diff --git a/flake.lock b/flake.lock index c45861a..2c5233e 100644 --- a/flake.lock +++ b/flake.lock @@ -1,5 +1,50 @@ { "nodes": { + "authentik-nix": { + "inputs": { + "authentik-src": "authentik-src", + "flake-compat": "flake-compat", + "flake-parts": "flake-parts", + "flake-utils": "flake-utils", + "nixpkgs": [ + "nixpkgs" + ], + "pyproject-build-systems": "pyproject-build-systems", + "pyproject-nix": "pyproject-nix", + "systems": "systems", + "uv2nix": "uv2nix" + }, + "locked": { + "lastModified": 1784669668, + "narHash": "sha256-t4TOTPaVDPmt7mSYARkhrq0OWFMqUFs4AZy/g64FAvY=", + "owner": "nix-community", + "repo": "authentik-nix", + "rev": "4e051db3737539af7d122430749fb4b1291c68cc", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "authentik-nix", + "type": "github" + } + }, + "authentik-src": { + "flake": false, + "locked": { + "lastModified": 1784135630, + "narHash": "sha256-9+43EXq4N1ecAIMyz8zGJRVkEc39LjhU11/cXAtGhN4=", + "owner": "goauthentik", + "repo": "authentik", + "rev": "8f35dc72e2b8f832dce5f385f3bf3830f7791d26", + "type": "github" + }, + "original": { + "owner": "goauthentik", + "ref": "version/2026.5.5", + "repo": "authentik", + "type": "github" + } + }, "cachyos-kernel": { "flake": false, "locked": { @@ -33,6 +78,22 @@ } }, "flake-compat": { + "flake": false, + "locked": { + "lastModified": 1767039857, + "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-compat_2": { "flake": false, "locked": { "lastModified": 1767039857, @@ -67,6 +128,24 @@ } }, "flake-parts_2": { + "inputs": { + "nixpkgs-lib": "nixpkgs-lib_2" + }, + "locked": { + "lastModified": 1782949081, + "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=", + "owner": "hercules-ci", + "repo": "flake-parts", + "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "flake-parts", + "type": "github" + } + }, + "flake-parts_3": { "inputs": { "nixpkgs-lib": [ "nixvim", @@ -90,7 +169,28 @@ }, "flake-utils": { "inputs": { - "systems": "systems" + "systems": [ + "authentik-nix", + "systems" + ] + }, + "locked": { + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "flake-utils_2": { + "inputs": { + "systems": "systems_2" }, "locked": { "lastModified": 1731533236, @@ -146,8 +246,8 @@ "inputs": { "cachyos-kernel": "cachyos-kernel", "cachyos-kernel-patches": "cachyos-kernel-patches", - "flake-compat": "flake-compat", - "flake-parts": "flake-parts", + "flake-compat": "flake-compat_2", + "flake-parts": "flake-parts_2", "nixpkgs": "nixpkgs" }, "locked": { @@ -235,6 +335,21 @@ "type": "github" } }, + "nixpkgs-lib_2": { + "locked": { + "lastModified": 1782614948, + "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=", + "owner": "nix-community", + "repo": "nixpkgs.lib", + "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "nixpkgs.lib", + "type": "github" + } + }, "nixpkgs-my-features": { "locked": { "lastModified": 1779912664, @@ -298,7 +413,7 @@ }, "nixvim": { "inputs": { - "flake-utils": "flake-utils", + "flake-utils": "flake-utils_2", "nixpkgs": "nixpkgs_3", "nixvim": "nixvim_2" }, @@ -318,9 +433,9 @@ }, "nixvim_2": { "inputs": { - "flake-parts": "flake-parts_2", + "flake-parts": "flake-parts_3", "nixpkgs": "nixpkgs_4", - "systems": "systems_2" + "systems": "systems_3" }, "locked": { "lastModified": 1783941741, @@ -356,8 +471,59 @@ "type": "github" } }, + "pyproject-build-systems": { + "inputs": { + "nixpkgs": [ + "authentik-nix", + "nixpkgs" + ], + "pyproject-nix": [ + "authentik-nix", + "pyproject-nix" + ], + "uv2nix": [ + "authentik-nix", + "uv2nix" + ] + }, + "locked": { + "lastModified": 1782093830, + "narHash": "sha256-6gmEVe69+KlRkZD4PEEV5xAlB9CB0Y9TiuEgQjDrKTQ=", + "owner": "pyproject-nix", + "repo": "build-system-pkgs", + "rev": "430680a19bc85a3bda55f12e4cc1a1aadcf2e478", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "build-system-pkgs", + "type": "github" + } + }, + "pyproject-nix": { + "inputs": { + "nixpkgs": [ + "authentik-nix", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1782905613, + "narHash": "sha256-SvXJcAemihifkTn4BGvyE5K1FJX9bl4U8DQ5pqKvD0s=", + "owner": "pyproject-nix", + "repo": "pyproject.nix", + "rev": "7af23cfe91064865ecf2e835da28b45b3c6f49fd", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "pyproject.nix", + "type": "github" + } + }, "root": { "inputs": { + "authentik-nix": "authentik-nix", "home-manager": "home-manager", "nix-cachyos-kernel": "nix-cachyos-kernel", "nixflix": "nixflix", @@ -390,6 +556,21 @@ } }, "systems": { + "locked": { + "lastModified": 1689347949, + "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=", + "owner": "nix-systems", + "repo": "default-linux", + "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default-linux", + "type": "github" + } + }, + "systems_2": { "locked": { "lastModified": 1681028828, "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", @@ -404,7 +585,7 @@ "type": "github" } }, - "systems_2": { + "systems_3": { "locked": { "lastModified": 1774449309, "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=", @@ -441,6 +622,31 @@ "type": "github" } }, + "uv2nix": { + "inputs": { + "nixpkgs": [ + "authentik-nix", + "nixpkgs" + ], + "pyproject-nix": [ + "authentik-nix", + "pyproject-nix" + ] + }, + "locked": { + "lastModified": 1783511944, + "narHash": "sha256-Z/Ss9rWw9QYcRK+Qqkmty7PB1pIik5XGbrtit+ad2qs=", + "owner": "pyproject-nix", + "repo": "uv2nix", + "rev": "83995ef5e4ece3c9c704aa645bbff439e15a0ac3", + "type": "github" + }, + "original": { + "owner": "pyproject-nix", + "repo": "uv2nix", + "type": "github" + } + }, "vpn-confinement": { "locked": { "lastModified": 1778182451, diff --git a/flake.nix b/flake.nix index 70c18d3..2b31552 100644 --- a/flake.nix +++ b/flake.nix @@ -24,6 +24,10 @@ url = "github:kiriwalawren/nixflix"; inputs.nixpkgs.follows = "nixpkgs"; }; + authentik-nix = { + url = "github:nix-community/authentik-nix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; outputs = @@ -37,6 +41,7 @@ nix-cachyos-kernel, noctalia, nixflix, + authentik-nix, ... }@inputs: let @@ -87,6 +92,7 @@ enableZram = true; additionalModules = [ nixflix.nixosModules.default + authentik-nix.nixosModules.default ]; }; nixosConfigurations."frog" = mkSystem "frog" { diff --git a/machines/bomba/secrets.nix b/machines/bomba/secrets.nix index b9a9d92..bc0297b 100644 --- a/machines/bomba/secrets.nix +++ b/machines/bomba/secrets.nix @@ -24,6 +24,9 @@ gitea_registration_token = default; navidrome_env = default; yamtrack_env = default; + authentik_env = default; + vaultwarden_env = default; + vikunja_env = default; }; }; } diff --git a/machines/bomba/services/authentik.nix b/machines/bomba/services/authentik.nix new file mode 100644 index 0000000..4119938 --- /dev/null +++ b/machines/bomba/services/authentik.nix @@ -0,0 +1,11 @@ +{ config, ... }: +{ + services.authentik = { + enable = true; + environmentFile = config.sops.secrets.authentik_env.path; + settings = { + disable_startup_analytics = true; + avatars = "initials"; + }; + }; +} diff --git a/machines/bomba/services/caddy.nix b/machines/bomba/services/caddy.nix index ec01633..fa17c54 100644 --- a/machines/bomba/services/caddy.nix +++ b/machines/bomba/services/caddy.nix @@ -1,15 +1,17 @@ { - pkgs, config, - currentSystemUser, ... }: { services.caddy = let - basicAuth = '' - basic_auth { - ${currentSystemUser} $2a$14$L6SBwu.0FhGBYwH2LWa6uOrBSeRHo8Lo95Vkle/g5uB7kZl7nmJPO + authentikAuth = '' + reverse_proxy /outpost.goauthentik.io/* http://127.0.0.1:9000 + + forward_auth http://127.0.0.1:9000 { + uri /outpost.goauthentik.io/auth/caddy + copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version + trusted_proxies private_ranges } ''; in @@ -20,21 +22,9 @@ root /var/www/patrickcanal.it/public file_server ''; - "novnc.patrickcanal.it".extraConfig = '' - handle { - ${basicAuth} - root ${pkgs.novnc}/share/webapps/novnc - file_server browse - } - - handle /websockify { - ${basicAuth} - reverse_proxy 127.0.0.1:6080 - } - ''; "vaultwarden.patrickcanal.it".extraConfig = '' encode zstd gzip - reverse_proxy :${toString config.services.vaultwarden.config.ROCKET_PORT} { + reverse_proxy :8003 { header_up X-Real-IP {remote_host} } ''; @@ -54,6 +44,7 @@ reverse_proxy :${toString config.nixflix.jellyfin.network.internalHttpPort} ''; "qbittorrent.patrickcanal.it".extraConfig = '' + ${authentikAuth} reverse_proxy :${toString config.nixflix.downloadarr.qbittorrent.port} ''; "radarr.patrickcanal.it".extraConfig = '' @@ -84,24 +75,12 @@ reverse_proxy :${toString config.services.homebox.settings.HBOX_WEB_PORT} ''; "adguard.patrickcanal.it".extraConfig = '' - ${basicAuth} + ${authentikAuth} reverse_proxy :${toString config.services.adguardhome.port} ''; + "auth.patrickcanal.it".extraConfig = '' + reverse_proxy :9000 + ''; }; }; - - systemd.services.websockify = { - description = "Websockify for noVNC"; - after = [ "network.target" ]; - wantedBy = [ "multi-user.target" ]; - serviceConfig = { - Restart = "always"; - DynamicUser = true; - ExecStart = '' - ${pkgs.python3Packages.websockify}/bin/websockify \ - --web ${pkgs.novnc}/share/webapps/novnc \ - 6080 127.0.0.1:5900 - ''; - }; - }; } diff --git a/machines/bomba/services/default.nix b/machines/bomba/services/default.nix index 6165614..a0af7ec 100644 --- a/machines/bomba/services/default.nix +++ b/machines/bomba/services/default.nix @@ -3,6 +3,7 @@ imports = [ ./actual.nix ./adguard.nix + ./authentik.nix ./caddy.nix ./fail2ban.nix ./gitea.nix diff --git a/machines/bomba/services/vaultwarden.nix b/machines/bomba/services/vaultwarden.nix index 83b52a4..eb6ca76 100644 --- a/machines/bomba/services/vaultwarden.nix +++ b/machines/bomba/services/vaultwarden.nix @@ -1,11 +1,26 @@ -{ ... }: +{ config, ... }: { services.vaultwarden = { enable = true; - config = { - DOMAIN = "https://vaultwarden.patrickcanal.it"; - ROCKET_ADDRESS = "127.0.0.1"; - ROCKET_PORT = 8003; - }; + environmentFile = config.sops.secrets.vaultwarden_env.path; + # config = { + # DOMAIN = "https://vaultwarden.patrickcanal.it"; + # ROCKET_ADDRESS = "127.0.0.1"; + # ROCKET_PORT = 8003; + # SSO_ENABLED = true; + # SSO_ONLY = false; + # SSO_AUTHORITY = "https://auth.patrickcanal.it"; + # SSO_SCOPES = [ + # "profile" + # "email" + # "offline_access" + # "vaultwarden" + # ]; + # SSO_PKCE = true; + # SSO_CLIENT_ID = "vaultwarden"; + # SSO_CLIENT_SECRET = config.sops.secrets.vaultwarden_sso_secret; + # SSO_ROLES_ENABLED = true; + # SSO_ROLES_DEFAULT_TO_USER = true; + # }; }; } diff --git a/machines/bomba/services/vikunja.nix b/machines/bomba/services/vikunja.nix index 102f4c4..85c6f15 100644 --- a/machines/bomba/services/vikunja.nix +++ b/machines/bomba/services/vikunja.nix @@ -1,9 +1,12 @@ -{ ... }: +{ config, ... }: { services.vikunja = { enable = true; port = 8011; frontendScheme = "http"; frontendHostname = "vikunja.patrickcanal.it"; + environmentFiles = [ + config.sops.secrets.vikunja_env.path + ]; }; } diff --git a/modules/nix-config/caches.nix b/modules/nix-config/caches.nix index 68f9cf0..5b0f38d 100644 --- a/modules/nix-config/caches.nix +++ b/modules/nix-config/caches.nix @@ -7,6 +7,7 @@ "https://nixvim-superredstone.cachix.org" "https://noctalia.cachix.org" "https://attic.xuyh0120.win/lantian" + "https://nix-community.cachix.org" ]; trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" @@ -14,6 +15,7 @@ "nixvim-superredstone.cachix.org-1:mEXHVxEv5dKka3FOxTMFDfdk/DJ0baydsahi+zZIcQE=" "noctalia.cachix.org-1:pCOR47nnMEo5thcxNDtzWpOxNFQsBRglJzxWPp3dkU4=" "lantian:EeAUQ+W+6r7EtwnmYjeVwx5kOGEBpjlBfPlzGlTNvHc=" + "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" ]; trusted-users = [ "root" diff --git a/secrets/bomba.sops.yaml b/secrets/bomba.sops.yaml index 2f07be7..07393c0 100644 --- a/secrets/bomba.sops.yaml +++ b/secrets/bomba.sops.yaml @@ -11,7 +11,10 @@ seerr_api_key: ENC[AES256_GCM,data:KDQxxo2W4tz9UokscAUSz7pf7wY2AfsEQpZh2aXGjsQOB indexers_ilcorsaroblu_password: ENC[AES256_GCM,data:w3CIGQqLxHEkUHvscZc=,iv:fjsB3zt4Z43MKRECjpa7+gNDzM8D+JK0sbKt2P+Hdiw=,tag:KvLawon+KfrhGmi1TWRHLw==,type:str] gitea_registration_token: ENC[AES256_GCM,data:aHoUBwPXtlme9RgGObwWt1V90JU5qeVBUtpINrb1hY6XjKi4+kLxAg==,iv:zkgDdx82Lku7/oNIoSoKUIrxvZuyPaGUI411V/rkW9c=,tag:0eBC0Kd71UwokH9scs/AKA==,type:str] navidrome_env: ENC[AES256_GCM,data:SjEg735zoiWNjp0+uYi5CyLadDd7mSXpG1LInLsaqESz0LNgMi+r46ohPjpEC3GD+WbE9D3XRwhB22oIey3K7p3GdB/bYjIR6wOa8MVjj3EDvzdBWbnhkXsGnIhLGuyZwDmMdA==,iv:gHv7lZzU09V3XVjs3nEOEm55xRwD23+sVWfgbuX18p4=,tag:8UAMIGXPGobQfBAao2nI6Q==,type:str] -yamtrack_env: ENC[AES256_GCM,data:viu/+B369Csc/nb1Psx5sIcrYw9IpUjtBPwiEAWRiBoCTlowLJ3xfRgUSx7w3/IhaCmuxEFTPBvIGCFFLgU0ZeHl5CnGe210O+uAgDpwJK+904zND3yVBPJmQ9u/ACHwqPOLON+ZFudEPtzW/5rkiQSXJdPelF28/0fkCLl1P7dVeEkwjRxPJKCt6lGv2WMlcqoHKEUCIsPWS/btRhzmLV5897AvZKTLDvrJxJi2yrPpfds=,iv:6i/1vFrwhGaq4pzCoX2og+kPRnJuqEWm9EqwOk9TSBA=,tag:122SE01quqmSjM4ttUn12w==,type:str] +yamtrack_env: ENC[AES256_GCM,data:fUaM7prLhu7aJQbWimzjPWmSD7SiCFTiXaWz4Ep34EadofCXvrBKnUa8ZDOSX9mw1PUAdqbao8l1TbA6LieV1ywW4VqC7+fUyJsfOhjRqtg+ud286UilIrMTcU/bodcKxbzxIjG9HMJ4HVs+hNnrVm4SUaloueXZm6pT0iB4Pm3ygXb/NjyBR5PdGc3MiJ0kJ4OvrLzMXYipdFTVqGvgiKazQm37ug3JFw+UjpRanYLlGT+q/aC0Km+UK41CQjvB06N8jwfd3vFWIxKHtWTfMaiJAarwSh6320lQWj5bIkbK5p4TXgqy+UgBqwEt6eWDbeZ5L46covfUi2ZUCDMBYSslFK5cYqaOvfRb0VO1nb+06djBi1WvuVR4i6PkNpyb5PGZa9f2cZB8yqXaUGNJQaut+nu7G8t8YWFlTP78fXAHOyd4kfCFot68LYJ1Vjo08v6SnUuF8JA+tmBOddBPpyO15IP5Ln7mEfinAhYRI7MACO/uOcfRX4ydcyHdELwKwM1hY69c8Ph2++1pkzJOtnSco1iJD07JreMTlOSyT7Y5Q96jR6OZdbPQ0KgoCQNjeRfoQlo2cRBwrCyvNb/Ajy2eW8JgRnY/U+SV+JkmjqrUh740sNbD0CNfFCOvvyIn9pSqQBkezfrqDKUznF6jMMATTdG75XMynbvS3RKfv/pd6ZR+m0DMFuWvvmL5cfjYsAe+M46TtfpHipCB+rxt27gn8+WN3o1cIm5OCsWK3bY51+pFFNr8P/S2kXPyRmq7B7GjLxfMBBYpERSPgzy1vTdpx+n1bREoFPll2d3KWSceVd+2izdj2S14ONPP/Ov4ImpIQQche1/Avaem6A/Go+y8Lpmnjp8/9ATwz3/b3RkbupX0bQy6y4gDg/V5bByaTpmb8Uh8,iv:rHGqUoLl6iJ1+LDHSuDFuIsl/YLlb75lUwl8gaxV79c=,tag:GVet48AfHBX5IXa/u1wXFA==,type:str] +authentik_env: ENC[AES256_GCM,data:kAva3C4pWZ4+BFhGbbq9j1rSXeldb+NAwU16aZUD7wiw8k7Sg0kVq/43rj1HtR2ZTQY6DxhPlsK5I7opVAg953GwN0kTErpuhKLRWaRGSb8rC8kkxnY=,iv:X61qSjH18KQRWNOtYq1o8IZmY6Dz4TrJzehJWxE7b2o=,tag:mifmD1C3A+XSQveLviLt2w==,type:str] +vaultwarden_env: ENC[AES256_GCM,data:vlwywspQDMrevce4dMgJTAbV4Fv9l8COK/k3ZMCZN4w0oIm4rQ3RfFzbagnG7oY9GRrqQNKM3gyRtxZ/5tPHHyiSNDDJ9lRBZ2g6w+VcVAmPyJaI736LOWZNwaYsK8yymfOWJuE8nZy5z07L/YjM+oQf0t6aqGIrHrwD4mB8GLIUhaDDNtB7xAJaDVtGCOKPseQGBwEXzs9S6hOKOUb/YeWXj290qDd9jVLSsBRZt8/ePxKMKnqSCekhrrlnGKGUitQBlHJgtUWd6wUtzR5DdTmh5Dn32JaAri51vlI+UuN6DOHxhh03rKsF5nTGXr1oclNMCrpk+uCOQZfjJ1U6jdz+vLxxuwocz3KRW2vi/v/MC2uutAu8KEskdcLBk+k6hnHse2WQ9HfePvY9hPcVMnnp1OaDLmJ3UnJsSuj+fTT/iGVyiDC+UpZ7XdF47VwohnYHbmsq30ruSxS05irhFqQ6Yla938V+l3ASSzAh7DNXmpGzYiit0evyt2wm+an29ulaU6oIaoh9etpvLK1I4WC9WjTG24Cq/4/S9d+Kzp6GaUxX7zOa9wANEAvPDHwUjreH/iIqbrIrbYBIdWLZacPWVj60JMP6ioaz8HfIsKel3q+pAfuZZbKJobSPOut/7jhz0RtLK9BN5zKv1UcAYRgcBF1Wy8d7eB5/k8IjDF6StfgJ+l5nEflrTx48ZouveMarincrj/i7PFmK2y5Ss31Xc3fvafPenxE8zT4CNaSu5RsUYQCIqAFcQfqdJSSu7S8OjQmzKGEwgFOhkG4mMqtPacvyNl2rDmgYcj8vbIkX5uC6wWejOJlqfDZwKIbnevBYaaoDLZWmzpqn47vBI4kveGLqhp2EqHH/yqAhz5Q=,iv:ziOAFuLGSngOmS9cOr8LE+Qf0Wh6CSCmWNHWFahpMUk=,tag:Ssm/6hC6A3t90502qo4zng==,type:str] +vikunja_env: ENC[AES256_GCM,data:dFh7Ev1HWL6AdjU3ZrWa7SzZicBRXdqUn53Mrguqh/EN/HrUHgk0pIa/SCM9kpt/xgEUkhDuxfMYWAXcJ8jX8yRgytN3ItF6aiivrV98lijGQR1rcAO7MR9T56Qp/FjXNEpleMJ6iv01JrpKTIFN47dC7Hal/AYrlXLqIyFG8uoje3b4xkTsNJeK+NfY4gNwddN454yNwADkJK+8QklM0Z73iGkVedPpOAi71JjsUIboJHGHUghxNIqalnTSZMs2jpI1HtPBAYdF/8WTwFGL7tAVwGUhctdQj+3LMuLBF5Z75ZDLJEbc16jf4ssfpnjAWQArb1oRsX5TCgceY7Qs5eso+hD1alWPVV0w/YygVTpWsSyBG0mN4Mm5r4mM7jW+B8y6aaQhtDb58laEZ1wDS1G+Fbnd/Y+ECJamKz8zi7xT0Qlh54hodFe4cXulOnt3/DQX8jPTttWawswBIq69k/j04T2oxpV33mR6MLrWvAU9vJKy+aYds0tbQS/j3DkeHtVo2Fsd6v5PHS/z8dP+vh1WYaFPg1NpYIQxr8ue0fB/S3Spme2EaiU9zdm6z0FYN1OJJlnQlt4YRbeUJMfCo+RoYkpR6VALtapKn40tXPiA22wCz5p3ErWblt0ZzOyWYkE3Q4d3DNhXUCbpnYw9WkS+GHYCXczfCc746+0tLpYTj3ncwtukblFjNY1glKJ7YV0v9fmDdm/zdfxrfZexTAeb8YSbKbCd5qxPyIzpwroLrwFleKmvBQ==,iv:y1XVaZV2Zt8d90CDoZXX5dAL3SBIZwTPNcopyGEr5SM=,tag:G+Yz18GWtyKRsXZsHWF5mg==,type:str] sops: age: - enc: | @@ -23,7 +26,7 @@ sops: ZQ17gIIOjhKHlGx8Lo5t/PekzFyQKCKdijS7caq74dVib1vO3tk+uQ== -----END AGE ENCRYPTED FILE----- recipient: age1ynu6zhhy84rr5xqce0flp25x5tnfgskesxfe39u7ewsk900fvagq9sq0lx - lastmodified: "2026-07-08T06:48:25Z" - mac: ENC[AES256_GCM,data:T92NqPVsMRcSrKhw87eZ182yB9tyosItanm3efW3klZqfv/L1LE9OTvwIqjhJA1EGfhgAJ1j3vW6d9WmjnMWAJ5dGwWAi9PA6NhqG5IvuOdGwF9ZRhA5Rv74MOeUyBLI9WPqP4fISupz6O5i70vfB6eD+CI+N+z+2WptebE/WDI=,iv:v24irSdN35hLDA8hBqGqQ6F75fABFHZ5ORkymkcXyis=,tag:1WrO5o4xSsEzDJcOTlpUbA==,type:str] + lastmodified: "2026-07-24T19:39:25Z" + mac: ENC[AES256_GCM,data:Gs/dqDo+NRqAb8H+L2WHuBQYisC4NEJ/zEJPSOcA8pdpdjxAbJ/Pqq/yQ4WDc/59w7pu13dddA7JmDv7sSwAmfSHVNB7JRWhfVm7YG7L5/6vSi5NG3OgJeQYcLYYJzfDK3f1FJkMe9OKV02mSZ2531AdCJmEa4URjkgXZoY8QDY=,iv:WGRxhf0A6ddi39xNlkE3yB+PybrAkZP0N1ulzA/sWvY=,tag:kW3MyTLVNaQE0M5mndurTA==,type:str] unencrypted_suffix: _unencrypted - version: 3.13.1 + version: 3.13.2