Merge pull request 'chore(secrets): Phase 4 — remove stale sops.yaml anchors and re-encrypt' (#60 ) from worktree-phase0-provision-ordering-fix into main

Merge PR #60: Phase 4 — remove stale sops.yaml anchors
chore(secrets): Phase 4 — remove stale sops.yaml anchors and re-encrypt
2026-07-25 11:32:25 +00:00 · 2026-07-25 21:31:56 +10:00 · 2026-07-25 11:24:55 +00:00 · 2026-07-25 21:24:32 +10:00 · 2026-07-25 11:18:19 +00:00 · 2026-07-25 21:10:46 +10:00
29 changed files with 835 additions and 432 deletions
@@ -1,32 +1,27 @@
 keys:
  - &admin age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad
-  - &docker age19gfn2yedg76dmztm4hncr7vf3r3c9j0qpt4rap7y7gersjk4m3ks2lhd0e
-  - &server age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
-  - &nix-cache age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
-  - &nix-minimal age120whqj96g26lsgy4udvgsn8dc9lumh8jeu3a564fx79rjr5lxffqmrljuu
  - &proxmox-minimal age10at8862478urh0eeuwh8hzln6ck78jgwtztgxatwqlzwagg77y5snm4xzg
-  - &lxc-nix-cache age1xjst4frdh0th6q8m7p7u9g5af7ty5jqeum0p6z8a52a9q7st7ewqw8yl9j
-  - &lxc-docker age1ezk9x53zt8kcnscdm80jcyf0xq97vndv7jsn3rl8cc0cwm2jmpmq372dzs
-  - &lxc-minimal age1jy444f9d9stygj4p3w9kh54cqcfr654tvr75tdvee5cxsgtdtc9q3v60ep
-  - &lxc-pxe-boot age1fxxzpnfse8nd9wz78ht3m0plrmraacf4cpga0pe8fm2tdnqcgy8q7qsyvp
  - &lxc-gui age190htw7prp4vln076dxjx3gxxaq06h0zl0te7cqgpx79vl3lhkaes8suy05
-  - &proxmox-server age1ukpqxzl44mnjpy5r96sfuc5sqzm47u4k8ujjh5qdgy6jvl9uqgpspymqfk
-  - &vm-server age15kh7akxlx7zn00tey79rq2g8lgs4j5y77rcnyfxrxap8ckfu0a9sqvtdhh
-  - &baremetal-gui age1ehkswwz2pqaz4svzh7ela5tdnssl8kn6d4vwwxd6zwg8exfpd43syyrrjp
-  - &lxc-tor-relay age1gl5ujmhd2pe37acd0eaar8tmnf2na28n8l28s8xct40vqpxvsdwqf49g4l
-  - &linode-docker age1eu65wsmez68gegnufl0gqrs0e6w2409mypjlajlq383d7l2e3pjqy5kn6v
-  - &linode-gui age17pwyghxr6lq06fw46gwqzhc9ut4paz28rpwx5pmv3cxwak6rgyjsw7lk3w
-  - &linode-minimal age1jukmg69cqxnjd0lp5f534jhqe65rxew2hufcmyjxa3rkw6ayef6s2ylcmy
-  - &linode-nix-cache age1tzsrtwd3p3lrr9g7nv3z5nvmzsz54t2uc6tfqwutp6usmav83s2sck25cc
-  - &linode-server age1rf4kj99wuq59k7w8ar326djmgmpl9hcwlnuag07f8gauq8c3y5mqne87s4
-  - &linode-tailscale-exit-node age1d0zhx7u3mfs3nktl67npey87cze4dwsfvfvgaje4rh3gwv500yssckcf6u
-  - &lxc-server age1jc6wx33hdhgwhk6nzy5rr8fkgmqxk9um639tk5h632nqfyaw8czskdptj9
-  - &lxc-tailscale-exit-node age1pgykvq4pmxhhjrqupcp99fyad2uht40pt79dkzg66cfvsjy5apjqls8u68
-  - &proxmox-docker age19ht95nv8uhz2shjmakeut8mc3l5spvrcxs3thhe85an7u02r6sysyv457n
-  - &proxmox-gui age1mhaze5tgvc9lwjpml6dnp3xc292337wgm6376yh6tq4fn492ndjq9h23dq
-  - &proxmox-nix-cache age15me6sx0f8r58xh9v7aqrj6e99n7eu555jkpw422txpkqt4r02v0qpahlyq
-  - &proxmox-pxe-boot age1q3hu6eh3mt4saey7dc3yu04s7knnk2ygpm9xt6mg6rqtem6l0uyq4wzul5
-  - &proxmox-tailscale-exit-node age1tczst3x7thwtcz4vce4rg6kmlsszzm6j45kn2nv860z9wa93a92s05ppmc
+  - &baremetal-gui age1adur9g330gua4l6ndk8cqjg35qc8yxwgme6wrl2hpylcc7vxm38q05ejuy
+  - &linode-docker age17e89ty6p0fw24daanen57wg8uald9s025t3wwxsw269svwpmgvrshfvfvt
+  - &linode-gui age1hrx8qj02fj2ea6d4g9vqhyj9hl7fppkjqfdx2l37py3h6pdkr95s8n8rvs
+  - &linode-minimal age1e7l8dusgmgfzd2cxrrzwepzjxt69hzqj4epee0cs27u6yg4kxcuqm34ncx
+  - &linode-nix-cache age1jcx3yajjhghn8qh8za3yeu8nxykzlg3p4nrv03vnfvzl0mzayg2qmg940e
+  - &linode-server age1sweerhrga9yf8x6sv0apz4ed4g48rnlcq34rpv20t0rcelwgpgeqwvndzz
+  - &linode-tailscale-router age1f7usptjx9rv4rxauasve200gxtdt9jkqhhdqstlf20wvlm7u75rsjfw50m
+  - &lxc-docker age17jqc66x9yeshfgd9v78mj483r4zzarqdtuxtrkxe4x5mw679gphshd94th
+  - &lxc-minimal age1px0h5l9zp2dww0m8fncrc82kfdmzplsfv2ltat7sna28xpg09pqqcl3s2k
+  - &lxc-nix-cache age1ufg390ydrmma849t9xfkxxl5xvdkk6mngnlzhmy7mvuaje8sgcmsmnq6l7
+  - &lxc-pxe-boot age16j42pdc5dr6wnj7xayhkqdj2rny9u68fcqejs50hqq42scssh4gsnrrnlt
+  - &lxc-server age1nruncs4l0ufk7yuc4des8p99c0alfndl0lhsws8tycl5pplfp56s30af5f
+  - &lxc-tailscale-router age1k7d2du5mejsmv5rzavm4xwgpthqvcfsehduquv28nzs53zppa3kqngfxq2
+  - &lxc-tor-relay age16kqfmvz4e23hmdlqresnyw69ej604s320mmd49h4hm3fhqchtgyqrws0k2
+  - &proxmox-docker age1arhf2q45zw6wf2uevju4savp575x3m2tfvved5zzq3ay92ynua9s3cm92c
+  - &proxmox-gui age19mn8zrxl8zpps9yvrh4euquvygpp4fp8queg7xc6qhtnl4ng8c9qx02qwn
+  - &proxmox-nix-cache age1jlltcv5jcnm40z5k0q6hv053k2rqpqvemtuecdwn527uw8uqz4es3x7m68
+  - &proxmox-pxe-boot age1ug787sgt6st6k82fgkrug2lzltw4qsukrrqqs3w27ewwqj8rg4hsxcmylz
+  - &proxmox-server age1529taqdwr6t0w7cvzmty0d5y5593wffl0krt48j6uc4u39k56g2qf6ywtp
+  - &proxmox-tailscale-router age1zhfyuzlq40reuqlr34gf77852nhs3t6mqfzrqmas8z6sxk7tcfhsungrm0

 creation_rules:
  # Shared across every currently-deployed host: root/nixos password hash,
@@ -37,58 +32,44 @@ creation_rules:
    key_groups:
      - age:
          - *admin
-          - *docker
-          - *server
-          - *nix-cache
-          - *lxc-minimal
-          - *nix-minimal
-          - *lxc-nix-cache
          - *proxmox-minimal
-          - *lxc-docker
-          - *lxc-pxe-boot
          - *lxc-gui
-          - *proxmox-server
-          - *vm-server
          - *baremetal-gui
-          - *lxc-tor-relay
          - *linode-docker
          - *linode-gui
          - *linode-minimal
          - *linode-nix-cache
          - *linode-server
-          - *linode-tailscale-exit-node
+          - *linode-tailscale-router
+          - *lxc-docker
+          - *lxc-minimal
+          - *lxc-nix-cache
+          - *lxc-pxe-boot
          - *lxc-server
-          - *lxc-tailscale-exit-node
+          - *lxc-tailscale-router
+          - *lxc-tor-relay
          - *proxmox-docker
          - *proxmox-gui
          - *proxmox-nix-cache
          - *proxmox-pxe-boot
-          - *proxmox-tailscale-exit-node
+          - *proxmox-server
+          - *proxmox-tailscale-router

  - path_regex: secrets/nix-cache\.yaml$
    key_groups:
      - age:
          - *admin
-          - *nix-cache
-          - *lxc-nix-cache
          - *linode-nix-cache
+          - *lxc-nix-cache
          - *proxmox-nix-cache

  - path_regex: secrets/server\.yaml$
    key_groups:
      - age:
          - *admin
-          - *server
-          - *proxmox-server
-          - *vm-server
          - *linode-server
          - *lxc-server
-
-  - path_regex: secrets/docker\.yaml$
-    key_groups:
-      - age:
-          - *admin
-          - *docker
+          - *proxmox-server

  - path_regex: secrets/tor-relay\.yaml$
    key_groups:
@@ -27,9 +27,12 @@ machines when deployed.
  template for a *real* host — every other host uses sops-nix
  (`hashedPasswordFile`, see "Security Notes" in `README.md`). Flag any *new*
  secret-like string you encounter instead of committing it.
- `host-keys/` is gitignored — locally-generated *private* SSH host keys for
-  the auto-installer (see `docs/auto-installer.md`). Never commit its
-  contents; if `git status` ever shows it as trackable, something is wrong.
+- `host-keys/` is gitignored — locally-generated *private* SSH host keys
+  for the auto-installer and non-LXC hosts (see `docs/auto-installer.md`).
+  Never commit its contents; if `git status` ever shows it as trackable,
+  something is wrong. Deployed LXC hosts use clan vars
+  (`vars/per-machine/<target>/openssh/`, committed and sops-encrypted)
+  instead — those ARE tracked by git and belong in the repo.

 ### Two Proxmox nodes: `pve1.sweet.home` (production) and `pve-test.sweet.home` (sandbox)

@@ -203,8 +206,11 @@ instead of copying it.
 - `scripts/secrets/sync-host-keys.sh` — generates/registers SSH host keys
  and their `.sops.yaml`/`secrets/*.yaml` recipients for flake targets,
  idempotently (`--all`, `<target>`, `--remove`, `--regenerate-all-keys`,
-  all with `--dry-run`). The primary tool for provisioning a new host's
-  secrets access — see "Creating a new machine" in `docs/auto-installer.md`.
+  all with `--dry-run`). For lxc-* targets it stores keys as clan vars
+  (`vars/per-machine/<target>/openssh/`, committed and sops-encrypted);
+  for other targets it uses the gitignored `host-keys/` directory. The
+  primary tool for provisioning a new host's secrets access — see
+  "Creating a new machine" in `docs/auto-installer.md`.
 - `scripts/secrets/prepare-host-key.sh` — narrower predecessor: generates a
  key by an arbitrary name without touching `.sops.yaml`. Still useful to
  pre-generate a key before its flake target exists yet, since
@@ -72,7 +72,8 @@ nix eval --json .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]'
 | `modules/common/` | Shared NixOS config, Home Manager, aliases imported by every host |
 | `modules/nix-cache/` | Binary cache and remote builder client/server modules |
 | `modules/installer/` | Auto-installer environment (ISO, also served as PXE netboot) — see `docs/auto-installer.md` |
-| `host-keys/` | Gitignored, locally-generated SSH host keys for the auto-installer — see `docs/auto-installer.md` |
+| `host-keys/` | Gitignored, locally-generated SSH host keys for the auto-installer (non-LXC hosts) — see `docs/auto-installer.md`. LXC hosts use clan vars (`vars/per-machine/<target>/openssh/`) instead |
+| `vars/per-machine/` | Clan vars: committed, sops-encrypted SSH host keys for deployed LXC hosts; read by `create-proxmox-resource.sh` at deploy time |
 | `docs/` | Operational notes for cache, builders, lock updates, boot services, the auto-installer, and Proxmox image builds |
 | `scripts/` | Codex setup, validation, host-key, release-bump, and Proxmox resource helpers |

@@ -162,7 +163,8 @@ sops-nix-everywhere: it has a hardcoded login password instead (no stable
 per-boot host key for sops-nix to derive from on ephemeral media) — see
 "Host keys" in `docs/auto-installer.md` for why, and how the private keys it
 *does* pre-seed for target hosts stay out of git via the gitignored
-`host-keys/` directory.
+`host-keys/` directory. Deployed LXC hosts instead use clan vars
+(`vars/per-machine/<target>/openssh/`, committed and sops-encrypted).

 This repository's git *history* still contains secrets committed before this
 migration (see `remove-sensetive-info-refactor.md`) — those are being
@@ -1,5 +1,62 @@
 {
  "nodes": {
+    "clan-core": {
+      "inputs": {
+        "data-mesher": "data-mesher",
+        "disko": [
+          "disko"
+        ],
+        "flake-parts": "flake-parts",
+        "nix-darwin": "nix-darwin",
+        "nix-select": "nix-select",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "sops-nix": [
+          "sops-nix"
+        ],
+        "systems": "systems",
+        "treefmt-nix": "treefmt-nix"
+      },
+      "locked": {
+        "lastModified": 1783497933,
+        "narHash": "sha256-TxmwEews6URFPqOWEHNychtXbFDgLZjbOfEXtvtOm6U=",
+        "rev": "3dc0221ca09033599fe98055e9bbc81bdf32732a",
+        "type": "tarball",
+        "url": "https://git.clan.lol/api/v1/repos/clan/clan-core/archive/3dc0221ca09033599fe98055e9bbc81bdf32732a.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://git.clan.lol/clan/clan-core/archive/26.05.tar.gz"
+      }
+    },
+    "data-mesher": {
+      "inputs": {
+        "flake-parts": [
+          "clan-core",
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "clan-core",
+          "nixpkgs"
+        ],
+        "treefmt-nix": [
+          "clan-core",
+          "treefmt-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778718524,
+        "narHash": "sha256-pXLoI6Ax0EnUK6r34UM1vibVC7CfTu6j72R2692ZzPs=",
+        "rev": "12c552ad547d87254f33f33bddd1a2cdbeac754d",
+        "type": "tarball",
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/12c552ad547d87254f33f33bddd1a2cdbeac754d.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://git.clan.lol/clan/data-mesher/archive/main.tar.gz"
+      }
+    },
    "disko": {
      "inputs": {
        "nixpkgs": [
@@ -51,9 +108,30 @@
        "type": "github"
      }
    },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "clan-core",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778716662,
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
    "flake-utils": {
      "inputs": {
-        "systems": "systems"
+        "systems": "systems_2"
      },
      "locked": {
        "lastModified": 1694529238,
@@ -109,6 +187,40 @@
        "type": "github"
      }
    },
+    "nix-darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "clan-core",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779036909,
+        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
+        "owner": "nix-darwin",
+        "repo": "nix-darwin",
+        "rev": "56c666e108467d87d13508936aade6d567f2a501",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-darwin",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
+    "nix-select": {
+      "locked": {
+        "lastModified": 1763303120,
+        "narHash": "sha256-yxcNOha7Cfv2nhVpz9ZXSNKk0R7wt4AiBklJ8D24rVg=",
+        "rev": "3d1e3860bef36857a01a2ddecba7cdb0a14c35a9",
+        "type": "tarball",
+        "url": "https://git.clan.lol/api/v1/repos/clan/nix-select/archive/3d1e3860bef36857a01a2ddecba7cdb0a14c35a9.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://git.clan.lol/clan/nix-select/archive/main.tar.gz"
+      }
+    },
    "nixos-conf-editor": {
      "inputs": {
        "flake-compat": "flake-compat",
@@ -163,6 +275,7 @@
    },
    "root": {
      "inputs": {
+        "clan-core": "clan-core",
        "disko": "disko",
        "home-manager": "home-manager",
        "nixos-conf-editor": "nixos-conf-editor",
@@ -214,6 +327,22 @@
      }
    },
    "systems": {
+      "locked": {
+        "lastModified": 1774449309,
+        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "ref": "future-26.11",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -227,6 +356,27 @@
        "repo": "default",
        "type": "github"
      }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "clan-core",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1780220602,
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
    }
  },
  "root": "root",
@@ -16,6 +16,19 @@
      url = "github:Mic92/sops-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
+    clan-core = {
+      url = "https://git.clan.lol/clan/clan-core/archive/26.05.tar.gz";
+      # Deduplicate modules: clan-core bundles its own disko and sops-nix
+      # (both imported by nixosModules.clanCore). Without follows, we'd get
+      # two different versions of each, and disko's _module.args.diskoLib
+      # unique option would conflict. With follows, clan-core uses the same
+      # store paths as us, so NixOS deduplicates the imports.
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        disko.follows = "disko";
+        sops-nix.follows = "sops-nix";
+      };
+    };
  };

  outputs = { self, nixpkgs, nixos-conf-editor, home-manager, sops-nix, ... } @ inputs:
@@ -41,6 +54,22 @@
          modules = [
            inputs.disko.nixosModules.disko
            sops-nix.nixosModules.sops
+            inputs.clan-core.nixosModules.clanCore
+            {
+              # Required clan settings. directory is the flake root (where
+              # vars/ and sops/ directories live); machine.name is the flake
+              # target name (matches what clan vars generate uses as the key
+              # under vars/per-machine/). enableRecommendedDefaults = false
+              # is mandatory: without it, clan unconditionally enables
+              # networking.useNetworkd, adds packages, and tweaks nix settings
+              # -- none of which belong here.
+              clan.core = {
+                settings.directory = self;
+                settings.machine.name = flakeTarget;
+                enableRecommendedDefaults = false;
+              };
+            }
+            ./modules/clan/ssh-host-key.nix
            ./modules/common/configuration.nix
            ./modules/platforms/${platform}.nix
            ./modules/build-types/${buildType}.nix
@@ -96,9 +125,9 @@
        proxmox-pxe-boot = mkTarget { platform = "proxmox"; buildType = "pxe-boot"; hostPath = ./hosts/pxe-boot/host.nix; };
        lxc-pxe-boot = mkTarget { platform = "lxc"; buildType = "pxe-boot"; hostPath = ./hosts/pxe-boot/host.nix; };

-        linode-tailscale-subnet-router = mkTarget { platform = "linode"; buildType = "tailscale-subnet-router"; hostPath = ./hosts/tailscale-subnet-router/host.nix; };
-        proxmox-tailscale-subnet-router = mkTarget { platform = "proxmox"; buildType = "tailscale-subnet-router"; hostPath = ./hosts/tailscale-subnet-router/host.nix; };
-        lxc-tailscale-subnet-router = mkTarget { platform = "lxc"; buildType = "tailscale-subnet-router"; hostPath = ./hosts/tailscale-subnet-router/host.nix; };
+        linode-tailscale-router = mkTarget { platform = "linode"; buildType = "tailscale-router"; hostPath = ./hosts/tailscale-router/host.nix; };
+        proxmox-tailscale-router = mkTarget { platform = "proxmox"; buildType = "tailscale-router"; hostPath = ./hosts/tailscale-router/host.nix; };
+        lxc-tailscale-router = mkTarget { platform = "lxc"; buildType = "tailscale-router"; hostPath = ./hosts/tailscale-router/host.nix; };

        lxc-tor-relay = mkTarget { platform = "lxc"; buildType = "tor-relay"; hostPath = ./hosts/tor-relay/host.nix; };
      };
@@ -27,7 +27,7 @@
    # Optional: set environment vars
    sessionVariables = {
      EDITOR = "vim";
-      SOPS_AGE_KEY_FILE = "/home/nixos/Nextcloud/Filing Cabinet/keys/nixos-sops-age-key-txt";
+      SOPS_AGE_KEY_FILE = "~/.config/sops/age/keys.txt";
    };

    file = {
@@ -0,0 +1,30 @@
+{ pkgs, ... }: {
+  # Defines the SSH host key as a clan vars generator so that:
+  #   - `clan vars generate <target>` creates and encrypts the key pair
+  #   - The private key lives at vars/per-machine/<target>/openssh/ssh_host_ed25519_key/secret
+  #     (sops binary-encrypted, admin-key-only; decrypted by the build script)
+  #   - The public key lives at vars/per-machine/<target>/openssh/ssh_host_ed25519_key.pub/value
+  #     (plaintext; used by sync-host-keys.sh to derive the sops age fingerprint)
+  #
+  # neededFor = "activation" means clan's deployment tool would upload this
+  # before running nixos-rebuild/nixos-install (for VM/baremetal via
+  # nixos-anywhere). For lxc-* hosts, the build script bakes it into the
+  # tarball directly via NIXOS_HOST_KEYS_DIR -- the neededFor value here
+  # simply ensures it is NOT mapped to sops.secrets (which would try to
+  # decrypt it at runtime as a regular service secret, which is wrong: the
+  # SSH host key reaches the container via the tarball, not sops).
+  clan.core.vars.generators.openssh = {
+    files."ssh_host_ed25519_key" = {
+      secret = true;
+      neededFor = "activation";
+    };
+    files."ssh_host_ed25519_key.pub" = {
+      secret = false;
+      neededFor = "activation";
+    };
+    runtimeInputs = [ pkgs.openssh ];
+    script = ''
+      ssh-keygen -t ed25519 -N "" -C "" -f "$out/ssh_host_ed25519_key"
+    '';
+  };
+}
@@ -3,7 +3,7 @@
 {
  nix.settings = {
    substituters = [
-      "http://${vars.nixCacheHost}"
+      "http://${vars.nixCacheHost}.${vars.homeDomain}"
      "https://cache.nixos.org/"
    ];
    trusted-public-keys = [
@@ -8,12 +8,12 @@
  # dedicated keypair). If this host doesn't have one yet:
  #   sudo -u root ssh-keygen -t ed25519 -N '' -f /root/.ssh/id_ed25519
  #   # then add its .pub to vars.remoteBuilderAuthorizedKeys and rebuild nix-cache
-  #   sudo ssh -i /root/.ssh/id_ed25519 nixremote@nix-cache nix-store --version
+  #   sudo ssh -i /root/.ssh/id_ed25519 nixremote@nix-cache.sweet.home nix-store --version
  # Trust nix-cache's SSH host key declaratively so the nix-daemon (root)
  # can connect the first time without a manual ssh-keyscan/known_hosts
  # step on every new client.
-  programs.ssh.knownHosts.${vars.nixCacheHost} = {
-    hostNames = [ vars.nixCacheHost ];
+  programs.ssh.knownHosts."${vars.nixCacheHost}.${vars.homeDomain}" = {
+    hostNames = [ "${vars.nixCacheHost}.${vars.homeDomain}" ];
    publicKey = vars.nixCacheHostKey;
  };

@@ -22,7 +22,7 @@

    buildMachines = [
      {
-        hostName = vars.nixCacheHost;
+        hostName = "${vars.nixCacheHost}.${vars.homeDomain}";
        sshUser = vars.remoteBuilderUser;
        sshKey = "/root/.ssh/id_ed25519";
        inherit (pkgs.stdenv.hostPlatform) system;
@@ -20,7 +20,7 @@
    nginx = {
      enable = true;
      recommendedProxySettings = true;
-      virtualHosts.${vars.nixCacheHost} = {
+      virtualHosts."${vars.nixCacheHost}.${vars.homeDomain}" = {
        locations."/" = {
          proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
        };
@@ -114,30 +114,39 @@ in
  # /etc/ssh/ssh_host_ed25519_key; deletion cascades into every sops secret
  # failing with "Error getting data key: 0 successful groups required, got 0".
  #
-  # Fix: two activation scripts that bracket the etc step.
-  #   preserveSshHostKey — no deps, runs before etc — saves the live key to
-  #                        /run (tmpfs) before etc can delete it.
-  #   restoreSshHostKey  — deps=[etc], runs after etc — reinstalls the key via
-  #                        `install` (atomic, sets mode) if etc removed it.
-  #                        The resulting file is not registered in environment.etc
-  #                        for either the previous or current generation, so
-  #                        subsequent rebuilds leave it alone permanently.
-  system.activationScripts.preserveSshHostKey = ''
-    if [ -f /etc/ssh/ssh_host_ed25519_key ]; then
-      cp /etc/ssh/ssh_host_ed25519_key /run/sshd-host-key-preserve.tmp
-      cp /etc/ssh/ssh_host_ed25519_key.pub /run/sshd-host-key-preserve.pub.tmp
-    fi
-  '';
-
-  system.activationScripts.restoreSshHostKey = {
-    deps = [ "etc" ];
-    text = ''
-      if [ ! -f /etc/ssh/ssh_host_ed25519_key ] && [ -f /run/sshd-host-key-preserve.tmp ]; then
-        install -m 0600 /run/sshd-host-key-preserve.tmp /etc/ssh/ssh_host_ed25519_key
-        install -m 0644 /run/sshd-host-key-preserve.pub.tmp /etc/ssh/ssh_host_ed25519_key.pub
+  # Fix: activation scripts that bracket the etc step, with explicit deps
+  # to enforce the correct ordering. Without deps the topological sort places
+  # preserveSshHostKey AFTER etc (confirmed live on a deployed lxc-tor-relay:
+  # position 7 vs etc's position 5) -- the key is already gone by the time it
+  # tries to save it. The etc/setupSecrets entries ADD to existing deps
+  # (types.listOf concatenates across module definitions).
+  system.activationScripts = {
+    # Saves the live key to /run before etc can delete it.
+    preserveSshHostKey = ''
+      if [ -f /etc/ssh/ssh_host_ed25519_key ]; then
+        cp /etc/ssh/ssh_host_ed25519_key /run/sshd-host-key-preserve.tmp
+        cp /etc/ssh/ssh_host_ed25519_key.pub /run/sshd-host-key-preserve.pub.tmp
      fi
-      rm -f /run/sshd-host-key-preserve.tmp /run/sshd-host-key-preserve.pub.tmp
    '';
+
+    # Reinstalls the key after etc runs if it was removed as "obsolete".
+    # The resulting file is not registered in environment.etc for either
+    # generation, so subsequent rebuilds leave it alone permanently.
+    restoreSshHostKey = {
+      deps = [ "etc" ];
+      text = ''
+        if [ ! -f /etc/ssh/ssh_host_ed25519_key ] && [ -f /run/sshd-host-key-preserve.tmp ]; then
+          install -m 0600 /run/sshd-host-key-preserve.tmp /etc/ssh/ssh_host_ed25519_key
+          install -m 0644 /run/sshd-host-key-preserve.pub.tmp /etc/ssh/ssh_host_ed25519_key.pub
+        fi
+        rm -f /run/sshd-host-key-preserve.tmp /run/sshd-host-key-preserve.pub.tmp
+      '';
+    };
+
+    # Force etc to wait until the key is saved, and sops to wait until the
+    # key is restored. Without these the topological sort breaks the chain.
+    etc = { deps = [ "preserveSshHostKey" ]; };
+    setupSecrets = { deps = [ "restoreSshHostKey" ]; };
  };

  # virtualisation/proxmox-lxc.nix (imported above) registers the Nix
@@ -146,9 +155,12 @@ in
  # sops-nix's "for users" secrets (password hashes -- installed by the
  # activation script itself, not a systemd service, since they need to
  # exist *before* user creation) nor the user-creation step that
-  # consumes them ever run on a real lxc-* boot. Regular secrets
-  # (nix-serve's key, beszel's token, etc.) work anyway because sops-nix
-  # provides its own systemd service for those.
+  # consumes them ever run on a real lxc-* boot. In this config sops-nix
+  # does NOT generate its own boot-time service (confirmed live: no
+  # sops-nix.service in systemctl list-unit-files on a deployed
+  # lxc-tor-relay container); /run/secrets is a tmpfs cleared on every
+  # reboot, so secrets must be reinstalled on each non-first boot by
+  # nixos-lxc-sops-reinstall (below).
  #
  # A systemd service, not boot.postBootCommands: tried that first (it's
  # a genuine, generally-invoked hook -- nixos/modules/system/boot/stage-2-init.sh,
@@ -199,4 +211,41 @@ in
      touch /var/lib/nixos-lxc-first-boot-activated
    '';
  };
+
+  # Reinstalls sops secrets on every non-first boot. /run/secrets is a
+  # tmpfs that is cleared on each reboot; without this service, secrets
+  # are permanently absent after the first boot and every service that
+  # reads from /run/secrets fails on start.
+  #
+  # wantedBy/before network.target: switch-to-configuration test requires
+  # D-Bus to restart systemd targets after running activation scripts. D-Bus
+  # is available once basic.target completes (the default After=basic.target
+  # that DefaultDependencies would otherwise add). Placing the service before
+  # network.target ensures secrets are ready before any network-dependent
+  # service (including beszel-agent and nix-serve) starts, while running late
+  # enough that D-Bus is already up.
+  #
+  # ConditionPathExists=... skips this service on the genuine first boot
+  # (the marker doesn't exist yet); nixos-lxc-first-boot-activate handles
+  # that case. On every subsequent boot the condition passes and secrets
+  # are reinstalled before user services start.
+  #
+  # SuccessExitStatus=11: switch-to-configuration exits 11 when it cannot
+  # acquire the activation lock (another switch is already in progress).
+  # During a nixos-rebuild switch the activation already installs secrets, so
+  # treating the lock-held case as success is correct.
+  systemd.services.nixos-lxc-sops-reinstall = {
+    description = "Reinstall sops secrets on each non-first boot (LXC, /run is tmpfs)";
+    wantedBy = [ "network.target" ];
+    before = [ "network.target" ];
+    unitConfig.ConditionPathExists = "/var/lib/nixos-lxc-first-boot-activated";
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      SuccessExitStatus = "11";
+    };
+    script = ''
+      /run/current-system/bin/switch-to-configuration test
+    '';
+  };
 }
@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+# Clan vars helpers: manage SSH host keys stored as clan vars (sops-encrypted
+# binary files under vars/per-machine/<target>/openssh/) instead of the
+# gitignored host-keys/ directory.
+#
+# Layout (per clan's convention):
+#   vars/per-machine/<target>/openssh/ssh_host_ed25519_key/secret  -- sops binary (admin-encrypted)
+#   vars/per-machine/<target>/openssh/ssh_host_ed25519_key.pub/value  -- plaintext SSH pubkey
+#
+# Sourced by create-proxmox-resource.sh and sync-host-keys.sh.
+# Depends on sops-age.sh and ssh-host-keys.sh being sourced first (for
+# sops_yaml_admin_pubkey, ssh_pubkey_to_age, and NIX_OPTS).
+
+if ! declare -p NIX_OPTS >/dev/null 2>&1; then
+  declare -a NIX_OPTS=()
+fi
+
+# clan_ssh_key_exists <target> <repo_root>
+# Returns 0 if clan vars hold a SSH host key for <target>, 1 otherwise.
+clan_ssh_key_exists() {
+  local target="$1" repo_root="$2"
+  [[ -f "${repo_root}/vars/per-machine/${target}/openssh/ssh_host_ed25519_key/secret" ]]
+}
+
+# clan_ssh_pubkey_path <target> <repo_root>
+# Prints the path to the plaintext SSH public key value file.
+clan_ssh_pubkey_path() {
+  local target="$1" repo_root="$2"
+  echo "${repo_root}/vars/per-machine/${target}/openssh/ssh_host_ed25519_key.pub/value"
+}
+
+# clan_decrypt_ssh_key <target> <repo_root> <dest_dir>
+# Decrypts the sops-encrypted SSH host private key for <target> into <dest_dir>,
+# naming it <target>_ssh_host_ed25519_key (to match NIXOS_HOST_KEYS_DIR
+# conventions that lxc.nix and the disko build already expect). Also copies
+# the plaintext public key. The caller is responsible for protecting and
+# cleaning up <dest_dir>.
+clan_decrypt_ssh_key() {
+  local target="$1" repo_root="$2" dest_dir="$3"
+  local secret="${repo_root}/vars/per-machine/${target}/openssh/ssh_host_ed25519_key/secret"
+  local pubval="${repo_root}/vars/per-machine/${target}/openssh/ssh_host_ed25519_key.pub/value"
+  local dest_priv="${dest_dir}/${target}_ssh_host_ed25519_key"
+  local dest_pub="${dest_dir}/${target}_ssh_host_ed25519_key.pub"
+
+  nix-shell "${NIX_OPTS[@]}" -p sops --run \
+    "sops -d --output-type binary '${secret}'" > "$dest_priv"
+  chmod 0600 "$dest_priv"
+  cp "$pubval" "$dest_pub"
+}
+
+# clan_generate_ssh_key <target> <repo_root>
+# Generates a new SSH host key pair and stores it in clan vars format:
+#   - private key: sops binary-encrypted for the admin age key
+#   - public key: plaintext value file
+# Idempotent: if the secret already exists, prints a note and returns 0.
+# Requires sops_yaml_admin_pubkey (from sops-age.sh) to be available.
+clan_generate_ssh_key() {
+  local target="$1" repo_root="$2"
+  local var_base="${repo_root}/vars/per-machine/${target}/openssh"
+  local secret_dir="${var_base}/ssh_host_ed25519_key"
+  local pubval_dir="${var_base}/ssh_host_ed25519_key.pub"
+
+  if [[ -f "${secret_dir}/secret" ]]; then
+    echo "Clan SSH host key for ${target} already exists -- skipping generation."
+    return 0
+  fi
+
+  # Resolve admin age public key from .sops.yaml
+  local admin_pubkey
+  admin_pubkey="$(sops_yaml_admin_pubkey "${repo_root}/.sops.yaml")"
+  if [[ -z "$admin_pubkey" ]]; then
+    echo "ERROR: Could not find &admin age key in ${repo_root}/.sops.yaml" >&2
+    return 1
+  fi
+
+  # Generate the SSH key pair in a secure temp directory
+  local tmpdir
+  tmpdir="$(mktemp -d)"
+  local priv_tmp="${tmpdir}/ssh_host_ed25519_key"
+
+  # shellcheck disable=SC2064
+  trap "rm -rf '${tmpdir}'" RETURN
+
+  nix-shell "${NIX_OPTS[@]}" -p openssh --run \
+    "ssh-keygen -t ed25519 -N '' -C '${target}' -f '${priv_tmp}'" >/dev/null
+
+  # Create a minimal sops config that uses only the admin age key -- this
+  # prevents sops from merging in ALL recipients from .sops.yaml (which
+  # would unnecessarily encrypt for every host's key, not just admin).
+  local sops_cfg="${tmpdir}/sops-config.json"
+  printf '{"creation_rules":[{"key_groups":[{"age":["%s"]}]}]}\n' \
+    "$admin_pubkey" > "$sops_cfg"
+
+  # Encrypt the private key in sops binary format (admin-only recipient)
+  mkdir -p "$secret_dir" "$pubval_dir"
+  nix-shell "${NIX_OPTS[@]}" -p sops --run \
+    "sops -e --config '${sops_cfg}' --input-type binary '${priv_tmp}'" \
+    > "${secret_dir}/secret"
+
+  # Store the public key as a plaintext value file
+  cp "${priv_tmp}.pub" "${pubval_dir}/value"
+
+  echo "Generated and stored clan SSH host key for ${target}."
+  echo "  Private key: ${secret_dir}/secret (sops binary, admin-key encrypted)"
+  echo "  Public key:  ${pubval_dir}/value"
+}
@@ -38,7 +38,7 @@
 set -euo pipefail

 : "${NIX_CACHE_HOST:=nix-cache}"
-: "${NIX_CACHE_HOST_KEY:=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPeWgMsdaiz4axT/deFc1+0B5bN+GX/NOeW9bbQ0c/IT lxc-nix-cache}"
+: "${NIX_CACHE_HOST_KEY:=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICuHUxGNH6ei3BZD+EfZs3l4X8uJNcjQiOsM/G4yo4O/ lxc-nix-cache}"
 : "${REMOTE_BUILDER_USER:=nixremote}"

 CACHE_PUB_KEY="cache.local-1:usoWYanY3Kpq2+kDIS2nhWoLZiRxanmdysdzqCFBHW4="
@@ -8,9 +8,12 @@
 # script -- there's no multi-gigabyte image to transfer afterward. The first
 # time a node doesn't have that repo path yet, it's bootstrapped: cloned from
 # this checkout's own `origin` remote, then scripts/codex-setup.sh installs
-# the build tooling (Nix, etc.). Every run after that just `git pull`s it and
-# copies over the locally-managed host-keys/ (gitignored, so a git pull
-# alone wouldn't carry it) before building.
+# the build tooling (Nix, etc.). Every run after that just `git pull`s it.
+# SSH host keys are stored as clan vars (vars/per-machine/<target>/openssh/,
+# committed and sops-encrypted) -- the script decrypts them locally and
+# copies only the two files for this target to the node's host-keys/ before
+# building. A target with no clan var is an error (generate one first with
+# scripts/secrets/sync-host-keys.sh <target>).
 #
 # --node (default: $PROXMOX_HOST, see scripts/env.sh) picks which of the two
 # LAN Proxmox nodes this runs against: production, pve1.sweet.home
@@ -59,6 +62,10 @@ source "${repo_root}/scripts/env.sh"
 source "${repo_root}/scripts/lib/nix-eval.sh"
 # shellcheck source=../lib/confirm.sh
 source "${repo_root}/scripts/lib/confirm.sh"
+# shellcheck source=../lib/sops-age.sh
+source "${repo_root}/scripts/lib/sops-age.sh"
+# shellcheck source=../lib/clan-vars.sh
+source "${repo_root}/scripts/lib/clan-vars.sh"

 sync_keys="${repo_root}/scripts/secrets/sync-host-keys.sh"

@@ -485,12 +492,37 @@ echo "Target: ${flake_target} (host=${host}, type=${type}) -> Proxmox resource '
 nix_extra_opts

 # --- make sure this target has a registered host key --------------------
+# sync-host-keys.sh is idempotent and generates the key (via clan vars) if
+# no key exists yet -- the old inline prepare-host-key.sh call is gone.
 echo
 echo "==> Ensuring host key exists and is registered..."
 sync_args=("$flake_target")
 [[ "$dry_run" -eq 1 ]] && sync_args+=(--dry-run)
 bash "$sync_keys" "${sync_args[@]}"

+# If sync-host-keys.sh changed .sops.yaml, secrets/, or vars/per-machine/,
+# those changes must be committed and pushed before the remote `git pull`
+# below picks them up -- the PVE node builds from whatever HEAD is checked
+# out there, not the local working tree. Uncommitted clan vars or sops
+# recipients mean the image builds fine but the host cannot decrypt its
+# secrets on first boot. Block until the operator confirms they've pushed.
+if [[ "$dry_run" -eq 0 ]]; then
+  _dirty="$(git -C "$repo_root" status --porcelain -- .sops.yaml secrets/ vars/per-machine/ 2>/dev/null || true)"
+  if [[ -n "$_dirty" ]]; then
+    echo
+    echo "==> COMMIT + PUSH REQUIRED before the remote build can succeed:"
+    echo "    Uncommitted changes in .sops.yaml, secrets/, or vars/per-machine/."
+    echo "    The PVE node builds from the git-tracked flake, so these changes"
+    echo "    must be committed and pushed first -- otherwise the image build will"
+    echo "    succeed but the host cannot decrypt its secrets on first boot."
+    echo
+    git -C "$repo_root" status --short -- .sops.yaml secrets/ vars/per-machine/ || true
+    echo
+    read -rp "    Commit and push those changes, then press Enter to continue (Ctrl-C to abort): "
+  fi
+  unset _dirty
+fi
+
 # --- VMID: pick one, and refuse to touch anything that already exists ---
 echo
 if [[ -z "$vmid" ]]; then
@@ -613,21 +645,35 @@ ensure_remote_repo() {
  fi
 }

-# --- sync locally-managed host-keys/ to the node ---------------------------
-# Gitignored (see .gitignore), so `git pull` above never carries it -- both
-# build paths need it present as NIXOS_HOST_KEYS_DIR / --pre-format-files
-# input on the node itself now that the build runs there. scp (not rsync,
-# not already a dependency anywhere else in this repo) mirrors how this
-# script already transfers the --image case below.
+# --- sync host key to the node ---------------------------------------------
+# SSH host keys are stored as clan vars (vars/per-machine/<target>/openssh/).
+# Decrypt locally and scp just the two files for this target to the node's
+# host-keys/ directory, where the remote build script picks them up via
+# NIXOS_HOST_KEYS_DIR (LXC) or --pre-format-files (VM). A target with no
+# clan var is an error -- generate one first with sync-host-keys.sh.
 sync_remote_host_keys() {
  echo
-  echo "==> Syncing host-keys/ to ${node}..."
+  echo "==> Syncing host key for ${flake_target} to ${node}..."
  if [[ "$dry_run" -eq 1 ]]; then
-    echo "[dry-run] would copy ${repo_root}/host-keys/ to ${ssh_target}:${remote_repo_dir}/host-keys/"
+    echo "[dry-run] would decrypt clan SSH key for ${flake_target} and copy to ${ssh_target}:${remote_repo_dir}/host-keys/"
    return
  fi
+  if ! clan_ssh_key_exists "$flake_target" "$repo_root"; then
+    echo "ERROR: no clan SSH key found for ${flake_target}" >&2
+    echo "  (expected: ${repo_root}/vars/per-machine/${flake_target}/openssh/ssh_host_ed25519_key/secret)" >&2
+    echo "  Generate one first: bash scripts/secrets/sync-host-keys.sh ${flake_target}" >&2
+    exit 1
+  fi
+  local tmpdir
+  tmpdir="$(mktemp -d)"
+  # shellcheck disable=SC2064
+  trap "rm -rf '${tmpdir}'" RETURN
+  echo "  Decrypting clan SSH key for ${flake_target}..."
+  clan_decrypt_ssh_key "$flake_target" "$repo_root" "$tmpdir"
  ssh "$ssh_target" "mkdir -p '${remote_repo_dir}/host-keys'"
-  scp -pr "${repo_root}/host-keys/." "${ssh_target}:${remote_repo_dir}/host-keys/"
+  scp -p "${tmpdir}/${flake_target}_ssh_host_ed25519_key" \
+         "${tmpdir}/${flake_target}_ssh_host_ed25519_key.pub" \
+         "${ssh_target}:${remote_repo_dir}/host-keys/"
 }

 # --- build (or reuse an image already on the node) ------------------------
@@ -696,6 +742,12 @@ cd "$repo_dir"
 # right after a successful install.
 . scripts/lib/nix-bootstrap.sh
 ensure_nix_profile
+if [[ ! -f "host-keys/${target}_ssh_host_ed25519_key" ]]; then
+  echo "ERROR: host-keys/${target}_ssh_host_ed25519_key not found in ${repo_dir}." >&2
+  echo "Generate the key locally (scripts/secrets/sync-host-keys.sh ${target})" >&2
+  echo "and ensure it was synced here before starting the build." >&2
+  exit 1
+fi
 NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build --impure \
  --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \
  ".#nixosConfigurations.${target}.config.system.build.tarball" \
@@ -736,12 +788,18 @@ declare -a NIX_OPTS=()
 cd "$repo_dir"
 . scripts/lib/nix-bootstrap.sh
 ensure_nix_profile
+if [[ ! -f "host-keys/${target}_ssh_host_ed25519_key" ]]; then
+  echo "ERROR: host-keys/${target}_ssh_host_ed25519_key not found in ${repo_dir}." >&2
+  echo "Generate the key locally (scripts/secrets/sync-host-keys.sh ${target})" >&2
+  echo "and ensure it was synced here before starting the build." >&2
+  exit 1
+fi
 nix build --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \
  ".#nixosConfigurations.${target}.config.system.build.diskoImagesScript" \
  --out-link "result-${target}"
 $sudo_pfx "./result-${target}" \
-  --pre-format-files "host-keys/${target}_ssh_host_ed25519_key" /etc/ssh/ssh_host_ed25519_key \
-  --pre-format-files "host-keys/${target}_ssh_host_ed25519_key.pub" /etc/ssh/ssh_host_ed25519_key.pub \
+  --pre-format-files "$(pwd)/host-keys/${target}_ssh_host_ed25519_key" /etc/ssh/ssh_host_ed25519_key \
+  --pre-format-files "$(pwd)/host-keys/${target}_ssh_host_ed25519_key.pub" /etc/ssh/ssh_host_ed25519_key.pub \
  --build-memory 2048
 built="$(find . -maxdepth 1 -name '*.raw' -newer "result-${target}" | head -1)"
 if [[ -z "$built" ]]; then
@@ -41,8 +41,9 @@ mkdir -p "$keydir"
 keyfile="${keydir}/${hostname}_ssh_host_ed25519_key"

 if [[ -f "$keyfile" ]]; then
-  echo "ERROR: $keyfile already exists. Remove it first if you want to regenerate." >&2
-  exit 1
+  echo "Key already exists: ${keyfile}"
+  echo "Reusing the existing key. Remove it first if you want to regenerate."
+  exit 0
 fi

 nix_extra_opts
@@ -19,8 +19,9 @@
 #                      already has the current .sops.yaml/secrets/*.yaml.
 #
 # SSH: connects as SSH_USER@<hostname> (default: nixos, the user with the
-# admin authorized key), then installs files via sudo. You will be prompted
-# for the sudo password once per host.
+# admin authorized key), then installs files via sudo -S (reads the sudo
+# password from stdin). The password is prompted once at startup and reused
+# for every host -- no PTY or terminal required on the remote side.
 # Hosts are reached at their bare hostname (relies on LAN DNS/mDNS).
 set -euo pipefail

@@ -37,6 +38,7 @@ SSH_OPTS=(-o StrictHostKeyChecking=no -o BatchMode=yes -o ConnectTimeout=5)

 dry_run=0
 skip_git_check=0
+sudo_password=""

 usage() {
  cat <<EOF
@@ -51,9 +53,30 @@ Usage: $0 [--all | <target>] [--dry-run] [--skip-git-check]

 Environment:
  SSH_USER           SSH username (default: nixos).
+  SUDO_PASS          Sudo password (skips the interactive prompt; useful
+                     when calling from another script).
 EOF
 }

+# Prompt for the sudo password once; store it for all _do_push calls.
+# Accepts SUDO_PASS from the environment to allow non-interactive callers.
+prompt_sudo_password() {
+  [[ "$dry_run" -eq 1 ]] && return
+  if [[ -n "${SUDO_PASS:-}" ]]; then
+    sudo_password="$SUDO_PASS"
+    return
+  fi
+  # read exits non-zero when stdin is not a terminal (e.g. CI, background
+  # agents). Catch that and give a clear message rather than a silent exit.
+  if ! read -r -s -p "sudo password for ${SSH_USER} on remote hosts: " sudo_password; then
+    echo >&2
+    echo "ERROR: stdin is not a terminal -- cannot prompt for sudo password." >&2
+    echo "       Set SUDO_PASS=<password> in the environment and re-run." >&2
+    exit 1
+  fi
+  echo >&2
+}
+
 locally_managed_hosts() {
  for f in "${keydir}"/*_ssh_host_ed25519_key.pub; do
    [[ -e "$f" ]] || continue
@@ -135,7 +158,7 @@ _do_push() {

  if [[ "$dry_run" -eq 1 ]]; then
    echo "  [dry-run] would scp host-keys/${target}_ssh_host_ed25519_key{,.pub} to /tmp/"
-    echo "  [dry-run] would: sudo install -m 0600/0644 to /etc/ssh/ and rm /tmp copies"
+    echo "  [dry-run] would: sudo -S install -m 0600/0644 to /etc/ssh/ and rm /tmp copies"
    return
  fi

@@ -145,15 +168,15 @@ _do_push() {
  scp -o StrictHostKeyChecking=no \
    "$pubfile" "${SSH_USER}@${hostname}:/tmp/push_ed25519_key.pub"

-  # Install with correct permissions in one interactive sudo session
-  echo "  (sudo password may be required)"
-  ssh -t -o StrictHostKeyChecking=no "${SSH_USER}@${hostname}" \
-    "sudo bash -s" <<'REMOTE'
-install -m 0600 /tmp/push_ed25519_key     /etc/ssh/ssh_host_ed25519_key
-install -m 0644 /tmp/push_ed25519_key.pub /etc/ssh/ssh_host_ed25519_key.pub
-rm -f /tmp/push_ed25519_key /tmp/push_ed25519_key.pub
-echo "  [ok] host key installed"
-REMOTE
+  # Install via sudo -S: the password is piped via herestring so no PTY is
+  # needed on either side. -p '' suppresses sudo's own prompt string.
+  ssh -o StrictHostKeyChecking=no "${SSH_USER}@${hostname}" \
+    "sudo -S -p '' bash -c '
+      install -m 0600 /tmp/push_ed25519_key     /etc/ssh/ssh_host_ed25519_key
+      install -m 0644 /tmp/push_ed25519_key.pub /etc/ssh/ssh_host_ed25519_key.pub
+      rm -f /tmp/push_ed25519_key /tmp/push_ed25519_key.pub
+      echo \"  [ok] host key installed\"
+    '" <<< "$sudo_password"

  # Drop the stale known_hosts entry for this host (public key just changed)
  ssh-keygen -R "$hostname" 2>/dev/null || true
@@ -278,6 +301,7 @@ fi

 nix_extra_opts
 ensure_remote_current
+prompt_sudo_password

 if [[ "$mode" == "single" ]]; then
  push_target "$target_arg"
@@ -39,6 +39,8 @@ source "${repo_root}/scripts/lib/ssh-host-keys.sh"
 source "${repo_root}/scripts/lib/sops-age.sh"
 # shellcheck source=../lib/confirm.sh
 source "${repo_root}/scripts/lib/confirm.sh"
+# shellcheck source=../lib/clan-vars.sh
+source "${repo_root}/scripts/lib/clan-vars.sh"

 mkdir -p "$keydir"

@@ -146,13 +148,15 @@ dry_run=0
 queue_host_sync() {
  local host="$1"
  local keyfile="${keydir}/${host}_ssh_host_ed25519_key"
-  local has_local_key=0 has_anchor=0
+  local has_local_key=0 has_clan_key=0 has_anchor=0
  [[ -f "$keyfile" ]] && has_local_key=1
+  clan_ssh_key_exists "$host" "$repo_root" && has_clan_key=1
  grep -qE "^  - &${host} age1" "$sops_yaml" && has_anchor=1

-  if [[ "$has_local_key" -eq 0 && "$has_anchor" -eq 1 ]]; then
+  if [[ "$has_local_key" -eq 0 && "$has_clan_key" -eq 0 && "$has_anchor" -eq 1 ]]; then
    echo "SKIP ${host}: .sops.yaml already has an &${host} anchor, but"
-    echo "     host-keys/${host}_ssh_host_ed25519_key is missing locally."
+    echo "     neither host-keys/${host}_ssh_host_ed25519_key nor"
+    echo "     vars/per-machine/${host}/openssh/ exist locally."
    echo "     Not generating a replacement -- it wouldn't match whatever's"
    echo "     already registered (and possibly deployed). Remove the"
    echo "     &${host} line from .sops.yaml first if you really want a"
@@ -160,21 +164,26 @@ queue_host_sync() {
    return 1
  fi

-  if [[ "$has_local_key" -eq 0 ]]; then
+  if [[ "$has_local_key" -eq 0 && "$has_clan_key" -eq 0 ]]; then
    if [[ "$dry_run" -eq 1 ]]; then
-      echo "[dry-run] ${host}: would generate host key"
+      echo "[dry-run] ${host}: would generate host key via clan vars"
    else
-      echo "==> ${host}: generating host key"
-      generate_host_ed25519_key "$host" "$keyfile"
+      echo "==> ${host}: generating host key via clan vars"
+      clan_generate_ssh_key "$host" "$repo_root"
+      has_clan_key=1
    fi
+  elif [[ "$has_clan_key" -eq 1 ]]; then
+    echo "==> ${host}: clan-managed SSH host key already present"
  else
-    echo "==> ${host}: host key already present"
+    echo "==> ${host}: host key already present (host-keys/)"
  fi

  if [[ "$has_anchor" -eq 0 ]]; then
    local age_pub
    if [[ "$dry_run" -eq 1 ]]; then
      age_pub="dry-run-placeholder-not-a-real-key"
+    elif [[ "$has_clan_key" -eq 1 ]]; then
+      age_pub="$(ssh_pubkey_to_age "$(clan_ssh_pubkey_path "$host" "$repo_root")")"
    else
      age_pub="$(ssh_pubkey_to_age "${keyfile}.pub")"
    fi
@@ -5,256 +5,211 @@ sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwU3A1MFJvZFJkL2d3UzNv
-            eUF5eFhkUGIyVVpjSEovaUZKdUlVeWxncEdjCkVOQjA0Q1FtbElFdTB2Rkp5aWl6
-            THdmcXVzcnUxeVZ5VUdFMmVKa0tXSzAKLS0tIG1ZcFZwUEoxRGcwakIyRVY3dzNT
-            VjlMTFdXYVVaeUpzTnNXMVhwalQybnMKjEHhkLMCGy3Q5mHPg7WSp7IBncKw6cCV
-            1WD9H47oGdW0BgBdi4rK4H7fmashw6TxjHZ1JfuCKps4mvvVWb2llg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiT2oxVkhrTVo3Wkx1SXFG
+            NzJFTkFrbHJKMTZGeVFDT2VVL2xFQmNsd1NjCi84eHA2TmV0WVBzckhnZFYxallI
+            WFptVFFKOXBlSXNvTWxEUlNNYUtPQUkKLS0tIDRjWWJVWjNtR0JSUk9Rc1hhK2lN
+            ME4wRE1hMlQ5d0tLYVZmTHYwZURLaE0KMKA/MUzB/a3OjibvYTlk5QQmzJ15L6y4
+            FvIliCLoBnGuvv/sS5/5piLHo4qRF9kqqqUuy0Cumg4SI4O2Toshtg==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRM3A0b0Jub04wcFZWelRo
-            L1RyZmRNS2pTV1FPVXNEbVF1SncxTXFvWnhVClRjSFVtOVIrVVd6VnoxR3NvSEpY
-            Y2lJU01lbWlUcTVraEFiNjJTeUlOdXcKLS0tIDliMElZTElVL0VNNVBseUVhQy9u
-            YnFmM29mUFMxUXhYS1R3ZnpEZmJtSlkKWoXICCvylDiMJ/YWR8oRgIZlSYb9Ubkl
-            H6BeOPVs1qegS3Hav6vJrd+OMv1rd8rxWw5B5MYhNUEG81cdX5fgkA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age19gfn2yedg76dmztm4hncr7vf3r3c9j0qpt4rap7y7gersjk4m3ks2lhd0e
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiZS9ibXZ5VzF4UEcyQmhE
-            N1JrOFNsMUgxbC8zRmQ4MWlxbVN1Ny9JTEhrCkM1Zk1IK2JNMnlFVjNPNzBaOVNz
-            K0lodkVBSnhSQkFvSm5TUmVCaFFRZ3cKLS0tICtaSE5Udnp5WTNIemI2MVJWNVpq
-            Nm1XOTRHbVdYczBZTDQ4a3hwRVV3MGsKmOmKG4ixQhLu+TO6bsdtD1Iwnzj45o73
-            M5cWNcPlKa4cF7JfzHMl7jzvjTzHN9NY1KjBS60EABTzvKGqYVfJng==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQQUh2YzJ1MTViYkNRSlFJ
-            OVM5cy8zcldvRHlmY2pIL0pPeWVDQitqcFVNCnhWWjYycGNaRzliZGxQUGdOUlEx
-            Q1Y3bWplZjc3WHdYUFpOUWQ0NkZOTEEKLS0tIFB5b0pOQVVWM3pRelR0SmlwS1FW
-            dnUxTklVa0N3RUl3bUIxRkU2Y3FtNncK7v0Q/fyygDAUr5aSgmillRb0AEE2+JHE
-            P+ae0gqe2L/i3h01XdiqxAflVXzCF8rhFIG6jf+XCmxQx0eDUSzbLA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhRzVrSDQzWGNoL21GU1FC
-            Z3ByeSsrRU42MWI1WVBjOXNFQ1RyOUluYTN3CkxLQjFBcXFYVS8wTFhkakZDSkZB
-            MmZRS1BCNi9Kdy9wa1FRYk9RT0V5TTQKLS0tIGpTV0I4UGZXY3BNYUNZdkxzUFYv
-            ZEN2L1F0ZXAyb2gwWTRNZDRwbjViMlEKUScRb9D360Ns/ofOn8voUNiJwzJxt7k8
-            9hwsBIiCDvNQtw5tlgEirSD0z5cZJ+6iWiyZbh1FJmFLfmlu8Y43sQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1jy444f9d9stygj4p3w9kh54cqcfr654tvr75tdvee5cxsgtdtc9q3v60ep
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1OTNFVTdHNVlBY1dDVkFH
-            ZU4xaVlWTkNzcjFKaDBZczU3dTFrSkd1TFJ3CjVxTXpoWXNwemEyU3hhWjZqeVl2
-            cEZrMWh1V3IxWnFLVE0zR1dkY0o1alEKLS0tIEhwM3ZyNHFIbU5OYzVkYnlkT204
-            RG9ocGd6NWdoRHdVanJPcWFNaStFTFEKFhmCp5Dpxev/ltZaNq4MC5JcTcKJnjUD
-            Nqby+fqJTcu9WFGqNHHra+I0+ROSAeE9ohhfqOZZg+6HNgzdjqmCEw==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age120whqj96g26lsgy4udvgsn8dc9lumh8jeu3a564fx79rjr5lxffqmrljuu
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqMUptazlMYjNwekVXRG5C
-            Rk5YWE9tTm5XVzFOVitjNFEzc1lrRmNqZlVFCmk5R2M3OWZ5SlBoV1YrdkVVbXpQ
-            dU1jTTNVWmdYRGtUczBaVmpQMDdpLzAKLS0tIGVMTFRmdUlySTk5WkE2M1VDQXZm
-            c0xHUXVCdFJrVFA3M0dHdUROdE50QTgKq5nhd/jlJkMIPCjYsuiMgY4VsW68zEf3
-            qADcbbuYWKfQi/lz92tgMP+d+3GoRjVBIQ2my0giZD8c7ZhibXSLVw==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1xjst4frdh0th6q8m7p7u9g5af7ty5jqeum0p6z8a52a9q7st7ewqw8yl9j
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4aklLVk5XaUl6dHVsNC9J
-            YUorZGlDTWs4aFIzK0o1dXJSeElLZWpvcWtrCkpOWmFuOUZSUUtNNHZ2dnpENG5v
-            Q1MwbVN0bXl1bDA4b2hwNzlBRnFEY1kKLS0tIFZPRHhyYTRRSG15ZU1uSXIyZmVC
-            eXA5c2FpY1BWamk3dzNXMUtteE91OWsKV+yTdt1MW/7FUxy64abvwjN4OQPaw81l
-            NsOLGSMbZHbQFrqyW1aXTfqYkN1wSuH5rYSZwBL+8gRLBEkFwQtfGw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqR3VsSlJMWFR1WHBwcHEz
+            blhLLzBoWEcwL0hVbkhJY2duSGxzaU5LVERzCk1STEZ5WExsT3o1SnRQSzN0OWh5
+            SjBaRkp5TnBkTGhZM2cyZGNZYmRydE0KLS0tIEx0ZU5PdnhQQng0OU91SW4rcW1O
+            WkRReU9DTWxLMU1XR1VSNXlZV0NGbFkK23aYRtL2n8L9OOSBJDKHKY63I1k2MxDb
+            ZoUiB48q379xc89KpI6uV2DNV2CpSUr/S1YI5OWRzMJmf+aYzJmikg==
            -----END AGE ENCRYPTED FILE-----
          recipient: age10at8862478urh0eeuwh8hzln6ck78jgwtztgxatwqlzwagg77y5snm4xzg
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwbmpEN0lrNitUcEdyNjFT
-            ZUFCUXA2STFTaTFxUXdrWTRuOG51cThTZ2dnCmhadmpNOTJKS0ZvNmFRdkVLWTJ4
-            ZUpwNGFxMGp2eDdKdjlNTmVCVnc2MncKLS0tIDY3eUZ3SmZwTXhMYkZqOWVTb2Vy
-            WCtxb2toY0UwRmxSemZza2VDOEk0U0EKzk4+Ik7eGUyot4/pCLV7rMY+aNpHFvM1
-            jlShEeqOrPiU1VQ0t4nWSI5E00rpZv+cxs/o1ii9RSUEi7/3VDgHtQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1ezk9x53zt8kcnscdm80jcyf0xq97vndv7jsn3rl8cc0cwm2jmpmq372dzs
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJdHBScXYyZEg4Ky9qVUZn
-            RWpMd3VPVEp0cUc2OUJmWHZwOW1DL3ByVXo0CkNWcldRNVpnVll5eVJTV3FBMTVC
-            WUJ4a3RZRUFuNFB6b01RVWJLNTZZc3cKLS0tIEF0ckhmWGZ0Y25jcnUyajNxZkMy
-            akEyWjUrM3RUOGZOZDgxSGlIT2VrejAKXjLTsZ/Qf+77sA2d8kxNublGsCJNiNUa
-            voxDqyXEYAP9JHk7LZr2iNz2j6lnrJbB80sSerZJAhok8A5cZ/RWsw==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1fxxzpnfse8nd9wz78ht3m0plrmraacf4cpga0pe8fm2tdnqcgy8q7qsyvp
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIUjFYQTIrUjFEUytDZDJj
-            eGU2UlBRV3NobkdyNy9rdjkvWDhVVi84OXlFCjlXSXBmVHljMTJwa25Zc0dIdlFD
-            RGRkaTI5UmI3ek1oTjZjc2M5UGlHYjAKLS0tIDF2QVpzajdObjhHZVV0dnJXMFZl
-            VFlJT0M0VjBvSHlrVXoraitkd0IrTjQKU0/plWrjbN5BL782Hls0idImBUHEDg8o
-            9svRbtapGOqwEVuMoLhPGhJ+FjjHZxYIDVj1o3ZHzs7aVMgiODdAzQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVYzkxVy9La0RzZGNHVXFN
+            MWUrc0RmT0NCaC9TZkFtOHBsV0ZtcGx2bVdvCmNnakVmL0xReXlMVkp5eXQyK1pr
+            aDFGemFrUVBZUGFwcjRVT3JTanBWZHcKLS0tIDRGZTRJY3lmZnpqTW5HRThWd2FN
+            MHhudjM4eFE4MDlIWTZoREp2NlgyZ0kKCo6/D0nchgDt8m/+idPRnjGaJoNrlqFj
+            5DwysBa3WPDTqeJ8053sMFGQWoYVEaL916B6zo+ZC34pPeKA9UuPsw==
            -----END AGE ENCRYPTED FILE-----
          recipient: age190htw7prp4vln076dxjx3gxxaq06h0zl0te7cqgpx79vl3lhkaes8suy05
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhRW8xNnNEalNmSmtvaUJM
-            OUQzQ1M5RFQzNHBVc1NZSUJTekZ3azRwalg4Ck8xUm5HR3UrdUJaOGIyait4ZlFk
-            RFFXTlY1SlZncy9VQnR1bTVWR3ZZcmsKLS0tIHM2K0oxMWNld3NQSHJhb1ZneWxL
-            d0J1NEhlMXRnMlZMRkdEMFhwUi9vVkUKgI1e28oU9zTUzGpiZSQUT1k4HVTtPeeV
-            aqVMxoomQd9Q8Hg9NFmMSqXvbAJm5NC7NVdwUzI5WrfUIGe01a1bFA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmUnYzd2lmVFdPRFh1b0VD
+            SlN2YjgrakRHRWFVSEFlWElEdGdOYTJxRWlJCnFRRm5lT0MydmVqTHduTlVLQTFk
+            eS9yV0kzVU1JTEJQV3dXOXVpcy9NSjQKLS0tIE56Q05mSWhVUWMyQkVqUFNlbm04
+            RUhIN0MrcWlQMERxa3M3RktkTW5HbVEKWzTl19inKF3wf2SrVDecFsth5PPjKyGi
+            839OP4IAMoM0GPOkmHk35sxjr/34hTpk5mO7yu4nYH8rOhMiSTZ9ng==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1ukpqxzl44mnjpy5r96sfuc5sqzm47u4k8ujjh5qdgy6jvl9uqgpspymqfk
+          recipient: age1adur9g330gua4l6ndk8cqjg35qc8yxwgme6wrl2hpylcc7vxm38q05ejuy
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCSVZkRHVWOWRUSU04cEdL
-            VG82aXZhTzlaSlZaME9uRDJiUE5ORmlxN244ClVsUlRDVlVhQ0FyaldRQkRLejRY
-            dHpicE1xektRWXdELzRkZXFwOVJJbUEKLS0tIDRDRXQxbFRJMWFIckIyVnI4ZXRY
-            OE85QjZOM2R6SnBjRnlYNlZsUFVUZ2cKpdpIA9FO6aX8nSxup6OSYBRGmVAw7uUA
-            yYwMaRZTd+d/1Xec9WJI03e8oAb0u4WMbok1G3eI1FQJYU22XQ0fDg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPL2NrbFFQRWlnVnFLRXEy
+            aHk1K0VCZjVKblk3V0RKeUxLUEVianB4dmg0CmxUNVVoZ2tyUE1YQW8rSDdGOFQ4
+            TmthK0pRU01aOEtmbUNlWG03R2JyUHMKLS0tIDlMbGhKSnlsL3BUTGF0YlNjZkZx
+            K29odXpLQndrdDAvaTJRSlEzWUpSSlUKq7XBK9MV24UhTgahxVKADQCPyS23UotX
+            dPkobMY1PzIBx+yeepCicCMaFz4foX7vA6+HEtbpzqP0lqPy7N8Jmw==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age15kh7akxlx7zn00tey79rq2g8lgs4j5y77rcnyfxrxap8ckfu0a9sqvtdhh
+          recipient: age17e89ty6p0fw24daanen57wg8uald9s025t3wwxsw269svwpmgvrshfvfvt
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKS0hjSStKdW0walhuVDlQ
-            bVBkL21sVEJ5VGlEcDhsOS9IU2VOR3pmdVFZCmhjSFJac045cWNhV0IwNGRVMGxE
-            QS9KUHVIZGFQVVZwcFJmTXRSc2VadkUKLS0tIGlXUUZoZ1Q0K1pvRk9HRnM3SC9t
-            aUc3ME9IMmVteiswUzQ4dWRYTW1ZYVUKogiJ89uSOoeOVklAIox4qzsvNaOhqTIn
-            DFVVP+nUZuYyqvIhPStAt/O9UpZiBKsTi7rNuTCfzDF5yHMVqQRMtg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1TTFSVVo4R21sWmZYaHc0
+            ZmFOYnVVNzlrVVRPUXlRVGUxMFpKMzdnZkZNCllZZjVxZ1dPZm1uMzUzc0hEMHdK
+            U3NDTVlHMDVPOVVrRlVYUTZ4c0RUR1EKLS0tIFF4YTJzWE9PdWYyY3IyNjdsdnor
+            YnhtSnFvK2dPdGNTdGhMdmcrb05jamMKhO+Gdv55WhJTRr4ICOzG4lVZlxF0xZKq
+            ksmT/QIZHyZElBtCnLNTC3n4TWoJzywv0kjBLksKP9gZwmnx2TniQA==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1ehkswwz2pqaz4svzh7ela5tdnssl8kn6d4vwwxd6zwg8exfpd43syyrrjp
+          recipient: age1hrx8qj02fj2ea6d4g9vqhyj9hl7fppkjqfdx2l37py3h6pdkr95s8n8rvs
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLUGxMZnQzN3JJY2ZENy9T
-            WGlZQ1htZHRjV1E0YVp6ZE9rdHZKS3AwY2p3Ck12eGF5bEkzc2IxQzFjRFVnZTRi
-            YzZLTlQ2dk9PVjA4ZHRpNTJ4V2U0Q3cKLS0tIFBVVG5VLzdXRjY1THN3QlJMbDNM
-            bzd5eERLbVVVd1dYOVdVWEFLTWdVbTgK5GAY4iM1+xMBarDrvd/I5VPZxvJJREBd
-            pB8G7TpkwapsXeLguoSHy8rgc9smMlb0QhpARtyoBJv2bDr0nQRUcg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzM0prUHBQTDZtcmw2d1FE
+            VWlyemZKSFQ0WHJCR2s1Z1pNTDEvalQ5TzEwCnpuWGVrUzRTVCswY2laVFNJVVND
+            WDh1MnhldWx6bEI3YmZOWGs4Q0piM1EKLS0tIENOOFg1VkJQblNKTjU3NVR0SzhN
+            cFNReUk0WkllbmFiMmFaa2pzRHg3ancKZQ4dCV9UxhiILsPEupR0RX8sPVMSCtcf
+            8KnCjjer75cHlYijqnz9EvQb5ywm04qoUv35szl3Miq6RTudRohYcw==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1gl5ujmhd2pe37acd0eaar8tmnf2na28n8l28s8xct40vqpxvsdwqf49g4l
+          recipient: age1e7l8dusgmgfzd2cxrrzwepzjxt69hzqj4epee0cs27u6yg4kxcuqm34ncx
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0c0V0bTMzOGdmbnhUenJP
-            ZXZDVGh5R1pxRDBlQTlqeEpjWFE2Z2FodlFBCklxNTZtc1M2MVNRZ3p4TE5LcU5m
-            UzlEZkxwTU91VkJ5U2pkbHppSmNuY1kKLS0tIEFvVzl2bHNvVFhKSTJjU0c2YjZ6
-            UCtjRytHY2J2amdaRHlyYXJDM1JLWTAKX2hb4vJQ43uwCoSOqaofoIUCnWuDeF5t
-            ir8fkAjpvFFuCTzi5AbajCkncyFXVF7tRTFzWSoj/73FdT3yQ1696w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5Q1dQMHlXQnF5NC92WFFC
+            bjgyQXNrMmE0L1Y2TVBIV0hGQ0lKbnh2V0EwCmxpeVNWYnFxRHcvUkpmRUJ6WUV1
+            cWFGK1ZmUGNOSGYzaTg5YUNLSXA2cm8KLS0tIFk3R1FWOTRYSEtleE1yUGtKeGtX
+            T2x5YjByeUhPTndEMVlLOTVKTUxOaEEK5MzNnIZvfREU0R12PtbD0QmpLD4EtQla
+            I/+c95O2YUl9sPS/OnaMETsV2PqHhI/dl/ZSzZcCYw3yfRBjFGVdBg==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1eu65wsmez68gegnufl0gqrs0e6w2409mypjlajlq383d7l2e3pjqy5kn6v
+          recipient: age1jcx3yajjhghn8qh8za3yeu8nxykzlg3p4nrv03vnfvzl0mzayg2qmg940e
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4VjVuUDZvYThhelBRWXph
-            QmZZZkw4MFpmNWt4b0pEa1daM2NnQ0ljUXlvCmZDbkp1d1EwNDYrWXI4cDYxME96
-            OUJpR0VpM1BkMk1TRTIwOEJDaUxieDgKLS0tIHRmSlFBQWl4VEtVNm8wRGZtanFv
-            RkhyNWppNC9WZHQyajZra0lrYlUzdUEK4GRvBd6bxV5LTRMvoOXrYJJMHKUpX3Bh
-            oSmmcFkphujOhnZ839jt4XnjdYoTfQ1b/M380Sijn9xhOrHfTWqinA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPWnRuSnVrMmRpVWg3SjRJ
+            OHJ0cUZ5UU9KVnhvQ042UXYrdXJYZ3RSdVh3CmtIWHlPbjB4VXgrazc5dTNNcFRG
+            ZkY0ZUpsanN1bHp5TG4xTngyNGxVaWcKLS0tIFV1UHUyaXdpWDF0NHpGVUd5N0hi
+            MWhDVGpXeWRoeVExckI5OWpWOERvSnMKkVzGUKoOxLkT3PnQupfI6PhP/WIrUU6Z
+            7YICeH+mmTjJLaDn3ZFn0KAQKlFTeR2rejorNN7B1j/mxQmV912whw==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age17pwyghxr6lq06fw46gwqzhc9ut4paz28rpwx5pmv3cxwak6rgyjsw7lk3w
+          recipient: age1sweerhrga9yf8x6sv0apz4ed4g48rnlcq34rpv20t0rcelwgpgeqwvndzz
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByT1pPU2RGeEJ2RHFnQ2Jk
-            WnRISFk4bGRVVzNxOHZKQ3A3dlA1Rno4WTNzCjlsVXRmWk1ZbVkxaTdPTkNjZWVv
-            QUFLcTlsOW9yZkpic0VGdWtUVHJYWUkKLS0tIFFQTlg5ODBIMG43cTgycGpGQnZx
-            VEJzaWtvN2NNSHFwSkQyRC8wSGJqcHMKH+UR0NyxjXoWLR6NmiGWphSrl2CgGL3Z
-            KuIZPGGKFELe79AlH6bOxkcJ7BcYBfVKRFrLzYLfV283DteAfxGMSw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5TEZlTU9jUnRNaXZZS1lG
+            L2o3UXZrajR6R2RjdXVkZ1FHQ0FtbUMvS1c4CmMyMURXZm5KMzh3RldMMFltejRC
+            VHBFNENCOVJOMGE2T211SWdUbTBER2MKLS0tIE1FeE5kb2VrejRoekt2UEs3MWxl
+            Q0RFbGw2L3FDUUVYNzdFV05lWnRGeHMK2EKY/HQ5RCTBpsifVrjlvy6i7F431uRV
+            zUgs4U3G/KB/MG9kxQsFmlRy53YA7il0n/0NnG/s4hvb09+6gD8ZuQ==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1jukmg69cqxnjd0lp5f534jhqe65rxew2hufcmyjxa3rkw6ayef6s2ylcmy
+          recipient: age1f7usptjx9rv4rxauasve200gxtdt9jkqhhdqstlf20wvlm7u75rsjfw50m
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsNHdueS9XN20wRzMvQnoz
-            NUlKeThWSUMxQ2c2ampxbzEvQS9XSWMrdFN3Ckk4YUtVTXdzTmg3QUxjTXhubHA4
-            azVsQ21yajlteVBjUHBGanYzU2xramsKLS0tIHhBMFNvZnJRc2ROd29vZ2VmdWlI
-            UStoVitWNjUvYUpkRTc4VFkrV0FOSUkK48TGNM55gQ+MKV8YGIYclv/eMz0nAZ6R
-            ZiY0XSP/2XE06Y2f3NKBtEauCRGqgwPFt74ITjFOAwitsqIhD0N2Uw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvTVBROUlXVWNKelpIOTBW
+            WUp1OXlyemtwRjd2V2lwQUd6WmZ1ajJucGpRCmlTVzhRUjZBQ3Z5SU9IMmZGZExw
+            YXBOd25SOVIrd3JDK0RZMXJ2NGdvVDgKLS0tIDJsaU5aN0ZnQjJRRmZsbVRpN2c1
+            VUlKVUs3OEdUU2FZYlJYNzE5OWoreFEKdDFkQsdwOeQWlaODaH3ZiuOjfZioGi7x
+            elq4NKp9iS+1VgZ+3pLH5Ev9vPquBFyB1vd97Z04HBA8+S6tyR8PZQ==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1tzsrtwd3p3lrr9g7nv3z5nvmzsz54t2uc6tfqwutp6usmav83s2sck25cc
+          recipient: age17jqc66x9yeshfgd9v78mj483r4zzarqdtuxtrkxe4x5mw679gphshd94th
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYcUxHbFljWEdBdzBsdklB
-            VE1IVVNoWFV3YWUzd2RON2ladVVxUThHMXgwClpXVHZUbDV3SHJlSUlTVXhONDQr
-            aG11YXFWWk11UVRnUG1MOE5FUWRKejQKLS0tIDl2V2M4RXNGTWtIVkgxem56UnZK
-            RHZXRUZESDFPRzFhUGhJKzlvODJiMjgKN793k0tnuFcfs9PSgdmDXefZ1euAEfC6
-            DMJ4sXJgwFGX459k0sG8f64eaZrQasg//tcz07J/gRx2D3VyaC6a5g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwNGV3TnUvODN3VDdWTDZS
+            TXY0WHVUVkdPWTh0Y1V4WnJpSWRMNnhTMzFnClRJNUFLZG5vWDQ2TkxIMU1NbHF5
+            eXFWWEh6VWwxU0NjMm1vcWtYckhNTzQKLS0tIEJQT3N4dmdoZnBjN3BoNTNWRnI5
+            OUpMdzZBWTBLNzNZWmZ4dEFqdkMvbWsKZHjMAHVsl+HWUyl8G9eGWYDuaA5rH5fg
+            7tia6vmmKWaVbDtvr9ARDcLr862kvMkMWg/R2/RP0w7sm6HPvzU+4w==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1rf4kj99wuq59k7w8ar326djmgmpl9hcwlnuag07f8gauq8c3y5mqne87s4
+          recipient: age1px0h5l9zp2dww0m8fncrc82kfdmzplsfv2ltat7sna28xpg09pqqcl3s2k
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrejFCSG5VcFgzb1VwNXNL
-            VnFmVHdaNk1UcnlkRFNscVJ5RFJSbXQrL2tzCllmZ0VVZUpSLyt5UEd6aFNQcnhl
-            QnNqT1o0Y0pIQWtyVC9OMmtOOXFQK0kKLS0tIGdvV0M0dHc0Rnd6RkJ6KzlOSEg1
-            YkM3Y1lpNjdBdUxLWlMzOHFwTGJ3bVUK92lLtBdwmLeRD/I+v2h7+InJA71fr6vE
-            5+BDHs8LAAIgu37QsQKUBKVsEp/elgm73+PQkWgW0/lbHnhevIE3NQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUWk5TMVpRQ2lxWGRSU2to
+            WUFVb1JqSTBDMXpwTktoRkFORmI1cHZXQW5ZCnFYTnlBSjNCM2NRU0JtR0lmbkQx
+            aU5qRGhTbUc3aFhObElxOVdXb0xWMzAKLS0tIGtrOU1DTjZBMmUvZVBlRy9qUGJu
+            NzJPM0hpRzVRcE5TSWM4R05zU3pnUHcKjxDRS4tmcVod0Zor4yC9+ogX3/DWkdtn
+            DpJn8g6pNlE+Dyg+NYyPKhzQjZue4bpPgnknU2rvvWdfOP7dlGMa6Q==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1d0zhx7u3mfs3nktl67npey87cze4dwsfvfvgaje4rh3gwv500yssckcf6u
+          recipient: age1ufg390ydrmma849t9xfkxxl5xvdkk6mngnlzhmy7mvuaje8sgcmsmnq6l7
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaR01RUDJhOHRtMldiMWxB
-            U2tSdTExWndFUU1KUmc0M0Ivb0lFRm1NckE0CmZTWERSMVl1SGtENC9keHZGQWMz
-            bWJnSEdCRXFiMkxESEcwMmtaaXZ5UVEKLS0tIDdsdTVseEFmVE0vbTJtVWVnUkQy
-            a0FuOUdvaUc5ZCtkZHBmRGFiNXEySjAK6W065nWaOSAs5HFfKRh8Dcbs4VEClXXK
-            TyKkVcBMxsB3axT7wE7uLi3soHWqaI/tKZceqXfrDuh3m+jNHqglYQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIb2hFNFh2c3ZwcXVwbC9P
+            U1h2Z0V1Zk0wL3BmbUUyVVE4SnpTYkhCeWdRClRUdzJWL3ZqUTNxNGVxSXNSVjl1
+            NEpGWTMvM1VjNmtVQXhSL1N4R1UybVEKLS0tIDBaTmx1amtGdy8wTk5Ec0xjQ2JR
+            YTlqdWswSjVVY1FHdE9USng0bjc1bjgKFE4tvSPr+D9qTbRYsErzE78usjp3L5fl
+            NTgjL4hBQ2KNs25bQKh8LMnjR3J5upcEsvI6dvu6oHxpcjFFUBXp0g==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1jc6wx33hdhgwhk6nzy5rr8fkgmqxk9um639tk5h632nqfyaw8czskdptj9
+          recipient: age16j42pdc5dr6wnj7xayhkqdj2rny9u68fcqejs50hqq42scssh4gsnrrnlt
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKQUQ4UW1GcjNDQ3BDUjVr
-            QzZ6L2FjN3QwZzlNMTRab1prQmZHRmNZLzM0ClZER3FwcmJwc1dhbzRWYUdONFRr
-            YlZRbE9CRk41UWR5emVtY204eFRxRlEKLS0tIGFoblJ1RWtuN0d1Q0pqWVZyRStZ
-            eGg0T0tHN0llQnl0cUw2blB4OENGRm8KHvfSTxceDjVizRzXZ/5GH5NRYzK7AH1K
-            AP6/JxOP2m+wXqI2xa6kna4k0xaUOZTEo3al59UM5yTcZGlBj87Y/A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjTHhRZDFqWU1zNkpsek4w
+            QmRaSms4ZzhhRkVXQlg4allKNlU2VWVHa0hjCmNoWnVmeXJmSEQ1RzBQbXErUXV2
+            OFJERjZMK3JoaHRqNm9Sd2svYmFiUWcKLS0tIFpvY1F0M2wyRXUxYW9DdmJWOU41
+            dlk4bVFDN2ErM0doREdMY0xBQUh3NHcKZ9bBa10mawRXh7GLDD6Xt6m+E1X9i8NJ
+            mDP3no+kP0kejJ+H7WhxixhPeU7xOyQGGmmhj3OH0C/q9QORYlYASQ==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1pgykvq4pmxhhjrqupcp99fyad2uht40pt79dkzg66cfvsjy5apjqls8u68
+          recipient: age1nruncs4l0ufk7yuc4des8p99c0alfndl0lhsws8tycl5pplfp56s30af5f
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwMUIrTWx2QWtuOEFiQjhs
-            SFlLZVlJM2VTTzJhOWVWbmNkS21MbFZyWWp3Ckp4Rms3djdMWnhKVHh2aEJJN1Zw
-            N0ZhamZMYlV2djQ0ZGovNGFmVVJNb2cKLS0tIEQwcUlqM1NweWxuWHZBZE9sc21V
-            ajlqSVVEcUpvUkR0ZFQ3NmNYSjJ1b2MKc6Hj9JU+jNYNzGzzGyIRZjRVGolowl0g
-            2pXB3VEVTfuAzDTH0hXiKSw8AgJdmNzR0QziXRwgoRIlZqSFKiykow==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1bWVSOW9HOHJuOTgwZlNJ
+            dzdJRHFzdC9HV1dBaEsreDJPVUpiU1pBQnpJCllwQVRUREFOSWljU3pIVm5NLzl5
+            NEkyaUNrNlJYbHdEeWNsMzk0dVdocHcKLS0tIFJ2dmdBNmhjUnlvK1NQQUs1ZHVB
+            WGprcjRmZ2dTQmhIVTBXYXBXbEgvSjgKam4xywYDQsBGwsUKtwFUXwBFNYGQpaHU
+            D5ZGJk3hFwCTdtdmsI7PmB2AVD7HChc3RatPUtQEZg7/Ko9zeLzb5Q==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age19ht95nv8uhz2shjmakeut8mc3l5spvrcxs3thhe85an7u02r6sysyv457n
+          recipient: age1k7d2du5mejsmv5rzavm4xwgpthqvcfsehduquv28nzs53zppa3kqngfxq2
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRZkREQ3RTbDEvSm83S0tV
-            UXcydk5kaDhKdHN3UzZJZ3FlUDRLTkQxSEFNCkcyblo5N0U2Zm4rSW1KUloxUHFY
-            VlFNbDJKc2dzTEdjYU0zYXo4NW5OWGMKLS0tIFo1MDBDSlJzUVg3TzdqTU1HeVQ3
-            VVNhMnZ3bC9jQXpRR09wOGdjLzMyK2sKwBokd7Jvo2Vohzipi8vJPsbxoVWoI/MQ
-            p2K/TpeWO44A33llWVGevwo8QvGu6zR1ANgUo5b3loj553hR6l6qJw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5WnBaUktML0d1Vm92dFNS
+            dDlHNERhT1lJMUFxWFp5ZVVvNnNILzVUblNrCnEzV0w4VmRtTnhQMEVoTDFGUy9W
+            YUFQNStRem4yRGNkU2VJQjFES1o1aUkKLS0tIEpnODFzSDFlbzBwVXMwT0toT1lS
+            eExqVHlQUzdzcWJOZ2k3MFdrSVpOemMKP+aBvhLrfBd0FCeZF89hvhjXMj2UYijW
+            w4Yta4Y/8X1zHaI+FyG7+IvvAcQAXrM3MM5ZqD+VaVdiMUfxTFJhYA==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1mhaze5tgvc9lwjpml6dnp3xc292337wgm6376yh6tq4fn492ndjq9h23dq
+          recipient: age16kqfmvz4e23hmdlqresnyw69ej604s320mmd49h4hm3fhqchtgyqrws0k2
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3QzBuMWE0VGdTMCtIYjZZ
-            SEo4OWN3ZldnenNFWCs2a0VXN21CK21XWlE4ClpzWFM4dllROGJsYXRTSGhFQjFi
-            Z3JpYlBCMmh5bjJQekUycWxSanFoaTQKLS0tIGdTWDdRdU1jS0VablNSYWVjdCtm
-            K3E0Szc3Rko2aFM2b2hzR3hCcDUrS3MKk09b4/pWkp2FqQRbB/Ggf//DN2mfWHxt
-            ofR0g7o9hg19a9/t34BD1eBfoTtIWfrWTAsZsJ/4+9u3YhFfubeGDA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwbVNzTlZ5MFF6UzNmUDBu
+            T0hMMnV0QklGZmtpb0xaNGNkTExhQkVlWDNZCmJYWmMwN3hpT1Y1MnlDaHllZDNY
+            SDM0OGkzcEd1UW10VVl4eTZXcnQ5TUkKLS0tIFIvSDhFYkhvRmdNNWExMllkbGpr
+            L2hYV3FITFZyUDhackhKOERwalNmbk0K6gyoVY9p7RKLMHDA8rPrA3aCLaQJgWE3
+            9cXH6IQSxvSOqHlcj0sNr4fVL0zY25IdHtQ07Jt2QYWoIQM6lmychw==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age15me6sx0f8r58xh9v7aqrj6e99n7eu555jkpw422txpkqt4r02v0qpahlyq
+          recipient: age1arhf2q45zw6wf2uevju4savp575x3m2tfvved5zzq3ay92ynua9s3cm92c
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQNU5Va3VHazNyNElWUVU2
-            Q3NCbzVucDVsNkVSMDIyZFhuYjluR0xNV25zClBTMkdlaDN1c2pOa04wVWI1NDNk
-            RHZBK0dNWG40TkhxM1NQOHBnektJOGcKLS0tIEp1WStuSDMxejVIeTVFYzFNZ0gx
-            Y2tUdHdEb3MySm5MT3k1YjNvQnpkaDQKroAPWf5iUKvdK3dHdwBtJT/jQjgi0kCe
-            6Yuk1ZKlS+6Scf0UkIG/NR0wvebM6O+SvNIcngz/3EVAJyU5mAgwIw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1UlZpNlMzZFRSbkdrQXFk
+            RFB2MnVFMEgrVjRnV1AycWRlUHlVUmw0VEVZCmswd3M1dkZQemIzVDNheFVac000
+            QXNWcjA1a2lnSjdHZHFtQ0JyVzE1RzAKLS0tIHpWNVFqN0kvMWVJVjFVK0pvakVM
+            SWQvNU05b0JUMXU2bVpGdTRIWnBjcUUKtnJpK0MhUi+OVnqXvD9a/oNvMPH556gr
+            Xn81BdmdvILoHmPZB41Z/c/U5G1fcf+GRegL+yALOILdHaPS8w5Sfg==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1q3hu6eh3mt4saey7dc3yu04s7knnk2ygpm9xt6mg6rqtem6l0uyq4wzul5
+          recipient: age19mn8zrxl8zpps9yvrh4euquvygpp4fp8queg7xc6qhtnl4ng8c9qx02qwn
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJdFNBS2Z2SE9pQUliczFB
-            NExlWFp4ZXAxL0FabWQycVJ1eG1XRTB5RUR3CllFRFhVQjgycGxxdCtmQ21oRzly
-            T2FNSEd4R3R3MFRkYzYxSndWcGxNVmMKLS0tIGpvMExFeVFHZ2FMckoxYUhSWGVp
-            ME4xK2VSb0ZSUDBvUFA4Qm5ZeXF6bVEKLdktQF5NQUipJ7X0+d8KJiIC17i60FST
-            GYg9NR4NKk9m1fxs4UpZD26tzTtPF0MzCJjrzu2/bt2sx6sbOm/2cg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNTEljUmIxZlhJU2YzTC9S
+            Q0ZQSEprZUd3WUM5bDE2OHQ0Z1V2bmc3R2dnCnU1eFhwWHNDN3hERkh0T01oZUl1
+            RG8yYnVFUTFYVGQ0RFpxZWdQdjU0WVUKLS0tIHFoWWZRY25BWGJybSs0ODJzN1Y0
+            dDJWMlRWVGdIQnovdit0Nlo2LzIzbk0KoNio+gOJ4SJHxBKA7t1v9DD5UTNoJGu6
+            x1/qXwh3SLFk8sirYewwY0FA8Z6XE7qq0DBTL4OjU/5IKYNOVW6Xsg==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1tczst3x7thwtcz4vce4rg6kmlsszzm6j45kn2nv860z9wa93a92s05ppmc
+          recipient: age1jlltcv5jcnm40z5k0q6hv053k2rqpqvemtuecdwn527uw8uqz4es3x7m68
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOU2ROSjNDN0lOamZHYjAw
+            d2tKL3RFRmtHKzNuQ1VXNUNZY3E5K1R3blU4Cm9QMng2OXFtWHYwRUxieFFHK0ox
+            cWRzdmFOOENyRnB1Y2NoRUo2UGkvZTQKLS0tIFU4b2hoeExBV0xLemxIWlpURkNa
+            N0VHMmtBT3JPZXF2QVFyUE51NjhWa2MKGCZK5saQ0RdbTUx+itnFTMKNj4VE59H6
+            FDGOVdWRne+1PA97Um1oNlYuoaUuyCtwCfOwz2iEi4RGTVPpK4ntyA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ug787sgt6st6k82fgkrug2lzltw4qsukrrqqs3w27ewwqj8rg4hsxcmylz
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzVWRoYUVtY2hWMHZtYlpO
+            b3JSSFIraEZXRGd3YnZGc25VenhlYlg3R0JzCkY5Mkh5WlVuQnVSZ0trakgvTGhN
+            TWVVK0R5WG9HWlJ0NWNPTGtDTFlNd1EKLS0tIGhKdG9hT29qWlcvL0UwL1BOcFIz
+            OGpjWTZDRzROclo3a2toUFhBRnhscDAKYnwkQ4H9b1BdFNgG2pIl9Xo7skpn5+HF
+            BJB7wfYi6IoDbj1gfyFf1NmOB2gX07xfRcmIGfkq+I2/cHMhsXTMIQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1529taqdwr6t0w7cvzmty0d5y5593wffl0krt48j6uc4u39k56g2qf6ywtp
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5eXFZUy85UlY5WW1qdktj
+            ekp5WTBFMjBLT2hMSVlzK1JGYno1bXd5TlNFCll5S2lqSXB3QTFYVm5hdmFUVDUz
+            TFVGNjh6VWJzTkR4TVhuK1JSaFhrVUEKLS0tIEp1SkFYR2lJS0VDSUw5bXRRTXht
+            QS9DaGs3SnRHZHUxREtmZm9TRThRNWMKCsbgErz3ulxAasQ6IfmWwWDTS33RSFJv
+            WiizvgQmjpWx8JFDyxS+eNeU0KQMf8TdI7D05f2ajkao+A7YmIAGNA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zhfyuzlq40reuqlr34gf77852nhs3t6mqfzrqmas8z6sxk7tcfhsungrm0
    lastmodified: "2026-07-23T21:15:41Z"
    mac: ENC[AES256_GCM,data:qFhnPra6IE3wyKQ4WKweON0S0YtD5I0adGZVfA0m6BVilN6bX5oC/1j5NK2oHrsz920hSl0SOF8LrpqOrUyGjSRkPsN4kq8qr9bJcrX4URiktP0oRden5LLt6hf+ZRP7WmRXFqixPkPHJnZIoAvkNnTFce7cDq5NEAHkKUEKG7k=,iv:nyblUDGeu3TUfFivYylOn3C/HITj99qiPI2+mh8AGh4=,tag:FrtRzSCylC4wlIoqZdfx7w==,type:str]
    unencrypted_suffix: _unencrypted
@@ -3,49 +3,49 @@ sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvMGJzZjVoandxc1FCaDR6
-            Z0hKTVFYRU9JMzA5djk1V3VBZjBETDJDS2xBCnZaRTkzTGg5OVBwckw0cXA4bzFi
-            OHJpdHFwRFBGbXZCbzUrKytGTGx2S2sKLS0tIGNSdW1rQmdOL2lpek91N051L3gz
-            K0duYnF5RlE3cmNXUVN3V0hLM0lUWlUKRYmIfAAfGCJOFwlimYk6bAvIKLokKufR
-            OYnDcUZuPlj9cx/FJNC+7/K7WWmfrpEEeNOVzv7JdTDLjWBslTCWGQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoVjNIOHJseTl6WDBzMDds
+            RGJqdTlyaWV1UUY2V1cvUkN6dUxTam1yUWtrCjBwQ25kZ2RVTTRwenlzQmZaM2hR
+            Ums4Z1NueFEzcXk1YmFjNHhVZTNHZUEKLS0tIDl2aVJlNk5jeG1wT3FMTnNvNU51
+            bVhFd3NTbWJLdDZzUDB6bkJnYkpUUWcKnz6lOojAEcROmGNLXGc+DWfaRLWFMS6g
+            V2Kx+Ouhojx5anoE0ZkFs+7iVEvCX+oe5LOeqzxoXUFEMBldu3AKhQ==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGNHJPODlpaHpIRFNVUlhF
-            WTJsdjB6Rmd6RlEvdDVXckduUkwxUGhVOFF3CkVJMXYzUVRkVjV0VVkzbGc1UlUr
-            VVVXU0wwYkpzU2pZdmlpaVB3enZ1djAKLS0tIGdkeFVrYkdzM1ZNdElJamhpajFp
-            YVZuVCtqUW95R3VHTlBadVoyZUZvNU0K/AtAp1bZ3QXKcVChHfMZVI9AHzTktXIB
-            JNAPKJAxQycMOYPNFklyslOj+oKmvKm5AdXx4XPYW5qOK4k2HMDIQw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhR3lVVldmZnJTWEFpZDVn
+            c29IVGttK1pvdXlaWVRIU2kwaGNIejJLc0hFCmsybnRia0oyRUZTcHg2V1BCeHg2
+            RUszSVN5dDlqVEhybFpBME1ramNKWWcKLS0tIHkyMDV1Z0V6ZzFyMlN4dDhjNVBp
+            Ylo3OXBIM2VOUGc0eTdJNGtYUFhLRmcKy55/uTFdjQflrDfGU8o0B6i+eF9gmaoN
+            TR47KGtDk3PNE7M+H8YLTEYGEypoP5Rtiwy778HaOQkLlturEJ3qhg==
            -----END AGE ENCRYPTED FILE-----
          recipient: age190htw7prp4vln076dxjx3gxxaq06h0zl0te7cqgpx79vl3lhkaes8suy05
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0a0dPSmdFbFRjQk1OWWNo
-            Q09VSHhmNlUrVjVXQzcrdi9hVklnRjliWG5vCjJ3bVRUNWdPV3d6STEzcjFxZVQr
-            MXZvdEVOVTlkWEVVNFV5UkUzWThSc2MKLS0tIGIwR1dNMnI3dlIxQ1d6NjhxZ3Vk
-            a1N5aHQvUU5PSEgwVlprcUNEeVorVGsKmmdhYnpOqk3x+5P0h4AfGJco1PGLmAtS
-            67hvtBQo1KSTwFyaYQUByfiTwIeMSu50SxvLi56ogT24CNADW6FjUQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzZFZjZVI3QkVjQ0FjWlAx
+            VDhCOG5lcVUvQkhkdFRPZDY3aUpDRWppWUN3CmEzQVBBVFhzNVN0VVRTdXFVS2wz
+            cXJiTE1MN0krY0FvZ3crL0kwWWtRREUKLS0tIGtkWXdMVC9MRVpJM3ZVK3M4SElZ
+            OWwzbDMyd2c3WllxZUtGTHRBQ3FsbDAKkFlJVvJxaqc41fG2NXEkf2ZWmwxPqvrt
+            zqr1xc5kn846G+VF97U4Ei3Kpe6TgSYc3evmZDsV6ajINM0Xi+3JKA==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1ehkswwz2pqaz4svzh7ela5tdnssl8kn6d4vwwxd6zwg8exfpd43syyrrjp
+          recipient: age1adur9g330gua4l6ndk8cqjg35qc8yxwgme6wrl2hpylcc7vxm38q05ejuy
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTTXYwS0dXUEI2WjRhZHNp
-            Qzd5STdlWUNFTG04UEdySUhSODF2NklvNVhrCkxFd1pVSjRmb0hPaFpyWCtoQi9K
-            eHVBcUU0amt3K1BONnV5Vnc2Z0JoazQKLS0tIGFrL0I5SjJYYThUS0Y0VVlraW9x
-            Z1VLT1hpNWswd3FsWWVGRTkrNkJOZG8KY74xa+6Pfc9lpupTodTBa1hqIrotE2Gu
-            H5+0g5D9838zxf/p7pzxh7rE7eo2gd9JT9bW2I4Pwn257Omblsyv1A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOZ0NJN1MyekRaNk56V2t0
+            enNBUVpVYnZjVm1nSnBhTithcXdKVE9VclRvCkZkbDVFNnVnSzhWWmdPQURqdFpC
+            MTJHcVJmSFBpRDVmbExGNVJuQWQzZTgKLS0tIEhjYVRkb0FWWnd0QWFCQUZLSnp4
+            RVpVWU9kNlZjajVxNk13V1k1UUNzV2MKVglPgF8juRhUfN4/MI6E9Z/yONCjUkzO
+            dCH6rY3eZh3EQm2F0XJpfsXSRw8bT4fEm5LCqAtTjdMLrgEWoPh4EQ==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age17pwyghxr6lq06fw46gwqzhc9ut4paz28rpwx5pmv3cxwak6rgyjsw7lk3w
+          recipient: age1hrx8qj02fj2ea6d4g9vqhyj9hl7fppkjqfdx2l37py3h6pdkr95s8n8rvs
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpUExNcmw2S3hSKytvMVQr
-            ZGJkVStyVjgvTURPSTRyMXZkdjdpRnhQZFV3CkVtQzBsUjFlRjNsc2dwU0R4UnlL
-            YkhtZWVNSW5zWkhJM0NwOUpkVlJGQVUKLS0tIEJiTWxQT0dPeUI0TTIvRys0Sk9s
-            RDFmcjZ6UGkrbWlFb1h0bmdRUlQwT28KK5vH6Svg8lFUKqXSzweb9405B0Z91TaW
-            65G51im23qSOeD+NLBHP+nqIwYrjDlODrgOeW9Up/9rE5rLgFfjoOw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUQVJhUjBFUURMUEtWNzV1
+            YVJrYnFFY3JyUnJtV2ZadGxBOWkzY28zK2tRCnJRck9UV0RjYmxUcEUreGVyaEd3
+            aU5td2ltRUZ0UjZqRm43YXlYSDV3SGsKLS0tIDArcTZZTXI4ZXJWZzdBL0dsN3Vk
+            U3lXWnRTaVJIVzl3NWw0dE1VMWEwbXMKUEgFevlDaV2GwzHfoFDjts6DXIQd76tF
+            RekC7ZRIzd3b0/6+oDv02Now7Fj+r5NuBrmwu7H4PYvF1gYtZ4eIPw==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1mhaze5tgvc9lwjpml6dnp3xc292337wgm6376yh6tq4fn492ndjq9h23dq
+          recipient: age19mn8zrxl8zpps9yvrh4euquvygpp4fp8queg7xc6qhtnl4ng8c9qx02qwn
    lastmodified: "2026-07-22T01:15:21Z"
    mac: ENC[AES256_GCM,data:dC/oIqMUHkOh3AocOwP7Gc6XGH3L+nTqJfhFNts1DNbRXsopNIxVBtIz2pEhwnWSQrqPisDLmPHFBwRpGVn01u8w8IU1FKbAKC0J2nJXF8ozpInbjzDOmehqPWZG7yaKoq8cwAnp5XOk+IVO4l6tPxLxkExU5fT2ALuMq+sgOko=,iv:jaVyArpf6zMCFa6J9X1aQMGrmFq+W2CPZdWO6vVW68c=,tag:S+qF8/FkgHc4uW0e4ICmSQ==,type:str]
    unencrypted_suffix: _unencrypted
@@ -4,49 +4,40 @@ sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYcFFSVFVxOWp2dCtEVzg4
-            VFF3Mk94Q0xVSDZNL1lBSXBKNzVXaU05TnlzCnhueTd1ek1BZ1JpZUMwM3ZBUHFh
-            UVFKZjduZUpUejJ0enBXK0pwMjZKSDQKLS0tIHJ1Mi9OQThrWndiWFE3WTRJREJN
-            Z2E5WTI5dzB3WDFtaFRoUERZa3N6TDQKy2FK57wDNLSPl2/L/FUBUP8rJZuAOqAR
-            I0hBe4epAKL28PlJ4M9P77qqg893beZK3UIJQ5O6d5fGPMNTJiIzAg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwMklZTFJuR3NYbkFvV0l0
+            eUhMWU4vMHpnN1NKVThuVVdiOFpkZW9rTjBVCjJabWkvOFpOSm1hdEdlZTYxc3BP
+            WkRURDFEQzMvRFlka1VnaU9zRjhiSEkKLS0tIHZXRG9GaE5iVjg3M3I0SzhtN0JP
+            UlJVUzRzN3NEZWxXZHJ6RW1oYWwxS2MKonnhq7YDg4v93PZtoaLANDy8mdRCenjo
+            FjRUzozMLpgWBll4DwRWikejsrRofRBwlcsiIdrBr90f8Lr9pHdQ/Q==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoaEZ5clpxV0ZQWmhSckxY
-            a3I5djhISUphMmV1RU9DREJsZFpDdktyaUJzClBQSUNvN054aXp4SzNkMmNqNVhP
-            QUdnUEppMmdENzUraHAyRVJLWm95V00KLS0tIHZuVXh4SkdhVU05YzV6VlI2c2RS
-            SWttRW9nS29MM0lJT2x0QS9rVU4yb2cKYZ1gts1qRFdod8PFWl6Tg0Ry0sXhKMrP
-            VwttGQj0iDg6UudB+qa2ngFgAc0C++OJebuLMFnK1K+PvUpfw2nRQg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsWDJQYzM5Z1JRT3FlVkJy
+            TkVaSXdzanYwbnpOM1d2RFh0c2NaSUFmdW1ZCit4SVFxSS9HNXhVM2gveERGVS81
+            NVFQaUV2RGR5Q3kyUTQ5eEpDVXJVMWcKLS0tIHdHSy9WM0o3Q0o1THhXZW11K2Vp
+            NTNtSGM2UDFuWDBEdS9tbTY1ZWt6UlUK8z5qoi0kGn0ES3m9khummuU51rkR0Sb9
+            TWT92+BWvPdNrAsDFjv0fgpUKyTMzN72EzHZKAJCIM3crUG9I0tX2g==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
+          recipient: age1jcx3yajjhghn8qh8za3yeu8nxykzlg3p4nrv03vnfvzl0mzayg2qmg940e
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKNXBOeS9od1lBd0VGSDRX
-            RE5BM3g0Zk53ZzBhdW9XUFhscmpHdEV1aG1vCnU0OGZZdENBdHd0Tzd5b05BR3RR
-            ZGNZRlVSVk41YzgyRnlHK1NUaXhqZVUKLS0tIGFKcWF3VGdibldnMndmSis5Skc5
-            aEZJVGh1UDFVUldrRndVZURGbVJMUXMKia/z+zwpfcaILCt4fpy7wsR0QkFKf07d
-            QwkV+gEfM3EydhcA7invDieIKbcOUoKKgOmf2sXMgW07CsjG1QXk6w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpY3o4SEpwZEdFQmVnOTVV
+            d2NqL0VudHM4VjdDK1N4dWdlS0lGR1V6a0c0CmJUTHlsbEMwaEU0Kzdaa21lRFRm
+            RTRnTUlGUG9GQVB4U2pzTHdRY09udkEKLS0tIGlFQW9Wd0N5WFg2WUpCQzhWUm5v
+            aG1VVWV5ajBmc2o4ckgyQWpWaFVxVmcKisAw40bGQBRH+u6uNygfYpfb7iEgfEHj
+            E+g9n2WeVH8kUzD2O1o6VAu4m/SVuI4+IQ77j9GEWmlI/wgp8wKXgQ==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1xjst4frdh0th6q8m7p7u9g5af7ty5jqeum0p6z8a52a9q7st7ewqw8yl9j
+          recipient: age1ufg390ydrmma849t9xfkxxl5xvdkk6mngnlzhmy7mvuaje8sgcmsmnq6l7
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpcTJHRy9CZlVWcERMRzlL
-            MVFyVHlRT1hnQTBsSlBYOWtoSzVyejJIM0RzCmFKM3J5cE1BejhHYVl0VzNTSXdj
-            dENsTCtJT0JFT3I0eGJtOFMvdjFmTm8KLS0tIE1zSmhBMjNnelQrdkJ3eVR6SFo1
-            QXJtMVRuS1daOU53dmxGdFIwN0ZOVW8KS0XIDkbp+1W+wUDHkaKXZ84QpcO0zK54
-            FrMzkChowtm/a+RSLVadBGDQv2R4gV89NArP/YAEQa7GK9aHvDlH/g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1elpNZXVJbmJWSU85aUV6
+            NG9YTWVBeWxiRHUveStTQnl4NC8rT2VNdHpNCldxZVJYNVhUR2V3Vk41VnJxenVT
+            WS9rRWlKcGpVdVJPakkwUTY2a2xQTlkKLS0tIFhFVTRucFNuS0pMK0FNRk1ndnFO
+            SlVvakczaktUa2VLY3RLYUdVRzFyamcKIhctg0mbYL7OE08dRwj5wMu2x+O8/BMu
+            IqA477+noQ/Rjrszb2hEvxID7keogcDUWMWQzQvdMc22+3mvAr9qIg==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1tzsrtwd3p3lrr9g7nv3z5nvmzsz54t2uc6tfqwutp6usmav83s2sck25cc
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2bnJZUFVVRTBrZExoSWJV
-            NDI2WUluaWJHVVdiR1JBUjhJT0owaTNoL1JBCjh2Y3ZvZXYrSE4raGtrcXVZai9L
-            cUFERVRvMEZPaC9oa01NSHR1ejBIdk0KLS0tIG5ZNmZqZWZxKzd4c2pYOEhwa0li
-            NDRQV1hDZ3ZwZksyTUtjcEVGWVpFMTgKmpLn5Ov03MKITQ7QihjK4GsYlHQiAFAc
-            pI7z78qQv34e7DLLJotxbeWYyX/IOe+DvUm9T8NGY4ujI2y3HjXPlQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age15me6sx0f8r58xh9v7aqrj6e99n7eu555jkpw422txpkqt4r02v0qpahlyq
+          recipient: age1jlltcv5jcnm40z5k0q6hv053k2rqpqvemtuecdwn527uw8uqz4es3x7m68
    lastmodified: "2026-07-19T23:30:21Z"
    mac: ENC[AES256_GCM,data:kLGE2xawQT7mx+sfw68hmGk5nCEGiEjZrqTEl9B1dtQmTrMwmoVr/1RISi4LfJrwxy31mDgff4lcIL4wIJuM373uk3X8j4RNyYQNTfKEkORT6r8NHeepNs267O77pKGd7OmcM4MT/BqOnB8ELS7Wlf2ect7CAlvUUVyc8icxgZE=,iv:EYLDsHYHZ1XOQXafOTqHHWpk/OBNq/R6IJnOBYV33E4=,tag:thxrCPC5oGvDjhK7Dz87YA==,type:str]
    unencrypted_suffix: _unencrypted
@@ -3,58 +3,40 @@ sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwbWFOSlB0ckJFc2hiQTlh
-            eEo1NzZSTWovRXNnTGJDWTVZRUsvbjQ2NGx3CithSDVSbFpCYW9KQjJndzR3aVlL
-            MHBDRmQxSEpTZ1FsRXFWQlE2aFc1VGsKLS0tIDc5bmI4WWtvcStZVk5WNDhva1dk
-            cEVKM2ZCTGdLM2NEbmRudk1SdDNzMTAKB6QCrxxNzazSbif28j6RNIfdfUTKxklM
-            Xip5xoLjTRNOjq561OS34gaMA1GE27YQqsqtgiU15i7SZ7IGefWpZQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZeDQyNFh3dm1YZ2FTMjdK
+            cDBWcDE2a1c1S0s1enhWRnVuMlVJc0gyTXk0CmxWNkRJMDhkeGpRTGltaitnVkZS
+            a3Q5TW4zYm5Ja2FETEhJcGF0N2ZKbmcKLS0tIDN0a1FqRGNOY3Y1UWxvUU8zWU1m
+            bE9DVzZESG1HTEhVWUdJOTF0bDhRVGcKP6OoyDAGLB9jQ69jpFyho5eaeK9XtZgN
+            RlSJpBm2Jo19h/crpH9AWXUAIG0BWueyr8mwBu12cQdFIU3IyZT6gg==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2MDVmZGp0bEpwZWRLZFFM
-            ckY1eERsSHFuMnhPK3J0eFRLY3lHYnlEK0NnCmNhQjlnUTNFOVF0UVBLendHYmdx
-            aXVIa2hmNENUNGdZL2FmbTlNekd5NUkKLS0tIDdwbmFGZVFlaG94UEgvOUNxdVlz
-            VHJZenplYVVPa2NUSUFWeEN5bGQ1MkUKT5CqEiCN61aOpvMlBp0effS3bh345E7u
-            wfxrMwMhrEzfnmpkvcafLCn9PMicqLuz48J9ipF5IHLf7MIvbT31ow==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwRVFQcHpkQkNlSDhhM1Zp
+            bUZyOFduQXg1cDd6ZlNObFgzL2hmUmJhM1JFCnprMldPQXJNVW10dVRqQTdWcGlv
+            RnBYWWFsaVNrMkJpS0pkOGlQQzlJVVUKLS0tIFNsMEEwZTREZ1lwWFJGdE5YSVVU
+            ZEZ1bVpFMEQ5N0g0L2RacUpLMWQrVDQKxPzq6f960purgAmUJw6IZnZSnhkzNE8r
+            CSrFDowKTZI2KRdCtQ5fGhEoWO0ZPgVNxYV0KH7JBttylcpRLm6r5w==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
+          recipient: age1sweerhrga9yf8x6sv0apz4ed4g48rnlcq34rpv20t0rcelwgpgeqwvndzz
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPS05tWG41Z3BwREhxUVRY
-            ZVBMQjhxRDNwUDBjVE1jNnlVOWZtcE81Smk0CnlHaEl2OTd2UnJhWmlHNmY2V3NQ
-            SUJKakZOZkdXeFhnZTF6dmxzTGFzZjAKLS0tIFhwKy84Z0l3cEhSQ0NBbVJIKytM
-            QzhxbTY0SkdkOWN5VDU2d0dTMzlGN00KtgobQ2hsilZnvoq/BesaM/RcYbVNHxSh
-            vEA80nUhyEdRim8WP/yu5KrgHsEVQ9ryclU4B49F1pINdAVaGRo9LA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0czVoT3ZyYTZhOEQ3RWtR
+            bVl1MW5vNERxUEpmNXV0MGVBRE9ySnBjT3pzCkM2aUVpZjg0SkNVTnRRMlhyMTN6
+            NlFrZDVKV09Yc0tuKzFzR0ZtQ2t6WkkKLS0tIG1mbUNFdHBycS9UOGc2cjNpeHVm
+            NUd1NThRQlZXeG1WbmR5Y3pTYXRKc3MKwSnE+0bGmxOAQUje6jHxuzIIyD6ZAwVz
+            b5AAYwbGRagKj6fimsHBUmi4ohyG1huIGGOU8HiUYpu4PGJgOscztg==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1ukpqxzl44mnjpy5r96sfuc5sqzm47u4k8ujjh5qdgy6jvl9uqgpspymqfk
+          recipient: age1nruncs4l0ufk7yuc4des8p99c0alfndl0lhsws8tycl5pplfp56s30af5f
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5NUxUMHdrbzl0OEl2RXoy
-            S1ovL05lTXhSNXBXZEtWU2hsdXhBZHlqc21rCnY0a1Z4QXZnTnJyTDR0WVgyYk5m
-            cHJJZkhoM2lNaG51TmY3K0hZeXZKM1kKLS0tIGU2MmV1TTFTY3QyQVNEb2ZxYmlU
-            c1doTkVLZEhKeDJTWmtLWjIrclRUenMKRem1nKPK/ghuipzOLTf6V3Ke5LK5S6LW
-            5ExYf7y++FC90IqkAqeIA67l2KihcPE0DqnBmwrDlNgL5tXyhYV39g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlVGRDMWNDZUR6c1VpUjRK
+            WDY3L2lNcWFFcm1UV3RPMjlqYnBGVEJLcFFzCjFxck4wdlp0Wmtzc1RKNS82MXpK
+            ZHBzOGhkc3ZuZUE2UmpUSTgycWdLSGMKLS0tIFUyYjczeUFWU2FyMlBTdzAxMTBE
+            VzhaVzlSL05nZzNmR0ZjNEFPTXYycHcKfiJ0KjdxtLWsXxsWKzAL+H3hYYjHrYO9
+            BjKknq1ZQJM0sB/Tid+GLqDwKi966MQK+AwHF5MqbsHW7eE5bO1nwg==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age15kh7akxlx7zn00tey79rq2g8lgs4j5y77rcnyfxrxap8ckfu0a9sqvtdhh
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvZkxwdUhOU3diRVFjSkhH
-            SmFDbjYzblFUZ2NLRmpiVGxuUGVrWC9BWERZCkl6MVJ0M3dvNGU0UmQ5Nm1VWmRm
-            ckVjSENWb05qMWtLQzNJd0tUWmgydWsKLS0tICtydnQyUXluWmxwWVpQWVRqOW9L
-            VjhoelJCZjM4aHh4UG0wcUJMSVFGbncK6B1Rou2axRoRQNXudD6BVq5buz9MJapB
-            vYMEhQPVCU2SinltqIrgd00qjgE7+oPnGr5pTFSQisJLlN3X1LUbhQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1rf4kj99wuq59k7w8ar326djmgmpl9hcwlnuag07f8gauq8c3y5mqne87s4
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvV0E2MnpDZzNkbC9DNGZ4
-            U1JLQ3J3ZHo2cEpraFlSdTA0V01wdlNaMkE0CjQ0SDBXT2tYU2VmZjNja0M0VG5K
-            Z1FkVWhYODVDNkhBR0o1NW43SjZRZW8KLS0tIEtrMFI0YjZIQzd5bHVMSmRSWi83
-            U20zMkg2UWpEclMxalNhMThlWXdhaDQKX6qsiRZqlFVhq5lP5B/XVqStq8Impvx9
-            MTmVRuMzFQ5qTs4BjhIqO25Ez+CI2GAq2K10prdSEin69gSTxntkIg==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1jc6wx33hdhgwhk6nzy5rr8fkgmqxk9um639tk5h632nqfyaw8czskdptj9
+          recipient: age1529taqdwr6t0w7cvzmty0d5y5593wffl0krt48j6uc4u39k56g2qf6ywtp
    lastmodified: "2026-07-19T02:30:40Z"
    mac: ENC[AES256_GCM,data:rKHZjU/MH08ASTlu32HZO9uWmsBYuMCEC6M8gwVhzuWvmablnP05tS2z13XfaWaCEUXk6kmGJKuU0zu5+IKVZgamCF6DAMtxQb6bVCaLsoAm/GSqWQ5VI9eHqgnSSdN/o3ul/33Rf8iBQo4aw8FFAmDVuNz8bfAn0QefFTj0ByI=,iv:JD2gtqRinOY77etg6PUmZNovkYl1Q3F6ZvRi4x7RznQ=,tag:/5IMpWKRVt+l1luCTQE0BA==,type:str]
    unencrypted_suffix: _unencrypted
@@ -3,22 +3,22 @@ sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5QVJmWlBlNmFTQ2RUaWdI
-            amdKLzdRVVdxdW5ROU9CRldKanU5QXkzc3hZClBGRWp5ajNFWWcrdlJaM2hEK1B0
-            emllQ2JLSkZFMG03WjNvQkc3RThrUlkKLS0tIElnR0tZVTlvTk00OGhrZUorUGJo
-            RGYraGU1dUg4SGJGcnVqdklINTdNbHcKeAotrwsYxsE4ktOzUgEaIibRprGf7pXQ
-            5GttilLcmfQNBeaA8z870impTdj6EZfUVItwaIzhN0dG9TcK7oJBoA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJL25EUUZack1FMzlnMmdk
+            Z1hnejZRNnMwVHpmWkFNdGcyeHVsNnRsSGtZCk9OdDhhcnR1WW9ZMEZ1OUVYbm1n
+            RmZRVy8wb1J3emJBK3Rrd1d4U1dYUDAKLS0tIGJaaElvSk1sOTBOM0lKck16OUtu
+            NnRZb3U0ZndmaHBZTm8zczhWdE1oaEUKkf6fLomAHoKPhuM4e9q96YmmH+h4VrEj
+            2x0rnwBwOoRzYWutB2MVtlsphAZmZ/PK0tEecT2MM0XXayVG/33qdg==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHbFY4WVp6OVNydnJ4eFc4
-            OEFDTzBTSzlVQkh5Vko4Rk80VURHSjlqbzBBCnRJNTJZRUNPaGNVUm9FV0ptdjVD
-            d3RUV3l2VERUMXhZVGRXRmsyR05lQk0KLS0tIC9RM052SHRrVjdyZkRhMk04RWI4
-            UHVxYXp5N0NKaCtmZ291MjNNakFwb1kKB3RlWa0adUCgaIUxGaN8Uzwkak7EtmX2
-            rBnOkujIVWMy9KHPltZtfRAQrY7nS2njhK1hFfTSomqdoJMFgH/iCQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpeEJvaHl4akc1TFdEVGV2
+            czg3OVprU3p4ejNpTktXZEpneDgrOEhrZGlZCmJwT1dhSkZneHE5UmR0WTd5UENq
+            VHJEWG1EekJLY2pRZldtVGtxTHlGaGMKLS0tIEYrWHE0WTgyUlIwdktmNzNIS3FW
+            ZVRvT1dHa1Vzc2RSakVISzdMTlpnVGsKeT+edn4+LUkVtpRUNd/gKX3H1HG2bvNo
+            c8iI6qr/l6oxfP85OrKYFDU9IGvDMxSSdbixHtojPEb5OKVurV0WPQ==
            -----END AGE ENCRYPTED FILE-----
-          recipient: age1gl5ujmhd2pe37acd0eaar8tmnf2na28n8l28s8xct40vqpxvsdwqf49g4l
+          recipient: age16kqfmvz4e23hmdlqresnyw69ej604s320mmd49h4hm3fhqchtgyqrws0k2
    lastmodified: "2026-07-23T23:32:57Z"
    mac: ENC[AES256_GCM,data:l9a/yNRoxY1hvSkLuR4N7deeKue/1JPlSvZvJfCSNbQ21p1qR433BbSDYvfW+kXQXS8GVcfgXSd9ywNzgVvkA5lR1++uYsZBLbYxJ+s3TKWs6/yECAZ0eM1KBA0BEm7cLSsHTOwd+2WspvmCYir++FDO9XRuS3guiMnQBglDf/E=,iv:eE6GVqexQNSiLYfmTTUdUx5AO//wyjSIsr96xAX1pcI=,tag:CNsoyDZYLUt5Seu7W5wJrw==,type:str]
    unencrypted_suffix: _unencrypted
@@ -26,7 +26,7 @@
  # fresh client that has never manually ssh'd to nix-cache before. Update
  # this if nix-cache's host key is ever rotated or the host is rebuilt
  # from scratch.
-  nixCacheHostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPeWgMsdaiz4axT/deFc1+0B5bN+GX/NOeW9bbQ0c/IT lxc-nix-cache";
+  nixCacheHostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICuHUxGNH6ei3BZD+EfZs3l4X8uJNcjQiOsM/G4yo4O/ lxc-nix-cache";

  # Public keys authorized to SSH in as remoteBuilderUser on the nix-cache
  # host (modules/nix-cache/server.nix) — one per client host that's allowed
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICuHUxGNH6ei3BZD+EfZs3l4X8uJNcjQiOsM/G4yo4O/ lxc-nix-cache
@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:nm1TQswDfqLgzwOZTpllM96/nqW1xyOoUmbmxL3kEbygnU9kKruuijhoLMSigti8Cgb4onyI3OFkOaNnBShGaXsrFHwIH4rwd4CRv4mHLFTqs/hTXxMxo98gKdhJYuCLXOOdhWrOfOO0GofmxLEX12AUhjS/cxtJWXqINIbmOzPm0rHVVx56r6kj1MojGssV3y68gbioSF1StGG+OIQIXL1LRBWknyTJ+NK3aViXn7oBglHzL9D74Lz5v8iFQQroZ4sBPi+ov0CKAFaghRxl7T7jGA9pO354ZbLdiGmpqtYFazCGq21hwjpWyobAog/Iidngm9Mz0wleB1pEpkCaEpUsjVYQkAoknITasCGhwpmFH0F9v8Du87rJ4jdWT3W8qh3uPlCHw7e5QwQYE/I9v1HU6Au+liQJWeAbbwt9wRC5NMETCqH1PDDpRjt19Le2ECXjstBRR4b9wQQkeDefgcFibQK156/i2twhAqIgz+RqIZ05aQYfy8Kfj3c7G34PEdOdz1P3bsAgISVpgMQO,iv:Cth8/Wlf7vJo050aDNt1XyFUDiihyuMxv6WH3yEZGXM=,tag:qM1/MVU3J2Kso8w0fzEvIQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqWFF4ekdNRG05bysxMGRz\nbkt0QmRKT2hsUzZWVXRxY0ZjenRXMXhrT1JNClE4WlRmU0grRG5BSjM5NWZwc1o0\nSFJ3dGRsR0pwYlJhRkV4MjJqNVFWL2MKLS0tIFBSVTU5aFVZNm5qZGtIU05XbDd1\neTd5Y1puYjBkKzlVRDVvaW9pL1B0R28KZbutmxm33H8qOE0jSDr+mrx6nFESmKLg\nTfjZBp1W0SDRVJfUbRQJvcp1ECMJIS5cWzXDoXmLnaeLFzawBPbIeQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad"
+			}
+		],
+		"lastmodified": "2026-07-25T11:10:21Z",
+		"mac": "ENC[AES256_GCM,data:IQ/XcH2boEt97exSgTUxuZwH+IwFHA0ota3Y15T9DP3tpN/Tvp4zWOqHYtiPfRf/Ea8Si/LDHwlVnuLIhFYtrMmTzJjKf8Xa+eN2bACzn1BAGKKkY1uQH2tIJ1HIxC08x0L7YhkGPVNMFcu2FsNB0bk57+iwUb/w5p4m5O4AZ6Q=,iv:/BkRQEGvUImCewxsfrpV+EYZVnfRlIChASpBXBAtppA=,tag:DAkApHsRza9DXOnKhhVNNA==,type:str]",
+		"version": "3.13.2"
+	}
+}
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOAzES7wlgL7gIyxOHbmwhzI8SJ5uMSEd26u+ek6knVh lxc-tor-relay
@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:Gx0ZxQ4OZUKUDFEPYjOEgTERHOFDYO+O36qA6h7+wp6G3ld4hTs4NhODdeCpz3xq7/EZ09Jej/ZZriIhiTUp7IjDIjR+hOsIWW7XQNUqBDfq/nO2Fz6nOd7ph1fgQfaSUvmUBo5qr68VmDs6ArnkDJ5TFNTwqypC9Ou/HXvKEvqfG+XjL8FT05ZG3iTqH68O73DlBhePhVuWby/8txyCL+fz9pXaqyFIGxmsMDE3d0Itveyi/bReOnf4g6UvCjnrA1nMpTB3rQLzVF0TvxfTv9XfaeV3On6eu8M+qUk9fqv0ytKS6+IcozuCax5kLMIGz7Y4kbw+yolgotWaM33Wu+e+UAZMHSksWAJAI/zqxHwRcyY5uEH8DJdqz6EtA06Yssup89iqMA4Nz88l+LpZ+1BPeY6PlhbubP+X1x34mbDixO8EguuUG908vd2jKi8f7GtYzDXm3ECN1iodiAXVJZ3TEGfYPfhvH6p9kSkwS9Jug1GVP5pDaPPkwvtsLjq2fV0HB/4qJQAkVJmwRz2L,iv:3sN+t1HvduJjlj+l0Jp9jqWIh0q1bwz4WiPPDLXyNzg=,tag:Qk3P3xoHoOhYQL3xzmJpaw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBETjR1YzVoaUtGTlo4QnUv\nbVE4ZXZmMmJ4ZzFhcXlaVWNEWHAxVW4xSm44CmlOaEVxSGpKelZwTEFCcitvcThE\na1B5bVdDUk56L2ZMVDJNVkpJalZ3eTgKLS0tIGU5NUM0bDVyaVc0WGVrbFF1VzFx\nT0p3a1Z0czd4bTRzUVRURmh1MzhUelUKaaL1TewLGICnl/gdAFQHHBM/ik2qUjAy\n2dNemNJrMuX7Rd9DCZPeFIqNHRVX1sIhJo3/dC1UJc235l1NLcSsSA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad"
+			}
+		],
+		"lastmodified": "2026-07-25T09:28:42Z",
+		"mac": "ENC[AES256_GCM,data:h/MkejHqwuJbc63HyJs8ki1aTt7bx7HVhsQCI45hHjN/WeEJxiZVcmHEXsL/dwPg/Q7H8OImC2sl6Gt7FtGwfN9O6JwYwl6BxBBoD+lZscgrPrNqp1I9u3KhgyOF7ziQhiWH2Lk3/OVa9kuFs3xYjcKxVIA+vW6VB54QkLNBcPM=,iv:BjtKnZ/B7RvWq1MBzWzudPGvntXnk9kYpzULTpK62EU=,tag:f71WOUHcjbcHHC7KIjHqrA==,type:str]",
+		"version": "3.13.2"
+	}
+}
Author	SHA1	Message	Date
beatzaplenty	2526b2dca7	Merge pull request 'chore(secrets): Phase 4 — remove stale sops.yaml anchors and re-encrypt' (#60 ) from worktree-phase0-provision-ordering-fix into main Check NixOS configurations / eval-hosts (push) Successful in 10m19s Details Merge PR #60: Phase 4 — remove stale sops.yaml anchors	2026-07-25 11:32:25 +00:00
beatzaplentyandClaude Sonnet 4.6	2df53fd5d7	chore(secrets): Phase 4 — remove stale sops.yaml anchors and re-encrypt Check NixOS configurations / eval-hosts (pull_request) Successful in 10m21s Details Remove four stale age key anchors from .sops.yaml that correspond to non-lxc build-type variants that were never deployed (or are now superseded by their lxc-* counterparts): &docker → superseded by &lxc-docker (active running host) &server → superseded by &lxc-server (active running host) &nix-cache → superseded by &lxc-nix-cache (active running host) &nix-minimal → superseded by &lxc-minimal (active running host) Also remove the secrets/docker.yaml creation_rules block entirely since that file does not exist. Re-encrypt secrets/common.yaml, secrets/nix-cache.yaml, and secrets/server.yaml with sops updatekeys to drop the stale recipients. The four removed keys can no longer decrypt these files. Update README.md and CLAUDE.md to clarify that deployed lxc-* hosts now use clan vars (vars/per-machine/<target>/openssh/) rather than the gitignored host-keys/ directory. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx	2026-07-25 21:31:56 +10:00
beatzaplenty	5e2ff76cf7	Merge pull request 'refactor(provision): Phase 3 — remove legacy host-keys/ fallback' (#59 ) from worktree-phase0-provision-ordering-fix into main Check NixOS configurations / eval-hosts (push) Successful in 10m23s Details Merge PR #59: Phase 3 — remove legacy host-keys/ fallback	2026-07-25 11:24:55 +00:00
beatzaplentyandClaude Sonnet 4.6	e8c4122460	refactor(provision): Phase 3 — remove legacy host-keys/ fallback Check NixOS configurations / eval-hosts (pull_request) Successful in 10m22s Details All actively deployed lxc-* hosts now have clan vars. Remove the legacy scp -pr host-keys/ fallback in sync_remote_host_keys(): instead of silently copying the gitignored directory, error clearly if no clan var exists for the target and tell the operator how to generate one. Also extend the uncommitted-changes check to cover vars/per-machine/ in addition to .sops.yaml and secrets/, since clan vars must be committed before the remote build git-pulls them. Update the script header and sync_remote_host_keys comment to reflect the new clan-only key flow. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx	2026-07-25 21:24:32 +10:00
beatzaplenty	5db41b1166	Merge pull request 'chore(vars): clan vars SSH host key for lxc-nix-cache' (#58 ) from worktree-phase0-provision-ordering-fix into main Check NixOS configurations / eval-hosts (push) Successful in 10m22s Details Merge PR #58: clan vars SSH host key for lxc-nix-cache	2026-07-25 11:18:19 +00:00
beatzaplentyandClaude Sonnet 4.6	ea7794dc05	chore(vars): commit clan vars SSH host key for lxc-nix-cache Check NixOS configurations / eval-hosts (pull_request) Successful in 10m27s Details Encrypted private key matches the running container's key and the vars.nixCacheHostKey in variables.nix (no rotation). Age fingerprint age1ufg390... matches the &lxc-nix-cache anchor in .sops.yaml. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx	2026-07-25 21:10:46 +10:00
beatzaplenty	67752fb1e8	Merge pull request 'fix(lxc): clan vars for lxc-tor-relay + sops-reinstall service fix (network.target)' (#57 ) from worktree-phase0-provision-ordering-fix into main Check NixOS configurations / eval-hosts (push) Successful in 10m30s Details Merge PR #57: fix(lxc): sops-reinstall to network.target + clan vars for lxc-tor-relay	2026-07-25 09:55:25 +00:00
beatzaplentyandClaude Sonnet 4.6	1a14b1d4d3	fix(lxc): move sops-reinstall service from sysinit to network.target Check NixOS configurations / eval-hosts (pull_request) Successful in 10m34s Details nixos-lxc-sops-reinstall.service called switch-to-configuration test at sysinit.target time (DefaultDependencies=false), before D-Bus was up. D-Bus is required to restart systemd targets after activation scripts run. The service reported failure on every boot (exit 1: "Failed to open dbus connection") even though secrets were correctly installed, because the D-Bus call happens after activation scripts complete. Move the service to network.target so basic.target (which includes dbus-broker.service) runs first. Also drop DefaultDependencies=false so systemd auto-adds After=basic.target. Add SuccessExitStatus=11 to handle the edge case where switch-to-configuration holds the lock during a concurrent rebuild (exit 11 = "Could not acquire lock" -- the rebuild's own activation already installed the secrets, so treating it as success is correct). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx	2026-07-25 19:50:35 +10:00
beatzaplentyandClaude Sonnet 4.6	68aea4cdcc	chore(vars): commit clan vars SSH host key for lxc-tor-relay The key was generated in a prior session but not committed — the clan vars files existed only in that session's working tree. Recovered the original private key from pve1's host-keys/ backup (fingerprint age16kqf... matches the &lxc-tor-relay anchor already in .sops.yaml), re-encrypted for admin age key only, and stored in the canonical clan vars layout. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx	2026-07-25 19:29:21 +10:00
beatzaplenty	0853952269	Merge pull request 'feat(provision): Phase 0-2 + fix — clan-core SSH host keys, activation ordering, boot-time sops' (#56 ) from worktree-phase0-provision-ordering-fix into main Check NixOS configurations / eval-hosts (push) Successful in 10m33s Details Merge feat(provision): Phase 0-2 + fix — clan-core SSH host keys, activation ordering, boot-time sops	2026-07-25 09:16:43 +00:00
beatzaplentyandClaude Sonnet 4.6	055577ee91	fix(lxc): fix activation ordering and add boot-time sops reinstall Check NixOS configurations / eval-hosts (pull_request) Successful in 10m33s Details Two bugs prevented nixos-rebuild switch from working on lxc-* hosts after first boot, both confirmed live on a deployed lxc-tor-relay container: 1. Ordering bug: preserveSshHostKey had no explicit deps, so the topological sort placed it at position 7 — after etc at position 5. By the time it tried to save the SSH key, etc had already removed it as "obsolete" (absent from the current generation's environment.etc when built without NIXOS_HOST_KEYS_DIR). Consolidate all four system.activationScripts entries into one block and add etc = { deps = ["preserveSshHostKey"]; } and setupSecrets = { deps = ["restoreSshHostKey"]; } to enforce the correct save→etc→restore→sops chain. 2. No boot-time secrets: /run/secrets is a tmpfs cleared on every reboot, and sops-nix does NOT generate a boot-time service in this configuration (confirmed live: no sops-nix.service in systemctl list-unit-files). Add nixos-lxc-sops-reinstall.service, modelled after sops-nix's own service placement (wantedBy/before sysinit.target, DefaultDependencies=false), so secrets are reinstalled before basic.target on every non-first boot. ConditionPathExists skips it on first boot; nixos-lxc-first-boot-activate handles that case. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx	2026-07-25 19:07:30 +10:00
beatzaplentyandClaude Sonnet 4.6	a63e1c70c3	feat(provision): Phase 2 — migrate SSH host keys to clan vars Replaces the gitignored host-keys/ directory with clan vars as the authoritative storage for SSH host keys. Keys are now generated as sops-binary-encrypted clan var files (admin-key only) and checked into vars/per-machine/<target>/openssh/, eliminating the plaintext private key that previously had to live outside the repo. Changes: - modules/clan/ssh-host-key.nix: clan vars generator for the ed25519 SSH host key pair (neededFor="activation" — not mapped to sops.secrets, delivered via tarball baking for LXC or --pre-format-files for VMs) - flake.nix: add clanCore module + required settings to every mkTarget; deduplicate bundled disko/sops-nix via follows; all 27 hosts eval clean - flake.lock: updated to reflect the new follows constraints - scripts/lib/clan-vars.sh: new helper library with clan_ssh_key_exists / clan_ssh_pubkey_path / clan_decrypt_ssh_key / clan_generate_ssh_key for use by the provisioning and sync scripts - scripts/secrets/sync-host-keys.sh: queue_host_sync() now checks clan vars first; generates via clan_generate_ssh_key if no key exists; derives age fingerprint from clan pub key for .sops.yaml registration - scripts/proxmox/create-proxmox-resource.sh: key management simplified (sync-host-keys.sh now generates the key if missing, so the inline prepare-host-key.sh call is gone); sync_remote_host_keys() decrypts the clan key into a temp dir and scps just the two files to the node when a clan key exists, falling back to the old host-keys/ scp for any remaining legacy entries Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx	2026-07-25 18:22:33 +10:00
beatzaplentyandClaude Sonnet 4.6	a9745b594b	feat(flake): add clan-core 26.05 as a flake input (Phase 1, no behavior change) Introduces clan-core pinned to its 26.05 release alongside the existing nixpkgs 26.05 input. No host configuration is changed — this is a pure dependency addition so Phase 2 (per-host vars/secret management migration) has the input available without a separate flake.lock bump. clan-core.inputs.nixpkgs.follows = "nixpkgs" keeps a single nixpkgs closure. sops-nix remains as a flake input; vars layers on top of it rather than replacing it (clan's sops storage backend still needs sops-nix). All hosts evaluate cleanly (codex-maintenance.sh --full-check equivalent triggered by the flake.nix change). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-25 17:29:29 +10:00
beatzaplentyandClaude Sonnet 4.6	78bb784265	fix(provision): block build until sops changes are committed, guard missing host keys Three ordering-related fixes to the Proxmox provisioning flow: 1. prepare-host-key.sh: make idempotent -- if the key already exists, print a note and exit 0 instead of erroring. The caller (create-proxmox-resource.sh) already guards standalone calls, but the script itself should be safe to run directly on a host that was already keyed. 2. create-proxmox-resource.sh: after sync-host-keys.sh updates .sops.yaml / secrets/, detect uncommitted changes and block with a prompt until the operator confirms they've committed and pushed. The PVE node's git pull only picks up committed+pushed state; without this gate, a new host's sops recipient is missing from the secrets files the image build uses, so the host can't decrypt secrets on first boot. 3. create-proxmox-resource.sh: add an explicit existence check for the host key in both the LXC and VM remote build heredocs, before it's passed as --pre-format-files / NIXOS_HOST_KEYS_DIR input. Gives a clear error pointing at sync-host-keys.sh instead of a raw `cp: cannot stat` from disko deep in the build. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-25 17:14:25 +10:00
beatzaplentyandClaude Sonnet 4.6	784e064fa2	fix(create-proxmox-resource): use absolute path for --pre-format-files Check NixOS configurations / eval-hosts (push) Successful in 10m20s Details The disko images script does `cd "$TMPDIR"` before parsing its arguments, so relative paths passed to --pre-format-files resolve against the temp dir instead of the repo root. Use $(pwd) to capture the absolute repo path before the disko script changes directory. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-25 16:45:04 +10:00
beatzaplenty	4a5afa6c1c	Merge pull request 'fix(tailscale): rename tailscale-subnet-router to tailscale-router everywhere' (#55 ) from worktree-fix-tailscale-host-dir into main Check NixOS configurations / eval-hosts (push) Successful in 10m33s Details fix(tailscale): rename tailscale-subnet-router to tailscale-router everywhere	2026-07-25 06:37:18 +00:00
beatzaplentyandClaude Sonnet 4.6	c844ccc4e3	fix(tailscale): rename tailscale-subnet-router → tailscale-router everywhere Check NixOS configurations / eval-hosts (pull_request) Successful in 10m28s Details Complete the rename so all identifiers match networking.hostName: - flake.nix: attribute names and buildType strings (linode/proxmox/lxc-tailscale-subnet-router → *-tailscale-router) - modules/build-types/tailscale-subnet-router.nix → tailscale-router.nix - .sops.yaml: anchor and alias names (age keys unchanged, no re-encrypt needed) - host-keys/: local gitignored key files renamed (not committed) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-25 16:33:03 +10:00
beatzaplentyandClaude Sonnet 4.6	9a0aea8f89	fix(create-proxmox-resource): auto-generate missing host key before sync Check NixOS configurations / eval-hosts (push) Successful in 10m19s Details If host-keys/<target>_ssh_host_ed25519_key doesn't exist, run prepare-host-key.sh to generate it before sync-host-keys.sh runs. Prevents sync-host-keys.sh from hitting its SKIP/exit-1 path (anchor in .sops.yaml but no local key) and the downstream disko build failure when --pre-format-files can't find the key file. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-25 16:26:49 +10:00
beatzaplenty	b013e28dcd	Merge pull request 'fix(tailscale): rename hosts/tailscale-subnet-router → hosts/tailscale-router' (#54 ) from worktree-fix-tailscale-host-dir into main Check NixOS configurations / eval-hosts (push) Successful in 10m32s Details Reviewed-on: #54	2026-07-25 06:24:59 +00:00
beatzaplentyandClaude Sonnet 4.6	5a56030f6e	fix(tailscale): rename hosts/tailscale-subnet-router → hosts/tailscale-router Check NixOS configurations / eval-hosts (pull_request) Successful in 10m30s Details The directory name was tailscale-subnet-router but networking.hostName was already tailscale-router, causing a mismatch that confused scripts comparing directory paths against actual hostnames. Flake attribute names (linode/proxmox/lxc-tailscale-subnet-router) and .sops.yaml anchors are unchanged — they describe the build type, not the hostname. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-25 16:24:13 +10:00
beatzaplentyandClaude Sonnet 4.6	f8719437ba	fix(nix-cache): use FQDN to fix hostname resolution on clients Check NixOS configurations / eval-hosts (push) Successful in 10m30s Details systemd-resolved only uses LLMNR for single-label hostnames, never DNS — same issue mount-data.nix already documented and fixed for NFS by switching to server.sweet.home. Change the substituter URL, SSH knownHosts, and remote-builder hostName from bare "nix-cache" to "nix-cache.sweet.home", and update nginx's virtualHost to match. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-25 16:01:56 +10:00
beatzaplentyandClaude Sonnet 4.6	9e34b9cbb9	fix(push-host-keys): detect non-interactive stdin, direct to SUDO_PASS Check NixOS configurations / eval-hosts (push) Successful in 10m19s Details read exits non-zero when stdin is not a terminal (set -e killed the script silently). Catch that and emit a clear error pointing to the SUDO_PASS environment variable rather than crashing with no output. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-25 15:55:50 +10:00
beatzaplenty	4dabd725f0	sync nix-cache ssh key Check NixOS configurations / eval-hosts (push) Successful in 10m34s Details	2026-07-25 15:55:04 +10:00
beatzaplentyandClaude Sonnet 4.6	2743d664a5	fix(push-host-keys): remove /dev/tty probe, plain read is sufficient Check NixOS configurations / eval-hosts (push) Successful in 10m22s Details /dev/tty exists as a device node even without a controlling terminal, so -r/-w tests pass but opening it fails. Plain 'read -r -s' from stdin is enough: works interactively from a real terminal, and from a non-tty context the caller should set SUDO_PASS in the environment instead. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-25 15:53:00 +10:00
beatzaplentyandClaude Sonnet 4.6	cfa34f3565	fix(push-host-keys): fall back to stdin when /dev/tty unavailable Check NixOS configurations / eval-hosts (push) Successful in 10m19s Details Environments without a controlling terminal (containers, CI agents) don't have /dev/tty. Try it first for the sudo password prompt, fall back to plain stdin so the script works in both contexts. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-25 15:51:04 +10:00
beatzaplentyandClaude Sonnet 4.6	e021b49412	fix(push-host-keys): prompt sudo password once, pass via sudo -S Check NixOS configurations / eval-hosts (push) Successful in 10m22s Details Instead of ssh -t (requires PTY on both sides), prompt for the sudo password once at startup and pipe it to each remote invocation via sudo -S. This works from any context -- interactive terminal, background agent, or script -- with no PTY needed on either end. Also accepts SUDO_PASS from the environment for non-interactive callers. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-25 15:49:27 +10:00
beatzaplentyandClaude Sonnet 4.6	0c29c6a93d	fix(push-host-keys): fix sudo PTY allocation failure Check NixOS configurations / eval-hosts (push) Successful in 10m28s Details ssh -t won't allocate a PTY when its own stdin is redirected (by a heredoc). Replaced the heredoc-fed 'sudo bash -s' with commands passed as an argument string so stdin stays free and -t can properly allocate a PTY for the sudo password prompt. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-25 15:39:06 +10:00
beatzaplenty	c329988cdd	secrets: update recipients and re-encrypt for host key changes Check NixOS configurations / eval-hosts (push) Failing after 12m10s Details	2026-07-25 15:31:22 +10:00
beatzaplenty	7a2b5ecf71	Merge pull request 'feat(secrets): add push-host-keys.sh; integrate into sync/recover scripts' (#53 ) from worktree-push-host-keys into main Check NixOS configurations / eval-hosts (push) Successful in 10m21s Details Reviewed-on: #53	2026-07-25 05:30:32 +00:00
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICuHUxGNH6ei3BZD+EfZs3l4X8uJNcjQiOsM/G4yo4O/ lxc-nix-cache`
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOAzES7wlgL7gIyxOHbmwhzI8SJ5uMSEd26u+ek6knVh lxc-tor-relay`