Cleanup & reformat

common/default.nix

@@ -28,7 +28,6 @@
   environment.systemPackages = with pkgs; [
     ccase
     comma
-    dogdns
     dust
     git
     headscale

common/fragments/bittorrent.nix

@@ -53,7 +53,7 @@
         ];
       };
       "qui" = {
-        image = "ghcr.io/autobrr/qui:v1.15.0@sha256:da33f8c850f7d6f1bfaee26b9553b21411e872639d54193906fa2cec51af1d0f ";
+        image = "ghcr.io/autobrr/qui:v1.19.0@sha256:baa07db5326f75f8c2246703603cbe2132476c8ad0ab31c976a960cb4c4731f5";
         autoStart = true;
         dependsOn = [ "qbittorrent" ];
         volumes = [

common/fragments/fail2ban.nix

@@ -1,8 +1,13 @@
-{ config, pkgs, ... }: {
+{
   services.fail2ban = {
     enable = true;
     maxretry = 10;
-    ignoreIP = [ "127.0.0.0/8" "10.0.0.0/8" "192.168.0.0/16" "78.94.116.222" ];
+    ignoreIP = [
+      "127.0.0.0/8"
+      "10.0.0.0/8"
+      "192.168.0.0/16"
+      "78.94.116.222"
+    ];
     bantime-increment.enable = true;
     banaction-allports = "iptables";
 
@@ -27,4 +32,3 @@
     ignoreregex =
   '';
 }
-

common/fragments/grafana.nix

@@ -21,7 +21,7 @@
       };
       "auth.generic_oauth" =
         let
-          authServerUrl = config.services.kanidm.serverSettings.origin;
+          authServerUrl = config.services.kanidm.server.settings.origin;
         in
         {
           enabled = true;

common/fragments/headscale.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, ... }:
 {
   services.headscale = {
     enable = true;
@@ -25,64 +25,4 @@
       proxyWebsockets = true;
     };
   };
-
-  sops.secrets."headplane/cookie-secret" = {
-    owner = config.services.headscale.user;
-  };
-  sops.secrets."headplane/integration-agent-authkey" = {
-    owner = config.services.headscale.user;
-  };
-  sops.secrets."headplane/oidc/client-secret" = {
-    owner = config.services.headscale.user;
-  };
-  sops.secrets."headplane/oidc/headscale-api-key" = {
-    owner = config.services.headscale.user;
-  };
-  services.headplane =
-    let
-      settings = pkgs.lib.recursiveUpdate config.services.headscale.settings {
-        tls_cert_path = "/dev/null";
-        tls_key_path = "/dev/null";
-        policy.path = "/dev/null";
-        oidc.client_secret_path = "/dev/null";
-      };
-      hs_config = (pkgs.formats.yaml { }).generate "headscale.yml" settings;
-    in
-    {
-      enable = true;
-      settings = {
-        server = {
-          port = 4000;
-          base_url = "https://mgmt.hs.technogothic.net";
-          cookie_secret_path = config.sops.secrets."headplane/cookie-secret".path;
-        };
-        headscale = {
-          url = "https://hs.technogothic.net";
-          config_path = hs_config;
-        };
-        integration.agent = {
-          enabled = true;
-          pre_authkey_path = config.sops.secrets."headplane/integration-agent-authkey".path;
-        };
-        oidc = {
-          issuer = "https://aphex.technogothic.net/oauth2/openid/headplane";
-          client_id = "headplane";
-          client_secret_path = config.sops.secrets."headplane/oidc/client-secret".path;
-          disable_api_key_login = true;
-          use_pkce = true;
-          headscale_api_key_path = config.sops.secrets."headplane/oidc/headscale-api-key".path;
-        };
-      };
-    };
-
-  security.acme.certs."technogothic.net".extraDomainNames = [ "*.hs.technogothic.net" ];
-  services.nginx.virtualHosts."mgmt.hs.technogothic.net" = {
-    useACMEHost = "technogothic.net";
-    forceSSL = true;
-
-    locations."/" = {
-      proxyPass = "http://localhost:4000";
-      proxyWebsockets = true;
-    };
-  };
 }

common/fragments/hedgedoc.nix

@@ -18,7 +18,7 @@
       email = false;
       oauth2 =
         let
-          authServerUrl = config.services.kanidm.serverSettings.origin;
+          authServerUrl = config.services.kanidm.server.settings.origin;
         in
         {
           baseURL = "${authServerUrl}/oauth2";

common/fragments/home-assistant.nix

@@ -19,7 +19,7 @@
 
   virtualisation.oci-containers.containers = {
     "home-assistant" = {
-      image = "ghcr.io/home-assistant/home-assistant:stable@sha256:916682086154a7390114a9788782b8efb199852d4f7d47066722c2bc5d1829e6";
+      image = "ghcr.io/home-assistant/home-assistant:stable@sha256:f0baa7922ecec7790c40c41baf08ab218b6ab8db5f96dc03b03a0ae33d987c3d";
       autoStart = true;
       volumes = [
         "/var/lib/hass:/config"
@@ -29,6 +29,8 @@
       extraOptions = [
         "--network=host"
         "--device=/dev/serial/by-id/usb-Silicon_Labs_CP2102_USB_to_UART_Bridge_Controller_0001-if00-port0:/dev/ttyUSB0"
+        "--cap-add=NET_ADMIN"
+        "--cap-add=NET_RAW"
       ];
     };
   };
@@ -66,4 +68,7 @@
     pkgs.lib.mkForce "${pkgs.linux-wifi-hotspot}/bin/create_ap --config ${
       config.sops.templates."create-ap.conf".path
     }";
+
+  hardware.bluetooth.enable = true;
+  services.matter-server.enable = true;
 }

common/fragments/kanidm.nix

@@ -4,10 +4,11 @@ let
 in
 {
   services.kanidm = {
-    package = pkgs.kanidm_1_8;
+    package = pkgs.kanidm_1_10;
-    enableServer = true;
+    server = {
-    serverSettings = {
+      enable = true;
-      origin = "https://${cfg.serverSettings.domain}";
+      settings = {
+        origin = "https://${cfg.server.settings.domain}";
         domain = "aphex.technogothic.net";
 
         # otel_grpc_url = "http://localhost:9008";
@@ -15,10 +16,13 @@ in
         tls_chain = "${config.security.acme.certs."technogothic.net".directory}/fullchain.pem";
         tls_key = "${config.security.acme.certs."technogothic.net".directory}/key.pem";
       };
+    };
 
-    enableClient = true;
+    client = {
-    clientSettings = {
+      enable = true;
-      uri = cfg.serverSettings.origin;
+      settings = {
+        uri = cfg.server.settings.origin;
+      };
     };
   };
 
@@ -27,12 +31,12 @@ in
     "nginx"
   ];
 
-  services.nginx.virtualHosts."${cfg.serverSettings.domain}" = {
+  services.nginx.virtualHosts."${cfg.server.settings.domain}" = {
     useACMEHost = "technogothic.net";
     forceSSL = true;
 
     locations."/" = {
-      proxyPass = "https://${config.services.kanidm.serverSettings.bindaddress}";
+      proxyPass = "https://${config.services.kanidm.server.settings.bindaddress}";
       extraConfig = ''
         proxy_ssl_verify off;
       '';

common/fragments/media.nix

@@ -20,7 +20,7 @@
     ];
     environmentFiles = [ config.sops.secrets.jellyfin-token.path ];
     cmd = [
-      "--jellyfin.address=http://127.0.0.1:8096"
+      "--jellyfin.address=https://jellyfin.technogothic.net"
       "--collector.activity"
     ];
   };

common/fragments/vsftpd.nix

@@ -46,4 +46,13 @@
       extraConfig = "autoindex on;";
     };
   };
+
+  services.nginx.virtualHosts."carvideo.technogothic.net" = {
+    useACMEHost = "technogothic.net";
+    forceSSL = true;
+
+    locations."/" = {
+      return = "301 https://ftp.technogothic.net/car_video.mp4";
+    };
+  };
 }

common/fragments/yubikey.nix

@@ -1,8 +0,0 @@
-{ pkgs, ... }:
-{
-  services.udev.packages = with pkgs; [
-    libu2f-host
-    yubikey-personalization
-  ];
-  services.pcscd.enable = true;
-}

common/home_manager/common.nix

@@ -44,7 +44,7 @@ in
             "$directory"
           ];
           right_format = lib.concatStrings [
-            "$\{custom.jj}"
+            "\${custom.jj}"
             "$status"
             "$cmd_duration"
           ];

common/home_manager/helix.nix

@@ -5,7 +5,7 @@
 
   home-manager.users.agatha = {
     # Formatters/Language Servers that Helix uses
-    home.packages = with pkgs; [ nixfmt-rfc-style ];
+    home.packages = with pkgs; [ nixfmt ];
 
     programs = {
       helix = {

common/linux-specific.nix

@@ -25,30 +25,9 @@
   time.timeZone = "Europe/Berlin";
   i18n.defaultLocale = "en_US.UTF-8";
 
-  i18n.extraLocaleSettings = {
-    LC_ADDRESS = "de_DE.UTF-8";
-    LC_IDENTIFICATION = "de_DE.UTF-8";
-    LC_MEASUREMENT = "de_DE.UTF-8";
-    LC_MONETARY = "de_DE.UTF-8";
-    LC_NAME = "de_DE.UTF-8";
-    LC_NUMERIC = "de_DE.UTF-8";
-    LC_PAPER = "de_DE.UTF-8";
-    LC_TELEPHONE = "de_DE.UTF-8";
-    LC_TIME = "de_DE.UTF-8";
-  };
-
-  # Configure keymap in X11
-  services.xserver.xkb = {
-    layout = "us";
-    variant = "";
-  };
-
   # Enable the OpenSSH daemon.
   services.openssh = {
     enable = true;
-    banner = ''
-      Hello mistress ^,,^
-    '';
     settings.PasswordAuthentication = false;
   };
 

common/pkgs/bin.nix

@@ -13,9 +13,7 @@ pkgs.rustPlatform.buildRustPackage rec {
 
   # Use custom syntax highlighting theme
   preBuild = ''
-    cp ${
+    cp ${../../external/paramount-dark.tmTheme} resources/themes/paramount-dark.tmTheme
-      ../../external/paramount-dark.tmTheme
-    } resources/themes/paramount-dark.tmTheme
 
     substituteInPlace src/models/pretty.rs \
       --replace "ayu_dark.tmTheme" "paramount-dark.tmTheme" \
@@ -27,9 +25,20 @@ pkgs.rustPlatform.buildRustPackage rec {
       --replace "#be7611" "#8673aa"
   '';
 
-  cargoLock = { lockFile = "${src}/Cargo.lock"; };
+  cargoLock = {
+    lockFile = "${src}/Cargo.lock";
+  };
 
-  nativeBuildInputs = [ pkgs.git ];
+  nativeBuildInputs = with pkgs; [
+    git
+    pkg-config
+  ];
+
+  buildInputs = with pkgs; [
+    oniguruma
+  ];
+
+  env.RUSTONIG_SYSTEM_LIBONIG = true;
 
   meta = {
     description = "highly opinionated, minimal pastebin";

flake.lock

@@ -21,27 +21,6 @@
         "type": "github"
       }
     },
-    "devshell": {
-      "inputs": {
-        "nixpkgs": [
-          "headplane",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1768818222,
-        "narHash": "sha256-460jc0+CZfyaO8+w8JNtlClB2n4ui1RbHfPTLkpwhU8=",
-        "owner": "numtide",
-        "repo": "devshell",
-        "rev": "255a2b1725a20d060f566e4755dbf571bbbb5f76",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "devshell",
-        "type": "github"
-      }
-    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -59,24 +38,6 @@
       }
     },
     "flake-utils": {
-      "inputs": {
-        "systems": "systems_2"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
       "locked": {
         "lastModified": 1667395993,
         "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
@@ -91,28 +52,6 @@
         "type": "github"
       }
     },
-    "headplane": {
-      "inputs": {
-        "devshell": "devshell",
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1777212944,
-        "narHash": "sha256-JjsM46y8NnXhS8zWYrUwZWv7wjxVB0q8gPEZT6m/2IE=",
-        "owner": "tale",
-        "repo": "headplane",
-        "rev": "4cf4e5c0404dada204a0b924dd6841b4c93c8d9e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tale",
-        "repo": "headplane",
-        "type": "github"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -120,16 +59,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1775425411,
+        "lastModified": 1780361225,
-        "narHash": "sha256-KY6HsebJHEe5nHOWP7ur09mb0drGxYSzE3rQxy62rJo=",
+        "narHash": "sha256-wnV9ttf4fPWNonBIQmvlrSlNpQYgx5HgWWd007mwIFA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0d02ec1d0a05f88ef9e74b516842900c41f0f2fe",
+        "rev": "e28654b71096e08c019d4861ca26acb646f583d8",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-25.11",
+        "ref": "release-26.05",
         "repo": "home-manager",
         "type": "github"
       }
@@ -175,7 +114,7 @@
     "mms": {
       "inputs": {
         "flake-compat": "flake-compat",
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils",
         "nix": "nix",
         "nixpkgs": [
           "nixpkgs"
@@ -263,16 +202,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1772129556,
+        "lastModified": 1779036909,
-        "narHash": "sha256-Utk0zd8STPsUJPyjabhzPc5BpPodLTXrwkpXBHYnpeg=",
+        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "ebec37af18215214173c98cf6356d0aca24a2585",
+        "rev": "56c666e108467d87d13508936aade6d567f2a501",
         "type": "github"
       },
       "original": {
         "owner": "LnL7",
-        "ref": "nix-darwin-25.11",
+        "ref": "nix-darwin-26.05",
         "repo": "nix-darwin",
         "type": "github"
       }
@@ -293,16 +232,16 @@
     },
     "nixpkgs-darwin": {
       "locked": {
-        "lastModified": 1777014176,
+        "lastModified": 1780383649,
-        "narHash": "sha256-OzisFv/K6SRIKNOUsR+9Xij/HnS+UqXWhrheEHPJJ3E=",
+        "narHash": "sha256-FS3od1iIyWYz68tqZGGc92Po7Ji+G2NEm6+a4s4RI0w=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3f05c8657c7016fb8cfec9ca06dac066cdeddb91",
+        "rev": "595ee2b1a31a50efcb8db3824999abb98ec1d0c9",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixpkgs-25.11-darwin",
+        "ref": "nixpkgs-26.05-darwin",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -325,11 +264,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1776949667,
+        "lastModified": 1780336545,
-        "narHash": "sha256-GMSVw35Q+294GlrTUKlx087E31z7KurReQ1YHSKp5iw=",
+        "narHash": "sha256-vhVhuXzFrIOfcssC/9hDHx7MHzDKjF3keHuREOQqQiQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "01fbdeef22b76df85ea168fbfe1bfd9e63681b30",
+        "rev": "4df1b885d76a54e1aa1a318f8d16fd6005b6401f",
         "type": "github"
       },
       "original": {
@@ -357,16 +296,16 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1776734388,
+        "lastModified": 1780203844,
-        "narHash": "sha256-vl3dkhlE5gzsItuHoEMVe+DlonsK+0836LIRDnm6MXQ=",
+        "narHash": "sha256-K5sT4jTpGs15ADhviMKNBH38REpPf5Q6mM1+N6cArVE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "10e7ad5bbcb421fe07e3a4ad53a634b0cd57ffac",
+        "rev": "b51242d7d43689db2f3be91bd05d5b24fbb469c4",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.11",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -390,7 +329,6 @@
     "root": {
       "inputs": {
         "ccase": "ccase",
-        "headplane": "headplane",
         "home-manager": "home-manager",
         "matrix-ril100": "matrix-ril100",
         "mms": "mms",
@@ -410,11 +348,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776771786,
+        "lastModified": 1777944972,
-        "narHash": "sha256-DRFGPfFV6hbrfO9a1PH1FkCi7qR5FgjSqsQGGvk1rdI=",
+        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "bef289e2248991f7afeb95965c82fbcd8ff72598",
+        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
         "type": "github"
       },
       "original": {
@@ -483,21 +421,6 @@
         "type": "github"
       }
     },
-    "systems_5": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "url-eater": {
       "inputs": {
         "naersk": "naersk_2",
@@ -540,7 +463,7 @@
     },
     "utils_2": {
       "inputs": {
-        "systems": "systems_3"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1687709756,
@@ -558,7 +481,7 @@
     },
     "utils_3": {
       "inputs": {
-        "systems": "systems_4"
+        "systems": "systems_3"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -576,7 +499,7 @@
     },
     "utils_4": {
       "inputs": {
-        "systems": "systems_5"
+        "systems": "systems_4"
       },
       "locked": {
         "lastModified": 1681202837,

flake.nix

@@ -1,18 +1,18 @@
 {
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
-    nixpkgs-darwin.url = "github:NixOS/nixpkgs/nixpkgs-25.11-darwin";
+    nixpkgs-darwin.url = "github:NixOS/nixpkgs/nixpkgs-26.05-darwin";
 
     vampysite.url = "git+https://git.lain.faith/sorceress/vampysite";
 
     home-manager = {
-      url = "github:nix-community/home-manager/release-25.11";
+      url = "github:nix-community/home-manager/release-26.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
     nix-darwin = {
-      url = "github:LnL7/nix-darwin/nix-darwin-25.11";
+      url = "github:LnL7/nix-darwin/nix-darwin-26.05";
       inputs.nixpkgs.follows = "nixpkgs-darwin";
     };
 
@@ -40,11 +40,6 @@
       url = "github:rutrum/ccase";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
-
-    headplane = {
-      url = "github:tale/headplane";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
   };
   outputs =
     {
@@ -58,7 +53,6 @@
       matrix-ril100,
       vampysite,
       ccase,
-      headplane,
       ...
     }:
     let
@@ -141,8 +135,6 @@
           ./hosts/synchronicity/configuration.nix
           (import "${home-manager}/nixos")
           sops-nix.nixosModules.sops
-          headplane.nixosModules.headplane
-          { nixpkgs.overlays = [ headplane.overlays.default ]; }
         ];
       };
       nixosConfigurations."watchtower" = nixpkgs.lib.nixosSystem {

hosts/bloodletting/configuration.nix

@@ -200,27 +200,6 @@
 
       extraConfig = "client_max_body_size 64M;";
     };
-
-    virtualHosts."jellyfin.technogothic.net" = {
-      useACMEHost = "technogothic.net";
-      forceSSL = true;
-
-      locations."/" = {
-        proxyPass = "http://watchtower.thorns.home.arpa:8096";
-        proxyWebsockets = true;
-      };
-    };
-
-    virtualHosts."carvideo.technogothic.net" = {
-      useACMEHost = "technogothic.net";
-      forceSSL = true;
-
-      serverAliases = [ "agatha.technogothic.net" ];
-
-      locations."/" = {
-        return = "301 https://ftp.technogothic.net/car_video.mp4";
-      };
-    };
   };
 
   # This value determines the NixOS release from which the default

hosts/synchronicity/hardware-configuration.nix

@@ -21,5 +21,4 @@
     device = "/dev/sda1";
     fsType = "ext4";
   };
-
 }

hosts/synchronicity/networking.nix

@@ -6,7 +6,10 @@
     nameservers = [
       "8.8.8.8"
     ];
-    defaultGateway = "172.31.1.1";
+    defaultGateway = {
+      address = "172.31.1.1";
+      interface = "eth0";
+    };
     defaultGateway6 = {
       address = "fe80::1";
       interface = "eth0";

secrets/secrets.yaml

@@ -4,16 +4,9 @@ create-ap-pass: ENC[AES256_GCM,data:iIq0ZUCWKYKZWNmvTjon0D8HkzxL9iqX5rJj6VBkkwI=
 qbittorrent-pass: ENC[AES256_GCM,data:J5m9y2pX5oI6ziIkhlMXXgszDum+rfQFfAQoImawW48=,iv:FqOYreDUX0CATPugra/dTlx2yMS4UMN0o8NesueRu3k=,tag:neKoHJhwdUdl/2mJKWkslg==,type:str]
 grafana-key: ENC[AES256_GCM,data:m/MJnidxdqnGk2GO6JXQ9Gw36a5gIWkVumggOx6NjZE=,iv:aCArsPNlDsp1b0+CAYRqAHV5n69wwUccSgvTXpKhEwQ=,tag:10rM/WytKNS3HqHMht4sMw==,type:str]
 grafana-oauth: ENC[AES256_GCM,data:en+OyzGDfNKYisyQxvlIRVrCXPNgyOgCIngtoEsJNTnO9RHqW4ny+rfKhZz0IZfl,iv:tI1q9UYI8ddi4KkSi/NiNJ50Eo21yi+vSHs9KZUsm58=,tag:SeGw6fJVshVAvuMfYcnDqg==,type:str]
-headplane:
-    cookie-secret: ENC[AES256_GCM,data:OS6Igw2D8o4KzHQDh6boGUAf4CA4/nrNnEMQfBoSpe4=,iv:AjV1bPUAUMX+Q97WNzlYo7pRxaj1gl/QsNBe7+1ld7k=,tag:dWV39QAqxnNpvUT0DsiBqA==,type:str]
-    integration-agent-authkey: ENC[AES256_GCM,data:AbjZ9xG+SQPjYtzCs8o8s/gMY9zRv02xupBpBn0Qn+GZKgCyxWw5nPEX+4ait68x,iv:1dgTUX1d6lkiJFnXPCGprlbrLycdqsDWa1LsZ8EDSaA=,tag:xqVjEqaoXnCDYCitRPDfjQ==,type:str]
-    oidc:
-        client-secret: ENC[AES256_GCM,data:F8LZWEqlG1NlfMKpQ4322wnD50xadolJN4Mp125hU0tqeiWAGwH+/utYKjx4EOhc,iv:8pTaDCZj4CAg+6BS9UUeZ8a3H6a5qXwsgU017XIhfTI=,tag:U8u4W+4dt1BeeFeAYhIvaw==,type:str]
-        headscale-api-key: ENC[AES256_GCM,data:J3aAOWuUfW8xRen5lUIuY5HedwnfDE7/7qaMFBOHDNS7E3m2s1KpzA==,iv:PbLFTibw4eFcuqCDFnRwN4EwvXk5ZglDycIdpR+4nuk=,tag:IJujjTsjL/ynCCYOXF1dBQ==,type:str]
 sops:
     age:
-        - recipient: age1se1q089cm462yku3md4xyk9lc4ck2x429awx9gh75lg6tpcaeyumcpnud7nht9
+        - enc: |
-          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IFdhNW5ydyBBcnY1MnB3
             VzY2KzkxcE5OT2FMMTM5TTgzeERTS2U2VTJqZE8vYTNiQnJKTApvN2o1Uk9VRHQy
@@ -22,8 +15,8 @@ sops:
             YsmVYHxxL573oJD06MvSFpT26dNEUaqWblUP1NnI26Qa2b/K6n8eWR6ADqW0nPIl
             7uI=
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1kjnrt7vnwhqzryxrgakd7tdga9sxvjrlgtj0j8xz0sah798atvxquvpqla
+          recipient: age1se1q089cm462yku3md4xyk9lc4ck2x429awx9gh75lg6tpcaeyumcpnud7nht9
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJYVNuZzJmYWVNTlhveE5l
             U3VuUnRVd0NYMEkvTG1QR0pTREZHT21lSGprClBQaUhMSWJpakwyWVprcXZsSGU1
@@ -31,8 +24,8 @@ sops:
             c2RGbkpCa3g3N2Jock5vellXZEpldXcKowC4myqPJsS2dweypyWvol6o3WsAW9qD
             6NfVtXdj52+Whr+/tHUJ1J2mkKZonSCfbpmKh/JYOINln6xgnDtbIw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1nhs7nhvkqhw8qgdyxwmgts044ce3t7jsgesea5l5mfz4ex6jsgyq76cfsy
+          recipient: age1kjnrt7vnwhqzryxrgakd7tdga9sxvjrlgtj0j8xz0sah798atvxquvpqla
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoRjAybHJDMEQ3TXpkSnlC
             NkhlTVRFdzJxaHdDeWNCOHpZUWtXMy80cFdNCjZDRC9OR0xnOS91QjdYMXFuRE10
@@ -40,7 +33,8 @@ sops:
             RGtjY1V6U2tla3ZaS09haXYrYUNrVDgK0e3UVPshSTB7kwYzm4uVUDif2PwiIGg4
             Qb4P3L13Lg6tT0a1SBEs2gedbNVcWyA0YgGTWouWvZIhBmSCOvHYVQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-18T11:02:40Z"
+          recipient: age1nhs7nhvkqhw8qgdyxwmgts044ce3t7jsgesea5l5mfz4ex6jsgyq76cfsy
-    mac: ENC[AES256_GCM,data:+6kk7iEZrNwPvcSag/z5W86wSrVm0qzwVKM/l9FDWtcfinFITIioecgPP+UdJxD6DhDwGOem9NWIcMUNVC1vhAyChM6xNr9oXm1sRxkpR+LZe1hiUnj6mXiZf7kcpz9FgY+nigTtME8GQiePBwPfctkpYEAv4P6RgGYFFTTpGpE=,iv:6AuBekjDO0ibNLODN9tDxB8DqP+I0l/jmbCQO9n8g3Y=,tag:4yI58P3EjJlOapKsBDsC0A==,type:str]
+    lastmodified: "2026-06-06T12:06:32Z"
+    mac: ENC[AES256_GCM,data:eFrplBoAgcpHwbPuxMBnes8+8+B7V4btfdDhurnp9SInF41J+snK0RgSAXepdHirgu8IrraEG/RYQ8sCCMKSnQBCFxdV7+HaVhqv2Qv+6KrVbb3Ha/CaqYEnEhVlY/QECEjTs7tpnvsoWo4uS1Gl32nuEwHLPMCLE66jgvQgk2M=,iv:AuuFfAiYjVmhQ15lY9rbuATnl2TRA6V/SeFS47cU87w=,tag:eHOpLwS2yM0vjDkFgkvm2A==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.13.1