feat: invoiceplane

hosts/default.nix

@@ -61,7 +61,6 @@
           ./pie
           self.nixosModules.yule
           self.nixosModules.docker
-          self.nixosModules.wireguard-client
         ];
       };
 

hosts/pie/backup.nix

@@ -0,0 +1,21 @@
+{
+  flake,
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+in {
+  age.secrets."rclone-pie.conf" = {
+    file = "${flake.self}/secrets/rclone-pie.conf";
+    path = "/root/.config/rclone/rclone.conf";
+    mode = "600";
+  };
+
+  age.secrets."restic-password.age" = {
+    file = "${flake.self}/secrets/restic-password.age";
+    mode = "600";
+  };
+}

hosts/pie/default.nix

@@ -4,6 +4,7 @@
     ./configuration.nix
 
     ./networking.nix
+    ./backup.nix
     ./wireguard.nix
     ./unbound.nix
     ./dhcpd.nix
@@ -11,5 +12,6 @@
     ./ddclient.nix
     ./paperless.nix
     ./firefly.nix
+    ./invoiceplane.nix
   ];
 }

hosts/pie/firefly.nix

@@ -106,17 +106,6 @@ in {
     "d '${backupDir}' 0700 root root - -"
   ];
 
-  age.secrets."rclone-pie.conf" = {
-    file = "${flake.self}/secrets/rclone-pie.conf";
-    path = "/root/.config/rclone/rclone.conf";
-    mode = "600";
-  };
-
-  age.secrets."restic-password.age" = {
-    file = "${flake.self}/secrets/restic-password.age";
-    mode = "600";
-  };
-
   services.restic.backups = {
     firefly = {
       paths = [

hosts/pie/invoiceplane.nix

@@ -0,0 +1,72 @@
+{
+  flake,
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+  backupDir = "/var/lib/invoiceplane/backup";
+in {
+  age.secrets."invoiceplane-db-password.age" = {
+    file = "${flake.self}/secrets/invoiceplane-db-password.age";
+    mode = "600";
+  };
+
+  age.secrets."invoiceplane-db-secrets.env" = {
+    file = "${flake.self}/secrets/invoiceplane-db-secrets.env";
+    mode = "600";
+  };
+
+  services.invoiceplane.sites."invoicing.b12f.io" = {
+    enable = true;
+
+    database = {
+      user = "invoiceplane";
+      name = "invoiceplane";
+      passwordFile = config.age.secrets."invoiceplane-db-password.age".path;
+      host = "localhost";
+      port = 5432;
+      createLocally = false;
+    };
+  };
+
+  virtualisation = {
+    oci-containers = {
+      backend = "docker";
+      containers."invoiceplane-db" = {
+        image = "postgres:16";
+        autoStart = true;
+        ports = [ "5432:5432" ];
+        volumes = [
+          "/var/lib/invoiceplane/db:/var/lib/postgresql/data"
+        ];
+        environmentFiles = [
+          config.age.secrets."invoiceplane-db-secrets.env".path
+        ];
+      };
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d '${backupDir}' 0700 root root - -"
+  ];
+
+  services.restic.backups = {
+    invoiceplane = {
+      paths = [
+        backupDir
+        "/var/lib/invoiceplane/invoicing.b12f.io"
+      ];
+      initialize = true;
+      passwordFile = config.age.secrets."restic-password.age".path;
+      # See https://www.hosting.de/blog/verschluesselte-backups-mit-rclone-und-restic-in-nextcloud/
+      repository = "rclone:cloud.pub.solar:/backups/InvoicePlane";
+      backupPrepareCommand = ''
+        ${pkgs.docker-client}/bin/docker exec -t invoiceplane-db pg_dumpall -c -U invoiceplane > "${backupDir}/postgres.sql"
+      '';
+      rcloneConfigFile = config.age.secrets."rclone-pie.conf".path;
+    };
+  };
+}

hosts/pie/networking.nix

@@ -38,14 +38,4 @@
       auto_https off
     '';
   };
-
-  age.secrets.wg-private-key.file = "${flake.self}/secrets/wg-private-pie.age";
-
-  pub-solar.wireguard-client = {
-    ownIPs = [
-      "10.0.1.2/32"
-      "fd00:acab:1312:acab:2::/128"
-    ];
-    wireguardPrivateKeyFile = "/run/agenix/wg-private-key";
-  };
 }

hosts/pie/unbound.nix

@@ -42,6 +42,7 @@
           "\"firefly.b12f.io. 10800 IN CNAME pie.b12f.io\""
           "\"firefly-importer.b12f.io. 10800 IN CNAME pie.b12f.io\""
           "\"paperless.b12f.io. 10800 IN CNAME pie.b12f.io\""
+          "\"invoicing.b12f.io. 10800 IN CNAME pie.b12f.io\""
 
           "\"fritz.box. 10800 IN A 192.168.178.1\""
           "\"fritz.box. 10800 IN AAAA fd00::3ea6:2fff:fe57:30b0\""

hosts/pie/wireguard.nix

@@ -18,8 +18,8 @@
     wg-server = {
       listenPort = 51898;
       address = [
-        "10.0.1.0/32"
-        "fd00:acab:1312:acab::/128"
+        "10.0.1.2/32"
+        "fd00:acab:1312:acab:2::/128"
       ];
       dns = [
         "10.0.1.2"
@@ -36,16 +36,6 @@
 
         #   persistentKeepalive = 25;
         # }
-        {
-          # pie client
-          publicKey = "hPTXEqQ2GYEywdPNdZBacwB9KKcoFZ/heClxnqmizyw=";
-          allowedIPs = [
-            "10.0.1.2/32"
-            "fd00:acab:1312:acab:2::/128"
-          ];
-
-          persistentKeepalive = 25;
-        }
         {
           # droppie
           publicKey = "qsnBMoj9Z16D8PJ5ummRtIfT5AiMpoF3SoOCo4sbyiw=";

modules/wireguard-client/default.nix

@@ -41,8 +41,8 @@ in {
             # pie-server
             publicKey = "8M/+y6AqbSsbK0JENkjRXqlRR56iiM/QRjGGtEM+Uj8=";
             allowedIPs = [
-              "10.0.1.0/32"
-              "fd00:acab:1312:acab:0::/128"
+              "10.0.1.2/32"
+              "fd00:acab:1312:acab:2::/128"
             ];
             endpoint = "[2a02:908:5b1:e3c0:3077:4e39:7763:2]:51898";
             persistentKeepalive = 25;

secrets/concourse-db-secrets.age

@@ -1,21 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 cakP9w t2qXuivxxedTQKATNuH2cGSxrErknPjOctX8sNnEagM
-VGYOtgWaGuTRLyyCQwz21n7pS/i0J2RkuEEcJitUmMs
--> ssh-rsa kFDS0A
-QCSiaQ+2MR9O7wxHjtQQ/8a8EGyLWl1jsn1jy6xofgrU6czdt9Fd1boCcj7WpWBJ
-A+kZQkTz+DJ8yUbxCzrKW5MNdDGtsxNJOv36LQXJ4sKpaXNdEODQ9qSjKPPf+Qlm
-/5m69OaAH0C+gVlU89vJEyOLt0VtOb8tGZn4aY0Fk5LTg0jY2xT2oRDk4JmOmXAY
-6t7EGaCKL9DBO+f3z908oPZrrkSs7eOdFA/zn4aKHHXVm/FsPoOuowV77ZcvqHL8
-1LrOwpk+W3odFhXHyBoBqcISocMMrkSseokZY6F0xLg9QurilPSbj6sqHBrFuLHe
-ko/Yu75OUh5PgZ2iomw7hIVonAlsMdS3IZd94Bci9UW2RslVE9Tk6b5Oz2/pRhkX
-Z4XrkmIbtu9LUeCkmGe5sSr3naf6gfJZhCxGkffG0Y3fKd/b3YKoBbpV8TRI5lwY
-HsZoSvbIzatLb0eZAI5VAOgAqi8NlnITotr42fepmqdh5DJR7MCRZr7wbP4qhqV5
-SCGdCom6k9dnC1n2c18urTAFOBghODhlKkfgy7P2dyhh8DdvKeYWq0NCXPnqJsD0
-/S2Zw8N19Ulpl+0BYuW/wbsB6qh34nZAX9sWs2SzMk9l8hOLihGWzxyqRUSz7HkR
-Vue5jSuYYjMS3MQ9jQebPsvDo9gq0sunJRVqJ/LumtU
--> k-grease TW
-Sg/AfKJutkGKk381valwbRhfpRizMW+kTtBX167zcSpRzV0nWLFVBrn6UvRywp1E
-Im8WzCCmPU+8RoSSHyrzEY/BpPxxY7Z2hsw020+efyWhqnRP
---- 5n2hSoQpkSsA0t2z0s4usP4UNfrbl0NCn4ni/Lc87lo
-:žÈ¬Q$¡š*þYüæ	šïqŒ¤®ä5R<Äw¾ÐÁùtF²ÐJ ¨Üž
.šË|àARôÅÉž€¥A¢ÆÊQ
-{w<<ÝÅnP‚Ù ú´<14>ž%QgÝL›Îi¸"ÇŒl+£"误À+òÌP›6d¯žédv·Å>PáæÖ…Øæ½í’<C3AD>þöˆ~ðð±

secrets/concourse-secrets.age

@@ -1,20 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 cakP9w vCHapAc5UgUayVXMX2LgJ1muOpZyzfiELlaoJMGJciY
-/nAmT53XZN7yiNi8iRppD/i/z+GZ35cdyAgoosN0kMI
--> ssh-rsa kFDS0A
-byBMA4F+/m4oE/Xz4eG5A00vaI1LRV+osye33/3B1pTaLD+WXbm4xbvu4N7S7nkm
-kn0HSBMlmgEN5pfxG3umKnZbXjv+tyoX4+ApVLJMyy5EHmWcB3jL+jiyF7KTs6pw
-Pz3nhNxmrrXEi6PIhHKFOMKsvsVUunKcBF7A0EIKjpMTa9e81QnOdh4Vks+5VCZo
-UWHYtM6ytY148oupsgT9xmVsZY8QToe8DShGgFooMt+jOpjaONeU409Joo7rSLfN
-hkXcxtufVpHe00klFJzf5Ac+YqTRRd2fU/uuaJN2IywDQVVjrhxntGOw2yA/u/yS
-rALPfLgn5Oeh0hE7B+YJ6X2OaQFnVOtZSDldSDfv7I/HPR9nDXVQKb48W0P1+l0G
-v88wTyqNTFcq+A6opIZMGoUjw9ocMSV2SCy4SfbHfKQm+6eInN/Vh1flrqVkHReX
-m9SsQ8Hz7N2PgCsES7W2yIDa5x3oFgfMSubRhtlcF7qCrAKBLxUKDl3AKaIaq1q+
-05E1aOtwYzw+LtMwVzTsg4pV6IJp0fPfU4ltev9fAhOl+4GXBCEKaHGxIpKKG6he
-0tVx1a9Ioi4RubHlNmTtgXBHm55V9oq+OUwzPqdyP3N7VIUlaPlKr4iV9LT5UFhe
-6krLYyXleTecm3Qaf+gveIMlE1bM57/jDZQZxLQkEmw
--> [j)5-grease &Q%
-eln3mXGqrVphVw
---- A80bpjrOaI/yIf4VgQLMUoGQqAliHYDixv/gvhXApDM
-#²ÅŒôxÙ›‚[;„™.O×2ÀHïîÁneÊS{ñ>˜"N¸D~:u!ûµJ<C2B5>t<EFBFBD>”(ºSÙ
ŽQ}ízóÆGgV |ÇÝÎ
ð±‰Ê’<>GÕ,<2C>/ñaS–ÕPÓCŠ‰Nîʘ£<CB9C>,‡¯Âñ=‰Ú•Nðüæ
»ãìÕéÁ<C3A9>ûÞ§É×ö@¤Ä›/–£ÏhÑ”u%·µƒd=퓸r—ƒ“ô_–ç+
·iÓ÷Ì»~ÊpY
³š"Ú¢çV½Åð{¸ÄsÄ#É<>íI~ª{°¥ß¬T#b¾x´&JýCÃSdÃ!ÀQB[†v‚§%Ar		ל«fnµ—t‰6¿0»ý
-¤ß@©µ[ã&NæYL<59>š‹• ÍÝÉOÿÆ+ˆRí

secrets/gitea-database-password.age

@@ -1,20 +0,0 @@
-age-encryption.org/v1
--> ssh-rsa kFDS0A
-j4vAJUTfwqSNwCxwbD8CQ1NCosHwl7WeWQ6yzJTVTS91GuBiPHy31sB4HsoLIvMS
-S6fqRaDWytvcQqGu1zrKISVER8nJBeprhaDV0wK4cmDPAgnkoPBOzp6ZEXGoEhM9
-pQBosLYGtInnCXVbdd2cWCaKLcmjMaItZzeC/xcjgAmkWOhbkt5DQbcxoplcPdJ3
-v4UGpVSylpO99Th3UyWQ0uQ66I2hkvipJaEbeXZakLdb5RWRDQAdjHQVThjxaNr6
-IzQ5dlIHPbH1fUSkj7vC5RyTbJC9o2MaiO4TnrMrwqfmrN18KvmtrzIsaeH6695B
-2hwpaQzJRt/eM9aWX29eRGzaaZPKpajhNlZO6ADGDnBtLrlFRsGDkxdaSVCknZce
-e7xo/MHtjs6HrITUSkrclP9uiNrsgz9lUd0j6bqZJMEsIAPlKXsckhoinr9pVxWG
-wHhwaYCFKh0JGO2x/LFwTfhiLWtUGWWbv24wU2nKXInQE2BNKz/kDNoVSKnXwxUF
-Y8FNR/SnLpYrVLvJozWGs5XaIDNmmnKspBzwA4T/uUttt/VsZkpDY1MC+M/l0SRv
-iEhzFiDcR8ZLqLOm40F1ZcuDjpMnc26Vw9MnJlU5drkC68UmSnhdtfwZrz8tIjM5
-AE2xrygSJIdcRBwXfr1WCpgT8fkXmloumGbeAeC7MGs
--> ssh-ed25519 cakP9w u0fC9unKSlgCaf8LeexabNZHN5TiE7Ji9edwTAY2hy0
-R47comlzrdTwh5/HyYcJWnbaJXz5Gyiyl5grPhWA4FE
--> {SpZO^-grease V[ P=
-oCMLf3Ix+ganP4GNp1mFZvfeJPp5ohdIyR8ZWUstJAmxJ8uja6MHc0JOjnWfGvtW
-k4oWmmkOrRx6
---- PMDSGvBkvUV+g/tYN3n93q7ikX3vwsd9yvHi1PvNjjg
--7–pŒl?PÅM®PØåªø€:ÃËB}m3&Ö]ma1¸«¥O-ç$íéNÓ!7gÏÜL|¡±w¡=LÙ5‡¤ò

secrets/hdd_keyfile-chocolatebar.bin

@@ -1,29 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 2Ca8Kg 6ZDp2RUA4DdKz998FYnZ7EyJiPuMbhlcK0DkMMYwJWY
-TLsOG+IiF8nS6s8c9MoW8jH63KYWptvvOmNMQAVH108
--> ssh-rsa 2ggJWw
-K5MQz9CwjmeAqYW3MrL6XuNF2j9jiogH024sRuIhZLOd++PYbuGJGHc7RNhB7+vg
-ilFPUmaLCZ9nO6mWTFOngRLtNPxy/sRYTLxhflqtiJYaj2GSfpf4zIQQirgYgZtx
-Ry05gAjcSObDL7DuocEGPe+Ih6I3t9gwccD2JS9yN1ZR4G5THdn3Nf6jSAaPdMcM
-3zQ6A0KTCxFLR7ZywRoA+YSjQ4nXRA7xfenUO1aD5OcXchrqQl8UVkGT7RiXg4b6
-8kbYHcUbU19uvMx5EVLjviW+qikPsQo0Q5P4i68R1XUU/8lxtF3U/QSkwxCu5u+I
-ecf+o9FJ2QGdvQyGZsW13Uhr5poYy74C3Hr/lAy9cACovqF/JQgPqiVPbBK5UGzq
-PZgqMrWjUmWepWi21izvJ1Z9B7o4403ctDY4sy/2mEAYI3TlCArftvpd1ZrUDmUB
-Td1XpsmsRSRHog0DzMIgbD7gjUwFndzU5rCVN0ZvQNoosfp7/OU4ZTRxa9j0L2aQ
-
--> ssh-rsa kFDS0A
-iKhylMF00idQgLKJulEk8AUg3VSO/C5/YLNF1p+BqCQI+0pTOU7rbmdq+bRrnUPR
-3JYZ6/eZIXOqu0zCpOIep5RHd/g9uj59hHbOTaRAMDVj8gql1lqyoFUBNOFn0Fhg
-Fiw3NG2FO+exNcFB/WjpQHOeTGsROBwEi33ngTp9Vvpp9BP4tI+uyXk7EyrAuU34
-kOrJocg6ak8Cm3FfZVuIZz/md7vdXW3/ZNpbwg2/e4iXXZR2tkdG3ILtbvVfz5OD
-Uh0RYINKddWoOn2mnyslLMtUrAsl1b5h0ZOf9GGS2lI7oX8hgioZeuExqLRzlg0T
-wpynZ9TAonIosDFmjBo5DWiR4RuZB8zoZpc06hIYcms87EDiRQsm4eECALzcLRfq
-deJfedxKcS2WwOx0P0Tm/orDoVSiQ9MhQ6NGGHmJxiDZn78860YRFZM5Zhv6KmGA
-nnbROo4qpOYXNky8snIKGAhglpqeRDFjYHm9j9H3m53dQhDh5/4igg6z8OC6YbHK
-1DVkq7YHB3xtnzoRk+HQ2L8GiNHA9euYrHaxg6nV1Gz9JUDvxkG03/Rf3cUjGU3y
-LOW0XxgOh994UFeBa5sXoqifMc6TOPDaKWuGqAHbqyh4Y5g23fUXZK5MBUG+yK9Y
-NOGwcQKWm1WjZDRRNQY/weQ9zo4Lbqw0OkDRWqyXYO0
--> eSA$EYI-grease
-eQ098pSqXxOODV534fR6EKutD6yohQ
---- a6fIF8Msqg+2ROcLMY4Ziypjg70cpfQzs38YK+Ae7xU
-k9“!¤þGf6(FœbÙ
…|ßp	j~Îô’a’Qò¯Ô ¹8é^3LMäRS]Þ°çÕ„`„ùÉV¹*HÒÐASäæx£§Ë;9

secrets/invoiceplane-db-password.age

@@ -0,0 +1,20 @@
+age-encryption.org/v1
+-> ssh-ed25519 8bHz7g SPo9Mhd6VsgIsbMyeZvLID6JY8tEe7t1bliDQvVo3jA
+GI/7fHbAOqZAKnKknpQ1fQY3j4yiakotvNCZyhsEe68
+-> ssh-rsa kFDS0A
+c5EED+7gs9TBd9c1S7OBMSsh63sgSe54W2IsVBlyYTsEsQc5YBFCIr9F1G+DAMv+
+u4JipemAcIGIRcoJPgqZvmOt0KzcckECb3n0G7veEqlHQSlDvu80NMfJgJ30Nx1v
+VlWPjAa3yVeuHWnu00ANFmwBNIJVxpFoYXI7kXP8NtRhs87Gdy01HybQgJNH31C3
+f/d0Htg7HlCsYIEYV86mSdWqFXen79RNBCnvVDz3M6YAxdxviFEYRXax3IuWpnSc
+zr76gVhvAuBcxIP4qqjRZnmfXOoxAsCC3y1CVphfYPcXka4/u8wgavzxFBs/vskv
+UBXp4WA1+HheCYu6K5CXsBs4AW1fVKg3U0wmyeXR0NdYrjNKsEkDdE5GbjUi68pA
+SAGZS15tMZtm+80OSxxVbbg2xcnkQXHXRAk6G5CIaQkc3DqgRX4niM36lFmUsULc
+KardwxAR0VaAXxzi18Mbm9dRpsktnGKrEGXSi40DfzG4Mrf+woyYHD7HRXpV7kVY
+PeHBNflYZEJW7mI6Y8lMF6INYY4Y+3SIJBMg5wapmOWIue8Pj22iHWD1CbSa+YUL
+GDF4TBEqXdiN5TaGuAj3B/IQ8dKF+pohglMqK/xBmAQ8Q7yF+Kyc0C7hMwOcc07Y
+NrfQkEhbgDLNOE61oI5je1hseu1/J/BDpfcuv82r2so
+-> 0UI(-grease
+hLbbDjER9olivUGkGNf0GX1UilyxtFkJPVbaHhPlBsbri9zM1tuHhPpNwU9FaTJY
+BrA5N7Db1TK0
+--- Z8g9OM5TylMaIexeEoVzfHiYyRMguw4Kb6K7zdd+m4w
+Þ—ð}ZÉ® ›çYA~'¢õ%+º”„7èÙ¯5ê¿»¼‰I	]Iæ’)*ü½¸KóTÁÂÙ<C382>‹²iíì—an+ü

secrets/invoiceplane-db-secrets.env

@@ -0,0 +1,21 @@
+age-encryption.org/v1
+-> ssh-ed25519 8bHz7g SyDLj5IaAnxA41QMsYkxKwtXHopZCo16PDDn0dNobFA
+xJ9jKhQK/+wKpm1vW264bz9YIy/Onf+r8yzC7jqRRF4
+-> ssh-rsa kFDS0A
+f2tjGApTzNg5LHwsZidoEmjlwetKetYHg8U2REpYp3P/GN8q6SrH6bpJt11lWE1V
+nLLm2UIAALBLuQEP12QvFS2lDgAOkHw7BvERE9nbDxMAtFp0HPOrfpMxnG/j4WE/
+GFKjYRvW5rBdvTyx6kGM12NlZW68ewtI+ph4Vv0sjlHFszDGRtosBkiSfMzLrZJ7
+sCKcb0bwihUbw956is+kKhnXbboyy36MgjnlFqOguklYk4CjvXCHlarIqr1sEBns
+MDxo4aXmDE/Kb9JXUAZk56ZF1pmw9CjtS2mSFLq2tBQsnACMDpNFthDN/gwl/ZDS
+kGr405Mc7Br94CSJ9TDFkuEr/g5/diZ47zJ6n73fgcR+77JB82ocqEjx7I4HOoCa
+jNOdIsKuAeqIj3hzTOaUzEfirbcj/aMfJAsODD+LAbO+udjkAgqr4SomjF9y4gGl
+4ACP0gFXJH5p3npOHRbpeo5Nog/zuhq615KvVlUlxJXJAQ2knlGsmTANp+BTA9GP
+X9Et4fVYyha99OVaOetdmwPQhNm6oWnE1f3ED/QkhL07RSqEnPMuS5puvEqZCtCM
+QoOu6sLntglEC2anyUg3eTJRKLTSPDL5hBPrjc/Vdh0vOUlxBsyjrcirOmuZjz7u
+U37u9d8Wor525KVhA0iPkoSbUQAdeWani15FpubAqug
+-> 'elxj-grease KCo\\D8X C1H.0GuO c
+UIh2br84y8h251JEQT/5wo1I4jzfLLZ3Jk/ZI0oq+yGnklm04GpV
+--- 3UVm82Ege5uZklcawiAStvmg44HE7Pc4lxQG+eIr2lY
+¾R•@[cw:lZŠï?Ïa­ß6‘eÞÐõ¸>4=
+[
+€Âö–NŽ=ç[t žÁÅ_÷wuh8yÙ(ãÜš’ü?5ød‰/‘WicÿlÅ<6C>˜<EFBFBD>ùt›«Õ'˼C5ïÑ"‘ÙŠ¯A$>Gn/÷Ú,&„U”°‰ÌŒ+2°o5×0×pßïè¿3

secrets/keycloak-database-password.age

@@ -1,20 +0,0 @@
-age-encryption.org/v1
--> ssh-rsa kFDS0A
-DWQcu9+8Tt6PbnhhtjaEh4JwKckPzGp8T886OitKmT36ONeX1xm4rxUV1BlZJESH
-bBUorgCjlVeNadhrvMH6f79iq84Itz3wFsRn3wtXTHPjyOjXKq3mBFCZchkNQXrQ
-kAlHVSU4KxArWdDgxZlSDDjqVKUO2otOax0jQIrATyoyXxydv3IrY+I/QJNXyMVV
-TWWur2MjLfRtXf8pKhKHhZMGthOtnYRYJplR638hw4TQ0j4/7J34qcZZgNoo4pUY
-FHO1xLqxdRzMiE5Kn7drhJ667QeEANZUr1sPjejXahMx/oYatpZ7YxDk2l8P4bcO
-qAiQ5Z3h1wfhfhHJWLCXac9jBifZeMXXsi43lB7/A+8OCPPZbJam6ng9Nqi6q52S
-nCwY54c50mDp1iS8b8coBnVqr4JPA+mipy31KGmbysxjKRV7SovYuPq6xzGzL9gO
-nAxpvwGuPShuKQMQ373u0NL5Fx3gnSwBpDax9Q8ZIvkn/iGIjntQj8IaDDXUtOUg
-6r3wQD8m8C54q8hdOeb8dvDTb8YkXJGumikOwx04KhhX/MJbIMpwSmhZGHdCY44v
-qhTQcnudnPUskTZsenY4pw9LOdzuVeLqGL2359qvw8w8KTNtZfeif0xCpWBKMOw8
-F3wdYRaowGp0Hqi1wb+mKtiz4Tyx93crkflrpxs5hT8
--> ssh-ed25519 cakP9w m4+f1g38ZLRWqO1eKOSnu/0wJ+ou4j/4VgR8IJhh9Bc
-1MkqVLAk5hZyyvjVSU7ScIitGkIiQlCl7oxJCBw7xmE
--> Bp=k^MJA-grease
-iP4iWQsV1F2QEiShf0j9AhCUq+SXOxQ
---- d1wE82sM45YxhJkxchil/8TFhZMjyDVSySvgS6BQCck
-dV¿­ÏQ“rJ8¿ýörøg(¤âì‡
-êiàŽfï6O¸#ßãõWj,ÌÛdq—<xŸòOÑŒ^}-p9<70>`B

secrets/secrets.nix

@@ -35,16 +35,11 @@ let
     pie-host
   ];
 in {
-  "keyfile-biolimo.bin".publicKeys = biolimoKeys ++ baseKeys;
-
-  "keyfile-chocolatebar.bin".publicKeys = chocolatebarKeys ++ baseKeys;
-  "crypto_keyfile-chocolatebar.bin".publicKeys = chocolatebarKeys ++ baseKeys;
-  "hdd_keyfile-chocolatebar.bin".publicKeys = chocolatebarKeys ++ baseKeys;
-
   "vnc-cert-chocolatebar.pem".publicKeys = chocolatebarKeys ++ baseKeys;
   "vnc-key-chocolatebar.pem".publicKeys = chocolatebarKeys ++ baseKeys;
 
   "dyndns.key".publicKeys = pieKeys ++ baseKeys;
+  "hosting.de-api.key".publicKeys = baseKeys;
 
   "droppie-ssh-root.key".publicKeys = droppieKeys ++ baseKeys;
 
@@ -56,16 +51,11 @@ in {
 
   "cat-test.ovpn".publicKeys = biolimoKeys ++ chocolatebarKeys ++ baseKeys;
 
-  "hosting.de-api.key".publicKeys = baseKeys;
-
   "firefly-secrets.env".publicKeys = pieKeys ++ baseKeys;
-
   "firefly-db-secrets.env".publicKeys = pieKeys ++ baseKeys;
-
   "firefly-importer-secrets.env".publicKeys = pieKeys ++ baseKeys;
 
   "rclone-pie.conf".publicKeys = pieKeys ++ baseKeys;
-
   "restic-password.age".publicKeys = pieKeys ++ baseKeys;
 
   "wg-private-chocolatebar.age".publicKeys = chocolatebarKeys ++ baseKeys;
@@ -73,4 +63,7 @@ in {
   "wg-private-pie.age".publicKeys = pieKeys ++ baseKeys;
   "wg-private-droppie.age".publicKeys = droppieKeys ++ baseKeys;
   "wg-private-pie-server.age".publicKeys = pieKeys ++ baseKeys;
+
+  "invoiceplane-db-password.age".publicKeys = pieKeys ++ baseKeys;
+  "invoiceplane-db-secrets.env".publicKeys = pieKeys ++ baseKeys;
 }

secrets/tsa_host_key.pub

@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDn6SYjNjHOjLP+U6Nv/6ISdvtBWKB/zXW0ATnDaN++jNs0QBAU6csa7anwG9txZKBuoJWqhNd+IQYXuLPj8dl/XARLrGj1rE256Royw6GU1dvwoBr2Ph1Odl9SwNdAUqnNoNYv6ub2vzaiAiFXrr2HkHj8eTK5EDWdT5FCl17IeHZDvVMBsEh7h+BGjNEetQXwML6LK+pgw0waqKXfIDN5y6Kj4XePYQ0besUQu+K/oLE5zQapdX7ThS7/Ky9diXywrCKnd6A/Ebly3chaQaf9qUmD7TUDaKZozUKjGIZvCq5JayxWL21wxvLBIM4ZbgVuJCv7wLCt+YiqeeGKh5ha1L42TX88KVa9dEoFvLKJO+A+6J8BaghPvMkWWx0uSVuxZ04aEGWg/+JDz8MbwOJtuJIxr2NtwPpgXuOvAGbJRq2xH1K/Hqqr4xxbxGYjXrOQJygW5RHGS5ofHo698jciY0JV8G3OtLpqNr/luRwC52oqGK2PuB1JwSqFkog7AmUMSLuGDcYT5H2iL5c58HA/a01uakBY6N0dBM6UdQtSdF0ji3nktOiy3a61OZuQbzwmiX1eNqH0VhrjwA/XnoxM14LOGXvjs+BaQFpFd6o1BWndNB+4rWr9oUsjdcs7KELpM6Su7RLhHL7a7pv1m4cHqPuyg2KVi6WIjbzLoIulcw==

secrets/worker_key.pub

@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDUXLNO8bl2Uvd2zvDrqT+PSZzK6qgCdlCQ1IuztVmy5qMg4s2lmFrz7qQ+XZVbyYe0DSKBe1/Y/DW+qiVUcrWaDajxRiQmCVnBAu1aNow/rP55Bo+uoFaExC+8qJs448WK1gTRR/gTfbyS/WUS3AqaVn3oAMSwVfi3ropQbsVhKK9kxCLbVmr8EVjn43K0XQzKnZ/BfniwGHCn4gayS9YL/2AHibJf8FXVscSVRh1GKzDt8wM+q/bZcFijp49LHo3A26HDr0SPthsvQ1HrNuGVqpoh0yDzdckQ5Wft4Gqx2qWVL62akn3dSpR2J68wN1HUrFBkX3E1yrEHxpjxoEX7xa9njZJX7ZRl6qfuGBwad51ewSzje6Llu2APTCT7JRSdy2UkfTuHchwXHaAWBMh9IjeLTq1ivTTDMoIRdpnBd8IKdQ/teYXvuXjeIhN3F0TOgAtbiIBHoiYPBf1BMT1ELBtFajZ/susxFSXcU7lWP8n/358wEHXpoTK5plD7gBy8sKC8KpypV64JjwDXhtXBPGJoIqOQVppj9RXgj9rIlyBveZalc58LhfUsSKk9wy1PLExGjYm0n9LXd//5Zy2Q/owpIOULcxEe9OUuAsnz7PUBPeiG6tLUWRXKJHZGGDY5yV1zAEutXYqdLE2cbrTlqxoBZiYyLwcuHk+swTH8Ew==