.just/machine.just

@@ -7,6 +7,5 @@
 [doc('Update the target machine')]
 [no-exit-message]
 @update machine:
-    cd .. && just vars _check {{ machine }}
     just assert '-d "../systems/x86_64-linux/{{ machine }}"' "Machine {{ machine }} does not exist, must be one of: $(ls ../systems/x86_64-linux/ | sed ':a;N;$!ba;s/\n/, /g')"
     nixos-rebuild switch -L --sudo --target-host {{ machine }} --build-host {{ machine }} --flake ..#{{ machine }} --log-format internal-json -v |& nom --json

.just/vars.just

@@ -23,7 +23,7 @@ edit machine:
 
     echo "Done"
 
-[doc('Get var by {key} from {machine}')]
+[doc('Get var value by {key} of {machine}')]
 get machine key:
     sops decrypt {{ base_path }}/{{ machine }}/secrets.yml | yq ".$(echo "{{ key }}" | sed -E 's/\//./g')"
 
@@ -38,52 +38,25 @@ remove machine key:
 
 [script]
 check:
-    cd ..
-
     for machine in $(ls {{ base_path }}); do
-         just vars _check "$machine"
+        [ -f "{{ base_path }}/$machine/secrets.yml" ] || continue
+        [ -f "{{ base_path }}/$machine/default.nix" ] || continue
+
+        echo "Processing $machine"
+
+        mapfile -t missing < <(jq -nr \
+            --rawfile defined <(nix eval --json --apply 'builtins.attrNames' ..#nixosConfigurations.$machine.config.sops.secrets 2>/dev/null) \
+            --rawfile configured <(sops decrypt {{ base_path }}/$machine/secrets.yml | yq '.') \
+            '
+                $defined | fromjson as $def
+                | $configured
+                | fromjson
+                | paths(scalars)
+                | join("/")
+                | select(. | IN($def[]) | not)
+            ')
+
+        if (( ${#missing[@]} > 0 )); then
+            printf 'missing the following %d secret(s):\n%s\n\n' "${#missing[@]}" "$(printf -- '- %s\n' "${missing[@]}")"
+        fi
     done
-
-[no-exit-message]
-[script]
-_check machine:
-    # If the default nix file is missing,
-    # we can skip this folder as we are
-    # missing the files used to compare
-    # the defined vs the configured secrets
-    if [ ! -f "{{ base_path }}/{{ machine }}/default.nix" ]; then
-        printf "\r• %-8sskipped\n" "{{ machine }}"
-        exit 0
-    fi
-
-    exec 3< <(jq -nr \
-        --rawfile defined <(nix eval --json ..#nixosConfigurations.{{ machine }}.config.sops.secrets 2>/dev/null) \
-        --rawfile configured <([ -f "{{ base_path }}/{{ machine }}/secrets.yml" ] && sops decrypt {{ base_path }}/{{ machine }}/secrets.yml | yq '.' || echo "{}") \
-        '
-            [ $configured | fromjson | paths(scalars) | join("/") ] as $conf
-            | $defined
-            | fromjson
-            | map(.key | select(. | IN($conf[]) | not))
-            | unique
-            | .[]
-        ')
-
-    pid=$! # Process Id of the previous running command
-    spin='⠇⠋⠙⠸⢰⣠⣄⡆'
-
-    i=0
-    while kill -0 $pid 2>/dev/null
-    do
-    i=$(( (i+1) %${#spin} ))
-    printf "\r${spin:$i:1} %s" "{{ machine }}"
-    sleep .1
-    done
-
-    mapfile -t missing <&3
-
-    if (( ${#missing[@]} > 0 )); then
-        printf '\r✗ %-8smissing %d secret(s):\n%s\n' "{{ machine }}" "${#missing[@]}" "$(printf -- '    %s\n' "${missing[@]}")"
-        exit 1
-    else
-        printf "\r✓ %-8sup to date\n" "{{ machine }}"
-    fi

modules/nixos/services/communication/matrix/default.nix

@@ -15,7 +15,6 @@
   port = 4001;
 
   database = "synapse";
-  keyFile = "/var/lib/element-call/key";
 in {
   options.${namespace}.services.communication.matrix = {
     enable = mkEnableOption "Matrix server (Synapse)";
@@ -27,6 +26,8 @@ in {
       # virtualisation.podman.enable = true;
     };
 
+    networking.firewall.allowedTCPPorts = [4001];
+
     services = {
       matrix-synapse = {
         enable = true;
@@ -54,27 +55,8 @@ in {
           password_config.enabled = true;
           backchannel_logout_enabled = true;
 
-          # Element Call options
-          max_event_delay_duration = "24h";
-          rc_message = {
-            per_second = 0.5;
-            burst_count = 30;
-          };
-          rc_delayed_event_mgmt = {
-            per_second = 1;
-            burst_count = 20;
-          };
-          turn_uris = ["turn:turn.${domain}:4004?transport=udp" "turn:turn.${domain}:4004?transport=tcp"];
-
           experimental_features = {
-            # MSC2965: OAuth 2.0 Authorization Server Metadata discovery
             msc2965_enabled = true;
-
-            # MSC3266: Room summary API. Used for knocking over federation
-            msc3266_enabled = true;
-            # MSC4222 needed for syncv2 state_after. This allow clients to
-            # correctly track the state of the room.
-            msc4222_enabled = true;
           };
 
           sso = {
@@ -199,180 +181,33 @@ in {
 
       caddy = {
         enable = true;
-        # globalConfig = ''
-        #   layer4 {
-        #           127.0.0.1:4004
-        #               route {
-        #                   proxy {
-        #                       upstream synapse:4004
-        #                   }
-        #               }
-        #           }
-        #           127.0.0.1:4005
-        #               route {
-        #                   proxy {
-        #                       upstream synapse:4005
-        #                   }
-        #               }
-        #           }
-        #       }
-        # '';
         virtualHosts = let
           server = {
             "m.server" = "${fqn}:443";
           };
           client = {
             "m.homeserver".base_url = "https://${fqn}";
-            "m.identity_server".base_url = "https://auth.${domain}";
+            "m.identity_server".base_url = "https://auth.kruining.eu";
-            "org.matrix.msc3575.proxy".url = "https://${domain}";
-            "org.matrix.msc4143.rtc_foci" = [
-              {
-                type = "livekit";
-                livekit_service_url = "https://${domain}/livekit/jwt";
-              }
-            ];
           };
         in {
-          "${domain}, darkch.at".extraConfig = ''
+          "${domain}".extraConfig = ''
-            # Route for lk-jwt-service
-            handle /livekit/jwt* {
-              uri strip_prefix /livekit/jwt
-              reverse_proxy http://[::1]:${toString config.services.lk-jwt-service.port} {
-                header_up Host {host}
-                header_up X-Forwarded-Server {host}
-                header_up X-Real-IP {remote_host}
-                header_up X-Forwarded-For {remote_host}
-              }
-            }
-
-            handle_path /livekit/sfu* {
-              reverse_proxy http://[::1]:${toString config.services.livekit.settings.port} {
-                header_up Host {host}
-                header_up X-Forwarded-Server {host}
-                header_up X-Real-IP {remote_host}
-                header_up X-Forwarded-For {remote_host}
-              }
-            }
-
             header /.well-known/matrix/* Content-Type application/json
             header /.well-known/matrix/* Access-Control-Allow-Origin *
             respond /.well-known/matrix/server `${toJSON server}`
             respond /.well-known/matrix/client `${toJSON client}`
           '';
           "${fqn}".extraConfig = ''
-            reverse_proxy /_matrix/* http://::1:${toString port}
+            reverse_proxy /_matrix/* http://::1:4001
-            reverse_proxy /_synapse/client/* http://::1:${toString port}
+            reverse_proxy /_synapse/client/* http://::1:4001
           '';
         };
       };
-
-      livekit = {
-        enable = true;
-        openFirewall = true;
-        inherit keyFile;
-
-        settings = {
-          port = 4002;
-          room.auto_create = false;
-        };
-      };
-
-      lk-jwt-service = {
-        enable = true;
-        port = 4003;
-        # can be on the same virtualHost as synapse
-        livekitUrl = "wss://${domain}/livekit/sfu";
-        inherit keyFile;
-      };
-
-      coturn = rec {
-        enable = true;
-        listening-port = 4004;
-        tls-listening-port = 40004;
-        no-cli = true;
-        no-tcp-relay = true;
-        min-port = 50000;
-        max-port = 50100;
-        use-auth-secret = true;
-        static-auth-secret-file = config.sops.secrets."coturn/secret".path;
-        realm = "turn.${domain}";
-        # cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
-        # pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
-        extraConfig = ''
-          # for debugging
-          verbose
-          # ban private IP ranges
-          no-multicast-peers
-          denied-peer-ip=0.0.0.0-0.255.255.255
-          denied-peer-ip=10.0.0.0-10.255.255.255
-          denied-peer-ip=100.64.0.0-100.127.255.255
-          denied-peer-ip=127.0.0.0-127.255.255.255
-          denied-peer-ip=169.254.0.0-169.254.255.255
-          denied-peer-ip=172.16.0.0-172.31.255.255
-          denied-peer-ip=192.0.0.0-192.0.0.255
-          denied-peer-ip=192.0.2.0-192.0.2.255
-          denied-peer-ip=192.88.99.0-192.88.99.255
-          denied-peer-ip=192.168.0.0-192.168.255.255
-          denied-peer-ip=198.18.0.0-198.19.255.255
-          denied-peer-ip=198.51.100.0-198.51.100.255
-          denied-peer-ip=203.0.113.0-203.0.113.255
-          denied-peer-ip=240.0.0.0-255.255.255.255
-          denied-peer-ip=::1
-          denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
-          denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
-          denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
-          denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
-          denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-          denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-          denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-        '';
-      };
-    };
-
-    networking.firewall = {
-      allowedTCPPortRanges = [];
-      allowedTCPPorts = [
-        # Synapse
-        port
-
-        # coTURN ports
-        config.services.coturn.listening-port
-        config.services.coturn.alt-listening-port
-        config.services.coturn.tls-listening-port
-        config.services.coturn.alt-tls-listening-port
-      ];
-      allowedUDPPortRanges = with config.services.coturn;
-        lib.singleton {
-          from = min-port;
-          to = max-port;
-        };
-      allowedUDPPorts = [
-        # coTURN ports
-        config.services.coturn.listening-port
-        config.services.coturn.alt-listening-port
-      ];
-    };
-
-    systemd = {
-      services.livekit-key = {
-        before = ["lk-jwt-service.service" "livekit.service"];
-        wantedBy = ["multi-user.target"];
-        path = with pkgs; [livekit coreutils gawk];
-        script = ''
-          echo "Key missing, generating key"
-          echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${keyFile}"
-        '';
-        serviceConfig.Type = "oneshot";
-        unitConfig.ConditionPathExists = "!${keyFile}";
-      };
-      services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = "${domain}";
     };
 
     sops = {
       secrets = {
         "synapse/oidc_id" = {};
         "synapse/oidc_secret" = {};
-        "coturn/secret" = {};
       };
 
       templates = {
@@ -387,19 +222,13 @@ in {
                 scopes:
                   - openid
                   - profile
-                  - email
-                  - offline_access
                 client_id: '${config.sops.placeholder."synapse/oidc_id"}'
                 client_secret: '${config.sops.placeholder."synapse/oidc_secret"}'
                 backchannel_logout_enabled: true
-                user_profile_method: userinfo_endpoint
-                allow_existing_users: true
-                enable_registration: true
                 user_mapping_provider:
                   config:
                     localpart_template: "{{ user.preferred_username }}"
                     display_name_template: "{{ user.name }}"
-                    email_template: "{{ user.email }}"
           '';
           restartUnits = ["matrix-synapse.service"];
         };

modules/nixos/services/games/minecraft.nix

@@ -1,16 +1,11 @@
-{
+{ inputs, config, lib, pkgs, namespace, ... }:
-  inputs,
+let
-  config,
-  lib,
-  pkgs,
-  namespace,
-  ...
-}: let
   inherit (lib) mkIf mkEnableOption mkOption;
   inherit (lib.types) str;
 
   cfg = config.${namespace}.services.games.minecraft;
-in {
+in
+{
   imports = [
     inputs.nix-minecraft.nixosModules.minecraft-servers
   ];
@@ -30,7 +25,7 @@ in {
   };
 
   config = mkIf cfg.enable {
-    users.users.${cfg.user} = {
+    user.users.${cfg.user} = {
       isSystemUser = true;
       group = cfg.group;
     };
@@ -82,7 +77,7 @@ in {
             inherit whitelist;
             inherit jvmOpts;
 
-            package = pkgs.fabricServers.fabric-1_21_4.override {loaderVersion = "0.16.10";};
+            package = pkgs.fabricServers.fabric-1_21_4.override { loaderVersion = "0.16.10"; };
 
             serverProperties = {
               gamemode = "survival";
@@ -108,14 +103,8 @@ in {
               inherit (pkgs) linkFarmFromDrvs fetchurl;
             in {
               mods = linkFarmFromDrvs "mods" (attrValues {
-                FabricApi = fetchurl {
+                FabricApi = fetchurl { url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/ZNwYCTsk/fabric-api-0.118.0%2B1.21.4.jar"; sha512 = "1e0d31b6663dc2c7be648f3a5a9cf7b698b9a0fd0f7ae16d1d3f32d943d7c5205ff63a4f81b0c4e94a8997482cce026b7ca486e99d9ce35ac069aeb29b02a30d"; };
-                  url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/ZNwYCTsk/fabric-api-0.118.0%2B1.21.4.jar";
+                Terralith = fetchurl { url = "https://cdn.modrinth.com/data/8oi3bsk5/versions/MuJMtPGQ/Terralith_1.21.x_v2.5.8.jar"; sha512 = "f862ed5435ce4c11a97d2ea5c40eee9f817c908f3223b5fd3e3fff0562a55111d7429dc73a2f1ca0b1af7b1ff6fa0470ed6efebb5de13336c40bb70fb357dd60"; };
-                  sha512 = "1e0d31b6663dc2c7be648f3a5a9cf7b698b9a0fd0f7ae16d1d3f32d943d7c5205ff63a4f81b0c4e94a8997482cce026b7ca486e99d9ce35ac069aeb29b02a30d";
-                };
-                Terralith = fetchurl {
-                  url = "https://cdn.modrinth.com/data/8oi3bsk5/versions/MuJMtPGQ/Terralith_1.21.x_v2.5.8.jar";
-                  sha512 = "f862ed5435ce4c11a97d2ea5c40eee9f817c908f3223b5fd3e3fff0562a55111d7429dc73a2f1ca0b1af7b1ff6fa0470ed6efebb5de13336c40bb70fb357dd60";
-                };
                 # DistantHorizons = fetchurl { url = "https://cdn.modrinth.com/data/uCdwusMi/versions/jptcCdp2/DistantHorizons-2.2.1-a-1.20.4-forge-fabric.jar"; sha512 = "47368d91099d0b5f364339a69f4e425f8fb1e3a7c3250a8b649da76135e68a22f1a76b191c87e15a5cdc0a1d36bc57f2fa825490d96711d09d96807be97d575d"; };
               });
             };
@@ -136,7 +125,7 @@ in {
             inherit whitelist;
             inherit jvmOpts;
 
-            package = pkgs.fabricServers.fabric-1_19_2.override {loaderVersion = "0.16.9";};
+            package = pkgs.fabricServers.fabric-1_19_2.override { loaderVersion = "0.16.9"; };
 
             serverProperties = {
               gamemode = "survival";
@@ -158,31 +147,24 @@ in {
               inherit (lib) concatMapAttrs;
 
               readDirRec = src: dir: fn:
-                concatMapAttrs (
+                concatMapAttrs (name: type: if type == "directory"
-                  name: type:
+                  then (readDirRec src "${dir}/${name}" fn)
-                    if type == "directory"
+                  else { "${dir}/${name}" = (fn "${dir}/${name}"); }
-                    then (readDirRec src "${dir}/${name}" fn)
-                    else {"${dir}/${name}" = fn "${dir}/${name}";}
                 ) (readDir "${src}/${dir}");
 
               copyDir = dir: readDirRec src dir (x: "${src}/${x}");
-            in
+            in {
-              {
+              "ops.json" = {
-                "ops.json" = {
+                value = ops;
-                  value = ops;
+              };
-                };
+            }
-              }
+            // (copyDir "config");
-              // (copyDir "config");
 
             symlinks = let
               inherit (builtins) attrNames readDir map;
               inherit (pkgs) linkFarm;
 
-              linkFarmFromDir = name: dir:
+              linkFarmFromDir = name: dir: linkFarm name (map (x: { name = x; path = "${src}/${dir}/${x}"; }) (attrNames (readDir "${src}/${dir}")));
-                linkFarm name (map (x: {
-                  name = x;
-                  path = "${src}/${dir}/${x}";
-                }) (attrNames (readDir "${src}/${dir}")));
             in {
               Deftu = linkFarmFromDir "tekxit-deftu" "Deftu";
               TKXAddons = linkFarmFromDir "tekxit-TKXAddons" "TKXAddons";

modules/nixos/services/games/palworld.nix

@@ -0,0 +1,25 @@
+{ config, lib, namespace, ... }:
+let
+  inherit (lib) mkIf mkEnableOption;
+
+  cfg = config.${namespace}.services.games.palworld;
+in
+{
+  options.${namespace}.services.games.palworld = {
+    enable = mkEnableOption "Palworld";
+  };
+
+  config = mkIf cfg.enable {
+#     kaas = (pkgs.mkSteamServer rec {
+#       name = "Palworld";
+#       src = pkgs.fetchSteam {
+#         inherit name;
+#         appId = "2394010";
+#         hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+#       };
+#
+#       sartCmd = "PalServer.sh";
+#       hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+#     });
+  };
+}

modules/nixos/services/games/palworld/default.nix

@@ -1,30 +0,0 @@
-{
-  config,
-  lib,
-  namespace,
-  ...
-}: let
-  inherit (lib) mkIf mkEnableOption;
-
-  cfg = config.${namespace}.services.games.palworld;
-in {
-  options.${namespace}.services.games.palworld = {
-    enable = mkEnableOption "Palworld";
-  };
-
-  config = mkIf cfg.enable {
-    #     kaas = (pkgs.mkSteamServer rec {
-    #       name = "Palworld";
-    #       src = pkgs.fetchSteam {
-    #         inherit name;
-    #         appId = "2394010";
-    #         hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-    #       };
-    #
-    #       sartCmd = "PalServer.sh";
-    #       hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-    #     });
-
-    sops.secrets."palworld/password" = {};
-  };
-}

modules/nixos/services/observability/grafana/default.nix

@@ -30,10 +30,6 @@ in {
             domain = "ulmo";
           };
 
-          security = {
-            secret_key = "$__file{${config.sops.secrets."grafana/secret_key".path}}";
-          };
-
           auth = {
             disable_login_form = false;
             oauth_auto_login = true;
@@ -137,10 +133,6 @@ in {
 
     sops = {
       secrets = {
-        "grafana/secret_key" = {
-          owner = "grafana";
-          group = "grafana";
-        };
         "grafana/oidc_id" = {
           owner = "grafana";
           group = "grafana";

systems/x86_64-linux/aule/secrets.yml

@@ -1,33 +0,0 @@
-sops:
-    age:
-        - recipient: age19qfpf980tadguqq44zf6xwvjvl428dyrj46ha3n6aeqddwhtnuqqml7etq
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZMC9nRjVFWnZlMHJJK0Nl
-            dWFTR0FCUGNBYXIrUHlIUUphZll2QU9IOEZrCitFS3JvK3hYYmpEZ05aRStpdUd1
-            L3JjNDl1Z2hQQ3FuNUZNM1hCRUtQUG8KLS0tIEg4VVEvVjZYN3JHSXljQW1xS3E4
-            eVpyM1lSWExndlZhMkw2Vis4dVhjSVUKbk+z1h3Hb1A6SEbZ3g5vYui/FfkMyfxx
-            Zm67JenYittHvQggTIErAgJatTocfVB6Zy4FqJtPCOevTVrRTRkwAg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ewes0f5snqx3sh5ul6fa6qtxzhd25829v6mf5rx2wnheat6fefps5rme2x
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtOGJXWi9vUzdFbkx2NmVa
-            YnhITlNMc1RRRXoyOFNPN1B4VWQ5ZDUwNDFBCnVmdDFyUnptekxhOUlwdVcyRjFI
-            cHRSRkoyWnFVUDJMcXpVcmM5bjRKMkkKLS0tIDROWXR1UFFUa0NxcUtkdEwxQ2Vl
-            OW50OE9RMWpyT1AvS0QzZ3JVNDViYlkK77H0Uq3eRy0CHgH4bhdo7FVEJpKeR/DB
-            KZonll74qqsyW4n+hIbIybjaqtF3RBN4kj5ARuIGFmH8sAl6jSyHXA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1jmrmdw4kmjeu9d6z74r2unqt7wpgsx24vqejmdjretsnsn8g4drsl3m98w
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZOURoRmk4QldEZExTRDYx
-            cXluYkg4OUFUNDNrQUNiNWRwKzhEQkdaemxzCnM3b25GYm5TM3NuNnBsVWRmQzNL
-            bTRabmx2UzBkN1dadlhwajN5RDIxVW8KLS0tIDhSQ1o4RGZBdlVHaHRKQWFyazU0
-            N0lnMjMvREpmNWZvTUdiT0tjMk4vTk0KmIN1a3gjmFzaEwJBu41sw5Z61UgiO5fc
-            /pkS22BeVonuB12SmJX+77A1CxFz1EwM8HSShFKlpN2hPCJFJL7Nng==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-25T07:59:24Z"
-    mac: ENC[AES256_GCM,data:64AkqWb97nUciWtOOHP/SZhUeo/5ahxa0cN14ILw/jmToFkn8uDrSfY8/ibqBB0mmfhwGzcnI/5QpCLVzCSgG1J68bdPeSsYTZPwy2/0S0ven+GeqYHMfJ2Q1eJE7TONyOEvSdYdUWG+ff5t0qhSet9F2BgFnMSKcNeAaxIY6KU=,iv:aMQXbKk8oKSLBHIZyJLJahu5HHEMysmhcgfpDdZG+Ak=,tag:hqBVXis8MdqRorxttYeQaw==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.11.0

systems/x86_64-linux/ulmo/secrets.yml

@@ -4,7 +4,7 @@ email:
 zitadel:
     masterKey: ENC[AES256_GCM,data:4MPvBo407qrS7NF4oUTf84tZoPkSRmiHdD7qpkYeHME=,iv:H2NIAN0xBUDqnyco9gA3zYAsKtSeA/JpqYrPhc1eqc0=,tag:6OFGDfsucG5gDerImgpuXA==,type:str]
     nix: {}
-    users: ENC[AES256_GCM,data:w/2Vdq0EHXaJ5u/aA/reSCtwRHreWm1U1WoJT927xV81zoN0ytoYOwush610caZu8vVXkL4b0hysK77dyWJkdkYpwLY8xG9pLkYlU3lN5E/2tgEjB7Dd7oY7TFTCNuypmIzYh6V74KiHMeA0vlyWUp9lLNt40Ro3MZLT42DyTYjF6YBoUHUp0fS0rKypILJGobJBrwz2YWagXj80IqaaUmmsIcYAaM2u3dQviLlRkIyUxPd1wjFoMc/OMp5Y8A4ZHroCN0wJitGeEEP33GD+MUy58u05pA430AD5Mo4H2V7b3t0qIkOQ8a0BgSVA8UqmrcY/TfikuIZ1kTyCxvD7kmjPq5tG+bhtHt85wgk1XffVO3NDTK7UrltO8R6KolQ5bBgcKgl7YnFTN5qSAT+xrYg8oZaPrGQBTx6eEVETKHKe4oSDkGlAle86lenhF+jm3k2ALmH9X3P/TpAtfRhuU+sUKqhrqQ2Nf4M7LfBtd7lyt2ESqilKokcl51gWCY+1B75dCEIdb/BPmpwzJBGFOI2nZqhxFnVa8TyMpT7C2TxK7rCBPDt5NnNvWYc4+8sRXHBz7s2R5NTk4gaJODlo3HvyL0MV,iv:XlO48HKJWRgwsozmgXstfirwb5CUY+ywelbgLlcx/n4=,tag:GuQMkL2mpNkTJIep79x0zw==,type:str]
+    users: ENC[AES256_GCM,data:GeuYaMNy5UICpYsJs95YCzKjtZxMQDpTTKjU9BDTTBToFir9Rn04QxNi6Wj1I3h2FcS63kbHWaP/W307kDoOQPBZrvrQMi2zSc8+/ivYGmAMhzt2kYXECKt7+YDf9cn9f3D6KV0NSh5UqlpZvDfYXSc/6q2gHOMV3bPvMEf+uxxUEf06kzLH7HpnjExgmUcOM6uVNAudf7HgJ1h/JzUzHq/XLPoVAuyj2TbaHwvRCk+YqLJZw1D+8z3MkpZsdNF57quEZfDPahg371l1wzvZMH5sfFuSzUajD3lbIGRiV0o9PpmBp4qwnU63EkFy1wqhMjXjoviPqouRyZb+fDzxkDoyMuhAYjHcIuSlAs3/5htO2CzOCQL1t6cfEGaxG5U4ocHH0b0C5wvqNG5u9NDLbP7AjBS3a9TLPfmjijNBd4xwt/eYCpDkXirv/m/PVQLvbNzzf+zDWDApldxmv5rCxTLR,iv:FqShjMhe8Yzh2RiC991mVhATYZD2rdW3m0js9gQsKC4=,tag:8P7nEFVVY32IFP9C5H4cZA==,type:str]
 forgejo:
     action_runner_token: ENC[AES256_GCM,data:yJ6OnRq5kinbuhvH06K5o3l86EafuBoojMwg/qhP+cgeH+BwPeE+Ng==,iv:IeXJahPxgLNIUFmkgp495tLVh8UyQBmJ2SnVEUhlhHs=,tag:XYQi613CxSp8AQeilJMrsg==,type:str]
 synapse:
@@ -59,7 +59,7 @@ sops:
             TTRWaHhpNWlkVDFmMFN4ZTNHMUxyNVkKV693pzTKRkZboQCMPr9IyMGSgxfuHXcb
             Y6BNcp6Qg6PWtX5QI7wRkPNINAK1TEbRBba+b8h6gMmVU4DliQyFiQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-25T07:35:41Z"
+    lastmodified: "2026-02-24T07:24:41Z"
-    mac: ENC[AES256_GCM,data:UKAWLSj/OpyCGj1U9rhCX2rQr5E2CXodU+Z5RZddTdFis1+1opw7GLr+2s4OTRbREdZsNP3JSoXycgCssf4na88p/PTZh/VUa9ymbRr9eTacJq6ZkqRC5J8WyDK6gI+Qv4gv5CxdxZd92vUa4uXlwrZ4VsYepvrrkatCe9YTA9w=,iv:dkm+hkdyzJsIXp4uB36wYa/uzl8VA7LwhmvQT3hQlog=,tag:zHxeEze6RVfTCcduVkwuoQ==,type:str]
+    mac: ENC[AES256_GCM,data:wmTua89j8OYC4lw5nmDgKQy2A31KbI5M8jQxqNicHUEZFnDjo2aloNrpwKz5/lM5EomPvvJEAm2eyV04EmfYqKqmAXbcj2wTl4f6Afzb1X/+uABCvlaHquTXbx6lU8IyA31nHKeBspRX0mED86wrXasOsG34YJdDTa/lAKymjzk=,iv:Qea6St+3XfoVHAuWczK/rF2lEeKQBguRGpfGybdf7lA=,tag:yFufTgb7AG5dhrQH47Y0tA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0