README.md

@@ -8,9 +8,9 @@
 
 1. Clone this repository
 
-```sh
+   ```sh
-git clone https://github.com/myned/nixos
+   git clone https://github.com/Myned/nixos
-```
+   ```
 
 2. Enable [Flakes](https://wiki.nixos.org/wiki/Flakes)
 
@@ -18,75 +18,59 @@ git clone https://github.com/myned/nixos
 
 4. Create machine-specific modules in `machines/MACHINE/`
 
-a. Machine configuration and hostname in `default.nix`
+   b. Machine configuration and hostname in `default.nix`
 
-```nix
+   ```nix
-{ custom.hostname = "MACHINE"; }
+   { custom.hostname = "MACHINE"; }
-```
+   ```
 
-b. [Disko](https://github.com/nix-community/disko) layout in `disko.nix`
+   c. [Disko](https://github.com/nix-community/disko) layout in `disko.nix`
 
-```sh
+   ```sh
-# Verify /dev identifier on machine
+   # Verify /dev identifier on machine
-lsblk
+   lsblk
 
-# Verify EFI/BIOS firmware on machine
+   # Verify EFI/BIOS firmware on machine
-[ -d /sys/firmware/efi/efivars ] && echo "UEFI" || echo "BIOS"
+   [ -d /sys/firmware/efi/efivars ] && echo "UEFI" || echo "BIOS"
-```
+   ```
 
-c. Generated hardware configuration in `hardware-configuration.nix`
+   d. Generated hardware configuration in `hardware-configuration.nix`
 
-```sh
+   ```sh
-nixos-generate-config --show-hardware-config --no-filesystems --root /mnt
+   nixos-generate-config --show-hardware-config --no-filesystems --root /mnt
-```
+   ```
 
 5. Choose profile and add machine-specific modules to `flake.in.nix`
 
-```nix
+   ```nix
-MACHINE = BRANCH "ARCHITECTURE" [ ./profiles/PROFILE ./machines/MACHINE ];
+   MACHINE = BRANCH [ ./profiles/PROFILE ./machines/MACHINE ];
-```
+   ```
 
-6. Generate and lock `flake.nix` with [flakegen](https://github.com/jorsn/flakegen)
+6. Generate `flake.nix` with [flakegen](https://github.com/jorsn/flakegen)
 
-```sh
+   ```sh
-cd nixos
+   git add .
-git add .
+   nix run .#genflake flake.nix
-nix run .#genflake flake.nix
+   nix flake lock
-nix flake lock
+   ```
-```
 
-7. Generate machine SSH key and rekey agenix secrets with added public key
+7. Copy host public SSH key to root on machine
 
-```sh
+   ```sh
-mkdir -p tmp/etc/ssh/
+   # On machine
-ssh-keygen -f tmp/etc/ssh/id_ed25519 -N '' -C root@MACHINE
+   sudo passwd root
-cd secrets
+   ```
-agenix -r
-```
 
-8. Add user SSH key to root authorized_keys on machine
+   ```sh
+   # On host
+   ssh-copy-id root@MACHINE
+   ```
 
-```sh
+8. Test and execute [NixOS Anywhere](https://github.com/nix-community/nixos-anywhere)
-# On host
-cat ~/.ssh/id_ed25519.pub | wl-copy
-```
 
-```sh
+   ```sh
-# On machine
+   nixos-anywhere --vm-test -f .#MACHINE root@IP
-sudo mkdir /root/.ssh/
+   nixos-anywhere -f .#MACHINE root@IP
-sudo nano /root/.ssh/authorized_keys
+   ```
-```
 
-9. Execute [NixOS Anywhere](https://github.com/nix-community/nixos-anywhere)
+9. Shutdown, detach ISO, and reboot
-
-```sh
-nixos-anywhere --extra-files tmp --flake .#MACHINE root@IP
-```
-
-10. Shutdown, detach ISO, and reboot
-
-11. Remove temporary files
-
-```sh
-rm -r tmp
-```

machines/myarm/default.nix

@@ -7,13 +7,9 @@
   custom = {
     hostname = "myarm";
 
-    settings = {
+    settings.networking = {
-      boot.systemd-boot = true;
+      static = true;
-
+      ipv6 = "2a01:4f8:c17:321c::1/64";
-      networking = {
-        static = true;
-        ipv6 = "2a01:4f8:c17:321c::1/64";
-      };
     };
   };
 }

machines/myne/default.nix

@@ -4,16 +4,5 @@
     ./hardware-configuration.nix
   ];
 
-  custom = {
+  custom.hostname = "myne";
-    hostname = "myne";
-
-    settings = {
-      boot.grub = true;
-
-      networking = {
-        static = true;
-        ipv6 = "2a01:4ff:f0:e193::1/64";
-      };
-    };
-  };
 }

machines/myne/disko.nix

@@ -3,7 +3,7 @@
     disk = {
       master = {
         type = "disk";
-        device = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_53186364";
+        device = "/dev/sda";
         content = {
           type = "gpt";
           partitions = {
@@ -54,33 +54,7 @@
 
                   "/swap" = {
                     mountpoint = "/swap";
-                    swap.swapfile.size = "4G";
+                    swap.swapfile.size = "8G";
-                  };
-                };
-              };
-            };
-          };
-        };
-      };
-
-      myvol = {
-        type = "disk";
-        device = "/dev/disk/by-id/scsi-0HC_Volume_101412796";
-        content = {
-          type = "gpt";
-          partitions = {
-            local = {
-              size = "100%";
-              content = {
-                type = "btrfs";
-                extraArgs = ["-f"];
-                subvolumes = {
-                  "/local" = {
-                    mountpoint = "/mnt/local";
-                    mountOptions = [
-                      "compress=zstd"
-                      "noatime"
-                    ];
                   };
                 };
               };

machines/myne/hardware-configuration.nix

@@ -8,11 +8,16 @@
   modulesPath,
   ...
 }: {
-  imports = [
+  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
 
-  boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
+  boot.initrd.availableKernelModules = [
+    "ahci"
+    "xhci_pci"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
   boot.initrd.kernelModules = [];
   boot.kernelModules = [];
   boot.extraModulePackages = [];

options/custom/containers/actualbudget.nix

@@ -12,14 +12,18 @@ in {
     #?? arion-actualbudget pull
     environment.shellAliases.arion-actualbudget = "sudo arion --prebuilt-file ${config.virtualisation.arion.projects.actualbudget.settings.out.dockerComposeYaml}";
 
-    virtualisation.arion.projects.actualbudget.settings.services = {
+    virtualisation.arion.projects.actualbudget = {
-      actualbudget.service = {
+      serviceName = "actualbudget";
-        container_name = "actualbudget";
+
-        image = "actualbudget/actual-server:24.9.0";
+      settings.services = {
-        ports = ["5006:5006"];
+        actualbudget.service = {
-        restart = "unless-stopped";
+          container_name = "actualbudget";
-        volumes = ["${config.custom.containers.directory}/actualbudget/data:/data"];
+          image = "actualbudget/actual-server:24.9.0";
-        # TODO: Set up trusted proxies
+          ports = ["5006:5006"];
+          restart = "unless-stopped";
+          volumes = ["${config.custom.containers.directory}/actualbudget/data:/data"];
+          # TODO: Set up trusted proxies
+        };
       };
     };
   };

options/custom/containers/coturn.nix

@@ -21,17 +21,21 @@ in {
     #?? arion-coturn pull
     environment.shellAliases.arion-coturn = "sudo arion --prebuilt-file ${config.virtualisation.arion.projects.coturn.settings.out.dockerComposeYaml}";
 
-    virtualisation.arion.projects.coturn.settings.services = {
+    virtualisation.arion.projects.coturn = {
-      # https://conduwuit.puppyirl.gay/turn.html
+      serviceName = "coturn";
-      coturn.service = {
-        container_name = "coturn";
-        image = "coturn/coturn:4.6";
-        network_mode = "host";
-        restart = "unless-stopped";
 
-        volumes = [
+      settings.services = {
-          "${config.custom.containers.directory}/coturn/coturn.conf:/etc/coturn/turnserver.conf"
+        # https://conduwuit.puppyirl.gay/turn.html
-        ];
+        coturn.service = {
+          container_name = "coturn";
+          image = "coturn/coturn:4.6";
+          network_mode = "host";
+          restart = "unless-stopped";
+
+          volumes = [
+            "${config.custom.containers.directory}/coturn/coturn.conf:/etc/coturn/turnserver.conf"
+          ];
+        };
       };
     };
 

options/custom/containers/forgejo.nix

@@ -24,31 +24,35 @@ in {
 
     networking.firewall.allowedTCPPorts = [22]; # SSH
 
-    virtualisation.arion.projects.forgejo.settings.services = {
+    virtualisation.arion.projects.forgejo = {
-      # https://codeberg.org/forgejo/forgejo
+      serviceName = "forgejo";
-      # https://forgejo.org/docs/latest/admin/
-      #?? docker exec -it forgejo bash
-      #?? sudo -u git forgejo admin user create --username USERNAME --random-password --email EMAIL --admin
-      forgejo.service = {
-        container_name = "forgejo";
-        depends_on = ["db"];
-        env_file = [config.age.secrets."${config.custom.profile}/forgejo/.env".path];
-        image = "codeberg.org/forgejo/forgejo:8";
-        restart = "unless-stopped";
-        volumes = ["${config.custom.containers.directory}/forgejo/data:/data"];
 
-        ports = [
+      settings.services = {
-          "127.0.0.1:3333:3000"
+        # https://codeberg.org/forgejo/forgejo
-          "22:2222"
+        # https://forgejo.org/docs/latest/admin/
-        ];
+        #?? docker exec -it forgejo bash
-      };
+        #?? sudo -u git forgejo admin user create --username USERNAME --random-password --email EMAIL --admin
+        forgejo.service = {
+          container_name = "forgejo";
+          depends_on = ["db"];
+          env_file = [config.age.secrets."${config.custom.profile}/forgejo/.env".path];
+          image = "codeberg.org/forgejo/forgejo:8";
+          restart = "unless-stopped";
+          volumes = ["${config.custom.containers.directory}/forgejo/data:/data"];
 
-      db.service = {
+          ports = [
-        container_name = "forgejo-db";
+            "127.0.0.1:3333:3000"
-        env_file = [config.age.secrets."${config.custom.profile}/forgejo/db.env".path];
+            "22:2222"
-        image = "postgres:15";
+          ];
-        restart = "unless-stopped";
+        };
-        volumes = ["${config.custom.containers.directory}/forgejo/db:/var/lib/postgresql/data"];
+
+        db.service = {
+          container_name = "forgejo-db";
+          env_file = [config.age.secrets."${config.custom.profile}/forgejo/db.env".path];
+          image = "postgres:15";
+          restart = "unless-stopped";
+          volumes = ["${config.custom.containers.directory}/forgejo/db:/var/lib/postgresql/data"];
+        };
       };
     };
   };

options/custom/containers/foundryvtt.nix

@@ -21,14 +21,18 @@ in {
     #?? arion-foundryvtt pull
     environment.shellAliases.arion-foundryvtt = "sudo arion --prebuilt-file ${config.virtualisation.arion.projects.foundryvtt.settings.out.dockerComposeYaml}";
 
-    virtualisation.arion.projects.foundryvtt.settings.services = {
+    virtualisation.arion.projects.foundryvtt = {
-      foundryvtt.service = {
+      serviceName = "foundryvtt";
-        container_name = "foundryvtt";
+
-        env_file = [config.age.secrets."${config.custom.profile}/foundryvtt/.env".path];
+      settings.services = {
-        image = "felddy/foundryvtt:12";
+        foundryvtt.service = {
-        ports = ["127.0.0.1:30000:30000"];
+          container_name = "foundryvtt";
-        restart = "unless-stopped";
+          env_file = [config.age.secrets."${config.custom.profile}/foundryvtt/.env".path];
-        volumes = ["${config.custom.containers.directory}/foundryvtt/data:/data"];
+          image = "felddy/foundryvtt:12";
+          ports = ["127.0.0.1:30000:30000"];
+          restart = "unless-stopped";
+          volumes = ["${config.custom.containers.directory}/foundryvtt/data:/data"];
+        };
       };
     };
   };

options/custom/containers/headscale.nix

@@ -22,35 +22,39 @@ in {
     #?? arion-headscale pull
     environment.shellAliases.arion-headscale = "sudo arion --prebuilt-file ${config.virtualisation.arion.projects.headscale.settings.out.dockerComposeYaml}";
 
-    virtualisation.arion.projects.headscale.settings.services = {
+    virtualisation.arion.projects.headscale = {
-      # https://headscale.net/
+      serviceName = "headscale";
-      # https://github.com/juanfont/headscale
-      # BUG: Does not support generic DoH/DoT
-      # https://github.com/juanfont/headscale/issues/1312
-      headscale.service = {
-        command = "serve";
-        container_name = "headscale";
-        env_file = [config.age.secrets."${config.custom.profile}/headscale/.env".path];
-        image = "headscale/headscale:v0.23.0-beta.4";
-        restart = "unless-stopped";
 
-        ports = [
+      settings.services = {
-          "9999:9999"
+        # https://headscale.net/
-          "9090:9090"
+        # https://github.com/juanfont/headscale
-        ];
+        # BUG: Does not support generic DoH/DoT
+        # https://github.com/juanfont/headscale/issues/1312
+        headscale.service = {
+          command = "serve";
+          container_name = "headscale";
+          env_file = [config.age.secrets."${config.custom.profile}/headscale/.env".path];
+          image = "headscale/headscale:v0.23.0-beta.4";
+          restart = "unless-stopped";
 
-        volumes = [
+          ports = [
-          "${config.custom.containers.directory}/headscale/config:/etc/headscale"
+            "9999:9999"
-          "${config.custom.containers.directory}/headscale/data:/var/lib/headscale"
+            "9090:9090"
+          ];
 
-          # Minimum config.yaml
+          volumes = [
-          # https://github.com/juanfont/headscale/blob/main/config-example.yaml
+            "${config.custom.containers.directory}/headscale/config:/etc/headscale"
-          # https://github.com/juanfont/headscale/blob/main/integration/hsic/config.go
+            "${config.custom.containers.directory}/headscale/data:/var/lib/headscale"
-          "${pkgs.writeText "config.yaml" ''
+
-            noise:
+            # Minimum config.yaml
-              private_key_path: /var/lib/headscale/noise_private.key
+            # https://github.com/juanfont/headscale/blob/main/config-example.yaml
-          ''}:/etc/headscale/config.yaml"
+            # https://github.com/juanfont/headscale/blob/main/integration/hsic/config.go
-        ];
+            "${pkgs.writeText "config.yaml" ''
+              noise:
+                private_key_path: /var/lib/headscale/noise_private.key
+            ''}:/etc/headscale/config.yaml"
+          ];
+        };
       };
     };
   };

options/custom/containers/homeassistant.nix

@@ -12,13 +12,17 @@ in {
     #?? arion-homeassistant pull
     environment.shellAliases.arion-homeassistant = "sudo arion --prebuilt-file ${config.virtualisation.arion.projects.homeassistant.settings.out.dockerComposeYaml}";
 
-    virtualisation.arion.projects.homeassistant.settings.services = {
+    virtualisation.arion.projects.homeassistant = {
-      homeassistant.service = {
+      serviceName = "homeassistant";
-        container_name = "homeassistant";
+
-        image = "homeassistant/home-assistant:2024.9.1";
+      settings.services = {
-        ports = ["8123:8123"];
+        homeassistant.service = {
-        restart = "unless-stopped";
+          container_name = "homeassistant";
-        volumes = ["${config.custom.containers.directory}/homeassistant/config:/config"];
+          image = "homeassistant/home-assistant:2024.9.1";
+          ports = ["8123:8123"];
+          restart = "unless-stopped";
+          volumes = ["${config.custom.containers.directory}/homeassistant/config:/config"];
+        };
       };
     };
   };

options/custom/containers/mastodon.nix

@@ -22,36 +22,40 @@ in {
     #?? arion-mastodon pull
     environment.shellAliases.arion-mastodon = "sudo arion --prebuilt-file ${config.virtualisation.arion.projects.mastodon.settings.out.dockerComposeYaml}";
 
-    virtualisation.arion.projects.mastodon.settings.services = {
+    virtualisation.arion.projects.mastodon = {
-      # https://github.com/linuxserver/docker-mastodon
+      serviceName = "mastodon";
-      # https://github.com/mastodon/mastodon/blob/main/docker-compose.yml
-      mastodon.service = {
-        container_name = "mastodon";
-        env_file = [config.age.secrets."${config.custom.profile}/mastodon/.env".path];
-        image = "lscr.io/linuxserver/mastodon:4.2.12";
-        ports = ["3000:443"];
-        restart = "unless-stopped";
-        volumes = ["${config.custom.containers.directory}/mastodon/config:/config"];
 
-        depends_on = [
+      settings.services = {
-          "cache"
+        # https://github.com/linuxserver/docker-mastodon
-          "db"
+        # https://github.com/mastodon/mastodon/blob/main/docker-compose.yml
-        ];
+        mastodon.service = {
-      };
+          container_name = "mastodon";
+          env_file = [config.age.secrets."${config.custom.profile}/mastodon/.env".path];
+          image = "lscr.io/linuxserver/mastodon:4.2.12";
+          ports = ["3000:443"];
+          restart = "unless-stopped";
+          volumes = ["${config.custom.containers.directory}/mastodon/config:/config"];
 
-      cache.service = {
+          depends_on = [
-        container_name = "mastodon-cache";
+            "cache"
-        image = "redis:latest";
+            "db"
-        restart = "unless-stopped";
+          ];
-        volumes = ["${config.custom.containers.directory}/mastodon/cache:/data"];
+        };
-      };
 
-      db.service = {
+        cache.service = {
-        container_name = "mastodon-db";
+          container_name = "mastodon-cache";
-        env_file = [config.age.secrets."${config.custom.profile}/mastodon/db.env".path];
+          image = "redis:latest";
-        image = "postgres:15";
+          restart = "unless-stopped";
-        restart = "unless-stopped";
+          volumes = ["${config.custom.containers.directory}/mastodon/cache:/data"];
-        volumes = ["${config.custom.containers.directory}/mastodon/db:/var/lib/postgresql/data"];
+        };
+
+        db.service = {
+          container_name = "mastodon-db";
+          env_file = [config.age.secrets."${config.custom.profile}/mastodon/db.env".path];
+          image = "postgres:15";
+          restart = "unless-stopped";
+          volumes = ["${config.custom.containers.directory}/mastodon/db:/var/lib/postgresql/data"];
+        };
       };
     };
   };

options/custom/containers/netbox/default.nix

@@ -24,59 +24,63 @@ in {
     environment.shellAliases.arion-netbox = "sudo arion --prebuilt-file ${config.virtualisation.arion.projects.netbox.settings.out.dockerComposeYaml}";
 
     # https://github.com/netbox-community/netbox-docker
-    # https://github.com/netbox-community/netbox-docker/blob/release/docker-compose.yml
+    virtualisation.arion.projects.netbox = {
-    virtualisation.arion.projects.netbox.settings.services = let
+      serviceName = "netbox";
-      netbox = {
-        container_name = "netbox";
-        depends_on = ["cache" "db"];
-        env_file = [config.age.secrets."${config.custom.profile}/netbox/.env".path];
-        image = "localhost/netbox"; # Built image
-        restart = "unless-stopped";
-        user = "unit:root";
-        volumes = ["${config.custom.containers.directory}/netbox/media:/opt/netbox/netbox/media"];
-      };
-    in {
-      netbox.service =
-        netbox
-        // {
-          ports = ["8585:8080"];
 
-          # https://github.com/netbox-community/netbox-docker/wiki/Using-Netbox-Plugins
+      # https://github.com/netbox-community/netbox-docker/blob/release/docker-compose.yml
-          #!! Context modifications require a rebuild
+      settings.services = let
-          #?? arion-netbox build --no-cache
+        netbox = {
-          build.context = "${./.}";
+          container_name = "netbox";
+          depends_on = ["cache" "db"];
+          env_file = [config.age.secrets."${config.custom.profile}/netbox/.env".path];
+          image = "localhost/netbox"; # Built image
+          restart = "unless-stopped";
+          user = "unit:root";
+          volumes = ["${config.custom.containers.directory}/netbox/media:/opt/netbox/netbox/media"];
+        };
+      in {
+        netbox.service =
+          netbox
+          // {
+            ports = ["8585:8080"];
+
+            # https://github.com/netbox-community/netbox-docker/wiki/Using-Netbox-Plugins
+            #!! Context modifications require a rebuild
+            #?? arion-netbox build --no-cache
+            build.context = "${./.}";
+          };
+
+        housekeeping.service =
+          netbox
+          // {
+            container_name = "netbox-housekeeping";
+            command = ["/opt/netbox/housekeeping.sh"];
+            depends_on = ["netbox"];
+          };
+
+        worker.service =
+          netbox
+          // {
+            container_name = "netbox-worker";
+            command = ["/opt/netbox/venv/bin/python" "/opt/netbox/netbox/manage.py" "rqworker"];
+            depends_on = ["netbox"];
+          };
+
+        cache.service = {
+          container_name = "netbox-cache";
+          command = ["sh" "-c" "valkey-server --requirepass $$REDIS_PASSWORD"];
+          env_file = [config.age.secrets."${config.custom.profile}/netbox/cache.env".path];
+          image = "docker.io/valkey/valkey:8.0";
+          restart = "unless-stopped";
         };
 
-      housekeeping.service =
+        db.service = {
-        netbox
+          container_name = "netbox-db";
-        // {
+          env_file = [config.age.secrets."${config.custom.profile}/netbox/db.env".path];
-          container_name = "netbox-housekeeping";
+          image = "docker.io/postgres:16";
-          command = ["/opt/netbox/housekeeping.sh"];
+          restart = "unless-stopped";
-          depends_on = ["netbox"];
+          volumes = ["${config.custom.containers.directory}/netbox/db:/var/lib/postgresql/data"];
         };
-
-      worker.service =
-        netbox
-        // {
-          container_name = "netbox-worker";
-          command = ["/opt/netbox/venv/bin/python" "/opt/netbox/netbox/manage.py" "rqworker"];
-          depends_on = ["netbox"];
-        };
-
-      cache.service = {
-        container_name = "netbox-cache";
-        command = ["sh" "-c" "valkey-server --requirepass $$REDIS_PASSWORD"];
-        env_file = [config.age.secrets."${config.custom.profile}/netbox/cache.env".path];
-        image = "docker.io/valkey/valkey:8.0";
-        restart = "unless-stopped";
-      };
-
-      db.service = {
-        container_name = "netbox-db";
-        env_file = [config.age.secrets."${config.custom.profile}/netbox/db.env".path];
-        image = "docker.io/postgres:16";
-        restart = "unless-stopped";
-        volumes = ["${config.custom.containers.directory}/netbox/db:/var/lib/postgresql/data"];
       };
     };
 

options/custom/containers/nextcloud.nix

@@ -22,56 +22,60 @@ in {
     #?? arion-nextcloud pull
     environment.shellAliases.arion-nextcloud = "sudo arion --prebuilt-file ${config.virtualisation.arion.projects.nextcloud.settings.out.dockerComposeYaml}";
 
-    virtualisation.arion.projects.nextcloud.settings.services = {
+    virtualisation.arion.projects.nextcloud = {
-      # https://github.com/nextcloud/docker
+      serviceName = "nextcloud";
-      nextcloud.service = {
-        container_name = "nextcloud";
-        env_file = [config.age.secrets."${config.custom.profile}/nextcloud/.env".path];
-        image = "nextcloud:29-apache";
-        ports = ["127.0.0.1:8181:80"];
-        restart = "unless-stopped";
 
-        volumes = [
+      settings.services = {
-          "${config.custom.containers.directory}/nextcloud/app:/var/www/html"
+        # https://github.com/nextcloud/docker
-          "${config.custom.containers.directory}/nextcloud/data:/var/www/html/data"
+        nextcloud.service = {
-        ];
+          container_name = "nextcloud";
+          env_file = [config.age.secrets."${config.custom.profile}/nextcloud/.env".path];
+          image = "nextcloud:29-apache";
+          ports = ["127.0.0.1:8181:80"];
+          restart = "unless-stopped";
 
-        depends_on = [
+          volumes = [
-          "db"
+            "${config.custom.containers.directory}/nextcloud/app:/var/www/html"
-          "cache"
+            "${config.custom.containers.directory}/nextcloud/data:/var/www/html/data"
-        ];
+          ];
-      };
 
-      cron.service = {
+          depends_on = [
-        container_name = "nextcloud-cron";
+            "db"
-        entrypoint = "/cron.sh";
+            "cache"
-        image = "nextcloud:29-apache";
+          ];
-        restart = "unless-stopped";
+        };
-        volumes =
-          config.virtualisation.arion.projects.nextcloud.settings.services.nextcloud.service.volumes; # volumes_from
 
-        depends_on = [
+        cron.service = {
-          "db"
+          container_name = "nextcloud-cron";
-          "cache"
+          entrypoint = "/cron.sh";
-        ];
+          image = "nextcloud:29-apache";
-      };
+          restart = "unless-stopped";
+          volumes =
+            config.virtualisation.arion.projects.nextcloud.settings.services.nextcloud.service.volumes; # volumes_from
 
-      cache.service = {
+          depends_on = [
-        container_name = "nextcloud-cache";
+            "db"
-        image = "redis:latest";
+            "cache"
-        restart = "unless-stopped";
+          ];
-        volumes = ["${config.custom.containers.directory}/nextcloud/cache:/data"];
+        };
-      };
 
-      db.service = {
+        cache.service = {
-        container_name = "nextcloud-db";
+          container_name = "nextcloud-cache";
-        env_file = [config.age.secrets."${config.custom.profile}/nextcloud/db.env".path];
+          image = "redis:latest";
-        image = "postgres:15";
+          restart = "unless-stopped";
-        restart = "unless-stopped";
+          volumes = ["${config.custom.containers.directory}/nextcloud/cache:/data"];
+        };
 
-        volumes = [
+        db.service = {
-          "${config.custom.containers.directory}/nextcloud/db:/var/lib/postgresql/data"
+          container_name = "nextcloud-db";
-        ];
+          env_file = [config.age.secrets."${config.custom.profile}/nextcloud/db.env".path];
+          image = "postgres:15";
+          restart = "unless-stopped";
+
+          volumes = [
+            "${config.custom.containers.directory}/nextcloud/db:/var/lib/postgresql/data"
+          ];
+        };
       };
     };
   };

options/custom/containers/redlib.nix

@@ -12,19 +12,23 @@ in {
     #?? arion-redlib pull
     environment.shellAliases.arion-redlib = "sudo arion --prebuilt-file ${config.virtualisation.arion.projects.redlib.settings.out.dockerComposeYaml}";
 
-    virtualisation.arion.projects.redlib.settings.services = {
+    virtualisation.arion.projects.redlib = {
-      redlib.service = {
+      serviceName = "redlib";
-        container_name = "redlib";
-        image = "quay.io/redlib/redlib:latest";
-        ports = ["127.0.0.1:8888:8080"];
-        restart = "unless-stopped";
 
-        environment = {
+      settings.services = {
-          REDLIB_DEFAULT_HIDE_HLS_NOTIFICATION = "on";
+        redlib.service = {
-          REDLIB_DEFAULT_SHOW_NSFW = "on";
+          container_name = "redlib";
-          REDLIB_DEFAULT_THEME = "dracula";
+          image = "quay.io/redlib/redlib:latest";
-          REDLIB_DEFAULT_USE_HLS = "on";
+          ports = ["127.0.0.1:8888:8080"];
-          REDLIB_DEFAULT_WIDE = "off";
+          restart = "unless-stopped";
+
+          environment = {
+            REDLIB_DEFAULT_HIDE_HLS_NOTIFICATION = "on";
+            REDLIB_DEFAULT_SHOW_NSFW = "on";
+            REDLIB_DEFAULT_THEME = "dracula";
+            REDLIB_DEFAULT_USE_HLS = "on";
+            REDLIB_DEFAULT_WIDE = "off";
+          };
         };
       };
     };

options/custom/containers/searxng/default.nix

@@ -21,29 +21,33 @@ in {
     #?? arion-searxng pull
     environment.shellAliases.arion-searxng = "sudo arion --prebuilt-file ${config.virtualisation.arion.projects.searxng.settings.out.dockerComposeYaml}";
 
-    virtualisation.arion.projects.searxng.settings.services = {
+    virtualisation.arion.projects.searxng = {
-      # https://github.com/searxng/searxng
+      serviceName = "searxng";
-      # https://github.com/searxng/searxng-docker
-      searxng.service = {
-        container_name = "searxng";
-        depends_on = ["cache"];
-        env_file = [config.age.secrets."${config.custom.profile}/searxng/.env".path];
-        image = "searxng/searxng:latest";
-        ports = ["127.0.0.1:8000:8080"];
-        restart = "unless-stopped";
 
-        volumes = [
+      settings.services = {
-          "${./limiter.toml}:/etc/searxng/limiter.toml"
+        # https://github.com/searxng/searxng
-          "${./settings.yml}:/etc/searxng/settings.yml"
+        # https://github.com/searxng/searxng-docker
-        ];
+        searxng.service = {
-      };
+          container_name = "searxng";
+          depends_on = ["cache"];
+          env_file = [config.age.secrets."${config.custom.profile}/searxng/.env".path];
+          image = "searxng/searxng:latest";
+          ports = ["127.0.0.1:8000:8080"];
+          restart = "unless-stopped";
 
-      # https://github.com/valkey-io/valkey
+          volumes = [
-      cache.service = {
+            "${./limiter.toml}:/etc/searxng/limiter.toml"
-        command = "valkey-server --save 60 1 --loglevel warning";
+            "${./settings.yml}:/etc/searxng/settings.yml"
-        container_name = "searxng-cache";
+          ];
-        image = "valkey/valkey:7-alpine";
+        };
-        restart = "unless-stopped";
+
+        # https://github.com/valkey-io/valkey
+        cache.service = {
+          command = "valkey-server --save 60 1 --loglevel warning";
+          container_name = "searxng-cache";
+          image = "valkey/valkey:7-alpine";
+          restart = "unless-stopped";
+        };
       };
     };
   };

options/custom/desktops/hyprland/settings.nix

@@ -139,7 +139,7 @@ in {
         "col.border_inactive" = "rgba(6c71c440)";
         "col.border_locked_active" = "rgb(d33682)";
         "col.border_locked_inactive" = "rgba(d3368240)";
-        #// auto_group = false;
+        auto_group = false;
         insert_after_current = false;
 
         # https://wiki.hyprland.org/Configuring/Variables/#groupbar

options/custom/programs/fish.nix

@@ -47,25 +47,19 @@ in {
           poweroff = "systemctl poweroff";
           shutdown = "systemctl poweroff";
 
+          backup = "borgmatic -v 1 create --progress --stats";
+          extract = "borgmatic -v 1 extract --progress";
+          init = "borgmatic init -e repokey-blake2";
+          key = "borgmatic key export";
+          list = "borgmatic -v 1 list";
+          restore = "borgmatic -v 1 restore";
+
           rsync = "rsync --info progress2";
 
           a = "adb";
           as = "adb shell";
           asa = "adb shell sh /sdcard/Android/data/com.llamalab.automate/cache/start.sh"; # Automate
 
-          b = "sudo borgmatic";
-          bb = "sudo borgmatic borg";
-          bc = "sudo borgmatic create --progress --stats";
-          be = "sudo borgmatic extract --progress";
-          bi = "sudo borgmatic init -e repokey-blake2";
-          bk = "sudo borgmatic key export";
-          bl = "sudo borgmatic list";
-          bm = "sudo borgmatic mount";
-          brl = "sudo borgmatic rlist";
-          br = "sudo borgmatic restore";
-          bt = "sudo borgmatic export-tar";
-          bu = "sudo borgmatic unmount";
-
           c = "clear";
           e = "exit";
           m = "mosh";

options/custom/services/borgmatic.nix

@@ -28,7 +28,6 @@ in {
 
       # https://torsion.org/borgmatic/docs/reference/configuration/
       settings = {
-        archive_name_format = "{now:%Y-%m-%d %H:%M:%S}"; # Remove hostname
         keep_daily = 7;
         keep_weekly = 4;
         keep_monthly = 1;
@@ -37,7 +36,9 @@ in {
         retry_wait = 60; # Additive seconds per retry
         compression = "auto,zstd"; # Use heuristics to decide whether to compress with zstd
         ssh_command = "ssh -i /etc/ssh/id_ed25519"; # !! Imperative key generation
-        encryption_passcommand = "${cat} ${config.age.secrets."${config.custom.profile}/borgmatic/borgbase".path}";
+        encryption_passcommand = "${cat} ${
+          config.age.secrets."${config.custom.profile}/borgmatic/borgbase.${config.custom.hostname}".path
+        }";
         repositories = cfg.repositories;
         source_directories = cfg.sources;
 
@@ -66,7 +67,7 @@ in {
     age.secrets = let
       secret = filename: {file = "${inputs.self}/secrets/${filename}";};
     in {
-      "${config.custom.profile}/borgmatic/borgbase" = secret "${config.custom.profile}/borgmatic/borgbase";
+      "${config.custom.profile}/borgmatic/borgbase.${config.custom.hostname}" = secret "${config.custom.profile}/borgmatic/borgbase.${config.custom.hostname}";
     };
   };
 }

secrets/common/tailscale/tailnet

@@ -1,17 +1,17 @@
 age-encryption.org/v1
--> ssh-ed25519 8E6j8Q jf86WwxzbtdGcWk7aZvGwKsAzQEwR1kQHTpvnwEEh3w
+-> ssh-ed25519 8E6j8Q WGq0X/29cBDG5XKrof9ZThTBP54wgYtNtWliauTZeBI
-JVYBOissoLVPXxttNS6Wd0n3XWTkdg9KR/rh6Bmy9lw
+Fq2goKdemSN0wp73esjvOEPpEMksPPw5JcytAxLaxZ8
--> ssh-ed25519 sfxzoQ aAEc8GQ5IM6PAwuhbPCOCBGVdKBNgXgMpZ+bNipTowQ
+-> ssh-ed25519 sfxzoQ mxciiI6swnkbLCdkdIUpF7g9xlEUhB0Ve/1CdBkXLFc
-CkCMmXWvAE+kfEQBSMjjznIXP/OPq+E9kxW/5Tx6YG0
+cdl7iV8alMwxmZf843YO/ZDLlTFD+Ek0ZYdLoj2QqlY
--> ssh-ed25519 BIBw2w YhiwU8G6gOx0bLz18zgxXQVra5WnQzlJgZ03bN5UHVc
+-> ssh-ed25519 BIBw2w esktLODxdL2EEoQdnt0QKkTCI7bORLXBITALvLnLeyA
-yr/M74vXLniDTWpkOy48vm7mINAx2IKmdOUBxe9oQWU
+gMKxLYZdZjmTxvxaRX+TJtnzDTK4olx7UJDWYSLmVbA
--> ssh-ed25519 g5GcDQ 2EuPbnU9TKMjuoh+FAOTz7x2GfpiEm0tYN7KFsjTVUs
+-> ssh-ed25519 g5GcDQ wO5BFahsUBF840ht5wGY3hgMqiMLeYvEX9LBFKeUKQI
-TTmx3iI71xufizHxG0Xep0WUtq3TAqZzjstLtJ2umbM
++Z5xCTbzh6BjWWiCO+VrKNAHau7an2sSKyg3WRN8yJ8
--> ssh-ed25519 T/dATA X6nel+VewJUwY1YpmQvCywHtWUItMkG+XFOFoLKay04
+-> ssh-ed25519 T/dATA 2Bu6U1h0dS2yBj2V4Rl5Jjt0Rj0pjPjMWZpZBx7RESg
-wdqsygZlAky9hyZEP5UikpU9zpEMLYuuCXL0a8IAoxk
+QRs/+Te7pJNw6HSHkVwVBF2wlzAqwKoR5iyOyiS/PvI
--> ssh-ed25519 kMNckw BuhVZ80+Eq4DgnlZfdeIAL0BXzIjNwrLkxkbrNYDpFI
+-> ssh-ed25519 kMNckw 7kk/Tp/8iigFhtmcfXBXgm91opyROVLmKwUUHnMWHHE
-Cndu2tG4fVFfWdtjPu+aQ1xD3r72lwOY+pfYu6MZjXY
+mjj+LnMPBruu54RBTRikQVQz1WcIH4k4AhsIqWmtTX0
--> ssh-ed25519 iw6hqg 5Bq9VBMvp+n/qub83UbfflqCPPtqIELBb88wcicjxlY
+-> ssh-ed25519 fEyKPw VnvJSr8LxV1HVq7a2U48GWQhxap0+x009Ys0k1+h1nU
-ApYy2SV4GDj+MYiYknNlsan59kLkrXO+pHnEva15yTg
+y6n3JJ8ZR741sktuAlwB1x1D1SooyHGdHHt1d8IntxU
---- C0yOWLx18EbGVTRY/RVYltyN3MXJUM5kfMoznhX0ivo
+--- y++IobSFLj4gcElykU/W7r2sZ0hQHYThL8P5Cr8l/PY
-Ü™gfS"Dúè;%rÒû;`8jMðŒì¸<C3AC>°×óˆ$±ÿBÛµÕÎN6F<46>K`GÒ"Œ
+ä~ŠšSÓEøœˆ7yO–GKÖ¸OZ:¿YjaMOÔÉ+ÃσC—ìçìr\<5C>½89ÈÃ

secrets/console/users/myned.pass

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 8E6j8Q uk25wbJOQFIE9f4AywO4sqDuclyW0Oc33hZvwspHMCg
+-> ssh-ed25519 8E6j8Q Zc51Xq32k0zcLmBhf5U5uVE0ueFlVuoJlX+F8svMcWg
-DHxrfnGl/FTaJtBckp7f5PA790JT8uNAUzEtDSVufos
+CwqIxWhp8Zktv0Psco5MwIUSHWb9gQvZoOFXAEGooVM
--> ssh-ed25519 sfxzoQ uH3I+U44vTOqT3hCtgoZrLf1dRYxqc4ZdwfGie86fl4
+-> ssh-ed25519 sfxzoQ 95lEiu7+r9CLCitBQXmv5WTHiTvao61M8Sby1ygcASU
-0FunAhyMgQ8WFq2yBFao6/OlvE6Bi5yz8m+9mG5n83A
+LYxDnOJP82Wtl90UTVHBu7Lw9ix4UXwXvRH2OGI0hes
--> ssh-ed25519 BIBw2w 7rWsYtFJXcWQetR9OoCbyt0G5N6mLkrQqFBBbPEYQGc
+-> ssh-ed25519 BIBw2w Y9dXk85Sc24I7wawvdMi+bcmok/4QdWU7NUmlUsUAyc
-/BYRlIRlp8l3CpWcexuiNvdIXxN0yyvwOio2YlNLcR0
+7E6aP4mArfaAUhwaxTtzMkrMs6BnmZFCvSRniyVoXdw
---- 3y/ivVt0wshO9v8K3NF8Acluzm3vnHkqU9LTxGW5GGk
+--- 6mnfJ4QZOBDTsVB82dCn8eNEYiwLEX09AjV/a9XAP9o
-ÛGè&<26><>¿hÇ#CêHAÙµ^PÓ$%=
<w÷"pó{ÑÙr,ÖmùzøR–¡ÈòWˆÍ(ÂN°ç†oήBò$N7<4E>¦pnN€³#úã—$çë<C3A7>Ák-æBp´±e
òuP£³Æ
+B娵亂鵺s<0C>ﾏ昇ﾏﾆﾉ<EFBE86><EFBE89><EFBFBD>ｵﾎqkU呱ｱM:<3A><>頂ﾑﾇﾅｵ鮻Zﾓﾚ8ｸﾒ1(ﾑ炅G<E78285>ﾜ與x<E88887><78>`Eﾌﾜ､ﾍ
u[3|qﾆb夘嫋$5､ﾉ<EFBDA4>瓢 蹼ﾇgV{

secrets/desktop/bitwarden/client_secret

@@ -1,11 +1,11 @@
 age-encryption.org/v1
--> ssh-ed25519 8E6j8Q 9/XAEOswfZGdcOq/37Q8fl2my6A1Z3pEIBImd5q5AiI
+-> ssh-ed25519 8E6j8Q jBMO/99RuISehUyoCcwpTDhHCuJU0ZVZF9lCzBUtg2Q
-8E1c0DX7Fo6PP26bK0aSTlgfyz5r6Q6eK/7wAHnUn7U
+QAciLwMDMmwd3SWHB0jJ3SK7Li1Bj0pGE/12QkCAN0Q
--> ssh-ed25519 sfxzoQ HLEkfZXE4QzO0Sx6rYNMQUoRnWFlIQADT/rVC1/uUyI
+-> ssh-ed25519 sfxzoQ ogDXW6qb8L9QWI5Tmi68lU27jfVDE7qr8yF6DIvPmBs
-NpxDrNjyxgiH1swH5eN6CVzZcQ62JcOaA3EvSVMbrVM
+nUDmMhpdd1or4HA2gRUV5iCoEg15Cem5ehDMZOIGbyA
--> ssh-ed25519 g5GcDQ 7DdGJYaIWWg/mdBAC3kI2aAqQS9quh3mNKXnZp+6ZwE
+-> ssh-ed25519 g5GcDQ YQJinIC0YUUiNWXRhO81zCOXLUVow29xZI8HDBPaaW4
-aExbAbXII0LlglI2ZD02TVCX/bwNpz2E5HvcWFWxhy8
+b9KLU7v7IzPXsxUdQw/1737HUFa8YFMgFfibjqKh1Y0
--> ssh-ed25519 T/dATA rNE4kD0otSqx3Ep5ldk7k/kkZKFvFYDQ7lEunN98SmI
+-> ssh-ed25519 T/dATA txfGP3naVimrtPzyOQDf3cA/4Z1bImJoLQlqTJPlzV4
-4vhzKswHh7cIa5SAiHR1aRxjZKroboeFey/9TDmKFhM
+tGnr0/p/KH1rXZfz/9MSY6RN0XTeslnf7eg6ShsF0Hc
---- naSlgfkmreMLriRJTiAlzdG9og5s43LQ8MV3bCPGh5E
+--- fMp/+rsSmJ9dh7eMagN6v7snjiWZq/jInVeyWz++kaw
-|<7C>Bb4Ûjˆ<04>Ю‡ÒáDÕCœq‚¯HþïKâ
Àµ¡<C2B5>$<24>VŽ”ܶ@ƒ<àúëq|5Â.Å^)4@ÚÕ
+hø ÙºŠõúÓ	‘Ö±vÁâH%x“úóâxÝöô–F“PåXúÔƒ$o#R`‘¢¯ŒL)ÉGWyÏv|bs

secrets/sbc/create_ap/ssid

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 8E6j8Q qdM2Rf/PoHS7Zs0LpQAEr5pEc4G9jHGZUDzEBc/e9yY
+-> ssh-ed25519 8E6j8Q eBSAWepYbY3v6gvrkkPFAkWItSsNI0KMU7XUp6omTmw
-oDn74ckYbNIt6iv+dqoSppYQlOI/X4RrfPbjvBtXYMw
+jhFiBIQUCTxMP6A349SjOe7shr1g8uDgfLnwS0KoTQ8
--> ssh-ed25519 sfxzoQ KDtcQO1AR/Kr18LlCM3sge2oF6FkAV2lEwTjvscXOT8
+-> ssh-ed25519 sfxzoQ NniUfTChtIN6hYjn9nyU5hDoO0er8OgJI8qbtgXJdR0
-nc+fjbMsCttZNLZlWmu+sAGWPMl1Swbn8BBGDrz9NqE
+/ZIcwDpoRVE7HckWyUBNttE4fxsDUuHCoL0IAri2IY4
--> ssh-ed25519 kMNckw KfIViI1UpHmQ3Eniak+9TavQ5xRbhJj8qaiQE0UYXlY
+-> ssh-ed25519 kMNckw Wgkk6woUFGbIsQ+4GmO4IYouyROKWCgYJpZyQNMFihA
-tCejs74W4GTdCt3miKQgs9zRblfxm212tS0068z95n8
+BOfBxs5xrPyIum+YxvXGq0CK+9HMzgxdbECzZ75F6qo
---- VZHPcNr19f9Mk+VJUlGmF/BFAEzPBWBQa0Iff5CqEhU
+--- ByHALf89ealwBGs6w9Rv4ku+UHPLbY5wJLuCIZpCRbU
-â<ü8V»Hln!
Ro%WÌG_£°D†M=*¾‘%O/
+”K@°Ñü(Ò‘£N ".¿cÔA†§"é 
 †S=†kA­ËèºÁÃ

secrets/sbc/users/myned.pass

@@ -1,11 +1,11 @@
 age-encryption.org/v1
--> ssh-ed25519 8E6j8Q bA32ozwutXBQ/2H3m7at9O/Gfsmu3dmJZbhkxPrOCDA
+-> ssh-ed25519 8E6j8Q w8WUcoqRugI5GwFzcwDCiTZJBeBk5naaw/inEKQwHTk
-eoWFyVDzxxFrk2xhz0fIyb1u8ZGE1o8+Wb8kisIJVic
+p7ZuZMrDqBzFGtrFzgg8F1n3/a3VrFrmOUoyK+4StIA
--> ssh-ed25519 sfxzoQ So4pMhmq1rBbLbZ5TdVj5ABgPNLWFFMsOLaPhhasdEY
+-> ssh-ed25519 sfxzoQ xuzuP3FcwA5nWKt2CDk/DVTzEazS3zp+XNZA19eqWGE
-82HhkzHtE6yHEIlEtXQClThNEKiDVAby0tdCVWJe5tQ
+7OeF2pZVrPgXgqEGsndwDyAuLHtI+EX2VnUVT5NnF4c
--> ssh-ed25519 kMNckw mOIazN7a5pJ7/z+vnoHMX1M1rk3sFc1Oh2QXRsvjIz8
+-> ssh-ed25519 kMNckw RYoe/cBKTCYil/4dsES4r0nOrJxaO9XbMbYiazoOeSI
-MrtznSiAbVLf5ZwhNMurfVBbTS4l5rMheluGQx6srSQ
+T5t9/SGZmKZbo6B0pprh/aNpFM20ZryysibshkJbnxE
---- HUHnLJ99Igkz9CzZM3vX1LrbgcZYioEr+Spdq3Mstsw
+--- veqh4r1ODD6xTPjHE3BZSJJqmEcYVs8VhqTlRcH12lg
-1ˆÎy}-ÜLáÉt
+ÒÐ?}Ÿ"ÉÐÿeØýo<C3BD><<ý¢9‡UŠGE’JŒÃ®¦º8ÂÕ<05>#];>«fŒõz®R
-û‚[/(r"›Ç„]°ïú7‹"ÿ03<07>)UÐ1uà(¬+Uï\»õ¾`J
+1ã’ªÀü.Ï»õ¹|§óÜ=û¦aèÉ<03>g
-gÓ’ð‰~A»<41>_…­‡WÛþŽ%5Š˜ŽxlBýÆWÚ}“ž”í%Zú¥Å+
+1öyÛlº£±çO·³ñP

secrets/secrets.nix

@@ -29,7 +29,7 @@ let
   ];
 
   servers = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAgrWvzp14Vj+aMd3b9w6e3/xbkHfNZoswsAg9QtUcDc root@myne"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDPlG7FWZ5Us4Ix5fGMHn2DJU1/ma/7kQu39cPKKQMXJ root@myarm"
   ];
 
   common = users ++ consoles ++ desktops ++ sbcs ++ servers;
@@ -65,7 +65,7 @@ in {
   "sbc/users/root.pass".publicKeys = sbc;
 
   ### Server
-  "server/borgmatic/borgbase".publicKeys = server;
+  "server/borgmatic/borgbase.myarm".publicKeys = server;
   "server/caddy/Caddyfile".publicKeys = server;
   "server/coturn/coturn.conf".publicKeys = server;
   "server/forgejo/.env".publicKeys = server;

secrets/server/borgmatic/borgbase.myarm

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 8E6j8Q xrvbTgTwyUl3TMj2FqjHXU8BD/Vdv3m6neBHvUHenkA
+fkqOe06bUTi1oPkwdK+MoQpG+u0/g098EppsvgSZPNE
+-> ssh-ed25519 sfxzoQ bLqMGk0GecuAPzvT6DdXQPTZvTGNwOuHeTYCI4wqiVs
+w/CfmvGZipntpLcNEh8cQ5q1QjRc/mcYZhq+5Wdmrk4
+-> ssh-ed25519 fEyKPw KXgvkZSllT7L1AQY0SV15mKLks+vKyrh7fwiAg7sFF0
+iXaZ7/rzCluo2acEfk66lFvlapazhDHM8Roq+uOr6Es
+--- Vj2nOYtxOlo9a9gJt75P1TVVLzmhPT5Ko7N5M31/YXA
+€F°&ÅRÚ½°•^x]Í6¡¬þ‘
+žÕVÜE—$£‹Ó½ –4¸]•Iè6Ô
+…

secrets/server/mastodon/db.env

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 8E6j8Q IUSkESGcFyING6GSrQlpQSYcJJ9aAjeB4Dtp1jxAzV4
+-> ssh-ed25519 8E6j8Q MsoA/cBAVEWTzonfCmI/66Oi8S/47AZtUEQlmAORdgo
-Mphi9EZNZRRDr0JRvRQw/YDVvqCujonnH6hVhD1m+HQ
+NVPWxOV4cXRIxQXtkpwPEMvy2aDc7DVr7ApNE6viarY
--> ssh-ed25519 sfxzoQ YCNUpEeRyODxDEOB3IRiyCJHqFSxC4DOJSRyvKChpXQ
+-> ssh-ed25519 sfxzoQ juVgUyBHUKT5tb1ZfzuZpij9I4AkscZQq7WsdVDZYE0
-IG0RBLuphWgQD37wYQPRcZuw/1V4xRRL2C6WJwNosbY
+5eDZjmkzJTOqKlvqVr6xDg16R7cd1E3W8DwwaRqnvHw
--> ssh-ed25519 iw6hqg 28e2FqcU4qmpzCpef6vOearGv/v2pLAIEl8rKxPoJDA
+-> ssh-ed25519 fEyKPw BlNMN0xeAKYqxYxwB2XTgg9qLZNVajd32HL/kgqZq1Q
-4X7MKOFfS0w5Gwz5Sahvl2wevmI5TBA2JJptHDoip3o
+045aAtmM83csNCpNI0NgpnjsaA94fXFBN7iAM/iGwHU
---- tBaFFYRxG+rxgptY0Ud3baYuQAq8EKAZ60+s5Pj/Isg
+--- S5m6cti6BKq8xm9iED6Vemdw8IX97g/5wOYrVsFo6Vw
-y>-Š>ôN€Ê—;ýÆ	2îå°E­_H‰Õîús@ðº´_z‡Õ¢~¦âNÀÃoËÔ_T±>“MÜb¤0ט¨„ñ<E2809E>Ì!Ä ¼7ˆ;;ëö€w:¥ç5äÏøÿ¨ìÖ­3Ò±Àš!
+=Ôë<11>áyÅæBXq:XÎjá:«ÿã%q
P‡
<0A>JYOyújm|Ä<0F>"~®u<<3C>‰e£«yð#m“j:5¨!ˆA×W/ÑC¾É‡`l³OÃs“59®DÝçWÍQG³ãžS¬¤ÖÓkÝ

secrets/server/users/myned.pass

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 8E6j8Q t+N18Bvdi6ifpBh6WVAzwmq/NZuNWQFe2sUAqa0PFhA
+-> ssh-ed25519 8E6j8Q gXAQbeuawSxnJ1kH55dABXygbh/xtjoAdpBCGgeNck8
-bDPDSPENggEkfGTDqBgmP6a/7ZtOvoC3dAsbR9Iumcg
+EfUQ4m+C6kJ7RyajNQN5/nA56WW6fEarTUjRj1O1018
--> ssh-ed25519 sfxzoQ QpOw4kgXb6qPk/ZjRqb5rNZKn/doJUSfYuKeauiZKFs
+-> ssh-ed25519 sfxzoQ PqVDfFVuRkURQvPc2ycnnU591geuK1FSi4WU6nVQKFQ
-SiYN8xRLPcyOalJ4Aw1MTtq8UoJGBDxCdRjJ4R34afU
+q9ZALua6toEt3QfRrr+WEd2DkyNg0lKRf398BBMqey0
--> ssh-ed25519 iw6hqg 1VUUszNoSU6VCPG7MtEPgriTLvBHL36HKhJskzSOgWI
+-> ssh-ed25519 fEyKPw 91E+SqBUNOJ75TrFEggr0nIWg2pMuZgWiSqh4//Y/jk
-sI8P4v2VJyqEdm1mmmcV6zak+a0vfFZnOnH2s8i2za8
+yWC5XfUa/UCijo+Dm/9yKnoPoA+HSieHJMc38zYEZHI
---- +9nCRrInPL79KWQeb1NPjETyQ/8JcsOV4MamsEO10uQ
+--- wtARYv4Q4nvS36EX4HtQzwX4grgPw1J84Ljvg48Bv0c
-Ëu,d<>Ěť¸aÂ9b#*í
0´|m]věvßÄáúÝ—ÉáHJo‚>U⤑×H‰{.><1C>üł‹9ź¤u^7ä蝀e,§·pTg˙…·ÜV©ôłĆbeĐçŘűřůH<óĚ&F@Ô$fv
+¢¯Û-.Xæ<58>|¦½ÑX~¢ºÅ!©ºn„ž8rZŸÔ³3Wë- <20>×щh<E280B0>ó0
¨K1Iæ¥\„ÞÎ.ŠŽ]¢‚º±Ô^XÑÙëm´ÞÔþUiq®jO®…w<Ï°HÑ
<óöí«Z¾2¯

secrets/server/users/root.pass

@@ -1,11 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 8E6j8Q 52z13TdgikuW8OSLj5V2k82rLd/JPgmcP+TJdhcw5XA
+-> ssh-ed25519 8E6j8Q 3wQ9vi56qeTLVAn0CrnMNbU9fMb8m6JEK0Y3Y7LAtnc
-KT07+bT6LqL//7+qe5MjGg4shxmxTlG25VyG8BOx4eo
+KMtukbBQvOuec9CnWjFlNmBFju+i1Yr+BA86wl5G+HQ
--> ssh-ed25519 sfxzoQ DSjiWUc/fJWxPRw/DDn91kzLBa98Xv9/4vXFA7LmFhE
+-> ssh-ed25519 sfxzoQ j+QkWOeBHSkwvxwFefpG3mKZbpy/rE0WRP9ZCyIWfQM
-+ynfjS70e6ZM7cN7w7WZs0db8Wr3hpDaU1LXL2GAXqA
+nMGvr3aivDlqRg/NFSwzlFBUxehuSTzLZdpbWhiOAEA
--> ssh-ed25519 iw6hqg cMKqC5xWs81i3ClGZjv3w8TXOq1mhcHVb8kn4/NFFTk
+-> ssh-ed25519 fEyKPw eTGlDsXmDKuHG4/wu5UPz/MKTQ+dF1XzKSlEIrjxAU8
-VNO7raXst/0wZCTL1T0nHX/hVdVSp2+3mB2+4fHQ4kw
+zy73tdCmomqVjGu8iG1Pa/6XA4R5U5g4TRRVV5GFnrc
---- EyslIKZFTtI2hgoWVk8XPWSueMHYlnzCtFV9NkmlrKg
+--- eK8BlTPjlQIZB7j7TiuUJJFkiLHNFnQqRDRzklc/bCk
-Òú”!}F9’Q
+<EFBFBD>ÞËï"öβàãÕ%Õæ§À‚Üf4ß,_{T…»œÌDšiˆž³óËr¬¼Í\Â<>®.wDxeU¨ŒÐAX6ç5öfªÜ-:_Nã„Z3§LxéªeUpÝØÿî¨îóÀÇŠC\ïÜÏrÉÙÛ†ƒ
-‚Æäé¤Ó¢—ul7ðX²úZ¤Õç-’ØÉ¡@žšá©ž_ý4’®¾8.™ÎþE‹tì¡[žÇ˜TþË&(ûÛ<C3BB>eÂñ;å»Ó6j
-<EFBFBD>z<EFBFBD>3¨«TW ;¶Ÿ©P¨Î»ÙDzÁ×