update readme

nextcloud: add calendar and contacts apps
haze: use lanzaboote
2026-01-31 14:57:10 +01:00 · 2026-01-31 14:43:31 +01:00 · 2026-01-31 14:43:31 +01:00 · 2026-01-31 14:43:31 +01:00 · 2026-01-31 14:31:38 +01:00 · 2026-01-31 14:31:27 +01:00
166 changed files with 1935 additions and 1485 deletions
--- a/README.md
+++ b/README.md
@@ -1,15 +1,18 @@
-# NixOS & Home Manager config
+# Flocon

 This repository contains all my system configurations, mostly deployed using Nix and [Clan].

 ## Structure

- **home**: Dotfiles
- **machines**: Host-specific configs
- **infra**: Terraform/OpenTofu files
- **vars**: Encrypted secrets managed by clan
- **modules**: NixOS modules
+- **clan**: Clan configuration
 - **clanServices**: Custom [Clan Services](https://docs.clan.lol/reference/clanServices)
+- **home**: Dotfiles
+- **home-manager**: [Home Manager] modules
+- **infra**: [Terranix] files (for Terraform/OpenTofu)
+- **machines**: Per-host configurations
+- **modules**: [NixOS] modules
+- **packages**: Nix packages
+- **vars**: Encrypted secrets managed by clan

 ## Dotfiles

@@ -19,4 +22,7 @@ This repository contains all my system configurations, mostly deployed using Nix
 dotbot -c ./dotbot/windows.yaml -d home
 ```

-[Clan]: https//clan.lol
+[Clan]: https://clan.lol
+[Home Manager]: https://home-manager.dev
+[NixOS]: https://nixos.org
+[Terranix]: https://terranix.org
--- a/clan/flake-module.nix
+++ b/clan/flake-module.nix
@@ -9,6 +9,10 @@
  clan.meta.name = "blossom";
  clan.meta.domain = "val";

+  clan.secrets.age.plugins = [
+    "age-plugin-yubikey"
+  ];
+
  clan.inventory.instances."rpqt-admin" = {
    module.input = "clan-core";
    module.name = "admin";
--- a/clan/network.nix
+++ b/clan/network.nix
@@ -33,16 +33,17 @@
    };
  };

-  # clan.inventory.instances.certificates = {
-  #   module.name = "certificates";
-  #   module.input = "clan-core";
+  clan.inventory.instances.certificates = {
+    module.name = "certificates";
+    module.input = "clan-core";

-  #   roles.ca.machines.verbena = {
-  #     settings.acmeEmail = "admin@rpqt.fr";
-  #   };
-  #   roles.default.tags.all = { };
-  #   roles.default.settings.acmeEmail = "admin@rpqt.fr";
-  # };
+    roles.ca.machines.verbena = {
+      settings.acmeEmail = "admin@rpqt.fr";
+      settings.tlds = [ "val" ];
+    };
+    roles.default.tags.all = { };
+    roles.default.settings.acmeEmail = "admin@rpqt.fr";
+  };

  # Temporarily patched version of clan-core/coredns for AAAA records support
  clan.inventory.instances.coredns = {
@@ -52,12 +53,21 @@
    roles.default.tags.all = { };
    roles.server.machines.verbena = {
      settings.ip = "fd28:387a:90:c400::1";
+      settings.dnsPort = 53;
    };
    roles.server.machines.crocus = {
      settings.ip = "fd28:387a:90:c400:6db2:dfc3:c376:9956";
    };
    roles.server.settings = {
-      tld = "home.rpqt.fr";
+      tld = "val";
+    };
+
+    roles.default.machines.verbena.settings = {
+      ip = "fd28:387a:90:c400::1";
+      services = [
+        "ca"
+        "vaultwarden"
+      ];
    };

    roles.default.machines.genepi.settings = {
--- a/clanServices/coredns/default.nix
+++ b/clanServices/coredns/default.nix
@@ -118,11 +118,13 @@

                ''
                  .:${dnsPort} {
+                      bind wireguard
                      forward . 1.1.1.1
                      cache 30
                  }

                  ${settings.tld}:${dnsPort} {
+                      bind wireguard
                      file ${zonefile}
                  }
                '';
@@ -168,7 +170,7 @@
            networking.nameservers = map (
              m:
              let
-                port = config.services.unbound.settings.port or 53;
+                port = config.services.unbound.settings.server.port or 53;
              in
              "127.0.0.1:${toString port}#${roles.server.machines.${m}.settings.tld}"
            ) (lib.attrNames roles.server.machines);
@@ -179,11 +181,11 @@

            services.unbound = {
              enable = true;
-              resolveLocalQueries = true;
+              # resolveLocalQueries = true;
              checkconf = true;
              settings = {
                server = {
-                  # port = 5353;
+                  port = 5353;
                  verbosity = 2;
                  interface = [ "127.0.0.1" ];
                  access-control = [ "127.0.0.0/8 allow" ];
--- a/devShells/flake-module.nix
+++ b/devShells/flake-module.nix
@@ -11,7 +11,7 @@
          inputs'.clan-core.packages.clan-cli
          pkgs.garage
          pkgs.nil # Nix language server
-          pkgs.nixfmt-rfc-style
+          pkgs.nixfmt
          pkgs.opentofu
          pkgs.terraform-ls
          pkgs.deploy-rs
@@ -19,7 +19,7 @@
        ];
        shellHook = ''
          export GARAGE_RPC_SECRET=$(clan vars get crocus garage-shared/rpc_secret)
-          export GARAGE_RPC_HOST=5d8249fe49264d36bc3532bd88400498bf9497b5cd4872245eb820d5d7797ed6@crocus.home.rpqt.fr:3901
+          export GARAGE_RPC_HOST=5d8249fe49264d36bc3532bd88400498bf9497b5cd4872245eb820d5d7797ed6@crocus.val:3901
        '';
      };
    };
--- a/flake.lock
+++ b/flake.lock
@@ -10,11 +10,11 @@
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1765893949,
-        "narHash": "sha256-5wn3/cMZ6cQ7BHaoTkeDiMxgjZUV/8FPGplCJ/P6Idc=",
+        "lastModified": 1769313163,
+        "narHash": "sha256-pjYF+adGJBkMLgKFAhnMEMR0818OsCaZAZREYs/baPQ=",
        "owner": "nix-community",
        "repo": "buildbot-nix",
-        "rev": "39896cb5a1a6ad52d1feb6634913087e11059454",
+        "rev": "6c0fbf1425279800fd8f02796fdb567599587b7b",
        "type": "github"
      },
      "original": {
@@ -32,7 +32,6 @@
        ],
        "nix-darwin": "nix-darwin",
        "nix-select": "nix-select",
-        "nixos-facter-modules": "nixos-facter-modules",
        "nixpkgs": [
          "nixpkgs"
        ],
@@ -41,11 +40,11 @@
        "treefmt-nix": "treefmt-nix_2"
      },
      "locked": {
-        "lastModified": 1766058975,
-        "narHash": "sha256-HBnRRq9wLq7UfJxMM55wR10lZFK1F0lNyRgUwwOby6s=",
+        "lastModified": 1769817905,
+        "narHash": "sha256-/Ktjya8b3TfYeskDPY+67/BXyOwz0EpZnIW4QY9Qd94=",
        "ref": "refs/heads/main",
-        "rev": "9032d11a0e31641808ef1427150aac0f40e2e0b9",
-        "revCount": 11671,
+        "rev": "49c69a0dd6750bbce8ebc698879e3cb48f32ae6b",
+        "revCount": 12606,
        "type": "git",
        "url": "https://git.clan.lol/clan/clan-core"
      },
@@ -54,6 +53,21 @@
        "url": "https://git.clan.lol/clan/clan-core"
      }
    },
+    "crane": {
+      "locked": {
+        "lastModified": 1765145449,
+        "narHash": "sha256-aBVHGWWRzSpfL++LubA0CwOOQ64WNLegrYHwsVuVN7A=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "69f538cdce5955fcd47abfed4395dc6d5194c1c5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
    "data-mesher": {
      "inputs": {
        "flake-parts": [
@@ -70,17 +84,41 @@
        ]
      },
      "locked": {
-        "lastModified": 1765768061,
-        "narHash": "sha256-RZ/ocDUJ3WPr2KcDc2MB6Fu+ZPqzwsMKQ16XxqrPi+o=",
-        "rev": "53351f9953ecf9dbe18795b4784abe53b14e6eee",
+        "lastModified": 1769701076,
+        "narHash": "sha256-ZquoXeXZ8fwMQ54UVgcGRKjzdK0deRHzm0a2jVbw4uw=",
+        "rev": "21655e76e84749d5ce3c9b3aaf9d86ba4016ba08",
        "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/53351f9953ecf9dbe18795b4784abe53b14e6eee.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/21655e76e84749d5ce3c9b3aaf9d86ba4016ba08.tar.gz"
      },
      "original": {
        "type": "tarball",
        "url": "https://git.clan.lol/clan/data-mesher/archive/main.tar.gz"
      }
    },
+    "direnv-instant": {
+      "inputs": {
+        "flake-parts": [
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "treefmt-nix": "treefmt-nix_3"
+      },
+      "locked": {
+        "lastModified": 1768707867,
+        "narHash": "sha256-bNHBR07JIJUMjDGqd3/KwhPsI7e43JkAoeczO2cQ8h8=",
+        "owner": "Mic92",
+        "repo": "direnv-instant",
+        "rev": "522eeea04ab1bc360464e51477963b0c3e18284a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "direnv-instant",
+        "type": "github"
+      }
+    },
    "disko": {
      "inputs": {
        "nixpkgs": [
@@ -89,11 +127,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1765794845,
-        "narHash": "sha256-YD5QWlGnusNbZCqR3pxG8tRxx9yUXayLZfAJRWspq2s=",
+        "lastModified": 1769524058,
+        "narHash": "sha256-zygdD6X1PcVNR2PsyK4ptzrVEiAdbMqLos7utrMDEWE=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "7194cfe5b7a3660726b0fe7296070eaef601cae9",
+        "rev": "71a3fc97d80881e91710fe721f1158d3b96ae14d",
        "type": "github"
      },
      "original": {
@@ -109,11 +147,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1765794845,
-        "narHash": "sha256-YD5QWlGnusNbZCqR3pxG8tRxx9yUXayLZfAJRWspq2s=",
+        "lastModified": 1769524058,
+        "narHash": "sha256-zygdD6X1PcVNR2PsyK4ptzrVEiAdbMqLos7utrMDEWE=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "7194cfe5b7a3660726b0fe7296070eaef601cae9",
+        "rev": "71a3fc97d80881e91710fe721f1158d3b96ae14d",
        "type": "github"
      },
      "original": {
@@ -122,6 +160,22 @@
        "type": "github"
      }
    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1761588595,
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
    "flake-parts": {
      "inputs": {
        "nixpkgs-lib": [
@@ -130,11 +184,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1765835352,
-        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
+        "lastModified": 1768135262,
+        "narHash": "sha256-PVvu7OqHBGWN16zSi6tEmPwwHQ4rLPU9Plvs8/1TUBY=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
+        "rev": "80daad04eddbbf5a4d883996a73f3f542fa437ac",
        "type": "github"
      },
      "original": {
@@ -150,11 +204,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1765835352,
-        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
+        "lastModified": 1768135262,
+        "narHash": "sha256-PVvu7OqHBGWN16zSi6tEmPwwHQ4rLPU9Plvs8/1TUBY=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
+        "rev": "80daad04eddbbf5a4d883996a73f3f542fa437ac",
        "type": "github"
      },
      "original": {
@@ -163,6 +217,28 @@
        "type": "github"
      }
    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "pre-commit",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
    "hercules-ci-effects": {
      "inputs": {
        "flake-parts": [
@@ -175,11 +251,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1765774562,
-        "narHash": "sha256-UQhfCggNGDc7eam+EittlYmeW89CZVT1KkFIHZWBH7k=",
+        "lastModified": 1768476106,
+        "narHash": "sha256-V0YOJRum50gtKgwavsAfwXc9+XAsJCC7386YZx1sWGQ=",
        "owner": "hercules-ci",
        "repo": "hercules-ci-effects",
-        "rev": "edcbb19948b6caf1700434e369fde6ff9e6a3c93",
+        "rev": "c19e263e6e22ec7379d972f19e6a322f943c73fb",
        "type": "github"
      },
      "original": {
@@ -195,11 +271,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1765980955,
-        "narHash": "sha256-rB45jv4uwC90vM9UZ70plfvY/2Kdygs+zlQ07dGQFk4=",
+        "lastModified": 1769813945,
+        "narHash": "sha256-9ABv9Lo9t6MrFjlnRnU8Zw1C6LVj2+R8PipQ/rxGLHk=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "89c9508bbe9b40d36b3dc206c2483ef176f15173",
+        "rev": "475921375def3eb930e1f8883f619ff8609accb6",
        "type": "github"
      },
      "original": {
@@ -208,39 +284,27 @@
        "type": "github"
      }
    },
-    "impermanence": {
-      "locked": {
-        "lastModified": 1737831083,
-        "narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=",
-        "owner": "nix-community",
-        "repo": "impermanence",
-        "rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "impermanence",
-        "type": "github"
-      }
-    },
-    "matugen": {
+    "lanzaboote": {
      "inputs": {
+        "crane": "crane",
        "nixpkgs": [
          "nixpkgs"
        ],
-        "systems": "systems_2"
+        "pre-commit": "pre-commit",
+        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1765981892,
-        "narHash": "sha256-c7VKaNiBUkwGsTq398EQSM4K7skPacmOz8NeLj67M7s=",
-        "owner": "InioX",
-        "repo": "Matugen",
-        "rev": "e405cd9de87510dd40c1328bcf06e0daf3d1a5bf",
+        "lastModified": 1765382359,
+        "narHash": "sha256-RJmgVDzjRI18BWVogG6wpsl1UCuV6ui8qr4DJ1LfWZ8=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "e8c096ade12ec9130ff931b0f0e25d2f1bc63607",
        "type": "github"
      },
      "original": {
-        "owner": "InioX",
-        "repo": "Matugen",
+        "owner": "nix-community",
+        "ref": "v1.0.0",
+        "repo": "lanzaboote",
        "type": "github"
      }
    },
@@ -252,11 +316,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1764161084,
-        "narHash": "sha256-HN84sByg9FhJnojkGGDSrcjcbeioFWoNXfuyYfJ1kBE=",
+        "lastModified": 1768764703,
+        "narHash": "sha256-5ulSDyOG1U+1sJhkJHYsUOWEsmtLl97O0NTVMvgIVyc=",
        "owner": "nix-darwin",
        "repo": "nix-darwin",
-        "rev": "e95de00a471d07435e0527ff4db092c84998698e",
+        "rev": "0fc4e7ac670a0ed874abacf73c4b072a6a58064b",
        "type": "github"
      },
      "original": {
@@ -293,32 +357,17 @@
        "type": "github"
      }
    },
-    "nixos-facter-modules": {
-      "locked": {
-        "lastModified": 1765442039,
-        "narHash": "sha256-k3lYQ+A1F7aTz8HnlU++bd9t/x/NP2A4v9+x6opcVg0=",
-        "owner": "nix-community",
-        "repo": "nixos-facter-modules",
-        "rev": "9dd775ee92de63f14edd021d59416e18ac2c00f1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixos-facter-modules",
-        "type": "github"
-      }
-    },
    "nixos-generators": {
      "inputs": {
        "nixlib": "nixlib",
        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1764234087,
-        "narHash": "sha256-NHF7QWa0ZPT8hsJrvijREW3+nifmF2rTXgS2v0tpcEA=",
+        "lastModified": 1769813415,
+        "narHash": "sha256-nnVmNNKBi1YiBNPhKclNYDORoHkuKipoz7EtVnXO50A=",
        "owner": "nix-community",
        "repo": "nixos-generators",
-        "rev": "032a1878682fafe829edfcf5fdfad635a2efe748",
+        "rev": "8946737ff703382fda7623b9fab071d037e897d5",
        "type": "github"
      },
      "original": {
@@ -329,11 +378,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1764440730,
-        "narHash": "sha256-ZlJTNLUKQRANlLDomuRWLBCH5792x+6XUJ4YdFRjtO4=",
+        "lastModified": 1769302137,
+        "narHash": "sha256-QEDtctEkOsbx8nlFh4yqPEOtr4tif6KTqWwJ37IM2ds=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "9154f4569b6cdfd3c595851a6ba51bfaa472d9f3",
+        "rev": "a351494b0e35fd7c0b7a1aae82f0afddf4907aa8",
        "type": "github"
      },
      "original": {
@@ -361,11 +410,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1765779637,
-        "narHash": "sha256-KJ2wa/BLSrTqDjbfyNx70ov/HdgNBCBBSQP3BIzKnv4=",
+        "lastModified": 1769461804,
+        "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "1306659b587dc277866c7b69eb97e5f07864d8c4",
+        "rev": "bfc1b8a4574108ceef22f02bafcf6611380c100d",
        "type": "github"
      },
      "original": {
@@ -375,19 +424,64 @@
        "type": "github"
      }
    },
+    "pre-commit": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1765016596,
+        "narHash": "sha256-rhSqPNxDVow7OQKi4qS5H8Au0P4S3AYbawBSmJNUtBQ=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "548fc44fca28a5e81c5d6b846e555e6b9c2a5a3c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
    "root": {
      "inputs": {
        "buildbot-nix": "buildbot-nix",
        "clan-core": "clan-core",
+        "direnv-instant": "direnv-instant",
        "disko": "disko_2",
        "flake-parts": "flake-parts_2",
        "home-manager": "home-manager",
-        "impermanence": "impermanence",
-        "matugen": "matugen",
+        "lanzaboote": "lanzaboote",
        "nixos-generators": "nixos-generators",
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs_2",
-        "srvos": "srvos"
+        "srvos": "srvos",
+        "terranix": "terranix"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1765075567,
+        "narHash": "sha256-KFDCdQcHJ0hE3Nt5Gm5enRIhmtEifAjpxgUQ3mzSJpA=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "769156779b41e8787a46ca3d7d76443aaf68be6f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
      }
    },
    "sops-nix": {
@@ -398,11 +492,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1765836173,
-        "narHash": "sha256-hWRYfdH2ONI7HXbqZqW8Q1y9IRbnXWvtvt/ONZovSNY=",
+        "lastModified": 1769469829,
+        "narHash": "sha256-wFcr32ZqspCxk4+FvIxIL0AZktRs6DuF8oOsLt59YBU=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "443a7f2e7e118c4fc63b7fae05ab3080dd0e5c63",
+        "rev": "c5eebd4eb2e3372fe12a8d70a248a6ee9dd02eff",
        "type": "github"
      },
      "original": {
@@ -418,11 +512,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1766020451,
-        "narHash": "sha256-Jy7rX7sMbSJEX0KKwvNcGUfRVZ0SDWo3Zk2e5LGyqw0=",
+        "lastModified": 1769681123,
+        "narHash": "sha256-i29n0IDa5nR8O9w7QsajWNy/dfgfnGF7/nJY+/OdjEY=",
        "owner": "nix-community",
        "repo": "srvos",
-        "rev": "5ecd4a56da963480db305e56ab3a42d13597c0a7",
+        "rev": "861710611463c47190345f09f6959c9230def555",
        "type": "github"
      },
      "original": {
@@ -448,16 +542,40 @@
    },
    "systems_2": {
      "locked": {
-        "lastModified": 1689347949,
-        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
        "owner": "nix-systems",
-        "repo": "default-linux",
-        "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
        "type": "github"
      },
      "original": {
        "owner": "nix-systems",
-        "repo": "default-linux",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "terranix": {
+      "inputs": {
+        "flake-parts": [
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1762472226,
+        "narHash": "sha256-iVS4sxVgGn+T74rGJjEJbzx+kjsuaP3wdQVXBNJ79A0=",
+        "owner": "terranix",
+        "repo": "terranix",
+        "rev": "3b5947a48da5694094b301a3b1ef7b22ec8b19fc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "terranix",
+        "repo": "terranix",
        "type": "github"
      }
    },
@@ -469,11 +587,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1762938485,
-        "narHash": "sha256-AlEObg0syDl+Spi4LsZIBrjw+snSVU4T8MOeuZJUJjM=",
+        "lastModified": 1768158989,
+        "narHash": "sha256-67vyT1+xClLldnumAzCTBvU0jLZ1YBcf4vANRWP3+Ak=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "5b4ee75aeefd1e2d5a1cc43cf6ba65eba75e83e4",
+        "rev": "e96d59dff5c0d7fddb9d113ba108f03c3ef99eca",
        "type": "github"
      },
      "original": {
@@ -490,11 +608,32 @@
        ]
      },
      "locked": {
-        "lastModified": 1766000401,
-        "narHash": "sha256-+cqN4PJz9y0JQXfAK5J1drd0U05D5fcAGhzhfVrDlsI=",
+        "lastModified": 1769691507,
+        "narHash": "sha256-8aAYwyVzSSwIhP2glDhw/G0i5+wOrren3v6WmxkVonM=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "42d96e75aa56a3f70cab7e7dc4a32868db28e8fd",
+        "rev": "28b19c5844cc6e2257801d43f2772a4b4c050a1b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "treefmt-nix_3": {
+      "inputs": {
+        "nixpkgs": [
+          "direnv-instant",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768158989,
+        "narHash": "sha256-67vyT1+xClLldnumAzCTBvU0jLZ1YBcf4vANRWP3+Ak=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "e96d59dff5c0d7fddb9d113ba108f03c3ef99eca",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -6,15 +6,12 @@
      nixpkgs,
      clan-core,
      flake-parts,
-      home-manager,
-      impermanence,
-      nixos-hardware,
-      self,
      ...
    }:
    flake-parts.lib.mkFlake { inherit inputs; } ({
      imports = [
-        inputs.clan-core.flakeModules.default
+        clan-core.flakeModules.default
+        inputs.terranix.flakeModule
        ./clan/flake-module.nix
        ./clanServices/flake-module.nix
        ./devShells/flake-module.nix
@@ -39,8 +36,6 @@
    home-manager.url = "github:nix-community/home-manager";
    home-manager.inputs.nixpkgs.follows = "nixpkgs";

-    impermanence.url = "github:nix-community/impermanence";
-
    nixos-hardware.url = "github:NixOS/nixos-hardware/master";

    nixos-generators.url = "github:nix-community/nixos-generators";
@@ -49,9 +44,6 @@
    clan-core.inputs.nixpkgs.follows = "nixpkgs";
    clan-core.inputs.flake-parts.follows = "flake-parts";

-    matugen.url = "github:InioX/Matugen";
-    matugen.inputs.nixpkgs.follows = "nixpkgs";
-
    flake-parts.url = "github:hercules-ci/flake-parts";
    flake-parts.inputs.nixpkgs-lib.follows = "nixpkgs";

@@ -60,5 +52,16 @@

    buildbot-nix.url = "github:nix-community/buildbot-nix";
    buildbot-nix.inputs.nixpkgs.follows = "nixpkgs";
+
+    direnv-instant.url = "github:Mic92/direnv-instant";
+    direnv-instant.inputs.nixpkgs.follows = "nixpkgs";
+    direnv-instant.inputs.flake-parts.follows = "flake-parts";
+
+    terranix.url = "github:terranix/terranix";
+    terranix.inputs.nixpkgs.follows = "nixpkgs";
+    terranix.inputs.flake-parts.follows = "flake-parts";
+
+    lanzaboote.url = "github:nix-community/lanzaboote/v1.0.0";
+    lanzaboote.inputs.nixpkgs.follows = "nixpkgs";
  };
 }
--- a/home-manager/cli.nix
+++ b/home-manager/cli.nix
@@ -5,12 +5,28 @@
  pkgs,
  ...
 }:
+let
+  shellAliases = {
+    ls = "eza";
+    lsa = "ls -A";
+    ll = "ls -lh";
+    lla = "ls -lAh";
+    h = "hx";
+    g = "git";
+    cd = "z";
+    tree = "eza --tree";
+    ".." = "cd ..";
+    "..." = "cd ../..";
+  };
+in
 {
  imports = [
    self.homeManagerModules.dotfiles
  ];

  home.packages = with pkgs; [
+    age
+    age-plugin-yubikey
    bottom
    btop
    comma
@@ -20,11 +36,13 @@
    eza
    fd
    glow
+    jjui
    lazygit
    nh
+    passage
+    rage
    ripgrep
    skim
-    taskwarrior3
    tealdeer
    vivid
    yazi
@@ -42,18 +60,12 @@
  programs.zsh = {
    enable = true;
    syntaxHighlighting.enable = true;
-    shellAliases = {
-      ls = "eza";
-      lsa = "ls -A";
-      ll = "ls -lh";
-      lla = "ls -lAh";
-      h = "hx";
-      g = "git";
-      cd = "z";
-      tree = "eza --tree";
-      ".." = "cd ..";
-      "..." = "cd ../..";
-    };
+    inherit shellAliases;
+  };
+
+  programs.fish = {
+    enable = true;
+    inherit shellAliases;
  };

  xdg.configFile."git".source = "${config.dotfiles.path}/.config/git";
--- a/home-manager/desktop/default.nix
+++ b/home-manager/desktop/default.nix
@@ -10,7 +10,6 @@
  home.packages = with pkgs; [
    discord
    seahorse
-    wofi-emoji
  ];

  home.pointerCursor = {
--- a/home-manager/desktop/sway.nix
+++ b/home-manager/desktop/sway.nix
@@ -1,32 +0,0 @@
-{
-  self,
-  config,
-  pkgs,
-  ...
-}:
-{
-  imports = [
-    self.homeManagerModules.dotfiles
-    ./wayland.nix
-  ];
-
-  home.packages = with pkgs; [
-    tofi
-    i3status-rust
-    wlsunset
-    kanshi
-    grim
-    slurp
-    playerctl
-    swaybg
-  ];
-
-  xdg.configFile = {
-    "sway".source = "${config.dotfiles.path}/.config/sway";
-    "swaylock".source = "${config.dotfiles.path}/.config/swaylock";
-    "swayidle".source = "${config.dotfiles.path}/.config/swayidle";
-    "kanshi".source = "${config.dotfiles.path}/.config/kanshi";
-    "i3status-rust".source = "${config.dotfiles.path}/.config/i3status-rust";
-    "tofi/config".source = "${config.dotfiles.path}/.config/tofi/config";
-  };
-}
--- a/home-manager/desktop/terminal.nix
+++ b/home-manager/desktop/terminal.nix
@@ -15,8 +15,7 @@
  ];

  programs.alacritty.enable = true;
-  xdg.configFile."alacritty/alacritty.toml".source =
-    "${config.dotfiles.path}/.config/alacritty/alacritty.toml";
+  xdg.configFile."alacritty".source = "${config.dotfiles.path}/.config/alacritty";

  xdg.configFile."ghostty/config".source = "${config.dotfiles.path}/.config/ghostty/config";
 }
--- a/home-manager/dev.nix
+++ b/home-manager/dev.nix
@@ -9,9 +9,11 @@
    ./cli.nix
    ./helix.nix
    self.homeManagerModules.dotfiles
+    self.inputs.direnv-instant.homeModules.direnv-instant
  ];

  home.packages = with pkgs; [
+    delta
    direnv
    gh
    hut
@@ -23,7 +25,7 @@
    radicle-tui
    typescript-language-server
    nil # Nix language server
-    nixfmt-rfc-style
+    nixfmt
    nixpkgs-review
  ];

@@ -33,6 +35,8 @@
    nix-direnv.enable = true;
  };

+  programs.direnv-instant.enable = true;
+
  xdg.configFile."hut/config".source = "${config.dotfiles.path}/.config/hut/config";
  home.file.".ssh/config".source = "${config.dotfiles.path}/.ssh/config";
 }
--- a/home-manager/mail/default.nix
+++ b/home-manager/mail/default.nix
@@ -1,4 +1,7 @@
 { config, ... }:
+let
+  pass = "passage";
+in
 {
  programs.thunderbird = {
    enable = true;
@@ -9,24 +12,44 @@
    };
  };

+  programs.aerc = {
+    enable = true;
+    # safe since the accounts file just contains commands for retrieving passwords and is readonly in the nix store
+    extraConfig.general.unsafe-accounts-conf = true;
+  };
+
  accounts.email.accounts = {
-    "rpqt@rpqt.fr" = {
+    "rpqt@rpqt.fr" = rec {
      address = "rpqt@rpqt.fr";
      realName = "Romain Paquet";
      primary = true;
      flavor = "migadu.com";
      thunderbird.enable = config.programs.thunderbird.enable;
+      aerc.enable = config.programs.aerc.enable;
+      passwordCommand = [
+        pass
+        "show"
+        "mail/${address}"
+      ];
+      folders.inbox = "INBOX";
    };

-    "admin@rpqt.fr" = {
+    "admin@rpqt.fr" = rec {
      address = "admin@rpqt.fr";
      aliases = [ "postmaster@rpqt.fr" ];
      realName = "Postmaster";
      flavor = "migadu.com";
      thunderbird.enable = config.programs.thunderbird.enable;
+      aerc.enable = config.programs.aerc.enable;
+      passwordCommand = [
+        pass
+        "show"
+        "mail/${address}"
+      ];
+      folders.inbox = "INBOX";
    };

-    "romain.paquet@grenoble-inp.org" = {
+    "romain.paquet@grenoble-inp.org" = rec {
      address = "romain.paquet@grenoble-inp.org";
      realName = "Romain Paquet";
      userName = "romain.paquet@grenoble-inp.org";
@@ -39,14 +62,26 @@
        port = 465;
      };
      thunderbird.enable = config.programs.thunderbird.enable;
+      aerc.enable = config.programs.aerc.enable;
+      passwordCommand = [
+        pass
+        "show"
+        "mail/${address}"
+      ];
+      folders.inbox = "INBOX";
    };

-    "admin@turifer.dev" = {
+    "admin@turifer.dev" = rec {
      address = "admin@turifer.dev";
      aliases = [ "postmaster@turifer.dev" ];
      realName = "Postmaster";
      flavor = "migadu.com";
      thunderbird.enable = config.programs.thunderbird.enable;
+      aerc.enable = config.programs.aerc.enable;
+      passwordCommand = [
+        pass
+        "mail/${address}"
+      ];
    };

    "romain@student.agh.edu.pl" = {
--- a/home/.config/alacritty/alacritty.toml
+++ b/home/.config/alacritty/alacritty.toml
@@ -1,6 +1,6 @@
 [general]
-live_config_reload = false
-import = ["~/.config/alacritty/themes/kanagawa_wave.toml"]
+live_config_reload = true
+import = ["~/.config/alacritty/themes/default_light.toml"]

 [font]
 size = 14
--- a/home/.config/alacritty/themes/default_light.toml
+++ b/home/.config/alacritty/themes/default_light.toml
@@ -0,0 +1,33 @@
+# Colors (Builtin Light)
+
+[colors.bright]
+black = '#555555'
+blue = '#5555ff'
+cyan = '#22cccc'
+green = '#2fd92f'
+magenta = '#ff55ff'
+red = '#ff5555'
+white = '#ffffff'
+yellow = '#bfbf15'
+
+[colors.cursor]
+cursor = '#000000'
+text = '#ffffff'
+
+[colors.normal]
+black = '#000000'
+blue = '#0000bb'
+cyan = '#00bbbb'
+green = '#00bb00'
+magenta = '#bb00bb'
+red = '#bb0000'
+white = '#bbbbbb'
+yellow = '#bbbb00'
+
+[colors.primary]
+background = '#ffffff'
+foreground = '#000000'
+
+[colors.selection]
+background = '#b5d5ff'
+text = '#000000'
--- a/home/.config/dotfiles/clone.sh
+++ b/home/.config/dotfiles/clone.sh
@@ -1,29 +0,0 @@
-#!/bin/sh
-
-DOTFILES_GIT_URL='git@git.sr.ht:~rpqt/dotfiles'
-
-# The first argument can be the destination folder
-if [ $# -eq 1 ]; then
-  DOTFILES_DIR="$1"
-else
-  DOTFILES_DIR="$HOME/.dotfiles"
-fi
-
-echo "$DOTFILES_DIR" >> "$HOME/.gitignore"
-
-git clone --bare "$DOTFILES_GIT_URL" "$DOTFILES_DIR"
-
-alias dotfiles='/usr/bin/git --git-dir=$DOTFILES_DIR --work-tree=$HOME'
-
-dotfiles config --local status.showUntrackedFiles no
-
-dotfiles checkout
-
-tee "$HOME/.config/git/config" >/dev/null <<EOT
-[include]
-  path = ~/.config/git/common.gitconfig
-  path = ~/.config/git/local.gitconfig
-EOT
-
-unset DOTFILES_DIR
-unset DOTFILES_GIT_URL
--- a/home/.config/helix/languages.toml
+++ b/home/.config/helix/languages.toml
@@ -58,3 +58,7 @@ auto-format = true
 [[language]]
 name = "vento"
 indent = { tab-width = 2, unit = "\t" }
+
+[[language]]
+name = "ocaml"
+auto-format = true
--- a/home/.config/i3bar-river/bottom-config.toml
+++ b/home/.config/i3bar-river/bottom-config.toml
@@ -1,6 +0,0 @@
-font = "JetBrains Mono NF Bold 12"
-height = 24
-background = "#000000"
-command = "i3status-rs ~/.config/i3status-rust/bottom-config.toml"
-position = "bottom"
-show_tags = false
--- a/home/.config/i3bar-river/config.toml
+++ b/home/.config/i3bar-river/config.toml
@@ -1,10 +0,0 @@
-font = "JetBrains Mono NF Bold 12"
-height = 24
-background = "#000000"
-command = "i3status-rs"
-tags_margin = 0.0
-tags_padding = 8.0
-tag_fg = "#727169"
-tag_bg = "#000000"
-tag_focused_fg = "#dcd7ba"
-tag_focused_bg = "#000000"
--- a/home/.config/kanshi/config
+++ b/home/.config/kanshi/config
@@ -1,5 +0,0 @@
-profile mirror-hdmi {
-    output eDP-1 enable mode 1920x1080 position 0,0
-    output HDMI-A-1 enable mode 1920x1080 position 1920,0
-    exec wl-present mirror eDP-1 --fullscreen-output HDMI-A-1 --fullscreen
-}
--- a/home/.config/niri/config.kdl
+++ b/home/.config/niri/config.kdl
@@ -25,6 +25,9 @@ input {
    focus-follows-mouse max-scroll-amount="0%"
 }

+workspace "browser" {
+}
+
 output "eDP-1" {
    mode "1920x1080@60.049"
    scale 1
@@ -72,6 +75,7 @@ cursor {
 window-rule {
    match app-id=r#"^firefox$"#
    open-maximized true
+    open-on-workspace "browser"
    focus-ring {
        off
    }
--- a/home/.config/sway/config
+++ b/home/.config/sway/config
@@ -1,2 +0,0 @@
-include ~/.config/sway/config.d/*
-include /etc/sway/config.d/*
--- a/home/.config/sway/config.d/bar
+++ b/home/.config/sway/config.d/bar
@@ -1,37 +0,0 @@
-include ~/.config/sway/kanagawa.sway
-
-set $font "JetBrains Mono NF Bold 12"
-set $background #000000
-
-bar {
-	id top_bar
-	status_command i3status-rs
-	position top
-	height 24
-	font $font
-	workspace_min_width 20
-	status_padding 0
-	status_edge_padding 0
-	colors {
-		background $background
-		focused_workspace #000000 #000000 $fujiWhite
-		active_workspace #000000 #000000 $fujiGray
-		inactive_workspace #000000 #000000 $fujiGray
-	}
-}
-
-bar {
-	id bottom_bar
-	status_command i3status-rs ~/.config/i3status-rust/bottom-config.toml
-	position bottom
-	height 24
-	font $font
-	workspace_buttons no
-	binding_mode_indicator no
-	tray_output none
-	colors {
-		background $background
-	}
-}
-
-# vim:ft=swayconfig
--- a/home/.config/sway/config.d/bindings
+++ b/home/.config/sway/config.d/bindings
@@ -1,169 +0,0 @@
-set $mod Mod4
-set $left h
-set $down j
-set $up k
-set $right l
-
-set $term alacritty msg create-window || alacritty
-set $launcher tofi-drun | xargs swaymsg exec --
-set $lock swaylock
-
-set $screenshots $HOME/Pictures/Screenshots
-
-floating_modifier $mod normal
-
-bindsym {
-    # Start a terminal
-    $mod+Return exec $term
-
-    # Kill focused window
-    $mod+Shift+q kill
-		$mod+w       kill
-
-    # Application launcher
-    $mod+d exec $launcher
-
-    # Reload the configuration file
-    $mod+Shift+c reload
-
-    # Exit sway / log out
-    $mod+Shift+e exec swaynag \
-		-t warning \
-		-m 'You pressed the exit shortcut. Do you really want to exit sway? This will end your Wayland session.' \
-		-B 'Yes, exit sway' 'swaymsg exit' \
-		--dismiss-button 'Cancel'
-
-    # Move focus
-    $mod+$left  focus left
-    $mod+$down  focus down
-    $mod+$up    focus up
-    $mod+$right focus right
-
-    $mod+Left   focus left
-    $mod+Down   focus down
-    $mod+Up     focus up
-    $mod+Right  focus right
-
-    # Move the focused window
-    $mod+Shift+$left  move left
-    $mod+Shift+$down  move down
-    $mod+Shift+$up    move up
-    $mod+Shift+$right move right
-
-    $mod+Shift+Left  move left
-    $mod+Shift+Down  move down
-    $mod+Shift+Up    move up
-    $mod+Shift+Right move right
-
-	--to-code {
-		# Switch to workspace
-		$mod+ampersand  workspace number 1
-		$mod+eacute     workspace number 2
-		$mod+quotedbl   workspace number 3
-		$mod+apostrophe workspace number 4
-		$mod+parenleft  workspace number 5
-		$mod+minus      workspace number 6
-		$mod+egrave     workspace number 7
-		$mod+underscore workspace number 8
-		$mod+ccedilla   workspace number 9
-		$mod+agrave     workspace number 10
-	}
-
-	# Move focused container to workspace
-	$mod+1 move container to workspace number 1
-	$mod+2 move container to workspace number 2
-	$mod+3 move container to workspace number 3
-	$mod+4 move container to workspace number 4
-	$mod+5 move container to workspace number 5
-	$mod+6 move container to workspace number 6
-	$mod+7 move container to workspace number 7
-	$mod+8 move container to workspace number 8
-	$mod+9 move container to workspace number 9
-	$mod+0 move container to workspace number 10
-	
-
-	$mod+Shift+1 move container to workspace number 1
-	$mod+Shift+2 move container to workspace number 2
-	$mod+Shift+3 move container to workspace number 3
-	$mod+Shift+4 move container to workspace number 4
-	$mod+Shift+5 move container to workspace number 5
-	$mod+Shift+6 move container to workspace number 6
-	$mod+Shift+7 move container to workspace number 7
-	$mod+Shift+8 move container to workspace number 8
-	$mod+Shift+9 move container to workspace number 9
-	$mod+Shift+0 move container to workspace number 10
-
-    # Split
-    $mod+b splith
-    $mod+v splitv
-
-    # Switch the current container between different layout styles
-    $mod+s layout stacking
-    $mod+t layout tabbed
-    $mod+m layout toggle split
-
-    # Toggle fullscreen on the current focus
-    $mod+f fullscreen
-
-    # Toggle floating mode for current container
-    $mod+Shift+f floating toggle
-
-    # Move focus to the parent container
-    $mod+a focus parent
-
-    # Move the focused window to the scratchpad
-    $mod+Shift+equal move scratchpad
-
-	# Cycle through scratchpad windows
-    $mod+equal scratchpad show
-
-	# Volume
-	XF86AudioRaiseVolume exec wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+ -l 1.0
-	XF86AudioLowerVolume exec wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%- -l 1.0
-	XF86AudioMute        exec wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle
-	XF86AudioMicMute     exec wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle
-
-	# Media
-	XF86AudioPlay exec playerctl play-pause
-	XF86AudioNext exec playerctl next
-	XF86AudioPrev exec playerctl previous
-	XF86Search    exec $launcher
-	
-	# Brightness
-	--locked {
-		XF86MonBrightnessDown exec brightnessctl set 5%-
-		XF86MonBrightnessUp   exec brightnessctl set +5%
-	}
-
-	# Lock
-	Ctrl+Mod4+L exec $lock
-
-	# Screenshot
-	## Full screen capture
-	Print             exec grim "$screenshots/$(date +\"Screenshot from %Y-%m-%d %H-%M-%S.png\")"
-
-	## Select a zone and save
-	$mod+Shift+s      exec grim -g "$(slurp -d)" "$screenshots/$(date +\"Screenshot from %Y-%m-%d %H-%M-%S.png\")"
-
-	## Select a zone and copy to clipboard
-	$mod+Shift+Ctrl+s exec grim -g "$(slurp -d)" - | wl-copy
-}
-
-mode "resize" bindsym {
-		# Shrink or grow the container
-		$left resize shrink width 10px
-	    $down resize grow height 10px
-	    $up resize shrink height 10px
-	    $right resize grow width 10px
-
-	    # Same with arrow keys
-	    Left resize shrink width 10px
-	    Down resize grow height 10px
-	    Up resize shrink height 10px
-	    Right resize grow width 10px
-
-	    # Return to default mode
-	    Return mode "default"
-	    Escape mode "default"
-}
-bindsym $mod+r mode "resize"
--- a/home/.config/sway/config.d/input
+++ b/home/.config/sway/config.d/input
@@ -1,17 +0,0 @@
-input "1267:12613:ASUE140C:00_04F3:3145_Keyboard" {
-    xkb_layout "fr,us(colemak_dh),us"
-	xkb_options grp:win_space_toggle
-}
-
-input "1:1:AT_Translated_Set_2_keyboard" {
-    xkb_layout "fr,us(colemak_dh),us"
-	xkb_options grp:win_space_toggle
-}
-
-input type:touchpad {
-    tap enabled
-    natural_scroll enabled
-}
-
-bindgesture swipe:right workspace prev
-bindgesture swipe:left workspace next
--- a/home/.config/sway/config.d/programs
+++ b/home/.config/sway/config.d/programs
@@ -1,16 +0,0 @@
-# Directory for received taildrop files
-set $taildrop_inbox $HOME/Downloads
-
-# Screen temperature
-exec wlsunset -l 45 -L 6
-
-# Notifications
-exec mako
-
-# Output management
-exec kanshi
-
-# Auto receive taildrop files
-exec tailscale file get --loop --conflict=rename $taildrop_inbox
-
-exec swayidle -w
--- a/home/.config/sway/config.d/theme
+++ b/home/.config/sway/config.d/theme
@@ -1,22 +0,0 @@
-include ~/.config/sway/kanagawa.sway
-
-default_border pixel 3
-smart_borders on
-titlebar_border_thickness 2
-font "JetBrains Mono NF 11"
-
-gaps outer 0
-gaps inner 0
-
-set $waveBlue3 #3D5F77
-set $waveBlue4 #6D8FA7
-
-# class                  border     background text       indicator  child_border
-client.focused_inactive  $sumiInk2  $sumiInk1  $fujiWhite $sumiInk2  $sumiInk2
-client.unfocused         $sumiInk2  $sumiInk1  $fujiWhite $sumiInk2  $sumiInk2
-client.focused           $waveBlue3 $waveBlue2 $fujiWhite $waveBlue4 $waveBlue2
-client.focused_tab_title $waveBlue2 $waveBlue2 $fujiWhite
-
-for_window [app_id="firefox"] border none
-
-output * bg ~/.local/state/wallpaper fill
--- a/home/.config/sway/kanagawa.sway
+++ b/home/.config/sway/kanagawa.sway
@@ -1,110 +0,0 @@
-# Default foreground
-set $fujiWhite      #DCD7BA
-
-# Dark foreground (statuslines)
-set $oldWhite 	    #C8C093
-
-# Dark background (statuslines and floating windows)
-set $sumiInk0 	    #16161D
-
-# Default background
-set $sumiInk1 	    #1F1F28
-
-# Lighter background (colorcolumn, folds)
-set $sumiInk2 	    #2A2A37
-
-# Lighter background (cursorline)
-set $sumiInk3 	    #363646
-
-# Darker foreground (line numbers, fold column, non-text characters), float borders
-set $sumiInk4 	    #54546D
-
-# Popup background, visual selection background
-set $waveBlue1 	    #223249
-
-# Popup selection background, search background
-set $waveBlue2 	    #2D4F67
-
-# Diff Add (background)
-set $winterGreen    #2B3328
-
-# Diff Change (background)
-set $winterYellow   #49443C
-
-# Diff Deleted (background)
-set $winterRed 	    #43242B
-
-# Diff Line (background)
-set $winterBlue     #252535
-
-# Git Add
-set $autumnGreen    #76946A
-
-# Git Delete
-set $autumnRed 	    #C34043
-
-# Git Change
-set $autumnYellow   #DCA561
-
-# Diagnostic Error
-set $samuraiRed     #E82424
-
-# Diagnostic Warning
-set $roninYellow    #FF9E3B
-
-# Diagnostic Info
-set $waveAqua1 	    #6A9589
-
-# Diagnostic Hint
-set $dragonBlue     #658594
-
-# Comments
-set $fujiGray 	    #727169
-
-# Light foreground
-set $springViolet1  #938AA9
-
-# Statements and Keywords
-set $oniViolet 	    #957FB8
-
-# Functions and Titles
-set $crystalBlue    #7E9CD8
-
-# Brackets and punctuation
-set $springViolet2  #9CABCA
-
-# Specials and builtin functions
-set $springBlue     #7FB4CA
-
-# Not used
-set $lightBlue 	    #A3D4D5
-
-# Types
-set $waveAqua2 	    #7AA89F
-
-# Strings
-set $springGreen    #98BB6C
-
-# Not used
-set $boatYellow1    #938056
-
-# Operators, RegEx
-set $boatYellow2    #C0A36E
-
-# Identifiers
-set $carpYellow     #E6C384
-
-# Numbers
-set $sakuraPink     #D27E99
-
-# Standout specials 1 (builtin variables)
-set $waveRed 	    #E46876
-
-# Standout specials 2 (exception handling, return)
-set $peachRed 	    #FF5D62
-
-# Constants, imports, booleans
-set $surimiOrange   #FFA066
-
-# Deprecated
-set $katanaGray     #717C7C
--- a/home/.config/swayidle/config
+++ b/home/.config/swayidle/config
@@ -1,10 +0,0 @@
-# This will lock the screen after 300 seconds of inactivity.
-timeout 300 "swaylock -f"
-
-# Turn off all displays after another 300 seconds.
-# and turn them back on when resumed.
-timeout 600 "swaymsg 'output * dpms off'" resume "swaymsg 'output * dpms on'"
-
-# Lock the screen before the computer goes to sleep.
-before-sleep "playerctl pause"
-before-sleep "swaylock -f"
--- a/home/.config/swaylock/config
+++ b/home/.config/swaylock/config
@@ -1,29 +0,0 @@
-daemonize
-font=JetBrains Mono NF
-font-size=22
-image=~/.local/state/wallpaper
-
-ring-color=FFFFFF55
-ring-clear-color=FFFFFF55
-ring-ver-color=1885d4
-ring-wrong-color=FF0000
-
-key-hl-color=FFFFFF
-
-inside-color=00000000
-inside-clear-color=00000000
-inside-ver-color=00000000
-inside-wrong-color=00000000
-
-line-uses-inside
-separator-color=00000000
-
-layout-bg-color=00000000
-layout-text-color=FFFFFF
-
-text-color=FFFFFF
-text-clear-color=FFFFFF
-text-ver-color=FFFFFF
-text-wrong-color=FFFFFF
-
-indicator-radius=100
--- a/home/.config/task/taskrc
+++ b/home/.config/task/taskrc
@@ -1,4 +0,0 @@
-data.location=~/.local/share/task
-hooks.location=~/.config/task/hooks
-
-include ~/.config/task/sync
--- a/home/.config/tofi/config
+++ b/home/.config/tofi/config
@@ -1,176 +0,0 @@
-#
-### Fonts
-#
-	# Font to use, either a path to a font file or a name.
-	#
-	# If a path is given, tofi will startup much quicker, but any
-	# characters not in the chosen font will fail to render.
-	#
-	# Otherwise, fonts are interpreted in Pango format.
-	font = "JetBrainsMono NF"
-
-	# Point size of text.
-	font-size = 15
-
-	# Perform font hinting. Only applies when a path to a font has been
-	# specified via `font`. Disabling font hinting speeds up text
-	# rendering appreciably, but will likely look poor at small font pixel
-	# sizes.
-	hint-font = true
-
-#
-### Colors
-#
-	# Window background
-	background-color = #111111DD
-
-	# Border outlines
-	outline-color = #080800
-
-	# Border
-	border-color = #0981E3
-
-	# Default text
-	text-color = #C5C9C7
-
-	# Selection text
-	selection-color = #0981E3
-
-	# Matching portion of selection text
-	selection-match-color = #44BBFF
-
-	# Selection background
-	selection-background = #00000000
-
-#
-### Text layout
-#
-	# Prompt to display.
-	prompt-text = "run: "
-
-	# Extra horizontal padding between prompt and input.
-	prompt-padding = 0
-
-	# Maximum number of results to display.
-	# If 0, tofi will draw as many results as it can fit in the window.
-	num-results = 0
-
-	# Spacing between results in pixels. Can be negative.
-	result-spacing = 8
-
-	# List results horizontally.
-	horizontal = false
-
-	# Minimum width of input in horizontal mode.
-	min-input-width = 0
-
-	# Extra horizontal padding of the selection background in pixels.
-	selection-background-padding = 0
-
-#
-### Window layout
-#
-	# Width and height of the window. Can be pixels or a percentage.
-	width = 100%
-	height = 100%
-
-	# Width of the border outlines in pixels.
-	outline-width = 0
-
-	# Width of the border in pixels.
-	border-width = 0
-
-	# Radius of window corners in pixels.
-	corner-radius = 0
-
-	# Padding between borders and text. Can be pixels or a percentage.
-	padding-top = 200
-	padding-bottom = 0
-	padding-left = 35%
-	padding-right = 0
-
-	# Whether to scale the window by the output's scale factor.
-	scale = true
-
-#
-### Window positioning
-#
-	# The name of the output to appear on. An empty string will use the
-	# default output chosen by the compositor.
-	output = ""
-
-	# Location on screen to anchor the window to.
-	#
-	# Supported values: top-left, top, top-right, right, bottom-right,
-	# bottom, bottom-left, left, center.
-	anchor = center
-
-	# Set the size of the exclusive zone.
-	#
-	# A value of -1 means ignore exclusive zones completely.
-	# A value of 0 will move tofi out of the way of other windows' zones.
-	# A value greater than 0 will set that much space as an exclusive zone.
-	#
-	# Values greater than 0 are only meaningful when tofi is anchored to a
-	# single edge.
-	exclusive-zone = -1
-
-	# Window offset from edge of screen. Only has an effect when anchored
-	# to the relevant edge. Can be pixels or a percentage.
-	margin-top = 0
-	margin-bottom = 0
-	margin-left = 0
-	margin-right = 0
-
-#
-### Behaviour
-#
-	# Hide the cursor.
-	hide-cursor = false
-
-	# Sort results by number of usages in run and drun modes.
-	history = true
-
-	# Use fuzzy matching for searches.
-	fuzzy-match = false
-
-	# If true, require a match to allow a selection to be made. If false,
-	# making a selection with no matches will print input to stdout.
-	# In drun mode, this is always true.
-	require-match = true
-
-	# If true, typed input will be hidden, and what is displayed (if
-	# anything) is determined by the hidden-character option.
-	hide-input = false
-
-	# Replace displayed input characters with a character. If the empty
-	# string is given, input will be completely hidden.
-	# This option only has an effect when hide-input is set to true.
-	hidden-character = "*"
-
-	# If true, directly launch applications on selection when in drun mode.
-	# Otherwise, just print the command line to stdout.
-	drun-launch = false
-
-	# The terminal to run terminal programs in when in drun mode.
-	# This option has no effect if drun-launch is set to true.
-	# Defaults to the value of the TERMINAL environment variable.
-	# terminal = foot
-
-	# Delay keyboard initialisation until after the first draw to screen.
-	# This option is experimental, and will cause tofi to miss keypresses
-	# for a short time after launch. The only reason to use this option is
-	# performance on slow systems.
-	late-keyboard-init = false
-
-	# If true, allow multiple simultaneous processes.
-	# If false, create a lock file on startup to prevent multiple instances
-	# from running simultaneously.
-	multi-instance = false
-
-#
-### Inclusion
-#
-	# Configs can be split between multiple files, and then included
-	# within each other.
-	# include = /path/to/config
--- a/home/.ssh/config
+++ b/home/.ssh/config
@@ -1,11 +1,11 @@
 Host crocus
-	HostName crocus.home.rpqt.fr
+	HostName crocus.val
 	User root

 Host verbena
-	HostName verbena.home.rpqt.fr
+	HostName verbena.val
 	User root

 Host genepi
-	HostName genepi.home.rpqt.fr
+	HostName genepi.val
 	User root
--- a/home/bin/switch-helix-theme.sh
+++ b/home/bin/switch-helix-theme.sh
@@ -6,10 +6,24 @@ HELIX_CONFIG_PATH=$(readlink -f "${HOME}/.config/helix/config.toml")
 HELIX_THEME_LIGHT="zed_onelight"
 HELIX_THEME_DARK="kanagawa"

+ALACRITTY_CONFIG_PATH=$(readlink -f "${HOME}/.config/alacritty/alacritty.toml")
+ALACRITTY_THEME_LIGHT="default_light"
+ALACRITTY_THEME_DARK="kanagawa_wave"
+
+set_helix_theme() {
+  sed -i "s/^theme .*/theme = \"$1\"/" "$HELIX_CONFIG_PATH"
+}
+
+set_alacritty_theme() {
+  sed -i "s/^import .*/import = \[\"\~\/\.config\/alacritty\/themes\/$1\.toml\"\]/" "$ALACRITTY_CONFIG_PATH"
+}
+
 if [[ "$2" == "prefer-dark" ]]; then
-  sed -i "s/^theme .*/theme = \"$HELIX_THEME_DARK\"/" "$HELIX_CONFIG_PATH"
+  set_helix_theme "$HELIX_THEME_DARK"
+  sey_alacritty_theme "$HELIX_THEME_DARK"
 else
-  sed -i "s/^theme .*/theme = \"$HELIX_THEME_LIGHT\"/" "$HELIX_CONFIG_PATH"
+  set_helix_theme "$HELIX_THEME_LIGHT"
+  set_alacritty_theme "$HELIX_THEME_LIGHT"
 fi

 pkill -USR1 hx || true
--- a/infra/.terraform.lock.hcl
+++ b/infra/.terraform.lock.hcl
@@ -1,83 +1,16 @@
 # This file is maintained automatically by "tofu init".
 # Manual edits may be lost in future updates.

-provider "registry.opentofu.org/go-gandi/gandi" {
-  version     = "2.3.0"
-  constraints = "2.3.0"
+provider "registry.opentofu.org/hashicorp/external" {
+  version = "2.3.5"
  hashes = [
-    "h1:9kqWL+eFk/ogrQSltL9zVqjMcOqbvs3EgIJEeyNPb8U=",
-    "zh:0936d011cf75bb5162c6027d00575a586807adc9008f4152def157b6ad22bae9",
-    "zh:2170e671f04d3346ea416fcc404be6d05f637eab7df77e289a6898a928885f0b",
-    "zh:250329baae3cb09cfb88dd004d45f003ba76fbe7b8daf9d18fd640b93a2b7252",
-    "zh:2ccd9f253424738ca5fbbcb2127bf3713c20e87bfb3829f8c4565569424fd0bd",
-    "zh:3607b48bc4691cd209528f9ffe16a6cc666bd284b0d0bdfe8c4e1d538559a408",
-    "zh:3bc1d2b770fe0f50027da59c405b2468d1322243235367014f75f765124f458d",
-    "zh:6c8a9092847ee2e2890825432b54424c456638d494e49b7d1845f055214714f5",
-    "zh:8e0b62a330876005d52bcd65d7b1d9a679a7ac79c626e0f86661519e8f9b5698",
-    "zh:8f44f4d52583ff249e2001ea2a8b8841010489dd43e1a01a9ec3a6813d121c28",
-    "zh:9a617927d4a3a2897ff10999a19a6d1f0ef634b8c6b8fc3be12cf53948cfd9cf",
-    "zh:cab3c82c54e38e6001eed5b80a2d16b7824921f8f8b3909049e174c48e6e8804",
-    "zh:f78cc685aa4ba5056ea53a7f8ce585f87a911f0a8a387a44a33d7dfb69db7663",
-  ]
-}
-
-provider "registry.opentofu.org/hashicorp/assert" {
-  version = "0.16.0"
-  hashes = [
-    "h1:2jeV46S9jN2rk0GXOa+HGNlVvyWzaB3wz0T65elbjOc=",
-    "zh:3c04d08d1bb4ae810b7972a219c8dd42a8ab901a9bc25197b250c38f3fa57033",
-    "zh:46119bcc47b545809c0ee873a72d44f4f875cca4d7228605f5c7a8956a5e7d55",
-    "zh:511949ee8a6ac8ff7296b4c9778deb2aec2783f5b85c4f27382a3b623fc50a4a",
-    "zh:b4ebb8b832bae26443880d2e17493f754495db2d6c3f02c6d0070cbf5ae21598",
-    "zh:bebed6c1873871eb824103f08e72055c077f01b10a40944760d19ffdd721d9ab",
-    "zh:e412855fd2fd81e0a847e45308bdbac99995315c503fdddf262ee59e1b7c5263",
-    "zh:ed47c4fe28c6f148f11fa4098516abea008c49fa670c3cedd2ff94596cac0831",
-    "zh:edee914b1d12ac6db241a1fecaa5186c47f361f4ceb2deb23ad45d67bf95c7b1",
-    "zh:eff5b2e1c2128217bdbc600eda4fe011831e5c655bf4acd84b6495fc20d128d3",
-    "zh:ff64424784171a3361b1ea95d8cef334ec1c4a395812edd0a77a1ed6b4119b0f",
+    "h1:en/2hMK/W/2hKtsEkbxGiiYwi/pSPS/UoGDILHIHjmw=",
  ]
 }

 provider "registry.opentofu.org/hetznercloud/hcloud" {
-  version     = "1.52.0"
-  constraints = "~> 1.45"
+  version = "1.58.0"
  hashes = [
-    "h1:LTjrLuC+4F1Kv4TxS9e7LVVkG8/S4QQ7X4ORblvKTbc=",
-    "zh:1e9bb6b6a2ea5f441638dbae2d60fbe04ff455f58a18c740b8b7913e2197d875",
-    "zh:29c122e404ba331cfbadacc7f1294de5a31c9dfd60bdfe3e1b402271fc8e419c",
-    "zh:2bd0ae2f0bb9f16b7753f59a08e57ac7230f9c471278d7882f81406b9426c8c7",
-    "zh:4383206971873f6b5d81580a9a36e0158924f5816ebb6206b0cf2430e4e6a609",
-    "zh:47e2ca1cfa18500e4952ab51dc357a0450d00a92da9ea03e452f1f3efe6bbf75",
-    "zh:8e9fe90e3cea29bb7892b64da737642fc22b0106402df76c228a3cbe99663278",
-    "zh:a2d69350a69c471ddb63bcc74e105e585319a0fc0f4d1b7f70569f6d2ece5824",
-    "zh:a97abcc254e21c294e2d6b0fc9068acfd63614b097dda365f1c56ea8b0fd5f6b",
-    "zh:aba8d72d4fe2e89c922d5446d329e5c23d00b28227b4666e6486ba18ea2ec278",
-    "zh:ad36c333978c2d9e4bc43dcadcbff42fe771a8c5ef53d028bcacec8287bf78a7",
-    "zh:cdb1e6903b9d2f0ad8845d4eb390fbe724ee2435fb045baeab38d4319e637682",
-    "zh:df77b08757f3f36b8aadb33d73362320174047044414325c56a87983f48b5186",
-    "zh:e07513d5ad387247092b5ae1c87e21a387fc51873b3f38eee616187e38b090a7",
-    "zh:e2be02bdc59343ff4b9e26c3b93db7680aaf3e6ed13c8c4c4b144c74c2689915",
-  ]
-}
-
-provider "registry.opentofu.org/ovh/ovh" {
-  version     = "2.5.0"
-  constraints = "2.5.0"
-  hashes = [
-    "h1:CrmFEWjczVhLWc2qzOktKSu8Q0U78uV8fnSHo54lMQg=",
-    "zh:1a11c3bc191c3417b41af5c56a66ac7071980f7babb390096b43aab3ac60fe7c",
-    "zh:1d46fa7c37468becb01d117463838f694a093e58a9b7d28347db2c377933db76",
-    "zh:22b83b15e878a9627477fe49e03dada3f4cd4357cb91cdb621394da690238542",
-    "zh:316541fc8bbf2fe14f4a484d878c63e4b949bd21a352e0ebf60d4848c96a338e",
-    "zh:50e72847a4b1d532e7abd5669408832ac1b49dcfda266378b8e2419d97f0f49a",
-    "zh:7582c8630edb3e83642e7a4b06fababeaf4833ce622c71220c38724d0e0231af",
-    "zh:a26714d6bd8e04acbbc94c708b151405c4b6fc20dc7060e0daef8395f1bb9ce0",
-    "zh:aa8be95462c5ca909c923cc3d44636eccc71cb25b51572fe7e2f68bc93c57612",
-    "zh:b520c0661c514586b2aa3105c4345eda4d34ef08b62fda2cc20a2bcb8cb88ab2",
-    "zh:be8125f1b6bc8aa93441ec9dd96db5f49d21b4dcc100c13028404b461da545c9",
-    "zh:c6aab9b6b04fa8483aa10c194eaab8e4a1fbffc64ad495f5027d496e5b2da214",
-    "zh:d537d85afc71c51d86b1031586c619c503df9462e0240d94984bc32273a03df2",
-    "zh:eaa9f41d33fa7731c4a937e80554a1b6b2042d273705e4c8fc983ba251193206",
-    "zh:f0d085065a0ada787ad080ddd6e7c646b8ca3a351712961de735d18c9d59af7c",
+    "h1:6C2LNEvCyGPyWgALDAFTNbRp+5Iuikd4Ju1Xejh+aeg=",
  ]
 }
--- a/infra/base.nix
+++ b/infra/base.nix
@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  terraform.required_providers.hcloud.source = "hetznercloud/hcloud";
+
+  data.external.hcloud-token = {
+    program = [
+      (lib.getExe (
+        pkgs.writeShellApplication {
+          name = "get-clan-secret";
+          text = ''
+            jq -n --arg secret "$(clan secrets get hcloud-token)" '{"secret":$secret}'
+          '';
+        }
+      ))
+    ];
+  };
+
+  provider.hcloud.token = config.data.external.hcloud-token "result.secret";
+}
--- a/infra/crocus.tf
+++ b/infra/crocus.tf
@@ -1,68 +0,0 @@
-resource "hcloud_server" "crocus_server" {
-  name         = "crocus"
-  server_type  = "cx22"
-  datacenter   = "nbg1-dc3"
-  image        = "ubuntu-20.04"
-  firewall_ids = [hcloud_firewall.crocus_firewall.id]
-  public_net {
-    ipv4 = hcloud_primary_ip.crocus_ipv4.id
-  }
-}
-
-resource "hcloud_primary_ip" "crocus_ipv4" {
-  name          = "crocus_ipv4"
-  type          = "ipv4"
-  datacenter    = "nbg1-dc3"
-  assignee_type = "server"
-  auto_delete   = true
-}
-
-resource "hcloud_firewall" "crocus_firewall" {
-  name = "crocus-firewall"
-
-  rule {
-    direction  = "in"
-    protocol   = "icmp"
-    source_ips = ["0.0.0.0/0", "::/0"]
-  }
-
-  rule {
-    direction  = "in"
-    protocol   = "tcp"
-    port       = "22"
-    source_ips = ["0.0.0.0/0", "::/0"]
-  }
-
-  rule {
-    direction  = "in"
-    protocol   = "tcp"
-    port       = "22"
-    source_ips = ["0.0.0.0/0", "::/0"]
-  }
-
-  rule {
-    direction  = "in"
-    protocol   = "tcp"
-    port       = "80"
-    source_ips = ["0.0.0.0/0", "::/0"]
-  }
-
-  rule {
-    direction  = "in"
-    protocol   = "tcp"
-    port       = "443"
-    source_ips = ["0.0.0.0/0", "::/0"]
-  }
-
-  # radicle-node
-  rule {
-    direction  = "in"
-    protocol   = "tcp"
-    port       = "8776"
-    source_ips = ["0.0.0.0/0", "::/0"]
-  }
-}
-
-output "crocus_ipv4" {
-  value = hcloud_primary_ip.crocus_ipv4.ip_address
-}
--- a/infra/dns.nix
+++ b/infra/dns.nix
@@ -0,0 +1,20 @@
+{ config, ... }:
+{
+  resource.hcloud_zone.rpqt_fr = {
+    name = "rpqt.fr";
+    mode = "primary";
+  };
+
+  resource.hcloud_zone.turifer_dev = {
+    name = "turifer.dev";
+    mode = "primary";
+  };
+
+  output.rpqt_fr_zone_name = {
+    value = config.resource.hcloud_zone.rpqt_fr "name";
+  };
+
+  output.turifer_dev_zone_name = {
+    value = config.resource.hcloud_zone.turifer_dev "name";
+  };
+}
--- a/infra/dns.tf
+++ b/infra/dns.tf
@@ -1,66 +0,0 @@
-data "gandi_livedns_domain" "rpqt_fr" {
-  name = "rpqt.fr"
-}
-
-resource "gandi_livedns_record" "rpqt_fr_radicle_a" {
-  zone = data.gandi_livedns_domain.rpqt_fr.id
-  name = "radicle"
-  type = "A"
-  ttl  = 10800
-  values = [
-    hcloud_server.crocus_server.ipv4_address,
-  ]
-}
-
-resource "gandi_livedns_record" "rpqt_fr_radicle_aaaa" {
-  zone = data.gandi_livedns_domain.rpqt_fr.id
-  name = "radicle"
-  type = "AAAA"
-  ttl  = 10800
-  values = [
-    hcloud_server.crocus_server.ipv6_address,
-  ]
-}
-
-resource "gandi_livedns_record" "rpqt_fr_cloud_a" {
-  zone   = data.gandi_livedns_domain.rpqt_fr.id
-  name   = "cloud"
-  type   = "A"
-  ttl    = 10800
-  values = local.verbena_ipv4_addresses
-}
-
-resource "gandi_livedns_record" "rpqt_fr_cloud_aaaa" {
-  zone   = data.gandi_livedns_domain.rpqt_fr.id
-  name   = "cloud"
-  type   = "AAAA"
-  ttl    = 10800
-  values = local.verbena_ipv6_addresses
-}
-
-data "ovh_vps" "verbena_vps" {
-  service_name = "vps-7e78bac2.vps.ovh.net"
-}
-
-data "ovh_domain_zone" "turifer_dev" {
-  name = "turifer.dev"
-}
-
-resource "ovh_domain_zone_import" "turifer_dev_import" {
-  zone_name = "turifer.dev"
-  zone_file = local.turifer_dev_zone_file
-}
-
-locals {
-  verbena_ipv4_addresses = [for ip in data.ovh_vps.verbena_vps.ips : ip if provider::assert::ipv4(ip)]
-  verbena_ipv6_addresses = [for ip in data.ovh_vps.verbena_vps.ips : ip if provider::assert::ipv6(ip)]
-
-  turifer_dev_zone_file = templatefile("./templates/turifer.dev.zone", {
-    crocus_ipv4_address = hcloud_server.crocus_server.ipv4_address
-    crocus_ipv6_address = hcloud_server.crocus_server.ipv6_address
-
-    verbena_ipv4_addresses = local.verbena_ipv4_addresses
-    verbena_ipv6_addresses = local.verbena_ipv6_addresses
-  })
-}
-
--- a/infra/flake-module.nix
+++ b/infra/flake-module.nix
@@ -1,7 +1,28 @@
+{ self, ... }:
 {
+  perSystem =
+    { pkgs, ... }:
+    {
+      terranix.terranixConfigurations.infra = {
+        terraformWrapper.package = pkgs.opentofu.withPlugins (p: [
+          p.hashicorp_external
+          p.hetznercloud_hcloud
+        ]);
+
+        extraArgs = { inherit (self) infra; };
+        modules = [
+          ./base.nix
+          ./dns.nix
+          ./mail.nix
+          ./radicle.nix
+          ./web.nix
+        ];
+      };
+    };
+
  flake.infra =
    let
-      tf_outputs = builtins.fromJSON (builtins.readFile ../infra/outputs.json);
+      tf_outputs = builtins.fromJSON (builtins.readFile ./outputs.json);
    in
    {
      machines = {
@@ -12,6 +33,7 @@
        };
        crocus = {
          ipv4 = tf_outputs.crocus_ipv4.value;
+          ipv6 = "2a01:4f8:1c1e:e415::1";
        };
      };
    };
--- a/infra/lib.nix
+++ b/infra/lib.nix
@@ -0,0 +1,88 @@
+{ lib, ... }:
+let
+  mkMigaduDkim = zone: name: {
+    inherit zone;
+    name = "${name}._domainkey";
+    type = "CNAME";
+    records = [
+      { value = "${name}.${zone}._domainkey.migadu.com."; }
+    ];
+  };
+in
+{
+  mkMigadu_hcloud_zone_rrset = zone: hostedEmailVerify: {
+    dkim_1 = mkMigaduDkim zone "key1";
+    dkim_2 = mkMigaduDkim zone "key2";
+    dkim_3 = mkMigaduDkim zone "key3";
+
+    spf = {
+      inherit zone;
+      name = "@";
+      type = "TXT";
+      records = [
+        {
+          value = lib.tf.ref ''provider::hcloud::txt_record("v=spf1 include:spf.migadu.com -all")'';
+        }
+        {
+          value = lib.tf.ref ''provider::hcloud::txt_record("hosted-email-verify=${hostedEmailVerify}")'';
+        }
+      ];
+    };
+
+    dmarc = {
+      inherit zone;
+      name = "_dmarc";
+      type = "TXT";
+      records = [
+        {
+          value = lib.tf.ref ''provider::hcloud::txt_record("v=DMARC1; p=quarantine;")'';
+        }
+      ];
+    };
+
+    mx = {
+      inherit zone;
+      name = "@";
+      type = "MX";
+      records = [
+        { value = "10 aspmx1.migadu.com."; }
+        { value = "20 aspmx2.migadu.com."; }
+      ];
+    };
+
+    autoconfig = {
+      inherit zone;
+      name = "autoconfig";
+      type = "CNAME";
+      records = [ { value = "autoconfig.migadu.com."; } ];
+    };
+
+    autodiscover = {
+      inherit zone;
+      name = "_autodiscover._tcp";
+      type = "SRV";
+      records = [ { value = "0 1 443 autodiscover.migadu.com."; } ];
+    };
+
+    submissions = {
+      inherit zone;
+      name = "_submissions._tcp";
+      type = "SRV";
+      records = [ { value = "0 1 465 smtp.migadu.com."; } ];
+    };
+
+    imaps = {
+      inherit zone;
+      name = "_imaps._tcp";
+      type = "SRV";
+      records = [ { value = "0 1 993 imap.migadu.com."; } ];
+    };
+
+    pop3s = {
+      inherit zone;
+      name = "_pop3s._tcp";
+      type = "SRV";
+      records = [ { value = "0 1 995 pop.migadu.com."; } ];
+    };
+  };
+}
--- a/infra/mail.nix
+++ b/infra/mail.nix
@@ -0,0 +1,15 @@
+{ config, lib, ... }:
+let
+  inherit (import ./lib.nix { inherit lib; })
+    mkMigadu_hcloud_zone_rrset
+    ;
+  rpqt_fr = mkMigadu_hcloud_zone_rrset (config.resource.hcloud_zone.rpqt_fr "name") "pgeaq3bp";
+
+  # Prefix resource names with zone name to avoid collision
+  turifer_dev = lib.mapAttrs' (name: value: lib.nameValuePair "turifer_dev_${name}" value) (
+    mkMigadu_hcloud_zone_rrset (config.resource.hcloud_zone.turifer_dev "name") "k5z4lcfc"
+  );
+in
+{
+  resource.hcloud_zone_rrset = rpqt_fr // turifer_dev;
+}
--- a/infra/main.tf
+++ b/infra/main.tf
@@ -1,19 +0,0 @@
-terraform {
-  required_providers {
-    gandi = {
-      source  = "go-gandi/gandi"
-      version = "2.3.0"
-    }
-    hcloud = {
-      source  = "hetznercloud/hcloud"
-      version = "~> 1.45"
-    }
-    ovh = {
-      source  = "ovh/ovh"
-      version = "2.5.0"
-    }
-    assert = {
-      source = "hashicorp/assert"
-    }
-  }
-}
--- a/infra/providers.tf
+++ b/infra/providers.tf
@@ -1,13 +0,0 @@
-provider "gandi" {
-  personal_access_token = var.gandi_token
-}
-
-provider "hcloud" {
-  token = var.hcloud_token
-}
-
-provider "ovh" {
-  endpoint      = "ovh-eu"
-  client_id     = var.ovh_client_id
-  client_secret = var.ovh_client_secret
-}
--- a/infra/radicle.nix
+++ b/infra/radicle.nix
@@ -0,0 +1,52 @@
+{
+  config,
+  infra,
+  lib,
+  ...
+}:
+{
+  resource.hcloud_zone_rrset =
+    let
+      zone = config.resource.hcloud_zone.rpqt_fr "name";
+    in
+    {
+      radicle_a = {
+        inherit zone;
+        name = "radicle";
+        type = "A";
+        records = [ { value = infra.machines.crocus.ipv4; } ];
+      };
+
+      radicle_aaaa = {
+        inherit zone;
+        name = "radicle";
+        type = "AAAA";
+        records = [ { value = infra.machines.crocus.ipv6; } ];
+      };
+
+      radicles_srv = {
+        inherit zone;
+        name = "seed._radicle-node._tcp";
+        type = "SRV";
+        records = [ { value = "32767 32767 58776 radicle.rpqt.fr."; } ];
+      };
+
+      radicles_nid = {
+        inherit zone;
+        name = "seed._radicle-node._tcp";
+        type = "TXT";
+        records = [
+          {
+            value = lib.tf.ref ''provider::hcloud::txt_record("nid=z6MkuivFHDPg6Bd25v4bEWm7T7qLUYMWk1eVTE7exvum5Rvd")'';
+          }
+        ];
+      };
+
+      radicle_ptr = {
+        inherit zone;
+        name = "_radicle-node._tcp";
+        type = "PTR";
+        records = [ { value = "seed._radicle-node._tcp.radicle.rpqt.fr."; } ];
+      };
+    };
+}
--- a/infra/templates/turifer.dev.zone
+++ b/infra/templates/turifer.dev.zone
@@ -1,39 +0,0 @@
-$TTL 3600
-@	IN SOA dns100.ovh.net. tech.ovh.net. (2025071505 86400 3600 3600000 60)
-    IN NS     dns100.ovh.net.
-	IN NS     ns100.ovh.net.
-
-turifer.dev. 3000 IN TXT "hosted-email-verify=k5z4lcfc"
-turifer.dev. 3000 IN MX 10 aspmx1.migadu.com.
-turifer.dev. 3000 IN MX 20 aspmx2.migadu.com.
-turifer.dev. 3000 IN TXT "v=spf1 include:spf.migadu.com -all"
-key1._domainkey.turifer.dev. 3000 IN CNAME key1.turifer.dev._domainkey.migadu.com.
-key2._domainkey.turifer.dev. 3000 IN CNAME key2.turifer.dev._domainkey.migadu.com.
-key3._domainkey.turifer.dev. 3000 IN CNAME key3.turifer.dev._domainkey.migadu.com.
-_dmarc.turifer.dev. 3000 IN TXT "v=DMARC1; p=quarantine;"
-autoconfig.turifer.dev. 3000 IN CNAME autoconfig.migadu.com.
-_autodiscover._tcp.turifer.dev. 3000 IN SRV 0 1 443 autodiscover.migadu.com.
-_submissions._tcp.turifer.dev. 3000 IN SRV 0 1 465 smtp.migadu.com.
-_imaps._tcp.turifer.dev. 3000 IN SRV 0 1 993 imap.migadu.com.
-_pop3s._tcp.turifer.dev. 3000 IN SRV 0 1 995 pop.migadu.com.
-
-%{ for addr in verbena_ipv4_addresses ~}
-git.turifer.dev. 10800 IN A ${addr}
-%{ endfor ~}
-%{ for addr in verbena_ipv6_addresses ~}
-git.turifer.dev. 10800 IN AAAA ${addr}
-%{ endfor ~}
-
-%{ for addr in verbena_ipv4_addresses ~}
-buildbot.turifer.dev. 10800 IN A ${addr}
-%{ endfor ~}
-%{ for addr in verbena_ipv6_addresses ~}
-buildbot.turifer.dev. 10800 IN AAAA ${addr}
-%{ endfor ~}
-
-%{ for addr in verbena_ipv4_addresses ~}
-wg1.turifer.dev. 10800 IN A ${addr}
-%{ endfor ~}
-%{ for addr in verbena_ipv6_addresses ~}
-wg1.turifer.dev. 10800 IN AAAA ${addr}
-%{ endfor ~}
--- a/infra/variables.tf
+++ b/infra/variables.tf
@@ -1,15 +0,0 @@
-variable "gandi_token" {
-  sensitive = true
-}
-
-variable "hcloud_token" {
-  sensitive = true
-}
-
-variable "ovh_client_id" {
-  sensitive = true
-}
-
-variable "ovh_client_secret" {
-  sensitive = true
-}
--- a/infra/verbena.tf
+++ b/infra/verbena.tf
@@ -1,20 +0,0 @@
-output "verbena_ipv4" {
-  value = local.verbena_ipv4_addresses[0]
-}
-
-output "verbena_ipv6" {
-  value = local.verbena_ipv6_addresses[0]
-}
-
-output "verbena_gateway6" {
-  value = local.gateway6
-}
-
-locals {
-  hextets      = 4
-  parts        = split(":", local.verbena_ipv6_addresses[0])
-  prefix_parts = slice(local.parts, 0, local.hextets)
-  prefix_str   = join(":", local.prefix_parts)
-  gateway6     = "${local.prefix_str}::1"
-}
-
--- a/infra/web.nix
+++ b/infra/web.nix
@@ -0,0 +1,96 @@
+{ config, infra, ... }:
+{
+  resource.hcloud_zone_rrset =
+    let
+      sourcehut_pages = {
+        ipv4 = "46.23.81.157";
+        ipv6 = "2a03:6000:1813:1337::157";
+      };
+      zone = config.resource.hcloud_zone.rpqt_fr "name";
+    in
+    {
+      a = {
+        inherit zone;
+        name = "@";
+        type = "A";
+        records = [ { value = sourcehut_pages.ipv4; } ];
+      };
+
+      aaaa = {
+        inherit zone;
+        name = "@";
+        type = "AAAA";
+        records = [ { value = sourcehut_pages.ipv6; } ];
+      };
+
+      cloud_a = {
+        inherit zone;
+        name = "cloud";
+        type = "A";
+        records = [ { value = infra.machines.verbena.ipv4; } ];
+      };
+
+      cloud_aaaa = {
+        inherit zone;
+        name = "cloud";
+        type = "AAAA";
+        records = [ { value = infra.machines.verbena.ipv6; } ];
+      };
+
+      git_turifer_dev_a = {
+        zone = config.resource.hcloud_zone.turifer_dev "name";
+        name = "git";
+        type = "A";
+        records = [ { value = infra.machines.verbena.ipv4; } ];
+      };
+
+      git_turifer_dev_aaaa = {
+        zone = config.resource.hcloud_zone.turifer_dev "name";
+        name = "git";
+        type = "AAAA";
+        records = [ { value = infra.machines.verbena.ipv6; } ];
+      };
+
+      git_rpqt_fr_a = {
+        zone = config.resource.hcloud_zone.rpqt_fr "name";
+        name = "git";
+        type = "A";
+        records = [ { value = infra.machines.verbena.ipv4; } ];
+      };
+
+      git_rpqt_fr_aaaa = {
+        zone = config.resource.hcloud_zone.rpqt_fr "name";
+        name = "git";
+        type = "AAAA";
+        records = [ { value = infra.machines.verbena.ipv6; } ];
+      };
+
+      buildbot_turifer_dev_a = {
+        zone = config.resource.hcloud_zone.turifer_dev "name";
+        name = "buildbot";
+        type = "A";
+        records = [ { value = infra.machines.verbena.ipv4; } ];
+      };
+
+      buildbot_turifer_dev_aaaa = {
+        zone = config.resource.hcloud_zone.turifer_dev "name";
+        name = "buildbot";
+        type = "AAAA";
+        records = [ { value = infra.machines.verbena.ipv6; } ];
+      };
+
+      wg1_turifer_dev_a = {
+        zone = config.resource.hcloud_zone.turifer_dev "name";
+        name = "wg1";
+        type = "A";
+        records = [ { value = infra.machines.verbena.ipv4; } ];
+      };
+
+      wg1_turifer_dev_aaaa = {
+        zone = config.resource.hcloud_zone.turifer_dev "name";
+        name = "wg1";
+        type = "AAAA";
+        records = [ { value = infra.machines.verbena.ipv6; } ];
+      };
+    };
+}
--- a/machines/genepi/actual.nix
+++ b/machines/genepi/actual.nix
@@ -1,4 +1,7 @@
 { config, ... }:
+let
+  domain = "actual.val";
+in
 {
  services.actual = {
    enable = true;
@@ -8,12 +11,14 @@
    };
  };

-  services.nginx.virtualHosts."actual.home.rpqt.fr" = {
+  services.nginx.virtualHosts.${domain} = {
    forceSSL = true;
-    useACMEHost = "home.rpqt.fr";
+    enableACME = true;
    locations."/".proxyPass =
      "http://127.0.0.1:${builtins.toString config.services.actual.settings.port}";
  };

-  clan.core.state.acutal.folders = [ "/var/lib/actual" ];
+  security.acme.certs.${domain}.server = "https://ca.val/acme/acme/directory";
+
+  clan.core.state.actual.folders = [ "/var/lib/actual" ];
 }
--- a/machines/genepi/configuration.nix
+++ b/machines/genepi/configuration.nix
@@ -12,7 +12,6 @@
    ./homeassistant.nix
    ./immich.nix
    ./monitoring
-    ./mpd.nix
    ./network.nix
    ./nginx.nix
    ./pinchflat.nix
--- a/machines/genepi/freshrss.nix
+++ b/machines/genepi/freshrss.nix
@@ -1,13 +1,13 @@
 { config, ... }:
 let
-  domain = "home.rpqt.fr";
-  subdomain = "rss.${domain}";
+  tld = "val";
+  domain = "rss.${tld}";
 in
 {
  services.freshrss = {
    enable = true;
-    baseUrl = "https://${subdomain}";
-    virtualHost = "${subdomain}";
+    baseUrl = "https://${domain}";
+    virtualHost = "${domain}";

    defaultUser = "rpqt";
    passwordFile = config.clan.core.vars.generators.freshrss.files.freshrss-password.path;
@@ -15,9 +15,11 @@ in

  services.nginx.virtualHosts.${config.services.freshrss.virtualHost} = {
    forceSSL = true;
-    useACMEHost = "${domain}";
+    enableACME = true;
  };

+  security.acme.certs.${domain}.server = "https://ca.${tld}/acme/acme/directory";
+
  clan.core.vars.generators.freshrss = {
    prompts.freshrss-password = {
      description = "freshrss default user password";
--- a/machines/genepi/glance-config.nix
+++ b/machines/genepi/glance-config.nix
@@ -1,3 +1,4 @@
+{ tld }:
 {
  theme = {
    light = true;
@@ -41,22 +42,22 @@
              sites = [
                {
                  title = "Immich";
-                  url = "https://images.home.rpqt.fr";
+                  url = "https://images.${tld}";
                  icon = "sh:immich";
                }
                {
                  title = "FreshRSS";
-                  url = "https://rss.home.rpqt.fr";
+                  url = "https://rss.${tld}";
                  icon = "sh:freshrss";
                }
                {
                  title = "Syncthing";
-                  url = "https://genepi.home.rpqt.fr/syncthing";
+                  url = "https://genepi.${tld}/syncthing";
                  icon = "sh:syncthing";
                }
                {
                  title = "Actual Budget";
-                  url = "https://actual.home.rpqt.fr";
+                  url = "https://actual.${tld}";
                  icon = "sh:actual-budget";
                }
                {
@@ -64,14 +65,19 @@
                  url = "https://git.turifer.dev";
                  icon = "sh:gitea";
                }
+                {
+                  title = "Forgejo";
+                  url = "https://git.rpqt.fr";
+                  icon = "sh:forgejo";
+                }
                {
                  title = "Pinchflat";
-                  url = "https://pinchflat.home.rpqt.fr";
+                  url = "https://pinchflat.${tld}";
                  icon = "https://cdn.jsdelivr.net/gh/selfhst/icons/png/pinchflat.png";
                }
                {
                  title = "Home Assistant";
-                  url = "https://assistant.home.rpqt.fr";
+                  url = "https://assistant.${tld}";
                  icon = "sh:home-assistant";
                }
                {
@@ -98,12 +104,12 @@
              sites = [
                {
                  title = "Grafana";
-                  url = "https://grafana.home.rpqt.fr";
+                  url = "https://grafana.${tld}";
                  icon = "sh:grafana";
                }
                {
                  title = "Prometheus";
-                  url = "http://genepi.home.rpqt.fr:9090";
+                  url = "http://genepi.${tld}:9090";
                  icon = "sh:prometheus";
                }
              ];
@@ -115,7 +121,7 @@
              sites = [
                {
                  title = "Lounge";
-                  url = "https://lounge.home.rpqt.fr";
+                  url = "https://lounge.${tld}";
                  icon = "si:html5";
                }
                {
@@ -178,7 +184,7 @@
              cache = "12h";
              feeds = [
                {
-                  url = "https://rss.home.rpqt.fr/api/query.php?user=rpqt&t=74HfeLZ6Wu9h4MmjNR38Rz&f=rss";
+                  url = "https://rss.${tld}/api/query.php?user=rpqt&t=74HfeLZ6Wu9h4MmjNR38Rz&f=rss";
                }
              ];
            }
--- a/machines/genepi/glance.nix
+++ b/machines/genepi/glance.nix
@@ -1,18 +1,20 @@
 { config, ... }:
 let
-  domain = "home.rpqt.fr";
-  subdomain = "glance.${domain}";
+  tld = "val";
+  domain = "glance.${tld}";
 in
 {
  services.glance = {
    enable = true;
-    settings = ./glance-config.nix;
+    settings = (import ./glance-config.nix) { inherit tld; };
  };

-  services.nginx.virtualHosts.${subdomain} = {
+  services.nginx.virtualHosts.${domain} = {
    forceSSL = true;
-    useACMEHost = "${domain}";
+    enableACME = true;
    locations."/".proxyPass =
      "http://127.0.0.1:${toString config.services.glance.settings.server.port}";
  };
+
+  security.acme.certs.${domain}.server = "https://ca.${tld}/acme/acme/directory";
 }
--- a/machines/genepi/homeassistant.nix
+++ b/machines/genepi/homeassistant.nix
@@ -1,7 +1,7 @@
 { config, ... }:
 let
-  domain = "home.rpqt.fr";
-  subdomain = "assistant.${domain}";
+  tld = "val";
+  domain = "assistant.${tld}";
 in
 {
  services.home-assistant = {
@@ -26,9 +26,9 @@ in
    };
  };

-  services.nginx.virtualHosts.${subdomain} = {
+  services.nginx.virtualHosts.${domain} = {
    forceSSL = true;
-    useACMEHost = "${domain}";
+    enableACME = true;
    extraConfig = ''
      proxy_buffering off;
    '';
@@ -37,4 +37,6 @@ in
      proxyWebsockets = true;
    };
  };
+
+  security.acme.certs.${domain}.server = "https://ca.${tld}/acme/acme/directory";
 }
--- a/machines/genepi/immich.nix
+++ b/machines/genepi/immich.nix
@@ -1,19 +1,19 @@
 { config, ... }:
 let
-  domain = "home.rpqt.fr";
-  subdomain = "images.${domain}";
+  tld = "val";
+  domain = "images.${tld}";
 in
 {
  services.immich = {
    enable = true;
    settings = {
-      server.externalDomain = "https://${subdomain}";
+      server.externalDomain = "https://${domain}";
    };
  };

-  services.nginx.virtualHosts.${subdomain} = {
+  services.nginx.virtualHosts.${domain} = {
    forceSSL = true;
-    useACMEHost = "${domain}";
+    enableACME = true;
    locations."/" = {
      proxyPass = "http://${toString config.services.immich.host}:${toString config.services.immich.port}";
      proxyWebsockets = true;
@@ -26,5 +26,7 @@ in
    };
  };

+  security.acme.certs.${domain}.server = "https://ca.${tld}/acme/acme/directory";
+
  clan.core.state.immich.folders = [ "/var/lib/immich" ];
 }
--- a/machines/genepi/monitoring/grafana.nix
+++ b/machines/genepi/monitoring/grafana.nix
@@ -1,6 +1,6 @@
 { config, ... }:
 let
-  domain = "home.rpqt.fr";
+  tld = "val";
 in
 {
  services.grafana = {
@@ -8,7 +8,7 @@ in
    settings = {
      server = {
        http_port = 3000;
-        domain = "grafana.${domain}";
+        domain = "grafana.${tld}";
      };
    };
    provision = {
@@ -31,10 +31,13 @@ in

  services.nginx.virtualHosts.${config.services.grafana.settings.server.domain} = {
    forceSSL = true;
-    useACMEHost = "${domain}";
+    enableACME = true;
    locations."/" = {
      proxyPass = "http://127.0.0.1:${toString config.services.grafana.settings.server.http_port}";
      proxyWebsockets = true;
    };
  };
+
+  security.acme.certs.${config.services.grafana.settings.server.domain}.server =
+    "https://ca.${tld}/acme/acme/directory";
 }
--- a/machines/genepi/mpd.nix
+++ b/machines/genepi/mpd.nix
@@ -1,27 +0,0 @@
-{ config, ... }:
-{
-  services.mpd = {
-    enable = true;
-    musicDirectory = "/home/rpqt/Media/Music";
-    extraConfig = ''
-      audio_output {
-        type "pulse"
-        name "Pulse Audio"
-      }
-    '';
-
-    network.listenAddress = "any";
-  };
-
-  services.pulseaudio.enable = true;
-
-  # Workaround: run PulseAudio system-wide so that the mpd user can access it
-  services.pulseaudio.systemWide = true;
-
-  # Fixes the stutter when changing volume (found this randomly)
-  services.pulseaudio.daemon.config.flat-volumes = "no";
-
-  users.users.${config.services.mpd.user}.extraGroups = [ "pulse-access" ];
-
-  users.users.rpqt.homeMode = "755";
-}
--- a/machines/genepi/pinchflat.nix
+++ b/machines/genepi/pinchflat.nix
@@ -3,6 +3,10 @@
  pkgs,
  ...
 }:
+let
+  tld = "val";
+  domain = "pinchflat.${tld}";
+in
 {
  services.pinchflat = {
    enable = true;
@@ -23,9 +27,11 @@

  clan.core.state.pinchflat.folders = [ "/var/lib/pinchflat" ];

-  services.nginx.virtualHosts."pinchflat.home.rpqt.fr" = {
+  services.nginx.virtualHosts.${domain} = {
    forceSSL = true;
-    useACMEHost = "home.rpqt.fr";
+    enableACME = true;
    locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.services.pinchflat.port}";
  };
+
+  security.acme.certs.${domain}.server = "https://ca.${tld}/acme/acme/directory";
 }
--- a/machines/genepi/syncthing.nix
+++ b/machines/genepi/syncthing.nix
@@ -1,31 +1,41 @@
 {
  config,
  lib,
+  pkgs,
  ...
 }:
 let
  user = "rpqt";
  home = config.users.users.${user}.home;
-  domain = "home.rpqt.fr";
-  subdomain = "genepi.${domain}";
+  tld = "val";
+  domain = "genepi.${tld}";
 in
 {

-  services.nginx.virtualHosts.${subdomain} = {
+  services.nginx.virtualHosts.${domain} = {
    forceSSL = true;
-    useACMEHost = "${domain}";
-    locations."/syncthing".proxyPass = "http://${config.services.syncthing.guiAddress}";
+    enableACME = true;
+    locations."/syncthing" = {
+      proxyPass = "http://${config.services.syncthing.guiAddress}";
+    };
  };

+  security.acme.certs.${domain}.server = "https://ca.${tld}/acme/acme/directory";
+
  services.syncthing = {
    enable = true;
    user = user;
    group = lib.mkForce "users";
    dataDir = home;
    configDir = lib.mkForce "${home}/.config/syncthing";
+    guiAddress = "0.0.0.0:8384";
    guiPasswordFile = config.clan.core.vars.generators.syncthing-gui.files.password.path;
  };

+  networking.firewall.interfaces.wireguard = {
+    allowedTCPPorts = [ 8384 ];
+  };
+
  clan.core.vars.generators.syncthing-gui = {
    files.password = {
      secret = true;
--- a/machines/haze/configuration.nix
+++ b/machines/haze/configuration.nix
@@ -18,6 +18,7 @@

    self.nixosModules.desktop
    self.nixosModules.dev
+    self.nixosModules.lanzaboote
    self.nixosModules.nix-defaults

    self.inputs.home-manager.nixosModules.home-manager
@@ -36,7 +37,8 @@
  clan.core.networking.targetHost = "rpqt@haze.local";

  networking.search = [
-    "home.rpqt.fr"
+    "val"
+    "wireguard"
  ];

  time.timeZone = "Europe/Paris";
--- a/machines/haze/sway.nix
+++ b/machines/haze/sway.nix
@@ -1,11 +0,0 @@
-{
-  services.gnome.gnome-keyring.enable = true;
-
-  programs.sway = {
-    enable = true;
-    wrapperFeatures.gtk = true;
-  };
-
-  users.users."rpqt".extraGroups = [ "video" ];
-  programs.light.enable = true;
-}
--- a/machines/verbena/configuration.nix
+++ b/machines/verbena/configuration.nix
@@ -4,6 +4,8 @@
    self.nixosModules.nix-defaults
    self.nixosModules.nextcloud
    self.nixosModules.gitea
+    self.nixosModules.forgejo
+    self.nixosModules.vaultwarden

    self.inputs.srvos.nixosModules.server

--- a/modules/acme-home.nix
+++ b/modules/acme-home.nix
@@ -1,26 +1,34 @@
-{ config, lib, ... }:
 {
-  imports = [
-    ./gandi.nix
-  ];
-
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
  security.acme = {
    acceptTerms = true;
    defaults.email = lib.mkDefault "admin@rpqt.fr";
  };

-  security.acme = {
-    certs."home.rpqt.fr" = {
-      group = config.services.nginx.group;
-      domain = "home.rpqt.fr";
-      extraDomainNames = [ "*.home.rpqt.fr" ];
-      dnsProvider = "gandiv5";
-      dnsPropagationCheck = true;
-      environmentFile = config.clan.core.vars.generators.gandi.files.gandi-env.path;
-      email = "admin@rpqt.fr";
-      dnsResolver = "1.1.1.1:53";
-    };
-  };
+  # security.acme = {
+  #   certs."home.rpqt.fr" = {
+  #     group = config.services.nginx.group;
+  #     domain = "home.rpqt.fr";
+  #     extraDomainNames = [ "*.home.rpqt.fr" ];
+  #     dnsProvider = "rfc2136";
+  #     dnsPropagationCheck = true;
+  #     credentialFiles = {
+  #       RFC2136_TSIG_SECRET_FILE = config.clan.core.vars.generators.coredns.files.tsig-key.path;
+  #     };
+  #     environmentFile = pkgs.writeFile ''
+  #       RFC2136_NAMESERVER=fd28:387a:90:c400::1
+  #     '';
+  #     email = "admin@rpqt.fr";
+  #     dnsResolver = "1.1.1.1:53";
+  #     server = "https://acme-staging-v02.api.letsencrypt.org/directory"; # TODO: use production api
+  # };
+  # };

-  clan.core.vars.generators.gandi.files.gandi-env.owner = "acme";
+  # clan.core.vars.generators.coredns.files.tsig-key.group = "acme";
+  # clan.core.vars.generators.coredns.files.tsig-key.mode = "0440";
 }
--- a/modules/desktop.nix
+++ b/modules/desktop.nix
@@ -20,4 +20,6 @@
    enable = true;
    terminal = "ghostty";
  };
+
+  services.pcscd.enable = true;
 }
--- a/modules/flake-module.nix
+++ b/modules/flake-module.nix
@@ -1,31 +1,28 @@
 { lib, ... }:
 {
-  flake.nixosModules = {
-    gitea.imports = [
-      ./gitea.nix
-    ];
+  flake.nixosModules =
+    (
+      (builtins.readDir ./.)
+      |> lib.filterAttrs (path: type: type == "regular" && (lib.hasSuffix ".nix" path))
+      |> lib.mapAttrs' (
+        path: _: {
+          name = lib.removeSuffix ".nix" path;
+          value = {
+            imports = [ ./${path} ];
+          };
+        }
+      )
+    )
+    // {
+      server.imports = [
+        ./motd.nix
+      ];

-    desktop.imports = [
-      ./desktop.nix
-    ];
-
-    dev.imports = [ ./dev.nix ];
-    nix-defaults.imports = [ ./nix-defaults.nix ];
-    tailscale.imports = [ ./tailscale.nix ];
-    user-rpqt.imports = [ ./user-rpqt.nix ];
-    hardened-ssh-server.imports = [ ./hardened-ssh-server.nix ];
-    nextcloud.imports = [ ./nextcloud.nix ];
-    radicle.imports = [ ./radicle.nix ];
-
-    server.imports = [
-      ./motd.nix
-    ];
-
-    common.imports = [
-      {
-        users.mutableUsers = lib.mkDefault false;
-        services.userborn.enable = lib.mkDefault true;
-      }
-    ];
-  };
+      common.imports = [
+        {
+          users.mutableUsers = lib.mkDefault false;
+          services.userborn.enable = lib.mkDefault true;
+        }
+      ];
+    };
 }
--- a/modules/forgejo.nix
+++ b/modules/forgejo.nix
@@ -0,0 +1,75 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.forgejo;
+in
+{
+  services.forgejo = {
+    enable = true;
+    lfs.enable = true;
+
+    settings = {
+      # storage = {
+      # };
+
+      server = {
+        ROOT_URL = "https://${cfg.settings.server.DOMAIN}";
+        DOMAIN = "git.rpqt.fr";
+        HTTP_PORT = 3001;
+      };
+
+      session.PROVIDER = "db";
+      session.COOKIE_SECURE = true;
+
+      service.DISABLE_REGISTRATION = true;
+
+      # Create a repository by pushing to it
+      repository.ENABLE_PUSH_CREATE_USER = true;
+    };
+  };
+
+  systemd.services.forgejo.environment = {
+    FORGEJO__storage__STORAGE_TYPE = "minio";
+    FORGEJO__storage__MINIO_ENDPOINT = "localhost:3900";
+    FORGEJO__storage__MINIO_BUCKET = "forgejo";
+    FORGEJO__storage__MINIO_LOCATION = "garage";
+    FORGEJO__storage__MINIO_USE_SSL = "false";
+  };
+
+  systemd.services.forgejo.serviceConfig = {
+    LoadCredential = [
+      "minio_access_key_id:${config.clan.core.vars.generators.forgejo-s3-storage.files.access-key-id.path}"
+      "minio_secret_access_key:${config.clan.core.vars.generators.forgejo-s3-storage.files.access-key-secret.path}"
+    ];
+    Environment = [
+      "FORGEJO__storage__MINIO_ACCESS_KEY_ID__FILE=%d/minio_access_key_id"
+      "FORGEJO__storage__MINIO_SECRET_ACCESS_KEY__FILE=%d/minio_secret_access_key"
+    ];
+  };
+
+  clan.core.vars.generators.forgejo-s3-storage = {
+    prompts.access-key-id = {
+      description = "s3 access key id";
+      type = "line";
+      persist = true;
+    };
+    prompts.access-key-secret = {
+      description = "s3 access key secret";
+      type = "hidden";
+      persist = true;
+    };
+  };
+
+  clan.core.state.forgejo.folders = [ config.services.forgejo.stateDir ];
+
+  services.nginx.virtualHosts."git.rpqt.fr" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://localhost:${builtins.toString (cfg.settings.server.HTTP_PORT)}";
+    };
+  };
+
+  security.acme.certs."git.rpqt.fr" = {
+    email = "admin@rpqt.fr";
+  };
+}
--- a/modules/gandi.nix
+++ b/modules/gandi.nix
@@ -1,15 +0,0 @@
-{
-  clan.core.vars.generators.gandi = {
-    prompts.gandi-token = {
-      description = "gandi access token";
-      type = "hidden";
-    };
-    files.gandi-env = {
-      secret = true;
-    };
-    script = ''
-      printf %s "GANDIV5_PERSONAL_ACCESS_TOKEN=" >> $out/gandi-env
-      cat $prompts/gandi-token >> $out/gandi-env
-    '';
-  };
-}
--- a/modules/lanzaboote.nix
+++ b/modules/lanzaboote.nix
@@ -0,0 +1,23 @@
+{
+  self,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  imports = [
+    self.inputs.lanzaboote.nixosModules.lanzaboote
+  ];
+
+  environment.systemPackages = [
+    # For debugging and troubleshooting Secure Boot.
+    pkgs.sbctl
+  ];
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/var/lib/sbctl";
+  };
+}
--- a/modules/lounge.nix
+++ b/modules/lounge.nix
@@ -1,7 +1,13 @@
+let
+  tld = "val";
+  domain = "lounge.${tld}";
+in
 {
-  services.nginx.virtualHosts."lounge.home.rpqt.fr" = {
-    useACMEHost = "home.rpqt.fr";
+  services.nginx.virtualHosts.${domain} = {
+    enableACME = true;
    forceSSL = true;
    root = "/var/www/lounge";
  };
+
+  security.acme.certs.${domain}.server = "https://ca.${tld}/acme/acme/directory";
 }
--- a/modules/nextcloud.nix
+++ b/modules/nextcloud.nix
@@ -34,7 +34,7 @@ in
    };
    extraAppsEnable = true;
    extraApps = {
-      # inherit (pkgs.nextcloud32Packages.apps) tasks;
+      inherit (config.services.nextcloud.package.packages.apps) tasks contacts calendar;
    };
  };

--- a/modules/nix-defaults.nix
+++ b/modules/nix-defaults.nix
@@ -9,6 +9,7 @@
    experimental-features = [
      "nix-command"
      "flakes"
+      "pipe-operators"
    ];

    trusted-users = [
--- a/modules/user-rpqt.nix
+++ b/modules/user-rpqt.nix
@@ -8,7 +8,7 @@

    description = "Romain Paquet";

-    shell = pkgs.zsh;
+    shell = pkgs.fish;

    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGa8R8obgptefcp27Cdp9bc2fiyc9x0oTfMsTPFp2ktE rpqt@haze"
@@ -17,5 +17,5 @@
    extraGroups = [ "wheel" ];
  };

-  programs.zsh.enable = true;
+  programs.fish.enable = true;
 }
--- a/modules/vaultwarden.nix
+++ b/modules/vaultwarden.nix
@@ -0,0 +1,18 @@
+{
+  config,
+  ...
+}:
+{
+  services.vaultwarden = {
+    enable = true;
+    domain = "vaultwarden.val";
+    configureNginx = true;
+  };
+
+  services.nginx.virtualHosts.${config.services.vaultwarden.domain} = {
+    enableACME = true;
+  };
+
+  security.acme.certs.${config.services.vaultwarden.domain}.server =
+    "https://ca.val/acme/acme/directory";
+}
--- a/sops/secrets/crocus-age.key/secret
+++ b/sops/secrets/crocus-age.key/secret
@@ -2,9 +2,17 @@
 	"data": "ENC[AES256_GCM,data:EGb773Q1F0hvpduV6UcOAhSy8ypN/r2ixBkazycuqY6AJmq9wGIMF40z6uWuUuy+19C4dN6pdwnJLGw4S/3qxrFGKHMFtVbKK0E=,iv:6ByZiSBUUtONGzgO8tbKzdeNlBMI0OnPLMigSeIO634=,tag:G1M64/oWQmxZydhMI9Mo/A==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBNGFLK0d4\nZ2JCdGdkYWd5TFpKNHpCODNCNGdYdzlwb1hzY1lQMzltV1cvZQpML1BJOXU0UUxo\nUnBGb0hSUG45OFovWmQwbzhjK2Y2MlpCanE1WDdiVkhvCi0tLSBGWEFRa05FM1RH\nNXdpT0hBK2JFU040UGdhWTVkcGxYV2p0SitHencrMkRVCsneAeYc6WjBDpM14O6x\n/Ru/3fh8zl908fjqcrr+UPaIXLD/2r7rgzfUGIROrWJwh8yos22atAWG4O0UGQQa\n8Pw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiTU5xN05kWlJuRFViT1lC\nSmxqSlNWTGVtTXhTS2o0Tm4xS05JUUkwK0dBClI5UVhna3Z3Q0NVODZVVW9aN2lG\nb05MbEw1SnVCcWpWNnVBNlRYMVZEQzQKLS0tIExvUFNhVUFxQkl3a1JrQjdOdlBq\nRzM1NDVzY0YvNEp6WWtnYTJYTXBWWGsKJlGXl/TadohSrjH9FEKvr8JMN13GDUl7\nN7OmOuy/2MxXXr2ChTJnmt+1is9Bj/52/oRH3m+yE6lAOb6eDMBgWA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUQ1FwSDFQZS93UUNUVFIz\nVUNjMjVQTUpQRXRaRVNJZzVCYjV3OFBFY1Z3CnpabE1CRm8xV0VuWm9EaU5qZ2RT\nb1FBUEgvcVN4RE51di95b1hiT1A3QTAKLS0tICtOWDRqbElaajJ0NDkzS1YyanpC\nOHdnMHB3Z0pRWEtYWUpDUjJFaTdzRHMKUg9bfInt/5mSBhVOhE99yYTsCXZ6CHjd\nKeu/K56gDMa93m4nPVubZjD7p3KareDRSjMW0/aY5Mf2QnY8nlk8wg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBbVFINDFx\nM3kvSEpqYkJHT2FFN2xORFYyNncrQnBZcWRIWkd3YVJwUTRuTwpQYlhtWDVCTllq\nK1NLeC9TWWtYd1VMNzZFLytiZjVNV1pIRk9VcjdhNXV3Ci0tLSBya1h5cDRncUJS\nU2NyOFpzWW1ZS3EvdkthRkxyOVBTdG44K1g3QUY3UzF3Ch8tbkMxoiee+PKYxAQu\ncdybSzHGDDhY9uEsFAycFDx5GLybVQoCxo6JxC9J59koFQz58WaXT2pKqo0mMw8r\ntCA=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-05-09T22:28:02Z",
--- a/sops/secrets/genepi-age.key/secret
+++ b/sops/secrets/genepi-age.key/secret
@@ -2,9 +2,17 @@
 	"data": "ENC[AES256_GCM,data:/fLnn5tEMlasoykvgvfjXJSMVFO1b7LMEDXEzw8mV2m6J8eyW0QMLIwfZFoe52ZOe7JC3RCRpEY7ei9UhZVJzLmewbVT5ziN55c=,iv:XW3LIFunMbEv1eQbLfBx7AgS6y8Pdp0/OF0juhq+boU=,tag:RVMEaWp8ilc6rTDW7N73vQ==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBcit3SDVV\nbUhnT2doYW5SK1ZrMkk4eHk1U3pKMnRQUGZnZ3NBck9LWGxzeAp3ZjRtczV2Nml5\nMDdYZGc3VUNMOU8vbXg5WTJDZUVYRVFiNDd1d1M5c2p3Ci0tLSBOeVora1R2Vms0\nSmhpTU1kM29MYlZ1Mi8zYlZxSmF5dkNLc3N1RjBselNvCvfEkfg+xXIR+M+xlK7r\nmmDG7DLm5v6v31Jthcn36ORKHBS6256j/mteMO8ftHwMwtvw55lmDWkQrtFuaX/J\nz5E=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiMnJNZ1EyeHVYa0pTdUNa\nOFlVRUo4SjY0WXlDUGVLK0V5VEdpMEQyT0ZrCldhOUpWL2x1Sjhrd3NMRUNMVy9B\nTkhFWXVaMWttQm9YWlhmdDl2MzlpODQKLS0tIE1GM0hCQjBwMGI4cVRXWUtVQUtC\nY3ZvZ256YytFbksvRE9GdHA0c0Ewb2cK9D6HssuN4aXDgg7zHdCIdlcOE9wseEkf\nswmuk6YcMbwORDIwVi8deM5MRerxGhSUo64vQup4O6ivBJdPh+jvyg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHejRPeXJoazIzd2xHZDBM\neEplanpuOFAxQ0Z2djRQRXIxcDJkZ3IxcHc0CmtlMGk2YVdUM0ZpZjdCQS9JcVFa\nTnFQV3RjbUptc2p5NnJEOGx0SVYwNmsKLS0tIFZlcXE1amliUEdBQVV3WDhobnpx\nNUIxc3ZjR3QxdlBQeXFZcDNmQlI1WmcKBKsLCbVVeyEy+9vNKOPjAruf8AlDzvat\nWjUjRy3YyjTRiRINaZz/7YOzcr0w14Jo9+GMBF/gX4exXtm4p0KPDQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBdXRFSlVU\nSlZIcyswckQzMXN0Qk55K1oyZ0pnREloYUZmM2VkSFhscUdFSgp3c3FWbDV3RWhB\nUU5oQTZOWFVVaU5wSHZiVUVEd25vekNSMDdVeEp6K0NzCi0tLSBMOFVSMGF3eEF3\nNXJrQUlIeG56Vkp5a3FjeFV5WkZ1eUtvQUV5bW83VnpjChSpqwUxZqox60+TkzUk\nTuaGGABkRDyyy+rL0jkVHZvh8gfF8WAe5M+TXHsXMHBN0XDhCulLKgXDkjiPDAtO\n2uA=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-05-15T13:43:50Z",
--- a/sops/secrets/haze-age.key/secret
+++ b/sops/secrets/haze-age.key/secret
@@ -2,9 +2,17 @@
 	"data": "ENC[AES256_GCM,data:g7js1FA6umKogdeqrE6VeJeqkIza7gPGX89aB7j4l33nPSGkZ6h8qR2j1fGqggwgolRVbEfszgIJYXrZ2dzzy8HGKQ2kQmQbgaw=,iv:LHGGVVFSRkuMxvCDM4VxxMF2MaNinRJGpIqO5w5mMzA=,tag:YjHpGPPWGhDz6g8+Rm1x0w==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBK1VnY1pu\nY0tJODhZSkg5aEdKangyT3VFb2pYZnpMNklNTmJYZzdVOGdzRgpzMUU4Rld2eWJp\nekNobGhES0VVb0tjbEVQb3k5elptR2QvMW1WdzZTVGdvCi0tLSA3ZC8zazF6cngr\nS3dzSmtGSks4WVlTRVB0NzdtcmcyTTd1UlFTcTJrdlpjChpFftWShZE5WfA4s2IJ\nYB/0ybfkJZ/PZwIaTc2LjLv93b+/XwHYqqfelbm5Xbzk2NP2zAkgHez/gAo20LCL\nQVk=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxbTZ3K20xWDNIWEd4TkVZ\nN1I5Ry9CWGgzYWt5Q21kWHQvM3VWK0NkalFFCnM3Um5WZVJJSldPK294ZUYvbG52\nNmk0SlRhQWNkWmNWbzB4cGtmdVNjWGsKLS0tIDI3N3V6dStMRVlobzhMbkttb0Zs\nVW56V1loaDAvNCtuT3FXeWVwNHVzb0UKr59CCWRzWWzxkjLci26NJ5SFHazdzqub\nXdD6uXvUVBDradDHzgg+jy1OXQfstHjQMapSd9rRspAotbmQjdqDeQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5QWxTdkRnZXViTTAycExQ\nUUx4Y3lRN0p4YllXLytnVjJYKzBEWjF6WjBNCkFBNVh0UEpScjJOejd2ZlNqbnhD\neUpMcW96cENuQmdRZmxFcER4WkFQSFkKLS0tIDZWaUFGYVdsbU1JSnhVTUlXK1Nz\nQy8vTU5MUU9tT0pwMEFBTlF6ZFdEdmMKCxfeNF6659103amzoWkAQrrZ23zOJtc2\nBGa6jBLsjfNIBRK0m/IJ4ixmwPXbAU/KsYkRkvM1WlUjWh6x+yyKnQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBbkp1UUpO\nTTZZZG83dndrZU5UZXRUTVpFNW9mY0p1N2hzdjVSUUdaL1JVUgpmMzBKUzh2WnlX\nTHQ2RHBKS2JGcEhCcHdnL2F6YndpNDNIWmgyMzVhaEZNCi0tLSAyK05TTEZ0eXE5\nWjUrb1hiMWZZcVRCZWFDT2g5VngyMFp1bkxXT1hUQlUwCle74xvsWsyhgyvlO7GR\n9HMOZ6tOvlfptOXaJXFxxtlHsfC1oA51pNPAdbq8bR6d+cf/rO2nLEHYhgNjls4p\nyVE=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-05-10T13:19:30Z",
--- a/sops/secrets/hcloud-token/secret
+++ b/sops/secrets/hcloud-token/secret
@@ -0,0 +1,22 @@
+{
+	"data": "ENC[AES256_GCM,data:Jw4huyAI4yZT/24rImVh//JaFvUlwuIRrzP3nzLBqts+U2bs3wcv0LVavSEhECoJveUwYyS29++ewlnw+wiSrQ==,iv:O2ISIPnIJ3677VswqMjphwV30W24SNciPwIzd/AWm/w=,tag:ORMMkAtGyvzlINQ4fbtTjQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFTXMyczVuc3ZwUHJIUlUr\nSTFObW0wNjBGQXBhS1FCSDNCVFJpT05DZzM4CmdscVg4dzJJVDZ6aVpiUHNydXhK\nK0tQTy9uZmJyM3d1OHVXT1FlYnhLck0KLS0tIHJGT1IxWTdJL01XWUE5NEhtcGhs\nZWlUZkx1L2cwd3dpakNCOGY0M3BZazQKZrK9JoWAJk9BOCPWfwxthR4sdNvF4bYj\nbnw5HBmXHPuV4pObDE0RwnoMVBXSfTof41HfogvsM16GWR577+CgMg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBdHhYQkMx\nb2xTUXB3dkZuajB0aHIwbllmcVJwOHY3eXphR21MRUdDdWorMApkcHVxQ1FRQ3ZQ\nSnpOYk9ZanJPZ1EvWUpoZHQ1K2VVUVBVMVphVlYweGg0Ci0tLSBiQmQ5YnJpKzJv\nY2lmOFpZSEVJeHNCb3F1SjFzNzBabHN0andFczRYTlFnCkSFxvQ47FvKcCh06tRd\nCb12wKSm12yMs5BR9Bv40YDB9C0/oqo17gDmVworyZKuK2dDfRaSLjoD4Cg2ww+A\nwS0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBaG9kZWdz\nWVloZGxVZW5lVHpkN292MVFjVC9wWkNWS2hJTWZiLzk0SkdmZwpSZTZkOTFadWxo\naHMzZlVGV3hCY3pyQ1BIczA0ekpIWXZRSFZtN1lZMzZFCi0tLSBlSkRCNkNtbjFs\nd2IvSlRISlRydVh4M1I2bVFFZ1ZJUFFNc1dtbGUrZWtvCiiFUjKkBp4eyI7YV1AY\nk3tqfqsoQyHPYhL4mxU5bDBPTwKpIwPZNzfVDxgiTwQq5s4TEoDYnl4rhEc6ONem\nx84=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-01-19T14:49:10Z",
+		"mac": "ENC[AES256_GCM,data:fWo9KS5W4A7UNM58G+KtCzAQAiM0qFVJwf42/eSQC+yAMfZJfbq17JDeow37CbnYo4GaXJuPQHbUqnrFHfqxRXAOP8GfQ02MRf3xSpmzwLQeKtZHwGG8+Ez9x+FnYUJcX8QIHpf25NKpe57h8STtC+Uz66lMp1EFXzJzgOvTY9w=,iv:Eya9bRyBUXv7ddSa7PVNYej6shnXTSdd3NvPPyRfezY=,tag:FH6YK+dfoPyQwgMNTqKQmg==,type:str]",
+		"version": "3.11.0"
+	}
+}
--- a/sops/secrets/hcloud-token/users/rpqt
+++ b/sops/secrets/hcloud-token/users/rpqt
@@ -0,0 +1 @@
+../../../users/rpqt
--- a/sops/secrets/verbena-age.key/secret
+++ b/sops/secrets/verbena-age.key/secret
@@ -2,9 +2,17 @@
 	"data": "ENC[AES256_GCM,data:wxFfM1b8w0EB/o1awHD9FMaHCSTp2NSyTfBCqJ5DjjQxDiBO4VkKVIK1Re28M1pKR4e/vThlvBpdEVnZksO6853RNbtBq8a5QSE=,iv:ZiJUjZ9TsIjse3sdxK40sYBbcBPwNkD7Pdq+O5DTcUQ=,tag:6GuL5cUgLKf3UEhioxk0AQ==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBZ1dNS1hn\ndUNMMm9PMEEvNW1WbnBiNitJNld2ZmlBQkphYzBFa1Z0bzJwZQpIeU9nSzY4bWpk\nL210cElrQy9PVTk0ZWtSZzAveUI4dlFGSjNBazd5NU5FCi0tLSB1alFvVEgxUDh6\ncGxmOGtqejFNMUVwNzZMeG5od0lPcitaWVF6TlF2QlhvClMRj078WFepyIPQi82b\n7GZ8+Wgel3y5ZfoUKZXFmpWqfYiODCdgBCduoovYY4vbrAsbfVun6VptW+Je3j0J\nC+M=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0Njl4T1NKaDV4VEgzK1pK\nRjZLekt2ZXVvWDFLdVVEbjBVaUJKdEs2TmlBClBwT2Q0dGpIcjR2WXQwVDJnTk5G\nTEtyVlpQTXpJdFZjeWREbWRNTzl3Z2MKLS0tIDlEWGRYbHNITFNYZWVENllTVEZl\ncTdWWlhRa2FVRDNFK0VwNnJldzhaVG8Koh116z18HdLSEWA/pevynZUh6eVR1p6V\ntif9NMKzwJzRm/5RKBBqaN+72zOHXSJBY4Te2TIqFkAaAfVjHmBujA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXZGhSV1pTQmx4QktYRENB\nbVZXQytaZFNlU2d3RWlraEVwSnpXNnAvVTA4CjJCdHZNN0lTZkFVOVR4SjdOUEVx\nMXRqc1o5TldOdE1pWkkwR0VzemZMTWMKLS0tIGdxNXZyaGUrMzZaQWwyMHRKZGZz\nbFRMam5ITjN4cVhXcEVQS3Q4bGlYU28K5hopN2oifM6d/9/o3aQ0jS8K2TzXokVj\ngRP0c4NB6cI9TPqOaCAs90z1jIeOVB26OR6JvFH+m7WaaxAuu8rgig==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBM3JHMEN4\nTzJJeHRaUXI3elRuRFBOZDN4MmttRHcrclZxV0owWXlUUHU0bgpXZ3pIQmhRS0Rx\nVXFyOVo3YXl0RVRVM1NWNWFuU0VKTjZDZW52SXhtSFNjCi0tLSAzSXhVQVNCNDlJ\nZjNtRlJkS0VLUUhhOEtLaE5jWmY1a2t1M1Q5RHZCOWE4CoTQMd7TKqdwzo7h8s8E\nqc28aqzCDNzPodvGidySkBpm6hvp6fQfSCgIJ4kWO5G4yZMOSqZmbudymMuUau+L\n6Ns=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-09-11T22:26:58Z",
--- a/sops/users/rpqt/key.json
+++ b/sops/users/rpqt/key.json
@@ -2,5 +2,13 @@
  {
    "publickey": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
    "type": "age"
+  },
+  {
+    "publickey": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+    "type": "age"
+  },
+  {
+    "publickey": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+    "type": "age"
  }
 ]
--- a/vars/per-machine/crocus/borgbackup/borgbackup.repokey/secret
+++ b/vars/per-machine/crocus/borgbackup/borgbackup.repokey/secret
@@ -4,11 +4,19 @@
 		"age": [
 			{
 				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5eCtVYmtlaWlmUEZKRkZP\nazB5N2NGc3JVcEs3NHRpZng3UnhjaGJwUUhnCmJKV3Y1Sm1oUndnWGZTMmxya0d1\nMG5yR0hwNkdoQWU3bE9kMUdxL0crNDAKLS0tIGI1NWhoLzZmNzY0L2xsNThNNzdw\nUmgyeGo2ejd4VU5XeFRJb0JhMy9UencKhDHBhlcAPOMdyUWzD2uMDHFoC7CW2T2D\n09vSaeL75t9uNsCbryM7SWal0HquEyAs8Pdn4YPMydpD2mQOVEAgfg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPV3RaOWZkczN5MHhvRTdk\nZjJWRUNGNzFLSUVxUGpCZjJ4cUZ3aDU2OEJrCjNYYm9yUkJPL1hGZEpSdnFIS0R0\nWlBmbVVuRS9OSitNMmtiM3JLcVZtU28KLS0tIDBDWkRpSWxVK2pvdm5xeGtRRDli\nUnRiQ2tCRGs2UndsWW9KYWdocGpYakUK1WFkf16tMEE7JJcrU67TdFfHxOo7eyr0\nBpNye/Gob3+zPuWUz9ugFiqPOMXfhMVoxRFgzXD5jd7xM7NnP4fmlQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBcGxGQTE2\ncmJWcjR4V2w5Zis2WGo0aytFbU9JZ1NkZzZVWkorRVg2SHlTRQpWMEdRRlBTNUM4\nZWY1TEEzMnRrVEhWcU5NNkdWWWFkZGxPay9BakJ4ZWdjCi0tLSAxb1Jhbzd2eUw1\nR2w3MnNMSDJTc1lhbzAvY0FsL2hXaXRZMWxTQmJaL0hBCltKw9Ex0B4BGVd1E7/a\nMKHXT7wEvlLfrfv2sBo0MAucnL3uCUgiQ1f+DQ9cGXwPuTBHCimCBRwkSh9VpVGy\nVF0=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtdmJUampVUEh1cytMUVFn\nVGRMSFZZcXZ0ekRzY0VVa1ZGSFV2c2pjOUdZCmNLUmdRbFhqRUk1REVhT2VWcjRZ\nKzBjQ3phSGhKNjVrd0U1eVlDSWVvVVUKLS0tIG93U1pmRmlZK0xOV0JzTk5FZndy\nZ3JKaVJNamxqYUpMQnF0eitsVFMxdk0KxGfukNQggo93Jc14Z2WAjfZ12e0SyRtD\n+hembYN7huaWCSyQdzS55U2r9C2bW+5qap6HhZOPAJ+1L+mD76wz/w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrTm1YYjdtQkQ3aERKU3hx\ndjg0b1dacVo0N055VWM2MmFGSmlBR2tDazFrCjdKb0VwQ2ZrbmExUDJFRTdCNCtu\nQ0pGbWtDeW1lbFZ1NjJaMXNMRmhpVVkKLS0tIHJCUGFYM1ZzeGVVWmFFOEYwR2Uz\nVDZlcFB1UnZYNnhLUEdFZjFXMGpBUWMK/giok2vHTK+YvkGj858pitrHKqJbrq/g\nmsof3z0utDBH8owfHMV9hB9pcE8qtP1lqkK9r6BfMMxrx+kilnC7KQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBME1yQlF0\nS1FrZllxcWJJbEkwV2VrcU42czVsNGowSWc0MnRyVCt2Y29DYgpmaEVIbGVOMHlZ\nbG1YS01tM1Q5VktNQkYzTVhZbTRPYStyNVBiSFJwbkwwCi0tLSBzVkJ2aGdUZE10\nUlVPL2NxNzhmbUU4MVRFZ2JPd094MXA3dEpndFg5bHd3CkrExz9N7/RGV2wMfTLa\nqFuOKYJyv+/9cUEIrzutKk+fRuuptdXzlAHApFqeZ1OxM7vynJV5UbrRca67auGY\n7Gk=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-05-13T21:59:48Z",
--- a/vars/per-machine/crocus/borgbackup/borgbackup.ssh/secret
+++ b/vars/per-machine/crocus/borgbackup/borgbackup.ssh/secret
@@ -4,11 +4,19 @@
 		"age": [
 			{
 				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1bkVVclhvVGExYmxOODdt\nZS9KRlhLcm1jZGZKT21VYWJ0bkp6WkU1WVdvCkU3UHhpdUpTMVJYWThsMElMN3NR\ncEp3RUhsTmNWVEVPeFVReUIxL3Q0dVkKLS0tIFk5VWR2U2ZwSzhUQ1lldWkxUTVW\nbURvVGswZXdNK2ViS1ZTNUt0M3B4N0UKxHYLja4nPCU7ms2Omo7JcCSU8/JR69pm\n0YMfpObSpDExrm/+ln58Pw6nVd1uA/mjWN1riLeKnetVxIpTAV369Q==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFSUw2MlRBRjBsNTI4KzQv\naE85c1ZQU1NXWnZ4d2taaklhNmJOM3BJSVM0CkFPMWt3UTUxcmFlNWpPVlgxVG1Y\nL0hxTlY0Tmg0S01pYkFaR3dwc0Jtb0kKLS0tIHltL1FNekJFUjJPbVJRdzNheVNv\nOG5SSFhUM2lzelV2aWVSMXRaSjJTUUEKCQNA7zTqd3NqeDxfaKPoBCbgOda+qnIF\nuOdNFADV7LCCpUolBUEofhEb+azGpnR87pou93QRaiXCrj9QGQqCTg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBb3B5OXUr\nMjE5K1VGM1Z0eEZxa1lUc3JpeTlXaHFhbDFzeEo3NEs0MmkwbQo3cE5TVkVmRGZz\neHFqNWFXcHdESVNPTTA2eW5RbzdyS1NaRSs1YmM2U2NFCi0tLSBkL3c0S0Y0OHB0\nT1piNGlYV0NvVjI0NkQzQTZoS0VzemJ2UmRXOGZCZTB3CgvVFBgMv+1FhBiYVPJZ\n29zfoYYIoHpjUU4pahjtgwBivSZy1Md/JV7AlWSz0zjyzWWquWyPyCbc4CRcc2U8\nTps=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4SjZPNE9GRC9ud0NZT2RH\ndHR0eU4xUld3YUFIRlBYN1h5Qjg5ZU82U0JzCkZVZTA5M1pnOTBxcmVoNWh3ZGJQ\nbVpsMXowOHE4eENlV0pKdG1YbUNPejQKLS0tIHhIa3dWMkpIMm1OZ3VlM1JaQ2gx\nbXk5OHMwakQzRDFUcWdLRmVXeHFnOEUKOpS+uXVevJ96bPhnKVYiM2Rl5PNvgmNz\nyxuYC+6cX+oPTnz6fSVYKmP9LWKAypHWQCzu5uKBriaAwU3EctRIHw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlOCtOSUwxbllMNkFvNVl2\nNGYwZ2x4TUVlTTBldjdJMG03VSs4TGY5L2pnCi91aWNnZ1kyUUZtK3hxd0ExdUFy\nQzZIcm1MMytzSzFyWlFnNnRKSkYvbW8KLS0tIDJBUkNRQ1duYlgyKzAxcExSZWJY\nUzcycC9Nb2pqWHZIL0NGSXFxUVBGTU0Kf4z8CV6hph0fl/te7Vvq5IGRTrraFufn\nvdt3bo/g2ph1O7TV6Yf7wUGmstPsB7ssH/byANTI5zrab0tgBqcm1w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBMEdBV2tY\nQ2p0M2gwVVAvaHpneDVUVXh4dm90YXNJdWlITFlWSUdNK2ZQQQpjTVI5dDVnYndY\nTnlyNGtSZVlWaGNmOExvY2g0cnNLWTVHYUJoN2tWQkN3Ci0tLSBYVHJmODNZRlpC\nVlI2Z1pjWVpSQUZOclU0VmxZKzM4MFVwRnNkR1drdVlFCraqEY2PYM59CpfILN7d\nCXxvYvAxXSlu4Giz6crAzHvAxq5BdiITRIw3m7st0zlEsCVOjjsGKtsQ1VDhipGE\nYbo=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-05-13T21:59:48Z",
--- a/vars/per-machine/crocus/gandi/gandi-env/secret
+++ b/vars/per-machine/crocus/gandi/gandi-env/secret
@@ -4,11 +4,19 @@
 		"age": [
 			{
 				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtMHIyNGJuQ2pDcGN2RW1k\nK1hvUlQvd3R3RGxLclpYN1puTkV3YXVLOTE4Ckx2N0FscGRPYXBsanlNempIQ1Qw\nMlBoOVg0bUFGNktITjhYWE9qWDE2UmMKLS0tIGpDRzVOVEF0QXhyangrVkN5dzZP\nc0g3RFMxaEUxb0lVc3ZRN3dac21Dc0EKmwoWl+Fb0AFzkh36gU9YIy74Vzb7ooLz\nbCOkLXCGpV/3gvlEer6mWaFR1UYGGcAGIr9Tg3K28uFpJo2WcbTzng==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrQ3Y5UjJVcVhaWUUwaklS\nK241U0x1M0xyd29lRGJRcWFtOW1GN0pKeVRjClhhempRRlJwajVEZDg2YXJFcDN3\nNEVSdng3bnpFRjZWQVQzRzNkUDlSMGMKLS0tIERPeVN2Q2VnelFzSHZUdGo3Y1RM\nSTJIZjBjVGFZMlByZkxFMTZyZmwzZ2cKRXU2LooeDPC4PSJFpYsLRIuzxKl5I6DM\nXY+Wmo8ffNNXzYfc7VeVk4NVwVPZQcqVmebRypYtnvG3cTejxG2H7A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBMnFKSFYz\nM1Bjc0pHd0NaSm91aTVSZmZFQTQ0MnJkVXZsUWdCQzEzd21BYQpxSW9wZlRmb3Bz\nSXRHSjRtZ0VuMWU0cFhGeDlwNUlqUVljeXJoU0lkSFdjCi0tLSB1V3Ryb0hGZ2dL\nOEN0ZTlhUTFHVzFkYXlGS3NFbkdKbXQ1MC9CWWNOZEhBCv0q2eUDHsUO50MhFTtX\nc/jv2delDYJpW7XClMWnvVZQjR0O64dETJdwX15c9hxcCCS/5zUt7xktVre3P64x\nnfo=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmc3YxV3c3elZpK3I5OXVu\nbDNyNCtLVlRFK1pPN21UVngxTE5xVWlNRmpRCks5ZzZOemVSTEZSMlJ6UE5yVXQx\nUm5jYUNid1NtdUZBSUkraEhrbUFCeVUKLS0tIFc5RVhCTlpVd21vRjFCSTNWdDNG\nSEJ5b1ROUDV1Z0FzbmhyYkY5NGVsb2cKmnbLoK915F1SVHXdBHCx/8cBy6SiGznZ\nKHNr4HcdKLSF9EPI/0fJIzGoCTTCRTG4ocvDRBDQiB57kQqhu5y2Sg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAybGRQTHlDMHB0NnRZbVIz\nekczKzBRZk5iUDhlQlZBMkJ1S0FxMjdqVlc0CmY3Q3NQRTV6Rkl3TWx5T0RMYkhs\nYzFjVzVNMDBuc3NuZWNzK3cvdm16NkkKLS0tIDEvaWNwQVRwV0NxbEJlcWc3NjEz\nV3RyMVYwdHRnQVNXeWxBZkNYQWttSEUKAMzWjimkgPgxA9Ctp4UMMhdeWi58iAJN\nKQwwN12GeQoII5ZQ0GcfPR/5j3ehQl2mMmoqcxc5UqoeS0U1tPjczA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBaU1zOXFU\nV0hqVXE1K00yUkFzUjdVN1RYNWgxYkxTNTk4Ry8vTlpMRnhyQwo4N1YxbXZHbklL\nMnFZRHBhNW9PUFlEN3dRRmxyeVlVaXBpdGZVYWg2cElrCi0tLSA1WFp0b3Y5cDVv\nZ1F2U0Y4OVNhcFlrOFRGOEpiRWlOTVV3bnFvbGNLMUJzCgUkSUQIlfXLdyFp9+YT\nvJo+BM3T0Lk9ZhcNy05PinmYorfzZdd0Eb2zZHp5amyuV3JXxjKuJhspB6wP1GYc\nfcw=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-09-11T20:41:34Z",
--- a/vars/per-machine/crocus/garage/admin_token/secret
+++ b/vars/per-machine/crocus/garage/admin_token/secret
@@ -4,11 +4,19 @@
 		"age": [
 			{
 				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsKzFrRTU0c0xIeG9yblRi\nUk9TbVRZMUxUNjdTdnViNEpDRGN3Z2E5czJrCkd2akJST3ZZbUNwcTdZeFZzVDJG\nTDE5WGlSdEQ0RUtkNEx2Wng5YkVrYWcKLS0tIEdPTkRrV3QyYzFraWhzRjI1c0N4\nY0xjc1N4eEo1YnNEK3ZoeENzOHFOZ00Kg19YjeYzSVuxrlOueX39SCzo9CX7063n\nBAVzFlgimDEKR3qfoDpdr7XssbWF942sYbIDBqDdqS/0nqL4vFkFxg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0eDhid0pjblhSYkcyb1p0\nUUx6QzY2SWRQVDhvNFZKNXpFYitUeHNzeWdZCjdsY09jQlpWMXV2emZOTjhQNk5v\nMmRmTVlGVDZqQ21EcUFQWGJtK1NqSTgKLS0tIFlmNTFJTHFETmpRTmE2UjJHaTVK\nbXlwODNDZ3BHK3EyNGE0UUpoOHBYcFUKNHrDq5tLe8fPIJ1C+ReWURECGqWDSU4x\nyf3m8SILjS8AEayTkgqcTxIpB/670zUWpxDGO+eYGwvTgkH4mCzS1Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBN0pwNWo4\nZjB3ZldtTVN2ZnVSME1iYm9XKzZSbVVnWEpjTmhZemVBWVBpOQpNT2FoUVEzTFFz\naWJqWHpaSk4rYzI0dGdxUm9aS0VxMnZrSzVPVHcrc3J3Ci0tLSBHdkpPN1VTSllh\nZEp2NjRRVWxFTGJNNjl3aE93Nm9wSndKNUtVR0RuTzhJClJVTVUqfClk4krjSSRu\n1Yu0x0Es3UdtDXUjcNkFSuskvM98YJWtt0A4ptt5TSgaLDvsY+RnUE+XLA8aX6ku\nkbk=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2NUdvaVRvYmpUYlc1MHR4\nTkpIdndTMW1XSGRxcXVjY2o3VnI3VDVkOUZNCmFaZm5vbTF1aXptMDRiZERZV3FS\nZG8yaWdEZmpobFUwU2FaeFdFTFcwN3MKLS0tIFZDUGRMa0ppanFtTnVvMHBacVJs\nNHpVUHRKL3MzMVJqQjBPeHdBanIyN0EK3KmePRXEK9o3uNX28sZvssiZorommPbS\ne1+mkTyK1ovuQcn/jVb2sA8EqiT/5DRar8a4gpdT+Wvw/io/mXXrHg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBleGdhSWVuMnZTRy9NSVh0\nUjlNVEVsY1NYZHo0TnFqUzZYS2FEbUNhMnhZCk5HR2RmeHRtekcza0RLN2VYUDNa\nZ3prMnRVRmJ4QzlTdC9SbVhHWHlMcGcKLS0tIGZqd2FDMUZEWWZ5eUtNRkgweThP\nVXZDNW9XWFBjNTEyemkzZ2xDZFR2R2MKCwr7sqFliDt3MGoI1LkFjo9QmlMOR3hV\n/LTrJ/4jt5BAsM2wJLgZUdBjkzFCNW4kCi5PqfV86+Nb34xTXJW9FQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBc3ozNVlD\nLzVIclF5Q2pzVVFQVHdybFFvOTNDaXJLWmltZmtEbFVsaU51Wgo5dDJsRFROa0Mw\nb1VzZ0MwSG9Bcjk5NlRUclYyanpRd3dNeXZ4QmZmbDNvCi0tLSBpRVA1Qm5sVUdh\nM0d6UHZlM21lREZUblZkRk1iQ0djZXJQaUNnT3hwN084CjJka1HD+xbkt76fw4Pd\nmk96YZwYOJmNGJGTX1ZS5oa2FXffhXuYtQj/c3uojylaP7G57XJuoJ1Nk6pSd2u9\n/Jw=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-06-19T21:51:47Z",
--- a/vars/per-machine/crocus/garage/metrics_token/secret
+++ b/vars/per-machine/crocus/garage/metrics_token/secret
@@ -4,15 +4,24 @@
 		"age": [
 			{
 				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyREJCdnZqTzVMVkZnZEd2\nTEdnZmpQZHVwYUM0K1BZMjViL3FkTmtXclJJCjVzMGd5RkFMM0tJOTZNOHowTFdw\nRWJpSWVLTjZ0OXJHcjFVbFpIMlpNVGsKLS0tIDIwRngwSUpyRkRpSXFlTExNc3hE\neVJBNTAzWTRtRCswT3B1T2dpcStrY2MK0peLN7aitVghBLfnp019fl80M/Wk1aL0\n0B7DNZDVKhC2vxWoq2ESwYDR5IwmJdg7xfJkUrvX3zTPde6I4fMlBg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqZGtqMDFHM0VLVnhjUWdn\nK0ZqYnJINUF1TmNLN0N2QkQ2S1FucWVTenhrCnh0OTg3eWRCYkVEeTcxQzNCTnBw\nbVphQm9wTk92emRlTU5waTkrY1RsR2sKLS0tIEJuNEJUNjhGMzlrYXdVcjFudDhp\nRFpVNmdFRnBteGNMQVNQaVpmWVhRZTAKj8VdXywqeN+VEc6aBEYUSwGqPNhzCdyp\nl+ZnX/1Zq5EpalnpBjeqBFVqtXsXvYeBsDg/2RfZok4jaFy+vil63A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBNjRWdXlH\nT2c3ZDVkcDlySHFhWlZkeEY5ZU9xYnZpUERITGJrQ0FuaHZMcgpobVAvUHJwUTNu\nQVhrbHdvVWQwek94TlNTZlpSWGhOQUV6QmRVc21mbFEwCi0tLSBjeHNFZk5JVW1N\nRHp4ZjlkM1RGM0NFU0Z6cUtSMy95azg4TnVpaG1KSGtVCqrX1dJRA7e66Py+ifW/\nUhzHZoPD4KB9EJrmQAgn7vMnFOIRwpam/Vkewe5ILv9uFl2SC49KI95iHA1AV1XL\nUYs=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzY2kvbGpjVWpsbTloUlJG\nMHUyYWt4VU5mSW83emNaRU1VSEtUdWl4WXlBClZQMStpeWpQSkZ2Q3JUUVZYR3JC\nQnZ3MlBXZFNFSFlxRkFzREhjcmltd1UKLS0tIElqZ1VIUSthSHJwV0o5SGp5V0NE\nMjVBcHVJU0wrWmx2Ujc2RnFxZWtyZ2MKwk/wHMqFSS2DUsA63j6xzI4Z0M5QBS5u\nmYo4lv6DbmBC71s2QxG6lUO1EeY5wIGkUpGTAnt6e39/Jpns53GY+w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0cGw1ci9NZEFxZFlVc1Qy\nM3VybDkrNFVLZjlLczlaUzFncG9lZmR1SUcwCjh3NFh1bTU3dG5HdmtKZGh0QjFn\nV3IzVVpHYjhpSDNpc1RyRUJ4cDR3TFUKLS0tIEpCTVBiWUxFS0MyRG5CM2FhRjFE\naEJBb1RlVHFySDZ3NmxWblh2MGFZQVkK7zxgSkhBrQZUTnGB13XfLSwgdwcjyyMh\nDKpMe1w4j9m45B7k2lAhbweTuDEiU4RoHvXaXeTsZ26XFIMlwpwT5g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBOExKSmtY\nYjNCcmJTZlljM1J0UUk4U3BnWDFONmc3bThxV05GUWx5alhncAorZ1J0czQxTXNl\nemhxZXpoYzJMdnNaM1BKczJXZW9RaXRVMnRKd2lHbGhRCi0tLSBjcWFhS2cwUGZO\nRTM4UnMwRjhrMXRmZnNzVkh0emdwazZvN1Q1QTlYY3UwCihSgclskDvQxfoA9Wnx\nagmLiceD3owl98ug3ZxN2x/wrjv9+44SYaNrI2kkim9Zp+4o0kE0qBYK9zeSsEHD\nMTc=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-10-22T13:51:53Z",
 		"mac": "ENC[AES256_GCM,data:H89aFtec/OOq7r4MS28N/5ygv5GCWU0kcZszIr4yacfvoxPDFhFy95WCk1O0mzeubJ0Kw0nnmRlDS++Xfa8O99gXOtJc3FupBtLH0s2067jH4SW4DF4B/8BDPN9erVPXC4cwjSQnLerP4+TA14JtTbkoMLSLIsfU3gVlN6S0F0k=,iv:q/DKwAs7wOJQ8oZfjPCDN6pm2yREiWk+CQd6B7TixOc=,tag:xRgjYRsv9pOoWpkofkw5dw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
 		"version": "3.11.0"
 	}
 }
--- a/vars/per-machine/crocus/gitea-s3-storage/access-key-id/secret
+++ b/vars/per-machine/crocus/gitea-s3-storage/access-key-id/secret
@@ -4,11 +4,19 @@
 		"age": [
 			{
 				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwRERmU3Bxbm42TlE4R0RX\na2ozeFVqNFlZYmVqeXFQb2JVVVlWbjVhTVdBCkJmWGdSK2VVcUZmRWkxL3U0S28v\nRTdpSGhsR0czUnBmUHNMdVdmRGJweVUKLS0tIHFVckZ5RE04TVcxbE9nbUZRWC9M\nTnAzM0k5cnFFREZ2SWFVbHhpdVlLaEkKigwXIzJ3WtyXOeZZ9INrfOdCJKADIjBC\ntSqzb2dY1I7akYd87nxR14fXIx0h379XZMBDgwLQhDI4iJOzmwON+Q==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJSEw5L2RxNTVpK2FEU2g4\nSno2S3F1NXdRTkNVWWcvY2NkSEhGVFlBVFJFCmRObDRkelZVbzFPRElxNHJBcXkz\nSE9BaFZwOWtrZWIreXJNZU9SL2YxMXcKLS0tIFJrbFhIVHo0azdGa2NxWHFoMW1J\nUG1qSzNOc3pDbTkvNWZRM0FzMG9pMnMKhDvWGGa8TjLSuGxyuWV40gvuXbhx2iph\ntSitGvEh3UExpK4s61vblne4tv+xBsjX0h6KSX0Ip2hGIodThe8nsQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBc0RIQ0x0\nbjgwU2tRSUNveGZMbUdqNTNmN05KVEpqazVNSWZKdWo5M1IzbgpNZE9QY1hUUE1N\nc056NEY1SEdTZmNhNUp3M0xPaENzWjk2eEJPcFRhbW00Ci0tLSBxeXNRUzVIM2RM\naVVDQWt3TldJbFdBdVEvM0c5MEFDbDdyamlEOGd0cXJrChGtzCSSTwjWIwZC9/6w\nBYYpHyVrU/i5cqLvWAv9ZT40cNhNUmFWk9tg3BFoFPFJUxDcCg8FOIQaNn2Z4PR/\ncBQ=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZkM0YUM5OFMxM0czek9H\nZU9sbzFFVTNYWktCeVYvYTh5TUtWNGhiZFNjClJDM2MvZlFCTGVwakZRRWVscDN0\nd2podlM4bXVwUW8zMEYydU0wNEhhV00KLS0tIDhGb2ZBQlNHMGo4bjd2ZCtUMzQ2\nZzQ3U3BybGhCbSt4bGwvSDltRmpIZTgKnpusl9Z/x2f/h+kamRwUR8yt+ZmwuvUk\nrfnG+qO1iEHGoGbM5ltWEiIy20Igf4SC7CluMJsm0qqTdUc0mPP5iw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDRWRSWi9TemhlWnlWaC9n\nMUc4MWVBV0F2bkdaSWFsaVl1alYrUlhxczJ3CmRWcjE4R0hSS0R3SW1oVlFCUGFa\nczA0UzdPVHZPenVwalpwd0k5eFl4Y2sKLS0tIDRJOVNpM0ptTVIzU3p3TGxuS3Qw\nQTVWMDE5QkhCR3RiWFdFSmZITG5WTm8KUjL6xuP/yMPQTfvyhrBxEI+xE51ks1Qy\nZgXokrXGSmCIQtZoA+OVT4R5ogop5OBP3rXEZWfGxVFyFE7SqCexyw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBM0FtbjBK\na2RBbmFUS0ZXTDJtZGY3TUZDc1VJK0QxOXVzVHhuZmc2UFpEVgpJU0swS2JIRk4w\nMThsYlViSm1SUnFnWFFVQ2lybGRmNlpsRHp1Qng3WFFFCi0tLSBlYXNoemZlaFgr\nNHFDVm1uSzJyT1dXSXo3eG9mYzdDd0FVdjNtZm1DZVBvCjKiC+OC5uCTJJkFbER+\n7mkox8LdCsobk24tTDTVbsuyzjxKZS/F2L1NXA4FBc1Y428ceoNiv7JcT1OWweUH\nDnw=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-26T17:18:51Z",
--- a/vars/per-machine/crocus/gitea-s3-storage/access-key-secret/secret
+++ b/vars/per-machine/crocus/gitea-s3-storage/access-key-secret/secret
@@ -4,11 +4,19 @@
 		"age": [
 			{
 				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkbVpCalVOdHQ2Y0MxQ2RD\nUGNQZy8veFVwUTltSmk4TEh1RkNsc3d0S240CmxIMHNqRVNPVEVKWW45d1plQUNq\nN0ZjRUVwdi90UlhQdlk5R1lkK0U3c2sKLS0tIGR2aE1VKzYxcmtHOXFxQ1dIdFpR\nbFYxZGdLUjQvSnRBc3BmeXF0Y2JScTAKPcg+bHmnvYu6yXCV8k5Mh+XmIIGDxT2y\nNJKHrAk1gRpI3L46dKPvoqIEAwT5lpv9qC9S//qnG6ZPexoHF5R39A==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzdUtYN3k2VUtBVkcwOUdP\nQmlodUN3dWVYKzJLUlFxMnhyRUhTWFpHbzJNCmVDK0dzditSNW5TZy9JdlZYMUdl\nQjJvSkRVVEpLY1FiSC9BTlZUMkxabWMKLS0tIEJrUmRzNVpVVHNabVpzSDkwSnZH\nRENnSUh6Y0lqMkdzOWJRQmwrc29PbW8Kli9N5DeyDuf9Ueuiw2XrvW4OD1NRSJwr\nGxWPKzft92MjF/wrr63DmMWB2PxxBynlSqCXZnL/zbU9Wy6GesAdcQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBNTltS25X\naVlSS1FxRmtRcFRHaWJIVVUvK2RrSHpYZzNuRVd6OWVqRUFIRwpiZGhUWU5UNSt5\nVVd0SmJBWlo4MzBuTGN0OFU1bWQxT09sZG5xUE93MVE4Ci0tLSBMTmFlanNyOCsy\nWFoyZWo1eU9JS3RRUlU5a0xGbU9SNEVSYndueTZtZnZVCq+i8FnDLkLV1t9QeMkN\nlhaB3cN1Q0CwWSAi/iCgIqDbA4q6PBrdQryrOnWyV3h0vFwMotuEEfjct9y3/chZ\n/G8=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvT1VSeGhTNXIzSWdKcGRT\nd0g0a1gzdi85VVJiWUk5a0dqRTlsMjhjWTNBCmwyakIyUlhyaHQ1Wld0K0ZieUNC\nZE9xeGgrTlFNd25BOTZ4ZnFwd1F5aWMKLS0tIDU3VlJEdFFQc2RXY0E3ODNaUWN2\nR2lIYU1aaDZabFJRZ1l5blk3MFBteEUKrhAutd7ppq/KjAnAtdvKcNFAfPfmFQe0\nnx1Zng1N2CINAxYkgEuMETqP29bsX4HibxdkPgMDqhKm1O43BY+PHA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkWFQ4dlR3aEF1RUU3bWZx\nakxHc1ZqQjc1Zm1pSm55UlFTMzhyT1hUU0VRCldSaDJINk82bEgxWVptd050emVk\nK29iVEhoclo0K0k3NjcwZ0trWjgvaTQKLS0tIHkzWWtaR3NBUTQ5cng1cll0YXdh\nQ2VsUVlWbGxhN2Y2TmpscFFoMGtoRm8KgGimtdpCLdmPxLVCVRutCKRsZIcIUisx\n0RG8J51MryaQ0aO3LgWbOwQ/rjWvgORR/M0z8L30VhT0XhJLckKRjw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBa2xqNjhr\nQzNkUzEyWFRtald0TytEVysxSE9meWFTNTY0ckZaSi9Gd3Q5RQpGL1grTXB3NkF5\nNmxCalJJU2RYR3V2b3pkMG5wUHFOaTRMQ0YyVE5pZkd3Ci0tLSB5WU9rUExsNUVL\na1BMWTJ1NGloL2taUEt1RU5qZHRrL3c0ek1CNXVKWC9BCjvh4pC8LikO8JmG+w0X\nb/DYoaeZfirlZKWm32vWMkJARiwyqB68X3FKXkN+s4hiKXl5DpsD4DuebkOgjy0n\nQuM=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-26T17:18:51Z",
--- a/vars/per-machine/crocus/gitea-s3-storage/gitea-env/secret
+++ b/vars/per-machine/crocus/gitea-s3-storage/gitea-env/secret
@@ -4,11 +4,19 @@
 		"age": [
 			{
 				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvanZmUDZnRkVWOHQrcEly\nY0E2eUpheDhmZGFJU3NkaC8vOVRRb3dZT1JBCkZ4Q1NpTUVPdHREUWkyeU1weC95\nVTV6SVFyT1BiSXkvNng5ZHZRc1p0aDgKLS0tIHJkNWxnQVJIMkxqR2FWZjRQcllz\nb3loRE9oWmRrOHNPdlE0KzQ3NzNxVVkKO6KkWQnRQejpUv5zG0xeDZjkAnlIMRU0\n+2/Hu3gzyC4cpDsZgqQeYPQ7y1N/n21bEmB63+mEKbwdZ/mSKtLerw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRVzkwcHptQzZESjdoc01S\ndG54V3FBT0pDN1JzSXh5N1pwTGRiTVFyYlNNCmVTV3VWTnB2QkhacW01VFlhSW9Q\ncHA1ODZ5V0hBYWJQVDdOWlIxdmFKMUEKLS0tIGk0VGd1cmU0Mmw0SDhaM2FGb3hP\nQ1ljdmZ0MWl0ckV1TVk3REJkUm1pV1kK0D2XBrQqZS9yGtGYzJedeZLXccbzDgcV\nb8/yvr3eJkOkshzFKYJzowbbBA5dmnTAA4jFIoF3dba09dV11098BQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBME11R3Fn\nUVhWcHVxTTlLTDVUODNXQlJIb2h3MGEwbTNaT3I5RStQeFBrQQpIT2UyYmhDSW1C\nWjlJdlc4MGtEb1BRVFoxRmpQeHUrbUhSVTJwSXZNQkxVCi0tLSBla0R6VkxrVE93\nSlZZZ0lJZUdCa0hiK1R3UThTekRwbE5MeWxuTUlvc0k4Ch4uqr9lUQiy4vkrmAUw\nA/I8x/t4BOc1mnqv67DPd0w9pyBBAHIRXNf0Ymzj5F22s30yuwXstbtecnPNKFgK\nE6Q=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKR1orQjhtUll3NTFaR2Va\nZnk0V2FMaTE3MHlIUnMyd1VzL3lDQStEcDNnCmNaODN5cDRuRG8vZ3k4WlYySmpZ\nWUlPc0Z2dzBlVGt1TnliVWFkRnZEYTgKLS0tIEJKWVVPMkpTYzVhWU51dWNLM1I0\nVXNLQ2hEU2tVNGVub29zS2VsYzAxT28KiNpcaQC8sQ1bN4WCWDIP2acs+DpGZSD4\nVNb0fxNPE33sbuQ4u6NfuGt5TxZjPkcFns14kEs2nZdA+jSHDcwaDQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzZDJhWFZmSVRnV3RKWGw2\ncURsTDVKa2V2QThwM0JPWHE1NS9DajY2L3hvCkJZTlBpOUNURHJndXpVSVBNZHdu\nZDFJa0YzMzdKQ0JCaWZyTktpTFB4b1UKLS0tIEZRc1NaSjlRenlhTHNsclVlNGht\nYkYxQlIrY0xnakhQSnNJdW9RVnJZZVEKLaLWFtMJE70HSZ4h4HpjqDIbRPfTu2iZ\nAW4rInouGTOoCimNO3eqxM+5fo5zMGilhY+sSYoZfj/8XtqN/N3r4A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBaHRPY3lD\nNVU5VzllWXBZaEZoaDJpdktJNmZtR0NWL0IrWm93ZWtidzhvOQp1c3V2K3l6K3VY\nbXBaSm9USlVSWnZUVm90aEVCSmlSYkljb2loWkxNb1FnCi0tLSBTQ2tHSXFMZlVG\nV1ZyQk1pS01ET1l3RjQ1YUVOT20xanhuT2orOEsxK25RChCM3eviktju87V/R9HX\nohaSmh3H+OJ/HzKgFcJV9QxxqksP/nOZ4XHKsjQEk4g4YVH6oFr+shs0Vpu/zAhf\nTq0=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-07-17T19:36:54Z",
--- a/vars/per-machine/crocus/nextcloud-s3-storage/access-key-secret/secret
+++ b/vars/per-machine/crocus/nextcloud-s3-storage/access-key-secret/secret
@@ -4,11 +4,19 @@
 		"age": [
 			{
 				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnbVZUVy9BYkFXN3loMzdp\nejBibHBUcEdRUmE0WGZEZ1dHTnEwdG92N1NVClJTVXJjVW1pS1prMzBrVDFDTXYw\nRk5DNWx2Y2FiRHA3eHNtTkh2eGJjM3MKLS0tIGdJWnhvV0tHdEVqaFBDODlVeC9J\nTU95cE1NcVM1TWExbUpwOWp0K1lVRDAKli1PM66AqGfaMwV6hNxsVcIXvYIfeEEI\np76ZHtGJ+z0tUgAzVd+h4XspbGa2GCnm7WzBjlzI0tT73WFJgZgAkw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJV2gwandKcXg2N1l0a0N3\nRkx6ZDJ6UEFQbkxKa1ZOUStsaFlGSXk1SmtBCks0cnN4WWZCRFBNYlZuQlI3aTJR\nOEdxQ3lGVE9wSnFOblowbWFlTmhDV00KLS0tIGtNRDloOXB1dzJsVVVIYXlkb1V2\nZzNhL3kxbFFwNzBNdGp1OHhTYUo0elUK90tA5xN7SASZ6Xes/6Z5DMKGkSrxu6xK\nhzzId2/C8U0+lbeTQQkprGpTDrG6XlTFRSvaIwq2vwM3ohGVXOyP9A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBbzY1MCtM\nZzV2MkFEMXVPdjFObU9jS3UwS0I5aFdnMUhvSFJLTEM4dHhQbApEbUVlMHVOQlgr\neEErQy9laTdKcis3bDRpSkNtWjFweVBnR3pIeVlTVjE0Ci0tLSBXNDVtQkpaOTJM\ndkcvdHY1TE1pR1dmRnFoWVhpYUxtbzAvV1dMNURmZDBzCv2yCsrI9e9GsPk31lRT\nVSsgpycRE74jTPCV9ALDQzW1tZ7CV+UH4zapgTguuCmqJF9QlNYEFZFSbsAb+ex5\nEtc=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5WUsvditpNGE1a1RkOXZU\nQU8wWnlOczdvSm9Gd21ab1orQ2Z4c1dMeXdJCmZBRktPSFV6N2p5enZjZGMxeFNt\nS28vaTcxN1E4T1BkVXQ0TS8zaE4xMEkKLS0tIFNqMHk1ZWtmR0lyR25Jc3VPS1hz\nM1RFb1BZclZyNzdUTmJzSmZqdk15R2sKqGzKDNduTLaSIj//NzhqdNK3CEcKFyq0\n8QLjgvOSdhkWS2yZwijMx2ikRBA31Uo9Ei9wO+UqeOoxLOVNI00Pig==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqc3kwUHlhRUtUakkwRWY3\nNTM2aFF1ejhPY1lRSDZmeUJTQjBmaUNtYTBjCk1HY0ZkSkthTVpLTkMwb2o4djNO\ndWhDSjhJRmlia010Y3lEZE9SMzZqWE0KLS0tIHRrSTZNMzRCZnRUeGtYdzJhTGk1\nYUd6MFZKU0ZFL3pjTm1ITnJMcGxWT28KgtKtewS+9nt9X0nBNSxOnGtS1WWViKwi\neKmKorFPykcpe0iloq3Pa6Z0cdreafHHQcAewOjY4nrsHcQOlD6T+g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBNzdaRmMr\naWxSczdYMWc0TEZzZ0Rya2ZUcjVXalBRUURLeEF5QU80VDBmdAo1OHBQT0JmRmRl\ncUFqMkpVMWRHcVpaMlRMdWtYL3lYcHo0aXJYQVo0Y1hnCi0tLSA3SmNOeWpGWldk\nVDYxTk5EN1M1bHlKYkloZ3ZRT3N5ZlNzRHAwVElqNFdRCsJkvpTfuqsI3L38JImj\nsEq4VT8t47dcIQJApMv0yIphCeX2bBPrPN0/6VMc/Th7kOWb9qhRzG/bR5bx6Oaa\n3Og=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-09-11T20:52:22Z",
--- a/vars/per-machine/crocus/nextcloud/admin-password/secret
+++ b/vars/per-machine/crocus/nextcloud/admin-password/secret
@@ -4,11 +4,19 @@
 		"age": [
 			{
 				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0Z1FGZHk2QmFlLzFQRUo2\nZk5EWTJOMG5JYXgrSXBVU25EWVBDYjVZZldrCmk5d0JMVEVWNTUyV2ZQOTlSVXR4\nTjNIdnVqZmRER3hrWktKdVhSdTQ1ZHMKLS0tIGU4NEVoZDR2QjNZeEdIODZrNkZJ\nZ1hlRUc3Q3Y0MU1iVm51VUJGQjNxUDQKamXqt6+nMqw6WEYdmgFzZa467hYAtpDx\nLtaTBmwk/hM/IExr6w4ycTcAVuBXyZYeFyNAz6EfGCyrGFL99zbGWA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzakVXTzVvVFVXdWxNS1VB\nUURrMktBTzdXcGIyY05aczV0akhLTUt4T1U0ClJER1JSalpna2RmaUlCMnJnV05p\nUlp6STVDeUQrYWRQWDVTWWxYL3BmRDAKLS0tIHB4K2RqTlFTdG8xaG9SZXVpdEFm\nT1pDaWlWSDVtcWpZTFZBSnZHVlFhOWsKok+32pQrxSx0TlffrXZ2YVDuZ7WgAfH0\njdsTtSMmuE4MXruiSpws9Qv6wCtWaXcK8anjHG/yup6snZnKaCpgyA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBcWNsOWVY\nRDMxZTZIRlpONVpvaFpOeWNzSmFLanliUWk4ampGUkdrcEt1dwpsVzdCWnREazZt\nR09VV3k3Qll5MjIxMThmdEJDSDJia25UTnBTVFloWFlnCi0tLSBzcXNySVNWOUts\naTRlYjZodFBBSmd4TEJKNzJJOTJJV3dHd2kvMXJHZmxRCnYIepxXIkKjp2erEpgo\nDOAg5JEmbvd69QDcPWq9+xR9pSPe5QIE1PWH87fPTN7mRE7S0fkbJlThMuuHmqHK\nqso=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxN0x4WWdMQzRSWEJuK0JT\nMlBBUzhMRldtOWJvWkVjWVJ1ZzJmNVFyYWprCnVjVitwV0lSV0ZWRlRRRitWZGVi\nS1U1ak5nQVBJMXE2V29QclRRd2NnQVUKLS0tIHBMaWFQTVNDRUxiVC9KV0ZNUVFy\nTkJoRjJFZkkxUDM3MFZzdXRTZzZmSE0KLA+kgNMf3Lpp9YwHqXQ5NgpYGMnRDJEu\ndxD93SX5hmMh83h8bM11yH2spMIof77SWM+LIUn273YEOM/gNUFEzg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVeVV0UDFPaE85RU91aEJq\nT04vM1N5ckt2dXpCVGNKZTV5WUtwWElKcEhVCldLTVlkU2Zodnd2THFWWFB4L3k1\nSFg3ekRQZUlyR3ppdzRvRUhJNVlmK2MKLS0tIFJwOFROQ0hJek5NSlBPcUM3aHlW\nNEhnejEvQUhyMmdrTTRBN1c3YmY3U1kKEp3VtKkfxhKBEfYO0fjcyUOjILg3jpDb\n0a/LEFMzGUa6oMxQQYkmi2XFZnvmTey/1mR5sOOvGz4fDlouwfxrBA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBc25NdE1S\nVjUzWDlvKzArRUN6SXJYcldmVW50NjhFSGxYYmVsY3BSN1ZtVwptRGN2dXphcm15\nUXdOM3BKdHp2ekVjSHA3eUZNKzdEMktRa2Yxcys4VmxNCi0tLSAydXJmVGlJQkRl\nb0h3UTBWK1VQWmlSWVFpT2x4T0hDMVREeUtzd0hqZWVRCoZz2my0mTi3dcAINk4p\nZhXoo/eCCSUGIhLVSLFyxFSd7slsb0EioZzecBt7kC1peba3OF9ZL455WKE0KCDj\n2VE=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-09-11T20:22:27Z",
--- a/vars/per-machine/crocus/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/crocus/openssh/ssh.id_ed25519/secret
@@ -4,11 +4,19 @@
 		"age": [
 			{
 				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoMVgyd3E3Yzg2bCtGaGx5\nTWxvMEluaXFVaGxmNmU0dFYvUkdUSHFMNGpvCnlFYXY1R3d0aHNha1kzMis2NVJV\nU1F2Ly8yUUV0SWpzSGVndG9pLzV2LzAKLS0tIDFrUUJqQzN4NGRlTTJRYUFjNHRW\nLzE0K3ovT0JqVUZEeTdaaUVNS2tWRFEKBmzU2fzC0KHb5ybXIwq+z3cdA8WrjHD1\nuFzNv1DotAxlA7e4BxmGm2Vuci7/EccNG7K2T5KQuD8nbtzXYJkkBw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1Smk0ZnlQZlljV25weWhC\nUkUrdElqSmVEMlowRWp4MzRyK0tuNi8zeHhVCk9pbEJBV1dLL29LQ2l4a3RvVVJl\nYW9LR3ZqQndiU1FqeklKcUx5YlRaVFEKLS0tIC9LWjdBTUdGRWc2YUQ2YVVzclVO\ndnF4TU5TNHdKMWpBVERDNGZkYUxuSFkKElI/4w5sPPwkPgb2lr2ck7HdiKXaYHQf\nJFbdfN9uZ+ORwDEfJPriEV3FeXbUI6+dD42n1tdB1rPs8GrcoAlwFA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBOXBIQ2FR\nVTh2bG9JWWFra0VZaXE1MVBIdERWdFQxekIxU3VYUHN3YWswRgpvWVAyWDJwblgx\nM05jWFhqUFA0eERXZVZRTUxiUHRPRVhyZXZJMFMxRzZNCi0tLSBRbEM4clpHbmMx\neUJlUDlVaDZuOVZqMkI2YmxkOXEreWNSRytESlBjbXd3Cuz6FSIgtQJpmPjmIeL+\nsgG3eWaClcRgr0YXKaokHoBn+8NEiFw5RSTrpgDcsZySBe2RPZqMbDsNJlGmJ1Ij\nfaU=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzaU9VRE5MVUcyWFBuc293\ncHVLYm1iSEx2MzVYSFoyZnh4WW10ZUpmd1NjCjRRbzIvSEwyZVArRHo5dFdUc1hN\nS2pHWGwyMG42UlJteTR5K1ZRRHJ6Q1EKLS0tIHdWeXd1RmxCd3VLbS9kcGt2TzQv\neEVZZ3ZUaUpyQVV3MUpWcmVVRzdZYWcK3NZpvf6uCsNz3Im+yDafBcPQT+QxddkV\nStX8svuvbtwU8ZPlj7FiF/HoeVC6im33hrrrpRx9l+udPrqUAeuESQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2R3d6WU5mK1p1dEdHVzNG\nSmZWRU5qdTJaRGFZTVZqRGtFcXY5aldaWlQ4CmJmWlJ1WlZlbDgrUDcrVWd6V0Ur\nUEphY0xHc04vdm1VMnJwajN3WHQ2UHcKLS0tIDNod0ZvZlZQalNKQmRhUFlOSUEy\nN1dmWnJLemVOQnhlMFAxWWl1bzk1RTAKu9wb50yH5MH25lb7Bztfr174nQMp9QLc\nUPXKQ3lgCOSltyQNtMOFvGYcFRVRfsSwp9unD0BEw9byhcGyTzchlw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBL1hUNnhl\nRnFVUVl5WUpwRjZGQUtXcmNVZzVDNUk2dXRjMmpNVmhKdHliNQpmYmZ1VXJoZjVB\ncUlIQTlvZ0ViTzJVbm04Zzh4b05FSDNzSDhWcjZVdmhzCi0tLSBZM01meGxyYnRu\nV2p3cDhFdFZUalRnOWZqOUZZSmgzTUxEZDRTNndpRHZFCnEuUAsLmtVIUuPEDqg+\nWvVb8mkHx47sgyK6HbJwV5obItuVzlbIZrrEVL30CDa7WzPUC/FxP1H7YPqCWYWl\nWU0=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-06-17T19:07:35Z",
--- a/vars/per-machine/crocus/radicle/id_ed25519/secret
+++ b/vars/per-machine/crocus/radicle/id_ed25519/secret
@@ -4,11 +4,19 @@
 		"age": [
 			{
 				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0Z1dkeWhORUpJQXFrMncx\nVmwzbjJuMzV1N2ZkRktHTGgyS1hxbzFKM3pjCm9ueWlaZGJGUUM0S2dSdkRtbFRy\nMCtOWUVoVENUMkNQVVVnQ3VadGhnSkUKLS0tIFJXWDIzOVJiOHkzQStiUmhrYUtH\neFIyd09tTEp3ZHZMWmpRcnZha3UyRjQKtVeTIccQrYxFzpHFSW2Fz9m02VcOT8Wo\ny9A233d155LjRpcv8T1KxbcPBL0nyRKEBCljCq41w3bB2JfX7zdzRw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4dVdIMVBQanlvRWprZ0Er\nd2RPSnRyUXhmNDFtb0FKUEF5MGJpTm94TkVrCjMvTWpicmhSTkNzU3Ria2dzTHNq\nZVhwRkl3MUdDNXJiSlhqa0hYRHNsY3cKLS0tIE0rQUE0cGdkbVFVc3JHWDdIS24v\nUlQ4LzdveUxzYThvMzFHditQcncvOFkKYAOMDXdTR0HLwOv5OsXQvGUY5QK4LQYA\ncUTyHL5HqnUn1+tnrUPWFkAGcxxv/gwLtta+u3qkK0HppXAU+4tiig==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBaGp1VEt1\nU0NJdnlqYm12T3UwZ3JmbFNrYzJlUUY3ZXZSdHNudDFOaHRZTwpqVXE2VXNnQTZW\nTWFTMDMrU2E5Q0lKOGVPZVZoSW90akhycitzcjlwUzdrCi0tLSBKMzFiK0hqSXdY\nN01lQWE0NFppcFo5QVhzTEozU2lZazVQWHhwVXFhWVd3CsfFbHYhIiwJj4uzGFN2\nmSWXahNJYj3vawrWEr7RppS7zw3EHNLmBbxXXSpXQzPspGqZbwApokdj3kcCaRfi\nIWE=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFZm1mOFhETFNPYXRiNGNB\nbTdLMDNLUG9nS2xZdTNUUmJWWW5FbHcrRW5rCm9SMUU4MDlaYjlRS2daQU1idDA2\neXZHNnF5cTFvUXR3a2dIVGh2a3JZZW8KLS0tIGl0Q2tZVmg0NnJhdWhSc2xUT3VO\nV1dyMzhHZ3NHUmliZ0xPY0hRUzJhaXMKKzu26ao/Mc4A8QQfMgsWfFe3fLzWdO2L\n5n0GAChocmVR4GHllrwDwXZ9YjKPZbGny+B/V3BdNL0MdAZVwdz5Hw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyQlVGQitkYmd3VWd5cjlO\nMWNVL0F1TmJ6VjZPQ3RmTXJOU2JMejRCcDNVCmtHdGF6V0RDTnAycUNwRGU2TlBR\nUHNpNSs5UWx6OTA0bUltWElENkhIZkUKLS0tIDc0Q0tsTG01c0E3SjB6TDVaV2tH\nN1FsK3E1NVRIT0dBL1ZDQVlzaVJsOXcKWsL4BAzrfy7fQfTlJVRlDm1VgxcHRXhT\nJk2bgyJhgyZv8dejfZbgJDJDohEN6PpRp1qdVUxhMrUDuL6joiB6FA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBdXZsUFdI\nWGtmY2pUYnlJenVXRDNCN2tQbVpDb1o3UG1hRzhVTE05TTZRUgpmVlRMYXJnOGFS\naHp5R0pxaXgxY3c3czJYemFtUlhETTA1TnM4VS9uU0RnCi0tLSArMVhlbWg4Q3cw\nSEdmWGxoTjJaVTVtZDArYU1xRmJiUGZNbVlpSDNuSGgwCsWB83ZKUTcN20C0ZuF8\n97ds5e5BOBfYzRFe4mjfIkqRqn+/bD51XZJAuX2/NNfn0QZP3CCw7NsOEG7IYPbG\nXoo=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-10-01T11:37:19Z",
--- a/vars/per-machine/crocus/root-password/password-hash/secret
+++ b/vars/per-machine/crocus/root-password/password-hash/secret
@@ -4,11 +4,19 @@
 		"age": [
 			{
 				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRR0JaTVdRTEJsOExkOC9D\nZGR6WXpYRTFLdXhDckZFb2w0RFk5cTFHZFRRCkVrM0l4QjN1bnlJaTU0eVY2bTNZ\ndDFGeXBkV2E1TEt4NmlMOHAvem42QUEKLS0tIGtuY29McVYzVUl0d2FPRmRadEdM\nWUwzWktjaHdvOHVvWXFKWVRzSEZKNlkKeeCozhNzrt1gI1QlBVACd0ytDaJ+VCG+\n3Fx420ScVSVq0SxpPNv1LOrYW/JyTEeFNCmuPvCSpMCRKmSOF2eoRw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPRW1xa2w4UWUrVzV1ZDdS\nc1B5MUh4RHlkdGVjQVZ2cDJQRGovcjZYbmtrCjV2SUV2WFExVXcxNW5JNEVBc0hr\nYVkyL2xwVmVwVFhmWW4zSWgzbHRjQ00KLS0tIFd3azZRamhmOFlVWWM2dFo4YjFC\nU2RtRURmZEt0Q1dHeUhBZ3hoc1dVQTgKVGesd5Y2FoLaiuojOMevkXXV2K5wXFs6\n9G2JTx8lPBBt0J6tvnr0zKBXxnMJq7TcRgZ9fsnBC6/36IpJ+dZ2Tg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBeU5jL2Ry\nNDZDOGVtYUVLRlJkczYrblRzTHFMZDNLdGRmT1VkWGxSbEcrbwplVC8rMmI2aWJp\nRVA4bWc2cjVZc2FyWE91WEJZQkNUeFR6MmdoaXdEbDdJCi0tLSAyV0kwL3JxZG11\neGNLNDRXUmlLUkp1SjRDTlJEZ09OWUNEVEtBZURCWm1JCv/h0VPNHV03gJiE5HO+\nXEScLRDtZ8g4eRoY58hoz7lHIG08BRYRYUEUEvcSTUnnXOVGbLEKq8vu71kiiubk\nTLA=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXZ240c1hrSmQxUndwSHdy\nMUJDQWJiNExvT0EwRitmcDd6VjFrQUJZNHg0Ckg3TkNOSFVQRUhGcFRZTXFmZDY1\nVnZibHFBVUdDNm9TNm00NTZMVHFWR0kKLS0tIHRxeGkwTnlNejdqeUswSGgwSmNH\nM0RMR2NPOUtFNjlGYityR1BUVnE1dlEK3Y3Qw+2+0XDwOmf323BPuZjhAn1BTYT4\nkEStKcrrVPsua4kQoK7rrdS8euTxmdDixXn7GXOEsfRBzmfaRSf0HA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpUlZ6ZmhZWGVJTkNXTE1H\nR1M2RmlXNnZLYnhIWk9KRDFieEF5eDVvNkNvCnhsT3piakkrby9sQUZMSzlXU1p0\nQ0tsWGdsRGQ5VzVmVkM5UE1sU2xzYkUKLS0tIG1ab3EvclIwOFlPdEVaM2taaFdp\nVWV0RC9JQlFVUk9uemR0T0oxVUFmdjQKWwaqMcu47K59PBam7+5IDFzZYzLEdXNp\nNKqzOY7yNyMFv/QoFcpccgGIeVz5PBXYqKKJQdnSPQIHoCybVUvK5w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBbStkMVRy\nNjJYYllSdGFwRzBtemNTN2FMZ2pWVkVjTDl1R2ZVZUhtSldiWApRaU9MNk1MaDMz\nVTNZRVI0Tnc3Sm16NTJZTEJ5SmVEcGEydmR5RC9PM3ZRCi0tLSAwNmlnd0ovTFoz\nUjR1a0ZqMllXSlZ3NjZGUmY4L01JMElzVkFKUFBPTzhnCg19RCFy9FkH51Z1jxu3\nrtZF0A3u3P50CVIChMtS2cwE+YiDj1C6Dl5urkzA+nmg9h4/XfblT2RcTEXCbeDB\nR0Q=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-05-14T17:21:00Z",
--- a/vars/per-machine/crocus/root-password/password/secret
+++ b/vars/per-machine/crocus/root-password/password/secret
@@ -2,9 +2,17 @@
 	"data": "ENC[AES256_GCM,data:R7GQt7/DDTtX6XUSydCuodA1QeW2,iv:VROiFMVtL20iDecEDVyFko5OvgYEA0Wcz8j/IglmH8k=,tag:HCfQ0oWVXrhvcV/QjSrFNw==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBMmUrZ2tZ\nNjN5dC9IQkRVSG9UdUVWSHJCV3FDeDFHM1RVVm94cW9EMTU5RwpOQnM3RGdLZ1Na\nK0UvekNqVDB3SlE5R01JRWs2VUcrMWpzYm9HbmJzbkN3Ci0tLSBYb0MrSzJON1ZM\nSFMwZGo2MnVtenVFQ2NEbzg1ZlpHMUFwYWtiZ3R5N1hNCnkqV9O2Ecb1fHGRjnCx\nXtAWFvN7IYB1ZV0SagRq7jdQ2g5FCRzcFV796rtND7E4YGrKH+Urf6ENxaCRqsrw\nEcI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwc1F5ajZGVGlqbEdyUG9X\nNk9NakJMNWR4NWN6d2lFUnRNWmxZcTdQYmhRCmZySFFsL2lsZGpYakFuZnJ1czNH\nMGxlQUYxUDZwbU5aTlZaVVBDb05VdDQKLS0tIHZYMlhGejJMWitVOVNRdzcvWEhU\nQVo1eFNGRUdMUHhpeFl3RThNNkZMdFkKW2OpI5QDTFkCVQ5HMYLxPvSN381OS/mr\nRfrulaRXYpcKRS5xE+Kp4OboHIezcYCndLNxsI1If6twP+SqakeVSA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoUXFiWWhyZ3BJR2s4bWd6\nbVQ3UjByWG9VRlVXSzgzSm5MSlpOYi9nQnhBCmxyLzlKc2ZLMnpqeHRtM2prNnJG\nZjZ2d294YThXcTVNaUt0U21pOFVhY1kKLS0tIDVDL1ZMdG1tUmhLRDdiSi9ZQ2Nl\nWjZCR3pSV1ViTndVWndobFlHQ0RFbTgKp24nhr+x1t4vbZECFTHVdctNZ28DePfo\nJcEvncKyzCI7DYQ02/xddgCrnwzquSZclwKcg6DT1zHeume55eGlCg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBbWJiakVo\nRElSUUNCV1J6NElyQjRINlFJa2xzV2k1VWdUTHd1Z1Q5K0dmWgo4MmlpeElSd21Q\nd3RWVityMXRKZ2lxUDFGVWcwMmE1MmhwWFVaSFFHN0pFCi0tLSBXekQvNnJjbmNX\nTnA5dzM2QkdrWEZYYnhGUWZHZnhXM09tdTRhU0Z1ZjNnCtVoFcT/GdtN3Qursajh\n1zydqRjhglBB9thPLEwCjytTUhveOY23QWTl+2MJXJzU1TapnE2IPpHlXykAcf9g\n9Eg=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-05-14T17:21:00Z",
--- a/vars/per-machine/crocus/user-password/user-password-hash/secret
+++ b/vars/per-machine/crocus/user-password/user-password-hash/secret
@@ -4,11 +4,19 @@
 		"age": [
 			{
 				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvR0cwMk1MejFwdXpQR3pF\nRUFuaGRlN01qV2k3U3FjQnJuVVRLdjBoNEY4CmdKcXJTeWpqazJIOFdiMDg2UEhv\nNnl0WEg5b25wbkZsc1lodUUxZkxLd2cKLS0tIHJkbHJtZnhwc1YrNVVCdDgweVVY\nakZYWlBKNlM3YlBiZnB5OWdwYWkrancKTMMFgAdfefUBtuihCuGlDHgBNXK9ppM6\nM6YliifuwsJLiXJrBdJCeOT4E8DjS1tG48VVUOeCAUImWbjL63c67A==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMNFB6cHVvQUVCaGs5enlK\nQkpYd2o4WlFOL0FjRkpsSUxydG1tMmxVL0dvCmsvVDY3cnBWWXRnd2cxandHZlEr\nS3JKbHp5dUx6SHpyUnNIN0tGZkpKSlEKLS0tICtaMElCY0UrQTFRMTlqRysrcnFB\nVmg0ZndpN08wa09ldGRoWXBSTEZWOFUK57r+xqIX4uPMhco8I6B+q9OhYfNGInlG\nFB3LTCBGGItStWYqgNmbKDWpMJk/Mrm/c6mUrkhgCppaw4ssOCZ4YA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBbTJ0cVJU\ncjlQaDNLc2twQmptY0RMbHhsYWhCa0MvR3lWcEl4L2hOSEIyNApaWkdTbkk2RytQ\nSDB3MERja1BDS2dDeU43N0E3S1RtS0R4Mk15NitXZmZZCi0tLSB0RjJEbHl1R3VL\nYkhRV2YyWUlXbWJpS29tVnhLVnFHNXpjRmJmNWdYVTJVCgTtdW8ko9undu70Aipy\nwYS8Vjl5lYXdCjYMpuaBDW7VngO8wHgGaZvcFZBWZW4qjoaLTYHPX2lKYEYJtQ6J\nhYo=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXcTh3dWE2ZzdkaEJ2Tmls\nYjRuWDVWS254TUY1RWt0bFpyTjFnYTQ5OTFzCkNmT3g5N2wrRTRJWlQ4NnovNzRp\nZ0IwVEgvZDhUUit6dFI0czdnL0JyTkEKLS0tIHlWcFVoS3pzendja1orQXNad0VF\nSmw0ZWpya0NtdlJHa3o0TDlGaGtTZTgKuvbeiKjcT+Km3zMeyey7damZfg/GH2Ft\nJSb4I7QUEW6xPR/Wzl+cmk9OoGk94tQ8SsPr11nYOGrUl6bOqaN72g==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvbUh3ZGNTNHdZSHNiM1Rl\nK0ZzSkcwSUhGWEQ1dndRTXZaQWl6QW5qMEVRCm9XaS85S0dtUDR1REtpaG1RbmNF\nVXpwOGgvdGE5bFhIekpUTEk0ZHdKUUUKLS0tIEpnN1J6SldyNytGSFlzOVQzZ3RT\nZ2ZBbGpZcEhCTEtpVldnVXZkNVZUblEKrToM96r+LkKiWg+1Kf7PEAqdTjUapp1d\nBCrWUuNBL/0mFs0C0RMGupnuXsHPKN+LdvgwzeUUf54sezOSM73H4w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBcHpNRmF4\nQTdrM0xCRnFWQ2FJSUZUSkp6VWIxb29sMSs5eEh6amdVVTVlbApzcXFjUndXelUy\nSU1VTFlYcW9lbTZBNm5uVXRKMmFKZzIzZTdzTlg5V1E0Ci0tLSBCSkpBd0FpNkly\nQXpFMm5RbHE1eXZ6STNEQitFbkVSUUVoUGlVdFc1M09BCr641phqc1xBkM7mmSoA\n6PNXs7DDNmM4zgceGf0uB6WgBc/leJysYf8Af5DexxgJMLZpS97dVeyukR4uVoE1\nmhA=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-05-10T20:20:53Z",
--- a/vars/per-machine/crocus/user-password/user-password/secret
+++ b/vars/per-machine/crocus/user-password/user-password/secret
@@ -2,9 +2,17 @@
 	"data": "ENC[AES256_GCM,data:Fo/Vp01uPR8nkb6H,iv:GlrAKIHbhGoL21Kxn3aXTJQ0U6hqothX/LO9kczOgpY=,tag:A2MznPnK90+Wx2S/9sIWtQ==,type:str]",
 	"sops": {
 		"age": [
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBb3Z4RlhM\nU0hVSmhqU3dSbnRMSlFORG5ZYXZlU05SQW9WbmtXVHpoL3ZTSgpjOGtHem5QbitV\nWDdmTFE1M2RaQkJ1TEFSWUVaV3ZXVVordkRhMG5KRjJFCi0tLSBVekpETXp4TDc4\nLy96a0VyWTlCWUpsQnp4MjU0MGx0RUk4NFVwTzNsa3F3CqcuAGQ1oYySnC6BBV6Z\nUh5o+u2vB7VskUcTFGwfFC0eckYvSmj6EfQsTpVrHPfr8w3yD+Qh09mWCi3EdUjp\nlno=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsWHFvdWJub0UrTkIvM3Nm\nZHROcCtkZWduMjIxcmdSUjk2ZHFNTkZsWFY4CnlHMUM3L3I3N0tvc0FZall0VU5Y\ncCswR081ejBXaHhpMFZBTWdYZFRUdFkKLS0tIEZneWowOXZsQW1GR3d4c1J1OTdo\nQ1pVM0NTdktNVU1pb05kU1Z3dVZjcWsKwuj49f46Ty+JAHMV6+iN0puMa46Pn90q\n5GTUb4eZ61YFVfeJswJDwIyE5e6uiibUMdNnlLCN/JBRTFJvoMhpkg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHNUNlRS9Gdy9nb0lkOXlp\nZnNFMXdEQlZTNUhZN2VIMU5ER0xmVERtTEc4ClNkdGF5Z2dmUjJtU0MzaUloREp3\nangwRVg1U3dPRDVtZ05jMXBxNDVHb0kKLS0tIHZnRFNrb29pT3hyc2NrWmZ0bVIy\nclU4WG9hNWVaVlVHUTFOajlrNzRrUUEKxWJkz0U7D4TE/cfKjEmh60mWlIGllfPN\nNmtXc0JsTSztqS6NFtAdqhBi9ATeb6qpdu3wNP4OEbHe9uVFP7nUFg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBK1BHWXh0\nQXdIVWV2djRua0dNQmJjNVdkNlgzRWVoMVZBV2I5RGZJakZBYwpLV0Y5Wkp1R1BP\nKzBsTisvc0ZRWHg5TTJPazhnUkVzTDBxSG5FOHo0ZTlzCi0tLSBUbUdkeVNQN2Fw\nb3Nwc2xoa0pGYzEyMEFJRWtDZ09jRmpCSnQ3VVltb3RvCu39Z3AzMxM4Eq3kSm7x\nH7tbm6Qbx22vzguLIOhltjqkRqChknMhwMlwzV5IHVWghtIp55xloW1HvuAzCEq/\nVBU=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-05-10T20:20:53Z",
--- a/vars/per-machine/crocus/wireguard-keys-wireguard/privatekey/secret
+++ b/vars/per-machine/crocus/wireguard-keys-wireguard/privatekey/secret
@@ -4,15 +4,24 @@
 		"age": [
 			{
 				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnWFN2eTRhYkF3eGMxSVBj\nRmV6aEl6TkFrYVNaSkZNeUt4SkJ0eFpnc3pjClluVExKZnlmZXZiZit0cGx1bmt2\nSTVXVDlUTjJvSDhvODFJT3JSRmFxWmcKLS0tIGpzSzh1NHM3U3ZCYWlkUHA1c1A5\nUENpMW5yS0xXSjYwOG42NGF4cWJQVkUK+o27ZfTVlD1tmqOXll3mTNKDPbmdpqLf\nDd51tfokYg7BVAP4bhgL2CbkH2p8qJdHmo6UcT77Pxvan1MCcgg8tw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvY1BkUm16UkE2eDhuSzdF\neXIrOXhhdWUxaE01Zk5LclpnazBuTEJQMlJ3CmZSM3ZWUVdOUWFCQTdyc3p5L0hn\nS3g4ZUlFdTFVTzUrZTJhaVF6bmdQdUkKLS0tIHRHaE5vUDJrQ0RPaC94STB4ZDl5\nb0NzYTNGZXFyZGI3V09vQi9SNXFNdzQKxWe1zDaRVvpcejQEB1tEFsc3zwfzCIXx\n+EQm9t9fjlU7rwpB2X1dpWyx6OZKRzK4ErvUhXgDWWBGp5Jz8DoXeQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBemY3K2c0\nM3ZYZHBQd2xPMXQ2Syt6RWxUaWloSmxna2FFVzFzZENtL2hhNwpkdkF1aHBWblVa\ndE1TOHJ3Ulk2TEJwZHNWSEcxRTV3bjlqMjVXVVo3TFE4Ci0tLSB4UXZnK0x2VlY2\nL0ZrVnFaMlVVa21lY1g2UVFiRkVFOTVJbHA3QzFVS2VvCpvONFyHigqWBYgx0YPs\nLCYroDHxwcbnRMVhO2LEj+eLwknJBvBLlZviN19pGjIpvuFFXt8Pu26OsWtAbCLZ\nvnw=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZY1VKMHIwbkNTRm91c1Vn\nOVZjWVhrTW5lMlFtaUdTcktWY2JrMFVHMGw0CjJrTWZlbkZKYm5XMGpZeW1pK0t2\nZEw3UTRzZGFBQlVRQlo4UFpLdjl3amMKLS0tIGdCNUtPVEd1U25pZVFYakR0MkR0\nSy9yQXBXOHBvbGdVU2wxOW5Kd0tDSU0KX+iIRVmYse0ECpDFXs16Rv6TE+vcX4qR\nqSBnIZJeeTsva/T0tXXnwSnIG8/nKtHzYPu+j75Sb3d7lXO6h0USGw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxSVh3bTRLaXl4bmFobWQ0\ndmgvT0Y1UzdkUmlCaVF5aWlPUnYyRXRTdmxnCldhNVlpTGZJSHBRVk9sU2l0VjRT\nWjFicWRmUXQ0TDA1dEF5b2hxdnJmU2cKLS0tIEY0OGh5Mk5jdzlpcFdkQVF5bDN4\nakFEUXpXQmVCT09wR1didGJMaGwrUWsKqOCiookFanh8GRtWjR42orvkk7HEVlwX\npdiVVb4KOvZXUmZxUTNnOlPkYE4k/kfZsM+B/Rl1QHG6kBtCwIknjw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBZ3M4dkQw\naThMbGVveHVaV0lNT3dPUjN2SWtXaVZ1NGEvR2ZKN0dncTJMNQpxMkpXM1lJNzVw\nRytxTEJwYVhjSTFYZ2NDTUZtQmJNeDFCQXN0QkRKa2t3Ci0tLSBJNnM0WDRyWjFv\nZDU3clZPcWJERHNuR1NlNU9wVktnNHUvbmF0UDhoMjljCmZR0QtAvt98ZZHZnrOO\nvwQQXpuItsMGoWWT3URwjENfQkU6VVgWJ1GfaNXXr8tst45PGqy4jmdrNoFREhfy\nA8c=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-11-21T16:53:25Z",
 		"mac": "ENC[AES256_GCM,data:gks9AYHofKUmYa9i7+8kpM3cEMWEfQmibjY7dLUqi4TDfLyxlUIoKmbptrwJgWTWBs+Tnb3YrU8RRTFGFXPyyiwForX0/mDHf1pK0+1NmxKWd8X/7hZmARaWXQGe3rwOLdlvgXyZ0qpTOYXa8vNCp14m8HHIvq12tY+RY7/l7dY=,iv:fz0Vsw0bmNr8wgVmRltk4xzNEGU9xGb0f/RilEyIBu8=,tag:AfYTEAUBoUw7sLd9NcMPgQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
 		"version": "3.11.0"
 	}
 }
--- a/vars/per-machine/crocus/zerotier/zerotier-identity-secret/secret
+++ b/vars/per-machine/crocus/zerotier/zerotier-identity-secret/secret
@@ -4,11 +4,19 @@
 		"age": [
 			{
 				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGb1RZUmQrQk1INllDeWhK\nNkZpY2xhc1BuSHYvK2EyNzdkVFlsaGlTRWt3CmFjUmxLOFg3YXViU1FRZFNINE1H\najVXSDNTSHJLY00zcitVQitMU3RkcUEKLS0tICtxSThJbGhQZEpTT2kvSTErb0Ny\nTHlZaStTSjQ3eklzQzNDbHZHQkxITWsK7uxGqGNRU82fZltqYoam76jtcnD6CMay\no4UfTOj5XOSmV+KVGH+e8rEIkUFQItU7GDh51+rmmeM0jzq2iinEcw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1NXlNbFB4bWdrdDZsS0lB\nTUc2MFRnWStvRW93UXRkcWxZZ3dPMXRleW1rCmdRUXhtazQ5b014dFJhK3NhSDJq\nTk1LVzNyOGo1RlZFMjhvVFJ6UnRadDgKLS0tIHZzOW42T1dmR3Z0R09CZFRQcXgw\nWG80MXJweDUrTHdDY085RW1TQXNSSkUK6LkvPYRfBiFJLrq+UXOkIxxRBinyIVA4\nOv+9F6+qTAsVF36zNLaSC+y1lSGH1QfLGrIqKWdHwPqeRzJ0fmnWEw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBbXhUV2xs\nL3VNaUNlZmUwNmhZYjNhWGZYbGZ3RkJjdTJpVnFHNjZrd2pzcQppVTBwZ0hOa0l5\nTSs0ajIyTUxZblRWV1FTd0orcFJ3VG1VM0tDaVlIN1pvCi0tLSBqZys2b25VS3pS\nVDZXd2UrcDZDZDBBbTRSUjlQS0RCaXk3WEt4UVlqanZrCtiDuhJzNM8PEvEbknz8\n6BynCKPUVu5U/8b47w+kpMPLX90hzhLesvcMjsHRc8k9lTOdDPeP9v6nI/M1jtm7\n0Gk=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5ZWF1MHUxOWRPYXE1Mzcw\nekt1UWZ4S3ZEQndDRjdTRHppUnVNVzNRVkJvClBQZGRMenY4bEovR2JUTXIxSXVW\ncHVrWHM3OWFuS2dIOTZGU1ptNEl2aTQKLS0tIC81cEFsR016dzB6QnVZdklRd2dG\nUjEyMnAzcXRtRExXU0R2akZGclk3dDgKLeZeDfzv5BfNmYt5FxZ1num/g/grZ7Xp\naLfufRxsEMrOhKZxTmY/x7ZxfOP6HfKgyH3j2tRAjBNwnPSst9QpPw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnMjJBUktGZkxqSytKMFBw\nbTFpTkZ2aGVhNG5PT2t4SkhMQ0tzUUlqQlU4Cmlla0lQNkpJWFJIb3JYWFVxQVE0\nNVNjQlllb0Vra2lKQXBxaU5BR055eTgKLS0tIFNqR1pSa3oyVDdvMzlJUnE3QS9O\ndFozQUtZeXI2blpmUEJRRlJkNjNlQTgKuXcMlm5EuJCjsoeUPTBZRPdKzvBLba0q\nJoaBjrX6qKjmMs9WgbEnoL7nz7i7DXOJTPTUULbhfKHM17MIkK4ZOg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBcnlRLzJo\nVkhaT1AvUWYyc2IyRTFyakdJZVMwWjlGbllQL3A0ZVhvQVBWQQp0eGhiZy9ZbktS\nSHlvVVFJVVg2NnFYZEFDcjc5VWlYckhxRmdLSmVyMWVzCi0tLSBpSkZLNjh1RWcw\nai9LOGRyc2JjQjEybVIwT0RmdW1zNGFLZXBHZVNWMk5VCgfiwtplC9rd1LhEBjEy\nzeyzxShIuKIQ2IdgDMnfmFEmyMSJh9LsqE62nbzxCXC6QIaIYLIczKggz4aiCVK9\nihs=\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-05-10T12:16:13Z",
--- a/vars/per-machine/genepi/borgbackup/borgbackup.repokey/secret
+++ b/vars/per-machine/genepi/borgbackup/borgbackup.repokey/secret
@@ -3,12 +3,20 @@
 	"sops": {
 		"age": [
 			{
-				"recipient": "age1h0vx6w4d89amt90j3u0vm96gvjt9lwczsjamaakyew524x9u8a8qu5qvg5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0SGREV21wekNCeTh2Q2FC\nRUY3NFJNbkFiaGVEaCsyZEt4MnZGdVNMbEE4Ck5OQ1pUN2puSHFBQjdnTTNVZGxK\naDVBV2N4OEJpd1YydDAxRSt3NEo3emMKLS0tIHArRzhTdThBSHNZRDNrbU80WmJh\nenpJUVllRURhZzRzbmtLdEJVMEtLaWMKWIuT+Asla9W7eZcIeBqz6jvnp8JCb2a2\nHaMn8TucGJrSuGbCTACTBDv6/CZUGpD/pVolwROVXalighoAN5ryIA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBNkVsV2hP\nVDNiWFloMWVLMTNLR2hURTl5cGF4Tk8zMzhuSmx1NHdMSDFQbwo2SnFBQStTU0pK\ndkVtUGk5RGRvaEFTSWVLQXA1UXNxUzVSbDZ0OEZOZVpvCi0tLSB1b292aUZlaDBx\nYVYvZCs3WS9oWmt0N0tZSWNnd1EwTXlNeDRQTGlnQW40Chia0ihnLnSTMyIfijLt\nqbEsQ4nhoB37vAZN1goV5YSmp0RubZoLJLcGTQVWqdmhJ7FE3KjRcf1wDq3irDqa\ndZw=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBMjBxeGt5\nOFFnMzlsaEh3WFlyMnFrQk16MjRJNk9RWkNWemdDSWdXSjVXSwp1aHkrSDBUZHE3\ncDIrd2JjVEV3cy90RUFXMXJNQWpwMXh0aG1lNUZnSWI4Ci0tLSB1Y2krK0VmNkFS\nZEdiOG5PNHF4UzFTZ1ZuT3krQUoyMS9XMFNJTE1MeW1JCgR4TqauuGY6LRimxyTb\nNN6ifGjJftAE44bAhHMg9fvO3dMt9Ql0SPZaetkaPeuVCjJ59yJQW7AFS4IPYD0W\nTug=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoQ0xnWjdGYzZIcnhreStp\nU2dJeXo4YkphWmhzaEFGcmtqTXk5N2xZY1ZFCjlVdWpycmNNYVNta0VSbjlrcnRo\nYkppdFRWME4zdkdnZFA0MCs0elBoSUEKLS0tIHdkUlJVeS9WQmF4ckVJa1BkTjJJ\naXVRLzVLQmM5d2xKSDRJZEtabWpCOGsKr2Q7ME0iGCeo1+uvMdAkbGWujQtzT0rP\nvYTSUdIllvB4zCkj4vK1h2/tl7dp3dwg6QI/qA1NZf6vrHQhakIRfw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArZlJ2dHJveWdmYUJpS1JK\nNEx4b2UycTV1VGNoRXR3ZkZMZWQ1aU81OUYwCm9UcG4xMVdabThCbHNPT2xyWm5x\naXEvV3dZWkoxbExvL25VUzdTUGlpQ2sKLS0tIE5ZcG5MSFNVemtIZk9ZUVNPNUM5\nOGlJaGNnQ2RVeUZmcVdySGRvRmhaY1EKRl29NkOdifFk5ZHNGL2WS/TjsQ7x4dKa\ncwyWwWb+2n5gyAwKPeV6oxQBVuebqvUAWeNLh7NBgqN8spXSqVr1rg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1h0vx6w4d89amt90j3u0vm96gvjt9lwczsjamaakyew524x9u8a8qu5qvg5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQWHRVN0JSY3lobnQrUFFq\nOE9KamVXWkhhZ0s3S3pnK1RkZ1dWa2hhTmljCkxJZVVnQjhGV1pNS3l1Vzd2TmNH\ndHpNKzN5NStUN0lSY3hJcFBSa0VUekEKLS0tIGFHbDFnQTN1L2JOd3YwZmw1QXEw\ncEw4NlBsRHFkS2hpSEF3VitCU0VHK0kKBl8wvRWi/pEcnF7UomWkrxOc92iPcdm8\nfg35vdLclvbMf5vDJUfmoarxTruFY6+Gnns3B7Ai8ulFZGjFoYBjhg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-05-15T13:43:54Z",
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Romain Paquet	dce4057083	update readme	2026-01-31 14:57:10 +01:00
Romain Paquet	a0234b7b6f	nextcloud: add calendar and contacts apps	2026-01-31 14:43:31 +01:00
Romain Paquet	59458a3ba1	haze: use lanzaboote	2026-01-31 14:43:31 +01:00
Romain Paquet	5bd14cffe9	alacritty: auto switch dark/light theme	2026-01-31 14:43:31 +01:00
Romain Paquet	0747388105	nixfmt-rfc-style -> nixfmt	2026-01-31 14:31:38 +01:00
Romain Paquet	240cb89fb7	update flake inputs	2026-01-31 14:31:27 +01:00
Romain Paquet	fc81d4ffc9	add forgejo	2026-01-31 14:31:15 +01:00
Romain Paquet	d0c9fdb625	infra: fix migadu generator	2026-01-31 14:30:05 +01:00
Romain Paquet	fb136061cf	add lanzaboote	2026-01-31 14:28:44 +01:00
Romain Paquet	782ac7140d	Update vars via generator forgejo-s3-storage for machine verbena	2026-01-23 13:31:31 +01:00
Romain Paquet	01f9ce7503	infra: add missing wireguard dns records	2026-01-20 15:52:31 +01:00
Romain Paquet	1ef49241b4	remove wofi-emoji	2026-01-20 15:32:04 +01:00
Romain Paquet	3d5695c9b3	helix: auto-format ocaml	2026-01-19 22:40:41 +01:00
Romain Paquet	de32fe0db0	migrate infra to terranix	2026-01-19 22:38:28 +01:00
Romain Paquet	32c4eeb2f8	add terranix	2026-01-19 22:37:34 +01:00
Romain Paquet	f1e06aaead	Update secret hcloud-token	2026-01-19 15:49:10 +01:00
Romain Paquet	93b923c146	rename nixfmt-rfc-style -> nixfmt	2026-01-18 17:06:18 +01:00
Romain Paquet	123c3edb0e	update flake inputs	2026-01-18 14:11:52 +01:00
Romain Paquet	6bb5625bc7	enable nix pipe-operators	2026-01-17 17:32:25 +01:00
Romain Paquet	65792b7ad4	add rage	2026-01-17 17:30:57 +01:00
Romain Paquet	8b9ab0b215	change default user shell to fish	2026-01-17 17:30:00 +01:00
Romain Paquet	f3d5f8e5d7	update flake inputs	2026-01-17 17:27:23 +01:00
Romain Paquet	a8d52b0473	update garage crocus hostname	2026-01-10 13:04:58 +01:00
Romain Paquet	a36f64cb93	add direnv-instant	2026-01-10 13:03:55 +01:00
Romain Paquet	1e8e04bf24	enable pcscd for yubikey	2026-01-06 15:51:35 +01:00
Romain Paquet	87e589e690	add .val search domain	2026-01-06 15:50:45 +01:00
Romain Paquet	c9953d269b	remove gandi acme	2026-01-06 15:48:51 +01:00
Romain Paquet	d162591696	infra: allow more recent ovh versions	2026-01-06 15:47:03 +01:00
Romain Paquet	4ce5811615	update flake inputs	2026-01-06 15:46:21 +01:00
Romain Paquet	600e2c26c9	add vaultwarden	2026-01-06 15:46:18 +01:00
Romain Paquet	d3201fbca9	move coredns to port 53 to allow access on android	2026-01-06 15:43:40 +01:00
Romain Paquet	2063550f93	setup internal CA	2026-01-06 15:43:17 +01:00
Romain Paquet	dda8ca5d0f	move services to internal clan tld	2026-01-06 15:43:17 +01:00
Romain Paquet	9e3d99231d	infra: allow more recent version of ovh provider	2026-01-03 23:43:01 +01:00
Romain Paquet	c79df328de	infra: fix terrible copypasta	2026-01-03 23:41:23 +01:00
Romain Paquet	7a8b12bba4	infra: remove gandi	2026-01-03 23:41:11 +01:00
Romain Paquet	caa0179f1d	refactor nix module list	2026-01-03 22:57:19 +01:00
Romain Paquet	d2c624fe9c	genepi: remove mpd	2026-01-03 22:26:56 +01:00
Romain Paquet	3a2dd0cc0b	configure email for aerc	2026-01-03 22:24:11 +01:00
Romain Paquet	afb8dd50f4	niri: reserve first workspace for web	2026-01-03 22:21:52 +01:00
Romain Paquet	82a559e81a	remove deleted vars	2026-01-03 22:21:28 +01:00
Romain Paquet	f8fb7a2480	add passage	2026-01-03 22:20:52 +01:00
Romain Paquet	410f63eb31	add jjui	2026-01-03 22:20:36 +01:00
Romain Paquet	2b2b5d30c7	migrate rpqt.fr domain to OVH	2026-01-03 22:17:25 +01:00
Romain Paquet	964b9b5b4e	add age-plugin-yubikey for clan vars	2026-01-03 22:15:49 +01:00
Romain Paquet	010c53b6ad	remove sway config and outdated dotfiles	2026-01-03 22:11:35 +01:00
Romain Paquet	e7ce8dba6d	cleanup flake inputs	2026-01-03 22:11:35 +01:00
Romain Paquet	2d8bf05283	Add key(s) for user rpqt to secrets	2025-12-31 00:22:18 +01:00
Romain Paquet	3206d3f476	Add key(s) for user rpqt to secrets	2025-12-31 00:21:10 +01:00
Romain Paquet	7d34c5c7c0	add delta diff for nixpkgs-review	2025-12-27 18:23:45 +01:00
Romain Paquet	9c266bf1df	remove taskwarrior	2025-12-27 18:23:30 +01:00