nginx-matrix: add maintenance page

2024-06-22 16:57:32 +02:00
151 changed files with 1699 additions and 4928 deletions
--- a/.editorconfig
+++ b/.editorconfig
@ -20,8 +20,41 @@ indent_style = unset
 indent_size = unset

 [{.*,secrets}/**]
-end_of_line = false
-insert_final_newline = false
+end_of_line = unset
+insert_final_newline = unset
+trim_trailing_whitespace = unset
+charset = unset
+indent_style = unset
+indent_size = unset
+
+[*.rom]
+end_of_line = unset
+insert_final_newline = unset
+trim_trailing_whitespace = unset
+charset = unset
+indent_style = unset
+indent_size = unset
+
+[*.py]
+indent_size = 4
+
+[*.md]
+max_line_length = off
+trim_trailing_whitespace = false
+
+# Ignore diffs/patches
+[*.{diff,patch}]
+end_of_line = unset
+insert_final_newline = unset
+trim_trailing_whitespace = unset
+indent_size = unset
+charset = unset
+indent_style = unset
+indent_size = unset
+
+[{.*,secrets}/**]
+end_of_line = unset
+insert_final_newline = unset
 trim_trailing_whitespace = unset
 charset = unset
 indent_style = unset
--- a/.forgejo/workflows/check.yml
+++ b/.forgejo/workflows/check.yml
@ -18,20 +18,14 @@ jobs:
          # Prevent cache garbage collection by creating GC roots
          mkdir -p /var/lib/gitea-runner/tankstelle/.local/state/nix/results

-          for target in $(nix flake show --json --all-systems | jq --raw-output '
+          for target in $(nix flake show --json --all-systems | jq '
            .["nixosConfigurations"] |
            to_entries[] |
-            .key'
+            .key
+            ' | tr -d '"'
          ); do
            nix --print-build-logs --verbose --accept-flake-config --access-tokens '' \
              build --out-link /var/lib/gitea-runner/tankstelle/.local/state/nix/results/"$target" ".#nixosConfigurations.${target}.config.system.build.toplevel"
          done

-          for check in $(nix flake show --json --all-systems | jq --raw-output '
-            .checks."x86_64-linux" |
-            to_entries[] |
-            .key'
-          ); do
-            nix --print-build-logs --verbose --accept-flake-config --access-tokens '' \
-              build --out-link /var/lib/gitea-runner/tankstelle/.local/state/nix/results/"$check" ".#checks.x86_64-linux.${check}"
-          done
+          nix --print-build-logs --verbose --accept-flake-config --access-tokens '' flake check
--- a/docs/administrative-access.md
+++ b/docs/administrative-access.md
@ -63,6 +63,12 @@ Example NixOS snippet for WireGuard client config
            #endpoint = "138.201.80.102:51820";
            persistentKeepalive = 15;
          }
+          { # flora-6.pub.solar
+            publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
+            allowedIPs = [ "10.7.6.2/32" "fd00:fae:fae:fae:fae:2::/96" ];
+            endpoint = "80.71.153.210:51820";
+            persistentKeepalive = 15;
+          }
          { # metronom.pub.solar
            publicKey = "zOSYGO7MfnOOUnzaTcWiKRQM0qqxR3JQrwx/gtEtHmo=";
            allowedIPs = [ "10.7.6.3/32" "fd00:fae:fae:fae:fae:3::/96" ];
@ -79,39 +85,6 @@ Example NixOS snippet for WireGuard client config
            #endpoint = "80.244.242.5:51820";
            persistentKeepalive = 15;
          }
-          {
-            # trinkgenossin.pub.solar
-            publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
-            allowedIPs = [
-              "10.7.6.5/32"
-              "fd00:fae:fae:fae:fae:5::/96"
-            ];
-            #endpoint = "85.215.152.22:51820";
-            endpoint = "[2a01:239:35d:f500::1]:51820";
-            persistentKeepalive = 15;
-          }
-          {
-            # delite.pub.solar
-            publicKey = "ZT2qGWgMPwHRUOZmTQHWCRX4m14YwOsiszjsA5bpc2k=";
-            allowedIPs = [
-              "10.7.6.6/32"
-              "fd00:fae:fae:fae:fae:6::/96"
-            ];
-            #endpoint = "5.255.119.132:51820";
-            endpoint = "[2a04:52c0:124:9d8c::2]:51820";
-            persistentKeepalive = 15;
-          }
-          {
-            # blue-shell.pub.solar
-            publicKey = "bcrIpWrKc1M+Hq4ds3aN1lTaKE26f2rvXhd+93QrzR8=";
-            allowedIPs = [
-              "10.7.6.7/32"
-              "fd00:fae:fae:fae:fae:7::/96"
-            ];
-            #endpoint = "194.13.83.205:51820";
-            endpoint = "[2a03:4000:43:24e::1]:51820";
-            persistentKeepalive = 15;
-          }
        ];
      };
    };
--- a/docs/backups.md
+++ b/docs/backups.md
@ -1,36 +0,0 @@
-# Backups
-
-We use [Restic](https://restic.readthedocs.io/en/stable/) to create backups and push them to two repositories.
-Check `./modules/backups.nix` and `./hosts/nachtigall/backups.nix` for working examples.
-
-### Hetzner Storagebox
-
- Uses SFTP for transfer of backups
-
-Adding a new host SSH public key to the storagebox:
-
-First, [SSH to nachtigall](./administrative-access.md#ssh-access), then become root and add the new SSH public key
-
-```
-sudo -i
-echo '<ssh-public-key>' | ssh -p23 u377325@u377325.your-storagebox.de install-ssh-key
-```
-
-[Link to Hetzner storagebox docs](https://docs.hetzner.com/robot/storage-box/backup-space-ssh-keys).
-
-### Garage S3 buckets
-
- Uses S3 for transfer of backups
- One bucket per host, e.g. `nachtigall-backups`, `metronom-backups`
-
-To start transfering backups from a new hosts, this is how to create a new bucket:
-
-First, [SSH to trinkgenossin](./administrative-access.md#ssh-access), then use the `garage` CLI to create a new key and bucket:
-
-```
-export GARAGE_RPC_SECRET=<secret-in-keepass>
-
-garage bucket create <hostname>-backups
-garage key create <hostname>-backups-key
-garage bucket allow <hostname>-backups --read --write --key <hostname>-backups-key
-```
--- a/docs/deploying.md
+++ b/docs/deploying.md
@ -13,6 +13,12 @@ For nachtigall.pub.solar:
 deploy --targets '.#nachtigall' --magic-rollback false --auto-rollback false --keep-result --result-path ./results
 ```

+For flora-6.pub.solar:
+
+```
+deploy --targets '.#flora-6' --magic-rollback false --auto-rollback false --keep-result --result-path ./results
+```
+
 For metronom.pub.solar (aarch64-linux):

 ```
--- a/docs/dns.md
+++ b/docs/dns.md
@ -1,10 +1,18 @@
 # Changing DNS entries

 Our current DNS provider is [namecheap](https://www.namecheap.com/).
-We use [OpenTofu](https://opentofu.org) to declaratively manage our pub.solar DNS records.
+We use [Terraform](https://www.terraform.io) to declaratively manage our pub.solar DNS records.

 ### Initial setup

+Skip this step if you already have a `triton` profile setup.
+
+```
+triton profile create
+```
+
+Please follow https://docs.greenbaum.cloud/en/devops/triton-cli.html for the details.
+
 You will need to setup the following [namecheap API credentials](https://www.namecheap.com/support/api/intro),
 look for "namecheap API key" in the pub.solar Keepass database.

@ -20,15 +28,13 @@ You will probably also need to add your external IP to the [API allow list](http
 dig -4 ip @dns.toys
 ```

-Now, change into the terraform directory and initialize the terraform providers. To decrypt existing state,
-search for "terraform state passphrase" in the pub.solar Keepass database.
+Now, change into the terraform directory and initialize the terraform providers.

 ```
 cd terraform
-export TF_VAR_state_passphrase=$(secret-tool lookup pub.solar terraform-state-passphrase-dns)
+export TRITON_KEY_ID=$(cat ~/.config/triton/profiles.d/lev-1-pub_solar.json | jq --raw-output .keyId)

-alias tofu="terraform-backend-git --access-logs --tf tofu git terraform"
-tofu init
+terraform init
 ```

 Make your changes, e.g. in `dns.tf`.
@ -40,21 +46,20 @@ $EDITOR dns.tf
 Plan your changes using:

 ```
-tofu plan -out pub-solar-infra.plan
+terraform plan -out pub-solar-infra.plan
 ```

 After verification, apply your changes with:

 ```
-tofu apply "pub-solar-infra.plan"
+terraform apply "pub-solar-infra.plan"
 ```

 ### Useful links

-We use terraform-backend-git remote backend with opentofu state encryption for collaboration.
+We use the Manta remote backend to save the terraform state for collaboration.

- https://github.com/plumber-cd/terraform-backend-git
- https://opentofu.org/docs/language/state/encryption
+- https://www.terraform.io/language/v1.2.x/settings/backends/manta

 Namecheap Terraform provider docs:

--- a/docs/drone-ci.md
+++ b/docs/drone-ci.md
@ -0,0 +1,19 @@
+# Drone CI
+
+We currently use two CI systems, [drone CI](https://drone.io), reachable via
+https://ci.pub.solar and [Forgejo Actions](https://forgejo.org/docs/latest/user/actions/),
+which UI is integrated into https://git.pub.solar, for example
+https://git.pub.solar/pub-solar/infra/actions.
+
+### Signing the `.drone.yml` file
+
+Login to https://ci.pub.solar by clicking on the user icon in the bottom left.
+After logging in, you can view your personal API token by clicking on the same
+icon. If you're using the nix [development-shell](./development-shell.md), the
+`drone` command will already be installed.
+
+```
+export DRONE_TOKEN=<your-drone-api-token>
+
+drone --token $DRONE_TOKEN sign --save pub-solar/os
+```
--- a/docs/garage.md
+++ b/docs/garage.md
@ -1,49 +0,0 @@
-# Garage
-
-### How-To create a new bucket + keys
-
-Requirements:
-
- [Setup WireGuard](./administrative-access.md#ssh-access) for hosts: `trinkgenossin`, optionally: `delite`, `blue-shell`
-
-```
-ssh barkeeper@trinkgenossin.wg.pub.solar
-
-export GARAGE_RPC_SECRET=<secret-in-keepass>
-
-garage bucket create <bucket-name>
-garage key create <bucket-name>-key
-garage bucket allow <bucket-name> --read --write --key <bucket-name>-key
-```
-
-Docs: https://garagehq.deuxfleurs.fr/documentation/quick-start/#creating-buckets-and-keys
-
-Then [setup your favourite S3 client](https://garagehq.deuxfleurs.fr/documentation/connect/cli/)
-or use the bucket with any [S3 compatible software](https://garagehq.deuxfleurs.fr/documentation/connect/).
-
-### Notes on manual setup steps
-
-```
-ssh barkeeper@trinkgenossin.wg.pub.solar
-
-export GARAGE_RPC_SECRET=<secret-in-keepass>
-
-# Uses the default config /etc/garage.toml
-garage node id
-
-garage node connect <node-id2>
-garage node connect <node-id3>
-
-garage status
-
-#Zones
-#DE-1 DE-2 NL-1
-
-garage layout assign fdaa -z DE-1 -c 800G -t trinkgenossin
-garage layout assign 8835 -z DE-2 -c 800G -t blue-shell
-garage layout assign 73da -z NL-1 -c 800G -t delite
-garage layout show
-garage layout apply --version 1
-```
-
-Source: https://garagehq.deuxfleurs.fr/documentation/cookbook/real-world/#creating-a-cluster-layout
--- a/docs/mediawiki-updates.md
+++ b/docs/mediawiki-updates.md
@ -4,7 +4,7 @@ See the [mediawiki-oidc-docker repository](https://git.pub.solar/pub-solar/media
 for instructions on updating our customized mediawiki docker image.

 To deploy a new docker image to `nachtigall`, first bump the mediawiki version
-of the docker image tag in `modules/mediawiki/default.nix` (search for
+of the docker image tag in `hosts/nachtigall/apps/mediawiki.nix` (search for
 `image`).

 Next, push your changes to https://git.pub.solar and get them reviewed and
@ -19,7 +19,7 @@ exit
 ```

 ```
-deploy --targets '.#nachtigall' --magic-rollback false --auto-rollback false --keep-result --result-path ./results
+deploy --targets '.#nachtigall'
 ```

 Then, finalize the update by running the database migration script (in a [SSH](./administrative-access.md#ssh-access) shell on `nachtigall`):
--- a/docs/nixos-anywhere.md
+++ b/docs/nixos-anywhere.md
@ -1,13 +0,0 @@
-```
-curl -L https://github.com/nix-community/nixos-images/releases/download/nixos-unstable/nixos-kexec-installer-noninteractive-x86_64-linux.tar.gz | tar -xzf- -C /root
-/root/kexec/run
-```
-
-```
-mkdir -p /etc/secrets/initrd
-ssh-keygen -t ed25519 -f /etc/secrets/initrd/ssh_host_ed25519_key
-```
-
-```
-nix run github:nix-community/nixos-anywhere -- --flake .#blue-shell root@194.13.83.205
-```
--- a/docs/unlocking-zfs-pool.md
+++ b/docs/unlocking-zfs-pool.md
@ -6,13 +6,13 @@ accessing the server via SSH as user `root` on port 2222.
 Nachtigall:

 ```
-ssh -4 root@nachtigall.pub.solar -p2222
+ssh root@nachtigall.pub.solar -p2222
 ```

 Metronom:

 ```
-ssh -4 root@metronom.pub.solar -p2222
+ssh root@metronom.pub.solar -p2222
 ```

 After connecting, paste the encryption passphrase you can find in the shared
--- a/flake.lock
+++ b/flake.lock
@ -14,11 +14,11 @@
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1723293904,
-        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
+        "lastModified": 1716561646,
+        "narHash": "sha256-UIGtLO89RxKt7RF2iEgPikSdU53r6v/6WYB0RW3k89I=",
        "owner": "ryantm",
        "repo": "agenix",
-        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
+        "rev": "c2fc0762bbe8feb06a2e59a364fa81b3a57671c9",
        "type": "github"
      },
      "original": {
@ -52,11 +52,11 @@
        "utils": "utils"
      },
      "locked": {
-        "lastModified": 1718194053,
-        "narHash": "sha256-FaGrf7qwZ99ehPJCAwgvNY5sLCqQ3GDiE/6uLhxxwSY=",
+        "lastModified": 1715699772,
+        "narHash": "sha256-sKhqIgucN5sI/7UQgBwsonzR4fONjfMr9OcHK/vPits=",
        "owner": "serokell",
        "repo": "deploy-rs",
-        "rev": "3867348fa92bc892eba5d9ddb2d7a97b9e127a8a",
+        "rev": "b3ea6f333f9057b77efd9091119ba67089399ced",
        "type": "github"
      },
      "original": {
@ -87,26 +87,6 @@
        "type": "github"
      }
    },
-    "disko": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1724349583,
-        "narHash": "sha256-zgB1Cfk46irIsto8666yLdKjqKdBrjR48Dd3lhQ0CnQ=",
-        "owner": "nix-community",
-        "repo": "disko",
-        "rev": "435737144be0259559ca3b43f7d72252b1fdcc1b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "disko",
-        "type": "github"
-      }
-    },
    "element-stickers": {
      "inputs": {
        "maunium-stickerpicker": [
@ -134,11 +114,11 @@
    "element-themes": {
      "flake": false,
      "locked": {
-        "lastModified": 1718859621,
-        "narHash": "sha256-ZOOm6UFGNSkGrdwbG5saLAYgAPYJ7E80ogA40CaW+E4=",
+        "lastModified": 1716915815,
+        "narHash": "sha256-5xOzatIJIzu/38TQAYWO8eFtYl0kaCBFJWrjLyyluU8=",
        "owner": "aaronraimist",
        "repo": "element-themes",
-        "rev": "3bc82abc3dd468dabc933f0f9d0b443ed97554a6",
+        "rev": "6ed3a981191cbd59f03ea530f16e096b9a4c278c",
        "type": "github"
      },
      "original": {
@ -167,11 +147,11 @@
    "flake-compat_2": {
      "flake": false,
      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "lastModified": 1668681692,
+        "narHash": "sha256-Ht91NGdewz8IQLtWZ9LCeNXMSXHUss+9COoqu6JLmXU=",
        "owner": "edolstra",
        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "009399224d5e398d03b22badca40a37ac85412a1",
        "type": "github"
      },
      "original": {
@ -185,11 +165,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1722555600,
-        "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
+        "lastModified": 1717285511,
+        "narHash": "sha256-iKzJcpdXih14qYVcZ9QC9XuZYnPc6T8YImb6dX166kw=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
+        "rev": "2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8",
        "type": "github"
      },
      "original": {
@ -234,6 +214,21 @@
        "type": "github"
      }
    },
+    "flake-utils_3": {
+      "locked": {
+        "lastModified": 1653893745,
+        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@ -241,16 +236,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1720042825,
-        "narHash": "sha256-A0vrUB6x82/jvf17qPCpxaM+ulJnD8YZwH9Ci0BsAzE=",
+        "lastModified": 1717476296,
+        "narHash": "sha256-ScHe38Tr+TxGURC17kby4mIIxOG3aJvZWXzPM79UnEk=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "e1391fb22e18a36f57e6999c7a9f966dc80ac073",
+        "rev": "095ef64aa3b2ab4a4f1bf07f29997e21e3a5576a",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "release-24.05",
+        "ref": "release-23.11",
        "repo": "home-manager",
        "type": "github"
      }
@ -282,11 +277,11 @@
      "flake": false,
      "locked": {
        "dir": "web",
-        "lastModified": 1718796561,
-        "narHash": "sha256-RKAAHve17lrJokgAPkM2k/E+f9djencwwg3Xcd70Yfw=",
+        "lastModified": 1716038335,
+        "narHash": "sha256-OjmeIkSds59i6lHG/M3Z+32k9nGgm/owJ4x+xwyx0Qs=",
        "owner": "maunium",
        "repo": "stickerpicker",
-        "rev": "333567f481e60443360aa7199d481e1a45b3a523",
+        "rev": "47f17fde452b5e9f0c9e96ce0e2c878dd0574b7f",
        "type": "github"
      },
      "original": {
@ -304,11 +299,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1724299755,
-        "narHash": "sha256-P5zMA17kD9tqiqMuNXwupkM7buM3gMNtoZ1VuJTRDE4=",
+        "lastModified": 1716993688,
+        "narHash": "sha256-vo5k2wQekfeoq/2aleQkBN41dQiQHNTniZeVONWiWLs=",
        "owner": "lnl7",
        "repo": "nix-darwin",
-        "rev": "a8968d88e5a537b0491f68ce910749cd870bdbef",
+        "rev": "c0d5b8c54d6828516c97f6be9f2d00c63a363df4",
        "type": "github"
      },
      "original": {
@ -320,11 +315,11 @@
    },
    "nixos-flake": {
      "locked": {
-        "lastModified": 1721140942,
-        "narHash": "sha256-iEqZGdnkG+Hm0jZhS59NJwEyB6z9caVnudWPGHZ/FAE=",
+        "lastModified": 1716406291,
+        "narHash": "sha256-qHjJ6alc4o3p51hrPp3JGdC5Pbz5EjF+UZq1HbK8av0=",
        "owner": "srid",
        "repo": "nixos-flake",
-        "rev": "5734c1d9a5fe0bc8e8beaf389ad6227392ca0108",
+        "rev": "aa9100167350cbdffaa272b0fd382d7c23606b86",
        "type": "github"
      },
      "original": {
@ -335,37 +330,82 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1724242322,
-        "narHash": "sha256-HMpK7hNjhEk4z5SFg5UtxEio9OWFocHdaQzCfW1pE7w=",
+        "lastModified": 1717159533,
+        "narHash": "sha256-oamiKNfr2MS6yH64rUn99mIZjc45nGJlj9eGth/3Xuw=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "224042e9a3039291f22f4f2ded12af95a616cca0",
+        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
        "type": "github"
      },
      "original": {
        "owner": "nixos",
-        "ref": "nixos-24.05",
+        "ref": "nixos-23.11",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
+    "nixpkgs-2205": {
+      "locked": {
+        "lastModified": 1685573264,
+        "narHash": "sha256-Zffu01pONhs/pqH07cjlF10NnMDLok8ix5Uk4rhOnZQ=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "380be19fbd2d9079f677978361792cb25e8a3635",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-22.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-23_05": {
+      "locked": {
+        "lastModified": 1704290814,
+        "narHash": "sha256-LWvKHp7kGxk/GEtlrGYV68qIvPHkU9iToomNFGagixU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "70bdadeb94ffc8806c0570eb5c2695ad29f0e421",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-23.05",
+        "type": "indirect"
+      }
+    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1722555339,
-        "narHash": "sha256-uFf2QeW7eAHlYXuDktm9c25OxOyCoUOQmh5SZ9amE5Q=",
+        "lastModified": 1717284937,
+        "narHash": "sha256-lIbdfCsf8LMFloheeE6N31+BMIeixqyQWbSr2vk79EQ=",
        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/a5d394176e64ab29c852d03346c1fc9b0b7d33eb.tar.gz"
+        "url": "https://github.com/NixOS/nixpkgs/archive/eb9ceca17df2ea50a250b6b27f7bf6ab0186f198.tar.gz"
      },
      "original": {
        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/a5d394176e64ab29c852d03346c1fc9b0b7d33eb.tar.gz"
+        "url": "https://github.com/NixOS/nixpkgs/archive/eb9ceca17df2ea50a250b6b27f7bf6ab0186f198.tar.gz"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1705856552,
+        "narHash": "sha256-JXfnuEf5Yd6bhMs/uvM67/joxYKoysyE3M2k6T3eWbg=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "612f97239e2cc474c13c9dafa0df378058c5ad8d",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-unstable",
+        "type": "indirect"
      }
    },
    "root": {
      "inputs": {
        "agenix": "agenix",
        "deploy-rs": "deploy-rs",
-        "disko": "disko",
        "element-stickers": "element-stickers",
        "element-themes": "element-themes",
        "flake-parts": "flake-parts",
@ -375,7 +415,9 @@
        "nix-darwin": "nix-darwin",
        "nixos-flake": "nixos-flake",
        "nixpkgs": "nixpkgs",
+        "nixpkgs-2205": "nixpkgs-2205",
        "simple-nixos-mailserver": "simple-nixos-mailserver",
+        "triton-vmtools": "triton-vmtools",
        "unstable": "unstable"
      }
    },
@ -383,25 +425,24 @@
      "inputs": {
        "blobs": "blobs",
        "flake-compat": "flake-compat_2",
-        "nixpkgs": [
-          "unstable"
-        ],
-        "nixpkgs-24_05": [
+        "nixpkgs": "nixpkgs_2",
+        "nixpkgs-23_05": "nixpkgs-23_05",
+        "nixpkgs-23_11": [
          "nixpkgs"
        ],
        "utils": "utils_2"
      },
      "locked": {
-        "lastModified": 1718084203,
-        "narHash": "sha256-Cx1xoVfSMv1XDLgKg08CUd1EoTYWB45VmB9XIQzhmzI=",
+        "lastModified": 1706219574,
+        "narHash": "sha256-qO+8UErk+bXCq2ybHU4GzXG4Ejk4Tk0rnnTPNyypW4g=",
        "owner": "simple-nixos-mailserver",
        "repo": "nixos-mailserver",
-        "rev": "29916981e7b3b5782dc5085ad18490113f8ff63b",
+        "rev": "e47f3719f1db3e0961a4358d4cb234a0acaa7baf",
        "type": "gitlab"
      },
      "original": {
        "owner": "simple-nixos-mailserver",
-        "ref": "nixos-24.05",
+        "ref": "nixos-23.11",
        "repo": "nixos-mailserver",
        "type": "gitlab"
      }
@ -466,28 +507,37 @@
        "type": "github"
      }
    },
-    "systems_5": {
+    "triton-vmtools": {
+      "inputs": {
+        "flake-utils": "flake-utils_3",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
+        "dir": "vmtools",
+        "lastModified": 1698443513,
+        "narHash": "sha256-wX2JIJ3JmJn6MAurdyjwZU+FZjLCwBArMrVSeeCb/ZU=",
+        "ref": "main",
+        "rev": "0d039dcf06afb8cbddd7ac54bae4d0d185f3e88e",
+        "revCount": 85,
+        "type": "git",
+        "url": "https://git.pub.solar/pub-solar/infra-vintage?dir=vmtools"
      },
      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
+        "dir": "vmtools",
+        "ref": "main",
+        "type": "git",
+        "url": "https://git.pub.solar/pub-solar/infra-vintage?dir=vmtools"
      }
    },
    "unstable": {
      "locked": {
-        "lastModified": 1724224976,
-        "narHash": "sha256-Z/ELQhrSd7bMzTO8r7NZgi9g5emh+aRKoCdaAv5fiO0=",
+        "lastModified": 1717196966,
+        "narHash": "sha256-yZKhxVIKd2lsbOqYd5iDoUIwsRZFqE87smE2Vzf6Ck0=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "c374d94f1536013ca8e92341b540eba4c22f9c62",
+        "rev": "57610d2f8f0937f39dbd72251e9614b1561942d8",
        "type": "github"
      },
      "original": {
@ -516,15 +566,12 @@
      }
    },
    "utils_2": {
-      "inputs": {
-        "systems": "systems_5"
-      },
      "locked": {
-        "lastModified": 1709126324,
-        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
+        "lastModified": 1605370193,
+        "narHash": "sha256-YyMTf3URDL/otKdKgtoMChu4vfVL3vCMkRqpGifhUn0=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
+        "rev": "5021eac20303a61fafe17224c087f5519baed54d",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@ -1,13 +1,15 @@
 {
  inputs = {
    # Track channels with commits tested and built by hydra
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";
    unstable.url = "github:nixos/nixpkgs/nixos-unstable";

+    nixpkgs-2205.url = "github:nixos/nixpkgs/nixos-22.05";
+
    nix-darwin.url = "github:lnl7/nix-darwin/master";
    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";

-    home-manager.url = "github:nix-community/home-manager/release-24.05";
+    home-manager.url = "github:nix-community/home-manager/release-23.11";
    home-manager.inputs.nixpkgs.follows = "nixpkgs";

    flake-parts.url = "github:hercules-ci/flake-parts";
@ -16,9 +18,6 @@
    deploy-rs.url = "github:serokell/deploy-rs";
    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";

-    disko.url = "github:nix-community/disko";
-    disko.inputs.nixpkgs.follows = "nixpkgs";
-
    agenix.url = "github:ryantm/agenix";
    agenix.inputs.nixpkgs.follows = "nixpkgs";
    agenix.inputs.darwin.follows = "nix-darwin";
@ -27,6 +26,9 @@
    keycloak-theme-pub-solar.url = "git+https://git.pub.solar/pub-solar/keycloak-theme?ref=main";
    keycloak-theme-pub-solar.inputs.nixpkgs.follows = "nixpkgs";

+    triton-vmtools.url = "git+https://git.pub.solar/pub-solar/infra-vintage?ref=main&dir=vmtools";
+    triton-vmtools.inputs.nixpkgs.follows = "nixpkgs";
+
    element-themes.url = "github:aaronraimist/element-themes/master";
    element-themes.flake = false;

@ -37,9 +39,8 @@
    element-stickers.inputs.maunium-stickerpicker.follows = "maunium-stickerpicker";
    element-stickers.inputs.nixpkgs.follows = "nixpkgs";

-    simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-24.05";
-    simple-nixos-mailserver.inputs.nixpkgs-24_05.follows = "nixpkgs";
-    simple-nixos-mailserver.inputs.nixpkgs.follows = "unstable";
+    simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-23.11";
+    simple-nixos-mailserver.inputs.nixpkgs-23_11.follows = "nixpkgs";
  };

  outputs =
@ -63,7 +64,6 @@
          system,
          pkgs,
          config,
-          lib,
          ...
        }:
        {
@ -76,27 +76,6 @@
            unstable = import inputs.unstable { inherit system; };
            master = import inputs.master { inherit system; };
          };
-
-          checks =
-            let
-              nixos-lib = import (inputs.nixpkgs + "/nixos/lib") { };
-              testDir = builtins.attrNames (builtins.readDir ./tests);
-              testFiles = builtins.filter (n: builtins.match "^.*.nix$" n != null) testDir;
-            in
-            builtins.listToAttrs (
-              map (x: {
-                name = "test-${lib.strings.removeSuffix ".nix" x}";
-                value = nixos-lib.runTest (
-                  import (./tests + "/${x}") {
-                    inherit self;
-                    inherit pkgs;
-                    inherit lib;
-                    inherit config;
-                  }
-                );
-              }) testFiles
-            );
-
          devShells.default = pkgs.mkShell {
            buildInputs = with pkgs; [
              deploy-rs
@ -111,13 +90,10 @@
              shfmt
              treefmt
              nixos-generators
-              inputs.unstable.legacyPackages.${system}.opentofu
-              terraform-backend-git
-              terraform-ls
+              inputs.nixpkgs-2205.legacyPackages.${system}.terraform
              jq
            ];
          };
-
          devShells.ci = pkgs.mkShell { buildInputs = with pkgs; [ nodejs ]; };
        };

@ -146,6 +122,10 @@
              hostname = "nachtigall.wg.pub.solar";
              sshUser = username;
            };
+            flora-6 = {
+              hostname = "flora-6.wg.pub.solar";
+              sshUser = username;
+            };
            metronom = {
              hostname = "metronom.wg.pub.solar";
              sshUser = username;
@ -154,18 +134,6 @@
              hostname = "tankstelle.wg.pub.solar";
              sshUser = username;
            };
-            trinkgenossin = {
-              hostname = "trinkgenossin.wg.pub.solar";
-              sshUser = username;
-            };
-            delite = {
-              hostname = "delite.wg.pub.solar";
-              sshUser = username;
-            };
-            blue-shell = {
-              hostname = "blue-shell.wg.pub.solar";
-              sshUser = username;
-            };
          };
        };
    };
--- a/hosts/blue-shell/configuration.nix
+++ b/hosts/blue-shell/configuration.nix
@ -1,33 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  boot.loader.grub.enable = true;
-
-  boot.kernelParams = [
-    "boot.shell_on_fail=1"
-    "ip=dhcp"
-  ];
-
-  # This option defines the first version of NixOS you have installed on this particular machine,
-  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
-  #
-  # Most users should NEVER change this value after the initial install, for any reason,
-  # even if you've upgraded your system to a new NixOS release.
-  #
-  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
-  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
-  # to actually do that.
-  #
-  # This value being lower than the current NixOS release does NOT mean your system is
-  # out of date, out of support, or vulnerable.
-  #
-  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
-  # and migrated your data accordingly.
-  #
-  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
-  system.stateVersion = "24.05"; # Did you read the comment?
-}
--- a/hosts/blue-shell/disk-config.nix
+++ b/hosts/blue-shell/disk-config.nix
@ -1,101 +0,0 @@
-{
-  disko.devices = {
-    disk = {
-      main = {
-        type = "disk";
-        device = "/dev/vdb";
-        content = {
-          type = "gpt";
-          partitions = {
-            bios = {
-              size = "1M";
-              type = "EF02"; # for grub MBR
-            };
-            boot = {
-              size = "1G";
-              type = "8300";
-              content = {
-                type = "filesystem";
-                format = "ext4";
-                mountpoint = "/boot";
-                mountOptions = [ "defaults" ];
-              };
-            };
-            luks = {
-              size = "100%";
-              content = {
-                type = "luks";
-                name = "cryptroot";
-                extraOpenArgs = [ ];
-                # if you want to use the key for interactive login be sure there is no trailing newline
-                # for example use `echo -n "password" > /tmp/secret.key`
-                passwordFile = "/tmp/luks-password";
-                content = {
-                  type = "lvm_pv";
-                  vg = "vg0";
-                };
-              };
-            };
-          };
-        };
-      };
-      data = {
-        type = "disk";
-        device = "/dev/vdc";
-        content = {
-          type = "gpt";
-          partitions = {
-            luks = {
-              size = "100%";
-              content = {
-                type = "luks";
-                name = "cryptdata";
-                extraOpenArgs = [ ];
-                # if you want to use the key for interactive login be sure there is no trailing newline
-                # for example use `echo -n "password" > /tmp/secret.key`
-                passwordFile = "/tmp/luks-password";
-                content = {
-                  type = "filesystem";
-                  format = "xfs";
-                  mountpoint = "/var/lib/garage/data";
-                  mountOptions = [ "defaults" ];
-                };
-              };
-            };
-          };
-        };
-      };
-    };
-    lvm_vg = {
-      vg0 = {
-        type = "lvm_vg";
-        lvs = {
-          root = {
-            size = "100G";
-            content = {
-              type = "filesystem";
-              format = "ext4";
-              mountpoint = "/";
-              mountOptions = [ "defaults" ];
-            };
-          };
-          swap = {
-            size = "16G";
-            content = {
-              type = "swap";
-            };
-          };
-          metadata = {
-            size = "50G";
-            content = {
-              type = "filesystem";
-              format = "btrfs";
-              mountpoint = "/var/lib/garage/meta";
-              mountOptions = [ "defaults" ];
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/hosts/blue-shell/hardware-configuration.nix
+++ b/hosts/blue-shell/hardware-configuration.nix
@ -1,27 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-
-  boot.initrd.availableKernelModules = [
-    "ata_piix"
-    "uhci_hcd"
-    "virtio_pci"
-    "sr_mod"
-    "virtio_blk"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}
--- a/hosts/blue-shell/networking.nix
+++ b/hosts/blue-shell/networking.nix
@ -1,26 +0,0 @@
-{
-  config,
-  pkgs,
-  flake,
-  ...
-}:
-{
-  services.garage.settings.rpc_public_addr = "[2a03:4000:43:24e::1]:3901";
-
-  networking.hostName = "blue-shell";
-  networking.hostId = "00000005";
-
-  networking.useDHCP = false;
-  systemd.network.enable = true;
-  systemd.network.networks."10-wan" = {
-    matchConfig.Name = "ens3";
-    address = [
-      "194.13.83.205/22"
-      "2a03:4000:43:24e::1/64"
-    ];
-    gateway = [
-      "194.13.80.1"
-      "fe80::1"
-    ];
-  };
-}
--- a/hosts/blue-shell/wireguard.nix
+++ b/hosts/blue-shell/wireguard.nix
@ -1,51 +0,0 @@
-{
-  config,
-  pkgs,
-  flake,
-  ...
-}:
-let
-  wireguardIPv4 = "10.7.6.7";
-  wireguardIPv6 = "fd00:fae:fae:fae:fae:7::";
-in
-{
-  networking.firewall.allowedUDPPorts = [ 51820 ];
-
-  age.secrets.wg-private-key.file = "${flake.self}/secrets/blue-shell-wg-private-key.age";
-
-  networking.wireguard.interfaces = {
-    wg-ssh = {
-      listenPort = 51820;
-      mtu = 1300;
-      ips = [
-        "${wireguardIPv4}/32"
-        "${wireguardIPv6}/96"
-      ];
-      privateKeyFile = config.age.secrets.wg-private-key.path;
-      peers = flake.self.logins.admins.wireguardDevices ++ [
-        {
-          # trinkgenossin.pub.solar
-          publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
-          allowedIPs = [
-            "10.7.6.5/32"
-            "fd00:fae:fae:fae:fae:5::/96"
-          ];
-          #endpoint = "80.244.242.5:51820";
-          endpoint = "[2a01:239:35d:f500::1]:51820";
-          persistentKeepalive = 15;
-        }
-      ];
-    };
-  };
-
-  services.openssh.listenAddresses = [
-    {
-      addr = wireguardIPv4;
-      port = 22;
-    }
-    {
-      addr = "[${wireguardIPv6}]";
-      port = 22;
-    }
-  ];
-}
--- a/hosts/default.nix
+++ b/hosts/default.nix
@ -11,7 +11,6 @@
          self.nixosModules.unlock-zfs-on-boot
          self.nixosModules.core
          self.nixosModules.docker
-          self.nixosModules.backups

          self.nixosModules.nginx
          self.nixosModules.collabora
@ -34,7 +33,6 @@
          self.nixosModules.promtail
          self.nixosModules.searx
          self.nixosModules.tmate
-          self.nixosModules.tt-rss
          self.nixosModules.obs-portal
          self.nixosModules.matrix
          self.nixosModules.matrix-irc
@ -43,6 +41,24 @@
        ];
      };

+      flora-6 = self.nixos-flake.lib.mkLinuxSystem {
+        imports = [
+          self.inputs.agenix.nixosModules.default
+          self.nixosModules.home-manager
+          ./flora-6
+          self.nixosModules.overlays
+          self.nixosModules.core
+
+          self.nixosModules.keycloak
+          self.nixosModules.caddy
+          self.nixosModules.drone
+          self.nixosModules.forgejo-actions-runner
+          self.nixosModules.grafana
+          self.nixosModules.prometheus
+          self.nixosModules.loki
+        ];
+      };
+
      metronom = self.nixos-flake.lib.mkLinuxSystem {
        imports = [
          self.inputs.agenix.nixosModules.default
@ -51,7 +67,6 @@
          self.nixosModules.overlays
          self.nixosModules.unlock-zfs-on-boot
          self.nixosModules.core
-          self.nixosModules.backups
          self.nixosModules.mail
          self.nixosModules.prometheus-exporters
          self.nixosModules.promtail
@ -67,66 +82,10 @@
          ./tankstelle
          self.nixosModules.overlays
          self.nixosModules.core
-          self.nixosModules.backups
          self.nixosModules.prometheus-exporters
          self.nixosModules.promtail
        ];
      };
-
-      trinkgenossin = self.nixos-flake.lib.mkLinuxSystem {
-        imports = [
-          self.inputs.agenix.nixosModules.default
-          self.nixosModules.home-manager
-          ./trinkgenossin
-          self.nixosModules.backups
-          self.nixosModules.overlays
-          self.nixosModules.unlock-luks-on-boot
-          self.nixosModules.core
-
-          self.nixosModules.garage
-          self.nixosModules.nginx
-
-          # This module is already using options, and those options are used by the grafana module
-          self.nixosModules.keycloak
-          self.nixosModules.grafana
-          self.nixosModules.prometheus
-          self.nixosModules.loki
-        ];
-      };
-
-      delite = self.nixos-flake.lib.mkLinuxSystem {
-        imports = [
-          self.inputs.agenix.nixosModules.default
-          self.inputs.disko.nixosModules.disko
-          self.nixosModules.home-manager
-          ./delite
-          self.nixosModules.overlays
-          self.nixosModules.unlock-luks-on-boot
-          self.nixosModules.core
-          self.nixosModules.prometheus-exporters
-          self.nixosModules.promtail
-
-          self.nixosModules.garage
-          self.nixosModules.nginx
-        ];
-      };
-
-      blue-shell = self.nixos-flake.lib.mkLinuxSystem {
-        imports = [
-          self.inputs.agenix.nixosModules.default
-          self.inputs.disko.nixosModules.disko
-          self.nixosModules.home-manager
-          ./blue-shell
-          self.nixosModules.overlays
-          self.nixosModules.unlock-luks-on-boot
-          self.nixosModules.core
-          self.nixosModules.prometheus-exporters
-          self.nixosModules.promtail
-
-          self.nixosModules.garage
-          self.nixosModules.nginx
-        ];
-      };
    };
  };
 }
--- a/hosts/delite/configuration.nix
+++ b/hosts/delite/configuration.nix
@ -1,33 +0,0 @@
-{
-  flake,
-  config,
-  pkgs,
-  ...
-}:
-{
-  boot.loader.grub.enable = true;
-
-  boot.kernelParams = [
-    "boot.shell_on_fail=1"
-    "ip=5.255.119.132::5.255.119.1:255.255.255.0:delite::off"
-  ];
-
-  # This option defines the first version of NixOS you have installed on this particular machine,
-  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
-  #
-  # Most users should NEVER change this value after the initial install, for any reason,
-  # even if you've upgraded your system to a new NixOS release.
-  #
-  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
-  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
-  # to actually do that.
-  #
-  # This value being lower than the current NixOS release does NOT mean your system is
-  # out of date, out of support, or vulnerable.
-  #
-  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
-  # and migrated your data accordingly.
-  #
-  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
-  system.stateVersion = "24.05"; # Did you read the comment?
-}
--- a/hosts/delite/default.nix
+++ b/hosts/delite/default.nix
@ -1,13 +0,0 @@
-{ flake, ... }:
-
-{
-  imports = [
-    ./hardware-configuration.nix
-    ./configuration.nix
-    ./disk-config.nix
-
-    ./networking.nix
-    ./wireguard.nix
-    #./backups.nix
-  ];
-}
--- a/hosts/delite/disk-config.nix
+++ b/hosts/delite/disk-config.nix
@ -1,84 +0,0 @@
-{
-  disko.devices = {
-    disk = {
-      main = {
-        type = "disk";
-        device = "/dev/vda";
-        content = {
-          type = "gpt";
-          partitions = {
-            bios = {
-              size = "1M";
-              type = "EF02"; # for grub MBR
-            };
-            boot = {
-              size = "1G";
-              type = "8300";
-              content = {
-                type = "filesystem";
-                format = "ext4";
-                mountpoint = "/boot";
-                mountOptions = [ "defaults" ];
-              };
-            };
-            luks = {
-              size = "100%";
-              content = {
-                type = "luks";
-                name = "cryptroot";
-                extraOpenArgs = [ ];
-                # if you want to use the key for interactive login be sure there is no trailing newline
-                # for example use `echo -n "password" > /tmp/secret.key`
-                passwordFile = "/tmp/luks-password";
-                content = {
-                  type = "lvm_pv";
-                  vg = "vg0";
-                };
-              };
-            };
-          };
-        };
-      };
-    };
-    lvm_vg = {
-      vg0 = {
-        type = "lvm_vg";
-        lvs = {
-          root = {
-            size = "40G";
-            content = {
-              type = "filesystem";
-              format = "ext4";
-              mountpoint = "/";
-              mountOptions = [ "defaults" ];
-            };
-          };
-          swap = {
-            size = "8G";
-            content = {
-              type = "swap";
-            };
-          };
-          data = {
-            size = "800G";
-            content = {
-              type = "filesystem";
-              format = "xfs";
-              mountpoint = "/var/lib/garage/data";
-              mountOptions = [ "defaults" ];
-            };
-          };
-          metadata = {
-            size = "50G";
-            content = {
-              type = "filesystem";
-              format = "btrfs";
-              mountpoint = "/var/lib/garage/meta";
-              mountOptions = [ "defaults" ];
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/hosts/delite/hardware-configuration.nix
+++ b/hosts/delite/hardware-configuration.nix
@ -1,26 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-
-  boot.initrd.availableKernelModules = [
-    "ata_piix"
-    "uhci_hcd"
-    "virtio_pci"
-    "virtio_blk"
-  ];
-  boot.initrd.kernelModules = [ "dm-snapshot" ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}
--- a/hosts/delite/networking.nix
+++ b/hosts/delite/networking.nix
@ -1,26 +0,0 @@
-{
-  config,
-  pkgs,
-  flake,
-  ...
-}:
-{
-  services.garage.settings.rpc_public_addr = "[2a04:52c0:124:9d8c::2]:3901";
-
-  networking.hostName = "delite";
-  networking.hostId = "00000004";
-
-  networking.useDHCP = false;
-  systemd.network.enable = true;
-  systemd.network.networks."10-wan" = {
-    matchConfig.Name = "ens3";
-    address = [
-      "5.255.119.132/24"
-      "2a04:52c0:124:9d8c::2/48"
-    ];
-    gateway = [
-      "5.255.119.1"
-      "2a04:52c0:124::1"
-    ];
-  };
-}
--- a/hosts/delite/wireguard.nix
+++ b/hosts/delite/wireguard.nix
@ -1,51 +0,0 @@
-{
-  config,
-  pkgs,
-  flake,
-  ...
-}:
-let
-  wireguardIPv4 = "10.7.6.6";
-  wireguardIPv6 = "fd00:fae:fae:fae:fae:6::";
-in
-{
-  networking.firewall.allowedUDPPorts = [ 51820 ];
-
-  age.secrets.wg-private-key.file = "${flake.self}/secrets/delite-wg-private-key.age";
-
-  networking.wireguard.interfaces = {
-    wg-ssh = {
-      listenPort = 51820;
-      mtu = 1300;
-      ips = [
-        "${wireguardIPv4}/32"
-        "${wireguardIPv6}/96"
-      ];
-      privateKeyFile = config.age.secrets.wg-private-key.path;
-      peers = flake.self.logins.admins.wireguardDevices ++ [
-        {
-          # trinkgenossin.pub.solar
-          publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
-          allowedIPs = [
-            "10.7.6.5/32"
-            "fd00:fae:fae:fae:fae:5::/96"
-          ];
-          #endpoint = "80.244.242.5:51820";
-          endpoint = "[2a01:239:35d:f500::1]:51820";
-          persistentKeepalive = 15;
-        }
-      ];
-    };
-  };
-
-  services.openssh.listenAddresses = [
-    {
-      addr = wireguardIPv4;
-      port = 22;
-    }
-    {
-      addr = "[${wireguardIPv6}]";
-      port = 22;
-    }
-  ];
-}
--- a/hosts/flora-6/configuration.nix
+++ b/hosts/flora-6/configuration.nix
@ -0,0 +1,72 @@
+{
+  config,
+  lib,
+  pkgs,
+  flake,
+  ...
+}:
+let
+  psCfg = config.pub-solar;
+in
+{
+  config = {
+    # Override nix.conf for more agressive garbage collection
+    nix.extraOptions = lib.mkForce ''
+      experimental-features = flakes nix-command
+      min-free = 536870912
+      keep-outputs = false
+      keep-derivations = false
+      fallback = true
+    '';
+
+    # # #
+    # # # Triton host specific options
+    # # # DO NOT ALTER below this line, changes might render system unbootable
+    # # #
+
+    # Use the systemd-boot EFI boot loader.
+    boot.loader.systemd-boot.enable = true;
+    boot.loader.efi.canTouchEfiVariables = true;
+
+    # Force getting the hostname from cloud-init
+    networking.hostName = lib.mkDefault "";
+
+    # We use cloud-init to configure networking, this option should fix
+    # systemd-networkd-wait-online timeouts
+    #systemd.services."systemd-networkd".environment.SYSTEMD_LOG_LEVEL = "debug";
+    systemd.network.wait-online.ignoredInterfaces = [
+      "docker0"
+      "wg-ssh"
+    ];
+
+    # List services that you want to enable:
+    services.cloud-init.enable = true;
+    services.cloud-init.ext4.enable = true;
+    services.cloud-init.network.enable = true;
+    # use the default NixOS cloud-init config, but add some SmartOS customization to it
+    environment.etc."cloud/cloud.cfg.d/90_smartos.cfg".text = ''
+      datasource_list: [ SmartOS ]
+
+      # Do not create the centos/ubuntu/debian user
+      users: [ ]
+
+      # mount second disk with label ephemeral0, gets formated by cloud-init
+      # this will fail to get added to /etc/fstab as it's read-only, but should
+      # mount at boot anyway
+      mounts:
+      - [ vdb, /data, auto, "defaults,nofail" ]
+    '';
+
+    # We manage the firewall with nix, too
+    # altough triton can also manage firewall rules via the triton fwrule subcommand
+    networking.firewall.enable = true;
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "22.05"; # Did you read the comment?
+  };
+}
--- a/hosts/blue-shell/default.nix
+++ b/hosts/blue-shell/default.nix
@ -1,13 +1,11 @@
-{ flake, ... }:
+{ ... }:

 {
  imports = [
+    # Include the results of the hardware scan.
    ./hardware-configuration.nix
    ./configuration.nix
-    ./disk-config.nix
-
-    ./networking.nix
+    ./triton-vmtools.nix
    ./wireguard.nix
-    #./backups.nix
  ];
 }
--- a/hosts/trinkgenossin/hardware-configuration.nix
+++ b/hosts/trinkgenossin/hardware-configuration.nix
@ -8,47 +8,45 @@
  modulesPath,
  ...
 }:
-
 {
  imports = [ ];

  boot.initrd.availableKernelModules = [
-    "ata_piix"
-    "uhci_hcd"
+    "ahci"
    "virtio_pci"
+    "xhci_pci"
    "sr_mod"
    "virtio_blk"
  ];
-  boot.initrd.kernelModules = [ "dm-snapshot" ];
-  boot.kernelModules = [ "kvm-amd" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
  boot.extraModulePackages = [ ];

-  boot.initrd.luks.devices."cryptroot" = {
-    device = "/dev/disk/by-uuid/52a1fd17-63d7-4d0a-b7ff-74aceaf6085a";
-  };
-
  fileSystems."/" = {
    device = "/dev/disk/by-label/nixos";
+    autoResize = true;
    fsType = "ext4";
  };

  fileSystems."/boot" = {
    device = "/dev/disk/by-label/boot";
+    fsType = "vfat";
+  };
+
+  fileSystems."/data" = {
+    device = "/dev/disk/by-label/ephemeral0";
    fsType = "ext4";
+    options = [
+      "defaults"
+      "nofail"
+    ];
  };

-  fileSystems."/var/lib/garage/data" = {
-    device = "/dev/disk/by-label/data";
-    fsType = "xfs";
-  };
+  swapDevices = [ ];

-  fileSystems."/var/lib/garage/meta" = {
-    device = "/dev/disk/by-label/metadata";
-    fsType = "btrfs";
-  };
-
-  swapDevices = [ { device = "/dev/disk/by-label/swap"; } ];
+  networking.useDHCP = lib.mkDefault false;
+  networking.networkmanager.enable = lib.mkForce false;

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  virtualisation.hypervGuest.enable = true;
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
--- a/hosts/flora-6/triton-vmtools.nix
+++ b/hosts/flora-6/triton-vmtools.nix
@ -0,0 +1,6 @@
+{ pkgs, flake, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    flake.inputs.triton-vmtools.packages.${pkgs.system}.default
+  ];
+}
--- a/hosts/trinkgenossin/wireguard.nix
+++ b/hosts/trinkgenossin/wireguard.nix
@ -4,22 +4,18 @@
  flake,
  ...
 }:
-let
-  wireguardIPv4 = "10.7.6.5";
-  wireguardIPv6 = "fd00:fae:fae:fae:fae:5::";
-in
 {
  networking.firewall.allowedUDPPorts = [ 51820 ];

-  age.secrets.wg-private-key.file = "${flake.self}/secrets/trinkgenossin-wg-private-key.age";
+  age.secrets.wg-private-key.file = "${flake.self}/secrets/flora6-wg-private-key.age";

  networking.wireguard.interfaces = {
    wg-ssh = {
      listenPort = 51820;
      mtu = 1300;
      ips = [
-        "${wireguardIPv4}/32"
-        "${wireguardIPv6}/96"
+        "10.7.6.2/32"
+        "fd00:fae:fae:fae:fae:2::/96"
      ];
      privateKeyFile = config.age.secrets.wg-private-key.path;
      peers = flake.self.logins.admins.wireguardDevices ++ [
@ -51,35 +47,17 @@ in
            "fd00:fae:fae:fae:fae:4::/96"
          ];
        }
-        {
-          # delite.pub.solar
-          endpoint = "5.255.119.132:51820";
-          publicKey = "ZT2qGWgMPwHRUOZmTQHWCRX4m14YwOsiszjsA5bpc2k=";
-          allowedIPs = [
-            "10.7.6.6/32"
-            "fd00:fae:fae:fae:fae:6::/96"
-          ];
-        }
-        {
-          # blue-shell.pub.solar
-          endpoint = "194.13.83.205:51820";
-          publicKey = "bcrIpWrKc1M+Hq4ds3aN1lTaKE26f2rvXhd+93QrzR8=";
-          allowedIPs = [
-            "10.7.6.7/32"
-            "fd00:fae:fae:fae:fae:7::/96"
-          ];
-        }
      ];
    };
  };

  services.openssh.listenAddresses = [
    {
-      addr = wireguardIPv4;
+      addr = "10.7.6.2";
      port = 22;
    }
    {
-      addr = "[${wireguardIPv6}]";
+      addr = "[fd00:fae:fae:fae:fae:2::]";
      port = 22;
    }
  ];
--- a/hosts/metronom/backups.nix
+++ b/hosts/metronom/backups.nix
@ -1,29 +1,13 @@
-{ config, flake, ... }:
+{ flake, ... }:
 {
-  age.secrets."restic-repo-storagebox-metronom" = {
-    file = "${flake.self}/secrets/restic-repo-storagebox-metronom.age";
+  age.secrets."restic-repo-droppie" = {
+    file = "${flake.self}/secrets/restic-repo-droppie.age";
    mode = "400";
    owner = "root";
  };
-  age.secrets.restic-repo-garage-metronom = {
-    file = "${flake.self}/secrets/restic-repo-garage-metronom.age";
+  age.secrets."restic-repo-storagebox" = {
+    file = "${flake.self}/secrets/restic-repo-storagebox.age";
    mode = "400";
    owner = "root";
  };
-  age.secrets.restic-repo-garage-metronom-env = {
-    file = "${flake.self}/secrets/restic-repo-garage-metronom-env.age";
-    mode = "400";
-    owner = "root";
-  };
-
-  pub-solar-os.backups.repos.storagebox = {
-    passwordFile = config.age.secrets."restic-repo-storagebox-metronom".path;
-    repository = "sftp:u377325@u377325.your-storagebox.de:/metronom-backups";
-  };
-
-  pub-solar-os.backups.repos.garage = {
-    passwordFile = config.age.secrets."restic-repo-garage-metronom".path;
-    environmentFile = config.age.secrets."restic-repo-garage-metronom-env".path;
-    repository = "s3:https://buckets.pub.solar/metronom-backups";
-  };
 }
--- a/hosts/metronom/configuration.nix
+++ b/hosts/metronom/configuration.nix
@ -18,19 +18,6 @@
  # https://nixos.wiki/wiki/ZFS#declarative_mounting_of_ZFS_datasets
  systemd.services.zfs-mount.enable = false;

-  services.zfs.autoScrub = {
-    enable = true;
-    pools = [ "root_pool" ];
-  };
-
-  # Declarative SSH private key
-  age.secrets."metronom-root-ssh-key" = {
-    file = "${flake.self}/secrets/metronom-root-ssh-key.age";
-    path = "/root/.ssh/id_ed25519";
-    mode = "400";
-    owner = "root";
-  };
-
  # Declarative SSH private key
  #age.secrets."metronom-root-ssh-key" = {
  #  file = "${flake.self}/secrets/metronom-root-ssh-key.age";
--- a/hosts/metronom/default.nix
+++ b/hosts/metronom/default.nix
@ -7,6 +7,6 @@

    ./networking.nix
    ./wireguard.nix
-    ./backups.nix
+    #./backups.nix
  ];
 }
--- a/hosts/metronom/wireguard.nix
+++ b/hosts/metronom/wireguard.nix
@ -19,6 +19,15 @@
      ];
      privateKeyFile = config.age.secrets.wg-private-key.path;
      peers = flake.self.logins.admins.wireguardDevices ++ [
+        {
+          # flora-6.pub.solar
+          endpoint = "80.71.153.210:51820";
+          publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
+          allowedIPs = [
+            "10.7.6.2/32"
+            "fd00:fae:fae:fae:fae:2::/96"
+          ];
+        }
        {
          # nachtigall.pub.solar
          endpoint = "138.201.80.102:51820";
@ -28,17 +37,6 @@
            "fd00:fae:fae:fae:fae:1::/96"
          ];
        }
-        {
-          # trinkgenossin.pub.solar
-          publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
-          allowedIPs = [
-            "10.7.6.5/32"
-            "fd00:fae:fae:fae:fae:5::/96"
-          ];
-          #endpoint = "80.244.242.5:51820";
-          endpoint = "[2a01:239:35d:f500::1]:51820";
-          persistentKeepalive = 15;
-        }
      ];
    };
  };
--- a/hosts/nachtigall/backups.nix
+++ b/hosts/nachtigall/backups.nix
@ -1,34 +1,13 @@
-{ config, flake, ... }:
+{ flake, ... }:
 {
  age.secrets."restic-repo-droppie" = {
    file = "${flake.self}/secrets/restic-repo-droppie.age";
    mode = "400";
    owner = "root";
  };
-  age.secrets."restic-repo-storagebox-nachtigall" = {
-    file = "${flake.self}/secrets/restic-repo-storagebox-nachtigall.age";
+  age.secrets."restic-repo-storagebox" = {
+    file = "${flake.self}/secrets/restic-repo-storagebox.age";
    mode = "400";
    owner = "root";
  };
-  age.secrets.restic-repo-garage-nachtigall = {
-    file = "${flake.self}/secrets/restic-repo-garage-nachtigall.age";
-    mode = "400";
-    owner = "root";
-  };
-  age.secrets.restic-repo-garage-nachtigall-env = {
-    file = "${flake.self}/secrets/restic-repo-garage-nachtigall-env.age";
-    mode = "400";
-    owner = "root";
-  };
-
-  pub-solar-os.backups.repos.storagebox = {
-    passwordFile = config.age.secrets."restic-repo-storagebox-nachtigall".path;
-    repository = "sftp:u377325@u377325.your-storagebox.de:/backups";
-  };
-
-  pub-solar-os.backups.repos.garage = {
-    passwordFile = config.age.secrets."restic-repo-garage-nachtigall".path;
-    environmentFile = config.age.secrets."restic-repo-garage-nachtigall-env".path;
-    repository = "s3:https://buckets.pub.solar/nachtigall-backups";
-  };
 }
--- a/hosts/nachtigall/configuration.nix
+++ b/hosts/nachtigall/configuration.nix
@ -35,11 +35,6 @@
  # https://nixos.wiki/wiki/ZFS#declarative_mounting_of_ZFS_datasets
  systemd.services.zfs-mount.enable = false;

-  services.zfs.autoScrub = {
-    enable = true;
-    pools = [ "root_pool" ];
-  };
-
  # Declarative SSH private key
  age.secrets."nachtigall-root-ssh-key" = {
    file = "${flake.self}/secrets/nachtigall-root-ssh-key.age";
@ -48,21 +43,9 @@
    owner = "root";
  };

-  age.secrets.keycloak-database-password = {
-    file = "${flake.self}/secrets/keycloak-database-password.age";
-    mode = "600";
-    #owner = "keycloak";
-  };
+  pub-solar-os.auth.enable = true;

-  pub-solar-os.auth = {
-    enable = true;
-    database-password-file = config.age.secrets.keycloak-database-password.path;
-  };
-
-  systemd.services.postgresql = {
-    after = [ "var-lib-postgresql.mount" ];
-    requisite = [ "var-lib-postgresql.mount" ];
-  };
+  nixpkgs.config.permittedInsecurePackages = [ "keycloak-23.0.6" ];

  # This value determines the NixOS release with which your system is to be
  # compatible, in order to avoid breaking some software such as database
--- a/hosts/nachtigall/wireguard.nix
+++ b/hosts/nachtigall/wireguard.nix
@ -19,6 +19,15 @@
      ];
      privateKeyFile = config.age.secrets.wg-private-key.path;
      peers = flake.self.logins.admins.wireguardDevices ++ [
+        {
+          # flora-6.pub.solar
+          endpoint = "80.71.153.210:51820";
+          publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
+          allowedIPs = [
+            "10.7.6.2/32"
+            "fd00:fae:fae:fae:fae:2::/96"
+          ];
+        }
        {
          # tankstelle.pub.solar
          endpoint = "80.244.242.5:51820";
@ -28,17 +37,6 @@
            "fd00:fae:fae:fae:fae:4::/96"
          ];
        }
-        {
-          # trinkgenossin.pub.solar
-          publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
-          allowedIPs = [
-            "10.7.6.5/32"
-            "fd00:fae:fae:fae:fae:5::/96"
-          ];
-          #endpoint = "80.244.242.5:51820";
-          endpoint = "[2a01:239:35d:f500::1]:51820";
-          persistentKeepalive = 15;
-        }
      ];
    };
  };
--- a/hosts/tankstelle/backups.nix
+++ b/hosts/tankstelle/backups.nix
@ -5,8 +5,8 @@
    mode = "400";
    owner = "root";
  };
-  age.secrets."restic-repo-storagebox-tankstelle" = {
-    file = "${flake.self}/secrets/restic-repo-storagebox-tankstelle.age";
+  age.secrets."restic-repo-storagebox" = {
+    file = "${flake.self}/secrets/restic-repo-storagebox.age";
    mode = "400";
    owner = "root";
  };
--- a/hosts/tankstelle/wireguard.nix
+++ b/hosts/tankstelle/wireguard.nix
@ -29,15 +29,13 @@
          ];
        }
        {
-          # trinkgenossin.pub.solar
-          publicKey = "QWgHovHxtqiQhnHLouSWiT6GIoQDmuvnThYL5c/rvU4=";
+          # flora-6.pub.solar
+          endpoint = "80.71.153.210:51820";
+          publicKey = "jtSR5G2P/nm9s8WrVc26Xc/SQLupRxyXE+5eIeqlsTU=";
          allowedIPs = [
-            "10.7.6.5/32"
-            "fd00:fae:fae:fae:fae:5::/96"
+            "10.7.6.2/32"
+            "fd00:fae:fae:fae:fae:2::/96"
          ];
-          #endpoint = "80.244.242.5:51820";
-          endpoint = "[2a01:239:35d:f500::1]:51820";
-          persistentKeepalive = 15;
        }
      ];
    };
--- a/hosts/trinkgenossin/configuration.nix
+++ b/hosts/trinkgenossin/configuration.nix
@ -1,35 +0,0 @@
-{
-  flake,
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  boot.loader.grub.enable = true;
-  boot.loader.grub.devices = [ "/dev/vda" ];
-
-  boot.kernelParams = [
-    "boot.shell_on_fail=1"
-    "ip=dhcp"
-  ];
-
-  # This option defines the first version of NixOS you have installed on this particular machine,
-  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
-  #
-  # Most users should NEVER change this value after the initial install, for any reason,
-  # even if you've upgraded your system to a new NixOS release.
-  #
-  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
-  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
-  # to actually do that.
-  #
-  # This value being lower than the current NixOS release does NOT mean your system is
-  # out of date, out of support, or vulnerable.
-  #
-  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
-  # and migrated your data accordingly.
-  #
-  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
-  system.stateVersion = "24.05"; # Did you read the comment?
-}
--- a/hosts/trinkgenossin/default.nix
+++ b/hosts/trinkgenossin/default.nix
@ -1,12 +0,0 @@
-{ flake, ... }:
-
-{
-  imports = [
-    ./hardware-configuration.nix
-    ./configuration.nix
-
-    ./networking.nix
-    ./wireguard.nix
-    #./backups.nix
-  ];
-}
--- a/hosts/trinkgenossin/networking.nix
+++ b/hosts/trinkgenossin/networking.nix
@ -1,15 +0,0 @@
-{
-  config,
-  pkgs,
-  flake,
-  ...
-}:
-{
-  services.garage.settings.rpc_public_addr = "[2a01:239:35d:f500::1]:3901";
-
-  networking.hostName = "trinkgenossin";
-  networking.hostId = "00000003";
-
-  networking.enableIPv6 = true;
-  networking.useDHCP = true;
-}
--- a/logins/robots.nix
+++ b/logins/robots.nix
@ -2,5 +2,6 @@
  # Used for restic backups to droppie, a server run by @b12f
  "root@droppie" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZQSephFJU0NMbVbhwvVJ2/m6jcPYo1IsWCsoarqKin root@droppie";

-  "hakkonaut" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP5MvCwNRtCcP1pSDrn0XZTNlpOqYnjHDm9/OI4hECW hakkonaut";
+  # robot user on flora-6
+  "hakkonaut@flora-6" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP5MvCwNRtCcP1pSDrn0XZTNlpOqYnjHDm9/OI4hECW hakkonaut@flora-6";
 }
--- a/modules/backups/default.nix
+++ b/modules/backups/default.nix
@ -1,290 +0,0 @@
-{
-  flake,
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  utils = import "${flake.inputs.nixpkgs}/nixos/lib/utils.nix" {
-    inherit lib;
-    inherit config;
-    inherit pkgs;
-  };
-  # Type for a valid systemd unit option. Needed for correctly passing "timerConfig" to "systemd.timers"
-  inherit (utils.systemdUtils.unitOptions) unitOption;
-  inherit (lib)
-    literalExpression
-    mkOption
-    mkPackageOption
-    types
-    ;
-in
-{
-  options.pub-solar-os.backups = {
-    repos = mkOption {
-      description = ''
-        Configuration of Restic repositories.
-      '';
-      type = types.attrsOf (
-        types.submodule (
-          { name, ... }:
-          {
-            options = {
-              passwordFile = mkOption {
-                type = types.str;
-                description = ''
-                  Read the repository password from a file.
-                '';
-                example = "/etc/nixos/restic-password";
-              };
-
-              environmentFile = mkOption {
-                type = with types; nullOr str;
-                default = null;
-                description = ''
-                  Read repository secrets as environment variables from a file.
-                '';
-                example = "/etc/nixos/restic-env";
-              };
-
-              repository = mkOption {
-                type = with types; nullOr str;
-                default = null;
-                description = ''
-                  repository to backup to.
-                '';
-                example = "sftp:backup@192.168.1.100:/backups/${name}";
-              };
-            };
-          }
-        )
-      );
-
-      default = { };
-      example = {
-        remotebackup = {
-          repository = "sftp:backup@host:/backups/home";
-          passwordFile = "/etc/nixos/secrets/restic-password";
-          environmentFile = "/etc/nixos/secrets/restic-env";
-        };
-      };
-    };
-
-    restic = mkOption {
-      description = ''
-        Periodic backups to create with Restic.
-      '';
-      type = types.attrsOf (
-        types.submodule (
-          { name, ... }:
-          {
-            options = {
-              paths = mkOption {
-                # This is nullable for legacy reasons only. We should consider making it a pure listOf
-                # after some time has passed since this comment was added.
-                type = types.nullOr (types.listOf types.str);
-                default = [ ];
-                description = ''
-                  Which paths to backup, in addition to ones specified via
-                  `dynamicFilesFrom`.  If null or an empty array and
-                  `dynamicFilesFrom` is also null, no backup command will be run.
-                   This can be used to create a prune-only job.
-                '';
-                example = [
-                  "/var/lib/postgresql"
-                  "/home/user/backup"
-                ];
-              };
-
-              exclude = mkOption {
-                type = types.listOf types.str;
-                default = [ ];
-                description = ''
-                  Patterns to exclude when backing up. See
-                  https://restic.readthedocs.io/en/latest/040_backup.html#excluding-files for
-                  details on syntax.
-                '';
-                example = [
-                  "/var/cache"
-                  "/home/*/.cache"
-                  ".git"
-                ];
-              };
-
-              timerConfig = mkOption {
-                type = types.nullOr (types.attrsOf unitOption);
-                default = {
-                  OnCalendar = "daily";
-                  Persistent = true;
-                };
-                description = ''
-                  When to run the backup. See {manpage}`systemd.timer(5)` for
-                  details. If null no timer is created and the backup will only
-                  run when explicitly started.
-                '';
-                example = {
-                  OnCalendar = "00:05";
-                  RandomizedDelaySec = "5h";
-                  Persistent = true;
-                };
-              };
-
-              user = mkOption {
-                type = types.str;
-                default = "root";
-                description = ''
-                  As which user the backup should run.
-                '';
-                example = "postgresql";
-              };
-
-              extraBackupArgs = mkOption {
-                type = types.listOf types.str;
-                default = [ ];
-                description = ''
-                  Extra arguments passed to restic backup.
-                '';
-                example = [ "--exclude-file=/etc/nixos/restic-ignore" ];
-              };
-
-              extraOptions = mkOption {
-                type = types.listOf types.str;
-                default = [ ];
-                description = ''
-                  Extra extended options to be passed to the restic --option flag.
-                '';
-                example = [ "sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp'" ];
-              };
-
-              initialize = mkOption {
-                type = types.bool;
-                default = false;
-                description = ''
-                  Create the repository if it doesn't exist.
-                '';
-              };
-
-              pruneOpts = mkOption {
-                type = types.listOf types.str;
-                default = [ ];
-                description = ''
-                  A list of options (--keep-\* et al.) for 'restic forget
-                  --prune', to automatically prune old snapshots.  The
-                  'forget' command is run *after* the 'backup' command, so
-                  keep that in mind when constructing the --keep-\* options.
-                '';
-                example = [
-                  "--keep-daily 7"
-                  "--keep-weekly 5"
-                  "--keep-monthly 12"
-                  "--keep-yearly 75"
-                ];
-              };
-
-              runCheck = mkOption {
-                type = types.bool;
-                default = (builtins.length config.pub-solar-os.backups.restic.${name}.checkOpts > 0);
-                defaultText = literalExpression ''builtins.length config.services.backups.${name}.checkOpts > 0'';
-                description = "Whether to run the `check` command with the provided `checkOpts` options.";
-                example = true;
-              };
-
-              checkOpts = mkOption {
-                type = types.listOf types.str;
-                default = [ ];
-                description = ''
-                  A list of options for 'restic check'.
-                '';
-                example = [ "--with-cache" ];
-              };
-
-              dynamicFilesFrom = mkOption {
-                type = with types; nullOr str;
-                default = null;
-                description = ''
-                  A script that produces a list of files to back up.  The
-                  results of this command are given to the '--files-from'
-                  option. The result is merged with paths specified via `paths`.
-                '';
-                example = "find /home/matt/git -type d -name .git";
-              };
-
-              backupPrepareCommand = mkOption {
-                type = with types; nullOr str;
-                default = null;
-                description = ''
-                  A script that must run before starting the backup process.
-                '';
-              };
-
-              backupCleanupCommand = mkOption {
-                type = with types; nullOr str;
-                default = null;
-                description = ''
-                  A script that must run after finishing the backup process.
-                '';
-              };
-
-              package = mkPackageOption pkgs "restic" { };
-
-              createWrapper = lib.mkOption {
-                type = lib.types.bool;
-                default = true;
-                description = ''
-                  Whether to generate and add a script to the system path, that has the same environment variables set
-                  as the systemd service. This can be used to e.g. mount snapshots or perform other opterations, without
-                  having to manually specify most options.
-                '';
-              };
-            };
-          }
-        )
-      );
-      default = { };
-      example = {
-        localbackup = {
-          paths = [ "/home" ];
-          exclude = [ "/home/*/.cache" ];
-          initialize = true;
-        };
-        remotebackup = {
-          paths = [ "/home" ];
-          extraOptions = [
-            "sftp.command='ssh backup@host -i /etc/nixos/secrets/backup-private-key -s sftp'"
-          ];
-          timerConfig = {
-            OnCalendar = "00:05";
-            RandomizedDelaySec = "5h";
-          };
-        };
-      };
-    };
-  };
-
-  config = {
-    services.restic.backups =
-      let
-        repos = config.pub-solar-os.backups.repos;
-        restic = config.pub-solar-os.backups.restic;
-
-        repoNames = builtins.attrNames repos;
-        backupNames = builtins.attrNames restic;
-
-        createBackups =
-          backupName:
-          map (repoName: {
-            name = "${backupName}-${repoName}";
-            value = repos."${repoName}" // restic."${backupName}";
-          }) repoNames;
-
-      in
-      builtins.listToAttrs (lib.lists.flatten (map createBackups backupNames));
-
-    # Used for pub-solar-os.backups.repos.storagebox
-    programs.ssh.knownHosts = {
-      "u377325.your-storagebox.de".publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA5EB5p/5Hp3hGW1oHok+PIOH9Pbn7cnUiGmUEBrCVjnAw+HrKyN8bYVV0dIGllswYXwkG/+bgiBlE6IVIBAq+JwVWu1Sss3KarHY3OvFJUXZoZyRRg/Gc/+LRCE7lyKpwWQ70dbelGRyyJFH36eNv6ySXoUYtGkwlU5IVaHPApOxe4LHPZa/qhSRbPo2hwoh0orCtgejRebNtW5nlx00DNFgsvn8Svz2cIYLxsPVzKgUxs8Zxsxgn+Q/UvR7uq4AbAhyBMLxv7DjJ1pc7PJocuTno2Rw9uMZi1gkjbnmiOh6TTXIEWbnroyIhwc8555uto9melEUmWNQ+C+PwAK+MPw==";
-      "[u377325.your-storagebox.de]:23".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs";
-    };
-  };
-}
--- a/modules/core/networking.nix
+++ b/modules/core/networking.nix
@ -31,17 +31,13 @@

    networking.hosts = {
      "10.7.6.1" = [ "nachtigall.wg.${config.pub-solar-os.networking.domain}" ];
+      "10.7.6.2" = [ "flora-6.wg.${config.pub-solar-os.networking.domain}" ];
      "10.7.6.3" = [ "metronom.wg.${config.pub-solar-os.networking.domain}" ];
      "10.7.6.4" = [ "tankstelle.wg.${config.pub-solar-os.networking.domain}" ];
-      "10.7.6.5" = [ "trinkgenossin.wg.${config.pub-solar-os.networking.domain}" ];
-      "10.7.6.6" = [ "delite.wg.${config.pub-solar-os.networking.domain}" ];
-      "10.7.6.7" = [ "blue-shell.wg.${config.pub-solar-os.networking.domain}" ];
      "fd00:fae:fae:fae:fae:1::" = [ "nachtigall.wg.${config.pub-solar-os.networking.domain}" ];
+      "fd00:fae:fae:fae:fae:2::" = [ "flora-6.wg.${config.pub-solar-os.networking.domain}" ];
      "fd00:fae:fae:fae:fae:3::" = [ "metronom.wg.${config.pub-solar-os.networking.domain}" ];
      "fd00:fae:fae:fae:fae:4::" = [ "tankstelle.wg.${config.pub-solar-os.networking.domain}" ];
-      "fd00:fae:fae:fae:fae:5::" = [ "trinkgenossin.wg.${config.pub-solar-os.networking.domain}" ];
-      "fd00:fae:fae:fae:fae:6::" = [ "delite.wg.${config.pub-solar-os.networking.domain}" ];
-      "fd00:fae:fae:fae:fae:7::" = [ "blue-shell.wg.${config.pub-solar-os.networking.domain}" ];
    };

    services.openssh = {
--- a/modules/core/nix.nix
+++ b/modules/core/nix.nix
@ -6,7 +6,7 @@
  ...
 }:
 {
-  nixpkgs.config = lib.mkDefault { allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ ]; };
+  nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ ];

  nix = {
    # Use default version alias for nix package
--- a/modules/drone/default.nix
+++ b/modules/drone/default.nix
@ -0,0 +1,114 @@
+{
+  config,
+  lib,
+  pkgs,
+  flake,
+  ...
+}:
+{
+  age.secrets.drone-secrets = {
+    file = "${flake.self}/secrets/drone-secrets.age";
+    mode = "600";
+    owner = "drone";
+  };
+  age.secrets.drone-db-secrets = {
+    file = "${flake.self}/secrets/drone-db-secrets.age";
+    mode = "600";
+    owner = "drone";
+  };
+
+  users.users.drone = {
+    description = "Drone Service";
+    home = "/var/lib/drone";
+    useDefaultShell = true;
+    uid = 994;
+    group = "drone";
+    isSystemUser = true;
+  };
+
+  users.groups.drone = { };
+
+  systemd.tmpfiles.rules = [ "d '/var/lib/drone-db' 0750 drone drone - -" ];
+
+  services.caddy.virtualHosts."ci.${config.pub-solar-os.networking.domain}" = {
+    logFormat = lib.mkForce ''
+      output discard
+    '';
+    extraConfig = ''
+      reverse_proxy :4000
+    '';
+  };
+
+  systemd.services."docker-network-drone" =
+    let
+      docker = config.virtualisation.oci-containers.backend;
+      dockerBin = "${pkgs.${docker}}/bin/${docker}";
+    in
+    {
+      serviceConfig.Type = "oneshot";
+      before = [ "docker-drone-server.service" ];
+      script = ''
+        ${dockerBin} network inspect drone-net >/dev/null 2>&1 || ${dockerBin} network create drone-net --subnet 172.20.0.0/24
+      '';
+    };
+
+  virtualisation = {
+    docker = {
+      enable = true; # sadly podman is not supported rightnow
+      extraOptions = ''
+        --data-root /data/docker
+      '';
+    };
+
+    oci-containers = {
+      backend = "docker";
+      containers."drone-db" = {
+        image = "postgres:14";
+        autoStart = true;
+        user = "994";
+        volumes = [ "/var/lib/drone-db:/var/lib/postgresql/data" ];
+        extraOptions = [ "--network=drone-net" ];
+        environmentFiles = [ config.age.secrets.drone-db-secrets.path ];
+      };
+      containers."drone-server" = {
+        image = "drone/drone:2";
+        autoStart = true;
+        user = "994";
+        ports = [ "127.0.0.1:4000:80" ];
+        dependsOn = [ "drone-db" ];
+        extraOptions = [
+          "--network=drone-net"
+          "--pull=always"
+          "--add-host=nachtigall.${config.pub-solar-os.networking.domain}:10.7.6.1"
+        ];
+        environment = {
+          DRONE_GITEA_SERVER = "https://git.${config.pub-solar-os.networking.domain}";
+          DRONE_SERVER_HOST = "ci.${config.pub-solar-os.networking.domain}";
+          DRONE_SERVER_PROTO = "https";
+          DRONE_DATABASE_DRIVER = "postgres";
+        };
+        environmentFiles = [ config.age.secrets.drone-secrets.path ];
+      };
+      containers."drone-docker-runner" = {
+        image = "drone/drone-runner-docker:1";
+        autoStart = true;
+        # needs to run as root
+        #user = "994";
+        volumes = [ "/var/run/docker.sock:/var/run/docker.sock" ];
+        dependsOn = [ "drone-db" ];
+        extraOptions = [
+          "--network=drone-net"
+          "--pull=always"
+          "--add-host=nachtigall.${config.pub-solar-os.networking.domain}:10.7.6.1"
+        ];
+        environment = {
+          DRONE_RPC_HOST = "ci.${config.pub-solar-os.networking.domain}";
+          DRONE_RPC_PROTO = "https";
+          DRONE_RUNNER_CAPACITY = "2";
+          DRONE_RUNNER_NAME = "flora-6-docker-runner";
+        };
+        environmentFiles = [ config.age.secrets.drone-secrets.path ];
+      };
+    };
+  };
+}
--- a/modules/forgejo-actions-runner/default.nix
+++ b/modules/forgejo-actions-runner/default.nix
@ -0,0 +1,67 @@
+{
+  config,
+  lib,
+  pkgs,
+  flake,
+  ...
+}:
+{
+  age.secrets.forgejo-actions-runner-token = {
+    file = "${flake.self}/secrets/forgejo-actions-runner-token.age";
+    mode = "440";
+  };
+
+  # Trust docker bridge interface traffic
+  # Needed for the docker runner to communicate with the act_runner cache
+  networking.firewall.trustedInterfaces = [ "br-+" ];
+
+  users.users.gitea-runner = {
+    home = "/var/lib/gitea-runner/flora-6";
+    useDefaultShell = true;
+    group = "gitea-runner";
+    isSystemUser = true;
+  };
+
+  users.groups.gitea-runner = { };
+
+  systemd.services."gitea-runner-flora\\x2d6".serviceConfig = {
+    DynamicUser = lib.mkForce false;
+  };
+
+  systemd.tmpfiles.rules = [
+    "d '/data/gitea-actions-runner' 0750 gitea-runner gitea-runner - -"
+    "d '/var/lib/gitea-runner' 0750 gitea-runner gitea-runner - -"
+  ];
+
+  # forgejo actions runner
+  # https://forgejo.org/docs/latest/admin/actions/
+  # https://docs.gitea.com/usage/actions/quickstart
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+    instances."flora-6" = {
+      enable = true;
+      name = config.networking.hostName;
+      url = "https://git.pub.solar";
+      tokenFile = config.age.secrets.forgejo-actions-runner-token.path;
+      settings = {
+        cache = {
+          enabled = true;
+          dir = "/data/gitea-actions-runner/actcache";
+          host = "";
+          port = 0;
+          external_server = "";
+        };
+      };
+      labels = [
+        # provide a debian 12 bookworm base with Node.js for actions
+        "debian-latest:docker://git.pub.solar/pub-solar/actions-base-image:20-bookworm"
+        # fake the ubuntu name, commonly used in actions examples
+        "ubuntu-latest:docker://git.pub.solar/pub-solar/actions-base-image:20-bookworm"
+        # alpine with Node.js
+        "alpine-latest:docker://node:20-alpine"
+        # nix flakes enabled image with Node.js
+        "nix-flakes:docker://git.pub.solar/pub-solar/nix-flakes-node:latest"
+      ];
+    };
+  };
+}
--- a/modules/forgejo/default.nix
+++ b/modules/forgejo/default.nix
@ -163,7 +163,7 @@
  # gitea gitconfig
  programs.gnupg.agent = {
    enable = true;
-    pinentryPackage = pkgs.pinentry-curses;
+    pinentryFlavor = "curses";
  };
  # Required to make gpg work without a graphical environment?
  # otherwise generating a new gpg key fails with this error:
@ -182,7 +182,7 @@
      OnCalendar = "*-*-* 00:00:00 Etc/UTC";
    };
    initialize = true;
-    passwordFile = config.age.secrets."restic-repo-storagebox-nachtigall".path;
+    passwordFile = config.age.secrets."restic-repo-storagebox".path;
    repository = "sftp:u377325@u377325.your-storagebox.de:/backups";
    backupPrepareCommand = ''
      ${pkgs.sudo}/bin/sudo -u postgres ${pkgs.postgresql}/bin/pg_dump -d gitea > /tmp/forgejo-backup.sql
--- a/modules/garage/default.nix
+++ b/modules/garage/default.nix
@ -1,142 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  flake,
-  ...
-}:
-{
-  age.secrets."garage-rpc-secret" = {
-    file = "${flake.self}/secrets/garage-rpc-secret.age";
-    mode = "400";
-  };
-
-  age.secrets."garage-admin-token" = {
-    file = "${flake.self}/secrets/garage-admin-token.age";
-    mode = "400";
-  };
-
-  age.secrets."acme-namecheap-env" = {
-    file = "${flake.self}/secrets/acme-namecheap-env.age";
-    mode = "400";
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    3900
-    3901
-    3902
-  ];
-
-  networking.firewall.interfaces.wg-ssh.allowedTCPPorts = [ 3903 ];
-
-  security.acme = {
-    defaults = {
-      environmentFile = config.age.secrets.acme-namecheap-env.path;
-    };
-    certs = {
-      # Wildcard certificate gets created automatically
-      "buckets.${config.pub-solar-os.networking.domain}" = {
-        # disable http challenge
-        webroot = null;
-        # enable dns challenge
-        dnsProvider = "namecheap";
-        dnsPropagationCheck = false;
-      };
-      # Wildcard certificate gets created automatically
-      "web.${config.pub-solar-os.networking.domain}" = {
-        # disable http challenge
-        webroot = null;
-        # enable dns challenge
-        dnsProvider = "namecheap";
-        dnsPropagationCheck = false;
-      };
-    };
-  };
-
-  services.nginx = {
-    upstreams.s3_backend.servers = {
-      "[::1]:3900" = { };
-    };
-    upstreams.web_backend.servers = {
-      "[::1]:3902" = { };
-    };
-    virtualHosts."buckets.${config.pub-solar-os.networking.domain}" = {
-      serverAliases = [ "*.buckets.${config.pub-solar-os.networking.domain}" ];
-
-      enableACME = true;
-      forceSSL = true;
-
-      locations."/" = {
-        proxyPass = "http://s3_backend";
-        extraConfig = ''
-          client_max_body_size 64m;
-          proxy_max_temp_file_size 0;
-        '';
-      };
-    };
-    virtualHosts."web.${config.pub-solar-os.networking.domain}" = {
-      serverAliases = [ "*.web.${config.pub-solar-os.networking.domain}" ];
-
-      enableACME = true;
-      forceSSL = true;
-
-      locations."/" = {
-        proxyPass = "http://web_backend";
-      };
-    };
-  };
-
-  services.garage = {
-    enable = true;
-    package = pkgs.garage_1_0_0;
-    settings = {
-      data_dir = "/var/lib/garage/data";
-      metadata_dir = "/var/lib/garage/meta";
-      db_engine = "lmdb";
-      replication_factor = 3;
-      compression_level = 2;
-      rpc_bind_addr = "[::]:3901";
-      s3_api = {
-        s3_region = "eu-central";
-        api_bind_addr = "[::]:3900";
-        root_domain = ".s3.${config.pub-solar-os.networking.domain}";
-      };
-      s3_web = {
-        bind_addr = "[::]:3902";
-        root_domain = ".web.${config.pub-solar-os.networking.domain}";
-        index = "index.html";
-      };
-      admin = {
-        api_bind_addr = "[::]:3903";
-      };
-    };
-  };
-
-  users.users.garage = {
-    isSystemUser = true;
-    home = "/var/lib/garage";
-    group = "garage";
-  };
-
-  users.groups.garage = { };
-
-  # Adapted from https://git.clan.lol/clan/clan-core/src/commit/23a9e35c665ff531fe1193dcc47056432fbbeacf/clanModules/garage/default.nix
-  # Disabled DynamicUser https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/web-servers/garage.nix
-  # for mounts + permissions to work
-  systemd.services.garage = {
-    serviceConfig = {
-      user = "garage";
-      group = "garage";
-      DynamicUser = false;
-      LoadCredential = [
-        "rpc_secret_path:${config.age.secrets.garage-rpc-secret.path}"
-        "admin_token_path:${config.age.secrets.garage-admin-token.path}"
-      ];
-      Environment = [
-        "GARAGE_ALLOW_WORLD_READABLE_SECRETS=true"
-        "GARAGE_RPC_SECRET_FILE=%d/rpc_secret_path"
-        "GARAGE_ADMIN_TOKEN_FILE=%d/admin_token_path"
-      ];
-    };
-  };
-}
--- a/modules/grafana/default.nix
+++ b/modules/grafana/default.nix
@ -33,17 +33,15 @@
      group = "grafana";
      user = "grafana";
    };
-    "grafana-dashboards/grafana-garage-dashboard-prometheus.json" = {
-      source = ./grafana-dashboards/grafana-garage-dashboard-prometheus.json;
-      group = "grafana";
-      user = "grafana";
-    };
  };

-  services.nginx.virtualHosts."grafana.${config.pub-solar-os.networking.domain}" = {
-    enableACME = true;
-    forceSSL = true;
-    locations."/".proxyPass = "http://127.0.0.1:${toString config.services.grafana.settings.server.http_port}";
+  services.caddy.virtualHosts."grafana.${config.pub-solar-os.networking.domain}" = {
+    logFormat = lib.mkForce ''
+      output discard
+    '';
+    extraConfig = ''
+      reverse_proxy :${toString config.services.grafana.settings.server.http_port}
+    '';
  };

  services.grafana = {
@ -66,7 +64,7 @@
        password = "\$__file{${config.age.secrets.grafana-smtp-password.path}}";
        from_address = "no-reply@pub.solar";
        from_name = "grafana.pub.solar";
-        ehlo_identity = "grafana.pub.solar";
+        ehlo_identity = "flora-6.pub.solar";
      };
      security = {
        admin_email = "crew@pub.solar";
--- a/modules/grafana/grafana-dashboards/grafana-garage-dashboard-prometheus.json
+++ b/modules/grafana/grafana-dashboards/grafana-garage-dashboard-prometheus.json
--- a/modules/grafana/grafana-dashboards/node-exporter-full_rev33.json
+++ b/modules/grafana/grafana-dashboards/node-exporter-full_rev33.json
@ -1,4 +1,47 @@
 {
+  "__inputs": [
+    {
+      "name": "DS_PROMETHEUS",
+      "label": "Prometheus",
+      "description": "",
+      "type": "datasource",
+      "pluginId": "prometheus",
+      "pluginName": "Prometheus"
+    }
+  ],
+  "__elements": {},
+  "__requires": [
+    {
+      "type": "panel",
+      "id": "gauge",
+      "name": "Gauge",
+      "version": ""
+    },
+    {
+      "type": "grafana",
+      "id": "grafana",
+      "name": "Grafana",
+      "version": "9.4.3"
+    },
+    {
+      "type": "datasource",
+      "id": "prometheus",
+      "name": "Prometheus",
+      "version": "1.0.0"
+    },
+    {
+      "type": "panel",
+      "id": "stat",
+      "name": "Stat",
+      "version": ""
+    },
+    {
+      "type": "panel",
+      "id": "timeseries",
+      "name": "Time series",
+      "version": ""
+    }
+  ],
  "annotations": {
    "list": [
      {
@ -26,6 +69,7 @@
  "fiscalYearStartMonth": 0,
  "gnetId": 1860,
  "graphTooltip": 1,
+  "id": null,
  "links": [
    {
      "icon": "external link",
@ -127,8 +171,6 @@
      "id": 20,
      "links": [],
      "options": {
-        "minVizHeight": 75,
-        "minVizWidth": 75,
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": ["lastNotNull"],
@ -136,10 +178,9 @@
          "values": false
        },
        "showThresholdLabels": false,
-        "showThresholdMarkers": true,
-        "sizing": "auto"
+        "showThresholdMarkers": true
      },
-      "pluginVersion": "10.2.7",
+      "pluginVersion": "9.4.3",
      "targets": [
        {
          "datasource": {
@ -216,8 +257,6 @@
      "id": 155,
      "links": [],
      "options": {
-        "minVizHeight": 75,
-        "minVizWidth": 75,
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": ["lastNotNull"],
@ -225,10 +264,9 @@
          "values": false
        },
        "showThresholdLabels": false,
-        "showThresholdMarkers": true,
-        "sizing": "auto"
+        "showThresholdMarkers": true
      },
-      "pluginVersion": "10.2.7",
+      "pluginVersion": "9.4.3",
      "targets": [
        {
          "datasource": {
@ -305,8 +343,6 @@
      "id": 19,
      "links": [],
      "options": {
-        "minVizHeight": 75,
-        "minVizWidth": 75,
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": ["lastNotNull"],
@ -314,10 +350,9 @@
          "values": false
        },
        "showThresholdLabels": false,
-        "showThresholdMarkers": true,
-        "sizing": "auto"
+        "showThresholdMarkers": true
      },
-      "pluginVersion": "10.2.7",
+      "pluginVersion": "9.4.3",
      "targets": [
        {
          "datasource": {
@ -384,8 +419,6 @@
      "id": 16,
      "links": [],
      "options": {
-        "minVizHeight": 75,
-        "minVizWidth": 75,
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": ["lastNotNull"],
@ -393,10 +426,9 @@
          "values": false
        },
        "showThresholdLabels": false,
-        "showThresholdMarkers": true,
-        "sizing": "auto"
+        "showThresholdMarkers": true
      },
-      "pluginVersion": "10.2.7",
+      "pluginVersion": "9.4.3",
      "targets": [
        {
          "datasource": {
@ -489,8 +521,6 @@
      "id": 21,
      "links": [],
      "options": {
-        "minVizHeight": 75,
-        "minVizWidth": 75,
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": ["lastNotNull"],
@ -498,10 +528,9 @@
          "values": false
        },
        "showThresholdLabels": false,
-        "showThresholdMarkers": true,
-        "sizing": "auto"
+        "showThresholdMarkers": true
      },
-      "pluginVersion": "10.2.7",
+      "pluginVersion": "9.4.3",
      "targets": [
        {
          "datasource": {
@ -576,8 +605,6 @@
      "id": 154,
      "links": [],
      "options": {
-        "minVizHeight": 75,
-        "minVizWidth": 75,
        "orientation": "horizontal",
        "reduceOptions": {
          "calcs": ["lastNotNull"],
@ -585,10 +612,9 @@
          "values": false
        },
        "showThresholdLabels": false,
-        "showThresholdMarkers": true,
-        "sizing": "auto"
+        "showThresholdMarkers": true
      },
-      "pluginVersion": "10.2.7",
+      "pluginVersion": "9.4.3",
      "targets": [
        {
          "datasource": {
@ -667,10 +693,9 @@
          "fields": "",
          "values": false
        },
-        "textMode": "auto",
-        "wideLayout": true
+        "textMode": "auto"
      },
-      "pluginVersion": "10.2.7",
+      "pluginVersion": "9.4.3",
      "targets": [
        {
          "datasource": {
@ -747,10 +772,9 @@
          "fields": "",
          "values": false
        },
-        "textMode": "auto",
-        "wideLayout": true
+        "textMode": "auto"
      },
-      "pluginVersion": "10.2.7",
+      "pluginVersion": "9.4.3",
      "targets": [
        {
          "datasource": {
@ -833,10 +857,9 @@
          "fields": "",
          "values": false
        },
-        "textMode": "auto",
-        "wideLayout": true
+        "textMode": "auto"
      },
-      "pluginVersion": "10.2.7",
+      "pluginVersion": "9.4.3",
      "targets": [
        {
          "datasource": {
@ -917,10 +940,9 @@
          "fields": "",
          "values": false
        },
-        "textMode": "auto",
-        "wideLayout": true
+        "textMode": "auto"
      },
-      "pluginVersion": "10.2.7",
+      "pluginVersion": "9.4.3",
      "targets": [
        {
          "datasource": {
@ -999,10 +1021,9 @@
          "fields": "",
          "values": false
        },
-        "textMode": "auto",
-        "wideLayout": true
+        "textMode": "auto"
      },
-      "pluginVersion": "10.2.7",
+      "pluginVersion": "9.4.3",
      "targets": [
        {
          "datasource": {
@ -1060,7 +1081,6 @@
            "mode": "palette-classic"
          },
          "custom": {
-            "axisBorderShow": false,
            "axisCenteredZero": false,
            "axisColorMode": "text",
            "axisLabel": "",
@ -1074,7 +1094,6 @@
              "tooltip": false,
              "viz": false
            },
-            "insertNulls": false,
            "lineInterpolation": "smooth",
            "lineWidth": 1,
            "pointSize": 5,
@ -1342,7 +1361,6 @@
            "mode": "palette-classic"
          },
          "custom": {
-            "axisBorderShow": false,
            "axisCenteredZero": false,
            "axisColorMode": "text",
            "axisLabel": "",
@ -1356,7 +1374,6 @@
              "tooltip": false,
              "viz": false
            },
-            "insertNulls": false,
            "lineInterpolation": "linear",
            "lineWidth": 1,
            "pointSize": 5,
@ -1862,7 +1879,6 @@
            "mode": "palette-classic"
          },
          "custom": {
-            "axisBorderShow": false,
            "axisCenteredZero": false,
            "axisColorMode": "text",
            "axisLabel": "",
@ -1876,7 +1892,6 @@
              "tooltip": false,
              "viz": false
            },
-            "insertNulls": false,
            "lineInterpolation": "linear",
            "lineWidth": 1,
            "pointSize": 5,
@ -2332,7 +2347,6 @@
            "mode": "palette-classic"
          },
          "custom": {
-            "axisBorderShow": false,
            "axisCenteredZero": false,
            "axisColorMode": "text",
            "axisLabel": "",
@ -2346,7 +2360,6 @@
              "tooltip": false,
              "viz": false
            },
-            "insertNulls": false,
            "lineInterpolation": "linear",
            "lineWidth": 1,
            "pointSize": 5,
@ -13008,7 +13021,8 @@
                "mode": "absolute",
                "steps": [
                  {
-                    "color": "green"
+                    "color": "green",
+                    "value": null
                  },
                  {
                    "color": "red",
@ -13212,7 +13226,8 @@
                "mode": "absolute",
                "steps": [
                  {
-                    "color": "green"
+                    "color": "green",
+                    "value": null
                  },
                  {
                    "color": "red",
@ -23139,7 +23154,8 @@
  ],
  "refresh": "",
  "revision": 1,
-  "schemaVersion": 39,
+  "schemaVersion": 38,
+  "style": "dark",
  "tags": ["linux"],
  "templating": {
    "list": [
@ -23162,11 +23178,7 @@
        "type": "datasource"
      },
      {
-        "current": {
-          "selected": false,
-          "text": "node-exporter",
-          "value": "node-exporter"
-        },
+        "current": {},
        "datasource": {
          "type": "prometheus",
          "uid": "${DS_PROMETHEUS}"
@ -23192,11 +23204,7 @@
        "useTags": false
      },
      {
-        "current": {
-          "selected": true,
-          "text": "nachtigall",
-          "value": "nachtigall"
-        },
+        "current": {},
        "datasource": {
          "type": "prometheus",
          "uid": "${DS_PROMETHEUS}"
@ -23266,6 +23274,6 @@
  "timezone": "browser",
  "title": "Node Exporter Full",
  "uid": "rYdddlPWk",
-  "version": 2,
+  "version": 87,
  "weekStart": ""
 }
--- a/modules/keycloak/default.nix
+++ b/modules/keycloak/default.nix
@ -6,22 +6,23 @@
  ...
 }:
 {
-  options.pub-solar-os.auth = with lib; {
-    enable = mkEnableOption "Enable keycloak to run on the node";
+  options.pub-solar-os.auth = {
+    enable = lib.mkEnableOption "Enable keycloak to run on the node";

-    realm = mkOption {
+    realm = lib.mkOption {
      description = "Name of the realm";
-      type = types.str;
+      type = lib.types.str;
      default = config.pub-solar-os.networking.domain;
    };
-
-    database-password-file = mkOption {
-      description = "Database password file path";
-      type = types.str;
-    };
  };

  config = lib.mkIf config.pub-solar-os.auth.enable {
+    age.secrets.keycloak-database-password = {
+      file = "${flake.self}/secrets/keycloak-database-password.age";
+      mode = "600";
+      #owner = "keycloak";
+    };
+
    services.nginx.virtualHosts."auth.${config.pub-solar-os.networking.domain}" = {
      enableACME = true;
      forceSSL = true;
@ -45,12 +46,13 @@
    # keycloak
    services.keycloak = {
      enable = true;
-      database.passwordFile = config.pub-solar-os.auth.database-password-file;
+      database.passwordFile = config.age.secrets.keycloak-database-password.path;
      settings = {
        hostname = "auth.${config.pub-solar-os.networking.domain}";
        http-host = "127.0.0.1";
        http-port = 8080;
        proxy = "edge";
+        features = "declarative-user-profile";
      };
      themes = {
        "pub.solar" =
@ -58,12 +60,14 @@
      };
    };

-    pub-solar-os.backups.restic.keycloak = {
+    services.restic.backups.keycloak-storagebox = {
      paths = [ "/tmp/keycloak-backup.sql" ];
      timerConfig = {
        OnCalendar = "*-*-* 03:00:00 Etc/UTC";
      };
      initialize = true;
+      passwordFile = config.age.secrets."restic-repo-storagebox".path;
+      repository = "sftp:u377325@u377325.your-storagebox.de:/backups";
      backupPrepareCommand = ''
        ${pkgs.sudo}/bin/sudo -u postgres ${pkgs.postgresql}/bin/pg_dump -d keycloak > /tmp/keycloak-backup.sql
      '';
--- a/modules/loki/default.nix
+++ b/modules/loki/default.nix
@ -48,6 +48,7 @@
        };
      };
      chunk_store_config = {
+        max_look_back_period = "0s";
        chunk_cache_config = {
          embedded_cache = {
            enabled = true;
@ -63,8 +64,8 @@
        split_queries_by_interval = "0";
      };
      compactor = {
+        shared_store = "filesystem";
        compaction_interval = "10m";
-        delete_request_store = "filesystem";
        retention_enabled = true;
        retention_delete_delay = "2h";
        retention_delete_worker_count = 150;
@ -81,16 +82,6 @@
              period = "24h";
            };
          }
-          {
-            from = "2024-05-31";
-            store = "tsdb";
-            object_store = "filesystem";
-            schema = "v13";
-            index = {
-              prefix = "index_";
-              period = "24h";
-            };
-          }
        ];
      };
    };
@ -108,7 +99,7 @@
      };
      clients = [
        {
-          url = "http://trinkgenossin.wg.pub.solar:${toString config.services.loki.configuration.server.http_listen_port}/loki/api/v1/push";
+          url = "http://flora-6.wg.pub.solar:${toString config.services.loki.configuration.server.http_listen_port}/loki/api/v1/push";
        }
      ];
      scrape_configs = [
@ -118,7 +109,7 @@
            max_age = "24h";
            labels = {
              job = "systemd-journal";
-              host = "trinkgenossin";
+              host = "flora-6";
            };
          };
          relabel_configs = [
--- a/modules/mail/default.nix
+++ b/modules/mail/default.nix
@ -67,20 +67,4 @@
  };
  security.acme.acceptTerms = true;
  security.acme.defaults.email = "security@pub.solar";
-
-  pub-solar-os.backups.restic.mail = {
-    paths = [
-      "/var/vmail"
-      "/var/dkim"
-    ];
-    timerConfig = {
-      OnCalendar = "*-*-* 02:00:00 Etc/UTC";
-    };
-    initialize = true;
-    pruneOpts = [
-      "--keep-daily 7"
-      "--keep-weekly 4"
-      "--keep-monthly 3"
-    ];
-  };
 }
--- a/modules/mailman/default.nix
+++ b/modules/mailman/default.nix
@ -91,7 +91,7 @@
      OnCalendar = "*-*-* 02:00:00 Etc/UTC";
    };
    initialize = true;
-    passwordFile = config.age.secrets."restic-repo-storagebox-nachtigall".path;
+    passwordFile = config.age.secrets."restic-repo-storagebox".path;
    repository = "sftp:u377325@u377325.your-storagebox.de:/backups";
    pruneOpts = [
      "--keep-daily 7"
--- a/modules/mastodon/default.nix
+++ b/modules/mastodon/default.nix
@ -106,7 +106,7 @@
      OnCalendar = "*-*-* 04:00:00 Etc/UTC";
    };
    initialize = true;
-    passwordFile = config.age.secrets."restic-repo-storagebox-nachtigall".path;
+    passwordFile = config.age.secrets."restic-repo-storagebox".path;
    repository = "sftp:u377325@u377325.your-storagebox.de:/backups";
    backupPrepareCommand = ''
      ${pkgs.sudo}/bin/sudo -u postgres ${pkgs.postgresql}/bin/pg_dump -d mastodon > /tmp/mastodon-backup.sql
--- a/modules/matrix/default.nix
+++ b/modules/matrix/default.nix
@ -108,6 +108,8 @@ in
      instance_map = { };
      limit_profile_requests_to_users_who_share_rooms = false;

+      log_config = ./matrix-log-config.yaml;
+
      max_spider_size = "10M";
      max_upload_size = "50M";
      media_storage_providers = [ ];
@ -270,18 +272,18 @@ in
    ];

    plugins = [ config.services.matrix-synapse.package.plugins.matrix-synapse-shared-secret-auth ];
-  };

-  services.matrix-sliding-sync = {
-    enable = true;
-    settings = {
-      SYNCV3_SERVER = "https://${publicDomain}";
-      SYNCV3_BINDADDR = "127.0.0.1:8011";
-      # The bind addr for Prometheus metrics, which will be accessible at
-      # /metrics at this address
-      SYNCV3_PROM = "127.0.0.1:9100";
+    sliding-sync = {
+      enable = true;
+      settings = {
+        SYNCV3_SERVER = "https://${publicDomain}";
+        SYNCV3_BINDADDR = "127.0.0.1:8011";
+        # The bind addr for Prometheus metrics, which will be accessible at
+        # /metrics at this address
+        SYNCV3_PROM = "127.0.0.1:9100";
+      };
+      environmentFile = config.age.secrets."matrix-synapse-sliding-sync-secret".path;
    };
-    environmentFile = config.age.secrets."matrix-synapse-sliding-sync-secret".path;
  };

  services.restic.backups.matrix-synapse-storagebox = {
@ -295,7 +297,7 @@ in
      OnCalendar = "*-*-* 05:00:00 Etc/UTC";
    };
    initialize = true;
-    passwordFile = config.age.secrets."restic-repo-storagebox-nachtigall".path;
+    passwordFile = config.age.secrets."restic-repo-storagebox".path;
    repository = "sftp:u377325@u377325.your-storagebox.de:/backups";
    backupPrepareCommand = ''
      ${pkgs.sudo}/bin/sudo -u postgres ${pkgs.postgresql}/bin/pg_dump -d matrix > /tmp/matrix-synapse-backup.sql
--- a/modules/matrix/matrix-log-config.yaml
+++ b/modules/matrix/matrix-log-config.yaml
@ -0,0 +1,40 @@
+version: 1
+
+formatters:
+  precise:
+    format: "%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s"
+
+filters:
+  context:
+    (): synapse.util.logcontext.LoggingContextFilter
+    request: ""
+
+handlers:
+  console:
+    class: logging.StreamHandler
+    formatter: precise
+    filters: [context]
+
+loggers:
+  synapse:
+    level: WARNING
+
+  synapse.storage.SQL:
+    # beware: increasing this to DEBUG will make synapse log sensitive
+    # information such as access tokens.
+    level: WARNING
+
+  synapse.http.matrixfederationclient:
+    level: CRITICAL
+  synapse.federation.sender.per_destination_queue:
+    level: CRITICAL
+  synapse.handlers.device:
+    level: CRITICAL
+  synapse.replication.tcp.handler:
+    level: CRITICAL
+  shared_secret_authenticator:
+    level: INFO
+
+root:
+  level: WARNING
+  handlers: [console]
--- a/modules/mediawiki/default.nix
+++ b/modules/mediawiki/default.nix
@ -211,7 +211,7 @@ in
      backend = "docker";

      containers."mediawiki" = {
-        image = "git.pub.solar/pub-solar/mediawiki-oidc-docker:1.42.1";
+        image = "git.pub.solar/pub-solar/mediawiki-oidc-docker:1.41.1";
        user = "1000:${builtins.toString gid}";
        autoStart = true;

@ -232,27 +232,4 @@ in
      };
    };
  };
-
-  pub-solar-os.backups.restic.mediawiki = {
-    paths = [
-      "/var/lib/mediawiki/images"
-      "/var/lib/mediawiki/uploads"
-      "/tmp/mediawiki-backup.sql"
-    ];
-    timerConfig = {
-      OnCalendar = "*-*-* 00:30:00 Etc/UTC";
-    };
-    initialize = true;
-    backupPrepareCommand = ''
-      ${pkgs.sudo}/bin/sudo -u postgres ${pkgs.postgresql}/bin/pg_dump -d mediawiki > /tmp/mediawiki-backup.sql
-    '';
-    backupCleanupCommand = ''
-      rm /tmp/mediawiki-backup.sql
-    '';
-    pruneOpts = [
-      "--keep-daily 7"
-      "--keep-weekly 4"
-      "--keep-monthly 3"
-    ];
-  };
 }
--- a/modules/nextcloud/default.nix
+++ b/modules/nextcloud/default.nix
@ -31,6 +31,7 @@
    https = true;
    secretFile = config.age.secrets."nextcloud-secrets".path; # secret
    maxUploadSize = "1G";
+    skeletonDirectory = "./nextcloud-skeleton";

    configureRedis = true;

@ -46,11 +47,11 @@
      dbtype = "pgsql";
      dbname = "nextcloud";
      dbtableprefix = "oc_";
+      overwriteProtocol = "https";
    };

-    settings = {
+    extraOptions = {
      overwrite.cli.url = "http://cloud.${config.pub-solar-os.networking.domain}";
-      overwriteprotocol = "https";

      installed = true;
      default_phone_region = "+49";
@ -91,13 +92,12 @@

      auth.bruteforce.protection.enabled = true;
      trashbin_retention_obligation = "auto,7";
-      skeletondirectory = "./nextcloud-skeleton";
+      skeletondirectory = "";
      defaultapp = "file";
      activity_expire_days = "14";
      integrity.check.disabled = false;
      updater.release.channel = "stable";
-      loglevel = 2;
-      debug = false;
+      loglevel = 0;
      maintenance_window_start = "1";
      # maintenance = false;
      app_install_overwrite = [
@ -111,10 +111,6 @@

    phpOptions = {
      "opcache.interned_strings_buffer" = "32";
-      "opcache.max_accelerated_files" = "16229";
-      "opcache.memory_consumption" = "256";
-      # https://docs.nextcloud.com/server/latest/admin_manual/installation/server_tuning.html#enable-php-opcache
-      "opcache.revalidate_freq" = "60";
      # https://docs.nextcloud.com/server/latest/admin_manual/installation/server_tuning.html#:~:text=opcache.jit%20%3D%201255%20opcache.jit_buffer_size%20%3D%20128m
      "opcache.jit" = "1255";
      "opcache.jit_buffer_size" = "128M";
@ -145,7 +141,7 @@
      OnCalendar = "*-*-* 01:00:00 Etc/UTC";
    };
    initialize = true;
-    passwordFile = config.age.secrets."restic-repo-storagebox-nachtigall".path;
+    passwordFile = config.age.secrets."restic-repo-storagebox".path;
    repository = "sftp:u377325@u377325.your-storagebox.de:/backups";
    backupPrepareCommand = ''
      ${pkgs.sudo}/bin/sudo -u postgres ${pkgs.postgresql}/bin/pg_dump -d nextcloud > /tmp/nextcloud-backup.sql
--- a/modules/nginx-matrix/default.nix
+++ b/modules/nginx-matrix/default.nix
@ -141,16 +141,22 @@ in
          ssl = true;
        }
      ];
-      root = "/dev/null";
+      root = "/srv/nginx";
      extraConfig = ''
        server_tokens off;

        gzip on;
        gzip_types text/plain application/json;
      '';
+      locations."/maintenance.html" = {
+      };
      locations."/" = {
-        proxyPass = "http://127.0.0.1:8008";
        extraConfig = ''
+          if (-f $document_root/maintenance.html) {
+            return 503;
+          }
+          error_page 503 /maintenance.html;
+          proxy_pass http://127.0.0.1:8008;
          proxy_set_header Host $host;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
--- a/modules/nginx-website/default.nix
+++ b/modules/nginx-website/default.nix
@ -7,7 +7,7 @@
  services.nginx.virtualHosts = {
    "www.${config.pub-solar-os.networking.domain}" = {
      enableACME = true;
-      forceSSL = true;
+      addSSL = true;

      extraConfig = ''
        error_log /dev/null;
--- a/modules/nginx/default.nix
+++ b/modules/nginx/default.nix
@ -10,10 +10,9 @@ let
  webserverGroup = "hakkonaut";
 in
 {
-  users.users.nginx.extraGroups = [ webserverGroup ];
-
  services.nginx = {
    enable = true;
+    group = webserverGroup;
    enableReload = true;
    proxyCachePath.cache = {
      enable = true;
--- a/modules/obs-portal/default.nix
+++ b/modules/obs-portal/default.nix
@ -147,26 +147,4 @@ in
      };
    };
  };
-
-  pub-solar-os.backups.restic.obs-portal = {
-    paths = [
-      "/var/lib/obs-portal/data"
-      "/tmp/obs-portal-backup.sql"
-    ];
-    timerConfig = {
-      OnCalendar = "*-*-* 01:30:00 Etc/UTC";
-    };
-    initialize = true;
-    backupPrepareCommand = ''
-      ${pkgs.docker}/bin/docker exec -i --user postgres obs-portal-db pg_dump obs > /tmp/obs-portal-backup.sql
-    '';
-    backupCleanupCommand = ''
-      rm /tmp/obs-portal-backup.sql
-    '';
-    pruneOpts = [
-      "--keep-daily 7"
-      "--keep-weekly 4"
-      "--keep-monthly 3"
-    ];
-  };
 }
--- a/modules/postgresql/default.nix
+++ b/modules/postgresql/default.nix
@ -25,4 +25,9 @@
      full_page_writes = false;
    };
  };
+
+  systemd.services.postgresql = {
+    after = [ "var-lib-postgresql.mount" ];
+    requisite = [ "var-lib-postgresql.mount" ];
+  };
 }
--- a/modules/prometheus/alert-rules.nix
+++ b/modules/prometheus/alert-rules.nix
@ -250,10 +250,4 @@ lib.mapAttrsToList
    #   description =
    #     "alertmanager: number of active silences has changed: {{$value}}";
    # };
-
-    garage_cluster_healthy = {
-      condition = "cluster_healthy == 0";
-      time = "15m";
-      description = "garage cluster on {{$labels.instance}} is not healthy: {{$labels.result}}!";
-    };
  })
--- a/modules/prometheus/default.nix
+++ b/modules/prometheus/default.nix
@ -12,27 +12,15 @@
    owner = "alertmanager";
  };

-  security.acme.certs = {
-    "alerts.${config.pub-solar-os.networking.domain}" = {
-      # disable http challenge
-      webroot = null;
-      # enable dns challenge
-      dnsProvider = "namecheap";
-    };
-  };
-
-  services.nginx.virtualHosts."alerts.${config.pub-solar-os.networking.domain}" = {
-    enableACME = true;
-    forceSSL = true;
-
-    listenAddresses = [
-      "10.7.6.5"
-      "[fd00:fae:fae:fae:fae:5::]"
-    ];
-
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:${toString config.services.prometheus.alertmanager.port}";
-    };
+  services.caddy.virtualHosts."alerts.${config.pub-solar-os.networking.domain}" = {
+    logFormat = lib.mkForce ''
+      output discard
+    '';
+    extraConfig = ''
+      bind 10.7.6.2 fd00:fae:fae:fae:fae:2::
+      tls internal
+      reverse_proxy :${toString config.services.prometheus.alertmanager.port}
+    '';
  };

  services.prometheus = {
@ -53,6 +41,12 @@
      {
        job_name = "node-exporter";
        static_configs = [
+          {
+            targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
+            labels = {
+              instance = "flora-6";
+            };
+          }
          {
            targets = [ "nachtigall.wg.${config.pub-solar-os.networking.domain}" ];
            labels = {
@ -75,30 +69,6 @@
              instance = "tankstelle";
            };
          }
-          {
-            targets = [
-              "trinkgenossin.wg.${config.pub-solar-os.networking.domain}:${toString config.services.prometheus.exporters.node.port}"
-            ];
-            labels = {
-              instance = "trinkgenossin";
-            };
-          }
-          {
-            targets = [
-              "delite.wg.${config.pub-solar-os.networking.domain}:${toString config.services.prometheus.exporters.node.port}"
-            ];
-            labels = {
-              instance = "delite";
-            };
-          }
-          {
-            targets = [
-              "blue-shell.wg.${config.pub-solar-os.networking.domain}:${toString config.services.prometheus.exporters.node.port}"
-            ];
-            labels = {
-              instance = "blue-shell";
-            };
-          }
        ];
      }
      {
@ -113,29 +83,6 @@
          }
        ];
      }
-      {
-        job_name = "garage";
-        static_configs = [
-          {
-            targets = [ "trinkgenossin.wg.${config.pub-solar-os.networking.domain}:3903" ];
-            labels = {
-              instance = "trinkgenossin";
-            };
-          }
-          {
-            targets = [ "delite.wg.${config.pub-solar-os.networking.domain}:3903" ];
-            labels = {
-              instance = "delite";
-            };
-          }
-          {
-            targets = [ "blue-shell.wg.${config.pub-solar-os.networking.domain}:3903" ];
-            labels = {
-              instance = "blue-shell";
-            };
-          }
-        ];
-      }
    ];

    ruleFiles = [
--- a/modules/promtail/default.nix
+++ b/modules/promtail/default.nix
@ -18,7 +18,7 @@
      };
      clients = [
        {
-          url = "http://trinkgenossin.wg.pub.solar:${toString flake.self.nixosConfigurations.trinkgenossin.config.services.loki.configuration.server.http_listen_port}/loki/api/v1/push";
+          url = "http://flora-6.wg.pub.solar:${toString flake.self.nixosConfigurations.flora-6.config.services.loki.configuration.server.http_listen_port}/loki/api/v1/push";
        }
      ];
      scrape_configs = [
--- a/modules/tt-rss/default.nix
+++ b/modules/tt-rss/default.nix
@ -1,81 +0,0 @@
-{
-  flake,
-  config,
-  pkgs,
-  ...
-}:
-let
-  ttrss-auth-oidc = pkgs.stdenv.mkDerivation {
-    name = "ttrss-auth-oidc";
-    version = "7ebfbc91e92bb133beb907c6bde79279ee5156df";
-    src = pkgs.fetchgit {
-      url = "https://git.tt-rss.org/fox/ttrss-auth-oidc.git";
-      hash = "sha256-G6vZBvSWms6s6nHZWsxJjMGuubt/imiBvbp6ykwrZbg=";
-    };
-    installPhase = ''
-      mkdir -p $out/auth_oidc
-      cp -r * $out/auth_oidc
-    '';
-  };
-in
-{
-  age.secrets.tt-rss-database-password = {
-    file = "${flake.self}/secrets/tt-rss-database-password.age";
-    owner = "tt_rss";
-    mode = "600";
-  };
-  age.secrets.tt-rss-keycloak-client-secret = {
-    file = "${flake.self}/secrets/tt-rss-keycloak-client-secret.age";
-    owner = "tt_rss";
-    mode = "600";
-  };
-  age.secrets.tt-rss-smtp-password = {
-    file = "${flake.self}/secrets/tt-rss-smtp-password.age";
-    owner = "tt_rss";
-    mode = "600";
-  };
-  age.secrets.tt-rss-feed-crypt-key = {
-    file = "${flake.self}/secrets/tt-rss-feed-crypt-key.age";
-    owner = "tt_rss";
-    mode = "600";
-  };
-
-  services.nginx.virtualHosts."rss.${config.pub-solar-os.networking.domain}" = {
-    enableACME = true;
-    forceSSL = true;
-  };
-
-  services.tt-rss = {
-    enable = true;
-    virtualHost = "rss.${config.pub-solar-os.networking.domain}";
-    selfUrlPath = "https://rss.${config.pub-solar-os.networking.domain}";
-    root = "/var/lib/tt-rss";
-    logDestination = "";
-    plugins = [
-      "auth_internal"
-      "note"
-      "auth_oidc"
-    ];
-    pluginPackages = [ ttrss-auth-oidc ];
-    email = {
-      server = "mail.pub.solar";
-      security = "tls";
-      login = "admins@pub.solar";
-      fromName = "pub.solar RSS server";
-      fromAddress = "rss@pub.solar";
-      digestSubject = "[RSS] New headlines for last 24 hours";
-    };
-    database = {
-      passwordFile = config.age.secrets.tt-rss-database-password.path;
-      createLocally = true;
-    };
-    extraConfig = ''
-      putenv('TTRSS_SMTP_PASSWORD=' . file_get_contents('${config.age.secrets.tt-rss-smtp-password.path}'));
-      putenv('TTRSS_AUTH_OIDC_NAME=pub.solar ID');
-      putenv('TTRSS_AUTH_OIDC_URL=https://auth.${config.pub-solar-os.networking.domain}/realms/${config.pub-solar-os.auth.realm}/');
-      putenv('TTRSS_AUTH_OIDC_CLIENT_ID=tt-rss');
-      putenv('TTRSS_AUTH_OIDC_CLIENT_SECRET=' . file_get_contents('${config.age.secrets.tt-rss-keycloak-client-secret.path}'));
-      putenv('TTRSS_FEED_CRYPT_KEY=' . file_get_contents('${config.age.secrets.tt-rss-feed-crypt-key.path}'));
-    '';
-  };
-}
--- a/modules/unlock-luks-on-boot/default.nix
+++ b/modules/unlock-luks-on-boot/default.nix
@ -1,20 +0,0 @@
-{ flake, config, ... }:
-{
-  boot.initrd.network = {
-    enable = true;
-    ssh = {
-      enable = true;
-      # To prevent ssh clients from freaking out because a different host key is used,
-      # a different port for ssh is useful (assuming the same host has also a regular sshd running)
-      port = 2222;
-
-      # Please create this manually the first time.
-      hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ];
-      authorizedKeys = config.pub-solar-os.authentication.sshPubKeys;
-    };
-    postCommands = ''
-      # Automatically ask for the password on SSH login
-      echo 'cryptsetup-askpass || echo "Unlock was successful; exiting SSH session" && exit 1' >> /root/.profile
-    '';
-  };
-}
--- a/overlays/default.nix
+++ b/overlays/default.nix
@ -12,6 +12,8 @@
                unstable = import inputs.unstable { system = prev.system; };
              in
              {
+                forgejo-runner = unstable.forgejo-runner;
+                prometheus-node-exporter = unstable.prometheus-node-exporter;
                element-themes = prev.callPackage ./pkgs/element-themes { inherit (inputs) element-themes; };
                element-stickerpicker = prev.callPackage ./pkgs/element-stickerpicker {
                  inherit (inputs) element-stickers maunium-stickerpicker;
--- a/secrets/acme-namecheap-env.age
+++ b/secrets/acme-namecheap-env.age
@ -1,47 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 NID4eA ST5vuBY34mBdhLIkNLqaIOY9Bbp34OcNCm5t39OpR1U
-abFLT6kV7/nX/wSV+V/2GSCa2vOuZgCnn5edh5ixNxg
-> ssh-ed25519 9RQHxg AXA6PsHeeFJh55sX5uO+HVshRlRzNxvSIGCpPChorUA
-30i8zc2wjovEn0LLh8YzUupRGeQQqeMf6Mhkx2t5xhk
-> ssh-ed25519 eP5MMw ZXLt8+mk1I4CtbXe7fAW69kbHViKHSmfI5N0bU738yc
-lexop3bpWsTUdd3y5y0kODgKwhdOeF76Meavv/Br54M
-> ssh-ed25519 uYcDNw UdYgsm2ZxtFOPXV9pnSt5d7K/hWfrg2GoVzG48ziOFc
-EXvAGb9aPu3GLsjl0QXEQgVuiHKSrQaMEW0UBcQmpZA
-> ssh-rsa f5THog
-r7bcUkt6dUxG5uYuLYfpfT+/DrConi8lzZwXQr/NTPc0NduG5qHktgesVpVN1Hyj
-a9ziumKtnSxmhdzJESRMezkQG7fK7qpjQI99tYmIM3unjq/dg8/GTQbMKnZY57o+
-Itu0LW9MKH83Z/3Vcv3qLZmULtcsfcXqjwIr2SDOjjsMhENG4KmOzX6wOVYuSWkp
-96fSGuFCy5cWrd6omfcqwQDGHd7APw6+bHwQ2rhCqkGSk+fAjJFEVgjKYowHtt+5
-sq1a7E5xZjNAETU9xw+baehMCXwSAuUdYGK5KTLtCar3c+FLPUtfapadsAR65iB5
-/uqoRLZidpFkFl1yDsboo0uq0esRSrb9xy0KXIR7XeKaEjSKKgwFeefZrQ1Z968f
-opXm/rmgkh202vO2NLQfDUz81hBrW+JH6E/SmKIYGYFIauoaxmYWzpaSmq7IAfIj
-2pxVyz74ryaYU9brJB/LsWc0elCcl1zo/e0OcxaLzzocDftpNk+dmYNQ5GuLFV9K
-uKh9uOopqTcrSLKiQ3Jnvsj5LEltv7oJE4u2OZyR6erCpz6ZL0bb2xJ+EkRTuvq5
-2ktXvSCMOWp0j7pHDeMQaldU656w0AS9JgoOSl22euZBFC1qxwvymFYNPLAAQBTU
-bojIYFtJQGv3hrCgAWSJXL5yEcVVBUQV4GU0EAelq6k
-> ssh-rsa kFDS0A
-dc3I3vVWe3V5XtUaNsIuFdes+nN7D981BPS9CdyQv/lDHf+G+KecyqeqPF1ZHq/F
-emnfGZDGjemSjd5hPDLkFKQ2zmKH+qabH5s2YYH3OgQc4xtdVfuhfEH+MAgO2ajy
-1PFAu9qyCXz8h30LIcXI69rILAUPrFbWGFxfAEAjV5PXdOj9BcDDpa6vafY9etVL
-mQQYSIyocUkFNhYUAivXcNzQEW5RY1sJkW4184BTdNyqnjBd1QtIRryssaod3rC6
-oGfxFUoOSG0o4QtrZfoo7Re8sR5gLVZrjBsoUAihQ/PgTk69JRsmAHef63rfNHO/
-4tmQzDA2F+cj1HtPPqpyetBRoxaRmJiNy4pmEkxFh3I9YSYdWPCDm6ntXcxi6KNK
-G41LzGy882EsiXeKAtX88FndEv70Ks7aXCk8RKiCJDRWUQAZhKfWN4/epZRwRupI
-ESceZCAElqI1QDyFnfuvDRkgjvyCeMqRG0vvgvTQdUW/2CSADeqKe0/MwNiwWFGJ
-g8jg9zZk7lT6AiqsclsmbW6hLA/+Gh8Yn7uuix57NxlNcB/MFoKVhLRlEfqSQz3O
-ZeEs0aGS5Q3GB1Up5dh5ug7QiMxNyGPKtZKCfE/fcVriGV1s7mdMk/v6DBGRDZYP
-cZT2eCqO4CR498DcZmEGmblzM5j5HecoIT1MRlpKGnE
-> piv-p256 vRzPNw ApGjOu3qnsHn8q8MRNsM+hK8FdQa7c4mjWvBDgV6zzYr
-zLZTP4agbTP96RdSDRaQE0QLCdiAw7PVgS7vqHCiOc0
-> piv-p256 zqq/iw A1RFt8g45pY/xKZHYRcrIKFWWVu1moRiEqYUNFzIMQnq
-NLOrT+6BNE0Oj/RbTZ08y75o2+/Ze2iFEHU08WDkUPo
-> ssh-ed25519 YFSOsg rHIQYA0LpOtjV/Qy5FvsLkICwAHny1wcRji2t+nk7Uk
-yvU8CdJAvt1TUlC8GjdBWvV49UzPJsrGSdjM1SBk3KE
-> ssh-ed25519 iHV63A cTbbkXP0/MCZopICjPI4FlFPNhwJUQRzfhvkQ+0tMW0
-WQYU05l05fp9WriD/DcImXpq1QxtGYt9HMCQZEvFmv4
-> ssh-ed25519 BVsyTA d/HQ6tLuyFmCbWNx2Y34f3lX7wmHkRjnXle4y7DYiC0
-TLk1E+wSdZjoNEhn6VYjVg9WUOU7Flntx0+lF4AY/kQ
-> ssh-ed25519 +3V2lQ Pjkt+aKYUa9w4qELEpYc6bm2EfBPf0HhmHAXAfix3wA
-zL+wczUJ632M+9PSEWTLc0UikNL1QSFyjuaKqvY8NQo
--- +CyD1ByF5fDQgtfi7NfiASk8ldY8LOJE/nOUe/JnSFE
-^QlÚH2ü¬(¢B¸	²ŸÔÑêž^¬•¬qa;Y[bIÛ¡øcú7Çß[YŽý›iúMÔ‘ëÙ«)ÐðÀqa,Rcƒür<C3BC>^Le’ÈnØ~¶w<›œU†–—û3ë„~n°<6E>™QS0ŽÐ«Ì
--- a/secrets/alertmanager-envfile.age
+++ b/secrets/alertmanager-envfile.age
@ -1,43 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 NID4eA jIwfpP0rFLANj63MsJAse0R+TQbGf7mUStdusSLkkCg
-RHyxZqWGYMvhQYfZUc89GPly42u7MR9gSpR8aFWH6LI
-> ssh-ed25519 uYcDNw JGsVrWwxwA8ftUM+Fo1jFigWfpvNUwoNkK5zKIu582Y
-BzM82Iqmta2Dtb8xey2nkoil7mDipn1iZtGMPKwPcPI
+-> ssh-ed25519 Y0ZZaw TsTaRLA+9WtN9+FJWpXeP12Af5EXMbo+ANTaLC9YlC8
+Yols084RY1C9gfOrDMwJcFRuGZ/5dgGuJey7RXqm7g0
+-> ssh-ed25519 uYcDNw ZLAINtv10PGMtK5TL5Tf0NyK/r1iww+vTC09ElMGoX0
+EgBB3aiHHdaDue9+Zdxg6mTV2VHeLoDN9wT+hlAzVMk
 -> ssh-rsa f5THog
-LkPMatwkNWAElm+RQiCHtHH2QPgVsAAd5b4qF0R0O6r+0CYzEF2OAOZ0LDsytTB8
-7oHAHxA6kAga/pqKUaJl28xw7ujVIb1CunZFvVSxtOTYRrEy1Rxe3AKUOm+ZmfPL
-66Ef58HWMCHzK9sc/ojo7Us4okfRhJBklB9lnORkSfdkvEHLeq0R0FfDtDCnynRD
-SKqlx3VbdWe9k6UOJidA+dY8Wx0w2TQM1c21nDr4vXsXpZf6ttT4HvrqbSrS9V1c
-nGofWP+72WinOpFRDQdLvdKvaNbLPwhigqL1VqaIcsnye5zZjQDNn+SYf55byBkS
-CMXj238UqvdDxB4E3mBEgpFxOnyi6kLQXcPEBF/xQ5fER0RS5MkWkuH4Up+BCQ+/
-CppqZrw85OOa9jAyWxil3yLQNAnLGi/P+mesPxSI+i2Not9wbUTALr4COG+1qvfF
-2MbHiqREoajnQUJjhGhXaAA332X7hNuOF/DjmBr7i81oWVmKs6TjCDVL7Yo9xu3j
-BcFqMlaOgr8gObwnyJ9BbtW4sBtnOeD5onPxWluV1+Ql8Idjmu/BKeuqIyGX6wFl
-606lbprSTRVjLZWvg3gWaIMlXdcnat9PmHeRk/yzTrHke2aFSkvUKLymnRCHETae
-Rh8ILeQTq36Ul9r7qklBNu4M7/f+jeX7gYPH/yDUCXc
+aiJqMs3/u06tzs8lx2ISlQm87TDatqEn47v3LB3HehPanRpZx9O1HUIRTeiWkMU9
+XroGe27HQCCPd63QunBHUH7WStA10IS4rHVpMcULB5IM4jwcbOhSYSiGyY2sbv8+
+Nn/04ZOwrfzTabC7moV1DqAw6hnlDqKWp/q5N6xMb780w5vn6Poni3OJfuLaBWaT
+r6WhE5evVt3F4jyYI64fB2hFw4AR2N/zIMOMvBncLFwJf9lbIFdbsENZf94cYceF
+Tj150xdMPuErBsSJQOlfDYSmyioNN3UJUWiYsDeM3nbPEVPHhfTk6b2/lMhSQkcY
+KcuMj/mN/7w7i4HSxW6mUcK2sUMV1BcSSGYRH9ZFf7kq++KpyiP7vB8vaZkcKbfJ
+qqrIcXTuXhR+/bWZWqf/GQOVwRwe1TnqN5MoZHipg3a/UCe0gMM617VwZcfhBzjA
+eW6VUdjSewwA8YHEuDrAeoQ4CMs7y56EaIlr2IlQy6uzJPX9eeO0auO9RZ5AR40a
+7un0FrlTJX9uorpCD/zi3tvd22W5qVoMGZ8vXJShZmT9he9K3Bv6XbzG4DJQ9/nv
+xZ676HUYhWeyYZFBvt6DnEBneiDJFeaV2AeuQY+juHBOfBrbYmlE0S4Pd8uRSJ7w
+u5UJTT+RV5TkZhpCqqYm7DphYocnrv7Ic+QKmvKE4ls
 -> ssh-rsa kFDS0A
-X1vrBlpHkWOVyhBokgO0yNDQk57S92xADIi88w2UU+nTYFgo/RsyTCCFAFMaDvR3
-kQdtorCowxQpKLnTzER8i2ABZAgAmUzGQuRPDKcqZuZH9oypNkBs6qeVI3TA5GKu
-V/IfKLeR57K3cpZT+TcOzKUqm/AAZO+rwdnrfW9qVAb7vlo3TWawfBHb+Fl7y9JL
-pEjhDMhnA7na67Ktz1MFm80XRneMTW+0NGtcTd1iQfjfHe0WfFuYU4H6aZ8ZpZYw
-2rLa+EmFqUpv0ELwdGViqmjUNwJunsJ6rhJZlMn43v5/XPLpapQr0zwtXzzfzZHd
-HnI6/X97zPYUFDsUeI6x2CiVKHVWMGjJ9VPAexpJepZSkgI6On2/mfs4++XnDWLv
-qsvsJqVzM075eH0LUyXq4WGu7oJc4OdfMm1CrEBKAaqdKRl0HnBZGSER3C/qAhLK
-Ihbk+kti5C7GTzRyUlzkwINVFV0pePClLP7AC5vdKMhXysGQlxNJsTeUTdAOhrAm
-UeWnd0Xp+K8OBsUgyGktKBMofNAJ+MilSKt3x7tJk3QuQIGjqHCshpkMf0ckixrh
-aDN9Rj+s0A8C3hrVv8z602jBrM5tfYOZv+q1/yFQo+ieic6Y9WEzzrTMJEHxFSzX
-KadqfZii8HCGQODcXh8VRpWDVjzt/pDVR/zu/0YCP+0
-> piv-p256 vRzPNw A4KCXAKoTYy8euaKXot9+c5N21WG9/9uLPomiiI6rZ5W
-vbTcLpDNM1qVdTBCUPMrlX2GpyeMUsKaKLFl5GVVdYY
-> piv-p256 zqq/iw ArX1s306JaaWVPiTA7XyzyTKcsBDHjeIiSoOg+5PhsBj
-zzmU1T5q5ff6TzIXhWqiVM0Oxxo/ln3uExBXBlLFcME
-> ssh-ed25519 YFSOsg tgHAr/emB3i+9Hd+q9oYCjkPO+RuXv22kimdXz06Zys
-p8sYz3j5I95ZBJroWxUSzWljcj8E3Ic9uwwyrUWm1+E
-> ssh-ed25519 iHV63A 9UXBAcuwIfuoTHcWYhLVa9qtJ7UsLsIQsH2Bn0T/Wy8
-OvfX4cOKJYv9pwaQp3yD/QPZdDnGSC6f1qemtKENtpE
-> ssh-ed25519 BVsyTA nC+YMVK5YyCM79iNijTaBgIZDPi7Bvlunuzl2s9SrRw
-xVUpZwdIcszqsRdZw74fJrSduzxqrO25EMfuypipys0
-> ssh-ed25519 +3V2lQ 4n/lkQ1nwcXD7mNc3DzIfC5xGF2mn27AoO36Chei8AA
-vDe0RU8Xm3L+/nFM0lKK3jv6hqiUE/YxZUFyHUsqAfI
--- D4n9aVPWABXpzO9DI20yHf11MRJ5ACWVhT16bDls5pA
-iR	ÅÏÿ%µÙØY^Ï	Ýñý’µ¶{“²°Ý”#®Z0´P6šÿ+ÛÄR!i›J-\ul°9!å¬`Z÷¿Nh²
+HhilpvIiUps80SXYUXg5vqNmcy8SACvxpC5dTVBU2n+4OVXQY/35Il5ZOrUX3U7a
+arfVp/KaQF7Oncu3x8F6Tp1ibUwmoyAV6OYqqs128nEPwkNbJvwrLY3aEBm+NIzm
+gMlLRjj6EP84TVWgOsenQCS4l957f0QoNVxQ3f+GWdOiZZJFsv//ndsflng8zPlF
+bGZy8c1TxDZfOD0/kW3Nx05c9X0EHKOEoDUc0p4qntrWlflxcvLONCgv1gZuPMF+
+jMsPFP81eu3rkEUxefJ1qbvvGuW0cbzfwiStv7iGQ+Skh/vcoM0qw6p+csNKyHVO
+8nYFcs9kD8067zMnyuqiUHASfZ4rPqTji0iiPC5kZn6N0YSgz2bybkXcoqmy3m6y
+qs0S+RD99o2vCLhW46hZyKAgUyTU1DW42EmnZkPrLoqV7uin8fAwPO/98Q/b3Rkr
+zBRtyTEbooHvOCL8limiRtDl+5LMcjRFNWk8AN+9vHMsYurXPNOCnd8n2Z4MbT2U
+AhpoAD/+8HXp0InBJ/sclITVAc6tPb2CbJW6mrFezH8Ri+/6u+zSF84JDd9ZrCOz
+oIshiGZmhP5mIuspVrxgKlm78a56vQrygpqzvuSSYk3zIJxmhEkZhw09/ga+rhyB
+pkKn7GRyZTfKjwt5nnvW5/bmQndTa13j+7RhkRgBSvU
+-> piv-p256 vRzPNw Awpc8paUfKnP6r0bYsaoeDE9GVSnads4/a3jCVScgS4V
+YydKOS09kyZDYN843SHIsYUimtSQKvGhIuycPWOFojc
+-> piv-p256 zqq/iw A54xbcufPkLpTD+N47AiIe/xZ/0vA5kDJ4p3rIZw0a4A
+1WFP2K3tfUxtdKDBEmT3cx/u1i5nCzFR7cK4kN3WjC4
+-> ssh-ed25519 YFSOsg L0lPSkoPVRKGlJ9MzkJx+cQvnZw/5m/j/JO4aRzd52Q
+o/N7zQkvbGGoadiJSvL6lfuP63uqzxEIxDtIg4tgKIo
+-> ssh-ed25519 iHV63A qfLWZhbDisCSJ4vFFTR+XpRUR0WViuAqarf56M0ekT4
+ZSWW34pFRr0M2jFhnphIPJ5ch37ASM6OgTzyHSo0KAs
+-> ssh-ed25519 BVsyTA JcFezSIfTF+AP8LYfFqz+wIpUrE0aoc1usiLtWxAPQE
+F9uhFyCPK46kIy+ud4V5/ESacQgc9R0JV+JTEZO6nBI
+-> ssh-ed25519 +3V2lQ G4yT1e7B5O2Gy6tusRMxuWOFScynWfFY5AjrJvxMK1o
+n1OVFRqzijWlc+B93cBNdFPz+8CBYOsI5hpF1wz7xr0
+--- 61u55uUc7z59iHF1IeyBLmcR6u7STUhpOPb/ODf75Vc
+<$kxpû´ÚH:}ò*ä/Tâ®Ñ$‹ÕbÀJ\F*ðòWîzÉ6 Ý	±Âì<îÌ¹>e?ñ¼<C3B1>Ÿ6ÚµÌ~Ô!
--- a/secrets/blue-shell-wg-private-key.age
+++ b/secrets/blue-shell-wg-private-key.age
@ -1,43 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 eP5MMw 3H1XEr/Vt2TOQUvGu3K54CxbigkVpaC6hofMOfFR60U
-hqFTOoMhyhb/Fsywzu4nYXmEACOunenO/4NwPaVdrZs
-> ssh-ed25519 uYcDNw raghSMdCaiQrfGviMlc9Pwh8cx33IWh+mnsxL8jgTQM
-aOMrh/746UulH7hkOV6XRiwEszgJtrI33mmzY5S2Ipg
-> ssh-rsa f5THog
-Hm/2fpGDwqKG9K6zLYXuSDwOppDtDfw665ppaVzRvnNppizkilCohBzCrwXTMyeH
-KKZKqaEt+n35wrurfMfqQf1AkamEimjlXCMmr9IwrBHbJeIJuHn6vGSOssQ0Sq4R
-dr002QrKsGDzlL8dCLmaKU6VPTXcSbCOgDnBW/AyU7bvN51jtgm+jOIey7jH9Bm4
-0nU0UNcPiShgSbXLPp0V6O/1zQBOVeFGyGenblAKlqLILPvc04f4703alqSbKwXF
-q6GoS0Dipzr4N8X4Thzgc8H/YQ6cBVGQTebVGHqFEngLQ2C0yZWlDfJsKnKOGUce
-xSxSskfzEv2s9VHDrXeiTAzSYaLoZI0JEDHOSICmZT2wqT1voFokIQV8twORGpOo
-RAlNX0BULPEg5Mi2k3V4ZBcG5EwUjEcHAg+0cQ82D0f4OJEqMVIa3dse/lBbrFzC
-/Gkr8+LPWVv7f+mRr3sdKtZ1nBwz1uTP5qIA9m92UeLVdVjmp20hixmlgftAbTBm
-MtIH2xqkitpb6bhImGIbnxpg7U8IqQZNfavvOM9yqj0uud/Nh8ruUuwxci4RS7yP
-YlIcompHudeirCLPvYx1T6nYRB2GB1tpTcyQN60pb6YC7lH9w/tLhZf8GFcMdIY8
-eLx7FoWfNj2dIp8EpBrRUEaQlea6Eb1r2DYTjmNunnI
-> ssh-rsa kFDS0A
-SPaIIABa0Wja26CIyeUvrlt+LWJY+Iw2+OouRZkMfi5YxDflb6SATesWh3zMD5+A
-SOiA/oUiRfGRVMmqiEznd2BLyUO7FQDv8tIT38R3m8Nj2Lb/kWtuhPKqrk0PPvr+
-kYR3iyM4klqccCzwOYwWfpO4ZkFACBApTOFYbU4WX50WDRQRco7M8funj10BAIsL
-H7hOKtigx2RJaJDcU3MPHV4beECpKbeH9scICEDmi098UP3850g1lN5AR7NjWvLi
-zr3Z8Up4UjEwH2mvuNnAbvA+0HOu5geIae+VUqy3EN7XFC5HnMHB6eK12Q1VAmF5
-MbgkppMeoqLnxIdLT9xxRNhD50B3QR8MNHgaNWuBqfl86XPfXjxYP5kRaCAraego
-nbE1gItlgIPESpf0ocfIEyXb0tSup8c+99ezgxBMrzNP6UtVGRhZvwLTpBZmrLoc
-5P/hTr0WQE7d/6lmY9VyDsXasPU758tUhM/cJxmmUyZcCOhjAiJdWSYHe7AUjSQy
-rUSKUSYwqM/epFNqdnanj4pmmRkSk/0AiEKikvb5DvWpHrnsL/EuQqtT382IGv6P
-VA6ORv3BmL8IjNnTppZsG8k91WWHLEqxoDKUHg6WHfJ5XqnEM4maFsRZs53QLqLB
-vjAxAeJHjFg13wkfJmo9mZNbw/0WXS/K+xmeOTYuH/8
-> piv-p256 vRzPNw AwPYD0NiFDZ3/0L0+BEUS0hm7RddL3sPXUshz7XtIQVi
-7rzoQuAQQHxkuYFx5TrLEXZbGsERg78mAXcgQySwHGw
-> piv-p256 zqq/iw A0Ec624/7FOTPVAbZDjhsBy0i5L1Tw9LwYfH/7DeKHi9
-djfKQINL2LVAAueovp/V1IGyhuy5LGQtOws5Dtih9sw
-> ssh-ed25519 YFSOsg 6EeEfNtlQ7/a5Rc5iShfSa2ZjIoN6QcLDI0hJgpF8AY
-Tcp4iqFjBTTzSUAZrxRWe8QkvuEoPWVagNL4EiZLMIA
-> ssh-ed25519 iHV63A P8IDXAspyflmLqtPOqPWE+J9s9e3OccKc5+8s/Wi9H8
-iRZba5723Ux5oo8YA2TDyiaWyGzHlAcvEiD7I99vq4o
-> ssh-ed25519 BVsyTA LB7gg2/eozH+f9BNC4Q1m6Pl7b6znkO5rPVgvKSjen4
-AjNzM/44dMy7JyUcAT7c4pAFTtOuapiGtiqLdBPGrKA
-> ssh-ed25519 +3V2lQ NHbovTrC4cTSsqb3AfmVOJ/pL0QQbK9GpMUpQMAW7w8
-iwAoDSQnucAzQPOgZZtl2bnJQ1mU19aoruItkQqJuZ8
--- itqKtiBSCvkVJ5boq7PeY3uRMemElImzWvSeTwbz3y4
-×ZP38†¶0¿Òe¯8W’j–Ž÷[ªø#;ñHjÀëÏwïYÂœp¨µ“6W`ôhŒ²ªs§õvbÈ·èÓWu·ÔœxZ5f5½ 
--- a/secrets/coturn-static-auth-secret.age
+++ b/secrets/coturn-static-auth-secret.age
@ -1,43 +1,44 @@
 age-encryption.org/v1
-> ssh-ed25519 iDKjwg vLO2012STCeqJACpBNg5uKyWx/u0Yfvwxek3S+0Q1C4
-6vPjunf0CQeWTwznZXPc5iVL/eiF7SrPqGeuvgcfizM
-> ssh-ed25519 uYcDNw QwGWHxl6dTO1HEfw7pEtdvb2ne0RiNMb8SkWRIrRJQg
-ffdyTEltr6wlrnA9isU17orFvSRmicPvX+w2t0QBJIY
+-> ssh-ed25519 iDKjwg ZUEOvf7JnWeFNohEAhloJ0+YL2SwHujjm2YG85NLHyU
+HwrrqLMlNmfSlZVt/lCkIwqmCYLARbDOBhIm+AYmDEM
+-> ssh-ed25519 uYcDNw Lrek6ru/vb2JIZyALem40oNZCf3ia/U6sb5hRyDaakA
+N34LLq2+qJOlbyaYXUtNP17fDPjF+evgZ6kOs7mVhYI
 -> ssh-rsa f5THog
-XjKRMzLPZlrTQEDJzgCwBbjZwIy6fMYGLuBR8TS15SAIbttLoikF/AV5zqJDaE9j
-RaRJIIQV6LYCm1fHOsoua0XGxicvJkdithrDC4zsEEJ5n2luNj+sQd7h9ruOdkO5
-l+Og+MphPM9naul+MJ/DluzS863DewkCNENEWe5H5MkHujOoqEsRsGdrRPXUbAPW
-oNIr6h7FHCTFTkxfj1aAqDHdK8R4Yqo2K0vnHHfNS3PeN+CQJOrGNzokYybMRxqK
-RXoJD0QKAUCV8cdXGr0XuS/ljv0lFODKhupy5ObYU71052nxo8j7KTq2NpZXqjul
-PWyetcPtH5nLCs2L31XoBk7cEE8g/eSjPky3gSMdjGjdB7qskmuPcAHlHEwQzecG
-D6J1LjrPa8OMVD4AdR0KAXSnSvzt/RhyymiZWtBeKg52rm4KK3PVbJqq05m+PEYA
-a8wFT6fJOqmNr4gj4peIUHca0gYWhfzhLpXsj4/MKTPxzdUem/wbbMJrM7oQpwma
-svN0vvqCUc2wfw2Apr3WwoAnNTIohZOngNkKNWNweXtPOee2qgZO3ko2wpFa+Yh+
-IMonHHVhtdchTidx4RttgDIaW/+i//XGfqPdmanO5wUmm+SwgqkkQkRHzmtbmgsq
-KlrAmjL5biH9f9sBItYMdKafgyQppMAQ3hXt5wgAgj8
+jmwJ+hV1/50cWemVUhPTkTFgnd7iJ0YLtjU4fEKXghWIlie/OR3AK++1f2UJxKT4
+Z/32ALRBnmb7FlAPyYbxIns3IUJP+Z/Il5SCeDrtwaUxmtluwXwwO07WlztqZJlO
+bvZ0ifDazxOFZO6QfXQE2SaPDOqcH2AAiiL50eXMgbdY5lARYW2Qbai/2a4t/PuT
+Qn8WAwjyXOIdOnaYb/MZWyp0GQYsa3nEhYyOWvTSjSROEfR5qBtGNYkUBBTYF+YO
+DGOYStbPSkIhnYYQmNajlcy9wMW5fH36ujGdnMH7C6DgcSCY2iTDTdE3cyCxAuaJ
+bRThKyXYsvhMKgrFzbhlgt68taESb4KcKcNO5r7lqqID/I0b/fVltsKpkXrSCB53
+Th/aXLXPUrYEkbdP6nqDBbUjeA8RDid1raIF1O29Ok72oU48q50QXqP8GF+honkg
+HSdXmhPtlZyArlJNWogDaU9FkWp81E0JS8G0OnoNilCmiu7sF717GG4pkA6GTnaB
+hlJSiVWBPhmhVURIOKkRl5bIWLUvJESPLVVog/vsW7OJETOb2u+AlwvaBNY8w1wE
+An+m/qNO/H9Nksw0B4C9nLfasE/nDvbOT/Igc7k6jP0sw6/PAWnosJY5vDyIpR8k
+7q3rBPnsZRXUr213ue8xs0G7SsbLheYNu3/D4YdB1tg
 -> ssh-rsa kFDS0A
-XAY8GSsx8B5q039L14C/t4cGK2sAm9eqO33r//YgpI5nkvw+pZrbJegdCItfHXHd
-9BwBGOowTe5Qmj6RVfz4rwsj57HJbt6ivoIrU3vH+GLsNs4JIg5lwz1/WCsotw6W
-8jQXiiZbA4nvzQzyZjJVKavTCfvbRXdzc+CUZiWgQDXsSFejp3ODeOvUds8YKWiz
-jYILyzUzyAf05HDC2SIUhfA/UoXokfpo6uZuryWXjRBgaRENa9csDnktc8V+61W7
-gUnu6yt/rN6oiBesnUZQK4sPd5YE6EcOT2gtLp1qKxtRuF9TEX25oLHi52kPBu8j
-TNGbCU2ImGW3Z6TkAj+/XQzwEIrbLgb7APMkI3DtWyIIxZn5QJdDOOCseKMKt2Lu
-VH1RF9C26mqcx7+WGCJKylARX8sbT1/ZsCWSUnmenYuGNQQppMwcQGSICs0YmFkH
-XnV19+pt93i5rVFs9IUxFCqFKKjElCiPgIHe0QlGuxifeiMXYuNi8g4ObN5X6GEL
-MPm0+sr19dheOZicyxqJ/jSlEOP8bHgN/VDHjKtsMWQD9r3NfLH7btNjA8HTITDI
-YvLLVCP6OR3ZlMz2HUXDpbaPYSSZvrEtwkqCIe3ij6066Y5cTsYHWEwOvXaKYh9P
-OJtPgLQDV9VfU9hK60E+C5qGQAvHhBgPUfXS8JMJkyw
-> piv-p256 vRzPNw A2vUnNzWtQNNOU//b3muMZeM1qdO3GyREn73VgdxMX4Q
-6AzSUdoPB4zMbFsf0fr6sxbCsg+5/qmBtkCo3ry88Gc
-> piv-p256 zqq/iw AwVuYkScYFB1OzvBz9255ebDwPO4o8szD79gPnzgK/t9
-UCm3jzlAPdfGvxO2VrE2DBvcGlaJpMTINJl2qcq+4oA
-> ssh-ed25519 YFSOsg wUzSRyoZOde45Uv+KaN/ARAxIRt1bPAqN30P6nM9b1o
-pmufkyRBD4BoL4a+dbS321KSdjPRrB09MssNU6N0dtE
-> ssh-ed25519 iHV63A qyqt+LHR4YGE+P2D2mq7qOS959vLZ9K2yalLvGg3riw
-1oDuGVg7Jn+8MIlsHb8KCDImManVGnlIMoqFt9w9Wjg
-> ssh-ed25519 BVsyTA skF/Np1FrFUSWJgCw5PN9uSy+bMezPHV7lH4jm67TCc
-QrtBW86S8cB6GLsw6LVGK5jhFQS56MvATcPspGJwmAE
-> ssh-ed25519 +3V2lQ DPCBFzgin6QTJx0QZ0+52qW+6xXmGA4M+hFEIFAvpC4
-QuuoukU5PC4BW2ieS52rkGcPRPuvrROE37gZpd7cudw
--- fVPm/8JI93qQmr6bEdb8JEtRpKtsBHnK88A1tptYLIs
-|9Á:\Ù›ŒèHÐ(„–•a-[çf„-Bpýu[€,¤bz¿ö'jA¸áyp`4üð“ï<E2809C>lÆ•|—Nj‹3ç
;”˜¾¾)“±ëGÈ¾b÷ÿ¦&ÓWãF/ý‹‚±yõ¹
+BwaozSAR0Lcn3ZOHhC/OuOYRZqW0ayV4kL7CSLgaw6x9WqA7NLcsE+HDr7aDx/lP
+K7TmFGYMrOiIk3siZ4Qc/JwZXPiayxGITcwoY82L+FrJKJmQd6c/3exggsHlc7B9
+1ijXoQgjnorlopI70Cyt3QLQyMCPFb7tuZFEKR0NqBzcFTi5fKVYcMrfa1WVxzMO
+0Ic+mhwMIAst6SQqOkqaVbtUYxATupQx+9FwThk+9NDety1vacb+lQ7hvCnImpTd
+uENry/G68I7zWhNuCeE6wj8lCplFkW7dvrJyoxUVokWheFnUKjziA3ZybfMyAmI9
+vJZnTvTc/7UxJCnuk/pB89q3ttm8LFT6AFAwZ1PY2ndWBMRlnOaB0JXSBKXZCYYV
+bmJ/NSNdzyO9Q4MrKwYO+O8SOkVWM9EqKYv+FMO5CksU/N9EOUkpZeLpMYh1WXPX
+BMKmXzRWp3YEsFH0g74ZBjFpTo+FK0bbRfYfTj7wtS9LpOFPr51qRDwv0zocM9cQ
+MkpNtuSqpXboCLGytJE34pAsDY1BHJpdAOwlwavwK8N/yxlF89ktIAtHpOaV5QNF
+r8oW2DLERj/s2yunrjZ5kQXaxbn2GBeml5gFyYWPnKVIa5x0PA6LgT2OMYd2x4vA
+r7UGlMktJLosJGjJEUVLUHXarKkTz8Xwrw4vtaaLIyc
+-> piv-p256 vRzPNw ApWXG3ayudUSrW8zw38cU6hYVeCVZhIQm/ZbjKpZqgnb
+NqaQ7bjTAuMei08uNpVaK23uVmspjlkGyleF8phudVM
+-> piv-p256 zqq/iw AxdOZ9zfYgKZJY9HhQokUHwSKbfKl7i7X+FPO30EADcr
+qsniaELyEVrTeSaJG/lp3sCPCmbTUA7CWdMxA9tsBXc
+-> ssh-ed25519 YFSOsg 64fhQVd3dvwHCBXa0QiK6E8rYA1jScm0UiBvJVuL6Eo
+YAvXqNw6kQkTzBpDIboqa9gOoTgHE8hcaIMTg6UkODs
+-> ssh-ed25519 iHV63A BlO/mSeyxTFBIa77g0Ce2CcaVf9SAiw9/OzkgnaHEV0
+sjmnXCpwe5KTgIJ1ZaM8j1U4fYi2Y5/WpwpUfAe8Dbk
+-> ssh-ed25519 BVsyTA gt6iV6mhL2G957w7IbJVzNFV8QMHOzP5uOkgSp5QgzM
+Vvz1jjLKA9qbqAE1g0UyHySrrnG16ENdz9TxwyoML+g
+-> ssh-ed25519 +3V2lQ g453jshh1sgCdUyhg3jlU0A0X+byL5jobpu2toWTYRU
+S2k6Nk+UBv8gcJZoIdZUc2Kd+Rv4jzzcEyGm+eb+KUg
+--- 8ahetWGfwjnJYRnkeSS15sLjDBBtN28biMlYCPSvObQ
+i’cü'ióë4Aî6$}ß!IÚ3ó¨ÍÄ™	Ù›3yŒ<79>ç¶;¶ƒ
+O<EFBFBD>.<2E>œ[„Íf%jTà4ŸG¶÷ãÙ¸W#iÐzuä`'Á*zmû‡òèE‡6ÓØ¶Ñúéª[ê€
--- a/secrets/delite-wg-private-key.age
+++ b/secrets/delite-wg-private-key.age
@ -1,43 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 9RQHxg dVdaiC3H/M+tA/xIW3NdwQax68lkydLDLm6OxTx1lSc
-HRLezYbdAPHNbQm/2WXT16wVX+ZC7GKlVp48aIECsdw
-> ssh-ed25519 uYcDNw SqHkg361mGpjrcynYld45CU/jfnPp55bt75apCWlADE
-Z55QoOPVt2u1d5Q/96PHfA0MFAaO4y3CWuJNBnVy2IU
-> ssh-rsa f5THog
-yKfwc4z4mIVfDJW5aEk7O9ddRL0YKOZFV+xKE6OyMGv6luJ+yM3QcPxu9yppCfMA
-AIreVH2/4Tn+WhYv0dQuVeTR7SLqfn+TynkfK6ZZ8NbjSZXnakPqNLtOWi6C8VIH
-MAfTTg1NGOG7E3TGmMqFrQnxYdpIvtfeGaBfiMhGLoWnCzJOzVkZSf1Qx+ibor1T
-ZtJGsAVoAqGlFoWNDNrlemx9/5qxARe/GSSUyKtEb8VtbvN2hgJeg3YAKBANYkUS
-C2Py72R662WBKPSd8vZRaQEJzP78b+LjBPmF98E8EZcHD/L6I6QRirpD8E89nN8b
-/vp/Ze2q5R+9ot2TIO4Q9TJKLs8uMYUNUImrWQM9eBG444dmuTNDDfBFeI0Xwwug
-FrHxS5pE8QzRdla/fIt/Py02F/734pb1LRCBPaLr5F7gFTBtIXe1TCvwfigiYrZ8
-3zD4mpasIz1a7MlOIBIUuNAvAvJIwemenzxoCPTJUIPR9Ja06JUJe0qe/qOOaUAE
-iio/a7XLYAUnTqHQ8efufS7RF8HB61Q5/CEtjE4NnpaiZkG+KQ57xjTwrfKSALxK
-FN5ydIMY2aNg6Hh+n0MlCfpV2N8XYqOF4YWWRKY39516i8QCvvL21k+lt3P0Lpad
-E5fn9FWoLqJw+evJsF/PyTrLT68tQbcY90mIGC6n/Ww
-> ssh-rsa kFDS0A
-dTkAwE1+eD5KvpKvI0Wja9vV3wgKogv9ADKyf/u6meetXQ0isUnqxhqBbQZKhVqU
-StNE4dSwg9gBwsPmNXJ2Avc9LMIBuhDomPOp8bqdO/r0IyDvJ+TngnJsroK7dfL5
-foIDtakdAOVZM12ytm5hZlUNfXppAJUF1T9w5LIBWAMQQYJs39u+RrLfHoIvXTor
-OvTikrdYfGiWdX3XIGQAfoPct3ZEKmD76ypH8ESw8kKF7ZfRQNDDP3LMbakoFs8K
-Jrh5S9e3b5hdiDsv0DFtMISm8l6ec2mhhkVhSPgJ0mZYimMUg2QW1b61aTbE+LEI
-K9O27ci1UKhxvLnxA3UWrYcm9SX3dvFgH8c+hJDdydHRGtMA3OU6Ut2HuGKaLfys
-P7F7gffBTEeW2na2I00k3/oq9CCT4AP1d/CKlGd8ZtRvv5Axv6ThehCFZ/FLYGCg
-kLBTHCX9qfvltdkKHIZwgxQ7JSGvNf/4bBzUz47o4gBhtnADaPondeLkqRS8sMwF
-gq4UtG13Y2NfVYLtydrZCpUSMXekibZ8Rj2ER1uy1PD32clevgmgbTSyniSbJDa9
-NFAeQS8KiyfvnxtLNNoMflR5yL2O4bX8Eo5ooaxILxga4M7ckcuKz2SMjDjpSBbK
-ndwen9EsZuQwK9Av09h3gZeRy/t1ne6MtZrsTY5W7+Q
-> piv-p256 vRzPNw AyZQpsc9MqXbooqG+eK5gQQbfe4ka6pG7uixb8ONVGQz
-FWuy/qAQidT6C8YMb3674epUzZw0Rb2NMCK5t9wdnT0
-> piv-p256 zqq/iw ApTqG55jHkxwd3cT2Hvw84V2DcoHo1M+q9eP2eLxSE2t
-+27Dzy6pzGpOwTqUG17QaDC93O3PSJIfy/d4eBnuLw0
-> ssh-ed25519 YFSOsg mRmdt4AzDKbzKvMPOEHg+jQSRs2RF7f7ev/jzP7SuFE
-VmNGaudQF6R8xDWBz6bFfmk2J8twCUEzcXj2AG5teKI
-> ssh-ed25519 iHV63A pXrKk8kpTBDxhiio5ZY7krRJIDkxYJZOMqCaW9Q7OGQ
-9/xgfjzsd2JT6FQ2YWELl9jqph3+HTF8jChvbiHceJo
-> ssh-ed25519 BVsyTA z8nXuz2JOAn8t8OW+AzFRAXb5ulAuderatBFDrb6klY
-Z+7S5aGCCV7f9WwHWr5LrsKW7rnpidImwoiP2dXcxew
-> ssh-ed25519 +3V2lQ p99nuu5l75p1y3Ea1yRdFBQSxvYRVRJzX1undANyFVk
-QHzKD4WvtnRI0wgiaIYKWwXrG5Qg0vQ+V6eTJUk+A8k
--- od3JqYVYOFEDzaNHY5oDbfOjhUBsiQFd9pNGSkAw8Dk
-øFJÒMmá|šž—>¿|ÉÏü‹µ
ï¾ê0½µ:+‡¬¥U^ØÑÚYØ¼÷æ/‰ŠwÊ X+8gtRNPÍ^\€N}«üÂ£
--- a/secrets/flora6-wg-private-key.age
+++ b/secrets/flora6-wg-private-key.age
--- a/secrets/forgejo-database-password.age
+++ b/secrets/forgejo-database-password.age
--- a/secrets/forgejo-mailer-password.age
+++ b/secrets/forgejo-mailer-password.age
@ -1,43 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 iDKjwg vmr542fc5ndYRiW5ukHanhTMBV4TgSduloYjuWwmpw8
-ACSBzerGx8Rd17zNfgO3qSqwBuQio9oyYaa5ypUbBxk
-> ssh-ed25519 uYcDNw fjP84i8BsNOfBoVDpH25MBC6D3xPXwbbO9ghLKr+mE4
-TRKHWqVvzLP/AOJ5SJ5qeKj6UdYp2+tsxO/GVRy+qt0
+-> ssh-ed25519 iDKjwg t2wVQkkmL35JIXb3x9xxWmRECF7yet7c4+EdoFhCaAs
+GJxaYARfYJdNDq6Ay81r4+TsTAMmPd7AxZMTq/GzuIY
+-> ssh-ed25519 uYcDNw LeXqaLu9EylzTOle7lma4la5S3NDPjALTybvV2ppd3c
+JCdLMyK1c+Sldqla8dVUDK28Zl+nLXnsh/MXQ4d/yJw
 -> ssh-rsa f5THog
-IMiwRGW5B09oJDDJamyQBOwtFu+KhxUQQ1w0RJEnpITZZzyfHOuhAuwsjLy+us9v
-znzSA7bo1YusdFjzfW4RZeueuW8vvWdsv9Cjadlg6Bb2uP7sWeh7qH+IoyB2Z9Kt
-fZ0O6O+65pOybsCKZ9cUuZ+E9E5nG2KRjzdV+csEKAshGLqeo2RILKZB8oSx9tZr
-sjPXRFLchj/6zbY1yBs+q0+qC7ldUBdJLDtl5Yj6hzB4fk1JuPTSDWtKSHBYDz60
-Ri3CO1Z0z+8/IJWZqaa0a7jCYH6v4ZzboGrdE7MJq6Tyorl26bitSSevXHJmCrJq
-ZpcpZfs/kVFu05ftaVul6vyPM09QOIQx+ia9tIKmCgWNcrM5mSy63C9klutXOW6j
-GZ60YUnOvVDz+i0wmaZvMs3C4THhdtOsln/dVrqOKFKf704mAsO4cSEwqNyoXy7n
-/WbxDQcTU62pKEkwlU//CjuA0rHwmX8m/tweNuokh8fPJ6SLE9dLqxPzmeq9JX7q
-RNO+eZZ2NnjpkrI46stVS3p3FUHPbk9mhIiyfr4LgSBCoNWv1TkLS8DOqWOeNKfy
-8wLAjgvpNIk8Vgbhoe4/G8wB5Qvr0vfGmdjzA5miu28YZ8PXHN6DlkaT9T0iROuZ
-HM8j2FND2EYLB/Je19ctYNDjCmEYFhsvH/H448QMODw
+ePz4dSiyFwtX5HmwF7/vyXKAwH52aVfjwQcyovl8r9srFt2o19MLkMvPM+CVXXo+
+v0Dc6dNdfp6Oyn4rNvGMNtsL7Zb4B32OVck/uGn4pI9aC3wsOvr1JvetolaepATG
+vnxB+TYjM/S/iYpxaKbrhKBOM466dUygI4bS/GPT749+R9610mZ+jle1yylyvRTM
+WiTJaNbOEKOnwPPgZdBbZEcisbz5BFJhVHBxxd/1DXZPRBeg9Xn7514IwbtRgRS2
+x6gzSDFZBcpvXQ/g86JveORI9eoS97w1Fgv1bJnwhoZ3yebDThPnP0xU6I64nCwJ
+H0W+Rrutq4UgMkYghElCoFyunPz73M7PArzW44PPCOeGUrVDsqbTgf9YD5s3HDsc
+TZqrcgzY6/cLzulgM2Is5b4ZEecWLNGoe84sjHR5OXneGf9BXcB5GpgWIC//ZFym
+Sr/UOlfI0YtZpY5ph/10uWqi838idwMTjOZGuope5T5m8+rsbxlwAKRf2E31nx5e
+rjW4hdV4tm2yZm+E75FEIo1yhu4JKm+MCv8ri8217c2Ex/qqDQ5pi/meOrjKGFgc
+7FKkg2h6ir1rh0bMYTpZAelpKVicTQpY4HyphiFuk5cCt6cXiEMiwRBm3QrwmSvl
+KcmXweuoYiunkb5q2GG6sE0d3yZluG7g5mPWE7WFngM
 -> ssh-rsa kFDS0A
-nSuC6Kgnp3+r41SXWEqIkryUlhWQTl5Qr0muXhnsBmuN+2iVBGYFqxqJSDpdnvbM
-SIIy5c5rLfGSNRejRebgvyCntEvrOiGtmgubpURMEaXwJiEI+Hqfju1V8yi2RUto
-KTR/YhYv0i50pLMV4JD7MWPga/zeYUVhE8eISUNFbiJS+ve3BP/3Tg2E9tUvTsCG
-j7MxM4Td1jH2jCa7ueYOJ0R/qr0BKIEOGP4e+7YCByujYWKTV1JHOZehzIYA5wFs
-Bqq7GZnTTiP5n/kh7CgNyWORdBW4gaBslyhjAJI3hCbBvZer547K4moP6aPKog32
-yTZQVVu/kZzCIgA/4TzWr/g11fKD0dUnPCmXbctQVgeOtYAbnWJBFwMmXvQdRU2P
-jt5Ce0WqwhExaE8fAx7v3AYXhYgAOBem4uIe34PAuj672Tc1U61hztSCynE2cXI/
-2ZyCoWZZC/4fjUTFXC8urATfjgGV5PrhRcU4JtnQwytjd0Ru4pm56zZCpzmHxWMi
-bbyVSF5NisCvjF5rxyS4XXNfg52fkV01gJsJ48B9dnSs5HYTBaWQWJ00sO5ssGRm
-9H+T/Bsi42X6lnlt8ybzYD7aDIJbfz56vHf18/tfRhOzYbIBE7Rnkvs0vsNwT05K
-OGOb3iLFtxGGIpSC5Ba1T8h1TuEAawhmrHkF/Lfdr8g
-> piv-p256 vRzPNw AquhJELiSYcW1KeKiied88TcDZYgtjdZm46FlV7CRsmt
-ikxq4EIkI3UXqjns1QJdAe0N3mEh7sbzYPu9H0IvmCA
-> piv-p256 zqq/iw A94RUts75asVyQG7IZSfg7mDgcWI/hruOfRqD8Pdn4Ff
-17kI8IKl98f5lMqdcvqpTO8EN7pr9HP0SJJxFlIMcrw
-> ssh-ed25519 YFSOsg gvcjFcWsCaBjYXvab/eyIhDhfw2bjc3u+nOenGiebTc
-hi30KYU9aYxWG/ZWFZQ4qW/P+hi+ms3140/9BTYNo7k
-> ssh-ed25519 iHV63A RVCt2pceoQfdaBWd5qXcT0x/0dQgLP3jKpa6xeDdnyY
-Q1arCu2nmcl3Qt/uqV6UeXUf/OffvNl7ZWtqbWjrw4k
-> ssh-ed25519 BVsyTA DX/5O7PCLEBoraM0qFy821i8GZysh2+XhR1fGV50SCw
-hN/a4NwiX9oySM7Uyt6vS9hjOTHNbN3tF9DAHF0vDiI
-> ssh-ed25519 +3V2lQ uXmSWC+gV5JsARpa8cDv6faykEoYJHH0TqnWc8yzhQM
-/y/94BU9Mwqcez6y2tJoCEkg8c5x9p8FkUbbhUpKh9M
--- SA5BB1izTywLQB/5ghs3XqlOzr0ag2gI2/09M3eVtjY
-±µ¦ýE¨Õ8SLJðZ½Ð°s\–4Â#ÏRB
rç|eÉY/ü|/.B¹
<0A>ÖÑ
+jvdXdLAU/L/dD6bmuXIXEaZIGAEOFTujxuVy7oFHSeAZk4AyT2ZBLfuDa1KI3iSR
+19hImXIZyaQJh5RSTkEHpwdsxexbzcQV8y77XdF2neNj6OYjMfpP8a5foGcu9Rnd
+/DRSkRNumkTfpet/gSiRIPz0Sj++HA8/X3GwRlwqPKE12As06ebL76003NX/u7ep
+6jJR/sOlLJV2VtqU1tvgQ5VV7KIyMTlP2a38MDCtOHTVmK8inVNqL28H0ptYJ1IZ
+KId96pKqR0v+h/qhHHQoYBJxCBUHc3Rp8eZdssLpLfRHGLQ1ccpV7KUr4ihKFh+9
+wu5/YD9qrQls1EjXi1mj/kCvT2FplUJEZqgBBRY1/mHjpWmx999E5QijjhWchBL/
+PgF0oF25MABESrm/edvThwp7MVTA8ZSY8xj40D9bfsBGrpVBlf5hKsSulpiaMQGK
+6ScH4sRFXDhwC7j8OOMZWcqNvEc3KjgjJwl+qFTXDdBe+zd5sF+orjORjIge1z3c
+v2wngm6vTX4GobrtqiC2ZmolWbRxz7a4IwWNPrmEql8Bnmf1bfRy4X5/EOuIy1zN
+s/3Qu0KjjVBikU60RyXAdRI2M+aCKSKushp7bThT2j+VJTGIsmEbG190VjChTkmb
+meF98Mt2uJoJjzCYdyaGCQRWAr/f8ER0GZgLXS4Apt8
+-> piv-p256 vRzPNw Am/95gSJXOtEBedzoMQBFwWC4E30vZcMINW5JjeM7ot4
+TzGZSlKt50OxQryrIQHSqMj+dnIDV5+adfohG9heDTs
+-> piv-p256 zqq/iw A5R9tfUoQmodbn9rt0M0x3lnJUMz02u66HR4+RTIcU6/
+D9JRgjM280CDu/ds6j4lequ3VGEwz2aEYf6Pu4e8Hf8
+-> ssh-ed25519 YFSOsg 8YXBlEpaC0Vkewf7awp/RuHxaV92jp8Lnf391jd8UDc
+9bzGios7kSFpAKJbmjupcpf7/BCn6XwQMDfh1uRb1qs
+-> ssh-ed25519 iHV63A 2WrmaliPbgh0rJLJJkgy1sUI4S0H07PwZ9oJNk5R+z4
+SdjvYKOlZLClUKs+KUQ2ek4X7amZn56Fcfo0TnAeTO4
+-> ssh-ed25519 BVsyTA +RlXlmh3g6GLA7W26NmDEd4fRSVrJ8lzY1ZZ8OuuT2U
+quL6DjgTibaE878QG9w281ArQ/9LS5467Nfm5TiADg
+-> ssh-ed25519 +3V2lQ 4B1XgSPLOVjzzNlxNYmLeIxABUnXcvETOOWlaXnmgRU
+bgdGjPihq6SnGVWsntPhajgy4sLD8c6VWSYeSlllUx4
+--- LEtvqKl5+C4uRIigcNFI3hVXkxov9Wt1CasYuMvEpvU
+¦V †ãCC{ËË©u%ŒÒr¤37ÓSG6	¤(Eëê1¡ çì–àmP©Fwï¸
--- a/secrets/forgejo-ssh-private-key.age
+++ b/secrets/forgejo-ssh-private-key.age
--- a/secrets/garage-admin-token.age
+++ b/secrets/garage-admin-token.age
--- a/secrets/garage-rpc-secret.age
+++ b/secrets/garage-rpc-secret.age
@ -1,47 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 NID4eA HQEbsh8zoRkgWQHuHLF/iu6GZhCXJ7h0bCbj2z4uyh0
-lhRAIYM2mWCmwT9WGESgQnf1EadGPMZARC+EnVMH4Vg
-> ssh-ed25519 9RQHxg GIKGKtJTCWVTZdXn+GpWPDTqQjk44ptA7/D2LmREmzU
-WuKeF8IZG70jA9zHaULJ4uXp3sj5MSga21rLOI4st4s
-> ssh-ed25519 eP5MMw 6rWxeM8wnvSOxIbvQidqr0MREqzEdsWMTibrWmy0hVA
-LkTgGZyJsl4vfq7jUbeFbrL/naaULV9E6yHyVG3hbso
-> ssh-ed25519 uYcDNw EC2iOzQLOUnt8a+V/zal82jrOBtBQrIWcaDo4tq0cUo
-T3iWlaRzbctnTrBCQ5aOwGND4QxmDnhulq9PcvtoBqA
-> ssh-rsa f5THog
-NCQjF/OsBHHODFWMhgz0pkyo9YJN4bUsocgEIx+Zag60wR13cmt4dLMU7k9U2LT1
-S7gs0ZVY/7RrA9GaxTyXT9c4UlehJX33+lfR/nNCbWguilcZ8yYV2pa8DQqBRPSm
-Ub6AlkgRos0R3nBfUDiUWuwZ3ZY2qWOp4WWzcrCFej65WBdrQABD07LRUghnEPCM
-eJEOJE5nnScvK8wVmw7OTVjA9ZTOS5/opF0v76Y3kU88/VuovJz7hb2AcANuB7W+
-jT5+hKhpTaBlL/A/AmgQmJJ9GiAvdn9KUNIeqt8Nfgpc4Vs3sHJZ3HZVwC6gL3vR
-dOE0D+eh0bmI1J7t8jpRa1r9tZyKxEwZqUh/O80/d+yZygw2x8ignLpcRhLmrT9d
-c7guE8Y71+mSxeITFN6QY/+5hY4EJ0XR1t4FZHgKgMjtPBPYyx1ogQNTQf4WaNld
-XWh7goRD+w3RhducqRdmhc0RhDpCazvbGXCyBxZOImgis69CQZQlFJhpCt+Z8B+Y
-QJxesMxpvGsV9c5r8SP7UF2juhzsG6cciq8NgF/7zIq7LEbVOgBVSCLCWx+DgaBa
-Fkdnrc8xw89CA6aIwlwptpWn8rOlSiTljiMkogzWwU1QcTcZuMF7/xbDrXaZ+X9C
-JBliKQ8sO/BVEOexJ+WuF9ORyLB9JjbdGdw7LRUhPMI
-> ssh-rsa kFDS0A
-dp8Sgszmxvk2xJ13SOQQ/ArEiTHr20nbyptGBO8esZmSOWW/7CYz7GzMT1VBNXhC
-vWgK5zknuaWWbj5o8zO3LFLPct9NvuPTSTCWYbGOR5r+I5Py+SNWNGXyZ8MycPqM
-5yNQXdhfpgTGT2I/ZbQVk3QrualTKX/usgDsIkFvkwq2/ACGsVRnfZUenZwc5XKm
-SWAzjbN8OEwtFG33fprOjYkrtfJeyMVSfdPkgg8P4Io4n1DXySZUAzR8z9uD4H5p
-HfaXWGF0JfC5LnS+8Q2lUeoB1nfb/BDMybNhfz0U9S2WyLlnjSpMBugi5bzR3Y6n
-bAHYIPnFbjstGGzBq7u0QYI8nPNrCxYdp0bZ6cgtUQfrUei6SMZcudXJXIK+DRk5
-FoHaTHkJBUTQPeN821KCjlYgV01pg86NNBMxJV9L8zJqtYp7nk7CLrG4JiwgN/+4
-MmEsmkifjOmSHuLSkrcrZdum3nlUkiaoWcjBYFwzXN6kxffefkzcoQK+Uio1m+m6
-cY6MDo5c1JzVNGIaeNJycutb7pG1iYzHGiVh5Xg2piU9Q8a+b445bShx8m9lKrHh
-VD2TeiU/P47LLURNsUpA87B2H6kLlQgj8mT9oxNp/a6rhKjaTWrt8tbApNVuttHs
-C4/N6cWeP+JwYLUSdjehTkS/3m6Gs9wPgx9uiBwi/Fk
-> piv-p256 vRzPNw A8BVgFdKagBtB82Fbylx71jPgc8f8hVF1N06/HkIZ4oH
-/gxYFwlY4Gx8HbtKjMf9Ba+gxkLTb2ZGcyKEbnke5Ew
-> piv-p256 zqq/iw Auev9DCuQrWVMFh8ckLgfrN1aOAVrjSsaKl00GNaneg0
-ZdqFFOSTWf1dsEdoponH1j9hXYag2/l6+pJMedYuVvA
-> ssh-ed25519 YFSOsg GuwGTH0D0YimZksECOmqpsB8S8I/my7fDRGlJyO5oGY
-uyX0FBN3hIF3az8OiP5L+DwgG69eDATVHPaNOsX35Ys
-> ssh-ed25519 iHV63A pD7q8qdejDfhxTWCvrfmm2oTmSdg0bNKNwPhhXH/fBE
-fVhPi/U/9MFfj2vORYM3gqEZK3dXawIAappo8eo1U94
-> ssh-ed25519 BVsyTA iwscr5+fZh4ErmdvKJ1ta5ZSEWVHtQEIXTfzYyvTEmo
-7n+41EGr1knWuHScqWF25xZijMIAjvk9iMGZzIr3v8w
-> ssh-ed25519 +3V2lQ HjPClU7+EumicsRX8wUk6r/W0G5eJOJ01rrunUHpBxM
-fOS+2bO9IgRd7pjZ3gWaFeLb/xBYFcJY/anHXaX6wFg
--- 7M/9M7Lz3skL2JNpQZtfMcsL/aKutELcIyQtDu8Kies
-¨_…"šBþ=ò&3_¶^ŸýÜkÕqwÀ"<22>{õ+ú³à<C2B3>AÝµe’«ÿJ‘ŒÌ:ï[×íÄõ’,gý 2:–rÿ|çÂ*vµÎ&ö"^ùksÀÈK–_âFñK
--- a/secrets/grafana-admin-password.age
+++ b/secrets/grafana-admin-password.age
--- a/secrets/grafana-keycloak-client-secret.age
+++ b/secrets/grafana-keycloak-client-secret.age
@ -1,43 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 NID4eA M8vj+GPvFph/o7wGQ3tR8HS4qkbNdlKEE5v5cOVE+x4
-gIpKa/ivPM+9JP0E6kUUOk1XXudNPXy1I8exD+SJPGk
-> ssh-ed25519 uYcDNw evMlmz/v8VFHkiHQn4TKRmCS+KLV59xqrgRXsjzj9wc
-cSN40Oq6RtXaYkgT33oR0J92IczJYJYsKkIeGK2hmIA
+-> ssh-ed25519 Y0ZZaw X+1NaQ7337zR0E6f7AsjP9koEpvVlXVg55kotyqHSgQ
+u2WmIK+g9D86OVI/U3ZcxVvqToG+HguqNyhv5ockPuA
+-> ssh-ed25519 uYcDNw fK9YX8nD3hLhUMENqDRADBHK6nlWEU3pxhvptVKWHUI
+L7xvLbeYVy/xiivumpbEF36nU1JiWLMLpnTjl+6G7i4
 -> ssh-rsa f5THog
-qj0FFtZwAA/vYiFnw+TXK78fPOuhXCLWJSUpMLSmuRCrJK1UVZVPa/mbvWGQODxV
-7ZOI2JlmacnJLZ+OvFLwoAQvicqIOCA4Gi2vWGgWlgaAjF+1k3FOPi2pNugXa2uS
-+ZsHtOZQD3mqREBmfLA0z3CjkuFlTGfHYItghCBh05L49OUyPai2pjtj6VYLKdYp
-swYk9l783bYxMtu+emcyHHw4k+YXv6QMFBJBOY5WsCJYA1Tu99uXj6/Jul3e2O4x
-ho8NK7DvpuOuPYG72pS7RVDXA28n8Kg8Mwl706aT4RTjI+KbXYfohR1EmYKrjxQD
-pzBWR8LZS29UKL18PFJQmwq6E/xrNRzOOsjSRjFvXOJUd/Xs9FM8rzE6IykA1Tkq
-6cQZ3szxKF+iK55axYzPUM2loD5McBZbd5LusXke1FtjJMz+xRhFJfcjJrA1AnRv
-3EoSHY/rK5SnSNUspg3CByUbxRNvhG6DI4XAqHNUyaUT/kGrQslcpd6QiP8zgRa4
-ZXpPxgSVxGgSUirDSkmlQxVog83Qwxm7wrO1VTYcWh5smC41blHGIbDxPbAGghHa
-PclirLGpNVH871tJevHz7ZqtHhRlsBz4TFXu89IP62G9s6h6CBc7AkrdaIy4enoP
-hX91hmnoFWCIcOfHJqySjKFv+DqH6JkBEhvv8y38Wrs
+BV+/u+xR/a9LGR6eKLsmBYhCT+USFrV/OWs3HTMPxUt38egZjMU8dyjTOUSywA11
+T8RLbIo4AB74YeNuBULUSup3868B26Gn3WcjcXdd7ZENC/bFTXsgS40p/0Qs9sj3
+BWWWCJp+Hi/3MfbXiQmpl7iVhVBe0k+gtpktXBTiJktIdKCGGuL9hrFPz9BbvZ+m
+AciTu6uEQ6h5KOrADJWT5AtU0jdqIqr/WWEkoWqnv9AV7Oa0gVw0RVjaay+mzy/1
+ck/syftO6kmeo8Q3NNXPW2cfYWx3DHLyzFsZrdV2tXyqlSvgumBBgXjqHH/vwIHR
+oZs6gaXFjTaebdccXnjZqx05JjJneMNBjqgJT2ZVTSJan8eAyX48AqOE3KvDrNwd
+mkZNM1xw8plm0uidGaxw5wnMdMrwtjx4qx1pKgkYzmKd2D8ro7F1DJ+wuGZcZN3g
+dluzVHNHlghbVJ9zkMumYQ8wb2bETvHsRuPocWc0ObsGArKjkzrdE9aT3mBNSure
+ZkpetWuFqPAH2GCM0bz8WQIEUeSpzNkUBIriAAJwWkx/V62lWCFj+FzQFL8FhSnY
+N+u2wXb2H601ARJDrbVFaFqbOYh/wWP6S9dft2WPxiCOXMlHXV1E/cCILiPYASir
+kReVqb8T8Q+ehVkufXOcAJjx+xAmeKQ6VKSlqT1F3UM
 -> ssh-rsa kFDS0A
-mpXeF3O2oLTU7MAWUUctR3bAPGVIr2Ic/1o1WFhyajP19ppjlIv5lhDdBXSNMrqe
-uoNFfRuqhn7f+mtbj3FkbJN0QogNGMic9YzCfuLD1hIedxAut235majPbHNAjYg7
-a6k0WKtZInIYnMSt++qqLoQw7MIx7Tm7DjM+EG7pJKr6ZT2w4b5sthBAkBDwLSPk
-cwOGZQR5AbyJnZH1QDiXfOhywZMia/quEd7ugGZaLwSV+Iz6DwjMCPYVTP+d1jI3
-pAd3CkWIsCLMvlTvfNbLX7IhAqdg4bOciGJ8d9O/pjfj2/15WpcCBYgvaR/UYKmS
-RhPkWnPiQXVsybgw1+mH7A3wi7YdLvmQRxPZF3pc07Abs5fHMpqE3G6lDk6bq4a2
-UJg7AIqMqxmkIk4s8XIVuUVF6WmydHKIcRUx4fvnqMKyNmvB9ge/jWzy507km6om
-nVitgVmc7BoaiuaJiDB4jNO5gGsbSYm4fH82lSLJy7nhak+BRgg0oombzzh5A96N
-pYbnrZrEHFrlyjpY1MRmUJuubKC7GmljqLCWlxD4YpOg70Ne25Z44Igv+2QhSage
-ipyOwosh0uCgoi2zfOLW6mqFdsWNMDUTtpaWQmH7ICSsKorHM/ySsVw/VY9SxyxO
-J6fkWlCakn27Cd7H39SroN4YdE1JvVA+QO7+7XVha+Q
-> piv-p256 vRzPNw A4W+Q6MpVn1ZoNHkGmIeTFrteV8IMBj0R90x3bSx6z0q
-F9+cMoBsfUeEN6bI9lPz9IKIaUNjLwJd0JOI6OYsXcs
-> piv-p256 zqq/iw Are2msR8ZZRaNu5Ab+BTl+AMaj/jPGra5BRBajmczXC/
-DXufB6ivej3Z4YHAvt4AMGtQcbcM69kNnYed3jnfapw
-> ssh-ed25519 YFSOsg butziA7Ccty3azzh5/LFbClCau2Go2krNjPbm2cGUxc
-x9JyLzPYyhTcvzjmb7w1fcJvcLEEDpSUUv7WCtk2Y9Q
-> ssh-ed25519 iHV63A hSs50Whtn+NxDOq3G5HhRs9vCh/0HS67bkB4akb9gwo
-CX4pQgasUT7Z7DWjxDz5L03/1+kMCUTiU8HrS4lV7uk
-> ssh-ed25519 BVsyTA 4Y2EBmTJc7rlFOgVdZrM9MFzes32FsRNlaMmZ1Zlxks
-BwkgIL+1gMpA55vz32iMLXgr+tK3VEe/7+JnKO7xV5Q
-> ssh-ed25519 +3V2lQ KXNeYb2HqYI/yMSu+0eCs0f9xW4d/t21uB4DcrAAIE4
-VLasUSXqhEU2U4P3IBXhVZ9jE7/OlJ4n3qrfaVH5Gkk
--- ZfxR44elx3WGfKSTK4+mlWuqLLSA4esg7Ml4/84MROQ
-œ“T¾'7Km¢6ûnÏKk*s™§ö!û™æS3è@$)‹ºc?á”…UUØŠc"ÈšõßÔ¢zÖWà)ºRªš<EFBFBD>
+VxreNdSiWmAtlpUvAAfTfiBcn1CLK5i4+TYdjdjSfn0QPs6QSFRQat2Ui6WIdD/w
+TBT/5/QmNwelUTFSGU+VUrCANtZ/Jl0dnWmyMObpFzrhtJG8EqISWI+QlE6JMwF9
+4jYXITmBQDQ/Jv1lOYQE2cTD8JRs8UwpvogOt6uZun9pnyQFP8uiwicearZiARas
+zHNxprPnPE1lAwqb0YRW11qsI6NEFLIY19/eybclQeeWRaC56FFUVkIIWaOPJUKS
+HsomdcMzz04RpO1Iy5R8TojGi1lmIlWNnMaZ8fL29t+pb4bV6JqmCZdGXhJBkeSt
+hMAglxs24/kahRkHoo7mTigx9ZkW6ul9KmGE0WN79s4XHOXgh3dcFXwBNFshklh5
+g27tfKPcRW8MAzowYaqdM55zpSExnu7YSmV46XCpKK0dLmjRBu4L8ttb4ZRJVkpd
+324BDs71E8l9F7h9u9Rg9OrcCBBjJ/fLWEnYa+q2voWNjde5xybg8DhC5ecfhcKy
+fvKaDEICqBGSDSFUd5u958KCx4Ar6WbVGpS1vmDWzeUZnn6QJrwfnBGE1zh8Usz+
+qJysxDf6k9IAVn4eVUpvakayt6MIixOZj83flKr3O9JMD3Hq7OJGuLVHNiiB/+Hl
+TGgdBtNeJ39OxUNI5xH//4ncGYCrBtQFogZTy7AveUA
+-> piv-p256 vRzPNw AlwY6q48DQJPgXgFtbUlxfcv/2dj0hLU79Gi9z1MlI/h
+rK1p/XmoP9HYfYIQwlTwmjCe04lHAxGDN4kMlmeLvYY
+-> piv-p256 zqq/iw AnKdELa32ZKGid6JZP+qqsth1YCETO/4H5kWg5oboEJg
+iNeCsNlz+Rn8J73Y0JdK5gkUsVqugK2pi1waWPMM3/E
+-> ssh-ed25519 YFSOsg arcUnqe7a9uUPpfTQVNj/JRQnlF8bRifI/WVu8hhzjM
+QQ62KL/yKowwO9nQI7XaeULusVkntta2EExkS7VcSeI
+-> ssh-ed25519 iHV63A SeayDA/rZ6vlPWa2TcPk1zD8YLtJMHoZ6jF1RNvWYhQ
+nUIh13KsiHWtU/tDAkBL7UGZC5DRmqjeXOPKT9WmMCA
+-> ssh-ed25519 BVsyTA NnVwcpyrWesyJFQzCvhWl511LWgt/cJR4g4w21GIRGE
+csco6z6z9r4v8CV2mj10Prz5EqwyUin5GFQaUnEK1D0
+-> ssh-ed25519 +3V2lQ IxN+9rih5S6VPbHKNfG1kLpthIw1sNxoFLb/o7YEFU0
+t+wrJWTt5ysWhMQeswb14vkfHPQKWjAvoPEkvEPhV88
+--- EG+fx7HIrd6f2S/q67m0SSq2raTQupOR6PsiYKm7wGk
+"Ut<,瞁u霴顚哫件.?榌憊f絺X娌%0缿^罾a$彟h濄*g扽螴c照噈<EFBFBD>
--- a/secrets/grafana-smtp-password.age
+++ b/secrets/grafana-smtp-password.age
@ -1,43 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 NID4eA 070w2iKFOrbla7LvC4xgbzl26rWta4SQAdfApaD2v0k
-iBz3f5kGyPK18/Hdh6GcuTirbe5CE/GfF5ZdpU36MXk
-> ssh-ed25519 uYcDNw 4keJjA2UPPTPOX3iHcxIYdw0FuYfTZ1j4YF7OQpUp3M
-vSuhNGXSs/kWQGzifULsS+bTddpuy3CcKCE9UmNZBfc
+-> ssh-ed25519 Y0ZZaw YW/GflpScjXOohk7fuyf4La3SAMsqzYPXQYcRfIldw0
+9JIhny8OgLF3/M0S53TLXimIIAiYP8txWE1xB4zZtj4
+-> ssh-ed25519 uYcDNw +p4m8Y9WMfc42acNfy42wxgTvKfv2Oucc3WQUL59RlE
+Z6/heh7+KK2xe412D/udZRlpMmcDFKi0xyghqAg/44
 -> ssh-rsa f5THog
-rcBf1LitYkIzigSq3weM+/GsavQc+ZF6cxLLKDgFdPRMGZlImt/4jKcuCGNTmF/8
-5Cfu+obojl8njdBQsWxJUuvGtbl6tOrWrAu7wlUH8GRcoy0A8umiWPcM7GiPvq0j
-nOQofSPVUD2vYRXikfGyxtlr5sjU7w9QpVWbrTsTatYGtj/A9onrgFOi0huoEHKm
-4nQufpe4VaAOeOmIUEWoJj9vOVovvoj7RqLn9k7nOPuabsHVxw6sePkJYllJjrtc
-Bg+fRduXkfqmu4hPSwJqVCG26VlM9UqiOVr0e73b+s6v20c45zr2rAT/xhhngzJl
-CB+13qf+XK3IjZaDsR6kDJKcR6+z2H37KpXbzqUUGCQ5lx5tP3imn7KuBoY96/Sz
-4fVgvcM39DuoibLh19LoSsGIBFOmbT4OuFqbaoxgRap+RGgh2uPY3CdfyB0chC/R
-t1qZla7Z2nSEqY7oBAd9NK6+EIQ1H1xd0WSokRVmlJdif3zdadyMJahHDbORq5zi
-RG1A8i3FHgr/q/cLcQQ/2bVE2pSuKzhlxydtVNZEDInJNPy0djKF2j4AHTyWQdCn
-200EvktqfLwL26nSKrZCrmTKUJEVmMTKM8SH/ZIpOLou2eIjQtCskqsXGdwfYmGD
-1fIBb2VLJT8G6Nj/ihqv/WJ8Mlpj5CAPWgMeeYHywX0
+BCgZnv4YCvxXau6Wm+mMC03lZVRbWjvoWymKj79/JMK52TLx5BUOS7hGkitgS2mr
+A7CkPxucLuMExdefcRiDYp1jX2rWU24nUy2MxwOm4sohuivsTJd6cuNvx/wDfbmC
+5JOUHiRsW+igclfQTYhYhPRVkWw+L3IBr/lav/vD4Zwp4sA0jnKXw/VRkOa4dHk+
+VeKMmc27K6FXpUNHh6xpi1lpZqgKBrsOQH3AxDHioKtTQOjIcIkniXmtjt+n1pAU
+z/GdtlBpI3JSd4pGHnXveN2zOMJb6A0DvfpXaTRlQmxNO1cxFm7DXLYy8uFCBI+D
+KWKJzHuvzIO2dRAano366SE/5MHv+ADL5mA3qJ2iF7uRiFkIi1yOMiejGWMA79m0
+aarx1K/EqSvGDC75N690vg+ol0MlVDFKHN9UlPMyjg3QQwQGGgtI1mWdxZoo7cjZ
+dVti/OCxTvbKMApWEvLGATSyX2tEL/PhcJFGSPGdKJU9C2WZcKiTy5rxCH/ZSgR0
+Ju20leD9TkCf0oHDFHIWRzxeOzYI8tlpK1vy7a1GQJEyeZn5eHXtTEL4tH3or0+p
+e3qW5djQrSZ0sQdaPt9XzzmdmBBODWomSweK3mLNKdOhdAVBwrV3l8Vm+qcVhuW0
+ZWfl2RYgGsfD7edFXmGTal4O8UIVl7NYjrhT3Qkl8G4
 -> ssh-rsa kFDS0A
-bNxi7xzpuF6XMua//fX+UCJ0eaTR3Z85YuXR6zfhNoh1kkueYjHXlQ1/85X3AuZ6
-6hhPR1z01jbYm9yrUAq3i8yJj9SaBXpuRVSCDL5xi9tByDmwhLFMo2g8CtNK2z+Y
-EOrqMmZ14Q3RG93CT/rDdemPYycNtkTqdNhNq0fIpHM29UgjMjKGrq+6L4dCnMHC
-dBQ7xpxCgni6cdx1H0KVxo43X1oVjcSy3D3XmOQox7Dysom8s8bS+GQGnXnxDBHC
-yYzfvEr2JA8+kb6dufraD6f5zHzwww2P8FRhWj+7GxYMPZ0WCDZjlxF0yxxPkzBG
-71CMRwXJ6SbsStDi8WlIFUdv7gQA+0KbjrKf/VGUPPAzQrqnb3Q5TcHSFKl+Zo9K
-W3dTuFQVMLbASFJTPPu676Ulz1L5Aa9ZFSRr0y+ri8D5ceip0u3rqEc0VFa9NRoA
-EloBano50AqBVi8rba/BLK1vXFBY/YU98nUPBTb/abTR3q2J/RhwKzQwdTk3uCqi
-hTNZ3qK5P9jagfT/rX2oeOBXsWxv5RxZw+tHw2EyBfQ6uOsK4tQQs5/lMhu9xOGV
-sLmHSDCNnBswI6WCvnZdgJPZKTbDeXRTK3RziJLr6Nh3QqYFAe6NZfD/xQ3ARyC7
-1uHoRk2aLEckAy5N/VS42xTPoK7mfDhao5hNONxh6EY
-> piv-p256 vRzPNw At7C/F8fSGgxpMZokvAphi2wDEgJ073XUXOprtxYV4iR
-3a/oxlKWvjRd1uxEJipyQV+/8VM23wVWWNYBm1GVn3k
-> piv-p256 zqq/iw A/ubZ0Jc9mAiZ4q1DHczZyxrRqpMJGLsp7yAqznaogli
-vyJUM2Hg/bUf06Gp1sT1FWYMovqaChsfLtlKStNjK6k
-> ssh-ed25519 YFSOsg tKDlPNLGGxJ5vn2JjLFzY++ZZ+8I3gGmCLZBXEYP7Aw
-0LrDm/4jIbZRL3GHmrKZovrM6mjacJwAAvw+niQCcC0
-> ssh-ed25519 iHV63A zKALwEkOjLDZxbYxCX447LUgDT8XKCN63TSR0bz5Th0
-1QaWaGAQxiUtF5rCSvvVK7wNtObUjBx2b+hJ6srzGVo
-> ssh-ed25519 BVsyTA htddHKuwj0GHraYeaz/G1wgmK1cVXc2rxOVEHJm5qDA
-ezhynFcRE/nWnu4F7DNOKzt+twXD8ruvsBevEZRHEI0
-> ssh-ed25519 +3V2lQ F/VW/8lQRXjo5wCJfpaDfy67nRwKk7s7OuWROvHgQhk
-8oU5fQEeQ8QJxO0tN0LJpAk+GsyjMg7S6wJSE59m4mI
--- AIuo0wtWpfspkSedhiuBzSwn4eCNY4PFmdzAdBVWE3s
-fp§‡Y¼ÙpswŸÀ<EFBFBD>à’"§](g¬mzr”ˆã!0œÜ2½µºJ`“1¢†ö<E280A0>ž
+Av0X9EWC+JOG5/XhJx9JhYe2ew2IE814J6qOv6/5hJehPHRs+x7pkyv7Z1KLbFJZ
+nQBQuZkqLY0fed0LF/7fEnNF41+/5+HEoTY1r/Je8akc9+pUoYgbGzJN0ddbXlOK
+P3antVHR9jx/E9eY8fgkNMASnea7BUc/yqxUljRKF3N7JTxC1S2BhSd9HIdT9XlB
+YhA1H0nRJbfp7SQw+xrCoMzln4a5brE7ycN94EaHnrgwf/AzYUawZ9xghwtS+HOo
+8FLwkjRPoscOEJyhSS1ONO3CKOUHfa+0cRWMA8LHhkwAv68/07zktF2eJa6dX4UN
+hNdxhwA4aSfM2lkCTzzlRpl1AEPlhjq66F6M9qy2B1nmsR3zeL1YhphDlty3r/2e
+Iw6wDKdMZgCbyQODXL/9w61cxpO8fjus3u1AkmR70MNc0QPjlGKs1V9LrYPvRl3O
+Hl0XUxg/7RE75Nqxy8GqO3YkgzLaMINgB9+mIS8XgtM87AAA2xSxWXII8iEbY0B+
+RjfM9MkhId8LQVY+3kH8WFJTBcEVUFmr52mXU/DImbvQCYdS1YRlfYfusXbABGDG
+5aRwcu+bJ42lX+G5ZtWM0wOnCS70zknvW79YabSLAM2wnvqCo+RDJbicfYeRb3Zf
+oyGR4JBZ9sAmOP9NlPTcWLMzEZxXdhGTyl0Ir0QEkm4
+-> piv-p256 vRzPNw AwRvkmNKHx4OKTdVEntbBvtJQ81iF5JtV6CywO3dD3O6
+wghX1uvRlC+4isf2e4H/ydPOLtmb9OsYeE/mePv9zqI
+-> piv-p256 zqq/iw AtEZGBvcuKRfmed4akDqnPlEIKQq5KjR9GHoXTudkl7l
+z2fQAhhisxDnjZszDtDI6VBQFsHHbKUlAZDNHmIFKVQ
+-> ssh-ed25519 YFSOsg ZppVdvUJDX9LJbOGKFBWgCNDQ5MjTuZGnI22uy4ftC4
+THFlybpO+tBCKgG0LZ7ZOMpw16q1sPvhVZ1CVe+MVfI
+-> ssh-ed25519 iHV63A 01XIo9M8Et2DkWSfO5sJzVu7S71EmJcRDht/u5XtRQQ
+iZjE46hyys1RW/ltjCmnXKcWfmoiurPoA3s1Ka0eIU0
+-> ssh-ed25519 BVsyTA B97LazX9/2obX9KM4yhAdbrjkDCMJ/Bxv57NnBAAeD0
+SSSEbPjl+SCl8T8X884aLmqJRgnT8kvI/hXC4NVMTp8
+-> ssh-ed25519 +3V2lQ EYVbEhF1NIpw/f0VmLgBc1tM56B+buSMGe/fY1ty000
+ZW6rEd+rMCgqG+Qc0xgFcThQcmfunIwIj+x/iwkeQ6s
+--- JAH/pCzrYMNHoLFH1FlXxFZVFRCMmrtZOS2lh/pvmMs
+°òòyƒÇî´Ž*!jÞµ)Ë4fô\ñ
•(Úæq³yö’À.ÂGÌÑ»c•ß3
--- a/secrets/keycloak-database-password.age
+++ b/secrets/keycloak-database-password.age
--- a/secrets/mail/admins.age
+++ b/secrets/mail/admins.age
@ -1,44 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 UE5Ceg gD5QRHbcUWSile/Qrcd8JzEd07QTQsgxD4NkyNZYYVI
-l2b1/Vue2S2ymlzCuHyHBDhSr3HQg4UMK12UCjTF6hw
-> ssh-ed25519 uYcDNw os3fheZXnX06seK0rrB0jvVFULf7H+sxrymQHtkM+D4
-+xzkMSJxAh7OJDEvznwCZXPi2tUAD0ejBV7qLM2KlV0
+-> ssh-ed25519 UE5Ceg 6rewUSyj9mZOZp1Oi+DvWxj7u6r7HWUAnp/zSDLmZyA
+OLBPwlUCqlVZqrZaqT/sfzslgcYRViuTt9yzJZRPIPI
+-> ssh-ed25519 uYcDNw JNpKkljIQIPKR/KNG9AF/DxbJjYoMeQdhOjmpig2Q3c
+bxu5hEvJi0ip74WUJNJhm6pAfdvVlFBbyCwQKYPkUXo
 -> ssh-rsa f5THog
-sMUYZP1yspVxsI4zWydUKPyATbc/dHED1slRmQMYBCgiJbpXxrcfyU7JvwEiW2Nf
-KXGU1HxBdstuC78+1jgVnSqRG2FUol+gAZPvqJCO30SznefSWciCvBfC71MKUjx5
-00WRZjQT/oSVAha7o/5nRqfsYy3mEkCvYOAX0X+ajpbIRJlywB29JNf19Smr4XNH
-cYtiOMQlqYvHj+YAHIZPqvZN5Pt75zNRdHqr0b0s6GI9/SuCxwkwU5eeO/QYM94d
-QckXRdg56gZKyJ87QFRFCMXi2KAAwGjLNVhws7wvnh3G03ZCQ2rWGR8YZxtDYyee
-TXPBo1JNDlIrKyGOz3AfXSNq8UwZDodpRy7Vu0LQBQNCOicGYrWl2lQ8Mo5zfNp4
-SbJZCxHztvHqeBWC3EQnQx95dUfUiui/zTp7HkQZ0bLVPS2qrSJCTlceT7JX7cIy
-krgTQ1/qcFqt8VWSUFz5sKXwE2FnvvJ5QPGsRPkBs2GAKpMQXpyLkv173iPksBMb
-NU1slvMlPzfeg3xHuGCJYofVlhhcUMi/RTQKWmhwwzfLBXZfocINZqOKn72TnAb5
-yfJ2t3BEZkaY5rkGrUhnPFIteUczaavu+P76cqp79recEmFwq+hrtOMSsUF/t6eM
-R3uPzN+6gLHvc3IFL2WkKYT50cb1rOAK9FdZ5ilsVFc
+0Im1QWg1IHp5nYfo0OK908ohS+Mo0Jyyyimq3sc6q5WoDUzufaMVYfgVpHJxasO/
+SrVAwE6QLcHuTBZPeyr1HZ7chyQiWT+Lepp/MXhgS8nDOkgJaSNxY35PO6W/qtpE
+rxkgdNZdB2Orqq0wHo0is5+pfZdcD7n6O4VoiayUh6kv5Brk98BUCHrydXMfJv26
+0Kzwg3s+/kDwOeVOt7uy6n5VPhcSLiJgQlK4t0HkPB2rUoD8dfyVqUZV3YmgCoJM
+Km1lCxaS96xKGnvt0HklYy0OX5S7ActBGpQJjcNLTl7sb2M/U0XAF7O8teSKzdq4
+ejKOnzMdxFB+qOSZ3fGzHbjxNDwxPqyps0yhm72rT5tww3wOzYZXUebn7LwNKVwU
+99mA0CR9W3wg3Thv4nwmsrycTMFHh9jvGRXOYgIqXNDoo2oqqkzLnS+N2fx6Wush
+SNziOeZkgb25h0wrehxmqsEOVjlSE6C59E40XlmSj+MJf6siDLQGpLShE4Fz1tyx
+GXASxlTNcJ8TY0N4UmozdWRW8pyTOtl1MhiuaHdYLQGvd3Zlwkr9C7pV6eVBxPyF
+agSqbSZXprY5owp17fUc7HQUu5AcNJyQtDstwqOTPbaJFNfPnyaHU61jt52sk468
+W2d1hZ9SYxiN32rjYV6py2SiuOvHIWMz3ODkvhxQdAM
 -> ssh-rsa kFDS0A
-mNMbBAtl8DqLVje6lOnsZv6C9ytsl/dJBoJj+qfM5mTo5vkhyGPzo4NaaZIPnMVs
-SIckvd8gUhaPC4D98oPANl/GgBHEYSjVVwYS99THMYurW0E/brG+Awy+wYchO8yU
-rN14o4uk+LkAuRhSpDs7ExA91H/BIQFwNbkubY5Hp1dFvEjn99vhTi9ntHcsOLgR
-PE1QlfW2uzBvm+gwJ4zFPWDe3XqIUb+hU0N9hCdtRF6LxR5FaMzWuF2Y06O3qlLf
-oamlPpB4jQAq4LXgm/GuW1csOmc+PPBEEc/V8DnLNqy9PAScd5LS/u0zL/D+NHCs
-i3CRwDce5yCp3S+mrhIwoVZW4doK6fiKvkoYCC7lZYvA++eEUmZ4Xuj6eK9H14Yi
-g3lF3k0NLH7xw5dUGB7faUOAtpVLaGRy4nyVHp9qOWgTvdxMCGjt+GbfSTnDQcvz
-S9+FfDIPVOAh0jMv1J6w1aREPSeEOikC/TDBwB3f7UwKiFSS8aDwqRraUwmqiLaq
-L/lYo2DK5vBf20C5iM6SwowrvDV47ZBUbLO/ulvKDXydG1C9whMJGsBnEo06hASL
-oZK4oRpzJapil350Z94q/mShQUkzxYe6GS5h5eV+jly1mvL++7CJYywsWfe3Z6O5
-Oy31UxjhpRhbW5iqOcvjALbCYEPiNst0zLqeFywZ+GE
-> piv-p256 vRzPNw A+EBgtoEKicMn8YJpH3ZGwV0PVt9l+YW6fTjs3deN70x
-RCx4lJavJo3pZRvj661M91wbZY6XTAMuqex95J6A22g
-> piv-p256 zqq/iw AhMeJNZ/JlBnn7+3scs1hU3NgQBsKDC9L6sK5i1IBPIx
-QDZFPPU/Y5t9WQkP5CfZtPkl9CidOyebsubwbav4PCQ
-> ssh-ed25519 YFSOsg kbmALRNCorj3qcJYyV5X2CGk0PBjOI6ay3INT15dFAA
-pfKCr+INssY1gccTCbFvnaaXLMoXr6DsCqgz4UD0mDE
-> ssh-ed25519 iHV63A 8jd9mJGDe6yCjPGDIOusCzCR95Y7wRla5QjaBE1ESCU
-vmjDhBr+lYTCu765o1FupE0/RbOGaB3X0wEbDyOfh3o
-> ssh-ed25519 BVsyTA e8lbhf+RO8CDMrR6MmBYgyeYJMXNMJ5cO5GsdYosbh4
-RKGw/EqxnQXeLrdPtCh84zZSN6lu0FyFfNSF7Rllbxk
-> ssh-ed25519 +3V2lQ f4is4PhlyDSkRwbMIW6nehwLD6feea0so9AXWECX0ys
-0wUtiufdA5FzCIqZrcUE1XKSNOA7YK/PNAdRMnbXaNk
--- rHG5GfdaRsmhAQyX4M6fDFTwCWKfI4MXTgyFL4py7RY
-|#÷üðÅd/Q‡Ä™‹”gÍGÅÄ…Äû—kýôjF@:}¶‹©
-Ë‡Ä8:0ž"®ó“ì°Žß‹4ÿ¨PŒ›ª¶äJÑ?MxYhb—”Ï•ê˜«#ç'tš
+TRrrVhtSIhhR9OXVAEwfmVn44a/LIaYJZWndqPAcAEhQp1Z3kPpolkxtKskz982G
+wQgSbzU3py4VRpXdy/FBttoEdBrhRMKG0z9N0szKlagfLA+DHQjTlaMn/UkxmO2S
+4AdwO8jEJVe26h6Y/3ne7N+/Ji8QKO6tKeNVapBKHYsJ8qqscgYW1WgKOAfJ3M6c
+6lyavfn2prTkM0xz6hMrywm1Is9ahM4vh39iLRAaVonFHmNJE+dAse8ijvKzjcYM
+KAiZtabdJkWwjD/3x513fU/o9DQCnBTHfM8KLb7DTPC9Ro1K//O7LjcG+WiaERSh
+0+dBZstMD7fQWEyJ/CgnRf54juZs2A7yBdrT9TcQtcgPKYk9QjFqHCmKB0R+TUaX
+nNh4h33i5V/8JfPRQTLz/YYFdG+kG5Hvucs9I2HN1n/vaHL9UIH3zC8BmkUd5fnR
+cnKXPjFCfrPPKg4DMT4gT5lIVtIBRx/IKxvjgR/8c8M9M3jk4SZSYHUlKtnzFOLq
+ycGJopWX7kBWGliEQ8jC+nKYOXpSYH+mbHOV54zplmNOZKMdLJ9ek23WoX5/BD7i
+arp4EtwYiD2LN3M1TG24gFW9VCY3Ofil6HAn5ySM9AMtIHwy/8srUBSCtdpWWGx+
+0fk+wGVu/5lCn51RPXl1L2YRloyx3giKvappuUcpho4
+-> piv-p256 vRzPNw AjkP6Dy1dEQ58LVB01S/1stB6JMpl+q3EuqHQp6RCfH9
+cePnQF/DS9AJx0MJArNi/5b6tncv46lKpu/1SIb5X7Y
+-> piv-p256 zqq/iw A7cNqXWWA3Zd4vccwwW/Wgfq5cCOjnIPq/Et0qpeQUMw
+p/e2OBgHoHA06WR4h3k1GK65u3qYH2YGPYQ10jz+pvQ
+-> ssh-ed25519 YFSOsg +Tl7z0DL81uPhdBuEJG+9qnZ6eoAzyZfvJ5FtrtyRUE
+nfVzlc5NoSxHv+2tM3D444kH9fCjUEYD+7wE2h83qYk
+-> ssh-ed25519 iHV63A FgYN6w2aRUPpBBp6lV8pqSyopRaWwzhkGXxncU83HVc
+PcNQ0P2ZGCnumKWuHVo0wwF3KCz13JadNkAHWgqIfbc
+-> ssh-ed25519 BVsyTA X/VL2A5AlbG1m6uTqbYDJTJj0wVrYGx5w/geJTpgQR4
+zwlsYTehOA3oK92zFN2J+HhgaX1zYd3MP0vQ3W751Co
+-> ssh-ed25519 +3V2lQ Hk8tcLh85helo+DXrRDhCHkDja+sEkM1CTz01s0SXDQ
+ftNhb63/JDulFgTukVu76XG2Dfcorbdt47EV6kqXw9g
+--- 37wAuChTQKbjj/RCIh7ZRB2GOf2kT1we3D4bQKevM3A
+ñ(=ÂžÙ>¤jIM¡ÿú ”ÑyÂA¼|à“áÊ¯Nè<4E>„…‰f‰1Dgí5èËÛÜ	¬áßˆßg<C39F>6ì²#>ßÐ%UjÃX›ŠÈ@ÌÑðG*ªNó™äÀå\çJE
--- a/secrets/mail/bot.age
+++ b/secrets/mail/bot.age
@ -1,43 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 UE5Ceg B2ypwlCArbfQlB9f6wCaNfoyigxlZLYPN+G1A0RzAEY
-phfpR0H12yHwNnAFqBs5Al+E0rykpX0JQsOSi21+9dg
-> ssh-ed25519 uYcDNw 0nP78x89Ug9p2kybjnkl1LdHS1sFHs47Cgx7Y29PvjU
-WDQ0hyddpyWHHUV+xuSees1FAUDE9aq9L9kpt38cuR4
+-> ssh-ed25519 UE5Ceg iKhPkRjtE/7UadHCdLoQR0/fe1LhVF9wSp5DQUw0hV8
+o8BmKJxLYcxml+hq7l57nWQ8xAQFrROcX/BDCpZW7YE
+-> ssh-ed25519 uYcDNw It3n9bvJCC+H+r5VRrtjrga1S1TkhiHUTGL/ltQbk0c
+h/98devoPCP18pYqK7KcXaDspMzQMtvs5YxsoyodDes
 -> ssh-rsa f5THog
-pzLQg7g9WXNhO2uoujkqlOFNTHjWBrWi6DCNlsJslkq+muOl2Jrnh82+781sc2ZB
-EayFfD0GN6w4qQ2/zknW01EKNNOV70qmx2C9jbKLT6XG7lzJGozIJMD78h8w4JAQ
-u0NTO+zSIzsrvdM3AXlcXvN9clvV3pdQ0ogKlxxAKf8dr7p4qy9dD1r5hvideLjd
-liIitoSZDzuVvlfsP9IAHIFavcLB8sHY+dTSQ0dBMZJQIDDCUSgqsCM48Wto+ePC
-YC+HSLUASKW8SAvWH2eyrGXtnFH20fTOrFiF3WkLvm5nd+H8rBiGQVZWzbyRR0cU
-vjZN/Iu+XefwVoMLEKtHA6NYOL0xuPgsbysU8DP45VjI3ULHX/f6qUJQbUfO82IF
-qSoPhVaWrCOMyc6NjSb5NvQ1ETR9lsvENmXXhQLQwVNozUM6fmXJt9Qf6E6u5xJa
-TJgK+gktDW+CWRSm8wJ3b+Cukx7qMkV+NGKyK2iDRZSmyc7bYgpTxjjYpAVz21UQ
-Djbc7uqsNf4EiwEwkxKK5zAMKgbVQqriy6RdBqjcgVXsPDmv+rbuDtZn7jKw4Btk
-3VganG2/CDzR5wxDdentOd6utHMKlZuTkJtwVh+gL+NO7AmbtWTpJAGJ+2tkyTpg
-Zg6gKsAYhH1hgoNuyWd5807L2BGaLZIN0zOyjT4OHQQ
+xVi9l7vg34PJaGhjOzOtPtoRMePzlvdYKjNnzCXLd0g6Y4JXQZMoKCeeWrO++rtY
+7/PDxJ0kJjJAEY7q2BnfV+87nmrGxFFerldDcEO9pP8/sN/u393WQpngb0tMNx6M
+cjhwv0Y9ygAb858G1NzvnALVZGmbUxX1JIsq8QDcoP3kz5JmonIKLM3b4LrO735I
+bfu3T+wTRebOHdC9SOhz6iuhyTnu/RmU9w22AKK/IL19z+11NJB2Xoejkfw0c6ZU
+cW25i3TdwmiJAZ+lCDJQyBXtLctDes1/e6HtOkXoJSKQA5QLfEtPeCMyBmE4y0pR
+z1DPiP0wMd37YR8dMXoYDRfo3EvsDJkNR0SDTZj86kio9e2sXA3OtIx8BLM0y01F
+0Vnh0FwpY9kclflboeY9w3Uq33/TCvy9aZ29XD+X7HGdqqiqxeo5rcAMXO9xAx3h
+2fIwdVyWYTnLt8TDOH9ZKDw8vausEITQM/D73AbVlLRKDnXTd+YTkYBgzU1rJtR0
+4FQK4PL2qkWYKEK7qDTp+Hrhc4vOnxURaLsdexTub/A/TXHhGAKPxpGBOcBbCjc5
+4mHSRQsDTbTNNE7bcDbkBiUcXAdlPgvEhfLmmBw8sho45M+krSeSd7V5CJ1NENhJ
+3SO92RqIuyGR48lmvsuN5js4uLS4ntoyQvnmIQIVSQI
 -> ssh-rsa kFDS0A
-VcGjofFOsYaE94MqcJGW2UZ99Bf5PIcFbYoWuMoyMlaRnOi145IpIemxwBY79UYx
-bnpgnUq0WjNEMhqgTIG1Us2/7C4es/hF3CTNDYItLiKqy1i/EWUCIiSGPIzoLASq
-tNkFcQCCOd6OhydzhlKm4EINmFfY/fvx1XmHJc1npdMfJt82mTU2ftxelOluEbmz
-wPdNxQCflswFNyEDoCT8FIIRw7RJvCu/wEc+6IH5oDupuZCT9LvD4QEPPSjVOjJo
-1w0BKOHBTHIe6/+DjS6oqb+Va6sy5urDA79/FZDSyO/4LtxoiB//K8xd0EUWu/D5
-e8P3aQVpM7efEDFNq00rNKNnwcwQwY+WnYQP4EZQOcj8auYTxI8YDqF4Lwl2Rlc8
-8+2oJyV2gYtybc0TEyoJIRJJKP3JcTLatAdZgXO39QP3ZQO4Z0ifYAWrRkmOkKRX
-8yaZnCSmumKkPZqNbB//YJyRQS4l/e0UoB0CYdU5ljXUeXc23a/0SiptioWCj0Fc
-dDzpFTQTz9M2d38kPnvC1FOlNolivbgeYJQsL8436LPB2R9EsI8x6CBqhoCYQPnH
-4/Be9NmJhNSFKM8gavQBw6tAuO+o3KUGQoAXO/0reXa4JlO6MMN4+wJ1hroBk6Qz
-LFJtI4dTG0eRiIprIw97azIbt5HRe3OZ+x2tf20Wsws
-> piv-p256 vRzPNw AwMtcJbTUbO1P+z0l9mHhJGgsA/FNVatPnEYWvHmWjUS
-e8U3q1ZX4uJhjvn5rnkQmulOccEJI1VK5cvS+tan4qA
-> piv-p256 zqq/iw AsZeadyx4Wyk9OswxgYnfgSbeT9NBaYN4bqAS1jXVKs5
-ahO6BcM6qxHnDYktXnnCuZlZwozprIH/1f6oMF7CrHg
-> ssh-ed25519 YFSOsg vyX/xUJ85G2lXyGWYl1AfDmuFxEp7HyUlltzYvLFgXY
-7GAV7wgvCPEC9RQkEVYn6t8Ou6STZpXAL9q+8Vm2BFM
-> ssh-ed25519 iHV63A 0fCn2yOmCXjfRR193mpXR87r4mwy8QjeNfA2n0F3ERA
-dUdVw7q5GCYS0CTyNczOj67MRcWTQfRUwGtEMsAe7tw
-> ssh-ed25519 BVsyTA fUsiobRR4HsqaYl0hfZfE+++swOV3XkAgSmMsvk5qHU
-txp2qnf62KbrYcV+Yp80WYZRJpj6MhjO0523m9nvbm4
-> ssh-ed25519 +3V2lQ OwLStSeY1+pJBZ9fXqsZdwjPfYMApi8HXgQMIEAgIXs
-X4eezCXShnn54qHgRJM1mo9FBtVK07XVLSHBn32pY9c
--- WX7/Z0eRS9Fkwi6s2jSr76HHmWx5oWfCQDqRJj9ovsA
-˜ýò“èt¿KiÂUl>î€@Rt<>?Æy	M
*’W¬Âböÿ»V}«žµ¤š(¸/Bu0³¬K—pjà+Ý›&žRÄ
Í$öE&µÂT{SEH84+HÇ7’
+EsW7RlBeeV69UwczFANtxqmz2Et2jpUL378UuMydlzRznbp/TJjrzCStMTOBEDyC
+SuADuvcvLf1WsVbf+rxRuFgte0YMiqUNlijN7tsOFg92odk8tHVwXEA71SW8/ZWh
+zFqUJ8pPFXPA6DEYMGmdNLV+tEx3YsUFCrTvhRIBGPCFbuYJj9Ta2xg0KK3uR5/l
+xziM5xxc7NtJGpW3dA/qFyneuY6gPm17PWav2l7gjAge/6FvLFzfev9TuF82iPgc
+RkCNgHZqClWLRO9b0af8FMGWIak6kr/mqao40net2azrFqMxmeQFLIKJSxa6Agz+
+UtlOND1COQwHrogQkHVuanBRRdUZzGk4QdW8MN49JPkvwvVPGS2XZrkE5m4k66Nu
+rfMtlcoSGSA+GIZXTDiDPLpfpYV/XDe4IoPTpLcivRNb8i75GwCT/5vD39Qmlyyc
+GHOX+v5JXh8WYpgvTEPDYE/oeKnsq27QT1wt8q0hKuHcRO4BcdPuiaSMnn0kjvLd
+o473b6cHE96F3cTKhXerLqeMFs1+DsJhrxYCmRikZot6Iz8H5GnqT82Me1by6cYt
+GDcuVLIB0OzWfI9ibZB0ueMM8UfrLeGDq8hSF5M0rDCbFc6ZzQw8PgI97PNaDGg
+FdIMho7IXEQKXMV7ueZ2/PiQEA8vfBWRnxGKFRQLOTY
+-> piv-p256 vRzPNw AjWew9VSba/AQKQ69l/4OhvZUT/bawt7AOSe4/LjanOI
+wHkZs8QQAOE69dq0d/2PAMgsi3xDBqEEvEFB7WKMC1Q
+-> piv-p256 zqq/iw AkKV76ktPNKCS/KidRxBHdRQmtH3BNO2kbBz408ZJ+wu
+S8KdsoVZUgvW7E4mlVFpp7/wxBarAPTEBqsYoBXar+M
+-> ssh-ed25519 YFSOsg SQt87e1+Lza1kqQl+AyqOu47+en8H2AbjCasMjDLfRE
+vBO3eKJPzagd9NdPmVG1SvO3x9rnf4H/8oddfCwpjLY
+-> ssh-ed25519 iHV63A a1iFLv3FlMcfq6p8+dKlFB9cDPC8RFVc9DxtpNIXU3c
+eQW7PJ+eGgp2loZTMUf40D8V3LNAinBSXgxdlHEQq34
+-> ssh-ed25519 BVsyTA KNSZgJezH8bUbpFOWiyBN9kPL6EvG/L7Yh9ZRGUJkzg
+Fb4oMWqk3OfdKFkLd8qq2wGvq9Fz1D4A9HmA5a412r8
+-> ssh-ed25519 +3V2lQ z3vxaJYUXcqI6f6U85Oj0u6cqyarKTLidDHsURqaTh0
+HNC+nhMbrJOUUS5SAcqJDDjwhjvRxOibo7Xx911cyOg
+--- 6hftMRn4kD/f/ixMq2T+VnXZwyfpcV7zxZ7PBAAcsDM
+Êü÷å5lŠk—9Ë¡zÉRÏÓ©õ×¨MáFM.º}ÊD§¨%ŒXŽºlu]7íÞç‹"\¼û<C2BC>êœ(}-¼â.åÐÿÛê25§‹>06ã
h'±^jˆK‹/5<16>Í
--- a/secrets/mail/crew.age
+++ b/secrets/mail/crew.age
@ -1,44 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 UE5Ceg VVagFKN67R8OKJNOthRBDK86mwsNhQfuptHfXmBQ/gE
-+nodn6RvyxNrMSA/aLAzmYTJVO/YSo6GlcBn0VhWJnI
-> ssh-ed25519 uYcDNw bVnHlcPbjGibV73krlHfvl4SWe/FnLI63G5mlAdtzXg
-FuswKHdEbwUeugeuSjjE/nu66qMl6EDT8nUsdihmGzc
+-> ssh-ed25519 UE5Ceg qBHHVskxlk6AOCGIusKKItMQVrJpjpyWXBfcmpx6Bn8
+RDGWdLn/D8h+dKixRk39zrMFuoaqjdbnUX+CiRq+TSA
+-> ssh-ed25519 uYcDNw K4nqUOfxtA3GDpg32ndobWATCQBN2ylzD3wyLlnT2nQ
+hRPPtWcxI/paVmOHT3J5SS7Ov8+gvXDAqtceJFn7o+s
 -> ssh-rsa f5THog
-BO6DdPxmOSg0eY0ML+rTWOQE+TqrFPFZbeETY75xmP7Cp6q2lWr2ZhOvZEhViMOC
-4U6giC7M428mSp9CPlXQnpk4fHA/4wJlDdWuGlzbMLHPm6hhCPcryfp+JuPjbq5i
-SFxOnvUdnpw12nxCCsLXMQktPMhNsK/A9BFlnjLohfzZpcVxKxA/2mr3Je+3srJR
-IWlOLP17HoDP8UGJDQm/pfa3YdarU8ah9j0AMWOWXMrqLsjsnxdBvqf4Ci72tp2O
-Cp83TkUmHkF8gTKCPSuYVP6aAYkzCb4r/5yqizOdF7YVkv6t3YBarvRi7N6X7EHj
-08/0JiN7pHciyIMs3K++yqYg0J74//I1/TqK7JJqJ145STXhaD3RCDNaC8TUt7E3
-WWa2PEg4ZYS0DXsJhis6iP1abYjiadl89nOp2v2oZOR2PFBLMeFdIZz1yYAxh2bN
-VfI8mSbIZFp3A3Z3xqmmrdPWRB7VVl9e5IpwvysEjbLZ9e4V8q0PXwux7kPI08oZ
-0WfbpHgJ4XL21cBYE2UvSieQ3Pd+M1sgO30tLv6BT3P1z+Y4G2KhpRTlJUE9SlzB
-uW0hiFOnvEPIcNoPUVlnPTiWtEHReHnlEaDOYd3ltyBhA5pxK0z9Bm1oY+jWalVZ
-a2F2OnCBtyYjE/FMJgNN70f1tjxsfAimm6kQ3ca4vmI
+n+B7fmdbS+uwPFyHhBCNAAuCsGh6nzA3Q1ttF7vtadi2yw6P940XKB9hXnCe1btz
+NBRvKkVtIzRqc/5xDTqbDJivIYzFu8StofWv4xRBFzpA3P9r1qQV1lHwxOCfrsdd
+296KHvqWVo4rdhkbd9Cye7cxndr2AWs0Gwn1uNvM1WQjTzUWzuKy6UsVztEcsB0J
+4avT6+S+yxpKkMIyLqlbis/VYe/CDpPJGnxeG2GN8POVQpSdyBCEL32qkj07wR17
+9rZFWU5WKfIr0XXJkhq+ewNdJzQKfWDFEhHrZYrg8LxKYsOWhydRBVEHkWVXnLin
+CSD1Cv4VNHnqCycJ1Dv2Lq2n7SHoGMLPyC1UPJudmpY1Z5XIvWOu5uxvv0674mdN
+WxOXgZpitwpgcmMC6K4mBZtqI8yqMP1Gijupoj4hFK7YGqKdn6+Q6ZFsttL97I00
+lU22H1kf/Rxh0ZxMPiT1JcTwAZdOHIuRG6xPhVIx1hNUOmdUpg3YZa8dMKeA3Yjz
+7YL7ZaYkwsIhMh6w+3xWUiYNkWfmGffRq0DfXIzTkKzapQtQJGLOpeot4wPkW51q
+fHoJ2MNvlB3Yo5AveAkIaJpofjFFZgy9XVPGH2XSAFRez3hixXkV2rWiM+GJAAnQ
+z45H8qWfGnRKSjgqEKVPDlfFEiG78Dtzjtl4oW1gfbY
 -> ssh-rsa kFDS0A
-cRu4Fw3m7KA7FGrGkC+D0C92Pw3BPcInBXjSlzuAk+/K1zcCTywRwA9RK7O9GRjw
-wDPNcrsu5pQe186PNij4FRldykFBrPwvhqDgfx2lr0E0jZdxMQ//mi5yoKHr6Sex
-95lvFiQpt2+5GJn6PyMebJf+GBVt3gToeCiwwBoUrCva1pibuNXIxEk0E6MCGQ/O
-yJeCeu9Sae0qxNy95XH06WX4CFOYmbxZSBQKfccVjFFwDmmVdpFP8NnuQCB6I+CK
-Ou1RFenqIfj9k/2D6gbis7CE+lK0Ke6SmszQljMvO7pk/EILe1NNwWPw0lMFlG5B
-gJIxjQQW+7aNP6J6jT7R2HEH6NjQu+Bsi4WO7a5b0oIMIXQdeRr00EJG1AynFgtW
-7tzqj+WSBHsvymQt9JyA/ZwlUTn7SfNHIa2Yx0e1Ze15/GNfINXlJgqPqod3aJM6
-9jrmKofvluIFUwA3EXcMzzXVHLDOi6/tp40rq/CIFcH/A9nV6MPrOzRx7Z/Mn8sp
-kmwLcxf/Ps4pEuateFU0ZvZWfxVb4abBDGkHMh53gKTohCP09yFYNaviXnwIRI2S
-OUl6MQxoOM+17ClkX11R7u+q3UxNN1rGKBjXvmLeCw0RS1nknm8lv9AGs/SgaQWz
-ZYQgSs0t8PmvHdZYJotdC6AykkCo6OhWmLd7nzRq0ko
-> piv-p256 vRzPNw AkURiU3pt8ZyKGLAroxSDAxxabHMWrUzfeze2oc3Cy9T
-l05K5As8wku+X93LG7vTNfHcAK2YeC6nqThSMuV4OSE
-> piv-p256 zqq/iw A7DcyvRjyVa6cjkEsW70dE8lha6BQAJF+NuN/wRD9/YH
-j8gqPHnpo2ZCyWbsssBZUki7WmGwXUJwFoE6rQB/9qE
-> ssh-ed25519 YFSOsg 6jKKEapBICrxIIP02TXy7Fn9v1711gUhlNE0C3KSTEs
-p+sGc/8aqd0kYZtLjeOF6QeJDDenALP8h3Gm2UE2eM8
-> ssh-ed25519 iHV63A FrWXvXyUrX5KHEtRmm6z/upIOO7eq0gruqHkz8uxwSk
-oSe+vJO7xbEb3CiADcnWDk0CSfdsjN44HwZMhwuxpWU
-> ssh-ed25519 BVsyTA QrTESB1FBYj4t35jhGIv5WXqlawYqPxJCoLJUtDMRgc
-Ghn5PWjiDI7SdjlcjpAfmm2NGE6zXcg2WGwAF9jHYYo
-> ssh-ed25519 +3V2lQ fsmAPXFR3An/2V0RZ4mCXiiMmKGiwyeTYlsZvVY1cQE
-snqgajEMGwSxghHUXizm1Q2Ifwtxv1/eMqTgNGmaUNE
--- m3Rt960K96VKVv+7+5F89I3ONU4q0TYT9GKwTbd/PHI
-Ò’
-#ã—…o½ƒþ`S|Â&ˆIÐòúhçEãè	^Ì¦ƒñ:PÙC‡ïmôöÙ˜YP9·¶]n5:íê`¯½€'V]ïŒ@ôñ{ãÈôîë~ôCc‹«i
+bZc7lDzI0kG/lY1reQtVjggoWfLj9/zz+BxmbZfisxsEE18AkYGsk/Ki9ddXFxDW
+5EIbCHheFBvkq7eb5OKcTUf3AFTch2/8dY1hnmR6uPq1Zwgl4ATCpcQPY85+7bPb
+GBl0msNpRHuo6um895rL4omdv+DItmMdp3Lyf+CcFRvaXOpRnFmOqgatZ1bMePx4
+qJajnToar4YIEJBzc53oGWdAHfcmVrvEdOIUNoS3QoyCmusCkMNrSfqmvPfwqsWt
+g+pTrI3NqmTt3+L0EawcRLjRYb/qM/L9/nSFOnYOv3hLzWOhwSQU/gr1ZKMxYnaI
+GxqWzWg2dvkuHlRKVwwf8mNBrZlqQDV/ydOeyjJUKe48jM/PsIj8NVsqRhkgHrkH
+/lvQClYEBhrgHc9Wdxzy4KM3DPyKCQSYxBPnZpFVzuFBKML/cnYU84i7r4Gkb/z4
+Jxwy6jxRzjt+Sou6gTP9dIASaYfMKYnf4ijB3IZLNApkNMBd0qt5qptTCG0LylDX
+eTGGWjKQrC11znI/PWkSJQsKuBDHesL+QmjgJBhPdpl7Tk9ZaI/rJk2KYAjF6J9V
+add0KsLxAZbqlFo1CJO8HHysCRljXob0jYefmnDXO2x8xZvt3eSzVa8JsNLcMv5w
+4/tAdHBfH4mifA5mVdVbeRUDby54TdfIWGAZtyhgvYg
+-> piv-p256 vRzPNw A/0edIuqR6hf5WE2qoSGqX18sbslgSxxgmDOc6wNqfQD
+GT94xHQpPOdNorZOaSi7EPdaqSSVjJNB2qaSYA6qZhY
+-> piv-p256 zqq/iw A5bQxOBbSgsr6+TL8bgNWl287IF8Zvec6k9oAZPgIRt2
+z0ygD5ZRl3WZjfVA3Aku70mKddTZZ/W9rX2XOBJ9cco
+-> ssh-ed25519 YFSOsg R487ufjbfae0x3wSAYH9d4Yz0dW/ze3wXxQI/DCFuWw
+klWo+lmfAMaZVo/gDz07/ht+szuA7YSpvDc0yEe0bgo
+-> ssh-ed25519 iHV63A Ond1kPLFFFIC/lSpv6K1uobvXYFmw+yVwNUTN1HIUVw
+ElzaC1ho8F2X2jRZtmAdY9FUMiCs5XAEcFqEPTy6Ilc
+-> ssh-ed25519 BVsyTA F9U4uSI1sNELggtM7/VwlYOlg+ghBg0xAQLux5Fmvw8
+4PY2p7QneYIuumlciTmEbR/DwBKVMXxsfRoSuSgfmR4
+-> ssh-ed25519 +3V2lQ 6i+WKf5wToBT5vne7ACy51BTAZrzMHCyiQ4D65m5Ol0
+/kt6I4forttfn8SbZ/9K2mvZRh4Cbj+JqmlZ746Pqqw
+--- ufN6THtH8xQ83XVERTJFwO8Ti0AJyflJwZtA8V2mba4
+g[Ä&‡à»¹î|þjG#¡—ßúíJÎ<0F>bÆ¤T<C2A4>c@EˆÝÉë}Œñ><3E>m¥÷÷ÜÅÿc™D*ÙMèÛ,(Ï”Ò6Cê‚¥´ÞÓkÇ’°é=¸â”f
Q‹
--- a/secrets/mail/erpnext.age
+++ b/secrets/mail/erpnext.age
@ -1,43 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 UE5Ceg WmBrIUKZmvKuvQe5//QLMLhw6FEr4+IpAHTd1+10wRw
-ICmqiDEkbDGxoVo5x04MikXD1hxWlwxEcmpOFMt5jcc
-> ssh-ed25519 uYcDNw n8bLEXW/uX6MaxkdnpRjuXVQ/40uuDsbwGpV63vWJ1k
-TOGsv7neJl8aSFqLFV0iPGjVcxTexJwrMHdVFA4JXds
+-> ssh-ed25519 UE5Ceg I6uUuN8666FFZt7t0Z/EyWpTALPQKjGT8BBtjrJL8Ro
+4Cy7GJ3RQqmrDpYocWTx31MV8yg5QKUCEfMjAaBunnU
+-> ssh-ed25519 uYcDNw x+wqWbE6v2rzDZ8oDP8a/80yMBn5LI+aqBsUO7QktHU
+1s7d1LfdY7bhXi6PJMi67RfxPDF8UWcLpS5cQzuiPvg
 -> ssh-rsa f5THog
-m6xyDkEy5SHS00Z08kYbmO/yGXujt7m/QCtQaHbx/Z5pvicipJpBudyiqC/XUY0y
-ACnYda8iKXuzCZ2Ls0xe0RWl1lEtLnb/7A8gsQVvZtlCNBZJe92RrsRARzHD/ah9
-IQ3498bktM7N3LFWq/H5ex1eiIxUhkTyVwYf9iDGkO4ui331ZCPoRLoYEBZLtuhg
-GxjC8ZlyyllcJxYZO1MXCrvKATTG0thgiWO1ozSswYOGUsCohBq29/nPo8iH3ZgQ
-07KQfQ990GjvjyjGDHLz2v8lquP+3d06QYTBUE9K6bJ5iDzEgXXeVnYEoA6nYJBm
-5QqVyrC11FGhzkcOTqTbpPKdsm401xJOajXw9YzjemZd+ba6ao74LEApNst2eYMD
-HVuq8h8TLsMuN1tcQYZy7I1EsXsEhuhEg7iA6PuQyBvDnLh1zdj3KMj6PunvFuCu
-f8df89bJXGNo+m+/qQftKTlgz0Epz9JSTvbXwxjelV7TDyrzRPlmhmSIIp+2JzRM
-VBH5lW4weJWN1XfvFWnX4Dhfn/QeuLnp5I/gjxj8xbO3N0905jVMklBsXS0Ak7Zl
-+3BkILIA9mqP/Z0BpNNzbxhIlGkX+AgV0IKuBQIQEUpwwpXjHoAJGZPNpbk6iOZe
-EI882rrAfjlsFQadhz3qnmj3AvLIjWz4EpRYPTYwz+I
+JQDnaZPrI5bw7OSCOo2d+C/4KsXOa7Dt0140G3/Snv7j/DPxkz+hC+jxLlt/GIY5
+Py6bV/wqeS9HRUlReB9Lr+5Q89yOZhxqQI08zYnpmn6Ipr+ALNWy2jHKTBDHHPJ7
+LSuv46ppPRDnZoy6NEUIlaIQ5EOXAGGVGi6nhS/R5I/fJIF4yk7B7MKur5Mhj731
+Np7pb2yAfAZGxqleYO5I1jTLIGcBIDpmCricg8W057cdXFG9DG3P4Wvi+Q9bvSH8
+cQwhCscUsxwZN4uVUvIAeavo06JqqOio4N3XJAwzY3syPfKhQ0xdAIMiOhl0TYYc
+eVy7llsbtFd7PSu0FTFfWyuqOZNOmDoKghns3H7HCUeFcp0II1+LS0v6QKAJCEIR
+CVtkNbfM8SxFioGaUTwSfxWIy9+usSX8oHYp0SYKYjBCoukq/N01yZIxVVrXgROK
+FjEbyHCyIwnJ/UsrWh3TldwsDSKWbFogO66m9K0d0wJEq26UcVADQi2GLt1YCXgS
+klNjHAdX1oodhr2p0ZURxngYaWuwMgEOjsMtxyA4M+4nbXfF1ds/uj7i7Btn3R6b
+AzlOo+tVKg1iHFGMn5AUTOV7DtltaMxeWM24l3W9v677aozu7BDZQK5VwSSjyywF
+Vq5p0Rsdif1Vywg0+AUxsPyTy4YqTvXRfQviEU/k9Qg
 -> ssh-rsa kFDS0A
-f1Wav1leVW0N8QUsqXzhh5CykomCh3VeYE0CYNQU30QbdjgKEDw9fSoUgYEbj/oH
-4r7mjQuUUjKpYOAqAGcV9KWCf0BTwAn/gXHHUnDjtcIDIJ7AC+0CQGm9LHXgmHnW
-AJXJ77PLNRuA+l+Eyy6mSIY4YB+/swA1as9SePMw5gewsYzVzMp5EhocJGj8fQ2k
-CoWp6ombc6Kmh7sFA46pyERWpFzyi6hZErmONctheZjFQqKCIEeuqTvYSn4Z1IjB
-B638M0n2hhQFv+0uCkAouve5TNR32lmcbpnM9TSVz9FWqU9irePdOkU9LqW4IGc/
-LggVDgC/cx7NjKmr26d3lzcPJLuJQvo2KxJ7ALK5REQYOoA4xSsKZTL+qy3Oqqgm
-1rMNL+N9aLBOrComp+p2BvRH23mRE1bm2IwyRQC+Zys9dnIrWw6r0Q+YXWLHHnNz
-4PVz0Q0FaxcAyR+udiAafSqkg1SvXSbC8s5hfLKV+V7hiU38e7sLkRDoYSJNtvDm
-3uhZyOccvPo5ofklvyEGv4Nk8jZlbMJ5l4Rsiq4USQZ7t/wZbrq04AnnpBwCPqmu
-tRP+0n1V1cBFrt3hZ5cSJS17XVL/38plo87O4I+grjpfDggE9NIUXi7y0yMjixFY
-AM5kDhjUukNpqw9brT/3j0M9gTqIV3aifEpq0SUSSMo
-> piv-p256 vRzPNw AsfnP33A74XRIq1yDvOhL68NPdF5vF6DYwxlwG2bUEmD
-3XAsbW6hVsSqy1ooxhDwakI55b2YqarRJA8PIK8vB7I
-> piv-p256 zqq/iw Asb1OHUQ12tk6+b//UXPCMnCGzJN9ET5YeL/cDdnespf
-RBflfmjCo17KFF+5MEKwhBEkGURfzqCBkZkPTeT9E7I
-> ssh-ed25519 YFSOsg tA+ABhYJajeDtrX21fO47/qUw/mpSDod6DO35rQnBik
-BDPGpr/bWqwG85E+s8tTHPgbd2pasvKrqZQfPO+9bOw
-> ssh-ed25519 iHV63A q3b/7DcjEStfvkOryZIMXUJWVZn1mjco+GcEWlLHDzY
-jIh4VoCoSYLpCGbtsgTyjSoAWqby/EHoMpSt2Mb1iCM
-> ssh-ed25519 BVsyTA TocNmjSOyr5CJenjOw0gWb+DueDIPPQ0AMIUi+dDL14
-lf3oNdStLp+bzbdhEg3uCsWPpPoqz2OdnRSAAc1rEko
-> ssh-ed25519 +3V2lQ GXYgAwXZRGGzH4VfodHfig4BVM3GqGQaiihZh+BhkRk
-8ZTn8ymgs28clohAYO4W55RvL9f8Zip0DX5yWpch7gA
--- 41gdBKYDkcvf0bmpVDejjhb3onORYQyu5ncnnbY5f7o
-Õ’š2;ÒÿTw);q»´Ü'I<>À/>¿5Ã!ˆA0d/½À\*zð4¹`ÇqÆ]ÇzÛÛ}äl‡¦£:)äaÛ´šÆGßÊÿû€Ãd`êåç
_žS–
+IVW5AyRKdS2zzPPZLt0qLS5aqb4+C+tFgHfD0mVtrYadn9ugn11+Wk+HKdDko43z
+0rLdqE9q+Hyg3jCVk7DbnsL7lzfLKt6JQVfdCN2qihHLofPqqGgjC9pp8C48EjP/
+ND/S1nrSTq8A9jF2/oja+ofcQCKGZKGC3u8E3UUdC2rmDrQF1CRZ6bW6kUxbEh7n
+fogXy8BP4WX3/LxJxRwaUSQuYMrnA/SvCbQP50Z235xgr6v2+Hfm4KxmgBpy9YV1
+BCuuS0Rgkkipa4SkDg4BdEyWcbTu4JaXTZPJ/6UKdNS9wEGkIaCIENkGIkl7ViTk
+DDHjbGKMQD7nOv42Y9bQJwwcAEW3gN+g7kgD22GW9cpZEFTcGESX1tkYclZiZOIs
+IC63gYk0o5fEuLsCYoE0Jld0D9Ja7JYbVH/ukzJ99rWgcLLKgkC5pEosPa0kex1y
+L2+YDmSKtqSY3YjTFv8q4DVTBKeoWjNHkNaDl5IInhzbJ3k4zZAvJ5av02ws5aM9
+i7WYk+tARjK/Bsl4pEOq5UwdAlQBuAOWUMhjLjR7BN5tWtA/wrz0LfCctTjpwxSE
+vuIUIeJENpjIv88OAWVqR2SYqyTyLnHO0YpreWfF0nj1GTGY//XdwA/kqekhj8dZ
+U70iXnquIhqzuwkMSC2cq1WL78pmh8kkmDbIgk8y1tw
+-> piv-p256 vRzPNw AiRbeKSGWFJXI93xQ2+yh+CwJKIl6w9XFvaf1QMo8lSN
+XjzQLjfA9e88kyGeBlLWqhYGSkcFhbEp2G0mthdYRyU
+-> piv-p256 zqq/iw Ay5OxlqOR1CuTnrkdN0DbZXU0X3XbwKjj138AO3+GEGh
+UqBjfcB5Xj829ZgvWk5eJk/5kXNE1oXBxOIo46SEqz0
+-> ssh-ed25519 YFSOsg g11+RyINzDuZtkWMDhq03pXFK/sI0rrvu1nRgt2lTi0
+KwhWvcS4dGb6usaNScrRUFtzaAbIHYNziY+E5tq/QBQ
+-> ssh-ed25519 iHV63A 18otcJyCfFTil0bJHQzHbnS1MktjeryOSI1OZXypki4
+vq7Og0UJmDgclm/MRFw77uGOiOatgPRhlTeEH7kjuS8
+-> ssh-ed25519 BVsyTA ISv3vLZ8DHSiiNrRIFPB7YZqcMKkecuG4U7OPAj7hU8
+8ANZ3bmxLZT+i0QCRQ2I/KgcKsdv0YBLX5FoGSw+M6M
+-> ssh-ed25519 +3V2lQ qNtNUsgkHIHXGEIjzjPuF3xKLOfeSCeMrNrIdkpjmxU
+OyS0yUzVdtpG+A+OvKVyX8vl7dUKysIosb5b+1qdH/Q
+--- ptU7IkkyEOB/9kxpGyi6TS/nx4zIrRnvtCqGiZi0NII
+8TxŒ˜úvþàJÄüƒ)&»ÍÕìkü—Çñ´ï•ÄÜ²‚¨‘úM–&.N¸ƒ½`ÏòS¯8|Âµw|Éí®2me/ð,¿…ôÜ@´3}³pÝ.oÅµÐ>Gvzô/‡½
--- a/secrets/mail/hakkonaut.age
+++ b/secrets/mail/hakkonaut.age
--- a/secrets/mail/hensoko.age
+++ b/secrets/mail/hensoko.age
@ -1,44 +1,44 @@
 age-encryption.org/v1
-> ssh-ed25519 UE5Ceg WMTF3HPhmI8Ins4NRnOWJaYVV5qjVhrQVB3u6pmDHSM
-SIlN9oDn1vvdygr+aT3cpM27K8kCa1U962dpDty3Pvc
-> ssh-ed25519 uYcDNw Da6Nl91XoUjVSBevH9GQ9rvD2eivl4OkdkJN73nV3DE
-t1Tf2aAEUA2SrH+PUGZP6zVptVuj6N7MGgJOuSH4giw
+-> ssh-ed25519 UE5Ceg F7J2BMCNuOUcZhcbEyXBbFHkOI4sVA0qXbRmCWYNBAE
+Na/iuNS8cxz0qEiosflBEB9TAF87sQgwBbUl0/fhmZo
+-> ssh-ed25519 uYcDNw Xd8D3eCNMcXrxlYef4kj1N4CD16b5Xs3pfA/J8RJQDk
+UoBSRBj4wS1cxnDV37JjW5kBP2XWWo7seJJsU0y0cEA
 -> ssh-rsa f5THog
-i4ljKLG/zVZPdCoUNMVK9jg3zMEMaP1dvtSyekb4ZWX+0Kfd0NHsi1z2bx52NnYp
-utjcXRvuRqd1dtIKe98FKHGvu4M1VzIOAvX2ALyrBtXCwA/G3nlLXlr5IKd90BR+
-2NwH4Sj9SEW3CbHEy4yeOxel/8NeaWYWbVmLv2q6x7J95ta3bwjO3heoskL/5ce2
-k84IrHiDNoSdx/qMyuz0K8wyOopViea4iodevPwL/IXXDzG7OJeoDPN89z+FJ7Em
-biK03qj0ONvD039mRlgGromum7U/FZE/jcbJcAhn/wRJpcfMYk3QRHBNhcxYvLhw
-KBsbQAMJmVYSbuyNHjQsQBPs+6Ujh1iDsxRtJCcQAMaKNfrHDbEIDugcVroyBGLc
-Z27uT6vyqIp/aDBUZMvUsvWNklVKHttnaZlLdrYgcz7GsbdufZx+rtCXklaei/Zk
-oc3+Ar6X12Z1psZx9U+VobBkvlrMzLnh69+vk41mOm0ZGX9miQSAy0k+dyqRDMZg
-5QjkXPZ/5ilsG+QXWIDl07z8OnHcy3nbH5dK/5NABl1NmVgTEpJlq5Jl/2BszwlA
-5dUi2wuC8p4wFXAB45PqQmogRpY0aI86FwjFYU11NNBgW28D4U3CMq69WLPbbL2R
-j2DSBvRQxuaXlUsihOSGmyipvAmuHCukpODgl57y1Hk
+OxPFa8NRWqy2ShVfYtxqZWfJAmgkYd2xg2E8vNCPoWafo/6hBob7C+4hDiKRZPZa
+EVLw0wgTe/nlMzBLOO3FlgZ0Ceb/uA2n4nu7st6mjwYQpsmVXwZoap88B2b+GYCs
+GG4sgybkZ/BrfFgm94TIcC1lr2lMjA6C4xhC9Mphf2iEQf1wjL4N1msOC4gTAW8Q
+zaH+K+qNEbTXne5Pox9wp6FjApSx33ldqRxOSzcf7RUuL2ew/63fTywW8ZdHcUgm
+usKqBZX9vyhLdsHzZWSXwetybMfKWs1ry5kU3ekf9EmAAkSiukFxFdr7PON3l+VV
+hNFxi7RBKGC2u+ZE2Oh/MdXkKHMIVuJE1yhUJyiirH9/Mj2S6gOpSL7pjXIQdbC
+RoGoE4fHWtp14Yn5X2YQCeGYPS+y87md9qKlVTzf29u95UjVkN4V8xwquOssWp/P
+qlBJscmU3cp+U3W4Gzh1k1IwdBQ7B26rUOFEwa2/DI8VsBd/x4WmLQGiIe0VnOIB
+YCekxeLrl4AAf/XTEc/qNTaXcn3OguMMq6KzyeWMTdKsrcw7/P7j+06SbK+Co57D
+7zt/h2dDeAEz1eo7yGLu/zd2s2iyEBNxnzvSqvRpYAkcNNI7DvNfdotDYWj0kbuW
+rKfPKnXOUvf9tKsjbd1BRI563TpcoL3ebnokhBfu+v4
 -> ssh-rsa kFDS0A
-lOK5MYqTwCrZG1rs6MVY6v5SaY2slePiZ/NXdWi9w2t8Bm301u4xfVcCaVK8qjWG
-5gvttm/kbgp0J4FfX6egQotZADcHrJe8r08Vzu515C8cY8DuDSfiV8gVyalb734A
-5H1zKFhPuxQn309I4xkvDrrHJRihoJdi0klWWUloDZKQMEAL8onfIOAx8TybgInS
-Mlt143AdsihpXByi+ENcDJ5f3O89jxMPmkU+bqT/VaxzMHmc6pDZOtW8iVbXV+y2
-YJ0SaCR0Ens1Qzghg6UWSyZpEYwN8dNgBye10qh+c1HwxlTnhrpsZVK1WYiB3eZd
-5kAxqwkWULRQq80ip4Xl+Pj4rEFcXQAaY2F1I9xH7eHbtf6YeS/0e19BPUmSnqaw
-yyLGYNIDVat4TCL0ArZkJS7YStZHcz9Dy2UA4ZhsN9Ph0bJyJfHUjwjx/QkQERY0
-I1JJOum96dJxI6Rz4fSp7vZIdJyXC0s19Mqoe9+fcrpRMQs7b1pPsOS9HM/VRCFC
-Cvb43fKnelm2Ma5xrtHTh+xR85bzkfv2MK4k02X4tGoQL3Cfre6HlbmAE3JqbX0A
-iFt2FZ+3JMTx1bYjM+kZ4m8tuW0iDBHrnsOXmNQivY6iSNAX4IWRdbmvJrl41XOt
-/QLLz5vH7aOvhJu5SQK9Mo/CseWJ+wfidRKwG/nTzvg
-> piv-p256 vRzPNw AxQJlOp7/sGiMhrx5o1dYnzh/NC4Ju3ULKYXaQN4RmP3
-e3DWL3B4oyRdPHdIWgpZC/ag8kj33G7DZriGm7Ag1Vc
-> piv-p256 zqq/iw AlY9wO734eTOrpqepjPkkjRU4YBaRwk4i2D2c2VE+64Q
-GT21H3jRaU3oa6B/P4v/5yd99DxDlQmk0A6OkXeLIRE
-> ssh-ed25519 YFSOsg 25usxRcYzCFBNBF+GPMlIl6+2l5WEEhsQsZ2OW9QFVE
-pP5xKthh1N6xMQW8IAaH0IYI7o8x55X8vlGcHHBy6vM
-> ssh-ed25519 iHV63A 9UKMa4oDS4TFWQAtbbwke62OH9QYkC6n9aoEdNiNOVI
-AQrV4g2AJarp9VDdNKG99ynxSU0u2jGw4xflcSdHDR0
-> ssh-ed25519 BVsyTA 7ahdvjlCNLLty12q5aFynuixXVGDU8B2ZWoXxeTYXDA
-yKBmqNKibs3B+xovVJIG0g3I2sCRj3xOQ2Y17pkiSUY
-> ssh-ed25519 +3V2lQ 9wG+kwXvabUdkhCr4DKeZNIgQATgEi94gkB1Za1hqEg
-l0S7WeQUFIPjp19NUn4H1y6l5zAmeVL0kRehF1zTEE8
--- Lz1ASOnZ6Gi0askjRf2C90AYiVpWZfbWCu1IOMxkdTI
-N€áÞ7 éåßž‰™[Ž=<3D>9ÔÒVòsß%pO…ðRdôÝÅìF½Oå$[2¥@Pàâqï°wà
-’ì ?!@M£ëi<>,@1®Ö¦æ{DÄ¸@…<2¡Ír…
+k8vywS465lFJyN/RvPMx3OUSl3UG2phrlZ0QY9BL2Gqf79tiSqMrWFCKqeZ8Djg6
+yDNC8F62IwWSQB030iWQMhQfI3FM9BFepmMpVE3zviyg1WRTNgLl9vdpjLP4FuNi
+Il5S3T49RmUgAzsPGMs0UWLhEudm9tJOU3tI3XD32tG7mYVrMcimtog8/1zasFf1
+GE3H3MyBiuawfSu0uMnQ267rxYiGF75bI8Er1nI7zIF55Lw7twHLjN+KOlSed3Vk
+VU7tNeRKfbircTrfxXo0I6SVPuX21SfBP5RWq4KrO/h4chW36OLxza2eiRvy74lY
+/MekrH3PgO0q7y+uqeSbiGAcvL1UXeZFFdItv5pKxMC95vpdsEhoywO8Rj6dd+9q
+iQjmy5RS/HC6uDzbqAl0HQSq1fZXO3UO0fQg5Rv3whpKMBHVMTU/PVimP93oAu4J
+rXnUUpqpKJqecVDYQT4XSuMDK5Iw+S+7RLxBk6hIYsg0jtywqgwD+zF1S8RHi9kK
+BEX5mR3NC/B+LdHAzphYQkHuY6UOk5AcgMO5jYCLtVK4vqlvTJPVbTSgdO86rmdy
+nZXZmi0Uqgz8QEdOgIp0ego8WdqGkZF0aQwMUw11Bi+78Asx5+hy+fUncw0qZndZ
+04ayMacztVL0cEaQ1AeOf85z0MPOugcVYFvih/XkgjE
+-> piv-p256 vRzPNw AyKY9szzF5MMfOBUISqtfu4EVk3GWOQ2WSqwgn8tCE9B
+uoSrnNdzVP1WO3uZflc+Va6cT8y5AfUpm8P3njiSQzo
+-> piv-p256 zqq/iw Atu7Vk8b6dyNLZcLFtnOkAlYxOMN033PV/bv8O77LORR
+jbYx5/YXY6LwoFvOfXHHPhTiMOMLwgbENvFzFmGf6ak
+-> ssh-ed25519 YFSOsg BCuhqDI2VVkG3gk927TjEOLLOQNeURfxVbGodW/Xh2c
+lUEeZrF5FSC/e6XRxWNQq5B7oC70mKit56AIrWMTKCY
+-> ssh-ed25519 iHV63A Job9bw0T6OJpmgeizCOyNGqA9YHrcbml8sj+9kadKVw
+4+pfaDyrgXuj8DKQzMj04nk2KRfobvQ6Z+E7RDOUm24
+-> ssh-ed25519 BVsyTA 2cN+HWBYc7mSbSEziFpyuDfHs7cbVd5Vdfj7NYNJ6Uk
+8+APjCiQmu9hoqffuqdJKk09wtk0Ywa3NqeURnP+n+M
+-> ssh-ed25519 +3V2lQ h+MbnwkJqmQbk2gtkyWvU/8gqJHYIG90lUH3AMENonk
+wXsXHxzIsP9kSsi3mxmr5oujWL0Grj7y5inECZNSuIk
+--- hkrqXuu9Lldhr675cyYUX5peiFT2s5ZMjIrOi7oRIyw
+ê®è( <¾i0þøÃk$bL
+ø+ë©€¯ï¬]–†úß…ÑÇEÄ¢¦wêíÆÈ	»µ¬YÞ†é!0$šiôKÜà0DXæJdBÍÕ¦O.V×S¿‚ºd€Ä8çSƒ©¢
--- a/secrets/mail/teutat3s.age
+++ b/secrets/mail/teutat3s.age
@ -1,44 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 UE5Ceg 5Ycto4bR/WdSMjxm/aaS/5yRjNoZCfYx2qP1OZFtwDg
-BmZST008XM8zx0KvekcyqQmO23FM/kyvEIWUQ0fLTM8
-> ssh-ed25519 uYcDNw TKRWYnIyipaBLL059gM1RzyrDoSwVgn3fTO4/GZX9wY
-a0W67aDBXQXdNtwx3gS32zqfooaIFbaipaKjWzppC2o
+-> ssh-ed25519 UE5Ceg NVteAXOZyA8sjXpRU5/ttHLFvGnzD1k48gWWd70erwM
+u57XR4AZoHLagd1/6aiYyz8jNSEtnEGp9Kc2kOHwq3o
+-> ssh-ed25519 uYcDNw CDCJGqbJfqR+8REsogbO7z2Uy4VDiWlLdd7FVUIHYn8
+OV7rjh5kzbGzwcKYsfgZX4jMP2pudlKEH8biFLvkeZU
 -> ssh-rsa f5THog
-c74ld2aFWL8NIGcnEbtwIlu39Unqx6Nv/txciv7KL7CGXzYR2tbBEEIcDplGvdzw
-pYyTer4DK3NdSyUIwQP3fONPQZx6IHNApr0nNFjPYjCniA0EpNL3D2eWNx6Ned1k
-zH2pVD4bLC7QQFbHT3XEa6a4bREfD9FJnlSDdjJawJSNxPZEYw8dUoHVrbhgVQam
-izv2MXmy05MLfpdErHHXjFHV9+1N3CYXXR6L/bFJBHyjfTjuXe0opPrrfLp2N1Tz
-8+a6s36h7V8soukGSxH8OLHCtEU8OcRuEymgfbF7/4a9fCPYaGx7hZNhevAArmuA
-0qE0C4FUBcuEGSjbLURe04vTzZcv+SZxmy4y0WTwvS+Vc4AHLppGeJbCSXv0UFAx
-flEJdjww2LODE0729I1ChnDJarCrV+gkvC1j5pAyNIEsMKd+yKAESAy2dR45G13H
-VmG0QeEFfALc2c04atcud6VNcmcb0saCy1jEXvGbcWe+3yEhvOMPIswMUZ6dagOH
-03XXOczo3yQwb94gAX4oMlU74BJRwNSDQcmIG26OfIL/nx00QjHZ6MIQzwLEuX7X
-Hsy/b86ogIxvbk70wdiBNngvBMouffXFyArHoyq/w2pl4Y+YtJxSuD4lv+e9iuRH
-ISBDUcfIkWqI44FFV3CTFuBgNY64o9nw3g9ODYATu5Q
+DTPOjmtjwHBIOxCcvDSu2cJBd9GHBD+0t25w6CaU8lQl3v1ZJE8eOpxV9Bs3u07Q
+BTjPeGp2qyXxvlLQ7hrQfJyhO7pN+Ngk01MRppFN2t83XiHi6VdAHTwZfxndNt/e
+elP72j5octVrPVJVjNsZSJH92LyZlD4/PGtr31VdzW0/jvjB8bjXqQDEhlhs7Qz8
+9gVT380VmZv4HvXoSgyCT2I/Rmij3zaRX6JQVkKV4YuNcuqoAHCmcG5SgEtesot1
+h2+zH5lewQVB00Airi/hnYbTanyv41vmvdejT6yxrLyCMUGHjX8zbKzr+kXpmywo
+AMraBh47mknL0XKAvqwsVRWh5JZI75sWI51Vs0o8N4k7J4FXc6TOvB2o2yGj+C+8
+4cHLqC967jec2wmDdC0K645Bdm0BdZmp3f70NYb9ts4O5naooYCIRqSGgl11J9Nx
+vfGDVsg+FtMTbk3UN5kikoYltBnR4wOW5TWYeZ6NaB+VTkB++lcFVTS+TyN1ejhF
+H5N0QRhG5NaEuTaTuDESudgB3Rmi3nkKCcGLWPpPnrqV+ID9zsoC85DFHNjM8eVO
+hzeMQUStpwp/AMfJm94GoO+x+6xXocB4+2Mq1hnv3CkrEdCFQGhH6zSTJCrRDayq
+WD/bqtJ6twBmnh+jUPUBxlmz42bGTROznoXjC3slVxU
 -> ssh-rsa kFDS0A
-bH6+SkWUpgXdz8r4RyGNJKmjBjcx12xNy6bup4cLsFN0gr2HZ/RJ1fTM6zp7pULa
-LUyE1i/XUe1ZN3cfivCOVdEGuMS3P37v+RJYtQILvH0a7EGUBYjAPSKMhQRp7N0F
-tyNPbh7pGM1m0eK2Ws/V14zodGbDvqSwX/SXBxn8iPO2l5opy7A1K9GMGvvRJFiF
-Ioe0Jtf5rYpaXfyfH8YvPda2cK6dxxEs17BG98RkdkGF3lzfseVlX9btyIi+0899
-VwbGUoWi0/Vf0avuRR06J0ksJfq2AN3zswLEgqyeytSpVU6unoiEE6lN8DsENKrb
-T53NxtyQPgfe+VGp7j7LNdUZQSIC96ivQwJb/QmJDmiFu0M1UuEEUbeDhvJiEuhg
-tnfrSicx2avkpj5mJpAHS3y9Cbfn/wY1kiNW3TWtCqR1CydcK+bE5dMCsbQl2qsl
-txp+Z+y0LWSK8lw0PpjmYE5Tn+p/4/Ir1QPhi+fv/9vr+ari5wqwsUEXBY1ugTKf
-4UyDSKZq4V+sDF75/XXrtBOZGyUUiqjK90YWk2Xw72Xr4XlsAU49qq7wvWGvSmTs
-LfvZbrvaH0SHDvlkowe4kAA3KEEjOUSOnaYlWOAbnFbl2KBOvFMvHyVO/5u2C/UT
-HyH0rsle8xYwNdwNeWBbbVvzx/y7yR0svd2IVQN87kA
-> piv-p256 vRzPNw AxzTl2axQ+fxapCcHWpvbqX469UMdcbGXBhINRR8SeOP
-4gfX6vY9c/iyotQCLmlCtrs015qRjxT8uGQr49/Y6Fc
-> piv-p256 zqq/iw A91keTk+gy0p36fc7TN3Lsl/t4Vp/2NPh4uiNekRO/qF
-AUg9OS73eHCWPOvnGfQVkGW76upVxz9+NzzxgQTRBlc
-> ssh-ed25519 YFSOsg 3BhEY7Bm7qpf1dPcEQ//xZcO7g82PUUyvfliyWeKSRA
-NltHRhBWz9F1dzn3wehVba9KUj1d41s8Z2AMP0lTZmQ
-> ssh-ed25519 iHV63A 8Vdid3iee/89Vzh0rs11o+WVf+qeav/Y55hAJH3tm28
-Q+4bZRnTBsuBLZJ/bt0XpfHDglztXua3AoMAVqhO/aA
-> ssh-ed25519 BVsyTA DpMMf/h5/LQzXqtPSPHC28lcROcJQT2D8gHTpn7uGmg
-8mXsjAyqP9DWtOVZVvwZeELeX5Bb7d55XTx3f/UK6PM
-> ssh-ed25519 +3V2lQ BIZayb0lLr8CWbOKxk4zcCOK4TiKxi3V+kfLHf49XTA
-7R7yfrMuvwpF8rO3OsSFFw+O8C82tjQQf3IqoAB+PLM
--- k4NkvG9Dz8dQk44w3zf9prh6xzg37EI37XMnjnlmkP0
-Vó
-þ j6x„‘íBnx-„
|öô’	ýÃJ|ÿK:P6êÑ9¿b¸®&O›èàW²Á(¿	µøbù»D2\ëÿkì¥i“ã$Ü<>îC¦bò!
+ap5x1yM55tQyJZRa5EewQwQlN/8FJXZ2JaZhAxP7TuKE0X5OqLqdh5sfF88vG2FT
+RwDImVDgAbCH/EN5DPRReW9XetmI/zC8vpXiqL5kNPh+pC9P46lVqsA9N4SE3AYk
+4XV7V8Z7MYS14vi0d8DFXNEBtwXAM0s4ZfOfEngkjUvOqRC9qCpSemMjrfNhvovP
+xjlwsh/LlEf7WAM+xPzNnMJEgs9sC3wp0+RdBZhjwSBiUp6lpmCZOcUyxKgwqfPU
+mSiQarTx8FZjurF/QZCAIyRGc5vs2mgQpHGOduWrPgLLwEgaWmOCz4ymdI60RJ0K
+qTD9EVDB8HO34+uPQWPvEJbtNL0KsEKjltGW661MJbQtqTIlChnzCsO79aqdqtGW
+wmOPGJJc3NMocVII/IA4mi2N/Ev5fnKK20Q8vQdsLW0WD3cm4zCPyIg+jiisC2by
+MRafMALkVBwTZYvjntv+l6Dlq6Q9IPfKPPi43UHWCv89yDrh19WxuM1e9lwYkWVl
+GUB9ncT89ETHm7IHzl4wtiogrTJbzFr9A/oBQqdIBvUYHP2HwPdDiPV9NCFHnWke
+4BzU8QUetQWDCvYreIxZobuJ2ig4SkBNsqrfb9ZQGS1lRqmkUk4J/38s8xAJpBR0
+KwzkEhJt5Dc92Q9RLlIW+QujLUEh9KjQPua/qb/1TYs
+-> piv-p256 vRzPNw AiWs1Nt6wGKVg0MqB7tHu8E6Wscj2Eo1xhxhB+/BZL2b
+pRjLl1Ds2dhLXVf4Im3Xzr3lG8vq+VJ1/EaPSAD5oiQ
+-> piv-p256 zqq/iw A64X3dQLMlgBuY3E+NRYn1TSs+CYq9JNDTgyMk3bTK79
+/tjhPEv0KwN5dH93zRvMFzBZRayjXQaQZjSHeW2etHE
+-> ssh-ed25519 YFSOsg a9MTVbDi1sA36SeVRnR51T4G2X6Wx1lx6VBI1bNsjFY
+UDUkvNwDXiuWc8XsVeFAW+WATZpKlJsKc+6i6ot7Pvk
+-> ssh-ed25519 iHV63A YwhQZF/lcI1OosRxfJ66wTcTctwcRa0/zY66U52G9VI
+HMHAI6FmX1DDq5z41/VomhCvRkJ9fIrxPEcO+aUIVp0
+-> ssh-ed25519 BVsyTA JKIbjoFUd8CNYCjYjxwaLersAaDp4yi/eN/KvTOhXkk
+1u9t02DQFgL6iN6e8HylV/tc7KpDlv/6hkulcNisrWk
+-> ssh-ed25519 +3V2lQ JJJAo2PVKGLTAFMPBGOSNfYEGEjkCPlRtxqBjFR9yDk
+PWm5uatk8fzhr4gK5XRgtdvTlzYRBUIEBfH6+CROyks
+--- FZl+1vvJBe49ofX4ncsNpdtzFmG0upDcJ3j0KUmXxbI
+ )À+K¢\5Óö4$*Í8ÄïÖ®£»ŒÙ‰ªxWõBÁà<C381>DÜ@æôIŒr¬HÖF}æ:ôÞeL	¤ÍáûýÌ•´¾qÓ½YûNCºùçíùŒ3uN–Z<E28093>Gža3Òû|
--- a/secrets/mastodon-extra-env-secrets.age
+++ b/secrets/mastodon-extra-env-secrets.age
--- a/secrets/mastodon-otp-secret.age
+++ b/secrets/mastodon-otp-secret.age
@ -1,45 +1,46 @@
 age-encryption.org/v1
-> ssh-ed25519 iDKjwg KInpfLUhAWIHoCUGACUgWwdHi0W2H+8MVtaU/QfOjxo
-6snIWaEWHq6aylghdaiGH7NETgVqH17fq3cEMIgMV2Q
-> ssh-ed25519 uYcDNw xGIknP5CTrf3TDFQP2j8OXlDcRS5chAkppgmizHP3mU
-/jUJLtfpsxysuwvwkWR9KAOrcvQRC0YX6kkY/zwt5tM
+-> ssh-ed25519 iDKjwg iwPq9gFJSw6u3BE2oJUAnyEzqIBex5cOg6kmILtXE2Y
+w9cqOdAkPCO0ev+EBCpb93gbptvlK8c7hxwUuUJnZv0
+-> ssh-ed25519 uYcDNw GBHPUyUmcy6e661yMijb71BPuTW3UvUk5qJT0OU5FCc
+OuWrIdz2SJENG0knN160/64RHEoBguwAK74d2dBb7/Y
 -> ssh-rsa f5THog
-QIaZt977+1TAuLqUSSCH1fBGnQ/gIxbxYYxv6AvIZo7mOPljIFVXev40bTSp6kXv
-mhNBcwhDsrBlYjKgvuXjaE16eFQIOI43+JTqmFdsM0XTDjO24hX06xnpGFIasarp
-qIJHZZE8ZLIV2c5SoLtO9jkNTRUZ/HLtN7Oa37nKOvWwQ9GvOTAqnFNBoXwraq+S
-5bPY/zk2kiCpkgs4gEaA+FMhv0TEMiN0VpS7jxkHFwLibEuQj5B0HqXtvSz522PG
-lrOSNk/l+qv5OAPrIgZzY7eenf1FJf/GoC8TUJYihBFsxhS7Uah0Kwv92AP+GVSB
-lYi6uP2TMH8VijHvWuMV1nNxooCioXuIokQL/bTYan6YhmNNkiefM4vYSRyg08eA
-QL14h956ULQRONPYSmtMt+YC9Lrj+xNe8TRqJ60MxjkpTD6CLRiO6FCaL3hGl/qP
-W2EEC2IrhBWxSaNOSjJEwLyN6VPoW83TU7S+8QchIhSLaDbkDkychsuXyQ30FXsQ
-0HpQbz8HfAh649TxmFijJaZUofgtbhOHsbma9AnE6dd/yEWVvBfzeG8zp7tj3p8r
-r0WyG3xfC8Vix+l8u32xTqNdxv//xTjkNTunzb/EifqVokzSL8TsfnCYtVRUjfEZ
-wZAg+jn8u+wnfEU33dL6at3yuhgLqS+q6vZLFUt4mvs
+ijc3QOsxqytpl7hKMzuzuFLHEFPf7TB68OWRwv2c2UyHRblKA5ejXTL8DfRUsPwp
+vLt306TB/XFYlWonORrW0lfKPwnhqXwLWyVX0KqeWobYBkta1YNothy5CLrvhcoG
+WRHJxA3Xb93X4WDtiXMcE6gLQvK4WTHWXAxRr7xz7eywXRcxc6x4GXsvojFG1uhC
+lX3yQvww51QRFGJfrU5LBTkjuh/V0hoFmJoH/2EOBb/5+j/Q9jKu43VNNQ4vpFa2
+lNw6jtYf1610T19Reu4VNeddE7Q3uJcW4K5L/dfIBA8jfDHSnEA7A6a1VaT9zMNp
+mfmhvLvpnJEEDpMU9/ekbdmFUYadryPPjTEyKTv40/yhHf8ynDk7ou4MBkCvBEBn
+KBwCOaYwHW55YuynzM3x9e606RN3XXOxcO056Ur3feeAWhjavXeMIsPuUtXWZD1V
+6uBi3WPrmV/uAZKGgdBYZEEJgnAZZ9HiusBeEz74tSBJG4iBdty3bl/Ji9OwPwc1
+obXdpagjFthphy/W10S5HgAm2DOipLv/NblU4x2vbPSDKEcZxizEUFZA7j6VX+x2
+a7hf+3b2E/TL9Ak6qQ+hgMXcKcNTBU4nIip3XjPTaSkeEtDLSoPrzt3b64cA8y+v
+ZOs/j3d4/lZp54WsOzbRcwAnJwhvcAa1BIISUaNfjzY
 -> ssh-rsa kFDS0A
-RtaoOXXVmr4wIZ5670NjdwEGssMtPDHx0zFOZah1vvQhJRZ4OukS7XtUeuAw7eXr
-z14nwwwQ9AsDHytqihR8hfPVm2FNWF/afUgHEir5zjPNwY7dj6qbmZjSdKfj4cq2
-7gn8FlMS84FTbP/7UlVdL9UijErLk7iJUEZ0UoA8nbXj7Rr6ecNFByqyGNrKU9Lu
-8UPly5upqnOyutb/KmhfyPkMPKMBDNY74eiAEbHWPLW+sm03pVLcdu2ADa/CmlKS
-j7GAdZHCU1okDMBPsTwQn2t5SGw9Ml/ijRiB0qcAd3B71f1VaKX49SAncaj2dYJg
-64wrmQiUpHBCxULLqG2UawFMQOg8YYS42qozGllcY05I0XniKWDDpjiK2UecEFwQ
-Y0DfZ01+oXbggaIyzVhFarfcQOk5tlLjlcHwLNkRw8c+zlnLZCmx0wYO8RwAnAKr
-HrCBaq/a9XBRlVNnzkabpZPhAsyNNXdhmCIi3Qf/ZbluISEG7RWSvCM+kAFwNjGG
-LbceGv8JXp2BnzlY0JNJfMOXFzsgtmYioav73mbT55xmkhgbWh6IlnBJSWZ9BU6/
-SAgBoM3AF9/00Vow3w70z02x8v/MwTf9pqOLLv9m2VbdJJK0fO62JkkOu9Z12gj6
-szBxucOaZJ0XJ+V+LK4HjnI1jm5/CBiy86pICcVbouo
-> piv-p256 vRzPNw AlabLb5NpYhL9A/xCyGIjks43CPOteyn+CZif5IhTN4c
-TEeM2PxvcDGPrNa+1T5aRupYhXe1LnUDtDX3f+3ugUQ
-> piv-p256 zqq/iw A3LNGN5NJxQe4goGItBcSrmuJQkceBzkHZk23BGC/qJc
-i9etwgttMkRtOFjS9L3tGkOA4nkRkgYRXQkpBbFU66M
-> ssh-ed25519 YFSOsg nTj7tnPgFuNmhPusz7un4MpYUFvKOsmww5GCyTl3CnQ
-hWMIXaScPoQ7lj7VQrXL+TMXif78QvLG+mqefWBPaHw
-> ssh-ed25519 iHV63A BjfAnEQq1Xs45iq2R30HGW+RFVKA+tUcGZtJ/1/gCCI
-OKR22LagZv0iYXFqi+yeD2KqxmlNVoUbszzeNUWnclg
-> ssh-ed25519 BVsyTA 3EhvoVhg2IhrIzc/r+SMu2nVdGFZ7goDCTMtAd53jCg
-JVG9Ems5AVcjthivYL9XC07UC6PY73reK1VHLXZ/8o4
-> ssh-ed25519 +3V2lQ 4P3w6HUJbfHHaOIhHtt/VjbtdrkW5tOloSV9T9yTgzw
-Rnenelfn2j8iKbOpptyQZnWEJrcmYwBkW3s5hSKvg/M
--- dTg5lbpg/TeQ10DJt8qkzbg4+bGD7j3893qj8UY9ZU0
-±‘£<EFBFBD>åè»
-¹i„'O:€àDæ¦3ˆˆã°´4MMk8¼~®½«õà,¶qÇÓ”tâ±÷ZáÑ<8xí!ZBò¡ˆÖÄ)wE#ÎžZ§‰"><3E>
-…qû±X‚ä)|œôà”‘ÒÄ§$²½Äªç).øà,kiwÐª.Ý×&<26>ª§{÷ $.Ãš*yÉÒn\>zÇ™<F;¤öf"³ƒ>J
+ZniAWvvGtlBWaehRZEXnMQPOTulBKNZDMflIkCvAqnGZi0kT3mNdSbG2WbfkUXAP
+qnrfpAgSecSNeKqceVzyUnJKtMXTbInLd1dExxUs8PV1P7NbSRKYF5YxgwOMfF8D
+hPIpW1HWjLP572JhjU/h5pKBak38YpvRWPcWG8LxA4z8TT24Ynq6/C62zcB4dE1i
+khJHXsZxMCW4AQUL9uRnhR5rbNBc6tKNalXEGPoEAnOrZXIDze6TwTT3E1kI3v5k
+Hwos2Eeeh5Qo5re/ohN5eFjLf4gEYjVZobWG0alEvz5YCnvkrJo9ACx7qQU8Dj2p
+anKKBc6s2xmUUUK/NyTq1SnBPDsJVbOzko1LW19P/9bZOhdOXF1XIk2F+5yc6/NI
+NPaAtbwATt55WhKxCmD1z9abPuOLmkbuS6f6CKxVthrNlzVaaNlTplQLeZf2tRIU
+vuVYk3woZ6aCCuKKMJ8iR2ebrurGQ4q4mXbhuO0gsSY/WO+tG+kJwHpEMjTru1LM
+RImZjfMaMjMkH0kHvgokkpUdwYc27TB8obg5SpKg6g03aqp3EmdaKytfX4u8CBkS
+hnRQf98l/ZssaBKQlK5T3J+eJkcHd52I8aaJQFAbyHE+0MKW4cvk6tCo7GycXsgy
+RteAYUh/unHoNI2mBpevQ4RDxhpH7vQHFgw5R3HaJXw
+-> piv-p256 vRzPNw AsNNfhHudMZScOgI9TbPW61JONHEivXPmLrWw/mWDAmc
+wWXKnr/X5++vtxJhI+pEJlk1b36cn05FT5uH3mxw4m8
+-> piv-p256 zqq/iw AwQKjZO2L7Id0dcdSo0rSXJzCOopB8WYGVpmquQJrj4P
+IRsQYsnvrfBoxjK3m2xHZLqR/VvHJzUqYutWLaPZ7bA
+-> ssh-ed25519 YFSOsg g0f5mSH59a90MZ5RHAoK89G/wWI7Sp1iX8TxvHATvhA
+IOsqT0Wi6v67RGbF+Xr5Yw39O2LLXvpYrzW8ATEgT2s
+-> ssh-ed25519 iHV63A fRocyEreGGIWHBIpP+Jz5AkdGHXNrWdZaXQsrbp8ew4
+Vgn08dmRU8oBSvO89YRKEi6oiy18enJycR08DE6718E
+-> ssh-ed25519 BVsyTA cEB52lMhlv9jryjolTngqeIAo6U1lvMLiJspuuXmxT8
+J3AsfPZgihmA61JHCHMc85lbpyTWiLiKfB+0Ny2iAsU
+-> ssh-ed25519 +3V2lQ uhEQUeZ20xAROd76KoWNShcvvFabMPjgBaCR2Ulwfmg
+bnevXbQ28ZRvAn4WZC5jBAfS3/gQ8g6488sfqKGGKlo
+--- xYEZ1crWWPYSRpxAW6b0OwtCIsAAd5NHAS/KMnAwx8E
+Eêš¨<EFBFBD>îg§t2”þ¸<C3BE>MŒ—~w„ÔûoõHPèˆ‡«O’Õ• q‡ç<E280A1>o•‹Ñ@—CH3I¾¦¿¥‚(â¼vY¦èê6~‰r²ulÝH6ýáL
'Ò›MØT<1D>ª»ÿÆÂÎ«9
+‘<}o
+Éâ&1¾Y2¼ùþ`×"ÑÖ©éó·{Lˆv¼¹Ùõ]ÂÁ
+	û"‰¡>¶ÕjËØèÂ,5¢üÝêÂ
--- a/secrets/mastodon-secret-key-base.age
+++ b/secrets/mastodon-secret-key-base.age
@ -1,43 +1,44 @@
 age-encryption.org/v1
-> ssh-ed25519 iDKjwg daG+pfjWme7/fIsMVx2XGijVIAdq305fB75MbME4IEA
-rOh6NjkaunFlJO68u7XD1v2ClGUBhPjxrObl/dR0hGk
-> ssh-ed25519 uYcDNw z/SI3gzQKZD5DRLgc2WRHkVmccNY3R7nF2p0gVvvd3I
-iYN7ExPXLuy8AoAqmRFtjiRosW3mG1ZVJk9kfsQBo8U
+-> ssh-ed25519 iDKjwg CfOLENpbakwerogJQIwYEs/6YnFUMR5UmBCbQrVO/Eo
+iWSXJXh3hwuTOLgi8mpImyZYTQgMcKvxmHFEgYWQw8Q
+-> ssh-ed25519 uYcDNw /mKtn+EYiKJY7p47N2XTpCbA6IJzg1kED+x9X1+q4SE
+xUmvilus2Aysa5ia5js6cXtEsuEdfgCH7uRjY7CSpXk
 -> ssh-rsa f5THog
-xW7zSSoL31tQbQMujEpTc8C5GkJj9O/x/cL6dSxsCC+J2hPKAaXsMgske4Akia4E
-3YmzW6kQSuOGAzWth7Xkms7n/PJTXRNzWEDCf7AYqWaaHHEMGb05DdC6ucwCY90c
-Wr0mAAfBSIWB30hgNfiel+TYjo10P15xcAQdtQ2n073VmNdH07Je+d+/8QgGwyDK
-esXM4g1chWpEtGhGrf87EX1/S5JT2CcPO4UL7TVXh1fxAwM5VZtSnhs65zZJRhPo
-HWV8Dl8f2w7k9WkcoTsS9meAohU1ZWcwmSMfRq9PF+7XmZoEmXMe0Vht+ksdNDMl
-TVYC2A8MRWl10K1rvElAdURISbF9MHid0qGrUycQq8Z2zhZIWxr8DItyDamXXbSv
-bElftfy6ZxHFhsOTFTCEVyPR4MMHXvUt+VBoWUirEVm5eglY4EhRbqm6QLakpTW7
-L9qSI2fYDxUfChr+tW4LtvrBDZRIZeGsJ8hI3WRpnqWcFulYi+0enqVm4SJXcniU
-kF0J5u+Bv0rmhggcYpy2cMXn3Sekc6OjvM2ge2uKfwZ6C/CzbAJs+BqHhE4maGTa
-vQusabgLvBN0MQJBjheIyETxCpRdf2j/rTy8H9S4B1hGbdvEVmv8O1uzEXWLKJYa
-u6jKbmUabCvQvn+mAOc3epkRonRpMUQ8VaVqdfqjjWQ
+vRRRh5DAva2f8oC6skWTQmHmZ2fZNzAF+GAtiZs2kFC1+G4iLo3ZfrJJ8LxRbe+4
+f0JIaVzw9jUlqHcT6IdEBq4AU8ximuyTzkU4bCKtGasEfoCSuj2aFf2gNbA4+4i5
+Ynj13CoP7CZpB/hUajJYB5qSVWrFIg4keR8ZcbbEiTWApe+yBkNFbaJitL3N/y5c
+wCWVjcs6fxBT0pPNwlys2eiT9u+LbVdKc+xPYrS8pY2yC4lIfQHox2EguKEoAykV
+kzDZVYJ1aeMgqr3wu0fLwhBZz6fVR6Lq7qrEaBccwfefA8C5mK13QVY8M2WBf+C4
+j0hUBrJ4cgiNOgaqlgetE5WGgChtgWMH0Wi0LNdhVM75MLodr+U/cl8xLwdshlwm
+sglkCoYgQneh13a6XxKlyGWSRccmybXUu0zPqnShAVhSZO4YVUK3DIt3P82TPuDh
+IDApn7MQftbrfnoAVeo+D+m+Qsgb/FPuGcMAg1LVxXQPM0KU8je3gixWZ2IKI2gn
+fD8PM2o8/PdhR16oOSnr4kLHSabyaBvD/JVdEsHRiXqEJ1DY4pQMZieFZ5k90YTd
+reT1wG0h9hv3zGGKKhNFdy3uLyzJiRWTlkt3ydut0kflssq/j4j7BccsyKx2p+HO
+UXv+6WRkepDfFwZmwkw1JCDRYwFHHzchlxi45zTL8HU
 -> ssh-rsa kFDS0A
-in62rDIm3ga9ntI5A7yeVflE9USLuVxJ47agcKoxDCfPaKyzLdIzLWlKj04E++QB
-iitG9o5qJ7ZOBUYtQYERPR0+3hramxuKR63Z7PPgFaBcSwx/WAY9HxjsA9dHxxtF
-CLud9KW0a3AmmkH7HfAmmS9iWUhHUf1/rosnUPvrPLY3hWYDREkUZv4MGUAYE0Gx
-biZ+7tT7YFzWF31E8i9+4TxO5edlpTgyqIqU2BdXRntrso6iH2WlSjLBpPhJ4OoJ
-cKmHI3KLf0BEEjvgGOtRibSRFL3X8BDyVmNdWlb4idkcbOzGLbpxr8pcCHQ4JetY
-ovwUWdhi6So/krKFGTD1Bx7SzwZrB3+m68viAN9PE8uoTApQiul5EHHAibC3DdWx
-348UpdPN7BVleQ+pR9jmlit/myGqxl9bEbHCm1adEw36ldWSdfIKJs0J1qs8jfLc
-8Syo5DqXvCUBUl3CR8cLe+sal2cZ/4NYcXNbkOhSW/heNdzGN7vQazywJi/Xt2ol
-8hF6N0LI+iVk6FlPthLBGB1lRU4YeyhN10v6e+h4tGhz7gcRf4Ea/ZGeWBp7mGtk
-ogNeWz1ejhzvksnQdrzllTrXfBcaXvD1qD1/VipLzv9/a78LAfQwQPqH8qqFGVgl
-EGzDWYrb6BQ1VfYY4aVy00WywScnwNnEm/rYrNqWUS0
-> piv-p256 vRzPNw AucA2fZnnEcsWtppo2zNYuoKiG7s8zgP157k7lqhNVSH
-DKm1jIK3Xcb+sQgl2kaSkUTVsuGPdhl3zlZQjnD6d8s
-> piv-p256 zqq/iw A+OHMqkmTsJpcXDNxtNlUI1Ko/mWLrKbtMNp4amqQTXf
-IccFOIqY3rv1fWh7dDmu608nWXoSUBLNORRX7ZTo0CI
-> ssh-ed25519 YFSOsg lXvuBojVXSG4+hzefRoCxO8Dg0PJN7MO3myoUNiaUU8
-B+B8m1z5Dn59vhDkXDTuZ9wmeSs/W9zzLtcoCHNnwHA
-> ssh-ed25519 iHV63A iYPlqA/m4Eh59Tw43N5mijxLm/FXJWGG7+GvyGknkDw
-VZ1JcuyXLXpM9BL3jutXmgFbkUgokfR/twcmXXDgmtg
-> ssh-ed25519 BVsyTA L3B7twUnx/UML4pMoIi3xf9bHy9Xyh0qMcmvZ20GXUc
-Nci7s4Ox3oqhJkHQRi9KSgm1n5L4HyaV/2XsXRy1sxA
-> ssh-ed25519 +3V2lQ I01GIP2vCvgwjVEwRD0rRbmWNUubw9MvhNp1fMKuuEw
-SONGPhMHTLb4kHO+qRBngvIheGBnODyQSLfHA/njczA
--- Bt3Ju25hzpaVmoo0s1+SmSNVMtww4Uf68QsTFSnUXnw
-‹¥UhŽßÍþá–<C3A1>‚5+¢q«,©ÛÜbÎ%…ëƒ<C3AB>’VÕ–$™‘6†—ß¿7>feñ¹é—*˜Æ‰-?‹@ÈÙL£Àû‚;ÁÎm±xâ…0ˆ‹ƒ8›5þ²¦KÖôDŸU4Gå–êËýL³@@Ð³v50˜àSe¢ËŠ[âb‰3ÏîD5šÏ¦kß<>¸'=WW-qáÐ¿Å?|*áÉ{
+Pw5Ty87uw4NCIA5FC4AduSbodKmJdR0v1Yl/dpjjl5KP06+27VOddJ9ZxWwtVM0C
+LcbAHMkWx+E9e6Ff1YAW28iLR71ncY9BjHnqLbc9oOBWfEVZEi0ob5OO8om7gPqz
+Y3ZielN7UY0tvwg3xsjqWCnD7eef696M7gr3NJ1HnTEDIjn3M4bV9ZQxMPcBPew6
+fwV/J+uk6KO0PgswFG7AgWSfcj7Ka3l1iZ8GF9LUZyY6/kqAndAn09XWrKXtwXwi
+CqO2zoI6prW/N80ePqIsJ7WAG9LR4nJduT+pX1fjS9v8WhLjE3eEon3v2A8hiKGO
+URBh9nQBBdxCXKZ+qGBfyB1CtiN6pqapHsdG+a0aYhIWxQ/l2+1a23qWMZ+MLtzO
+tvSTV6Gv1muINDHcJzLtD9nyfEq+11XcZk1LlHm/HRGTvCTLiRHJxRnDHZEIX5Pw
+3Mrw+n+tvv3jVjAJ9RuT5jm0zcFk719QZT7Ic23Q8iu3YDgkKKQbchzP0oeJDjrn
+zNfSO+K1GXEOoNgHSJv8IOcL/7AnSO/jg1em8nulxlFSj4nXsYtKpjLZFKPBq8SN
+h4GttIloJvIDmn4cFeEKtEfGqZS6H+SpGfA6uD0AlNdH/TGVtbZSDV2A2RlXni8m
+gfyjFEAPSix03AINGsDBDufRIWjLE3PfBxeEqx8to2c
+-> piv-p256 vRzPNw A8ZYD6qutHn7Tu/hWrCnoVTnmd4p/xSRNlgCi7Z+Ds7a
+Ds9F3y3mEsdbFeJQW+KscpnaW8BeHVVmxpyaUtkdOO4
+-> piv-p256 zqq/iw Aqus2odLOSqWHHPncAA2JMjLhTscshC25BPk3JoAwzgc
+y0/oo/kVuXMlya5Q/gQTK3DorUGv1Dq352UP3Jeebmc
+-> ssh-ed25519 YFSOsg UZlASTWx40N87euqbwB3yYqDRXqoPxarYocukMAXjSs
+/21vCj6xBDk6P0956D5/yjVpQlyfXANMD5TebyNblyo
+-> ssh-ed25519 iHV63A IiQxkranbz9QsMkx3yjt/RPjGfR9Lay/bkZ0tth52xc
+PmhS0h28iVr0yUcTU9o8XWu29qOm7JCYays4IA3n9t8
+-> ssh-ed25519 BVsyTA NbXq9vdZ3r2Dvzo1m2dzYlVd2tVZYxrptT4oul76pUk
+doJFEhCckrlSmYmYDS1kmKgIng6SCKh2LbnSRVTCGkI
+-> ssh-ed25519 +3V2lQ dOvZBoaRFfnYo7dE+l+pqNKbu2TEddJzF+ijJa8y1FE
+FgCcypV98xsv52IZjvmDEaoDUwr+unYSYZowRwLz88Y
+--- 4hmokk2I+HudzM6Oh2qpiYUJLdUmIwapvhhP79LF97I
+ºI¨2`Öß‚¥eŽ·\/P,o‚`D£ÎŽûëfC"EŠÞèúí¨ÑÉEðO_k7±¥0¿¬ÕX<C395>öl
+gnð‡µ>$›Ê™ƒ¶ËxP§ì€›ñÄÍà(op`”gÞÂ¥z#ÖÕú.”°Yk3¬ó8Žã{Û	¤\Å«¤ZËTù‡íÐ
ÀÏ]EzXî§FTé¯ì;a—+eÄÕºã¯Gê
--- a/secrets/mastodon-smtp-password.age
+++ b/secrets/mastodon-smtp-password.age
@ -1,45 +1,43 @@
 age-encryption.org/v1
-> ssh-ed25519 iDKjwg Td1xpczm4SaXNEVNf5TjN2QlbKJy3CW8LPDGiMclakI
-kFi0PFg+VHptG9WRBOtTJvDa4kjOua/4PF5AV6MPEZ4
-> ssh-ed25519 uYcDNw NMzLBxORxWCd5A7sm5g+Mp0oORk8NFQ1kSmXLXr1lks
-H3l3Ow3YMKKFkuwphewGH3J/3vl6QsbKW6w2l41+ERI
+-> ssh-ed25519 iDKjwg svJv3RnPq4L7+hJaNL2xv+wnQ81DODKDlPW4RdX8nBM
+5mObtaLBtLvQlY+poGFc65J1C0fBniTpEfdLv/1Fuc0
+-> ssh-ed25519 uYcDNw aLt8Iz8gPl18ZoDtBCoAQ0tOmVOwdyT206MGRSHhNkA
+t8aD1JtjxXeX2i5qdCj71xossxLnlMqZ1TizJC6xgEk
 -> ssh-rsa f5THog
-OXoPASz2VOPWVdFa6obQppMnVr6q/DdsMU4Wh0ok6cV7Mm1U/WIsTGCFxPtRUCAz
-NhTi667lnXXgrkKmlJhC6R8R2HTNp2WeaDzllexX1uvYACc/rnvD7KPqmxePvoc7
-TYLawVxl83+wsWLDQR7vuK2lSB/S6qZ7yPpF0nDIM153WI7edHu69/Yu0V+xJp0A
-UbSJTP53C+DA1J87H6SsN+qE/a67qTV6J3qhRD3tAW5EY0ZOQ+Lr7OQFRnEW4hOL
-mbIXzgTISU/eQSJ22Xz7vk0jUOPN77RH5B/1EJmEbKJifZYYb9sajgrWwGvBbp4E
-hvWpGPqd2Jxxev1uhjjbwcf19O4/Gv1vCxTCQ6SQnW7t6L4hhWVKeH9p3/ZGHdcV
-GL7TtD7Qnj5uZfc4bOWZ5RSm/JYdjyIYFe0wP7qz21hup3j92nKMIruOL2o6s0nv
-m75n0aoZwQWyOdk5RZpfs9Bfw+y6tnsAWqg+PYR3RFV4raLbpFJJFYdPKO2E5gDx
-/y22LGVYZqajuKzfRmznHKGlSTxF0Aa+cFV5HWqmN3oA5UiteZX6JCQRVy5egfSo
-KMNhpR37wxI6B5AUS0UMGay0kIWSUCJGe0PF/lPWoM9Q6Lp6CqJEUMwojZtISc8y
-BJJclZ+M48HCR1OiCMXlduipXbRUV6TN9KytA+erRuo
+ZCccraTiNEGp5EcPJm4u9W1cigox4tIXo55NITEd99AnU59erULTaQs1gfdW+5/b
+tubzmpN10T87ELxK8sZiu3LaW1yuHqleecF6gtGhftl/4n7Wup3SR50c6yUlJVq5
+IwVE/vmhymicGNjMI24kRHYPzjDLtiuqFiwolC/o4MGiplGQPRvZ1W49PLoGc5xy
+zRvpREy31oSH+L38gxaMSiI3nIH2y62kl64LnsjRD3E9oYPQ6uDKbz/tyN8tYe7t
+yf6JZ8g9JrnU7pKZ9PalJplWEjxUGoD49aI2/0e4UYyNsTNbCIMhxOAIY5Rb4mXA
+LE7EZ16uqzdfv1iidXVcVVgYFdDSfIg28lexWD8TZFHRV7jHsaw/VuQYnu05KEOl
+19iloUCPl4UQNgsE6PUIJoIhvRGHhovw80eol0v8weOXcBi2J5NupWwy5mjTSqeH
+JsBEFz//PZ7cvTD6pblTLkEVXWKCIu/tJs7ZoeVLaR+dANHyviwVuH42xa8Ouj0I
+aFgl9FYo3j/aNsIzgMdNTAQJCzhxRmzgTGqkVdEqFtg9H5SjQrcHDlogK4w84Sm2
+LSHv3rRX+pHSIpETACCWd/GGqzVGE+v5gHpafFdCc2P1+0MH1tZ5dfhFFS7mgg1A
+vuRXLAD6/7aN4pNapPe22Woin5Xde3yCUmi56+a1hv0
 -> ssh-rsa kFDS0A
-oNmPaJpfuPxGgcdYsPwDiaeu5lmoWLTdFjdKQqr/vEsmTC9TbgVIu3ijbixpaO7g
-cabLWs6WCAE4yV6bq8DCNVwok4IltRq6gz0E2H47qP9r5SsLGiu5HjBLajGlesId
-8mxEL5dQIxnaBwFIsKreFfh2FlTuljTAmVtsqzQAspjGa/fHd/K8ZWUsyInHWaMR
-KtgqGPjmbgWY0SM8j07j1OkKHuzIK2v/LRUUqvkcC/vZjoGqVbbJA40PhfRzDd2B
-+FdYUHP86ZfeW1/dORSTQrad4OacWX38HI+P1atWq436wa+K9qOGzJcJfudtYJ43
-ZvF8rus5GOTP+M+HX1J2flSbG36WEB/0JD1nACsvE5eMtWtynAVbu/tyKuAmWzTS
-zCy/biMn4vMYzHg3jsZIJvvGLwk2xTd3tesvqvOviDRGE1WmUK77shLlG7fGR76e
-/t1Zsvw2SFhpgeSbPYwoZcFQlxi0PVGgaT38mjWi5s6I6oA7hmvS8bcM2IXkICdu
-TBQ+nGjhwfmkhnfkHiEy6A9LYxziiDIJL15dma0KG7Kc6qhH7X62/mE+2OITKylA
-+zB5BX0HI/UJx3tFDxoL9SwVqcXi6qWHWy+4vRHJUGe1hGLkF+f+iJTWxNL9Lcky
-VwJyO/kAQdDg5SNCDY3ohGhBb4VOBzX0AMJdXB7aE7s
-> piv-p256 vRzPNw A95+KMAiva5R852fe8G5ceXc23HfkCkio4H6w1eiZS61
-ulukL7Gic4R1ptaKGWckIU+kaq/1AGwYI2aTrM87eMY
-> piv-p256 zqq/iw Aj5KBZXqgzT1nq4lFoFJpKWSxZ1NmPX+nQkrC/0wbMt1
-2DHEAmbQ2/XNDJ1umkGdHXbDzq5YDMUdmD/J3JMiaRo
-> ssh-ed25519 YFSOsg Bekl48HOIuCKbZ9xWeHtk5q/e1nFQXoiK2GYQWJ4/jo
-VtL/msbj5MaRl3V4GMoyWdqxyppTx+NYClMsTha/Prk
-> ssh-ed25519 iHV63A P2u2Lpz8kmaOfKMFMgQtcXYFzwy5wlAgciy20Ay/rV0
-FbOG+kykxeOioqiJ0ARNZUlcn85iBc0qmxdWb1VxmLU
-> ssh-ed25519 BVsyTA +602HApwdGhQ0Kd+oVNOKOuGCCBLLNp+/QLfLcV4nwE
-gVnMaQszX3sps2hjiXxgcrq22W0mFfpMaT7OXqZS69s
-> ssh-ed25519 +3V2lQ GSgwPGbFo1TFNNrdIiiQapn/FXEk2JJgk5xzRDL6okY
-CnhJlD68e7P3xixU3DOwJJGiu0PpzeR3Ag2SUjti468
--- 5Adibjlpvg9vr6rB/vaPEMj9y+MPL8vGRx582w9YIz0
-¦öÑõÉˆ²A
-_Û;@1ò)»=4Ø³†ÕÜè¼dmÕgZÕi“<69>T=ˆmMm®
-®
+mxu6zyFO8dZgsr2W2BCbVckHEODcTCGi0evcRgT0EnEBCx1OdALV/NLK8ZdJtFvQ
+GiKOeN8unbBLIh845yFgVZUrsb7h0nlg1ogWZswX0IpxC2x9CKCgiT1PJRGpzpyL
+LUyDzzam3CyIWjPHqx1BwCEfiHDdsP0w1FMn0olJgahzW39/+zjcz4x0R0zTKGy8
+wrFdzTI2FYhpK3Ob8/d+0tKjbca5y6qayBfYnLGpQK5WZ0RiIS4t5C1JJ1xC4nU8
+f8aRWqXZusSkbCpZJj98t8tUragFTwS8iCHmzTst6uoLZ88YmYNvo/s1vtI+yomc
+gG29EaPSdsTdyBPb/T/8F+IO7Ym+ZKBYag579pygUq8kbJKLzLZG5WRSBpT79VmG
+B/951N2JazdppmZ+lzTxGxgJM+SnAbQeEsNC/oOn69WQO7INcpzOXi3m9kwF+qd
+0EnR8JUqY1dHDbwLEdjuHg4LQjBmlSf2k/bdoqiptchDGSHQv5k0ic3m006HJgqN
+/zF1mw8c9o/6MyOprfoIhq3Comk7Ykwig8nirYIqzPnMB8G6D7Vk7jFq0cbv85nA
+OPiVUGtmEr6BcOdf5btV/3ei2nTq+NpPO3IbHnu4DUC6kZrZcCwc4vW1OLVUSx75
+qjEzzJ27ZSi2k4BtBAp3gGMum0y7RX/x+vPRKcb904I
+-> piv-p256 vRzPNw AsasoTH+Vv1bQsGQlLRkDGiY6QcENjogT6+tzbXitooQ
+IHas+Nxa+l+HfCHJslrewW+4LcZ9GUsAgC/39AI4/v4
+-> piv-p256 zqq/iw AuMn5t1bJYqysPbG7IEzwiRDZvL3jhYsZSjrAjafK9he
+dV5YCEHPCngePXLI6OdNAvexOxk+0zmG+MARyVnf8o4
+-> ssh-ed25519 YFSOsg WLd3aKTaPpdLf/L5M+DE19KMifJGjIRaR86CDbYWejg
+oKOx5Te7/NNnq2X/BLNLIZZbZ57+VGBqNtJClbgh4NY
+-> ssh-ed25519 iHV63A y46J97PK6iTxWxONVn3rbj11NVRU9224HzjSeXAF0hY
+ePg06ps+pYDW3BcgLe1IPMDCUVHHpWrRF6zw8BWrg+U
+-> ssh-ed25519 BVsyTA fjbffFH0Pybw+K68+7+Oti2qvovaaom0dvLpGLs7tRo
+dApBFurCvCVcWEK1WsQ6fDCz9c1Kg4BKDTT3jMfykP8
+-> ssh-ed25519 +3V2lQ rNrCTEwEiGb/MY4h6tY38GdJkarNvgBxAltya9c9/14
+lIvWQUFm3K5pfd0ShA8If0ttUU1mpRgpSpuuXTT9Na0
+--- OAPKaCUB4sQSJBLBKQz3eVexevlfwif4jwgj/htCeuw
+ðª•÷Ê 
üVOîLÌßkÅÇÜŽ!lS˜;¨äÓchMŠ™<15>öF½m1«ø
--- a/secrets/mastodon-vapid-private-key.age
+++ b/secrets/mastodon-vapid-private-key.age
--- a/Show more
+++ b/Show more