authelia: auth is working, but not the proxy

* Use mako home-manager module
* Use nextcloud-client home-manager module
* Urgent notifications go above fullscreen apps
* Add battery check with libnotify
* Increase waybar text sizing

flake.lock

@@ -256,11 +256,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1702676849,
-        "narHash": "sha256-XqcREaTS38/QOsN8fk8PP325/UXHyF9enbP5ZPw5aiA=",
+        "lastModified": 1710888565,
+        "narHash": "sha256-s9Hi4RHhc6yut4EcYD50sZWRDKsugBJHSbON8KFwoTw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "aa99c2f4e9847cbb7e46fac0844ea1eb164b3b3a",
+        "rev": "f33900124c23c4eca5831b9b5eb32ea5894375ce",
         "type": "github"
       },
       "original": {
@@ -423,11 +423,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1710871319,
-        "narHash": "sha256-y30iYkmVpi6o2yCLH8Iz7Bi7XXuNOmCPmxFIdNMW9Og=",
+        "lastModified": 1711717242,
+        "narHash": "sha256-PW9J9sFw5DA4Fo3Cq4Soc+an6tjTS4VV2NxG6G0UMqw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "f4fb648799ae71ac118a2a1c8b92698f2a01e246",
+        "rev": "824952ff6b32b0019465b139b5c76d915ec074ea",
         "type": "github"
       },
       "original": {
@@ -439,11 +439,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1710806803,
-        "narHash": "sha256-qrxvLS888pNJFwJdK+hf1wpRCSQcqA6W5+Ox202NDa0=",
+        "lastModified": 1711523803,
+        "narHash": "sha256-UKcYiHWHQynzj6CN/vTcix4yd1eCu1uFdsuarupdCQQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b06025f1533a1e07b6db3e75151caa155d1c7eb3",
+        "rev": "2726f127c15a4cc9810843b96cad73c7eb39e443",
         "type": "github"
       },
       "original": {
@@ -487,11 +487,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1710695816,
-        "narHash": "sha256-3Eh7fhEID17pv9ZxrPwCLfqXnYP006RKzSs0JptsN84=",
+        "lastModified": 1711460390,
+        "narHash": "sha256-akSgjDZL6pVHEfSE6sz1DNSXuYX6hq+P/1Z5IoYWs7E=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "614b4613980a522ba49f0d194531beddbb7220d3",
+        "rev": "44733514b72e732bd49f5511bd0203dea9b9a434",
         "type": "github"
       },
       "original": {

hosts/default.nix

@@ -15,9 +15,9 @@
           self.nixosModules.desktop-extended
           self.nixosModules.docker
           self.nixosModules.graphical
-          self.nixosModules.nextcloud
           self.nixosModules.office
           self.nixosModules.persistence
+          self.nixosModules.portable
           self.nixosModules.printing
         ];
       };
@@ -33,8 +33,8 @@
           self.nixosModules.desktop-extended
           self.nixosModules.docker
           self.nixosModules.graphical
-          self.nixosModules.nextcloud
           self.nixosModules.office
+          self.nixosModules.portable
           self.nixosModules.printing
         ];
       };
@@ -51,7 +51,6 @@
           self.nixosModules.docker
           self.nixosModules.gaming
           self.nixosModules.graphical
-          self.nixosModules.nextcloud
           self.nixosModules.office
           self.nixosModules.printing
           self.nixosModules.virtualisation
@@ -67,6 +66,7 @@
           ./droppie
           self.nixosModules.yule
           self.nixosModules.acme
+          self.nixosModules.proxy
           self.nixosModules.persistence
         ];
       };
@@ -79,6 +79,7 @@
           ./pie
           self.nixosModules.yule
           self.nixosModules.acme
+          self.nixosModules.proxy
           self.nixosModules.docker
           self.nixosModules.invoiceplane
         ];
@@ -91,6 +92,7 @@
           ./frikandel
           self.nixosModules.yule
           self.nixosModules.acme
+          self.nixosModules.proxy
           self.nixosModules.docker
         ];
       };

hosts/droppie/networking.nix

@@ -15,7 +15,6 @@
 
   # Allow pub.solar restic backups
   services.openssh.allowSFTP = true;
-  services.openssh.openFirewall = true;
 
   age.secrets.wg-private-key.file = "${flake.self}/secrets/wg-private-droppie.age";
 

hosts/droppie/nginx.nix

@@ -5,16 +5,7 @@
   lib,
   ...
 }: {
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
   services.nginx = {
-    enable = true;
-
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-    recommendedTlsSettings = true;
-    recommendedProxySettings = true;
-
     defaultListenAddresses = [
       "192.168.178.3"
       "10.13.12.3"

hosts/frikandel/configuration.nix

@@ -44,7 +44,6 @@ in {
   };
 
   boot.supportedFilesystems = [ "zfs" ];
-  boot.kernelPackages = pkgs.linuxPackages_6_1;
 
   # Copy the NixOS configuration file and link it from the resulting system
   # (/run/current-system/configuration.nix). This is useful in case you

hosts/frikandel/default.nix

@@ -6,6 +6,7 @@
     ./networking.nix
     ./unbound.nix
     ./nginx.nix
+    ./invoiceplane-proxy.nix
     ./wireguard.nix
     ./email.nix
     ./website.nix

hosts/frikandel/invoiceplane-proxy.nix

@@ -0,0 +1,20 @@
+{
+  flake,
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  security.acme.certs = {
+    "invoicing.b12f.io" = {};
+  };
+
+  services.nginx.virtualHosts = {
+    "invoicing.b12f.io" = {
+      forceSSL = true;
+      useACMEHost = "invoicing.b12f.io";
+      # This redirects to invoiceplane on pie
+      locations."/".proxyPass = "https://invoicing.b12f.io";
+    };
+  };
+}

hosts/frikandel/networking.nix

@@ -14,8 +14,6 @@
     "2a0f:fc81::" #dns0.eu
   ];
 
-  services.openssh.openFirewall = true;
-
   # Network configuration (Hetzner uses static IP assignments, and we don't use DHCP here)
   networking.useDHCP = false;
   networking.interfaces.enp1s0 = {

hosts/frikandel/nginx.nix

@@ -5,16 +5,7 @@
   lib,
   ...
 }: {
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
   services.nginx = {
-    enable = true;
-
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-    recommendedTlsSettings = true;
-    recommendedProxySettings = true;
-
     defaultListenAddresses = [
       "10.13.12.7"
       "[fd00:b12f:acab:1312:acab:7::]"

hosts/frikandel/unbound.nix

@@ -58,6 +58,9 @@
           "\"b12f.io\" transparent"
         ];
         local-data = [
+          "\"droppie.b12f.io. 10800 IN A 10.13.12.3\""
+          "\"droppie.b12f.io. 10800 IN AAAA fd00:b12f:acab:1312:acab:3::\""
+
           "\"droppie.b12f.io. 10800 IN A 10.13.12.3\""
           "\"droppie.b12f.io. 10800 IN AAAA fd00:b12f:acab:1312:acab:3::\""
           "\"backup.b12f.io. 10800 IN A 10.13.12.3\""
@@ -75,6 +78,8 @@
           "\"paperless.b12f.io. 10800 IN AAAA fd00:b12f:acab:1312:acab:2::\""
           "\"invoicing.b12f.io. 10800 IN A 10.13.12.2\""
           "\"invoicing.b12f.io. 10800 IN AAAA fd00:b12f:acab:1312:acab:2::\""
+          "\"auth.b12f.io. 10800 IN A 10.13.12.2\""
+          "\"auth.b12f.io. 10800 IN AAAA fd00:b12f:acab:1312:acab:2::\""
 
           "\"vpn.b12f.io. 10800 IN A 128.140.109.213\""
           "\"vpn.b12f.io. 10800 IN AAAA 2a01:4f8:c2c:b60::\""

hosts/pie/authelia.nix

@@ -0,0 +1,115 @@
+{
+  flake,
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+  xdg = config.home-manager.users."${psCfg.user.name}".xdg;
+in {
+  age.secrets."authelia-storage-encryption-key" = {
+    file = "${flake.self}/secrets/authelia-storage-encryption-key.age";
+    mode = "400";
+    owner = "authelia-b12f";
+  };
+
+  age.secrets."authelia-session-secret" = {
+    file = "${flake.self}/secrets/authelia-session-secret.age";
+    mode = "400";
+    owner = "authelia-b12f";
+  };
+
+  age.secrets."authelia-jwt-secret" = {
+    file = "${flake.self}/secrets/authelia-jwt-secret.age";
+    mode = "400";
+    owner = "authelia-b12f";
+  };
+
+  age.secrets."authelia-users-file" = {
+    file = "${flake.self}/secrets/authelia-users-file.age";
+    mode = "400";
+    owner = "authelia-b12f";
+  };
+
+  age.secrets."mail@b12f.io-password" = {
+    file = "${flake.self}/secrets/mail@b12f.io-password.age";
+    mode = "400";
+    owner = "authelia-b12f";
+  };
+
+  security.acme.certs = {
+    "auth.b12f.io" = {};
+  };
+
+  services.nginx.virtualHosts = {
+    "auth.b12f.io" = {
+      forceSSL = true;
+      useACMEHost = "auth.b12f.io";
+      locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.services.authelia.instances.b12f.settings.server.port}";
+      locations."/".extraConfig = "include /etc/nginx/conf-available/proxy.conf;";
+      locations."/api/verify".proxyPass = "http://127.0.0.1:${builtins.toString config.services.authelia.instances.b12f.settings.server.port}";
+      locations."/api/authz".proxyPass = "http://127.0.0.1:${builtins.toString config.services.authelia.instances.b12f.settings.server.port}";
+    };
+  };
+
+  services.authelia.instances.b12f = {
+    enable = true;
+
+    secrets = {
+      storageEncryptionKeyFile = config.age.secrets."authelia-storage-encryption-key".path;
+      sessionSecretFile = config.age.secrets."authelia-session-secret".path;
+      jwtSecretFile = config.age.secrets."authelia-jwt-secret".path;
+    };
+
+    settings = {
+      theme = "light";
+      default_2fa_method = "webauthn";
+      log.level = "debug";
+      server = {
+        port = 9092;
+        host = "127.0.0.1";
+      };
+      authentication_backend = {
+        refresh_interval = "disable";
+        password_reset = { disable = true; };
+        file = {
+          path = config.age.secrets."authelia-users-file".path;
+          watch = false;
+        };
+      };
+      duo_api.disable = true;
+      webauthn.user_verification = "required";
+      totp.issuer = "auth.b12f.io";
+      storage.local.path = "/var/lib/authelia-b12f/db.sqlite3";
+      access_control.default_policy = "two_factor";
+      session = {
+        domain = "auth.b12f.io";
+        # authelia_url = "https://auth.b12f.io";
+      };
+      notifier.disable_startup_check = true;
+      notifier.smtp = {
+        host = "mail.b12f.io";
+        port = 587;
+        username = "mail@b12f.io";
+        sender = "auth.b12f.io <mail@b12f.io>";
+        identifier = "auth@b12f.io";
+        subject = "[auth.b12f.io] {title}";
+      };
+    };
+  };
+
+  systemd.services.authelia-b12f.environment.AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE = config.age.secrets."mail@b12f.io-password".path;
+
+  services.restic.backups = {
+    authelia = {
+      paths = [ "/var/lib/authelia-b12f" ];
+      initialize = true;
+      passwordFile = config.age.secrets."restic-password".path;
+      # See https://www.hosting.de/blog/verschluesselte-backups-mit-rclone-und-restic-in-nextcloud/
+      repository = "rclone:cloud.pub.solar:/backups/Authelia";
+      rcloneConfigFile = config.age.secrets."rclone-pie.conf".path;
+    };
+  };
+}

hosts/pie/configuration.nix

@@ -21,7 +21,7 @@ in {
   boot.loader.generic-extlinux-compatible.enable = false;
 
   boot.supportedFilesystems = [ "zfs" ];
-  boot.kernelPackages = pkgs.linuxPackages_6_1;
+  boot.kernelPackages = pkgs.linuxPackages_6_1_hardened;
 
   boot.kernelParams = [
     "boot.shell_on_fail=1"

hosts/pie/default.nix

@@ -9,6 +9,7 @@
     ./unbound.nix
     ./dhcpd.nix
     # ./wake-droppie.nix
+    ./authelia.nix
     ./paperless.nix
     ./firefly.nix
     ./invoiceplane.nix

hosts/pie/firefly.nix

@@ -38,12 +38,22 @@ in {
     "firefly.b12f.io" = {
       forceSSL = true;
       useACMEHost = "firefly.b12f.io";
+      extraConfig = "include /etc/nginx/conf-available/authelia-location.conf;";
       locations."/".proxyPass = "http://127.0.0.1:8080";
+      locations."/".extraConfig = ''
+        include /etc/nginx/conf-available/proxy.conf;
+        include /etc/nginx/conf-available/authelia-authrequest.conf;
+      '';
     };
     "firefly-importer.b12f.io" = {
       forceSSL = true;
       useACMEHost = "firefly-importer.b12f.io";
+      extraConfig = "include /etc/nginx/conf-available/authelia-location.conf;";
       locations."/".proxyPass = "http://127.0.0.1:8081";
+      locations."/".extraConfig = ''
+        include /etc/nginx/conf-available/proxy.conf;
+        include /etc/nginx/conf-available/authelia-authrequest.conf;
+      '';
     };
   };
 

hosts/pie/invoiceplane.nix

@@ -28,12 +28,16 @@ in {
     "invoicing.b12f.io" = {
       forceSSL = true;
       useACMEHost = "invoicing.b12f.io";
+      extraConfig = "include /etc/nginx/conf-available/authelia-location.conf;";
+      locations."/".extraConfig = ''
+        include /etc/nginx/conf-available/proxy.conf;
+        include /etc/nginx/conf-available/authelia-authrequest.conf;
+      '';
     };
   };
 
   services.invoiceplane.webserver = "nginx";
   services.invoiceplane.sites."invoicing.b12f.io" = {
-    # nginx is not supported
     enable = true;
 
     database = {

hosts/pie/networking.nix

@@ -27,7 +27,6 @@
     "192.168.178.3" = [ "droppie-initrd.b12f.io" ];
   };
 
-  services.openssh.openFirewall = true;
   services.openssh.allowSFTP = true;
 
   age.secrets.wg-private-key.file = "${flake.self}/secrets/wg-private-pie.age";

hosts/pie/nginx.nix

@@ -5,16 +5,7 @@
   lib,
   ...
 }: {
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
   services.nginx = {
-    enable = true;
-
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-    recommendedTlsSettings = true;
-    recommendedProxySettings = true;
-
     defaultListenAddresses = [
       "192.168.178.2"
       # "2a02:908:5b1:e3c0:2::"

hosts/pie/paperless.nix

@@ -9,9 +9,9 @@ with lib; let
   psCfg = config.pub-solar;
   xdg = config.home-manager.users."${psCfg.user.name}".xdg;
 
-  dataDir = "${xdg.dataHome}/Paperless";
-  backupDir = "${xdg.dataHome}/PaperlessBackup";
-  consumptionDir = "/home/${psCfg.user.name}/.local/share/scandir";
+  dataDir = "/var/lib/paperless";
+  backupDir = "/var/lib/PaperlessBackup";
+  consumptionDir = "/var/lib/scandir";
 
   scan2paperless = with pkgs; writeShellScriptBin "scan2paperless" ''
     DEVICE=$1
@@ -53,21 +53,25 @@ in {
     "paperless.b12f.io" = {
       forceSSL = true;
       useACMEHost = "paperless.b12f.io";
+      extraConfig = "include /etc/nginx/conf-available/authelia-location.conf;";
       locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.services.paperless.port}";
-    };
+      locations."/".extraConfig = ''
+        include /etc/nginx/conf-available/proxy.conf;
+        include /etc/nginx/conf-available/authelia-authrequest.conf;
+      '';
+    }; 
   };
 
   services.paperless = {
     enable = true;
-    user = psCfg.user.name;
     consumptionDir = consumptionDir;
     dataDir = dataDir;
     address = "127.0.0.1";
     extraConfig = {
       PAPERLESS_OCR_LANGUAGE = "nld+deu";
-      PAPERLESS_ADMIN_USER = psCfg.user.name;
-      PAPERLESS_AUTO_LOGIN_USERNAME = psCfg.user.name;
       PAPERLESS_URL = "https://paperless.b12f.io";
+      PAPERLESS_DISABLE_REGULAR_LOGIN = "True";
+      PAPERLESS_ENABLE_HTTP_REMOTE_USER = "True";
     };
   };
 
@@ -101,13 +105,13 @@ in {
   age.secrets."hosting-de-invoice-sync-api-key" = {
     file = "${flake.self}/secrets/hosting-de-invoice-sync-api-key.age";
     mode = "400";
-    owner = psCfg.user.name;
+    owner = "paperless";
   };
 
   services.cron = {
     enable = true;
     systemCronJobs = [
-      "30 1 * * * ${psCfg.user.name} ${pkgs.fetch-hostingde-invoices}/bin/fetch-hostingde-invoices '${config.age.secrets."hosting-de-invoice-sync-api-key".path}' '${consumptionDir}'"
+      "30 1 * * * paperless ${pkgs.fetch-hostingde-invoices}/bin/fetch-hostingde-invoices '${config.age.secrets."hosting-de-invoice-sync-api-key".path}' '${consumptionDir}'"
     ];
   };
 
@@ -116,8 +120,10 @@ in {
   #################################
 
   systemd.tmpfiles.rules = [
-    "d '${backupDir}' 0700 ${psCfg.user.name} users - -"
-    "d /tmp/paperless 0700 ${psCfg.user.name} users - -"
+    "d '${dataDir}' 0700 paperless users - -"
+    "d '${backupDir}' 0700 paperless users - -"
+    "d '${consumptionDir}' 0700 paperless users - -"
+    "d /tmp/paperless 0700 paperless users - -"
   ];
 
   age.secrets."rclone-pie.conf" = {

hosts/stroopwafel/configuration.nix

@@ -19,6 +19,7 @@ in {
   boot.swraid.mdadmConf = ''
 DEVICE /dev/nvme0n1p2 /dev/nvme1n1p2
 ARRAY /dev/md/nixos:root metadata=1.2 name=nixos:root UUID=67d1aa81:1b348887:c17a75e8:f2edf2bd
+MAILADDR ${psCfg.user.email}
   '';
 
   pub-solar.core.hibernation.enable = true;

lib/default.nix

@@ -13,6 +13,7 @@
       deploy = import ./deploy.nix { inherit inputs lib; };
       addLocalHostname = callLibs ./add-local-hostname.nix;
       recursiveMerge = callLibs ./recursive-merge.nix;
+      mkEmailAddress = account: domain: account + "@" + domain;
     };
   };
 }

modules/acme/default.nix

@@ -19,6 +19,8 @@
       # server = "https://acme-staging-v02.api.letsencrypt.org/directory";
       dnsProvider = "hostingde";
       dnsPropagationCheck = true;
+      # We check via dns0 directly or unbound will be in our way
+      dnsResolver = "193.110.81.0";
       credentialsFile = config.age.secrets."hosting-de-acme-secrets".path;
       group = "nginx";
       webroot = null;

modules/core/boot.nix

@@ -12,7 +12,7 @@ in {
       loader.systemd-boot.enable = lib.mkDefault true;
 
       # Use latest LTS linux kernel by default
-      kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
+      kernelPackages = lib.mkDefault pkgs.linuxPackages_6_7_hardened;
 
       # Support ntfs drives
       supportedFilesystems = ["ntfs"];

modules/core/default.nix

@@ -13,26 +13,9 @@ in {
     ./i18n.nix
     ./networking.nix
     ./packages.nix
+    ./hardening.nix
   ];
 
   # Service that makes Out of Memory Killer more effective
   services.earlyoom.enable = true;
-
-  services.logind.lidSwitch = "hibernate";
-
-  services.tor.settings = {
-    UseBridges = true;
-  };
-
-  # The options below are directly taken from or inspired by
-  # https://xeiaso.net/blog/paranoid-nixos-2021-07-18
-
-  # Limit the use of sudo to the group wheel
-  security.sudo.execWheelOnly = true;
-
-  # Remove the complete default environment of packages like
-  # nano, perl and rsync
-  environment.defaultPackages = lib.mkForce [];
-
-  # fileSystems."/".options = [ "noexec" ];
 }

modules/core/hardening.nix

@@ -0,0 +1,41 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.pub-solar.core;
+  psCfg = config.pub-solar;
+in {
+  services.tor.settings = {
+    UseBridges = true;
+  };
+
+  # Always go to encrypted hibernation instead of sleep
+  services.logind.lidSwitch = "hibernate";
+
+  # The options below are directly taken from or inspired by
+  # https://xeiaso.net/blog/paranoid-nixos-2021-07-18
+
+  # Limit the use of sudo to the group wheel
+  security.sudo.execWheelOnly = true;
+
+  # Remove the complete default environment of packages like
+  # nano, perl and rsync
+  environment.defaultPackages = lib.mkForce [];
+
+  # fileSystems."/".options = [ "noexec" ];
+
+  # disable coredump that could be exploited later
+  # and also slow down the system when something crash
+  systemd.coredump.enable = false;
+
+  # required to run chromium
+  security.chromiumSuidSandbox.enable = true;
+
+  # enable antivirus clamav and
+  # keep the signatures' database updated
+  services.clamav.daemon.enable = true;
+  services.clamav.updater.enable = true;
+}

modules/core/networking.nix

@@ -37,6 +37,9 @@
     '';
   };
 
+  # Don't expose SSH via public interfaces
+  networking.firewall.interfaces.wg-private.allowedTCPPorts = [ 22 ];
+
   # For rage encryption, all hosts need a ssh key pair
   services.openssh = {
     enable = true;

modules/default.nix

@@ -18,10 +18,11 @@
       graphical = import ./graphical;
       invoiceplane = import ./invoiceplane;
       nix = import ./nix;
-      nextcloud = import ./nextcloud;
       office = import ./office;
       persistence = import ./persistence;
+      portable = import ./portable;
       printing = import ./printing;
+      proxy = import ./proxy;
       terminal-life = import ./terminal-life;
       user = import ./user;
       virtualisation = import ./virtualisation;

modules/desktop-extended/default.nix

@@ -11,14 +11,13 @@ in {
   hardware.logitech.wireless.enable = true;
 
   users.users."${psCfg.user.name}".packages = with pkgs; [
-    ungoogled-chromium
     wine
+    chromium
 
     gimp
     present-md
     inkscape
     gpxsee
-    digikam
     nix-output-monitor
     tigervnc
     nodejs
@@ -28,8 +27,6 @@ in {
     signal-desktop
     tdesktop
     element-desktop
-    cinny-desktop
-    irssi
 
     # Nix specific utilities
     alejandra

modules/graphical/.config/mako/config

@@ -1,22 +0,0 @@
-padding=10
-margin=5,5,0
-default-timeout=5000
-
-## Base16 Burn
-# Author: Benjamin Bädorf
-#
-# You can use these variables anywhere in the mako configuration file.
-
-background-color=#1a181a
-text-color=#e3e1e4
-border-color=#ff5f5f
-
-[urgency=low]
-background-color=#1a181a
-text-color=#e3e1e4
-border-color=#ff5f5f
-
-[urgency=high]
-background-color=#ff5f5f
-text-color=#1a181a
-border-color=#1a181a

modules/graphical/.config/waybar/colorscheme.css

@@ -1,23 +0,0 @@
-/*
-*
-* Base16 Burn
-* Author: Benjamin Bädorf
-*
-*/
-
-@define-color base00 #1a181a;
-@define-color base01 #2d2a2e;
-@define-color base02 #303030;
-@define-color base03 #949494;
-@define-color base04 #d3d1d4;
-@define-color base05 #e3e1e4;
-@define-color base06 #303030;
-@define-color base07 #ff5f5f;
-@define-color base08 #f85e84;
-@define-color base09 #df5923;
-@define-color base0A #e5c463;
-@define-color base0B #9ecd6f;
-@define-color base0C #ef9062;
-@define-color base0D #7accd7;
-@define-color base0E #ab9df2;
-@define-color base0F #d70000;

modules/graphical/.config/waybar/config

@@ -1,116 +0,0 @@
-{
-  "layer": "top", // Waybar at top layer
-  // "position": "bottom", // Waybar position (top|bottom|left|right)
-
-  "height": 26, // Waybar height
-  "modules-left": ["sway/workspaces", "sway/mode"],
-  //"modules-center": ["mpd"],
-  "modules-right": ["sway/language", "pulseaudio", "network", "idle_inhibitor", "battery", "clock", "tray"],
-  "sway/workspaces": {
-    "disable-scroll": true
-  },
-  "sway/mode": {
-  "tooltip": false,
-    "format": "{}"
-  },
-  "sway/window": {
-    "tooltip": false,
-    "max-length": 96
-  },
-  "sway/language": {
-    "format": "{}",
-    "max-length": 50
-  },
-  "tray": {
-    "icon-size": 21,
-    "spacing": 10
-  },
-  "clock": {
-      "tooltip-format": "<tt><small>{calendar}</small></tt>",
-      "format-alt": "{:%a %d. %h %H:%M}",
-      //"on-scroll": {
-      //    "calendar": 1
-      //}
-      "calendar": {
-          "mode-mon-col"  : 3,
-          "on-scroll": -1,
-          "on-click-right": "mode",
-          "format": {
-              "months":     "<span color='#ffead3'><b>{}</b></span>",
-              "days":       "<span color='#ecc6d9'><b>{}</b></span>",
-              "weekdays":   "<span color='#ffcc66'><b>{}</b></span>",
-              "today":      "<span color='#ff6699'><b><u>{}</u></b></span>"
-          },
-      },
-  },
-  "backlight": {
-    // "device": "acpi_video1",
-    "tooltip": true,
-    "tooltip-format": "Brightness: <big>{percent}%</big>",
-    "format": "<span font='10'>{icon}</span>",
-    "format-icons": ["", ""]
-  },
-  "cpu": {
-    "format": "{}% "
-  },
-  "memory": {
-    "format": "{}% "
-  },
-  "idle_inhibitor": {
-    "format": "<span font='10'>{icon} </span>",
-    "format-icons": {
-      "activated": "",
-      "deactivated": ""
-    }
-  },
-  "battery": {
-    "tooltip": false,
-    "states": {
-      "critical": 25
-    },
-    "full-at": 84,
-    "format": "<span font='10'>{icon}</span> {capacity}%",
-    "format-full": "<span font='10'>{icon}</span>",
-    "format-icons": ["", "", "", "", ""],
-  },
-  "network": {
-    "interval": 3,
-    "tooltip": true,
-    //"interface": "wlp4s0", // (Optional) To force the use of this interface          \uF2E7,
-    "format-wifi": "<span font='10'></span> \uf062 {bandwidthUpBits} | \uf063 {bandwidthDownBits}",
-    "format-ethernet": "<span font='10'></span> \uf062 {bandwidthUpBits} | \uf063 {bandwidthDownBits}",
-    "format-disconnected": "",
-    "tooltip-format-wifi": "{essid} ({signalStrength}%)  {ipaddr}",
-    "tooltip-format-ethernet": "{ifname}  {ipaddr}"
-  },
-  //\ue04f{volume}%
-  "pulseaudio": {
-    "tooltip": false,
-    "format": "{volume}% <span font='10'>{icon}</span>",
-    "format-bluetooth": "{volume}% <span font='10'>{icon}</span>",
-    "format-muted": "",
-    "on-click": "pavucontrol",
-    "format-alt": "{volume}% <span font='10'>{icon}</span>",
-    "format-icons": {
-      "headphones": "",
-      "handsfree": "",
-      "headset": "",
-      "phone": "",
-      "portable": "",
-      "car": "",
-      "default": ["","", ""]
-    }
-  },
-  "mpd": {
-    "format": "{artist} - {title} <span color=\"#999999\">[<span color=\"#ffffff\">{elapsedTime:%M:%S}</span> / {totalTime:%M:%S}]</span>",
-    "format-disconnected": "",
-    "format-stopped": "",
-    "interval": 1,
-    "state-icons": {
-      "paused": "",
-      "playing": ""
-    },
-    "tooltip-format": "MPD (connected)",
-    "tooltip-format-disconnected": "MPD (disconnected)"
-  }
-}

modules/graphical/.config/waybar/style.css

@@ -1,4 +1,19 @@
-@import "./colorscheme.css";
+@define-color base00 #1a181a;
+@define-color base01 #2d2a2e;
+@define-color base02 #303030;
+@define-color base03 #949494;
+@define-color base04 #d3d1d4;
+@define-color base05 #e3e1e4;
+@define-color base06 #303030;
+@define-color base07 #ff5f5f;
+@define-color base08 #f85e84;
+@define-color base09 #df5923;
+@define-color base0A #e5c463;
+@define-color base0B #9ecd6f;
+@define-color base0C #ef9062;
+@define-color base0D #7accd7;
+@define-color base0E #ab9df2;
+@define-color base0F #d70000;
 
 * {
     min-height: 0;
@@ -8,7 +23,7 @@
 window#waybar {
     font-family: Hack, FontAwesome;
     font-weight: 500;
-    font-size: 14px;
+    font-size: 16px;
     background: rgba(11, 12, 13, 0.90);
     border-bottom: 1px solid  rgba(0, 0, 2, 0.53);
     color: @base04;
@@ -16,7 +31,7 @@ window#waybar {
 
 
 #workspaces button {
-    font-size: 14px;
+    font-size: 16px;
     box-shadow: none;
     text-shadow: none;
     padding: 0px 3px 0px 3px;
@@ -36,18 +51,20 @@ window#waybar {
 }
 
 #clock, #backlight, #battery, #cpu, #memory, #network, #pulseaudio, #custom-spotify, #tray, #mode {
-    font-size: 14px;
-    margin: 0px 10px 0px 5px;
+    font-size: 16px;
+}
+
+#clock {
+  margin-right: 12px;
 }
 
 #pulseaudio {
     /* border-top: 1px solid transparent; */
-    font-size: 12px;
-    margin-left: 15px;
+    font-size: 16px;
 }
 
 #battery {
-  font-size: 12px;
+  font-size: 16px;
 }
 
 #battery.critical {
@@ -57,7 +74,7 @@ window#waybar {
     color: @base0B;
 }
 #battery.full {
-    margin: 0px 0px 0px 0px;
+    color: @base0D;
 }
 
 
@@ -65,13 +82,11 @@ window#waybar {
     border-top: 1px solid transparent;
 }
 #network.disconnected {
-    margin: 0px 0px 0px 0px;
     color: rgba(75, 81, 98, 0);
 }
 
 
 #pulseaudio.muted {
-    margin: 0px 0px 0px 0px;
     color: rgba(75, 81, 98, 0);
 }
 

modules/graphical/default.nix

@@ -19,6 +19,8 @@ with lib; let
 in {
   imports = [
     ./sway
+    ./waybar.nix
+    ./mako.nix
   ];
 
   options.pub-solar.graphical = {
@@ -71,6 +73,10 @@ in {
     # Enable GVfs, a userspace virtual filesystem
     services.gvfs.enable = true;
 
+    # This actually lowers security and is
+    # required to run electron apps with the hardened kernel
+    boot.kernel.sysctl."kernel.unprivileged_userns_clone" = 1;
+
     fonts = {
       packages = with pkgs; [
         dejavu_fonts
@@ -108,11 +114,7 @@ in {
       xdg.configFile."user-dirs.dirs".source = ./.config/user-dirs.dirs;
       xdg.configFile."user-dirs.locale".source = ./.config/user-dirs.locale;
       xdg.configFile."xsettingsd/xsettingsd.conf".source = ./.config/xsettingsd/xsettingsd.conf;
-      xdg.configFile."mako/config".source = ./.config/mako/config;
       xdg.configFile."libinput-gestures.conf".source = ./.config/libinput-gestures.conf;
-      xdg.configFile."waybar/config".source = ./.config/waybar/config;
-      xdg.configFile."waybar/style.css".source = ./.config/waybar/style.css;
-      xdg.configFile."waybar/colorscheme.css".source = ./.config/waybar/colorscheme.css;
       xdg.configFile."wallpaper.jpg".source = ./assets/wallpaper.jpg;
 
       gtk = {

modules/graphical/mako.nix

@@ -0,0 +1,32 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+in {
+  home-manager.users."${psCfg.user.name}" = {
+    services.mako = {
+      enable = true;
+      extraConfig = ''
+        padding=10
+        margin=5,5,0
+        default-timeout=5000
+
+        background-color=#1a181a
+        text-color=#e3e1e4
+        border-color=#ff5f5f
+        font=Hack 14
+
+        [urgency=high]
+        background-color=#ff5f5f
+        text-color=#1a181a
+        border-color=#1a181a
+        layer=overlay
+        font=Hack 14
+      '';
+    };
+  };
+}

modules/graphical/sway/default.nix

@@ -51,9 +51,7 @@ in {
       sway
       grim
       kanshi
-      mako
       slurp
-      swayidle
       swaybg
       xwayland
 
@@ -75,14 +73,8 @@ in {
     ];
 
     home-manager.users."${psCfg.user.name}" = {
-      programs.waybar.enable = true;
-      #programs.waybar.systemd.enable = true;
-
-      systemd.user.services.mako = import ./mako.service.nix {inherit pkgs psCfg;};
       systemd.user.services.sway = import ./sway.service.nix {inherit pkgs psCfg;};
-      systemd.user.services.swayidle = import ./swayidle.service.nix {inherit pkgs psCfg;};
       systemd.user.services.xsettingsd = import ./xsettingsd.service.nix {inherit pkgs psCfg;};
-      systemd.user.services.waybar = import ./waybar.service.nix {inherit pkgs psCfg;};
       systemd.user.targets.sway-session = import ./sway-session.target.nix {inherit pkgs psCfg;};
 
       xdg.configFile."sway/config".text = import ./config/config.nix {inherit config pkgs;};
@@ -93,6 +85,32 @@ in {
       xdg.configFile."sway/config.d/mode_system.conf".text = import ./config/config.d/mode_system.conf.nix {inherit pkgs psCfg;};
       xdg.configFile."sway/config.d/applications.conf".source = ./config/config.d/applications.conf;
       xdg.configFile."sway/config.d/systemd.conf".source = ./config/config.d/systemd.conf;
+
+      services.swayidle = with pkgs; {
+        enable = true;
+        events = [
+          {
+            event = "before-sleep";
+            command = "${systemd}/bin/systemctl hibernate";
+          }
+        ];
+        timeouts = [
+          {
+            timeout = 120;
+            command = "${swaylock-bg}/bin/swaylock-bg";
+          }
+          {
+            timeout = 130;
+            command = "${sway}/bin/swaymsg \"output * dpms off\"";
+            resumeCommand = "${sway}/bin/swaymsg \"output * dpms on\"";
+          }
+          {
+            timeout = 300;
+            command = "${systemd}/bin/systemctl hibernate";
+          }
+        ];
+        systemdTarget = "sway-session.target";
+      };
     };
   };
 }

modules/graphical/sway/mako.service.nix

@@ -1,18 +0,0 @@
-{pkgs, ...}: {
-  Unit = {
-    Description = "Lightweight Wayland notification daemon";
-    Documentation = ["man:mako(1)"];
-    BindsTo = ["sway-session.target"];
-    After = ["sway-session.target"];
-    ConditionEnvironment = ["WAYLAND_DISPLAY"];
-  };
-  Service = {
-    Type = "dbus";
-    BusName = "org.freedesktop.Notifications";
-    ExecStart = "${pkgs.mako}/bin/mako";
-    ExecReload = "${pkgs.mako}/bin/makoctl reload";
-  };
-  Install = {
-    WantedBy = ["sway-session.target"];
-  };
-}

modules/graphical/sway/swayidle.service.nix

@@ -1,28 +0,0 @@
-{
-  pkgs,
-  psCfg,
-  ...
-}: {
-  Unit = {
-    Description = "Idle manager for Wayland";
-    Documentation = ["man:swayidle(1)"];
-    BindsTo = ["graphical-session.target"];
-    Wants = ["graphical-session-pre.target"];
-    After = ["graphical-session-pre.target"];
-  };
-  Service = {
-    Type = "simple";
-    Environment = "PATH=/run/current-system/sw/bin:${pkgs.sway}/bin:${pkgs.swayidle}/bin";
-    ExecStart = with pkgs; ''
-      swayidle -w \
-      before-sleep '${systemd}/bin/systemctl hibernate' \
-      timeout 120 '${swaylock-bg}/bin/swaylock-bg' \
-      timeout 130 '${sway}/bin/swaymsg "output * dpms off"' \
-        resume '${sway}/bin/swaymsg "output * dpms on"' \
-      timeout 300 '${systemd}/bin/systemctl hibernate'
-    '';
-  };
-  Install = {
-    WantedBy = ["sway-session.target"];
-  };
-}

modules/graphical/sway/waybar.service.nix

@@ -1,21 +0,0 @@
-{pkgs, ...}: {
-  Unit = {
-    Description = "Highly customizable Wayland bar for Sway and Wlroots based compositors.";
-    Documentation = "https://github.com/Alexays/Waybar/wiki/";
-    BindsTo = ["sway-session.target"];
-    After = ["sway-session.target" "network-online.target"];
-    Wants = ["graphical-session-pre.target" "network-online.target" "blueman-applet.service"];
-    ConditionEnvironment = ["WAYLAND_DISPLAY"];
-  };
-
-  Service = {
-    Type = "dbus";
-    Environment = "PATH=${pkgs.bash}/bin:${pkgs.pavucontrol}/bin";
-    BusName = "fr.arouillard.waybar";
-    ExecStart = "${pkgs.waybar}/bin/waybar";
-  };
-
-  Install = {
-    WantedBy = ["sway-session.target"];
-  };
-}

modules/graphical/waybar.nix

@@ -0,0 +1,96 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+with lib; let
+  psCfg = config.pub-solar;
+in {
+  home-manager.users."${psCfg.user.name}" = {
+    programs.waybar = {
+      enable = true;
+      settings.main = {
+        layer = "top";
+        position = "top";
+
+        height = 32;
+        spacing = 16;
+        modules-left = ["sway/workspaces"];
+        modules-center = ["sway/mode"];
+        modules-right = ["network" "tray" "sway/language" "pulseaudio" "battery" "clock"];
+
+        "sway/workspaces".disable-scroll = true;
+        "sway/mode" = {
+          tooltip = false;
+          format = "{}";
+        };
+        "sway/window" = {
+          tooltip = false;
+          max-length = 96;
+        };
+        "sway/language" = {
+          format = "{}";
+          max-length = 2;
+          on-click = "${pkgs.toggle-kbd-layout}/bin/toggle-kbd-layout";
+        };
+        tray = {
+          icon-size = 16;
+          spacing = 16;
+        };
+        clock = {
+          tooltip-format = "<tt><small>{calendar}</small></tt>";
+          format-alt = "{:%a %d. %h %H:%M}";
+          calendar = {
+            mode-mon-col = "3";
+            on-scroll = "-1";
+            on-click-right = "mode";
+            format = {
+              months =     "<span color='#ffead3'><b>{}</b></span>";
+              days =       "<span color='#ecc6d9'><b>{}</b></span>";
+              weekdays =   "<span color='#ffcc66'><b>{}</b></span>";
+              today =      "<span color='#ff6699'><b><u>{}</u></b></span>";
+            };
+          };
+        };
+        battery = {
+          tooltip = false;
+          states = {
+            critical = 20;
+          };
+          full-at = 90;
+          format = "<span font='12'>{icon}</span>  {capacity}%";
+          format-icons = ["" "" "" "" ""];
+        };
+        network = {
+          interval = 3;
+          tooltip = true;
+          format-wifi = "{bandwidthUpBits} up | {bandwidthDownBits} down";
+          format-ethernet = "{bandwidthUpBits} up | {bandwidthDownBits} down";
+          format-disconnected = "no network";
+          tooltip-format-wifi = "{essid} ({signalStrength}%)   {ipaddr}";
+          tooltip-format-ethernet = "{ifname}  {ipaddr}";
+        };
+        pulseaudio = {
+          tooltip = false;
+          format = "<span font='12'>{icon}</span> {volume}%";
+          format-bluetooth = "<span font='12'>{icon}</span> {volume}%";
+          format-muted = "<span font='12'>{icon}x</span>";
+          on-click = "pavucontrol";
+          format-icons = {
+            headphones = "";
+            handsfree = "";
+            headset = "";
+            phone = "";
+            portable = "";
+            car = "";
+            default = ["" "" ""];
+          };
+        };
+      };
+      style = builtins.readFile ./.config/waybar/style.css;
+      systemd.enable = true;
+      systemd.target = "sway-session.target";
+    };
+  };
+}

modules/nextcloud/default.nix

@@ -1,13 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-with lib; let
-  psCfg = config.pub-solar;
-in {
-  home-manager.users."${psCfg.user.name}" = {
-    systemd.user.services.nextcloud-client = import ./nextcloud.service.nix pkgs;
-  };
-}

modules/nextcloud/nextcloud.service.nix

@@ -1,20 +0,0 @@
-pkgs: {
-  Unit = {
-    Description = "Nextcloud Client";
-    BindsTo = ["sway-session.target"];
-    Wants = ["graphical-session-pre.target"];
-    After = ["graphical-session-pre.target"];
-    # ConditionEnvironment requires systemd v247 to work correctly
-    ConditionEnvironment = ["WAYLAND_DISPLAY"];
-  };
-  Service = {
-    Type = "simple";
-    ExecStart = "${pkgs.nextcloud-client}/bin/nextcloud --background";
-    ExecReload = "/run/current-system/sw/bin/kill -HUP $MAINPID";
-    KillMode = "process";
-    Restart = "on-failure";
-  };
-  Install = {
-    WantedBy = ["sway-session.target"];
-  };
-}

modules/portable/default.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+{
+  services.cron = {
+    enable = true;
+    systemCronJobs = [
+      "*/5 * * * * b12f ${pkgs.check-battery}/bin/check-battery"
+    ];
+  };
+}

modules/proxy/authelia-authrequest.conf

@@ -0,0 +1,32 @@
+## Send a subrequest to Authelia to verify if the user is authenticated and has permission to access the resource.
+auth_request /internal/authelia/authz;
+
+## Save the upstream metadata response headers from Authelia to variables.
+auth_request_set $user $upstream_http_remote_user;
+auth_request_set $groups $upstream_http_remote_groups;
+auth_request_set $name $upstream_http_remote_name;
+auth_request_set $email $upstream_http_remote_email;
+
+## Inject the metadata response headers from the variables into the request made to the backend.
+proxy_set_header Remote-User $user;
+proxy_set_header Remote-Groups $groups;
+proxy_set_header Remote-Email $email;
+proxy_set_header Remote-Name $name;
+
+## Configure the redirection when the authz failure occurs. Lines starting with 'Modern Method' and 'Legacy Method'
+## should be commented / uncommented as pairs. The modern method uses the session cookies configuration's authelia_url
+## value to determine the redirection URL here. It's much simpler and compatible with the mutli-cookie domain easily.
+
+## Modern Method: Set the $redirection_url to the Location header of the response to the Authz endpoint.
+auth_request_set $redirection_url $upstream_http_location;
+
+## Modern Method: When there is a 401 response code from the authz endpoint redirect to the $redirection_url.
+error_page 401 =302 $redirection_url;
+
+## Legacy Method: Set $target_url to the original requested URL.
+## This requires http_set_misc module, replace 'set_escape_uri' with 'set' if you don't have this module.
+# set_escape_uri $target_url $scheme://$http_host$request_uri;
+
+## Legacy Method: When there is a 401 response code from the authz endpoint redirect to the portal with the 'rd'
+## URL parameter set to $target_url. This requires users update 'auth.example.com/' with their external authelia URL.
+# error_page 401 =302 https://auth.example.com/?rd=$target_url;

modules/proxy/authelia-location.conf

@@ -0,0 +1,32 @@
+set $upstream_authelia https://auth.b12f.io/api/authz/auth-request;
+
+## Virtual endpoint created by nginx to forward auth requests.
+location /internal/authelia/authz {
+    ## Essential Proxy Configuration
+    internal;
+    proxy_pass $upstream_authelia;
+
+    ## Headers
+    ## The headers starting with X-* are required.
+    proxy_set_header X-Original-Method $request_method;
+    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header Content-Length "";
+    proxy_set_header Connection "";
+
+    ## Basic Proxy Configuration
+    proxy_pass_request_body off;
+    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; # Timeout if the real server is dead
+    proxy_redirect http:// $scheme://;
+    proxy_http_version 1.1;
+    proxy_cache_bypass $cookie_session;
+    proxy_no_cache $cookie_session;
+    proxy_buffers 4 32k;
+    client_body_buffer_size 128k;
+
+    ## Advanced Proxy Configuration
+    send_timeout 5m;
+    proxy_read_timeout 240;
+    proxy_send_timeout 240;
+    proxy_connect_timeout 240;
+}

modules/proxy/default.nix

@@ -0,0 +1,29 @@
+{
+  flake,
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  services.nginx = {
+    enable = true;
+
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+    recommendedTlsSettings = true;
+    recommendedProxySettings = true;
+
+    resolver.addresses = [
+      "10.13.12.7"
+      "[fd00:b12f:acab:1312:acab:7::]"
+    ];
+  };
+
+  environment.etc = {
+    "nginx/conf-available/proxy.conf".source = ./proxy.conf;
+    "nginx/conf-available/authelia-location.conf".source = ./authelia-location.conf;
+    "nginx/conf-available/authelia-authrequest.conf".source = ./authelia-authrequest.conf;
+  };
+}

modules/proxy/proxy.conf

@@ -0,0 +1,33 @@
+## Headers
+proxy_set_header Host $host;
+proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-Forwarded-Host $http_host;
+proxy_set_header X-Forwarded-URI $request_uri;
+proxy_set_header X-Forwarded-Ssl on;
+proxy_set_header X-Forwarded-For $remote_addr;
+proxy_set_header X-Real-IP $remote_addr;
+
+## Basic Proxy Configuration
+client_body_buffer_size 128k;
+proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; ## Timeout if the real server is dead.
+proxy_redirect  http://  $scheme://;
+proxy_http_version 1.1;
+proxy_cache_bypass $cookie_session;
+proxy_no_cache $cookie_session;
+proxy_buffers 64 256k;
+
+## Trusted Proxies Configuration
+## Please read the following documentation before configuring this:
+##     https://www.authelia.com/integration/proxies/nginx/#trusted-proxies
+set_real_ip_from 10.13.12.0/24;
+set_real_ip_from fc00::/7;
+
+real_ip_header X-Forwarded-For;
+real_ip_recursive on;
+
+## Advanced Proxy Configuration
+send_timeout 5m;
+proxy_read_timeout 360;
+proxy_send_timeout 360;
+proxy_connect_timeout 360;

modules/wireguard/private.nix

@@ -45,7 +45,7 @@ in {
     networking.firewall.allowedUDPPorts = [51899];
 
     systemd.services.wireguard-wg-private = {
-      after = [
+      wantedBy = [
         "network.target"
         "network-online.target"
         "nss-lookup.target"
@@ -54,7 +54,7 @@ in {
       serviceConfig = {
         Type = mkForce "simple";
         Restart = "on-failure";
-        RestartSec = "30";
+        RestartSec = "10";
       };
 
       environment = {
@@ -98,7 +98,6 @@ in {
               "::/0"
             ] else []);
             endpoint = "vpn.b12f.io:51899";
-            persistentKeepalive = 30;
             dynamicEndpointRefreshSeconds = 30;
           }
         ];

modules/wireguard/tunnel.nix

@@ -41,8 +41,26 @@ in {
   config = mkIf (length cfg.ownIPs != 0){
     networking.firewall.allowedUDPPorts = [51820];
 
-    systemd.services.wireguard-wg-tunnel = mkIf (length config.pub-solar.wireguard.private.ownIPs != 0) {
-      after = [ "wireguard-wg-private.service" ];
+    systemd.services.wireguard-wg-tunnel = {
+      after = [
+        "network.target"
+        "network-online.target"
+        "nss-lookup.target"
+      ];
+
+      wants = [
+        "wireguard-wg-private.service"
+      ];
+
+      preStart = ''
+        while true; do
+          if ${pkgs.netcat}/bin/nc -w 5 -z 10.13.12.7 22 2>/dev/null; then
+            exit 0;
+          else
+            sleep 1;
+          fi
+        done;
+      '';
 
       serviceConfig = {
         Type = mkForce "simple";

overlays/default.nix

@@ -17,6 +17,7 @@
             factorio-headless = master.factorio-headless;
             paperless-ngx = master.paperless-ngx;
             waybar = master.waybar;
+            ungoogled-chromium = master.ungoogled-chromium;
 
             adlist = inputs.adblock-unbound.packages.${prev.system};
 

pkgs/check-battery.nix

@@ -0,0 +1,13 @@
+self:
+with self; ''
+status=$(cat /sys/class/power_supply/BAT0/status)
+if [ $status != "Discharging" ]; then
+  exit 0
+fi
+
+capacity=$(cat /sys/class/power_supply/BAT0/capacity)
+if [ $capacity -lt 20 ]; then
+  export DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u)/bus
+  ${libnotify}/bin/notify-send -u critical "Battery ''${capacity}%"
+fi
+''

pkgs/default.nix

@@ -4,6 +4,7 @@ with prev; {
   sources = callPackage (import ./_sources/generated.nix) {};
   # then, call packages with `final.callPackage`
   # caddy = callPackage (import ./caddy) {};
+  check-battery = writeShellScriptBin "check-battery" (import ./check-battery.nix final);
   concourse = import ./concourse.nix final;
   fetch-hostingde-invoices = import ./fetch-hostingde-invoices final;
   import-gtk-settings = writeShellScriptBin "import-gtk-settings" (import ./import-gtk-settings.nix final);
@@ -13,8 +14,6 @@ with prev; {
   mu = writeShellScriptBin "mu" (import ./mu.nix final);
   p = writeShellScriptBin "p" (import ./p.nix final);
   present-md = writeShellScriptBin "present-md" (import ./present-md.nix final);
-  psos = writeShellScriptBin "psos" (import ./psos.nix final);
-  psos-docs = import ./psos-docs.nix final;
   s = writeShellScriptBin "s" (import ./s.nix final);
   sway-launcher = writeScriptBin "sway-launcher" (import ./sway-launcher.nix final);
   sway-service = writeShellScriptBin "sway-service" (import ./sway-service.nix final);

pkgs/psos-docs.nix

@@ -1,27 +0,0 @@
-self:
-with self;
-  stdenv.mkDerivation rec {
-    pname = "psos-docs";
-    version = "0.0.1";
-    buildInputs = [
-      mdbook
-      mdbook-pdf
-    ];
-
-    src = ../docs/..; # wut
-
-    phases = ["buildPhase" "installPhase"];
-
-    buildPhase = ''
-      cp -r $src/doc ./doc
-      cp $src/README.md ./README.md
-      chmod ug+w -R .
-      ls -la .
-      mdbook build doc
-    '';
-
-    installPhase = ''
-      mkdir -p $out/lib/
-      cp -r doc/book $out/lib/html
-    '';
-  }

pkgs/psos.nix

@@ -1,34 +0,0 @@
-self:
-with self; ''
-  case $1 in
-    rebuild)
-      shift;
-      exec sudo nixos-rebuild switch --flake "/etc/nixos#installed-host" $@
-      ;;
-    update)
-      shift;
-      cd /etc/nixos
-      git pull
-      exec nix flake update
-      ;;
-    option)
-      shift;
-      exec nixos-option -I nixpkgs=/etc/nixos/lib/compat $@
-      ;;
-    help)
-      shift;
-      exec xdg-open http://help.local/
-      ;;
-    *)
-      if [[ "$@" != "" ]]; then
-        echo "Unknown command: psos $@"
-        echo ""
-      fi
-      echo "Usage: psos [COMMAND]"
-      echo "  rebuild                   Rebuild the configuration and switch to it"
-      echo "  update                    Pull git and update flake.lock"
-      echo "  option [path]             See the current value for an option in the flake config. Example: psos option nix.nixPath"
-      exit 1
-      ;;
-  esac
-''

pkgs/toggle-kbd-layout.nix

@@ -5,12 +5,15 @@ with self; ''
   current_layout=$(${sway}/bin/swaymsg -t get_inputs | ${jq}/bin/jq -r '.[] | select(.type == "keyboard") | .xkb_active_layout_index' | head -1)
   total_layouts=$(${sway}/bin/swaymsg -t get_inputs | ${jq}/bin/jq -r '.[] | select(.type == "keyboard") | .xkb_layout_names | length' | head -1)
 
-  next_layout=$(expr $current_layout + 1);
+  next_layout_index=$(expr $current_layout + 1);
 
-  if [ $next_layout -ge $total_layouts ]; then
-    next_layout=0;
+  if [ $next_layout_index -ge $total_layouts ]; then
+    next_layout_index=0;
   fi
 
+  ${sway}/bin/swaymsg input '*' xkb_switch_layout "$next_layout_index"
+
+  echo $next_layout_index
+  next_layout=$(${sway}/bin/swaymsg -t get_inputs | ${jq}/bin/jq  -r "[ .[] | select(.type == \"keyboard\") | .xkb_layout_names ][0].[$next_layout_index]")
   ${libnotify}/bin/notify-send "$next_layout"
-  ${sway}/bin/swaymsg input '*' xkb_switch_layout "$next_layout"
 ''

secrets/authelia-jwt-secret.age

@@ -0,0 +1,24 @@
+age-encryption.org/v1
+-> ssh-ed25519 8bHz7g zKjSwAkx3AP3kn3E+Yxx3vqvKDPp1RfRqI2DXsGZEUo
+px/kpl3Emm85x8jC3FX2GTsOKlbv+yu3M9z3oUipLxE
+-> ssh-rsa kFDS0A
+ezAH1vla7uUC7jbtsc4s/PoASi4SyD5SlHpdwSFWqF4rKwkamJLgUlfv8D0ogSHl
+iGF/XypomK4wQbc+B1fECKZGfbaXtqY8un8Zljh5rC4v4Un7twwA+uoXkUUNF5/q
++UlJnCnJL5kpM89mpYc3YXT/E/xbKT/LcEhn7ngTWcDxgMkbxOgj5N5t/XUWxtMD
+qjv1DfXNHl95gI02yMpqmxGly0tIY9nHD1vAz87w25swr4VJFn3yjCVZlKz2+m5w
+b5SghK9ZotXlvZDLhe12+//XTbEtr3FW9cwU7Ad6ATTD15CnciCI1+wd3L8Os0In
+aV9NiGwXhThggnlDmMu22gw3QSj5f0masSSxSTFyCm/SSPL2mnlzANHuLj2DbTgA
+cNNWwIPUAB09cn0F5k1uYy1rsScaLf46gY+HWUYqGHvPaE7j2eY9phTt9qxgOWdP
+an9zktCMbJaoQ8EyaYpl7ZHjT9pfQPmmmrBDeFfPso5Oy681TWmwvifOe/lNWits
+EgKwR09yI780tELxXAZEO52rix503GtM0RJAJlifThvF5HU/FC4M7X1QoYYJsIMc
+ilhAsTlwIxQfXWTrt3hvucA4cwdfLh9USz1Otz9ct9NmfqOBHUD3eDz2DtKTUykW
+aushupzdaRQS1JIQqklzKZBc8r8W9ePO/MOTb3l2dAA
+-> piv-p256 zqq/iw A6lhtVxLSu9x/WnIzsBQYYcSepbrCh9LKffXdPnY44EP
+ZsTeF0qctvTCrAn1rOxtySolyA1ERsX6xoOFWykl1uE
+-> piv-p256 vRzPNw A+vnxQlBvTqe9zhXoIXkwqqmvXkmmxk5wOJE5viCqxA9
+2E+mx13FD2A89KAI95KnulBUUF3c9Nni7IGCn0LG6Y4
+-> e-grease WS4 hN A;D ^Q'
+89Rq7mgvyF6s9pQe0W7zM9I0wZQmTkLU75xQl7j8d+7kCvp8t5Qm9r1lS9QTqlfL
+L1MjgllMv0Mgl10I796UM5T21QoSdY3RfP8
+--- mQbEPEUmeSnOPFXoKIIc6VHOUqJqsddXnGz7ZyMvMGM
+	žMšøÜzóù‘Oð¼Î¬ŽÉ[µ>SŠÎ»IunxOZ¦Sée<C3A9>ÍÔ)ÏÑ–	«/lŠVe˜†Ú­?é/YìZT–9®Û<C2AE>µÎF»÷U<C3B7>Éó˜ÈîÄÑ]dRRÛã¼Ø™

secrets/dyndns.key.age

@@ -1,25 +1,23 @@
 age-encryption.org/v1
--> ssh-ed25519 8bHz7g 2M1zTXuz8F9ccQRXzNNBffl33O/uBo0Fq4lcfEC6KlU
-Lod8LXs62N/oGojaiFH3FBl7Tez/FdJIWznzSutsIjE
+-> ssh-ed25519 8bHz7g tU9tWTdUGfcYQDPViqDzMB+0cbhx69ttVhtVco2U7kk
+A1xkW3krGYL4bWMCOujo3nxg+pnIRlabfr0/rImYU34
 -> ssh-rsa kFDS0A
-OUWTYz/8wmdJ2WN2NXO4DtxICgVdAPhilFfQhz96HH4mI4ggDYS5RpQzffw+DozR
-W13PIUnLIrOzpn7+YPUz9bIIzYpjNnIoRQnMKN66MucdJNXJ1qBhTa0WDwnkC0KM
-M62GKjLMhQOesP48acx2OvGxdYIUJm8oD8TpAP1qb9Pg7Vy1F//KIs3BE6RsOM3w
-o17t6gYs718vza+5oVsXVayIsyDgISOhRT29EsuIoPDsDFjm1tz/UYeUtppwJruZ
-ArGcdz8bpC6INDNlB5Njrg/zECdiIvLZ030DlAuo9Y3IAcE/hFUQhwaYJe4OCMqf
-aA0vsPjsKPpXn4Ui8IyXP8JJ+CU3enu43bFH8h8q7LOb6rLxYFVAzT6jg7hLFdES
-7aPkBJR0nYMtt9gdL3KxmTtSgdKdRV8yqrHtBM/rj8IYvpjjqVwinrk5n7yaTBas
-jDAoi0OZ0wP9ZykaaILfkoar7ZecJgxWZ6dmaGB641Dwu7mZv4Pqh3uYDHjU2VYW
-f5TC0pzzuyE4me0fmy5efc0/wbxYH/bSw81tjih9KmRUhvqzxwMFBtnkYElYo2MM
-G7G/1GAYlHpewaXTc2k7pG7sicA42Zn0OoGLMpgWyJJWDvVa16XR133rUQmPCLOW
-T5FuGeQi+hDX/xJ2JoNiBXQfP84jqfmMSK7mO8O3ofI
--> piv-p256 zqq/iw Ay6ViJqFtNzyrZ9EBHHE3mE0h+jg2YkgMz0Y0oxqVAkK
-bolGO/OqFNoT6AF/z7bhocW9W2mYiYQUjsvKY8vuL8I
--> piv-p256 vRzPNw A0foK8gvOdXspZG0H0yT1gqf7JC1U14ZAuOvfL/j2MrE
-McGAqd59RKTg0BKAFl8CErbbfEjcTcHtTJqZFcFZSik
--> ez5dw-grease
-2GgPMYkIUyZhdPL4WWY0mIJDTjHt7YWZPebSHLe7++Hf1ZUQ8Q0Yv6oufH3YCeI3
-T9yVzdzkyJf51moR
---- G5KQtnyEAno2mVCtciQ1IvoyR98i1zUQMu98OLwTq84
-èÉÁk¾¨úö TLû 
'ßìrrL«eU­#P6Î#PÓO§b²Ú<C2B2>˜SUúÊÿÀÕ¼ˆÈûaêçÝÆ‚ïf0öRÂQ™<51>ÓÞ“Äs¹¯rfi¼çœ[.+ü‰JŸô
-1O
+mZN2a1v/gTk8baMSw9ZoDI4hHIFm6KhOYR7vvAKjK8OVaTQcFaTj7hMsZ2gT2erI
+Bgm0iHLrFBqqrrD9Mi2Tv2e/ePW8w5omcedo7bAcgCm2rdcTHePYswHnYTCTadCT
+hhH8kuZTMfEm1FU1c/CB898qhYFS6lOYFBnQYoSTsGgx3JCDB1S4Rm2AsyXvzlaZ
+TD6H6LcHYJRClcaHU/3bn4dmiEGwYoYOcYiHp6tM4+prVajGMrOYTPucAbf3xxzR
+GE7FMl6POvkniiPjamBF4K9cE8KtIzyDJoWLiZQOGOMXh5prSTEOFL8zerWKhJAR
+4kvSx2F0UtuKgikwQBpxRC40V12ivJGCrr7DFXxSZThBJzK1PfnAyY2VRrLr6QGM
+wqctsudOHtRHt5NTK4QzX8OMqmkdM+KBDHxxbfSg0d5Fy0qM5KOH1aw6+/pLC7rt
+gdE6sn3HQMRM2DL8PxJEC3GyJVuwmC2PC0uPqpvrcabM5S9cBvoLRUwp66vwNCPL
+CW7LdSAbu4TfPlffRmPoMqjuRo0HLQ76ZchSJyN0NDscejh1hsEbl/M5etjIAVu1
+IuiG4DR2yGJQOaFcKLyxbJcMKtI8+g01cr3K9GQr1IVh8bcouReJfmzIBv0kKZvK
+bMBhkPbyjhmgRj212/+QdsXHrEUhXGe04HHwPnjo/Xg
+-> piv-p256 zqq/iw Au0LMoXmBQujrAcouzeRYwE9th7w7VacTcPA1eE1xMqw
+hEaZcmAQ3ekiF/GuT2XLC0SEoHr9pLI8870g1t0cgr8
+-> piv-p256 vRzPNw A0XNs/XOz2O1eud5aH7Q4DbhR9WXmJGYwby27G5FoyrK
+nVibl5qpWLuxqR6DkoGbNrHEpCfxJUl5SdUxygHarrY
+-> Q]A>-grease `@,ipv 4]wX
+Xd1UCl4E88saY5AqPdzxKM77f0G8rsbqM78tBmg
+--- hlcJUXHAuVi75Oi2dr01NSh4RWjruTFyzWdJjk/mQ2U
+ð.ˆ·Ñ³DeN¶¦ÃcŒ{ºàr<C3A0>‰Ñ-a¥Ó>ùɪÿ±`AòHï§àeÜHDßÐM'tcm_•Ê”psH;„•Ó* Œ¶$JJQŽ„É'Ëíü#㉳ЩTº2«¨cë

secrets/firefly-cron-secrets.env.age

@@ -1,25 +1,24 @@
 age-encryption.org/v1
--> ssh-ed25519 8bHz7g 66swOUsEOMipbpWdvfQDyyhrlQs9SYIKDu7uRKXRgn8
-biYdYn5NgOV5F7Tpi2rXzBLDMufmZ/7Ux1fns/7p6YA
+-> ssh-ed25519 8bHz7g ENnUFWaMTl0qIRuWwDwf5LU5SEJacCmNbF4kehtytns
+8B01SNu4tpN35J/WPACTfwxm5+vy9Xr3fKWxtTcSxq4
 -> ssh-rsa kFDS0A
-ITieW8I1T3bdN62xVCipB4iGELGrP2pwY7hgZ61sIk3Oi9T98gXFYKS/t2GznPDl
-QczVlUvJ1Ujt2ozHfDGQsCHIsrNrEVCV9UOdaUjim2aWZ0pwvYGWJ0G+wuJCUK/Z
-N1miOPdKddOefUf5tTc5w+nPdRQuhxB4nRP+qpAHiPPigdM5RfNZCO1YtucIedBz
-3qMYXR4+Ouewv0evbimrbIrrdlvesQlHfA7q8N/uFm5BtAf43iu2fJ5xapHqC4d8
-vfGauwdyoOuM6xllW+wjsBNP4Vq6h6g3mT5FGXGmCHscNx6EZWy2CKPAAXHjukGS
-f8wCs7LPnd/1jS4DIXo3qjZ1kAnpqh+nC3J2hRfGrgjf4AoqDmdmUnRVx6vNOiEQ
-AhU1V05Utq7I4x8EQmpaR/x5ELehYXtpKUTQWoee9dvV9Ys2tae9qnYJpX5iWJ1D
-SjVJqL+a1GRGAzCiJnLFOAT+iPEByHQsqRqvjp9XBfQFtyk613lyBEQDWQznaSD9
-e0WPQpyGYpY/D7CmFKOrcjuRbpdW5f+Tnpu0p8y4uLeRuoXtrVL6FdYUlEEJQUHu
-RWFVy1Dg2Ft7wdKTtDjArV/93S6KYcU+lY8jzNQz3OgdVLImlgky92aWhTFehgVC
-ou9gs2wLWv9vAiFu0fb/y94Eupw/+fxwVEfvInIpX3I
--> piv-p256 zqq/iw A5tJ9Z0fDXK9jW6xG7jGLvH17N5hqoOBoo/MCX8pszjz
-XsbaaIOnMEbkvAgb3nDcVUiLCiG7atahzLwSyavzWvw
--> piv-p256 vRzPNw A9TeFYNYmlp9zJ2jGPRYjLdlhz0VPOJuhhzjJb44Plox
-XHsPQCEP6VuoLCCZZRyDzcH2cMzQj2qAH+xZxL0y5DU
--> eN-grease OZ NzlxU
-uRyMfsTMRnC1otTrruqhhelq+6ivP7PCF0t6VcDhPuA4qGsXsfxxILgJhI3eRWCT
-AeQ8efeEWMPCBVI
---- 1EhV0FID63UugANohR2Zn8Iq1XaEEbgQ38B9vmKONNc
-姨z<EFBFBD>,ｶzj.<2E>\ﾓ4a､﨧uﾌ+祁%鉸ﾙｴ@z]J<>ｧ[fXﾆ
-粐c<0B><>>fNJVｻ<b袁㍼=2<>2]ｨ皷<>ﾏ~
+Iyr4T/9nLrXnNF3t46B/bb71UtmrZ6Q2fUUrgQB/IY2mF2dkOg+Z9lslTu+cgvFM
+9A5whPOlvf9K5Z3X2pItHjLZTQuoyWevye/Nz1WHZ+GAMoVSibDzJao13jxGZ5C7
+elMV/22x3VvPQrwd7UcOhP3gB752sXcwiOhUjn+WWZYbvqLVNSmnZt541xhcTEmK
+Ef+/Mx8WwY9L+G0Coy8oFinhj9Uwlq1M9o+y27ehaUCQakvaRhxMwB93ucJYq7fT
+5eaDHv9da/3KnF0o9dAtvEyUvfjuDVcD1a9bX+PB+Ctd7liRDFYRLteGBX5oflzd
+qYVUHqQuXBmO6juBXwA0qe0mgDIoHIlPdFhdvUVec801OBS3OUwfpjm2AVJeFz7w
+kYv6nkmOmJoaSduwLgGkZlJ9XL9kt9x6GdThUYfukfDuEEV/9d4hiS2JvRYR9LJf
+xv8sbIG2L/WeUROqOQ/CtuhfHNYLr/B086e199EfoDoB3I1iI/kezsOqIFt5aYlF
+H7vzmehS+JucpXzCklZEJ3o87aythD8ykjJ9WDrh/Rdr2ChchyenlPN4fe0oSq32
+TrdXpyLUeEUfziq+PZsPYYFqeIdIrOcMML7p5aR8yEJFLxYi8+cMoomgsU+36DW2
+SaX7wAV+ypBQqfk1SbDqCfp38euEikM47E2zEAVPlJI
+-> piv-p256 zqq/iw AqcF/BWtdsliavHR9BQvhvp4fDt+PNtL3Z42Ey/Q7BsG
+jAZJPrf8fT7vWG43uTjUCStQO5BdCu9qWM5RcoBiDGA
+-> piv-p256 vRzPNw AoK+Ey7lxHQuFDuv0QVvuCQ0SJOT/PaAW8VK6e2zHDg0
+k4fachnuQvB7US1l463OevoiHGEpijp12XgZLOOzDbo
+-> uzP2\R0P-grease
+BKMYkkT/SqLY2jnMb2pPUtLLH+rKKfTRA8Ci6KM42Z0nQY/fwgudSvxNHFEBagjY
+VnZVvYeKOuyw+jofGhWqQJt/Bx/6i84SrA
+--- zZIJs/tZNBvXHUHkUGNC6XHq+5Wqb9y12cf2Iob2oBE
+tf=¤ößÏ<C39F>:$Ð’ãA¡¡ñaë•+	äå4D»´vŸ
n<>\Ÿºw6ÔWŸ	Grò6ƒè˜ãêòrôZÀ•{×Xê«í-ÈGñ¨î-$ä6

secrets/firefly-db-secrets.env.age

@@ -1,24 +1,24 @@
 age-encryption.org/v1
--> ssh-ed25519 8bHz7g EOBiyT+XbUTNXlTVZEKSqjTu596M3s0ThhnW5QhaLg8
-TCqqC4xam2BLFtBx7CZ/Wv/LmW24IQ+oB3DosLHHQAM
+-> ssh-ed25519 8bHz7g 7fscDY4cD3eU+uV5ydog2IgaDXXEOO/J4jSEo3smrlU
+51LfcGo3091EYv6MLqzN4+SmfEAaCG2AqxQygr5m820
 -> ssh-rsa kFDS0A
-KpDm5RpJtUAXEacIu6wWPg9ZNzSoi8L8rmzKAkKP2r5kQRe8qV0QjwAlM6yBKf/W
-od9Cmx33+ZwmXWJ+IMxZFRGhhGQWm8yjegs6oU47UqHrS4D9WCN4Eb1ZLM+VNz5a
-/9ZNPjJijde2XQH7GzduTgoPrzQhP32Z4z3PhB00+ij1CN0riF+WRR0+pS7WIK4J
-ay8uVqpn78NPUR0WApDDscVIBWZ3Dy2T/IOklqdRMbdprR6WSvfGVqMmb0KT8J5v
-lo3Zlb0Nqi4Af06c79/wdssJaEHvPnGXTSW5tKiL77pAz1HXl6GRIKTSiHXaEEZZ
-W6YSQ6tG8VRhDjiKD2GIB/dsYfRZAsge595kfZmHvAL9OplUD4FBUhCNah5MtxbV
-0/BTUN3N0+tVG31/ssdBi+BtMtcuEu9fb4uMjjrezNdObQXJg3PSVaJkwQ4HsjNT
-pZ+Q2alqBFmSIJf+IcNpIgdFoQMCac113BGzhQCEebFEkuem5Fw0whoKP5770R+n
-Z8uh8UunwGLNoE7XgP+XWpWh/64H+GKDEBVtP9ZXmtl5dW729n9oSLSb2B1pD+jj
-isVhM7RjVoWicAdH9B0fH3T5nq8OJFiTMl8azyvL9mDjsmBjmeDydOc2FMupQ9xS
-I7pJDRIWejRUQ++oxIXmlEJ2odN2uHAhXCT8dRw+fqg
--> piv-p256 zqq/iw Az25/im2z0pUUiTYx+M3Npk/2oY9UbusYXYeAoSRGNns
-+0B+TIdz4kRvWbjlqtOiJ5bj93IiSk3kIp6p54/j94E
--> piv-p256 vRzPNw AzoyfEC8b0XZPuOzkpJGtPpdszPxDk750zBED5QBdYj5
-gMMyz/uTTsfOGztsxoOy71wRUx2q8Edn4drR/DMvWFg
--> (l-grease ->N%-5VO A HK |w.l0A%Q
-QHowYsjCHy+UrjwQqcSKAFh3+PwRK6EykQSmPvuPlWMC2fp/d0UL3ONXvm3/tek
---- +GX80CPQhAQVnpRKBXbEGDYWkXSIhLouyBMlYzg0BYg
-*¶Íw¤…<C2A4>a­f’Ö„èŸðÇö-<2D>¼ç›o<E280BA>"Y_£¸\N}<7D>*^)‘íX]Åäí“þ X´Gµªi- XZƒþôÚ>
-îןì‹ðyÁ8•'‘<>
³}<7D>ûe’GÈ{ÄÙ¼OfÖ-|<7C>ÂOˆœPÄüþ¶	'˜Äê/gÚãŸMöåšÝ©EìOx‘H¢yÌçOW~m+À<>ÊÜ¿
+f7h6EH4h4JeCrtHWUZwu1QcYMURD/O4yvS1ZwUmoQSZBhDmwnR/OzOOQVB79plGG
+M0JaQohWhVldmPg3KX6Aq4uDqgSWsYeO9Q8BYaLBZpiw83qgQAhkqv85xcSSTGuQ
+eZMkr2aOvEMf8pOpmzPLvMiFI+Z5LwrvMuMmptGmUY9sJ/kp9ngjblJxtGk32p3S
+RuKGBY6iC+swpK2+BQy7vpjGnRXcUSuvVd/Nh72Vncamlm7BKXdYbop6UM1JYjQy
+bag6Ud2mEZFcmR+E0CTGWTD0S1rmce/VM/Lab4DSWXQrs6aB2UybOeCUF3eVaPE/
+C8UCeNKSOF+sRiiGz/vS68JS9DL5buhhnYjsjGLLt0hJ1KN/YT5MyVZN/bbGqZz2
+mC2Yd2TCF61v+7Zr763l2hSLztTPorGDiZV1a4WAujRP2uRWxbVz3io86NQNXc3d
+0ExybZ4nBEWJKd2yWTdxzUVVgVXZecwfWIXAOQML2TCJAz0cHzzaZjdfW6ACYr0X
+DtPN9BBFkrxboCENWjRcy3lniaIi8ef5e7ZmstbvjQxlMjBBZzE0dlrINjfzgQrz
+tGLGbzfmvTyssIs4+hu+ldpxF1xdM10VGP0NHk7P9PwjVJDtauPgfWL5SvnvEePP
+MTe9J74IS5ZKUpkbYc82pZ9N8ZuzMYmz0v5T0r+bj3U
+-> piv-p256 zqq/iw AgJRcywG0jtOF/Jy9TVEFkXQjYny8NtVpl7SZK/QmqGs
+ASFjv9Uda5pR7C6GLpVxTWATcdvTHX7+nD2KPx+5Gr0
+-> piv-p256 vRzPNw AloLZJP8lW8iWp9USg9+UQqjyZbvOlrkPyXzk/xVFkyl
+V75Xdr62EO3pUUsh6WEJyKEXUfaUfd+igr5qLmhSzKs
+-> Qrs?o-grease
+PFTlH6gTXESwADsl6c7YM+Ut9AbgJRMS1SDwSn1kFN/NTNNoDtnqzLS5fi3bCxDe
+w/D3t6AQws0u2g
+--- 6A9h83fQQ9fT+2q2N30OIwJkTMBTK8UzFSyWVjGKXpA
+¸#‚<>ýÉP<>R’-èùÕ­ø<C2AD>ŸîPE£s´dÆV®ˆè·<C3A8>Bñä³Û˜0ADø0Û/L;–×Q•°¤¡÷Ý°•N
§¾Áš[*·²‰ô(¬°7vÂzùTù¸œ RZ”BÇä«$duÕõü­šˆäÁëŽg^ʨÔ5Gcäu	~BFq¸*\uUÝÚMÿ)gºî’=G®Rm´¢Ìç/

secrets/hosting-de-invoice-sync-api-key.age

@@ -1,24 +1,24 @@
 age-encryption.org/v1
--> ssh-ed25519 8bHz7g zFQGBUd6WAdzaEzBavUWqm4U4ndIvzP00ntU1mhjSnw
-xJjfZz0wwqY3k1oqDwH9VxsM6/N61H/YV43JJZokfUY
+-> ssh-ed25519 8bHz7g 8rdlpuz3TCunjDVAO/PoymA89EQIrruHpR6JN5sIkkI
+xXN0koSPwM3pCKpH2qDRImvYq7q7azfNy7ppq2rRIFU
 -> ssh-rsa kFDS0A
-anu8DuRW7aev+nKgxZOchK5SVJO1/azxBITmEyy6IGHi78/DhaNEX1FdZoWTI4Sx
-dnND3DsCLdDiLgAUXWaQrbm+ZiTW4pip1pLFlEWDjddVtek2hLHYwUDd1g11bSm1
-a4Uk9Up54eZZF0j1y1/g4pwa2H/eQuQObE3uGR9RvFaIGmEftiH4aJN4jplPnXoW
-YuNNYRkdG2B9fHVnmHmKZetfqx4wcXMGM2BQCw93sCUYIiMl+ggzq6WiP5lNXrvl
-zVd3myPsMEWMWNX72OGmpaCtz2A2jWvO3MJlY+QjhaDzzvxN6/p6wxjGmsoymWIm
-r1ZdzDjZHU8e/WLrfoHXosKr0FYtRTFU69OjmShfkpK8eHFc433g9IsV2CNWLsMR
-oL9zkAvIH+cmkfzchKN2rgv8RgurDRXAOaX1tx5w/gZIrxfweXNHbUpeGej34e4A
-RDPxDgccfl0i6o2xKd6FnTV6RzEgnjhsQViq5B1/yRlHeHuFlXV4XRqEplduhepb
-DYY9+rxZM8uMxNTW5a9IcybWZJkocbmCUbkzOoTHpj0wtwlyKrqhtv3g+oAruPlO
-yKkq5RERT+i8TRDSJubiueBp8LdG0ffd1vUaXvLh2IXVyceHIul0K+dLxwZnqiIp
-+7jBIFjTRgQOiQdCCBkTvWrv3VrWRncElmAdvCKUAkY
--> piv-p256 zqq/iw AvONKaUIttkKS3u09BV7Pzhu4D8l2eD4Jeh+ebH07/BG
-97r1usenqTgi1QFQQ0DK1hhaTRgXXdSh9yPY6k3vg9A
--> piv-p256 vRzPNw A9jD43mHz8IhAx2T/LbUX5aDD0mD7qXyIsq+4qnJAYHp
-WHB14YVrqK9kULLkLaixTW5CuXV/F2PB+L6BlyLrBy4
--> E/-grease OT
-t5kB0LrtZWT1Wo75cYHgJhQHRgcZ1JOzahc6un1gP1/hmetCoOsCYKKtVszKr278
-dHFM1jMjn7EQH4kMUNXUOhcLrEy94A
---- MA00Lr6/JrZT09+RKzchJ57pvr8rg2y7wbQ6ZJu39Yg
-Iû¬Ž`åƒÕM´,¯gÙ-çaü:&ÎÑàÊ<C3A0>H|ûZø'U<>&¶MiÜ’q±Šä¢¼)Z²ãx7yt=¸NŒh>_‰“b€P„wȬÓ[ÐZÃ-
+I/iVl03DlSfPxRfmndXCM4VD6NGfmoRsHIFtRQSfB58FrMsadgRc1h+pqKIaKNcE
+c5TYcFOY6k4qOjTHLksTrs9kCP8TOVv/nlEQIeArb8qNnHJzNQ788iIqlM7Mbgkh
+xwHo3doAuckNOK0IZms+F/RrD3DWAOfagwxLUdmuwda6NqMHLZN9lvlkKadO7Aaj
+jO4WhNBF+t1bhEl9xogntgPND3TTWEN/RhlTCQF4PZteUhjjdIcxuELWuT4BDKEb
+XACpHsPJYMi/9IAOGTGqTkeIs7m4w8hFtbOLl84DY4ec03P3VGmPNBzpU1A9E0Sd
+czJgPMGFIGv76UqvFTXy87Nfkc/QNJ7gtOzmAuu5674kmVisMl67L/jk5pqVRgO+
+UyOf+A56Dt+224q+mgXOeMW/NdUDiVuyO/MC2Yai5H/w+sSF7pciMrJ0a9GFj+OK
+d5+qxsLOr3SdskIA6aOiFp2JhvvWDgZ4UIvCioCG7y1GqVpnv7K/7Tjn9y4d8LSZ
+nhpQL2wOTJ6sOQAQ5oc5lo3nqCv/QF1XwzoGo+L1UVR5WlsM9mJNoD+yN/6gD0pe
+3B45iwM0MpXy5N2qiT1Vhy39+Khh5vp40tPQDIqFuGvLAzRRrKjl7gp6QnegDdqX
+XiaKLe6uEkgyU80lXv7qDrp6Js0wGWde3x9ll07rqLk
+-> piv-p256 zqq/iw A3ojWGL4IKZCMVPeVXZKeWNDLaZUoVBGqubPRvVKjaJb
+PjLiZ6QBcaQlxeAcUqTvlUQ0yEbAp+1/0qlUxewVKDM
+-> piv-p256 vRzPNw AnH19MCu/ep73iwnA+T36tZWRNCcVoT4P59KQAKqj89L
+ztwGjBpEKOahU7XeP543/WdNzBAo2Lr+XU9QNtDf4zc
+-> Z$#a<-grease /+|s (q^%1!;i
+uAMcvqH7cObeEscVhea8W+PC4zYrAzOHZW+HHZjWbfhhUo6ydGAnV4JG9x9UEnll
+eHTMATaRlI6G1vjxYtA
+--- pwCLEHC9XL4kYGqgDiqio8iIKKVLbCdcUrXPAwwZeE0
+ëgís‹ÿSÊ<53>LZävÑP¹.g^AX<41>Ͳ‰Îà‘ÂÓ%+.ÞVâýAD\tΊKÉ-”éMئ€‚aj/AZ‰b¯tb¬çºDv¹o*^š

secrets/invoiceplane-db-password.age

@@ -1,23 +1,23 @@
 age-encryption.org/v1
--> ssh-ed25519 8bHz7g TCA9KQFzsUWdpQJxdBdkUPMvikhRxDI5YQKw/eiXQyo
-yJurY58hHJJgkn1wbMzi+oEioC/x7ef2F/87BYWwSk0
+-> ssh-ed25519 8bHz7g 5XO7I95Ar7qL5JzjmfSjDMEB3IIph7CKWJP67u0dg30
+jq9A/szOCQbBk+cUUZv2OCkZZq8UMy7fu+BCQPbYF8Q
 -> ssh-rsa kFDS0A
-WHCED5d5DDUuLZ2+YjuAhVDLUmr4Ap/hmhVpkHeXtgISmtwL/fd7oE3PbY9YOnFT
-RXz8bP+WMNYIR02rGdMc0EoiKVrTnsw/4cgMR8e03+yd2arJ2ee0MUefhzVL6lD6
-ZGigT/yU0F5/F/tOfpr9ZZw+JB4ZC632MtAOtiZsuZojQe4NbFL7kO/ROkY8UELk
-P3s5VtKw1H1SzYYfzOqza98ViLFqxVjkqjXWcFLBMg6cWHHbsGr57vkVchz39NyV
-1EMs4/5NKmYaL8OxNpu6ijv6kOmXMRdBJ5sNsJvG1SLN6UT93Ng1TH+c7kih9g/G
-BMaKLMUmMDjPoqDAKXlWZiTsbmKzpIy3xINeLSUcnCWs4cQVwoJuqQXqYr1fo8w3
-3qzKz5bDqy4S7rzg1Rys7fs58dLv4/gfdhDuygKMuknHwIPwNxG1hN7gRYfJ1cl9
-/+NyKDk1yJY2WzDZJbtq2kmd0CI75oTqC0mSXoq19hgwG7muzYYfy07lhX04aJQ7
-G8J14WzU8cthqPHHTveEuZ49xbYoowhrhQ7dj5c2Mn1UozT0iLs4IBOShdvwJTQX
-xgtxUYRSJ36m3J1iejcUAEJhICPrdLDeTYrCmltDL5tFKCNsr6unWiinbEI7OYAo
-fGM8IIb3Tb7H/d0uIHR6Mi5Rov7FnJdKa9P80XK8vxo
--> piv-p256 zqq/iw Av0NW0dKHLamCwcJ6PFYEmGgMtOPRkfDfNIK5J0IVFgp
-bNTjApEFndNw0fv5TfgRE7oo8SbnTb219h/RPwtxfiU
--> piv-p256 vRzPNw A7Wdd008zYOl4VkCkIwkwoZm5cCRpfuL+7GkR4NW/7rb
-vRlPIsznRuO/HDFDIYsdy/rCHPlX8Nq3I8Ow5wC2L5w
--> X`EMA<C-grease `' ZiXT+55 0
-CYzMaxueNx85gcbfHGJszBzoF9FRh9Pf/l0q4Sy7ju4Uv3pKJg
---- zBdflctZxVPfiYZ5LKoqd0AVa7uEw9tuur2nfjfCQfc
-[‹Î`ÎrÏÇ oÐŒªfÞdvô×VÃivA)Ò+ŠÅOÌa¡d”> ‹X®óþzþV¯^kYZÄfJ$ƒ#!»
+GIK2g7tPYcFOTbz5TgXAKXutVQb1namPGw2pfzf8jabsgRlQbWXR9xo3TgySlOZC
+bpbcNs9LOkyG9su7R0Q3VB/AZYsp0mixfh0aAcFBVjh9NRA989vdqaMzY5e3K0Rv
+9opc/YYdwSagHfC94BbwP6T+MA+3ukpm8tTXRudxZGzjRa7a1FWsBjHipqfUqGPT
+QoZRcaVW0lBdNA+H0rcwcYP+vGoHYO58fkxIs5tj4//uxasyYFRN6k1BsePh6U2u
+MiEaotlCoUKTjJMIh6aBArsFzv/s+5i8VQhL2YXzqCCk0hg1EyH1B3iHEdEwSskz
+xNQPq6sgDEaAk4K/qSFKLseen8DWFz2AL/4jhEL8YZLtbIt5nwg0PXley8M0hjV0
+PitQEfJuhyd9HtF0WdXY+DjnukeXDrBqfPZcRLZPvazxSqo4xnBh3t/39GFh8Rrw
+qj5sJ+shK7SnsbmDG4bNNrYDh22RfxDClInn89G7NRfVeYlqyswVh3cpNhHLTsGi
+ucWorz5NFQ9QrY0FnlwQjsW2HptjhP2ZZtCP1AJi8FQVg61W+MC+XumaFLhEa40c
+6Hn03r4cBGS90N7MTtdqcyoVIeggEdufI9vtDY/lrfhy7/e3I2F+XfuzmR3vORqs
+qEmiHDzH/SAD/6aSOxtXqTKu1m+LfG4c55WhlInM9HU
+-> piv-p256 zqq/iw Akln6P4WFprrCdthyn9HDY1GB9AA4eyBoE33TvAbgE0X
+IVENAfkcJCeJo9+Wgt/5kZD0y5bwQsefxN9MyejCbZs
+-> piv-p256 vRzPNw A7GkomUc1J3NsSxiS/HcyCwoIxU5rr9yqAGGFWHP1+yc
+bXnxRzxyPfa3LWq0uSJONl7NXKR5wo3/xkib9w2K2oc
+-> zQ/~=RXm-grease {kc Z
+xgcrCpjjb1n9hFM
+--- dEfgvftiM5d+B47Lyg+Mgqp6mt+XvBWFP3dIy3p7Nfs
+)€”4¡Ë÷fs[õ¥à®ËJ?Iº¤¸ãDÁIÀèÕ‚
æâÌ¢ÁêqåS7·-Ue<55>ùóåSûmÄ4z<>S¸

secrets/mail@b12f.io-password.age

@@ -1,24 +1,26 @@
 age-encryption.org/v1
--> ssh-ed25519 n71/yQ EyjzTXELrxtUfSmmQhwUZiD0YNxYIYTOMqAyvVbtfA8
-Y5LHi7e8Y74VekBdwiOCrHMhcweNYjEcTNQqgWnqSbE
+-> ssh-ed25519 8bHz7g mhrNQ6X4FHzNvLWypw3zx0ckYU0t8cBkjl07y8zhSGE
+EZGdtwFYi3+LEZgv/JcV2K4qdypFq15Gguxfs18lWTA
+-> ssh-ed25519 n71/yQ bZ1/2BHLKcNhD8EkkojunsFOkag4cTfE0L8maeLxyRk
+kctlXpT7nWdlcDlBaHiEyZ8AA9hlMbtAhjYHYrFtSjk
 -> ssh-rsa kFDS0A
-CQal9M6tSnQCNps4ZBr2F/rYE8fP9EYZJiJ7Vto5EvaEgHEIUOc6T7mYfGnqedHW
-a1pbwIRGEPS/Q/EIEZ5ozQy9/mcWrCpOqthty6jcsh6E6mScnUkq4p4xd2clrrK+
-fddLORVeMUaRhm6XBDsXwZHebto5MG3BXbGKMBpMGQhng6EtTRILFRsFKpp3xWRi
-fVuJFThjwOV4rukaSUdL/vBsIOOlANUSsxM3s6lzwho+kvjHukQI23IKMiotO7Sr
-s9WBOypT+jf8IOwccPcfZI2lYHVZFlqCYvskxCQTpiVNasSgSyCJmHP95UtR3hxS
-Z6RM/4HxJ0bdQ8mqFNIxsGcrIkQoIyVT9gP4vhl0YpAWXXzxbdV1zqBpSxPWsFH3
-iLfvFGA2iWgLUzedUXMtZhjeeK0TxjG6edsYFSYW+mwzeYCJYCHH2MYjharM/7Js
-rD5MqvMfF/bVYXYgVvcAWYcLWQ3dr6JgCrVIZ75uBDfhWAy1/cP8QD6U1jZvZn2d
-qr6YgUj4mxIgVYNWsEuT0+2z4m+lHw+AoYjfxk7a7Zh5RP0zfvJF/BbUd2wxJoIu
-/e/2LMo11GtLniZZTGEPeZX/ZT4GVhCpsziIHkLDsUY4ouT2KIwPaJeaFIcEMrHN
-RhKBpP/M4e2or7qYCd03+82zVyaLEEbdgEAME9Yk3+s
--> piv-p256 zqq/iw Ax5JLfx5M3ql8P6HsagnQpNobpuJKQzd8Cv1sQb4RpJ/
-ADhF/v8/sa224OTQw+huQjxVPnE0Xhg7eZmacx8RBlg
--> piv-p256 vRzPNw AvRzTmKw7Vd4QNnyeE6EDNRzcD/foqg3Z0KUnLd8pYW8
-fcFUmbUPBveQhDKLzSxeub2Tlmn+qoRfLEOrkJBEcUI
--> HxJ1F}Yi-grease ?sS?y7_^ MO
-1hmMavlruAyT7Bcoj01ic18WLFDczHdw0cWgXxVz38+/5cHh7dDwuR1qS2kADHzC
-HfMAwvYn5RJWY0PTUoqTQArsO+lCeb4/
---- W31vgvWmpOGbpFdGyboh5mQ3VffIGx/FUQ1uYR61U+4
-o)Ñ	&ð⬯•—Yô$¼Ī<C384>@áŠI«ææQìCD6ot%6{ö0—¨§íD€ÿËÇ8q/þoÁ<15>›O§<0E>¦°-ª³®n¿˜Ö®<C396>yø{¸NѬŽß(uiÅòÍÉ¿€±WP,´
+lgRrxLpW80twjIgj8dYi8WiaZeDW9nbOK1PwIFn830H6K3uD3v/1+UlrOmuOLakV
+ANRB2VNJlzXgWeg4+VKLc79qYmX/9LhS46QLrzENx3KKKyXyBqf9F7XCbHu0J+95
+Wt+XA/+OTy288AmFgO8Qa80WNZce712Mr93pIyfczisyGf8IiMCpR2ul+4HDwty9
+c7Q+rfKZixaIJ0ybRc+vepV+qovjgXaPU1nFtb/tcCWmxA0MO/zrltYmor9GeD5H
+seld4mYDdJ+HmrQMkIAodA/WRrm0woKXk/RP56OOhp/L/wvGJy5hKb20ki1+u5l6
+MIbcPNuwp9rMs2G6Yjv/Vt+pGpChxoU7kB8TnK9iJkn4RT/gGi9A6/xocC+U4/OJ
+Qu6zWs7M7KNtn4m29ZrAgjeNVXMOiKvP89+B0jtY/DR0lBu1fqhE9RjNQ5Ns8CBD
+wsoAO0wsi1n0QB/EHYabph6itc+jk2dA0DDqj2H9DClq6YPLRjcJfWgaXPpOtJK1
+5+rOwZHJ/MFXDGXJW7D+ewNIbuM+vNO6GIxYLpEcoyigJ9rREi36yIMo/qASdkWV
+KVJ/nMHxf8Tu+BrgtMXZ2YPV9+2Acmdh7kNaHmWSh7qJKHUJA8TyRe3jZpAC5m4v
+bDUCcIYTvhdfGMSgkxhyLCrPc52isfEG4YbEHsx4XkA
+-> piv-p256 zqq/iw A3VtBWDegSqGY/LyA/C2GEzxd3+NE5MBaFyuJzQGuQwy
+KtUPPP2PZ5ZaTYq2XPNR2q2JOlxWCdoZ4VXEeETEFME
+-> piv-p256 vRzPNw A2LMV/ZownRHylZjThU4XjrXi/FTbO5EIpcxLiE9/5or
+hNa4N9vuMsEI6yCtmT1qYw/ilurNivDqjf2X+Irzo4g
+-> c/-grease ##C EpP`;[_k E=V56~SX
+oyCtZqWQ
+--- E1vLmVyXPABdiO+H22tpBRP2x/tdM3Fj0rzRLrrYTaA
+½îŽïN¥7ô"ç—W0üLJD¦'‚J/5¹îí0ÓÔú»—±W¸CmŽ”dîv(‰¥#‰Q<0E>N)Ðñ„‘@UÉý
+ÐV¾ÎÂR/“Ê#‹û•¶ºtêŽb…Ÿ¿L<ÜšøÛ<>’T

secrets/rclone-pie.conf.age

@@ -1,23 +1,23 @@
 age-encryption.org/v1
--> ssh-ed25519 8bHz7g MmZ7fmLyYJ80ByhsPMjCsFnfYrYzkI/8P2IDTtydFXs
-HAfkn5/Za61+fJG1c9babFbnXN6QsnUtbjC4Ctf72qQ
+-> ssh-ed25519 8bHz7g 5tX4I9C2sqQ585//XBKPe/5wUGXS0II+VJpgmFD5JzE
+TFYb+9V1S70PI8zy6+TbeCE6Z5TxBtvRx/0s0cHNpmc
 -> ssh-rsa kFDS0A
-WgGNwmUZgFtD3qEGX/HkZMvHifYV6Q9cgMYQ3H8OMdc9e5Mil7gcnhimygdoYzIS
-zmWoS/GgwiNlvJmTEd/5KhqdrJ7blG8YoU1LKECwnsV/8EhJN6g7qKFgrDuwtlJS
-Yu0UktISAyV1CMc/BhiBPe7qcd45CKi0++HDFTUzGpD30ljWHtsjmjc7UJQZ86q+
-WsHG9+v7YELUm7dWuH2XMgzg0OCNw/zgbJzQfat6D1RC6jY9QC3xjYqjHJmkEK//
-nEOA0z2bAo3fEQc/ud3ZCVZ0mF5k+nVW8iKNGftUwzSoM3nQND7+Yn8t8tQVGCA7
-dYXlcTZjPToL6+K1V21fidsvMD4FKbM7eALMS23OF9rmG3Dk8hsmL87Ki+13x1Eg
-3yVXWMKxZNyNwWpsYREf3v8C/RBcfr9n8NUrwl0+8xbOHY5Bm3r1Jqi2mvlTVeyY
-PCJR/eh8VLkYN6Hhn0R+F1/sS0o80xL/OfyjB0tS9wxApyScdyr2PIaAlrymChUj
-APrsfd563/W19md86Nag8mdEQ4g2sICK7gO54anJUUpNIj36eEHJaN3SpJ1DX1nI
-VG/plVWBYqAR1+vr29OsiME0Zoxda8Pgp3AFVhUNU9UF7ZdOmr4SzMwctATUI2AI
-UqbDV+hnoIxvcVYGre1kCy5ASPa25FCLSKnzs0l3tMU
--> piv-p256 zqq/iw A0JYniZBQfPoL03FGWLSmErb/kPFlqGpJwleWTrACS65
-4MRrwXl9OsGqboRBbLguoJWEpxJVKThGYhHquCZ/rnI
--> piv-p256 vRzPNw AlgfAIkQxA/THKii8h9NLcy1vBhadoQWiVpXXcQEgUDA
-wteqtb2terIAUAeAx/7f8j7mNP2fYA5DnR0rQclm+3Y
--> z)1b)U".-grease
-9w
---- OBHthG1RpP739pjH0sr7z182fmOUhgmHv1c/ZBL2AW0
-Ö;láLŚO›Ą©>™®ń¦S…S˘˙\X<>Ş<DT`ál~k|›ŰK˘ŹR¸OkßaÖ=ćŘă
íĘ7Ď Ż1T¸|yČ%äÜ™—¸wçXöEóÎŻ‹šiké÷ĄzĆč’çj§;§Í‡üaŻĺHáŤ-äKY»:ÄôΧ—]¤®mĺŚî8°ť;W”56[:ď€ÉŃď°p¬eaÖć:\&‡ŕ°ŇáÄ_Ą®ő<C2AE>« <v¶<76>hů,´:”Xč“$†]?gO,¨˛P;ęîDaŮiäĹĂŹÂjĆU¶lÎ
+Uqbac+VKWOsIJ1WslFc68Y0aNs4Qqd50f9uUY+u+VkudQwGUcKrLeYASQVN5XwUL
+zFVw/39N7AR2giA9n/LEw683IZkjdhJt02Tl/soCvRNncCIaJw0SAfqoJVeQ2N07
+gFjqE6QYmh4/5DOInRayzOvxrDucz9ji/iNMwdXCNAoyTQzKf7EiLbtd8CKwnONx
+HDSj+YXTNFygM0kkRgcH4psiqxAJ/io7iXtmWgMDMn2Sa+h51b07KPax9qiVi/wl
+zeHs5Sc0eYnu16kPg/PN67PrVliMeOg03vBVR+tELDslmkObaZ5RVL76U5sHYgV3
+lC+i6lhRe2Brq3pusidP5fbw7Wpf05YnbpL0BE6C7xPa91P80SWYlCLn2+hKBZ7z
+YddOHSssfvlf25UGFt28FiSGUjbr7k24cV2tXgRcHlY2ObU2uQ2xgzPxGaFgtfSo
+bk6wPrH9dB3iEJIpSY4u9m3PgtNEKBknjZodzrE32Qz8Ffgut5NQ4oKJoZ/lJIu5
+KB8a5bsHfzRo95w3UAK4pb3MXjMY1F29lZZ9PofEuBDg1IR9x4aTs2RVp0yruAA4
+N+V53t5yUz4J1umrit5lGuE5TNxJyJZ1Med0b1z2V/A2tstVHnhi5WQX/Lvkd4QQ
+i/2WZfKC6xwdpdMUeBEeImzyEByv0ZYcTeJg/uyXEME
+-> piv-p256 zqq/iw Ar8w2iXTqd8Cp9MrNSBcx8F5R/i/LLO3+tbxcEeAaxQj
+K0fpNGKdieq5PdsUxkVbWvv4re0tbfJAvA5BLv3NXng
+-> piv-p256 vRzPNw A2cvMzMyWqr3x90irJ2UbvUhubHrSrWxOv2ufZxq7Uss
+RaBcEhSGlI72W9qkM4d73tLW36I85ezA8qaMuZ4gKeU
+-> )*,2-grease EO <n O26t]ur m"^s
+uS2pF4qN4V01mXD3V3z3k8fHRiXcWeLxJBJzl3NzbxVonHIhvfuF90U
+--- kA9nR0Nzybv6y6TFkN9R/8QkDj7DMF6sHAHIgPQsPMk
+ÎŐô:8Kü
0P
=­}u•`E&˛e#[<5B>_ ,ĂŮŘĹż®”e»hrµz@­_Ř–°nëŐkŔn=ś»"Bm …‡zhI
)é<>juéQWC<57>Žä[33  dx‚Äńµ—-ŕĄÔ¦ůuPŐ’[z2_)šqďgNz·ń95©*bX!:†#ÄKC}ż@cg¨yĆ9CŹ„©Ě/˙ĄNpwú}ŤëĚVŹáĺUWA”‰	äß‘ëÂ;€DjJUłnW‰>†”˝éžDŔnLľ9˘śÔ;73

secrets/secrets.nix

@@ -71,6 +71,11 @@ in {
   "firefly-importer-secrets.env.age".publicKeys = pieKeys ++ baseKeys;
   "firefly-cron-secrets.env.age".publicKeys = pieKeys ++ baseKeys;
 
+  "authelia-storage-encryption-key.age".publicKeys = pieKeys ++ baseKeys;
+  "authelia-session-secret.age".publicKeys = pieKeys ++ baseKeys;
+  "authelia-jwt-secret.age".publicKeys = pieKeys ++ baseKeys;
+  "authelia-users-file.age".publicKeys = pieKeys ++ baseKeys;
+
   "rclone-pie.conf.age".publicKeys = pieKeys ++ baseKeys;
   "restic-password.age".publicKeys = pieKeys ++ baseKeys;
 
@@ -87,7 +92,7 @@ in {
   "invoiceplane-db-password.age".publicKeys = pieKeys ++ baseKeys;
   "invoiceplane-db-secrets.env.age".publicKeys = pieKeys ++ baseKeys;
 
-  "mail@b12f.io-password.age".publicKeys = frikandelKeys ++ baseKeys;
+  "mail@b12f.io-password.age".publicKeys = pieKeys ++ frikandelKeys ++ baseKeys;
 
   "b12f.io-dkim-private-rsa.age".publicKeys = frikandelKeys ++ baseKeys;
 

secrets/wg-private-biolimo.age

@@ -1,23 +1,23 @@
 age-encryption.org/v1
--> ssh-ed25519 TnSWKQ MvgMl+dFyEfv2YIu6KUXqcCqOHCoRHCzj0xuBBUFIDI
-HMe1r4Moc3oMZX7J6fF8SgQUZyT5w7Wref5GZDfJ0YM
+-> ssh-ed25519 TnSWKQ ZZCY6VFZ7F/e7Xv3ogmlHuzQW4jP2hsE8ABjj7kwE0w
+SxtLCTTNj2MZK6zN84W+5QJIUWBv4/seo+9Egh/p9DY
 -> ssh-rsa kFDS0A
-lISWipj8WIOebuiGowBInUllFi4As3ORTmhWPFOSkPT0Esntfy3Le3L99XLt8opc
-II6uaXsyIPEPPJC/GQbWaMo9iShOzQj8u7vMiiR5IJ7Lo0KytFtCoOf+lr/EglUf
-IrfcME6ikzROdq574vF1pwqSwi0M6LbuITtmn1yDfP0IFoEMT2qAz9jg8DavrytS
-KKmsPFno0G+YNYKZ5w4khQGyS99YuCPPUw/phsbedAwuJZE6gyCp+TZhfbb85sac
-vxr3NTz/2/qaq9tsp/pzLmomRiBo9sllEh+aiA05V7b7Tk3yy1Vxhg0nJzvXI4Ra
-1iE0CWuFBWxbZoDuQm6IIUYjUltJWKZwcyBh03qlHter6FnqaCKLkGivcGqzQnTU
-hBk1uxig8sCm2cka2iSsHOahNNAEQ8/3I7zGe+FD6EDAHtid0mf6PuVsd7AZDFao
-jiaSBPg2Z1Ua3g4vQJ/qDexzdqcSlPFuKFsxBDr7pbvdPadFdoaqA8B73/yAwei6
-WQlC1uX4k43xY5jfUxQdy68mOZlXfdVpVZm3057n1zuETU8wzs6D6qviG6iYO49o
-yYVEEu65qf9I4j5XJW7DZpAOqxQiFQoDJF/BIx5RUPRPiGDxa4cbWbNqeynMmay/
-aPW6mDSlC88prxVmQCM+e9Gz1cX4q2pCGQifhySRpWw
--> piv-p256 zqq/iw Aq5EJVFwPV2JDR6a6ccMAKIqK1cUrqkW/hzyYlfm+3aw
-cBbqGAMZAMmMQDupnpWjMP3wdRlHJYuYVB27KQRS/AM
--> piv-p256 vRzPNw A/2NuOBEGAfcgz1hpdfczkvzHiEVRhIDf5pgpvmS1cAW
-GBhe63VMOE/eJa/noLbdKnNsRx5waCGzyGB5ZnX7xl0
--> X?_ri}-grease sSvM-a H{(
-kZ/yGjI
---- Sf8MIIUDfVRIpOezOiiSyeR194CK0wtQfJt8dk+1+YU
-O}s&é<>9s
<0A>½(i>‹_gcw0þÔ’WˆQËBØßk\àî~ÇžöM§±Ÿç¾²E†¯²@€b—C	õ}'å_2οÀy‹¯f
+AkyCC5oL0s+Cab4CLBERbHPc1Yhvpgmt1uErlAGWp0ZRKnksAf6XKlLFw8/6z5oX
+QgI9a1WOC3K9X0GvOTuhoh/m5De7kKzV1RFMepVB4SlZVRj0QZUO4fvr0auUAaEl
+Cv1DUkpHmLE3ZpIPTxSboMqLsZOgj+Sfas3X/Fc/vTDPCir6iIU8wlYQ8ZNYxUq6
+RDvmbl//nu83J7xsIZCyYCTAJb6VQXk2lNz2UsxE4BRKkaCQbS3g3IHbk6oV1Gwg
+zTqiqLY9kgIywA+vIqIkW5El7tCfyy7gN6DZFqu1vTD05M5i7UqHLkpy+rjo9X6D
+gjhhmMMwFea9mSGFeF1h9o/IBFmxejM2sue2R6EESRPONhdGauepZQHbYEFVDmJZ
+yczaWBiSmsayUHPPv+7Cx+OaCc/xCWyPiQPgSj73sijIw4o4SxOBluPpY+ECpj86
+UCX9xpDApuWjgvo3JIAQlg5MaQ5A6QW/UqqrcpfYWR0pjXnL31R2yQ0hHauO1Kvm
+NB1ChPxjhfoDkHi+IHIuSMyfDM18OOAmSKtZRMduy8CpRcp4aSCf+NRzpus9GjZF
+2/peROnKg+YO3H+EQ1to/niD5qo8Jj0nKuOME/lOyY47pNuhua3PBOsXERBN/qMP
+xJZy9hu3JQdm+erMIycMvD2tdkmrfPdoEIOijylUZcA
+-> piv-p256 zqq/iw AoIiwAJbykVEoDfDNxnx3SHgxyTrbVGCbo6kIiHNIO9S
+RHyOsqM3z+OE0ZLINcjfioUX6Jjm8qdSHvAnAj8QGAE
+-> piv-p256 vRzPNw Ag/8RzRTt3Qsj5CaIGM4GAO0/6acQQaS9ZTKlYLRBAkx
+QF2QTPL6k3wpsWV01t0O42uPzyEODOBrExT8VODMrYg
+-> R&03"-grease gka3rd@ 0Rt??bj
+Jr1XNmLf+agpBDOtsgYrW/doH8/M3oG3Nv8hrngyNAZuoGZyO52HTxwim1Rg
+--- q9CQR3Ai0kkidaY5S9jwnmbKY8qjmY9z+CdNvreAGc0
+§{K¶¹Arv\²
óH¢:%É:­›{E·)Ó}•øÒ舾ˆü!²¸ iʧ‚N+€·5>#AÔḭʯAý
®!%j\Å7r

secrets/wg-private-frikandel-server.age

@@ -1,24 +1,24 @@
 age-encryption.org/v1
--> ssh-ed25519 n71/yQ GCjoVuL3wJyWCGApQzb4oTmFR4JzTYQz+siq3ez0bwA
-QukuwR/ojojKApg93QAy/it1azMikIMUdYQY0O3V0ok
+-> ssh-ed25519 n71/yQ 5haGtuX0lE8Y/377A4juZy+6B2EKF29cQv/Vr/YYJRg
+SF/Qg5iRR+5eLOa1VA2bDaBeuIpmt8wLxsqGCjlY3hg
 -> ssh-rsa kFDS0A
-Q8i2LTfs9SXNtGjiPJOGtrmmpUf/fDnBDl/UbvS+oy1m6qlsb+DLsaTW0G+4S5E/
-19UsEbcswwLAob76e5Xfik/toF9MmoCiozkbNythX0NOf51JvinNq8IR2QcCxk7n
-v3pwGW7TZoNa1H4hqopBaKC8xikXAGfjd/LUmIGoN7mCuSs8Te8GWT8HCmazx2M9
-R0mGZGnvTp4/9L6Bl1tU4+CZzFUfMgBAr66U4zFFjhamVO+FotdGJRzEFpEt17NU
-A/rhwBF6bPUHR2WdcQjJy71ruiQFTfUUc+Ws3WvBYV+R5eRVEw7bYZWKRCe/zU+x
-A0I3gEC6pSxAuIOgmYnuCMk06tXoy9WtWHyUv5BQyoJGO1BJN88MgZQr0VaRkoFc
-n/BZH8rpPtdF3N62kstgqFW8wb9PxTgbX9Tk7vVD9m5oH7n6G7WS7jzcRJmaW5st
-RPBIDv9LSjV0bPjkxiJwnKFMRcPxas7XRff1rP9PAPzPMfh7hGtuNBb7F3xnAfi+
-39dcFlopZwO8EJ9KKLfuvfrFeIGXA0BLk6MZQtvaqO3X4wfuKI2lAJXIntEZ232O
-0uspNbWclEfYBTtqjNC1Fl/82LMw98pnMc0rZCWMGbdYkbbcTs11YCx9+Rr5fJ1S
-7+zgiSpHbqFOPZTSDOyoik9R8xNfxCujuTX5Eytg1+Y
--> piv-p256 zqq/iw Ahm7w+8aJI9u7+NBD6b8zyayTLRF7ujkT6b0w+uwXMKb
-zJ0hX4caWgn46jP2pKHus8n7TwmbfKrLVPem827z974
--> piv-p256 vRzPNw At03S5XGlmgectJStVi1slliR3NT0NtgrMW/QqyZ2n1r
-llyEfJ7s7082OgfltW5VJ5rGWvMdo7IhM2fXjEmBO70
--> ["|3O-grease ZUvxX)_l ]PU+\ 9aKH
-7TGRE0yQboWKo4O7pO9mkg/7QiYNmRq48pKZsyn7T2Vyu0AU44hM3YmvUYgleAt1
-d6ODwnaJQIuwfuY5Mpwaeab7Tg
---- ggsgQyrCG+MCWJZerT/9sbV02BwSDn6Hzo3p4ZzFf7Y
-#ý×3–@VG¾ŒR¨q¶Næ'W@¼^Éq«RÜBìc^"xÙ))ñ#ý¸__Û€<C39B>"p_
D¶ÅU,*]¹FEËh³ùùܦnë
+Gc2/HAQZonZvzQxit8Zc6TubI4gJHo75S4PF/gP2/ILMK9xh6Yf5m2ixjkhFhbKk
+eh6VEzoGX5kkPm9SlmRVeAlE5ClSGEG9mqL4wcBtKhUZXXuvhaMoaJOlphZ9Lcgc
+HFi/qxyp4WE7v45L8FkmYQzfhypqPC4ef/I2bG3d4EPoR3/ciPD/fdTWnlA5vx/a
++9Whl0RjuKhSpHzl4miA19s/p+gEjn+d6Dqaf1EPgweEswJXAKtHt1tOp6q/pl8g
+3T810aUYkbgBopIso+U0HX94VK7gvJfeIyRk64P46IMo8FHJhutxca8pxOWF3bbC
+QqhEGSsRk7MPT8iMsGMW5SlA1Xw0pDwKINR8BmUWvz2yf6NzKzoK1B0uAWHadJip
+l5MpiTbmMTBc9ghIkIvxFKuufp+5Iue8qCPtg0j/Cq1Owk9BdYXdia9H6mAYtLuA
+5w8d4G9vBSmVb5K7F9pJey8lqm4KuRpnDGXBI+HIeDAWHyhq0/isjHDZGeZ3FvWy
+2Ea3ZYim0Msf4v0vZCN/T13nGFBOuu+2ExCyV+BrsIkIygbJuiZnCargMaOUpF1v
+Ze+fnZJ880l809auvW9h8W8QFgWPojfWgfT32FIl0n2zc71rh1vvGKL0cgMRUbyA
+3A9NmNcRMJ0SqRWTyrP6RyIlmzGJqyogysO6JQ80tVU
+-> piv-p256 zqq/iw Aux4+LKkxM1KXQKvCDs3QDXV2YtcB3VhGlhZQhzDwhXc
+p3bhhl8Qzb/1sl4xN21II2bQZAB7kceycgh/wWWxAkg
+-> piv-p256 vRzPNw A3kJ1x2AIhPI8c50iJmRPk0d35xOXjK1h3bgz2cF9fPq
+Aoa89fyn0sajhhDEE85p5qsPobNsOQvnszrfig/LZjo
+-> I~/\RCb-grease c
+YzIE557DLZ8ZoQhpjHyGBFomCTRJ1jEqoVF439fryRfDDKZ4QeyH0dksrtw9dpcr
+NAinAHlKafpv
+--- C5OQ3a+DqiWJc7455+cMWnZN9pGdVLqW/lgUZT5oKOE
+¦5'7Õ€fÕÉyW<02>šF•¬ÌûýœNJk
í^È!1r7ŠÜ3¡_Šò
Ú#ˆÄw·NÆ&³<>”¶MyÄ”†¯ê{óKti6—…flÕŽ®¨ð

secrets/wg-private-stroopwafel.age

@@ -1,25 +1,25 @@
 age-encryption.org/v1
--> ssh-ed25519 b0WFDg 48BhkqoqtL6p2z9C9L26Dah3Ki3lV6+GdH6M/GJHRTA
-L9lRDtdNm9Obgl3bdwW7xdqmkHrfE0RpXQ5Aya7Fnf8
+-> ssh-ed25519 b0WFDg i41DRugywwKhguvvzKBwHiy2g8MWhWkv0wifid8hcVo
+iVniMGTex3MQFp+lSxxDn/2IMx587tENmXQv2lcH2AM
 -> ssh-rsa kFDS0A
-E0LvaebGY7h/A+KwhFN61rq0Is/X1l3bwilTCdOg8RWw8Amp5fo1OBasRHL8hhOn
-LQ9iJii3kS9PK+cMUvg9hJKwPVH7b9J4N0gOVGXt8ggkG3LXwymrjAV7GYkC87Xw
-bZ4UfWKK7NXl6jWvHc001EP+sAEvYbLv7MlZZbiugT3lbzYF0HkBIHOKzNDq9Cp/
-wQn3dBj4IOffys60okp2CoMSrz9Ag1wst4NY757lItCY7e4KlM/3Ap+K2cYGyWB3
-reXN1RZr8mh6L2SmQm3oLgvgxQ5H8UviDdMIfCBPMSpPJGEIr4r15aA3o6QpUbOF
-UzxcaECCt/HrJMjb7tKjI4NhbF1g0Ac19ri4WSta8ttgertIlmvzOOoaY2UnPo66
-FBTDlVmdeg0XhTZFwzvYrUcnp1SEA9qLx5OrFOGTd+qZlhIqSBQcTQRtEmh4SFjs
-2NEfiqzP+8dU/GziVYSL+RCdiZBnwSLeHF8iO/oLCRyZuhB/nFj22Tvt9ynanLcE
-nXGO6dIyTBbgTQrYKL3/Gnl1kQZ4MHAdtM6BV9FsMtbc8n4WbvjVzycRV1NYXWHF
-zefsHbCIZaQPvT1DhSGrajER5vRfidq9QPPLxPdf5PK2CB5tjWTALNAyO1PXKPGg
-1QuaYrVl2qVolYfF9P1P6iCLT58TMIULMXs82TAZ3U0
--> piv-p256 zqq/iw Awl8WkTsqKq7wkHmZIa45/eGBMX40k58Z5finBgWdmRt
-uhOLKTrgCSZReNoApKvM+jKP7oMP4N+TMgZNWSeaI+Y
--> piv-p256 vRzPNw A91cNaGQBLNZirxPdXFPqiHFIXJzRNEqxsyvmJlQTS/4
-Mn4hCgrtE8s4k3JGNkMJbGS5qt0sPHeMsxueS05QtPE
--> =-grease 'Y p1tQHZ F8 'ZDgWD
-WkH8xo2vOcIj912KR4aIjHM2R0XE0Q8y40nhhCUf1CKrxsGtzWtDceX3J9PTf5lC
-hLXLeE3X3Ufkro6lmSLqTK/LxOi641nQONOuWjOarMmw5BI
---- N4foRnruFO0WBsBDFlRpqzWYR5ZmDfNvJIXj2ceSnns
-pÎ$xtVé>USM_’Ë™BÁ3¦c*o©ø‘Ï÷⦺eKßsŒËG™’qÅ$o
-‘MŸÚ“M^·c.ѹ)‹¶‡ƒ5øõ/û~Çvá8
+WcaL8c1+HAU8Fjd0QPdcWvGbAVTUgkxH+++5SHkrGYVOW7tsdaX7e0nVTKuIWa5s
+hPPEqz+xg7XwVJtbmqV7CZ1r/gRXshC1epTER9slKiU+o9XdMl7mVOpWzROQbI9M
+6ZpSbWUHenmZ4v5RZFswho3EkqwFJJQVAaD/3BQVOY0BYSaC5mhaTpsD5/s/V+1y
+/C6sSrJ5STGc1ZQ5rnvUId2qAZCrginNWmh0B9QpW0hJugKL6xOkCdJGiFLvQvFW
+vU5IO+GDl/B+bsIPDmzRqs3UUuErs4rXWLasV/9zHXdUpoeFXTKCoLPXlhK3qVQb
+25xmedaS+9s9tTd4Lb4bI5kHvnINAZa67u5VL0o0azHLy80pCJeOSLzYaj4E83BW
+tQMcPuCG7ViWn1+BEnB+1c5GLBFAV2s+krJz2LaayZa4g6o5PlSmC0wU4r8Nw7oG
+9MWay2CPbbfM8eu+JKQ0x1GbZHUmWU0xlRWuaQzc0yYybGVBDaaaosJztQnIOzuH
+M+EzzM6PPb6S1dpYIOhnYg8Bpx4TNmJ7NJk0d93SYd+bcYgmFqU/8P23fn2QCwow
++XcGarJiDRbqqs/Yo8rSb31ZY3MknJjaGUJl4YaHqqTszpGBtg93vkTecXHbPpZL
+D0nim5SwvwIPLSKQLb99AJrmRlZpS9APxLv2esODO7c
+-> piv-p256 zqq/iw Aq7821c9GsIVELFO0/Yi9IT5Bp1prVGZYxZRrVEc5Tri
+uA9BhJIwHOJIDH0DuVpz2sY0i2k67puvoC4bApO0uGI
+-> piv-p256 vRzPNw AtnEI2530dZZBQMrfTiCWzhwsGrl5JMEX0eqbXnHBQ06
+T16WNIdFO3T3V6HLHFuNdgWDwvtc5Y8CB/LubVg8oTY
+-> 5dkO-grease 9.lBvvN 4<)myIo v\)S
+Nw8ymlLA2sTovBJdp9P56UguFS/TNjqJBNfJpkLQI190joCiTCLVbWuM5km0ZbJ5
+0W4ATKVgRHVx1dLVjgQW
+--- GEJeyoaq6XJ9/HBcAstcHTuhj6JiyB7QAV9IwJqfRCo
+§Ó<EFBFBD>8űűť{HVŁQB?3ApqčŰ6tń7o!9Sżł<C5BC>ń
+Á7­C)@	Őtatc_ŰpjŽoŔÜĆńý:a¨‰…çƇseěÍ

secrets/wg-tunnel-droppie.age

@@ -1,24 +1,23 @@
 age-encryption.org/v1
--> ssh-ed25519 LVlqCg /mVa20mT7mKpzTShgWcbtKa+R0iRT0SzG9wKK633olc
-81110gKfZafs+MftCX7ZlbO1do6whhMdFMJ9zF67Zso
+-> ssh-ed25519 LVlqCg tSCSsthEuH5GG6udigkD6u0/ufY1IKckWO1z4wL1aQk
+JUXWHZOw1CWBbs0nnldsuS2CCwNRsECz1qTSc1159Jg
 -> ssh-rsa kFDS0A
-P+oCjv2+AJPzxu8DNAsuwl7ZPLJig/flzCUxrE/pNzSQTwQr9dS/hOy6421sbY2a
-22Ve8oEzUtGDO2omzXTy4a2cYywlvy6AjG60JSMpPWVTlCuvvTv1s7TrPcGZ21J0
-gARKRZBD0QtA/gUp3awbABhfDVCgHSDVTeV56Z2aD92i9N8QaYcDZizcIiWrybhC
-mI3jOsliYUOj2uzp7h04q3bNJe6IizfbRP0b6jrausJCr9L6BCPvkhvcERRytA3E
-zNRH5lVaRKQLDZsTZdXNCHRZ4Hg5fnR8xdkHTsaZTowohmjYkb0AdBp4fRBy2Dmz
-w0H833mEXEdPkjl8PM7NT4aYDmJyKT7DKGHep1iEz2czXVaCUFUaMN5S4JgEnOSr
-kQH/qkwPA0bEvmiUaxe+zMrYYaHhumh+m28NhlIQWH7HyyiilRvcbRW+dXy4XcYJ
-JkVCR0uWfU2/fjJF1fGTibD48BBOnXpbZY1gkma/pWLmIjkRIlxdWPChCxDUelct
-jama/Zqv5RYbiiR9z66K1OoNgrn7sJ7q+cx+FAWihZof4qg7Foeh6nfaeVZPhVws
-TkoHtsitjOJB64/7ykAPdfVLNwxTsg3k7FK64tR9t/SMFRnPjI0J63WC82TjQjrC
-oPa4GJPMo5yaOWmO/Gau3HZ2kgnwt3brdWaifHfI5nc
--> piv-p256 zqq/iw A4KxHHmwWuQv9paadyg20RlQKXFNjKs4mvduZHXtYqLV
-jBP9JrY1/bZkDPK2fnQDwrMxfdJD5nCP5o/l/4BEf/s
--> piv-p256 vRzPNw AuidNlvPMpCl4iq6CJllzJvAoo2h9lIrcNuERGc3d6o3
-tpLM4Vulr0pS6I+zWynV/wxSnRdQxgEpB7Y4W0RqhdE
--> Tc':~)<-grease EW=TL
-AL2dCoXGFdWfFMuNy5ugLZifSi3hnQbsw2nMaKKs1hbKBBInpcnzxG+KSsWFc1Rv
-0dE3XcUEHZVhCaodt5w4bZSXag9pA8BQfZdMj9lLl9wjMYjn1kLP
---- bQUmuzsnM0ZUZCvpmH0r9dkFLbIwn5rgOFZr4JLxXO0
-zßíY9lž	<cˆ=Kn<4B>¹
šòɾvÑ—]9z£‚$@Õ/w‘./•¹žý>x6VýÕ^ö¸Å(ræÓ7÷Kâüo5ª„'È<Ú
+pBKPCXHoYJQbyATYYu29b841RYNuEhy1huVANlta2HsJhEuO0Q76gJ0jgMyddIni
+CfpKJiLeSjy8c2n4FWd3/amYwojhR7AO7OWYURNLJJWnsJq1h5FebM6H/G8ZdvIb
+UGFM+sCsM/+Xt8XdNzVIbrxDteWYoUM43IUQN/MuScYsE74w9TWLOr0k26QauSph
+PqjluGW/3/qT3Y6GDsLi55IfisifvzOZ7kFzlzbovCEoRD4AyoLNJyDqUBdGivji
+z2LaD2MMPUAubGB8o/uCB1/WFc66WarY3f/VnzwI0FlfcjNPDgIv3qtf+R3SwNUV
+2D1e533QvSGmnhc7M/5bSyWYQCWVViv5THXHejjF/1xM//9vj2XGS7e8ELezBFP3
+0TbX2kx198QZM94AOkIoZkIhLLJmOAU0aTjIQoOWjTJrHR9cjUg+PnUu4NR6YLwI
+uJFYXqVF2r6Gotm8pB/PHh8gGKY+UPYJlnzAV32UmfeW3ia+PGo7bbdpb6QKHDs1
+EPvWRu8ghwACAsXpSPnH6GeN8JEKfrLBub+j8/q8kaZsEZFKAwXDFF43c4JoQyzK
+egRzEyUtBVOHGMF4z2rnhIpiMdjSFaOu6gBAXMwYGQyjlgZrNBMU2aRj25006O1Y
+yTNkVQGlQ5wFUcytrlkNAp+1iF2vkSubdhAfWzQkyVI
+-> piv-p256 zqq/iw AgzIwxlqP4A7/njEUpCXXxsdaQJvddq3+cTv/rCWRfmy
+yKJpr2gOMnkcJ2UfOlbrd6JOTsnP6aQvWIAF0ceanDs
+-> piv-p256 vRzPNw A2dCbUkkG26gUzfw7+ePsARIOd3a4sgNk9PX3D0JHhJo
+/zTSbFyFwErm65HATah0CYkEixnTSvkv/mUVBgJhYS0
+-> ^U6Ex[fv-grease
+UROHZseDwsP+Wvg+a7keVj92WVlrukLtW63tJg
+--- GmeA8/sI5PtrR5dZRPzb0th0MPn/OhxI5PAKyolhj+Y
+¾ók¦1t#,²Ïl<C38F>·:Ë¡"úO’èê*:€«,±>ºó:+l­âúÂä©~y™gñП™JäÓ>r3
ýŠ0€__å÷ÓnG{ü

secrets/wg-tunnel-stroopwafel.age

@@ -1,23 +1,23 @@
 age-encryption.org/v1
--> ssh-ed25519 b0WFDg NsuSXeVDNaiVmbj9lPv1YhA0TDyjqXm6i0a3wwHaAj4
-Nm0RztSI2ErmObckxT7fG5sJ1Ce+Yy2hyVxYYFSEv9w
+-> ssh-ed25519 b0WFDg 3j1UJJrQANyh66Ec72sYbOCFvoD+3qq77GAFBAcHiw4
++azblW4BVLURS8f22v18C+gUTgwgUTexTM9MlmL8UZs
 -> ssh-rsa kFDS0A
-gEqURzUz1V/WPavUH9rKtvP0gzVtiY1iYh9kNe4yrV1AKQkBKCPVtO0rI5UJ5mtT
-OkEbDm7EYaw/VXW2KJO8OE6v7+bNKrhgvUDKKTg5qcV1u62Q1KNBHu3yV9iRBR2L
-esj8amIv6W6jj5S1RO52UGxggnSWZXihfsFu7evvZ0tS6o14qCpTUhfsiSu3UdGc
-SjbKSSf+XrvqTNQoF7IW0XdRpoY5CRwzQhO6pSXKMZJW4n3W16su01+nq8uU/vVD
-9ZM3m21IofjrUeiBpM2qu2pthU/3kC9LZ5LKG2HMeWWQ/dPvCvhopXZWWRL7+q8q
-B3MSdEza5URRqifKKoW04MfOpWw1YzrA6Md0lIKiyViCrep6zoWC+QlBohzlpGce
-ew0rjsSeNpY0SBJk7+Svm3Ws6qUXpE5F+ZeDOMguJnbzH51ERGlipK5mu7kKSXi4
-cXwCcaOZ4HlO8HQtb7sm87kVPsX03n+/es4WOXx6TzHIHto46kGc/8fnuDc0I9oV
-9mNqjJGjPOEdnGKwH/7qBCyKxEr1akaz7P0XxzclVIw1ZbCFo15km+4KFx0TPO96
-5lCZQjxywa2tRrg04IIH6Ix0HK37GTh6RPNFLC+fBGfCDVPwxEImqlspxIYP7EwW
-3jiKznAkQQf6NDfoxAJLqkQAhS1M5uswcfmMHGps91g
--> piv-p256 zqq/iw Ay/OZWoqN1T94ev5AIRa+dgIz6+793KiHN60olbLPlYq
-q0VjnvzttleF8IE4Y68AH+Mu8MmUZLfFWmKsYGqqTeQ
--> piv-p256 vRzPNw A8KNTT64X05ac5+sLbcpzbHj/kH+501w/c4HgXz6vg+z
-gw3hnxpNvEJoxVJxkzOtzk8pUhxA+lcQXLKxzsNMA4Y
--> SLXduAh<-grease ;Os ?h<#sQ-
-zjtD7bxdUXKO19VLoqKGaTa9rRgCtyBX2ERtdxk
---- 9T5CjtTCQsIi5arc8p4EmbwUqUe/Chuoaljd9ysZoWU
-šÏ”ÝT½ C
T¼*̧öE‘¥Ö‚»%†§8ãB7ª"üoNñGyõ4
i´æ …Ç!Ò© mé\ò!qi¯Dg"J,òZð8>TÓÁG5w
+jyP4y27LZ6SngtBDL48/BwnEtDfvRLIDCrvw/Iih2Cd1kqoyzEFLlqSUiCoriX8J
+sWB4uspH3zrlSFGsvUGsSvYn6CBLsgDP9UhAVK1JX8syAefovP6dsXkwYkB7e/qR
+tb1oFeet7+wNU7+64m+JO5mbdNH6U2I3wpLfnCGL7kwnSFQTkgWARJOMvd+dB9XA
+0uHAGviRVpBwXPSa7i444VQUUS4qsGvNNjbsPNOI4zH7lAEK16fiKHl3yMC00+fR
+8vh0DRgpjZ5ZiNnk4YnbQ8FQjS3JYVPQpltuS/K3NPbbjfNlWhfPgwg+PDw/AT6O
+Iv/fsDdaU+kpx/Lu//s1zVP//zTl3XtUt0Zhin/PfvWiktR5U0L0pO30desNOmt7
+7ZP7Kup4VD4C4tJ+OPkXAdMBM+zY3d6lo/D4d6ftUSIGGF9p5y272s3GXMy4/7hI
+4eVqDrBrcsNpBQlN/8pYc3cM0Rmg+hncBenRor9ITaQW5TAjEgv4NEIWobzWHLX3
+cqutJK9d8N5xOrDajOJBgsWZoK+N6BXdD+LrmxAgXpwAWVvcPAxDfDKJRTmsQmB8
+XdShltzcIax7Rr4upZy2Zl5E7W2z6WBLmsGr1DYCSUHL/JS0ZQqV6l/VLmwag2kV
+JAI1YcC8Vr2AIQHhGEngmC5EO+KoPEfrx2ILigjxIY4
+-> piv-p256 zqq/iw AmONfNtOZgLS7c6riIxXzZwwcNDjP6TXRf308Grl2wPC
+cHwQkRbQEpf5bF4eUEgfHT0peChXbTLLEiuUKxb7Ptc
+-> piv-p256 vRzPNw A+PkCRleNTtKvyJGYBOKmWfPTTdqK2cjjEb9YLKYkKIe
+YQ+79xWO3NAh2EH5tVtCf3vKiPXktXCWk1RtfD7Mus8
+-> )UypngR7-grease !'e$a <=
+0ynjPVURj7uBD/OZPkVuzUplxCI
+--- WHuDdh43ZEgSTWpnJEpEAkxUtGiNq1hlQBPzF8ITjLQ
+«µì¯j c`¹î­œ€G—­u^…(ùpqÌWô&Û7m-5¶¿´‘ÄÄ]þ¸ÐãøçÈÔ2Ô¬‘\èmšWl†Æ®¯px‚òhçÄ>4Ž

terraform/b12f.io.tf

@@ -160,7 +160,7 @@ resource "hostingde_record" "b12f-invoicing" {
   zone_id = hostingde_zone.b12f.id
   name = "invoicing.b12f.io"
   type = "CNAME"
-  content = "pie.b12f.io"
+  content = "frikandel.b12f.io"
   ttl = 300
 }