Bring back APU2 router for more experimentation

Music assistant has custom modifications they made to librespot that they haven't bothered to even try to upstream.
Thus, they require a custom librespot.  I tried and tried and tried and tried to just override the one already in nixpkgs
but I had trouble doing so despite copying the pattern already shown in nixpkgs for overriding the src of a cargo pkg
(See mopidy) but it just didn't work... Oh well. So I just patch nixpkgs instead with the new source. It works I guess.

This is about where I gave up...

```nix
nixpkgs.overlays = [
  (final: prev: {
    # Cannot use librespot upstream because music-assistant requires custom changes
    # that they never bothered to even try to uptream
    librespot = prev.librespot.overrideAttrs (oldAttrs: rec {
      src = prev.fetchFromGitHub {
        owner = "music-assistant";
        repo = "librespot";
        rev = "786cc46199e583f304a84c786acb0a9b37bc3fbd";
        sha256 = "sha256-xaOrqC8yCjF23Tz31RD3CzqZ3xxrDM6ncW1yoovEaGQ=";
      };

      cargoDeps = oldAttrs.cargoDeps.overrideAttrs (oldAttrs': {
        vendorStaging = oldAttrs'.vendorStaging.overrideAttrs {
          outputHash = "sha256-SqvJSHkyd1IicT6c4pE96dBJNNodULhpyG14HRGVWCk=";
        };
      });
    });
  })
];
```

Makefile

@@ -29,4 +29,9 @@ gc:
 # Update a flake input by name (ex: 'nixpkgs')
 .PHONY: update-input
 update-input:
-	nix flake update $(filter-out $@,$(MAKECMDGOALS))
+	nix flake update $(filter-out $@,$(MAKECMDGOALS))
+
+# Build Custom Install ISO
+.PHONY: iso
+iso:
+	nix build .#packages.x86_64-linux.iso

flake.lock

@@ -271,6 +271,18 @@
         "type": "github"
       }
     },
+    "nixpkgs-linkwarden": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-wW3F+iRM/ATWkyq8+Romal8oFmsM/p98V96d5G0tasA=",
+        "type": "file",
+        "url": "https://github.com/NixOS/nixpkgs/pull/347353.diff"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://github.com/NixOS/nixpkgs/pull/347353.diff"
+      }
+    },
     "root": {
       "inputs": {
         "agenix": "agenix",
@@ -282,6 +294,7 @@
         "nix-index-database": "nix-index-database",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
+        "nixpkgs-linkwarden": "nixpkgs-linkwarden",
         "simple-nixos-mailserver": "simple-nixos-mailserver",
         "systems": "systems"
       }

flake.nix

@@ -2,6 +2,10 @@
   inputs = {
     # nixpkgs
     nixpkgs.url = "github:NixOS/nixpkgs/release-25.05";
+    nixpkgs-linkwarden = {
+      url = "https://github.com/NixOS/nixpkgs/pull/347353.diff";
+      flake = false;
+    };
 
     # Common Utils Among flake inputs
     systems.url = "github:nix-systems/default";
@@ -120,6 +124,11 @@
                 patches = [
                   # ./patches/gamepadui.patch
                   ./patches/dont-break-nix-serve.patch
+                  # music-assistant needs a specific custom version of librespot
+                  # I tried to use an overlay but my attempts to override the rust package did not work out
+                  # despite me following guides and examples specific to rust packages.
+                  ./patches/librespot-pin.patch
+                  inputs.nixpkgs-linkwarden
                 ];
               };
               patchedNixpkgs = nixpkgs.lib.fix (self: (import "${patchedNixpkgsSrc}/flake.nix").outputs { self = nixpkgs; });

machines/ephemeral/minimal.nix

@@ -7,12 +7,20 @@
     ../../common/ssh.nix
   ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "e1000" "e1000e" "virtio_pci" "r8169" ];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "e1000"
+    "e1000e"
+    "virtio_pci"
+    "r8169"
+    "sdhci"
+    "sdhci_pci"
+    "mmc_core"
+    "mmc_block"
+  ];
   boot.kernelParams = [
-    "panic=30"
-    "boot.panic_on_fail" # reboot the machine upon fatal boot issues
     "console=ttyS0,115200" # enable serial console
-    "console=tty1"
   ];
   boot.kernel.sysctl."vm.overcommit_memory" = "1";
 

machines/howl/hardware-configuration.nix

@@ -6,7 +6,8 @@
     nixos-hardware.nixosModules.framework-13-7040-amd
   ];
 
-  boot.kernelPackages = pkgs.linuxPackages_6_14;
+  # boot.kernelPackages = pkgs.linuxPackages_6_14;
+  boot.kernelPackages = pkgs.linuxPackages_6_13;
 
   hardware.framework.amd-7040.preventWakeOnAC = true;
   services.fwupd.enable = true;

machines/router/default.nix

@@ -22,8 +22,7 @@
 
   # networking.useDHCP = lib.mkForce true;
 
-  # TODO
+  networking.usePredictableInterfaceNames = false;
-  # networking.usePredictableInterfaceNames = true;
 
   powerManagement.cpuFreqGovernor = "ondemand";
 

machines/router/hardware-configuration.nix

@@ -10,8 +10,6 @@
 
   # Enable serial output
   boot.kernelParams = [
-    "panic=30"
-    "boot.panic_on_fail" # reboot the machine upon fatal boot issues
     "console=ttyS0,115200n8" # enable serial console
   ];
   boot.loader.grub.extraConfig = "
@@ -23,6 +21,8 @@
   # firmware
   firmware.x86_64.enable = true;
   nixpkgs.config.allowUnfree = true;
+  hardware.enableRedistributableFirmware = true;
+  hardware.enableAllFirmware = true;
 
   # boot
   bios = {
@@ -31,20 +31,18 @@
   };
 
   # disks
-  remoteLuksUnlock.enable = true;
-  boot.initrd.luks.devices."enc-pv".device = "/dev/disk/by-uuid/9b090551-f78e-45ca-8570-196ed6a4af0c";
   fileSystems."/" =
     {
-      device = "/dev/disk/by-uuid/421c82b9-d67c-4811-8824-8bb57cb10fce";
+      device = "/dev/disk/by-uuid/6aa7f79e-bef8-4b0f-b22c-9d1b3e8ac94b";
-      fsType = "btrfs";
+      fsType = "ext4";
     };
   fileSystems."/boot" =
     {
-      device = "/dev/disk/by-uuid/d97f324f-3a2e-4b84-ae2a-4b3d1209c689";
+      device = "/dev/disk/by-uuid/14dfc562-0333-4ddd-b10c-4eeefe1cd05f";
       fsType = "ext3";
     };
   swapDevices =
-    [{ device = "/dev/disk/by-uuid/45bf58dd-67eb-45e4-9a98-246e23fa7abd"; }];
+    [{ device = "/dev/disk/by-uuid/adf37c64-3b54-480c-a9a7-099d61c6eac7"; }];
 
   nixpkgs.hostPlatform = "x86_64-linux";
 }

machines/router/properties.nix

@@ -0,0 +1,17 @@
+{
+  hostNames = [
+    "router"
+    "192.168.6.159"
+    "192.168.3.1"
+  ];
+
+  arch = "x86_64-linux";
+
+  systemRoles = [
+    "server"
+    "wireless"
+    "router"
+  ];
+
+  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKDCMhEvWJxFBNyvpyuljv5Uun8AdXCxBK9HvPBRe5x6";
+}

machines/router/properties.nix.disabled

@@ -1,21 +0,0 @@
-{
-  hostNames = [
-    "router"
-    "192.168.1.228"
-  ];
-
-  arch = "x86_64-linux";
-
-  systemRoles = [
-    "server"
-    "wireless"
-    "router"
-  ];
-
-  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFr2IHmWFlaLaLp5dGoSmFEYKA/eg2SwGXAogaOmLsHL";
-
-  remoteUnlock = {
-    hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJOw5dTPmtKqiPBH6VKyz5MYBubn8leAh5Eaw7s/O85c";
-    onionHost = "jxx2exuihlls2t6ncs7rvrjh2dssubjmjtclwr2ysvxtr4t7jv55xmqd.onion";
-  };
-}

machines/router/router.nix

@@ -31,8 +31,10 @@ in
     networking.bridges = {
       br0 = {
         interfaces = [
-          "enp2s0"
+          "eth2"
-          "wlp4s0"
+          # "wlp4s0"
+          # "wlan1"
+          "wlan0"
           "wlan1"
         ];
       };
@@ -64,142 +66,173 @@ in
 
     services.dnsmasq = {
       enable = true;
-      extraConfig = ''
+      settings = {
         # sensible behaviours
-        domain-needed
+        domain-needed = true;
-        bogus-priv
+        bogus-priv = true;
-        no-resolv
+        no-resolv = true;
 
         # upstream name servers
-        server=1.1.1.1
+        server = [
-        server=8.8.8.8
+          "1.1.1.1"
+          "8.8.8.8"
+        ];
 
         # local domains
-        expand-hosts
+        expand-hosts = true;
-        domain=home
+        domain = "home";
-        local=/home/
+        local = "/home/";
 
         # Interfaces to use DNS on
-        interface=br0
+        interface = "br0";
 
         # subnet IP blocks to use DHCP on
-        dhcp-range=${cfg.privateSubnet}.10,${cfg.privateSubnet}.254,24h
+        dhcp-range = "${cfg.privateSubnet}.10,${cfg.privateSubnet}.254,24h";
-      '';
+      };
     };
 
     services.hostapd = {
       enable = true;
       radios = {
-        # 2.4GHz
+        # Simple 2.4GHz AP
-        wlp4s0 = {
+        wlan0 = {
-          band = "2g";
-          noScan = true;
-          channel = 6;
           countryCode = "US";
-          wifi4 = {
+          networks.wlan0 = {
-            capabilities = [ "LDPC" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "HT40+" ];
+            ssid = "CXNK00BF9176-1";
-          };
+            authentication.saePasswords = [{ passwordFile = "/run/agenix/hostapd-pw-CXNK00BF9176"; }];
-          wifi5 = {
-            operatingChannelWidth = "20or40";
-            capabilities = [ "MAX-A-MPDU-LEN-EXP0" ];
-          };
-          wifi6 = {
-            enable = true;
-            singleUserBeamformer = true;
-            singleUserBeamformee = true;
-            multiUserBeamformer = true;
-            operatingChannelWidth = "20or40";
-          };
-          networks = {
-            wlp4s0 = {
-              ssid = "CXNK00BF9176";
-              authentication.saePasswordsFile = "/run/agenix/hostapd-pw-CXNK00BF9176";
-            };
-            # wlp4s0-1 = {
-            #   ssid = "- Experimental 5G Tower by AT&T";
-            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
-            # };
-            # wlp4s0-2 = {
-            #   ssid = "FBI Surveillance Van 2";
-            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
-            # };
-          };
-          settings = {
-            he_oper_centr_freq_seg0_idx = 8;
-            vht_oper_centr_freq_seg0_idx = 8;
           };
         };
 
-        # 5GHz
+        # WiFi 5 (5GHz) with two advertised networks
         wlan1 = {
           band = "5g";
-          noScan = true;
+          channel = 0;
-          channel = 128;
           countryCode = "US";
-          wifi4 = {
+          networks.wlan1 = {
-            capabilities = [ "LDPC" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "HT40-" ];
+            ssid = "CXNK00BF9176-1";
-          };
+            authentication.saePasswords = [{ passwordFile = "/run/agenix/hostapd-pw-CXNK00BF9176"; }];
-          wifi5 = {
-            operatingChannelWidth = "160";
-            capabilities = [ "RXLDPC" "SHORT-GI-80" "SHORT-GI-160" "TX-STBC-2BY1" "SU-BEAMFORMER" "SU-BEAMFORMEE" "MU-BEAMFORMER" "MU-BEAMFORMEE" "RX-ANTENNA-PATTERN" "TX-ANTENNA-PATTERN" "RX-STBC-1" "SOUNDING-DIMENSION-3" "BF-ANTENNA-3" "VHT160" "MAX-MPDU-11454" "MAX-A-MPDU-LEN-EXP7" ];
-          };
-          wifi6 = {
-            enable = true;
-            singleUserBeamformer = true;
-            singleUserBeamformee = true;
-            multiUserBeamformer = true;
-            operatingChannelWidth = "160";
-          };
-          networks = {
-            wlan1 = {
-              ssid = "CXNK00BF9176";
-              authentication.saePasswordsFile = "/run/agenix/hostapd-pw-CXNK00BF9176";
-            };
-            # wlan1-1 = {
-            #   ssid = "- Experimental 5G Tower by AT&T";
-            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
-            # };
-            # wlan1-2 = {
-            #   ssid = "FBI Surveillance Van 5";
-            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
-            # };
-          };
-          settings = {
-            vht_oper_centr_freq_seg0_idx = 114;
-            he_oper_centr_freq_seg0_idx = 114;
           };
         };
       };
     };
-    age.secrets.hostapd-pw-experimental-tower.file = ../../secrets/hostapd-pw-experimental-tower.age;
     age.secrets.hostapd-pw-CXNK00BF9176.file = ../../secrets/hostapd-pw-CXNK00BF9176.age;
 
-    hardware.firmware = [
+    # wlan0 5Ghz 00:0a:52:08:38:32
-      pkgs.mt7916-firmware
+    # wlp4s0 2.4Ghz 00:0a:52:08:38:33
-    ];
 
-    nixpkgs.overlays = [
+    # services.hostapd = {
-      (self: super: {
+    #   enable = true;
-        mt7916-firmware = pkgs.stdenvNoCC.mkDerivation {
+    #   radios = {
-          pname = "mt7916-firmware";
+    #     # 2.4GHz
-          version = "custom-feb-02-23";
+    #     wlp4s0 = {
-          src = ./firmware/mediatek; # from here https://github.com/openwrt/mt76/issues/720#issuecomment-1413537674
+    #       band = "2g";
-          dontBuild = true;
+    #       noScan = true;
-          installPhase = ''
+    #       channel = 6;
-            for i in \
+    #       countryCode = "US";
-              mt7916_eeprom.bin \
+    #       wifi4 = {
-              mt7916_rom_patch.bin \
+    #         capabilities = [ "LDPC" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "HT40+" ];
-              mt7916_wa.bin \
+    #       };
-              mt7916_wm.bin;
+    #       wifi5 = {
-            do
+    #         operatingChannelWidth = "20or40";
-              install -D -pm644 $i $out/lib/firmware/mediatek/$i
+    #         capabilities = [ "MAX-A-MPDU-LEN-EXP0" ];
-            done
+    #       };
-          '';
+    #       wifi6 = {
-          meta = with lib; {
+    #         enable = true;
-            license = licenses.unfreeRedistributableFirmware;
+    #         singleUserBeamformer = true;
-          };
+    #         singleUserBeamformee = true;
-        };
+    #         multiUserBeamformer = true;
-      })
+    #         operatingChannelWidth = "20or40";
-    ];
+    #       };
+    #       networks = {
+    #         wlp4s0 = {
+    #           ssid = "CXNK00BF9176";
+    #           authentication.saePasswordsFile = "/run/agenix/hostapd-pw-CXNK00BF9176";
+    #         };
+    #         # wlp4s0-1 = {
+    #         #   ssid = "- Experimental 5G Tower by AT&T";
+    #         #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
+    #         # };
+    #         # wlp4s0-2 = {
+    #         #   ssid = "FBI Surveillance Van 2";
+    #         #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
+    #         # };
+    #       };
+    #       settings = {
+    #         he_oper_centr_freq_seg0_idx = 8;
+    #         vht_oper_centr_freq_seg0_idx = 8;
+    #       };
+    #     };
+
+    #     # 5GHz
+    #     wlan1 = {
+    #       band = "5g";
+    #       noScan = true;
+    #       channel = 128;
+    #       countryCode = "US";
+    #       wifi4 = {
+    #         capabilities = [ "LDPC" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "HT40-" ];
+    #       };
+    #       wifi5 = {
+    #         operatingChannelWidth = "160";
+    #         capabilities = [ "RXLDPC" "SHORT-GI-80" "SHORT-GI-160" "TX-STBC-2BY1" "SU-BEAMFORMER" "SU-BEAMFORMEE" "MU-BEAMFORMER" "MU-BEAMFORMEE" "RX-ANTENNA-PATTERN" "TX-ANTENNA-PATTERN" "RX-STBC-1" "SOUNDING-DIMENSION-3" "BF-ANTENNA-3" "VHT160" "MAX-MPDU-11454" "MAX-A-MPDU-LEN-EXP7" ];
+    #       };
+    #       wifi6 = {
+    #         enable = true;
+    #         singleUserBeamformer = true;
+    #         singleUserBeamformee = true;
+    #         multiUserBeamformer = true;
+    #         operatingChannelWidth = "160";
+    #       };
+    #       networks = {
+    #         wlan1 = {
+    #           ssid = "CXNK00BF9176";
+    #           authentication.saePasswordsFile = "/run/agenix/hostapd-pw-CXNK00BF9176";
+    #         };
+    #         # wlan1-1 = {
+    #         #   ssid = "- Experimental 5G Tower by AT&T";
+    #         #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
+    #         # };
+    #         # wlan1-2 = {
+    #         #   ssid = "FBI Surveillance Van 5";
+    #         #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
+    #         # };
+    #       };
+    #       settings = {
+    #         vht_oper_centr_freq_seg0_idx = 114;
+    #         he_oper_centr_freq_seg0_idx = 114;
+    #       };
+    #     };
+    #   };
+    # };
+    # age.secrets.hostapd-pw-experimental-tower.file = ../../secrets/hostapd-pw-experimental-tower.age;
+    # age.secrets.hostapd-pw-CXNK00BF9176.file = ../../secrets/hostapd-pw-CXNK00BF9176.age;
+
+    # hardware.firmware = [
+    #   pkgs.mt7916-firmware
+    # ];
+
+    # nixpkgs.overlays = [
+    #   (self: super: {
+    #     mt7916-firmware = pkgs.stdenvNoCC.mkDerivation {
+    #       pname = "mt7916-firmware";
+    #       version = "custom-feb-02-23";
+    #       src = ./firmware/mediatek; # from here https://github.com/openwrt/mt76/issues/720#issuecomment-1413537674
+    #       dontBuild = true;
+    #       installPhase = ''
+    #         for i in \
+    #           mt7916_eeprom.bin \
+    #           mt7916_rom_patch.bin \
+    #           mt7916_wa.bin \
+    #           mt7916_wm.bin;
+    #         do
+    #           install -D -pm644 $i $out/lib/firmware/mediatek/$i
+    #         done
+    #       '';
+    #       meta = with lib; {
+    #         license = licenses.unfreeRedistributableFirmware;
+    #       };
+    #     };
+    #   })
+    # ];
   };
 }

machines/storage/s0/default.nix

@@ -237,7 +237,7 @@
             globalRedirect = "s0.neet.dev";
           };
         }
-        (mkVirtualHost "ha.s0.neet.dev" "http://localhost:8123") # home assistant
+        (mkVirtualHost "ha.s0.neet.dev" "http://localhost:${toString config.services.home-assistant.config.http.server_port}")
         (mkVirtualHost "esphome.s0.neet.dev" "http://localhost:6052")
         (mkVirtualHost "zigbee.s0.neet.dev" "http://localhost:55834")
         {
@@ -251,6 +251,7 @@
         (mkVirtualHost "sandman.s0.neet.dev" "http://192.168.9.14:3000") # es
         (mkVirtualHost "todo.s0.neet.dev" "http://localhost:${toString config.services.vikunja.port}")
         (mkVirtualHost "budget.s0.neet.dev" "http://localhost:${toString config.services.actual.settings.port}") # actual budget
+        (mkVirtualHost "linkwarden.s0.neet.dev" "http://localhost:${toString config.services.linkwarden.port}")
       ];
 
     tailscaleAuth = {
@@ -314,5 +315,18 @@
 
   services.actual.enable = true;
 
+  services.linkwarden = {
+    enable = true;
+    enableRegistration = true;
+    port = 41709;
+    environment.NEXTAUTH_URL = "https://linkwarden.s0.neet.dev/api/v1/auth";
+    environmentFile = "/run/agenix/linkwarden-environment";
+  };
+  age.secrets.linkwarden-environment.file = ../../../secrets/linkwarden-environment.age;
+  services.meilisearch = {
+    enable = true;
+    package = pkgs.meilisearch;
+  };
+
   boot.binfmt.emulatedSystems = [ "aarch64-linux" "armv7l-linux" ];
 }

machines/storage/s0/hardware-configuration.nix

@@ -58,25 +58,34 @@
     };
   swapDevices = [ ];
 
-  systemd.network.enable = true;
+  ### networking ###
+
+  # systemd.network.enable = true;
   networking = {
-    useNetworkd = true;
+    # useNetworkd = true;
-    dhcpcd.enable = true;
+    dhcpcd.enable = false;
+
     vlans = {
-      main = {
-        id = 1;
-        interface = "eth1";
-      };
       iot = {
         id = 2;
         interface = "eth1";
       };
     };
 
-    # Shouldn't be needed but it is. DHCP only works for a day or so while without these.
+    interfaces.eth1.ipv4.addresses = [{
-    # This ensures that each interface is configured with DHCP
+      address = "192.168.1.2";
-    interfaces."main".useDHCP = true;
+      prefixLength = 21;
-    interfaces."iot".useDHCP = true;
+    }];
+    interfaces.iot.ipv4.addresses = [{
+      address = "192.168.9.8";
+      prefixLength = 22;
+    }];
+
+    defaultGateway = {
+      interface = "eth1";
+      address = "192.168.1.1";
+    };
+    nameservers = [ "1.1.1.1" "8.8.8.8" ];
   };
 
   powerManagement.cpuFreqGovernor = "powersave";

machines/storage/s0/home-automation.nix

@@ -15,7 +15,14 @@
     ];
   };
   networking.firewall.allowedTCPPorts = [
-    1883 # mqtt
+    # mqtt
+    1883
+
+    # Must be exposed so some local devices (such as HA voice preview) can pair with home assistant
+    config.services.home-assistant.config.http.server_port
+
+    # Music assistant (must be exposed so local devices can fetch the audio stream from it)
+    8097
   ];
 
   services.zigbee2mqtt = {
@@ -75,12 +82,23 @@
       "homekit_controller"
       "zha"
       "bluetooth"
+      "whisper"
+      "piper"
+      "wyoming"
+      "tts"
+      "music_assistant"
+      "openai_conversation"
     ];
     config = {
       # Includes dependencies for a basic setup
       # https://www.home-assistant.io/integrations/default_config/
       default_config = { };
 
+      homeassistant = {
+        external_url = "https://ha.s0.neet.dev";
+        internal_url = "http://192.168.1.2:${toString config.services.home-assistant.config.http.server_port}";
+      };
+
       # Enable reverse proxy support
       http = {
         use_x_forwarded_for = true;
@@ -105,4 +123,28 @@
       };
     };
   };
+
+  services.wyoming.faster-whisper.servers."hass" = {
+    enable = true;
+    uri = "tcp://0.0.0.0:45785";
+    model = "distil-small.en";
+    language = "en";
+  };
+
+  services.wyoming.piper.servers."hass" = {
+    enable = true;
+    uri = "tcp://0.0.0.0:45786";
+    voice = "en_US-joe-medium";
+  };
+
+  services.music-assistant = {
+    enable = true;
+    providers = [
+      "hass"
+      "hass_players"
+      "jellyfin"
+      "radiobrowser"
+      "spotify"
+    ];
+  };
 }

machines/storage/s0/properties.nix

@@ -15,6 +15,7 @@
     "frigate"
     "zigbee"
     "media-server"
+    "linkwarden"
   ];
 
   hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwiXcUFtAvZCayhu4+AIcF+Ktrdgv9ee/mXSIhJbp4q";

patches/librespot-pin.patch

@@ -0,0 +1,28 @@
+diff --git a/pkgs/applications/audio/librespot/default.nix b/pkgs/applications/audio/librespot/default.nix
+index 9694c3d0cf4f..ca9502de7ee1 100644
+--- a/pkgs/applications/audio/librespot/default.nix
++++ b/pkgs/applications/audio/librespot/default.nix
+@@ -25,14 +25,19 @@ rustPlatform.buildRustPackage rec {
+   version = "0.6.0";
+ 
+   src = fetchFromGitHub {
+-    owner = "librespot-org";
++    owner = "googlebot42";
+     repo = "librespot";
+-    rev = "v${version}";
+-    sha256 = "sha256-dGQDRb7fgIkXelZKa+PdodIs9DxbgEMlVGJjK/hU3Mo=";
++    rev = "786cc46199e583f304a84c786acb0a9b37bc3fbd";
++    sha256 = "sha256-xaOrqC8yCjF23Tz31RD3CzqZ3xxrDM6ncW1yoovEaGQ=";
+   };
+ 
+   useFetchCargoVendor = true;
+-  cargoHash = "sha256-SqvJSHkyd1IicT6c4pE96dBJNNodULhpyG14HRGVWCk=";
++  cargoHash = "sha256-sUAZgOuBD9CGAy1mRqLRzVnVfxB0DqSCNAc2yzItTCA=";
++
++  cargoBuildFlags = [
++    "--features"
++    "passthrough-decoder"
++  ];
+ 
+   nativeBuildInputs = [
+     pkg-config

secrets/cris-hashed-email-pw.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 6AT2/g lQvZqYp05ofMG2kPUYVMOkJssssOmg9lLiTDxscDFHA
+-> ssh-ed25519 6AT2/g /5WB1i5RrjWIbnBErUWliedwnv8qTIsl8r8zbWNkOmA
-JWRyQo5MqQjz5b+uNLhLYgqOqWpQZdG9dU9ptfhWYaU
+wr8fN2FbNnCRUNgV3aZPQibXHy1MNjMP9SMK7urHL+o
--> ssh-ed25519 w3nu8g kqS10jUVfZqs/x3R3dm0IFGfouGUJUakLjwn0TogbgU
+-> ssh-ed25519 w3nu8g exWaIxM68nwycLphws0PRnRvvdOuT7h3xOZqndsAHxo
-RbUZQudujtzn7ci1HRchuUoXSyBb/KbKta/QvIbIeso
+EIUTjS57F5MKGt6bJjaFxHnbTFzUrpmrTVqNZoQ060Y
--> ssh-ed25519 evqvfg U29OBOuOrgX8/Uhok1AQ8p8inLf+bBWHJhvDWCHkZko
+-> ssh-ed25519 evqvfg SAQyzljqtBd65bpZo6yMsIAS1d5ymjKBoODjOQMUdTs
-oBwfJlFRQqUHYlyVRxqqdMkxKe2uTP7Z2ZCwk+Bk9yU
+/roobEvljSoREVHygqLNKTJHWG6rDdhXmlc4BM/7Em8
---- XMwxBGyVUG3OX1m8OnC1Eavnj+HCywi2VFGC6Vnp/k0
+--- Gp+OLOIN5aqR3G1fSM+Epdw4B6RTXrB99Ty/YUWI0S8
-âþd~O7—<37>rΘªVVÝʉ¹„ùnÒ4•bKd÷õïyéœp<Öþ‹,pÖ²Ë¯³Ð"æÒ0CdBMº2kœ 	ÔêñÐÏjú¬ŠØ£ÒØD~§ì%)×4û5
+ÊžÁ<EFBFBD>¶…Àoÿ;¥3ŽeºÉ<>„Ôu
âT
éÄdŸ«‡ñüÈ<²y{ Jëë¶ñg]nŸþ+QX˜Øéóå´qEÜ™çƒMþË/QàÓÔ#k­É[8(‚ß5

secrets/digitalocean-dns-credentials.age

@@ -1,14 +1,16 @@
 age-encryption.org/v1
--> ssh-ed25519 WBT1Hw +mmh+AeldhS/z282wz0d6rfklNpQLFE4M+hAL20XH3c
+-> ssh-ed25519 WBT1Hw ZMrG+yubAhxfDf/hh8gSfxZuvM5hsOBQu/V/KfdcNyk
-zyyxtRp6P6ZFdn+1NqVonEfYPtozAgDEZQWnCUbahak
+un2XWeWmt9pYLAk4n54A52T96sgvasNgD65AiYL9YO0
--> ssh-ed25519 6AT2/g TZYBBcBMnmUegRKEx4tBvbFroHV+AM+KKuE0lNOD928
+-> ssh-ed25519 6AT2/g KxgJ1UJ1amcXzpcFmFFi3C3umo70iwmL5GxDaqfk1j8
-w0d0EBpnrF9rk2SH5ROLyqqgmb2y0KD0sDiSa+gt5Vw
+VZkDd3vgf1xX9kdzrDhmv2w/Ubq6UUJyw7UAkqmWlOU
--> ssh-ed25519 hPp1nw bQSu9KjCmPIwjHrw3GXI8F807y1kCi9CvCKE/Q4+fBA
+-> ssh-ed25519 r848+g MXTm1V8lHIb4oHg0glttyooeECLn0uVrHaY5NzAE718
-BbYsl7XxNsDET3ldgQWtJCEI6euMZ/BtghEBxlOo+kg
+Qv+vEeuFz+sew5GmR17ALXKmpfByjwi2j93dMVAU5WY
--> ssh-ed25519 w3nu8g +MWibl8Un6Ga7bNAaFqZ83H4ERtBfkAeFI4q6BtpUHo
+-> ssh-ed25519 hPp1nw 7dxkddbQHdVi+7dpxBHXYi8pNgMsRjfj8KLqgJFYqQc
-mB4oxmiYNgrUBwNrG5slhQtT6yttSWiaq0M0DYGrK8A
+984ysvTIvdjJirkUIfNMEUVKkzUTCBDAOgLbKZj5AhU
--> ssh-ed25519 evqvfg gcBt9ZQ2Um08Q1b1k1UQhj0oUpLbKLuFycs4cfAe/G0
+-> ssh-ed25519 w3nu8g fC2KGM9/I2Sl0VHkYZy7YbvmF5CMWRIUahgGaGiZPVM
-YMK/4+LfAYuj6TwT+NOdLQNHfuj9rnhFaNUu+tkMX9M
++IGvvjHj14bV9PS2r0L3pFNV+eDCE63ZmNdHfCG0yCw
---- 9dISdhi6vbWXis37GEw2vb/ZaBFR3srYKlyc0N1cEP0
+-> ssh-ed25519 evqvfg fAr1POoqc5y1stRkCJfgCHSW8QXIPEiFZT0STSP931s
-¹ÙÍhž~ó 4ZK1y¨tuïád,¹Àþ<7F>zôÐ(´›W6È]ïZïö?‹S0òQ;*ôêÃvw£~ÎGPÁì
+wFWWX6tPV0mV5HC3be7a2xr4Pax35rT16S0h7eiF990
-BÚí@,‰à\1gø
.^Œ3)Z£f$xæS˜Ô&4…„ŒÆ<C592>¸¶mýEj[OK:Z<>L
+--- N5A6/IK5wKwzUT20Hxu/37ovLEkLGGj7Y30p1hu5fNM
+r&BãHA%ǺhŒRÕ²~!Ä<>{bÝ[ØU?‹k(‹µD
+öB7[öùððb/ [¿YçÚÃy[yOCjT-9:†xâ²(;ÝüœXy\
¬N‘hÄíòäLPö¼§y¿mG±—ÑÁfŽý4aT<²Š
‡çaŠè†@

secrets/frigate-credentials.age

@@ -1,10 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 hPp1nw z8hVbU48K+xyH8zxVXjy7sE35GcdSTeGIu/ywdtRBkQ
+-> ssh-ed25519 hPp1nw p8uus03Jrn9HtEelmufFx2orYkSlyAq90L7bTm3n/GQ
-ynwH7Jug9yK4iCLYIwUn5paYQISWDVYTkq+7rklAW8Y
+Ki+Pf1RG27H2wmgxXz2u7fqlU2hrxTmBZCn8RMIh8wI
--> ssh-ed25519 w3nu8g hP/IbrLUi/tvOOu5pRKWGIfbiGnQofR/s7V9kUcMUzs
+-> ssh-ed25519 w3nu8g UQQYC93hQLRIgaA5P3Upax2HzfNddWkjTkAyZF5/hFs
-kZLewvTi5JQ5enF5Bl7wiGUJ2W3THTQVXkyXhLM/Xqg
+33fVUBBaJFRhDIuZoM8Rn1fd0JwqjmyXsbu4pioxXw4
--> ssh-ed25519 evqvfg s+mq+Pr3fCKSm6dG+p7tF1piR6KZztgH/j0+0S9W7i4
+-> ssh-ed25519 evqvfg /J1fpbZORlnYADjqAcF8kV81e+mlxXC4mhMwozG7YXw
-T9KzT/+WK/XOeuWIyf2/eNQz/ytmOYzAjzzZmlY2Ppg
+KYAtHd1MyNiEKoN/RgBCOsn/uCvXIjusXPFWW4urMFY
---- A4sCAKn9DQwaSQIdyRYe9XwKvMosCLmdP7RQId7l6vA
+--- KVdBWZjlOA44GAK3GubvPaXlbg1zdpxL7+rJ4hv4Lmo
-›BQ{™Uœƒ¢þi&
º°ÞV,çÝÜ93÷¸ñl`™<Ê‹(à½îÇÆ×-«=ÇÒivÒ
+X/{×[PĽćÎ
Ĺ+ł$_Z,t\#e¶ĐĂfńř>„,0ié©Ě’;ţ°ÖVńB§QÍ8,Řëńú'JŞRו=´ŐLś–ęÉäęLłÝ@běđp?HĹM¦2—uÁňł€ŕÝp'g:ÄWŔ;YXs©ÍóN ĂO´m»y~Łň
-Ò&7»Ë#&Íÿì͇ß¿Ûee™<65>š€Kˆiç Ì×à–Â[e¶û·Þ®‹lD?¥œU-Nÿ‚pÐ,þ¤cן-
!LMÝxh™¾<E284A2>釺³

secrets/gitea-actions-runner-token.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 hPp1nw bo+iestejjHIx0accmbyOgLJPRH5xMugtfwKgax+DCU
+-> ssh-ed25519 hPp1nw 5wFHyqBRdZxUDa180U3RgrL4DWNF3BO60C1ytWdZvXM
-smaxrCeUgUu9a5mnFlDBbTbw7gNFcLi6mVb3px8gYk0
+anPvoQk7kvz/wBddKYquSZ7b6dslhIrhV8wnMpC725E
--> ssh-ed25519 w3nu8g bhpGV/Yfqfl7mrBgjCgVZEJIsRjXVOmQ2rU7dh+FQzw
+-> ssh-ed25519 w3nu8g McO3H/GkcqQavMokZhXAsRijGq0wiXzmN1GH29n12wg
-2irMVi9Vx3/PZT4fqYfcnU7q7wRCtUFOUPZ/X6fQuXw
+ooFxa+vYd49JSwdj9Knc8iDFyxX4elDb3IjOjrC5Cmo
--> ssh-ed25519 evqvfg aic8EzOuwt6ojUoHaAlhy0IWmSzuOvXjBQrK/QSS2Vs
+-> ssh-ed25519 evqvfg pW/T4WXURnk7G+HL+O3STBWkQ+5by7EgwOPTcMNakyw
-tfw0GyfsovxlMeySyQULMECEoiEjPtdkoQ4OP/t9K9s
+HByJjWNhOg7PSms4Px9NO0FnFcMj1Ig2rOXhCNQri7Y
---- uNvusvjFFt4Fza4a/hmns/tWm9LTE4fULWJ/1Gg3Izc
+--- LCgnSaNDEKv8du0OxZoLtyF4W02E/6pC/e1h0+XDDGA
-Ax­™ €¶;²þ¼[§²oÿ’®“'Lâ@«ö·^<5E>~9\jvCúUϳ$¦§hqÉ<>ú2–Ht?y\vËÈŒ<C388>ð`K!®7Yàï7Ôü

+õViÁ°“ìbð[¾í<C2BE><C3AD>%þÚ{œtäL8àP‚[¦2z{g/KG®üÈAëZýåšœÂ
ïàþ0pÃSg²…󶵿P³ÊYÊù—$•á

secrets/hashed-email-pw.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 6AT2/g kXgY0gJW/LpFYNukKCxa/Dhht4hxmoht+CIENXngW3U
+-> ssh-ed25519 6AT2/g kH4DufpuybglKzupJsGvWKfWsZ5xhRwefdPKkx/AuW4
-OFTjvs35H2HLGENEChI9fEowlvp6W7hTWFNRZ1PziW0
+QrDu/vSbgEIgYSnraG5u37RNp6Mp6ARjqzAduy9iX/Y
--> ssh-ed25519 w3nu8g jWZ0COxc+hFs7bVNTKcWa7oBmLqPmlqktpZ0gpwIUEo
+-> ssh-ed25519 w3nu8g mBt4VQNJAMwcseVhc8k/mB5XThbQT48OnstkWaGQ8zQ
-xf4aKirzqHUWppJghPwyCj6SzPntH5gxcP3ch659RIU
+6w7lMJA8giG9PVux1ncjCPrN7ER0S7uWi8UjhOOeMS8
--> ssh-ed25519 evqvfg KR2lx8vs0Eseh37tLtcfDDXE2BoyxCr91vqlnpJraA4
+-> ssh-ed25519 evqvfg uM4SAf1aMCvtRKdPn5BFr1EWlBGVgbgjp6OkuMV7GnU
-5HiO7QB7sAC0YlDgkq4gOH0Pp83et9+0UPS8+BA+juk
+Zi5X5TL7phRpwsbUVsFgS0qHvqtLdckz01qDfVypn/s
---- vt6f6yWyfunZS7pihgt97hFccp0hqlkOeLWdfsq5SAo
+--- I92hNxGkHSHR/fQhUI5UAXvzIvMd+YBih9nFP5IZW3w
-Z+äœm8¬¸vÕ[ïg_K×s™¼8·1hÙÅ1šüžü¤ã´»=@.„2À=ºÛ2?—<>µ¤8\‹›f§3oy÷ga8¾(.•²?¶8m–¹t‹ã<E280B9>,½]«ú
+áÎ_§ØN/	nÞúú®H<C2AE>ô¡ÒaŽeõâ¼ÈêÅhÊB¤ê»[Ô´ðªqÂ<71>\ý+M:F‹Üîñ‚gP¦¤¤nh’¨¼N/¸2ÞÇl8µ3q>	rHt’UJG×n

secrets/pia-login.age

@@ -1,12 +1,12 @@
 age-encryption.org/v1
--> ssh-ed25519 6AT2/g nn9O3nzI2M9+vKJ3qoKL3xs29iYp2n01xTrmtdbzs1k
+-> ssh-ed25519 6AT2/g rk3jNJlQwab++isNOPpQJZlb4rL7nIAYfoAhlvY9QTc
-atqBqI77ADuCnV04skh/2KCco5Pgwlz0vSnruiI0dzU
+J+6/MRepeixmDQzz3bRd/AMJpZls60dUBjrHh+p759Y
--> ssh-ed25519 hPp1nw tBTDeKMPoCpuoQNdnHdggQdpeYYRXhtJZqCA+o5CPkg
+-> ssh-ed25519 hPp1nw GnjIH+V6mLcXvfNhiBBwqBvY6NO8W+1sPcgvu6fS0nI
-q5BYRcZYY8oGot4F5fhx6hZfVpClvOTycQ6kMTXykqk
+qP6jDxd+0h/AZhsBs7om0BDutrPmP/1NUEuZ7LBlxmw
--> ssh-ed25519 w3nu8g C80+Mp8qRkpSfJBCH3XduSv/oT2bJ6TqVxkyh1NfRFo
+-> ssh-ed25519 w3nu8g QwztUaCCtEVeI9AbJn5dKH07Y2fal+Nn9/bsnBkTJgI
-9EEh97C2uFzP3a8DB+4YEgjqJyoa97rRT9tXEFGbMFE
+/Ce0a9bGv6RmQiK8C3wIvMCh5DM+m/EujYFsXgNjieY
--> ssh-ed25519 evqvfg qByh1A/4ylqHIuvvMqHl0lGBxwWIlwz+pGDdox6zJXE
+-> ssh-ed25519 evqvfg VLoQNzz62Q1KawvTHWeyBfCGTlGYNPQcdTaPq7cLxDo
-Ubym3YKOcekSR+O6dLD+322Kgk3152WDW+Tsu32MYY8
+eabkTR9iUPYqCj50R7rwYcrMqcs+RHWqRZai2KKzPMQ
---- 4QA63y/d1AXP95G6MHZLJlVyB8LSPVO886QcT2j2tVo
+--- fQkT/xI/iptJd/UmihEcUWx77d2wr6bOj5lecPa/P8o
-~H«;ùœe¹g<C2B9>7Á7+e|µ!ÿk0à€e•hšì?³k^m¯kDPõ}Ê\<iißv[ÆzOÚ÷sýSe¾ƒŸëTØ>Ë£¨+ŒÙ	ü®¯ÏÁáš5[Âíåä
+,V„ý²lz­ºOP¿'Ìü2ÑÃ4¦o
¸ü|ÅK‘m÷´»²FYL†Ì&ìâÓáéÊÁ>†©Ä\@emVÈnŒm½®6nôu—O@wRèãÁ‘åý^_
-Éÿ§7ˆ
+ztFŠ©~

secrets/radarr-api-key.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 hPp1nw Uhd03cBQ85Yw4FjsXkBDfrcAsTBVVOFVFrnU7sPbTXY
+-> ssh-ed25519 hPp1nw MRItBkM6GC+jht3ly0K04wCptE28UI9FmFAm2+8KHHw
-/5XIXty9cNwNPV/MXdjoOttmKMXt6PB0/7OMSl7scZ0
+Pbz+oZcWtzSz4eyWyRbi/a89Q3PripNJ+PYM/wiLKq0
--> ssh-ed25519 w3nu8g CzC59hO2YLD+Bbzvi62KXvFlyPXrx/OD8hVeQH3hfFU
+-> ssh-ed25519 w3nu8g a5G6FrbGmglm2Ba2T6NPsaVP+/4g//jh9ui/BVzR0EU
-V7OtV9QjRYNg2+kMk1K4V9RWb8AsgkQ4OlIRs7hwYyo
+f0xNuCbhC0FqqFH6CD9jPAgWmTEZqga/fRjU6VMdfSk
--> ssh-ed25519 evqvfg XTSo+9xdmL57Mkc7NNw3Xy1kJrE0Sc+81h+OEHfiCVc
+-> ssh-ed25519 evqvfg 1lhGzpY7I0fKimq6sQ/zWUHCFSEaN31rmGCckUepfHY
-PguEYlZkPMMiMaEpK+gamgl7V9/gaEUpUuV8O8tIUVs
+3OfNrzAajS6azIT90CmVnBzXLXcwMw/BRhOfbcuuz3c
---- 81iRaeiLWHHzFBoWSa6JFdp9mkKZ1TT9mdRXZaQ4N0M
+--- vagzuZWeWUcZTBISnL4vNVcpMX2CbJGHwfaAFiIZeHM
-‹»J
:“ÅŠ¶R9RrT“P	Š‡<C5A0>N™ùÊÃâi%¦ŒÛº/”L{…
½©ª‡1§^ÿÚìO©ÁÓÒW:<3A>ËÒ<C38B>Ÿo4
+en¼!<z'ß‹û,W
8†}òÙö=åà—lõÖŸ
ê^^56èiÌ”½àÜd<C39C>æß»ü<C2BB>t.yç
w>_%

secrets/robots-email-pw.age

@@ -1,11 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 6AT2/g HGqc2dbbCJNR5JR8mNfM8VRSBAWGzvBR0IdQVTM3jys
+-> ssh-ed25519 6AT2/g LnQtCha5IIh5zokvLXRVBrL/Szq4Xpl/069ErdPhz1w
-speCXu0Q79q8DXVpxYKacTh3zq0/6KXdWc1yvMJCrwA
+E2M0aK4aRgiTpqSYB3Bzpy7ZqayES5LomFDf+faxVXc
--> ssh-ed25519 w3nu8g /ArJSkSyJ0+/GGUln+PULXLu2v9IFatasIZ4d97ClnQ
+-> ssh-ed25519 w3nu8g HHwFH0wJFiDre/GNjcYQd28bfo1lZ1FIsEllnVhsL2M
-tsoXfqg2mC+3YVPHVvkrqXCN6CEpOGDBrS8vzBLkrXA
+PX1y17/8uuExa7KEQYtprfTNSDPczr/SE940xaZARB0
--> ssh-ed25519 evqvfg qJ+4dEvSS8E9tI3q0iXJAnqEZqEE6s2Hn4BAgkjWaEg
+-> ssh-ed25519 evqvfg SArOP2lww7Tlh/r4bD4mKTJcdpGyoaUn6VI3geYZvDo
-1s0rlm960TEiIefYqdqwMgff1A2WTavuq0e3GNrxFi0
+Wz9Hi8j3fMSYcM5ek3nQg9ErHHP2lMgdk5Ub3n5Aw0A
---- KbFFpe+ZN1XxXV6biHn9Vm1jw1ZaN0/wAW9/GmrQdJ8
+--- igI6cN3XWmK1V3Zy0V9wgC6vsOvBsjrKu2B4gVbEIRY
-i
+A‘š5”b<EFBFBD>yNß^1_`¦<>±ïüB©Èè]O“C<E2809C>kâlMxêºÛÖá²—7[1$‘e%d#d¨ÈÙ‹³Á°°þÍl´êŽßmª“úJ!ü9y¢¯Øý
-2w°„ÙÈx¦»$ÝÉ©;8su¢è€\G˜Ñ£¼SÑ'†.Ü*&¸ýQ^¸&$B/V¥8±
Ëï?ѨÐÖ´¼Ö 
Åx§
-;*¡)HCË

secrets/secrets.nix

@@ -38,6 +38,7 @@ with roles;
   # services
   "searx.age".publicKeys = nobody;
   "wolframalpha.age".publicKeys = dailybot;
+  "linkwarden-environment.age".publicKeys = linkwarden;
 
   # hostapd
   "hostapd-pw-experimental-tower.age".publicKeys = nobody;

secrets/smb-secrets.age

@@ -1,17 +1,17 @@
 age-encryption.org/v1
--> ssh-ed25519 N7drjg EazSO4KSpDf7Xi3pTNdhm800ZA5EIIhMbwYp+L42yD0
+-> ssh-ed25519 N7drjg lVrCcpRGeAJ+62CF+fTT+iGKmaaiBk2rmtzS3jz4ux4
-FDktPGF+bWrlPuwD8QNId3tUxt3kPO5JZ9GQ1B4vtPQ
+BbMLKa0uCoopsV0BekIcApzyJggQf4uFICuC26inA/c
--> ssh-ed25519 jQaHAA 2UJ/6JUgZBaiVVj6Y43dIvebrozJW4kuR5xfWIWSVSA
+-> ssh-ed25519 jQaHAA k7JCJlbAKDuH+bLhaoiQQssN5gfwPw9w30J3OAA4nWg
-nhZ/CMdHMIN/GjFV/WMmNvRkPYcmgtjihFtNwASS/4E
+fQ6te5iDG54mn5oXdarxMYPeze4ZWbk1yPAsLsTFby4
--> ssh-ed25519 w3nu8g fLbN1n9ncJz5xW4BnmOfOMI5tdODrZGwhOczWz81NDc
+-> ssh-ed25519 w3nu8g r3wLOavRLT++n+NaBRtcQqKXFTFhRYGl8naqUWNR0kE
-MP1Z2q1KMmvh76opIwG9ZepFiLRJBnfnGKAGSLvb38k
+pYkqQIiwzpN/XkDBrfCuFPc3yzyFjRbdCcFmRaY8iIU
--> ssh-ed25519 evqvfg ZgT1jg/k43AdfVIny9i3PxD0FRG3CWHEKJwL/r/VX28
+-> ssh-ed25519 evqvfg b+BUWYHdu1z38I0BMqpkSf5qaeaCm2C+vf9Hcqgjlg4
-Qme90RlNTtlDZcCbbxmJQ1BHphkYC1fLA7MKWTn+jEA
+PK0y5MadYrM9ANyTMdHKXRTNi5cwD8/+19mN+vaTNiM
--> ssh-ed25519 jQaHAA C5hiPm6jr4TZa+Hl+ruODqSvl9PAx7bvhAMPiNjCe00
+-> ssh-ed25519 jQaHAA 86i8je5q4vVBfdi/Ws8/n4R/Z25uLw1e6zXDza8SwiI
-2trojxFes701L8D1XvWPQBCWJB6rwgppPcGK3jDhCBY
+5yuvdl0InHxrjRyi4SJOWEo6pWZt/mX8BsaFer3NwlE
--> ssh-ed25519 w3nu8g IuWEPi/Tacoc2Oyey92eJQun4r0RGjY6GAd8oHTQ4Xk
+-> ssh-ed25519 w3nu8g N2QWi7I8V//jfK2ZGsXwBkEt2Zh7/5zpWCKUNV30bFA
-u6iVh1p2x/ACIHQO9mcVuR3Xmq2ln/F97vlYjWphvMQ
+ZmjY/lwFaVeM88FZSGwG+BYHi+32UPffZPZPbVcw+J8
--> ssh-ed25519 evqvfg q1Xp4IxCTofR+RDdi1Hoy+8NOO45u1U9/m/t6eBDUhs
+-> ssh-ed25519 evqvfg cZflDyFn9H85TnSbi2HFrdVvlT5uZ+6+l4stOaoyOxE
-WkQKg8LGQoIPuICvj7KcvgF4RMyG15txHG4uFg3v7X0
+3HpWWCbWoU1ufbi02xpXnU47Ti6YjrpMVh/mS5jgO0M
---- 4WXmmAwvor5BDjArHN3T37/zxKOO3c8jtMaxGigAcMA
+--- wF990HQn1zh8JVo2alfC/QhpFimLsLDtj26DREVYr18
-øж[îîj‹¿Ž U.wÁó@<40>ŸBHr7Seª/‰»x©í1;ÝÂSUÔ(¤8µ¥¸{Ì=µ¦N²Ý±’<C2B1>ø;_]ªÝVY2D‹¸";úµã×Câ•ùûì7‚§-.’¡üœ‚VÀr±
>*2T
+Qh
E{+帻R(+­ ÝNYIľ›Ť<ýęţ’k¦/ČÖŻ„pA<70>ݶ°Đ_ž'ËĹ
«ž‰@3ů;»°÷-0‰Çˇa€b9W5ÔĂęźbU3)ASóĹ÷Śe÷ůQ/SMJ“_šĹe<16>Ža*‡:ť<>µ

secrets/sonarr-api-key.age

@@ -1,10 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 hPp1nw F3GP7ySGf2wVUdTr1K6iChf0DczmaMnJjDWNl4sIVws
+-> ssh-ed25519 hPp1nw aoj3IvYutQWfkOYOcDu0g7/FX05Y1t5NE2dP/x50gw8
-NgfyXX4F14kyrgzuMfExb3D4pY31tzFjGkq2UmC3JMM
+KV2kpClMmBPavyyhtC2coc3Gw9/QJQwXxfM13aKRrvQ
--> ssh-ed25519 w3nu8g tnpGVKL1bYFJOhbbOa+TyEOhaXTVUk9D7HtSUWoM+WA
+-> ssh-ed25519 w3nu8g ZjQIXYV3oK5ppG9ltfojwZ0Z93wFvXdiVBnFz5ncSSQ
-cM8Jm2uKXkt31UFFdSWq3pClQhJZXUksEBMq1/xu7GE
+CI3je4tMSb9ws+IyAgBVokFdy7z23n2EwtDrvLTziM8
--> ssh-ed25519 evqvfg A3Ght96pdzoWpNpX/jmoBOz+uQUaoF3C2yw+VCOe22c
+-> ssh-ed25519 evqvfg bWwaEp5s9nvzzQXbPd3rwmy4Ei9PWZg3Gk2I1nYBcCM
-btao6WVQSwHv07hnkbpv44Pc7r3Essyoz3Spst+pDMQ
+PwLLVWVI0GY4snYRadT92NZFneuA54yzL+Ie4RWDxDk
---- J1ZZ/XeiLUpkfOl6xOckks4FxqdzPZJyglYhZf4Sa48
+--- aqM1/sssbDgs4DNsGHqiaVH1LCyhh0vtoHSD3ju67Ew
-¡°è5 ó#”I¸m\í˜Eñ"žH,s<>»{l¼'!—®¢Ë‰zú¿ƒ?ZÁ@·õ-áX´>PÁG
+&ﾈﾞ<EFBE88>ﾀﾆg~ﾊ*Y<12>訷E┴<45>ﾞoE,yｾﾜE{濁ﾁ瑩ｬ*ﾚ訶_A=ｷ6=怨M'燕ﾍｧr0<72>
-)+S½­

secrets/zigbee2mqtt.yaml.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 hPp1nw WkcqGYW9EwuqwdPa22bZ2yyxxSUlfZ1Y+NggCyFR/Qc
+-> ssh-ed25519 hPp1nw FnUaydWe7+2dVUIYrKqx2/0AzRPN3ZylczJBkTqeeXg
-Nccy64qgRnPj+6pDRPEvHCo4TRszDL5x8NUoljvAeZ0
+boSEnMZmQyre4mJBQkEPuXuRP90woU1obqMdh+uQKhM
--> ssh-ed25519 w3nu8g gr+GjbS4lanuXX6QRpzMl/3cuLInJ+djyoSnN/tH5xM
+-> ssh-ed25519 w3nu8g pIDzDUVLZuZUCn6tGKpCLVS7OmhQiMgtMvuCKfWcgiM
-md07riIXJ2eH43nL8SJFU+dThXu3kUePO/ZaV9iuS4k
+zZxCUe0LslQ0ZqHV6sSMNQ5fhyscDFxVmJk0h2voEfc
--> ssh-ed25519 evqvfg rP45WmM5H7O8dFoOQHPeVDY0JqiIDYgJsPyQjh4jC1w
+-> ssh-ed25519 evqvfg eukXn1jUoHwP/cVmYCJ1O0kYQw+Xsad1PswvbcFUMEk
-R7VH7PhaSCRW5bUAgC0Rlic6FV0IAiqKWFA8ah4/3Q0
+B0AvuWyfqK8ZFgCAW/iuXB0sKoKmB9d62ZNRTdDG43w
---- tyRX1o1ewWqSvvaHYQjzare0j6oW6VT1tdnqTN4Or34
+--- 0aziJ5/DCB9kJUqWhIggCqRnsuqu9s/g4Rt4vbwsBJk
-"T÷¶áÁÀŠ„Z»S㵈ձ7ƒÜëW—v¡¨[Êi ˜¹CÌÓÜ»Öä<@°yuƒlÊǽ’Rsò<73><C3B2>ƒ¸ä­Íí“´¬y¬`«{ò_Í
+FVÜçi`í1¥XFI–ÇI´@ŸoÞmf§Á³¤õ“ˆQ=ñè–彈臼i?²¿ƒb?Á
P6ŒA„-“°ÉY´°[Gö9<C3B6>ó î¥„½ÇÕ