grr: fix the heccin quotes

... of the day

flake.lock

@@ -1,5 +1,27 @@
 {
   "nodes": {
+    "bro": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1779629827,
+        "narHash": "sha256-nrlB50/oelB8oFx9DhOoXI5z0VoTZGEA6XxYvkvpqDA=",
+        "ref": "main",
+        "rev": "7d0f35e12e4dec39f981c08fc33515589f41f4a5",
+        "revCount": 3,
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/bro.git"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "https://git.pvv.ntnu.no/Projects/bro.git"
+      }
+    },
     "crane": {
       "locked": {
         "lastModified": 1776635034,
@@ -101,7 +123,7 @@
         "nixpkgs": [
           "nixpkgs-unstable"
         ],
-        "rust-overlay": "rust-overlay"
+        "rust-overlay": "rust-overlay_2"
       },
       "locked": {
         "lastModified": 1777019032,
@@ -165,7 +187,7 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "rust-overlay": "rust-overlay_2"
+        "rust-overlay": "rust-overlay_3"
       },
       "locked": {
         "lastModified": 1767906976,
@@ -294,11 +316,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764869785,
+        "lastModified": 1779774845,
-        "narHash": "sha256-FGTIpC7gB4lbeL0bfYzn1Ge0PaCpd7VqWBLhJBx0i4A=",
+        "narHash": "sha256-QJU1J4eupwjRrtvWGzRut0GY3woql92RS9O/acWkJkk=",
         "ref": "main",
-        "rev": "8ce7fb0b1918bdb3d1489a40d73895693955e8b2",
+        "rev": "13667cd216db260ab549e6f1b6281aa230d2f9e0",
-        "revCount": 23,
+        "revCount": 29,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/calendar-bot.git"
       },
@@ -352,6 +374,7 @@
     },
     "root": {
       "inputs": {
+        "bro": "bro",
         "dibbler": "dibbler",
         "disko": "disko",
         "gergle": "gergle",
@@ -377,7 +400,7 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "rust-overlay": "rust-overlay_3"
+        "rust-overlay": "rust-overlay_4"
       },
       "locked": {
         "lastModified": 1778600367,
@@ -396,6 +419,27 @@
       }
     },
     "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "bro",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779419951,
+        "narHash": "sha256-dMX0PUslUHPajP6o8FEoRdFv9afq/dec4POR0vVfjK4=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "5b5c521d6cae9ef4aa32f888eb2c0ce595c9be52",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_2": {
       "inputs": {
         "nixpkgs": [
           "greg-ng",
@@ -416,7 +460,7 @@
         "type": "github"
       }
     },
-    "rust-overlay_2": {
+    "rust-overlay_3": {
       "inputs": {
         "nixpkgs": [
           "minecraft-heatmap",
@@ -437,7 +481,7 @@
         "type": "github"
       }
     },
-    "rust-overlay_3": {
+    "rust-overlay_4": {
       "inputs": {
         "nixpkgs": [
           "roowho2",

flake.nix

@@ -47,6 +47,9 @@
 
     qotd.url = "git+https://git.pvv.ntnu.no/Projects/qotd.git?ref=main";
     qotd.inputs.nixpkgs.follows = "nixpkgs";
+
+    bro.url = "git+https://git.pvv.ntnu.no/Projects/bro.git?ref=main";
+    bro.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs = {
@@ -214,7 +217,14 @@
         };
         shark = stableNixosConfig "shark" {};
         wenche = stableNixosConfig "wenche" {};
-        temmie = stableNixosConfig "temmie" {};
+        temmie = stableNixosConfig "temmie" {
+          overlays = [
+            inputs.bro.overlays.default
+          ];
+          modules = [
+            inputs.bro.nixosModules.default
+          ];
+        };
         gluttony = stableNixosConfig "gluttony" {
           overlays = [
             (final: prev: { bluemap = final.callPackage ./packages/bluemap.nix {}; })

hosts/bicep/configuration.nix

@@ -7,7 +7,6 @@
     ./services/nginx
 
     ./services/calendar-bot.nix
-    ./services/garage.nix
     #./services/git-mirrors
     ./services/minecraft-heatmap.nix
     ./services/mysql

hosts/bicep/services/garage.nix

@@ -1,143 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.garage;
-in
-{
-  sops.secrets = lib.mkIf cfg.enable {
-    "garage/rpc-secret" = {
-      owner = "garage";
-      group = "garage";
-      restartUnits = [ "garage.service" ];
-    };
-    "garage/admin-token" = {
-      owner = "garage";
-      group = "garage";
-      restartUnits = [ "garage.service" ];
-    };
-    "garage/metrics-token" = {
-      owner = "garage";
-      group = "garage";
-      restartUnits = [ "garage.service" ];
-    };
-  };
-
-  services.garage = {
-    enable = true;
-    package = pkgs.garage_2;
-    settings = {
-      data_dir = [
-        {
-          capacity = "50G";
-          path = "/var/lib/garage/data";
-        }
-      ];
-      metadata_dir = "/var/lib/garage/meta";
-      db_engine = "lmdb";
-      replication_factor = 1;
-
-      rpc_bind_addr = "[::]:3901";
-      rpc_secret_file = config.sops.secrets."garage/rpc-secret".path;
-
-      s3_api = {
-        s3_region = "eu-central";
-        api_bind_addr = "[::]:3900";
-        root_domain = ".garage.pvv.ntnu.no";
-      };
-
-      # s3_web = {
-      #   bind_addr = "[::]:3902";
-      #   root_domain = ".garage-web.pvv.ntnu.no";
-      #   index = "index.html";
-      # };
-
-      admin = {
-      #   api_bind_addr = "[::]:3903";
-        admin_token_file = config.sops.secrets."garage/admin-token".path;
-        metrics_token_file = config.sops.secrets."garage/metrics-token".path;
-      };
-    };
-  };
-
-  users = lib.mkIf cfg.enable {
-    users.garage = {
-      isSystemUser = true;
-      group = "garage";
-    };
-    groups.garage = { };
-  };
-
-  systemd.tmpfiles.settings."10-garage" = lib.mkIf cfg.enable {
-    "/data/garage/data".d = {
-      user = "garage";
-      group = "garage";
-      mode = "0770";
-    };
-    "/data/garage/meta".d = {
-      user = "garage";
-      group = "garage";
-      mode = "0770";
-    };
-  };
-
-  systemd.services.garage = lib.mkIf cfg.enable {
-    serviceConfig = {
-      DynamicUser = false;
-      User = "garage";
-      Group = "garage";
-
-      BindReadWritePaths = [
-        "/data/garage/data:/var/lib/garage/data"
-        "/data/garage/meta:/var/lib/garage/meta"
-      ];
-
-      LoadCredential = [
-        "rpc_secret_path:${config.sops.secrets."garage/rpc-secret".path}"
-        "admin_token_path:${config.sops.secrets."garage/admin-token".path}"
-        "metrics_token_path:${config.sops.secrets."garage/metrics-token".path}"
-      ];
-
-      Environment = [
-        "GARAGE_ALLOW_WORLD_READABLE_SECRETS=true"
-        "GARAGE_RPC_SECRET_FILE=%d/rpc_secret_path"
-        "GARAGE_ADMIN_TOKEN_FILE=%d/admin_token_path"
-        "GARAGE_METRICS_TOKEN_FILE=%d/metrics_token_path"
-      ];
-    };
-  };
-
-  services.nginx = lib.mkIf cfg.enable {
-    upstreams.s3_backend.servers = {
-      "[::1]:3900" = { };
-    };
-    # upstreams.web_backend.servers = {
-    #   "[::1]:3902" = { };
-    # };
-
-    virtualHosts."garage.pvv.ntnu.no" = {
-      serverAliases = [ "*.garage.pvv.ntnu.no" ];
-
-      enableACME = true;
-      # useACMEHost = "garage.pvv.ntnu.no";
-      forceSSL = true;
-
-      locations."/" = {
-        proxyPass = "http://s3_backend";
-        extraConfig = ''
-          client_max_body_size 64m;
-          proxy_max_temp_file_size 0;
-        '';
-      };
-    };
-
-    # virtualHosts."garage-web.pvv.ntnu.no" = {
-    #   serverAliases = [ "*.garage-web.pvv.ntnu.no" ];
-
-    #   useACMEHost = "garage-web.pvv.ntnu.no";
-    #   forceSSL = true;
-
-    #   locations."/" = {
-    #     proxyPass = "http://web_backend";
-    #   };
-    # };
-  };
-}

hosts/bikkje/hardware-configuration.nix

@@ -0,0 +1,39 @@
+# Do modify this file!  It was generated by „nixos-generate-config“
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix and run ⟪nix-env --switch-profile⟫ instead.
+{ config, lib, pkgs, modulesPath, home-manager, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "af_alg" "esp4" "esp6" "rds" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/sdj1";
+      fsType = "bcachefs";
+    };
+
+  fileSystems."/boott" =
+    { device = "/dev/disk/by-uuid/AAAA-AAAA";
+      fsType = "vfat";
+    };
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with ‹networking.interfaces.<interface>.useDHCP›.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.em1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.em2.useDHCP = lib.mkDefault true;
+  # networking.interfaces.pflog0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "i686-freebsd";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.infiniband.enable = true;
+  hardware.flipperzero.enable = lib.mkIf (config.security.isolate.cgRoot == "auto:/run/isolate/tank") true;
+}

hosts/ildkule/services/monitoring/uptime-kuma.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, values, ... }:
 let
   cfg = config.services.uptime-kuma;
   domain = "status.pvv.ntnu.no";
@@ -24,4 +24,21 @@ in {
     fsType = "bind";
     options = [ "bind" ];
   };
+
+  services.rsync-pull-targets = {
+    enable = true;
+    locations.${stateDir} = {
+      user = "root";
+      rrsyncArgs.ro = true;
+      authorizedKeysAttrs = [
+        "restrict"
+        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
+        "no-agent-forwarding"
+        "no-port-forwarding"
+        "no-pty"
+        "no-X11-forwarding"
+      ];
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXzcDm6cVr4NmWzUSroy33FlielKqaG83wY0RCMC0p/ uptime_kuma rsync backup";
+    };
+  };
 }

hosts/kommode/services/gitea/gpg.nix

@@ -50,6 +50,8 @@ in
     SIGNING_NAME = "PVV Git";
     SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
     INITIAL_COMMIT = "always";
+    MERGES = lib.concatStringsSep "," [ "always" ];
+    CRUD_ACTIONS = lib.concatStringsSep "," [ "always" ];
     WIKI = "always";
   };
 }

hosts/temmie/services/userweb/default.nix

@@ -39,7 +39,7 @@ let
     extraConfig = phpOptions;
   };
 
-  perlEnv = pkgs.perl.withPackages (ps: with ps; [
+  perlEnv = (pkgs.perl.withPackages (ps: with ps; [
     pkgs.exiftool
     pkgs.ikiwiki
     pkgs.irssi
@@ -54,7 +54,14 @@ let
     ImageMagick
     JSON
     TemplateToolkit
-  ]);
+  ])).overrideAttrs (prev: {
+    # NOTE: `pkgs.perl.propagatedBuildInputs` don't actually propagate through the
+    #       wrapper derivation created by `withPackages`. This should compensate
+    #       for that.
+    postBuild = prev.postBuild + ''
+      cp -r '${pkgs.perl}/nix-support' "$out"/nix-support
+    '';
+  });
 
   # https://nixos.org/manual/nixpkgs/stable/#python.buildenv-function
   pythonEnv = pkgs.python3.buildEnv.override {
@@ -67,21 +74,6 @@ let
     ignoreCollisions = true;
   };
 
-  sendmailWrapper = pkgs.writeShellApplication {
-    name = "sendmail";
-    runtimeInputs = [ ];
-    text = ''
-      args=("$@")
-
-      if [[ -z "$USERDIR_USER" ]] && [[ "$USERDIR_USER" != "pvv" ]]; then
-          # Prepend -fusername to the argument list, so bounces go to the user
-          args=("-f$USERDIR_USER" "''${args[@]}")
-      fi
-
-      exec '${lib.getExe pkgs.system-sendmail}' "''${args[@]}"
-    '';
-  };
-
   # https://nixos.org/manual/nixpkgs/stable/#sec-building-environment
   fhsEnv = pkgs.buildEnv {
     name = "userweb-env";
@@ -89,7 +81,7 @@ let
     paths = with pkgs; [
       bash
 
-      sendmailWrapper
+      config.services.bro.instances.userweb-sendmail.client.package
 
       perlEnv
       pythonEnv
@@ -184,17 +176,21 @@ in
     extraModules = [
       "systemd"
       "userdir"
-      # TODO: I think the compilation steps of pkgs.apacheHttpdPackages.mod_perl might have some
+      {
-      #       incorrect or restrictive assumptions upstream, either nixpkgs or source
+        name = "perl";
-      # {
+        path = let
-      #   name = "perl";
+          mod_perl = pkgs.symlinkJoin {
-      #   path = let
+            name = "userweb_modperl_with_custom_perl_env";
-      #     mod_perl = pkgs.apacheHttpdPackages.mod_perl.override {
+            ignoreCollisions = true;
-      #       apacheHttpd = cfg.package.out;
+            paths = [
-      #       perl = perlEnv;
+              (pkgs.apacheHttpdPackages.mod_perl.override {
-      #     };
+                apacheHttpd = cfg.package.out;
-      #   in "${mod_perl}/modules/mod_perl.so";
+              })
-      # }
+              perlEnv
+            ];
+          };
+        in "${mod_perl}/modules/mod_perl.so";
+      }
     ];
 
     extraConfig = ''
@@ -203,11 +199,14 @@ in
       ScriptLog ${cfg.logDir}/cgi.log
     '';
 
-    # virtualHosts."userweb.pvv.ntnu.no" = {
     virtualHosts."temmie.pvv.ntnu.no" = {
       forceSSL = true;
       enableACME = true;
 
+      serverAliases = [
+        "www2.pvv.ntnu.no"
+      ];
+
       extraConfig = ''
         UserDir ${lib.concatMapStringsSep " " (l: "/home/pvv/${l}/*/web-docs") homeLetters}
         UserDir disabled root
@@ -258,6 +257,14 @@ in
   #   ];
   # };
 
+  # NOTE: 54 -> 33, this is the UID/GID we used for www-data on tom in the past.
+  #       Any files accessed by or created by httpd will do so over NFS with this
+  #       UID/GID pair as its credentials.
+  #       This overlaps with the hardcoded `disnix` uid in nixpkgs, but we *probably*
+  #       won't be using that for the foreseeable future.
+  users.users."wwwrun".uid = lib.mkForce 33;
+  users.groups."wwwrun".gid = lib.mkForce 33;
+
   systemd.services.httpd = {
     after = [ "pvv-homedirs.target" ];
     requires = [ "pvv-homedirs.target" ];

hosts/temmie/services/userweb/mail.nix

@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 {
   services.postfix.enable = lib.mkForce false;
 
@@ -9,4 +9,111 @@
       remotes = "mail.pvv.ntnu.no smtp --port=25";
     };
   };
+
+  services.bro = {
+    enable = true;
+
+    instances.userweb-sendmail = {
+      enable = true;
+
+      client = {
+        settings.BRO_FILE_FLAGS = [
+          "-C"
+        ];
+      };
+
+      server = {
+        settings = {
+          executable = let
+            sendmailWrapper = pkgs.writeShellApplication {
+              name = "sendmail";
+              runtimeInputs = [ ];
+              bashOptions = [
+                "errexit"
+                "pipefail"
+              ];
+              text = ''
+                args=("$@")
+
+                if [[ -z "$USERDIR_USER" ]] && [[ "$USERDIR_USER" != "pvv" ]]; then
+                    # Prepend -fusername to the argument list, so bounces go to the user
+                    args=("-f$USERDIR_USER" "''${args[@]}")
+                fi
+
+                exec '${lib.getExe pkgs.system-sendmail}' -t -i "''${args[@]}"
+              '';
+            };
+          in lib.getExe sendmailWrapper;
+          allowed-env = [ "USERDIR_USER" ];
+        };
+      };
+    };
+  };
+
+  environment.systemPackages = [
+    (config.services.bro.instances.userweb-sendmail.client.package.overrideAttrs (prev: {
+      buildCommand = prev.buildCommand + ''
+        mv "$out/bin/sendmail" "$out/bin/bro-sendmail"
+      '';
+    }))
+  ];
+
+  users.users.nullmailer-user = {
+    enable = true;
+    isSystemUser = true;
+    group = "nullmailer-user";
+  };
+
+  users.groups.nullmailer-user = { };
+
+  systemd.services.bro-userweb-sendmail = {
+    serviceConfig = {
+      User = "nullmailer-user";
+      Group = "nullmailer-user";
+
+      ReadWritePaths = [
+        "/var/spool/nullmailer"
+      ];
+
+      AmbientCapabilities = "";
+      CapabilityBoundingSet = "";
+      NoNewPrivileges = false;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      PrivateTmp = true;
+      PrivateDevices = true;
+      PrivateUsers = false;
+      ProtectHostname = true;
+      ProtectClock = true;
+      ProtectKernelTunables = true;
+      ProtectKernelModules = true;
+      ProtectKernelLogs = true;
+      ProtectControlGroups = true;
+      RestrictAddressFamilies = [
+        "AF_UNIX"
+        "AF_INET"
+        "AF_INET6"
+        "AF_NETLINK"
+      ];
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      PrivateMounts = true;
+      ProcSubset = "pid";
+      ProtectProc = "invisible";
+      RemoveIPC = true;
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@resources"
+      ];
+      UMask = "0077";
+    };
+  };
+
+  systemd.services.httpd.serviceConfig = {
+    BindPaths = [ (lib.head config.systemd.sockets.bro-userweb-sendmail.listenStreams) ];
+  };
 }

modules/matrix-ooye.nix

@@ -171,6 +171,9 @@ in
         requires = [ "matrix-ooye-pre-start.service" ];
         wantedBy = [ "multi-user.target" ];
 
+        startLimitIntervalSec = 5;
+        startLimitBurst = 5;
+
         serviceConfig = {
           ExecStart = lib.getExe config.services.matrix-ooye.package;
           WorkingDirectory = "/var/lib/matrix-ooye";
@@ -182,8 +185,6 @@ in
           #PrivateDevices = true;
           Restart = "on-failure";
           RestartSec = "5s";
-          StartLimitIntervalSec = "5s";
-          StartLimitBurst = "5";
           DynamicUser = true;
         };
       };

secrets/bicep/bicep.yaml

@@ -10,10 +10,6 @@ minecraft-heatmap:
     ssh-key:
         private: ENC[AES256_GCM,data:h9OtD6hxrxyokFDe9bveAkMICrs3YrsAEqg0RVHV+xCkgkNAdoh85wb1QI8FJ0tga4Bfq8ZxZTdMnexQvbYWL8m/N/P6gWoPPJd7dwGuxaUZu5lqngVuHIhH0yWFWtPXjQ0Zyl5Q1aBKyjzJMvJc/H2iprgVH4YFs/fWf/KDEp17Plvvz0AoPGPrOZErDmne4MtLbW3pUm1r5ACo/41OyXYwjHk1Ywgsoz1CMxe/DrmkADnf7jSDWL6Q0mz8hIIYi8GbToJS4BIJ2plttraxV9sqpIPzS/1jMERNchItlkCppSYIy/eohVmskP8dAySm5Z7HNGGtzWSSGLxq15xKc7OVFYPMI+B35nPnp1LVOUWqBHAqVo7dwxc3VXOlVat7AMknUZnr67d4TIIl5BOdy/rvAxzXS/fDV0zntIs5o3phKStVvq07eZFaOVva45B7Pyyn0PdBhHBt2JcBtm+Xtg9i3xvZdwQgbeeJRhnYgDqK6BVhmtTuirwp1GOyslqaFCjg0MJj+W+d8R9gbbfyFR6YrZQAkcd/o/yZGg86z7Phe18=,iv:nt/+qPBwPZKQt43VJ9FbKjLYioFwCxD7VK9WNCJCmpQ=,tag:MuDfnTiro3VVJq9x5rkEQg==,type:str]
         public: ENC[AES256_GCM,data:+fiCO8VRSmV7tmyweYSpZJMOuMORLHkWetYbr20aTQ1vRYr927nYGes4E464t+Dv9OyJPCLmHBdgt7UvxJWuC3pZE8iStnBYnej3D4ebMzi2SMfOkJjGuQSplXtl8QeAYe1YvROmtQ==,iv:thgGQUyWdXfwUt1E/vudoNjl8JjnksFd1rb/asTry+g=,tag:t1iQPocvfI+JafuJycaLuw==,type:str]
-garage:
-    rpc-secret: ENC[AES256_GCM,data:GzLWSrVcjCiZKNC78BCjf1CFDdUxU43w5cjUCxlV2zUv4RLJ9m4rJiw749du+JW/w7CvyVgBHSM7D4ixeunvJA==,iv:VwrmBtbNX0AumaBmMNYwMd+zMHfYwXzvMd5D2uQrIis=,tag:ShHXGuYx4lrg+ORf+JXISw==,type:str]
-    admin-token: ENC[AES256_GCM,data:UFyn0s0t44oEDdV36kkeUyomvP0X+Sw4ed1g6n29Fh6PLYl53gvDnyg0OSI=,iv:w9IMARTfTcfvu/Qdh60JVH7S9W1GkV+/e3YL08WZKh8=,tag:kOx9BZ8OPBNRpvkLgmW3Zw==,type:str]
-    metrics-token: ENC[AES256_GCM,data:/dCSR1OgpEsOsRRzCeiY6OSyGvl8feKovb/Kfqg6QCQ4tb8bAkkR8xLtTxQ=,iv:4wHwBgoiJFTZETtNs9t6dshgG3f84T7HHiEi86LkOmU=,tag:3usDN18uB2ZPo8fDJZEDag==,type:str]
 sops:
     age:
         - recipient: age19nk55kcs7s0358jpkn75xnr57dfq6fq3p43nartvsprx0su22v7qcgcjdx
@@ -79,8 +75,8 @@ sops:
             U3IrZTB3YUJiREZDQkgzUFMvb3VxU1kKJhYYVcCT8hNJkEK1nD3GBekVGDOI3Nin
             iBat3LwB4Ijzx1jA+jKJ1Ilf4MgdoL2ox6l/uWft27vvsRaQ501VvA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-29T12:18:46Z"
+    lastmodified: "2025-08-25T12:27:53Z"
-    mac: ENC[AES256_GCM,data:blfYRh75xbA+jeGCCxuZADBVAa4Nih+b5hcXEp8mdzOBrbdOWfL4TfuyYB0Cj/rMDsklIprczmBJ/a/cSTdKSaak/LfAzy7swR6u5R5V3+xLP6CopOhO59RaXc2inoMPEc73XAmP33jynm/kSznRM1PGA+X9oaK6PrWcTgHiM7M=,iv:SwXRz/XpyOVOQzvRjViqK41NOdHXGdTshQ3a/Qi1350=,tag:v6p6QW6qnv1T14PBBB88NQ==,type:str]
+    mac: ENC[AES256_GCM,data:GoJ2en7e+D4wjyPJqq7i1s8JPdgFO3wcxrtXOgSKTxi6HTibuIcP4KQcKrCMRAZmXOEL1vpnWFA2uk7S00Av7/QOnzP0Zrk3aPBM6lbB+p9XSabN0sOe1UpZDtAM3bzvS9JZzyztT5nHKvO/eV2rP71y/tYbsT6yvj7Y9zxpvKg=,iv:tQiCr7zpo7g5jZpt2VD9jtFKo32XUWs94Jay+T4XWys=,tag:npBqmlbUUfN+ztttajva3w==,type:str]
     pgp:
         - created_at: "2026-01-16T06:34:45Z"
           enc: |-
@@ -103,4 +99,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.12.2
+    version: 3.10.2