chore: rekey secrets

chore: flake update
feat: litellm provider for opncode
2026-03-10 04:38:25 +01:00 · 2026-03-07 11:44:04 +01:00 · 2026-03-03 20:07:25 +01:00 · 2026-03-02 19:24:28 +01:00 · 2026-02-28 10:06:42 +01:00 · 2026-02-27 16:03:12 +01:00
73 changed files with 1504 additions and 921 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,7 @@ result-*
 # OS
 .DS_Store
 Thumbs.db
 # Opencode rules
 .opencode-rules
 opencode.json
--- a/flake.lock
+++ b/flake.lock
@@ -24,14 +24,17 @@
    "agents": {
      "flake": false,
      "locked": {
-        "lastModified": 1770833637,
+        "lastModified": 1772563257,
-        "narHash": "sha256-T97AWZYIQE1mI9eL1dfuOJ4YPkpU6kfETi1QZsC0WyE=",
+        "narHash": "sha256-hp6Q8TVP9xZeBFgZm51ndCacmVZxucZzLtj12pzD6c0=",
-        "path": "/home/m3tam3re/p/AI/AGENTS",
+        "ref": "refs/heads/master",
-        "type": "path"
+        "rev": "39ac89f388532e9a7629808037791c64cd5fc13c",
        "revCount": 63,
        "type": "git",
        "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
      },
      "original": {
-        "path": "/home/m3tam3re/p/AI/AGENTS",
+        "type": "git",
-        "type": "path"
+        "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
      }
    },
    "base16-schemes": {
@@ -50,6 +53,65 @@
        "type": "github"
      }
    },
    "blueprint": {
      "inputs": {
        "nixpkgs": [
          "llm-agents",
          "nixpkgs"
        ],
        "systems": [
          "llm-agents",
          "systems"
        ]
      },
      "locked": {
        "lastModified": 1771437256,
        "narHash": "sha256-bLqwib+rtyBRRVBWhMuBXPCL/OThfokA+j6+uH7jDGU=",
        "owner": "numtide",
        "repo": "blueprint",
        "rev": "06ee7190dc2620ea98af9eb225aa9627b68b0e33",
        "type": "github"
      },
      "original": {
        "owner": "numtide",
        "repo": "blueprint",
        "type": "github"
      }
    },
    "bun2nix": {
      "inputs": {
        "flake-parts": [
          "llm-agents",
          "flake-parts"
        ],
        "import-tree": "import-tree",
        "nixpkgs": [
          "llm-agents",
          "nixpkgs"
        ],
        "systems": [
          "llm-agents",
          "systems"
        ],
        "treefmt-nix": [
          "llm-agents",
          "treefmt-nix"
        ]
      },
      "locked": {
        "lastModified": 1770895533,
        "narHash": "sha256-v3QaK9ugy9bN9RXDnjw0i2OifKmz2NnKM82agtqm/UY=",
        "owner": "nix-community",
        "repo": "bun2nix",
        "rev": "c843f477b15f51151f8c6bcc886954699440a6e1",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
        "repo": "bun2nix",
        "type": "github"
      }
    },
    "darwin": {
      "inputs": {
        "nixpkgs": [
@@ -79,11 +141,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1769524058,
+        "lastModified": 1772867152,
-        "narHash": "sha256-zygdD6X1PcVNR2PsyK4ptzrVEiAdbMqLos7utrMDEWE=",
+        "narHash": "sha256-RIFgZ4O6Eg+5ysZ8Tqb3YvcqiRaNy440GEY22ltjRrs=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "71a3fc97d80881e91710fe721f1158d3b96ae14d",
+        "rev": "eaafb89b56e948661d618eefd4757d9ea8d77514",
        "type": "github"
      },
      "original": {
@@ -93,6 +155,27 @@
      }
    },
    "flake-parts": {
      "inputs": {
        "nixpkgs-lib": [
          "llm-agents",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1772408722,
        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
        "type": "github"
      },
      "original": {
        "owner": "hercules-ci",
        "repo": "flake-parts",
        "type": "github"
      }
    },
    "flake-parts_2": {
      "inputs": {
        "nixpkgs-lib": [
          "nur",
@@ -159,11 +242,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1770263241,
+        "lastModified": 1772845525,
-        "narHash": "sha256-R1WFtIvp38hS9x63dnijdJw1KyIiy30KGea6e6N7LHs=",
+        "narHash": "sha256-Dp5Ir2u4jJDGCgeMRviHvEQDe+U37hMxp6RSNOoMMPc=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "04e5203db66417d548ae1ff188a9f591836dfaa7",
+        "rev": "27b93804fbef1544cb07718d3f0a451f4c4cd6c0",
        "type": "github"
      },
      "original": {
@@ -199,7 +282,7 @@
          "rose-pine-hyprcursor",
          "nixpkgs"
        ],
-        "systems": "systems_3"
+        "systems": "systems_4"
      },
      "locked": {
        "lastModified": 1709914708,
@@ -235,20 +318,63 @@
        "type": "github"
      }
    },
-    "m3ta-nixpkgs": {
+    "import-tree": {
      "inputs": {
        "nixpkgs": "nixpkgs_3",
        "opencode": "opencode"
      },
      "locked": {
-        "lastModified": 1770832025,
+        "lastModified": 1763762820,
-        "narHash": "sha256-b6iPOU2ruuSDscCsIvNCO9/vhOsUCYtSaHlQbJ7PTnE=",
+        "narHash": "sha256-ZvYKbFib3AEwiNMLsejb/CWs/OL/srFQ8AogkebEPF0=",
-        "path": "/home/m3tam3re/p/NIX/nixpkgs",
+        "owner": "vic",
-        "type": "path"
+        "repo": "import-tree",
        "rev": "3c23749d8013ec6daa1d7255057590e9ca726646",
        "type": "github"
      },
      "original": {
-        "path": "/home/m3tam3re/p/NIX/nixpkgs",
+        "owner": "vic",
-        "type": "path"
+        "repo": "import-tree",
        "type": "github"
      }
    },
    "llm-agents": {
      "inputs": {
        "blueprint": "blueprint",
        "bun2nix": "bun2nix",
        "flake-parts": "flake-parts",
        "nixpkgs": "nixpkgs_3",
        "systems": "systems_3",
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
        "lastModified": 1772864581,
        "narHash": "sha256-+AiWgqbKkjU1W/S/U7ktSoScMa4+z9APtJx+3gEDcCQ=",
        "owner": "numtide",
        "repo": "llm-agents.nix",
        "rev": "856b24f862d0a19b7764f35ee9a7546309e605a0",
        "type": "github"
      },
      "original": {
        "owner": "numtide",
        "repo": "llm-agents.nix",
        "type": "github"
      }
    },
    "m3ta-nixpkgs": {
      "inputs": {
        "nixpkgs": "nixpkgs_4",
        "nixpkgs-master": "nixpkgs-master",
        "opencode": "opencode",
        "openspec": "openspec"
      },
      "locked": {
        "lastModified": 1772876766,
        "narHash": "sha256-PiikuOqrjyzTAqUbnUwIKCr9+YvKX0xTRZ4q0srkQKU=",
        "ref": "refs/heads/master",
        "rev": "291e3a0744d4a0192654c8afdbe3d1636c9c0890",
        "revCount": 156,
        "type": "git",
        "url": "https://code.m3ta.dev/m3tam3re/nixpkgs"
      },
      "original": {
        "type": "git",
        "url": "https://code.m3ta.dev/m3tam3re/nixpkgs"
      }
    },
    "nix-colors": {
@@ -385,11 +511,27 @@
    },
    "nixpkgs-master": {
      "locked": {
-        "lastModified": 1770276510,
+        "lastModified": 1772847790,
-        "narHash": "sha256-1z3GzjNxm2QREjQC579bD6oFAwkLBjJIUt5al08n2oo=",
+        "narHash": "sha256-lEK3FqujT4UPgk31wI90scsZQK+I1GaLa61SOQ2Jirc=",
        "owner": "NixOS",
        "repo": "nixpkgs",
        "rev": "9724b991f92022aafa14b3610840f9742752227d",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
        "ref": "master",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs-master_2": {
      "locked": {
        "lastModified": 1772874821,
        "narHash": "sha256-ehnRKCc/qq0hjyi5aaE/H4RPUPfSDqjndWqAGZFesfY=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "feb0a690655b2ef4c35843eb88c4ba415e1e8c61",
+        "rev": "10e7894b40eb0ad14d3a3184d20cc1beace1414d",
        "type": "github"
      },
      "original": {
@@ -401,11 +543,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1770136044,
+        "lastModified": 1772598333,
-        "narHash": "sha256-tlFqNG/uzz2++aAmn4v8J0vAkV3z7XngeIIB3rM3650=",
+        "narHash": "sha256-YaHht/C35INEX3DeJQNWjNaTcPjYmBwwjFJ2jdtr+5U=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "e576e3c9cf9bad747afcddd9e34f51d18c855b4e",
+        "rev": "fabb8c9deee281e50b1065002c9828f2cf7b2239",
        "type": "github"
      },
      "original": {
@@ -433,32 +575,32 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1770562336,
+        "lastModified": 1772736753,
-        "narHash": "sha256-ub1gpAONMFsT/GU2hV6ZWJjur8rJ6kKxdm9IlCT0j84=",
+        "narHash": "sha256-au/m3+EuBLoSzWUCb64a/MZq6QUtOV8oC0D9tY2scPQ=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "d6c71932130818840fc8fe9509cf50be8c64634f",
+        "rev": "917fec990948658ef1ccd07cef2a1ef060786846",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixpkgs-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1770073757,
+        "lastModified": 1772624091,
-        "narHash": "sha256-Vy+G+F+3E/Tl+GMNgiHl9Pah2DgShmIUBJXmbiQPHbI=",
+        "narHash": "sha256-QKyJ0QGWBn6r0invrMAK8dmJoBYWoOWy7lN+UHzW1jc=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "47472570b1e607482890801aeaf29bfb749884f6",
+        "rev": "80bdc1e5ce51f56b19791b52b2901187931f5353",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixos-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
@@ -481,11 +623,11 @@
    },
    "nixpkgs_6": {
      "locked": {
-        "lastModified": 1770197578,
+        "lastModified": 1772624091,
-        "narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=",
+        "narHash": "sha256-QKyJ0QGWBn6r0invrMAK8dmJoBYWoOWy7lN+UHzW1jc=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2",
+        "rev": "80bdc1e5ce51f56b19791b52b2901187931f5353",
        "type": "github"
      },
      "original": {
@@ -513,17 +655,17 @@
    },
    "nur": {
      "inputs": {
-        "flake-parts": "flake-parts",
+        "flake-parts": "flake-parts_2",
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1770270187,
+        "lastModified": 1772875192,
-        "narHash": "sha256-+vK4PsLWiDZ9IO8FdBI9bmZp62Py3DPV1aa+iEueR6w=",
+        "narHash": "sha256-R706OBJ+nMQsVP2Dni+FaG3UDfhlE2zR4rz+YGnEi8I=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "27c438bb3ed9d4c6f4a25c689b3fb2a855a646a9",
+        "rev": "2b3f4e0a0eea5a32dc78204fefba15ee83d437d3",
        "type": "github"
      },
      "original": {
@@ -534,23 +676,47 @@
    },
    "opencode": {
      "inputs": {
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": [
          "m3ta-nixpkgs",
          "nixpkgs-master"
        ]
      },
      "locked": {
-        "lastModified": 1770824220,
+        "lastModified": 1772782174,
-        "narHash": "sha256-+vvNQzfhuP91mK/BjBufWGdS+2vHJAtB8iDl14z4y48=",
+        "narHash": "sha256-FBmF7/uwZYY/qY1252Hz+XhXdE+Qp5axySAy5Jw7XUQ=",
        "owner": "anomalyco",
        "repo": "opencode",
-        "rev": "42bea5d297125c4f8ea5c1d6055fa06829de0a51",
+        "rev": "6c7d968c4423a0cd6c85099c9377a6066313fa0a",
        "type": "github"
      },
      "original": {
        "owner": "anomalyco",
-        "ref": "v1.1.59",
+        "ref": "v1.2.20",
        "repo": "opencode",
        "type": "github"
      }
    },
    "openspec": {
      "inputs": {
        "nixpkgs": [
          "m3ta-nixpkgs",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1772182342,
        "narHash": "sha256-9Q0iUyZGcDPLdgvnrBN3GumV8g9akV8TFb8bFkD1yYs=",
        "owner": "Fission-AI",
        "repo": "OpenSpec",
        "rev": "afdca0d5dab1aa109cfd8848b2512333ccad60c3",
        "type": "github"
      },
      "original": {
        "owner": "Fission-AI",
        "repo": "OpenSpec",
        "type": "github"
      }
    },
    "root": {
      "inputs": {
        "agenix": "agenix",
@@ -558,6 +724,7 @@
        "disko": "disko",
        "home-manager": "home-manager_2",
        "hyprpanel": "hyprpanel",
        "llm-agents": "llm-agents",
        "m3ta-nixpkgs": "m3ta-nixpkgs",
        "nix-colors": "nix-colors",
        "nixos-generators": "nixos-generators",
@@ -565,7 +732,7 @@
        "nixpkgs-45570c2": "nixpkgs-45570c2",
        "nixpkgs-9e58ed7": "nixpkgs-9e58ed7",
        "nixpkgs-locked": "nixpkgs-locked",
-        "nixpkgs-master": "nixpkgs-master",
+        "nixpkgs-master": "nixpkgs-master_2",
        "nixpkgs-stable": "nixpkgs-stable",
        "nur": "nur",
        "rose-pine-hyprcursor": "rose-pine-hyprcursor"
@@ -622,6 +789,21 @@
      }
    },
    "systems_3": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
        "owner": "nix-systems",
        "repo": "default",
        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
        "type": "github"
      },
      "original": {
        "owner": "nix-systems",
        "repo": "default",
        "type": "github"
      }
    },
    "systems_4": {
      "locked": {
        "lastModified": 1689347949,
        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
@@ -636,7 +818,7 @@
        "type": "github"
      }
    },
-    "systems_4": {
+    "systems_5": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -651,9 +833,30 @@
        "type": "github"
      }
    },
    "treefmt-nix": {
      "inputs": {
        "nixpkgs": [
          "llm-agents",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1772660329,
        "narHash": "sha256-IjU1FxYqm+VDe5qIOxoW+pISBlGvVApRjiw/Y/ttJzY=",
        "owner": "numtide",
        "repo": "treefmt-nix",
        "rev": "3710e0e1218041bbad640352a0440114b1e10428",
        "type": "github"
      },
      "original": {
        "owner": "numtide",
        "repo": "treefmt-nix",
        "type": "github"
      }
    },
    "utils": {
      "inputs": {
-        "systems": "systems_4"
+        "systems": "systems_5"
      },
      "locked": {
        "lastModified": 1710146030,
--- a/flake.nix
+++ b/flake.nix
@@ -24,6 +24,8 @@
    m3ta-nixpkgs.url = "git+https://code.m3ta.dev/m3tam3re/nixpkgs";
    # m3ta-nixpkgs.url = "path:/home/m3tam3re/p/NIX/nixpkgs";
    llm-agents.url = "github:numtide/llm-agents.nix";
    #
    nur = {
      url = "github:nix-community/NUR";
@@ -36,9 +38,7 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };
-    nixos-generators = {
+    nixos-generators = {url = "github:nix-community/nixos-generators";};
      url = "github:nix-community/nixos-generators";
    };
    hyprpanel.url = "github:Jas-SinghFSU/HyprPanel";
    rose-pine-hyprcursor.url = "github:ndom91/rose-pine-hyprcursor";
@@ -58,6 +58,7 @@
    nixpkgs,
    m3ta-nixpkgs,
    nur,
    agents,
    ...
  } @ inputs: let
    inherit (self) outputs;
@@ -79,6 +80,7 @@
      m3-ares = nixpkgs.lib.nixosSystem {
        specialArgs = {
          inherit inputs outputs;
          system = "x86_64-linux";
          hostname = "m3-ares";
        };
        modules = [
@@ -88,7 +90,10 @@
        ];
      };
      m3-atlas = nixpkgs.lib.nixosSystem {
-        specialArgs = {inherit inputs outputs;};
+        specialArgs = {
          inherit inputs outputs;
          system = "x86_64-linux";
        };
        system = "x86_64-linux";
        modules = [
          ./hosts/m3-atlas
@@ -100,6 +105,7 @@
      m3-kratos = nixpkgs.lib.nixosSystem {
        specialArgs = {
          inherit inputs outputs;
          system = "x86_64-linux";
          hostname = "m3-kratos";
        };
        modules = [
@@ -110,7 +116,10 @@
        ];
      };
      m3-helios = nixpkgs.lib.nixosSystem {
-        specialArgs = {inherit inputs outputs;};
+        specialArgs = {
          inherit inputs outputs;
          system = "x86_64-linux";
        };
        system = "x86_64-linux";
        modules = [
          ./hosts/m3-helios
@@ -125,26 +134,61 @@
        pkgs = nixpkgs.legacyPackages."x86_64-linux";
        extraSpecialArgs = {
          inherit inputs outputs;
          system = "x86_64-linux";
          hostname = "m3-daedalus";
        };
        modules = [./home/m3tam3re/m3-daedalus.nix];
      };
    };
-    devShells.x86_64-linux.infraShell = let
+    devShells = forAllSystems (system: let
-      pkgs = nixpkgs.legacyPackages.x86_64-linux;
+      pkgs = import nixpkgs {
-    in
+        inherit system;
-      pkgs.mkShell {
+        config.allowUnfree = true; # Allow unfree packages in devShell
      };
      m3taLib = m3ta-nixpkgs.lib.x86_64-linux;
      rules = m3taLib.opencode-rules.mkOpencodeRules {
        inherit agents;
        languages = ["nix"];
      };
    in {
      default = pkgs.mkShell {
        buildInputs = with pkgs; [
-          opentofu
+          alejandra
-          nixos-anywhere
+          nixd
          openssh
          agenix.packages.${system}.default
        ];
        inherit (rules) instructions;
        shellHook = ''
-          echo "Infrastructure Management Shell"
+          ${rules.shellHook}
-          echo "Commands:"
+          echo "======================================"
-          echo "  - cd infra/proxmox && tofu init"
+          echo "🧑‍🚀 Nix Development Shell with Opencode Rules"
-          echo "  - tofu plan"
+          echo "======================================"
-          echo "  - tofu apply"
+          echo ""
          echo "Active rules:"
          echo "  - Nix language conventions"
          echo "  - Coding-style best practices"
          echo "  - Naming conventions"
          echo "  - Documentation standards"
          echo "  - Testing guidelines"
          echo "  - Git workflow patterns"
          echo "  - Project structure guidelines"
          echo ""
          echo "Generated files:"
          echo "  - .opencode-rules/ (symlink to AGENTS repo)"
          echo "  - opencode.json (configuration file)"
          echo ""
          echo "Useful commands:"
          echo "  - cat opencode.json        View rules configuration"
          echo "  - ls .opencode-rules/      Browse available rules"
          echo "  - nix develop              Re-enter this shell"
          echo ""
          echo "Remember to add to .gitignore:"
          echo "  .opencode-rules"
          echo "  opencode.json"
          echo "======================================"
        '';
      };
    });
  };
 }
--- a/home/common/default.nix
+++ b/home/common/default.nix
@@ -3,6 +3,7 @@
  lib,
  outputs,
  pkgs,
  system,
  ...
 }: {
  imports = [
@@ -24,7 +25,7 @@
      inputs.nur.overlays.default
      inputs.m3ta-nixpkgs.overlays.default
      inputs.m3ta-nixpkgs.overlays.modifications
-
+      (outputs.overlays.mkLlmAgentsOverlay system)
      # You can also add overlays exported from other flakes:
      # neovim-nightly-overlay.overlays.default
--- a/home/features/cli/default.nix
+++ b/home/features/cli/default.nix
@@ -222,6 +222,8 @@
    rocmPackages.rocm-smi
    rocmPackages.rocminfo
    rocmPackages.rocm-runtime
    sqlite
    sqlite-vec
    tldr
    pomodoro-timer
    trash-cli
--- a/home/features/coding/default.nix
+++ b/home/features/coding/default.nix
@@ -5,14 +5,13 @@
  home.packages = with pkgs; [
    agenix-cli
    alejandra
    beads
    bc
    bun
    claude-code
    devpod
    #devpod-desktop
    code2prompt
-    nur.repos.charmbracelet.crush
+    gnumake
    cmake
    (python3.withPackages (ps:
      with ps; [
        pip
@@ -23,9 +22,14 @@
        torch
        srt
      ]))
    # opencode-desktop
    pyrefly
    nixd
    nodejs
    opencode-desktop
    (qmd.override {
      vulkanSupport = true;
      cudaSupport = false;
    })
    alejandra
    sidecar
    tailwindcss
--- a/home/features/coding/opencode.nix
+++ b/home/features/coding/opencode.nix
@@ -16,13 +16,17 @@
      source = "${inputs.agents}/skills";
      recursive = true;
    };
    "opencode/rules" = {
      source = "${inputs.agents}/rules";
      recursive = true;
    };
  };
  programs.opencode = {
    enable = true;
    settings = {
      theme = "opencode";
-      plugin = ["oh-my-opencode" "opencode-beads" "opencode-antigravity-auth@beta"];
+      plugin = ["oh-my-opencode" "opencode-antigravity-auth@beta"];
      agent =
        builtins.fromJSON
        (builtins.readFile "${inputs.agents}/agents/agents.json");
@@ -84,122 +88,41 @@
        };
      };
      provider = {
-        google = {
+        litellm = {
          npm = "@ai-sdk/openai-compatible";
          name = "LiteLLM (AZ-Gruppe)";
          options.baseURL = "https://llm.az-gruppe.com/v1";
          models = {
-            antigravity-gemini-3-pro = {
+            "gpt-5.2" = {
-              name = "Gemini 3 Pro (Antigravity)";
+              name = "GPT-5.2";
              limit = {
                context = 1048576;
                output = 65535;
              };
              modalities = {
                input = ["text" "image" "pdf"];
                output = ["text"];
              };
              variants = {
                low = {thinkingLevel = "low";};
                high = {thinkingLevel = "high";};
              };
            };
            antigravity-gemini-3-flash = {
              name = "Gemini 3 Flash (Antigravity)";
              limit = {
                context = 1048576;
                output = 65536;
              };
              modalities = {
                input = ["text" "image" "pdf"];
                output = ["text"];
              };
              variants = {
                minimal = {thinkingLevel = "minimal";};
                low = {thinkingLevel = "low";};
                medium = {thinkingLevel = "medium";};
                high = {thinkingLevel = "high";};
              };
            };
            antigravity-claude-sonnet-4-5 = {
              name = "Claude Sonnet 4.5 (Antigravity)";
              limit = {
                context = 200000;
-                output = 64000;
+                output = 16384;
              };
              modalities = {
-                input = ["text" "image" "pdf"];
+                input = ["text" "image"];
                output = ["text"];
              };
            };
-            antigravity-claude-sonnet-4-5-thinking = {
+            "claude-sonnet-4-6" = {
-              name = "Claude Sonnet 4.5 Thinking (Antigravity)";
+              name = "Claude Sonnet 4.6";
              limit = {
                context = 200000;
-                output = 64000;
+                output = 16000;
              };
              modalities = {
-                input = ["text" "image" "pdf"];
+                input = ["text" "image"];
                output = ["text"];
              };
              variants = {
                low = {thinkingConfig = {thinkingBudget = 8192;};};
                max = {thinkingConfig = {thinkingBudget = 32768;};};
            };
-            };
+            "claude-opus-4-6" = {
-            antigravity-claude-opus-4-6-thinking = {
+              name = "Claude Opus 4.6";
              name = "Claude Opus 4.6 Thinking (Antigravity)";
              limit = {
                context = 200000;
-                output = 64000;
+                output = 32000;
              };
              modalities = {
-                input = ["text" "image" "pdf"];
+                input = ["text" "image"];
                output = ["text"];
              };
              variants = {
                low = {thinkingConfig = {thinkingBudget = 8192;};};
                max = {thinkingConfig = {thinkingBudget = 32768;};};
              };
            };
            "gemini-2.5-flash" = {
              name = "Gemini 2.5 Flash (Gemini CLI)";
              limit = {
                context = 1048576;
                output = 65536;
              };
              modalities = {
                input = ["text" "image" "pdf"];
                output = ["text"];
              };
            };
            "gemini-2.5-pro" = {
              name = "Gemini 2.5 Pro (Gemini CLI)";
              limit = {
                context = 1048576;
                output = 65536;
              };
              modalities = {
                input = ["text" "image" "pdf"];
                output = ["text"];
              };
            };
            "gemini-3-flash-preview" = {
              name = "Gemini 3 Flash Preview (Gemini CLI)";
              limit = {
                context = 1048576;
                output = 65536;
              };
              modalities = {
                input = ["text" "image" "pdf"];
                output = ["text"];
              };
            };
            "gemini-3-pro-preview" = {
              name = "Gemini 3 Pro Preview (Gemini CLI)";
              limit = {
                context = 1048576;
                output = 65535;
              };
              modalities = {
                input = ["text" "image" "pdf"];
                output = ["text"];
              };
            };
@@ -211,60 +134,36 @@
  home.file.".config/opencode/oh-my-opencode.json".text = builtins.toJSON {
    "$schema" = "https://raw.githubusercontent.com/code-yeongyu/oh-my-opencode/master/assets/oh-my-opencode.schema.json";
-    google_auth = false;
+    # google_auth removed - use opencode-antigravity-auth plugin instead (already in plugin array)
    agents = {
-      sisyphus = {
+      sisyphus = {model = "zai-coding-plan/glm-5";};
-        model = "zai-coding-plan/glm-4.7";
+      oracle = {model = "zai-coding-plan/glm-5";};
-      };
+      librarian = {model = "zai-coding-plan/glm-5";};
-      oracle = {
+      explore = {model = "zai-coding-plan/glm-4.5-air";};
-        model = "zai-coding-plan/glm-4.7";
+      multimodal-looker = {model = "zai-coding-plan/glm-4.6v";};
-      };
+      prometheus = {model = "zai-coding-plan/glm-5";};
-      librarian = {
+      metis = {model = "zai-coding-plan/glm-5";};
-        model = "zai-coding-plan/glm-4.7";
+      momus = {model = "zai-coding-plan/glm-5";};
-      };
+      atlas = {model = "zai-coding-plan/glm-5";};
      explore = {
        model = "zai-coding-plan/glm-4.5-air";
      };
      multimodal-looker = {
        model = "zai-coding-plan/glm-4.6v";
      };
      prometheus = {
        model = "zai-coding-plan/glm-4.7";
      };
      metis = {
        model = "zai-coding-plan/glm-4.7";
      };
      momus = {
        model = "zai-coding-plan/glm-4.7";
      };
      atlas = {
        model = "zai-coding-plan/glm-4.7";
      };
    };
    categories = {
-      visual-engineering = {
+      visual-engineering = {model = "zai-coding-plan/glm-5";};
-        model = "zai-coding-plan/glm-4.7";
+      ultrabrain = {model = "zai-coding-plan/glm-5";};
-      };
+      artistry = {model = "zai-coding-plan/glm-5";};
-      ultrabrain = {
+      quick = {model = "zai-coding-plan/glm-5";};
-        model = "zai-coding-plan/glm-4.7";
+      unspecified-low = {model = "zai-coding-plan/glm-5";};
-      };
+      unspecified-high = {model = "zai-coding-plan/glm-5";};
-      artistry = {
+      writing = {model = "zai-coding-plan/glm-5";};
        model = "zai-coding-plan/glm-4.7";
      };
      quick = {
        model = "zai-coding-plan/glm-4.7";
      };
      unspecified-low = {
        model = "zai-coding-plan/glm-4.7";
      };
      unspecified-high = {
        model = "zai-coding-plan/glm-4.7";
      };
      writing = {
        model = "zai-coding-plan/glm-4.7";
      };
    };
    disabled_mcps = ["context7" "websearch"];
-    disabled_hooks = ["comment-checker"]; #Temporarily added to address bug in 3.5.1 (MCP)
+    disabled_hooks = ["comment-checker"];
    git_master = {
      commit_footer = false;
      include_co_authored_by = false;
    };
    experimental = {
      truncate_all_tool_outputs = true;
      aggressive_truncation = false;
    };
  };
 }
--- a/home/features/desktop/hyprland.nix
+++ b/home/features/desktop/hyprland.nix
@@ -122,6 +122,7 @@ in {
          "match:title branchdialog, float on"
          "match:class pavucontrol-qt, float on"
          "match:class pavucontrol, float on"
          "match:class class:^(espanso)$, float on"
          # wlogout
          "match:class wlogout, fullscreen on"
          "match:title wlogout, float on"
--- a/home/features/desktop/media.nix
+++ b/home/features/desktop/media.nix
@@ -19,22 +19,22 @@ in {
      amf
      blueberry
      ffmpeg_6-full
      gimp
      gst_all_1.gstreamer
      gst_all_1.gst-vaapi
      handbrake
      inkscape
      kdePackages.kdenlive
      krita
      libation
      #makemkv
      pamixer
      pavucontrol
      qpwgraph
      v4l-utils
-      #plexamp
+      plexamp
      # uxplay
      # vlc
-      # webcord
+      webcord
      # yt-dlp
      unimatrix
    ];
--- a/home/m3tam3re/m3-atlas.nix
+++ b/home/m3tam3re/m3-atlas.nix
@@ -2,9 +2,10 @@
  imports = [
    ../common
    ../features/cli
    ../features/coding/opencode.nix
    ./home-server.nix
  ];
-
+  coding.editors.neovim.enable = true;
  features = {
    cli = {
      nushell.enable = true;
@@ -12,6 +13,7 @@
      nitch.enable = true;
      secrets.enable = false;
      starship.enable = true;
      zellij.enable = true;
    };
  };
 }
--- a/hosts/common/default.nix
+++ b/hosts/common/default.nix
@@ -1,5 +1,13 @@
 # Common configuration for all hosts
-{ config, pkgs, lib, inputs, outputs, ... }: {
+{
  config,
  pkgs,
  lib,
  inputs,
  outputs,
  system,
  ...
 }: {
  imports = [
    ./extraServices
    ./ports.nix
@@ -7,14 +15,13 @@
    inputs.home-manager.nixosModules.home-manager
  ];
-  environment.pathsToLink =
+  environment.pathsToLink = ["/share/xdg-desktop-portal" "/share/applications"];
    [ "/share/xdg-desktop-portal" "/share/applications" ];
  home-manager = {
    useUserPackages = true;
    extraSpecialArgs = {
-      inherit inputs outputs;
+      inherit inputs outputs system;
-      videoDrivers = config.services.xserver.videoDrivers or [ ];
+      videoDrivers = config.services.xserver.videoDrivers or [];
    };
  };
@@ -31,7 +38,7 @@
      inputs.m3ta-nixpkgs.overlays.default
      inputs.m3ta-nixpkgs.overlays.modifications
-
+      (outputs.overlays.mkLlmAgentsOverlay system)
      # You can also add overlays exported from other flakes:
      # neovim-nightly-overlay.overlays.default
@@ -65,9 +72,10 @@
      options = "--delete-older-than 30d";
    };
    optimise.automatic = true;
-    registry = (lib.mapAttrs (_: flake: { inherit flake; }))
+    registry =
      (lib.mapAttrs (_: flake: {inherit flake;}))
      ((lib.filterAttrs (_: lib.isType "flake")) inputs);
-    nixPath = [ "/etc/nix/path" ];
+    nixPath = ["/etc/nix/path"];
  };
  users.defaultUserShell = pkgs.nushell;
 }
--- a/hosts/common/ports.nix
+++ b/hosts/common/ports.nix
@@ -18,6 +18,10 @@
      wireguard = 51820;
      tailscale = 41641;
      headscale = 3009;
      netbird-stun = 3478;
      netbird-proxy = 8443;
      netbird-metrics = 9090;
      netbird-health = 9000;
      # Containers & web apps
      gitea = 3030;
@@ -33,9 +37,7 @@
      slash-nemoti = 3016;
      kestra = 3018;
      outline = 3019;
-      pangolin = 3020;
+      authentik = 3023;
      pangolin-api = 3021;
      pangolin-ws = 3022;
      # Home automation
      homarr = 7575;
--- a/hosts/common/users/m3tam3re.nix
+++ b/hosts/common/users/m3tam3re.nix
@@ -24,6 +24,7 @@
    ];
    openssh.authorizedKeys.keys = [
      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3YEmpYbM+cpmyD10tzNRHEn526Z3LJOzYpWEKdJg8DaYyPbDn9iyVX30Nja2SrW4Wadws0Y8DW+Urs25/wVB6mKl7jgPJVkMi5hfobu3XAz8gwSdjDzRSWJrhjynuaXiTtRYED2INbvjLuxx3X8coNwMw58OuUuw5kNJp5aS2qFmHEYQErQsGT4MNqESe3jvTP27Z5pSneBj45LmGK+RcaSnJe7hG+KRtjuhjI7RdzMeDCX73SfUsal+rHeuEw/mmjYmiIItXhFTDn8ZvVwpBKv7xsJG90DkaX2vaTk0wgJdMnpVIuIRBa4EkmMWOQ3bMLGkLQeK/4FUkNcvQ/4+zcZsg4cY9Q7Fj55DD41hAUdF6SYODtn5qMPsTCnJz44glHt/oseKXMSd556NIw2HOvihbJW7Rwl4OEjGaO/dF4nUw4c9tHWmMn9dLslAVpUuZOb7ykgP0jk79ldT3Dv+2Hj0CdAWT2cJAdFX58KQ9jUPT3tBnObSF1lGMI7t77VU= m3tam3re@m3-nix"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZcjCKl0DRuOUOMXbM0GKY5JjvmyFpVZ/tRlTKWu/zp razr"
    ];
    packages = [inputs.home-manager.packages.${pkgs.stdenv.hostPlatform.system}.default];
  };
--- a/hosts/m3-aether/services/default.nix
+++ b/hosts/m3-aether/services/default.nix
@@ -2,10 +2,4 @@
  imports = [
    ./cloud-init.nix
  ];
  systemd.sleep.extraConfig = ''
    AllowSuspend=no
    AllowHibernation=no
    AllowHybridSleep=no
    AllowSuspendThenHibernate=no
  '';
 }
--- a/hosts/m3-ares/services/default.nix
+++ b/hosts/m3-ares/services/default.nix
@@ -1,20 +1,34 @@
-{
+{pkgs, ...}: {
  imports = [
    ./containers
    ./netbird.nix
    #./n8n.nix
    ./mem0.nix
    ./postgres.nix
    ./restic.nix
    ./sound.nix
    ./tailscale.nix
    ./udev.nix
    ./wireguard.nix
  ];
  # console.useXkbConfig = true;
  # services.xserver.xkb = {
  #   layout = "de,us";
  #   options = "ctrl:nocaps";
  # };
  # optional, falls du auch die TTY-Konsole deutsch willst:
  services = {
    hypridle.enable = true;
    espanso = {
      enable = true;
      package = pkgs.espanso-wayland;
    };
    printing.enable = true;
    gvfs.enable = true;
    trezord.enable = true;
    gnome.gnome-keyring.enable = true;
    qdrant.enable = true;
    # qdrant = {
    #   enable = true;
    #   settings = {
@@ -35,10 +49,4 @@
    };
    displayManager.gdm.enable = true;
  };
  systemd.sleep.extraConfig = ''
    AllowSuspend=no
    AllowHibernation=no
    AllowHybridSleep=no
    AllowSuspendThenHibernate=no
  '';
 }
--- a/hosts/m3-ares/services/mem0.nix
+++ b/hosts/m3-ares/services/mem0.nix
@@ -0,0 +1,23 @@
 {
  m3ta.mem0 = {
    enable = true;
    port = 8000;
    host = "127.0.0.1";
    # LLM Configuration
    llm = {
      provider = "openai";
      apiKeyFile = "/var/lib/mem0/openai-api-key-1"; # Use agenix or sops-nix
    };
    # Vector Storage Configuration
    vectorStore = {
      provider = "qdrant"; # or "chroma", "pinecone", etc.
      config = {
        host = "localhost";
        port = 6333;
        collection_name = "mem0_alice";
      };
    };
  };
 }
--- a/hosts/m3-ares/services/netbird.nix
+++ b/hosts/m3-ares/services/netbird.nix
@@ -0,0 +1,29 @@
 {pkgs, ...}: {
  services.netbird.enable = true;
  environment.systemPackages = with pkgs; [netbird-ui];
  systemd.services.netbird = {
    environment = {
      NB_DISABLE_SSH_CONFIG = "true";
    };
    path = [
      pkgs.shadow
      pkgs.util-linux
    ];
  };
  programs.ssh.extraConfig = ''
    Match exec "${pkgs.netbird}/bin/netbird ssh detect %h %p"
        PreferredAuthentications password,publickey,keyboard-interactive
        PasswordAuthentication yes
        PubkeyAuthentication yes
        BatchMode no
        ProxyCommand ${pkgs.netbird}/bin/netbird ssh proxy %h %p
        StrictHostKeyChecking no
        UserKnownHostsFile /dev/null
        CheckHostIP no
        LogLevel ERROR
  '';
  networking.firewall.checkReversePath = "loose";
 }
--- a/hosts/m3-ares/services/tailscale.nix
+++ b/hosts/m3-ares/services/tailscale.nix
@@ -1,11 +0,0 @@
 {config, ...}: {
  services.tailscale = {
    enable = false;
    authKeyFile = config.age.secrets.tailscale-key.path;
    useRoutingFeatures = "both";
    extraUpFlags = [
      "--login-server=https://va.m3tam3re.com"
      "--accept-routes"
    ];
  };
 }
--- a/hosts/m3-atlas/secrets.nix
+++ b/hosts/m3-atlas/secrets.nix
@@ -1,25 +1,43 @@
 {
  age = {
    secrets = {
-      baserow-env = { file = ../../secrets/baserow-env.age; };
+      baserow-env = {file = ../../secrets/baserow-env.age;};
-      ghost-env = { file = ../../secrets/ghost-env.age; };
+      ghost-env = {file = ../../secrets/ghost-env.age;};
      kestra-config = {
        file = ../../secrets/kestra-config.age;
        mode = "644";
      };
-      kestra-env = { file = ../../secrets/kestra-env.age; };
+      kestra-env = {file = ../../secrets/kestra-env.age;};
-      littlelink-m3tam3re = { file = ../../secrets/littlelink-m3tam3re.age; };
+      littlelink-m3tam3re = {file = ../../secrets/littlelink-m3tam3re.age;};
-      minio-root-cred = { file = ../../secrets/minio-root-cred.age; };
+      minio-root-cred = {file = ../../secrets/minio-root-cred.age;};
-      n8n-env = { file = ../../secrets/n8n-env.age; };
+      n8n-env = {file = ../../secrets/n8n-env.age;};
-      paperless-key = { file = ../../secrets/paperless-key.age; };
+      netbird-auth-secret = {
-      restreamer-env = { file = ../../secrets/restreamer-env.age; };
+        file = ../../secrets/netbird-auth-secret.age;
-      searx = { file = ../../secrets/searx.age; };
+      };
-      tailscale-key = { file = ../../secrets/tailscale-key.age; };
+      netbird-db-password = {
        file = ../../secrets/netbird-db-password.age;
      };
      netbird-encryption-key = {
        file = ../../secrets/netbird-encryption-key.age;
      };
      netbird-dashboard-env = {
        file = ../../secrets/netbird-dashboard-env.age;
      };
      netbird-server-env = {
        file = ../../secrets/netbird-server-env.age;
      };
      netbird-proxy-env = {
        file = ../../secrets/netbird-proxy-env.age;
      };
      paperless-key = {file = ../../secrets/paperless-key.age;};
      restreamer-env = {file = ../../secrets/restreamer-env.age;};
      searx = {file = ../../secrets/searx.age;};
      tailscale-key = {file = ../../secrets/tailscale-key.age;};
      traefik = {
        file = ../../secrets/traefik.age;
        owner = "traefik";
      };
-      vaultwarden-env = { file = ../../secrets/vaultwarden-env.age; };
+      vaultwarden-env = {file = ../../secrets/vaultwarden-env.age;};
      m3tam3re-secrets = {
        file = ../../secrets/m3tam3re-secrets.age;
        owner = "m3tam3re";
@@ -30,6 +48,23 @@
        owner = "gitea-runner";
        group = "gitea-runner";
      };
      ref-key = {
        file = ../../secrets/ref-key.age;
        owner = "m3tam3re";
      };
      exa-key = {
        file = ../../secrets/exa-key.age;
        owner = "m3tam3re";
      };
      basecamp-client-id = {
        file = ../../secrets/basecamp-client-id.age;
        owner = "m3tam3re";
      };
      basecamp-client-secret = {
        file = ../../secrets/basecamp-client-secret.age;
        owner = "m3tam3re";
      };
      authentik-env = {file = ../../secrets/authentik-env.age;};
    };
  };
 }
--- a/hosts/m3-atlas/services/containers/authentik.nix
+++ b/hosts/m3-atlas/services/containers/authentik.nix
@@ -0,0 +1,67 @@
 {config, ...}: let
  image = "ghcr.io/goauthentik/server:2026.2.0";
  serverIp = "10.89.0.22";
  workerIp = "10.89.0.23";
  postgresHost = "10.89.0.1";
  postgresPort = config.m3ta.ports.get "postgres";
  authentikPort = config.m3ta.ports.get "authentik";
  sharedEnv = {
    AUTHENTIK_POSTGRESQL__HOST = postgresHost;
    AUTHENTIK_POSTGRESQL__PORT = toString postgresPort;
    AUTHENTIK_POSTGRESQL__USER = "authentik";
    AUTHENTIK_POSTGRESQL__NAME = "authentik";
  };
 in {
  virtualisation.oci-containers.containers = {
    "authentik-server" = {
      inherit image;
      cmd = ["server"];
      environment = sharedEnv;
      environmentFiles = [config.age.secrets.authentik-env.path];
      ports = ["127.0.0.1:${toString authentikPort}:9000"];
      volumes = [
        "authentik_media:/media"
        "authentik_templates:/templates"
      ];
      extraOptions = [
        "--add-host=postgres:${postgresHost}"
        "--ip=${serverIp}"
        "--network=web"
      ];
    };
    "authentik-worker" = {
      inherit image;
      cmd = ["worker"];
      user = "root";
      environment = sharedEnv;
      environmentFiles = [config.age.secrets.authentik-env.path];
      volumes = [
        "authentik_media:/media"
        "authentik_certs:/certs"
        "authentik_templates:/templates"
      ];
      extraOptions = [
        "--add-host=postgres:${postgresHost}"
        "--ip=${workerIp}"
        "--network=web"
      ];
    };
  };
  services.traefik.dynamicConfigOptions.http = {
    services.authentik.loadBalancer.servers = [
      {url = "http://localhost:${toString authentikPort}/";}
    ];
    routers.authentik = {
      rule = "Host(`auth.m3ta.dev`)";
      tls = {certResolver = "godaddy";};
      service = "authentik";
      entrypoints = "websecure";
    };
  };
 }
--- a/hosts/m3-atlas/services/containers/default.nix
+++ b/hosts/m3-atlas/services/containers/default.nix
@@ -5,11 +5,13 @@
    ./kestra.nix
    ./littlelink.nix
    ./matomo.nix
    ./netbird.nix
    # ./n8n.nix
    # ./pangolin.nix
    ./restreamer.nix
    ./slash.nix
    ./slash-nemoti.nix
    ./authentik.nix
  ];
  system.activationScripts.createPodmanNetworkWeb = lib.mkAfter ''
    if ! /run/current-system/sw/bin/podman network exists web; then
--- a/hosts/m3-atlas/services/containers/netbird.nix
+++ b/hosts/m3-atlas/services/containers/netbird.nix
@@ -0,0 +1,244 @@
 {
  config,
  pkgs,
  ...
 }: let
  serviceName = "netbird";
  stunPort = config.m3ta.ports.get "netbird-stun";
  proxyTlsPort = config.m3ta.ports.get "netbird-proxy";
  metricsPort = config.m3ta.ports.get "netbird-metrics";
  healthPort = config.m3ta.ports.get "netbird-health";
  postgresPort = config.m3ta.ports.get "postgres";
  wireguardPort = config.m3ta.ports.get "wireguard";
  domain = "v.m3ta.dev";
  proxyDomain = "p.m3ta.dev";
  ipBase = "10.89.0";
  ipOffset = 50;
  dashboardIp = "${ipBase}.${toString ipOffset}";
  serverIp = "${ipBase}.${toString (ipOffset + 1)}";
  proxyIp = "${ipBase}.${toString (ipOffset + 2)}";
  # Database configuration
  dbName = "netbird";
  dbUser = "netbird";
  dbHost = "${ipBase}.1";
  # NetBird config as Nix attribute set
  netbirdConfig = {
    server = {
      listenAddress = ":80";
      exposedAddress = "https://${domain}:443";
      stunPorts = [stunPort];
      metricsPort = metricsPort;
      healthcheckAddress = ":${toString healthPort}";
      logLevel = "info";
      logFile = "console";
      dataDir = "/var/lib/netbird";
      auth = {
        issuer = "https://${domain}/oauth2";
        localAuthDisabled = true;
        signKeyRefreshEnabled = true;
        dashboardRedirectURIs = [
          "https://${domain}/nb-auth"
          "https://${domain}/nb-silent-auth"
        ];
        cliRedirectURIs = ["http://localhost:53000/"];
      };
      reverseProxy = {
        trustedHTTPProxies = ["${ipBase}.1/32"];
      };
      # Proxy feature
      proxy = {
        enabled = true;
        domain = proxyDomain;
      };
      store = {
        engine = "postgres";
        postgres = {
          host = dbHost;
          port = postgresPort;
          database = dbName;
          username = dbUser;
        };
      };
    };
  };
  # Generate YAML from Nix attribute set
  yamlFormat = pkgs.formats.yaml {};
  configYamlBase = yamlFormat.generate "netbird-config-base.yaml" netbirdConfig;
  # Script that injects secrets at runtime
  configGenScript = pkgs.writeShellScript "netbird-gen-config" ''
    set -euo pipefail
    AUTH_SECRET=$(cat "$1")
    DB_PASSWORD=$(cat "$2")
    ENCRYPTION_KEY=$(cat "$3")
    ${pkgs.yq-go}/bin/yq eval "
      .server.authSecret = \"$AUTH_SECRET\" |
      .server.store.encryptionKey = \"$ENCRYPTION_KEY\" |
      .server.store.postgres.password = \"$DB_PASSWORD\"
    " ${configYamlBase}
  '';
 in {
  age.secrets."${serviceName}-auth-secret".file = ../../../../secrets/${serviceName}-auth-secret.age;
  age.secrets."${serviceName}-db-password".file = ../../../../secrets/${serviceName}-db-password.age;
  age.secrets."${serviceName}-encryption-key".file = ../../../../secrets/${serviceName}-encryption-key.age;
  age.secrets."${serviceName}-dashboard-env".file = ../../../../secrets/${serviceName}-dashboard-env.age;
  age.secrets."${serviceName}-server-env".file = ../../../../secrets/${serviceName}-server-env.age;
  age.secrets."${serviceName}-proxy-env".file = ../../../../secrets/${serviceName}-proxy-env.age;
  # Oneshot systemd service that generates the config with injected secrets
  systemd.services."${serviceName}-config" = {
    description = "Generate NetBird config with secrets";
    wantedBy = ["multi-user.target"];
    before = ["podman-${serviceName}-server.service"];
    requiredBy = ["podman-${serviceName}-server.service"];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      ExecStart = pkgs.writeShellScript "netbird-write-config" ''
        mkdir -p /var/lib/${serviceName}
        ${configGenScript} \
          ${config.age.secrets."${serviceName}-auth-secret".path} \
          ${config.age.secrets."${serviceName}-db-password".path} \
          ${config.age.secrets."${serviceName}-encryption-key".path} \
          > /var/lib/${serviceName}/config.yaml
        chmod 600 /var/lib/${serviceName}/config.yaml
      '';
    };
  };
  virtualisation.oci-containers.containers = {
    "${serviceName}-dashboard" = {
      image = "netbirdio/dashboard:latest";
      autoStart = true;
      environmentFiles = [config.age.secrets."${serviceName}-dashboard-env".path];
      extraOptions = [
        "--ip=${dashboardIp}"
        "--network=web"
      ];
    };
    "${serviceName}-server" = {
      image = "netbirdio/netbird-server:latest";
      autoStart = true;
      ports = ["${toString stunPort}:${toString stunPort}/udp"];
      environmentFiles = [config.age.secrets."${serviceName}-server-env".path];
      volumes = [
        "${serviceName}_data:/var/lib/netbird"
        "/var/lib/${serviceName}/config.yaml:/etc/netbird/config.yaml:ro"
      ];
      cmd = ["--config" "/etc/netbird/config.yaml"];
      extraOptions = [
        "--ip=${serverIp}"
        "--network=web"
      ];
    };
    "${serviceName}-proxy" = {
      image = "netbirdio/reverse-proxy:latest";
      autoStart = true;
      ports = ["${toString wireguardPort}:${toString wireguardPort}/udp"];
      volumes = [
        "${serviceName}_proxy_certs:/certs"
      ];
      environmentFiles = [config.age.secrets."${serviceName}-proxy-env".path];
      cmd = [
        "--domain=${proxyDomain}"
        "--mgmt=https://${domain}:443"
        "--addr=:${toString proxyTlsPort}"
        "--cert-dir=/certs"
        "--acme-certs"
        "--trusted-proxies=${ipBase}.1/32"
      ];
      dependsOn = ["${serviceName}-server"];
      extraOptions = [
        "--ip=${proxyIp}"
        "--network=web"
      ];
    };
  };
  services.traefik.dynamicConfigOptions = {
    # HTTP services and routers
    http = {
      services = {
        "${serviceName}-dashboard".loadBalancer.servers = [
          {url = "http://${dashboardIp}:80/";}
        ];
        "${serviceName}-server".loadBalancer.servers = [
          {url = "http://${serverIp}:80/";}
        ];
        "${serviceName}-server-h2c".loadBalancer.servers = [
          {url = "h2c://${serverIp}:80";}
        ];
      };
      routers = {
        # gRPC (Signal + Management)
        "${serviceName}-grpc" = {
          rule = "Host(`${domain}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))";
          entrypoints = "websecure";
          tls.certResolver = "godaddy";
          service = "${serviceName}-server-h2c";
          priority = 100;
        };
        # Backend (relay, WebSocket, API, OAuth2)
        "${serviceName}-backend" = {
          rule = "Host(`${domain}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))";
          entrypoints = "websecure";
          tls.certResolver = "godaddy";
          service = "${serviceName}-server";
          priority = 100;
        };
        # Dashboard (catch-all, lowest priority)
        "${serviceName}-dashboard" = {
          rule = "Host(`${domain}`)";
          entrypoints = "websecure";
          tls.certResolver = "godaddy";
          service = "${serviceName}-dashboard";
          priority = 1;
        };
      };
    };
    # TCP for proxy TLS passthrough
    tcp = {
      services."${serviceName}-proxy-tls".loadBalancer.servers = [
        {address = "${proxyIp}:${toString proxyTlsPort}";}
      ];
      routers."${serviceName}-proxy-passthrough" = {
        entryPoints = ["websecure"];
        rule = "HostSNI(`*`)";
        service = "${serviceName}-proxy-tls";
        priority = 1;
        tls.passthrough = true;
      };
    };
    # ServersTransport for Proxy Protocol v2 (optional)
    serversTransports."pp-v2" = {
      proxyProtocol.version = 2;
    };
  };
  networking.firewall.allowedUDPPorts = [
    stunPort # STUN
    wireguardPort # WireGuard for proxy
  ];
 }
--- a/hosts/m3-atlas/services/containers/pangolin.nix
+++ b/hosts/m3-atlas/services/containers/pangolin.nix
@@ -1,211 +0,0 @@
 {
  config,
  pkgs,
  lib,
  ...
 }: let
  # Define the Pangolin configuration as a Nix attribute set
  pangolinConfig = {
    app = {
      dashboard_url = "https://vpn.m3tam3re.com";
      log_level = "info";
      save_logs = false;
    };
    domains = {
      vpn = {
        base_domain = "m3tam3re.com";
        cert_resolver = "godaddy";
        prefer_wildcard_cert = false;
      };
    };
    server = {
      external_port = 3000;
      internal_port = 3001;
      next_port = 3002;
      internal_hostname = "pangolin";
      session_cookie_name = "p_session_token";
      resource_access_token_param = "p_token";
      resource_session_request_param = "p_session_request";
    };
    traefik = {
      cert_resolver = "godaddy";
      http_entrypoint = "web";
      https_entrypoint = "websecure";
    };
    gerbil = {
      start_port = 51820;
      base_endpoint = "vpn.m3tam3re.com";
      use_subdomain = false;
      block_size = 24;
      site_block_size = 30;
      subnet_group = "100.89.137.0/20";
    };
    rate_limits = {
      global = {
        window_minutes = 1;
        max_requests = 100;
      };
    };
    email = {
      smtp_host = config.age.secrets.smtp-host.path;
      smtp_port = 587;
      smtp_user = config.age.secrets.smtp-user.path;
      smtp_pass = config.age.secrets.smtp-pass.path;
      no_reply = config.age.secrets.smtp-user.path;
    };
    users = {
      server_admin = {
        email = "admin@m3tam3re.com";
        password = config.age.secrets.pangolin-admin-password.path;
      };
    };
    flags = {
      require_email_verification = true;
      disable_signup_without_invite = true;
      disable_user_create_org = true;
      allow_raw_resources = true;
      allow_base_domain_resources = true;
    };
  };
  # Convert Nix attribute set to YAML using a simpler approach
  pangolinConfigYaml = pkgs.writeTextFile {
    name = "config.yml";
    text = lib.generators.toYAML {} pangolinConfig;
  };
 in {
  # Define the containers
  virtualisation.oci-containers.containers = {
    "pangolin" = {
      image = "fosrl/pangolin:1.1.0";
      autoStart = true;
      volumes = [
        "${pangolinConfigYaml}:/app/config/config.yml:ro" # Mount the config file directly
        "pangolin_config:/app/config/data" # Volume for persistent data
      ];
      ports = [
        "127.0.0.1:3020:3001" # API server
        "127.0.0.1:3021:3002" # Next.js server
        "127.0.0.1:3022:3000" # API/WebSocket server
      ];
      extraOptions = ["--ip=10.89.0.20" "--network=web"];
    };
    "gerbil" = {
      image = "fosrl/gerbil:1.0.0";
      autoStart = true;
      volumes = [
        "pangolin_config:/var/config" # Share the volume for persistent data
      ];
      cmd = [
        "--reachableAt=http://gerbil:3003"
        "--generateAndSaveKeyTo=/var/config/key"
        "--remoteConfig=http://pangolin:3001/api/v1/gerbil/get-config"
        "--reportBandwidthTo=http://pangolin:3001/api/v1/gerbil/receive-bandwidth"
      ];
      ports = [
        "51820:51820/udp" # WireGuard port
      ];
      extraOptions = [
        "--ip=10.89.0.21"
        "--network=web"
        "--cap-add=NET_ADMIN"
        "--cap-add=SYS_MODULE"
      ];
    };
  };
  # Secrets for Pangolin
  # age.secrets = {
  #   "smtp-host" = {
  #     file = ../secrets/smtp-host.age;
  #     owner = "root";
  #     group = "root";
  #     mode = "0400";
  #   };
  #   "smtp-user" = {
  #     file = ../secrets/smtp-user.age;
  #     owner = "root";
  #     group = "root";
  #     mode = "0400";
  #   };
  #   "smtp-pass" = {
  #     file = ../secrets/smtp-pass.age;
  #     owner = "root";
  #     group = "root";
  #     mode = "0400";
  #   };
  #   "pangolin-admin-password" = {
  #     file = ../secrets/pangolin-admin-password.age;
  #     owner = "root";
  #     group = "root";
  #     mode = "0400";
  #   };
  # };
  # Traefik configuration for Pangolin
  services.traefik.dynamicConfigOptions = {
    http = {
      # Next.js service (front-end)
      services.pangolin-next-service.loadBalancer.servers = [
        {url = "http://localhost:3021";}
      ];
      # API service
      services.pangolin-api-service.loadBalancer.servers = [
        {url = "http://localhost:3022";}
      ];
      # Routers
      routers = {
        # Next.js router (handles everything except API paths)
        "pangolin-next" = {
          rule = "Host(`vpn.m3tam3re.com`) && !PathPrefix(`/api/v1`)";
          service = "pangolin-next-service";
          entrypoints = ["websecure"];
          tls = {
            certResolver = "godaddy";
          };
        };
        # API router
        "pangolin-api" = {
          rule = "Host(`vpn.m3tam3re.com`) && PathPrefix(`/api/v1`)";
          service = "pangolin-api-service";
          entrypoints = ["websecure"];
          tls = {
            certResolver = "godaddy";
          };
        };
      };
    };
  };
  # Add HTTP provider to Traefik for dynamic configuration from Pangolin
  services.traefik.staticConfigOptions.providers.http = {
    endpoint = "http://localhost:3020/api/v1/traefik-config";
    pollInterval = "5s";
  };
  # Add experimental section for Badger plugin
  services.traefik.staticConfigOptions.experimental = {
    plugins = {
      #TODO create an overlay for the plugin
      badger = {
        moduleName = "github.com/fosrl/badger";
        version = "v1.0.0";
      };
    };
  };
  # Firewall configuration for WireGuard
  networking.firewall.allowedUDPPorts = [51820]; # WireGuard port
 }
--- a/hosts/m3-atlas/services/default.nix
+++ b/hosts/m3-atlas/services/default.nix
@@ -3,15 +3,13 @@
    ./containers
    ./gitea.nix
    ./gitea-actions-runner.nix
    ./headscale.nix
    ./minio.nix
    ./mysql.nix
    ./netbird.nix
    ./n8n.nix
    ./outline.nix
    ./paperless.nix
    ./postgres.nix
    ./searx.nix
    ./tailscale.nix
    ./traefik.nix
    ./vaultwarden.nix
    ./wastebin.nix
--- a/hosts/m3-atlas/services/headscale.nix
+++ b/hosts/m3-atlas/services/headscale.nix
@@ -1,119 +0,0 @@
 {
  config,
  lib,
  pkgs,
  ...
 }: {
  # Define a new option for the admin user
  options.services.headscale = {
    adminUser = lib.mkOption {
      type = lib.types.str;
      default = "m3tam3re";
      description = "Username for the headscale admin user";
    };
  };
  config = let
    adminUser = config.services.headscale.adminUser;
    aclConfig = {
      # Groups definition
      groups = {
        "group:admins" = ["${adminUser}"];
      };
      acls = [
        # Allow all connections within the tailnet
        {
          action = "accept";
          src = ["*"];
          dst = ["*:*"];
        }
        # Allow admin to connect to their own services
        {
          action = "accept";
          src = ["${adminUser}"];
          dst = ["${adminUser}:*"];
        }
      ];
      # Auto-approvers section for routes
      autoApprovers = {
        routes = {
          "0.0.0.0/0" = ["${adminUser}"];
          "10.0.0.0/8" = ["${adminUser}"];
          "192.168.0.0/16" = ["${adminUser}"];
        };
        exitNode = ["${adminUser}"];
      };
    };
    # Convert to HuJSON format with comments
    aclHuJson = ''
      // Headscale ACL Policy - Generated by NixOS
      // Admin user: ${adminUser}
      ${builtins.toJSON aclConfig}
    '';
    aclFile = pkgs.writeText "acl-policy.hujson" aclHuJson;
  in {
    services = {
      headscale = {
        enable = true;
        adminUser = "m3tam3re@m3ta.loc";
        port = 3009;
        settings = {
          server_url = "https://va.m3tam3re.com";
          dns = {
            base_domain = "m3ta.loc";
            nameservers.global = ["8.8.8.8"];
          };
          logtail.enabled = false;
          policy.path = "${aclFile}";
        };
      };
    };
    # Create a systemd service to ensure the admin user exists
    systemd.services.headscale-ensure-admin = lib.mkIf config.services.headscale.enable {
      description = "Ensure Headscale admin user exists";
      after = ["headscale.service"];
      requires = ["headscale.service"];
      wantedBy = ["multi-user.target"];
      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
        User = "headscale";
        Group = "headscale";
      };
      script = ''
        # Check if user exists and create if needed
        if ! ${pkgs.headscale}/bin/headscale users list | grep -q "${adminUser}"; then
          echo "Creating headscale admin user: ${adminUser}"
          ${pkgs.headscale}/bin/headscale users create "${adminUser}"
        else
          echo "Headscale admin user ${adminUser} already exists"
        fi
      '';
    };
    # Traefik configuration for headscale
    services.traefik.dynamicConfigOptions.http = {
      services.headscale.loadBalancer.servers = [
        {
          url = "http://localhost:3009/";
        }
      ];
      routers.headscale = {
        rule = "Host(`va.m3tam3re.com`)";
        tls = {
          certResolver = "godaddy";
        };
        service = "headscale";
        entrypoints = "websecure";
      };
    };
  };
 }
--- a/hosts/m3-atlas/services/n8n.nix
+++ b/hosts/m3-atlas/services/n8n.nix
@@ -1,8 +1,16 @@
-{config, ...}: {
+{
  config,
  lib,
  ...
 }: {
  services.n8n = {
    enable = true;
    environment.WEBHOOK_URL = "https://wf.m3tam3re.com";
  };
  # Temporary fix for upstream module
  systemd.services.n8n.serviceConfig.LoadCredential = lib.mkForce [];
  systemd.services.n8n.environment.N8N_RUNNERS_AUTH_TOKEN_FILE = lib.mkForce null;
  systemd.services.n8n.serviceConfig = {
    EnvironmentFile = ["${config.age.secrets.n8n-env.path}"];
  };
--- a/hosts/m3-atlas/services/netbird.nix
+++ b/hosts/m3-atlas/services/netbird.nix
@@ -0,0 +1,28 @@
 {pkgs, ...}: {
  services.netbird.enable = true;
  systemd.services.netbird = {
    environment = {
      NB_DISABLE_SSH_CONFIG = "true";
    };
    path = [
      pkgs.shadow
      pkgs.util-linux
    ];
  };
  programs.ssh.extraConfig = ''
    Match exec "${pkgs.netbird}/bin/netbird ssh detect %h %p"
        PreferredAuthentications password,publickey,keyboard-interactive
        PasswordAuthentication yes
        PubkeyAuthentication yes
        BatchMode no
        ProxyCommand ${pkgs.netbird}/bin/netbird ssh proxy %h %p
        StrictHostKeyChecking no
        UserKnownHostsFile /dev/null
        CheckHostIP no
        LogLevel ERROR
  '';
  networking.firewall.checkReversePath = "loose";
 }
--- a/hosts/m3-atlas/services/outline.nix
+++ b/hosts/m3-atlas/services/outline.nix
@@ -1,33 +0,0 @@
 {
  services.outline = {
    enable = true;
    port = 3019;
    publicUrl = "https://ol.m3ta.dev";
    databaseUrl = "postgresql://outline:outline@127.0.0.1:5432/outline";
    storage = {
      storageType = "local";
    };
  };
  systemd.services.outline.serviceConfig = {
    Environment = [
      "PGSSLMODE=disable"
    ];
  };
  # Traefik configuration specific to littlelink
  services.traefik.dynamicConfigOptions.http = {
    services.outline.loadBalancer.servers = [
      {
        url = "http://localhost:3019/";
      }
    ];
    routers.outline = {
      rule = "Host(`ol.m3ta.dev`)";
      tls = {
        certResolver = "godaddy";
      };
      service = "outline";
      entrypoints = "websecure";
    };
  };
 }
--- a/hosts/m3-atlas/services/postgres.nix
+++ b/hosts/m3-atlas/services/postgres.nix
@@ -26,6 +26,8 @@
      # Podman network connections for Baserow
      host    baserow      baserow      10.89.0.0/24    scram-sha-256
      host    kestra       kestra       10.89.0.0/24    scram-sha-256
      host    netbird      netbird      10.89.0.0/24    scram-sha-256
      host    authentik    authentik    10.89.0.0/24    scram-sha-256
      # Deny all other connections
      local   all       all       reject
@@ -36,7 +38,7 @@
  services.postgresqlBackup = {
    enable = true;
    startAt = "03:10:00";
-    databases = ["baserow" "paperless" "kestra"];
+    databases = ["baserow" "paperless" "kestra" "authentik" "netbird"];
  };
  networking.firewall = {
    extraCommands = ''
--- a/hosts/m3-atlas/services/tailscale.nix
+++ b/hosts/m3-atlas/services/tailscale.nix
@@ -1,27 +0,0 @@
 {
  config,
  lib,
  pkgs,
  ...
 }: {
  services.tailscale = {
    enable = true;
    authKeyFile = config.age.secrets.tailscale-key.path;
    useRoutingFeatures = "both";
    extraUpFlags = [
      "--login-server=${config.services.headscale.settings.server_url}"
      "--advertise-exit-node"
      "--accept-routes"
    ];
  };
  services.networkd-dispatcher = lib.mkIf config.services.tailscale.enable {
    enable = true;
    rules."50-tailscale" = {
      onState = ["routable"];
      script = ''
        NETDEV=$(ip -o route get 8.8.8.8 | cut -f 5 -d " ")
        ${pkgs.ethtool}/bin/ethtool -K "$NETDEV" rx-udp-gro-forwarding on rx-gro-list off
      '';
    };
  };
 }
--- a/hosts/m3-helios/services/default.nix
+++ b/hosts/m3-helios/services/default.nix
@@ -4,10 +4,4 @@
    ./containers
    ./traefik.nix
  ];
  systemd.sleep.extraConfig = ''
    AllowSuspend=no
    AllowHibernation=no
    AllowHybridSleep=no
    AllowSuspendThenHibernate=no
  '';
 }
--- a/hosts/m3-kratos/default.nix
+++ b/hosts/m3-kratos/default.nix
@@ -50,8 +50,9 @@
  };
  services.ollama = {
    environmentVariables = {
-      HCC_AMDGPU_TARGET = "gfx1100";
+      HCC_AMDGPU_TARGET = "gfx1103";
      ROCR_VISIBLE_DEVICES = "0";
    };
-    rocmOverrideGfx = "11.0.0";
+    rocmOverrideGfx = "11.0.3";
  };
 }
--- a/hosts/m3-kratos/secrets.nix
+++ b/hosts/m3-kratos/secrets.nix
@@ -5,7 +5,7 @@
        file = ../../secrets/anytype-key.age;
        owner = "m3tam3re";
      };
-      tailscale-key = { file = ../../secrets/tailscale-key.age; };
+      tailscale-key = {file = ../../secrets/tailscale-key.age;};
      wg-DE = {
        file = ../../secrets/wg-DE.age;
        path = "/etc/wireguard/DE.conf";
--- a/hosts/m3-kratos/services/default.nix
+++ b/hosts/m3-kratos/services/default.nix
@@ -1,22 +1,25 @@
-{
+{pkgs, ...}: {
  imports = [
    ./containers
    ./mem0.nix
    ./n8n.nix
    ./netbird.nix
    ./postgres.nix
    ./sound.nix
    ./tailscale.nix
    ./udev.nix
    ./wireguard.nix
  ];
  services = {
    hypridle.enable = true;
    espanso = {
      enable = true;
      package = pkgs.espanso-wayland;
    };
    printing.enable = true;
    gvfs.enable = true;
    trezord.enable = true;
    gnome.gnome-keyring.enable = true;
    qdrant.enable = true;
    stirling-pdf.enable = true;
    avahi = {
      enable = true;
      nssmdns4 = true;
@@ -28,10 +31,4 @@
    };
    displayManager.gdm.enable = true;
  };
  systemd.sleep.extraConfig = ''
    AllowSuspend=no
    AllowHibernation=no
    AllowHybridSleep=no
    AllowSuspendThenHibernate=no
  '';
 }
--- a/hosts/m3-kratos/services/n8n.nix
+++ b/hosts/m3-kratos/services/n8n.nix
@@ -1,12 +1,13 @@
-{
+{lib, ...}: {
  services.n8n = {
    enable = true;
    openFirewall = true;
  };
  systemd.services.n8n = {
    environment = {
      N8N_SECURE_COOKIE = "false";
      N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS = "false";
    };
  };
  # Temporary fix for upstream module
  systemd.services.n8n.serviceConfig.LoadCredential = lib.mkForce [];
  systemd.services.n8n.environment.N8N_RUNNERS_AUTH_TOKEN_FILE = lib.mkForce null;
 }
--- a/hosts/m3-kratos/services/netbird.nix
+++ b/hosts/m3-kratos/services/netbird.nix
@@ -0,0 +1,32 @@
 {pkgs, ...}: {
  services.netbird.enable = true;
  environment.systemPackages = with pkgs; [netbird-ui];
  systemd.services.netbird = {
    environment = {
      NB_DISABLE_SSH_CONFIG = "true";
    };
    path = [
      pkgs.shadow # login
      pkgs.util-linux # runuser
    ];
  };
  # Symlink kannst du jetzt ENTFERNEN – nicht mehr nötig!
  # system.activationScripts.netbird-login-link = ...  # LÖSCHEN
  programs.ssh.extraConfig = ''
    Match exec "${pkgs.netbird}/bin/netbird ssh detect %h %p"
        PreferredAuthentications password,publickey,keyboard-interactive
        PasswordAuthentication yes
        PubkeyAuthentication yes
        BatchMode no
        ProxyCommand ${pkgs.netbird}/bin/netbird ssh proxy %h %p
        StrictHostKeyChecking no
        UserKnownHostsFile /dev/null
        CheckHostIP no
        LogLevel ERROR
  '';
  networking.firewall.checkReversePath = "loose";
 }
--- a/hosts/m3-kratos/services/tailscale.nix
+++ b/hosts/m3-kratos/services/tailscale.nix
@@ -1,12 +0,0 @@
 {config, ...}: {
  services.tailscale = {
    enable = false;
    authKeyFile = config.age.secrets.tailscale-key.path;
    useRoutingFeatures = "both";
    extraUpFlags = [
      "--login-server=https://va.m3tam3re.com"
      "--accept-routes"
      "--exit-node-allow-lan-access"
    ];
  };
 }
--- a/overlays/default.nix
+++ b/overlays/default.nix
@@ -59,4 +59,10 @@
      config.allowUnfree = true;
    };
  };
  # Flatten llm-agents packages into top-level pkgs namespace.
  # Takes system as parameter to avoid infinite recursion — overlays
  # can't safely access final/prev.system when spreading attributes.
  mkLlmAgentsOverlay = system: _final: _prev:
    inputs.llm-agents.packages.${system} or {};
 }
--- a/secrets.nix
+++ b/secrets.nix
@@ -7,12 +7,14 @@ let
  # USERS
  m3tam3re = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3YEmpYbM+cpmyD10tzNRHEn526Z3LJOzYpWEKdJg8DaYyPbDn9iyVX30Nja2SrW4Wadws0Y8DW+Urs25/wVB6mKl7jgPJVkMi5hfobu3XAz8gwSdjDzRSWJrhjynuaXiTtRYED2INbvjLuxx3X8coNwMw58OuUuw5kNJp5aS2qFmHEYQErQsGT4MNqESe3jvTP27Z5pSneBj45LmGK+RcaSnJe7hG+KRtjuhjI7RdzMeDCX73SfUsal+rHeuEw/mmjYmiIItXhFTDn8ZvVwpBKv7xsJG90DkaX2vaTk0wgJdMnpVIuIRBa4EkmMWOQ3bMLGkLQeK/4FUkNcvQ/4+zcZsg4cY9Q7Fj55DD41hAUdF6SYODtn5qMPsTCnJz44glHt/oseKXMSd556NIw2HOvihbJW7Rwl4OEjGaO/dF4nUw4c9tHWmMn9dLslAVpUuZOb7ykgP0jk79ldT3Dv+2Hj0CdAWT2cJAdFX58KQ9jUPT3tBnObSF1lGMI7t77VU=";
-  users = [m3tam3re];
+  sascha.koenig = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEZbg/Z9mnflXuLahGY8WOSBMqbgeqVIkIwRkquys1Ml";
  users = [m3tam3re sascha.koenig];
  systems = [m3-atlas m3-ares m3-helios m3-kratos];
 in {
  "secrets/anytype-key.age".publicKeys = systems ++ users;
  "secrets/anytype-key-ares.age".publicKeys = systems ++ users;
  "secrets/authentik-env.age".publicKeys = systems ++ users;
  "secrets/baserow-env.age".publicKeys = systems ++ users;
  "secrets/ghost-env.age".publicKeys = systems ++ users;
  "secrets/littlelink-m3tam3re.age".publicKeys = systems ++ users;
@@ -21,6 +23,12 @@ in {
  "secrets/kestra-env.age".publicKeys = systems ++ users;
  "secrets/minio-root-cred.age".publicKeys = systems ++ users;
  "secrets/n8n-env.age".publicKeys = systems ++ users;
  "secrets/netbird-auth-secret.age".publicKeys = systems ++ users;
  "secrets/netbird-db-password.age".publicKeys = systems ++ users;
  "secrets/netbird-encryption-key.age".publicKeys = systems ++ users;
  "secrets/netbird-dashboard-env.age".publicKeys = systems ++ users;
  "secrets/netbird-server-env.age".publicKeys = systems ++ users;
  "secrets/netbird-proxy-env.age".publicKeys = systems ++ users;
  "secrets/paperless-key.age".publicKeys = systems ++ users;
  "secrets/ref-key.age".publicKeys = systems ++ users;
  "secrets/exa-key.age".publicKeys = systems ++ users;
--- a/secrets/anytype-key-ares.age
+++ b/secrets/anytype-key-ares.age
--- a/secrets/anytype-key.age
+++ b/secrets/anytype-key.age
--- a/secrets/authentik-env.age
+++ b/secrets/authentik-env.age
@@ -0,0 +1,32 @@
 -----BEGIN AGE ENCRYPTED FILE-----
 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyA4Rm1L
 RHlqT3RqblNCdEM2clc0eXpyR0NWUTdsS3NaM1g1Zk50QURUVjFVClZ1Vk1KM0RS
 VEhMSjFoQUdUcnVSdTlOV3M3N1V5RnNQakFXN0JoU3QyZUkKLT4gc3NoLWVkMjU1
 MTkgNWt3Y3NBIDU4dTBYREd1Ym05akNyb0FpQy9HZjIza2ZETncxbldRWGhTVDNL
 R2tKQ28KbG9laFZheG5YbEZkRVFqRlk2VVBqd01YUHJkL3NqUElIS3BkOEpUN2du
 dwotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgL3N4bDh5ZDFsOUdFTDgwdmk4N2hZU0lo
 eGJCWVJtbXZqTTFzNUhPTmZsVQpnYXlFUUpkU25hWm5oVkJlK0lkWlFuL21HcW5k
 Mk1oN3J0K0UxVnJiNlJzCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyBpdVV6QUxkaDhz
 bXRXNUJ6bTdkWHVYUVFUaHJROE4zMGpiMVRZUE9rOVVJCjNXTFg0aTZLZXE0RWg0
 M3BFTy92QzBqaTI2MW02bnkxUTBEYS9GdjhndUkKLT4gc3NoLXJzYSBEUWxFN3cK
 bkRrbXZmaysxM0JlQzVkYmY3aWNLR0VlT3dreGJNNnZ4N0NCSjFadU1tS2ZscHVk
 Ny9MTWtwb2d0ZnNJNTVZSQpVUmFqTlJzaHBlRzVUeWxTaGpzb0VBNGwxVzI1bGc4
 ajUxZ2NUTVpSOTk0QjNKRkNsY1lTNUdQTCt3Tm5PZ3VDCjQ0b3Bha2h0NDBjS1VH
 UHlHbEUxYnVYanVBdS9OcWFPb2VGTFEwNEU0WWZEV2pLUWYxaWRDUzJzdGxTZFpp
 US8KaWE5SDFuQU5PRjBoRDBVbVQ3c2RWWFNhYUo2TjY1cEFpSi83c2duUFVubytW
 aTdZSlJ2OEgyZmNjWnBNeEJRNgpTL2xESER6ZmdSbTVnaXQrazVHSmpVSk9MUE9S
 WStCblMxNk9Tc1lFems3bE5zNzYwdHpKMXl3cnJQL2V2WGJlClo1Y2xEZnViUFBJ
 YlZER1FqQmUxaFE5VkMwSWVheWx2Nk4zMXd5VzRRR1ZsYnR1bStXSWVRcXRsSisr
 aHByQnoKcnZBWlhwRjRUZ0VRQVBMbEtmZG5GNlp4NUpUeEI2dkNnZHZieWhaM2tQ
 Y1p2aUgybE9NUzJNYjZMM1FaN3RyVQo1TUJvSTRjQkY1Rm95SExLN1V1dkw4bC8v
 SHIvWnpkalVES2JLbGEyQnJDU1psL0VhYzYxK1hBZ3hQRTRncmlGCgotPiBzc2gt
 ZWQyNTUxOSBDU015aGcgR1BrdTVVNzNPMlBuVVpvL1RhVHN0aklzb0FCMUhRdTZp
 YzdZWFVUUVhSbwphWXdFeFlHcXl0M2UzZTdkd0wydlVWOU1GT2ZKa2g5YVhNeEpj
 K2FQT0FFCi0+IEFBbSFAdS1ncmVhc2UgKzE+aEs0Ck85U1Yra2FsR0VTVW5LNDRu
 MEtlK25hb0p4Z29MRExVakM4aWo1eXRvdmhnU09zWm84bnh4NkUKLS0tIEUreHdo
 eTFxSU80Q0lBc1Fab28xdEMrVUpsb1NWdytoa3YwbUM3QVM0bDQKeUu+in8qeaFw
 tQRcM/4RNZaA/GVE4WXdDApUt4qaTl4Vd7VxRNE+zJfP3W88IsZS5/AXfKLtdUwE
 wQcUouSotWdVnPnhaDkCYFNFHRvdKzKQxN60rn/fUBuc8GMnBWtxW7IPqJD9ahbB
 0mw3zJ7BH9qOI7IVSspPueu3IHo6vQgXRiIA/xxJbv3XrJgw7lgmFrCU5AvUsbHz
 jbjc3YcfRlHB2XLBdTyosTV3X9LfdY+xIveTmQ==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/basecamp-client-id.age
+++ b/secrets/basecamp-client-id.age
--- a/secrets/basecamp-client-secret.age
+++ b/secrets/basecamp-client-secret.age
@@ -1,21 +1,29 @@
-age-encryption.org/v1
+-----BEGIN AGE ENCRYPTED FILE-----
-> ssh-ed25519 4NLKrw eqiq6a9Ht012v9ryAt2uZwpCU5/DFbiMZIkH0A/ovhc
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyA0eUFL
-c2ubOjYEc6RjhrZUCyKvB7chJwlCBv1KeIXdXlYcyNA
+VkFLckJIcFNNZWVoaml3Q1BJcTEyYnUvSFNEdG5WdlZmdjNYc0M0CmlXZlRjQVdQ
-> ssh-ed25519 5kwcsA R+KKgXolqFgs3sPFKLWBj8CYMHvsE0vcoPYjqgaYSDc
+RXV5UVJUbjU1ZkU4anVXVEpsTG9Pc3MvUTZZN0FacXEzd0UKLT4gc3NoLWVkMjU1
-jdl1BcHDXY3lvAfFKeHl8lNgbjbxLPOL+5OaPBsJC5o
+MTkgNWt3Y3NBIC9ucHAzSSs0eUpuNHpuVlVKa0YrOE5tQ1Y3aWY1a2JuQUJPMXVV
-> ssh-ed25519 9d4YIQ KYeIi3u2JB3efI5pSlc4up2wgAvR+X1xsHuRSZmr5RY
+MVpBR28KQWM3bm1odlQ2K0RYdmVPZjIyV1pOS2VkNjE2K3lwdUF4TENNMjVtNisy
-Qy6wagBuOXuy5b23stKEc/zfMpN53/56LKMgPFd5fwo
+awotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgU1BieFpHVDBnUnRDaDEvem0rZHNQMC9B
-> ssh-ed25519 3Bcr1w yYclbDnxBkGQF+MmcqNDG2VHZDcXK01Orl2c0L4auy4
+anV3b3d4blM4aDhDc2xodHZGMAp5Z0NGY0Q5aGpDNzFxTGNyaTVGV1lwZ3I5a0VN
-wbC9r7P4hnJT+V0Ic3Pk9nQ5ZUoPL+/qR9Ab5OHv3d0
+ZG5qYzlwVy9tWTFjbjJRCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyA5a1FFcUUwR3Nk
-> ssh-rsa DQlE7w
+RzhUcGYvVFNuVFFIcXA2RUhYVGhNb2JWUnRzZ2NzOGlrCkh5ZjN1dE5XNHNVYm1Q
-CQBYcl5SvyoDAm5n1QWE9o2er5GxYZvG2zrBtOPs+S7gnm6yHL2rtKDfxf+tpp/E
+VnlTU21WQ2c1UFZrY3JLWXJWNEV2ZktmajNkcTQKLT4gc3NoLXJzYSBEUWxFN3cK
-8xJHSi6t9zTWYwZ+udU8gjmawe8GcaWGYOHqjCd4H6Ic5c1aMMfUQsPR2aWlJ7R5
+cDJZRXZTZERhckhvUkJLT1ZaSkt4aFVBVmtXaldndElaa2VLY1h1a0NqeVJxVHpU
-4B1D83pZ/PHp1Qqb/AJKoiw3DNo4KrvYS+nX4FXuDD8o9JRuY5KjbY+9E2UcHx0s
+RTArWjFtcDgrVzJrU0lrcgpzbHVVMlB0N3VlY1l2MlVXLzRFalJpSEZPZ3lPYzZW
-8XGZq26TY8I2hVA8519bZeI4FTqoBx0yUBuE3VjTlrd/XtgpvNk0YswyMBiqpdhG
+c3RuWk5wVEpTV0hGQllNeGdrSzJwb2d3Z2VtVG1vcG1wCkNhWEhxVXl3WWZSWTVy
-PY+KZAnEPw3TbFtfmqbLk5QXrm4pn/TE/z4kzN9+3CkT2zbBBPGwaBAtQsOQ6yKL
+MjQrM0x5MWRwSTdpUHlrUEdQQXZneER5dVlZNHlvcmRGdUZ0UlN2TmpUR0hEbFlJ
-ZQRtnEm9FJzOBu3fFodeBfea8vEzEmuro+zbw/94tk0zjpMzfSehRfLE8tusgO+S
+WWkKeSs3VUduK1g0OXJQcFBwd0RmTmsyYUhYd2ZiVGdUSk9wNXgzd0xianJHNkJX
-/W/7yzlMVeutlWbzwpMZ4mALjz/PAYq8O3Kh88dbu9XEh0i/oWPBJiHlUdYND2YJ
+TDVsWUZ3NDM3NmFUVDgxTllyZQorYkc4eFY0aWY5aFI3ZmthZlYvcmtSRmpkbGsx
-5WOSlXDnotRmwB8vGmyPWS72jBfgPZLVfA7y73RzOhc6vwo4jU5Nh6ee+3LPOjfW
+TmFSTHVNZy8xY05pQ1FvWE5vSWY4V2dLWFAvaHNpSytITzBwCjJDYXFsYVVqL0ww
-
+aS8xU0k5dnRmRU54a0FnRkJiNkd3RXE0WVRKbm9xVmF2d3B6d2ZYemFPdklCZ1NF
--- 6X7pxwraQpXikkDgLrY3ay7zcwdk9U9LHx/MP8jEgcw
+YWhYdXAKNW5jcy9FN21Dek5WeWRSVXJBV0ZhWE5VeDQxTWlITTFRdjlnYlIraFBp
-<3‘jÂ<6A>ö¼uWÙF“’DæÙŸ™$Hð¹Ç†s)àSÚˆ›/ïÂëº pí3üA‰Sö^ùïóïVß‹u@9‡»µ´rš+L2
+UnhJelR5VFNmU2psSlkxRFA3c05qQwpVSkt0b3JZeGNJb1VJMngwUkE0bHBxZ3Y5
 Mkw4L2xoL1pKTGN4cmVsRnlNOE5PVHBXMTJUbElVY29pMXlEdVc4CgotPiBzc2gt
 ZWQyNTUxOSBDU015aGcgeThoakE5dWx5NVpnWGwybEY0WkZzcjNFZDlvYUFZVXl1
 ekl5RFh3anZGSQpFSDRDQzhxMlBKVllWUlEwRGZWN29iYkVQMlJlLzNoN3p4NGFK
 MWNpVXpFCi0+IEdyLWdyZWFzZSAwVkxtUiBlRjFbOSo2IEp+Cit2bFpKNDV6c3U0
 Ci0tLSBJR2IzRkZBKzVDUDlhZGFPQjJwYjBycC9DNFF4OUpnU1dvWHBPMTNGODNr
 CsCAHIe91MC8JJ2z5inV8EQOyEt/xZks224ofHdSdicQgpqmJzWTROzyehYmiaa5
 OEfKKCFIQEjAa+LM+geKj9qnMlvaimy/K+M=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/baserow-env.age
+++ b/secrets/baserow-env.age
--- a/secrets/exa-key.age
+++ b/secrets/exa-key.age
@@ -1,21 +1,30 @@
-age-encryption.org/v1
+-----BEGIN AGE ENCRYPTED FILE-----
-> ssh-ed25519 4NLKrw BJ2iDD2cLf/qP+VxEHz6Y+8GJ4s4I2wP92uBMG2ttQc
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyB5MGVD
-Nea+eK5CELL0eBq8+xuT+qDEbPyRzUgjnhDY+Mk8bjA
+VGFBOUwxWnQrZzUyamx0S0JrZWlEeDJEcGdKNEdBYzI3bmJ1RVJZClpJUmlTZm5p
-> ssh-ed25519 5kwcsA kpzfRai9rtonBkKVpYkD5kSYTsxbpwAliLO6WnyAgx8
+UVVvN1BtT0xoOGh2N0ZyN3Q5Z0Y2a2RkaUwwVG5KMllDNDAKLT4gc3NoLWVkMjU1
-BXG4c2yGwkaXPCkKAiOqrNJknz/tN1jOXmTuj6mJvzA
+MTkgNWt3Y3NBIENTSnBQOXhUUlNmYTZ2eE84TjVyTDlHSFJoSmYvM2lBTHN6TXNM
-> ssh-ed25519 9d4YIQ fRuLFIYDaY7JdtZs9BP4xm7zwDdBYGrzuueuQgS+QWo
+V2w0MmMKdS8xYi9RTmxHTWw5WWpQRE5kajRsWER5T3VvemJRaG02SEM5MHZQU0hz
-YM65b3HG43cP7EvcbX+WIn76a9I427MaeI0kJm0ZjHA
+VQotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgVVR3Tit6aStybW1VRWYvNGZOS0REWWJZ
-> ssh-ed25519 3Bcr1w /zGBacmchTtDaaCykhuJkMatDzuo7Hi8iefvnqYDyEg
+azhFTUU4MmNtdDZhbTQxWm1TbwpGekJtUWNkWHdWNUh6dUxvSWU1QkRtMlp4RW5k
-bK+aCK8cN7gDqLo15z6BC7WaWA+xXXSjP/eoe3ch71M
+ZGcwL0pwUzNzM2N6UUlNCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyBpWWgyVFY0eVZh
-> ssh-rsa DQlE7w
+U0FQdDQ1ZFV4NFJSNk1rNTd6NjgzVzNMWnozY0tMaFJjClR0YzRCRlRpYXFCTTh3
-JRj461Gh8JYOykv4J2ce6W+q0y4imNfJgAF8r/1FvIy1VYSpDPtPqX6zIldKZ4Fs
+SVJ6Y0t5Q0NVV2NDeEVaV1cvcjJpZm5YQU9YM3cKLT4gc3NoLXJzYSBEUWxFN3cK
-dcTpL4AFyQHysrLlMeTuOf7+91vWxBAPqMUR4DtEqxrnYKDpDMy6Addonx7ZhmwZ
+SEtsWHU5UVBaUm1mRlZrK3RUcldXL3d2S1V5T0Rmc2NUSGwyYkVqQ2xaTWZwczZz
-gl1dnfx7W9OxGrYZm3YsV5q4lvK1rwzDIswFduOky/kH65SUzdLl5nm8AcSQbKjy
+RVlEdEt3V2UwbURQbmwySgpZWTV5K0d2dzMzeVZmMGR6STV4Q0plNG1NMEJYbFBi
-k2jR57/0+z2wmHdxrjY4aEredqTXZNfWRbrX3RQc3xlzka4qajVKAuq4V6EsV3h0
+cW1mZlZZNWxEZjNrNzNBUml6YXlsUHhBbE10WFBTYnBNCmpCVjUvYVEvZEkybEZ6
-SjQfRgMTnqMyTxqbURl2L5juZrLSj3UAFvYLi7nLCfKjBeRmezG5zZ58eJPnq3co
+UVdDTzJzdE9XNFJEZ3NUcSswaVZYRC9LYzBoajdyT05DdFdlRGhPaG5wdGtLREQz
-A5Dy884MXuciLhc8nDUcTCSJap50P9HlyETq6ptzBV8JAF9TSpxY/gzbMt77VZFb
+Qm4KdTJKWkFQbkhQdml2VEFMYjJsRWhaZzVTTXRrZGgzekRLbXNwRUx2WXZkV0wx
-MKf+3gtUIOaXzmzkFp6u90XLN+0n6kM+eJw6PMAPHxHfRDHTtPXE7ZMxRt/TKv1D
+dkRrQ0J0eG1rRU0xOG5Rbi94aApncXpqRlQwcndkdjlvQTdDNWcwZGVkdDFLV0pP
-Pi/Aqmi5Q9t79TfcNsIT7DcspefCSf4NdTrggxOxo0jmKNw4mdN5SLVqnZ/Ij72R
+eCttSjZNSTMwTVNHOWJlbGx5Y0pQa2crRllpV05qM01TV3AwCmpQV1F5Nys5L2hP
-
+bGNEZEpXR3BjZ3YwekFNQ1NYSzNmcm1VaS90dkVtQ1Mya1BpSHRONUFucUFjNUFt
--- gwpY8yhU+VJSvw2xbmfKHrp8lJpb/0LuGaFDRIA7ORI
+WVRLcXMKano3ZFFEVHFxbFAvc2w1bjUxb3hJRkpuU0x6TWpKOUlXd01ST3ZGcnhq
-¥.ÑÉ®ŸùL,rð’RjmÚê<ûo
+alNvcFlmMCtOM2lMT3ZFaDNiK2RieQpvWGw2NEJuUXlJY1pRcVFJSEg5OWM1Zm5y
 NVJXTzhoZSs4WHBmUnQzTEVFT0hSZVBYVm1xY0dQdkdQYUtoTWxBCgotPiBzc2gt
 ZWQyNTUxOSBDU015aGcgQXJnZXRFYWFCL0Zwa004a1FVZzVSQjlsL25TY0ZVVDB2
 ZGdHczBmT21XawpmNGkzdFNQb2pHTi9NaWxDam42U0NzUy9DTHV6enROWGVQaFZ0
 dnFCZ3VnCi0+IF5baD1wSC1ncmVhc2UgZmFefHsxRmMgIyBebjRGYHAgJGhqTiYl
 fApQODJxRTlsUW5QaGd6a2prdXlmNFZycUs3MzNLUVZQdEY1ZTN6dlVjWUp5Y0tO
 VFhNM1lDRXVpY1BRRmgxTzRBCkN3Ci0tLSBRQmJaN0IyaFRFNjAzTUlkQVg5Z0M3
 bEFtMG1GeWRYenc0Rnh0YU12d09BCuk9nJPaV77UQ/31QCaI9bRuH1kKgVBsgL/K
 X5vSWh/tQjaXn1cKGxRW+ioa/IECid7Uu4GuhFlcttAURX80hFZiLyGB2Q==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/ghost-env.age
+++ b/secrets/ghost-env.age
--- a/secrets/gitea-runner-token.age
+++ b/secrets/gitea-runner-token.age
@@ -1,5 +1,30 @@
-age-encryption.org/v1
+-----BEGIN AGE ENCRYPTED FILE-----
-> ssh-ed25519 4NLKrw yQsk1NS2ujPzm4WJLl/CYi0EZRCIFvgJP2aLG09KJQE
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyAwcE5K
-H2QT+huNTEpE2ndSeyL38e1JW1Z+UEHObqhZQ66E28M
+Y1I3NG5vbkhmZ0pBZFB4MjhlOHgrdTc5SG9wMkFQUjBtZzFpNjBjCmhPK2VmbCt2
--- 1lhPBj02CB6BsouveThOL4pyTKXQhrUro59YXz0+fRk
+cFBzanBwQjFGRHhrSjlqeFNleGlwNTgxUlFNbmxjVnZVUncKLT4gc3NoLWVkMjU1
-qœË=÷¼V<C2BC>wÃ×Ü®1A<31>½ß²uš!óI›(ÏÄ?¤CC"ßÞ‹’3.ëÎåŽãsŒô :"úÔº|¦ÑæÃ†çY2”þ\ï<>ýˆ›Í¨«
+MTkgNWt3Y3NBIGlrUXRuaG1nNy9IWk1KUDNuUVBLU2t2SHNxNFRSL1dOZzRZTS9s
 T0JrREkKVUJHQ3NiTzF6L1RjRHlQNUJIS3JiODI1eWJZK0x5ZnRnUW1ZZjhLOHlO
 bwotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgZE8wdXFpb1BOcE9ZS2ZSUHFQVVVWQ1h3
 Vk5mVWxpT001aVlUeTZyWTEzYwpRY0pSOTFJTEt2dVN0eVBZY1ZMQ2RLZHNPL1o4
 Tkw1WEIvemJZODdzTTA4Ci0+IHNzaC1lZDI1NTE5IDNCY3IxdyBlcjFrRlVrTncx
 OGxlVlA4blBRKzhCREUwNmpaMnA4ejMzQnZKZnVsVFRVClExTzA5RVkvWXFOTWlJ
 c1VzNW5zVHJYNEhTaHgxa0F4R2ZNQnVZSE1tQlUKLT4gc3NoLXJzYSBEUWxFN3cK
 RzQrR0RhV3VCRWRVREM3V2QwL2Rob21HQ1JCYUNPWUs1MjBYd1I4Z0RNbFZCQzVD
 bThHNDRDNVVZa2pPemUxYwpxbjFIbjQ5UStyaWpJREdLVEc4THpEcEhqeG9MdElF
 R1R3RFBWSG95VWRFT0pTK2lRd1p0UzJ1U1NVYm1XT2xjClhQdnhQVHFQRnduSFdW
 MnpGY0NOYktPenlQZG9pUnBZNStJWElobTh3RVJnUnJmdDExWnAwWTR1Q2RtSmE0
 NTMKNEZ3Z0FFdFAvTkFKVyt2a2Z0VmJrVlpMeGk2QitNMDI0RmQ4TllINUR5L05H
 MVR6eDRIaXhUMzdNNVFwcyt4Rgp2N2hSVWNoUGt3SFp3NWowdWxQdmNvSno0emlp
 Ui9XVmxPbjgyUFE0WngwTFRhYTRzNUFQWGNiM1AwL1Z5UWtqCmswcGtFVm1xMGZN
 M3dQNlZVbU81a3hxNjNPbmIwM3pWRndseU1OQnlHbE9MMGROOURwQURqeUhFVDFn
 Z1NUN0cKOU1aMjhHUFdIbHU3MDltWTAySFRqSXN1Ym10eDUzRjFpeTNQdGlobFl1
 ZlZKT0FQWVZHZHFKRThvVjFVRVpvQQpRTjE1S1dhSDgwQ1BpcC9OK2VBQ29vT2Nt
 OVNwT1pYL2RjbmNmcG92bHg4a3JUUTloMkwwcUg3VjE5cUkxM1hRCgotPiBzc2gt
 ZWQyNTUxOSBDU015aGcgZkc4bUJoU2kya1NVZzZvRXpOUlg1WlBGQmoyM1laOUFD
 VVhmTWZ0MVRuYwpaNVRXbHNrU3orUTVRZDdlMm1jOUFONVBNRVRPOW93MnFMRnhQ
 UUJtb0M4Ci0+IGRSZ2NHK3RbLWdyZWFzZSBKI3MgaWhKWQpUd05qemIrUTNIK3VU
 ZHlWS3E4cDBHZVpGZHZhVXpBTGFKcHRrOUJFTkEKLS0tIFhSanJDZ2VPbm4xNFAx
 YVorSEVKS0pnSUl6QWVna2NkNEJvZnRBS2dMZ0EKeQpsgHF697S5LUJOsIaB+uS9
 wLQZ5RlWhuUdugIOEQBkkOOx3+LDRliy2q2iGKAzQrxxlGv6I3K6rb9HoKtbHczI
 n6/22k85WIXE560Xog==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/kestra-config.age
+++ b/secrets/kestra-config.age
--- a/secrets/kestra-env.age
+++ b/secrets/kestra-env.age
--- a/secrets/littlelink-m3tam3re.age
+++ b/secrets/littlelink-m3tam3re.age
--- a/secrets/m3tam3re-secrets.age
+++ b/secrets/m3tam3re-secrets.age
--- a/secrets/minio-root-cred.age
+++ b/secrets/minio-root-cred.age
@@ -1,21 +1,31 @@
-age-encryption.org/v1
+-----BEGIN AGE ENCRYPTED FILE-----
-> ssh-ed25519 4NLKrw bgUEh/FVWfivAo6uKPiDHEdmfdpD3br6mIrN4/tu2B8
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyBVOXNX
-Clt8sWlK9pyiCBjq3F+10JlPtKwapENMlhEDYRX2bIM
+eG1LSDBrbGRCSTlFZk14TjQ5RVVaYmhLdFdkNUUxQ25ZOG5DVlVvCjgydlZoOVRn
-> ssh-ed25519 5kwcsA x3Q+WtnwvaAUbTW1v+2zmAALSlBaYvFNli3hCHi8wxg
+LzhyRlc4alFYa08wNmpMNmtmZUVOakQ0WFh4aGJHTjRlK0kKLT4gc3NoLWVkMjU1
-V1T3gO5eWtxdg/ykaLNESXEZ2MYeWqJUt5L+G6cUIZw
+MTkgNWt3Y3NBIEFVRFgvUWt5N0VwcWpxeEM0NmEvYUdYUjh3WXlNSFgxd3Vva3RU
-> ssh-ed25519 9d4YIQ 9KzUEMXjzu/qPc6bdArd+KnY7rwbZ6/CEzM+lwF0C0E
+OERsd0kKTFR2VWlxanYvL3BWRXBuekF1czJ3V0cyajhXMkpRcUQ4ME5ZcGxMZFB6
-8KNfU9QYYyufDhHMgLdrSx6jciukaW7t1I+V9p1Y66o
+awotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgaGxrYllDdk5RbTVQb1p6c3UwTkJUeDJJ
-> ssh-ed25519 3Bcr1w X8vjb8VCjEI5BJHGWcMJWKwygGvvlVf0BjpijxN2vjM
+ZTBvOWJwY20wT0srOTlyR2xXcwpSbkNBQUJTWDNBWDFNZDJIREE2NTBQOXJ4Q3NR
-dslcuK2/dWB8XB5oYycjcv6evB2c2gcrsXQga44m7Rk
+VEhycDg1eDNjZ1hMV0ZBCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyBzTUl1aFU3OFVk
-> ssh-rsa DQlE7w
+ZysreUtUVm5xc3FxaC9BK0JkdTVNeWJlcFd4Rkk1SlhvClNPd0xubHdhN3Y1QVo1
-rGLyz1BUE4mMXUiBrpvJkcfHFw6CJKVvqn+6PK3dJ913miQJvPDvAJAzmYb4GPaT
+akNKVGtjTldxYnZiM0cyZkNpZG9yaUNHeTNHMmcKLT4gc3NoLXJzYSBEUWxFN3cK
-bRy3Igeh+P59OWWVXIdW5V3jZkUdOmkzU8J0+XW+mA7GkuuYgY9DddKwBRsuhZLL
+aUJ4U2FYWDBkb1RYV2UzeFUvTW9VRWpka3BFVG5rbDRHKzRiRURYcTJLeWp4UFhK
-aQJghfobOd5fGEJyU1JmHJE/fD2qaQjspvBr1SgWkTfFGguRR3DBXWEocMW9ggDR
+NVNGbUdzcGUxblcyUzNsUAo2aU1nWC9TVm5lRjNKNzEwT2dmb2xhekdmcXVZdGxt
-gLrt/exLJz6IVN8oZ7jZ1lNL2xETZtsFckCWZPqgH696DaeOq00Zm2SDIiP4WfyR
+Vmxjbk9Ob1FBcXZWUVQ0THptNmh4STJzeVd2b29KOVJSCkN5ZlFqc2tmbmhUWi9v
-yssym4yNtDnmkGGgowr53G0yNDgz0mOHvKsAaVXTYKHUZn6EbWm3YzfSjf93K5YT
+OXIzQ3RHN0lENDBacWE3SjQxc0lSUWtKbXkyVEhYM2RXWG8ySG5sOFl6d05CQXNT
-sDowkgLVpgaGlbpuNV5QTo4bRxR5E0Nxt48Fz3bqqZ2dhMFK0+jNokeXDS1aoMbM
+VWoKbW1URHlqV2k0bUlLcmZIRUxzaUp1YUR2OTlFaGpsVkIzYlZKUnFZQ0ErcnRO
-QItR+fyRgfv65krMnYVNflMBedbp9wUpDrePLOkvu3U6gYOSc2yXr+/WPABJkcMD
+WDdCMUM0ZERhY3d5N1g2Qi9EKwpqc3VqU0xudFovaG5mbm4wMVFIVGJTd0EwZm1u
-SFcgmmUN52zOJk//innJF6lEw38WQXrvWpVtR/rs8YAzsyU4PomD7x1jKrvyvlpJ
+SVR3VWM5TjU0bE9SWUR5UEFGdXhDRjdZY2d3YzkzTjhEdTYzClJ5V2JZcTBnMmt5
-
+YWMraURJSmZUbTM1cmlzc09mMzlGOXRteTZsN1IwZzd0T1Yvd25mamh3R0I2czU5
--- /jB268IK9QX/iUEBxzb94wU2LlPT7bl9D9dMbykMaQs
+VitRdTcKeC9TSUFjb00rVTB5a3hrWmF5L2hueFlyc1Z2M3l2OE0zc2VkeWZjK3VR
-PjÙdW!‘£êcJØ9ûÅ.µ‚Ùóî±<5æ,t¦•Ž;2÷UžüØþ©e¡õ¥ÿm„!÷
+ZDhnRG0raVM4NzN4ZWJrUjYvRXoxbQpnOWNXWVVVR3NxeldJWjRBNG5QejRtWit1
 eCtUd2RzSXpMaTJ5QjI5Y0JNVUtDTjJDcW5neTdBZG5vdEJNMmZPCgotPiBzc2gt
 ZWQyNTUxOSBDU015aGcgOXRvR25JdDBvWU5ySXN6V3k2eDcwd1JYMjdjRkpoRkEy
 YmpyQ0E5bEpESQpSM2sxak1xazgxSzlZR0V3RlBPVTZ5SEx4dzB2NVJmdTFKZDE5
 OVR6TXhvCi0+IEYtZ3JlYXNlIDIgPS4gZyhOfGpDLgpEZm45TWNCRlJKUm01THVl
 YjN3VVYva1pLYTIrUDcyUTZabWw2N2lmNlVnL1cyNGlMeWtUU0J3SDFPTmxwdXh1
 CnhsOFBjS01qTDYvRlE1eDI3QW5NQ3VVCi0tLSBMUnlNUE5ITUM3RnFkRE0vTVBS
 SXp4L0VZQms4WEpERE5CVnVidHoyU01FCgN2/Wgb0rxsPsiGAFb7lphaW2QMZ8UH
 C0Ab8vLqqCcjeNNyU1AyH8MG0z3s1BatdpD+XTGMGG1c3poOJ6zhsSWG4W2Td/aD
 +vTc8es14IYJ8irM0q6E7sJ2xXxNKo1rpwZr
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/n8n-env.age
+++ b/secrets/n8n-env.age
--- a/secrets/netbird-auth-secret.age
+++ b/secrets/netbird-auth-secret.age
@@ -0,0 +1,31 @@
 -----BEGIN AGE ENCRYPTED FILE-----
 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyA5czE0
 YUFkZmJiUjRXVVRlTHFkTkhrVFBnMklpbStSS2lvTjFWeldVS2drCmgvc3B0dmlK
 Q1FiTmtUckNHSmE5RnR2dmowZEx4WkJSNGpVU05FMnYxUFEKLT4gc3NoLWVkMjU1
 MTkgNWt3Y3NBIHk2SDd1ZUNSS0cwckp5dy8yN21ESUxGSGJNTWpORzF1T3lXRHov
 cTIrQkkKZi9CSXlCeEE4V0xBdTRDUG44WUdHZ2QvZ1NqNi9JOUVVNURhZHFCKysv
 RQotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgam5Nb1ZEWGNxUWZnUWk1a20xcDRUSXE2
 Zi9GbjVTUE93b0pUenErcjVESQpBbUdFZzBMYlhDUmFSVnZOamYvT2JUZGJjc1Q4
 MVBSdU9jaktRczhQSmh3Ci0+IHNzaC1lZDI1NTE5IDNCY3IxdyByRzBJUXZxQWlj
 Y0NoZE5OMC93eUlubkR0K0hiR1A2Z0dYNTlSbHRXcGcwCjVWbkQ4bnRPQ2IvN2Z1
 Q3lKUGVyVUNjcDhUazRQU1ZORDdLNlRTWXAzTW8KLT4gc3NoLXJzYSBEUWxFN3cK
 SnNBNnlDeFlGZzBxbUVmSlZ6RTFJWHRJTkZ2R3p4MDdrUE9YTUY5ZFhVTWRDZG9M
 bmJabmFMV0RDbUw3eDJRbQp0eFJEaEVuZXAxTXNESlFncjBSdC8yM2dyamZQdXlr
 eUhNMEM0NjFSeFNLdW1NMVZ1bjJvSmFQSEY4NzZaTGtzCkxndVdwb0Yyb0FxWFNX
 cU1jMXFEKzFOdXpwdEFqY25oc3VPbVV1SlhDSW5EcHcxVEoxR3Y1b256RFRpaGNC
 NzcKanJ6bmFmVncrVGxuSnpMOVNoYXBWbWtMbFdDQ0dOUU5GZDhTZi9pMkkzSUdY
 T1B3b0hRZ3dsR3orL1hQbTQ2UwpTdGkvRC9UUjFncjN6TXZkbmkzK2ZwOCthY2ll
 T1gxemt1RHo3Y0JsV25hdTlLVm85MDdneVoxa1E1Y1A0aExTCjludHdvNDRGS0Ni
 d0pXZDZXcHdZcnV0RDFJTTNXWlZWeWIxYVFGM2VHTWtyVk4wdTlwczIveG14SWJJ
 L3RWSE0KQ096VWNuV05Ub2tmK3VGZ3pGV2t1NEMwSmNzSGYxd0tMNzh2Z0E0UVU1
 Z1VhS3h2VTB6eGpFaXdSc3kwQXJhSApTWFIxUVNOOWhUNVpHT1VSV1FHZUk0Mk1k
 a1B4U0UyaTVBK1FyckRBSHV0ZmxFVXhScm1lYTQwWXlBb1B2WXptCgotPiBzc2gt
 ZWQyNTUxOSBDU015aGcgMFJnVGVtSnNxcURBNUxsMzV0M2VhT1dmS2xaOTBpS21C
 emM5blZrVzJqVQo0UXNTYys4TUd2RUEvcUI5enp3WmlWTFBnTTA4b09oVUE2Z2Qr
 TnVSK0ZBCi0+IFJOMEIzXXEtZ3JlYXNlClFGMXJpcTN5dks0L3pzUzQzcDh2OUwx
 U0VPMTc5bG41c0hGUTJLNmtrL0EyWW80L29tS0EydkQySG1sTDNOVFgKbzdWTURO
 Yy9UWS81T3NudTZGTmsyc1pOK3hJRmdFR0RoT21XSVp1Y3VhTkFTQ1A4c0NUWUxs
 M1luNmJBR09MWgpGa0JlCi0tLSB0TjlpK2lZU1pZSEJodmFqeWVYK2lTTGJmZWVt
 UG1BRld0ajlmdTJCUllJCqVpsdjXomzGNO7FJZSQYfMBTafn1twocRQOh0GoFH7B
 dVqgO1AKbR/qBskLwv9VhwVjcF5lcd4eMKV7GesllD0UOh7gSy82LS8rqsyg
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/netbird-dashboard-env.age
+++ b/secrets/netbird-dashboard-env.age
@@ -0,0 +1,40 @@
 -----BEGIN AGE ENCRYPTED FILE-----
 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyBSZUxm
 V2ZMdVJjM0s2UUdOM1JmVDlhYnkwc3doRGJJaUxYKzhIUFgrQVQ4CnlTc1NjMzVS
 SW5yRWtneUxsZjNXdTFoWUxsdlVpZHB6aTNyaTYrZGZHUlEKLT4gc3NoLWVkMjU1
 MTkgNWt3Y3NBIERqK3ZYcTVhU2VmemlQWm14ZWR6Q1gzeXlxVkFhM2tmd0N2djR5
 NkN2QzgKNG9rVUEvc3dLL2FQUkM0L0h4c1NYR09nWHY1Tjl2WHB2UUFQMnlHZnVL
 OAotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgTWh2ek5RVEgzOEJaSXRWR1pyZU1FZndu
 Z2lYUm9vdXJhMGxqVmJ2a25HTQpoL1hKK09wRjJXd2hXa01nRFkzeFhoQ2tvMk9K
 dnRycFFHR3M1RDhoa05vCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyBRQTArdVhtRzh0
 dXdET0ZxcW9WVE85ZWd5R3A5a1NIRzh5cWJSVFlUUlJjClJrREVyZi9FN1dvcXBE
 TTZSV3gxcko2d2NVMFJIQmZMcXJpWXVEODJwdGsKLT4gc3NoLXJzYSBEUWxFN3cK
 VW5CNm14aitjK3dMblRteXMyeFYwYU1kK3BoTW1BNlc5U3hKMXFtbFJXSTdWSVln
 R21CTE1pZ1hhRVBkU09FVwpoL2tqem5ObUJhZ3B0RlM3aGZmWDFoTUdvY01zYXN0
 Q0o2bndZQnBNZXpDd0tiMlhtUEg4MXp5ZWZ1NE4rWFNyCnd1eXVKblJjZzZvNDA1
 K2pBbTZUa2hCcDZKcW8zOEp5U1cwTHZ3SWZlaXp4UFNidWpMN0ZRRE42N3o4czFD
 TjcKZHR5R2tpZ3dYN2c2QVEyZU8zQmY2a1ZvSCtBZ3RiMldUVmQyYk9iNTBpamtQ
 dGtUN2QrdmMvU2psRU9TL25oVQpNY21GUDJCdnVtOTJYbHp1MTJ1V2VvNlR2bDRJ
 VnpFTUEyVFRpQ1ltMkpVRjhoQldYeHJ6bmNSQmY2Z29DVXpuCklsUkVud0IxMVk5
 b0Q0TGZSU3NqZWsxS3JhQlhrTzZ0Z0FRczIvNDhqREsvbU5UNjhEZG1GQ1pHTm5i
 RWhFOHcKWlA3ejg2dmhCTlRpdEZtQWNYTktqYjduRUdDWFBFWWZyeDB3UXNCVXpM
 UDd1L3VFTGloRjZKZnVUL1VkWVZsMApYNHhpT2M2aEN2bTVIOTNDZkdmYU0wL1JT
 aVFSU3V0dVBGY245WE8yY20vSXRoU0RrTTV6VkliYVF6ejQ1K2g3CgotPiBzc2gt
 ZWQyNTUxOSBDU015aGcgUE1HVTFsZTg2UUd4ejB2VGp2MzB3c3YwSG8yOG85MzFx
 SXdIckdTdy9odwpJYmtsc0J2dnlIWFFoQWljLy9yUGVMcnhpQlBmd3doRFEwNXJO
 RVpaNE1FCi0+IEprSC1ncmVhc2UgNnJcZzssblUgKzlJCkRLZmhmZlhVZ1k4WE0z
 eUJTRzFDeWp3VEVheUhnUmt4dTBOZmorM2VMSENJbmxoV2R0QVFORXZUQ2lmRVhQ
 bFkKd0lhY1JNMmFFYTJ6QzI0WWNKK25MWUh4QlFFclJBV2pqT3NnWVdQdEVrVQot
 LS0gN0VYajJBRGVDM1h6RGsvajZHbU5FNWlTMmR3dEcxc1h2dTlIanIwQUdVVQpn
 NKFJ2fxJEwLS71oPYhLJxN8fedFcOAuXCqxTKfa6MK40Kcs/9IV6nmgaA7XQLRfR
 aMXlWuay1karZlojoZKPHIRduYEc0GbFS+0mYE+RsSHzn/enxuTcvE36pkQg0bsV
 BKyXaWnXKMWRSfNNt8Wb7+54B4Y40qGLGLDWBBxiPhNe4ys0Hjq6PESb1ghuBiGh
 wa8rUASELYeMzyiGNI3yA9zP5pdk7YxqsjEx37egLe3unmSjzKY0z9+eJK3bRk/e
 emI3KGtIdb1QnhPg+1BaHiqe4u0v0DwD/JbUhzB+DBuD0iLMUQ+jHhX84x0b6MGN
 mzK4yTFEkOZVHLc670dnF/Ye3L4DwFVCzx7jqq8Ci3wy9yNev9D+uDMypO9PMqXZ
 dfREOVrj5gGMKaNM6hOCw7IsAk7UeZfVCJLXbS7mZAkxhHyomKzeLzvnsUCMAEOE
 TEuglM/dWVMG9UJ1tHQ7L8W0+cgA0Pmj+9QffeM85aub5+31bWMkaecuvIjOJbNA
 jTXblFB4MV07+jDeCDf8Pxatd0zzL5qshXsejSjYC7ywZ56eJxi/yFJLkiS7Q2Uc
 6SnR2S8C1T+KTIZLlU9rHZMqqHoeF69eGa5CeAEg3Rrp4MBQEGaqhYoaOWbjOL5B
 JVaHvaePhoEG
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/netbird-db-password.age
+++ b/secrets/netbird-db-password.age
@@ -0,0 +1,29 @@
 -----BEGIN AGE ENCRYPTED FILE-----
 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyBmQUFK
 MFR6Z1JTK2dER3hPMmlQeGRBTjBjT3dMbFozeTNvZkhrM0JKTW1NCkcvU3BLWnR3
 cWVSenNnWkJBREQ2enp5ZngrRStnQlpvOWlScWtxUVVIV1EKLT4gc3NoLWVkMjU1
 MTkgNWt3Y3NBIEpROXJYZU9BVURFenQzZERsd1l5MnRHOHdaSFV2V2dHZnRPbHky
 eVZ5Qk0KYjBtY0lJSUhaRWlYN2FKNHV5MCtzWkdhd0ErdG8wNmc4V2F4ZGMvK2Z2
 RQotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgZXp4YWxGbmd3SG5RL1JPRzc0ZEcyUTZK
 TlVGTi93c1FscGVhTG9qYjZUQQpRTFovcHFwOTQzcERuaGwvczJnVkZNWmUrSEt0
 L05OK25Zb3VpMTY4SG5ZCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyB0OHAwNVp2M3c1
 a29QUkFBcHZxZVhoaVFUNXpndktCUzlON1N1TWJ1R1NnCmtsMDhuc21XdWh1U2kw
 dTdvV3pNbW5GSFNLaTlpcW5sa203SW90SkptejgKLT4gc3NoLXJzYSBEUWxFN3cK
 ZGNtZ1lqSHcySGQzbkE5UE1ieGNvczArdnJsY3JPOHErNXZwV0E1ZkRHbTFVMmJ2
 bFpzaFkrS0dmWlp4QXlaYgpUSjcxNE11Tm9YQmpPSWhQU3FlYy9yMW8xUGdkYjVG
 SDVoUUtHMlk3MVErc2JBRVRtS0pyTlorNk9aVUNZSno2CnJmYlhlL3UzWXpiNnpk
 UnZIZHMyNkdBQlJ2akdDcURYWUxBNm1mMFV1dXJYUWQzR3VrVXZIenRtd3gyQjdw
 RlIKYlJMVUt6ZEdKdUN3ME96UDN5d1MvbDQycklNZXJLZllJZThOSmZaQ2EvZFF1
 RHNSOExsQ1hLcUxKamRSOElDcgprY2treWJxYnJnNVJFejhtMUlJdzZYTEF0OHpY
 eGI1VEtWcU5CTTlUME9RN0hXTXRsZE5kWFJQZDV4d1B4OXc1CkxLYm5qaVJMMFNL
 bUU5YlEzazJOb1U5MnJjdldFSC9iak1tRTk4a2Q2MXpKMGN6UG16WEp0Z2RCNytV
 KzNtbkoKRGt4MDd2ZGxkc0M4c2lmbVBpZVYwNDI0Q05oWTFWQ3ZqMVRDbnNFcHM4
 NjJCOW0wYW01MUwwVU16bHp6WGg2MgpnMXREWHNoSm9kbWZQZDRFS2paUm5ibTI3
 UFBxaXhsY0pPYnZ1WWhuUFhrMllIbE5ua3dxYkkrNFB5S29DTFZ5CgotPiBzc2gt
 ZWQyNTUxOSBDU015aGcgQ3NhNHJuQXVoVUt1TDhDQVFtWEJhS0VxbFFablV4V1hF
 WGtuaStCMDNpWQozU25UQndsa29xMWFOTXFlNzdNd1Jxd2tzbjcvTG43bGlWYmda
 TFRVQVZjCi0+IClzUy1ncmVhc2UgISAyOz9mQz9WeyB8NWp9N2oKL1oyMlRBY0JM
 Vk1UcTRqQ1ZCVHZ0TC9zQWs3eFdkZHhHekkKLS0tIEpiRi9naXFBQ0U4U1JwdUlB
 OHRDNlVBYWJObnBYeXZibjVLbDdiYlNKREkKXE0A0Ikjrggw+RQhdQWwUK/lajMI
 9FcD58IL5PUrx6Sx7BokDbFXr5JJOY+rQs8=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/netbird-encryption-key.age
+++ b/secrets/netbird-encryption-key.age
@@ -0,0 +1,31 @@
 -----BEGIN AGE ENCRYPTED FILE-----
 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyBXOEtX
 YlBXaGZrTDRMSFpHbExhZGl6b2hGRVptbk1OU0JhS3JhUDBhdGdBCndpMGRNOG5i
 d3dGUkpEM2pwTGswS2pYR1RTZ3NHTVJjSnpxOXB4VlZ0c2sKLT4gc3NoLWVkMjU1
 MTkgNWt3Y3NBIFFvWjA3dzdKU2hQY25WU0R5V3U5MkZPNFZ5WXNzQ2VxUnZtc2dY
 QXpqbk0KV1dleDhhUGhBaytST3ovMm5CNWFkcGx0SnpCTm1MUW50RTh2a2x0UTR6
 TQotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgZVBkT1N0aGUvYTZVaEpnNlhmY01NYjlS
 WUpkUWorbUhva2pSYzZUQ2hoMApUcVNYcExtejhpeXRabVY5U3lsMk9MelJIdjMr
 aDBGN0k3aml2Q1l0ckg4Ci0+IHNzaC1lZDI1NTE5IDNCY3IxdyBaYk52c0VQUFVD
 emFIcG5IWEk4SzdmeWJzZy8wMkY2SHM1d0JBUjNzaGdZCnR3Skh5eXE5ZVRIeXNO
 TW93N3FtTVFLTzFJblFpeVlqR0pWd3lwSCtBTVEKLT4gc3NoLXJzYSBEUWxFN3cK
 cVVaODhZRzgyKzBoQVZKT0RhTmh3R3M5eHJzVElINWZ1QmhiU3dMaW1zYlQ1UDFH
 YWhLTGF3aWxwclJidGtUMApwUnVRRnEyY3ZUUDExb3RNdXRHR3cxWEVyajUvdHFD
 VkMydkFxMmJwYjViQUZXWXdCWW4rK3RzWWttamFMclRFCmxHTlVBMGxzajJRY1Fm
 LzVRME1sZjgwSnBsZzlZOW8zNGNxWDdmdTZqaE53bU1WRWYyK3UzT2x0bEc0RWVO
 bkoKTW1qUlVMQkdvY0Z1WVNMZ0NDVkNvNFZZbUZ6UFNVcHh6ZjVkckgveVFWc2xk
 NXhlVnpZMDcyV2d4eUh4OFlPQwphWjQ2RHZKUjNwRjZWTXVmTXl2MHE2OWFDNVhR
 RjdzbEZwOU1Qb0gzQVA3dlFEbjcwY1JnNVZFdHNxdWdsaDU1CmdhS1NsbHRFOU02
 cXRjeW9tanRmeFI1TVJ2QnRsYTd5d2dPeEJKZ2RsbGY0RXRDWXplN0E4OHp6MkMy
 a2JZRzkKTFIveEkybzlKMjdaUDE4VWNFZlZqbmNGMENIdVM1RGMvRnlPQlMzdWcy
 eHBRc3B5WVlXK0M3MkswNmswaFBHSApqY2g3cmxLVDRlb3FkUzVBSGRoekJlVlBj
 UHE1QVYvM0hTeTYwd29XV1JZc00ySXgzeElNa2V5QnJJekdJc2UrCgotPiBzc2gt
 ZWQyNTUxOSBDU015aGcgMldyS0p3SlB3ODJnNmE5Yi9BK1kyZHNoS3JraGxHZDlM
 djlrMGlteExDYwp4OGI5REJjZ0V5b1Foc3ZLTWEvRFBkK2Y2OEEzU3ZKUVgrTnpj
 bXVPbGxNCi0+IDIuLWdyZWFzZSBvJy5MRyFsUwp5Y1FoZzQvZGM2ZTlKWlcyVHJo
 TGxwMmo1dkVNYW1abFJlckxMM2FMSnNKcVpJb2p6R3Yyc2dHQUhRUUpldGd2ClU2
 RWNocW14SThFV0MyUWZLWHM0VG5RejFmM3c1V1lzUDRxUGFjRGRMTXorZGlYdWlp
 dmFMbHg3Ci0tLSBCc3Y3WHZiZDRIU0FjM0lEN0p4eG4xTTlPeUtpVDJhb1ZTQVps
 N0NlR2x3CjTFZbgGgHvPtO2GvG9spzW0aZ/JqM2NB3k61s0DowyUCLo6t7FjBMHB
 j4A3bLf9aVbqD7AD9BK6QAz8aQe10PuAWdd9zqd3EPF8bZNe
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/netbird-proxy-env.age
+++ b/secrets/netbird-proxy-env.age
@@ -0,0 +1,32 @@
 -----BEGIN AGE ENCRYPTED FILE-----
 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyBOcU5W
 QnZVZXRnQ04zckRJQ00vU3c5eFVjSkNQNFVuSW1XU1E5OU5lRkdnCjdHQk5oSElz
 bCtVVWdyalcvR09ieGpFSCtOUStVdEJqRWU0R1BCZnJCa2MKLT4gc3NoLWVkMjU1
 MTkgNWt3Y3NBIHVaWENvOHp3b3lxS3ZvaU9IL3R3NUI4cUFTZ016U1JMYUJtT2Jt
 L2g5aVUKVmhuTnVlTWExZWpTNUVqMSttc0MxQk9zRDFBdlhhYnVwVzhRTXNQVHRy
 MAotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgSUNLR21DemQ1TXZ0ejF5WWh3L0xCbGwv
 bVBndGlwbEdSYUQ5dS9sblppNApTZTd0MGJON2FtaWZJZXpFWlZPSUZaU0xEUVdQ
 VEJWWWNnVmRTVTdpRmRvCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyBtdXFVa0IvaGVY
 ZGNyRVNENThWVXdTaTJmSXY4OG5OTmhtYkJOelpPbFJRClp1UXJMSzBMMzlkMlVp
 T3RGc0VtWXUxc1BvS1lyd1VQem96SktQRE40NU0KLT4gc3NoLXJzYSBEUWxFN3cK
 clFleXkyME1XMytOYi9LY0RCNjdPOUZaUVJqUmVyK0NwdytKaTN5cC81N2NBQUtR
 N2l0VCtRK3FtcEhrcU5pMAo2bmh3Nm1rN3Z5VGdyUHhScWE2WUJ6YXdPZE91TG5z
 NnQ5NG8zb1NEZjVZUm5QUDc1TmdlZ1RBOVZhSG13Wmo3Ck1RUnQ3Rk1Da2VTSGth
 bWNvdUpQNTNLMFcxMlFmNERGNEtjRGhCc3c4Z1ZiNGpKZkREY2VlaXMyZXRaQ2NQ
 cUsKYUFjSkRMUGZuLzdNVmNob1QxYjJsb0gxZmFob3Q2T3BhbzZRbzZZVTZJUURF
 YUkwK2FWZnYvbFJ2YXJ2bW8zegphM1luNlVXRUFSVWEwN3pmK1ZzZGxGYkxHVEta
 YVZSOVF4V0VJVWNYRm5aSDNHVnVwc3JCZW9RVmtxTjBJZFlzCmJXbFdPM1Q0bThj
 cXplQWhocGRRLzRCL0ZWRndxZzdQai9jRlR2U2FwanNJUTM5Q25IaXc4cDVXeXlq
 b1BwYVEKM0t1dUxDSXFMbW1wd0Z4VGxxMFRXWmd1QUVsWTRCbFBZSXhGMWxKN1JO
 Qmorb0hnckptdkhKVUNNdWR5anhtRAo4TmdwTzltMmQrd2FxRG1IQVpZcmc2VlFm
 Nk9aMEtsYTl4L0tyTk1NSzlsRit1UC9WNk5VQ1YzcnFHMG9GYnliCgotPiBzc2gt
 ZWQyNTUxOSBDU015aGcgUXZ2bUpQL0JOWXNJdHdiNzlPbHhQUWJ5TkxocU02ckpH
 VFBDSXMvd0R4VQpsWFZvdjFObkIwZlE4Q0g5eWJySUcwdUg1V2N0c1Rxc2MyVEpH
 MmJodjFjCi0+IHBiaG43LWdyZWFzZSBRZFQ4O1UKOFZ2aWpwbHRtc0daMDVHREUr
 RWp6K3JlbmJxL0l2dXVCd0pYR2wwRnBIbnBIdWJkN1VGQWJwaEMyZ1hyUXBVbQo4
 c1B0Nngzc2t3ZjlueHZnaHhCZnBWK0pzNWxRaitZcjhVWW1maGJ4K3dBU2V3ZVFi
 UkNVQ1VpK3hlQU05RnlpCkdBCi0tLSBSazBRS1F4YkJlMTVTejhIY0k1S2wvVkl6
 YjJmQmc0RjhxSnd4UmErUUJrCgEDmxWBtnorNPAFQLGAiW1WEuKPhH+pDJuwcD2N
 Ez+2PF3281HyF25y529S4NGXi9NMGdbLHosc0bMbtiDHAaEzfBq/oCSGZwUZSH41
 XT0orh6e99GMo5I=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/netbird-server-env.age
+++ b/secrets/netbird-server-env.age
@@ -0,0 +1,32 @@
 -----BEGIN AGE ENCRYPTED FILE-----
 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyBJank4
 cGVYZmNPVHVZQ1ViczBBQ2hIZG9SNG5uY2pTd0U5MElCdWhjZ2g0CllzSmVETDc0
 aHRmOTV2VCs2aVA1WUVVVlhlOHRCdjVtZGNaSG56dG0yUVUKLT4gc3NoLWVkMjU1
 MTkgNWt3Y3NBIGI3ekxmdkpRYlZuK3dlL2Y3QUppY01qUVBmSDl5ZHE1NENyRlhW
 QU45blkKSVpCT2p4UjU5My9mM2J3eGNyQzZWUnJoSXJWSFhvMFZBQ1ZrUGNINE45
 awotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgUXpib3BTcEtjZXFxeEZYSHFFS2QxcXFa
 THZIOENFZU5naWx3THNXVUdUbwpxR1hkUldMZVdObkNqSUhuSGhoS0hycjVOdmM5
 MDNkNy9lMmpIamlpRTd3Ci0+IHNzaC1lZDI1NTE5IDNCY3IxdyA2a2owUWRsRFhL
 VTVYcjJaMElYdm5mSnl3WHRyZU1SWVluMTJpcUczN1JrCmxhQU9pZUpXVDM5bWgy
 VS9VZG5EU0VCakw2eEhBY1ZTbHY4RXgwTzRibFUKLT4gc3NoLXJzYSBEUWxFN3cK
 VWlnc2M5WHBkWEgwSWtkNUkwZTJNSENMUDBkaGlmT2MwVjE5aDhCclQwYVpxcmpK
 ZklMZ3hVZnpxc2NtbDlnVApJYks1STRzUzk4c2F1LyszdnVwUDRnNmZZQW9Qd0kz
 cjdPQzZJTE4zQzVtcGJaaWdOd1NSKzgwOWlOZ3hhQWI0ClRoaGV3RXNoQklFZU9H
 Q0NpV1NQbnBkV0d2WmJKNDJWZzBhZEFIdzVkeDFPbk5TRnR6NDZYZHpuZVFSTTRz
 VzMKMGFZMlI3VlY4UTlPSkNtcm1HcTZBRkhJYWtOVUhsMjUyUi9XVXEyUlF1d3g3
 YWZXQkdRd09JSWpKMld5U3N5OApuL2c3eGR1OWttMjRVWXFmL0NPajNRVE9lOHhG
 MFlHRUlZcThkeFJkdWczbDhMZWhZa1hrOWpDMU4vSzlaaVF4ClhRZTVES2JhcGhl
 SFlBT1hyRjNuRmdQM1NIK2tXcEFucURJZWVNb09ZakMrZEhLMHVTMDllbVRKVWx3
 MHNFTXcKc0dEb3R1TXFaVWpnV3h1aVZSTUdJQ2t2N1dTSGNMa04vUnE5M2NKTW1y
 ajJTS2c2eWRDelQ3WTlIaVAwRGNUTQpzT1BWcG82eW9VR1lqZ0kwSXFsNkxVTWF1
 elQ1SFBEaWo2Z3BTZGNMWmEreTBjNjJxcWptdTA5S0ZTRnJUUGh6CgotPiBzc2gt
 ZWQyNTUxOSBDU015aGcgdkhReFZCWVIyMVZlc3czS3ZOckErREtxQlNUOG1SVXlZ
 UXRya3N0ak1uRQpNSWI2eURrdElUc2Q5Mk9UNk5rU1JVQWg4U09kVm1ZaVZhQlhx
 cnkwU3gwCi0+IEBxLWdyZWFzZSBcYDssYEEqIEk3X1tKaSspCnBpRzdVTEdnTUtl
 TFJEcXRad0p3WElWNTZmdUM5WUkrSVd0SWhPL0NTRjdubXFXQnA3ZjlpZzRwYklz
 Njc2OUMKcnVmeTdKNlhUZWt5U0dNQWw5bC9KdwotLS0gY3NmaEFUaW04bjlCYUla
 eUFiQ3pXdUkvS2RqR1p5dlpJeHpjdkg3enVNMArtP6Q0zNE7GmNslMNC+jVr0fHy
 hPpDQaVsZEzCyKo79FvFRtHikuLOPUd4WA9Gp7Ggpw4zuCvKmcWEenigDRNuMljT
 Ny46zYxx4iQvkCBlID4a2XaeYY3WYZEzb8F4QHU9hTT3Zzp6nz2x7WV7LZtoHfYK
 948qYA/q8OlWRrGGM5gdLGyoBv3m
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/outline-key.age
+++ b/secrets/outline-key.age
@@ -1,21 +1,31 @@
-age-encryption.org/v1
+-----BEGIN AGE ENCRYPTED FILE-----
-> ssh-ed25519 4NLKrw wSH8yusbJ18/yaLjEVQ0+J0simPigV0Y+2+JUeVNSDE
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyBRRFRK
-UMnO1DQAEnQV6esB6q+DMKuKXI7mATSTN56Mm43kdo4
+WnI0bWFxY1ZXdkpsaldRSUpNeTBobzhCRWpGMWRCTHAvRVA3UWc0CjloVmVJWUls
-> ssh-ed25519 5kwcsA BtsDKFtXx3X3TmIrjcr5PuLAMDmLmAihtVh6S3MnKxw
+ekF0cmNCVGxMbHo5WUFIZ0ljdUNZWi9Lamc1OW1xM0NrMGsKLT4gc3NoLWVkMjU1
-EHY/e83so8CFXFBCQLx8u1UL1hn0B6gSTNNkQtK3QfU
+MTkgNWt3Y3NBIElwMW8rOEVISEVKVGJYSnJHc0RPeTE2YmFqUGxXVlg3cDdMNXJh
-> ssh-ed25519 9d4YIQ J3xOFRQVcHM5WP9UcXgtfXl2yytpBIleEegIXlDJKhM
+aE93aTgKR2Rwa0d5cjZYRTN2SllFOFBENXE0VlZYTTVjbUFnUzlpMGs3Ui9xVU12
-7gVb+ry6BTyZHTZI2Qb/edLK+UiqdE8MWkWrsMs1xPY
+TQotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgZTFmZkFOSkpFQm1FYmozbTQwaTN3ejdq
-> ssh-ed25519 3Bcr1w RKF9kMe7Pj69MYxDTOkxlOpkX9hwpwLmIWf8NIlotHI
+WUVHbHNsd2FOL2x6akg3enFoWQpFbkJKZmQxQjhZZHBJeTE0bzR0bktvN3JMVk5F
-CMWJIfHJYZ2XbBgTi6zUkTLY55BJBCkyZUNAVBNdxco
+M2NoMVFWckhZaTE0eGFRCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyBMbkR2cTVMbFpL
-> ssh-rsa DQlE7w
+enY5eGo1d1c5UWo1MHRKMDNRa1IwZ3Z5VVZZZ2ZobUFNCmx5V3ZhMVNMZTZEWFlB
-YoUlCh8ePLkUQoZxWDOu/0Bdd5kA5/5aZdgMoMEXnLSr9Q0u76hpSFvw40FpmvkI
+YTREbE5LeGozY1YwcXJmK1oweHZ4aEEvQWNMWlkKLT4gc3NoLXJzYSBEUWxFN3cK
-hcZL/s2bu/25EkrsA2x8e8s5ORdJpLj5I/D4ucrloD0g36wqnw0upeTWk8rmEN+i
+ZWdZTE92N3hrU09sSFJkVEpOcUs0VEtUNGN0bi9NMWlmb1N0T0pKSlZKK01WMmJX
-DrMPvRPaN2tYm4Qdn4jTlLeCzZzky+nWIISYHsufqdrjwlDNDL0FJFUVumbhPhFV
+MjRDQnpEZVVjL1YyenRLagpqU2R1Y0JnT202dWNDdG81VXpUbE1hVlM0UmZvR2hT
-LOfy/HM7MD/vPAaUpFh6S/vHSD96LOAVMYGdOwJwCxbxQIT7HIB1FJSaR+utKSbg
+Ukt2d20yQ1hJWlVQWXpXK2llMXZYWURUaUR1OU1xNGN5CkM5R2F4TDhPRzdSemd3
-wCHZWjC1ffcXsXBB8CNIHrZ6tso/N2Mg4QsySN52WoFdHk/wf9yncHc37Kj5cEEd
+U0VQcll6V1B0a2FXZVlVbjNOK3dhbE5ieEhKaGhDTTFic0VGdGsxeXErYjYxMUZD
-CUfg3N7T3n4cntRzGvZ9w1j+KfRmD/cf3hn15Y8UzogD7iXxT/xgQMuCX9pW3/G9
+R1oKZm01MllwQlA2Wm00MGJFTDYzSFpOb0ZSaWVDcVh0YURSRFVwQ0I3MEZuSS9L
-e/q5rd4xHt7DLV4E4DuDQpUcIfYPl6Y4LkSmdXC+t6DiGksuZhaldUpUhJGS6FM4
+TW1nUDFEVmNZMUU4THoyazBLYgo1bXlIY3VzUlA4UEpsbnhuSE9sNWtuZmk0MlB4
-e6LPl09u0+XuGg0nuZYPelhtcBsGeJJREd7oU9obGc3YjaG7YrmJSA6bh7sJ8s7s
+dDRJUWxqNWlZTHl1U3loOW52RGYyaTlzNHRPblRFMkhpeVgxClR3cVJhRFNhMjVW
-
+NFdQcDRmNlFmejZLYXRvUWx1allhNnI4L2VRVDNLSTU4MFlWclg5cFd2TFkwY1hz
--- C+htpX6TzGXiYseZn9iTBy2or3mH7qX7AJiigQH3Lto
+b1NGYlIKVXozS1hEQlZuMzZJd0JkSDZFdURpa0lxS0c1RGJuTzR6SlBBcDd5S0dl
-$5€1g8ž²p‚¨j9Jt$c‹ÕXyÒøES‡ôÅü<C385>“	lQ0o„·,›UPa«²ã)]Ë’ ‰¡‚ã”<$½ó^%%iÚ|8&ðŒ;¾
+ajNIQXF3dUJkZUtBbU1lSkpHVTF5MgozYlhlK0V2bGpweEUvU20yWHdMejdyd3FN
 NEt3ZVNwM3pLbkpqbTNNbjdaaFAxcTJGQ0I0NVVmR0pBYzdxdW91CgotPiBzc2gt
 ZWQyNTUxOSBDU015aGcgMGhMSTBuci9GVTUrOWVRZTZDREU4U3JDcmlDZzlkWklm
 TnlPMGFOc0dqbwpmL2pwYUhWSVZHK0ZhMy93amJIeWovdkFKNjk2UUNucjYwTHc1
 RjJrMHc4Ci0+IH1LLWdyZWFzZSBUMyBnPGJ0a2EgLz1qMFsgay8KUFZaNkRhbDFZ
 V0NrOHY1VDZIUWwxTmozZHlRZkJCRktySlZKbllYSVhablhRTlF5cC8zY3VRVU5o
 eDRET0V3cgpQMlE4MmprVkVlRWUKLS0tIEdPbnJWZElBSkx3R0JCcW1YNnVqUXhn
 UUdTcDJ1UjNZWmt1QzhTUkhXTHcK0Lq5VAIe+/28uSWpeUK/vupdV9XUGCJc4iDA
 1fbi1NfgUoTAVPEhygN8IC2uM2Q02MjHQckKGeeOylizn2ofGS4M/W5F2oDEL40l
 pVBh
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/paperless-key.age
+++ b/secrets/paperless-key.age
@@ -1,21 +1,31 @@
-age-encryption.org/v1
+-----BEGIN AGE ENCRYPTED FILE-----
-> ssh-ed25519 4NLKrw +gTzzublNrJqte2A+JoeQ7pm8AbvHHFpEkvKDgKnrQE
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyArRkZv
-TXRy2FHd4f6/QHgrayNBLYnL7R7fRi8oQCg/1SovnDQ
+L1E5bmRYejBzWGZ4bVo2ajMzTmxRU0lld1NHdVlHdkwwV2tYMFh3CnNxbGtuM3Bt
-> ssh-ed25519 5kwcsA zlGTm4IOhoSWSU0GjRq6deElKp+Oa7blT7lD5zTW8gI
+YWJaMXJPaEJTK0RleWhCWXVnUFR2R0VwekRkem1Ea3BDT3MKLT4gc3NoLWVkMjU1
-wexSSiMFP4wgBW4OdUXX6w/0hSM5bnw0SFseB2iicP8
+MTkgNWt3Y3NBIHU0Y3NmK1c5T05Ud1pwdkhHcFJZblkxRzRCWk9PTDNZVEkxb0JW
-> ssh-ed25519 9d4YIQ tHtlFaaNFLOhwftQycfkLvGeuMb6+Vf9avd89H/Y/TI
+Ukx4U2MKcjc0YmhXVTVSUDc2TXNzbDJNZE9BZlRCOVZZTEw1N25tWWkwWm1FbDNY
-F0Odk63tfaDU46W4GSkfthB2mhGUnvGxkM9uH6MxveE
+awotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgQWZudkZCZ21mTnNRelZPaHhhSTE0ZDZ2
-> ssh-ed25519 3Bcr1w pN9xpC1+bkMgKfLwWq+mS/Nfns6OvLmMJ8Gp83yZ7wA
+NzFvV1JSaTVvZEt6ODZkbCt5UQpQQlhWODExYnpYNUs4KzBKNmZEek53ZG1Qb3dJ
-poHvRg2RAlzTcgXruUz4bRCna3/Csruk7we78WFr6ps
+elpkY3B5bDJGRTBTU0JRCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyBiS1IwNVA4dy9T
-> ssh-rsa DQlE7w
+YVYrZkU1eXU4NWVNWTMrTUNRd3Z6aExBenZOUmZUM1J3Cjd3YkpYbTlHOC91ek5N
-T/3AVPmmUZWnsSMBo09oYfBjNfN4C077mFUeHQP2TJOUFIPFxakWoQs8ge6wM35q
+bmJ4UmljUGQrTm1DZCswbkpKbUZYcFBwY0x0aFkKLT4gc3NoLXJzYSBEUWxFN3cK
-zj+iPFYw/QhRWYn525dcc3szBMQBk7dpcQ0ioX71L6aLR50jTVDu+kdRzgIvIrnh
+Qy94WVJmbzd1TWNVc1RDUDhmS2YvNTBsMHpnckM3dHpiVG5pUDBCVXRvNVZVekY5
-YvR0u0H1JwNm1j6w6yRumG76hXyWmqBHRBY6pUwgObXX891rsLZm66cpM6rCkWKu
+UWZScmd3WVE0WE9vaGlFNApMZjMwcTU3WG9aRVdFRTM1aXR3STFOMXpjNXRJM1R6
-lOAfrtfQeLxco+8LIbjyszUZPAOQDyf+agD2TLEncpvZuMM31XX+wc8fWFs8hEI1
+ekdmRHhMZE94TWZRV29ISkhYdTVObmN1ckx6NnRMRW0yClpGS1BvZDJUY3NTbTBv
-jnaIJ/xku1dMVazks1v2p5ydrddqyHj2xXunB3Vp0se17qm0oupOGLJfYg2cm0h0
+N0srT01aWmtFanhpR2pQV1I1ankxbXBCV1RMenhuTGFYNXVKWjhodkEwbUpYdzhC
-Lr1MnGMG/rPyzejFKq5aBX/eiK3Vbk+eez6StR6jBDPYvfU1nxuX+X6uxU6PKFrM
+SmsKRTV2K3k0ZmI3akZNL0o1TE9OQ1pRUnAwajFyeEpBb2RRVE9Genl1b1lRZGlL
-/XF8Fdjq9vRGr15GGWDvsWGqR/tpdH8IzQTuoh3A2tkQPqjpDGztWzlWWoX2fQEt
+bEFYQ1RXVFAvbVBHMkdBSStCWApIejU0RGYrMzFkZENtQ0ptV0E2Mkt4NVhPSDAz
-aWGdZvXOuW0ZngeoGnqTkCzWZ1Wi6PIzZEWBhxYaHKtcM84yP4o1P1hcybpKU7wK
+YkwwaDFicGVrYmx4VnZleG1HT0kxM3RXYXVxUXdUcVNzQWlHCk9VQklPNkpvVHJL
-
+K2YzYUhOT2MzOWN6ZWJnenV4bTZoc2tLTmJRNkVKSTNJQ2x0YXA4RW9URmw2MWdK
--- oYnNUuCYBsE2dkKN9H5VR+lrnnwP2sM/7oia0ss95N0
+Q3BKeDYKRXV2VGxsWXRjdWFtUDhpN2NWaUdwbDlJQVJSSHB5dkFFYm5kMHgvU2Jt
-<EFBFBD>‚ON-‘¹OÄO‘ïyOë¨ªìÏ»bÒ;6P‹‡XKÛ—þ¨ùuS/œÛ©Ý,—ƒùX<C3B9>w+_+ù*É¾ýâXçx¸&Ã<>åe}å(»ò
+bjZVT2dObGRaZ1FHMFpHTGRLajRVTwpBNjlRSzJEbHk5cHF2emQzYVN0Y3RPamht
 U2I4a2hJNnZIeExSZWxvdDZQRUoyNTBReVhuZnM4aWU1RVdUQ1hZCgotPiBzc2gt
 ZWQyNTUxOSBDU015aGcgR1dlTTUxb2lnNHNFQ1JmckxFV1BXK2x0cHlYMDU5K1g3
 ZU9xekRHT3NEZwpEYUxyUCtYUEpibkZyMWthZlJXc2NidnJ0RWEyc0swU0NYb2VC
 WGFpQ0dZCi0+IFsmeXQlcHwtZ3JlYXNlIFh9IGsoKC1gU00gfT41NSA2CjIyMGhC
 eW9LekVNYzRBeDA4RWhTczBjOUhPNytZQ2dyWjFFZmE0WUNUL3ZFVVBxTFJBRkFw
 S1l5TXNKVlBNY2sKN0pvZTlnCi0tLSBJdDg1WVh5S1NvTndrRUNpcFllOThYdXpi
 bmVwRnNkMDVXOE9ZK1lJOWJzChJnwfn1uyUG8MarT+es+9QV/16Aba3zUdGvCgaa
 Bg8uQ/mhXtTQi0E+rfIcXWO2xzaUKBpwTqPH/7jd++RqtBAjHt106tWHkMBHBkn5
 y7WkztM=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/ref-key.age
+++ b/secrets/ref-key.age
@@ -1,21 +1,31 @@
-age-encryption.org/v1
+-----BEGIN AGE ENCRYPTED FILE-----
-> ssh-ed25519 4NLKrw ARySQU5NWBIxM1sICZMk/SU+kPMrvd3M9zs65v42hVo
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyBma3hi
-3/SeIH0CpIicYOjG3Swrpt/4Nplo4parVWt3qIoW7SI
+b0hZUVROY2F4ZnAvSGM1bGZmUThBT2hoVVRqUWdTOVNjQ0hWUmdRCmdXS3ZvRzNj
-> ssh-ed25519 5kwcsA M4GABkszkaU5TmeemgEp/iJ4myYL3fmZFrNP5wYq1iM
+bmdkbnFNWFQyRXF4SXR6MlNuaWo3T3dvRGdJZkhBMFhLMDAKLT4gc3NoLWVkMjU1
-rOyGrD1hAMzQVBJeDTDXZPyaIyoEvDisGe7Te491Wv4
+MTkgNWt3Y3NBIDBXTVVyL3VzRW9YbzVuUXFqUzJxMEFvS3lZSFQ1c004ak9jRTYz
-> ssh-ed25519 9d4YIQ eyJigzNeLlC1YxambeZYE2bMzUUgMqJHtpPxlZheERg
+ZEkvaWsKMFVrL200bVJaU1dBOGU2NmxHMkpJUzhxTVViR1ZVU1RpUVFEcThCaito
-mZsYy9QTl6EnF//u2Agt/9cKxxMZw7nJDfJV/n+dVaA
+awotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgUGI0VUI1dnZ3MHdIV2M0dUw2QTNmcVZE
-> ssh-ed25519 3Bcr1w oEZnh+FPv7EqyKLcX5rmvTGRIZlSj1ycaFg/cTCIqiM
+U1BqaW5iOTBjSXdzVXFqa1AzMAp2U2VadUptS1hCVnhkclVJNEUxb3JnNXpqWEdr
-AlOvpd+MAAe43hLfcROQ+QIkUOPmjc1SPu3NPIEhlyc
+OHUwcVFoOHEwT0swSmhVCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyBzWW9SSDJVeGtD
-> ssh-rsa DQlE7w
+aDE5U2lFbE1sanRhcnRQdGllZXkyTGtraHZ6YndpZndZCmZvNzJyRVhSaVZZNWFP
-WgdDjMGNKWgxa2QxYh33HO8JrkNeYtTqMs5Ninb0+FzJYTD+zCYWUlFEPcytp8Dl
+NHBiMG1XNUd4QnloSzhIZXhkMDYrUk4weXlOSmMKLT4gc3NoLXJzYSBEUWxFN3cK
-gzGH5dwTG1Tvjig5a7IWcw8sO7AAklpU95oauq3Pi1rBq8IBBpmAjvCWb8Is9UsQ
+REJXbHhZVlBFbnNjd3lJaTRHVFRLVVZRTHRzT2Y1cE4vVDZ0NysrUHdwNHZuWXJX
-cazsOmFHYQfmCWfd1TugIOju4ovJMmUxx6acAN6McD723Q7Ns+WVmLGS/ot2LsKE
+cjFpK3I4bzlSdU1KaVkwZgowSlRvVFE3M1dZVW1xZXFpWlJIZlFkTXhicEpxTFNx
-WMXTVarDk++NhIHlwmHbVk7Nej8OwFt2xTJM3ihENtCLb46wDcBfEO4GaYHxY2dn
+NUlEa1hmRHVLeUJncVpwTElyMFZwOWkwUmNsbWRySWRnCjlUSE1USFRCR2h4cG9l
-AjuGFTgv5U8ZjdSuktw0gMV0Eldgwk04NfX1+Ey0dDSJ2/f4i4O1AqQZ3ylhBrhv
+eFFiKy9MNGZWWS9lNzhPRjcwMTA1SUFDamlZUWNnZlpUMDRCQmUwN3dtTUIxeUh1
-aVS/XQxmJphSlSux5puquGtJIyI+vTUWPlQ0zIAGuKCmXQ9K5FKxdOmsl73/fBqj
+NmgKbGVONWFNNktPNHA2MmhpODhoU1pxRzVqU2IrTDhxV3hnQ1BaekxTZ1gzcXcy
-rpWUX6YQ9993fUpVvnCRjOThG6x8L90J5MfksgJKNP6QPDc7r2aV8p5vzY0ssE2B
+Y2tmS3VDc0xuSmJKbUt5SWpDdwoxMjZRalRDdXRnenBCajlIV0x2SUJKcXgvYjZo
-JYvhRYGp0esP/DyMSczExQRpAfhNwS6ONhDjcmTRJAeaxuyteTOyypGG5morzQq9
+NktGUUVJZ2N0dXBNaDBHOFdrekcvRk55eGJjSG9wZ2RvRTVECkdmbmplZWlBYXZs
-
+MEdXU0ZnVGNrczg3eldIaHNVV3NDYndKV3BxWllHR1hnZENNTy9tTXZsSi9La1FO
--- 3dwuxoM7PjwyPI6fn5lRwxonntFxBNCREh0LipP7IRI
+YXp5aHEKZ3BzejNJSkZtSXk0Tm1aZGdSQ3FTemNJMEVuRFBsNjdVTTkzKzRrQ2Nq
-V‚‡lÝžŽçU[`Û´Hxn~¹:šŠzi\Ñ¥ƒWm«Åc_ÞÓfÍå->
+TE5mS2NiYVRRUXg3ZzEySE9iZzk2UgplOWhYc0QyeXlvTkFVV1lZd1kxU1RrQXB2
 czJpT0E5VDBQWmpwdytCUTRidU53UmJ3OG83T2ZJdlk1V0I0ZDlpCgotPiBzc2gt
 ZWQyNTUxOSBDU015aGcgZE9vOEJXNVFVcUhpZTNHR3MyeUtTZVZzV2tBZ2VrWXhS
 THFSWE44Qjl5YwpEeVdWNkJhVThkeDdtZitqbnJlZ1BHY2VqYy8rWFdKVlhUakhl
 Y25saVprCi0+IG1sdy1ncmVhc2UgWFlBYkY9IEMhIGQxPXdrJwpvZndKMVFRZUdl
 Vks2UHlKVSsxRWNucVptbG5CWjVFYlhXL0VSUXU3c0ZXdnUwRmcrWE9SR2xiRTUz
 RHEwc0ZzCmFNK1JicUlnVjl1QzdoVmhQbmt1cEY2RjJ1UHpqVXBVL1grWEkwMUhm
 NTFBT1dZelFFdUl1WTkyemZVCi0tLSBteHozY2tGaGZyV055TDlIZGdlcjByeUt0
 QzhDVnZDbjE3a3VFNWx6K2dZCmfJoDWk7T4XzmXiJGzJ3ZkDCprW1zAxnXRjeOPP
 dgFyBuvVkHJE9j+CD6wGkaiF9ExXLjmBSQ/J9A==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/restreamer-env.age
+++ b/secrets/restreamer-env.age
@@ -1,21 +1,28 @@
-age-encryption.org/v1
+-----BEGIN AGE ENCRYPTED FILE-----
-> ssh-ed25519 4NLKrw ujol4VLzOhJQkOLACge18IshC59mKHSYtkrl2sEGc3U
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyBIRkFx
-G7Dje5m+l2LVvLXsP2dxI3zlg0ik8781/mQHM3FVPYU
+b3ZsODk4MlZzRUc0Uk1EdkxtNURQSytOa2hKRzIvZWt5c0ZsUVRNCkVhL1FpSUsr
-> ssh-ed25519 5kwcsA cCSwI5ONGu9JlzfPEdd+fr3fdtRZMVUucEQ9FGIK8EA
+M3NaUks1TFVWMjJKVHR3NGtlNU1YWG53QTNTQ0FLNWlHZUEKLT4gc3NoLWVkMjU1
-+iLecJaAv7uJ3hgwkQqLh4S9u18r2oy8ZAwiajVRYhE
+MTkgNWt3Y3NBIFlBajFYdlJyNkMrTFRGNkZLaTRJNW04WmduS3lUb0YvaDRpQmRq
-> ssh-ed25519 9d4YIQ kHP8FhCx52peMGRQ8A0qmTEf1X3sGzraqR+sYaqJmnc
+R3BRVE0KTWgrd2c0MXUxRmZSbERxREkxc21UNjFZRnNZdkdIRXNOQnBwVDNNNjZZ
-YQ1mGHRD4viHfIyIDBuvGQHsyi3M9z12RNWvQD3ibuo
+NAotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgUjVodzBabXloTkZITTZuU2dOYmJrZlBP
-> ssh-ed25519 3Bcr1w bB1R7kZRTmlsj6oMAuTTcVHwUgY5QqydLpzYGXUe7BY
+NHRIV1dxUUJiT0t5aERnWEFnawpHWDNHSlRyTzd0eGVrNFNldXZtbmZiRVJzY3ZK
-ARhxY2AUp5DYgsq31gYwiDNj+bA4s03ctBxl6ipONHQ
+c2drK1NpTmsza1FWR1kwCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyB2ZmpZcVJKR0tv
-> ssh-rsa DQlE7w
+elN0cW5lbDRvOElKSDc4ZlVtaW1DditlcHIrSzFab3c0ClB5REpzOWh5QWF0aWV1
-oVCEFSMqyvoWY0SkJZOENUDgmvNsaCdfna6QYGvQQTh/XC563ODIj0WiED6AAQqw
+Q1E4OVhtMytaN0JUaUNESmYvc3NNbzdpTTJ3T0EKLT4gc3NoLXJzYSBEUWxFN3cK
-N/FxPdGdbsew3BCOB0pyvsOmv9ql8/cpiSAM8J6SMw78/9e+ri3F6PVKbTEY9aXP
+WmZOSndtbUJjZlRyQzRmMVpxZVRLcEtnbUJZczZLK0RydURxMkhhR243ZkYxcG43
-Ds8uttbjozy5kWJcZf5dGfB5BXW2v/6WRo9PUOUUapJgJqKXD5hjthcOurXoj2B6
+d1UzVGJ6QjQwem5WeFhUSgpYZ1NvMi9UQWxsUit1NFpaRzJxQldFd2lVM1FnVHFJ
-qQXAWr+hYwy8saQWItD6hOGNKbYzqkAXOBkwSRvdmXpc9e75yUw7KPHHng8QrrYj
+UDEwaVFXc1AvbFdxd0ROWmsyZzBBS3QzV1pnYjJiOFBOCkVIM0NjRmxuTHQrR0Uv
-/gM28qBo6cyT8cEsV/6XRo4LxzqCGiCqup+YpY80Jxk46hh7O1rMXW/IjeHww27f
+YjJCcXJMSm8xUnQrUTlON25DY25nTTR5akhwZGhsTkFSQnpmYnFYeU9hclZMYjVk
-CzwIdi37IE9QCviuuGjqn7kbKkg9jhcPKbktfNF+9urUDnCvoYT8umH8bfRa/wSB
+dEkKTHovUXNpUnFoK3ZkcC9YVkx2aDdXL1N6SkNPeS9pNDNsWCtrQWhraE8yOURl
-VVqIzpjYjA0NrIqRfon1dK/LsTgKSeExOsb8wQDS4rpvX/Yqm0lBfmYJ7DaBmwpj
+WndZODM0Z1BnS3NST0duOWtGWAorMmhvdEZGZkhmWm83d3hpUExtSndvYUlySmF0
-XTpOyn1wGu4/cgFz9BO6WEhrxXum/67UXGwxisV3pmGXLIHqshMkgYjGl6gvUe0C
+MEZYcVVhTlR2c0ZibnVqdWhpSWNPWEFFQllkeC9RZVJxUmJsCkJqYm5mVVhxYXpY
-
+TnlTeFljeCs0MDZrNUJtRjh3cEJuU3BGS3VyMFNqRkVkSjNiVFZQbTFnUnZmVVFN
--- QM3r5pYRyC4nnhf/dO/zFwzwye1pgLNOKOPAowdYQBM
+UEdKd2kKaGlTNlhlNmhnNnp1WEVnb1VISktiaVBBNGI4SFBVWjFQdEppWSsyRk1F
-f泇髎鰉螤毲裰饆+鰲?渚<>}5蔟@
+SXFGTnhha1pWQUtzUjlqRDhWZzhmUApsbFdqc01aV1N2RG1mdGF2cEd4NWhyMSti
 ODM3UEtmMjVnaXIydnlYRndDRGh6Rmg1RVMzNlZpYUxXUjQ0REdiCgotPiBzc2gt
 ZWQyNTUxOSBDU015aGcgaXppSmVaeU9PZnRKSjYxSG94RWtSUHhKWUlhZUw4eGNq
 TmdMRnlqb3QwQQphZWhFNUZacnJoWkFnbk1FZ01wMmpRRnlHQW5uQWs5K0dkckx2
 V1p0eDhnCi0+IGxnNTstZ3JlYXNlIFIualwkcyA3fXVFIG45Oi0mdG51ICQyT1UK
 Z05LUFZBdUZNdwotLS0gR1dzT0tMdk5JdVNrTGE3SnFiU0ZPSTZmV3U2Q0QzSXZl
 K09FTzVsVFRCcwpmNiPpr1N4Cx697kp5LSOqv9a0vNcOj88MmyXopEc04A==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/searx.age
+++ b/secrets/searx.age
@@ -1,23 +1,31 @@
-age-encryption.org/v1
+-----BEGIN AGE ENCRYPTED FILE-----
-> ssh-ed25519 4NLKrw StoVt28gDfCQw796MXA4wToPMT/JZG3lNNav7tkaykQ
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyBLbGNo
-kI7i+623lEOlLTAf9HvbkeuS/h5sI9iKoivVbrt2R2M
+MFk5cXdzNUYrQlRQNUJEMDFRNlM2dUgzNU1KZG0xaTdTcUh3d1NjCmVPQi9zTFQ1
-> ssh-ed25519 5kwcsA DGWAqEOUf8x3L5oIvaARXNXugcPrFCg27kPZFOyGI3s
+QXR0MzhFTUQxOGtlS2swdjNHeXNpWE5FaGt0NGRYRWRvNjgKLT4gc3NoLWVkMjU1
-mL7w3d67LiAvYWid86obfhQykFTwy7tFEz2GdaQllSw
+MTkgNWt3Y3NBIDdUcFlCanMxS0RkMmdVLzZNdWdvZEZJamhxZGd0TXZQRGdQU2hZ
-> ssh-ed25519 9d4YIQ BjLOvH4m5UahL7hANEnuYUFraMZoDYM4Ohpt6GC48HQ
+VHlaZ00KL1o2ODJXMzFBb1ViQ0ZiQ05BTkh5a2xhbUdXcWpZQ3Awd1haRlc0QTVP
-ypVz4aARz49+5jmC/sWt8mS9HP2VFly1aFcU+VD8bkg
+cwotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgaWFIV3ZiakUyZDhBVU5ma0owK1FIQzF4
-> ssh-ed25519 3Bcr1w +tB7V+TobxlWMWqMbSbR4p4MSLwidUNaSqVZJa5JK1o
+QTR4ZUxGaHJML1JJMFJsdFh3dwpLZWN4d1dUU2kxcE1sRnVuZWc1Q0UvdWpsem03
-7yZNvLRE6H2qmHsbB3C81oaW3U+ub1QXNHIkbo7K9mU
+RVVtTGRPM0xzYzFRRERZCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyB0bWR3UEo5WjAw
-> ssh-rsa DQlE7w
+dkw0N2dDRnhRcTk4eW01RnN0cFppR3hhVWhoNGFIZlNvCnVyS3JsdVkwOTF5dUxy
-eDfNLuOLxrhfm6t7RqjbDwL+DUSZiEiBg5LtIhKw0LiGotFjj0jXa7SeahNNipjL
+TmxXSFZLTWhqL1BZSnhJWmVzaUw0NENYb0xkVXMKLT4gc3NoLXJzYSBEUWxFN3cK
-bneSIf91mTBtiDxmsSdV+93BBTtuOVEUmBr/2A6SuZ4ttXKRD4wN2fiFTTwjcNw8
+YUVKZEoraHFNY1lQNWh3NXlEYTJJRC9TLzZQZ3pFNHM2MVd5NE5Vd0ZmdGo5d0E1
-xlkK8uyw4jVPupsE0cS/wWr+yyPXHenMB+1QxJLeEF8o8iHhlkA/YUkDWHVfq9Pb
+K3R2THk1blpwOGpydmxhTwpCY3pIUkRNclI0Y0Rxa2ptMStlNFhuWmRvOUludXJR
-ekGOaeVDbiuzE1iSGIhQ9d2t+LkoE5UCkLEAYoXD0d5vV2ayK0gitHLvxQvJC1Bw
+SUx5c3JjWmp6MkM0L1UxT0g2aGRxVmNYS2ZSb1h6L1hIClcrQnVLTmgya0xOR0Q3
-Q4qGioTm9XIf8O15lrw1CY5DL1qcwvEGO8AQrByoQ58szm3EcyxJKL3YxsICDujd
+b01DZjkxRXJJMnFISE40ZkZwWnNPSjZ4WDFubUlSMEJGUFBVbEthWjBvUnB6WFJo
-+VPUdIUgCbw7P24wjzFohTfdWO2NcCRiQnCyoALJyzSCdLXHwKL605eX3TiEgJL4
+V0wKc1h0YXpiYXhLN0NaMjFnVFN1THM2dDBvKzV0RndINWZ2bFhSQ1A1bTRmTjM4
-igJxbEfPH5heXGOUfOq7RX9PfHGsMdQLZlqS29/h+NAWHqF50JIy9zzUopzTrAh7
+RHhnZGJwZzlJYlUvUDc3N1h5YQpicnRUaWpLMDJEdUxETngreHZ0dmNhNi9sanNt
-e6uCU1v+IBjyWmfapK1UCJ5dWBZTVEZr8mNYpaljRzw6TqxS0GRLPybOCawC6dey
+RnBaRWxPRmNrT24rcTQ0T2dSUmtDKzViMGs5cSthMWJqK2xZCkFvemFNMDkrSkZK
-
+YnNxNlgwWXlzZFU2UjdjaHhYSVFycVR2dm8xV1hyUjdZWlI5eHFZK1lGd01rdmZ5
--- sxcuCTgVI8Sxdz9AgyUDPHSss9ExX2HY487yt2j+EQc
+VUdlbGkKZXRLZFArbUtBNnVPWFdVaHZsUTJFT2hGWnB0MkpFVG45cEtnaWJhb1Ns
-=D¥ZBðvä9	ñöh–o²jÒfH}r%J=Þ
+WUJ3ZmhHZTFUYURlZWRqZHpZT0VySgp4cVFyS1RKOElMazg4aTlWZHBYV1BiUVRv
-í6ªÕÆ¾àþH»Á±¢§¸I3Šÿ’]áót§vLì´©Omëûdõ(±ü.ç½ä*RÙÀÚ\wî¤5Ïýa¢ :Mü+œ
+d0VmQWovYU80ZllsTFh4NTVNUVVOU3pnRTYxK2tFTXJWUEpYQVE5CgotPiBzc2gt
-v[|Ð§‘It}ì
+ZWQyNTUxOSBDU015aGcgbGl5RGIrSWpKeWVmQ2k2MWZWRWQ1dHpmSXN3VGd5eUxZ
 aFJ3bXUrMUltSQpiSHBHRWR6aTFLMFY3V3lhZWwva3RFTXhucmpoejlYZHNoMzRa
 RTIzZ0RvCi0+IFh7VHAtZ3JlYXNlIDkqWFIgV1NAQjpCaSBgQn5uOy5vKQpTbENu
 cUxVS0hJS2t3RWJORzB4cmhUdzZESGk0elE0V3dpemRFVEJVaTlsK2wrTFhMb3cv
 TFEKLS0tIFFhbXFsQ3RFK2pHY1ZUK3owVjVxM3dJQ0ZmcTE1SkhOVUVxV2YxOWoz
 dTQKeNKR2CTcJF9YlJGxdA/Jd94blNFanWBCKv4B19pueO9dj+WTamwUE204Xxpw
 eLOIK2j58jcXX+QW7niNtSUNk39FLsWhyw5LxpB50zEIozoAq6QwpN1sofJlhD3q
 aZ7KADz898/l43s4rnGZgyFUzQHX
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/tailscale-key.age
+++ b/secrets/tailscale-key.age
--- a/secrets/traefik.age
+++ b/secrets/traefik.age
@@ -1,21 +1,31 @@
-age-encryption.org/v1
+-----BEGIN AGE ENCRYPTED FILE-----
-> ssh-ed25519 4NLKrw 4W1twcJwqyd1r5JGdkeEM7fVuIMkdcKLpDQ9IcXoGVY
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyBIaStX
-Ah6Dd31bzeFJ/KrcucHlk6PYH038SZVVqfB3vitt4t0
+b2F2VVdLd3FJMUNxSHpIVjAyM1RHMTl0by9DU0tJTFdKc3JGNXhjCjFVK1dhcTdw
-> ssh-ed25519 5kwcsA +/R4MlAGV6UzNvandAJLDTevMJtK4WaduRAVmrM4n1s
+eXVhR2hjMHZuTE5PQ25xNDdjd2tGMnZ0QjIwVnM0NHhnZFEKLT4gc3NoLWVkMjU1
-UGAjYzO/gjKYhjiVwgVt2T3wvHoPAcyMLuPu89Q+0cE
+MTkgNWt3Y3NBIGVGaWVwdEx6bFFVb0JIQnZDRFJaWUdoNTE0L1Q2MUdFL3hGL3Vt
-> ssh-ed25519 9d4YIQ P2A8L74BB0Zio6gEPCAcmaZPXHAP/wAPiLwmvzQuGzg
+YmhzVG8KclZwZ2ZadDJnWGFSWXBWbXVTc3hLeUJBMnlUR1dpZ3pHYWJWT0ZOY2Ex
-XC/+dfw7uNP4jsO/bwMf3y8BfirnjligyqdVDvrLwkI
+TQotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgbHZKc2JFSkNzQU5IVHoycEZ5R2Z0Ympr
-> ssh-ed25519 3Bcr1w 0Pqs9nidGLBeACXrsbu2KGzNlKVaZ1R2GdDKLiP6DRY
+YUg5V1RjSUdKeUYrckc3QWd6TQpxcTY1QXkrcVlDb2tlU3ZlRy9VcU01UmRLQjVQ
-lU6dfn15jJxlgfmR0wCYyhL5fzaB3jSvLMiGhB+ht20
+WGN0Z2dTSEJSSTYzay9zCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyBpRXd0aXJvVlNU
-> ssh-rsa DQlE7w
+NGVab2Nqc3Y1akgxTWREaFY1Mjc2VnVFdDB1TGxKaUE4CkR2cjIwaHRTMUFVaGh4
-fIfiUhZpT7bHQssxFLc76YgeVX8Aph2xluyF5Eb3wdoks3r3H2gD4WBKvceBxZ8R
+K0xBU3lmaTBnbS9YY1dCL2FsYnZReHdaSUhIQ0kKLT4gc3NoLXJzYSBEUWxFN3cK
-xIIQ7PKnNRyPmIAHTuOQvDozTxAqMRzLOpDIhCY5//FT9Lb4h3J6I7EiJsK+1/pB
+cDNLaVpudi9rakVIZXlPSWRJUW5FSE1oK05Bay9mMGVNRmJaNUJkTFpPSnZVS3hn
-AbtRXJrTSLr+qIKDx8YW75YPgmcluzV8h82OcyyzTd42TNsoaacC4ihEJ0XMec/p
+QkF3djZzeExMVzZ0a2FDUQp2U29iSm0vcHZUOWtNMHlZSHByYzdEdElmWUx4SVJ0
-+zJGZk2h3TC6dn8SjPdFn4kTNuwt23wkFV9vIxHHU5/Duod6SyoyKS0Bd5a69FRI
+VjJmdjhnVmVYSlZRNmpIUmJZN1lUa3JaSVlXVUF5QTJSClBEeW5FemVXZkxvZFN4
-VjeWu3EyN4gq+X+jw8E8NZm0TXcYv5hACC0LPxNECwhf55KyttV+0IWxNoT2Qoys
+T1ZWT0U2U3lVYU02V0M0dERvQWdCSWxGVTRBTi9PTE5WTFE5bVBYVzN2L0YxcjNE
-aIZAFBkXLQ/stUoKYfA1kw626nynUIqAeJTb8Y3SkkF4CxOl9CZ/uqoMByys5KOv
+bi8KWk5wenB0aGlqMkprcm1mR1RWdGNXZUxMTkVyUmNTWE56Q2laRno4d245STEw
-pbi/tRGp6IuNbUJPed+C2+65I+jZGEt4BuDTd0/vpQvhf25nhZSxwXcEHX5TNIMT
+STlEZkFtSXJwckxSWk1abkJYRQpDSWEzcnByMXdGOStOMXNJU1gvV25xWnFNVGRy
-3Ky94rExZgj6GRyuWk7myEQKvL47naEElBLu5X4goWaWxQIJZThEGsOQjVHoeDhb
+M3p5dlNUSUlxU0l5KzVMUy9URmFSTTVXbkx4UmxzTWlIMEx3ClBTb0RWNm54KzdD
-
+eGxoV2k2MGZaMDhSRC9aQWY1YnlobEdCOVFDdFQ0UW4rcWdhMDd5UFVzdGVVSFE4
--- bpQsB8ArJ7UeY/50Yh6Cxr8dBE3cKE1lj9/WvG7M0Rw
+WnRKNmkKdldjTmF3WSt1RmJGUkI2QUpDQlo5NHZCRGU2WW9tSEhCcUJycWNnVW5s
-˜î–ÏÌN;ùöÅÑYí·”˜‹È§ƒä³â‘”¦cˆ…šnî~vý(«3Å`è®ÿŠî=ày~æ're†ï&N™u<17>kÒ#…sq<73>Æ…ÕOQâ}cl£Ø:?gZ=|VçT0iŽÞ`™B'o
+Z2duUDhvNDdKbldrZEZIcnB0djFOWQphb09XTlo2bWk0VzJPR3NLVDA1ajlCVmhQ
 cnk1UUF1SGtYdzdVNVpHYzFaWlRGSmZ5OWlNQmpBbHhuTXg4TDNyCgotPiBzc2gt
 ZWQyNTUxOSBDU015aGcgNkFhWHNXcWd5WU42cUFOK2M1b3R1MklUczZJdDEwVXRq
 Wm05T1ExYU9pMApobGJwejhINGpJU3RLdlZFcHV0QmhjcFdHcTdRR2UwZ3JzMVEx
 a29YemwwCi0+IGN6b31dRC1ncmVhc2UgLW5KUCBcO255NXIgNX5XMiAxYlx5Jmw8
 SwpFV0VMaCtMT2lhZSsrbmNGCi0tLSBpMjBJMjhXZ2FuSFA0ZjNuMEtJb2N3ZFhI
 NGhVcHNVRGUwZ3ZzTG4rckRvCvr9n7y6/sKH/aRKNaOOzfqMydnHoeWxPyciMChN
 zUgoLZn179w0K1ogUbGR28lz+hCSQELvyWkiO4+OgR9OaSO0MJZ3wIGdqcS3mUPj
 ufZbixxgiiTjMBn8e6sFm53dXcXqqnTDm6+1BNixsPmxMwzRV6nM7uXCh31TWLzG
 TiY=
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/vaultwarden-env.age
+++ b/secrets/vaultwarden-env.age
--- a/secrets/wg-BR.age
+++ b/secrets/wg-BR.age
@@ -1,23 +1,37 @@
-age-encryption.org/v1
+-----BEGIN AGE ENCRYPTED FILE-----
-> ssh-ed25519 4NLKrw CkxFQBZnYhZN0KvtsQePp/wLGPNjArr8tyG3MficOC8
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyB6cTBQ
-wNEF3t38J6yThhhc0d5F1hIsEvLJa4TdH0YtPt93AZc
+Z0tNRHRzc1NHZ3ZrN0hUUWViZDV4U3ZveDdjdjFyZ3FQYXNxdG5FCjRHOHcrdTIy
-> ssh-ed25519 5kwcsA o2PUZZXwJHhgKm0MNEONCUSQGL2uCYD52sw59OqgMR0
+ZUkyeExNZEZFSTB0MUVTZHhMSUEweTJjNkF6YVcrNDRaQzQKLT4gc3NoLWVkMjU1
-wARXC7AVh+cNGlsDEc87JPj9CJmUK87y6/mhOU6y8HQ
+MTkgNWt3Y3NBIHI3RC9oQjc2SXlwUHYrZ1M2YmNvcWdyZTQwaHBFUS9LQ0E3QzRh
-> ssh-ed25519 9d4YIQ lZa0HTqpoOBo88sXEyVsu25bQqsNoP9vIAWFS+9hpW4
+eXhNd0EKVTF4dzE0ZDgrRWVwSUtQU0h1SFVvOG9tM25LRUNLNWJqeUVhdmRaWSs3
-enuKpztdcHMQkJxooj/6pFpPQmsXlNLAMaCAoo/wZBA
+WQotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgLzVtWEpGb2JQcUVCSlJqdDI5UHJkSHhh
-> ssh-ed25519 3Bcr1w pffOBbY4CEdYLCj7DIJWT/2Dr9IZYKJP9nAaMlXqmj8
+MVpWdkJvU0EvRm1tcEdrRyt6dwowSWFmSW9OV2NFSGNCZXlqRTFYRW1BOE9OOWs5
-qexuDvtIfz3cbFnFlmIe2TZ0PYpDUsmu31M1Eccoipw
+MnNOdG5jN2lRMzR2M1VBCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyAyNVN4MWxrSTYz
-> ssh-rsa DQlE7w
+a0VMeU5NRGY4dDBJN0xDeTRqNkRVSDNPS01uNm9LTm5BCjBXQzB1Lys4YzQ5RDVv
-NuDXmJz0pcSJ8dbnZlCSbM6vBMgeKmr6c2S7NiLyn99BGJ9vMh7MJTQqlxqjMKR1
+SXZLNEo2KzcwOHdVeHE1eGtxam9jK05FV0hiSUkKLT4gc3NoLXJzYSBEUWxFN3cK
-JWO1Llw0dwqaZ+LqnTUFVgaRRxsT/cONU2yVfs4gOS73ut0QlTDFYb3HZLa26Bvi
+dHdTNTEwQ0FWMXcxM3NhZW5HcE8yZjFZckFKVUsvclh0aGNDeHJRak9ic2Jic3Fh
-FkMWfYCu5VXTNsuXiUSjnOtey2PUxeUgFgjoJY2iqxOdnua2sIkC7XiP83YskjQl
+amJyZm92VDZucGRjZnhmNQorVGNCWGJDZUVYZERudjVaSmZiM2IxRXR2N0FZY1l4
-uDRzkxxaZY42sDTCigvVcWaC2N83WY7JkuD7lah2ST5vhL2gDHpL50FHt3r3S3tk
+M3ZVNjdCeVNCUlNhVDV5T3NYdzMyRXN3cERSL0dXenYyCjZSKzN6VFBjaFo1c25t
-fR/AVr5Bv2uIZbtwSQM8XF3yTIJ/lGPtCSrrHSkrivr/kXOqJP4R420fVoBtLJCw
+NkhHeEpTQytWdDVjajBRSEF4QWx6TUo5K2QxLzROdmdJaGpQVEFmVnozQkRKVnBP
-2QPVxutV8EUUSIDqHuyU1eU2fHhhalkRWfJApM9geLgZmcWFhtvvyw2a7IdHqEaK
+ckIKbGRqZmJlNFpLTTRpTzRTNkpUZmtRMTlkZFhkSm5UNkVrT3ZSNjRNS2RicDI0
-n3WgsXGxB6NHgihoOy0wCHJvCiQ2W43wDd51op6S6SlpcaMAVsnp6N1HUNHZBZ5P
+c1BiU3dSa0FYcHZsOWtib0RhMQpCeCtRbllkWDZ3UEtFcjVhVkZzbzcxTFU4bWxD
-pAGRYM0bcxZaIPvQ21YTtMTBvEMyCsiBvUeBZjCfG8JeiQ/GPBDIfTbkeCFQngcD
+RXM2bXdIQnVwbVU5V0p2UGROZVdJMGNpTHJSWTAxUlhYQ3B2Cms4d29ranBaR2Jv
-
+eGV5MEJsVEo1VDRGSFI4U1k0SFhNMEtKdHM0UWsvZEdYZmJWOFBKdC9ZRjRLR1dr
--- 3LqWn99/9jDZ0l2rzB/TbIOHwnn968Znoyjq6C3cKNU
+SjY1Mk4KQ29mak9RWlFJaG5WQUV6ZURzWExiU0prSUp0QUlUUXRNdGgwRW9zR2Vk
-KBj8(Àòö¢¾:èÒ«e¸g;ÜM
+c1lRZVU3WXR5MzlHRXp6a0xDeUJMaApmM1pzTmlzbXpGTXl0VkV3ZTRGZzF6SktT
-@<40>™Å›nšjjÝ÷BìµòÜ<>¼?ô$ïÎ÷7!ì]ù¾qxhui~ŠúXáê0ïPiØRÂç0²Æ—Çu%ÀSƒÌ	õ÷Bƒ·>r§½—‡»—š$\…°Ìh
+UHA4ZFBqejV3WlFKYWd4NW9yelQ0cmg1bXdLTHNJZE13VU5vL213CgotPiBzc2gt
-x¢às -zpzõ"ÚJgßÔZH<ƒ˜g‹'}á¢r‹S·ô$Þ	`ëþþ1´ú¢–®§ [Í9Ÿ©÷ce§h±QÂKbè0Ñ
+ZWQyNTUxOSBDU015aGcgKy9aZ09zOXZua0ljd1Q0dE1lbm9jTWZXYWdZcFg5UFg5
 Vkt3UXNWL2RHYwpFTHpWR3BQb1pZeHFTakdySmRZWE8vNHl1d0RVaEhqQlVrUTNv
 c0lNa3JvCi0+IHN2JylXYy1ncmVhc2UgNTY8KiIKTldkN1VEdVJkalNsSWlLdWVM
 aWxNYnBieURmYklnL0h4NWgwek02K3llMjlkZzQKLS0tIGNFZDk5Z09KaC9QM3VG
 M09GbWN5Q3ZxTzRkTE1TN21sRTYwT2l4V1ZQQVUKKIZUcGsHN+qmBNXzFlmF8nmt
 6qhMa40ZXAy7G6t9i9hIYBWtizHRi/zUCd+SmmqsKkO1H2J/XeZasO3o0avA0dC0
 o9bl0iGtAmK7wHNSWuWtwvi7QfE5nhSVq6V9uGwc3/MDSjjfLhti6qgpEGexBLS9
 EHdohR5a9S7XL3mwRTqUqrSlQgDWzi3KvpuxbMZzWUDj5Bbc++jNJNglypps7wAx
 MOM9Y+7yhPmnMDr8uEj36MSb9u5K6iEJhVpkVUjb+UOvKJG3kTCKkWnkff2zK56e
 xCQisxYZh6LEkGqCH6OFYzwlhKZvwNDa0sPuccwhSmgsB/SLSnHVLHK7XlRzzZNB
 LMrQfZXDDpPKKpS5KgmIPkxLdL+P+6G8BgqSyxyd9fz9okNz2TOHb9v49ujm+mSc
 SwqE7dUpighhE9YehI4VY752CPhs9oToTR1sDKs37x7TKmUSk+cuG/tpoLCBnJLe
 qRKb+cuYpiUiiGVOZNiB+pKCOHgiI+NS3hNyyOXB23Wnmdq42I+15HE4sM2AL3Lo
 wg==
 -----END AGE ENCRYPTED FILE-----
--- a/secrets/wg-DE.age
+++ b/secrets/wg-DE.age
--- a/secrets/wg-NL.age
+++ b/secrets/wg-NL.age
--- a/secrets/wg-NO.age
+++ b/secrets/wg-NO.age
--- a/secrets/wg-US.age
+++ b/secrets/wg-US.age
Author	SHA1	Message	Date
m3tm3re	e9f20d7dda	chore: rekey secrets	2026-03-10 04:38:25 +01:00
m3tm3re	4ae2bb0f48	chore: flake update	2026-03-07 11:44:04 +01:00
m3tm3re	b08be9132b	feat: litellm provider for opncode	2026-03-03 20:07:25 +01:00
m3tm3re	e4195230a5	chore: fix netbird ssh	2026-03-02 19:24:28 +01:00
m3tm3re	674ce6957c	feat: authentik	2026-02-28 10:06:42 +01:00
m3tm3re	a9022a4f55	refactor(netbird): use port registry and named IP variables	2026-02-27 16:03:12 +01:00
m3tm3re	fa9747f3e9	refactor(ports): add netbird port definitions	2026-02-27 16:03:08 +01:00
m3tm3re	4920029c65	+openspec	2026-02-18 17:57:21 +01:00
m3tm3re	a12958b68f	chore: flake update	2026-02-18 16:28:31 +01:00
m3tm3re	2e550b91f5	feat(opencode): integrate rules into default devShell - Switch agents input to local path for development - Add default devShell with Opencode rules integration - Update .gitignore to exclude generated Opencode files - Upgrade opencode to v1.2.6	2026-02-17 20:11:14 +01:00
m3tm3re	1d3564f360	feat(opencode): deploy rules/ to ~/.config/opencode/rules/ via home-manager - Add xdg.configFile entry for opencode/rules - Rules deployed alongside skills, commands, context, prompts Refs: T4 of rules-system plan	2026-02-17 18:59:43 +01:00
m3tm3re	8ead26a791	update opencode config, secrets, tailscale, and agents input - opencode: remove deprecated google_auth, add git_master config, experimental truncation, use glm-4.6v for multimodal-looker, upgrade categories to glm-5, remove opencode-memory plugin - m3-atlas: add ref/exa/outline/basecamp secret declarations - m3-kratos: enable tailscale with ssh and reset flags - agents: switch back to remote git input	2026-02-17 08:54:13 +01:00
m3tm3re	87baf2377f	+opencode-memory	2026-02-16 19:57:16 +01:00
m3tm3re	7b9caedaa4	headscale ssh acl	2026-02-16 18:59:34 +01:00
m3tm3re	105e573c53	Switch to local m3ta-nixpkgs and enable services Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-02-15 18:16:11 +01:00
m3tm3re	eda9f2a1f9	Enable mem0 and qdrant services on m3-ares Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-02-15 18:15:37 +01:00
m3tm3re	f3536919f0	Update OpenCode configuration and add sqlite tools Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-02-15 18:15:00 +01:00