fra1-a

2023-08-26 07:18:27 +03:00
parent 1baec30bc4
commit 1db9253ae6
18 changed files with 255 additions and 126 deletions
--- a/data.nix
+++ b/data.nix
@@ -48,6 +48,12 @@ rec {
      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBudUFFEBpUVdr26vLJup8Hk6wj1iDbOPPQnJbv6GUGC";
      jakstIP = "100.89.176.2";
    };
+    "fra1-a.servers.jakst" = rec {
+      extraHostNames = ["fra1-a.jakstys.lt" publicIP jakstIP];
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFj9Ktw9SZQlHe/Pl5MI7PRUcCyTgZgZ0SsvWUmO0wBM";
+      publicIP = "168.119.184.134";
+      jakstIP = "100.89.176.5";
+    };
    "hel1-a.servers.jakst" = rec {
      extraHostNames = ["hel1-a.jakstys.lt" publicIP jakstIP];
      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF6Wd2lKrpP2Gqul10obMo2dc1xKaaLv0I4FAnfIaFKu";
@@ -82,6 +88,7 @@ rec {

  jakstysLTZone = let
    hel1a = hosts."hel1-a.servers.jakst".publicIP;
+    fra1a = hosts."hel1-a.servers.jakst".publicIP;
    vno1 = hosts."vno1-oh2.servers.jakst".publicIP;
  in ''
    $ORIGIN jakstys.lt.
@@ -99,6 +106,7 @@ rec {
    dl                               A     ${vno1}
    fwmine                           A     ${hel1a}
    hel1-a                           A     ${hel1a}
+    fra1-a                           A     ${fra1a}
    vno1                             A     ${vno1}

    @                               MX     10 aspmx.l.google.com.
--- a/flake.nix
+++ b/flake.nix
@@ -118,6 +118,25 @@
        specialArgs = {inherit myData;} // inputs;
      };

+      nixosConfigurations.fra1-a = nixpkgs.lib.nixosSystem {
+        modules = [
+          ./hosts/fra1-a/configuration.nix
+
+          ./modules
+
+          agenix.nixosModules.default
+          home-manager.nixosModules.home-manager
+
+          {
+            age.secrets.motiejus-passwd-hash.file = ./secrets/motiejus_passwd_hash.age;
+            age.secrets.root-passwd-hash.file = ./secrets/root_passwd_hash.age;
+            age.secrets.sasl-passwd.file = ./secrets/postfix_sasl_passwd.age;
+          }
+        ];
+
+        specialArgs = {inherit myData;} // inputs;
+      };
+
      deploy.nodes.hel1-a = {
        hostname = myData.hosts."hel1-a.servers.jakst".jakstIP;
        profiles = {
@@ -154,6 +173,18 @@
        };
      };

+      deploy.nodes.fra1-a = {
+        hostname = myData.hosts."fra1-a.servers.jakst".jakstIP;
+        profiles = {
+          system = {
+            sshUser = "motiejus";
+            path =
+              deploy-rs.lib.aarch64-linux.activate.nixos self.nixosConfigurations.fra1-a;
+            user = "root";
+          };
+        };
+      };
+
      checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
    }
    // flake-utils.lib.eachDefaultSystem (system: let
--- a/hosts/fra1-a/configuration.nix
+++ b/hosts/fra1-a/configuration.nix
@@ -0,0 +1,79 @@
+{
+  config,
+  pkgs,
+  myData,
+  modulesPath,
+  ...
+}: {
+  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
+
+  zfs-root = {
+    boot = {
+      enable = true;
+      devNodes = "/dev/disk/by-id/";
+      bootDevices = ["scsi-0QEMU_QEMU_HARDDISK_36151096"];
+      forceNoDev2305 = true;
+      immutable = false;
+      availableKernelModules = ["xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod" "virtio_gpu"];
+      removableEfi = true;
+      kernelParams = ["console=tty"];
+      sshUnlock = {
+        enable = true;
+        authorizedKeys =
+          (builtins.attrValues myData.people_pubkeys)
+          ++ [
+            myData.hosts."hel1-a.servers.jakst".publicKey
+            myData.hosts."vno1-oh2.servers.jakst".publicKey
+          ];
+      };
+    };
+  };
+
+  mj = {
+    stateVersion = "23.05";
+    timeZone = "UTC";
+    base = {
+      users.passwd = {
+        root.passwordFile = config.age.secrets.root-passwd-hash.path;
+        motiejus.passwordFile = config.age.secrets.motiejus-passwd-hash.path;
+      };
+      unitstatus = {
+        enable = true;
+        email = "motiejus+alerts@jakstys.lt";
+      };
+    };
+
+    services = {
+      node_exporter.enable = true;
+
+      postfix = {
+        enable = true;
+        saslPasswdPath = config.age.secrets.sasl-passwd.path;
+      };
+
+      deployerbot = {
+        follower = {
+          enable = true;
+          uidgid = myData.uidgid.updaterbot-deployee;
+          publicKey = myData.hosts."vno1-oh2.servers.jakst".publicKey;
+        };
+      };
+    };
+  };
+
+  services.tailscale.enable = true;
+
+  networking = {
+    hostId = "bed6fa0b";
+    hostName = "fra1-a";
+    domain = "servers.jakst";
+    useDHCP = true;
+    firewall = {
+      allowedUDPPorts = [];
+      allowedTCPPorts = [22];
+      checkReversePath = "loose"; # for tailscale
+    };
+  };
+
+  nixpkgs.hostPlatform = "aarch64-linux";
+}
--- a/modules/base/boot/default.nix
+++ b/modules/base/boot/default.nix
@@ -26,6 +26,11 @@ in {
      description = "Specify boot devices";
      type = types.nonEmptyListOf types.str;
    };
+    forceNoDev2305 = mkOption {
+      description = "https://github.com/NixOS/nixpkgs/issues/222491";
+      type = types.bool;
+      default = false;
+    };
    availableKernelModules = mkOption {
      type = types.nonEmptyListOf types.str;
      default = ["uas" "nvme" "ahci"];
@@ -130,7 +135,10 @@ in {
          generationsDir.copyKernels = true;
          grub = {
            enable = true;
-            devices = map (diskName: cfg.devNodes + diskName) cfg.bootDevices;
+            devices =
+              if cfg.forceNoDev2305
+              then ["nodev"]
+              else map (diskName: cfg.devNodes + diskName) cfg.bootDevices;
            efiInstallAsRemovable = cfg.removableEfi;
            copyKernels = true;
            efiSupport = true;
--- a/secrets.nix
+++ b/secrets.nix
@@ -5,9 +5,10 @@ let
  motiejus = [motiejus_yk1 motiejus_yk2 motiejus_bk1];

  hel1-a = (import ./data.nix).hosts."hel1-a.servers.jakst".publicKey;
+  fra1-a = (import ./data.nix).hosts."fra1-a.servers.jakst".publicKey;
  vno1-oh2 = (import ./data.nix).hosts."vno1-oh2.servers.jakst".publicKey;
  vno1-rp3b = (import ./data.nix).hosts."vno1-rp3b.servers.jakst".publicKey;
-  systems = [hel1-a vno1-oh2 vno1-rp3b];
+  systems = [hel1-a fra1-a vno1-oh2 vno1-rp3b];

  mk = auth: keyNames:
    builtins.listToAttrs (
--- a/secrets/grafana.jakstys.lt/oidc.age
+++ b/secrets/grafana.jakstys.lt/oidc.age
@@ -1,13 +1,14 @@
 age-encryption.org/v1
-> ssh-ed25519 gJrHQg FIcNGRpq57RyXSx7ggde3ix79ijt7EHnU8LhMRrXiGk
-feCa7Xln/wTFxSfBt1wW9nJDUunp1ng01kRR4fX3wtk
-> X25519 9a/Z7fQMlb2Ossnx6OQfOEn+Sc7EkjH1qvRnAUNO3nI
-gfpPM7RauKm2NnOfER+zJvJjaVEZOmXjxkbWKFGOUGw
-> piv-p256 +y2G/w A4oYywSwobBVMGs3RTxmvnh7TQV1FYlNYrUVVqEjFUFa
-qVGtilxTsOOkYaSQ8c8Io4JCqxuJSHB8szEEWc9HWNU
-> piv-p256 jNqd3A AsVFA1wUy811MHNgMoCLvd3ETXbd8XxSr3uCgqGh7414
-d366KUCPHzScDv4A+9DkUcqRgfnpzoHwKXPTI6RM1Pc
-> pKOSD-grease jSg. !!V_P>| +K ~E
-JklMXPMAv8vHnxBr/F2g4tAKmDoe0ub/G45MSxmG5E8/HtE
--- zzyjEbFgNDFzw+NQaFyCJlqmkuYubPu2VKnkR2RHIcc
-<EFBFBD><EFBFBD>ܥ<EFBFBD><EFBFBD><EFBFBD>lJ<14>NT<4E><54>s<EFBFBD>ۍ<>-LL<13>H<EFBFBD><48><EFBFBD>|<7C>C<EFBFBD>b<18><>J;<3B>k<EFBFBD><6B>JQ4<51><34><EFBFBD><EFBFBD><EFBFBD><15>`<60><07><>U<EFBFBD><55>g1<17><>ur<75><14>{[<5B>_Q<5F>rR<72>[<5B>=1
+-> ssh-ed25519 gJrHQg AwfB7w4hVyiTnbbFhZp/TYjwKXh4u1vV4tW7fbRSUD8
+sVSnkjJUZM9sWy7xXy8CaxzzXe0z0ZX4hhKwpnSgaGA
+-> X25519 ZferPUdGyYwe9xe0oDZtzsioOSTO1VOZO/6cFn9oIjg
+4jwGyF6Qhdu1mTLbjtP5rT2poLC5tBaZqwufRIeZ17I
+-> piv-p256 +y2G/w Ai8ntDMBKe2o8AoIpy3bt4zaVGq4PivLBqvUncQ3M6bf
+1XQ1uOpipPR15fWWo5uhNHxlewJDXwIdq3axCIBn1Ns
+-> piv-p256 jNqd3A An1OrvEft3fnhdpfgLYkr2mzJAQhFgXEkrhcMJNzH6u9
+iGA+p7inVs/5L0SMrZXWeKQ7fozTMyBxXTSZLbZCHDM
+-> np%0L/z(-grease nX]
+y39sQdw8Mk3unpOkDXVIyFGlznFUecLzsRTBo1BPjwEAbZH+ppzBceiB8XYJvsGZ
+Zo
+--- gsMsI9JUPzLqFZVh1Zq+jtOsm+D0c2k6POXnXc9nV6E
+Y_<59>H<EFBFBD><48><EFBFBD><EFBFBD>f7<0B><>/<2F>/[)><3E>=<3D>S<10><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>3<><33>\<10><><EFBFBD><EFBFBD>+<2B><>r<EFBFBD><0F><><EFBFBD>`<60>ƷtV݊<17>1<><31>
--- a/secrets/headscale/oidc_client_secret2.age
+++ b/secrets/headscale/oidc_client_secret2.age
@@ -1,14 +1,14 @@
 age-encryption.org/v1
-> ssh-ed25519 gJrHQg /05rQ0bweVNFPoI6a7w4CMk8iKdObSnrK5mzU+OtAls
-fEO5kDvRF049alg3AMxTwJ+KiFoh+o/6gRYxFUEdIRI
-> X25519 rGiyMZnRwYcvcoFkBXfwxDy71/F7RC4xL2ILY/3KAHE
-9thFbnnBvOJsopicp366uU3bJGJ2Tu4ETkhKFRWFU6A
-> piv-p256 +y2G/w An1oipHxaTcuwMJtW2C+J7fiE4rafB19fCxouyW6k8Ml
-/JsGUuNknM1K9PEfrwOPr2r07sChEgy80GFytvH+1Tw
-> piv-p256 jNqd3A A77/PWu+DQbUNVjv6CeDB98nSZPojVXlSmk8Ed8cW0Ya
-WPseJycaWCvC15+RvjJSpfyMR2kB8+jK4JIsE6fz2ws
-> +WA-grease Z[ q+*
-p2PdS7tDHpBr3/2EQbUXqFs5H9hAkgvMy2hiYJR5gGgLjXXFdteza2DHAP4knXfZ
-iBXIy54
--- H4QPWaIOL3GIPmPeRirGJ3W9zqjryG/cb4f+tMdJ8do
-OU<EFBFBD>"D1<44>s+<2B><><EFBFBD>& <EFBFBD><EFBFBD><EFBFBD><EFBFBD>^<5E>)ĎI]J)"<22><>|<12>b<10>a<EFBFBD><61>2<><32>dcRﰅ )s<>x<7F>s*<19><><EFBFBD>s<EFBFBD>¦<EFBFBD>iH<69><48>L<EFBFBD>em<65>m1r<31>2
+-> ssh-ed25519 gJrHQg wew/aQ8cC6zokYR5ysGTKl6Hlk5+FkMHGm9tPlnOBHc
+3Gv9k+wQ/1+J6N0SwYkPBQzIY30dUm9vRT70pQE3kRM
+-> X25519 v+zcnSwoOYbvuJ2lJqR8omrYWHLuTOWGIeIHEnPOCWY
+VlUlnwWtlAze04CIjgxU5Hxhg/aKEza9FaB59yTwPh8
+-> piv-p256 +y2G/w Axb188Nt8Hgg1ld9G9WRmua32quiozY137fOJTJ3U5o2
+Czw71F+TZK+xrqlZWLbT4ZXRhOjTqxMWbHa47BPxnSQ
+-> piv-p256 jNqd3A ApkWxW24HNtvrh9FTHoTdL5Slg+egLPM8B4SsCasg6H2
+EQsZGRWQeHZ+MyNH1JLnp7Ivaep8ndGdEaHvCs58reg
+-> ':zBd6BO-grease k )9bGRs +`I+}e=y 1+2f
+EtDLRcOK7FZPcIMAPvdG3Lm/gcZ6BhxVDpwWGaS/5Xbz/l/vCvlxpBKZhDJbLO2v
+pRrCHgwzZ1F4beoEsoUMbetgu+RWeuN20PoRqYcF/bqaEw
+--- Y44uyHqYhyONGZwhugfiL15SYPwNa1Hnc0uWTC/K47I
+<EFBFBD><EFBFBD>%<25>%ʹ1٠<31>%<25><EFBFBD><EFBFBD><EFBFBD><EFBFBD>s<07><1C><><EFBFBD>y,Z?<3F><><EFBFBD><EFBFBD>|<7C>5<EFBFBD><35><EFBFBD><EFBFBD><EFBFBD><EFBFBD>`~<7E><><EFBFBD>rUpTE<>
--- a/secrets/hel1-a/borgbackup/password.age
+++ b/secrets/hel1-a/borgbackup/password.age
@@ -1,14 +1,13 @@
 age-encryption.org/v1
-> ssh-ed25519 vDjOfg uZsTUwEu/YMai2awdIq/BQFWY3abjsVwkMEmdXnGdRE
-Qb2875RKIevWlZLFI6p8nzYHJZWWBEaneJN3O3av9Nk
-> X25519 w4QdhZ6T83yEtmMmHYxuM6OzvfxKYnDRSrFNnT/DUEU
-0/wyhwb9l+apT4f3yLycoNdc8KAGD7jN01MP+rIQSQw
-> piv-p256 +y2G/w A9zY1wzeRZns4KLJw9atZ3yeht6C3hn6ZX5/U6/gKsZj
-WDgCACCvTzWvrGEnyxH/5m8IYF2L+V0Oju+Bpc207oA
-> piv-p256 jNqd3A Aup30eQTR+vsmv1cax857STTmDcLZt/LYGr04A1b+gvN
-EfrHZNnE0kVYs5pFPjMEJBGGvQWQMCduBYcLimR/5uM
-> 8J-grease
-Ke8pF2bIDFLnG7x3WE0nVjs0/b7uiUCWsKkiMGfmGWweEPKp12WzW0I3nbY0W+RG
-mkg2tLP/e3f3Bg1ojHGLAxviPNarGMLHggHfqA
--- OpZ8utdErw6Y+ft54h+M8U7RqSpiMrVLmF5CeVgsOXA
-<EFBFBD><17>0<EFBFBD>S<EFBFBD><53><EFBFBD>=PF<50><46>%<>)<29>t<EFBFBD><74>H<04>GP<><50>WD<57><44>^Q<>A##e%<25><>A~<7E><>UA><3E><><EFBFBD>
+-> ssh-ed25519 vDjOfg qE1m5wfe6EDznGY1+wSOpjQUKqtTxIDdchhCI9k5XDk
+QYY1XoNgPSKG7FviZ/eKd1JRnzgxqJ1Qk1N4Mef2VgU
+-> X25519 w7kjkHTAfCa/BBR9UIt5Ot5J3E3/5eeEq5UYzeI5kyA
+muOd5sJ7ltp+Qoa/4u2JK6nDKDznOGIdXdW97EJd5kw
+-> piv-p256 +y2G/w AgL2mVamTDtUpdh0aP1uEh50rHRIuKd+2lwx+bJ+lzXJ
+YHrtfcMdVwVRaDlO2w4mRFl/a9B7EUzCChVRk7dZvFk
+-> piv-p256 jNqd3A Al5XgSsapW+fByHbnzuHrf4EOigaCPcddad5uT8IamSw
+7opGoEQkyNwmQpiKg2Cv1iD+QoJciE/ge6cfvY1CGj4
+-> +-grease *T {@-1U qK wp
+A+n+ZsIvo09wWd52WR+ALEPHTcFm5Eg
+--- LJnZrv1AE60TX+PQl1cGayCh4Y337S/Kb48FgTgNDuI
+<EFBFBD>k<EFBFBD>q|ۘ[<5B>h<EFBFBD><68><EFBFBD>]><3E>u<EFBFBD><75>1<1D><>j"<1A>q<1E>o<>fΆo<CE86><6F>a<EFBFBD>c<EFBFBD><63>><3E>.ȴ<><C8B4>AЮ'<27>
--- a/secrets/hel1-a/zfs-passphrase.age
+++ b/secrets/hel1-a/zfs-passphrase.age
@@ -1,14 +1,14 @@
 age-encryption.org/v1
-> ssh-ed25519 gJrHQg FWA1lK+TeNBOpcRkyTlg1RR1PWcq998uQzNJBJDjIUE
-5Nu5BQE1qjJ9xIqFGVMUCyx/QyHO2r4Ix0oVggUdj/M
-> X25519 5s5tQfEM12E80k9ijUtHJ3reh/eBySGKy8dsdtOuT28
-U3MheuBJ2M9qtBTAE5Vlbx/1sOrr2/MgJo65Sxv9Vs8
-> piv-p256 +y2G/w A24qVT5zeyEx0ZnsoBDUJuT4yNttPQZSuy0cvP5dBuXp
-+ofdTddNA2DULyNCh1G/Sz+AcvIGXjoiecN8Lc5MQuE
-> piv-p256 jNqd3A ApCoXMRihIMxiMRCMyfHWlFCli4RWxi+B4OZbb5rXFBh
-YZkECC647AFW13wUw0//jsoQUoBcjzk/FDVzGdZ8bEU
-> 3<n-grease sr"G g UjuP/CP @Ybu;j
-si4K9TTzPCNThYW9SGoqmrMmbyfwDntvCGNBKNI4+Cs/RNdEbjqSU1XL6h9SzoD4
-EYE6TbotpitFkZQqO6z0gNtPppLm0blqnw
--- lgz2xoEoMtAMctBQus6bHdf5JOtem281WvCTgnJPsyI
-S<EFBFBD>+<2B><><EFBFBD>7{<7B><><EFBFBD><EFBFBD>C<EFBFBD>XCc<1F><>5r<35>U<EFBFBD>\<5C>&۫g<DBAB>ҁ<1C>N<EFBFBD>^Mrܽ><3E>G<EFBFBD>N<EFBFBD>#Y*<03>6<EFBFBD><36>wɹ<77><EFBFBD>
+-> ssh-ed25519 gJrHQg I/eHDEwq5k+VUaw7K9NZMi8QAJB9oRYh++h+MmIwHgI
+aNJrHNG344QJ3Gu5aOglIApuJ/81q+zwzPdn8vxlz1U
+-> X25519 OacNJ2QUbzyCLA14VaFV7iDbvnvxcHGhrbb3W+U9n2o
+gI/gTlOG1Bf6VtnywvbK/sBw7qifccYN//ewzAiqOXg
+-> piv-p256 +y2G/w AzTSWUxWmA2PfCuSHwnvvpptSbuXlJUvcb06wC2NUR9I
+rQk5jOiOaAUY2K/3cOU85Ybc2CQE9D2w7OKEtjQjpJg
+-> piv-p256 jNqd3A AtbxvFxcX2p9rI4nGtO6I+fQpcjOE/VY4zfM0HPZMyuN
+3WzZpLoD7EGUnhVYWtu+RUA6hQlYMZht5I/7XfuiREE
+-> 3;W'_6-grease QPW Lo bMh
+H7kK9Mv1FebKetEpM7OCh88zHZosr2O+knlIUySwcOLyuYuG7YKX7kn6EewLOECe
+k08/HrRocSDsM+xf7TLS6daHq+DtdTM8u18Kt+l8spdIzPdpRBqs9DSp
+--- 4MS301cyK8LfYfi8+rypmOAl5cf8a+BB5JFm6uP4aX0
+<EFBFBD>U<EFBFBD>̯Neƭ<65>0<EFBFBD><30><EFBFBD>p<EFBFBD>r<EFBFBD>}3f<33><66><EFBFBD><EFBFBD>\¹ꈞ<C2B9><EA889E>q<1D><04>l|<7C><>"Ԣ<><D4A2>ȏ<EFBFBD>+f!z<><7A>8F<38><46><EFBFBD>7<EFBFBD>
--- a/secrets/letsencrypt/account.key.age
+++ b/secrets/letsencrypt/account.key.age
--- a/secrets/motiejus_passwd_hash.age
+++ b/secrets/motiejus_passwd_hash.age
--- a/secrets/postfix_sasl_passwd.age
+++ b/secrets/postfix_sasl_passwd.age
@@ -1,17 +1,20 @@
 age-encryption.org/v1
-> ssh-ed25519 vDjOfg 6fa6kHvbSkI6F9S54u7FMduv+YmuHUGTIZz0CiQhhnQ
-sb9iRMQeU8w8GIh4/iczLHfq4HmFEEClyeVq0cTQ7rc
-> ssh-ed25519 gJrHQg 5Vne+RdTULf2Pqq2X9h2uu0Q4hGX9/FjfWcNkTJa0D8
-+Uv7KvCDlAhPhS3vVwzH+SLFMkP2fIiuwvAETksdasc
-> ssh-ed25519 CBqt6Q +gmJpUrMj+6ximFLkdW67k8TKfOQR1YAz20aPsixXxk
-pM4H8b70EF/Ga4y77BPobxuUF/FawBcrLjVBxEdtvsM
-> X25519 qbNRcP9+m4kubmSsRYE6vIU0F3x5D5hilQ27CP1O+GA
-BRiup/KQxlqX5JoWy7aJjon14Mruxv1JvftFshuyZKc
-> piv-p256 +y2G/w ArRtqE+8sVRYvK8r6yj8UhYhCJeqzH1fYGo4yK6y/Mpa
-iJRdwpx5glVPzuI60f1tSbBsWfECWIkUIY6wiIeF+yk
-> piv-p256 jNqd3A A22i9InHF96PSCvrPWLmgS42MLwJwtMJAVYr9u4qjmD1
-iqV25lJ5k+Xg8L+Q7Xc9EFQV+QnSJZgUJDy/eD8PKn4
-> DcZ0C-grease
-auoi
--- XTP2L0fnjBcOJuu3VkZeGvO2QSVngpBuNtvQsqnXRDY
-<EFBFBD>M<><4D>(2[o<><6F>ӂ<EFBFBD>D<EFBFBD>}5<><35><EFBFBD><EFBFBD><EFBFBD>$$<24><>*<2A><0E>RZ<0E><>ƃ<EFBFBD><C683><EFBFBD>}<7D><><EFBFBD>TA<54>/<1D><>H<><48><EFBFBD>%w)o<>$<24>37Cet<65><13><><EFBFBD>Z<EFBFBD><5A><EFBFBD><EFBFBD><EFBFBD>7ޮ/<2F><><EFBFBD><EFBFBD>֩<EFBFBD><D6A9>'<27><>9U<12>><3E><><EFBFBD>S]<5D>E	<09>N<EFBFBD>j<17>kV˕lK<6C><4B><EFBFBD>u<EFBFBD>
+-> ssh-ed25519 vDjOfg AfQkw1UeTbbmmLpQDUREbymEhksQcuuew5CVvUm96l8
+MGHzsuUSGxylTki4RiweGpy6qkfNDV6FZWFq0HYqcVA
+-> ssh-ed25519 qDkIVA ae13qzkkd7MOF+K3c9hboyLgIKtyCvIwnwTaJPUptGQ
+NqgLmlyRH1xS8DPLf6K2TkVXyLPq7JoVQIrJR/ZiQok
+-> ssh-ed25519 gJrHQg XPvoFk3rmcR+LUqhEe4lPRRaJX15Aly2Bog1yupGcXk
+8dhK7AkVeBRzHxyeuR4A2aDCEQD1MX6cJ9IjJwEINE0
+-> ssh-ed25519 CBqt6Q +KdvDUniNHGTo0jBFWItMmyNxE0r5xLPGAFxV9VFNhc
+K4Lu5yzchnoCrvxzjR9xCxSgYZvKry+drpjwiKVQ8J8
+-> X25519 88HnH2v3YYipPYB9qk8pmVtMIYN/1vmW43f55HCUyjo
+AThm3DxL6sbDlBnN0YwJBee7X+79QwGRJTwWjBaNTqc
+-> piv-p256 +y2G/w AmxWHRvDHpWeP14zX4osgk6J86rhgwZ0zGu/Tsi1B6Q7
+yyBXrNYjobXhtZJXb7agK8Qv9+FJ5PaJSvC0CZ9Gedg
+-> piv-p256 jNqd3A Am53IYYfiB4zdUsAgBHWSZYGOhjS19U4j3DlgzY0EnwU
+F3CcfTCcsujUhVIBVUbu3umE3Tta+gMQmYzQZBpdGf4
+-> ?FGn:n?-grease Vx sa, pC
+3O61kvJv/TGOMRyjDAFXBA64FQLjL1CyAUi0GrxJ5nBarL8w6iaaWRcRUBBkw1rb
+pY1R
+--- I/iGZ9cuID9D/KMFMMqRDd/ole/MNPygPYks57FHprU
+?'a8<61>ߵ<EFBFBD><DFB5><EFBFBD><EFBFBD>rig<69><67>9<><39>0c<><63><EFBFBD><7F>N<>(<28>hg<1A><><EFBFBD>RI<11><>Q<EFBFBD><51>#<23>J<EFBFBD>IudX<64><58>d<EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD>;@<40><><EFBFBD>;dh<64>
--- a/secrets/root_passwd_hash.age
+++ b/secrets/root_passwd_hash.age
@@ -1,18 +1,20 @@
 age-encryption.org/v1
-> ssh-ed25519 vDjOfg +T2+c6s8yRI3DmcMCELDCu9bH5jwkGmWcOe0BT9e504
-ilH6f5UfROVu9UNEG3bwKDVCW9TBez/1tctCo7GqW3o
-> ssh-ed25519 gJrHQg Rj+QeoWpjZzwBD3zRVRA0TbYBKtlZnLIXjza5xb1oXc
-2KJxVI1VCvD7IuO8nQ2V9TjMK0+ybfOh6t2/7dRw9dg
-> ssh-ed25519 CBqt6Q A1VXR8o6Xyt1jzbDhmvAtuUzvjDqeVxIbWObGV/Fe20
-o5o42d6SVooI67lg4nKfx1u+HY/TGL2ys0J/V5lzn+0
-> X25519 uMqXsxlaJlX5WDy/0m4LTGQwqy4+gouKIOzjAQMpzA4
-eYaegTrmE+n7zdet2oSixttbd+zA2hssdg6NoyS04vY
-> piv-p256 +y2G/w A2HUb9rvWY/Wehzh7luAt3Z3bJftC1eSgV6D2G/sivuf
-7g3BjfSbfI97gzpeUpgVyCNc94Cx9j9coc/7huEKxl8
-> piv-p256 jNqd3A AyuHpDNY37NNMFsC5e9RRSh6Ii1WvNhK2JwCgLzxBgdG
-fumXWMKQd3cdCzGhGSrKl0v7AYkUwOXL4iPLQamHFnE
-> %i4-grease
-uHEF74/F+pbG8QNel8l7uqFLqmN7uw4gd0zd5SPidB8IXjzc
--- vuYEQoi+VbObu7O6lokSpYmKLn1H6lOuc+C9Q5FZD1U
-P<EFBFBD><EFBFBD>R<EFBFBD>
-<EFBFBD><EFBFBD><EFBFBD>@B<><42>=sK<73>N<EFBFBD><4E><1C><><EFBFBD>h<03><>E<EFBFBD>=<3D><>ҍ<EFBFBD><D28D><EFBFBD>[<5B><>v<EFBFBD>y<EFBFBD>p<><70><EFBFBD>ڔ<0F><><EFBFBD>U3<55>*<2A>b<EFBFBD><62> o.<2E>d<EFBFBD>q<EFBFBD>Պסl=<3D>ˇ󴵎<CB87><F3B4B58E>d۬MM#J<><4A> <20>3<EFBFBD><33><EFBFBD><EFBFBD>|U<><55><EFBFBD>|<7C><>&<26><12><><EFBFBD>Yd<59><64><EFBFBD><EFBFBD>e<EFBFBD><65><EFBFBD>0<EFBFBD><30><EFBFBD>0<07>ZY^
+-> ssh-ed25519 vDjOfg ccN/cS4ZAfiOx9C6wFErEjvOqPbKy6h893jYT/z2T18
+9ChhXfz2dV5T0D06TzW255LB76g16ifZmQbPVDqD5Do
+-> ssh-ed25519 qDkIVA Fac/jOHkXu8NPiZlb3hk2BqB8BhadPjqfn1zc108ll8
+N9AY1CqLGwtfYiFsJGV/IQ9mJTDSqM54X6fnA7NnXNQ
+-> ssh-ed25519 gJrHQg VF4G1Q4oeb3JVfHQhjh4yJvUlTN1PTEyrhKSBrOcvgg
+8ceAf/cu7cuhTXVzB7nOi2he/ktrlpVkr21i1Z4XqIQ
+-> ssh-ed25519 CBqt6Q bzv7fF4OAU7GKJiJGrihvDev4M6Qsr7+W8JQ9QNHUjo
+Hy9ZIS04J4VMfuNQiTTB7sW2CzoROdoyhIbLldndfvI
+-> X25519 PrY0KyZTE7eXHRGlVSpYzBoT73pBHWQvTRO9eeJCWwg
+L/ukKZtZScR3WkeX8bMNXxGW2PFV9kLnPKFSb+t001E
+-> piv-p256 +y2G/w AxDz+bV/IPQCzwPUt6+am/IRtijuRkf3vTuufzGiyO6Y
+knF13FZXnMLOEF9Q7dOKJZE/2QQg83PqGFpO0kyWFBw
+-> piv-p256 jNqd3A AtRxeHPEitdL4wic71ulRVgM2QbO/sOuNxilHnstQA6P
+Gbrsiq00AnBjMR25PPYxeix3RaUvub/6F02JP6W9AJg
+-> wIqU6'R-grease 33MjIB)v TohZ
+Dsa2LmHh0qb+8Vmzr73952TK7Fy6DdNQTlbsyixrjKy18my/Q40kfKfipM0+
+--- 2tU902KSTImP9fQArgBYHy2yEnPkrlR/LMrSOuaLwdE
+<EFBFBD>tD;<11>8"8<>e=(<28><><EFBFBD>
+<10><><EFBFBD><EFBFBD><EFBFBD>2<EFBFBD>_<><5F><EFBFBD>#I7<><37><EFBFBD><0E><>QX<51><58>K<1E>w=_(<28>r<EFBFBD><72><EFBFBD><1E><0B>	<09>b<EFBFBD>w<EFBFBD>D:<3A><>t<EFBFBD><74><EFBFBD>"<22><><EFBFBD>7<EFBFBD>u<EFBFBD>\D<0F><><EFBFBD><EFBFBD><EFBFBD>l<EFBFBD><6C><EFBFBD>M<EFBFBD><4D>`<60><>e<EFBFBD><1A><>'
--- a/secrets/synapse/jakstys_lt_signing_key.age
+++ b/secrets/synapse/jakstys_lt_signing_key.age
--- a/secrets/synapse/macaroon_secret_key.age
+++ b/secrets/synapse/macaroon_secret_key.age
--- a/secrets/synapse/registration_shared_secret.age
+++ b/secrets/synapse/registration_shared_secret.age
@@ -1,15 +1,13 @@
 age-encryption.org/v1
-> ssh-ed25519 gJrHQg ffxdmFgRbbThAPsXCqrmqlJeaKj50YS+hM0GYGLTQkU
-MxEkjQzTlJ9GGLpohAoVa7w1AJKaxCJRca7dYGLtBzA
-> X25519 8OTgARYYgWi1PeFLEDUndJ9xSs/W9Z6p2hETrWaurkk
-D4DvfXCZ7TrloVYbXx/DLIrW5yW5PhhEUzOrte3RPac
-> piv-p256 +y2G/w A4iElwc6M+dTz/LVi0l/vO73zSf3bE0t8gT0/zGF9dWq
-mKdyh0I/8Dmv4DRpcE+RhPjp8tTuV3UI0uI/LYt0noQ
-> piv-p256 jNqd3A Ai4ZOf+hB30/3IkpLVzeDBbBkoAbsSP+/esY3SACYt4G
-Z/DYBsb8TVt75Nvt9KNPqGuGhLRtT+KJcNsgTjRDsBE
-> p-grease %V0%NL0/ Jqtp61!y 4 %*ii3\%
-3CEt8jshnha3CaS3g1/gsHuNonR/Nn17C+aOmMUt7+HTvoVZpsSWMb+y5q4LR1S0
-vHsquuywbw257q4E+foJPlKXtK/nbRATvKXpHAC5sSPwbw+aye4zSLWU8rv+yA
--- 0O9vjzCZYCyhj+Wpf9n8JTUqHmXNLifflFBpYvLFL80
-<EFBFBD>
-?<3F>l<EFBFBD>t<EFBFBD><74>7-R{<7B>Bf<42><66>8<EFBFBD>@<40>W<EFBFBD><57><EFBFBD>t<7F><74><EFBFBD>4<EFBFBD>K<EFBFBD><0B>UI&wU˘<55>m<EFBFBD><6D><EFBFBD>O<EFBFBD>"<22>y<EFBFBD><79>O<EFBFBD><4F><EFBFBD><02>lJ<6C><4A>I<EFBFBD><49><EFBFBD>&<26><><EFBFBD><EFBFBD>W<EFBFBD>B<EFBFBD>=2<><32>e<EFBFBD>{<02><>?<3F># <20>
+-> ssh-ed25519 gJrHQg 41GyF7UMrtsuI0z2WZgsZf/bmyAcAa74RfLp1AicLjg
+ytXT4+8r0ffudmZ4ZlkICx+ddRm3b+T73IkLfOrJrWs
+-> X25519 guLncWEl3J7IqltGm9TuhN/8O3hrnQ1Prh0Jsxy7PFo
+RR0x9AkSjAM6TNyNWZA1LOG3uZAxqGIjq0t714Msn/c
+-> piv-p256 +y2G/w A+S8K3QVsjfGVFpIyCA3uXV2ZE2CcitAWFs1wdTb/bec
+MboWcsjnwwhggY67m9qmDwY7hmHsdew9fktbmTI0fWU
+-> piv-p256 jNqd3A A+fH2xUnVmcgQxREYgT4v1PaAmPAG9uoC8UrBPucMVxP
+XU3VOt8BsN8hka0XbJ1zLG+1asmfv2qslSirlLlA4VU
+-> =s-grease
+BH6aufY
+--- oSZP5kASZECqlU7b8N7+WSFtstI4u6Vc49QUZl+SIg8
+<03>Υ<EFBFBD><CEA5>E<EFBFBD><14><><EFBFBD><EFBFBD><EFBFBD>	<09>!hΒ<68><CE92>3u<>P<EFBFBD>v<EFBFBD><76>L<EFBFBD><4C><0B>VK<56>22i*<2A>q<EFBFBD><71><EFBFBD><EFBFBD>ޖ2G<32><47>iד<69>o<EFBFBD><6F><EFBFBD><01>i<EFBFBD><69><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>4[<5B>3<EFBFBD><33>#<23><>c<EFBFBD>1<EFBFBD>"<22>v)<29><>>
--- a/secrets/vno1-oh2/borgbackup/password.age
+++ b/secrets/vno1-oh2/borgbackup/password.age
@@ -1,14 +1,13 @@
 age-encryption.org/v1
-> ssh-ed25519 gJrHQg ESiJkK+AbUYnpPzWzJwT2vXCekr8JFKVHAluKgYj+lQ
-Y1dVxVehvXp982Uv8yFkQMd8bDxmtK6q/vwAV41B6ao
-> X25519 QNnqg1/Bi911Y7W2fD5oTgfbeuhknXHkoBLjTLOH6RU
-upXY8JVRjSTfw3kGQIVl3B+HP3l5mIug5KJCSQfnPgg
-> piv-p256 +y2G/w AyXKFigaApuL9nF/3hO5+KYg+I6dEZ8jt8MdTLQ1Uo2s
-lkncgwZebVAQi8IfoqFdfwBU9Im5z6t95fUxalY85uc
-> piv-p256 jNqd3A AxkBvH1D4M0SKXUcU0xLkVlOGs5N5chQibVBqFyBqATn
-DiSN52dtvrtigH7Ab3WKNUh04b72KT0oTprIDRVZAVI
-> 6jYgXN-grease
-GEvhMWqEB2ERO1F0rOxJacf5QQ
--- ZXufptBo8uDjjxBH5szEVCV0mttzfhra2D0jMijKcFo
-<EFBFBD>X<><18>T(<28>ܥ<EFBFBD>Ω<EFBFBD>$,[<5B>ִ;zm`<17><>3<EFBFBD><33>k<EFBFBD><6B><EFBFBD>J&E"ԫ<>9
-<EFBFBD><EFBFBD>
+-> ssh-ed25519 gJrHQg Nn62/m3DrF4YxjI0ycPFaKriGrkE3ixVVJz+tFYCsVs
+sDa69aqWlf75k/hWgx8OuuPWvvWuDYZlStaWzW3kq70
+-> X25519 3ebH/jOO/SjKrdcPcYc24mYXg5nn4HyvRCxlIJVVZUI
+TujCwZHodT5adBPpKuZ12e2g8ONVI+Zf7ba95FKNFAs
+-> piv-p256 +y2G/w AjBaqeL3p8bjNPGn+uI+MCsF1UiiXLxiRGh44BavzOpH
+96+gVz3oxd4b4fvT0VgVvIt6ppq1Yav4H1rGZgVqUsE
+-> piv-p256 jNqd3A A8peXvU8dS8RxQxEw5+vcPto5aLGVvXKAaAo15x0giVa
+aqZo+JsD02ONfovyNw9y4iRvNFYh6VryNETfZja4elE
+-> 5-grease =2CO W
+u74
+--- YeeJl5cn6iA2PxOVw9NmuvBE9hkwYt8+nA8S4OsGqss
+<EFBFBD><EFBFBD><EFBFBD>ں^<5E>ٞ`<60>;ιf<CEB9>}<7D>U<EFBFBD><55><07>?<3F><><EFBFBD><EFBFBD>gg<><67><EFBFBD>y<EFBFBD><1B>_<>D<EFBFBD><44>n<EFBFBD><6E>r<EFBFBD>
--- a/secrets/vno1-oh2/zfs-passphrase.age
+++ b/secrets/vno1-oh2/zfs-passphrase.age
@@ -1,14 +1,14 @@
 age-encryption.org/v1
-> ssh-ed25519 vDjOfg Q1sECRy7lkHYa3bFIQQNNbaIfEjdZShkdGjPqTipWEU
-OzCOnN56ti6HmLFwYOKCZ81qnhCTGNoMtdaOrSPDsRA
-> X25519 gIWhWpUrehSyghn/Eok2Fg2bKo0/28n01+bB3DXaPDA
-i71PJ/nJAgvZuwDwnTeqvxXsQr09VCOlpkCZ3V3NQ+U
-> piv-p256 +y2G/w A2rC4hbY48aKDwZ08hMZPAXTMP6dtUxVboG5ow3bDXPq
-wK9Co8sWTygN+Mp+3ZSy+JLV5TRpA/ZgXoCoqSqtipw
-> piv-p256 jNqd3A A8eWt9X0EyPCwST/tutbEjUcyJ3Id9cL7fFkm75SeWKI
-caMp+o0ziLQLpJukTSEqnwkhE84bXIL76wTu3JAEpKo
-> G`=je-grease z hi^@N@
-Q+3IMD7GELrAEPoCeL0i
--- IOqB7rGBpsOYcNf81wMJfwAox7zL0+lyKVzh6ZhuJH0
-<EFBFBD><EFBFBD>=<3D><><EFBFBD><EFBFBD>ѹ<EFBFBD><D1B9><EFBFBD>o<EFBFBD>
-x$D<><03>G<EFBFBD>C<EFBFBD>1<EFBFBD>2<EFBFBD><32>'ը<><D5A8><EFBFBD>VL<56><4C>P<EFBFBD><50><EFBFBD>]UT
+-> ssh-ed25519 vDjOfg hQz/8dKNzISetnpTQAqSGyAzlxJxVKiTMc4iA38yXyE
+2TEo7UV6EyASIByWwliiLTqP0smmfKDi/UkDi8PMwwY
+-> X25519 KlnATfXI6zqAaVTSNO78la8rmyWMtVRww9BlF8/h7nc
+O5Digx7rg+JsCTncY6/aNVPNQeYHKpCf1EYwHIWdnvQ
+-> piv-p256 +y2G/w AgbNt1GusrDSgdy5tFoRrfga6alFvEph85HuU9NQ6lJE
+csay3X8DFRj3VEBrCGDz1ItIcL8lmZUEIQC7VMXExA4
+-> piv-p256 jNqd3A A1kYMKCBVoNt1a7ntDlxB75zZLEpkK+B2S/oEVtLb3L4
+Eim5jOLs+LeFtBW6Mx3Qum1ush7hLc5xm5sskPxkF9c
+-> czlN+-grease Ixf
+B8uHZdeLS17u6pLgeHiCCjNTvctel5Tby+GatAEssp9SzxZYZEKr2w42KpJe0k/F
+iKao
+--- w4iT5CdobRQzEKBiGyU60DIHxAn9SsJ++X0vYrECmuM
+<EFBFBD><EFBFBD>_<EFBFBD>	<12><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>W+@#<23>|3<>:;<3B><0B><><EFBFBD><EFBFBD>U<EFBFBD>`2<><32><EFBFBD><EFBFBD><EFBFBD>ebc<62><63>g<EFBFBD><67>T<EFBFBD>U