idk ??

.sops.yaml

···
   - &diogo ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE4wh28BWFp9Jql1BEzEO5RjtlmzBqRSXjGo03a8qXdd
 
   - &lumi age12anach2tn0hladej0x3409r2d8c74rj6l5ggk9c6ahjggkkdwy3qgde4gf
-  - &tulip age14q5k8w8efxeljcshz76wrst8m94rrpqlz4ru4ypn7rldq82e84tqm0mkpq
-  - &cute age1xz2qp33mrjln0dk0f5mwhpfvlcjyh9vhaw2ys227ggxlgttgks6qvmgqex
+  - &tulip age1ggegtuygt9xzfqnx4vcf5llu96rqkm3gjygtyzdvhn7p93n3lq7qram2vc
 
 creation_rules:
   - path_regex: ^secrets/diogo\.yaml$
···
           - *diogo
           - *lumi
           - *tulip
-          - *cute

hosts/cute/default.nix

···
-{
-  imports = [
-    ./hardware.nix
-  ];
-
-  sys = {
-    profiles.headless.enable = true;
-    services = {
-      caddy = {
-        enable = true;
-        domain = "fawni.world";
-      };
-      pds.enable = true;
-    };
-  };
-
-  system.stateVersion = "25.05";
-}

hosts/cute/hardware.nix

···
-{
-  fileSystems."/" = {
-    device = "/dev/vda2";
-    fsType = "ext4";
-  };
-
-  boot = {
-    loader.grub = {
-      enable = true;
-      device = "/dev/vda";
-    };
-
-    initrd = {
-      availableKernelModules = [
-        "ata_piix"
-        "uhci_hcd"
-        "xen_blkfront"
-        "vmw_pvscsi"
-      ];
-
-      kernelModules = [ "nvme" ];
-    };
-
-    tmp.cleanOnBoot = true;
-  };
-
-  zramSwap.enable = true;
-}

hosts/default.nix

···
       lumi = { };
 
       tulip = { };
-
-      cute = { };
     };
   };
 }

hosts/tulip/default.nix

···
         enable = true;
         domain = "fawni.org";
       };
-      fawni.enable = true;
-      anubis.enable = true;
-      postgresql.enable = true;
-      forgejo.enable = true;
       pocket-id.enable = true;
-      uptime-kuma.enable = true;
-      pds.enable = true;
+      pds = {
+        enable = true;
+        domain = "pds.fawni.world";
+      };
     };
   };
 

modules/nixos/services/default.nix

···
     ./postgresql.nix
     ./website.nix
     ./anubis.nix
-    ./n8n.nix
     ./fawni.nix
-    ./forgejo.nix
     ./pocket-id.nix
     ./uptime-kuma.nix
     ./pds.nix

modules/nixos/services/forgejo.nix

···
-{
-  lib,
-  self,
-  config,
-  pkgs,
-  ...
-}:
-let
-  inherit (lib) mkIf mkForce;
-  inherit (self.lib) mkServiceOption;
-
-  cfg = config.sys.services.forgejo;
-in
-{
-
-  options.sys.services.forgejo = mkServiceOption "forgejo" {
-    domain = "git.${config.networking.domain}";
-    port = 3077;
-  };
-
-  config = mkIf cfg.enable {
-    sops.secrets.anubis-forgejo = {
-      sopsFile = "${self}/secrets/services/anubis.yaml";
-      key = "forgejo";
-      owner = "anubis";
-      group = "anubis";
-    };
-
-    networking.firewall.allowedTCPPorts = [
-      config.services.forgejo.settings.server.HTTP_PORT
-      config.services.forgejo.settings.server.SSH_PORT
-    ];
-
-    users = {
-      groups.git = { };
-      users.git = {
-        isSystemUser = true;
-        createHome = false;
-        group = "git";
-      };
-    };
-
-    services = {
-      forgejo = {
-        enable = true;
-        package = pkgs.forgejo;
-        lfs.enable = true;
-
-        settings = {
-          DEFAULT = {
-            APP_NAME = "Fawni";
-            APP_SLOGAN = "Where ideas compile into reality.";
-          };
-
-          ui = {
-            SHOW_USER_EMAIL = false;
-          };
-          "ui.meta" = {
-            AUTHOR = "Fawni";
-            DESCRIPTION = "Fawni Git runs on Forgejo - a self-hosted, lightweight forge that just works.";
-            KEYWORDS = "fawni, git, fawni forge, forgejo, git forge, self-hosted git, code hosting, dev forge, software forge, open source, collaborative development, fawni projects, self-hosted forgejo, source control, lightweight forge, git server";
-          };
-
-          server = {
-            PROTOCOL = "http+unix";
-            ROOT_URL = "https://${cfg.domain}";
-            HTTP_PORT = cfg.port;
-            DOMAIN = cfg.domain;
-
-            BUILTIN_SSH_SERVER_USER = "git";
-
-            OFFLINE_MODE = false;
-          };
-
-          database = {
-            DB_TYPE = mkForce "postgres";
-            HOST = "/run/postgresql";
-            NAME = "forgejo";
-            USER = "forgejo";
-            PASSWD = "forgejo";
-          };
-
-          openid.ENABLE_OPENID_SIGNUP = true;
-
-          actions = {
-            ENABLED = false;
-            DEFAULT_ACTIONS_URL = "https://code.forgejo.org";
-          };
-
-          oauth2_client = {
-            OPENID_CONNECT_SCOPES = "openid email profile";
-            USERNAME = "nickname";
-            ACCOUNT_LINKING = "login";
-            UPDATE_AVATAR = true;
-            ENABLE_AUTO_REGISTRATION = true;
-          };
-
-          service = {
-            AUTO_WATCH_NEW_REPOS = false;
-            ALLOW_ONLY_INTERNAL_REGISTRATION = true;
-          };
-
-          session = {
-            COOKIE_SECURE = true;
-            SESSION_LIFE_TIME = 86400 * 7;
-          };
-
-          other = {
-            SHOW_FOOTER_VERSION = false;
-            SHOW_FOOTER_TEMPLATE_LOAD_TIME = false;
-            ENABLE_FEED = false;
-          };
-
-          migrations.ALLOWED_DOMAINS = "github.com, *.github.com, gitlab.com, *.gitlab.com, codeberg.org, *.codeberg.org";
-
-          federation.ENABLED = true;
-        };
-      };
-
-      postgresql = {
-        ensureDatabases = [ "forgejo" ];
-        ensureUsers = lib.singleton {
-          name = "forgejo";
-          ensureDBOwnership = true;
-        };
-      };
-
-      openssh.settings.AcceptEnv = "GIT_PROTOCOL";
-
-      anubis = mkIf config.sys.services.anubis.enable {
-        instances.forgejo.settings = {
-          BIND = "/run/anubis/anubis-forgejo/anubis.sock";
-          METRICS_BIND = "/run/anubis/anubis-forgejo/anubis-metrics.sock";
-          TARGET = "unix://${config.services.forgejo.settings.server.HTTP_ADDR}";
-          ED25519_PRIVATE_KEY_HEX_FILE = config.sops.secrets.anubis-forgejo.path;
-        };
-      };
-
-      caddy.virtualHosts.${cfg.domain} = {
-        extraConfig = ''
-          reverse_proxy ${
-            if config.sys.services.anubis.enable then
-              "unix/${config.services.anubis.instances.forgejo.settings.BIND}"
-            else
-              "unix/${config.services.forgejo.settings.server.HTTP_ADDR}"
-          }
-        '';
-      };
-    };
-  };
-}

modules/nixos/services/n8n.nix

···
-{
-  self,
-  lib,
-  config,
-  ...
-}:
-let
-  inherit (lib) mkIf mkForce;
-  inherit (self.lib) mkServiceOption;
-
-  cfg = config.sys.services.n8n;
-in
-{
-  options = {
-    sys.services.n8n = mkServiceOption "n8n" {
-      domain = "n8n.${config.networking.domain}";
-      port = 5678;
-    };
-  };
-
-  config = mkIf cfg.enable {
-    services = {
-      n8n = {
-        enable = true;
-        settings = {
-          DB_TYPE = mkForce "postgresdb";
-          DB_POSTGRESDB_USER = "n8n";
-
-          N8N_PUSH_BACKEND = "sse";
-          N8N_HIRING_BANNER_ENABLED = false;
-          N8N_PORT = cfg.port;
-          N8N_HOST = cfg.domain;
-          N8N_METRICS = true;
-          N8N_HIDE_USAGE_PAGE = true;
-          GENERIC_TIMEZONE = "Europe/Lisbon";
-          N8N_PROTOCOL = "https";
-        };
-      };
-
-      postgresql = {
-        ensureDatabases = [ "n8n" ];
-        ensureUsers = lib.singleton {
-          name = "n8n";
-          ensureDBOwnership = true;
-        };
-      };
-
-      caddy.virtualHosts.${cfg.domain}.extraConfig = ''reverse_proxy ${cfg.host}:${toString cfg.port}'';
-    };
-  };
-}

modules/nixos/services/pds.nix

···
           ];
 
           PDS_OAUTH_PROVIDER_NAME = config.networking.domain;
-          PDS_SERVICE_HANDLE_DOMAINS = ".${config.networking.domain}";
+          PDS_SERVICE_HANDLE_DOMAINS = ".fawni.world";
         };
       };
 
       caddy.virtualHosts.${cfg.domain} = {
-        serverAliases = [ "*.${config.networking.domain}" ];
+        serverAliases = [ "*.fawni.world" ];
         extraConfig = ''
           reverse_proxy http://${cfg.host}:${toString cfg.port}
 

secrets/diogo.yaml

···
-uwu: ENC[AES256_GCM,data:LyNF,iv:zRILxhD8FDMHam2fKaRGZTucmazwogB53SAmn4Vk7bE=,tag:NjPrVvIgwIyF/+3Sds6fyA==,type:str]
+uwu: ENC[AES256_GCM,data:vkC/,iv:zRILxhD8FDMHam2fKaRGZTucmazwogB53SAmn4Vk7bE=,tag:BMejDlzAng8FR8+bw7UmBQ==,type:str]
 sops:
     age:
         - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE4wh28BWFp9Jql1BEzEO5RjtlmzBqRSXjGo03a8qXdd
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFR2YmJrUSBQTXFK
-            ZTN0NEwyaGxJcFV1N1QzdkxZV2dTbHhURmJLM09nc2wwbk5jZDM4ClVoRXdzTm1R
-            VmFvSTJLbWg1aTVyRFRnUVg5QWRxZ3hrVHlpcytxWjdBRzQKLS0tIGhwelVwYUI2
-            MXdHbU9HRlhBL3BIMXNRRDNsdmhXRkxMa2FPN0RSWG5BeTgKfQgr1e8Db6iJUaME
-            2J8z4kzv1JSAbayjQYqUZJ4/EDYaMRtBDbn6RheW4xfZGgCSnlIbZKpcaqABhEtg
-            etsYJQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFR2YmJrUSB5SE1t
+            Nys5QUpwMS9kZWtrdDA4bHZGdDZjWW1KeG5tekdOcWxkRHR3N1dJCmRlNXhGR3RF
+            K2RJRXEzTEFERkhySkVuSklXbUkxcTg3V0NsR3BoMjd0Q2sKLS0tIEdnRHhDcXov
+            Yy8za042U21CajdJNE5qS1RpT2V0L0RDL3hVVVZobncvaXMKSHCzwSkxoQrqmGF1
+            f/MsX3RS5a/DfJkGRRwZtu3F9f8eSrtzKi8QSbfxQ86WMnXPLdWcBmmWiYsVnh3B
+            FDN2qw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-13T11:46:38Z"
-    mac: ENC[AES256_GCM,data:NVr7BypGrbSV5BoGnjFWIN2ZuLo2WgnyBHOuPHRWUELrMqy2DKlQq2ay5ldkc+0dQ7cKqZXK0QB6WEFKMtNmbtXvnVFrqXasim1rbHtieYpjoAfT169FPts3i73JVDnVAAT7lFayyGywBnvHc2d8PmhVJO3CuWJwM2xWM3p5OK8=,iv:x6L4dZ0Sul4SJnkvDbGRNP02hgbBy3UPRe4BtsnDg4U=,tag:n78rXkpVudz5eyvhoac27A==,type:str]
+    lastmodified: "2025-11-13T15:52:52Z"
+    mac: ENC[AES256_GCM,data:GEz6kSxERF9Wqs9CT0l4uwHSyy5Bf+Zes0WHgJbTsi6B6gvDoSLMrW8RpnEPVMAd1S9UgSKgADlVNzVVi8NxigzfK/XFhqsIU2xC9Fd5n8jwcQEkzXWHcmhWP57pYUsdQrDAugJrjzJKuNC+9LBdg33SLLUyQD9goOVoFRLmY3s=,iv:2n0QCpG3dct5lgqzEM9/MeEpp5Dtr/NUJOPTTtzyaBs=,tag:qpb2+RNnvRAoozQVdsXK/Q==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.10.2

secrets/services/anubis.yaml

···
-forgejo: ENC[AES256_GCM,data:tK08Mqnma3WZf/HQhE2xs0+moGiuCqH9ZuJ1MFX+wConBwHS0CJcAKp/TDwmPBwgAKSmaGd8CPG2JYBljn6HeA==,iv:I68e0Vu8/yuMlR1L88ZC6YAZPWSCydyZVqv9lNo25pE=,tag:4Vz89v3g++u3zOqA6OfT5Q==,type:str]
+forgejo: ENC[AES256_GCM,data:kW1vrkKqeLdNRBgl5Z/EgkdFCIXIzA/jeUMYCmQxVboYpxJlL8zPIfeknyLOKs7OivtibwLicczvwSMumJ4HrQ==,iv:I68e0Vu8/yuMlR1L88ZC6YAZPWSCydyZVqv9lNo25pE=,tag:utLTizSjHlmKPsY6NH3A6A==,type:str]
 sops:
     age:
         - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE4wh28BWFp9Jql1BEzEO5RjtlmzBqRSXjGo03a8qXdd
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFR2YmJrUSAwMkdr
-            MzQ1aEgxZjdvZ082UUs5VlJDWFVHNU8zbUhDTExrUzAvclpaK2tJClVIRlpMV0Iz
-            Ni9vVVd5ZlJKM0VmdmFLdGJYOUY1TnBmYVU2bDFjcXBORzQKLS0tIFh3bnBrVWh1
-            bFo5ekhNMGh5SkVYajdPN2dzRU94NlBIQmdtSW1PU3JtYzAKsi7q5vH65wZZngYs
-            pArqIR+N0HSBaWPQ3aR+ZN+62QTNGihiJvTK4eN/zm4sWvBiQO8p/5rv8Xh0ckn9
-            2YRAdg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFR2YmJrUSArYjJz
+            ZXdCdHM3NWo3NVVPSGpMcWFzbHZHdXQ2TzZrL3lnYTRMRmFlTjBjCkxuTVNETUpD
+            VloyNmRtVXJFTisxenFIc094Mm90TGtTNXluRUtaNm9YSEUKLS0tIGtEb2EwZkxE
+            NkVOSUNhY0pKRmtzRVYvWFBqUlRtajVJTGVOM0srTzV5VXMKWylACfO6aLZn0INk
+            yBuV4KMkrCKlwZitpYV29y6A6s8vywjeLSZTXoEiTP2pqIxSHZLPsFxhqf1t4AnV
+            0HQ5aA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age12anach2tn0hladej0x3409r2d8c74rj6l5ggk9c6ahjggkkdwy3qgde4gf
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaSTVKa2FIaG5YU3pGQWxF
-            V0xHeEZnd01nZ0krSGo5TWxUTURqcVpWNFhRCnR1a0NHNm9yVHcxbjVDVWpaMTBr
-            VW51NDdaYkxDZ3QzNExyZEdjMUx5QjAKLS0tIDN2alNWWldhanZJYnpNeGw1T0t3
-            Z2NuUmVjaFNtd1hPZVhxU0FmK20yMDQKAiB6t0h0lbMTtCFV2aTWMrwvO9GLZk06
-            JDYUHj8xgktJS92hxEQNjBbjiZRd8+UxeU4CT1E+QdAbIIuNWgoSUQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSTEIrbzdOSlF2YVR0YSs5
+            eTllejhXakRraTZHRFdlT2lkR0ZEd3JWOEVVCnc3UldjUk1hdEJMRVVDMnE4MEdI
+            VDVQQ2VNaE84QldXVXNzdmVrM3RuclUKLS0tIG5PSWpLbUVuV2lyZXd0M2Q5VE5U
+            ZnliWmpXTnk3VE1kOU1QSi9xS1JwaU0KIvtAFYilG6EDLqdJ8YHOeh4iaELvKZpH
+            Hz4C4jP4BlFTzaSw3AjGb/+4lMVvvhLQ86GMzMmEBYtL524L95Nf8A==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age14q5k8w8efxeljcshz76wrst8m94rrpqlz4ru4ypn7rldq82e84tqm0mkpq
+        - recipient: age1ggegtuygt9xzfqnx4vcf5llu96rqkm3gjygtyzdvhn7p93n3lq7qram2vc
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQb1VTbVZnbTFJN0xrWnpa
-            MmdHcmhkRHYvcnRYSkZJUVpXUWUwNi9ZZkdzCk9QRzUzbDhZSVRBemN6ZklZN0lr
-            cWdGdmpEazBFYlNtM2NCQU1ydm9vK2sKLS0tIEFQbVF5dWNPM3cvcTlVcFduczRm
-            WVZoSXFPNDlGa3pQYXFQUGNiWXFjcVEKzuX2jIIwNm93p9gASvhYCQ8dvVWMA5f2
-            TLDWwovfX7UZb2W5fOmQo2UD8ZAHHG8I1gMCO3mK2AKvTv6wgBYghQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1xz2qp33mrjln0dk0f5mwhpfvlcjyh9vhaw2ys227ggxlgttgks6qvmgqex
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOZFJrdXIzYlp3Rkd6WUJY
-            Rm85U0EzYzk2ZlhZYlZIT0VCKzJUc0Y2eFRFCmIxWFgvSFhDa1ZBMnUwRUFnRjhT
-            Q3Y0bFNWRHo3aTdQc0NFWFFnMm1nNVEKLS0tIG9YMkJrMU02eW9lSHhOQWZ4VmpJ
-            R1R2VmVWdlhnSjM5UER3SW42a1BZWmcKBbSgULD43acJ2uUOCVwr8UD8j2VL9/Kt
-            8Lc8zwxZDz4X4nIBSaOjRJl4yB9Ci45/ypWys95/21sxtuvP4GWY3A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHaitaMzdNdkxlejQyWE0z
+            UXVmaFJ0czJNZkVkR1RxRDJqRXdGdERmYXlNCjExSzVzRnhOWGs3dGd3eGdBWVVU
+            Zk9yMEt3S2kzSFhFSWh6ZGhNVFhKUTgKLS0tIE9FOUJhekx5eG5pems1UHNQMFdI
+            V0JYdFdGN1kyWWhGejFONFFUdkNJUzAKKEzXjDHSz12Ly7vpOXerZwuPKd2pndDO
+            j1ilPuI37mZX8uv1UXSQgcoYbLwMpdGO5FYay/cprMHMF2iDXLm9VQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-13T11:46:38Z"
-    mac: ENC[AES256_GCM,data:pBeTuG2++jwkrv49BcAS95Jpvll9rdPnAqR5qoZSfjDOTnpYFNnGS1TwTersB51+6IQOpjojEW1QXN7jxy7qkhyaganOgq2xAgGBKv/xSbEnbeT4QCZEM8f8SJf2kW4JIk0ni3bDEI9v0RtkR/bcJaQpSxjPzHo+aoq9RUiqPxs=,iv:rlVaE5gLGBppldY/iK0L4RwKYY5kV1r+fW0qpIK+zK4=,tag:Hx3bAQ8nnDOam/utA2nEQw==,type:str]
+    lastmodified: "2025-11-13T15:52:52Z"
+    mac: ENC[AES256_GCM,data:rFH7aThtgInYAa+ZVR7KOeIorzkkJ657EzWMF9Aos0id+1otcW2c0lxvl6nmXmJkFiPoFQk9+NaS8bIyQXVzxxogAOgWvHa5xKzmoXuYwcXt744NkKXOHToQR5q92yEqVOjxXq9W9duwpDDF8lLu9m5k6I1iwz+k/zvTmHAexHs=,iv:on6VQZ6/QU+ZCmxPrrN8Gubpl/KXm5TViwSCOrEEbQw=,tag:NQiKuODNlWyqO983/Wds5A==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0

secrets/services/asf.yaml

···
-asf: ENC[AES256_GCM,data:EIAK4ccPSIkqPxcoYeb/ukYXQIJEo3EcBQhRIQwyK0Wg9/UxhphuByyrWKrO4ViWcVSVAbE6j2ZcXLMJ7xLlso8d/CyYnsT/y2iyafeix10AAsBz87xtd5vxPjrjhNCwFISxLypk49f80vKQzfKfSpzoIuBJUhRIVkKe4N9ApXk=,iv:m2BaFFos2jepwvGBiXzKcHNu28iAyuSZg3nEhJKUoL8=,tag:uLNw6q8dGlLwexRM8Z15jQ==,type:str]
-sops:
-    age:
-        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE4wh28BWFp9Jql1BEzEO5RjtlmzBqRSXjGo03a8qXdd
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFR2YmJrUSBwQWZj
-            elI5R2FFZ3U4YjVjSTJ5VUtPYVRyY3F6SU5sa2dQQ3FrUnZKeEFFCnFqZWhiTTFI
-            bkNYQUtDSW5NdzQ4anVIajJaVzl3RVRiNW5IRnJxVHV1Mm8KLS0tIDRjU0hzUEFi
-            SVNCNVQ1djR3d1hwK2lWazRKZ1QwTzY3a0JDOVNmYmtrdDQKhkMlFkZ8hLDeZT3q
-            dq7Z//DRSpqeONCaIKC30eu4oDJL2v1bYJyAPN86H1PDdmVRzxTg7V78LEOOQqWi
-            ZI2k3Q==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age12anach2tn0hladej0x3409r2d8c74rj6l5ggk9c6ahjggkkdwy3qgde4gf
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0SkIzMmR3Q1lOb2FURDdl
-            blplK3hzQm1LMXNwS2JOc0xlTmMycTUrZlVZClVlbm9Gdmpaam8wbEhreU56SmQz
-            ckwrR2NSUUJ4eDd2TFpKTytIM1d1OFkKLS0tIEN1QzRORnQrdDByODFGRHhtUHJl
-            RTVUTWt4ZWc5K09yc3lHbE45RG9LMDAK9cd3ksA7hMvZH2N5p2Wa0KsdFjfMEWIn
-            i0Z2YD9/PI7lBAMzeGwCepBurTxwPuPfzgekjHr2xTO9ClnKAx8zwA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age14q5k8w8efxeljcshz76wrst8m94rrpqlz4ru4ypn7rldq82e84tqm0mkpq
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2eFhoT2swbGFmSW9SN2w1
-            MmlXNjhmamtoMDVHTFJWVDVGUWNRaDBnbVY4CkNoZWhzazZiUnBDMmFCY1RpMGRO
-            UjA1NCt4RG9tUE1kaHBtcWprNWJWc28KLS0tIEl4V0FMOVdjMytzN0VjaTRqMlNY
-            T3prTSsxeGVnZmpkYjNMb1Z6dVU0S1EKDxUvrCt4SDA9iri3r6bqEz15e7xWf4hW
-            qRlI/Lhw3mnE8Wez0pgIn9ZE3Wd25oXdqNfoOFag/Km5uJSCv7HqLw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1xz2qp33mrjln0dk0f5mwhpfvlcjyh9vhaw2ys227ggxlgttgks6qvmgqex
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMeWxDUjZKN2lnbmZadTg4
-            Ym9rVHp4SGNNMDhqOC9VNkV6eU9Ka0JobkhzCnYzRG9QTFQwbXlINzl4OGhjMVF3
-            Qm91VGgzWTJad2hHM3BsYk9CQmV3S3cKLS0tIGpTTm50TWtJdjAvQjBsZXhkcVdO
-            ajV4WnMyL2srQUdmRVFXQlRRZ202ODQKvYmBiZYydTyoOza9JZyXXvhc7L9vc0gC
-            8xs861E9r2TbakReH1CjAxwLoxuIgMUlgyqkmT6Mu79PFyGum5cTMg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-13T11:46:38Z"
-    mac: ENC[AES256_GCM,data:iLyzJ+mHlXxh+vNkRdkKwmQdAPhPS60gIybS+XiY5oPrkkJp1Apoelv9RiL9439ExCxN3s7lHzLPFsgkx94ggSG+bC30+Deft765HES0Dg6BXUAYuj/rI78cgfq0NsleAwNELg58+AjyOtlm99nrAg6hK/8Zzzt9ssDArXOIwrM=,iv:N5LsSlUqU27aoATSs2iLpRQ2+Xwi4SNKJXlsXS0mhsE=,tag:xCPWnBG1XgcThAa7y035mg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.10.2

secrets/services/bunny.yaml

···
-bunny: ENC[AES256_GCM,data:uW4JyIlYH096htOmvq7Iiztt3Z8VgerNNwADgcMC6Hlba3BHc6mxcQP5yDR5fZ4D/iFEp/qwvnbxzGPzs07yCUbWUu8Frj4Kttor4ySGm2M/xj1zPzBE,iv:9irGAPMiQcHHpcjo+Ho660oiyAV4PdJnzsZEhpAmQ8k=,tag:rAHVpt+k4RSEcPXf+CsTcw==,type:str]
+bunny: ENC[AES256_GCM,data:5l07YqHpmbu0QJcU+GzXJUm6HH5tIu0l8xoXx/aouMusq03mdJ97uP7p9M/Hd39jUOOIOyBeeSdoXewahfzdgMcoyRkVszDGUL4nkAquO+259AFxP40u,iv:9irGAPMiQcHHpcjo+Ho660oiyAV4PdJnzsZEhpAmQ8k=,tag:agSG0GdWjSimbpDjtOPFlQ==,type:str]
 sops:
     age:
         - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE4wh28BWFp9Jql1BEzEO5RjtlmzBqRSXjGo03a8qXdd
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFR2YmJrUSBhR09j
-            UUpkRllmbSs0Yi8ySkwrUWRFaWkwU0JEdEw2eEFzRlgwcDFvUDBzCnNiRzBqRnVM
-            TXB0UnBOSzk4c21tSXk1Q3U5S3ZYb2VMVXNOclBScUpHMmMKLS0tIGg4cTR0cS9T
-            QWdFVHlZRS83RDB2QitidXlzY2d6RExLZlhSQkp1enJFSkUKooWaytixW+omYaqx
-            NRPBV269EXhJxhCPMX6PdQMAa4l/JulNvq3tL7e59RZQR+OO9Ls/WsEhUDlgGLnO
-            fcD5ZQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFR2YmJrUSBxbi9u
+            MVpPUmJLb1pnZWoybXMrbEdWcFFVd3hsYXBoMC83ZHBSWU0wc1hBCkFDcHo3S1E4
+            N1E4RFl5M2dMQ3U5bUZhVDVBalV4eXZMTHdkUk4yWWp2VGsKLS0tIFJhRHVWeVZ4
+            U0p1TGhNbmtRSjYrYVJjTm9VUDNDOUNCRm1ET1RlS1ZTL3MK4Trutdjc5+GQloSp
+            fW7v+4pqciPI9HT57a4/SVa0M9We3l6iTY0747noH+3aBgyfZdY+e3O7MhDvk7+f
+            8h7yKQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age12anach2tn0hladej0x3409r2d8c74rj6l5ggk9c6ahjggkkdwy3qgde4gf
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnN0RmOXBBamJ1WTJsZ3BC
-            ZXB6WkhHdnZubm1rMzhDYmx4U1VESGJXZVVVCmEvSnVaY1F4YkZ5V2ZqNGQ5WUhL
-            RksycmgwUnhyU2N1aVdzNUcvS1BONDgKLS0tIG9yR0VvcGNPQkQvVjYrWnd6NjZI
-            M0ZHSm1XWVFMYVFNelVqTnNnN2tjMjgKn46nQjYrIBXR2NYGRyXomjbi304vokCe
-            5YwxPqh2BAJkFjHHSVvayLjIQyq9CT40QTijhGKbfKwt+rfoofuPWw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzTUNOajc2KzdqcklFSjN6
+            K1pwbDQ2ZTFUNGh5MTRBVU1XS21kSXpLVVNJCk5yclRTNTVhZFhxT0U1RHNaU2hX
+            Kzhab3NUcm9nMzhtUWJkNFE4d05ROWMKLS0tIEU0b2k0TjM1SUxpMURmUnNTVkd2
+            cVBJODBJaWJ0ekUvN0JZQndQbitRaDAKjSaCS8RfDdri1iGMCo2ljDJUhfU3oQmj
+            xlbTRVjiZ/dv68j/Yspun4duqhP/5orddLUdfN5NoUU56RTrORcnlQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age14q5k8w8efxeljcshz76wrst8m94rrpqlz4ru4ypn7rldq82e84tqm0mkpq
+        - recipient: age1ggegtuygt9xzfqnx4vcf5llu96rqkm3gjygtyzdvhn7p93n3lq7qram2vc
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEQTdsd1Q1NmxHeWdvSUsz
-            RUwxZnZmTDdVK3VIMVVRYnpFRWN6REdSRDF3CmkzMTBmcVNCa3ptZVhKeTVkTjlu
-            NG1PcDNwNmtSbCtHMk5RMWxGSkEvVzAKLS0tIHdDZjVsNkQ4dGgrc1RvUjl6NkhB
-            U2tIcTd0Y3BNTzRHTllNS2NYalE3dWsKruvBIl3R6YjZ5mr3rihYgdkDH2CBHVQ0
-            O78/VOmdW0VdYFWUexiKtFZqbN1KcCbjKVJI1dgxnBYUJsgawS5t9Q==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1xz2qp33mrjln0dk0f5mwhpfvlcjyh9vhaw2ys227ggxlgttgks6qvmgqex
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWY1JXSlU5NEJId01wYnhE
-            RG9Eb2lGTGpDRGNCMCtpSzRlcEhVdWhobHhNCkRMM053V256TnoyWWFROHBhQk1q
-            cGk1elE2dVBPcStjNVFacDVxeWJhaW8KLS0tIHkrMVQvT1hucnJ2WWlEYTdyR096
-            Y2J1alNBdXhUZGdYSHIveW9mRjV2NDAKBS8Qy3R4i3s3kwYrkf/tjAiOjiedec4r
-            tQ5C38MhMQoK8oQYkoRkt6TgseJAXVxp+8FsU3+IH2GZpgpMzYVROg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWcUc1S0kxZWo0ak9zNFhC
+            UDdLTm5CTGltTUd3TDJTeUlHL3NFMC9kY0FNCjRaNXZMaDlWc2FwRXJmMk8vdkxW
+            VDZPZnVzeVB4YUhoMUVMZzZNTWJYVUEKLS0tIFVialFGbDhNRTVCWW1KZWt1QS9x
+            NFkzMzBlU2J0aUlMNzZ5SWorSWkvbzQKNygMDKL0IRzvILGMcPsT7R+6qEEWLkpB
+            vcx9yNJNHRK7EGofH06FtK+EPe3GP7TAyMhd6ZXsO1dAVZwMSo/+kQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-13T11:46:38Z"
-    mac: ENC[AES256_GCM,data:AAPljkNG2TsnBHB6TKHjnjRWWuqSwW7MMcJWf1KvytlHxipcMHJKrcwD5L4GLElys6YmNJy9wQ3CZFNlO6pRRBms5LlL9swzEoFl8TB49VpG3Cx2/CKYv7HJPLT1zUU9qkSZ3/34l5/5oA63WVHnVuofWKW/nzFhku1mFi2PTPo=,iv:F5lwe+5RVhYg+uFLdD4Ij/w+b9UsiEXJHNr9s0RY064=,tag:KcmcEEVlZaHCljAZShDfhw==,type:str]
+    lastmodified: "2025-11-13T15:52:52Z"
+    mac: ENC[AES256_GCM,data:kV3nfg8OEQfnGCqZhJDUZ0iYp4hqDp1Ny7FCCH6/BKHTMJjQpaxCtQcze8ukBByAtSgrRXo0znFryw0RSY9JZ3bbaP0LSDuXxNW1tz7Wz2hPIgiaL6vN6CZ+cGo1Mu9P1AFYohlvYHEYGgHRVKIqPfSYDvCrlkXTB08HMZGNeJ4=,iv:DtJN12EZnmAvqGIpKMC9/pD4CpNFFir8mV6EhTpKTgY=,tag:ezfkSBcGrECrBIW/R+EURQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0

secrets/services/matrix.yaml

···
-matrix: ENC[AES256_GCM,data:e3WebXbJaAua7qWsHEOmtTmP8RvKISF7By/oMcr8+suF+mulbkgZvurROF2ghuSw6g1uGxeU1rAY4sdDDuKKMCRb4frkjIp2j3lKXOr4ow/VC6xg51Kb5Rvqqn5QxCqdQKbHIGCJ0DuZxdT5tA4BKFyUzh9kFZEn3JWk46WOSz0Gwn/ey6Zsb0QSLIxiiCWeLHc+U6nA7je5q8w4zEiSvYzMZCpH0T6uJRm/ip/3vipvvw8=,iv:mvJcst3KxHtYM3GmDdN8OH2tVR4RNdOrJ2llT+uuTVo=,tag:1xd98Jz79Gpy9mB0xLHScQ==,type:str]
-sops:
-    age:
-        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE4wh28BWFp9Jql1BEzEO5RjtlmzBqRSXjGo03a8qXdd
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFR2YmJrUSBjb1BE
-            bzE3aGR2M21rOXFvUWlJR255VGJndkpRNHNudEo5dHppYzBPcTBvCnhhRU01N0dT
-            dEJ0RlVHbHpBOHdEQ3NzUUM4c1p3VmVSWUJnWlROSUJqYVkKLS0tIG9GS3FIUXp6
-            eE5haHJqYnRML3JBZFBDd2RUZmQ0RmFHUmEzM3lBWGUvY3cK6+CuQOxgXt6CJAmf
-            cu9LOiNLXv0yg8jO2B48MTjqWxAYY3Oxn1ReedZCN1tOjCz8WTRkL+7sVLPZ+jrg
-            rJimTQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age12anach2tn0hladej0x3409r2d8c74rj6l5ggk9c6ahjggkkdwy3qgde4gf
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMYVVzSWxKZC9IdmFZa2xa
-            NTlPa1RxbE02OUlRMnJVK2VWbGgyeTZ6ZVN3ClVtWWpna3ViRVEvSUtlcWY4NTM4
-            SmNXLzVrVXV0N0tWL2dzVllXNFo4TGMKLS0tIG9OdWg3ZEpCODYxeUs2RjBGbTd3
-            bllWM3VyZXdOc2NvYnU1emh6TTYyNEUK5Gquj1XBsHHp2sXF7ArB9ExFkaAmKM/A
-            DYoP5l4V9D82R9USDeXV3MeRolvcrg+CQ1KlJex4MSD4N0T0XG725g==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age14q5k8w8efxeljcshz76wrst8m94rrpqlz4ru4ypn7rldq82e84tqm0mkpq
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZK1pTUHF2MFg0UlhjTGFp
-            Q0M2ZXNNdDErWS96MUNBSzdieENoQnJVZzBrCnIyU3NQOTR3Qk02c082dFlpcjJ4
-            M2pXRXBNZnJVekdvQ3BTdllIUUVlaG8KLS0tIC9ERUQ2S2lXYjNER3Q0eWR1UDNG
-            QWdrRXp1MGkwQzQ3UUgwV3FMSzduSTQKrxNussOKfkmsW+4jzTEINcLWM4A7nGjT
-            tCFHuOn8dmsQC+NPN2WV6HNqdwtmYduYcU2Q3XeZHNdWCAvah86kZg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1xz2qp33mrjln0dk0f5mwhpfvlcjyh9vhaw2ys227ggxlgttgks6qvmgqex
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLbSs3Ujh6SEViQTd2VFEz
-            MmxKbGs3QnNlM2F4bzduZ2E4UnQxUFdRa1VRClZjR3I2dkp3U2U0bUs0dzVqUzcz
-            ZmZWeGthUDNOMjltOWlxWEpuWHU1VXMKLS0tIENlT2RtOS9nNGQ5U0w2MndFUCtM
-            RVgyVzlua3hMb2dPMkJ0YTdwRytYTUEKp9Z0MicgAIL/Bh74BApjCR9RbNLwkgpn
-            adPyuItfDup5ARz3sf2XGW+dLcDHCTPbpHEzMcXPZn5Tn5JpysS61g==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-13T11:46:38Z"
-    mac: ENC[AES256_GCM,data:DCbVw+YUW0Df2uE2CfTg4Ckw+trs6z3kV0t3hHvDUbkoxmYYdTyZULFycDv5WSF2eV95zvvdk8T/ajzAPhmm+MHW7wCILNmIZ9oEA5Kr5ddy/gvOSbB+55KCVbPnGkM9Bm0t0MITkqa5FlKh44p8vgnTWQxLo9S5ZEYOcCbcfT4=,iv:4191tIxhJPJXFqu5DcvWvIhJNAAgzg0xFJjR3c4fE2s=,tag:6Pl3t9o545zOwzp/3e/mDQ==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.10.2

secrets/services/pds.yaml

···
-pds: ENC[AES256_GCM,data:v83rbQsWSUXxAWpqWR59poFGaUy+GE/i2pNyjWxzW0NUsgu46vj0iO0+tBCJPw2RzXj5UUhJMP0QRrWt/nOgoTnjCS78+crUVZxWciob5gNhCvINo+/4BGjA7PzWdg4oqCzW6dkKLhnNZn6xqqztRh7pi3ezFEsntGbptecA352uVRGq8xQsDsBtFFlWlS9otpChrtMimXcO29Tw47HlV0Vzx2T6wnBvw9Y/0FGJPmo2Qv0VQPoDf8go1jStX6ws5yiyXl/ykxr9LE+PiTkSU8CasiKj8M8fJRYq/OFjUY4x9FtRdy643+bcjazlu/MpEOZf8vqPXKiduT0KdAEq4fxQDEaFo3XP3g4xMO8L6VKVYCgAnsJUz/uCLYyUh/L+4nAL6hDW2u3me0ZnK4ZRX4pRRXSIjWQNBNc5oOdyMjzFXBNPwIqyZOhqbdvNNvFcKA==,iv:dYz52R/bI9P5ohHmfam8gkhAL6hEyect3A2pcalOakw=,tag:oSu+/M5W0YxGxLXecg/LeA==,type:str]
+pds: ENC[AES256_GCM,data:hA2U0UXJUvnmkfATL1Q/Whno0QqgECVdeesWbclCOpC1NGQd6flvsZw/7mwmGhce1nrEkoUeVl3fTOM3jjRHKwuzEZzm1tUiNSYOowrcECWeQQ/XtpK39MXQuPVNjtPG2sbRMylE32NcmeFhFnBwwm5a3v5n+rkw+kA5VuQbR6SV9FrdXsybdqT/MvMUJkqp8OyQwdfQkrUbJHSYv6QZItAUoUDc4N4kr8VCb64RrMT8TSrMUrYojnZ1h+vZhM+8LHdW5DtpSaxo+pUwmJPO8NV7Y2XBBRbNbDLi3yqBGlq6z1MD+/r+Muy5J3fIWt3e0MVfiTID+K9APWy+Ogo83TVZNljzeWsNlicFxrqn2zg5koUefuSlhs6DaFBptV0+dbarhwCPOm/yYcH8N8uN3BNFlfnIv9GtOL9bBBOUqb5+vW3xhjiMwcbC722FmZZPPw==,iv:dYz52R/bI9P5ohHmfam8gkhAL6hEyect3A2pcalOakw=,tag:AXsl9dKrw1//XiOGMO7ckA==,type:str]
 sops:
     age:
         - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE4wh28BWFp9Jql1BEzEO5RjtlmzBqRSXjGo03a8qXdd
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFR2YmJrUSByck92
-            dGNYY3lWMG84SEUraHpkZndQazZMbzZRWnFGTVpNbTk4bVJvRUVBCng2NnB1RkdC
-            YjVoTGR2T3NnaUNYRnc0eTZWU3dIQ3lzM1c1VHhHWURDYUkKLS0tIFZLdldBVnFK
-            bGlLN2RZSzJBOXJwOTY3Q3ppdmxmQk1NRTQ5Z3BZL08yMmMK9T0ZSlHb8wikPyEO
-            wXjQSk/SXKeV3o2L/FUmAfGrx/GBPZ0du611Z5IvL4C2bejASoUOn6kc3mfhbOQi
-            p/47sg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFR2YmJrUSA4OXBa
+            cm96c3IyblhzOWRVZzVubmJBUzA0MmFubEJ2blREYkRhWUZRUjBZCk9zS0hFMDFK
+            dVI0aHBWWVZsK0V0c0tSOEs5LzVDWFhvckI4MDNQcXd1OXMKLS0tIFVjVkRBQTUw
+            NHY0aFphV2hnT2Uwb3hpOUFoT3VZeU51WWpPRW1DQXlEZlUKznvxNn7yEJaVXuTr
+            y5CxIYV58Wy+KCZxhqwLhkdWWwqvYXicwBBQ8bjuPX97QxehFqsdu9WwhLIwf+Lw
+            nd9ZjQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age12anach2tn0hladej0x3409r2d8c74rj6l5ggk9c6ahjggkkdwy3qgde4gf
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnRXZ5M01BMG9hUXU1YkhZ
-            QWtsdkJ3dUlpYjZjTGEyUVhvb0N6a0VGMGpRClJGWXZJK2k0TjdIYWovczhSMWVW
-            RUNpK3gwSVloNUoycTJIUU1WTzdQOEkKLS0tIDUxb1V5WUJpRWR5d2lCc3RsV0hr
-            Unp5akVqdWxtKy84M2dvSTFMam5MMkEKmUBaBDGqgeTcG+tpj+vLsWzWN0ofIM/K
-            v1fllYt7ROc3qMqTmE/qWFoGj7R5Z346vyNMWpjqi9rSmOx7uqpV8A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvb0lPc2tCZjZVamJWVjFy
+            QmFlb3FsMTJ4Nm83cVJ0aENZRnAxaGhIZ2pZCnpraDBrMVZmUEhEQkhnL3ZuWDRn
+            TXhLZ0RBZTJBQm14VDViTC9BWnhmZ2sKLS0tIENZREVUeGJDNkNPbklQU25sMDBi
+            Y1dPTmFzMUkzVjY1cTI4Vm5WMDNGV3MKivfX1SPVannT5g4ky+zRfiVveiIxxQ0+
+            df6HgGEV9QuQ+M2+AFj9lr3O5zZYCug2BScuYtrCSY1ncffp5TV3aQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age14q5k8w8efxeljcshz76wrst8m94rrpqlz4ru4ypn7rldq82e84tqm0mkpq
+        - recipient: age1ggegtuygt9xzfqnx4vcf5llu96rqkm3gjygtyzdvhn7p93n3lq7qram2vc
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuYmNSU1hWVW5hK09HL1Fj
-            ak5zN2dwc3V1YVFabWFlUkVTckpEUzZadGgwCmFvWVg0cGNpM1E3OW5IVGtLK0lB
-            NkRpbFJpaFJyeGRBOU9Zd0xuZUdvTlEKLS0tIHFqa1VRRmZpWDBwRStadlZYSlZK
-            R2o4RG04REtzMXd4cUpISE5xYWVTNTAKYxStfB+XBuPU6jM8IxON8Vg97VWRkT+Z
-            eIry9fpRzH/YXWR7MM4BrNerlToWXGe2aTMOsqplgers+pA2HU3Z4A==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1xz2qp33mrjln0dk0f5mwhpfvlcjyh9vhaw2ys227ggxlgttgks6qvmgqex
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoSk5YcUZGWjRha0VpTzIr
-            R3RQZnBpU0JyMlNNeVdKM0NDL29RWVhyRXcwCjlnTkhURnh4b1lpWVZZNjdZS1hm
-            ZUliY0tIcmhWY1ovUG5vNFhOUHFnajAKLS0tIDVHYWJBL0tpS0pwQjBrdkY4TGxJ
-            SzdQUVY5QzlZSHlYUis4RU1VcDcvMzgKnbI7jPLTzeYB7ho0V27s+J6wSYt25vqt
-            3J8xYS+cFkEWWjMOpKE0TYrj7c1gPeaKC+IHjjp5u0qHJWN+RQN3dg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyY0kzQ0x3MjJ6M1JIVjFJ
+            KzU4NzhZVXcyb2RWanhOWEczdll4TFNNZzBzCldEWXVSVW1RQ2ZZdFAwZFVlYWtn
+            R0V1ai9Cemd5cnVmSEVLc3NFVnVqbk0KLS0tIG9oQ0pzRVkxSVhVZjZaTXZHQWN1
+            bXhGMjdvTFhnNTBGUFNSTk5BanorKzQKdJfRZF8nTgcx8WphZkJ3CbjpP7IHUYQW
+            I/rlg15sY0/SmMhjxhho+q/WvkHNDtvvHxXkVVMU8Oefolkd5JzQLg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-13T11:46:38Z"
-    mac: ENC[AES256_GCM,data:7Le3/mXQwIYDhd2YNs5CgU/toAp/WDx5773lMTEv5gAEM/hKvfRR4W3p1QyyyQecSthn/VhrfZfzCfpk1YYUr4crfCLkiiFIEs8wl4xi+4ShYo3oQIUardnYBMlcQ8hHQjRjUSB74Tru6t51CiSy7ma+AaEgBlcXexpmrpoLpWE=,iv:YE/TxkMWmt432nMDJggRzIY6cdZA9d5JJqRDuFUhSqM=,tag:YgTnU+K1JfYsR6oEawZM2Q==,type:str]
+    lastmodified: "2025-11-13T15:52:52Z"
+    mac: ENC[AES256_GCM,data:baaKJcF+bwVP0lVt2xU5TpfUoy/tPazKykY+L8CGsNahcBUn5yg4iIxkBEg0xt1uIsyvw/f5ppNVfZTpLgnWyipGjynGKVy6sPT02T3P/4UmRIKFcCB7KraXc1z9N05gQkTB/0efm5g5hfG+ImeG5jm2BBSp/36L/I1Pj5ytaYI=,iv:U2qOd/C1iQ9Th4dzUlrMwB5wHXbsG3XPlHmOAq78xcM=,tag:gEKbnxgwfKE42/zzTa0CXQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0

secrets/services/pocket-id.yaml

···
-pocket-id: ENC[AES256_GCM,data:EcSt0m6xba8D3hNyieGS8lD4hUFedQ7EuXxrJhDDdT/Tj3MXiRf95+HF0VmCpWSSlDgcwWIrZnrr018/lmu4Twq4OoCP6CNgbaBncjY54F73eypLcJEI93zFoffbZhMeBMFTt9/FO6uK68HHcBM18XtHQATncuK77IzENF5JJny6SIsccrY9TjEIOGyqSelD4sjFlPY1hMk/iCZKQLX4VpfppJLfV3HVZaxgufxKWBZfQjP3gKg+CYVVu7kGEATqwtSnt06pjgop1H8e6sNB/PERn2dDE+F2v06Oe8mqmyMGRQLfhcZlqedlGz/uCy7EfHvqAsTuXvBFV5Y5yoJH+hrJno6ce1T1kBzXkNzJZ0zcaOQxcYzZa1sgxTGXKOcsPUguN7yIawTVwLF/4l4XMR0MmZzCfOaEj539A9qxfmf0stRX8lon3FXlmLNWm1yK,iv:93yJE3qFS/l6XqJvVpmTKbd3nOV6mAVJHkDoRHBO4jw=,tag:6IIroepiAR/cSL2pj+EnmA==,type:str]
+pocket-id: ENC[AES256_GCM,data:pY5yeFVla3bDDq2PbCzPgzdkpwW0P6wlJNnVskAZnXfBH+om6zrwjAaeCHKagihgBm1lqEE3zypMJkaOCq83fF4S02rRopfpvIeKYatQlKM7QNPUjuD6TeKjsWRmlvgqJUrNfSlCSR9U/PPt61d6kyAH3q/iSA+2jAIeGDCzlUInjE9P1gRBmbGNWjgUCN8keT/+HPO4mgUeMcl+YAxSB/mM7M9WJ+VK1Pzd/5Dmmvo53VS4IfCPj8w4n116Cg+xkPqlg+Edc2IM8LT5wv3L7KthJrz0JuxRwEviPo6gARL/J+jEcjaKpnzrzLrsQUwKKjwn8O3ZRLb4pK4tYiH82OMMgA7LorB5iHH/pYEN1j85GBTspaZ4YLBxTErcDxiSbqvC7ZKYUNpYsZhf7i5Kbq1OpnExTQOqtiB3O7TXRgTsWlfjf8Ii5BOnzP9mPYel,iv:93yJE3qFS/l6XqJvVpmTKbd3nOV6mAVJHkDoRHBO4jw=,tag:XHY4EVYd5nwrdUTkK5xwRw==,type:str]
 sops:
     age:
         - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE4wh28BWFp9Jql1BEzEO5RjtlmzBqRSXjGo03a8qXdd
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFR2YmJrUSAxYlJa
-            Vmo5RlYvSjZQbDZwTzVJQ2pSZ242ckZ2WDRTQWphMjVMK1dXeFZZCitSazlidnNa
-            MVhEbVdJSks3ZU44dkNURnJGTG54S1RaaUlUZmFFeHI2MXMKLS0tIExueUVseS9x
-            Qy9mS3VRR1V5SmxDV1lVNVczZFFwTC91T0ZjTndNT0JqVHcKfcjWS8D+5Ai6Kh2p
-            cRh0d7QDq+YlK4oY+vHRsHwtomknzZmdKhKjpLrJHAops+o5wAMkNpfKHaWiTgP4
-            Wtxrrg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFR2YmJrUSBtamlw
+            ZkhxZzcrNHVFZzRyZVRWNUFRYjl3eDV3RWNmR0NqMWdsVVlUWmprCis4d3JBRTFN
+            cldrMVVEQW56TTZaa0RaUUZGZ2Y2Zk93SmEvR0pDV0JNU1kKLS0tIG9RWTFzSFd4
+            UjdkREY1eUhQZWd1T3NOOWFrMGNYcVBtY0QwTmtmRVdIY0EKYDttPgIK1DZTLJaZ
+            wUqkxsB6aBXmEIVyjQfR0yUNlNT6DBb1IhHPeAn0w8CEOHw4vEGQTuukS3w5yso6
+            xOR+OA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age12anach2tn0hladej0x3409r2d8c74rj6l5ggk9c6ahjggkkdwy3qgde4gf
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEYUI0UGlMUEFyWDY4c2Fk
-            S3J0ODNpRFA3cmQ4MndrMDYydTdlZkVrM0Y4CjJWeGYvM3MxZmxFRTgxUlFhNXdy
-            NmdNbVRIK05iVU5YNi9XRllRdEphNm8KLS0tIFYzWTlDZWZYUXR0SGRlbHFCTUVV
-            NEprV3BxeWQ3bFBXZXJqU2tnMlJOUjAKrpszpSOZXMXjGvkSx9jXwuv7U1toyJC8
-            //916oBZCdHuDHH737E4uGeBHzd2d3fwT6kFwrO28YmYgSc3xKLbSQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5N1M0L3hXZ3N6bWNTaG5i
+            MDZNYmhQbTJqdzFSeks5STdHU2g2eWwva244CklJRmo4cDF1TUU2bk5Mb2E1cXVo
+            OGpkRUFsLzRaVnFYM0pxNVN1MUxETkEKLS0tIHlEa3BzRzlZVENiUkhRWmZPT2d4
+            bGNhRzQvRU4vMHd4VkhlZDVUdTlMS2sKTUWfGLJRwDw8Ro+Hy4bELVpwweoxgOs2
+            AcWvwMsLb7hrWSfHsIv+c9VbJ5g/i8dE881fkHHNZE2cC/oj+1pvMw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age14q5k8w8efxeljcshz76wrst8m94rrpqlz4ru4ypn7rldq82e84tqm0mkpq
+        - recipient: age1ggegtuygt9xzfqnx4vcf5llu96rqkm3gjygtyzdvhn7p93n3lq7qram2vc
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6SUpaT0hkaVBRekxrMHNV
-            Z2xDeXFURjU3K1hYNCsxcFFYS2I1S3ZRT0JRCkIxRXYvMFFGNUdSSWpscmlJckVt
-            YUxWeHk2c1k4Rit4Zm53NUtzU1AvTU0KLS0tIHBSL3JQanlaa25xc3RhVFhSL0J3
-            UVRyZFllME5iSXlhUW5mNnhiQm10QXcKChJqqHRbHBLrJ+Ab2PHtkLoGUkHc1e+v
-            2U1nAri58Ei2CDaKH94HYOfjCD3HecfZ61vV8uJTQ0qVhNtaMMIa8w==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1xz2qp33mrjln0dk0f5mwhpfvlcjyh9vhaw2ys227ggxlgttgks6qvmgqex
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhbEcwS0RDT0hBY0d2dHRk
-            RkNTekE0RU1QUENLdzNiMXYyTlJkTkRiTG1rCnNJTWxIUXVSUXM5ejYyTUdrSjBx
-            Q21YdzVEaDd2eURabGVhUW9veEhoVWcKLS0tIDJvSVdhRzVJOFFudERhcVZSVm1j
-            VVJPemFkVnF6cUJLMlFhdVdOU3RRSmcK5DfF7wWwWfZW2hs+jcGAauqSskhms8hh
-            wTVHuqMeiu+hYzcKHMtHZm3ALXZo1eSUNtxg94Zp35VsWOqUfzxYzA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0S2V6dzl3SVZMZy92UUg2
+            RC9kUEhNVWhSU0Voa2JlWjJha3NpQlFmamhnCmlWSVBxOCtWeDhkbHFzRnZLV3l5
+            ZmVoeVJUR0hYS09RVENaTFRVcFpVRzgKLS0tICtRVWpERW1mcVQ0Y2xodHYxMXJG
+            NHVha1dDRm4ycmNnbzdQZkRXbEZOWDAKIg/u+o/Zu7PluvtiYqRcb0QEyAyYO1LM
+            TwC1nm5lbeYANpiTva8on6gzBFCUtm8+lAezB6DLQIQczmYvcJsriw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-13T11:46:38Z"
-    mac: ENC[AES256_GCM,data:NhO4GcRlDIfud2QSqDzmfZkrWViKdQvK/d+dquY1rItC1esY1Vql39uvQkWHPibTuJOoFbBdkIoKgQbkCN8tsNa8K9sn9Gz6CUE5n5F05K5P7RPKxJLR6toHWSCztb6nvgoDY5tV3ZXdMb/8y8XViQVyZ+3Pxc9mKgS02P4ldyk=,iv:tH9PMq8I7mnkCbico0Ka5Gqfcd9geC5ZpxSfO40uJoY=,tag:sCRa4ifr+84JooK2akEU0g==,type:str]
+    lastmodified: "2025-11-13T15:52:52Z"
+    mac: ENC[AES256_GCM,data:Kc9yfacq54B6G1ZuMcRhfyXkhYldB1uce7pK8N8MQSqMrI0Gkv9cjfxTmARhRCpFK2EIjVLH86sLj0Z1Fl929gN2FF/tOo9mB9dEMAHdU5uRrw0qi6BGOTzkKBtJU7uge7FWkURMQixsAzUDzeN39j+krl0VecNcAbf1brtAqBM=,iv:XZQ7CRvX1gCu3pDjBHfv2irufZaHCUzUNl8z64l8zgE=,tag:S0IUU9p2wXgjWQNqtlzjZw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0