authelia: auth is working, but not the proxy

authelia: init
wireguard: add pub.solar wireguard config
2024-04-03 21:56:48 +02:00 · 2024-04-03 21:56:47 +02:00 · 2024-04-03 21:56:03 +02:00
61 changed files with 682 additions and 333 deletions
--- a/hosts/default.nix
+++ b/hosts/default.nix
@ -66,6 +66,7 @@
          ./droppie
          self.nixosModules.yule
          self.nixosModules.acme
+          self.nixosModules.proxy
          self.nixosModules.persistence
        ];
      };
@ -78,6 +79,7 @@
          ./pie
          self.nixosModules.yule
          self.nixosModules.acme
+          self.nixosModules.proxy
          self.nixosModules.docker
          self.nixosModules.invoiceplane
        ];
@ -90,6 +92,7 @@
          ./frikandel
          self.nixosModules.yule
          self.nixosModules.acme
+          self.nixosModules.proxy
          self.nixosModules.docker
        ];
      };
--- a/hosts/droppie/nginx.nix
+++ b/hosts/droppie/nginx.nix
@ -5,16 +5,7 @@
  lib,
  ...
 }: {
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
  services.nginx = {
-    enable = true;
-
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-    recommendedTlsSettings = true;
-    recommendedProxySettings = true;
-
    defaultListenAddresses = [
      "192.168.178.3"
      "10.13.12.3"
--- a/hosts/frikandel/nginx.nix
+++ b/hosts/frikandel/nginx.nix
@ -5,16 +5,7 @@
  lib,
  ...
 }: {
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
  services.nginx = {
-    enable = true;
-
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-    recommendedTlsSettings = true;
-    recommendedProxySettings = true;
-
    defaultListenAddresses = [
      "10.13.12.7"
      "[fd00:b12f:acab:1312:acab:7::]"
--- a/hosts/frikandel/unbound.nix
+++ b/hosts/frikandel/unbound.nix
@ -78,6 +78,8 @@
          "\"paperless.b12f.io. 10800 IN AAAA fd00:b12f:acab:1312:acab:2::\""
          "\"invoicing.b12f.io. 10800 IN A 10.13.12.2\""
          "\"invoicing.b12f.io. 10800 IN AAAA fd00:b12f:acab:1312:acab:2::\""
+          "\"auth.b12f.io. 10800 IN A 10.13.12.2\""
+          "\"auth.b12f.io. 10800 IN AAAA fd00:b12f:acab:1312:acab:2::\""

          "\"vpn.b12f.io. 10800 IN A 128.140.109.213\""
          "\"vpn.b12f.io. 10800 IN AAAA 2a01:4f8:c2c:b60::\""
--- a/hosts/pie/authelia.nix
+++ b/hosts/pie/authelia.nix
@ -0,0 +1,115 @@
+{
+  flake,
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+in {
+  age.secrets."authelia-storage-encryption-key" = {
+    file = "${flake.self}/secrets/authelia-storage-encryption-key.age";
+    mode = "400";
+    owner = "authelia-b12f";
+  };
+
+  age.secrets."authelia-session-secret" = {
+    file = "${flake.self}/secrets/authelia-session-secret.age";
+    mode = "400";
+    owner = "authelia-b12f";
+  };
+
+  age.secrets."authelia-jwt-secret" = {
+    file = "${flake.self}/secrets/authelia-jwt-secret.age";
+    mode = "400";
+    owner = "authelia-b12f";
+  };
+
+  age.secrets."authelia-users-file" = {
+    file = "${flake.self}/secrets/authelia-users-file.age";
+    mode = "400";
+    owner = "authelia-b12f";
+  };
+
+  age.secrets."mail@b12f.io-password" = {
+    file = "${flake.self}/secrets/mail@b12f.io-password.age";
+    mode = "400";
+    owner = "authelia-b12f";
+  };
+
+  security.acme.certs = {
+    "auth.b12f.io" = {};
+  };
+
+  services.nginx.virtualHosts = {
+    "auth.b12f.io" = {
+      forceSSL = true;
+      useACMEHost = "auth.b12f.io";
+      locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.services.authelia.instances.b12f.settings.server.port}";
+      locations."/".extraConfig = "include /etc/nginx/conf-available/proxy.conf;";
+      locations."/api/verify".proxyPass = "http://127.0.0.1:${builtins.toString config.services.authelia.instances.b12f.settings.server.port}";
+      locations."/api/authz".proxyPass = "http://127.0.0.1:${builtins.toString config.services.authelia.instances.b12f.settings.server.port}";
+    };
+  };
+
+  services.authelia.instances.b12f = {
+    enable = true;
+
+    secrets = {
+      storageEncryptionKeyFile = config.age.secrets."authelia-storage-encryption-key".path;
+      sessionSecretFile = config.age.secrets."authelia-session-secret".path;
+      jwtSecretFile = config.age.secrets."authelia-jwt-secret".path;
+    };
+
+    settings = {
+      theme = "light";
+      default_2fa_method = "webauthn";
+      log.level = "debug";
+      server = {
+        port = 9092;
+        host = "127.0.0.1";
+      };
+      authentication_backend = {
+        refresh_interval = "disable";
+        password_reset = { disable = true; };
+        file = {
+          path = config.age.secrets."authelia-users-file".path;
+          watch = false;
+        };
+      };
+      duo_api.disable = true;
+      webauthn.user_verification = "required";
+      totp.issuer = "auth.b12f.io";
+      storage.local.path = "/var/lib/authelia-b12f/db.sqlite3";
+      access_control.default_policy = "two_factor";
+      session = {
+        domain = "auth.b12f.io";
+        # authelia_url = "https://auth.b12f.io";
+      };
+      notifier.disable_startup_check = true;
+      notifier.smtp = {
+        host = "mail.b12f.io";
+        port = 587;
+        username = "mail@b12f.io";
+        sender = "auth.b12f.io <mail@b12f.io>";
+        identifier = "auth@b12f.io";
+        subject = "[auth.b12f.io] {title}";
+      };
+    };
+  };
+
+  systemd.services.authelia-b12f.environment.AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE = config.age.secrets."mail@b12f.io-password".path;
+
+  services.restic.backups = {
+    authelia = {
+      paths = [ "/var/lib/authelia-b12f" ];
+      initialize = true;
+      passwordFile = config.age.secrets."restic-password".path;
+      # See https://www.hosting.de/blog/verschluesselte-backups-mit-rclone-und-restic-in-nextcloud/
+      repository = "rclone:cloud.pub.solar:/backups/Authelia";
+      rcloneConfigFile = config.age.secrets."rclone-pie.conf".path;
+    };
+  };
+}
--- a/hosts/pie/default.nix
+++ b/hosts/pie/default.nix
@ -9,6 +9,7 @@
    ./unbound.nix
    ./dhcpd.nix
    # ./wake-droppie.nix
+    ./authelia.nix
    ./paperless.nix
    ./firefly.nix
    ./invoiceplane.nix
--- a/hosts/pie/firefly.nix
+++ b/hosts/pie/firefly.nix
@ -38,12 +38,22 @@ in {
    "firefly.b12f.io" = {
      forceSSL = true;
      useACMEHost = "firefly.b12f.io";
+      extraConfig = "include /etc/nginx/conf-available/authelia-location.conf;";
      locations."/".proxyPass = "http://127.0.0.1:8080";
+      locations."/".extraConfig = ''
+        include /etc/nginx/conf-available/proxy.conf;
+        include /etc/nginx/conf-available/authelia-authrequest.conf;
+      '';
    };
    "firefly-importer.b12f.io" = {
      forceSSL = true;
      useACMEHost = "firefly-importer.b12f.io";
+      extraConfig = "include /etc/nginx/conf-available/authelia-location.conf;";
      locations."/".proxyPass = "http://127.0.0.1:8081";
+      locations."/".extraConfig = ''
+        include /etc/nginx/conf-available/proxy.conf;
+        include /etc/nginx/conf-available/authelia-authrequest.conf;
+      '';
    };
  };

--- a/hosts/pie/invoiceplane.nix
+++ b/hosts/pie/invoiceplane.nix
@ -28,6 +28,11 @@ in {
    "invoicing.b12f.io" = {
      forceSSL = true;
      useACMEHost = "invoicing.b12f.io";
+      extraConfig = "include /etc/nginx/conf-available/authelia-location.conf;";
+      locations."/".extraConfig = ''
+        include /etc/nginx/conf-available/proxy.conf;
+        include /etc/nginx/conf-available/authelia-authrequest.conf;
+      '';
    };
  };

--- a/hosts/pie/nginx.nix
+++ b/hosts/pie/nginx.nix
@ -5,16 +5,7 @@
  lib,
  ...
 }: {
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
  services.nginx = {
-    enable = true;
-
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-    recommendedTlsSettings = true;
-    recommendedProxySettings = true;
-
    defaultListenAddresses = [
      "192.168.178.2"
      # "2a02:908:5b1:e3c0:2::"
--- a/hosts/pie/paperless.nix
+++ b/hosts/pie/paperless.nix
@ -9,9 +9,9 @@ with lib; let
  psCfg = config.pub-solar;
  xdg = config.home-manager.users."${psCfg.user.name}".xdg;

-  dataDir = "${xdg.dataHome}/Paperless";
-  backupDir = "${xdg.dataHome}/PaperlessBackup";
-  consumptionDir = "/home/${psCfg.user.name}/.local/share/scandir";
+  dataDir = "/var/lib/paperless";
+  backupDir = "/var/lib/PaperlessBackup";
+  consumptionDir = "/var/lib/scandir";

  scan2paperless = with pkgs; writeShellScriptBin "scan2paperless" ''
    DEVICE=$1
@ -53,21 +53,25 @@ in {
    "paperless.b12f.io" = {
      forceSSL = true;
      useACMEHost = "paperless.b12f.io";
+      extraConfig = "include /etc/nginx/conf-available/authelia-location.conf;";
      locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.services.paperless.port}";
-    };
+      locations."/".extraConfig = ''
+        include /etc/nginx/conf-available/proxy.conf;
+        include /etc/nginx/conf-available/authelia-authrequest.conf;
+      '';
+    }; 
  };

  services.paperless = {
    enable = true;
-    user = psCfg.user.name;
    consumptionDir = consumptionDir;
    dataDir = dataDir;
    address = "127.0.0.1";
    extraConfig = {
      PAPERLESS_OCR_LANGUAGE = "nld+deu";
-      PAPERLESS_ADMIN_USER = psCfg.user.name;
-      PAPERLESS_AUTO_LOGIN_USERNAME = psCfg.user.name;
      PAPERLESS_URL = "https://paperless.b12f.io";
+      PAPERLESS_DISABLE_REGULAR_LOGIN = "True";
+      PAPERLESS_ENABLE_HTTP_REMOTE_USER = "True";
    };
  };

@ -101,13 +105,13 @@ in {
  age.secrets."hosting-de-invoice-sync-api-key" = {
    file = "${flake.self}/secrets/hosting-de-invoice-sync-api-key.age";
    mode = "400";
-    owner = psCfg.user.name;
+    owner = "paperless";
  };

  services.cron = {
    enable = true;
    systemCronJobs = [
-      "30 1 * * * ${psCfg.user.name} ${pkgs.fetch-hostingde-invoices}/bin/fetch-hostingde-invoices '${config.age.secrets."hosting-de-invoice-sync-api-key".path}' '${consumptionDir}'"
+      "30 1 * * * paperless ${pkgs.fetch-hostingde-invoices}/bin/fetch-hostingde-invoices '${config.age.secrets."hosting-de-invoice-sync-api-key".path}' '${consumptionDir}'"
    ];
  };

@ -116,8 +120,10 @@ in {
  #################################

  systemd.tmpfiles.rules = [
-    "d '${backupDir}' 0700 ${psCfg.user.name} users - -"
-    "d /tmp/paperless 0700 ${psCfg.user.name} users - -"
+    "d '${dataDir}' 0700 paperless users - -"
+    "d '${backupDir}' 0700 paperless users - -"
+    "d '${consumptionDir}' 0700 paperless users - -"
+    "d /tmp/paperless 0700 paperless users - -"
  ];

  age.secrets."rclone-pie.conf" = {
--- a/hosts/stroopwafel/networking.nix
+++ b/hosts/stroopwafel/networking.nix
@ -31,4 +31,14 @@
      endpoint = "146.70.134.2:3565";
    };
  };
+
+  age.secrets.wg-pub-solar-key.file = "${flake.self}/secrets/wg-pub-solar-stroopwafel.age";
+
+  pub-solar.wireguard.pub-solar = {
+    ownIPs = [
+      "10.7.6.200/32"
+      "fd00:fae:fae:fae:fae:200::/96"
+    ];
+    privateKeyFile = config.age.secrets.wg-pub-solar-key.path;
+  };
 }
--- a/modules/core/hardening.nix
+++ b/modules/core/hardening.nix
@ -34,11 +34,6 @@ in {
  # required to run chromium
  security.chromiumSuidSandbox.enable = true;

-  # create system-wide executables firefox and chromium
-  # that will wrap the real binaries so everything
-  # work out of the box.
-  programs.firejail.enable = true;
-
  # enable antivirus clamav and
  # keep the signatures' database updated
  services.clamav.daemon.enable = true;
--- a/modules/default.nix
+++ b/modules/default.nix
@ -22,6 +22,7 @@
      persistence = import ./persistence;
      portable = import ./portable;
      printing = import ./printing;
+      proxy = import ./proxy;
      terminal-life = import ./terminal-life;
      user = import ./user;
      virtualisation = import ./virtualisation;
--- a/modules/desktop-extended/default.nix
+++ b/modules/desktop-extended/default.nix
@ -12,6 +12,7 @@ in {

  users.users."${psCfg.user.name}".packages = with pkgs; [
    wine
+    chromium

    gimp
    present-md
@ -35,25 +36,6 @@ in {
    nvd
  ];

-  programs.firejail.wrappedBinaries = {
-    chromium = {
-      executable = "${pkgs.lib.getBin pkgs.ungoogled-chromium}/bin/chromium";
-      profile = "${pkgs.firejail}/etc/firejail/chromium.profile";
-    };
-    # signal-desktop = {
-    #   executable = "${pkgs.lib.getBin pkgs.signal-desktop}/bin/signal-desktop";
-    #   profile = "${pkgs.firejail}/etc/firejail/signal-desktop.profile";
-    # };
-    # telegram-desktop = {
-    #   executable = "${pkgs.lib.getBin pkgs.tdesktop}/bin/telegram-desktop";
-    #   profile = "${pkgs.firejail}/etc/firejail/telegram-desktop.profile";
-    # };
-    # element-desktop = {
-    #   executable = "${pkgs.lib.getBin pkgs.element-desktop}/bin/element-desktop";
-    #   profile = "${pkgs.firejail}/etc/firejail/element-desktop.profile";
-    # };
-  };
-
  fonts = {
    packages = with pkgs; [
      dejavu_fonts
--- a/modules/graphical/default.nix
+++ b/modules/graphical/default.nix
@ -73,6 +73,10 @@ in {
    # Enable GVfs, a userspace virtual filesystem
    services.gvfs.enable = true;

+    # This actually lowers security and is
+    # required to run electron apps with the hardened kernel
+    boot.kernel.sysctl."kernel.unprivileged_userns_clone" = 1;
+
    fonts = {
      packages = with pkgs; [
        dejavu_fonts
@ -88,6 +92,7 @@ in {

    users.users."${psCfg.user.name}".packages = with pkgs; [
      alacritty
+      firefox-wayland
      flameshot
      gnome.adwaita-icon-theme
      gnome.eog
@ -102,13 +107,6 @@ in {
      wcwd
    ];

-    programs.firejail.wrappedBinaries = {
-      firefox = {
-        executable = "${pkgs.lib.getBin pkgs.firefox-wayland}/bin/firefox";
-        profile = "${pkgs.firejail}/etc/firejail/firefox.profile";
-      };
-    };
-
    home-manager.users."${psCfg.user.name}" = {
      home.file."xinitrc".source = ./.xinitrc;
      xdg.configFile."alacritty/alacritty.yml".source = yamlFormat.generate "alacritty.yml" (import ./alacritty.nix);
--- a/modules/proxy/authelia-authrequest.conf
+++ b/modules/proxy/authelia-authrequest.conf
@ -0,0 +1,32 @@
+## Send a subrequest to Authelia to verify if the user is authenticated and has permission to access the resource.
+auth_request /internal/authelia/authz;
+
+## Save the upstream metadata response headers from Authelia to variables.
+auth_request_set $user $upstream_http_remote_user;
+auth_request_set $groups $upstream_http_remote_groups;
+auth_request_set $name $upstream_http_remote_name;
+auth_request_set $email $upstream_http_remote_email;
+
+## Inject the metadata response headers from the variables into the request made to the backend.
+proxy_set_header Remote-User $user;
+proxy_set_header Remote-Groups $groups;
+proxy_set_header Remote-Email $email;
+proxy_set_header Remote-Name $name;
+
+## Configure the redirection when the authz failure occurs. Lines starting with 'Modern Method' and 'Legacy Method'
+## should be commented / uncommented as pairs. The modern method uses the session cookies configuration's authelia_url
+## value to determine the redirection URL here. It's much simpler and compatible with the mutli-cookie domain easily.
+
+## Modern Method: Set the $redirection_url to the Location header of the response to the Authz endpoint.
+auth_request_set $redirection_url $upstream_http_location;
+
+## Modern Method: When there is a 401 response code from the authz endpoint redirect to the $redirection_url.
+error_page 401 =302 $redirection_url;
+
+## Legacy Method: Set $target_url to the original requested URL.
+## This requires http_set_misc module, replace 'set_escape_uri' with 'set' if you don't have this module.
+# set_escape_uri $target_url $scheme://$http_host$request_uri;
+
+## Legacy Method: When there is a 401 response code from the authz endpoint redirect to the portal with the 'rd'
+## URL parameter set to $target_url. This requires users update 'auth.example.com/' with their external authelia URL.
+# error_page 401 =302 https://auth.example.com/?rd=$target_url;
--- a/modules/proxy/authelia-location.conf
+++ b/modules/proxy/authelia-location.conf
@ -0,0 +1,32 @@
+set $upstream_authelia https://auth.b12f.io/api/authz/auth-request;
+
+## Virtual endpoint created by nginx to forward auth requests.
+location /internal/authelia/authz {
+    ## Essential Proxy Configuration
+    internal;
+    proxy_pass $upstream_authelia;
+
+    ## Headers
+    ## The headers starting with X-* are required.
+    proxy_set_header X-Original-Method $request_method;
+    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header Content-Length "";
+    proxy_set_header Connection "";
+
+    ## Basic Proxy Configuration
+    proxy_pass_request_body off;
+    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; # Timeout if the real server is dead
+    proxy_redirect http:// $scheme://;
+    proxy_http_version 1.1;
+    proxy_cache_bypass $cookie_session;
+    proxy_no_cache $cookie_session;
+    proxy_buffers 4 32k;
+    client_body_buffer_size 128k;
+
+    ## Advanced Proxy Configuration
+    send_timeout 5m;
+    proxy_read_timeout 240;
+    proxy_send_timeout 240;
+    proxy_connect_timeout 240;
+}
--- a/modules/proxy/default.nix
+++ b/modules/proxy/default.nix
@ -0,0 +1,29 @@
+{
+  flake,
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  services.nginx = {
+    enable = true;
+
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+    recommendedTlsSettings = true;
+    recommendedProxySettings = true;
+
+    resolver.addresses = [
+      "10.13.12.7"
+      "[fd00:b12f:acab:1312:acab:7::]"
+    ];
+  };
+
+  environment.etc = {
+    "nginx/conf-available/proxy.conf".source = ./proxy.conf;
+    "nginx/conf-available/authelia-location.conf".source = ./authelia-location.conf;
+    "nginx/conf-available/authelia-authrequest.conf".source = ./authelia-authrequest.conf;
+  };
+}
--- a/modules/proxy/proxy.conf
+++ b/modules/proxy/proxy.conf
@ -0,0 +1,33 @@
+## Headers
+proxy_set_header Host $host;
+proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-Forwarded-Host $http_host;
+proxy_set_header X-Forwarded-URI $request_uri;
+proxy_set_header X-Forwarded-Ssl on;
+proxy_set_header X-Forwarded-For $remote_addr;
+proxy_set_header X-Real-IP $remote_addr;
+
+## Basic Proxy Configuration
+client_body_buffer_size 128k;
+proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; ## Timeout if the real server is dead.
+proxy_redirect  http://  $scheme://;
+proxy_http_version 1.1;
+proxy_cache_bypass $cookie_session;
+proxy_no_cache $cookie_session;
+proxy_buffers 64 256k;
+
+## Trusted Proxies Configuration
+## Please read the following documentation before configuring this:
+##     https://www.authelia.com/integration/proxies/nginx/#trusted-proxies
+set_real_ip_from 10.13.12.0/24;
+set_real_ip_from fc00::/7;
+
+real_ip_header X-Forwarded-For;
+real_ip_recursive on;
+
+## Advanced Proxy Configuration
+send_timeout 5m;
+proxy_read_timeout 360;
+proxy_send_timeout 360;
+proxy_connect_timeout 360;
--- a/modules/wireguard/default.nix
+++ b/modules/wireguard/default.nix
@ -7,5 +7,6 @@
  imports = [
    ./private.nix
    ./tunnel.nix
+    ./pub.solar.nix
  ];
 }
--- a/modules/wireguard/pub.solar.nix
+++ b/modules/wireguard/pub.solar.nix
@ -0,0 +1,68 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+  cfg = config.pub-solar.wireguard.pub-solar;
+in {
+  options.pub-solar.wireguard.pub-solar = {
+    ownIPs = mkOption {
+      description = "Internal ips in wireguard used for cluster control-plane communication.";
+      type = types.listOf types.str;
+      default = [];
+    };
+
+    privateKeyFile = mkOption {
+      description = "Location of private key file";
+      type = types.path;
+    };
+  };
+
+  config = mkIf (length cfg.ownIPs != 0){
+    networking.firewall.allowedUDPPorts = [51821];
+
+    systemd.services.wireguard-wg-pub-solar = {
+      enable = false;
+
+      after = [
+        "network.target"
+        "network-online.target"
+        "nss-lookup.target"
+      ];
+
+      serviceConfig = {
+        Type = mkForce "simple";
+        Restart = "on-failure";
+        RestartSec = "30";
+      };
+
+      environment = {
+        WG_ENDPOINT_RESOLUTION_RETRIES = "infinity";
+      };
+    };
+
+    networking.wireguard.interfaces = {
+      wg-pub-solar = {
+        listenPort = 51821;
+        mtu = 1300;
+        ips = cfg.ownIPs;
+        privateKeyFile = cfg.privateKeyFile;
+        peers = [
+          { 
+            endpoint = "flora6.pub.solar:51820";
+            publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
+            allowedIPs = [ "10.7.6.2/32" "fd00:fae:fae:fae:fae:2::/96" ];
+          }
+          { 
+            endpoint = "nachtigall.pub.solar:51820";
+            publicKey = "qzNywKY9RvqTnDO8eLik75/SHveaSk9OObilDzv+xkk=";
+            allowedIPs = [ "10.7.6.1/32" "fd00:fae:fae:fae:fae:1::/96" ];
+          }
+        ];
+      };
+    };
+  };
+}
--- a/secrets/.fwknoprc.age
+++ b/secrets/.fwknoprc.age
--- a/secrets/authelia-jwt-secret.age
+++ b/secrets/authelia-jwt-secret.age
@ -0,0 +1,24 @@
+age-encryption.org/v1
+-> ssh-ed25519 8bHz7g zKjSwAkx3AP3kn3E+Yxx3vqvKDPp1RfRqI2DXsGZEUo
+px/kpl3Emm85x8jC3FX2GTsOKlbv+yu3M9z3oUipLxE
+-> ssh-rsa kFDS0A
+ezAH1vla7uUC7jbtsc4s/PoASi4SyD5SlHpdwSFWqF4rKwkamJLgUlfv8D0ogSHl
+iGF/XypomK4wQbc+B1fECKZGfbaXtqY8un8Zljh5rC4v4Un7twwA+uoXkUUNF5/q
+UlJnCnJL5kpM89mpYc3YXT/E/xbKT/LcEhn7ngTWcDxgMkbxOgj5N5t/XUWxtMD
+qjv1DfXNHl95gI02yMpqmxGly0tIY9nHD1vAz87w25swr4VJFn3yjCVZlKz2+m5w
+b5SghK9ZotXlvZDLhe12+//XTbEtr3FW9cwU7Ad6ATTD15CnciCI1+wd3L8Os0In
+aV9NiGwXhThggnlDmMu22gw3QSj5f0masSSxSTFyCm/SSPL2mnlzANHuLj2DbTgA
+cNNWwIPUAB09cn0F5k1uYy1rsScaLf46gY+HWUYqGHvPaE7j2eY9phTt9qxgOWdP
+an9zktCMbJaoQ8EyaYpl7ZHjT9pfQPmmmrBDeFfPso5Oy681TWmwvifOe/lNWits
+EgKwR09yI780tELxXAZEO52rix503GtM0RJAJlifThvF5HU/FC4M7X1QoYYJsIMc
+ilhAsTlwIxQfXWTrt3hvucA4cwdfLh9USz1Otz9ct9NmfqOBHUD3eDz2DtKTUykW
+aushupzdaRQS1JIQqklzKZBc8r8W9ePO/MOTb3l2dAA
+-> piv-p256 zqq/iw A6lhtVxLSu9x/WnIzsBQYYcSepbrCh9LKffXdPnY44EP
+ZsTeF0qctvTCrAn1rOxtySolyA1ERsX6xoOFWykl1uE
+-> piv-p256 vRzPNw A+vnxQlBvTqe9zhXoIXkwqqmvXkmmxk5wOJE5viCqxA9
+2E+mx13FD2A89KAI95KnulBUUF3c9Nni7IGCn0LG6Y4
+-> e-grease WS4 hN A;D ^Q'
+89Rq7mgvyF6s9pQe0W7zM9I0wZQmTkLU75xQl7j8d+7kCvp8t5Qm9r1lS9QTqlfL
+L1MjgllMv0Mgl10I796UM5T21QoSdY3RfP8
+--- mQbEPEUmeSnOPFXoKIIc6VHOUqJqsddXnGz7ZyMvMGM
+	žMšøÜzóù‘Oð¼Î¬ŽÉ[µ>SŠÎ»IunxOZ¦Sée<C3A9>ÍÔ)ÏÑ–	«/lŠVe˜†Ú?é/YìZT–9Â®Û<C2AE>µÎF»÷U<C3B7>Éó˜ÈîÄÑ]dRRÛã¼Ø™
--- a/secrets/authelia-session-secret.age
+++ b/secrets/authelia-session-secret.age
--- a/secrets/authelia-storage-encryption-key.age
+++ b/secrets/authelia-storage-encryption-key.age
--- a/secrets/authelia-users-file.age
+++ b/secrets/authelia-users-file.age
--- a/secrets/b12f-env-secrets.age
+++ b/secrets/b12f-env-secrets.age
--- a/secrets/b12f.io-dkim-private-rsa.age
+++ b/secrets/b12f.io-dkim-private-rsa.age
--- a/secrets/cat-test.ovpn.age
+++ b/secrets/cat-test.ovpn.age
--- a/secrets/droppie-ssh-root.key.age
+++ b/secrets/droppie-ssh-root.key.age
--- a/secrets/dyndns.key.age
+++ b/secrets/dyndns.key.age
@ -1,25 +1,23 @@
 age-encryption.org/v1
-> ssh-ed25519 8bHz7g 2M1zTXuz8F9ccQRXzNNBffl33O/uBo0Fq4lcfEC6KlU
-Lod8LXs62N/oGojaiFH3FBl7Tez/FdJIWznzSutsIjE
+-> ssh-ed25519 8bHz7g tU9tWTdUGfcYQDPViqDzMB+0cbhx69ttVhtVco2U7kk
+A1xkW3krGYL4bWMCOujo3nxg+pnIRlabfr0/rImYU34
 -> ssh-rsa kFDS0A
-OUWTYz/8wmdJ2WN2NXO4DtxICgVdAPhilFfQhz96HH4mI4ggDYS5RpQzffw+DozR
-W13PIUnLIrOzpn7+YPUz9bIIzYpjNnIoRQnMKN66MucdJNXJ1qBhTa0WDwnkC0KM
-M62GKjLMhQOesP48acx2OvGxdYIUJm8oD8TpAP1qb9Pg7Vy1F//KIs3BE6RsOM3w
-o17t6gYs718vza+5oVsXVayIsyDgISOhRT29EsuIoPDsDFjm1tz/UYeUtppwJruZ
-ArGcdz8bpC6INDNlB5Njrg/zECdiIvLZ030DlAuo9Y3IAcE/hFUQhwaYJe4OCMqf
-aA0vsPjsKPpXn4Ui8IyXP8JJ+CU3enu43bFH8h8q7LOb6rLxYFVAzT6jg7hLFdES
-7aPkBJR0nYMtt9gdL3KxmTtSgdKdRV8yqrHtBM/rj8IYvpjjqVwinrk5n7yaTBas
-jDAoi0OZ0wP9ZykaaILfkoar7ZecJgxWZ6dmaGB641Dwu7mZv4Pqh3uYDHjU2VYW
-f5TC0pzzuyE4me0fmy5efc0/wbxYH/bSw81tjih9KmRUhvqzxwMFBtnkYElYo2MM
-G7G/1GAYlHpewaXTc2k7pG7sicA42Zn0OoGLMpgWyJJWDvVa16XR133rUQmPCLOW
-T5FuGeQi+hDX/xJ2JoNiBXQfP84jqfmMSK7mO8O3ofI
-> piv-p256 zqq/iw Ay6ViJqFtNzyrZ9EBHHE3mE0h+jg2YkgMz0Y0oxqVAkK
-bolGO/OqFNoT6AF/z7bhocW9W2mYiYQUjsvKY8vuL8I
-> piv-p256 vRzPNw A0foK8gvOdXspZG0H0yT1gqf7JC1U14ZAuOvfL/j2MrE
-McGAqd59RKTg0BKAFl8CErbbfEjcTcHtTJqZFcFZSik
-> ez5dw-grease
-2GgPMYkIUyZhdPL4WWY0mIJDTjHt7YWZPebSHLe7++Hf1ZUQ8Q0Yv6oufH3YCeI3
-T9yVzdzkyJf51moR
--- G5KQtnyEAno2mVCtciQ1IvoyR98i1zUQMu98OLwTq84
-èÉÁk¾¨úö TLû 
'ßìrrL«eU#P6Î#PÓO§b²Ú<C2B2>˜SUúÊÿÀÕ¼ˆÈûaêçÝÆ‚ïf0öRÂQ™<51>ÓÞ“Äs¹¯rfi¼çœ[.+ü‰JŸô
-1O
+mZN2a1v/gTk8baMSw9ZoDI4hHIFm6KhOYR7vvAKjK8OVaTQcFaTj7hMsZ2gT2erI
+Bgm0iHLrFBqqrrD9Mi2Tv2e/ePW8w5omcedo7bAcgCm2rdcTHePYswHnYTCTadCT
+hhH8kuZTMfEm1FU1c/CB898qhYFS6lOYFBnQYoSTsGgx3JCDB1S4Rm2AsyXvzlaZ
+TD6H6LcHYJRClcaHU/3bn4dmiEGwYoYOcYiHp6tM4+prVajGMrOYTPucAbf3xxzR
+GE7FMl6POvkniiPjamBF4K9cE8KtIzyDJoWLiZQOGOMXh5prSTEOFL8zerWKhJAR
+4kvSx2F0UtuKgikwQBpxRC40V12ivJGCrr7DFXxSZThBJzK1PfnAyY2VRrLr6QGM
+wqctsudOHtRHt5NTK4QzX8OMqmkdM+KBDHxxbfSg0d5Fy0qM5KOH1aw6+/pLC7rt
+gdE6sn3HQMRM2DL8PxJEC3GyJVuwmC2PC0uPqpvrcabM5S9cBvoLRUwp66vwNCPL
+CW7LdSAbu4TfPlffRmPoMqjuRo0HLQ76ZchSJyN0NDscejh1hsEbl/M5etjIAVu1
+IuiG4DR2yGJQOaFcKLyxbJcMKtI8+g01cr3K9GQr1IVh8bcouReJfmzIBv0kKZvK
+bMBhkPbyjhmgRj212/+QdsXHrEUhXGe04HHwPnjo/Xg
+-> piv-p256 zqq/iw Au0LMoXmBQujrAcouzeRYwE9th7w7VacTcPA1eE1xMqw
+hEaZcmAQ3ekiF/GuT2XLC0SEoHr9pLI8870g1t0cgr8
+-> piv-p256 vRzPNw A0XNs/XOz2O1eud5aH7Q4DbhR9WXmJGYwby27G5FoyrK
+nVibl5qpWLuxqR6DkoGbNrHEpCfxJUl5SdUxygHarrY
+-> Q]A>-grease `@,ipv 4]wX
+Xd1UCl4E88saY5AqPdzxKM77f0G8rsbqM78tBmg
+--- hlcJUXHAuVi75Oi2dr01NSh4RWjruTFyzWdJjk/mQ2U
+ð.ˆ·Ñ³DeN¶¦ÃcŒ{ºàr<C3A0>‰Ñ-a¥Ó>ùÉªÿ±`AòHï§àeÜHDßÐM'tcm_•Ê”psH;„•Ó* Œ¶$JJQŽ„É'Ëíü#ã‰³Ð©Tº2«¨cë
--- a/secrets/ehex-vpn.creds.age
+++ b/secrets/ehex-vpn.creds.age
--- a/secrets/ehex.ovpn.age
+++ b/secrets/ehex.ovpn.age
--- a/secrets/firefly-cron-secrets.env.age
+++ b/secrets/firefly-cron-secrets.env.age
@ -1,25 +1,24 @@
 age-encryption.org/v1
-> ssh-ed25519 8bHz7g 66swOUsEOMipbpWdvfQDyyhrlQs9SYIKDu7uRKXRgn8
-biYdYn5NgOV5F7Tpi2rXzBLDMufmZ/7Ux1fns/7p6YA
+-> ssh-ed25519 8bHz7g ENnUFWaMTl0qIRuWwDwf5LU5SEJacCmNbF4kehtytns
+8B01SNu4tpN35J/WPACTfwxm5+vy9Xr3fKWxtTcSxq4
 -> ssh-rsa kFDS0A
-ITieW8I1T3bdN62xVCipB4iGELGrP2pwY7hgZ61sIk3Oi9T98gXFYKS/t2GznPDl
-QczVlUvJ1Ujt2ozHfDGQsCHIsrNrEVCV9UOdaUjim2aWZ0pwvYGWJ0G+wuJCUK/Z
-N1miOPdKddOefUf5tTc5w+nPdRQuhxB4nRP+qpAHiPPigdM5RfNZCO1YtucIedBz
-3qMYXR4+Ouewv0evbimrbIrrdlvesQlHfA7q8N/uFm5BtAf43iu2fJ5xapHqC4d8
-vfGauwdyoOuM6xllW+wjsBNP4Vq6h6g3mT5FGXGmCHscNx6EZWy2CKPAAXHjukGS
-f8wCs7LPnd/1jS4DIXo3qjZ1kAnpqh+nC3J2hRfGrgjf4AoqDmdmUnRVx6vNOiEQ
-AhU1V05Utq7I4x8EQmpaR/x5ELehYXtpKUTQWoee9dvV9Ys2tae9qnYJpX5iWJ1D
-SjVJqL+a1GRGAzCiJnLFOAT+iPEByHQsqRqvjp9XBfQFtyk613lyBEQDWQznaSD9
-e0WPQpyGYpY/D7CmFKOrcjuRbpdW5f+Tnpu0p8y4uLeRuoXtrVL6FdYUlEEJQUHu
-RWFVy1Dg2Ft7wdKTtDjArV/93S6KYcU+lY8jzNQz3OgdVLImlgky92aWhTFehgVC
-ou9gs2wLWv9vAiFu0fb/y94Eupw/+fxwVEfvInIpX3I
-> piv-p256 zqq/iw A5tJ9Z0fDXK9jW6xG7jGLvH17N5hqoOBoo/MCX8pszjz
-XsbaaIOnMEbkvAgb3nDcVUiLCiG7atahzLwSyavzWvw
-> piv-p256 vRzPNw A9TeFYNYmlp9zJ2jGPRYjLdlhz0VPOJuhhzjJb44Plox
-XHsPQCEP6VuoLCCZZRyDzcH2cMzQj2qAH+xZxL0y5DU
-> eN-grease OZ NzlxU
-uRyMfsTMRnC1otTrruqhhelq+6ivP7PCF0t6VcDhPuA4qGsXsfxxILgJhI3eRWCT
-AeQ8efeEWMPCBVI
--- 1EhV0FID63UugANohR2Zn8Iq1XaEEbgQ38B9vmKONNc
-姨z<EFBFBD>,ｶzj.<2E>\ﾓ4a､﨧uﾌ+祁%鉸ﾙｴ@z]J<>ｧ[fXﾆ
-粐c<0B><>>fNJVｻ<b袁㍼=2<>2]ｨ皷<>ﾏ~
+Iyr4T/9nLrXnNF3t46B/bb71UtmrZ6Q2fUUrgQB/IY2mF2dkOg+Z9lslTu+cgvFM
+9A5whPOlvf9K5Z3X2pItHjLZTQuoyWevye/Nz1WHZ+GAMoVSibDzJao13jxGZ5C7
+elMV/22x3VvPQrwd7UcOhP3gB752sXcwiOhUjn+WWZYbvqLVNSmnZt541xhcTEmK
+Ef+/Mx8WwY9L+G0Coy8oFinhj9Uwlq1M9o+y27ehaUCQakvaRhxMwB93ucJYq7fT
+5eaDHv9da/3KnF0o9dAtvEyUvfjuDVcD1a9bX+PB+Ctd7liRDFYRLteGBX5oflzd
+qYVUHqQuXBmO6juBXwA0qe0mgDIoHIlPdFhdvUVec801OBS3OUwfpjm2AVJeFz7w
+kYv6nkmOmJoaSduwLgGkZlJ9XL9kt9x6GdThUYfukfDuEEV/9d4hiS2JvRYR9LJf
+xv8sbIG2L/WeUROqOQ/CtuhfHNYLr/B086e199EfoDoB3I1iI/kezsOqIFt5aYlF
+H7vzmehS+JucpXzCklZEJ3o87aythD8ykjJ9WDrh/Rdr2ChchyenlPN4fe0oSq32
+TrdXpyLUeEUfziq+PZsPYYFqeIdIrOcMML7p5aR8yEJFLxYi8+cMoomgsU+36DW2
+SaX7wAV+ypBQqfk1SbDqCfp38euEikM47E2zEAVPlJI
+-> piv-p256 zqq/iw AqcF/BWtdsliavHR9BQvhvp4fDt+PNtL3Z42Ey/Q7BsG
+jAZJPrf8fT7vWG43uTjUCStQO5BdCu9qWM5RcoBiDGA
+-> piv-p256 vRzPNw AoK+Ey7lxHQuFDuv0QVvuCQ0SJOT/PaAW8VK6e2zHDg0
+k4fachnuQvB7US1l463OevoiHGEpijp12XgZLOOzDbo
+-> uzP2\R0P-grease
+BKMYkkT/SqLY2jnMb2pPUtLLH+rKKfTRA8Ci6KM42Z0nQY/fwgudSvxNHFEBagjY
+VnZVvYeKOuyw+jofGhWqQJt/Bx/6i84SrA
+--- zZIJs/tZNBvXHUHkUGNC6XHq+5Wqb9y12cf2Iob2oBE
+tf=¤ößÏ<C39F>:$Ð’ãA¡¡ñaë•+	äå4D»´vŸn<>\Ÿºw6ÔWŸ	Grò6ƒè˜ãêòrôZÀ•{×Xê«í-ÈGñ¨î-$ä6
--- a/secrets/firefly-db-secrets.env.age
+++ b/secrets/firefly-db-secrets.env.age
@ -1,24 +1,24 @@
 age-encryption.org/v1
-> ssh-ed25519 8bHz7g EOBiyT+XbUTNXlTVZEKSqjTu596M3s0ThhnW5QhaLg8
-TCqqC4xam2BLFtBx7CZ/Wv/LmW24IQ+oB3DosLHHQAM
+-> ssh-ed25519 8bHz7g 7fscDY4cD3eU+uV5ydog2IgaDXXEOO/J4jSEo3smrlU
+51LfcGo3091EYv6MLqzN4+SmfEAaCG2AqxQygr5m820
 -> ssh-rsa kFDS0A
-KpDm5RpJtUAXEacIu6wWPg9ZNzSoi8L8rmzKAkKP2r5kQRe8qV0QjwAlM6yBKf/W
-od9Cmx33+ZwmXWJ+IMxZFRGhhGQWm8yjegs6oU47UqHrS4D9WCN4Eb1ZLM+VNz5a
-/9ZNPjJijde2XQH7GzduTgoPrzQhP32Z4z3PhB00+ij1CN0riF+WRR0+pS7WIK4J
-ay8uVqpn78NPUR0WApDDscVIBWZ3Dy2T/IOklqdRMbdprR6WSvfGVqMmb0KT8J5v
-lo3Zlb0Nqi4Af06c79/wdssJaEHvPnGXTSW5tKiL77pAz1HXl6GRIKTSiHXaEEZZ
-W6YSQ6tG8VRhDjiKD2GIB/dsYfRZAsge595kfZmHvAL9OplUD4FBUhCNah5MtxbV
-0/BTUN3N0+tVG31/ssdBi+BtMtcuEu9fb4uMjjrezNdObQXJg3PSVaJkwQ4HsjNT
-pZ+Q2alqBFmSIJf+IcNpIgdFoQMCac113BGzhQCEebFEkuem5Fw0whoKP5770R+n
-Z8uh8UunwGLNoE7XgP+XWpWh/64H+GKDEBVtP9ZXmtl5dW729n9oSLSb2B1pD+jj
-isVhM7RjVoWicAdH9B0fH3T5nq8OJFiTMl8azyvL9mDjsmBjmeDydOc2FMupQ9xS
-I7pJDRIWejRUQ++oxIXmlEJ2odN2uHAhXCT8dRw+fqg
-> piv-p256 zqq/iw Az25/im2z0pUUiTYx+M3Npk/2oY9UbusYXYeAoSRGNns
-+0B+TIdz4kRvWbjlqtOiJ5bj93IiSk3kIp6p54/j94E
-> piv-p256 vRzPNw AzoyfEC8b0XZPuOzkpJGtPpdszPxDk750zBED5QBdYj5
-gMMyz/uTTsfOGztsxoOy71wRUx2q8Edn4drR/DMvWFg
-> (l-grease ->N%-5VO A HK |w.l0A%Q
-QHowYsjCHy+UrjwQqcSKAFh3+PwRK6EykQSmPvuPlWMC2fp/d0UL3ONXvm3/tek
--- +GX80CPQhAQVnpRKBXbEGDYWkXSIhLouyBMlYzg0BYg
-*¶Íw¤…<C2A4>af’Ö„èŸðÇö-<2D>¼ç›o<E280BA>"Y_£¸\N}<7D>*^)‘íX]Åäí“þ X´Gµªi- XZƒþôÚ>
-î×Ÿì‹ðyÁ8•'‘<>³}<7D>ûe’GÈ{ÄÙ¼OfÖ-|<7C>ÂOˆœPÄüþ¶	'˜Äê/gÚãŸMöåšÝ©EìOx‘H¢yÌçOW~m+À<>ÊÜ¿
+f7h6EH4h4JeCrtHWUZwu1QcYMURD/O4yvS1ZwUmoQSZBhDmwnR/OzOOQVB79plGG
+M0JaQohWhVldmPg3KX6Aq4uDqgSWsYeO9Q8BYaLBZpiw83qgQAhkqv85xcSSTGuQ
+eZMkr2aOvEMf8pOpmzPLvMiFI+Z5LwrvMuMmptGmUY9sJ/kp9ngjblJxtGk32p3S
+RuKGBY6iC+swpK2+BQy7vpjGnRXcUSuvVd/Nh72Vncamlm7BKXdYbop6UM1JYjQy
+bag6Ud2mEZFcmR+E0CTGWTD0S1rmce/VM/Lab4DSWXQrs6aB2UybOeCUF3eVaPE/
+C8UCeNKSOF+sRiiGz/vS68JS9DL5buhhnYjsjGLLt0hJ1KN/YT5MyVZN/bbGqZz2
+mC2Yd2TCF61v+7Zr763l2hSLztTPorGDiZV1a4WAujRP2uRWxbVz3io86NQNXc3d
+0ExybZ4nBEWJKd2yWTdxzUVVgVXZecwfWIXAOQML2TCJAz0cHzzaZjdfW6ACYr0X
+DtPN9BBFkrxboCENWjRcy3lniaIi8ef5e7ZmstbvjQxlMjBBZzE0dlrINjfzgQrz
+tGLGbzfmvTyssIs4+hu+ldpxF1xdM10VGP0NHk7P9PwjVJDtauPgfWL5SvnvEePP
+MTe9J74IS5ZKUpkbYc82pZ9N8ZuzMYmz0v5T0r+bj3U
+-> piv-p256 zqq/iw AgJRcywG0jtOF/Jy9TVEFkXQjYny8NtVpl7SZK/QmqGs
+ASFjv9Uda5pR7C6GLpVxTWATcdvTHX7+nD2KPx+5Gr0
+-> piv-p256 vRzPNw AloLZJP8lW8iWp9USg9+UQqjyZbvOlrkPyXzk/xVFkyl
+V75Xdr62EO3pUUsh6WEJyKEXUfaUfd+igr5qLmhSzKs
+-> Qrs?o-grease
+PFTlH6gTXESwADsl6c7YM+Ut9AbgJRMS1SDwSn1kFN/NTNNoDtnqzLS5fi3bCxDe
+w/D3t6AQws0u2g
+--- 6A9h83fQQ9fT+2q2N30OIwJkTMBTK8UzFSyWVjGKXpA
+¸#‚<>ýÉP<>R’-èùÕø<C2AD>ŸîPE£s´dÆV®ˆè·<C3A8>Bñä³Û˜0ADø0Û/L;–×Q•°¤¡÷Ý°•N§¾Áš[*·²‰ô(¬°7vÂzùTù¸œ RZ”BÇä«$duÕõüšˆäÁëŽg^Ê¨Ô5Gcäu	~BFq¸*\uUÝÚMÿ)gºî’=G®Rm´¢Ìç/
--- a/secrets/firefly-importer-secrets.env.age
+++ b/secrets/firefly-importer-secrets.env.age
--- a/secrets/firefly-secrets.env.age
+++ b/secrets/firefly-secrets.env.age
--- a/secrets/hosting-de-acme-secrets.age
+++ b/secrets/hosting-de-acme-secrets.age
--- a/secrets/hosting-de-invoice-sync-api-key.age
+++ b/secrets/hosting-de-invoice-sync-api-key.age
@ -1,24 +1,24 @@
 age-encryption.org/v1
-> ssh-ed25519 8bHz7g zFQGBUd6WAdzaEzBavUWqm4U4ndIvzP00ntU1mhjSnw
-xJjfZz0wwqY3k1oqDwH9VxsM6/N61H/YV43JJZokfUY
+-> ssh-ed25519 8bHz7g 8rdlpuz3TCunjDVAO/PoymA89EQIrruHpR6JN5sIkkI
+xXN0koSPwM3pCKpH2qDRImvYq7q7azfNy7ppq2rRIFU
 -> ssh-rsa kFDS0A
-anu8DuRW7aev+nKgxZOchK5SVJO1/azxBITmEyy6IGHi78/DhaNEX1FdZoWTI4Sx
-dnND3DsCLdDiLgAUXWaQrbm+ZiTW4pip1pLFlEWDjddVtek2hLHYwUDd1g11bSm1
-a4Uk9Up54eZZF0j1y1/g4pwa2H/eQuQObE3uGR9RvFaIGmEftiH4aJN4jplPnXoW
-YuNNYRkdG2B9fHVnmHmKZetfqx4wcXMGM2BQCw93sCUYIiMl+ggzq6WiP5lNXrvl
-zVd3myPsMEWMWNX72OGmpaCtz2A2jWvO3MJlY+QjhaDzzvxN6/p6wxjGmsoymWIm
-r1ZdzDjZHU8e/WLrfoHXosKr0FYtRTFU69OjmShfkpK8eHFc433g9IsV2CNWLsMR
-oL9zkAvIH+cmkfzchKN2rgv8RgurDRXAOaX1tx5w/gZIrxfweXNHbUpeGej34e4A
-RDPxDgccfl0i6o2xKd6FnTV6RzEgnjhsQViq5B1/yRlHeHuFlXV4XRqEplduhepb
-DYY9+rxZM8uMxNTW5a9IcybWZJkocbmCUbkzOoTHpj0wtwlyKrqhtv3g+oAruPlO
-yKkq5RERT+i8TRDSJubiueBp8LdG0ffd1vUaXvLh2IXVyceHIul0K+dLxwZnqiIp
-+7jBIFjTRgQOiQdCCBkTvWrv3VrWRncElmAdvCKUAkY
-> piv-p256 zqq/iw AvONKaUIttkKS3u09BV7Pzhu4D8l2eD4Jeh+ebH07/BG
-97r1usenqTgi1QFQQ0DK1hhaTRgXXdSh9yPY6k3vg9A
-> piv-p256 vRzPNw A9jD43mHz8IhAx2T/LbUX5aDD0mD7qXyIsq+4qnJAYHp
-WHB14YVrqK9kULLkLaixTW5CuXV/F2PB+L6BlyLrBy4
-> E/-grease OT
-t5kB0LrtZWT1Wo75cYHgJhQHRgcZ1JOzahc6un1gP1/hmetCoOsCYKKtVszKr278
-dHFM1jMjn7EQH4kMUNXUOhcLrEy94A
--- MA00Lr6/JrZT09+RKzchJ57pvr8rg2y7wbQ6ZJu39Yg
-Iû¬Ž`åƒÕM´,¯gÙ-çaü:&ÎÑàÊ<C3A0>H|ûZø'U<>&¶MiÜ’q±Šä¢¼)Z²ãx7yt=¸NŒh>_‰“b€P„wÈ¬Ó[ÐZÃ-
+I/iVl03DlSfPxRfmndXCM4VD6NGfmoRsHIFtRQSfB58FrMsadgRc1h+pqKIaKNcE
+c5TYcFOY6k4qOjTHLksTrs9kCP8TOVv/nlEQIeArb8qNnHJzNQ788iIqlM7Mbgkh
+xwHo3doAuckNOK0IZms+F/RrD3DWAOfagwxLUdmuwda6NqMHLZN9lvlkKadO7Aaj
+jO4WhNBF+t1bhEl9xogntgPND3TTWEN/RhlTCQF4PZteUhjjdIcxuELWuT4BDKEb
+XACpHsPJYMi/9IAOGTGqTkeIs7m4w8hFtbOLl84DY4ec03P3VGmPNBzpU1A9E0Sd
+czJgPMGFIGv76UqvFTXy87Nfkc/QNJ7gtOzmAuu5674kmVisMl67L/jk5pqVRgO+
+UyOf+A56Dt+224q+mgXOeMW/NdUDiVuyO/MC2Yai5H/w+sSF7pciMrJ0a9GFj+OK
+d5+qxsLOr3SdskIA6aOiFp2JhvvWDgZ4UIvCioCG7y1GqVpnv7K/7Tjn9y4d8LSZ
+nhpQL2wOTJ6sOQAQ5oc5lo3nqCv/QF1XwzoGo+L1UVR5WlsM9mJNoD+yN/6gD0pe
+3B45iwM0MpXy5N2qiT1Vhy39+Khh5vp40tPQDIqFuGvLAzRRrKjl7gp6QnegDdqX
+XiaKLe6uEkgyU80lXv7qDrp6Js0wGWde3x9ll07rqLk
+-> piv-p256 zqq/iw A3ojWGL4IKZCMVPeVXZKeWNDLaZUoVBGqubPRvVKjaJb
+PjLiZ6QBcaQlxeAcUqTvlUQ0yEbAp+1/0qlUxewVKDM
+-> piv-p256 vRzPNw AnH19MCu/ep73iwnA+T36tZWRNCcVoT4P59KQAKqj89L
+ztwGjBpEKOahU7XeP543/WdNzBAo2Lr+XU9QNtDf4zc
+-> Z$#a<-grease /+|s (q^%1!;i
+uAMcvqH7cObeEscVhea8W+PC4zYrAzOHZW+HHZjWbfhhUo6ydGAnV4JG9x9UEnll
+eHTMATaRlI6G1vjxYtA
+--- pwCLEHC9XL4kYGqgDiqio8iIKKVLbCdcUrXPAwwZeE0
+ëgís‹ÿSÊ<53>LZävÑP¹.g^AX<41>Í²‰Îà‘ÂÓ%+.ÞVâýAD\tÎŠKÉ-”éMØ¦€‚aj/AZ‰b¯tb¬çºDv¹o*^š
--- a/secrets/id_ed25519_sk-464.age
+++ b/secrets/id_ed25519_sk-464.age
--- a/secrets/id_ed25519_sk-485.age
+++ b/secrets/id_ed25519_sk-485.age
--- a/secrets/invoiceplane-db-password.age
+++ b/secrets/invoiceplane-db-password.age
@ -1,23 +1,23 @@
 age-encryption.org/v1
-> ssh-ed25519 8bHz7g TCA9KQFzsUWdpQJxdBdkUPMvikhRxDI5YQKw/eiXQyo
-yJurY58hHJJgkn1wbMzi+oEioC/x7ef2F/87BYWwSk0
+-> ssh-ed25519 8bHz7g 5XO7I95Ar7qL5JzjmfSjDMEB3IIph7CKWJP67u0dg30
+jq9A/szOCQbBk+cUUZv2OCkZZq8UMy7fu+BCQPbYF8Q
 -> ssh-rsa kFDS0A
-WHCED5d5DDUuLZ2+YjuAhVDLUmr4Ap/hmhVpkHeXtgISmtwL/fd7oE3PbY9YOnFT
-RXz8bP+WMNYIR02rGdMc0EoiKVrTnsw/4cgMR8e03+yd2arJ2ee0MUefhzVL6lD6
-ZGigT/yU0F5/F/tOfpr9ZZw+JB4ZC632MtAOtiZsuZojQe4NbFL7kO/ROkY8UELk
-P3s5VtKw1H1SzYYfzOqza98ViLFqxVjkqjXWcFLBMg6cWHHbsGr57vkVchz39NyV
-1EMs4/5NKmYaL8OxNpu6ijv6kOmXMRdBJ5sNsJvG1SLN6UT93Ng1TH+c7kih9g/G
-BMaKLMUmMDjPoqDAKXlWZiTsbmKzpIy3xINeLSUcnCWs4cQVwoJuqQXqYr1fo8w3
-3qzKz5bDqy4S7rzg1Rys7fs58dLv4/gfdhDuygKMuknHwIPwNxG1hN7gRYfJ1cl9
-/+NyKDk1yJY2WzDZJbtq2kmd0CI75oTqC0mSXoq19hgwG7muzYYfy07lhX04aJQ7
-G8J14WzU8cthqPHHTveEuZ49xbYoowhrhQ7dj5c2Mn1UozT0iLs4IBOShdvwJTQX
-xgtxUYRSJ36m3J1iejcUAEJhICPrdLDeTYrCmltDL5tFKCNsr6unWiinbEI7OYAo
-fGM8IIb3Tb7H/d0uIHR6Mi5Rov7FnJdKa9P80XK8vxo
-> piv-p256 zqq/iw Av0NW0dKHLamCwcJ6PFYEmGgMtOPRkfDfNIK5J0IVFgp
-bNTjApEFndNw0fv5TfgRE7oo8SbnTb219h/RPwtxfiU
-> piv-p256 vRzPNw A7Wdd008zYOl4VkCkIwkwoZm5cCRpfuL+7GkR4NW/7rb
-vRlPIsznRuO/HDFDIYsdy/rCHPlX8Nq3I8Ow5wC2L5w
-> X`EMA<C-grease `' ZiXT+55 0
-CYzMaxueNx85gcbfHGJszBzoF9FRh9Pf/l0q4Sy7ju4Uv3pKJg
--- zBdflctZxVPfiYZ5LKoqd0AVa7uEw9tuur2nfjfCQfc
-[‹Î`ÎrÏÇ oÐŒªfÞdvô×VÃivA)Ò+ŠÅOÌa¡d”> ‹X®óþzþV¯^kYZÄfJ$ƒ#!»
+GIK2g7tPYcFOTbz5TgXAKXutVQb1namPGw2pfzf8jabsgRlQbWXR9xo3TgySlOZC
+bpbcNs9LOkyG9su7R0Q3VB/AZYsp0mixfh0aAcFBVjh9NRA989vdqaMzY5e3K0Rv
+9opc/YYdwSagHfC94BbwP6T+MA+3ukpm8tTXRudxZGzjRa7a1FWsBjHipqfUqGPT
+QoZRcaVW0lBdNA+H0rcwcYP+vGoHYO58fkxIs5tj4//uxasyYFRN6k1BsePh6U2u
+MiEaotlCoUKTjJMIh6aBArsFzv/s+5i8VQhL2YXzqCCk0hg1EyH1B3iHEdEwSskz
+xNQPq6sgDEaAk4K/qSFKLseen8DWFz2AL/4jhEL8YZLtbIt5nwg0PXley8M0hjV0
+PitQEfJuhyd9HtF0WdXY+DjnukeXDrBqfPZcRLZPvazxSqo4xnBh3t/39GFh8Rrw
+qj5sJ+shK7SnsbmDG4bNNrYDh22RfxDClInn89G7NRfVeYlqyswVh3cpNhHLTsGi
+ucWorz5NFQ9QrY0FnlwQjsW2HptjhP2ZZtCP1AJi8FQVg61W+MC+XumaFLhEa40c
+6Hn03r4cBGS90N7MTtdqcyoVIeggEdufI9vtDY/lrfhy7/e3I2F+XfuzmR3vORqs
+qEmiHDzH/SAD/6aSOxtXqTKu1m+LfG4c55WhlInM9HU
+-> piv-p256 zqq/iw Akln6P4WFprrCdthyn9HDY1GB9AA4eyBoE33TvAbgE0X
+IVENAfkcJCeJo9+Wgt/5kZD0y5bwQsefxN9MyejCbZs
+-> piv-p256 vRzPNw A7GkomUc1J3NsSxiS/HcyCwoIxU5rr9yqAGGFWHP1+yc
+bXnxRzxyPfa3LWq0uSJONl7NXKR5wo3/xkib9w2K2oc
+-> zQ/~=RXm-grease {kc Z
+xgcrCpjjb1n9hFM
+--- dEfgvftiM5d+B47Lyg+Mgqp6mt+XvBWFP3dIy3p7Nfs
+)€”4¡Ë÷fs[õ¥à®ËJ?Iº¤¸ãDÁIÀèÕ‚
æâÌ¢ÁêqåS7·-Ue<55>ùóåSûmÄ4z<>S¸
--- a/secrets/invoiceplane-db-secrets.env.age
+++ b/secrets/invoiceplane-db-secrets.env.age
--- a/secrets/mail@b12f.io-password.age
+++ b/secrets/mail@b12f.io-password.age
@ -1,24 +1,26 @@
 age-encryption.org/v1
-> ssh-ed25519 n71/yQ EyjzTXELrxtUfSmmQhwUZiD0YNxYIYTOMqAyvVbtfA8
-Y5LHi7e8Y74VekBdwiOCrHMhcweNYjEcTNQqgWnqSbE
+-> ssh-ed25519 8bHz7g mhrNQ6X4FHzNvLWypw3zx0ckYU0t8cBkjl07y8zhSGE
+EZGdtwFYi3+LEZgv/JcV2K4qdypFq15Gguxfs18lWTA
+-> ssh-ed25519 n71/yQ bZ1/2BHLKcNhD8EkkojunsFOkag4cTfE0L8maeLxyRk
+kctlXpT7nWdlcDlBaHiEyZ8AA9hlMbtAhjYHYrFtSjk
 -> ssh-rsa kFDS0A
-CQal9M6tSnQCNps4ZBr2F/rYE8fP9EYZJiJ7Vto5EvaEgHEIUOc6T7mYfGnqedHW
-a1pbwIRGEPS/Q/EIEZ5ozQy9/mcWrCpOqthty6jcsh6E6mScnUkq4p4xd2clrrK+
-fddLORVeMUaRhm6XBDsXwZHebto5MG3BXbGKMBpMGQhng6EtTRILFRsFKpp3xWRi
-fVuJFThjwOV4rukaSUdL/vBsIOOlANUSsxM3s6lzwho+kvjHukQI23IKMiotO7Sr
-s9WBOypT+jf8IOwccPcfZI2lYHVZFlqCYvskxCQTpiVNasSgSyCJmHP95UtR3hxS
-Z6RM/4HxJ0bdQ8mqFNIxsGcrIkQoIyVT9gP4vhl0YpAWXXzxbdV1zqBpSxPWsFH3
-iLfvFGA2iWgLUzedUXMtZhjeeK0TxjG6edsYFSYW+mwzeYCJYCHH2MYjharM/7Js
-rD5MqvMfF/bVYXYgVvcAWYcLWQ3dr6JgCrVIZ75uBDfhWAy1/cP8QD6U1jZvZn2d
-qr6YgUj4mxIgVYNWsEuT0+2z4m+lHw+AoYjfxk7a7Zh5RP0zfvJF/BbUd2wxJoIu
-/e/2LMo11GtLniZZTGEPeZX/ZT4GVhCpsziIHkLDsUY4ouT2KIwPaJeaFIcEMrHN
-RhKBpP/M4e2or7qYCd03+82zVyaLEEbdgEAME9Yk3+s
-> piv-p256 zqq/iw Ax5JLfx5M3ql8P6HsagnQpNobpuJKQzd8Cv1sQb4RpJ/
-ADhF/v8/sa224OTQw+huQjxVPnE0Xhg7eZmacx8RBlg
-> piv-p256 vRzPNw AvRzTmKw7Vd4QNnyeE6EDNRzcD/foqg3Z0KUnLd8pYW8
-fcFUmbUPBveQhDKLzSxeub2Tlmn+qoRfLEOrkJBEcUI
-> HxJ1F}Yi-grease ?sS?y7_^ MO
-1hmMavlruAyT7Bcoj01ic18WLFDczHdw0cWgXxVz38+/5cHh7dDwuR1qS2kADHzC
-HfMAwvYn5RJWY0PTUoqTQArsO+lCeb4/
--- W31vgvWmpOGbpFdGyboh5mQ3VffIGx/FUQ1uYR61U+4
-o)Ñ	&ðÃ¢¬¯•—Yô$¼Äª<C384>@áŠI«ææQìCD6ot%6{ö0—¨§íD€ÿËÇ8q/þoÁ<15>›O§<0E>¦°-ª³®n¿˜Ö®<C396>yø{¸NÑ¬Žß(uiÅòÍÉ¿€±WP,´
+lgRrxLpW80twjIgj8dYi8WiaZeDW9nbOK1PwIFn830H6K3uD3v/1+UlrOmuOLakV
+ANRB2VNJlzXgWeg4+VKLc79qYmX/9LhS46QLrzENx3KKKyXyBqf9F7XCbHu0J+95
+Wt+XA/+OTy288AmFgO8Qa80WNZce712Mr93pIyfczisyGf8IiMCpR2ul+4HDwty9
+c7Q+rfKZixaIJ0ybRc+vepV+qovjgXaPU1nFtb/tcCWmxA0MO/zrltYmor9GeD5H
+seld4mYDdJ+HmrQMkIAodA/WRrm0woKXk/RP56OOhp/L/wvGJy5hKb20ki1+u5l6
+MIbcPNuwp9rMs2G6Yjv/Vt+pGpChxoU7kB8TnK9iJkn4RT/gGi9A6/xocC+U4/OJ
+Qu6zWs7M7KNtn4m29ZrAgjeNVXMOiKvP89+B0jtY/DR0lBu1fqhE9RjNQ5Ns8CBD
+wsoAO0wsi1n0QB/EHYabph6itc+jk2dA0DDqj2H9DClq6YPLRjcJfWgaXPpOtJK1
+5+rOwZHJ/MFXDGXJW7D+ewNIbuM+vNO6GIxYLpEcoyigJ9rREi36yIMo/qASdkWV
+KVJ/nMHxf8Tu+BrgtMXZ2YPV9+2Acmdh7kNaHmWSh7qJKHUJA8TyRe3jZpAC5m4v
+bDUCcIYTvhdfGMSgkxhyLCrPc52isfEG4YbEHsx4XkA
+-> piv-p256 zqq/iw A3VtBWDegSqGY/LyA/C2GEzxd3+NE5MBaFyuJzQGuQwy
+KtUPPP2PZ5ZaTYq2XPNR2q2JOlxWCdoZ4VXEeETEFME
+-> piv-p256 vRzPNw A2LMV/ZownRHylZjThU4XjrXi/FTbO5EIpcxLiE9/5or
+hNa4N9vuMsEI6yCtmT1qYw/ilurNivDqjf2X+Irzo4g
+-> c/-grease ##C EpP`;[_k E=V56~SX
+oyCtZqWQ
+--- E1vLmVyXPABdiO+H22tpBRP2x/tdM3Fj0rzRLrrYTaA
+½îŽïN¥7ô"ç—W0üÇ‡D¦'‚J/5¹îí0ÓÔú»—±W¸CmŽ”dîv(‰¥#‰Q<0E>N)Ðñ„‘@UÉý
+ÐV¾ÎÂR/“Ê#‹û•¶ºtêŽb…Ÿ¿L<ÜšøÛ<>’T
--- a/secrets/rclone-pie.conf.age
+++ b/secrets/rclone-pie.conf.age
@ -1,23 +1,23 @@
 age-encryption.org/v1
-> ssh-ed25519 8bHz7g MmZ7fmLyYJ80ByhsPMjCsFnfYrYzkI/8P2IDTtydFXs
-HAfkn5/Za61+fJG1c9babFbnXN6QsnUtbjC4Ctf72qQ
+-> ssh-ed25519 8bHz7g 5tX4I9C2sqQ585//XBKPe/5wUGXS0II+VJpgmFD5JzE
+TFYb+9V1S70PI8zy6+TbeCE6Z5TxBtvRx/0s0cHNpmc
 -> ssh-rsa kFDS0A
-WgGNwmUZgFtD3qEGX/HkZMvHifYV6Q9cgMYQ3H8OMdc9e5Mil7gcnhimygdoYzIS
-zmWoS/GgwiNlvJmTEd/5KhqdrJ7blG8YoU1LKECwnsV/8EhJN6g7qKFgrDuwtlJS
-Yu0UktISAyV1CMc/BhiBPe7qcd45CKi0++HDFTUzGpD30ljWHtsjmjc7UJQZ86q+
-WsHG9+v7YELUm7dWuH2XMgzg0OCNw/zgbJzQfat6D1RC6jY9QC3xjYqjHJmkEK//
-nEOA0z2bAo3fEQc/ud3ZCVZ0mF5k+nVW8iKNGftUwzSoM3nQND7+Yn8t8tQVGCA7
-dYXlcTZjPToL6+K1V21fidsvMD4FKbM7eALMS23OF9rmG3Dk8hsmL87Ki+13x1Eg
-3yVXWMKxZNyNwWpsYREf3v8C/RBcfr9n8NUrwl0+8xbOHY5Bm3r1Jqi2mvlTVeyY
-PCJR/eh8VLkYN6Hhn0R+F1/sS0o80xL/OfyjB0tS9wxApyScdyr2PIaAlrymChUj
-APrsfd563/W19md86Nag8mdEQ4g2sICK7gO54anJUUpNIj36eEHJaN3SpJ1DX1nI
-VG/plVWBYqAR1+vr29OsiME0Zoxda8Pgp3AFVhUNU9UF7ZdOmr4SzMwctATUI2AI
-UqbDV+hnoIxvcVYGre1kCy5ASPa25FCLSKnzs0l3tMU
-> piv-p256 zqq/iw A0JYniZBQfPoL03FGWLSmErb/kPFlqGpJwleWTrACS65
-4MRrwXl9OsGqboRBbLguoJWEpxJVKThGYhHquCZ/rnI
-> piv-p256 vRzPNw AlgfAIkQxA/THKii8h9NLcy1vBhadoQWiVpXXcQEgUDA
-wteqtb2terIAUAeAx/7f8j7mNP2fYA5DnR0rQclm+3Y
-> z)1b)U".-grease
-9w
--- OBHthG1RpP739pjH0sr7z182fmOUhgmHv1c/ZBL2AW0
-Ö;láLŚO›Ą©>™®ń¦S…S˘˙\X<>Ş<DT`ál~k|›ŰK˘ŹR¸OkßaÖ=ćŘăíĘ7Ď Ż1T¸|yČ%äÜ™—¸wçXöEóÎŻ‹šiké÷ĄzĆč’çj§;§Í‡üaŻĺHáŤ-äKY»:ÄôÎ§—]¤®mĺŚî8°ť;W”56[:ď€ÉŃď°p¬eaÖć:\&‡ŕ°ŇáÄ_Ą®ő<C2AE>« <v¶<76>hů,´:”Xč“$†]?gO,¨˛P;ęîDaŮiäĹĂŹÂjĆU¶lÎ
+Uqbac+VKWOsIJ1WslFc68Y0aNs4Qqd50f9uUY+u+VkudQwGUcKrLeYASQVN5XwUL
+zFVw/39N7AR2giA9n/LEw683IZkjdhJt02Tl/soCvRNncCIaJw0SAfqoJVeQ2N07
+gFjqE6QYmh4/5DOInRayzOvxrDucz9ji/iNMwdXCNAoyTQzKf7EiLbtd8CKwnONx
+HDSj+YXTNFygM0kkRgcH4psiqxAJ/io7iXtmWgMDMn2Sa+h51b07KPax9qiVi/wl
+zeHs5Sc0eYnu16kPg/PN67PrVliMeOg03vBVR+tELDslmkObaZ5RVL76U5sHYgV3
+lC+i6lhRe2Brq3pusidP5fbw7Wpf05YnbpL0BE6C7xPa91P80SWYlCLn2+hKBZ7z
+YddOHSssfvlf25UGFt28FiSGUjbr7k24cV2tXgRcHlY2ObU2uQ2xgzPxGaFgtfSo
+bk6wPrH9dB3iEJIpSY4u9m3PgtNEKBknjZodzrE32Qz8Ffgut5NQ4oKJoZ/lJIu5
+KB8a5bsHfzRo95w3UAK4pb3MXjMY1F29lZZ9PofEuBDg1IR9x4aTs2RVp0yruAA4
+N+V53t5yUz4J1umrit5lGuE5TNxJyJZ1Med0b1z2V/A2tstVHnhi5WQX/Lvkd4QQ
+i/2WZfKC6xwdpdMUeBEeImzyEByv0ZYcTeJg/uyXEME
+-> piv-p256 zqq/iw Ar8w2iXTqd8Cp9MrNSBcx8F5R/i/LLO3+tbxcEeAaxQj
+K0fpNGKdieq5PdsUxkVbWvv4re0tbfJAvA5BLv3NXng
+-> piv-p256 vRzPNw A2cvMzMyWqr3x90irJ2UbvUhubHrSrWxOv2ufZxq7Uss
+RaBcEhSGlI72W9qkM4d73tLW36I85ezA8qaMuZ4gKeU
+-> )*,2-grease EO <n O26t]ur m"^s
+uS2pF4qN4V01mXD3V3z3k8fHRiXcWeLxJBJzl3NzbxVonHIhvfuF90U
+--- kA9nR0Nzybv6y6TFkN9R/8QkDj7DMF6sHAHIgPQsPMk
+ÎŐô:8Kü0P=}u•`E&˛e#[<5B>_ ,ĂŮŘĹż®”e»hrµz@_Ř–°nëŐkŔn=ś»"Bm …‡zhI)é<>juéQWC<57>Žä[33  dx‚Äńµ—-ŕĄÔ¦ůuPŐ’[z2_)šqďgNz·ń95©*bX!:†#ÄKC}ż@cg¨yĆ9CŹ„©Ě/˙ĄNpwú}ŤëĚVŹáĺUWA”‰	äß‘ëÂ;€DjJUłnW‰>†”˝éžDŔnLľ9˘śÔ;73
--- a/secrets/restic-password.age
+++ b/secrets/restic-password.age
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@ -71,6 +71,11 @@ in {
  "firefly-importer-secrets.env.age".publicKeys = pieKeys ++ baseKeys;
  "firefly-cron-secrets.env.age".publicKeys = pieKeys ++ baseKeys;

+  "authelia-storage-encryption-key.age".publicKeys = pieKeys ++ baseKeys;
+  "authelia-session-secret.age".publicKeys = pieKeys ++ baseKeys;
+  "authelia-jwt-secret.age".publicKeys = pieKeys ++ baseKeys;
+  "authelia-users-file.age".publicKeys = pieKeys ++ baseKeys;
+
  "rclone-pie.conf.age".publicKeys = pieKeys ++ baseKeys;
  "restic-password.age".publicKeys = pieKeys ++ baseKeys;

@ -84,10 +89,12 @@ in {
  "wg-tunnel-stroopwafel.age".publicKeys = stroopwafelKeys ++ baseKeys;
  "wg-tunnel-droppie.age".publicKeys = droppieKeys ++ baseKeys;

+  "wg-pub-solar-stroopwafel.age".publicKeys = stroopwafelKeys ++ baseKeys;
+
  "invoiceplane-db-password.age".publicKeys = pieKeys ++ baseKeys;
  "invoiceplane-db-secrets.env.age".publicKeys = pieKeys ++ baseKeys;

-  "mail@b12f.io-password.age".publicKeys = frikandelKeys ++ baseKeys;
+  "mail@b12f.io-password.age".publicKeys = pieKeys ++ frikandelKeys ++ baseKeys;

  "b12f.io-dkim-private-rsa.age".publicKeys = frikandelKeys ++ baseKeys;

--- a/secrets/u2f_keys.age
+++ b/secrets/u2f_keys.age
--- a/secrets/unbound_control.key.age
+++ b/secrets/unbound_control.key.age
--- a/secrets/unbound_control.pem.age
+++ b/secrets/unbound_control.pem.age
--- a/secrets/unbound_server.key.age
+++ b/secrets/unbound_server.key.age
--- a/secrets/unbound_server.pem.age
+++ b/secrets/unbound_server.pem.age
--- a/secrets/wg-private-biolimo.age
+++ b/secrets/wg-private-biolimo.age
@ -1,23 +1,23 @@
 age-encryption.org/v1
-> ssh-ed25519 TnSWKQ MvgMl+dFyEfv2YIu6KUXqcCqOHCoRHCzj0xuBBUFIDI
-HMe1r4Moc3oMZX7J6fF8SgQUZyT5w7Wref5GZDfJ0YM
+-> ssh-ed25519 TnSWKQ ZZCY6VFZ7F/e7Xv3ogmlHuzQW4jP2hsE8ABjj7kwE0w
+SxtLCTTNj2MZK6zN84W+5QJIUWBv4/seo+9Egh/p9DY
 -> ssh-rsa kFDS0A
-lISWipj8WIOebuiGowBInUllFi4As3ORTmhWPFOSkPT0Esntfy3Le3L99XLt8opc
-II6uaXsyIPEPPJC/GQbWaMo9iShOzQj8u7vMiiR5IJ7Lo0KytFtCoOf+lr/EglUf
-IrfcME6ikzROdq574vF1pwqSwi0M6LbuITtmn1yDfP0IFoEMT2qAz9jg8DavrytS
-KKmsPFno0G+YNYKZ5w4khQGyS99YuCPPUw/phsbedAwuJZE6gyCp+TZhfbb85sac
-vxr3NTz/2/qaq9tsp/pzLmomRiBo9sllEh+aiA05V7b7Tk3yy1Vxhg0nJzvXI4Ra
-1iE0CWuFBWxbZoDuQm6IIUYjUltJWKZwcyBh03qlHter6FnqaCKLkGivcGqzQnTU
-hBk1uxig8sCm2cka2iSsHOahNNAEQ8/3I7zGe+FD6EDAHtid0mf6PuVsd7AZDFao
-jiaSBPg2Z1Ua3g4vQJ/qDexzdqcSlPFuKFsxBDr7pbvdPadFdoaqA8B73/yAwei6
-WQlC1uX4k43xY5jfUxQdy68mOZlXfdVpVZm3057n1zuETU8wzs6D6qviG6iYO49o
-yYVEEu65qf9I4j5XJW7DZpAOqxQiFQoDJF/BIx5RUPRPiGDxa4cbWbNqeynMmay/
-aPW6mDSlC88prxVmQCM+e9Gz1cX4q2pCGQifhySRpWw
-> piv-p256 zqq/iw Aq5EJVFwPV2JDR6a6ccMAKIqK1cUrqkW/hzyYlfm+3aw
-cBbqGAMZAMmMQDupnpWjMP3wdRlHJYuYVB27KQRS/AM
-> piv-p256 vRzPNw A/2NuOBEGAfcgz1hpdfczkvzHiEVRhIDf5pgpvmS1cAW
-GBhe63VMOE/eJa/noLbdKnNsRx5waCGzyGB5ZnX7xl0
-> X?_ri}-grease sSvM-a H{(
-kZ/yGjI
--- Sf8MIIUDfVRIpOezOiiSyeR194CK0wtQfJt8dk+1+YU
-O}s&é<>9s
<0A>½(i>‹_gcw0þÔ’WˆQËBØßk\àî~ÇžöM§±Ÿç¾²E†¯²@€b—C	õ}'å_2Î¿Ày‹¯f
+AkyCC5oL0s+Cab4CLBERbHPc1Yhvpgmt1uErlAGWp0ZRKnksAf6XKlLFw8/6z5oX
+QgI9a1WOC3K9X0GvOTuhoh/m5De7kKzV1RFMepVB4SlZVRj0QZUO4fvr0auUAaEl
+Cv1DUkpHmLE3ZpIPTxSboMqLsZOgj+Sfas3X/Fc/vTDPCir6iIU8wlYQ8ZNYxUq6
+RDvmbl//nu83J7xsIZCyYCTAJb6VQXk2lNz2UsxE4BRKkaCQbS3g3IHbk6oV1Gwg
+zTqiqLY9kgIywA+vIqIkW5El7tCfyy7gN6DZFqu1vTD05M5i7UqHLkpy+rjo9X6D
+gjhhmMMwFea9mSGFeF1h9o/IBFmxejM2sue2R6EESRPONhdGauepZQHbYEFVDmJZ
+yczaWBiSmsayUHPPv+7Cx+OaCc/xCWyPiQPgSj73sijIw4o4SxOBluPpY+ECpj86
+UCX9xpDApuWjgvo3JIAQlg5MaQ5A6QW/UqqrcpfYWR0pjXnL31R2yQ0hHauO1Kvm
+NB1ChPxjhfoDkHi+IHIuSMyfDM18OOAmSKtZRMduy8CpRcp4aSCf+NRzpus9GjZF
+2/peROnKg+YO3H+EQ1to/niD5qo8Jj0nKuOME/lOyY47pNuhua3PBOsXERBN/qMP
+xJZy9hu3JQdm+erMIycMvD2tdkmrfPdoEIOijylUZcA
+-> piv-p256 zqq/iw AoIiwAJbykVEoDfDNxnx3SHgxyTrbVGCbo6kIiHNIO9S
+RHyOsqM3z+OE0ZLINcjfioUX6Jjm8qdSHvAnAj8QGAE
+-> piv-p256 vRzPNw Ag/8RzRTt3Qsj5CaIGM4GAO0/6acQQaS9ZTKlYLRBAkx
+QF2QTPL6k3wpsWV01t0O42uPzyEODOBrExT8VODMrYg
+-> R&03"-grease gka3rd@ 0Rt??bj
+Jr1XNmLf+agpBDOtsgYrW/doH8/M3oG3Nv8hrngyNAZuoGZyO52HTxwim1Rg
+--- q9CQR3Ai0kkidaY5S9jwnmbKY8qjmY9z+CdNvreAGc0
+§{K¶¹Arv\²
óH¢:%É:›{E·)Ó}•øÒèˆ¾ˆü!²¸ iÊ§‚N+€·5>#AÔá¸Ê¯Aý®!%j\Å7r
--- a/secrets/wg-private-chocolatebar.age
+++ b/secrets/wg-private-chocolatebar.age
--- a/secrets/wg-private-droppie.age
+++ b/secrets/wg-private-droppie.age
--- a/secrets/wg-private-frikandel-server.age
+++ b/secrets/wg-private-frikandel-server.age
@ -1,24 +1,24 @@
 age-encryption.org/v1
-> ssh-ed25519 n71/yQ GCjoVuL3wJyWCGApQzb4oTmFR4JzTYQz+siq3ez0bwA
-QukuwR/ojojKApg93QAy/it1azMikIMUdYQY0O3V0ok
+-> ssh-ed25519 n71/yQ 5haGtuX0lE8Y/377A4juZy+6B2EKF29cQv/Vr/YYJRg
+SF/Qg5iRR+5eLOa1VA2bDaBeuIpmt8wLxsqGCjlY3hg
 -> ssh-rsa kFDS0A
-Q8i2LTfs9SXNtGjiPJOGtrmmpUf/fDnBDl/UbvS+oy1m6qlsb+DLsaTW0G+4S5E/
-19UsEbcswwLAob76e5Xfik/toF9MmoCiozkbNythX0NOf51JvinNq8IR2QcCxk7n
-v3pwGW7TZoNa1H4hqopBaKC8xikXAGfjd/LUmIGoN7mCuSs8Te8GWT8HCmazx2M9
-R0mGZGnvTp4/9L6Bl1tU4+CZzFUfMgBAr66U4zFFjhamVO+FotdGJRzEFpEt17NU
-A/rhwBF6bPUHR2WdcQjJy71ruiQFTfUUc+Ws3WvBYV+R5eRVEw7bYZWKRCe/zU+x
-A0I3gEC6pSxAuIOgmYnuCMk06tXoy9WtWHyUv5BQyoJGO1BJN88MgZQr0VaRkoFc
-n/BZH8rpPtdF3N62kstgqFW8wb9PxTgbX9Tk7vVD9m5oH7n6G7WS7jzcRJmaW5st
-RPBIDv9LSjV0bPjkxiJwnKFMRcPxas7XRff1rP9PAPzPMfh7hGtuNBb7F3xnAfi+
-39dcFlopZwO8EJ9KKLfuvfrFeIGXA0BLk6MZQtvaqO3X4wfuKI2lAJXIntEZ232O
-0uspNbWclEfYBTtqjNC1Fl/82LMw98pnMc0rZCWMGbdYkbbcTs11YCx9+Rr5fJ1S
-7+zgiSpHbqFOPZTSDOyoik9R8xNfxCujuTX5Eytg1+Y
-> piv-p256 zqq/iw Ahm7w+8aJI9u7+NBD6b8zyayTLRF7ujkT6b0w+uwXMKb
-zJ0hX4caWgn46jP2pKHus8n7TwmbfKrLVPem827z974
-> piv-p256 vRzPNw At03S5XGlmgectJStVi1slliR3NT0NtgrMW/QqyZ2n1r
-llyEfJ7s7082OgfltW5VJ5rGWvMdo7IhM2fXjEmBO70
-> ["|3O-grease ZUvxX)_l ]PU+\ 9aKH
-7TGRE0yQboWKo4O7pO9mkg/7QiYNmRq48pKZsyn7T2Vyu0AU44hM3YmvUYgleAt1
-d6ODwnaJQIuwfuY5Mpwaeab7Tg
--- ggsgQyrCG+MCWJZerT/9sbV02BwSDn6Hzo3p4ZzFf7Y
-#ý×3–@VG¾ŒR¨q¶Næ'W@¼^Éq«RÜBìc^"xÙ))ñ#ý¸__Û€<C39B>"p_D¶ÅU,*]¹FEËh³ùùÜ¦në
+Gc2/HAQZonZvzQxit8Zc6TubI4gJHo75S4PF/gP2/ILMK9xh6Yf5m2ixjkhFhbKk
+eh6VEzoGX5kkPm9SlmRVeAlE5ClSGEG9mqL4wcBtKhUZXXuvhaMoaJOlphZ9Lcgc
+HFi/qxyp4WE7v45L8FkmYQzfhypqPC4ef/I2bG3d4EPoR3/ciPD/fdTWnlA5vx/a
+9Whl0RjuKhSpHzl4miA19s/p+gEjn+d6Dqaf1EPgweEswJXAKtHt1tOp6q/pl8g
+3T810aUYkbgBopIso+U0HX94VK7gvJfeIyRk64P46IMo8FHJhutxca8pxOWF3bbC
+QqhEGSsRk7MPT8iMsGMW5SlA1Xw0pDwKINR8BmUWvz2yf6NzKzoK1B0uAWHadJip
+l5MpiTbmMTBc9ghIkIvxFKuufp+5Iue8qCPtg0j/Cq1Owk9BdYXdia9H6mAYtLuA
+5w8d4G9vBSmVb5K7F9pJey8lqm4KuRpnDGXBI+HIeDAWHyhq0/isjHDZGeZ3FvWy
+2Ea3ZYim0Msf4v0vZCN/T13nGFBOuu+2ExCyV+BrsIkIygbJuiZnCargMaOUpF1v
+Ze+fnZJ880l809auvW9h8W8QFgWPojfWgfT32FIl0n2zc71rh1vvGKL0cgMRUbyA
+3A9NmNcRMJ0SqRWTyrP6RyIlmzGJqyogysO6JQ80tVU
+-> piv-p256 zqq/iw Aux4+LKkxM1KXQKvCDs3QDXV2YtcB3VhGlhZQhzDwhXc
+p3bhhl8Qzb/1sl4xN21II2bQZAB7kceycgh/wWWxAkg
+-> piv-p256 vRzPNw A3kJ1x2AIhPI8c50iJmRPk0d35xOXjK1h3bgz2cF9fPq
+Aoa89fyn0sajhhDEE85p5qsPobNsOQvnszrfig/LZjo
+-> I~/\RCb-grease c
+YzIE557DLZ8ZoQhpjHyGBFomCTRJ1jEqoVF439fryRfDDKZ4QeyH0dksrtw9dpcr
+NAinAHlKafpv
+--- C5OQ3a+DqiWJc7455+cMWnZN9pGdVLqW/lgUZT5oKOE
+¦5'7Õ€fÕÉyW<02>šF•¬ÌûýœNJkí^È!1r7ŠÜ3¡_ŠòÚ#ˆÄw·NÆ&³<>”¶MyÄ”†¯ê{óKti6—…flÕŽ®¨ð
--- a/secrets/wg-private-pie.age
+++ b/secrets/wg-private-pie.age
--- a/secrets/wg-private-stroopwafel.age
+++ b/secrets/wg-private-stroopwafel.age
@ -1,25 +1,25 @@
 age-encryption.org/v1
-> ssh-ed25519 b0WFDg 48BhkqoqtL6p2z9C9L26Dah3Ki3lV6+GdH6M/GJHRTA
-L9lRDtdNm9Obgl3bdwW7xdqmkHrfE0RpXQ5Aya7Fnf8
+-> ssh-ed25519 b0WFDg i41DRugywwKhguvvzKBwHiy2g8MWhWkv0wifid8hcVo
+iVniMGTex3MQFp+lSxxDn/2IMx587tENmXQv2lcH2AM
 -> ssh-rsa kFDS0A
-E0LvaebGY7h/A+KwhFN61rq0Is/X1l3bwilTCdOg8RWw8Amp5fo1OBasRHL8hhOn
-LQ9iJii3kS9PK+cMUvg9hJKwPVH7b9J4N0gOVGXt8ggkG3LXwymrjAV7GYkC87Xw
-bZ4UfWKK7NXl6jWvHc001EP+sAEvYbLv7MlZZbiugT3lbzYF0HkBIHOKzNDq9Cp/
-wQn3dBj4IOffys60okp2CoMSrz9Ag1wst4NY757lItCY7e4KlM/3Ap+K2cYGyWB3
-reXN1RZr8mh6L2SmQm3oLgvgxQ5H8UviDdMIfCBPMSpPJGEIr4r15aA3o6QpUbOF
-UzxcaECCt/HrJMjb7tKjI4NhbF1g0Ac19ri4WSta8ttgertIlmvzOOoaY2UnPo66
-FBTDlVmdeg0XhTZFwzvYrUcnp1SEA9qLx5OrFOGTd+qZlhIqSBQcTQRtEmh4SFjs
-2NEfiqzP+8dU/GziVYSL+RCdiZBnwSLeHF8iO/oLCRyZuhB/nFj22Tvt9ynanLcE
-nXGO6dIyTBbgTQrYKL3/Gnl1kQZ4MHAdtM6BV9FsMtbc8n4WbvjVzycRV1NYXWHF
-zefsHbCIZaQPvT1DhSGrajER5vRfidq9QPPLxPdf5PK2CB5tjWTALNAyO1PXKPGg
-1QuaYrVl2qVolYfF9P1P6iCLT58TMIULMXs82TAZ3U0
-> piv-p256 zqq/iw Awl8WkTsqKq7wkHmZIa45/eGBMX40k58Z5finBgWdmRt
-uhOLKTrgCSZReNoApKvM+jKP7oMP4N+TMgZNWSeaI+Y
-> piv-p256 vRzPNw A91cNaGQBLNZirxPdXFPqiHFIXJzRNEqxsyvmJlQTS/4
-Mn4hCgrtE8s4k3JGNkMJbGS5qt0sPHeMsxueS05QtPE
-> =-grease 'Y p1tQHZ F8 'ZDgWD
-WkH8xo2vOcIj912KR4aIjHM2R0XE0Q8y40nhhCUf1CKrxsGtzWtDceX3J9PTf5lC
-hLXLeE3X3Ufkro6lmSLqTK/LxOi641nQONOuWjOarMmw5BI
--- N4foRnruFO0WBsBDFlRpqzWYR5ZmDfNvJIXj2ceSnns
-pÎ$xtVé>USM_’Ë™BÁ3¦c*o©ø‘Ï÷â¦ºeKßsŒËG™’qÅ$o
-‘MŸÚ“M^·c.Ñ¹)‹¶‡ƒ5øõ/û~Çvá8
+WcaL8c1+HAU8Fjd0QPdcWvGbAVTUgkxH+++5SHkrGYVOW7tsdaX7e0nVTKuIWa5s
+hPPEqz+xg7XwVJtbmqV7CZ1r/gRXshC1epTER9slKiU+o9XdMl7mVOpWzROQbI9M
+6ZpSbWUHenmZ4v5RZFswho3EkqwFJJQVAaD/3BQVOY0BYSaC5mhaTpsD5/s/V+1y
+/C6sSrJ5STGc1ZQ5rnvUId2qAZCrginNWmh0B9QpW0hJugKL6xOkCdJGiFLvQvFW
+vU5IO+GDl/B+bsIPDmzRqs3UUuErs4rXWLasV/9zHXdUpoeFXTKCoLPXlhK3qVQb
+25xmedaS+9s9tTd4Lb4bI5kHvnINAZa67u5VL0o0azHLy80pCJeOSLzYaj4E83BW
+tQMcPuCG7ViWn1+BEnB+1c5GLBFAV2s+krJz2LaayZa4g6o5PlSmC0wU4r8Nw7oG
+9MWay2CPbbfM8eu+JKQ0x1GbZHUmWU0xlRWuaQzc0yYybGVBDaaaosJztQnIOzuH
+M+EzzM6PPb6S1dpYIOhnYg8Bpx4TNmJ7NJk0d93SYd+bcYgmFqU/8P23fn2QCwow
+XcGarJiDRbqqs/Yo8rSb31ZY3MknJjaGUJl4YaHqqTszpGBtg93vkTecXHbPpZL
+D0nim5SwvwIPLSKQLb99AJrmRlZpS9APxLv2esODO7c
+-> piv-p256 zqq/iw Aq7821c9GsIVELFO0/Yi9IT5Bp1prVGZYxZRrVEc5Tri
+uA9BhJIwHOJIDH0DuVpz2sY0i2k67puvoC4bApO0uGI
+-> piv-p256 vRzPNw AtnEI2530dZZBQMrfTiCWzhwsGrl5JMEX0eqbXnHBQ06
+T16WNIdFO3T3V6HLHFuNdgWDwvtc5Y8CB/LubVg8oTY
+-> 5dkO-grease 9.lBvvN 4<)myIo v\)S
+Nw8ymlLA2sTovBJdp9P56UguFS/TNjqJBNfJpkLQI190joCiTCLVbWuM5km0ZbJ5
+0W4ATKVgRHVx1dLVjgQW
+--- GEJeyoaq6XJ9/HBcAstcHTuhj6JiyB7QAV9IwJqfRCo
+§Ó<EFBFBD>8űűť{HVŁQB?3ApqčŰ6tń7o!9Sżł<C5BC>ń
+Á7C)@	Őtatc_ŰpjŽoŔÜĆńý:a¨‰…çĆ‡seěÍ
--- a/secrets/wg-pub-solar-stroopwafel.age
+++ b/secrets/wg-pub-solar-stroopwafel.age
@ -0,0 +1,24 @@
+age-encryption.org/v1
+-> ssh-ed25519 b0WFDg FVT9AEwFAJ05+ximaSsEIdfW/HD7ZvUUFwwB26GDNQM
+sWo3Cewxl6NFyj6+I5fFRv675ehncRsAA+oLNzO2jNs
+-> ssh-rsa kFDS0A
+gJiz5L1u7Y5UPeH1dcjkHOhMJ38taEuOt9tkTc+BRqjsGN50rW/gtJuJyBMwI3v5
+odxVJcWgp6uZMMJdTN6L7e7YRcDbZUbbKYcnQbuAE3mb1y0WrZLRbLfWS7eNTB3d
+CRNeqfVn7Tg2e/r2kwLWmZb2HdMn0t6Yv1adPkQ1kkmkrzHPfpgfxdyxZ1WzEOnV
+g7WgxYw0mmLpnN2n1PPSSvAn/v8u4sj+7vMszoRIEgyVSRwDxKGR3qo2sKchSeUD
+yZX56a6AJgHHBh7wUjURVd90HBzm4dKbC8zzir0ZygWGVrNf2ybnLPj1c7Hl+zlW
+up6IwIGplWDkQY/fix1wVg+KBtphLkTVaW/3ZuyOu2q2JC/Vnprz1BuPpkWUC9lB
+9RW5NjN8P03h1rPg7USPnN2Pyrc63pBG55fL/Xaohk8eedD65kpxuH0afUv7422t
+95iG0SbEwAokJhTXkSDN8zMMxfn9c/+rJSUdQ7Qc5WyrvDePZw1zu104JV9Jlq9s
+ArtR437UL2GZu1xs6tXFsfbxJdI/YfmlgjwofHdmukuOzFZPqUtBmCsOI3b22JaV
+fYhlYHI0nQLbujSP31sm81xSBaIz6kH6yniospmLFIa3niXay9MnlEAM5ljUHBk/
+GQtSQPt75y45FgkghYhDG+/av0CbgEOypbYrUvKuXqc
+-> piv-p256 zqq/iw A7USudAooh1b3G9cLZoudZ8WuBJusE3gTmVU/3AaOoBh
+O4OD1N2MQezfJI1m5kndsu0U7sG19EQHAL+mOSLK+Wc
+-> piv-p256 vRzPNw Akjk82+BfO5tApOXVUCYwgXJer+y2VrUkmdoQRUSNHoR
+ULJojv+NuRsw+ygQ1+8Kr8oNZ+0tioVW0aHvf7siUlA
+-> !z&b-grease gi.# |_t^z\0J ),Y}>RlK ,qOur6S^
+IImLm/0FMvQ1SnrbZXCdTT6LY5sm1UeKFNjMOGD5JXxSWaZYJ/FujzzDLAwNqDJN
+PFnYFGHGv3TqxEDYpy9R+OAROsIgQeI
+--- eYDSPRJJ8A2xQVO+ttl1doPz738sD2qo+hrE4S+KwwU
+c{4O<34>ÐÊ«ªû£DœýxÂT›F™_þ€¨‚ÿTCÞè'í³o-†KR¦—_¹JÇ¿]oÒý<''%3éÈ9HF¦UgÙ9
--- a/secrets/wg-tunnel-droppie.age
+++ b/secrets/wg-tunnel-droppie.age
@ -1,24 +1,23 @@
 age-encryption.org/v1
-> ssh-ed25519 LVlqCg /mVa20mT7mKpzTShgWcbtKa+R0iRT0SzG9wKK633olc
-81110gKfZafs+MftCX7ZlbO1do6whhMdFMJ9zF67Zso
+-> ssh-ed25519 LVlqCg tSCSsthEuH5GG6udigkD6u0/ufY1IKckWO1z4wL1aQk
+JUXWHZOw1CWBbs0nnldsuS2CCwNRsECz1qTSc1159Jg
 -> ssh-rsa kFDS0A
-P+oCjv2+AJPzxu8DNAsuwl7ZPLJig/flzCUxrE/pNzSQTwQr9dS/hOy6421sbY2a
-22Ve8oEzUtGDO2omzXTy4a2cYywlvy6AjG60JSMpPWVTlCuvvTv1s7TrPcGZ21J0
-gARKRZBD0QtA/gUp3awbABhfDVCgHSDVTeV56Z2aD92i9N8QaYcDZizcIiWrybhC
-mI3jOsliYUOj2uzp7h04q3bNJe6IizfbRP0b6jrausJCr9L6BCPvkhvcERRytA3E
-zNRH5lVaRKQLDZsTZdXNCHRZ4Hg5fnR8xdkHTsaZTowohmjYkb0AdBp4fRBy2Dmz
-w0H833mEXEdPkjl8PM7NT4aYDmJyKT7DKGHep1iEz2czXVaCUFUaMN5S4JgEnOSr
-kQH/qkwPA0bEvmiUaxe+zMrYYaHhumh+m28NhlIQWH7HyyiilRvcbRW+dXy4XcYJ
-JkVCR0uWfU2/fjJF1fGTibD48BBOnXpbZY1gkma/pWLmIjkRIlxdWPChCxDUelct
-jama/Zqv5RYbiiR9z66K1OoNgrn7sJ7q+cx+FAWihZof4qg7Foeh6nfaeVZPhVws
-TkoHtsitjOJB64/7ykAPdfVLNwxTsg3k7FK64tR9t/SMFRnPjI0J63WC82TjQjrC
-oPa4GJPMo5yaOWmO/Gau3HZ2kgnwt3brdWaifHfI5nc
-> piv-p256 zqq/iw A4KxHHmwWuQv9paadyg20RlQKXFNjKs4mvduZHXtYqLV
-jBP9JrY1/bZkDPK2fnQDwrMxfdJD5nCP5o/l/4BEf/s
-> piv-p256 vRzPNw AuidNlvPMpCl4iq6CJllzJvAoo2h9lIrcNuERGc3d6o3
-tpLM4Vulr0pS6I+zWynV/wxSnRdQxgEpB7Y4W0RqhdE
-> Tc':~)<-grease EW=TL
-AL2dCoXGFdWfFMuNy5ugLZifSi3hnQbsw2nMaKKs1hbKBBInpcnzxG+KSsWFc1Rv
-0dE3XcUEHZVhCaodt5w4bZSXag9pA8BQfZdMj9lLl9wjMYjn1kLP
--- bQUmuzsnM0ZUZCvpmH0r9dkFLbIwn5rgOFZr4JLxXO0
-zßíY9lž	<cˆ=Kn<4B>¹
šòÉ¾vÑ—]9z£‚$@Õ/w‘./•¹žý>x6VýÕ^ö¸Å(ræÓ7÷Kâüo5ª„'È<Ú
+pBKPCXHoYJQbyATYYu29b841RYNuEhy1huVANlta2HsJhEuO0Q76gJ0jgMyddIni
+CfpKJiLeSjy8c2n4FWd3/amYwojhR7AO7OWYURNLJJWnsJq1h5FebM6H/G8ZdvIb
+UGFM+sCsM/+Xt8XdNzVIbrxDteWYoUM43IUQN/MuScYsE74w9TWLOr0k26QauSph
+PqjluGW/3/qT3Y6GDsLi55IfisifvzOZ7kFzlzbovCEoRD4AyoLNJyDqUBdGivji
+z2LaD2MMPUAubGB8o/uCB1/WFc66WarY3f/VnzwI0FlfcjNPDgIv3qtf+R3SwNUV
+2D1e533QvSGmnhc7M/5bSyWYQCWVViv5THXHejjF/1xM//9vj2XGS7e8ELezBFP3
+0TbX2kx198QZM94AOkIoZkIhLLJmOAU0aTjIQoOWjTJrHR9cjUg+PnUu4NR6YLwI
+uJFYXqVF2r6Gotm8pB/PHh8gGKY+UPYJlnzAV32UmfeW3ia+PGo7bbdpb6QKHDs1
+EPvWRu8ghwACAsXpSPnH6GeN8JEKfrLBub+j8/q8kaZsEZFKAwXDFF43c4JoQyzK
+egRzEyUtBVOHGMF4z2rnhIpiMdjSFaOu6gBAXMwYGQyjlgZrNBMU2aRj25006O1Y
+yTNkVQGlQ5wFUcytrlkNAp+1iF2vkSubdhAfWzQkyVI
+-> piv-p256 zqq/iw AgzIwxlqP4A7/njEUpCXXxsdaQJvddq3+cTv/rCWRfmy
+yKJpr2gOMnkcJ2UfOlbrd6JOTsnP6aQvWIAF0ceanDs
+-> piv-p256 vRzPNw A2dCbUkkG26gUzfw7+ePsARIOd3a4sgNk9PX3D0JHhJo
+/zTSbFyFwErm65HATah0CYkEixnTSvkv/mUVBgJhYS0
+-> ^U6Ex[fv-grease
+UROHZseDwsP+Wvg+a7keVj92WVlrukLtW63tJg
+--- GmeA8/sI5PtrR5dZRPzb0th0MPn/OhxI5PAKyolhj+Y
+¾ók¦1t#,²Ïl<C38F>·:Ë¡"úO’èê*:€«,±>ºó:+lâúÂä©~y™gñÐŸ™JäÓ>r3
ýŠ0€__å÷ÓnG{ü
--- a/secrets/wg-tunnel-stroopwafel.age
+++ b/secrets/wg-tunnel-stroopwafel.age
@ -1,23 +1,23 @@
 age-encryption.org/v1
-> ssh-ed25519 b0WFDg NsuSXeVDNaiVmbj9lPv1YhA0TDyjqXm6i0a3wwHaAj4
-Nm0RztSI2ErmObckxT7fG5sJ1Ce+Yy2hyVxYYFSEv9w
+-> ssh-ed25519 b0WFDg 3j1UJJrQANyh66Ec72sYbOCFvoD+3qq77GAFBAcHiw4
+azblW4BVLURS8f22v18C+gUTgwgUTexTM9MlmL8UZs
 -> ssh-rsa kFDS0A
-gEqURzUz1V/WPavUH9rKtvP0gzVtiY1iYh9kNe4yrV1AKQkBKCPVtO0rI5UJ5mtT
-OkEbDm7EYaw/VXW2KJO8OE6v7+bNKrhgvUDKKTg5qcV1u62Q1KNBHu3yV9iRBR2L
-esj8amIv6W6jj5S1RO52UGxggnSWZXihfsFu7evvZ0tS6o14qCpTUhfsiSu3UdGc
-SjbKSSf+XrvqTNQoF7IW0XdRpoY5CRwzQhO6pSXKMZJW4n3W16su01+nq8uU/vVD
-9ZM3m21IofjrUeiBpM2qu2pthU/3kC9LZ5LKG2HMeWWQ/dPvCvhopXZWWRL7+q8q
-B3MSdEza5URRqifKKoW04MfOpWw1YzrA6Md0lIKiyViCrep6zoWC+QlBohzlpGce
-ew0rjsSeNpY0SBJk7+Svm3Ws6qUXpE5F+ZeDOMguJnbzH51ERGlipK5mu7kKSXi4
-cXwCcaOZ4HlO8HQtb7sm87kVPsX03n+/es4WOXx6TzHIHto46kGc/8fnuDc0I9oV
-9mNqjJGjPOEdnGKwH/7qBCyKxEr1akaz7P0XxzclVIw1ZbCFo15km+4KFx0TPO96
-5lCZQjxywa2tRrg04IIH6Ix0HK37GTh6RPNFLC+fBGfCDVPwxEImqlspxIYP7EwW
-3jiKznAkQQf6NDfoxAJLqkQAhS1M5uswcfmMHGps91g
-> piv-p256 zqq/iw Ay/OZWoqN1T94ev5AIRa+dgIz6+793KiHN60olbLPlYq
-q0VjnvzttleF8IE4Y68AH+Mu8MmUZLfFWmKsYGqqTeQ
-> piv-p256 vRzPNw A8KNTT64X05ac5+sLbcpzbHj/kH+501w/c4HgXz6vg+z
-gw3hnxpNvEJoxVJxkzOtzk8pUhxA+lcQXLKxzsNMA4Y
-> SLXduAh<-grease ;Os ?h<#sQ-
-zjtD7bxdUXKO19VLoqKGaTa9rRgCtyBX2ERtdxk
--- 9T5CjtTCQsIi5arc8p4EmbwUqUe/Chuoaljd9ysZoWU
-šÏ”ÝT½ C
T¼*Ì§öE‘¥Ö‚»%†§8ãB7ª"üoNñGyõ4
i´æ …Ç!Ò© mé\ò!qi¯Dg"J,òZð8>TÓÁG5w
+jyP4y27LZ6SngtBDL48/BwnEtDfvRLIDCrvw/Iih2Cd1kqoyzEFLlqSUiCoriX8J
+sWB4uspH3zrlSFGsvUGsSvYn6CBLsgDP9UhAVK1JX8syAefovP6dsXkwYkB7e/qR
+tb1oFeet7+wNU7+64m+JO5mbdNH6U2I3wpLfnCGL7kwnSFQTkgWARJOMvd+dB9XA
+0uHAGviRVpBwXPSa7i444VQUUS4qsGvNNjbsPNOI4zH7lAEK16fiKHl3yMC00+fR
+8vh0DRgpjZ5ZiNnk4YnbQ8FQjS3JYVPQpltuS/K3NPbbjfNlWhfPgwg+PDw/AT6O
+Iv/fsDdaU+kpx/Lu//s1zVP//zTl3XtUt0Zhin/PfvWiktR5U0L0pO30desNOmt7
+7ZP7Kup4VD4C4tJ+OPkXAdMBM+zY3d6lo/D4d6ftUSIGGF9p5y272s3GXMy4/7hI
+4eVqDrBrcsNpBQlN/8pYc3cM0Rmg+hncBenRor9ITaQW5TAjEgv4NEIWobzWHLX3
+cqutJK9d8N5xOrDajOJBgsWZoK+N6BXdD+LrmxAgXpwAWVvcPAxDfDKJRTmsQmB8
+XdShltzcIax7Rr4upZy2Zl5E7W2z6WBLmsGr1DYCSUHL/JS0ZQqV6l/VLmwag2kV
+JAI1YcC8Vr2AIQHhGEngmC5EO+KoPEfrx2ILigjxIY4
+-> piv-p256 zqq/iw AmONfNtOZgLS7c6riIxXzZwwcNDjP6TXRf308Grl2wPC
+cHwQkRbQEpf5bF4eUEgfHT0peChXbTLLEiuUKxb7Ptc
+-> piv-p256 vRzPNw A+PkCRleNTtKvyJGYBOKmWfPTTdqK2cjjEb9YLKYkKIe
+YQ+79xWO3NAh2EH5tVtCf3vKiPXktXCWk1RtfD7Mus8
+-> )UypngR7-grease !'e$a <=
+0ynjPVURj7uBD/OZPkVuzUplxCI
+--- WHuDdh43ZEgSTWpnJEpEAkxUtGiNq1hlQBPzF8ITjLQ
+«µì¯j c`¹îœ€G—u^…(ùpqÌWô&Û7m-5¶¿´‘ÄÄ]þ¸ÐãøçÈÔ2Ô¬‘\èmšWl†Æ®¯px‚òhçÄ>4Ž
Author	SHA1	Message	Date
Benjamin Yule Bädorf	6a9372853e	authelia: auth is working, but not the proxy	2024-04-03 21:56:48 +02:00
Benjamin Yule Bädorf	547bd4ca27	authelia: init	2024-04-03 21:56:47 +02:00
Benjamin Yule Bädorf	09d6f74e1a	wireguard: add pub.solar wireguard config	2024-04-03 21:56:03 +02:00