzC)gr9jth;cx=hiPVIjzLMTc~qFANtIDnWI?`#TYYwfS7x4nS~1s*T8}^GX=>-x zAMnkxa0$tS) zJ4U~^*5>>_jvK$P1lhM<*R#&)bTDEH%(%H{OMJ!ZQ+6&TIh^9He_w9< z&&C>cL{4<#cGXovzx%rT7tZ^zdH$W(K~D}p?|L%bg*{;R&1X_-wsG}aB*e1(Z)+Is zcW;pt`D%Fd%N^mAJFyHhac36)?7q0Cg{S9fr%&{q*9*(ar@dd=`f1aaB#rrbKaQl$ zG~AbT`pIvu!WlBf9idG>58ta?yK}LR5x>i{iHy4L(#HZ7e*K%f?BK4>e@;`SUwrDn zWE^C7YvHRp{k>e`oA14CIMkuuzO9}uvoXSCcfho!S-GxL4OLjx-xTWYQ)b?}(=X-7 zwwH`c9pd)R*kSTQ>wf#pl!*>#^p?Ar3LtYze3*qn9XMe?NHZHDI8Vpm!nX;ZRtdhCA2#royug^zWz&vu)2 z)N9Q+_Vuk@m8;`dA2qAnHEf-e66&trCg_s0h7_pUb`i&EB2Nx-~MF! z+=KUA#Lr~JF@AaVm`lra-m^`;#-hcGO|_q2HdmP<8hw9D%}J#x--REjYy6*+B`xKp zdpmkYiQ{3Gy#AyvttmZB%T!~R_pMsNYj$l{go;UhxUC&Wd-B5I=nB&&t3Jg=pPnq7r5~ub>ZR1Bx6iM=N* zXSBck9;$yawEmmZjbn=zs|j5H!JxP1%Bh+>m+Wny`5XV7@8OEKFy6OlU8#J{ z?K$I~1sL0L7GbC=$ht)sxHZNefzp8@0Ghy*6TTQOZ-Spj( zJk2F3)yl{~u;T15QSJR^!8h}Q1uY%3Sb9~iabK3Nu`5`=f2_FBhMwsx#WrS&_FSqL}UMhwsj3V^$uX)R0%Y>&3b>+uSbJp?LWO!%a?O$F#w-pvui%3%#2V$(D*B7mh3Zxb7hjz;>(c9*Xr65eeMjq#%=o!jOX$?Ao)4#=+TPqCR8_XI z<1MSotNuh-SH9_j2!{Jl(aM-u&BnnfcVF&;KKE#DA#0|JbI2c`;(DF253{3(v1v(-T~?!L(zcq~*PgACJyx zO5EF%@~vrZpd!ous>WIWdhc1jn!n6KcgyMaTT|37o$)gXlRaxX{k_J84;Q^MAD^vU zW}ABA!@Fq~l8?&yzcB}Uaj0Y*oLFBhq*T*h;vu%fchC7;*V8^bBo7}Bv(h-Oc=y*6 zsg0Kpt%#Y#r|fZX;d$q}DS5^6*A50+On8*oa`XF@3HL6>zy6|Y;s34R;?}IbyKguC zoY=U~H^OJjeaSXPw#*EhuzOG6J(%{>_LZBw=7pQ7Z8kku4AQ@D{&J}+F(B%f*{3US zPS>{|zE#XGli67uxN22>P-ijw8JlC<1dq+0d6jqCA?3pdPq^IGED+LG4*PAqCnx*f z^vUm(d|YM*vghsn$Mfeg$N%>hlI1*J#+M}L-CnaH!Qj&LS1Sxk8z%3Oo-G_cQO8*P zm>1ufds5$>)6EvoFNr@`utqZB$i>{nzdNjI|JwZaufKAk{xrKn&+*04kK_~|b;a=2 z#0a@2Z*{mFVXeRapSI=KdmUdBBbsJ^d-VItnX@Z{8@6jrzb$FKb)U*(E}g{E*$khK zuUzT6$YI{I0E-W0#hESd%&KoEzuzkVf9?5KUUD1)!JB37-u7mlJn`Z5m77$(MW!s9 zAAa|^@#gCD9}@rY)O)V#NqNpbJ52x2_jznZPs}F%{9oF?#?WupZU*k+O(!Q@;Pf<` zI5S%1p%jPerKj~#?kvwJyfQO*8YKUV3ru9~^$@3N(~E7p5mk6Nt0yWd>D z??B#!-Wxn8ID@=q1a5n^UGlcqzr(Y_ES9W%xHvZBv~I2V#pIcvy|t%y*Bffw6%=`W z|H5+iCCjJQY&Bi=u(aZ;m)y5Fq2pT8n*yT#EA}igO`i3)By_`N2H^(%cj7-cuKzlH zLj9%m%F~@2DkYgx6IXP-yy#k|l6*K%a7$;NwjgVfuV_Yz|5u)=bMO9|_Fd(T_)K}F zEfx9VIw1=@rkk7%+_dG(-=lj&{>I#{f4xOs+W&#q%#&}n1$Kwz)cS|=v@9!m7ro0i zL;d`wCu|q)DH?0$EZ^>8b>*vxd-bWehd#Ey?_m%xIK1G(!3CS%SIg;d-I!`Rwa?|Y zykv^k-}#R=?(tbW-Tl;_vJ&N#&ugFQ>rQ&8b-bggaq^n_fXFjlcc(5*ujF+)wjyE%KPu@AveKMt0&3-;S44 zCC;9Cw^g~g;c=>}#7tfT=4a-cE=in_cx%P{p85XupFwIo4g7s^o%MGz+l~ftRBiBL zS+zjccY%p?v*yl8xg{~IV!qqBj)eAR*5;h7&W%;weP-sFrkRO~U*;)Y*3z+9QoE8z z>-B~@oyTvumpf*9I9~nuif8}ogunkBDz?eI>)8_;{;R5aVuXgyYL|1irs@Y39bMs=cTOut2PDIUp(Cs_G8gK>D>=HME^{%n_NH5UTCV2TB8zEz8#C= zsyW;GO;pm>W`6Wzx}%D8P) zOukOEe7f}bieR282QGKUYHTU!zq~c3-gfgz-!<2NY_q$jCu%r1b1M7c4UJk|k7Vn= zZ$2h+>i36V#lbhs7k>4RaqF5eC%@yI&AGYrKQ1?3(5o@CI^#++3%{d}*ecs`skBlRmyb-4-BvnEl!MjUEwme!8y?dl{zQ zADne-@2s$oZ@$i2Y`!*^z0k*Hy50rLsUNw!xFqV;u1OV`o>t`#Dg08L_4#3|?u?in zD`wAk()n;9p!MX@AYRYKRvBH9E_%*EvIb6G+VRd84JIs~`$_t*jJf2APwifA4R@sz z8=m!Zn_m~MKKS-V{fjTwKU@4R%+1{T>Dld+B&q#&0!wmEZ~f=oX3=TT;ZWSu-)(00 z)oIa=zn;1N^%HHA%(qAQ*&OlzEEhjNc?WNYuHBMEZcu6>lcR4+)v+WEqT1wP+*{1Ll5sd=v59KU&Xjcjbc)#je{2y<9AVXjHm z<%Wr2$(Js>wVH|VmJ*aFxJ_ z%ssd7=C!=nOSsM!WJ|BuBW75?#{OTtiS^7G_f~&?_&aaUFW3Ip2{W!gTLcek#MELfiZP}HaD%gZ|#Hf&fJZ(3j@wM~9G%m01@&wc%S=C29ce%r&S zdu2!&gY+IZ`|I;&zi;==oESXe*cweaHvR^wM=MPFX3R2_*phdT_eH6g$(ityLf3j8 z?mH2_0m3$-LT?uAeP;D!w`TFQj)qnBN@@C6vJD!8npVG^BnlXqC8Uv_>@iiuHyfth7;sk45LQ<`7CU#4+saB_HHHkYohu0oV= zu5qBLXIY?cP?||)USWx+c8OV*)jc1=Id{)QY)68U;An1!{aS`H$HmNvWDmHi)qED zD{p5{dC#e|+y213dWLydI$WG5e_+y`esFmJ%Vh=5jEogA-42qUW<7HMTpgNw@B`VjfA7BuEC+A?6D#X4o9wHfoOtqp@=ni9`F+A4`z)BB-l(bneK3A^Oq^Nn z{Y{G=DOw(k2`fHH z)|_m;th?UvV}1d{QK5$FGs6F7{1W1D*|WY_)^z9Top;mryndY7GDmjaZjD#E{}wgI zudaIApcnt(|JK}|Q$2k}Nvtooq}BhMX81g;@S^~iwU}cRYcTuIih8N3ryX1_N&cOE zuI0-6^DJ!5;w~q)`L;B3d{qxi*n0HQ=MJg&)&50KBtxwim*!0tbGXzM_gHpf^Svu8 zj?63GSiX6;jC3*oS*2YbXUj6~`_7zN^3S36c|}Tm{HA-?jyyDvVg9xI!E=f3PpYhe z^)r?(oU`lB$`AETos++Kt}!&fp1?4Dzx$ixZ|b*h-Q9b1343CyblC$x-cQ~C*|xR2 zW&cq;c=X~=^9`k)EcNWO6PNPTZoR|&))!m*+$0e%7+`A>+Tpd={T@OlW|9|64huycW^~!h6y9*AiFh8bZ;v?qsYw=}) zm1nv{em69gZ;6r?tG1R>NT_lPI%i_n`0)DFsm|he-IJL#tJbdzSg|*I^-}2>`7^?g zbKR(zCcN(Kv6#%eo@eqdZK+UX`Mve1-WKD_Wd}cs*4+-1vzk9+PV3aE-*=u^)!eOR z_C@FQ!FMZK-Lfy$2j=c)`s7@Zabl`QqF39$Lj}73A{Qn+`!2Qr$bt(tua|nSzL&h% zjrniNRNXj>8AYnkc?)hnsVRA}%zN`o?jsVNUFo|EYv$kl%Vrbu`^P$K?tg#WRxsbM zRGu=c(Xac8(@othwiQ#Bh`IIZ%UZ=cG(UKtvgVb(>w=_)mc4g2ynIogWoN4J6tF*VfeK_|EwI+wf$`50-{q`_o?`9J4I$?|t(-)e@SmbG4r>YCUegxa)q40RNMN zw@Yt!d|hC_yKcJ1xyI&Lvy!>z4YI5BZOfK_{@$2e|N8O0vi_N`riTRwa#bwsHr}#V zp#ExULYvX*sSXFa#LRZ=yx}PC{)|7=EYQKF$MB8tu82ZE)!?MHi~t*?^$Q}_)lcHJ8#V^+ed~UVpp&9J>Je+ z+MoY*aoM+(Ctn$T@^LWwKWm=-?`sQoXYHHDeemDm`V)b_+RhsV2RMD}dAsX6d(rY! zuVS7nFH1Zq?Z|&nzToTeo@upp9$R9ks|LAPhzG~;{t$CYIPoMTq7S##H$GY06eg~=;+A1?><+ctE=O zPj#I>xBiP*+g;N+b-Q_GL)0%lf3xC=10Scf;kqgNCwb3yi)Gx@9T>Nq^So6Q?}zhU zuYA)zE?(0-Un}|M$(#b$oV794@6WZRMoqu=S8&^b?EG1BqIYjh_w}p4sPR71iyjo&|# z@AJ^K{Zl)|>!Vyt;>Xid`htUI`;<>T^F7F5^UOQP=2!-@?2W1p+AYG&oVv$rdeh|2 z0}nqla6rwGBy?-T3a^0WN;{KWgqgf5P`RgO+wy3eb39$e~RJpZPD z#umG3`za|usy80JnymdcZb6cVr|Hx3<$QN;=y6HUHTic~PG+&Mh~t$>Y`5K_r>5s_ zI`}l=q*1_xB;~o^*Te>Ci``yR?ftjq`vFmt%;?hX*1zVRH~vv$Q@xbg&yCr&?$A4J z&wA&>U#3^w-t{9XJ6q(uWa%xP1Et^eE(B=p4Olvzr%7l%UuD zzx%&5GyWI#e{i$#Vz*G{&C=}_hp$bnmEt`6fO2@7tcvZ^ zt3_!`%Qs$T(XKzSUasf*uNUV`E;YGF_%Q{Azf>?~dd@tzSFPq6ULPf=NKJd&~U73Vu9yvm)OQL5&y5UOlIQr={FJ6 zFxwLQ$DWVf^x08&rMT7kie)k;RCJxVuHLQeA?mHCyf==X%( znK4@WQ<;nPo(~D8IrSHh#ONHgsLXX%%&BwZKXTeoUU!vSWu+ohS>M+- zX&O5@h_*f8lM$)^`l9OU;y1pt?#13!ed)j6dU}*#<;7Jc4eD`!3e7#@tRvdZ-Ob*! zx!leQl=z>so$tufOODzCp^sMw?U7P{)xs3Rx9;B7!nMtp-o7(1e(b!f`MK=rdF)CJ zjMMz;56rS!^iwhEq{xvv=hlEJGrV_iap<4<=jg2WdxIF}8(&&h*H{0}&hP4nW2>hG z?_9o8jCb|1{~<^ByJwc_)ktMlmpaXvxth_t>!9z8JfHRE`x2j|+Lk(p_o|ugDtNYE z{jHXcVx)=C&1o;s?Ohn6xPYZ7dcL{U+qBP@X8K$eG&h>^zG#yF($=Yqw}~BidUz(c zoA`!`v?Z&)mopm(Yus=Y;FvCZvOc_i>W_k!Qlh|(Ij`P?TDMTxEuVcxl7^~$dDw{uMmf3)u@{vuw!cmIEl zC%0;M-()k{ba`gr=IAvEJpSQxQk4!Qe36}`!)4&O`Qw!_ zf0ZhK@lcMCQoXsd^{7g{ibKvjo_&nEPMP z`1G(oqjoOerg&cURqY4n-F@+6ac1Myl3kAi_k0ZOyWD1}Tyy^43yE*X2}koXZ##2v}bK%()+pFT7ISSB^~%vuPyWPz|$KVSto8RzI~&r zK3$05ypBZ+GmDQ`?JTd2==;qQL zlm0GsUX^ftjc?a(+3>Uen_noOE#tn;@<%1;$((nK`eS@ozA0pq3f%SY(f(I|RQ+|6 zP4q5x_0(RurjftkQsFXBNAAMVy%(0JZ;xQGd*rq@gXMx`Xrm+R65ji1D-RaWv5mOf zs%Wn;!#9QR^L)+#`Ni5RjUCec>n}`tD(5EsXB&Sw$N$?0tb7dSlsG-#dqTa6Yl_s< z>HPmUojvkr8n=DH~sk-kjt~NaGUXgikhM6#5 zblv~uF)DwXlQmY?%wPTVyXcLDyH_sXayVjhaZm@7&#s*Fq0-5Re=HDo&R=R(FR8P$ zKH-x|Ux0z1wz2Ss?H%?~dghU>ir$$^ zaKPlR5@|Qjr)@GYBSH;Z@>TUSI(C- z(_NQdZO~>`Vfij{(egtYm!@~$(2Cxt$X7ezsI=tgopLWemRj?;dAYcx{7c^)k*%Aai2dZ9lo*Vu(;QSKd+xxzI9uF<`oZ9 z@>)UF%h%%bmfbe`Rgjn7>&Ky}pUiU9qK=g+ug@`u^V56e&UW<0b`{S&Ti z{`kJ-#wDG1o)n#}{dTXX;={~CbAD&=+}qt0_w!ojoRE-pohdsmB?pyj?tIyCqao{_ z_p*07HgTtwG#2bRld)8bL2}_oyZ+}D<=Imv-mU2Qty)~s#+g#_Kw-imqifxDZC_@r z*R>FSw&KIvgR9SMIuf{GV*Z6mZ*}-A6K5XYDW7rhX;T`N8@b+ zHFotqf+e5oOcwRN+jakQ{OvTRE6PFIfBx-JXX@8q{CdZA<$Zg6`=qkMzE9$gcz3b( z>DGtASJu8)eGw!7qH}=}-#f&ox_nEHI`W9=h` zt7cu{ZD~1s_=;FV$)cl2;(jcBch<>XjrITemyX-S6Eaysvt?GESJ-sqtvvgQZ6B_$ zuyU-vIQ_|;M>Bow)IatxEHpnPwd7(1`_acOxjcEv6I#Fi{-5fusCKS%nS#~ffEg;P ztCl@msiFRn>p_Q-#%#XFfB!t)&(Rli!{Xxg3tJy=nR9H4iH&2$RgS>)4I!=F@8ePz zgw17hTRACl$vGc?W4Z9i%a48TZ2g|8{BS}3hfw|1#yox@^%9eXx?I_=P2O+uG$4I$ z>$_uOHqM>*?-zzOhR%)nyY%kPww<*}GpFCmi&%Woc9OwI=67{gkJ7VFH9WeRnEGOo zT3kU*!Q#0c6?0w$?w!vn1?$4c1 zP2{a}GhFqhid;9d9xd6*Zq(@iU{y93ojdu(Z>zdX}ttjb^{;Yj z_=Ks~?n%4N5;kR8x^70%M>Qic-|XG51Pa35cbvLf9=4PDkZ{?Room#dF1Z%*GA){Q zQ)SHb&R}z0d-?2$rXOc|=lj|g_uR-S*#4w1_s2tBUx7F6!Jkt%m9yp;W?L9*9$30X z{dNXZ;iG)@)*ZKN7OdT$J^9I2rr+Yf0`3(a_x#BkAhE)=P;T`Ti;K59PV(-Od#h@` z-MRVeuCU!7-b73aVmoNYdcIlKxI1mRmFmqI`|q2zf2&MOyDb&d@{RNIOS7gq&a%qa zx<2ShZpbc@6E{_i_St*DyK-mi?!}Ev4qksn-esmgnqlLc))jPXW7Z^X$NDYbmN0$~ z{`F?&Hg4vVrFCzgvmcO>JvRHQ9n0T2Hiec-b^Pw%!L0j4<@`h5qkFjvoCX& zy?)cJJ8AjjHM_3d{m2wLHU9JR@TAL~I?emL7d)HsqwLwtc*U|u+9qdKE)h|YDvff{ z`H&K6eD>7-))|rS=csOQ+4+!rJ`+dj%niRS3}@copVnQGw(^dX>~4n`(N7QAU#)1} z*x+vU#)_#*?C<}wzRmU$iJa$s7nptK*W4)GZJPhQuBrUL+EkAjrXREvt=Rp%Bjdlv z%RZOjv58u}x7gzNpVh$%v7NT}HT5|r|B|=q+jy7ZQh|YW;_}$fD=fZwD(^|W=5zEn zi`Wwr*{;>0UoM68x<2{+YnhYN=a}^Yyl1MO-#5Q|v^^{YauACM6T_x0OufM=W^MIp!S?9;{_7fj=Y94;Xo|(4&bw!!^ zR1TZ+I+ZtJ6J-0g7o5oRn)uYu`;1h1ZmC>hzzgZwFWr|}%g;A@`+kD#g=K9sS8C{Q zJO0c@_K^L%`$=8rKDk^ymA`wxciNvRNe;W1G@h)}^mo*Doc{iL?d9t?*bmHlFOXbx zdX)`x=K{t6(+v?aBGmx~B02w@M2hu}ZsZj__4{a3y6 Date: Fri, 14 Nov 2025 21:50:41 +0100 Subject: [PATCH 17/36] update --- nix/my-projects.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nix/my-projects.json b/nix/my-projects.json index fc8c335..130c8e3 100644 --- a/nix/my-projects.json +++ b/nix/my-projects.json @@ -18,12 +18,12 @@ } }, "does-it-build": { - "commit": "e4c69f17be6b7ae96d1845774250a1b11aef070f", + "commit": "9c71be05a8f6e512330d308cdb7e35adc3cf1005", "fetchFromGitHub": { "owner": "Noratrieb", "repo": "does-it-build", - "rev": "e4c69f17be6b7ae96d1845774250a1b11aef070f", - "hash": "sha256-9voNfhTn614cDtit4W8FPWCXukqy7jUXLH0mHfzfxVE=" + "rev": "9c71be05a8f6e512330d308cdb7e35adc3cf1005", + "hash": "sha256-Z23dITtvByu8fhbAJ0ka6vJnhchv70npBU1/hUyCquI=" } }, "upload.files.noratrieb.dev": { From 306028604c4d59960b6c4397b1d994535503123f Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Fri, 14 Nov 2025 23:03:03 +0100 Subject: [PATCH 18/36] update --- nix/my-projects.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nix/my-projects.json b/nix/my-projects.json index 130c8e3..f35cee3 100644 --- a/nix/my-projects.json +++ b/nix/my-projects.json @@ -18,12 +18,12 @@ } }, "does-it-build": { - "commit": "9c71be05a8f6e512330d308cdb7e35adc3cf1005", + "commit": "e523607cbc10c3b93e573fb651b16ab62eacbd5c", "fetchFromGitHub": { "owner": "Noratrieb", "repo": "does-it-build", - "rev": "9c71be05a8f6e512330d308cdb7e35adc3cf1005", - "hash": "sha256-Z23dITtvByu8fhbAJ0ka6vJnhchv70npBU1/hUyCquI=" + "rev": "e523607cbc10c3b93e573fb651b16ab62eacbd5c", + "hash": "sha256-PcPD1XAwhBpEBvw2YPhb6oRytmhEkVeu4Dajyn9tfRY=" } }, "upload.files.noratrieb.dev": { From 343ee037652b1e8ed791d754435e90b0da93c36f Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Sat, 22 Nov 2025 13:42:24 +0100 Subject: [PATCH 19/36] apply --- nix/my-projects.json | 6 +++--- nix/nixpkgs.json | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/nix/my-projects.json b/nix/my-projects.json index f35cee3..7df23b6 100644 --- a/nix/my-projects.json +++ b/nix/my-projects.json @@ -18,12 +18,12 @@ } }, "does-it-build": { - "commit": "e523607cbc10c3b93e573fb651b16ab62eacbd5c", + "commit": "25179d488df81b2d585970440b3f716717e9a8f4", "fetchFromGitHub": { "owner": "Noratrieb", "repo": "does-it-build", - "rev": "e523607cbc10c3b93e573fb651b16ab62eacbd5c", - "hash": "sha256-PcPD1XAwhBpEBvw2YPhb6oRytmhEkVeu4Dajyn9tfRY=" + "rev": "25179d488df81b2d585970440b3f716717e9a8f4", + "hash": "sha256-IeljAkaFHZjCF4zM1Em/Aij6Gp+EyLJCVZMxSGG46QE=" } }, "upload.files.noratrieb.dev": { diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json index fbee18d..420739d 100644 --- a/nix/nixpkgs.json +++ b/nix/nixpkgs.json @@ -1,5 +1,5 @@ { "channel": "nixos-25.05", - "lastUpdated": "2025-09-28T10:00:08.329Z", - "commit": "25e53aa156d47bad5082ff7618f5feb1f5e02d01" + "lastUpdated": "2025-11-18T21:17:51.860Z", + "commit": "4c8cdd5b1a630e8f72c9dd9bf582b1afb3127d2c" } From f6fb60c03a292612835e5efb416a5f1966733474 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Sat, 29 Nov 2025 00:14:47 +0100 Subject: [PATCH 20/36] update does-it-build now needs a new rust version so let's pull in the rust from 25.11 lol --- nix/apps/does-it-build/default.nix | 8 +++++--- nix/hive.nix | 4 +++- nix/my-projects.json | 6 +++--- nix/nixpkgs.json | 11 ++++++++--- nix/update-nixpkgs.mjs | 31 +++++++++++++++--------------- 5 files changed, 34 insertions(+), 26 deletions(-) diff --git a/nix/apps/does-it-build/default.nix b/nix/apps/does-it-build/default.nix index 10815c4..cf6b74d 100644 --- a/nix/apps/does-it-build/default.nix +++ b/nix/apps/does-it-build/default.nix @@ -1,9 +1,11 @@ -{ pkgs, lib, config, my-projects-versions, ... }: +{ pkgs, nixpkgs-next, lib, config, my-projects-versions, ... }: let - does-it-build-base = (import (pkgs.fetchFromGitHub my-projects-versions.does-it-build.fetchFromGitHub)) { inherit pkgs; }; + does-it-build-base = (import (pkgs.fetchFromGitHub my-projects-versions.does-it-build.fetchFromGitHub)) { + # needs a recent rust version. + pkgs = nixpkgs-next; + }; does-it-build = does-it-build-base.overrideAttrs (finalAttrs: previousAttrs: { DOES_IT_BUILD_OVERRIDE_VERSION = my-projects-versions.does-it-build.commit; - RUSTFLAGS = "-Cforce-frame-pointers=true"; }); in { diff --git a/nix/hive.nix b/nix/hive.nix index 796c822..9a574d3 100644 --- a/nix/hive.nix +++ b/nix/hive.nix @@ -2,7 +2,8 @@ meta = let nixpkgs-version = builtins.fromJSON (builtins.readFile ./nixpkgs.json); - nixpkgs-path = (fetchTarball "https://github.com/NixOS/nixpkgs/archive/${nixpkgs-version.commit}.tar.gz"); + nixpkgs-path = (fetchTarball "https://github.com/NixOS/nixpkgs/archive/${nixpkgs-version."nixos-25.05".commit}.tar.gz"); + nixpkgs-next = import (fetchTarball "https://github.com/NixOS/nixpkgs/archive/${nixpkgs-version."nixos-25.11".commit}.tar.gz") { }; in { # Override to pin the Nixpkgs version (recommended). This option @@ -15,6 +16,7 @@ specialArgs = { my-projects-versions = builtins.fromJSON (builtins.readFile ./my-projects.json); + inherit nixpkgs-next; inherit nixpkgs-path; networkingConfig = { diff --git a/nix/my-projects.json b/nix/my-projects.json index 7df23b6..34360b9 100644 --- a/nix/my-projects.json +++ b/nix/my-projects.json @@ -18,12 +18,12 @@ } }, "does-it-build": { - "commit": "25179d488df81b2d585970440b3f716717e9a8f4", + "commit": "d15a7465584b5e90dc19126cc3d097683d055a63", "fetchFromGitHub": { "owner": "Noratrieb", "repo": "does-it-build", - "rev": "25179d488df81b2d585970440b3f716717e9a8f4", - "hash": "sha256-IeljAkaFHZjCF4zM1Em/Aij6Gp+EyLJCVZMxSGG46QE=" + "rev": "d15a7465584b5e90dc19126cc3d097683d055a63", + "hash": "sha256-UC+uy7Ba+VAXeBplIblrYptoI2ORsnL+U64BNGUR7CY=" } }, "upload.files.noratrieb.dev": { diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json index 420739d..5ecd090 100644 --- a/nix/nixpkgs.json +++ b/nix/nixpkgs.json @@ -1,5 +1,10 @@ { - "channel": "nixos-25.05", - "lastUpdated": "2025-11-18T21:17:51.860Z", - "commit": "4c8cdd5b1a630e8f72c9dd9bf582b1afb3127d2c" + "nixos-25.05": { + "lastUpdated": "2025-11-28T23:05:00.984Z", + "commit": "9a7b80b6f82a71ea04270d7ba11b48855681c4b0" + }, + "nixos-25.11": { + "lastUpdated": "2025-11-28T23:07:32.637Z", + "commit": "2fecba9952096ba043c16b9ef40b92851ff3e5d9" + } } diff --git a/nix/update-nixpkgs.mjs b/nix/update-nixpkgs.mjs index fa63e62..4b3c155 100644 --- a/nix/update-nixpkgs.mjs +++ b/nix/update-nixpkgs.mjs @@ -1,23 +1,22 @@ import fs from "node:fs/promises"; const path = `${import.meta.dirname}/nixpkgs.json`; -const nixpkgs = JSON.parse(await fs.readFile(path)); +const channels = JSON.parse(await fs.readFile(path)); -const res = await fetch( - `https://api.github.com/repos/NixOS/nixpkgs/commits/${nixpkgs.channel}` -); - -if (!res.ok) { - throw new Error( - `get commit for ${name}: ${res.status} - ${await res.text()}` +for (const [channel, nixpkgs] of Object.entries(channels)) { + const res = await fetch( + `https://api.github.com/repos/NixOS/nixpkgs/commits/${channel}` ); + if (!res.ok) { + throw new Error( + `get commit for ${channel}: ${res.status} - ${await res.text()}` + ); + } + const body = await res.json(); + if (body.sha !== nixpkgs.commit) { + nixpkgs.commit = body.sha; + nixpkgs.lastUpdated = new Date().toISOString(); + } } -const body = await res.json(); - -if (body.sha !== nixpkgs.commit) { - nixpkgs.commit = body.sha; - nixpkgs.lastUpdated = new Date().toISOString(); - - await fs.writeFile(path, JSON.stringify(nixpkgs, null, 2) + "\n"); -} +await fs.writeFile(path, JSON.stringify(channels, null, 2) + "\n"); From 413dfef3943d6bb03e7c460cfad273a3367a7e8b Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Mon, 22 Dec 2025 13:12:07 +0100 Subject: [PATCH 21/36] update --- nix/nixpkgs.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json index 5ecd090..c3d3918 100644 --- a/nix/nixpkgs.json +++ b/nix/nixpkgs.json @@ -1,10 +1,10 @@ { "nixos-25.05": { - "lastUpdated": "2025-11-28T23:05:00.984Z", - "commit": "9a7b80b6f82a71ea04270d7ba11b48855681c4b0" + "lastUpdated": "2025-12-22T11:35:31.967Z", + "commit": "2b0d2b456e4e8452cf1c16d00118d145f31160f9" }, "nixos-25.11": { - "lastUpdated": "2025-11-28T23:07:32.637Z", - "commit": "2fecba9952096ba043c16b9ef40b92851ff3e5d9" + "lastUpdated": "2025-12-22T11:35:32.154Z", + "commit": "b3aad468604d3e488d627c0b43984eb60e75e782" } } From 9015d6ebab7779b7a8a069dba1faebb550b449fe Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Sun, 28 Dec 2025 18:43:32 +0100 Subject: [PATCH 22/36] update --- nix/apps/does-it-build/default.nix | 17 +++++++++++++++ nix/modules/default/default.nix | 34 ++++++++++++++++++++++++++++++ nix/my-projects.json | 6 +++--- 3 files changed, 54 insertions(+), 3 deletions(-) diff --git a/nix/apps/does-it-build/default.nix b/nix/apps/does-it-build/default.nix index cf6b74d..a2b0244 100644 --- a/nix/apps/does-it-build/default.nix +++ b/nix/apps/does-it-build/default.nix @@ -49,6 +49,23 @@ in ]; # GITHUB_APP_PRIVATE_KEY=-----BEGIN RSA PRIVATE KEY-----... EnvironmentFile = [ config.age.secrets.does_it_build_private_key.path ]; + + ProtectHome = true; + StateDirectory = "does-it-build"; + ProtectSystem = "strict"; + PrivateTmp = true; + + RemoveIPC = true; + NoNewPrivileges = true; + PrivateDevices = true; + ProtectClock = true; + ProtectKernelLogs = true; + ProtectControlGroups = true; + ProtectKernelModules = true; + PrivateMounts = true; + RestrictNamespaces = ""; + RestrictSUIDSGID = true; + ProtectHostname = true; }; }; diff --git a/nix/modules/default/default.nix b/nix/modules/default/default.nix index b14b5ab..260523c 100644 --- a/nix/modules/default/default.nix +++ b/nix/modules/default/default.nix @@ -60,6 +60,7 @@ in settings = { PasswordAuthentication = false; + AllowUsers = [ "root" ]; }; }; services.fail2ban = { @@ -79,6 +80,22 @@ in "PRETENSE_PORTS=23,3306,5432,1521" # telnet,mysql,postgres,oracle "PRETENSE_METRICS_PORT=9150" ]; + PrivateDevices = true; + ProtectHome = true; + ProtectClock = true; + ProtectKernelLogs = true; + ProtectHostname = true; + ProtectKernelTunables = true; + CapabilityBoundingSet = "CAP_NET_BIND_SERVICE"; + ProtectProc = "ptraceable"; + RestrictNamespaces = true; + MemoryDenyWriteExecute = true; + ProtectControlGroups = true; + ProtectKernelModules = true; + SystemCallArchitectures = ""; + SystemCallFilter = "@system-service"; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; + ProtectSystem = "strict"; }; }; systemd.services.quotdd = { @@ -90,6 +107,23 @@ in ExecStart = "${lib.getExe (quotdd {inherit pkgs;})}"; AmbientCapabilities = "CAP_NET_BIND_SERVICE"; Environment = [ ]; + + PrivateDevices = true; + ProtectHome = true; + ProtectClock = true; + ProtectKernelLogs = true; + ProtectHostname = true; + ProtectKernelTunables = true; + CapabilityBoundingSet = "CAP_NET_BIND_SERVICE"; + ProtectProc = "ptraceable"; + RestrictNamespaces = true; + MemoryDenyWriteExecute = true; + ProtectControlGroups = true; + ProtectKernelModules = true; + SystemCallArchitectures = ""; + SystemCallFilter = "@system-service"; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; + ProtectSystem = "strict"; }; }; networking.firewall.allowedTCPPorts = [ diff --git a/nix/my-projects.json b/nix/my-projects.json index 34360b9..2e631e6 100644 --- a/nix/my-projects.json +++ b/nix/my-projects.json @@ -18,12 +18,12 @@ } }, "does-it-build": { - "commit": "d15a7465584b5e90dc19126cc3d097683d055a63", + "commit": "3a1695c554d8f07aac47a11f516ff65db7420ca6", "fetchFromGitHub": { "owner": "Noratrieb", "repo": "does-it-build", - "rev": "d15a7465584b5e90dc19126cc3d097683d055a63", - "hash": "sha256-UC+uy7Ba+VAXeBplIblrYptoI2ORsnL+U64BNGUR7CY=" + "rev": "3a1695c554d8f07aac47a11f516ff65db7420ca6", + "hash": "sha256-n7rTR3VrPt0x7QfzRnOHSxb4gSfMj4rA9kZD1RTYTWY=" } }, "upload.files.noratrieb.dev": { From ad469cf1528f31d6fd97c08e3ec8c1f9d5692d6f Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Sat, 10 Jan 2026 20:37:45 +0100 Subject: [PATCH 23/36] womangling --- nix/apps/website/default.nix | 7 +++++++ nix/modules/dns/noratrieb.dev.nix | 2 ++ 2 files changed, 9 insertions(+) diff --git a/nix/apps/website/default.nix b/nix/apps/website/default.nix index 1bdd91a..45e881b 100644 --- a/nix/apps/website/default.nix +++ b/nix/apps/website/default.nix @@ -38,5 +38,12 @@ reverse_proxy * localhost:3902 ''; }; + "womangling.noratrieb.dev" = { + logFormat = ""; + extraConfig = '' + encode zstd gzip + reverse_proxy * localhost:3902 + ''; + }; }; } diff --git a/nix/modules/dns/noratrieb.dev.nix b/nix/modules/dns/noratrieb.dev.nix index 443234f..81d3647 100644 --- a/nix/modules/dns/noratrieb.dev.nix +++ b/nix/modules/dns/noratrieb.dev.nix @@ -59,6 +59,8 @@ let }; }; + womangling = combine [ vps1 vps3 vps4 ]; + garage = combine [ vps1 vps2 vps3 vps4 ]; # --- apps From ac0860cd052b39f129d0a8743f328f267b631f91 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Sun, 11 Jan 2026 19:37:15 +0100 Subject: [PATCH 24/36] update does-it-build --- nix/my-projects.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nix/my-projects.json b/nix/my-projects.json index 2e631e6..cfe25d6 100644 --- a/nix/my-projects.json +++ b/nix/my-projects.json @@ -18,12 +18,12 @@ } }, "does-it-build": { - "commit": "3a1695c554d8f07aac47a11f516ff65db7420ca6", + "commit": "5518c49d7c6348ba01f286ce031f5322bbd9f786", "fetchFromGitHub": { "owner": "Noratrieb", "repo": "does-it-build", - "rev": "3a1695c554d8f07aac47a11f516ff65db7420ca6", - "hash": "sha256-n7rTR3VrPt0x7QfzRnOHSxb4gSfMj4rA9kZD1RTYTWY=" + "rev": "5518c49d7c6348ba01f286ce031f5322bbd9f786", + "hash": "sha256-nOV0n2THZXG/fC3lgPW2gDeWn7bYIZydCTIkKJ+U898=" } }, "upload.files.noratrieb.dev": { From c5ec691a7c7c5774366de3354c9d16786b617a90 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Sat, 31 Jan 2026 14:36:40 +0100 Subject: [PATCH 25/36] hugo chat permissive cors --- nix/apps/hugo-chat/default.nix | 30 +++++++++++------------------- 1 file changed, 11 insertions(+), 19 deletions(-) diff --git a/nix/apps/hugo-chat/default.nix b/nix/apps/hugo-chat/default.nix index 986d9b7..2229650 100644 --- a/nix/apps/hugo-chat/default.nix +++ b/nix/apps/hugo-chat/default.nix @@ -62,35 +62,27 @@ in "api.hugo-chat.noratrieb.dev" = let cors = pkgs.writeText "cors" '' - # https://gist.github.com/ryanburnette/d13575c9ced201e73f8169d3a793c1a3 - @cors_preflight{args[0]} method OPTIONS - @cors{args[0]} header Origin {args[0]} - - handle @cors_preflight{args[0]} { - header { - Access-Control-Allow-Origin "{args[0]}" - Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS" - Access-Control-Allow-Credentials "false" - Access-Control-Allow-Headers "$${args[1]}" - Access-Control-Max-Age "86400" - defer - } - respond "" 204 + @cors_preflight { + method OPTIONS + header Origin * } - handle @cors{args[0]} { + handle @cors_preflight { header { - Access-Control-Allow-Origin "{args[0]}" - Access-Control-Expose-Headers * - defer + Access-Control-Allow-Origin "*" + Access-Control-Allow-Methods "*" + Access-Control-Allow-Headers "content-type" } + respond 204 } + + ''; in { logFormat = ""; extraConfig = '' - import ${cors} https://hugo-chat.noratrieb.dev "DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type" + import ${cors} encode zstd gzip reverse_proxy * localhost:5001 ''; From d39236947371b2f5d2f76429cb2cb7e5cc53ce43 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Sat, 31 Jan 2026 15:04:01 +0100 Subject: [PATCH 26/36] update --- nix/nixpkgs.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json index c3d3918..1efe252 100644 --- a/nix/nixpkgs.json +++ b/nix/nixpkgs.json @@ -1,10 +1,10 @@ { "nixos-25.05": { - "lastUpdated": "2025-12-22T11:35:31.967Z", - "commit": "2b0d2b456e4e8452cf1c16d00118d145f31160f9" + "lastUpdated": "2026-01-31T13:55:04.757Z", + "commit": "ac62194c3917d5f474c1a844b6fd6da2db95077d" }, "nixos-25.11": { - "lastUpdated": "2025-12-22T11:35:32.154Z", - "commit": "b3aad468604d3e488d627c0b43984eb60e75e782" + "lastUpdated": "2026-01-31T13:55:04.922Z", + "commit": "fa83fd837f3098e3e678e6cf017b2b36102c7211" } } From f2b1f2bc51bba715d042acafeb95321eb781cbbd Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Sat, 14 Feb 2026 17:40:02 +0100 Subject: [PATCH 27/36] update and matrix --- nix/apps/matrix/default.nix | 36 +++++++++++++++++++++++++++++++ nix/apps/website/default.nix | 6 ++++++ nix/hive.nix | 3 +++ nix/modules/caddy/default.nix | 2 +- nix/modules/dns/noratrieb.dev.nix | 2 ++ nix/nixpkgs.json | 4 ++-- 6 files changed, 50 insertions(+), 3 deletions(-) create mode 100644 nix/apps/matrix/default.nix diff --git a/nix/apps/matrix/default.nix b/nix/apps/matrix/default.nix new file mode 100644 index 0000000..0906cd1 --- /dev/null +++ b/nix/apps/matrix/default.nix @@ -0,0 +1,36 @@ +{ pkgs, ... }: { + services.matrix-continuwuity = { + enable = true; + settings = { + global = { + server_name = "noratrieb.dev"; + allow_registration = false; + allow_encryption = true; + allow_federation = true; + trusted_servers = [ "matrix.org" ]; + well_known = { + server = "matrix.noratrieb.dev:443"; + client = "https://matrix.noratrieb.dev"; + support_page = "https://noratrieb.dev"; + }; + }; + }; + }; + environment.systemPackages = [ pkgs.matrix-continuwuity ]; + services.caddy.virtualHosts."matrix.noratrieb.dev" = { + extraConfig = '' + encode zstd gzip + + reverse_proxy * http://localhost:6167 + ''; + }; + services.caddy.virtualHosts."matrix.noratrieb.dev:8448" = { + extraConfig = '' + encode zstd gzip + + reverse_proxy * http://localhost:6167 + ''; + }; + networking.firewall.allowedTCPPorts = [ 8448 ]; + networking.firewall.interfaces.wg0.allowedTCPPorts = [ 6167 ]; +} diff --git a/nix/apps/website/default.nix b/nix/apps/website/default.nix index 45e881b..bd5105b 100644 --- a/nix/apps/website/default.nix +++ b/nix/apps/website/default.nix @@ -12,6 +12,12 @@ logFormat = ""; extraConfig = '' encode zstd gzip + + reverse_proxy /.well-known/matrix/* https://matrix.noratrieb.dev { + header_up Host matrix.noratrieb.dev + } + + header -Last-Modified header /blog/css/* Cache-Control "max-age=31540000, immutable" diff --git a/nix/hive.nix b/nix/hive.nix index 9a574d3..6d3a58e 100644 --- a/nix/hive.nix +++ b/nix/hive.nix @@ -205,6 +205,9 @@ ./modules/caddy ./modules/garage ./modules/snowflake-proxy + + # apps + ./apps/matrix ]; system.stateVersion = "23.11"; diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix index daca119..07c3646 100644 --- a/nix/modules/caddy/default.nix +++ b/nix/modules/caddy/default.nix @@ -6,7 +6,7 @@ let "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3" "github.com/sagikazarmark/caddy-fs-s3@v0.10.0" ]; - hash = "sha256-onWUF2Ecd+LFprqY52U1AEvKhBIwKmI6eibeK03LpWM="; + hash = "sha256-aZnF6dMCOfQufDhABS4ggfB0gkhDVYpdn2f60oqqKI8="; }; in { diff --git a/nix/modules/dns/noratrieb.dev.nix b/nix/modules/dns/noratrieb.dev.nix index 81d3647..e2dc8ea 100644 --- a/nix/modules/dns/noratrieb.dev.nix +++ b/nix/modules/dns/noratrieb.dev.nix @@ -63,6 +63,8 @@ let garage = combine [ vps1 vps2 vps3 vps4 ]; + matrix = vps2; + # --- apps docker = vps1; hugo-chat = vps1 // { diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json index 1efe252..f1929d3 100644 --- a/nix/nixpkgs.json +++ b/nix/nixpkgs.json @@ -4,7 +4,7 @@ "commit": "ac62194c3917d5f474c1a844b6fd6da2db95077d" }, "nixos-25.11": { - "lastUpdated": "2026-01-31T13:55:04.922Z", - "commit": "fa83fd837f3098e3e678e6cf017b2b36102c7211" + "lastUpdated": "2026-02-14T15:07:37.351Z", + "commit": "6c5e707c6b5339359a9a9e215c5e66d6d802fd7a" } } From eebb543d9904a7a0ad5b98518274bc7fa23eb792 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Sat, 14 Feb 2026 20:37:31 +0100 Subject: [PATCH 28/36] update to nixos 25.11 --- nix/apps/does-it-build/default.nix | 5 ++--- nix/hive.nix | 4 +--- nix/modules/caddy/default.nix | 2 +- nix/modules/garage/default.nix | 2 +- nix/nixpkgs.json | 4 ---- 5 files changed, 5 insertions(+), 12 deletions(-) diff --git a/nix/apps/does-it-build/default.nix b/nix/apps/does-it-build/default.nix index a2b0244..588d0af 100644 --- a/nix/apps/does-it-build/default.nix +++ b/nix/apps/does-it-build/default.nix @@ -1,8 +1,7 @@ -{ pkgs, nixpkgs-next, lib, config, my-projects-versions, ... }: +{ pkgs, lib, config, my-projects-versions, ... }: let does-it-build-base = (import (pkgs.fetchFromGitHub my-projects-versions.does-it-build.fetchFromGitHub)) { - # needs a recent rust version. - pkgs = nixpkgs-next; + inherit pkgs; }; does-it-build = does-it-build-base.overrideAttrs (finalAttrs: previousAttrs: { DOES_IT_BUILD_OVERRIDE_VERSION = my-projects-versions.does-it-build.commit; diff --git a/nix/hive.nix b/nix/hive.nix index 6d3a58e..3406272 100644 --- a/nix/hive.nix +++ b/nix/hive.nix @@ -2,8 +2,7 @@ meta = let nixpkgs-version = builtins.fromJSON (builtins.readFile ./nixpkgs.json); - nixpkgs-path = (fetchTarball "https://github.com/NixOS/nixpkgs/archive/${nixpkgs-version."nixos-25.05".commit}.tar.gz"); - nixpkgs-next = import (fetchTarball "https://github.com/NixOS/nixpkgs/archive/${nixpkgs-version."nixos-25.11".commit}.tar.gz") { }; + nixpkgs-path = (fetchTarball "https://github.com/NixOS/nixpkgs/archive/${nixpkgs-version."nixos-25.11".commit}.tar.gz"); in { # Override to pin the Nixpkgs version (recommended). This option @@ -16,7 +15,6 @@ specialArgs = { my-projects-versions = builtins.fromJSON (builtins.readFile ./my-projects.json); - inherit nixpkgs-next; inherit nixpkgs-path; networkingConfig = { diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix index 07c3646..dfdf0f6 100644 --- a/nix/modules/caddy/default.nix +++ b/nix/modules/caddy/default.nix @@ -6,7 +6,7 @@ let "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3" "github.com/sagikazarmark/caddy-fs-s3@v0.10.0" ]; - hash = "sha256-aZnF6dMCOfQufDhABS4ggfB0gkhDVYpdn2f60oqqKI8="; + hash = "sha256-ERccS8hBcjttV92MgJkgLBNY1RWRztYujby80MH52Xo="; }; in { diff --git a/nix/modules/garage/default.nix b/nix/modules/garage/default.nix index 23e1cad..409dcc6 100644 --- a/nix/modules/garage/default.nix +++ b/nix/modules/garage/default.nix @@ -20,7 +20,7 @@ in }; services.garage = { enable = true; - package = pkgs.garage_2_1_0; + package = pkgs.garage_2; settings = { metadata_dir = "/var/lib/garage/meta"; data_dir = "/var/lib/garage/data"; diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json index f1929d3..c1c6d94 100644 --- a/nix/nixpkgs.json +++ b/nix/nixpkgs.json @@ -1,8 +1,4 @@ { - "nixos-25.05": { - "lastUpdated": "2026-01-31T13:55:04.757Z", - "commit": "ac62194c3917d5f474c1a844b6fd6da2db95077d" - }, "nixos-25.11": { "lastUpdated": "2026-02-14T15:07:37.351Z", "commit": "6c5e707c6b5339359a9a9e215c5e66d6d802fd7a" From f3aed2bf45c63762478d5e60597549e9d5cf5841 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Wed, 15 Apr 2026 22:06:01 +0200 Subject: [PATCH 29/36] update --- nix/modules/caddy/default.nix | 2 +- nix/nixpkgs.json | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix index dfdf0f6..13f445e 100644 --- a/nix/modules/caddy/default.nix +++ b/nix/modules/caddy/default.nix @@ -6,7 +6,7 @@ let "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3" "github.com/sagikazarmark/caddy-fs-s3@v0.10.0" ]; - hash = "sha256-ERccS8hBcjttV92MgJkgLBNY1RWRztYujby80MH52Xo="; + hash = "sha256-mrsiXQi+5SIA/vhRuyiPUE5EXmLgUHCC5I+L8ARFDDg="; }; in { diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json index c1c6d94..d8692bf 100644 --- a/nix/nixpkgs.json +++ b/nix/nixpkgs.json @@ -1,6 +1,6 @@ { "nixos-25.11": { - "lastUpdated": "2026-02-14T15:07:37.351Z", - "commit": "6c5e707c6b5339359a9a9e215c5e66d6d802fd7a" + "lastUpdated": "2026-04-15T19:50:47.947Z", + "commit": "7e495b747b51f95ae15e74377c5ce1fe69c1765f" } } From 131a2823388ee5f3bc13d290896a628815b04c52 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Sun, 10 May 2026 16:57:35 +0200 Subject: [PATCH 30/36] update --- ci/build.sh | 77 ------------------------------------------------ nix/nixpkgs.json | 4 +-- 2 files changed, 2 insertions(+), 79 deletions(-) delete mode 100755 ci/build.sh diff --git a/ci/build.sh b/ci/build.sh deleted file mode 100755 index e5c7a26..0000000 --- a/ci/build.sh +++ /dev/null @@ -1,77 +0,0 @@ -#!/usr/bin/env bash - -set -euo pipefail - -APP="$1" - -if [ "$APP" = "hugo-chat" ]; then - REPO="https://github.com/C0RR1T/HugoChat.git" -elif [ "$APP" = "cors" ]; then - REPO="https://github.com/noratrieb-lehre/davinci-cors.git" -else - REPO="https://github.com/Noratrieb/$APP.git" -fi - -echo "Checking out $REPO" -git clone "$REPO" ../app -cd ../app - -CURRENT_COMMIT=$(git rev-parse HEAD | cut -c1-8) -echo "Latest commit of $APP is $CURRENT_COMMIT" - -echo "**Commit: \`$CURRENT_COMMIT\`**" >> "$GITHUB_STEP_SUMMARY" - -if [ "$APP" = "hugo-chat" ]; then - IMAGE_PREFIX="docker.noratrieb.dev/hugo-chat" - SERVER_FULL_NAME="$IMAGE_PREFIX-server:$CURRENT_COMMIT" - CLIENT_FULL_NAME="$IMAGE_PREFIX-client:$CURRENT_COMMIT" - - pushd ./HugoServer - echo "Building server" - docker build . -t "$SERVER_FULL_NAME" - docker push "$SERVER_FULL_NAME" - popd - - pushd ./hugo-client - echo "Building client" - docker build . -t "$CLIENT_FULL_NAME" - docker push "$CLIENT_FULL_NAME" - popd - - exit 0 -fi - -if [ "$APP" = "cors" ]; then - IMAGE_PREFIX="docker.noratrieb.dev/cors-school" - SERVER_FULL_NAME="$IMAGE_PREFIX-server:$CURRENT_COMMIT" - CLIENT_FULL_NAME="$IMAGE_PREFIX-client:$CURRENT_COMMIT" - BOT_FULL_NAME="$IMAGE_PREFIX-bot:$CURRENT_COMMIT" - - pushd ./react-frontend - echo "Building frontend" - docker build -t "$CLIENT_FULL_NAME" . - docker push "$CLIENT_FULL_NAME" - popd - - pushd ./rust - echo "Building server" - docker build -t "$SERVER_FULL_NAME" -f Dockerfile.server . - docker push "$SERVER_FULL_NAME" - - echo "Building bot" - docker build -t "$BOT_FULL_NAME" -f Dockerfile.bot . - docker push "$BOT_FULL_NAME" - popd - - exit 0 -fi - -if [ "$APP" = "dockerolat" ]; then - APP="openolat" -fi - -IMAGE_PREFIX="docker.noratrieb.dev/$APP" -IMAGE_FULL_NAME="$IMAGE_PREFIX:$CURRENT_COMMIT" - -docker build . -t "$IMAGE_FULL_NAME" -docker push "$IMAGE_FULL_NAME" diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json index d8692bf..10dd445 100644 --- a/nix/nixpkgs.json +++ b/nix/nixpkgs.json @@ -1,6 +1,6 @@ { "nixos-25.11": { - "lastUpdated": "2026-04-15T19:50:47.947Z", - "commit": "7e495b747b51f95ae15e74377c5ce1fe69c1765f" + "lastUpdated": "2026-05-10T14:35:41.703Z", + "commit": "0c88e1f2bdb93d5999019e99cb0e61e1fe2af4c5" } } From 9dd5ae6698f0181b3ac5836f525d31a627ca489a Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Thu, 28 May 2026 14:57:18 +0200 Subject: [PATCH 31/36] minipc --- minipc-config/configuration.nix | 122 ++++++++++++++++++ nix/hive.nix | 25 +++- nix/modules/default/default.nix | 11 +- nix/modules/immich/default.nix | 29 +++++ nix/modules/minipc/default.nix | 8 ++ nix/modules/minipc/hardware-configuration.nix | 42 ++++++ nix/modules/nas-mount/default.nix | 6 + nix/modules/postgres/default.nix | 6 + nix/modules/tailscale/default.nix | 13 ++ nix/modules/wg-mesh/default.nix | 4 +- nix/secrets/backup_s3_secret.age | 25 ++-- nix/secrets/caddy_s3_key_secret.age | Bin 904 -> 904 bytes nix/secrets/docker_registry_password.age | 10 +- nix/secrets/does_it_build_private_key.age | Bin 1916 -> 1916 bytes nix/secrets/forgejo_s3_key_secret.age | 9 +- nix/secrets/garage_secrets.age | Bin 819 -> 819 bytes nix/secrets/generic_backup_password.age | 24 ++-- nix/secrets/grafana_admin_password.age | Bin 282 -> 282 bytes nix/secrets/hugochat_db_password.age | Bin 339 -> 339 bytes nix/secrets/immich_secrets.age | 5 + nix/secrets/killua_env.age | 9 +- nix/secrets/loki_env.age | Bin 326 -> 326 bytes nix/secrets/minio_env_file.age | 14 +- nix/secrets/openolat_db_password.age | 10 +- nix/secrets/pyroscope_s3_secret.age | 8 +- nix/secrets/registry_htpasswd.age | Bin 278 -> 278 bytes nix/secrets/registry_s3_key_secret.age | 9 +- nix/secrets/restic_backup.age | Bin 784 -> 784 bytes nix/secrets/s3_mc_admin_client.age | Bin 912 -> 912 bytes nix/secrets/secrets.nix | 3 + nix/secrets/upload_files_s3_secret.age | Bin 474 -> 474 bytes nix/secrets/website_s3_key_write.age | Bin 344 -> 344 bytes nix/secrets/wg_private_dns1.age | 8 +- nix/secrets/wg_private_dns2.age | 9 +- nix/secrets/wg_private_minipc.age | 5 + nix/secrets/wg_private_vps1.age | Bin 257 -> 257 bytes nix/secrets/wg_private_vps2.age | Bin 257 -> 257 bytes nix/secrets/wg_private_vps3.age | 9 +- nix/secrets/wg_private_vps4.age | 9 +- nix/secrets/wg_private_vps5.age | Bin 256 -> 256 bytes nix/secrets/widetom_bot_token.age | Bin 272 -> 272 bytes nix/secrets/widetom_config_toml.age | Bin 4006 -> 4006 bytes secrets-git-crypt/immich_secrets | Bin 0 -> 51 bytes secrets-git-crypt/wg_private_minipc | Bin 0 -> 66 bytes 44 files changed, 353 insertions(+), 79 deletions(-) create mode 100644 minipc-config/configuration.nix create mode 100644 nix/modules/immich/default.nix create mode 100644 nix/modules/minipc/default.nix create mode 100644 nix/modules/minipc/hardware-configuration.nix create mode 100644 nix/modules/nas-mount/default.nix create mode 100644 nix/modules/postgres/default.nix create mode 100644 nix/modules/tailscale/default.nix create mode 100644 nix/secrets/immich_secrets.age create mode 100644 nix/secrets/wg_private_minipc.age create mode 100644 secrets-git-crypt/immich_secrets create mode 100644 secrets-git-crypt/wg_private_minipc diff --git a/minipc-config/configuration.nix b/minipc-config/configuration.nix new file mode 100644 index 0000000..442b500 --- /dev/null +++ b/minipc-config/configuration.nix @@ -0,0 +1,122 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running ‘nixos-help’). + +{ config, pkgs, ... }: { + services.openssh.enable = true; + programs.vim.enable = true; + + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + ]; + + # Bootloader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + networking.hostName = "minipc"; # Define your hostname. + # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. + + # Configure network proxy if necessary + # networking.proxy.default = "http://user:password@proxy:port/"; + # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; + + # Enable networking + networking.networkmanager.enable = true; + + # Set your time zone. + time.timeZone = "Europe/Zurich"; + + # Select internationalisation properties. + i18n.defaultLocale = "en_US.UTF-8"; + + # Enable the X11 windowing system. + services.xserver.enable = true; + + # Enable the GNOME Desktop Environment. + services.xserver.displayManager.gdm.enable = true; + services.xserver.desktopManager.gnome.enable = true; + + # Configure keymap in X11 + services.xserver.xkb = { + layout = "ch"; + variant = ""; + }; + + # Configure console keymap + console.keyMap = "sg"; + + # Enable CUPS to print documents. + services.printing.enable = true; + + # Enable sound with pipewire. + services.pulseaudio.enable = false; + security.rtkit.enable = true; + services.pipewire = { + enable = true; + alsa.enable = true; + alsa.support32Bit = true; + pulse.enable = true; + # If you want to use JACK applications, uncomment this + #jack.enable = true; + + # use the example session manager (no others are packaged yet so this is enabled by default, + # no need to redefine it in your config for now) + #media-session.enable = true; + }; + + # Enable touchpad support (enabled default in most desktopManager). + # services.xserver.libinput.enable = true; + + # Define a user account. Don't forget to set a password with ‘passwd’. + users.users.nora = { + isNormalUser = true; + description = "nora"; + extraGroups = [ "networkmanager" "wheel" ]; + packages = with pkgs; [ + # thunderbird + ]; + }; + + # Install firefox. + programs.firefox.enable = true; + + # Allow unfree packages + nixpkgs.config.allowUnfree = true; + + # List packages installed in system profile. To search, run: + # $ nix search wget + environment.systemPackages = with pkgs; [ + # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default. + # wget + ]; + + # Some programs need SUID wrappers, can be configured further or are + # started in user sessions. + # programs.mtr.enable = true; + # programs.gnupg.agent = { + # enable = true; + # enableSSHSupport = true; + # }; + + # List services that you want to enable: + + # Enable the OpenSSH daemon. + # services.openssh.enable = true; + + # Open ports in the firewall. + # networking.firewall.allowedTCPPorts = [ ... ]; + # networking.firewall.allowedUDPPorts = [ ... ]; + # Or disable the firewall altogether. + # networking.firewall.enable = false; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "25.05"; # Did you read the comment? + +} diff --git a/nix/hive.nix b/nix/hive.nix index 3406272..92d7186 100644 --- a/nix/hive.nix +++ b/nix/hive.nix @@ -66,7 +66,7 @@ wg = { privateIP = "10.0.0.3"; publicKey = "pdUxG1vhmYraKzIIEFxTRAMhGwGztBL/Ly5icJUV3g0="; - peers = [ "vps1" "vps2" "vps4" "vps5" "dns1" "dns2" ]; + peers = [ "vps1" "vps2" "vps4" "vps5" "dns1" "dns2" "minipc" ]; }; tags = [ "apps" ]; }; @@ -92,6 +92,17 @@ }; tags = [ "apps" ]; }; + minipc = { + publicIPv4 = null; + publicIPv6 = null; + wg = { + privateIP = "10.0.2.1"; + publicKey = "ecYfTot7RrJyNebSZTQ1wciOhvrpNSSbkR15twpSSl4="; + peers = [ "vps3" ]; + noEndpoint = true; + }; + tags = [ "home" ]; + }; }; }; @@ -300,4 +311,16 @@ system.stateVersion = "23.11"; }; + minipc = { name, nodes, modulesPath, config, pkgs, lib, ... }: { + imports = [ + ./modules/minipc + ./modules/wg-mesh + ./modules/nas-mount + ./modules/postgres + ./modules/immich + ./modules/tailscale + ]; + + system.stateVersion = "25.05"; + }; } diff --git a/nix/modules/default/default.nix b/nix/modules/default/default.nix index 260523c..e3b668a 100644 --- a/nix/modules/default/default.nix +++ b/nix/modules/default/default.nix @@ -2,9 +2,12 @@ let pretense = import (pkgs.fetchFromGitHub my-projects-versions.pretense.fetchFromGitHub); quotdd = import (pkgs.fetchFromGitHub my-projects-versions.quotdd.fetchFromGitHub); + networkConfig = networkingConfig."${name}"; in { - deployment.targetHost = "${name}.infra.noratrieb.dev"; + deployment.targetHost = + if networkConfig.publicIPv4 == null + then name else "${name}.infra.noratrieb.dev"; # TODO: ensure that the rust programs have frame pointers @@ -20,6 +23,8 @@ in nixPath = [ "nixpkgs=${nixpkgs-path}" ]; }; + nixpkgs.config.allowUnfree = true; + environment.systemPackages = with pkgs; [ vim wget @@ -27,10 +32,14 @@ in traceroute dnsutils nftables + htop ]; networking.hostName = name; + # Swiss german console tty keyboard layout + console.keyMap = "sg"; + time.timeZone = "Europe/Zurich"; users.users.root.openssh.authorizedKeys.keys = [ ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG0n1ikUG9rYqobh7WpAyXrqZqxQoQ2zNJrFPj12gTpP nilsh@PC-Nils'' ]; diff --git a/nix/modules/immich/default.nix b/nix/modules/immich/default.nix new file mode 100644 index 0000000..a681d93 --- /dev/null +++ b/nix/modules/immich/default.nix @@ -0,0 +1,29 @@ +{ config, pkgs, ... }: { + age.secrets.immich_secrets.file = ../../secrets/immich_secrets.age; + + services.immich = { + enable = true; + mediaLocation = "/mnt/nas/HEY/_Nora/immich"; + secretsFile = config.age.secrets.immich_secrets.path; + host = "0.0.0.0"; + database = { + enableVectors = false; + enableVectorChord = true; + }; + openFirewall = true; + }; + + services.postgresql = { + ensureDatabases = [ "immich" ]; + ensureUsers = [ + { + name = "immich"; + ensureDBOwnership = true; + } + ]; + authentication = pkgs.lib.mkForce '' + #type database DBuser auth-method + local all all peer + ''; + }; +} diff --git a/nix/modules/minipc/default.nix b/nix/modules/minipc/default.nix new file mode 100644 index 0000000..39adc61 --- /dev/null +++ b/nix/modules/minipc/default.nix @@ -0,0 +1,8 @@ +{ ... }: { + imports = [ ./hardware-configuration.nix ]; + + networking.networkmanager.enable = true; + + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; +} diff --git a/nix/modules/minipc/hardware-configuration.nix b/nix/modules/minipc/hardware-configuration.nix new file mode 100644 index 0000000..b8476f3 --- /dev/null +++ b/nix/modules/minipc/hardware-configuration.nix @@ -0,0 +1,42 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { + device = "/dev/disk/by-uuid/9327fdbf-f6d2-41ae-b69f-6dbb97ab388a"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { + device = "/dev/disk/by-uuid/2A59-D3C9"; + fsType = "vfat"; + options = [ "fmask=0077" "dmask=0077" ]; + }; + + swapDevices = + [{ device = "/dev/disk/by-uuid/db30dd66-fa2a-46a4-b81a-b0fc935db5ac"; }]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/nix/modules/nas-mount/default.nix b/nix/modules/nas-mount/default.nix new file mode 100644 index 0000000..0379576 --- /dev/null +++ b/nix/modules/nas-mount/default.nix @@ -0,0 +1,6 @@ +{ ... }: { + fileSystems."/mnt/nas" = { + device = "nas:/volume1/homes"; + fsType = "nfs"; + }; +} diff --git a/nix/modules/postgres/default.nix b/nix/modules/postgres/default.nix new file mode 100644 index 0000000..79f0e6a --- /dev/null +++ b/nix/modules/postgres/default.nix @@ -0,0 +1,6 @@ +{ pkgs, ... }: { + config.services.postgresql = { + enable = true; + package = pkgs.postgresql_18; + }; +} diff --git a/nix/modules/tailscale/default.nix b/nix/modules/tailscale/default.nix new file mode 100644 index 0000000..9756f48 --- /dev/null +++ b/nix/modules/tailscale/default.nix @@ -0,0 +1,13 @@ +{ ... }: { + networking.nftables.enable = true; + + services.tailscale = { + enable = true; + extraUpFlags = [ "--advertise-exit-node" ]; + useRoutingFeatures = "server"; + }; + + systemd.services.tailscaled.serviceConfig.Environment = [ + "TS_DEBUG_FIREWALL_MODE=nftables" + ]; +} diff --git a/nix/modules/wg-mesh/default.nix b/nix/modules/wg-mesh/default.nix index abb904a..636dc13 100644 --- a/nix/modules/wg-mesh/default.nix +++ b/nix/modules/wg-mesh/default.nix @@ -35,7 +35,9 @@ in let peerConfig = (builtins.getAttr peer networkingConfig).wg; in { inherit (peerConfig) publicKey; - endpoint = "${peer}.infra.noratrieb.dev:${toString listenPort}"; + endpoint = + if !(builtins.hasAttr "noEndpoint" peerConfig) || !peerConfig.noEndpoint + then "${peer}.infra.noratrieb.dev:${toString listenPort}" else null; allowedIPs = [ "${peerConfig.privateIP}/32" ]; # sometimes there's some weirdness....?? persistentKeepalive = 25; diff --git a/nix/secrets/backup_s3_secret.age b/nix/secrets/backup_s3_secret.age index 1aba70f..72aa71e 100644 --- a/nix/secrets/backup_s3_secret.age +++ b/nix/secrets/backup_s3_secret.age @@ -1,13 +1,14 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg Iwzv4FA1pIES6SynmQejkarTCRc3xwqJhbPK+U197BI -0F6drTGs14E6tf0/eDcWu2y9b9yYLXjkAkHV0hT01MQ --> ssh-ed25519 91VHug NhInO02XlDKVDYeEk+Y4jmaAG03YO1yy50R9vnUGPWU -0lgqjusLVxCLIQA8BSQveTNKEQf7uyEctRX+TDqipj4 --> ssh-ed25519 XzACZQ vtBUTFyr4gjqcUsn3WCYOPspjnVwL19izhKYGX4kiy4 -bW6zwWar6COr58s/U6GJZsOPicAECUJr2VQZ0nOneF0 --> ssh-ed25519 51bcvA itN8U0WXocUWmsO7Hy3a94j+aUyH83BN4iG9RK/9lCk -Eyuawwp7+bv9/f2UOihOqFLcETsFgPS+iJRrLID6jT0 --> ssh-ed25519 vT7ExA tJoU7e9muJvOLU1a50SI7+KgbHYke/vaMn77u9gAyTw -p0Ofeh74R/UTpaBRDITNjwwXkUs/grBnsHiSvzUxCKU ---- EsDITASaNlbxImI3s/hCMpOM6Up4UrZgez1fTJlRT1M -:,ߐ n.|*#Ca%Iw$` ssh-ed25519 qM6TYg vf1l0o7K8ZIZGEBx2x7EzWKG7UKFQtuOhBqj/Nyq6xU +8b0863lHC83pZZ/dIkKS3f7L+PE0I+m0f2zqtef4tuU +-> ssh-ed25519 91VHug r5WkIt9V+TM/zupGjYH7FrIz2ZSctKh0cWixaaL8vH8 +c0J8wy8gRmgoA5vEA3AeXa8orH2amWdIgxJJDaBSjTQ +-> ssh-ed25519 XzACZQ Z6z3pornKWMM08RxpWV4YjWs8qKF9xn8lNS6S3SpFSI +1O4YNGfKjiY/BJDKwm1J3ZOhpPrMAiTdUHfZ305mSco +-> ssh-ed25519 51bcvA cxBUjrD7stWdK400O/2HJM3YcKGjDGpWZt4Yq1sVdVg +mw2xRTGFWiWI959J8GOCTp/kiV85+k2/+bYJpw95/ew +-> ssh-ed25519 vT7ExA 8bQ4LWtqj2AodnJHcV8lEk+3EcZBfWHUVHQKcG4nCwI +dIfddL4LTMun+EQQuPdLJNkGVysvTPm2059vQUUnEGk +--- VIlkl9DdBWVgTiJvBK3jgdpsLgGkvv/dFfbZLEYMmT0 + GE=0bʮP*&^V)?0,vpaȧ}p笆Yǭ[;̞@[o g$xܶ9g +{Y}_!([RV U'qC%SZwTC=5aIJxF)J \ No newline at end of file diff --git a/nix/secrets/caddy_s3_key_secret.age b/nix/secrets/caddy_s3_key_secret.age index e3d4cf9073b472dd4e0da5bae69081e7a695f546..d734f8e50e294220306da65e608c68da766d6337 100644 GIT binary patch delta 816 zcmeBR?_i&xQy(6b>!_dSom1(ZobBQizU`6VQLW+UJ&Z*9FXN~ z!sQ=fqHR=?>S|`5VV)UT?4MF<=$;nnT&bU3;9g;B;h7n1n66*uR^{dB%cX0lP+Xj$ zo0?)|YHDbyU}+fUQJSvc>Ft|S98~P>R*`6&;%Sj%>6U3|kXYuTUv5@pk(*IfT$Soy z;%MQNoty2-rJrb-8xWrC8|r74<>(h>sh?!7pC4Er8eEc55S-;ykXlmdUzDv~;pLe< z@uPTnR76@*xqGHDa(m!(GBtBE2g@ zBg36N1HvqgA_AN(Li~KWbaizV$|_QPB8@7Na|2Ry%|im+3Jcvm%*x9gQ%$_9j7%zh z9U~&@%_4Kcd@_Qvx!Clja&$LjrvLsu+jmB#6R(7v@acM{MWrSNiC;yyJkDNY+$Ng+ zKuh}1v72^kXSdvZExhTYe;l`|pZz!6s+Q`xijN~$Z+x8izwn#f_R0#^yl9=BR&p~! z{r#@b;5;7ns73M^%hh>nnDm!q+w8x7*JHBSPlh$}y!Gqlrkq-5F8!qONs-u&h-3}! z_=5#&CRvL#GvqFCjPH(UT&hysz17Oyd(YM{M{h^996e{qxA*0hnuSZJ9lZEk@Y`8t`6T1lJyWgJw_RE9dUj@-n&?;0gKCD1b8fEt z@?P-B5seP@Gg^N$)mIsaFBY5dFw@+WP5S5C->F{<-n9H(CHBLwb>7PVj*nJKUH)jF HC*}tL*CaJ^ delta 816 zcmeBR?_i&xQy*27=^W-^?wM!q65(i?9^qx|U!Iv&*XIQH3>sXNOtDhMW8t#$fV;E6ZmFrsN;pGrAbq#I zRO4iy5W_H!qO{`Vz$nMWlqwVNlHfpN;~ewEz>37OT!T=qZ2e^K%97$jeaHOLtPGPt z1B>$Tg0jG<3XBoxoOWkuLTwED-t~&xo&*4h~GbLs@+a*<4xT!y}b6C83z3~h;#aoQ!ur){oxV=!986K zGA9bcYtOve)?4ZrmG)oc!>>NO-J9cP*M81eRrJt<|3UZ~SH<67r_4GkUFR(?rMyBg zNIfWZMf3~5;K>g}XROn{ GED->rZ8+Zm diff --git a/nix/secrets/docker_registry_password.age b/nix/secrets/docker_registry_password.age index 602f634..f97c5fb 100644 --- a/nix/secrets/docker_registry_password.age +++ b/nix/secrets/docker_registry_password.age @@ -1,7 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg 8d5Jze4wRBsRqy+/ifnIMf5IhQZrn2Hs0k4/RCJoAko -IUgnzcCHmQhsrJfUuOG5s7nl98/X+ycpr0JWQeqc1Ps ---- dNJXPA7jEVJs5yQmvcaidVnJoN5pRMbh6okQsjjDabc -f ssh-ed25519 qM6TYg I4FIet5K6KGjWaCvKbhK7UV4LFJthRpRVDO/FoARzxw +F/KQtQI78KlLe1jT84oxdg4UG8QuG8xAVAutzVM+kJw +--- TEgDiZeZQL2K8Nq/xqUKrkPKSXyO5NgRbx8SkfGl62o +(Lנ* 2ڃjED* ȹ^䥶IJsy:7 oRe \ No newline at end of file diff --git a/nix/secrets/does_it_build_private_key.age b/nix/secrets/does_it_build_private_key.age index bf6bc35db49d1c643d0182a4fe52e8e1afccdab3..babd21b4e73aa04a131cc0c9c9fbf6ca05f86ccb 100644 GIT binary patch delta 1893 zcmeyv_lIwSPQ9T)kz=rSxpuN|X<($AYk*f)Nm8guaHU(ZkGogCOK@PWzoA>9r;(e1 zD_6LeNpMt>d3v^qWrT5dWR!18YDq~_a!GiEZ*ECtMShrtnOljWu~W8RAeXMLu7bOV zdy=-JnRmXkslHcIm3OdlVraIBxszj9esZRPV`*wsR((lfQks8pW-?dg)f^RrqoIc$ zZ+))y`jyc9&fVv_n#BI@*dyPwWJZI{lz>qCub$j&4F+?o0_yAMD4a=_7LyZ|s()vH zx+i0rrqR;v^~!txbg_24OYZ!AoA*G?<@5d3=Y{uuceZ)v$dS0R);mP|BA4u={K+Cu zG82{5E-3ESdDmIL&dmSh40nk+sk}cz!#46ixoLDyYe~zpR|~q9f4i$)%xS-JbIul@ zF9nQgr%#uB`pvRXTmNU8^3;#=Ve@Zlz1k?dZ`wlN_mx{uH_xcL`n-O@kD3b_m(o0? z-I|^$%iXE1l05Q{$I`HwyoXQkh16*n->3y zPzRqcs+kkctvr3c*k#7H`wAaI4;t}?=bt(msrLGxMEjY?d}kj#YSPsFsre#Xwwn3m zC*__Uvio~&+_wnqS(NzqbKd;G&}sD&hEsG6rnxp<+LQQLuJ%vG0mn@BLq{c#Pkyyj ze63vT;Zi+I^A+A3H0}7+dp-&<2t>92yb%A(Igo3igT*A(@?((=T1o*|{I9tCyR2FM zUXgE(vz5!=f5G?X_eVYZcjQCWe~XfoZ7j#{Tb^rsreQK8KDs+;#pay{^u?+z9#-GC zs6Xx)^2(_)_4>*kvi?tgo!^uD^UVK$v5fJDcHZ@kS&g^uMq0S8{v^5~ z$G5<9#VnzxE1%vv60>L5w~Q@zd?&LD)r@X)zs>2ocr{_JUg5N3-($+$vy=0M&pRHR zSba{fbdH~~?Wt%}*ChKdEq^}V=h+bF#hCIY%-ZBry&Uf>+sZ{XN|{1mDwp{PUOQ!S zY_m>?gFNabSIMcw^c76&oxk&)De9y!qwsD{I_O-aB?G zKxJP3uE#UWJ*;$rROf<9mh$ z*W|C* zWmMy`mU}E6p3!%@XJ5NzwRX*sH(#}n$kvA3>DQB(ZocqfS8!_L@-Js(CG3AY9jJSA zsQ!fMjF8(GWyJR7B<^~&fMvbXHwFd1MmOEn%==y+Ueac9UXwq!@a&y{w5Ena@eZS_ zHx^D*&;P3RxnuE~g{LjcwZ9b_Eq(dyI>U=(UjL~Nq{G?UryGjCbZGK@tMcL8-=(W= zCpWlU;|||nR66bW0ggVqMGJ+d?hQ-P*5;NkSbjsKzC*s9Bi2;yr2hY`jkE291ZuvW zb==9{Q?ZcCt=N?H<%~Wy;J!vF1s-Oi=k=ht|XNsai=?i`Yk0SmQFRE zudr|4g_CV8n>{S+-psA}erS28kx|F1uhIuHdN$n=5O+B_)0-bEg^xY9wd!%1o2Yv0?%l|m5N?5sj;)19 z(q5JYGNssBW!`MiS(-V=)@EOY*Sy+mk}FcCSlp|rG2QYpplG-7C%=%Q(;JU-YG_S^tG7o9Kic|z z?T&f*Gc2R_x95G|?jX~aap+Y{?wXIbYRlF-Wjc733QglJ# zOYsWH9&Jw)J5aapV1j6t?yH=*sfSKzcXRkKZGD}jd?4sNo6aA}1ryHi7F3+KYqNaU zvj|?LrLK{R3%n|lds;4d${lNIFm0@AR%%ZQVhwg)uxPSVo!jGE24-{Dy;+}m+3R}S T3pKO$?3A}Fj!4b^D|HP3V)&Pr delta 1893 zcmeyv_lIwSPJLmHQ>atAOG<=APH~WSdb+EAfJs!Dc3`+kiJ_TqNvc;+j=5`OR*^}i z0atc-VP1ZChIfI9g-57kk&%(5Nt&}yxm$TonX^w+SZGvAaY}HSTcBxxE0?aWu0pzn zwtsnXSiY-4S#WSfRA`uorDJ$%VX<#{c222FL8*RbYQ1wvPH><{wkua&J-3^I=fa0d zug_d4PcXZ`k~{3_iWR-@SIcflk)O0c*6X8c%-PJ!o;CB*cLx5JI-(dS^R54v@XdSDob#N`MNYUK&0b&HwM*3Pbz{KIX|Zy7>EHA;W~`uRh;r@!#6_epiqF4}R-4GnJ~OSG-qIy3IcA z(}sJOe>3)m^h}soCgUi#$h3C`*Xp|U9f7U3_syPe_th;|dbMEP)xNlQ+~Ed|%At~9 z9mQULIFU~kBiknQ%XJ9w+-+z|LZ|KW?fFXuTH6@6%MIN_2iwy(KVQqVswYs&aRXoZ5pSdsR&i5UXjLEiweH_Iu6`oht zT&Z82v7rCVHtTC)$u(kocs|TzKULpVf5d2So6VYnCDWJl8Qoyq>sGpcT_sD&j8r{4 z;k2?froS|m=7-*Yc=oW6(-AS>ef3ip*FO4KyEI@=N87yuVP(t4bBC_HnDj|P;NFtx z>SWW+`EyHOTvuNNtV2>W3#w z^y|5z*_$p4iZG-+o@$8ov!W9R3myWxGBq{Qtc1WmBE{ z5|xj3hfam=yLml#o%79!7J}y_*StG0qx*Jl%lB4c({oA2v7xFD^yDVg3P_&sm>aM! zD&zajEf;vZE`}UDUo7-njnqRwBq*EwDt`c0Dtn%%gJp{3jEOho`Q8=q-{~XHID}yO6D`R;ZN~q!Y!%|3_3{vhlhP-W}K0 z+J@?~Z=76_t?yRg7?_JD=l*=Od@^2krlxQ|BK}NSM)B-J7<%%bV?AudH#pACna4BlljG-z)9s z$&^0iw~t|nR(KcO$D_98b|qViaQZ}#=`Wc|^Oar;+UI+H{pB8+P@naNb2dYaBTJTl zyw8vD{6|}!&VA8z#rXZtLl5W7VtD*Iu2%hR%j4Q}dYsWKG7GbwTwwRH4XiO{yL)l9 z&aO)nE-#UFymWrr({+nW{x4~Hdezm#`pv9G?3HWmm(9F1>&d2v$+zteOgEnN(`@pQ zg6z1u%UbgV3~sComwkOO-JIw9)cS@Uk`|NH{r}f%O)1_I#BN!8Xcd~!Y{0*vwT(ZSdHw(MQIBL39VIqh6r3NyyWs4WRa5623KlW1 ze{=nR#;Ti>65lOIUDE6LyhFpWQE&_QGS^_^r$^ZsEdQO*`&PInv#eaS#dd0F&L@|C z)~mm^ofFyaFP!$uOmuIp_|2)Q%OAby{c3+Q^^=vS!p7I)jbhSUjy;l#dpGm^5%o-# zRc8+wITaty{KLp`Vp-RnQ;Cn0 zx$5zTpDdLR|9fxAYyW=7_S*UaiOx@NHf-27M{~jVnB8J4SMfc1vvl|C4_aRBhp%V- zzqoqUbPI{J#*m#_r7Q>2^viA+MLIudclR&3=_39|;P`mKUAFP-t zCgRe*bwPJz{mH$R(K?=P@6?uly*KZh98<%)dmYb{C3Y-*nUUmTmva2+h2s$sR&Ro8 zd0tQA+g9Sav+7mOmixQkO}To^By{TUUy{!IzH)y1%k48EQ}z0TMib= z@32`X`eKHvy5xcM6y~dHQKzN^1Q+z~*>~o+`JcN&La z({H9&@-_a<6Fd3num-10SVzwBDVO7v-&+)&aLK)CIwz8)hIOjr{NvTF6}fRoepMbf zc@f=UzjEnW&y~k=L ssh-ed25519 qM6TYg oDQzYAbe3UasUjgyw2AAtcYaID6nKD+j6C2R05R8Bw0 -NnPZ81p1PafEEfYHP+MafDdrhq83aJ2NuH8iYz2Uk/Q ---- FM0robN+6H2uAp+ASaCVxlLmD6xVp5oNHHAz1BE8/+A -6K(6F Ys#+\,\L:R@t糆Bp -.6> L}`QD 5Q-iӧF 1V \ No newline at end of file +-> ssh-ed25519 qM6TYg pA28Ib4AvSxoAZuGE7ZDW7CpA1GQkYm77WKNahcUFEE +HjzZ2b/iVig4reIgU3z0O1El+tct50LS5fp+SiQB+Pk +--- ExFpE2FxaqSuuSMtQTU+kzVz4rI2SriLKhcy0JHZXPo +Kz)`Q= gXg}| R!wD6?^4HγMV]`7L0T61Nd1 \ץC~ϝF \ No newline at end of file diff --git a/nix/secrets/garage_secrets.age b/nix/secrets/garage_secrets.age index 96d1e66d2671e23286e8b0806c866e900fbb17b3..0da71d3087bb3146420e55ae4b31d135a815528f 100644 GIT binary patch delta 730 zcmdnYwwY~$PQ7DRS!HfiWspT)Ub#z@r(>#xMOBcIYmq@pUSUMCvuQ{~x{Ggwn~`N` zGFNVHWMx%GV6J6>d67q0X{L9okzZ~~U`3IUhijsCxO<*kTDfPrQ({s^HkYoQLUD11 zZfc5=si~o*f~8@YM`^l3XlZ_AntoV>QE^p(S$V#9h+A4^iDOQhez=cMdXT4nmanOk zcUVr4nPFZemr;a4PP)0iN4|-%U#OFlwoy=tuX9F0nTJofZ<2YLqhFYBrkQqjp0j@T z#E;_PChnRsMmc zrBQ)th8{VAiEgQ;`r1`4CZ=9~Y2_w?hMw*fP8sFFDIs|lS(*8h;~B-nvw{tByu+RH zJVQeL3X(ITLPLx^bJI;6vnvwa9E*dDi!7Y{%)$y&{j+_!{EDm0y)7f1{mV@}T=d=2 z^(&2%EIp0FjVr>l0-f`s%nHNHEQ%{KT#F4RpJf!UH}g$NGx3gaF$hj7^4HG`57IA7 zwoFPZ_9`p3@Gs5tGN~%AG)Xfv&&hP<(l!n+aZa`{ERQtt@+(ZQaLy|*&M`|%b2jix z%#HM{axY3X%QY}cx9~~k($&>f$PIPY4$m;~H1H@)H*^flG7Is`Eh;j})AuhiaH{YL z^$IemFAB17$}<5d}Uq59{R@+GtGv*!I{j$@2X3X*!y$&;Tt`p!vizNgMIwsi{+{r@LoLR(7y!iIYJ|hP!roj$yEq zFPBq(s9QuvRHbQAxKXlUWU78hk$XW|NLYDVRF0X4exy-eq-k!JqoZqzE0?aFLUD11 zZfc5=si~o*f~8@YM`^l3pn+Rhc%E@_c!*zFK|z{(rdvgzXI^$$N@-+acD9Fhk#?qc zL8?cwdytbSS3$6Qc!+^{W@TbdRd}ICcwV`7NwTwkW|e1YW_D1KMVfzlNk)igo>!*h z#E;_P>49OTCh3`ZDVa%@WoaqNd6nTAPUR+kIbq3;Med1Nq52j@Nf`z?ULomR&XK9U zeo^6prCHt)NuDK9QK2a*l}Y;HiAIGkZh0Z)hM6wO`X%~)$f2r)LvD+?+!*3R=!j7$r5b}UW{bPW%SG)Z z%!~4@_s=fYcC0ig=dy_{)nBz^^8ZVpel$(`d`x`C*Fv^6HP>RV3M9w@Q>a0FB(5(lPcRq*N5M2o)h}o%RlS$bGO$w@4g6p&%Et`seq+a|K;>ohXl?g zCBENdwEctmmKW^)YdGyP`5$lJXn$jh1V>M7O66CRrB+(8Gad+hP;uhis}@?jI?_D( V!jrW-vWg}*Z-3oC=Plc87XULI7WM!D diff --git a/nix/secrets/generic_backup_password.age b/nix/secrets/generic_backup_password.age index 1e72b6f..a3789b1 100644 --- a/nix/secrets/generic_backup_password.age +++ b/nix/secrets/generic_backup_password.age @@ -1,13 +1,13 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg EOynzb0Op5bNKRZ1jRaS+ZZDowhMmGYkv4u0OjWqJjE -po5rR/gfWwB24nNa3w5VqW8o8AGEqTk40yQTTxNUfEI --> ssh-ed25519 91VHug /NK1O4g1DWl6xNwHgkizeLJoFomY2zy/heEMChzrwWQ -yc+fwswX7at6eEcAjJrcYhdGlJwHJa6ZFpbBhntVtsA --> ssh-ed25519 XzACZQ RUMXGNZ6fpgmOVGKuspoOf5cgGUvjyzCmBipU64BikI -XID++wcObepaGXScGD8KJwSHyX45UjrT2oRlh/VYGHs --> ssh-ed25519 51bcvA TmB9sS4plGSx0ScZxYr2sWCo0UesyceyYPKWi+rVUy0 -yZrk2FbXpqb7XZoullu0JivQ97yTQLBiDv8BOox3evc --> ssh-ed25519 vT7ExA n0kaB8lgH4OWR9l3hxlMT7tSjYZzNNlQLZJXnzHKf2Q -kswoozAAVll/lFIG66Iikzu086tnzGF523fVnAGLFbw ---- Sa3qvrEI+FxIoDUmXRW4tEcNjdhWPw4U15Xy197wb6w -8q93lx~J/VdhoIL{`O!76Һ6Ze._l?Jrf4 \ No newline at end of file +-> ssh-ed25519 qM6TYg AcP/Za8jdEONeSNcC2fm0rZg1VOMvqCreXdpd/iDKDY +dgBlpFUcvP/n86idjIWuKsx7jX6xEWQJKY+pdGG8XVY +-> ssh-ed25519 91VHug R4SIqnNLIoIVGIR0XnUsh3RCz+20M3pWoQGJta4y2CM +s4O6GBECMUQpUX7yhx9CrNgedDn6yomCg8Bkke+4vu8 +-> ssh-ed25519 XzACZQ OVHPNsSR5IfrAslyKuIMAZakz+k12GUGNYsGc7e5WQ4 +IQKyRtlh7lkwIdH79IYCYod93+qAqap6rGL/VJ04Mdo +-> ssh-ed25519 51bcvA NYivGhQwqPbjLY+Bb08ow38Rb1SBfbEotPwdDr/v7gE +VRT0QUnImc0unH4DoEg07+PhQ0a3IsJRrJIcgDzBtjU +-> ssh-ed25519 vT7ExA 6gW6MAGGmz7wqrE1cNgAJqhLyLBDnAkh3IFB/EJf7Us +nhE8i7G/n/CnLTOUYsprFFjWCA+v/CmOpYRB8dAAjaE +--- WvW+S65yf7YP+UsQH7VY1CSRqIFyNQAMBzVDCKcgk28 +wBэ*N%uz>9`?T7L?):g07޵ Lbxa޷$ ? \ No newline at end of file diff --git a/nix/secrets/grafana_admin_password.age b/nix/secrets/grafana_admin_password.age index 18d4ced877abe8545910fcd92c730fb7d8c9c222..75986947808d41dc6a8ca5a55be72e601082f9e8 100644 GIT binary patch delta 246 zcmbQmG>d71PQ7uSOMtgiZgF;Lh+|o?mt$d8P>N@GWsp;Dl}V9Vae$+Dc6w;3iA#8x z30Ig$PG(kGn6qz6d4_pdQE60mPD)snYgE3UPhws~MWKGBOI2=Wl$&Q_K9{bpu0nc_ zqg$y-X?c>VSGI9-aHYSqQ@B@=iBp59;Qc|sI=RDrma^(k> zKM}m{lz;1V=9-)pfesNZ&UKYaQ(LP7OoFd;HSLVZs10CVba>h2TMI2$|9A@kFYINK delta 246 zcmbQmG>d71PQACgSCxlvW~pJSnVWuYSz2mTiG`bAxvRTNm8olSg zHkYYaXu3tFi<^^UUVurqZ-AkTL6C7`VML*iM{<%|L1?gxxpq;mQ&@4n374*}u0oYT zRFQjrX1TVfd6utpa9Dbv1wY6SAJl5WN@laXf{`9(VmNk52+?p z+>V=VK2t8dC*SXy8$%8&yL#_Swrj1!JIyq{NqMjPh95c y5y||p(AKAUYu>U8nLD>;{yV+r>gjb(jzatH8gR9IQgQ4!|4S)1`_J^{<_`hV=VEmL diff --git a/nix/secrets/hugochat_db_password.age b/nix/secrets/hugochat_db_password.age index 07af7262f626ac41d6a207af710426a77b89aa08..a0c5bdeb1f901d7c0b02956dc2aec8f88af083dc 100644 GIT binary patch delta 304 zcmcc2beU;_PQ6)Wg;9k|rk}BUainopQc8KYv$k_VgomR`sc~6wYHof&u6I>Igtu7a0q zl%cDouSr&(v#+*Am5a8ilSP!Xw`;z)MP6C5X`-Q*QN5#Yg{4nXkS|x2XwLRX;V|Rq zKRU;Sc`c8+YE1Soy0I%W*-!BNQ;RP9C954ePk;4sIu&qL;CQ_Lk;-+Cr$qBVU3s)N zTWwmfz!ZK5->-9{uRe-gGxxWhN@-e3?5l#H2RGtp{@Jp`{@F8O&Eq;xBg$WNY@KCg z%w{5|_ccsErR%BY3WdVz*vycIyszGuzPcLdm-glE`*!`3!J*|-eA|STRK!#rww+$j HtF{vW$E ssh-ed25519 yMKb8Q wDQ9QOIpJMfsxGr63x9PozZEVfy1M0XvW9MvIjBjlSo +eAbDN8ZB52vcC1zEXKqjWUYb+vvIJVQ+f9CZmk1Jcos +--- ZRGd4IncBO5g0BIoezzfvCxNMAVP3cgmsF8Co06u+fc +Ui,W b%d9:dq{ ŽL[M ,d8{6 \ No newline at end of file diff --git a/nix/secrets/killua_env.age b/nix/secrets/killua_env.age index 30a6d95..531b5e3 100644 --- a/nix/secrets/killua_env.age +++ b/nix/secrets/killua_env.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg bPkp8HZ9R6dGxYgND2mPKC85fyDhuNyhlnobEZnGRmw -xFKtdyfAEQyFQt8c0hKB5uB+YYVow4nEJkejcDBl5Ls ---- xSKVxbaHOvIFnprTjxfV1rv1L1jc/Y2PkB7TLbWam3E -_Tfv@$&kc* s L]v"Ft!4qۉ27"db8~0亁xyJ`(nb]r8䈺{$tYqua^W96x) \ No newline at end of file +-> ssh-ed25519 qM6TYg 4XizqcJTul2c4nKebIgHNBlX1wfNM6ZdJIi+uD4STCI +wLKLC8dfC1jVWNLQR2pmJM3+yvlILUkn6be+x/l1Se4 +--- kgeOkLbbLqXAK8urZUOVhqPKn4AWulo4hGbOkgr+fOU +BSXN+u%C}%WtMS;abc-fVL@(oNJ?^0 zI+vqkN@}2Ma79>NS&peoR$*p@NvW|#wvV?-nu%+$Pl$(WS(bljl&M=zF_*5cu7YQ9 zXh?~dPl#z@et}O&QNFoxZkbDHV4;~oR;9jCrCCLqbG>)Dv1PG^X&~3L;(cp8S3Gxm zSbX)<4hH_oX?=P}`^i=s-}I%M!grA~RQo<0Y`D7Tp8#9dRiD=;Tfge%6ij(jn0aiy w+pQ-Sk~@A%avZCFFC%ha;-x~eR{=xl!Jn5daG%<}@lc|0#&+J4=f7?M041k>_y7O^ delta 291 zcmX@cbc|_&PQ68WvPW`GuA^m&pKqprNJenJV_wIsacdoiHVu9qib=pnSV~AQB-(detnp`xpqW>K`7VFGfNvdvKo23 zoo_epjkm0>$jb_H(Nul?`q$@8s&QZITHak*>g5=7aEgBvf8>*uX4iQV++KNkTyML# zV(|j0&NkVL`t6(a?q27*)zrQ3ecYx)7rRfL{$sxT>%(n_Vmn2)hAgtU{5Q?-%wy%x u9CQ91p3pFT%Y)KtnS1x1^_b4Kueez%T3p|HlP|c>;){0zYxV1Qfgb?ZKYwlj diff --git a/nix/secrets/minio_env_file.age b/nix/secrets/minio_env_file.age index b23894b..180971c 100644 --- a/nix/secrets/minio_env_file.age +++ b/nix/secrets/minio_env_file.age @@ -1,9 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg LSDtwlm9BBqnpzsXoeCQnJ7YImkiMJvqfet0MROaBFA -h/efW4ApyMTnp/p+3tUa8RaMreI00/T5Q4Gh71lFeTk --> ssh-ed25519 XzACZQ of8qdZPKfTtCKNMA+eHgX+WijYZHrHrzq0alH1mTJyE -rVW21YZw3kbe1TCQj/Ch1krrJt0o6PXThAV/eUbY8B8 ---- gWUT/+evFTR4ARdKZK01i8qgDCjt/EKnpKCAS5fCt1w -(H At_ï -5oJV.D̀#lGu#ɉK!-T~"ksҖoǣip1> -𗣫iD6yPOia$/]:dk]A3 \ No newline at end of file +-> ssh-ed25519 qM6TYg bv3MPWeJTJj/lrwKDBAv4T+OrRdD3ViwX8HLCmCKghE +MGP87vT3Rmf+aqhMMXyZIs4OeMkS+uc+je6Zkod0hrY +-> ssh-ed25519 XzACZQ cUkJyWCO6HkdxCqSnv9onmEUhEQY+Pj4seR/lH8KSAg +qTUgF/iT2IoJf7UOleaayWbkJbn5dgSVHKctKWnqfIw +--- BOvXie+k6OIewLDVF+Rx2YzkpytshqkFGCL/uYgljNQ +}pSS y*Sp*>ݖ  u:0b:=)tS\HNb9_mٝj{)(<3&Ә`R [{aܓ! \ No newline at end of file diff --git a/nix/secrets/openolat_db_password.age b/nix/secrets/openolat_db_password.age index 29aa8ee..cc08707 100644 --- a/nix/secrets/openolat_db_password.age +++ b/nix/secrets/openolat_db_password.age @@ -1,5 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg ONh+83MLxToMgANja31F4qVxE47NVjXat06RLj4qG0E -9vRKxWSdW2Bvc/KsWqbbi5mGhLekViT87WhGnPf5ZUM ---- m/MMUEWaa8RewCOG6fOBQpu8M+pgFMWUs67NQcnI4c8 -J%ϻlNBי#^@fTrxt=If&ICl@ /D8c{MR39擻ն3`;$hھ>sO핅! U} \ No newline at end of file +-> ssh-ed25519 qM6TYg 7Nt/x/IT9ofXjrRRV7coT6nrrCSOCkqUqflm1oXLXTk +BafDaEiVpuT3SDVXvuD31WIKe0QlvAGoyn4MzUm9LfQ +--- BsY9/meRTzX5oCBD+w9f+2TO/TdPD936xOjgtQMWuag +RN|- +[6q +r7d% [3K`I{!u5ƃnӺMvodz A~ǍT QGh?Nw/YBQn_`_,ZFV8yw \ No newline at end of file diff --git a/nix/secrets/pyroscope_s3_secret.age b/nix/secrets/pyroscope_s3_secret.age index 58f14dc..e96d5b8 100644 --- a/nix/secrets/pyroscope_s3_secret.age +++ b/nix/secrets/pyroscope_s3_secret.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 XzACZQ m7q/k7PLJpNDFEFxm1SNobF2abWhncqxWri+CbVqkCc -3NB/uTmOdkPH3N+kZrSep7u0A57KpQzI4tlzyT6Z5rg ---- cI9WvpISFVi7fXb5pcNgyu3rH+4L8o5dZUnAxhQ1x4Y -Wj;lx8m Šq߮X+MJSzա4`=8$9`}w~ډשa6t۫Jtu"|p`Tb("j:I5PrSd3%[ok!gc\6sd52%j \ No newline at end of file +-> ssh-ed25519 XzACZQ ver7uyV552D1F9hTxFYb61szNWPeIxsTr4M6RWZH1DY +BF2bL0xu6rAx21EQkGF8KNc/4+jqo/0E6O89vZ8WhfQ +--- b3peeNoZ70tv7mAtQokJ8IUgE6nTGPvUkSf8p6jika8 +<E7L{WJaO oL֡[Xd-!04U?Cyz1l e1e!_IP2Ce1WzVR}kAVnCb)%̪RwhAwA66Zkqlgz=K \ No newline at end of file diff --git a/nix/secrets/registry_htpasswd.age b/nix/secrets/registry_htpasswd.age index a2098a673dc4d0ec9da553c12abe3fa34a7d4427..dce3ea840df7183eb91ce1a733f7700b83dc4ff2 100644 GIT binary patch delta 242 zcmbQnG>vJ3PQ7=zmw~BoNU2v|SVo|Ut5K9esZ&K@l2^D%d110kS!hm*OR-O-Q$u}?{QQJGV=fpbb=vTJ7{_tY`)RKD1+U delta 242 zcmbQnG>vJ3PJKy;Wu$Yyp|6{{p}T&5nz43)nNwkrsaKhszK^G6o@roZxJPDySGHw( zAeVo+mse<3a-oNFN<=}Tqf1U%W|~E&cR{{kxu=sse!i2rMPQJLrC~spCzr0Su0mi? zzIIN2nP;U@hG&3laFs!Te^_Ovrkok%CxH@|Pgejx#utFK&I vGbJXA%07Lkv#&b!R=4l(%nKiGvfCWGwQSqjLW7wJM;<;uae3N8IoAvTb1PyF diff --git a/nix/secrets/registry_s3_key_secret.age b/nix/secrets/registry_s3_key_secret.age index 11c6e78..5649f2f 100644 --- a/nix/secrets/registry_s3_key_secret.age +++ b/nix/secrets/registry_s3_key_secret.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg zUespYByALhutVeTKDYRCXpskuwotOzfTjWCVtGcXTg -LxTqOV8sk6zOQv1eAIvSfUoeCfpus5lB4VwQV7joMks ---- bCKKLMK0Alw89Sh6HB4EW76P29aNUC5btlNFHDBTsQk -4mXA/u U}hz <5f2<jYO=FWIW%%8f~` vl@:1ľkYwaL:\:G㚢H٭rkbEbt/N}v-xMXܿtGRptǭ.hbԓ8x5LF"qaG ssh-ed25519 qM6TYg /73Z7R1RE4lfUfVSeJqZjbGA5yjygfrxKi5iuMMxrno +tsbPaW/x9HFT/tG+5F3n/3SsuhmswVIfHVLNRAzdiP0 +--- jHapfTz6oq7gdrgBn+XNQdMZ67DbrFPBY6KKzb+wfjE +U1r(RMN8Ol$DNu3JonBOc%AT~RV##[;3*6/5gD]2%f)fxv +]h:d{_O~2tiz28 W>BT(a%͉l`\ \ No newline at end of file diff --git a/nix/secrets/restic_backup.age b/nix/secrets/restic_backup.age index bce219620893904dfb3c6cc51864833be9f6fc61..c968ff04bb49dbfed9dc395368bedfbd6ede363e 100644 GIT binary patch delta 695 zcmbQhHi2z|PQA9XWmT1DrhcBUlT%5NYp!c(ex*yLNrrD~NwIfQikZKsYekqvUYfs0 zAeVN zP98<3CK2Z0xrvq8SylQ4o~fCh1{G03S&n{TK_Mvt$%Ta;zJ(&5LmK$#aX0$g+rZcQto3k1#fHO-)HL z@NjguOb&PPaW*wC@JTn}($&>fh;SK7)5+`W1TXWr{GY+Yc!BA}A3NPL-KNy(&XQd*?-hB} z?e7UDMx9qYmc3_FAmg4n;*MQ=H_VXw^6=x@>}w0|ea#Dz>)YG0o$00hq;i(*4Ud{m zTB={D?YsJ-$UgJC(z1Ko8ImlQwzpA!hGkxWr*?XJk+xfzV`WM}QDQ)7VW>-H zI#-gBYfzMFQCftjw@Y|{Yhk64d777(zq?C`eww9|zka%QVYqWhQc1b9FPE;JLUD11 zZfc5=si~o*f~8@YM`^l3Nw|fvewwRMm`|8{cD{Rtwp*29wrO&tQJG0VQCNAln|5VL zmYJWIcX4JqS9o|-QeJV0S(bUSrK^8HW|mu!g?WgfuccX(NkmR)hqQ(Z~}Lj8=xL&7W~lU)2lQ@nEmvZ^wpoD2fF!t#w>0xbfyogH)ilQKe6 z3v;~+N;178{lblNE4*_(-IIMBU9*DqgS;arpJf!U_scbN&r7KYam{qn_cu2%u#7VH zHw-pS3NKCZ2=MU8cJmBMNp_ENE)LG-%E>9oDMng($&>fFbhd>GAN7mjY_Y|PR}cG3@>o;@vR8XF)=bRb`L0Y zbPGzVcP|Z%D)q=Q;kt8V`d!iXljYXJK{md;>#iP4QM$NscJidBMYG>*UVpPsVrtj7 zR8^086C*x6*D3GkSKymkXLIjg`^H^o_sP5OJjNv_Dbm%iax0iK#N@T<7568;8R2&W zxnE2ZIoYcg`a483WdG?al^>_y-69=g!w?X_d409^4NJYuyX#+UG1yYf;dbZX!E;h) jlp+e$ZM1cQTlJEK`uvLC+_zLMoUCwID0grE?oS2)Vu$(% diff --git a/nix/secrets/s3_mc_admin_client.age b/nix/secrets/s3_mc_admin_client.age index 17f25f5e6c998f2f28f6927bd621d1724ad15514..e64d1a44751ad9bb2956ee36fbde58cc646a86b8 100644 GIT binary patch delta 824 zcmbQhK7oCLPQ6KXNtV7#igtFTMTL2uM_9Q*Vz@;{R$+2hYQArnWqMFpnY(FPu4!gS zK9^~6L|R^!mr12hn!A}tMq#jXa)xtcslS=8o3C%KySAZ^dr)vrc9ogF1(&X!LUD11 zZfc5=si~o*f~8@YM`^l3NN};4p=YRhl6O!=Rfc}Ki<`bzut}I#SW#G&n?Y)&Td0Y# zv8ADfiD{4tSDw3BMM!2@Kv+apa;R^(rB6^;X0VHKX=ZA9MMzPii&MBqP>O$4T2ylW z#E;_Pk?F2ZPLX~gW+{c?KHh1T{vIJ|iREEg9$t=lo`ycfA=v@`1)lyPxfSVLo~GuN zi7BN?+AfX(sg@pr$v$poiAMUlu0@$ePI=zBAteEZNgmpXCi&%);~B-nJ)A?!JSy{| z%3UkmT!Ipf416qua`k;f^34nUoy`)<%H6^(T*KUw%qxAl(tIN$3PQpoiUR!&JxmRK zOv)n-Ox!|CGs~k)Q@uP5!kjF9v_s9!j2tZ{pJf!U4=yfB&oCf$PEZDN;h__bT2du^Yaf(GSD`xDl-rBF3pHC5Ao0P z@d(YXFAps$tO`v}=JL6zGtqY8q(XN);~=x6&&pDw+$;75?ftym^sM0q!$+!p8y1S? zBz`|ZCa{({Wc`?eN>28!+z#V+n#OR4rav@n5XMK;qWy4 zpE-M#^plQ{2h66)y^+c}rhk0p>WYuMp1N$g*WC-PabQEEt;SB^Jw|8)gFw&{}&owSRKOnNB(4p@TI66vx}=NmV8{WER#1~ zK7HYi#VZ?ky>Pm&ZuBhZ5bLf@m#nM`{y#e*G^;n_hH|{b%Qx?yi+=p^=wm`a%$42G zg*g7F?Ci-gx;%A3fj);AS6Qyw`Ah9fcH5qt-&4M;e8B|%(4zY4g05rhXKwOSJ+vp| Q+3EGk;?rJz%BkH906qdf82|tP delta 824 zcmbQhK7oCLPJLx@Qoco^XHIxlfO()>m0v+chNWe2zGq~LtF}*7NMTMyOXh_X=sYRPe6%rh_+*8ibt|@AeXM4LUD11 zZfc5=si~o*f~8@YM`^l3Qg*O=saJkbaE`BeN?4`2yIZlRg==O+SfWv7L}GBDL1{^r zf38oFYhYzMS5{6{cA=w}X^5$RN>zk^d2+I^S)ymCrK3TJQD~55sk^I1a%g&nSC*IS z#E;_Psh)Y2;Z-RaMuyr3K`#EDMgdO#ZWg(z$!=~rDaobY8IEQ8iTNJhr5Pq%2KoV| zF2Vlc<&OE;QE47|W~K(oAx7n%nIVo9mRZ^%CVpNKe)(zU=1zf=;~B-nz4J}nU5pDX z43nKxwLQZvD@v0J+;crma>CQo^76yv-Hah zHTCr?Of)S@GdE6gOfd`0k2EjKE6DWa3i7E+F)Ar3^v?6rj<5_Vw5)J5&NlY3O!p4+ zs7fm^P0#bl$nZ7{PtGyn($&>fD9y}u3h@gr%6BdDG&P9Ia7(sG%PAz!q+DAx0pgg|eeM7{B!`er0DK0hgmb2OWgyGhMV-;PG9j@%( zFS2jevA@^z=4V(GWWFgh^N`$BJ=J~o^@*vg3j9lsNnNjh@6Mn7LuuxH&z=QoH=PbI zf3PklLan>>=sKBx-%YE&Z)@bcWz@X#ka?6&&;O-yDnYgU4N224C^B1hnl!o}irX~5 z%;e$oO%J#q=%2awm9ZhCcb@;(<@bvB@bS*het%!vO7Cv4(+;;3iM=MJOo!fc)*L;o zv^ge9z;Ac$@f&i*uk;`A)uvsKTpID|q^)w{{>0cJs5jVUwjt@eF>b478&t*vY4 QJ^CRo!PCC^UdWXB04^~^=l}o! diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix index 287aa86..22ecaff 100644 --- a/nix/secrets/secrets.nix +++ b/nix/secrets/secrets.nix @@ -6,6 +6,7 @@ let vps3 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHvupo7d9YMZw56qhjB+tZPijxiG1dKChLpkOWZN0Y7C"; vps4 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMpoLgBTWj1BcNxXVdM26jDBZl+BCtUTj20Wv4sZdCHz"; vps5 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBWbIznvWQSqRF1E9Gv9y7JXMy3LZxMAWj6K0Nq91kyZ"; + minipc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINApZRrvK4RC1SU5m4OLbill7HZYPQtuvh/m/AB4q5dG"; in { "widetom_bot_token.age".publicKeys = [ vps1 ]; @@ -30,6 +31,7 @@ in "generic_backup_password.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ]; "website_s3_key_write.age".publicKeys = [ vps1 ]; # only used by Noratrieb/website GHA "does_it_build_private_key.age".publicKeys = [ vps4 ]; + "immich_secrets.age".publicKeys = [ minipc ]; "wg_private_dns1.age".publicKeys = [ dns1 ]; "wg_private_dns2.age".publicKeys = [ dns2 ]; "wg_private_vps1.age".publicKeys = [ vps1 ]; @@ -37,4 +39,5 @@ in "wg_private_vps3.age".publicKeys = [ vps3 ]; "wg_private_vps4.age".publicKeys = [ vps4 ]; "wg_private_vps5.age".publicKeys = [ vps5 ]; + "wg_private_minipc.age".publicKeys = [ minipc ]; } diff --git a/nix/secrets/upload_files_s3_secret.age b/nix/secrets/upload_files_s3_secret.age index 255fdc33acfbdec71c529fff737f2aaa96c88522..50ec7d6a2ad423cac91555e4d5810def9d70b3a9 100644 GIT binary patch delta 440 zcmcb`e2aO4PJNbtrC+&4dReh+ny+(}p?^exi)WyVfuonXcX@JgP*s^%aHwCBtG<7T z0arw5MwCHLR(N@ZcCc}Bs&SHjcuqlxqjyk5mZ_I#M3%9;U!J#idR0MXIhU@ku0l{! zU}9QEdX!smfSXxaKygT+i+iPqQDt~}x>;_8wqL4yP`z8eX+fH|S0LBQds9^dI`7Hy zo4LNP@MnFWdQ5-Sf#p9|?ux#{81=7%XY0KK0+BMO*XW zm?ZhDbGLHvmR;J`S1$2Alq%p{mQwl4;LY3WENzu`fkn?#_^r;XJv6$a7jXT+ls6(K zo#zdA>_2KgrSEh6`gshD1y6K@40o-ZvQeN`!DbzghFijgh;!Vjt62;eMGEkn_;xQZ vx&P>xOO%d5#-(-@J=$Bj?|sQ_)9*jKZshAfX%JbxY~DTqJx;?I delta 440 zcmcb`e2aO4PQ7KQrAb<8n0CHFMY36BUVd4Sr;&wgrdMf^WwJq9p`*5IhZnQM-rcX*(CW>%tssY`*EaY(7FZ%8F7{FF}3 z`_ha4#ZS}U@HA+n;)w|-e0!`lTX)I#({rSPKD)P_{t_h48;TY^-I>p_D)Y2U!11~pDIC%O9p1&| diff --git a/nix/secrets/website_s3_key_write.age b/nix/secrets/website_s3_key_write.age index c42418f0258f196ed9db80fae143904d4e823874..96b92cb19f93e747d1c2813d300d7f31c8d63131 100644 GIT binary patch delta 309 zcmcb?bc1PvPQ8DMR19EN@$s3 zHkUmma!_$`nY(YEd6BnUPDQXqX>qneMSWhRwxxcCelZtYjE~FzeD0u# z6H{Xn;$1x_@}IC`O4}2{W14>~!qd8b_tKEmCDmH-P9_HxyB(9xHus-CDL-?ywR>I4 zJ*N5_^R~LYXPRuvA8;afPOh%Ud!adRS$LGXJ|6!oq0AuKw{-2*WI=<&yALN!JsNj; zNnzxy7w6;nmu}T_T=yyV?U8pO7oR2bF04*^x9-HW4xU#+!fVsiX8hjT-tc>ohcWL~ MHDy!tN?#{60K#;AmH+?% delta 309 zcmcb?bc1PvPQ6FCXPQsAM}${aL~@y#iNASvR(@Jmn0unPvtf>9NTrjrv5RGuTaIV8 z375WKmTz)oL6E<>kAF(r374*}u7aMIIW!>uMyjQ1Ht?y1Ko`3!9eg~)1uNU{NUN|{Ih?no&=eK`67e#&Z|MjN)+b*S7 zHXf%#S8+vi85DHtZEoIw#BUOJud23dWa5*VesY3uZnVDRGx~3O@XmF?w)`XR{9;#J N%~k$Z*jP=S1OOS>f4l$y diff --git a/nix/secrets/wg_private_dns1.age b/nix/secrets/wg_private_dns1.age index 8d422bf..76fd998 100644 --- a/nix/secrets/wg_private_dns1.age +++ b/nix/secrets/wg_private_dns1.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 LZU5Eg T16scfWokKj/4TaHvplWuIdHCs/oR4t3V9x4hFo9yhU -h8RoAXndXCwUBskJlJTLWoXapWMUTF0yPnqUV9u7qt8 ---- qGJTnOXdnz8D9eA8AKtYarVa1l75x10SqjhsKchfQ+E -aҿ/}=7_r^rԕ?y"oؘ;U`*(Ztz7s ，$^k` \ No newline at end of file +-> ssh-ed25519 LZU5Eg 3Bde2BfrG8qdngKCIg4xeXnkqqdrtcAZfW0REYwkmWc +0Js204/ZpkBK9mDZwhYOY1IGW8yA5L/iMAmrZR1r940 +--- V7Xj3KkcueKzPhl6wjk12zRrEmFPMpUcQd799p0Dqr4 +~TO80} Q. {q6Qu׆%N6Ќa|41րZՀ;Dz*^ѻ \ No newline at end of file diff --git a/nix/secrets/wg_private_dns2.age b/nix/secrets/wg_private_dns2.age index cfca638..1c04d1b 100644 --- a/nix/secrets/wg_private_dns2.age +++ b/nix/secrets/wg_private_dns2.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 5bWSnQ eiSLsSWrjQldff9ZbhjhrvGgNGWxmxKu1JfsWmjo0Qg -cCLcVTC9hzN79cOMOuuOMo5VpwlBKraqxqeQuvVzqqU ---- bgLRe7t+KD2ehc2gAp4RERJ3nN5pGLA04L06KHVeQvw -ns4!nt3ܻ:#i? Jʷ '1d!? $/{uX6erL.][ \ No newline at end of file +-> ssh-ed25519 5bWSnQ V/5bLxQqdZEF9tgSPGgm7nEpnyNGScgSVfjS3KOvxA0 +oKHKz5IIZNdsWhBCTCqvHVLAJGC+LEC7RuMgQHI9Wkk +--- 71jtq96kfCYsB8UGSccc2F6qWtj7DO658MeVWSD+L64 +UXd2ClEV~Fgip%N6 +t%͢Ż{LZ@B9${g&PBHQہ%4 \ No newline at end of file diff --git a/nix/secrets/wg_private_minipc.age b/nix/secrets/wg_private_minipc.age new file mode 100644 index 0000000..b5f0470 --- /dev/null +++ b/nix/secrets/wg_private_minipc.age @@ -0,0 +1,5 @@ +age-encryption.org/v1 +-> ssh-ed25519 yMKb8Q o1qLnZBL+o8wrQYM6bo01DsCKVmA/NCzLe84aO4NSlI +iEnVZGcr4wyMN5b5f9Qzt1lmycZVe+km/8ApNvq6ME4 +--- MiV3GRLz1rEy283zGsbTtrAbQgmdW0pobJE83BmPrmU +G^%Lj,sCIC&@>#t$.2R+p.4 ke^+sCgn-z{ \ No newline at end of file diff --git a/nix/secrets/wg_private_vps1.age b/nix/secrets/wg_private_vps1.age index ff02844e38aa68e204ff8326b04b01657cf651bc..c186827a391b40d78823b17623332594a6988942 100644 GIT binary patch delta 221 zcmZoKmSE8k(DDV&H1#l%k)doe@^(nO{ delta 221 zcmZo+7iRQd#LzkZbPkn^79&<7Jc7D9Q z&Q)d*Vwsudlb_+`?h#OBU=ZPFY7|gX>Fycf9hh5ESm7UH=8>9WnV+Fw&ZVoXt5D@^ z9_e0GnpPH=oRVm0Vq_T};qCA3VVLQw@8V?OYHDQZ7UrZ~9-fq9lFa48+M6e^w0F^z z0KNZO1~2Y}FBH1Hf$wsc@T9YHAJ^Qz>a%U$DgT*QcO4R+S(F-}Q2J1Nr_tKXJ0E8- Z%sIY7y|Zu*SHyYIY@1hEhMQ-a0syTxQ=k9< diff --git a/nix/secrets/wg_private_vps2.age b/nix/secrets/wg_private_vps2.age index aa84c780699e849e07d41cd0a8c1b9e921f89a5c..7b8faa9505dd2996c8be4f17302139742ca7f18f 100644 GIT binary patch delta 221 zcmZo5^$|?(9?^;q94jloyni9${&aRu~qT*5mO9>{g|*7VNaedbel z?l~dXxc*m~uHp6?4~y$ZUP?Jlln7lT7|ZndNS4sczC(o~M*kT-&A#8BX1=-7$!CMf YkpF delta 221 zcmZoyK~l^gDy8(bNg=I4}KaMTvUlXv`pt^x5!x}j0QDbK)c^nh diff --git a/nix/secrets/wg_private_vps3.age b/nix/secrets/wg_private_vps3.age index a874cea..50d20a4 100644 --- a/nix/secrets/wg_private_vps3.age +++ b/nix/secrets/wg_private_vps3.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 XzACZQ EsFwUOjtcoWVd5gJxu0vAfcXxGZovBBKcGuin+TE6kY -51vzn9SvfX8WCDe8f5dtblAhFykUIxLkvsNK6XjMSuQ ---- VTYLeqYga9RKPLxjB6JotAMC4StSGh9PNNnG3+kq6vs -]#A *R1*{TMڍíq2~pGJ#RWrWC ҷ# 3^͗ \ No newline at end of file +-> ssh-ed25519 XzACZQ JO+9ZDfv/rjpGHSL8WBm286V164a2CwppavSZ4+L+Ws +hqfAaluHnH5XHzI/oc71q7HlKioHMAbKP9cg9wRJ6kw +--- maAUQCFkFuMs55Yr6wX+2q+VUM/c3h8rNb6u+VrJnEM +)WFj +},E\G&x@,[r+ ssh-ed25519 51bcvA 14yVvUnmbYRhz0jbTEsj5bEZnJleq6ZT3NgOqVybzFk -F0cCQQhghlR3rHDEiBwIWdBXv6Cfac+JL9MArEXOHuY ---- bB7RaiP/rNyTpjpoa2qXmZw7RCa73b2FEy2WN+CTpfk -M):8&=$8.U7~j]QHC$^"˿ -WCZ#uA!dXpx"1c \ No newline at end of file +-> ssh-ed25519 51bcvA CkaPksfSDKWRMaL4FV7vI4VZ2c8Fd2RlyRW8DEkOkgM +NrvBSSPDrwNL+YKgBTHqQuLhKgGy1+/H51JTsA70Dww +--- 6qkEageKcIweJ7wWcqb2HZp9zJNTyLcoQ+Gv/+O6CJA +(,zfD8)]|P+a {n$ Ax"Â]K \ No newline at end of file diff --git a/nix/secrets/wg_private_vps5.age b/nix/secrets/wg_private_vps5.age index 6f2383b0459c1fe76f93a0d8620d856fb7ac1ec9..3f4dbff24b270648ed8918c639b9f7ff5d5e3f1a 100644 GIT binary patch delta 220 zcmZo*YG9h6Q*Y>`A6DUGnw0BYSem0gxF@n5#G zEwk1#E?d4)*!zyM=6~*^=ex}>NA7wreN$3E&|qssdBg>`w2QX`KRxajb<19p@UdF= WROjT%70pWgb|Qr_ZeLX6n-~C#=~6QQ delta 220 zcmZo*YG9h6Q=gKXmaA>)YF^}Ko*9;2mE%)s>Xw$~Z<1qLo?05}Tw3Ymn-q{!?&(@y z&Q+A1SMKVQY@l80=$jf^73O4I;B4un@9R?OotGL=mXZ{iS>_oY91s$i&!wxYt5A^? z;plJSnQK(+9vWO3l9%h~5|LPHXl@*w?iE%LnUdlb8R}t{9Z_zOY{K=_NVP$2|C-s3 za%c1Qb_$1mlwIrRy}&2y8F9hlW3{%r|8TlJ*%@93TzNraz&qOntISW;wuNr+2Cj%l!YRf?0PzEhHciC=KGPnnxzm~U8+ z1(#D*Zl!C8VMtLym1n4bwpq5TadB>HQiZp3q;pYGK9{bpu7Y!p zXI@~Yc42XZVQy-$SzuDKSEQSVS7BD5iFt~Dk+Wk+PHJeDp;=CrwkMZ>``f5vM?;L} zi!b%Avzlq~VOsxb&v&2RzC5lo{n!2fRw7KT3@LhC>yjDe_8|T zl3w?pGfrLlIWqML%TKf3c%eU6HXY{6d17ob$7OGEp~(-!$>;8`m6)?Q>Qi<1-sz8@ oOuOxV@Xg*`u1$e2_ukuFZ)$8QwyaGdQTMFQGDjx<hCj0G3}|`~Uy| diff --git a/nix/secrets/widetom_config_toml.age b/nix/secrets/widetom_config_toml.age index cf9ff8dd43d06bd4c1371b68bc18be371735cb8c..fea9a10a006f3a7499b727380dc1b99c3b8bac64 100644 GIT binary patch delta 4000 zcmZ1`zf69DPQ6iXn!i(0kV`;TWMyiZiK(|wnYVF@tC?3=az(z6Ws1K=sJpqRaj>a- zAXi3FNmaO?zEO6DrJydPCzr0Su7Z!B zTSR4Ou8UbtMsiq4l3BiGxOah{Tcm|YsB21jVNqh4Uww{`Q-GVcu`k!zLXT;`-^+*? zid$ScQEMvldb(E9PuqZUY4fL6|Mf#1f1BU7dVcMIM3L~d=QEyc*c`R4_+!gC)#pB2 z56O1-Ik9AGy;&f##{5|l!?8$r$IBe=gIjJtQ~Kz4Rp^?Q*nD0Yq2)_2FdS6#`r8+4 z{pxJVeFdI7sxKAm`);MRe*DvrTkhj%QD$R0OM=(ufmF*J=HT_bTNddw-1^nBLUHB< z_mzQ9{#C8`nm$MF@Vg^QGIg!(3*CI9j+b;+ubyu8y34!dT=D&X*$XCZ7XER?-QZNf z*$c<^KdbACTP53hcf!522@hA+H3 zY~S`-4j(1I-e0BsO0v>*4!iOenInlg!Bd}YE)3W9|MuYF0W>ue)OTr{eZ}!0!=Hzi{Fau#g&LIRzq5$n8ggA# zI;hq0p8M`of8CyMc+}O<>b#MoD>GOjx920z{jVQ?Em?Yb=aTG#n|H3fIpQgHM5R+i z>f62mt;7`vTf2VOJ?cAq_BW4!{(U>f%;1{zJ-W;vU;O{Kp1EZA!jj~JT|uddhq;c_ z=iaospb

S19qg_ugnGy$`!2UKN~Ln7T~f<&uTIP@5Gh)*jOC($ca0&Xz#&u`<6{+ zc09Z*(A&P}!-1SfN0nq9%hv65*s`fG;&fJFrnE%8?6l?FAxoYuIhV&RK56-p2R0|? z9`pM(X$8-OVAYvR9~?QJwmB%RecxF%;ryBUGcJGB+F;M~;F$Yt$-635x3@W_S~aL> zi?nj@ZL<6HuZ-X3rj>$yw%g%F-S;HfRJ(j;FMhC?E9YRwbkd_^2i`8cCu%X3*{QO?;ZT#$%ev;DB`?^;pt&ZpGrk$Ac)#~tE^{MJxA68|YwYv67oH4QaRlV6o7nhiQ*Oz=g zbNtX6`P))U_SNV2S$g?5bse2`@Xe=W>#YUHA0#lx_OCjYkbEGsK3^zM`b#CvCFMh7e7Oc&S zlVdP6IHYjk=Kf!l{y5Q6*%3Tc$~B3&1(L&e{ajRv-Sm>H2;%1cU+}* zTHl8&rItx&41Tp;+@LjS=hh85C*7T!+g%GiZ@F)sUC|NOxT0&Cy4wd2vyTTeA9489 z$1Fbn&T`qyszYhrPx9nEFD`6!d1MrM$;XnP%Zp3tSMa;k72AUAC)nRuRC1wl_%Vs`t0M2Mf;!1Mf`Ao&A79ArOE2| zUuvwC$^>$|JDk|}oNtnUa_}#2z`3H`&$>(Y_N=(V6**shF*C=dmku!|tLE9X>t#JN zJ8p1WInLbW^_qIC*4sS$7SD>fWjKA8=qG=n&cLW?6&Be)rT>QBzkg)ODc;l1W={!o zh;2TUHuH(sbH1DjGTaybvFa615V;klb?(~p*3bnZtCSb5yYPIE;~V$cR)4khSD(DY z6m?Vc)ZFyEoKFm&68=uPcX*bgpxpuX)U7wapEnUPTf-}$7C)ECrK>(f>4v=5^1o*; zaDC7HZa=%M_iawl-Fv>thqudZUjC`F_t%jW&MPMIHj`f5nY(xvSM!a_oqt&BW^0^# zPSxVrw*&3dh4}7T zMsNPFJcY|3{G7ZTxo0XNk5^*nNzn;Y3I)UYBZ~P!npa>kIO$a^3G3cka@7^ z?ac-GEN?$Yt-2?qfAOmUzq*>#u>+QIH|hmlTO1{_8*efuTI`&$%v$XAyX7&f&rT~` zXrwb;w7*r=%|+Ck^Y5(_;d|%m6fb!7dG@@Bec>YYJZw=?C3W1>7k_&-E#08{>Wb&B zpOh2i<|IXG9(S}8h@ZkxWPQDKYi1*WuEpa<(Sh8*Qg=?__Qx{FGbg%_3u-{m+ol{t9e(Msl%u;NnP`nOa8Qg@=L2Hf0AJT zA;QP`vedg?Mbl}0h=`;B&kX-XnJOQiTH0zjo;Y!4`Ba5JH{a(ym=VYLBv1RLmYLSk z90N_mUJcHP((^>j_IfwGXSnWmI`9dj%qOdk!UUuG+qx#=`^8V!@7lTJhlr*s*TF{5 z(2ifzKW%SNGV2SU7r!&SP_Tf%?DMRv9PRcsex8-NulYYSY}-^aK_RC7vrT)Q!I8Z5 zKQCsxY)j4iHji`G+sHE$12_A;?fh(-7TM1g))_eFo3>Lce z2bi<(wqBE5uXJwNi!GN|W!4{GkaIBDWeeNsMJA<}MD$8`ajdaE@x${-abtIr_MI5M zxk6f3h2~DxWQgQQZwjjENX*-_^RB91_KXm@dLfBV3p@TV5L#ZJaP>cXipP<>%NG+5 z-d)ezEG@UlUTdH0%aWWqLL3Yq`CooN{zN#oeB-?zYdPP=b1oG>y?)s;mz$X<>UZm> z3f(V}ns>jY=TJigL(jGYH$L;tyqo#x?E8~VX-Vu;xdM1K4zu{LzIiEW+LH4B%Tv{s z=3L^lyb+eM!&ievt2>a>_;lpj2aFma?^PGPj&#|U+jurUKFU&bw=B!1-M=pBPqpZ|T)Mz#~(0w-Nf?2-fHYpk|*3TQEw8=rcV(k~shO>>9N z;vn`P8?ExU&y{zddNK2;e7zHoQT5VHN9nTzTA|nZ>r0=IwUhQB|#aZuV|b+py{FX6xtg@w#+#R?j;Az(?tm zW*DxIoX#uvo%@T(7tY|kFE#m_k{>=h9~mYt&gUFFV@#WAQdU9wRqTY_mI;&!J0+XCGuQ zXVX5?yU#Jf+*#+(vX?*Wljf|Rv~Y7$*7}aG$=R`Qlp9scdm}FL?5kz(-XAG%@yFAC z^BtZoa@SY7t@QD3Yze%%l5dvGKgEMN3~}`*=Xt(a=RIrR`sh_Vf9yZ`&LS&5sPXI_ zfs`^qnbkXwOl4-Gxw!KrFS84xzC5wJ*{X1Qw zl6B8lf2^}uRGz`2_vA#?XCHl*3(PyBlRy%S2UQ|GN`t9_{lfSLw-liN#6Zr}OT3^?Bz0`PmL%wAJr^tKK7IG{wd>PAM-{ zZ0b9m{oKz?UbY>a`E5b{4v)`ezkj}CVJ$r8^6ScnrjAd++hPmSr^jt*KdV`%cJ84W zzk}IfgL8+YdHoBoP7N!SQ53hSS-aP%FDG7l@qE>_`b`Y#rEgC;{ZEKzIik9ralhIW ze&ugh109<;P5&H`mXw#azUIr}^uG-my6;Bq$eEV`CN-x zAMnkxa0$tS) zJ4U~^*5>>_jvK$P1lhM<*R#&)bTDEH%(%H{OMJ!ZQ+6&TIh^9He_w9< z&&C>cL{4<#cGXovzx%rT7tZ^zdH$W(K~D}p?|L%bg*{;R&1X_-wsG}aB*e1(Z)+Is zcW;pt`D%Fd%N^mAJFyHhac36)?7q0Cg{S9fr%&{q*9*(ar@dd=`f1aaB#rrbKaQl$ zG~AbT`pIvu!WlBf9idG>58ta?yK}LR5x>i{iHy4L(#HZ7e*K%f?BK4>e@;`SUwrDn zWE^C7YvHRp{k>e`oA14CIMkuuzO9}uvoXSCcfho!S-GxL4OLjx-xTWYQ)b?}(=X-7 zwwH`c9pd)R*kSTQ>wf#pl!*>#^p?Ar3LtYze3*qn9XMe?NHZHDI8Vpm!nX;ZRtdhCA2#royug^zWz&vu)2 z)N9Q+_Vuk@m8;`dA2qAnHEf-e66&trCg_s0h7_pUb`i&EB2Nx-~MF! z+=KUA#Lr~JF@AaVm`lra-m^`;#-hcGO|_q2HdmP<8hw9D%}J#x--REjYy6*+B`xKp zdpmkYiQ{3Gy#AyvttmZB%T!~R_pMsNYj$l{go;UhxUC&Wd-B5I=nB&&t3Jg=pPnq7r5~ub>ZR1Bx6iM=N* zXSBck9;$yawEmmZjbn=zs|j5H!JxP1%Bh+>m+Wny`5XV7@8OEKFy6OlU8#J{ z?K$I~1sL0L7GbC=$ht)sxHZNefzp8@0Ghy*6TTQOZ-Spj( zJk2F3)yl{~u;T15QSJR^!8h}Q1uY%3Sb9~iabK3Nu`5`=f2_FBhMwsx#WrS&_FSqL}UMhwsj3V^$uX)R0%Y>&3b>+uSbJp?LWO!%a?O$F#w-pvui%3%#2V$(D*B7mh3Zxb7hjz;>(c9*Xr65eeMjq#%=o!jOX$?Ao)4#=+TPqCR8_XI z<1MSotNuh-SH9_j2!{Jl(aM-u&BnnfcVF&;KKE#DA#0|JbI2c`;(DF253{3(v1v(-T~?!L(zcq~*PgACJyx zO5EF%@~vrZpd!ous>WIWdhc1jn!n6KcgyMaTT|37o$)gXlRaxX{k_J84;Q^MAD^vU zW}ABA!@Fq~l8?&yzcB}Uaj0Y*oLFBhq*T*h;vu%fchC7;*V8^bBo7}Bv(h-Oc=y*6 zsg0Kpt%#Y#r|fZX;d$q}DS5^6*A50+On8*oa`XF@3HL6>zy6|Y;s34R;?}IbyKguC zoY=U~H^OJjeaSXPw#*EhuzOG6J(%{>_LZBw=7pQ7Z8kku4AQ@D{&J}+F(B%f*{3US zPS>{|zE#XGli67uxN22>P-ijw8JlC<1dq+0d6jqCA?3pdPq^IGED+LG4*PAqCnx*f z^vUm(d|YM*vghsn$Mfeg$N%>hlI1*J#+M}L-CnaH!Qj&LS1Sxk8z%3Oo-G_cQO8*P zm>1ufds5$>)6EvoFNr@`utqZB$i>{nzdNjI|JwZaufKAk{xrKn&+*04kK_~|b;a=2 z#0a@2Z*{mFVXeRapSI=KdmUdBBbsJ^d-VItnX@Z{8@6jrzb$FKb)U*(E}g{E*$khK zuUzT6$YI{I0E-W0#hESd%&KoEzuzkVf9?5KUUD1)!JB37-u7mlJn`Z5m77$(MW!s9 zAAa|^@#gCD9}@rY)O)V#NqNpbJ52x2_jznZPs}F%{9oF?#?WupZU*k+O(!Q@;Pf<` zI5S%1p%jPerKj~#?kvwJyfQO*8YKUV3ru9~^$@3N(~E7p5mk6Nt0yWd>D z??B#!-Wxn8ID@=q1a5n^UGlcqzr(Y_ES9W%xHvZBv~I2V#pIcvy|t%y*Bffw6%=`W z|H5+iCCjJQY&Bi=u(aZ;m)y5Fq2pT8n*yT#EA}igO`i3)By_`N2H^(%cj7-cuKzlH zLj9%m%F~@2DkYgx6IXP-yy#k|l6*K%a7$;NwjgVfuV_Yz|5u)=bMO9|_Fd(T_)K}F zEfx9VIw1=@rkk7%+_dG(-=lj&{>I#{f4xOs+W&#q%#&}n1$Kwz)cS|=v@9!m7ro0i zL;d`wCu|q)DH?0$EZ^>8b>*vxd-bWehd#Ey?_m%xIK1G(!3CS%SIg;d-I!`Rwa?|Y zykv^k-}#R=?(tbW-Tl;_vJ&N#&ugFQ>rQ&8b-bggaq^n_fXFjlcc(5*ujF+)wjyE%KPu@AveKMt0&3-;S44 zCC;9Cw^g~g;c=>}#7tfT=4a-cE=in_cx%P{p85XupFwIo4g7s^o%MGz+l~ftRBiBL zS+zjccY%p?v*yl8xg{~IV!qqBj)eAR*5;h7&W%;weP-sFrkRO~U*;)Y*3z+9QoE8z z>-B~@oyTvumpf*9I9~nuif8}ogunkBDz?eI>)8_;{;R5aVuXgyYL|1irs@Y39bMs=cTOut2PDIUp(Cs_G8gK>D>=HME^{%n_NH5UTCV2TB8zEz8#C= zsyW;GO;pm>W`6Wzx}%D8P) zOukOEe7f}bieR282QGKUYHTU!zq~c3-gfgz-!<2NY_q$jCu%r1b1M7c4UJk|k7Vn= zZ$2h+>i36V#lbhs7k>4RaqF5eC%@yI&AGYrKQ1?3(5o@CI^#++3%{d}*ecs`skBlRmyb-4-BvnEl!MjUEwme!8y?dl{zQ zADne-@2s$oZ@$i2Y`!*^z0k*Hy50rLsUNw!xFqV;u1OV`o>t`#Dg08L_4#3|?u?in zD`wAk()n;9p!MX@AYRYKRvBH9E_%*EvIb6G+VRd84JIs~`$_t*jJf2APwifA4R@sz z8=m!Zn_m~MKKS-V{fjTwKU@4R%+1{T>Dld+B&q#&0!wmEZ~f=oX3=TT;ZWSu-)(00 z)oIa=zn;1N^%HHA%(qAQ*&OlzEEhjNc?WNYuHBMEZcu6>lcR4+)v+WEqT1wP+*{1Ll5sd=v59KU&Xjcjbc)#je{2y<9AVXjHm z<%Wr2$(Js>wVH|VmJ*aFxJ_ z%ssd7=C!=nOSsM!WJ|BuBW75?#{OTtiS^7G_f~&?_&aaUFW3Ip2{W!gTLcek#MELfiZP}HaD%gZ|#Hf&fJZ(3j@wM~9G%m01@&wc%S=C29ce%r&S zdu2!&gY+IZ`|I;&zi;==oESXe*cweaHvR^wM=MPFX3R2_*phdT_eH6g$(ityLf3j8 z?mH2_0m3$-LT?uAeP;D!w`TFQj)qnBN@@C6vJD!8npVG^B Ibhifs0O;!!MF0Q* literal 0 HcmV?d00001 diff --git a/secrets-git-crypt/wg_private_minipc b/secrets-git-crypt/wg_private_minipc new file mode 100644 index 0000000000000000000000000000000000000000..73a8795170ed4d79e835e6d240344812d64f5eef GIT binary patch literal 66 zcmZQ@_Y83kiVO&0sC{*+?Jq|=+XD`_x;ReeG?{bD`&R~BxqbT}V~vZ2>&-rauXfLh YPQBgn Date: Thu, 28 May 2026 15:16:54 +0200 Subject: [PATCH 32/36] update --- nix/modules/caddy/default.nix | 2 +- nix/modules/immich/default.nix | 5 +++++ nix/modules/prometheus/default.nix | 7 +++++++ nix/nixpkgs.json | 4 ++-- 4 files changed, 15 insertions(+), 3 deletions(-) diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix index 13f445e..463b85f 100644 --- a/nix/modules/caddy/default.nix +++ b/nix/modules/caddy/default.nix @@ -6,7 +6,7 @@ let "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3" "github.com/sagikazarmark/caddy-fs-s3@v0.10.0" ]; - hash = "sha256-mrsiXQi+5SIA/vhRuyiPUE5EXmLgUHCC5I+L8ARFDDg="; + hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g="; }; in { diff --git a/nix/modules/immich/default.nix b/nix/modules/immich/default.nix index a681d93..9d3b52c 100644 --- a/nix/modules/immich/default.nix +++ b/nix/modules/immich/default.nix @@ -10,6 +10,9 @@ enableVectors = false; enableVectorChord = true; }; + environment = { + IMMICH_TELEMETRY_INCLUDE = "all"; + }; openFirewall = true; }; @@ -26,4 +29,6 @@ local all all peer ''; }; + + networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8081 8082 ]; } diff --git a/nix/modules/prometheus/default.nix b/nix/modules/prometheus/default.nix index d0e67a1..ef04088 100644 --- a/nix/modules/prometheus/default.nix +++ b/nix/modules/prometheus/default.nix @@ -85,6 +85,13 @@ scrape_interval = "1h"; static_configs = [{ targets = [ "localhost:7846" ]; }]; } + { + job_name = "immich"; + static_configs = [ + { targets = [ "minipc.local:8081" ]; labels = { server = "minipc"; }; } + { targets = [ "minipc.local:8082" ]; labels = { server = "minipc"; }; } + ]; + } ]; }; diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json index 10dd445..8d760b2 100644 --- a/nix/nixpkgs.json +++ b/nix/nixpkgs.json @@ -1,6 +1,6 @@ { "nixos-25.11": { - "lastUpdated": "2026-05-10T14:35:41.703Z", - "commit": "0c88e1f2bdb93d5999019e99cb0e61e1fe2af4c5" + "lastUpdated": "2026-05-28T12:57:27.843Z", + "commit": "b77b3de8775677f84492abe84635f87b0e153f0f" } } From 1df84d34b63f53ace23f9adf07dbcc95e526e549 Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Thu, 28 May 2026 15:21:24 +0200 Subject: [PATCH 33/36] cleanup --- minipc-config/configuration.nix | 122 -------------------------------- 1 file changed, 122 deletions(-) delete mode 100644 minipc-config/configuration.nix diff --git a/minipc-config/configuration.nix b/minipc-config/configuration.nix deleted file mode 100644 index 442b500..0000000 --- a/minipc-config/configuration.nix +++ /dev/null @@ -1,122 +0,0 @@ -# Edit this configuration file to define what should be installed on -# your system. Help is available in the configuration.nix(5) man page -# and in the NixOS manual (accessible by running ‘nixos-help’). - -{ config, pkgs, ... }: { - services.openssh.enable = true; - programs.vim.enable = true; - - imports = - [ # Include the results of the hardware scan. - ./hardware-configuration.nix - ]; - - # Bootloader. - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; - - networking.hostName = "minipc"; # Define your hostname. - # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. - - # Configure network proxy if necessary - # networking.proxy.default = "http://user:password@proxy:port/"; - # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; - - # Enable networking - networking.networkmanager.enable = true; - - # Set your time zone. - time.timeZone = "Europe/Zurich"; - - # Select internationalisation properties. - i18n.defaultLocale = "en_US.UTF-8"; - - # Enable the X11 windowing system. - services.xserver.enable = true; - - # Enable the GNOME Desktop Environment. - services.xserver.displayManager.gdm.enable = true; - services.xserver.desktopManager.gnome.enable = true; - - # Configure keymap in X11 - services.xserver.xkb = { - layout = "ch"; - variant = ""; - }; - - # Configure console keymap - console.keyMap = "sg"; - - # Enable CUPS to print documents. - services.printing.enable = true; - - # Enable sound with pipewire. - services.pulseaudio.enable = false; - security.rtkit.enable = true; - services.pipewire = { - enable = true; - alsa.enable = true; - alsa.support32Bit = true; - pulse.enable = true; - # If you want to use JACK applications, uncomment this - #jack.enable = true; - - # use the example session manager (no others are packaged yet so this is enabled by default, - # no need to redefine it in your config for now) - #media-session.enable = true; - }; - - # Enable touchpad support (enabled default in most desktopManager). - # services.xserver.libinput.enable = true; - - # Define a user account. Don't forget to set a password with ‘passwd’. - users.users.nora = { - isNormalUser = true; - description = "nora"; - extraGroups = [ "networkmanager" "wheel" ]; - packages = with pkgs; [ - # thunderbird - ]; - }; - - # Install firefox. - programs.firefox.enable = true; - - # Allow unfree packages - nixpkgs.config.allowUnfree = true; - - # List packages installed in system profile. To search, run: - # $ nix search wget - environment.systemPackages = with pkgs; [ - # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default. - # wget - ]; - - # Some programs need SUID wrappers, can be configured further or are - # started in user sessions. - # programs.mtr.enable = true; - # programs.gnupg.agent = { - # enable = true; - # enableSSHSupport = true; - # }; - - # List services that you want to enable: - - # Enable the OpenSSH daemon. - # services.openssh.enable = true; - - # Open ports in the firewall. - # networking.firewall.allowedTCPPorts = [ ... ]; - # networking.firewall.allowedUDPPorts = [ ... ]; - # Or disable the firewall altogether. - # networking.firewall.enable = false; - - # This value determines the NixOS release from which the default - # settings for stateful data, like file locations and database versions - # on your system were taken. It‘s perfectly fine and recommended to leave - # this value at the release version of the first install of this system. - # Before changing this value read the documentation for this option - # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). - system.stateVersion = "25.05"; # Did you read the comment? - -} From 975fb518ef736d2d3ccd95430604cd147a2d8eeb Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Thu, 28 May 2026 22:08:46 +0200 Subject: [PATCH 34/36] paperless --- nix/hive.nix | 2 + nix/modules/caddy-base/default.nix | 49 ++++++++++++++++++++++ nix/modules/caddy/default.nix | 39 +---------------- nix/modules/dns/noratrieb.dev.nix | 10 +++++ nix/modules/paperless/default.nix | 24 +++++++++++ nix/secrets/backup_s3_secret.age | Bin 772 -> 772 bytes nix/secrets/caddy_s3_key_secret.age | Bin 904 -> 904 bytes nix/secrets/docker_registry_password.age | 8 ++-- nix/secrets/does_it_build_private_key.age | Bin 1916 -> 1916 bytes nix/secrets/forgejo_s3_key_secret.age | 8 ++-- nix/secrets/garage_secrets.age | Bin 819 -> 819 bytes nix/secrets/generic_backup_password.age | 24 +++++------ nix/secrets/grafana_admin_password.age | 9 ++-- nix/secrets/hugochat_db_password.age | Bin 339 -> 339 bytes nix/secrets/immich_secrets.age | 8 ++-- nix/secrets/killua_env.age | 9 ++-- nix/secrets/loki_env.age | Bin 326 -> 326 bytes nix/secrets/minio_env_file.age | 12 +++--- nix/secrets/openolat_db_password.age | 12 +++--- nix/secrets/paperless_env.age | Bin 0 -> 340 bytes nix/secrets/pyroscope_s3_secret.age | Bin 336 -> 336 bytes nix/secrets/registry_htpasswd.age | Bin 278 -> 278 bytes nix/secrets/registry_s3_key_secret.age | 10 ++--- nix/secrets/restic_backup.age | Bin 784 -> 784 bytes nix/secrets/s3_mc_admin_client.age | Bin 912 -> 912 bytes nix/secrets/secrets.nix | 1 + nix/secrets/upload_files_s3_secret.age | Bin 474 -> 474 bytes nix/secrets/website_s3_key_write.age | Bin 344 -> 344 bytes nix/secrets/wg_private_dns1.age | 8 ++-- nix/secrets/wg_private_dns2.age | 9 ++-- nix/secrets/wg_private_minipc.age | 8 ++-- nix/secrets/wg_private_vps1.age | Bin 257 -> 257 bytes nix/secrets/wg_private_vps2.age | 8 ++-- nix/secrets/wg_private_vps3.age | Bin 257 -> 257 bytes nix/secrets/wg_private_vps4.age | 8 ++-- nix/secrets/wg_private_vps5.age | Bin 256 -> 256 bytes nix/secrets/widetom_bot_token.age | Bin 272 -> 272 bytes nix/secrets/widetom_config_toml.age | Bin 4006 -> 4006 bytes secrets-git-crypt/paperless_env | Bin 0 -> 150 bytes 39 files changed, 158 insertions(+), 108 deletions(-) create mode 100644 nix/modules/caddy-base/default.nix create mode 100644 nix/modules/paperless/default.nix create mode 100644 nix/secrets/paperless_env.age create mode 100644 secrets-git-crypt/paperless_env diff --git a/nix/hive.nix b/nix/hive.nix index 92d7186..eee6101 100644 --- a/nix/hive.nix +++ b/nix/hive.nix @@ -319,6 +319,8 @@ ./modules/postgres ./modules/immich ./modules/tailscale + ./modules/paperless + ./modules/caddy-base ]; system.stateVersion = "25.05"; diff --git a/nix/modules/caddy-base/default.nix b/nix/modules/caddy-base/default.nix new file mode 100644 index 0000000..6356e88 --- /dev/null +++ b/nix/modules/caddy-base/default.nix @@ -0,0 +1,49 @@ +{ pkgs, ... }: +let + caddy = pkgs.caddy.withPlugins { + plugins = [ + "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3" + "github.com/sagikazarmark/caddy-fs-s3@v0.10.0" + ]; + hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g="; + }; +in +{ + environment.systemPackages = [ pkgs.caddy ]; + + networking.firewall.interfaces.wg0.allowedTCPPorts = [ 9010 ]; # metrics + + networking.firewall = { + allowedTCPPorts = [ + 80 # HTTP + 443 # HTTPS + ]; + allowedUDPPorts = [ + 443 # HTTP/3 via QUIC + ]; + }; + + services.caddy = { + enable = true; + package = caddy; + logFormat = '' + output stdout + format json + ''; + globalConfig = '' + auto_https disable_redirects + + servers { + metrics + } + ''; + virtualHosts = { + ":9010" = { + logFormat = "output discard"; + extraConfig = '' + metrics /metrics + ''; + }; + }; + }; +} diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix index 463b85f..e4c1b0a 100644 --- a/nix/modules/caddy/default.nix +++ b/nix/modules/caddy/default.nix @@ -1,40 +1,11 @@ -{ pkgs, config, lib, name, ... }: - -let - caddy = pkgs.caddy.withPlugins { - plugins = [ - "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3" - "github.com/sagikazarmark/caddy-fs-s3@v0.10.0" - ]; - hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g="; - }; -in -{ - environment.systemPackages = [ caddy ]; - - networking.firewall.interfaces.wg0.allowedTCPPorts = [ 9010 ]; # metrics - - networking.firewall = { - allowedTCPPorts = [ - 80 # HTTP - 443 # HTTPS - ]; - allowedUDPPorts = [ - 443 # HTTP/3 via QUIC - ]; - }; +{ pkgs, config, lib, name, ... }: { + imports = [ ../caddy-base ]; age.secrets.caddy_s3_key_secret.file = ../../secrets/caddy_s3_key_secret.age; systemd.services.caddy.serviceConfig.EnvironmentFile = [ config.age.secrets.caddy_s3_key_secret.path ]; systemd.services.caddy.after = [ "garage.service" ]; # the cert store depends on garage services.caddy = { - enable = true; - package = caddy; - logFormat = '' - output stdout - format json - ''; globalConfig = '' email tls@noratrieb.dev auto_https disable_redirects @@ -59,12 +30,6 @@ in respond "This is an HTTPS-only server, silly you. Go to https:// instead." 418 ''; }; - ":9010" = { - logFormat = "output discard"; - extraConfig = '' - metrics /metrics - ''; - }; "${name}.infra.noratrieb.dev" = { logFormat = ""; extraConfig = '' diff --git a/nix/modules/dns/noratrieb.dev.nix b/nix/modules/dns/noratrieb.dev.nix index e2dc8ea..c753f0f 100644 --- a/nix/modules/dns/noratrieb.dev.nix +++ b/nix/modules/dns/noratrieb.dev.nix @@ -14,6 +14,10 @@ let A = lib.lists.flatten (map (host: if builtins.hasAttr "A" host then host.A else [ ]) hosts); AAAA = lib.lists.flatten (map (host: if builtins.hasAttr "AAAA" host then host.AAAA else [ ]) hosts); }; + + minipc = { + A = [ (a "100.100.2.1") ]; # tailscale IP + }; in with hostsToDns; # vps{1,3,4} contains root noratrieb.dev @@ -89,6 +93,12 @@ let grafana = vps3; infra.subdomains = hostsToDns; + # --- internal stuff + internal.subdomains = { + immich = minipc; + paperless = minipc; + }; + # --- other verification _discord.TXT = [ "dh=e0f7e99c70c4ce17f7afcce3be8bfda9cd363843" ]; _atproto.TXT = [ "did=did:plc:pqyzoyxk7gfcbxk65mjyncyl" ]; diff --git a/nix/modules/paperless/default.nix b/nix/modules/paperless/default.nix new file mode 100644 index 0000000..5cb60cb --- /dev/null +++ b/nix/modules/paperless/default.nix @@ -0,0 +1,24 @@ +{ config, ... }: +let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in { + age.secrets.paperless_env.file = ../../secrets/paperless_env.age; + + services.paperless = { + enable = true; + consumptionDir = "${nasDir}/consume"; + address = "0.0.0.0"; + port = 8010; + environmentFile = config.age.secrets.paperless_env.path; + settings = { + PAPERLESS_TIME_ZONE = "Europe/Zurich"; + PAPERLESS_ADMIN_USER = "nora"; + PAPERLESS_OCR_LANGUAGE = "deu+eng"; + }; + exporter = { + enable = true; + directory = "${nasDir}/export_minipc"; + onCalendar = "02:25:00"; + }; + }; + + networking.firewall.allowedTCPPorts = [ 8010 ]; +} diff --git a/nix/secrets/backup_s3_secret.age b/nix/secrets/backup_s3_secret.age index 72aa71e57954d817e2cbc148e766cb57429820e7..af7230234fb4160110188098c8520cce111854ef 100644 GIT binary patch delta 683 zcmZo+Yhjz9Q=gh+f`3;X<6c&QJ89&5fKvNWZ>ss;8_`&VHlX@SYn*v z$W;_*kY`frZWL)zW>Vm2q-|sxT#|2Ml9_Gp74B#3=;xT7>6l_%Rhr=u%B5?kP+Xj$ zo0?)|YHDbyU}+fUQJSvcs-G7bYFg?PY@F_rnNn1d<(8WlW>J=tW}fL$n3b58rXT5I z8Re2>;U8kcl@pnkV&ItQpIcy-Wm;flV&-b( zid@$u|MaM;f;4@TkT4V13a`xcNQ;zEA6JtIk1SW;lyq0FGA|>Ol!#;t|B|RG!wA1z zKTFpr-(<@ufAfF{PuJooQ?Ig2XCM8NTm#R^XBoxoT|z1&z1_VE{JioC3iOM!!y_$H zQmPz1O?+J{jf^v^Dx3Z`(z;(#rDaF!u13^cDV+%b=!*3_ delta 683 zcmZo+Yhjz9Q(u;5m}8J{?rjm}8RhQkRAE$M?phV@?QS0G?G{*4>Yw3Mn5FMmS!h-f z%4LycU}0vQPA9c-Lt?xP*xYT&7zYmjDCRalamW>Qib%B5?kP+Xj$ zo0?)|YHDbyU}+fUQJSt$WE!6BSz;Nc9pbBBRa)SlhT;iQ!kQ|;_ zk(lUXQRZR6m2BW;QC?}09+aD&?`T@)>S*kk8j)y`U*utwm>ZtrnO@=L<&x+WoD~u{ z@uPTnlv$N=L4Hx5cet;wfkjY7L3o%+WL9{wMWMHwWksGvj$g1@uyJsKTd*gWp}$F_ zpL?2jR%WEWlb4Hkd9ILo&U}oV<;*(o+hGebU{t%gXdq z+|rWjqkLQ=eRD$$xE6H&T+Hk4YWve5>EEe!2c86MWYc=_V=b*PE(ritQs8kx?GBN!TbUJn3xh4r}r diff --git a/nix/secrets/caddy_s3_key_secret.age b/nix/secrets/caddy_s3_key_secret.age index d734f8e50e294220306da65e608c68da766d6337..fb3f1f48ec1054af7c92ef1b15f832eac210f897 100644 GIT binary patch delta 816 zcmeBR?_i&xQ|}&-Q&OB{8ju=ZmYI^Jt({(y7M5>Vlv$GJWEK$NVdiL_=^qjq>K{;< z&6VWp5oO_?6O~aE;uq%ckz!$ymg4J_kz0`;WRe}?5@z8NR%qc|7!a-<%B5?kP+Xj$ zo0?)|YHDbyU}+fUQJSuh65$)_V(#POli{Tu=~tFpy%nt>X%*~ z<>BiRRb}AIm1Yr@q@5S#W0{66s$rzJiBXBKVWD3|RH%QDS8jSxX@S2-a7cbdse5@|cBE%gq;oQtWqP`q zV}WUMioa=Ls8?P^U|6DORamx1nT4lma&D1NPHsU)p;^Bq+s{b)Kb5Ef9K#r;}BP_?2M@Ng7S(C|B4W!ibw;$ z9FJf_!xSTfzzF9;k3tu(+^C=^BR{u@VEz2bXBoxoJyHS^ox{tsB3$!B%H5-Uv;C{8 zlFCX_ODs()i*v$@1A~iQ3RBATgAF6O65X;~OI_XbQw9KJrWBO^#i;d4FVmxbaizV{3;wn%Kd`V%uUR4vdcZ3ip`uYU7hodbG$Q3{Vk0B z1Dq1;ef^UP6EgyRx%$M6m+pM*&~|xg*@@~8tM7Fi>gV5oyl&F5Nwu9iA!Q!H_32m3 zT}zL&K3=u5-pWhyPlN5kr|c&jPELBU#Hsbt$+ELNdW|pll{ToQls9jRi%mK3-p6JJ zcf|+c`;Er2exlxg_6An_FpEy}nKj>NqDtc5I~EVr@6^{U=yKb-cx%mrZvUi%t1IuU z)N+FhzpHexQ$y4-i+v*{AlhY(S@=N z_0EcUdVBvDi(AaF(Y`m~S*o|LL=Cr_`nT=dB$Hpftv{x@lvPtX#f|-9*PYn?0w;Ta zUFcq%{#&!GDk7R){ptHI6QM0xtq~hC)jf`1^t?PL?5@KNy%Q_0e*b*srkCRPEspZ~ G1!_dSom1(ZobBQizU`6VQLW+UJ&Z*9FXN~ z!sQ=fqHR=?>S|`5VV)UT?4MF<=$;nnT&bU3;9g;B;h7n1n66*uR^{dB%cX0lP+Xj$ zo0?)|YHDbyU}+fUQJSvc>Ft|S98~P>R*`6&;%Sj%>6U3|kXYuTUv5@pk(*IfT$Soy z;%MQNoty2-rJrb-8xWrC8|r74<>(h>sh?!7pC4Er8eEc55S-;ykXlmdUzDv~;pLe< z@uPTnR76@*xqGHDa(m!(GBtBE2g@ zBg36N1HvqgA_AN(Li~KWbaizV$|_QPB8@7Na|2Ry%|im+3Jcvm%*x9gQ%$_9j7%zh z9U~&@%_4Kcd@_Qvx!Clja&$LjrvLsu+jmB#6R(7v@acM{MWrSNiC;yyJkDNY+$Ng+ zKuh}1v72^kXSdvZExhTYe;l`|pZz!6s+Q`xijN~$Z+x8izwn#f_R0#^yl9=BR&p~! z{r#@b;5;7ns73M^%hh>nnDm!q+w8x7*JHBSPlh$}y!Gqlrkq-5F8!qONs-u&h-3}! z_=5#&CRvL#GvqFCjPH(UT&hysz17Oyd(YM{M{h^996e{qxA*0hnuSZJ9lZEk@Y`8t`6T1lJyWgJw_RE9dUj@-n&?;0gKCD1b8fEt z@?P-B5seP@Gg^N$)mIsaFBY5dFw@+WP5S5C->F{<-n9H(CHBLwb>7PVj*nJKUH)jF HC*}tL*CaJ^ diff --git a/nix/secrets/docker_registry_password.age b/nix/secrets/docker_registry_password.age index f97c5fb..83a4bc9 100644 --- a/nix/secrets/docker_registry_password.age +++ b/nix/secrets/docker_registry_password.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg I4FIet5K6KGjWaCvKbhK7UV4LFJthRpRVDO/FoARzxw -F/KQtQI78KlLe1jT84oxdg4UG8QuG8xAVAutzVM+kJw ---- TEgDiZeZQL2K8Nq/xqUKrkPKSXyO5NgRbx8SkfGl62o -(Lנ* 2ڃjED* ȹ^䥶IJsy:7 oRe \ No newline at end of file +-> ssh-ed25519 qM6TYg 0u8KWoP0daJZA97H5KkNCSn839ObF87VYU4AChP2XVw +PqtYdZR3xokf7iIQ9khrz2pt7n6FipWn5y3bmzDfdEM +--- 3tTg1eoL9exHUTtn3Uww7xWecgmzf5EyyQEZ//Bbjic +|HLXZ'v2"? zI+tIdceb{Hc7{(xj!{ZTa)FVLnSX9zO1Wu9aZ*V|c!qCcsAFMLq`!w>IhU@ku0lYv zTe!A+x~XBgkzZ+*XF!OllaXUluBmC7k4bo8K)6|iSG{(6Xd^JilXxA$FDQfWJM z@zjq6dbj+QE~^~mOEanrp6FXL>xb9zWQHmo1?i{#&tg8A>F>KPDRrlO>Pg+hDqi1x z9qjLLP0)VM5Voz}Q?0Y=&td0-A#0rk!{*EPWh|DNc-w{XYe}q6_gR_P^_!QoF8Mo4 z??U!IiKF{o{x`mnnRmSXO3tFi_ri6(!cu>lK3QY5`g%^`udM>%ZrMCnv)6>VoBdWa zRq5YS=$NjuDd$IBijlQhB$rCfq+c}(dToxrXXPhtmC(!GrQZCpxPH-&8C<7dPMP)C z`(W)<`5hm>b{)v5nvlZYtDSZ#Pm49YbqiZv+;wlRCx+b&QfG4PdBn>+--Lfv`@6gBA z(!X!^j`ahboU+H;cT9EhcT$M|ym8p3WXDp^OaWNcc zShsz~zu7jMeK+>%PBwp;lDuHUh9_+M|1VK$DXZ@mPrJHT+t%Cu)zza9Dx8(yxICWd z!0@Hrx1h%8&;lEto||cPbqyQ!CO_d0k#JSn_o_4D`HH{SqVz5wdh3+>e5RSta{a`6 z-=`NnHFt2#RNBUGVIQk1{8jIX!gEOgNUN{cHXV52k2Cd9ys$ zmN$oT9qr2M1?zpJ+Q{@k+i_O*na-=7)pC<$hgO6QsTW=gVt$BIY&6OOHUlTllLT&{H0mI}ju#FAwqh59 zrN8s3DdfEWWT5xGwLW~$zxtQAPo5P{zpz$X`R}tCH*deyG@f7aZ{q!$uZ!!C@N38C zE?_!+E!u43@dwu?@B0^X!eDDiSOx#pzwz7sRnyH^KYO3fC?43gS>2P3W3!LIEd|yR ztBs*;oBMx$U75XP@r~OrI)mOOKVEBpi%aucBJ0$Hx7oTp|GE~bv~JB7Oz-+`Twi+R z%|}knTh2W5*fw_wxJEdh4xg;Y_bs?0{Qq*b2T_-9ZsBW_GoO6NVB125wya6SC(=f|Nr za|I?XkEqBwEV912@n_iD9TN_!|KZMGwymGPzCY^Zq>YjBGfJab)Bep5OSZWEUux28 zmBpP>8+T6jU-td0)`ZDb21|IVETmdY|JzHKs`I_uS{-=7z?Eyo(mzaEO?7&)Av>9} z92-9#*!}6miX9&tG;-ZmCF*g0`NOni`K1dl(=2sOaxR@uQ}&oV)9A*}mc^AP!xFjb znclZgkV&ZTtWJC{wflq2tV_Gt;~Ng&;NrY4fBUG6sY!VHnr9(eb39IpP29u8W3xGY zx1-#l8;=A|UCw;<+T+0d&;FfWZB@t2CbrIQtXnpJ?oFPypsp6bNS zk{V?`?+XqDOk7~MFMY@Mbt+|dSM5sJ&;M7{wzz!N#<<&@NnAcf=bHT3ZX8#P?ds*8 z7Pn`$qW|JDQD;@_-{;)++pj()>2q!4!Og2K2?oi=`fZf;o%Cq&=@<)x|bYx@{ zB&J{cy(;0mYllZUtCJeR+0y!7*ix3W@l&DTjQ^w##pFPvP-x_jcBDRLYk{{%c8 zLp@YNWPj$lAO5$gu(xCBDyE4CPo$m;bx@gn-};a6Rffy$UpfUU4(DsFQ0eJTKDJB! Q`3#2jMX%9r;(e1 zD_6LeNpMt>d3v^qWrT5dWR!18YDq~_a!GiEZ*ECtMShrtnOljWu~W8RAeXMLu7bOV zdy=-JnRmXkslHcIm3OdlVraIBxszj9esZRPV`*wsR((lfQks8pW-?dg)f^RrqoIc$ zZ+))y`jyc9&fVv_n#BI@*dyPwWJZI{lz>qCub$j&4F+?o0_yAMD4a=_7LyZ|s()vH zx+i0rrqR;v^~!txbg_24OYZ!AoA*G?<@5d3=Y{uuceZ)v$dS0R);mP|BA4u={K+Cu zG82{5E-3ESdDmIL&dmSh40nk+sk}cz!#46ixoLDyYe~zpR|~q9f4i$)%xS-JbIul@ zF9nQgr%#uB`pvRXTmNU8^3;#=Ve@Zlz1k?dZ`wlN_mx{uH_xcL`n-O@kD3b_m(o0? z-I|^$%iXE1l05Q{$I`HwyoXQkh16*n->3y zPzRqcs+kkctvr3c*k#7H`wAaI4;t}?=bt(msrLGxMEjY?d}kj#YSPsFsre#Xwwn3m zC*__Uvio~&+_wnqS(NzqbKd;G&}sD&hEsG6rnxp<+LQQLuJ%vG0mn@BLq{c#Pkyyj ze63vT;Zi+I^A+A3H0}7+dp-&<2t>92yb%A(Igo3igT*A(@?((=T1o*|{I9tCyR2FM zUXgE(vz5!=f5G?X_eVYZcjQCWe~XfoZ7j#{Tb^rsreQK8KDs+;#pay{^u?+z9#-GC zs6Xx)^2(_)_4>*kvi?tgo!^uD^UVK$v5fJDcHZ@kS&g^uMq0S8{v^5~ z$G5<9#VnzxE1%vv60>L5w~Q@zd?&LD)r@X)zs>2ocr{_JUg5N3-($+$vy=0M&pRHR zSba{fbdH~~?Wt%}*ChKdEq^}V=h+bF#hCIY%-ZBry&Uf>+sZ{XN|{1mDwp{PUOQ!S zY_m>?gFNabSIMcw^c76&oxk&)De9y!qwsD{I_O-aB?G zKxJP3uE#UWJ*;$rROf<9mh$ z*W|C* zWmMy`mU}E6p3!%@XJ5NzwRX*sH(#}n$kvA3>DQB(ZocqfS8!_L@-Js(CG3AY9jJSA zsQ!fMjF8(GWyJR7B<^~&fMvbXHwFd1MmOEn%==y+Ueac9UXwq!@a&y{w5Ena@eZS_ zHx^D*&;P3RxnuE~g{LjcwZ9b_Eq(dyI>U=(UjL~Nq{G?UryGjCbZGK@tMcL8-=(W= zCpWlU;|||nR66bW0ggVqMGJ+d?hQ-P*5;NkSbjsKzC*s9Bi2;yr2hY`jkE291ZuvW zb==9{Q?ZcCt=N?H<%~Wy;J!vF1s-Oi=k=ht|XNsai=?i`Yk0SmQFRE zudr|4g_CV8n>{S+-psA}erS28kx|F1uhIuHdN$n=5O+B_)0-bEg^xY9wd!%1o2Yv0?%l|m5N?5sj;)19 z(q5JYGNssBW!`MiS(-V=)@EOY*Sy+mk}FcCSlp|rG2QYpplG-7C%=%Q(;JU-YG_S^tG7o9Kic|z z?T&f*Gc2R_x95G|?jX~aap+Y{?wXIbYRlF-Wjc733QglJ# zOYsWH9&Jw)J5aapV1j6t?yH=*sfSKzcXRkKZGD}jd?4sNo6aA}1ryHi7F3+KYqNaU zvj|?LrLK{R3%n|lds;4d${lNIFm0@AR%%ZQVhwg)uxPSVo!jGE24-{Dy;+}m+3R}S T3pKO$?3A}Fj!4b^D|HP3V)&Pr diff --git a/nix/secrets/forgejo_s3_key_secret.age b/nix/secrets/forgejo_s3_key_secret.age index 8313430..ae631cc 100644 --- a/nix/secrets/forgejo_s3_key_secret.age +++ b/nix/secrets/forgejo_s3_key_secret.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg pA28Ib4AvSxoAZuGE7ZDW7CpA1GQkYm77WKNahcUFEE -HjzZ2b/iVig4reIgU3z0O1El+tct50LS5fp+SiQB+Pk ---- ExFpE2FxaqSuuSMtQTU+kzVz4rI2SriLKhcy0JHZXPo -Kz)`Q= gXg}| R!wD6?^4HγMV]`7L0T61Nd1 \ץC~ϝF \ No newline at end of file +-> ssh-ed25519 qM6TYg z5yLpu5zJ9m7Ukl3nEHZND8Ot2cYnADJidYjELzfr0k +qy1n6TSeWniRFXLc1Zkpvz1+pmjFaMga0BeSE1q6RSk +--- fe6vqb3f0bRvXlQG4JglZ0h/At5kUPIM+VkRh91BCtY +".O J76~ԥSH-40 [vAD=^Ty"@A@,P|q!؊M \ No newline at end of file diff --git a/nix/secrets/garage_secrets.age b/nix/secrets/garage_secrets.age index 0da71d3087bb3146420e55ae4b31d135a815528f..7f33bee3408de17e9140ea4ca694103ebe5276f4 100644 GIT binary patch delta 730 zcmdnYwwY~$PJNbFu$OUacv5b;cVS{-qK84Avtyc9hFO)nL3yBspGTxma)z02R+w9+ zFIQfbueW7IX=1uzZfZ`dSD3F^qMy6BacGvdk4t8DPI!r9l54SRSYlL>E0?aFLUD11 zZfc5=si~o*f~8@YM`^l3PP(6dn5Djdq>ou)S-wlYshdfXZ+Ui5R=QV(xshv-Nm03T zrIU}VxtEhCmv?2Mf3k^zzGf@GCMb$d2&yC^OK`aY{GwG7il1Hc2zh_BD?356>zO zaW2oQ4~_Km4RUnK=6X3bwAk}AXO16JiqD4wpO#+WkNb0y{bV7tzGT2u7mk=)FK4_{ z-FokDvB^Sr=QID#@4D8Kn7)U9(f5S{HM$*X^R;!lU$AbHttsOx$ZCy!(4yDpGx^jv z+n!}V=Z2oT|3pTh`#`+?@+5aQwa9Xz*Kb#Rs^L$oGYKpVn)Ov{kx#`km0R7LBd3W4 ztSxf=|M1{dKUtj_S>en2TB=SySgq_Wb@G$LndP6iE1PdqQk!{ho}BHvC+-yszWXiH UV`<6jl=C+i_>x?kmRuDA0PtuIq5uE@ delta 730 zcmdnYwwY~$PQ7DRS!HfiWspT)Ub#z@r(>#xMOBcIYmq@pUSUMCvuQ{~x{Ggwn~`N` zGFNVHWMx%GV6J6>d67q0X{L9okzZ~~U`3IUhijsCxO<*kTDfPrQ({s^HkYoQLUD11 zZfc5=si~o*f~8@YM`^l3XlZ_AntoV>QE^p(S$V#9h+A4^iDOQhez=cMdXT4nmanOk zcUVr4nPFZemr;a4PP)0iN4|-%U#OFlwoy=tuX9F0nTJofZ<2YLqhFYBrkQqjp0j@T z#E;_PChnRsMmc zrBQ)th8{VAiEgQ;`r1`4CZ=9~Y2_w?hMw*fP8sFFDIs|lS(*8h;~B-nvw{tByu+RH zJVQeL3X(ITLPLx^bJI;6vnvwa9E*dDi!7Y{%)$y&{j+_!{EDm0y)7f1{mV@}T=d=2 z^(&2%EIp0FjVr>l0-f`s%nHNHEQ%{KT#F4RpJf!UH}g$NGx3gaF$hj7^4HG`57IA7 zwoFPZ_9`p3@Gs5tGN~%AG)Xfv&&hP<(l!n+aZa`{ERQtt@+(ZQaLy|*&M`|%b2jix z%#HM{axY3X%QY}cx9~~k($&>f$PIPY4$m;~H1H@)H*^flG7Is`Eh;j})AuhiaH{YL z^$IemFAB17$}<5d}Uq59{R@+GtGv*!I{j$@2X3X*!y$&;Tt`p!vizNgM ssh-ed25519 qM6TYg AcP/Za8jdEONeSNcC2fm0rZg1VOMvqCreXdpd/iDKDY -dgBlpFUcvP/n86idjIWuKsx7jX6xEWQJKY+pdGG8XVY --> ssh-ed25519 91VHug R4SIqnNLIoIVGIR0XnUsh3RCz+20M3pWoQGJta4y2CM -s4O6GBECMUQpUX7yhx9CrNgedDn6yomCg8Bkke+4vu8 --> ssh-ed25519 XzACZQ OVHPNsSR5IfrAslyKuIMAZakz+k12GUGNYsGc7e5WQ4 -IQKyRtlh7lkwIdH79IYCYod93+qAqap6rGL/VJ04Mdo --> ssh-ed25519 51bcvA NYivGhQwqPbjLY+Bb08ow38Rb1SBfbEotPwdDr/v7gE -VRT0QUnImc0unH4DoEg07+PhQ0a3IsJRrJIcgDzBtjU --> ssh-ed25519 vT7ExA 6gW6MAGGmz7wqrE1cNgAJqhLyLBDnAkh3IFB/EJf7Us -nhE8i7G/n/CnLTOUYsprFFjWCA+v/CmOpYRB8dAAjaE ---- WvW+S65yf7YP+UsQH7VY1CSRqIFyNQAMBzVDCKcgk28 -wBэ*N%uz>9`?T7L?):g07޵ Lbxa޷$ ? \ No newline at end of file +-> ssh-ed25519 qM6TYg WSRKNimMa2qdIrTxZIsnybHi+gzOweCGmCx2D3DPciU +e6MO1QIL5FI0ATaR8hBUeE2ayLoyP4P7d5eO7liMBHg +-> ssh-ed25519 91VHug JZjoc5tcVSQjIpbVGVca4P2s80Rb7NTIEKPhlXx9wQ4 +QWqufjXwphL4Kes5Ky2tWozdusA5AJwqgzT5JWCQbvQ +-> ssh-ed25519 XzACZQ ek1dpX4Lqf6hd13B0dX06tTTmNRhZswxV3W1gBLKkXk +LQMnAxrr3ZfUc3Brn39BzIdyBe8Jma8LSML+eaBuKJE +-> ssh-ed25519 51bcvA zA9GHEGOXETl9zX0yoHHB9B5On06KlEcYRba8eKGKEo +yPTcsFhDLiSLpWoZX0b7dNzZmBaLTUY8PSMVFCUzlRA +-> ssh-ed25519 vT7ExA N7U+hiTEzwKvglQ0At36e/p0TTA7xVRb7UvuX/4Bbjs +acP9zBODifOsHVmM7COfBX+tkxZIPnQCUR0TskHacQ8 +--- tOLU9ascA2rI4R0oIg/0vsn2dEC1LBLFN6TFRcyrcvI +{đq.忳U َcO)|¥,+^]?PĻ$3m4Ǧ|c).R6@r] \ No newline at end of file diff --git a/nix/secrets/grafana_admin_password.age b/nix/secrets/grafana_admin_password.age index 7598694..53e26d0 100644 --- a/nix/secrets/grafana_admin_password.age +++ b/nix/secrets/grafana_admin_password.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 XzACZQ 3nDPKBmskuTAvsJAqjRdIWyRBmz4r6sPAKkgUu4DWV4 -VHlijfVCMdwh7VruZkldVzEZoNLanXxq/yDzmiZFIao ---- glAFu4uwb5Jk3cSyOCBWJr4BfJVAi9HxzWkvTVm1dZA -ƫs ȷocp"H഻`3MrPavEP#9"b}% wBoilQ@XC~y"zP4SԊXh}Pæڡ9 \ No newline at end of file +-> ssh-ed25519 XzACZQ jIs+NClvISjvJSkJlkkGX5ZJzFge/1Nj2Wi4en/viRw +H1sfzg7cCWmCVg9GpFF5QNVVJjllxbmt7wBETRfM8hw +--- hOo2vi9EjLwAa8PQzJGdzUZ/VIzfhM7TnPsQ+OYJzcY +%f>8Àuw[ l*V(u2)e&X) +ƼQ"X|iO,';ItʽoZ՝kE)I 0v/? \ No newline at end of file diff --git a/nix/secrets/hugochat_db_password.age b/nix/secrets/hugochat_db_password.age index a0c5bdeb1f901d7c0b02956dc2aec8f88af083dc..fec59be17cfc087c53a1d386796c2d3fcc51ed3f 100644 GIT binary patch delta 304 zcmcc2beU;_PJOeQLgjr^!dAV7Ize{MK zBUhllW0Y};cTRbxX_0G~MQ&hlpqsvVsZ&LzK~R`$Rbp0(cT{PZyH8bFI+w1lu7X=> zmWN-tWl&nOd#P_^T0xenvt>qpc(G|_WMY9_T0Dl%5i=dH}+RN%Dtt^I{8vh6jhu} zFD%Sn?bXP(e%e+4=4VMKF0DIz!X|U!f^vW6v#F2clFZg~rnP@duy6a+RlJDz>E}~Z z6EkwxwjEEXZ;aQ>Hk^Az-fn^c%R3du>|>ACOfIgt ssh-ed25519 yMKb8Q wDQ9QOIpJMfsxGr63x9PozZEVfy1M0XvW9MvIjBjlSo -eAbDN8ZB52vcC1zEXKqjWUYb+vvIJVQ+f9CZmk1Jcos ---- ZRGd4IncBO5g0BIoezzfvCxNMAVP3cgmsF8Co06u+fc -Ui,W b%d9:dq{ ŽL[M ,d8{6 \ No newline at end of file +-> ssh-ed25519 yMKb8Q szKG8gw88EAiUx26fzY/pYMVb7Vb91FZC1FEQTYRZDY +0jBl8757lsXnxWE90iZLJcO5VUXz+E2+7m/ZfNq87J0 +--- huOResyzGVCip/Sdoyvid3TxFI01wiXNaHdZ/oGI5Zg +*clHxAh5H(dU'nҘ;M.Vx}" f 9f~Jv9 \ No newline at end of file diff --git a/nix/secrets/killua_env.age b/nix/secrets/killua_env.age index 531b5e3..3633642 100644 --- a/nix/secrets/killua_env.age +++ b/nix/secrets/killua_env.age @@ -1,6 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg 4XizqcJTul2c4nKebIgHNBlX1wfNM6ZdJIi+uD4STCI -wLKLC8dfC1jVWNLQR2pmJM3+yvlILUkn6be+x/l1Se4 ---- kgeOkLbbLqXAK8urZUOVhqPKn4AWulo4hGbOkgr+fOU -BSXN ssh-ed25519 qM6TYg mMvnBUGVS8d0di+drDXo7mws4Uz5T+nZmQY9uUpKfQ8 +rea2peORLvRF6qYtGKFnylyEdnV0NTc6QO3xSgp/y1I +--- xyeBOfVq3hwyckUma5LWOU9cWHzg/XY2f8T/0Vc+njk +G6kN0 !Um[rHꟉt}׊X'yqLbEY:n NHnHݰ'W|3z{٢'N&M`# \ No newline at end of file diff --git a/nix/secrets/loki_env.age b/nix/secrets/loki_env.age index 75520f96fa4d5b07be5f41615639b72017e4e2d8..3b49086d19e726dbfad8e15f94fcd8e5cc54bd5c 100644 GIT binary patch delta 291 zcmX@cbc|_&PJLC9g=HAlXCzBW4 vP5XGkp;5~zXZ6GwnTP60k(?jcQhh^;pH7-J>r2o%1+G;`zbVQ|h8_R_hbwxo delta 291 zcmX@cbc|_&PJMa0X=Y%gr%7H`sB@ZMSxS+%Ws;>+u%C}%WtMS;abc-fVL@(oNJ?^0 zI+vqkN@}2Ma79>NS&peoR$*p@NvW|#wvV?-nu%+$Pl$(WS(bljl&M=zF_*5cu7YQ9 zXh?~dPl#z@et}O&QNFoxZkbDHV4;~oR;9jCrCCLqbG>)Dv1PG^X&~3L;(cp8S3Gxm zSbX)<4hH_oX?=P}`^i=s-}I%M!grA~RQo<0Y`D7Tp8#9dRiD=;Tfge%6ij(jn0aiy w+pQ-Sk~@A%avZCFFC%ha;-x~eR{=xl!Jn5daG%<}@lc|0#&+J4=f7?M041k>_y7O^ diff --git a/nix/secrets/minio_env_file.age b/nix/secrets/minio_env_file.age index 180971c..c046394 100644 --- a/nix/secrets/minio_env_file.age +++ b/nix/secrets/minio_env_file.age @@ -1,7 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg bv3MPWeJTJj/lrwKDBAv4T+OrRdD3ViwX8HLCmCKghE -MGP87vT3Rmf+aqhMMXyZIs4OeMkS+uc+je6Zkod0hrY --> ssh-ed25519 XzACZQ cUkJyWCO6HkdxCqSnv9onmEUhEQY+Pj4seR/lH8KSAg -qTUgF/iT2IoJf7UOleaayWbkJbn5dgSVHKctKWnqfIw ---- BOvXie+k6OIewLDVF+Rx2YzkpytshqkFGCL/uYgljNQ -}pSS y*Sp*>ݖ  u:0b:=)tS\HNb9_mٝj{)(<3&Ә`R [{aܓ! \ No newline at end of file +-> ssh-ed25519 qM6TYg OO4FC/zdYJPzw8ujHG66sX2ShWSrWfCKRj1z9FYOwyU +84DDDS2TPxxoGxxaj4WLJN6zZfVIH7m1xC1mRMMzBaM +-> ssh-ed25519 XzACZQ YydvMTzqlr24U79p1vCZ0DIB1DmLNxp/kLptb5WtmCI +KaJ0zuNwVsYr0pLRB2MJIix22xTdujqspFPISU3Q9EU +--- TzKmJkMsYD2ZS7LJw9qdVRsBeoxMPQjOyovIoopesMI +S p+rGF "19,kVKЪ鍆ShnhyldFX+ d; ssh-ed25519 qM6TYg 7Nt/x/IT9ofXjrRRV7coT6nrrCSOCkqUqflm1oXLXTk -BafDaEiVpuT3SDVXvuD31WIKe0QlvAGoyn4MzUm9LfQ ---- BsY9/meRTzX5oCBD+w9f+2TO/TdPD936xOjgtQMWuag -RN|- -[6q -r7d% [3K`I{!u5ƃnӺMvodz A~ǍT QGh?Nw/YBQn_`_,ZFV8yw \ No newline at end of file +-> ssh-ed25519 qM6TYg anB4Ljud6na0zsnFkNjgBcicE6kFUg0y2xTlohEUggI +gUTv83/Mktm8CyXdKEf1eu7NpWJd/hmiGzKs91WyPCc +--- zxoGip/R/tIH30MATCWht9P9oUxU//L/jnf6T/DwKEI +U͌5fq{!%ZE; +xȻvnktP\-1PۺB}gMn{3o*]ڦ0zU52߈@yrUgA -4)F +>"Ub \ No newline at end of file diff --git a/nix/secrets/paperless_env.age b/nix/secrets/paperless_env.age new file mode 100644 index 0000000000000000000000000000000000000000..1da8fb8135d02fb883434d6e52d0b9edcb5cdf23 GIT binary patch literal 340 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCTy^z}}%2vl(Pi?qyf z^Gh4^>s}&Fv<@K^ySjk)m3ouch1n(uJqMT&rUNdb8@Om zPcHV!Ee|csHmvmYD|adN%M8*EHT5*gHsHF#bI<1YCo6Wy%il1#+u;xSEw=;EYtGg$Z#lZ& s8R&lVc;0;c@ZAGKrA59MrL9)aT&T-!7*xll`sJ$IwD-Q^GdW)X0G}&}qyPW_ literal 0 HcmV?d00001 diff --git a/nix/secrets/pyroscope_s3_secret.age b/nix/secrets/pyroscope_s3_secret.age index e96d5b8a313babde14bfba7bea6036dc5000c39a..637f94230129b0fe981a6da395714bae63dde8d0 100644 GIT binary patch delta 300 zcmcb>bb)DtZoQ91nYWXfd1zR;Z&tXaNuomVvqyL_ zSD}pMm#(g^LVlK8 zs9R`NewJl~WujxSnMr1nsefgnGNw!VpFP<>T+qNPE3HkT2%=GJ&+LB*o- zzh@clt^1kdar4uLyVdPv~nq@`<)w0W0My%mDuT@DmfLy5_^4SfPGi; z|KDHs#tJ$`D_a;P1r@ucsQyU!zhD>7@dDL*7le-LAM@C-XI)m%lKUSD)@Z+UXTP$i zcK&R!mRCpBK54tCO7!Vbb)DtZhdNzd1+;ssi~2Rp_^q!NQGNul9^#~m0x&3s%J%UNRf%JSx|VChoMU( zmy?@Ol8-?}sacU@g^{6aV79xPg|}a_zKM2LVZOeBtC_!rWm%L(ct%b-qa(93_qmGDaLzF3fQ&J$T@Xp-wheV`A@>vRn2bs8x~Z1E89`xW7wR$ zvsa%uFF%{~K~wdN>Z)xkWp)MiTrc1MI>Yh$wQ@(ZJ7!TUclCeCF3fpyKfTKKn)lzA E02#1>AOHXW diff --git a/nix/secrets/registry_htpasswd.age b/nix/secrets/registry_htpasswd.age index dce3ea840df7183eb91ce1a733f7700b83dc4ff2..5ffafb6492d9027815364a9a8977dead5d5d2f78 100644 GIT binary patch delta 242 zcmbQnG>vJ3PJNWOxocK%Mp1!zV7OmsacGreL`8OaWoS@fx_M%Fh?{w6R!CHkwoz!9 zD_3NpU#_`Za+;4xs(xZdRYsX-sYSY@my>6)w{d>HfthikcA!T@S-7R4FPE;au7XpD zlW}mGYpI*Qu}eUqMPP}0ex#+halU&{Xi{-_nYoXrPj+#NcY3j@TRE3(`_WG^OAZU> zeZR}A-nT?cKgeX3sf>kL_vAa(Z$#qiovz9yu1vJ3PQ7=zmw~BoNU2v|SVo|Ut5K9esZ&K@l2^D%d110kS!hm*OR-O-Q$u}?{QQJGV=fpbb=vTJ7{_tY`)RKD1+U diff --git a/nix/secrets/registry_s3_key_secret.age b/nix/secrets/registry_s3_key_secret.age index 5649f2f..72fe931 100644 --- a/nix/secrets/registry_s3_key_secret.age +++ b/nix/secrets/registry_s3_key_secret.age @@ -1,6 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg /73Z7R1RE4lfUfVSeJqZjbGA5yjygfrxKi5iuMMxrno -tsbPaW/x9HFT/tG+5F3n/3SsuhmswVIfHVLNRAzdiP0 ---- jHapfTz6oq7gdrgBn+XNQdMZ67DbrFPBY6KKzb+wfjE -U1r(RMN8Ol$DNu3JonBOc%AT~RV##[;3*6/5gD]2%f)fxv -]h:d{_O~2tiz28 W>BT(a%͉l`\ \ No newline at end of file +-> ssh-ed25519 qM6TYg wkP6wv0rewclikCkz1XjByNu8dWtQgk23SW++uoNmy4 +Pqd1t5ITKxwLmBZxQZqQ1jHn5o+atN2L5Kdk02SZiDQ +--- vcfVaVUg2W8jTf+BrDYg5TKccjk0I6iA7bJEovIvsVQ + EcbMf%sч߶:ռ^zm7CnD;3}ZѼP5% B1Cu`?`4z}my)^⤅܍8;4vnTI,S}x}阘RCc"I zh +;"(?^aFoO0zcʕ3 \ No newline at end of file diff --git a/nix/secrets/restic_backup.age b/nix/secrets/restic_backup.age index c968ff04bb49dbfed9dc395368bedfbd6ede363e..38f35603c306c37e838a8a35dd71df98bf20d4b5 100644 GIT binary patch delta 695 zcmbQhHi2z|PQ8zxc2c@|VN!0ChnZt;s;{|kR#kFYT6tNBOHpE0pr=`xqEhUa79R}enz%-d6aQ(K}k|nNJVIXziVVwF_*5LLUD11 zZfc5=si~o*f~8@YM`^l(Z&8N6XHKz6RH}D)rcY6Fnwv$giFtXTWsYNbc7SD;cW!A; zm1A&`ub)#sSF%rtn{Qy4NqL2db5uxqKxs*qM__@csgFr{SWr-fpJQr(rDJ+(grT3w z#E;_P`4$;Lf$cpmtFY^pDjB?D+Eeh06&h*PPEXXsp^a{yH4NgrC zaY=Qn4+%7ONp&g;pSI`P$UX?xs?6T+qusD_zL@Rj-$9SP)E>t1 z_0IW~*=yWV`*b~1NXaC2~Xd|-3k<6P7mckR=kobRyyy34(W z>#w{|WbiMay#9>`o+dL`G53p4KGOcc%vk#$N1^8u9X-`Iu9M^VwIj>;ZSCfGh@Oc{ j>=a%*@j&rO`74|oVtqf&ox36CgwX?^*r{%hl|BOiO2z#j delta 695 zcmbQhHi2z|PQA9XWmT1DrhcBUlT%5NYp!c(ex*yLNrrD~NwIfQikZKsYekqvUYfs0 zAeVN zP98<3CK2Z0xrvq8SylQ4o~fCh1{G03S&n{TK_Mvt$%Ta;zJ(&5LmK$#aX0$g+rZcQto3k1#fHO-)HL z@NjguOb&PPaW*wC@JTn}($&>fh;SK7)5+`W1TXWr{GY+Yc!BA}A3NPL-KNy(&XQd*?-hB} z?e7UDMx9qYmc3_FAmg4n;*MQ=H_VXw^6=x@>}w0|ea#Dz>)YG0o$00hq;i(*4Ud{m zTB={D?YsJ-$UgJC(z1Ko8Imtv%ZB>X<}h`nzv(^0hg|wLUD11 zZfc5=si~o*f~8@YM`^l(Z&{_6zK2JCZc?d5Xoi!Kv0G6@o^P^6j-f@Fp+!|tihET_ zm1lT*YD!f;S6-I8SxJgX+@5kvsY>0 z#E;_P0mhYS-sNdIRUzdmF5W&RA!&YjX6`xJp%&VXMkYRqemMczCXp`Q9(j>mu3`H6 zDV7C36-k*UDS-ju+1}*^<`yCPeopS*ZYe3IA%UKGi5b2wo}OpWuo4E*zQiql=)yi7c@iriey zt2_$xoqQwA1H#KJ4RYNg0+Xt=3yVS{QUgLKpJf!U4=9Xq^GPWvvha^`cXadhH?VY1 z^l)-13{EmM^$9i$cM5bVHwp{YHpp}2@+@(6HuUx^@eQqX$x87kO>s{4%e5%ej!X)5 z%nYhB$Te}P()M#V^2svb($&>faL@EJG&3l74|CQ|F(~!S^Kg%FP4UTbj>yvY4EC*b zPfskXFU|AyGYSeQ=5o=z{d}Ifz0UN&IXPDa3)!`$C*$GfZ?hEq^G-9LD5o zaVBS{DEq1W+fJXhPV~@z>f6?RbH|hrR&^1<7RjzC<@(N!zkBoQT6F||H;A6@c;-0e z=;wZS?uFO(tU27fyiVcka^>3hnvb(2zPz0K`oz;eO&?DP6^fpm8Fk!6zkc_j?m0jI zzCB@|lB8I9JFnv+tZwvxN_L@S(5#0eec-%hBHwmO1o|esU>_%F4ir1D{7|gGWl2G!GPA~TIuuhn6LwlLY|S!Z*YK delta 824 zcmbQhK7oCLPQ6KXNtV7#igtFTMTL2uM_9Q*Vz@;{R$+2hYQArnWqMFpnY(FPu4!gS zK9^~6L|R^!mr12hn!A}tMq#jXa)xtcslS=8o3C%KySAZ^dr)vrc9ogF1(&X!LUD11 zZfc5=si~o*f~8@YM`^l3NN};4p=YRhl6O!=Rfc}Ki<`bzut}I#SW#G&n?Y)&Td0Y# zv8ADfiD{4tSDw3BMM!2@Kv+apa;R^(rB6^;X0VHKX=ZA9MMzPii&MBqP>O$4T2ylW z#E;_Pk?F2ZPLX~gW+{c?KHh1T{vIJ|iREEg9$t=lo`ycfA=v@`1)lyPxfSVLo~GuN zi7BN?+AfX(sg@pr$v$poiAMUlu0@$ePI=zBAteEZNgmpXCi&%);~B-nJ)A?!JSy{| z%3UkmT!Ipf416qua`k;f^34nUoy`)<%H6^(T*KUw%qxAl(tIN$3PQpoiUR!&JxmRK zOv)n-Ox!|CGs~k)Q@uP5!kjF9v_s9!j2tZ{pJf!U4=yfB&oCf$PEZDN;h__bT2du^Yaf(GSD`xDl-rBF3pHC5Ao0P z@d(YXFAps$tO`v}=JL6zGtqY8q(XN);~=x6&&pDw+$;75?ftym^sM0q!$+!p8y1S? zBz`|ZCa{({Wc`?eN>28!+z#V+n#OR4rav@n5XMK;qWy4 zpE-M#^plQ{2h66)y^+c}rhk0p>WYuMp1N$g*WC-PabQEEt;SB^Jw|8)gFw&{}&owSRKOnNB(4p@TI66vx}=NmV8{WER#1~ zK7HYi#VZ?ky>Pm&ZuBhZ5bLf@m#nM`{y#e*G^;n_hH|{b%Qx?yi+=p^=wm`a%$42G zg*g7F?Ci-gx;%A3fj);AS6Qyw`Ah9fcH5qt-&4M;e8B|%(4zY4g05rhXKwOSJ+vp| Q+3EGk;?rJz%BkH906qdf82|tP diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix index 22ecaff..f9fed44 100644 --- a/nix/secrets/secrets.nix +++ b/nix/secrets/secrets.nix @@ -32,6 +32,7 @@ in "website_s3_key_write.age".publicKeys = [ vps1 ]; # only used by Noratrieb/website GHA "does_it_build_private_key.age".publicKeys = [ vps4 ]; "immich_secrets.age".publicKeys = [ minipc ]; + "paperless_env.age".publicKeys = [ minipc ]; "wg_private_dns1.age".publicKeys = [ dns1 ]; "wg_private_dns2.age".publicKeys = [ dns2 ]; "wg_private_vps1.age".publicKeys = [ vps1 ]; diff --git a/nix/secrets/upload_files_s3_secret.age b/nix/secrets/upload_files_s3_secret.age index 50ec7d6a2ad423cac91555e4d5810def9d70b3a9..631523c23af390151ecd68122003ac31f9178bf2 100644 GIT binary patch delta 440 zcmcb`e2aO4PQ9~1Vp?gQb8>iEilbw0X=$RFZ?Q#4enD}HetC#dP;p*jn0|?mg}$ew z0av-3PqA-QZh&8Ierk52Ym~2JRBl04x?6f`n4^nvwv(k(MNU+zbGnC-1(&X_u0lz8 zm0NIHh^bMDiJ@^oNkNK*ad}cjgkw==qCr_sm`P4valLbyPo$+`hyj<&qq}@vTPEDm z>CXDiQZtt>{PeZPE8W&H#nl6 z@+fcCkMuQ1Ix;qyv^{M&v1tFlHK`2e1>W3^kNH;_8wqL4yP`z8eX+fH|S0LBQds9^dI`7Hy zo4LNP@MnFWdQ5-Sf#p9|?ux#{81=7%XY0KK0+BMO*XW zm?ZhDbGLHvmR;J`S1$2Alq%p{mQwl4;LY3WENzu`fkn?#_^r;XJv6$a7jXT+ls6(K zo#zdA>_2KgrSEh6`gshD1y6K@40o-ZvQeN`!DbzghFijgh;!Vjt62;eMGEkn_;xQZ vx&P>xOO%d5#-(-@J=$Bj?|sQ_)9*jKZshAfX%JbxY~DTqJx;?I diff --git a/nix/secrets/website_s3_key_write.age b/nix/secrets/website_s3_key_write.age index 96b92cb19f93e747d1c2813d300d7f31c8d63131..9adbf2230a4e1a0e60a7c01b8b5c9ccadb76b417 100644 GIT binary patch delta 308 zcmcb?bc1PvZoRRGw@ax+|Ju^W@pq;J{G5uUQS<4(9IbwxsS`B~)l=n4{*WxtL+*#y96a zFJ}-sx1h23Lhw%AJ(Zzcx2D;Iu)kU6vF_WW+qVNn4Ohh5$#wUXn5@^$`rp@op*e3^c$B(69{($$%plsgbnVq-L4(7)4<}4L8h3d~ zVdShA=i~U7ZgtdM_bK-6k#`{%pC$7ytWJ8j?!>eXo>xM`Ytz(b{NCE$@OzPmG4ED2 LWmEG?UneyHa;tq* diff --git a/nix/secrets/wg_private_dns1.age b/nix/secrets/wg_private_dns1.age index 76fd998..f218338 100644 --- a/nix/secrets/wg_private_dns1.age +++ b/nix/secrets/wg_private_dns1.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 LZU5Eg 3Bde2BfrG8qdngKCIg4xeXnkqqdrtcAZfW0REYwkmWc -0Js204/ZpkBK9mDZwhYOY1IGW8yA5L/iMAmrZR1r940 ---- V7Xj3KkcueKzPhl6wjk12zRrEmFPMpUcQd799p0Dqr4 -~TO80} Q. {q6Qu׆%N6Ќa|41րZՀ;Dz*^ѻ \ No newline at end of file +-> ssh-ed25519 LZU5Eg OKL541Y7HQSCBtUqWQVdIxZK9HiWeaPyAWwkcj/bsgs +PviTqNl4VLbQtErGDpXFEJSeRf59Mx0v3qcznEZ1tTo +--- yRq8T7TGu/yBKFx2r+t8gbohrUHDkyXdvsB3n5csgpY +kMQl?N'!.LlLBoDY:_Vctci= 3rKvMfDu \ No newline at end of file diff --git a/nix/secrets/wg_private_dns2.age b/nix/secrets/wg_private_dns2.age index 1c04d1b..536fb4f 100644 --- a/nix/secrets/wg_private_dns2.age +++ b/nix/secrets/wg_private_dns2.age @@ -1,6 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 5bWSnQ V/5bLxQqdZEF9tgSPGgm7nEpnyNGScgSVfjS3KOvxA0 -oKHKz5IIZNdsWhBCTCqvHVLAJGC+LEC7RuMgQHI9Wkk ---- 71jtq96kfCYsB8UGSccc2F6qWtj7DO658MeVWSD+L64 -UXd2ClEV~Fgip%N6 -t%͢Ż{LZ@B9${g&PBHQہ%4 \ No newline at end of file +-> ssh-ed25519 5bWSnQ KNg5E8fLL/rDMbRGQDujv/NaSUVGY/HmxFgIVK7vox4 +bH+Gywr/dDW3UPfQpLpWg9sVZq+LfE2aDs29chCpaDk +--- mYTYZH2KoiKyxtfrxgIomqaaCyfnLVNwXkUzp+cDl7c +Q}B.$bq{4;5-;3Jyble̞do#i({J譍y>˨] \ No newline at end of file diff --git a/nix/secrets/wg_private_minipc.age b/nix/secrets/wg_private_minipc.age index b5f0470..2fa88e6 100644 --- a/nix/secrets/wg_private_minipc.age +++ b/nix/secrets/wg_private_minipc.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 yMKb8Q o1qLnZBL+o8wrQYM6bo01DsCKVmA/NCzLe84aO4NSlI -iEnVZGcr4wyMN5b5f9Qzt1lmycZVe+km/8ApNvq6ME4 ---- MiV3GRLz1rEy283zGsbTtrAbQgmdW0pobJE83BmPrmU -G^%Lj,sCIC&@>#t$.2R+p.4 ke^+sCgn-z{ \ No newline at end of file +-> ssh-ed25519 yMKb8Q 8ESNEQZaTfjWl4qGZJV/GPN+tFozDmiZZtXCctRD8yE +w2+Pjzmotz2X0O8ehb3TTOLk9YCk8hqRqNKfNNnLQIw +--- pfmBROvSCK/41HS44uMmwU5izVCyHrRirYjL/WBAhZQ +m *Qv"+JQ Ā'PhD>GJ]ĠLݩ N̤ۀ \ No newline at end of file diff --git a/nix/secrets/wg_private_vps1.age b/nix/secrets/wg_private_vps1.age index c186827a391b40d78823b17623332594a6988942..a9442703dc960a7f1486f18065350ac5cf14f3be 100644 GIT binary patch delta 221 zcmZoJgq=>5~-|Q10zwP!N{r<7Vs{ z%H`)_YU!2kUE-B(SrY7m0anl9U4(!78Y8W7H(8(5y>^J>_d;p$2GRh z>ls)!Uwjv;bLQ@h14Yu6O&07I^}_hu_PI~usgJYceRJ)hxaO4^vCn)TPVJpr5y$v! YL(hd!--c^bc8iEDjaeM_*rjhV0B`S8KL7v# delta 221 zcmZoKmSE8k(DDV&H1#l%k)doe@^(nO{ diff --git a/nix/secrets/wg_private_vps2.age b/nix/secrets/wg_private_vps2.age index 7b8faa9..3cf2891 100644 --- a/nix/secrets/wg_private_vps2.age +++ b/nix/secrets/wg_private_vps2.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 91VHug 2cqCCA9Di37CBwXKIg2nRfgX90fqVQbIDlvbys7uSCQ -IKMUR81lUusM+BqXSMiuCEyfeAfup0ljLCZ09GVjv0M ---- oisBggLksra17ZbAQcWuIX3iOo2hE+De/mtXpmDDXGQ -ڗ7f-1|H8BU]jq2I6ۖ7yBL4ij"d_+%]U \ No newline at end of file +-> ssh-ed25519 91VHug nuqwTTdoNOLWvbQAIhl9WguvArxG0jNfkFn3qM8VyjE +NvhMCreuxdWHezfH8cF4wXjO8ZbG7yQC8+sVnWFghFM +--- OGewUdFWzL1PzHGBHB7ulJVi5eX6UXKLFUyfbvGErmY +ʋ.\Ņiқ~`Q ,W;m pQTY Tz?]T-s4)ZP,6H5bԄ7h \ No newline at end of file diff --git a/nix/secrets/wg_private_vps3.age b/nix/secrets/wg_private_vps3.age index 50d20a415a2d9afa74e85c51941bf567a97504d4..5cb419d45a29ae348afb586c44bf9e0767d1f022 100644 GIT binary patch delta 221 zcmZo)Dtr^r(bN(cgb=mrI~Wlk9UOZvtQj|anCM%y+e-E+g%X$sM5^%v02hx^{{R30 delta 221 zcmZo|+t`lxt*R7G`K>l4#^yUQm!&793@w?V}xD z%#~4?=9rjM>XGMR8sSmpsh^*0ZdhpUk>j12@8Rp10&C9Tw`VpKP3AQRJ6o7FMbqR^*lE>dU2BKUd^^_&>LQ zyPjli=K3bp!dQD)=D5zG8wX!)zb)$; ssh-ed25519 51bcvA CkaPksfSDKWRMaL4FV7vI4VZ2c8Fd2RlyRW8DEkOkgM -NrvBSSPDrwNL+YKgBTHqQuLhKgGy1+/H51JTsA70Dww ---- 6qkEageKcIweJ7wWcqb2HZp9zJNTyLcoQ+Gv/+O6CJA -(,zfD8)]|P+a {n$ Ax"Â]K \ No newline at end of file +-> ssh-ed25519 51bcvA jfwnJ0gZN/FeF0krZ/ERWq/eqKBGwANBwea3xCJLeHw +x8ccoxcT8Yn99d6aWzZ667jUjE4dHPfz3ZIg9qG4xe0 +--- H0b14xAs2FTADz89JQx2eOSmAgN3Rs5A2o316xzISwc +@}`͠&9WjWSEH@V˒x[?Uu.~J*7ҷ< \ No newline at end of file diff --git a/nix/secrets/wg_private_vps5.age b/nix/secrets/wg_private_vps5.age index 3f4dbff24b270648ed8918c639b9f7ff5d5e3f1a..d870bc4ba8a4edfc2ca6a466f2e34995954d2289 100644 GIT binary patch delta 220 zcmZo*YG9h6Q*RnsVBntY=pUGr9+Xp&>FJd2Qexz9>gR1xmGA0j9FP(k=!j9VHy-_=I&oq;OiBs9gJNB=c=6&*2>WB1cI<6O4A3a!MozV4B>90F)Md|*3 XVU1F6S2{7p{m{;S``m1w;FIS79t2k} delta 220 zcmZo*YG9h6Q*Y>`A6DUGnw0BYSem0gxF@n5#G zEwk1#E?d4)*!zyM=6~*^=ex}>NA7wreN$3E&|qssdBg>`w2QX`KRxajb<19p@UdF= WROjT%70pWgb|Qr_ZeLX6n-~C#=~6QQ diff --git a/nix/secrets/widetom_bot_token.age b/nix/secrets/widetom_bot_token.age index 366d1b9d1890667fa5839451ca8673e0c8c082aa..c9bb8389c87718a17c75c4634e3c5db0dfb69d20 100644 GIT binary patch delta 236 zcmbQhG=XV?PJN-Peo%yYaaw6gc4BzCwxy$CR#1S2NkE>vv$I8-d8LtKrm=xVwx4!Y zI+ssgWpIFDWO=Hwv8%ItiCcwnXr6&~U~+|rzGrc=vqxgSiDh0=scTuT1(&X_u7XRX zn^8$+QNEX!e_O!773{hM9`02t?51ONa4 delta 236 zcmbQhG=XV?PJK>zNraz&qOntISW;wuNr+2Cj%l!YRf?0PzEhHciC=KGPnnxzm~U8+ z1(#D*Zl!C8VMtLym1n4bwpq5TadB>HQiZp3q;pYGK9{bpu7Y!p zXI@~Yc42XZVQy-$SzuDKSEQSVS7BD5iFt~Dk+Wk+PHJeDp;=CrwkMZ>``f5vM?;L} zi!b%Avzlq~VOsxb&v&2RzC5lo{n!2fRw7KT3@LhC>yjDe_iUEMu>m7 zFIRwnxwdy{p@pYqZmCI7re{!oYI%NoN@|!$Lg-JX_bWDRYjpI0XtuA+OM%i?0VCLSs!{Ea#zTCYWjOc-jds# z>dxSoAJ#qd!||}6Cv`NWPG35DoV)oR>(SUa%h$f6cdlydMzQ|seKTvyeb1jywbdEzayNSJJ;V^& z)M_cw@$OY@+V0%Wk!Cg)IYqXr-qrs}zziBi(v8{ehA`@1t}zG|~=)i;G*#oP4^*pKLFB&Hqd39jEX^Wh}s=*TBC zh7POxo7UpUS=0XYvzS@&E>ab9Zq|_iT;{(qu#tKDk1c6^P2}VcvYtaCc4fj zUts*}1iN_4vGbD3`&Tucd#Vugx_8~0b-+H;PZK4PD%B7v6hWur8^!`$@RCu5Pwj zx@*FUulYsR7a0v0EI4a3pDk2idA03(q=@^k_3Ni!ntyM}hNQ5><92gRUw=D$k4gX7 z5%)CNgB*Jw1sC24UaldrEbbkzRKO((OYW$|UA8(?_b9N49enpFIIrHimHDHK+~Rtf zg)XpZ zgVzcVi61i#x^CJmw!UcpycOI`F2Uv!|DE2xUFK$H>3Ziu*RV}kpPuN!ukNN?Hydue@|<>Xo0!X90ARjFL&w|Z4x@qLpQ zmtUU_h|riUdQB)itwwV8<`?!B5er^U&E|ctkQ;JAP{TjR;dZF}d+AdaHD|x-|Mz(m zt1xM$ND5mqcg19zw%sq>zo({`e7le;n!q{vdm^h@x$pXvUqROM1V#6~v^^jr#klM8 zRfC#)Kiy}qt9M?#rtrXqnSy*@^(EIma5>t1Y}U(V{nEC(?D@Rb1yM7%S=pWcZG3iGBiALx z6#0kGrf)uxGL2cwY3_`f=elg_8-pJl;LdaKKRiw03|rjZ@9CM(Z0Dc#DOYotIPKoM z@72tc3UVJDTr4fbBlvHzi2PnDWt}gdGq==L3yYoFuvO4_PCZw4<5rtVdJAsub(Ea` zNV?-on$5H?@0edcpLvZl=kv6Hw=(Ks%c?|KzUY~Du(E!*Ej{Oh>-lbDsW#E=GH2?a zN982cO>p_Kdev-BeeOlG_VTbPO?6!zvx7%0vSIeTDgSp(*`Alute}47s%)xK62C9w znkjPwr@rPsacWyCkJ#VLd2X-I%B1OZW`xX^>sPq7dz#cHcWwD7LD^Rfq8D}wA6dCu zaLeL{6|=mLR3DxmbTs9(!g)sPD!!-gFSk89wzdAM2m8JKTY9s6HZJrE$zB$1%US7v z@u0?0#i0C^yU*3S?WupTd#lPsCXqKLXPVX?OkOPamdW$!A_vnX*B5_!H!F2n@iG=n z5)88Q`966{LivIBn{Ix5tN%3MgJi}3jq95(T~jDN-n{jj;_~~#nx)g%&Y3S^@ta*o zdXuPS(VIBg-Sv7OzHzmEP4z9VtNpZS>eo1qbu!t4`Dfa99nx1zHqO`H(B<+nMo+FK zYG;nNo{RNX?jJ6a6}*WPkL;&-25+-4}>_s53JvO?lCbOY?p$zj-A!m2K)_&g~KPdLM4xpSLE4XOrvf z%9tp#%A4>1MBfnU_Sx`7Zl>qOm8x!w_ImaxObVaewd<(VMNjVuc3%yrsNUG>Gw=LD zfsc`l%*LsY9Ig1RD=&yldc%8G`ox|uFPraZ_$xa*%}D*V!0)r~%jf1==?2Fa#~HJ{ zv{YhK_N$)H)WN&{(i@gEmcn`^foAzz0tcQ;*@f;C-}3sQCwKZ$2iHQCYj0gv2EMo9 z+xRu8c~{Z%WshI(V)#2R_DaFIcKf=^^48t9A1m%+!TIzn?vt%*W0hzcOO(* z9r+z{IY3Fn`B&uEEe47*|MX6u+{-;-QyY)s!}>jwzxY2;>lQ2VSlRS!=jAWwTMBlB zttsPbv{F!Mb2N)fcKCm_cG<%T`x~FdOud_$C?>Ip>BZzsz9i1)Ho*d~Uw={)_6j?C zL@M%-)lrA9hu!wxb2%yWW?NA4mGql?UpAx(d)&NQ)HPwHaMOx+E8qTHdGb{DuV{;3 z${W0n{ylTyQ@y{rSwg34hQQJi<&e0f-AwcecvF4(Ax;1mY!LRzMwtbgc zedc&ec-1#{{;WI8_d8Wjbg%rjh`U`s>MvY5n-%R2+vyE%ZSCf~E;ohT?|LR4w!Cmm>SFO^uSs>gH>|FYUG;k1wA2=h{qa3H z@j;u`t@Tl9*z4tTq&j$}`LWZ6i4IotehTgW@a?nazW*2hvTWKS>w7gz=9ak#>!b(s z%`QFl7Pwql-ZiD{(eghcu3x4k#Z9ffyK99i-=Phq9U`42Y4X;&-ZI+Lqu*X#zIgN5 zGg>(xVlr2&{FK`+99^;Uc53~f|Avlb%a%>lJ=(BkA4lY#Zcmloj=GfX8gmLSg>L0| z=Fr;W6n5+0ySn)fX->4Q&40%N!6=85(e;*yvh*oqN^8`kT=a z;XB@|dYtiH_wn1|BysB-g|e`&C)=>;JkD za`niiAGV)<^LF-|dgPpa5vuv~cR;G;ob0>O)xZ3{Og7(pG0=bIig%S?nxFB=9$I{1 zp>WAc=6CwvQoA=>J}6%%d4x-5dv@^YoTZiZy-NbW1_$vGx6IsmWdV8osj=1;N7uFYv=*+4KGpxR%70zg;-2a_}E zT7z{Ly(pa#&bws)sTZog4<}yKls>sK_2t(cJ)XPm_8i$&f5CARl8R%`y?G=|Gzpx zk#YWC_v2SYHb2c^KF40azvJ!y&-Xw5ecg2+g74WIsl~g$Ex5uNo3JH(c9`w@Ph0tZ zbS}^MwLj|6;un#>-n+`wGm9~~te()ibH}L{9DObJd+Igk&6Aj&dz5>b^~@5{)7Ia* zDh_Db?e$E05jSs%nRdbAQ(xb2`m|_CR$H^VV4iWt7nLP-^4$9;KlR_EQ*XdJH*>k} z1N*I4Pifg3@2)$Y^?~#DNqzr`jE2rVjO9=ARvhu!>+0*#v3tg%Qy-aFKi#fRUg5X2 z=&6Rpj^xzpO?P}GBz=-?8hzxN+Y_?KF! z)gIY}oy!@7IkzkbU$;(T$#wa%>DA!^e;>|C6Kj+;Ic<8Q|0?_Y-Ikf}Vm7>Bkl~Vf z@}6yO{ljMKqYrJ`i{uooM9zBiZLoCEExdj5Vn;>SI>T!FO~T&hrq>HTK57d;+^^ay!!ZS;k21;+J_2{f14!|`?9-KWX>`r*|zMDvo9`> zy7Mpb_5EXF@o$y6Umn&9uj1Yk%44{u!03xs>%n=o zDR1Ag#jKgqbhkN$LE-afw)0QBR&-an{$%gkxtg73zPd;ir99@hT(sIck8y8Fx# zN46w9t=`F-x{PH(`GkkQjRNb!wF~S2F4Wk*CzE$^C4%+SiJ~RCs*IfUXd-n^|t9o2ERX!H;rYFx{=MmWGA9wA0vE=uCmXXi<7UpX? zYR=-&ePy4Wb}>afGbZWS*ECD%`z0sxBVR8P)|z_lT~IR1-s?I~Gq*Nx__c)plHi&H z(Y1>ncKivddJ#8W{FU^HZHKOH+9VyjSxaQfQWv8gjaAD`&$4e(i`XFazTVKv&|e{H zQmu%CYtdr{-sRKI$e3y=IWIU=ae0o5@a$s(y4$86NVwp}U22oe&Z+aOe%ZYO(|Jo~ z34FZy<5T#?H_y4-q7$A)*J|4Y-kcvTwcz(VyMP+m#eyD3rtWHfTzGI(A)iTB}q_^HnpX5`ySm}XAQOA7% DEvlqk delta 4000 zcmZ1`zf69DPQ6iXn!i(0kV`;TWMyiZiK(|wnYVF@tC?3=az(z6Ws1K=sJpqRaj>a- zAXi3FNmaO?zEO6DrJydPCzr0Su7Z!B zTSR4Ou8UbtMsiq4l3BiGxOah{Tcm|YsB21jVNqh4Uww{`Q-GVcu`k!zLXT;`-^+*? zid$ScQEMvldb(E9PuqZUY4fL6|Mf#1f1BU7dVcMIM3L~d=QEyc*c`R4_+!gC)#pB2 z56O1-Ik9AGy;&f##{5|l!?8$r$IBe=gIjJtQ~Kz4Rp^?Q*nD0Yq2)_2FdS6#`r8+4 z{pxJVeFdI7sxKAm`);MRe*DvrTkhj%QD$R0OM=(ufmF*J=HT_bTNddw-1^nBLUHB< z_mzQ9{#C8`nm$MF@Vg^QGIg!(3*CI9j+b;+ubyu8y34!dT=D&X*$XCZ7XER?-QZNf z*$c<^KdbACTP53hcf!522@hA+H3 zY~S`-4j(1I-e0BsO0v>*4!iOenInlg!Bd}YE)3W9|MuYF0W>ue)OTr{eZ}!0!=Hzi{Fau#g&LIRzq5$n8ggA# zI;hq0p8M`of8CyMc+}O<>b#MoD>GOjx920z{jVQ?Em?Yb=aTG#n|H3fIpQgHM5R+i z>f62mt;7`vTf2VOJ?cAq_BW4!{(U>f%;1{zJ-W;vU;O{Kp1EZA!jj~JT|uddhq;c_ z=iaospb

S19qg_ugnGy$`!2UKN~Ln7T~f<&uTIP@5Gh)*jOC($ca0&Xz#&u`<6{+ zc09Z*(A&P}!-1SfN0nq9%hv65*s`fG;&fJFrnE%8?6l?FAxoYuIhV&RK56-p2R0|? z9`pM(X$8-OVAYvR9~?QJwmB%RecxF%;ryBUGcJGB+F;M~;F$Yt$-635x3@W_S~aL> zi?nj@ZL<6HuZ-X3rj>$yw%g%F-S;HfRJ(j;FMhC?E9YRwbkd_^2i`8cCu%X3*{QO?;ZT#$%ev;DB`?^;pt&ZpGrk$Ac)#~tE^{MJxA68|YwYv67oH4QaRlV6o7nhiQ*Oz=g zbNtX6`P))U_SNV2S$g?5bse2`@Xe=W>#YUHA0#lx_OCjYkbEGsK3^zM`b#CvCFMh7e7Oc&S zlVdP6IHYjk=Kf!l{y5Q6*%3Tc$~B3&1(L&e{ajRv-Sm>H2;%1cU+}* zTHl8&rItx&41Tp;+@LjS=hh85C*7T!+g%GiZ@F)sUC|NOxT0&Cy4wd2vyTTeA9489 z$1Fbn&T`qyszYhrPx9nEFD`6!d1MrM$;XnP%Zp3tSMa;k72AUAC)nRuRC1wl_%Vs`t0M2Mf;!1Mf`Ao&A79ArOE2| zUuvwC$^>$|JDk|}oNtnUa_}#2z`3H`&$>(Y_N=(V6**shF*C=dmku!|tLE9X>t#JN zJ8p1WInLbW^_qIC*4sS$7SD>fWjKA8=qG=n&cLW?6&Be)rT>QBzkg)ODc;l1W={!o zh;2TUHuH(sbH1DjGTaybvFa615V;klb?(~p*3bnZtCSb5yYPIE;~V$cR)4khSD(DY z6m?Vc)ZFyEoKFm&68=uPcX*bgpxpuX)U7wapEnUPTf-}$7C)ECrK>(f>4v=5^1o*; zaDC7HZa=%M_iawl-Fv>thqudZUjC`F_t%jW&MPMIHj`f5nY(xvSM!a_oqt&BW^0^# zPSxVrw*&3dh4}7T zMsNPFJcY|3{G7ZTxo0XNk5^*nNzn;Y3I)UYBZ~P!npa>kIO$a^3G3cka@7^ z?ac-GEN?$Yt-2?qfAOmUzq*>#u>+QIH|hmlTO1{_8*efuTI`&$%v$XAyX7&f&rT~` zXrwb;w7*r=%|+Ck^Y5(_;d|%m6fb!7dG@@Bec>YYJZw=?C3W1>7k_&-E#08{>Wb&B zpOh2i<|IXG9(S}8h@ZkxWPQDKYi1*WuEpa<(Sh8*Qg=?__Qx{FGbg%_3u-{m+ol{t9e(Msl%u;NnP`nOa8Qg@=L2Hf0AJT zA;QP`vedg?Mbl}0h=`;B&kX-XnJOQiTH0zjo;Y!4`Ba5JH{a(ym=VYLBv1RLmYLSk z90N_mUJcHP((^>j_IfwGXSnWmI`9dj%qOdk!UUuG+qx#=`^8V!@7lTJhlr*s*TF{5 z(2ifzKW%SNGV2SU7r!&SP_Tf%?DMRv9PRcsex8-NulYYSY}-^aK_RC7vrT)Q!I8Z5 zKQCsxY)j4iHji`G+sHE$12_A;?fh(-7TM1g))_eFo3>Lce z2bi<(wqBE5uXJwNi!GN|W!4{GkaIBDWeeNsMJA<}MD$8`ajdaE@x${-abtIr_MI5M zxk6f3h2~DxWQgQQZwjjENX*-_^RB91_KXm@dLfBV3p@TV5L#ZJaP>cXipP<>%NG+5 z-d)ezEG@UlUTdH0%aWWqLL3Yq`CooN{zN#oeB-?zYdPP=b1oG>y?)s;mz$X<>UZm> z3f(V}ns>jY=TJigL(jGYH$L;tyqo#x?E8~VX-Vu;xdM1K4zu{LzIiEW+LH4B%Tv{s z=3L^lyb+eM!&ievt2>a>_;lpj2aFma?^PGPj&#|U+jurUKFU&bw=B!1-M=pBPqpZ|T)Mz#~(0w-Nf?2-fHYpk|*3TQEw8=rcV(k~shO>>9N z;vn`P8?ExU&y{zddNK2;e7zHoQT5VHN9nTzTA|nZ>r0=IwUhQB|#aZuV|b+py{FX6xtg@w#+#R?j;Az(?tm zW*DxIoX#uvo%@T(7tY|kFE#m_k{>=h9~mYt&gUFFV@#WAQdU9wRqTY_mI;&!J0+XCGuQ zXVX5?yU#Jf+*#+(vX?*Wljf|Rv~Y7$*7}aG$=R`Qlp9scdm}FL?5kz(-XAG%@yFAC z^BtZoa@SY7t@QD3Yze%%l5dvGKgEMN3~}`*=Xt(a=RIrR`sh_Vf9yZ`&LS&5sPXI_ zfs`^qnbkXwOl4-Gxw!KrFS84xzC5wJ*{X1Qw zl6B8lf2^}uRGz`2_vA#?XCHl*3(PyBlRy%S2UQ|GN`t9_{lfSLw-liN#6Zr}OT3^?Bz0`PmL%wAJr^tKK7IG{wd>PAM-{ zZ0b9m{oKz?UbY>a`E5b{4v)`ezkj}CVJ$r8^6ScnrjAd++hPmSr^jt*KdV`%cJ84W zzk}IfgL8+YdHoBoP7N!SQ53hSS-aP%FDG7l@qE>_`b`Y#rEgC;{ZEKzIik9ralhIW ze&ugh109<;P5&H`mXw#azUIr}^uG-my6;Bq$eEV`CNTTtF*VR3; zKg;y}hQ`7JikwNGl?~)IQ;!;^--z5__|i~qhE~C=5GH$1zZVC~RupP(Jo$L4|5_yh z_mEDTn{tw`=KaiSy!L9}{5uzgdjD*GmsHoVF73r?zsHQqzgaoY-+06S;A713Joz-0 J*HzbN0RU#GNv8k+ literal 0 HcmV?d00001 From d41530b65f62ffe45b7c1856a10e37db8f246f8b Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Thu, 28 May 2026 22:36:23 +0200 Subject: [PATCH 35/36] step 1 for dyn dns --- nix/modules/dns/nilstrieb.dev.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nix/modules/dns/nilstrieb.dev.nix b/nix/modules/dns/nilstrieb.dev.nix index 1d0fb7d..c013f4f 100644 --- a/nix/modules/dns/nilstrieb.dev.nix +++ b/nix/modules/dns/nilstrieb.dev.nix @@ -18,7 +18,7 @@ let vps1 // { TTL = hour1; SOA = { - nameServer = "ns1.nilstrieb.dev."; + nameServer = "ns.nilstrieb.dev."; adminEmail = "void@nilstrieb.dev"; serial = 2024072601; }; @@ -34,6 +34,7 @@ let ]; subdomains = { + ns = dns1; ns1 = dns1; ns2 = dns2; From 8479644fc4c1b7481d02282396a49340f47821ca Mon Sep 17 00:00:00 2001 From: Noratrieb <48135649+Noratrieb@users.noreply.github.com> Date: Wed, 13 Aug 2025 20:36:27 +0200 Subject: [PATCH 36/36] dynamic dns updates --- nix/modules/caddy-base/default.nix | 1 + nix/modules/caddy/default.nix | 11 ++++++++ nix/modules/dns/default.nix | 22 ++++++++++++++- nix/modules/dns/noratrieb.dev.nix | 3 +++ nix/secrets/backup_s3_secret.age | Bin 772 -> 772 bytes nix/secrets/caddy_s3_key_secret.age | Bin 904 -> 904 bytes nix/secrets/docker_registry_password.age | 8 +++--- nix/secrets/does_it_build_private_key.age | Bin 1916 -> 1916 bytes nix/secrets/forgejo_s3_key_secret.age | 8 +++--- nix/secrets/garage_secrets.age | 25 +++++++++--------- nix/secrets/generic_backup_password.age | 24 ++++++++--------- nix/secrets/grafana_admin_password.age | Bin 282 -> 282 bytes nix/secrets/hugochat_db_password.age | Bin 339 -> 339 bytes nix/secrets/immich_secrets.age | 9 ++++--- nix/secrets/killua_env.age | 8 +++--- nix/secrets/knot_dns_rfc2136_key_config.age | Bin 0 -> 434 bytes nix/secrets/knot_dns_rfc2136_key_envvar.age | 13 +++++++++ nix/secrets/loki_env.age | Bin 326 -> 326 bytes nix/secrets/minio_env_file.age | 13 ++++----- nix/secrets/openolat_db_password.age | Bin 321 -> 321 bytes nix/secrets/paperless_env.age | Bin 340 -> 340 bytes nix/secrets/pyroscope_s3_secret.age | Bin 336 -> 336 bytes nix/secrets/registry_htpasswd.age | Bin 278 -> 278 bytes nix/secrets/registry_s3_key_secret.age | Bin 364 -> 364 bytes nix/secrets/restic_backup.age | Bin 784 -> 784 bytes nix/secrets/s3_mc_admin_client.age | Bin 912 -> 912 bytes nix/secrets/secrets.nix | 2 ++ nix/secrets/upload_files_s3_secret.age | Bin 474 -> 474 bytes nix/secrets/website_s3_key_write.age | Bin 344 -> 344 bytes nix/secrets/wg_private_dns1.age | 9 ++++--- nix/secrets/wg_private_dns2.age | Bin 256 -> 256 bytes nix/secrets/wg_private_minipc.age | 10 ++++--- nix/secrets/wg_private_vps1.age | Bin 257 -> 257 bytes nix/secrets/wg_private_vps2.age | 8 +++--- nix/secrets/wg_private_vps3.age | Bin 257 -> 257 bytes nix/secrets/wg_private_vps4.age | 8 +++--- nix/secrets/wg_private_vps5.age | 8 +++--- nix/secrets/widetom_bot_token.age | 9 ++++--- nix/secrets/widetom_config_toml.age | Bin 4006 -> 4006 bytes secrets-git-crypt/knot_dns_rfc2136_key_config | Bin 0 -> 134 bytes secrets-git-crypt/knot_dns_rfc2136_key_envvar | Bin 0 -> 67 bytes 41 files changed, 128 insertions(+), 71 deletions(-) create mode 100644 nix/secrets/knot_dns_rfc2136_key_config.age create mode 100644 nix/secrets/knot_dns_rfc2136_key_envvar.age create mode 100644 secrets-git-crypt/knot_dns_rfc2136_key_config create mode 100644 secrets-git-crypt/knot_dns_rfc2136_key_envvar diff --git a/nix/modules/caddy-base/default.nix b/nix/modules/caddy-base/default.nix index 6356e88..a33e7b3 100644 --- a/nix/modules/caddy-base/default.nix +++ b/nix/modules/caddy-base/default.nix @@ -4,6 +4,7 @@ let plugins = [ "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3" "github.com/sagikazarmark/caddy-fs-s3@v0.10.0" + "github.com/caddy-dns/rfc2136@v1.0.0" ]; hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g="; }; diff --git a/nix/modules/caddy/default.nix b/nix/modules/caddy/default.nix index e4c1b0a..bec542b 100644 --- a/nix/modules/caddy/default.nix +++ b/nix/modules/caddy/default.nix @@ -19,6 +19,17 @@ insecure true } + acme_dns rfc2136 { + key_name "test" + key_alg "hmac-sha256" + key "" + server "dns1.local:53" + } + + tls { + dns_challenge_override_domain "nilstrieb.dev" + } + servers { metrics } diff --git a/nix/modules/dns/default.nix b/nix/modules/dns/default.nix index 815eed0..7d1c858 100644 --- a/nix/modules/dns/default.nix +++ b/nix/modules/dns/default.nix @@ -1,6 +1,12 @@ -{ pkgs, lib, networkingConfig, ... }: +{ pkgs, lib, networkingConfig, config, ... }: let metricsPort = 9433; in { + age.secrets.knot_dns_rfc2136_key_config = { + file = + ../../secrets/knot_dns_rfc2136_key_config.age; + owner = "knot"; + }; + # get the package for the debugging tools environment.systemPackages = with pkgs; [ knot-dns ]; @@ -21,12 +27,25 @@ let metricsPort = 9433; in services.knot = { enable = true; + keyFiles = [ config.age.secrets.knot_dns_rfc2136_key_config.path ]; settingsFile = pkgs.writeTextFile { name = "knot.conf"; text = '' server: listen: 0.0.0.0@53 listen: ::@53 + + key: + - id: rfc2136-update + algorithm: hmac-sha256 + secret: QRpeYCJLokRWyzT/tWrxaly5Seb5yTkE6/Ub66edWds= + + acl: + - id: update_acl + address: 10.0.0.0/24 + key: rfc2136-update + action: update + update-type: [TXT] zone: - domain: noratrieb.dev @@ -35,6 +54,7 @@ let metricsPort = 9433; in - domain: nilstrieb.dev storage: /var/lib/knot/zones/ file: ${import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; }} + acl: update_acl log: - target: syslog any: info diff --git a/nix/modules/dns/noratrieb.dev.nix b/nix/modules/dns/noratrieb.dev.nix index c753f0f..808e0b1 100644 --- a/nix/modules/dns/noratrieb.dev.nix +++ b/nix/modules/dns/noratrieb.dev.nix @@ -54,6 +54,9 @@ let ns1 = dns1; ns2 = dns2; + # --- ACME setup for caddy + _acme-challenge.CNAME = [ (cname "_acme-challenge.nilstrieb.dev.") ]; + # --- website stuff blog = vps1; www = vps1; diff --git a/nix/secrets/backup_s3_secret.age b/nix/secrets/backup_s3_secret.age index af7230234fb4160110188098c8520cce111854ef..adb5d54f3a550338865d2804819a45ff136ca89a 100644 GIT binary patch delta 683 zcmZo+Yhjz9Q*R!eU1FM^T~d~08R>1NpIPMOrf;ZiZkm%;Xk=KJoSqlvUF;U&k!zS^ zz~y69nr-3XTp3(xXp&!$5|9#A=vU_9S&&icWsx7^UYg|`9%<}XQc)J3&82InP+Xj$ zo0?)|YHDbyU}+fUQJSuh=Ug4WlR$^jYWp3=8m04ht5>*!ElIrVkUghuZT2c@= z@uPUSZ;5w=X>oFPNs()WSE_MdKv9*Ot8YqpQA&DQkiJP$NtCv4ZmCz1wy_0QQDlCw zd!e?cad>9FXR%9ap`TldS5}yBv3`(iURr^7X=p}OVqS=8QfB((ct-JX%kYda%OIy> zM?*_XcSn<~oDkPY?aG2MFK2ykAE&6GRIenjaN{J4;6P6LhU?@fHJS(MANFk z63gtoJd4UqbEERYk|ay#s0{t!0PRZS{HpxPXBoxo!%UnFlZ#B8tNcSEO~PHvQbNm% z42v@z!<=(GGYe9TN>j8mGm7;yvcp2T3X_t9E8TMq^&PW{^n)@3Ej)b-eVkn^wX>tj z%=0a?0xa_*^1My--9lZtbaizVvfKjQi^{zmGkgNV3ksYA^z+=kLLD8=3xl%#ixMqd zJkty6OMp8jo)%RC@)sc|PQZmr=={8!h-gl$fsk(1# z^n6#I>YO)))gbr&`%UFvWDc^575LU?oEPffHn&fDyXoX;=NHdf?Pgkf`3;X<6c&QJ89&5fKvNWZ>ss;8_`&VHlX@SYn*v z$W;_*kY`frZWL)zW>Vm2q-|sxT#|2Ml9_Gp74B#3=;xT7>6l_%Rhr=u%B5?kP+Xj$ zo0?)|YHDbyU}+fUQJSvcs-G7bYFg?PY@F_rnNn1d<(8WlW>J=tW}fL$n3b58rXT5I z8Re2>;U8kcl@pnkV&ItQpIcy-Wm;flV&-b( zid@$u|MaM;f;4@TkT4V13a`xcNQ;zEA6JtIk1SW;lyq0FGA|>Ol!#;t|B|RG!wA1z zKTFpr-(<@ufAfF{PuJooQ?Ig2XCM8NTm#R^XBoxoT|z1&z1_VE{JioC3iOM!!y_$H zQmPz1O?+J{jf^v^Dx3Z`(z;(#rDaF!u13^cDV+%b=!*3_ diff --git a/nix/secrets/caddy_s3_key_secret.age b/nix/secrets/caddy_s3_key_secret.age index fb3f1f48ec1054af7c92ef1b15f832eac210f897..d231b8074bf10fafdcbbe86cf82de726583f9815 100644 GIT binary patch delta 816 zcmeBR?_i&xQy-q;;hCIj9%xWnX=LGrV?QNkN z>6e@9>u3z-H|VW_!TN`}6xxj{)tXqIV`r%7RDX^;h1X}CwY ziKnAuRdz&Ter2X#NvVHgQE76STY5oSg-f1ugnw|McV)JDSWx8Tct-K?WFwQTQ0LU# z#0W?ITmw`8&~nE#k3etBK(Ao$d;?Ga5F;~vx0J*JFC!B!LnkM{$U@)pJa?Z`UxR|& zT;I$BBj@y#VExR*sH8~G6c=B&Lig|j57XqyXBoxoE!~TZoKl=3GEJPy6N8;SeLPJ) z90O8~OVf)hN?nUQviyQ7vWmUJ^4-(93PbZE+`WC03ZpFC68()L{CuK9yv#GalOy~? zO-o$MJe@>sfu{jF?Kwao+q9E7jwO1p_OvOTX216BnRoR&zx+G7aOvMAH=;gyO|G(i z`F7pHsr^$+;7VRXV2Hex8|r)k)2F|1`s7^Aj?E zB@_cLmhI`?=rXDB+zTVO&M9xE3(K1ZxvsspmPh`@Zie_Qe&4X7cUp(yOB|n;TzTHQ zqmkF+eH4%Q%=HqEZ`IG7ncO8&6})Y=h1K-1@{94OKA*h*z4`&q`6X@FZwfQ6Te9o@ I*N-mG0L-;Q0ssI2 delta 816 zcmeBR?_i&xQ|}&-Q&OB{8ju=ZmYI^Jt({(y7M5>Vlv$GJWEK$NVdiL_=^qjq>K{;< z&6VWp5oO_?6O~aE;uq%ckz!$ymg4J_kz0`;WRe}?5@z8NR%qc|7!a-<%B5?kP+Xj$ zo0?)|YHDbyU}+fUQJSuh65$)_V(#POli{Tu=~tFpy%nt>X%*~ z<>BiRRb}AIm1Yr@q@5S#W0{66s$rzJiBXBKVWD3|RH%QDS8jSxX@S2-a7cbdse5@|cBE%gq;oQtWqP`q zV}WUMioa=Ls8?P^U|6DORamx1nT4lma&D1NPHsU)p;^Bq+s{b)Kb5Ef9K#r;}BP_?2M@Ng7S(C|B4W!ibw;$ z9FJf_!xSTfzzF9;k3tu(+^C=^BR{u@VEz2bXBoxoJyHS^ox{tsB3$!B%H5-Uv;C{8 zlFCX_ODs()i*v$@1A~iQ3RBATgAF6O65X;~OI_XbQw9KJrWBO^#i;d4FVmxbaizV{3;wn%Kd`V%uUR4vdcZ3ip`uYU7hodbG$Q3{Vk0B z1Dq1;ef^UP6EgyRx%$M6m+pM*&~|xg*@@~8tM7Fi>gV5oyl&F5Nwu9iA!Q!H_32m3 zT}zL&K3=u5-pWhyPlN5kr|c&jPELBU#Hsbt$+ELNdW|pll{ToQls9jRi%mK3-p6JJ zcf|+c`;Er2exlxg_6An_FpEy}nKj>NqDtc5I~EVr@6^{U=yKb-cx%mrZvUi%t1IuU z)N+FhzpHexQ$y4-i+v*{AlhY(S@=N z_0EcUdVBvDi(AaF(Y`m~S*o|LL=Cr_`nT=dB$Hpftv{x@lvPtX#f|-9*PYn?0w;Ta zUFcq%{#&!GDk7R){ptHI6QM0xtq~hC)jf`1^t?PL?5@KNy%Q_0e*b*srkCRPEspZ~ G1 ssh-ed25519 qM6TYg 0u8KWoP0daJZA97H5KkNCSn839ObF87VYU4AChP2XVw -PqtYdZR3xokf7iIQ9khrz2pt7n6FipWn5y3bmzDfdEM ---- 3tTg1eoL9exHUTtn3Uww7xWecgmzf5EyyQEZ//Bbjic -|HLXZ'v2" ssh-ed25519 qM6TYg N7lS400e/5mSV3BlhnzThydz/c3DIIOHLNQodTErR08 +vMqHXmSloSrWCxeD4QCH30GSqg1AI+6Dy16atFLNxjs +--- aJ6lQv9jnJHyocy+Kz4jPCtpiIewxoooR0Zsm7CS/pY +j9KyȰ0*ÜbɿY0I3v+D"*/g`o#ص \ No newline at end of file diff --git a/nix/secrets/does_it_build_private_key.age b/nix/secrets/does_it_build_private_key.age index 81b84bd45fdeca5ef9a86d1be3445b784c32fbca..a1a6080a499bbbae00a5b03dceb06505ef8c1dba 100644 GIT binary patch delta 1893 zcmeyv_lIwSPQ9^9YJgj2m1{)4enwod$^@@x>rzOgh!}XNNJ^8xuajXXMnSbm#JHzd5~*Xka@aAg;RQAAeXMLu0l#) zNnl`=QFfG(M{b~}VNQyPw_C2GL4j*hK!{IzWTvB$dwoS}Sa3>;wky{wfzQueHypa` z6y^2yZOg9w_j63H-`OR^uPFCq#}-ewL#BUy85XeSHmg`(negt${{rbxbGC?YeOl+G z&3LGfP|x?ap=hN=wdbq+jd{T{_C7Ys;M(@|(J$|LE!HJU4$Lqy4ShFQ+_`)|>97Y|ZUqbYkzFVxxB!$rI}( z4_(m9ocuuWdn!60*|+RW4-U!;jHlHc5m~(EuYO&zr-Fm&G%;h6^m5q zmafChtKHVLoY2qyA+g2yk?RzXPHXvk)z1eRJXb6}$Z|#KT=({rX627ZJ|uJ;T+|Y8 z{&;)1anPE7vRX~5*X~&uiF<`Ey->_}f9vjY*AU0|`yO&uy*RVHXbtbTSuBU={9AUw za7}@K+T*po8}w70-^>c^;%|x8a9ea_?y4Wn+1o`WrYxQQ%yhS?)2sdYqHoG`PhD75 zx$jkdO+<8nZ1LuKf-NO8=f=%?v4{1UM&@yqn~ndTTl_uyVWF3r&AMMR90ivcZ;nXc z_j$dwTI{~#i;CteEbQW%x_-{7y_X-PRIa%9c$&|lh!4{)=K1H99&gN0e){=;R{Of_ z*oooG&rbcBY5Zcpz1NG>4VHVjuf0orr{6yR^ykj&0`B$o&Z=1kv)^vr_iKLQjQ$l z)8YTRkG3A&sAH>`6ta8MhM1m;EnI$Fl8n}K{@n@8U|AGpt=+JHQnrU6mnUzD_kG1r z_b&1_&df+R{-I>3re0sresV&wPo=L@*y5cd?iBeP8MqkT{0%ZvKwHH>e*N}r|tqVG84$E_Sw8NJ@R|CHY- z%lzxuTp^Xve@Pa9BJ{U&G9UE6qWEW5eV7_EN8iq?h_^&=a+g&^VaKDG}RIh@5 zmo5&?PL9t%j)wkKH4EKWGgfta2%~E=B z$h6+!pJAKxCQpg!Tex=`1>U@+^tdeh5tI0Py${cxF4>ZN{A&EGweEWV7rbzK`@xq{ zgWYrKncJP~S99lfe|VcFZRDeE%G4(97a3n*Bsn*xaF4x5<@Qq(zrAj;Tvt{!k8#y^ z?QZ8r>4J9(;S1ut9BfXkK6kN9ZqKUC{Obd6q`3WhUH>%AkLkEw;fv#?N(-dUzj)76 zKY7;rc%vhiEL2kbwunovS~qdVJf;WpX4F=>%QwH?eL~WE>HPKVOjGh_Ka8CCk14Y0 zw#$q;KjQXOyDHDVBA%1(9CqwL*!4>*s-0z-uAZ8rAhmVZjx<*H^(C(-Eso+{zajpD zozY?Er-ixq+**Fs)CWhbT#@b?KR3Hg^6R+RKD6%jMbiMqDeaz*1WWRqG6D_-+YlG zXSucHjw_!ocAK8O-mF^6S8yu#3%6=qPGS7#C(CYkYQNf7Gk<52RmkkcUP4bL5_*K! z-!)@+cKfR2=In@U;egcwX$rZ{UiO6tP6Yh(pQ2o;-p{)($eZB|!y#3LORqEUKJi%* X8SduHa(qV19=@Y$SC{(s_pAT_OI)Po delta 1893 zcmeyv_lIwSPQ6iRsB=VsbGUa|o{y`EVR&Y)b9j1sfkjA8UaotoXR<+digRv~Z(4>? zI+tIdceb{Hc7{(xj!{ZTa)FVLnSX9zO1Wu9aZ*V|c!qCcsAFMLq`!w>IhU@ku0lYv zTe!A+x~XBgkzZ+*XF!OllaXUluBmC7k4bo8K)6|iSG{(6Xd^JilXxA$FDQfWJM z@zjq6dbj+QE~^~mOEanrp6FXL>xb9zWQHmo1?i{#&tg8A>F>KPDRrlO>Pg+hDqi1x z9qjLLP0)VM5Voz}Q?0Y=&td0-A#0rk!{*EPWh|DNc-w{XYe}q6_gR_P^_!QoF8Mo4 z??U!IiKF{o{x`mnnRmSXO3tFi_ri6(!cu>lK3QY5`g%^`udM>%ZrMCnv)6>VoBdWa zRq5YS=$NjuDd$IBijlQhB$rCfq+c}(dToxrXXPhtmC(!GrQZCpxPH-&8C<7dPMP)C z`(W)<`5hm>b{)v5nvlZYtDSZ#Pm49YbqiZv+;wlRCx+b&QfG4PdBn>+--Lfv`@6gBA z(!X!^j`ahboU+H;cT9EhcT$M|ym8p3WXDp^OaWNcc zShsz~zu7jMeK+>%PBwp;lDuHUh9_+M|1VK$DXZ@mPrJHT+t%Cu)zza9Dx8(yxICWd z!0@Hrx1h%8&;lEto||cPbqyQ!CO_d0k#JSn_o_4D`HH{SqVz5wdh3+>e5RSta{a`6 z-=`NnHFt2#RNBUGVIQk1{8jIX!gEOgNUN{cHXV52k2Cd9ys$ zmN$oT9qr2M1?zpJ+Q{@k+i_O*na-=7)pC<$hgO6QsTW=gVt$BIY&6OOHUlTllLT&{H0mI}ju#FAwqh59 zrN8s3DdfEWWT5xGwLW~$zxtQAPo5P{zpz$X`R}tCH*deyG@f7aZ{q!$uZ!!C@N38C zE?_!+E!u43@dwu?@B0^X!eDDiSOx#pzwz7sRnyH^KYO3fC?43gS>2P3W3!LIEd|yR ztBs*;oBMx$U75XP@r~OrI)mOOKVEBpi%aucBJ0$Hx7oTp|GE~bv~JB7Oz-+`Twi+R z%|}knTh2W5*fw_wxJEdh4xg;Y_bs?0{Qq*b2T_-9ZsBW_GoO6NVB125wya6SC(=f|Nr za|I?XkEqBwEV912@n_iD9TN_!|KZMGwymGPzCY^Zq>YjBGfJab)Bep5OSZWEUux28 zmBpP>8+T6jU-td0)`ZDb21|IVETmdY|JzHKs`I_uS{-=7z?Eyo(mzaEO?7&)Av>9} z92-9#*!}6miX9&tG;-ZmCF*g0`NOni`K1dl(=2sOaxR@uQ}&oV)9A*}mc^AP!xFjb znclZgkV&ZTtWJC{wflq2tV_Gt;~Ng&;NrY4fBUG6sY!VHnr9(eb39IpP29u8W3xGY zx1-#l8;=A|UCw;<+T+0d&;FfWZB@t2CbrIQtXnpJ?oFPypsp6bNS zk{V?`?+XqDOk7~MFMY@Mbt+|dSM5sJ&;M7{wzz!N#<<&@NnAcf=bHT3ZX8#P?ds*8 z7Pn`$qW|JDQD;@_-{;)++pj()>2q!4!Og2K2?oi=`fZf;o%Cq&=@<)x|bYx@{ zB&J{cy(;0mYllZUtCJeR+0y!7*ix3W@l&DTjQ^w##pFPvP-x_jcBDRLYk{{%c8 zLp@YNWPj$lAO5$gu(xCBDyE4CPo$m;bx@gn-};a6Rffy$UpfUU4(DsFQ0eJTKDJB! Q`3#2jMX% ssh-ed25519 qM6TYg z5yLpu5zJ9m7Ukl3nEHZND8Ot2cYnADJidYjELzfr0k -qy1n6TSeWniRFXLc1Zkpvz1+pmjFaMga0BeSE1q6RSk ---- fe6vqb3f0bRvXlQG4JglZ0h/At5kUPIM+VkRh91BCtY -".O J76~ԥSH-40 [vAD=^Ty"@A@,P|q!؊M \ No newline at end of file +-> ssh-ed25519 qM6TYg Ln9ZxoEmhHUMbU4PufH8OYVzEnvFEm+b/SlBfitqEhw +M0n0qe7L9peTLylt0uoTR4gQBcCxfSIm7FAR0mPeG5E +--- BzrHhLTDQ49g2GTkJdmLpdhRBp1rfdekcW+A26jzKys +G6?U'ry@b $MZ`@kv]6_۟Nق $!mVkgA]yW,d';Ȧ핒 ܎ \ No newline at end of file diff --git a/nix/secrets/garage_secrets.age b/nix/secrets/garage_secrets.age index 7f33bee..ce127e4 100644 --- a/nix/secrets/garage_secrets.age +++ b/nix/secrets/garage_secrets.age @@ -1,13 +1,14 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg jJSJ3eWbmwKqaqaH0nCAfJh6zG0wQ8NHYLch6MjVFiM -nzMK9xuag1meleJVM6aNGK3Uj+LDiklWtAbEsEVaZrE --> ssh-ed25519 91VHug lgN/V9/OYL6qvoDo54bMwkRjgJx72ER4rwCyBLE7JBI -KyqOc40/5iNubbk3vuF6e5qypscUNWGXSO+TvnE60Ug --> ssh-ed25519 XzACZQ MH28c1eBXCHnnmWeEiKbB7qnqIWb11ciYZopRwK1lzw -kHr78ot/c9JS7L+uWk5XhCwZ8y41cEkCfjiv5ITHXpI --> ssh-ed25519 51bcvA JbXk+iiHx+TkrosjfP28iGjQQ3lNFlo6L7ebmOmOJzs -KQH6qVfm+48U6TzaomwPQJP3Xs8JCX1JDuVNu6+djUM --> ssh-ed25519 vT7ExA W/tG8Jk982TcvMP+ZVY1Jgtk/0ykGlKT471OloV68G8 -9/ieFx+uf+zLUKfWtIYUiEyHHkwYLOhX8FtZP6oup/Y ---- Nr1pkXNHv0+lBg4J3QnK4f5kM3ZOWjwTCwjUYNMRABk -UsI lNdL^q/PD\%s4GCϺքag|-f+,|vpj].L=U_?bG&Yw|f~4qR*Lx$ڋYPrEN,jWz#K@̧#7"&Ξ=GxN.nO7c}fczT \ No newline at end of file +-> ssh-ed25519 qM6TYg Nl4yCNn9+FiX2uBliOH052tOjnTj4DcFzaIDjD2MVTY +aU848NDVI6MN5JPm9FRha+HJySIEyRRcNaiiBRnxJLY +-> ssh-ed25519 91VHug HfzLsV+15VwIFXz9mYc3dNdlFnb2MdqOMIV3DkxnJmQ +Fr2LDl/Z5Tn9FspwZynbCvK9Let8VWGAr00lf3Uhj14 +-> ssh-ed25519 XzACZQ GWXW5myuKkabbJwdW3OsHl08KBo0wu3dJXXo13xYjR4 +SYu+6yj0om9BHFoJH8wsDPEbQCQy/oAp1jRW9wX6Ys0 +-> ssh-ed25519 51bcvA nenOCUH5VZ2j/u1fv7mD/2hZufU6KWY46UZwzINXSSo +GbQOiKQ6ko7RpuYvmtUnf5wzNrKpR/FHkrYHhRzURDw +-> ssh-ed25519 vT7ExA 8/Cn92m/Qtoo78VSNEYNrC4HqoIKxLyvT7A0R0CpE0U +rehfI6pEM0nAv9AQAFa3g/PTd4uvc8zwWLAVAgoq3NA +--- fHz+V2yXufeCvWNZ4Eu+vAdPYBoDYyuUlXcrTo8O/88 +ru^+=$!1 +rF-NHr+2z>Fiw`ˬ024(3 իH=ay$tV|H I d2_` dr?PM bش%qho"ߗlzs;r{XuE n)'!VZ֘܌u \ No newline at end of file diff --git a/nix/secrets/generic_backup_password.age b/nix/secrets/generic_backup_password.age index 5dd7134..d009691 100644 --- a/nix/secrets/generic_backup_password.age +++ b/nix/secrets/generic_backup_password.age @@ -1,13 +1,13 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg WSRKNimMa2qdIrTxZIsnybHi+gzOweCGmCx2D3DPciU -e6MO1QIL5FI0ATaR8hBUeE2ayLoyP4P7d5eO7liMBHg --> ssh-ed25519 91VHug JZjoc5tcVSQjIpbVGVca4P2s80Rb7NTIEKPhlXx9wQ4 -QWqufjXwphL4Kes5Ky2tWozdusA5AJwqgzT5JWCQbvQ --> ssh-ed25519 XzACZQ ek1dpX4Lqf6hd13B0dX06tTTmNRhZswxV3W1gBLKkXk -LQMnAxrr3ZfUc3Brn39BzIdyBe8Jma8LSML+eaBuKJE --> ssh-ed25519 51bcvA zA9GHEGOXETl9zX0yoHHB9B5On06KlEcYRba8eKGKEo -yPTcsFhDLiSLpWoZX0b7dNzZmBaLTUY8PSMVFCUzlRA --> ssh-ed25519 vT7ExA N7U+hiTEzwKvglQ0At36e/p0TTA7xVRb7UvuX/4Bbjs -acP9zBODifOsHVmM7COfBX+tkxZIPnQCUR0TskHacQ8 ---- tOLU9ascA2rI4R0oIg/0vsn2dEC1LBLFN6TFRcyrcvI -{đq.忳U َcO)|¥,+^]?PĻ$3m4Ǧ|c).R6@r] \ No newline at end of file +-> ssh-ed25519 qM6TYg Kmd5m9hb9QXzbbrLWC3SLcUfy/B8bEWdJMQ1iMe5MQ8 +A4ZoS84dtX+DMOzPXOMBb402q3o6LBExOda+Rm4hbO0 +-> ssh-ed25519 91VHug rXXXRgZI91mIlLAclodKDk3V14pDyRCv5kg1RCB7AH8 +CzC46ry6tCYkDX4jTW08j7Itqjb0raz2nlmU5/7zLCc +-> ssh-ed25519 XzACZQ KbzLsMTNqcjJ2I+Bx5moRC74Z/QKHrbFVovC5hhm8DY +aAGFH0KBdM+nm4HyZ0X7MPc3+fBbcQrQAcvrK0F7LNM +-> ssh-ed25519 51bcvA qv9cje7I7Sxje9xV0DghaxSxyovB37O3B1Bt6sHp/Bk +2zEnhhy6dIOWMdbQE54xtQKfZjR2vTH+Z4son1/gYr8 +-> ssh-ed25519 vT7ExA voN3ZvXhhqv4V9FpVTd2ViydPgxvjpQpeUcH6jljen4 +sLjK4aWqGSlxxeMKPrIZCjw4tsz95C1R498bFZgBMVk +--- Kfk+aieCFtZiKPE8toWEZwZw06sELpx1FiJCVDyLGcc +uM?C0Z& rSgWp8{*6yqð% \ No newline at end of file diff --git a/nix/secrets/grafana_admin_password.age b/nix/secrets/grafana_admin_password.age index 53e26d016f5a27b6d294582d9e5223cec9fec302..eecd4fcc77a12ede5288eba2af310304e06ef44f 100644 GIT binary patch delta 246 zcmbQmG>d71PJL2ZifNFCXPQ$$c9?mXmur}#er32tVwPukLB5$!vXgsMwzf}Jj+cRf z0as|Tsc&Moi*HnxSxRAXv3XQ(er{Swh@o$=OPIEMQCgC-n@^f=a%O&>0hg|>u0myi zx3goQxqgI2a7tNKh(%dgZb49TR#I|GadJwMsaJY#WPYi;pGj^&XgQbBGoiyN=C1!Z z-Nn}RC~evNvFgoRVVi#@!RJ3b%3Znp`kvyyx3%ldw_3CBNc_+6H%rno=HAwwYx4F# zt&Dd6aNT?TOP9wx%V)k_d{c1p+)EahHnwh1e^d90rP!I_U69~J0S~p*-!B~j0F-5{ delta 246 zcmbQmG>d71PJNbVv9_OcPMK$LR+(3DwpUJewtIwWlvkBodaAymUzSmLrb%j^epzNv zIhTiFaavWnd9rhOu5(zrrF(&!n`xk5SeREXToSL?X^!{xr>$T>4_N3Rdt8ag_E8}JU(YM2 z{51LVYkIU7_jiweLH>0NK>=4D2)Q{V2r&kAh`i*zFRXrX(xC?;+Df^(b8Iv?pQZFv zSl)E1-hISbat4#8{xr4U>fcy*-cV<{cOf-fcS6Cx@Asm6cJ7}m6;b|Rd-F$=Ye`eQLgjr^!dAV7Ize{MK zBUhllW0Y};cTRbxX_0G~MQ&hlpqsvVsZ&LzK~R`$Rbp0(cT{PZyH8bFI+w1lu7X=> zmWN-tWl&nOd#P_^T0xenvt>qpc(G|_WMY9_T0Dl%5i=dH}+RN%Dtt^I{8vh6jhu} zFD%Sn?bXP(e%e+4=4VMKF0DIz!X|U!f^vW6v#F2clFZg~rnP@duy6a+RlJDz>E}~Z z6EkwxwjEEXZ;aQ>Hk^Az-fn^c%R3du>|>ACOf ssh-ed25519 yMKb8Q szKG8gw88EAiUx26fzY/pYMVb7Vb91FZC1FEQTYRZDY -0jBl8757lsXnxWE90iZLJcO5VUXz+E2+7m/ZfNq87J0 ---- huOResyzGVCip/Sdoyvid3TxFI01wiXNaHdZ/oGI5Zg -*clHxAh5H(dU'nҘ;M.Vx}" f 9f~Jv9 \ No newline at end of file +-> ssh-ed25519 yMKb8Q lRux6HhczttLaNglBB4xdx7B4GUhs50ucnyYYYlNLzo +nxSaMiEcscZ62uEA3N4ssHN0Vc/fw0wRsGzUXHk5vyA +--- FpSXOah6uQRaHLOxdGNFF9Pud9NsjYDLhiXzqg5/Sao +x ll w\vS-!V]}g΃[>e;n0n!;L ++ \ No newline at end of file diff --git a/nix/secrets/killua_env.age b/nix/secrets/killua_env.age index 3633642..19d8d77 100644 --- a/nix/secrets/killua_env.age +++ b/nix/secrets/killua_env.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg mMvnBUGVS8d0di+drDXo7mws4Uz5T+nZmQY9uUpKfQ8 -rea2peORLvRF6qYtGKFnylyEdnV0NTc6QO3xSgp/y1I ---- xyeBOfVq3hwyckUma5LWOU9cWHzg/XY2f8T/0Vc+njk -G6kN0 !Um[rHꟉt}׊X'yqLbEY:n NHnHݰ'W|3z{٢'N&M`# \ No newline at end of file +-> ssh-ed25519 qM6TYg w8lK7Dhc3CzenrzJTI32uTNgXVyBUKJf7F1xGG6AV2Q +wBlK8pbH1M0NBeAFjwLyyuOKT2jk+o1BwjkQPNc9pvY +--- 5hl/tchAPOurJ+fDLDB5/l/MuqrSTjV2Pnhc1Dy7Uhk +a.A hUwq<.dzXМ&;ⶸ9ۻͮc:z`D XLʳh\Yǝ'U^+^3k5t4 \ No newline at end of file diff --git a/nix/secrets/knot_dns_rfc2136_key_config.age b/nix/secrets/knot_dns_rfc2136_key_config.age new file mode 100644 index 0000000000000000000000000000000000000000..48f95c0935a38f1de69cbe117509485000a7ae50 GIT binary patch literal 434 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCUli3&A!O;;%ONzCyq zE6j3pE6Ptd2`Nf;EsS*W3o=hJ@o))?3M&l?C#HT99(<|H~D%Zm|*OklJG_TY=%_z)0F)**d)!jhbIL|ZD z-_*%H#KJN&I4m(=+pVC`KO?dv)Pze{S64ybA}}eh%rGm`%{(hKxX9bdvph1u+`^?O zJFqMy*k3!hGTbdPygWC>Jd*3Uz@*7PPWRe+@M!T&(h^;+GpS_T5w824Yqdo=cy*65 zwf1Zi&Gsnd-L4bnruB3K|AkfC_L$#r*!!~leZu`a-<)M5{$y@^yYRx73w}4ne9oFw z`aYjCHG9%lgRfR!6D_vrZ*|M^uiW!~0rRy|-u5H&<^=6n6rfVsBzbeO)~lBPQJdmA Tm2AY#&J{(OFznVgJv$Eog&m=8 literal 0 HcmV?d00001 diff --git a/nix/secrets/knot_dns_rfc2136_key_envvar.age b/nix/secrets/knot_dns_rfc2136_key_envvar.age new file mode 100644 index 0000000..fc3744f --- /dev/null +++ b/nix/secrets/knot_dns_rfc2136_key_envvar.age @@ -0,0 +1,13 @@ +age-encryption.org/v1 +-> ssh-ed25519 qM6TYg QQMDIquZuxMKwx2hl2ST9BMXa61DBdC/cMUutcRIRHw +l7oENezyJwfJHrgNUtFMfOF08BhAYWQOjW8v7VPN/aE +-> ssh-ed25519 91VHug wQBzeFG2xixYU5L8/d81n5FkZMqO3uCSF60Xi80mvnU +nPAgKpJj7WDJ4tbKGnlWAhvAUOyLIyOY3aPofKM0LfY +-> ssh-ed25519 XzACZQ HYj1Omcc8WYq6s9l5hVrjjibg1LFHnkYkXiPolGewws +uhrQ6nmP5fMApIJzUzwXcnlILdPvmlG4QhG1laW6alk +-> ssh-ed25519 51bcvA e2Xng7rC2SkYiDn5BRTIDBxn7vN/F95hI+okWL9TymI +7TJrZQlJsnGMu5jaFQllI1E/+ZGHZjGmaUpuNZSAPDI +-> ssh-ed25519 vT7ExA PSM21ZGF9T9g6rxnsCv3rAio1f5KckTHgivfclDjFFs +rq3M2R/LHYki4nQ68iFoLXH8VVmWyBDD6yv6y4tt5qQ +--- KqTQhyl3ef04vDQ8eu1IvTsEaSMYtQxxBAcIO+WYPr4 +$Jk#_Fr"B}~P@.e܅YSL;Pz &0DiKJ^:Oc'+ \ No newline at end of file diff --git a/nix/secrets/loki_env.age b/nix/secrets/loki_env.age index 3b49086d19e726dbfad8e15f94fcd8e5cc54bd5c..1c8516506264c2b2c5da1bb3f9d11636581662cf 100644 GIT binary patch delta 291 zcmX@cbc|_&PJLofQj~vYMYfxvb4jFUzH>#oM}(nsxshppRc=X`iAQ*`n`fj!ahiu? zIaj4+K$(|GQA%=ZX`*?ciF;UKm4T&qRB>uvv3G`}MS+iRmV0Gsl7U%8B$uwPu0p!A zhhdacmVQK8X?anJS8`TZM3JSXe~5*ppShR6XO2gTX?;b0T2{G-Wj;koCBCs+Qw_3$x;cU9S6O>)-b7U7Evkd$vbh zc5jYvQGQG-<7?ICNy?XZtl&Sr%r9}z);T)=#BD|8+_Jk$tvct(D@IRQ&~eCi#}766 uUEd8N?%Hhk_njzn=FZX!eEm09PF39gQQqjlX5ICzUQwOPMQRM+T>${#VRt70 delta 291 zcmX@cbc|_&PJLC9g=HAlXCzBW4 vP5XGkp;5~zXZ6GwnTP60k(?jcQhh^;pH7-J>r2o%1+G;`zbVQ|h8_R_hbwxo diff --git a/nix/secrets/minio_env_file.age b/nix/secrets/minio_env_file.age index c046394..05d0b31 100644 --- a/nix/secrets/minio_env_file.age +++ b/nix/secrets/minio_env_file.age @@ -1,7 +1,8 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg OO4FC/zdYJPzw8ujHG66sX2ShWSrWfCKRj1z9FYOwyU -84DDDS2TPxxoGxxaj4WLJN6zZfVIH7m1xC1mRMMzBaM --> ssh-ed25519 XzACZQ YydvMTzqlr24U79p1vCZ0DIB1DmLNxp/kLptb5WtmCI -KaJ0zuNwVsYr0pLRB2MJIix22xTdujqspFPISU3Q9EU ---- TzKmJkMsYD2ZS7LJw9qdVRsBeoxMPQjOyovIoopesMI -S p+rGF "19,kVKЪ鍆ShnhyldFX+ d; ssh-ed25519 qM6TYg sx4kKW1m2RrcVkyxDMdDgh5jcwfrRDAFYa0EJBZKFnI +WPbchNFC7tTqC4DrIw7hUZSNNxE64kkXZdXB6/VFhj4 +-> ssh-ed25519 XzACZQ GXDgzIGU4X6/oOr5hcI7SoorcowGPJHx/0X2+gj+Sk0 +NATuZ7IZ0QwM9/GtaYdLXjBs6X0enhpVgWvGVpyqOO0 +--- xMESjwLO7fJhwd0HnYzypoh3s6YRx86vSdXovvSBoHg +9I{֝ʼؐZd{YrXB= +l] Hܴ`lRΙRw8Qi4*t#͂ƚmȟ+6hS&VἙ';J0] = \ No newline at end of file diff --git a/nix/secrets/openolat_db_password.age b/nix/secrets/openolat_db_password.age index 234ac01adf08871f277cf44e52c72bf985e07831..f9a3b40b61d31f84fb41d56446052e567d0aaabc 100644 GIT binary patch delta 286 zcmX@ebdYI+PJKvPctu!6UZ#6+kauoUs=sq&kb!AYqH(dYV@iZYNswz^Wv)-IwwJbR zI#;E$rEx`hW~ys;YOcRQPJUsiVNyV`Wk$GrnYW>-zo}zzj!RmIx21c80hg|>u0pY& zt9E3fb47AsVo5VM+lR56=5|UBXPi+=zD;I<&I;$Ev=%s2OahA1_gp49Z>g^ZeP97TsDL z53IFz)hR_EiMqpdvnR^JOFFz7>`)*wLOVujAFqy^orLLI0 z+a#lFzNl~UFSA=(!jg`qizl=79-L(4YZ1J|^s!IBOLXUbM*kZu>>Jl_z4l*ihO<(X ITlAx)0O4VKbN~PV delta 305 zcmcb@bcJbxPQ9~Vq-BnqUy@-~az>b=g;$ZYQ*c&PqOog6KzL4$r-^%*K~AViK(JS4 zF;|I^cVK#yrCWZ8zENdmR#sY?v!7u^X@Fl*dALD}uTPb$uWO=#QGQUMFPE;au7Zod zbB4BdrLT5+cA8n4lT%fCaExl5^EW_^%$sHvw>wgJ}_o_jXGFJE8H zqqF3i{j2+{8y8pGqy;C>x+M8;!DANwgWh!vE4RpK9G3VSX&U+eQ%#Gg#XYvA;-N1r zT_WF=+@Gqbs(sInwd|$dadDo`ZD$PD+id=AQ~Yepf;AuNzMZLKTirdOEcfBN$cHA| z0##XAzG^o5@pV4cYFl@;Gt5Buo5%C!bb)DtPQ8y)QdEwalTk^krIBw~NpPN@wxzb8OIko)gnw?9L9jukQDuaCN{X*> zAXlcBOGJcYntw)FR=Sf{o>8cqubD?~S!uRoSYDxPWN4n5nMGPrW<{k@HkYohu0lwj zr&B>tiJ`t%lBao#B>CSH3cw^nblr=Z8%%LsD;kaAv4oB0SMI zyL<22!wy>052|fei<&6L*vj&`e#6}#hE=B$8u!O`ex9ALRewHJtNc#>R%S^-*Wg7K E06PAAJpcdz delta 301 zcmcb>bb)DtPJNk=MVYsgnR#efxNlatrAeYoSU^NhV1AHxnPYNkNN|!{c9ofLfU`$< zF;}2vKyHYMU!YmGaeB6yc|c0CwsVG`W0hxRsk1?Na;0aIwzp4VXrXp?GMBEdu0np6 zTc}%TReqLbgk_>*u$f6_lBs`Xx>rhow`p-!khZ>wWqnXpc%r32c{Z03x8~M(WkJQF z^1o*p?ydWo<8kxThP_|r@NHjd7yGNevb1t3r~927OJkE4GnLrspDH;O!xDRaW`KQH z^8epo_Qnc2MJrnvB?T3`rKtW$_`hHm&+!7)dl!U`>L2siuxDLX(31Nf3f5@9bZ5V^ zr*{5qv6fdy)jnyfxk&Wsb*wwZm>=O|X)h!dc3rOIw4v3fwB`Iijf83(7+EvJ3PJLNah^ui`c8;^DqjO}Lf2l{XUx2TRS8+yQKypQHQd(-BK}cn~w|BTv zF_%$@uXA37iKTC*n}K7Yvzu>7ZfS(GeuZ~cezBQZQE_&*OIk{vXG&m5D3`9Tu7ZVE zNM&GIc~P!!K#HGFfVWAqyL)P0j;V{EQD{NFb75#;Rdz~}YguYlK_J&X#Txf-g~zYO zxmfEu&3kFIV-B<3bET)(j23kqla-t6xIyz+%Gcr;o&}dTy~|v`@13jSnRGKV#@{-% v;yXA44ku4K99Z$;(8TUZ23z{e1RGt#OwL)Y*>P$8ck9Ku@1LI3s3-;igK%Ni delta 242 zcmbQnG>vJ3PJNWOxocK%Mp1!zV7OmsacGreL`8OaWoS@fx_M%Fh?{w6R!CHkwoz!9 zD_3NpU#_`Za+;4xs(xZdRYsX-sYSY@my>6)w{d>HfthikcA!T@S-7R4FPE;au7XpD zlW}mGYpI*Qu}eUqMPP}0ex#+halU&{Xi{-_nYoXrPj+#NcY3j@TRE3(`_WG^OAZU> zeZR}A-nT?cKgeX3sf>kL_vAa(Z$#qiovz9yu1bFfuUl zIILLkSFrNd#1J*xO%CO^^;d(euHq+rJ{sqFJ}HIn>Ed$N3>w(q*XZTjh-y;dvO#a8Z`!E$v^T-B#s^S+(VQ%>i-k`6oc1@8TU!J6qluimi2K?ki2$Y%e04AZPM@P1Vw`J!@-oD>b*p&7bpV zN$Z_ni#yiqndMBJ$}Z)xoq8DZzui+OxTm(F_W19YGiLAyIkzQCGcVhvwAAxMFHcqd h)C{gw*6d1~H0pQ)p#!WmKMXL~3b3da83ks8di@j%iv%QkiR!e~D{wv1LG3 zK37qqVQ7wHQCOy%V|uA^PD-kOpuVS>eo=8^aFIc!d$4a-U~rC6n6X!IGMBEMLUD11 zZfc5=si~o*f~8@YM`^l3poO+icutyem3L}hvZY_Sfm?8qv#DpgM{;P9WpK8)ad4`B zYDGv+Xt7~BS5}%~fNNl;k70pXRl0tdt6NcKL~5F;f0kKEW~gs^M2cBjSy4q$NLp(7 z#E;_PJ|+>VrfIGbc@bgG>G`3#A$k7!A=(zfeibGm$rYuE*=EJwflj`m`e7DaUM2dW zW@TX^k!C6Wi53O=&QXq0X1UqHWs#0$RVLYHhT%qKzG;D;;YlWw;~B-nL&F1&6CjMPA|n#R%yN=*!;*}Ql1mFMLb9@Qiu5A`%M5(VBJy0ha?(Qsoq|H54D<~{-Q0^a z9ZkJ_L(9UAyuI|b-K+EiEh;SvvyBVf^Q%H9pJf!Uk4Q?&H}(v&NH31440JB_tnx2+ z3Xdo(b9Hj`$Tjk@%y$WJOb^U2%#JYN(hjMpFex-CH7^d#bF9pEFE7h9Dt2`W^z%+L z^moZl_suqNHA-_ab#zPT($&>f@D7ViD@iOchzxZyNH`xqEhUa79R}enz%-d6aQ(K}k|nNJVIXziVVwF_*5LLUD11 zZfc5=si~o*f~8@YM`^l(Z&8N6XHKz6RH}D)rcY6Fnwv$giFtXTWsYNbc7SD;cW!A; zm1A&`ub)#sSF%rtn{Qy4NqL2db5uxqKxs*qM__@csgFr{SWr-fpJQr(rDJ+(grT3w z#E;_P`4$;Lf$cpmtFY^pDjB?D+Eeh06&h*PPEXXsp^a{yH4NgrC zaY=Qn4+%7ONp&g;pSI`P$UX?xs?6T+qusD_zL@Rj-$9SP)E>t1 z_0IW~*=yWV`*b~1NXaC2~Xd|-3k<6P7mckR=kobRyyy34(W z>#w{|WbiMay#9>`o+dL`G53p4KGOcc%vk#$N1^8u9X-`Iu9M^VwIj>;ZSCfGh@Oc{ j>=a%*@j&rO`74|oVtqf&ox36CgwX?^*r{%hl|BOiO2z#j diff --git a/nix/secrets/s3_mc_admin_client.age b/nix/secrets/s3_mc_admin_client.age index 0287a9e1812413cb2bad3df29d28aaf92c638e81..ba1bd5299017489b97c386061fcdd017e897790f 100644 GIT binary patch delta 824 zcmbQhK7oCLPQ9y>TVQCCi)V#@nO|l~SxKf_ex;>BL~f9KZlH0Lvvam-phtkWsiCiN zBv*E1fpe*gQ=)lTRfM5Qeqw}+et=hHly9L&Wq`Sdqkp7%NNHF|nTfNJ374*&LUD11 zZfc5=si~o*f~8@YM`^l(K}B(~K}5NCL7Jm}SXzmJxm#$JTXC>KR;Wo%YNWGyvUWjw zW|*&jWM!}`SD?OsS$R}gMY?yMXIZwVe{f}CiLsNTkz;5?gmb30p?_M2VX?NGesXB~ z#E;_PjsgA_Zeh-TxmDpVZoZa=`kqnAKE7$?`jrLFd4*L)+NDMjW-j45{_e?K+POJ_ zArY13ff+_VhLQe7VIF2Kjz(Ek6@hsX>7{x4E-sFl-eKluxgoBT;~B-n9kYtcL-JfJ zUHvi~i;|Q4E6sDwBXc7w{Ves1Gs**#!_sns%RF)n0>ZMnii$%#BXTNDBl5#5f?O+$ zLNar6+$~LglM+jPEOR~F{QbOA@**lt!a~X?pJf!UPbw?(4Js(GEcQyx@=MN4bf(9dvoPx3HJEDJC!FZC$QN{TSEsERc7aLo>IjPi^M zD>n73w{XucvJ7!4=F)HWn?0xIfyK@bnrk$edlQd%T@$TU576bC#&zr3yW*39W#5l8 zG40l$QR{imWP{(y#UYx)hn%0hi|KVMmQea}IQh+{pJ$fkn>_s@UR@x6-|KYfgsmn; zN2LRJJbmhS7sMRtF!MjyWVv}!asT0qFA^HMvQ;`#FV{=u9y`?G-lyN5qGiisYvrSJ z;M}!3U3aVaLriAtb40#h=;E2VeukLBm2d3Fw+H0?UAZ^#LGV>8&%?d*q$UJ>Uva>* z^qg~V_Xlsk@MQU;JCB7cU3>2ktHRWET=M-=r>)vWv0a8wUvt#fvv`J0o?&bl!p|pN zZNkeha6dwei#=OETx#8h#@L0ktyk8kTULd5%%30r*mm82i>sZpO?R|DzxugE&_%4^ Ohl4@(%=iC)c>@5rggAEq delta 824 zcmbQhK7oCLPJLB)gjs5?nYNL$xvOt-fm3EyR;r^%wohnKSaC#nzNw3kxleXbXr_~s z0auxMx|5l6skxzLo?o_mq+dmDfR9_TN2y=9v!i>tv%ZB>X<}h`nzv(^0hg|wLUD11 zZfc5=si~o*f~8@YM`^l(Z&{_6zK2JCZc?d5Xoi!Kv0G6@o^P^6j-f@Fp+!|tihET_ zm1lT*YD!f;S6-I8SxJgX+@5kvsY>0 z#E;_P0mhYS-sNdIRUzdmF5W&RA!&YjX6`xJp%&VXMkYRqemMczCXp`Q9(j>mu3`H6 zDV7C36-k*UDS-ju+1}*^<`yCPeopS*ZYe3IA%UKGi5b2wo}OpWuo4E*zQiql=)yi7c@iriey zt2_$xoqQwA1H#KJ4RYNg0+Xt=3yVS{QUgLKpJf!U4=9Xq^GPWvvha^`cXadhH?VY1 z^l)-13{EmM^$9i$cM5bVHwp{YHpp}2@+@(6HuUx^@eQqX$x87kO>s{4%e5%ej!X)5 z%nYhB$Te}P()M#V^2svb($&>faL@EJG&3l74|CQ|F(~!S^Kg%FP4UTbj>yvY4EC*b zPfskXFU|AyGYSeQ=5o=z{d}Ifz0UN&IXPDa3)!`$C*$GfZ?hEq^G-9LD5o zaVBS{DEq1W+fJXhPV~@z>f6?RbH|hrR&^1<7RjzC<@(N!zkBoQT6F||H;A6@c;-0e z=;wZS?uFO(tU27fyiVcka^>3hnvb(2zPz0K`oz;eO&?DP6^fpm8Fk!6zkc_j?m0jI zzCB@|lB8I9JFnv+tZwvxN_L@S(5#0eec-%hBHwmO1o|esU>_%F4ir1D{7|gGWl2G!GPA~TIuuhn6LwlLY|S!Z*YK diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix index f9fed44..f02c447 100644 --- a/nix/secrets/secrets.nix +++ b/nix/secrets/secrets.nix @@ -33,6 +33,8 @@ in "does_it_build_private_key.age".publicKeys = [ vps4 ]; "immich_secrets.age".publicKeys = [ minipc ]; "paperless_env.age".publicKeys = [ minipc ]; + "knot_dns_rfc2136_key_config.age".publicKeys = [ dns1 dns2 ]; + "knot_dns_rfc2136_key_envvar.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ]; "wg_private_dns1.age".publicKeys = [ dns1 ]; "wg_private_dns2.age".publicKeys = [ dns2 ]; "wg_private_vps1.age".publicKeys = [ vps1 ]; diff --git a/nix/secrets/upload_files_s3_secret.age b/nix/secrets/upload_files_s3_secret.age index 631523c23af390151ecd68122003ac31f9178bf2..003343f8300afc5d5371610bd1c34e05be4f37f2 100644 GIT binary patch delta 440 zcmcb`e2aO4PJKvlL7st+TWL~SL{7SqzoUL(l~JluRiR&id0tS2mwt&)p?`sQXr*7e zD_3?-ibu7Yn! zfn}+_yRlbNfOkM)Vz^JPp+|6GU}R{jS&?bFp?;K8R=r1YNrpv;ZzR`|kYlXQp|w^8W3dw9I@pd-&X?{y=akMVomb#}AZt>47)(dnRhq2ZON%kpnes7-h@ uP3N*>rILik`$mNy7Zxt96KrYpKjczfw9Ak+u<@^kA=l>5nP=Cqp9BC#^}HDX delta 440 zcmcb`e2aO4PQ9~1Vp?gQb8>iEilbw0X=$RFZ?Q#4enD}HetC#dP;p*jn0|?mg}$ew z0av-3PqA-QZh&8Ierk52Ym~2JRBl04x?6f`n4^nvwv(k(MNU+zbGnC-1(&X_u0lz8 zm0NIHh^bMDiJ@^oNkNK*ad}cjgkw==qCr_sm`P4valLbyPo$+`hyj<&qq}@vTPEDm z>CXDiQZtt>{PeZPE8W&H#nl6 z@+fcCkMuQ1Ix;qyv^{M&v1tFlHK`2e1>W3^kNHfcz95b zFPCwFb6U2czgJ{sVW_9EMMhRhM5TE~dU>#^rBg*oR%KyUUQ&QZvafN51(&X_u0n}^ zN>D_ZXKrCgzH3Bcc)E9nnWb}Dg;{DyN_ei3Yh}7mV0~tYX;4s@mkHN}*}AXlMN>Yp zr2YJ@@YT^_i>GnYx7tYo`+jf;?LMJ*JT@h4_2OS{8&=yIFXN2ZvuE|pcgfNpe3+MU zyByMHy&k61bH$CZ{_=yKRV-`_Uz8OsJ+?S7%{$`l?Xh>V){8YS54Jw^eyka2_Ko2~ zZ1~ycZ)rZc3lpd6Rdl{_?7RBr0H4OAI>BdsY17+21u8Z=yx+9RHNqjP{p~iz6SGZc Nxhvb|Z4Un<0RX1wfLH(k delta 309 zcmcb?bc1PvPQ8<{hqq6$n`3fChO>4~X=ZAWg?_1jL`Yahc5bL?cu<(Xt7oL4hpV@T zD_5#-VT!(YqD8i)WvRALNkp1oS-N&`WOk5$QNCHeW0`reiJxzof3l0A374*}u0nCL zXH|x=cVIz=e?>)9nrE?RWV(fcvw=lrp-)PpduDQ#Z@sojxVfpjZ$6jOpHE4$7t;L} zerIC}QYrNps{SY$arsTP0LzXqcnsr@5G6=EgVY zJ}+kwI=7&)_(HJW&OMc(T(_p#gs{I^=CSVEquaLwMGaTP+sSqJl$fm7&HCThf8)an Mj{kz(*0vmy06>*{umAu6 diff --git a/nix/secrets/wg_private_dns1.age b/nix/secrets/wg_private_dns1.age index f218338..59f797a 100644 --- a/nix/secrets/wg_private_dns1.age +++ b/nix/secrets/wg_private_dns1.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 LZU5Eg OKL541Y7HQSCBtUqWQVdIxZK9HiWeaPyAWwkcj/bsgs -PviTqNl4VLbQtErGDpXFEJSeRf59Mx0v3qcznEZ1tTo ---- yRq8T7TGu/yBKFx2r+t8gbohrUHDkyXdvsB3n5csgpY -kMQl?N'!.LlLBoDY:_Vctci= 3rKvMfDu \ No newline at end of file +-> ssh-ed25519 LZU5Eg YCaoZYLxmyrcSVXaTqDeC25n7lwuGlTDfWPNxg9etn0 +xSVH1o+ITY39M7X8FNpj5liEW/20HTq0ZRxsoo3U8JQ +--- i8MfM8cVg0SJnNqUYeTQ+dY2FZ6yEhIGkiHgxBzTDYE + +F0eҍY-{sh]ƬfApB^1e0!3s"j@=rRs(+" \ No newline at end of file diff --git a/nix/secrets/wg_private_dns2.age b/nix/secrets/wg_private_dns2.age index 536fb4ffc998396a24d6837bae31af7b0789ba95..64d55f036090e8040dab8ceeb11936677d515df6 100644 GIT binary patch delta 220 zcmZo*YG9h6Q}62HsITu4kQou0o*Qo9ky2@Fn&IbCrk_`8Smb7E;GdJ_6>i{Dl%1Db z%vDupnCP9FRA%hxmgZtvVd!VzQ&{R-k{sqAoSjw@m>3Zmm1G$dVp&*}&ZVoXt56!G z?PzA0Y+&S=80uc?l3{6Jpq*aflN%Y}lW6W2YMJSg66&95;E|c-=E@~`Pxk54{L-CM zJEfnl{=B?;n%KOLKT5M}rJwqGg|5Hz>df=nD<)Qpem62~(l-6bW9QOXvgy92?iuH; X3!K^d_s=o^pWt+NS*iCswX??nz4BG{ delta 220 zcmZo*YG9h6Q}6AUZt7~0=HsJZtYS-r^cDWvu|T-mCsjhX~CgU$&l}S0NzrLTDcPHgu{=Uu1neFTv0)IKG-*57I Xv9@>GzO|Psk4sLSV8?QLMeG#-Z8KNY diff --git a/nix/secrets/wg_private_minipc.age b/nix/secrets/wg_private_minipc.age index 2fa88e6..1d0e1be 100644 --- a/nix/secrets/wg_private_minipc.age +++ b/nix/secrets/wg_private_minipc.age @@ -1,5 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 yMKb8Q 8ESNEQZaTfjWl4qGZJV/GPN+tFozDmiZZtXCctRD8yE -w2+Pjzmotz2X0O8ehb3TTOLk9YCk8hqRqNKfNNnLQIw ---- pfmBROvSCK/41HS44uMmwU5izVCyHrRirYjL/WBAhZQ -m *Qv"+JQ Ā'PhD>GJ]ĠLݩ N̤ۀ \ No newline at end of file +-> ssh-ed25519 yMKb8Q QdFcYSyIYFlrx1vOfnWaFzULi8AxYIpH1HXLRZzs+iE +3JG+l7U6AXmWe/H9J1B3dFjD+GCNRM4wsNWR0CHU0PM +--- UXqL/EG0JYwnV4Owi0Gy4BnpW7QkgiF4z2P9Qskfq4w +@ +q,YL3)eqaK@]exC +tv-G!}Ji$=* \ No newline at end of file diff --git a/nix/secrets/wg_private_vps1.age b/nix/secrets/wg_private_vps1.age index a9442703dc960a7f1486f18065350ac5cf14f3be..5dd33e1a86e3ce1990b794961fd8f04b5fb08578 100644 GIT binary patch delta 221 zcmZo=xl0TA5Rs8tLqr;vZ;K z&ZS=vkZ)A!lIs&>=~nKat)H8osqbQzmTDdnY?K!jP-twL6Xcd;?(LHq%B8ETt56hZ zP*h$~S{7*<72=VZ98{5}?Gllet)G>l?O7C@mRaOu7FJvtmYkmCkC$uooFC!Try?(6-d*MgSFblm(r!Q;ZTnzNnmuAe_F4OaInS${Fj!uSh+ ZmY~PMiUK$8&!--)IDeJ#f6~5v9|3YJgq=>5~-|Q10zwP!N{r<7Vs{ z%H`)_YU!2kUE-B(SrY7m0anl9U4(!78Y8W7H(8(5y>^J>_d;p$2GRh z>ls)!Uwjv;bLQ@h14Yu6O&07I^}_hu_PI~usgJYceRJ)hxaO4^vCn)TPVJpr5y$v! YL(hd!--c^bc8iEDjaeM_*rjhV0B`S8KL7v# diff --git a/nix/secrets/wg_private_vps2.age b/nix/secrets/wg_private_vps2.age index 3cf2891..dbdcbd2 100644 --- a/nix/secrets/wg_private_vps2.age +++ b/nix/secrets/wg_private_vps2.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 91VHug nuqwTTdoNOLWvbQAIhl9WguvArxG0jNfkFn3qM8VyjE -NvhMCreuxdWHezfH8cF4wXjO8ZbG7yQC8+sVnWFghFM ---- OGewUdFWzL1PzHGBHB7ulJVi5eX6UXKLFUyfbvGErmY -ʋ.\Ņiқ~`Q ,W;m pQTY Tz?]T-s4)ZP,6H5bԄ7h \ No newline at end of file +-> ssh-ed25519 91VHug MzqFl7ZTH4laSYXRYPbIiXadl/bqVXPHRM7wD5aLhy8 +Ng19G3jaJJr1s33i0kCHxIUQeTmoISTN+VQQD3rB33I +--- JkYGUYo6Ys48HI9UpXGardgf+k+DC71dxLiXqxMmFEQ +CqC!n ƈ,bA8"MeNьnM[(֡XͤX+~ؓSnKXi8> \ No newline at end of file diff --git a/nix/secrets/wg_private_vps3.age b/nix/secrets/wg_private_vps3.age index 5cb419d45a29ae348afb586c44bf9e0767d1f022..f9b5098fc0a5c5f760dbf1d7cd824ef9159b2cd8 100644 GIT binary patch delta 221 zcmZo}BCy&ZVoXtB~kp z85yEoY3ku+SZQqGlW&;o=2(?cnrv*G;+|)cnq}yn7M2zfn4RtG>dN)tm%w-Sk0rk* zvbP;h*>Gf;@RAd!SIhS12hg&%! Z7jI+y|K#)Dtr^r(bN(cgb=mrI~Wlk9UOZvtQj|anCM%y+e-E+g%X$sM5^%v02hx^{{R30 diff --git a/nix/secrets/wg_private_vps4.age b/nix/secrets/wg_private_vps4.age index 7915ceb..0674d3a 100644 --- a/nix/secrets/wg_private_vps4.age +++ b/nix/secrets/wg_private_vps4.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 51bcvA jfwnJ0gZN/FeF0krZ/ERWq/eqKBGwANBwea3xCJLeHw -x8ccoxcT8Yn99d6aWzZ667jUjE4dHPfz3ZIg9qG4xe0 ---- H0b14xAs2FTADz89JQx2eOSmAgN3Rs5A2o316xzISwc -@}`͠&9WjWSEH@V˒x[?Uu.~J*7ҷ< \ No newline at end of file +-> ssh-ed25519 51bcvA soCOaoBhsAvjaw29hw6Q9JkrLGbfQEwgszOIl38+CB8 +uj17MiT/crUT+LXF9TEylo131FV1cKQbNXQNWCI1djw +--- MAVo3X1mO0iUC0mEo4wbbDbK19hKxB/zEcfqfR4Bxsw +2}[I,sW/8KDkjzH,(nyߔ8uq.^PrͪCM`)1fy,XOҡ \ No newline at end of file diff --git a/nix/secrets/wg_private_vps5.age b/nix/secrets/wg_private_vps5.age index d870bc4..5bef662 100644 --- a/nix/secrets/wg_private_vps5.age +++ b/nix/secrets/wg_private_vps5.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> ssh-ed25519 vT7ExA 5Yp0GcAOQbgRlxiIBgDt2O5NK0zoEN3PdUQOFsKtSXc -653+sJWsCeQpu6agZn85RU6GOrpMJY+TbzqRLbYvnaw ---- SYT84Omvncdv4tQYH7Put8sXqqA3LBR4/DuVyVCVbNg -v_AbL"fR6W6hepKeg,E;`"G xuVB^+k6 \ No newline at end of file +-> ssh-ed25519 vT7ExA Z8248Zxd0dGjx/YtU3cVKwuKMDRaHQpo6d21bwSOWz0 +/7PxJCz7yfuGuBWioDQMizW9+tL7Ku7JEB2h6aG4vmE +--- xEBearw/OGRugS23zBrNGj5zKY/bNsot+UQOcCEATWA +!p%~)6- Hy*e g pXѷӖk وm4bnx6de \ No newline at end of file diff --git a/nix/secrets/widetom_bot_token.age b/nix/secrets/widetom_bot_token.age index c9bb838..05e6159 100644 --- a/nix/secrets/widetom_bot_token.age +++ b/nix/secrets/widetom_bot_token.age @@ -1,5 +1,6 @@ age-encryption.org/v1 --> ssh-ed25519 qM6TYg qE/RX7sfudkaWg+9A1jRP84PnGCC8f7y2Ai308kN+zg -LnySP1Ywe33ECGtFx3Un0+QcxH/IscCHao49nbuEvm8 ---- DYF2tyroJ1KnECqhUvzLyox9wULA/eEH5SdENW2fPVc -)nCzLb!P[>jl(9P@{;a#Bq#0+]-M\5{)laWkRCEtc3 \ No newline at end of file +-> ssh-ed25519 qM6TYg XJWJcqVabkHFOrbsNTS6+jc/pQ1a4D8lZkObT8BZwiE +DgFVt1+01MNlPm898/qnC0wGbs6eEsLcHpyANA5tpsA +--- VhhquCcml82lpKjXLecBoCz/2CHNl2S9htU2iIWfvyY +~'t/!Fb[k"yfiܨLGg!FqZaA3 +iE`v8<1Fmpx~)gc7R&%U'XDD \ No newline at end of file diff --git a/nix/secrets/widetom_config_toml.age b/nix/secrets/widetom_config_toml.age index af313d3a6781a81ffb4869949b5bf2718cd688b3..374e672200052d943c1c7ae3029b858fc3708132 100644 GIT binary patch delta 4000 zcmZ1`zf69DPJNPhURj8Xr?a7UqMM^ply8VnUWJ*lNpMMiYNkn&Wo3vbuXk9T02zh`h&c71lFn^B&2c`?^@H@{hr_^M(8 znhxGfey#E_>%gqLQ3tx%eq1{D{j`48y2q}^BX~}ExcJWf#$y;{7yIbZgDw7xuN^W< z&=LpO3ct-hU>#^Ic!z>Nigl{kASYm|5R-LTHiJvqmkp zWTwCW(~_pzxnE7$xis20Bt)iS5lIiu3|pWaDk&IN^=eps+fH(M1`@%_;C;`ofc$IPUxBMZ|NI30O6T@yE$ zDI6yL^tmt%S~ey6C#rW|cOG9zDe(K9Qr)4_`vGQxjWwoBy{W*6#12 z_g>vqjs3e0?Z2^+A-FJ=htXGTs>gU$Nx_J{7}_=W&&s3u&VI4E4WnX%mT)ert;={&K($?4OcTzBN^I#+*?RpRo3W3!g%L>{?$?3@_K)Z8nk z@A*5{I4^vA=k$k*!F6@n#C~-UpC)j)p#N8d|GPm?L(>h!LPq+ zToOwxnHn%@R?M0+QVnyW=PEV?NWM7YAMevHB7J&{wJE>~7z$0ux;g9h@y~7rV z+b2!^gx;ubn7|n8nt!$a-rMYD$L4+fct+Mcmh%)_SyKMvTXP>LzRFxbshZL0?~}Q$ zcU?-XW(o*sT(Ug#BT4#G@q)RM8`s6iDrL=edGK^?vysWR6SF`3dOrL2ne^fpHm{b| z)t#JSI87&G$D~M$S>~zzqPGm{??iR=WxH)VArx`$*70j>tf@;S7iyaeDX#gvZhb>a zeBaEhv|2HhuNrN~Y>e&ZZ1dkJ*pqgd>7GJt%HNs%855PdRn~9Wz@B3{bwMm|#Hs9P zm+A|i)o=9$n$5BwTvZn5{S(`rT@n27!-;LoVQIn6}kTo9eU9 zUh%eD^yjAfT&|nkVKW+e)eq{VSFTLXO7U7A> z^P|r6oo5U-iO{lszNj2-m zne#>O9x$IHI`e&fapC9AxCg@X-EPKOO;|bE=SIAK>>&@s{uy1tPSgI^TAj(b+!=hQ z_D{$D8^2`h>$fae)n&KptjA#ym8}-ve$+nfMa1?^DvACpE_oVO z2DnCCd(0T~+kxLd$HMjYff)zfywj|2A6x9{t@1E+$)W0#_1XH>ELF1C7Co)0ytXjV zU~aRlPyeRxErFiP)=yzl^*!p?li|PTjc-T(jQ8eJzrDR&FV|;2&OM$tN$K;g=NZ*X zPj)PlTe*`f^xpN$Hv(JgTEu1@zOL-^{?BU52G73Y4?lLttqh5bz&FPYBN;Y-bL5X@@V#(a{1=&J}G{aLdlxb+D+daiw?+eycI8B_*qME>E`sd zBd!4%J8oMf>{VZ`Y|A59zke^!5~*JGYnOztR9h%LU%62z`67o~T<0!Z=HJt_&wpC` zdUJNx^|c<)IUSFSy2M^9tqY$gdRz2z_KF;?Tc&Hy_-visbIPNTS+AJE|JJRQ<;?#@ zdXi2mMOmGW&Dj@v!1VDZwpq$@z8~yk9|wMueV)*AHOQj=xXQF$`9I{?JbCNCT{d9V z?fCIZLaNI{C{XYH{Harxv0rX*cvLNLEa*tyf(Gt|UcVwGC+<=A_k{GK!P+G!4v(sb437^7$H_j@-egjFMb>NDrr`V5 zOI}N6Yv;sp#?@r?2fF>A&br3oMa0ZkYwox#;d${fmhYk1`$ISX+V1t_@NTiIHjh&D z?{%#|qwDR<^yird%Y6;0>Dv2P9D1%7uJC!g?soW7slY$y9v{$OIIp>T2j5eXu2~?1p4$f^=d6i+S&egN)gkJsa?j;5R_|4R9vknM%D-=O;r(~jWSdW1@~nkrcP6#j zK9F0rZkq7)HRks_F7<0YWV`FvcY4)3y$e&O9hHt*`o`Sf>P>r^?+LFHr8oLwCP-h~ z{rcrg=czkg4HyIV7u0`zBzUUpV8rLB@A+$tGwxlk6a67375Ve&x6j58pYMAvfAO$7 z&*h}am%`^nR6X|Idg5$o`-Ac`+kd`!d}Qm3l($o~;*S6Pw%_M2@4-Ww?_7@T)^}hE zntMCrp$ON<@VLo_(^;lJDW7TId_-&En*)_rs_$CnCJS?=K4!7Enyhwb>Bf5TjSt?w zeJjJoIO$<uO+pPMZaZBJ5Ccvwjxai*jz#I-~z?1<(KfmwWx<wmr}DqqkX?z&|w*MrQbYhNx`StQ`kCi`^btUEF~TQd?| z*)!yA)4MD(?0gngFHo57bka8V|D4q5BaH>JJ07Y%TNqHk&Z;KMFf!6%M{B~*Uu_4Q z@3e@WIod3HhIx$3YECib``amcXa5uTYf~56gfITIX%EYSG?PgM4;Hga zT)CJL|3oK$!=a09nb}V3`Rk4<^BL(rz0@jSQmG&*DRkss$mLFTC*EBjCR{LIBD4Nb zQ-R!3_RL(lyRA<+Zq|EM?a9)5blxXHuKjeDsgT#XsurC7f18$DVuElNQe7j@ZtTv8dJ8h&S|mSw)fq+mopw3#XsBk z@ixeA5zgfEeDh@G zYT4V{K9nr9es5Jj^H0x3>$BT#SYLP{E|k~76r-@HGF?*X`22{}+Zi45FRVnbZRA?h zxyvcD^-|@s$z^+AOc&4;aS`EPQBc=ZuUg)6kU=tVdS8|03|C&Jxz_u>#PBTBFbpcu z_^GeY-S=aK*xpNlI~rr{I8WNxJzL}VSY{ti!M2j(1$Ff>@#eq!d?=uexf z>JP79r82iDQlwoi|L32DqHIAci?>N-=bVl15s9Ahx@fK5iZ(9xMElvnyE5K9aW7b% z{i&Yy4HvKFenFkOoSIOUn=iV99HWbVTg}?ZToo(!s@VGH`&--1=h+qgPAuEuv`d61 zKA@+z?tq__y80%4gD57M?EUZWPkScpS@hUh)Fzc00J)?J0#&H=@hCQz&GEYDGuu`3M zsrnD)==&@;Q-8Ux-};B&PCTfv>0v`V*8|g3E4P_SUCeDITNb{%EGYXVsXLsti%GtE z$6BfPaV}*~86`3wSnND*8@%nvv&U)GcWz}S?y)&*EURi*vXALZRrCQB;rF|*-Eigm zsBmuo-gEE%UgxTBR~Oi5rnN)JJ@RDd=kp|)xUM{EYV-Jb-u@e^${{tKN;+;?D~29$3c&k`b%0W z!|w%rwh2ho@8G=mNbvo==mnQr%QOpS_*^v=*tuXi-z&eCB?qIHs@C6^xV~!hEH1@P zPqE3JZaQlIQxPjU)i;1O$cvet9YIFmHP#;E6kR>0|1Nv BnneHr delta 4000 zcmZ1`zf69DPJLKZL}jUuZ;*RNVu@pMc9wRjr=M|2Muc`{d2vBzfv0h}g>iUEMu>m7 zFIRwnxwdy{p@pYqZmCI7re{!oYI%NoN@|!$Lg-JX_bWDRYjpI0XtuA+OM%i?0VCLSs!{Ea#zTCYWjOc-jds# z>dxSoAJ#qd!||}6Cv`NWPG35DoV)oR>(SUa%h$f6cdlydMzQ|seKTvyeb1jywbdEzayNSJJ;V^& z)M_cw@$OY@+V0%Wk!Cg)IYqXr-qrs}zziBi(v8{ehA`@1t}zG|~=)i;G*#oP4^*pKLFB&Hqd39jEX^Wh}s=*TBC zh7POxo7UpUS=0XYvzS@&E>ab9Zq|_iT;{(qu#tKDk1c6^P2}VcvYtaCc4fj zUts*}1iN_4vGbD3`&Tucd#Vugx_8~0b-+H;PZK4PD%B7v6hWur8^!`$@RCu5Pwj zx@*FUulYsR7a0v0EI4a3pDk2idA03(q=@^k_3Ni!ntyM}hNQ5><92gRUw=D$k4gX7 z5%)CNgB*Jw1sC24UaldrEbbkzRKO((OYW$|UA8(?_b9N49enpFIIrHimHDHK+~Rtf zg)XpZ zgVzcVi61i#x^CJmw!UcpycOI`F2Uv!|DE2xUFK$H>3Ziu*RV}kpPuN!ukNN?Hydue@|<>Xo0!X90ARjFL&w|Z4x@qLpQ zmtUU_h|riUdQB)itwwV8<`?!B5er^U&E|ctkQ;JAP{TjR;dZF}d+AdaHD|x-|Mz(m zt1xM$ND5mqcg19zw%sq>zo({`e7le;n!q{vdm^h@x$pXvUqROM1V#6~v^^jr#klM8 zRfC#)Kiy}qt9M?#rtrXqnSy*@^(EIma5>t1Y}U(V{nEC(?D@Rb1yM7%S=pWcZG3iGBiALx z6#0kGrf)uxGL2cwY3_`f=elg_8-pJl;LdaKKRiw03|rjZ@9CM(Z0Dc#DOYotIPKoM z@72tc3UVJDTr4fbBlvHzi2PnDWt}gdGq==L3yYoFuvO4_PCZw4<5rtVdJAsub(Ea` zNV?-on$5H?@0edcpLvZl=kv6Hw=(Ks%c?|KzUY~Du(E!*Ej{Oh>-lbDsW#E=GH2?a zN982cO>p_Kdev-BeeOlG_VTbPO?6!zvx7%0vSIeTDgSp(*`Alute}47s%)xK62C9w znkjPwr@rPsacWyCkJ#VLd2X-I%B1OZW`xX^>sPq7dz#cHcWwD7LD^Rfq8D}wA6dCu zaLeL{6|=mLR3DxmbTs9(!g)sPD!!-gFSk89wzdAM2m8JKTY9s6HZJrE$zB$1%US7v z@u0?0#i0C^yU*3S?WupTd#lPsCXqKLXPVX?OkOPamdW$!A_vnX*B5_!H!F2n@iG=n z5)88Q`966{LivIBn{Ix5tN%3MgJi}3jq95(T~jDN-n{jj;_~~#nx)g%&Y3S^@ta*o zdXuPS(VIBg-Sv7OzHzmEP4z9VtNpZS>eo1qbu!t4`Dfa99nx1zHqO`H(B<+nMo+FK zYG;nNo{RNX?jJ6a6}*WPkL;&-25+-4}>_s53JvO?lCbOY?p$zj-A!m2K)_&g~KPdLM4xpSLE4XOrvf z%9tp#%A4>1MBfnU_Sx`7Zl>qOm8x!w_ImaxObVaewd<(VMNjVuc3%yrsNUG>Gw=LD zfsc`l%*LsY9Ig1RD=&yldc%8G`ox|uFPraZ_$xa*%}D*V!0)r~%jf1==?2Fa#~HJ{ zv{YhK_N$)H)WN&{(i@gEmcn`^foAzz0tcQ;*@f;C-}3sQCwKZ$2iHQCYj0gv2EMo9 z+xRu8c~{Z%WshI(V)#2R_DaFIcKf=^^48t9A1m%+!TIzn?vt%*W0hzcOO(* z9r+z{IY3Fn`B&uEEe47*|MX6u+{-;-QyY)s!}>jwzxY2;>lQ2VSlRS!=jAWwTMBlB zttsPbv{F!Mb2N)fcKCm_cG<%T`x~FdOud_$C?>Ip>BZzsz9i1)Ho*d~Uw={)_6j?C zL@M%-)lrA9hu!wxb2%yWW?NA4mGql?UpAx(d)&NQ)HPwHaMOx+E8qTHdGb{DuV{;3 z${W0n{ylTyQ@y{rSwg34hQQJi<&e0f-AwcecvF4(Ax;1mY!LRzMwtbgc zedc&ec-1#{{;WI8_d8Wjbg%rjh`U`s>MvY5n-%R2+vyE%ZSCf~E;ohT?|LR4w!Cmm>SFO^uSs>gH>|FYUG;k1wA2=h{qa3H z@j;u`t@Tl9*z4tTq&j$}`LWZ6i4IotehTgW@a?nazW*2hvTWKS>w7gz=9ak#>!b(s z%`QFl7Pwql-ZiD{(eghcu3x4k#Z9ffyK99i-=Phq9U`42Y4X;&-ZI+Lqu*X#zIgN5 zGg>(xVlr2&{FK`+99^;Uc53~f|Avlb%a%>lJ=(BkA4lY#Zcmloj=GfX8gmLSg>L0| z=Fr;W6n5+0ySn)fX->4Q&40%N!6=85(e;*yvh*oqN^8`kT=a z;XB@|dYtiH_wn1|BysB-g|e`&C)=>;JkD za`niiAGV)<^LF-|dgPpa5vuv~cR;G;ob0>O)xZ3{Og7(pG0=bIig%S?nxFB=9$I{1 zp>WAc=6CwvQoA=>J}6%%d4x-5dv@^YoTZiZy-NbW1_$vGx6IsmWdV8osj=1;N7uFYv=*+4KGpxR%70zg;-2a_}E zT7z{Ly(pa#&bws)sTZog4<}yKls>sK_2t(cJ)XPm_8i$&f5CARl8R%`y?G=|Gzpx zk#YWC_v2SYHb2c^KF40azvJ!y&-Xw5ecg2+g74WIsl~g$Ex5uNo3JH(c9`w@Ph0tZ zbS}^MwLj|6;un#>-n+`wGm9~~te()ibH}L{9DObJd+Igk&6Aj&dz5>b^~@5{)7Ia* zDh_Db?e$E05jSs%nRdbAQ(xb2`m|_CR$H^VV4iWt7nLP-^4$9;KlR_EQ*XdJH*>k} z1N*I4Pifg3@2)$Y^?~#DNqzr`jE2rVjO9=ARvhu!>+0*#v3tg%Qy-aFKi#fRUg5X2 z=&6Rpj^xzpO?P}GBz=-?8hzxN+Y_?KF! z)gIY}oy!@7IkzkbU$;(T$#wa%>DA!^e;>|C6Kj+;Ic<8Q|0?_Y-Ikf}Vm7>Bkl~Vf z@}6yO{ljMKqYrJ`i{uooM9zBiZLoCEExdj5Vn;>SI>T!FO~T&hrq>HTK57d;+^^ay!!ZS;k21;+J_2{f14!|`?9-KWX>`r*|zMDvo9`> zy7Mpb_5EXF@o$y6Umn&9uj1Yk%44{u!03xs>%n=o zDR1Ag#jKgqbhkN$LE-afw)0QBR&-an{$%gkxtg73zPd;ir99@hT(sIck8y8Fx# zN46w9t=`F-x{PH(`GkkQjRNb!wF~S2F4Wk*CzE$^C4%+SiJ~RCs*IfUXd-n^|t9o2ERX!H;rYFx{=MmWGA9wA0vE=uCmXXi<7UpX? zYR=-&ePy4Wb}>afGbZWS*ECD%`z0sxBVR8P)|z_lT~IR1-s?I~Gq*Nx__c)plHi&H z(Y1>ncKivddJ#8W{FU^HZHKOH+9VyjSxaQfQWv8gjaAD`&$4e(i`XFazTVKv&|e{H zQmu%CYtdr{-sRKI$e3y=IWIU=ae0o5@a$s(y4$86NVwp}U22oe&Z+aOe%ZYO(|Jo~ z34FZy<5T#?H_y4-q7$A)*J|4Y-kcvTwcz(VyMP+m#eyD3rtWHfTzGI(A)iTB}q_^HnpX5`ySm}XAQOA7% DEvlqk diff --git a/secrets-git-crypt/knot_dns_rfc2136_key_config b/secrets-git-crypt/knot_dns_rfc2136_key_config new file mode 100644 index 0000000000000000000000000000000000000000..61b3a36d237bff406f13e3dc15ff34ebdc0012c5 GIT binary patch literal 134 zcmZQ@_Y83kiVO&0DC=SS8fm#-SoOQ-!ar;0Em}H7p{lfs_qU);taX0;{LRv<<9vlB z|HS|1?iX7n$sMqN?{pM41 sLJqIHtZyxOW5qeu8ysH*4xG5mpL+er+iRll^fS!=NEoy#e@g!a0PL$k&;S4c literal 0 HcmV?d00001 diff --git a/secrets-git-crypt/knot_dns_rfc2136_key_envvar b/secrets-git-crypt/knot_dns_rfc2136_key_envvar new file mode 100644 index 0000000000000000000000000000000000000000..5bb8e79a0efe14fc85b94c13d4e21a0e027b6d23 GIT binary patch literal 67 zcmZQ@_Y83kiVO&0@DY)CC2OB~;$l?&{>z*%_BCqVn`a&*6jiojaY*liOz)$9x)bN# ZdMsBP(sWKE@T2+LE%s+lc=TOw0syQv9}xfm literal 0 HcmV?d00001