feat: winters <> summers parity

2026-04-14 13:19:09 +02:00 · 2026-01-10 15:56:09 +01:00 · 2026-01-10 15:56:09 +01:00 · 04e3bcefc3
commit 04e3bcefc3
parent 7cacce85a0
144 changed files with 3628 additions and 732 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@ -7,10 +7,13 @@ keys:
    - &swarsel 4BE7925262289B476DBBC17B76FD3810215AE097
  - &hosts
    - &bakery age1mjgw3nxlnqdj04mgjz3wn7fj2nl2nxla4p2r2fn4nkvayfgp09pqllxzyh
-    - &summers age18cgqlely56hgmhscllkmafwpjdk6dwep6ej3vkk97dzemp8jtuksqrrjjl
+    - &summers age14sjyqch8tzqexk2gv0qgrrg09f0s6hvwhsgjac3vs6sc5rzgpcxsyqda6u
    - &belchsfactory age1k73gy5em3js9zklnnkzp5hme9k04lny32fgahmzddknjw5c295asdyr4x6
+    - &dgx age1ax5hqk6e2ekgfx5u7pl8ayc3vvhrehyvtvf07llaxhs5azpnny0qpltrns
    - &eagleland age1cmzh82q8k59yzceuuy2epmqu22g7m84gqvq056mhgehwpmvjadfsc3glc8
    - &hintbooth age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+    - &hintbooth-adguardhome age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+    - &hintbooth-nginx age1nanlervuderw4qskcuessycqy2yfmptl6nym9scgp9ky2265ssmq3u73r0
    - &liliputsteps age1ly2endyt0y9xyddj6yuj4nw6fa3ltvzlvew4cr4lzs6dv8dkavpqadmyxx
    - &moonside age18quey88vge7xytclg2nuq4ncme86dg04lxwczqxczmdchnjg3p0saehsnh
    - &pyramid age15cx90pnp54xp5gxlt02yn9j2pz968wp3l5ukdkx55xuecp34e5pszjku4m
@ -18,9 +21,6 @@ keys:
    - &toto age16vzhcvz8tyxj8e0f47fy0z4p3dsg0ak4vl52ut3l07a0tz465cxslmhevl
    - &twothreetunnel age1g7atkxdlt4ymeh7v7aa2yzr2hq2qkvzrc4r49ugttm3n582ymv9qrmpk8d
    - &winters age1s0vssf9fey2l456hucppzx2x58xep279nsdcglvkqm30sr9ht37s8rvpza
-    - &dgx age1ax5hqk6e2ekgfx5u7pl8ayc3vvhrehyvtvf07llaxhs5azpnny0qpltrns
-    - &hintbooth-adguardhome age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
-    - &hintbooth-nginx age1nanlervuderw4qskcuessycqy2yfmptl6nym9scgp9ky2265ssmq3u73r0
 creation_rules:
  - path_regex: secrets/repo/[^/]+\.(yaml|json|env|ini|enc)$
    key_groups:
@ -56,6 +56,7 @@ creation_rules:
      - *swarsel
      age:
      - *twothreetunnel
+      - *summers
      - *eagleland
      - *hintbooth-nginx

@ -152,6 +153,146 @@ creation_rules:
      - *hintbooth
      - *hintbooth-nginx

+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/ankisync/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/atuin/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/audio/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/firefly/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/forgejo/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/freshrss/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/homebox/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/immich/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/jellyfin/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/kanidm/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/kavita/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/koillection/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/matrix/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/monitoring/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/nextcloud/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/paperless/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/postgresql/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/radicale/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/storage/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
+  - path_regex: hosts/nixos/x86_64-linux/summers/secrets/transmission/[^/]+\.(yaml|json|env|ini|enc)$
+    key_groups:
+    - pgp:
+      - *swarsel
+      age:
+      - *summers
+
  - path_regex: hosts/darwin/x86_64-darwin/nbm-imba-166/secrets/[^/]+\.(yaml|json|env|ini|enc)$
    key_groups:
    - pgp:
--- a/SwarselSystems.org
+++ b/SwarselSystems.org
--- a/files/emacs/init.el
+++ b/files/emacs/init.el
@ -1117,7 +1117,7 @@ create a new one."

 (use-package nix-ts-mode
  :after lsp-mode
-  :mode ("\\.nix\\'" . "\\.nix\\.enc\\'")
+  :mode "\\.nix\\'" "\\.nix\\.enc\\'"
  :ensure t
  :hook
  (nix-ts-mode . lsp-deferred) ;; So that envrc mode will work
@ -1131,6 +1131,9 @@ create a new one."
        lsp-nix-nixd-home-manager-options-expr "(builtins.getFlake \"/home/swarsel/.dotfiles\").nixosConfigurations.pyramid.options.home-manager.users.type.getSubOptions []"
        ))

+(add-to-list 'auto-mode-alist '("\\.nix\\.enc\\'" . nix-mode))
+(add-to-list 'auto-mode-alist '("\\.nix\\.enc\\'" . nix-ts-mode))
+

 (with-eval-after-load 'lsp-mode
  (lsp-register-client
@ -1774,70 +1777,73 @@ create a new one."
    )))

 (use-package dashboard
-  :ensure t
-  :config
-  (dashboard-setup-startup-hook)
-  ;; (setq initial-buffer-choice (lambda () (get-buffer-create "*dashboard*")))
+    :ensure t
+    :config
+    (dashboard-setup-startup-hook)
+    ;; (setq initial-buffer-choice (lambda () (get-buffer-create "*dashboard*")))

-  (let ((files-domain (getenv "SWARSEL_FILES_DOMAIN"))
-        (music-domain (getenv "SWARSEL_MUSIC_DOMAIN"))
-        (insta-domain (getenv "SWARSEL_INSTA_DOMAIN"))
-        (sport-domain (getenv "SWARSEL_SPORT_DOMAIN"))
-        (swarsel-domain (getenv "SWARSEL_DOMAIN"))
-        )
-    (setq dashboard-display-icons-p t ;; display icons on both GUI and terminal
-          dashboard-icon-type 'nerd-icons ;; use `nerd-icons' package
-          dashboard-set-file-icons t
-          dashboard-items '((recents . 5)
-                            (projects . 5)
-                            (agenda . 5))
-          dashboard-set-footer nil
-          dashboard-banner-logo-title "Welcome to SwarsEmacs!"
-          dashboard-image-banner-max-height 300
-          dashboard-startup-banner "~/.dotfiles/files/wallpaper/swarsel.png"
-          dashboard-projects-backend 'projectile
-          dashboard-projects-switch-function 'magit-status
-          dashboard-set-navigator t
-          dashboard-startupify-list '(dashboard-insert-banner
-                                      dashboard-insert-newline
-                                      dashboard-insert-banner-title
-                                      dashboard-insert-newline
-                                      dashboard-insert-navigator
-                                      dashboard-insert-newline
-                                      dashboard-insert-init-info
-                                      dashboard-insert-items
-                                      )
-          dashboard-navigator-buttons
-          `(;; line1
-            ((,""
-              "SwarselSocial"
-              "Browse Swarsele"
-              (lambda (&rest _) (browse-url ,insta-domain)))
+    (let ((files-domain (getenv "SWARSEL_FILES_DOMAIN"))
+          (music-domain (getenv "SWARSEL_MUSIC_DOMAIN"))
+          (insta-domain (getenv "SWARSEL_INSTA_DOMAIN"))
+          (sport-domain (getenv "SWARSEL_SPORT_DOMAIN"))
+          (swarsel-domain (getenv "SWARSEL_DOMAIN"))
+          )
+      (setq dashboard-display-icons-p t ;; display icons on both GUI and terminal
+            dashboard-icon-type 'nerd-icons ;; use `nerd-icons' package
+            dashboard-set-file-icons t
+            dashboard-items '((recents . 5)
+                              (projects . 5)
+                              (agenda . 5))
+            dashboard-set-footer nil
+            dashboard-banner-logo-title "Welcome to SwarsEmacs!"
+            dashboard-image-banner-max-height 300
+            dashboard-startup-banner "~/.dotfiles/files/wallpaper/swarsel.png"
+            dashboard-projects-backend 'projectile
+            dashboard-projects-switch-function 'magit-status
+            dashboard-set-navigator t
+            dashboard-startupify-list '(dashboard-insert-banner
+                                        dashboard-insert-newline
+                                        dashboard-insert-banner-title
+                                        dashboard-insert-newline
+                                        dashboard-insert-navigator
+                                        dashboard-insert-newline
+                                        dashboard-insert-init-info
+                                        dashboard-insert-items
+                                        )
+            dashboard-navigator-buttons
+            `(;; line1
+              ((,""
+                "SwarselSocial"
+                "Browse Swarsele"
+                (lambda (&rest _) (browse-url ,insta-domain)))

-             (,""
-              "SwarselSound"
-              "Browse SwarselSound"
-              (lambda (&rest _) (browse-url ,(concat "https://" music-domain))) )
-             (,""
-              "SwarselSwarsel"
-              "Browse Swarsel"
-              (lambda (&rest _) (browse-url "https://github.com/Swarsel")) )
-             (,""
-              "SwarselStash"
-              "Browse SwarselStash"
-              (lambda (&rest _) (browse-url ,(concat "https://" files-domain))) )
-             (,"󰫑"
-              "SwarselSport"
-              "Browse SwarselSports"
-              (lambda (&rest _) (browse-url ,sport-domain)))
-             )
-            (
-             (,"󱄅"
-              ,swarsel-domain
-              ,(concat "Browse " main-domain)
-              (lambda (&rest _) (browse-url ,(concat "https://" swarsel-domain))))
-             )
-            ))))
+               (,""
+                "SwarselSound"
+                "Browse SwarselSound"
+                (lambda (&rest _) (browse-url ,(concat "https://" music-domain))) )
+               (,""
+                "SwarselSwarsel"
+                "Browse Swarsel"
+                (lambda (&rest _) (browse-url "https://github.com/Swarsel")) )
+               (,""
+                "SwarselStash"
+                "Browse SwarselStash"
+                (lambda (&rest _) (browse-url ,(concat "https://" files-domain))) )
+               (,"󰫑"
+                "SwarselSport"
+                "Browse SwarselSports"
+                (lambda (&rest _) (browse-url ,sport-domain)))
+               )
+              (
+               (,"󱄅"
+                ,swarsel-domain
+                ,(concat "Browse " main-domain)
+                (lambda (&rest _) (browse-url ,(concat "https://" swarsel-domain))))
+               )
+              ))))
+
+(add-to-list 'recentf-exclude "\\Archive\\.org\\'")
+(add-to-list 'recentf-exclude "\\Tasks\\.org\\'")

 (use-package vterm
  :ensure t)
--- a/files/topology-images/ender3.png
+++ b/files/topology-images/ender3.png
--- a/files/topology-images/ender3_.png
+++ b/files/topology-images/ender3_.png
--- a/files/topology-images/matrix.png
+++ b/files/topology-images/matrix.png
--- a/files/topology-images/mautrix.png
+++ b/files/topology-images/mautrix.png
--- a/files/topology-images/octoprint.png
+++ b/files/topology-images/octoprint.png
--- a/files/topology-images/postgresql.png
+++ b/files/topology-images/postgresql.png
--- a/files/topology-images/ps4.png
+++ b/files/topology-images/ps4.png
--- a/files/topology/private/flake.nix
+++ b/files/topology/private/flake.nix
@ -0,0 +1,5 @@
+{
+  description = "Flake that sets topologyPrivate to true for building topology.";
+
+  outputs = _: { topologyPrivate = true; };
+}
--- a/files/topology/public/flake.nix
+++ b/files/topology/public/flake.nix
@ -0,0 +1,5 @@
+{
+  description = "Flake that sets topologyPrivate to false for general purpose.";
+
+  outputs = _: { topologyPrivate = false; };
+}
--- a/flake.lock
+++ b/flake.lock
@ -2676,6 +2676,7 @@
        "stylix": "stylix",
        "swarsel-nix": "swarsel-nix",
        "systems": "systems_8",
+        "topologyPrivate": "topologyPrivate",
        "treefmt-nix": "treefmt-nix",
        "vbc-nix": "vbc-nix",
        "zjstatus": "zjstatus"
@ -3243,6 +3244,17 @@
        "type": "github"
      }
    },
+    "topologyPrivate": {
+      "locked": {
+        "path": "./files/topology/public",
+        "type": "path"
+      },
+      "original": {
+        "path": "./files/topology/public",
+        "type": "path"
+      },
+      "parent": []
+    },
    "treefmt-nix": {
      "inputs": {
        "nixpkgs": "nixpkgs_27"
--- a/flake.nix
+++ b/flake.nix
@ -76,6 +76,7 @@
    nix-minecraft.url = "github:Infinidoge/nix-minecraft";
    simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/master";
    nixos-nftables-firewall.url = "github:thelegy/nixos-nftables-firewall";
+    topologyPrivate.url = "./files/topology/public";
  };

  outputs =
--- a/hosts/nixos/aarch64-linux/twothreetunnel/default.nix
+++ b/hosts/nixos/aarch64-linux/twothreetunnel/default.nix
@ -36,6 +36,7 @@
          peers = [
            "moonside"
            "winters"
+            "summers"
            "belchsfactory"
            "eagleland"
            "hintbooth-adguardhome"
--- a/hosts/nixos/x86_64-linux/hintbooth/default.nix
+++ b/hosts/nixos/x86_64-linux/hintbooth/default.nix
@ -11,8 +11,8 @@

  topology.self = {
    interfaces = {
-      lan2.physicalConnections = [{ node = "summers"; interface = "eth1"; }];
-      lan3.physicalConnections = [{ node = "summers"; interface = "eth2"; }];
+      lan2.physicalConnections = [{ node = "summers"; interface = "lan"; }];
+      lan3.physicalConnections = [{ node = "summers"; interface = "bmc"; }];
      lan4.physicalConnections = [{ node = "switch-bedroom"; interface = "eth1"; }];
      lan5.physicalConnections = [{ node = "switch-livingroom"; interface = "eth1"; }];
    };
@ -43,9 +43,10 @@
        wgHome = {
          isServer = true;
          peers = [
-            "winters"
            "hintbooth-adguardhome"
            "hintbooth-nginx"
+            "summers"
+            "winters"
          ];
        };
      };
--- a/hosts/nixos/x86_64-linux/hintbooth/secrets/adguardhome/pii.nix.enc
+++ b/hosts/nixos/x86_64-linux/hintbooth/secrets/adguardhome/pii.nix.enc
@ -0,0 +1,25 @@
+{
+	"data": "ENC[AES256_GCM,data:j4Vhhuinx3xb0YhEvtjK6CmGm4HDmhOZN9ftHJ6IgrINdlj8tWxyxsOfQkJoX+PmIjhloLob61MSBm2QfMGojMsvbgNrvakpPBoTd8w2H9u6IxMH0DpPCnXOq2rD6aC2Y5Xjg6AZJCXQNWMCfkhTgbZoTOen3e/1IUXtPtbURKe7vpOuyaB3d7IIO6NnMGlNpF3ZXRuxoOtu9Y9ZrMjgRH7I5vkE4KkMoFIt//Tx1rtlhu68UrFKlochelXNPxWc+NHNbi1ynibdgeuipak5GmheJ1vY7oKAMogvsZWvn5qs8Ar5juoonWWKsc++dIcFwhDHaxd/xHiak2MhKmnU+do=,iv:LLAaoxXaqVnoCprUfSNLNBU/69ZTxytVswgdz5s2swQ=,tag:B8wC/3YB04tKvBrS2AvmdQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4YjFzelZTVE40L2hiZ0pP\nL1o2ZUJ3VmFnZE15alRaTHE0aEU2T2M5YjFZCk9tdUxEdStRemZTdnNodE5aUzk2\nSFlaeklZZU1NYVdTcW5VOHczWkNabDgKLS0tIFJtM0dlN2N4WnltaGVLMFg5ZEJG\nbVdMU085TnlzMmxEWkNvdUxnVUIxeU0KRW+NWgYTqxKUIrK9v3E2zYmZCnAEsUjw\n4WxVqwhGgUoHDeURiKkJNJ4kg3op6pNZg12NJ2JfAngAKfCK4xUNzw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwQXc1MWpLNms2QzVzeHRo\nd2NJNVh6MWIvVkFsbEc2b2FVSkxkQjFYMURJCnJGOGZPMkt4L1ZXSW5UbGQzNFA1\nYm5uZlFXNlNjd0VSQVo3N3lFQ3BvUmcKLS0tIFlqQmpOL3VLVzZmcmxnN2RuOEd5\nZXRBN0wvbDB3a2hSdWRuN096ZExCcTQKMGRB1v9Jlilzx65/5yUgWQ+i7ubK8y3Z\n87o23XUIdXAx9oPW3j3HP1OpuYqiJc0FYX+THtmpHln/J9n9Qe18qw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-09T13:49:03Z",
+		"mac": "ENC[AES256_GCM,data:cJauc3/EUrx5uYx1SGLTmXdPrsnLY0SYm9vCakX9CUuBOoOp3aA5SGFtzGSjOlbPa22uo5Yt0t25setij3G4A9DjTGG/P/aQq9lLYvEeBxN0oxmBnww0YeLUoHT+04qxSH/5CShwZg26Ycep/43DMO1x3HH3fx4ijenfwmKhuAo=,iv:aZc6KMC2JaxEdKX3uOuSzJ6Bhfu0I77Yw+9t0z+ZI80=,tag:lQCZmxfq+Hp8G0JG/bjhVA==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2026-01-09T13:48:11Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAwDh3VI7VctTARAAxNIPrwgDPEUjt+06WWjvh+NYFfxkEdVPH+8o7O1GG/xS\nH+K3iviN+IPdvXeV5zDjHfARVpnnaT0GfH1yb9+4X8731bDPhZk4iYH/RTloByoL\nx+yRhBzo6YfWvLVBHDXuV0Ux5xWFlQmhAoUrsHeBycDmNCEoQV58igBNgHxROpHA\nwwWxkuAk2A6LQRIJkCd3q0FonES7G8Oi2sslYOqlsMzzfTS3OrZfc+y6vjjQshqn\nldZLjFogOPH6YJZe9r/LTaXqoY31t4ZeGKlH5ShfKui+e7va6pZy0X63iNmhLAfw\nccxIJVQCEf7DOtFdohKVrhpLD88nj2PIv618QFLgBW72Cyw0O1RPGRCQkwk0WGqN\nlzm/2MoStUlO/0/GvWi3KN46E1E0LR6FkAOEphxH7gB+1wiJpgnDCSWtR8ow1gOG\n/SNKb6xFD2haKZVl4DyioK6yiOQ2/tHEeYrIDhVfW3+KZ57zd6R5euhaK+QxABVW\niCNDaERqMvwWuwfBUif7g3V4CU1iTkQ6DHI8LbaVH4Vs+YwqGt21kpe/dcIiqtm1\nSNACM5mJ1Q1P7r8fM4i544IxFbl+LHijJzFTjTxdgkEsovwXbOVpWqVl5oQ8xVVx\nkd1FZuQmcNvsS9y1enK5kD3DUZzygvtZwKcKRohLyQV3T+ujUFAh8hhVUwmrRKKF\nAgwDC9FRLmchgYQBD/9AhPK/E4/cmSFSnUYpyvoRqlUhGtXzZMwTzRKjf5hRHyio\npjqJEND+UTIrIMy8rExBFiE39+7crsICG+k03Fawtmmw9Q5zXmhPFW1pD6g2zQcH\nMtGmg2BJBdXXcL6wuaaDaDUWVVhYw8iN9QaC6ma0/i92ZiH7T55D3+0MQeqSrDFx\nISjtg4xU8Vx/vHXayEHSuLzaqU2/5vnx0DUalqYUTE4f9eeaD9e1qLyoDBGRld3T\nHuAXdKulwL1YSKNBe2X9Y3kHlHzK48I5NfMy8NuTkMPUQ442ZZYD7mYM7J3kyjgH\n9DTRC7P2sfacE7f3i3Tnum0kwTEs6a8aeIR/BS+EDrPouKXuHevWLzbqB/pa9cfm\nU0yvZmcXOrLVXsjOKdgHzS2I2jGnbacza/FTkkjS4amDKq5kmkqeBkSol0//oDUR\n15sa+vEWDBFTdDZPvYZAKwndNkPy4prjOsXxHSpLa0oX+vT5UWdLvYy8P6av5Hk8\nNBDePCf/WhwIr3612n7kSBzEdh7HQTtPWapq31GaH7+vgZAw9hVWrWiIBuHf3j60\nN1zHfid7wMeFHqnRvT74vpM7ekvfVf2ab0XLpQmFMvMkZSj7gZllJsiA4TiAqgvg\ntANiOnPtZDr25GDogl+3b6uBEhmTmSi40D0te84zsT18yvZXbJhr23swRlo7cNJe\nAdAi5A4/stmMaLSzFoyt/FZL7+/lwOGmGHo6TMcr2b1UkLfA/c7r9udVnOJGuDFW\nau9MXji34BkREW2gzEaJBqOJ5RkaKB3TBxbl3c6FX0DsFoEINzALM1yJ/B6NbQ==\n=NwLj\n-----END PGP MESSAGE-----",
+				"fp": "4BE7925262289B476DBBC17B76FD3810215AE097"
+			}
+		],
+		"version": "3.11.0"
+	}
+}
--- a/hosts/nixos/x86_64-linux/pyramid/hardware-configuration.nix
+++ b/hosts/nixos/x86_64-linux/pyramid/hardware-configuration.nix
@ -26,7 +26,20 @@
    # kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
    binfmt.emulatedSystems = [ "aarch64-linux" ];
    initrd = {
-      availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "cryptd" "usbhid" "sd_mod" "r8152" ];
+      availableKernelModules = [
+        "nvme"
+        "xhci_pci"
+        "thunderbolt"
+        "usb_storage"
+        "cryptd"
+        "usbhid"
+        "sd_mod"
+        "r8152"
+        "drm"
+        "drm_kms_helper"
+        "ttm"
+        "gpu_sched"
+      ];
      # allow to remote build on arm (needed for moonside)
      kernelModules = [ "sg" ];
      luks.devices."cryptroot" = {
@ -37,7 +50,7 @@
      };
    };

-    kernelModules = [ "kvm-amd" ];
+    kernelModules = [ "amdgpu" "kvm-amd" ];
    kernelParams = [
      # deep sleep is discontinued by amd
      # "mem_sleep_default=deep"
--- a/hosts/nixos/x86_64-linux/summers/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/default.nix
@ -1,17 +1,20 @@
-{ self, inputs, lib, config, minimal, nodes, globals, ... }:
+{ self, inputs, lib, minimal, ... }:
 {

  imports = [
    ./hardware-configuration.nix
    ./disk-config.nix

+    inputs.nixos-hardware.nixosModules.common-cpu-intel
+
+    "${self}/modules/nixos/optional/systemd-networkd-server-home.nix"
    "${self}/modules/nixos/optional/microvm-host.nix"
  ];

  topology.self = {
    interfaces = {
-      "eth1" = { };
-      "eth2" = { };
+      "lan" = { };
+      "bmc" = { };
    };
  };

@ -20,21 +23,51 @@
    loader.efi.canTouchEfiVariables = true;
  };

-  node.lockFromBootstrapping = lib.mkForce false;
+  hardware.enableRedistributableFirmware = true;

  swarselsystems = {
    info = "ASUS Z10PA-D8, 2* Intel Xeon E5-2650 v4, 128GB RAM";
    flakePath = "/root/.dotfiles";
    isImpermanence = true;
-    isSecureBoot = false;
+    isSecureBoot = true;
    isCrypted = true;
    isBtrfs = true;
    isLinux = true;
    isNixos = true;
    isSwap = false;
-    rootDisk = "/dev/disk/by-id/ata-TS128GMTS430S_H537280456";
+    proxyHost = "twothreetunnel";
+    writeGlobalNetworks = false;
+    networkKernelModules = [ "igb" ];
+    rootDisk = "/dev/disk/by-id/ata-TS120GMTS420S_J024880123";
    withMicroVMs = false;
-    server.localNetwork = "lan";
+    localVLANs = [ "services" "home" ]; # devices is only provided on interface for bmc
+    initrdVLAN = "home";
+    server = {
+      wireguard.interfaces = {
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+      };
+      restic = {
+        bucketName = "SwarselWinters";
+        paths = [
+          "/Vault/data/paperless"
+          "/Vault/data/koillection"
+          "/Vault/data/postgresql"
+          "/Vault/data/firefly-iii"
+          "/Vault/data/radicale"
+          "/Vault/data/matrix-synapse"
+          "/Vault/Eternor/Paperless"
+          "/Vault/Eternor/Bilder"
+          "/Vault/Eternor/Immich"
+        ];
+      };
+    };
  };

 } // lib.optionalAttrs (!minimal) {
@ -43,34 +76,63 @@
    server = true;
  };

-  microvm.vms =
-    let
-      mkMicrovm = guestName: {
-        ${guestName} = {
-          backend = "microvm";
-          autostart = true;
-          modules = [
-            ./guests/${guestName}.nix
-            {
-              node.secretsDir = ./secrets/${guestName};
-            }
-          ];
-          microvm = {
-            system = "x86_64-linux";
-            # baseMac = config.repo.secrets.local.networking.interfaces.lan.mac;
-            # interfaces.vlan-services = { };
-          };
-          specialArgs = {
-            inherit (config) nodes globals;
-            inherit lib;
-            inherit inputs minimal;
-          };
-        };
-      };
-    in
-    lib.mkIf (!minimal && config.swarselsystems.withMicroVMs) (
-      { }
-      // mkMicrovm "guest1"
-    );
+  swarselmodules.server = {
+    wireguard = true;
+
+    nginx = true; # for php stuff
+    acme = false; # cert handled by proxy
+
+    nfs = true;
+    kavita = true;
+    restic = true;
+    jellyfin = true;
+    navidrome = true;
+    spotifyd = true;
+    mpd = true;
+    postgresql = true;
+    matrix = true;
+    nextcloud = true;
+    immich = true;
+    paperless = true;
+    transmission = true;
+    syncthing = true;
+    grafana = true;
+    freshrss = true;
+    kanidm = true;
+    firefly-iii = true;
+    koillection = true;
+    radicale = true;
+    atuin = true;
+    forgejo = true;
+    ankisync = true;
+    homebox = true;
+    opkssh = true;
+  };
+
+  # guests = lib.mkIf (!minimal && config.swarselsystems.withMicroVMs) (
+  #   { }
+  #   // confLib.mkMicrovm "kavita"
+  #   // confLib.mkMicrovm "jellyfin"
+  #   // confLib.mkMicrovm "audio"
+  #   // confLib.mkMicrovm "postgresql"
+  #   // confLib.mkMicrovm "matrix"
+  #   // confLib.mkMicrovm "nextcloud"
+  #   // confLib.mkMicrovm "immich"
+  #   // confLib.mkMicrovm "paperless"
+  #   // confLib.mkMicrovm "transmission"
+  #   // confLib.mkMicrovm "storage"
+  #   // confLib.mkMicrovm "monitoring"
+  #   // confLib.mkMicrovm "freshrss"
+  #   // confLib.mkMicrovm "kanidm"
+  #   // confLib.mkMicrovm "firefly"
+  #   // confLib.mkMicrovm "koillection"
+  #   // confLib.mkMicrovm "radicale"
+  #   // confLib.mkMicrovm "atuin"
+  #   // confLib.mkMicrovm "forgejo"
+  #   // confLib.mkMicrovm "ankisync"
+  #   // confLib.mkMicrovm "homebox"
+  # );
+
+  networking.nftables.firewall.zones.untrusted.interfaces = [ "lan" "bmc" ];

 }
--- a/hosts/nixos/x86_64-linux/summers/guests/ankisync/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/ankisync/default.nix
@ -0,0 +1,42 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 2;
+    vcpu = 1;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    ankisync = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/atuin/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/atuin/default.nix
@ -0,0 +1,42 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 1;
+    vcpu = 1;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    atuin = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/audio/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/audio/default.nix
@ -0,0 +1,44 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 4;
+    vcpu = 2;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    navidrome = true;
+    spotifyd = true;
+    mpd = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/firefly/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/firefly/default.nix
@ -0,0 +1,43 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 3;
+    vcpu = 1;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    firefly-iii = true;
+    nginx = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/forgejo/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/forgejo/default.nix
@ -0,0 +1,42 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 2;
+    vcpu = 1;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    forgejo = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/freshrss/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/freshrss/default.nix
@ -0,0 +1,43 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 3;
+    vcpu = 1;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    freshrss = true;
+    nginx = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/homebox/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/homebox/default.nix
@ -0,0 +1,42 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 2;
+    vcpu = 1;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    homebox = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/immich/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/immich/default.nix
@ -0,0 +1,42 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 8;
+    vcpu = 8;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    immich = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/jellyfin/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/jellyfin/default.nix
@ -0,0 +1,42 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 2;
+    vcpu = 1;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    jellyfin = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/kanidm/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/kanidm/default.nix
@ -0,0 +1,42 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 4;
+    vcpu = 1;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    kanidm = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/kavita/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/kavita/default.nix
@ -0,0 +1,42 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 1;
+    vcpu = 1;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    kavita = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/koillection/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/koillection/default.nix
@ -0,0 +1,42 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 2;
+    vcpu = 1;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    koillection = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/matrix/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/matrix/default.nix
@ -0,0 +1,42 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 3;
+    vcpu = 2;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    matrix = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/monitoring/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/monitoring/default.nix
@ -0,0 +1,42 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 2;
+    vcpu = 2;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    grafana = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/nextcloud/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/nextcloud/default.nix
@ -0,0 +1,43 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 3;
+    vcpu = 2;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    nextcloud = true;
+    nginx = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/paperless/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/paperless/default.nix
@ -0,0 +1,42 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 4;
+    vcpu = 4;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    paperless = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/postgresql/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/postgresql/default.nix
@ -0,0 +1,42 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 2;
+    vcpu = 1;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    postgresql = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/radicale/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/radicale/default.nix
@ -0,0 +1,42 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 2;
+    vcpu = 1;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    radicale = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/storage/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/storage/default.nix
@ -0,0 +1,43 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 2;
+    vcpu = 2;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    nfs = true;
+    syncthing = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/guests/transmission/default.nix
+++ b/hosts/nixos/x86_64-linux/summers/guests/transmission/default.nix
@ -0,0 +1,42 @@
+{ self, lib, minimal, ... }:
+{
+  imports = [
+    "${self}/profiles/nixos/microvm"
+    "${self}/modules/nixos"
+  ];
+
+  swarselsystems = {
+    isMicroVM = true;
+    isImpermanence = true;
+    proxyHost = "twothreetunnel";
+    server = {
+      wireguard.interfaces = {
+        wgHome = {
+          isClient = true;
+          serverName = "hintbooth";
+        };
+        wgProxy = {
+          isClient = true;
+          serverName = "twothreetunnel";
+        };
+      };
+    };
+  };
+
+
+} // lib.optionalAttrs (!minimal) {
+
+  microvm = {
+    mem = 1024 * 2;
+    vcpu = 2;
+  };
+
+  swarselprofiles = {
+    microvm = true;
+  };
+
+  swarselmodules.server = {
+    transmission = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/summers/secrets/ankisync/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/ankisync/secrets.yaml
@ -0,0 +1,58 @@
+wireguard-private-key: ENC[AES256_GCM,data:oJkwX64LSXAaGXvEKbK5UPVtgFbFZSh9EQD3s634fUR155TT7yxI2YcHd1U=,iv:y666pwtBDTF7DMWx4vJu65VEBnuPBDCirGeVkntmVyQ=,tag:OZR6wxla3YYEZ2KtNbKnDw==,type:str]
+anki-pw: ENC[AES256_GCM,data:CVZxqubgfojCeA0=,iv:Ux7k27srI1bMh3nBlGGkuimcJkKkmkjaNBph0X0o5vM=,tag:yUfVrCl1srD1V+3wXSbFug==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-08T08:02:47Z"
+    mac: ENC[AES256_GCM,data:bZ0SeyqYFrtn5P5lkuK1aVTKxoMVpN3+CHnvMFp+bIYW3eoDTEAey7otLh8psqS+0r9KnbsDTODTfVn2fX4xmRCI2bchflcJ/O6bnGhFjx0dVlmQXVzZg8LJe4+qvFxdGbwh5yXJnE503wdF5xN6xuvOBLa0Z5yOIsmd+X8c63c=,iv:8BXVbteOxr8ZA5Lo0sGN6JhFZF96gdwy2RjLMgfWPbg=,tag:pBCPHAUeleUaOCMJgGjx+w==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/atuin/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/atuin/secrets.yaml
@ -0,0 +1,57 @@
+wireguard-private-key: ENC[AES256_GCM,data:CBL7h5Ip5Fp5tnY0Cg5iRC2MKlPjh6DG9BRVHbD6wuTO/EAV7O/OpSXxxG0=,iv:WnBTR+0GwmUO++JhMd/2alVuIPhXBT50Qwc7Z9umVC0=,tag:4j5ieGF0gedQUD8SWBEQ7g==,type:str]
+sops:
+    age:
+        - recipient: age18cgqlely56hgmhscllkmafwpjdk6dwep6ej3vkk97dzemp8jtuksqrrjjl
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsQjFBcFdBNnB4M1NnT2FL
+            R2JJd0tKME9IMXZzdS9XckJGenNZNUFHaTBNCnJZUzlNdHlJbUdJeklSWDZmS1lI
+            MHNTbmY4Z3pvNmE1M213QlNGOVhnWVkKLS0tIGNRQkIwZklxRkMxVHZnZXJldlNy
+            STVlb2VUNlJqMktneTE4SlhsdEVLaW8KmPgkeyA3S4BI2zaU2QCcpAXrkG5pRMZt
+            5nVp+cIBVipDRak+ZmFWpghVUAd6J4rlW/U/t+S6mzRfP8Ni83zOsw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1nanlervuderw4qskcuessycqy2yfmptl6nym9scgp9ky2265ssmq3u73r0
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHQkZmRE5YRlVMZUsrano1
+            K2VaNnQ0MlVhamx6TWtNWEFtTVczT2tmc0U0ClcrUHJJa0NLR3pYV1JhL2R4ZFF3
+            TDE1VFNVOC9tQ01ydVdGTHlHcDBwRlkKLS0tIEpVOVVGZVNMeUJlYWQzc1ZuSzR5
+            Q2c0eG9Jb1pVZWpVR3FzdzJXMXI0TTgKQ5u0O365QUiNPXsopBVSwwhVLyqGYp3i
+            16Kbj4C0S7tuRzOQObuHgd8zlvgNM+qmqQ7J1mf5VNLn57jLcfYgGQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-07T13:36:32Z"
+    mac: ENC[AES256_GCM,data:TQWNPos7lbjMFN3w8gMUBdik0YqMjW6Wa0qBPHwrnnJZvpOJqzKBmKK4boHD/7kvrOD3yo7RKdp/n2gAJBa0+atSdV6LLf8gFBPOHFa6YWEu2adOjtayDetQiCy8G9ygjC4x/RDt25SUC/+UbgeKuoMKsjN2lOZFe+/zwAYpF0A=,iv:6l9Ev9WQZQMrLhC26z6ydBmbBtQJpJHBM/s97X6I3hk=,tag:QTQVTjOz+R19xWgWOfWC2A==,type:str]
+    pgp:
+        - created_at: "2026-01-07T13:15:42Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTAQ//VjPq0XFqmIXs5IQqTnCCYVYYF93wOrBagxx2NjI7/f4B
+            pOi0v2a5DJyBAgntCLTCP+AdglEz9QvbFOcDPseFVukmg6c20YYaI9gsq4wI46JW
+            Ws3j1nHe8nsh6TGJEpHw8Tmx9YrNymXaiwMtpsCfFvEhKrauscSvU4D2WTR2XrTH
+            nMmLZZkeZ/i3upivrOIMlrogBMN0/Zv0Cb/LBW9ifXen+Rq6LieYuHwJjOtyL9Vj
+            gpUzqVNutBwlLpoDbb+mRMWUl4G0rVckB6CIsuoKL8YXZEflWF4xO4jxBoa9OIGh
+            ty5faencnlUWCg/e1NwdoD1U55Qu2Qclu3sfPh4eIdIjcJ4AOhWlfAvybiANiJJO
+            7OOALbo1/JJTv5cghVOtOhG7xG5g43WwqH1g9uV1cpUhvyB49Sg28b2qIvi4j8bj
+            zv2jMj3yceWstAmnqBW3CSWzO2b0U9+k8O4xUo3eJ7Qz1rn5rR1gfsYRT6o7+ev5
+            VFRBaY5ax/y3/hxCfvXHsi+ZkvKfoh9a0t2zZrSU9eNxkPNoQTEDqqag0+/+aIJ3
+            kesULKl1aANNlk7y2K/B3Ycwta/zSN4lAmMUM1v0H1TlgXBsrQHbv/7gvtrmIcBS
+            i5fiS4S3o5PEv3dj00LRHYI/mc/yGiwrn0Lhdn5unE8HiQx9f4o4iopE+Q4foIOF
+            AgwDC9FRLmchgYQBEACGP6RDBC9VrrJqwqXHba8GTgKvjvm1NdHVkswtbBEjTjRp
+            UCV19Tv1XLBF5jw9eom4ltTgf7PnOxvgadtTptGbT5/TzTPp6nFmAqjOwbyb9OZ5
+            VQ4vOyJYXyTokrPAAO1zVEFL3dWVgeZbaGBCD+SoP5I5MkHBTvOiNySZajjyMMzd
+            rdLwx0HGYHVqhYs9cz+kBitPHino1rFvgWXaWGOb7Oi1IrxIF98Qt/xekST7MK4w
+            zXzVU1KJBbInvOzx7wISSknK3R5TeN0WIxRZgADgKa26nc18UrzBggx8l0iach0N
+            GB2vUsiNRT4DlEOG6qDrA1PlYpSWvV15pH5yoUF9bhSWQCIxpO9BOEI8DJ3FnM1l
+            cjA4GcoaU/4eBQdsW7cJ6I6w/8nPHQbrCjZ+XHQ+a6n6RBK6oNdvj2fnjXy8KwV9
+            o9xd4w0ogDoN6h3qjlUxmYqTeZOw8cHNRVcG5fGNPg6jkZINqeVemh43sjeSt0qu
+            fMum7u4lFFrUElJasFec6SMDPgssMf+9VKpBDc33+hiY/g7i65zeTbfFMojBmt+O
+            7MFSguUeQZi5ULxj7FWXLdpnl3nfXK0mhRbuoG071Byo4zMUfNVdeTInKlHxRiPa
+            rgXqrAJHoWngo9AKuNVQ8VaSE4lPCz2yrmsCHNkRkmNuGwu8lJgLGSEIvzXaVtJe
+            AQy9uc7cH1zjV/t5MdU8AThSyWnKCp8S5yAAaNAWc1zBj3xrqXuzTJurK5EbwGnt
+            i/r6xnHZtVW03VXM9KU8VvgV0mJHgEiOu5IjLpGq/16b2Wt8xBn5FI/a7hsO7A==
+            =DDOY
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/audio/pii.nix.enc
+++ b/hosts/nixos/x86_64-linux/summers/secrets/audio/pii.nix.enc
@ -0,0 +1,25 @@
+{
+	"data": "ENC[AES256_GCM,data:wIROKHVWuV052x4k858oCq+xZnub2DyGwVWEKbw5lwvIbat7q7GXawrYlX2owKXaPUBGjOmktOHdXIlal2TVvO1+9cXleYtcEXBsK7ifSfxTmLzDa3aOR9c2jqFehvxUlZ0NdFcAbvy4dAi+I8Olt/29gruDmRYZGXLUb129FeO2ugdzpNL2nAg9SAR5p+QWpo86TwwUFf2Lsil0YBBtMgdVVjcPHk2CP+BnZM3PNNqh+m1fU09BNpwTyXw0nEsL7L2eMYm3bjP/A72WqJckugdX0etN9ohqs1DdunQyuYnfOeMVMYlPQKQ=,iv:O4rR6PXzF5gflvcez4kjdPr718wDOacAhxVVMvZFKQo=,tag:n4xVVTe42NiUx7Gj/52mwQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age18cgqlely56hgmhscllkmafwpjdk6dwep6ej3vkk97dzemp8jtuksqrrjjl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwajBWMFFQNGkxMk1SVFI2\nakJnNVErdEEyNmliRVBwZ2tYUXNKeUVRU3cwCmhWSm5MbWlBaWRYRzNXODJ0QVhH\ndjNOVkNFdlZ2VmlMTVJmQzk2MmUzc2MKLS0tIHlCalVTaE0zODlzdUlWK1lHWU1L\nVm4xWllJeStzekwyMVlqdWxhY3J4NVkKgFf+DpK5+ChVdS9Mz7Xi5/8hk+IH0BrW\n6rMWdhK4uq4leM2b9UjJf9JJSQFj5/ZDmC+WF2naewVFwjM9B5rQZw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1nanlervuderw4qskcuessycqy2yfmptl6nym9scgp9ky2265ssmq3u73r0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByRTBWTi9yOU1icTFpbnR4\nKy9ES1FpbE5Gb1FTekE0aHVyYWdFTE1GUDFnClpCeDA3RnBtYzV6YlhRaEkzYjIv\nQW1GZHJ4b01ReFIvbGpmU2hMMkxXYjgKLS0tIG5tZEx5V1BnQjdIdE1sODhhOHor\nbFZmSy9Ya0FlMEtxcXRtUGNlU2VjZkkK4/ejnIqhbdC8BSDVrW2uw/Xrxh/lzX5N\nB15g52lsvdCbIrUdHzdXQwOQuqBfQ67sHpUZxCHoJvojQuc/dwB8qA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-08T08:04:51Z",
+		"mac": "ENC[AES256_GCM,data:xEn7TvlAZnYUuWOoI6e5gB5lNYC+xAmmRNdPis+2m/AGNhH+++c/hu5xfLTqYOMXfs1QhD50Y93xXCT9C60J38cFRjnSO86NGB8hITYLVVBVMCd5LIhYoAhUnwg1+6bZ+gTjvY+sseh7WJ1dbfLMa7liWwtpKEY2PbioekKOnjc=,iv:X7O1YAaFkB/+aKd+EP3HK9JHJeLb6jRTCkVKLoaNlW8=,tag:hydcLTO6vj6TIS29maniaQ==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2026-01-08T08:04:26Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAwDh3VI7VctTAQ/9E5jKJGSxjC4tTGfMXcn7y0WeP6ieFqFUev+wKhv2Ko8Y\noODbbdmsv+lGF2RfgAnOUdZ5TlKxueMg3npLlSRDxCPretpkOaEjxwuhTkRK69O+\nZUClaiL/LAg7iVq8LSo/gDH4w1ObXPB/wuSguMuEqaVyqJNqIbOU+kKCy+jSMwoH\nc+65puznN5jUYd4mPKgoY0mLMYxuK+RBmRWMwDwLmRvm2ZjOqx/mgv1zdb7LZOfX\n4z5XRFfNMPV1qUo0tGC/KBxAXKie13qJu5diAZTWaqlf0s+rhZWCVdqlyEWmI00m\nUeArRnw+23uSKQgHOJ7dlqNiSCRdoKtcH1XjyQNfGMTYinnWQBSvHYuA5K6mTsEL\nQ+flp3jLj3AxlIPn4cV9KX5nZtRluSlnA2V3oY4U3amsFeJ1GhJ8+veNxd4YcIyj\n2ZY8lLfCS9saVf2tAWBdKjvhbLD9k3pTUXLNrbknAZjoVzqkkujUfmkg6oOyb4JK\nO1Q5h5EFlRyIs281iWR0u3kLyhA3Xi5s1NZWSGd51E9Kaf1y8wfGMK4xC1r0zBAQ\nMwOJcrNjlNQGfKdANkWfjnOC1RmGELJ9MoKR6TBDhtamShrdNRatFWxsPo7FX2MT\nzy2xWPx/yi/bbjjj98hyiKI6n7Osan/DQuxC17B/5FghjTXjO8QxY6ueF3Bj4l+F\nAgwDC9FRLmchgYQBD/0QnAEJRsUnyknJ+csmzHaLzYOVPXNcEaftkMLDFSrtFT5V\n2TLARxyBaOWCdszX1VnMNrlLfdMLzGO7oX2GnwDrR/K2e0m2RZ/Nj7InWFhatLUS\nkCdrqkeJmOTNVqN67jycCKthfiSp12sYjR/Ib1l8Yelf8NlVr51ULUlonaRcP7ji\nXr4UNlg+012M5sosE2HRx1f92dQWv9we9t5ZQz/y9RaDnOlx5jgFkOzbTt/JSYHK\nEoYNLfvzebwwsfuZU9++Q0TEcAQGJ0vGoqx6ijb8fHZ6dlV/PLZv2G2aFpr7A2bI\nXhgBT0e1HPR/UsLy+iqInjTNELL1DX37DPYrwCgMMQqtCuFOhm0PvHxWNHKHXYLo\nMKN5dnapaNTKbjaZxBjCEv/PGWkiYo8Ho3HAPrI5XAfGfvOQQfpNQI/vdFZ2YxjX\ncw/waW2gPkDz0UlsUeAo1FzFsu1esz7P1BIX4Xm8v+dplZqTv9rZ6o7qed+0vka/\nWIdHvYgcaSgvzhz6W0NQqGcOLaOX8pqYJ72ioEjuwXZjAaY+/ZVkoYeFHAa8Ujzd\nRvv7nYA3WQknaOeUALruaOXZUMT2fpxNylRYaGZ9sEgXbyTh7TI5x1QssTJoNGmI\nxYA/d04CAVGBvqMMT0n0TL/QIdAMfyO7iKNhcjaakgQi3CMwYxMRq/NkgZJxQ9Je\nAeG/i9KsMknPTDNndFNOO/omjosqhEOA+FxeWWbT+FHdtxvPbVvKHBt9+CBIYDru\nOca/A/eslrtYbiJkBaGzrZtskPi+opIf6Nrn417B8fl4q8QtaFK4ndq5B2YYbQ==\n=XdD+\n-----END PGP MESSAGE-----",
+				"fp": "4BE7925262289B476DBBC17B76FD3810215AE097"
+			}
+		],
+		"version": "3.11.0"
+	}
+}
--- a/hosts/nixos/x86_64-linux/summers/secrets/audio/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/audio/secrets.yaml
@ -0,0 +1,58 @@
+wireguard-private-key: ENC[AES256_GCM,data:9elXuNwaA1gJ/KtVnlkFbovrDGmPUfiUAlzejwRzUlCL1nL5klXsjn5BUWY=,iv:38u4rFzoidMYBhEs4xXeeJH5RgnpRqdKKjbuVU3d1bA=,tag:HJqn/RqdSh5zDyxwBYST2A==,type:str]
+mpd-pw: ENC[AES256_GCM,data:prKWr8XWo2jc3DBwqMcplwS5tUadHx4RWQ==,iv:jmUj+89dCc3cHjejikTfYIXlEI1K2/Uy3uSxzcx0wbk=,tag:/hXqt2ZH9pU0IY0gMmPl+g==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-08T08:00:54Z"
+    mac: ENC[AES256_GCM,data:QMkeCVeiq7+b4ft6ykag3VO5FDqIQp0hsBTnSEduYiA0FIR4QYmDhGVHUipUSZH/xllflxMv/CXNQqtW852LWWy8PXn7GzEXn3nEjRBZi89sEOoh03I6SfQMDWYR5wjKBy1hL7e8dZfEGONZobViM7U9YynEFqYpkvd1fK97DB4=,iv:MbchKNzaDBMF/YbBxkEUwxA0Uc/+fju4dgl/28trVV8=,tag:VwfuskgULOyBdJmJ2LCVxg==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/firefly/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/firefly/secrets.yaml
@ -0,0 +1,58 @@
+wireguard-private-key: ENC[AES256_GCM,data:PGK3JHj/xacJgxx6Ubwz/3bQlE2hYQXM6A2LvGlI+MeRzdLErTcZ4m0jJKw=,iv:fvDsmOJGvKzfoLhJzx6kab5S2kPQ+YwB4sXG+I4baRk=,tag:i7hHSnUA2n5fj4YK0L+9jQ==,type:str]
+firefly-iii-app-key: ENC[AES256_GCM,data:Wu/gr1vzVcRXm96hTvSO9bIRsvZ//2ZsTVJ9igrPU1h5dGV0fkI4rwQfb+5zhy4f56Na,iv:5+c0DYC0qVNRQMwibCpWfN/ZIiDUTtjXhKuZxMq+qs8=,tag:Jx2axAZr95/EqvH2gl+rYA==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-08T08:02:26Z"
+    mac: ENC[AES256_GCM,data:lqey6BT0Wf/manMLp7LyApRqtnerCHrPndo3w/9i3GBkpWeas9JLx6+sXZFdodc3tLjA00FF0MLm0sjDSWSz3fDfSclVNEYWUdrspH9W0a6p95GAdclJARna9ncVG2pn+Hk1QoD5EjEhvOayz2A7e3yIO2aBh8U6coc21h9L0lo=,iv:n68z6eL9UYI28eBJzYe+1QLOfkE4Fba69VgOCnFVELg=,tag:a6jli1+cn8s0Mlg65sVy8w==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/forgejo/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/forgejo/secrets.yaml
@ -0,0 +1,58 @@
+wireguard-private-key: ENC[AES256_GCM,data:2/usWvtboQJ3Yc5ixT/7ZUvk74aZqYr7ZUZVE78jvlSZzfsMrXWjWxC0Bug=,iv:4nwdd+4Cr2Kjbia/5s0f2C1O6vyaBxQR8TUSKyAqJhA=,tag:ymJLP2d6SGgVsw52S7q6uA==,type:str]
+kanidm-forgejo-client: ENC[AES256_GCM,data:0S2Wt2/hP8e5qMXgI2cM3GApWoQ9pEHwiA==,iv:Utq8Q1LWk0TefpcwhSvXrulrgslCSnPanGGHSMPi/pA=,tag:ou/1y+DtFi/z4P54zzZ2Uw==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-08T08:03:05Z"
+    mac: ENC[AES256_GCM,data:Ko12SPrZ65B+T8JIERI8a08uN87wwVndIweIxbr+TkcEsRyLCPziB8tMsTGtDIZkTG7dJywT/SeZ9gqnMgiH9mvsk7Uqi0hrmEf65fsqCVGTOi17DBRGS2rwbXkEmT3xiSL2LSe6+9rjlZ5B9ZUfO3hdhw+jy7rSdcaLu7R8LL0=,iv:GPBDabdBLbCYuKr//XlC578Mpw9LGJ/gM1etek/PtWI=,tag:5/qXhTCHxiCRka4N2qYVzw==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/freshrss/pii.nix.enc
+++ b/hosts/nixos/x86_64-linux/summers/secrets/freshrss/pii.nix.enc
@ -0,0 +1,25 @@
+{
+	"data": "ENC[AES256_GCM,data:tGnvFaZgx1Gi59DYlV/4+VswuvBY5K/XN6yomaFk9AnsslowtKAPKHyH5dM5rqe0n+Ua7kI=,iv:qwXybQUGanHXQXzDU+jJn/FI5mmi+PNUOCTsh97tmDg=,tag:jQtXaFNJL5jeTtSodMCmiA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age18cgqlely56hgmhscllkmafwpjdk6dwep6ej3vkk97dzemp8jtuksqrrjjl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5TXJSbjhWcnVqaWlKV2M2\nQ2lNUW0ySkh2TFdLblhmMWxuWXhJSndFc0ZvCmkrRnBxT3VRc1JoQzMzWUVHMTlr\nc0N0R3R6SzVwOHYwQXI0eFVOakdQWlkKLS0tIHcrMXBBS0lRTzN3Nk5YaUhxOFk1\nS3FpRXFQRTBNL3hRMTdlSlFXSUdSQ0kK3OhWMXUSPhfADCmiuRfsIv+GJ0SY0sar\nVchVKmqPjGg+ALF/krwjaIcE2zrlK2tsngGja2rO5vZ8YS5BFzVQ0g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1nanlervuderw4qskcuessycqy2yfmptl6nym9scgp9ky2265ssmq3u73r0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLeEV3YXJqaCtoTUtVNzho\nNk9Dbmd2bmNXTUx2VS9rNzVhTmR4WEM2Q3hBCmo4QnlMN0ZuUHRvUjhZTHdET1o2\nTmw3TUZTMEVCMGpja01TSGRCTTExY1UKLS0tIFAzTDIwRHplNHFyMkVmUjVxNjNL\nWTQ3YWRkVnJoWGRucTJHaXpHMUN3VkkKFWSY1u7Ksv7SO04f0pzRYSk0GWz0lvXv\na3Pd+lGrH0q3CX1i7beq587bNgqxTdDlWzsSQSAxWkacqwb1eB3KAA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-08T08:05:49Z",
+		"mac": "ENC[AES256_GCM,data:sIUIH1PfvCnm2nlmUOCHX/CihlLTcNP6PWCRH3tqpwS13uYF1DHv7Km0DiZJ48YOBbCiXNwEVzCttem+BXCvi0eDkqUasAIjBOmWBp+W9Z8bnDk5luztxLeb6OKqO5/8rrR+bXgb5Z3cRiV4VquVMA0nOkHq4f7HvQ3UyTWtJTs=,iv:hmKYcWSfdnI+mjUvH6zO1PP/wDj04H454arzROjs/tE=,tag:zY+CBOj2DNRhKNkdwnYhPw==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2026-01-08T08:05:35Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAwDh3VI7VctTARAAmEfso+foaYdccWYWrumexWByHdZHdC2PzyiIWWUIddY2\neXifkUu4/x5lI2eRrAGqUTJqbtwlMloq4uUcZChkTRXhOv7NLLstnE6PAfhsCOOq\nG76DjeI3cVQnFdIP7krTHPyZYBrk/iq2KAh91EDYQnmBBKy8RT77/b0tzyJgpKOp\nIs1YqMQfP6RQJeDJXFGJy+KljTsyn6lxRjQ9Fa8N+UmbZjX8QW8ZNU+Za9J/r+5u\nlznZ/V02jB2tRpOOnJSORrLMy7mIMBN6j08hbb5T2dcHQUTnz9VEJx10FTHCY43I\nMFGzt6Etv1Pd/TkGQILlY6goIeyTzvlfa2Kd+M0N5YzA64MBhOHCJ00yB3rIAy0R\n5a6BWl6t9zlU+YxMTaC0bZdclBp9E/4uDJBVHWcWTRHKgiYndFbIq0uc+FUSQnXQ\ndXM7f6wSLOR0Gk8pUXSGyoi8rTYri5DKyVeRg6H0JddIkEKMLBx7UD9Z1u9kFpTE\nqlJuYip+95DSr7UbE3WSuoFmX+ZHv2XCK+rW9k8MNYu9EY2VbE+dmHCytITpdrlU\nJyAHfIvzteRm9Ub5KyYkZU8O2ARfP7V49p4IGZDVPM42IcERbpmYUORi83e3VlWt\nllYrORH/l4qYLd6LPQJVhPOguNlHk5GomWo5ozd1AQWmLXbX9E7uG+zvo3QVAgqF\nAgwDC9FRLmchgYQBD/0S7E4be6vcAb9P9WfwPWiYR2SGa5qZCGsgnXmroAYft3yc\nxFM0T/NP8Q2sFT4DU8rn06jBQnKG9sb7hIfMTOTbBzrERQEPwNOOlhRMesM7DlIi\nHG5VTvkYk1k3akYjk5L9WCE7GMU6ZUb93K3DamESt1bxwdRm/UwrcgdbEu8YHX4c\nm7rLg9T/f4OVojMh/gKZ9RrwkpZE+d769FSOql42gTLheYjGWarntE9TMFZGnOZ3\n5KTvl8AfZwN+j7/LIu/6EtMhvmHy4UHNR4wiadY1ONQ1hlPPapBbFdayy6ap1azb\nK4e1vYFOj+8FnDO0TUGidZM7JUoOSb039Tc6lcI6qc5dtusQTJyD6kBX7BJq+mgU\nCDbgMjmLdSU8d4nTHB1KWZimIDoGvste0+sF6f4cBHfYW+QzqPikYlw8TdZvRQ/1\n3Q01dEgg7LrgNBjMSUZvfaYYkcSz+Uqkhs0vq65XLmAMfGKIvqFrqPSjRuJ5vQV7\nByrRj+rL36th/3Jew25sBbR4RIjo4otfSWIga10epijVs+14D2g6c+bKPf3vk6ZF\nT04KP80pLpk7zTlYJI1OqxJFLMiONZs5LxHdfNSMFGw9euHuODQVPKZBE5c52KhQ\nn05tWLkOBzyiiAd50fzaVQxa628VBhCHFlIG75ZC+wCgV+urFasooBRoUhxAntJe\nAYhJ1fiT5W/vhYZy8AVDnidVPv6EpZ4DwF7E4wm0rx/Vy/np2jXiavraMGEL/m4/\nM62snldKaZgGFc6K8DTZdbrGBGySZ2LvAP8QYNGckQ5CW/5CiCCS+NEqEVKhZw==\n=FEUR\n-----END PGP MESSAGE-----",
+				"fp": "4BE7925262289B476DBBC17B76FD3810215AE097"
+			}
+		],
+		"version": "3.11.0"
+	}
+}
--- a/hosts/nixos/x86_64-linux/summers/secrets/freshrss/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/freshrss/secrets.yaml
@ -0,0 +1,60 @@
+wireguard-private-key: ENC[AES256_GCM,data:NrUaY1DMA+fOLEZ9kPJmrCIHUDZxg46XFjcxTkt2Y11WOTl1ky4BYEXElgI=,iv:VAPVXRtIsHQX2DitGwy24dK+9zq2IY0nL7BuZvl8xXw=,tag:bKC4BGI3CDl7qhM80ak0GA==,type:str]
+freshrss-pw: ENC[AES256_GCM,data:nOwhGTTUN9tJkU8=,iv:6urp7o0LewW2yQep6LGEWUn7jxk92pLClOwWyT416R0=,tag:5V0xDwwjeEdIlaU0qNJ9nw==,type:str]
+freshrss-oidc-crypto-key: ENC[AES256_GCM,data:nEoIHlKXpgKlJ1iFKLUdb6QVcU8fMRoZ+oghGlrnH1q39HjBrNrzmA==,iv:7LWlVkeaviBlsU6aEevF/icHgROR4uThxCD59txUmTM=,tag:P/+UQHHz+t8BckaWhjKYig==,type:str]
+kanidm-freshrss-client: ENC[AES256_GCM,data:BTPaUyI7qrBpiB+0zQKJw9odT0fRLc+zFg==,iv:9u25+thsHm+0Ganm0z5QtsgFBGccpAIPQa0aYqqHkXA=,tag:cgCvMIs7jUMe7QiDPznbtA==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-08T08:01:49Z"
+    mac: ENC[AES256_GCM,data:+RtsIjA8DXxCGeTqsb24DQdP04/8oEvviiYp+SSfvCiUL4nu/WkAIAHdcC+Gvw379vnq1N38JPycB3mQbyabC2lUJ85oEMmfn6YDdsoIxvdDuJuN5VGhLkqXdwgkfJZU+e1XUDkGmAalWeNFTlE7i51qecVevdjPf10YW/V1QZw=,iv:TEYHADkS50xgUCQ4ftWv5YcIqSX+cYgeNbPxSbp0+fI=,tag:+PoSBjFfV99vOZIkNJaXcQ==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/guest1/pii.nix.enc
+++ b/hosts/nixos/x86_64-linux/summers/secrets/guest1/pii.nix.enc
@ -1,15 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:pGWiWA==,iv:sVpYJiphhvVPEo2MUMnpjlJmvf58/UJTTVVdU9dpqzM=,tag:2AsQRCyN9Pc/hnqviCo43g==,type:str]",
-	"sops": {
-		"lastmodified": "2025-11-06T12:11:19Z",
-		"mac": "ENC[AES256_GCM,data:NBAgy3MNd+p8Ih6v/JuxuMWgh0k9xj5Trg7mggBE/LrxfCZg+BpbhYcmAw/FW9Du5gq3Pcynnql3dqwKlzHEtkEOcI1MJSnBSWexgLxwEtRwbTJVOqEkCxby6dcQ4HWD1ZZnwa9Q7Cg1vcPD/yZuzVUH15mFHic7s5M5Xzdfu/w=,iv:tv8CFuXJ0iqh/Vho7vSoOpfhcGfCElMLWNvjxoE3fMg=,tag:pGP3CjKFFm0UuVgSCnn4RA==,type:str]",
-		"pgp": [
-			{
-				"created_at": "2025-11-06T12:11:04Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAwDh3VI7VctTARAAwZd6dmNcZqOWY7Ro6DXCRAD2LJuzR0AA26cRRzPgTPcw\nOwvV+Nh3hBWcZb5qkjKysZKGlIxzs4f02dKI172vUyIWQ6P5skygOOOpbr9g5171\nY0XTrmemesSKNfoUhsMFMCbFUc4HUxkUK7zadLk1AiBUqZMIFtx/riFMUBS2qTpR\nuLWiebt1Dw+rwcR8rBNxXPbeclm7322YOQDLUk4sHfi0vTvn+3sfGkbJ+OcJckoD\ndjVhWFqGUAbbELoR8yHpb+Ps6RYjKRNFNros9Yx9zQ18512gxOpRSzm0MTkKFyrz\n1UYVcv4Oz4W/e4nh1z2/re5X3l/HFUzwBG6AUTrYVuRo580kkZvWYFxHT6R+goVC\n5dhkqZpowrGpDIE/C7hKLenFIcOl1Nw5wgJ4Y9EmfZzorUnjJqT1Et2b2GU0hxvY\nKny+fiDeCfNdLzJejSNNg1/whoVmHbw3Q2aBJP0NL3nmNvaykO8RSA8WmzvQa+MA\nXweflh5G9lXOdH2vwb6EelOXpxlTjI7K/43Nbw/SXf/e1FKYK5l6TscyGEcHpFux\ns4ufYkCqTgxdKZjKwh0vqbdmbPUOCe/jqBOz6s/L/sR1/+8c2iIs0JVZd1VJSvDu\nIdfDfQh4wmso8L0qpjWimmkf0Y9itLWZo/oyioIqjVQ9+Daj2mvMkbKcSa486b2F\nAgwDC9FRLmchgYQBD/9lVmkHkPz5pbJV5U0nL3h/xx0JSyt6YYtLDacW8fw135GT\nojHijHvJAd1MqbNv391LcsZ1jtnUawNf6GAkr649lRuEH/WhNitXq20Z/06v5lwt\nGDhPMMf5uh+Uwgjxbeg/PFeTKILS2VX0tjJ8yeos2jNMOrmmwIg74V6mJk03E85K\nId06e2qNjzWlESyWOCFkfLQfSOTajQWmGyil8vNglmjuZdzLSE8eL6nA0hePnfJW\nOwewWcXEzHeeJsaevKFBBDpimAqi3XbKasQbZNSSFlkmw0vzAWKw5mzcdTMseae1\nLafjem7uw2epr4HIhwCZ47pCFrKcbweZMuUY557SomIGmv93OvglnZC40AYkJuNU\nIAVwNc8W/pd+jyiHh6tMlXfQ5/n25AcylDcacxxalNcKI0emNC90TsFc6wDpLh5D\n+R6kJ7GK8tI5BwIwtGIQmFsRREKE1x+IYATtKwQskb0Rng/D6eqNEvs8pjD1nGO3\nfNTG9G8PgC07TXSKGcNGytZy/GNSW9mnFgDgoiqh29bgfoJfSTWWvwZlzFXdWm0c\nzOiV5JSDRLewaqzhsQ/etms7qJIccRD7WcvM82x7UF0VYGd92EVsZxsq2aSVlMob\nCsxNXxij3qqNHdFgUuYYDzFym3/zmmi2wltPOZl7qYMhZI9P6wCsvDpxlFv16tJc\nAaBkBf1oOnjDvJm5i62KCEcRUmphKOB6Odr9/VHkAtgjPdWCOyge7ktbcwgsPw8L\ndemiSrNAglDX9RnPST5ggShZWn1Ik2mFfocCapvGBi5Hj9I/4xG/oIKREYc=\n=Ty0h\n-----END PGP MESSAGE-----",
-				"fp": "4BE7925262289B476DBBC17B76FD3810215AE097"
-			}
-		],
-		"version": "3.11.0"
-	}
-}
--- a/hosts/nixos/x86_64-linux/summers/secrets/homebox/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/homebox/secrets.yaml
@ -0,0 +1,57 @@
+wireguard-private-key: ENC[AES256_GCM,data:uDvv70RDyd0DEA0IAowsBLKew2k1TzMPmrVmIW1ZuMtSYxpstq8x5l2MPN8=,iv:02HfUl4lUkhlBzgOfvv+hRoyMMAaGcf9PooRAZzgjK0=,tag:dL/qhDLjzMP/4ENUcF3WHQ==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-07T13:36:38Z"
+    mac: ENC[AES256_GCM,data:4ZeARGvSyuzNT2vFJ9ou0JeZ9wyTU443BLHINsEzchHDCB/xlMjhrt9N0DIX+EfkMZiRukUw5C56HNgBfD5uEBgt1lbdBfLQOnUgVlP3EC7HXPZXYEOtS9kj2j2VTBHnGFOZKDiBVgQNJkJ6QBmJtx2rEwQcCax3DeHO/RyLleY=,iv:sCrpoKKTN6X6GoxPQvSaCaiY3b4o9QzLWCus62ltLwk=,tag:kN4UXDS68/OvEi8ZYafLFA==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/immich/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/immich/secrets.yaml
@ -0,0 +1,57 @@
+wireguard-private-key: ENC[AES256_GCM,data:rTVAsx0XyI7i1coICpFjANV6CpWSjDTlvdOxu1yLggei/XZKeRuDmv1PsE8=,iv:P0S+juvE3LswavDMPpoxUYkKCzGlYaaEpIg7DBwvoc4=,tag:hIrOXG4F5qkK10VIjtiggg==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-07T13:36:39Z"
+    mac: ENC[AES256_GCM,data:KYqOMm6Xk04/1nwEXaX+Htkovwa+RbHtZH3Nd9S/K1bjdZZESpka7Kxib+mf9ezBnTdJTBzwacf0bgQnU+rpQWxBvWz65K8RAHcJms0JoNYEPWJkIeG9/KdV2iefPcml5SOFID8Xr/KpISfnayS4CGUWRFU8DyDtb30g9DQ2Peg=,iv:3QT6PqinySd6lUWBNxpxBxsY7VVmrnFqUxjLbsMMYR0=,tag:SLkWHWnnxNn0j+lnGnJGeQ==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/jellyfin/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/jellyfin/secrets.yaml
@ -0,0 +1,57 @@
+wireguard-private-key: ENC[AES256_GCM,data:5o3vhdHriS1Iau5/wS/QM2IKlIGn1Aua+M9blroPrOgfBWLtLxzhBcAzJ/A=,iv:zv4ZvP5gIJ5Y1dC2H0AqqMRIGFE/QJ8ztp6yG/QfDZE=,tag:W6BWuHk594xqd6WwEN6n4w==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-07T13:36:40Z"
+    mac: ENC[AES256_GCM,data:Ep/6toPN64tEaCGEnO8dIUd14x5JB5TSfw9A5J3KFkhCAhCoMW29yzuqHMy7iBRwS9VqJS3R0g7SL8x6dIzsHmT9sZ3m0gihGZsM9Psc24NOi6iWfOLyNApwTsI+LhL1CEcspb/quvm4Nh+xSnYXhap+3+rPtMGpyVtgyNgN2eU=,iv:zhi6NU4lPOJ+X5KIbVpDS3mz418psH9nu8qtguKQ7po=,tag:FjePycuZddog47Wwmu94wg==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/kanidm/pii.nix.enc
+++ b/hosts/nixos/x86_64-linux/summers/secrets/kanidm/pii.nix.enc
@ -0,0 +1,25 @@
+{
+	"data": "ENC[AES256_GCM,data:C5d6taSxlSq3lOQMomUiIHWgibkiRuDYRSdmf4vJaSVdXcpEU5QfKsebaJOhRm4q/Z7A4QVb5s3NYeid0OTrAyt8hwjferxNMQpENsW+biIV30+c1u+B8Ft4b6kHO4B0qkDaAg5aFXJIc1hSGz5AKzq1RSkGH5psegcvKUymi7vEDusmPSKeesYHXMmkibrpRaZ4GkAScROFA07q6+3Qcn0unf9NTqH3zaAiO05IcvfetLCzl355BmQbiCdTZOLoooavk082oxzfKlYomgxnHaj0qaxjxCQ6sju3Bl/EsVdoRbAN2JloWJzUyGztVf1rHfTzAuswgBkj+VOmTajPqKiUK8oayL5FoCvHsZW2EAFlTCGsxtPEizqEAA5eXLSpWet7JleVTDh8jCCz6B/uonJDKi3SlE2b9Q4Pqm30c9kULcqSHppBoEdPF7wXCIcVCg7X2DGdAcjzi/UP8uOVHOt5XQEELRH3qXLQnVq1i9CtjRZADyBBFTASMm8WBySHIq5igKo+NdxKR4BxXERjTFmteqhBT4X5JfyUKc0gOkoN3OEuTgfWVTUATiLBJlGx5gUMWusfIPwog0g99D99J8PWJsrl4qrIH49Ns/QvNxEHUBXgdWvquZkfOiLMdjyapG+4yXM6yESz7+I4zGb7IC3VE4WPQAwpIzoy/wsioou1xOKtkFNX8fTszHY7GnkJVUcSGlspFCMLtF+zr5c1kEizVCEbu35i6gpP9+INAsy3LvJIFF4iegaSuD2jmCCpD3dK27B9bbwEHwrwYBHKexVlrbDrtcWBQSwB9jKTlVMhK0UbQU/+2yZ2/OZEgcesAl2q+sTG3hctddL37vnFcRR7FNvwGyEWorn+N/gpa6gIaZwCIzih1eHeraLq5cdzhHhRUtAbnBscfPntKTPOu7EMb/y0F/cGwV9iX/BSy7pbIfaiyOoVB4snyrty5r3tEi9ujghcqi7GObuySToGhJmekQbREUnGG6CRRel/9f0326FOCsiS5MEDXiaqO5mNVI0IcMunSnf9dGlwNAqi6B5+Zifrv6PPfi97LHklGjoLxG892R36lM1nqoU1VmEJneP6mmCJ695bTaZT8mUmasvoJJyhz67xrhEFLrRVl0gd8b5S4eXlghvP/WDBLd1mPe3uKmFzzqouhIO/JtbkL0D+IZWvdqShlGOWm+Sz17Au1YP7GHMWR20Hc6JLTVW+LMLk6UThzM3TnEgEyFgk6Xc5HsJG7L3Jn4aVzI1Ye3m18sHB1cVsWS7R,iv:sgvuk9gDz4fAzPae/pTkIklwUgI2h060SfBYRwcnzsU=,tag:cOUYD7HldKqLL8rxPElChQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age18cgqlely56hgmhscllkmafwpjdk6dwep6ej3vkk97dzemp8jtuksqrrjjl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtUUh1YXJ0VXh4UHJkWGxy\nNE1nOGtnZDhGRjVDdmhTQWZHSGhWY3QwT1VFCkU0QkhicDZpTUdDMjNGY1NqR0x0\nYytac3ZZbHArZjl4MGZRWGVIQWkzREEKLS0tIEswTnRpT2hZdU5sSUxUcTFYMGxR\ndE1DNlh5c3g0NXorZTM2RUk0YmF3NnMK3JvfEq73WuuzrAXPbR2BB4orj39P+KU5\n0ICepOK4GXYWXbmTDqTb/vn88uB8iaTl3F93Wv7VC450miouEYmcxA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1nanlervuderw4qskcuessycqy2yfmptl6nym9scgp9ky2265ssmq3u73r0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5elg1N1NoMDVXdGU2TzBW\neFl4K2E1dXlWZFlQUnhSekV3a2k1ZjNKYURJCmFZZ0taWFJuNUlrTjZvTUxTM0Zo\nZEVNcDFvdjhBN1FGRkpNWEE3bHpHM28KLS0tIC8xVFR2czNqd3FoREZPRkpqcStq\ncTF1dXJQWHdEaVF4YzNYREFZRVpOQ2MK6XoP4eXUJr/eHh9OwPoPzeYvCT1yAqBC\nY3Xdw+crV4XXR9PytImJua6j+eHdCeB9qPyHFcJOB0oOhhae4XOjxA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-08T08:04:16Z",
+		"mac": "ENC[AES256_GCM,data:QNIiEvJR1UTFt2Rtk5GBl8ALPx2DvSWUhl4Q9O96aCMTbJt6iwQpisGN9O8o4m4a/nHdeOV8auxmNnQ16j/HhPLwv6cEwdfvHcKZcB1F7e1bslBufA9hgcAnkfng9nbMIMmn6RbCF5vFjcTwCrNYNQ4QqluuuuSHrA8TQ+gkiOE=,iv:vmOsmY90VjkCULuorn3sKxn+JQKNXKo5INax66xa0n8=,tag:nIYcopB+0C5hkzvVao6Avw==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2026-01-08T08:03:56Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAwDh3VI7VctTARAAzdR1BVqaHG2eDsDqPPCEA/jeKqAW6claqA7Ggx/aEeE2\nJlvka3MvrBS3YT9rlDbks/bMWoWeKWBu+dVW3lsMJEhAPhmJ6rWUg+13BPQWKblj\nli7xFqT9EOtlea9i/xZDDY+wjRAtj54dNZGft3X27IZLgWxaKMjxhmoqCzHk8Erk\nW+2Lwjfrs5u3v6f3l7DafzMr2uEB5QUOsLGvvEwW3pd9SLinZqRMqGxkRHjhoppD\nB9BEDQmkWFpm8QJWvlmixpgCVKYAB9bwyjmYbXvzpMS2Of2tgDcMTu3EC4Rkl1z5\n+SyImout9P8/ns9xur1u5NG2Ib8r3ydH0k3tmjTHtOl90P7jqvB889VpHXGj6YVZ\nCpFsGV7agvdG7LpxN2JdMouDirve2OLCukTc9Ksd8Z2VlFdg3SirEd3t57FRPxxQ\nFkV/iCNb2ajbVCNcPQzbtdCVxNg9xA7NKsISkGIy2hOnixklWRDYuagMkokx8PNM\nGWUAw3/wCFb5ugF71NQeuolpaE15cWoy02XQ7OwOP99nZS9ldavmQkTZkhcR5OeV\n1ka1/UyhW3tccWf45K9rCf+jVqgyhA4tp3u5wGfA/0Xj/7JeKCqzlhgyBwLPF3Ie\nBdjrzmCusU/HMnp0PphxGkOqiPkeCg0UkWVp/duYvVLaGr4wO+GJiCttSpHif0KF\nAgwDC9FRLmchgYQBD/9BeEvF3GN8Ns6cBfWswbfl9eY2XW+AaFZO8pRFLQshzm+n\nOUb3riii2LuPdMSKc2UkkdJugLem+QuRnf6fkoer08itQdP3KNYYS3Kr4M4aQwlh\nqPx1pmMSS25RFn3SlhKLRZPvK/x0zq2aiwkcoLkVUHgnwTbzerO5MLVmkvwlfokq\nPzwv43KzLCeOQOEMoalSEW4ljqQs/kziLSPHZdoTcsNx50vTpCl4P/cFdhugMbqt\n8YZzQIw9KTMcT7YXT2y86ZzZKXkfqpX6bRkT/JiDjp8iLqj/ILxUEiHjANQrQGSW\ncYOY52XTxdU/WVjfefzP/bnTz14Ww9vC99QQyZwgU+PgV4NwLP1IdmpsGZGQFlHk\nz3iDdGvB905i6Oco+dTBBbHRFUvIYO/PC2oVsOS2eua/IkZhtHIz2qmiC6RJHETh\nvBTVInfcz8PFuMCo9rjbXghy9E56RuOy3qVqTtypFrTzGF2hG8j1+s2ygCIYokIy\nRYHDZELy2M8dtgNNQiGvYFFFK0+Ww9K3i2IeESxjQ7mkCGVIiOadM5J1tLlWP9uf\n+ehkZPvCiPWlL03rz2jXdcufqwbcT0SMdsN+iq+a6v1YEAh639gD3kmM8Bk5W/AO\niMIxmRpnszvdO6sdZsdjcxtlm1mwPGixImVoGPWiGElXsx+hgFk7VYwrMqePetJc\nAdy8BhEL0rmZ8zNkZ3s11shzcGFxnI8DU5a4anK26WUaeRVdCIQV7cq7uZr2O6ob\nz3KOPtFS7CegmNnrO6WCGh5Dvixc3EQ1mOIwCt9DoY0tLZo8lUpILbc8Uc0=\n=YxFO\n-----END PGP MESSAGE-----",
+				"fp": "4BE7925262289B476DBBC17B76FD3810215AE097"
+			}
+		],
+		"version": "3.11.0"
+	}
+}
--- a/hosts/nixos/x86_64-linux/summers/secrets/kanidm/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/kanidm/secrets.yaml
@ -0,0 +1,67 @@
+wireguard-private-key: ENC[AES256_GCM,data:R8o48IzTOqAdSDGpdC+euQo+TdvxPY44iHgO7NGCwQnqnv87Tqbyqn/e6r8=,iv:sWhQJ3JiZRSFQoydNiZJ1UB0u+qdKdRoU9zapswqsbg=,tag:d5W5NOl/sB0MpZmaUiAAYA==,type:str]
+kanidm-admin-pw: ENC[AES256_GCM,data:S/iBo56ONAB/m3Z7LfsD60cN4jx6rKdpMw==,iv:zX5g2yf8cL+YNv/rOKxaUFst49jTNv0/RC7dCmDxRq4=,tag:/+dXYKm1fIsWxPNf3Dte5Q==,type:str]
+kanidm-idm-admin-pw: ENC[AES256_GCM,data:f+kENj9pvEzg6i0zdiNwVRgRXYgsNITlsg==,iv:+8rN4PJ6wdk8N8LZTlcuhv4lzY/ydi+mBfg4jp3kp4k=,tag:kVLFM845aNePnCWBlAhUFQ==,type:str]
+kanidm-immich: ENC[AES256_GCM,data:5mLDFJ/8gyX7Ij2KjpqWbtMjB8v9ek0tuw==,iv:eUMCFjTrAh/Ws4pDYf6T2s1OgNLQnaDXMvbTDbZ7Wfg=,tag:qlp5qRtgdl+TYy8TK2kteA==,type:str]
+kanidm-paperless: ENC[AES256_GCM,data:Jo/uMujrq5eHLClGoxVSyb4kJSIQW7MxSw==,iv:Ck6Z9V3IXUBpSF4RCoqKF3J8Vyo71PaS4itXOf3NNHg=,tag:/u0C34IaUlm0oOGHCgwN8A==,type:str]
+kanidm-forgejo: ENC[AES256_GCM,data:DP6nGFVL/7lwANf2DyI3E+Qfh7b/SF+SrQ==,iv:zuNS5Hq1N8ntEi9z1fCz2Hpzev5F+WEGn8EOTwj+4EY=,tag:8/j1AWi+JUcp6YyBc0v1Vw==,type:str]
+kanidm-grafana: ENC[AES256_GCM,data:o74mBnxhNRuQbqmKEWG/o19JE9M0bBNxKQ==,iv:J5HzDasytKMIvC3tLvWnv2Cu4HPlPHtukE48i2xwWik=,tag:63zpBuhRpnVL4oQjfA2f+g==,type:str]
+kanidm-nextcloud: ENC[AES256_GCM,data:cDZFLh316tIQhsY9osPBvlc3msj+8h/cBQ==,iv:e0nEiOdjxy2an0J21wuc38Tns7kzUvZ//RxnQ0hhjfM=,tag:vKyPRlfFRyLA/PARXlWnFA==,type:str]
+kanidm-oauth2-proxy: ENC[AES256_GCM,data:H6PS6WcMiH+gMsp1CYRYHqSdM9SqR4V/Aw==,iv:WnaEy32YxenO5KqQsEqhQm3jzsq0/HztYZrE99lVbb4=,tag:OPYDhTTKHJ63rHNLyjG7tQ==,type:str]
+kanidm-freshrss: ENC[AES256_GCM,data:t2iIWLeyChAPFKfWeLkEnWC0zbpuSP/tmQ==,iv:fPpjO8RhgIHNRq7V5pYZN1VNeO9NkUi/1HWsHrS5iS0=,tag:v+W0yPtWNpl0CQIdyJuaBg==,type:str]
+kanidm-firezone: ENC[AES256_GCM,data:/at/1dhYtPzeh6F7/juE1XyY6abq1OQIgw==,iv:Qp1QXBKHYoDJfTbZZYDRcdM+/GFu8WonhO6uSI7NdVA=,tag:lvSei5/yGk3aU7HX9KOgaw==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-08T08:02:14Z"
+    mac: ENC[AES256_GCM,data:YRVfa2nuKJ392zbrVDB8XILDa7zsdmdKak4tXAiru5SY9vGzY68sHSu1R0pBr0RxPZ4Z0NYyvJwiH1ni2PKabuJzAIyZLV0KL6ekKIFg2B+2o5nMUT2s2+7yjQ8VJ9nZSdjN+Qk4O9yF3L6GTg3CMKk+wahrySAPuyMn4rTMzcQ=,iv:JoGWfR4Ld0QsTIWnm5bZKwma2vPutEsSL0x6Siz5eGY=,tag:zzGyZs2wSwEo2yTUgKgcpQ==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/kavita/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/kavita/secrets.yaml
@ -0,0 +1,58 @@
+wireguard-private-key: ENC[AES256_GCM,data:rZ4bOiYyBa2Pq9TuxNRifoZ9uRSeL1cRA2JK1FDBK1Wa2ZAd0ZHQfRI0D00=,iv:3L8JLV6D80EbI1ArawwQ77ndepEoq84JfvM9XAjg+/Y=,tag:nCXsqWAXhB9xTnKn8ZbL2A==,type:str]
+kavita-token: ENC[AES256_GCM,data:yKwv9L24Ek4q8KNaTJcW3Xx6d1GCnEZ3LS+GkW2i7C+eE2XgBuG1Ff0L8xcdTPGFVkPPb2bvCP+CKVgnSVd5W+FFek/XQtVcFgWQVDUjG4mBbonQ3VnTKw==,iv:b/UfgHVBviUEMtt4Q6RQSkTVujH+qMIyuiZxD4mwMTc=,tag:rIVUGYOluyXU8fEd/dgQEw==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-08T07:59:40Z"
+    mac: ENC[AES256_GCM,data:MpnXoqLkHYbPHvA6ZdfgJ2sPzM/BtmhbzEjymvnUp4zLIojE15pTEvYKXOedr2RKYZk1BCF+ksfyyVgJxy+HFZ28baC3dPXRMAHH7InEkf144N2Kmodv2czohz45gnbBz38d2DBU1/7pbpktc2Iuw1bQZTBbg5xAw5Nkd3pzKJw=,iv:O2vkWIDuzKzStrDLcVnVnWBa8Moy48fPE3YeSlV1scA=,tag:OreHXW+REVZC6sOa0t7idA==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/koillection/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/koillection/secrets.yaml
@ -0,0 +1,59 @@
+wireguard-private-key: ENC[AES256_GCM,data:VOvcwYy6YVQ+QxTqiWD5bbnH0qNDZ66ZRfq2gY/W0DpjBlJiIcSx1zgaggA=,iv:d6TMF2DAebYt1mNZ0ijzIYNhub2P7sCkD0WRuVPupMI=,tag:9R9N7/rDj/9OHWF2Y3n5eQ==,type:str]
+koillection-env-file: ENC[AES256_GCM,data:rELcMMdigW1SSCgyTyD4Tugqmv8nZCMnI1Pmwaf4MKA=,iv:/g/L+GfYR11rCg3QEJwIQQKXov4GqRIKdJvPcA1mst8=,tag:y6UMG24UdzONssovtFdbBg==,type:str]
+koillection-db-password: ENC[AES256_GCM,data:GxqSXFrTR1am4vmJtW162v8ekM8=,iv:b4T8Rsy7HOnQt0OnFPuKKSByrWxzYKdIsSQntfbh9Pc=,tag:xZHJPexSvNQb9EgmTyxvEA==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-08T08:02:37Z"
+    mac: ENC[AES256_GCM,data:rjxF+XnvVS7Yo39xXq77aeCMttnMaIOB77o7LrZdTMlcL+doTJFh9uOA0dh7vfP4Q9Aq8JWS7IHP1f4D99+uAKBf0BxCmapPgFnFxomFLqxVXYnF0iC85XGZXdWSFZY78Lo7Ilfn7ahyjcvJI4UUdshQVULbJr8cpJfR+KNM3h0=,iv:XNXXxHLQuncyHp7rPiyRXlYBoqfsv1OSv9Z+ktvFUzg=,tag:SFmFapugipfG7feXsuUYfQ==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/matrix/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/matrix/secrets.yaml
@ -0,0 +1,62 @@
+wireguard-private-key: ENC[AES256_GCM,data:yWAKbF6rsLOCC/DfLH6F+XQLGb3fBRTN8asmyRgbkwSjk4c+BFYAt5+QBlk=,iv:6Cas9BbNIjoxgIB8Y+ILFjdMTRFtGz2dI6oiEiOLqsc=,tag:8+hgOBQAlMJOZ7Qhp/D+Sw==,type:str]
+matrix-shared-secret: ENC[AES256_GCM,data:JW7AOGGD6faDpXflV5zOUppOFIswq2C6ydxwFYYMqmnypKrGN/6HPI9pkrsAQYnnJrkEKp6SGVIKClc/+QC+wg==,iv:UW67HFNDqgg3uOFA01xR0btzWnDrgxMRG2SSKwXBQzU=,tag:/OuKL+e6QGlEHgjC/o0xXw==,type:str]
+mautrix-telegram-as-token: ENC[AES256_GCM,data:qUhoSZG6wY9XBc7FzM53Ia1jYb4pd0nnMJy4CXiQyUQKu7b3DJuQK92nSdb+Enlwrboui2Cs+zO3yzK69Evntw==,iv:jr7e+9JUSWUxOj/XiLTctc47Ticndzaj1dWBcT6KkHM=,tag:gRC+Bdn1rHb16LBxb0dVvA==,type:str]
+mautrix-telegram-hs-token: ENC[AES256_GCM,data:PEeMGrKEV7+EO4g5GgFFIAeX2XUU3PbcKt/1Lm9bjTThmaDGA7eUSEObJMolVOmTMwyQc5szyjqOQ504rCZK/g==,iv:ycjxbl74QS9Y3ZNc0rvsbR+llLKaaUQtcefTfGbPbKw=,tag:o/BC/VLnzvsx0QuQulsHdw==,type:str]
+mautrix-telegram-api-id: ENC[AES256_GCM,data:qAYbVdgeUw==,iv:D5AjnZdDQyDMGQe7FSVoPxWif9sfbkznXgBGDg+HkYU=,tag:5jQI9brdup/uQSaPVOWfHg==,type:str]
+mautrix-telegram-api-hash: ENC[AES256_GCM,data:bwfQP/EuyS+iWGlx6IoC7VrJPYbYtsU5cmtnCn+L8z4=,iv:lardLJjfWVvQqXcPm4b4b6iS+U8De+P61GnyfqjkKDk=,tag:YbsSPAqeSqIWsUoxdjbyGQ==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-08T07:59:58Z"
+    mac: ENC[AES256_GCM,data:ZT6hdEn/UkUqa2SMgbN6rUj1Aq+x4kvmf8wyWdgnPiCM4+EzY6N9AP0QcaVTssPH6hO5jj37jPCY8W6FCJQFOkxU0VsF/mYUq0k36xuPMyS4ztZ8zTVSW+0oV6YHZFzE/epbhcIiXIHaoFSyIoVtlMawl/LeBZ92R8MU8kUn5MU=,iv:nDA22BM9tpFAMflconxFsf6mj07W/+tcS3nJHhzqpS8=,tag:jYEm3IpmlwIEGpQZYJ0mJQ==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/monitoring/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/monitoring/secrets.yaml
@ -0,0 +1,61 @@
+wireguard-private-key: ENC[AES256_GCM,data:bHFzF918KWIY7abTp4B71liKBpowEfdyPb2RmFhnER59ito1px5kccZe8CM=,iv:A/5EQ2NVCtPuDfJFAQgusd2Na95a6p4oWbIh78x/904=,tag:IiPzjZNwT7ZyPB0R8/AIjQ==,type:str]
+grafana-admin-pw: ENC[AES256_GCM,data:lTpusl8gd7R7FP9QfIU=,iv:h+xtTtDp03JHHmZ3hX9czEqSWq4l8tRrB52qaKBX3yw=,tag:0MIWfhrkfhmL0Jn8bqY7Zw==,type:str]
+prometheus-admin-pw: ENC[AES256_GCM,data:bdfXLIyuW2N4w5EHd4QD+js7KFF7RBv1mg==,iv:E8AseMXVEcrkCg2fzp2IGphZsMZiCPvTj8CGD2v1t2s=,tag:H+hgftqGwHpdEba5UAjd/Q==,type:str]
+kanidm-grafana-client: ENC[AES256_GCM,data:ppEqUFZC59A1Fv55l6VroWPzUiKtMO+5XQ==,iv:8SUmgijE1PEOiyMUSbZuKUfLifTD3bsdsSGFCQiPjgQ=,tag:crHqsVLK3uC7vA/wkCXZLg==,type:str]
+prometheus-admin-hash: ENC[AES256_GCM,data:6qIEAwDQQdMeiJ8oQsnRxvMV/x+p/rgHfViLMgGh9Lg5FoarzAoZjxNeyE63X87UzsjXY3+7/9khJ9PD,iv:O0VsqAUyiQ3YwLHSx2Pje3trlinz4CjxZ+h4lPPPRN4=,tag:fo2U43uEtfB8LWjP3zpkDA==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-08T08:03:30Z"
+    mac: ENC[AES256_GCM,data:k/1raTPyx+paIzNg6vIuOh2GwAwyBuejMe8QTjRcmOU3Cb6rLovI4kElP8mmC5lNPZtK/z16UKONw9Wj4PJyXpeFr06wUpN64P7qHZ104lJWnixR6kisZ7Vv4AUGAUaRCVC/IebA8If0/Sm6/Vtz+QqoJXNY6vZRg/e4POavwOc=,iv:X40QnY6vzU7E5QmJGM7pHnPreLqUoD6shuqMnE0C1bA=,tag:QqTdb0hUjtWF5bBIiS1PLA==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/nextcloud/pii.nix.enc
+++ b/hosts/nixos/x86_64-linux/summers/secrets/nextcloud/pii.nix.enc
@ -0,0 +1,25 @@
+{
+	"data": "ENC[AES256_GCM,data:0clUhOOUsJ15FkS92KGVth3EkH7TgSS0yb+FTEFpsJtUYNCziXVlXZvoFn0jicnSQw0=,iv:ekWADW1QtWU/Kge0avvMeOromJFsGzXNXNWsymZkZOQ=,tag:qoax3QtqzKoxU+8egb9lNw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age18cgqlely56hgmhscllkmafwpjdk6dwep6ej3vkk97dzemp8jtuksqrrjjl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOTDNHWkRJYmszMFZSaHA2\nY0NmMlo0RG9waTRTL3BmOWRtY0Y3dlNDZ1JJClk3TWkvVDRGZCtJVjF1TldycW1U\nV1lkQjNxOExHcTZ0YXhJd3hZOU14c0EKLS0tIHhqY04xdTMzK2tSQnFGSDVnM2pX\neGhtL1N3VVFnSXZNQkJzTmUyTkhTN2MKkWFj7pEdbD+pPqR17MnYma8EC9PeXezX\n8sRLSVGlWb2YobSavwbA9AL+WFsXsT71gSFgTkAtsPh9paDTKSAMjg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1nanlervuderw4qskcuessycqy2yfmptl6nym9scgp9ky2265ssmq3u73r0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTTnFJMURBQko0ZlhkZ2VO\nT2dNenNGU3FvVjA1VzRnQVJ5WDlTQXdoWkh3CmZOaWY3SUdNT2Rib2gyN1JKU2J3\nUEpmV1lqSlJiV0FsUWZpcmJYNHI3SFkKLS0tIHZ3UlFOOGN5T3VjVmNkaFkxY0FR\nQVRpRjdpVU1GWVdNMGdHSU5LYU1rUkkKrT+HGA8QauJT2U5RfuSIAOmQ5EHTlr6R\nLmGaKGPVoH1UrQJW7JpTKA9knYgweCPy4aEt4UhTrZxx7r3FKlM51A==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-08T08:05:30Z",
+		"mac": "ENC[AES256_GCM,data:EilwuLJTnz6pgg8tn3bNc7MxYc+RQQodCoyHAb5RRLSNDqIp90XaWKgXwBdW2lMJxYnnkprkFTOZHGW2IoSQ04S1oeYRya/NvBCSnX45zd7wQxL8k85/oYsCFZAqEV29QXoJmagO2isiFN6DXEf6IJGtzOD+MJuYjj8PufaBzaE=,iv:l7LlbYrSY4mJaQeJ1uN8MKN0z3xu5GhzGmEf/femROc=,tag:QxyUjkSbOcKBqwzGcXV6tg==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2026-01-08T08:05:15Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAwDh3VI7VctTAQ/9HZTVACE+U8I1i4bcSX7umSFfi6qEX+Cnpe2sbBQAddz+\nFAIAoImmymvOnBw/oF852vU1a7W71IHZ9723NH8yqngil/R4taLZGRVpg+f4ogEn\nFz1a2yJEjNy/Pkm32Y9w0RvKuVvuYaSk2XRj/GARSlwAgn/lGF84r2zUofuD4jnh\nzlVzvwDbc90GoFVN7rOAzgD88IOMHEC244IpxeQ0oVPaun6xhTThZD9twRUWVrqc\n1lpwMjdcNfr+AbL2BK+35uTxE8wA+kyF81yGXCGQZY0pGncUBCmXSiitMXLuU0V4\nXmydcKpB/pKQgdsIkZtfhxOEN9hdzb62GXiESg2jqF5fHBN7Qw7Solf5xtAHnUxD\n/yacrR9/uqhInVxVlxHzwZN4iZBQxQmtIz5uoA5NSgawrUf2DULLknYCWo6L5W2m\nIlqfzWnQIRDFKvpFjtouencQsdAM3jsxRPcq/+/AwoUdSsDnJsOhzIm7SfQmlr71\nMp3bD4M5ccZYVm0dH45N/fXssfWdFwRCBJ53veLfTyWRGpWiaS1ofsAkmVXemqur\nG/w7Dm4H4D8vn8mxPGg3l5VftxbjXU7mbq1PzzJBvktZM3p52VesTIAE91p17d6Y\n6zKSjmTMLKeWAnR/vXAFIJMXPROVd8jIrNHjhgflel+frBU2IGoo2jJNPr46Kw+F\nAgwDC9FRLmchgYQBEACqaN73KchQPMGgND1AdR/vupph0JF1uG0g9qA61xmvzBYa\nCfJob6Esb7wd5mf2ohfVkgEVNs36qGJZJ6/nes2X9BWb9InIYp7d5exVFI3uXNuZ\nccvGSUefPdZuRIK8XvdXWAsxCitcZZHNkJSstDUwpdDJpWMz+u+HTbRiLYp722QB\ndKTGhnsbpk9pnsIQPR3GHJh9iPLFyayM/Ej3y6N72ywQUN/pptZo+boWla3NO4JM\nHTXZHcUKbcNiCnhPgVK+xhP1gfgKjlyAC/STq8x1pOVvhNjtT/N1YuGiNQtxSLbE\nekLBkFK4VoH+fyDaHB8TFXK8dqq6+189Eg5kiTYGkMihR2g6g+0Sp5mbdHoRQEYv\ndpjHYauaKw4/V4c/UgcuQOT9WOUGqH5Lw0QohIhF+JLRU/GvppTxxk+wQm/yYWg0\nGrHU50wvV9udxIGxYxi/HICZ2CgqanWGOJDaTLejMK/Qi5bI3eAKkN4MDIJd0G+c\npVnr+Ry8uaKlmIzI0HV0LKdV5dAS4sbYOzp45Ze0M1geZrTwoWMUOyUNgjdGVj6/\nOz0eIXPK3e5IowfPUBW25sW0ztIg+Q3lfivC7xqoYBL3HCTgKevOGXgqnf5i1kZD\nrncVehBN+e33dnFLmLICPiawd09xWIckpGYlQ8NgtIXa8JaZPj27M04erhqzBNJe\nAS3cV3cwtBkuf16ZRgdI5CiUoSN5IyVuGb+q8GwKh9Hh5VLS4mwUNL8t034U/Azy\n68rN25cuZyAOcPmzTMW9xIhNacO4+gEW+X8MKalzbtOubOeGrkleTYuHyiuekA==\n=bjKZ\n-----END PGP MESSAGE-----",
+				"fp": "4BE7925262289B476DBBC17B76FD3810215AE097"
+			}
+		],
+		"version": "3.11.0"
+	}
+}
--- a/hosts/nixos/x86_64-linux/summers/secrets/nextcloud/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/nextcloud/secrets.yaml
@ -0,0 +1,59 @@
+wireguard-private-key: ENC[AES256_GCM,data:k8HHv5NRBKJRNWRNHeQGr49ZrBrz/gwGL7qYXifmObYOeT1o3MfmG7wslOM=,iv:EYrcKjyRVxndG3puJ2HS++O1UbJSU4WN0vlD1yQQ3fs=,tag:Kc6VhUSw36ksSlfeZTwDIw==,type:str]
+nextcloud-admin-pw: ENC[AES256_GCM,data:paK35a5bPIHioXMzGPZ9XU6t,iv:VkSLO1VhIbDTGs/NRGYbKcThP/uv6LzuptJcXFmY398=,tag:VC2q6p38JI2a9vBehoJeQA==,type:str]
+kanidm-nextcloud-client: ENC[AES256_GCM,data:QOl4sP/+N3GIxrQMyD2TmyveZo4Wm88u7A==,iv:S409ur/y9j8HYLEbuVhUbSPO0JwD1zQST+J5035Cd2E=,tag:VgQs30NNosDdxwEL1iAvbg==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-08T08:01:15Z"
+    mac: ENC[AES256_GCM,data:UdaDVFUew2OaFnmdD+sULrrXQlvhASqomUt6kUxCoyXydotNL//X8tc6U9iUOhrXLKXsLB1fWKpiIQGGTtkK02p9F/IjWtakeSN8AiSCw60vVBueIdG4dDFXpOvLf4JVkLG2FkRqcLxLqyWLGzgXSFEIaaCTK/tRLWLXlCxitZo=,iv:1VgXeCIlQx89J4dW7Mldae47yvmej3Wu1NRnKK31oPE=,tag:GKfotJ6uoq+Jhf5uh2L6OQ==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/paperless/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/paperless/secrets.yaml
@ -0,0 +1,59 @@
+wireguard-private-key: ENC[AES256_GCM,data:51Mpw8Wgq4SsUokL+AFRUwuKQq9UmXHc2glmiMdjKwa/kvu0JeI8R6pPVMg=,iv:VBqyAk1kNX8IAJhCjBnDNeEEGEKWmUHLkG4l10PMvMU=,tag:uGQ0u+11GuJ7f2T6AA2FHg==,type:str]
+paperless-admin-pw: ENC[AES256_GCM,data:2t5nZmpPblts6nZ6Pm4JZMBpwxVMap2NGg==,iv:IbCUeNBX4D0tOIOVGVv71fLwzC9NZZaD7M153la2eIk=,tag:L1FbrYOuwHQBHcBwbhm5Qw==,type:str]
+kanidm-paperless-client: ENC[AES256_GCM,data:mEJBDT1qEz6vHrjnT5b9iBjXYbRwcoG2sw==,iv:SL91pO4QgtD+458dy/7ra7+mQgW5P+n7qUdVaXxYbHM=,tag:dGD5mzVRNFLORrMgiVYJbg==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-08T08:00:28Z"
+    mac: ENC[AES256_GCM,data:ssSrHidYu6SUIVk07FMJ8p5W64INqRLdynQdizq+n37c69Ogj02LjcuRCH9W4vI0vIsbZv/Az0PnQRUfPwW9nHqJPtvWb5cUS9AK/kpQKRDd60QK8Le7+PPEzemvR61xeUv3CiUE5qh5Lf/AGUs0g/Mw1Ur8qSaj7FZUkKWMp7o=,iv:5KgI5vbEfquerHrKo0JpJbJaoAVJp7gblaUvQyr8TPg=,tag:BiGm5Lk53F0w79gnrBglbQ==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/pii.nix.enc
+++ b/hosts/nixos/x86_64-linux/summers/secrets/pii.nix.enc
@ -1,18 +1,18 @@
 {
-	"data": "ENC[AES256_GCM,data:xPgUMSYz77DhqS8Vvv5FawLGZOaoI+yVqyK6NIqqF5Z+eVN1FyYjg6tPRB56rq4/yPtI69fKpQyEvnrtOZRFp1L6R+blweXobmeG762a/FxoWmh2CaF1QutFKtS94xfJmci7De5h67miKRy7rGWOeMs8gvjspvLtGrmDJQj+NQCwTvUDcibMKL59GttYTUhTxeGyN2R3utEQeIkI0Sf0mJmQUWXXMsjiMrQGhGx1iS9KJHlU2izl4pZMDsGr01d/seV7O2xspfhf5saJk9yiTwxyKLAW0ueSAnstfQJU+CD4zDXxbxcl94dzLFkJm+WTYV1X+IZJtMODLYf2XgVsz4Ihf7CuzYXHGw==,iv:3eohgv4d8CUuGPb8ODmEeAGeBsfwZsmFG2ZuxWkbKRk=,tag:31eaWzlcCslHMTeq3kEvJg==,type:str]",
+	"data": "ENC[AES256_GCM,data:l0LIC8IP4wVA8wI5Ef1yKYfvJw4b4izz7HemWgoKjx34GWLnVYKYqrsXuGD8QN0GzbK9ZAPsWXYa3VejnVXv8Qe1B9GPEJbPtP//ExZ9lDYoKICLpy/yLxSiG85xSQQ46UcipCpA5ZjJPnmYeimTlW+PH5BmuL3LD/OteGVcIwRVznBaQwQ/DnzxE7eBOyF3l0apIIzk4paMswF5OSh0+0EfIS0wKJ1zBLW3OfVc9N1npC7nn7x01X/fde9k4s0gt2XjPQ/Qo5HdBfEfqzzOTu1jiYuvuoiQ4KmlME75HWfLoGLjCYCespoEnH0v45vJALiKNk6wBbHwidY00HH8DSxRujYxl23IuW+r6x5B/rpXUanrHzfKmQyx3crYqDl3URHwycW49GXxWBy8PPE49SGmWMh25ceuLjIgqQaGppza1X/V3RV7tvA96/L/kAIvmoDaYJMncFv89Q+fi0obp1YqVNkxsdGuBawOnCzyL2RAhf9t1no2ak7zJnMqaiHY6BU0Sg2OSwWEJQEEBzmj4P5k9SXqVBF/MUL65sp76hq7Wk6mqtofHvzY0ugLw/b2G4+RlWNAyDQnb3dSmldSc/U7bLZ+2Z6IFlMrRGg0niZd8g2283CQACvNBSonZ9v1SMfgN6ChG2U8ry6McYwsrO0dDshiFyyyvy1GxPAzc8nf/n40i0ipnTydJ3vxlaPq3rKZPfsXQdfiqDDu5tGiF+7JpdBtoJQ2Pp8pRKkS6sVPIY2OsTdu/ZQ34aW9aBKLfGMB/YPm9vid1Nlp/5TSbmbXfC9Lwz5s3I50N/iLI9F8W+hhR4RpOQLufkS0+neFqK1N38s6P/lXAfIrDdq9+QNZvSE61bZqjx7oxl6QKJKvZCFmkTIZOP/xANrSe17f2MZ1ugh1MBMb/5/Zh9BznJBEjNMsaCdEEBe8Anbum0oO9CXlldFMqUf+LufI1VDWj/68oBjNmHgHFVzUofxD7q4EZ/8HTtfTWOivVLg0F2l4fR6JIdTqKEk/g1tVll2gWfH9H/xNrdZQ9PQI/XKiSa6LIWEdlPz3TuH2Fw6bo6UC1YfVMvoWPUQsUhqrCBv0eb7snvYBkUJg+/BWhWelL9W8FD0gce3WrJfAe12TXqgWb0zSHtPk9C9E0+UkXEM/SAciBJTSowR0edM8QyPzT8nP/9qrHz390V8EIbENWU9AYDuo6o5fh0E34FHNCuX/+toq9VrZZLVUR1pb+o4=,iv:o6qAis1FnoabxGMQDDXrubSFHIgP0XHkjO4Usx+eQoM=,tag:rC+nrChrFNfT/3C71szrfg==,type:str]",
 	"sops": {
 		"age": [
 			{
-				"recipient": "age18cgqlely56hgmhscllkmafwpjdk6dwep6ej3vkk97dzemp8jtuksqrrjjl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3RjVhWERrSGtvYUhYOFpo\naDZ2UGZ3RlQwYVJaR1cxbVRRYVBVellBWXpnCjcyYjFYdG9YNk5mNWdIYnN3d1M0\nWTVLM0RyWmtyejg4T0YxNFdsTElLTGMKLS0tIGR3d21SS0Y1MHBsQjdJaEpzUUNk\nVmhjRHJ3RDhDSEdTWlpoNDlWaHJxM1kK3KsLvzB4QGCqKS1pq5jQjXU0tkS6CDat\nL8emFbAPLKPEafb/dZP+AXupztod9R0feSaDxTre5m8ljplEnE5Lew==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age14sjyqch8tzqexk2gv0qgrrg09f0s6hvwhsgjac3vs6sc5rzgpcxsyqda6u",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKcWF5cDZnWlZBYko2UFV2\nNGRMNlNzejVGR3hJSXNjaFQrWk1FWU9WZDM4CjZBRW9PbG9XY0V2T0dZTVhGU1Nn\nOXpXSWdaeHRNbmd5S0xuUkVuLzlidTgKLS0tIGNXckVXK0d6R2dNKzFzYTNPZWVW\nT0QzY0kvNEJvSC9CWExaRjBsQjdVYU0KavAD19+DC502a44wxbtz8fbxwIgpgE2c\nU4LlkgvkrhtTTiu6d/LiAKfqM9PrSajBdO8YrTpFxkqYgfi1tMoC8w==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-12-17T22:56:04Z",
-		"mac": "ENC[AES256_GCM,data:+UeKJoKrYLGMU0LMOVvBTYCrwS5gs4dWIIi4ceUnnbs3Q2vqtyn52Ht8ECH6EAHnEtk9G5IBj72NmLgu8Hr24mDc0SFpJKqFuemvJHef9t6eB3ZGYFNwbEJ6HOjmmp6+Xrt25b/C1q7mw/ysnb0g1Fs1I0GzsyQAjDeYWYTh6Y4=,iv:ndTm8UuVgt/O44vlKafu7F9knSNNO2+RoH/GoEhTCqA=,tag:PQMhJlANkxAgngIdzuGEdQ==,type:str]",
+		"lastmodified": "2026-01-10T11:23:49Z",
+		"mac": "ENC[AES256_GCM,data:p/kSeOGsEFw1NxehT0UVNOrf20K+YEK/heZakNf+X4C4GabctvCTyGouoRDDq3ea/O7TeTT+uVRiveZ6TOE7S7rKwFX5yTuB1wKDqsFLjDgFidwzicHIBmfceB3XolU/l0cIkEH4UcYYOelfiHr5gtjLefnCUojttlUhRZz9CD4=,iv:2QDqwkwlaKZwtnuzfkmBDYmTTvt7FN2op6/O8JcHSBA=,tag:cOgrxorAFDwpBF2NfxxuVw==,type:str]",
 		"pgp": [
 			{
-				"created_at": "2025-12-17T23:34:30Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAwDh3VI7VctTARAA2WAZd8mTmgXn8X+MmMTgSXZX0TJSV7gI1U98+F6ewg7Q\nDB0Q36UVEtbpYaQi+vdP0g7lzPo9ubEaO4U38LYiumxlYZASmn3faYLvgikSpDM5\nnE9Huhff5Z9gP7tY0Kq37xEOVLNx5hI019ULk9r/7T1g2bOh4fWyBVvCseQ+8r3i\nR1IN2QPCWP39evzL/FUHtiFH2XD/dFtHRLqV2Zd7JXJ57FOdwROc5omKh1bN2Q92\n9BCJ5vE32gpPcBxmAz5VY4lgF2SYps3Er9ObgTv5ux7hmqspQZayIvpYeERXTeUp\nePAqzmbbcG/MabpjuUboy5KoWsbEi4SsohzJC5r/oCnRCbu0PCz2Ip8f7CyMUyhB\neOjAJ7zrY8XW/ee6X0BYIZwUZhZw8Z/Qf2x+GSamamkhEA9AhbQcyW+c2D99vM0P\ntAqVqaPNqNeMVpmUJtgprZP5VjbckIkLsgtRRqopKjM7FkzHykwhI7hNJWJmUnC6\nrI/y+xGTQ16kge0NMbgwRuGyxFQbB9FKB5VP4vsJ227XjrEZ5HaOd+XOgj7Us29q\nkIl9ZGKbEUn3I5sxI/0ijTG/pPN+H3ROvXs9cRBkBa/T3uL4Gdvideet7IxIAOU7\neamskzNS5OosEyafAibD3ctB4wI/E19HS0JKoRNsA7CUqzVXhx5ipeLXec5tHMmF\nAgwDC9FRLmchgYQBD/9V20QCxpY8lFdhbiN5n3dnlsGAIQtYTYKXWqTWb/iq6Mhu\nUU+/2Czu1fpjOEmPcvKk3XxM2wclzpTG+7NWvtHuDLe9HCai6eujY+1Jrek95AqL\nDzm83PDONp61nGj0mCHDgyEcnDK6ViCglofjjAN5HmfZxw6NI71GIk+c3qLx1pem\nUR7ETjjBbBW3gv9BXAqe+NYRbFx173lf6er4ogqYWRFCRlN7IQGlMLhAbbYfiwIz\nsnyyCj9UEekFcsVkQHoIHFeuP8xmsOjL7AAtKAMXVL1UdHfgJjK7bI669tzmcJJV\nakECPeKDwk1/C6CwHtKrnAHoUHPLw99WEPThQ4yselDBkf7yFibnHc6dNd77xIEG\n7lVyZFFq/a+gOOWdN/6mxqumD6LgQexoatY+8shQEJ7tfcNKs3ptJZX6zLiA1A1e\nzLxpVqtAmU7H399M8Q7Q5wiJh7wlF2ssADnAMws9ybCzKqBAsbBDhlwrXvZW5lic\nQTMZoeYBgZp6l59hHppcaUXTFOCR0fW10VNyyKJa0/fRegptxGAmvVQzSLLJODw+\nXHxabaeuF8IcU00GqIC/7OuUY3yN2IHYjxkB90F+rOHYj6nF6zFxBVRplqvgbzbq\nSpx9/JEuzVqv7cwmix0osmru2NrY/xvmtJq+8VZooU6JcXk+wY5MtD7sIG/yFNJc\nARwQJ1fSiUBvXVBM46O+XQIPk4aP10cxhz0NF0LTCXttJJnHqgjjI3SAGvpAq2mH\nCGPu49vKjzW5l3Y8SfHGPe1vU11l0KZeXfPSijhupM6V45N+YBkwDLNj0Qs=\n=zt+q\n-----END PGP MESSAGE-----",
+				"created_at": "2026-01-10T00:38:26Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAwDh3VI7VctTARAAxZP0/unKQe/AK8lpaLcPSttcLwSXosaIa9PFoBpW1iJC\nZSGx+HcWufN/aniE5PMEa/ibI4VUESuhPtqolAf8DD1ofhIwMIHTcEFvZ8bLQscv\nt31mGECunSwMhmmszRkyJb6Ic5tx8I2mhcQ7Nn8BVTlTRUeq/NNk2gKVuadd1MLG\nb2C90uk2DQWgU3/Cu8k9s8xrxSVmDwUEDliyY9tKCStL+E1UKbsc7iR494eDWrc1\nUjV6e0DjbWVaMAJWCUSHBSaEEQYHEWYoaQHjLcosZoq1ihgmEQK69r/vKl5tY6/u\nkAwrjWK04szMJ6fWI8a/56lwtUTKP8+tP9afRE5r4D8/xSKbbwIFUCAFRoIMRJ7/\nRst5q/kiS5G+9UTkT5TrKp0sxTbEyfucREMzUiuaMK0hh82DJM3DoYl0BhtFiNUA\n0xjDbq9jDdxxf6qVc2+j7G4oBZsEpSGCGeBB8V2s60A04HAcPDl6KuJgdNn5UGKT\nztleh7CzQxupByprHh/a97XDvvNpvzz6VGYtsIv42IW4sINgDIImhUdYFYgmRn6j\nrtJ4f6WWC62YENjiwR5GRm3tPjK8iyPh4XtSokqKSLe8NRfLK9+Ix/ZAS9woEgtb\nyLejKc35I229Cdq79uDqzj+oDr34q2M5+4Q3mU/Hk4AO3BGb/++v68z6r7EeqziF\nAgwDC9FRLmchgYQBD/9pH6hLvPyM+pGNuRVWYVKg9xxLVu17hBKV1U+VR1flfT5s\nRhz2wvCE3/JRrTyNDKSwSnFiZDDoq9o1tGmHn+C7pgZGODTIBiIYdQoweF1h5l+o\nc0gdWb8PJROTHGJvl4PGZEeGsav0vhHlSvbh1MtmbldGgZQ+LFwdZWUMMXRtHzGZ\nwihOD+dyurdPHmyqKnylna/uvI6SYwLoW80LzZ2HDROknu21q3P61Pz27aUIX+9S\nBfM/JAlhdz21jgmWNinV/zKiSze2twFtpjniz92lb9avPNs34MRbOCp/q5b6rai0\nanEcSBigxcrZR8Og0cPTKYlVTwuHej3wjVEtH9PUTmihMwQoU5RQloySlaEyAKZR\nL9h8sdl+PVh+Yc+Em8WM0XvdFwYKwpVUqAbUeYQV1sBL/oE8qTKNG4xDXBnSUvwF\n4zSzZ2ulkTl2J3t7uNUKI3suU21T0A5+MKB2Tl1n6lK90djfKnlQnbvUsVu/l4HG\nOvOZgaR64wx7ZQymSinjqNnITuIpkOEZ6Gu0Kg+hJPOiXPBRwskpn0P5piUhsbvX\n80fyWZZvKxealQyqUCf3ZFKir/CNat6QDvPRvGgGpgYfIC9zOxznlcEMSZE77ZvG\nCHQBsRjgn7EdI9I3OQZvZuVBtuSQlPcUJXuOUqyptPG49frMtg9cOlI3Z7xRyNJe\nAXuQhlSzBIdRD/Calc9dlJE6ViFePryA6VAUYyF2KAsPdSXK0AzlG2tAQY8nbxfq\nLn/J5HToEODGX4W95mkBl/+qgjbDVQU53fZ7NDPrQLBBXiGgR2pZKMShs/jtzw==\n=Fg87\n-----END PGP MESSAGE-----",
 				"fp": "4BE7925262289B476DBBC17B76FD3810215AE097"
 			}
 		],
--- a/hosts/nixos/x86_64-linux/summers/secrets/postgresql/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/postgresql/secrets.yaml
@ -0,0 +1,57 @@
+wireguard-private-key: ENC[AES256_GCM,data:iSjQO7EUVOYgh3378FTGPOf7fUFLBoA7KhxroPv3iyWfbDI8r0yB/ewoMOI=,iv:Z9KlHucjpU44VvYWkq443njeSs0TREKTIeq65ieUXv4=,tag:6fjf3Ce/tuvK4vHvBaQn4A==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-07T13:36:49Z"
+    mac: ENC[AES256_GCM,data:FVo2l0qd8E0G4252lmbPqhBKBu1WRXdqD5iYNJ5VTcFwM2ErC1RXVFFzX5jnBdq8yPUozS5/Vjm5p4B+N1bxwDe8nmKUJcXFy5AdMMgrVmXySPqEF6+uMQM5Mfh5yLgLnxscpCo6SV0kESfD86TeHI/HJ73EL4L8tD5V0tiDcSg=,iv:igf9D+MLI0rhagUP6IZLe6sP2HL5UpT5Z0DtLbXVq50=,tag:c0CGV69zbtIUxZMRJHh8yg==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/radicale/pii.nix.enc
+++ b/hosts/nixos/x86_64-linux/summers/secrets/radicale/pii.nix.enc
@ -0,0 +1,25 @@
+{
+	"data": "ENC[AES256_GCM,data:+gy58+DZWMwnfjFLa9rIoV1lpk2NtEd2OnTOKRgNqzTqYPo/DHsBhDNMvSDPpa8=,iv:pax5GFmUDJURjSoYVpuWPtTJHFJ938jb9+GlzFqtl9I=,tag:5VmVjszfJhNYPpa1FsDXiw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age18cgqlely56hgmhscllkmafwpjdk6dwep6ej3vkk97dzemp8jtuksqrrjjl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxdk56TXBTMnkwSTVpcjJa\nQXVqbFBrVXg0alNVRU8vUTE0WVVhVWo2OWpNCkF6WTMxSHNpVS9HSThzbG1qckdr\nQjZscm1SeDZJRVhTbXZ3L1drbnNyemMKLS0tIDU5NW84dUhhMm9lcUFTeE1JSWtM\nZTRIK2RBZWFFdnFwRGRpVmFZa1p2ZDAKoTVtGfVUCibVZMdmSPuSB4+V/v3JoLdN\nJhkUyG4ZLlB0CVP/o8Iscs2R1+2uMTVGFtHISUpKv7pskfUdZgWGag==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1nanlervuderw4qskcuessycqy2yfmptl6nym9scgp9ky2265ssmq3u73r0",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4UnZna3gxQ3JFTGRDMVdU\nUGtPWFRoWXNoMmpSTW5wWXl3RmcrOXdwSGwwCjYyVyticEllVlJhZHc4SlVjdkli\nOGJ2eGFrL05OTFJ2RDFGNENCZTJmWW8KLS0tIHpmcDN1bFpRSVkyS2ZkZHBiMW5L\nSGgyNFkrYVlaZGprZ2ZnQ204dkJLTGMK0A6Un1SDu0ipQZXfOALR/3izQLhr5u0x\nhNtU3Qgbv8LrO78PGxTq4bj2SSRvlQPnA66Nk9OCft1Tje50KoKciQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-08T08:05:10Z",
+		"mac": "ENC[AES256_GCM,data:dqrPYwYaz2xcD6OsTrqjSkyNT1g5ntlGr+3WViuhuV+UcwmGFSQ4T0M/vJE8tGiopoxElfxZJyYGZ97BnK+WppIUiFGOQc1hcJhzFavo/gzz6xQsourq17DiXJS34VKjejneXDY+ieIUG4xXUlGWsiyNnBCGbj3STGLYcxtvKt4=,iv:mozuoTM0gS8peTfe2Pm+HANZZJozenRCdQFcq2eCHC4=,tag:MrCV9VpZi4gKMC3eWYzgnw==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2026-01-08T08:04:56Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAwDh3VI7VctTAQ//QXKt4eibQonofUjKAWjH66ZuBNN6sVY9ioqAQH9SaKob\nOPZVTSxNn/4zcMulticYpPyQuSdvGx3GTAYx3gVOSXKHnHo8nKRiNEq9ZDx4A8CN\nJkvJ3R74/XLay6sO7gCGsfNe+nXeNiObanyV2wNwsigwr2NjItERHMCH4//sFm2N\n0Y0LnuxcRL6Bty5gQg29NZaBiYNWw2viaKIyhAqeC7ner9iIYeHre9eEhU8+Fouh\n1aegkvFSgDqzPAtBSFW2rP65HIiQEh+4FB6FlJmXqnIK/FCozDpH96xn0L1CMxVk\njRExv7K8s2tCKgkJ1pdbs1QBPJGuXKMFDagNPl1vVj9cTBG8XAaJ5td+Ye1Kf61f\n7SLdBu5Rov2kp8fhW2tKBWySpcPUxiVQkS73kL0j9L8xZMcw5e/d2KOSwXalCs6p\nxMF29SmraOSG93q4dFAyO73rbVwueE6MKe5Q+h/zFMK/V7U/WWprDaL3VoYHoQjZ\n6dknrYPPUcgAdMqGYGllY0CVDeysrQQ+QFgWnTPa9kfBn8EUSbNzhxaISrUJ6xYX\ndTkRa0f8qYCiGNZ5BuigA/yH3VDMIaUmJYB9XbpPAWi9ltZuA2Tt8cQ1oPWm5SDU\nq3ct8KP6UqwEXXawC75D57Z8R2mUz8dZGyACRKHWnkjEQZE892Rymq+R+BW/cu6F\nAgwDC9FRLmchgYQBD/9+U7ducieN9QpYX7ZBs7RP5xUCtzCV/dL4Ps7m5b3ZzlE2\n867eFCSn6TMu6/KBi1WmsJJ2eSkBvYw3S0fEp8O3n8pvVyYZBIgmUM49oTx+Xnjb\n/FKRj+TxMYjlQyAXIMFCXsrk49genJV0mGSODn5ZAKj5Rhx1Kaqm1tkZ+ZJ0zzJr\n79NYypQjMsuhA3VL+MkxE3zoipOeU60KPaR7o7uei/PHBtcUtSOLmJEvaZ1XVM2s\nwtnRQXeyQwxzzNE800wWGQF6PDMvjFp63o0Pj+Ie0dyVNS2UbebjJl5uR0pn22sq\nUtIFTi/IwwwRYUFI1i6Kkw7igfyaI6ThO3thxfVcBzi1/7pMNbD7yiIOBdZlcgoT\niCqrK0+uyfPQztJiseX0Sn9xhA9bQK6ob4OnZoHRF7EKXC7CU9C5ReGY+W7EKSJy\nrJ94IeEPHojjnkH1RgK4h5gxDiVJ+d6mQhbbmPmXomBHaaViL4y8gs7cHNXL4v2/\nDH46EUoljeyUxvxIQe5UDBaGB1AwoIrCQoByCmMVGZos1w2QKG2cUXWRfLY4vUgo\nA//hfPyGCwsM88265ohNqx1kMb9qFHd0P4uXaM5wX3hqnP8NlR9JhHOmtjXEXj0U\nPXuqLvNw18ytb1lQ/6lvIfB3nTz6Cd/CiiMtgcJU2AMFY1etgztcr7ZvvfcMVtJc\nAW4txy8U+ulr59a9uMFcjWl8MnEIW4fT2NqJSk27qWMxdkcf+O2prW9wilkazctC\nFIw1IKw0y9ahLQmCdjYwHw0iTqOAvpcJ/eQxhTAWrGY1pCAn7UZhpOmXMn4=\n=xDUO\n-----END PGP MESSAGE-----",
+				"fp": "4BE7925262289B476DBBC17B76FD3810215AE097"
+			}
+		],
+		"version": "3.11.0"
+	}
+}
--- a/hosts/nixos/x86_64-linux/summers/secrets/radicale/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/radicale/secrets.yaml
@ -0,0 +1,58 @@
+wireguard-private-key: ENC[AES256_GCM,data:1yvGiPIViIM7PZc8fi4MRFo6X4ZP0ospI4bx0SwduI30Lk+eWMeutvSjUso=,iv:mcefti2M/qe39zzLp21aMfMI5CrUXgl+c/BvncRHGdU=,tag:pO3TR0utUc55EEbQFiX9vA==,type:str]
+radicale-user: ENC[AES256_GCM,data:BBo1TscIK622Whg=,iv:yRxEy4sVlZNzqGGML+dCeGzN2viMT7N9Eg9lWYSGljE=,tag:3cX1cfTzhxNYrtk1u3lLXw==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-08T08:03:16Z"
+    mac: ENC[AES256_GCM,data:z+ETj7inVkrg3lniueJNw4VwMp52S0wH+6kEH3bWPvMjml4Biy9wUqatlayi4cHsYQaEL/2ok8bi9rNuMrYYWs7qieLDZfRQuHEJNdylPxIKrQn0xn91ihbQJRyGMCweEtaHNR6uZY0uKH/wvvBlBLcZmuiXtPU9CGPIh72fTdA=,iv:41h4pi70SArumCJ+RqdLKlaiPwyqW0Kzro8u/GHNvxI=,tag:1kitWfua42WtVlWRrGJ/TA==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/secrets.yaml
@ -0,0 +1,106 @@
+resticpw: ENC[AES256_GCM,data:duM1dMkCRdckaOg=,iv:mPRxC5KgBMHRUcgHJQTfLA9P5EfGwnbnfzCp8CNIr9o=,tag:VZlFcaVnm4eay+JM0Sd7cA==,type:str]
+resticaccesskey: ENC[AES256_GCM,data:Jt4uKdD7WqjaRjnKLeJhYoFSTtpwqPuARw==,iv:s1Ff5h2uKVxZY0hIZObZLXDlxgoUIFTYSiO17JKPUWY=,tag:DenvTp2ny8i+XjgTF3MPNA==,type:str]
+resticsecretaccesskey: ENC[AES256_GCM,data:ijvux8Uldkct48gqVIC+jtfJ8m2oQ8ZbIZUZbyY79A==,iv:BxC2CZ87hxZhf35xqLe4ArGO8EnsYCABmiN+OM7t6tk=,tag:I61Ne5ztK5CUDUu+yvBcig==,type:str]
+wireguard-private-key: ENC[AES256_GCM,data:lP5wnI1YUSb2PJUo8LvCogz0gfwwnqgYtNEly2i8P4geQVGnsxCz2c0ZKgM=,iv:55gjJ2K15EB8i9iwNNsuKwzHZsX3RvsTKNAnr+Ac4to=,tag:GPscRLTJSj+TNJ/15pM1mw==,type:str]
+#ENC[AES256_GCM,data:D3AMwX0rBg==,iv:4AaUSc9Swp4RJIqeNzTW7MvAi5cZ3c53alWY3P4wS5U=,tag:IUzpcX38+495WM3O7L0uGQ==,type:comment]
+kavita-token: ENC[AES256_GCM,data:coBAnDN4tWB0b05z+SRv8tGau+KrvMbEBICpPPYrjAqS/jVIrsKfpiVp+jJ2ruKnrwFnE8aVzWMB423fFk/GzpLDJZHF7oPjlr5QQVsGQ+NP7Ls7lAu6/A==,iv:pk+sZqRcx+WgS0Nwa4z4I2RmTobL7QME8E77bYdlcsw=,tag:XJ46v//ploErgSNLlUfPBg==,type:str]
+#ENC[AES256_GCM,data:KxuybG2VSA==,iv:5HnK8dQsTW+shG+EzGh9BomfoBGl5cdSQpZjD4OF8y4=,tag:S2EgHIoHyXpxpU48hWiiYQ==,type:comment]
+matrix-shared-secret: ENC[AES256_GCM,data:wCDMXzV18aFk4h1tf60N61K8j+gRJxIfbQLvqbfoDWPH2gbuNsg3SfDyFgDZQUzAzfaYC+jcbUAFOPm7ZD6axQ==,iv:9Rpx5jHyxqoyLSD39zPopj7m5ZZcPIhiRTh9tZXIero=,tag:JQg1uOorQvN3m7Cm6fT0vA==,type:str]
+mautrix-telegram-as-token: ENC[AES256_GCM,data:/34XoVkm/8o84PUDXGWzFphEu+0LyvfEo+HOEbEB5GfrHzJmPpWgdGmedAYLpupvOzWWjODXgNk0zC3l4a+4gQ==,iv:7AdLQ3/SCJM9VxEFOBZnmVWKeSDTKyFLq+dysahlErI=,tag:NP/iV6aVZLy4RFOK1OqOPA==,type:str]
+mautrix-telegram-hs-token: ENC[AES256_GCM,data:6je3dFrFAoNCbUuZD7C+kMoQpNeqBxoUusEJBFM0IYcVAqsmclMktHWLFDerkfzgGmKverqnf+rINDVEX8Df5A==,iv:iDqeYSsw1OTxu4K+zAEU+eUz+TLnXSzXbr6J4cLp7KQ=,tag:PBHqaqJEVEN8nk5hmIVEpQ==,type:str]
+mautrix-telegram-api-id: ENC[AES256_GCM,data:R6C4gFh+NQ==,iv:30LZQR0CRmtAxqXVu/GOihdvdsWqGqiLMQJAM1yaSg0=,tag:9QM9VlCqSFuDo2k0WJx7/w==,type:str]
+mautrix-telegram-api-hash: ENC[AES256_GCM,data:m6RhyLX2wNtMG/rZtLtwPVYiF9rD6bqsulJTE4tNkeA=,iv:aGq8TGQCOVlf55XfM4A9V0eDF75E8Rg8Jg+Vc72NJ00=,tag:J2fJ+Q7KToQirY87t4mvzQ==,type:str]
+#ENC[AES256_GCM,data:6lE2jJal,iv:n6GbM2CZy9KSVRPJvnYYhcN81P77TUoy9ZJwplbtPLg=,tag:UaI3x5tu9meuZc2Wj+s82w==,type:comment]
+acme-dns-token: ENC[AES256_GCM,data:Q5rGOFLYvCQ0h8BZKC3JlcWHp2q3ucIoE1E3NujEGoBltdUj3RpY3Q==,iv:T38LtQ02/11zlJUUahIeDNXyd9fQ7MYAOYgAY5ioLMw=,tag:5G0emN3Oje+Otl4uBxe8Ow==,type:str]
+#ENC[AES256_GCM,data:XTHlwp41c52pmg==,iv:P82FtV4f+KziNF5QNca/xx8ZvdeZu+4tQmtePvjhKGU=,tag:AdVhiRLboyDT3jaSBjD0Mw==,type:comment]
+paperless-admin-pw: ENC[AES256_GCM,data:mfk+N/cxddgUiandSNIYvbt0X1nDLaWOzw==,iv:CbHsz5ldL4sdnMCghh5DFbIBeR7e7c8ftuB3cTRBXBQ=,tag:SGk6QsUO7+H30Mi8fFuaRQ==,type:str]
+kanidm-paperless-client: ENC[AES256_GCM,data:9mqdKyyuPyezSiNIVBe4/ViHydfkfZmAiA==,iv:frksTnlKbIHG1XdXUTQwKHLtlpRdZeQOOCBFRQ9DY1o=,tag:DBUy4xV0drIxXL9IxV30/w==,type:str]
+#ENC[AES256_GCM,data:4n9xtQ==,iv:Qa+X5jJ/PQLkEB/EdRoB6pic642twVkt8zTIkHLOGz8=,tag:cZP9TyLPNACeHRMqTsRnlw==,type:comment]
+mpd-pw: ENC[AES256_GCM,data:umt4fAgqaLBIXLhLLGUAay/YbSKC2r4uZA==,iv:yBOe8MpJZGrko30+zmP6LYI7uPJvQUf9+KhZAsSKk90=,tag:JWpGwG5trY/kLyQo707jDQ==,type:str]
+#ENC[AES256_GCM,data:mHqhDMd0XorN,iv:LFGTMK375H8QenyYVSSF0IfummbSa6XPSCrrQryy0/8=,tag:r7qqAYPVfVkgZXObQLYMGQ==,type:comment]
+nextcloud-admin-pw: ENC[AES256_GCM,data:WIS+dK+6sNa8l9sfqILcVXpI,iv:pAOX6uUusKKOGrzHzij6tNOHJkacxyac/YFbU8ZmFhY=,tag:NQByvZhCu1qf1Qb/Eor0sA==,type:str]
+kanidm-nextcloud-client: ENC[AES256_GCM,data:qEamdf1+i9Je6l2uswgDfrc/KkbLDDnZ/Q==,iv:T9g7V86o9sTIWZ6MwRg2Li2ntpR5B+DgvXbrM/pBHo0=,tag:OH4FKB6qgsdAEVb8wdkKCg==,type:str]
+#ENC[AES256_GCM,data:mRjlEtwcsjs=,iv:l+6IJr+nyIUF45vhNAw84eVoypF+grcKvXa3Z4mDntI=,tag:A8guEoZcPnAzlvsbQGI1NQ==,type:comment]
+grafana-admin-pw: ENC[AES256_GCM,data:OZRhYLC8mKGT1dLpYNA=,iv:JWLDUXsHEgISVX5qPOY/SyEyMbd1wBPRcX4aB9V1VY4=,tag:UnM7Ki9rqcv+QKEkbD5geQ==,type:str]
+prometheus-admin-pw: ENC[AES256_GCM,data:zKtPGDIDN/pJxdRuQthIOkvVgjmx+FrEcA==,iv:M/gY7JGCcf3qOR3abTOhW4oK+cEZ+qrA7Ej1dXXWXnU=,tag:LD4faKNGJnJSPv0w2UtCqw==,type:str]
+kanidm-grafana-client: ENC[AES256_GCM,data:wIPvYpMuT3cJKImJ/NrvfZg4u841DQNjow==,iv:BMIrNgd5p5kaQOqC7GyCz6tF76HOx7GHJ5TcWL/Qeaw=,tag:pfhys3Q1WBzv8lcaz4gSZA==,type:str]
+#ENC[AES256_GCM,data:jWNwieXkgftTIg==,iv:3fYUvETktHqHxg1MR2ZK6Bkz4DGjILS7gIU7taGj534=,tag:cLIde4jkQUo2kZ1nxACQ2A==,type:comment]
+freshrss-pw: ENC[AES256_GCM,data:+jKVUjkpNCjGSgE=,iv:SZu/AZxue9Y4xEdrAEHkwzuoL7THI6MS8YQFwcoRPMI=,tag:M/iBUKcKe1d6gW1cUpeBew==,type:str]
+freshrss-oidc-crypto-key: ENC[AES256_GCM,data:bsnB53+pm+1AlPx6kvQ46GUtocDZJW2+MyJDC7tuSbgY3hnFOhmbbQ==,iv:9gF7OLOTxva4znYIEsdvrfI9JFPhuFucuH3oK9Rj3f8=,tag:TY7QfUpI1GmkNYXDNyl4zQ==,type:str]
+kanidm-freshrss-client: ENC[AES256_GCM,data:7CO/LL3uKxQHFjfC3VR4JfL13hT7T/OG5w==,iv:Q5BZSrxMgUM5dXKKLeTXG/kWUgFb1RCmUQSg+B0H32w=,tag:gX2O/2l9XFk2r9HfGzWliA==,type:str]
+#ENC[AES256_GCM,data:fs3hYmSnPA==,iv:AO/BtxZ//pNQESSDYSUZzSWc1daj6aa2vXteC04HivI=,tag:HfRZ2YUWO2XNtjN8IZMmvQ==,type:comment]
+kanidm-admin-pw: ENC[AES256_GCM,data:OF7rhjmg0I7V5qc2nWfQzSAIMlowXapbvg==,iv:I3Ig16YFPP2BeoAdYmRLQe8fqdV/MC+GW3T61kNiftY=,tag:n/WcJsNejgoZIK4GmnaPlA==,type:str]
+kanidm-idm-admin-pw: ENC[AES256_GCM,data:UdGmzkgeDVWzFR+jqmwzxB2U0yjbOMf5ZQ==,iv:dB1rS0d7/hgA4UGSu/P2OIu43PHZbif3UkNd9vZ962Y=,tag:6mYDZUcobB0Vi/sZ+nOt/g==,type:str]
+kanidm-immich: ENC[AES256_GCM,data:9vIcSVknbeitmmj5SVWcfOkji+0tTyvEJA==,iv:cMorkTF7swSLShonZqkuPl2RfrGBOQVnR2XTFr8Rwy0=,tag:BK4QRnCsxNPpdqQk03ghMw==,type:str]
+kanidm-paperless: ENC[AES256_GCM,data:IjB3ZySYVS3OZU3pq4dE4qzm4F3enTEwYw==,iv:UZyYN5zyyvsAwLf55mAw32/CdygYbtfZvQY6BBzlchE=,tag:Tz3TOqf7oIyw1j414bvHDw==,type:str]
+kanidm-forgejo: ENC[AES256_GCM,data:hDPeC5CPg2yHvxtw5Z6uIwr9TtiJM+PjGg==,iv:+pEDpmePUbbH9H5edZ5IPPXY1g2Daw8lLgyDM+h/0Zc=,tag:tugJxGP2LTYrHnNKb4/wgg==,type:str]
+kanidm-grafana: ENC[AES256_GCM,data:+tfJr1mrfD7Kza9R26av7G+QgzzQhjeUmw==,iv:StWa8qivQZFhA1V5pSskeXL2IF8QkZd/tdOdAmWJLL8=,tag:U5A137+ACOWl1LdmLwb+xA==,type:str]
+kanidm-nextcloud: ENC[AES256_GCM,data:yTBSlSN7O+ywGB6j8dvORE8C3xabayg3NA==,iv:kprbm7NR/ukczINENzdLOgBl2fwSs1CWkW+XFmLYxTw=,tag:U1fwlVRwcJBMbxCPAqovBg==,type:str]
+kanidm-oauth2-proxy: ENC[AES256_GCM,data:Wj+tqtfxI/JDZwM8dFKvWaq6P5xrdPeszw==,iv:9WNcoLs4zMzVgGAMIanS8IAJKZU/IV9AY4YXw8gsl4c=,tag:JTZMI7xmzlVbpoN7T35bJA==,type:str]
+kanidm-freshrss: ENC[AES256_GCM,data:pO6j+ZAD8NXUiHMZ5jg1Dsu6OcFr8BUIfQ==,iv:2vxDhyGqafbOBLsmQFuiBVN/2H4h2ZIJfG7h4iV/dIE=,tag:cYO2ANzUMAwVBiq87SQ0wA==,type:str]
+kanidm-firezone: ENC[AES256_GCM,data:5QcRJy1kn1bk8zBqPznyq6vHHukmIIQpiQ==,iv:GL0QkqhsgRIeE+1rIDqVuC+UyIKPJTu5AHALBMZq2Yg=,tag:+kF/HQexEgg6JJyv3LeGvw==,type:str]
+#ENC[AES256_GCM,data:nkfK+2JT/zAFEN5r,iv:zhequNAlsknCC1ROXYm+tzaUy6mN6XmuqS13Q6HU0a0=,tag:FQw0dwMR/yitjGSFWW6/RQ==,type:comment]
+firefly-iii-app-key: ENC[AES256_GCM,data:1jLFVD8tMVF9hYiNeUZn1ZpPcKuvpYEZxLJcylg415PXl7ngmDa6H3ruYKFk/rt0sjh7,iv:uFBKrNOa5NdHWsLW5knd16tF0HQH7j4nsoF2TGEcrl0=,tag:X61hLERJNS//sSkhtkBEwA==,type:str]
+#ENC[AES256_GCM,data:ZeR7BLj26KJabuQx,iv:Fp8Etgu5tg9xmqT421n7vvQvL27evPslZmVgIiGCGDs=,tag:DjirUtjNCh09D2JGJXqaYQ==,type:comment]
+koillection-env-file: ENC[AES256_GCM,data:G/Nwzw5wQAr7aUfM+JclpmXaVwLKr9DV4M0F69Sya1U=,iv:gAYrD2XFKl0gWyU0wQ2JU0Vrn9bXVLJf5p1HdunZxqw=,tag:y64flWvqJ2KGETBnnnSDOw==,type:str]
+koillection-db-password: ENC[AES256_GCM,data:vKHnmcvSOKhHOt6Mdbw+uT7GdM8=,iv:/pHI4ficUG81gkAUTATUt1SLDxiWYZoONqXUrIuEjcM=,tag:2kRNBut9P8qSGvy1D5mJzA==,type:str]
+#ENC[AES256_GCM,data:QgzAs3Xq1wgb10RNZzl0uJA=,iv:oCIr3yh3iiaskY1en7QPZvRGhC4wmzGI2MQ9qJ1FoW0=,tag:Fjcr+5Xz3gmEckizaUczgQ==,type:comment]
+anki-pw: ENC[AES256_GCM,data:TGKLFfBD9UEZlvc=,iv:8GsOAxr7DI4uEsGREfsbRPA6p6/7Jl9oUXWpCmobBZ4=,tag:ZpmubPgfwmLw817sMpHRcg==,type:str]
+#ENC[AES256_GCM,data:g1yoM9Q8wfA=,iv:Gj/srSIg6aI0lybHMQGu8wu2KfvzdKJ3XetoTaZwJpg=,tag:N1lqDLoqhiT7YNu4hyvwmw==,type:comment]
+kanidm-forgejo-client: ENC[AES256_GCM,data:eQwwaqdWAHQ+1HgfKtx9v/5kT1rzbFfUhA==,iv:HKylHTkifgSIuq4tKPIsyOzDCn5ynl66/PLDyWW/pEQ=,tag:k3ZjA0BvdLvpbogq+e9JUQ==,type:str]
+#ENC[AES256_GCM,data:7ZIGRjWPgI9l,iv:YXDxvRZ9SPO9cJBsGQ2T1i5DojjaghrlF5h53ECgukE=,tag:uXvmB3kINl4jg+18OoSpHA==,type:comment]
+radicale-user: ENC[AES256_GCM,data:jsrSPQ9bk5IPSaw=,iv:4o4BYlQlWONCv5M51C1EhgbxGvg8Bir/rIdMjGO+yeo=,tag:oxrSuJS9LKRQurSM+0gfYg==,type:str]
+#ENC[AES256_GCM,data:MiKHFUmTDvnrjhw=,iv:Y72pVFthqLq+LVj5bmy7dNDvXMxvTtFPEHSAfB1Dcoo=,tag:802/jEiC4zWXmvjXPwSYEw==,type:comment]
+prometheus-admin-hash: ENC[AES256_GCM,data:Zp2yXBiFudvD75Yupi5mjQwL5wai+atnJ0ltzM+TnzFNzFgYv8hdilsxYSD0VDo6CZJWhEtp9ozfiETs,iv:jidoobYusa5RfAZfcdVSNj5yKBJvlRRCfcN7MYkN6Ko=,tag:2tYV/SFajv9VE+lIOuH/5w==,type:str]
+snipe-it-appkey: ENC[AES256_GCM,data:6nsXRMr2Fr7e0b/0WJS7ntlg5HEedGMCGe/69kwfyb6llSp4Pn1H4eQc0Mk=,iv:ZtL9tTNZhUT+YL7Ps7ZyUBKd5W0i7ZZAeqyZbJB6ELs=,tag:nJnqHXg6OhQhRnRtraW3bA==,type:str]
+snipe-it-db-password: ENC[AES256_GCM,data:Jpk3Ka4/Fk3CMdUZDf1SbaUbGbmkYl1L2YvEpGR/H4kq32Q=,iv:7t4bM8c2huTEYxUJDxu72dTueiGNOzwFjoedcQK5hdY=,tag:IHXqtICjjd4O/9MqqCyu2Q==,type:str]
+#ENC[AES256_GCM,data:Z2MArzHJ5g==,iv:5IFG5SSmOOQU8hUiwLXG2UBRbPmgeq09/XU7UcPqoDc=,tag:93YLtbQgBMdDWCSl5BUVvw==,type:comment]
+garage-admin-token: ENC[AES256_GCM,data:XZ4OVmqy4O2+NBqV+TlVCYb9Lk5bNoKFLcCNaNIRv0YEKcIgAlnL3bTuIaw=,iv:KvYTpvnmupx5DIVIh/EkKPkX3yr/3eLMzWB1vA5KM9k=,tag:L+kMrGSHXUsEqH0oFuBB2Q==,type:str]
+garage-rpc-secret: ENC[AES256_GCM,data:uTLsZv1viatNX3f1qdDvFDKfVRgDDLv2+AUHCPo3lx/cUiB9HMcuUHJoNP8sLeuX77WXon29ZKMd5fKnydo77g==,iv:IJgDZZkA4QQfOWTWh7OLtWRZi0yE4dKE0BoJCqopWl8=,tag:wh9aWZhEehHx0nQ8UBBNKg==,type:str]
+sops:
+    age:
+        - recipient: age14sjyqch8tzqexk2gv0qgrrg09f0s6hvwhsgjac3vs6sc5rzgpcxsyqda6u
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvVEgzdnZUTjlOM2Q1M3pI
+            VW1OWEtGczU3cHlXaU45MTk3MzNYNnh4L1FJCkVNOFBlVUFpZFZqOGhBVVBQR3gw
+            SzRXbEZyZWNoZlVwQWxZWVZUSFBEd00KLS0tIGs4bnd5M05DMWtOaFJDYlVaY1RU
+            cUpZZzBOZHlZdzRoS0l4SkRER1JQeTQKBeYA2sVQab9moaYlT0jE7/zMJvOJoC7V
+            QwHXwnkjZCavAC5HIn82PzJ0DNrMKSZ136AgA+F99X0ZFyFnEIFZCQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-10T11:56:45Z"
+    mac: ENC[AES256_GCM,data:3Y124JX/6MsyIeOv9t0DPSv6YUICgvQn688LpXvW2jSWYRuJCbSWG67cPQHCNYP3NjFWXuASlKhDRJQicwgamh3WrE7gC7QxtqCVtwL0FTfZeOQ+vRoIejWIldcKC3YK6vKYW/O//Uhd+5rG8ah2b7XqRvgv8bwIdUKFUQqG0EA=,iv:VfsIS6+QTbv4WhykReXOGkGul7dWj0Voux2vrkv6Ecw=,tag:h7zZqbe4NAZ0PlcWBq0r2w==,type:str]
+    pgp:
+        - created_at: "2026-01-10T00:38:27Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAupwKI+ZxJSXN856THn/72D4Exl6hY+Xs2SlU/MO3USYV
+            1/2SuZK6x/yl8tXycUiAJ/G/2iPEkE7QIpou0Ck0Q5dCzGyEyjh8d6myEGpCXTyJ
+            +41bMOHrnRWpZ1IPeU2qfbp4RNF6i3i0VOSzT7Hi7i7xDGQCMoD6yRwo2NH5T03P
+            DNkssIZ2V4SbCF+uHF5wbNgOlBZcLex2I/0vfgQXBz2wClaVY/YAkKarjroARhI6
+            K8zaueup2/uJr6UBvsbBXdroYSJDKkzl9cMl+g16RnqQKPj6BMKD12c3w/U9Jmb6
+            dXGWjs2xLQJ0coD9pl7hpSuYBBZk3h4/wpI1Tyxf9s5qra4ARtJbvlhztkYbTnby
+            vrOR6zFrbqHuTqPIil2rCTkMGXxEgyJ0sMIWDWRF1PUb8LODBBhgfYSUHOZM3rvK
+            1txWY7Wz1SOO2J+MjCmgvEUakW1Pp4c5hIDtmRTBwlEx0s1/Yb6S6sTPloNepDnW
+            ev0YJIDX4zdHn73yZaYOrPX6NsUSSHC9SPVHIZSOWO+nO7DdX/eSKd5NbZJEyKcf
+            xUQoKvF0+3Lg7Xh/p9yLfmaMEQvTxBcBhBmYOxboiKOFacJBVz4MbfSkCXm4IAeb
+            YW6ToixrOv7Dm92ii5uqfsOtnwP0LlMa+x54wc8S7lqND1Yw+CHGgt3AGoN9hDCF
+            AgwDC9FRLmchgYQBD/9OfpyzNpwlBkbqWXcygmkd9n121KhPdIWd174zcDmln0h9
+            3+1CM4MPerCOpqrLKI9KpYUct7b1ObwEcG21famUR3scKFSSgaPWst2sSz1W0YmT
+            eRJ3TZrO7gVHkWZ5pBjBFbYa3E7P0LbDYcXJrEa74OKiW+ukICYvtQp7s1bLMoH6
+            Gy23xglPpgb1tMhLk6TXbPuj3p2rErUjhR+f/TNmStliVGfFmnYSigGlG3MZmhSp
+            q6/SFeTCbWg6qMqgCxz1xvG7zRTVxTKdTop5YF7lcpY25Jso+z9TPGfWV9xzOejy
+            ZKE4Jako6mrkNmgYZPL5E8y7R3n9AZnieXzgKC19d2QFergy5wp41Qwwpk+YCcpR
+            vSBLcIIgHDizDI1+1878MvBM3soRcyPhkq6Y/eg5SuUATvG8k11VxznO+iEXDv9B
+            G8JkK6IOYwYGhaawcsmwZedyrRq97DEZYgONemriaY/UB2MT3uY369NDV0UrIZgz
+            FNXp9GwuaXj+M5MJaG6//G36IKnhEBJqVvmqpR/FQiSIddnGYJrW7WkGEIYsHLEy
+            sF1vmblhE8f/4w3IrNv1SmBnE/IwrKe+OIT4b5SUFQaTFe8m1fuj7M6i+LRcsJmi
+            QQ/G3OFbZVycjjz+3Wm17sOez5UDzTCTgXfIxLlqselCPjEmNgB/xF/XNKvcxtJc
+            ARnZYFJHNPPnyvGgT5UO0unihVvYwjANSspdUVo9kYfgO7DV4ptN/eRYppZvnSIn
+            bGBYIVuHzTQyfjNzgukghJANWctbyaABv6wZPTO6/jjNtkMAI60+vjfKCTI=
+            =OxXr
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/storage/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/storage/secrets.yaml
@ -0,0 +1,57 @@
+wireguard-private-key: ENC[AES256_GCM,data:IsQLebLnWOCmERQLSmZAASOgxyg8itWr0o3rt6062cbWIDLO+TPJTDtlWRE=,iv:bhhFTLjhHMTfEyynklpWPTU6KCpBZJZoRLlr0o+Pk7Q=,tag:j4pCfGDo2CQPpKmpn6gVyg==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-07T13:36:51Z"
+    mac: ENC[AES256_GCM,data:eRO2+uoeWo+qeZR1gf7QJbydXvrLWwQQytNDM0Hxo9S8ONrSK6uA6Vac050Tmo9JM3606pr9RR3RvtRn20jcKI9X1PNVayE/hhdgug7O2CzpR7Xnekh7PM2N9hLgdH8lKdOASPXTYMQxnvKfX0oWEjLnRa28kK48GzdyrLh2iU4=,iv:UQuaMAcVjgz+fD99lJPMRvcWNduYxCccKDnwPT1ikf0=,tag:7VgsxiXcYaHnQyUoOSvmoQ==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/summers/secrets/transmission/secrets.yaml
+++ b/hosts/nixos/x86_64-linux/summers/secrets/transmission/secrets.yaml
@ -0,0 +1,57 @@
+wireguard-private-key: ENC[AES256_GCM,data:o3wV7UI5BSV9YU0uaumgfFWBJlgMewpUqOusvcGWxOW8dSrT/aqpT9iu1K0=,iv:fNf6fOL8KcYBxmfFLi5K/qPmNfon16HE1fgQ86qNDNU=,tag:BoRbtrw7jvENAn5wiP/sWQ==,type:str]
+sops:
+    age:
+        - recipient: age1wmx8y2hs83j2u5srdnfxljrzxm8jtxl6fr0mq7xf2ldxyglpzf2qq89rpx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMEM4alliWlBCT3VsbVA5
+            OGt5bmQvZW1TaUNkbWtFdzVGNDNpY0hBOVhzCm84TldYNHBrU01HMlBkbGNwZFAw
+            WVk0T3FycVRHUUNtM1pTYkQ4Qmw3RTgKLS0tIE9LUlNEVjJHOGVIK1RSMmRXUDF6
+            QlRKY1hRVzNTVXhESUd3OElXL2pBZXcKDWYoOzi2b4qeIbCVCfTj0lTW+OfbnsXB
+            8MugCHu7+b+ju0v/lUP66jDW9/2AH4PzHtCNHjsafyzr2qnW8HlOzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1c2enwel9un28dcs4wg0vcyamx9a4a6g3walkhu8w5lqhmd804paq9d24as
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWJXR2tYdEd4cTZsSi9l
+            Tm1pSC9pek5BakpEMlkwVTcrMlBuVzlXWUVrCmlnV0xJc25nL0twK3VCZ3FRK2x2
+            RW52Q1NxWUhTUGY0NnQ0WEhLMWxIcFUKLS0tIG83eVM0KzdLQ004aDRKNTYvdmVZ
+            d3ZOSStBMFpSU2ZjNWhFRkREQWlUdmcKggVvLy1mLYGf8084RQtlipS4+z4dfPsN
+            HZfid0srwYnezlQ5qOY8/HrDLWHEyuZ4xFZVi4n0k49qBpNwJdmvyQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-07T13:36:52Z"
+    mac: ENC[AES256_GCM,data:Sb9HItfMt5WaTYJw1/OcPVR3SBKzAifgK0NTwSb59ByxAsaOhkXrGL2cx+6p7QpVBw2V9duiFVmZhOp9vW2clCQX2RwiSAxaRLcDtVIoqB7YfmiNTdzrEDFHJNndbT6Vs0qOb42tjMyKXGZIcrA55G3Vh8S5Qy5w3IW4CSwI20U=,iv:pRjPa71yPRy4X29IPjk9Jju4JZkhIK2uucgK/dBX4L8=,tag:2RD746vX1mlQu3GyDELF8w==,type:str]
+    pgp:
+        - created_at: "2026-01-02T21:12:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTARAAmvkQ9V14f0BT/bNdFVZtTlY4yVon37CX32SZPUcHV7o8
+            Dya0sZd9tuVATSv79TnybscuNx95fkoZJwujBfAadexn2zY8zl1oEWEHx7p+8/mE
+            W8JbQAjbcbX9sNQYXc8kYJylBThmgNN/HXK7CGtgDFr9xnGzDBnDm/M31P1HwYBm
+            IdIQgFGErEt1K3xvw28Lk3tPuZLK3Y+H2Yna7RRF6K1blGJUvEnL6yFdA10/eFW7
+            8066mO26F2l5xFuktK0nNeniLHKa5VVYp8iM+JMhX38l0wiIi8pGyxo3uAjNpa0w
+            IfpCneEBe/yyaUPcWMjXmUG5LJe3kWUup8cSzvu01Z3W159/QsflxIMkIsklqhim
+            B2zuPdAlYsjjS/05DIHInN2IIB/rjADkQvXji1XYLhWJj4jxDeck/UIc6Q22TED+
+            autlbl8d/5sqyO5ghPpShF/s0vMTqUfpXZrDrbuyDFqCfwi0ahP03bUsv20ZEz6u
+            zG3K5HuXHh7ATSppwuMbcv7vcjF1tkbo6XhWZDv0rY0DFWqiYhnxWwlFlGLxf4zX
+            g6r7Ca/E/YXG/eOET6M9DxwHjj0D7u/ryAkCktqPL9w8oNGarZQ/xMx0+ocI3byc
+            Zvzlmd63BtgaGNSxH3stK29KN3ED8cDkG/JzAxCATWiUBBkqW/ga4sGZqtLlSO+F
+            AgwDC9FRLmchgYQBD/9JbFZie25PO2CyELlUWm5SmJcugT9SK/mIA2fe1PlA+Gnf
+            5z9iXraMSQchz4R1IoiixDhubwKeKp/auqhlOPvo58Lsi6iDR/WaLWabD+hcyAb1
+            ck/f/PUzTLhlLcfu18VPfXVzfnky3dX8P5aS0WMLAQblj2RaaiHxnPqf49kXSn3q
+            VSJ0pr0nEsPuWtoCkHUAwAJ8X5GPXN2OD4YbHsNaA9h2vrJAxNd5+HNsvg8JtI88
+            X/uMM7cWcaXcmNZOz166HUIPcJ5cabJ48Sv8sDfMPOcTiJkMiESBnRYTwdUcp08m
+            nGipSrUeW3pVOC1bGyukZb6sF84pTtCpqS+kOSfKFlxFFdAEcpzFIPuOMeo2dbKj
+            GSGPDemZFC2yFq883yk9/mZbgjOUsqrj0ZP3rCD5ZHpfUM5IxGQ+mKaOucTXYmif
+            lrTPMYnAc7pHxKZ87BgiKBYrfRAZvorLYKv8zG8YagAUw8iCtc68YUUdvLW9haQf
+            rwWCU1z+sszYSac7I57gfqICQhMUbs1n9S2Cn0C0xo4q2Lu36ysip4rEVGg6TmUu
+            znXYu+3orodw2TwC0tGxXHYKwmlr7EGnBCbdVKpDoCbV6cYkDYoPUFg0alqIPd5r
+            KCkee9MaCLLX7IdBrbLf1lkHGwSAs81GfZRMLBauM7/hn+hMUeIJnMbtJnVIB9Je
+            AdT2nSH06+POnjvxa2t0dUasnG/6ISBRSk6FgBBZ+pdVlrvaB4javgWGpiAWCUu6
+            b2CMZF3HullmLj+wwAKlsZsIOXGICN5GeQxLHYF8Kx7Doj68Owu/zGM5MS+7XQ==
+            =wYdb
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/hosts/nixos/x86_64-linux/winters/default.nix
+++ b/hosts/nixos/x86_64-linux/winters/default.nix
@ -72,35 +72,35 @@

  swarselmodules.server = {
    diskEncryption = lib.mkForce false;
-    nginx = true; # for php stuff
-    acme = false; # cert handled by proxy
-    wireguard = true;
+    # nginx = true; # for php stuff
+    # acme = false; # cert handled by proxy
+    # wireguard = true;

-    nfs = true;
-    kavita = true;
-    restic = true;
-    jellyfin = true;
-    navidrome = true;
-    spotifyd = true;
-    mpd = true;
-    postgresql = true;
-    matrix = true;
-    nextcloud = true;
-    immich = true;
-    paperless = true;
-    transmission = true;
-    syncthing = true;
-    grafana = true;
-    freshrss = true;
-    kanidm = true;
-    firefly-iii = true;
-    koillection = true;
-    radicale = true;
-    atuin = true;
-    forgejo = true;
-    ankisync = true;
-    homebox = true;
-    opkssh = true;
+    # nfs = true;
+    # kavita = true;
+    # restic = true;
+    # jellyfin = true;
+    # navidrome = true;
+    # spotifyd = true;
+    # mpd = true;
+    # postgresql = true;
+    # matrix = true;
+    # nextcloud = true;
+    # immich = true;
+    # paperless = true;
+    # transmission = true;
+    # syncthing = true;
+    # grafana = true;
+    # freshrss = true;
+    # kanidm = true;
+    # firefly-iii = true;
+    # koillection = true;
+    # radicale = true;
+    # atuin = true;
+    # forgejo = true;
+    # ankisync = true;
+    # homebox = true;
+    # opkssh = true;
  };

  networking.nftables.firewall.zones.untrusted.interfaces = [ "lan" "enp3s0" ];
--- a/hosts/nixos/x86_64-linux/winters/hardware-configuration.nix
+++ b/hosts/nixos/x86_64-linux/winters/hardware-configuration.nix
@ -1,4 +1,4 @@
-{ config, lib, modulesPath, ... }:
+{ lib, modulesPath, ... }:

 {
  imports =
@ -13,7 +13,7 @@
    extraModulePackages = [ ];

    supportedFilesystems = [ "zfs" ];
-    zfs.extraPools = [ "Vault" ];
+    # zfs.extraPools = [ "Vault" ];
  };

  fileSystems = {
--- a/modules/home/common/zsh.nix
+++ b/modules/home/common/zsh.nix
@ -1,4 +1,4 @@
-{ config, pkgs, lib, minimal, globals, confLib, type, ... }:
+{ self, config, pkgs, lib, minimal, globals, confLib, type, ... }:
 let
  inherit (config.swarselsystems) flakePath isNixos;
  crocDomain = globals.services.croc.domain;
@ -46,7 +46,7 @@ in
            boot-diff = "nix store diff-closures /run/*-system";
            gen-diff = "nix profile diff-closures --profile /nix/var/nix/profiles/system";
            cc = "wl-copy";
-            build-topology = "nix build .#topology.x86_64-linux.config.output";
+            build-topology = "nix build --override-input topologyPrivate ${self}/files/topology/private .#topology.x86_64-linux.config.output";
            build-iso = "nix build --print-out-paths .#live-iso";
            nix-review-local = "nix run nixpkgs#nixpkgs-review -- rev HEAD";
            nix-review-post = "nix run nixpkgs#nixpkgs-review -- pr --post-result --systems linux";
--- a/modules/nixos/common/globals.nix
+++ b/modules/nixos/common/globals.nix
@ -189,6 +189,14 @@ in
                    type = types.nullOr types.str;
                    default = null;
                  };
+                  serviceAddress = mkOption {
+                    type = types.nullOr types.str;
+                    default = null;
+                  };
+                  homeServiceAddress = mkOption {
+                    type = types.nullOr types.str;
+                    default = null;
+                  };
                  isHome = mkOption {
                    type = types.bool;
                    default = false;
--- a/modules/nixos/common/lanzaboote.nix
+++ b/modules/nixos/common/lanzaboote.nix
@ -1,18 +1,25 @@
 { lib, pkgs, config, minimal, ... }:
+let
+  inherit (config.swarselsystems) isSecureBoot isImpermanence;
+in
 {
  options.swarselmodules.lanzaboote = lib.mkEnableOption "lanzaboote config";
  config = lib.mkIf config.swarselmodules.lanzaboote {

-    environment.systemPackages = lib.mkIf config.swarselsystems.isSecureBoot [
+    environment.systemPackages = lib.mkIf isSecureBoot [
      pkgs.sbctl
    ];

+    environment.persistence."/persist" = lib.mkIf (isImpermanence && isSecureBoot) {
+      directories = [{ directory = "/var/lib/sbctl"; }];
+    };
+
    boot = {
      loader = {
        efi.canTouchEfiVariables = true;
-        systemd-boot.enable = lib.swarselsystems.mkIfElse (minimal || !config.swarselsystems.isSecureBoot) (lib.mkForce true) (lib.mkForce false);
+        systemd-boot.enable = lib.swarselsystems.mkIfElse (minimal || !isSecureBoot) (lib.mkForce true) (lib.mkForce false);
      };
-      lanzaboote = lib.mkIf (!minimal && config.swarselsystems.isSecureBoot) {
+      lanzaboote = lib.mkIf (!minimal && isSecureBoot) {
        enable = true;
        pkiBundle = "/var/lib/sbctl";
        configurationLimit = 6;
--- a/modules/nixos/common/pii.nix
+++ b/modules/nixos/common/pii.nix
@ -53,7 +53,7 @@ in

      secrets = lib.mkOption {
        readOnly = true;
-        default = lib.mapAttrs (_: x: importEncrypted x { inherit lib nodes inputs; }) config.repo.secretFiles;
+        default = lib.mapAttrs (_: x: importEncrypted x { inherit lib nodes inputs; inherit (inputs.topologyPrivate) topologyPrivate; }) config.repo.secretFiles;
        type = lib.types.unspecified;
        description = "Exposes the loaded repo secrets. This option is read-only.";
      };
--- a/modules/nixos/optional/systemd-networkd-server-home.nix
+++ b/modules/nixos/optional/systemd-networkd-server-home.nix
@ -21,6 +21,7 @@ in

    boot.initrd = lib.mkIf (isCrypted && (localVLANsList != [ ]) && (!isRouter)) {
      availableKernelModules = [ "8021q" ];
+      kernelModules = [ "8021q" ]; # at least summers needs this to actually find the interfaces
      systemd.network = {
        enable = true;
        netdevs."30-vlan-${initrdVLAN}" = {
@ -55,6 +56,20 @@ in
      };
    };

+    topology.self.interfaces = (lib.mapAttrs'
+      (vlanName: _:
+        lib.nameValuePair "vlan-${vlanName}" {
+          network = lib.mkForce vlanName;
+        }
+      )
+      localVLANs) // (lib.mapAttrs'
+      (vlanName: _:
+        lib.nameValuePair "me-${vlanName}" {
+          network = lib.mkForce vlanName;
+        }
+      )
+      localVLANs);
+
    systemd.network = {
      netdevs = lib.flip lib.concatMapAttrs localVLANs (
        vlanName: vlanCfg: {
--- a/modules/nixos/optional/systemd-networkd-server.nix
+++ b/modules/nixos/optional/systemd-networkd-server.nix
@ -25,6 +25,7 @@ in
        in
        {
          "10-${ifName}" = lib.mkIf (isRouter || (localVLANs == [ ])) {
+            # address = lib.optionals (isRouter || (localVLANs == [ ])) [
            address = [
              "${globals.networks.${config.swarselsystems.server.netConfigName}.hosts.${config.node.name}.cidrv4}"
              "${globals.networks.${config.swarselsystems.server.netConfigName}.hosts.${config.node.name}.cidrv6}"
--- a/modules/nixos/server/adguardhome.nix
+++ b/modules/nixos/server/adguardhome.nix
@ -24,7 +24,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

@ -64,6 +65,7 @@ in
            # FIXME: change to homeWebProxy once that is setup
            answer = globals.networks.home-lan.vlans.services.hosts.${homeWebProxy}.ipv4;
            # answer = globals.hosts.${webProxy}.wanAddress4;
+            enabled = true;
          })
          homeDomains;
        filters = [
@ -83,6 +85,7 @@ in
            enabled = true;
          }
        ];
+        user_rules = config.repo.secrets.local.adguardUserRules;
      };
    };

--- a/modules/nixos/server/ankisync.nix
+++ b/modules/nixos/server/ankisync.nix
@ -31,7 +31,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/attic.nix
+++ b/modules/nixos/server/attic.nix
@ -28,7 +28,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/atuin.nix
+++ b/modules/nixos/server/atuin.nix
@ -20,7 +20,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/disk-encrypt.nix
+++ b/modules/nixos/server/disk-encrypt.nix
@ -51,6 +51,7 @@ in
      initrd = {
        secrets."/tmp${hostKeyPathBase}" = if minimal then (lib.mkForce generatedHostKey) else (lib.mkForce hostKeyPath); # need to mkForce this or it behaves stateful
        availableKernelModules = config.swarselsystems.networkKernelModules;
+        kernelModules = config.swarselsystems.networkKernelModules; # at least summers needs this to actually find the interfaces
        network = {
          enable = true;
          flushBeforeStage2 = true;
--- a/modules/nixos/server/firefly-iii.nix
+++ b/modules/nixos/server/firefly-iii.nix
@ -35,7 +35,8 @@ in

    globals.services.${serviceName} = {
      domain = serviceDomain;
-      inherit proxyAddress4 proxyAddress6 isHome;
+      inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+      homeServiceAddress = lib.mkIf isHome homeServiceAddress;
    };

    services = {
--- a/modules/nixos/server/firezone.nix
+++ b/modules/nixos/server/firezone.nix
@ -53,7 +53,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/forgejo.nix
+++ b/modules/nixos/server/forgejo.nix
@ -34,7 +34,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/freshrss.nix
+++ b/modules/nixos/server/freshrss.nix
@ -52,7 +52,8 @@ in

    globals.services.${serviceName} = {
      domain = serviceDomain;
-      inherit proxyAddress4 proxyAddress6 isHome;
+      inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+      homeServiceAddress = lib.mkIf isHome homeServiceAddress;
    };

    services.${serviceName} =
--- a/modules/nixos/server/garage.nix
+++ b/modules/nixos/server/garage.nix
@ -108,7 +108,8 @@ in
      };
      services.${specificServiceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/homebox.nix
+++ b/modules/nixos/server/homebox.nix
@ -24,7 +24,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/hydra.nix
+++ b/modules/nixos/server/hydra.nix
@ -23,7 +23,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/immich.nix
+++ b/modules/nixos/server/immich.nix
@ -25,7 +25,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/jellyfin.nix
+++ b/modules/nixos/server/jellyfin.nix
@ -11,15 +11,15 @@ in
      extraGroups = [ "video" "render" "users" ];
    };

-    nixpkgs.config.packageOverrides = pkgs: {
-      intel-vaapi-driver = pkgs.intel-vaapi-driver.override { enableHybridCodec = true; };
-    };
+    # nixpkgs.config.packageOverrides = pkgs: {
+    #   intel-vaapi-driver = pkgs.intel-vaapi-driver.override { enableHybridCodec = true; };
+    # };

    hardware.graphics = {
      enable = true;
      extraPackages = with pkgs; [
        intel-media-driver # LIBVA_DRIVER_NAME=iHD
-        intel-vaapi-driver # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
+        # intel-vaapi-driver # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
        libva-vdpau-driver
        libvdpau-va-gl
      ];
@ -38,7 +38,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/jenkins.nix
+++ b/modules/nixos/server/jenkins.nix
@ -18,7 +18,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/kanidm.nix
+++ b/modules/nixos/server/kanidm.nix
@ -72,7 +72,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

@ -396,13 +397,20 @@ in

    systemd.services.${serviceName}.serviceConfig.RestartSec = "30";

-    nodes = {
-      ${dnsServer}.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
-        "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
+    nodes =
+      let
+        extraConfig = ''
+          allow ${globals.networks.home-lan.vlans.services.cidrv4};
+          allow ${globals.networks.home-lan.vlans.services.cidrv6};
+        '';
+      in
+      {
+        ${dnsServer}.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+          "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
+        };
+        ${webProxy}.services.nginx = confLib.genNginx { inherit serviceAddress servicePort serviceDomain serviceName; protocol = "https"; noSslVerify = true; };
+        ${homeWebProxy}.services.nginx = confLib.genNginx { inherit servicePort serviceDomain serviceName; protocol = "https"; noSslVerify = true; extraConfig = extraConfig + nginxAccessRules; serviceAddress = homeServiceAddress; };
      };
-      ${webProxy}.services.nginx = confLib.genNginx { inherit serviceAddress servicePort serviceDomain serviceName; protocol = "https"; noSslVerify = true; };
-      ${homeWebProxy}.services.nginx = confLib.genNginx { inherit servicePort serviceDomain serviceName; protocol = "https"; noSslVerify = true; extraConfig = nginxAccessRules; serviceAddress = homeServiceAddress; };
-    };

  };
 }
--- a/modules/nixos/server/kavita.nix
+++ b/modules/nixos/server/kavita.nix
@ -37,7 +37,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/kea.nix
+++ b/modules/nixos/server/kea.nix
@ -29,7 +29,7 @@ let
            rapid-commit = lib.mkIf (intX == 6) true;
            pools = [
              {
-                pool = "${lib.net.cidr.host 20 vlanCfg."cidrv${x}"} - ${lib.net.cidr.host (-6) vlanCfg."cidrv${x}"}";
+                pool = "${lib.net.cidr.host 100 vlanCfg."cidrv${x}"} - ${lib.net.cidr.host (-6) vlanCfg."cidrv${x}"}";
              }
            ];
            pd-pools = lib.mkIf (intX == 6) [
--- a/modules/nixos/server/koillection.nix
+++ b/modules/nixos/server/koillection.nix
@ -41,7 +41,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/mailserver.nix
+++ b/modules/nixos/server/mailserver.nix
@ -24,7 +24,8 @@ in
      };
      roundcube = {
        domain = roundcubeDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/matrix.nix
+++ b/modules/nixos/server/matrix.nix
@ -1,4 +1,4 @@
-{ lib, config, pkgs, globals, dns, confLib, ... }:
+{ self, lib, config, pkgs, globals, dns, confLib, ... }:
 let
  inherit (config.swarselsystems) sopsFile;
  inherit (confLib.gen { name = "matrix"; user = "matrix-synapse"; port = 8008; }) servicePort serviceName serviceUser serviceDomain serviceAddress proxyAddress4 proxyAddress6;
@ -59,6 +59,20 @@ in

    # networking.firewall.allowedTCPPorts = [ servicePort federationPort ];

+    topology.self.services = {
+      ${serviceName} = {
+        name = lib.swarselsystems.toCapitalized serviceName;
+        info = "https://${serviceDomain}";
+        icon = "${self}/files/topology-images/${serviceName}.png";
+      };
+    } // (lib.listToAttrs (map
+      (service:
+        lib.nameValuePair "mautrix-${service}" {
+          name = "mautrix-${service}";
+          icon = "${self}/files/topology-images/mautrix.png";
+        })
+      [ "whatsapp" "signal" "telegram" ]));
+
    systemd = {
      timers."restart-bridges" = {
        wantedBy = [ "timers.target" ];
@ -99,7 +113,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/microbin.nix
+++ b/modules/nixos/server/microbin.nix
@ -58,7 +58,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/monitoring.nix
+++ b/modules/nixos/server/monitoring.nix
@ -68,7 +68,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

@ -221,6 +222,10 @@ in

    nodes =
      let
+        extraConfig = ''
+          allow ${globals.networks.home-lan.vlans.services.cidrv4};
+          allow ${globals.networks.home-lan.vlans.services.cidrv6};
+        '';
        genNginx = toAddress: extraConfigPre: {
          upstreams = {
            "${grafanaUpstream}" = {
@ -267,7 +272,7 @@ in
          "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
        };
        ${webProxy}.services.nginx = genNginx serviceAddress "";
-        ${homeWebProxy}.services.nginx = genNginx homeServiceAddress nginxAccessRules;
+        ${homeWebProxy}.services.nginx = genNginx homeServiceAddress (extraConfig + nginxAccessRules);
      };
  };
 }
--- a/modules/nixos/server/navidrome.nix
+++ b/modules/nixos/server/navidrome.nix
@ -50,7 +50,8 @@ in
      };
      services.${serviceName} = {
        domain = serviceDomain;
-        inherit proxyAddress4 proxyAddress6 isHome;
+        inherit proxyAddress4 proxyAddress6 isHome serviceAddress;
+        homeServiceAddress = lib.mkIf isHome homeServiceAddress;
      };
    };

--- a/modules/nixos/server/network.nix
+++ b/modules/nixos/server/network.nix
@ -27,7 +27,7 @@ in

    swarselsystems.server.localNetwork = netConfig.localNetwork or "";

-    globals.networks = lib.mapAttrs'
+    globals.networks = lib.mkIf config.swarselsystems.writeGlobalNetworks (lib.mapAttrs'
      (netName: _:
        lib.nameValuePair "${netPrefix}-${netName}" {
          hosts.${config.node.name} = {
@ -36,7 +36,7 @@ in
          };
        }
      )
-      netConfig.networks;
+      netConfig.networks);

    globals.hosts.${config.node.name} = {
      defaultGateway4 = netConfig.defaultGateway4 or null;
--- a/Show more
+++ b/Show more