feat[server]: add mailserver

2025-12-06 09:07:21 +01:00 · 2025-11-25 19:46:28 +01:00 · 2025-11-25 19:46:28 +01:00 · c62d244783
commit c62d244783
parent 31623b65d6
12 changed files with 657 additions and 166 deletions
--- a/hosts/nixos/x86_64-linux/eagleland/default.nix
+++ b/hosts/nixos/x86_64-linux/eagleland/default.nix
@ -0,0 +1,82 @@
+{ lib, config, minimal, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./disk-config.nix
+  ];
+
+  topology.self = {
+    icon = "devices.cloud-server";
+  };
+
+  networking = {
+    useDHCP = lib.mkForce false;
+    useNetworkd = true;
+    dhcpcd.enable = false;
+    renameInterfacesByMac = lib.mapAttrs (_: v: v.mac) (
+      config.repo.secrets.local.networking.networks or { }
+    );
+  };
+  boot.initrd.systemd.network = {
+    enable = true;
+    networks = {
+      inherit (config.systemd.network.networks) "10-wan";
+    };
+  };
+
+  systemd = {
+    network = {
+      enable = true;
+      wait-online.enable = false;
+      networks =
+        let
+          netConfig = config.repo.secrets.local.networking;
+        in
+        {
+          "10-wan" = {
+            address = [
+              "${netConfig.wanAddress4}/32"
+              "${netConfig.wanAddress6}/64"
+            ];
+            gateway = [ "fe80::1" ];
+            routes = [
+              { Destination = netConfig.defaultGateway4; }
+              {
+                Gateway = netConfig.defaultGateway4;
+                GatewayOnLink = true;
+              }
+            ];
+            matchConfig.MACAddress = netConfig.networks.${config.swarselsystems.server.localNetwork}.mac;
+            networkConfig.IPv6PrivacyExtensions = "yes";
+            linkConfig.RequiredForOnline = "routable";
+          };
+        };
+    };
+  };
+
+  swarselmodules.server.mailserver = true;
+
+  swarselsystems = {
+    flakePath = "/root/.dotfiles";
+    info = "2vCPU, 4GB Ram";
+    isImpermanence = true;
+    isSecureBoot = false;
+    isCrypted = true;
+    isCloud = true;
+    isSwap = true;
+    swapSize = "4G";
+    rootDisk = "/dev/sda";
+    isBtrfs = true;
+    isNixos = true;
+    isLinux = true;
+    proxyHost = "eagleland";
+    server = {
+      inherit (config.repo.secrets.local.networking) localNetwork;
+    };
+  };
+} // lib.optionalAttrs (!minimal) {
+  swarselprofiles = {
+    server = true;
+  };
+
+}
--- a/hosts/nixos/x86_64-linux/eagleland/disk-config.nix
+++ b/hosts/nixos/x86_64-linux/eagleland/disk-config.nix
@ -0,0 +1,121 @@
+{ lib, pkgs, config, ... }:
+let
+  type = "btrfs";
+  extraArgs = [ "-L" "nixos" "-f" ]; # force overwrite
+  subvolumes = {
+    "/root" = {
+      mountpoint = "/";
+      mountOptions = [
+        "subvol=root"
+        "compress=zstd"
+        "noatime"
+      ];
+    };
+    "/home" = lib.mkIf config.swarselsystems.isImpermanence {
+      mountpoint = "/home";
+      mountOptions = [
+        "subvol=home"
+        "compress=zstd"
+        "noatime"
+      ];
+    };
+    "/persist" = lib.mkIf config.swarselsystems.isImpermanence {
+      mountpoint = "/persist";
+      mountOptions = [
+        "subvol=persist"
+        "compress=zstd"
+        "noatime"
+      ];
+    };
+    "/log" = lib.mkIf config.swarselsystems.isImpermanence {
+      mountpoint = "/var/log";
+      mountOptions = [
+        "subvol=log"
+        "compress=zstd"
+        "noatime"
+      ];
+    };
+    "/nix" = {
+      mountpoint = "/nix";
+      mountOptions = [
+        "subvol=nix"
+        "compress=zstd"
+        "noatime"
+      ];
+    };
+    "/swap" = lib.mkIf config.swarselsystems.isSwap {
+      mountpoint = "/.swapvol";
+      swap.swapfile.size = config.swarselsystems.swapSize;
+    };
+  };
+in
+{
+  disko = {
+    imageBuilder.extraDependencies = [ pkgs.kmod ];
+    devices = {
+      disk = {
+        disk0 = {
+          type = "disk";
+          device = config.swarselsystems.rootDisk;
+          content = {
+            type = "gpt";
+            partitions = {
+              ESP = {
+                priority = 1;
+                name = "ESP";
+                size = "512M";
+                type = "EF00";
+                content = {
+                  type = "filesystem";
+                  format = "vfat";
+                  mountpoint = "/boot";
+                  mountOptions = [ "defaults" ];
+                };
+              };
+              root = lib.mkIf (!config.swarselsystems.isCrypted) {
+                size = "100%";
+                content = {
+                  inherit type subvolumes extraArgs;
+                  postCreateHook = lib.mkIf config.swarselsystems.isImpermanence ''
+                    MNTPOINT=$(mktemp -d)
+                    mount "/dev/disk/by-label/nixos" "$MNTPOINT" -o subvolid=5
+                    trap 'umount $MNTPOINT; rm -rf $MNTPOINT' EXIT
+                    btrfs subvolume snapshot -r $MNTPOINT/root $MNTPOINT/root-blank
+                  '';
+                };
+              };
+              luks = lib.mkIf config.swarselsystems.isCrypted {
+                size = "100%";
+                content = {
+                  type = "luks";
+                  name = "cryptroot";
+                  passwordFile = "/tmp/disko-password"; # this is populated by bootstrap.sh
+                  settings = {
+                    allowDiscards = true;
+                    # https://github.com/hmajid2301/dotfiles/blob/a0b511c79b11d9b4afe2a5e2b7eedb2af23e288f/systems/x86_64-linux/framework/disks.nix#L36
+                    crypttabExtraOpts = [
+                      "fido2-device=auto"
+                      "token-timeout=10"
+                    ];
+                  };
+                  content = {
+                    inherit type subvolumes extraArgs;
+                    postCreateHook = lib.mkIf config.swarselsystems.isImpermanence ''
+                      MNTPOINT=$(mktemp -d)
+                      mount "/dev/mapper/cryptroot" "$MNTPOINT" -o subvolid=5
+                      trap 'umount $MNTPOINT; rm -rf $MNTPOINT' EXIT
+                      btrfs subvolume snapshot -r $MNTPOINT/root $MNTPOINT/root-blank
+                    '';
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+
+  fileSystems."/persist".neededForBoot = lib.mkIf config.swarselsystems.isImpermanence true;
+  fileSystems."/home".neededForBoot = lib.mkIf config.swarselsystems.isImpermanence true;
+}
--- a/hosts/nixos/x86_64-linux/eagleland/hardware-configuration.nix
+++ b/hosts/nixos/x86_64-linux/eagleland/hardware-configuration.nix
@ -0,0 +1,18 @@
+{ lib, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot = {
+    initrd = {
+      availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+      kernelModules = [ ];
+    };
+    kernelModules = [ ];
+    extraModulePackages = [ ];
+  };
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
--- a/hosts/nixos/x86_64-linux/eagleland/secrets/pii.nix.enc
+++ b/hosts/nixos/x86_64-linux/eagleland/secrets/pii.nix.enc
@ -0,0 +1,22 @@
+{
+	"data": "ENC[AES256_GCM,data:vLTAWtyZJVHtXifwicSRYRYj1PjoEiumhE3bcsMuhj5P0PjyT9f2wzse7GDtusUFXDNWQXNWMNwk1V0auQmWayJa0zvpfRGtnGJrwdl/dImK+UN7ddJ6x6tNU6kjNZ05UplaUsJAJ9tm4eg050muY7KLBuEw1E4Ki9clDDxhxULXv4bdv5QpXaYSiK33ZORnD2EWcYvqUJayU/d8zSRTHV456ePHDIJPfXo22XQSLY7//q1v44ZMKDptOwlktxVQr9/asvE4eLDjdDTA5DXHTfsAGBDZCHqPI33CxZbHENM9UOHw7S0qYpKW2f232Huwv4J7llmsOIT8Axppz6fC8neBKOFPH+n4bZQTaZUL/xSLCQrF/T8k8k84lKJ3eBJdfyTpU8oInu8VAe/w+s2lC+n/zAjGoSGIF412xQ5VS0fsG1Wi/veRDr50KybYUuYQNjwtIXle3fUibUaMGFwd4Y9uSlxrWwWQxJhFpoZhoPPfeNMrT+7BSpVax27HvM7p9+VKkLfWtHiwuSZNSI3HKRmrsxHJVUxuJdXO87TCbabQAvPWoqR6qKMwixN/gvN1JNZ6Ml59HPSe6SKBAh5SI95kzXaBMZ9d7Yy7bUy/xkbbFHNYLwXR62H89XyK3yW6CMr+M7JLSC0WErAVHkUEuIEkWILBIiTeqU3Q,iv:KoTbJUnhbZp7jX/jPmX8gBobDJDoLPAvhBU9j9RYr/g=,tag:qhd6OAHNkbn0xN7wJhF1Fw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1cmzh82q8k59yzceuuy2epmqu22g7m84gqvq056mhgehwpmvjadfsc3glc8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJR1ZPZFUxRTh0QjB6UDJ4\nOFd2c2lFejhHck5UdUxVbmFFbVRYNEJaSzJZCkNxbndVVThObDkxUmx2WW9ESzhh\na2o0LzFCbWdJVlRIV00rTVUwTktoek0KLS0tIC9qalVvZmpGQXZsV3RIYWRPbmRY\nam80NkRkT2l0ak8wV3pTSW9kSC9nZ3cKCH8eEMmku6WMliEDdAiW2Lk1jAGH9SoP\nWQ5Y6e90jEnp8XbGE7KYiG+jy5fHSc6Y5/YyMmi/b9bF9AhmRT6rdw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-11-25T15:44:12Z",
+		"mac": "ENC[AES256_GCM,data:EqEvcd75Si3I0Tgxm0ffeVRKrKNqaFNI+NqZcB02mKPYPWTR6fX4VT2oVhLIxvn+5MQY2BBR/VzSxblcX6K149REpk/22aGuHfk45giq8q1xBnZeNzEQDuhoY8XZd8dzqxk1pHmQFS+jL/zl42a2Qib/jVmlnPof0bcwa/HlZDU=,iv:5V2zSQOCG/XkRF7zgFe1oDuzrP3dx6pWZpsvdVT8hz8=,tag:DYHQIFEedflw43aCTT/ACA==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2025-11-23T15:25:41Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAwDh3VI7VctTAQ/+OOUtfNq9RBpm1/AbgTjenkcsRwzvyxMQ+VfT7AN/OjEH\naYaVnoU+IYoUJIw8u0zfFuJGyhcU862pMN+isngqNNZiEqY8C9rP4+l82Ks4qLU2\nanUk8HPcUc7bQC19zoSpl5MIeppV4SNC5OAph+YKVcj95l6OFw1EieptfhRFtTps\nwUKMf3p9FC/ndxjDG6Rxro7RQsETJgZ3DE3tRFPsBzMiC3sf+fsOzFgVyABqYZ1k\nDr+pkdBzGB3LXOyeDJWK38DxY/NEEfDgdSGLC6ntQ8eS9fbcNajT6FUwH2uwHJ4y\niWT6Q8z+XFjh3Z458tZhcnBGv6AKGeQ/QG9z+0DALKkkmij+vJqRAGjJxur6XM3K\nf0anUMXLeCINcLEa+Wv7inYJaPXu2NSmqtd1yYYXoAbVcnmzmgW9D2in+JnG5urQ\nCq0MEALyp1axExIaD3BHrFIaK9IX2PO1E/PLDng8AtGEx5Fn//OQX0Wt/yB2eEk2\n3uubPz1a1eMfRz1pK5CFOpJoZ8bmyg5n4g/5MgVgoxzA5nhjfMYD/HD8EG3ta8PI\nrQZhtlg7C+5nEsNevD4RPmzO7z1JdqJGMIWPPUJKZ7WozA5192aAw6HVKdtI4FH7\nXv4KY+GcmUvsKhpaWidW7vsY4MWSfn4m6Ybg2vqHsCUjj5fHVHF9BeKQecIcTTyF\nAgwDC9FRLmchgYQBD/4mfMCt5Ez8WITcru+pwlMHCeSUOxfftsydqdtt/gZ2oJTH\nhMMN2A26x3LXIfZ8IA6to6ldxQLfj3gDF8H+akHbRyndrA1V0U+EhoNZ/DYECkNB\nx8xtrJwsY47siT7sWlounXqnQr5E4nfSfDOsfSv04aUyyUsMqdjFRVY1/b5BCkoJ\nOptFJJjdosfmGfsHCGYvqj0XNycVQj3ioYEwOdDMlZ8riSyRTRPL9UAfgFeQ5swG\n1I1qWaF2+8KUk01wQwmwYLKs1JUnVOl6Uy4XpHbcZcCEIW3VVnwxFVCYcHwhDXWT\n4YGeGFfosuthL4AjJ2EmNKLq+sUxmD7ANS2E561+0BDAakQ3Z0eA/wpJ6VWQtfV0\n05tw6zS3BWwTi5fiiN4JvXqnj+8aT1PBtgxrCeDCjQ36KGViLzDsZOCMNYcr1EZI\nEFMTmaUDFWtoHQKi7ZU+oiRGGfZdnbh0icCsnBecePo4//LaCvBn6lA+vFBmuHLo\nZ2Idh5JSYFoEvhdX3j+sO0dOqzQdDEDy6+Y3S3T4vuSB3w5k1B5c3EDseKfLHUY/\nhgAIxO7rtELyhlFODMmEOzLWwOfxq/5ar/izxkdQS5HPNyVXT6SKikTGmI2z8Uw3\njyCaXv7ny5IVG/kR5aTP+DIHhichcpxJk7j+wZfZV/g8O2PWQpYXfxr36gSo49Je\nARJUBGaEVAhqoNfaHCUbvHCSbbI2yKY+sliX3p7MmcMdy/cvKyowQUuw/FYtdbGD\nHwCe6GZZzHWJZkX3nju3zhOy3gBDBDB1fbF4W0VjsjOwYjy/7MNMVH0eXli20Q==\n=qkvc\n-----END PGP MESSAGE-----",
+				"fp": "4BE7925262289B476DBBC17B76FD3810215AE097"
+			}
+		],
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.11.0"
+	}
+}
--- a/modules/home/common/mail.nix
+++ b/modules/home/common/mail.nix
@ -1,6 +1,6 @@
-{ lib, config, inputs, nixosConfig ? config, ... }:
+{ lib, config, inputs, globals, nixosConfig ? config, ... }:
 let
-  inherit (nixosConfig.repo.secrets.common.mail) address1 address2 address2-name address3 address3-name address4 address4-user address4-host;
+  inherit (nixosConfig.repo.secrets.common.mail) address1 address2 address2-name address3 address3-name address4;
  inherit (nixosConfig.repo.secrets.common) fullName;
  inherit (config.swarselsystems) xdgDir;
 in
@ -123,24 +123,43 @@ in
            maildirBasePath = "Mail";
            accounts = {
              swarsel = {
+                imap = {
+                  host = globals.services.mailserver.domain;
+                  port = 993;
+                  tls.enable = true; # SSL/TLS
+                };
+                smtp = {
+                  host = globals.services.mailserver.domain;
+                  port = 465;
+                  tls.enable = true; # SSL/TLS
+                };
+                thunderbird = {
+                  enable = true;
+                  profiles = [ "default" ];
+                };
                address = address4;
-                userName = address4-user;
+                userName = address4;
                realName = fullName;
                passwordCommand = "cat ${nixosConfig.sops.secrets.address4-token.path}";
-                smtp = {
-                  host = address4-host;
-                  port = 587;
-                  tls = {
-                    enable = true;
-                    useStartTls = true;
-                  };
-                };
-                mu.enable = false;
+                mu.enable = true;
                msmtp = {
                  enable = true;
                };
                mbsync = {
-                  enable = false;
+                  enable = true;
+                  create = "maildir";
+                  expunge = "both";
+                  patterns = [ "*" ];
+                  extraConfig = {
+                    channel = {
+                      Sync = "All";
+                    };
+                    account = {
+                      Timeout = 120;
+                      PipelineDepth = 1;
+                      AuthMechs = "LOGIN";
+                    };
+                  };
                };
              };

--- a/modules/nixos/server/mailserver.nix
+++ b/modules/nixos/server/mailserver.nix
@ -0,0 +1,115 @@
+{ lib, config, globals, dns, confLib, ... }:
+let
+  inherit (config.swarselsystems) sopsFile;
+  inherit (confLib.gen { name = "mailserver"; dir = "/var/lib/dovecot"; user = "virtualMail"; group = "virtualMail"; port = 443; }) serviceName serviceDir servicePort serviceUser serviceGroup serviceDomain serviceProxy proxyAddress4 proxyAddress6;
+  inherit (config.repo.secrets.local.mailserver) user1 alias1_1 alias1_2 alias1_3 alias1_4 user2 alias2_1 user3;
+  baseDomain = globals.domains.main;
+in
+{
+  options = {
+    swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
+  };
+  config = lib.mkIf config.swarselmodules.server.${serviceName} {
+
+    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+      "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
+    };
+
+    globals.services.${serviceName} = {
+      domain = serviceDomain;
+      inherit proxyAddress4 proxyAddress6;
+    };
+
+    sops.secrets = {
+      user1-hashed-pw = { inherit sopsFile; owner = serviceUser; };
+      user2-hashed-pw = { inherit sopsFile; owner = serviceUser; };
+      user3-hashed-pw = { inherit sopsFile; owner = serviceUser; };
+    };
+
+    environment.persistence."/persist".directories = lib.mkIf config.swarselsystems.isImpermanence [
+      { directory = "/var/vmail"; user = serviceUser; group = serviceGroup; mode = "0770"; }
+      { directory = "/var/sieve"; user = serviceUser; group = serviceGroup; mode = "0770"; }
+      { directory = "/var/dkim"; user = "rspamd"; group = "rspamd"; mode = "0700"; }
+      { directory = serviceDir; user = serviceUser; group = serviceGroup; mode = "0700"; }
+      { directory = "/var/lib/postgresql"; user = "postgres"; group = "postgres"; mode = "0750"; }
+      { directory = "/var/lib/rspamd"; user = "rspamd"; group = "rspamd"; mode = "0700"; }
+      { directory = "/var/lib/roundcube"; user = "roundcube"; group = "roundcube"; mode = "0700"; }
+      { directory = "/var/lib/redis-rspamd"; user = "redis-rspamd"; group = "redis-rspamd"; mode = "0700"; }
+      { directory = "/var/lib/postfix"; user = "root"; group = "root"; mode = "0755"; }
+      { directory = "/var/lib/knot-resolver"; user = "knot-resolver"; group = "knot-resolver"; mode = "0770"; }
+    ];
+
+    mailserver = {
+      enable = true;
+      stateVersion = 3;
+      fqdn = serviceDomain;
+      domains = [ baseDomain ];
+      indexDir = "${serviceDir}/indices";
+      openFirewall = true;
+      certificateScheme = "acme";
+      dmarcReporting.enable = true;
+
+      loginAccounts = {
+        "${user1}@${baseDomain}" = {
+          hashedPasswordFile = config.sops.secrets.user1-hashed-pw.path;
+          aliases = [
+            "${alias1_1}@${baseDomain}"
+            "${alias1_2}@${baseDomain}"
+            "${alias1_3}@${baseDomain}"
+            "${alias1_4}@${baseDomain}"
+          ];
+        };
+        "${user2}@${baseDomain}" = {
+          hashedPasswordFile = config.sops.secrets.user2-hashed-pw.path;
+          aliases = [
+            "${alias2_1}@${baseDomain}"
+          ];
+          sendOnly = true;
+        };
+        "${user3}@${baseDomain}" = {
+          hashedPasswordFile = config.sops.secrets.user3-hashed-pw.path;
+          aliases = [
+            "@${baseDomain}"
+          ];
+          catchAll = [
+            baseDomain
+          ];
+        };
+      };
+    };
+
+    services.roundcube = {
+      enable = true;
+      # this is the url of the vhost, not necessarily the same as the fqdn of
+      # the mailserver
+      hostName = serviceDomain;
+      extraConfig = ''
+        $config['imap_host'] = "ssl://${config.mailserver.fqdn}";
+        $config['smtp_host'] = "ssl://${config.mailserver.fqdn}";
+        $config['smtp_user'] = "%u";
+        $config['smtp_pass'] = "%p";
+      '';
+      configureNginx = true;
+    };
+
+    # the rest of the ports are managed by snm
+    networking.firewall.allowedTCPPorts = [ 80 servicePort ];
+
+    nodes.${serviceProxy}.services.nginx = {
+      virtualHosts = {
+        "${serviceDomain}" = {
+          enableACME = true;
+          forceSSL = true;
+          acmeRoot = null;
+          locations = {
+            "/".recommendedSecurityHeaders = false;
+            "~ ^/(SQL|bin|config|logs|temp|vendor)/".recommendedSecurityHeaders = false;
+            "~ ^/(CHANGELOG.md|INSTALL|LICENSE|README.md|SECURITY.md|UPGRADING|composer.json|composer.lock)".recommendedSecurityHeaders = false;
+            "~* \\.php(/|$)".recommendedSecurityHeaders = false;
+          };
+        };
+      };
+    };
+
+  };
+}
--- a/nix/globals.nix
+++ b/nix/globals.nix
@ -1,5 +1,5 @@
 # adapted from https://github.com/oddlama/nix-config/blob/main/nix/globals.nix
-{ self, inputs, ... }:
+{ inputs, ... }:
 {
  flake = { config, lib, ... }:
    {
--- a/secrets/certs/secrets.yaml
+++ b/secrets/certs/secrets.yaml
@ -8,98 +8,116 @@ sops:
        - recipient: age16lnmuuxfuxxtty3atnhut8wseppwnhp7rdhmxqd5tdvs9qnjffjq42sqyy
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrOE9rY2tmekF4blBrUEpH
-            TmM2a2ozUGNvaFpDWjYrelhEdGc1RUp3Q0RjCmloQldpdDdXUlV4eEt6YjF1V3lm
-            NUxTckR3STNNRmF1dHRqTmhNOWt5cmMKLS0tIDJjVFJZUlNXQzhjVWNLQVpjOTgw
-            anhEbXNFblZpZ3hIVXNxcmhBcDRpK2MKb/Fh7QtHGBFttpzt1qSVE+1H6W2FYKXI
-            Uuly3uYxfvQXV/rtgXNP5nqtFe9rMAQYuLMgJ8SbUr7cczt57CX4VA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3Vzk2RWVCUk51cWtVRk1K
+            dXA4dmJSNGVMQ2VlUXJsbGZjbjRaMUFZdVJFCm1RMk1PbDQyOWpjaXVVdWoxVUJq
+            dGQxMmlVcEovZGZ4bzdnbS9kRE9NZHMKLS0tIFdEeHJVS0NjcElNQ2hDNkJNaURZ
+            VWR2RXZHd2ZON2VQZW9KL1NlME5hNDgKvEn7GMfQgA3FBDmimP32i8QQ8NuUAt4p
+            uM2Z7UJP8i75x6GWku6eEKWO3M+rNsTPFL1VJfYORjiG8JKGWb4IOw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1k73gy5em3js9zklnnkzp5hme9k04lny32fgahmzddknjw5c295asdyr4x6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtMHlrMUlkYnJWTkZPSEhq
+            VnpVd2c0VUxwZnJsaElxcXVCQldMblhoc1hVClJGOEZReVgyaDBTUndFUUhJaU9r
+            QkxySldYMFVpSjh2VVQ2aXBleUFFM0UKLS0tIEtZZW9KNS9sMzd6STdJTXQ4Vkxo
+            UU0rRTZDUnJsRkVrdFljRXlEanF6RTgKuXPEvoGgBtQX21yBJGBJSRnDw5uK7iUa
+            NIB6YUZjGpzzjgdStSrqBe74Q5Jz0z1uy41l5r1YW4SMs8xP9N2EzA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1cmzh82q8k59yzceuuy2epmqu22g7m84gqvq056mhgehwpmvjadfsc3glc8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjK2tQYVUzOGxlWGE3Ulc2
+            TmFpMnVaanQrdFoyUW1iKzdjQkFra0JSUEZJCmxObElTWExJanBxNVVPV3dLZzZw
+            WThURHFkQUlpOXBEZGZFTUkxZ3lMbVkKLS0tIGI2QTg3UUhPRjlZVDFWQjZiT0px
+            MGdUdjR3S1k0V0FzTzFTQ3ZXSkxaMlUKxH8TdDacUtyTmG/rpDg7tmpN7XGUXzgj
+            Fqg5QSpDSB06945MGt+zgHGEArcg9v+PtfX0MbF/Lj6uW871J6Ihiw==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1hsumymvh5mkqlaynrp9lv2w696yk3wtjzlyfmrpeuvh9u2tlwceqh3563x
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZTFVPMElxenJwQVBwYUlr
-            WGZOUUx2NU84WnY2VWRBQllLR3Zub3d1ZEJFCkhubngxM2phTjdtVTR2ZFB3REc3
-            NDNJNHE2OVpFaWdFVVYwOWJRajRrSDQKLS0tIHBJL2ZoTURaSGhFWDdKQ2oxcnUv
-            S1J2VmRIYTNSd3lkUTRBWXhkR2o3aVkKknm9GBqyoPCZZbN+A0PkOVnBWAq18rqX
-            SnvvX4GYiSor9H+DtPHoRkg7P2eDi8c9ISkpnXReYcRjpw1mSqFE0Q==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLa1hlZ2JuS0JOc01IZTBv
+            ZkUrQ25SeGU3VC9YcXFrbzlpeEtLZ09DLzJRClRZc1NuNG9OTlY1enphbjdrc1BZ
+            L0w1ZVR1SGNSekdSb0FSdXRYMDAvc28KLS0tIEJHSFo5YzZIVVNaNUdOa1pHamlq
+            bFNWM0g4MG9ZQnIwTG40VFVXL3ByS1kKPOt/Y66db5aZ/PRihBX1JMMjtZGV4RJd
+            s6REyW9R2VvwCtDQMewEFTSXZgeGQeyH6i3hEuYRDxb0VNZibXFHIQ==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1mjgw3nxlnqdj04mgjz3wn7fj2nl2nxla4p2r2fn4nkvayfgp09pqllxzyh
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWV05lSmRvb1JRTW1jK1dR
-            VFFEdGEzbTRuQk10YVhoeVhVL1cwQ2ZYVFZVCjhNTHB3N0s0N3NBMkRMZWNsRzVE
-            WVVZdkxBU0N2dnArY3BlYXRyUnI4QjgKLS0tIHFYai9BV0R0VTBKT0tjcDIrSUU1
-            dFlxNXJRMmdNclVMeHNNYWcxRHF4b3cK2Ql2NFSci/LJhIw3lNc+2EB7XzrLsJj/
-            gVHiXmF42v/vI59ZLuBZfY9tD53WfO4RFe89uh8gGh0JHly3DTS7nA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArQXdwNWhEK3dodjNaK2Zm
+            cWVWQ3BsTWQybVRUOUx6TWNDcjhRam01ODFFCi9BcUFFSHN0UVZoOUdrQ3piejFY
+            R0grN3M1U0NLYXlFUEpjdEpVOEJmckUKLS0tIEtKc0N2OXF0aXg0bGhWMUZBNlJ6
+            NTdWcmtVNHA4WUczb0xpZVc0TGczV0kKmnoGm9V6amumqlClGjlFcGIX05KeV2qW
+            f11xsg8pjGpPldzT/Wqb6vWYJDJL7c7J/AJkm9d8k/7GtJQ1qKngCg==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age16vzhcvz8tyxj8e0f47fy0z4p3dsg0ak4vl52ut3l07a0tz465cxslmhevl
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwU21WTEh1cVhkSXhTNURU
-            RWl0L3hFeVp1c3VJNDg5QnlHdHpLTFEzUUFFCkVkSVNLclhDZjB4amRSR25LSjhQ
-            TG1vN3NoWFE1ZE4rSnNneUliVFV2K3cKLS0tIEx1Q0E5bG9TVk8vWS80cklZUmhU
-            MHJqSis0TWJOcTk5MXBxWW5hanMyMXcKC6o2kKTVGho9t0QZGpG1ivd33iNmNu7F
-            UTykT8tGY+rZJTGKBXRGbFXL9prXnnAhpeRywfiKq2d1MFhJwR2ing==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQUHJVd1BQeXYyQ1BzSlFv
+            bkpBYTA2Z0J0WGtWZ3NxOE5wYmZRSU92aFc4Clg4Ly9qREV6eGV6ZWk1WTY4SjBB
+            QzZTVmlRSTgwSlUxTVJTOWIrZnNKWnMKLS0tIGtiSTJ0Y3F4S09FSnR6WGdJaC9D
+            a2FvbEgwejlob0U3Q25lK1M2TDczT1kKTzSG1q51CEr/dBgYJ37HceXZYS5cnBtJ
+            1zxmURZaXpsOtzB9KJn6iUt7FwpqIJss/+p1AELvHUZgjJI9DiFfkg==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1zlnxraee6tddr07xn59mx5rdexw8qxryd53eqlsajasfhfy78fkq705dfg
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqbVN0MDgzcVdPNUYyTEFu
-            cWNVVEduQ2NsTmxBelhKU2ZaK2g0TjN1U1VRClNmbXRxWjZmQW1jSkhtZ3loNFlj
-            VHlreVA5K3kvV3Q3SWFEb3JoWkRjSFUKLS0tIFlaYmlTaTdFWE5HMjBzOHFkVEFQ
-            UFlML3RpOEo4RTZEREplMFVTdm9QYzQK73riJYtOcy4Edzcf/BehAEhYPNNmMu/P
-            wbnfg79Dz2vslu81s44uc08rQdYDyp2ByS64ov4AwjYnQ4t3Hs7SgQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVTzc5NjI0TnRYREVIZFIr
+            VDFkK1Q4WmJGNnBBLzN3SVJBQ3dZMTVrWkE0ClpselBZaEdNeEdjTGQ3SjJuUkhH
+            alpEbGF6TDRSRVZLelROcVJxcG5id0EKLS0tIFRPMG82VG45Qm9uNlBzQWVFdC9C
+            UzFWUGhINDRQUS9TZHRLblRybzBIU0kKV3nNWCLMZliDnW4PCZ/6HAMJSTy6arjE
+            Eh89+SCKBpVecZM+DrwPDQOYY3BSihTYD4bawfhbTxFI8RQXA/ljkw==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1h72072slm2pthn9m2qwjsyy2dsazc6hz97kpzh4gksvv0r2jqecqul8w63
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzTVgzZHFISlFwMndON1Zy
-            VmRxWmUxdVhIU1dBb1FCNDFpeERQblBmNkNVCjBKalRSblFGREprZCtLaUV3bkJq
-            L09OZzJjSzdkV0J3c3cxRmNqYXluNTgKLS0tIENvQzk4UGlIeVJZa2FBS3YxQ0o4
-            aE5wcVpqRVFaUDZEbUR2ckZZUlpFbFkKF3QH10Qb+UNpRbM3JzVRCjJfz4J10aB5
-            a67zfK+4Nf1lqWMcTC72zOJo1b4OitkwOZPSHUwd37URLxA+b3F0+Q==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByQjlhcGtKRDdCdkFMZ1l5
+            Mm4zUXJCTmdkMVh5TUpwc2dndFNOUHBLaTI0CmZGaDQxRHAwcWdyT1BtUDRQT2xq
+            NEZsYnNVOEpzckZYUEM5WTg4eU9yUjQKLS0tIDRzeFRkZHZUQkpiNGFjeSt5SThK
+            NXVYOUdMQk9NRjlKTFlHTU1leFZISkUK/hudtpolmk19shnGFstPflmotm3uvfF/
+            5ZiXoVKcptQne33YczlhY13+0QPpV7hXuXBw+YTHRRXvjGN3wrtgNA==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age18quey88vge7xytclg2nuq4ncme86dg04lxwczqxczmdchnjg3p0saehsnh
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhbGFOOWpyOXY3dlpKeDgy
-            cGVpY1dkamd2RU5qWm1MVzBEUXlqV1EwRlZ3CmFyUXJ6Y1lSNlFNNSswRUc5dTVx
-            T2xQQlhzbVAxS2c3RUpxVHVYelBEYUkKLS0tIHU1SUpoZi85WG1uMitUVmFkdG91
-            bHRhZnBtUXZybm9VT2Y3TGhjbCtsSVEKfEo8jXw9wQdncX1gWev5xxz4s9XRMrX0
-            OampKe7MO30BsocF2blkgRQqJe8aZqFgZt0AvSBc7OyuI3mRZMPCBQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1dHJTL2I4NEFxakJmTk5F
+            RURmSUVwcGEvR0NLRE8yNlkwbW9WRWV0c2hZCm5KUXROZ3k3ZzBpV1dQcnN0TWNI
+            R2lTbUNjaWlpQ3dXd0dVS3IrbmYzVjgKLS0tIHlHTk1ITDE0d0tnNW02T3Q1OFVM
+            UitSdTNFM1JTTVYycDNoeEdhSmpOajAK3G02xLW42AEcJxHKmqoSsmss33xXkH5j
+            9ewQOxAAdR0teBoHRC8hE5wNrnL4u4xGTOAq3zXxhidEq0fMc0C9tg==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2025-11-19T14:09:27Z"
    mac: ENC[AES256_GCM,data:tZ6QzVPivueZiC9Qfb3KNZAv02QatgHRNnlM+Y0iV4BZkYoBjxeDojutizvAMwUarnubUdk5I6m2OZK1mvVDZKXyI6zALX4JMeT2xYQWRHYzHpOygLhhGwTFVhV+0C4jN+eJFF2cNf9lu7NuZI9ylZSOY8I3YKUl+l0l3CkXUl4=,iv:JSGOUq+j9T/NXspn70dfu0J4ISV6vVFZUe/Z1CirrJk=,tag:Hm9N55f9qMc056nSTR1piw==,type:str]
    pgp:
-        - created_at: "2025-11-11T17:51:25Z"
+        - created_at: "2025-11-25T18:32:47Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMAwDh3VI7VctTAQ/+KEHJIsZn5VF+vGkqGoMmoqYcRQ+TVXeOIAA6ZM4G/VN1
-            3AEcFmq3JQo/Bjvq0pl1IQbvCzT6bNprl3ADmXeqt9x8MOoc28Qx2AJcOmfT+Gzu
-            AL2Y0zuJ54qXqgBfF+b/014Ek0fxMSPbUI8EuIPPMWuG+upQqhlcvxTr5usvO3qn
-            dfxt0R7ISwjA9pDYs3fBI+65M4eq0yrSyfsoKQLKsLRXSn3rO56vSS3jTHc3FwWD
-            0cOOrWNMdbSnAFeMsioG1sfH4LlzDG3MM96Ne49f9dv0Z9JmLFV18i85mzN75i0p
-            4cmcMC6XrHasdLXcvfob42n1PMRArOpLppf0kk3UVvNcx3xVKmCp6S39LIR++763
-            wawC22oo6rz3aFRqVqGMudWub2DamsQrnb0IQjnRP249JLROw/cd/h1LaG02ZSP5
-            zSz/TmZ1FjgO6aT8oMUQyiDCEq8BfFO6i6SQLkXxw9pfy5kqX5OGh02xLceAzTYH
-            HCTZm/DRYZw7XimA0CTw51Jd5qy0t7vddcN1bjSy3uZH4CyFn0AsDLvHo6t7xTSr
-            hZKR8ICbUUDOIi5hLskqFvtSUYIBJoH8NwcMyPukK+ZrrLOwSMWa3qB7r3NodXd0
-            NsxxFT9GiQAtD46SgATLhgHCmP5L8DlVvWv3zyYpim7VxoLW8T5s6yOkURAHWlOF
-            AgwDC9FRLmchgYQBD/9NR8LjoQkd95Qrff2NN7wU5a2QD/dSkQgLAkjWnJ+S14TU
-            zHdZPp/lorQw5pXanndDRMElZdFrfL7CKI4e4Dd3oPdOpRW9+8/7iyDrW1Pcsgz6
-            H2qAEMjLESdWswxbS8uEdX6UzYUBv3+BamedgbBj95qPtPnTaQvGCUL+kpBb7YTm
-            +Fo1tlC5fZ6jr/V3qacNeG8nFDLm1GvhWOtqNW16Dt4z3RaYBtYF7ElMXRMq11iT
-            iFMT512SN7/e8dd1jDcFg6Cw4NkU7o+6bA+gs/P7ksAJxyUqAn9elhKYSrNeSDnD
-            Vtb92/kFO5dc3CrD1F24FyD1Xe6sgqETFL6OilvEGQ/wYJ/AXu84q0ch23f0Tksm
-            kk6ZpQLd7QKgow5pLwnAbpFBS1P5cemPY6gvmUAtgYJrGLIxxtk44SVhlQeSX3lq
-            eEJT4lZTu8gzQLTnDiZWJpVTnppZhMqXV2LsWAFU2XRHpuCnAuT0HmNFbaqzzC3r
-            tWa5lZRjgzs5e+zxsRhz+OfwwtJMWZw9OAmIQiRWeitZpk0XMYGraQce2ohPQlSQ
-            RFarR7EDDevuvRnLmbhhK73of6v8Wb0J/40gZZIWVLRT1LcNBz9ueBsHwPTvvCe5
-            FFELdJcxYfIGaCINU6uwvNulS/47f1rpyCtoegNtSvzGtmc+/r2RR8emd8lMS9Jc
-            AYmI7h6C5XznEGGVtIoAkW44WhIm+Y08tbJoMevp6aRADTnEC6CY1cH3H1ZQbdp0
-            YeN6qE3d91gmxW25hsStr8Mcy0JPIflt3kxcWeASpgJnbkOgxtgxhMqYAqc=
-            =R1dw
+            hQIMAwDh3VI7VctTARAAzpWulcVroUoACaD2ruC3zk49IbaTntS5BnduZgckvHWU
+            YREVjz48tuE2KLDm/AHkEdJAOlTS5jkhz5L2k74wg9MehqwVEzMfaLaJyDm7J9oW
+            CdsI16TPpr3j68m7yMn45GUwNMmMj0NBYfpd+ydFbqcswC4Is5vFn9hIPAlQgQLt
+            G3uKh8IWOxWT/6rHSL2ajQNGTg6h08yvgoIas8JBq3J7RPa5vPL/XJXh3yCUIjgF
+            wFNprivM9CiYf7rwJUEa9TUdjPoj0Vo4mfZIBh85YJ7LCI3hyxFLMgxqNNFtq+Op
+            NKrznWjpzyxDSrXGz4os2khg8bVWXEbV5H0pvvwtLf9ADRp9KhB7Jdd5VX61KHta
+            0j32SuX86m3KAFzXV+s8xM/abVcfb3g2ECZIJ0qjX7kJ3q5F/Zzv99JoutjJ1Qko
+            Zv1XrsfdFPR9Z6XJyU2No4aegiYtFxKp3Uo8u5yAetXO8uG/aPXXVI1VphYAheuU
+            TKaWirIRC6jA9I2fI0WEk9pKi0vcjbK/RdkYUyfeTmxzE8F50rCuclXRkR4yVWCm
+            09xrcyZK04BkYdgSx5ldhq3LpW0DqtP79KFZ9M2Vr8+9wOcJFkA2g5jQh+/b/0U0
+            0lOUVg+PRkBQ4SEi4UauFmhgnt/nrMfXwty5XyW6MvTUSZo3N1SW4CaSmBEGxUKF
+            AgwDC9FRLmchgYQBD/9iknczA7d6KW/t1Ek/R2MIcvHN4lndzcLzzctR5CpJVbne
+            dHuz6DEFb/x/134iSPZhkJHLLUgCBaasgEzL8vniaoWq6uccdxYL6nK/P11z2fVA
+            NFUwR4t1NWodi8xZ2lKiv6MFpDekjphS/9qL9NTmjdXxpyd6gnz+tRn3Kdnm4cSx
+            /ESJQ9DOVGxa04EEup6TN5HttGIoP/kxJfgGCTG93AAIYbCRJEQJaLqpoiuUZmL6
+            EccOivMlqwEaV3fAFx93tPJzMOZwJeVO03qnAPjqrIsJpuFBSqerLZdxZcgipoia
+            skIW/FMI1ei5qTFgq29mJZvEixK0zu86jRi53pNmyPHKqNEaH9rRi5X7zJXk4Wij
+            1KdeNl9XdbtXjNmqOQHD8D5cIV43Hko69ZAxCXVJ1dYq3tjM6OuDTUWAxhfXOcE4
+            qfb9hdQ5l7NpPaK44NEVCjVZHyNYq9Tu2V/5od3uz18Y7L7RPX1EnnSq6swsE1Yk
+            qBg10Uh1a9vh3tu2gcoHA5qUrpukzX+ndWmtJ7P0k51VqdQGSkamo2YfPj1BYxQa
+            TJ0VMIo9936rcBPFy8WxemERhkOPtzWfIaeiK4sUREK/z6bQl1aY1y85pKS1vyPn
+            CFx+7lt4ITRgiuaTCGRgTQ3xYBhqUufA1+dtbLDf9WOT3kBtktXU3KNjC+QEWNJc
+            AQSLv5CljoYo/FV16RZKwmCWADMZ6qB5cuJTGpI/TDyiap7jDiVXYX0A97FbwS09
+            a+XS7M5vCVpPLY+lXsM34m3Enn7uLnfsj8Y6GDFs+7vn43ajcsWJtuN1sbk=
+            =ySlA
            -----END PGP MESSAGE-----
          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
    unencrypted_suffix: _unencrypted
--- a/secrets/eagleland/secrets.yaml
+++ b/secrets/eagleland/secrets.yaml
@ -0,0 +1,53 @@
+#ENC[AES256_GCM,data:TeJxdPs=,iv:M76JVBlBfgjjm1SuT/0tG/98FXpkIPpGng4u4F5p07I=,tag:RXAqa2R0HmEOjW0dD1treA==,type:comment]
+acme-dns-token: ENC[AES256_GCM,data:39nbceTlpOCKThRLBVvA0b39+ZMo7IQwXjRED3niNzVk8aCsOq077g==,iv:px8OoxEN+OsCN9ve87eXw0Zc8lhXVC9tOk3VVhoKlt0=,tag:hcUVsH2XkgclmfEsC+NeaA==,type:str]
+#ENC[AES256_GCM,data:dZiEtGPKsbsd9g==,iv:lNgXQHx/w7pm3EUTBwyFnqv2j0T7zQ59nFLom8F0hQ8=,tag:1cF89QMfjipYZgfl08qSOA==,type:comment]
+user1-hashed-pw: ENC[AES256_GCM,data:uPyDpGOVIqE6cCyvhXIM6v8sTqEx9dV96oqMYS7fRMLiR0kYlCmgNBEeDFmTNRskqwW/WGXrOBn555ZH,iv:KbHW2mOGzOw4t9aOrKLOIobkUNLWj69dk7fFuy1x3aQ=,tag:51+qAavIiM6K256MkhBaZw==,type:str]
+user2-hashed-pw: ENC[AES256_GCM,data:+BES2HwH+Jj6wl7MVzsdmPGxp6AuiPLx+XuOpJClksm9SlbAyqATAHeNokAHmj7yLS79rJF5C3YBBtT4,iv:bSX0PLcriKal3eir24DTyePfropgVhh83U0JdR6/2Cs=,tag:TiSKjApnJg3di+77vV9l6Q==,type:str]
+user3-hashed-pw: ENC[AES256_GCM,data:sr7jv7PppT5Ub8VsvipXdZZWTZ31GFscmZ/CcHzYE4vsfIYYHpFElHGMjlbcTSLjyqfVOcXAKNvabcoO,iv:C22sZLrUUc3G80yyYr1snuwqtAa8USZd8FRtua5hllw=,tag:lu0hPo24CXNI2kE7C8g3Eg==,type:str]
+sops:
+    age:
+        - recipient: age1cmzh82q8k59yzceuuy2epmqu22g7m84gqvq056mhgehwpmvjadfsc3glc8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxWkxKRHJnTjFHcGlhN2Ev
+            aHphYWN6SXNNZWdNc2dBclViaUJFdW9HTUNVCnN2Q2MvMUZpMmFENlpNTVZmZFJj
+            bjFRTmtENzQ2WVpHWmc3S1BCMzZmeE0KLS0tIHRPZlNQRnZXcjMvSERuVVN5WDIr
+            SmZrb2xuVW5VVjM0b244U0lkVmlkVGcKin/6A8ONfW72fbQmvJWiNCzAZfGUtxCI
+            WV0DaPvO7sO5y7q37QxVUOxgJgF0WpKiNel4Y9E06xbl3TK6jXk2MA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-11-24T13:05:23Z"
+    mac: ENC[AES256_GCM,data:/wmUX+WUP9Jbai9hv+a7/yqzJuL/y2BnjOjaONoce1RGD1ULZb3/qjXJr2NdqQNLbDDq6z3UafX1c+ki8CDs8Q3psO4P5jXrntcc9mgNuioy69TWJtCz8nWYaoZQLyOwe6sAClmJb3prGbSXmt1VO+5RBd3GN482eoA9+NWuhjg=,iv:tLfkcFYWMs+DErWocrT4c3YfBJtGtSGX+E3i8b+qKFM=,tag:QH6IMxpZPVvvKgFPTnis0Q==,type:str]
+    pgp:
+        - created_at: "2025-11-24T12:05:01Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwDh3VI7VctTAQ//XLsWCm+hQ4388h7XmawVSSjBF5dRYHUpuW35fMG/+EWj
+            8cGL9dXCBTwBMCV1tEPQikjdVdzFPfCdroeKozvdt9XEOv26sYxtUwihPsp3PDtZ
+            Mq42veeVqcd33NgfINim7DALCoF6wlh6FM8Xeg/HHcFk9T6gcnhHRWbka/nBXm5y
+            3ESVCMws+nuenmNsAp7NP6+TbF5kToSHSd5sf/S+mdo3rMIWVtdwc3Ox7RGeA2Kc
+            1AEGfkIZmrUtnCnhbE6Q89nNfmtdmQ6RFY0sPZem3Kksx5SfxLTP+QwsyUeNG402
+            ndnjCKiWLlQGkO51wgl3oobJ4KqqC1A9wMvYCIiv163bCy+jA1fsGH/OAIa3kCTb
+            sauCsLeq3ilSmzmwbWKFIi3dst+YR63XSs7aSCaZ0HnI8CCPV4TMtNkgtiVCXIGv
+            UmF5XCx7aN3cfGTbTwBzMs741HzQHSxMgKekicJS+NJC/P0DfJu/st781rFqJ536
+            FLYF9yK98kVNLrxpWlw+ayp8pP2wMmDScYjZU0Pi4Xz9y6iF0ZtJfEc/NaThKJ6l
+            K1xat17b7dTdn0H1Ncq2zhZ41nydk6+0K1zYMtjFplCwzGtTDAn7QIY2YEFf+zEF
+            A/FrEW8sjTOYbWORz3ZdH/lhd12FKEG/QFiM5UwQkINRjBO9NFLTmGXzD0C0kVOF
+            AgwDC9FRLmchgYQBD/9TYF9hq4JEshBgmUrv+6MnnuXJCYkDdPFrDWk14bAL+J/M
+            9r3hHNK/PY9OUqgVf1HRO8d/bIvAwDJhs3rhWP/el6IM5UWfkwwwx/blhTzTlbgm
+            1XjN9uPd8lAaNFDgZBKg341zxxuQa6Ikm3MCI/pyXqeOKMlxXfrkH0Lx+e4TyoBF
+            pDflamEOVJt15dQFOB9aiphTZMCmVQfV/eYfjqpRDR837/ptzQgasgk2KFvyxCkp
+            iWL/n1nN4n4lg2BYeg0EinFu9lR03VIPaWYrmYCU1XvDUbVKr3c5FbX1mcyt4PvW
+            oSCq7Gax/YCSQFy6Iv2QiPqhrnelYRuBMuXrnSz8TKfXJtsW8+R42vNc4o4iSYsj
+            ZIzBQO39YcUA01qogP0hxPSGzo1M0cWRpZaX3JbjWLwqZQoiDi9Uw482xDuxO0bx
+            TeFtekSCZTV7Mi1EdENb3J4UdgpEsviFLSsK0uSnCPkHu8MteS+FiztxusgHtH5f
+            YVhQhJ/bIp7jTheow5SZSnb+pRHbTq9GcN48k4G8l4YQZjbXRaYR0ojL//9yexCL
+            z2poLvkw0q59GgiBNudITIKSB0IJCcg3jDafMCJ8iqyBzwPzPHOL0oB+cYyMth5a
+            chufOtDAE3JEUJb8c3RXUnpIl2JScYV/IZNHDIUSpWOszCVDYZ9TUqM/+C8iV9Je
+            AeVg5jGHq5yGwhzhXgM0DJfFksCNvC6uyAJKpw8YRhNGNBt+pSvF38TMA+R1YPmd
+            yntweGKTK9Qjg4zpS0zwnDehJis/RSkNTkK66RsdVpcaMj47WOrvw3zGVqz1fg==
+            =A+L4
+            -----END PGP MESSAGE-----
+          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
--- a/secrets/general/secrets.yaml
+++ b/secrets/general/secrets.yaml
@ -1,7 +1,8 @@
 address1-token: ENC[AES256_GCM,data:2maU0sN0+blUbmZADtzpk2BKSg==,iv:7c+7QB2liu3UjKk0OiiwaYnlz2ysPuvhYTAsgMbsfOM=,tag:MgCOEcqQDIyNlLeTOnOvxQ==,type:str]
 address2-token: ENC[AES256_GCM,data:jZu02PAicI7u6K2P4YsXRmr9Wg==,iv:1Ry6+r8TL04Pioph8I1r0W8MU7UFbvkap378siJxYT0=,tag:Jk+RFCmEu93C3ULkrYh3Gg==,type:str]
 address3-token: ENC[AES256_GCM,data:9rotZe4tdPJpdWZMN8UMjksqlA==,iv:gVzLlM6h/+YXEi2YnJeShrczWc8Qn0lleRdJoPHbJbk=,tag:Zg59VaKgMysjYekfpbRvhw==,type:str]
-address4-token: ENC[AES256_GCM,data:q1z9P0zo8/66HZOVYv2sT1bxGsIrKSQKGcM3ouX8DaE=,iv:KJFPnQoGObsiLGH1WZFdhrg6cuasLBgbZ8sQ2jiFzEc=,tag:koqwVXnA+i27IkGSeEawkQ==,type:str]
+#ENC[AES256_GCM,data:pvNcp0qySk95V4tp8WmbPAICSoT5xyUVhbjdxjmq36bfH2wKpXCOzFlwQ5N9o1iY,iv:ykJGXAfXQ32yb3WI07VlILcKvIyXk07DQrGkuPzMazU=,tag:SRaT5AG4pwQvOp3W5SoryQ==,type:comment]
+address4-token: ENC[AES256_GCM,data:21Gy95axXTMPViM=,iv:bC1iHdVfwRJFVe2rANe8HJ4PKXFDC8XbJJzLStho22E=,tag:ZIKGbtG21Tu9vZ7up0w25w==,type:str]
 fever-pw: ENC[AES256_GCM,data:62cQ/mUFMTb63OY=,iv:RCqzwKEi7LdIegibpVe/WlTsREECy4xrqPFNini49Z8=,tag:bfmBEFj3zzmzfk4T7CfPAw==,type:str]
 main-user-hashed-pw: ENC[AES256_GCM,data:RbXaVuCd8+MTFwwRGK2aJ07clDOOt5msCsEK+384WLdeJz8fjxKJcwIsIUfqlsjKG1Ands9GINlFiCHXPFBRTjnN1ih20t6InA==,iv:pLas4FuJXz5ORvKqZmXyOp9RzKse/vUFOMbw3S1B+Wk=,tag:gkZ2C/Krf53nQiPBVnZ/rw==,type:str]
 #ENC[AES256_GCM,data:O/ceQ4r5sc3YS86n1yQYH40l,iv:Ak2QK9MCIrrT7TRGpyCTEo9e2VsyaeATWjCITqYI+7g=,tag:kcIDdMujWfs2IZIheA82ZQ==,type:comment]
@ -34,107 +35,125 @@ sops:
        - recipient: age1h72072slm2pthn9m2qwjsyy2dsazc6hz97kpzh4gksvv0r2jqecqul8w63
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQNU8xU0tHWVJOYjR1UVpz
-            THlRK0FvYisyR3NqTVk1QUlhQVJGbTJROTJBCjVMQThqK3cvUGZlcU5WOEJncnM4
-            ZlcrQmdCVTZsT0t0ODhJUG4vY0JlWGMKLS0tIGpQY3hqdDA5bkhOU2I0UGVHaU5F
-            T2pYcDRMczh3c1B6cmNFMXRYM21Ea28K6An8G4+/mwC7SNYyV3cpx1AQuUsO3uKh
-            EG6oyvwcLbbqAdHkKLiDdD2bG/NNp+f9xycNyG2AH/8T6kl0fQN2gg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2cmdUWlNuSDdOcWo3eHRD
+            c0tGY3FmWjdhclN0dFdJSlEveDJPbGxPSnlnCnlTM1dKNTY4SC82MWJqMVFLQ1pi
+            ZXNwaVAvNnJnRDlyQm5DRFM3MktRcmcKLS0tIGF2bTcxRFRGamZ0N3U4YnFoeXdT
+            ZENWbnBjM0VlSitYdXhCVVlUQ1ZKUjgKetWVsf1xLsqfAKkO0yQSJWDmxETYWBCQ
+            CSJn0mbabacvgLFZh9CIbm1GBm1CRR+pPVdygwy2ISQSpB27tbHApg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1k73gy5em3js9zklnnkzp5hme9k04lny32fgahmzddknjw5c295asdyr4x6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAydTFkbFVtUGFQUFpBbjhx
+            cnZwVEVaWElKbVN4bWM0RnR5T1g3NndvejJrCngrY1NJVXpxNC9TN3dmK3VzZTFx
+            bG1FZEpubU8rSWYyU1NObW42TG1uancKLS0tIGg1dEowTVM0R2hKUWIyVVlRY3N6
+            YitZNW5TamlJbWtNUFhiWmNoV3dXN00KDaQWoCLomSLPzt969bwa/pxOdlAUqPKg
+            5jbzSJX22N671dhwzJY1IiGTRKNnh54hCZbb1Jvl0l2mUifkxZazIg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1cmzh82q8k59yzceuuy2epmqu22g7m84gqvq056mhgehwpmvjadfsc3glc8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArMUlHOGE3cjVuVnkzSS9L
+            aFRWZExPbUJDZUhXL29oaVlyZ2JUSmtpV3pvCkhGREdZYWVPZ29KSkErSkgrUVBt
+            YjNPVXVaeXlyNXIrdzRBVFVEMDR0VEkKLS0tIHFNdHFlQUtwcWx4TDMrRDFac3hW
+            M2ozakkvSGxSTi80Q3YzV0lJbUx4eTQKC7bf1qkqKM2YkHYuk67Ub7XAO3engfBi
+            nk/kDjf47A5LWUzGFDYb7UizmaI7lkPjw2mOhWPLGfX6uFK7sZAt2Q==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1hsumymvh5mkqlaynrp9lv2w696yk3wtjzlyfmrpeuvh9u2tlwceqh3563x
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1djB6aDJRdW5zdjMrMnhJ
-            YmF2WncrazVUMWNaNXBWU2Y0TVh2S1VpbmtZCjdXQmM0RzVJK1ZNSlhwd2NvSHFO
-            UmlXZEZWRzJnSGJtdFFUQVd2aytNU00KLS0tIFhwQWQ1MnBVZllzb0VyQzJMRm9Z
-            Qk5XdXUrcloxelBlVlJuMmpJZ2liK28KNt0EMbRBErf1GExZ7QBnrvwRKozNaHQF
-            MeFiEuIRAS4vSUHz2dHo7/iyub7D//qXKt4vD6DURfCHhhoGUF1Qdg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZOE1xRTJaWUR3cDBhS0ZX
+            eDJ3aW1vU1o1eW1yRW5UUWN4QWN6TFY2QUVnCnRGUkgvNmRFMkdFRHhPMlZrczB5
+            VjRvb05NTHRxTkQ2Rmx3clJwUVovVTAKLS0tIGRzdm5vL2NTdTRpNmY1dUtXcGN2
+            OEVSOEIydnRJaTdocVBNK3pQSk9lOVEKgD2xXVdgrk4Ur6UdbdEMsjCqu+w1VxTc
+            HIvvvx6JhXU5ZD7kjFru2eg2g9ZalikZuL7wt4OGfIkyZZrg0QwLZw==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1mjgw3nxlnqdj04mgjz3wn7fj2nl2nxla4p2r2fn4nkvayfgp09pqllxzyh
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYWm15SitONndOZkVDekNl
-            ajhTQXljdllXaEJ3RVdQRm5sdFJnV0VpQ0E4Ck9nTEVSYmNDK1RUbnU0TkFabnEz
-            aHVxcTNqUGJ3cDkybHllSmRPVW9Fa2cKLS0tIDgyZjZnV3hWS3phUG1RMjU1Lzlr
-            QWZLTUV2ZVJlRXBrN3ZXZFRBaGtabE0Kgcy7XL1iCLifYHxydg29tIyPYUQ7hgd9
-            c589DNlukEn+i1J4pBkiLDnTUxDOEsUv2VJlGTRrdbFsfjU7PdvG6g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQTU9jZXBtanR3RFZxRk91
+            OGNDcnJFSU5UTEZDMHFRTmh0bGg3VkxNdTJBCitDNzVQZ3NOSWtGR0RhS3NvdC9E
+            NTFyejl6TFAyZk9ZK0hBMXVLUHplNU0KLS0tIGwyWnl4aVZxZ1BoR09kZDE1Z1hP
+            UWhnZVdhaGNtekdqVWV4UENJTGhiWUUK2Mo/VAq6pTUC919opBOVoqe8rDhx+7YG
+            WEEbFrsuncwU5E7lTRveIhI3E9cEA2+Fy88dN/p8ntCR2doaZjlu8w==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age16vzhcvz8tyxj8e0f47fy0z4p3dsg0ak4vl52ut3l07a0tz465cxslmhevl
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxeGt6Nkd1TWhLc2FpZXM5
-            cEhDUWVNU0xSWjZlZFdsb3FmbGQyUVV1MGp3CmNUcG14UXpyLytNRFFVRWw5b09n
-            ZU0wMDcxZVJENWdlcVpEQU9Mdnlkd1EKLS0tIGxHSTBXWi9EQkNYL3p6NGJvU2Zo
-            cVRHeVJXTVIvaW85Skh0Ym5vRjllaFkKhuQpyhqyTz2eoQ0Mxt0/CaNHgaksrdbH
-            rBDEw0U0eXX54oQkqNZD/HUosmLO4f2EZKMhBnFaZ8LvaOV6jM9Mpw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5V1ZTYW9KUmFKWFdWanpH
+            Q0dTcDZVd0pDSTVUWlVYVGptRndkVU1sRjNFCnVmQ0ZFRnBVWGk0ZExHeW5oTFNN
+            eFRYVzV2SDA1RmNZRXlrRmV4SGMvZzgKLS0tIHpkZS9ZbnViYmtqa1A3WmZjU2x5
+            M3FaM0RaeURQT1lCb1oyNVcvbU1iRUUKDk3bCkZf+xGf40JoiC/lLmI9xVVrkHaK
+            AwSeHtRHhvunWdFRyNlO5gLeeAqQuIBAUlwuMTgMdLYKzueOjdzJiQ==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1zlnxraee6tddr07xn59mx5rdexw8qxryd53eqlsajasfhfy78fkq705dfg
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyM3hLYnNMVS80R08xbm1s
-            YklvK05mc255bUNjc1RYbmlOblo4cXcwRTBnCnVabFR4UFpDNSs2UUNoRUpYZ1dJ
-            d2xZRlhMNGM2M2RzTEwveWh4NmRSVWMKLS0tIFZTeGY4MzFxMWppOFlseFZWcG5D
-            RkUrdDJTNmNhQkFzWTRKbnM2OElDbW8KXITNQ+SKRxIBHh8vgqq+d0u3oLejr6mP
-            OxhLohXXPXi7r2KTVTVjCu5fbDyVix/L604LvJE623ALl0pmyQq9XA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTMVB4N1NvWlN3d2IrYm84
+            d09jWU00RUtUVTY4WTZ1d0w3N2tPZmcwVFFRCk9qNjM4UFB1b3NTTFowV3dmWGl5
+            bEJNeE5LSlNGdGdGcjAzZ3A3RENqeE0KLS0tIDR2a0RXSVFQRHNSZzRjVThkVm5B
+            U1NhUjNYcmpVV1JBdGVEYWZha3dEbzQKeci1Kak+wj+tCEsQiKg52IvWbjrmx/aZ
+            ZEpwZOeuputFvxDVUAvkTtE/qthfstDjFnHYtKgTz2vtBUDachnhhw==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age16lnmuuxfuxxtty3atnhut8wseppwnhp7rdhmxqd5tdvs9qnjffjq42sqyy
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLTHVXQXRGZnl0QUEzQ00r
-            cGpaS0RpYnVHVjg4cGNTdzBTMXFvTkUya3lnCmlJai8ySUxONXNnWW9BR0tKMDdr
-            RHVLTUYxY1FMSjFnaFdZSy9nekV1dWsKLS0tIEFuL3FTQ0xNOHJsSHlzR3VFT0FK
-            RE05ODd5bnFkVzlXVXlBU0FZa01nNzAKzjfkwKN4mC04r+AMNPTIt/lSMUuL/OD0
-            MGtqjZFB6vGrcqV/t0EbkZfxCqfmUeTDZgwWM2r6zhihb6Y9vTjHTA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpYmpJMFgwWmsySWlzZk8v
+            OGtTTG9xZXNQL0pHMnlSdWxNSDlWY0NKdmdzCkd5VG5vcTZKSTBOVnFYQkdGNzRB
+            M0lPOGdNamJHcWxHRUFXUEp0ejF6eFEKLS0tIFM1VVpFK2UrcDk0YWoxOXo1Z2JO
+            OWpGV09wOVBEWnZ0M0xBdmc4TFlnYTgKlPTvteJrwkEfNAPGOKK84WNXz0ZWEkFQ
+            irEIJV+SQD75KCfsFQRNL9s0Phd6t1wknqAbB5L4GLPdLAZKY2hf1A==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1glge4e97vgqzh332mqs5990vteezu2m8k4wq3z35jk0q8czw3gks2d7a3h
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGRmpKaWM5dVNDWDJLOUlj
-            bGZiUzNWMkFkT3IzNUtqZmt6ZW5WSDVyUlUwCkx6aFIxTnNnd1N5ZkZDYldmTndX
-            T0g2Yy9tVVpHQ3FYY2RtVmhjSS83TUEKLS0tIFNTT0JUbVBqNDVvWnAyaVRhcllj
-            ZjNtSU5iYVpXQXA4QUU1YjBCU2xKaFEK+cANW7VGs7HQTmMDEY2oLG6pSBnBLFXn
-            /PpoqzxNVovh7ghFRduDcHWuJI+DBtn1axmSXF/K22WO6LG59/hr5A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4OE5nYkFrbTZUWmdnVWN0
+            YUhDNFRmblU2MFk4UFlXNmtoOVYvZkY2cWlRCmJ2VGwxUENxS0VKbnRXUVNRSWNW
+            ZlFTcTNVVnZKVXhqczc4ekF4M1FUTFEKLS0tIFhiR2QrYTFNcTZtZjduTWg3OFAz
+            aThXZ0c4MmNVU21NK2UyZGJjUkNQencKiyEdqY1J9MGYfbEQ6U/7xOulYFTemU9i
+            2gg0P+3MhxBu1zcVTq+0+YbOxjw7O3/TKTO9Qj7MqdM3Gh1DXlix+A==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age18quey88vge7xytclg2nuq4ncme86dg04lxwczqxczmdchnjg3p0saehsnh
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2QTlyeDBGa1hNek5aWnlr
-            RzlWN2dDaU9IeXovb1BGTXR1RG1ZUVdwTUVvCkRuVXFnYWpOakZYamZtdDNMRjQ0
-            ajU0VmtraEplbDU0ajZyT2psWVBrVlEKLS0tIEhXa2F6RFlsQnc5ejZETVBvOFYz
-            Wlo1WFlvZFJXZWZBVkh6UUpCRmVESFkKqbuLxX706LssJTNyvg0ghDjyJaVuYfgJ
-            X1OJbbBvHerqvOmk03biU93oo6PygdAAgkPFI7JnxvQP1U4IH45Esw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEQnZpbi80Qmx3WTYzc3p5
+            TElMWkJYVlNLdlVZS0Q5cFNTei9ITVVkd0dZCldrdGQyZmxPUFFMLzFnL1c0VWpk
+            Z09XdktuNHQzTzh6ZnJueXoySHYwa28KLS0tIEc0ZXBHZ3ZvOVVlelVhNTZpS0hL
+            ZmhYMGhpcndEMlNFMWVPWmFUQitmRkEKQoi4hri+lEDo7FWiiYlbw11MK+PRnIbD
+            YYGmu44YDEMFZWAfszAaT6dYF0tJpyEuH0bOgcDEg7GlQf+BIIogtg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-03T15:12:52Z"
-    mac: ENC[AES256_GCM,data:86AWnB2q5xv/JIyomkJOkZh4r2tj18rmNb02JINokmBv4/eRmej/sQIBeSbCj9cJhtKewECwVk8QKtwTu2sWB/hPjtxb8qnWD7MhNs7qmHOYAeYlAON4w7abcLxt0VFMKa7gd0c28qTHOkaWsLy6gDaIB/5x468FIYqsbfIiL9U=,iv:BDiKNHKTHPazwoM6bVoCf2kb/eNrJS9zy4yj3+PFdlY=,tag:6ZFtZZHvzdWp2EhOV3S7xQ==,type:str]
+    lastmodified: "2025-11-25T09:18:55Z"
+    mac: ENC[AES256_GCM,data:vUjq35hovsqOZoTuRZuPYLL6bCz96yYQr0+hjReXfc240+dZkZfpo/EH2U7kmKUXcfvXMR8ThextHNDcfBNo70EqyOdGZTrzUFIzdZw2rbYb8bVt1stSj8AAilIN5xgf+aKOYAuKxQoZ5zbtW9vCzrGI71PSp6gX7zNnEZI7QTs=,iv:+2p3A1hEDftpqMwPiQNXxVonZ8Xh+CaD9A7vcRmlJcY=,tag:4Mv7vMwW8buziYRJylLw0Q==,type:str]
    pgp:
-        - created_at: "2025-11-11T17:51:26Z"
+        - created_at: "2025-11-25T18:32:48Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMAwDh3VI7VctTARAAzM9wzRQI9IYBz9sXGG1YKIojcuhi3UnZNjOwRQeJbSsw
-            OMPY/e84m668uFaGUwOPwFkYikBCaPF3OmzNhMDqxHPUbFJN/6UA8ntLuugHrhs9
-            brpt52yYvo69znaR8iYXw/S0mL4rfLnHkc8p69RkBCk/4FrA/Jj/KImcFxZ8GDcf
-            G5dfaEmJCRfZGeyr1D7RVJ0gs3LQT9M8c9Qm/ShRQQqVlEko4rjsOmqOt6eapSuQ
-            KnlsEtYS5yZOFoBtabmlTiFgdC8vaHQ+oxI98phdRkc0xDpqZetMMVlgonbewur8
-            nVZPb+wxULeltkIIleWQx2E0D9RBi5Xu+L+vXj7jJYwUNajqama/N+1wB7DsiBeu
-            cdPjLyRcXPD5pE2qi24X1nzBiWdjef0tkJiH07MQtXA4r3PLtX8a3cCvVsecoT4D
-            0oK8dGumaXSj8NkYB/kP47hOleSYzNGWPR4iMiXYNJHhUw0Otr0GFSfjVo7s7KBi
-            6WO6tWE2VLVuolABEKQPF4sadF1fXxcv9artuzUX9MZquOvsOvEgkQnYzGIY9hio
-            2X8nyLxORpwPFmPcZ5WeVyaZ04CiM9nTiflFgt5X/rX1Mf3sKa0NkrhO3+k7lx1j
-            GjWvgiuCkgLYt0fLgyYVEj/N8jHjcCejVEsiwAoP/apvEgFylgI+YwyXOJXXz0qF
-            AgsDC9FRLmchgYQBD/jvs1GaGr52Qu1TP7IXqg353G3yZDPoPmQhdkiOKLFe5wXD
-            PaqNUNOQG4qwffuPBSfyw5XHYZN1v0SCwrNpQ24DFnT5XjVTboYl+DN4bWStrSE+
-            ZpGUy+PxvSgKY8lbvGi0+RX1NW32Gwz1cuPNQRnwS/jwCFrxgk1aCnK5+USAmNfi
-            R5+ex+Ij6+EEiMRpvNdN2ViCP2PfFMLYOR4pjvLL7i1XSPLhGxORcCyIKw8RAi+J
-            I/qP7IubG1XTsS7gm0D4Rf4eYOy9O3Qi/g+GOk8mxCXaym7hQmCcM5H+m4R85Zxy
-            EIXKGQhs2UB7JD47SJ1iY3FBFzq3jpn0wPq6piy4lJVR/+r9Zd99EcWOEjuoavE/
-            24q+Z3OB864Fks9hVl8herQbV4oGqHTQJr9Y5ScnS+7RuAV6Cy7d0nEaj/H4jBxN
-            fKpFGAJ3LkwxKfAwxximTq2lgHBtCyMably7XBc3D0Cyb1lyG5mss3tWNXRNkckL
-            yg9I64lKdEQz2Fp7qs8JDWmbhUl6eyDtGX+4KKW7lsFTbi4kvo/FgtW6m6xaP57k
-            PPOJlfDHOqZy7GR+hvaHBIgFkhvqIvJjARK5OaDyP19NMtA7qNJOwParSikkTeXl
-            XgkZGnh3ID3EJ5V9vMIYqrhhjDU5Qb/avytjEoef8GYmPb8bWd0sVODEL59T0l4B
-            u4ahb81JM4JVo+p1P+W+0gXA8uUgP9pJ7lWjNCV+oL5RWTJRaTzSwa8ywj5HjLdH
-            +M50prEhcMiDupwZXU2prEKrCIWUGpeaHK3DIJmWhbO8Hh8OCXeQ+EFfxB+Z
-            =s+4A
+            hQIMAwDh3VI7VctTARAA2KVbwbh02Bofe+Fp5xuwOZ8vezg5dQp9ZRq57NlnvTcN
+            LgygtWBkBYhle9PtkU+GoaIxD12cTErEXjwt70HpFlUtSQso8xzi8/wo0cvSynDp
+            pN7j6SLF4jNjQzF8d0CP2Pw0nz/kK2yt20G3WOEAsRdvaHsbd+IefPWX91hhM0cr
+            svTkPU1sVT/svhyhgSw6MllAxxHQ8s35RJD456MIzoQMr/R28cJz539R+R3NGQ8s
+            ecLK+8qaqBrKWkXvucs2E4zOMyN41ND7vWDbxQGHy2RY5xpXzXSvpw3eDljK8mcY
+            6MOiuWgGzLl20ww5TD/c7EwD/V3mecu+DO/qReWFe+UzAZOP7DdH4gcrbmDyvrIk
+            vM5Es3rkLwp+N31bBEZoBOX7ebD5CjToz4WUgWDgiaIpiSsAsCW5wO4e85Lc6L0+
+            MgqqicIcLQrUHLK6t/X68lFTHCmjKttKCYFnvA3pVi0BCpcTjGJiF7ywHhbVeBEE
+            Zp4zjbrz6hP6Sg4yE6DUFBf7cK5BrTbdw9DNO6h6wre2SFCGan3AlWyr2l+U6gq4
+            fCgtLHJcjchf41bIdCNod+FImRBrkJYGdIff+ZqFQ8a3C10blmqoaHXii72ig+RJ
+            vwR/ND0BQWsV56tNkviEapBr3n196xR4ueXFTuXe69PX0BI95jP4ybyQlUmx6rCF
+            AgwDC9FRLmchgYQBD/95o/4k1QFCtDhpD0H2RXtlP9HH3Mlul9vsd1Heqf9I4oZ/
+            XcwrXcaep/3Sf3VWIzzYtiid3gkO4yO/jBdxaQUY06h+32v9EsEbbE8TcpRCjUXz
+            fh5TBtPIPCDaZjj8Zg8CbJPeQL/9ePg85OLk8OL3kwbS8j77cAYnJwk2ghoyHMAD
+            Ty4Vy/qzyxmSMXXK/V8WDBuUb8D41iD8lTk0swTUKkwPQmn9IZvpD4uHB3M2L4ll
+            GneOcFET5RqpltUmm72DOoy/wcOCAb19IzRz1j9Emtob4BElhYyMHShyXof/8JUr
+            PiwMm5PWj30YRD7GvsfWpEHhpmN+uTauoRlQ5WNSDIMuDIVjIMq5whEQ3cnO1Wp0
+            LPqL2KqE8U7nl2lsxEp9siZpt8yawOBZlHRqXrqsdQ94UrgBa/AkfqNC/WgSHi/5
+            mgFKulRqT82Y7Gr0HZYmfAF3M1z4NZ1xOk3/LsmhkEc5NvMV1sWqIEOahKrUMwL6
+            EfhxIdfYZ4RBf19A+L1ZFV9cxeI7NhBTK8IZNgJypTpih7Ue3igECuYNHxOrtTON
+            tIAqRU3Ow8V/JvO5SGXYtDk3SmFyaEEPQXb/ZDTuh0c3nRhbeIaHjF26nD22krht
+            B4MxaK+/UOsD61W3OICanep5fBREUN+Ku6BuYyT8hvZUJ+Kjjnp0G+EvL3dKX9Je
+            AZkb6xguhuMcgbS0K+mEItPcrozbNZ6t6KN9Gk/dn+6D9kONypkSlRveETyQHPkx
+            +jPJtJnro7ADZyFHzQTF2/2o6pEnyG2xwn3m32n9UAU0vZ30gV04AQYE9zMa0g==
+            =Z5aJ
            -----END PGP MESSAGE-----
          fp: 4BE7925262289B476DBBC17B76FD3810215AE097
    unencrypted_suffix: _unencrypted
--- a/secrets/repo/globals.nix.enc
+++ b/secrets/repo/globals.nix.enc
@ -1,38 +1,50 @@
 {
-	"data": "ENC[AES256_GCM,data:1nK/JO8sa+N6EXpyIHBnRapOXYbtM38jnNCf/j0wIOG+0uJvQEFc1e9gIFvuvmPUpUjh6XMuEKNxvLTjFlaLiypOX3yJVTn2fiyOWSm244wcye0GRPe+RWIi+1kEPrFDBEG2JFB+9iGSx0Vf2NfBPgaVFnr4Z2TTGH/kvxiTV6KYucWQNHh+jvVKZ6vAsCP2pFWp2yhpov9l5Tj6MwyK7E46Gn7DmCAtlZcA64Nht+99Zrrfuq8byan6w8RMFR830GJvdMAAD/Vsz/6aGQfHhpJwl4L8/4WwvhQq/DuU1umI1Q7r7FosXbos6g8wTWuM3ccD7V//tFDeVkaMKJzkLkQt0JbyzansijadTYjo0I1w15iH2nySBSIrsOJauBcw3XaP6NfAC3fN1lh/fDaj5HWud5v2ginWRfJNYalfMvTkXm2E5m8SXjanGJL1bHBle4TwEDNPT8+LFIJm8gf57rQRcRlh,iv:W3xvnTblM4Aa0dzDKiWqHM6B5zmu5ddk3D4tYAVNBiY=,tag:KelbYP9xbTmDaWiPrkS+Mw==,type:str]",
+	"data": "ENC[AES256_GCM,data:4xUewD3bW8oAY4nG78bYXC6LxCyG9Wd8S6bzlvOBpUNkkVdNpQo5OarlkKZrP7dNOFDw3fYjthRympGhPiWS/0JGTgCocEZyvTFbYdHsqtGvS0MBSd7tWcaQNfYcGUS69ueQz2xa9WN5AL5r3XMvdZzXWdOX3uap0m/KmfnRmrKsF060pMO1Ll7TCCRSOrj31r64HPG6mcwSPYe3DhkuMeOCKQRUNsfpe5T3PaQqwfgFqGrtKturYGg3YzwN1p7l5m+jc2BEWAswIJg7IuKgTSRqqtgfbduTlGZADxTcGDpczJ+wazH3LGqhhRB/ZUKeA0l5oezBrML7sJdTEfgiM/7xHT4cpW2TQewCQoSNDPxnHBxOz+2wa1mz9gXrBx24gLFpeHKYSIu7X3k/t4sG1ll2a1DjFvV+I+B4ALEj6kVkMnlieTpzreI7zsnuWR7TbhTFIN5xiPSWPITZpRH5SkYwicwv6j8KZqPVDoMnEKBq7PSZnjEFODzchrrEXCkahEJ/1Hw27Lz8PSLIsA+HQyjzhYJ/35OkG6QCbSoms8FONnJ6uK0iNXNau8mBO7memlXJNSdnuPtU/jd5CiGrBc85BaWU0aTOlXPJA+kJ2FKaL66JkOtObIEYhQWqt9ao4FwH+gXupnZDdPyX0ZpP/4CGa95FlhqpSVV3vzOFZyXhUi/QN8bBC5ESa0WgnXOf2p8y4Z35+AHbJX/RMsjG5yk8gDQU0BDU7+aXWNYX+JrQZgVFShgba5KFN7G45oYz8hbFBfpkOjfe8i8xiEMoGPnov9QhqjRpEN9eRFoT/tD4fY/6ztfBMcqr4pPZuZCU+wcZGM8k1y6/eguX+cJ0sVPYhB7ZZ/pa6Dea3JVekRFUdqQJBElteRIloRGoNuNaU+LLNTfO+H3ys9f4rhMOVumU4sffWTmnSwgQCCoPxbY1A4a5G69N2DnnRQwsN5qtsbN7aUb9eRECfNHcmldpwhUeUYOlfoLVKaJitfEU8+GgXB0umpd0wr6LD6GlmxPYKA/NZfnDk8+mkzJx1eul/x1YweH79+ifqdu1+TURc5AYEFcB5P2vxz185Q3HiWYMLvjClO4jyKaWZ0IuNq8jENmBYjsk8/G7Cec+/tdHFBbV5Ctn7g0gzwziAJ9mPgDUpRF7BpNWgJOpW8E1giFkiBUdPJoO/zfKJHdV5CKY6Qyq4kAv/eLyi2qhfHhKTkSiuW4nCYpqHDsFi51QnGM=,iv:N3Bs1Arc+0g9tCd66OMsrPyeB2be+76EFYBPPSchIpE=,tag:h5zh01CkvZj3ikWWwbJXEQ==,type:str]",
 	"sops": {
 		"age": [
 			{
 				"recipient": "age1h72072slm2pthn9m2qwjsyy2dsazc6hz97kpzh4gksvv0r2jqecqul8w63",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBudFBlTlVWMUk4QzByRlN2\nTUcrS0VhV2xEUTc2ZkJjY3dZaTg1ZTBmNVNvCnNhY2FpQkJkQ1VZRDhTN1dUaE5M\nSTJ4WUt0SDA2Y2FSK1JENU5kVkcwNlEKLS0tIFRvV3haejQxNUJUSGd6bkJMa3hM\nVFJQUWNhaGlVenRLSDhHd0VJSDcwKzAKt+JZAK2QVUdB4Nh/xqKS1acqQy7iNMka\n/YrjK6J9CSTGUAjfMZTPXXwstVYaZCZYUnZ0xeIlRZPQw741hx4kWQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkNjR2L09PalRkUTREY2lW\nSWFmL2lTRWtMOXA4Qk9kbzNicTJZV0JEM1FRClpjQmlZRGhHUDR0YlZlUW1uaUJm\nSElmZXJ5RnczVm5uZnpyejVMQkhDNlUKLS0tIFdhZzB6TGh4UkZUUktmY3ZRUXM2\nSURjZG9kVXZ0a1dCZWczV3VGTXVva3cKTGhXQjLhn3hpY72nfeu0pVCz+qzJi1gJ\n6AcGZQDKavoJaP+qadTVe8pa0Vu1NX3ILJBKigPF6OTVJY8/BaiX1Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1cmzh82q8k59yzceuuy2epmqu22g7m84gqvq056mhgehwpmvjadfsc3glc8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqWE8ydmNXRlBEM2lidU5k\nb01jQ0Q5TjlRZXI1YjlTTDF2N0VNZ2pJOTJFCjV5bmZuWE82UGtWSGJFWkVCbmVD\nRlJLczhwN21XSGhaaWFpVlNyWUNZem8KLS0tIGphZ0RFVUdXdUVTbDFibjR1TFp5\nQ3hvZjhaWFI2TnVzTWJ6dCt4K05lTzAK5pJgUGGCwzPO6yWyqiQuCEwYc3PrFXV9\n/fhVaRhdLJXc6/hBvWsK5vzQNe4o64AfUjS+iHyXi5m0dGINzWCDSw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hsumymvh5mkqlaynrp9lv2w696yk3wtjzlyfmrpeuvh9u2tlwceqh3563x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnUFV1Q2pQUEJvOUtQWFZL\nNlowSmg3MGQwUTJxMFhXcFZ0aElLMEM5NWpNCk5lZkNUQzNzNnVVZCtkMzdIdStV\ndmJ1dDBwck9lVUc5MmhKekxWV3h1UGcKLS0tIC9yOHBUbzY4R1c1aXZ4N0JVZkpF\nZ0gvMnhxSXl0LytxVUVxVGV1eElIYlkKPa58QsZc7y15LJlOamtTNrWPH+EkblLX\nEI7IkmOWK/lhG9KEwG4h1+8gDS+5bHPuvqz/7+sROo/A8Ry0Tj9oWg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mjgw3nxlnqdj04mgjz3wn7fj2nl2nxla4p2r2fn4nkvayfgp09pqllxzyh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIODlXSjhFbmo4ZWZUWkdj\ncEVHT3N5Vjg1NnJVNzFOWEkybzVxTEtWbWhZCjRHUlo2L0U4YjZFS2tMMVM0NjJQ\nQWtLV21MWTZRWkFWVGdUNUEzK0g1TnMKLS0tIDFxaTNtQ00zbXJNQUdqVUc4QUJ5\ndWVvTGpMNVkxZmVjK2xKN3F0dE1mZTQKuw+pFE5tYe6vcTL4FrgvJs7RKKGJBNZO\nDUjlUxMB/WBR52BNuDL7kviFeLaF2HLeF4s+GkvqYugHnTBiZ5fzww==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age16vzhcvz8tyxj8e0f47fy0z4p3dsg0ak4vl52ut3l07a0tz465cxslmhevl",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2RUM0TVJFam5lTERkSzRZ\nVmF1SmJYU3VlN0psUXlYKzVkV0VNS21UWFNzCjU2b2p3cEZod21rYVNxWDQvS0lB\neHhDTTIySzZ3TnNYTkVQU1g4ejUzOEkKLS0tIDNxaWpMV2RJQzl5T1gyOW1aT0xH\nMFU0S1FyOFZnczhETTBvZkNmQUtvcEEKO32cV09CY6x9ievHyaKNLFR2Jt1y8Pbg\nCXnpvFmXMXROoxRaDN2N4+0SRyjhzuAabyAKszOksW+iJ7fwAmuR/Q==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4WkJ1Q3Rlcjc0QTRmallo\nRlRlclFmcXArUW04R3JEY2FWYlBBTWxscGxjCnpOcTJqN3FzR05NcTh2SytFbU1l\nbEJHZXZPdHVuODcyVjZLU1k2WEJxaHcKLS0tIEtNRnBzK29mZlZXeGdpYTRXWW1S\nZVVuQk9rQXBOZk5QQ01ucDAyelh3eEUKKmljNvAc5Af+B6x4hVlNjZZiznPu+U2/\n4cA9twbGvxJab6cU/aXLtB1yOmQMbm5sroBZ8+sqThGo1n1eBRHQDg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1zlnxraee6tddr07xn59mx5rdexw8qxryd53eqlsajasfhfy78fkq705dfg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxRFZFcWhDYkpENkhmVzhr\naGVueEFRdUxHZ2l3K24zL1pWR1VtSzUxWWx3CkVReU5FSnI2TDkwV05KaVl6cERY\ndzR2Yk8way9aNlhIZEEwNmUyOTdYYncKLS0tIFNqVHpNczhZREkweCtYWmpPcjdK\nRWdRQ1ZGa256cTJrdEloRmpGTXFDMGsKF9A40XY/cRGd4ZQXnxnlHVxAWks77j+z\nt18W7/lECC0Dt/jLMfEup9dnPyXS60C4Mz35kRNFCPXgvlIiozzyYw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMWtLZkZHRHBGK0JnQThs\nN1g2K2lQYWFmdTIyOEE4cmg4R3FnWWdldEQ0CndFbFBZOGRhWlh5QU9DWlc3MkVk\ncktUdDZjWXQ4anE1S3RsMnN4UnJOc3MKLS0tIFZlSU02eHByMzNScCs5QWdHYnlU\nWDdJcHBzQ0l2MjMxdFU4Q1c1S2pVdHcKvAzlHn0XQ3Oi5SqckELFtEWl3kOulf/U\nZ4ux4+FGfkjYbq7jiyyHL8RfLVuBRDS4MGcGYEsI0YQvmcgxBFLP2Q==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age16lnmuuxfuxxtty3atnhut8wseppwnhp7rdhmxqd5tdvs9qnjffjq42sqyy",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYdGswSkh5bmZHait6Uisw\nTzRqZDUvOThVWjhHeWFUUGJzUUpWbWU4UkFJCk1pNjZjMUV6UWtHbUc2anpRcmZZ\nYTlOOTJFS2YyS1daRzJMUFZacHJiWjAKLS0tIEcveS9RckRLQ1N4dlRiaGliYW9E\ncmhXeVVnQ3RYSmJKcUs4NTVQLzMvN3cKPxFN6MiGXyXVX0ePLTioLGTxCyEUY+X2\nHJeiFKuFkDIpfdSxrPgwrWY6r8bVeLqMsepdruqUE4o0UGHVEOn7VA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiMkh6ZG11ZVIzKzdocnNw\nODVzSmFlaEt3bEo5QWZCUVErRUQ5WklpUjBVCnNzZkdoSHdJNEJtYlpEV1VHNWF3\nQjAvVE9ZOWU0U01QdmdDMzU5NHA2ZWcKLS0tIHJZeGpsMVJhRFZCVnk4T0JqVExm\ndDYxU3RMNTVvUVhEdVJ1VHVybkhJaDgKOcg5MoybrReGg5Y+kVusweFcEKzc1xd9\ndhZC22Klz/va5RRS5IVnoaIj9JaDuN6p//mZGKtYhUQfr5SaiWnfHQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1glge4e97vgqzh332mqs5990vteezu2m8k4wq3z35jk0q8czw3gks2d7a3h",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5S2FWYzNseEkxUndRa2F6\ncW5kYzhvengrZ1pycnphQ2FFR1dYUXh4VlZFCjBPS3FhbXBvanZRNWwyYWZCSmRl\nTEs4V0NaajBkQzRxV2lJalBIVnI2bmMKLS0tIElpV0ZOU0RWWkswZ0Y4UUFiMlN6\neFRGdDIzNHA2b0lGSFFzaFZBcXNsWUkKvpYIHTeGlQ+Bqz/EcjlQ7R6I3yuwNc9l\njQQ99P3tq7bFgj4UIUDdRWaZG7PDGesEJZ6fjJEieA5o5IO3Kq0GAg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6bVBGL0l0bzFiREVscjcx\nRElzN243eDRwV0g5NGMwRzdlTmk5Umd5Unl3CnBDTlV4b3Z4K0hUbFRiMmpObE4r\nSEZPampwNUxxRGMzbFBwQldWVEFIY1UKLS0tIGtzZE1NSFFWdlFHQTg3RXNwSEdM\nTnZ2R3ppbEVBeCtvaGlNWTVWZXQ0Q2MKoOLKAxiCiTrQ1gATwuqh2aphq3zWskp/\nWeQ8oqOwc4mL5nzKIJp3VzTQ+CdL2BYfDsxhsqgilSruht0tFm+Opw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age18quey88vge7xytclg2nuq4ncme86dg04lxwczqxczmdchnjg3p0saehsnh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBibGlMSU4vUEF5UlNVZzlr\nMTMyOFY2Zi8rZFdZT1JrelZEUUZkZHFvOFdzCjVPbVovaU9nZklJQWNZeDJZNm0r\nMXBIK2hsZEY0NElxTVVMWmN6WU1Ld28KLS0tIENaallkK05SMllia3prV25hZDR2\nZDBNU0dYYnJESG1JZGpvSGp1WW9UMVEKJgfdLp7BRXvyAekecNJiaBXmxSj1qNxx\nZeHceqEkfWV/PzX+RP4LHjXTQCLEOJijbKxDmxSsYq49hC9xjZASuw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHblFPenlYNDA2WnlVdFBm\nait3bEpqR2ZUUjlOM0tMT1Q4UEpFSXpNUGxFCmtvQjVyc3RUT2pMKzdBbHNwaFUz\nelFFRVZFVzdSekY3c2M3RmJvcDR1N28KLS0tIFZBazRsTW41N0tHdXJWZnpwUUJB\nNk1iMkxZOFFDY2JtVnM4WU5KUVVEVmsKHb8PCo8cTyipymup/F8Oue5DiP+uPznd\nXbD74jiB732WPPNOrXh+wU74Uj7EpYoazvTcs4tHu30cCpbCz6cqCw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-11-09T22:41:57Z",
-		"mac": "ENC[AES256_GCM,data:iHmgHvT3yn5ayimvO+miRA3dA/0o4juBvBzWIXwtZyt5gSI4oJizMbRaX5coVJgeDdPsYaiQFqSnEPrPmrMIR16jdmscQLvz7X1gtdanMP++5q13jWOkiUHPC2nZy47M+36bzC2P/BHqKE782ERTGnD70VZO4a1lOa7pB32NutY=,iv:oOn9x/xf5g82GXdZ9fDxgEiUScXXfzSdEZccqFQLF4w=,tag:iEhx2Hm0yP6G/1w6cIgHIg==,type:str]",
+		"lastmodified": "2025-11-24T23:32:32Z",
+		"mac": "ENC[AES256_GCM,data:OAAUaCDJF3BOex3Mwl3CViPvrvkyYosgiC+hj1yvVDstRxM1hdpztl4GXA68jEykH3cw7tvSAom5ldeIr0FvZfwQ0WZXoYad6zPcQVvrdmuqev3B1TVnclvYTDKnt4UaJJleM9rYXmWYUgZSkKOr8Fgntx/YITl07kvJ8fCeIqc=,iv:a9utBRpGmwlhneyZEKWDytM8sD1z31fHQ942MTXzZ+8=,tag:n4sp39nXsmYlOXl4y37b9Q==,type:str]",
 		"pgp": [
 			{
-				"created_at": "2025-07-02T12:10:18Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAwDh3VI7VctTAQ//YG1H7a2MZEWjFupRqe1jgxJMsDXq0zWdK8Wy9mHCLmEk\njFJL8xjuJGYx1tKlQKq5tLPob1NmnIr9KXwtarFrIdWY34BwqmkYSO8Vmcp7iq5U\nL0xTRX4ZWTyOpTMwsIhIrEGWd1be4HlS/QedJxOn7/D5Y+XBHf+0t+4ScE+4n4ek\nlRhSxR9OlFrmmxAjD/PHsrekgi7wX02lHhy+yKmDQ4YYL3ve6AONY3dltOFr1wk3\nQ3ffjIGegkXTiafNbAvo6joekDDIGm44lRCoaxuS/0ZbDC0IZN9EUpw7KmJvRpaW\nkYWKLLZn07CpsG5cNvZvcSMTyVi+La7WJ4Nf8x+6XzRboVcVfQ/ZnCFqUKJTIGcS\ni+UBMgNxX7PCVmbQ2pIKzn5eSk0OTwgUv4LOJzivFDc60Mk/iq2c8ptOOuzBxhR2\n/M1fs4D8QfseU3b+/2e1ysVZGpba/QxYkdgeAa3FtZz8YpgFlSHdenuljrJke28I\nqkwWEdR80jBXwZ785Ur7Uqw3Pjv0xW9hwa0s3yJ1HyL4Was0ONp2aJIW1NSRbbFv\njTVJVQOJVz+bxMla9t9cB6JmV/JxSe4Q7dkiHFxdmxug2qL9aqpXFRy0M+R6HClp\n8FjvClOhyRAOFYwjm4Ry/jY1mM33hh+KiJ9fYxAZ6ZQBonl3BdOq6/LbAwKDdC6F\nAgwDC9FRLmchgYQBD/9YHAFQvEDfzbTbJrQT4BjqRyKjgA27tA3D8MwS9Gvub91V\nJfaYbn0bc9oJBqkTEmiKw2zOTTbEC0zw18aB3rHrAc0EjYZCP9XMYQvctJo1XAKo\nZFJcCCmdKzLX6XO7rLOyjEp4J5QfdgR2NAt4NXbBH9SjqNJ29bQhR14JyYUtd+Wo\nHcypltxgX4Hd69ZHBrhY/1YVfhLOoO/vhiyCLZPFrV5HYGo7Dzrtw1aZg+RYAH5R\nixZ+ADpdVj1Tc0EwBEIzjsmJ28g8liYOeRI8g4X8/RmgJRtPerBRMxXqXxHHU0Bq\ngZpm4Aafy2NGLWPQjjjbWO3emQSkQWPtldyiYf2pSdixm8gahMK4/As3Ziu1MvIw\nMlu6TsOca2762DJfw3eWJ7DeVAVH0gDOeibPMlRVOIlqRbKOg58ZDsVMwyQaiTxC\nWa/2Do6jOIEfWGhM8MbzVuhqEvkxlUHDJjP2v50SPCBVhdI3p+im5mr9cgalwlp/\nanSR7KMC1diRz2cpePb3bHgtJGoSHRoId85Xo/mhgPQS3wJGujEUafQQRR089YF7\nLHWgahHAYX1RP0tYA9sJQxBZkc4ryCMk3R6k6HdiZsoGB5D5rJa4ufdACrgsCuML\noF/hCCulldltYNN9ZekgB1Xii5SEYku0NP4NZnA6dsoXDE7hlcy95bm09iA7StJe\nASuM1tJbFJI7eRKdg2OafM5+aVGRsJqHmYue9sD+LY7LoOK0nR6tPrL97AybKqq1\nsHwXmxhaJglwBpConTHTIIKQw0ZGUuzowFHjrTs69lLkdIOq3BP8/3cBYJAeLw==\n=P5FL\n-----END PGP MESSAGE-----",
+				"created_at": "2025-11-23T20:29:01Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAwDh3VI7VctTAQ//QwNJ7lhnXTXntHGRFgxzpIRgDBFe/cIjztt3FfA5tavw\nWt9+Zm3et3imgGE2n/7CrgWFobhsFLP5oEXavzea6IjyH3T+RWeW9nxCzFZrP6fQ\nOS3oEhQ/SBTUFP5xDJHz/b2oNrEMQjDXlZYoMtMQihmn6qx3fiFK+dTaCKvnH3zC\nrKH03Y1iWiK5JsKs8nn97m3x9XfT/TQSlbDe1ktlGIzh0p8zvIEJcGgbz35BkBYL\nN/RK/l+xHWnt2jLLi6vj6WFano8x3BzpVrahYA7ynKoVWQChE80TUDacaVjh64MO\nYqGUluZwTSaw1NXlaRIas2z2Rm+HEpeeNEyVUCpe/gAGOawmTAhcIgORhkIK81S6\nToiAqIWaw/i/xtH+U2M59YOPRwG9XHG9/DAEmdCsztB/AykNxOMq6xJDayu++kyY\nRXe0uYbPd3b0nGMcngBr/DTWUSuO9qcpg21d4VfmNTaLHgXY8QS+8bYTETJDqyvR\nFioAfHx+H+/la+OrLwee+CONCHGrlItSo1s4jQXW3TvbWlB19gj9XYVLU6dohrke\n1h9hr0Ia82/a+5or7RCU5Gtf8tHqueOdIfG0acv7ohtmjxtZOegSgZZfPIRpUI+X\npuLxrD1u9FFF/KaVJOERZJze4jVOHvPbr69B3OD2TJkoHXQzlCEu1E2/U/zGNz+F\nAgwDC9FRLmchgYQBEAC+7PFEa8+euceAKBBPiV6CswPFy1n+4o2E3n5DGFMxm3n/\n9O074js/c2X8km0FZLg/OQ68h5iZPX/mavCybvNOdIDUDzpEYiiYhQKThVW0Oz07\nOPxXNA1U34hv+raMlvR0Uyuync7RoMJLy3VIlqttqn9urQsusUJPYTtWpVRaojjc\nhunYPQV7XdIGJG92sCMgG8JeYLpRpDJphX232xuxt4L6BZh+Ddr0TUGmKdMbPGSo\nU50Ub1uDWWDYL0BWN8BzsuQQNDOTBMVqucG/WCr7d//x1A6CY2wz8tK0pIzyv0sa\nIF0PYAguFFZ2noT9QA64wyB4BJn8bgW7L6ohv0XfVdLK0fR59lb1A9Ar386uhaCc\nstjmijCLy9T1aN8roKM98CUUamNwPFZhv+Fb70/5qN6OLRz1SPrpZRyaaqOsiyz8\nyJCxMz0KwOSc3PsLLBVhBPr5wk2w9tB7CJxk6hCjgbugXbLXXedYtlNwXyOXb7kB\nAMjGWFw1e46pCmkpHr8e0XbKqY1lXfeBPO6y3MhrqQ7Atn61lSGGuwmsbRM0oLET\nHYNbjZexMVTxsle29eM6k6Y/MPSxLp2mwj4orPgIOXKaxletNKDgLoqnSUIhbItX\n102RMnCLptObGPmlzJ3z7xSWievOiyOtT6yY1tCQQfdWE9cHONni1TYTupY9/tJe\nATViviHLvdhJTVcj/MJY5pQ3EK/UYwxJPXZG0CWHixz1uJeZTdfJm0t++tiWlRO3\nDRZ7TIvYUsicqCj/DKrcOLpS3U9toBp2dz2tCzHwZC7u99v5YgpCl058ZEMwcw==\n=TbqJ\n-----END PGP MESSAGE-----",
 				"fp": "4BE7925262289B476DBBC17B76FD3810215AE097"
 			}
 		],
--- a/secrets/repo/pii.nix.enc
+++ b/secrets/repo/pii.nix.enc