From 91fc0227bf1fe3f7b79767214afaaa76b96a2e84 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Leon=20Schwarz=C3=A4ugl?=
 <leon.schwarzaeugl@imba.oeaw.ac.at>
Date: Sun, 29 Jun 2025 15:31:16 +0200
Subject: [PATCH] feat: add croc

---
 SwarselSystems.org                      | 85 ++++++++++++++++++++++++-
 hosts/nixos/winters/secrets/pii.nix.enc |  6 +-
 modules/home/common/env.nix             |  1 +
 modules/home/common/zsh.nix             |  6 ++
 modules/nixos/server/croc.nix           | 59 +++++++++++++++++
 profiles/nixos/moonside/default.nix     |  1 +
 secrets/general/secrets.yaml            |  8 ++-
 secrets/moonside/secrets.yaml           | 14 +++-
 8 files changed, 169 insertions(+), 11 deletions(-)
 create mode 100644 modules/nixos/server/croc.nix

diff --git a/SwarselSystems.org b/SwarselSystems.org
index 323bee7..ac2c415 100644
--- a/SwarselSystems.org
+++ b/SwarselSystems.org
@@ -4767,6 +4767,7 @@ Modules that need to be loaded on the NixOS level. Note that these will not be a
             nginx = lib.mkDefault true;
             ssh = lib.mkDefault true;
             oauth2Proxy = lib.mkDefault true;
+            croc = lib.mkDefault true;
           };
         };
       };
@@ -10727,6 +10728,73 @@ To get other URLs (token, etc.), use https://<kanidmDomain>/oauth2/openid/<clien
   }
 #+end_src
 
+**** croc
+:PROPERTIES:
+:CUSTOM_ID: h:f922e8d6-f6e8-4779-a7ad-4037229c9bf0
+:END:
+
+#+begin_src nix :tangle modules/nixos/server/croc.nix
+  { lib, config, pkgs, ... }:
+  let
+    serviceDomain = "send.swarsel.win";
+    servicePorts = [
+      9009
+      9010
+      9011
+      9012
+      9013
+    ];
+    serviceName = "croc";
+
+    cfg = config.services.croc;
+  in
+  {
+    options.swarselsystems.modules.server."${serviceName}" = lib.mkEnableOption "enable ${serviceName} on server";
+    config = lib.mkIf config.swarselsystems.modules.server."${serviceName}" {
+
+      sops = {
+        secrets = {
+          croc-password = { };
+        };
+
+        templates = {
+          "croc-env" = {
+            content = ''
+              CROC_PASS="${config.sops.placeholder.croc-password}"
+            '';
+          };
+        };
+      };
+
+      topology.self.services.croc.info = "https://${serviceDomain}";
+
+      services.croc = {
+        enable = true;
+        ports = servicePorts;
+        pass = config.sops.secrets.croc-password.path;
+        openFirewall = true;
+      };
+
+
+      systemd.services = {
+        "${serviceName}" = {
+          serviceConfig = {
+            ExecStart = lib.mkForce "${pkgs.croc}/bin/croc ${lib.optionalString cfg.debug "--debug"} relay --ports ${
+              lib.concatMapStringsSep "," toString cfg.ports}";
+            EnvironmentFile = [
+              config.sops.templates.croc-env.path
+            ];
+          };
+        };
+      };
+
+      # ports are opened on the firewall for croc, no nginx config
+
+    };
+
+  }
+#+end_src
+
 *** Darwin
 :PROPERTIES:
 :CUSTOM_ID: h:ac0cd8b3-06cf-4dca-ba73-6100c8fedb47
@@ -12318,6 +12386,7 @@ Sets environment variables. Here I am only setting the EDITOR variable, most var
       home.sessionVariables = {
         EDITOR = "e -w";
         DISPLAY = ":0";
+        CROC_RELAY = "send.swarsel.win";
         SWARSEL_LO_RES = config.swarselsystems.lowResolution;
         SWARSEL_HI_RES = config.swarselsystems.highResolution;
       };
@@ -12361,8 +12430,14 @@ This section is for programs that require no further configuration. zsh Integrat
         jq.enable = true;
         ripgrep.enable = true;
         pandoc.enable = true;
-        fzf.enable = true;
-        zoxide.enable = true;
+        # fzf.enable = true;
+        zoxide = {
+          enable = true;
+          enableZshIntegration = true;
+          options = [
+            "--cmd cd"
+          ];
+        };
       };
     };
   }
@@ -12760,6 +12835,11 @@ Currently I only use it as before with =initExtra= though.
       };
     };
     config = lib.mkIf config.swarselsystems.modules.zsh {
+
+      sops.secrets = {
+        croc-password = { };
+      };
+
       programs.zsh = {
         enable = true;
         shellAliases = lib.recursiveUpdate
@@ -12863,6 +12943,7 @@ Currently I only use it as before with =initExtra= though.
           # ctrl + del
           bindkey '^H' my-backward-delete-word
 
+          export CROC_PASS="$(cat ${config.sops.secrets.croc-password.path})"
         '';
       };
     };
diff --git a/hosts/nixos/winters/secrets/pii.nix.enc b/hosts/nixos/winters/secrets/pii.nix.enc
index 898d83a..e1f2457 100644
--- a/hosts/nixos/winters/secrets/pii.nix.enc
+++ b/hosts/nixos/winters/secrets/pii.nix.enc
@@ -1,5 +1,5 @@
 {
-	"data": "ENC[AES256_GCM,data:lDZMNsc9MwBxrLWzgOmo+y+Th5nDOWZhnQkvPlJ79/oZ3qcu5aCL5PqkWlldyxvRvUuatrRmxVKD/6EbR/W4G/l9YQnG/dw1XAtb2VPz1RjQLC/X8h+V+F1XHv7g6afUPd7HRUq4HIgEYeRi9qwwDbL7/LUV09PAr9w55n9Ch92/rhIstGWt9te1D2igfRgQo3Vsqxy3JGV1R9NVKLkJt/snVcKN9SaQp94hlzkhOUnYtrvOjE1++TaIX5EL1ZqQ0bIabRKATxRTF8yKfQBQ0Y7d82yQyME+xit27aXhuYG42UbbCVxh1NlZuwGFUAzZa5k4K13/a1/Axiww8wYQdCPMqv+TYrYxMDVdqdn53qaFqxoy6aunucVYKfpObyDbRFugrVldfnmEKGcSSv5xrO9RRv+B3rLbq3MRsi3Jsgt3uo2SI0UkiAUq7Il6epLsEBIsxSrPGlncRNu9BjZqRq4BzqD2KvPXtz2YdLJBRBrjc6iWadIDB6ABl8xF25jb7oxK7XkWi7Oi5HWRbrWzsw4jLftNhIJYWb/V2IDxbnVPWEnZNO44Ez68pqpnrAMo4UprxTwXiAaufx2E5opQHf4PhJ5Dtei/TPyPyxpSUjUMbVpCjbXu784k+SY3Dgi7ZKA87nylz+sYvh2ezGeoQETbDoKOAf0X3oIvub10qOc+lhKHuMiHCBhmZWmnic5vLWZdqYYtsnG6fsOYTYJWkSFoFuUJpBnAFs1k4lRKFz2hVVifO2x5i1YEUMRasx02Br/3JyMLeVZ3tlZqAAVIuwaIzIseAyaDlUuHApqjCqjxnzWRWxZlMKFDVLvgXsjQ2D5eRCDiCN0qrmOQYSHreuyrLnuPzyvZuqKUCXOg4XjzwXBi+sfqf/N+C2i70iGOG30mULxnboZ3HcNtpR5NxHBIrbyiTwqb5tW19qjVtf97buAfnexnHzufQdHMtjIXDNkf7ue8E/f8J+khYVG2Om01+aiJmYpc4JnmZ/pO2HVZeFOUEMruWr0xhZ0rRasT5LiJJqk9xavwnZdzLBtRgtS56yVxEqX5AhJWYEcp8EmPGDv2xEB0gFZ0i5iiBickcxnvQ2BGTQd1lrkZN7qEcSJlOBDukG8DLV5euZrkZwynF4AUubvrOE5M0zCzc0RxNQ8qW+CVoCqygoTkXzvZtrxZHnfIGLxyFsuPE2FgK1giHo7gh0FQRzPSlqA4h3iuJtMAiV60NYiE0Rw9HzYDcfOEtbM2neKRclzSBDSVXwg=,iv:YHJfh4UqYLw9mOYBf0rgOxyuRMLHuLUh/QuKTCzZ6R4=,tag:VXMCjBEeYzGYzsHW8ATmLA==,type:str]",
+	"data": "ENC[AES256_GCM,data:Bb45EoiwDMRxYR/YAmYcwn7HT3mF0kT1DHmBclmCxj0xK81qqQzFZyF+2WKFwyMYAC0gfOpeoi9B+a2nNfIaY7hujqQ1luLOaHAL687hKFM1w62U1w5XNs9Rs0OnO99ag8IZTAjY0lqC4djTrTlklx+x6qzISW2z191SMho4zD89mKA2qCk3iYd37+N/uOZ4LSPSBtX625d2lXZPpWhBDd/UrlZqwQqGa+cxdeM3QcRr+Xnv4hYVg+UC2kGXwBWCkMY9S12iQp0CQTMAcqhgfs5J7tdxycYcXYJZjUGfJBTrG6t5xVzzibKFpAjpl9aqiUGLNHf1EtwBP4+PtEs7XQCHltsz8PA4PtH291RVzT4FYUbkCTw1gQBgB1tQzwa4Gc7MBtvAR4DCXrTfda5eYGUzwBsCC9AVNI1jEaDncaiPPjK8rzyjcZGK9i5hMDf5L0XqLKG350RPRWMPFCnCml67n+tnEp4JsOfadpIJ7iCrBTXpgWHVXBcOKuEjIjAInBtzOUrV1AbH6f45R6N1jOoe315t4FlWPL4M0oUemi6Uw8NYiX80X2VD558j80jLZVfybz87IlvTI/GiI1GykkRoanH2LURtrzLUAGtpvK8ueCeKStYDLt89s4m8HFO/p8hhQ1id6vD8VAyvp7n6lZ4SUOjyWy1DTsR9YMz/t7oilwfsfp7bSiFzqk3cOgbZsdbyZZVNlGdN4XeWUHIztpiy1239N70xeE7HeJODkgrVs6HI8GME1LDtYZcBzyh1zHIInT5gv4fNBDTCG4a3yhpuDIPnCXwC3L93wX058u2t0ETcaeMRjeWZU0H0PFfM9DhjO6wmWRxQ0yqT69b1gsCoUWdsixfUtJQ9dKstM5pdJCNiEvehMC5SPXP20PPeZEIlmVnXGQqAs6Bcpo+TmdrNaI7llHPmRVE9MeumqC7V22eHVpwawP4NHwLXtL/SjZuMWDc7F2DnCm3lHxxqVfWS6XFFB+WcBkmQFh2cqCuRsGhXFUPevxpDp0thL8rBnUzro/Xlh1KvBSstC75m1c4dx/EL7yBLWllWOVCEQU7R2QEw77G/viCx3/KCuJrkTWXOyiREqXdUDin2N4jZAhH3QKONrBYYBubVPIpaWZEindKyjNdItFxTbSDb5MwOtBsCNhLTqT45vefXh4LYYOf/+YvUmEw9nkgQn5Nw8vJ8H2mpLyLGgKupSYdlErmcu59QWwjW3drentzx8DhMWBiICkAWRe8PHXZHcC8kD0+sEXtBtvtfgkQ3aYv2aF0Dy3DHcHhf2auDCuJr6IBwwM2RKO4EhS2Ec9YKVyDXC7/bZqsymTyCawKCQZYCK9ZPcI97gTM=,iv:peWndkV5HrPgsJTgMvDM+uLO6jqfpIBiiQzL80dqCFM=,tag:gPkHLiO6/yPUIZ6q/X4Thg==,type:str]",
 	"sops": {
 		"age": [
 			{
@@ -7,8 +7,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyK0w2RjJ5R1l2ay94QXRj\nekJwSlowcFVLc1cvWVFjNEVFUnFocEJHYlNnCnBnUEYvNWdNWE9BTjB5ODRuTlAw\nMUh4QmlTeVVYNHM0S1FwWG5qUG42VDgKLS0tIHh5VlU2dVZmUlRIMDRlVEJmNU55\ncFlXR1BzMkVnMkFWN3BBZWhHalltMlEKibdARxBcFqaXUhYp3KkrrvO9YgaBDacl\n8BEv4ph0f2baDN0dsymJjmdHStwKTjOwDspRtCTs5u75hR35a2xyFQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-06-13T01:21:29Z",
-		"mac": "ENC[AES256_GCM,data:vXi8WeZ4/dP/M13NgrKMNzDw9SIbMcIHWP+2VZWDlHQyDwGsZoMeIQ+LDefRp/5h894XiRoDgPvzY61JukJG2ytZpKHelZaAVSDwPkMmtAA4ccCLUlTmu5I1VozIPfCbeMJVEWYGlZbRoDGsiey8906R4pauInzgjRvg8pcBUqs=,iv:rGDTDiZjRVBZlea4HVJJVien6c11u34XBJWtYL0Tgeg=,tag:4uaGiBIdF3uvb3fd5jRVPg==,type:str]",
+		"lastmodified": "2025-06-28T22:52:43Z",
+		"mac": "ENC[AES256_GCM,data:iv7/BhKzDCsx3I7lmwaBr9BHvTausvWDky2drGZD0YXJqh3KNAp9e2MZnPs8RzsavsEd23JG6Xi1u9cnlcJtmkebBTqrUPZOSJz6RTw/YAlCSR+d1Az5B10jY1wVeweGDVUn0ncVx2zzEjbguMQz4T1kcZU5XT7MX8XITDE6J9M=,iv:xPNHn6E4oTQ7F5f9Df8M+G07uxhhW7mXh2BWUX5cD9M=,tag:cU2OFctCdqdgQnTKns0yOQ==,type:str]",
 		"pgp": [
 			{
 				"created_at": "2025-06-11T11:42:23Z",
diff --git a/modules/home/common/env.nix b/modules/home/common/env.nix
index 0c36301..976efa3 100644
--- a/modules/home/common/env.nix
+++ b/modules/home/common/env.nix
@@ -9,6 +9,7 @@ in
     home.sessionVariables = {
       EDITOR = "e -w";
       DISPLAY = ":0";
+      CROC_RELAY = "send.swarsel.win";
       SWARSEL_LO_RES = config.swarselsystems.lowResolution;
       SWARSEL_HI_RES = config.swarselsystems.highResolution;
     };
diff --git a/modules/home/common/zsh.nix b/modules/home/common/zsh.nix
index 600dfa4..4671899 100644
--- a/modules/home/common/zsh.nix
+++ b/modules/home/common/zsh.nix
@@ -11,6 +11,11 @@ in
     };
   };
   config = lib.mkIf config.swarselsystems.modules.zsh {
+
+    sops.secrets = {
+      croc-password = { };
+    };
+
     programs.zsh = {
       enable = true;
       shellAliases = lib.recursiveUpdate
@@ -114,6 +119,7 @@ in
         # ctrl + del
         bindkey '^H' my-backward-delete-word
 
+        export CROC_PASS="$(cat ${config.sops.secrets.croc-password.path})"
       '';
     };
   };
diff --git a/modules/nixos/server/croc.nix b/modules/nixos/server/croc.nix
new file mode 100644
index 0000000..98532ae
--- /dev/null
+++ b/modules/nixos/server/croc.nix
@@ -0,0 +1,59 @@
+{ lib, config, pkgs, ... }:
+let
+  serviceDomain = "send.swarsel.win";
+  servicePorts = [
+    9009
+    9010
+    9011
+    9012
+    9013
+  ];
+  serviceName = "croc";
+
+  cfg = config.services.croc;
+in
+{
+  options.swarselsystems.modules.server."${serviceName}" = lib.mkEnableOption "enable ${serviceName} on server";
+  config = lib.mkIf config.swarselsystems.modules.server."${serviceName}" {
+
+    sops = {
+      secrets = {
+        croc-password = { };
+      };
+
+      templates = {
+        "croc-env" = {
+          content = ''
+            CROC_PASS="${config.sops.placeholder.croc-password}"
+          '';
+        };
+      };
+    };
+
+    topology.self.services.croc.info = "https://${serviceDomain}";
+
+    services.croc = {
+      enable = true;
+      ports = servicePorts;
+      pass = config.sops.secrets.croc-password.path;
+      openFirewall = true;
+    };
+
+
+    systemd.services = {
+      "${serviceName}" = {
+        serviceConfig = {
+          ExecStart = lib.mkForce "${pkgs.croc}/bin/croc ${lib.optionalString cfg.debug "--debug"} relay --ports ${
+            lib.concatMapStringsSep "," toString cfg.ports}";
+          EnvironmentFile = [
+            config.sops.templates.croc-env.path
+          ];
+        };
+      };
+    };
+
+    # ports are opened on the firewall for croc, no nginx config
+
+  };
+
+}
diff --git a/profiles/nixos/moonside/default.nix b/profiles/nixos/moonside/default.nix
index f7d6385..96bd674 100644
--- a/profiles/nixos/moonside/default.nix
+++ b/profiles/nixos/moonside/default.nix
@@ -19,6 +19,7 @@
           nginx = lib.mkDefault true;
           ssh = lib.mkDefault true;
           oauth2Proxy = lib.mkDefault true;
+          croc = lib.mkDefault true;
         };
       };
     };
diff --git a/secrets/general/secrets.yaml b/secrets/general/secrets.yaml
index aa61880..154b34b 100644
--- a/secrets/general/secrets.yaml
+++ b/secrets/general/secrets.yaml
@@ -25,6 +25,8 @@ githubforgepass: ENC[AES256_GCM,data:CS1ZmDjQQIjGrmaDTzkut/tethQueEyKomc=,iv:k8M
 gitlabforgeuser: ENC[AES256_GCM,data:SrQw69bvtYUcVSePCg==,iv:PlaTHDWJRMtf0HQCG/fVUfw+/91x3ubJKSrcEf+R/Ck=,tag:8E+ZlJE+O+mmcPjhEc/2DA==,type:str]
 gitlabforgepass: ENC[AES256_GCM,data:WvUFqQtBqqlWvUWhF7x46RcjqA3RPnKSgbd3ZIr1kHO+Vmh5zUh+LA==,iv:+n2VPdLdxFFVHlzRdMCi1lyqGLH+U3RRZX/qfs42I0s=,tag:1iBorR1N1HDRtrqcAcSmvA==,type:str]
 u2f_keys: ENC[AES256_GCM,data:jk1IDfO778V3MCQ8fGoO87lCmqj2Dw+vNRfT4JuWXZ6cB/ARYblnGIpEfogciXJbmYWc4MiKHcO2PkXFdCynpniU3pf3stvNYjTV/TdUpNXkAyho1OjBXwisOMFMcqF3I8yI/XpaMr+5aL6tyMLZ4wIsa0tP4FH74BxCt426uhH8YKLCXREaLRy2PFEQS2MVwKL8i41LDhrkVaJIEMZJ34rvHQqsjckjvwEtCHzBh8XVqdJXAKPq1EgR+9gTVhixwvceDsoSAC0/q2RkSfKhqhOFnj6e09GM7i+o1e98INyABHmd3OHxzTydYk6nrcJHFWIBZlushSgVI0qn+JL+e+2CF8NFtshHH7CGI7ws23n1DZz/BkjQtcfjZEnJv5uAZ9oOt4R0hOSpXn0rGQRNgo5JSMGR37ywyJlaDHmRolS6lRk/7pEdO3jCEMSwjjitWK1/iNDSgEExclQZ/cSL2svPZmwiTKrf0wm/+gbGrd+BxzJmHCopFyNG47kweyR7iMcknF/4+iJj9t2Mi+xOxYdqmQB+I6140DOqcMz9sA0tzqV+Ou6Jf4H4w9sqvI10pnw2sK7OuvFZQ442H+iLelRiZLA/ZCzDCieddLJBtqSsmgEJtJpRsiJXUzDn4CzaAFWrNvNaU/MKAAZwsPeJywmwKgjOUSdHz3YKVDhP/TDqvlzvjKYDte7+6baAYKjVNPJpMy4aQ4/m2FnUEcgRdwct3G8JCe1CORIZSFbO9fkgEgJK6WN3XyQn1nAcDGZdmS95O5Ajmj6a1f5nZQ==,iv:B/Nf1lS0gKW43Nq8QuwJD6GCzzvx35LBw1q1OmZMfF8=,tag:gVNKbyq514J1eoM03JoQYg==,type:str]
+#ENC[AES256_GCM,data:NoqAfw==,iv:myxrEPllN9zwXn5iCxL89qX7wSN8C0foFdxvvitq7b0=,tag:Yud5HDjWvEMrw1lMp21hMg==,type:comment]
+croc-password: ENC[AES256_GCM,data:uz7vI2rrPi1uTKEks4IPnWOt/R6ydlp/cQ==,iv:ZE01XcS6nF1sqz04rC1o20l+1DpNSRVjhC40ZmTVCww=,tag:REjnDQBcDkUzLg2ZsiDUvA==,type:str]
 sops:
     age:
         - recipient: age1h72072slm2pthn9m2qwjsyy2dsazc6hz97kpzh4gksvv0r2jqecqul8w63
@@ -81,8 +83,8 @@ sops:
             azY5dGFTUWhiQ083VlBzdVRrSmZFNTQKqoJy8eP+beb/86Dg7BLaYEmZJG2oMS/I
             y1tSw+Ij5TfghzbtKcK++88L7ZPJLRocnKXftFbjutHNKmWW3+oW7Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-18T22:08:25Z"
-    mac: ENC[AES256_GCM,data:vU+7/VLEzwDOrScD/HTo9JBf4ixtmcBmjtSUEtaVHwZuPMJ0OpydwcBPYKvhvU6z9xNecCcuiY7beJ5sq7fnv8XY66TOZWq/2tTZPXdJwpfAyHqBhf7uoCiOmSl53tpWzUFbfT8fQQwjKmBO1079Op24WNWzG3w0i9BsoYTYrpY=,iv:9bLlRg28paoitcK1lFc4ipsgMVvr/zECNozwXU2qJTM=,tag:uRviXeIlwUnvJqHwWuoYcA==,type:str]
+    lastmodified: "2025-06-28T17:31:16Z"
+    mac: ENC[AES256_GCM,data:kNNvGXtSnsaiuvIULjyfTx3tD54w8ZlI4cl/rQn5NUymu0evCflPYvc6YtBroCby6kvWn906/hR13r5m5OQuyU6rNmouLtZpCEwThlEcIbIITkFj8KwJJyaWXw+DaNlKP4n96mwoto/xyh3kBawbntcWLsYqCBgyhmLsLaAzY1Q=,iv:T5WKzdb2fck+C29qGv8QnODq5D28/94BD5g2Zw16glU=,tag:L6SPUs4tDMpVqR8swD6C+g==,type:str]
     pgp:
         - created_at: "2025-06-14T18:15:57Z"
           enc: |-
@@ -116,4 +118,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: 4BE7925262289B476DBBC17B76FD3810215AE097
     unencrypted_suffix: _unencrypted
-    version: 3.9.1
+    version: 3.10.2
diff --git a/secrets/moonside/secrets.yaml b/secrets/moonside/secrets.yaml
index e7f59ac..a966591 100644
--- a/secrets/moonside/secrets.yaml
+++ b/secrets/moonside/secrets.yaml
@@ -1,10 +1,18 @@
 swarsel: ENC[AES256_GCM,data:AnxZLN+3ta2Dmg0=,iv:S25Xbbj5K3tWynO4/7XGRp/+XexxoUofHjlPNDo5el8=,tag:uov6okR56P324TYA3/YN/g==,type:str]
 dnstokenfull: ENC[AES256_GCM,data:z9gi0pwfbDyHkKw8rhiGOIlaLUzepAAxQfAH4esla2NkSCx/S0VAiQ==,iv:qtCE+V4vHImViCquHwUEADEzl6dj7PB16PoRqYEgQ6o=,tag:jVfWgt3cx+bpYeMuyesjrA==,type:str]
 swarseluser: ENC[AES256_GCM,data:s09lyp9yRPJaSsDXj19s1mosF3O39Fk7Eg==,iv:tVBEFqTQPreul617EU6CfBUhz3Fmt37VAi3GzezeEmA=,tag:9sbJ465VxKoW3/q6ju7hpg==,type:str]
-wireguard-private-key: ENC[AES256_GCM,data:z5TV66YW4FqBVi/3uyE+r9Nkx9vVUOEgwVBXxqi32pecR9dQyLHW9QtFF/A=,iv:+qpRvDlF5v7hQo/S2oYGQ1MDHnxT3yHny1S1SVCainw=,tag:90pIiVx1lSXsin0b2M2SeA==,type:str]
+wireguard-private-key: ENC[AES256_GCM,data:GCi+otqW06yoBKnG0WCIN4Wu9VKDsOUv8WRm240cHBnSAoW/ycd2WgDWsYY=,iv:TYj38C00fMIhg8LEGz6HPWxg11xUdwGgnxOmy+1SG9k=,tag:CQr9phCmU5it2EYjzqhAlA==,type:str]
 #ENC[AES256_GCM,data:u/O2rHXqOoTNpOSm,iv:hqhZC9R76P3sPkpQMximrvcTC15IM99QaRZErC9AIc4=,tag:wc2w7iwtfazlwWpnQJV63w==,type:comment]
 oauth2-cookie-secret: ENC[AES256_GCM,data:cbNVAkBAWJCN4fLmkYUFhy8v9iE5fB30hFI3nTpZuVIFCnmXPBtlftI58Zg=,iv:q9xjUDOH9M4pW+9YB9dEYSqEu9gpsezbxcGbpORNljU=,tag:KoGNcssD608huewmHeJOxw==,type:str]
 kanidm-oauth2-proxy-client: ENC[AES256_GCM,data:wUTfb0r9d7nRb1wmQEOjXwDTM8V56DmOGw==,iv:OMXiObgt4AbKmovT62+P99r0UzGELj37FX+lqW38F0g=,tag:lksIWm0cSLydTZvlxliXgA==,type:str]
+#ENC[AES256_GCM,data:+aP4Jw==,iv:TYiFr6tWfRzWyFq9DO//0SOJ3+Hu4H+Weh5KeCUlD6g=,tag:kTgWC64QIHlwVertJpSCCw==,type:comment]
+croc-password: ENC[AES256_GCM,data:c7u5xj4mG222wLPYuKPVh6X0SaoUBH4w6A==,iv:BEkTlLUawAqs6zk309WMCW3DEXjmXv9LHt8mkt8RfoU=,tag:7CM5D4ibgXuVIM83ismUaA==,type:str]
+#ENC[AES256_GCM,data:v0/dQUi4gcI=,iv:JXSkXO8BDbHPzxlgnCro5OgN9sMkMQBX7qTmMvf2D2M=,tag:XBgoXC3JCPsBL3g0x9h3Lw==,type:comment]
+microbin-admin-username: ENC[AES256_GCM,data:1YaDw08=,iv:hg+zaL5jiEfyvGpptfJ0uJgxygtMBJ6kfCcrAzUW3jM=,tag:HWVTTLwFjV37gRVirIQ4bw==,type:str]
+microbin-admin-password: ENC[AES256_GCM,data:+UyWJAsQ4Jd5iJgdepJ/m9OvkEewLKQz+A==,iv:oJPZjMnFJ9Mq4tUUWQV0yf/bBvesEXuWqhxr1s5IORQ=,tag:VX2TwIzTbpsyxf11RtA5vg==,type:str]
+microbin-uploader-password: ENC[AES256_GCM,data:20QOWTMLS7iTS/Q=,iv:EuUYcY1l4ykKjWvCA0bpXPU0033jlQ8qjYyqSuLAQl0=,tag:Ka5gWBajMdeZS25AajToiA==,type:str]
+#ENC[AES256_GCM,data:ZnMVMv6M,iv:z53BHIVvMUfYseftc6DTU9Mlb9ywEvNHv24TvIZiMFI=,tag:QdeWjrw0pmJsXYobADzA1A==,type:comment]
+shlink-api: ENC[AES256_GCM,data:XdfDJMjyhJyeqVB4RKgCdkWT2nYC/Pw21D8H/JzkGLuwGx8Q,iv:zucJGNLX8018gD34NL/BwTe0fPFucqpBtMCYXd3IGHs=,tag:/sN/ayEhUaCPmu6fS+mMHQ==,type:str]
 sops:
     age:
         - recipient: age18quey88vge7xytclg2nuq4ncme86dg04lxwczqxczmdchnjg3p0saehsnh
@@ -16,8 +24,8 @@ sops:
             bURRem1aY203VW0ya0tZWUY3WTJLQ3MKonflaevgNP91G1cVgzoE6/K800kyG6BK
             Goe81HCYFfm86pzv5wV3/38j7fTZNeZnKwPFkMgEUueF1kA8J9V5CA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-15T09:26:29Z"
-    mac: ENC[AES256_GCM,data:IcDG5eTj7QQQdsQ7/lhHpJL+L6s0XJltng5yvyG6/sEIRzy4lrUMeR/9BcEiAw0vgz1jWlZR8pNaWZJHc4lEOmMax8rfEhz/3IrWh7MxvCkSSp1Y+JE8xewxzDE57+tR7BxYXjyjmrbQ0C1kiDfUAMVrkXTmV7hA/eY2xFezxXg=,iv:mfyVv5QyRWbCFOmYDsdcmnb7TBFD+5RE84UYc9+j4Yk=,tag:47XAmRcoI2XdQNb2tsL/4Q==,type:str]
+    lastmodified: "2025-06-28T20:39:53Z"
+    mac: ENC[AES256_GCM,data:eJf8SlsN5lxPLVnN0m+LAd6twJ2QnnmUK3h3ueAFV96oTsG7wUCJ/M/cqMGUkG3hy38OKk/BFDAHDmmjc02stWf14HiN02fm5CYjROLhJMaeXuSXOLQSPuo72s45YiKZL1x3ph//cgO3CQP+mvElywYDy4LQRTVKm9Eajq5Q/ZU=,iv:Ch9dS9Vkk8ag/3BIsxoWyJ3ksbh8oIjHZJJjoQSGGHA=,tag:PjNd3256sSb6o/6iUIjjyQ==,type:str]
     pgp:
         - created_at: "2025-06-13T21:18:31Z"
           enc: |-