ha

nix/deploy/smoke-tests.sh

@@ -4,20 +4,28 @@
 
 set -eux
 
+check_single_dig_answer() {
+    dns="$1"
+    type="$2"
+    host="$3"
+    grep="$4"
+
+    dig "@$dns.infra.noratrieb.dev" "$type" "$host" +noall +answer | grep "$grep"
+}
+
 check_dig_answer() {
     type="$1"
     host="$2"
     grep="$3"
 
-    dig @dns1.infra.noratrieb.dev "$type" "$host" +noall +answer | grep "$grep"
+    check_single_dig_answer "dns1" "$type" "$host" "$grep"
-    dig @dns2.infra.noratrieb.dev "$type" "$host" +noall +answer | grep "$grep"
+    check_single_dig_answer "dns2" "$type" "$host" "$grep"
-
 }
 
 # Check DNS name servers
 check_dig_answer A "dns1.infra.noratrieb.dev" "154.38.163.74"
 
-check_dig_answer A "nilstrieb.dev" "161.97.165.1"
+check_single_dig_answer "dns1" A "nilstrieb.dev" "161.97.165.1"
 
 # Check the NS records. The trailing dot matters!
 check_dig_answer NS noratrieb.dev "noratrieb.dev..*3600.*IN.*NS.*ns1.noratrieb.dev."

nix/hive.nix

@@ -24,7 +24,7 @@
             wg = {
               privateIP = "10.0.1.1";
               publicKey = "7jy2q93xYBHG5yKqLmNuMWSuFMnUGWXVuKQ1yMmxoV4=";
-              peers = [ "vps3" ];
+              peers = [ "minipc" "vps3" "vps5" ];
             };
             tags = [ "dns" ];
           };
@@ -88,7 +88,7 @@
             wg = {
               privateIP = "10.0.0.5";
               publicKey = "r1cwt63fcOR+FTqMTUpZdK4/MxpalkDYRHXyy7osWUk=";
-              peers = [ "vps1" "vps2" "vps3" "vps4" ];
+              peers = [ "dns1" "vps1" "vps2" "vps3" "vps4" ];
             };
             tags = [ "apps" ];
           };
@@ -98,7 +98,7 @@
             wg = {
               privateIP = "10.0.2.1";
               publicKey = "ecYfTot7RrJyNebSZTQ1wciOhvrpNSSbkR15twpSSl4=";
-              peers = [ "vps3" ];
+              peers = [ "dns1" "vps3" ];
               noEndpoint = true;
             };
             tags = [ "home" ];
@@ -320,7 +320,9 @@
       ./modules/immich
       ./modules/tailscale
       ./modules/paperless
+      ./modules/home-assistant
       ./modules/caddy-base
+      ./modules/caddy-acme-dns
     ];
 
     system.stateVersion = "25.05";

nix/modules/caddy-acme-dns/default.nix

@@ -0,0 +1,13 @@
+{ config, ... }: {
+  age.secrets.knot_dns_acme_dns_01_key_envvar.file = ../../secrets/knot_dns_acme_dns_01_key_envvar.age;
+  systemd.services.caddy.serviceConfig.EnvironmentFile = [ config.age.secrets.knot_dns_acme_dns_01_key_envvar.path ];
+
+  services.caddy.globalConfig = ''
+    acme_dns rfc2136 {
+      key_name "acme-dns-01"
+      key_alg "hmac-sha256"
+      key "{$CADDY_DNS_RFC2136_KEY}"
+      server "dns1.local:53"
+    }
+  '';
+}

nix/modules/caddy-base/default.nix

@@ -4,8 +4,9 @@ let
     plugins = [
       "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3"
       "github.com/sagikazarmark/caddy-fs-s3@v0.10.0"
+      "github.com/caddy-dns/rfc2136@v1.0.0"
     ];
-    hash = "sha256-m5RHlrheqzoGqKQxixq+xTd2hlnCTets9zCT7aFka8g=";
+    hash = "sha256-EGkboqppRr2xcZ+7ie+WrqdP8sHSoouX4STl4NajMYs=";
   };
 in
 {
@@ -31,6 +32,7 @@ in
       format json
     '';
     globalConfig = ''
+      email tls@noratrieb.dev
       auto_https disable_redirects
 
       servers {

nix/modules/caddy/default.nix

@@ -7,9 +7,6 @@
   systemd.services.caddy.after = [ "garage.service" ]; # the cert store depends on garage
   services.caddy = {
     globalConfig = ''
-      email tls@noratrieb.dev
-      auto_https disable_redirects
-
       storage s3 {
         host "localhost:3900"
         bucket "caddy-store"
@@ -18,10 +15,6 @@
 
         insecure true
       }
-
-      servers {
-        metrics
-      }
     '';
     virtualHosts = {
       "http://" = {

nix/modules/dns/default.nix

@@ -1,6 +1,12 @@
-{ pkgs, lib, networkingConfig, ... }:
+{ pkgs, lib, networkingConfig, config, name, ... }:
 let metricsPort = 9433; in
 {
+  age.secrets.knot_dns_acme_dns_01_key_config = {
+    file =
+      ../../secrets/knot_dns_acme_dns_01_key_config.age;
+    owner = "knot";
+  };
+
   # get the package for the debugging tools
   environment.systemPackages = with pkgs; [ knot-dns ];
 
@@ -21,28 +27,57 @@ let metricsPort = 9433; in
 
   services.knot = {
     enable = true;
-    settingsFile = pkgs.writeTextFile {
+    keyFiles = [ config.age.secrets.knot_dns_acme_dns_01_key_config.path ];
-      name = "knot.conf";
+    settings = {
-      text = ''
+      server.listen = [ "0.0.0.0@53" "::@53" ];
-        server:
+      acl = [
-            listen: 0.0.0.0@53
+        {
-            listen: ::@53
+          id = "update_acl";
+          address = "10.0.0.0/16";
+          key = "acme-dns-01";
+          action = "update";
+          update-type = [ "TXT" ];
+        }
+      ];
+      zone = [
+        {
+          domain = "noratrieb.dev";
+          file = import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; };
+        }
 
-        zone:
+      ] ++ (if name == "dns1" then [
-          - domain: noratrieb.dev
+        {
-            storage: /var/lib/knot/zones/
+          domain = "nilstrieb.dev";
-            file: ${import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; }}
+          file = import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; };
-          - domain: nilstrieb.dev
+        }
-            storage: /var/lib/knot/zones/
+        {
-            file: ${import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; }}
+          domain = "noratrieb-acme-delegate.dev";
-        log:
+          storage = "/var/lib/knot/zones/";
-          - target: syslog
+          file = "noratrieb-acme-delegate.dev.zone";
-            any: info
+          acl = "update_acl";
-      '';
+        }
+      ] else [ ]);
+      log = [{
+        target = "syslog";
+        any = "info";
+      }];
     };
   };
 
-  networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort ];
+  systemd.services.knot.preStart =
+    lib.mkIf (name == "dns1")
+      (lib.getExe
+        (pkgs.writeShellApplication {
+          name = "knot-prestart.sh";
+          text = ''
+            mkdir -p /var/lib/knot/zones/
+            cp ${
+              import ./noratrieb-acme-delegate.dev.nix { inherit pkgs lib networkingConfig; }
+            } /var/lib/knot/zones/noratrieb-acme-delegate.dev.zone
+          '';
+        }));
+
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort 53 ];
   services.prometheus.exporters.knot = {
     enable = true;
     port = metricsPort;

nix/modules/dns/nilstrieb.dev.nix

@@ -29,14 +29,11 @@ let
       ];
 
       NS = [
-        "ns1.nilstrieb.dev."
+        "ns.nilstrieb.dev."
-        "ns2.nilstrieb.dev."
       ];
 
       subdomains = {
         ns = dns1;
-        ns1 = dns1;
-        ns2 = dns2;
 
         localhost.A = [ (a "127.0.0.1") ];
 

nix/modules/dns/noratrieb-acme-delegate.dev.nix

@@ -0,0 +1,39 @@
+# https://github.com/nix-community/dns.nix
+{ pkgs, lib, networkingConfig, ... }:
+let
+  data = with pkgs.nix-dns.lib.combinators;
+    let
+      hour1 = 3600;
+      hostsToDns = builtins.mapAttrs
+        (name: { publicIPv4, publicIPv6, ... }:
+          lib.optionalAttrs (publicIPv4 != null) { A = [ (a publicIPv4) ]; } //
+          lib.optionalAttrs (publicIPv6 != null) { AAAA = [ (aaaa publicIPv6) ]; })
+        networkingConfig;
+    in
+    with hostsToDns;
+    {
+      TTL = hour1;
+      SOA = {
+        nameServer = "ns.noratrieb-acme-delegate.dev.";
+        adminEmail = "void@noratrieb.dev";
+        serial = 2024072601;
+      };
+
+      CAA = [
+        { issuerCritical = false; tag = "issue"; value = "letsencrypt.org"; }
+        { issuerCritical = false; tag = "issue"; value = "sectigo.com"; }
+      ];
+
+      NS = [
+        "ns.noratrieb-acme-delegate.dev."
+      ];
+
+      subdomains = {
+        ns = dns1;
+      };
+    };
+in
+pkgs.writeTextFile {
+  name = "noratrieb-acme-delegate.dev.zone";
+  text = pkgs.nix-dns.lib.toString "noratrieb-acme-delegate.dev" data;
+}

nix/modules/dns/noratrieb.dev.nix

@@ -54,6 +54,9 @@ let
         ns1 = dns1;
         ns2 = dns2;
 
+        # --- ACME setup for caddy
+        _acme-challenge.CNAME = [ (cname "_acme-challenge.nilstrieb.dev.") ];
+
         # --- website stuff
         blog = vps1;
         www = vps1;
@@ -94,10 +97,15 @@ let
         infra.subdomains = hostsToDns;
 
         # --- internal stuff
-        internal.subdomains = {
+        internal.subdomains = builtins.listToAttrs (builtins.map
-          immich = minipc;
+          (name: {
-          paperless = minipc;
+            inherit name;
-        };
+            value = minipc // {
+              subdomains = {
+                _acme-challenge.CNAME = [ (cname "_acme-challenge.${name}.internal.noratrieb-acme-delegate.dev.") ];
+              };
+            };
+          }) [ "immich" "paperless" "home-assistant" ]);
 
         # --- other verification
         _discord.TXT = [ "dh=e0f7e99c70c4ce17f7afcce3be8bfda9cd363843" ];

nix/modules/home-assistant/default.nix

@@ -0,0 +1,28 @@
+{ config, ... }: {
+  services.home-assistant = {
+    enable = true;
+    extraComponents = [
+      # Recommended for fast zlib compression
+      # https://www.home-assistant.io/integrations/isal
+      "isal"
+      "fronius"
+      "integration"
+    ];
+    config = {
+      default_config = { };
+      http = {
+        use_x_forwarded_for = true;
+        trusted_proxies = [ "::1" ];
+      };
+    };
+  };
+
+  services.caddy.virtualHosts."home-assistant.internal.noratrieb.dev" = {
+    extraConfig = ''
+      tls {
+        dns_challenge_override_domain "_acme-challenge.home-assistant.internal.noratrieb-acme-delegate.dev"
+      }
+      reverse_proxy * localhost:${builtins.toString config.services.home-assistant.config.http.server_port}
+    '';
+  };
+}

nix/modules/immich/default.nix

@@ -13,7 +13,6 @@
     environment = {
       IMMICH_TELEMETRY_INCLUDE = "all";
     };
-    openFirewall = true;
   };
 
   services.postgresql = {
@@ -30,5 +29,14 @@
     '';
   };
 
+  services.caddy.virtualHosts."immich.internal.noratrieb.dev" = {
+    extraConfig = ''
+      tls {
+        dns_challenge_override_domain "_acme-challenge.immich.internal.noratrieb-acme-delegate.dev"
+      }
+      reverse_proxy * localhost:${builtins.toString config.services.immich.port}
+    '';
+  };
+
   networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8081 8082 ];
 }

nix/modules/paperless/default.nix

@@ -12,6 +12,7 @@ let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
       PAPERLESS_TIME_ZONE = "Europe/Zurich";
       PAPERLESS_ADMIN_USER = "nora";
       PAPERLESS_OCR_LANGUAGE = "deu+eng";
+      PAPERLESS_URL = "https://paperless.internal.noratrieb.dev";
     };
     exporter = {
       enable = true;
@@ -20,5 +21,12 @@ let nasDir = "/mnt/nas/HEY/_Nora/paperless"; in {
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ 8010 ];
+  services.caddy.virtualHosts."paperless.internal.noratrieb.dev" = {
+    extraConfig = ''
+      tls {
+        dns_challenge_override_domain "_acme-challenge.paperless.internal.noratrieb-acme-delegate.dev"
+      }
+      reverse_proxy * localhost:${builtins.toString config.services.paperless.port}
+    '';
+  };
 }

nix/secrets/docker_registry_password.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg 0u8KWoP0daJZA97H5KkNCSn839ObF87VYU4AChP2XVw
+-> ssh-ed25519 qM6TYg UVJ4EkIz+aHGJHW/UWVOod/NSUrmLL4pNvK60KPWxzE
-PqtYdZR3xokf7iIQ9khrz2pt7n6FipWn5y3bmzDfdEM
+pQ3h/qZ8XfwCqb2QshUxuLs6F+YddX2QSp8MLQnxBR0
---- 3tTg1eoL9exHUTtn3Uww7xWecgmzf5EyyQEZ//Bbjic
+--- gox0jFVFKNb46LsZ/aOEpkxCWnx8sTe7Rvv+tdzkvq8
-’|˜H¦ôLXñ
Zºõ'v2"ÕóÈ<‘K#9ÿ$TÔûÇ	Ó_Ì«
æ}^aoÜ4¤
+Â×iB<69><'+ŒÌ½Å˨¸L‘Ydî6cÛ6B‹gé]UGôŠƒ»N€¥cª]4Y<

nix/secrets/forgejo_s3_key_secret.age

@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg z5yLpu5zJ9m7Ukl3nEHZND8Ot2cYnADJidYjELzfr0k
+-> ssh-ed25519 qM6TYg nMMawatvWfcdHyOTJu5UBTCZbB8MDbvdd5XaSCR9ARQ
-qy1n6TSeWniRFXLc1Zkpvz1+pmjFaMga0BeSE1q6RSk
+iUI0FSTyjhx0xdfUn3ikxR3dcW8GQH1Flu2kwlkP1HA
---- fe6vqb3f0bRvXlQG4JglZ0h/At5kUPIM+VkRh91BCtY
+--- Fb7A45fAQY9VJN6Er23jTuEMvm5eDHJflTiiNFB4dYs
-†Ã"Ô.O†ë
J‰±º7ÄçªÝ6ÛàÜ~Ô¥SõñHÈø»ó-’4¡0’ýÍ[vA¶D‡ÐÜ=‰´²^T°ýy"@A¤‰@÷,§¼ÝáéüPÛÝ|¶q!ØŠM
+Û.Ÿ)!<21>$Y­QÊÏŽ$ß9i3—3b_z
+©ÒTR˲qîhs|[®í¯óF(´m‰â¦I®Ž‰q1z÷^&÷&	'Á‹(¨g×<67>6<EFBFBD>’FÕ¾Š^.¸j]®­DÉi
M5ýq<C3BD>

nix/secrets/garage_secrets.age

@@ -1,13 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg jJSJ3eWbmwKqaqaH0nCAfJh6zG0wQ8NHYLch6MjVFiM
+-> ssh-ed25519 qM6TYg GE45kAK/hBIkfDcJ9T5KSf2ZlRuznfyCXNgyiROKSho
-nzMK9xuag1meleJVM6aNGK3Uj+LDiklWtAbEsEVaZrE
+07IiEZYSR+BoaHsNOMfpTB7KvFI5erLqiLkxHeghNA0
--> ssh-ed25519 91VHug lgN/V9/OYL6qvoDo54bMwkRjgJx72ER4rwCyBLE7JBI
+-> ssh-ed25519 91VHug I5YszjRHyHEIPSO9ATRx/hgSiBnq6CmQeCiEWyThKQY
-KyqOc40/5iNubbk3vuF6e5qypscUNWGXSO+TvnE60Ug
+6cyqqeR7jyvWCC3yfxqVk9YtjhR8LmUISxoScoAl0Ac
--> ssh-ed25519 XzACZQ MH28c1eBXCHnnmWeEiKbB7qnqIWb11ciYZopRwK1lzw
+-> ssh-ed25519 XzACZQ qqZvo9xbK4rQRDzCsyKD0NVYhk3960UW5FRfavIoI24
-kHr78ot/c9JS7L+uWk5XhCwZ8y41cEkCfjiv5ITHXpI
+AjsMDfEzmGMCGekIAHPXkN2RRZHC4ZjACo3cNGx/iqc
--> ssh-ed25519 51bcvA JbXk+iiHx+TkrosjfP28iGjQQ3lNFlo6L7ebmOmOJzs
+-> ssh-ed25519 51bcvA mvDGI9jBis304qlduEX3kDb2Y5E2fiNL70i110hdDUo
-KQH6qVfm+48U6TzaomwPQJP3Xs8JCX1JDuVNu6+djUM
+OJl67yJ26ZZVLgobEbh63J9kku+whdmgawpPrlyAgFs
--> ssh-ed25519 vT7ExA W/tG8Jk982TcvMP+ZVY1Jgtk/0ykGlKT471OloV68G8
+-> ssh-ed25519 vT7ExA NgHlD7tjMUF2kIeMmHyE/qsZI9VzIkg4drUCDj0GABs
-9/ieFx+uf+zLUKfWtIYUiEyHHkwYLOhX8FtZP6oup/Y
+kxwMjB9CBd5IRlh2SBHIQJSjCjARLMwOg40DSdbDO3k
---- Nr1pkXNHv0+lBg4J3QnK4f5kM3ZOWjwTCwjUYNMRABk
+--- hzXf515cyiJHjcIAg+kmCeZ4Hy2GI/b21F5O+Pq7r5A
-é•UsIó	lNdLðÀò¥Ð^üÉÉq/P•D\Úé˜î%µÞýs4¡GCÌþϺքag¼¢÷¡|-ˆfŸ+,‹è²|vpj…]à„.ŽL“Êö=Œ¦ù<C2A6>UÊßä‹À_?§bG&Ywëí¨ò|f~4qRšõ*¢Lx¦$Ú‹³Y–P­rEÿáÁÕN,˜jW¦Ž„zÉà«#KÉò@̧ó·#7¶"&™Îž=®äGx ÷N¦.„n‰O7ôc}fczT
+§=ä)€BTÁÖ¢ È(¯_±_ÃÛ
È2ì{¡EÇãdõÚι¥±	wŒMSÛVs9TÈj_+˜q¸¦}‹™îføñ5Ä1ôÞ¿Ý^Ú>Q¹Fìg¿^Qvn²ZœÍ”dŽÎ˜ïõl=ÛåYȬ»Ù¾\!ëFú4v±ßt´÷ ­h·˜à!•AÿmÌ%'‘šnìר<W‚wiºghmÚ¬À/'í»á‚·¡¨Y|ACºÎ÷¨`zXŠ–£×»-µ3Œ

nix/secrets/generic_backup_password.age

@@ -1,13 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg WSRKNimMa2qdIrTxZIsnybHi+gzOweCGmCx2D3DPciU
+-> ssh-ed25519 qM6TYg NaiDsYFYQAZuJinDZ60OiPEZMsnmPOggyW/lKwLPWR0
-e6MO1QIL5FI0ATaR8hBUeE2ayLoyP4P7d5eO7liMBHg
+vLZKSA9iaFIdOjE7K9n7vtlF8UKCS+AKuSS3O8jlfbw
--> ssh-ed25519 91VHug JZjoc5tcVSQjIpbVGVca4P2s80Rb7NTIEKPhlXx9wQ4
+-> ssh-ed25519 91VHug O5htAKX31xr2plcilbKy/AZ0xtyIDekjtr6GYeIXcns
-QWqufjXwphL4Kes5Ky2tWozdusA5AJwqgzT5JWCQbvQ
+aK43EBfhqDCEtkB/1RephM7PK0tB0xHjS+GIDTFw2A8
--> ssh-ed25519 XzACZQ ek1dpX4Lqf6hd13B0dX06tTTmNRhZswxV3W1gBLKkXk
+-> ssh-ed25519 XzACZQ NRs3M2HrY9vZ94a+MccGZisn/cEyY9lg6l/ZiOaECgY
-LQMnAxrr3ZfUc3Brn39BzIdyBe8Jma8LSML+eaBuKJE
+aZ84NrESzU+yhsxXk+XiHEFJ+5/8B5wmFZVhPU5K8p4
--> ssh-ed25519 51bcvA zA9GHEGOXETl9zX0yoHHB9B5On06KlEcYRba8eKGKEo
+-> ssh-ed25519 51bcvA 74NdYVJKbbDBuhxqUUAgx4GpGbKFzL0/+KRXJKoxh0M
-yPTcsFhDLiSLpWoZX0b7dNzZmBaLTUY8PSMVFCUzlRA
+nXjmvzBfiq5Y7EUeUM5aoEColQa80JUCMwaLX36Scss
--> ssh-ed25519 vT7ExA N7U+hiTEzwKvglQ0At36e/p0TTA7xVRb7UvuX/4Bbjs
+-> ssh-ed25519 vT7ExA buG7ZHfGrdKqobgouN2DHkOointeeSo3LbQ5TbXxMT4
-acP9zBODifOsHVmM7COfBX+tkxZIPnQCUR0TskHacQ8
+v+CfO/1CDfu2d/Oy7LX1S/tPa25zaY6rWafpQB+yzdo
---- tOLU9ascA2rI4R0oIg/0vsn2dEC1LBLFN6TFRcyrcvI
+--- 1urbgjL5IrFAQbt9FPGt+Hv5hJ99uiFaC3K3G4X5JSQ
-{ÏÄ‘<C384>‹q.忳U×ÙŽcO¹Å)¨ì|Â¥ü,+^]¥Ÿë?­©PÄ»$3mº4©Ç¦|…cõø)ó.R6@r‘]ˆ½´
+?
+A€>•$-ťÉ>6<>ÁŘń<1F>ŇîÁǵÂÂ蝠ܬČ>/RZsŤYĹÉ®4Ă5ŁŃşR}ň<1B>a§9SŚXwŔúíËR9¨

nix/secrets/grafana_admin_password.age

@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 XzACZQ jIs+NClvISjvJSkJlkkGX5ZJzFge/1Nj2Wi4en/viRw
+-> ssh-ed25519 XzACZQ io2AGztJepz/HVtDyyO5pplYumC+Ym95zUvjvzz3Twc
-H1sfzg7cCWmCVg9GpFF5QNVVJjllxbmt7wBETRfM8hw
+mmJtTOkG/7HnUVKmpEMhRER1WhCbPMqsS09d3V76qr8
---- hOo2vi9EjLwAa8PQzJGdzUZ/VIzfhM7TnPsQ+OYJzcY
+--- yquBIN4NRMcxCzpDb2N1MTf3d4S0riWumE+fVIkwx8U
-%¾f>8ëá¤ÅÃðÐÀuwª[	žl*´V(u”2‘ó)e&•äú’XÎ)
+¡Ç½Å»t^zñçΪ#t8Ûé<C39B>	#UÛ&ÌB#<23>åpÜ<70>9ÉNoóŠR³ÎÿO¤´Ù¥']—ÝϤ÷¼¨ÊÅ9Äà·~EeFÒºc¯I<C2AF>ŒåËÄd5<64>,ü]”	]<5D>k¸Óõâ‰r<E280B0>
-ƼåQÑ"ÂX|iOÕôÓ,'Û<16>;æä<C3A6>ItʽoÚZËÕ<C38B>kÕàÓE)ÐÉIÈ —0v/»ë?

nix/secrets/hugochat_db_password.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg o9FlX/G7SotMq0hWJWsBnutiOuMu9pX6iY7w6xODUQA
+-> ssh-ed25519 qM6TYg kzaYC7OTJ7pOil0/e+q6+MwCBhyCu+O8pkRt0LtuzVY
-Q/AZ3tKlwi5rEV8mQSQF/7uBxy0RVEzajdKZuVGLzvg
+9VM4lmMvJqaHB3WfzbzBfniO8oTHgUz1vZzK2c0TfTw
---- FujHNw9RfcGuMYfpj5C9hoWs5iYaj+x7tDqJ74lqVsg
+--- PPkKzcyL6DezZfRPUvIVjn2gjT5AFtYRbXhabPIIq/E
-ÉÂvP¥aŠ@¼®éQî<>³äR .›@,à@;þà{‚xtfçMsÔÇDFê#<23>u#,oä!$C5Сk«J<C2AB>¯–ÕOƒæbÈÒ®ÍÈ<i¡ wOÍeã^b6¯	f‡ö`?†òŠs¢
åóÊ•ahm­†Ç`<>_k1<6B>Ä><3E>0î$
kÆ⬑7; ííM
†ïAˆðÔÓ<C394>ê¦5¤
+Üÿ"Ýu5ús£îxõ[Ün³‘(<28>£Ù+çyGc㦂ÂÄÉÖ=}´ž:Ä#ëõg@L7è¤P¢"7ê"ñ/¾¶ÜÛVÄ¥àJ¦=èõÖKÖÀðF6ª<02>ÿÜlÃß6!ä"øá¡‹ÏXî">Íý?‘¡•m)Ëv>†úhC'WˆëàKG*ïb‹õi£™=ÓßR?sKÝ1jÏòUw

nix/secrets/immich_secrets.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 yMKb8Q szKG8gw88EAiUx26fzY/pYMVb7Vb91FZC1FEQTYRZDY
+-> ssh-ed25519 yMKb8Q ttfca/hqpWJm9dRJYWBXj9Of1rdWg2NbgfsAJFMUQTY
-0jBl8757lsXnxWE90iZLJcO5VUXz+E2+7m/ZfNq87J0
+qokH5RFlOmZMETgkqlWhcx41EtXtN2IxKpvP/WGz6mk
---- huOResyzGVCip/Sdoyvid3TxFI01wiXNaHdZ/oGI5Zg
+--- vn3HoHqGBa02fSSeO8LGjhGb/7JK/tN/0Zh1Pjz25dY
-*c‘ÚlH¢àxôAhã5H(d‘çŸUé'ònÒ˜;M.Vx}‘À•"Öf· ø«§³9Š¼fß~JvÍ9–
+]?møÌõ±D“C:gà‹_klU×G¼¦ð¶Qù•ÈçJ+‹°g3àuê9FH"ìöÙ'g¨êáé‹d‡¡è߃

nix/secrets/knot_dns_acme_dns_01_key_config.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 LZU5Eg REfGT+ZHVlXvO+6s9AgIGQCBS+AQYfAG012IfRipJhQ
+V/O4nPGoAOpB/4DyBWuEV/GxoRJ7hdgVomIQwcxnSdg
+-> ssh-ed25519 5bWSnQ vFGAKwm8eJ/Fqv+LxLo+1mnzg4ht1BLTA7zdJuWdlnI
+Lhh3d9dWKyRcVTKeMOJb/cVzwnnqrBYNE0ijDgAxut0
+--- Du4x4K3KsDMktwzmEMiFRxGXq63eP5x9CBowtGJWM+w
+‹1÷{$Ôeü’9î»b”Âð`ëê+gÖüpœƒÆîÉD¥åx<1B>hK*/­Zå~eAÔ¥æHö}lÖÝÐ0¾ý”ÎŒ««sì»Z…tî<74>ÁÚ¸ßÐ:!¼µ®kçjÅ!Iœ_×y«Ià[eÀûê<>é§FØéGˆ»Žî<C5BD>¨Cbûð¼xÜ’ì›Ê

nix/secrets/knot_dns_acme_dns_01_key_envvar.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 vT7ExA UhRU412YTV9dkMkINM4xDQvQqwosWzIRGap+NxS7MFQ
+FUlsU461cxI+2befwB1v3ygyYAeTwfpJft/EX7eCGCo
+-> ssh-ed25519 yMKb8Q 2kpI3iQwInOH+TYnbvuyKyksGD9Q8UthqF1eBG5I+0g
+Si5Q1xNovm8hBmSfHx6l4PsiFU/cPa52rLw8OAGWQl0
+--- PO+gCtXKMloPmRAplw/pOAVPDHqh5PwzrQqrzSPN5Ng
+_W÷ÿî[ƒ<>VNÅJÚÓ1×ÚÛD-ºž±:…ᔆ|Vžz¢ñlñÿŠS¢vÝ*{´žGø9V"òøºóŽ_ÊîG˜r¡öS\‘cÄ?sõ±Å&ê°¶öSöä	

nix/secrets/openolat_db_password.age

@@ -1,7 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg anB4Ljud6na0zsnFkNjgBcicE6kFUg0y2xTlohEUggI
+-> ssh-ed25519 qM6TYg 8JOs+ohdkwfpHfDO7hq07sJ8IGny1yupoCy5ucro2n4
-gUTv83/Mktm8CyXdKEf1eu7NpWJd/hmiGzKs91WyPCc
+2TWbFpYjg6k6fBgGmAhNQQ1hBd6k04wu9gcKD2iF/ZY
---- zxoGip/R/tIH30MATCWht9P9oUxU//L/jnf6T/DwKEI
+--- GO7BMFQgRi6aBsnhc64kRcslMo4ziPFbrFVgzubQ5Ww
-UĎÍŚ5ś¦f—śqˇ{¤ĂÎ!„ł´%ĺZóŔEŠűó;í¦
+K°Ú&<26>1ÌÌ=c0Ù^$ÏLr‰«üÈó§0òG}‘è¡S5˜´Ç/òjµ
-xČ»é‰vËn´’k†Ź ŤľtéÄP\-ť1PŰşŔB}gMn{3ĄÄňo<C588>ąż *]łÚ¦Ä0<C384>—zŐU5Č2Ůß<C5AE>±Ęý@yär®UţgAé ŕ-4ă¬Ń)Fĺ
+é	¯¢Ì6S¶1D×%¨ù³»%Q]”|‡!‚oqÜÏ<C39C>YÅíÚ§TÜÄlÂSüèvÊE¢BèdÊ Õ®H® —ãŒ(Í 9ö4RáG°MAð<SZñš¯ìK,JÛÐ{
-Ć>"­ČUĄb‚

nix/secrets/secrets.nix

@@ -33,6 +33,8 @@ in
   "does_it_build_private_key.age".publicKeys = [ vps4 ];
   "immich_secrets.age".publicKeys = [ minipc ];
   "paperless_env.age".publicKeys = [ minipc ];
+  "knot_dns_acme_dns_01_key_config.age".publicKeys = [ dns1 dns2 ];
+  "knot_dns_acme_dns_01_key_envvar.age".publicKeys = [ vps5 minipc ];
   "wg_private_dns1.age".publicKeys = [ dns1 ];
   "wg_private_dns2.age".publicKeys = [ dns2 ];
   "wg_private_vps1.age".publicKeys = [ vps1 ];

nix/secrets/wg_private_dns1.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 LZU5Eg OKL541Y7HQSCBtUqWQVdIxZK9HiWeaPyAWwkcj/bsgs
+-> ssh-ed25519 LZU5Eg 8zZFvGVb6VIefxLJERJ16VqhKczWW2tcUEdSU4dIsC4
-PviTqNl4VLbQtErGDpXFEJSeRf59Mx0v3qcznEZ1tTo
+5k+Qpn+ZloytTx4DhcgT3Il5lBlXIuNmwMvNKC1hvNY
---- yRq8T7TGu/yBKFx2r+t8gbohrUHDkyXdvsB3n5csgpY
+--- rEDDdmvnau74yyYkVHKGx8kKi+Is/s/Ygt7PKfs4dv0
-kMõQl?N'!œñ¦.LlL¹±BoDæ§Y‹<59>ï¼:¯¹Ö_¹‚Vù“cèàžðtì¬ci= ã3ärKv¹<1D>MÛfîDuúÑ
+=@±_‘ýyçÿ\Åô<C385>Ô-*垣ªöF<ý¤KV^uíˆWCzZøl‰ª•}oo
©6äh"¡»EÿÜpÎòk#l••ÕaÊ°¡&

nix/secrets/wg_private_dns2.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 5bWSnQ KNg5E8fLL/rDMbRGQDujv/NaSUVGY/HmxFgIVK7vox4
+-> ssh-ed25519 5bWSnQ K+8u0rnGv8MsfaRy0eeZTwOsKsRcPixxnp1X7VR9cFk
-bH+Gywr/dDW3UPfQpLpWg9sVZq+LfE2aDs29chCpaDk
+U9MsbgO1w5x91uqRxLdD94VmbuAk/nqv8e/b9B8QP8E
---- mYTYZH2KoiKyxtfrxgIomqaaCyfnLVNwXkUzp+cDl7c
+--- LzVg9wCJGFUNvtRLqwzMBTWNcJRJoy6FgRq7g0IQ7M8
-ç«Q}ðBö¿.Š$bðŽqú¸ {4ù;5-;†²3ôJybleú÷ÌžÜdÞo¾³#i‡(ý{ï²Jè­<C3A8>–¾­ÒyÇ•<>>˨]Ô
+i	ﾒ<><EFBE92>!､貔8ｿｷﾆｴ+Hﾎｱｸ矛#:?v!飃
ﾆN'Aa%ｾ.ﾛY-N0S㍼<53>^ﾓqIsﾜ轗lｶｾ}･擇."ﾖ

nix/secrets/wg_private_minipc.age

@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 yMKb8Q 8ESNEQZaTfjWl4qGZJV/GPN+tFozDmiZZtXCctRD8yE
+-> ssh-ed25519 yMKb8Q OK8Z0x1tfsdGQo0Acqxj99IDVwfRRO4nHmtBuwDXpEo
-w2+Pjzmotz2X0O8ehb3TTOLk9YCk8hqRqNKfNNnLQIw
+FNfKD0EJ3FMQ8neRd5tNldCLp9Wk2K4/wlaEjKQPxPQ
---- pfmBROvSCK/41HS44uMmwU5izVCyHrRirYjL/WBAhZQ
+--- y32/fNgc6fz2cAr76vUej99Xu5DMcmO8bDQepK04TRM
-m í<>*QÀØv"­›<>¢+˜…JQ®ñÔÄ€ý'òPø´hD·¡>G’¹ð Jû]§
êÀÄ Ÿø‡×LÝ©¯ù¹¼	ÁN÷žÌ¤Û€
+Ñ£`'mo¡HK{O¿Ö-Ÿ¥¤—Ð<>yýlœÖ,X49 Ú
'+¶t÷¤r&OKñ^â®Öç
ßš>
+¿(°æ«GŸúð>æAç×n—

nix/secrets/wg_private_vps2.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 91VHug nuqwTTdoNOLWvbQAIhl9WguvArxG0jNfkFn3qM8VyjE
+-> ssh-ed25519 91VHug v7DD5jgO2eah7KvV9shAkyFRG1zce0kKKD6U/QBIzCk
-NvhMCreuxdWHezfH8cF4wXjO8ZbG7yQC8+sVnWFghFM
+hKwCVfnc/5wKEs2ow0etWhet/8+AT318LOnrEgTVEdw
---- OGewUdFWzL1PzHGBHB7ulJVi5eX6UXKLFUyfbvGErmY
+--- WWKcK5xf8FeUsA7atbz8r/ScBM857aXQA9mN9TdpRB8
-Ê‹Ì.\†—ŅدiÒ›ÎóÒ~`êQ–,¿§W;m´‚<C2B4>­pQóTY
TÅz?]¯£T-sÃ4)ÑZPý,6ŸH5bìÔ„7—ƒh
+Ђ¾Ó/ ?K!A>ü–9q¥mׂö¶ð,Ûl°Àþˆ÷^[pÄ»°!rûmMEÆýzÊ€“OÓ`„ÓãÞq>qý^cRòKí3Ã

nix/secrets/wg_private_vps5.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 vT7ExA 5Yp0GcAOQbgRlxiIBgDt2O5NK0zoEN3PdUQOFsKtSXc
+-> ssh-ed25519 vT7ExA 1SyRWnZNW7piWgD9AhV3evIk5qmlPZw3vtaYysYPKUo
-653+sJWsCeQpu6agZn85RU6GOrpMJY+TbzqRLbYvnaw
+vC2skZEXjrM2HgU6nhrzqZhwVtIZWrZyaVZwUp5PE5c
---- SYT84Omvncdv4tQYH7Put8sXqqA3LBR4/DuVyVCVbNg
+--- 46tHy1OYd8fqnjpLu+MVYrJyPaP6UdgubrsvhI7KO4A
-øöòv_Ab¿‹ÓL"fªÉR6<52>W<EFBFBD>›¡6Áhep¸¿¬–KÉêeðg–,EÑâà¨;`Šñ"ýG
xu¿þV<C3BE>í©B^ø+kíç6¾äç
+òÅJ¶·HJÍSívá}áù+	<17>‘¾jÐÇ/„Ô
ÄêÙMJ§’P“+~8Aé웧üf™^Û„Õlj˜K–AbHóó5·U"@

nix/secrets/widetom_bot_token.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg qE/RX7sfudkaWg+9A1jRP84PnGCC8f7y2Ai308kN+zg
+-> ssh-ed25519 qM6TYg p+Rts+QHTmO+vPpCHEp2LTAdPF8UMq0BqoN3rAPzCgM
-LnySP1Ywe33ECGtFx3Un0+QcxH/IscCHao49nbuEvm8
+g5RaqS2rCOdp8/vllNb3Revq+bfDdHQkwYKsnNRN97c
---- DYF2tyroJ1KnECqhUvzLyox9wULA/eEH5SdENW2fPVc
+--- Ws0i3nFuR6DNeO1RpdUvc3Irt4I3HuzBtPgxXsBaOvU
-)nˆCzL‚ËbŸ!šP[õò>jl(9Â<39>ÊÓèP@‡{îÂ÷½”;a#”B<E2809D>ÉÝq#0¡<30>+]óõ-‹µ–MÀ\5²‘{ÿƒ)‘laW–kù³RCE›tcÖ3¿²ë
+P¨ŒÚn_8ùPÿÆlJßìêÃP(<1A>lÊæ¾É*=V+QXù=ØR¸Ob±åf'l&çu‡UÑ=ºFßø«.†½î`sγ‰
·é_ø&<26>Â}šÎ¬-<Ï0€_-‚