From c2f40e27774995db41f99ac6d7a86bb03549b3d9 Mon Sep 17 00:00:00 2001
From: Kopatz <7265381+Kropatz@users.noreply.github.com>
Date: Sat, 4 May 2024 12:32:52 +0200
Subject: [PATCH] rekey secrets and update mini pc config

---
 modules/collections/server.nix     |   6 +++--
 modules/misc/static-ip.nix         |   4 +--
 modules/services/kavita.nix        |  14 +++++++++--
 secrets/coturn-secret.age          | Bin 538 -> 497 bytes
 secrets/create_secrets.md          |   8 ++++--
 secrets/duckdns.age                |  19 +++++++--------
 secrets/github-runner-pw.age       | Bin 685 -> 506 bytes
 secrets/github-runner-token.age    | Bin 526 -> 526 bytes
 secrets/grafana-contact-points.age | Bin 694 -> 804 bytes
 secrets/kavita.age                 | Bin 521 -> 521 bytes
 secrets/matrix-registration.age    | Bin 675 -> 589 bytes
 secrets/nextcloud-admin.age        | Bin 515 -> 485 bytes
 secrets/nextcloud-cert.age         | Bin 1812 -> 1730 bytes
 secrets/nextcloud-key.age          | Bin 2271 -> 2136 bytes
 secrets/paperless.age              | Bin 538 -> 486 bytes
 secrets/restic-gdrive.age          | Bin 961 -> 920 bytes
 secrets/restic-pw.age              | Bin 639 -> 481 bytes
 secrets/restic-s3.age              | Bin 626 -> 530 bytes
 secrets/secrets.nix                |  38 ++++++++++++++---------------
 secrets/step-ca-key.age            | Bin 820 -> 746 bytes
 secrets/step-ca-pw.age             |  19 ++++++---------
 secrets/wireguard-private.age      |  18 ++++++--------
 systems/mini-pc/configuration.nix  |   6 +++++
 23 files changed, 74 insertions(+), 58 deletions(-)

diff --git a/modules/collections/server.nix b/modules/collections/server.nix
index 750c417..6bbe3ff 100644
--- a/modules/collections/server.nix
+++ b/modules/collections/server.nix
@@ -28,7 +28,6 @@
     ../hdd-spindown.nix
     ../logging.nix
     ../motd.nix
-    ../static-ip.nix
   ];
 
   custom = {
@@ -44,7 +43,10 @@
       settings.enable = true;
     };
     services = {
-      kavita.enable = true;
+      kavita = {
+        enable = true;
+        dir = "/mnt/1tbssd/kavita";
+      };
     };
     hardware = {
       firmware.enable = true;
diff --git a/modules/misc/static-ip.nix b/modules/misc/static-ip.nix
index e67a83e..f2559b5 100644
--- a/modules/misc/static-ip.nix
+++ b/modules/misc/static-ip.nix
@@ -11,11 +11,11 @@ in
         description = "ipv4 address";
       };
       dns = lib.mkOption {
-        default = types.str;
+        type = types.str;
         description = "ip of the dns server";
       };
       interface = lib.mkOption {
-        default = types.str;
+        type = types.str;
         description = "interface to apply the change to";
       };
    };
diff --git a/modules/services/kavita.nix b/modules/services/kavita.nix
index 0c95fa9..95e5937 100644
--- a/modules/services/kavita.nix
+++ b/modules/services/kavita.nix
@@ -6,13 +6,23 @@ in
 {
   options.custom.services.kavita = {
       enable = mkEnableOption "Enables kavita";
+      https = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Should it use https?";
+      };
+      dir = mkOption {
+        default = "/data/kavita";
+        type = types.path;
+        description = "data path";
+      };
   };
   config =
 let
   fqdn = "kavita-kopatz.duckdns.org";
   useStepCa = false; #config.services.step-ca.enable;
-  useHttps = true;
-  baseDir = "/mnt/1tbssd/kavita";
+  useHttps = cfg.https;
+  baseDir = cfg.dir;
   mangal = "${pkgs.mangal}/bin/mangal";
   githubRunnerEnabled = config.services.github-runners ? oberprofis.enable;
 in lib.mkIf cfg.enable {
diff --git a/secrets/coturn-secret.age b/secrets/coturn-secret.age
index d27aeef08b26e8af77536caa3f232a95cd7dd706..4a9e9ec80e4dbe67624e83ed89f1599dc220a3b6 100644
GIT binary patch
delta 450
zcmbQm@{xIhYJG93foo;Cf>~))TC!PMW=e=prI)2!xuLmda7swBcbIu-uzN&=VTxmV
zd74wCzIk9MS6;YzYF1TQMzNp1k$Y&kc5#(kX-Y<!QBZ}pzDY$%l#!QyMTu#iSDr;a
zm#&>cadC!jYKoDmsiCEUXPB`|cA$chMPh(?Rz!eXm2XH!UP_8vwriqua79_Vg@<`q
zWtp3YYm%dxPm*g{L~c5lOJa#}VpL+Vmxo!3k)x-vXS!){xM5UgZdzHgp{YlOo3?Xq
zs!x@#d7AIUkK*<IZebbziN^Z+zNIGarXi6&#ZGCZA>mO5;r=Bdh3-iKLE2UMp&rR;
z1_oS#u3p}u`c=Mp&K`v&E|sYfMxj||d3hF@;bHoghUsY`m8s>Sj>TS?rlDNAy1EK^
zIr=GiMLwRUg(falktJS^!I9~%6_rUr=~?Ch5$0LW$);JAfu5GWCJ~`rOo!*2n|+nm
zJUqj_s-dNHpW6Z7UCHmJA54FAr<7OjZrH@7H_X4^R4@tq@mppq=Tfylujge%?XsRL
v7p(qwvZ6+x8snn8i<^_r^i0{8cGUaq-*rr!GYWY6H$36qd!une4#QFaIjEyj

delta 492
zcmey!Jd0(5YJFvzv$Joxg0owdSD15Pny;r*mQR6OsH1_AONgsqft!c9f0a?Bd8SdS
zOG>VGgnp#~mv4HNX=QM-bGnI(Q)NYlcZ8`~m3F3Ig==V5xU+wHZdrJ;zP72KiDkYo
zm#&>cadC!jYKoDmsiCEUXPB`|cA$cJRG3*|aB6aCwr^FcZ&rC&L`0fzWtyW~N=1H-
zk(ZH4RZ*6HN=~ksd#(jnL4K5PU~zI(v1^5MRk>qcVnAeilw-J0PEb*?aa3eQR%&`i
zQL=}hnNR4%kK*+uCI%kfQRzvJo{7o%{-x&HUd}E>S=r$wnffN_`X<4Sd1e-dL5U$H
zRgqk-QTmQSRk@KB*~y-UAq9asQ339$g{fYlt{zF@kp?BjUZL5=W}$@!CfOjL`0Az?
zr6v}qDwt#_D&{E{D?}@})#h=fyJ!anI~!z}Ci~@h)|YeX>gp=^mH4`aXC)cBBo}3;
zWf!|<TL$^$W&4*pyQOJ|COSKs8hUsd>xTyfndWo-<H!}8Bg>$$bfa32^3=A%2)<P_
zYgeo0+%=y5^oe4iYaaI|F0qJRj^ai&E(%kFlX@SoQDgoWxc|~#OKZWRz>Wfy0L>R$
ibv7tgMY5}ll)w8b&Cmb$#RPW4g}1+YWjvSoD*yn6f~c+l

diff --git a/secrets/create_secrets.md b/secrets/create_secrets.md
index 1c83ada..aca1b76 100644
--- a/secrets/create_secrets.md
+++ b/secrets/create_secrets.md
@@ -1,4 +1,5 @@
-agenix -e secret1.age
+# create secrets
+`agenix -e secret1.age`
 
 
 example secrets.nix file
@@ -28,4 +29,7 @@ services.nextcloud = {
   hostName = "localhost";
   config.adminpassFile = config.age.secrets.nextcloud.path;
 };
-```
\ No newline at end of file
+```
+
+# rekeying
+`agenix -r`
diff --git a/secrets/duckdns.age b/secrets/duckdns.age
index 232f847..37a1153 100644
--- a/secrets/duckdns.age
+++ b/secrets/duckdns.age
@@ -1,11 +1,10 @@
 age-encryption.org/v1
--> ssh-ed25519 yfCCMw bknEVINSpmzqbs669XXGW10WlRU2eYqM21nCra4Grm0
-UH/rieabfARVLfMojUzRpMV8OgQQegmkERr3OsudizI
--> ssh-ed25519 IV3DkQ ae0X4te6ZevvoybUP20LgE4ymTiisoBMfrZQBm0LHEo
-f9VxOHjo6W349d/T9DuH0KbQRHj+EXa+yascxnG/oEA
--> ssh-ed25519 DCzi1A vBpgN1TwpEv+mJNIMoHitLshG0q1RDTz3WrvRbRGnno
-Nc9I8WWXDDzCfOHkcbhqXjk0Fvp23f8QxiW6bdPix3Q
--> 5-grease ;gX' KVd. S[Du |%f:LC8
-g5R1yuzS9892Jf0N+RsaVg77389vLxeowKKcD/PM962AMYCe4iHdCw
---- u/d/x8qCopx23d4TiecnfbaL+l+JJu5i+yJqmU6XH/c
-4��n�~�Xv�6��j�80���}	_�=$H@�u�{�q���/��^+vԹ�Oy���E�p�K3��L��Z
\ No newline at end of file
+-> ssh-ed25519 su0Eyw abgbb/Gl03Gkn8FXt8OWvsQZIIkmp+9OJYJBARfuMHE
+C6btapYsEstmrPfOSzApBxo88PCVG0ECbJJ9ATvHwSo
+-> ssh-ed25519 IV3DkQ r1h8O7eotpWQ7R2MC/EgWsndd+V+YNJs6SEQqxY4DHk
+FRuoj1KMLoHYGYk+78cgQbtH6QN0LQX69LzS72zTeLA
+-> ssh-ed25519 DCzi1A S5japvaVIvNF8gB8d6lDMniYvWDhPXKxdHIypoYQiho
+us1sOKs3YwTQZEbgh3YgN6GgRDP7Na3KGdzTSqzENrA
+--- Nq1cKNge2TngWd41zf1sTneHozmQzGrFQ6y6qtXzRDs
+9�1
+��U �6��eد0n׹��v���[�fZ��(~�sY'�SG��f�
��c�$���#y��Dk
\ No newline at end of file
diff --git a/secrets/github-runner-pw.age b/secrets/github-runner-pw.age
index a59a99ea92e0fed1dce55d1a6bba20a4b69ac609..5ff3cf12f0e75d4b3bf0d031005f70e59a044458 100644
GIT binary patch
delta 459
zcmZ3>`ipsjYJG93foo;CLTGS`r>A3%V~SH*R-v|WsiCJyx}}d}fO$!IqEnVrihGr5
zd0CKAR$*{HS7MNVk#}UNdwyj|PNaT;MSiARWI>LTpR2K%XP#fWM`>=5XRx8aewtG<
zm#&>cadC!jYKoDmsiCEUXPB`|cA$b$R(L^~wpV~-u5WHpsZpe-n|5lxmvcy_QI2u4
zYlx|ti<@g|l52#2o<TX6cV2i@R#0eQQK&&yq`#R(RdAAPglST4u3JQrr@ohdK)y?`
zrA4-(zPs<lkK*-C=B@!1o@q}0IY!!!dBL8kuK6Y|S&1P58Ko6w7HLL~MUEEbxtYNM
zj^$h?g+<}TsouGT>6ry?DY?!e!Iq|#`H}k0Wo~BaIbqJl-mVtjNtte`CXrmay1EKR
zu5Lz#g+>KtUY?~UVL`!;;dv1T+JRM`mAP3?dF9#J0aeAx5$?W4W!j!xzl>N!bI%^|
z<=c>FK0&zNv)(LtM}X0SH<x#9;M&)o<h(MmbH4TUIa35Jzc4$!a67`lH~(_Px9J|e
zZhR9ZojybxXT4Xn*Lm{Ha>1*d=er;3w53Go{jS@b+f?29Bq8yvkTe(Xccx;|%HwkZ
D|9qpD

delta 640
zcmeyxyq0x>YJFvzv$JoxLTJ8$i+*ZSl5=oWMpUGuTeeAAQd*UNQjnLid!(yrWK@x9
zSy7&gMPXPmS7|_LL4I+5p1Gm9v#XnlzJ73sZ=z#Wl4+TdVR))XlBH>svs*!BYFUK^
zm#&>cadC!jYKoDmsiCEUXPB`|cA!G8fqRILi=U%Wj&D(3Sx8!CR8T>2TAI5>N@l)K
zcxt$FM2JDTk$0(MrF$}0VYqolL}prcnzm7?cYbb?Uqp&gMny@YWkI?}lDV(DadudE
zabih8cDBL9kK*+Oo=)0XAw@Yx1wmOA1z}mvsfC8V<+<kJ;f8M7CC)_#fv)E1NqMH)
z9==@uA;unsZpk@jsj119j%86v1<t93K|YSoo>4A^K9(k_{;6eY>BY_=ZmuAo_;}{m
zDaY%k7o{c^rz%8erg$2~1{o>T7T7yS=PCp#ct^Tu)GL~(>T*?-nwa}q1Y|{7_<AQr
z6cvXgTZVfT7Fn43_&Pe7I^}EonV96|1zMOV`{Z~>8W`l6q!pRE8Ks$*L<JV7lsj`p
zWoEioIz?6Gm4xI6ScZhAl_pg=8996AM1_{?2dDXXRiqgCq=XuH`KM;(dM8yzhNM(F
zB}Z0P)Tb1gXa}aGb5)fZm~iRp>MFST`=m!kgqMcpgePS<hZ(u&g_bzE8<hHFraQSu
zWLKHwIs26QWmg#lr*nNZth17IKA)0w;>(#I>t0-XEcI89+3|Gs=K9$F>6PsNH7@y`
z(PjJi?y!1xmzG4i=$DQq39;vLRa~F-`j|YN@Jnp5hUrb+U+-)W|MPVG$a5vZZbsSL
bY3Cj}l$&&@z5dbsCikG`YKvm|6Za$l`E2G1

diff --git a/secrets/github-runner-token.age b/secrets/github-runner-token.age
index 981a3965916312e114494324e641a63d81faf617..a6ad2e79d3655949ef3de3d1f830d83aaeee0266 100644
GIT binary patch
delta 480
zcmeBU>0_CoT3=jh;96O(P~hz3S!$9PR_^a==%Vj$>RlF8S>k3|VOeHY;u@aslIfV|
zpB$1M;gw~;m2Becnx2{(RG1QAn3ZE$T#;q!Rb(0-;Z>61>};MA?&+Uj=^t8Al$UM5
zrE8~9T%4hsnqp*XYG|q88D{K~9jIUyl$xpSoMKt#=vxpL819#C6z-Io5g2Lg9Oawq
zqhAn`YMvTtT4|W!VHnEgTjK0wlxS2OY3N#J<mllY80z9zk**(Rnjd1EmsePklN_9t
z8&=>Ro|HZDqj<fuk(+UOm0^BBnqfhywn3P7c!6n<MWRQthq1GPt50^AbAEniS!$L+
zW+0bAa9Vg(vVmWAO1Wuept(_bR%l9cd4_+Ec|=rxsB1`afU$d?zGYOdOC*=BuC79c
zc4DBrtA15lMzBeKlD}hAa#&b-lv|K<dZ>Q6Z*FjLesaBQNuHy&ex@szJ=e<Isk7dm
zR6a4|xXJBB9M9IDym&By`Jv-4l^ttX)U!{W{jt|1eiHW&hJK%X{<|G{%r|t*mo9es
z^(l%`Gw$ij_0Fm5ciozkk#Ie)sy)xtQgq#|T~Cf$EoDzTvwr43tGHTk6BT|Dy+1Ya
bi*q-f`1*DEgy(#}UT`>cbOb*5VOt6SY813$

delta 480
zcmeBU>0_CoT3?yw?Ce{v;2Y+g73Sxclo%RR8Jh27>Xqi_A5v+VQ&D8@l3!x%nw3*!
z?wamo8C-6_<&_lV8)_Du?U59b5|rWZ7UbmY?VDz4YHAsh;vP`tTxpgRnURzpQDm0P
zrE8~9T%4hsnqp*XYG|q88D{K~9jIU$>RJ`y>r_-)>1(E6k?WP5t{vhUSyh?gnOSaF
z6721oS5TBz>Qd}ym=Vb3S*)F%733S_=8~QmVOUxi5Mb(5>f=`B9+jk>;#XAR8JHKG
zp5_>p9iBY#qj-IVdw!HxV1-j&X-Rl$u}4^nQB`2Nercw@zqx5>Xij8ciIYoOL}`SF
zha*>+QI>IJQj~FqWl)5Rd%k&~mv&lYqJCnqX|Q*mv7cpRp^2w+NSJ4(Um%yRuC794
zabcc|vrke$N@<pfPky<dfuV()c2Jh5sYh<9t7A!`V^n>GcA~$LrEfCVOde$w(bXc^
z;%5!k^RY&+T>JU!omE%wI5@8P>$mRQ<B~rt;u}@6%2bwlEE78XO7{^j>v|u**`5D>
z{I;`o@;rB*Gh$-9T!1oLb>D@*F5g%R*~8vk<8iZ2+@|x-GDE6J@V}t$T(LjFuS@*Q
ZR~n><=$uJ-BX=U5L&x-)Og6K)4*=+htAPLj

diff --git a/secrets/grafana-contact-points.age b/secrets/grafana-contact-points.age
index dea2c701b2482a39b03441bf50f900375b93d0b9..dffcfecc75cf94384e38020ed86de804a0803ab1 100644
GIT binary patch
delta 780
zcmdnSx`b_lYJG93foo;Cf~#L}Qifl?b83=)T2`@Tl#!8sd0KF$qd}6tL2hD(r*^KN
zv3G@Wg<(!Umtjzrv1^pKNnUb!RAr?}NO5pzpo^PNwrP&3hjv9|o@;JtsDYuYxrKK!
zm#&>cadC!jYKoDmsiCEUXPB`|cA!FTx_gm{Nl=xGTYZSTrF*$wP<e%?w_|9LX_#A<
zky~~^YF>eft6yqCc~~G<ahjz`U`cYanQxw(lW$RJqH#!eP+3_;qQ8qts86;<YEpQ(
zS4nw@PoM?5buP|TnTC!EMX8?og@sXxX%>Fz-j$(7nVzn`X8sXIzV0RUY5H!t!AVIz
zCFaJymJwB<TvZ-rq2}(6*(OopzF{E|5pMaR#*sx%dG79I1!-o9;iis(RaMEkUg4Gb
zT)Mit3fVpxZiV@dg(cy}875xoAsJa783FmFRZ+Rxe(u>$B{`9miRCU8p<%%WTuI)^
zzjcK^DmBJ$nvmW8$e6*dewJ@dTH@A9i3X)Ii3dyF6g^UdXPjKswYU6%o2b2J<JNrX
zMS3y0Y@dHGpX?U&bYf)8sgNo1I^3`3HEo%%ClR^ri_HHWTAW+W_KQ00s`)fiQEIoL
z`f{~hYkJR1m#7AqiwV8bj+(kTZ-464VjhL>FK%S+*rV^FIqAyPG9H6RZ-3Q0e6_Rw
zaKXN)MKHelFlXdjF1?PM-}-`&%dFHe@cQA`a<j$v(Q@NTmIc@Iigp}x;;BeqeKno;
z_VkAL&*J~hj6T6qxhXvC9_#t<(TfdJ#1c90X8c&($ksjEIcnVrsaX$JTYOsa+%;cJ
zfYm2Sq)l{NZq!LFUhn5wF5IDFntnfQ>jT*DNUryv*BSol)y%*deJ|GY1-_eiPW;f~
z?h99+9Z{QlcGf;oojUIKJd-&Uf9YzeE|{@m>xwwF?%QV7hi7;cU&uN5dE<T0Qh!4y
z$pc?*M$gUp%|2CsVeBuxtOq5_>=JH0bCArtZ5q2J%HpJ-akk9`kL16lkETl6$j|C9
O{kd!btLi@2Q(XYot~>?+

delta 649
zcmZ3&wvBayYMf`7u}gNKf_G|=Q*cRTo}0gOetuMNSVU<^j=pJXRf<PaW@w39rcs`L
zk+)O1QD&YeS7M1zl5=XfvA>~lc8+J5TUL=vZh?!lpOde1dZNE)uy2^Nw|{bRSdzBq
z#E;_je%WQF0YO=bspcj{;Q>zGUfP+)>EV`cK7RR$`X25c&gqu=Mn<lV0Y(N~z8+!a
zrV-{Q<^jP5{@Ot<!O5lB$;R0pM)|Jh{@JA=Ib|jhMkRhG!7jyIy1KdwK`w6oMNV1i
z8HHt)X=X*fL76%E!EQzc`C+-)9$uk_Wxhf6g}E*fRi#GRTu!$SDD{W(YUo}5!92P0
z=ZpFs?M?H|EKb%>nR)Ax>68a+qr_tUPE{S^|HE(mVCln04!h1CxBq$FT*{Lx=;U$(
zbCuqkW=cO=&wu_s#i(`j^mW&47GL$?IkjjD+j6yqL5plN*W`%@CPX$E9GW|QJD>hy
z*_`@6#S`kK?Ks|D3&>AS^SyoX(5_8y%XN&NzkJ1Mu{d+`<dCy+sX>e^bHz(0_3z&L
z^1>y{|M%y7oAqwWB%TSrA*MQ0m(Em?-hF<C7LVPX`(Mu~)GZP}6?Mq3pZChNrQHfs
z8~$eL2TF;)_xAk$PG$PJUkdipoR)qwWY<{92=CwHA>YasVp*?tQecO0eb4V>Un*m(
zdkT*FU;S#k;9}M>xeUoo(YvBG8?|Ts{l07V>cw{seq5Jt5cBm>_otr5l+|Y!s`YJC
zlXFPpG&kUDnUhs?&d{qf^Z)nFk*nOln{Z2>^}qEauCC3JzjxM$ovw4Fy#L;b-o+T^
zy?bt7{M>hc4Q|vJRM<Y)sqjd!V6jQ~%h+8r*$*6I%ek{zPFMBGh35{(qq3cZ*$RXK
D`Rp01

diff --git a/secrets/kavita.age b/secrets/kavita.age
index 35fd4e7fdf5145c342da1d82ea82b3287988eba0..3f561b18534d9e69a21940354f72bcd1c9207c02 100644
GIT binary patch
delta 475
zcmeBV>13IpT3=jh;96O(P?T4kUJ;yb>Xnx5ml6=9o#>NY<rWy=pW|s#Y8GG;X5sH_
zSe}-bmmV6)WmIIKZ&8+L;-9J=nBh^FRT$=ErXS+vl~H6~lw#;%WZ>%;l9w4!RO(;O
zrE8~9T%4hsnqp*XYG|q88D{K~9jKrmU~H6;o@*HD@0;#undIs0nw)B$UX+w(?&fBi
zZ)ECIl3@{$ZSLe+nHkBYZ=M$55|rg+l3rzLXi`#GUXbVM<YVfU85$ViWgeAO;98~a
zo1ULz8euZ=qj<exXjzDNnq_Wjq*1x0TZV;+VPLLHs+p5Pp_#d<iMM%xuXAOxWqG2z
zdoq`^e@<Acdt$O*P_cPHsbQ6uwtqo^yK|~#RZ*z1Syow=QL3wdftOo`K{=PMuC9WM
ziMvHWdQ_m7V}`SDXo*LudzE9diBn2oVo7>PVtSTaQdGTHMro*_VU90X;!2@AhE?$e
zx~G{By<4;GX4Jc{a*eTVJ>Mk*c=@ZNdW*znv!rmZQ#Lof%^SA<PqIbe$y3M9ZM^)g
z?f6lRx2Cogce!U;xP3mCR&jh<p!v@awfYuzu4jufc3L|5_7~KprM~{ydWK`tu@_T}
U`j0Gpw04TjrF8A%%)dJV0OO#o`~Uy|

delta 475
zcmeBV>13IpT3?yw?Ce{vkZMujU2Nb~Y7rWqYm}@X<g0D0ZQ-0&WfGZbuAi5l>tX5c
zR#ajZXcQRAmGAE4WnP}29v<c8?H!PkWLTP?9FiItVrc4-WFBHtmX%kPY2oef8WiBm
zrE8~9T%4hsnqp*XYG|q88D{K~9jIVl?vr00nr>*8<6CK-Q|j*F8Cc;TmE@Hh<>XP7
zS6NZuXKqmCnd@X8;^E3wRgzH}=@D+}UQ!WO8Dd!y6jEWCn`2_?Sx}aro?_}`R2JeB
zWumQL5aB!Vqj<fiS4v2Rg_(<weneodTa<^fTV|kFhO<{zMsQY2X<)Hawns@}SZ=OU
zMKPC=V_B7@uZL@Dx|vZ>TA+JrxSOX_WRiKQVX1qnMTkd6WJpS&XQ^{)Ng$W5uC78x
zlu1Q!j<LH-qHC#vSzeWXkXw>=Zb4dBfu(6>X1RH3l}UY8L{vy<VQ@Ov9f>;`77ae$
z*B|qg-}@-Ex+UxGO{O=`cdU!Q^0undW&KM-`}7_EJY$Vz4a_7pzVUoF|1wo;T7}J=
z?T@OL2lM~l+3Zv#r(W>HqUusKXDHW;r7dOGkN+rCVAuaB)Zy{^QBmEMJ)zxKo!6-_
UFaNoO!8@cj>aOTyX6ED`0A13q{r~^~

diff --git a/secrets/matrix-registration.age b/secrets/matrix-registration.age
index 046ca6b78ae175af4119e0baf11d1c47896ea210..721af66c69421b38474cfe1b825806bac1a05570 100644
GIT binary patch
delta 543
zcmZ3?dX{B^YJG93foo;CLTY(txp#VQpsS&wvrk2GfqPc5bH0CspP9C6fuV=5Q%<g7
zTA;f}p|M*zS5<npc9~ClRiwFba9DYvm!ElMV4`oTOQvs7Mwn}!zfoFcK&ew!Xt-lO
zm#&>cadC!jYKoDmsiCEUXPB`|cA!F<d2oqoeq>%wo^Ob|VM%yYX|9>4Z-H}erC~)`
zUP)v@qPu0DTVbJbaCtgcu}M&PMr2B<uTN-But}PQhmpHQNs)eelz)JKK!tyZlX;<|
zrC*+#ONqh6kK*<ErBS9vP8J!3McGMNWr_L~8I|5X**>|I9%fnYk>!cu`ng$Y9$C4?
z;TBv027WHZd5&o=!QO$z<q=`!d4Zvpp&7;%{$AnfMTN;3`XNE-Sx#lX`pI0ny1EJ>
zg~=IFPGNbW1*Q>BK1Qh#hJmgDNq%l=VP2s=k!I!|uA%i2h9O4UUS^J5zt6wfsbsWo
zzpeD7yZgVeeAYdnmaD(%sK}PGFARng_HIzDsITeIwOx_^_}ybRt1TOoH(xmYTrHtY
z{&wM)o3#@fPHOCCQ8+v^Xln$IIm^9wNBfkzS6qIz$A!sLvVZ&OAnoD_l`WxjbG0+$
zUh#d|Z2O`t_*d}CWcT&odxcIM*R<L)(agxc)Liawxof?;5c|XKZ$FmnaVgBMK7UJt
o>1mPEZ@)Y(vsqFK{#?vY#QD^euQc9@t5m(h%kq-*R$rqZ0C@_}^Z)<=

delta 630
zcmX@hvY2&(YJFvzv$JoxLPe2_w~v#XM}CHxv1w9dWVxwZj*n4zUQj?)m8-9*tD9$L
zK~`y=OQ5kMS9n@>mVu?dcV&)~dvR5GL|A5ej(=KUUX^P=rIA;Le_>^znSQcML}8{U
zm#&>cadC!jYKoDmsiCEUXPB`|cA$c`n`LsbMRBf)v9D2TzLSe_adAdaWxk=iXQhRH
zWO+(rUSUv#ezHlVxswH#k4HgJd3u4Tkzavjrc0Supl6a<c1CWvS7B;~hg)h%xsgj&
zNk&<?pQ-D_kK*+KVXk>5zJ`GY0cIZl;Xa`rfd=V@`EKRm<wa>3-r30p1tm_w0bynN
zF4<gR5iTjg`DwleNxo&KK^Yb)9@$CxKKk0pg%*{8NoC&p!BN@e{)w)ERgoZ{Xy~RF
zr6v}qD%gc2rE*!i1%wqDq~sQbh6k9Zct_@Y8JFaw)~6?#XXgb(<%EU=xfMkjmlV01
z`;?a%8~AwyN9OtZlvD&~87Gz&XSn)uc~+%!>FVk#xH(%S`$VOclo^&}dM0@mnI;>g
z`|7*r<m6=<1~`=%m<8mRdL%}bn;IE#ZJon2d(Krczt68`%t@7HUwM4NT{c!$kEQ3;
zHau|Nch;bOZFEALZIhOj+G}}*U77lfT44{Bw4c{n@%CrOMZQ0##x2gXbXnW%Tl&*d
z#OqG2abaVY*v}Fte%`m$jKgZH)Nai~tP40BjK#jMefB5fqH*z)ROR&#whAaK^1Rgl
zJ@3>6ZV$Z~OiR*wcKq7$png$%9p~C=qYVN^B~$hV9TbQVl&e;WF48y>?VKf7{pql~
Va@hK$oHehGi&%AwmYqI58vwVP<M#jn

diff --git a/secrets/nextcloud-admin.age b/secrets/nextcloud-admin.age
index 3f0a5e0c494e9623723a2639ea578b3788cb8bba..36b10c0581ac0394d6220fb78b33ae649fd9c67f 100644
GIT binary patch
delta 438
zcmZo>dCELNwZ6F2z_qemA+#{q($g(C*wr^ZE7UEgyu!yPC%eq3vcM&=$lck`%h*jn
zHLyTG&C|n`t2`^ysjSrB)!QV(DBQfVFvQ8vGCkSJFEq!*q{t;H&pkyyLOU?j%)>pI
zOV>`JxHv;MHO0u()X-AFGtAf}J5V9VsWQ!=Aj3N<-PgjrG`AqhH_XVZ*xV_}HO$h_
z*VNp{$G^-nG1D?JFE5=d!aFN7qRcWs(;&qx-7wfKILp)1DaSayD9pv#GRxhlC^Oe2
zATqf)GdOVKNAdbJ|J-mB&oI-h;_N&}BlAM%&<xKCKhGrnsPK%;4D+0bqA-st3pWeD
zTwg8|?+VutAG4GYXN!UeFQ3w=DyN*Z!aPTJcekLbs+0(m2=n|rFV9S`ObaeuU0sDl
zrz}IS<f8Dhut+mw6I0VH??h8WcN0U8Bt!E+qr8HQQj@rh0@Fgbkf2a5!<P>`pPf4%
zAsyFzob%7Drc5rY!*+cO3tR8WakzZkDqXx)SR?mF*#z~(Kg+sXU9P3yHHr>f^{3mr
h`X$f(?X^d_|H>>*k*}(KzOEsp+E!`q?Kv4?&j3|=oZtWe

delta 468
zcmaFL+{`jTwZ1aV+1a;TA)u-<*w7*{MBl{1GqOCxyCfq$-#00#+~2LpT-!Y_+_9oE
z&&|igEYcvGE7Hf^)i=|#(jv?(#4Ou9E3Cr5#K+9IxGc~$B(f+yqAb_bJKrZL-MBEF
zOV>`JxHv;MHO0u()X-AFGtAf}J5a&Z$T`xZJi^jB$2Zl<G%MKH-LEpl(yTlwILOk#
z&CNYK*VE7-D$&g=GQ*WCy(HT`**GiQ+%i8hFUQwI-@DAu+|1E5PrKaQ*R9ecxXQ3J
z$Hy_s$gz0hNAddf+<<U13%5YO&?Mg^lfcYM<3PjwsNfX$^1_S&f48)x>}(HrUo+Rx
z^m4B3&@5wjH)p3Zm$XuCld_<+tP(SQZPUoqpvd%~N=pxYL*p!qveM90&vKAYOp3je
zHFeXAQWJ|)71Ars91D`U3Zpy=s>-=^b#)bd^PGxvYm%Lu{7oyIlT)*ub1gITUGoic
z-HS|;{X7jFy~8u}eaebMa=l%-Qge3L$;NDCp1AQt%Z^*G7dAh9yEaCDwcqQnCUL$G
zj?VXN7Z1t|_?mG<pTTkZga>>6R$M5tRs9vPuenpAR9~G_@ZaYxo)3?%b+`8{<FT2M
KRyVh}+YSKr`KAs4

diff --git a/secrets/nextcloud-cert.age b/secrets/nextcloud-cert.age
index 37a12ac86e5b29648c15bda68ebd68c5176cf04d..00570c162150b5386b3039944b54aab5ffb69d75 100644
GIT binary patch
delta 1692
zcmbQjcZhd_YJG93foo;CLYYTNQgC^CUW#k6w?$P{aY|8crME$TQL;&yS-5MYr@m2O
zK~Q;EzK@YBSBk$!rAc07SxKIwX;rGBo3^WOcvM)Cd1jWmr;%%Bc4?ZgiK($!cCmRr
zm#&>cadC!jYKoDmsiCEUXPB`|cA$cpTco?Tse75JmrrnUfr*c2u&+m<VMM-fVo-8s
zWQ4w}No1B!NrpjrN?10RYnpbHuc47+se4LlSfy)uc4l5iM1GN9iN244lVwIgs(E>E
zuD`K+TG+%767}f@Io=i}KJKO=rD2}Vj>*AcVMPW`j%og;`MHkzSxHWAmF1OLKIxUA
z>0Cx3DH%zI9swR18HGj#73Jj_Q9ik*mae{$p%LyOrEY<_ImP}V&aR;z<y^YDx(ZI2
z+1bg(9wqK&u8tPoIgvr-;c4kkNiH6iz5#`ifd<6|ruFH0kuK#`hMrtkwN)$f!tUF&
z+Ot>f^Kv{^I_3ZR{AtQj$JblNw<OLqi0Cn0zFx6SPe}ay<c(&N7ClRep7vzXpVIce
z9eXbPdHBy`SD#zij&r{^{9W70?-%S|_U5|Hsar26tyT}zW-`+>{my9NHt~N`T<!J`
zMTV}0TvM{R*Qg$-Uu$vyNzB42&Bo^spU;r?Vm`xpz%(som(R`TY58_$T$`QvyRAMp
zInK$sc`c^B_s^LH_l_BRt6g|*G0}C(m70ou7CNa6f4BQ@>zcFB*lq3=g}*muO#Ayp
z-RolD>QGt17uz<7Uhuqspm=fRiL3y@w&(E^_PYF88TcYaQqf?g$C`8X@84P4^FO@e
zrpQ~9H|zHAGx~RD+y4A{aO!zc<>-lr?hE~zuyeuI&NZgWIx}2X9e26=W=i{)X=nBe
z<(#;+d|J<|U!UXjU*0ngPg!(e&N9``b=SDX*_{u5SN_VsLacq~f5Sh!8G}~d@cF&0
zz-p(;98cD1S)nIyp1D#Yn0#|bQfa}3dfmH6H>n!;IERT%IIa3yD%<u<x2MRm?-#ip
zr7};?Oq*$VsFp2;*+6q*?TN(5mXhnwvJx~c+nzpu^kK!(rY}+IOH5Ke8k|)N7Sa$`
z6KAS;()p(R5qDu!mO}bc?oC?F!3vqvgW@zE?^jH7vo`pCVZQyG97~piPnXS^YwI19
z`nx_+;YnW2{<>efVrS<*a#|f&e$3{|tia}{X^t<ITDdMP4P2YUCZe)6w?2xe&a_xR
z_Er1Rp1Dkh^*%O@rs4YzzKwpg{mJR`KMbF@@;1y(G+CU+^*Ggk(X)qV)@+S=E3x#}
zO{w%13Ganu%(oZHt#Vy)caFfh!o`8!dvew}_?X1j*SqgIrxs!9TaoXo=y`dMh`tj;
zdQjT7iiMp!Px;p{bSXXG?PQf+a;mA_pG{p_=(2}x8rR`d3(h*Xs>_=5>R9SsEt<~7
z@Jn;cp3a_KJ6`f?tiBRmdyG}&+5biEKU1=Ih@CW@?)HB9iD$C6Wn$8<cHY_lGw4NP
zvZcFl`FeY{f2{Sav%d$5PZF#7^;bk-QpkZ1Ka-PhYG@vHmEI+BVz;2g#mW5=z2{E0
zK3Q&7@HKJW?DqFYdpG~wow8a^nmO;KmGtue|JEhf9&|MOce2qW<IUogdp$b1!`{93
zv-i2E&${sYtln0h){O%G`<wkeg7&xlzx%L%_1S$!PFvDrT=w>U&8=tf`LeXZ^nObZ
z59b7?w^J5<a+#QMOj3Pu`R&l(5eGe2Z4}-ubKUDhes#F*%ERXOZ~tDkvtr`JhJ9X{
zYk8mX8BaMHbXaNr@AQxjk#h~KE;01#Zb*G5?)pdQlLteqBWGsNevQkoWOw=G9m(0Y
zw{@+EllkSlKeu=Ksypm9S#iPsTK$LP+IRayG7^>r2pmaS>OSGZKj#3`DMxZG4yClT
zGCX|#Gx}kV<K{gRuRB?&e!DzL&F9H`wlyxk-e)qt%e2ePYF<~X=eFWk@vS2gP8A^<
z8<S^j$=tUjsdlOE-i8;p{=ctqexLMsV`0bVD-Um&ZhW3CwXL&oT}XxP(`{wmKEfex
z^%L^fL{5?wn|>~M&sit?v!agb@t@xrue-wgO{6Wpm7_M~JxgrZo^!RUbY7}CPA%Fz
zDbsn*)HKEITFY1Vyi4Bm!Z0K-x6bjyrg?YRE_c5QJM}A%>*dkrf*IawTNZ`B<|*bC
zo?|iV@V#XLY0GDQbFz#%xthOjeTIPJm7FPWJ{?`;8gFfuWu~O$=lXhf-o6hlapwPC
zJL{S~S#WuhL*#v52gl26mvJuCpB)kXdi&&Wwzatne_FXO;VKk)()D50k3BAt`!9OR
G8UX-jR25JF

delta 1775
zcmX@aJB4q8YJFvzv$JoxLYk#<s!>H|iJPOZNm68%Q)Wm|n2B~`WwE7irGb~bdxmAI
zOJGu&mvK%pmywZWqGwr=OS+qvk-JBxnUhPFr@xtFa7nUZfuWmUVYs`Wwr^%>N`yx`
zm#&>cadC!jYKoDmsiCEUXPB`|cA!G2ajKzPYGjCIfsbXfYg%4~bA@S0g+Z22YJQ1<
zYkFm&WpIv#M?`r*N_H`qk6~VgL8fVnc2%)+g@wO)hKFH6L`tz|PO724Z>pthN}fqU
zx?7>XcI3nl67`X$&VfFaDM^-TiN+;ar5-5({zlq{*=f#xDMtDMQAQP!zF|p;o?f|z
zCS3Z-{)Ks7Y1#o11z|ac1qKCar8$O4#g^%b-cAu!X&#Qj0baTOzCocCksyx*`zY(C
z7o{c^r*gTJgrsO^W?5GHJNcNE78XPWCFkaqI;9uar>6URJB6AVS(JJdmn9dwIhy!d
zltlVhdS!-Xmxf0eTj&==85<OEWjk`|>gp<#`<J8#nPgRHr<r?{WQQ3B8>VI_=9%Z_
zx#y;&r0IJ&`x`lDCl;k-r5JGSyU|oSaiPNNVhPS}=9rrq<}J^<nk;RXwWmxt+xY+I
zt&{5`E9$$~Z0~*?zv$+n)qB4irbO`A&z#gWq10Jv#^L6i-Eu3pPHld?TYN>?S8n#G
zrp;5=99;P`-sm6GJa4`Q_k%a@^?zc%J=Oi+twl0%F&|!9*M)1$%|HJ?e#X1w$_Hxu
zp0_-$(cZrxdcmENdBRPK3!Zrkd#pX-_xDHOy5N1jPvZA1TUP(^>(eu5lHPpw{E#l9
z_UGkdmtxnH*-0i+75|cA1Qj{1tUIpJqqRglY<8~mHoMnF-){#-uALgE;rQc^=&Dni
z4i}Q*&Q^Vi5cGC$edMO-D$`u5rupA6>z75(Rcp5Hs&7_jnYa67)NBdMXNY%F%Zxg*
z?#KRpbDB@Q{w(qR@{9!?_0DeUZ~taDh!(Esc(T0uTy(LVNs*THq_~q;yHmaOB9?^h
zzxgllTj(!-fpzB!*9Pb(Gwhw>c);bJeY}TR%x}9tlay9WPMR4x(M<6pLwASnv-KZ!
zUv9p#B$X}1{`8y&rPcc%*Qy6~lrvoZbnWnrs50SOul-&hDyn>6{)uVR`Czwt<(hJP
zA^*q8=Gtu{Ldnlq?V1l{H&)&IZ7IgS@J48tSCjjsjn8V{D#nVvh<z?%uUfbCMAqAF
zHk_ZYK6EL4^XvGki4*L$?UZoXFYX#BY2$R!{MzKT3*Iztu`JjfEOc!zk7SJI?)P#R
z#IlTLbE`kUQJ|}MIeXow@a5l?<7P0f&#R9vH_1w5?c#ht>+*E{mm;aJpRL&*<L%gQ
zzsJbqm+RZOmP>YyKLkG~Pu%%>X`0Yf-3J!)D~-HoK47$JUQoBKTP=upkM1-sg@?i`
z%=%oV3=av&d{aN|HGfU7@v_pdPKz#o-u_AM`-KjjEQg>4Z<iU1ow#zt!}I-_Cl?cn
zI9jr0>Q`^<%|7bHzkT6tT@#&utd=jnO;VfTGI{m%|5~gyItHd@DXVU-y;kfyC8fKX
zsVF{V<)II(4{P$SW?fkMM@ma^&(3AfC&|~oPX1+h#v_6KN!<^NzKZDFId_d?17Eis
zWqqTV;J!VBTT!X7r)WdqIiBqw`!fzd=)S>l%H#M<quU4Sr%rg8KXujxrIYHX_}~0C
z*0?|a;~H_ZUDM3YwcEHYR*#UM@%>txXn^zz*<Lf}reDDapS~B3cwRGS#-$~`%{wk~
zL}smd(csJ36=AC?Z~pS0VbdK;#(<8>hkwkjJn#H>Vuu_1B4KZ*1@;wBQ$9CZUp#8a
zRkOI)aZ|w04dE(Fo%rhSv#k4db9MTxA7?!~{6a4l$Ul<%qBZqWUJ?5R&!CbmuOA9n
z{F%KtJCFBVXrHOw`JbWXiW_R8=N)cb-Te7<`|A7al4h%#T$_5`rs0Oy8Lw<XhS_ts
z@S0oi6?=1IQnzyQoqbIW71J&}`=aOcsHLm0U#a1*>MeE8xJs`xYYhMJy4L5*d~k1m
z_w0RT_RMz?KZ4$Ov@x(q-<ioF>pkbFWI%OK?(x)(t&a}m{F>%8eNR>HyFYi9wV!Kp
zI3Lt|Yn_LiYXR%K@9I43yglB(KilsWvgKEUYEJdyolBQV7)uw={&hm&-&?*fb6VeJ
znl77vQJ(4NhCL6a-SB#(#j#)=?}uBn4%fHl>Rvsplx=hOj@a~{*INE3yxny0HrLFp
zZ`M!L3k>$)mRh_+{2F7;k=bva-}x#Rd+@X=zvq5-ttV!YollK#?X+6ce8%XrlgE$W
z$~XKAiafdd*!Qn;S*NV~=dZWDXX?HOUXJ^P!d>J4o-*6%y<}=x0`soB>uyY!KEZM3
j`?|MmdJ=AIKMQ5u%mljjuWS6i?q!~+YVG08TgAKqRaQBL

diff --git a/secrets/nextcloud-key.age b/secrets/nextcloud-key.age
index ca2d4a7ebd0f27ff17da5295525bffb5d1e60a6e..0336400a379ad45940a4c6723b8067d2f11cc97b 100644
GIT binary patch
delta 2102
zcmcaFctc=<YJG93foo;Cf=il<r-4sSM3kFxeuhDDN>HhLj=ph-V{SoKdZB))g}$Y}
zp;K~LhF4x7muGNZVxW(cw~JSxNkB!mhrhpZutiyfo1;O#K}BhlM}CyQQ(#C`iGfEx
zm#&>cadC!jYKoDmsiCEUXPB`|cA!FbPNb<%V1b`=mT#$9NwG^#NkC{}d0LQ9sG(a*
zNUlqiTZUI?R))ELMz8@_Ws#4cYn6vnR8f^lWqGNOOOA_?nRlkMmvM@DMWLT(iF=w~
zpmULBR<Ps5kK*--u0_G_xs`ba#%?|?jwU5(f#GFA#gXB~`Nn1i<u0xnrv6#k;o0GV
z>5g0(#i_m)p*|*=<|&y;Q7(R79zmX-7Djnl&K{w@#*yARF3$R4ImVSH=7C(gy1EK^
zC1$=Q9%0(P#*yJ}k$$<U*~Urk#=%Cxf&OkD7Wox^DS7qf-Whr6CK=gWYd%N&Jt#V7
z7b|#A_=0f7(-M`1ah4JMe&;Jr`z`$0Uq0trNVkLEy$!BO$vI25dM`B0oNeiJ^F~r^
zJ41Zxz9J#<j|InBJ^!9>K7A)}Lf@9mb=Inyxf|IT&z}Au_WO$1sUO9c-GU_VpG><J
z6EcrCo%2I{ne4Qf`U^2Rd{%p2KR1`k-Wq&Q;@+Z{qT>AVA=RggcHY{>u=K@2rOi(R
zUjHx9{dYZJWv*$=&b^oSJhm*%cpIP*7_L+xeqQafk?lO~?xSfZR9{)xoW43w%8g%`
z>wx;Fs|<a=m^qfK&soWNA!mP=tGdBN)@K)UY}%D0=cn?!@A5mWKW%!w)LFrZOA=d4
z`Ad|KCkV4hJ*jJWnpIiYa`S7T(zXdz|BI$gw~AF}Q56f|UT5X6@I*&#?u6A^I&U8R
zvq<dSe6DNPCF|gK`pq5}C(I7{_PggyjgOt@#LM+XKa=HKJ5Py3dAM1eTkM?jar%!V
zE7*<iyt*@CQv5p3g+Wa(7@pTN)YR|TcqFq>;y}Wcx2L(cB#FB|yfyh-O6R3@mzwL7
zu7{{?m*`V=+5T<sM2l*d8?$8n-n?L||KlOF?hxy`$F)7;H9W}%v9h1Cm)HvQuN2nc
zYb`zerRvW=Kg$;Vz$Nhohm_yUjXt;M$kVMR+`0^IPYd<<u3xf$w<%e(>0~IcszvOR
z`i|KAgQt2vn#Jt;XLd$GDDTTD+lTiZ{<I(dbWXRW@2rJ&Y3iN*uJgp&QbVWS&&)qo
zz?*K<%-p9`5Y+Bb^i12m?Z=kY?JjR`6n4xO%iOR}&?F-<XhXTo?0eyB&OOn4{=fc=
zg>rC6+v1qq)6J}x3wL*0-<%~MYkl?7{>!owXYSQk-P|?(F5lE*$+u2*d7EpGa9(md
zA9rAJ@1Bed<6UbWzjylmLhSdRA53c&NQX4+x>$N+Vw7H(HIJCW{8N$E@@rqYrFVat
zY=2|B!o_EXOAMDyVN-rxo4WJ}<AQHz=IlOnF8{-(`DeXP$^TuY9Id&r!7=G|-lIox
zYD($>&YcT4>w45bHTL@E{K_N#{#nsIf>U$zPOn&#=e$&Q&NR-Dj&q{dExs3>Qhf8A
zb(e+s{)RV_GYo`$?NnaXWZp}kdauo@^kIju{{mfI)rET+wsmi~rY+p?Bjd~B=gYiy
znAXHvJ^tQiW;RFZ{)gttwUUz0cd^_2**rN@W`DKmQ?s0+$fwC}zw34W$SklqXxx70
zspYD?-$JcFpS-)vCClsoxQ}htG~wqJo?p0k`6<rzG*+9kML%VOu=KVy@Af@^$8&p6
zwuIrWz80O!{jrO38@^a%#_!?2a%>{QR{sZV#XLv28%uf(KirdBrX`SjD~mPy<<)&$
zW>Y@yd3Sii&I6h%kBTgEt71$X>ZN}q|Lj~?8fD`c-RXVkADd9_mN1``uSrv1Fw9=N
ztKvx3x~ui}t)8w&7q<o7T;49}_uuS<a^&5g&S~DiUw(NLz*c^7NtZ*)^DSw!-PbaH
zmzw;lV&AH&SMB{5a}y6cx}PY_Fe`fD`^lkgwP#}R^^m;jYP?(4FtIgRi<*3%Q>j!h
zwLA9BhFhQCd*3|dv^4y9jM%#tGtqEq))(hK1zl~q=ym+hrz?q%w#c(qKUg$hu1Ku&
z$PvbNCYfo^E?;;Rx>vVZMbuBldy1@$+&|NZ-faw<k6z#1XTm7ruXZ80z4&66^Dn-S
z$Iawk@7-j6>G@2Re_wKb?|C`XOwau36#u4N#q4^K+m}|c*`D3=e-T3|f6EfRQ)lYV
zg?udiD%ii@wv5%qd+vPKxSk|0OX;VAwMnzr_#{azUHZ91LAdAioyDfI^0`%xyKO_|
zcwPrNCCo|<zOU_iy~Bi&*+@0;zTU#i4=S8@Ufa}AUdgWUd9%iqt8;#Tob=0Qt=lDo
z$m!e~=L_bpudiOX*vvZAK0m@WL&9nUOV=hRBjGDS8T;S-7d;|bzq_cX<?Tm)=5)gi
z3(9ZA$W8ro#l+@I=Sp{-zejhaT-J81SiPqBo4Nd_D7~oToElfG(jT!IRBHcDvN-d@
zAb!TScgyux{;Jd9oT2#U`lk14d4AFw_gAQXX=9%AJC(mmZJ}j-Fr)CkVzaji>&>^V
z|9gJ&@dx+ob&VVL2><KPj+hzF*%W%$M)=4=?e()~Wf-akn@utNt$xdQ`s@8t^(}0w
z1}@W5(`>HAzi~MFf#WEfEnoicHWBUocQx~tDz>-Icp&+4<FWbgA3v^rm3;2<->EUq
zbCd1zd$0Z!$osssWXYv3ErxMxb$5%3s`7mIUwm+?MXX)x6}z2hf5@fSA5NT+$GI}L
z_e|$Gi%q_7%oe-tcinvU=u^8I-B$@Fq1L79YJMz&^Y%p4RTwQw<u1t4XNvRfcrCEw
SY2ydh=D9C?l_t35rvU(=>eX8S

delta 2238
zcmca1a9?nOYJFvzv$Joxf`^-NXi|QFaY&VSe!7WQUb1Jluc@g)MU<;=WJsEeSCW5f
zs*!1yxnGb4SBRUDfwzf8x`|0nfuBL8u~TrFwyT$WvWsh;K|rK`P+~w?VQE-aih-Le
zm#&>cadC!jYKoDmsiCEUXPB`|cA!F1VWgY3zH?P#xvz0SmRVtGYPe}ZS*Bx@OInn>
zmycg?pqsg2n3J}CuCphXVOnTbh@q)Va8`+@sgXr!QE^0aq(xz7M3u8klzUQ!YrcP0
zPKK9$ntt}gkK*-4#*u}g6&B^Wo+f#Q5e6Ba`L21c9wB}y8DWJX72XA9g-Lm4M&3>V
z5e8f(g+YEnk%m5bL9R)bg#nJ**?}3R{&`**Nls;Dd1<~uL1FIBMU}xxrNtnh*yd&F
zrWd6q7N;uc*lJcP7{w?kx@x9c_}Ot;7#C(%IHsBy)CW7KrdmXJ1_dQ2TZD&%`}-ET
zCK`H$xcU2qMx`e^M^+Vkl$AUBSqA!LWqIa=8iW_P7Kh}xbA^}%W~U~4muE+0`4+fE
z`KG5Bdz1x~n;4szM;ZpD2DyY8nOPKua_Q>oDx{>PR_ccqnv@n7=Hyvggc_8kTKa`~
zdPex>*L#Je8<!b)d1#w?M7o-J=5xgaUjLALgn93W-}h!}d6^}-sau~eo4jcEk$NvF
zkF{T<8aQ@2u%ua?{&)I98JEF1HO(8(*BGu$5nE+{W52(1%BDQOlEuF?pPTv2@!tBr
z@WYL^t8*W>ZL!;Z$9l<Cg|D`2J9#(d^h#N8$~o+ln0c?B*H=Ml)u|~}tn#yNG)$bR
z*`yU6Sp2=s_XyjLTjJZUC!XD3nE&o$);!*`o1}R+Pd#)%cZNeaTS&rMomsr|oWj{x
zuJ_u<ExGZ<vSa<`uLbXQy{nq|tmw;M(G@$+Oy^d3_D)X1@5Gz>ipR&?cb3k(a!*k`
zxxi9N(#`A8uF~$$;fnQ-JZ=}~c3VF-RxOv3yD`nH-o|tH_uksFmHrn)yIQWM99v*4
zuRT$&bN{21dHM~fJyp)n%ltUS^kCS8zxgY;WZaJJ{N|eZHtsXav`5izr5c3pG_2Y<
zr^RnQ*OaMF3nP|t9+!|@?R2}u@SeJ&v}{|J_^tinY0MW-hfgv+ac{qaa=kE*vRr}x
zlGDXkR@J*!9xBPrU%gTwQrGj@>&@b7jC1DwE#L4{F>_v7)#g|^pW6c4wrl6wn{L$j
z_2k*N@V=C=QxDWNYmA>1$7jXAWqpz3F3i@v>1Tx;ug9@j4-aKl`gA3~tX$W$nC->m
zoquiSZSh{!t{TyAQLY!l|J==vN8wQY3-L3-2ad!~<UJ)HcCw!B*$m0+X)hVCS{yK*
zXTF8w?YyQ(Gba`(zFHdbS;)s<@3XJ%n~%3LRRW{B9)>jLdmg@SB9pykO-j7+ql5Jo
z(yKRqo9+?3$@Q0Axqjsu?!`$Ls@G>8cF4bd`NYA<mK$XkPKG~rvGq&s^m&mL+_os#
zfV+O{hgoZzmuYl0#T}{(zA<TH-(?<7;R9O@Y%acI%ztB4x_aW`6H86r%;wW-t_q+3
z%6dza`KAy5-i6dYeR;uhZNUY>XG=>AO)EraUG<t`IUz#O`u3T%7b12FO?Z2->ho7N
zCby3C;M*_W?C3ooY@s|o^5@-U<{wKUbSF%-{H9+PX<lFV<;+S3qp1R$wTqle;^uiC
zHvh3SWQvULtvBb`dW+cuw{3a5@y4%NFLxdCDY;(75T5*3#BFn)=I5-Qm;Ldq8c(*r
zchJ+A-oU6-@A+)O1opfYSyO}k)-9c;ySC0c@1pA&H|IUgrCTN_8;4J~NW67V^3?Uh
zS$aqAFmOdm_3!)ATEAWX@A1+T88dT2uGBwGc^#i<{>twh&x>gb8}Ho-o8<q<?Bt6h
z(fi$&q-dUe!c?awyHGCVbxOP9j1|qtPt=_}>A>|ZNA^^>$MT<|i*?V0mz1s*pRRSs
zVs*N6@9J-NEtICU+icbKQh&^}<ILS^P8U6`db4Rauc*5o3*EKtC(oDadf%_YDu>UT
zy?!Fu_?+>KV8;Bl(@KgO_kIffW9%z#ug<R!Yx*{{KC}AVf}}0nh6c)0*BCa(udzHM
zbL-`^`<mHS@3?=aFSS_oZkFff4KV?H|F@{k>3%eUJ?ZWCS!Pbpj&>#F%nL3L_!Cl9
zr`@Dfa9LGy`#+0Y2OZSkZ2TG?#}-zvaKAC~kH7Nr9Sh{XZb>$pFJ|qu=ZctB>i<l}
z(;FJAK3Ql@U$bw1>iQ!Or=0L(S!lJO=4OSR&Ou?}YH`NiyO#A|Zlp=IukroyrY7ON
zxl1Bb=p@EH?GDB7rU{xZQ4eC5I)CKA?5%balL8Aj>u1yioik#3D008E=*^^P1NF7N
z()CrJ^?UB_6yNa0YloD|uXWe_<ga^w$+>8=j?>Eg-tO(yZn8{ExBWg7alGb$_p`$s
z7Zi7kZeBH2Y(aW(mHVv9TQk4&ZkC?5^vK4x>=U|&ZyKn07{5^Q`mihH+FKv~dCct3
z*V|RRu(Cg=`eOBWX+Hk{8Dg8G`Br`0ZJCkbI=ec^zFw!Ncvj-FJ@@?YZr|5F=fsgk
zQTG>S72h}SZ?q|LGTP8I_nU^CD5Fwo(%d2+zO^Nr=I%US$~Uj^^MjWqTOPN1Jvq9r
z>-@we>oR4}J2D+~b2wnXGNAmxR+-E%nje^U-<c;m`=;@~sp7x?t2*SpSDtAaaeS^u
zbhS^8Xw^^U_W^I@>O}<Zy!`(<&HS`1U)Q0T2^-EWT(e%|$>xa*qa@m6`PbQRyLrg}
z22V`el7p&MSALg?=f=zk=a+rH=Fr{nO{~8;%zrN3=4f+|dqqa9z=l63g8~y1ua-S1
zp5<I1EG)7^;QPl{?{9DW{IGJ9z)8!n^-FsLleYKs9b<bQk?;IHR5IvF+V)k4Hw33k
zSh!!>pp^dR?u(4muPyT$&jy;mG~LzUC_N)KYTvCTN?}jBWhxIAg>dH0U|1m;+xlm=
zr<(2LM-?_R=h+yZH}IX3a;EWpdF1@*dpi~fKT<hmI3uX*n&pXi70UCYx6jG?0|52m
B2p<3d

diff --git a/secrets/paperless.age b/secrets/paperless.age
index 1b9364ccd339173e5a91441223dccd850ecc0c13..279501673af5f15f62c75877eb72da5666e1e781 100644
GIT binary patch
delta 439
zcmbQm@{D<cYJG93foo;Cf~Qw<wyRfUMNwH!zK2U-N?2J^W`J2*WOz}qennboqOW6W
zP-T`uid&coS3qu<d03F2lZU=%esN}sNoIL+L0UvnVUC%nwzEZExvP<dTSdBQnt^^G
zm#&>cadC!jYKoDmsiCEUXPB`|cA!F<L8e!+Uv5Exsc)%Ko==p4N05PQpjoO>R)w~6
zZeWH}RkCS@S-8JvVP-m)uTyeHSXohNcz&e0t6`dPWO|XQtFvoxNJfT5mS<IxuZ5e5
zyQz7QbFk~gkK*-3Nr_ceJ~_pX2BiTZj@e#;DUqfXRmH*D#vX=V=9P)Lg^_`2+NNez
zS&>}su8IB@{y9e4ZbtfE{*}2Ff&L{1m8L#P{@PLLCBZqaS*Ct@?x{fq7M@(Xy1EKw
zzUj^`?)hPv$(|-b7NI%rfyr*!B>~B%X~ljXxn5DG9ue`{p=n0x>E+p6HGVyw{8ENl
zQ#RZYz4X6j`X`Uy#X9MYp$$tKqE`y_ZBo)RKP@cgy!q3{1>PR#bAF$ZzNW^c5OCM&
idW+2cS2yMrsb?=`pS3dHD&?B#ZDFOyZI+Ycx{U$KM4LeX

delta 492
zcmaFHJd0(5YJFvzv$Joxf<c-`Ql7V&k6U@Baj<WNk+xe{u}_deaau`=zH5$mNR(rq
zfuB=_p;2%)SB`6GL1<o~OL0Jun^#&+vR_z1dPtCCa+$A1Sc+LnLAI&8TS|qaUvjbq
zm#&>cadC!jYKoDmsiCEUXPB`|cA$bwd1-D)dQNzGmTys&ky~Jjzo|)xeqc(Gr&D%-
zYhk#lL8xnTNoit5wqYn&kZZC_g?U-Bg|oJ?QDIbakcoS7PNuoJSw)z8Kx(*8glT0_
zif3Y|d1CU!kK*-(e#s`;MqXLr>7hm@&P6$HsUaTO83FDQ!HE$?$-V}8mJwM2j;W48
zVd-2Umae5GrlwIQNokQ4Zh_{OW&S?KsUE3;hNWIfp2?26zJ>Xbxh~%3+L0iiIC$my
z7bZFCrWd6q7N;t>+32}dD%2<_TUAAH8D*sTR%nOk)`w>q<yH7-yE!LkmvHIo>M9td
zn!4r`I%Znr_~n}CN4T5jd1e+Q`{%hiW+qi+cva+=6uFycrxyi<g>v<6w&7&>eEs&b
z2_m1Qy(iQrFY!LXF+D|Gar>kUb;Gavc_*%Yohp69dGo*YiHaQVMbBdQR&4uMKARyS
jJK)%Ck;(2qM0U&&X*Ui#7;txHn&6vTJO`r+4u1jw%LT5v

diff --git a/secrets/restic-gdrive.age b/secrets/restic-gdrive.age
index 660992f42852bae0b25499afc4348c3d0463bfef..65a33844595a9f62c3eac2cdb22d7ffa14d21a1f 100644
GIT binary patch
delta 877
zcmX@eK7)ONYJG93foo;CLW+C3XLfj{k6A@XpuTgIu~SH4Xs(NIsJD@Sn0uOeu}h_S
zdR};hNo7txmyua%R7pjVai~v<pO<-3aB)RyS!IDiR8XpCieqtQlAm{$u}O%#K}vox
zm#&>cadC!jYKoDmsiCEUXPB`|cA!Fur$M@Tp>wu&sBcAnN{WZEiG_!Wd7_VTZf3Tx
zrAugqXGCdscz|1Sxnm?(QF(Gfl2>qLv8hi<mZ!dlXMj_Mmy2Uquzqf!N0m`Vd8w1J
zn_*!=iF@|MkK*+KmcITTp;?L973OKhIVGOXX_>wj-X1}I8UDEi#-WKN5oS?U5ys}J
z9wuA?VFhMImfm?~W+}eD85Wt@=|)jOIeD4Rjs+DZeg(nVIi)U@?xqo*Ij&r~y1ELk
z+Agk^78YfpQB{Qn<`s!)7GZhL5za1|fkE#2DW&;k`MLF_l_8#m0acz{`)}P;T$39S
z8hj!CyJ_Ew`7_;0!mInHn9ZCvQ^<^?IYCSN`?}qJcXqpM?he~^;H1J=(_ot~;-?Cy
zWwiAt8XR(8>yyV@Iy3+6H6ttGZvXnZC6D72y{hXMD+c&vHOaTO_ihM%|N5rNQSN*E
za%V$t<}ZD|Res^RdfDkGjnnK37tcDp{j%}(pGG~c{^$O4*S=(!uBN)te7n@N^8Krr
zW*SZ`nb5oP=3U0gWle2~k5+r$I(2JP{IU;BeBP~^FJhLcE!RGL$0fqkQtXQQoO@^1
zzUydERzCQ<fuZ$iz5M&Ouy^cDw_f-aAIY6jufDJO;B$*T3VG8N-Bf1RU*NyLFmtlZ
z&k3T}=6<LbStxcyb9ebAy?5_!*)(~tRIKyVxMLh*xqSK??*!iqvZ0<joS{|T*Ghk1
z&|N3<=|b)IG~+P#B_XFb`lcMJZ#Z>j@s&HvH*FMPkM*(${t^?M^*&<C`S+L9=DV&u
zm&<N((y~)G^D|GqNv(S>`)+Mh{^RxatxJFX&?uIj@3VM)=8@i7=2i3lda-gCTrpc8
zovE!}@ImxI)3=VFw|TGdzLQ+oymie*$K=k_tzJt?{yAs16#h<}A2f5)e~p*j0^IB-
zot5mic7Yr1gI{0X&En5wsWdHM+D}Qvtar;+vi3O@zsc6GYERARz16AwC3~6LndF5$
bqLr@yn{7?*uND=wt9tZF(qs0`7Vm`sSR8gP

delta 918
zcmbQievo~FYJFvzv$JoxLRp2SM_y)<i*s30h*6bSlzC;AL3o8(V3lj4znPh-nOjL<
zxW02(fN_;CSD3R~pmutGa!#_PTS}@$L0V#Pa$<U=yO*<3NJK%Dd03!_WpZAXt5=8#
zm#&>cadC!jYKoDmsiCEUXPB`|cA!E~VQ9L4wtIF-ps%k{RB>*Kx4uhSPK2vxL8_;Z
zVNO<XNQSqkMS#A(c|{;sRF0v6OF>n#aZ!MUV@8B&VpLU1nM=A`X|8vqhkvlXYra9a
zf2LD_W4Oh{kK*-71}@J2ncCjYu8w)x$u5@8$tFR@rP(GW+FoVG9$8NQdA=4|`emW+
zdC6R5K_O<w*`9fxmAOvgW#M^6c?RX~Cb?x5iRES%9+{y5#@;UZL8)0$Sq31VIE873
zo9Lz&r6v}qD)=Wl$EbOj)NwgSggEAgWw;u6hNc9X)t7VW>gp<lScDaM=9`y#rFgoT
z=WFNXd3c+pXBLE21elnlMh1mASz4ClmxUBp`ucMHsgXPMv}t}s<BE-ruX9rlhjoTn
zdwU-7XO3C>Rb}$r@SoCqWN*!n-+x@fGVrEMN@`A${LA&#PCf_a|JvDxWqmW*`RB6I
zZ~3Ha%PMjY*DqR|DX~vtW4_trRVv;LvqeH!<X-)rl_m1dyKmbcvl#+KoD-f;t~6e*
zweMy9%&ciY+<km`ZBBRzKAkgnrV8hr@T->>mrXf-wQS-dfvGWx_19)TGR-`*(zSNx
zi9LViS824VGfunl*lFXQ88epuUe+inA#`JAPaD^x+gtC>nb#h>zCO}{S;x9E^oP8d
z%_5f=8{hb5rByQ*I3>T`9DZ3bnW;p{;mzyC;`+sp?)<N~uQWT{#B6KwXN$tW0XAW8
z_Dn0<ep;@?`&6ahhlGwLj^!^d-#*H=T>i|{)o0&kRv&mFTM#p$<WRA9#I46i`gb?@
zPnJEzW3@{6>O~#qdFP(WJ~ef(k1Uwq@So?(k(tcPb<~ReJ|(_M7ytJBT<6|>?Gu?K
z=3coj8=Mif?y_Fg^DQ5pKdLQs(fxL^*snou<AkG$i^HQnb5ESD>@7O;yrOW)ysl5N
zvs$-yIm)i~`Lp+U-$WiQ=9abqt~q({r1B+yGM{Mt@HFr0l1tp_9@kbqpIerB_Sro<
z*Z!h+?d)DISNrxUuG1*6VCUSmZ{wz`Kk`!^-L*`7#k?{h=k=>&4*yl`w6$Me|N85z
Sg`>{}t6T2LpL74)$pZkoaEO}#

diff --git a/secrets/restic-pw.age b/secrets/restic-pw.age
index 2064b01220e120ef70ef601ca5c3703aff3f4de6..ee593398d53c56d72298b2843568ca5d85721862 100644
GIT binary patch
delta 434
zcmey*@{oCgYJG93foo;CLSbd1fwyr$zJH}fa;d9Jx_P;Qws}N&l4o#eo@uy6zN=$i
zMUrPhdSsXZm!+9enNMg%X<o6jPg0<BN`AR_hHGSyuUoR2nMGcyt7leWX-ImWacZFf
zm#&>cadC!jYKoDmsiCEUXPB`|cA!FPc1W04KxBAmuCKFONqS_6mtk6wOLlOuM{#nF
zN06m&X`!cEdQ@hax1#}9sfDXYx_M?*iL;xTg`<&ol1F+~ZlzyZc)58-PGMPDhKadv
zcxJF^va#pHkK*+eB|%<>2C3#I+2xg4-sPUT;lasnfyRj`ZZ2h|kpcRyfk_dL+1ZBf
z6`@?2o*9<;PAL^$;So75p22?3QBjr|K0cAbIpL*#UjELBxw*lW0TC${?vY%&y1EKR
z{yEu}r3Tq%QHHMRMwuQJp00U0nTCbI2BzV8E)j_qQO;3?hB-yWm1U7!%zfQmWhPS|
z=We`OeOu;ROyeo0+b^s6o;V$1PL}(0_v?h9vgOB<i*}j6<xY`5l-S2HXZ6Ald20hK
e7jgx4YsOm!EMp3K^lIYrFpbv%4>t<N{r~{rIh~LI

delta 593
zcmaFJ{GVllYJFvzv$Joxf{U-IS9VsmiBGmca+R}jcv@gmh*Q3qw~u~uh^M}DS)ysE
zg_oaGeqnhzmw}^uZmx;HW0Id)eq~}=xrI-1L56;szK^4}S*d46nqgv^VWLTfwy}jT
zm#&>cadC!jYKoDmsiCEUXPB`|cA!F4L87luWT1Ioo^MuUQff&-YM4cOUPiu)uZLff
zQLt;GPne5WP`G|#dT=_IWq_Yifxe?fL3mC?zJ8R6OL~D>lzv!fW@(hAr;mZQL6%Eq
zgllS~cX9H>kK*-J25H8bDW>6}$?oa-M!`kKSq2rQQCY@`CGKU02AKxAX}%G`k%evr
zRVG{kW-i6f5rHldW$DFXS<Y4dmA;Y2mim>6+0OaFz8T3mZrL7LApsRGRgNH^1lH-M
z7o{c^rz#YCDriS|da5ealzS;udT@mlWksasWk&=A)MrE%x_dg8hn5BAn`vkJyN7yc
z=NNcb1$q}5MtHhZcoaIi>1!KQxfhm(JGtlNgoOJPdiVx#6?^&?WV$(;lqDMF`UF(D
zR2W30x@8zg1O&Pn`KK0yReER}L>dPgT3Ti}d4;-%Bv&T785O&w8&wvEWTcyL>FVk#
zg!+b;RfZWBMw(Yug<2M-8kQA%ggIuV7P~oWmuZ*gnY#HH=V+Ulo1~N{bLque*eI|+
zys-YmV}`2Nu2<Kqyy#iSc!296hs9yjU4b579(nw|vz<x)-8$oc1+80~AKsKMxaXK`
f5wK(7n=W_e;t5aZo6VoA>El&VRldjBC-oNqKR?c3

diff --git a/secrets/restic-s3.age b/secrets/restic-s3.age
index e8687bbb83d4c34b24e4ec506ccedc1fc53f6c01..e7efad636753e0f5039dcf72213822ff86421df4 100644
GIT binary patch
delta 484
zcmeywGKpn^YJG93foo;CLYTIJc}S4Iad@OpsGo0@u|=klTXsRVVYYddlXpRdPflf0
zu6CM1u$ij`S5baYYMzgiOF%?$dVr6YpGQVzU`TR-Nk&9=xm#M5myy1kUtv;kdbmd@
zm#&>cadC!jYKoDmsiCEUXPB`|cA$b$P@08@zLSTuuWy!dc|~ZXPlZcXNRFkWV})Nx
zX1P&lxk*4yQ9-zIW{4wKj)ilUr+$`qRB(7&T5d&}w!WW%ex!MEl$(h~P^e2)c4khp
zSz4;TYeeA0kK*-}ZduM|{*h(nSth0ax#_7<{z;)uff<%bRThTs#;IOKmL6f@KH45m
zE}mR@SsuoPUO@%np=kwW*(KfuSp})a`4#5c#x5lp*##a|Nv0k}rH-M7-o9MAy1EKE
z;icwT<zbnYmF1;b`bEX=zR8Yec?PL@7A78HX>Lxbh5_|eekrDjZW#t#AAel$zWeMz
zYx9v{&iUtdc<96|*HBlrQ2*b4b@i>p=nq%e0(H2a%NJX%R5`M4?feaa=QjQQB)L>@
zPP`PWc%0fMagTSgY~~9}E1y(;ydUk{Fu{FJWZSeX_r~CmO)fsYU8P-`n_@&3O%}~a
e`&<3nd4j(LPn(Ao&!Gu(A4#+|TlTHe=m!7|k+Dty

delta 580
zcmbQl@`+`FYJFvzv$JoxLSk5^Z*g#PN<n~OVOemHze$mQMoE})hF4CChhK$ZSiW(j
zsY`%?aY2wTmt|qOXGnfUQmJ2vfqSmLb5x2&aZY4~evpTESYl;)dUkk9no+)^qi2C9
zm#&>cadC!jYKoDmsiCEUXPB`|cA$cHPH0YWu2X19v2R3fiDz(5p0S_4pTCz+R8EGI
zi$PMEW4dEdaI#5mp@#)mQh`x+saL5{VzIGnaAIC!S$1}ntGjQShe^6guuFx1Qh7*Z
zSy-fYc24%hkK*+?CO*lIK8DT}p_W<Z<@&BcrrJpcIhL+&US27_5oT#lnI0+WImyAH
z!M<GHCPw;6md?peZp9Wk?qz{KNr_JBd2SUZL763<IhID{+1mN;73SuZuEijqWMt{4
z7o{c^rz#ZqSU7PRrKRMA7ethM7iPO>mHSkc<{GDk)tg3{8oGp<6d9D}1Q_`T<cF1n
z1o)@>CWnM&6q%-`I%ni%lok4g7rI57aGCl$W@H9>m}VB{x^wC3>MCd#r<(c{y9PN1
zCA*Y31(;bFRk^1Xx|mvoBsm6{1o@VQ=LI^aSA<)Z`f}BWU7XtCwt}l@l98;*TKT46
zZM72{Jae|rTmI&9M9<$JQ%^V=l}QIOD@)5hijhs2&H46!`fb}6`wuzSdNUlcDbkI9
zAW<!E^yBWQinTj=*y=X*Z>kF}li?9qSsXa+t-!J4tq&i%*0@=y)z9?(f8EKz=%n0f
U_C<YrWi=<<*OHa~$~$!x080hWn*aa+

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 52e7af6..c28a354 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -1,26 +1,26 @@
 let
   kop = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeP6qtVqE/gu72ZUZE8cdRi3INiUW9NqDR7SjXIzTw2 lukas@Kopatz-PC2";
-  nix-test-vm = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMVqEb1U1c9UX3AF8otNyYKpIUMjc7XSjZY3IkIPGOqi root@server";
   server = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAUA7uVKXAF2UcwaIDSJP2Te8Fi++2zkKzSPoRx1vQrI root@server";
+  mini-pc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKla9+Gj2i9Ax7cIdnTM6zsmze3g1N/qCPqhga0P+toU root@mini-pc";
   users = [ kop ];
-  systems = [ nix-test-vm server ];
+  systems = [ mini-pc server ];
 in
 {
-  "github-runner-token.age".publicKeys = [ nix-test-vm server kop ];
-  "github-runner-pw.age".publicKeys = [ nix-test-vm server kop ];
-  "duckdns.age".publicKeys = [ nix-test-vm server kop ];
-  "nextcloud-admin.age".publicKeys = [ nix-test-vm server kop ];
-  "nextcloud-cert.age".publicKeys = [ nix-test-vm server kop ];
-  "nextcloud-key.age".publicKeys = [ nix-test-vm server kop ];
-  "restic-pw.age".publicKeys = [ nix-test-vm server kop ];
-  "restic-s3.age".publicKeys = [ nix-test-vm server kop ];
-  "restic-gdrive.age".publicKeys = [ nix-test-vm server kop ];
-  "wireguard-private.age".publicKeys = [ nix-test-vm server kop ];
-  "coturn-secret.age".publicKeys = [ nix-test-vm server kop ];
-  "matrix-registration.age".publicKeys = [ nix-test-vm server kop ];
-  "paperless.age".publicKeys = [ nix-test-vm server kop ];
-  "kavita.age".publicKeys = [ nix-test-vm server kop ];
-  "step-ca-pw.age".publicKeys = [ nix-test-vm server kop ];
-  "step-ca-key.age".publicKeys = [ nix-test-vm server kop ];
-  "grafana-contact-points.age".publicKeys = [ server kop];
+  "github-runner-token.age".publicKeys = [ mini-pc server kop ];
+  "github-runner-pw.age".publicKeys = [ mini-pc server kop ];
+  "duckdns.age".publicKeys = [ mini-pc server kop ];
+  "nextcloud-admin.age".publicKeys = [ mini-pc server kop ];
+  "nextcloud-cert.age".publicKeys = [ mini-pc server kop ];
+  "nextcloud-key.age".publicKeys = [ mini-pc server kop ];
+  "restic-pw.age".publicKeys = [ mini-pc server kop ];
+  "restic-s3.age".publicKeys = [ mini-pc server kop ];
+  "restic-gdrive.age".publicKeys = [ mini-pc server kop ];
+  "wireguard-private.age".publicKeys = [ mini-pc server kop ];
+  "coturn-secret.age".publicKeys = [ mini-pc server kop ];
+  "matrix-registration.age".publicKeys = [ mini-pc server kop ];
+  "paperless.age".publicKeys = [ mini-pc server kop ];
+  "kavita.age".publicKeys = [ mini-pc server kop ];
+  "step-ca-pw.age".publicKeys = [ mini-pc server kop ];
+  "step-ca-key.age".publicKeys = [ mini-pc server kop ];
+  "grafana-contact-points.age".publicKeys = [ mini-pc server kop ];
 }
diff --git a/secrets/step-ca-key.age b/secrets/step-ca-key.age
index 7a85a7726cd73a1c46e78d59e349d322c9ebd95f..ca7244cd6f6ab2a5f08ea74e7b880ffeaba9a158 100644
GIT binary patch
delta 701
zcmdnO_KJ0aYJG93foo;CLS{~)cSTTgPKJJAMx~FRmu0r4OLk&fSeScSQj}>xYNVxS
zc}`YlR#kQ~SDt~Fho4`1Vr0Ijb6H8YW0X;tW1eGplDCIrZlsHQacEk)r+;FQg{N~M
zm#&>cadC!jYKoDmsiCEUXPB`|cA$c1R=7oCc2;I~h_9D%RFsQ(YOt?QSea$Ii=T->
zesE4eNVa)USg=Q8ut6wSNN#FzPHIL-Kz6FDpI>EmRe)($ftOLPL1a*_ho^^yOH!Uu
zVO73oXn6L-kK*;lPA1;zS!IQVVX5hUW&x&7xk(X`mVSQe{sAV*7S1`I<xb`nCI)#v
zMuA+eL58_$MgHYg5&C{k;riO%h9Sj8<<5E8hEA3GIqv1@MjrWQQQk>m875r1y1EKk
z+UcckCfWYpA(lZ!QRXIQp<!7m$==D@rjDNe&aT>J$zk<5Ip#h_=2iJz%GtbX5qA?+
z6SlRmncb{P{&;)cj0q3C**46&eSKNY>!n(U(%tT@K5*>u&g+>|H0N)V72*s1GX3tA
zmwB>W?q^!PW#WFnD?h*Qz73}_LnUj&g#F)tR;K>wduKXreQeiGwxn0z0uOvTQ*t7?
z<h+yYwbdU3BpsJrPO9I{ao_6st@S(J>=CFeW>~nF|Fyb~UFP<@=6>-!x3!mMWPZEz
zg*|+?L9x>DeEt5rQj6l3I;^*MH(SYA{2`Ec#}=8`@Tdu&l@*F-xCgy5nBFL}c0<6e
z8Rc468V>AwH>05JmRi49yT`nZA3D1qRQ<YVvwF?EJC_xhogO!5KWRx&OZ7iK$us!z
zS=OGHYO8aM=guguQWQGC7sOk8(ku3|YrTqS`Mx`s@-iwyt83>r`=}_Lp3tBo{%G4P
zX7$9>pz9nv5)UfzT8T`YWVcg$p07)_YsxN}Kg)ENFMrRFVt1^<aH9gtOQHP${|_HY

delta 776
zcmaFGx`l0mYJFvzv$JoxLb|uRSx}Zqgh6<rhkshSlew!;j+v*gkC}yIS$aiKhEIg6
zwqu})eo&AnSEO^gce<H*fnRodvQKJ8NkpJoR7Q?LL6wJJuBW!Ag<GnlPiAmLsZ&rs
zm#&>cadC!jYKoDmsiCEUXPB`|cA$c<Z%VOiNqR{@m9ME!mAg@;r=y9HyHj{zNS1S1
zc7}^VMR<8udXQJJi=iWzd6h+>t9FjJu|a@|xpRbzMY(%wNr<Ougn4eRX=RvKzMol0
zVo`FbWpd!ekK*-7Mg^6rVJ>NrIYn9Fe%Z-p&S5E~0ZA4aUda&=m61WdZrV9XPKIT<
z&L&(TRhA_t=FXm`VWIg(VTF#NUJ+sbky)0WB_ZDaUL{@y&PAbl8Iiuhrmi5LXgXCo
z>!uf_CKjhEXemYHg(>7JSjQ^pW_WNF>!*f9R%ZD})VpVR1XdY(xP&^J2N)VArB_-c
z6}Wh11^XMjq=r@*8V9;^>FVk#xF$vBMVeJac$az?XS@1jnfN#sWQG)^8(5Zlhgy_X
zcxflQJGw{u_?r20F)Es_&I;{jxbl}}jogGyieF~l`P8PB^(1fO=CzjIiAxvs8LsEJ
z7yTyacl(_Bn-fheSff9#Psw@z_`%;dJ6F8XTGI9XhK$mJs_3a6?(Xe}4BsqG5MNfN
zw=^lIG}UAFI>V35N3!=^yf&M8<`LGn-(UQ??!H^dN=Ct3Vn_7+BU|ro{u+_6o<;K5
z4T)PW9-L8Jwk!89es0e%@X^&||MrlDUIhlVH)K?<>h90Hr23%Vbn%PI&^s%C3g0zz
za-O^<=C*e|=eiQ}wZ**Ga+$?ub?&<ItS(mFPG!T3w^3I*Z9d-a{O3{T%y~Wj6syc*
z?&Z--W{a%eu_JPc)*P)6g((3>@1Jm#EDJZ}-MfX^&q3<?ksYC%F0GsRcG8?f$_mft
ze&=8O+jG_RCJlcr9nn=wVs09oT3W{QJ%7Umo40ANYIeF;y2Y*TI=@iTP~x_mfW=-u
WgQu6Sson`S{}_8_-L~F9slNcm3O5M=

diff --git a/secrets/step-ca-pw.age b/secrets/step-ca-pw.age
index 0da0878..418e6b2 100644
--- a/secrets/step-ca-pw.age
+++ b/secrets/step-ca-pw.age
@@ -1,12 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 yfCCMw OgXEZi4GHlh0htigcyT0c86ZlZvmv5ve6g0Dnk9mhS8
-57hPI3DO/2Lic5JZ/4Cgq1y0tYoZKc+E6LwS62Zi0kg
--> ssh-ed25519 IV3DkQ YG3gxtuOx5sfD7rwAClr+MrFzEgw2sgfpxzZDyT9nj4
-VIP3Hkk9ZBG9BHNPHt4C6LazylU6htJ6gmdamqAYLUw
--> ssh-ed25519 DCzi1A DcsbrGWEyzUB7QKGvlMU9CMB/bq7JVz/aSz7uJprQRg
-NpBDT786hL0GZNaY1IsDnU9iFxlYZs8ti1FAfBeHBIQ
--> z-grease |WDf ~K7q9K *xzH^n6{
-6G9KAajGo/o6dcYb/MAOE7AIIZKTTMrN9fh9ACkINLB38ZrREUCsrJDE90sx62nX
-MOJKZ3k4
---- ExlgUArhnqSMlZwWWoFdM/Ugc3fLKbQ9ZCguzqUIlkM
-�F!���0Q����Qm�[��e��6�M�����xB
�Ԙ�������cq6>��H��
\ No newline at end of file
+-> ssh-ed25519 su0Eyw 6vviSJcXLLG9cOZb1owE2oudEYGqRfq9lk8Ulq9Gmj0
+OHuZl76lF83C8kMhoRMV6cMLR0LXVim/vG5hm+MqnCM
+-> ssh-ed25519 IV3DkQ DKxFE4xir6ykfEohvZOE/zh5dqb05mRRksapheXSfUM
+HkdZI6L96PLSXvnnfcMhaxB67JBjFr6pdfShB0FeBpY
+-> ssh-ed25519 DCzi1A kHrUepWwMDt6pgmETeclWpscQdWS/X0744mKn1C7kjU
+vrWA1Dapi5APp2EDXccCEEGV0j8YrRrC2e2Wfp75Vko
+--- StnQRDu2BAUK36iyf9lOUtWOwwwcNA7De2G3tSd1L2M
+c2��mڟ���}b��E����F�"�YV��D_�S�E fhG���J63�w:�O���hu�2�
\ No newline at end of file
diff --git a/secrets/wireguard-private.age b/secrets/wireguard-private.age
index 28b3005..16dc233 100644
--- a/secrets/wireguard-private.age
+++ b/secrets/wireguard-private.age
@@ -1,11 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 yfCCMw HoX1AI2rIYDJbfKRDRXr1ZRsNM1OVRVrr0XRnBD29FQ
-aM3HP0kxq9ACb2TFcb7f9rxKXFoT2Y9nEjL+XD3nHIM
--> ssh-ed25519 IV3DkQ EKn/xr5EWEev3stYXDGrzfLtwt2thJ+34e5eP1v4l0g
-raaOM6zpmokVCBKNWx9xHpsQJSpTbHHQeRbz2+wC3+0
--> ssh-ed25519 DCzi1A mVLJ1c2e1UOsTuDCKIwLliBz3OVBH8vGp/gICb8cyQY
-dXok0Tr56SdW5sf74IYk7rDnim/s7vZI/PZIGKvNuaM
--> ;mHckk.i-grease [&? MW78 %Ee4m
-LebJ6ZshTkkY+fM5zI/sbQzGpcKN5oGiEu5tWSPnmeQQxJrjT7Utqf3KAfI
---- 6HedZR4VvouzHmjeV9DY6BsybKcainxK9fro9MSjpxg
-h��q��<3�:7{,�9'�����w�(FVGuLAA0�̽��a|��Kw�?��!\Z�-\��$���6y�֧�x�
\ No newline at end of file
+-> ssh-ed25519 su0Eyw 9mpUnyWpauqdSlrjHZb2uyTG5U7wyWesQz0WfNms1nc
+652z/tIinaCwhBQitxSLWMl1n9FCEaRKC6F/h9c4rzk
+-> ssh-ed25519 IV3DkQ esDKdA6+78STpPx2kCRbRCjJ7w5+YCRwR9G5IHusRl8
+cFc2EJE+gfY7YJzindI+3Q7Eum/D02GetqjHjaZUQzk
+-> ssh-ed25519 DCzi1A meR8aXi4kq1xxSdGvieMZ0tcrgT4Ifo2fRoR6v7wP1U
+rULzoIdJyh/MwDXGfI9Nh3nPfqdUBoQHV7s15cYpKsw
+--- 6cTo396+lzrd+YrQnEU3GvW6gPLo4rVaukpx48QdGGY
+������hдfF���8F�~���0�^|��u�_a�Ivy!�eVCdj2��v?+*��8��g0���F�CZr�7K�
\ No newline at end of file
diff --git a/systems/mini-pc/configuration.nix b/systems/mini-pc/configuration.nix
index c28018e..026fd37 100644
--- a/systems/mini-pc/configuration.nix
+++ b/systems/mini-pc/configuration.nix
@@ -29,6 +29,12 @@
       firmware.enable = true;
       ssd.enable = true;
     };
+    services = {
+      kavita = {
+        enable = true;
+        dir = "/data/kavita";
+      };
+    };
     nftables.enable = true;
     cli-tools.enable = true;
     nix = {