wip

common/pc/chromium.nix

@@ -80,7 +80,6 @@ in {
     nixpkgs.config.packageOverrides = pkgs: {
       vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
       chromium = pkgs.chromium.override {
-        enableWideVine = true;
         # ungoogled = true;
         # --enable-native-gpu-memory-buffers # fails on AMD APU
         # --enable-webrtc-vp9-support
@@ -90,7 +89,7 @@ in {
     # todo vulkan in chrome
     # todo video encoding in chrome
     hardware.opengl = {
-      enable = true;
+      enable = cfg.enableAcceleration;
       extraPackages = with pkgs; [
         intel-media-driver # LIBVA_DRIVER_NAME=iHD
         vaapiIntel         # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)

common/pc/default.nix

@@ -14,20 +14,25 @@ in {
     ./pithos.nix
     ./spotify.nix
     ./vscodium.nix
-    ./discord.nix
-    ./steam.nix
+    # FIXME make optional
+#    ./discord.nix
+#    ./steam.nix
     ./touchpad.nix
     ./mount-samba.nix
   ];
 
   options.de = {
     enable = lib.mkEnableOption "enable desktop environment";
+    enableAcceleration = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+    };
   };
 
   config = lib.mkIf cfg.enable {
     # vulkan
-    hardware.opengl.driSupport = true;
-    hardware.opengl.driSupport32Bit = true;
+   hardware.opengl.driSupport = cfg.enableAcceleration;
+   hardware.opengl.driSupport32Bit = cfg.enableAcceleration;
 
     # Applications
     users.users.googlebot.packages = with pkgs; [
@@ -40,8 +45,7 @@ in {
       element-desktop
       mpv
       nextcloud-client
-      signal-desktop
-      minecraft
+#      signal-desktop # FIXME
       gparted
       libreoffice-fresh
       thunderbird

common/ssh.nix

@@ -5,13 +5,15 @@ rec {
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO0VFnn3+Mh0nWeN92jov81qNE9fpzTAHYBphNoY7HUx" # reg
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHSkKiRUUmnErOKGx81nyge/9KqjkPh8BfDk0D3oP586" # nat
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeTK1iARlNIKP/DS8/ObBm9yUM/3L1Ub4XI5A2r9OzP" # ray
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKXc9PX3uTYVrgvKdztk+LBh5WMNBUzbXlAo50SCAeNw" # nat 2
   ];
   system = {
     liza = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDY/pNyWedEfU7Tq9ikGbriRuF1ZWkHhegGS17L0Vcdl";
     ponyo = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMBBlTAIp38RhErU1wNNV5MBeb+WGH0mhF/dxh5RsAXN";
     ponyo-unlock = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC9LQuuImgWlkjDhEEIbM1wOd+HqRv1RxvYZuLXPSdRi";
     ray = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDQM8hwKRgl8cZj7UVYATSLYu4LhG7I0WFJ9m2iWowiB";
-    s0 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHkTQNPzrIhsKk3OpTHq8b7slIp9LktB49r1w/DKb/5b";
+    s0 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwiXcUFtAvZCayhu4+AIcF+Ktrdgv9ee/mXSIhJbp4q";
+    nat = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGVgZc5Z2Oh426z7lEftcFUwCFcrZy8bvqS09Tj49GWE";
     n1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPWlhd1Oid5Xf2zdcBrcdrR0TlhObutwcJ8piobRTpRt";
     n2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ7bRiRutnI7Bmyt/I238E3Fp5DqiClIXiVibsccipOr";
     n3 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+rJEaRrFDGirQC2UoWQkmpzLg4qgTjGJgVqiipWiU5";
@@ -26,6 +28,7 @@ rec {
     liza
     ponyo
     ray
+    nat
     s0
     n1
     n2
@@ -37,6 +40,7 @@ rec {
   ];
   personal = with system; [
     ray
+    nat
   ];
   servers = with system; [
     liza

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1652712410,
-        "narHash": "sha256-hMJ2TqLt0DleEnQFGUHK9sV2aAzJPU8pZeiZoqRozbE=",
+        "lastModified": 1665870395,
+        "narHash": "sha256-Tsbqb27LDNxOoPLh0gw2hIb6L/6Ow/6lIBvqcHzEKBI=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "7e5e58b98c3dcbf497543ff6f22591552ebfe65b",
+        "rev": "a630400067c6d03c9b3e0455347dc8559db14288",
         "type": "github"
       },
       "original": {
@@ -100,11 +100,11 @@
     },
     "flake-utils": {
       "locked": {
-        "lastModified": 1653893745,
-        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
+        "lastModified": 1667395993,
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
         "type": "github"
       },
       "original": {
@@ -136,17 +136,17 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1655456688,
-        "narHash": "sha256-j2trI5gv2fnHdfUQFBy957avCPxxzCqE8R+TOYHPSRE=",
+        "lastModified": 1668994630,
+        "narHash": "sha256-1lqx6HLyw6fMNX/hXrrETG1vMvZRGm2XVC9O/Jt0T6c=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d17a56d90ecbd1b8fc908d49598fb854ef188461",
+        "rev": "af50806f7c6ab40df3e6b239099e8f8385f6c78b",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-22.05",
         "repo": "nixpkgs",
+        "rev": "af50806f7c6ab40df3e6b239099e8f8385f6c78b",
         "type": "github"
       }
     },
@@ -167,11 +167,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1649408932,
-        "narHash": "sha256-JhTW1OtS5fACcRXLqcTTQyYO5vLkO+bceCqeRms13SY=",
+        "lastModified": 1669411043,
+        "narHash": "sha256-LfPd3+EY+jaIHTRIEOUtHXuanxm59YKgUacmSzaqMLc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "42948b300670223ca8286aaf916bc381f66a5313",
+        "rev": "5dc7114b7b256d217fe7752f1614be2514e61bb8",
         "type": "github"
       },
       "original": {
@@ -246,11 +246,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1655214255,
-        "narHash": "sha256-hgFF2X9mxFieekDh2VoVAtgwuM6XeAwzvb53yakmjTg=",
+        "lastModified": 1655930346,
+        "narHash": "sha256-ht56HHOzEhjeIgAv5ZNFjSVX/in1YlUs0HG9c1EUXTM=",
         "owner": "simple-nixos-mailserver",
         "repo": "nixos-mailserver",
-        "rev": "a48082c79cff8f3b314ba4f95f4ae87ca7d4d068",
+        "rev": "f535d8123c4761b2ed8138f3d202ea710a334a1d",
         "type": "gitlab"
       },
       "original": {

flake.nix

@@ -1,6 +1,6 @@
 {
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.05";
+    nixpkgs.url = "github:NixOS/nixpkgs/af50806f7c6ab40df3e6b239099e8f8385f6c78b";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
 
     flake-utils.url = "github:numtide/flake-utils";

machines/nat/configuration.nix

@@ -1,17 +1,52 @@
-{ config, pkgs, fetchurl, lib, ... }:
+{ config, lib, pkgs, ... }:
 
 {
   imports = [
     ./hardware-configuration.nix
+    ./m1-support
   ];
 
-  efi.enable = true;
-
   networking.hostName = "nat";
-  networking.interfaces.ens160.useDHCP = true;
-
-  services.zerotierone.enable = true;
 
   de.enable = true;
+  de.enableAcceleration = false;
   de.touchpad.enable = true;
+
+  # nixpkgs.overlays = [
+  #   (final: prev: {
+  #     signal-desktop = prev.signal-desktop.overrideAttrs (old: {
+  #       version = "5.50.1";
+  #       src = final.fetchurl {
+  #         url = "https://github.com/0mniteck/Signal-Desktop-Builder/raw/2610eaded94b3c717a63fdff3cb872dbbaf16383/builds/release/signal-desktop_5.50.1_arm64.deb";
+  #         sha256 = "sha256-++xG3fCMvU+nwlkBwjZ0d0wfWiNDSUhyCfzTirsY2xs=";
+  #       };
+
+  #       #buildInputs = old.buildInputs ++ [ final.openssl_3_0 ];
+
+  #       preFixup = ''
+  #         gappsWrapperArgs+=(
+  #           --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ final.stdenv.cc.cc ] }"
+  #           --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
+  #           --suffix PATH : ${lib.makeBinPath [ final.xdg-utils ]}
+  #         )
+  #         # Fix the desktop link
+  #         substituteInPlace $out/share/applications/signal-desktop.desktop \
+  #           --replace /opt/Signal/signal-desktop $out/bin/signal-desktop
+  #         autoPatchelf --no-recurse -- $out/lib/Signal/
+  #         patchelf --add-needed ${final.libpulseaudio}/lib/libpulse.so $out/lib/Signal/resources/app.asar.unpacked/node_modules/ringrtc/build/linux/libringrtc-arm64.node
+  #         patchelf --add-needed ${final.openssl_3_0}/lib/libcrypto.so.3 $out/lib/Signal/resources/app.asar.unpacked/node_modules/ringrtc/build/linux/libringrtc-arm64.node
+  #       '';
+
+  #       meta.platforms = [ "aarch64-linux" ];
+  #     });
+  #   })
+  # ];
+
+  nixpkgs.overlays = [
+    (final: prev: {
+      jellyfin-media-player = prev.jellyfin-media-player.overrideAttrs (old: {
+        meta.platforms = [ "aarch64-linux" ];
+      });
+    })
+  ];
 }

machines/nat/hardware-configuration.nix

@@ -4,22 +4,66 @@
 { config, lib, pkgs, modulesPath, ... }:
 
 {
-  imports = [ ];
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
 
-  boot.initrd.availableKernelModules = [ "uhci_hcd" "ahci" "nvme" "usbhid" ];
-  boot.initrd.kernelModules = [ ];
+  efi.enable = true;
+
+  # 4k kernel for m1
+  hardware.asahi.use4KPages = false;
+
+  boot.initrd.availableKernelModules = [ "usb_storage" ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
+  # fix keys
+  boot.extraModprobeConfig = ''
+    options hid-apple swap_fn_leftctrl=1 swap_opt_cmd=1
+  '';
+
+  boot.initrd.luks.devices."enc-pv" = {
+    device = "/dev/nvme0n1p5";
+    allowDiscards = true;
+  };
+
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/02a8c0c7-fd4e-4443-a83c-2d0b63848779";
+    { device = "/dev/disk/by-uuid/f3021c34-2034-4bf0-bf3f-64d6d02c0eff";
       fsType = "btrfs";
+      options = [ "subvol=root" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-uuid/f3021c34-2034-4bf0-bf3f-64d6d02c0eff";
+      fsType = "btrfs";
+      options = [ "subvol=home" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/f3021c34-2034-4bf0-bf3f-64d6d02c0eff";
+      fsType = "btrfs";
+      options = [ "subvol=nix" ];
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/0C95-1290";
+    { device = "/dev/disk/by-uuid/D33C-18EE";
       fsType = "vfat";
     };
 
-  swapDevices = [ ];
-}
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/98e875e4-4c34-42e9-8c71-404dfe137ba7"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp1s0f0.useDHCP = lib.mkDefault true;
+
+  #nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
+  # high-resolution display
+  hardware.video.hidpi.enable = lib.mkDefault true;
+}

machines/nat/m1-support/asahi-fwextract/default.nix

@@ -0,0 +1,29 @@
+{ lib
+, python3
+, python3Packages
+, fetchFromGitHub
+, gzip
+, gnutar
+, lzfse
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "asahi-fwextract";
+  version = "0.5pre10";
+
+  # tracking version: https://github.com/AsahiLinux/PKGBUILDs/blob/main/asahi-fwextract/PKGBUILD
+  src = fetchFromGitHub {
+    owner = "AsahiLinux";
+    repo = "asahi-installer";
+    rev = "v${version}";
+    hash = "sha256-93dTRrNNo7yilSGpSNjXir+DhQe29DeoZHXusrk9PN8=";
+  };
+
+  postPatch = ''
+    substituteInPlace asahi_firmware/img4.py \
+      --replace 'liblzfse.so' '${lzfse}/lib/liblzfse.so'
+    substituteInPlace asahi_firmware/update.py \
+      --replace '"tar"' '"${gnutar}/bin/tar"' \
+      --replace '"xf"' '"-x", "-I", "${gzip}/bin/gzip", "-f"'
+  '';
+}

machines/nat/m1-support/boot-m1n1/default.nix

@@ -0,0 +1,53 @@
+{ config, pkgs, lib, ... }:
+let
+  bootM1n1 = config.hardware.asahi.pkgs.callPackage ../m1n1 {
+    isRelease = true;
+    withTools = false;
+    customLogo = config.boot.m1n1CustomLogo;
+  };
+
+  bootUBoot = config.hardware.asahi.pkgs.callPackage ../u-boot {
+    m1n1 = bootM1n1;
+  };
+
+  bootFiles = {
+    "m1n1/boot.bin" = pkgs.runCommand "boot.bin" {} ''
+      cat ${bootM1n1}/build/m1n1.bin > $out
+      cat ${config.boot.kernelPackages.kernel}/dtbs/apple/*.dtb >> $out
+      cat ${bootUBoot}/u-boot-nodtb.bin.gz >> $out
+      if [ -n "${config.boot.m1n1ExtraOptions}" ]; then
+        echo '${config.boot.m1n1ExtraOptions}' >> $out
+      fi
+    '';
+  };
+in {
+  config = {
+    # install m1n1 with the boot loader
+    boot.loader.grub.extraFiles = bootFiles;
+    boot.loader.systemd-boot.extraFiles = bootFiles;
+
+    # ensure the installer has m1n1 in the image
+    system.extraDependencies = lib.mkForce [ bootM1n1 bootUBoot ];
+    system.build.m1n1 = bootFiles."m1n1/boot.bin";
+  };
+
+  options.boot = {
+    m1n1ExtraOptions = lib.mkOption {
+      type = lib.types.str;
+      default = "";
+      description = ''
+        Append extra options to the m1n1 boot binary. Might be useful for fixing
+        display problems on Mac minis.
+        https://github.com/AsahiLinux/m1n1/issues/159
+      '';
+    };
+
+    m1n1CustomLogo = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Custom logo to build into m1n1. The path must point to a 256x256 PNG.
+      '';
+    };
+  };
+}

machines/nat/m1-support/default.nix

@@ -0,0 +1,40 @@
+
+
+{ config, pkgs, lib, ... }:
+{
+  imports = [
+    ./kernel
+    ./peripheral-firmware
+    ./boot-m1n1
+  ];
+
+  config = {
+    hardware.asahi.pkgs = if config.hardware.asahi.pkgsSystem != "aarch64-linux"
+    then import (pkgs.path) {
+        system = config.hardware.asahi.pkgsSystem;
+        crossSystem.system = "aarch64-linux";
+      }
+    else pkgs;
+  };
+
+  options.hardware.asahi = {
+    pkgsSystem = lib.mkOption {
+      type = lib.types.str;
+      default = "aarch64-linux";
+      description = ''
+        System architecture that should be used to build the major Asahi
+        packages, if not the default aarch64-linux. This allows installing from
+        a cross-built ISO without rebuilding them during installation.
+      '';
+    };
+
+    pkgs = lib.mkOption {
+      type = lib.types.raw;
+      description = ''
+        Package set used to build the major Asahi packages. Defaults to the
+        ambient set if not cross-built, otherwise re-imports the ambient set
+        with the system defined by `hardware.asahi.pkgsSystem`.
+      '';
+    };
+  };
+}

machines/nat/m1-support/kernel/0001-drivers-usb-dwc3-remove-apple-dr_mode-check.patch

@@ -0,0 +1,28 @@
+From 1c60b7662b82d7d5d54aca1cd24f9517a8c4595f Mon Sep 17 00:00:00 2001
+From: Thomas Watson <twatson52@icloud.com>
+Date: Thu, 24 Nov 2022 11:00:43 -0600
+Subject: [PATCH] drivers/usb/dwc3: remove apple dr_mode check
+
+This check prevents the driver from probing with old device trees.
+Allegedly this check is incorrect anyway as the dr_mode should default
+to OTG but this is not true at the time of the check.
+---
+ drivers/usb/dwc3/core.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 1d88119cdbb8..b92401c1ee0c 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1882,8 +1882,7 @@ static int dwc3_probe(struct platform_device *pdev)
+ 		}
+ 
+ 		if (of_device_is_compatible(dev->of_node, "apple,dwc3")) {
+-			if (!IS_ENABLED(CONFIG_USB_ROLE_SWITCH) ||
+-			    dwc->dr_mode != USB_DR_MODE_OTG) {
++			if (!IS_ENABLED(CONFIG_USB_ROLE_SWITCH)) {
+ 				dev_err(dev,
+ 				    "Apple DWC3 requires role switch support.\n"
+ 				    );
+-- 
+2.17.1

machines/nat/m1-support/kernel/default-pagesize-16k.patch

@@ -0,0 +1,13 @@
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index a1eb6572ecd2..b94fbd9b3d70 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1036,7 +1036,7 @@ endmenu
+ 
+ choice
+ 	prompt "Page size"
+-	default ARM64_4K_PAGES
++	default ARM64_16K_PAGES
+ 	help
+ 	  Page size (translation granule) configuration.
+ 

machines/nat/m1-support/kernel/default.nix

@@ -0,0 +1,98 @@
+# the Asahi Linux kernel and options that must go along with it
+
+{ config, pkgs, lib, ... }:
+{
+  config = {
+    boot.kernelPackages = config.hardware.asahi.pkgs.callPackage ./package.nix {
+      _4KBuild = config.hardware.asahi.use4KPages;
+    };
+
+    # we definitely want to use CONFIG_ENERGY_MODEL, and
+    # schedutil is a prerequisite for using it
+    # source: https://www.kernel.org/doc/html/latest/scheduler/sched-energy.html
+    powerManagement.cpuFreqGovernor = lib.mkOverride 800 "schedutil";
+
+    boot.initrd.includeDefaultModules = false;
+    boot.initrd.availableKernelModules = [
+      # list of initrd modules stolen from
+      # https://github.com/AsahiLinux/asahi-scripts/blob/e4d6151a7dcb63ae5e3779c3cf57362eb37d908a/initcpio/install/asahi
+      "apple-mailbox"
+      "nvme_apple"
+      "pinctrl-apple-gpio"
+      "macsmc"
+      "macsmc-rtkit"
+      "i2c-apple"
+      "tps6598x"
+      "apple-dart"
+      "dwc3"
+      "dwc3-of-simple"
+      "xhci-pci"
+      "pcie-apple"
+      "gpio_macsmc"
+      "spi-apple"
+      "spi-hid-apple"
+      "spi-hid-apple-of"
+      "rtc-macsmc"
+      "simple-mfd-spmi"
+      "spmi-apple-controller"
+      "nvmem_spmi_mfd"
+      "apple-dockchannel"
+      "dockchannel-hid"
+      "apple-rtkit-helper"
+      "dm_crypt"
+
+      # additional stuff necessary to boot off USB for the installer
+      # and if the initrd (i.e. stage 1) goes wrong
+      "usb-storage"
+      "xhci-plat-hcd"
+      "usbhid"
+      "hid_generic"
+    ];
+
+    boot.kernelParams = [
+      "earlycon"
+      "console=ttySAC0,1500000"
+      "console=tty0"
+      "boot.shell_on_fail"
+      # Apple's SSDs are slow (~dozens of ms) at processing flush requests which
+      # slows down programs that make a lot of fsync calls. This parameter sets
+      # a delay in ms before actually flushing so that such requests can be
+      # coalesced. Be warned that increasing this parameter above zero (default
+      # is 1000) has the potential, though admittedly unlikely, risk of
+      # UNBOUNDED data corruption in case of power loss!!!! Don't even think
+      # about it on desktops!!
+      "nvme_apple.flush_interval=1000"
+    ];
+
+    # U-Boot does not support EFI variables
+    boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
+
+    # GRUB has to be installed as removable if the user chooses to use it
+    boot.loader.grub = lib.mkDefault {
+      version = 2;
+      efiSupport = true;
+      efiInstallAsRemovable = true;
+      device = "nodev";
+    };
+  };
+
+  imports = [
+    (lib.mkRemovedOptionModule [ "boot" "kernelBuildIsCross" ] ''
+      If it should still be true (which is unlikely), replace it
+      with 'hardware.asahi.pkgsSystem = "x86_64-linux"'. Otherwise, delete it.
+    '')
+
+    (lib.mkRemovedOptionModule [ "boot" "kernelBuildIs16K" ] ''
+      Replaced with 'hardware.asahi.use4KPages' which defaults to false.
+    '')
+  ];
+
+  options.hardware.asahi.use4KPages = lib.mkOption {
+    type = lib.types.bool;
+    default = false;
+    description = ''
+      Build the Asahi Linux kernel with 4K pages to improve compatibility in
+      some cases at the cost of performance in others.
+    '';
+  };
+}

machines/nat/m1-support/kernel/package.nix

@@ -0,0 +1,63 @@
+{ pkgs, _4KBuild ? false }: let
+  localPkgs =
+    # we do this so the config can be read on any system and not affect
+    # the output hash
+    if builtins ? currentSystem then import (pkgs.path) { system = builtins.currentSystem; }
+    else pkgs;
+
+  readConfig = configfile: import (localPkgs.runCommand "config.nix" {} ''
+    echo "{" > "$out"
+    while IFS='=' read key val; do
+      [ "x''${key#CONFIG_}" != "x$key" ] || continue
+      no_firstquote="''${val#\"}";
+      echo '  "'"$key"'" = "'"''${no_firstquote%\"}"'";' >> "$out"
+    done < "${configfile}"
+    echo "}" >> $out
+  '').outPath;
+
+  linux_asahi_pkg = { stdenv, lib, fetchFromGitHub, fetchpatch, linuxKernel, ... } @ args:
+    linuxKernel.manualConfig rec {
+      inherit stdenv lib;
+
+      version = "6.1.0-rc6-asahi";
+      modDirVersion = version;
+
+      src = fetchFromGitHub {
+        # tracking: https://github.com/AsahiLinux/PKGBUILDs/blob/stable/linux-asahi/PKGBUILD
+        owner = "AsahiLinux";
+        repo = "linux";
+        rev = "asahi-6.1-rc6-5";
+        hash = "sha256-HHPfAtNh5wR0TCsEYuMdSbp55p1IVhF07tg4dlfgXk0=";
+      };
+
+      kernelPatches = [
+        # sven says this is okay since our kernel config supports it, and that
+        # it will be fixed at some point to not be necessary. but this allows
+        # new kernels to get USB up with old device trees
+        { name = "0001-drivers-usb-dwc3-remove-apple-dr_mode-check";
+          patch = ./0001-drivers-usb-dwc3-remove-apple-dr_mode-check.patch;
+        }
+      ] ++ lib.optionals _4KBuild [
+        # thanks to Sven Peter
+        # https://lore.kernel.org/linux-iommu/20211019163737.46269-1-sven@svenpeter.dev/
+        { name = "sven-iommu-4k";
+          patch = ./sven-iommu-4k.patch;
+        }
+      ] ++ lib.optionals (!_4KBuild) [
+        # patch the kernel to set the default size to 16k instead of modifying
+        # the config so we don't need to convert our config to the nixos
+        # infrastructure or patch it and thus introduce a dependency on the host
+        # system architecture
+        { name = "default-pagesize-16k";
+          patch = ./default-pagesize-16k.patch;
+        }
+      ];
+
+      configfile = ./config;
+      config = readConfig configfile;
+
+      extraMeta.branch = "6.1";
+    } // (args.argsOverride or {});
+
+  linux_asahi = (pkgs.callPackage linux_asahi_pkg { });
+in pkgs.recurseIntoAttrs (pkgs.linuxPackagesFor linux_asahi)

machines/nat/m1-support/kernel/sven-iommu-4k.patch

@@ -0,0 +1,449 @@
+diff --git a/drivers/iommu/apple-dart.c b/drivers/iommu/apple-dart.c
+index 4f1a37bdd42d..c8c3ea81d818 100644
+--- a/drivers/iommu/apple-dart.c
++++ b/drivers/iommu/apple-dart.c
+@@ -97,7 +97,6 @@ struct apple_dart_hw {
+  * @lock: lock for hardware operations involving this dart
+  * @pgsize: pagesize supported by this DART
+  * @supports_bypass: indicates if this DART supports bypass mode
+- * @force_bypass: force bypass mode due to pagesize mismatch?
+  * @sid2group: maps stream ids to iommu_groups
+  * @iommu: iommu core device
+  */
+@@ -115,7 +114,6 @@ struct apple_dart {
+
+ 	u32 pgsize;
+ 	u32 supports_bypass : 1;
+-	u32 force_bypass : 1;
+
+ 	struct iommu_group *sid2group[DART_MAX_STREAMS];
+ 	struct iommu_device iommu;
+@@ -499,9 +497,6 @@ static int apple_dart_attach_dev(struct iommu_domain *domain,
+ 	struct apple_dart_master_cfg *cfg = dev_iommu_priv_get(dev);
+ 	struct apple_dart_domain *dart_domain = to_dart_domain(domain);
+
+-	if (cfg->stream_maps[0].dart->force_bypass &&
+-	    domain->type != IOMMU_DOMAIN_IDENTITY)
+-		return -EINVAL;
+ 	if (!cfg->stream_maps[0].dart->supports_bypass &&
+ 	    domain->type == IOMMU_DOMAIN_IDENTITY)
+ 		return -EINVAL;
+@@ -630,8 +625,6 @@ static int apple_dart_of_xlate(struct device *dev, struct of_phandle_args *args)
+ 	if (cfg_dart) {
+ 		if (cfg_dart->supports_bypass != dart->supports_bypass)
+ 			return -EINVAL;
+-		if (cfg_dart->force_bypass != dart->force_bypass)
+-			return -EINVAL;
+ 		if (cfg_dart->pgsize != dart->pgsize)
+ 			return -EINVAL;
+ 	}
+@@ -736,8 +729,6 @@ static int apple_dart_def_domain_type(struct device *dev)
+ {
+ 	struct apple_dart_master_cfg *cfg = dev_iommu_priv_get(dev);
+
+-	if (cfg->stream_maps[0].dart->force_bypass)
+-		return IOMMU_DOMAIN_IDENTITY;
+ 	if (!cfg->stream_maps[0].dart->supports_bypass)
+ 		return IOMMU_DOMAIN_DMA;
+
+@@ -1121,8 +1121,6 @@ static int apple_dart_probe(struct platform_device *pdev)
+ 		goto err_clk_disable;
+ 	}
+
+-	dart->force_bypass = dart->pgsize > PAGE_SIZE;
+-
+ 	ret = apple_dart_hw_reset(dart);
+ 	if (ret)
+ 		goto err_clk_disable;
+@@ -1149,8 +1147,8 @@ static int apple_dart_probe(struct platform_device *pdev)
+
+ 	dev_info(
+ 		&pdev->dev,
+-		"DART [pagesize %x, %d streams, bypass support: %d, bypass forced: %d] initialized\n",
+-		dart->pgsize, dart->num_streams, dart->supports_bypass, dart->force_bypass);
++		"DART [pagesize %x, %d streams, bypass support: %d] initialized\n",
++		dart->pgsize, dart->num_streams, dart->supports_bypass);
+ 	return 0;
+
+ err_sysfs_remove:
+
+diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
+index 09f6e1c0f9c0..094592751cfa 100644
+--- a/drivers/iommu/dma-iommu.c
++++ b/drivers/iommu/dma-iommu.c
+@@ -20,9 +20,11 @@
+ #include <linux/iommu.h>
+ #include <linux/iova.h>
+ #include <linux/irq.h>
++#include <linux/kernel.h>
+ #include <linux/list_sort.h>
+ #include <linux/mm.h>
+ #include <linux/mutex.h>
++#include <linux/pfn.h>
+ #include <linux/pci.h>
+ #include <linux/scatterlist.h>
+ #include <linux/spinlock.h>
+@@ -710,6 +712,9 @@ static struct page **__iommu_dma_alloc_pages(struct device *dev,
+ {
+ 	struct page **pages;
+ 	unsigned int i = 0, nid = dev_to_node(dev);
++	unsigned int j;
++	unsigned long min_order = __fls(order_mask);
++	unsigned int min_order_size = 1U << min_order;
+
+ 	order_mask &= (2U << MAX_ORDER) - 1;
+ 	if (!order_mask)
+@@ -749,15 +754,37 @@ static struct page **__iommu_dma_alloc_pages(struct device *dev,
+ 				split_page(page, order);
+ 			break;
+ 		}
+-		if (!page) {
+-			__iommu_dma_free_pages(pages, i);
+-			return NULL;
++
++		/*
++		 * If we have no valid page here we might be trying to allocate
++		 * the last block consisting of 1<<order pages (to guarantee
++		 * alignment) but actually need less pages than that.
++		 * In that case we just try to allocate the entire block and
++		 * directly free the spillover pages again.
++		 */
++		if (!page && !order_mask && count < min_order_size) {
++			page = alloc_pages_node(nid, gfp, min_order);
++			if (!page)
++				goto free_pages;
++			split_page(page, min_order);
++
++			for (j = count; j < min_order_size; ++j)
++				__free_page(page + j);
++
++			order_size = count;
+ 		}
++
++		if (!page)
++			goto free_pages;
+ 		count -= order_size;
+ 		while (order_size--)
+ 			pages[i++] = page++;
+ 	}
+ 	return pages;
++
++free_pages:
++	__iommu_dma_free_pages(pages, i);
++	return NULL;
+ }
+
+ /*
+@@ -785,16 +787,28 @@ static struct page **__iommu_dma_alloc_noncontiguous(struct device *dev,
+ 	bool coherent = dev_is_dma_coherent(dev);
+ 	int ioprot = dma_info_to_prot(DMA_BIDIRECTIONAL, coherent, attrs);
+ 	unsigned int count, min_size, alloc_sizes = domain->pgsize_bitmap;
++	struct sg_append_table sgt_append = {};
++	struct scatterlist *last_sg;
+ 	struct page **pages;
+ 	dma_addr_t iova;
+ 	ssize_t ret;
++	phys_addr_t orig_s_phys;
++	size_t orig_s_len, orig_s_off, s_iova_off, iova_size;
+
+ 	if (static_branch_unlikely(&iommu_deferred_attach_enabled) &&
+ 	    iommu_deferred_attach(dev, domain))
+ 		return NULL;
+
+ 	min_size = alloc_sizes & -alloc_sizes;
+-	if (min_size < PAGE_SIZE) {
++	if (iovad->granule > PAGE_SIZE) {
++		if (size < iovad->granule) {
++			/* ensure a single contiguous allocation */
++			min_size = ALIGN(size, PAGE_SIZE*(1U<<get_order(size)));
++			alloc_sizes = min_size;
++		}
++
++		size = PAGE_ALIGN(size);
++	} else if (min_size < PAGE_SIZE) {
+ 		min_size = PAGE_SIZE;
+ 		alloc_sizes |= PAGE_SIZE;
+ 	} else {
+@@ -797,13 +836,17 @@ static struct page **__iommu_dma_alloc_noncontiguous(struct device *dev,
+ 	if (!pages)
+ 		return NULL;
+
+-	size = iova_align(iovad, size);
+-	iova = iommu_dma_alloc_iova(domain, size, dev->coherent_dma_mask, dev);
++	iova_size = iova_align(iovad, size);
++	iova = iommu_dma_alloc_iova(domain, iova_size, dev->coherent_dma_mask, dev);
+ 	if (!iova)
+ 		goto out_free_pages;
+
+-	if (sg_alloc_table_from_pages(sgt, pages, count, 0, size, GFP_KERNEL))
++	/* append_table is only used to get a pointer to the last entry */
++	if (sg_alloc_append_table_from_pages(&sgt_append, pages, count, 0,
++					iova_size, UINT_MAX, 0, GFP_KERNEL))
+ 		goto out_free_iova;
++	memcpy(sgt, &sgt_append.sgt, sizeof(*sgt));
++	last_sg = sgt_append.prv;
+
+ 	if (!(ioprot & IOMMU_CACHE)) {
+ 		struct scatterlist *sg;
+@@ -825,18 +839,59 @@ static struct page **__iommu_dma_alloc_noncontiguous(struct device *dev,
+ 			arch_dma_prep_coherent(sg_page(sg), sg->length);
+ 	}
+
++	if (iovad->granule > PAGE_SIZE) {
++		if (size < iovad->granule) {
++			/*
++			 * we only have a single sg list entry here that is
++			 * likely not aligned to iovad->granule. adjust the
++			 * entry to represent the encapsulating IOMMU page
++			 * and then later restore everything to its original
++			 * values, similar to the impedance matching done in
++			 * iommu_dma_map_sg.
++			 */
++			orig_s_phys = sg_phys(sgt->sgl);
++			orig_s_len = sgt->sgl->length;
++			orig_s_off = sgt->sgl->offset;
++			s_iova_off = iova_offset(iovad, orig_s_phys);
++
++			sg_set_page(sgt->sgl,
++				pfn_to_page(PHYS_PFN(orig_s_phys - s_iova_off)),
++				iova_align(iovad, orig_s_len + s_iova_off),
++				sgt->sgl->offset & ~s_iova_off);
++		} else {
++			/*
++			 * convince iommu_map_sg_atomic to map the last block
++			 * even though it may be too small.
++			 */
++			orig_s_len = last_sg->length;
++			last_sg->length = iova_align(iovad, last_sg->length);
++		}
++	}
++
+ 	ret = iommu_map_sg_atomic(domain, iova, sgt->sgl, sgt->orig_nents, ioprot);
+-	if (ret < 0 || ret < size)
++	if (ret < 0 || ret < iova_size)
+ 		goto out_free_sg;
+
++	if (iovad->granule > PAGE_SIZE) {
++		if (size < iovad->granule) {
++			sg_set_page(sgt->sgl,
++				pfn_to_page(PHYS_PFN(orig_s_phys)),
++				orig_s_len, orig_s_off);
++
++			iova += s_iova_off;
++		} else {
++			last_sg->length = orig_s_len;
++		}
++	}
++
+ 	sgt->sgl->dma_address = iova;
+-	sgt->sgl->dma_length = size;
++	sgt->sgl->dma_length = iova_size;
+ 	return pages;
+
+ out_free_sg:
+ 	sg_free_table(sgt);
+ out_free_iova:
+-	iommu_dma_free_iova(cookie, iova, size, NULL);
++	iommu_dma_free_iova(cookie, iova, iova_size, NULL);
+ out_free_pages:
+ 	__iommu_dma_free_pages(pages, count);
+ 	return NULL;
+@@ -1040,8 +1124,9 @@ static int __finalise_sg(struct device *dev, struct scatterlist *sg, int nents,
+ 		unsigned int s_length = sg_dma_len(s);
+ 		unsigned int s_iova_len = s->length;
+
+-		s->offset += s_iova_off;
+-		s->length = s_length;
++		sg_set_page(s,
++			    pfn_to_page(PHYS_PFN(sg_phys(s) + s_iova_off)),
++			    s_length, s_iova_off & ~PAGE_MASK);
+ 		sg_dma_address(s) = DMA_MAPPING_ERROR;
+ 		sg_dma_len(s) = 0;
+
+@@ -1082,13 +1167,17 @@ static int __finalise_sg(struct device *dev, struct scatterlist *sg, int nents,
+ static void __invalidate_sg(struct scatterlist *sg, int nents)
+ {
+ 	struct scatterlist *s;
++	phys_addr_t orig_paddr;
+ 	int i;
+
+ 	for_each_sg(sg, s, nents, i) {
+-		if (sg_dma_address(s) != DMA_MAPPING_ERROR)
+-			s->offset += sg_dma_address(s);
+-		if (sg_dma_len(s))
+-			s->length = sg_dma_len(s);
++		if (sg_dma_len(s)) {
++			orig_paddr = sg_phys(s) + sg_dma_address(s);
++			sg_set_page(s,
++				    pfn_to_page(PHYS_PFN(orig_paddr)),
++				    sg_dma_len(s),
++				    sg_dma_address(s) & ~PAGE_MASK);
++		}
+ 		sg_dma_address(s) = DMA_MAPPING_ERROR;
+ 		sg_dma_len(s) = 0;
+ 	}
+@@ -1166,15 +1255,16 @@ static int iommu_dma_map_sg(struct device *dev, struct scatterlist *sg,
+ 	 * stashing the unaligned parts in the as-yet-unused DMA fields.
+ 	 */
+ 	for_each_sg(sg, s, nents, i) {
+-		size_t s_iova_off = iova_offset(iovad, s->offset);
++		phys_addr_t s_phys = sg_phys(s);
++		size_t s_iova_off = iova_offset(iovad, s_phys);
+ 		size_t s_length = s->length;
+ 		size_t pad_len = (mask - iova_len + 1) & mask;
+
+ 		sg_dma_address(s) = s_iova_off;
+ 		sg_dma_len(s) = s_length;
+-		s->offset -= s_iova_off;
+ 		s_length = iova_align(iovad, s_length + s_iova_off);
+-		s->length = s_length;
++		sg_set_page(s, pfn_to_page(PHYS_PFN(s_phys - s_iova_off)),
++			    s_length, s->offset & ~s_iova_off);
+
+ 		/*
+ 		 * Due to the alignment of our single IOVA allocation, we can
+@@ -1412,9 +1502,15 @@ static int iommu_dma_get_sgtable(struct device *dev, struct sg_table *sgt,
+ 		void *cpu_addr, dma_addr_t dma_addr, size_t size,
+ 		unsigned long attrs)
+ {
++	struct iommu_domain *domain = iommu_get_dma_domain(dev);
++	struct iommu_dma_cookie *cookie = domain->iova_cookie;
++	struct iova_domain *iovad = &cookie->iovad;
+ 	struct page *page;
+ 	int ret;
+
++	if (iovad->granule > PAGE_SIZE)
++		return -ENXIO;
++
+ 	if (is_vmalloc_addr(cpu_addr)) {
+ 		struct page **pages = dma_common_find_pages(cpu_addr);
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index f2c45b85b9fc..0c370e486d6e 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -80,6 +80,8 @@ static struct iommu_domain *__iommu_domain_alloc(struct bus_type *bus,
+ 						 unsigned type);
+ static int __iommu_attach_device(struct iommu_domain *domain,
+ 				 struct device *dev);
++static void __iommu_detach_device(struct iommu_domain *domain,
++				  struct device *dev);
+ static int __iommu_attach_group(struct iommu_domain *domain,
+ 				struct iommu_group *group);
+ static void __iommu_detach_group(struct iommu_domain *domain,
+@@ -1976,6 +1978,24 @@ void iommu_domain_free(struct iommu_domain *domain)
+ }
+ EXPORT_SYMBOL_GPL(iommu_domain_free);
+
++static int iommu_check_page_size(struct iommu_domain *domain,
++				struct device *dev)
++{
++	bool trusted = !(dev_is_pci(dev) && to_pci_dev(dev)->untrusted);
++
++	if (!iommu_is_paging_domain(domain))
++		return 0;
++	if (iommu_is_large_pages_domain(domain) && trusted)
++		return 0;
++
++	if (!(domain->pgsize_bitmap & (PAGE_SIZE | (PAGE_SIZE - 1)))) {
++		pr_warn("IOMMU pages cannot exactly represent CPU pages.\n");
++		return -EFAULT;
++	}
++
++	return 0;
++}
++
+ static int __iommu_attach_device(struct iommu_domain *domain,
+ 				 struct device *dev)
+ {
+@@ -1985,9 +2005,23 @@ static int __iommu_attach_device(struct iommu_domain *domain,
+ 		return -ENODEV;
+
+ 	ret = domain->ops->attach_dev(domain, dev);
+-	if (!ret)
+-		trace_attach_device_to_domain(dev);
+-	return ret;
++	if (ret)
++		return ret;
++
++	/*
++	 * Check that CPU pages can be represented by the IOVA granularity.
++	 * This has to be done after ops->attach_dev since many IOMMU drivers
++	 * only limit domain->pgsize_bitmap after having attached the first
++	 * device.
++	 */
++	ret = iommu_check_page_size(domain, dev);
++	if (ret) {
++		__iommu_detach_device(domain, dev);
++		return ret;
++	}
++
++	trace_attach_device_to_domain(dev);
++	return 0;
+ }
+
+ int iommu_attach_device(struct iommu_domain *domain, struct device *dev)
+diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
+index db77aa675145..180ce65a6789 100644
+--- a/drivers/iommu/iova.c
++++ b/drivers/iommu/iova.c
+@@ -49,10 +49,11 @@ init_iova_domain(struct iova_domain *iovad, unsigned long granule,
+ {
+ 	/*
+ 	 * IOVA granularity will normally be equal to the smallest
+-	 * supported IOMMU page size; both *must* be capable of
+-	 * representing individual CPU pages exactly.
++	 * supported IOMMU page size; while both usually are capable of
++	 * representing individual CPU pages exactly the IOVA allocator
++	 * supports any granularities that are an exact power of two.
+ 	 */
+-	BUG_ON((granule > PAGE_SIZE) || !is_power_of_2(granule));
++	BUG_ON(!is_power_of_2(granule));
+
+ 	spin_lock_init(&iovad->iova_rbtree_lock);
+ 	iovad->rbroot = RB_ROOT;
+diff --git a/include/linux/iommu.h b/include/linux/iommu.h
+index 9208eca4b0d1..dec2dd70a876 100644
+--- a/include/linux/iommu.h
++++ b/include/linux/iommu.h
+@@ -63,6 +63,8 @@ struct iommu_domain_geometry {
+ 					      implementation              */
+ #define __IOMMU_DOMAIN_PT	(1U << 2)  /* Domain is identity mapped   */
+ #define __IOMMU_DOMAIN_DMA_FQ	(1U << 3)  /* DMA-API uses flush queue    */
++#define __IOMMU_DOMAIN_LP	(1U << 4)  /* Support for PAGE_SIZE smaller
++					      than IOMMU page size        */
+
+ /*
+  * This are the possible domain-types
+@@ -82,10 +84,12 @@ struct iommu_domain_geometry {
+ #define IOMMU_DOMAIN_IDENTITY	(__IOMMU_DOMAIN_PT)
+ #define IOMMU_DOMAIN_UNMANAGED	(__IOMMU_DOMAIN_PAGING)
+ #define IOMMU_DOMAIN_DMA	(__IOMMU_DOMAIN_PAGING |	\
+-				 __IOMMU_DOMAIN_DMA_API)
++				 __IOMMU_DOMAIN_DMA_API |       \
++				 __IOMMU_DOMAIN_LP)
+ #define IOMMU_DOMAIN_DMA_FQ	(__IOMMU_DOMAIN_PAGING |	\
+ 				 __IOMMU_DOMAIN_DMA_API |	\
+-				 __IOMMU_DOMAIN_DMA_FQ)
++				 __IOMMU_DOMAIN_DMA_FQ |        \
++				 __IOMMU_DOMAIN_LP)
+
+ struct iommu_domain {
+ 	unsigned type;
+@@ -102,6 +106,16 @@ static inline bool iommu_is_dma_domain(struct iommu_domain *domain)
+ 	return domain->type & __IOMMU_DOMAIN_DMA_API;
+ }
+
++static inline bool iommu_is_paging_domain(struct iommu_domain *domain)
++{
++	return domain->type & __IOMMU_DOMAIN_PAGING;
++}
++
++static inline bool iommu_is_large_pages_domain(struct iommu_domain *domain)
++{
++	return domain->type & __IOMMU_DOMAIN_LP;
++}
++
+ enum iommu_cap {
+ 	IOMMU_CAP_CACHE_COHERENCY,	/* IOMMU can enforce cache coherent DMA
+ 					   transactions */

machines/nat/m1-support/m1n1/default.nix

@@ -0,0 +1,96 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, pkgsCross
+, python3
+, dtc
+, imagemagick
+, isRelease ? false
+, withTools ? true
+, withChainloading ? false
+, rust-bin ? null
+, customLogo ? null
+}:
+
+assert withChainloading -> rust-bin != null;
+
+let
+  pyenv = python3.withPackages (p: with p; [
+    construct
+    pyserial
+  ]);
+
+  rustenv = rust-bin.selectLatestNightlyWith (toolchain: toolchain.minimal.override {
+    targets = [ "aarch64-unknown-none-softfloat" ];
+  });
+in stdenv.mkDerivation rec {
+  pname = "m1n1";
+  version = "1.1.8";
+
+  src = fetchFromGitHub {
+    # tracking: https://github.com/AsahiLinux/PKGBUILDs/blob/stable/m1n1/PKGBUILD
+    owner = "AsahiLinux";
+    repo = "m1n1";
+    rev = "v${version}";
+    hash = "sha256-4Ykh+EzOCRtZQD1upUDJpi5ikMOCnxLwvLWajtMo7LU=";
+    fetchSubmodules = true;
+  };
+
+  makeFlags = [ "ARCH=aarch64-unknown-linux-gnu-" ]
+    ++ lib.optional isRelease "RELEASE=1"
+    ++ lib.optional withChainloading "CHAINLOADING=1";
+
+  nativeBuildInputs = [
+    dtc
+    pkgsCross.aarch64-multiplatform.buildPackages.gcc
+  ] ++ lib.optional withChainloading rustenv
+    ++ lib.optional (customLogo != null) imagemagick;
+
+  postPatch = ''
+    substituteInPlace proxyclient/m1n1/asm.py \
+      --replace 'aarch64-linux-gnu-' 'aarch64-unknown-linux-gnu-' \
+      --replace 'TOOLCHAIN = ""' 'TOOLCHAIN = "'$out'/toolchain-bin/"'
+  '';
+
+  preConfigure = lib.optionalString (customLogo != null) ''
+    pushd data &>/dev/null
+    ln -fs ${customLogo} bootlogo_256.png
+    if [[ "$(magick identify bootlogo_256.png)" != 'bootlogo_256.png PNG 256x256'* ]]; then
+      echo "Custom logo is not a 256x256 PNG"
+      exit 1
+    fi
+    rm bootlogo_128.png
+    convert bootlogo_256.png -resize 128x128 bootlogo_128.png
+    ./makelogo.sh
+    popd &>/dev/null
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/build
+    cp build/m1n1.macho $out/build
+    cp build/m1n1.bin $out/build
+  '' + (lib.optionalString withTools ''
+    mkdir -p $out/{bin,script,toolchain-bin}
+    cp -r proxyclient $out/script
+    cp -r tools $out/script
+    for toolpath in $out/script/proxyclient/tools/*.py; do
+      tool=$(basename $toolpath .py)
+      script=$out/bin/m1n1-$tool
+      cat > $script <<EOF
+#!/bin/sh
+${pyenv}/bin/python $toolpath "\$@"
+EOF
+      chmod +x $script
+    done
+    GCC=${pkgsCross.aarch64-multiplatform.buildPackages.gcc}
+    BINUTILS=${pkgsCross.aarch64-multiplatform.buildPackages.binutils-unwrapped}
+    ln -s $GCC/bin/*-gcc $out/toolchain-bin/
+    ln -s $GCC/bin/*-ld $out/toolchain-bin/
+    ln -s $BINUTILS/bin/*-objcopy $out/toolchain-bin/
+    ln -s $BINUTILS/bin/*-objdump $out/toolchain-bin/
+    ln -s $GCC/bin/*-nm $out/toolchain-bin/
+  '') + ''
+    runHook postInstall
+  '';
+}

machines/nat/m1-support/peripheral-firmware/default.nix

@@ -0,0 +1,70 @@
+{ config, pkgs, lib, ... }:
+{
+  config = {
+    assertions = lib.mkIf config.hardware.asahi.extractPeripheralFirmware [
+      { assertion = config.hardware.asahi.peripheralFirmwareDirectory != null;
+        message = ''
+          Asahi peripheral firmware extraction is enabled but the firmware
+          location appears incorrect.
+        '';
+      }
+    ];
+
+    hardware.firmware = let
+      asahi-fwextract = pkgs.callPackage ../asahi-fwextract {};
+    in lib.mkIf ((config.hardware.asahi.peripheralFirmwareDirectory != null)
+        && config.hardware.asahi.extractPeripheralFirmware) [
+      (pkgs.stdenv.mkDerivation {
+        name = "asahi-peripheral-firmware";
+
+        nativeBuildInputs = [ asahi-fwextract pkgs.cpio ];
+
+        buildCommand = ''
+          mkdir extracted
+          asahi-fwextract ${/. + config.hardware.asahi.peripheralFirmwareDirectory} extracted
+          mkdir -p $out/lib/firmware
+          cat extracted/firmware.cpio | cpio -id --quiet --no-absolute-filenames
+          mv vendorfw/* $out/lib/firmware
+        '';
+      })
+    ];
+  };
+
+  options.hardware.asahi = {
+    extractPeripheralFirmware = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        Automatically extract the non-free non-redistributable peripheral
+        firmware necessary for features like Wi-Fi.
+      '';
+    };
+
+    peripheralFirmwareDirectory = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = let
+        paths = [
+          # path when the system is operating normally
+          "/boot/asahi"
+          # path when the system is mounted in the installer
+          "/mnt/boot/asahi"
+          ./.
+        ];
+
+        validPaths = (builtins.filter
+          (p: builtins.pathExists (p + "/all_firmware.tar.gz"))
+          paths) ++ [ null ];
+      in builtins.elemAt validPaths 0;
+      description = ''
+        Path to the directory containing the non-free non-redistributable
+        peripheral firmware necessary for features like Wi-Fi. Ordinarily, this
+        will automatically point to the appropriate location on the ESP. Flake
+        users and those interested in maximum purity will want to copy those
+        files elsewhere and specify this manually.
+        Currently, this consists of the files `all-firmware.tar.gz` and
+        `kernelcache*`. The official Asahi Linux installer places these files
+        in the `asahi` directory of the EFI system partition when creating it.
+      '';
+    };
+  };
+}

machines/nat/m1-support/u-boot/default.nix

@@ -0,0 +1,40 @@
+{ lib
+, fetchFromGitHub
+, pkgs
+, pkgsCross
+, m1n1
+}: let
+  # u-boot's buildInputs get a different hash and don't build right if we try to
+  # cross-build for aarch64 on itself for whatever reason
+  buildPkgs = if pkgs.stdenv.system == "aarch64-linux" then pkgs else pkgsCross.aarch64-multiplatform;
+in (buildPkgs.buildUBoot rec {
+  src = fetchFromGitHub {
+    # tracking: https://github.com/AsahiLinux/PKGBUILDs/blob/stable/uboot-asahi/PKGBUILD
+    owner = "AsahiLinux";
+    repo = "u-boot";
+    rev = "asahi-v2022.10-1";
+    hash = "sha256-/dtTJ+GxC2GFlqduAa2WWPGwktLjM7tUKus6/aUyPNQ=";
+  };
+  version = "2022.10.asahi1-1";
+
+  defconfig = "apple_m1_defconfig";
+  extraMeta.platforms = [ "aarch64-linux" ];
+  filesToInstall = [
+    "u-boot-nodtb.bin.gz"
+    "m1n1-u-boot.macho"
+    "m1n1-u-boot.bin"
+  ];
+  extraConfig = ''
+    CONFIG_IDENT_STRING=" ${version}"
+  '';
+}).overrideAttrs (o: {
+  # nixos's downstream patches are not applicable
+  patches = [ ];
+
+  preInstall = ''
+    # compress so that m1n1 knows U-Boot's size and can find things after it
+    gzip -n u-boot-nodtb.bin
+    cat ${m1n1}/build/m1n1.macho arch/arm/dts/t[68]*.dtb u-boot-nodtb.bin.gz > m1n1-u-boot.macho
+    cat ${m1n1}/build/m1n1.bin arch/arm/dts/t[68]*.dtb u-boot-nodtb.bin.gz > m1n1-u-boot.bin
+  '';
+})

secrets/iodine.age

@@ -1,38 +1,39 @@
 age-encryption.org/v1
--> ssh-ed25519 xoAm7w Hfe9WoVDvMWc8P60BreiUS9+F1PmpZwUQ/Rf1tRxIRY
-oFunT3z6xg8BRAqzcaHVxafBUJbXJSCrsge1/nEI8x4
--> ssh-ed25519 mbw8xA xR/jq0KjCpwusJJ60mHqt6TGBdsSjUxWHChO8dGYhzA
-kFEYLlnF7g6e7Tvud8JsblOtsj2v3QrAdkjJwV0b9ng
--> ssh-ed25519 N240Tg DoXupPWk4YsgqpQ4yPfpz9a13Qu+ZcxavLbKjStf40E
-+mCkreDEjo8G5Ew9TNaRp221VL6l20jG/6QVa8Cbwa4
--> ssh-ed25519 2a2Yhw t0BY1ZmbeSORtHRvy5c3XeIe29QSRd5wSgibjZgcmAE
-5+EWlrZoeg3SZ6MCaj+YN4ovWxrTbfVz5IV9gA7bcwg
--> ssh-ed25519 dMQYog gaJXyfz3aN5CnbKGao5nxnKc6ZGyXuLI9s5DQ7zcfDA
-6BdUMh7erbIXstvEPnc0jE38rL9+0QU8PYtcQp5PUNA
--> ssh-ed25519 G2eSCQ boj8/IRM5HG4LEHWMYzDr37Z/fVyI+ZAGbFaUzGtOS8
-tzZLK/jzjron85vLrxFALKUgGVi8ZdPnM/zcVpfp6Ps
--> ssh-ed25519 6AT2/g A8NtCXr6AksNJCnOLsErYIqKy2SqMza0GsUURr1YASo
-lMnDpcWZxXIIRqBtLYG6Pkd6L+/dPVGRCgyYPzRLnII
--> ssh-ed25519 yHDAQw NOqmfI7ZuSMTmEErJjHkbjGtNwJhpHTWeS/6zPsTVC4
-5tZLg+GbfpnCi2CbSP7lZLssYm7hR/B7PZCZZ5X3ahs
--> ssh-ed25519 2+FxVg SA3lD4YzgKQWnztnaKZkkWZvooAnH3uv3o4lKn59rAI
-vXkGl4IUstTQ6BZsT3c5PmPKU3lJxosX5LRUuAGVSVY
--> ssh-ed25519 CRfjsA uIa4dBktv7pMMv4U8hwlUJz+Ewh7ZjQ+j5ln7ZqxlAw
-WadTmmOeOlaNlejglQ3NgOk86zS/yyKKkVabIPajeCQ
--> ssh-ed25519 vwVIvQ pg5Yv6YQh2tYXmv9PP5etAMxNN85dwQ28jXZRkQI9RY
-zE81eln0hmbRchzNNYXaMxI8aF/xwGXy2wm6GlKnzg8
--> ssh-ed25519 fBrw3g gtUFDnC6CowNoKxwgLCOsSQ8rK21y327K8B94zlMHQE
-+WepWvCmTZj+ht7U8aMD4kJ+zDSH7+c5lNSDw2JKrzA
--> ssh-ed25519 S5xQfg vsDTXbJTOjL7wVx1rA5ny0Ix/f6QFlZxxB1z6X2YcGk
-im/TCt3Rszp0tP8hx1CV1xqaxh/PEUmC6ZoARVJXUzo
--> ssh-ed25519 XPxfUQ OQf+JUauisYKuYtya1HlpnZKteLLJonnd8JZiVwfAQA
-wDSRsGMxQ2rXtej/iBX8n7KRfdLIB5q12Z6zu2I4wNw
--> ssh-ed25519 SpD5mg UlMJvnqDtRj3BTE4wAYa11D1mM5Q4vIkKIPmtODKYSc
-RW1Brw2kCbUlBZK+UdusWAKEW5ZC5VHt49qUsyeUr+s
--> ssh-ed25519 Kk8sng 1TYOMJBzUZrgcRE02YtFllJgV4bxsCFRrRgnoasWyVA
-FXSNZ6U60lRRgS3EvqKZwWdwA3vIW9xe5+NcmuYorug
--> x'-grease dT
-viYi3YkLyuugYlo01uxExjHQVbq6hMoAGI64lXiE6fE0I0AV5Wr8yHiylwAH8ax2
-4ylwQQVAA66xCEF+2QoIapO+V7oaWrjeiEVEAn1D
---- q9OmQIHexmW/2u7d1XKjUgwp+QYHbiiPgC9ZurBY5l8
-¥qÌr
.¹s
;ñïÑïMdYŠuÜ~°#i¸ï-øÁVBCÞrå·>üADéÝÉþ83<38>ú:"î¶o+
+-> ssh-ed25519 xoAm7w NvgGcHYNA6WmPn3sCmMzPCib+6P7s5R/G6lSJFpih2E
+gLugCNcPJtAl9+2fa80OD7D7XaBkpb2bzKJclOdjGfw
+-> ssh-ed25519 mbw8xA dBYbSV7QcUTOp9a5hUAZeMlL828KrRp6tB3zMIopPDA
+i4QRHxTVaN60elfiuYXuESwbphxPN4tsQ7scH0ZJjoA
+-> ssh-ed25519 N240Tg Xg5q74f1ylRZGLpPggkTy1QU+LWEcHpqCV6wQ2OhQlk
+RubXACwdS4+xNt8nt0C0wk8XU2YIWOSRwIXUg47sNA0
+-> ssh-ed25519 2a2Yhw p5w1WsmcVHImVtolvrULgSsYXlm06g2za8zSiDf9uR8
+qVuj2L8jvRmINprQbYg91yoJU0XZmO7TprQv2UsvpmY
+-> ssh-ed25519 dMQYog EFYjggjACyNwvNCG75XsceqnUrrrsX4cv7e+Mu2Z2zI
+Q7VPIP7iNqHxGGtRG2Q122f60ZztSRsRHRbziGAinNY
+-> ssh-ed25519 G2eSCQ 5Y6Tazqz2Wjl2/lrlQMUWgEnSBJpmzwXAUGEK56upgE
+eVxcvshe+uecw4ORKdS/2W8p+jcrro8cDcDdmeY7Olg
+-> ssh-ed25519 6AT2/g h6E5M1uJRhqfR1bm82rXrJvmr+nkeUPbygD8S+zbAmY
+r5yR6W2uCcR4cEnbk/1tXwhAanT2EqTsH1mIDbrVGVM
+-> ssh-ed25519 yHDAQw lWomhFF/IyKtOUlBori7wNjrtsbqvKXXhAwF4a1y8js
+baOAc0tKMbh6Sw0bWyynI3OMrsOPA3W1fCCIn26azeQ
+-> ssh-ed25519 hPp1nw ZGwi0yK0Nu+Y/uXIxnQH6Pwmw1SWBE0yQ9FOuBNKp1U
+tN8kk/0AxUIiFbEOSeIlGiBIy0d96wTG8VrGPnEHTg4
+-> ssh-ed25519 CRfjsA ntYznFouB2JWY2LZ6aycDogIFbLHOhqcx50QbJIB+RY
+slo38Rvg+2GV2fKRlt4Yns644kd55DrDz7ivi6RTyXg
+-> ssh-ed25519 vwVIvQ UF+Bo3Rl5OPPqqddi0bqleRJV9XTuykrl2dkPPSyRAE
+znn5KNsXZPHN2/E652cPhOx8RF5+uuFUyGhrI+kCou0
+-> ssh-ed25519 fBrw3g w8EkEo1db0Po5ZhDzz/5nshsSmjy9wMSKp+XFDEuUQA
+q50eyTDTxQULpogMbVXI2zSfu+ZZP9DOXjM+Y2/rMNI
+-> ssh-ed25519 S5xQfg 651xn3mNSl/3+KT5d4XD2pkMNcxi6BScqX3teoKbgio
+EOfzB+woFBWBaVKuv4t4E0Gx3vf7Lg40WXSovXs8N6s
+-> ssh-ed25519 XPxfUQ FL+FYVsRNJBv7xEpwf0fXgJt3G/FiARQ7+aWK/sxryE
+xneOKh3muAhjkLC2upsRrc4B0mggwm7IOMFsg+25gT8
+-> ssh-ed25519 SpD5mg f140sUr/7itxtllfcbBaNV9xhRaV/IULGVn6AaP7zkw
+FnostzjoSC/bdOu2UF+rT+0mZ0aUM8rAAoQltUXn534
+-> ssh-ed25519 Kk8sng 9JnybgIcROZf+l0C9YGNb4xWkZLtdfUPm2V0WJsGPUI
+fs4wBEIdK6kU1CIhI8zz/yqa4Fb6Q2u+MO6SsudQlCM
+-> C89-grease >Fa(j6s UN5!{
+nb+ymnliEEKJf3IGloFQMNl/SyFjvFUqekC2YEY2qJblAUaft3Tf6hMYf7uDSjew
+5SRhESY0VucHhAK6OybwPWYRlXXv2gM/wxUicB8
+--- t6Q6ULdQzW4/xDtZDVI/lfP5i8Cq8lnURqQSyKWHvyI
+h,:ìüæ
+H)'’ЊÂ/²)žÒ¾ìpˆ¡Rç›2QU
ˆÁ™h£Í’×2ák•äG!A	~,b

secrets/nextcloud-pw.age

@@ -1,37 +1,39 @@
 age-encryption.org/v1
--> ssh-ed25519 xoAm7w ftH5Ym/ik0hpKF9/keVodc9lbrbl/tfgI7FNYvY7aCo
-2UxiWjJ18muZg1qcomcFEJChlebx5dvdsVfdxdVCnEQ
--> ssh-ed25519 mbw8xA CKMJ+LK6HWZybajuHKTNkPUJWTcR/E7Pu7E0LwLljRE
-aXgVMhoC8GEAm4YqHPAascX4CDX5D4T/uwbfdcfheI8
--> ssh-ed25519 N240Tg WjE5EbH6nsSCsZfHBTDebdCYU4lNyEemAfqdSIpYxiU
-Dt6ZVntKzQo65WWHRg9Bp0JJhjwMIDqfV2WMdtELhpQ
--> ssh-ed25519 2a2Yhw Nvaz150AMV7M9QuY87wPGfHCfNJ7CH3VSl6tTbNlHig
-U7KG+Yl8OnEFjso8s5xgHDsnHSe6IfkImG92uoo8BoQ
--> ssh-ed25519 dMQYog EMPtqpONlZ1XJycSBZJMNx2LBQEcPEcPIoJ1LstdJE4
-IdewH3GF1c5hWGNQYbLYWMYFrhiFfoN811GDdoNEVlE
--> ssh-ed25519 G2eSCQ unDoBOz26bzNaKAoYfS+Bf6M+bGf/D38aZrGL7pifgs
-uNcXcIOaS3ZGxwmKXMqRR7kG3ErDW4VW0ZSDVkrDPVY
--> ssh-ed25519 6AT2/g hAm89Sp/tWm7lnSggrK0CCMEXxkBaToQ6wsXSzZifTE
-qhRrlwPCdaAmvW+S6XdbWsKnwoO2eLgWIfSF1XKaP2c
--> ssh-ed25519 yHDAQw vm25bEwFJg6jY2LIHTxbOnYDE2u+8MuahtBQJpzdW3s
-/tZPXzO363LuyAQ2juZnq5S6tRXaq5RA1VsdQI6I3LU
--> ssh-ed25519 2+FxVg EfDKgl4yXd0MaTMOYVUwWqlujNiDJn8cUensuRHa9WY
-lmq9qcJaGm1IIlC4wZ6rcnywJrZP1XrjXGpQmRrE6WE
--> ssh-ed25519 CRfjsA eJXHwGRcgGRy7jziDsuWJlpJZ367DgmPk33vMza+PVM
-kQzmsqhxydPnO8zkQAF6V69inaIur+Jj/Y/UWSlm8bU
--> ssh-ed25519 vwVIvQ g7Dbz/nR7ltZVJtfnLfNcuTl0EEmwevqx4uzE2yU9Bo
-t0kEKYGDjcjDRCnKcyLoLJigfupgSwFGNKnWZNgcEjk
--> ssh-ed25519 fBrw3g 8YAKhKpmrEqyg96QOTPjHv/Ufjzn4ebyf812/u3crB4
-joYiN6sLiz5zlp+w1nezyVLsN4cTMreL7vG2Q1BR8IA
--> ssh-ed25519 S5xQfg PvaGUlWhWUhW8KXg9GK0Tlw4ru1M7vpeG4jdZt6HnmU
-rFb37EZYgmmmrJNxVe4S5CkFEadUNw72FWS67qlOcmM
--> ssh-ed25519 XPxfUQ BQkn2MzbRQT32mrGK9jyvpm4e2cnZEmrFig+YVOy0TY
-vvemmqvcsE+4MZYBltYMZyuosZy5JxDYe+a+EbeDTv8
--> ssh-ed25519 SpD5mg mndEjGwk50wd8+zdFao9dvscApXrQVk5HcdgBzTAzhI
-1Bl7ixB7xYLsAYvu3HY67u48Dv4ktDwYo5oMAbr4n1k
--> ssh-ed25519 Kk8sng PR7IpsRjn/4WYchFHfkGPgNayTSJDM9rY2X1CFKN5Fo
-mHPqmcdjP1atZYLaA3phPsjrNAEbAfvpu01mfZ8qK54
--> ZN_d{1-grease {~-\e[ 8c 0LUi]F)=
-E+1JKauEcaaXzol/Gg4rqPJmO3+x0EU3V3evmxbZ
---- hl4Pp2I55YOS97jg8WRxXI1+wylN6RvGF3P+kRxL/YE
-Ù$²L1ÒuðC,œ,QLÖiõØ&º`ñÍe<C38D><65>0§ÿøÙC§”„ד\7ÈP3Ñݤ,ª}U¢	üî·½î-¹R.¯îb®‰|1ò3 	ùŸ“àÚÒ
+-> ssh-ed25519 xoAm7w 7+DO9mI/zZfTIN/0KBMOIjMNnReyGoH/XVQa0OLdAHY
+qg/UIBJr8GX79d7xrIIN9GUt3pDIormlOM7IdjIytHk
+-> ssh-ed25519 mbw8xA 9KorXegEBX3PYQm+Ljdjs2hkxAIpz2CZrITNCGo0BnM
+QNQWGWqoudiryg/0fV2KZUuJQGp/suZun9KF9c2OTqw
+-> ssh-ed25519 N240Tg kfl4aaKI28cDfzX3MBisRGraQYChPdUF2WigjOFYx0Y
+u8dgbgJSmcJBp2Uc8qbWMbpa/cKEmx4V3psQgzqnitA
+-> ssh-ed25519 2a2Yhw MGk791xEYHlC4bYfU5CMS3rY8TVI8KYvEIwUhE7wQ3k
+iFT3QUR8PyWw4grqy7/8KfLfYNIDkgDKM2MqSr6cj0U
+-> ssh-ed25519 dMQYog IW1ntuHrV85WX60GI295c197NUlQMKuo5gd3sQZl/gA
+gAnx0rMggqZ7Rn8tHFAXJx3z3t9MkZpmjpgI2qAtK4g
+-> ssh-ed25519 G2eSCQ 7ZpZQAda0uxjIIdpLnC5JlU6cbLtJWr9LSIIdi7PUQw
+PfGFrMVLCmy8SDv2nn6p6M560Xu8lte8DjbCORDM+uc
+-> ssh-ed25519 6AT2/g JGE9jVFM2Wu348XIHpubyCEismpfBraxnFGTnEvqqnI
+kDHfyJdBIGIURDJ0Nsce4DqzPzhk5p+LM1QZ44pZ4g8
+-> ssh-ed25519 yHDAQw KNzCNjvErLwEJZpWWMIBFUGOC8jURyvoKzCWX0ATrRM
+EyIJpn48eU8oEB5FbMhCOd16hAVrxTFLyJEoos7WGOY
+-> ssh-ed25519 hPp1nw kdjLNwgYQV/4NMubVpJw8QCIuKn+u3CT1boZNJEWfCM
+FXNLqmpZB+CtSmCY9zGr+3UebEwNK3JmdP4ifdXiQL4
+-> ssh-ed25519 CRfjsA axLQSlgVkaYmRktIP+fwHnhN2pJ55NCOW0fzTzgjFF4
+ElO0byzF3PJxN9WgENIN/YfmsOR9rOhEh3xRNIIGIyk
+-> ssh-ed25519 vwVIvQ LtrPXRJ0hztkWFnoKt5c0UzWQpD9CO990k52gjWcQnY
+nHb1hsXhHQokcA4WoRlbZy0EFQt8Xd0cYUGqblY17Q4
+-> ssh-ed25519 fBrw3g dnWs7lWY8QoWOjWHG68FSYqZDzsIaA/qU4AXrndGNTw
+gh4+t6THL2mtrPUzGlYd/YxDjk3hpHxUmGq+kRcz9BQ
+-> ssh-ed25519 S5xQfg kEXs5hXXR4ocYYWoT2xFr4HITe9wIOOLz73zm/9bf0o
+WpO+5/zXc+UGYJGkNNQr8UsEz2RyBUtQ4Syep718294
+-> ssh-ed25519 XPxfUQ pL4j/idFPiIPnWI7bIwn0+FuB6az/hXURAh+tvdr7Hc
+WWJPFYanmf3+KnjG84XlnEapI1vh0wRi9XFJRn5JVpo
+-> ssh-ed25519 SpD5mg CpGcl7ONt0juh/N2hwcxWiuc9u9wjQ4d+AAF+1BQim0
+7Xs7qYITkCsjloA74CDGn6lZhXNTqFV05omLiCz9efg
+-> ssh-ed25519 Kk8sng DzLM7ewz+4yz5YNQfBDKcOOlqMxScGR34XfVpCUHMEM
+eH2ogYJO2N4cqxRibCOEoL5cXcTdWavHS3uRX7wwHxY
+-> h<Vf$Fh-grease :~Z8 qwh*'} 2*OyJh )iMU_m?t
+u9QuYuPJEVl7Rt1cEcXZPQ0IfpOzqB59iTMch/SDoByr966PBlBfjDS/7i9U0sEI
+GMeVtXePXkKPXVvhmbZ/C9KI
+--- 1F0kxs/7SRrpoj9q4t1eCg381LzCgrwA1DYG7zcI3dI
+ö>°cY§ÀeéEò‹ƒ\ã¯<>Ôc¸j‘½	ßÎíÃS­—XpºýG<C3BD>§$½}i¼10
+ϱ™<œ`á Œ<>, öAž¤£
~r>ø$|wˆ¿

secrets/peertube-db-pw.age

@@ -1,38 +1,39 @@
 age-encryption.org/v1
--> ssh-ed25519 xoAm7w 99ufX8x+2IWSFhunUnSeH5Li0bdNZQpnjAeoI7TBZQ4
-AtecBXuKzWfxYO80lRha9uyltLExWqTTpT80HHOsW5s
--> ssh-ed25519 mbw8xA ZEtocwiOLTy313asl0C9MDGPy8KTk5wo6hZHLSx0WjI
-wwxe3HF3P5BFfAMI5nes+dwnzM51HSY3xtia7wVBn8s
--> ssh-ed25519 N240Tg 1tT+WIwhrNAZKiU11+rS6lo4XqII4yjwoC5h/J8GLkQ
-hLWQ7XFlmycr+J1MukhHFebYpsJVUwUz5F2+XNDU5g4
--> ssh-ed25519 2a2Yhw 5JwVo1eeVRryxYYaWznfHlIm2IbNcONOKK++ssMj2VY
-o1P5EycNl31HBfQYZyB3KL62ZxBej/t3T30dfo3WYko
--> ssh-ed25519 dMQYog Gh9wRFQ5at0IRp7lSUxqx4cmo9khOPMfS4B+QM7JRzU
-zVhsUzfXDOowR2ICIEqpTfm2TjsiFmK+3k0/cHJ/o/o
--> ssh-ed25519 G2eSCQ iv5pDSg2yIcqCJcBHS4GL2lbCZvzPxjHbkLjZJQEWD8
-JFGDm/7tRozdGVSdeA7kd6N8+Sj39OjJ/Aut6A/7w9A
--> ssh-ed25519 6AT2/g 3aE7p8BUJ0Dt6zATjGBql9Hgv4gzpAR5zqPahLbR/j0
-nfhfhAP2ZLWZPzRr2ZV7oaP2DEOGH/9Ygo0plrkmu4Y
--> ssh-ed25519 yHDAQw KR40v7vC6hRm9QqWtlF9WX8WIzbo7b0Bukvl1dHMiRE
-2F2jAXTK2g+82Y1kSzkRruqAfsCzhYwKEbJWtg2JbMk
--> ssh-ed25519 2+FxVg JQxr5S9RIOcVzBK2tNBtIBDnncldTPk9blnuGNxrmyI
-4vcIXvs9seQZ3GVPIqYr41Bd9xhPA11BlLHa+YNDf9Y
--> ssh-ed25519 CRfjsA HjpZxl25Xu175mNcmhb6gBJkSiN0rZAHGaxChssjkVw
-dX2D42NviiSQGCIPBPK1x4CzLf5v3fkcFM6+tVAi7k0
--> ssh-ed25519 vwVIvQ a08tDilNeVsKz/SdzmI7/drnMTyh8o45JJgc27yRZG0
-5qiAp/6uHLIBNdG9FZQqZsa7q9pbJyzlTe0UQvWikPw
--> ssh-ed25519 fBrw3g dDA8Vy5fpfTs7b3+mAVkR1HXvtSRcyq5shCHZtwDRxo
-gIk85ymB3yWjINCmlSJkaFMihCD1vDon8+OLwAh2wRU
--> ssh-ed25519 S5xQfg ElRT4mtq4Ksv0imJ5dbvW5M5DIgdStHQdrFqzmXZXho
-QCK3xZRemQtgXczwgwEbrf9oJZ9NtSHa3a50T+nE6AE
--> ssh-ed25519 XPxfUQ l8AbR8IsS33Q99i9uC0b3eT83tAX7CFiep0V6+62hRE
-D2YSywYJ3WzTm3VWMh4YWKBaTARQ/rexq7ked3Di9fA
--> ssh-ed25519 SpD5mg IQUqhLhcHQn9wfFY1RSZnv/GeQau6y2N9JOl6e8prgo
-K11LjHTz0VZyYj90xsbQznUBGvckPDX8jDy8md5o+8Y
--> ssh-ed25519 Kk8sng XRNVn/26tWcdLBzO3cb/XVdewgaw+b8sDIn0jDcWIU0
-r8yDTjK6W9BG18hAU/sN3G6o2jU1dyhn/no9SBNcT8s
--> P_O-grease M#%Ei0hU
-rzNzlsj4euy4zrS7S85p
---- T48w5S/LYYKktHmqdc//AxHomtH3Xz7CPxRD8KOhYoA
-dú6ûJ+B†·r!žøµŠC&Y1G/ÖKm½ BÞè©\ÆñSTü[l„uW
-á®fÄŒ
NTõå6éÜ|5c,R"É…ÜqôÍ+;šè|€ªÜ
+-> ssh-ed25519 xoAm7w 6fOw4Kh4O0WAdZG0WPBdl63ap/Xr/w+Rweylt/0mKDU
+M2ZYVPz9vVGjJ6us48pXSFKKH8tK8PhkvBUJAUriimY
+-> ssh-ed25519 mbw8xA JBYsd9iwH4E2GfGP63DwdwT4Y+gvL31sB3rSY2GKDmQ
+zMHRL3bDxeAkWdKYPPtc/xyrkZlNtzBwzMyt5lb0H4o
+-> ssh-ed25519 N240Tg 9DErfKdTHuvUcw9+5yzo8kMHa+IKxspGlWb6KRvPB0o
+q1FLalljaHyYxEu6JrmcXGYhYi0L7TAtV0U8UsaQ4cs
+-> ssh-ed25519 2a2Yhw eDolYbro00zktVZA8xdhbjvLkcOItFU/lTBPXNYypWI
+d1MlKnVGRf2T2VFPhDnsSF8fboF+5mAdXEMeJRTjJz8
+-> ssh-ed25519 dMQYog 2y6zkr37iC5VarUPOlrXVj9XyS5pihQq6O/K20gTMnc
+jQxtJYCH1JagBpaupGVizzk0ZCswOQvFTcxT8IeFtRI
+-> ssh-ed25519 G2eSCQ 8b0ZqtAxiFRfLEMHnj6LZmq5CQT7nMmfTwc+gpKbQQs
+kl9EvBs9BpZXoomdg30ViCMBV8xEnYlCD9GFY+dNVBM
+-> ssh-ed25519 6AT2/g kA3H9/fN5qyPquKIBQqYSGZYhxqDc7Zyj0CrjF0Nqgg
+zXrT+jpTJo6ToVzLuLzDcqblXKdDbjxt4Zr9CvWBZc0
+-> ssh-ed25519 yHDAQw vuMN4IU9wAIAWDFEDCr1yjEPtEMCISxYTx27qh4QS3U
+2vrVYYbBlbyEOmd7cpeijKeNk6uEe/1iWQcZO8dSrWI
+-> ssh-ed25519 hPp1nw TwogaV1PZXUekJoqXepW8sUm+DvPCxTEL+RobecJ3ys
+VKM1QHFM8qDW1ZCpueQEqQtQknoQ470nll7y6WTjlWA
+-> ssh-ed25519 CRfjsA dvkLphHpCButJtI/RMlt7RvaIuMNHLbF9y663tvuvhs
+VEwK/KDK93e2iwEcwmGM8vvhwqi+tNW8SYrbsehZbWE
+-> ssh-ed25519 vwVIvQ xnd9Vgz9FCeRu6yZbbIZbSBEvSkgPzFifye5eT8kmT0
+XOCZBNTP66Wzy5Vdn4qJwzApDx3U2qNnQqEBcwfARHk
+-> ssh-ed25519 fBrw3g 81Mv0OtBk9J2Tb7kjnT4uCGeytV7HJfOTcA5C4NoLy4
+hiMbGjXjtvBa2Puhb8GBas3WXc0fozRD4hg73MvQumw
+-> ssh-ed25519 S5xQfg F2oOMdM1U1aT4K6pIhCnCz5EbxnEb9Q4QZ0MkhSJKnE
+Pz2cyF+IGLz64466ne8np3xA7g+51S4s4mlaLRohIM4
+-> ssh-ed25519 XPxfUQ 3rIutnjj8fXIo3mCAL5nfzJep7q70j+AGLE3j/JxOhY
+v2Xj5PbpFMsf6Tx68u7VHCRqGa3Wrnsk4E6Q08SklUc
+-> ssh-ed25519 SpD5mg tmM+zaXpX+W8xsMfBCoWZc+7wPRI6yFt2W/p4O2s4lo
+ckNxHza6ruYdIffwxDFOWnYOUgpbWNfwzU5AQJb6ZAA
+-> ssh-ed25519 Kk8sng 2ddBuZ+DEVuvRmWS2O8r+xT4Qtrev78Vre+yQ3kNdEA
+LojDcUOsZtA5kw8kIPC2y+G21T1uKUEUkwkJ3xPiUX4
+-> "JnF1%Gd-grease |=~ P
+tzG7OLiEsRVyoTBpLPGwqNBUGkz0
+--- /AHllIllItlnpPXQAkywTF1UsUb7Wpec2jdYE6kOkO4
+lß´“ <>§K
+^U5{Ôpœ_l9ûá7I#J¯˜Á!ë†å`Cθ^vÚÕˆEòµßŸÁˆuž¥òä×_WPæo2.<èù w}¶Ì
+(!V®

secrets/peertube-init.age

@@ -1,37 +1,41 @@
 age-encryption.org/v1
--> ssh-ed25519 xoAm7w cxa29LYBQrc3YAW5rUvS6nfkEg0j66w5wYu1PZ8Wc0E
-NdsMgB5PVVsFrm7wR3xrOcMmIvP5pv6g+KYAhiRvpuI
--> ssh-ed25519 mbw8xA CKUESfDlXNokBZDcbmCkgD16V9han/+r5dFI2rnBcRc
-uc1sJ/OQ5gclZUSIAJ2c9VY2Xb/ArMNpSnNp+gSTWZA
--> ssh-ed25519 N240Tg 8ZUgwgnxZFMnR3F+8VSXDAYooXrJsWK5QpfSxKKSKBg
-raQOAeM4rpFuGMtjts6AkwcFaVRNoy0byVXBDR5BYYE
--> ssh-ed25519 2a2Yhw ig2GjUHCFT57AldnHOWs5uQAaOoFJeoounbweJTQlwE
-VARizPNxh8KHt/PxPgkagovHAVIiL8ex6XIwUM3xYLg
--> ssh-ed25519 dMQYog LQUCsEaZI+6jWrwz3HKWj4CJN1r2SeCJmc35b2/WsHc
-5S4K966vu1EdRTENYLgyCdmGBln28O/j9V3uPgjaS7g
--> ssh-ed25519 G2eSCQ zLkbxZbH3rsgENTIZJKDPo6ByTGjwRScgl3HVZxwu0E
-lHvz8F27CTG0pCW/nAJpdISuTcOiqpD2PhLOYyWCC6A
--> ssh-ed25519 6AT2/g 3pshwP5X6PFs8GhQVPQ5s3TSyEt/Z6mEswTvZ5ZLgUc
-nFSzE4oF+tnXklCyacNQwBJ82s1HdmGC6mWrYqRVd+w
--> ssh-ed25519 yHDAQw wnJ41lJounkHLnZB56fLgjles3dYOzoiFM8vOfEHPEU
-33TGDVzGFr5TSVSzK3MHYB5rHR70lBrnvpgyTVBsLl8
--> ssh-ed25519 2+FxVg NnL/Wt2gNb/0vkd9FgiZFlkbpCfwweAJUCXi94U1Jms
-fvkC5RGNBDZ4DLVjZvAQCvnqLeQAuQn0XCS+VFSyb2Y
--> ssh-ed25519 CRfjsA YC4+VW4epc3UKMDV5r6RXR4Vx8td1qCuTJwnSiHyxV4
-gRLgJqsMuTKD8SObfpR+3zWew5rjwdpEmUluyWco3Ps
--> ssh-ed25519 vwVIvQ qr9hH+jPD/2eXesSPE9/sk51EeuNHmPe+Br1XVJpsDo
-fiRhSdMKVo4K63UAJh4jyTky0aUZZUYFDAE0abWinYs
--> ssh-ed25519 fBrw3g d1YdgbjHQpvTgLjN9z/0eRtEYs3x0Wht506uxogWCm8
-d5bULkVNiFT4l9uJ/6k59dfcY5jYkv38YHjx7+07YRQ
--> ssh-ed25519 S5xQfg 9Q0QgN7g9kRGiOvBGZp+3TrVuGU3oyAvK9M64aUmbSA
-PJQPEpCM4zU5VLrqsMa9Qd2rZvQSq1vYbPc0uCwtWyk
--> ssh-ed25519 XPxfUQ qS5Y1YSx2g7ulSINPEbjm1lqL3OvGuLaj04tcPmjTiE
-hSw0TZRL+V4NinnYq37fC64zFM8CdhZFNXmd3ps0f3o
--> ssh-ed25519 SpD5mg 6215GJh97SQIklYqTx5WPUlPbNJUMo0vhXTwtr95rGM
-jklCiz/2AIAIuCKPFS8u1Bw8SXMf1AOV9X2P5UHXMUU
--> ssh-ed25519 Kk8sng F8va5sud1ck2V5MQ8ky14Eolj+YEIzoibGrty0wVQhw
-FQIkCvXEtPy+aek5rvU6SO/Cet+f4wzQ/ebqbLSaunU
--> 1k-grease wE~W)OD
-DXxr4+gUdNeA2+skSQ
---- n9Ef7xVWYWE0Gu0h2fLzw2gP4qOHKLsCZ/6Yjfxp/xA
-Ô…Ñ…(¾= e‘ŠjÿE‚ƒl)h·:¹žiÉ<C383>…ÂÎ(>6ð¶{ÜäêÏ:ÜlŽ,D¨º,I;þ3”˜»ªw¼¾úµ­Þþ)0“غ0ÆøXÖ{fè·—­@þƒÛꀪM­ˆÒ˜Žä!t
+-> ssh-ed25519 xoAm7w N9ZPma02+vK6eoQ6X9/AufI8d9Sq0fAmbCygEAprM30
+qUcK7qCxU/wGxssjMO3BFmiP+ZPCMMA+MPsqTS6Hau8
+-> ssh-ed25519 mbw8xA 1uhQY3YHakSRBjgVfqWc3ynGGNT+T6qR74oy7UpbdGM
+7cvBh7xPxDxZqrQURBUUnyk2YjzVY/kzAUf7dy5y/JI
+-> ssh-ed25519 N240Tg ujiP5iMMSupxkwhY1DpkmRQOQlZSr9WjPGrY7aUKmnQ
+FNeXuINzgDB+gn/u76gQq7J1zYCQC0wbFyUVxvbalI4
+-> ssh-ed25519 2a2Yhw C8/2A7AOzjyrH4Ulre9G+w1y7H1pvVZe6k5PTmGBlCI
+9W6w4Ib0riy9sbZEQvSYeJ42LXwPruV8kPvTOP+dMqg
+-> ssh-ed25519 dMQYog hIbfS8dz5LGPZ9sU+lHHnL8KB0CceM2nYV5mFV038gY
+6r14pRwszEZGVzDRZQlymlgjdp1Zd+r/O2IfjqxBZcs
+-> ssh-ed25519 G2eSCQ kvgWxBHowwVcGlm3KiWjxug+Wx3zkcMWl4wbPRrhrl8
+A5VtHqvDwaa8jONXMTvVQC1ALcnsiqxllM/DrRXWFws
+-> ssh-ed25519 6AT2/g XUGBtkOcpLRKNDS3hsyXAap1DXAIeaRX9jFOfhUpMw4
+sq/Ziv4RGRBmrUgS0GWTQs8AViUXBWjUxqf0V/rAN8E
+-> ssh-ed25519 yHDAQw GmscTQwu+lHC2VARJusQ606NLf6OlxITZzINjrbxf2o
+LmuIU71tE+2OlF0HGNS+DdXCLdA5lAeTPXl1S+V5KCA
+-> ssh-ed25519 hPp1nw XQbGxz+YJ8RieN0HxEQz9kJfikbWTtz1hFNGQBHkXzg
+1yst2YMs9XelKpIGyl+qxAgrFZ+Hq9odh6wBovbb8sc
+-> ssh-ed25519 CRfjsA 79TlEM5+g11lMOkkW/KvSTmt//ChklK3jlUHLAM/1hQ
+9X1VP6SYST3Q841ahE+fAeg0FhKq+/XcZdysigIOgdc
+-> ssh-ed25519 vwVIvQ 1r0/J5T1fEmOjM7ybKDPOBdE2UIDEUdkIFNWGJBzXGs
+gAOX/3koAfQx8er8nt4dlvLbIoYfeVPENjz7wLNoFwg
+-> ssh-ed25519 fBrw3g 9hdWAt6qEwjAwVmTprCkR2q6GsE4dEOCiCTRfz58fTk
+f24fPWUrwtt1UN2ebk7tj7gBY8EiAMwvEvztCvaNZRc
+-> ssh-ed25519 S5xQfg wyY1lx8QIDJy9pCi9zS3T3lNV0jQGhVC8HvyI60zrD4
+6+agBFHfxcaTLfZLyEeUMl9zyaFbsM9X2EXPvf6DfeM
+-> ssh-ed25519 XPxfUQ IabbhU0TM3zImRHyKk1NLnGRUUTuQHHCMLzp9AltDVE
+vf+5OlycHphA0i4nB7c6OtBBahWPJR/8VSWzudM9FEc
+-> ssh-ed25519 SpD5mg VSBErQVSLWPcA7C3p+wuL0/JaP58O5Gvy8z5eJduky0
+jnd3tBVjqhf8oZy9h2soMZVPEa2dvYHxvrNUdKK/UwU
+-> ssh-ed25519 Kk8sng 3gM4o/sdewPR8BZo8owBVEE2GwqnQgUeA1Uxsd8nOlM
+VpgZRzc4tN7QX8s41iKoCstfU0KgrGhWolfws8QXYr8
+-> vWbrVo-grease ,kVQ{
+PpMMMc8V/eqh5OBEcK067OIY3UQt9QTjHCVVesZediQxm/E2rRYvKm793NdgsflT
+mAA0Lcu8/6EPFWtK05TxkDO+JaVfrvKLKuh/E3k
+--- eKZw2cOm1WsLYj/Bx14q433kkZ6altIqL0qnBSYXjn8
+>»KÝ’-B<15>vœâŒ×ôÕŽ}4©Q‹åÎ˳x
+ÅîÝÒ{ʱí­
+0U
<01>Ò

ê¶×Ý
+' @JÕ¢ç¼$‹IKBÞ:Øp<C398>‡;7EìÞ%x µG ’®RsÆv˜<76>Ú6rtÇ<74>›e”

secrets/pia-login.conf

@@ -1,37 +1,38 @@
 age-encryption.org/v1
--> ssh-ed25519 xoAm7w 6YE8Xut+bONuueEoD3aAPn6ly0nlgHKmPhrOYmaZyys
-OFY0cogxB/TM5ShiYG9OyAlIXJvPWrgmB4QZrdTYTGA
--> ssh-ed25519 mbw8xA mZdtNfY4gLd31NYVhhdFqKhNh+tKTCGayG8n8CY16Xk
-3FVJm0Ky29mtmCo2NaeCPqcurt1oy+1kFaGzBMRFvgY
--> ssh-ed25519 N240Tg 8ldjy789NFoPb6FprQEESprs2G+tH4h59uZ1cR9OKmI
-527JcKENr6ddpZ1xWy+9rWgsFG/0/okHYtyZ8bnIGtU
--> ssh-ed25519 2a2Yhw CSpAusLjwTyUMR3TQEX7K6wLkEBQCTwDmDWzqa4BWE8
-ZMWO6kC/xXdzeYzuMtj0PU78rjCB2SxmLW2FkEm3GwA
--> ssh-ed25519 dMQYog xKjJsFoT+B3+vm+92ywinppmwbMDFqlLHLlQh56d5m0
-c8yhBQL/umJZoAqPXJFYFZVN2CwyftPnXZbL6BEo/XA
--> ssh-ed25519 G2eSCQ PNecZsY2AXDMAZvPw+HMdioRE+4hiqoXViwQDAvCWn0
-3xemYVepW2NvII/zDuUsFfp5uBFQzU5Iz2zHpnSACfo
--> ssh-ed25519 6AT2/g fnRDsTvXSqLKzraCy2QUqIqCteAlVuSqrkohHoIQh1A
-NJaoRKC8IyZcaObclNuvIJV1xtNA2Vnh6+6gylNBRko
--> ssh-ed25519 yHDAQw vhIaLzY3A5H4xVoWXJDFXdlX/Ddk0OCScSp72Jy+jjA
-r4sj0I/Vs1/klWNa1Ud/alCCmuGGKbZ38K0UAbxOaNg
--> ssh-ed25519 2+FxVg UfBGv5v9kilraMWTgPj6reFn1Ipv8elF/Je2L8HJfzE
-xeMgBC6Ao2ykXFNRbdok/gC1RXHjH4NPiv7lpFzCWGI
--> ssh-ed25519 CRfjsA 7Zz5w+LgThJBhCeTLsT09rZnQiaLnFUuuxxFz0ui7xQ
-XCPZeaiQ9uDS7dachDEFKZXc2VI+2S3EpP8m4fWH714
--> ssh-ed25519 vwVIvQ 5Bc4/BrCY4VdCabJ+XW+e3UPshgZWYFktE/QBb7+0Tk
-0+2IcVoyV7aX4wSBkwD0uuZlzInTXXJpJ582dQiwlME
--> ssh-ed25519 fBrw3g NcGqfNA75TZK8snDZ1RV7CXDVDHzIo27CzUlisWw8X4
-s9UR8O4q4w/PbAZPSd3+hubg8GdUBYfhQ0zaRTgTx5o
--> ssh-ed25519 S5xQfg xtYjArK1YYAV4ts55E0jPIovtagFV7UJRb3iv1Om43U
-SkqJ8UmlKtf+0KntLyjZ8Rgf0MtapEnEoVA+xTFbVSc
--> ssh-ed25519 XPxfUQ gy1JvMR1oy1mstVgPAc8m2haExzpEaJj+2POUNc0ZUw
-+HaGMvuuybpJaWs2yCjUyJ29jXKaDLkFBm9l1WLus/M
--> ssh-ed25519 SpD5mg C2BcTINChQTOMgMnn6wjJZ7ADmiqJpE4Z5dYZ3z4wwE
-QgUNdg/PSj67SdNfa08YvupPfV4GWnSkwcRIt7ZgOVY
--> ssh-ed25519 Kk8sng +bkUV2nOzxIrwjFWNErRE3G5itxwzDKs6lG0NlSe/CI
-X8rlOeGQLzZXiIrkVFHJDHPt6ruuBs99jZ1XLZSAgBw
--> N+U,G!$-grease u eB<}B2q $nG@I[&z D..uu,:
-E3PUEP7Z7anp0PcXD2CDpRsv
---- FlP6ry9X2YIf++tM8sOD6wqqrmRgGNBED5RmAepRfOk
-(Z‘4š¾´×Éxt-à<>¡Ø¤N9¥ÌÜÖ<í®Tû‹ÁGß.RW#kÞ'v%øã@êR‰!#Á%Ô|<7C>CùÉP€YÜÀší¹‘ Œt1Ñ¿³ †Ñ3qÑ
`
+-> ssh-ed25519 xoAm7w SqYHa6RK3Qc2q7PnzW+2zWIc+A45lcgsGUOcloo5NCY
+YK3fq1eFLcrYyeB0jrbpaDlvZI4QXtGDB6gBsNOHRbc
+-> ssh-ed25519 mbw8xA td67bdiy9OVhynehUE0t9WNhSm5mibBSouANJsb54DI
+k5Q0NYRDLuEVqi6spysZ3wczsl6KeJHnzeQs4AcfOPM
+-> ssh-ed25519 N240Tg yQxm7sk3zmluyfrHuXcfcUH4bep9yO2yasWsZL8jlm0
+0uLbEiU6G+BOFnhdtQ7y1TaZun3L9cayeOJUiKmhK3I
+-> ssh-ed25519 2a2Yhw rWgv/wgxs/G8JqWRMX4K8OMkbDDEWKXn8tr1EZHXNTg
+//vsUBg5VSyyPOhUppiV4hkEhSVh7TUxlgRhroeMH2Y
+-> ssh-ed25519 dMQYog C231LaIgcDukZz+Q0w3BS6QoRNPYBpQnDc0iapNDACY
+h053cONj1m8SP/V9oFU7MuMRNKq8KNxr9FyWoRShZ2w
+-> ssh-ed25519 G2eSCQ oazxEulqB0zTHwBBZxxBvskYLENNm62hy0EMt/6BIi0
+rM8Evty9wq4qC/Tau0bU0LgBqNP1J6Zt+iQeYwhBJ1g
+-> ssh-ed25519 6AT2/g GWYlWQLxy+JjQUGGG4P2ePuqYkUov/0OV1gyAUfo7xE
+CT4W8xfyQyZ8LgnVWncxL9TMyf2tC1mXhjJ8/OrV/yk
+-> ssh-ed25519 yHDAQw 5FsOvziKO7oXBvIbJ6ikUHyZsfJcwoXcXYmCCCZlUl4
+5wywGXF9/QbqT0H3f7GY1J79ZwrFaSG6qzHll5G9Xcc
+-> ssh-ed25519 hPp1nw Aii3iq5LHQPAWIGj7RbK18ChTij7zYnARHqXTAcU+wo
+218UL87Ev75zAsloHSkLlQoSLk3u+XaRgMpqFlHQEIM
+-> ssh-ed25519 CRfjsA AafQ3rTlpqLZqz614VPy0h0o+ha4f7gdx3zuoO7h9BI
+jyhVN8DsgSo58YPKb8c/eBWSgunbLgN0tnvqTaaOxTU
+-> ssh-ed25519 vwVIvQ oQHpWgGDhgea9M774iyQ2gP0hvSgFr5ScM4ZdhMHD2g
+9vJjWXwOqpOfegf9ZtKMxAayDsn2ziHGTHGIBlAO71E
+-> ssh-ed25519 fBrw3g lGSzsEt5Ot/RHwJbL3fNQoR29ZQ7EsFUWv7HjWnU9wg
+cufwuuyT/Vcf3QeJGXEcYFUQqjf0US95po7FaGMYXAE
+-> ssh-ed25519 S5xQfg CGj9qzx3vvlNnHh5RUyg4+3gVpIEcgGYbYJr61oTJgI
+x3TLtdaRpFtMRTC/RdngyBOeXQFEVvQIRdfAsaj8hj4
+-> ssh-ed25519 XPxfUQ r1iu+mpoUVuf0AqaDsrumw8SOdiHapODcgrYRrAuSjo
+1XNRKfEgm2U9DXZmNogFr9B9MqibE72NjyHiy2zZFMk
+-> ssh-ed25519 SpD5mg NM2MP1/5yxwQvvpiHnq1aiXQg4yxWpsNH/Isrwcz1Vo
+IdWPzZg+/mwCr91bIlDMpAiii/HWsnIxTGXnetYjRPA
+-> ssh-ed25519 Kk8sng 4NAaCbs1EOQpZz/qm8yW7PkFdsn8seSTgInow1zqBiE
+2MJJNUFyBkxy26adDmoJKNndeQT+MsJGjdYiXMpMS4g
+-> A-grease L''*[IU]
+5xdl3E2HB0Yz2TKiRucf1X/PV2JS4rc4LG4cKJ9VYIUksE5Aoj26E8h1izCrhEsp
+Hnr2xC029yD3shPQ1w
+--- OjLAmZwep6nKTZYMUuBBaMe+F3FmWqsCM2XCDqoiG/4
+ÍZΛëk²¬¨œoéG´ûCbÇÚ!Zö{ʦƒ\öO˜+PK±¬†’rîЕîA´~zÕô@ö’\Õ‘±M3G¿i’ÚGl‹èçÒ~€!þ§Á*Qõ‡ã

secrets/searx.age

@@ -1,39 +1,40 @@
 age-encryption.org/v1
--> ssh-ed25519 xoAm7w 8/Xbnl2GV2BouMzSyi9SccnOvkr9MhD16hL7mATBok0
-IIUWe7J0BA2KtKSCV9hGHwwutyV0iDXEp4iBw2ECP1E
--> ssh-ed25519 mbw8xA ljb+MWwZ9neSLiGcRRiVV77AS887N9LrfJLi6f/XYQk
-sNYx/g82DJC8boBMYev5HpHrBf/6d3Itr3O3C1M9nUE
--> ssh-ed25519 N240Tg RpJNQFws7kfcXBoEjAHSZSDrxxCK+Wvd+TxAS218iUI
-Ykb4uzw9s3TYcNmV5Bv3Fos2P3L9OkKwPCP/dr5aMJI
--> ssh-ed25519 2a2Yhw kFpleOyyyhKDq41jgohT0BCpVpasAoiIUPs3oB/kEWw
-9tHqujFzQ6QI8jQUEevspybHVDtzwyNoWEXUhDitlKo
--> ssh-ed25519 dMQYog ISBfsqV1suikFT1b/0bWj3Lk8VLR/PQrQjviWg4JmCg
-nDnUy5N987f/TAwanzzOKtdYLJ2ywoikugr2sGuVI7s
--> ssh-ed25519 G2eSCQ ygV0RkgqXQxvsmXOIjAPfopWldnsMZ8KgwRKletoGCU
-sELGgITcp3DKT1sNoUzE1Nl7tyINq06TfYP7k2yKLYo
--> ssh-ed25519 6AT2/g EtzGUZOzofDnfd5M8wIIxaoTk34hr49PbChEqMmRHHw
-DvEzWA9X7OWjHAl5JCVV09R6KTA/JwlBcB/lyFVgbvU
--> ssh-ed25519 yHDAQw +ojBBWCXn0DDBK9kfhDRYwbIQgOVE49vAZJ5skq0Wy0
-MbX37CfoHI/Y9KAj39XgRfa83CzgGuTRkZ+tcKT4Icw
--> ssh-ed25519 2+FxVg 421B7+BKrkKUv4anVKUtptyCneC9lMuAuqfYtow6j3U
-4BDAGe7MmBPX/3c6SXnSIiZB1QzkyIDT+HKiXIB5QdI
--> ssh-ed25519 CRfjsA aBrHk8ZZKbSLYKjjySs1Qj//e7kGIjIBVMeT7An9zkk
-W20VN7h3QwmRJmV5J3VGl7IhqUQatVAlncfufjnPwII
--> ssh-ed25519 vwVIvQ b9wq6xiir/uVFSbs+0pN34Ec+F47CwKAvjEDQEZJylA
-CKiFnDpY0S/iZrMPNNMAT4+aZ55KNviXmCphe89bjCk
--> ssh-ed25519 fBrw3g F7MkD9bPZ3awfYdd3v4If+XCgtCRRS+rq/uW365mnks
-vGWy9YrSiBESG4MWxgqWZzol1YSRUGgbjY+2Q6FwLWQ
--> ssh-ed25519 S5xQfg lZDkCihzUwC7rGSeRFxvN1Yue5Ql/8MveeIMv8nXLRU
-5yxTfZhyk00iQnnFIsGvStPGFb4lWhn8bgDsnQvNnsY
--> ssh-ed25519 XPxfUQ zlZV5zjm2XkSo+6CQ5nLTaw6gPTaDbu0D7VHsYmKYg0
-SpdQFAmBAOQVZL+kAKIQcix2+lCwvxqJvOPid6crL+o
--> ssh-ed25519 SpD5mg 4z+FHDyqILNWuc1iyqC9bLSZ43MhzdZmsMi0rnMb/wU
-aBGWQ7GIIkQ8gDyrFYCLBFIzaj+VY88FfTJphzprST0
--> ssh-ed25519 Kk8sng p0YQLEF0uEq1aLcaNnnCE+z1FkI0DA5QaCR7VJ3ZaXE
-djFc0xi5DqZpf+on2ytj1GuVy7SVcxey2Wzuvwy8AY4
--> UuD+-grease b 4<Q0g" hgjWJo qiA
-19psCQoHNTysO3fsEMnVkLahsWJPgshhy5hQKX3dWUUaNUwnVSf+WDKXKnjeupWo
-OaEPSmp8I5e0lpAggFZZhYwCu9fG2BZCFLeXNm2LFzUli9pgjFdYz/up2hB5C/c4
-
---- jMFadnLfkEPXvTzhx5TKtnK6Yr+r3pgpv4cz2RBok/I
-Èþ
\Lh¿_r.”z½S«2ʧEª±J¹b—#ð†~<7E> >$çÜßü&})ßÿT§ÚãW<nbNÞ¢þ5Àœ<>‹-¹qê#J?½(µÚŠÙô.^›pgF&'Ø:z:ó¡Àæi\å¡ä.¼Hf^Q­²ðØèö¯|K¡oŽÎš	zŒìC
+-> ssh-ed25519 xoAm7w CNXq63Qxe5wvwn0dr7QKcJogg9cO5+no3FcNmxkL7Gg
+w14UiCOJofq3r8VikRCOjIp29NXvoKJHyRms6tjr3/M
+-> ssh-ed25519 mbw8xA tzrtBUcTaOZBi2BNhgwN45MqMlQKGZU6FYm8IEQJKH8
+Vpc/0IHNizsxTozoVm0YZdm0qgKwx1sZ/JMIKSjQW3g
+-> ssh-ed25519 N240Tg F4wZmhSgHx1+tLok5IdJe+CCzWf6LmlkOFNGWqOpxXc
+ZF7+t0HDmfaJnyNe3lkz5aVFezD7mAxqRiDCZCwW2sk
+-> ssh-ed25519 2a2Yhw rC3PH9ftW4UWPuUpP6tThaSe9AkfKUiEgQPPXerJ/SA
+UNKobz02TnEN/oqhp7hwS46mU1IA0ehVzLqeIm9QVVk
+-> ssh-ed25519 dMQYog XowiBliO/PhqZFnmfnXWmw7KVT8I8Rp46RjuFd/amEM
+eAhc4PVY/3ZjwiNihO9Yqa/au6ebkXmqbK4Zehf/FxQ
+-> ssh-ed25519 G2eSCQ ann2y2LP2fIHtQRLtpLow/g2yTmcEYpUrbc0N69iJxI
+N1VAHkPjzxA5Vf9lKY5o7SWFy1kxlv78LSDcRt/MxaU
+-> ssh-ed25519 6AT2/g uQhLUtHpvNoLBUs0zvdMeGTtXQH8gHzNiRfDq1x/3yA
+rhSm2KQw3k/nhrm2UmCWJ1oBcmYwP1S8hAY5xUALY5U
+-> ssh-ed25519 yHDAQw qO/7smo6DZpW4/dBvkorYBYSGBdemDe7UrdSXDjb8zk
+xkRizpKMEbD0X3BsdSfc5DgjYG1IQLKJuQjLLSwPnzU
+-> ssh-ed25519 hPp1nw +Y+MeoeD58k8uedCeD2RbRyGlcLYEgNc2PC0Hr7MuTY
+B3wQcio9YW1Vl6reg6APLKDbizQDxWY32CkXbuzyyt4
+-> ssh-ed25519 CRfjsA 6KxnAOe2pmjfwTiQZe8zHaeNJApPYdCCFK1OlFaE61A
+9psQfGIFCSjSYw0AKpKRFZ5qIYFOvq3FvHFyVRa/zbI
+-> ssh-ed25519 vwVIvQ Zghw7uz/yR4dgsFhbeXfPvk1HmSaXV6CcRD6GlHeiGI
+KTM1Xu01FBcsmhJVeB6VGhMqHpnpLNmvWVBxV0+JW5Y
+-> ssh-ed25519 fBrw3g h+wmH368BHkFp5Mu3PnbZFjyMVRBNcwU4hloIaZEaGo
+TKPz2C3yF2wBsiT8/WhbKEg792PLcQ3YN5UWcxJnwtE
+-> ssh-ed25519 S5xQfg YZcNHfVDJ0GRF+IpLVSxOeBOSoDhDhdL7r2npRYcuEg
+mPfQ+m3SGGnGO32oA917AfosSnXGqHRDdMfIypK+UOw
+-> ssh-ed25519 XPxfUQ jsXVjpItFnuJiaeYIaYKsJFusASry67LiqDW3n5+QSg
+0KzbBSbRrq6JrpWEyTbs41b4gUUiKeZzWI3rBaa/AdM
+-> ssh-ed25519 SpD5mg 873X6UIo87svyS+jhQGjILcVy+RjtsKwJfDyj6gmF3I
+KNHCRKZ5NhJbNmrhWehpUXEv6jBGeJkRxCi9+/bgouA
+-> ssh-ed25519 Kk8sng /ItiKGK46Wia6VSKa2AtEPj+PqpDtWxBhea4s3mqOVo
+OPclxoc2MygKYJtahVbLfE72X4s4yVil4dugeSF/3DU
+-> U(/M3X-grease Jh[D'
+z6L8qVMUmuElYKbQViqc6tecJic8gho79RaMilbwp7uS+owmgqNMUFxv9+8bbtYY
+wC+YIigf5xAKlwcOipCJ7xv3jlqt8yUFWV8hg3J0GRbkWnhFYdWGXHnPtomPFtE
+--- bD5IgVE3GQSnej0FLxh1nGD2q2/fuhqRL2yYw+2KMek
+·)ˆ7&ªð„3¦ Ñ_¾â
%!2aâýÍݱQ
+ÿ6hêlÑ	)Í0ß}*ÌmìO(¿l8^"È‘Ì‘ù<H¡Žqr¶²û³!r<0F>ÌXóÖ˜ºxó:FF£¹áÉó§‚#.Ž™Ú"[Š9çZ„°
+C¾ÜÊ62›¥-'™ÛX$S

secrets/spotifyd.age

@@ -1,37 +1,38 @@
 age-encryption.org/v1
--> ssh-ed25519 xoAm7w oWqlikYvtZPfXQywZ/XuMW0b/w3+5D+KkaAimixxwAQ
-I4kD0+enhgNuQWC4PYaL+9yvitL471K5EiUJ5B8nAw8
--> ssh-ed25519 mbw8xA CBJUxWTXE8Ln/3qFqMg0FeLBc9OFsSAl2AHeeygOwEk
-+abHOk0hrRQDn7grE9frUJh7Wa28hW5Mak2m0mVGWpo
--> ssh-ed25519 N240Tg X2+ColuqWnXT1WRmLQ8wr8qea8uwhWteClBYBNKTIFc
-v3YeIjzItehJKMPovIcGxOsAH3lBt7Au5GzcMFyYQME
--> ssh-ed25519 2a2Yhw UJX1qygh1EOG7IR3kRTaUF+CTTmeK64K7WDlSRejoBs
-3dHllueF9JR8pirslK9KnRh5DuIg3yoI+P3xAETWgZc
--> ssh-ed25519 dMQYog el0Oc5Er66UQiJXKbS0K1bKKb1fP3gvlaJE0PxMF60s
-ceoXPA0zjkFcqWA2sBA7F956w0yzIH1EWTZhPAxmEOc
--> ssh-ed25519 G2eSCQ 4Lo9os9HsE/S8RD9hvFmMZCUZndu4u+Y5kiMMDqxEEU
-N7Ii/hgJ2YzyykzZYyL42xirKE7czTfhcdg59j5T090
--> ssh-ed25519 6AT2/g vBgK1qHPdccfAhfW+XhMuUwki5j4V34mbC1JStDy8hw
-6dMibsL7dkzOdNFXq95iIVLZrcw1gvjX//Kv2ggNbeM
--> ssh-ed25519 yHDAQw nu+lave53WZ3gTlQbxIbNZCQWwOgx9oHqcGmBf3YkDM
-aqpjYlhHa2osez/hbXlRD4nbNwAPelCWeQo7BjUYuHI
--> ssh-ed25519 2+FxVg W/YJBvKMT8etI3GGFNzQMne+3s3bX96+C01hqpl0QWc
-bRDwFFn4R0oVoItxfiBgtg6GIypDxVnsgjQCYDqa1/Q
--> ssh-ed25519 CRfjsA v3Mq+ywipRWdk7E0uiGkzVrTLGbKtVRKQCeENsprXFQ
-pUNkotqQs7AdnOFq6uK+Y1Aw1XPpYOk78MrL7mYNXBs
--> ssh-ed25519 vwVIvQ ktAGql+uSv5FlTGRX/dh/i+SeNf/425Ty9EP7LvIyQA
-uzyYPdpoY+wu8K1XphBaQUQaPUI/eaj+pN4hFQOEb1s
--> ssh-ed25519 fBrw3g 89smE2Osv+DQnmjli4erhsBx/tajT4kcUMn9BFANWHk
-PFVelVa6VjY/09vFwqTIrRuvEuiOjV66KzFMYrMqksE
--> ssh-ed25519 S5xQfg AneXz8P0Uzq9xlAhUo8NjP+4Lu98LEvVjXuI4T7nGTs
-8maTe5Ql/BydWva8FpGqFW19yjOEwR9m3WjnHwoaP/Y
--> ssh-ed25519 XPxfUQ tCIPHgsUCVjL8J6rel0wriavQPI8X8A+LrralWhX7XM
-tw75vmwvDkfkSsLHm7J/1G1RtXCBmmK+4/x8kszHaDk
--> ssh-ed25519 SpD5mg +zS3tCZuEDPmyJJAwxd5XwHZ6Oj529ASDJncvkHiWx8
-s4FlthCezHVAwnAxeEsaaztzmhEvsd9Rfv2BiyyQHcs
--> ssh-ed25519 Kk8sng aAfQRcv43KV2/bU4Lu+Do4KEz++WmvqjHBjpK5Frmjo
-I+fuEjPECpvC8hvEX+eDjFWWo3nOSuxApJuMmaq/ROM
--> L((Gv+;X-grease
-FJW/OLKcapzoBETajzdgteof4o4CS0SCge1G
---- c4qHoenW7h4CZIBcFhf/jkGQFc1ztJPcC6VqwmQKZdE
-<EFBFBD>[qáAÚÀÛP»øK!É¥eÙAÁ¼Já1¤ãÀ<C3A3>õŽ'Ÿâ¯¢•}\±cù«vñŒJW< c•€µ~ÊÙB¾˜Ö&³?d-~¾¾f^ödæ0{hárJ÷ÝLÑ<4C>‹óB­¬†|ªPêºÈî
+-> ssh-ed25519 xoAm7w F1C6i9iOvzUf6pS7eBfcsRFRn4q2YE7htxCqiLvasw0
+viF83MLadEfum6wQWgbl/h0l65+jAtBszhevVS4jh4k
+-> ssh-ed25519 mbw8xA Ec2wju2txmmCHuVNDWdLQkfUNY7/okY2koAz6Jur53o
+JLmlpd43QO/LPvS0TW9eKh6f5zZmbVDWjYn44J5ZqMo
+-> ssh-ed25519 N240Tg 1bl9Y+I3XGx7RiY8078wEMdaAishvW84nMrprt8jjVU
+4lXtc1rGouF1DoTohQnSEMvNwRZaaenimEFypsfxajM
+-> ssh-ed25519 2a2Yhw SDknhtgjNgNy3ktoNNvLie3OdO8bKhWW5P4s73OtLk8
+Ihl/yNw35f2CgcZX6KHRXUTpAHp6aAQR/7oeU+gq3V4
+-> ssh-ed25519 dMQYog dME46DZmwFnKBKlmx5AZEoaVipBmpuz66RXPQfFoXSY
+eAzeaSpIL5KPQADGEeuX/bkQ014L8MeTQF2fapO2N/w
+-> ssh-ed25519 G2eSCQ 8/xTD9nSXyAeZwBEdJgLcOembBwnMOgWX3jR4N2sXC8
+0BmY7u5TEcIEza2PZIJEamV2dfC0sDeVl0UXECBwDlc
+-> ssh-ed25519 6AT2/g xSdH52Oq0TOg0D76WlDVSY5kJb0hMAWoM3XVyMtAeWk
+0p2AHJDa9XK6C2g8AM/g7cWdR5DGLk6SoUL3Nah2G1M
+-> ssh-ed25519 yHDAQw mQBHUkvKf+Na8pCfl2Vb7+sKLmKth0lbxDFEcTtH/ng
+JDPxV93vE8mKJtDp/MewHA0F78rW/0ZPYUQKkdNUivs
+-> ssh-ed25519 hPp1nw htVxNW9zp7J38WN06jfEX417xtXt50iMTRUtrzLRO2k
+iTHjoS5eWNiQxIWtuylkqXlO8E+Dx/2CkENs16lZqhQ
+-> ssh-ed25519 CRfjsA Dqs/SAfRhgszI9pz4yZHyVp0iqPg1ssspX6ZW2QTv10
+tA7NQXpPtJQ4mHjTDr4pTt9jrqDkMJZGMLVazOenMbs
+-> ssh-ed25519 vwVIvQ oNmVe26rEpI7nNGlI5G7Er9fu7blpHNE6NOeGkoR/TM
+vAL2gsM9NatGQpnNIh8XpCP+o9KoOnuLVt9e8+Kymcw
+-> ssh-ed25519 fBrw3g 7GVBA1eUhgxGfiiKirK/i5JUbehOJVgmc2H/tgQ+A1s
+n3i9gtNt4aRT4EOk8C94lGmXNN538HNOqo8uCmxZz6o
+-> ssh-ed25519 S5xQfg 2KQLClmvqWMuJDOSAkzcpJkRTJgV6ig5Cq22RcCixWA
+zYULXTJL5o5uZxxi/fOCrocxZooH3KarUj8vUDkfWn8
+-> ssh-ed25519 XPxfUQ z0v4A6O509NqQgbKFzZrY2WL1ATc9SCYckbtqaSOdk0
+PbDNvSWw4QEGLUzhp8IrX0oMDJzWjeemuEDZ02YlClo
+-> ssh-ed25519 SpD5mg +A6LavFPjRHuTyk0MTZ6zmJf+CIMX69fT/HI6/0RJWI
+CVgJC3y/H7MHUCMR5s77oPWA56oIEpj+7MZH+Qw/LTU
+-> ssh-ed25519 Kk8sng 4Re6/B65/TMi45/fZh7zl7dAzH4MnCnHqca1Otpaa2o
+zJAlQ96vODytPwtwPSxEEi8hn052vCGcPUxECyU9Ivo
+-> V1&(!o4J-grease I)F/
+AQ7tCx9XyVd3QDf9Tadcz8QIOJ3bgj4kDh8YuwATAmF7M9DPAlQiW5qkkvaALloG
+KwwV
+--- VnZ2JJVPKnr8hDMqsZidpehwkLY9W2UmF40/5Khu7rg
+„;»­晣,‘ΧÂ<C2A7>òHµˆ›¿ˆ±‚>ê¬?þL¬Üiv?PËwùìŒímW£›­3„^¯{^ÂÆ«"ýçMÈ[…P¤$­RàüNðú…£ÄŽýÓ6LÍ Ï
´˜»ò½$yôl

secrets/wolframalpha.age

@@ -1,37 +1,38 @@
 age-encryption.org/v1
--> ssh-ed25519 xoAm7w Zhpc9RVEpY8IQHoaV7bXITknEzZvD3vhtlkyS2NiED4
-XF4a0bcetANx/Uc14yI/g4iu1rg6tilwGXS4EZDiC9M
--> ssh-ed25519 mbw8xA 3y/ebluo5ydfc0dvKgfjX9d3h9oMIHB2f4zrTQZ1VRY
-J+QzUk3lK6Lts4xbrFB9MsZGaITH2727tZ7wP5vv6II
--> ssh-ed25519 N240Tg wn8PvBMhca6ZaWwSGC6QT6RU0Evkf+T0pyp0KtL4u38
-7/qQJHlx0KawNp6h6UeNvhXEEZ9c2m+BBHxdYihh/Yo
--> ssh-ed25519 2a2Yhw HC2B/ovIP9yOY8f1Y9vfdPqGmf2WDZOZ02o0U09CPTI
-RlEnllYliqBORlAXMHBBJBQD2L8MUmtrCnnO37f1BfI
--> ssh-ed25519 dMQYog 0iDHfwUHCba5Qybli5GDAqCtNPplS5n9j76ukk0ZBDI
-qCDVF47jdG5NesPRNy0IKLbJqPazoZ636Ow2WCdXTZk
--> ssh-ed25519 G2eSCQ 3QltdxVJUixiewBLgdpJDaovHIHErX3Q2mhvTH1XgVg
-6rbVirj6LznfVZ6FcD+VoeOyj/4sduMVkWAm/pLVVwk
--> ssh-ed25519 6AT2/g Kyz9q3tPuiX6X5wUU6fyESJetkcTNgPu3KoWFFO/EE8
-wQRGnXdTrFVhdUrCRfHYoIRK1Yun4QURxIdd9dBvH8s
--> ssh-ed25519 yHDAQw lElQZAKDD+AhsNEAIrz/3i1Z5YS0U46bQ+YHjxtX7Fc
-ez72aO1BiG6J1G4LOVQDMUh8cAhqpxc1kcXJRRkg2Qg
--> ssh-ed25519 2+FxVg gbGEias/yB8ILGsVhhwfCNwGDCtKEa027TY5f8vAfhA
-LcsSY9f5UI2akH5USLBMd0V9eDwd6vCpxjDPWZcXnpQ
--> ssh-ed25519 CRfjsA Pd2ZMD1asDSzddRD36LZUPvkYjDeHfZyEpOXMnwB8Xc
-aFqMTiRL7zPKc480CysFu9645UIZ0BmqBAhB3nAxb44
--> ssh-ed25519 vwVIvQ LEym3BnhIR0eFb1/T3HHh+Ozo64qJ4L0L9gH3OGfLQU
-54g4goCKamaNHNfx2kNVoMD/RmbcGMgbQ/71zdsuYhg
--> ssh-ed25519 fBrw3g rodu0fR9X+20LKQ8+FccwWpiT0LbU0KAA2NHmXbSM2A
-w0W9cqZ81aJcpl6GT/zCHKMy2qhAKWdVRSVTgmmq7Ec
--> ssh-ed25519 S5xQfg zi2A//LI7Ot9MX1gohQxS8e6qHRozw3kEpyMU7jnfWc
-72T7ctknEgZ+nnFCgct7B8tDa1/DJqkk6LAiJ5Kqktk
--> ssh-ed25519 XPxfUQ jXrYF/rcG2aJ9he1dCcmkuQtQlTAZQrqQFu4AaTESG8
-i9o+h5NcB+NYgrU+Pei2xHSF2fihw75IDM/rx9ddziw
--> ssh-ed25519 SpD5mg 7u3lIXggJjgRZRXCkfgDb7+Sp+q+GtSKJH4gAycaSQs
-jEEdWSJHjXUsx8T4kmmjKUjWNwmLIwQzl9FXKbHhXM0
--> ssh-ed25519 Kk8sng VmT7aS3ggF/M21MsUMCEF6cT8C8QvIN4IQ0le2SlyWg
-G8rxkI0WaA2K3T5ETrEZJNfYpmhVESo0n3sDEs5YbVE
--> T.{#h\gw-grease \R/D bw>~X%FP
-xW/YLhgKe2qTxlZSe836hH7hDCb40FXAQJ1VPjij02iCZEBW
---- KUhBgZXJA+9QxOwdJeJj4qk/rcUmTRXS8LcyaKro4c0
-Ä䡬Vm9ëvcHÊj¹®²ä´¶*†z;±@–óƒÖÏ1õÆKZõ/TNk\nj
+-> ssh-ed25519 xoAm7w QDzXkxhczV+ZUvEHmN1Uf7xWaEDSugv2dcisOakVPEc
++k9M+R98OqsfIROOedql7ksLCtejx5uzFXigxB1Dhzs
+-> ssh-ed25519 mbw8xA ERuMyLhLVrNwmr1wS9h0ssZYayCn0Hc1dhu3zBKzDF0
+pz2rEMX3MtxtVOTuEyO5K9ZE5s0C+2JL7lNE5BdUsRo
+-> ssh-ed25519 N240Tg kHC1Wn8T3aUpWd4yK0+GJo+SDBXrVmTSrNz/Z+3kfGs
+sg6A3DgaQev5ZezJeSNAR7+G4MS1rdwHd/6u1H5+0us
+-> ssh-ed25519 2a2Yhw 64vHNVi/UCK1aCBFu+BnSyy42DHZIFeiDekfnQeDlHE
+19On29XUAiUsTmlqxrY8PQGderv7VzBO4a10jT5aZwY
+-> ssh-ed25519 dMQYog EHtR1wf5/2aWvGwkD4EBOECctp2zs2RjAUOKcncjUSI
+s7dfQHaLjO6Hor6xXpx8h5hox3OQA4mPRGt8ewr0jQM
+-> ssh-ed25519 G2eSCQ 4L9zIv4aApkZgFneUjVm2esXp4DJYVzm94LA2sS0Qkc
++iDy2G82PX6yuIyn7zITzp/jvBX2P25u26n/NuGdjVM
+-> ssh-ed25519 6AT2/g HyH+8r/SZUXilmITIsFVyr2t6rCJK9scP9TR2/rO+1M
+0Hkx2o3wlq7nj6fRSL3QNtrxKFxYlfhg7CwsyQDjIo8
+-> ssh-ed25519 yHDAQw vZlwV2QvrzG1Xu4XZt4Yi5aDQ8qmPQnadCJtHdtTSlc
+4NscOK2mu+P+vrZ8FIbIYhQ/97DPo5vgsl0jnlZM0gY
+-> ssh-ed25519 hPp1nw YWRekiOxwuK8eAGehbBfOzW7Rmw95V+A/XD4rmFxS3Y
+sd+q4ya9k/KE06GYGFV2O9P3O77aZcJl05tAvY6W1s8
+-> ssh-ed25519 CRfjsA LfIzQhaql9b4EAotyVrvKBV1AhlMVcRarA49q7+rQXc
+v4WddjXusd/m/s/T7E+wdKm9tDR3rGj6CNE3AdVrDb8
+-> ssh-ed25519 vwVIvQ 53S5tWgmlVnKIHonBAmvxbv+w0j9b65NdyWvwlvgZWg
+xa+z7MYrJHCgILtG/3Yw1OKH1/YKvuVG2jabnv3gSoA
+-> ssh-ed25519 fBrw3g GsaGAXiMo4WhEZTQPgr761gAiQHmHPSwdWF0t910+DI
+dmZGcEghoXi7giaxC/1UVJVAtyY5hcknUBxr0wQ4RBk
+-> ssh-ed25519 S5xQfg wgkQBHQi8xY4++/quS4ZJWb9PPpg6b0KZpSwypdS7HY
++1yatx5SUanPC04jJMVVILHAwdtg2r9Bd+sj9728BnY
+-> ssh-ed25519 XPxfUQ Hj2e1U4udGkp04dSdTSsaaJPIQ7gB1bwralXazBzpVM
+LPOMpbX+ndXRkQlR3GKKpwSd5zOT03j5bII8btjY52o
+-> ssh-ed25519 SpD5mg ++/8/U9XQKg6L3SHej+mvXeZYrvoWhiwmcurC3V0aTU
+qR3nTcugxtBgDhcbZpCe0/NUavbzV6tFJZKv3IopAO4
+-> ssh-ed25519 Kk8sng /bL56jng2lp0INyIDqUAX5L8mFmKxCBeHFWPUW6gE0U
+4v+jq2N6RIQAh0VRrBZkMjSQW6L+LYcAfYUBvfTM+Jw
+-> ";etw{[s-grease E;mh^R$ c8
+ossMGyq0gpvz9PjjLBWD+QHRKKhzY6/9Kj4b0M7YdP0OgMdpr5QlA7UIDhiGQQBL
+dbt0YyLxbAdhqG7S3lLeedQmvzv/oIyhmV0jsTB79W1l/27FujvPRWYf
+--- pYjss6AEPZn0PG7FmO6bGq1O+k1IFGzoxsitB4qgotY
+ÌÐçJö›Ç<10>>Z`´{ª<0C>
b%RW^óºñ–&<26>·ª’	­-4¥ðè¬ÙÚW…á