43 changed files with 269 additions and 424 deletions
--- a/7
+++ b/7
@ -29,9 +29,4 @@ gc:
 # Update a flake input by name (ex: 'nixpkgs')
 .PHONY: update-input
 update-input:
-	nix flake update $(filter-out $@,$(MAKECMDGOALS))
-
-# Build Custom Install ISO
-.PHONY: iso
-iso:
-	nix build .#packages.x86_64-linux.iso
+	nix flake update $(filter-out $@,$(MAKECMDGOALS))
--- a/flake.lock
+++ b/flake.lock
@ -271,18 +271,6 @@
        "type": "github"
      }
    },
-    "nixpkgs-linkwarden": {
-      "flake": false,
-      "locked": {
-        "narHash": "sha256-wW3F+iRM/ATWkyq8+Romal8oFmsM/p98V96d5G0tasA=",
-        "type": "file",
-        "url": "https://github.com/NixOS/nixpkgs/pull/347353.diff"
-      },
-      "original": {
-        "type": "file",
-        "url": "https://github.com/NixOS/nixpkgs/pull/347353.diff"
-      }
-    },
    "root": {
      "inputs": {
        "agenix": "agenix",
@ -294,7 +282,6 @@
        "nix-index-database": "nix-index-database",
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs",
-        "nixpkgs-linkwarden": "nixpkgs-linkwarden",
        "simple-nixos-mailserver": "simple-nixos-mailserver",
        "systems": "systems"
      }
--- a/flake.nix
+++ b/flake.nix
@ -2,10 +2,6 @@
  inputs = {
    # nixpkgs
    nixpkgs.url = "github:NixOS/nixpkgs/release-25.05";
-    nixpkgs-linkwarden = {
-      url = "https://github.com/NixOS/nixpkgs/pull/347353.diff";
-      flake = false;
-    };

    # Common Utils Among flake inputs
    systems.url = "github:nix-systems/default";
@ -124,11 +120,6 @@
                patches = [
                  # ./patches/gamepadui.patch
                  ./patches/dont-break-nix-serve.patch
-                  # music-assistant needs a specific custom version of librespot
-                  # I tried to use an overlay but my attempts to override the rust package did not work out
-                  # despite me following guides and examples specific to rust packages.
-                  ./patches/librespot-pin.patch
-                  inputs.nixpkgs-linkwarden
                ];
              };
              patchedNixpkgs = nixpkgs.lib.fix (self: (import "${patchedNixpkgsSrc}/flake.nix").outputs { self = nixpkgs; });
--- a/machines/ephemeral/minimal.nix
+++ b/machines/ephemeral/minimal.nix
@ -7,20 +7,12 @@
    ../../common/ssh.nix
  ];

-  boot.initrd.availableKernelModules = [
-    "ata_piix"
-    "uhci_hcd"
-    "e1000"
-    "e1000e"
-    "virtio_pci"
-    "r8169"
-    "sdhci"
-    "sdhci_pci"
-    "mmc_core"
-    "mmc_block"
-  ];
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "e1000" "e1000e" "virtio_pci" "r8169" ];
  boot.kernelParams = [
+    "panic=30"
+    "boot.panic_on_fail" # reboot the machine upon fatal boot issues
    "console=ttyS0,115200" # enable serial console
+    "console=tty1"
  ];
  boot.kernel.sysctl."vm.overcommit_memory" = "1";

--- a/machines/howl/hardware-configuration.nix
+++ b/machines/howl/hardware-configuration.nix
@ -6,8 +6,7 @@
    nixos-hardware.nixosModules.framework-13-7040-amd
  ];

-  # boot.kernelPackages = pkgs.linuxPackages_6_14;
-  boot.kernelPackages = pkgs.linuxPackages_6_13;
+  boot.kernelPackages = pkgs.linuxPackages_6_14;

  hardware.framework.amd-7040.preventWakeOnAC = true;
  services.fwupd.enable = true;
--- a/machines/router/default.nix
+++ b/machines/router/default.nix
@ -22,7 +22,8 @@

  # networking.useDHCP = lib.mkForce true;

-  networking.usePredictableInterfaceNames = false;
+  # TODO
+  # networking.usePredictableInterfaceNames = true;

  powerManagement.cpuFreqGovernor = "ondemand";

--- a/machines/router/hardware-configuration.nix
+++ b/machines/router/hardware-configuration.nix
@ -10,6 +10,8 @@

  # Enable serial output
  boot.kernelParams = [
+    "panic=30"
+    "boot.panic_on_fail" # reboot the machine upon fatal boot issues
    "console=ttyS0,115200n8" # enable serial console
  ];
  boot.loader.grub.extraConfig = "
@ -21,8 +23,6 @@
  # firmware
  firmware.x86_64.enable = true;
  nixpkgs.config.allowUnfree = true;
-  hardware.enableRedistributableFirmware = true;
-  hardware.enableAllFirmware = true;

  # boot
  bios = {
@ -31,18 +31,20 @@
  };

  # disks
+  remoteLuksUnlock.enable = true;
+  boot.initrd.luks.devices."enc-pv".device = "/dev/disk/by-uuid/9b090551-f78e-45ca-8570-196ed6a4af0c";
  fileSystems."/" =
    {
-      device = "/dev/disk/by-uuid/6aa7f79e-bef8-4b0f-b22c-9d1b3e8ac94b";
-      fsType = "ext4";
+      device = "/dev/disk/by-uuid/421c82b9-d67c-4811-8824-8bb57cb10fce";
+      fsType = "btrfs";
    };
  fileSystems."/boot" =
    {
-      device = "/dev/disk/by-uuid/14dfc562-0333-4ddd-b10c-4eeefe1cd05f";
+      device = "/dev/disk/by-uuid/d97f324f-3a2e-4b84-ae2a-4b3d1209c689";
      fsType = "ext3";
    };
  swapDevices =
-    [{ device = "/dev/disk/by-uuid/adf37c64-3b54-480c-a9a7-099d61c6eac7"; }];
+    [{ device = "/dev/disk/by-uuid/45bf58dd-67eb-45e4-9a98-246e23fa7abd"; }];

  nixpkgs.hostPlatform = "x86_64-linux";
 }
--- a/machines/router/properties.nix
+++ b/machines/router/properties.nix
@ -1,17 +0,0 @@
-{
-  hostNames = [
-    "router"
-    "192.168.6.159"
-    "192.168.3.1"
-  ];
-
-  arch = "x86_64-linux";
-
-  systemRoles = [
-    "server"
-    "wireless"
-    "router"
-  ];
-
-  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKDCMhEvWJxFBNyvpyuljv5Uun8AdXCxBK9HvPBRe5x6";
-}
--- a/machines/router/properties.nix.disabled
+++ b/machines/router/properties.nix.disabled
@ -0,0 +1,21 @@
+{
+  hostNames = [
+    "router"
+    "192.168.1.228"
+  ];
+
+  arch = "x86_64-linux";
+
+  systemRoles = [
+    "server"
+    "wireless"
+    "router"
+  ];
+
+  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFr2IHmWFlaLaLp5dGoSmFEYKA/eg2SwGXAogaOmLsHL";
+
+  remoteUnlock = {
+    hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJOw5dTPmtKqiPBH6VKyz5MYBubn8leAh5Eaw7s/O85c";
+    onionHost = "jxx2exuihlls2t6ncs7rvrjh2dssubjmjtclwr2ysvxtr4t7jv55xmqd.onion";
+  };
+}
--- a/machines/router/router.nix
+++ b/machines/router/router.nix
@ -31,10 +31,8 @@ in
    networking.bridges = {
      br0 = {
        interfaces = [
-          "eth2"
-          # "wlp4s0"
-          # "wlan1"
-          "wlan0"
+          "enp2s0"
+          "wlp4s0"
          "wlan1"
        ];
      };
@ -66,173 +64,142 @@ in

    services.dnsmasq = {
      enable = true;
-      settings = {
+      extraConfig = ''
        # sensible behaviours
-        domain-needed = true;
-        bogus-priv = true;
-        no-resolv = true;
+        domain-needed
+        bogus-priv
+        no-resolv

        # upstream name servers
-        server = [
-          "1.1.1.1"
-          "8.8.8.8"
-        ];
+        server=1.1.1.1
+        server=8.8.8.8

        # local domains
-        expand-hosts = true;
-        domain = "home";
-        local = "/home/";
+        expand-hosts
+        domain=home
+        local=/home/

        # Interfaces to use DNS on
-        interface = "br0";
+        interface=br0

        # subnet IP blocks to use DHCP on
-        dhcp-range = "${cfg.privateSubnet}.10,${cfg.privateSubnet}.254,24h";
-      };
+        dhcp-range=${cfg.privateSubnet}.10,${cfg.privateSubnet}.254,24h
+      '';
    };

    services.hostapd = {
      enable = true;
      radios = {
-        # Simple 2.4GHz AP
-        wlan0 = {
+        # 2.4GHz
+        wlp4s0 = {
+          band = "2g";
+          noScan = true;
+          channel = 6;
          countryCode = "US";
-          networks.wlan0 = {
-            ssid = "CXNK00BF9176-1";
-            authentication.saePasswords = [{ passwordFile = "/run/agenix/hostapd-pw-CXNK00BF9176"; }];
+          wifi4 = {
+            capabilities = [ "LDPC" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "HT40+" ];
+          };
+          wifi5 = {
+            operatingChannelWidth = "20or40";
+            capabilities = [ "MAX-A-MPDU-LEN-EXP0" ];
+          };
+          wifi6 = {
+            enable = true;
+            singleUserBeamformer = true;
+            singleUserBeamformee = true;
+            multiUserBeamformer = true;
+            operatingChannelWidth = "20or40";
+          };
+          networks = {
+            wlp4s0 = {
+              ssid = "CXNK00BF9176";
+              authentication.saePasswordsFile = "/run/agenix/hostapd-pw-CXNK00BF9176";
+            };
+            # wlp4s0-1 = {
+            #   ssid = "- Experimental 5G Tower by AT&T";
+            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
+            # };
+            # wlp4s0-2 = {
+            #   ssid = "FBI Surveillance Van 2";
+            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
+            # };
+          };
+          settings = {
+            he_oper_centr_freq_seg0_idx = 8;
+            vht_oper_centr_freq_seg0_idx = 8;
          };
        };

-        # WiFi 5 (5GHz) with two advertised networks
+        # 5GHz
        wlan1 = {
          band = "5g";
-          channel = 0;
+          noScan = true;
+          channel = 128;
          countryCode = "US";
-          networks.wlan1 = {
-            ssid = "CXNK00BF9176-1";
-            authentication.saePasswords = [{ passwordFile = "/run/agenix/hostapd-pw-CXNK00BF9176"; }];
+          wifi4 = {
+            capabilities = [ "LDPC" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "HT40-" ];
+          };
+          wifi5 = {
+            operatingChannelWidth = "160";
+            capabilities = [ "RXLDPC" "SHORT-GI-80" "SHORT-GI-160" "TX-STBC-2BY1" "SU-BEAMFORMER" "SU-BEAMFORMEE" "MU-BEAMFORMER" "MU-BEAMFORMEE" "RX-ANTENNA-PATTERN" "TX-ANTENNA-PATTERN" "RX-STBC-1" "SOUNDING-DIMENSION-3" "BF-ANTENNA-3" "VHT160" "MAX-MPDU-11454" "MAX-A-MPDU-LEN-EXP7" ];
+          };
+          wifi6 = {
+            enable = true;
+            singleUserBeamformer = true;
+            singleUserBeamformee = true;
+            multiUserBeamformer = true;
+            operatingChannelWidth = "160";
+          };
+          networks = {
+            wlan1 = {
+              ssid = "CXNK00BF9176";
+              authentication.saePasswordsFile = "/run/agenix/hostapd-pw-CXNK00BF9176";
+            };
+            # wlan1-1 = {
+            #   ssid = "- Experimental 5G Tower by AT&T";
+            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
+            # };
+            # wlan1-2 = {
+            #   ssid = "FBI Surveillance Van 5";
+            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
+            # };
+          };
+          settings = {
+            vht_oper_centr_freq_seg0_idx = 114;
+            he_oper_centr_freq_seg0_idx = 114;
          };
        };
      };
    };
+    age.secrets.hostapd-pw-experimental-tower.file = ../../secrets/hostapd-pw-experimental-tower.age;
    age.secrets.hostapd-pw-CXNK00BF9176.file = ../../secrets/hostapd-pw-CXNK00BF9176.age;

-    # wlan0 5Ghz 00:0a:52:08:38:32
-    # wlp4s0 2.4Ghz 00:0a:52:08:38:33
+    hardware.firmware = [
+      pkgs.mt7916-firmware
+    ];

-    # services.hostapd = {
-    #   enable = true;
-    #   radios = {
-    #     # 2.4GHz
-    #     wlp4s0 = {
-    #       band = "2g";
-    #       noScan = true;
-    #       channel = 6;
-    #       countryCode = "US";
-    #       wifi4 = {
-    #         capabilities = [ "LDPC" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "HT40+" ];
-    #       };
-    #       wifi5 = {
-    #         operatingChannelWidth = "20or40";
-    #         capabilities = [ "MAX-A-MPDU-LEN-EXP0" ];
-    #       };
-    #       wifi6 = {
-    #         enable = true;
-    #         singleUserBeamformer = true;
-    #         singleUserBeamformee = true;
-    #         multiUserBeamformer = true;
-    #         operatingChannelWidth = "20or40";
-    #       };
-    #       networks = {
-    #         wlp4s0 = {
-    #           ssid = "CXNK00BF9176";
-    #           authentication.saePasswordsFile = "/run/agenix/hostapd-pw-CXNK00BF9176";
-    #         };
-    #         # wlp4s0-1 = {
-    #         #   ssid = "- Experimental 5G Tower by AT&T";
-    #         #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
-    #         # };
-    #         # wlp4s0-2 = {
-    #         #   ssid = "FBI Surveillance Van 2";
-    #         #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
-    #         # };
-    #       };
-    #       settings = {
-    #         he_oper_centr_freq_seg0_idx = 8;
-    #         vht_oper_centr_freq_seg0_idx = 8;
-    #       };
-    #     };
-
-    #     # 5GHz
-    #     wlan1 = {
-    #       band = "5g";
-    #       noScan = true;
-    #       channel = 128;
-    #       countryCode = "US";
-    #       wifi4 = {
-    #         capabilities = [ "LDPC" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "HT40-" ];
-    #       };
-    #       wifi5 = {
-    #         operatingChannelWidth = "160";
-    #         capabilities = [ "RXLDPC" "SHORT-GI-80" "SHORT-GI-160" "TX-STBC-2BY1" "SU-BEAMFORMER" "SU-BEAMFORMEE" "MU-BEAMFORMER" "MU-BEAMFORMEE" "RX-ANTENNA-PATTERN" "TX-ANTENNA-PATTERN" "RX-STBC-1" "SOUNDING-DIMENSION-3" "BF-ANTENNA-3" "VHT160" "MAX-MPDU-11454" "MAX-A-MPDU-LEN-EXP7" ];
-    #       };
-    #       wifi6 = {
-    #         enable = true;
-    #         singleUserBeamformer = true;
-    #         singleUserBeamformee = true;
-    #         multiUserBeamformer = true;
-    #         operatingChannelWidth = "160";
-    #       };
-    #       networks = {
-    #         wlan1 = {
-    #           ssid = "CXNK00BF9176";
-    #           authentication.saePasswordsFile = "/run/agenix/hostapd-pw-CXNK00BF9176";
-    #         };
-    #         # wlan1-1 = {
-    #         #   ssid = "- Experimental 5G Tower by AT&T";
-    #         #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
-    #         # };
-    #         # wlan1-2 = {
-    #         #   ssid = "FBI Surveillance Van 5";
-    #         #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
-    #         # };
-    #       };
-    #       settings = {
-    #         vht_oper_centr_freq_seg0_idx = 114;
-    #         he_oper_centr_freq_seg0_idx = 114;
-    #       };
-    #     };
-    #   };
-    # };
-    # age.secrets.hostapd-pw-experimental-tower.file = ../../secrets/hostapd-pw-experimental-tower.age;
-    # age.secrets.hostapd-pw-CXNK00BF9176.file = ../../secrets/hostapd-pw-CXNK00BF9176.age;
-
-    # hardware.firmware = [
-    #   pkgs.mt7916-firmware
-    # ];
-
-    # nixpkgs.overlays = [
-    #   (self: super: {
-    #     mt7916-firmware = pkgs.stdenvNoCC.mkDerivation {
-    #       pname = "mt7916-firmware";
-    #       version = "custom-feb-02-23";
-    #       src = ./firmware/mediatek; # from here https://github.com/openwrt/mt76/issues/720#issuecomment-1413537674
-    #       dontBuild = true;
-    #       installPhase = ''
-    #         for i in \
-    #           mt7916_eeprom.bin \
-    #           mt7916_rom_patch.bin \
-    #           mt7916_wa.bin \
-    #           mt7916_wm.bin;
-    #         do
-    #           install -D -pm644 $i $out/lib/firmware/mediatek/$i
-    #         done
-    #       '';
-    #       meta = with lib; {
-    #         license = licenses.unfreeRedistributableFirmware;
-    #       };
-    #     };
-    #   })
-    # ];
+    nixpkgs.overlays = [
+      (self: super: {
+        mt7916-firmware = pkgs.stdenvNoCC.mkDerivation {
+          pname = "mt7916-firmware";
+          version = "custom-feb-02-23";
+          src = ./firmware/mediatek; # from here https://github.com/openwrt/mt76/issues/720#issuecomment-1413537674
+          dontBuild = true;
+          installPhase = ''
+            for i in \
+              mt7916_eeprom.bin \
+              mt7916_rom_patch.bin \
+              mt7916_wa.bin \
+              mt7916_wm.bin;
+            do
+              install -D -pm644 $i $out/lib/firmware/mediatek/$i
+            done
+          '';
+          meta = with lib; {
+            license = licenses.unfreeRedistributableFirmware;
+          };
+        };
+      })
+    ];
  };
 }
--- a/machines/storage/s0/default.nix
+++ b/machines/storage/s0/default.nix
@ -237,7 +237,7 @@
            globalRedirect = "s0.neet.dev";
          };
        }
-        (mkVirtualHost "ha.s0.neet.dev" "http://localhost:${toString config.services.home-assistant.config.http.server_port}")
+        (mkVirtualHost "ha.s0.neet.dev" "http://localhost:8123") # home assistant
        (mkVirtualHost "esphome.s0.neet.dev" "http://localhost:6052")
        (mkVirtualHost "zigbee.s0.neet.dev" "http://localhost:55834")
        {
@ -251,7 +251,6 @@
        (mkVirtualHost "sandman.s0.neet.dev" "http://192.168.9.14:3000") # es
        (mkVirtualHost "todo.s0.neet.dev" "http://localhost:${toString config.services.vikunja.port}")
        (mkVirtualHost "budget.s0.neet.dev" "http://localhost:${toString config.services.actual.settings.port}") # actual budget
-        (mkVirtualHost "linkwarden.s0.neet.dev" "http://localhost:${toString config.services.linkwarden.port}")
      ];

    tailscaleAuth = {
@ -315,18 +314,5 @@

  services.actual.enable = true;

-  services.linkwarden = {
-    enable = true;
-    enableRegistration = true;
-    port = 41709;
-    environment.NEXTAUTH_URL = "https://linkwarden.s0.neet.dev/api/v1/auth";
-    environmentFile = "/run/agenix/linkwarden-environment";
-  };
-  age.secrets.linkwarden-environment.file = ../../../secrets/linkwarden-environment.age;
-  services.meilisearch = {
-    enable = true;
-    package = pkgs.meilisearch;
-  };
-
  boot.binfmt.emulatedSystems = [ "aarch64-linux" "armv7l-linux" ];
 }
--- a/machines/storage/s0/hardware-configuration.nix
+++ b/machines/storage/s0/hardware-configuration.nix
@ -58,34 +58,25 @@
    };
  swapDevices = [ ];

-  ### networking ###
-
-  # systemd.network.enable = true;
+  systemd.network.enable = true;
  networking = {
-    # useNetworkd = true;
-    dhcpcd.enable = false;
-
+    useNetworkd = true;
+    dhcpcd.enable = true;
    vlans = {
+      main = {
+        id = 1;
+        interface = "eth1";
+      };
      iot = {
        id = 2;
        interface = "eth1";
      };
    };

-    interfaces.eth1.ipv4.addresses = [{
-      address = "192.168.1.2";
-      prefixLength = 21;
-    }];
-    interfaces.iot.ipv4.addresses = [{
-      address = "192.168.9.8";
-      prefixLength = 22;
-    }];
-
-    defaultGateway = {
-      interface = "eth1";
-      address = "192.168.1.1";
-    };
-    nameservers = [ "1.1.1.1" "8.8.8.8" ];
+    # Shouldn't be needed but it is. DHCP only works for a day or so while without these.
+    # This ensures that each interface is configured with DHCP
+    interfaces."main".useDHCP = true;
+    interfaces."iot".useDHCP = true;
  };

  powerManagement.cpuFreqGovernor = "powersave";
--- a/machines/storage/s0/home-automation.nix
+++ b/machines/storage/s0/home-automation.nix
@ -15,14 +15,7 @@
    ];
  };
  networking.firewall.allowedTCPPorts = [
-    # mqtt
-    1883
-
-    # Must be exposed so some local devices (such as HA voice preview) can pair with home assistant
-    config.services.home-assistant.config.http.server_port
-
-    # Music assistant (must be exposed so local devices can fetch the audio stream from it)
-    8097
+    1883 # mqtt
  ];

  services.zigbee2mqtt = {
@ -82,23 +75,12 @@
      "homekit_controller"
      "zha"
      "bluetooth"
-      "whisper"
-      "piper"
-      "wyoming"
-      "tts"
-      "music_assistant"
-      "openai_conversation"
    ];
    config = {
      # Includes dependencies for a basic setup
      # https://www.home-assistant.io/integrations/default_config/
      default_config = { };

-      homeassistant = {
-        external_url = "https://ha.s0.neet.dev";
-        internal_url = "http://192.168.1.2:${toString config.services.home-assistant.config.http.server_port}";
-      };
-
      # Enable reverse proxy support
      http = {
        use_x_forwarded_for = true;
@ -123,28 +105,4 @@
      };
    };
  };
-
-  services.wyoming.faster-whisper.servers."hass" = {
-    enable = true;
-    uri = "tcp://0.0.0.0:45785";
-    model = "distil-small.en";
-    language = "en";
-  };
-
-  services.wyoming.piper.servers."hass" = {
-    enable = true;
-    uri = "tcp://0.0.0.0:45786";
-    voice = "en_US-joe-medium";
-  };
-
-  services.music-assistant = {
-    enable = true;
-    providers = [
-      "hass"
-      "hass_players"
-      "jellyfin"
-      "radiobrowser"
-      "spotify"
-    ];
-  };
 }
--- a/machines/storage/s0/properties.nix
+++ b/machines/storage/s0/properties.nix
@ -15,7 +15,6 @@
    "frigate"
    "zigbee"
    "media-server"
-    "linkwarden"
  ];

  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwiXcUFtAvZCayhu4+AIcF+Ktrdgv9ee/mXSIhJbp4q";
--- a/patches/librespot-pin.patch
+++ b/patches/librespot-pin.patch
@ -1,28 +0,0 @@
-diff --git a/pkgs/applications/audio/librespot/default.nix b/pkgs/applications/audio/librespot/default.nix
-index 9694c3d0cf4f..ca9502de7ee1 100644
--- a/pkgs/applications/audio/librespot/default.nix
-+++ b/pkgs/applications/audio/librespot/default.nix
-@@ -25,14 +25,19 @@ rustPlatform.buildRustPackage rec {
-   version = "0.6.0";
- 
-   src = fetchFromGitHub {
-    owner = "librespot-org";
-+    owner = "googlebot42";
-     repo = "librespot";
-    rev = "v${version}";
-    sha256 = "sha256-dGQDRb7fgIkXelZKa+PdodIs9DxbgEMlVGJjK/hU3Mo=";
-+    rev = "786cc46199e583f304a84c786acb0a9b37bc3fbd";
-+    sha256 = "sha256-xaOrqC8yCjF23Tz31RD3CzqZ3xxrDM6ncW1yoovEaGQ=";
-   };
- 
-   useFetchCargoVendor = true;
-  cargoHash = "sha256-SqvJSHkyd1IicT6c4pE96dBJNNodULhpyG14HRGVWCk=";
-+  cargoHash = "sha256-sUAZgOuBD9CGAy1mRqLRzVnVfxB0DqSCNAc2yzItTCA=";
-+
-+  cargoBuildFlags = [
-+    "--features"
-+    "passthrough-decoder"
-+  ];
- 
-   nativeBuildInputs = [
-     pkg-config
--- a/secrets/backblaze-s3-backups.age
+++ b/secrets/backblaze-s3-backups.age
--- a/secrets/binary-cache-private-key.age
+++ b/secrets/binary-cache-private-key.age
--- a/secrets/binary-cache-push-sshkey.age
+++ b/secrets/binary-cache-push-sshkey.age
--- a/secrets/cris-hashed-email-pw.age
+++ b/secrets/cris-hashed-email-pw.age
@ -1,9 +1,9 @@
 age-encryption.org/v1
-> ssh-ed25519 6AT2/g /5WB1i5RrjWIbnBErUWliedwnv8qTIsl8r8zbWNkOmA
-wr8fN2FbNnCRUNgV3aZPQibXHy1MNjMP9SMK7urHL+o
-> ssh-ed25519 w3nu8g exWaIxM68nwycLphws0PRnRvvdOuT7h3xOZqndsAHxo
-EIUTjS57F5MKGt6bJjaFxHnbTFzUrpmrTVqNZoQ060Y
-> ssh-ed25519 evqvfg SAQyzljqtBd65bpZo6yMsIAS1d5ymjKBoODjOQMUdTs
-/roobEvljSoREVHygqLNKTJHWG6rDdhXmlc4BM/7Em8
--- Gp+OLOIN5aqR3G1fSM+Epdw4B6RTXrB99Ty/YUWI0S8
-ÊžÁ<EFBFBD>¶…Àoÿ;¥3ŽeºÉ<>„Ôu
âT
éÄdŸ«‡ñüÈ<²y{ Jëë¶ñg]nŸþ+QX˜Øéóå´qEÜ™çƒMþË/QàÓÔ#kÉ[8(‚ß5
+-> ssh-ed25519 6AT2/g lQvZqYp05ofMG2kPUYVMOkJssssOmg9lLiTDxscDFHA
+JWRyQo5MqQjz5b+uNLhLYgqOqWpQZdG9dU9ptfhWYaU
+-> ssh-ed25519 w3nu8g kqS10jUVfZqs/x3R3dm0IFGfouGUJUakLjwn0TogbgU
+RbUZQudujtzn7ci1HRchuUoXSyBb/KbKta/QvIbIeso
+-> ssh-ed25519 evqvfg U29OBOuOrgX8/Uhok1AQ8p8inLf+bBWHJhvDWCHkZko
+oBwfJlFRQqUHYlyVRxqqdMkxKe2uTP7Z2ZCwk+Bk9yU
+--- XMwxBGyVUG3OX1m8OnC1Eavnj+HCywi2VFGC6Vnp/k0
+âþd~O7—<37>rÎ˜ªVVÝÊ‰¹„ùnÒ4•bKd÷õïyéœp<Öþ‹,pÖ²Ë¯³Ð"æÒ0CdBMº2kœ 	ÔêñÐÏjú¬ŠØ£ÒØD~§ì%)×4û5
--- a/secrets/digitalocean-dns-credentials.age
+++ b/secrets/digitalocean-dns-credentials.age
@ -1,16 +1,14 @@
 age-encryption.org/v1
-> ssh-ed25519 WBT1Hw ZMrG+yubAhxfDf/hh8gSfxZuvM5hsOBQu/V/KfdcNyk
-un2XWeWmt9pYLAk4n54A52T96sgvasNgD65AiYL9YO0
-> ssh-ed25519 6AT2/g KxgJ1UJ1amcXzpcFmFFi3C3umo70iwmL5GxDaqfk1j8
-VZkDd3vgf1xX9kdzrDhmv2w/Ubq6UUJyw7UAkqmWlOU
-> ssh-ed25519 r848+g MXTm1V8lHIb4oHg0glttyooeECLn0uVrHaY5NzAE718
-Qv+vEeuFz+sew5GmR17ALXKmpfByjwi2j93dMVAU5WY
-> ssh-ed25519 hPp1nw 7dxkddbQHdVi+7dpxBHXYi8pNgMsRjfj8KLqgJFYqQc
-984ysvTIvdjJirkUIfNMEUVKkzUTCBDAOgLbKZj5AhU
-> ssh-ed25519 w3nu8g fC2KGM9/I2Sl0VHkYZy7YbvmF5CMWRIUahgGaGiZPVM
-+IGvvjHj14bV9PS2r0L3pFNV+eDCE63ZmNdHfCG0yCw
-> ssh-ed25519 evqvfg fAr1POoqc5y1stRkCJfgCHSW8QXIPEiFZT0STSP931s
-wFWWX6tPV0mV5HC3be7a2xr4Pax35rT16S0h7eiF990
--- N5A6/IK5wKwzUT20Hxu/37ovLEkLGGj7Y30p1hu5fNM
-r&BãHA%ÇºhŒRÕ²~!Ä<>{bÝ[ØU?‹k(‹µD
-öB7[öùððb/ [¿YçÚÃy[yOCjT-9:†xâ²(;ÝüœXy\¬N‘hÄíòäLPö¼§y¿mG±—ÑÁfŽý4aT<²Š
‡çaŠè†@
+-> ssh-ed25519 WBT1Hw +mmh+AeldhS/z282wz0d6rfklNpQLFE4M+hAL20XH3c
+zyyxtRp6P6ZFdn+1NqVonEfYPtozAgDEZQWnCUbahak
+-> ssh-ed25519 6AT2/g TZYBBcBMnmUegRKEx4tBvbFroHV+AM+KKuE0lNOD928
+w0d0EBpnrF9rk2SH5ROLyqqgmb2y0KD0sDiSa+gt5Vw
+-> ssh-ed25519 hPp1nw bQSu9KjCmPIwjHrw3GXI8F807y1kCi9CvCKE/Q4+fBA
+BbYsl7XxNsDET3ldgQWtJCEI6euMZ/BtghEBxlOo+kg
+-> ssh-ed25519 w3nu8g +MWibl8Un6Ga7bNAaFqZ83H4ERtBfkAeFI4q6BtpUHo
+mB4oxmiYNgrUBwNrG5slhQtT6yttSWiaq0M0DYGrK8A
+-> ssh-ed25519 evqvfg gcBt9ZQ2Um08Q1b1k1UQhj0oUpLbKLuFycs4cfAe/G0
+YMK/4+LfAYuj6TwT+NOdLQNHfuj9rnhFaNUu+tkMX9M
+--- 9dISdhi6vbWXis37GEw2vb/ZaBFR3srYKlyc0N1cEP0
+¹ÙÍhž~ó 4ZK1y¨tuïád,¹Àþ<7F>zôÐ(´›W6È]ïZïö?‹S0òQ;*ôêÃvw£~ÎGPÁì
+BÚí@,‰à\1gø.^Œ3)Z£f$xæS˜Ô&4…„ŒÆ<C592>¸¶mýEj[OK:Z<>L
--- a/secrets/frigate-credentials.age
+++ b/secrets/frigate-credentials.age
@ -1,9 +1,10 @@
 age-encryption.org/v1
-> ssh-ed25519 hPp1nw p8uus03Jrn9HtEelmufFx2orYkSlyAq90L7bTm3n/GQ
-Ki+Pf1RG27H2wmgxXz2u7fqlU2hrxTmBZCn8RMIh8wI
-> ssh-ed25519 w3nu8g UQQYC93hQLRIgaA5P3Upax2HzfNddWkjTkAyZF5/hFs
-33fVUBBaJFRhDIuZoM8Rn1fd0JwqjmyXsbu4pioxXw4
-> ssh-ed25519 evqvfg /J1fpbZORlnYADjqAcF8kV81e+mlxXC4mhMwozG7YXw
-KYAtHd1MyNiEKoN/RgBCOsn/uCvXIjusXPFWW4urMFY
--- KVdBWZjlOA44GAK3GubvPaXlbg1zdpxL7+rJ4hv4Lmo
-X/{×[PĽćÎĹ+ł$_Z,t\#e¶ĐĂfńř>„,0ié©Ě’;ţ°ÖVńB§QÍ8,Řëńú'JŞR×•=´ŐLś–ęÉäęLłÝ@běđp?HĹM¦2—uÁňł€ŕÝp'g:ÄWŔ;YXs©ÍóN ĂO´m»y~Łň
+-> ssh-ed25519 hPp1nw z8hVbU48K+xyH8zxVXjy7sE35GcdSTeGIu/ywdtRBkQ
+ynwH7Jug9yK4iCLYIwUn5paYQISWDVYTkq+7rklAW8Y
+-> ssh-ed25519 w3nu8g hP/IbrLUi/tvOOu5pRKWGIfbiGnQofR/s7V9kUcMUzs
+kZLewvTi5JQ5enF5Bl7wiGUJ2W3THTQVXkyXhLM/Xqg
+-> ssh-ed25519 evqvfg s+mq+Pr3fCKSm6dG+p7tF1piR6KZztgH/j0+0S9W7i4
+T9KzT/+WK/XOeuWIyf2/eNQz/ytmOYzAjzzZmlY2Ppg
+--- A4sCAKn9DQwaSQIdyRYe9XwKvMosCLmdP7RQId7l6vA
+›BQ{™Uœƒ¢þi&º°ÞV,çÝÜ93÷¸ñl`™<Ê‹(à½îÇÆ×-«=ÇÒivÒ
+Ò&7»Ë#&ÍÿìÍ‡ß¿Ûee™<65>š€Kˆiç Ì×à–Â[e¶û·Þ®‹lD?¥œU-Nÿ‚pÐ,þ¤c×Ÿ-
!LMÝxh™¾<E284A2>é‡º³
--- a/secrets/gitea-actions-runner-token.age
+++ b/secrets/gitea-actions-runner-token.age
@ -1,9 +1,9 @@
 age-encryption.org/v1
-> ssh-ed25519 hPp1nw 5wFHyqBRdZxUDa180U3RgrL4DWNF3BO60C1ytWdZvXM
-anPvoQk7kvz/wBddKYquSZ7b6dslhIrhV8wnMpC725E
-> ssh-ed25519 w3nu8g McO3H/GkcqQavMokZhXAsRijGq0wiXzmN1GH29n12wg
-ooFxa+vYd49JSwdj9Knc8iDFyxX4elDb3IjOjrC5Cmo
-> ssh-ed25519 evqvfg pW/T4WXURnk7G+HL+O3STBWkQ+5by7EgwOPTcMNakyw
-HByJjWNhOg7PSms4Px9NO0FnFcMj1Ig2rOXhCNQri7Y
--- LCgnSaNDEKv8du0OxZoLtyF4W02E/6pC/e1h0+XDDGA
-õViÁ°“ìbð[¾í<C2BE><C3AD>%þÚ{œtäL8àP‚[¦2z{g/KG®üÈAëZýåšœÂïàþ0pÃSg²…ó¶µ¿P³ÊYÊù—$•á
+-> ssh-ed25519 hPp1nw bo+iestejjHIx0accmbyOgLJPRH5xMugtfwKgax+DCU
+smaxrCeUgUu9a5mnFlDBbTbw7gNFcLi6mVb3px8gYk0
+-> ssh-ed25519 w3nu8g bhpGV/Yfqfl7mrBgjCgVZEJIsRjXVOmQ2rU7dh+FQzw
+2irMVi9Vx3/PZT4fqYfcnU7q7wRCtUFOUPZ/X6fQuXw
+-> ssh-ed25519 evqvfg aic8EzOuwt6ojUoHaAlhy0IWmSzuOvXjBQrK/QSS2Vs
+tfw0GyfsovxlMeySyQULMECEoiEjPtdkoQ4OP/t9K9s
+--- uNvusvjFFt4Fza4a/hmns/tWm9LTE4fULWJ/1Gg3Izc
+Ax™ €¶;²þ¼[§²oÿ’®“'Lâ@«ö·^<5E>~9\jvCúUÏ³$¦§hqÉ<>ú2–Ht?y\vËÈŒ<C388>ð`K!®7Yàï7Ôü
--- a/secrets/hashed-email-pw.age
+++ b/secrets/hashed-email-pw.age
@ -1,9 +1,9 @@
 age-encryption.org/v1
-> ssh-ed25519 6AT2/g kH4DufpuybglKzupJsGvWKfWsZ5xhRwefdPKkx/AuW4
-QrDu/vSbgEIgYSnraG5u37RNp6Mp6ARjqzAduy9iX/Y
-> ssh-ed25519 w3nu8g mBt4VQNJAMwcseVhc8k/mB5XThbQT48OnstkWaGQ8zQ
-6w7lMJA8giG9PVux1ncjCPrN7ER0S7uWi8UjhOOeMS8
-> ssh-ed25519 evqvfg uM4SAf1aMCvtRKdPn5BFr1EWlBGVgbgjp6OkuMV7GnU
-Zi5X5TL7phRpwsbUVsFgS0qHvqtLdckz01qDfVypn/s
--- I92hNxGkHSHR/fQhUI5UAXvzIvMd+YBih9nFP5IZW3w
-áÎ_§ØN/	nÞúú®H<C2AE>ô¡ÒaŽeõâ¼ÈêÅhÊB¤ê»[Ô´ðªqÂ<71>\ý+M:F‹Üîñ‚gP¦¤¤nh’¨¼N/¸2ÞÇl8µ3q>	rHt’UJG×n
+-> ssh-ed25519 6AT2/g kXgY0gJW/LpFYNukKCxa/Dhht4hxmoht+CIENXngW3U
+OFTjvs35H2HLGENEChI9fEowlvp6W7hTWFNRZ1PziW0
+-> ssh-ed25519 w3nu8g jWZ0COxc+hFs7bVNTKcWa7oBmLqPmlqktpZ0gpwIUEo
+xf4aKirzqHUWppJghPwyCj6SzPntH5gxcP3ch659RIU
+-> ssh-ed25519 evqvfg KR2lx8vs0Eseh37tLtcfDDXE2BoyxCr91vqlnpJraA4
+5HiO7QB7sAC0YlDgkq4gOH0Pp83et9+0UPS8+BA+juk
+--- vt6f6yWyfunZS7pihgt97hFccp0hqlkOeLWdfsq5SAo
+Z+äœm8¬¸vÕ[ïg_K×s™¼8·1hÙÅ1šüžü¤ã´»=@.„2À=ºÛ2?—<>µ¤8\‹›f§3oy÷ga8¾(.•²?¶8m–¹t‹ã<E280B9>,½]«ú
--- a/secrets/hashed-robots-email-pw.age
+++ b/secrets/hashed-robots-email-pw.age
--- a/secrets/hostapd-pw-CXNK00BF9176.age
+++ b/secrets/hostapd-pw-CXNK00BF9176.age
--- a/secrets/hostapd-pw-experimental-tower.age
+++ b/secrets/hostapd-pw-experimental-tower.age
--- a/secrets/iodine.age
+++ b/secrets/iodine.age
--- a/secrets/librechat-env-file.age
+++ b/secrets/librechat-env-file.age
--- a/secrets/linkwarden-environment.age
+++ b/secrets/linkwarden-environment.age
--- a/secrets/nextcloud-pw.age
+++ b/secrets/nextcloud-pw.age
--- a/secrets/oauth2-proxy-env.age
+++ b/secrets/oauth2-proxy-env.age
--- a/secrets/pia-login.age
+++ b/secrets/pia-login.age
@ -1,12 +1,12 @@
 age-encryption.org/v1
-> ssh-ed25519 6AT2/g rk3jNJlQwab++isNOPpQJZlb4rL7nIAYfoAhlvY9QTc
-J+6/MRepeixmDQzz3bRd/AMJpZls60dUBjrHh+p759Y
-> ssh-ed25519 hPp1nw GnjIH+V6mLcXvfNhiBBwqBvY6NO8W+1sPcgvu6fS0nI
-qP6jDxd+0h/AZhsBs7om0BDutrPmP/1NUEuZ7LBlxmw
-> ssh-ed25519 w3nu8g QwztUaCCtEVeI9AbJn5dKH07Y2fal+Nn9/bsnBkTJgI
-/Ce0a9bGv6RmQiK8C3wIvMCh5DM+m/EujYFsXgNjieY
-> ssh-ed25519 evqvfg VLoQNzz62Q1KawvTHWeyBfCGTlGYNPQcdTaPq7cLxDo
-eabkTR9iUPYqCj50R7rwYcrMqcs+RHWqRZai2KKzPMQ
--- fQkT/xI/iptJd/UmihEcUWx77d2wr6bOj5lecPa/P8o
-,V„ý²lzºOP¿'Ìü2ÑÃ4¦o¸ü|ÅK‘m÷´»²FYL†Ì&ìâÓáéÊÁ>†©Ä\@emVÈnŒm½®6nôu—O@wRèãÁ‘åý^_
-ztFŠ©~
+-> ssh-ed25519 6AT2/g nn9O3nzI2M9+vKJ3qoKL3xs29iYp2n01xTrmtdbzs1k
+atqBqI77ADuCnV04skh/2KCco5Pgwlz0vSnruiI0dzU
+-> ssh-ed25519 hPp1nw tBTDeKMPoCpuoQNdnHdggQdpeYYRXhtJZqCA+o5CPkg
+q5BYRcZYY8oGot4F5fhx6hZfVpClvOTycQ6kMTXykqk
+-> ssh-ed25519 w3nu8g C80+Mp8qRkpSfJBCH3XduSv/oT2bJ6TqVxkyh1NfRFo
+9EEh97C2uFzP3a8DB+4YEgjqJyoa97rRT9tXEFGbMFE
+-> ssh-ed25519 evqvfg qByh1A/4ylqHIuvvMqHl0lGBxwWIlwz+pGDdox6zJXE
+Ubym3YKOcekSR+O6dLD+322Kgk3152WDW+Tsu32MYY8
+--- 4QA63y/d1AXP95G6MHZLJlVyB8LSPVO886QcT2j2tVo
+~H«;ùœe¹g<C2B9>7Á7+e|µ!ÿk0à€e•hšì?³k^m¯kDPõ}Ê\<iißv[ÆzOÚ÷sýSe¾ƒŸëTØ>Ë£¨+ŒÙ	ü®¯ÏÁáš5[Âíåä
+Éÿ§7ˆ
--- a/secrets/radarr-api-key.age
+++ b/secrets/radarr-api-key.age
@ -1,9 +1,9 @@
 age-encryption.org/v1
-> ssh-ed25519 hPp1nw MRItBkM6GC+jht3ly0K04wCptE28UI9FmFAm2+8KHHw
-Pbz+oZcWtzSz4eyWyRbi/a89Q3PripNJ+PYM/wiLKq0
-> ssh-ed25519 w3nu8g a5G6FrbGmglm2Ba2T6NPsaVP+/4g//jh9ui/BVzR0EU
-f0xNuCbhC0FqqFH6CD9jPAgWmTEZqga/fRjU6VMdfSk
-> ssh-ed25519 evqvfg 1lhGzpY7I0fKimq6sQ/zWUHCFSEaN31rmGCckUepfHY
-3OfNrzAajS6azIT90CmVnBzXLXcwMw/BRhOfbcuuz3c
--- vagzuZWeWUcZTBISnL4vNVcpMX2CbJGHwfaAFiIZeHM
-en¼!<z'ß‹û,W
8†}òÃ™ö=åà—lõÖŸê^^56èiÌ”½àÜd<C39C>æß»ü<C2BB>t.yçw>_%
+-> ssh-ed25519 hPp1nw Uhd03cBQ85Yw4FjsXkBDfrcAsTBVVOFVFrnU7sPbTXY
+/5XIXty9cNwNPV/MXdjoOttmKMXt6PB0/7OMSl7scZ0
+-> ssh-ed25519 w3nu8g CzC59hO2YLD+Bbzvi62KXvFlyPXrx/OD8hVeQH3hfFU
+V7OtV9QjRYNg2+kMk1K4V9RWb8AsgkQ4OlIRs7hwYyo
+-> ssh-ed25519 evqvfg XTSo+9xdmL57Mkc7NNw3Xy1kJrE0Sc+81h+OEHfiCVc
+PguEYlZkPMMiMaEpK+gamgl7V9/gaEUpUuV8O8tIUVs
+--- 81iRaeiLWHHzFBoWSa6JFdp9mkKZ1TT9mdRXZaQ4N0M
+‹»J
:“ÅŠ¶R9RrT“P	Š‡<C5A0>N™ùÊÃâi%¦ŒÛº/”L{…½©ª‡1§^ÿÚìO©ÁÓÒW:<3A>ËÒ<C38B>Ÿo4
--- a/secrets/restic-password.age
+++ b/secrets/restic-password.age
--- a/secrets/robots-email-pw.age
+++ b/secrets/robots-email-pw.age
@ -1,9 +1,11 @@
 age-encryption.org/v1
-> ssh-ed25519 6AT2/g LnQtCha5IIh5zokvLXRVBrL/Szq4Xpl/069ErdPhz1w
-E2M0aK4aRgiTpqSYB3Bzpy7ZqayES5LomFDf+faxVXc
-> ssh-ed25519 w3nu8g HHwFH0wJFiDre/GNjcYQd28bfo1lZ1FIsEllnVhsL2M
-PX1y17/8uuExa7KEQYtprfTNSDPczr/SE940xaZARB0
-> ssh-ed25519 evqvfg SArOP2lww7Tlh/r4bD4mKTJcdpGyoaUn6VI3geYZvDo
-Wz9Hi8j3fMSYcM5ek3nQg9ErHHP2lMgdk5Ub3n5Aw0A
--- igI6cN3XWmK1V3Zy0V9wgC6vsOvBsjrKu2B4gVbEIRY
-A‘š5”b<EFBFBD>yNß^1_`¦<>±ïüB©Èè]O“C<E2809C>kâlMxêºÛÖá²—7[1$‘e%d#d¨ÈÙ‹³Á°°þÍl´êŽßmª“úJ!ü9y¢¯Øý
+-> ssh-ed25519 6AT2/g HGqc2dbbCJNR5JR8mNfM8VRSBAWGzvBR0IdQVTM3jys
+speCXu0Q79q8DXVpxYKacTh3zq0/6KXdWc1yvMJCrwA
+-> ssh-ed25519 w3nu8g /ArJSkSyJ0+/GGUln+PULXLu2v9IFatasIZ4d97ClnQ
+tsoXfqg2mC+3YVPHVvkrqXCN6CEpOGDBrS8vzBLkrXA
+-> ssh-ed25519 evqvfg qJ+4dEvSS8E9tI3q0iXJAnqEZqEE6s2Hn4BAgkjWaEg
+1s0rlm960TEiIefYqdqwMgff1A2WTavuq0e3GNrxFi0
+--- KbFFpe+ZN1XxXV6biHn9Vm1jw1ZaN0/wAW9/GmrQdJ8
+i
+2w°„ÙÈx¦»$ÝÉ©;8su¢è€\G˜Ñ£¼SÑ'†.Ü*&¸ýQ^¸&$B/V¥8±Ëï?Ñ¨ÐÖ´¼Ö Åx§
+;*¡)HCË
--- a/secrets/sasl_relay_passwd.age
+++ b/secrets/sasl_relay_passwd.age
--- a/secrets/searx.age
+++ b/secrets/searx.age
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@ -38,7 +38,6 @@ with roles;
  # services
  "searx.age".publicKeys = nobody;
  "wolframalpha.age".publicKeys = dailybot;
-  "linkwarden-environment.age".publicKeys = linkwarden;

  # hostapd
  "hostapd-pw-experimental-tower.age".publicKeys = nobody;
--- a/secrets/smb-secrets.age
+++ b/secrets/smb-secrets.age
@ -1,17 +1,17 @@
 age-encryption.org/v1
-> ssh-ed25519 N7drjg lVrCcpRGeAJ+62CF+fTT+iGKmaaiBk2rmtzS3jz4ux4
-BbMLKa0uCoopsV0BekIcApzyJggQf4uFICuC26inA/c
-> ssh-ed25519 jQaHAA k7JCJlbAKDuH+bLhaoiQQssN5gfwPw9w30J3OAA4nWg
-fQ6te5iDG54mn5oXdarxMYPeze4ZWbk1yPAsLsTFby4
-> ssh-ed25519 w3nu8g r3wLOavRLT++n+NaBRtcQqKXFTFhRYGl8naqUWNR0kE
-pYkqQIiwzpN/XkDBrfCuFPc3yzyFjRbdCcFmRaY8iIU
-> ssh-ed25519 evqvfg b+BUWYHdu1z38I0BMqpkSf5qaeaCm2C+vf9Hcqgjlg4
-PK0y5MadYrM9ANyTMdHKXRTNi5cwD8/+19mN+vaTNiM
-> ssh-ed25519 jQaHAA 86i8je5q4vVBfdi/Ws8/n4R/Z25uLw1e6zXDza8SwiI
-5yuvdl0InHxrjRyi4SJOWEo6pWZt/mX8BsaFer3NwlE
-> ssh-ed25519 w3nu8g N2QWi7I8V//jfK2ZGsXwBkEt2Zh7/5zpWCKUNV30bFA
-ZmjY/lwFaVeM88FZSGwG+BYHi+32UPffZPZPbVcw+J8
-> ssh-ed25519 evqvfg cZflDyFn9H85TnSbi2HFrdVvlT5uZ+6+l4stOaoyOxE
-3HpWWCbWoU1ufbi02xpXnU47Ti6YjrpMVh/mS5jgO0M
--- wF990HQn1zh8JVo2alfC/QhpFimLsLDtj26DREVYr18
-QhE{+ĺ¸»R(+ ÝNYIľ›Ť<ýęţ’k¦/ČÖŻ„pA<70>Ý¶°Đ_ž'ËĹ«ž‰@3ů;»°÷-0‰Çˇa€b9W5ÔĂęźbU3)ASóĹ÷Śe÷ůQ/SMJ“_šĹe<16>Ža*‡:ť<>µ
+-> ssh-ed25519 N7drjg EazSO4KSpDf7Xi3pTNdhm800ZA5EIIhMbwYp+L42yD0
+FDktPGF+bWrlPuwD8QNId3tUxt3kPO5JZ9GQ1B4vtPQ
+-> ssh-ed25519 jQaHAA 2UJ/6JUgZBaiVVj6Y43dIvebrozJW4kuR5xfWIWSVSA
+nhZ/CMdHMIN/GjFV/WMmNvRkPYcmgtjihFtNwASS/4E
+-> ssh-ed25519 w3nu8g fLbN1n9ncJz5xW4BnmOfOMI5tdODrZGwhOczWz81NDc
+MP1Z2q1KMmvh76opIwG9ZepFiLRJBnfnGKAGSLvb38k
+-> ssh-ed25519 evqvfg ZgT1jg/k43AdfVIny9i3PxD0FRG3CWHEKJwL/r/VX28
+Qme90RlNTtlDZcCbbxmJQ1BHphkYC1fLA7MKWTn+jEA
+-> ssh-ed25519 jQaHAA C5hiPm6jr4TZa+Hl+ruODqSvl9PAx7bvhAMPiNjCe00
+2trojxFes701L8D1XvWPQBCWJB6rwgppPcGK3jDhCBY
+-> ssh-ed25519 w3nu8g IuWEPi/Tacoc2Oyey92eJQun4r0RGjY6GAd8oHTQ4Xk
+u6iVh1p2x/ACIHQO9mcVuR3Xmq2ln/F97vlYjWphvMQ
+-> ssh-ed25519 evqvfg q1Xp4IxCTofR+RDdi1Hoy+8NOO45u1U9/m/t6eBDUhs
+WkQKg8LGQoIPuICvj7KcvgF4RMyG15txHG4uFg3v7X0
+--- 4WXmmAwvor5BDjArHN3T37/zxKOO3c8jtMaxGigAcMA
+øÐ¶[îîj‹¿Ž U.wÁó@<40>ŸBHr7Seª/‰»x©í1;ÝÂSUÔ(¤8µ¥¸{Ì=µ¦N²Ý±’<C2B1>ø;_]ªÝVY2D‹¸";úµã×Câ•ùûì7‚§-.’¡üœ‚VÀr±
>*2T
--- a/secrets/sonarr-api-key.age
+++ b/secrets/sonarr-api-key.age
@ -1,9 +1,10 @@
 age-encryption.org/v1
-> ssh-ed25519 hPp1nw aoj3IvYutQWfkOYOcDu0g7/FX05Y1t5NE2dP/x50gw8
-KV2kpClMmBPavyyhtC2coc3Gw9/QJQwXxfM13aKRrvQ
-> ssh-ed25519 w3nu8g ZjQIXYV3oK5ppG9ltfojwZ0Z93wFvXdiVBnFz5ncSSQ
-CI3je4tMSb9ws+IyAgBVokFdy7z23n2EwtDrvLTziM8
-> ssh-ed25519 evqvfg bWwaEp5s9nvzzQXbPd3rwmy4Ei9PWZg3Gk2I1nYBcCM
-PwLLVWVI0GY4snYRadT92NZFneuA54yzL+Ie4RWDxDk
--- aqM1/sssbDgs4DNsGHqiaVH1LCyhh0vtoHSD3ju67Ew
-&ﾈﾞ<EFBE88>ﾀﾆg~ﾊ*Y<12>訷E┴<45>ﾞoE,yｾﾜE{濁ﾁ瑩ｬ*ﾚ訶_A=ｷ6=怨M'燕ﾍｧr0<72>
+-> ssh-ed25519 hPp1nw F3GP7ySGf2wVUdTr1K6iChf0DczmaMnJjDWNl4sIVws
+NgfyXX4F14kyrgzuMfExb3D4pY31tzFjGkq2UmC3JMM
+-> ssh-ed25519 w3nu8g tnpGVKL1bYFJOhbbOa+TyEOhaXTVUk9D7HtSUWoM+WA
+cM8Jm2uKXkt31UFFdSWq3pClQhJZXUksEBMq1/xu7GE
+-> ssh-ed25519 evqvfg A3Ght96pdzoWpNpX/jmoBOz+uQUaoF3C2yw+VCOe22c
+btao6WVQSwHv07hnkbpv44Pc7r3Essyoz3Spst+pDMQ
+--- J1ZZ/XeiLUpkfOl6xOckks4FxqdzPZJyglYhZf4Sa48
+¡°è5 ó#”I¸m\í˜Eñ"žH,s<>»{l¼'!—®¢Ë‰zú¿ƒ?ZÁ@·õ-áX´>PÁG
+)+S½
--- a/secrets/whiteboard-server-jwt-secret.age
+++ b/secrets/whiteboard-server-jwt-secret.age
--- a/secrets/wolframalpha.age
+++ b/secrets/wolframalpha.age
--- a/secrets/zigbee2mqtt.yaml.age
+++ b/secrets/zigbee2mqtt.yaml.age
@ -1,9 +1,9 @@
 age-encryption.org/v1
-> ssh-ed25519 hPp1nw FnUaydWe7+2dVUIYrKqx2/0AzRPN3ZylczJBkTqeeXg
-boSEnMZmQyre4mJBQkEPuXuRP90woU1obqMdh+uQKhM
-> ssh-ed25519 w3nu8g pIDzDUVLZuZUCn6tGKpCLVS7OmhQiMgtMvuCKfWcgiM
-zZxCUe0LslQ0ZqHV6sSMNQ5fhyscDFxVmJk0h2voEfc
-> ssh-ed25519 evqvfg eukXn1jUoHwP/cVmYCJ1O0kYQw+Xsad1PswvbcFUMEk
-B0AvuWyfqK8ZFgCAW/iuXB0sKoKmB9d62ZNRTdDG43w
--- 0aziJ5/DCB9kJUqWhIggCqRnsuqu9s/g4Rt4vbwsBJk
-FVÜçi`í1¥XFI–ÇI´@ŸoÞmf§Á³¤õ“ˆQ=ñè–å½ˆè‡¼i?²¿ƒb?Á
P6ŒA„-“°ÉY´°[Gö9<C3B6>ó î¥„½ÇÕ
+-> ssh-ed25519 hPp1nw WkcqGYW9EwuqwdPa22bZ2yyxxSUlfZ1Y+NggCyFR/Qc
+Nccy64qgRnPj+6pDRPEvHCo4TRszDL5x8NUoljvAeZ0
+-> ssh-ed25519 w3nu8g gr+GjbS4lanuXX6QRpzMl/3cuLInJ+djyoSnN/tH5xM
+md07riIXJ2eH43nL8SJFU+dThXu3kUePO/ZaV9iuS4k
+-> ssh-ed25519 evqvfg rP45WmM5H7O8dFoOQHPeVDY0JqiIDYgJsPyQjh4jC1w
+R7VH7PhaSCRW5bUAgC0Rlic6FV0IAiqKWFA8ah4/3Q0
+--- tyRX1o1ewWqSvvaHYQjzare0j6oW6VT1tdnqTN4Or34
+"T÷¶áÁÀŠ„Z»SãµˆÕ±7ƒÜëW—v¡¨[Êi ˜¹CÌÓÜ»Öä<@°yuƒlÊÇ½’Rsò<73><C3B2>ƒ¸äÍí“´¬y¬`«{ò_Í