Merge pull request 'modules/forgejo: allow migrations from local networks' (#262 ) from forgejo/allow-local-migrations into main

Reviewed-on: #262 Reviewed-by: teutat3s <teutat3s@noreply.git.pub.solar>
modules/forgejo: allow migrations from local networks
2024-11-14 11:10:44 +00:00 · 2024-11-14 11:10:44 +00:00 · 2024-11-13 20:39:47 +00:00 · 2024-11-13 21:25:12 +01:00 · 2024-11-13 19:48:15 +00:00 · 2024-11-13 19:47:17 +00:00
130 changed files with 2524 additions and 2382 deletions
--- a/.forgejo/workflows/check.yml
+++ b/.forgejo/workflows/check.yml
@ -10,7 +10,7 @@ jobs:

      - name: Check formatting
        run: |
-          nix --accept-flake-config --access-tokens '' develop --command treefmt --fail-on-change
+          nix --accept-flake-config --access-tokens '' develop --command treefmt --ci

      - name: Run flake checks
        run: |
--- a/docs/administrative-access.md
+++ b/docs/administrative-access.md
@ -63,12 +63,6 @@ Example NixOS snippet for WireGuard client config
            #endpoint = "138.201.80.102:51820";
            persistentKeepalive = 15;
          }
-          { # flora-6.pub.solar
-            publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
-            allowedIPs = [ "10.7.6.2/32" "fd00:fae:fae:fae:fae:2::/96" ];
-            endpoint = "80.71.153.210:51820";
-            persistentKeepalive = 15;
-          }
          { # metronom.pub.solar
            publicKey = "zOSYGO7MfnOOUnzaTcWiKRQM0qqxR3JQrwx/gtEtHmo=";
            allowedIPs = [ "10.7.6.3/32" "fd00:fae:fae:fae:fae:3::/96" ];
--- a/docs/cachix.md
+++ b/docs/cachix.md
@ -0,0 +1,55 @@
+# Cachix usage
+
+URL: https://pub-solar.cachix.org
+
+Requirements:
+
+- [Install cachix](https://docs.cachix.org/installation)
+- Optional: To push to the cache, you need to set `CACHIX_AUTH_TOKEN` in your environment. To generate one for you, follow the [Getting Started](https://docs.cachix.org/getting-started#authenticating) docs and login with your GitHub account.
+- Add our binary cache [to your nix config](https://docs.cachix.org/faq#cachix-use-effects). To add the pub-solar cache, run:
+
+```
+cachix use pub-solar
+```
+
+Example to build and push a custom package of a host in this flake (e.g. after creating an overlay):
+
+```
+nix build --json -f . '.#nixosConfigurations.nachtigall.pkgs.keycloak^*' \
+  | jq -r '.[].outputs | to_entries[].value' \
+  | cachix push pub-solar
+```
+
+Example to build and push a package in the `nixpkgs` repo:
+
+```
+cd nixpkgs
+nix build --json -f . 'pkgs.lix^*' \
+  | jq -r '.[].outputs | to_entries[].value' \
+  | cachix push pub-solar
+```
+
+Checking if a package has been correctly pushed to the cache:
+
+```
+❯ nix build --json '/nix/store/f76xi83z4xk9sn6pbh38rh97yvqhb5m0-noto-fonts-color-emoji-png-2.042.drv^*' | jq -r '.[].outputs | to_entries[].value'  | cachix push pub-solar
+Pushing 1 paths (0 are already present) using zstd to cache pub-solar ⏳
+
+✓ /nix/store/xpgpi84765dxqja3gd5pldj49xx2v0xl-noto-fonts-color-emoji-png-2.042 (10.30 MiB)
+
+All done.
+
+❯ curl -I https://pub-solar.cachix.org/xpgpi84765dxqja3gd5pldj49xx2v0xl.narinfo
+HTTP/2 200
+date: Mon, 26 Aug 2024 09:31:10 GMT
+content-type: text/x-nix-narinfo
+traceparent: 00-b99db37cc9c2581b8d226cdf81e54507-794fc49193659c03-01
+tracestate:
+cache-control: public, max-age=14400
+last-modified: Mon, 26 Aug 2024 09:31:10 GMT
+cf-cache-status: EXPIRED
+report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A67KGsCIsYjoFdvndxJ0rkmb7BZ5ztIpm8WUJKAiUPRVWvbYeXU9gU27P7zryiUtArbwrLzHhhMija0yyXk0kwNa3suz8gNzKK6z1CX1FWDZiiP07rnq7zAg8nZbSBiEU%2FZrU9nSrR6mhuL9ihbmW1Hf"}],"group":"cf-nel","max_age":604800}
+nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
+server: cloudflare
+cf-ray: 8b92ceab0d19c80e-DUS
+```
--- a/docs/deletion-request.md
+++ b/docs/deletion-request.md
@ -50,7 +50,7 @@ Docs: https://forgejo.org/docs/latest/admin/command-line/#delete
 ### Matrix

 ```
-curl --header "Authorization: Bearer <admin-access-token>" --request POST http://172.18.0.3:8008/_synapse/admin/v1/deactivate/@<username>:pub.solar --data '{"erase": true}'
+curl --header "Authorization: Bearer <admin-access-token>" --request POST http://127.0.0.1:8008/_synapse/admin/v1/deactivate/@<username>:pub.solar --data '{"erase": true}'
 ```

 Docs: https://matrix-org.github.io/synapse/latest/admin_api/user_admin_api.html#deactivate-account
--- a/docs/deploying.md
+++ b/docs/deploying.md
@ -13,12 +13,6 @@ For nachtigall.pub.solar:
 deploy --targets '.#nachtigall' --magic-rollback false --auto-rollback false --keep-result --result-path ./results
 ```

-For flora-6.pub.solar:
-
-```
-deploy --targets '.#flora-6' --magic-rollback false --auto-rollback false --keep-result --result-path ./results
-```
-
 For metronom.pub.solar (aarch64-linux):

 ```
--- a/docs/dns.md
+++ b/docs/dns.md
@ -1,18 +1,10 @@
 # Changing DNS entries

 Our current DNS provider is [namecheap](https://www.namecheap.com/).
-We use [Terraform](https://www.terraform.io) to declaratively manage our pub.solar DNS records.
+We use [OpenTofu](https://opentofu.org) to declaratively manage our pub.solar DNS records.

 ### Initial setup

-Skip this step if you already have a `triton` profile setup.
-
-```
-triton profile create
-```
-
-Please follow https://docs.greenbaum.cloud/en/devops/triton-cli.html for the details.
-
 You will need to setup the following [namecheap API credentials](https://www.namecheap.com/support/api/intro),
 look for "namecheap API key" in the pub.solar Keepass database.

@ -28,13 +20,15 @@ You will probably also need to add your external IP to the [API allow list](http
 dig -4 ip @dns.toys
 ```

-Now, change into the terraform directory and initialize the terraform providers.
+Now, change into the terraform directory and initialize the terraform providers. To decrypt existing state,
+search for "terraform state passphrase" in the pub.solar Keepass database.

 ```
 cd terraform
-export TRITON_KEY_ID=$(cat ~/.config/triton/profiles.d/lev-1-pub_solar.json | jq --raw-output .keyId)
+export TF_VAR_state_passphrase=$(secret-tool lookup pub.solar terraform-state-passphrase-dns)

-terraform init
+alias tofu="terraform-backend-git --access-logs --tf tofu git terraform"
+tofu init
 ```

 Make your changes, e.g. in `dns.tf`.
@ -46,20 +40,21 @@ $EDITOR dns.tf
 Plan your changes using:

 ```
-terraform plan -out pub-solar-infra.plan
+tofu plan -out pub-solar-infra.plan
 ```

 After verification, apply your changes with:

 ```
-terraform apply "pub-solar-infra.plan"
+tofu apply "pub-solar-infra.plan"
 ```

 ### Useful links

-We use the Manta remote backend to save the terraform state for collaboration.
+We use terraform-backend-git remote backend with opentofu state encryption for collaboration.

- https://www.terraform.io/language/v1.2.x/settings/backends/manta
+- https://github.com/plumber-cd/terraform-backend-git
+- https://opentofu.org/docs/language/state/encryption

 Namecheap Terraform provider docs:

--- a/docs/drone-ci.md
+++ b/docs/drone-ci.md
@ -1,19 +0,0 @@
-# Drone CI
-
-We currently use two CI systems, [drone CI](https://drone.io), reachable via
-https://ci.pub.solar and [Forgejo Actions](https://forgejo.org/docs/latest/user/actions/),
-which UI is integrated into https://git.pub.solar, for example
-https://git.pub.solar/pub-solar/infra/actions.
-
-### Signing the `.drone.yml` file
-
-Login to https://ci.pub.solar by clicking on the user icon in the bottom left.
-After logging in, you can view your personal API token by clicking on the same
-icon. If you're using the nix [development-shell](./development-shell.md), the
-`drone` command will already be installed.
-
-```
-export DRONE_TOKEN=<your-drone-api-token>
-
-drone --token $DRONE_TOKEN sign --save pub-solar/os
-```
--- a/docs/garage.md
+++ b/docs/garage.md
@ -4,29 +4,64 @@

 Requirements:

+- `garage` RPC credentials, in the shared keepass, search for 'garage rpc secret'.
 - [Setup WireGuard](./administrative-access.md#ssh-access) for hosts: `trinkgenossin`, optionally: `delite`, `blue-shell`

 ```
 ssh barkeeper@trinkgenossin.wg.pub.solar
+```

-export GARAGE_RPC_SECRET=<secret-in-keepass>
+```
+# Add a few spaces to avoid leaking the secret to the shell history
+   export GARAGE_RPC_SECRET=<secret-in-keepass>
+```

+Now, you can run the following command to check the cluster status:
+
+```
+garage status
+```
+
+Command to list all existing buckets:
+
+```
+garage bucket list
+```
+
+Creating a new bucket and access keys:
+
+```
 garage bucket create <bucket-name>
 garage key create <bucket-name>-key
 garage bucket allow <bucket-name> --read --write --key <bucket-name>-key
 ```

-Docs: https://garagehq.deuxfleurs.fr/documentation/quick-start/#creating-buckets-and-keys
+Full example for `mastodon` bucket:
+
+```
+garage bucket create mastodon
+
+garage key create mastodon-key
+
+garage bucket allow mastodon --read --write --key mastodon-key
+```

 Then [setup your favourite S3 client](https://garagehq.deuxfleurs.fr/documentation/connect/cli/)
 or use the bucket with any [S3 compatible software](https://garagehq.deuxfleurs.fr/documentation/connect/).

+Further reading:
+
+- https://garagehq.deuxfleurs.fr/documentation/quick-start/
+- https://garagehq.deuxfleurs.fr/documentation/connect/
+- https://garagehq.deuxfleurs.fr/documentation/connect/apps/#mastodon
+
 ### Notes on manual setup steps

 ```
 ssh barkeeper@trinkgenossin.wg.pub.solar

-export GARAGE_RPC_SECRET=<secret-in-keepass>
+# Add a few spaces to avoid leaking the secret to the shell history
+    export GARAGE_RPC_SECRET=<secret-in-keepass>

 # Uses the default config /etc/garage.toml
 garage node id
--- a/docs/nextcloud.md
+++ b/docs/nextcloud.md
@ -0,0 +1,19 @@
+# Nextcloud debugging
+
+Set loglevel to `0` for debug logs:
+
+```nix
+services.nextcloud.settings.loglevel = 0;
+```
+
+Then, logs appear in the `phpfpm-nextcloud.service` logs:
+
+```bash
+sudo journalctl -fu phpfpm-nextcloud
+```
+
+Make sure to set the loglevel back to the default `2` warning after debugging:
+
+```nix
+services.nextcloud.settings.loglevel = 2;
+```
--- a/flake.lock
+++ b/flake.lock
@ -52,11 +52,11 @@
        "utils": "utils"
      },
      "locked": {
-        "lastModified": 1718194053,
-        "narHash": "sha256-FaGrf7qwZ99ehPJCAwgvNY5sLCqQ3GDiE/6uLhxxwSY=",
+        "lastModified": 1727447169,
+        "narHash": "sha256-3KyjMPUKHkiWhwR91J1YchF6zb6gvckCAY1jOE+ne0U=",
        "owner": "serokell",
        "repo": "deploy-rs",
-        "rev": "3867348fa92bc892eba5d9ddb2d7a97b9e127a8a",
+        "rev": "aa07eb05537d4cd025e2310397a6adcedfe72c76",
        "type": "github"
      },
      "original": {
@ -94,11 +94,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1724349583,
-        "narHash": "sha256-zgB1Cfk46irIsto8666yLdKjqKdBrjR48Dd3lhQ0CnQ=",
+        "lastModified": 1731274291,
+        "narHash": "sha256-cZ0QMpv5p2a6WEE+o9uu0a4ma6RzQDOQTbm7PbixWz8=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "435737144be0259559ca3b43f7d72252b1fdcc1b",
+        "rev": "486250f404f4a4f4f33f8f669d83ca5f6e6b7dfc",
        "type": "github"
      },
      "original": {
@ -185,11 +185,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1722555600,
-        "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
+        "lastModified": 1730504689,
+        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
+        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
        "type": "github"
      },
      "original": {
@ -234,18 +234,19 @@
        "type": "github"
      }
    },
-    "flake-utils_3": {
+    "fork": {
      "locked": {
-        "lastModified": 1653893745,
-        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
+        "lastModified": 1729963002,
+        "narHash": "sha256-2zrYfd/qdfExU5zVwvH80uJnKc/dMeK6zp3O1UtW2Mo=",
+        "owner": "teutat3s",
+        "repo": "nixpkgs",
+        "rev": "005faaacbeede0296dec5c844f508027ab8a3ff6",
        "type": "github"
      },
      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
+        "owner": "teutat3s",
+        "ref": "init-matrix-authentication-service-module",
+        "repo": "nixpkgs",
        "type": "github"
      }
    },
@ -256,11 +257,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1720042825,
-        "narHash": "sha256-A0vrUB6x82/jvf17qPCpxaM+ulJnD8YZwH9Ci0BsAzE=",
+        "lastModified": 1726989464,
+        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "e1391fb22e18a36f57e6999c7a9f966dc80ac073",
+        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
        "type": "github"
      },
      "original": {
@ -279,11 +280,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1707424749,
-        "narHash": "sha256-eTvts5E3zmD4/DoAI9KedQjRwica0cg36wwIVp1NWbM=",
+        "lastModified": 1731518114,
+        "narHash": "sha256-h9Wb3VjmXBZwTO3prRweUKwp2H9hZHCQKrkbU+2WPQs=",
        "ref": "main",
-        "rev": "1202a23c205b3c07a5feb5caf6813f21b3c69307",
-        "revCount": 30,
+        "rev": "060ecccc5f8c92a0705ab91ff047811efd559468",
+        "revCount": 36,
        "type": "git",
        "url": "https://git.pub.solar/pub-solar/keycloak-theme"
      },
@ -319,11 +320,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1724299755,
-        "narHash": "sha256-P5zMA17kD9tqiqMuNXwupkM7buM3gMNtoZ1VuJTRDE4=",
+        "lastModified": 1731153869,
+        "narHash": "sha256-3Ftf9oqOypcEyyrWJ0baVkRpvQqroK/SVBFLvU3nPuc=",
        "owner": "lnl7",
        "repo": "nix-darwin",
-        "rev": "a8968d88e5a537b0491f68ce910749cd870bdbef",
+        "rev": "5c74ab862c8070cbf6400128a1b56abb213656da",
        "type": "github"
      },
      "original": {
@ -333,28 +334,13 @@
        "type": "github"
      }
    },
-    "nixos-flake": {
-      "locked": {
-        "lastModified": 1721140942,
-        "narHash": "sha256-iEqZGdnkG+Hm0jZhS59NJwEyB6z9caVnudWPGHZ/FAE=",
-        "owner": "srid",
-        "repo": "nixos-flake",
-        "rev": "5734c1d9a5fe0bc8e8beaf389ad6227392ca0108",
-        "type": "github"
-      },
-      "original": {
-        "owner": "srid",
-        "repo": "nixos-flake",
-        "type": "github"
-      }
-    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1724242322,
-        "narHash": "sha256-HMpK7hNjhEk4z5SFg5UtxEio9OWFocHdaQzCfW1pE7w=",
+        "lastModified": 1731239293,
+        "narHash": "sha256-q2yjIWFFcTzp5REWQUOU9L6kHdCDmFDpqeix86SOvDc=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "224042e9a3039291f22f4f2ded12af95a616cca0",
+        "rev": "9256f7c71a195ebe7a218043d9f93390d49e6884",
        "type": "github"
      },
      "original": {
@ -364,32 +350,16 @@
        "type": "github"
      }
    },
-    "nixpkgs-2205": {
-      "locked": {
-        "lastModified": 1685573264,
-        "narHash": "sha256-Zffu01pONhs/pqH07cjlF10NnMDLok8ix5Uk4rhOnZQ=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "380be19fbd2d9079f677978361792cb25e8a3635",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-22.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1722555339,
-        "narHash": "sha256-uFf2QeW7eAHlYXuDktm9c25OxOyCoUOQmh5SZ9amE5Q=",
+        "lastModified": 1730504152,
+        "narHash": "sha256-lXvH/vOfb4aGYyvFmZK/HlsNsr/0CVWlwYvo2rxJk3s=",
        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/a5d394176e64ab29c852d03346c1fc9b0b7d33eb.tar.gz"
+        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
      },
      "original": {
        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/a5d394176e64ab29c852d03346c1fc9b0b7d33eb.tar.gz"
+        "url": "https://github.com/NixOS/nixpkgs/archive/cc2f28000298e1269cea6612cd06ec9979dd5d7f.tar.gz"
      }
    },
    "root": {
@ -400,15 +370,13 @@
        "element-stickers": "element-stickers",
        "element-themes": "element-themes",
        "flake-parts": "flake-parts",
+        "fork": "fork",
        "home-manager": "home-manager",
        "keycloak-theme-pub-solar": "keycloak-theme-pub-solar",
        "maunium-stickerpicker": "maunium-stickerpicker",
        "nix-darwin": "nix-darwin",
-        "nixos-flake": "nixos-flake",
        "nixpkgs": "nixpkgs",
-        "nixpkgs-2205": "nixpkgs-2205",
        "simple-nixos-mailserver": "simple-nixos-mailserver",
-        "triton-vmtools": "triton-vmtools",
        "unstable": "unstable"
      }
    },
@ -514,37 +482,13 @@
        "type": "github"
      }
    },
-    "triton-vmtools": {
-      "inputs": {
-        "flake-utils": "flake-utils_3",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "dir": "vmtools",
-        "lastModified": 1698443513,
-        "narHash": "sha256-wX2JIJ3JmJn6MAurdyjwZU+FZjLCwBArMrVSeeCb/ZU=",
-        "ref": "main",
-        "rev": "0d039dcf06afb8cbddd7ac54bae4d0d185f3e88e",
-        "revCount": 85,
-        "type": "git",
-        "url": "https://git.pub.solar/pub-solar/infra-vintage?dir=vmtools"
-      },
-      "original": {
-        "dir": "vmtools",
-        "ref": "main",
-        "type": "git",
-        "url": "https://git.pub.solar/pub-solar/infra-vintage?dir=vmtools"
-      }
-    },
    "unstable": {
      "locked": {
-        "lastModified": 1724224976,
-        "narHash": "sha256-Z/ELQhrSd7bMzTO8r7NZgi9g5emh+aRKoCdaAv5fiO0=",
+        "lastModified": 1731139594,
+        "narHash": "sha256-IigrKK3vYRpUu+HEjPL/phrfh7Ox881er1UEsZvw9Q4=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "c374d94f1536013ca8e92341b540eba4c22f9c62",
+        "rev": "76612b17c0ce71689921ca12d9ffdc9c23ce40b2",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@ -3,8 +3,7 @@
    # Track channels with commits tested and built by hydra
    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
    unstable.url = "github:nixos/nixpkgs/nixos-unstable";
-
-    nixpkgs-2205.url = "github:nixos/nixpkgs/nixos-22.05";
+    fork.url = "github:teutat3s/nixpkgs/init-matrix-authentication-service-module";

    nix-darwin.url = "github:lnl7/nix-darwin/master";
    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
@ -13,7 +12,6 @@
    home-manager.inputs.nixpkgs.follows = "nixpkgs";

    flake-parts.url = "github:hercules-ci/flake-parts";
-    nixos-flake.url = "github:srid/nixos-flake";

    deploy-rs.url = "github:serokell/deploy-rs";
    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
@ -29,9 +27,6 @@
    keycloak-theme-pub-solar.url = "git+https://git.pub.solar/pub-solar/keycloak-theme?ref=main";
    keycloak-theme-pub-solar.inputs.nixpkgs.follows = "nixpkgs";

-    triton-vmtools.url = "git+https://git.pub.solar/pub-solar/infra-vintage?ref=main&dir=vmtools";
-    triton-vmtools.inputs.nixpkgs.follows = "nixpkgs";
-
    element-themes.url = "github:aaronraimist/element-themes/master";
    element-themes.flake = false;

@ -56,7 +51,6 @@
      ];

      imports = [
-        inputs.nixos-flake.flakeModule
        ./logins
        ./lib
        ./overlays
@ -114,9 +108,10 @@
              nvfetcher
              shellcheck
              shfmt
-              treefmt
+              inputs.unstable.legacyPackages.${system}.treefmt2
              nixos-generators
-              inputs.nixpkgs-2205.legacyPackages.${system}.terraform
+              inputs.unstable.legacyPackages.${system}.opentofu
+              terraform-backend-git
              terraform-ls
              jq
            ];
@ -150,10 +145,6 @@
              hostname = "nachtigall.wg.pub.solar";
              sshUser = username;
            };
-            flora-6 = {
-              hostname = "flora-6.wg.pub.solar";
-              sshUser = username;
-            };
            metronom = {
              hostname = "metronom.wg.pub.solar";
              sshUser = username;
@ -162,6 +153,10 @@
              hostname = "tankstelle.wg.pub.solar";
              sshUser = username;
            };
+            underground = {
+              hostname = "80.244.242.3";
+              sshUser = username;
+            };
            trinkgenossin = {
              hostname = "trinkgenossin.wg.pub.solar";
              sshUser = username;
--- a/hosts/blue-shell/wireguard.nix
+++ b/hosts/blue-shell/wireguard.nix
@ -24,13 +24,15 @@ in
      privateKeyFile = config.age.secrets.wg-private-key.path;
      peers = flake.self.logins.admins.wireguardDevices ++ [
        {
-          # flora-6.pub.solar
-          endpoint = "80.71.153.210:51820";
-          publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
+          # trinkgenossin.pub.solar
+          publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
          allowedIPs = [
-            "10.7.6.2/32"
-            "fd00:fae:fae:fae:fae:2::/96"
+            "10.7.6.5/32"
+            "fd00:fae:fae:fae:fae:5::/96"
          ];
+          #endpoint = "85.215.152.22:51820";
+          endpoint = "[2a01:239:35d:f500::1]:51820";
+          persistentKeepalive = 15;
        }
      ];
    };
--- a/hosts/default.nix
+++ b/hosts/default.nix
@ -1,9 +1,35 @@
-{ self, ... }:
+{
+  self,
+  inputs,
+  config,
+  ...
+}:
 {
  flake = {
-    nixosConfigurations = {
-      nachtigall = self.nixos-flake.lib.mkLinuxSystem {
+    nixosModules = {
+      home-manager = {
        imports = [
+          inputs.home-manager.nixosModules.home-manager
+          {
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.extraSpecialArgs = {
+              flake = {
+                inherit self inputs config;
+              };
+            };
+          }
+        ];
+      };
+    };
+    nixosConfigurations = {
+      nachtigall = self.inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = {
+          flake = {
+            inherit self inputs config;
+          };
+        };
+        modules = [
          self.inputs.agenix.nixosModules.default
          self.nixosModules.home-manager
          ./nachtigall
@ -43,27 +69,13 @@
        ];
      };

-      flora-6 = self.nixos-flake.lib.mkLinuxSystem {
-        imports = [
-          self.inputs.agenix.nixosModules.default
-          self.nixosModules.home-manager
-          ./flora-6
-          self.nixosModules.overlays
-          self.nixosModules.core
-          self.nixosModules.backups
-
-          self.nixosModules.keycloak
-          self.nixosModules.caddy
-          self.nixosModules.drone
-          self.nixosModules.forgejo-actions-runner
-          self.nixosModules.grafana
-          self.nixosModules.prometheus
-          self.nixosModules.loki
-        ];
+      metronom = self.inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = {
+          flake = {
+            inherit self inputs config;
          };
-
-      metronom = self.nixos-flake.lib.mkLinuxSystem {
-        imports = [
+        };
+        modules = [
          self.inputs.agenix.nixosModules.default
          self.nixosModules.home-manager
          ./metronom
@ -79,8 +91,13 @@
        ];
      };

-      tankstelle = self.nixos-flake.lib.mkLinuxSystem {
-        imports = [
+      tankstelle = self.inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = {
+          flake = {
+            inherit self inputs config;
+          };
+        };
+        modules = [
          self.inputs.agenix.nixosModules.default
          self.nixosModules.home-manager
          ./tankstelle
@ -92,11 +109,43 @@
        ];
      };

-      trinkgenossin = self.nixos-flake.lib.mkLinuxSystem {
-        imports = [
+      trinkgenossin = self.inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = {
+          flake = {
+            inherit self inputs config;
+          };
+        };
+        modules = [
          self.inputs.agenix.nixosModules.default
          self.nixosModules.home-manager
          ./trinkgenossin
+          self.nixosModules.backups
+          self.nixosModules.overlays
+          self.nixosModules.unlock-luks-on-boot
+          self.nixosModules.core
+
+          self.nixosModules.garage
+          self.nixosModules.nginx
+
+          # This module is already using options, and those options are used by the grafana module
+          self.nixosModules.keycloak
+          self.nixosModules.grafana
+          self.nixosModules.prometheus
+          self.nixosModules.loki
+        ];
+      };
+
+      delite = self.inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = {
+          flake = {
+            inherit self inputs config;
+          };
+        };
+        modules = [
+          self.inputs.agenix.nixosModules.default
+          self.inputs.disko.nixosModules.disko
+          self.nixosModules.home-manager
+          ./delite
          self.nixosModules.overlays
          self.nixosModules.unlock-luks-on-boot
          self.nixosModules.core
@ -108,25 +157,13 @@
        ];
      };

-      delite = self.nixos-flake.lib.mkLinuxSystem {
-        imports = [
-          self.inputs.agenix.nixosModules.default
-          self.inputs.disko.nixosModules.disko
-          self.nixosModules.home-manager
-          ./delite
-          self.nixosModules.overlays
-          self.nixosModules.unlock-luks-on-boot
-          self.nixosModules.core
-          #self.nixosModules.prometheus-exporters
-          #self.nixosModules.promtail
-
-          self.nixosModules.garage
-          self.nixosModules.nginx
-        ];
+      blue-shell = self.inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = {
+          flake = {
+            inherit self inputs config;
          };
-
-      blue-shell = self.nixos-flake.lib.mkLinuxSystem {
-        imports = [
+        };
+        modules = [
          self.inputs.agenix.nixosModules.default
          self.inputs.disko.nixosModules.disko
          self.nixosModules.home-manager
@ -134,13 +171,37 @@
          self.nixosModules.overlays
          self.nixosModules.unlock-luks-on-boot
          self.nixosModules.core
-          #self.nixosModules.prometheus-exporters
-          #self.nixosModules.promtail
+          self.nixosModules.prometheus-exporters
+          self.nixosModules.promtail

          self.nixosModules.garage
          self.nixosModules.nginx
        ];
      };
+
+      underground = self.inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = {
+          flake = {
+            inherit self inputs config;
+          };
+        };
+        modules = [
+          self.inputs.agenix.nixosModules.default
+          self.nixosModules.home-manager
+          ./underground
+          self.nixosModules.overlays
+          self.nixosModules.unlock-luks-on-boot
+          self.nixosModules.core
+
+          self.nixosModules.backups
+          self.nixosModules.keycloak
+          self.nixosModules.postgresql
+          self.nixosModules.matrix
+          self.nixosModules.matrix-irc
+          self.nixosModules.nginx
+          self.nixosModules.nginx-matrix
+        ];
+      };
    };
  };
 }
--- a/hosts/delite/configuration.nix
+++ b/hosts/delite/configuration.nix
@ -9,7 +9,7 @@

  boot.kernelParams = [
    "boot.shell_on_fail=1"
-    "ip=dhcp"
+    "ip=5.255.119.132::5.255.119.1:255.255.255.0:delite::off"
  ];

  # This option defines the first version of NixOS you have installed on this particular machine,
--- a/hosts/delite/wireguard.nix
+++ b/hosts/delite/wireguard.nix
@ -24,13 +24,15 @@ in
      privateKeyFile = config.age.secrets.wg-private-key.path;
      peers = flake.self.logins.admins.wireguardDevices ++ [
        {
-          # flora-6.pub.solar
-          endpoint = "80.71.153.210:51820";
-          publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
+          # trinkgenossin.pub.solar
+          publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
          allowedIPs = [
-            "10.7.6.2/32"
-            "fd00:fae:fae:fae:fae:2::/96"
+            "10.7.6.5/32"
+            "fd00:fae:fae:fae:fae:5::/96"
          ];
+          #endpoint = "85.215.152.22:51820";
+          endpoint = "[2a01:239:35d:f500::1]:51820";
+          persistentKeepalive = 15;
        }
      ];
    };
--- a/hosts/flora-6/configuration.nix
+++ b/hosts/flora-6/configuration.nix
@ -1,72 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  flake,
-  ...
-}:
-let
-  psCfg = config.pub-solar;
-in
-{
-  config = {
-    # Override nix.conf for more agressive garbage collection
-    nix.extraOptions = lib.mkForce ''
-      experimental-features = flakes nix-command
-      min-free = 536870912
-      keep-outputs = false
-      keep-derivations = false
-      fallback = true
-    '';
-
-    # # #
-    # # # Triton host specific options
-    # # # DO NOT ALTER below this line, changes might render system unbootable
-    # # #
-
-    # Use the systemd-boot EFI boot loader.
-    boot.loader.systemd-boot.enable = true;
-    boot.loader.efi.canTouchEfiVariables = true;
-
-    # Force getting the hostname from cloud-init
-    networking.hostName = lib.mkDefault "";
-
-    # We use cloud-init to configure networking, this option should fix
-    # systemd-networkd-wait-online timeouts
-    #systemd.services."systemd-networkd".environment.SYSTEMD_LOG_LEVEL = "debug";
-    systemd.network.wait-online.ignoredInterfaces = [
-      "docker0"
-      "wg-ssh"
-    ];
-
-    # List services that you want to enable:
-    services.cloud-init.enable = true;
-    services.cloud-init.ext4.enable = true;
-    services.cloud-init.network.enable = true;
-    # use the default NixOS cloud-init config, but add some SmartOS customization to it
-    environment.etc."cloud/cloud.cfg.d/90_smartos.cfg".text = ''
-      datasource_list: [ SmartOS ]
-
-      # Do not create the centos/ubuntu/debian user
-      users: [ ]
-
-      # mount second disk with label ephemeral0, gets formated by cloud-init
-      # this will fail to get added to /etc/fstab as it's read-only, but should
-      # mount at boot anyway
-      mounts:
-      - [ vdb, /data, auto, "defaults,nofail" ]
-    '';
-
-    # We manage the firewall with nix, too
-    # altough triton can also manage firewall rules via the triton fwrule subcommand
-    networking.firewall.enable = true;
-
-    # This value determines the NixOS release from which the default
-    # settings for stateful data, like file locations and database versions
-    # on your system were taken. It‘s perfectly fine and recommended to leave
-    # this value at the release version of the first install of this system.
-    # Before changing this value read the documentation for this option
-    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-    system.stateVersion = "22.05"; # Did you read the comment?
-  };
-}
--- a/hosts/flora-6/default.nix
+++ b/hosts/flora-6/default.nix
@ -1,11 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-    ./configuration.nix
-    ./triton-vmtools.nix
-    ./wireguard.nix
-  ];
-}
--- a/hosts/flora-6/triton-vmtools.nix
+++ b/hosts/flora-6/triton-vmtools.nix
@ -1,6 +0,0 @@
-{ pkgs, flake, ... }:
-{
-  environment.systemPackages = with pkgs; [
-    flake.inputs.triton-vmtools.packages.${pkgs.system}.default
-  ];
-}
--- a/hosts/flora-6/wireguard.nix
+++ b/hosts/flora-6/wireguard.nix
@ -1,91 +0,0 @@
-{
-  config,
-  pkgs,
-  flake,
-  ...
-}:
-{
-  networking.firewall.allowedUDPPorts = [ 51820 ];
-
-  age.secrets.wg-private-key.file = "${flake.self}/secrets/flora6-wg-private-key.age";
-
-  networking.wireguard.interfaces = {
-    wg-ssh = {
-      listenPort = 51820;
-      mtu = 1300;
-      ips = [
-        "10.7.6.2/32"
-        "fd00:fae:fae:fae:fae:2::/96"
-      ];
-      privateKeyFile = config.age.secrets.wg-private-key.path;
-      peers = flake.self.logins.admins.wireguardDevices ++ [
-        {
-          # nachtigall.pub.solar
-          endpoint = "138.201.80.102:51820";
-          publicKey = "qzNywKY9RvqTnDO8eLik75/SHveaSk9OObilDzv+xkk=";
-          allowedIPs = [
-            "10.7.6.1/32"
-            "fd00:fae:fae:fae:fae:1::/96"
-          ];
-        }
-        {
-          # metronom.pub.solar
-          endpoint = "49.13.236.167:51820";
-          publicKey = "zOSYGO7MfnOOUnzaTcWiKRQM0qqxR3JQrwx/gtEtHmo=";
-          allowedIPs = [
-            "10.7.6.3/32"
-            "fd00:fae:fae:fae:fae:3::/96"
-          ];
-          persistentKeepalive = 15;
-        }
-        {
-          # tankstelle.pub.solar
-          endpoint = "80.244.242.5:51820";
-          publicKey = "iRTlY1lB7nPXf2eXzX8ZZDkfMmXyGjff5/joccbP8Cg=";
-          allowedIPs = [
-            "10.7.6.4/32"
-            "fd00:fae:fae:fae:fae:4::/96"
-          ];
-        }
-        {
-          # trinkgenossin.pub.solar
-          endpoint = "85.215.152.22:51820";
-          publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
-          allowedIPs = [
-            "10.7.6.5/32"
-            "fd00:fae:fae:fae:fae:5::/96"
-          ];
-        }
-        {
-          # delite.pub.solar
-          endpoint = "5.255.119.132:51820";
-          publicKey = "ZT2qGWgMPwHRUOZmTQHWCRX4m14YwOsiszjsA5bpc2k=";
-          allowedIPs = [
-            "10.7.6.6/32"
-            "fd00:fae:fae:fae:fae:6::/96"
-          ];
-        }
-        {
-          # blue-shell.pub.solar
-          endpoint = "194.13.83.205:51820";
-          publicKey = "bcrIpWrKc1M+Hq4ds3aN1lTaKE26f2rvXhd+93QrzR8=";
-          allowedIPs = [
-            "10.7.6.7/32"
-            "fd00:fae:fae:fae:fae:7::/96"
-          ];
-        }
-      ];
-    };
-  };
-
-  services.openssh.listenAddresses = [
-    {
-      addr = "10.7.6.2";
-      port = 22;
-    }
-    {
-      addr = "[fd00:fae:fae:fae:fae:2::]";
-      port = 22;
-    }
-  ];
-}
--- a/hosts/metronom/wireguard.nix
+++ b/hosts/metronom/wireguard.nix
@ -19,15 +19,6 @@
      ];
      privateKeyFile = config.age.secrets.wg-private-key.path;
      peers = flake.self.logins.admins.wireguardDevices ++ [
-        {
-          # flora-6.pub.solar
-          endpoint = "80.71.153.210:51820";
-          publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
-          allowedIPs = [
-            "10.7.6.2/32"
-            "fd00:fae:fae:fae:fae:2::/96"
-          ];
-        }
        {
          # nachtigall.pub.solar
          endpoint = "138.201.80.102:51820";
@ -37,6 +28,17 @@
            "fd00:fae:fae:fae:fae:1::/96"
          ];
        }
+        {
+          # trinkgenossin.pub.solar
+          publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
+          allowedIPs = [
+            "10.7.6.5/32"
+            "fd00:fae:fae:fae:fae:5::/96"
+          ];
+          #endpoint = "85.215.152.22:51820";
+          endpoint = "[2a01:239:35d:f500::1]:51820";
+          persistentKeepalive = 15;
+        }
      ];
    };
  };
--- a/hosts/nachtigall/configuration.nix
+++ b/hosts/nachtigall/configuration.nix
@ -48,6 +48,7 @@
    owner = "root";
  };

+  # keycloak
  age.secrets.keycloak-database-password = {
    file = "${flake.self}/secrets/keycloak-database-password.age";
    mode = "600";
@ -59,6 +60,61 @@
    database-password-file = config.age.secrets.keycloak-database-password.path;
  };

+  # matrix-synapse
+  age.secrets."matrix-synapse-signing-key" = {
+    file = "${flake.self}/secrets/matrix-synapse-signing-key.age";
+    mode = "400";
+    owner = "matrix-synapse";
+  };
+
+  age.secrets."matrix-synapse-secret-config.yaml" = {
+    file = "${flake.self}/secrets/matrix-synapse-secret-config.yaml.age";
+    mode = "400";
+    owner = "matrix-synapse";
+  };
+
+  age.secrets."matrix-synapse-sliding-sync-secret" = {
+    file = "${flake.self}/secrets/matrix-synapse-sliding-sync-secret.age";
+    mode = "400";
+    owner = "matrix-synapse";
+  };
+
+  age.secrets."matrix-authentication-service-secret-config.yml" = {
+    file = "${flake.self}/secrets/matrix-authentication-service-secret-config.yml.age";
+    mode = "400";
+    owner = "matrix-authentication-service";
+  };
+
+  pub-solar-os.matrix = {
+    enable = true;
+    synapse = {
+      sliding-sync.enable = false;
+      signing_key_path = config.age.secrets."matrix-synapse-signing-key".path;
+      extra-config-files = [
+        config.age.secrets."matrix-synapse-secret-config.yaml".path
+
+        # The registration file is automatically generated after starting the
+        # appservice for the first time.
+        # cp /var/lib/mautrix-telegram/telegram-registration.yaml \
+        #   /var/lib/matrix-synapse/
+        # chown matrix-synapse:matrix-synapse \
+        #   /var/lib/matrix-synapse/telegram-registration.yaml
+        "/var/lib/matrix-synapse/telegram-registration.yaml"
+      ];
+      app-service-config-files = [
+        "/var/lib/matrix-synapse/telegram-registration.yaml"
+        "/var/lib/matrix-appservice-irc/registration.yml"
+        # "/matrix-appservice-slack-registration.yaml"
+        # "/hookshot-registration.yml"
+        # "/matrix-mautrix-signal-registration.yaml"
+        # "/matrix-mautrix-telegram-registration.yaml"
+      ];
+    };
+    matrix-authentication-service.extra-config-files = [
+      config.age.secrets."matrix-authentication-service-secret-config.yml".path
+    ];
+  };
+
  systemd.services.postgresql = {
    after = [ "var-lib-postgresql.mount" ];
    requisite = [ "var-lib-postgresql.mount" ];
--- a/hosts/nachtigall/default.nix
+++ b/hosts/nachtigall/default.nix
@ -9,5 +9,12 @@
    ./networking.nix
    ./wireguard.nix
    ./backups.nix
+    "${flake.inputs.fork}/nixos/modules/services//matrix/matrix-authentication-service.nix"
+    "${flake.inputs.unstable}/nixos/modules/services/web-apps/mastodon.nix"
+  ];
+
+  disabledModules = [
+    "services/matrix/matrix-authentication-service.nix "
+    "services/web-apps/mastodon.nix"
  ];
 }
--- a/hosts/nachtigall/wireguard.nix
+++ b/hosts/nachtigall/wireguard.nix
@ -19,15 +19,6 @@
      ];
      privateKeyFile = config.age.secrets.wg-private-key.path;
      peers = flake.self.logins.admins.wireguardDevices ++ [
-        {
-          # flora-6.pub.solar
-          endpoint = "80.71.153.210:51820";
-          publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
-          allowedIPs = [
-            "10.7.6.2/32"
-            "fd00:fae:fae:fae:fae:2::/96"
-          ];
-        }
        {
          # tankstelle.pub.solar
          endpoint = "80.244.242.5:51820";
@ -37,6 +28,17 @@
            "fd00:fae:fae:fae:fae:4::/96"
          ];
        }
+        {
+          # trinkgenossin.pub.solar
+          publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
+          allowedIPs = [
+            "10.7.6.5/32"
+            "fd00:fae:fae:fae:fae:5::/96"
+          ];
+          #endpoint = "85.215.152.22:51820";
+          endpoint = "[2a01:239:35d:f500::1]:51820";
+          persistentKeepalive = 15;
+        }
      ];
    };
  };
--- a/hosts/tankstelle/wireguard.nix
+++ b/hosts/tankstelle/wireguard.nix
@ -29,13 +29,15 @@
          ];
        }
        {
-          # flora-6.pub.solar
-          endpoint = "80.71.153.210:51820";
-          publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
+          # trinkgenossin.pub.solar
+          publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
          allowedIPs = [
-            "10.7.6.2/32"
-            "fd00:fae:fae:fae:fae:2::/96"
+            "10.7.6.5/32"
+            "fd00:fae:fae:fae:fae:5::/96"
          ];
+          #endpoint = "85.215.152.22:51820";
+          endpoint = "[2a01:239:35d:f500::1]:51820";
+          persistentKeepalive = 15;
        }
      ];
    };
--- a/hosts/trinkgenossin/hardware-configuration.nix
+++ b/hosts/trinkgenossin/hardware-configuration.nix
@ -18,6 +18,7 @@
    "virtio_pci"
    "sr_mod"
    "virtio_blk"
+    "virtio_net"
  ];
  boot.initrd.kernelModules = [ "dm-snapshot" ];
  boot.kernelModules = [ "kvm-amd" ];
@ -50,5 +51,4 @@
  swapDevices = [ { device = "/dev/disk/by-label/swap"; } ];

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  virtualisation.hypervGuest.enable = true;
 }
--- a/hosts/trinkgenossin/wireguard.nix
+++ b/hosts/trinkgenossin/wireguard.nix
@ -24,12 +24,49 @@ in
      privateKeyFile = config.age.secrets.wg-private-key.path;
      peers = flake.self.logins.admins.wireguardDevices ++ [
        {
-          # flora-6.pub.solar
-          endpoint = "80.71.153.210:51820";
-          publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
+          # nachtigall.pub.solar
+          endpoint = "138.201.80.102:51820";
+          publicKey = "qzNywKY9RvqTnDO8eLik75/SHveaSk9OObilDzv+xkk=";
          allowedIPs = [
-            "10.7.6.2/32"
-            "fd00:fae:fae:fae:fae:2::/96"
+            "10.7.6.1/32"
+            "fd00:fae:fae:fae:fae:1::/96"
+          ];
+        }
+        {
+          # metronom.pub.solar
+          endpoint = "49.13.236.167:51820";
+          publicKey = "zOSYGO7MfnOOUnzaTcWiKRQM0qqxR3JQrwx/gtEtHmo=";
+          allowedIPs = [
+            "10.7.6.3/32"
+            "fd00:fae:fae:fae:fae:3::/96"
+          ];
+          persistentKeepalive = 15;
+        }
+        {
+          # tankstelle.pub.solar
+          endpoint = "80.244.242.5:51820";
+          publicKey = "iRTlY1lB7nPXf2eXzX8ZZDkfMmXyGjff5/joccbP8Cg=";
+          allowedIPs = [
+            "10.7.6.4/32"
+            "fd00:fae:fae:fae:fae:4::/96"
+          ];
+        }
+        {
+          # delite.pub.solar
+          endpoint = "5.255.119.132:51820";
+          publicKey = "ZT2qGWgMPwHRUOZmTQHWCRX4m14YwOsiszjsA5bpc2k=";
+          allowedIPs = [
+            "10.7.6.6/32"
+            "fd00:fae:fae:fae:fae:6::/96"
+          ];
+        }
+        {
+          # blue-shell.pub.solar
+          endpoint = "194.13.83.205:51820";
+          publicKey = "bcrIpWrKc1M+Hq4ds3aN1lTaKE26f2rvXhd+93QrzR8=";
+          allowedIPs = [
+            "10.7.6.7/32"
+            "fd00:fae:fae:fae:fae:7::/96"
          ];
        }
      ];
--- a/hosts/underground/configuration.nix
+++ b/hosts/underground/configuration.nix
@ -0,0 +1,72 @@
+{
+  flake,
+  config,
+  pkgs,
+  ...
+}:
+{
+  # Use GRUB2 as the boot loader.
+  boot.loader.grub = {
+    enable = true;
+    devices = [ "/dev/vda" ];
+  };
+
+  pub-solar-os.networking.domain = "test.pub.solar";
+
+  systemd.tmpfiles.rules = [ "f /tmp/dbf 1777 root root 10d password" ];
+
+  # keycloak
+  pub-solar-os.auth = {
+    enable = true;
+    database-password-file = "/tmp/dbf";
+  };
+  services.keycloak.database.createLocally = true;
+
+  # matrix-synapse
+  # test.pub.solar /.well-known is required for federation
+  services.nginx.virtualHosts."${config.pub-solar-os.networking.domain}" = {
+    default = true;
+    enableACME = true;
+    forceSSL = true;
+  };
+
+  age.secrets."staging-matrix-synapse-secret-config.yaml" = {
+    file = "${flake.self}/secrets/staging-matrix-synapse-secret-config.yaml.age";
+    mode = "400";
+    owner = "matrix-synapse";
+  };
+
+  age.secrets."staging-matrix-authentication-service-secret-config.yml" = {
+    file = "${flake.self}/secrets/staging-matrix-authentication-service-secret-config.yml.age";
+    mode = "400";
+    owner = "matrix-authentication-service";
+  };
+
+  pub-solar-os.matrix = {
+    enable = true;
+    synapse = {
+      extra-config-files = [
+        config.age.secrets."staging-matrix-synapse-secret-config.yaml".path
+
+        # The registration file is automatically generated after starting the
+        # appservice for the first time.
+        # cp /var/lib/mautrix-telegram/telegram-registration.yaml \
+        #   /var/lib/matrix-synapse/
+        # chown matrix-synapse:matrix-synapse \
+        #   /var/lib/matrix-synapse/telegram-registration.yaml
+        #"/var/lib/matrix-synapse/telegram-registration.yaml"
+      ];
+      app-service-config-files = [
+        "/var/lib/matrix-appservice-irc/registration.yml"
+        #"/var/lib/matrix-synapse/telegram-registration.yaml"
+      ];
+    };
+    matrix-authentication-service.extra-config-files = [
+      config.age.secrets."staging-matrix-authentication-service-secret-config.yml".path
+    ];
+  };
+
+  services.openssh.openFirewall = true;
+
+  system.stateVersion = "24.05";
+}
--- a/hosts/underground/default.nix
+++ b/hosts/underground/default.nix
@ -0,0 +1,16 @@
+{ flake, ... }:
+
+{
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    ./configuration.nix
+
+    ./networking.nix
+    "${flake.inputs.fork}/nixos/modules/services//matrix/matrix-authentication-service.nix"
+  ];
+
+  disabledModules = [
+    "services/matrix/matrix-authentication-service.nix "
+  ];
+}
--- a/hosts/underground/hardware-configuration.nix
+++ b/hosts/underground/hardware-configuration.nix
@ -8,45 +8,40 @@
  modulesPath,
  ...
 }:
+
 {
-  imports = [ ];
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];

  boot.initrd.availableKernelModules = [
    "ahci"
-    "virtio_pci"
    "xhci_pci"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
    "sr_mod"
-    "virtio_blk"
  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
  boot.extraModulePackages = [ ];

+  boot.initrd.luks.devices."cryptroot" = {
+    device = "/dev/disk/by-label/cryptroot";
+  };
+
  fileSystems."/" = {
-    device = "/dev/disk/by-label/nixos";
-    autoResize = true;
+    device = "/dev/disk/by-label/root";
    fsType = "ext4";
  };

  fileSystems."/boot" = {
    device = "/dev/disk/by-label/boot";
-    fsType = "vfat";
-  };
-
-  fileSystems."/data" = {
-    device = "/dev/disk/by-label/ephemeral0";
    fsType = "ext4";
-    options = [
-      "defaults"
-      "nofail"
-    ];
  };

-  swapDevices = [ ];
-
-  networking.useDHCP = lib.mkDefault false;
-  networking.networkmanager.enable = lib.mkForce false;
+  swapDevices = [
+    { device = "/dev/disk/by-label/swap"; }
+  ];

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/underground/networking.nix
+++ b/hosts/underground/networking.nix
@ -0,0 +1,30 @@
+{
+  config,
+  pkgs,
+  flake,
+  ...
+}:
+{
+
+  networking.hostName = "underground";
+
+  networking = {
+    defaultGateway = {
+      address = "80.244.242.1";
+      interface = "enp1s0";
+    };
+    nameservers = [
+      "95.129.51.51"
+      "80.244.244.244"
+    ];
+    interfaces.enp1s0 = {
+      useDHCP = false;
+      ipv4.addresses = [
+        {
+          address = "80.244.242.3";
+          prefixLength = 29;
+        }
+      ];
+    };
+  };
+}
--- a/logins/admins.nix
+++ b/logins/admins.nix
@ -63,6 +63,7 @@
  teutat3s = {
    sshPubKeys = {
      teutat3s-1 = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFro/k4Mgqyh8yV/7Zwjc0dv60ZM7bROBU9JNd99P/4co6fxPt1pJiU/pEz2Dax/HODxgcO+jFZfvPEuLMCeAl0= YubiKey #10593996 PIV Slot 9a";
+      teutat3s-2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHcU6KPy4b1MQXd6EJhcYwbJu7E+0IrBZF/IP6T7gbMf teutat3s@dumpyourvms";
    };

    secretEncryptionKeys = {
--- a/logins/robots.nix
+++ b/logins/robots.nix
@ -2,6 +2,5 @@
  # Used for restic backups to droppie, a server run by @b12f
  "root@droppie" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZQSephFJU0NMbVbhwvVJ2/m6jcPYo1IsWCsoarqKin root@droppie";

-  # robot user on flora-6
-  "hakkonaut@flora-6" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP5MvCwNRtCcP1pSDrn0XZTNlpOqYnjHDm9/OI4hECW hakkonaut@flora-6";
+  "hakkonaut" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP5MvCwNRtCcP1pSDrn0XZTNlpOqYnjHDm9/OI4hECW hakkonaut";
 }
--- a/modules/core/networking.nix
+++ b/modules/core/networking.nix
@ -31,13 +31,17 @@

    networking.hosts = {
      "10.7.6.1" = [ "nachtigall.wg.${config.pub-solar-os.networking.domain}" ];
-      "10.7.6.2" = [ "flora-6.wg.${config.pub-solar-os.networking.domain}" ];
      "10.7.6.3" = [ "metronom.wg.${config.pub-solar-os.networking.domain}" ];
      "10.7.6.4" = [ "tankstelle.wg.${config.pub-solar-os.networking.domain}" ];
+      "10.7.6.5" = [ "trinkgenossin.wg.${config.pub-solar-os.networking.domain}" ];
+      "10.7.6.6" = [ "delite.wg.${config.pub-solar-os.networking.domain}" ];
+      "10.7.6.7" = [ "blue-shell.wg.${config.pub-solar-os.networking.domain}" ];
      "fd00:fae:fae:fae:fae:1::" = [ "nachtigall.wg.${config.pub-solar-os.networking.domain}" ];
-      "fd00:fae:fae:fae:fae:2::" = [ "flora-6.wg.${config.pub-solar-os.networking.domain}" ];
      "fd00:fae:fae:fae:fae:3::" = [ "metronom.wg.${config.pub-solar-os.networking.domain}" ];
      "fd00:fae:fae:fae:fae:4::" = [ "tankstelle.wg.${config.pub-solar-os.networking.domain}" ];
+      "fd00:fae:fae:fae:fae:5::" = [ "trinkgenossin.wg.${config.pub-solar-os.networking.domain}" ];
+      "fd00:fae:fae:fae:fae:6::" = [ "delite.wg.${config.pub-solar-os.networking.domain}" ];
+      "fd00:fae:fae:fae:fae:7::" = [ "blue-shell.wg.${config.pub-solar-os.networking.domain}" ];
    };

    services.openssh = {
--- a/modules/core/nix.nix
+++ b/modules/core/nix.nix
@ -6,7 +6,21 @@
  ...
 }:
 {
-  nixpkgs.config = lib.mkDefault { allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ ]; };
+  nixpkgs.config = lib.mkDefault {
+    allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ ];
+    permittedInsecurePackages = [ "olm-3.2.16" ];
+  };
+
+  system.activationScripts.diff-closures = {
+    text = ''
+      if [[ -e /run/current-system ]]; then
+        ${config.nix.package}/bin/nix store diff-closures \
+          /run/current-system "$systemConfig" \
+          --extra-experimental-features nix-command
+      fi
+    '';
+    supportsDryActivation = true;
+  };

  nix = {
    # Use default version alias for nix package
--- a/modules/coturn/default.nix
+++ b/modules/coturn/default.nix
@ -18,7 +18,7 @@
    min-port = 49000;
    max-port = 50000;
    use-auth-secret = true;
-    static-auth-secret-file = "/run/agenix/coturn-static-auth-secret";
+    static-auth-secret-file = config.age.secrets."coturn-static-auth-secret".path;
    realm = "turn.${config.pub-solar-os.networking.domain}";
    cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
    pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
--- a/modules/drone/default.nix
+++ b/modules/drone/default.nix
@ -1,114 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  flake,
-  ...
-}:
-{
-  age.secrets.drone-secrets = {
-    file = "${flake.self}/secrets/drone-secrets.age";
-    mode = "600";
-    owner = "drone";
-  };
-  age.secrets.drone-db-secrets = {
-    file = "${flake.self}/secrets/drone-db-secrets.age";
-    mode = "600";
-    owner = "drone";
-  };
-
-  users.users.drone = {
-    description = "Drone Service";
-    home = "/var/lib/drone";
-    useDefaultShell = true;
-    uid = 994;
-    group = "drone";
-    isSystemUser = true;
-  };
-
-  users.groups.drone = { };
-
-  systemd.tmpfiles.rules = [ "d '/var/lib/drone-db' 0750 drone drone - -" ];
-
-  services.caddy.virtualHosts."ci.${config.pub-solar-os.networking.domain}" = {
-    logFormat = lib.mkForce ''
-      output discard
-    '';
-    extraConfig = ''
-      reverse_proxy :4000
-    '';
-  };
-
-  systemd.services."docker-network-drone" =
-    let
-      docker = config.virtualisation.oci-containers.backend;
-      dockerBin = "${pkgs.${docker}}/bin/${docker}";
-    in
-    {
-      serviceConfig.Type = "oneshot";
-      before = [ "docker-drone-server.service" ];
-      script = ''
-        ${dockerBin} network inspect drone-net >/dev/null 2>&1 || ${dockerBin} network create drone-net --subnet 172.20.0.0/24
-      '';
-    };
-
-  virtualisation = {
-    docker = {
-      enable = true; # sadly podman is not supported rightnow
-      extraOptions = ''
-        --data-root /data/docker
-      '';
-    };
-
-    oci-containers = {
-      backend = "docker";
-      containers."drone-db" = {
-        image = "postgres:14";
-        autoStart = true;
-        user = "994";
-        volumes = [ "/var/lib/drone-db:/var/lib/postgresql/data" ];
-        extraOptions = [ "--network=drone-net" ];
-        environmentFiles = [ config.age.secrets.drone-db-secrets.path ];
-      };
-      containers."drone-server" = {
-        image = "drone/drone:2";
-        autoStart = true;
-        user = "994";
-        ports = [ "127.0.0.1:4000:80" ];
-        dependsOn = [ "drone-db" ];
-        extraOptions = [
-          "--network=drone-net"
-          "--pull=always"
-          "--add-host=nachtigall.${config.pub-solar-os.networking.domain}:10.7.6.1"
-        ];
-        environment = {
-          DRONE_GITEA_SERVER = "https://git.${config.pub-solar-os.networking.domain}";
-          DRONE_SERVER_HOST = "ci.${config.pub-solar-os.networking.domain}";
-          DRONE_SERVER_PROTO = "https";
-          DRONE_DATABASE_DRIVER = "postgres";
-        };
-        environmentFiles = [ config.age.secrets.drone-secrets.path ];
-      };
-      containers."drone-docker-runner" = {
-        image = "drone/drone-runner-docker:1";
-        autoStart = true;
-        # needs to run as root
-        #user = "994";
-        volumes = [ "/var/run/docker.sock:/var/run/docker.sock" ];
-        dependsOn = [ "drone-db" ];
-        extraOptions = [
-          "--network=drone-net"
-          "--pull=always"
-          "--add-host=nachtigall.${config.pub-solar-os.networking.domain}:10.7.6.1"
-        ];
-        environment = {
-          DRONE_RPC_HOST = "ci.${config.pub-solar-os.networking.domain}";
-          DRONE_RPC_PROTO = "https";
-          DRONE_RUNNER_CAPACITY = "2";
-          DRONE_RUNNER_NAME = "flora-6-docker-runner";
-        };
-        environmentFiles = [ config.age.secrets.drone-secrets.path ];
-      };
-    };
-  };
-}
--- a/modules/forgejo-actions-runner/default.nix
+++ b/modules/forgejo-actions-runner/default.nix
@ -1,67 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  flake,
-  ...
-}:
-{
-  age.secrets.forgejo-actions-runner-token = {
-    file = "${flake.self}/secrets/forgejo-actions-runner-token.age";
-    mode = "440";
-  };
-
-  # Trust docker bridge interface traffic
-  # Needed for the docker runner to communicate with the act_runner cache
-  networking.firewall.trustedInterfaces = [ "br-+" ];
-
-  users.users.gitea-runner = {
-    home = "/var/lib/gitea-runner/flora-6";
-    useDefaultShell = true;
-    group = "gitea-runner";
-    isSystemUser = true;
-  };
-
-  users.groups.gitea-runner = { };
-
-  systemd.services."gitea-runner-flora\\x2d6".serviceConfig = {
-    DynamicUser = lib.mkForce false;
-  };
-
-  systemd.tmpfiles.rules = [
-    "d '/data/gitea-actions-runner' 0750 gitea-runner gitea-runner - -"
-    "d '/var/lib/gitea-runner' 0750 gitea-runner gitea-runner - -"
-  ];
-
-  # forgejo actions runner
-  # https://forgejo.org/docs/latest/admin/actions/
-  # https://docs.gitea.com/usage/actions/quickstart
-  services.gitea-actions-runner = {
-    package = pkgs.forgejo-runner;
-    instances."flora-6" = {
-      enable = true;
-      name = config.networking.hostName;
-      url = "https://git.pub.solar";
-      tokenFile = config.age.secrets.forgejo-actions-runner-token.path;
-      settings = {
-        cache = {
-          enabled = true;
-          dir = "/data/gitea-actions-runner/actcache";
-          host = "";
-          port = 0;
-          external_server = "";
-        };
-      };
-      labels = [
-        # provide a debian 12 bookworm base with Node.js for actions
-        "debian-latest:docker://git.pub.solar/pub-solar/actions-base-image:20-bookworm"
-        # fake the ubuntu name, commonly used in actions examples
-        "ubuntu-latest:docker://git.pub.solar/pub-solar/actions-base-image:20-bookworm"
-        # alpine with Node.js
-        "alpine-latest:docker://node:20-alpine"
-        # nix flakes enabled image with Node.js
-        "nix-flakes:docker://git.pub.solar/pub-solar/nix-flakes-node:latest"
-      ];
-    };
-  };
-}
--- a/modules/forgejo/default.nix
+++ b/modules/forgejo/default.nix
@ -141,6 +141,12 @@
        LOGIN_REMEMBER_DAYS = 365;
      };

+      # See https://docs.gitea.com/administration/config-cheat-sheet#migrations-migrations
+      migrations = {
+        # This allows migrations from the same forgejo instance
+        ALLOW_LOCALNETWORKS = true;
+      };
+
      # https://forgejo.org/docs/next/admin/config-cheat-sheet/#indexer-indexer
      indexer = {
        REPO_INDEXER_ENABLED = true;
--- a/modules/garage/default.nix
+++ b/modules/garage/default.nix
@ -31,6 +31,8 @@

  security.acme = {
    defaults = {
+      # LEGO_DISABLE_CNAME_SUPPORT=true set here to fix issues with CNAME
+      # detection, as we use wildcard DNS for garage
      environmentFile = config.age.secrets.acme-namecheap-env.path;
    };
    certs = {
@ -40,7 +42,6 @@
        webroot = null;
        # enable dns challenge
        dnsProvider = "namecheap";
-        dnsPropagationCheck = false;
      };
      # Wildcard certificate gets created automatically
      "web.${config.pub-solar-os.networking.domain}" = {
@ -48,7 +49,6 @@
        webroot = null;
        # enable dns challenge
        dnsProvider = "namecheap";
-        dnsPropagationCheck = false;
      };
    };
  };
@ -88,7 +88,7 @@

  services.garage = {
    enable = true;
-    package = pkgs.garage_1_0_0;
+    package = pkgs.garage_1_0_1;
    settings = {
      data_dir = "/var/lib/garage/data";
      metadata_dir = "/var/lib/garage/meta";
@ -99,7 +99,7 @@
      s3_api = {
        s3_region = "eu-central";
        api_bind_addr = "[::]:3900";
-        root_domain = ".s3.${config.pub-solar-os.networking.domain}";
+        root_domain = ".buckets.${config.pub-solar-os.networking.domain}";
      };
      s3_web = {
        bind_addr = "[::]:3902";
--- a/modules/grafana/default.nix
+++ b/modules/grafana/default.nix
@ -40,13 +40,10 @@
    };
  };

-  services.caddy.virtualHosts."grafana.${config.pub-solar-os.networking.domain}" = {
-    logFormat = lib.mkForce ''
-      output discard
-    '';
-    extraConfig = ''
-      reverse_proxy :${toString config.services.grafana.settings.server.http_port}
-    '';
+  services.nginx.virtualHosts."grafana.${config.pub-solar-os.networking.domain}" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/".proxyPass = "http://127.0.0.1:${toString config.services.grafana.settings.server.http_port}";
  };

  services.grafana = {
@ -69,7 +66,7 @@
        password = "\$__file{${config.age.secrets.grafana-smtp-password.path}}";
        from_address = "no-reply@pub.solar";
        from_name = "grafana.pub.solar";
-        ehlo_identity = "flora-6.pub.solar";
+        ehlo_identity = "grafana.pub.solar";
      };
      security = {
        admin_email = "crew@pub.solar";
--- a/modules/loki/default.nix
+++ b/modules/loki/default.nix
@ -25,7 +25,7 @@
          };
        };
        replication_factor = 1;
-        path_prefix = "/data/loki";
+        path_prefix = "/var/lib/loki";
        storage = {
          filesystem = {
            chunks_directory = "chunks/";
@ -108,7 +108,7 @@
      };
      clients = [
        {
-          url = "http://flora-6.wg.pub.solar:${toString config.services.loki.configuration.server.http_listen_port}/loki/api/v1/push";
+          url = "http://trinkgenossin.wg.pub.solar:${toString config.services.loki.configuration.server.http_listen_port}/loki/api/v1/push";
        }
      ];
      scrape_configs = [
@ -118,7 +118,7 @@
            max_age = "24h";
            labels = {
              job = "systemd-journal";
-              host = "flora-6";
+              host = "trinkgenossin";
            };
          };
          relabel_configs = [
--- a/modules/mastodon/default.nix
+++ b/modules/mastodon/default.nix
@ -7,6 +7,21 @@
 }:

 {
+  age.secrets."mastodon-active-record-encryption-deterministic-key" = {
+    file = "${flake.self}/secrets//mastodon-active-record-encryption-deterministic-key.age";
+    mode = "400";
+    owner = config.services.mastodon.user;
+  };
+  age.secrets."mastodon-active-record-encryption-key-derivation-salt" = {
+    file = "${flake.self}/secrets//mastodon-active-record-encryption-key-derivation-salt.age";
+    mode = "400";
+    owner = config.services.mastodon.user;
+  };
+  age.secrets."mastodon-active-record-encryption-primary-key" = {
+    file = "${flake.self}/secrets//mastodon-active-record-encryption-primary-key.age";
+    mode = "400";
+    owner = config.services.mastodon.user;
+  };
  age.secrets."mastodon-secret-key-base" = {
    file = "${flake.self}/secrets/mastodon-secret-key-base.age";
    mode = "400";
@ -54,6 +69,9 @@
    webProcesses = 2;
    # Threads per process used by the mastodon-web service
    webThreads = 5;
+    activeRecordEncryptionDeterministicKeyFile = "/run/agenix/mastodon-active-record-encryption-deterministic-key";
+    activeRecordEncryptionKeyDerivationSaltFile = "/run/agenix/mastodon-active-record-encryption-key-derivation-salt";
+    activeRecordEncryptionPrimaryKeyFile = "/run/agenix/mastodon-active-record-encryption-primary-key";
    secretKeyBaseFile = "/run/agenix/mastodon-secret-key-base";
    otpSecretFile = "/run/agenix/mastodon-otp-secret";
    vapidPrivateKeyFile = "/run/agenix/mastodon-vapid-private-key";
@ -67,20 +85,20 @@
      passwordFile = "/run/agenix/mastodon-smtp-password";
      fromAddress = "mastodon-notifications@pub.solar";
    };
+    # Defined in ./opensearch.nix
+    elasticsearch.host = "127.0.0.1";
    mediaAutoRemove = {
      olderThanDays = 7;
    };
    extraEnvFiles = [ "/run/agenix/mastodon-extra-env-secrets" ];
    extraConfig = {
      WEB_DOMAIN = "mastodon.${config.pub-solar-os.networking.domain}";
-      # Defined in ./opensearch.nix
-      ES_HOST = "127.0.0.1";
      # S3 File storage (optional)
      # -----------------------
      S3_ENABLED = "true";
-      S3_BUCKET = "pub-solar-mastodon";
-      S3_REGION = "europe-west-1";
-      S3_ENDPOINT = "https://gateway.tardigradeshare.io";
+      S3_BUCKET = "mastodon";
+      S3_REGION = "eu-central";
+      S3_ENDPOINT = "https://buckets.pub.solar";
      S3_ALIAS_HOST = "files.${config.pub-solar-os.networking.domain}";
      # Translation (optional)
      # -----------------------
--- a/modules/matrix-irc/default.nix
+++ b/modules/matrix-irc/default.nix
@ -16,11 +16,6 @@ let
  synapseClientPort = "${toString listenerWithClient.port}";
 in
 {
-  systemd.services.matrix-appservice-irc.serviceConfig.SystemCallFilter = lib.mkForce [
-    "@system-service @pkey"
-    "~@privileged @resources"
-    "@chown"
-  ];
  services.matrix-appservice-irc = {
    enable = true;
    localpart = "irc_bot";
@ -40,7 +35,8 @@ in
          port = 1113;
        };
        logging = {
-          level = "debug";
+          # set to debug for debugging
+          level = "warn";
          maxFiles = 5;
          toCosole = true;
        };
--- a/modules/matrix/default.nix
+++ b/modules/matrix/default.nix
@ -1,6 +1,7 @@
 {
  flake,
  config,
+  lib,
  pkgs,
  ...
 }:
@ -9,24 +10,46 @@ let
  serverDomain = "${config.pub-solar-os.networking.domain}";
 in
 {
-  age.secrets."matrix-synapse-signing-key" = {
-    file = "${flake.self}/secrets/matrix-synapse-signing-key.age";
-    mode = "400";
-    owner = "matrix-synapse";
+  options.pub-solar-os = {
+    matrix = {
+      enable = lib.mkEnableOption "Enable matrix-synapse and matrix-authentication-service to run on the node";
+
+      synapse = {
+        app-service-config-files = lib.mkOption {
+          description = "List of app service config files";
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
        };

-  age.secrets."matrix-synapse-secret-config.yaml" = {
-    file = "${flake.self}/secrets/matrix-synapse-secret-config.yaml.age";
-    mode = "400";
-    owner = "matrix-synapse";
+        extra-config-files = lib.mkOption {
+          description = "List of extra synapse config files";
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
        };

-  age.secrets."matrix-synapse-sliding-sync-secret" = {
-    file = "${flake.self}/secrets/matrix-synapse-sliding-sync-secret.age";
-    mode = "400";
-    owner = "matrix-synapse";
+        signing_key_path = lib.mkOption {
+          description = "Path to file containing the signing key";
+          type = lib.types.str;
+          default = "${config.services.matrix-synapse.dataDir}/homeserver.signing.key";
        };

+        sliding-sync.enable = lib.mkEnableOption {
+          description = "Whether to enable a sliding-sync proxy, no longer needed with synapse version 1.114+";
+          default = false;
+        };
+      };
+
+      matrix-authentication-service = {
+        extra-config-files = lib.mkOption {
+          description = "List of extra mas config files";
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf config.pub-solar-os.matrix.enable {
    services.matrix-synapse = {
      enable = true;
      settings = {
@ -194,7 +217,7 @@ in
          }
        ];

-      signing_key_path = "/run/agenix/matrix-synapse-signing-key";
+        signing_key_path = config.pub-solar-os.matrix.synapse.signing_key_path;

        stream_writers = { };
        trusted_key_servers = [ { server_name = "matrix.org"; } ];
@ -240,29 +263,12 @@ in
        };
        user_ips_max_age = "28d";

-      app_service_config_files = [
-        "/var/lib/matrix-synapse/telegram-registration.yaml"
-        "/var/lib/matrix-appservice-irc/registration.yml"
-        # "/matrix-appservice-slack-registration.yaml"
-        # "/hookshot-registration.yml"
-        # "/matrix-mautrix-signal-registration.yaml"
-        # "/matrix-mautrix-telegram-registration.yaml"
-      ];
+        app_service_config_files = config.pub-solar-os.matrix.synapse.app-service-config-files;
      };

      withJemalloc = true;

-    extraConfigFiles = [
-      "/run/agenix/matrix-synapse-secret-config.yaml"
-
-      # The registration file is automatically generated after starting the
-      # appservice for the first time.
-      # cp /var/lib/mautrix-telegram/telegram-registration.yaml \
-      #   /var/lib/matrix-synapse/
-      # chown matrix-synapse:matrix-synapse \
-      #   /var/lib/matrix-synapse/telegram-registration.yaml
-      "/var/lib/matrix-synapse/telegram-registration.yaml"
-    ];
+      extraConfigFiles = config.pub-solar-os.matrix.synapse.extra-config-files;

      extras = [
        "oidc"
@ -272,8 +278,56 @@ in
      plugins = [ config.services.matrix-synapse.package.plugins.matrix-synapse-shared-secret-auth ];
    };

-  services.matrix-sliding-sync = {
+    services.matrix-authentication-service = {
      enable = true;
+      createDatabase = true;
+      extraConfigFiles = config.pub-solar-os.matrix.matrix-authentication-service.extra-config-files;
+
+      settings = {
+        http.public_base = "https://mas.${config.pub-solar-os.networking.domain}";
+        http.issuer = "https://mas.${config.pub-solar-os.networking.domain}";
+        http.listeners = [
+          {
+            name = "web";
+            resources = [
+              { name = "discovery"; }
+              { name = "human"; }
+              { name = "oauth"; }
+              { name = "compat"; }
+              { name = "graphql"; }
+              {
+                name = "assets";
+                path = "${config.services.matrix-authentication-service.package}/share/matrix-authentication-service/assets";
+              }
+            ];
+            binds = [
+              {
+                host = "0.0.0.0";
+                port = 8090;
+              }
+            ];
+            proxy_protocol = false;
+          }
+          {
+            name = "internal";
+            resources = [
+              { name = "health"; }
+            ];
+            binds = [
+              {
+                host = "0.0.0.0";
+                port = 8081;
+              }
+            ];
+            proxy_protocol = false;
+          }
+        ];
+        passwords.enabled = false;
+      };
+    };
+
+    services.matrix-sliding-sync = {
+      enable = config.pub-solar-os.matrix.synapse.sliding-sync.enable;
      settings = {
        SYNCV3_SERVER = "https://${publicDomain}";
        SYNCV3_BINDADDR = "127.0.0.1:8011";
@ -284,7 +338,7 @@ in
      environmentFile = config.age.secrets."matrix-synapse-sliding-sync-secret".path;
    };

-  services.restic.backups.matrix-synapse-storagebox = {
+    pub-solar-os.backups.restic.matrix-synapse = {
      paths = [
        "/var/lib/matrix-synapse"
        "/var/lib/matrix-appservice-irc"
@ -295,8 +349,6 @@ in
        OnCalendar = "*-*-* 05:00:00 Etc/UTC";
      };
      initialize = true;
-    passwordFile = config.age.secrets."restic-repo-storagebox-nachtigall".path;
-    repository = "sftp:u377325@u377325.your-storagebox.de:/backups";
      backupPrepareCommand = ''
        ${pkgs.sudo}/bin/sudo -u postgres ${pkgs.postgresql}/bin/pg_dump -d matrix > /tmp/matrix-synapse-backup.sql
      '';
@ -309,4 +361,5 @@ in
        "--keep-monthly 3"
      ];
    };
+  };
 }
--- a/modules/nginx-mastodon-files/default.nix
+++ b/modules/nginx-mastodon-files/default.nix
@ -1,8 +1,7 @@
 { config, ... }:

 let
-  objStorHost = "link.tardigradeshare.io";
-  objStorBucket = "s/jw24ad6l4a6zxsnd32cmf5hp5nsq/pub-solar-mastodon";
+  objStorHost = "mastodon.web.pub.solar";
 in
 {
  services.nginx.virtualHosts = {
@ -10,6 +9,12 @@ in
      enableACME = true;
      forceSSL = true;

+      # Use variable to force nginx to perform a DNS resolution on its value,
+      # the IP of the object storage provider may not always remain the same.
+      extraConfig = ''
+        set $s3_backend 'https://${objStorHost}';
+      '';
+
      locations = {
        "= /" = {
          index = "index.html";
@ -25,7 +30,6 @@ in
              deny all;
            }

-            resolver 8.8.8.8;
            proxy_set_header Host ${objStorHost};
            proxy_set_header Connection \'\';
            proxy_set_header Authorization \'\';
@ -40,7 +44,7 @@ in
            proxy_hide_header x-amz-bucket-region;
            proxy_hide_header x-amzn-requestid;
            proxy_ignore_headers Set-Cookie;
-            proxy_pass https://${objStorHost}/${objStorBucket}$request_uri?download;
+            proxy_pass $s3_backend$request_uri;
            proxy_intercept_errors off;
            proxy_ssl_protocols TLSv1.2 TLSv1.3;
            proxy_ssl_server_name on;
--- a/modules/nginx-matrix/default.nix
+++ b/modules/nginx-matrix/default.nix
@ -10,11 +10,14 @@ let
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-XSS-Protection "1; mode=block";
  '';
-  clientConfig = import ./element-client-config.nix { inherit lib pkgs; };
+  clientConfig = import ./element-client-config.nix { inherit config lib pkgs; };
  wellKnownClient = domain: {
    "m.homeserver".base_url = "https://matrix.${domain}";
    "m.identity_server".base_url = "https://matrix.${domain}";
-    "org.matrix.msc3575.proxy".url = "https://matrix.${domain}";
+    "org.matrix.msc2965.authentication" = {
+      issuer = "https://mas.${domain}/";
+      account = "https://mas.${domain}/account";
+    };
    "im.vector.riot.e2ee".default = true;
    "io.element.e2ee" = {
      default = true;
@ -85,6 +88,27 @@ in
      root = pkgs.element-stickerpicker;
    };

+    "mas.${config.pub-solar-os.networking.domain}" = {
+      root = "/dev/null";
+
+      forceSSL = lib.mkDefault true;
+      enableACME = lib.mkDefault true;
+
+      locations = {
+        "/" = {
+          proxyPass = "http://127.0.0.1:8090";
+
+          extraConfig = ''
+            ${commonHeaders}
+            proxy_http_version 1.1;
+
+            # Forward the client IP address
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          '';
+        };
+      };
+    };
+
    "matrix.${config.pub-solar-os.networking.domain}" = {
      root = "/dev/null";

@ -99,28 +123,41 @@ in
      locations = {
        # For telegram
        "/c3c3f34b-29fb-5feb-86e5-98c75ec8214b" = {
+          priority = 100;
          proxyPass = "http://127.0.0.1:8009";
          extraConfig = commonHeaders;
        };

-        # sliding-sync
-        "~ ^/(client/|_matrix/client/unstable/org.matrix.msc3575/sync)" = {
-          proxyPass = "http://127.0.0.1:8011";
-          extraConfig = commonHeaders;
+        # Forward to the auth service
+        "~ ^/_matrix/client/(.*)/(login|logout|refresh)" = {
+          priority = 100;
+          proxyPass = "http://127.0.0.1:8090";
+
+          extraConfig = ''
+            ${commonHeaders}
+            proxy_http_version 1.1;
+
+            # Forward the client IP address
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          '';
        };

-        "~* ^(/_matrix|/_synapse/client|/_synapse/oidc)" = {
+        # Forward to Synapse
+        # as per https://element-hq.github.io/synapse/latest/reverse_proxy.html#nginx
+        "~ ^(/_matrix|/_synapse/client)" = {
+          priority = 200;
          proxyPass = "http://127.0.0.1:8008";

          extraConfig = ''
            ${commonHeaders}
+            proxy_set_header X-Forwarded-For $remote_addr;
+            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Host $host;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;

            client_body_buffer_size 25M;
            client_max_body_size 50M;
            proxy_max_temp_file_size 0;
+            proxy_http_version 1.1;
          '';
        };
      };
--- a/modules/nginx-matrix/element-client-config.nix
+++ b/modules/nginx-matrix/element-client-config.nix
@ -1,9 +1,14 @@
-{ pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 {
  default_server_config = {
    "m.homeserver" = {
-      base_url = "https://matrix.pub.solar";
-      server_name = "pub.solar";
+      base_url = "https://matrix.${config.pub-solar-os.networking.domain}";
+      server_name = "${config.pub-solar-os.networking.domain}";
    };
    "m.identity_server" = {
      base_url = "";
--- a/modules/nginx/default.nix
+++ b/modules/nginx/default.nix
@ -22,6 +22,13 @@ in
    recommendedOptimisation = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;
+    resolver.addresses = [
+      # quad9.net
+      "9.9.9.9"
+      "149.112.112.112"
+      "[2620:fe::fe]"
+      "[2620:fe::9]"
+    ];
    appendHttpConfig = ''
      # https://my.f5.com/manage/s/article/K51798430
      proxy_headers_hash_bucket_size 128;
--- a/modules/obs-portal/default.nix
+++ b/modules/obs-portal/default.nix
@ -154,11 +154,11 @@ in
      "/tmp/obs-portal-backup.sql"
    ];
    timerConfig = {
-      OnCalendar = "*-*-* 00:30:00 Etc/UTC";
+      OnCalendar = "*-*-* 01:30:00 Etc/UTC";
    };
    initialize = true;
    backupPrepareCommand = ''
-      ${pkgs.docker}/bin/docker exec -ti --user postgres obs-portal-db pg_dump obs > /tmp/obs-portal-backup.sql
+      ${pkgs.docker}/bin/docker exec -i --user postgres obs-portal-db pg_dump obs > /tmp/obs-portal-backup.sql
    '';
    backupCleanupCommand = ''
      rm /tmp/obs-portal-backup.sql
--- a/modules/prometheus/alert-rules.nix
+++ b/modules/prometheus/alert-rules.nix
@ -24,10 +24,10 @@ lib.mapAttrsToList
    #   description = "Configurations of AlertManager cluster instances are out of sync.";
    # };

-    #alert_manager_e2e_dead_man_switch = {
-    #  condition = "vector(1)";
-    #  description = "Prometheus DeadManSwitch is an always-firing alert. It's used as an end-to-end test of Prometheus through the Alertmanager.";
-    #};
+    alert_manager_e2e_dead_man_switch = {
+      condition = "vector(1)";
+      description = "Prometheus DeadManSwitch is an always-firing alert. It's used as an end-to-end test of Prometheus through the Alertmanager.";
+    };

    # prometheus_not_connected_to_alertmanager = {
    #   condition = "prometheus_notifications_alertmanagers_discovered < 1";
@ -142,8 +142,8 @@ lib.mapAttrsToList

    cpu_using_90percent = {
      condition = ''100 - (avg by (instance) (irate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) >= 90'';
-      time = "10m";
-      description = "{{$labels.instance}} is running with cpu usage > 90% for at least 10 minutes: {{$value}}";
+      time = "20m";
+      description = "{{$labels.instance}} is running with cpu usage > 90% for at least 20 minutes: {{$value}}";
    };

    reboot = {
@ -234,10 +234,10 @@ lib.mapAttrsToList
      };
    */

-    host_memory_under_memory_pressure = {
-      condition = "rate(node_vmstat_pgmajfault[1m]) > 1000";
-      description = "{{$labels.instance}}: The node is under heavy memory pressure. High rate of major page faults: {{$value}}";
-    };
+    #host_memory_under_memory_pressure = {
+    #  condition = "rate(node_vmstat_pgmajfault[1m]) > 1000";
+    #  description = "{{$labels.instance}}: The node is under heavy memory pressure. High rate of major page faults: {{$value}}";
+    #};

    # ext4_errors = {
    #   condition = "ext4_errors_value > 0";
@ -250,4 +250,10 @@ lib.mapAttrsToList
    #   description =
    #     "alertmanager: number of active silences has changed: {{$value}}";
    # };
+
+    garage_cluster_healthy = {
+      condition = "cluster_healthy == 0";
+      time = "15m";
+      description = "garage cluster on {{$labels.instance}} is not healthy: {{$labels.result}}!";
+    };
  })
--- a/modules/prometheus/default.nix
+++ b/modules/prometheus/default.nix
@ -12,15 +12,27 @@
    owner = "alertmanager";
  };

-  services.caddy.virtualHosts."alerts.${config.pub-solar-os.networking.domain}" = {
-    logFormat = lib.mkForce ''
-      output discard
-    '';
-    extraConfig = ''
-      bind 10.7.6.2 fd00:fae:fae:fae:fae:2::
-      tls internal
-      reverse_proxy :${toString config.services.prometheus.alertmanager.port}
-    '';
+  security.acme.certs = {
+    "alerts.${config.pub-solar-os.networking.domain}" = {
+      # disable http challenge
+      webroot = null;
+      # enable dns challenge
+      dnsProvider = "namecheap";
+    };
+  };
+
+  services.nginx.virtualHosts."alerts.${config.pub-solar-os.networking.domain}" = {
+    enableACME = true;
+    forceSSL = true;
+
+    listenAddresses = [
+      "10.7.6.5"
+      "[fd00:fae:fae:fae:fae:5::]"
+    ];
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString config.services.prometheus.alertmanager.port}";
+    };
  };

  services.prometheus = {
@ -41,12 +53,6 @@
      {
        job_name = "node-exporter";
        static_configs = [
-          {
-            targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
-            labels = {
-              instance = "flora-6";
-            };
-          }
          {
            targets = [ "nachtigall.wg.${config.pub-solar-os.networking.domain}" ];
            labels = {
@ -77,6 +83,22 @@
              instance = "trinkgenossin";
            };
          }
+          {
+            targets = [
+              "delite.wg.${config.pub-solar-os.networking.domain}:${toString config.services.prometheus.exporters.node.port}"
+            ];
+            labels = {
+              instance = "delite";
+            };
+          }
+          {
+            targets = [
+              "blue-shell.wg.${config.pub-solar-os.networking.domain}:${toString config.services.prometheus.exporters.node.port}"
+            ];
+            labels = {
+              instance = "blue-shell";
+            };
+          }
        ];
      }
      {
@ -95,11 +117,22 @@
        job_name = "garage";
        static_configs = [
          {
-            targets = [
-              "trinkgenossin.wg.${config.pub-solar-os.networking.domain}:3903"
-              "delite.wg.${config.pub-solar-os.networking.domain}:3903"
-              "blue-shell.wg.${config.pub-solar-os.networking.domain}:3903"
-            ];
+            targets = [ "trinkgenossin.wg.${config.pub-solar-os.networking.domain}:3903" ];
+            labels = {
+              instance = "trinkgenossin";
+            };
+          }
+          {
+            targets = [ "delite.wg.${config.pub-solar-os.networking.domain}:3903" ];
+            labels = {
+              instance = "delite";
+            };
+          }
+          {
+            targets = [ "blue-shell.wg.${config.pub-solar-os.networking.domain}:3903" ];
+            labels = {
+              instance = "blue-shell";
+            };
          }
        ];
      }
--- a/modules/promtail/default.nix
+++ b/modules/promtail/default.nix
@ -18,7 +18,7 @@
      };
      clients = [
        {
-          url = "http://flora-6.wg.pub.solar:${toString flake.self.nixosConfigurations.flora-6.config.services.loki.configuration.server.http_listen_port}/loki/api/v1/push";
+          url = "http://trinkgenossin.wg.pub.solar:${toString flake.self.nixosConfigurations.trinkgenossin.config.services.loki.configuration.server.http_listen_port}/loki/api/v1/push";
        }
      ];
      scrape_configs = [
--- a/modules/tt-rss/default.nix
+++ b/modules/tt-rss/default.nix
@ -10,6 +10,7 @@ let
    version = "7ebfbc91e92bb133beb907c6bde79279ee5156df";
    src = pkgs.fetchgit {
      url = "https://git.tt-rss.org/fox/ttrss-auth-oidc.git";
+      rev = "7ebfbc91e92bb133beb907c6bde79279ee5156df";
      hash = "sha256-G6vZBvSWms6s6nHZWsxJjMGuubt/imiBvbp6ykwrZbg=";
    };
    installPhase = ''
--- a/overlays/default.nix
+++ b/overlays/default.nix
@ -16,6 +16,8 @@
                element-stickerpicker = prev.callPackage ./pkgs/element-stickerpicker {
                  inherit (inputs) element-stickers maunium-stickerpicker;
                };
+                mastodon = unstable.mastodon;
+                matrix-authentication-service = unstable.matrix-authentication-service;
              }
            )
          ];
--- a/secrets/acme-namecheap-env.age
+++ b/secrets/acme-namecheap-env.age
--- a/secrets/alertmanager-envfile.age
+++ b/secrets/alertmanager-envfile.age
@ -1,43 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 Y0ZZaw TsTaRLA+9WtN9+FJWpXeP12Af5EXMbo+ANTaLC9YlC8
-Yols084RY1C9gfOrDMwJcFRuGZ/5dgGuJey7RXqm7g0
-> ssh-ed25519 uYcDNw ZLAINtv10PGMtK5TL5Tf0NyK/r1iww+vTC09ElMGoX0
-EgBB3aiHHdaDue9+Zdxg6mTV2VHeLoDN9wT+hlAzVMk
+-> ssh-ed25519 NID4eA jIwfpP0rFLANj63MsJAse0R+TQbGf7mUStdusSLkkCg
+RHyxZqWGYMvhQYfZUc89GPly42u7MR9gSpR8aFWH6LI
+-> ssh-ed25519 uYcDNw JGsVrWwxwA8ftUM+Fo1jFigWfpvNUwoNkK5zKIu582Y
+BzM82Iqmta2Dtb8xey2nkoil7mDipn1iZtGMPKwPcPI
 -> ssh-rsa f5THog
-aiJqMs3/u06tzs8lx2ISlQm87TDatqEn47v3LB3HehPanRpZx9O1HUIRTeiWkMU9
-XroGe27HQCCPd63QunBHUH7WStA10IS4rHVpMcULB5IM4jwcbOhSYSiGyY2sbv8+
-Nn/04ZOwrfzTabC7moV1DqAw6hnlDqKWp/q5N6xMb780w5vn6Poni3OJfuLaBWaT
-r6WhE5evVt3F4jyYI64fB2hFw4AR2N/zIMOMvBncLFwJf9lbIFdbsENZf94cYceF
-Tj150xdMPuErBsSJQOlfDYSmyioNN3UJUWiYsDeM3nbPEVPHhfTk6b2/lMhSQkcY
-KcuMj/mN/7w7i4HSxW6mUcK2sUMV1BcSSGYRH9ZFf7kq++KpyiP7vB8vaZkcKbfJ
-qqrIcXTuXhR+/bWZWqf/GQOVwRwe1TnqN5MoZHipg3a/UCe0gMM617VwZcfhBzjA
-eW6VUdjSewwA8YHEuDrAeoQ4CMs7y56EaIlr2IlQy6uzJPX9eeO0auO9RZ5AR40a
-7un0FrlTJX9uorpCD/zi3tvd22W5qVoMGZ8vXJShZmT9he9K3Bv6XbzG4DJQ9/nv
-xZ676HUYhWeyYZFBvt6DnEBneiDJFeaV2AeuQY+juHBOfBrbYmlE0S4Pd8uRSJ7w
-u5UJTT+RV5TkZhpCqqYm7DphYocnrv7Ic+QKmvKE4ls
+LkPMatwkNWAElm+RQiCHtHH2QPgVsAAd5b4qF0R0O6r+0CYzEF2OAOZ0LDsytTB8
+7oHAHxA6kAga/pqKUaJl28xw7ujVIb1CunZFvVSxtOTYRrEy1Rxe3AKUOm+ZmfPL
+66Ef58HWMCHzK9sc/ojo7Us4okfRhJBklB9lnORkSfdkvEHLeq0R0FfDtDCnynRD
+SKqlx3VbdWe9k6UOJidA+dY8Wx0w2TQM1c21nDr4vXsXpZf6ttT4HvrqbSrS9V1c
+nGofWP+72WinOpFRDQdLvdKvaNbLPwhigqL1VqaIcsnye5zZjQDNn+SYf55byBkS
+CMXj238UqvdDxB4E3mBEgpFxOnyi6kLQXcPEBF/xQ5fER0RS5MkWkuH4Up+BCQ+/
+CppqZrw85OOa9jAyWxil3yLQNAnLGi/P+mesPxSI+i2Not9wbUTALr4COG+1qvfF
+2MbHiqREoajnQUJjhGhXaAA332X7hNuOF/DjmBr7i81oWVmKs6TjCDVL7Yo9xu3j
+BcFqMlaOgr8gObwnyJ9BbtW4sBtnOeD5onPxWluV1+Ql8Idjmu/BKeuqIyGX6wFl
+606lbprSTRVjLZWvg3gWaIMlXdcnat9PmHeRk/yzTrHke2aFSkvUKLymnRCHETae
+Rh8ILeQTq36Ul9r7qklBNu4M7/f+jeX7gYPH/yDUCXc
 -> ssh-rsa kFDS0A
-HhilpvIiUps80SXYUXg5vqNmcy8SACvxpC5dTVBU2n+4OVXQY/35Il5ZOrUX3U7a
-arfVp/KaQF7Oncu3x8F6Tp1ibUwmoyAV6OYqqs128nEPwkNbJvwrLY3aEBm+NIzm
-gMlLRjj6EP84TVWgOsenQCS4l957f0QoNVxQ3f+GWdOiZZJFsv//ndsflng8zPlF
-bGZy8c1TxDZfOD0/kW3Nx05c9X0EHKOEoDUc0p4qntrWlflxcvLONCgv1gZuPMF+
-jMsPFP81eu3rkEUxefJ1qbvvGuW0cbzfwiStv7iGQ+Skh/vcoM0qw6p+csNKyHVO
-8nYFcs9kD8067zMnyuqiUHASfZ4rPqTji0iiPC5kZn6N0YSgz2bybkXcoqmy3m6y
-qs0S+RD99o2vCLhW46hZyKAgUyTU1DW42EmnZkPrLoqV7uin8fAwPO/98Q/b3Rkr
-zBRtyTEbooHvOCL8limiRtDl+5LMcjRFNWk8AN+9vHMsYurXPNOCnd8n2Z4MbT2U
-AhpoAD/+8HXp0InBJ/sclITVAc6tPb2CbJW6mrFezH8Ri+/6u+zSF84JDd9ZrCOz
-oIshiGZmhP5mIuspVrxgKlm78a56vQrygpqzvuSSYk3zIJxmhEkZhw09/ga+rhyB
-pkKn7GRyZTfKjwt5nnvW5/bmQndTa13j+7RhkRgBSvU
-> piv-p256 vRzPNw Awpc8paUfKnP6r0bYsaoeDE9GVSnads4/a3jCVScgS4V
-YydKOS09kyZDYN843SHIsYUimtSQKvGhIuycPWOFojc
-> piv-p256 zqq/iw A54xbcufPkLpTD+N47AiIe/xZ/0vA5kDJ4p3rIZw0a4A
-1WFP2K3tfUxtdKDBEmT3cx/u1i5nCzFR7cK4kN3WjC4
-> ssh-ed25519 YFSOsg L0lPSkoPVRKGlJ9MzkJx+cQvnZw/5m/j/JO4aRzd52Q
-o/N7zQkvbGGoadiJSvL6lfuP63uqzxEIxDtIg4tgKIo
-> ssh-ed25519 iHV63A qfLWZhbDisCSJ4vFFTR+XpRUR0WViuAqarf56M0ekT4
-ZSWW34pFRr0M2jFhnphIPJ5ch37ASM6OgTzyHSo0KAs
-> ssh-ed25519 BVsyTA JcFezSIfTF+AP8LYfFqz+wIpUrE0aoc1usiLtWxAPQE
-F9uhFyCPK46kIy+ud4V5/ESacQgc9R0JV+JTEZO6nBI
-> ssh-ed25519 +3V2lQ G4yT1e7B5O2Gy6tusRMxuWOFScynWfFY5AjrJvxMK1o
-n1OVFRqzijWlc+B93cBNdFPz+8CBYOsI5hpF1wz7xr0
--- 61u55uUc7z59iHF1IeyBLmcR6u7STUhpOPb/ODf75Vc
-<$kxpû´ÚH:}ò*ä/Tâ®Ñ$‹ÕbÀJ\F*ðòWîzÉ6 Ý	±Âì<îÌ¹>e?ñ¼<C3B1>Ÿ6ÚµÌ~Ô!
+X1vrBlpHkWOVyhBokgO0yNDQk57S92xADIi88w2UU+nTYFgo/RsyTCCFAFMaDvR3
+kQdtorCowxQpKLnTzER8i2ABZAgAmUzGQuRPDKcqZuZH9oypNkBs6qeVI3TA5GKu
+V/IfKLeR57K3cpZT+TcOzKUqm/AAZO+rwdnrfW9qVAb7vlo3TWawfBHb+Fl7y9JL
+pEjhDMhnA7na67Ktz1MFm80XRneMTW+0NGtcTd1iQfjfHe0WfFuYU4H6aZ8ZpZYw
+2rLa+EmFqUpv0ELwdGViqmjUNwJunsJ6rhJZlMn43v5/XPLpapQr0zwtXzzfzZHd
+HnI6/X97zPYUFDsUeI6x2CiVKHVWMGjJ9VPAexpJepZSkgI6On2/mfs4++XnDWLv
+qsvsJqVzM075eH0LUyXq4WGu7oJc4OdfMm1CrEBKAaqdKRl0HnBZGSER3C/qAhLK
+Ihbk+kti5C7GTzRyUlzkwINVFV0pePClLP7AC5vdKMhXysGQlxNJsTeUTdAOhrAm
+UeWnd0Xp+K8OBsUgyGktKBMofNAJ+MilSKt3x7tJk3QuQIGjqHCshpkMf0ckixrh
+aDN9Rj+s0A8C3hrVv8z602jBrM5tfYOZv+q1/yFQo+ieic6Y9WEzzrTMJEHxFSzX
+KadqfZii8HCGQODcXh8VRpWDVjzt/pDVR/zu/0YCP+0
+-> piv-p256 vRzPNw A4KCXAKoTYy8euaKXot9+c5N21WG9/9uLPomiiI6rZ5W
+vbTcLpDNM1qVdTBCUPMrlX2GpyeMUsKaKLFl5GVVdYY
+-> piv-p256 zqq/iw ArX1s306JaaWVPiTA7XyzyTKcsBDHjeIiSoOg+5PhsBj
+zzmU1T5q5ff6TzIXhWqiVM0Oxxo/ln3uExBXBlLFcME
+-> ssh-ed25519 YFSOsg tgHAr/emB3i+9Hd+q9oYCjkPO+RuXv22kimdXz06Zys
+p8sYz3j5I95ZBJroWxUSzWljcj8E3Ic9uwwyrUWm1+E
+-> ssh-ed25519 iHV63A 9UXBAcuwIfuoTHcWYhLVa9qtJ7UsLsIQsH2Bn0T/Wy8
+OvfX4cOKJYv9pwaQp3yD/QPZdDnGSC6f1qemtKENtpE
+-> ssh-ed25519 BVsyTA nC+YMVK5YyCM79iNijTaBgIZDPi7Bvlunuzl2s9SrRw
+xVUpZwdIcszqsRdZw74fJrSduzxqrO25EMfuypipys0
+-> ssh-ed25519 +3V2lQ 4n/lkQ1nwcXD7mNc3DzIfC5xGF2mn27AoO36Chei8AA
+vDe0RU8Xm3L+/nFM0lKK3jv6hqiUE/YxZUFyHUsqAfI
+--- D4n9aVPWABXpzO9DI20yHf11MRJ5ACWVhT16bDls5pA
+iR	ÅÏÿ%µÙØY^Ï	Ýñý’µ¶{“²°Ý”#®Z0´P6šÿ+ÛÄR!i›J-\ul°9!å¬`Z÷¿Nh²
--- a/secrets/blue-shell-wg-private-key.age
+++ b/secrets/blue-shell-wg-private-key.age
@ -1,43 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 eP5MMw xAObv9OBtCMHWnbnO9b9w5fiG3tkJJTvjFNWmYmGfhQ
-sXmgq1drzY3rap8aD8/iMbMgjGkajfENkBQDdK/2TKQ
-> ssh-ed25519 uYcDNw sxw3K1xYG+OZQy+4U2UfX//ZElPaCieANzFHanJxfxw
-VyhqjYppfHVb2jTceXLL/yYwEJE2uD9TY4PliHu7c0E
+-> ssh-ed25519 eP5MMw 3H1XEr/Vt2TOQUvGu3K54CxbigkVpaC6hofMOfFR60U
+hqFTOoMhyhb/Fsywzu4nYXmEACOunenO/4NwPaVdrZs
+-> ssh-ed25519 uYcDNw raghSMdCaiQrfGviMlc9Pwh8cx33IWh+mnsxL8jgTQM
+aOMrh/746UulH7hkOV6XRiwEszgJtrI33mmzY5S2Ipg
 -> ssh-rsa f5THog
-hRIMIg4P7SOOS3IGr2vF/TAdvgAXjJ8CbjKQt+Bd8MUjxf769rD3bln3lF3DlfIU
-RMkicdnwRdWTnqp+HyV0/UsD4ZzVb0YY+ntK6wujqgEwhpef9NOE2Hsiyvv228l5
-pu6eUTrosmb0ysnw8zRmr4RYdv1+MsD9gbnLOnnuHkA+i28jAE6o4gXIdnKfDcIk
-ptJISTFwyzz+q8UvdfO4YGRBL4zSoWM5VEQS0IPjrt4+qBlOyC2IlXz1/aaGZk41
-ODgPUO68USpzFsLqsmRJJQOMxxkdnYWy4DoeHKUyZI4YO0t94zVEHIS3x6w2l+/Q
-9r7TdKXxniLFYW9t5+28ez5XfLruapXroA8kp2hy3S7ybuOyB2MIfCXVvK0kiOfw
-2kZnv7LvL4BLUMtgPKoAxj8Pzpi8HzFGxQudqNwSkjb4bvFg8eej0oP/WhvFalsY
-MGSdlFJkKKeLWh8MzmD2WXHJ5yVcRFHydyWGMHlZJ4soi0I3gTSQaNSPUxWtFSd3
-Trk3Jz4Qrd7EA6y6wn2Jc4xCX+cWb8Q3nrXVZJL/FSxss+zstQit5O3BwWupJQLt
-ubyqLxQI/PKP/gIU8sGhwKDWGjZUlwvjPBG+EdWJAxoI7S7+4UxkGgsNvx67VKgi
-xxz3ANlHPbGLgAZTtEk5AqHWLWE6ZRn/7i3Qv1HWZJ4
+Hm/2fpGDwqKG9K6zLYXuSDwOppDtDfw665ppaVzRvnNppizkilCohBzCrwXTMyeH
+KKZKqaEt+n35wrurfMfqQf1AkamEimjlXCMmr9IwrBHbJeIJuHn6vGSOssQ0Sq4R
+dr002QrKsGDzlL8dCLmaKU6VPTXcSbCOgDnBW/AyU7bvN51jtgm+jOIey7jH9Bm4
+0nU0UNcPiShgSbXLPp0V6O/1zQBOVeFGyGenblAKlqLILPvc04f4703alqSbKwXF
+q6GoS0Dipzr4N8X4Thzgc8H/YQ6cBVGQTebVGHqFEngLQ2C0yZWlDfJsKnKOGUce
+xSxSskfzEv2s9VHDrXeiTAzSYaLoZI0JEDHOSICmZT2wqT1voFokIQV8twORGpOo
+RAlNX0BULPEg5Mi2k3V4ZBcG5EwUjEcHAg+0cQ82D0f4OJEqMVIa3dse/lBbrFzC
+/Gkr8+LPWVv7f+mRr3sdKtZ1nBwz1uTP5qIA9m92UeLVdVjmp20hixmlgftAbTBm
+MtIH2xqkitpb6bhImGIbnxpg7U8IqQZNfavvOM9yqj0uud/Nh8ruUuwxci4RS7yP
+YlIcompHudeirCLPvYx1T6nYRB2GB1tpTcyQN60pb6YC7lH9w/tLhZf8GFcMdIY8
+eLx7FoWfNj2dIp8EpBrRUEaQlea6Eb1r2DYTjmNunnI
 -> ssh-rsa kFDS0A
-OqNv7KThlRd0aD1gixsI2LVb+Zj2r7OVm4lUD/UJ0WVe/ihlcBAeEj8noqNA3zgH
-djO53WpAkGrbt8CejuQcPYLyw8Bdk++cBu9Po+X0dAp2cCPqakgIpEI6qG1uiEty
-LOOF13TivCB802UrJmX/8HLDV3yv7IWIr2XV0V8s5UvasYlgCt1eg4suhXIngnJG
-wd7WFnXwtNtR/UcnWtpE8c6p5kaAn4wSAtx6hFqnkN5ANjKXHy29NkFR1Lgu55OU
-qoJPpcZpvEESYMQfPvfuCUSZgcSvJE8B1MJZzxdKBHFiaWa7BkkWOL2KNIARFji5
-nBrGzGLV9IaHWsS0UfIWixvM3OPl4wgwpdLtVJsnLX/ggFZrZmj+iR5DdqurfW7E
-0a8Ie1NKK7FU+HnzEk6+8aiDb0QozEhrmaE5olc8dBOKK13e1idDTCsquaQcSOEh
-DBP8r0LhqU7YwnNF6UpQiYs3Zs2HyPegfz2GwB3yeaHqc7+MnXm/j4B5qUcX5naz
-llQoNfddAtoXGeK3G0yjugkSluValw6o2hQ+4iRx4n1f3dVcurXkBr9fjCKMmjC4
-qbOHhsBU4dHCvFIOXY27Xvq5qZ4/ceNb6fq/NXvkD87eePMLg9R9hmtTaCDlEN2d
-a350/FxlWOZXEox+mRZhE+mE5qSIg+LbnFZ+zjWq+yc
-> piv-p256 vRzPNw AzwIBCtS5Tx/zuFHRYsYSOffxAE79O5foV+ndpw0hR1t
-HDmWtvUS9wSnlNjbkD0Rc0jQ4tNhqpcqpeztW1GXC3g
-> piv-p256 zqq/iw Av5ZYxbCJrjUImhX7hoO8nxtWEtd7mPWhofwCxtW5GNI
-tB/mFmw4U2NbeDKdasi/Z99VggQYhnv6+n9+VJekq/k
-> ssh-ed25519 YFSOsg nl0SHBFBylYgoy4qrZ851AQ6NLuDpXtIQ5WffqQPckU
-/yk/gT3enujLcjHkYuE0XGUDrYUEEzvyPvIlKhHtf5c
-> ssh-ed25519 iHV63A 2Gq6dIvLDJQmwgQwxhqrPpubkToiseczLkobeCZiOSA
-IXddfsh84BrA0v6X/SjqoFbUfJfw3v+zD3Dk5RdsfAE
-> ssh-ed25519 BVsyTA 9oRVFqCqPoQ35/u+Cg4dPkG4eXw7vSRaPwhel430TGE
-C54Ofc94lPFMGLljqY4Ag0AhM/MHWeZjZ6x1fmyMmqI
-> ssh-ed25519 +3V2lQ 2g1xRrQZy30nCaDq6RtfXQfUchtD8oOnmGYX+A2venQ
-oop5rNpGKvTUOLGN2HGc7B63H/8XYrhO+XsCjsKfPgA
--- cMgwwO4kfMX17njkjYczc4R6FVRwC+cpK37g2cFAapc
-È
`Ñ<>Xéø¶Ó“¡;êR…Vàâ]tbM"N4×Éa§êš/æI×pšBâ7Qòe‡MÑ
§ºÀnpÊ±£†ç2Å}Éz-R4E<34>‚(éÀN
+SPaIIABa0Wja26CIyeUvrlt+LWJY+Iw2+OouRZkMfi5YxDflb6SATesWh3zMD5+A
+SOiA/oUiRfGRVMmqiEznd2BLyUO7FQDv8tIT38R3m8Nj2Lb/kWtuhPKqrk0PPvr+
+kYR3iyM4klqccCzwOYwWfpO4ZkFACBApTOFYbU4WX50WDRQRco7M8funj10BAIsL
+H7hOKtigx2RJaJDcU3MPHV4beECpKbeH9scICEDmi098UP3850g1lN5AR7NjWvLi
+zr3Z8Up4UjEwH2mvuNnAbvA+0HOu5geIae+VUqy3EN7XFC5HnMHB6eK12Q1VAmF5
+MbgkppMeoqLnxIdLT9xxRNhD50B3QR8MNHgaNWuBqfl86XPfXjxYP5kRaCAraego
+nbE1gItlgIPESpf0ocfIEyXb0tSup8c+99ezgxBMrzNP6UtVGRhZvwLTpBZmrLoc
+5P/hTr0WQE7d/6lmY9VyDsXasPU758tUhM/cJxmmUyZcCOhjAiJdWSYHe7AUjSQy
+rUSKUSYwqM/epFNqdnanj4pmmRkSk/0AiEKikvb5DvWpHrnsL/EuQqtT382IGv6P
+VA6ORv3BmL8IjNnTppZsG8k91WWHLEqxoDKUHg6WHfJ5XqnEM4maFsRZs53QLqLB
+vjAxAeJHjFg13wkfJmo9mZNbw/0WXS/K+xmeOTYuH/8
+-> piv-p256 vRzPNw AwPYD0NiFDZ3/0L0+BEUS0hm7RddL3sPXUshz7XtIQVi
+7rzoQuAQQHxkuYFx5TrLEXZbGsERg78mAXcgQySwHGw
+-> piv-p256 zqq/iw A0Ec624/7FOTPVAbZDjhsBy0i5L1Tw9LwYfH/7DeKHi9
+djfKQINL2LVAAueovp/V1IGyhuy5LGQtOws5Dtih9sw
+-> ssh-ed25519 YFSOsg 6EeEfNtlQ7/a5Rc5iShfSa2ZjIoN6QcLDI0hJgpF8AY
+Tcp4iqFjBTTzSUAZrxRWe8QkvuEoPWVagNL4EiZLMIA
+-> ssh-ed25519 iHV63A P8IDXAspyflmLqtPOqPWE+J9s9e3OccKc5+8s/Wi9H8
+iRZba5723Ux5oo8YA2TDyiaWyGzHlAcvEiD7I99vq4o
+-> ssh-ed25519 BVsyTA LB7gg2/eozH+f9BNC4Q1m6Pl7b6znkO5rPVgvKSjen4
+AjNzM/44dMy7JyUcAT7c4pAFTtOuapiGtiqLdBPGrKA
+-> ssh-ed25519 +3V2lQ NHbovTrC4cTSsqb3AfmVOJ/pL0QQbK9GpMUpQMAW7w8
+iwAoDSQnucAzQPOgZZtl2bnJQ1mU19aoruItkQqJuZ8
+--- itqKtiBSCvkVJ5boq7PeY3uRMemElImzWvSeTwbz3y4
+×ZP38†¶0¿Òe¯8W’j–Ž÷[ªø#;ñHjÀëÏwïYÂœp¨µ“6W`ôhŒ²ªs§õvbÈ·èÓWu·ÔœxZ5f5½ 
--- a/secrets/coturn-static-auth-secret.age
+++ b/secrets/coturn-static-auth-secret.age
@ -1,44 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 iDKjwg ZUEOvf7JnWeFNohEAhloJ0+YL2SwHujjm2YG85NLHyU
-HwrrqLMlNmfSlZVt/lCkIwqmCYLARbDOBhIm+AYmDEM
-> ssh-ed25519 uYcDNw Lrek6ru/vb2JIZyALem40oNZCf3ia/U6sb5hRyDaakA
-N34LLq2+qJOlbyaYXUtNP17fDPjF+evgZ6kOs7mVhYI
+-> ssh-ed25519 iDKjwg vLO2012STCeqJACpBNg5uKyWx/u0Yfvwxek3S+0Q1C4
+6vPjunf0CQeWTwznZXPc5iVL/eiF7SrPqGeuvgcfizM
+-> ssh-ed25519 uYcDNw QwGWHxl6dTO1HEfw7pEtdvb2ne0RiNMb8SkWRIrRJQg
+ffdyTEltr6wlrnA9isU17orFvSRmicPvX+w2t0QBJIY
 -> ssh-rsa f5THog
-jmwJ+hV1/50cWemVUhPTkTFgnd7iJ0YLtjU4fEKXghWIlie/OR3AK++1f2UJxKT4
-Z/32ALRBnmb7FlAPyYbxIns3IUJP+Z/Il5SCeDrtwaUxmtluwXwwO07WlztqZJlO
-bvZ0ifDazxOFZO6QfXQE2SaPDOqcH2AAiiL50eXMgbdY5lARYW2Qbai/2a4t/PuT
-Qn8WAwjyXOIdOnaYb/MZWyp0GQYsa3nEhYyOWvTSjSROEfR5qBtGNYkUBBTYF+YO
-DGOYStbPSkIhnYYQmNajlcy9wMW5fH36ujGdnMH7C6DgcSCY2iTDTdE3cyCxAuaJ
-bRThKyXYsvhMKgrFzbhlgt68taESb4KcKcNO5r7lqqID/I0b/fVltsKpkXrSCB53
-Th/aXLXPUrYEkbdP6nqDBbUjeA8RDid1raIF1O29Ok72oU48q50QXqP8GF+honkg
-HSdXmhPtlZyArlJNWogDaU9FkWp81E0JS8G0OnoNilCmiu7sF717GG4pkA6GTnaB
-hlJSiVWBPhmhVURIOKkRl5bIWLUvJESPLVVog/vsW7OJETOb2u+AlwvaBNY8w1wE
-An+m/qNO/H9Nksw0B4C9nLfasE/nDvbOT/Igc7k6jP0sw6/PAWnosJY5vDyIpR8k
-7q3rBPnsZRXUr213ue8xs0G7SsbLheYNu3/D4YdB1tg
+XjKRMzLPZlrTQEDJzgCwBbjZwIy6fMYGLuBR8TS15SAIbttLoikF/AV5zqJDaE9j
+RaRJIIQV6LYCm1fHOsoua0XGxicvJkdithrDC4zsEEJ5n2luNj+sQd7h9ruOdkO5
+l+Og+MphPM9naul+MJ/DluzS863DewkCNENEWe5H5MkHujOoqEsRsGdrRPXUbAPW
+oNIr6h7FHCTFTkxfj1aAqDHdK8R4Yqo2K0vnHHfNS3PeN+CQJOrGNzokYybMRxqK
+RXoJD0QKAUCV8cdXGr0XuS/ljv0lFODKhupy5ObYU71052nxo8j7KTq2NpZXqjul
+PWyetcPtH5nLCs2L31XoBk7cEE8g/eSjPky3gSMdjGjdB7qskmuPcAHlHEwQzecG
+D6J1LjrPa8OMVD4AdR0KAXSnSvzt/RhyymiZWtBeKg52rm4KK3PVbJqq05m+PEYA
+a8wFT6fJOqmNr4gj4peIUHca0gYWhfzhLpXsj4/MKTPxzdUem/wbbMJrM7oQpwma
+svN0vvqCUc2wfw2Apr3WwoAnNTIohZOngNkKNWNweXtPOee2qgZO3ko2wpFa+Yh+
+IMonHHVhtdchTidx4RttgDIaW/+i//XGfqPdmanO5wUmm+SwgqkkQkRHzmtbmgsq
+KlrAmjL5biH9f9sBItYMdKafgyQppMAQ3hXt5wgAgj8
 -> ssh-rsa kFDS0A
-BwaozSAR0Lcn3ZOHhC/OuOYRZqW0ayV4kL7CSLgaw6x9WqA7NLcsE+HDr7aDx/lP
-K7TmFGYMrOiIk3siZ4Qc/JwZXPiayxGITcwoY82L+FrJKJmQd6c/3exggsHlc7B9
-1ijXoQgjnorlopI70Cyt3QLQyMCPFb7tuZFEKR0NqBzcFTi5fKVYcMrfa1WVxzMO
-0Ic+mhwMIAst6SQqOkqaVbtUYxATupQx+9FwThk+9NDety1vacb+lQ7hvCnImpTd
-uENry/G68I7zWhNuCeE6wj8lCplFkW7dvrJyoxUVokWheFnUKjziA3ZybfMyAmI9
-vJZnTvTc/7UxJCnuk/pB89q3ttm8LFT6AFAwZ1PY2ndWBMRlnOaB0JXSBKXZCYYV
-bmJ/NSNdzyO9Q4MrKwYO+O8SOkVWM9EqKYv+FMO5CksU/N9EOUkpZeLpMYh1WXPX
-BMKmXzRWp3YEsFH0g74ZBjFpTo+FK0bbRfYfTj7wtS9LpOFPr51qRDwv0zocM9cQ
-MkpNtuSqpXboCLGytJE34pAsDY1BHJpdAOwlwavwK8N/yxlF89ktIAtHpOaV5QNF
-r8oW2DLERj/s2yunrjZ5kQXaxbn2GBeml5gFyYWPnKVIa5x0PA6LgT2OMYd2x4vA
-r7UGlMktJLosJGjJEUVLUHXarKkTz8Xwrw4vtaaLIyc
-> piv-p256 vRzPNw ApWXG3ayudUSrW8zw38cU6hYVeCVZhIQm/ZbjKpZqgnb
-NqaQ7bjTAuMei08uNpVaK23uVmspjlkGyleF8phudVM
-> piv-p256 zqq/iw AxdOZ9zfYgKZJY9HhQokUHwSKbfKl7i7X+FPO30EADcr
-qsniaELyEVrTeSaJG/lp3sCPCmbTUA7CWdMxA9tsBXc
-> ssh-ed25519 YFSOsg 64fhQVd3dvwHCBXa0QiK6E8rYA1jScm0UiBvJVuL6Eo
-YAvXqNw6kQkTzBpDIboqa9gOoTgHE8hcaIMTg6UkODs
-> ssh-ed25519 iHV63A BlO/mSeyxTFBIa77g0Ce2CcaVf9SAiw9/OzkgnaHEV0
-sjmnXCpwe5KTgIJ1ZaM8j1U4fYi2Y5/WpwpUfAe8Dbk
-> ssh-ed25519 BVsyTA gt6iV6mhL2G957w7IbJVzNFV8QMHOzP5uOkgSp5QgzM
-Vvz1jjLKA9qbqAE1g0UyHySrrnG16ENdz9TxwyoML+g
-> ssh-ed25519 +3V2lQ g453jshh1sgCdUyhg3jlU0A0X+byL5jobpu2toWTYRU
-S2k6Nk+UBv8gcJZoIdZUc2Kd+Rv4jzzcEyGm+eb+KUg
--- 8ahetWGfwjnJYRnkeSS15sLjDBBtN28biMlYCPSvObQ
-i’cü'ióë4Aî6$}ß!IÚ3ó¨ÍÄ™	Ù›3yŒ<79>ç¶;¶ƒ
-O<EFBFBD>.<2E>œ[„Íf%jTà4ŸG¶÷ãÙ¸W#iÐzuä`'Á*zmû‡òèE‡6ÓØ¶Ñúéª[ê€
+XAY8GSsx8B5q039L14C/t4cGK2sAm9eqO33r//YgpI5nkvw+pZrbJegdCItfHXHd
+9BwBGOowTe5Qmj6RVfz4rwsj57HJbt6ivoIrU3vH+GLsNs4JIg5lwz1/WCsotw6W
+8jQXiiZbA4nvzQzyZjJVKavTCfvbRXdzc+CUZiWgQDXsSFejp3ODeOvUds8YKWiz
+jYILyzUzyAf05HDC2SIUhfA/UoXokfpo6uZuryWXjRBgaRENa9csDnktc8V+61W7
+gUnu6yt/rN6oiBesnUZQK4sPd5YE6EcOT2gtLp1qKxtRuF9TEX25oLHi52kPBu8j
+TNGbCU2ImGW3Z6TkAj+/XQzwEIrbLgb7APMkI3DtWyIIxZn5QJdDOOCseKMKt2Lu
+VH1RF9C26mqcx7+WGCJKylARX8sbT1/ZsCWSUnmenYuGNQQppMwcQGSICs0YmFkH
+XnV19+pt93i5rVFs9IUxFCqFKKjElCiPgIHe0QlGuxifeiMXYuNi8g4ObN5X6GEL
+MPm0+sr19dheOZicyxqJ/jSlEOP8bHgN/VDHjKtsMWQD9r3NfLH7btNjA8HTITDI
+YvLLVCP6OR3ZlMz2HUXDpbaPYSSZvrEtwkqCIe3ij6066Y5cTsYHWEwOvXaKYh9P
+OJtPgLQDV9VfU9hK60E+C5qGQAvHhBgPUfXS8JMJkyw
+-> piv-p256 vRzPNw A2vUnNzWtQNNOU//b3muMZeM1qdO3GyREn73VgdxMX4Q
+6AzSUdoPB4zMbFsf0fr6sxbCsg+5/qmBtkCo3ry88Gc
+-> piv-p256 zqq/iw AwVuYkScYFB1OzvBz9255ebDwPO4o8szD79gPnzgK/t9
+UCm3jzlAPdfGvxO2VrE2DBvcGlaJpMTINJl2qcq+4oA
+-> ssh-ed25519 YFSOsg wUzSRyoZOde45Uv+KaN/ARAxIRt1bPAqN30P6nM9b1o
+pmufkyRBD4BoL4a+dbS321KSdjPRrB09MssNU6N0dtE
+-> ssh-ed25519 iHV63A qyqt+LHR4YGE+P2D2mq7qOS959vLZ9K2yalLvGg3riw
+1oDuGVg7Jn+8MIlsHb8KCDImManVGnlIMoqFt9w9Wjg
+-> ssh-ed25519 BVsyTA skF/Np1FrFUSWJgCw5PN9uSy+bMezPHV7lH4jm67TCc
+QrtBW86S8cB6GLsw6LVGK5jhFQS56MvATcPspGJwmAE
+-> ssh-ed25519 +3V2lQ DPCBFzgin6QTJx0QZ0+52qW+6xXmGA4M+hFEIFAvpC4
+QuuoukU5PC4BW2ieS52rkGcPRPuvrROE37gZpd7cudw
+--- fVPm/8JI93qQmr6bEdb8JEtRpKtsBHnK88A1tptYLIs
+|9Á:\Ù›ŒèHÐ(„–•a-[çf„-Bpýu[€,¤bz¿ö'jA¸áyp`4üð“ï<E2809C>lÆ•|—Nj‹3ç
;”˜¾¾)“±ëGÈ¾b÷ÿ¦&ÓWãF/ý‹‚±yõ¹
--- a/secrets/delite-wg-private-key.age
+++ b/secrets/delite-wg-private-key.age
--- a/secrets/drone-db-secrets.age
+++ b/secrets/drone-db-secrets.age
@ -1,43 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 Y0ZZaw 5slOxDM4xGALMpYxFm1WBX4Sds7itgPBMIiY97d7Egk
-mZNzn4I6obUHAdox6eVR4H82EZagZ1IrCcq0CDtK44Y
-> ssh-ed25519 uYcDNw w5lzhmA8wIMXihKF25d5jx4/Cc5BFE3Lw6ad60b0wBg
-v9z03cpts6oVlcTQ48hMw8rjWHp1JUOov2qCUjFN4bs
-> ssh-rsa f5THog
-A93Usdjf6yJFLFqDiy6UUIJ4faBgQXIvk0pZlABlj9M5n7fSf9uzR6sSih4HNCvm
-sMkZ4wKyQHJnUB4Uc2jGrdcWqpmP5MLYHhj74Rxsi6heZuCRf94KH7sE/03A958w
-jAV4v9z4EqmkvWLNQi/hxMVMs5A61Vs63WIX/TA6vhL8Yrn0FeIKlRZYUVIeMu42
-pbEuLWeIzbUioAuEA1ZKV5VDx+6ack8TS/Dj5bTNEnzFWpjnHjO0/GeQU+aaQZTe
-Zy325TcRosT0V7PIh0tDQZKKRpOH/e9LnDkd8NIjyfEsGdDYaP1EVOYVxPCqUDAh
-A0kV1kkTiBzaXDkuakc+HDCIxtYXLWthsmbD+vI3D7FlTl0CY4fOP0wwO/0rS5Yp
-KDuxjz89II1H4+ZvlcPUihyW7OEj4d+NwFQy+7Qq0Y9Ii0NONXNsnx17FKXJwOMo
-NKyLo097FvHV7k8F9wv9mmZboRulDAoRyDngeO0+SJA90uJass04DuiZvK+g3Hry
-xVzbkk59j9EQqUogopW/oSeSbUP0pvcKOahGcSIW8vmadDTgnN7zzqf3fq+dJ2TM
-QD2IXAwvoTFBE+9DnPOtptk1X1D2umZuAWTzGAseXOImrPFZ+bEr5MV3qLGlg7sL
-yA7Mvbp4diVdH5aePzeBefhxrYphz+yfCbELFTYam9g
-> ssh-rsa kFDS0A
-Ng0FhTDjASWJkrlNh+UZxU/dU/wfmoV1/fwTv6Xg69k/2qU9lk0oR6e5xAimvX6u
-h7rKAYt3zSRIFveGczPCflC1nycG9wLSpaoJghav+q+muoDQ/fbSKSgHFXITC7Me
-f/wblyWvJsUQbjxSW3g6/8EGz6FvpTnycPtD2vbRj+Ctq72GPA2ZWg/OC4jAUlDs
-r6X0Ql2jwWzy3Y12v0mPknlBezN8cIfjBmoNOWokUeGJIBjujlS7loA1yif09BLg
-PTSLCY1YH3QYcm6lCXK0HaNcMjSSk/ZK9D0wROriF9PBbkpWgg5NlIrqGaeqPN9z
-QwRR2DvhuCa1br57F36Y2LKGphYjmhWAtzCyQ0h9YQ+AzEy9uFCbK0IFyyeVl/fN
-+HBGgxacJBcEGsNV3mbJvh6dn1348eex0GgaQEf1B/lu/y66WHbmSqVyUDfWkqEz
-IytAC43VT2rKgg+B5u0d/JhLDLwXTp7iVDy52ul1n7keJHk8t1GDaufAXbWqalQ4
-vuyxs6ghSIXUi27IZrYblg/OEPFTBfcoMXkmCgyx5a+eK+DhnBazWjy5j+vgp2so
-ZQRQurbG02qpZasTwBM3iy4ZklX/uFjsKnk0c/YcmK4YcMviHcQQjdjKruEE93u+
-Za1KE+qZGLkhFCd9O3ZPMtEjRjpN10XIs5ylKQ9MKU4
-> piv-p256 vRzPNw AiNjNIR0OGHBu5Qn+bvn+Lk5VnpI2BQ3eJ3+2/FTJfZC
-elT3acRVdmtBl0qC5YbvfntxkJrsZwEJqlF6aN5hhWw
-> piv-p256 zqq/iw AjIzSibkqG+YcP894QekM61Wsty6MaKBghlWapHfU0Jn
-HyXBp8DxtnNsfuzZq13bwgma5CzLTf3UB5Eht6XUwe8
-> ssh-ed25519 YFSOsg WRBQZZYM+X26hfoH4zvNWQulZvVWP/Ha5OgkUmGK/Q4
-5Hw4ZDNawn5YRC673Op/sbpexOKeL3gez2B7oZxUKhA
-> ssh-ed25519 iHV63A wyr8R4DlqLAu0XypddVoFimK2ZMncWaa+KWV7vMEQm8
-puV3g1t5AbnEgC0S1U4ft1evB7KuNppEi1g/AtxHgWE
-> ssh-ed25519 BVsyTA 0N3iyyGqTCRAHHcK7QfN5xRttorc2E2GL0RDTIVIBU4
-Bph0OujqmXzi9IswduX9Mbh+yRdPKOwCf3fBv2zUzqI
-> ssh-ed25519 +3V2lQ 0p90VtsxWyGFaeeoTISIxQRyeKVk0HoGGq71tjpIPjg
-sRf73Tp3BJ0DsTnJO2xVGyCKjaX7C7oydXj+39dKMUg
--- +/HCG0s/x+c03NG5qrgliJ+5EXXI6UnuJz5XDv2aphY
-ÞšÂ<>™Ý@»=£L¬“7*®„ÐFq<46>UÒ*ûUê¿‰»È$e=þLgJ|*1Ï½BÚE ZG—_Ü5ê²ð—²ŽíÂ,òöÛi<C39B>_'¸d7
Ý3Ú“Nä3ãç¡*»ðªê<C2AA>£ŽáŽòqýŸ‰Oy#¶([l³†pÄf¼õ¾¥ö
--- a/secrets/drone-secrets.age
+++ b/secrets/drone-secrets.age
--- a/secrets/flora6-wg-private-key.age
+++ b/secrets/flora6-wg-private-key.age
--- a/secrets/forgejo-actions-runner-token.age
+++ b/secrets/forgejo-actions-runner-token.age
@ -1,43 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 Y0ZZaw tm4AmC8yXPgR82lgsQR4VZn4xfGiK8o6fIn8pKPY6XQ
-IDnsYVD8noh2HdPNvjY/M5G+meR5rwvVI5SVN/cHEVM
-> ssh-ed25519 uYcDNw ZB7GyOvD8S8XLqE1AeMXWTPcJnvEntWbZ7TGg8CJVxc
-Bfb/+P2DEiKI9ZWH105rLAYQXTUwWftWtudUGnVtjSU
-> ssh-rsa f5THog
-Q3Hqks6BMGmP8TXnUkbblO8btrVdls7AUdxDW8e/w5biis/4awZVBHuZCLpiasM7
-7RWXcUep2VVyfCMb+8tedaf5a1MpGPDkZvdbxhfDVWZakh7vsEnth+gK2QsV0h8e
-eIgfDMA9J6DHXNCr4EYSf22PxY12KPqGqsMpVBhOZQuXoJwJy0ob3jbJEOYfPlu6
-V+TLYQNGQ2UQ+A7zjpUrGz1L+u7rUejY4Rv1BmCakg1bLEs8oSDmIVmsuVmFPqOI
-wqQJvnYlRAdioVQZwYCiqJech2QJ0ZhtC/ZeVp4c6TgFwB1ottxiAI8l7Bz1nFzW
-/E85qU3Jkh1tcNcLsVHj8+tnxwn1SSQ3xQxcOT9l1Po98sNapK7mwd/xx3pJ1hH8
-5YUQAtG80e5YmOBxkabVI4s612wACfK9JrIdL+uyIIzGeNHgoimjx7GuOCQ2ut6L
-gj/+Rcv3e0ERkNaXTXGkcdrsMTt45lGmyxUgxz6lbHgtqq+r+BHogiQ9cdPKwXuK
-wom4AvaMOBKCxtB4qVsuNHRd0I8OaA9Ab9SUvHCRvzCkJRHP4qc0zRJif7Rk4qRl
-rAGYwVxq3DRk2HHCQCYC26VqLU6B5LuAAqOipVhOeTfbgaSGD6Wfrt+XBBPmWB7o
-i9zDrk5GKehsPeDKgjh9uVd1y+IBHcWoYBxR5WPTYnA
-> ssh-rsa kFDS0A
-HS3y8/5wAej0jv0sQqhdGwWd79vUwkrLkoKKPmqo9HlJaO70Cr1bnAIdyA8PBphs
-NIRjIcdClbUBuelZudzuhHuEzH8/JMAVwgHoIiUxviEIr6JpJVBagtvSHp1nfDdn
-x/hkpt2isSYb6fVzYgewqkdD3tv9XEm/WR2JmzlfaNTV9N9x/HNJYy5iYoTWRxKr
-e8R7txdmgRaDDxpbkJdWBcoV9HVgytTMtvBkqGViWzaFDopb9nDlfN/C7/BkCp6H
-9b65JqznpIChoJV7+sK5SEw8VcFj7ikIHzREWscEn8XBb7Kth2iVukaEPM+BgGZz
-Irk0IdkSb/XmQFwsOLnQViwUjkFXGXwHyMdHIcU2qEzZ4PN0PgEengILt9vqWJs0
-qHxrA7sKiC1D8S0i1+Dn+DiI//1s5Bbmp1jk626tH6fNKqSOlpwM47IGArTxCAFd
-NMinIBnR47DUCXWheirsWF6yP7kwX7vOW1dR4UVJJnVPKkgjklwCZvJiNAo0Soo+
-95zuugaeobsJ+qz2Pv+l8BGYriOFpRIAu7YTy9yY7mqHwC5MoeY0G8eNg5UmEzFz
-JsEbKPsZcsMg4WdywzLU2aufK4M/Cd7lVPGZzuZ8hJHBF/EvTFov7L/HK5VnhZar
-CYtILdyiVvmMZ7dhEARG1GG988W9wMendikmKpM4dTA
-> piv-p256 vRzPNw AuCJRxHGmvv25VTHpnbfMLyLIj8K+daFD97wwHvFAqHl
-m4lPR+5h3+xmdL0OBfmNoxSM/O5Ca+2lVRLwITUtVmQ
-> piv-p256 zqq/iw ApNbp/6seWw6gCj/QWKLYlmuHaqdaSKVI+Hup1fKAO2O
-xpNXgDXMVFe15eS+L9lGaI0Ip2F13SuhjCTQLDtBIr0
-> ssh-ed25519 YFSOsg v9BtvUZh5HIvN7nsnErVrHbWTwRhWpj/SlHoiiJSIR0
-ol9z9juHfOCuZsSpuRl/zGFuJg5RzpKK1YnX+VDLDTA
-> ssh-ed25519 iHV63A yfa9P22C7+wCMqtRRSyiOhcFnLWPI50jMWxWpLarMT8
-VpU+Uv/20JJGkTWTATiF5JImMsDKwyHMj+Wp0mMC/MQ
-> ssh-ed25519 BVsyTA dUj/mHSyOm61h2ETa4tSX7Cyf+KRN8AMXCVKwMbJTE0
-E1EEPqVQSqlxSAi7DaMlaS1Az1D5XsasrPrIdwylSAE
-> ssh-ed25519 +3V2lQ AWBlXeuJq76UgQR0xQVPMN0NUq/mqa2iDlIDBBp/Wjo
-XiliN4FB5YQ7qmTyV3AIbvoCY8UoGS6Vi5LpVWrH9kg
--- V4Tp84/WJUM+/l+eEjlypE4Lx47BtkGFpEnNIdIB35E
-ô¡qzîL¡çzYNŽv×0[¿AöKN<ÛÀ<C39B>ö¦÷:,D<>¢S¹:!$`Õw©^‡àŽhi†O'(ž7!=ÿC(ÿï>´ûDÐ¾ÙFÐ=J
--- a/secrets/forgejo-database-password.age
+++ b/secrets/forgejo-database-password.age
--- a/secrets/forgejo-mailer-password.age
+++ b/secrets/forgejo-mailer-password.age
@ -1,43 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 iDKjwg t2wVQkkmL35JIXb3x9xxWmRECF7yet7c4+EdoFhCaAs
-GJxaYARfYJdNDq6Ay81r4+TsTAMmPd7AxZMTq/GzuIY
-> ssh-ed25519 uYcDNw LeXqaLu9EylzTOle7lma4la5S3NDPjALTybvV2ppd3c
-JCdLMyK1c+Sldqla8dVUDK28Zl+nLXnsh/MXQ4d/yJw
+-> ssh-ed25519 iDKjwg vmr542fc5ndYRiW5ukHanhTMBV4TgSduloYjuWwmpw8
+ACSBzerGx8Rd17zNfgO3qSqwBuQio9oyYaa5ypUbBxk
+-> ssh-ed25519 uYcDNw fjP84i8BsNOfBoVDpH25MBC6D3xPXwbbO9ghLKr+mE4
+TRKHWqVvzLP/AOJ5SJ5qeKj6UdYp2+tsxO/GVRy+qt0
 -> ssh-rsa f5THog
-ePz4dSiyFwtX5HmwF7/vyXKAwH52aVfjwQcyovl8r9srFt2o19MLkMvPM+CVXXo+
-v0Dc6dNdfp6Oyn4rNvGMNtsL7Zb4B32OVck/uGn4pI9aC3wsOvr1JvetolaepATG
-vnxB+TYjM/S/iYpxaKbrhKBOM466dUygI4bS/GPT749+R9610mZ+jle1yylyvRTM
-WiTJaNbOEKOnwPPgZdBbZEcisbz5BFJhVHBxxd/1DXZPRBeg9Xn7514IwbtRgRS2
-x6gzSDFZBcpvXQ/g86JveORI9eoS97w1Fgv1bJnwhoZ3yebDThPnP0xU6I64nCwJ
-H0W+Rrutq4UgMkYghElCoFyunPz73M7PArzW44PPCOeGUrVDsqbTgf9YD5s3HDsc
-TZqrcgzY6/cLzulgM2Is5b4ZEecWLNGoe84sjHR5OXneGf9BXcB5GpgWIC//ZFym
-Sr/UOlfI0YtZpY5ph/10uWqi838idwMTjOZGuope5T5m8+rsbxlwAKRf2E31nx5e
-rjW4hdV4tm2yZm+E75FEIo1yhu4JKm+MCv8ri8217c2Ex/qqDQ5pi/meOrjKGFgc
-7FKkg2h6ir1rh0bMYTpZAelpKVicTQpY4HyphiFuk5cCt6cXiEMiwRBm3QrwmSvl
-KcmXweuoYiunkb5q2GG6sE0d3yZluG7g5mPWE7WFngM
+IMiwRGW5B09oJDDJamyQBOwtFu+KhxUQQ1w0RJEnpITZZzyfHOuhAuwsjLy+us9v
+znzSA7bo1YusdFjzfW4RZeueuW8vvWdsv9Cjadlg6Bb2uP7sWeh7qH+IoyB2Z9Kt
+fZ0O6O+65pOybsCKZ9cUuZ+E9E5nG2KRjzdV+csEKAshGLqeo2RILKZB8oSx9tZr
+sjPXRFLchj/6zbY1yBs+q0+qC7ldUBdJLDtl5Yj6hzB4fk1JuPTSDWtKSHBYDz60
+Ri3CO1Z0z+8/IJWZqaa0a7jCYH6v4ZzboGrdE7MJq6Tyorl26bitSSevXHJmCrJq
+ZpcpZfs/kVFu05ftaVul6vyPM09QOIQx+ia9tIKmCgWNcrM5mSy63C9klutXOW6j
+GZ60YUnOvVDz+i0wmaZvMs3C4THhdtOsln/dVrqOKFKf704mAsO4cSEwqNyoXy7n
+/WbxDQcTU62pKEkwlU//CjuA0rHwmX8m/tweNuokh8fPJ6SLE9dLqxPzmeq9JX7q
+RNO+eZZ2NnjpkrI46stVS3p3FUHPbk9mhIiyfr4LgSBCoNWv1TkLS8DOqWOeNKfy
+8wLAjgvpNIk8Vgbhoe4/G8wB5Qvr0vfGmdjzA5miu28YZ8PXHN6DlkaT9T0iROuZ
+HM8j2FND2EYLB/Je19ctYNDjCmEYFhsvH/H448QMODw
 -> ssh-rsa kFDS0A
-jvdXdLAU/L/dD6bmuXIXEaZIGAEOFTujxuVy7oFHSeAZk4AyT2ZBLfuDa1KI3iSR
-19hImXIZyaQJh5RSTkEHpwdsxexbzcQV8y77XdF2neNj6OYjMfpP8a5foGcu9Rnd
-/DRSkRNumkTfpet/gSiRIPz0Sj++HA8/X3GwRlwqPKE12As06ebL76003NX/u7ep
-6jJR/sOlLJV2VtqU1tvgQ5VV7KIyMTlP2a38MDCtOHTVmK8inVNqL28H0ptYJ1IZ
-KId96pKqR0v+h/qhHHQoYBJxCBUHc3Rp8eZdssLpLfRHGLQ1ccpV7KUr4ihKFh+9
-wu5/YD9qrQls1EjXi1mj/kCvT2FplUJEZqgBBRY1/mHjpWmx999E5QijjhWchBL/
-PgF0oF25MABESrm/edvThwp7MVTA8ZSY8xj40D9bfsBGrpVBlf5hKsSulpiaMQGK
-6ScH4sRFXDhwC7j8OOMZWcqNvEc3KjgjJwl+qFTXDdBe+zd5sF+orjORjIge1z3c
-v2wngm6vTX4GobrtqiC2ZmolWbRxz7a4IwWNPrmEql8Bnmf1bfRy4X5/EOuIy1zN
-s/3Qu0KjjVBikU60RyXAdRI2M+aCKSKushp7bThT2j+VJTGIsmEbG190VjChTkmb
-meF98Mt2uJoJjzCYdyaGCQRWAr/f8ER0GZgLXS4Apt8
-> piv-p256 vRzPNw Am/95gSJXOtEBedzoMQBFwWC4E30vZcMINW5JjeM7ot4
-TzGZSlKt50OxQryrIQHSqMj+dnIDV5+adfohG9heDTs
-> piv-p256 zqq/iw A5R9tfUoQmodbn9rt0M0x3lnJUMz02u66HR4+RTIcU6/
-D9JRgjM280CDu/ds6j4lequ3VGEwz2aEYf6Pu4e8Hf8
-> ssh-ed25519 YFSOsg 8YXBlEpaC0Vkewf7awp/RuHxaV92jp8Lnf391jd8UDc
-9bzGios7kSFpAKJbmjupcpf7/BCn6XwQMDfh1uRb1qs
-> ssh-ed25519 iHV63A 2WrmaliPbgh0rJLJJkgy1sUI4S0H07PwZ9oJNk5R+z4
-SdjvYKOlZLClUKs+KUQ2ek4X7amZn56Fcfo0TnAeTO4
-> ssh-ed25519 BVsyTA +RlXlmh3g6GLA7W26NmDEd4fRSVrJ8lzY1ZZ8OuuT2U
-+quL6DjgTibaE878QG9w281ArQ/9LS5467Nfm5TiADg
-> ssh-ed25519 +3V2lQ 4B1XgSPLOVjzzNlxNYmLeIxABUnXcvETOOWlaXnmgRU
-bgdGjPihq6SnGVWsntPhajgy4sLD8c6VWSYeSlllUx4
--- LEtvqKl5+C4uRIigcNFI3hVXkxov9Wt1CasYuMvEpvU
-¦V †ãCC{ËË©u%ŒÒr¤37ÓSG6	¤(Eëê1¡ çì–àmP©Fwï¸
+nSuC6Kgnp3+r41SXWEqIkryUlhWQTl5Qr0muXhnsBmuN+2iVBGYFqxqJSDpdnvbM
+SIIy5c5rLfGSNRejRebgvyCntEvrOiGtmgubpURMEaXwJiEI+Hqfju1V8yi2RUto
+KTR/YhYv0i50pLMV4JD7MWPga/zeYUVhE8eISUNFbiJS+ve3BP/3Tg2E9tUvTsCG
+j7MxM4Td1jH2jCa7ueYOJ0R/qr0BKIEOGP4e+7YCByujYWKTV1JHOZehzIYA5wFs
+Bqq7GZnTTiP5n/kh7CgNyWORdBW4gaBslyhjAJI3hCbBvZer547K4moP6aPKog32
+yTZQVVu/kZzCIgA/4TzWr/g11fKD0dUnPCmXbctQVgeOtYAbnWJBFwMmXvQdRU2P
+jt5Ce0WqwhExaE8fAx7v3AYXhYgAOBem4uIe34PAuj672Tc1U61hztSCynE2cXI/
+2ZyCoWZZC/4fjUTFXC8urATfjgGV5PrhRcU4JtnQwytjd0Ru4pm56zZCpzmHxWMi
+bbyVSF5NisCvjF5rxyS4XXNfg52fkV01gJsJ48B9dnSs5HYTBaWQWJ00sO5ssGRm
+9H+T/Bsi42X6lnlt8ybzYD7aDIJbfz56vHf18/tfRhOzYbIBE7Rnkvs0vsNwT05K
+OGOb3iLFtxGGIpSC5Ba1T8h1TuEAawhmrHkF/Lfdr8g
+-> piv-p256 vRzPNw AquhJELiSYcW1KeKiied88TcDZYgtjdZm46FlV7CRsmt
+ikxq4EIkI3UXqjns1QJdAe0N3mEh7sbzYPu9H0IvmCA
+-> piv-p256 zqq/iw A94RUts75asVyQG7IZSfg7mDgcWI/hruOfRqD8Pdn4Ff
+17kI8IKl98f5lMqdcvqpTO8EN7pr9HP0SJJxFlIMcrw
+-> ssh-ed25519 YFSOsg gvcjFcWsCaBjYXvab/eyIhDhfw2bjc3u+nOenGiebTc
+hi30KYU9aYxWG/ZWFZQ4qW/P+hi+ms3140/9BTYNo7k
+-> ssh-ed25519 iHV63A RVCt2pceoQfdaBWd5qXcT0x/0dQgLP3jKpa6xeDdnyY
+Q1arCu2nmcl3Qt/uqV6UeXUf/OffvNl7ZWtqbWjrw4k
+-> ssh-ed25519 BVsyTA DX/5O7PCLEBoraM0qFy821i8GZysh2+XhR1fGV50SCw
+hN/a4NwiX9oySM7Uyt6vS9hjOTHNbN3tF9DAHF0vDiI
+-> ssh-ed25519 +3V2lQ uXmSWC+gV5JsARpa8cDv6faykEoYJHH0TqnWc8yzhQM
+/y/94BU9Mwqcez6y2tJoCEkg8c5x9p8FkUbbhUpKh9M
+--- SA5BB1izTywLQB/5ghs3XqlOzr0ag2gI2/09M3eVtjY
+±µ¦ýE¨Õ8SLJðZ½Ð°s\–4Â#ÏRB
rç|eÉY/ü|/.B¹
<0A>ÖÑ
--- a/secrets/forgejo-ssh-private-key.age
+++ b/secrets/forgejo-ssh-private-key.age
--- a/secrets/garage-admin-token.age
+++ b/secrets/garage-admin-token.age
--- a/secrets/garage-rpc-secret.age
+++ b/secrets/garage-rpc-secret.age
--- a/secrets/grafana-admin-password.age
+++ b/secrets/grafana-admin-password.age
--- a/secrets/grafana-keycloak-client-secret.age
+++ b/secrets/grafana-keycloak-client-secret.age
@ -1,43 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 Y0ZZaw X+1NaQ7337zR0E6f7AsjP9koEpvVlXVg55kotyqHSgQ
-u2WmIK+g9D86OVI/U3ZcxVvqToG+HguqNyhv5ockPuA
-> ssh-ed25519 uYcDNw fK9YX8nD3hLhUMENqDRADBHK6nlWEU3pxhvptVKWHUI
-L7xvLbeYVy/xiivumpbEF36nU1JiWLMLpnTjl+6G7i4
+-> ssh-ed25519 NID4eA M8vj+GPvFph/o7wGQ3tR8HS4qkbNdlKEE5v5cOVE+x4
+gIpKa/ivPM+9JP0E6kUUOk1XXudNPXy1I8exD+SJPGk
+-> ssh-ed25519 uYcDNw evMlmz/v8VFHkiHQn4TKRmCS+KLV59xqrgRXsjzj9wc
+cSN40Oq6RtXaYkgT33oR0J92IczJYJYsKkIeGK2hmIA
 -> ssh-rsa f5THog
-BV+/u+xR/a9LGR6eKLsmBYhCT+USFrV/OWs3HTMPxUt38egZjMU8dyjTOUSywA11
-T8RLbIo4AB74YeNuBULUSup3868B26Gn3WcjcXdd7ZENC/bFTXsgS40p/0Qs9sj3
-BWWWCJp+Hi/3MfbXiQmpl7iVhVBe0k+gtpktXBTiJktIdKCGGuL9hrFPz9BbvZ+m
-AciTu6uEQ6h5KOrADJWT5AtU0jdqIqr/WWEkoWqnv9AV7Oa0gVw0RVjaay+mzy/1
-ck/syftO6kmeo8Q3NNXPW2cfYWx3DHLyzFsZrdV2tXyqlSvgumBBgXjqHH/vwIHR
-oZs6gaXFjTaebdccXnjZqx05JjJneMNBjqgJT2ZVTSJan8eAyX48AqOE3KvDrNwd
-mkZNM1xw8plm0uidGaxw5wnMdMrwtjx4qx1pKgkYzmKd2D8ro7F1DJ+wuGZcZN3g
-dluzVHNHlghbVJ9zkMumYQ8wb2bETvHsRuPocWc0ObsGArKjkzrdE9aT3mBNSure
-ZkpetWuFqPAH2GCM0bz8WQIEUeSpzNkUBIriAAJwWkx/V62lWCFj+FzQFL8FhSnY
-N+u2wXb2H601ARJDrbVFaFqbOYh/wWP6S9dft2WPxiCOXMlHXV1E/cCILiPYASir
-kReVqb8T8Q+ehVkufXOcAJjx+xAmeKQ6VKSlqT1F3UM
+qj0FFtZwAA/vYiFnw+TXK78fPOuhXCLWJSUpMLSmuRCrJK1UVZVPa/mbvWGQODxV
+7ZOI2JlmacnJLZ+OvFLwoAQvicqIOCA4Gi2vWGgWlgaAjF+1k3FOPi2pNugXa2uS
+ZsHtOZQD3mqREBmfLA0z3CjkuFlTGfHYItghCBh05L49OUyPai2pjtj6VYLKdYp
+swYk9l783bYxMtu+emcyHHw4k+YXv6QMFBJBOY5WsCJYA1Tu99uXj6/Jul3e2O4x
+ho8NK7DvpuOuPYG72pS7RVDXA28n8Kg8Mwl706aT4RTjI+KbXYfohR1EmYKrjxQD
+pzBWR8LZS29UKL18PFJQmwq6E/xrNRzOOsjSRjFvXOJUd/Xs9FM8rzE6IykA1Tkq
+6cQZ3szxKF+iK55axYzPUM2loD5McBZbd5LusXke1FtjJMz+xRhFJfcjJrA1AnRv
+3EoSHY/rK5SnSNUspg3CByUbxRNvhG6DI4XAqHNUyaUT/kGrQslcpd6QiP8zgRa4
+ZXpPxgSVxGgSUirDSkmlQxVog83Qwxm7wrO1VTYcWh5smC41blHGIbDxPbAGghHa
+PclirLGpNVH871tJevHz7ZqtHhRlsBz4TFXu89IP62G9s6h6CBc7AkrdaIy4enoP
+hX91hmnoFWCIcOfHJqySjKFv+DqH6JkBEhvv8y38Wrs
 -> ssh-rsa kFDS0A
-VxreNdSiWmAtlpUvAAfTfiBcn1CLK5i4+TYdjdjSfn0QPs6QSFRQat2Ui6WIdD/w
-TBT/5/QmNwelUTFSGU+VUrCANtZ/Jl0dnWmyMObpFzrhtJG8EqISWI+QlE6JMwF9
-4jYXITmBQDQ/Jv1lOYQE2cTD8JRs8UwpvogOt6uZun9pnyQFP8uiwicearZiARas
-zHNxprPnPE1lAwqb0YRW11qsI6NEFLIY19/eybclQeeWRaC56FFUVkIIWaOPJUKS
-HsomdcMzz04RpO1Iy5R8TojGi1lmIlWNnMaZ8fL29t+pb4bV6JqmCZdGXhJBkeSt
-hMAglxs24/kahRkHoo7mTigx9ZkW6ul9KmGE0WN79s4XHOXgh3dcFXwBNFshklh5
-g27tfKPcRW8MAzowYaqdM55zpSExnu7YSmV46XCpKK0dLmjRBu4L8ttb4ZRJVkpd
-324BDs71E8l9F7h9u9Rg9OrcCBBjJ/fLWEnYa+q2voWNjde5xybg8DhC5ecfhcKy
-fvKaDEICqBGSDSFUd5u958KCx4Ar6WbVGpS1vmDWzeUZnn6QJrwfnBGE1zh8Usz+
-qJysxDf6k9IAVn4eVUpvakayt6MIixOZj83flKr3O9JMD3Hq7OJGuLVHNiiB/+Hl
-TGgdBtNeJ39OxUNI5xH//4ncGYCrBtQFogZTy7AveUA
-> piv-p256 vRzPNw AlwY6q48DQJPgXgFtbUlxfcv/2dj0hLU79Gi9z1MlI/h
-rK1p/XmoP9HYfYIQwlTwmjCe04lHAxGDN4kMlmeLvYY
-> piv-p256 zqq/iw AnKdELa32ZKGid6JZP+qqsth1YCETO/4H5kWg5oboEJg
-iNeCsNlz+Rn8J73Y0JdK5gkUsVqugK2pi1waWPMM3/E
-> ssh-ed25519 YFSOsg arcUnqe7a9uUPpfTQVNj/JRQnlF8bRifI/WVu8hhzjM
-QQ62KL/yKowwO9nQI7XaeULusVkntta2EExkS7VcSeI
-> ssh-ed25519 iHV63A SeayDA/rZ6vlPWa2TcPk1zD8YLtJMHoZ6jF1RNvWYhQ
-nUIh13KsiHWtU/tDAkBL7UGZC5DRmqjeXOPKT9WmMCA
-> ssh-ed25519 BVsyTA NnVwcpyrWesyJFQzCvhWl511LWgt/cJR4g4w21GIRGE
-csco6z6z9r4v8CV2mj10Prz5EqwyUin5GFQaUnEK1D0
-> ssh-ed25519 +3V2lQ IxN+9rih5S6VPbHKNfG1kLpthIw1sNxoFLb/o7YEFU0
-t+wrJWTt5ysWhMQeswb14vkfHPQKWjAvoPEkvEPhV88
--- EG+fx7HIrd6f2S/q67m0SSq2raTQupOR6PsiYKm7wGk
-"Ut<,瞁u霴顚哫件.?榌憊f絺X娌%0缿^罾a$彟h濄*g扽螴c照噈<EFBFBD>
+mpXeF3O2oLTU7MAWUUctR3bAPGVIr2Ic/1o1WFhyajP19ppjlIv5lhDdBXSNMrqe
+uoNFfRuqhn7f+mtbj3FkbJN0QogNGMic9YzCfuLD1hIedxAut235majPbHNAjYg7
+a6k0WKtZInIYnMSt++qqLoQw7MIx7Tm7DjM+EG7pJKr6ZT2w4b5sthBAkBDwLSPk
+cwOGZQR5AbyJnZH1QDiXfOhywZMia/quEd7ugGZaLwSV+Iz6DwjMCPYVTP+d1jI3
+pAd3CkWIsCLMvlTvfNbLX7IhAqdg4bOciGJ8d9O/pjfj2/15WpcCBYgvaR/UYKmS
+RhPkWnPiQXVsybgw1+mH7A3wi7YdLvmQRxPZF3pc07Abs5fHMpqE3G6lDk6bq4a2
+UJg7AIqMqxmkIk4s8XIVuUVF6WmydHKIcRUx4fvnqMKyNmvB9ge/jWzy507km6om
+nVitgVmc7BoaiuaJiDB4jNO5gGsbSYm4fH82lSLJy7nhak+BRgg0oombzzh5A96N
+pYbnrZrEHFrlyjpY1MRmUJuubKC7GmljqLCWlxD4YpOg70Ne25Z44Igv+2QhSage
+ipyOwosh0uCgoi2zfOLW6mqFdsWNMDUTtpaWQmH7ICSsKorHM/ySsVw/VY9SxyxO
+J6fkWlCakn27Cd7H39SroN4YdE1JvVA+QO7+7XVha+Q
+-> piv-p256 vRzPNw A4W+Q6MpVn1ZoNHkGmIeTFrteV8IMBj0R90x3bSx6z0q
+F9+cMoBsfUeEN6bI9lPz9IKIaUNjLwJd0JOI6OYsXcs
+-> piv-p256 zqq/iw Are2msR8ZZRaNu5Ab+BTl+AMaj/jPGra5BRBajmczXC/
+DXufB6ivej3Z4YHAvt4AMGtQcbcM69kNnYed3jnfapw
+-> ssh-ed25519 YFSOsg butziA7Ccty3azzh5/LFbClCau2Go2krNjPbm2cGUxc
+x9JyLzPYyhTcvzjmb7w1fcJvcLEEDpSUUv7WCtk2Y9Q
+-> ssh-ed25519 iHV63A hSs50Whtn+NxDOq3G5HhRs9vCh/0HS67bkB4akb9gwo
+CX4pQgasUT7Z7DWjxDz5L03/1+kMCUTiU8HrS4lV7uk
+-> ssh-ed25519 BVsyTA 4Y2EBmTJc7rlFOgVdZrM9MFzes32FsRNlaMmZ1Zlxks
+BwkgIL+1gMpA55vz32iMLXgr+tK3VEe/7+JnKO7xV5Q
+-> ssh-ed25519 +3V2lQ KXNeYb2HqYI/yMSu+0eCs0f9xW4d/t21uB4DcrAAIE4
+VLasUSXqhEU2U4P3IBXhVZ9jE7/OlJ4n3qrfaVH5Gkk
+--- ZfxR44elx3WGfKSTK4+mlWuqLLSA4esg7Ml4/84MROQ
+œ“T¾'7Km¢6ûnÏKk*s™§ö!û™æS3è@$)‹ºc?á”…UUØŠc"ÈšõßÔ¢zÖWà)ºRªš<EFBFBD>
--- a/secrets/grafana-smtp-password.age
+++ b/secrets/grafana-smtp-password.age
@ -1,43 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 Y0ZZaw YW/GflpScjXOohk7fuyf4La3SAMsqzYPXQYcRfIldw0
-9JIhny8OgLF3/M0S53TLXimIIAiYP8txWE1xB4zZtj4
-> ssh-ed25519 uYcDNw +p4m8Y9WMfc42acNfy42wxgTvKfv2Oucc3WQUL59RlE
-+Z6/heh7+KK2xe412D/udZRlpMmcDFKi0xyghqAg/44
+-> ssh-ed25519 NID4eA 070w2iKFOrbla7LvC4xgbzl26rWta4SQAdfApaD2v0k
+iBz3f5kGyPK18/Hdh6GcuTirbe5CE/GfF5ZdpU36MXk
+-> ssh-ed25519 uYcDNw 4keJjA2UPPTPOX3iHcxIYdw0FuYfTZ1j4YF7OQpUp3M
+vSuhNGXSs/kWQGzifULsS+bTddpuy3CcKCE9UmNZBfc
 -> ssh-rsa f5THog
-BCgZnv4YCvxXau6Wm+mMC03lZVRbWjvoWymKj79/JMK52TLx5BUOS7hGkitgS2mr
-A7CkPxucLuMExdefcRiDYp1jX2rWU24nUy2MxwOm4sohuivsTJd6cuNvx/wDfbmC
-5JOUHiRsW+igclfQTYhYhPRVkWw+L3IBr/lav/vD4Zwp4sA0jnKXw/VRkOa4dHk+
-VeKMmc27K6FXpUNHh6xpi1lpZqgKBrsOQH3AxDHioKtTQOjIcIkniXmtjt+n1pAU
-z/GdtlBpI3JSd4pGHnXveN2zOMJb6A0DvfpXaTRlQmxNO1cxFm7DXLYy8uFCBI+D
-KWKJzHuvzIO2dRAano366SE/5MHv+ADL5mA3qJ2iF7uRiFkIi1yOMiejGWMA79m0
-aarx1K/EqSvGDC75N690vg+ol0MlVDFKHN9UlPMyjg3QQwQGGgtI1mWdxZoo7cjZ
-dVti/OCxTvbKMApWEvLGATSyX2tEL/PhcJFGSPGdKJU9C2WZcKiTy5rxCH/ZSgR0
-Ju20leD9TkCf0oHDFHIWRzxeOzYI8tlpK1vy7a1GQJEyeZn5eHXtTEL4tH3or0+p
-e3qW5djQrSZ0sQdaPt9XzzmdmBBODWomSweK3mLNKdOhdAVBwrV3l8Vm+qcVhuW0
-ZWfl2RYgGsfD7edFXmGTal4O8UIVl7NYjrhT3Qkl8G4
+rcBf1LitYkIzigSq3weM+/GsavQc+ZF6cxLLKDgFdPRMGZlImt/4jKcuCGNTmF/8
+5Cfu+obojl8njdBQsWxJUuvGtbl6tOrWrAu7wlUH8GRcoy0A8umiWPcM7GiPvq0j
+nOQofSPVUD2vYRXikfGyxtlr5sjU7w9QpVWbrTsTatYGtj/A9onrgFOi0huoEHKm
+4nQufpe4VaAOeOmIUEWoJj9vOVovvoj7RqLn9k7nOPuabsHVxw6sePkJYllJjrtc
+Bg+fRduXkfqmu4hPSwJqVCG26VlM9UqiOVr0e73b+s6v20c45zr2rAT/xhhngzJl
+CB+13qf+XK3IjZaDsR6kDJKcR6+z2H37KpXbzqUUGCQ5lx5tP3imn7KuBoY96/Sz
+4fVgvcM39DuoibLh19LoSsGIBFOmbT4OuFqbaoxgRap+RGgh2uPY3CdfyB0chC/R
+t1qZla7Z2nSEqY7oBAd9NK6+EIQ1H1xd0WSokRVmlJdif3zdadyMJahHDbORq5zi
+RG1A8i3FHgr/q/cLcQQ/2bVE2pSuKzhlxydtVNZEDInJNPy0djKF2j4AHTyWQdCn
+200EvktqfLwL26nSKrZCrmTKUJEVmMTKM8SH/ZIpOLou2eIjQtCskqsXGdwfYmGD
+1fIBb2VLJT8G6Nj/ihqv/WJ8Mlpj5CAPWgMeeYHywX0
 -> ssh-rsa kFDS0A
-Av0X9EWC+JOG5/XhJx9JhYe2ew2IE814J6qOv6/5hJehPHRs+x7pkyv7Z1KLbFJZ
-nQBQuZkqLY0fed0LF/7fEnNF41+/5+HEoTY1r/Je8akc9+pUoYgbGzJN0ddbXlOK
-P3antVHR9jx/E9eY8fgkNMASnea7BUc/yqxUljRKF3N7JTxC1S2BhSd9HIdT9XlB
-YhA1H0nRJbfp7SQw+xrCoMzln4a5brE7ycN94EaHnrgwf/AzYUawZ9xghwtS+HOo
-8FLwkjRPoscOEJyhSS1ONO3CKOUHfa+0cRWMA8LHhkwAv68/07zktF2eJa6dX4UN
-hNdxhwA4aSfM2lkCTzzlRpl1AEPlhjq66F6M9qy2B1nmsR3zeL1YhphDlty3r/2e
-Iw6wDKdMZgCbyQODXL/9w61cxpO8fjus3u1AkmR70MNc0QPjlGKs1V9LrYPvRl3O
-Hl0XUxg/7RE75Nqxy8GqO3YkgzLaMINgB9+mIS8XgtM87AAA2xSxWXII8iEbY0B+
-RjfM9MkhId8LQVY+3kH8WFJTBcEVUFmr52mXU/DImbvQCYdS1YRlfYfusXbABGDG
-5aRwcu+bJ42lX+G5ZtWM0wOnCS70zknvW79YabSLAM2wnvqCo+RDJbicfYeRb3Zf
-oyGR4JBZ9sAmOP9NlPTcWLMzEZxXdhGTyl0Ir0QEkm4
-> piv-p256 vRzPNw AwRvkmNKHx4OKTdVEntbBvtJQ81iF5JtV6CywO3dD3O6
-wghX1uvRlC+4isf2e4H/ydPOLtmb9OsYeE/mePv9zqI
-> piv-p256 zqq/iw AtEZGBvcuKRfmed4akDqnPlEIKQq5KjR9GHoXTudkl7l
-z2fQAhhisxDnjZszDtDI6VBQFsHHbKUlAZDNHmIFKVQ
-> ssh-ed25519 YFSOsg ZppVdvUJDX9LJbOGKFBWgCNDQ5MjTuZGnI22uy4ftC4
-THFlybpO+tBCKgG0LZ7ZOMpw16q1sPvhVZ1CVe+MVfI
-> ssh-ed25519 iHV63A 01XIo9M8Et2DkWSfO5sJzVu7S71EmJcRDht/u5XtRQQ
-iZjE46hyys1RW/ltjCmnXKcWfmoiurPoA3s1Ka0eIU0
-> ssh-ed25519 BVsyTA B97LazX9/2obX9KM4yhAdbrjkDCMJ/Bxv57NnBAAeD0
-SSSEbPjl+SCl8T8X884aLmqJRgnT8kvI/hXC4NVMTp8
-> ssh-ed25519 +3V2lQ EYVbEhF1NIpw/f0VmLgBc1tM56B+buSMGe/fY1ty000
-ZW6rEd+rMCgqG+Qc0xgFcThQcmfunIwIj+x/iwkeQ6s
--- JAH/pCzrYMNHoLFH1FlXxFZVFRCMmrtZOS2lh/pvmMs
-°òòyƒÇî´Ž*!jÞµ)Ë4fô\ñ
•(Úæq³yö’À.ÂGÌÑ»c•ß3
+bNxi7xzpuF6XMua//fX+UCJ0eaTR3Z85YuXR6zfhNoh1kkueYjHXlQ1/85X3AuZ6
+6hhPR1z01jbYm9yrUAq3i8yJj9SaBXpuRVSCDL5xi9tByDmwhLFMo2g8CtNK2z+Y
+EOrqMmZ14Q3RG93CT/rDdemPYycNtkTqdNhNq0fIpHM29UgjMjKGrq+6L4dCnMHC
+dBQ7xpxCgni6cdx1H0KVxo43X1oVjcSy3D3XmOQox7Dysom8s8bS+GQGnXnxDBHC
+yYzfvEr2JA8+kb6dufraD6f5zHzwww2P8FRhWj+7GxYMPZ0WCDZjlxF0yxxPkzBG
+71CMRwXJ6SbsStDi8WlIFUdv7gQA+0KbjrKf/VGUPPAzQrqnb3Q5TcHSFKl+Zo9K
+W3dTuFQVMLbASFJTPPu676Ulz1L5Aa9ZFSRr0y+ri8D5ceip0u3rqEc0VFa9NRoA
+EloBano50AqBVi8rba/BLK1vXFBY/YU98nUPBTb/abTR3q2J/RhwKzQwdTk3uCqi
+hTNZ3qK5P9jagfT/rX2oeOBXsWxv5RxZw+tHw2EyBfQ6uOsK4tQQs5/lMhu9xOGV
+sLmHSDCNnBswI6WCvnZdgJPZKTbDeXRTK3RziJLr6Nh3QqYFAe6NZfD/xQ3ARyC7
+1uHoRk2aLEckAy5N/VS42xTPoK7mfDhao5hNONxh6EY
+-> piv-p256 vRzPNw At7C/F8fSGgxpMZokvAphi2wDEgJ073XUXOprtxYV4iR
+3a/oxlKWvjRd1uxEJipyQV+/8VM23wVWWNYBm1GVn3k
+-> piv-p256 zqq/iw A/ubZ0Jc9mAiZ4q1DHczZyxrRqpMJGLsp7yAqznaogli
+vyJUM2Hg/bUf06Gp1sT1FWYMovqaChsfLtlKStNjK6k
+-> ssh-ed25519 YFSOsg tKDlPNLGGxJ5vn2JjLFzY++ZZ+8I3gGmCLZBXEYP7Aw
+0LrDm/4jIbZRL3GHmrKZovrM6mjacJwAAvw+niQCcC0
+-> ssh-ed25519 iHV63A zKALwEkOjLDZxbYxCX447LUgDT8XKCN63TSR0bz5Th0
+1QaWaGAQxiUtF5rCSvvVK7wNtObUjBx2b+hJ6srzGVo
+-> ssh-ed25519 BVsyTA htddHKuwj0GHraYeaz/G1wgmK1cVXc2rxOVEHJm5qDA
+ezhynFcRE/nWnu4F7DNOKzt+twXD8ruvsBevEZRHEI0
+-> ssh-ed25519 +3V2lQ F/VW/8lQRXjo5wCJfpaDfy67nRwKk7s7OuWROvHgQhk
+8oU5fQEeQ8QJxO0tN0LJpAk+GsyjMg7S6wJSE59m4mI
+--- AIuo0wtWpfspkSedhiuBzSwn4eCNY4PFmdzAdBVWE3s
+fp§‡Y¼ÙpswŸÀ<EFBFBD>à’"§](g¬mzr”ˆã!0œÜ2½µºJ`“1¢†ö<E280A0>ž
--- a/secrets/keycloak-database-password.age
+++ b/secrets/keycloak-database-password.age
--- a/secrets/mail/admins.age
+++ b/secrets/mail/admins.age
@ -1,43 +1,44 @@
 age-encryption.org/v1
-> ssh-ed25519 UE5Ceg 6rewUSyj9mZOZp1Oi+DvWxj7u6r7HWUAnp/zSDLmZyA
-OLBPwlUCqlVZqrZaqT/sfzslgcYRViuTt9yzJZRPIPI
-> ssh-ed25519 uYcDNw JNpKkljIQIPKR/KNG9AF/DxbJjYoMeQdhOjmpig2Q3c
-bxu5hEvJi0ip74WUJNJhm6pAfdvVlFBbyCwQKYPkUXo
+-> ssh-ed25519 UE5Ceg gD5QRHbcUWSile/Qrcd8JzEd07QTQsgxD4NkyNZYYVI
+l2b1/Vue2S2ymlzCuHyHBDhSr3HQg4UMK12UCjTF6hw
+-> ssh-ed25519 uYcDNw os3fheZXnX06seK0rrB0jvVFULf7H+sxrymQHtkM+D4
+xzkMSJxAh7OJDEvznwCZXPi2tUAD0ejBV7qLM2KlV0
 -> ssh-rsa f5THog
-0Im1QWg1IHp5nYfo0OK908ohS+Mo0Jyyyimq3sc6q5WoDUzufaMVYfgVpHJxasO/
-SrVAwE6QLcHuTBZPeyr1HZ7chyQiWT+Lepp/MXhgS8nDOkgJaSNxY35PO6W/qtpE
-rxkgdNZdB2Orqq0wHo0is5+pfZdcD7n6O4VoiayUh6kv5Brk98BUCHrydXMfJv26
-0Kzwg3s+/kDwOeVOt7uy6n5VPhcSLiJgQlK4t0HkPB2rUoD8dfyVqUZV3YmgCoJM
-Km1lCxaS96xKGnvt0HklYy0OX5S7ActBGpQJjcNLTl7sb2M/U0XAF7O8teSKzdq4
-ejKOnzMdxFB+qOSZ3fGzHbjxNDwxPqyps0yhm72rT5tww3wOzYZXUebn7LwNKVwU
-99mA0CR9W3wg3Thv4nwmsrycTMFHh9jvGRXOYgIqXNDoo2oqqkzLnS+N2fx6Wush
-SNziOeZkgb25h0wrehxmqsEOVjlSE6C59E40XlmSj+MJf6siDLQGpLShE4Fz1tyx
-GXASxlTNcJ8TY0N4UmozdWRW8pyTOtl1MhiuaHdYLQGvd3Zlwkr9C7pV6eVBxPyF
-agSqbSZXprY5owp17fUc7HQUu5AcNJyQtDstwqOTPbaJFNfPnyaHU61jt52sk468
-W2d1hZ9SYxiN32rjYV6py2SiuOvHIWMz3ODkvhxQdAM
+sMUYZP1yspVxsI4zWydUKPyATbc/dHED1slRmQMYBCgiJbpXxrcfyU7JvwEiW2Nf
+KXGU1HxBdstuC78+1jgVnSqRG2FUol+gAZPvqJCO30SznefSWciCvBfC71MKUjx5
+00WRZjQT/oSVAha7o/5nRqfsYy3mEkCvYOAX0X+ajpbIRJlywB29JNf19Smr4XNH
+cYtiOMQlqYvHj+YAHIZPqvZN5Pt75zNRdHqr0b0s6GI9/SuCxwkwU5eeO/QYM94d
+QckXRdg56gZKyJ87QFRFCMXi2KAAwGjLNVhws7wvnh3G03ZCQ2rWGR8YZxtDYyee
+TXPBo1JNDlIrKyGOz3AfXSNq8UwZDodpRy7Vu0LQBQNCOicGYrWl2lQ8Mo5zfNp4
+SbJZCxHztvHqeBWC3EQnQx95dUfUiui/zTp7HkQZ0bLVPS2qrSJCTlceT7JX7cIy
+krgTQ1/qcFqt8VWSUFz5sKXwE2FnvvJ5QPGsRPkBs2GAKpMQXpyLkv173iPksBMb
+NU1slvMlPzfeg3xHuGCJYofVlhhcUMi/RTQKWmhwwzfLBXZfocINZqOKn72TnAb5
+yfJ2t3BEZkaY5rkGrUhnPFIteUczaavu+P76cqp79recEmFwq+hrtOMSsUF/t6eM
+R3uPzN+6gLHvc3IFL2WkKYT50cb1rOAK9FdZ5ilsVFc
 -> ssh-rsa kFDS0A
-TRrrVhtSIhhR9OXVAEwfmVn44a/LIaYJZWndqPAcAEhQp1Z3kPpolkxtKskz982G
-wQgSbzU3py4VRpXdy/FBttoEdBrhRMKG0z9N0szKlagfLA+DHQjTlaMn/UkxmO2S
-4AdwO8jEJVe26h6Y/3ne7N+/Ji8QKO6tKeNVapBKHYsJ8qqscgYW1WgKOAfJ3M6c
-6lyavfn2prTkM0xz6hMrywm1Is9ahM4vh39iLRAaVonFHmNJE+dAse8ijvKzjcYM
-KAiZtabdJkWwjD/3x513fU/o9DQCnBTHfM8KLb7DTPC9Ro1K//O7LjcG+WiaERSh
-0+dBZstMD7fQWEyJ/CgnRf54juZs2A7yBdrT9TcQtcgPKYk9QjFqHCmKB0R+TUaX
-nNh4h33i5V/8JfPRQTLz/YYFdG+kG5Hvucs9I2HN1n/vaHL9UIH3zC8BmkUd5fnR
-cnKXPjFCfrPPKg4DMT4gT5lIVtIBRx/IKxvjgR/8c8M9M3jk4SZSYHUlKtnzFOLq
-ycGJopWX7kBWGliEQ8jC+nKYOXpSYH+mbHOV54zplmNOZKMdLJ9ek23WoX5/BD7i
-arp4EtwYiD2LN3M1TG24gFW9VCY3Ofil6HAn5ySM9AMtIHwy/8srUBSCtdpWWGx+
-0fk+wGVu/5lCn51RPXl1L2YRloyx3giKvappuUcpho4
-> piv-p256 vRzPNw AjkP6Dy1dEQ58LVB01S/1stB6JMpl+q3EuqHQp6RCfH9
-cePnQF/DS9AJx0MJArNi/5b6tncv46lKpu/1SIb5X7Y
-> piv-p256 zqq/iw A7cNqXWWA3Zd4vccwwW/Wgfq5cCOjnIPq/Et0qpeQUMw
-p/e2OBgHoHA06WR4h3k1GK65u3qYH2YGPYQ10jz+pvQ
-> ssh-ed25519 YFSOsg +Tl7z0DL81uPhdBuEJG+9qnZ6eoAzyZfvJ5FtrtyRUE
-nfVzlc5NoSxHv+2tM3D444kH9fCjUEYD+7wE2h83qYk
-> ssh-ed25519 iHV63A FgYN6w2aRUPpBBp6lV8pqSyopRaWwzhkGXxncU83HVc
-PcNQ0P2ZGCnumKWuHVo0wwF3KCz13JadNkAHWgqIfbc
-> ssh-ed25519 BVsyTA X/VL2A5AlbG1m6uTqbYDJTJj0wVrYGx5w/geJTpgQR4
-zwlsYTehOA3oK92zFN2J+HhgaX1zYd3MP0vQ3W751Co
-> ssh-ed25519 +3V2lQ Hk8tcLh85helo+DXrRDhCHkDja+sEkM1CTz01s0SXDQ
-ftNhb63/JDulFgTukVu76XG2Dfcorbdt47EV6kqXw9g
--- 37wAuChTQKbjj/RCIh7ZRB2GOf2kT1we3D4bQKevM3A
-ñ(=ÂžÙ>¤jIM¡ÿú ”ÑyÂA¼|à“áÊ¯Nè<4E>„…‰f‰1Dgí5èËÛÜ	¬áßˆßg<C39F>6ì²#>ßÐ%UjÃX›ŠÈ@ÌÑðG*ªNó™äÀå\çJE
+mNMbBAtl8DqLVje6lOnsZv6C9ytsl/dJBoJj+qfM5mTo5vkhyGPzo4NaaZIPnMVs
+SIckvd8gUhaPC4D98oPANl/GgBHEYSjVVwYS99THMYurW0E/brG+Awy+wYchO8yU
+rN14o4uk+LkAuRhSpDs7ExA91H/BIQFwNbkubY5Hp1dFvEjn99vhTi9ntHcsOLgR
+PE1QlfW2uzBvm+gwJ4zFPWDe3XqIUb+hU0N9hCdtRF6LxR5FaMzWuF2Y06O3qlLf
+oamlPpB4jQAq4LXgm/GuW1csOmc+PPBEEc/V8DnLNqy9PAScd5LS/u0zL/D+NHCs
+i3CRwDce5yCp3S+mrhIwoVZW4doK6fiKvkoYCC7lZYvA++eEUmZ4Xuj6eK9H14Yi
+g3lF3k0NLH7xw5dUGB7faUOAtpVLaGRy4nyVHp9qOWgTvdxMCGjt+GbfSTnDQcvz
+S9+FfDIPVOAh0jMv1J6w1aREPSeEOikC/TDBwB3f7UwKiFSS8aDwqRraUwmqiLaq
+L/lYo2DK5vBf20C5iM6SwowrvDV47ZBUbLO/ulvKDXydG1C9whMJGsBnEo06hASL
+oZK4oRpzJapil350Z94q/mShQUkzxYe6GS5h5eV+jly1mvL++7CJYywsWfe3Z6O5
+Oy31UxjhpRhbW5iqOcvjALbCYEPiNst0zLqeFywZ+GE
+-> piv-p256 vRzPNw A+EBgtoEKicMn8YJpH3ZGwV0PVt9l+YW6fTjs3deN70x
+RCx4lJavJo3pZRvj661M91wbZY6XTAMuqex95J6A22g
+-> piv-p256 zqq/iw AhMeJNZ/JlBnn7+3scs1hU3NgQBsKDC9L6sK5i1IBPIx
+QDZFPPU/Y5t9WQkP5CfZtPkl9CidOyebsubwbav4PCQ
+-> ssh-ed25519 YFSOsg kbmALRNCorj3qcJYyV5X2CGk0PBjOI6ay3INT15dFAA
+pfKCr+INssY1gccTCbFvnaaXLMoXr6DsCqgz4UD0mDE
+-> ssh-ed25519 iHV63A 8jd9mJGDe6yCjPGDIOusCzCR95Y7wRla5QjaBE1ESCU
+vmjDhBr+lYTCu765o1FupE0/RbOGaB3X0wEbDyOfh3o
+-> ssh-ed25519 BVsyTA e8lbhf+RO8CDMrR6MmBYgyeYJMXNMJ5cO5GsdYosbh4
+RKGw/EqxnQXeLrdPtCh84zZSN6lu0FyFfNSF7Rllbxk
+-> ssh-ed25519 +3V2lQ f4is4PhlyDSkRwbMIW6nehwLD6feea0so9AXWECX0ys
+0wUtiufdA5FzCIqZrcUE1XKSNOA7YK/PNAdRMnbXaNk
+--- rHG5GfdaRsmhAQyX4M6fDFTwCWKfI4MXTgyFL4py7RY
+|#÷üðÅd/Q‡Ä™‹”gÍGÅÄ…Äû—kýôjF@:}¶‹©
+Ë‡Ä8:0ž"®ó“ì°Žß‹4ÿ¨PŒ›ª¶äJÑ?MxYhb—”Ï•ê˜«#ç'tš
--- a/secrets/mail/bot.age
+++ b/secrets/mail/bot.age
@ -1,43 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 UE5Ceg iKhPkRjtE/7UadHCdLoQR0/fe1LhVF9wSp5DQUw0hV8
-o8BmKJxLYcxml+hq7l57nWQ8xAQFrROcX/BDCpZW7YE
-> ssh-ed25519 uYcDNw It3n9bvJCC+H+r5VRrtjrga1S1TkhiHUTGL/ltQbk0c
-h/98devoPCP18pYqK7KcXaDspMzQMtvs5YxsoyodDes
+-> ssh-ed25519 UE5Ceg B2ypwlCArbfQlB9f6wCaNfoyigxlZLYPN+G1A0RzAEY
+phfpR0H12yHwNnAFqBs5Al+E0rykpX0JQsOSi21+9dg
+-> ssh-ed25519 uYcDNw 0nP78x89Ug9p2kybjnkl1LdHS1sFHs47Cgx7Y29PvjU
+WDQ0hyddpyWHHUV+xuSees1FAUDE9aq9L9kpt38cuR4
 -> ssh-rsa f5THog
-xVi9l7vg34PJaGhjOzOtPtoRMePzlvdYKjNnzCXLd0g6Y4JXQZMoKCeeWrO++rtY
-7/PDxJ0kJjJAEY7q2BnfV+87nmrGxFFerldDcEO9pP8/sN/u393WQpngb0tMNx6M
-cjhwv0Y9ygAb858G1NzvnALVZGmbUxX1JIsq8QDcoP3kz5JmonIKLM3b4LrO735I
-bfu3T+wTRebOHdC9SOhz6iuhyTnu/RmU9w22AKK/IL19z+11NJB2Xoejkfw0c6ZU
-cW25i3TdwmiJAZ+lCDJQyBXtLctDes1/e6HtOkXoJSKQA5QLfEtPeCMyBmE4y0pR
-z1DPiP0wMd37YR8dMXoYDRfo3EvsDJkNR0SDTZj86kio9e2sXA3OtIx8BLM0y01F
-0Vnh0FwpY9kclflboeY9w3Uq33/TCvy9aZ29XD+X7HGdqqiqxeo5rcAMXO9xAx3h
-2fIwdVyWYTnLt8TDOH9ZKDw8vausEITQM/D73AbVlLRKDnXTd+YTkYBgzU1rJtR0
-4FQK4PL2qkWYKEK7qDTp+Hrhc4vOnxURaLsdexTub/A/TXHhGAKPxpGBOcBbCjc5
-4mHSRQsDTbTNNE7bcDbkBiUcXAdlPgvEhfLmmBw8sho45M+krSeSd7V5CJ1NENhJ
-3SO92RqIuyGR48lmvsuN5js4uLS4ntoyQvnmIQIVSQI
+pzLQg7g9WXNhO2uoujkqlOFNTHjWBrWi6DCNlsJslkq+muOl2Jrnh82+781sc2ZB
+EayFfD0GN6w4qQ2/zknW01EKNNOV70qmx2C9jbKLT6XG7lzJGozIJMD78h8w4JAQ
+u0NTO+zSIzsrvdM3AXlcXvN9clvV3pdQ0ogKlxxAKf8dr7p4qy9dD1r5hvideLjd
+liIitoSZDzuVvlfsP9IAHIFavcLB8sHY+dTSQ0dBMZJQIDDCUSgqsCM48Wto+ePC
+YC+HSLUASKW8SAvWH2eyrGXtnFH20fTOrFiF3WkLvm5nd+H8rBiGQVZWzbyRR0cU
+vjZN/Iu+XefwVoMLEKtHA6NYOL0xuPgsbysU8DP45VjI3ULHX/f6qUJQbUfO82IF
+qSoPhVaWrCOMyc6NjSb5NvQ1ETR9lsvENmXXhQLQwVNozUM6fmXJt9Qf6E6u5xJa
+TJgK+gktDW+CWRSm8wJ3b+Cukx7qMkV+NGKyK2iDRZSmyc7bYgpTxjjYpAVz21UQ
+Djbc7uqsNf4EiwEwkxKK5zAMKgbVQqriy6RdBqjcgVXsPDmv+rbuDtZn7jKw4Btk
+3VganG2/CDzR5wxDdentOd6utHMKlZuTkJtwVh+gL+NO7AmbtWTpJAGJ+2tkyTpg
+Zg6gKsAYhH1hgoNuyWd5807L2BGaLZIN0zOyjT4OHQQ
 -> ssh-rsa kFDS0A
-EsW7RlBeeV69UwczFANtxqmz2Et2jpUL378UuMydlzRznbp/TJjrzCStMTOBEDyC
-SuADuvcvLf1WsVbf+rxRuFgte0YMiqUNlijN7tsOFg92odk8tHVwXEA71SW8/ZWh
-zFqUJ8pPFXPA6DEYMGmdNLV+tEx3YsUFCrTvhRIBGPCFbuYJj9Ta2xg0KK3uR5/l
-xziM5xxc7NtJGpW3dA/qFyneuY6gPm17PWav2l7gjAge/6FvLFzfev9TuF82iPgc
-RkCNgHZqClWLRO9b0af8FMGWIak6kr/mqao40net2azrFqMxmeQFLIKJSxa6Agz+
-UtlOND1COQwHrogQkHVuanBRRdUZzGk4QdW8MN49JPkvwvVPGS2XZrkE5m4k66Nu
-rfMtlcoSGSA+GIZXTDiDPLpfpYV/XDe4IoPTpLcivRNb8i75GwCT/5vD39Qmlyyc
-GHOX+v5JXh8WYpgvTEPDYE/oeKnsq27QT1wt8q0hKuHcRO4BcdPuiaSMnn0kjvLd
-o473b6cHE96F3cTKhXerLqeMFs1+DsJhrxYCmRikZot6Iz8H5GnqT82Me1by6cYt
-+GDcuVLIB0OzWfI9ibZB0ueMM8UfrLeGDq8hSF5M0rDCbFc6ZzQw8PgI97PNaDGg
-FdIMho7IXEQKXMV7ueZ2/PiQEA8vfBWRnxGKFRQLOTY
-> piv-p256 vRzPNw AjWew9VSba/AQKQ69l/4OhvZUT/bawt7AOSe4/LjanOI
-wHkZs8QQAOE69dq0d/2PAMgsi3xDBqEEvEFB7WKMC1Q
-> piv-p256 zqq/iw AkKV76ktPNKCS/KidRxBHdRQmtH3BNO2kbBz408ZJ+wu
-S8KdsoVZUgvW7E4mlVFpp7/wxBarAPTEBqsYoBXar+M
-> ssh-ed25519 YFSOsg SQt87e1+Lza1kqQl+AyqOu47+en8H2AbjCasMjDLfRE
-vBO3eKJPzagd9NdPmVG1SvO3x9rnf4H/8oddfCwpjLY
-> ssh-ed25519 iHV63A a1iFLv3FlMcfq6p8+dKlFB9cDPC8RFVc9DxtpNIXU3c
-eQW7PJ+eGgp2loZTMUf40D8V3LNAinBSXgxdlHEQq34
-> ssh-ed25519 BVsyTA KNSZgJezH8bUbpFOWiyBN9kPL6EvG/L7Yh9ZRGUJkzg
-Fb4oMWqk3OfdKFkLd8qq2wGvq9Fz1D4A9HmA5a412r8
-> ssh-ed25519 +3V2lQ z3vxaJYUXcqI6f6U85Oj0u6cqyarKTLidDHsURqaTh0
-HNC+nhMbrJOUUS5SAcqJDDjwhjvRxOibo7Xx911cyOg
--- 6hftMRn4kD/f/ixMq2T+VnXZwyfpcV7zxZ7PBAAcsDM
-Êü÷å5lŠk—9Ë¡zÉRÏÓ©õ×¨MáFM.º}ÊD§¨%ŒXŽºlu]7íÞç‹"\¼û<C2BC>êœ(}-¼â.åÐÿÛê25§‹>06ã
h'±^jˆK‹/5<16>Í
+VcGjofFOsYaE94MqcJGW2UZ99Bf5PIcFbYoWuMoyMlaRnOi145IpIemxwBY79UYx
+bnpgnUq0WjNEMhqgTIG1Us2/7C4es/hF3CTNDYItLiKqy1i/EWUCIiSGPIzoLASq
+tNkFcQCCOd6OhydzhlKm4EINmFfY/fvx1XmHJc1npdMfJt82mTU2ftxelOluEbmz
+wPdNxQCflswFNyEDoCT8FIIRw7RJvCu/wEc+6IH5oDupuZCT9LvD4QEPPSjVOjJo
+1w0BKOHBTHIe6/+DjS6oqb+Va6sy5urDA79/FZDSyO/4LtxoiB//K8xd0EUWu/D5
+e8P3aQVpM7efEDFNq00rNKNnwcwQwY+WnYQP4EZQOcj8auYTxI8YDqF4Lwl2Rlc8
+8+2oJyV2gYtybc0TEyoJIRJJKP3JcTLatAdZgXO39QP3ZQO4Z0ifYAWrRkmOkKRX
+8yaZnCSmumKkPZqNbB//YJyRQS4l/e0UoB0CYdU5ljXUeXc23a/0SiptioWCj0Fc
+dDzpFTQTz9M2d38kPnvC1FOlNolivbgeYJQsL8436LPB2R9EsI8x6CBqhoCYQPnH
+4/Be9NmJhNSFKM8gavQBw6tAuO+o3KUGQoAXO/0reXa4JlO6MMN4+wJ1hroBk6Qz
+LFJtI4dTG0eRiIprIw97azIbt5HRe3OZ+x2tf20Wsws
+-> piv-p256 vRzPNw AwMtcJbTUbO1P+z0l9mHhJGgsA/FNVatPnEYWvHmWjUS
+e8U3q1ZX4uJhjvn5rnkQmulOccEJI1VK5cvS+tan4qA
+-> piv-p256 zqq/iw AsZeadyx4Wyk9OswxgYnfgSbeT9NBaYN4bqAS1jXVKs5
+ahO6BcM6qxHnDYktXnnCuZlZwozprIH/1f6oMF7CrHg
+-> ssh-ed25519 YFSOsg vyX/xUJ85G2lXyGWYl1AfDmuFxEp7HyUlltzYvLFgXY
+7GAV7wgvCPEC9RQkEVYn6t8Ou6STZpXAL9q+8Vm2BFM
+-> ssh-ed25519 iHV63A 0fCn2yOmCXjfRR193mpXR87r4mwy8QjeNfA2n0F3ERA
+dUdVw7q5GCYS0CTyNczOj67MRcWTQfRUwGtEMsAe7tw
+-> ssh-ed25519 BVsyTA fUsiobRR4HsqaYl0hfZfE+++swOV3XkAgSmMsvk5qHU
+txp2qnf62KbrYcV+Yp80WYZRJpj6MhjO0523m9nvbm4
+-> ssh-ed25519 +3V2lQ OwLStSeY1+pJBZ9fXqsZdwjPfYMApi8HXgQMIEAgIXs
+X4eezCXShnn54qHgRJM1mo9FBtVK07XVLSHBn32pY9c
+--- WX7/Z0eRS9Fkwi6s2jSr76HHmWx5oWfCQDqRJj9ovsA
+˜ýò“èt¿KiÂUl>î€@Rt<>?Æy	M
*’W¬Âböÿ»V}«žµ¤š(¸/Bu0³¬K—pjà+Ý›&žRÄ
Í$öE&µÂT{SEH84+HÇ7’
--- a/secrets/mail/crew.age
+++ b/secrets/mail/crew.age
@ -1,43 +1,44 @@
 age-encryption.org/v1
-> ssh-ed25519 UE5Ceg qBHHVskxlk6AOCGIusKKItMQVrJpjpyWXBfcmpx6Bn8
-RDGWdLn/D8h+dKixRk39zrMFuoaqjdbnUX+CiRq+TSA
-> ssh-ed25519 uYcDNw K4nqUOfxtA3GDpg32ndobWATCQBN2ylzD3wyLlnT2nQ
-hRPPtWcxI/paVmOHT3J5SS7Ov8+gvXDAqtceJFn7o+s
+-> ssh-ed25519 UE5Ceg VVagFKN67R8OKJNOthRBDK86mwsNhQfuptHfXmBQ/gE
+nodn6RvyxNrMSA/aLAzmYTJVO/YSo6GlcBn0VhWJnI
+-> ssh-ed25519 uYcDNw bVnHlcPbjGibV73krlHfvl4SWe/FnLI63G5mlAdtzXg
+FuswKHdEbwUeugeuSjjE/nu66qMl6EDT8nUsdihmGzc
 -> ssh-rsa f5THog
-n+B7fmdbS+uwPFyHhBCNAAuCsGh6nzA3Q1ttF7vtadi2yw6P940XKB9hXnCe1btz
-NBRvKkVtIzRqc/5xDTqbDJivIYzFu8StofWv4xRBFzpA3P9r1qQV1lHwxOCfrsdd
-296KHvqWVo4rdhkbd9Cye7cxndr2AWs0Gwn1uNvM1WQjTzUWzuKy6UsVztEcsB0J
-4avT6+S+yxpKkMIyLqlbis/VYe/CDpPJGnxeG2GN8POVQpSdyBCEL32qkj07wR17
-9rZFWU5WKfIr0XXJkhq+ewNdJzQKfWDFEhHrZYrg8LxKYsOWhydRBVEHkWVXnLin
-CSD1Cv4VNHnqCycJ1Dv2Lq2n7SHoGMLPyC1UPJudmpY1Z5XIvWOu5uxvv0674mdN
-WxOXgZpitwpgcmMC6K4mBZtqI8yqMP1Gijupoj4hFK7YGqKdn6+Q6ZFsttL97I00
-lU22H1kf/Rxh0ZxMPiT1JcTwAZdOHIuRG6xPhVIx1hNUOmdUpg3YZa8dMKeA3Yjz
-7YL7ZaYkwsIhMh6w+3xWUiYNkWfmGffRq0DfXIzTkKzapQtQJGLOpeot4wPkW51q
-fHoJ2MNvlB3Yo5AveAkIaJpofjFFZgy9XVPGH2XSAFRez3hixXkV2rWiM+GJAAnQ
-z45H8qWfGnRKSjgqEKVPDlfFEiG78Dtzjtl4oW1gfbY
+BO6DdPxmOSg0eY0ML+rTWOQE+TqrFPFZbeETY75xmP7Cp6q2lWr2ZhOvZEhViMOC
+4U6giC7M428mSp9CPlXQnpk4fHA/4wJlDdWuGlzbMLHPm6hhCPcryfp+JuPjbq5i
+SFxOnvUdnpw12nxCCsLXMQktPMhNsK/A9BFlnjLohfzZpcVxKxA/2mr3Je+3srJR
+IWlOLP17HoDP8UGJDQm/pfa3YdarU8ah9j0AMWOWXMrqLsjsnxdBvqf4Ci72tp2O
+Cp83TkUmHkF8gTKCPSuYVP6aAYkzCb4r/5yqizOdF7YVkv6t3YBarvRi7N6X7EHj
+08/0JiN7pHciyIMs3K++yqYg0J74//I1/TqK7JJqJ145STXhaD3RCDNaC8TUt7E3
+WWa2PEg4ZYS0DXsJhis6iP1abYjiadl89nOp2v2oZOR2PFBLMeFdIZz1yYAxh2bN
+VfI8mSbIZFp3A3Z3xqmmrdPWRB7VVl9e5IpwvysEjbLZ9e4V8q0PXwux7kPI08oZ
+0WfbpHgJ4XL21cBYE2UvSieQ3Pd+M1sgO30tLv6BT3P1z+Y4G2KhpRTlJUE9SlzB
+uW0hiFOnvEPIcNoPUVlnPTiWtEHReHnlEaDOYd3ltyBhA5pxK0z9Bm1oY+jWalVZ
+a2F2OnCBtyYjE/FMJgNN70f1tjxsfAimm6kQ3ca4vmI
 -> ssh-rsa kFDS0A
-bZc7lDzI0kG/lY1reQtVjggoWfLj9/zz+BxmbZfisxsEE18AkYGsk/Ki9ddXFxDW
-5EIbCHheFBvkq7eb5OKcTUf3AFTch2/8dY1hnmR6uPq1Zwgl4ATCpcQPY85+7bPb
-GBl0msNpRHuo6um895rL4omdv+DItmMdp3Lyf+CcFRvaXOpRnFmOqgatZ1bMePx4
-qJajnToar4YIEJBzc53oGWdAHfcmVrvEdOIUNoS3QoyCmusCkMNrSfqmvPfwqsWt
-g+pTrI3NqmTt3+L0EawcRLjRYb/qM/L9/nSFOnYOv3hLzWOhwSQU/gr1ZKMxYnaI
-GxqWzWg2dvkuHlRKVwwf8mNBrZlqQDV/ydOeyjJUKe48jM/PsIj8NVsqRhkgHrkH
-/lvQClYEBhrgHc9Wdxzy4KM3DPyKCQSYxBPnZpFVzuFBKML/cnYU84i7r4Gkb/z4
-Jxwy6jxRzjt+Sou6gTP9dIASaYfMKYnf4ijB3IZLNApkNMBd0qt5qptTCG0LylDX
-eTGGWjKQrC11znI/PWkSJQsKuBDHesL+QmjgJBhPdpl7Tk9ZaI/rJk2KYAjF6J9V
-add0KsLxAZbqlFo1CJO8HHysCRljXob0jYefmnDXO2x8xZvt3eSzVa8JsNLcMv5w
-4/tAdHBfH4mifA5mVdVbeRUDby54TdfIWGAZtyhgvYg
-> piv-p256 vRzPNw A/0edIuqR6hf5WE2qoSGqX18sbslgSxxgmDOc6wNqfQD
-GT94xHQpPOdNorZOaSi7EPdaqSSVjJNB2qaSYA6qZhY
-> piv-p256 zqq/iw A5bQxOBbSgsr6+TL8bgNWl287IF8Zvec6k9oAZPgIRt2
-z0ygD5ZRl3WZjfVA3Aku70mKddTZZ/W9rX2XOBJ9cco
-> ssh-ed25519 YFSOsg R487ufjbfae0x3wSAYH9d4Yz0dW/ze3wXxQI/DCFuWw
-klWo+lmfAMaZVo/gDz07/ht+szuA7YSpvDc0yEe0bgo
-> ssh-ed25519 iHV63A Ond1kPLFFFIC/lSpv6K1uobvXYFmw+yVwNUTN1HIUVw
-ElzaC1ho8F2X2jRZtmAdY9FUMiCs5XAEcFqEPTy6Ilc
-> ssh-ed25519 BVsyTA F9U4uSI1sNELggtM7/VwlYOlg+ghBg0xAQLux5Fmvw8
-4PY2p7QneYIuumlciTmEbR/DwBKVMXxsfRoSuSgfmR4
-> ssh-ed25519 +3V2lQ 6i+WKf5wToBT5vne7ACy51BTAZrzMHCyiQ4D65m5Ol0
-/kt6I4forttfn8SbZ/9K2mvZRh4Cbj+JqmlZ746Pqqw
--- ufN6THtH8xQ83XVERTJFwO8Ti0AJyflJwZtA8V2mba4
-g[Ä&‡à»¹î|þjG#¡—ßúíJÎ<0F>bÆ¤T<C2A4>c@EˆÝÉë}Œñ><3E>m¥÷÷ÜÅÿc™D*ÙMèÛ,(Ï”Ò6Cê‚¥´ÞÓkÇ’°é=¸â”f
Q‹
+cRu4Fw3m7KA7FGrGkC+D0C92Pw3BPcInBXjSlzuAk+/K1zcCTywRwA9RK7O9GRjw
+wDPNcrsu5pQe186PNij4FRldykFBrPwvhqDgfx2lr0E0jZdxMQ//mi5yoKHr6Sex
+95lvFiQpt2+5GJn6PyMebJf+GBVt3gToeCiwwBoUrCva1pibuNXIxEk0E6MCGQ/O
+yJeCeu9Sae0qxNy95XH06WX4CFOYmbxZSBQKfccVjFFwDmmVdpFP8NnuQCB6I+CK
+Ou1RFenqIfj9k/2D6gbis7CE+lK0Ke6SmszQljMvO7pk/EILe1NNwWPw0lMFlG5B
+gJIxjQQW+7aNP6J6jT7R2HEH6NjQu+Bsi4WO7a5b0oIMIXQdeRr00EJG1AynFgtW
+7tzqj+WSBHsvymQt9JyA/ZwlUTn7SfNHIa2Yx0e1Ze15/GNfINXlJgqPqod3aJM6
+9jrmKofvluIFUwA3EXcMzzXVHLDOi6/tp40rq/CIFcH/A9nV6MPrOzRx7Z/Mn8sp
+kmwLcxf/Ps4pEuateFU0ZvZWfxVb4abBDGkHMh53gKTohCP09yFYNaviXnwIRI2S
+OUl6MQxoOM+17ClkX11R7u+q3UxNN1rGKBjXvmLeCw0RS1nknm8lv9AGs/SgaQWz
+ZYQgSs0t8PmvHdZYJotdC6AykkCo6OhWmLd7nzRq0ko
+-> piv-p256 vRzPNw AkURiU3pt8ZyKGLAroxSDAxxabHMWrUzfeze2oc3Cy9T
+l05K5As8wku+X93LG7vTNfHcAK2YeC6nqThSMuV4OSE
+-> piv-p256 zqq/iw A7DcyvRjyVa6cjkEsW70dE8lha6BQAJF+NuN/wRD9/YH
+j8gqPHnpo2ZCyWbsssBZUki7WmGwXUJwFoE6rQB/9qE
+-> ssh-ed25519 YFSOsg 6jKKEapBICrxIIP02TXy7Fn9v1711gUhlNE0C3KSTEs
+p+sGc/8aqd0kYZtLjeOF6QeJDDenALP8h3Gm2UE2eM8
+-> ssh-ed25519 iHV63A FrWXvXyUrX5KHEtRmm6z/upIOO7eq0gruqHkz8uxwSk
+oSe+vJO7xbEb3CiADcnWDk0CSfdsjN44HwZMhwuxpWU
+-> ssh-ed25519 BVsyTA QrTESB1FBYj4t35jhGIv5WXqlawYqPxJCoLJUtDMRgc
+Ghn5PWjiDI7SdjlcjpAfmm2NGE6zXcg2WGwAF9jHYYo
+-> ssh-ed25519 +3V2lQ fsmAPXFR3An/2V0RZ4mCXiiMmKGiwyeTYlsZvVY1cQE
+snqgajEMGwSxghHUXizm1Q2Ifwtxv1/eMqTgNGmaUNE
+--- m3Rt960K96VKVv+7+5F89I3ONU4q0TYT9GKwTbd/PHI
+Ò’
+#ã—…o½ƒþ`S|Â&ˆIÐòúhçEãè	^Ì¦ƒñ:PÙC‡ïmôöÙ˜YP9·¶]n5:íê`¯½€'V]ïŒ@ôñ{ãÈôîë~ôCc‹«i
--- a/secrets/mail/erpnext.age
+++ b/secrets/mail/erpnext.age
@ -1,43 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 UE5Ceg I6uUuN8666FFZt7t0Z/EyWpTALPQKjGT8BBtjrJL8Ro
-4Cy7GJ3RQqmrDpYocWTx31MV8yg5QKUCEfMjAaBunnU
-> ssh-ed25519 uYcDNw x+wqWbE6v2rzDZ8oDP8a/80yMBn5LI+aqBsUO7QktHU
-1s7d1LfdY7bhXi6PJMi67RfxPDF8UWcLpS5cQzuiPvg
+-> ssh-ed25519 UE5Ceg WmBrIUKZmvKuvQe5//QLMLhw6FEr4+IpAHTd1+10wRw
+ICmqiDEkbDGxoVo5x04MikXD1hxWlwxEcmpOFMt5jcc
+-> ssh-ed25519 uYcDNw n8bLEXW/uX6MaxkdnpRjuXVQ/40uuDsbwGpV63vWJ1k
+TOGsv7neJl8aSFqLFV0iPGjVcxTexJwrMHdVFA4JXds
 -> ssh-rsa f5THog
-JQDnaZPrI5bw7OSCOo2d+C/4KsXOa7Dt0140G3/Snv7j/DPxkz+hC+jxLlt/GIY5
-Py6bV/wqeS9HRUlReB9Lr+5Q89yOZhxqQI08zYnpmn6Ipr+ALNWy2jHKTBDHHPJ7
-LSuv46ppPRDnZoy6NEUIlaIQ5EOXAGGVGi6nhS/R5I/fJIF4yk7B7MKur5Mhj731
-Np7pb2yAfAZGxqleYO5I1jTLIGcBIDpmCricg8W057cdXFG9DG3P4Wvi+Q9bvSH8
-cQwhCscUsxwZN4uVUvIAeavo06JqqOio4N3XJAwzY3syPfKhQ0xdAIMiOhl0TYYc
-eVy7llsbtFd7PSu0FTFfWyuqOZNOmDoKghns3H7HCUeFcp0II1+LS0v6QKAJCEIR
-CVtkNbfM8SxFioGaUTwSfxWIy9+usSX8oHYp0SYKYjBCoukq/N01yZIxVVrXgROK
-FjEbyHCyIwnJ/UsrWh3TldwsDSKWbFogO66m9K0d0wJEq26UcVADQi2GLt1YCXgS
-klNjHAdX1oodhr2p0ZURxngYaWuwMgEOjsMtxyA4M+4nbXfF1ds/uj7i7Btn3R6b
-AzlOo+tVKg1iHFGMn5AUTOV7DtltaMxeWM24l3W9v677aozu7BDZQK5VwSSjyywF
-Vq5p0Rsdif1Vywg0+AUxsPyTy4YqTvXRfQviEU/k9Qg
+m6xyDkEy5SHS00Z08kYbmO/yGXujt7m/QCtQaHbx/Z5pvicipJpBudyiqC/XUY0y
+ACnYda8iKXuzCZ2Ls0xe0RWl1lEtLnb/7A8gsQVvZtlCNBZJe92RrsRARzHD/ah9
+IQ3498bktM7N3LFWq/H5ex1eiIxUhkTyVwYf9iDGkO4ui331ZCPoRLoYEBZLtuhg
+GxjC8ZlyyllcJxYZO1MXCrvKATTG0thgiWO1ozSswYOGUsCohBq29/nPo8iH3ZgQ
+07KQfQ990GjvjyjGDHLz2v8lquP+3d06QYTBUE9K6bJ5iDzEgXXeVnYEoA6nYJBm
+5QqVyrC11FGhzkcOTqTbpPKdsm401xJOajXw9YzjemZd+ba6ao74LEApNst2eYMD
+HVuq8h8TLsMuN1tcQYZy7I1EsXsEhuhEg7iA6PuQyBvDnLh1zdj3KMj6PunvFuCu
+f8df89bJXGNo+m+/qQftKTlgz0Epz9JSTvbXwxjelV7TDyrzRPlmhmSIIp+2JzRM
+VBH5lW4weJWN1XfvFWnX4Dhfn/QeuLnp5I/gjxj8xbO3N0905jVMklBsXS0Ak7Zl
+3BkILIA9mqP/Z0BpNNzbxhIlGkX+AgV0IKuBQIQEUpwwpXjHoAJGZPNpbk6iOZe
+EI882rrAfjlsFQadhz3qnmj3AvLIjWz4EpRYPTYwz+I
 -> ssh-rsa kFDS0A
-IVW5AyRKdS2zzPPZLt0qLS5aqb4+C+tFgHfD0mVtrYadn9ugn11+Wk+HKdDko43z
-0rLdqE9q+Hyg3jCVk7DbnsL7lzfLKt6JQVfdCN2qihHLofPqqGgjC9pp8C48EjP/
-ND/S1nrSTq8A9jF2/oja+ofcQCKGZKGC3u8E3UUdC2rmDrQF1CRZ6bW6kUxbEh7n
-fogXy8BP4WX3/LxJxRwaUSQuYMrnA/SvCbQP50Z235xgr6v2+Hfm4KxmgBpy9YV1
-BCuuS0Rgkkipa4SkDg4BdEyWcbTu4JaXTZPJ/6UKdNS9wEGkIaCIENkGIkl7ViTk
-DDHjbGKMQD7nOv42Y9bQJwwcAEW3gN+g7kgD22GW9cpZEFTcGESX1tkYclZiZOIs
-IC63gYk0o5fEuLsCYoE0Jld0D9Ja7JYbVH/ukzJ99rWgcLLKgkC5pEosPa0kex1y
-L2+YDmSKtqSY3YjTFv8q4DVTBKeoWjNHkNaDl5IInhzbJ3k4zZAvJ5av02ws5aM9
-i7WYk+tARjK/Bsl4pEOq5UwdAlQBuAOWUMhjLjR7BN5tWtA/wrz0LfCctTjpwxSE
-vuIUIeJENpjIv88OAWVqR2SYqyTyLnHO0YpreWfF0nj1GTGY//XdwA/kqekhj8dZ
-U70iXnquIhqzuwkMSC2cq1WL78pmh8kkmDbIgk8y1tw
-> piv-p256 vRzPNw AiRbeKSGWFJXI93xQ2+yh+CwJKIl6w9XFvaf1QMo8lSN
-XjzQLjfA9e88kyGeBlLWqhYGSkcFhbEp2G0mthdYRyU
-> piv-p256 zqq/iw Ay5OxlqOR1CuTnrkdN0DbZXU0X3XbwKjj138AO3+GEGh
-UqBjfcB5Xj829ZgvWk5eJk/5kXNE1oXBxOIo46SEqz0
-> ssh-ed25519 YFSOsg g11+RyINzDuZtkWMDhq03pXFK/sI0rrvu1nRgt2lTi0
-KwhWvcS4dGb6usaNScrRUFtzaAbIHYNziY+E5tq/QBQ
-> ssh-ed25519 iHV63A 18otcJyCfFTil0bJHQzHbnS1MktjeryOSI1OZXypki4
-vq7Og0UJmDgclm/MRFw77uGOiOatgPRhlTeEH7kjuS8
-> ssh-ed25519 BVsyTA ISv3vLZ8DHSiiNrRIFPB7YZqcMKkecuG4U7OPAj7hU8
-8ANZ3bmxLZT+i0QCRQ2I/KgcKsdv0YBLX5FoGSw+M6M
-> ssh-ed25519 +3V2lQ qNtNUsgkHIHXGEIjzjPuF3xKLOfeSCeMrNrIdkpjmxU
-OyS0yUzVdtpG+A+OvKVyX8vl7dUKysIosb5b+1qdH/Q
--- ptU7IkkyEOB/9kxpGyi6TS/nx4zIrRnvtCqGiZi0NII
-8TxŒ˜úvþàJÄüƒ)&»ÍÕìkü—Çñ´ï•ÄÜ²‚¨‘úM–&.N¸ƒ½`ÏòS¯8|Âµw|Éí®2me/ð,¿…ôÜ@´3}³pÝ.oÅµÐ>Gvzô/‡½
+f1Wav1leVW0N8QUsqXzhh5CykomCh3VeYE0CYNQU30QbdjgKEDw9fSoUgYEbj/oH
+4r7mjQuUUjKpYOAqAGcV9KWCf0BTwAn/gXHHUnDjtcIDIJ7AC+0CQGm9LHXgmHnW
+AJXJ77PLNRuA+l+Eyy6mSIY4YB+/swA1as9SePMw5gewsYzVzMp5EhocJGj8fQ2k
+CoWp6ombc6Kmh7sFA46pyERWpFzyi6hZErmONctheZjFQqKCIEeuqTvYSn4Z1IjB
+B638M0n2hhQFv+0uCkAouve5TNR32lmcbpnM9TSVz9FWqU9irePdOkU9LqW4IGc/
+LggVDgC/cx7NjKmr26d3lzcPJLuJQvo2KxJ7ALK5REQYOoA4xSsKZTL+qy3Oqqgm
+1rMNL+N9aLBOrComp+p2BvRH23mRE1bm2IwyRQC+Zys9dnIrWw6r0Q+YXWLHHnNz
+4PVz0Q0FaxcAyR+udiAafSqkg1SvXSbC8s5hfLKV+V7hiU38e7sLkRDoYSJNtvDm
+3uhZyOccvPo5ofklvyEGv4Nk8jZlbMJ5l4Rsiq4USQZ7t/wZbrq04AnnpBwCPqmu
+tRP+0n1V1cBFrt3hZ5cSJS17XVL/38plo87O4I+grjpfDggE9NIUXi7y0yMjixFY
+AM5kDhjUukNpqw9brT/3j0M9gTqIV3aifEpq0SUSSMo
+-> piv-p256 vRzPNw AsfnP33A74XRIq1yDvOhL68NPdF5vF6DYwxlwG2bUEmD
+3XAsbW6hVsSqy1ooxhDwakI55b2YqarRJA8PIK8vB7I
+-> piv-p256 zqq/iw Asb1OHUQ12tk6+b//UXPCMnCGzJN9ET5YeL/cDdnespf
+RBflfmjCo17KFF+5MEKwhBEkGURfzqCBkZkPTeT9E7I
+-> ssh-ed25519 YFSOsg tA+ABhYJajeDtrX21fO47/qUw/mpSDod6DO35rQnBik
+BDPGpr/bWqwG85E+s8tTHPgbd2pasvKrqZQfPO+9bOw
+-> ssh-ed25519 iHV63A q3b/7DcjEStfvkOryZIMXUJWVZn1mjco+GcEWlLHDzY
+jIh4VoCoSYLpCGbtsgTyjSoAWqby/EHoMpSt2Mb1iCM
+-> ssh-ed25519 BVsyTA TocNmjSOyr5CJenjOw0gWb+DueDIPPQ0AMIUi+dDL14
+lf3oNdStLp+bzbdhEg3uCsWPpPoqz2OdnRSAAc1rEko
+-> ssh-ed25519 +3V2lQ GXYgAwXZRGGzH4VfodHfig4BVM3GqGQaiihZh+BhkRk
+8ZTn8ymgs28clohAYO4W55RvL9f8Zip0DX5yWpch7gA
+--- 41gdBKYDkcvf0bmpVDejjhb3onORYQyu5ncnnbY5f7o
+Õ’š2;ÒÿTw);q»´Ü'I<>À/>¿5Ã!ˆA0d/½À\*zð4¹`ÇqÆ]ÇzÛÛ}äl‡¦£:)äaÛ´šÆGßÊÿû€Ãd`êåç
_žS–
--- a/secrets/mail/hakkonaut.age
+++ b/secrets/mail/hakkonaut.age
--- a/secrets/mail/hensoko.age
+++ b/secrets/mail/hensoko.age
@ -1,44 +1,44 @@
 age-encryption.org/v1
-> ssh-ed25519 UE5Ceg F7J2BMCNuOUcZhcbEyXBbFHkOI4sVA0qXbRmCWYNBAE
-Na/iuNS8cxz0qEiosflBEB9TAF87sQgwBbUl0/fhmZo
-> ssh-ed25519 uYcDNw Xd8D3eCNMcXrxlYef4kj1N4CD16b5Xs3pfA/J8RJQDk
-UoBSRBj4wS1cxnDV37JjW5kBP2XWWo7seJJsU0y0cEA
+-> ssh-ed25519 UE5Ceg WMTF3HPhmI8Ins4NRnOWJaYVV5qjVhrQVB3u6pmDHSM
+SIlN9oDn1vvdygr+aT3cpM27K8kCa1U962dpDty3Pvc
+-> ssh-ed25519 uYcDNw Da6Nl91XoUjVSBevH9GQ9rvD2eivl4OkdkJN73nV3DE
+t1Tf2aAEUA2SrH+PUGZP6zVptVuj6N7MGgJOuSH4giw
 -> ssh-rsa f5THog
-OxPFa8NRWqy2ShVfYtxqZWfJAmgkYd2xg2E8vNCPoWafo/6hBob7C+4hDiKRZPZa
-EVLw0wgTe/nlMzBLOO3FlgZ0Ceb/uA2n4nu7st6mjwYQpsmVXwZoap88B2b+GYCs
-GG4sgybkZ/BrfFgm94TIcC1lr2lMjA6C4xhC9Mphf2iEQf1wjL4N1msOC4gTAW8Q
-zaH+K+qNEbTXne5Pox9wp6FjApSx33ldqRxOSzcf7RUuL2ew/63fTywW8ZdHcUgm
-usKqBZX9vyhLdsHzZWSXwetybMfKWs1ry5kU3ekf9EmAAkSiukFxFdr7PON3l+VV
-+hNFxi7RBKGC2u+ZE2Oh/MdXkKHMIVuJE1yhUJyiirH9/Mj2S6gOpSL7pjXIQdbC
-RoGoE4fHWtp14Yn5X2YQCeGYPS+y87md9qKlVTzf29u95UjVkN4V8xwquOssWp/P
-qlBJscmU3cp+U3W4Gzh1k1IwdBQ7B26rUOFEwa2/DI8VsBd/x4WmLQGiIe0VnOIB
-YCekxeLrl4AAf/XTEc/qNTaXcn3OguMMq6KzyeWMTdKsrcw7/P7j+06SbK+Co57D
-7zt/h2dDeAEz1eo7yGLu/zd2s2iyEBNxnzvSqvRpYAkcNNI7DvNfdotDYWj0kbuW
-rKfPKnXOUvf9tKsjbd1BRI563TpcoL3ebnokhBfu+v4
+i4ljKLG/zVZPdCoUNMVK9jg3zMEMaP1dvtSyekb4ZWX+0Kfd0NHsi1z2bx52NnYp
+utjcXRvuRqd1dtIKe98FKHGvu4M1VzIOAvX2ALyrBtXCwA/G3nlLXlr5IKd90BR+
+2NwH4Sj9SEW3CbHEy4yeOxel/8NeaWYWbVmLv2q6x7J95ta3bwjO3heoskL/5ce2
+k84IrHiDNoSdx/qMyuz0K8wyOopViea4iodevPwL/IXXDzG7OJeoDPN89z+FJ7Em
+biK03qj0ONvD039mRlgGromum7U/FZE/jcbJcAhn/wRJpcfMYk3QRHBNhcxYvLhw
+KBsbQAMJmVYSbuyNHjQsQBPs+6Ujh1iDsxRtJCcQAMaKNfrHDbEIDugcVroyBGLc
+Z27uT6vyqIp/aDBUZMvUsvWNklVKHttnaZlLdrYgcz7GsbdufZx+rtCXklaei/Zk
+oc3+Ar6X12Z1psZx9U+VobBkvlrMzLnh69+vk41mOm0ZGX9miQSAy0k+dyqRDMZg
+5QjkXPZ/5ilsG+QXWIDl07z8OnHcy3nbH5dK/5NABl1NmVgTEpJlq5Jl/2BszwlA
+5dUi2wuC8p4wFXAB45PqQmogRpY0aI86FwjFYU11NNBgW28D4U3CMq69WLPbbL2R
+j2DSBvRQxuaXlUsihOSGmyipvAmuHCukpODgl57y1Hk
 -> ssh-rsa kFDS0A
-k8vywS465lFJyN/RvPMx3OUSl3UG2phrlZ0QY9BL2Gqf79tiSqMrWFCKqeZ8Djg6
-yDNC8F62IwWSQB030iWQMhQfI3FM9BFepmMpVE3zviyg1WRTNgLl9vdpjLP4FuNi
-Il5S3T49RmUgAzsPGMs0UWLhEudm9tJOU3tI3XD32tG7mYVrMcimtog8/1zasFf1
-GE3H3MyBiuawfSu0uMnQ267rxYiGF75bI8Er1nI7zIF55Lw7twHLjN+KOlSed3Vk
-VU7tNeRKfbircTrfxXo0I6SVPuX21SfBP5RWq4KrO/h4chW36OLxza2eiRvy74lY
-/MekrH3PgO0q7y+uqeSbiGAcvL1UXeZFFdItv5pKxMC95vpdsEhoywO8Rj6dd+9q
-iQjmy5RS/HC6uDzbqAl0HQSq1fZXO3UO0fQg5Rv3whpKMBHVMTU/PVimP93oAu4J
-rXnUUpqpKJqecVDYQT4XSuMDK5Iw+S+7RLxBk6hIYsg0jtywqgwD+zF1S8RHi9kK
-BEX5mR3NC/B+LdHAzphYQkHuY6UOk5AcgMO5jYCLtVK4vqlvTJPVbTSgdO86rmdy
-nZXZmi0Uqgz8QEdOgIp0ego8WdqGkZF0aQwMUw11Bi+78Asx5+hy+fUncw0qZndZ
-04ayMacztVL0cEaQ1AeOf85z0MPOugcVYFvih/XkgjE
-> piv-p256 vRzPNw AyKY9szzF5MMfOBUISqtfu4EVk3GWOQ2WSqwgn8tCE9B
-uoSrnNdzVP1WO3uZflc+Va6cT8y5AfUpm8P3njiSQzo
-> piv-p256 zqq/iw Atu7Vk8b6dyNLZcLFtnOkAlYxOMN033PV/bv8O77LORR
-jbYx5/YXY6LwoFvOfXHHPhTiMOMLwgbENvFzFmGf6ak
-> ssh-ed25519 YFSOsg BCuhqDI2VVkG3gk927TjEOLLOQNeURfxVbGodW/Xh2c
-lUEeZrF5FSC/e6XRxWNQq5B7oC70mKit56AIrWMTKCY
-> ssh-ed25519 iHV63A Job9bw0T6OJpmgeizCOyNGqA9YHrcbml8sj+9kadKVw
-4+pfaDyrgXuj8DKQzMj04nk2KRfobvQ6Z+E7RDOUm24
-> ssh-ed25519 BVsyTA 2cN+HWBYc7mSbSEziFpyuDfHs7cbVd5Vdfj7NYNJ6Uk
-8+APjCiQmu9hoqffuqdJKk09wtk0Ywa3NqeURnP+n+M
-> ssh-ed25519 +3V2lQ h+MbnwkJqmQbk2gtkyWvU/8gqJHYIG90lUH3AMENonk
-wXsXHxzIsP9kSsi3mxmr5oujWL0Grj7y5inECZNSuIk
--- hkrqXuu9Lldhr675cyYUX5peiFT2s5ZMjIrOi7oRIyw
-ê®è( <¾i0þøÃk$bL
-ø+ë©€¯ï¬]–†úß…ÑÇEÄ¢¦wêíÆÈ	»µ¬YÞ†é!0$šiôKÜà0DXæJdBÍÕ¦O.V×S¿‚ºd€Ä8çSƒ©¢
+lOK5MYqTwCrZG1rs6MVY6v5SaY2slePiZ/NXdWi9w2t8Bm301u4xfVcCaVK8qjWG
+5gvttm/kbgp0J4FfX6egQotZADcHrJe8r08Vzu515C8cY8DuDSfiV8gVyalb734A
+5H1zKFhPuxQn309I4xkvDrrHJRihoJdi0klWWUloDZKQMEAL8onfIOAx8TybgInS
+Mlt143AdsihpXByi+ENcDJ5f3O89jxMPmkU+bqT/VaxzMHmc6pDZOtW8iVbXV+y2
+YJ0SaCR0Ens1Qzghg6UWSyZpEYwN8dNgBye10qh+c1HwxlTnhrpsZVK1WYiB3eZd
+5kAxqwkWULRQq80ip4Xl+Pj4rEFcXQAaY2F1I9xH7eHbtf6YeS/0e19BPUmSnqaw
+yyLGYNIDVat4TCL0ArZkJS7YStZHcz9Dy2UA4ZhsN9Ph0bJyJfHUjwjx/QkQERY0
+I1JJOum96dJxI6Rz4fSp7vZIdJyXC0s19Mqoe9+fcrpRMQs7b1pPsOS9HM/VRCFC
+Cvb43fKnelm2Ma5xrtHTh+xR85bzkfv2MK4k02X4tGoQL3Cfre6HlbmAE3JqbX0A
+iFt2FZ+3JMTx1bYjM+kZ4m8tuW0iDBHrnsOXmNQivY6iSNAX4IWRdbmvJrl41XOt
+/QLLz5vH7aOvhJu5SQK9Mo/CseWJ+wfidRKwG/nTzvg
+-> piv-p256 vRzPNw AxQJlOp7/sGiMhrx5o1dYnzh/NC4Ju3ULKYXaQN4RmP3
+e3DWL3B4oyRdPHdIWgpZC/ag8kj33G7DZriGm7Ag1Vc
+-> piv-p256 zqq/iw AlY9wO734eTOrpqepjPkkjRU4YBaRwk4i2D2c2VE+64Q
+GT21H3jRaU3oa6B/P4v/5yd99DxDlQmk0A6OkXeLIRE
+-> ssh-ed25519 YFSOsg 25usxRcYzCFBNBF+GPMlIl6+2l5WEEhsQsZ2OW9QFVE
+pP5xKthh1N6xMQW8IAaH0IYI7o8x55X8vlGcHHBy6vM
+-> ssh-ed25519 iHV63A 9UKMa4oDS4TFWQAtbbwke62OH9QYkC6n9aoEdNiNOVI
+AQrV4g2AJarp9VDdNKG99ynxSU0u2jGw4xflcSdHDR0
+-> ssh-ed25519 BVsyTA 7ahdvjlCNLLty12q5aFynuixXVGDU8B2ZWoXxeTYXDA
+yKBmqNKibs3B+xovVJIG0g3I2sCRj3xOQ2Y17pkiSUY
+-> ssh-ed25519 +3V2lQ 9wG+kwXvabUdkhCr4DKeZNIgQATgEi94gkB1Za1hqEg
+l0S7WeQUFIPjp19NUn4H1y6l5zAmeVL0kRehF1zTEE8
+--- Lz1ASOnZ6Gi0askjRf2C90AYiVpWZfbWCu1IOMxkdTI
+N€áÞ7 éåßž‰™[Ž=<3D>9ÔÒVòsß%pO…ðRdôÝÅìF½Oå$[2¥@Pàâqï°wà
+’ì ?!@M£ëi<>,@1®Ö¦æ{DÄ¸@…<2¡Ír…
--- a/secrets/mail/teutat3s.age
+++ b/secrets/mail/teutat3s.age
@ -1,43 +1,44 @@
 age-encryption.org/v1
-> ssh-ed25519 UE5Ceg NVteAXOZyA8sjXpRU5/ttHLFvGnzD1k48gWWd70erwM
-u57XR4AZoHLagd1/6aiYyz8jNSEtnEGp9Kc2kOHwq3o
-> ssh-ed25519 uYcDNw CDCJGqbJfqR+8REsogbO7z2Uy4VDiWlLdd7FVUIHYn8
-OV7rjh5kzbGzwcKYsfgZX4jMP2pudlKEH8biFLvkeZU
+-> ssh-ed25519 UE5Ceg 5Ycto4bR/WdSMjxm/aaS/5yRjNoZCfYx2qP1OZFtwDg
+BmZST008XM8zx0KvekcyqQmO23FM/kyvEIWUQ0fLTM8
+-> ssh-ed25519 uYcDNw TKRWYnIyipaBLL059gM1RzyrDoSwVgn3fTO4/GZX9wY
+a0W67aDBXQXdNtwx3gS32zqfooaIFbaipaKjWzppC2o
 -> ssh-rsa f5THog
-DTPOjmtjwHBIOxCcvDSu2cJBd9GHBD+0t25w6CaU8lQl3v1ZJE8eOpxV9Bs3u07Q
-BTjPeGp2qyXxvlLQ7hrQfJyhO7pN+Ngk01MRppFN2t83XiHi6VdAHTwZfxndNt/e
-elP72j5octVrPVJVjNsZSJH92LyZlD4/PGtr31VdzW0/jvjB8bjXqQDEhlhs7Qz8
-9gVT380VmZv4HvXoSgyCT2I/Rmij3zaRX6JQVkKV4YuNcuqoAHCmcG5SgEtesot1
-h2+zH5lewQVB00Airi/hnYbTanyv41vmvdejT6yxrLyCMUGHjX8zbKzr+kXpmywo
-AMraBh47mknL0XKAvqwsVRWh5JZI75sWI51Vs0o8N4k7J4FXc6TOvB2o2yGj+C+8
-4cHLqC967jec2wmDdC0K645Bdm0BdZmp3f70NYb9ts4O5naooYCIRqSGgl11J9Nx
-vfGDVsg+FtMTbk3UN5kikoYltBnR4wOW5TWYeZ6NaB+VTkB++lcFVTS+TyN1ejhF
-H5N0QRhG5NaEuTaTuDESudgB3Rmi3nkKCcGLWPpPnrqV+ID9zsoC85DFHNjM8eVO
-hzeMQUStpwp/AMfJm94GoO+x+6xXocB4+2Mq1hnv3CkrEdCFQGhH6zSTJCrRDayq
-WD/bqtJ6twBmnh+jUPUBxlmz42bGTROznoXjC3slVxU
+c74ld2aFWL8NIGcnEbtwIlu39Unqx6Nv/txciv7KL7CGXzYR2tbBEEIcDplGvdzw
+pYyTer4DK3NdSyUIwQP3fONPQZx6IHNApr0nNFjPYjCniA0EpNL3D2eWNx6Ned1k
+zH2pVD4bLC7QQFbHT3XEa6a4bREfD9FJnlSDdjJawJSNxPZEYw8dUoHVrbhgVQam
+izv2MXmy05MLfpdErHHXjFHV9+1N3CYXXR6L/bFJBHyjfTjuXe0opPrrfLp2N1Tz
+8+a6s36h7V8soukGSxH8OLHCtEU8OcRuEymgfbF7/4a9fCPYaGx7hZNhevAArmuA
+0qE0C4FUBcuEGSjbLURe04vTzZcv+SZxmy4y0WTwvS+Vc4AHLppGeJbCSXv0UFAx
+flEJdjww2LODE0729I1ChnDJarCrV+gkvC1j5pAyNIEsMKd+yKAESAy2dR45G13H
+VmG0QeEFfALc2c04atcud6VNcmcb0saCy1jEXvGbcWe+3yEhvOMPIswMUZ6dagOH
+03XXOczo3yQwb94gAX4oMlU74BJRwNSDQcmIG26OfIL/nx00QjHZ6MIQzwLEuX7X
+Hsy/b86ogIxvbk70wdiBNngvBMouffXFyArHoyq/w2pl4Y+YtJxSuD4lv+e9iuRH
+ISBDUcfIkWqI44FFV3CTFuBgNY64o9nw3g9ODYATu5Q
 -> ssh-rsa kFDS0A
-ap5x1yM55tQyJZRa5EewQwQlN/8FJXZ2JaZhAxP7TuKE0X5OqLqdh5sfF88vG2FT
-RwDImVDgAbCH/EN5DPRReW9XetmI/zC8vpXiqL5kNPh+pC9P46lVqsA9N4SE3AYk
-4XV7V8Z7MYS14vi0d8DFXNEBtwXAM0s4ZfOfEngkjUvOqRC9qCpSemMjrfNhvovP
-xjlwsh/LlEf7WAM+xPzNnMJEgs9sC3wp0+RdBZhjwSBiUp6lpmCZOcUyxKgwqfPU
-mSiQarTx8FZjurF/QZCAIyRGc5vs2mgQpHGOduWrPgLLwEgaWmOCz4ymdI60RJ0K
-qTD9EVDB8HO34+uPQWPvEJbtNL0KsEKjltGW661MJbQtqTIlChnzCsO79aqdqtGW
-wmOPGJJc3NMocVII/IA4mi2N/Ev5fnKK20Q8vQdsLW0WD3cm4zCPyIg+jiisC2by
-MRafMALkVBwTZYvjntv+l6Dlq6Q9IPfKPPi43UHWCv89yDrh19WxuM1e9lwYkWVl
-GUB9ncT89ETHm7IHzl4wtiogrTJbzFr9A/oBQqdIBvUYHP2HwPdDiPV9NCFHnWke
-4BzU8QUetQWDCvYreIxZobuJ2ig4SkBNsqrfb9ZQGS1lRqmkUk4J/38s8xAJpBR0
-KwzkEhJt5Dc92Q9RLlIW+QujLUEh9KjQPua/qb/1TYs
-> piv-p256 vRzPNw AiWs1Nt6wGKVg0MqB7tHu8E6Wscj2Eo1xhxhB+/BZL2b
-pRjLl1Ds2dhLXVf4Im3Xzr3lG8vq+VJ1/EaPSAD5oiQ
-> piv-p256 zqq/iw A64X3dQLMlgBuY3E+NRYn1TSs+CYq9JNDTgyMk3bTK79
-/tjhPEv0KwN5dH93zRvMFzBZRayjXQaQZjSHeW2etHE
-> ssh-ed25519 YFSOsg a9MTVbDi1sA36SeVRnR51T4G2X6Wx1lx6VBI1bNsjFY
-UDUkvNwDXiuWc8XsVeFAW+WATZpKlJsKc+6i6ot7Pvk
-> ssh-ed25519 iHV63A YwhQZF/lcI1OosRxfJ66wTcTctwcRa0/zY66U52G9VI
-HMHAI6FmX1DDq5z41/VomhCvRkJ9fIrxPEcO+aUIVp0
-> ssh-ed25519 BVsyTA JKIbjoFUd8CNYCjYjxwaLersAaDp4yi/eN/KvTOhXkk
-1u9t02DQFgL6iN6e8HylV/tc7KpDlv/6hkulcNisrWk
-> ssh-ed25519 +3V2lQ JJJAo2PVKGLTAFMPBGOSNfYEGEjkCPlRtxqBjFR9yDk
-PWm5uatk8fzhr4gK5XRgtdvTlzYRBUIEBfH6+CROyks
--- FZl+1vvJBe49ofX4ncsNpdtzFmG0upDcJ3j0KUmXxbI
- )À+K¢\5Óö4$*Í8ÄïÖ®£»ŒÙ‰ªxWõBÁà<C381>DÜ@æôIŒr¬HÖF}æ:ôÞeL	¤ÍáûýÌ•´¾qÓ½YûNCºùçíùŒ3uN–Z<E28093>Gža3Òû|
+bH6+SkWUpgXdz8r4RyGNJKmjBjcx12xNy6bup4cLsFN0gr2HZ/RJ1fTM6zp7pULa
+LUyE1i/XUe1ZN3cfivCOVdEGuMS3P37v+RJYtQILvH0a7EGUBYjAPSKMhQRp7N0F
+tyNPbh7pGM1m0eK2Ws/V14zodGbDvqSwX/SXBxn8iPO2l5opy7A1K9GMGvvRJFiF
+Ioe0Jtf5rYpaXfyfH8YvPda2cK6dxxEs17BG98RkdkGF3lzfseVlX9btyIi+0899
+VwbGUoWi0/Vf0avuRR06J0ksJfq2AN3zswLEgqyeytSpVU6unoiEE6lN8DsENKrb
+T53NxtyQPgfe+VGp7j7LNdUZQSIC96ivQwJb/QmJDmiFu0M1UuEEUbeDhvJiEuhg
+tnfrSicx2avkpj5mJpAHS3y9Cbfn/wY1kiNW3TWtCqR1CydcK+bE5dMCsbQl2qsl
+txp+Z+y0LWSK8lw0PpjmYE5Tn+p/4/Ir1QPhi+fv/9vr+ari5wqwsUEXBY1ugTKf
+4UyDSKZq4V+sDF75/XXrtBOZGyUUiqjK90YWk2Xw72Xr4XlsAU49qq7wvWGvSmTs
+LfvZbrvaH0SHDvlkowe4kAA3KEEjOUSOnaYlWOAbnFbl2KBOvFMvHyVO/5u2C/UT
+HyH0rsle8xYwNdwNeWBbbVvzx/y7yR0svd2IVQN87kA
+-> piv-p256 vRzPNw AxzTl2axQ+fxapCcHWpvbqX469UMdcbGXBhINRR8SeOP
+4gfX6vY9c/iyotQCLmlCtrs015qRjxT8uGQr49/Y6Fc
+-> piv-p256 zqq/iw A91keTk+gy0p36fc7TN3Lsl/t4Vp/2NPh4uiNekRO/qF
+AUg9OS73eHCWPOvnGfQVkGW76upVxz9+NzzxgQTRBlc
+-> ssh-ed25519 YFSOsg 3BhEY7Bm7qpf1dPcEQ//xZcO7g82PUUyvfliyWeKSRA
+NltHRhBWz9F1dzn3wehVba9KUj1d41s8Z2AMP0lTZmQ
+-> ssh-ed25519 iHV63A 8Vdid3iee/89Vzh0rs11o+WVf+qeav/Y55hAJH3tm28
+Q+4bZRnTBsuBLZJ/bt0XpfHDglztXua3AoMAVqhO/aA
+-> ssh-ed25519 BVsyTA DpMMf/h5/LQzXqtPSPHC28lcROcJQT2D8gHTpn7uGmg
+8mXsjAyqP9DWtOVZVvwZeELeX5Bb7d55XTx3f/UK6PM
+-> ssh-ed25519 +3V2lQ BIZayb0lLr8CWbOKxk4zcCOK4TiKxi3V+kfLHf49XTA
+7R7yfrMuvwpF8rO3OsSFFw+O8C82tjQQf3IqoAB+PLM
+--- k4NkvG9Dz8dQk44w3zf9prh6xzg37EI37XMnjnlmkP0
+Vó
+þ j6x„‘íBnx-„
|öô’	ýÃJ|ÿK:P6êÑ9¿b¸®&O›èàW²Á(¿	µøbù»D2\ëÿkì¥i“ã$Ü<>îC¦bò!
--- a/secrets/mastodon-active-record-encryption-deterministic-key.age
+++ b/secrets/mastodon-active-record-encryption-deterministic-key.age
@ -0,0 +1,43 @@
+age-encryption.org/v1
+-> ssh-ed25519 iDKjwg 1hTwlkE1sBAeCz0gf7XU6o0iMX9NXcqs4dFKrmerV1Y
+QTRSr5Ab6redaWHmSkGv3QBDOTCoN+0bqZnWTkUXw+k
+-> ssh-ed25519 uYcDNw FJ3Jxz2Y1uz7cZwYw+IfO3MQjoXkO4OU+CIeMDa9Mk0
+MgTZesZpxk788OBPM1forUuxIYFKkpsnp7NsEzmx9M4
+-> ssh-rsa f5THog
+JH7iLrQWeElqdYWVwQJIVh7KjBx2TmfqUekwkI0FA9ikqaWM9byewNkT+juu7egY
+eZol4fyx9WLVVNI0P+Gc64mi1K3DzW6IzJT5PN24TSOeVggj0buKRLBPZeSroCL8
+mfIRPJF5esA0j2ohGOzZLA1cpeHCkAVU6tGq5iXI7w883AOhZDZHtEJWJHE+QMZG
+9ZaSnGPLeAiC9xFjxxUQRuxUAE7nOjqoflcEPcm1/OkZoauqsJGzvNl2L+b1D1Oz
+wgSTTSVxsNH6MDKmuxZgjPLUpU9rbi1/ylfI+caW8SJ1ygu2yYhTh+KyXiDjtj03
+ZZYBjOw9bR12qiQx1it0OaxJU8YPGAlBIN+PZQIQrV7j1KwGUfsYXFmHGdRehK9
+7bVcDMeIEPYorQWiOL59zolwQ1u0Y5oFPJBiXxDwpVKEwen/VzYCtJwCDb4eIfsS
+AWLARmnRR2KIOJn6SgcoqBl8OfPntPjWr3KjvfXXrH1wo56Ba/5c4her1S/wQNh1
+MuMLE61WgCcR5Pn14gtuzMh4cqt2UN4kHLQi2KluRSa9v02WhWOCyf8AJFInANo5
+tdvM0asCAAE0vTPqk1/gwrsIAdATjC50lCyJsmUZQs6iMuL1voihWfZ154CtRS48
+ji8wKDlOuIalbzq9/kQUa6vM1kaHqq8LoLtw5wHFLJQ
+-> ssh-rsa kFDS0A
+QkIAoXUvfop74tdybgxTC6l4RSJD+QcSnCMadA4fQhfgvxftXXAMERPVmWS8L8Rr
+fnkb7WOsLKe5uFwDBAi/stjNugtjxPE6j4Hbv0LxyMh2KzsczRKQjdcEN4IVjHMi
+EZoePsshDJ1ND/SBhfSqQ/Y3N7g9sEU3K3oTE70hGX+0MOxQYz/vhw5VfjwwfihL
+n4Btjn/kmUALlWtox599tvNfy+Tjq583UdZNQMHakI4bust1FOatIdJEz4qHVb7C
+XJ0QnqlJPqY/V8KF5IOh5at37U2raAp/54RDAAziXjLnbeiCIFGFpPNNH4c1XMRe
+MNcDJQo9VxfDreVAWUEjaQSv0xK3bv64A/RelDCvgQA9+4MBDZO9i9PRkC/dUf1C
+0UzNT0pQPR/8TmAo2S/XcPYGaQif6g+OL0dvNivKNjhpx5AUxR+nImuIRL5c4H/P
+x37O6iZbg38B2g6l4oS9kOEALr3zithv7k/J9tC/5kOtXDcnDo5nuLDV1+maASnk
+a1mKGF+NnJNj9HfN9Tf5v1HYSgOHjH1RXZWaSUqQEaaIJ7jKg/hZroXUDGEZxU0E
+0u9rzeoQNXNLvTJtZjO79EWLlp8C+CryfVgJLBELe6yY4FcLR6TbB9t1bWT3VOnf
+s62sU5fpsgQgQ1Wv4JyEPt1Vy93JNPQGrbnI0euFQhc
+-> piv-p256 vRzPNw AmLneGaB8PWxhNVQakxubRiTfQI8ztGWXsZv+eirFURz
+N5bR+P/vKP0hgnejhIBEMG3c3fbnpTeZOsL4FTQdIiA
+-> piv-p256 zqq/iw AzQcsc5Tdm4R+yYGO0TDiDyEkXlsdqhZm5hp4mAj1CPG
+Nxc2z1uW63Cl3N4cQ2T3g1/fju/bVHc2BwA8VGtL/Z0
+-> ssh-ed25519 YFSOsg iKhgZjb+wldSbt6GK6RXHVOmmHIy/q1kvwR/sirvQ3w
+0IIhK9FhVl6CsdDS6e1oqlha2DfeUZ/Bs9MNooPFTpY
+-> ssh-ed25519 iHV63A u5F2ywZTiWhB19r3ey9JTzho7za06Cq8UISh4G1ApGQ
+NpuI82VTuaZdqGKyftNIrYhr5KAkh56sf84J9aw51+s
+-> ssh-ed25519 BVsyTA kDelsR5/FRuItCOMX6m6H7vyLlZRYyMrb32Eve3lMEY
+sNGS7R6zqSLT7xNJAJWmzWfWL0uj5QnJ+Gbh49YfpKQ
+-> ssh-ed25519 +3V2lQ idYZrubfci3W4Yn+3pEblXOQCf1UoyA7cxKnFmfh3Bc
+OMI1yg67nxUBH1xj9NikqFVeCTqAWa+69DYvB4T4uiQ
+--- 7HlnH19UqRCTjysYSSUJGrdsK4ZduF8+k4nSK/3JDq8
+}sˆðDéµYá–ÀMÔŽzS’Å~ºùÂ…«.Qc¯¶d("û)#š¾þý*HdºÓ…Œ%/s¬g—hé]½m}
--- a/secrets/mastodon-active-record-encryption-key-derivation-salt.age
+++ b/secrets/mastodon-active-record-encryption-key-derivation-salt.age
@ -0,0 +1,44 @@
+age-encryption.org/v1
+-> ssh-ed25519 iDKjwg dNFZ+e+a0AjH6Gs5POmZVl9bSXREvkqx1lSdmOq5IRI
+ZPEuKmVDwWgPL0qfDsMtslNJ7RG55MPTQjlBL2iEJdk
+-> ssh-ed25519 uYcDNw qDCVM6EndKJxZUXOUg0d4ElU9vlMGS9mJxELjezs8H0
+clZ8JJ24IPAd74jKyOcUvKeeanxm/Cy4b3B5mrvg9ds
+-> ssh-rsa f5THog
+rjdgXMdt8KqI1qJA0hWkF3SyjsaDz0f7AwUzcTY7hk5ULa98mCRe26tmWbTiil5D
+gchbehmLRy1JTzahUw+1xLH/iZzo3RqXCvzjrBoPCM/iucHJZPHpLNoOTtL//zXR
+0lZusQaUZ/lQrjCwyMwACJ9DKv4QiCIUfgYBzZGq6oLMYiWpEHfZQ7tWiROAO4/T
+cCCvLtM2LQ5Q5vZ5cCdBQLxrAZz+OnPgXQRAoLqH5WLMIqleUhkoVh8JoIzww+UG
+c2OKazF2dL4djnujrTQfS1uWirfmkpNW+TKrKKq6q0+cLOMjc/eLjOfBvgD+yZuO
+TxnkRRbOGNuc8hA+9FL3A/yfYk/TH78eQ27aiiV6yaX3qK9KcPp1/vUe+m4XguXE
+8LRemmCVazYuYKXzh4jr+ecppVokKep3tzb/eKSjw55xx/PIcG3AV4UjuN3Vvtdx
+BkP4/S/jn7tEBlNc1DmkrgmuUF5iwPR0CTMG1I6gxUkjyxWyPKntq6wegPT4QMRE
+eePq6SjKOOH06u4W1z4HM1ipMOK1VJrozQabnmZnhbE2+Gfy76N+Fe0sjG2iK/pg
+J8v/KT6BrhR0PYvGJirnZD0MvIlSZA+xI/FpKav/Y2195Bb+LEJY+nJoxepdj8ev
+d7N+J6g5Yt6SN9BJS0QTmtatFlTnfsU8nAYCEVB1Uxc
+-> ssh-rsa kFDS0A
+PnAXBG7IsVdWs3TEthQFSDglnQdZlmBzhYWq5er7Q32i06BGw0OJp5c7VNi6zLFd
+EOSYtdZ8SaK/CL7m3LROmv8NraVst2ml7zKeYPZ5/xHLVBb57SWkFYZIalMpZDr3
+IVRxHifZVS6hgdCa5MWUotOsdzbStUSSh6G7TCrP/LnCeh/abOXLkvqLj9NrHeAH
+UOb+Sxay3y5jUc3OBPGWw0LzGFa8S0vKhqGYIIMUcFBoenQ68/WYMMt9Lc5nD9yA
+fiH0ytkhZVkPd1+0MQ99dpCgUOcK7SOG/jUDIOhVJ8OQMoqovaML0Kmz6+Csj8l3
+l+iMd19D8CCK16dLGDi3LdvDaanIHq7H8vOW5ihWgV313aLYWdYJDIKhyn90XO0b
+SjF7dFuPxsIb+8r8/hk8xPdGu1cB3ryfEUaccQF1f0q3jBaM1RZ5Jfu/0fVHDnOj
+9c1lMC2MvwBOFFrNo9GzKjq6ezLBb58i8fV5+LZTVOgMa25BusCpnHW+KerjpGb1
+/2RK8WoXoviGAAaPuIp0ttD21oj7Ba7ZjalzO328cTlK/J6wp6qxoJOC9FuXBZCf
+M91kGWavS8Y941kRZJBD14VhLQeIjzRphnR64r03kv8HyIDSAmNc2sDOoqji1G4Q
+Fxs1oKVnSxmnGWazjmxtOtbDMhJjJlLyVEJOxgHXmz0
+-> piv-p256 vRzPNw A8qqho2hbHfodtF8D4JFu039UlMDhXhIy1lzqOBkIpIB
+CY5cHkLTHhhNIq1s6iFVGyKyIMemO/my/GmnWS2we08
+-> piv-p256 zqq/iw A23triY0bM1tpn20GXCvGCcWny9dkQDY6tP7du/HmJty
+vXVsqP2j6Kf0mwb29jSY/qn1FFnmQLWVEcL002MT6U0
+-> ssh-ed25519 YFSOsg KZ5TnAoRXHKCIEg1eoMO28saKhKmG08lCoCKNnWaOTM
+FOOqg8s2cVDPAiIVmYI2UkmpXWimQE4Sy+gCwH7oYEw
+-> ssh-ed25519 iHV63A mlcNQxplVIGOPIte0u+vibNIQtV1FCzC5IUmz7183SY
+5IlGvhYYU510PkdyzdNGgFfS9f2rkU1dMJ2Spt3RGls
+-> ssh-ed25519 BVsyTA s5BCUQJfI9Oo8XclNEp9ZJxklF/OwVECb7vFReVQ+SA
+0U2S5Y2den/c/5wNt3RI69AaURAZoEIxjoL1cBtomxM
+-> ssh-ed25519 +3V2lQ ot8xMJdVEzGv0W17UMaOvDp5ltMV1t8zrXhkpRjwrEo
+M8ky+nhQo/rgBZ2gzD1rf++MIJXzrkh9RmGOvL4cqV8
+--- 5RnhwI3yXutsCzaH+lUK221P8Drag4a4LWW0vMJKyis
+P£v ^V÷ä]zù;>Ev»-äŠ½Uª¨}üpb€ð2žÆ3W?Ôo¬!m»ç¶×
+ËNÌ	7™—"•Ÿ'•â}qk
--- a/secrets/mastodon-active-record-encryption-primary-key.age
+++ b/secrets/mastodon-active-record-encryption-primary-key.age
--- a/secrets/mastodon-extra-env-secrets.age
+++ b/secrets/mastodon-extra-env-secrets.age
--- a/secrets/mastodon-otp-secret.age
+++ b/secrets/mastodon-otp-secret.age
@ -1,46 +1,45 @@
 age-encryption.org/v1
-> ssh-ed25519 iDKjwg iwPq9gFJSw6u3BE2oJUAnyEzqIBex5cOg6kmILtXE2Y
-w9cqOdAkPCO0ev+EBCpb93gbptvlK8c7hxwUuUJnZv0
-> ssh-ed25519 uYcDNw GBHPUyUmcy6e661yMijb71BPuTW3UvUk5qJT0OU5FCc
-OuWrIdz2SJENG0knN160/64RHEoBguwAK74d2dBb7/Y
+-> ssh-ed25519 iDKjwg KInpfLUhAWIHoCUGACUgWwdHi0W2H+8MVtaU/QfOjxo
+6snIWaEWHq6aylghdaiGH7NETgVqH17fq3cEMIgMV2Q
+-> ssh-ed25519 uYcDNw xGIknP5CTrf3TDFQP2j8OXlDcRS5chAkppgmizHP3mU
+/jUJLtfpsxysuwvwkWR9KAOrcvQRC0YX6kkY/zwt5tM
 -> ssh-rsa f5THog
-ijc3QOsxqytpl7hKMzuzuFLHEFPf7TB68OWRwv2c2UyHRblKA5ejXTL8DfRUsPwp
-vLt306TB/XFYlWonORrW0lfKPwnhqXwLWyVX0KqeWobYBkta1YNothy5CLrvhcoG
-WRHJxA3Xb93X4WDtiXMcE6gLQvK4WTHWXAxRr7xz7eywXRcxc6x4GXsvojFG1uhC
-lX3yQvww51QRFGJfrU5LBTkjuh/V0hoFmJoH/2EOBb/5+j/Q9jKu43VNNQ4vpFa2
-lNw6jtYf1610T19Reu4VNeddE7Q3uJcW4K5L/dfIBA8jfDHSnEA7A6a1VaT9zMNp
-mfmhvLvpnJEEDpMU9/ekbdmFUYadryPPjTEyKTv40/yhHf8ynDk7ou4MBkCvBEBn
-KBwCOaYwHW55YuynzM3x9e606RN3XXOxcO056Ur3feeAWhjavXeMIsPuUtXWZD1V
-6uBi3WPrmV/uAZKGgdBYZEEJgnAZZ9HiusBeEz74tSBJG4iBdty3bl/Ji9OwPwc1
-obXdpagjFthphy/W10S5HgAm2DOipLv/NblU4x2vbPSDKEcZxizEUFZA7j6VX+x2
-a7hf+3b2E/TL9Ak6qQ+hgMXcKcNTBU4nIip3XjPTaSkeEtDLSoPrzt3b64cA8y+v
-ZOs/j3d4/lZp54WsOzbRcwAnJwhvcAa1BIISUaNfjzY
+QIaZt977+1TAuLqUSSCH1fBGnQ/gIxbxYYxv6AvIZo7mOPljIFVXev40bTSp6kXv
+mhNBcwhDsrBlYjKgvuXjaE16eFQIOI43+JTqmFdsM0XTDjO24hX06xnpGFIasarp
+qIJHZZE8ZLIV2c5SoLtO9jkNTRUZ/HLtN7Oa37nKOvWwQ9GvOTAqnFNBoXwraq+S
+5bPY/zk2kiCpkgs4gEaA+FMhv0TEMiN0VpS7jxkHFwLibEuQj5B0HqXtvSz522PG
+lrOSNk/l+qv5OAPrIgZzY7eenf1FJf/GoC8TUJYihBFsxhS7Uah0Kwv92AP+GVSB
+lYi6uP2TMH8VijHvWuMV1nNxooCioXuIokQL/bTYan6YhmNNkiefM4vYSRyg08eA
+QL14h956ULQRONPYSmtMt+YC9Lrj+xNe8TRqJ60MxjkpTD6CLRiO6FCaL3hGl/qP
+W2EEC2IrhBWxSaNOSjJEwLyN6VPoW83TU7S+8QchIhSLaDbkDkychsuXyQ30FXsQ
+0HpQbz8HfAh649TxmFijJaZUofgtbhOHsbma9AnE6dd/yEWVvBfzeG8zp7tj3p8r
+r0WyG3xfC8Vix+l8u32xTqNdxv//xTjkNTunzb/EifqVokzSL8TsfnCYtVRUjfEZ
+wZAg+jn8u+wnfEU33dL6at3yuhgLqS+q6vZLFUt4mvs
 -> ssh-rsa kFDS0A
-ZniAWvvGtlBWaehRZEXnMQPOTulBKNZDMflIkCvAqnGZi0kT3mNdSbG2WbfkUXAP
-qnrfpAgSecSNeKqceVzyUnJKtMXTbInLd1dExxUs8PV1P7NbSRKYF5YxgwOMfF8D
-hPIpW1HWjLP572JhjU/h5pKBak38YpvRWPcWG8LxA4z8TT24Ynq6/C62zcB4dE1i
-khJHXsZxMCW4AQUL9uRnhR5rbNBc6tKNalXEGPoEAnOrZXIDze6TwTT3E1kI3v5k
-Hwos2Eeeh5Qo5re/ohN5eFjLf4gEYjVZobWG0alEvz5YCnvkrJo9ACx7qQU8Dj2p
-anKKBc6s2xmUUUK/NyTq1SnBPDsJVbOzko1LW19P/9bZOhdOXF1XIk2F+5yc6/NI
-NPaAtbwATt55WhKxCmD1z9abPuOLmkbuS6f6CKxVthrNlzVaaNlTplQLeZf2tRIU
-vuVYk3woZ6aCCuKKMJ8iR2ebrurGQ4q4mXbhuO0gsSY/WO+tG+kJwHpEMjTru1LM
-RImZjfMaMjMkH0kHvgokkpUdwYc27TB8obg5SpKg6g03aqp3EmdaKytfX4u8CBkS
-hnRQf98l/ZssaBKQlK5T3J+eJkcHd52I8aaJQFAbyHE+0MKW4cvk6tCo7GycXsgy
-RteAYUh/unHoNI2mBpevQ4RDxhpH7vQHFgw5R3HaJXw
-> piv-p256 vRzPNw AsNNfhHudMZScOgI9TbPW61JONHEivXPmLrWw/mWDAmc
-wWXKnr/X5++vtxJhI+pEJlk1b36cn05FT5uH3mxw4m8
-> piv-p256 zqq/iw AwQKjZO2L7Id0dcdSo0rSXJzCOopB8WYGVpmquQJrj4P
-IRsQYsnvrfBoxjK3m2xHZLqR/VvHJzUqYutWLaPZ7bA
-> ssh-ed25519 YFSOsg g0f5mSH59a90MZ5RHAoK89G/wWI7Sp1iX8TxvHATvhA
-IOsqT0Wi6v67RGbF+Xr5Yw39O2LLXvpYrzW8ATEgT2s
-> ssh-ed25519 iHV63A fRocyEreGGIWHBIpP+Jz5AkdGHXNrWdZaXQsrbp8ew4
-Vgn08dmRU8oBSvO89YRKEi6oiy18enJycR08DE6718E
-> ssh-ed25519 BVsyTA cEB52lMhlv9jryjolTngqeIAo6U1lvMLiJspuuXmxT8
-J3AsfPZgihmA61JHCHMc85lbpyTWiLiKfB+0Ny2iAsU
-> ssh-ed25519 +3V2lQ uhEQUeZ20xAROd76KoWNShcvvFabMPjgBaCR2Ulwfmg
-bnevXbQ28ZRvAn4WZC5jBAfS3/gQ8g6488sfqKGGKlo
--- xYEZ1crWWPYSRpxAW6b0OwtCIsAAd5NHAS/KMnAwx8E
-Eêš¨<EFBFBD>îg§t2”þ¸<C3BE>MŒ—~w„ÔûoõHPèˆ‡«O’Õ• q‡ç<E280A1>o•‹Ñ@—CH3I¾¦¿¥‚(â¼vY¦èê6~‰r²ulÝH6ýáL
'Ò›MØT<1D>ª»ÿÆÂÎ«9
-‘<}o
-Éâ&1¾Y2¼ùþ`×"ÑÖ©éó·{Lˆv¼¹Ùõ]ÂÁ
-	û"‰¡>¶ÕjËØèÂ,5¢üÝêÂ
+RtaoOXXVmr4wIZ5670NjdwEGssMtPDHx0zFOZah1vvQhJRZ4OukS7XtUeuAw7eXr
+z14nwwwQ9AsDHytqihR8hfPVm2FNWF/afUgHEir5zjPNwY7dj6qbmZjSdKfj4cq2
+7gn8FlMS84FTbP/7UlVdL9UijErLk7iJUEZ0UoA8nbXj7Rr6ecNFByqyGNrKU9Lu
+8UPly5upqnOyutb/KmhfyPkMPKMBDNY74eiAEbHWPLW+sm03pVLcdu2ADa/CmlKS
+j7GAdZHCU1okDMBPsTwQn2t5SGw9Ml/ijRiB0qcAd3B71f1VaKX49SAncaj2dYJg
+64wrmQiUpHBCxULLqG2UawFMQOg8YYS42qozGllcY05I0XniKWDDpjiK2UecEFwQ
+Y0DfZ01+oXbggaIyzVhFarfcQOk5tlLjlcHwLNkRw8c+zlnLZCmx0wYO8RwAnAKr
+HrCBaq/a9XBRlVNnzkabpZPhAsyNNXdhmCIi3Qf/ZbluISEG7RWSvCM+kAFwNjGG
+LbceGv8JXp2BnzlY0JNJfMOXFzsgtmYioav73mbT55xmkhgbWh6IlnBJSWZ9BU6/
+SAgBoM3AF9/00Vow3w70z02x8v/MwTf9pqOLLv9m2VbdJJK0fO62JkkOu9Z12gj6
+szBxucOaZJ0XJ+V+LK4HjnI1jm5/CBiy86pICcVbouo
+-> piv-p256 vRzPNw AlabLb5NpYhL9A/xCyGIjks43CPOteyn+CZif5IhTN4c
+TEeM2PxvcDGPrNa+1T5aRupYhXe1LnUDtDX3f+3ugUQ
+-> piv-p256 zqq/iw A3LNGN5NJxQe4goGItBcSrmuJQkceBzkHZk23BGC/qJc
+i9etwgttMkRtOFjS9L3tGkOA4nkRkgYRXQkpBbFU66M
+-> ssh-ed25519 YFSOsg nTj7tnPgFuNmhPusz7un4MpYUFvKOsmww5GCyTl3CnQ
+hWMIXaScPoQ7lj7VQrXL+TMXif78QvLG+mqefWBPaHw
+-> ssh-ed25519 iHV63A BjfAnEQq1Xs45iq2R30HGW+RFVKA+tUcGZtJ/1/gCCI
+OKR22LagZv0iYXFqi+yeD2KqxmlNVoUbszzeNUWnclg
+-> ssh-ed25519 BVsyTA 3EhvoVhg2IhrIzc/r+SMu2nVdGFZ7goDCTMtAd53jCg
+JVG9Ems5AVcjthivYL9XC07UC6PY73reK1VHLXZ/8o4
+-> ssh-ed25519 +3V2lQ 4P3w6HUJbfHHaOIhHtt/VjbtdrkW5tOloSV9T9yTgzw
+Rnenelfn2j8iKbOpptyQZnWEJrcmYwBkW3s5hSKvg/M
+--- dTg5lbpg/TeQ10DJt8qkzbg4+bGD7j3893qj8UY9ZU0
+±‘£<EFBFBD>åè»
+¹i„'O:€àDæ¦3ˆˆã°´4MMk8¼~®½«õà,¶qÇÓ”tâ±÷ZáÑ<8xí!ZBò¡ˆÖÄ)wE#ÎžZ§‰"><3E>
+…qû±X‚ä)|œôà”‘ÒÄ§$²½Äªç).øà,kiwÐª.Ý×&<26>ª§{÷ $.Ãš*yÉÒn\>zÇ™<F;¤öf"³ƒ>J
--- a/secrets/mastodon-secret-key-base.age
+++ b/secrets/mastodon-secret-key-base.age
@ -1,44 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 iDKjwg CfOLENpbakwerogJQIwYEs/6YnFUMR5UmBCbQrVO/Eo
-iWSXJXh3hwuTOLgi8mpImyZYTQgMcKvxmHFEgYWQw8Q
-> ssh-ed25519 uYcDNw /mKtn+EYiKJY7p47N2XTpCbA6IJzg1kED+x9X1+q4SE
-xUmvilus2Aysa5ia5js6cXtEsuEdfgCH7uRjY7CSpXk
+-> ssh-ed25519 iDKjwg daG+pfjWme7/fIsMVx2XGijVIAdq305fB75MbME4IEA
+rOh6NjkaunFlJO68u7XD1v2ClGUBhPjxrObl/dR0hGk
+-> ssh-ed25519 uYcDNw z/SI3gzQKZD5DRLgc2WRHkVmccNY3R7nF2p0gVvvd3I
+iYN7ExPXLuy8AoAqmRFtjiRosW3mG1ZVJk9kfsQBo8U
 -> ssh-rsa f5THog
-vRRRh5DAva2f8oC6skWTQmHmZ2fZNzAF+GAtiZs2kFC1+G4iLo3ZfrJJ8LxRbe+4
-f0JIaVzw9jUlqHcT6IdEBq4AU8ximuyTzkU4bCKtGasEfoCSuj2aFf2gNbA4+4i5
-Ynj13CoP7CZpB/hUajJYB5qSVWrFIg4keR8ZcbbEiTWApe+yBkNFbaJitL3N/y5c
-wCWVjcs6fxBT0pPNwlys2eiT9u+LbVdKc+xPYrS8pY2yC4lIfQHox2EguKEoAykV
-kzDZVYJ1aeMgqr3wu0fLwhBZz6fVR6Lq7qrEaBccwfefA8C5mK13QVY8M2WBf+C4
-j0hUBrJ4cgiNOgaqlgetE5WGgChtgWMH0Wi0LNdhVM75MLodr+U/cl8xLwdshlwm
-sglkCoYgQneh13a6XxKlyGWSRccmybXUu0zPqnShAVhSZO4YVUK3DIt3P82TPuDh
-IDApn7MQftbrfnoAVeo+D+m+Qsgb/FPuGcMAg1LVxXQPM0KU8je3gixWZ2IKI2gn
-fD8PM2o8/PdhR16oOSnr4kLHSabyaBvD/JVdEsHRiXqEJ1DY4pQMZieFZ5k90YTd
-reT1wG0h9hv3zGGKKhNFdy3uLyzJiRWTlkt3ydut0kflssq/j4j7BccsyKx2p+HO
-UXv+6WRkepDfFwZmwkw1JCDRYwFHHzchlxi45zTL8HU
+xW7zSSoL31tQbQMujEpTc8C5GkJj9O/x/cL6dSxsCC+J2hPKAaXsMgske4Akia4E
+3YmzW6kQSuOGAzWth7Xkms7n/PJTXRNzWEDCf7AYqWaaHHEMGb05DdC6ucwCY90c
+Wr0mAAfBSIWB30hgNfiel+TYjo10P15xcAQdtQ2n073VmNdH07Je+d+/8QgGwyDK
+esXM4g1chWpEtGhGrf87EX1/S5JT2CcPO4UL7TVXh1fxAwM5VZtSnhs65zZJRhPo
+HWV8Dl8f2w7k9WkcoTsS9meAohU1ZWcwmSMfRq9PF+7XmZoEmXMe0Vht+ksdNDMl
+TVYC2A8MRWl10K1rvElAdURISbF9MHid0qGrUycQq8Z2zhZIWxr8DItyDamXXbSv
+bElftfy6ZxHFhsOTFTCEVyPR4MMHXvUt+VBoWUirEVm5eglY4EhRbqm6QLakpTW7
+L9qSI2fYDxUfChr+tW4LtvrBDZRIZeGsJ8hI3WRpnqWcFulYi+0enqVm4SJXcniU
+kF0J5u+Bv0rmhggcYpy2cMXn3Sekc6OjvM2ge2uKfwZ6C/CzbAJs+BqHhE4maGTa
+vQusabgLvBN0MQJBjheIyETxCpRdf2j/rTy8H9S4B1hGbdvEVmv8O1uzEXWLKJYa
+u6jKbmUabCvQvn+mAOc3epkRonRpMUQ8VaVqdfqjjWQ
 -> ssh-rsa kFDS0A
-Pw5Ty87uw4NCIA5FC4AduSbodKmJdR0v1Yl/dpjjl5KP06+27VOddJ9ZxWwtVM0C
-LcbAHMkWx+E9e6Ff1YAW28iLR71ncY9BjHnqLbc9oOBWfEVZEi0ob5OO8om7gPqz
-Y3ZielN7UY0tvwg3xsjqWCnD7eef696M7gr3NJ1HnTEDIjn3M4bV9ZQxMPcBPew6
-fwV/J+uk6KO0PgswFG7AgWSfcj7Ka3l1iZ8GF9LUZyY6/kqAndAn09XWrKXtwXwi
-CqO2zoI6prW/N80ePqIsJ7WAG9LR4nJduT+pX1fjS9v8WhLjE3eEon3v2A8hiKGO
-URBh9nQBBdxCXKZ+qGBfyB1CtiN6pqapHsdG+a0aYhIWxQ/l2+1a23qWMZ+MLtzO
-tvSTV6Gv1muINDHcJzLtD9nyfEq+11XcZk1LlHm/HRGTvCTLiRHJxRnDHZEIX5Pw
-3Mrw+n+tvv3jVjAJ9RuT5jm0zcFk719QZT7Ic23Q8iu3YDgkKKQbchzP0oeJDjrn
-zNfSO+K1GXEOoNgHSJv8IOcL/7AnSO/jg1em8nulxlFSj4nXsYtKpjLZFKPBq8SN
-h4GttIloJvIDmn4cFeEKtEfGqZS6H+SpGfA6uD0AlNdH/TGVtbZSDV2A2RlXni8m
-gfyjFEAPSix03AINGsDBDufRIWjLE3PfBxeEqx8to2c
-> piv-p256 vRzPNw A8ZYD6qutHn7Tu/hWrCnoVTnmd4p/xSRNlgCi7Z+Ds7a
-Ds9F3y3mEsdbFeJQW+KscpnaW8BeHVVmxpyaUtkdOO4
-> piv-p256 zqq/iw Aqus2odLOSqWHHPncAA2JMjLhTscshC25BPk3JoAwzgc
-y0/oo/kVuXMlya5Q/gQTK3DorUGv1Dq352UP3Jeebmc
-> ssh-ed25519 YFSOsg UZlASTWx40N87euqbwB3yYqDRXqoPxarYocukMAXjSs
-/21vCj6xBDk6P0956D5/yjVpQlyfXANMD5TebyNblyo
-> ssh-ed25519 iHV63A IiQxkranbz9QsMkx3yjt/RPjGfR9Lay/bkZ0tth52xc
-PmhS0h28iVr0yUcTU9o8XWu29qOm7JCYays4IA3n9t8
-> ssh-ed25519 BVsyTA NbXq9vdZ3r2Dvzo1m2dzYlVd2tVZYxrptT4oul76pUk
-doJFEhCckrlSmYmYDS1kmKgIng6SCKh2LbnSRVTCGkI
-> ssh-ed25519 +3V2lQ dOvZBoaRFfnYo7dE+l+pqNKbu2TEddJzF+ijJa8y1FE
-FgCcypV98xsv52IZjvmDEaoDUwr+unYSYZowRwLz88Y
--- 4hmokk2I+HudzM6Oh2qpiYUJLdUmIwapvhhP79LF97I
-ºI¨2`Öß‚¥eŽ·\/P,o‚`D£ÎŽûëfC"EŠÞèúí¨ÑÉEðO_k7±¥0¿¬ÕX<C395>öl
-gnð‡µ>$›Ê™ƒ¶ËxP§ì€›ñÄÍà(op`”gÞÂ¥z#ÖÕú.”°Yk3¬ó8Žã{Û	¤\Å«¤ZËTù‡íÐ
ÀÏ]EzXî§FTé¯ì;a—+eÄÕºã¯Gê
+in62rDIm3ga9ntI5A7yeVflE9USLuVxJ47agcKoxDCfPaKyzLdIzLWlKj04E++QB
+iitG9o5qJ7ZOBUYtQYERPR0+3hramxuKR63Z7PPgFaBcSwx/WAY9HxjsA9dHxxtF
+CLud9KW0a3AmmkH7HfAmmS9iWUhHUf1/rosnUPvrPLY3hWYDREkUZv4MGUAYE0Gx
+biZ+7tT7YFzWF31E8i9+4TxO5edlpTgyqIqU2BdXRntrso6iH2WlSjLBpPhJ4OoJ
+cKmHI3KLf0BEEjvgGOtRibSRFL3X8BDyVmNdWlb4idkcbOzGLbpxr8pcCHQ4JetY
+ovwUWdhi6So/krKFGTD1Bx7SzwZrB3+m68viAN9PE8uoTApQiul5EHHAibC3DdWx
+348UpdPN7BVleQ+pR9jmlit/myGqxl9bEbHCm1adEw36ldWSdfIKJs0J1qs8jfLc
+8Syo5DqXvCUBUl3CR8cLe+sal2cZ/4NYcXNbkOhSW/heNdzGN7vQazywJi/Xt2ol
+8hF6N0LI+iVk6FlPthLBGB1lRU4YeyhN10v6e+h4tGhz7gcRf4Ea/ZGeWBp7mGtk
+ogNeWz1ejhzvksnQdrzllTrXfBcaXvD1qD1/VipLzv9/a78LAfQwQPqH8qqFGVgl
+EGzDWYrb6BQ1VfYY4aVy00WywScnwNnEm/rYrNqWUS0
+-> piv-p256 vRzPNw AucA2fZnnEcsWtppo2zNYuoKiG7s8zgP157k7lqhNVSH
+DKm1jIK3Xcb+sQgl2kaSkUTVsuGPdhl3zlZQjnD6d8s
+-> piv-p256 zqq/iw A+OHMqkmTsJpcXDNxtNlUI1Ko/mWLrKbtMNp4amqQTXf
+IccFOIqY3rv1fWh7dDmu608nWXoSUBLNORRX7ZTo0CI
+-> ssh-ed25519 YFSOsg lXvuBojVXSG4+hzefRoCxO8Dg0PJN7MO3myoUNiaUU8
+B+B8m1z5Dn59vhDkXDTuZ9wmeSs/W9zzLtcoCHNnwHA
+-> ssh-ed25519 iHV63A iYPlqA/m4Eh59Tw43N5mijxLm/FXJWGG7+GvyGknkDw
+VZ1JcuyXLXpM9BL3jutXmgFbkUgokfR/twcmXXDgmtg
+-> ssh-ed25519 BVsyTA L3B7twUnx/UML4pMoIi3xf9bHy9Xyh0qMcmvZ20GXUc
+Nci7s4Ox3oqhJkHQRi9KSgm1n5L4HyaV/2XsXRy1sxA
+-> ssh-ed25519 +3V2lQ I01GIP2vCvgwjVEwRD0rRbmWNUubw9MvhNp1fMKuuEw
+SONGPhMHTLb4kHO+qRBngvIheGBnODyQSLfHA/njczA
+--- Bt3Ju25hzpaVmoo0s1+SmSNVMtww4Uf68QsTFSnUXnw
+‹¥UhŽßÍþá–<C3A1>‚5+¢q«,©ÛÜbÎ%…ëƒ<C3AB>’VÕ–$™‘6†—ß¿7>feñ¹é—*˜Æ‰-?‹@ÈÙL£Àû‚;ÁÎm±xâ…0ˆ‹ƒ8›5þ²¦KÖôDŸU4Gå–êËýL³@@Ð³v50˜àSe¢ËŠ[âb‰3ÏîD5šÏ¦kß<>¸'=WW-qáÐ¿Å?|*áÉ{
--- a/secrets/mastodon-smtp-password.age
+++ b/secrets/mastodon-smtp-password.age
@ -1,43 +1,45 @@
 age-encryption.org/v1
-> ssh-ed25519 iDKjwg svJv3RnPq4L7+hJaNL2xv+wnQ81DODKDlPW4RdX8nBM
-5mObtaLBtLvQlY+poGFc65J1C0fBniTpEfdLv/1Fuc0
-> ssh-ed25519 uYcDNw aLt8Iz8gPl18ZoDtBCoAQ0tOmVOwdyT206MGRSHhNkA
-t8aD1JtjxXeX2i5qdCj71xossxLnlMqZ1TizJC6xgEk
+-> ssh-ed25519 iDKjwg Td1xpczm4SaXNEVNf5TjN2QlbKJy3CW8LPDGiMclakI
+kFi0PFg+VHptG9WRBOtTJvDa4kjOua/4PF5AV6MPEZ4
+-> ssh-ed25519 uYcDNw NMzLBxORxWCd5A7sm5g+Mp0oORk8NFQ1kSmXLXr1lks
+H3l3Ow3YMKKFkuwphewGH3J/3vl6QsbKW6w2l41+ERI
 -> ssh-rsa f5THog
-ZCccraTiNEGp5EcPJm4u9W1cigox4tIXo55NITEd99AnU59erULTaQs1gfdW+5/b
-tubzmpN10T87ELxK8sZiu3LaW1yuHqleecF6gtGhftl/4n7Wup3SR50c6yUlJVq5
-IwVE/vmhymicGNjMI24kRHYPzjDLtiuqFiwolC/o4MGiplGQPRvZ1W49PLoGc5xy
-zRvpREy31oSH+L38gxaMSiI3nIH2y62kl64LnsjRD3E9oYPQ6uDKbz/tyN8tYe7t
-yf6JZ8g9JrnU7pKZ9PalJplWEjxUGoD49aI2/0e4UYyNsTNbCIMhxOAIY5Rb4mXA
-LE7EZ16uqzdfv1iidXVcVVgYFdDSfIg28lexWD8TZFHRV7jHsaw/VuQYnu05KEOl
-19iloUCPl4UQNgsE6PUIJoIhvRGHhovw80eol0v8weOXcBi2J5NupWwy5mjTSqeH
-JsBEFz//PZ7cvTD6pblTLkEVXWKCIu/tJs7ZoeVLaR+dANHyviwVuH42xa8Ouj0I
-aFgl9FYo3j/aNsIzgMdNTAQJCzhxRmzgTGqkVdEqFtg9H5SjQrcHDlogK4w84Sm2
-LSHv3rRX+pHSIpETACCWd/GGqzVGE+v5gHpafFdCc2P1+0MH1tZ5dfhFFS7mgg1A
-vuRXLAD6/7aN4pNapPe22Woin5Xde3yCUmi56+a1hv0
+OXoPASz2VOPWVdFa6obQppMnVr6q/DdsMU4Wh0ok6cV7Mm1U/WIsTGCFxPtRUCAz
+NhTi667lnXXgrkKmlJhC6R8R2HTNp2WeaDzllexX1uvYACc/rnvD7KPqmxePvoc7
+TYLawVxl83+wsWLDQR7vuK2lSB/S6qZ7yPpF0nDIM153WI7edHu69/Yu0V+xJp0A
+UbSJTP53C+DA1J87H6SsN+qE/a67qTV6J3qhRD3tAW5EY0ZOQ+Lr7OQFRnEW4hOL
+mbIXzgTISU/eQSJ22Xz7vk0jUOPN77RH5B/1EJmEbKJifZYYb9sajgrWwGvBbp4E
+hvWpGPqd2Jxxev1uhjjbwcf19O4/Gv1vCxTCQ6SQnW7t6L4hhWVKeH9p3/ZGHdcV
+GL7TtD7Qnj5uZfc4bOWZ5RSm/JYdjyIYFe0wP7qz21hup3j92nKMIruOL2o6s0nv
+m75n0aoZwQWyOdk5RZpfs9Bfw+y6tnsAWqg+PYR3RFV4raLbpFJJFYdPKO2E5gDx
+/y22LGVYZqajuKzfRmznHKGlSTxF0Aa+cFV5HWqmN3oA5UiteZX6JCQRVy5egfSo
+KMNhpR37wxI6B5AUS0UMGay0kIWSUCJGe0PF/lPWoM9Q6Lp6CqJEUMwojZtISc8y
+BJJclZ+M48HCR1OiCMXlduipXbRUV6TN9KytA+erRuo
 -> ssh-rsa kFDS0A
-mxu6zyFO8dZgsr2W2BCbVckHEODcTCGi0evcRgT0EnEBCx1OdALV/NLK8ZdJtFvQ
-GiKOeN8unbBLIh845yFgVZUrsb7h0nlg1ogWZswX0IpxC2x9CKCgiT1PJRGpzpyL
-LUyDzzam3CyIWjPHqx1BwCEfiHDdsP0w1FMn0olJgahzW39/+zjcz4x0R0zTKGy8
-wrFdzTI2FYhpK3Ob8/d+0tKjbca5y6qayBfYnLGpQK5WZ0RiIS4t5C1JJ1xC4nU8
-f8aRWqXZusSkbCpZJj98t8tUragFTwS8iCHmzTst6uoLZ88YmYNvo/s1vtI+yomc
-gG29EaPSdsTdyBPb/T/8F+IO7Ym+ZKBYag579pygUq8kbJKLzLZG5WRSBpT79VmG
-+B/951N2JazdppmZ+lzTxGxgJM+SnAbQeEsNC/oOn69WQO7INcpzOXi3m9kwF+qd
-0EnR8JUqY1dHDbwLEdjuHg4LQjBmlSf2k/bdoqiptchDGSHQv5k0ic3m006HJgqN
-/zF1mw8c9o/6MyOprfoIhq3Comk7Ykwig8nirYIqzPnMB8G6D7Vk7jFq0cbv85nA
-OPiVUGtmEr6BcOdf5btV/3ei2nTq+NpPO3IbHnu4DUC6kZrZcCwc4vW1OLVUSx75
-qjEzzJ27ZSi2k4BtBAp3gGMum0y7RX/x+vPRKcb904I
-> piv-p256 vRzPNw AsasoTH+Vv1bQsGQlLRkDGiY6QcENjogT6+tzbXitooQ
-IHas+Nxa+l+HfCHJslrewW+4LcZ9GUsAgC/39AI4/v4
-> piv-p256 zqq/iw AuMn5t1bJYqysPbG7IEzwiRDZvL3jhYsZSjrAjafK9he
-dV5YCEHPCngePXLI6OdNAvexOxk+0zmG+MARyVnf8o4
-> ssh-ed25519 YFSOsg WLd3aKTaPpdLf/L5M+DE19KMifJGjIRaR86CDbYWejg
-oKOx5Te7/NNnq2X/BLNLIZZbZ57+VGBqNtJClbgh4NY
-> ssh-ed25519 iHV63A y46J97PK6iTxWxONVn3rbj11NVRU9224HzjSeXAF0hY
-ePg06ps+pYDW3BcgLe1IPMDCUVHHpWrRF6zw8BWrg+U
-> ssh-ed25519 BVsyTA fjbffFH0Pybw+K68+7+Oti2qvovaaom0dvLpGLs7tRo
-dApBFurCvCVcWEK1WsQ6fDCz9c1Kg4BKDTT3jMfykP8
-> ssh-ed25519 +3V2lQ rNrCTEwEiGb/MY4h6tY38GdJkarNvgBxAltya9c9/14
-lIvWQUFm3K5pfd0ShA8If0ttUU1mpRgpSpuuXTT9Na0
--- OAPKaCUB4sQSJBLBKQz3eVexevlfwif4jwgj/htCeuw
-ðª•÷Ê 
üVOîLÌßkÅÇÜŽ!lS˜;¨äÓchMŠ™<15>öF½m1«ø
+oNmPaJpfuPxGgcdYsPwDiaeu5lmoWLTdFjdKQqr/vEsmTC9TbgVIu3ijbixpaO7g
+cabLWs6WCAE4yV6bq8DCNVwok4IltRq6gz0E2H47qP9r5SsLGiu5HjBLajGlesId
+8mxEL5dQIxnaBwFIsKreFfh2FlTuljTAmVtsqzQAspjGa/fHd/K8ZWUsyInHWaMR
+KtgqGPjmbgWY0SM8j07j1OkKHuzIK2v/LRUUqvkcC/vZjoGqVbbJA40PhfRzDd2B
+FdYUHP86ZfeW1/dORSTQrad4OacWX38HI+P1atWq436wa+K9qOGzJcJfudtYJ43
+ZvF8rus5GOTP+M+HX1J2flSbG36WEB/0JD1nACsvE5eMtWtynAVbu/tyKuAmWzTS
+zCy/biMn4vMYzHg3jsZIJvvGLwk2xTd3tesvqvOviDRGE1WmUK77shLlG7fGR76e
+/t1Zsvw2SFhpgeSbPYwoZcFQlxi0PVGgaT38mjWi5s6I6oA7hmvS8bcM2IXkICdu
+TBQ+nGjhwfmkhnfkHiEy6A9LYxziiDIJL15dma0KG7Kc6qhH7X62/mE+2OITKylA
+zB5BX0HI/UJx3tFDxoL9SwVqcXi6qWHWy+4vRHJUGe1hGLkF+f+iJTWxNL9Lcky
+VwJyO/kAQdDg5SNCDY3ohGhBb4VOBzX0AMJdXB7aE7s
+-> piv-p256 vRzPNw A95+KMAiva5R852fe8G5ceXc23HfkCkio4H6w1eiZS61
+ulukL7Gic4R1ptaKGWckIU+kaq/1AGwYI2aTrM87eMY
+-> piv-p256 zqq/iw Aj5KBZXqgzT1nq4lFoFJpKWSxZ1NmPX+nQkrC/0wbMt1
+2DHEAmbQ2/XNDJ1umkGdHXbDzq5YDMUdmD/J3JMiaRo
+-> ssh-ed25519 YFSOsg Bekl48HOIuCKbZ9xWeHtk5q/e1nFQXoiK2GYQWJ4/jo
+VtL/msbj5MaRl3V4GMoyWdqxyppTx+NYClMsTha/Prk
+-> ssh-ed25519 iHV63A P2u2Lpz8kmaOfKMFMgQtcXYFzwy5wlAgciy20Ay/rV0
+FbOG+kykxeOioqiJ0ARNZUlcn85iBc0qmxdWb1VxmLU
+-> ssh-ed25519 BVsyTA +602HApwdGhQ0Kd+oVNOKOuGCCBLLNp+/QLfLcV4nwE
+gVnMaQszX3sps2hjiXxgcrq22W0mFfpMaT7OXqZS69s
+-> ssh-ed25519 +3V2lQ GSgwPGbFo1TFNNrdIiiQapn/FXEk2JJgk5xzRDL6okY
+CnhJlD68e7P3xixU3DOwJJGiu0PpzeR3Ag2SUjti468
+--- 5Adibjlpvg9vr6rB/vaPEMj9y+MPL8vGRx582w9YIz0
+¦öÑõÉˆ²A
+_Û;@1ò)»=4Ø³†ÕÜè¼dmÕgZÕi“<69>T=ˆmMm®
+®
--- a/secrets/mastodon-vapid-private-key.age
+++ b/secrets/mastodon-vapid-private-key.age
--- a/secrets/mastodon-vapid-public-key.age
+++ b/secrets/mastodon-vapid-public-key.age
--- a/secrets/matrix-authentication-service-secret-config.yml.age
+++ b/secrets/matrix-authentication-service-secret-config.yml.age
--- a/secrets/matrix-mautrix-telegram-env-file.age
+++ b/secrets/matrix-mautrix-telegram-env-file.age
--- a/secrets/matrix-synapse-secret-config.yaml.age
+++ b/secrets/matrix-synapse-secret-config.yaml.age
--- a/secrets/matrix-synapse-signing-key.age
+++ b/secrets/matrix-synapse-signing-key.age
--- a/secrets/matrix-synapse-sliding-sync-secret.age
+++ b/secrets/matrix-synapse-sliding-sync-secret.age
@ -1,43 +1,45 @@
 age-encryption.org/v1
-> ssh-ed25519 iDKjwg QTrFViSf1A4vuY49zDa7KpMRDc5O059FCJ7NSZ0Oxgw
-JTgHRh1J/fABSXhxnupTcgRLvF8WF//0mEbL+DJCSvI
-> ssh-ed25519 uYcDNw /xiahQFk1ycLkFAN9cS/6oCeY2H6zMB93t0GcuX9lVM
-+0htTc6E6GEQGdB+YEMs7PELWfJZKXdzduQz9N/yS4A
+-> ssh-ed25519 iDKjwg GPTqfaZZC6ze7BUkT1uF4VslvE29BFKm0+AlJk+DKQQ
+GxI7erqw8p3GrCArh5vZOiTmYh40DVisCphNyFhNTqM
+-> ssh-ed25519 uYcDNw oo52Nh9BCO5NNF0YyzracKfvMifSiREsxyQqiRZ6WTs
+JvqwRX5yOMtEYgWyc7dIQs85wDghMRHQCIi6t5QxIwo
 -> ssh-rsa f5THog
-iKLcPsPRqxj7gGj8AMxHqT8ybITO4AHZNTebbYp5asr1DZ0zgnf1nLYmr27Hg62z
-vQ+h8gwdhhcR1hETw2h9Mbxt4JoPxPggUrkzuvWEmc2yE9M8VzdnnMM1uTJ+lR6X
-4Z2iWFUsyRGmFZI24uHCuHfbl671R8P5nbPYKETEGK7M2wKrOA9ilO66bomlD28a
-q7PhGtXfLKlEX55N+q5HotI/YrdSSJla0xUPrFioJwyK5duUj6b8bVo2D24Neoax
-m4usA/cjOxZThAR4GtCBB87VEGqUrUfTK50kizlB50ES+o1FL7S0vKtcYSTEpQaR
-eQW59BxQpqOGlLi42w+on4RYonCuq7bvjTXmE5WtLYX0kT7xLGQl+HKvNo/wm3QI
-ERFfwHDDfatQzJrAyZRxarUSd05aOveFeOBfg/DLmwGJ6J3liZaq8TtzIPdYhNNH
-46bdjFpOegQ+maBtBsAegF0rhZNX/2KQTCdvGZk/sv6QMXEZ2urSV3PEKIBatTEs
-NdVOchiPjQEiUOytnvvkR05/8OMJqqCXjHwdigcmu8cRBXdPPn5042rW+Hrz7Qx7
-/4+JGCcHph/saeCj83SrBx1QAAQ9Nvi68f70Tx+wY3OQxMRlmILi+GPr2YVV5eF2
-HV+zdHduLVgk4OtTnVu7DX876S5W9zguDGoyXp+675A
+w+B5hc0E9u1fFWNNPaTtPmJfPJWUBbRwHYK/T69g2ORNfaBYynl0LL4vSUs8o9Gw
+rwBY+cLpth6e4tS819H5C7HtvT47KR3KF8JLxVjA2mbVO83+BnWFjThjYB452CdI
+KZvQQPhkSH/43YF6pjxnQjNWB/wroScyjGVtUamcij7YHxt71z0AAnyqE5PgWEc6
+6/ao5gLfTKhcWpxkTTz8LHn05s9IppXywDrvpwtJaU8LKgJT2H6Epsaci348lG+I
+tAZYODhQqP+yKl92DZbuQQCjxH5CJfhdBs2ZR63hQPj9OrIFRjLg4V+1gdcxzAuz
+9FwwIeLq3uxWXPdwTRR8RUsHEGhKMcVty4PkW0vlt+VwZrZBhdz3k+ApVG7Jvclz
+MPZYLzKC0DiODqPuA23ye6suFRCHXYfq3ZyCIIN6wOci0X0crSr9ZXW4M8R7aWaZ
+XDeZRaUgvd54WI0HZhVWBvJQyswgUXf+/RkS4aI8IgnNV801x12h+mTdWX9BC/cD
+YRIWBnGkfTX4WM4OEE2VEgqSDuKl/90o2LFIquIIJULVd2Vs5C2S8FhJcsT7+HmL
+TFWnLeIfGbw7RDUeH0c/Bbg9NK11SZF0/VdRZcBQ/zIXBMBlL1EZsH1HfIfhKISN
+PyHFB5kfmuVIBhDXgtDdgjKfDmQL9/9Aq1U4ZMBcUKA
 -> ssh-rsa kFDS0A
-HwPTF+Ca4BwQmIPQ/5fkvfYQF0b1a2SJIMbBdKwgkytHKHN9XgX7DsOYTJHiL6Es
-iNjyusEPOjRiEKTJ7vI/LyHQGsmbw6yU+g9/1RxjLrrdnHCeGHEHvzmxGU6jsnnZ
-CwFPI+KC4bbkR4x6/IzQPPZiMrGoPr1whII65Mj3ZVTDYvCA6rfPgz1+0HN6xPV/
-3LnYKXVCi1Nil6hzY9/4NEDauoGO7AXQfwiEH5mCqaqgWmn0hD/IN+7+rVGbRW0/
-ZrYFUVYKsT7qraTGUlZwK4EWyl5Zd8KwvS2m7r93Wh/aQVNv4XpSXSQXFryS+/P7
-5c+uPWtdnaE1MymlM0iwnUGT0djH67GzJIghpfI7VLh00DBXqxdLApUMUe+ZSA3D
-bu0srA0o2GeWbzDwRXsnrpOQeb/4i7gjTZDaE0jASB/8REGGbYpp5jUozyzXfmEQ
-CQF226B7v9ONbfQia29zILZctqVPmxnvZ3KNC/ykyufnnvscewflzTTERZdCO5Cl
-n1R16QIpcH1C6kndpeJmoU0k62L8hk48I3vmelc9D90h/VPkeX95/JOYvgzaiwKE
-hPrax8FWrCA/BeIIom6oPigzBE9QYifSwhMU1dLGWOpjxY24gJh810I7P3MroU+X
-q3TKm+0KZ45pvJMZ9AkdfJQqJh0yJqsO1Jkz4WAd2mQ
-> piv-p256 vRzPNw A4eHMov75qdhGP4kcxlIc6BuiynaVv0QJKKZb5zOcZot
-4vnBfX+zHbYkYuxwAc0HFpsI9DlRC1Hw+Xm0+02mfTc
-> piv-p256 zqq/iw A1v4AWVcro4a4rXjgX3ote29MTil6fpno8XFRsMTMbwl
-Znh5NXxsG/K6E8qXUW9Z3DBVN4RQFYQpSUvNYmR5c4g
-> ssh-ed25519 YFSOsg VLRvUwQn0DlHoIC/LMY+zV8A4CEeEFEW+nr1Ku8N4A4
-wKMAeBw597ZQQIqZIwPvhtnJ7eT126fhHA8GyT0A4zg
-> ssh-ed25519 iHV63A c/9tDKfDw0f4qtwCJwNjlfVNQd5x3E2kyqS57tggqXg
-yUzA8LBe23UKqwEHTIlTXoYGQ+GWFNYyJACM3jrYroQ
-> ssh-ed25519 BVsyTA glTVH0ilsQOrE2AwZdwKQdQd9Fn3flF6WxHBUbjhAhI
-FnRMdzqp2sQWOPZvbZKSOptbonXllDPkgjaJdCxl68U
-> ssh-ed25519 +3V2lQ j1MotiKfE4I2YpTmnnSyB14N/44NOBVe1bw421g540g
-9Go2OcSb4Li1HmhM3STtw1t5lmGDJocLmrBIuf65tdo
--- 56KzUsaM/R0th43DR6XzEbNNsFCV2FAj5ooDSSZxHZ0
-<SF<-W†¬¥õ5Õk&=Âýõÿ¼'
È´nnû¹%Øn6£t»Oå±ì¬ª¤('€Çÿâ²1¼„<C2BC>Mzx<7A>&¥N9þ5z^œƒ©ÜœƒZØ4/q@¥¼© dqõ	Ò9bÿ[~
).lòÆ¬
+KysKtr7wrKKJ8w+Dj7qjJstyXtKIw9weFi9oVwJkMvy2utn+JARs7puh7KC27TXC
+slZJrHf4vx+y8qSjRS0W4z8CPl8/auiYOilepT9JoxwGUP7J/nTr5SCofgWcdZm5
+FtgHoCcABjzcF+mrKUofuqrx6oYSDCS0JkV2tClQI6ybXnjRwIIicLmBN9UDHCuU
+9ZOesYp5XrJyBoD3Zv51b19xJyOfuWAUQvlNPRH2TpgvisutpESU/o869z5AMn4Z
+BfDD/0oR1ALbk/sB3r13Xi6oJZAB2AbggoQRlwvPeWc3MdS+bFNV2o2ue0ov6Fkd
+U5C/GnJVlyE0cv9I+YvxtLT6T/Gf/yoUZGfB7xD5QkHpMIEmKxUYqGNBB/NcnFMY
+Tal8jMDtZDEk+uk0MahE7GsL6Z3xrkKTevG+Rr3j+beFYie2RJbNwwUyQ1lL3EoA
+Rx1AMk+nYlvxVHiciYJNh9nffgAXXwO255IkWvYzmuPBEP1LmqadA4fQPf5Rgj3u
+DuOX3hJ+rIyRIoDXOZio3SDf+bb380xCxF+7efJ27Ep0sFviAq5qKeptbyt51Dp8
+tlbeYAylhVbV9Zgd+EozwE7Btlfqt3sbUij/0Iy+BdOYSPLmvx3oKybpipZ0i3fo
+KR/bZHlMKF1Ipd5L7zEwh5aTjImuomoyRyZG3NWdv44
+-> piv-p256 vRzPNw A7FwWUuml/VyHcOmha3R/DOg1RvnRXcwjaJJH/sgmsBR
+CP1/qY8sHbR7nkFl1T5HPsjYLRPDCSR01DEJaim96o
+-> piv-p256 zqq/iw AgYhaJWqe+QbVCHkXsU7AQhWhte/fjwVbOgmHVRPHsEE
+7jNmDI62i/9RakJhbo3MP0qMgXYGlhAW9BKo8HLWQYc
+-> ssh-ed25519 YFSOsg cGPMyhqcd20TDBeMkSDJ8hQ/vE9cuDgVi1hfcwAKVjw
+U9GRSr607w5oUGr0rC6XqdWMD65JidY/Ri3Ex1dmGXI
+-> ssh-ed25519 iHV63A cW7bblsvL1TwI6lp8KjPfUwB5EzWilLhc6Z2geE3SQw
+PzBdZ/LXA7iGI7ZjErredqC7ehHsr5MCY3qENv0nZI8
+-> ssh-ed25519 BVsyTA AGDqp6Rrp2vStBU9+eJMGf5O4SZQIASE63n8vbf8PEs
+SFakjoivQrFkSUBGZ9sISKVhAxNOpc2RxugiBTSK9/k
+-> ssh-ed25519 +3V2lQ MmMv45CQFAdgkV/B7InOY22iXzvIU8TY41SV5Jxx7RQ
+vNIRE5wSXVzy4miZLV90T1TEOhOjYQT12GWtZpsTxJ8
+--- EBBXvYr1OpETpgXOsUfJn6h1e4rXF+olz6DbhDUWCcw
+.Œ
+ösÊ~¦—åHÍ¯k‘	2 ¦À9<C380>¶§Bz¤¨?°3ëþTÇJ`§gº¦P°çioÙÜr<C39C>Š€" ØÝöwÒs-K€6©òšfÝ
+ß0XÎŒvù‘Xª&£8
š¶gÐ=ÄzrH¥jh>
--- a/secrets/mediawiki-admin-password.age
+++ b/secrets/mediawiki-admin-password.age
--- a/secrets/mediawiki-database-password.age
+++ b/secrets/mediawiki-database-password.age
@ -1,43 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 iDKjwg 1C+20IO/2nEYBt8z+4AA5vUHHz24veThDLUWRGevmAY
-VqchaRRyw9DmcB7f0HhsMvxaaZiRNZLU3uAAb67roUc
-> ssh-ed25519 uYcDNw L++eJn2qhye9MDHQvjE0Vqz/d/gexZI7qOmPhYtjtng
-Ba/nkWkbyoj+MqS7ZkaShx5sjUG749n32xW/TJjHTj0
+-> ssh-ed25519 iDKjwg 5z9N7aq1bFqJOGru8Ue5X2UMQo07dci6TPv7oXC/Izk
+C3muvlb9BlU2JtDemLwHjfe4iwiFFiwzP55V8Kr6PCk
+-> ssh-ed25519 uYcDNw pXhHZWPIZo2clMc2USKcNPpw2T7azMy/SpC0OAOPqDc
+/CIOMLd/4H0TqjliHC5jQqL+Gl9YO3L2rUizNl5aXtk
 -> ssh-rsa f5THog
-w10+c+E7ARuTHYPXAvU+xMGGnCgqYFUKPdLmk63ssswHQMEEXIG/7XJcCspSuLnu
-fko9Edc62Vo9VMw4FljzRP4EWmR2Ea0WC2T4IPMOsdIHkOq/3hPbp/2WfmZDpzxO
-sij852xBt5F/tx4CyCwqajwoDbsjmBjDAeMMPisf1HJ4/O6dJ716YUpHNRcWnqV4
-JGWWfUgvTd3D7Fsw9TSBOWHtKTeRZOWYIP5bbHr34cipVkHK85W8zo8v+/ITC6SS
-HKPDWdf8zruu7lvIQCgEzkUX4C2S2WB94BZb0TKS0dEZ5IWDkhF1Cn365lcc17ly
-T4dGHKBQoIaVl8JQ5/VqenippDlv625s+tOjyCaqO2ib3RWIDeaEd4HQcrU7DyRI
-LYofSXHsVbaCBUxrJXHpfu+ua52SbXkipJVXltzKk3mov9THz8iENMUSTdOFj/ZC
-hNqWHSFV0SCqONxtdNX1jvhJFo3Q1ipGaPoqsw4+Y4cOueF/+93IaGtDWGjpNL+r
-5t1Lx3qE21P6VCocUlnszBCjJokE4HK1VTC5UQbYsDu4A34KkJt1xdpBoF80npck
-VrUTS8Alg53SqyyybDa/BPDXmIB33It7LEx99ScbMECkSaUJeZDn/Z7CZp8jzMbm
-sNkatBFlj+qP5AOGey15GI3NI51IezID4j03RVBstLc
+vSVYgXdGIRK5rEpJheecRFALYmM00jvDEgM7lKzgVb1Vbs7Y342VEJiHdZPJYTdn
+v9AZ4d2AHporb3FOLLizprpzO6DV2q6bbDm97U2uNgAep9HmfHXQ7pxwvL5I2jdc
+HDQzWnqVz19JyObE1awPI2F+LVevN5Ha5OiU4r6n0qbs3+NesesMeSR3rZizJ3cn
+zyO5LvM5SJxMy+gJO/uYKCCuAi9/MbH/TeztfHpClp8xb8EXPnIDT2aujhDsv0B9
+xVP++OkjTbEhbbmRxV2o77q7q+H8WxeVUfACCHlegp9mm1SJ/o2ZyzLRu1qEM2dL
+sKO97uyLQxSRk4jN2T0gJRnZzia/yZ3eFJwKGZOSog0/kzYMvw8cNa2FgHfk/IDB
+b+jY6Qquc5uqA1B2DogHkYCVPShuHqDoKKvNsIopCZhUlOkEX4dAu+KvWG6yxQ+t
+NLoSP3hVmVn5aeASZXJysv5w9BVHTnf+mvJ9ZUTSEBbHmh+43u385WXNVlGC9+oq
+kS1bcKXfWx8rqgwWtYh5Lj0YoQ0SvuDuxiEPG8BUUvldL10T1J4SAihvXn4nqIZz
+I1gnhjT74uR1UhELL/BRvS2Y/6ZoveE8DC8NtvFdKNtmRVyTdj5UGd6r113jntiC
+PhxWTOs8hMeCjPKoknDfLviJCihnvW3Ac1EnHIc5s9A
 -> ssh-rsa kFDS0A
-IbHux39+xm7fKZFkM/WAnIu9gGGHBoYiPAAB99iAjH2qVBsUOnhNB4dE6HAX2cS+
-GnOx6SVCWTKN+zMCSb7Z/Xk1R3lYCH0g8i48Y0aKWPCNsluQ1xHh6umJ7eT4acuv
-dEQ4znvxwS9Ms0DzD0V28qe2zupJkeWFdz1+9gyUe5nAVNnze5M37N5fajr4hBqq
-26IkfVe3Rf46SYLA6CewuteQiz8ZZvUKz131hmqyRFWX76vTJPQmkx+LJ0FK2woB
-D8wxW9w+ObTRYJbVQyv0+iDug1XyZ9L6urITHiBPU4RsQBENlat5N+Vzx75PleUE
-FBJI4+hy/DEqqiqQCcGmQtVpJRyn0g99kcF1xE6eRAP6nMTy62E0G8CrbcVdGqM0
-68RQfypYZF0kliPqn9NNhJ4teZ41CCSptJZcOksk3kKyhzdx4yt10P9pPH/lI9vJ
-AVmnB4M1iroD422OsEW47IojLevvPdnXWX9czoafOuKTlNTZNfocK+6VSRpu//Eu
-ZpN/IXL5RaljDim61d9bnm8XAgtiNqxdW8EaJXFVmUqXW6+by9eUtwmBZ54geqHG
-CDnOHgYB00WrT6jn6bnLryXTAhaEFbu+vUZbpOeIB3q7W8Fb+8gV/qR3sXTT7+zY
-9ETYzm4RtuGzuInJIiCMP8WOmMNuMFegJxINBEgxhM8
-> piv-p256 vRzPNw A1cWIZaOKkTU15wbDrgHviISmtiernjAZDfeSvepq13c
-Tkf0TZkfokidSRZK0V+gwaSu2ResB71qa+UbvMESdqk
-> piv-p256 zqq/iw A7E96kpuNAnFVJVDGpX74oryuUf6scsewaSkROINkrY8
-aK7S026r6hSqCxR9rQ8v4h2FWXKxMQckx8pWfdemHTA
-> ssh-ed25519 YFSOsg ExKrcdldCkOtKa7EMl02h460u/feDBb0oTv24uWcgQs
-Rpp5v2bTC3wH8NGSGOJHJxA+BaUL+WQnsJ5iL8bFrUg
-> ssh-ed25519 iHV63A gK2hsqI9XjEUxnB+wyJJsdpCAErgqhm9hkKUP/hgUlU
-mKx9SBrkEsZEhQJq8WJ0z3rb5b9d7gQi+QaDAc+8UgA
-> ssh-ed25519 BVsyTA 8TYVSYseHWK0GCHcZ9coS0JdI0Cl0rWoVpzFRKgyaUE
-bVXw97FGDR2pEOoGokpUpy2yT6/nTvhQWLho3i2lSTM
-> ssh-ed25519 +3V2lQ Xlj/USDk+YAg3e63qO0u9AyOpAVBBCJV5kyvG/4UHmI
-2Iud4kbxE2sLJVp40w4MsoU8Qpb0BY0/TmnDIYrHfmY
--- 6mfdU2UTG6iCR15L+KwnmFrRFyFA2mIW1RNGdSERDfk
-mVK
l%iÂÂQ‹°ñ¨NclƒaøKŽ‰SÁøjÒq¸Bv½1ü|g•^¹/DüMªºåè?Ï•ò
+bjqZTVtnEmQe2/K4njziDWUd3oNMz3xhlqDJRepgnvfLcdIgtMz6lpT7h9VMLHAT
+5Br7nmsgOiVHkndu8C71gt/OyuD3O1QjY8u7bquqZ2fI+a7aG3tVun71P8CoYLfX
+bCqzpYSa+uc3Jqkie2lL1Wbs8kOaceQTmrLLqnYLP++hpzkK/BmDUoKqOcVbwUV8
+cuoJeVsCPXn/dIVIPg8Zgp6K7Rv6i10wBxKRLHtv++hWmpdXQ4oao34qt/nxwco4
+uwB8qmJ4Va60uUuwb0AlBeiauFAnl1aoGn01bYOHCKIRIBd5GyE52ZsHxDEZg/3Y
+vGa3a5gQQa7VT9dGF9GRjKusZdFCtiewbptZXdi0HFSDDbHkphJfoYUsYXsPloWs
+gWNSXqFngklxYGjJMMfAuomtYxdD50ramMY85C+/mLGuZSKQ9u/8DOcm0CLhRskc
+Xj/VhGGRIuQrLvb1QJGpV5DPgT0+vkrqvnNKMgQ24l2ziogsCBHkSIl6If2HQkGe
+QLyIl+CDLgIshQ6Qrg9c9dRzH3np2Fg3XT8ypbmfON0EERd4u3sZ+uZzYtkza8/X
+o/xVkIVUCJh2GwyxqAD22kJCro0qPn4F1HAFWy/rBMRbapXiYlUFnLVgEu3Gs6Lx
+PGMuqnT/3/uzko8lQR49zohmHGziYDPzmZEjRNrJu6w
+-> piv-p256 vRzPNw A2Deyx1/qvv9ylHmyTO149TvT6Pkh35iH+FggOqUPKYz
+PGBMYjusfUINKi7ayGJxzBuP6f9GrLH2qFtaSH7ZH9w
+-> piv-p256 zqq/iw AuosErZS/Pu9DeljWCfX/KqoRn21B1L9hwYeSnjHi0CJ
+wVQo1+s1l5ZHCGVYyIE2JgJi7DAe/Ms+/aNvF+9YtTk
+-> ssh-ed25519 YFSOsg jtYU04ZXp2zKnStgexrsiacwsAbJIV/ZBLa4YN5RPnE
+tiZn82jmUpJmcVhRzrCJbvfGgdDTm/SDJQuZ4depLzs
+-> ssh-ed25519 iHV63A wSTdp2qyNeNLnYaKyM6nmYmScLVirO0rtnDx9lKTX00
+mhRzqgPZHkrT6lHe6mdb9WYzV4UJ1o/GIqz0i17WZH8
+-> ssh-ed25519 BVsyTA cWa5esVjShFSk+NwZ/5/JRD13qtGXc/OU4o8sxSgD2k
+rL3tman5xeS0J+KxIs42m3uglv8G3516Zi9yyRsD7B0
+-> ssh-ed25519 +3V2lQ yfTuw0c9pIGYaIbUM0MYqCOiNH56iTMuA/DmPHqdlyc
+gkqHI4vx480aC3Qvytj5IuiKODMH454BMxRkOHHD7g4
+--- cxCIUqVXbLdIb14TLxFvRO065Ran0D9ZlEs17nlBggw
+áÚÅýÑwÆa¨*ýñD·ÔŽ%ï<>áÜÍ…˜-ÿ›ßk;÷ç±×-¤˜Ûpß¥ãõÒ<1F>°k³öPQþbá
--- a/secrets/mediawiki-oidc-client-secret.age
+++ b/secrets/mediawiki-oidc-client-secret.age
@ -1,44 +1,44 @@
 age-encryption.org/v1
-> ssh-ed25519 iDKjwg CEnU0iP4ogaMZ21Bn4x0xO94h0PEO1P2onUBGoYCgw4
-DqqwfjtV07Wo16uWdf+Od77maRar6spibmMyKlo7eSo
-> ssh-ed25519 uYcDNw C0np5b4g8BNBFV/0yw4hAkQHTDYrxuJTfV3+29NAHE4
-quppz1mstlcYLVFeUPrFj0+VVVMOhv5tSOD9+g/DTuU
+-> ssh-ed25519 iDKjwg B4Q4n3OQcImK3kQGY+lnpoV9X8Cg7dVEudqnwYXD8nE
+ezhdtoWHukS641yB2bGsz7OqekTC6wuVhJltH34KCEM
+-> ssh-ed25519 uYcDNw BqZs3Yy2bEJK/cAj0QXFi1JfEo+pVnYGwrKxreUobUI
+qRWxFsM4Ic+x1uaoKMcFldZ/D5UZ4dbcqoVGMJbMlCQ
 -> ssh-rsa f5THog
-UJTkDsNsPMWcCpA9woC1LWfw462PLfDXHKwPytO+El2RtAuJ46Y7cKNr1vtZIeA1
-vuCVe7jiBQb0VTvxW4h+GevsWdODB7oeRfunbPludU1XiFyvRNdfTo7lwi0PY7Ip
-RQoOcnq5e60OkndQL/Hs9qHnOwjjCyT5PMAkyYb+myUhho1hxs8hTbOtQ8E4+sIS
-+3y5p4qI9XONC2ZccCKq+vXBWTOjT7wl+lsB4k+8YhsKYcolYz40tIvz3WpIs5ex
-NvjCiaIW2p1IUYhpS+2fGbc+VN3TlLbjeb4N0GAqeJpzwsJaovAAPgJ2dKX/qP2h
-Et16W4MHo+4nHKvaHIYf9KzsfFPOqXhkhgHgUU0OC2+PTyZeUlAy8Iywa609PRWH
-MOLRBksKHAu83nxHbEnAy3333vKcMRU8IX6dvvgr62dQb358luaLAW58KB2AdYt3
-PMGSld8u5th2tMnt2HrNud5TvNhOGd4EquaoVrcBZZm6bKYDDs7WgsRdcJwoIkdr
-dqXiwJ1QpdbN/NUCig9v6gkVCzJw9rGOol67/nAq5tzvUN1GBCusV4XdFLZfW4mC
-bX/UcX1U4gn2dJj+iuBOdBj3xh16pqjOsxAreCYjUfC6zWhojeDeh8KsjkR7X8cR
-zyPKIvb+gn0OHJaH8NALXwpEP9xf9r6X5LMtdOH8L/0
+sNxBqEa+zGdScrGxMoCNIw4UXRhpIq6TVkAp/a/tAy46ko2aUp089mjLXYokLCEI
+ybEL/8ud8eYg3Ktj7crbcPhLcCtN8GR4M7AUXO2XssKK4kqrayOoXXJNT9UTIDuD
+zeyRE4WwVT/ggLBb2Fs84inH+Cab+r24MNlHc6wKHkiLGx2KB6IPv7iemH10Fews
+XGJaLp4W16tAnxRMuzHRHjhAtzx9j8tQTiEF1hOqIbxFcLP3ggZtpdTS6xX1KG/u
+nJZtFQaWG3uDmTVf7JRAowSEG+UBYEzHIxN1FRE9DVL9i1A/lmgAYhP7By8e/j2I
+eOfLa9eRHGAKoZ4B+RoNjb/NWuaVzoLQ/IzrvKq64zq+b5v1BSSGG9OtLk5E3dU7
+qoIl1aDObZ1hrGisJ2AxAOnC373vykxOhnHceeth8UqftNqARZLaAo3/LQJpq85a
+6a/ybNlrxD7DXCzM1CqdyHhHeOh4v/1fnB2wi94NX+Ke7RJ+PPHJoDhnMf7gIaVI
+IevVlzAt0tQ0QSwO9QYVNaP8O9KmmN1B2nf8qn+vscysvPUl2hzItcb0O2MYBfJJ
+SOwoTaHhwW63OK8FlfbOOgzMvxWMm4LSvA+n7UacKWJPDcR3PQzuK+k35sl+ScKB
+OfdblBDcqaUZ214AHzv1zq8k5356yUK+xYGWuFasxMY
 -> ssh-rsa kFDS0A
-hGi70Dd5OgZ0SGWEZPubG8IFXIylxOscm1uCZVJr2Z5bebo2gNNQt1LLyEQ6jvJ+
-HFBMqf8vFWsmyUQYNFRNwHbZrbURm4b7XEkFv/TIkkzrTihy2ZUo7p/t7xIHf9Nv
-31EbHLF4OisHmH9a0qwJrdR4lVzJ/q7IYcaY8ucNveBfBVodgM0XFvtx+HsZuEY3
-jGvm6vSFbqFCw8/I8G4CSLoDorC9OMz8Je/Za074UBdd5wV7fLt/YDbxxADFnhhX
-5Odt6oXrfLQlAHvOKjRdC1f1TvPdAVfRM94X96RFLSrML+7ADtdbs/X5a7VvghDn
-BVLEWg7F3ShRqzcPpY3uz2S2ccSblPKPNkkjlPLU6GU+J5TqWkeIaODTNDMJsFfR
-MNsNWWyYvBXuyWjZmxCbd7iE+rtDq4Pyh0UJBRXrUKYbpl0p+1B11VRJJ0j2ZLKG
-DolsqR5lg4Pnwsxw+TT6nSyYQJ8h3gfuIeo9u4ZrkcVFwv/fiw252iS4aPFWO2e6
-6aPRKJfMYW0FG2YMS+mTa+Y/nLATS0KXAN8GLzh7QyAUDoFVTAjl6otUclOzLj/8
-QeectHDsS/pjmhvsW7xzKmGeVJYjCw1ecuvwz4OV3dJm5J/7W1ZslWJ13Z1Z6mFq
-2vx6Qd543YnguSLyi4i6IClE8Ow4bc0KCX5pQhg2Gzc
-> piv-p256 vRzPNw Argk6m5H5waBp0UIrdv0O2T/qfyKthIDbSA4se0NJm8n
-CHHdgEldzhb7m4FRZAUSARsxKLEtwdPRrORCd1p7M5U
-> piv-p256 zqq/iw AtWsqjYNLms140yTXL+xxXvEpw1ehYDSc1Z5dineL7rQ
-eytefsFDJjaorWWAawsN9cm6G9wYby/ZcgWN2OxxtLs
-> ssh-ed25519 YFSOsg YnL/WNqBxRAEv2Sn6ADBtVxv+oAEzEzr7HbX5OR9vSA
-g3WFx4bKUQppDJKppn851eeWdLkpwXm3WT69oDEQo4g
-> ssh-ed25519 iHV63A DNLST+k4uxFP0LI5TeCi7ZlUgXfFMk42jb6yL8SayBA
-692IFxNSJCx9BpBBV2ukT3IvH+XAezyQXf0WLc3EPWY
-> ssh-ed25519 BVsyTA QTfzFaT68MykKpCShQvvdDnZ8cN+E+En6WSmo7rRf2k
-DACTBi93Z4G3Z9qwKN20YX1syCzgcMDlhvtgxCoLLvA
-> ssh-ed25519 +3V2lQ imxwf2/GA2BdEhpKweoVMijwHRzLz+6fvfrc0nZndVY
-usy59msFFQC0QS6xiE9Ln/uFVWK8a0dQYz7KR3vReZk
--- bDtTuziSuOoBpEsJ0xPk0O6u5q3V/4xvywlVmfQ/WEc
-²cÓ•~e¹€DrR1q
³*ï$!ÊFy¨¹<C2A8>2«æÆ½äóOo
-wD@!’ÓÚk¬Qù[ºú¨jÒÕ|óœÊhÓ
+IhS+V1Iv0rg2ZA/F9WOQGl7vjSGEsV8OXm7q77Uf9zHw3yxXrWkAS9MawdyT6shJ
+1SS51c8nFdx1135i4CqYwqQ94aCvZYMSMbub7bMQsHyEon1KPeLSJ01OP7Fzo8xP
+Ffv2BigbrCShKJfStO6ughS3lBhqLl0/bUINkjtTzzIpbVyW49AfCxhlt2xdkgls
+5HrRihfUInm0euaf3uDF+I5/sf1Z4s+1Ytce550etZMYuzb3uL/uLji4SlleTPzF
+MjEm3j3J9hNEbImXrE0URRMtvsn9vIsmEHcPiodutDJNtolEPLJCgi2xxbV0sFPd
+vDOSLHpC0+bkqGVpfCAoXZ3iipYhSJiff1x1vp06tsKRYFAPZ6Xf22G0F2qOH5ci
+ELIhxcC4uggN3zU6Kn6mu+cLquln5+F8mj3oUJvUgHbWxxsXbtwHONSoBu/zH4vX
+HsAbIvGi+MOoAxhRfWJZEAlpXuQWmdhVv93tV1ovNh3RPRjhZjHgKAOh6T4YNXVL
+w9QaOKjS5GVvRm4pzOr2FDr0S6XCmRPT5af3iaTx5mXCbOvKvcU4DHVoBf+z6AM
+EOeX6Nbg5Y53xw+XnoHOtJEZ3jlMOoHopYxoPkCZzebc24U0lRvoa/Sznp/NLCYe
+TZUsxYE0PKmS3y7Mbzsh9ndpSfdGyEO4g25293mVdn8
+-> piv-p256 vRzPNw A/G5cbWw8Qk/3coF3miTW4Ly6lEq14cqvZw+V3nRH3F7
+hIlZRI47gbHxFtVDMTzFWGK4opwASBs2+2UayfpNnu8
+-> piv-p256 zqq/iw Ah1dVGfIxLG1boPe9uzLQlodIZKIhssbbUTh0iHDWHjN
+JM5wYMuymrAj5C7eRUTv7jODft3qwr5julB9sGClGCs
+-> ssh-ed25519 YFSOsg SdjyfEQ8he0o9YJa/xOS4LRMAO6PhZVTMWFIAEs+FQg
+4GlYuqhtXtlrNAWKnz7NvcMxDqB0ippsfxQW0w0WaRs
+-> ssh-ed25519 iHV63A v0u3Hw6eO7bLfGZvn9ZlI3efgBDVITpj2R9+tS6vQC0
+SB+5Mu2UJbZHTK87NCnstwtwxUy7Nqax8LLJHPcgEmE
+-> ssh-ed25519 BVsyTA PJ6f0X5TjtbkOQAxAQlajnGz8VgWBLYCZvCB7tlzxi4
+w9UAYVwdhOFT8+9/zkprPXO16n7aMRDG2EwEfsXJ/vw
+-> ssh-ed25519 +3V2lQ imQ3snuaaxF8Y0NopC5u3qZi74HDEjhFc/cSRX5VRQU
+zEe8cxACsxrPFSDno96nyhga35ZJXB9rVKYzJY+eHPg
+--- +tHk8JDyqT3idP1MrsunTGcEO0DFuUec/fshqmsPp2g
+ﾒoﾇ/ｾ2鯵ﾝs{[`屑ｳ襞?o楕ｶ9默ｵH5ﾓ<35>ﾄ｣褸ｨｪﾇz
+0ﾚEﾟ隋ｷwｵ謐像gﾒ涅
--- a/secrets/mediawiki-secret-key.age
+++ b/secrets/mediawiki-secret-key.age
@ -1,43 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 iDKjwg LvWKgdnCYLVDqpuiUVLOI/r2MqbvPv8nnpHW/ZYi8kA
-QpCGQ5R3sjbTYYSg3AcWii7IeX6gSmVTM7K/sgFzUjk
-> ssh-ed25519 uYcDNw mb2CfQ/sQiKED7pSr0UwlflDFxdu8AIq3a1U0Ngvqz8
-mP0DjtT1hGq9aV/BXz5wHpiuY+yJISFivNL5Ai3QmVc
+-> ssh-ed25519 iDKjwg 2oxyNUkFiy7ibFwoekB0Z2jmSBEf8XyP1+42jNG7phM
+UlczSRNUs3KdeLvp8HUAk8wUfuuKEaN/s+C9wEBVtrY
+-> ssh-ed25519 uYcDNw mP2CBhTvN8h2UFp0Pm1zve6rIl5qF2qrMqBLcLFWuxE
+QUfrFUIeauO6zNbhyPuc0JCZ5Vb5mO/QfPkx4VyCUN4
 -> ssh-rsa f5THog
-bj4foR8WIGq/Q/QdETy7lCafQOmoQNGD0WylS1ig6HC3HQdV16IZUBoarRSPfZAm
-jKEan+AFpilmc/GV6rKN6FLIBnzy7VIH4kMlPyMR/Wzk5udFMQ1kcbb/VkoG+XSb
-7cQw3cMr+BJTj4yEnOFxvZ3euOdUBOABKNMY5P2zZVQOGq5RDMoiU3QXKQm9hoNu
-JGpmf2CX9VTv5nfxf/AaVWJFjI5mvCZl2Ut5lgZT7xECxoIFBiw+bcH7na6N8NZg
-Rz2AEcak5HP2s7EWCYQmZICwN2a/cgk/loPBrKtst01zSpG/h+yCyzBP5nnwtrtE
-6iBbIE37aT/mizEIjWCIlulWsMhNgF0sfzSRw+3UkyvDY30mYlOZ6SSetPdfBadN
-hN6RBTEo2JkpVVDNT4hrADeVx8lptVlKnTK9n7Ln7g+yLl/DvWJO2jV0hVSzvGfH
-1DxIB1BR79kL3KHWPNTCsJjtZVs3jRkBXxYHlIYN/2zEVw4p2g7E11PgK8mNWzsi
-JahqnOgrkutiK2xP/MYPqlFnp3vAbH0AgUu/8KFon5uH8mJeF7RkMQ0wyAYxlw0y
-B3jGeY5hypv9YVuYQ1zqgO8zeSYwqbXCVizKVDlAY+rfmtdZR8lYoC8h8GDgrd/Z
-hmPiqaxKwsBtm2ORuEELc10oBvR2zqdmwXtep4PZOQY
+AputF66htTIxUES7oCZL44NG5jYpM/F9qmGoN8+fm6k0f0oURozSYZSR2MW7iOcL
+Y4yeeCmHZ1u7MkL0zN2fBealNpKUR3AyfyUz0Bv/C2+7yiDUehkOq9ktsYjH/Bn4
+9EkdxwDDpC7485ZmDSQKuVw0p8XRvk0cC8lsZM/c8PjrJsF5d6AoVR9XzfFZqQXJ
+fn5Sk6OMZhneHB0snnCEiqCKKah1nbIgaJzUs69MaYM7rFYHqd+V9jcCOr73lIoA
+Zp1RTLybaWUOEtNUiLqy9j1CChdjCauSbGMCQrL+ZF8OZ2+v6CsrjG6LVV3JA3vY
+hLN0whrhbSbAj5JrLwx9f6oDwn+bNG6RXqFIpxpIbt1aN5xAX1mLuOl3XG0pzjhc
+t3k+XvaSUoNanrP3GdevYwLeVFejp+Ddf8uYQcVRf8PBEA9+WpI/4R+gP8tDBokp
+8t7GFqnfL2DPuEZWmo/46DtqRmMdqlVdt9WRccKYDDdcOpQFG9kxOhmopRUWnqZi
+/qbp0REISFD6/Kyfu1Htqf/3Hw4qHsViRKwLK/Bd59viP1Oa/No0T5RdXGoe7U9P
+3xmCAZpjPApTYenSpTusAVy0dFDsEk4Fpo+NZlr859PZ+3mxkJmvRpOy/NTPl4mL
+4JKDmyLe/QrQyUrYFfqdU+VsoORFN/lAKerADkOcFh8
 -> ssh-rsa kFDS0A
-llujbUS2prT/3g9DLaVoz2Y9HskNvSh0EBIZxbH6dVZ59UJD2zOKKdLxKIWv50Jy
-bMnwaJzWS5WA7O0E1PdtuKytNRBhWCdsMRT+fH2e1zgdwKlLbyAVzGw5XETyQMN+
-u46MJo+yhuaLhwTMZDIt+gNa5zohAPbDz6cA2XEyJY8RO6j4xGvVowGD3UU/LMKr
-zvT1HUVxGflcemuSvHdWlIZBZZl4ZrrL+FxVBgRlfpievtFpAZRRlv3+sxyknWa6
-gaph1/85S3Q503gcK6j9tvVWlrYaR5uaRFIj/DeL0YkRCFt9NX0OgPvu8L5hxBmc
-51zFbnFEBxMeLl44P4HTNCZuxZQMQZLeSVEsyyqq4qscbEut+hPHuhzGlVzi0qMP
-RlVgj8o2N0ihlKKK5Huo0he350yRxaoYo+zATv/Ly0zq8UMD6RQaE9GYGHwRylNl
-JzbbWLzUmTLtYi25lM/WT+H9yiEmQoj8fIPpE/EKubCBHFb5lG7y9FH7iFhBPCoC
-hLiktzScrFn6UJHfQLSmo3ANaBYNm+HHdROw7vFYowYQ2W3IDZR9C323Yl/dbtE0
-JNbXfjNeNK1xEl1kRjNmeGd5ChlFB8N1NbgtYb3hiypPq9rP+lB6IR7xQuSdAu/O
-4Sfug7J+AijffoQXaElrfIn5una3lmed7mMk0uaNTIg
-> piv-p256 vRzPNw AilxzZo4RK2OF0w8MfgqErW9N5k4QDmeh+G8lRbivggZ
-jO6r7reVSu7u0Ysd8QsMIg9xuKK7wgqGHG4rSvKEP20
-> piv-p256 zqq/iw A3DCqyhisy5rmWTtp7eGZv1fvYf1ex5Gu6vAQBPRopqA
-c8Giy6ce6xmKzIx2xFNnUu/0rF9Y7SP7cX+ZJyUzKkQ
-> ssh-ed25519 YFSOsg HucdhTX0K91R7HMKVpCLAK9njev1lTtTLXIJsBbsjFY
-Iatbon1/3EdX9wD4pkbpFeqaBLXD7Pq1JE6fwItaxu8
-> ssh-ed25519 iHV63A cZN7Y8ZllKtyZ9UQkSOTX/B3GmjlF/R00zSZy7RfvhY
-GaDpHUc19rPc1+k4ViFccN2FosdpOh9x9QDz4ROqh/4
-> ssh-ed25519 BVsyTA meGMMl2/5g19Nabbo++XqLxg+/NHVIXGl1wXFkvH/VA
-YMrGNHkf8y8ZD3xfERCCNRQB7hE4BuI9k095gpkb4aA
-> ssh-ed25519 +3V2lQ FYZQobNPTJhGecH3WSB5+2o/94Q9Kv2iDMhmmxV+qSY
-MCJzi4gBMytQhuYD7Do82wkarLLr2+6HlOc+Z7YTU58
--- DtFHKE5w9Hn6qD5/7A2uFrZNiFZLYrFsUyYPfRjvKlk
-Ž1Sª˜fPÎ]½8ácÉ½·¦ð/äûë˜äÇ¨#©Åµð·}}t¢ÉØ$¼	5hæûVâIñœõv8"!<21>
+Xlg1Paj4+EwLyqpvns4Tr0p6HldEAlGoXpWjhHDqyoTyu+afNVUlEZSdKZIZkuBA
+KknOhHd0F0WhEGA9ieA4zzRXQtT2IV1gZex+sS1IQyHskBzUIQ6wSGa7KGMwzkOB
+abDFCqybdbcgEtSt2kunAmDf62poBMiI2RAL9qQbA9qom53ekoUk5Ge+5EUW92B5
+HLnUwhj0j/D4sRL3gnNuZnXnxQAaPHr0Ojcjcx61XoFy1wUrZltVRW6X92/1diXn
+rulEuxVssOqWEpHi3dYaWpg0sJgrPP2K8FZ76Vz/j5QKvARXW/UeSwUeEr1H7cSi
+eA3IUB9SHIlRwVQOlrNa2WHj5v236+VQqOBQewwLb/ev5lE4TkA/HtHbtwnjyWWm
+P/pXXNDcFm7gA9FnzbUe+u7rbSdyZDGYff1Jp2xn5+aGsUUPmCIAJBlzOe/+RqCY
+03WUstGZ5SBuB3bC95IMSa8pwtNKDs62ZXqbe91GaqzzzYbsUeQSJkfKJkqRmRlT
+wdXJHxV1Ot7ulStbArVULrc20j5UESqmiJuQnqfd9dro4pMppcB+lkibFJS0Wm9A
+PGuHF1SHZoWCJA1tOccli3SwWcfXNQyoJ6Y1OGcHnt0lX82LwjOv/Fwy7QB/N5x3
+xD2b4BekULFjLPnrO3n5xhLxZWT20VWuVjVhzPKoqxg
+-> piv-p256 vRzPNw A8RM25Qglq8NFI5leRtDZZID8uLH9EMc6AayAqxxqWOp
+X7WQdS7eAZZGZPQtJpdaYonqgsz/fFRMNeL9VF/IU9c
+-> piv-p256 zqq/iw A9laFsikY0G40GXHdLPbpwMCJWz2vC9wojcY2rLmCO8R
+EjSFWrhl2n4hHO4o04NWok5C7slm7Bj2YZwKrtjiEdQ
+-> ssh-ed25519 YFSOsg 70Hc2RsbEeS38yVGFFwpSPsvaG2soKD0c7VkrqukPg0
+o7/Ok5BWjV/9rTKGOzJTHLx6IXBpq1i1ZlU+NvSw2Fg
+-> ssh-ed25519 iHV63A 2g1462VDxZN2eNS9hCSatW0BrX0FytjUCF505fCsHEs
+T2sh+D1xjtfJ5s9G0VChOsYRzcXpzKX9/j/HsB5c+Fg
+-> ssh-ed25519 BVsyTA WogYDmweYRM2ylkgvjtKx7etjFLjI5IRKFgA49/1xgQ
+o2HLBLoAuplW48b64xv4I6vD89SQbwT+uzIrtWo9+kM
+-> ssh-ed25519 +3V2lQ 2oTDm1sK6VVD1dxcjg8H+zYGPIyVcKklOiX6GFUsG3A
+ZDbhkYBEj1mx25GeeP5yCZt8S7iNbOcUbFEU+cY3+xA
+--- ugYfMD7r7efVTdPdzkplZSWjq/fC3luecBPwwd1AYbM
+T-@gQMG¼Ý ÏŠ>±Ð÷¼ñÁÓY¡ºD·ÅfÍ!ßÇ»4êG^aðé<C3B0>	jaË<wµvQk½ÿ‰ö¢ŒWk
--- a/secrets/metronom-root-ssh-key.age
+++ b/secrets/metronom-root-ssh-key.age
--- a/secrets/metronom-wg-private-key.age
+++ b/secrets/metronom-wg-private-key.age
--- a/secrets/nachtigall-root-ssh-key.age
+++ b/secrets/nachtigall-root-ssh-key.age
--- a/Show more
+++ b/Show more