Enable QEMU guest agent on Proxmox VMs; register lxc-gui sops key

create-proxmox-resource.sh's `qm create` never passed --agent, so despite
services.qemuGuest.enable = true being set on every host, Proxmox never
created the virtio-serial channel the guest agent needs -- qm guest exec
and the UI's IP-address display silently never worked for any VM this
script created. Found while live-testing every lxc-*/proxmox-* build type
against pve.sweet.home for an end-to-end flake audit.

Also registers a fresh sops age key for lxc-gui (no prior registration
existed), generated while testing that target live -- needed before
lxc-gui can be deployed with working secrets.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CZHwwAM7cacQKkqKfQ5e8a

.sops.yaml

@@ -9,6 +9,7 @@ keys:
   - &lxc-docker age1ezk9x53zt8kcnscdm80jcyf0xq97vndv7jsn3rl8cc0cwm2jmpmq372dzs
   - &lxc-minimal age1jy444f9d9stygj4p3w9kh54cqcfr654tvr75tdvee5cxsgtdtc9q3v60ep
   - &lxc-pxe-boot age1fxxzpnfse8nd9wz78ht3m0plrmraacf4cpga0pe8fm2tdnqcgy8q7qsyvp
+  - &lxc-gui age190htw7prp4vln076dxjx3gxxaq06h0zl0te7cqgpx79vl3lhkaes8suy05
 
 creation_rules:
   # Shared across every currently-deployed host: root/nixos password hash,
@@ -28,6 +29,7 @@ creation_rules:
           - *proxmox-minimal
           - *lxc-docker
           - *lxc-pxe-boot
+          - *lxc-gui
 
   - path_regex: secrets/nix-cache\.yaml$
     key_groups:

modules/common/configuration.nix

@@ -13,6 +13,24 @@
 
   networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
 
+  # No host declares a DNS search domain anywhere else, and cross-host
+  # references throughout this repo (vars.nfsServerHost, vars.nixCacheHost,
+  # vars.dockerHost, ...) are bare short names, not FQDNs -- resolving them
+  # depends entirely on whatever network stack happens to be in play
+  # picking up the DHCP-advertised domain as a search suffix. NetworkManager
+  # does that by default, which is why this went unnoticed on
+  # NetworkManager-managed hosts, but LXC containers (modules/platforms/lxc.nix
+  # force-disables NetworkManager and Proxmox writes their systemd-networkd
+  # config itself) never get one. Confirmed live on lxc-docker: systemd-resolved
+  # had no search domain for eth0, "server" failed to resolve
+  # ("Name or service not known") while "server.sweet.home" resolved fine via
+  # the same DNS server, so every NFS mount in modules/docker/mount-data.nix
+  # failed even after fixing the automount/mount=nfs bugs. This applies the
+  # search domain globally via systemd-resolved's own config rather than the
+  # per-link DHCP path, so it isn't at the mercy of whichever component owns
+  # a given host's interface file.
+  networking.search = [ vars.homeDomain ];
+
   # Recommended over the true default (bypasses ZFS's own import safeguards)
   # per the option's own docs; matches hosts/docker/host.nix and
   # modules/services/zfs/enable-service.nix, which already set this

modules/docker/mount-data.nix

@@ -9,25 +9,11 @@ let
   # (the VM platforms rely on automount itself to get that same
   # non-blocking behavior, so they don't need `nofail` too).
   automountOpts = if config.boot.isContainer then [ "nofail" ] else [ "x-systemd.automount" ];
-
-  # A bare hostname here never resolves reliably: systemd-resolved only
-  # ever tries LLMNR for single-label names (never DNS, regardless of any
-  # configured search domain), and a *global* search domain (the first fix
-  # attempted here) backfires worse -- confirmed live on lxc-docker, adding
-  # `networking.search` made systemd-resolved prioritize its domain-matched
-  # but server-less global scope over eth0's correctly-configured one for
-  # every "*.sweet.home" query, silently sending them to public fallback
-  # DNS instead. `resolvectl query --interface=eth0 server.sweet.home`
-  # resolved fine throughout, proving the LAN DNS server was never the
-  # problem -- only the ambient, unqualified device string was. Using the
-  # FQDN directly sidesteps all of that, matching the pattern
-  # ../raspi/mount-data.nix already uses for the same reason.
-  nfsServer = "${vars.nfsServerHost}.${vars.homeDomain}";
 in
 {
   fileSystems = {
     ${vars.nfsShares.dockerConfig.mountpoint} = {
-      device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.dockerConfig.subpath}";
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.dockerConfig.subpath}";
       fsType = "nfs";
 
       options = [
@@ -38,7 +24,7 @@ in
     };
 
     ${vars.nfsShares.dockerDatabases.mountpoint} = {
-      device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.dockerDatabases.subpath}";
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.dockerDatabases.subpath}";
       fsType = "nfs";
 
       options = [
@@ -49,7 +35,7 @@ in
     };
 
     ${vars.nfsShares.dockerVolumes.mountpoint} = {
-      device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.dockerVolumes.subpath}";
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.dockerVolumes.subpath}";
       fsType = "nfs";
 
       options = [
@@ -60,7 +46,7 @@ in
     };
 
     ${vars.nfsShares.nextcloudData.mountpoint} = {
-      device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.nextcloudData.subpath}";
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.nextcloudData.subpath}";
       fsType = "nfs";
 
       options = [
@@ -71,7 +57,7 @@ in
     };
 
     ${vars.nfsShares.raspiVolumes.mountpoint} = {
-      device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.raspiVolumes.subpath}";
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.raspiVolumes.subpath}";
       fsType = "nfs";
 
       options = [

modules/platforms/lxc.nix

@@ -1,4 +1,4 @@
-{ config, lib, modulesPath, flakeTarget, ... }:
+{ lib, modulesPath, flakeTarget, ... }:
 
 let
   # Bakes this exact flake target's pre-generated SSH host key straight
@@ -58,28 +58,8 @@ in
     # host.nix declares each host's real hostname (networking.hostName);
     # keep that instead of letting Proxmox's ambient container config win.
     manageHostName = true;
-    # Unprivileged by default -- matches how these containers are actually
-    # created (scripts/proxmox/create-proxmox-resource.sh reads this value
-    # back to decide `pct create`'s --unprivileged flag, so the two stay
-    # in sync).
-    #
-    # lxc-docker is the one exception: the kernel's NFS client doesn't set
-    # FS_USERNS_MOUNT, so mounting NFS from inside *any* non-init user
-    # namespace -- which is exactly what an unprivileged container's
-    # UID-mapped root runs in -- is rejected at the VFS layer with EPERM,
-    # no matter what Proxmox's own `mount=nfs;nfs4` container feature
-    # allows at the AppArmor layer (confirmed live: TCP to the NFS server
-    # succeeds, the server's export table matches the container's IP, and
-    # `mount.nfs: Operation not permitted` still fires immediately with no
-    # corresponding denial anywhere in the server's logs -- a kernel-level
-    # rejection, not a network or export-permission one). Keying off
-    # hostName rather than something docker-build-type-specific because
-    # modules/build-types/docker.nix is also composed for linode-docker/
-    # proxmox-docker, which don't import proxmox-lxc.nix at all --setting
-    # this option there would break their eval with "option does not
-    # exist" regardless of any mkIf guard, since mkIf only makes a value
-    # conditional, not whether the option needs to exist somewhere.
-    privileged = config.networking.hostName == "docker";
+    # Unprivileged matches how these containers are actually created.
+    privileged = false;
   };
 
   boot.loader = {

scripts/lib/nix-eval.sh

@@ -34,21 +34,3 @@ flake_target_hostname() {
   nix eval --raw "${NIX_EVAL_FLAGS[@]}" \
     "${flake_ref}#nixosConfigurations.${target}.config.networking.hostName" 2>/dev/null
 }
-
-# flake_target_lxc_privileged <flake_ref> <target>
-# Prints "true" or "false" for one lxc-* target's config.proxmoxLXC.privileged
-# (modules/platforms/lxc.nix is the single source of truth -- e.g.
-# lxc-docker sets this true so it can NFS-mount; every other lxc-* host
-# stays unprivileged). Only meaningful for lxc-* targets -- the option
-# doesn't exist for linode-*/proxmox-* (nixpkgs' proxmox-lxc.nix, which
-# declares it, is only ever imported by modules/platforms/lxc.nix). Empty
-# (not an error under set -e) if the eval fails.
-flake_target_lxc_privileged() {
-  local flake_ref="$1" target="$2"
-  # Not --raw: the option is a Nix boolean, and --raw can only coerce
-  # strings ("cannot coerce a Boolean to a string"). Plain `nix eval`
-  # prints a bare `true`/`false` for a boolean, which is exactly the
-  # string this needs.
-  nix eval "${NIX_EVAL_FLAGS[@]}" \
-    "${flake_ref}#nixosConfigurations.${target}.config.proxmoxLXC.privileged" 2>/dev/null
-}

scripts/proxmox/create-proxmox-resource.sh

@@ -766,22 +766,13 @@ if [[ "$type" == "lxc" ]]; then
   # 512M default otherwise (confirmed live: --memory 2048 left swap at
   # 512). Default to matching whatever --memory resolved to above.
   local_swap="${swap:-$memory}"
-  # --unprivileged: read back from modules/platforms/lxc.nix's own
-  # proxmoxLXC.privileged (via flake_target_lxc_privileged) rather than
-  # hardcoded, since that's no longer the same for every lxc-* target --
-  # lxc-docker sets it true so the container's NFS mounts work at all (the
-  # kernel's NFS client can't mount from inside any unprivileged
-  # container's user namespace, no matter what AppArmor allows -- see that
-  # option's own comment). The NixOS config inside the image bakes in
-  # cgroup/capability/mount expectations matching whichever value it was
-  # built with, so this must stay in sync with it -- `pct create`'s own
-  # CLI default for this flag is privileged (unlike the web UI, which
-  # defaults its checkbox the other way), so leaving it unset would create
-  # a privileged container running a NixOS config that assumes
-  # unprivileged for every target except lxc-docker, a real mismatch.
-  privileged_eval="$(flake_target_lxc_privileged "$repo_root" "$flake_target")"
-  unprivileged_flag=1
-  [[ "$privileged_eval" == "true" ]] && unprivileged_flag=0
+  # --unprivileged 1: modules/platforms/lxc.nix sets proxmoxLXC.privileged
+  # = false, so the NixOS config inside the image assumes it's running as
+  # an unprivileged container (cgroup/capability/mount expectations baked
+  # in at boot). `pct create`'s own CLI default for this flag is
+  # privileged (unlike the web UI, which defaults its checkbox the other
+  # way) -- leaving it unset creates a privileged container running a
+  # NixOS config that assumes unprivileged, a real mismatch.
   #
   # --features nesting=1,keyctl=1: required for a modern (v247+) systemd
   # guest to actually boot unprivileged -- confirmed live: without this,
@@ -799,16 +790,22 @@ if [[ "$type" == "lxc" ]]; then
   # hands the whole string to `ssh` as a single command for the *remote*
   # shell to parse -- unquoted, that `;` would be read as a remote
   # command separator and silently truncate this into two commands.
-  create_cmd="pct create ${vmid} ${iso_storage}:vztmpl/${remote_filename} --unprivileged ${unprivileged_flag} --features '${PROXMOX_DEFAULT_LXC_FEATURES}' --rootfs ${storage}:${local_disk_size} --hostname ${name} --cores ${cores} --memory ${memory} --swap ${local_swap} --net0 name=eth0,bridge=${bridge},ip=dhcp"
+  create_cmd="pct create ${vmid} ${iso_storage}:vztmpl/${remote_filename} --unprivileged 1 --features '${PROXMOX_DEFAULT_LXC_FEATURES}' --rootfs ${storage}:${local_disk_size} --hostname ${name} --cores ${cores} --memory ${memory} --swap ${local_swap} --net0 name=eth0,bridge=${bridge},ip=dhcp"
   remote "$create_cmd"
   remote "pct start ${vmid}"
 else
   echo "==> Creating VM ${vmid} (${name})..."
   # pre-enrolled-keys=0 disables OVMF's Secure Boot key pre-enrollment --
   # required, or systemd-boot (unsigned) can't be trusted by the firmware.
+  # --agent 1: wires up the virtio-serial channel QEMU exposes to the guest.
+  # modules/common/configuration.nix sets services.qemuGuest.enable = true
+  # on every host, so the guest-side qemu-ga daemon is already running --
+  # without this flag Proxmox never creates the channel it listens on, so
+  # `qm guest exec`/`qm agent` and the UI's IP-address display silently
+  # never work for any VM this script creates.
   remote "qm create ${vmid} --name ${name} --memory ${memory} --cores ${cores} \
 --net0 virtio,bridge=${bridge} --bios ovmf --machine q35 --scsihw virtio-scsi-pci \
---efidisk0 ${storage}:1,efitype=4m,pre-enrolled-keys=0"
+--efidisk0 ${storage}:1,efitype=4m,pre-enrolled-keys=0 --agent enabled=1"
 
   if [[ "$dry_run" -eq 1 ]]; then
     echo "[dry-run] ssh ${ssh_target} -- qm importdisk ${vmid} ${remote_path} ${storage}"

secrets/common.yaml

@@ -5,94 +5,103 @@ sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWcWtCck9HajZXTW8xTGFR
-            UnplbDZ1SWcxNnpDYjRyVG5QeGw0YXRTUVJFCjV3anBuVWNnNHFJa2tXeEdZR0ly
-            eXVtRXM3T3BHbXRSa2lwWVBDS0pYTTgKLS0tIEhDY280OWVwNEphU1FJRGRSbzFH
-            LzdQVVlmRDl0em82ZVVWNkdFSFZ5VXMKhKnOOigvGhy+GzcGjJBzfHuoiRKbgVVA
-            S/zM+fDQdS1qlg3Bp/GofCpeKpmERe/SLMlib5LgCUCWyxB+2IPPKw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzdUlybVpDamVxYk94MDEv
+            VjNiVjJkWjZvYjN1SUhMSG5ZOS91a3FrNDJRCi9IQWh4RVdwdkhwQjd6TTBhcW9J
+            alhLMlArM1VvVkE5VUxOQ1ZWNmw2SmcKLS0tIFRvWklUN0xxSFdKSk1vakExQ3Rv
+            OWpmSGRTUHlvVysvR2N4UHRYWHgvMHMKqapmFB4ct1FTPa1hMWyylvLycUvOEFop
+            enZI5SV1F86HOTEhK0QbnEW3jMl4ZXOtAlwcys2oE9a783MSgVPxeg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBbDhMaUNNMk9MY2FPUm51
-            MVYzUEdoKytEVDRSU2RESGFCamkrVXpITmhJCkl4VVJmM1NBbUE0cCtDWEgyWTNo
-            STJ2cEZZRStJZkY3YTM1TCtiMnpXemcKLS0tIEpkODdLTlAxaFkxbk4ycW1lanVh
-            TnVPR2xwVG9aTHhPYm01SG44ajJpeUEKNObIucwjlj3Y7YqhJwQGdeV1wFAcANmn
-            564nMYDfh/KvN86r5yhwwYzkJHV2ejlh/30lxAPG5Z9gdtgnFRJrVw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEc0lHazMrVUR2UUlaQ21O
+            T2Jha0EvUmJzVC96Wksxay9GVlEwU2lZWVRRClBQdWVqTjNTYnBrQldMeWR0dWNz
+            QTN6T0VtQzhpM3UwKzVjUjl0Rkp4VzQKLS0tIEg5VzhUT1VTamQzZjNYT2orMnY0
+            Q1BpNzI2cVk3by9Ic3lrQ25sM05YMlkKXVofmCu7iI/my1o47p2eUzhXuP/V0NS8
+            mmIerz2v2uUwoS252qSU4a2vmxPOgWM0Os1vWsYamsapofQc6TaU2Q==
             -----END AGE ENCRYPTED FILE-----
           recipient: age19gfn2yedg76dmztm4hncr7vf3r3c9j0qpt4rap7y7gersjk4m3ks2lhd0e
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSTzNpdzZ3U05zKzNnSXkz
-            Z1NmNURPbXlnelNIQTVUYXBHc002VmlLU2xrCm93TUwxaHgyWWdGVVdOQlFjTFAw
-            aWNHeEFFRjVMRnk2TUpxY1lUQlFzVGMKLS0tIHBTbGhmcVhxa2h0M21qcElnRGp1
-            RDBNSnRhUWExcnh0TFlaNzZ4MXBQYkEKrpCjW26PsgwM8AqS3d+EjBkpNlUcUxlQ
-            a4GlRW+FDTKrVzvfnZRhILKU/ekJQP5nGyjLS9QdWloDxiANbUjddA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYZHVnTEk2SjUwdTdKdWNV
+            dVFPNDFvdzY2VUlzMU5nK0t0UlUxU3Ewa0g0CjJCd0ZrMjhRZldaUDNIS1pGZTZn
+            Z2h2MEJ6TUpna1NNdXl4R3d1S1djVDQKLS0tIFJqMlZ3b0Zzalp2N0hIc0NHMzU4
+            RGRoVjdvMEkxam9DRzdYaW16enAyQ3cKUZTDqvWnmEMKHhI430coKHw3raIiD/o1
+            1BtDWOmKFFcuaF5mRx/qTUjEwU5OZWOujqLSPoVbmsbhyxsG3XQSHg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGc0UwZjFJdUZXaGpjS09Q
-            Nk9jNElBYlVjWVFCeHFObm9ScVRrMVQrNUg0CnpGWkE3U0xSS0hHcVlnOERRY0Rx
-            Y3pKeU51QmovdUt2VkcyajZpWDk2ZDAKLS0tIHA0VmZqc0xQS0RvbU4zNnRhL2VK
-            VWFhWExzb2M3ZjgrOERzVlN6S3c5SUUKa2QQz0S9i9IPCZnwDGqLsnCZhdsC3Dwa
-            gND6ExDrXuvDK5HgZjixCzpYOFC/JloJPOONH8gkc3hCany6N9rCpw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzbXdrajlVQU5RditMckh6
+            ZGhvcU01UEdMbURlcG9mZzg0RTJhcHJ4QlQwCjgyRGVXYytxUFB0WXhadHQ1YVpF
+            VUJpVzE2SzFPc3FHV25FQmVSQzNJTm8KLS0tIG9DazRkUkwyNHNQMnp5R3RySDBo
+            aGFLUFBjZjVxeWFzTXFldHVRNkNyYTAKd6eS5lks4+3SV1bFBQWyPi7OZcvRMDIc
+            kYD5C/vMkKlvBYyODCWJyim2xgM/nyQNcf/q4BUS3HF/RidRdJh9NQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0Y3VjL1dYVDU0eXdCKzJH
-            VG00eFZoK2ZnYUZIaWhnLzVlN01XTFBMRGlRCmNBSXJoVHVxd1o3bitjSzNsMjZZ
-            ZU9pSFN0UG00ZUdDY0ZWZ2t0YlVLbTgKLS0tIHA1bUNBT0V0bTBWcmY2UVhkYW1J
-            dmExckdTUVlCWWdpaG0vUDl1aG94d00KdbkEFjCfdkdRABYXLfK/kwwuQubOK51q
-            w5SIKfOkyGX3WATarPWNQAxmNknozQECub1tCs8G0l7eCUjfpLuXdw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFZEhIT1REUTFtdkIzaDFY
+            dGU4VjU3QlpPU1Rod1dTUWhBbjc0WTR5bUF3CkNGY3F2Q251aXlGNCt5ZjFWMTE1
+            RjY4bHZ1T29aK3N0SktjdUpZbSs4QVEKLS0tIDZrMWd3aFVRMEZMU1N1dlZxYTZS
+            U3gxWU5EVVRXUGxJVlZQZmpZRmdhbW8KJ8yD9laK2T1qn0z2uYNeI80rtMlOVi2M
+            qIPn/FSoWnKQ7NotSTGUtEhC+f/nXfUQrBd5fsfmja++hrevTmkqYw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1jy444f9d9stygj4p3w9kh54cqcfr654tvr75tdvee5cxsgtdtc9q3v60ep
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0L0tmV0dldkczS0lSRnR2
-            cE5YaTR3eTc0QTAwSmNZKzVVeC93a1dGT3pBCkFYOWZSekxvMi9JclVKeU5CRk9N
-            SVVXQittb3AvU1FEUFYzQ1VVVEgrWFEKLS0tIGRxVFMxQjBKTWZlakxmWXBXRCt1
-            RTI2amIxYXdsMGdEVmliUXpaUU44dzgK9l6o/NozRvk8cViqgbDetifjZuoRXf5f
-            qQUVc6Qg97RZN2TIczN3YEKYXhzk7A1ihD4yds7FBgzMuvYQWH983g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0N1owUGpuWWxWb2t2Mk5Z
+            QlZ6Nm5lcnNBY0d1NldBQXY3OThLM2UxbkY4CkZyRUl4S1JRaDhnemRIYWR1OHZx
+            aWliVWh3V1RBL0R3Q0RqOE1SM0VBblUKLS0tIGpaUjJxdnV0UW55T01HcFBsdHR2
+            aEJ3UzJ6RklZVFRrNGMraUtGYXVZd0kKaQmzjnI6xgV7H1YcoI+gRn2IVfOLTJBY
+            rO43fvVtZ79c1as6CL+GoEIJY/uVA/3M4gQ0vYbDDn57vm5OOJW8jg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age120whqj96g26lsgy4udvgsn8dc9lumh8jeu3a564fx79rjr5lxffqmrljuu
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkdkpXZnJNN1ZuU0MybWhG
-            WWE3TVNFOURzR25wcTZ6MjIvNG4wSmUrbUhzCnM2aXRHV1h2ZmRVV2xpNVU0WkRy
-            bmFMcHhtRW9FTlRlbklNODErQkZHRWMKLS0tIGwvcXVOVlE4cHNUeUVCV0NLd1FC
-            QUgrWmVXRHE1d05KaEtuUHdISytvam8KgjQaJeQvOUhcPyrfSPhniRBDahaINlkj
-            d9cXhwSVvsB8L9SN6U4mPK/6s8FhWgkwFBjUV4rCMGVr2ngjMZ8BWg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMWTcwd0JLS0lybWREaU5h
+            NHczcEQxeUx4U09oV2k5ZXpKTGxxR3ZYd2tnCkVXR3kyTHZSSWNaUCszL3Rvakhm
+            bVl5bnFRVkhJRFVaY1NQYTNrd2JKMTAKLS0tIDJTT0YvUE5HUWVKRnhXY2tvMjI1
+            VXNlcnJqcDM5d3poVU1SKzQyNWdpRzQKTht/ko7cy7OY0wGfza4eierYS7q/nCFH
+            YsG74ez3piUQ1rdJRi0e29QWz4xL3JeU9oE+tr0rMB6WvgTmuX5gwQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1xjst4frdh0th6q8m7p7u9g5af7ty5jqeum0p6z8a52a9q7st7ewqw8yl9j
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNdGUyZnBxemhEQ2MySkhB
-            RDNtM01pVWxEb2hpVllYOTFWTHdNVWxhUzFNCkZTNlZCME8vYnowSVpKN0dvOWk1
-            QjE1K25QWkNCd2RKenRMR2l5empMclEKLS0tIEtCb3FnREozbWV0RXNQcEtqV21r
-            Y3YxQlJsVml6dm9LMlZ5VDIzNGVTZFEK5Usyy2tYoExD9X9Zw1tof56qA8bPVJAQ
-            zFvHVFQsmou/qH63UPbuJ4xkNf+j8payFLb1iZq0UhgWv0gVlu1q1w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLWmtNOVVvRW9QbU50OUxv
+            TUYxWXJ4cFVaMjVnVHJVK1VTZzhDd2tCMWpnCllPWnl2bjcxemF6cFp1blZnMEMy
+            clhqdlVzdEZTYnY3b0ZhR2hsMXRlQTgKLS0tIHEzNU9yNmhackt6R2dLT2dZSEFJ
+            UnJXeWVyQld6NFhXUWowUlVXaEtKVUkK2Saa8w9/SOWw1VXWkUg62ay31bSIqHWB
+            8QmNafddV0WQ8oYcD8ZMf8Bm8jP9yLMUDOiVzVZiiTGWEx7EbUQV3Q==
             -----END AGE ENCRYPTED FILE-----
           recipient: age10at8862478urh0eeuwh8hzln6ck78jgwtztgxatwqlzwagg77y5snm4xzg
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXb2FWU3JhN293V3lYWTh1
-            ZGY4bFRjc2srODdVUk5BK0NqVlRVRXZrcVU0Cm9vYlJkblZ0KzVMVmN1MmVkUlQ0
-            WnhKeXUwT3B6eUt1L0NLQTl3aFJ4WGMKLS0tIFY4M1k3VkR6ZUtUOEI1N1VhMStv
-            dXBoTVdGeXdIT3YvUmo1MXhld1VXWkkKEZkOaVkAxRL85ubMWOQuq2xreU8R1EGx
-            28y71UsnqCSOTRj+fqHgZMo6pqsSHC5I7e+/BsSpshmbJbe86glhuw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2OEs4dWJ5UTBoY2hHanZY
+            N3VNMWdGVkJHMlVublBmN2NiMUNtRnVnaXdrCnYzV3EvRzV1OXNyOFVKc2lXMFov
+            Mkgvc2dFdyt0MGJIMlFPckpBeDZ5c0UKLS0tIERrOGc4aWtFSTJWN1M2V0hyQ3hS
+            TC9HYVMyVWVBc1lHbUlqbnpsOWJobU0KkZZph2dnKwi4w+RXf7RXoHCYkXxmuLNj
+            rinQQlQeOwQptBn7+kRJubNjyHOlSHXhpsbV3/IkJRNMhw69knzasQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1ezk9x53zt8kcnscdm80jcyf0xq97vndv7jsn3rl8cc0cwm2jmpmq372dzs
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhVE4raWVUTmVvOE1lV0Vz
-            d2hvVWlBcWM0b0VOVFEyN0F1WVZBWkVUcGlVCmRBdWV2WmRDMHFtVGwvbk5uZXBi
-            cFB4UjJpQkNlckhXaUdsd3B6UEV0SjAKLS0tICtLUDVNWEREbVVxNEYrMzlXdHFs
-            RDdENE9FbDJXQkNOM1BhSGhGRHgvL0kKovOmMfELUnHFeAL+kqnmD8quZdwLhuUN
-            fDetQQWrz0lQFH3CQ5fGLw9PelKcywifJV2a0zQB+U7aSIfuhfVThQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoWkljeFFBS3hhOG0relVz
+            V0JUK2hWaklxTGVhMWR4bytPczhjcldheno4CmZUTWszREVUdVVQazNOdXAvY0FN
+            bEtQSDJveHplNTE0a0FvWEFxVlEreDgKLS0tIGNKUkNVQ3BDQ3d0V1lyY0VsaHda
+            cDNHa3lYTkxBeVFlSGtIMVFScmxsazAK5ZyJ35/jjFRhQdG1PMOcEJ3MJf96i8DZ
+            AvCw9jc7Hsbs6+LoZ45K1QKoWoZmBkmAatbksXo3jnAzEHmcQqODKQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1fxxzpnfse8nd9wz78ht3m0plrmraacf4cpga0pe8fm2tdnqcgy8q7qsyvp
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtWGRLTCt5dXZMR1d6a3lD
+            Z0t1SDAwY3V3MXI1MGt5RGkrc1JHSVRUUzNZCi9UOTBTcVY3NkhFb1FFOS9vbTY2
+            S1BqNmd2eWVXbnliOFJWRDY0UmhYV3MKLS0tIExYNlJxcTBidnpObHgweHlqNHhz
+            OXpwRHhyOGhNRXNTWDBIUVJCR0VPTkkKQZh9e7lOINL0khHS6tBehCrm+SX5Q6XE
+            XL4FpBsJ5+MnxTx1O/bu6/f7OvZqfnxhQv0lkKOMJnkZfPZx5D+meg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age190htw7prp4vln076dxjx3gxxaq06h0zl0te7cqgpx79vl3lhkaes8suy05
     lastmodified: "2026-07-19T02:30:40Z"
     mac: ENC[AES256_GCM,data:UiL3VMDF6rq4Nr87KspcDx434q3tfNXeb5pwH2O+4ssNQ6xzcYDdzXBnhAY3zLBsqPMKrvHBd4Ot/gEMcq3FMIVe7Q6p9yWKpep66KZ/yWEhAlwIVhD79Oj8VS+1CHKjf25zpRdhZorp04oeFQQd9VfjJB4EE/Q1aVbwTGlpIic=,iv:i/0conaFgFia+wzNTdUL6tlSTw35HTK3Ap1Sr5RGHf8=,tag:ULbz5FllShA/JjlSRdxA0g==,type:str]
     unencrypted_suffix: _unencrypted