feat: migrate host Hyprland configs to Lua (Hyprland 0.55+)

- m3-kratos/home.nix: use hl.monitor({}), hl.workspace_rule({}),
  hl.window_rule({}) table-based Lua API
- m3-ares/home.nix: same Lua API + tuxedo-backlight via hl.on()
- Update flake.lock: home-manager -> 74f170c6 (2026-05-18)

.a5c/.gitignore

@@ -1,3 +0,0 @@
-node_modules/
-runs/
-*.log

.a5c/inputs/fix-eval-warnings-inputs.json

@@ -1,5 +0,0 @@
-{
-  "nixosConfigDir": "/home/m3tam3re/p/NIX/nixos-config",
-  "m3taHomeDir": "/home/m3tam3re/p/NIX/m3ta-home",
-  "specPath": "/home/m3tam3re/p/NIX/nixos-config/.a5c/inputs/fix-eval-warnings-spec.md"
-}

.a5c/inputs/fix-eval-warnings-spec.md

@@ -1,10 +0,0 @@
-Fix the following Nix/Home Manager evaluation warnings except for the gc/nh conflict warning:
-
-- `evaluation warning: 'system' has been renamed to/replaced by 'stdenv.hostPlatform.system'`
-- `evaluation warning: m3tam3re profile: programs.ssh.matchBlocks defined in /nix/store/...-users/m3tam3re/identities/private.nix is deprecated. Use programs.ssh.settings.`
-
-Do not fix or change the warning:
-
-- `evaluation warning: programs.nh.clean.enable and nix.gc.automatic are both enabled. Please use one or the other to avoid conflict.`
-
-The private identity source file is in `/home/m3tam3re/p/NIX/m3ta-home/users/m3tam3re/identities/private.nix`.

.a5c/inputs/project-install.json

@@ -1,5 +0,0 @@
-{
-  "projectRoot": "/home/m3tam3re/p/NIX/nixos-config",
-  "isNewProject": false,
-  "additionalContext": "Install and configure babysitter for this existing NixOS flake configuration repository. Respect AGENTS.md instructions, Beads workflow, Nix conventions, and avoid interactive/destructive operations unless explicitly approved."
-}

.a5c/package.json

@@ -1,9 +0,0 @@
-{
-  "name": "nixos-config-a5c",
-  "version": "1.0.0",
-  "private": true,
-  "type": "module",
-  "dependencies": {
-    "@a5c-ai/babysitter-sdk": "latest"
-  }
-}

.a5c/processes/fix-nix-eval-warnings.js

@@ -1,301 +0,0 @@
-/**
- * @process local/fix-nix-eval-warnings
- * @description Fix Nix/Home Manager evaluation warnings except the nh/gc conflict warning.
- * @skill systematic-debugging methodologies/superpowers/systematic-debugging.js
- * @skill verification-before-completion methodologies/superpowers/verification-before-completion.js
- * @skill root-cause-diagnosis methodologies/shared/root-cause-diagnosis.js
- */
-
-import { defineTask } from '@a5c-ai/babysitter-sdk';
-
-const q = (value) => `'${String(value).replace(/'/g, `'\\''`)}'`;
-
-export async function process(inputs, ctx) {
-  const nixosConfigDir = inputs.nixosConfigDir || '/home/m3tam3re/p/NIX/nixos-config';
-  const m3taHomeDir = inputs.m3taHomeDir || '/home/m3tam3re/p/NIX/m3ta-home';
-  const specPath = inputs.specPath || `${nixosConfigDir}/.a5c/inputs/fix-eval-warnings-spec.md`;
-
-  const spec = await ctx.task(readSpecTask, { specPath });
-
-  const inspection = await ctx.task(inspectWarningSourcesTask, {
-    nixosConfigDir,
-    m3taHomeDir,
-  });
-
-  const implementation = await ctx.task(implementFixesTask, {
-    nixosConfigDir,
-    m3taHomeDir,
-    spec: spec.stdout,
-    inspection: inspection.stdout,
-  });
-
-  const formatting = await ctx.task(formatChangedNixTask, {
-    m3taHomeDir,
-  });
-
-  const verification = await ctx.task(verifyWarningsTask, {
-    nixosConfigDir,
-    m3taHomeDir,
-  });
-
-  const artifacts = await ctx.task(collectArtifactsTask, {
-    nixosConfigDir,
-    m3taHomeDir,
-    verifyStdout: verification.stdout || '',
-    verifyStderr: verification.stderr || '',
-  });
-
-  const acceptance = await ctx.task(acceptanceReviewTask, {
-    spec: spec.stdout,
-    artifacts: artifacts.stdout,
-  });
-
-  if (!acceptance.accepted) {
-    await ctx.breakpoint({
-      title: 'Warning fix acceptance review failed',
-      question: `Acceptance review did not approve the changes: ${acceptance.reason}`,
-      context: {
-        runId: ctx.runId,
-        files: [
-          { path: `${m3taHomeDir}/users/m3tam3re/identities/private.nix`, format: 'nix', label: 'Private SSH identity' },
-          { path: `${m3taHomeDir}/profiles/sets/coding/agents/agents.nix`, format: 'nix', label: 'Agent packages' },
-          { path: `${m3taHomeDir}/profiles/contexts/desktop/default.nix`, format: 'nix', label: 'Desktop packages' },
-        ],
-      },
-    });
-  }
-
-  return {
-    success: acceptance.accepted,
-    summary: implementation.summary,
-    changedFiles: implementation.changedFiles,
-    verification: {
-      formatting: formatting.stdout,
-      warnings: verification.stdout,
-      review: acceptance,
-    },
-  };
-}
-
-export const readSpecTask = defineTask('read-spec', (args, taskCtx) => ({
-  kind: 'shell',
-  title: 'Read warning-fix spec',
-  shell: {
-    command: `cat ${q(args.specPath)}`,
-    expectedExitCode: 0,
-    timeout: 10000,
-  },
-  io: {
-    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
-    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
-  },
-  labels: ['spec', 'shell'],
-}));
-
-export const inspectWarningSourcesTask = defineTask('inspect-warning-sources', (args, taskCtx) => ({
-  kind: 'shell',
-  title: 'Inspect current warning sources',
-  shell: {
-    command: [
-      'set -euo pipefail',
-      `echo '== nixos-config status =='`,
-      `cd ${q(args.nixosConfigDir)} && git status --short`,
-      `echo`,
-      `echo '== m3ta-home status =='`,
-      `cd ${q(args.m3taHomeDir)} && git status --short`,
-      `echo`,
-      `echo '== active pkgs.system-style package selectors =='`,
-      `grep -RIn --include='*.nix' -E 'packages[.]\\$\\{pkgs[.]system\\}|packages[.]\\$\\{prev[.]system\\}|packages[.]\\$\\{final[.]system\\}' ${q(args.nixosConfigDir)} ${q(args.m3taHomeDir)} || true`,
-      `echo`,
-      `echo '== SSH matchBlocks in m3ta-home identities =='`,
-      `grep -RIn --include='*.nix' 'matchBlocks' ${q(`${args.m3taHomeDir}/users/m3tam3re/identities`)} || true`,
-    ].join('\n'),
-    expectedExitCode: 0,
-    timeout: 30000,
-  },
-  io: {
-    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
-    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
-  },
-  labels: ['diagnosis', 'shell'],
-}));
-
-export const implementFixesTask = defineTask('implement-warning-fixes', (args, taskCtx) => ({
-  kind: 'agent',
-  title: 'Implement requested warning fixes',
-  agent: {
-    name: 'worker',
-    prompt: {
-      role: 'Nix/Home Manager maintenance engineer',
-      task: 'Edit the repositories to remove the requested evaluation warnings, excluding the nh/gc warning by request.',
-      context: {
-        nixosConfigDir: args.nixosConfigDir,
-        m3taHomeDir: args.m3taHomeDir,
-        specVerbatim: args.spec,
-        inspectionStdout: args.inspection,
-      },
-      instructions: [
-        'Execute the task fully; do not just provide a plan.',
-        'Do not invoke the babysit skill or create another babysitter run.',
-        'Read every file before editing it.',
-        'Preserve unrelated existing user changes, especially any dirty files in nixos-config such as flake.nix or flake.lock.',
-        'Fix active uses of pkgs.system/prev.system/final.system that trigger the Nixpkgs deprecation warning by using stdenv.hostPlatform.system through the appropriate package set.',
-        'Migrate /home/m3tam3re/p/NIX/m3ta-home/users/m3tam3re/identities/private.nix from programs.ssh.matchBlocks to programs.ssh.settings.',
-        'For programs.ssh.settings, use OpenSSH directive names such as HostName, User, Port, and IdentityFile; do not keep legacy camelCase option names under settings.',
-        'Do not change programs.nh.clean.enable or nix.gc.automatic; the user explicitly excluded that warning.',
-        'Keep the change minimal and focused on the warnings in the spec.',
-        'Run a quick static check of the edited files if practical, but leave deterministic verification to the process quality gate.',
-      ],
-      outputFormat: 'JSON with summary, changedFiles, and verificationNotes.',
-    },
-    outputSchema: {
-      type: 'object',
-      required: ['summary', 'changedFiles', 'verificationNotes'],
-      properties: {
-        summary: { type: 'string' },
-        changedFiles: { type: 'array', items: { type: 'string' } },
-        verificationNotes: { type: 'array', items: { type: 'string' } },
-      },
-    },
-  },
-  io: {
-    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
-    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
-  },
-  labels: ['implementation', 'agent', 'nix'],
-}));
-
-export const formatChangedNixTask = defineTask('format-changed-nix', (args, taskCtx) => ({
-  kind: 'shell',
-  title: 'Format changed Nix files',
-  shell: {
-    command: [
-      'set -euo pipefail',
-      `cd ${q(args.m3taHomeDir)}`,
-      `if command -v alejandra >/dev/null 2>&1; then`,
-      `  alejandra users/m3tam3re/identities/private.nix profiles/sets/coding/agents/agents.nix profiles/contexts/desktop/default.nix`,
-      `else`,
-      `  nix run nixpkgs#alejandra -- users/m3tam3re/identities/private.nix profiles/sets/coding/agents/agents.nix profiles/contexts/desktop/default.nix`,
-      `fi`,
-    ].join('\n'),
-    expectedExitCode: 0,
-    timeout: 120000,
-  },
-  io: {
-    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
-    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
-  },
-  labels: ['format', 'shell'],
-}));
-
-export const verifyWarningsTask = defineTask('verify-warning-removal', (args, taskCtx) => ({
-  kind: 'shell',
-  title: 'Verify requested warnings are gone',
-  shell: {
-    command: [
-      'set -euo pipefail',
-      `echo '== static checks =='`,
-      `! grep -RIn --include='*.nix' -E 'packages[.]\\$\\{pkgs[.]system\\}|packages[.]\\$\\{prev[.]system\\}|packages[.]\\$\\{final[.]system\\}' ${q(`${args.m3taHomeDir}/profiles`)} || { echo 'Found deprecated package system selector' >&2; exit 1; }`,
-      `! grep -n 'matchBlocks' ${q(`${args.m3taHomeDir}/users/m3tam3re/identities/private.nix`)} || { echo 'private.nix still uses matchBlocks' >&2; exit 1; }`,
-      `grep -n 'settings = {' ${q(`${args.m3taHomeDir}/users/m3tam3re/identities/private.nix`)}`,
-      `echo`,
-      `echo '== nix eval m3-ares =='`,
-      `cd ${q(args.nixosConfigDir)}`,
-      `eval_stdout=$(mktemp)`,
-      `eval_stderr=$(mktemp)`,
-      `set +e`,
-      `nix eval .#nixosConfigurations.m3-ares.config.system.build.toplevel.drvPath --show-trace >"$eval_stdout" 2>"$eval_stderr"`,
-      `status=$?`,
-      `set -e`,
-      `cat "$eval_stdout"`,
-      `cat "$eval_stderr" >&2`,
-      `if [ "$status" -ne 0 ]; then exit "$status"; fi`,
-      `if grep -F "'system' has been renamed" "$eval_stderr"; then echo 'Deprecated system warning still present' >&2; exit 1; fi`,
-      `if grep -F 'programs.ssh.matchBlocks' "$eval_stderr"; then echo 'Deprecated SSH matchBlocks warning still present' >&2; exit 1; fi`,
-      `if grep -F 'programs.nh.clean.enable and nix.gc.automatic' "$eval_stderr" >/dev/null; then echo 'Allowed nh/gc warning remains by request.'; fi`,
-    ].join('\n'),
-    expectedExitCode: 0,
-    timeout: 300000,
-  },
-  io: {
-    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
-    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
-  },
-  labels: ['verification', 'shell', 'nix'],
-}));
-
-export const collectArtifactsTask = defineTask('collect-artifacts', (args, taskCtx) => ({
-  kind: 'shell',
-  title: 'Collect diffs and verification output',
-  shell: {
-    command: [
-      'set -euo pipefail',
-      `echo '== m3ta-home diff =='`,
-      `cd ${q(args.m3taHomeDir)} && git diff -- users/m3tam3re/identities/private.nix profiles/sets/coding/agents/agents.nix profiles/contexts/desktop/default.nix`,
-      `echo`,
-      `echo '== nixos-config diff (should not include warning fix unless needed) =='`,
-      `cd ${q(args.nixosConfigDir)} && git diff -- overlays/default.nix flake.nix flake.lock || true`,
-      `echo`,
-      `echo '== verification stdout =='`,
-      `cat <<'VERIFY_STDOUT'`,
-      args.verifyStdout || '',
-      `VERIFY_STDOUT`,
-      `echo`,
-      `echo '== verification stderr =='`,
-      `cat <<'VERIFY_STDERR'`,
-      args.verifyStderr || '',
-      `VERIFY_STDERR`,
-    ].join('\n'),
-    expectedExitCode: 0,
-    timeout: 30000,
-  },
-  io: {
-    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
-    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
-  },
-  labels: ['artifacts', 'shell'],
-}));
-
-export const acceptanceReviewTask = defineTask('acceptance-review', (args, taskCtx) => ({
-  kind: 'agent',
-  title: 'Review changes against requested warning fixes',
-  agent: {
-    name: 'reviewer',
-    prompt: {
-      role: 'Acceptance reviewer for a Nix/Home Manager warning fix',
-      task: 'Compare SPEC to ARTIFACTS directly and decide whether the requested warnings were fixed without touching the excluded nh/gc warning.',
-      instructions: [
-        'Ignore any narrative in your context about how ARTIFACTS were built.',
-        'Do not ask for additional changes unless they are required by the SPEC.',
-        'Accept if the system deprecation warning and private SSH matchBlocks warning are addressed, and the nh/gc conflict remains untouched.',
-        '',
-        'SPEC (verbatim):',
-        '---',
-        args.spec,
-        '---',
-        '',
-        'ARTIFACTS (verbatim):',
-        '---',
-        args.artifacts,
-        '---',
-        '',
-        'Compare SPEC to ARTIFACTS directly. Ignore any narrative in your context about how ARTIFACTS were built.',
-      ],
-      outputFormat: 'JSON with accepted boolean, reason string, and checkedCriteria array.',
-    },
-    outputSchema: {
-      type: 'object',
-      required: ['accepted', 'reason', 'checkedCriteria'],
-      properties: {
-        accepted: { type: 'boolean' },
-        reason: { type: 'string' },
-        checkedCriteria: { type: 'array', items: { type: 'string' } },
-      },
-    },
-  },
-  io: {
-    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
-    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
-  },
-  labels: ['acceptance', 'agent', 'review'],
-}));

.a5c/project-profile.json

@@ -1,596 +0,0 @@
-{
-  "projectName": "nixos-config",
-  "description": "A reliable, elegant, multi-system NixOS flake configuration for personal desktop, server, cloud, Home Manager, package, overlay, and secret management.",
-  "goals": [
-    {
-      "id": "goal-reliability-1",
-      "description": "Keep all managed NixOS systems reproducible, reliable, and easy to validate before deployment.",
-      "category": "reliability",
-      "priority": "high",
-      "status": "active"
-    },
-    {
-      "id": "goal-architecture-1",
-      "description": "Maintain an elegant multi-system architecture with clear host boundaries and reusable common modules.",
-      "category": "architecture",
-      "priority": "high",
-      "status": "active"
-    },
-    {
-      "id": "goal-modularization-1",
-      "description": "Continue breaking up the former monorepo by keeping Home Manager profiles in m3ta-home and custom packages/modules in m3ta-nixpkgs where appropriate.",
-      "category": "modularization",
-      "priority": "high",
-      "status": "active"
-    },
-    {
-      "id": "goal-cicd-1",
-      "description": "CI/CD is not currently configured; add useful Gitea Actions validation later for formatting, linting, flake evaluation, and safe host checks.",
-      "category": "automation",
-      "priority": "medium",
-      "status": "deferred"
-    }
-  ],
-  "techStack": {
-    "languages": [
-      {
-        "name": "Nix",
-        "role": "primary system, module, overlay, and package configuration language"
-      },
-      {
-        "name": "Markdown",
-        "role": "project, agent, and workflow documentation"
-      },
-      {
-        "name": "JSON/YAML",
-        "role": "tool configuration and metadata"
-      }
-    ],
-    "frameworks": [
-      {
-        "name": "Nix flakes",
-        "category": "reproducible dependency and output model"
-      },
-      {
-        "name": "NixOS modules",
-        "category": "host and service configuration"
-      },
-      {
-        "name": "Home Manager",
-        "category": "user environment management"
-      },
-      {
-        "name": "Agenix",
-        "category": "encrypted secret management"
-      },
-      {
-        "name": "Disko",
-        "category": "server disk provisioning"
-      },
-      {
-        "name": "NUR",
-        "category": "community package access"
-      },
-      {
-        "name": "llm-agents.nix",
-        "category": "LLM agent packages overlay"
-      },
-      {
-        "name": "m3ta-home",
-        "category": "external reusable Home Manager profiles"
-      },
-      {
-        "name": "m3ta-nixpkgs",
-        "category": "external custom packages/modules/overlays"
-      }
-    ],
-    "databases": [],
-    "infrastructure": [
-      {
-        "name": "m3-ares",
-        "category": "desktop NixOS host"
-      },
-      {
-        "name": "m3-kratos",
-        "category": "desktop NixOS host"
-      },
-      {
-        "name": "m3-daedalus",
-        "category": "portable laptop/Home Manager configuration"
-      },
-      {
-        "name": "m3-atlas",
-        "category": "primary server NixOS host"
-      },
-      {
-        "name": "m3-helios",
-        "category": "minimal server/AdGuard host"
-      },
-      {
-        "name": "m3-hermes",
-        "category": "secondary server/Hermes host"
-      },
-      {
-        "name": "m3-aether",
-        "category": "cloud VM/minimal server host"
-      }
-    ],
-    "buildTools": [
-      "nix",
-      "nixos-rebuild",
-      "nix build",
-      "nix flake show",
-      "alejandra",
-      "statix",
-      "deadnix"
-    ],
-    "packageManagers": [
-      "nix flakes"
-    ]
-  },
-  "architecture": {
-    "pattern": "Pure Nix flake-based NixOS configuration repository with host-specific modules, common shared modules, overlays, custom packages, agenix secrets, and externalized Home Manager/package inputs.",
-    "modules": [
-      {
-        "name": "flake.nix",
-        "path": "flake.nix",
-        "description": "Top-level entry point defining inputs, packages, overlays, Home Manager modules, NixOS configurations, and dev shells."
-      },
-      {
-        "name": "hosts/common",
-        "path": "hosts/common",
-        "description": "Shared NixOS configuration, nix settings, overlays, Home Manager setup, ports, extra services, and users."
-      },
-      {
-        "name": "hosts",
-        "path": "hosts",
-        "description": "Per-host NixOS/Home Manager configurations for desktops, servers, and cloud VM."
-      },
-      {
-        "name": "modules/nixos",
-        "path": "modules/nixos",
-        "description": "Reusable NixOS modules."
-      },
-      {
-        "name": "modules/home-manager",
-        "path": "modules/home-manager",
-        "description": "Reusable Home Manager module exports."
-      },
-      {
-        "name": "overlays",
-        "path": "overlays",
-        "description": "Nixpkgs overlays for stable, locked, pinned, master, temporary, and agent packages."
-      },
-      {
-        "name": "pkgs",
-        "path": "pkgs",
-        "description": "Custom package export set."
-      },
-      {
-        "name": "secrets",
-        "path": "secrets",
-        "description": "Encrypted agenix secret files and registry."
-      }
-    ],
-    "entryPoints": [
-      "flake.nix",
-      "hosts/<host>/default.nix",
-      "hosts/<host>/configuration.nix",
-      "hosts/common/default.nix",
-      "hosts/common/users/m3tam3re.nix",
-      "overlays/default.nix",
-      "pkgs/default.nix",
-      "secrets.nix"
-    ],
-    "dataFlow": "flake.nix wires inputs, overlays, packages, NixOS modules, and Home Manager. Host modules import common configuration and host-specific hardware/programs/services/secrets. Host profile flags in hosts/common/users/m3tam3re.nix feed the external m3ta-home mkHome integration. Secrets flow through agenix registry and host secret modules."
-  },
-  "team": [
-    {
-      "name": "m3tam3re",
-      "role": "solo developer and operator",
-      "responsibilities": [
-        "architecture",
-        "implementation",
-        "host maintenance",
-        "deployments",
-        "review"
-      ]
-    },
-    {
-      "name": "m3ta-chiron",
-      "role": "agent contributor",
-      "responsibilities": [
-        "semi-autonomous implementation",
-        "validation",
-        "documentation updates",
-        "conventional commits"
-      ]
-    }
-  ],
-  "workflows": [
-    {
-      "name": "development",
-      "description": "Default feature-branch workflow for solo development with conventional commits and validation before push.",
-      "steps": [
-        "review Beads issues with bd ready --json",
-        "claim work with bd update <id> --claim when applicable",
-        "edit Nix modules or project files",
-        "run alejandra .",
-        "run statix check .",
-        "run targeted nix flake or host dry-run checks",
-        "commit with conventional commit format",
-        "pull --rebase and push"
-      ],
-      "triggers": [
-        "new feature",
-        "bug fix",
-        "refactor",
-        "agent task"
-      ]
-    },
-    {
-      "name": "nix validation",
-      "description": "Quality gate for Nix configuration changes.",
-      "steps": [
-        "alejandra .",
-        "statix check .",
-        "deadnix check or deadnix -w when appropriate",
-        "nix flake show",
-        "sudo nixos-rebuild dry-run --flake .#<host> for affected hosts"
-      ],
-      "triggers": [
-        "Nix code changes",
-        "before deployment",
-        "before commit"
-      ]
-    },
-    {
-      "name": "host deployment",
-      "description": "Manual deployment after successful dry-run validation.",
-      "steps": [
-        "sudo nixos-rebuild dry-run --flake .#<host>",
-        "sudo nixos-rebuild switch --flake .#<host>"
-      ],
-      "triggers": [
-        "manual host update"
-      ]
-    },
-    {
-      "name": "dependency/input update",
-      "description": "Controlled flake input updates without manually editing flake.lock.",
-      "steps": [
-        "use nix flake update or nixos-rebuild --update-input <input>",
-        "validate affected outputs",
-        "commit flake.nix/flake.lock changes"
-      ],
-      "triggers": [
-        "planned dependency update",
-        "security update"
-      ]
-    },
-    {
-      "name": "beads issue tracking",
-      "description": "Persistent issue tracking and session handoff workflow.",
-      "steps": [
-        "bd ready --json",
-        "bd show <id>",
-        "bd update <id> --claim",
-        "bd close <id> --reason <summary>",
-        "bd dolt push"
-      ],
-      "triggers": [
-        "start of tracked work",
-        "completion of tracked work"
-      ]
-    }
-  ],
-  "processes": [
-    {
-      "id": "cradle/project-install",
-      "name": "Babysitter project install",
-      "status": "installing",
-      "purpose": "Create and save a Babysitter project profile and setup recommendations."
-    }
-  ],
-  "tools": {
-    "formatting": [
-      {
-        "name": "alejandra",
-        "purpose": "Nix formatting",
-        "configPaths": [
-          "flake.nix devShells.default"
-        ]
-      }
-    ],
-    "linting": [
-      {
-        "name": "statix",
-        "purpose": "Nix anti-pattern linting",
-        "configPaths": [
-          "flake.nix devShells.default"
-        ]
-      },
-      {
-        "name": "deadnix",
-        "purpose": "Detect unused Nix code",
-        "configPaths": [
-          "flake.nix devShells.default"
-        ]
-      }
-    ],
-    "testing": [
-      {
-        "name": "nix flake show",
-        "purpose": "Evaluate flake outputs",
-        "configPaths": [
-          "flake.nix"
-        ]
-      },
-      {
-        "name": "nixos-rebuild dry-run",
-        "purpose": "Validate host configurations without applying changes",
-        "configPaths": [
-          "flake.nix",
-          "hosts/*"
-        ]
-      },
-      {
-        "name": "nix build",
-        "purpose": "Build selected outputs such as host toplevels or ISOs",
-        "configPaths": [
-          "flake.nix"
-        ]
-      }
-    ],
-    "issueTracking": [
-      {
-        "name": "Beads",
-        "command": "bd",
-        "purpose": "Persistent task tracking"
-      }
-    ]
-  },
-  "services": [
-    {
-      "name": "code.m3ta.dev",
-      "type": "git hosting",
-      "url": "git+ssh://gitea@code.m3ta.dev"
-    },
-    {
-      "name": "GitHub",
-      "type": "flake input hosting",
-      "url": "github:* flake inputs"
-    },
-    {
-      "name": "Agenix",
-      "type": "secret encryption",
-      "url": "github:ryantm/agenix"
-    },
-    {
-      "name": "Hermes Agent",
-      "type": "NixOS module/agent service",
-      "url": "github:NousResearch/hermes-agent"
-    },
-    {
-      "name": "RustFS",
-      "type": "NixOS server service flake",
-      "url": "github:rustfs/rustfs-flake"
-    }
-  ],
-  "externalIntegrations": [
-    {
-      "service": "Beads",
-      "category": "issue tracking",
-      "enabled": true
-    },
-    {
-      "service": "Dolt",
-      "category": "Beads storage/sync",
-      "enabled": true
-    },
-    {
-      "service": "Agenix",
-      "category": "secrets",
-      "enabled": true
-    },
-    {
-      "service": "Home Manager",
-      "category": "user environment",
-      "enabled": true
-    },
-    {
-      "service": "m3ta-home",
-      "category": "external home profiles",
-      "enabled": true
-    },
-    {
-      "service": "m3ta-nixpkgs",
-      "category": "external Nix modules/packages",
-      "enabled": true
-    },
-    {
-      "service": "NUR",
-      "category": "Nix packages",
-      "enabled": true
-    },
-    {
-      "service": "Disko",
-      "category": "disk provisioning",
-      "enabled": true
-    },
-    {
-      "service": "Hermes Agent",
-      "category": "LLM/agent service",
-      "enabled": true
-    }
-  ],
-  "cicd": {
-    "provider": null,
-    "enabled": false,
-    "configPaths": [],
-    "pipelines": [],
-    "notes": "CI/CD is intentionally disabled for now. If re-enabled later, prefer Gitea Actions because this repository is hosted on code.m3ta.dev.",
-    "babysitterIntegration": {
-      "enabled": false,
-      "triggerOn": [],
-      "processIds": []
-    }
-  },
-  "painPoints": [
-    {
-      "id": "pp-architecture-1",
-      "description": "The repository is transitioning away from a monorepo; boundaries with m3ta-home and m3ta-nixpkgs must remain clear.",
-      "severity": "high",
-      "category": "architecture",
-      "discoveredVia": "user interview",
-      "suggestedRemediation": "Keep host-specific decisions local while moving reusable Home Manager profiles and package/module abstractions to their dedicated inputs."
-    },
-    {
-      "id": "pp-validation-1",
-      "description": "A single shared Nix change can require validating several hosts to be confident.",
-      "severity": "medium",
-      "category": "validation",
-      "discoveredVia": "repo structure and AGENTS workflow",
-      "suggestedRemediation": "Use targeted affected-host validation locally for now; add a Gitea Actions validation matrix later if CI/CD is re-enabled."
-    },
-    {
-      "id": "pp-dependency-1",
-      "description": "Multiple pinned, locked, stable, master, and external SSH flake inputs increase update complexity.",
-      "severity": "medium",
-      "category": "dependency management",
-      "discoveredVia": "flake and history analysis",
-      "suggestedRemediation": "Update inputs intentionally, group related updates, and validate affected host outputs."
-    },
-    {
-      "id": "pp-operations-1",
-      "description": "Service additions often need synchronized module, secret, and network/TLS changes.",
-      "severity": "medium",
-      "category": "operations",
-      "discoveredVia": "git history and tree structure",
-      "suggestedRemediation": "Use checklist-style issue templates or Babysitter processes for service changes."
-    }
-  ],
-  "bottlenecks": [
-    {
-      "id": "bn-flake-1",
-      "description": "flake.nix and flake.lock are high-churn files whose changes can affect many hosts at once.",
-      "impact": "High; evaluation failures can block all hosts.",
-      "location": "flake.nix, flake.lock",
-      "frequency": "very frequent"
-    },
-    {
-      "id": "bn-secrets-1",
-      "description": "Secret registry and host secret modules must stay aligned with encrypted .age files.",
-      "impact": "Medium to high; missing or mismatched secrets break host deployment.",
-      "location": "secrets.nix, hosts/*/secrets.nix, secrets/*.age",
-      "frequency": "recurring"
-    },
-    {
-      "id": "bn-services-1",
-      "description": "Server service changes can span service modules, secrets, Traefik/networking, and flake inputs.",
-      "impact": "High for m3-atlas and m3-hermes changes; requires host-specific dry-runs.",
-      "location": "hosts/m3-atlas/services, hosts/m3-hermes/services, hosts/common",
-      "frequency": "frequent"
-    },
-    {
-      "id": "bn-home-1",
-      "description": "Home Manager behavior depends on both the external m3ta-home input and local host flags.",
-      "impact": "Medium; may require coordinated updates across repositories.",
-      "location": "flake.nix, hosts/common/users/m3tam3re.nix, m3ta-home input",
-      "frequency": "frequent after migration"
-    }
-  ],
-  "conventions": {
-    "naming": {
-      "files": "hyphen-case for Nix/docs where practical; host directories use m3-* names",
-      "hosts": "m3-<greek-name>",
-      "modules": "one module per file/directory where possible",
-      "nixVariables": "camelCase"
-    },
-    "git": {
-      "branchStrategy": "default feature branches for non-trivial work; master as integration branch",
-      "commits": "conventional commits for agent work",
-      "reviews": "optional for solo development",
-      "releaseCadence": "continuous/manual as needed",
-      "remote": "code.m3ta.dev over SSH for private inputs and repo access"
-    },
-    "codeStyle": {
-      "formatter": "alejandra",
-      "indentation": "2 spaces",
-      "nixStyle": "explicit pkgs references preferred; avoid with pkgs, builtins.fetchTarball, import <nixpkgs>, builtins.getAttr/hasAttr"
-    },
-    "importOrder": [
-      "module function arguments",
-      "imports",
-      "let bindings",
-      "options/config"
-    ],
-    "errorHandling": "Nix configuration should fail explicitly during evaluation/build; avoid hiding errors or impure paths.",
-    "testingConventions": "Run alejandra, statix, deadnix as appropriate, nix flake show, and host-specific nixos-rebuild dry-run before switching.",
-    "additionalRules": [
-      "Use Beads for persistent task tracking.",
-      "Use non-interactive flags for shell file operations.",
-      "Do not modify flake.lock directly; use nix flake update.",
-      "Do not commit plaintext secrets.",
-      "Use SSH URLs for code.m3ta.dev flake inputs.",
-      "Operate Babysitter semi-autonomously with breakpoints for destructive, deployment, or architecture-changing decisions."
-    ]
-  },
-  "repositories": [
-    {
-      "name": "nixos-config",
-      "path": "/home/m3tam3re/p/NIX/nixos-config",
-      "role": "primary multi-host NixOS configuration"
-    },
-    {
-      "name": "m3ta-home",
-      "url": "git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home",
-      "role": "external Home Manager profiles"
-    },
-    {
-      "name": "m3ta-nixpkgs",
-      "url": "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs",
-      "role": "external custom packages/modules/overlays"
-    }
-  ],
-  "claudeMdInstructions": [
-    "Respect AGENTS.md as the source of project workflow rules.",
-    "Resolve the active Babysitter process library before using library processes.",
-    "Use cradle/project-install for project setup or profile refresh.",
-    "Use evolutionary GSD: map affected Nix modules/hosts, make focused changes, verify, and iterate.",
-    "Prefer alejandra, statix, deadnix, nix flake show, and targeted host dry-runs for Nix changes.",
-    "Preserve boundaries between nixos-config, m3ta-home, and m3ta-nixpkgs.",
-    "Use breakpoints for destructive operations, deployments, architecture changes, and secret-handling decisions.",
-    "Babysitter CI/CD is not currently enabled; if re-added later, use Gitea Actions rather than GitHub Actions."
-  ],
-  "installedSkills": [
-    "project-install",
-    "babysit",
-    "specializations/devops-sre-platform/skills/cicd-pipelines/SKILL.md",
-    "specializations/devops-sre-platform/skills/gitops/SKILL.md",
-    "specializations/devops-sre-platform/skills/secrets-management/SKILL.md"
-  ],
-  "installedAgents": [
-    "general-purpose",
-    "specializations/devops-sre-platform/agents/platform-engineer/AGENT.md",
-    "specializations/devops-sre-platform/agents/cicd-specialist/AGENT.md"
-  ],
-  "installedProcesses": [
-    "cradle/project-install",
-    "methodologies/gsd/quick.js",
-    "methodologies/gsd/verify-work.js",
-    "methodologies/gsd/iterative-convergence.js",
-    "methodologies/evolutionary.js",
-    "specializations/devops-sre-platform/iac-testing.js"
-  ],
-  "preferences": {
-    "babysitterAutonomy": "semi-autonomous",
-    "breakpointTolerance": "moderate",
-    "externalIntegrationsRequested": false,
-    "cicdDesired": false,
-    "cicdNote": "Deferred for now; Gitea Actions is the preferred provider if CI/CD is added later."
-  },
-  "createdAt": "2026-05-29T15:50:48.754Z",
-  "updatedAt": "2026-05-29T16:07:19.245463Z",
-  "version": 1
-}

.a5c/project-profile.md

@@ -1,238 +0,0 @@
-# Project Profile: nixos-config
-
-A reliable, elegant, multi-system NixOS flake configuration for personal desktop, server, cloud, Home Manager, package, overlay, and secret management.
-
-> Last updated: 2026-05-29T16:02:11.092188Z | Version: 1
-
-## Goals
-
-- **reliability** [high]: Keep all managed NixOS systems reproducible, reliable, and easy to validate before deployment. (active)
-- **architecture** [high]: Maintain an elegant multi-system architecture with clear host boundaries and reusable common modules. (active)
-- **modularization** [high]: Continue breaking up the former monorepo by keeping Home Manager profiles in m3ta-home and custom packages/modules in m3ta-nixpkgs where appropriate. (active)
-- **automation** [medium]: CI/CD is not currently configured; add useful Gitea Actions validation later for formatting, linting, flake evaluation, and safe host checks. (deferred)
-
-## Tech Stack
-
-### Languages
-
-- Nix (primary system, module, overlay, and package configuration language)
-- Markdown (project, agent, and workflow documentation)
-- JSON/YAML (tool configuration and metadata)
-
-### Frameworks
-
-- Nix flakes [reproducible dependency and output model]
-- NixOS modules [host and service configuration]
-- Home Manager [user environment management]
-- Agenix [encrypted secret management]
-- Disko [server disk provisioning]
-- NUR [community package access]
-- llm-agents.nix [LLM agent packages overlay]
-- m3ta-home [external reusable Home Manager profiles]
-- m3ta-nixpkgs [external custom packages/modules/overlays]
-
-### Infrastructure
-
-- m3-ares [desktop NixOS host]
-- m3-kratos [desktop NixOS host]
-- m3-daedalus [portable laptop/Home Manager configuration]
-- m3-atlas [primary server NixOS host]
-- m3-helios [minimal server/AdGuard host]
-- m3-hermes [secondary server/Hermes host]
-- m3-aether [cloud VM/minimal server host]
-
-**Build tools:** nix, nixos-rebuild, nix build, nix flake show, alejandra, statix, deadnix
-
-**Package managers:** nix flakes
-
-## Architecture
-
-**Pattern:** Pure Nix flake-based NixOS configuration repository with host-specific modules, common shared modules, overlays, custom packages, agenix secrets, and externalized Home Manager/package inputs.
-**Data flow:** flake.nix wires inputs, overlays, packages, NixOS modules, and Home Manager. Host modules import common configuration and host-specific hardware/programs/services/secrets. Host profile flags in hosts/common/users/m3tam3re.nix feed the external m3ta-home mkHome integration. Secrets flow through agenix registry and host secret modules.
-
-### Modules
-
-| Module | Path | Description |
-|--------|------|-------------|
-| flake.nix | `flake.nix` | Top-level entry point defining inputs, packages, overlays, Home Manager modules, NixOS configurations, and dev shells. |
-| hosts/common | `hosts/common` | Shared NixOS configuration, nix settings, overlays, Home Manager setup, ports, extra services, and users. |
-| hosts | `hosts` | Per-host NixOS/Home Manager configurations for desktops, servers, and cloud VM. |
-| modules/nixos | `modules/nixos` | Reusable NixOS modules. |
-| modules/home-manager | `modules/home-manager` | Reusable Home Manager module exports. |
-| overlays | `overlays` | Nixpkgs overlays for stable, locked, pinned, master, temporary, and agent packages. |
-| pkgs | `pkgs` | Custom package export set. |
-| secrets | `secrets` | Encrypted agenix secret files and registry. |
-
-**Entry points:** `flake.nix`, `hosts/<host>/default.nix`, `hosts/<host>/configuration.nix`, `hosts/common/default.nix`, `hosts/common/users/m3tam3re.nix`, `overlays/default.nix`, `pkgs/default.nix`, `secrets.nix`
-
-## Team
-
-- **m3tam3re** (solo developer and operator): architecture, implementation, host maintenance, deployments, review
-- **m3ta-chiron** (agent contributor): semi-autonomous implementation, validation, documentation updates, conventional commits
-
-## Workflows
-
-### development
-
-Default feature-branch workflow for solo development with conventional commits and validation before push.
-**Triggers:** new feature, bug fix, refactor, agent task
-
-1. review Beads issues with bd ready --json
-2. claim work with bd update <id> --claim when applicable
-3. edit Nix modules or project files
-4. run alejandra .
-5. run statix check .
-6. run targeted nix flake or host dry-run checks
-7. commit with conventional commit format
-8. pull --rebase and push
-
-### nix validation
-
-Quality gate for Nix configuration changes.
-**Triggers:** Nix code changes, before deployment, before commit
-
-1. alejandra .
-2. statix check .
-3. deadnix check or deadnix -w when appropriate
-4. nix flake show
-5. sudo nixos-rebuild dry-run --flake .#<host> for affected hosts
-
-### host deployment
-
-Manual deployment after successful dry-run validation.
-**Triggers:** manual host update
-
-1. sudo nixos-rebuild dry-run --flake .#<host>
-2. sudo nixos-rebuild switch --flake .#<host>
-
-### dependency/input update
-
-Controlled flake input updates without manually editing flake.lock.
-**Triggers:** planned dependency update, security update
-
-1. use nix flake update or nixos-rebuild --update-input <input>
-2. validate affected outputs
-3. commit flake.nix/flake.lock changes
-
-### beads issue tracking
-
-Persistent issue tracking and session handoff workflow.
-**Triggers:** start of tracked work, completion of tracked work
-
-1. bd ready --json
-2. bd show <id>
-3. bd update <id> --claim
-4. bd close <id> --reason <summary>
-5. bd dolt push
-
-## Processes
-
-- **Babysitter project install** (`cradle/project-install`, undefined)
-
-## Tools
-
-### Linting
-
-- statix
-- deadnix
-
-### Testing
-
-- nix flake show
-- nixos-rebuild dry-run
-- nix build
-
-### Formatting
-
-- alejandra
-
-## Services
-
-- **code.m3ta.dev** (git hosting) - git+ssh://gitea@code.m3ta.dev
-- **GitHub** (flake input hosting) - github:* flake inputs
-- **Agenix** (secret encryption) - github:ryantm/agenix
-- **Hermes Agent** (NixOS module/agent service) - github:NousResearch/hermes-agent
-- **RustFS** (NixOS server service flake) - github:rustfs/rustfs-flake
-
-## CI/CD
-
-**Status:** Not configured/enabled for now.
-
-No Babysitter CI/CD workflow is currently installed. If CI/CD is added later, prefer Gitea Actions because this repository is hosted on code.m3ta.dev.
-
-## Pain Points
-
-- **high** [architecture]: The repository is transitioning away from a monorepo; boundaries with m3ta-home and m3ta-nixpkgs must remain clear.
-  - Remediation: Keep host-specific decisions local while moving reusable Home Manager profiles and package/module abstractions to their dedicated inputs.
-- **medium** [validation]: A single shared Nix change can require validating several hosts to be confident.
-  - Remediation: Use targeted affected-host validation locally for now; add a Gitea Actions validation matrix later if CI/CD is re-enabled.
-- **medium** [dependency management]: Multiple pinned, locked, stable, master, and external SSH flake inputs increase update complexity.
-  - Remediation: Update inputs intentionally, group related updates, and validate affected host outputs.
-- **medium** [operations]: Service additions often need synchronized module, secret, and network/TLS changes.
-  - Remediation: Use checklist-style issue templates or Babysitter processes for service changes.
-
-## Bottlenecks
-
-- flake.nix and flake.lock are high-churn files whose changes can affect many hosts at once. at flake.nix, flake.lock (very frequent)
-  Impact: High; evaluation failures can block all hosts.
-- Secret registry and host secret modules must stay aligned with encrypted .age files. at secrets.nix, hosts/*/secrets.nix, secrets/*.age (recurring)
-  Impact: Medium to high; missing or mismatched secrets break host deployment.
-- Server service changes can span service modules, secrets, Traefik/networking, and flake inputs. at hosts/m3-atlas/services, hosts/m3-hermes/services, hosts/common (frequent)
-  Impact: High for m3-atlas and m3-hermes changes; requires host-specific dry-runs.
-- Home Manager behavior depends on both the external m3ta-home input and local host flags. at flake.nix, hosts/common/users/m3tam3re.nix, m3ta-home input (frequent after migration)
-  Impact: Medium; may require coordinated updates across repositories.
-
-## Conventions
-
-### Naming
-
-- **files:** hyphen-case for Nix/docs where practical; host directories use m3-* names
-- **hosts:** m3-<greek-name>
-- **modules:** one module per file/directory where possible
-- **nixVariables:** camelCase
-
-### Git
-
-- **branchStrategy:** default feature branches for non-trivial work; master as integration branch
-- **commits:** conventional commits for agent work
-- **reviews:** optional for solo development
-- **releaseCadence:** continuous/manual as needed
-- **remote:** code.m3ta.dev over SSH for private inputs and repo access
-
-**Import order:** module function arguments > imports > let bindings > options/config
-
-**Error handling:** Nix configuration should fail explicitly during evaluation/build; avoid hiding errors or impure paths.
-
-**Testing:** Run alejandra, statix, deadnix as appropriate, nix flake show, and host-specific nixos-rebuild dry-run before switching.
-
-### Additional Rules
-
-- Use Beads for persistent task tracking.
-- Use non-interactive flags for shell file operations.
-- Do not modify flake.lock directly; use nix flake update.
-- Do not commit plaintext secrets.
-- Use SSH URLs for code.m3ta.dev flake inputs.
-- Operate Babysitter semi-autonomously with breakpoints for destructive, deployment, or architecture-changing decisions.
-
-## Repositories
-
-- **nixos-config** [`/home/m3tam3re/p/NIX/nixos-config`]
-- **m3ta-home** - git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home
-- **m3ta-nixpkgs** - git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs
-
-## CLAUDE.md Instructions
-
-- Respect AGENTS.md as the source of project workflow rules.
-- Resolve the active Babysitter process library before using library processes.
-- Use cradle/project-install for project setup or profile refresh.
-- Use evolutionary GSD: map affected Nix modules/hosts, make focused changes, verify, and iterate.
-- Prefer alejandra, statix, deadnix, nix flake show, and targeted host dry-runs for Nix changes.
-- Preserve boundaries between nixos-config, m3ta-home, and m3ta-nixpkgs.
-- Use breakpoints for destructive operations, deployments, architecture changes, and secret-handling decisions.
-- Babysitter CI/CD is not currently enabled; if re-added later, use Gitea Actions rather than GitHub Actions.
-
-## Installed Extensions
-
-- Skills: project-install, babysit, specializations/devops-sre-platform/skills/cicd-pipelines/SKILL.md, specializations/devops-sre-platform/skills/gitops/SKILL.md, specializations/devops-sre-platform/skills/secrets-management/SKILL.md
-- Agents: general-purpose, specializations/devops-sre-platform/agents/platform-engineer/AGENT.md, specializations/devops-sre-platform/agents/cicd-specialist/AGENT.md
-- Processes: cradle/project-install, methodologies/gsd/quick.js, methodologies/gsd/verify-work.js, methodologies/gsd/iterative-convergence.js, methodologies/evolutionary.js, specializations/devops-sre-platform/iac-testing.js

.a5c/quality-gates.json

@@ -1,53 +0,0 @@
-{
-  "qualityThreshold": 80,
-  "testCoverage": {
-    "minimum": 0,
-    "rationale": "NixOS configuration repository without a coverage-producing test suite."
-  },
-  "formatting": [
-    {
-      "name": "alejandra",
-      "command": "alejandra .",
-      "ciCommand": "alejandra --check ."
-    }
-  ],
-  "linting": [
-    {
-      "name": "statix",
-      "command": "statix check ."
-    },
-    {
-      "name": "deadnix",
-      "command": "deadnix . --fail"
-    }
-  ],
-  "evaluation": [
-    {
-      "name": "flake outputs",
-      "command": "nix flake show"
-    },
-    {
-      "name": "affected host dry-run",
-      "command": "sudo nixos-rebuild dry-run --flake .#<host>",
-      "when": "Run for affected hosts when practical and safe."
-    }
-  ],
-  "commitChecks": [
-    "alejandra .",
-    "statix check .",
-    "deadnix . --fail",
-    "nix flake show"
-  ],
-  "deployGates": [
-    "formatting passes",
-    "linting passes",
-    "flake outputs evaluate",
-    "affected host dry-run succeeds",
-    "secrets are encrypted and host secret modules remain aligned"
-  ],
-  "cicdIntegrationPoints": [],
-  "cicd": {
-    "enabled": false,
-    "notes": "No CI/CD integration is currently configured. Add Gitea Actions later if automated Babysitter or Nix validation is desired."
-  }
-}

.gitignore

@@ -46,10 +46,3 @@ CLAUDE.md
 .dolt/
 *.db
 .beads-credential-key
-
-# --- babysitter managed ---
-.a5c/creds.env
-.a5c/creds.env.tmp.*
-.a5c/logs/
-.a5c/runs/
-# --- end babysitter managed ---

flake.nix

@@ -15,21 +15,17 @@
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-26.05";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.11";
-    # nixpkgs-45570c2.url = "github:nixos/nixpkgs/45570c299dc2b63c8c574c4cd77f0b92f7e2766e";
+    nixpkgs-45570c2.url = "github:nixos/nixpkgs/45570c299dc2b63c8c574c4cd77f0b92f7e2766e";
-    # nixpkgs-locked.url = "github:nixos/nixpkgs/2744d988fa116fc6d46cdfa3d1c936d0abd7d121";
+    nixpkgs-locked.url = "github:nixos/nixpkgs/2744d988fa116fc6d46cdfa3d1c936d0abd7d121";
-    # nixpkgs-9e58ed7.url = "github:nixos/nixpkgs/9e58ed7ba759d81c98f033b7f5eba21ca68f53b0";
+    nixpkgs-9e58ed7.url = "github:nixos/nixpkgs/9e58ed7ba759d81c98f033b7f5eba21ca68f53b0";
     nixpkgs-master.url = "github:nixos/nixpkgs/master";
 
-    m3ta-nixpkgs = {
+    m3ta-nixpkgs.url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs";
-      url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs";
-      inputs.nixpkgs.follows = "nixpkgs";
-      # url = "path:/home/m3tam3re/p/NIX/nixpkgs";
-    };
-
     llm-agents.url = "github:numtide/llm-agents.nix";
 
+    #
     nur = {
       url = "github:nix-community/NUR";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -43,16 +39,46 @@
 
     nixos-generators = {url = "github:nix-community/nixos-generators";};
 
+    hyprpanel.url = "github:Jas-SinghFSU/HyprPanel";
     rose-pine-hyprcursor.url = "github:ndom91/rose-pine-hyprcursor";
     nix-colors.url = "github:misterio77/nix-colors";
 
     m3ta-home = {
       url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home";
-      # url = "path:/home/m3tam3re/p/NIX/m3ta-home";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    hermes-agent.url = "github:NousResearch/hermes-agent/v2026.8.3";
+    agents = {
+      # url = "path:/home/m3tam3re/p/AI/AGENTS";
+      url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/AGENTS";
+    };
+    ## Skills
+    skills-basecamp = {
+      url = "github:basecamp/basecamp-cli";
+      flake = false;
+    };
+    skills-anthropic = {
+      url = "github:anthropics/skills";
+      flake = false;
+    };
+    skills-kestra = {
+      url = "github:kestra-io/agent-skills";
+      flake = false;
+    };
+    skills-superpowers = {
+      url = "github:obra/superpowers";
+      flake = false;
+    };
+    skills-vercel = {
+      url = "github:vercel-labs/skills";
+      flake = false;
+    };
+    hermes-agent.url = "github:NousResearch/hermes-agent/v2026.5.7";
+
+    rustfs = {
+      url = "github:rustfs/rustfs-flake";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = {
@@ -62,6 +88,7 @@
     nixpkgs,
     m3ta-nixpkgs,
     nur,
+    agents,
     ...
   } @ inputs: let
     inherit (self) outputs;
@@ -77,7 +104,8 @@
   in {
     packages =
       forAllSystems (system: import ./pkgs nixpkgs.legacyPackages.${system});
-    overlays = allOverlays;
+    overlays = removeAttrs allOverlays ["mkLlmAgentsOverlay"];
+    lib.mkLlmAgentsOverlay = allOverlays.mkLlmAgentsOverlay;
     homeManagerModules = import ./modules/home-manager;
 
     nixosConfigurations = {
@@ -104,6 +132,7 @@
           inputs.disko.nixosModules.disko
           agenix.nixosModules.default
           m3ta-nixpkgs.nixosModules.default
+          inputs.rustfs.nixosModules.rustfs
         ];
       };
       m3-kratos = nixpkgs.lib.nixosSystem {
@@ -162,6 +191,11 @@
         inherit system;
         config.allowUnfree = true; # Allow unfree packages in devShell
       };
+      m3taLib = m3ta-nixpkgs.lib.x86_64-linux;
+      rules = m3taLib.coding-rules.mkCodingRules {
+        inherit agents;
+        languages = ["nix"];
+      };
     in {
       default = pkgs.mkShell {
         buildInputs = with pkgs; [
@@ -172,6 +206,7 @@
           statix
           deadnix
         ];
+        inherit (rules) instructions shellHook;
       };
     });
   };

hosts/common/default.nix

@@ -21,8 +21,7 @@
     useGlobalPkgs = true;
     useUserPackages = true;
     extraSpecialArgs = {
-      inputs = inputs // {agents = null;};
+      inherit inputs outputs system;
-      inherit outputs system;
       videoDrivers = config.services.xserver.videoDrivers or [];
     };
   };
@@ -32,19 +31,15 @@
     overlays = [
       # Add overlays your own flake exports (from overlays and pkgs dir):
       #outputs.overlays.additions
-      outputs.overlays.modifications
+      #outputs.overlays.modifications
       outputs.overlays.stable-packages
-      # outputs.overlays.locked-packages
+      outputs.overlays.locked-packages
-      # outputs.overlays.pinned-packages
+      outputs.overlays.pinned-packages
       outputs.overlays.master-packages
 
       inputs.m3ta-nixpkgs.overlays.default
-      # inputs.m3ta-nixpkgs.overlays.modifications
+      inputs.m3ta-nixpkgs.overlays.modifications
-      # llm-agent packages under the `pkgs.llm-agents.*` namespace, built
+      (outputs.lib.mkLlmAgentsOverlay system)
-      # against this system's nixpkgs (needed for qmd.override cudaSupport
-      # with allowUnfree). Do NOT flatten to top-level attrs — see
-      # overlays/default.nix.
-      inputs.llm-agents.overlays.shared-nixpkgs
       # You can also add overlays exported from other flakes:
       # neovim-nightly-overlay.overlays.default
 
@@ -72,30 +67,16 @@
         "m3tam3re"
       ]; # Set users that are allowed to use the flake command
     };
-    # Garbage collection is handled by programs.nh.clean on each host.
+    gc = {
-    # Keep nix.gc.automatic disabled to avoid dueling GC timers.
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
     optimise.automatic = true;
     registry =
       (lib.mapAttrs (_: flake: {inherit flake;}))
       ((lib.filterAttrs (_: lib.isType "flake")) inputs);
     nixPath = ["/etc/nix/path"];
   };
-  users.defaultUserShell = pkgs.bashInteractive;
+  users.defaultUserShell = pkgs.nushell;
-  programs.bash = {
-    enable = true;
-    interactiveShellInit = ''
-      # Interactive bash -> nushell, unless started deliberately from
-      # nu/bash (parent check — an exported env marker would leak into
-      # zellij/zed/herdr children). Non-interactive bash (ssh command
-      # exec, Mosh app bootstrap) stays bash.
-      if [[ $- == *i* ]]; then
-        parent=""
-        [[ -r /proc/$PPID/comm ]] && IFS= read -r parent < /proc/$PPID/comm
-        if [[ "$parent" != "nu" && "$parent" != "bash" ]]; then
-          exec ${pkgs.nushell}/bin/nu --login
-        fi
-        unset parent
-      fi
-    '';
-  };
 }

hosts/common/extraServices/virtualisation.nix

@@ -21,22 +21,9 @@ in {
       };
     };
     programs.virt-manager.enable = true;
+    systemd.services.virt-secret-init-encryption.enable = false;
     environment = {
       systemPackages = [pkgs.qemu];
-      etc = {
-        "ovmf/OVMF_CODE.fd" = {
-          source = "${(pkgs.OVMF.override {
-            secureBoot = true;
-            tpmSupport = true;
-          }).fd}/FV/OVMF_CODE.fd";
-        };
-        "ovmf/OVMF_VARS.fd" = {
-          source = "${(pkgs.OVMF.override {
-            secureBoot = true;
-            tpmSupport = true;
-          }).fd}/FV/OVMF_VARS.fd";
-        };
-      };
     };
   };
 }

hosts/common/ports.nix

@@ -39,11 +39,6 @@
       outline = 3019;
       authentik = 3023;
       tuwunel = 3024;
-      honcho = 3025;
-
-      # Agent infrastructure
-      hermes-api = 8642;
-      hermes-dashboard = 9119;
 
       # Home automation
       homarr = 7575;

hosts/common/users/m3tam3re.nix

@@ -90,7 +90,6 @@
           hyprland.enable = true;
           rofi.enable = true;
           wayland.enable = true;
-          dms.enable = true;
         };
         apps = {
           crypto.enable = true;
@@ -210,7 +209,7 @@
 in {
   # ── NixOS user definition ──
   users.users.m3tam3re = {
-    hashedPassword = "$y$j9T$ORX4btVZgs9Xjq2oIvzJm0$lXiPwaa0D6t.eMDIx1UBesEAMOkWXBoGwpeI7X0aS8D";
+    password = "12345";
     isNormalUser = true;
     description = "m3tam3re";
     extraGroups = [
@@ -228,18 +227,14 @@ in {
     ];
     openssh.authorizedKeys.keys = [
       "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3YEmpYbM+cpmyD10tzNRHEn526Z3LJOzYpWEKdJg8DaYyPbDn9iyVX30Nja2SrW4Wadws0Y8DW+Urs25/wVB6mKl7jgPJVkMi5hfobu3XAz8gwSdjDzRSWJrhjynuaXiTtRYED2INbvjLuxx3X8coNwMw58OuUuw5kNJp5aS2qFmHEYQErQsGT4MNqESe3jvTP27Z5pSneBj45LmGK+RcaSnJe7hG+KRtjuhjI7RdzMeDCX73SfUsal+rHeuEw/mmjYmiIItXhFTDn8ZvVwpBKv7xsJG90DkaX2vaTk0wgJdMnpVIuIRBa4EkmMWOQ3bMLGkLQeK/4FUkNcvQ/4+zcZsg4cY9Q7Fj55DD41hAUdF6SYODtn5qMPsTCnJz44glHt/oseKXMSd556NIw2HOvihbJW7Rwl4OEjGaO/dF4nUw4c9tHWmMn9dLslAVpUuZOb7ykgP0jk79ldT3Dv+2Hj0CdAWT2cJAdFX58KQ9jUPT3tBnObSF1lGMI7t77VU= m3tam3re@m3-nix"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZcjCKl0DRuOUOMXbM0GKY5JjvmyFpVZ/tRlTKWu/zp razr"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEZbg/Z9mnflXuLahGY8WOSBMqbgeqVIkIwRkquys1Ml sascha.koenig@azintec.com"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKCTBFMPCOpKerJBlcvH44602sGyJvgXrwYUegYf96D0 m3ta-adm"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZcjCKl0DRuOUOMXbM0GKY5JjvmyFpVZ/tRlTKWu/zp"
     ];
     packages = [inputs.home-manager.packages.${pkgs.stdenv.hostPlatform.system}.default];
   };
 
   # ── Home-Manager configuration via m3ta-home ──
   home-manager.users.m3tam3re = {
-    home.file.".bashrc".text = ''
-      . /etc/bashrc
-    '';
     imports =
       [
         # Load m3ta-home composition engine

hosts/m3-ares/home.nix

@@ -7,20 +7,7 @@
   lib,
   ...
 }:
-with lib; let
+with lib; {
-  lua = lib.generators.mkLuaInline;
-
-  startupCommand = command: {
-    _args = [
-      "hyprland.start"
-      (lua ''
-        function()
-          hl.exec_cmd(${builtins.toJSON command})
-        end
-      '')
-    ];
-  };
-in {
   config = mkMerge [
     # ── XDG / MIME defaults ──
     {
@@ -49,94 +36,39 @@ in {
       };
     }
 
-    # ── Hyprland monitor layout ──
+    # ── Hyprland monitor layout & host-specific rules ──
     (mkIf config.desktop.wm.hyprland.enable {
       wayland.windowManager.hyprland = {
         enable = true;
         settings = {
-          on = [
+          # Laptop internal + external HDMI
-            (startupCommand "tuxedo-backlight")
-          ];
           monitor = [
-            {
+            { output = "eDP-1";     mode = "preferred";       position = "0x0";     scale = 1.25; }
-              output = "eDP-1";
+            { output = "HDMI-A-1";  mode = "1920x1080@120";   position = "2560x0";  scale = 1; }
-              mode = "preferred";
-              position = "0x0";
-              scale = 1.25;
-            }
-            {
-              output = "HDMI-A-1";
-              mode = "1920x1080@120";
-              position = "2560x0";
-              scale = 1;
-            }
           ];
           workspace_rule = [
-            {
+            { workspace = 1; monitor = "eDP-1";    default = true; }
-              workspace = "1";
+            { workspace = 2; monitor = "eDP-1"; }
-              monitor = "eDP-1";
+            { workspace = 3; monitor = "eDP-1"; }
-              default = true;
+            { workspace = 4; monitor = "HDMI-A-1"; }
-            }
+            { workspace = 5; monitor = "HDMI-A-1"; border = false; rounding = false; }
-            {
+            { workspace = 6; monitor = "HDMI-A-1"; }
-              workspace = "2";
-              monitor = "eDP-1";
-            }
-            {
-              workspace = "3";
-              monitor = "eDP-1";
-            }
-            {
-              workspace = "4";
-              monitor = "HDMI-A-1";
-            }
-            {
-              workspace = "5";
-              monitor = "HDMI-A-1";
-              no_border = true;
-              no_rounding = true;
-            }
-            {
-              workspace = "6";
-              monitor = "HDMI-A-1";
-            }
           ];
           window_rule = [
-            {
+            { match = { class = "dev.zed.Zed" };            workspace = "1"; }
-              match.class = "dev.zed.Zed";
+            { match = { class = "Msty" };                    workspace = "1"; }
-              workspace = "1";
+            { match = { class = "^com.obsproject.Studio$" }; workspace = "2"; }
-            }
+            { match = { class = "^(brave-browser)$" };      workspace = "4"; opacity = 1.0; }
-            {
+            { match = { class = "^(vivaldi-stable)$" };     workspace = "4"; opacity = 1.0; }
-              match.class = "Msty";
+            { match = { class = "^steam_app_\\d+$" };       fullscreen = true; workspace = "5"; idle_inhibit = "focus"; }
-              workspace = "1";
-            }
-            {
-              match.class = "^(com.obsproject.Studio)$";
-              workspace = "2";
-            }
-            {
-              match.class = "^(brave-browser)$";
-              workspace = "4";
-              opacity = "1.0";
-            }
-            {
-              match.class = "^(vivaldi-stable)$";
-              workspace = "4";
-              opacity = "1.0";
-            }
-            {
-              match.class = "^steam_app_\\d+$";
-              fullscreen = true;
-            }
-            {
-              match.class = "^steam_app_\\d+$";
-              workspace = "5";
-            }
-            {
-              match.class = "^steam_app_\\d+$";
-              idle_inhibit = "focus";
-            }
           ];
         };
+        extraConfig = mkAfter ''
+          -- Host startup: TUXEDO backlight
+          hl.on("hyprland.start", function()
+            hl.exec_cmd("tuxedo-backlight")
+          end)
+        '';
       };
     })
   ];

hosts/m3-ares/services/default.nix

@@ -1,7 +1,7 @@
 {pkgs, ...}: {
   imports = [
     ./containers
-    ./greetd.nix
+    ./hermes-agent.nix
     ./netbird.nix
     #./n8n.nix
     ./mem0.nix
@@ -29,7 +29,7 @@
     gvfs.enable = true;
     trezord.enable = true;
     gnome.gnome-keyring.enable = true;
-    # qdrant.enable = true;
+    qdrant.enable = true;
     # qdrant = {
     #   enable = true;
     #   settings = {

hosts/m3-ares/services/greetd.nix

@@ -1,38 +0,0 @@
-# greetd login manager for m3-kratos (replaces broken GDM on nixos-unstable).
-# Uses tuigreet as the greeter, launching Hyprland after authentication.
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: let
-  tuigreet = "${lib.getExe pkgs.tuigreet}";
-  # Use start-hyprland wrapper to avoid Hyprland startup warnings
-  # withUWSM=true is set in programs.nix; start-hyprland handles this correctly
-  hyprlandCmd = "${config.programs.hyprland.package}/bin/start-hyprland";
-in {
-  services.greetd = {
-    enable = true;
-
-    settings = {
-      default_session = {
-        user = "greeter";
-        # Minimal config: verified supported flags only
-        # The --time and --remember are tested; power commands omitted
-        # to avoid potential quoting/parsing issues
-        command = builtins.concatStringsSep " " [
-          tuigreet
-          "--time"
-          "--remember"
-          "--asterisks"
-          "--cmd ${hyprlandCmd}"
-        ];
-      };
-    };
-  };
-
-  # Required for --remember to persist username between logins
-  systemd.tmpfiles.rules = [
-    "d /var/cache/tuigreet 0755 greeter greeter - -"
-  ];
-}

hosts/m3-ares/services/hermes-agent.nix

@@ -0,0 +1,184 @@
+{config, ...}: let
+  # Default ElevenLabs voice: Bella (German-capable female)
+  elevenlabsVoiceId = "hpp4J3VqNfWAUOO0d1Us";
+in {
+  services.hermes-agent = {
+    enable = true;
+    addToSystemPackages = true;
+
+    # Secrets via agenix
+    environmentFiles = [config.age.secrets."hermes-env".path];
+
+    # Non-secret environment variables
+    environment = {
+      GLM_BASE_URL = "https://api.z.ai/api/coding/paas/v4/";
+    };
+
+    settings = {
+      # ── Model ──────────────────────────────────────────────────────────
+      model = {
+        default = "glm-5.1";
+        provider = "zai";
+      };
+
+      credential_pool_strategies = {
+        zai = "fill_first";
+      };
+
+      toolsets = ["all"];
+
+      # ── Agent ──────────────────────────────────────────────────────────
+      agent = {
+        max_turns = 90;
+        gateway_timeout = 1800;
+        tool_use_enforcement = "auto";
+      };
+
+      # ── Terminal ───────────────────────────────────────────────────────
+      terminal = {
+        backend = "ssh";
+        modal_mode = "auto";
+        cwd = ".";
+        timeout = 180;
+        persistent_shell = true;
+      };
+
+      # ── Browser ────────────────────────────────────────────────────────
+      browser = {
+        inactivity_timeout = 120;
+        command_timeout = 30;
+        cloud_provider = "local";
+      };
+
+      # ── Checkpoints / Compression ──────────────────────────────────────
+      checkpoints = {
+        enabled = true;
+        max_snapshots = 50;
+      };
+
+      file_read_max_chars = 100000;
+
+      compression = {
+        enabled = true;
+        threshold = 0.5;
+        target_ratio = 0.2;
+        protect_last_n = 20;
+      };
+
+      # ── Display ────────────────────────────────────────────────────────
+      display = {
+        compact = false;
+        personality = "kawaii";
+        resume_display = "full";
+        busy_input_mode = "interrupt";
+        inline_diffs = true;
+        skin = "default";
+        tool_progress = "all";
+      };
+
+      # ── TTS / STT / Voice ──────────────────────────────────────────────
+      tts = {
+        provider = "elevenlabs";
+        elevenlabs = {
+          voice_id = elevenlabsVoiceId;
+          model_id = "eleven_multilingual_v2";
+        };
+      };
+
+      stt = {
+        enabled = true;
+        provider = "local";
+        local = {model = "base";};
+      };
+
+      voice = {
+        record_key = "ctrl+b";
+        max_recording_seconds = 120;
+        silence_threshold = 200;
+        silence_duration = 3.0;
+      };
+
+      # ── Memory ─────────────────────────────────────────────────────────
+      memory = {
+        memory_enabled = true;
+        user_profile_enabled = true;
+        memory_char_limit = 2200;
+        user_char_limit = 1375;
+      };
+
+      # ── Delegation ─────────────────────────────────────────────────────
+      delegation = {
+        max_iterations = 50;
+      };
+
+      # ── Discord ────────────────────────────────────────────────────────
+      discord = {
+        require_mention = true;
+        auto_thread = true;
+        reactions = true;
+      };
+
+      # ── Approvals / Security ───────────────────────────────────────────
+      approvals = {
+        mode = "manual";
+        timeout = 60;
+      };
+
+      security = {
+        redact_secrets = true;
+        tirith_enabled = true;
+        tirith_fail_open = true;
+      };
+
+      # ── Cron / Session ─────────────────────────────────────────────────
+      cron = {wrap_response = true;};
+
+      session_reset = {
+        mode = "both";
+        idle_minutes = 1440;
+        at_hour = 4;
+      };
+
+      # ── Web ────────────────────────────────────────────────────────────
+      web = {backend = "exa";};
+
+      # ── Platform Toolsets ──────────────────────────────────────────────
+      platform_toolsets = {
+        cli = [
+          "browser"
+          "clarify"
+          "code_execution"
+          "cronjob"
+          "delegation"
+          "file"
+          "image_gen"
+          "memory"
+          "session_search"
+          "skills"
+          "terminal"
+          "todo"
+          "tts"
+          "vision"
+          "web"
+        ];
+        telegram = [
+          "browser"
+          "clarify"
+          "code_execution"
+          "cronjob"
+          "delegation"
+          "file"
+          "image_gen"
+          "memory"
+          "session_search"
+          "skills"
+          "terminal"
+          "todo"
+          "tts"
+          "vision"
+          "web"
+        ];
+      };
+    };
+  };
+}

hosts/m3-atlas/programs.nix

@@ -5,7 +5,6 @@
     # here, NOT in environment.systemPackages
   ];
   programs.fish.enable = true;
-  programs.mosh.enable = true;
   programs.nh = {
     enable = true;
     clean.enable = true;

hosts/m3-atlas/secrets.nix

@@ -3,14 +3,6 @@
     secrets = {
       baserow-env = {file = ../../secrets/baserow-env.age;};
       ghost-env = {file = ../../secrets/ghost-env.age;};
-      honcho-selfhost-db-password = {
-        file = ../../secrets/honcho-selfhost-db-password.age;
-        owner = "postgres";
-        group = "postgres";
-        mode = "400";
-      };
-      honcho-selfhost-env = {file = ../../secrets/honcho-selfhost-env.age;};
-      honcho-selfhost-jwt-secret = {file = ../../secrets/honcho-selfhost-jwt-secret.age;};
       kestra-config = {
         file = ../../secrets/kestra-config.age;
         mode = "644";
@@ -18,7 +10,8 @@
       kestra-env = {file = ../../secrets/kestra-env.age;};
       littlelink-m3tam3re = {file = ../../secrets/littlelink-m3tam3re.age;};
       minio-root-cred = {file = ../../secrets/minio-root-cred.age;};
-      rustfs-env = {file = ../../secrets/rustfs-env.age;};
+      rustfs-access-key = {file = ../../secrets/rustfs-access-key.age;};
+      rustfs-secret-key = {file = ../../secrets/rustfs-secret-key.age;};
       n8n-env = {file = ../../secrets/n8n-env.age;};
       netbird-auth-secret = {
         file = ../../secrets/netbird-auth-secret.age;

hosts/m3-atlas/services/containers/default.nix

@@ -1,12 +1,13 @@
 {lib, ...}: {
   imports = [
-    # ./baserow.nix
+    ./baserow.nix
     ./ghost.nix
-    # ./honcho.nix
+    ./kestra.nix
     ./littlelink.nix
-    # ./matomo.nix
+    ./matomo.nix
     ./netbird.nix
     # ./n8n.nix
+    # ./pangolin.nix
     ./restreamer.nix
     ./slash.nix
     ./slash-nemoti.nix
@@ -14,7 +15,7 @@
   ];
   system.activationScripts.createPodmanNetworkWeb = lib.mkAfter ''
     if ! /run/current-system/sw/bin/podman network exists web; then
-      /run/current-system/sw/bin/podman network create web --subnet=10.89.0.0/24 --gateway=10.89.0.1
+      /run/current-system/sw/bin/podman network create web --subnet=10.89.0.0/24 --internal
     fi
   '';
 }

hosts/m3-atlas/services/containers/ghost.nix

@@ -1,10 +1,10 @@
 {config, ...}: {
   virtualisation.oci-containers.containers."ghost" = {
-    image = "docker.io/ghost:6-alpine";
+    image = "docker.io/ghost:latest";
     environmentFiles = [config.age.secrets.ghost-env.path];
     ports = ["127.0.0.1:3002:2368"];
     volumes = ["ghost_data:/var/lib/ghost/content"];
-    extraOptions = ["--add-host=mysql:10.89.0.1" "--ip=10.89.0.11" "--network=web" "--dns=8.8.8.8"];
+    extraOptions = ["--add-host=mysql:10.89.0.1" "--ip=10.89.0.11" "--network=web"];
   };
   # Traefik configuration specific to ghost
   services.traefik.dynamicConfigOptions.http = {

hosts/m3-atlas/services/containers/kestra.nix

@@ -0,0 +1,32 @@
+{config, ...}: {
+  virtualisation.oci-containers.containers."kestra" = {
+    image = "docker.io/kestra/kestra:latest";
+    environmentFiles = [config.age.secrets.kestra-env.path];
+    cmd = ["server" "standalone" "--config" "/etc/config/application.yaml"];
+    ports = ["127.0.0.1:3018:8080"];
+    user = "root";
+    volumes = [
+      "/var/run/docker.sock:/var/run/docker.sock"
+      "${config.age.secrets.kestra-config.path}:/etc/config/application.yaml"
+      "kestra_data:/app/storage"
+      "/tmp/kestra-wd:/tmp/kestra-wd"
+    ];
+    extraOptions = ["--add-host=postgres:10.89.0.1" "--ip=10.89.0.18" "--network=web"];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /tmp/kestra-wd 0750 1000 1000 - -"
+  ];
+
+  # Traefik configuration specific to littlelink
+  services.traefik.dynamicConfigOptions.http = {
+    services.kestra.loadBalancer.servers = [{url = "http://localhost:3018/";}];
+
+    routers.kestra = {
+      rule = "Host(`k.m3ta.dev`)";
+      tls = {certResolver = "godaddy";};
+      service = "kestra";
+      entrypoints = "websecure";
+    };
+  };
+}

hosts/m3-atlas/services/containers/netbird.nix

@@ -1,6 +1,5 @@
 {
   config,
-  lib,
   pkgs,
   ...
 }: let
@@ -122,7 +121,7 @@ in {
 
   virtualisation.oci-containers.containers = {
     "${serviceName}-dashboard" = {
-      image = "docker.io/netbirdio/dashboard:latest";
+      image = "netbirdio/dashboard:latest";
       autoStart = true;
       environmentFiles = [config.age.secrets."${serviceName}-dashboard-env".path];
       extraOptions = [
@@ -132,7 +131,7 @@ in {
     };
 
     "${serviceName}-server" = {
-      image = "docker.io/netbirdio/netbird-server:latest";
+      image = "netbirdio/netbird-server:latest";
       autoStart = true;
       ports = ["${toString stunPort}:${toString stunPort}/udp"];
       environmentFiles = [config.age.secrets."${serviceName}-server-env".path];
@@ -148,15 +147,12 @@ in {
     };
 
     "${serviceName}-proxy" = {
-      image = "docker.io/netbirdio/reverse-proxy:latest";
+      image = "netbirdio/reverse-proxy:latest";
       autoStart = true;
       ports = ["${toString wireguardPort}:${toString wireguardPort}/udp"];
       volumes = [
         "${serviceName}_proxy_certs:/certs"
       ];
-      environment = {
-        NB_PROXY_PRIVATE = "true";
-      };
       environmentFiles = [config.age.secrets."${serviceName}-proxy-env".path];
       cmd = [
         "--domain=${proxyDomain}"

hosts/m3-atlas/services/default.nix

@@ -7,7 +7,7 @@
     ./rustfs.nix
     ./mysql.nix
     ./netbird.nix
-    # ./n8n.nix
+    ./n8n.nix
     ./paperless.nix
     ./postgres.nix
     ./searx.nix

hosts/m3-atlas/services/gitea-actions-runner.nix

@@ -5,7 +5,7 @@
 }: {
   services.gitea-actions-runner = {
     instances.default = {
-      enable = false;
+      enable = true;
       name = "${config.networking.hostName}-runner";
       url = "https://code.m3ta.dev";
       tokenFile = config.age.secrets.gitea-runner-token.path;

hosts/m3-atlas/services/paperless.nix

@@ -1,9 +1,4 @@
-{
+{config, ...}: {
-  config,
-  inputs,
-  pkgs,
-  ...
-}: {
   services.paperless = {
     enable = true;
     port = config.m3ta.ports.get "paperless";

hosts/m3-atlas/services/postgres.nix

@@ -18,11 +18,14 @@
       # Localhost connections (IPv4 and IPv6)
       host    all          postgres     127.0.0.1/32    scram-sha-256
       host    all          postgres     ::1/128         scram-sha-256
+      host    outline      outline      127.0.0.1/32    scram-sha-256
+      host    outline      outline      ::1/128         scram-sha-256
       host    paperless    paperless    127.0.0.1/32    scram-sha-256
       host    paperless    paperless    ::1/128         scram-sha-256
 
       # Podman network connections for Baserow
       host    baserow      baserow      10.89.0.0/24    scram-sha-256
+      host    kestra       kestra       10.89.0.0/24    scram-sha-256
       host    netbird      netbird      10.89.0.0/24    scram-sha-256
       host    authentik    authentik    10.89.0.0/24    scram-sha-256
 
@@ -35,7 +38,7 @@
   services.postgresqlBackup = {
     enable = true;
     startAt = "03:10:00";
-    databases = ["baserow" "paperless" "authentik" "netbird"];
+    databases = ["baserow" "paperless" "kestra" "authentik" "netbird"];
   };
   networking.firewall = {
     extraCommands = ''

hosts/m3-atlas/services/rustfs.nix

@@ -6,32 +6,37 @@
 }: {
   services.rustfs = {
     enable = true;
-    environmentFile = config.age.secrets.rustfs-env.path;
+    package = inputs.rustfs.packages.${pkgs.stdenv.hostPlatform.system}.default;
-    settings = {
-      RUSTFS_VOLUMES = "/var/storage/s3";
 
-      RUSTFS_ADDRESS = ":3008";
+    # Reuse existing MinIO data directory
-      RUSTFS_CONSOLE_ENABLE = "true";
+    volumes = "/var/storage/s3";
-      RUSTFS_CONSOLE_ADDRESS = ":3007";
 
-      RUST_LOG = "info";
+    # Keep same ports as MinIO to avoid changing Traefik and client configs
-    };
+    address = ":3008";
+    consoleEnable = true;
+    consoleAddress = ":3007";
+
+    # Credentials via agenix
+    accessKeyFile = config.age.secrets.rustfs-access-key.path;
+    secretKeyFile = config.age.secrets.rustfs-secret-key.path;
+
+    logLevel = "info";
   };
 
   # Traefik configuration — same routes as before
   services.traefik.dynamicConfigOptions.http = {
-    services.rustfs-console.loadBalancer.servers = [
+    services.minio-console.loadBalancer.servers = [
       {
         url = "http://localhost:3007/";
       }
     ];
-    services.rustfs.loadBalancer.servers = [
+    services.minio.loadBalancer.servers = [
       {
         url = "http://localhost:3008/";
       }
     ];
 
-    routers.rustfs = {
+    routers.minio = {
       rule = "Host(`s3.m3tam3re.com`)";
       tls = {
         certResolver = "godaddy";
@@ -39,31 +44,13 @@
       service = "minio";
       entrypoints = "websecure";
     };
-    routers.rustfs-console = {
+    routers.minio-console = {
-      rule = "Host(`s3c.m3ta.dev`)";
-      tls = {
-        certResolver = "godaddy";
-      };
-      service = "rustfs-console";
-      entrypoints = "websecure";
-    };
-    routers.rustfs-old = {
-      rule = "Host(`s3.m3ta.dev`)";
-      tls = {
-        certResolver = "godaddy";
-      };
-      service = "rustfs";
-      entrypoints = "websecure";
-      middlewares = ["subdomain-redirect"];
-    };
-    routers.rustfs-console-old = {
       rule = "Host(`minio.m3tam3re.com`)";
       tls = {
         certResolver = "godaddy";
       };
-      service = "rustfs";
+      service = "minio-console";
       entrypoints = "websecure";
-      middlewares = ["subdomain-redirect"];
     };
   };
 }

hosts/m3-atlas/services/traefik.nix

@@ -37,10 +37,6 @@
         };
         websecure = {
           address = ":443";
-          # NetBird (signal/management gRPC, proxy mapping stream) requires
-          # long-lived HTTP/2 streams — see https://docs.netbird.io/selfhosted/maintenance/configuration-files
-          # Default readTimeout (60s) kills the streams every minute.
-          transport.respondingTimeouts.readTimeout = "0s";
         };
       };
     };
@@ -89,6 +85,15 @@
         };
 
         routers = {
+          # ── Hermes Dashboard — Netbird mesh only ─────────────────────
+          hermes-dashboard = {
+            rule = "Host(`dash.m3ta.dev`)";
+            service = "hermes-dashboard";
+            entrypoints = ["websecure"];
+            tls = {
+              certResolver = "godaddy";
+            };
+          };
           api = {
             rule = "Host(`r.m3tam3re.com`)";
             service = "api@internal";

hosts/m3-hermes/programs.nix

@@ -1,7 +1,6 @@
 {pkgs, ...}: {
   programs.nix-ld.enable = true;
   programs.nix-ld.libraries = with pkgs; [];
-  programs.mosh.enable = true;
   programs.fish.enable = true;
   programs.nh = {
     enable = true;

hosts/m3-hermes/services/hermes-agent.nix

@@ -1,6 +1,5 @@
 {
   config,
-  lib,
   pkgs,
   inputs,
   ...
@@ -8,41 +7,40 @@
   # Edge TTS: Seraphina — friendly, multilingual German female voice (free, no API key)
   edgeVoice = "de-DE-SeraphinaMultilingualNeural";
 
-  agentSkillExclusions = {
+  # Extra Python packages from the container's writable venv layer.
-    m3ta-agents = [];
+  # matrix-nio is installed via pip in /home/hermes/.venv but the hermes
-    anthropic = ["pdf" "skill-creator" "xlsx"];
+  # process uses the read-only Nix store Python, so we inject the venv's
-    basecamp = [];
+  # site-packages via PYTHONPATH and provide libstdc++ for libolm (e2e).
-    kestra = [];
+  # NOTE: v0.13.0 upgraded to Python 3.12 — path updated accordingly.
-    mattpocock = ["grill-me" "caveman"];
+  venvSitePackages = "/home/hermes/.venv/lib/python3.12/site-packages";
-    superpowers = ["brainstorming" "systematic-debugging"];
+  gccLibPath = "${pkgs.stdenv.cc.cc.lib}/lib";
-    vercel = [];
-  };
 
-  agentLibSourceSelections =
+  # Build skills using agents flake lib for hermes user
-    lib.mapAttrs (_sourceName: exclude: {
+  hermesSkills = inputs.agents.lib.mkSkills {
-      skills = {
+    inherit pkgs;
-        all = true;
+    customSkills = "${inputs.agents}/skills";
-        inherit exclude;
+    externalSkills = [
-      };
+      {
-    })
+        src = inputs.skills-basecamp;
-    agentSkillExclusions;
+        skillsDir = "skills";
-
+      }
-  # Deterministic store renderer consumed directly by Hermes. m3ta-home
+      {
-  # re-exports the focused helper so nixos-config does not need a direct
+        src = inputs.skills-anthropic;
-  # agent-lib flake input.
+        skillsDir = "skills";
-  hermesSkills = inputs.m3ta-home.lib.mkHermesSkillsDir {
+      }
-    system = pkgs.stdenv.hostPlatform.system;
+      {
-    name = "hermes-agent-lib-skills";
+        src = inputs.skills-kestra;
-    lockFile = ../../../agent-sources.lock.json;
+        skillsDir = "skills";
-    sources = agentLibSourceSelections;
+      }
+    ];
   };
 in {
   virtualisation.docker.enable = true;
 
   systemd.tmpfiles.rules = [
-    "d /var/lib/hermes/.config 0755 hermes hermes -"
+    "d /home/hermes/.config 0755 hermes hermes -"
-    "d /var/lib/hermes/.config/tea 0755 hermes hermes -"
+    "d /home/hermes/.config/tea 0755 hermes hermes -"
-    "L+ /var/lib/hermes/.config/tea/yml - - - - ${pkgs.writeText "tea-yml" ''
+    "L+ /home/hermes/.config/tea/yml - - - - ${pkgs.writeText "tea-yml" ''
       logins:
         - name: m3ta
           url: https://code.m3ta.dev
@@ -53,38 +51,32 @@ in {
     ''}"
   ];
 
-  systemd.services.hermes-agent.restartTriggers = [hermesSkills];
+  systemd.services.copy-hermes-skills = {
+    description = "Copy agent skills to hermes home directory";
+    wantedBy = ["hermes-agent.service"];
+    before = ["hermes-agent.service"];
+    serviceConfig.Type = "oneshot";
+    serviceConfig.RemainAfterExit = true;
+    script = ''
+      mkdir -p /var/lib/hermes/.agents
+      cp -rT ${hermesSkills} /var/lib/hermes/.agents/skills
+      chown -R hermes:hermes /var/lib/hermes/.agents
+    '';
+  };
+
+  # Ensure 'uv' is in the hermes-agent service PATH so CronJobs and terminal
+  # sessions can use 'uv run' for PEP 723 scripts (e.g. garmin-daily.py).
+  systemd.services.hermes-agent.path = [pkgs.uv];
 
   services.hermes-agent = {
     enable = true;
     addToSystemPackages = true;
-    # v0.14 lazy-installs heavy optional backends by default. In the sealed
-    # Nix package, include the backends this host config actively uses so the
-    # gateway, Matrix bridge, memory, web search, TTS, and local STT work
-    # without runtime pip/uv mutation.
-    extraDependencyGroups = [
-      "matrix"
-      "honcho"
-      "exa"
-      "edge-tts"
-      "voice"
-    ];
 
     extraPackages = with pkgs; [
-      basecamp
       docker
-      llm-agents.herdr
-      llm-agents.opencode
-      pi-coding-agent
-      bun
       git
-      curl
-      jq
       tea
       nix
-      python3Minimal
-      llm-agents.qmd
-      uv
       zellij
     ];
 
@@ -113,7 +105,7 @@ in {
       # Bind to 0.0.0.0 so the Netbird interface can reach it.
       API_SERVER_ENABLED = "true";
       API_SERVER_HOST = "0.0.0.0";
-      API_SERVER_PORT = toString (config.m3ta.ports.get "hermes-api");
+      API_SERVER_PORT = "8642";
     };
 
     # ── Container mode (podman) ──────────────────────────────────────────
@@ -121,27 +113,21 @@ in {
       enable = false;
       backend = "podman";
       extraVolumes = ["/home/m3tam3re/p:/projects:rw"];
-      extraOptions = [];
+      extraOptions = [
+        "--env"
+        "PYTHONPATH=${venvSitePackages}"
+        "--env"
+        "LD_LIBRARY_PATH=${gccLibPath}"
+      ];
     };
 
     settings = {
       # ── Model ──────────────────────────────────────────────────────────
       model = {
-        default = "glm-5.3";
+        default = "glm-5.1";
         provider = "zai";
       };
 
-      fallback_providers = [
-        {
-          provider = "openai-codex";
-          model = "gpt-5.5";
-        }
-        {
-          provider = "minimax";
-          model = "MiniMax-M3";
-        }
-      ];
-
       credential_pool_strategies = {
         zai = "fill_first";
       };
@@ -153,14 +139,13 @@ in {
         max_turns = 90;
         gateway_timeout = 1800;
         tool_use_enforcement = "auto";
-        reasoning_effort = "high";
       };
 
       # ── Skills ─────────────────────────────────────────────────────────
 
       skills = {
         external_dirs = [
-          hermesSkills
+          "/var/lib/hermes/.agents/skills"
         ];
       };
 
@@ -294,7 +279,6 @@ in {
     isNormalUser = false;
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICAVF7jGP1S6vc5CxeBFD/UxiImHOgbPlKg8WYyNtOA3"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZcjCKl0DRuOUOMXbM0GKY5JjvmyFpVZ/tRlTKWu/zp"
     ];
   };
 }

hosts/m3-hermes/services/hermes-dashboard.nix

@@ -7,8 +7,6 @@
   # Netbird mesh VPN range — dashboard only accessible from mesh peers.
   # m3-atlas Traefik proxies to this port over Netbird.
   netbirdRange = "100.64.0.0/16";
-  apiPort = config.m3ta.ports.get "hermes-api";
-  dashboardPort = config.m3ta.ports.get "hermes-dashboard";
 
   # Reference the hermes-agent package from the running service config
   hermesPkg = config.services.hermes-agent.package or (inputs.hermes-agent.packages.${pkgs.stdenv.hostPlatform.system}.default or pkgs.hermes-agent);
@@ -16,10 +14,10 @@ in {
   # ── Hermes Dashboard systemd service ───────────────────────────────────
   # Web UI for managing Hermes Agent — sessions, config, kanban, cron, etc.
   #
-  # Flow: Browser → dash.m3ta.dev (TLS via m3-atlas Traefik) → Netbird → :${toString dashboardPort}
+  # Flow: Browser → dash.m3ta.dev (TLS via m3-atlas Traefik) → Netbird → :9119
   #
   # --insecure is required to bind 0.0.0.0 (hermes refuses non-localhost otherwise).
-  # Safe because firewall restricts the dashboard/API ports to Netbird mesh only.
+  # Safe because firewall restricts port 9119 to Netbird mesh only.
   systemd.services.hermes-dashboard = {
     description = "Hermes Agent Web Dashboard";
     after = ["network.target" "hermes-agent.service"];
@@ -31,7 +29,7 @@ in {
       User = "hermes";
       Group = "hermes";
 
-      ExecStart = "${hermesPkg}/bin/hermes dashboard --host 0.0.0.0 --port ${toString dashboardPort} --no-open --insecure";
+      ExecStart = "${hermesPkg}/bin/hermes dashboard --host 0.0.0.0 --port 9119 --no-open --insecure";
 
       # Environment matching the hermes-agent service
       Environment = [
@@ -53,17 +51,15 @@ in {
     };
   };
 
-  # ── Firewall: Hermes network endpoints only from Netbird mesh ──────────
+  # ── Firewall: Dashboard only from Netbird mesh ─────────────────────────
   networking.firewall = {
     extraCommands = ''
-      # Allow Hermes Dashboard and OpenAI-compatible API only from Netbird mesh VPN
+      # Allow Hermes Dashboard (9119/tcp) only from Netbird mesh VPN
-      ip46tables -A nixos-fw -p tcp --dport ${toString dashboardPort} -s ${netbirdRange} -j nixos-fw-accept
+      ip46tables -A nixos-fw -p tcp --dport 9119 -s ${netbirdRange} -j nixos-fw-accept
-      ip46tables -A nixos-fw -p tcp --dport ${toString apiPort} -s ${netbirdRange} -j nixos-fw-accept
     '';
 
     extraStopCommands = ''
-      ip46tables -D nixos-fw -p tcp --dport ${toString dashboardPort} -s ${netbirdRange} -j nixos-fw-accept 2>/dev/null || true
+      ip46tables -D nixos-fw -p tcp --dport 9119 -s ${netbirdRange} -j nixos-fw-accept 2>/dev/null || true
-      ip46tables -D nixos-fw -p tcp --dport ${toString apiPort} -s ${netbirdRange} -j nixos-fw-accept 2>/dev/null || true
     '';
   };
 }

hosts/m3-kratos/configuration.nix

@@ -1,11 +1,7 @@
 # Edit this configuration file to define what should be installed on
 # your system. Help is available in the configuration.nix(5) man page, on
 # https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
-{
+{pkgs, ...}: {
-  config,
-  pkgs,
-  ...
-}: {
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
@@ -15,10 +11,10 @@
   boot.supportedFilesystems = ["zfs"];
   boot.zfs.package = pkgs.zfs_unstable;
   boot.zfs.forceImportAll = false;
-  boot.zfs.forceImportRoot = false;
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
   boot.initrd.kernelModules = ["amdgpu"];
+  boot.kernelPackages = pkgs.linuxPackages_6_18;
   services.xserver.videoDrivers = ["amdgpu"];
   security.polkit.enable = true;
   security.pam.services.gdm.enableGnomeKeyring = true;

hosts/m3-kratos/default.nix

@@ -48,7 +48,6 @@
     podman.enable = true;
     virtualisation.enable = true;
   };
-  services.power-profiles-daemon.enable = true;
   services.ollama = {
     environmentVariables = {
       # HCC_AMDGPU_TARGET = "gfx1103";

hosts/m3-kratos/home.nix

@@ -7,22 +7,10 @@
   lib,
   ...
 }:
-with lib; let
+with lib; {
-  mkEnvVar = name: value: {
-    _args = [
-      name
-      value
-    ];
-  };
-in {
-  imports = [
-  ];
-
   config = mkMerge [
     # ── XDG / MIME defaults ──
     {
-      qt.platformTheme.name = mkForce "qtct";
-
       xdg = {
         enable = true;
         configFile."mimeapps.list".force = true;
@@ -48,95 +36,32 @@ in {
       };
     }
 
-    # ── Hyprland monitor layout ──
+    # ── Hyprland monitor layout & host-specific rules ──
     (mkIf config.desktop.wm.hyprland.enable {
       wayland.windowManager.hyprland = {
         enable = true;
         settings = {
+          # Dual monitor: DP-1 left, DP-2 right
           monitor = [
-            {
+            { output = "DP-1"; mode = "2560x1440@144"; position = "0x0";     scale = 1; }
-              output = "DP-1";
+            { output = "DP-2"; mode = "2560x1440@144"; position = "2560x0";  scale = 1; }
-              mode = "2560x1440@144";
-              position = "0x0";
-              scale = 1;
-            }
-            {
-              output = "DP-2";
-              mode = "2560x1440@144";
-              position = "2560x0";
-              scale = 1;
-            }
           ];
           workspace_rule = [
-            {
+            { workspace = 1; monitor = "DP-1"; default = true; }
-              workspace = "1";
+            { workspace = 2; monitor = "DP-1"; }
-              monitor = "DP-1";
+            { workspace = 3; monitor = "DP-1"; }
-              default = true;
+            { workspace = 4; monitor = "DP-2"; }
-            }
+            { workspace = 5; monitor = "DP-2"; }
-            {
+            { workspace = 6; monitor = "DP-2"; }
-              workspace = "2";
+            { workspace = 7; monitor = "DP-2"; }
-              monitor = "DP-1";
-            }
-            {
-              workspace = "3";
-              monitor = "DP-1";
-            }
-            {
-              workspace = "4";
-              monitor = "DP-2";
-            }
-            {
-              workspace = "5";
-              monitor = "DP-2";
-            }
-            {
-              workspace = "6";
-              monitor = "DP-2";
-            }
-            {
-              workspace = "7";
-              monitor = "DP-2";
-            }
-          ];
-          # m3ta-home sets QT_QPA_PLATFORMTHEME to gtk3 globally for Hyprland.
-          # ksnip crashes with duplicate GDK type registration under that Qt GTK
-          # platform theme, so use qtct for Qt apps on this host instead.
-          "env" = mkForce [
-            (mkEnvVar "XCURSOR_SIZE" "32")
-            (mkEnvVar "HYPRCURSOR_THEME" "Bibata-Modern-Ice")
-            (mkEnvVar "WLR_NO_HARDWARE_CURSORS" "1")
-            (mkEnvVar "XDG_CURRENT_DESKTOP" "Hyprland")
-            (mkEnvVar "XDG_SESSION_TYPE" "wayland")
-            (mkEnvVar "XDG_SESSION_DESKTOP" "Hyprland")
-            (mkEnvVar "XKB_DEFAULT_LAYOUT" "de")
-            (mkEnvVar "NIXOS_OZONE_WL" "1")
-            (mkEnvVar "QT_QPA_PLATFORM" "wayland;xcb")
-            (mkEnvVar "QT_QPA_PLATFORMTHEME" "qt5ct")
-            (mkEnvVar "QT_QPA_PLATFORMTHEME_QT6" "qt6ct")
           ];
           window_rule = [
-            {
+            { match = { class = "dev.zed.Zed" };            workspace = "1"; }
-              match.class = "dev.zed.Zed";
+            { match = { class = "Msty" };                    workspace = "1"; }
-              workspace = "1";
+            { match = { class = "^com.obsproject.Studio$" }; workspace = "2"; }
-            }
+            { match = { class = "^(brave-browser)$" };      workspace = "4"; opacity = 1.0; }
-            {
+            { match = { class = "^(vivaldi-stable)$" };     workspace = "4"; opacity = 1.0; }
-              match.class = "^(com.obsproject.Studio)$";
+            { match = { class = "^steam_app_\\d+$" };       idle_inhibit = "focus"; }
-              workspace = "2";
-            }
-            {
-              match.class = "^(brave-browser)$";
-              workspace = "4";
-              opacity = "1.0";
-            }
-            {
-              match.class = "^(vivaldi-stable)$";
-              workspace = "4";
-              opacity = "1.0";
-            }
-            {
-              match.class = "^steam_app_\\d+$";
-              idle_inhibit = "focus";
-            }
           ];
         };
       };

hosts/m3-kratos/programs.nix

@@ -19,7 +19,6 @@
     dedicatedServer.openFirewall = true;
     gamescopeSession.enable = true;
   };
-  programs.localsend.enable = true;
   programs.obs-studio = {
     enable = true;
     enableVirtualCamera = true;
@@ -46,7 +45,6 @@
     enable = true;
     clean.enable = true;
     clean.extraArgs = "--keep-since 4d --keep 3";
-    flake = "/home/m3tam3re/p/NIX/nixos-config";
+    flake = "/home/m3tam3re/p/nixos/nixos-config";
   };
-  programs.mosh.enable = true;
 }

hosts/m3-kratos/services/default.nix

@@ -1,9 +1,8 @@
 {pkgs, ...}: {
   imports = [
     ./containers
-    # ./greetd.nix
+    ./mem0.nix
-    # ./mem0.nix
+    # ./n8n.nix
-    ./n8n.nix
     ./netbird.nix
     ./postgres.nix
     ./sound.nix
@@ -20,7 +19,7 @@
     gvfs.enable = true;
     trezord.enable = true;
     gnome.gnome-keyring.enable = true;
-    # qdrant.enable = true;
+    qdrant.enable = true;
     avahi = {
       enable = true;
       nssmdns4 = true;

hosts/m3-kratos/services/greetd.nix

@@ -1,38 +0,0 @@
-# greetd login manager for m3-kratos (replaces broken GDM on nixos-unstable).
-# Uses tuigreet as the greeter, launching Hyprland after authentication.
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: let
-  tuigreet = "${lib.getExe pkgs.tuigreet}";
-  # Use start-hyprland wrapper to avoid Hyprland startup warnings
-  # withUWSM=true is set in programs.nix; start-hyprland handles this correctly
-  hyprlandCmd = "${config.programs.hyprland.package}/bin/start-hyprland";
-in {
-  services.greetd = {
-    enable = true;
-
-    settings = {
-      default_session = {
-        user = "greeter";
-        # Minimal config: verified supported flags only
-        # The --time and --remember are tested; power commands omitted
-        # to avoid potential quoting/parsing issues
-        command = builtins.concatStringsSep " " [
-          tuigreet
-          "--time"
-          "--remember"
-          "--asterisks"
-          "--cmd ${hyprlandCmd}"
-        ];
-      };
-    };
-  };
-
-  # Required for --remember to persist username between logins
-  systemd.tmpfiles.rules = [
-    "d /var/cache/tuigreet 0755 greeter greeter - -"
-  ];
-}

hosts/m3-kratos/services/n8n.nix

@@ -1,10 +1,13 @@
-{
+{lib, ...}: {
   services.n8n = {
-    enable = true;
+    enable = false;
     openFirewall = true;
     environment = {
       N8N_SECURE_COOKIE = "false";
       N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS = "false";
     };
   };
+  # Temporary fix for upstream module
+  systemd.services.n8n.serviceConfig.LoadCredential = lib.mkForce [];
+  systemd.services.n8n.environment.N8N_RUNNERS_AUTH_TOKEN_FILE = lib.mkForce null;
 }

overlays/default.nix

@@ -8,22 +8,29 @@
   # You can change versions, add patches, set compilation flags, anything really.
   # https://nixos.wiki/wiki/Overlays
   modifications = final: prev: {
-    # aardvark-dns 2.x has a DNS forwarding bug breaking external name
+    #   n8n = import ./mods/n8n.nix {inherit prev;};
-    # resolution in podman networks — pin to last 1.x from nixpkgs-stable.
-    aardvark-dns = import ./mods/aardvark-dns.nix {inherit (final) stable;};
 
-    # font-manager 0.9.4 does not compile against gtk4 4.22 (Vala errors
+    #   brave = prev.brave.override {
-    # in Gtk.DragIcon.get_for_drag) — apply the upstream fix from
+    #     commandLineArgs = "--password-store=gnome-libsecret";
-    # FontManager/font-manager#468 until our nixpkgs lock carries it.
+    #     };
-    font-manager = import ./mods/font-manager.nix {inherit prev;};
+
+    # hyprpanel = inputs.hyprpanel.packages.${prev.system}.default.overrideAttrs (prev: {
+    #   version = "latest"; # or whatever version you want
+    #   src = final.fetchFromGitHub {
+    #     owner = "Jas-SinghFSU";
+    #     repo = "HyprPanel";
+    #     rev = "master"; # or a specific commit hash
+    #     hash = "sha256-l623fIVhVCU/ylbBmohAtQNbK0YrWlEny0sC/vBJ+dU=";
+    #   };
+    # });
   };
 
-  # temp-packages = final: _prev: {
+  temp-packages = final: _prev: {
-  #   temp = import inputs.nixpkgs-9e9486b {
+    temp = import inputs.nixpkgs-9e9486b {
-  #     system = final.stdenv.hostPlatform.system;
+      system = final.stdenv.hostPlatform.system;
-  #     config.allowUnfree = true;
+      config.allowUnfree = true;
-  #   };
+    };
-  # };
+  };
 
   stable-packages = final: _prev: {
     stable = import inputs.nixpkgs-stable {
@@ -32,19 +39,19 @@
     };
   };
 
-  # pinned-packages = final: _prev: {
+  pinned-packages = final: _prev: {
-  #   pinned = import inputs.nixpkgs-9472de4 {
+    pinned = import inputs.nixpkgs-9472de4 {
-  #     system = final.stdenv.hostPlatform.system;
+      system = final.stdenv.hostPlatform.system;
-  #     config.allowUnfree = true;
+      config.allowUnfree = true;
-  #   };
+    };
-  # };
+  };
 
-  # locked-packages = final: _prev: {
+  locked-packages = final: _prev: {
-  #   locked = import inputs.nixpkgs-locked {
+    locked = import inputs.nixpkgs-locked {
-  #     system = final.stdenv.hostPlatform.system;
+      system = final.stdenv.hostPlatform.system;
-  #     config.allowUnfree = true;
+      config.allowUnfree = true;
-  #   };
+    };
-  # };
+  };
 
   master-packages = final: _prev: {
     master = import inputs.nixpkgs-master {
@@ -53,10 +60,9 @@
     };
   };
 
-  # llm-agent packages (qmd, herdr, beads, …) come from
+  # Factory: not a proper overlay itself — takes system to avoid the infinite
-  # inputs.llm-agents.overlays.shared-nixpkgs, applied directly in
+  # recursion that occurs when accessing final/prev.system while the fixed-point
-  # hosts/common/default.nix. They are consumed via the `pkgs.llm-agents.*`
+  # is still being computed.  Exposed via outputs.lib, not outputs.overlays.
-  # namespace — no flattening to top-level attributes (that clobbered
+  mkLlmAgentsOverlay = system: _final: _prev:
-  # nixpkgs attrs like buildNpmPackage/fetchPnpmDeps and needed a
+    inputs.llm-agents.packages.${system} or {};
-  # hard-to-maintain blocklist).
 }

overlays/mods/aardvark-dns.nix

@@ -1,12 +0,0 @@
-# aardvark-dns pinned to the 1.x series.
-#
-# aardvark-dns 2.x has a DNS forwarding bug that breaks resolution of
-# external hostnames in podman networks.  1.17.1 is the last 1.x release
-# and is taken from nixpkgs-stable (nixos-26.05), which ships it together
-# with netavark 1.17.2 — the same netavark version as our unstable input,
-# so this is the exact upstream-tested combination.
-#
-# No further wiring needed: the nixpkgs podman package pulls aardvark-dns
-# in via callPackage and symlinks it into libexec/podman (helpersBin), so
-# overriding the top-level attribute propagates to podman automatically.
-{stable}: stable.aardvark-dns

overlays/mods/font-manager.nix

@@ -1,19 +0,0 @@
-# font-manager 0.9.4: fix compilation against gtk4 >= 4.22 / newer Vala.
-#
-# In GTK 4.22 the Gtk.DragIcon.get_for_drag binding changed in the gtk4
-# vapi, turning `Gtk.DragIcon.get_for_drag(drag)` into a hard Vala error
-# ("use `new' operator to create new objects") in Collections.vala and
-# FontList.vala.  0.9.4 is the latest upstream release and even upstream
-# master is unfixed; the fix lives in FontManager/font-manager#468 and is
-# already carried as a patch by current nixpkgs master — but our locked
-# nixpkgs (and the locked nixpkgs-master input) predate it.
-#
-# Drop this overlay (and the patch file) once our nixpkgs lock advances
-# past nixpkgs@e2ad529-vendoring (pkgs/by-name/fo/font-manager carries
-# fix-compilation-error-with-newer-vala-versions.patch).
-{prev}:
-prev.font-manager.overrideAttrs (old: {
-  patches =
-    (old.patches or [])
-    ++ [./patches/font-manager-fix-compilation-error-with-newer-vala-versions.patch];
-})

overlays/mods/patches/font-manager-fix-compilation-error-with-newer-vala-versions.patch

@@ -1,37 +0,0 @@
-From e2ad529a88929bbc76906ac78260dacf4d8c8c6b Mon Sep 17 00:00:00 2001
-From: Jan Baier <jan.baier@amagical.net>
-Date: Fri, 1 May 2026 17:25:25 +0200
-Subject: [PATCH] Fix compilation error with newer Vala versions
-
-Fixes #467
----
- src/font-manager/Collections.vala | 2 +-
- src/font-manager/FontList.vala    | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/font-manager/Collections.vala b/src/font-manager/Collections.vala
-index 5e7f5cdb..43531e54 100644
---- a/src/font-manager/Collections.vala
-+++ b/src/font-manager/Collections.vala
-@@ -523,7 +523,7 @@ namespace FontManager {
-             var row = ((CollectionListRow) source.widget);
-             var drag_icon = new Gtk.Label(row.item_label.label);
-             drag_icon.add_css_class("FontManagerListRowDrag");
--            var gtk_drag_icon = (Gtk.DragIcon) Gtk.DragIcon.get_for_drag(drag);
-+            var gtk_drag_icon = new Gtk.DragIcon.get_for_drag(drag);
-             gtk_drag_icon.set_child(drag_icon);
-             return;
-         }
-diff --git a/src/font-manager/FontList.vala b/src/font-manager/FontList.vala
-index c8b170cb..9720dc2b 100644
---- a/src/font-manager/FontList.vala
-+++ b/src/font-manager/FontList.vala
-@@ -669,7 +669,7 @@ namespace FontManager {
-             widget_set_name(drag_count, "FontManagerListDragCount");
-             drag_icon.add_overlay(drag_count);
-             drag_count.set_label(selected_items.length.to_string());
--            var gtk_drag_icon = (Gtk.DragIcon) Gtk.DragIcon.get_for_drag(drag);
-+            var gtk_drag_icon = new Gtk.DragIcon.get_for_drag(drag);
-             gtk_drag_icon.set_child(drag_icon);
-             return;
-         }

secrets.nix

@@ -3,13 +3,13 @@ let
   m3-ares = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG+M4CygEQ29eTmLqgyIAFCxy0rgfO23klNiARBEA+3s";
   m3-kratos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDl+LtFGsk/A7BvxwiUCyq5wjRzGtQSrBJzzLGxINF4O";
   m3-helios = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIyHuLITpI+M45ZZem33wDusY2X988mBoWpD1HDeZNRJ";
-  m3-atlas = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmmqZ4GgDEXJgj8uYrZAr/EoLIA6LJGkTIyKGQD/60a";
+  m3-atlas = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBYK1wsFkUPIb/lX1BH7+VyXmmGSbdEFHnvhAOcaC7H";
   m3-hermes = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOXJ5y9u88KptDaG959Aj6eq0CCBePOw1SvEh/84wb4M";
 
   # USERS
-  m3ta-adm = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKCTBFMPCOpKerJBlcvH44602sGyJvgXrwYUegYf96D0";
+  m3tam3re = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3YEmpYbM+cpmyD10tzNRHEn526Z3LJOzYpWEKdJg8DaYyPbDn9iyVX30Nja2SrW4Wadws0Y8DW+Urs25/wVB6mKl7jgPJVkMi5hfobu3XAz8gwSdjDzRSWJrhjynuaXiTtRYED2INbvjLuxx3X8coNwMw58OuUuw5kNJp5aS2qFmHEYQErQsGT4MNqESe3jvTP27Z5pSneBj45LmGK+RcaSnJe7hG+KRtjuhjI7RdzMeDCX73SfUsal+rHeuEw/mmjYmiIItXhFTDn8ZvVwpBKv7xsJG90DkaX2vaTk0wgJdMnpVIuIRBa4EkmMWOQ3bMLGkLQeK/4FUkNcvQ/4+zcZsg4cY9Q7Fj55DD41hAUdF6SYODtn5qMPsTCnJz44glHt/oseKXMSd556NIw2HOvihbJW7Rwl4OEjGaO/dF4nUw4c9tHWmMn9dLslAVpUuZOb7ykgP0jk79ldT3Dv+2Hj0CdAWT2cJAdFX58KQ9jUPT3tBnObSF1lGMI7t77VU=";
   sascha.koenig = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEZbg/Z9mnflXuLahGY8WOSBMqbgeqVIkIwRkquys1Ml";
-  users = [m3ta-adm sascha.koenig];
+  users = [m3tam3re sascha.koenig];
 
   systems = [m3-atlas m3-ares m3-helios m3-kratos m3-hermes];
 in {
@@ -23,7 +23,8 @@ in {
   "secrets/kestra-config.age".publicKeys = systems ++ users;
   "secrets/kestra-env.age".publicKeys = systems ++ users;
   "secrets/minio-root-cred.age".publicKeys = systems ++ users;
-  "secrets/rustfs-env.age".publicKeys = systems ++ users;
+  "secrets/rustfs-access-key.age".publicKeys = systems ++ users;
+  "secrets/rustfs-secret-key.age".publicKeys = systems ++ users;
   "secrets/n8n-env.age".publicKeys = systems ++ users;
   "secrets/netbird-auth-secret.age".publicKeys = systems ++ users;
   "secrets/netbird-db-password.age".publicKeys = systems ++ users;
@@ -37,9 +38,6 @@ in {
   "secrets/basecamp-client-id.age".publicKeys = systems ++ users;
   "secrets/basecamp-client-secret.age".publicKeys = systems ++ users;
   "secrets/gitea-runner-token.age".publicKeys = systems ++ users;
-  "secrets/honcho-selfhost-db-password.age".publicKeys = systems ++ users;
-  "secrets/honcho-selfhost-env.age".publicKeys = systems ++ users;
-  "secrets/honcho-selfhost-jwt-secret.age".publicKeys = systems ++ users;
   "secrets/outline-key.age".publicKeys = systems ++ users;
   "secrets/restreamer-env.age".publicKeys = systems ++ users;
   "secrets/searx.age".publicKeys = systems ++ users;

secrets/basecamp-client-id.age

@@ -1,17 +1,25 @@
 age-encryption.org/v1
--> ssh-ed25519 WyOB4g hrA2+5CnksFy2xF6LsztnY/8tWZbxVH0WAY95BrjcW0
+-> ssh-ed25519 4NLKrw KVgzdtYwUeHfTWI0kyVizuCXcavP7QRNeF+8XkQAADI
-/b7cqI/Erlc4McGqU9e+DVJcU9PCWvN9wnsgxKhSygQ
+RLRWb0CqvON7Ue4kDnSDFjcFBqVqM8DDp+XjOuvZPIc
--> ssh-ed25519 5kwcsA J5ClFMFoVad6kACaTAZzz1y27X15k78J9fBiP1FqwR8
+-> ssh-ed25519 5kwcsA t/1m3S8bTGxlspSIsJ7TYkNd2Dj2LwI3QujaViwWgkk
-a5+RRCZ63Bnzaf/ogZLUJYijewDhc1swR3MeFS/uX0w
+Y5hrADXvBnWEJffiP4eE+x/Bk/osoEuWaHe40WwAGgA
--> ssh-ed25519 9d4YIQ 4ndCPUlYQ51RAWHtZfCAM34fSGPnKr+Zr6r6IJAMyzA
+-> ssh-ed25519 9d4YIQ ac6n1mFXDfGKxL0z0/meBxJ0uBp5u2qOntQCzpF1/BE
-BFH+m8/ttDMNPEtpsk3XcwVFkiohvuutlLM67Z+Akg0
+d4GUD0y2SMhSG7chSzy5J5fiPe8ubxgYqpoOfeQtgHw
--> ssh-ed25519 3Bcr1w YfUqH5spneMxZf9u/OpS1nLPKHRcrxrbwG+Z/HGXGV4
+-> ssh-ed25519 3Bcr1w VXpq7b5+Ok+rmVbUTHckj77rlPH0T1t8F3L1ioyKx0M
-EMPTt1zmhJuG0FsXnF0MsKmEJI9uPeX6qQVQnZ8Yh1A
+8q8tKBRBV9dZTnKVoOsV8y6K4G2eYhqwh080WvqumJo
--> ssh-ed25519 c4NQlA BmiPoNbWU0QEJwiAs1ICdLDw/UMCDG87HpusXUqIbX8
+-> ssh-ed25519 c4NQlA Cxx+PteoMdLYR7ARVlSY+hXChZhFvrr+EWPV0rz+wj4
-wx5k5RXIkOux31kkMiIBpQz522mQyvIub+SVAB3b20s
+QXQy3n7FoVWgKQ4xi2x2y7d+l4AqKLBqGwY9Vxu1K7o
--> ssh-ed25519 ++TqaQ se2jxoqQAKfbgbMENdtiIG7IVLsIVRUaTfz759yEHi8
+-> ssh-rsa DQlE7w
-PMnQ1CPGN5omZVrVDOUIvwa5E97B9tPtd+Vn5LsZTVc
+sBkktyV7JaL1NViEHoH4CxTalKI9vIkoCZPBkyomCnNJexbfyEFLH88JUeBuJu2f
--> ssh-ed25519 CSMyhg RJ9KHxLRocI7GKO0sjav5sGh/X/2GjrlicQ08nxKVwM
+zxVZOVRqfUyTPnPV7KOdMEFuOXZn92PMc3Qd4/mk3jmWgQcHd1DB73sWlRtrrJfn
-52l5XnpdMj3a3gzNhwdV7lUdeRJyCwZ9j0HOn6PTt/4
+PJLJwFr6WXuMz/wo7Vnxa+dAH09dhSoR08LQy96LDLYCt8sPzvPeYCBI7eZ6VMyr
---- KHsdd30ddmuUizobsZX1AuS/VNT37N1UNb/lLiBaWJE
++hhJp8tD1pRDbG3SE0R9VgLUX/FutFIuS/7ZkwvQtor37v9ne1e7/4kbYah+RPbe
-)m�ﾎ樓ﾌ^�py投qﾇyｬｵ�2国.ｭ�}Уﾅ z庖ﾓW謗ﾊｨ｡1ｰroﾛ:�ｵC#ﾃﾎhｭwLt･]q�Hv
+qUFVXOEq7A5QYjz7BBXbCtf7Iapg4XiIMHD5TRFhXvRfCymdHXtxKcIf9osWtRH9
+nBWqjJlLIi2r32IJZbM2Nx086vwM0F/MrTzFNydKC3UzCI2W5BCNohw8tCNLLlAW
+Ef1oK0HjJob3NUqAbVuj5vzpEaziksdqWX+khmAZYwZuu/9kTdaKj8DVWEXBC8Jw
+OKG74kTEpe11ZsUNYcVxG9e2OvhpCStcPZdzchts5ZLyZoS6JDXQZgnk+amgUCSY
+
+-> ssh-ed25519 CSMyhg vRXAIXq6DOzLwlRPgKYM9tT2FTGM3Sy9oiWpKA5ZZwI
+8vsuNkP+NS1cyi6dU1BeiqhmjC1OQrUY4IJSns6nDyY
+--- 6L/OMvw9H0PR96XMTSOh4NS5lOHl9aJumliYuxZcPCM
++.„à öçUEƒLêù£�sŸ>u!Þjõ“ï\úe”²`‘,q?·v¸¤rÖÈüï±á¹£ë´]Öw³²2ʸ’Ï{
„méÈá

secrets/basecamp-client-secret.age

@@ -1,17 +1,25 @@
 age-encryption.org/v1
--> ssh-ed25519 WyOB4g uzM5wk7ZIKIt+Rq5oXSV0oCAF/knLdpb8UMlCSrvzx8
+-> ssh-ed25519 4NLKrw zVS6W9IOVIQbpXQhL7GGWm87MPV/57rYwMU6gWrCPyI
-ZVDlIKYDeIgyB51ywXtuM2h/hhc8UHWS8+u86T/LMkI
+lgWep7WTRJ/uZLgH44YIYdsnsJclXTWBBPpgPY9VWKw
--> ssh-ed25519 5kwcsA 1mStFttlOH3YUPrGPqgrkcuLC2ORpEs6wc7Z5KZR8DM
+-> ssh-ed25519 5kwcsA awrHu9+jzXjvSg3ivJqcffXvVTtNV9B/W2Ey3pbzJBg
-zc8b/Uq0qvnRYP+zRpGTzqb7jjGd9y6EjtTNoa4NZ9c
+8GGXhUrT405a2KGZIztnnOF9S8oNnOHGq3icpRH5YxM
--> ssh-ed25519 9d4YIQ GZqO57qrMLBBCpSPMm9kFTvswl6aT2EWzz93e/9hPnM
+-> ssh-ed25519 9d4YIQ BHTm2aHH23DrESeUOoPqCENbr69tOl46VDePkqa0fhE
-5vZLSO0IKHSxu04e1POYFwiUSrBRFtIPmeVhFI0tbCI
+L6V0FRRQGDSRV0NoqdyPS+Jw3sTzPj1JkSuTx4mhd54
--> ssh-ed25519 3Bcr1w Y3w5ReBbm+7GsSDLY0w5ffBHo5DE/yV3MrjgDqiQITM
+-> ssh-ed25519 3Bcr1w 0Vkq0jms2bT+MtXfXeWBZ8WJxGADKBk1dSCSiVL9DWE
-L+/c/9TEpjr9dz1vj5abnFz7iSG882oEsITmx0W1yqo
+rTPKYMFe2VnBnOpcLIFeyFZDp3RS/Hz6H4XdTWGDzRc
--> ssh-ed25519 c4NQlA Y7XtK1ZjEalXEQNJDM8e7v72nn65p3xP9gE8fE6SGks
+-> ssh-ed25519 c4NQlA oij0yRVXl9hn8Rn2/ebOmfxUdJwTGiZO/4CSBXppWSc
-wL7ySo+AEwxlYJifZeOpojm1hO3MxufCA5tZDp6FKZg
+nPx4rsjWfumRRy7IctmVEl+IV41dmhsYD18Kntn3Tgs
--> ssh-ed25519 ++TqaQ Vg/yfEZb+vdjim45WjtyFD8znry1W8lJLacrVFYdKmY
+-> ssh-rsa DQlE7w
-SKimb6BidrI/CRU0sZx8C67qnvlCjka/dquIfSi6gfU
+lRns1CsVo49lMc2zmEqEgtLNyK9ltQOMDhuzxITte6RwFeUTgll7jJgPY/EKK5vG
--> ssh-ed25519 CSMyhg SZGrbDwQFEO7NKD5PNCmwKWUeRgeR+v7B0eZklSCZW8
+KUWyMqNZ59StUxmgJCYsu9jKMuTkd8VPlz2BM9AVHrA8iDpwbzkRUl5qvl7pC2vJ
-hjcMmlhhkQUrWMAqqpe+aIxW1PXvi+YlzwlUXNrTLFA
+Y4h3K1vw0Hjq7kB0XxMyf21aX7sIseC5J6FfieGbU41sFDHbGALDAMuuBSMXeAqd
---- ZDXA3ywzCiiHfYoaQcvGZDXDd8V0Ebe9F4/DEwDstL8
+XgmOeoXt4lTSdO3BX0csax1waDSDKfLkzSI0GWoljPRHhDU+5SnDAeraYZrC2d7v
-?Akõoæ>ûÖ^å*Œ‡â¼3';9z$[;)ÇQ~èÐZ Qt–_õG«Vk"¸v‹Äc¦$KY‡ø¹ÇÙ°š'ð
+BsTLiSSNbAKd7NnmT8w8l5HYloA9GStTmU2VGW+BOlkpVOXszbGrPrm07q/syPMy
+ZYQHLEaD6P65UvqMQAFOTewYV3Dtht7z++W6CJl86sN8wMaLKVWXqym5z9uJzJqh
+HNK9oCWGhPr516Y6rhGvJFn8opuwgteDYIz0tN3K/CEtRIgeuaJzDy5lYuOfU0Jt
+jag2u5lnPqXJAJH62FOoCFkpWdQ0pSW8FFBgGphe0dIIE8Kdxw1N/VFA4wlHC3Ke
+
+-> ssh-ed25519 CSMyhg gIOL+m8JjlSCAWihY3RFZ2XSjcLpf7A9OPiB4vFcFEE
+G0MtxPT8xpXaTx7ktqLxui7OcKhHCjItLe4pvAV/2DY
+--- eB/NDnhF6snyeQc9C8DsCZr7Om87zIcGBdddskeQvmo
+‘Q†wÆMrˆ�+&;~ëV¯y»PúCˆ¿ˆ®Ÿ¼‡Hí´à‰6LÌ�çåƶ¨aÕé›Ã)9¹óCáJýÃ�­ß~lÒ6+“Ä

secrets/hermes-gitea-token.age

@@ -1,17 +1,25 @@
 age-encryption.org/v1
--> ssh-ed25519 WyOB4g WsqwH1Ag1bQRiiB80jjzdZutoisT7i0gDirpqHU0Mkk
+-> ssh-ed25519 4NLKrw j+zQu+BGTMVhIEzhqECFLMqs8tK7P8zDF/0fumWTrSY
-Eos8bh2LRVN7sHx3cfpO9wmxhP3aBEOEuc4UPuUSAlI
+RqemJfrS6bf6r/Owh38FNV14JNqTP2ZtN8diUqJ0NTU
--> ssh-ed25519 5kwcsA 5XEok5gRN/JV3k5JyerBCdyyi2ZPnTod8CNFez1tKms
+-> ssh-ed25519 5kwcsA gYZEiF1oFwd7kddSzmmvFC7umpaD0y4DL2LAOHmmkkI
-Lzx4PYb6uSRxULUyDTy+t2h6YJ0plDQTwoMasc34DRE
+KcOSW/aExT0wJl2Fs97mVSj64CYGL8DsHbKZca3BdTo
--> ssh-ed25519 9d4YIQ zPPsxbjSn1UE7UOIg0cAaQwEBGa2WFWC5tH/ti8T/mY
+-> ssh-ed25519 9d4YIQ 41Mx+hpizRKeW4lu1gMcHVI4p5PqN202F/dJl0n9oTw
-ZF5jJ9Sp7508+QBj9AOydlQjxxN0nkHlQpnr2Lz1abs
+G9zr0kdbswSifyHzqlWNyYB1TEaQjxFyxs7mz9XM7Ko
--> ssh-ed25519 3Bcr1w c6jCupUbwcWx+tb3qHvLDaBZ31+Ba0RzD7erg4tw3xM
+-> ssh-ed25519 3Bcr1w 3FnDPnyWym3Pv70DBEg+tewH6GNM3S/mbbYPGjb1LiY
-OExbAelnOzx3D8O2LjVMZ/hDHdwCJW1m3nVFX2gz2hE
+TOpFTHq5XDoJoqfsDnProGUlXKwuGJQhYJf/f23bgKE
--> ssh-ed25519 c4NQlA pV9sCS5xsTtt56372D7k+G0vAWRNmgiI6zbd8wFhqhU
+-> ssh-ed25519 c4NQlA mpZuWGlXdmhqkta3SxcDcm/4dw017Zn9KS29WBznnzg
-U/6W1jfBS3i0adR39cgRs3cOX9SXq/h7/M+JdVP9syE
+3LjR5O5uezXy3toWAEAEPU4nVx69GYpbYQwQygoIwf4
--> ssh-ed25519 ++TqaQ tb36ZafJp27IVtmx21KOXIB40SCmsxOq730Ff7aYyTs
+-> ssh-rsa DQlE7w
-ZlT2QTXzCrAVyfcJwvdQMR8uejcfodDTHzr/ua0Y+Cs
+iK5n9EFFD3apn6eJJiAB6dom/llqgneXeSYWNN44Xm0Qez5H3slpn4779BiQwMrI
--> ssh-ed25519 CSMyhg mnYb1m3nhfibLBK6V66UZiG01NMUZUXrVsbAme/tuFM
+863iJj91E7KSgANfm3yP3JP8veuuwATk1lRjnk/Xx5AbIQjhlANK7SoNB938unKc
-FT5g0MsjBS/9dTs6BJbkpbLIdcouM8rAMab6S+6d2PA
+Syd5sA4NX/SRy5rlJUXmc1ZtJex1sc880xj9xEOrclhd1pMD7zPE647SUDz8FcEU
---- S0n3laCPoxtEmNRe0C8KG6e0ZiI9YG7/J2ax6C8g0aY
+BsHckU3+dKvlLcUVbFJCVfH9LBQezVRE2ajRQRy6FygwTkgrXpD9peTCXLBOacye
-A:´ŸÝOÊá „ï•þr
}Ø<IëŒDï€.^âÅæ÷nC’¼È£ßÕ7÷‹Äh)àA†6ûV–TâÎ}5·î“Hé(g+=¾©ñ
+IOzPCJUsDB0Ats5osq/xdYb23Qz5RaiztBhNuurI6gWkAim17f8sGIdlWirjQOvH
+NwTIArMT8vexBJsLtiYW0ZbLYPX+byidLRpuk2RXT1pfUMkeVWA2g1CgKCHKJbQG
+ef4EMFRPhRZ5Knd6279dXalbE2FTbt1uWpxhvjOF8E5O4lM6+3ApWf5d7c0qM6on
+jP4+Bn/sOIkVsiB1fjd6YqcXdyORNLqlwOsaCtvfLJ5t0EfebpP5Rigk13f2xddf
+
+-> ssh-ed25519 CSMyhg M6Nc06Maem8c92oFktCHl/FeNdevn8fazYJjxLygxSc
+h6E9GHEO8l9cKVEO6RlpzVJovuo7aOmKYXVDYHVBs1s
+--- RlUihZA7p0luD4sv9EY73wq9qIFWMHNnoNmxxVMO8OI
+¸å¿Ür	␍ŽcCuaÙ¹dŠÜð¹d+Þ»Wºõ¹w%Ú߉€¤¶ŠsM³ý)”yÁËÓ¢=\jðp˜"ÂÒéðåql

secrets/honcho-selfhost-db-password.age

@@ -1,17 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 WyOB4g PQFhjQHeeymsGZEc13bLd66087sPelcv37ewU6cRN0Q
-VWfJEoNyNZPt8ihoMfA6mBITf3ptMFn09bLSLykYD9g
--> ssh-ed25519 5kwcsA vgY71RKCRyyxJW2m0mEA4BwWR7zzcImLeCFwejDv0zw
-0hTGhczM2SQvJ8dwtD1aY3GwDFFI6sz4/h5rysFBPcE
--> ssh-ed25519 9d4YIQ biZntIHyd3wZIhfQYHubpsdjOzmHp9+3DX4d/8DrXQo
-lD1wij8a/OiBevf2jhcbrtJnVFvTxMzYqI6SsXyRffE
--> ssh-ed25519 3Bcr1w x2p4/XpPfRSCBNjU+WnZOuxqPSvEqnY+jrUItmS/WX8
-JJZ7hJ+yVy9ATFPHm13ESUHu9FvUkasKmezTu/WbmHw
--> ssh-ed25519 c4NQlA eFxngNtcNNU4OyOax4aRRcGhvfbFW/E0T7w474VTCiQ
-S3zPMdTmNQTs9CLJL8w6/7ai3S7Ec4Zcqju7zCIjXig
--> ssh-ed25519 ++TqaQ QbmnKOBSFcYlGlwa2MsBAA8UzFQJEF+SBw0lwdoGEHQ
-2fKEhwjtrnXMBJQr5HKJte0YN93/IhFcwYGAHe4ueLY
--> ssh-ed25519 CSMyhg aHMev0x3RlLEKNi/1F7+bDhYd3TARf3ELCfX+IdIA3Y
-zV5MbaCCPCptKK4FyuFUuscQmUBoXerzLx3/jg45Mi4
---- R6IzuH0eeM8VmEHHJPRcZzwjlFVzIwcxn5VTlao+yeg
-”µP�”ï]9Ó¡êj^i`é-w˜È0H'Fs«££ßCŒO31·@ÉýÓïwŸ!ð	…>b¹J=µó×�+ŽÅÉWXv\ #8</éo>·Zàê3ya ´ˆ_…Wç

secrets/honcho-selfhost-env.age

@@ -1,17 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 WyOB4g XpORoNWRCbKsJBAUS5TeC4FRoyL71Qtuo/tooCu86xo
-EO+6IcAhhcQNehmN8eBFfjHnipecr9QC6W2IMpey0KA
--> ssh-ed25519 5kwcsA dLm8uQ9rf0UwDZLFW3Xzrm6XiPSjZGekqkl8uIYH/3U
-JW1zBEhQ8cMAUGY5DuZjgPlGAx/xa+JLgiZFXD/Mukw
--> ssh-ed25519 9d4YIQ bfemPyKSM2E2/MM/jDo8SlrA07T5AWlkOu/m1N1D6SY
-XHVTZ/qT08FULKayVT3I/Ey62XwnOrQtLIfxfCWgfrs
--> ssh-ed25519 3Bcr1w a9eppZxhd0S3QKD6DndecGddXbUnMKT//2M2g71OMDw
-Q6sjYSAG6POHBUTMEF9Pj8wkiYV8AYQdjG4Q/HpCVpA
--> ssh-ed25519 c4NQlA Kn2Jmyc1V5PAP4YsCdqpRI3Aw2jQEEEnzoLWSGxEIXc
-Jsz4ea4eQltZoELfeyC7vDzdG8lLmJxPzZBRkiNmoBs
--> ssh-ed25519 ++TqaQ VVn0zZ7ZJLA2xHAVug6BphSYUPMhrZ/FB+JvUZzViEk
-58snUe1dHJcUrD1mCXBl6SBu2grnJ6yiuBmXtI6nhCw
--> ssh-ed25519 CSMyhg yebJxcw1VBxrJkjV7C0hKM+Lg4bsBG9LoeSsdsZVLHs
-rFjrnj1558TjSULRqQIcxLaMpoJmjBfL/qeoDxw9k5o
---- 7tNtB1EI4ULIpY5ZHnGr4J4hZRynWlqP/WcTkOl/Fe0
-È]œW�9“†¦yD£¤¶ÿê²–žJÓ‹‚Ü$Oè•@é™Â
HM}u¦d£�¹m²‘sõ’Bì½6[

secrets/minio-root-cred.age

@@ -1,17 +1,25 @@
 age-encryption.org/v1
--> ssh-ed25519 WyOB4g ljCDQGc4h9hHCCcshwWX0EBMHUkwLuT5anYkDT5KcFA
+-> ssh-ed25519 4NLKrw +/zFX1Q/Bgw6220OgEcI7EgWsI91gngvh8wLMbRG0S4
-iOSs9IXQG9C8E8+955EcVYxylMNXfkNmCK+0VeF4Joc
+uGbKIkhPA1HjW179Q/PFEph0xmvm5CWSB6ddNDW/Mjc
--> ssh-ed25519 5kwcsA G3Kin4iq5Bx67kWGxovrxSx1IB/P3zW+EE5/lQr/UnM
+-> ssh-ed25519 5kwcsA hRPrKuvK/7BBT1KdD2dEAF++6fTzzaHIFnyqVwM0J1g
-Sm46LiJHtLNBbHEjEk+3VE7+khoB/AMUtY8YabTv4Nk
+G6vohGGmMxHqPKlP9W1YItDA+CMXA7TCKvlBndKhjLw
--> ssh-ed25519 9d4YIQ trJJTwPdTSh25Gt1JIzn1z5JHZNUxeM1jKtCPRUQsTQ
+-> ssh-ed25519 9d4YIQ czK4KiVSzplor6qhuBGz3UQQBH5VALPnwHaTLn07uTk
-ShPXrA9zcHNzGvxf24yltKnE5LfqaSPnCm4smGp4Q7g
+FxD8pNNNUcHNNhEudMoNSd1VyDyBgTUr52OFJV84OFg
--> ssh-ed25519 3Bcr1w 80a9OItN6RrJj5twFNNIDaC3Cby8UVmMohpGjh8LsG4
+-> ssh-ed25519 3Bcr1w Bj2T816YmBI6EB6E5xt0zrkfV0ZfEf3WkrJIANOcWx4
-LIMAVI0Mo86MMcoiMBpbSp3zLdDt1omv/k4sYbycHiw
+oGr6INTE/9gx6DU/nOuhMJcXbYJAWnpmI7+1hatzvhY
--> ssh-ed25519 c4NQlA Z3B5IiE8uDB4ATkDDoOrHeGjgQnAxWkAwXE0Rs16qis
+-> ssh-ed25519 c4NQlA 53VFWqLxNuz5966Snpw/ALV3+nm6dzJ22oHG7HZenCg
-1qAWH7Q1rhVbn+rv544L9rGfpymGq+3cq8n+0KsI9SA
+SBNtTs9hjRGqFdZQSlhB1ZVDfIvo0chQS2tFeMB1mwI
--> ssh-ed25519 ++TqaQ oi9ZHcziV/F6fN8mVOnXaCJb3ITjHGpBNVUDiFWWfXs
+-> ssh-rsa DQlE7w
-vrLp6d+CpYuvv7nRx4IZyRh+l6lUEQO4bJJ1DcTiUpA
+lj9ZZGpjvx5QqTxVqci0b9eCOT//bn1esCMggSoB5L7qgmdDDc2uv9lwWm/8XWIb
--> ssh-ed25519 CSMyhg JwMCpsC8udEhILdfhBiFrBB8H5/yPIWw//T0CUO/NUc
+R6VKTUtUXRIH3OKd+fTbTsvVN1cOghnODqyEffOa6voZGMnnwkcvU7B0LqGrnIgR
-lGigHdJyba5CiK2Qfq+mW07zTX9qb9JgfmtuWLO8oik
+657gTDs1BPW3Gm8RB9Rk2CQpwcuIXbUvUR9lYXs94HbTuRIVJJFV1nnVVed3P12j
---- LRkxYqMQFbeZQvFzrmZ0zG6owRxOTGBcZRP8COuIflI
+dR3O8H+7ohOuZhSMoh5Ja1Z5fstWoV1cdKDfmSW3mFK0eZc/qsf+7ROqfKJVt3kv
-ÍŸg¾¼.ÿ{¶“ëc~ö–»ó˜YgÖˆCÚ怠‰]—)ÿ¯œgrsëO@¥A2(±¯¬´
,Åâ¡ß!†£÷\Õù®óþè6¥¾J+W̤͜û–ÆW/4"®ŸÏ™“;3Ü
+f6TClLZf004yf0p+snrqguWlVBRZhSeqVpm9PTfzizxLg+rafXIhbw1G9ankE+nP
+2yi6MT0I8sgVxnUcNmbwMG510DheJ8Su0rfAOEE9Rk34EEADnzwAY3Bsgv8iw0Ws
+E8dkSqX+gETf8Uaf0r8OyNmDLj7/DECq9uCvr80wwC5AA2F5DAyn2wOjGZbm3DdB
+erAe0RuZFVGzroLCIwKVS5jKTuTmNfpmiYuhOeoqGzbBU8ZQBj2W6UommHD+xgwv
+
+-> ssh-ed25519 CSMyhg 1wAgIuMsX6VTxrdo1BMcDzInrgWtYEXxGdgOME+5q0Q
+BfX6Wp14JURZ9k3BEgJ6SqkhPNA8kQ89plMJznCDOzA
+--- ro5KrLuMtpIM4Gf6sybFLkG6IETPspsa7vCKF0IvXHY
++–ù×yƒ–VÆÈMSÔX¡‡§�ûâEùßt«eLv?øÔG…×QX
Õó…ÉúŽ‹¤
A»Ï„¥…,¡£Œ/Éó,‡r„ÃjßHpl?cÙfjô=¤Öø½é[ï:cs^Î

secrets/netbird-auth-secret.age

@@ -1,17 +1,25 @@
 age-encryption.org/v1
--> ssh-ed25519 WyOB4g NnoyvqOz1aSKCLa6e+meCG8vYk4AgnK2yFmR6VFIURQ
+-> ssh-ed25519 4NLKrw 1YeW9LfXmOOApAit/eBGIIl1qFM5IBJP9poT47IIBB8
-v8MuGuZLZPoKCSiQu+NReQx3WXAf0rwAyxGCy07yqys
++oqa613hyllTSpHN9yjRXTDwZl9X4fffj6teZIdKx9I
--> ssh-ed25519 5kwcsA 0FUhtgonWT+I+aM65nArDRtRLsG8EOWKz5tAeNmXAmo
+-> ssh-ed25519 5kwcsA +gCzfVL1SAJF/xZ8SN8WLqJbPy3ibAarBkWJ31nSJBM
-QWQxrAojs1o5lMeSxf2hduM9IKJGIFAnxl2x6aHyL4M
+LpIa6NsLJtEnFpp9p2br72A/5gcwpx0uISejYg6LzjI
--> ssh-ed25519 9d4YIQ HZM/NW9ZmaQbvzIXyd4GzXYWPyLJma9UmyBLz8GJ4TE
+-> ssh-ed25519 9d4YIQ ZabgFxZX1mG3d+wFejcv9DdTT1TS4No7WYqQIQvw8Fk
-fCWdHiOtRB8JfP/sKm6Lw+BHQV5DQrfh/anluUu4Ius
+Z5cYGTk6Ma4Wb+ZzgRAbsZuIfjT4l98uOOBn5vuXUM0
--> ssh-ed25519 3Bcr1w 2MceCqTHEPA7ZzTlEDQsHkTvDCBl5J84ZwpEMT26wG0
+-> ssh-ed25519 3Bcr1w MxiP5fnT5BWjNAlK6ttgwWY/7FxUjKv9IqFVEh3Ac38
-Msk3G/wHvDkS/lxnPpgNvxxCKfakNnEORvTT8oyQErQ
++uxaqozcx5DS/bEU6s9fWy4wUUgsdiw20mOAR36xYCs
--> ssh-ed25519 c4NQlA FAleJbDgTdLim62jYz/jVEwAQg6Tc3eHaZTGoTumCiU
+-> ssh-ed25519 c4NQlA B1WL0A7M8xrbsBN5UXamNXN1RQ/0U8ISqiR+rolVoGM
-7Ia2goemrkRfCavUpjlwn7v+C7ixtQrrvGz6AiptiVU
+5mJNAYf5AHIwVOeH8TPniFd4na3p5GmgjsZA+15CCTg
--> ssh-ed25519 ++TqaQ kHh034/ivTVbxlSXhcH3xsjbrISkpO7jn/cZcJFt0Bs
+-> ssh-rsa DQlE7w
-AddJ0nSWKRoa89UPHT0aXPBU9KKdt2u0285wTASsyrY
+gn4MxqdrSk/dqhe+GBlSXyV4DdottL+CQo5H8oYWL98iJD7eDQuKxb1ewWRf6WqE
--> ssh-ed25519 CSMyhg /XwFvkVMST7FhpE2iiqZ0A39wXdWdRX5/i6PjI3BuQk
+ommyFB8hBXW2kuUtEscNllL5RGaHNWrP3CBfto/vxhaDPdTefhTS+ynmkppXv38R
-OzFYtdrU/Edp/wNJA/1Uoj6sn/GvwnsX1ywnmIOCaMg
+4FYrF3hswVZs2eepTWaR6MPSRyLsEsse0W0kcj4HiOnLZ/UDfe0VAzEB6C1DOvpt
---- jAXyWeAqVJLlV6F8qv2TjiglIsuImfwYn8eimbVoxlo
+XadU2YAR6tiNzmwkegBTDVByyQOf5VH7YFejeI4Rf2Q8qnTLfYDsEyThhHq9oxwV
-åAÝŸ^éýGƬJ(¿ôò3¢ª@Ñ8Y` 1º³½EvÑ[mRë¨zY@Üü°#À3µ2JEm]÷wfp‰qVÏ7iõFÑD“œZ„\
+AZkaVHGEazIUkDFG803qFZyNhLeJyh4rLEFrJbuRO4WIHUhq96oMJ9IJkX0qbZdh
+g9PYEX1G9YUdZpWk5lno8aPLLdDR/stBtOyw0EAv19yg5vuqYKJnk75bZ6Dba8Of
+8+e/KHVid39n2P73JQlC4dVNWVcAcecVKyxim1kwxFB3MVTvjWWfhVYIdMUr2OpN
+D7dykCmoVsRc9OJrzEjQ4RqY045YHjbKGw6GAnRM5ZGSk5vTFE6eBkhy9T2LFFZ0
+
+-> ssh-ed25519 CSMyhg V6U7l5m3lgV9f2HhMaiP9jO/5E3iH2yXYzCS8Jnj/V0
+sjvk1WhfKNtpoOAOGAqAzQCcxxMP3rAJN2gp2IG0GjE
+--- kKNuLSezCfpaCAQNTwnE6uArT0INDfeq5/C+1CE3Gh8
+Ą̃\¯¿­„f2?n‡}N<NÅF±ÊB~¹J‡…=€º´’#«9¸"p˜(¾Ö*¨�K¯ä§nèª÷àe¹Œ>Ò?8™õå+ ÏpSß

secrets/netbird-db-password.age

@@ -1,17 +1,25 @@
 age-encryption.org/v1
--> ssh-ed25519 WyOB4g gP2rRYMsnNFAgksIuYcBeEvMLT8MCB0XF3FYl8I2f0s
+-> ssh-ed25519 4NLKrw +LvrzIjrqMdJqhqt0EXB2nIhXoQ6k19icPKg2JfcMzQ
-4MPgXZ3VngItftYmhrlZ6fgR6jbtouVLo9dSlP48p9U
+q9/tvlJ4qzJMFQb3W8NFQ1vUhCEQJZyr4zZyqPSHk/c
--> ssh-ed25519 5kwcsA +WJSr4faVINieGeP2v/Savo78NrIfU18crziQ3jHP3Y
+-> ssh-ed25519 5kwcsA qomVI1vW/9dIxUCs0ZI9yzOdpuVsH3qoH/aLUKWOCH4
-3XyuJ0+fB4nQ5jMp38hQCBFUg/vFlWyBcFcvG7dHZe8
+0KeaxSICJBSLYBP5wl5PxBEXBCyKsldabmUrT8Rmrks
--> ssh-ed25519 9d4YIQ dB8aqBpClhWLD9mSP9bjCnK5xmO83R6ZMm6msrT+jyg
+-> ssh-ed25519 9d4YIQ taF4thF2VLbSw24kmAICp7LNDNZMsnjRkK4hz1remT4
-/WsTTeJBLldW9oRuziVnz7DbPGFM7JlTgYQ2vl7402A
+wNESxs8Cc4Bnu/+24V5RdA3Q7Uw8VAHS/Cr+8UNSHL0
--> ssh-ed25519 3Bcr1w wFCUQ3gMqHntpujPfD4q3a1zX7quALvmOsowsYnQpRA
+-> ssh-ed25519 3Bcr1w YrGrQLH9TrqAfKzrxfEMOIC3dHbR5cliHHG+jgpkgiM
-CbRQFe+whUwvjs8aC4XHJ7aosfN3ked6R2c9hFfGcEI
+hoXOnFmFcX5m4Qqk1+LDP+zZQl6+NwPlU8dTXStBy2c
--> ssh-ed25519 c4NQlA JYbqbza55Wjyf3Jsgxn8vkGyLjp0IT5UANt8c8MhtWY
+-> ssh-ed25519 c4NQlA pZNL9SPPc5gYRotMzYOaqm6WdEyujRTrI/k3qOgk7lg
-8m2FIuJ/7T2pBLA5WwS8n2BbdT55G0elQG/RituiHVw
+v0op6BPTpog4AHuBb5sSCB6BQbp8QFSZdJDn4ppSdC4
--> ssh-ed25519 ++TqaQ c0OGB33Si/Htv4MMQmC/LgeLxRf5UjuzPLuhrDn4WiM
+-> ssh-rsa DQlE7w
-QVwajFZZ2faynhUUZ21g/0bP1lBCy9q999JrFyNy5Xw
+Co9vmAJuKJstMQ2+rZJsyHHKplTPlWCBPA2YsOdpiVfMEkjuhF9WdtRFHQ72JZZe
--> ssh-ed25519 CSMyhg PsEMEe1c3iZuSDya5DJowxK5eS0SrviIUAd1ueydMFQ
+ktZhCv3MUsXOew0ktObskrgYsa31Ejbhy4JD5PcqIKRUr9SxuKZrBDK04B3xYj9Q
-XsDN4YC+RaCjmq/t3mCHVQrXMnIbW/DkmnpYYPgCMho
+FB/ziQb48sSDdnAp7kZ6KtFyG9eOTG7LhYc9rHK+DBUiDRvp493ypRMXDd1ZFhYj
---- EreT7qwTgYYLF1gan8mirsQLe3RQpF8iWT33SXzTOeE
+hirIQMIwiQmKMo5U/q5vYrRiTb4YmJsZpH8U4sl/xldtz5FCmiUsq9sIj7hvIaD1
-Ù¡³¾uyýµmůE³}2`z)fžnÿÝÁÛq,Ô2UkÝ72e’àOˆ26þ÷ù
+AmyCwCYYJemi5bQIfGiKnEZ4IYLt9h57CMDL/vXr3SzmoyKvUwgned7w5OFXFuaA
+B10CU2vN1htYtVz+g2c4Jx5ASVT2UMfDDdBCALfW6R+wXIYSbdzO1vTKcGFBio37
+DlnfctNpqUgduICZIIGi37zjPhM0tV+LpfcRV12a7UnHQFhW7roLtra+gfmGwrcO
+ivYCkdD4NvNEjCKRCst66Qb6/gYgGVEo34mTjh/3g2agxHuzeJOVwCRXWxqebtWI
+
+-> ssh-ed25519 CSMyhg ZU1CbyripaWZEZI1U/qZP/EfsDb1JKSrT5suTQKecG0
+pyC1p2nnaF5A7KnFBjJuxoyzKEAuC4wHFAr2wmX97HI
+--- 3KxuO0ZSOS3goo+OoO1R+pXgfeuhetca9PTapAjkZOY
+至+駃Q{毽錊v棱 鞩苰釲亭�󡘝3贕�芶`K桫妮WCn

secrets/netbird-encryption-key.age

@@ -1,17 +1,25 @@
 age-encryption.org/v1
--> ssh-ed25519 WyOB4g QghhMC1z3pSAP8vYVvafwhCv2nfiN1YS/Q+IP9FtnWo
+-> ssh-ed25519 4NLKrw FWpC9T6vAIctX6K7NR4lUJux+hnW0RiIYBGhHfr80SU
-JbDyF5P7g7UIUIhL62y2DB9oQcWpuXNxr8x5h+aRbts
+lpuAN98zrnj2XSrN68GKMKa1fRqInN9qoTAby4daos4
--> ssh-ed25519 5kwcsA arPTSjFhEgZKN2/POEvleAGYntcz4akDlhxZiPP66G4
+-> ssh-ed25519 5kwcsA 5iDc5J0ZLtPofhWqxA35mUJ/eAtyjL+zS5IUl86572U
-q2W2urqZir/aEnrEkGxVaVwfBMOdyERKsNxkI9k2N2w
+z13sCitLAndU/23P2OcAu2iS/6FHF3SyRViHTHz8EBE
--> ssh-ed25519 9d4YIQ 05hqWNllggLu5aqHwR15Xe9LYoppEyA1GN+/2LINgAI
+-> ssh-ed25519 9d4YIQ eEaMwGGQvQ2gwsJQEAOunyxpadkazt3218MGk4enakU
-KN+E1yvJEnQWg5HtiBPO/eOB1AGnUdpL97W3PO52XQk
+i6Vtw8ODaBgkc/biFM/5OPb5tqfc9O1pEj8gQ81zyik
--> ssh-ed25519 3Bcr1w CPs9tLsmIW30onKmJP4kslK2YP8GT13/YRLwHKz/mAI
+-> ssh-ed25519 3Bcr1w U5qcbz2AJA4snHpFbVcHumlzTzgan59UD0uroVzvPx0
-XlumXiAnW34rkXYfiern7ZvQjckor1Z7tbg5sNWryd0
+0rS0C+521gEMpRys5t8ecqFMkhZ1a0PKb+BxQsNCtqo
--> ssh-ed25519 c4NQlA 0FDNEjaGV4O55CYn+ajvt/vSsquzeT0XGsFvgU7qdjE
+-> ssh-ed25519 c4NQlA 8eKxwuYZYphL6NZemr1WfQjgEWKX7UMQYPoFudgWGV8
-d55BnlXMunb2bnvJOLLi/v71vuBmthpHj+DYSYiwNiY
+/x88KY3wxLrnQmMORRllRYUh65KPyZT9RELiRu6LKxM
--> ssh-ed25519 ++TqaQ l+6k9qrH0ZtJYA5br4nTknpheYPqw4B0hjyWQZ9itCY
+-> ssh-rsa DQlE7w
-z+KJDXvebRzaZNeWHiRad40RUkpRY608Z7rKQCgr9tU
+DLrdKj7KY7jUBcsYlBksTdKY1l+YHMmTmyiWeiANwgM4co1rrjZirtnntJPIVPn+
--> ssh-ed25519 CSMyhg Wg/VxX/6/Ed3rnWoHIVexAScpIdPMoeheamdzo5Cc2M
+Fc5tNJ0S6y+RvN+B69F4BgTljzoRLuIW0YYctk3NaNUuX9QOzF9jhbXoAW1iN4bj
-Sjg0lNY5853hbO3WEvs+o59a8xCNzp5avVFS8vYQEeI
+f4PK6Cw+Bn2ZJ76Feh+4xIQJxSAK0dIVaiJeHZy0/eI2GZdmRFY6f7iytdlacX4D
---- 64bKdonXtquzkjrQOZIYrm11QXObp0bBlR7JFe2Ji0o
+cJZkFdB8bPRDJuagTZMifWERhYZExdF1Q5XDYRpxycehSM9s1fvW2xCBPJMCjlCf
-‰u,0A«Ü[˜Ì z:†ÝàA´*Cœí˜ÔÌ¢÷«,X¿G4U^¹ÀëÄÊÇ…œSƒÜ¹…fEïì³¹|v�ã�
6÷ ´¯ÞW7c+È
+dCbqSAnCn+tDUfgV+M9FDRQwz72RLov92DcOWoIcP4D2Wm0cOMnk0Pbb9yB13E6e
+batyaLvuVPXKLle58bh09b2OR9zgy6RKsvTn3PNpogV8T50jEitVd7lDT+OvPcW4
+Dueb7q63IUKe/iuKmmW3w/S5Fi0JLUGVU+Ip8teIrNhJ19tPCkbRvbDWA5Mq2QAT
+ItYsEWTBf34JNrjEcmqOmnz70XgaelouClC0KXpLszSbOfEjxClBxOLfPYVioc8k
+
+-> ssh-ed25519 CSMyhg V0o0nL95KeGPxAwZF6RvJ19ZoDCaQcJusm6MXHeJJgs
+YFOaM5jwE9bUWx7al6JheB6BBT5asF5Tm1QjjVxueO8
+--- WCfgjJe6TKNKPtcU9BEWLZjF/z6Ccd+J86uiRwIHqbM
+ÚÔÂápÆ*ãÿ¨Ö$½Z±ÉÌÃVƒoEbú"Áw°�•6~,SR¬\÷ò␍Œ:7úD”�üæ”Ý<”n¨—ÒçoL¿taBp¤õ†‹12éÏ

secrets/netbird-proxy-env.age

@@ -1,17 +1,25 @@
 age-encryption.org/v1
--> ssh-ed25519 WyOB4g MpjRbeds5q0uRthy9DWseQfvwVZXeHkIEQk/BvgqTBo
+-> ssh-ed25519 4NLKrw 8/2l4YLhR20UzhNC5C1ALRi+ERnJmzfbDKOgiayqJh0
-XB+qMM6dErcpLE1G0MFlsgvvHlSQU+PwkxM0rlM9iX4
++AA7Ol+Ni3Dw0ba9czlqqcQQRG6GZCKYRuTEsaDttqs
--> ssh-ed25519 5kwcsA I5DqOw/8secbtxpm0A4YPa/9kJzfDkA4cPUPBpdlOiM
+-> ssh-ed25519 5kwcsA 91P0Y0VwfQHOtkS+aoMiysves73MVHTYmjSBU7H7bk8
-9V3SnCPYLONzO77mfwaBkPmTtmgNhSwA8XGgqZDAFfw
+rFX5VbH5G1Y4q8Q1AtSj8m03Q45pIehMsZA171N3oX8
--> ssh-ed25519 9d4YIQ wRHFpBUN0E1Oz6qRVr7ydv9et+xpXAsnDfUCGCTHxU8
+-> ssh-ed25519 9d4YIQ 4mQa4BvWBnp19042Ajz9KBDkwHeT0qgOKzxrfPEASwg
-cpDNKgQDilUMr7Ru+22XTAJuJ8QTX2cjvSW0pNF/wxw
+T5ipjK3xHMFsDY600XeLzMuFgb45Uae3keSC5fQt2Wk
--> ssh-ed25519 3Bcr1w snlBREU2AM85xkM8wwl3vIY/UjCZrey1Ws/sOQYfLGQ
+-> ssh-ed25519 3Bcr1w TxEF84qjfrzLscryLyRIB0wplcqTU68sHZNzSQfUBBQ
-s5tdY09lCICgySD/jNlP3A072kx+YWZMREVxfR6Vo70
+6uYAHPvUFSFDRs1ZPW5YpF73LV3Ubyc895weNME59vk
--> ssh-ed25519 c4NQlA M6texP/eQb4Q346cCI+J0AqmlWw3mVlRd0QhSbUzsTQ
+-> ssh-ed25519 c4NQlA mjiiGsAJINaPkgZTvbo08SplW8HnHBOBlItypKvsShU
-ue2DUqBShnlMHSDcLPhVWoTQHv9T5O/TJa+jN8IqGOM
+mebaeE5sfaaslPtCaqwDh3O0atlXHIirvVHk70d5NlU
--> ssh-ed25519 ++TqaQ +X0FlafOJwP9QAu29l8p+blLaQiZNOl8t6tBv48vdT8
+-> ssh-rsa DQlE7w
-2EYKZSCA+3sO7HaiaRCWd7YzWmBy7qvku3y52LeEUwI
+qex5N8/fRlkGdX08bMiYVxXV6bwSuHyeoVKp33lxjDJHriSgpJGOrRIPaztRIoW4
--> ssh-ed25519 CSMyhg zJ/XnwOLBJuZosafj29J9OMI1nV2fpXmkT5bgEAtsGA
+gyukJZoqlHIBSoLzXcmrXydaHUSPcDPLqw4csZZPfGJq3RjuDQKQMyiHe7xS9+Lh
-4ZeWdGbiiVK7cxyGU7d8QBjncrmacQeyEMgfrIzZ12M
+7RSpV5kpu81FwdV5szFF4cjV6klv3aP2sMut7WQyzxvJiHjO5gdoJnD4TBcdAa78
---- 8vjxije+hZQfjzhhBDkj5GZDKReXUpKn4Gr6GrPDBPw
+twWn8Bb6od8I9xMoqNOnq7w6nlC+AWmspWv5Iz1gV9KUMnbwFcu73axNfYHAFgU2
-¨B@Ä==[ƒá¦A+¤ŠZ¦xJÇÌÞ»°)É'	L
ŒZo�0|f§Õ„I\˜Ï=¶Ù“æˆLa~ϤæD趫9¤¡äãmX°\9CÊßî‰éØ03¾ÞBÃ

+R6CvL3LwYD5xkvS7JknYKcagDIuzOc1TvwYmEiQR476smP/vbwkn5Jnb5oILLcR7
+6QNd8NAg4Hn8Efcl/Uavm9i6ywn7RNzIS+PHV8iHha6sx8BsxiiYdMsS/KG9qogz
+eLp3/t47dFMvp5etdgHojGf/nH6no9EWjuX+oNeZsTExyW+HMMh7ItDxzupg3g1r
+2HZYwGvX44+IoSICROAxHuYmr8oUKhiAWTAGGUCcdPPAX6pIaXB6WpaY5fFyPXJt
+
+-> ssh-ed25519 CSMyhg e3b1Lr23YzRvHksn930vZYMl1z8xRzlQLiltH8ASmGg
+URFCzy/EhYs3l/hYJgZ/ufotlfX2x0/E44Nhu/9SbXI
+--- Ni5yTPCt/3piVUbdKPeYZTGyoY6J1o8HwtSYam2FgRM
+¾ãƒtÑÒã-Ytí`Rqst6ü€ê�pî�ᶃõzCƒr!ôŽ=co€Œk‚w9á°"±Tš7"Ë"␍Y^ßßø'±,Ì+NÀ¥Xk@òBCˆ¬àÇeô

secrets/netbird-server-env.age

@@ -1,17 +1,26 @@
 age-encryption.org/v1
--> ssh-ed25519 WyOB4g paYz+itgMDDQKlHS4wfZzN78RtsaH4qowEt7KHggOFg
+-> ssh-ed25519 4NLKrw p2ZuCHmfgR8iAF83JYqmwew1KUgW57xiz7WPTRC32l0
-DpSekGJpOKUWlOwZ/Sn5I+apOJdEJGlwAPuOjZnPU5Y
+Cy1600fvFxYHq8JkAi4N+/i8xwBqdRc4FfGEX5KNnPc
--> ssh-ed25519 5kwcsA oElzpBP+4jWqhmB8P/yc2aQQILdwuZ163bMbB6wTp1c
+-> ssh-ed25519 5kwcsA +FsTe6rqd1V1Ml5DXer/RWQCA+213bNrG6uhYFv+zFY
-MKOznEs5OU5zB6wus6AYwrSUjN99NqbP2bImIkfZ03s
+3fnw5cBKZOSw+mCfFcXw9VDjz4iR13sB2+CTvPtTOA8
--> ssh-ed25519 9d4YIQ 5lYmmCIsHPEsV48uoXu4HPj1JSWp7aCMUlfYCqbxPHI
+-> ssh-ed25519 9d4YIQ rsT4Tv0IAOGmMrXJT/K8fzfhdwIV37zDemrKQHYLQzw
-r/1bmUMZRCg4hmM9DnP/x+RaOL4iRS7VXz5JdKmtOHM
+y5nWezhU56iMGJlbLx3T6hqcfELeLiRSaERLJ54cIQQ
--> ssh-ed25519 3Bcr1w L6UtFDF5y1MNkC37Z5jGEnDFfEoqWs5pAVqShY0dzVw
+-> ssh-ed25519 3Bcr1w FN5u1gjtjLZsVZPYP1HnJq2LS3lJ9cP2yz6y9H8qB34
-dRioPbUjZhIxafJoGwXvkSNInuEXLKwvcAPOSyzBHjk
+mziulAWawSGJoBCJWt6Ctp9U41G0SAaHT9b2RYTmyhU
--> ssh-ed25519 c4NQlA qC4VmGqP3TC/x3W/jaYK8Jhdf2BW9oYlpHdZpGyUAEQ
+-> ssh-ed25519 c4NQlA gY9Cax1u3TdZSuhwuwn/oROm6h2/4hdj8O4HiiPkDGY
-GSgfw7qBBKHFTL40V4/t0VT4Kc7Jzr1Z7fIv/qmclrw
+eYP+yEzRtlTIprS5NfKr4pHjOjk8RDOlpCuGqflO3/M
--> ssh-ed25519 ++TqaQ T/Sz7uHRj4gkxsSKNwrYuRIVkklGH5iCPfQlVxCh3n8
+-> ssh-rsa DQlE7w
-+EdxFCPboc6drxHsvdFK51oTz3uafGgv2lnaG/poPj8
+bx+TsU3GEALbh0hD+334S1wggvGA6zcUb3R1f5MzF8OcNwFFWMGonStJBPXLodEa
--> ssh-ed25519 CSMyhg JDFjwNOM9LdlZO7EBoTOMTMI+a7kS8L7i9n2X1UqRmc
+cvfgSSVEJHHq8P3pmQoxgB5qv1fpgNRqWO/G+N5EmPFdnts2XfDfFuvtrTmCwLNC
-LHsCXWiQyTjPCxQTSsKA8ierxPApGEWr1sK567+EIBI
+5VRmLiCdVH31wIe71Qkomw37AjE2vgyu1MYe9fHECiRNhoyr9WEhSis/O2akdGVc
---- x+gz528sBIH8ChPbbCutRQ0JgtSGL1BVje9crfAsfS8
+IOL/mOPEwucoqVIJJG0qZHa7QXQJnMhC0XEwZJIGYbMRs5dLrgLtFq4TybRRyXa8
-ÁJ¼	,jz÷€MÏM®ç$YCÝ‘±ôÊõ]�T$åä´
é¼ØŽ‡k�Iæ5å-$ÅŒtäÁ‚hÄDXõ´Äô ü1»û!zyž(ë×ô"g(Ø�êqåIg$‚‚ؤZÅàxz‚Ø	]Å~MáÌö¨.üQ€l£@=GUDûÕê«v“£ê
+x2ELgT5SU0sdwki/raiCLyi5CD4tTOHImwSYEhfU/6rgJjzA4vI2qCwBgjEi6vK9
+y3LJgwV7d9ngXuWyKI/hsw7Mgn4eDL9FzvZ7ifFzJ/gWfaVE1xkSgv09eTvFY5cJ
+naYgeHwPitVQU1FmYWi3KcOwpUTa6xis6Jo9iJbT+511hw0B78p1x6WRA6077b6F
+ewjay+HWoswL9tMwokYN6XUnDu3DGqvHT5pSmmNEJmMMrOIVPIIM6D+wVFbzeUFH
+
+-> ssh-ed25519 CSMyhg juce3JYlAZOusDXo2AIeQUtIzkDw9VtWp9PiiRone2o
+W2awt7uAMPrtNNocRuukrbKzpn5iUFXhkt06ngmMyhg
+--- HgpiyiLgi81TJGFpYJnGHFEFvXsrUakUwBvc56hqevc
+ûúÛ]GÓaÇ:v3S�ŸÙÉ/¡0Ä/Àýá^“㬃cds­âùöœ{¯-YàÂ…ìäO­Aâ
Á†­îøI²‰•t5Øbs/ñƒïïhrj¦ù‚ð²ßyEàÌmpT#]ü1²Sš@¬
+£Vf‚G¾miw
émäÒ›|’æ²µËf•Ð”ë‡

secrets/paperless-key.age

@@ -1,17 +1,25 @@
 age-encryption.org/v1
--> ssh-ed25519 WyOB4g /TtTfjVbxknyTe4mL4+RPpFoDjh2hYI5RvjHedV+NmU
+-> ssh-ed25519 4NLKrw 00116Ozm0CeNhV+xXkojclJ5B8ulP/M1CV6u6thTFGg
-ct7/LFi56ileUQ1kOpUrLjOQl7XSCDFx0KnATG6qGPU
+Pacikayyy9dyJqJFm/6fd37Oz2j2GEDnYEVJ3NQ/lbY
--> ssh-ed25519 5kwcsA vyj+IQdPpdbpRLK/3ImD3qDRyjcJ+5c1+OaksgahiAQ
+-> ssh-ed25519 5kwcsA Qvk4nvZ40VIrhLE+uZgTPLO82eRCNdHRilZ82X/H9jE
-fuGq/KG2tt7Bwrboa4WxT6YJvszElDZnGlLkE+AYV40
+rjJVe6jyl9/zBBzQmlDguD8Lgy8P1/7PlMz8W3MSzXQ
--> ssh-ed25519 9d4YIQ uH9k1p2iSRVyI8RTw7kvs0tPwvp0xCt75RDW2y3JN3c
+-> ssh-ed25519 9d4YIQ kBSkme3/hpSAFVhc+zzBcSEiRkVlHFN4rx4PRsuCvmw
-WcM3MkcuYoud5Gz5YxM0zdF2VAJrNszDRi4wKSjOQZQ
+qlKxGNd8dbMjAnOuGueug1fJdPnRrBN7vjaEBEqF5tI
--> ssh-ed25519 3Bcr1w A9elhJ+ljCHah3ekVgYA/tQuUtyLrB6NkEYyJ1G7TH8
+-> ssh-ed25519 3Bcr1w 7LNSHsaXOkRtWVeP6vaZAVTPwwXEOHjhO/lsh1BqVRQ
-8Gl/N9msqylMEWq21AyccqMtNH9k9OpPi3W6SJKT2IY
+GgCGG9HbgvvJMtYL2/vfbc+mYb+1hPvSU6fb+I/okak
--> ssh-ed25519 c4NQlA OX0h2QjKyNsNvw6X7k63T28y1BaH/g4hGtly3i1eW38
+-> ssh-ed25519 c4NQlA dcXm7OXRmSxqvC91dT89Usn2aM8sR+uK18HVPH/E72c
-CbPT+mGWcS0FLz5WaHDCE/7+Ep+WzC1ourCBRGD8fFs
+/YW75+3nTlbPzEy43DOT6FOQceTzJVnPygG0NUvXvjQ
--> ssh-ed25519 ++TqaQ 7eyn8ACphPZYOkkNz1rTs3s9/yvDpnJR5HqjWhnXISM
+-> ssh-rsa DQlE7w
-c0BOsIk2hPrp0S5yJj3AJZn9aFBlYeVPuVSAGz5SM9Q
+KhfZIR/ucdUx2I9Z7/Tqk0KMQar3OWxoZEz3pnZgi9hC24VBxhyS0j1JXKhMrl2W
--> ssh-ed25519 CSMyhg duWS4ZnQckLwRaLbmiaCprpqKrAYYacdPp+vpf3VF3s
+oZF9uVb9JOc3duAXTbJ0g416QGQYG56eo7FzA3m7/ALOmTJzbXJOp3DuhmQ5tIxl
-EpDEvhbokTd+8vIZRLefsQYdssXlqZivDNosNO+4dx8
+8jSFtrZVuMDMcWNObBZdfipfRgE+Cn0P9dONsXF2GxxGn8/DXVjDKUxNI4DKl2uZ
---- 8pOU8Ur9VJrDyrbseLz3ZA9z1tlpAe7gS1rGrjwdka8
+E4K2/5nf3HhNOhjMWX0+VhbOTs3qtcs5tWycKzipODLl2j9svpW3okWWqy8aWR+u
-Œ/¸im)B.ÿÿ�Îy?j€ÿ´ÒêN͉ÌÍOjÙ ú¬
qå:ã*6Ó®~Æ^1#íAÌ×&¼sQÎMJ©?␍´ÑÆõ'Xj™¯†¸†�÷
+KNVX99//Eq5FleHJQk52BOOQBIzrkmiLluHlDFLsXiQGWnh7PpwmC0ip3VOeFaSz
+vMX5t6b4rE+28SeeG3iJ5fNz7XKRNJvZsDyGN5HhEcZJp3m42illxLF/7EXQxtLM
+mvPBsJa33xusTPkM9D9pBbAHzJIyR6ZLMI0wdV9KeWXH/yzNtTndYMekJw4k55yw
+kiflVaRDv9jt4XkyApLo93GmwTc0nly7Eju5A5JI5GrfZm1WwbcQlCcb+v3AuRLW
+
+-> ssh-ed25519 CSMyhg 3dnbUyluSARc0W2xBTz9T0XDMNkv3U+q+r7MG4oyNSg
+v3cECLlOG62zczYw1ym2SHBUtSP3Aw9KcENWD1kh2M0
+--- 1IOJhGjkrbvb3bB9Z4PKu9xmSa3FDChQ/0FuO7Zrepw
+}’ÎYÏa�‰·5|ÍÆ—�)ŸÒ°2.»);I;}|F'|#³ oêÁÈÖ¬ä¬ôNY +ð¨Õ²Ï×CS0¿Ñši‰Òësxî%ÙÏäŸ

secrets/ref-key.age

@@ -1,17 +1,25 @@
 age-encryption.org/v1
--> ssh-ed25519 WyOB4g o3fGqMXmFCUZc9sovrIP54jUGeZ/22YuyFp03RUJqgU
+-> ssh-ed25519 4NLKrw ONN3gzuDgI2PMfsfIb++dqxp8wPw3ThcbsdbTDkxai0
-xeRAkIVWDjptuSmJTLYFJaXfEyUWmU+GojprGGzHVas
+Zac4oZfgwLukIycGiuedjLFbJ4Me08BsjurBWjuqHWs
--> ssh-ed25519 5kwcsA K61fOEcKdu2z11bCV1ei16gh+Tdd7o4sygiPA4fMvVw
+-> ssh-ed25519 5kwcsA YdxxIewjWoWo2JZT6ywQWP/exKrGMfqJN6ktJYn8ayY
-xCmkZbcIougORgZ5SrVY0LyRJBLLH8W634xcmYJbhEk
+PX60BaNwuasTnvStUsu/KOqrnI3nWyCscH24fMCcWCw
--> ssh-ed25519 9d4YIQ ojKpx26VRPfzZwi3Z5XqRMb9PhGok2I5HmRKWxLd+wQ
+-> ssh-ed25519 9d4YIQ iraKK1wYdMGyPbD3s33QzCqueVkoaGc5PK8KcCl1bSI
-NiETzbpoCzFzwz5bczm0mV924YHRhHTZQ4nA5UIhZ9g
+pIhd5Rb61KQpP7/QaVzT01HVL/WKMS/rGpFneyqPOF8
--> ssh-ed25519 3Bcr1w qVo0BVQSJcb9QBiOrZ8yqxk6nDijapUkwP33MQMEPFc
+-> ssh-ed25519 3Bcr1w QTRRX4Bty5KQiOoy2BWpzE1/1YrDAeC9RCENrc7/eXQ
-D6C8siF92VmOCoioWiZbY05A4wy6BrAuGB5mqI6yERo
+UfE3zT64FwxbbFeygEmN/cb24H82hQjv2LPnNFig7oA
--> ssh-ed25519 c4NQlA YEwq6ULLIFbmpicbD3OUQy+7b6C0Rsmhf/1P/CJQTwY
+-> ssh-ed25519 c4NQlA ppG/ZxQLVA4cEPxDcZw5o1SB42ORHLdlIo29O7adWFE
-Nznm6HL7mSGTllcdY265/rDAzSzXkQITWqlRIL1qytE
+HcqGBMnB3aNMoIK64Wv8eMqOOP7wic3qgRRH8m7H8do
--> ssh-ed25519 ++TqaQ qe7CEy8BcKfd2Mb0JyMk93YTZXqdxhpCR68tYTr/ukM
+-> ssh-rsa DQlE7w
-VFxO8jM6+UNSZAVidpizQ/Ni7Vyyu5ffyhdHae+PIJA
+ZQbgQQR98VppYA/B+yYjboDeufJQwpA8t7o1dq3oBfMQgexYciRD73rasSqcZlIR
--> ssh-ed25519 CSMyhg Zis9qFXNRqi23QRmYNyxSgYbFoRdtKm62yWjHWAh1io
+XbELtn0XVxJIOF6qfUFrPPza3ewsr+5n+rxw/9PoWloLlUqBxWSwuUOtwKx7Epuy
-u/IqQsvUtUVYOR3OtmiGdYd1bzreTa7Hii0iOaL0w/U
+3uJ+1238+e/KR9vLFcSAPUucCqfgQ1okXdHbJwI0qPDX7MJ0Kxk+dJIoyI9fwcfy
---- MPhR+LMo453VFvi96q97cjaJklD18b2hmSax9wBUvFo
+PbgxqinWnAewM0Brcy4I3n/tBnVW8YGQ4hWqLhqI2tNwFEdZnyuMJQ6stfJEz3dq
-Š(„J˜x‹EŒAÃ�èÁÑ$ŒÆ¦añYfèÒeî�`;‡E“ú“¢0HùEþ­<M,²¡N¯7
+4FxOe4S6NZ0UUsVrenxi2+5O3FxQ4vl7yDxAxdGs0aPHiyPvqUZuvu10WrdhtMft
+iXhR8+XZS9FAF67DLOXDxF+mMMIdN/SszY/fZ6R7fa+sXbLpfGEtAtPL0/t6jrwP
+W5gMzDQD9/e3+wrYnVYvilvmUgYanC6bB2ne5L8TjnSokizb9r5sDzph0ztQVbn2
+5A6TmEqqtPFL5qG/CSrfoTHCFZ6CyhXU/NZ7ZWMCJXEb2ab4aaqJkPWfcVweiHQt
+
+-> ssh-ed25519 CSMyhg 0CeHfAwRth+O5PnBaR8VyhWxEXP8wT6ki0spZTXhBwo
+d78TJ+iK054rPfRO6pp7t2kf1dATi/4bYFDLE3Pcaww
+--- 9g35GK8Mvzx2dm3qr+L2aU31KEYHbAQrherGZzX16Ro
+#Uˆ�f3.æG0Æ
"gw$ˆN¨Ê§¼\<ß?Jà~0ðg@]3vÚº�¡ÐÀ–ƒˆ

secrets/restreamer-env.age

@@ -1,17 +1,25 @@
 age-encryption.org/v1
--> ssh-ed25519 WyOB4g znlomRQwoG7F8EoL60SJ09fRN7/B/LWXFKtDISmrm2M
+-> ssh-ed25519 4NLKrw quA7yedT47agjViOM1rm2UXkFXlkBrQ/szMyrP4pogI
-MAIitMZbd/oJu3rImFifUmQva/Igu9C+4sLFbY852/M
+j5cUgnyMNULbb+HjQMp9yPwvcn3EI/JZ2V4fRdlcnFA
--> ssh-ed25519 5kwcsA 59DIcdEsC9uifVJ2rGHn6Lv4od9T2XvG7G1tUdwHsmQ
+-> ssh-ed25519 5kwcsA mIMaDoRRSddDpiUBj3vn43AQoZPaD9Nj/LaqDD19CQo
-rkJBVsrDmsoat9EHQDVts6YEgA68eTHgyVp8tDLiEjU
+CxFWtIIoXweSdcGx7UwGMbgwYMk88H8ZmJ1u3C64HBA
--> ssh-ed25519 9d4YIQ FANDf99gKci19znoxixOQ7v70eq5rDFlEE0TuleUZhQ
+-> ssh-ed25519 9d4YIQ FHkrz8DpB8Ly1QcS872wAYaOp+LkgHK63/ydPCCMQxE
-k/ABQI9V2H65nNThy8axq/0M2CWfZgeq3GV30AKVcNQ
+wksDmByI4LZyAcyOJR3GZaOnUHvE6mpAQ5AWt5z9qbo
--> ssh-ed25519 3Bcr1w CDyTGjL9d+JNFq+fTiHfWPQZ4usZ2TdskKcwieZpM1Q
+-> ssh-ed25519 3Bcr1w t9n1d30mWWyBddc5z0bKxxZg1CGs7XN2lcECA75WjVs
-13wmA6U6XQW5OurCwJ/K9giJZv47jffySDhD0C3l8RA
+CidXDNx36aHh8IIgktW1Ybt+nzXWlmqhFH5TFoXC7mY
--> ssh-ed25519 c4NQlA SO0XyKTcsJGf6epggAgQDs+On+yzILjUG92GIQ5bTWI
+-> ssh-ed25519 c4NQlA 4jkAxmcrfsukN/meIthnMAgAeX50urT8LOY0JsDPU10
-YW9ATJpR60LJN1FNKeSCJ76HAkaJ0psm7R6NoXtyi28
+VTirLbQ5ywSnXBk+om+TRmRjI2S3Bu3Byu7f6MdjweA
--> ssh-ed25519 ++TqaQ JXzpUgF4ejNqTBkTeW865WoEuqCZN4Wt4jpBQtjmxmc
+-> ssh-rsa DQlE7w
-Oz7gs6cyMiDZ5jWjp7vphF8PHh3sok8UNrKIIaV72Xc
+R7ki9bXDeaSCxk/zLb2Xvmy06UntcBBIAyO3S9VcA6pjlfamaOJVt/qUS+2+8g47
--> ssh-ed25519 CSMyhg 8heO2O5eCd5rt6u+zfR62yeQbohefXhu1g2FjoJeAiM
+U2EHL9Y1TazLDxTSJGO5pRKv4OnKtPn1CYCXjBKh7UenRkjzLS6RfpFAoch7CDpI
-YDD/bUR6xihsw1WTfB3/USUvEv+S0BJZpfT1rKL23oE
+OSDgHPYG3TEGG5Y0UIph9IgCzuREsJh6ckl/CXrHHDnbs9PW2ySQI7hWGua+xf88
---- 8778I13zGa9k2O2431zFt7jMHp1XkHqAW1hAxbbCbfU
+8uktoJ2AcNDQvrevtZdf2H/eBumEWKPXmIKXTIfosYHLXDL6lXDN34tZGyEMjI8e
-ÿp•â´Ï�õùr³´€à’]ú”ž¶Ç-W®Óòa`
+L26nn8gl9CUBy3zYx+RNJor8Ze+NT/6mX12jAtCRxi8cGbqUS7W5QarsIEcsXj7d
+dib28LnfuErvk8F6e+P+zHHADgAoBiWixy0QrIvUEpsAtJKcMAkJAAD9S63t0/k8
+lYVvJfbpr3EKkXxlYNyOH7d1S0RsPdcBeGe0sXkwT6Q5D7h/OuuGdGTdMBmL5Af/
+f774JXDXYmfMNwqqFL9ey5Eh3p8S3tOxl8LrgCu0bdpOFOPEgYtDCIxoGrMUVG1+
+
+-> ssh-ed25519 CSMyhg VoSNTWJr8Q9PtedzPJ5r3P0MO/vFpDj+mQ0kjWCnKBI
+UE5LnlKJNgQzn5oyliiyP6uaTokQDKewZYQ/02T4N/Y
+--- 0dA5QHaOHsPmtWhbvhxhux/jAsXu0wI3Jnp1Yz0Io+c
+qÌ­Ù¾uýQü7ã>]q푨Ï7`ç!®ØÓk«

secrets/rustfs-access-key.age

@@ -0,0 +1,31 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyBnRjhF
+SHhTS2YrOHF1OWM1Zm04elkzVWpST0hhN0RhOWZBZGpBYmNTVnk4Cm9SMm5NcWdV
+Rnh0TVpqTlFSaGtaMnBrSGorUEhDd1RibWs1VUt5RGtqaVEKLT4gc3NoLWVkMjU1
+MTkgNWt3Y3NBIFV5OWhMU204L25nR3ZLOWl1a1ppZkUvcTNJTDhlNmE3eXpJMjRL
+NWdsWDQKNGhVYUhwRWRndjFYVEVIT3N2WE1WVncyV1Q1Q1BoNkhraVU5Q2s4UmtB
+OAotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgVkRwdGtHVTlTMUVMOFZrdUNHZHc5UWo3
+WWtRaXJPY0p2QWZOUEtjWDVCYwpYQmh3ejdLOWdmM3dZbWJuRU1EYlRYZ2tJL3VY
+OURUKzhRY2dtcVRQZnBnCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyAyOFI4YllyWlox
+V09BbERmRm4yd1Y5dlh0UGphK05DMGpsWXJQTmwrVlRVCjdqNE4yVHFKWFV3NXlr
+bm40M1BpNGNNNDdJOXMyak5EUWdMa0hrb3lJY3cKLT4gc3NoLWVkMjU1MTkgYzRO
+UWxBICsxb3poQit6VGRtWmZXUWUxMmRGWUN6RGVOeUxEZjdvZldTTE5XSFpDRVkK
+bFNWLzFpazJLM0Q2R0NKU2FaS25ldEQ1RUZQM2RpektaT1NhRnJtS0JFcwotPiBz
+c2gtcnNhIERRbEU3dwpFMVdKYnhiTWF4MCtJMFNHVGtOZGNBdlVDYWRRR252dVd6
+NW1vNFRtbENLbHB2cHo1aE43M3RiZGh1QkVQVzBECjlvRnhYbjlpWWFFTEFFc1cw
+NjFVSENsVWJHdWdGV3ZEY2tOcXkvUm9SSFE4VWw5eHVUSnV6SmxCRU9TNUdpRjMK
+aGNhdHcvay85N0ZQNksydEhkcXNkc0h6dkRMRXlzUCtNNGM1V2tXb28wQ05valBH
+TUdJa3V1bEdYRUZveFNwbwpIbWRnZmtQMDREd08rRkx3OERwRVZZNVlnSXlNNlFH
+SkFoQWVEN1NzL0lqeVkvZllPdUkvbWZkU2NxNjQyYTIvCnJ4QmZ1SlpGNkp3UXFD
+SUdFMFY5RWVadTd5QmM1U2tIZ3dLQ2ZZKzF0WTE3K09aN3FYWUVBYkErVlNpblNU
+QzgKNENEZStFeitaYmE5Q1MyQ0lWSFlZb2hJdlBVNkhUUjBFWkxsWmZqdHNYb3Fk
+VVJMMzg2V2xWdnNCNndGSWdpbAoyUHZ1WXR5UG04ZmZOdVluU2J6VUhKZ0xMZ0lS
+R3YrY3RIRHJCby8yVWxIMWpGNWlJK1h4eXdRUXExT3pleWc3CnRmQVl1Yk1IUUFJ
+blNoUGxVUUlVOG9FSE5CMDVidmZhSWJmWTFsY0lFcWpZU213cmcxNzFvb29XaklC
+MnhpSkwKCi0+IHNzaC1lZDI1NTE5IENTTXloZyBOMDNYdGlvL3Y5QUp2YlNlUDZu
+RXFyTkFWbFFsN1oweEErSS9Ccmh0WmwwClpzTWw1aXNqVXdaTVFrTTJ6Y0FWbVpR
+TXk4cTNUUElkeGF1VUZ0U3RWcEEKLT4gTyUkcSZASGstZ3JlYXNlCnYwSGdsbE5h
+d2JLOAotLS0gcjB3WU1rNDhBY1VxalpBNVJRSTJFZ0NhWEZlSW15UHphMnRHTjBj
+aGptRQpiZ/2f41GnSHdg+EXeRwxHOHc/RNfEwlKhEB/Weq8tQ2Xf/jJ21WiWsTIm
+g7Sq9EO6JyYMTJ/qlccpytfkU/qkouyR+z3prQcP7NWTcg==
+-----END AGE ENCRYPTED FILE-----

secrets/rustfs-env.age

@@ -1,18 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 WyOB4g hhAvT6VcNCahVtm1KuZKvHCed3hcpQz4RN+55QfcWlo
-y31QEfMiLzAHEvtyyiZH1s5nVwXyCWpTLUPsMd2+OOg
--> ssh-ed25519 5kwcsA rtaPMyOhhH7Iz6QZHPNuc6QD467/SXjFwWSNSXYTkAk
-z0Rt9JTnNRv7Krc2NPtONKWfo16XWbG9aOnYE4aujJ8
--> ssh-ed25519 9d4YIQ B/S0exr09e2vMDHxHoOeiTIePEED+aQQbgHp6AAJIBk
-MY7QxSjQEGthNl3w/qIaGUtwp2CyAiWp2NrYANnwQ8s
--> ssh-ed25519 3Bcr1w Af7dqP7+Izj2+17BKUZv0OYCJjMO+YkxWavWvrif6Q4
-IpbODCD9Y8N/L6z+49uJcMPXYqY17QWJ1E46xe2H7dE
--> ssh-ed25519 c4NQlA RlMioymSWV+qj4e2bRgvkMeXRtzSp7hrKMPEcD3LZxk
-3MzuySB+MkYeTWGduPETRyxSDrbNHLsIUbpbuTqb/Qg
--> ssh-ed25519 ++TqaQ D4N5MfbrzKJK2d7TXwhFKL9/Ge9T6phvRzoBeebc4Dw
-zPA2L8bPbOUPY5XVLskiSTQ8GzOCGtp0NyhGIk8dB34
--> ssh-ed25519 CSMyhg P2mwMRB9MsTcph04/9KNybekb8o3NS++9T5OF+i97Ss
-57BkC8oe2HzhCQ0BFIK55bmyevMgx0S4cRkLmAUbUaM
---- kNaEN8WTXkWGpfu4ibNUgydnIf3bH4++mRMDuXuuxgM
--×±wé'F¬¢Á’¿d/[P•ï%ƒXVqWü÷›æêiïÈ**v[�ƒ¿¡C#šAgr¦˜ÞËD±á‘]µ•ß“:Ç=#ßú,Ùúš�«)‹ÕðU5#DŸªn˜›‡sþ	É4¯‰ °s\Ÿ§*.Ybû%e‘µêŽ«v?pä	—	î.¥qÙÈ ¹
-␍x+R©%ØL·ì

secrets/rustfs-secret-key.age

@@ -0,0 +1,32 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDROTEtydyBQd3FZ
+dUFYOFhoUGdBejZKYjRnVmNvYU85LzdJS1lVZFNRS3pTeS9hT0c4Cndwc3pHdStQ
+N1QvU0NSbGJhNEJCOE83eThhSFBrbDJPU0tDbmhIM3lwcjQKLT4gc3NoLWVkMjU1
+MTkgNWt3Y3NBIHdaS3UvRUdFb3pITmZGdTNEaUtXdnlUMWFuNk5ZcFV0VVIwNllN
+S2c5Rm8KV0x3Z2NjcUdLWmFEUExDT2EwbjFhQ2Y2TXNoaUc1d052RnJmM3VOSDVr
+VQotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgOG1URGlNekltV0YyQ2Y2NFdPL2tSWDlG
+UnNLc2wrSllNWFd6aU9LWGN3YwpXUEthT3NNVHZJMUJndiswUVNFNWZjZnBDS3ZH
+dXBJV1FSNEpPRGxQd0JrCi0+IHNzaC1lZDI1NTE5IDNCY3IxdyAvSTlFMitYZFVQ
+ZER6ZDI5OEorTE5TRTdlcllPSmpkUjU5SkV2N0xQY1JBCmJPNFN5NEovdHBVVDRl
+T0czS0g2dEgyTXhIMmtJVFRONDQ3enpLbFhJT3MKLT4gc3NoLWVkMjU1MTkgYzRO
+UWxBIDBUV2RYajBTMkZ4WnV4ZUVCeHFZay9vRGR2dkcxaXBPOWxsZ05IZm1KVDAK
+am56blp1ajlzc0NSYjY5NFdGNlNzQ0NNQzZPeVRtWTc1Z0lEYzc2TGNFMAotPiBz
+c2gtcnNhIERRbEU3dwpOMGowMWFoRzhsTGp0U0RqeHUyckZvQU9EVkQxUXE1b0U0
+N2hPU2NZY2huNm5kREg5SExCZGYzaTUwdWs4MjlsCjhONjVOWnZDZjFRU2k2K2Uz
+dnVmWVd5MCt6bFk4UVU3UEdsWXZMOHlZMktzWWR4SFJ6Vzh4dDFpYWNYRVQ2UmsK
+aW5iODV0WDYyQWN4K1ROZUVjdE40MGlxZDlXdnZVRVZBc04zdVRaOE9RTUJPUWxa
+YnJjZEg3OGcxNHVEVkR0MgpGUWh6NHV4WTcxUEZwUU52QkdsOE5hZy9XWFpjQUFP
+bDZzUjd3ZXFTTmpDN3ViZ0dpL3BOTFpBL3k2aUs3Qm9HCkVDeXZ2M0dQcWJwaXdm
+N2E1R2pjcWY2V1dYaEFNMVc3MG9ndDRLd0tVdkxHSUxwL2REazE2Unc1Z3JjUHJh
+NDgKamVqZjdkU0hCTVhqcjRsL1NtYkxxd3BId0lsRTRRUTNrZ05mcE1ZRkFSUlBW
+VVdkd2VSNzJMQVJEM2QyVkMzSQoxRGVOOUtzdGVOMTBLVk8zN2xjT3lvYm0vSXpQ
+VElTaS84SUxIekVybGYxV0ttZldVWHhyVVEvdzRFK3RibVFGCjV3bzltRjFTb0pu
+bGJQaTJ1Mlgxd0hNN2VvS0p3eDd4WHNkaTkwV3MwWTdLWUxnNzJjLzBBZzZsck5h
+Zk1UUDcKCi0+IHNzaC1lZDI1NTE5IENTTXloZyByQ1cwWm50UTY1bkp2NWZFeFVU
+T0htZDFWUUFsdlBSOVVNY3RTZnNwdjE0CjBySlExb1dnTGJKZy9MT25Oa2hZdDJZ
+Um9PZWlpOVA5bTBRM2wvVHJJaG8KLT4gWS1ncmVhc2UgWydtCnF4dzJjR2luMHBS
+S2p3bUE2bVl2R2FaQ2hRK3greGMKLS0tIDhSdFFGaGlGRVV2VFZKcTNWYnNtbUQr
+blprSjUyMjJwQkhBbVBCTmVhQ0kKUITtRYOYPDGGQlKrEp/JVUP8jTcptZxVaVcd
+AmxviaG76EuXQeK/VgrGKoi+bZwHbpCbXBT2H8DBuSPgXdG3aQDQn2QgZylMnhmM
+wzU=
+-----END AGE ENCRYPTED FILE-----

secrets/traefik.age

@@ -1,18 +1,25 @@
 age-encryption.org/v1
--> ssh-ed25519 WyOB4g sgNJigC1mHTfc99a4Zbbvs5CjYFWBzP6zavZwcH+gD0
+-> ssh-ed25519 4NLKrw L3agH3Z6bj+Sq9E3DfaTN0V0oZ5niRM8CBEFROroQkM
-rsPuP996M3iEnoroYuyu2Wubdl2/bGLubP+poZaLdNc
+BwL3I3fvhGoEAqcRFCaj7eyiwTKOlgfaUu0j7oX0ORM
--> ssh-ed25519 5kwcsA uuRb8F+MulRQJ+J4a/qQFA/gblaD0fnuY4s+5IivcTo
+-> ssh-ed25519 5kwcsA +oFqz/Gi9yCpt4zSSmtFGlLb/vR2472qSjHrJwFbDjc
-Ff79mN0PHGPfjvcxuzrVLV/xlHtnmxEpeBjx0bhCnVA
+4fE6ksDuzdCb5CTM/9l0BCBHdBW5EjgKbdZZORpBewY
--> ssh-ed25519 9d4YIQ eagO4M6TMAlKPHbA1Pxn/gWGbVM5qMIfwXjpgQcSynI
+-> ssh-ed25519 9d4YIQ hdRYhnLz8V62eC1JPgYRdau2a5DSOGKh3wL0qJmnCnU
-EgLCVcLN9DmxUUzOsQPW/0rFnJxLqI2twoLwK6IjbJQ
+oKIB8WxnmTJ1OxPpkvQ2vbJmgGTbtWH3at5ppFeiZi0
--> ssh-ed25519 3Bcr1w BMqOBhbxvEVN71hXp1k1wvgdMI/CJ1n0uMqCALS0rC4
+-> ssh-ed25519 3Bcr1w ZP7GpdLeUAvAIUyISp80xvsoKBQK8li+KS7QpM92jWo
-EW0b7pnmX9VUAEnutmVKKnf84dqsZQFGD3VdhEbyw4g
+om03ep2OHLSijw9LUGTHPnFdH6oGE44hvqxwe8fuAe0
--> ssh-ed25519 c4NQlA RAWVceQjC0n8q/cQVLep/nq/9+yqSu+p+8Md2jRSyhc
+-> ssh-ed25519 c4NQlA XHPJbNCieeQN0NyvD5yK1MxkiJXKAWvKTm+jg/nQkyU
-H4Jnm2breoj7pMrdViDQVVaE97ugvMyotrZPaKL3pl8
+Cq6qEBraBwNwp7Cfx4FDNLSx5u94akf27SIQjROR3j8
--> ssh-ed25519 ++TqaQ 39Vgs3hRK8xFch23bFpt98JkpCPlBe1tW/CWNMLzxxQ
+-> ssh-rsa DQlE7w
-btV7hNCoOosE+nuIdLCC1b77Iysgx27VYoAjEvoIxls
+K/dFkf1KDDiX+HIakT+lv0qMiPv8iNt0wFvaSxpETa2v3Z+YxPdu5MlfAuaY3YCl
--> ssh-ed25519 CSMyhg A/82i7cqPl6YsUR3SUSf1jbZmSdYTXQ8ts/WRP1h/00
+0/pSOLUOA90ugAZkj6SF02HValGS/SnXqpQYN9NTSLwie6gUSKAMgfkV1UDNRbLj
-w7VfU5nfA/PJiE0qtAQ1GB0UB1kYIHZ0HbPnXNOqi6Q
+d04rTcSF9XqpQLmLZbQY6/CALiaGj6QPqdKU4lFTDNEyiEzrKUEorAnMnKGULYws
---- 1qTrY3rOpD1NV7WhFdghygfv6SvfRf4eVmRUkFPVi4c
+y+1QAlKY4yyzRaHTRq/IbBC83oUjpj391Z8fFUelHnN8iXXZQpmigOpw5/XVqRP0
-æLÕ‰å5_FY¸e)×±)Zúl~Ìäuwy Ã{;ßãN…ezÿ°	·äœæ
+21+iZty2e046r1TvSp+QpD/IvqqWUMMRcaWWUm9tCJQCaMOyapyrFNLjvmJzhgvg
-,&["uA:Cùœ§hnî"ìpJ*Uôày:Üñl²¥®Y ™;„qÊ':}0␍ø¥u‡çÔf-È×Ì‹àï$O¬66]zì£S=’lë
+BiEFknqde0lfYJQIa4Mc5qziM98wGU0cVnsieYXp3AtcJ6ozhW6znDfedkS3TgrX
+SQWwWbWNskjOAhLtRenACfoOkupq//ZCce3HCrJYbHCWG+lw6SfU0vA1EO6O1/SX
+KlGSp2zr9Rp/TkxABRuciiMlLMVDi4EI5iuubWhH0OY8Sy9140hOYjDUFrNeJN4n
+
+-> ssh-ed25519 CSMyhg jBp/C2EF27oe8TuNMy/GYutMb29ST2ciVjg3Bj6OZUE
+WHPnk6765AVdMQEbxENGd0b44vyefRR2rv4rxPDpNS8
+--- bFPtf/w/F/Mx/YycTvC1SKGQiOT33QluwD0LaPYjK5U
+2xÚN˜?âó�x%þ´‹ök£é3̇‹å‰Êž›&‘␍vßë²n!8‚б8ôtUE8�æ„–½ó�[†£sD/*èÚ[@•Í°gcÇ
ë*ÝxáÐȶÍìM2H°ÝõרcaK¡P®/˜␍ŠžŒ¢>ÏÍ›s{7®Ô