Add LiveKit, coturn, and JWT service to Matrix module

- Integrate LiveKit SFU, coturn TURN server, and lk-jwt-service for
  Element Call support in the Matrix Synapse module
- Add firewall rules for new services and ports
- Add key generation systemd service for LiveKit JWT
- Extend Synapse config with TURN URIs and experimental features
- Update Caddy config for new endpoints and well-known support
- Improve OIDC config with additional scopes and user mapping
- Add Grafana secret_key to SOPS secrets and config
- Refactor and modularize secret checking in justfile scripts

.just/machine.just

@@ -7,5 +7,6 @@
 [doc('Update the target machine')]
 [no-exit-message]
 @update machine:
+    cd .. && just vars _check {{ machine }}
     just assert '-d "../systems/x86_64-linux/{{ machine }}"' "Machine {{ machine }} does not exist, must be one of: $(ls ../systems/x86_64-linux/ | sed ':a;N;$!ba;s/\n/, /g')"
     nixos-rebuild switch -L --sudo --target-host {{ machine }} --build-host {{ machine }} --flake ..#{{ machine }} --log-format internal-json -v |& nom --json

.just/vars.just

@@ -23,7 +23,7 @@ edit machine:
 
     echo "Done"
 
-[doc('Get var value by {key} of {machine}')]
+[doc('Get var by {key} from {machine}')]
 get machine key:
     sops decrypt {{ base_path }}/{{ machine }}/secrets.yml | yq ".$(echo "{{ key }}" | sed -E 's/\//./g')"
 
@@ -38,25 +38,52 @@ remove machine key:
 
 [script]
 check:
+    cd ..
+
     for machine in $(ls {{ base_path }}); do
-        [ -f "{{ base_path }}/$machine/secrets.yml" ] || continue
-        [ -f "{{ base_path }}/$machine/default.nix" ] || continue
+         just vars _check "$machine"
+    done
 
-        echo "Processing $machine"
+[no-exit-message]
+[script]
+_check machine:
+    # If the default nix file is missing,
+    # we can skip this folder as we are
+    # missing the files used to compare
+    # the defined vs the configured secrets
+    if [ ! -f "{{ base_path }}/{{ machine }}/default.nix" ]; then
+        printf "\r• %-8sskipped\n" "{{ machine }}"
+        exit 0
+    fi
 
-        mapfile -t missing < <(jq -nr \
-            --rawfile defined <(nix eval --json --apply 'builtins.attrNames' ..#nixosConfigurations.$machine.config.sops.secrets 2>/dev/null) \
-            --rawfile configured <(sops decrypt {{ base_path }}/$machine/secrets.yml | yq '.') \
+    exec 3< <(jq -nr \
+        --rawfile defined <(nix eval --json ..#nixosConfigurations.{{ machine }}.config.sops.secrets 2>/dev/null) \
+        --rawfile configured <([ -f "{{ base_path }}/{{ machine }}/secrets.yml" ] && sops decrypt {{ base_path }}/{{ machine }}/secrets.yml | yq '.' || echo "{}") \
         '
-                $defined | fromjson as $def
-                | $configured
+            [ $configured | fromjson | paths(scalars) | join("/") ] as $conf
+            | $defined
             | fromjson
-                | paths(scalars)
-                | join("/")
-                | select(. | IN($def[]) | not)
+            | map(.key | select(. | IN($conf[]) | not))
+            | unique
+            | .[]
         ')
 
-        if (( ${#missing[@]} > 0 )); then
-            printf 'missing the following %d secret(s):\n%s\n\n' "${#missing[@]}" "$(printf -- '- %s\n' "${missing[@]}")"
-        fi
+    pid=$! # Process Id of the previous running command
+    spin='⠇⠋⠙⠸⢰⣠⣄⡆'
+
+    i=0
+    while kill -0 $pid 2>/dev/null
+    do
+    i=$(( (i+1) %${#spin} ))
+    printf "\r${spin:$i:1} %s" "{{ machine }}"
+    sleep .1
     done
+
+    mapfile -t missing <&3
+
+    if (( ${#missing[@]} > 0 )); then
+        printf '\r✗ %-8smissing %d secret(s):\n%s\n' "{{ machine }}" "${#missing[@]}" "$(printf -- '    %s\n' "${missing[@]}")"
+        exit 1
+    else
+        printf "\r✓ %-8sup to date\n" "{{ machine }}"
+    fi

modules/nixos/services/communication/matrix/default.nix

@@ -15,6 +15,7 @@
   port = 4001;
 
   database = "synapse";
+  keyFile = "/var/lib/element-call/key";
 in {
   options.${namespace}.services.communication.matrix = {
     enable = mkEnableOption "Matrix server (Synapse)";
@@ -26,8 +27,6 @@ in {
       # virtualisation.podman.enable = true;
     };
 
-    networking.firewall.allowedTCPPorts = [4001];
-
     services = {
       matrix-synapse = {
         enable = true;
@@ -55,8 +54,27 @@ in {
           password_config.enabled = true;
           backchannel_logout_enabled = true;
 
+          # Element Call options
+          max_event_delay_duration = "24h";
+          rc_message = {
+            per_second = 0.5;
+            burst_count = 30;
+          };
+          rc_delayed_event_mgmt = {
+            per_second = 1;
+            burst_count = 20;
+          };
+          turn_uris = ["turn:turn.${domain}:4004?transport=udp" "turn:turn.${domain}:4004?transport=tcp"];
+
           experimental_features = {
+            # MSC2965: OAuth 2.0 Authorization Server Metadata discovery
             msc2965_enabled = true;
+
+            # MSC3266: Room summary API. Used for knocking over federation
+            msc3266_enabled = true;
+            # MSC4222 needed for syncv2 state_after. This allow clients to
+            # correctly track the state of the room.
+            msc4222_enabled = true;
           };
 
           sso = {
@@ -181,33 +199,180 @@ in {
 
       caddy = {
         enable = true;
+        # globalConfig = ''
+        #   layer4 {
+        #           127.0.0.1:4004
+        #               route {
+        #                   proxy {
+        #                       upstream synapse:4004
+        #                   }
+        #               }
+        #           }
+        #           127.0.0.1:4005
+        #               route {
+        #                   proxy {
+        #                       upstream synapse:4005
+        #                   }
+        #               }
+        #           }
+        #       }
+        # '';
         virtualHosts = let
           server = {
             "m.server" = "${fqn}:443";
           };
           client = {
             "m.homeserver".base_url = "https://${fqn}";
-            "m.identity_server".base_url = "https://auth.kruining.eu";
+            "m.identity_server".base_url = "https://auth.${domain}";
+            "org.matrix.msc3575.proxy".url = "https://${domain}";
+            "org.matrix.msc4143.rtc_foci" = [
+              {
+                type = "livekit";
+                livekit_service_url = "https://${domain}/livekit/jwt";
+              }
+            ];
           };
         in {
-          "${domain}".extraConfig = ''
+          "${domain}, darkch.at".extraConfig = ''
+            # Route for lk-jwt-service
+            handle /livekit/jwt* {
+              uri strip_prefix /livekit/jwt
+              reverse_proxy http://[::1]:${toString config.services.lk-jwt-service.port} {
+                header_up Host {host}
+                header_up X-Forwarded-Server {host}
+                header_up X-Real-IP {remote_host}
+                header_up X-Forwarded-For {remote_host}
+              }
+            }
+
+            handle_path /livekit/sfu* {
+              reverse_proxy http://[::1]:${toString config.services.livekit.settings.port} {
+                header_up Host {host}
+                header_up X-Forwarded-Server {host}
+                header_up X-Real-IP {remote_host}
+                header_up X-Forwarded-For {remote_host}
+              }
+            }
+
             header /.well-known/matrix/* Content-Type application/json
             header /.well-known/matrix/* Access-Control-Allow-Origin *
             respond /.well-known/matrix/server `${toJSON server}`
             respond /.well-known/matrix/client `${toJSON client}`
           '';
           "${fqn}".extraConfig = ''
-            reverse_proxy /_matrix/* http://::1:4001
-            reverse_proxy /_synapse/client/* http://::1:4001
+            reverse_proxy /_matrix/* http://::1:${toString port}
+            reverse_proxy /_synapse/client/* http://::1:${toString port}
           '';
         };
       };
+
+      livekit = {
+        enable = true;
+        openFirewall = true;
+        inherit keyFile;
+
+        settings = {
+          port = 4002;
+          room.auto_create = false;
+        };
+      };
+
+      lk-jwt-service = {
+        enable = true;
+        port = 4003;
+        # can be on the same virtualHost as synapse
+        livekitUrl = "wss://${domain}/livekit/sfu";
+        inherit keyFile;
+      };
+
+      coturn = rec {
+        enable = true;
+        listening-port = 4004;
+        tls-listening-port = 40004;
+        no-cli = true;
+        no-tcp-relay = true;
+        min-port = 50000;
+        max-port = 50100;
+        use-auth-secret = true;
+        static-auth-secret-file = config.sops.secrets."coturn/secret".path;
+        realm = "turn.${domain}";
+        # cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
+        # pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
+        extraConfig = ''
+          # for debugging
+          verbose
+          # ban private IP ranges
+          no-multicast-peers
+          denied-peer-ip=0.0.0.0-0.255.255.255
+          denied-peer-ip=10.0.0.0-10.255.255.255
+          denied-peer-ip=100.64.0.0-100.127.255.255
+          denied-peer-ip=127.0.0.0-127.255.255.255
+          denied-peer-ip=169.254.0.0-169.254.255.255
+          denied-peer-ip=172.16.0.0-172.31.255.255
+          denied-peer-ip=192.0.0.0-192.0.0.255
+          denied-peer-ip=192.0.2.0-192.0.2.255
+          denied-peer-ip=192.88.99.0-192.88.99.255
+          denied-peer-ip=192.168.0.0-192.168.255.255
+          denied-peer-ip=198.18.0.0-198.19.255.255
+          denied-peer-ip=198.51.100.0-198.51.100.255
+          denied-peer-ip=203.0.113.0-203.0.113.255
+          denied-peer-ip=240.0.0.0-255.255.255.255
+          denied-peer-ip=::1
+          denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
+          denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
+          denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
+          denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
+          denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+          denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+          denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+        '';
+      };
+    };
+
+    networking.firewall = {
+      allowedTCPPortRanges = [];
+      allowedTCPPorts = [
+        # Synapse
+        port
+
+        # coTURN ports
+        config.services.coturn.listening-port
+        config.services.coturn.alt-listening-port
+        config.services.coturn.tls-listening-port
+        config.services.coturn.alt-tls-listening-port
+      ];
+      allowedUDPPortRanges = with config.services.coturn;
+        lib.singleton {
+          from = min-port;
+          to = max-port;
+        };
+      allowedUDPPorts = [
+        # coTURN ports
+        config.services.coturn.listening-port
+        config.services.coturn.alt-listening-port
+      ];
+    };
+
+    systemd = {
+      services.livekit-key = {
+        before = ["lk-jwt-service.service" "livekit.service"];
+        wantedBy = ["multi-user.target"];
+        path = with pkgs; [livekit coreutils gawk];
+        script = ''
+          echo "Key missing, generating key"
+          echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${keyFile}"
+        '';
+        serviceConfig.Type = "oneshot";
+        unitConfig.ConditionPathExists = "!${keyFile}";
+      };
+      services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = "${domain}";
     };
 
     sops = {
       secrets = {
         "synapse/oidc_id" = {};
         "synapse/oidc_secret" = {};
+        "coturn/secret" = {};
       };
 
       templates = {
@@ -222,13 +387,19 @@ in {
                 scopes:
                   - openid
                   - profile
+                  - email
+                  - offline_access
                 client_id: '${config.sops.placeholder."synapse/oidc_id"}'
                 client_secret: '${config.sops.placeholder."synapse/oidc_secret"}'
                 backchannel_logout_enabled: true
+                user_profile_method: userinfo_endpoint
+                allow_existing_users: true
+                enable_registration: true
                 user_mapping_provider:
                   config:
                     localpart_template: "{{ user.preferred_username }}"
                     display_name_template: "{{ user.name }}"
+                    email_template: "{{ user.email }}"
           '';
           restartUnits = ["matrix-synapse.service"];
         };

modules/nixos/services/games/minecraft/default.nix

@@ -1,11 +1,16 @@
-{ inputs, config, lib, pkgs, namespace, ... }:
-let
+{
+  inputs,
+  config,
+  lib,
+  pkgs,
+  namespace,
+  ...
+}: let
   inherit (lib) mkIf mkEnableOption mkOption;
   inherit (lib.types) str;
 
   cfg = config.${namespace}.services.games.minecraft;
-in
-{
+in {
   imports = [
     inputs.nix-minecraft.nixosModules.minecraft-servers
   ];
@@ -25,7 +30,7 @@ in
   };
 
   config = mkIf cfg.enable {
-    user.users.${cfg.user} = {
+    users.users.${cfg.user} = {
       isSystemUser = true;
       group = cfg.group;
     };
@@ -103,8 +108,14 @@ in
               inherit (pkgs) linkFarmFromDrvs fetchurl;
             in {
               mods = linkFarmFromDrvs "mods" (attrValues {
-                FabricApi = fetchurl { url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/ZNwYCTsk/fabric-api-0.118.0%2B1.21.4.jar"; sha512 = "1e0d31b6663dc2c7be648f3a5a9cf7b698b9a0fd0f7ae16d1d3f32d943d7c5205ff63a4f81b0c4e94a8997482cce026b7ca486e99d9ce35ac069aeb29b02a30d"; };
-                Terralith = fetchurl { url = "https://cdn.modrinth.com/data/8oi3bsk5/versions/MuJMtPGQ/Terralith_1.21.x_v2.5.8.jar"; sha512 = "f862ed5435ce4c11a97d2ea5c40eee9f817c908f3223b5fd3e3fff0562a55111d7429dc73a2f1ca0b1af7b1ff6fa0470ed6efebb5de13336c40bb70fb357dd60"; };
+                FabricApi = fetchurl {
+                  url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/ZNwYCTsk/fabric-api-0.118.0%2B1.21.4.jar";
+                  sha512 = "1e0d31b6663dc2c7be648f3a5a9cf7b698b9a0fd0f7ae16d1d3f32d943d7c5205ff63a4f81b0c4e94a8997482cce026b7ca486e99d9ce35ac069aeb29b02a30d";
+                };
+                Terralith = fetchurl {
+                  url = "https://cdn.modrinth.com/data/8oi3bsk5/versions/MuJMtPGQ/Terralith_1.21.x_v2.5.8.jar";
+                  sha512 = "f862ed5435ce4c11a97d2ea5c40eee9f817c908f3223b5fd3e3fff0562a55111d7429dc73a2f1ca0b1af7b1ff6fa0470ed6efebb5de13336c40bb70fb357dd60";
+                };
                 # DistantHorizons = fetchurl { url = "https://cdn.modrinth.com/data/uCdwusMi/versions/jptcCdp2/DistantHorizons-2.2.1-a-1.20.4-forge-fabric.jar"; sha512 = "47368d91099d0b5f364339a69f4e425f8fb1e3a7c3250a8b649da76135e68a22f1a76b191c87e15a5cdc0a1d36bc57f2fa825490d96711d09d96807be97d575d"; };
               });
             };
@@ -147,13 +158,16 @@ in
               inherit (lib) concatMapAttrs;
 
               readDirRec = src: dir: fn:
-                concatMapAttrs (name: type: if type == "directory"
+                concatMapAttrs (
+                  name: type:
+                    if type == "directory"
                     then (readDirRec src "${dir}/${name}" fn)
-                  else { "${dir}/${name}" = (fn "${dir}/${name}"); }
+                    else {"${dir}/${name}" = fn "${dir}/${name}";}
                 ) (readDir "${src}/${dir}");
 
               copyDir = dir: readDirRec src dir (x: "${src}/${x}");
-            in {
+            in
+              {
                 "ops.json" = {
                   value = ops;
                 };
@@ -164,7 +178,11 @@ in
               inherit (builtins) attrNames readDir map;
               inherit (pkgs) linkFarm;
 
-              linkFarmFromDir = name: dir: linkFarm name (map (x: { name = x; path = "${src}/${dir}/${x}"; }) (attrNames (readDir "${src}/${dir}")));
+              linkFarmFromDir = name: dir:
+                linkFarm name (map (x: {
+                  name = x;
+                  path = "${src}/${dir}/${x}";
+                }) (attrNames (readDir "${src}/${dir}")));
             in {
               Deftu = linkFarmFromDir "tekxit-deftu" "Deftu";
               TKXAddons = linkFarmFromDir "tekxit-TKXAddons" "TKXAddons";

modules/nixos/services/games/palworld.nix

@@ -1,25 +0,0 @@
-{ config, lib, namespace, ... }:
-let
-  inherit (lib) mkIf mkEnableOption;
-
-  cfg = config.${namespace}.services.games.palworld;
-in
-{
-  options.${namespace}.services.games.palworld = {
-    enable = mkEnableOption "Palworld";
-  };
-
-  config = mkIf cfg.enable {
-#     kaas = (pkgs.mkSteamServer rec {
-#       name = "Palworld";
-#       src = pkgs.fetchSteam {
-#         inherit name;
-#         appId = "2394010";
-#         hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-#       };
-#
-#       sartCmd = "PalServer.sh";
-#       hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-#     });
-  };
-}

modules/nixos/services/games/palworld/default.nix

@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  namespace,
+  ...
+}: let
+  inherit (lib) mkIf mkEnableOption;
+
+  cfg = config.${namespace}.services.games.palworld;
+in {
+  options.${namespace}.services.games.palworld = {
+    enable = mkEnableOption "Palworld";
+  };
+
+  config = mkIf cfg.enable {
+    #     kaas = (pkgs.mkSteamServer rec {
+    #       name = "Palworld";
+    #       src = pkgs.fetchSteam {
+    #         inherit name;
+    #         appId = "2394010";
+    #         hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+    #       };
+    #
+    #       sartCmd = "PalServer.sh";
+    #       hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+    #     });
+
+    sops.secrets."palworld/password" = {};
+  };
+}

modules/nixos/services/observability/grafana/default.nix

@@ -30,6 +30,10 @@ in {
             domain = "ulmo";
           };
 
+          security = {
+            secret_key = "$__file{${config.sops.secrets."grafana/secret_key".path}}";
+          };
+
           auth = {
             disable_login_form = false;
             oauth_auto_login = true;
@@ -133,6 +137,10 @@ in {
 
     sops = {
       secrets = {
+        "grafana/secret_key" = {
+          owner = "grafana";
+          group = "grafana";
+        };
         "grafana/oidc_id" = {
           owner = "grafana";
           group = "grafana";

systems/x86_64-linux/aule/secrets.yml

@@ -0,0 +1,33 @@
+sops:
+    age:
+        - recipient: age19qfpf980tadguqq44zf6xwvjvl428dyrj46ha3n6aeqddwhtnuqqml7etq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZMC9nRjVFWnZlMHJJK0Nl
+            dWFTR0FCUGNBYXIrUHlIUUphZll2QU9IOEZrCitFS3JvK3hYYmpEZ05aRStpdUd1
+            L3JjNDl1Z2hQQ3FuNUZNM1hCRUtQUG8KLS0tIEg4VVEvVjZYN3JHSXljQW1xS3E4
+            eVpyM1lSWExndlZhMkw2Vis4dVhjSVUKbk+z1h3Hb1A6SEbZ3g5vYui/FfkMyfxx
+            Zm67JenYittHvQggTIErAgJatTocfVB6Zy4FqJtPCOevTVrRTRkwAg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1ewes0f5snqx3sh5ul6fa6qtxzhd25829v6mf5rx2wnheat6fefps5rme2x
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtOGJXWi9vUzdFbkx2NmVa
+            YnhITlNMc1RRRXoyOFNPN1B4VWQ5ZDUwNDFBCnVmdDFyUnptekxhOUlwdVcyRjFI
+            cHRSRkoyWnFVUDJMcXpVcmM5bjRKMkkKLS0tIDROWXR1UFFUa0NxcUtkdEwxQ2Vl
+            OW50OE9RMWpyT1AvS0QzZ3JVNDViYlkK77H0Uq3eRy0CHgH4bhdo7FVEJpKeR/DB
+            KZonll74qqsyW4n+hIbIybjaqtF3RBN4kj5ARuIGFmH8sAl6jSyHXA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1jmrmdw4kmjeu9d6z74r2unqt7wpgsx24vqejmdjretsnsn8g4drsl3m98w
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZOURoRmk4QldEZExTRDYx
+            cXluYkg4OUFUNDNrQUNiNWRwKzhEQkdaemxzCnM3b25GYm5TM3NuNnBsVWRmQzNL
+            bTRabmx2UzBkN1dadlhwajN5RDIxVW8KLS0tIDhSQ1o4RGZBdlVHaHRKQWFyazU0
+            N0lnMjMvREpmNWZvTUdiT0tjMk4vTk0KmIN1a3gjmFzaEwJBu41sw5Z61UgiO5fc
+            /pkS22BeVonuB12SmJX+77A1CxFz1EwM8HSShFKlpN2hPCJFJL7Nng==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-25T07:59:24Z"
+    mac: ENC[AES256_GCM,data:64AkqWb97nUciWtOOHP/SZhUeo/5ahxa0cN14ILw/jmToFkn8uDrSfY8/ibqBB0mmfhwGzcnI/5QpCLVzCSgG1J68bdPeSsYTZPwy2/0S0ven+GeqYHMfJ2Q1eJE7TONyOEvSdYdUWG+ff5t0qhSet9F2BgFnMSKcNeAaxIY6KU=,iv:aMQXbKk8oKSLBHIZyJLJahu5HHEMysmhcgfpDdZG+Ak=,tag:hqBVXis8MdqRorxttYeQaw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0

systems/x86_64-linux/ulmo/secrets.yml

@@ -4,7 +4,7 @@ email:
 zitadel:
     masterKey: ENC[AES256_GCM,data:4MPvBo407qrS7NF4oUTf84tZoPkSRmiHdD7qpkYeHME=,iv:H2NIAN0xBUDqnyco9gA3zYAsKtSeA/JpqYrPhc1eqc0=,tag:6OFGDfsucG5gDerImgpuXA==,type:str]
     nix: {}
-    users: ENC[AES256_GCM,data:GeuYaMNy5UICpYsJs95YCzKjtZxMQDpTTKjU9BDTTBToFir9Rn04QxNi6Wj1I3h2FcS63kbHWaP/W307kDoOQPBZrvrQMi2zSc8+/ivYGmAMhzt2kYXECKt7+YDf9cn9f3D6KV0NSh5UqlpZvDfYXSc/6q2gHOMV3bPvMEf+uxxUEf06kzLH7HpnjExgmUcOM6uVNAudf7HgJ1h/JzUzHq/XLPoVAuyj2TbaHwvRCk+YqLJZw1D+8z3MkpZsdNF57quEZfDPahg371l1wzvZMH5sfFuSzUajD3lbIGRiV0o9PpmBp4qwnU63EkFy1wqhMjXjoviPqouRyZb+fDzxkDoyMuhAYjHcIuSlAs3/5htO2CzOCQL1t6cfEGaxG5U4ocHH0b0C5wvqNG5u9NDLbP7AjBS3a9TLPfmjijNBd4xwt/eYCpDkXirv/m/PVQLvbNzzf+zDWDApldxmv5rCxTLR,iv:FqShjMhe8Yzh2RiC991mVhATYZD2rdW3m0js9gQsKC4=,tag:8P7nEFVVY32IFP9C5H4cZA==,type:str]
+    users: ENC[AES256_GCM,data:w/2Vdq0EHXaJ5u/aA/reSCtwRHreWm1U1WoJT927xV81zoN0ytoYOwush610caZu8vVXkL4b0hysK77dyWJkdkYpwLY8xG9pLkYlU3lN5E/2tgEjB7Dd7oY7TFTCNuypmIzYh6V74KiHMeA0vlyWUp9lLNt40Ro3MZLT42DyTYjF6YBoUHUp0fS0rKypILJGobJBrwz2YWagXj80IqaaUmmsIcYAaM2u3dQviLlRkIyUxPd1wjFoMc/OMp5Y8A4ZHroCN0wJitGeEEP33GD+MUy58u05pA430AD5Mo4H2V7b3t0qIkOQ8a0BgSVA8UqmrcY/TfikuIZ1kTyCxvD7kmjPq5tG+bhtHt85wgk1XffVO3NDTK7UrltO8R6KolQ5bBgcKgl7YnFTN5qSAT+xrYg8oZaPrGQBTx6eEVETKHKe4oSDkGlAle86lenhF+jm3k2ALmH9X3P/TpAtfRhuU+sUKqhrqQ2Nf4M7LfBtd7lyt2ESqilKokcl51gWCY+1B75dCEIdb/BPmpwzJBGFOI2nZqhxFnVa8TyMpT7C2TxK7rCBPDt5NnNvWYc4+8sRXHBz7s2R5NTk4gaJODlo3HvyL0MV,iv:XlO48HKJWRgwsozmgXstfirwb5CUY+ywelbgLlcx/n4=,tag:GuQMkL2mpNkTJIep79x0zw==,type:str]
 forgejo:
     action_runner_token: ENC[AES256_GCM,data:yJ6OnRq5kinbuhvH06K5o3l86EafuBoojMwg/qhP+cgeH+BwPeE+Ng==,iv:IeXJahPxgLNIUFmkgp495tLVh8UyQBmJ2SnVEUhlhHs=,tag:XYQi613CxSp8AQeilJMrsg==,type:str]
 synapse:
@@ -59,7 +59,7 @@ sops:
             TTRWaHhpNWlkVDFmMFN4ZTNHMUxyNVkKV693pzTKRkZboQCMPr9IyMGSgxfuHXcb
             Y6BNcp6Qg6PWtX5QI7wRkPNINAK1TEbRBba+b8h6gMmVU4DliQyFiQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-24T07:24:41Z"
-    mac: ENC[AES256_GCM,data:wmTua89j8OYC4lw5nmDgKQy2A31KbI5M8jQxqNicHUEZFnDjo2aloNrpwKz5/lM5EomPvvJEAm2eyV04EmfYqKqmAXbcj2wTl4f6Afzb1X/+uABCvlaHquTXbx6lU8IyA31nHKeBspRX0mED86wrXasOsG34YJdDTa/lAKymjzk=,iv:Qea6St+3XfoVHAuWczK/rF2lEeKQBguRGpfGybdf7lA=,tag:yFufTgb7AG5dhrQH47Y0tA==,type:str]
+    lastmodified: "2026-02-25T07:35:41Z"
+    mac: ENC[AES256_GCM,data:UKAWLSj/OpyCGj1U9rhCX2rQr5E2CXodU+Z5RZddTdFis1+1opw7GLr+2s4OTRbREdZsNP3JSoXycgCssf4na88p/PTZh/VUa9ymbRr9eTacJq6ZkqRC5J8WyDK6gI+Qv4gv5CxdxZd92vUa4uXlwrZ4VsYepvrrkatCe9YTA9w=,iv:dkm+hkdyzJsIXp4uB36wYa/uzl8VA7LwhmvQT3hQlog=,tag:zHxeEze6RVfTCcduVkwuoQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0