chore: update flake.lock

Replace container-flake (feat/o4dev branch) dependency with
oparic-flakes (main) + direct o4dev service inputs. Container
is now built via mkOparicContainer with local config and secrets.

.sops.yaml

@@ -1,11 +1,23 @@
 keys:
-  - &primary age1nlta6ek2fsre42g38ytwg3fxtra4h444psd7g986md0gzmvv6d5qqlwwjy
+  - &user age1nlta6ek2fsre42g38ytwg3fxtra4h444psd7g986md0gzmvv6d5qqlwwjy
+  - &oparic-local-dev age1mgxmpfpy6qg374kyq66cc5yw68qfw0mlk89rcdy3lkzw9q93jvwqg73395
+  - &o4dev age1e80f6ea37ha7udmcctaggak9l44khtcn6e966fhcldrzjjxwzals65yasf
+# 按 GPT 的说法, 要想不踩坑, 就绝对不要用宽泛的匹配规则
 creation_rules:
-  - path_regex: secrets/ssh-config.yaml$
+  - path_regex: ^secrets/ssh-config\.yaml$
     key_groups:
       - age:
-          - *primary
-  - path_regex: secrets/ssh-private.yaml$
+          - *user
+  - path_regex: ^secrets/ssh-private\.yaml$
     key_groups:
       - age:
-          - *primary
+          - *user
+  - path_regex: ^secrets/hosts/oparic-local-dev\.yaml$
+    key_groups:
+      - age:
+          - *user
+          - *oparic-local-dev
+  - path_regex: ^hosts/oparic-local-dev/containers/o4dev/secrets\.yaml$
+    key_groups:
+      - age:
+          - *o4dev

docs/multi-secrets.md

@@ -0,0 +1,538 @@
+# 多机器秘密管理
+
+> ChatGPT 回答摘录
+
+> 用 sops, 给我一个适合于个人 homelab 的方案. 有一把用户级的密钥, 可以解密和加密任意秘密. 然后每个机器都有一个自己的密钥可以加密解密我在配置文件里想要它们加解密的内容. 我要知道如何为新机器生成密钥, 如何删除机器的密钥, 如何轮转特定机器的密钥, 如何为特定机器生成秘密. 我希望不同机器的秘密是分开多个 yaml 的.
+
+## 推荐模型
+
+使用：
+
+```text
+SOPS + age + sops-nix
+```
+
+权限模型：
+
+```text
+你的用户 age key
+  ├─ 能解密 / 编辑所有 secret
+  └─ 只放在你的管理机 / 笔记本上
+
+每台机器自己的 age key
+  ├─ 只放在该机器上
+  ├─ 只被加入该机器对应的 YAML
+  └─ 只能解密自己的 host secrets
+```
+
+SOPS 支持 YAML/JSON/ENV/INI/BINARY，并且支持 `age`；`age` recipient 可以写进 `.sops.yaml` 的 `creation_rules`。SOPS 官方文档也明确说明，`creation_rules` 中的 `age` 字段是 age public key 列表。([SOPS: Secrets OPerationS][1])
+
+---
+
+## 目录结构
+
+建议这样放：
+
+```text
+infra/
+  .sops.yaml
+
+  secrets/
+    hosts/
+      nas.yaml
+      pve.yaml
+      nuc.yaml
+
+    shared/
+      wireguard.yaml
+      tailscale.yaml
+
+  nixos/
+    hosts/
+      nas/
+        configuration.nix
+        secrets.nix
+      pve/
+        configuration.nix
+        secrets.nix
+      nuc/
+        configuration.nix
+        secrets.nix
+```
+
+原则：
+
+```text
+secrets/hosts/nas.yaml 只给 admin + nas 加密
+secrets/hosts/pve.yaml 只给 admin + pve 加密
+secrets/hosts/nuc.yaml 只给 admin + nuc 加密
+secrets/shared/*.yaml 只在确实需要多机器共享时使用
+```
+
+不要把所有机器的 secret 塞进一个大 `secrets.yaml`，否则任意一台机器只要能解这个文件，就能看到别的机器的秘密。
+
+---
+
+## 1. 生成你的用户级 admin key
+
+在你的管理机上：
+
+```bash
+mkdir -p ~/.config/sops/age
+age-keygen -o ~/.config/sops/age/keys.txt
+chmod 600 ~/.config/sops/age/keys.txt
+age-keygen -y ~/.config/sops/age/keys.txt
+```
+
+输出类似：
+
+```text
+age1adminxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+```
+
+这个 public key 记为：
+
+```text
+ADMIN_AGE_PUB
+```
+
+SOPS 默认会在 Linux 的 `$XDG_CONFIG_HOME/sops/age/keys.txt` 或 `~/.config/sops/age/keys.txt` 找 age private key；也可以用 `SOPS_AGE_KEY_FILE` 显式指定。([SOPS: Secrets OPerationS][1])
+
+---
+
+## 2. 为新机器生成机器 key
+
+以 `nas` 为例，在 `nas` 机器上执行：
+
+```bash
+sudo install -d -m 0700 -o root -g root /var/lib/sops-nix
+sudo age-keygen -o /var/lib/sops-nix/key.txt
+sudo chmod 0400 /var/lib/sops-nix/key.txt
+sudo age-keygen -y /var/lib/sops-nix/key.txt
+```
+
+得到：
+
+```text
+age1nasxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+```
+
+这个 public key 记为：
+
+```text
+NAS_AGE_PUB
+```
+
+`sops-nix` 支持 `sops.age.keyFile = "/var/lib/sops-nix/key.txt"`，也可以设置 `sops.age.generateKey = true` 自动生成 key；不过个人 homelab 我更建议手动生成一次，然后把 private key 持久化。sops-nix 文档里也提示，如果用 Impermanence，这个 key 必须放在持久化目录并且启动早期可用。([GitHub][2])
+
+---
+
+## 3. 写 `.sops.yaml`
+
+示例：
+
+```yaml
+keys:
+  - &admin age1adminxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+  - &nas   age1nasxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+  - &pve   age1pvexxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+  - &nuc   age1nucxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+creation_rules:
+  - path_regex: ^secrets/hosts/nas\.yaml$
+    age:
+      - *admin
+      - *nas
+
+  - path_regex: ^secrets/hosts/pve\.yaml$
+    age:
+      - *admin
+      - *pve
+
+  - path_regex: ^secrets/hosts/nuc\.yaml$
+    age:
+      - *admin
+      - *nuc
+
+  - path_regex: ^secrets/shared/wireguard\.yaml$
+    age:
+      - *admin
+      - *nas
+      - *pve
+      - *nuc
+```
+
+注意：
+
+```text
+creation_rules 是顺序匹配；
+建议 path_regex 写精确；
+不要用一个泛泛的 ^secrets/.*\.yaml$ 把所有 host 都打通。
+```
+
+SOPS 文档里的例子也说明了 `creation_rules` 可以按 `path_regex` 匹配不同文件，并给不同文件配置不同的 age recipients。([SOPS: Secrets OPerationS][1])
+
+---
+
+## 4. 为特定机器生成 secret
+
+以 `nas` 为例：
+
+```bash
+sops secrets/hosts/nas.yaml
+```
+
+编辑内容：
+
+```yaml
+restic_password: "example-password"
+minio_root_user: "minio"
+minio_root_password: "example-password"
+```
+
+保存后，文件会变成加密形式。SOPS 会保留 YAML 结构，但加密具体值；这正是 SOPS 的主要设计之一。([SOPS: Secrets OPerationS][3])
+
+检查谁能解：
+
+```bash
+sops -d secrets/hosts/nas.yaml
+```
+
+你的 admin key 能解。`nas` 机器的 `/var/lib/sops-nix/key.txt` 也能解。其他机器不能解。
+
+---
+
+## 5. 在 NixOS 里接入 sops-nix
+
+`nixos/hosts/nas/secrets.nix`：
+
+```nix
+{ config, ... }:
+
+{
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+
+  sops.secrets."restic_password" = {
+    sopsFile = ../../../secrets/hosts/nas.yaml;
+    owner = "root";
+    group = "root";
+    mode = "0400";
+  };
+
+  sops.secrets."minio_root_user" = {
+    sopsFile = ../../../secrets/hosts/nas.yaml;
+    owner = "minio";
+    group = "minio";
+    mode = "0400";
+  };
+
+  sops.secrets."minio_root_password" = {
+    sopsFile = ../../../secrets/hosts/nas.yaml;
+    owner = "minio";
+    group = "minio";
+    mode = "0400";
+  };
+}
+```
+
+在 `configuration.nix` 里：
+
+```nix
+{
+  imports = [
+    ./secrets.nix
+  ];
+}
+```
+
+服务引用 secret：
+
+```nix
+{
+  services.restic.backups.main = {
+    passwordFile = config.sops.secrets."restic_password".path;
+  };
+}
+```
+
+`sops-nix` 会在激活阶段解密 SOPS 文件，并把 secret 以单独文件形式放到 `/run/secrets/...`；权限、owner、group 可由 Nix 配置声明。([GitHub][2])
+
+---
+
+## 6. 新增一台机器
+
+假设新增 `router`。
+
+### 6.1 在新机器上生成 key
+
+```bash
+sudo install -d -m 0700 -o root -g root /var/lib/sops-nix
+sudo age-keygen -o /var/lib/sops-nix/key.txt
+sudo chmod 0400 /var/lib/sops-nix/key.txt
+sudo age-keygen -y /var/lib/sops-nix/key.txt
+```
+
+得到：
+
+```text
+age1routerxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+```
+
+### 6.2 修改 `.sops.yaml`
+
+```yaml
+keys:
+  - &admin age1adminxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+  - &nas    age1nasxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+  - &pve    age1pvexxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+  - &nuc    age1nucxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+  - &router age1routerxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+creation_rules:
+  - path_regex: ^secrets/hosts/router\.yaml$
+    age:
+      - *admin
+      - *router
+```
+
+### 6.3 创建该机器的 secret 文件
+
+```bash
+sops secrets/hosts/router.yaml
+```
+
+### 6.4 写 Nix 配置
+
+```nix
+{
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+
+  sops.secrets."some_secret" = {
+    sopsFile = ../../../secrets/hosts/router.yaml;
+    owner = "root";
+    group = "root";
+    mode = "0400";
+  };
+}
+```
+
+---
+
+## 7. 删除一台机器的密钥
+
+假设要删除 `nuc`。
+
+### 7.1 从 `.sops.yaml` 删除 `nuc`
+
+删除：
+
+```yaml
+- &nuc age1nucxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+```
+
+以及所有引用：
+
+```yaml
+- *nuc
+```
+
+### 7.2 更新所有受影响文件
+
+例如：
+
+```bash
+sops updatekeys -y secrets/hosts/nuc.yaml
+sops updatekeys -y secrets/shared/wireguard.yaml
+```
+
+`updatekeys` 会根据 `.sops.yaml` 更新文件中的 recipients；官方文档说明它就是用 `.sops.yaml` 来添加或移除对应的 key。([sops.pages.dev][4])
+
+### 7.3 删除 host 专属文件
+
+如果这台机器永久下线：
+
+```bash
+git rm secrets/hosts/nuc.yaml
+git rm -r nixos/hosts/nuc
+```
+
+### 7.4 对共享 secret 做 rotate
+
+如果 `nuc` 曾经能解某些共享文件，例如 `secrets/shared/wireguard.yaml`，删除 recipient 后建议 rotate data key：
+
+```bash
+sops rotate -i secrets/shared/wireguard.yaml
+```
+
+SOPS 官方文档说明，`rotate` 会生成新的 data encryption key，并用当前 master keys 重新加密；文档也明确建议移除 key 时轮转 data key。([sops.pages.dev][4])
+
+注意：这不能让对方“忘记”历史 Git 版本里已经能解出的旧 secret。真正撤销访问时，应该同时轮转 secret 本身，比如数据库密码、API token、WireGuard private key。
+
+---
+
+## 8. 轮转某台机器的 key
+
+假设轮转 `nas` 的机器 key。
+
+### 8.1 在 nas 上备份旧 key
+
+```bash
+sudo cp /var/lib/sops-nix/key.txt /var/lib/sops-nix/key.txt.old
+sudo chmod 0400 /var/lib/sops-nix/key.txt.old
+```
+
+### 8.2 生成新 key
+
+```bash
+sudo age-keygen -o /var/lib/sops-nix/key.txt.new
+sudo chmod 0400 /var/lib/sops-nix/key.txt.new
+sudo age-keygen -y /var/lib/sops-nix/key.txt.new
+```
+
+得到：
+
+```text
+age1nasnewxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+```
+
+### 8.3 修改 `.sops.yaml`
+
+把旧的：
+
+```yaml
+- &nas age1nasoldxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+```
+
+换成新的：
+
+```yaml
+- &nas age1nasnewxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+```
+
+### 8.4 更新该机器相关 secret
+
+```bash
+sops updatekeys -y secrets/hosts/nas.yaml
+sops rotate -i secrets/hosts/nas.yaml
+```
+
+如果 `nas` 也在某些 shared secret 里：
+
+```bash
+sops updatekeys -y secrets/shared/wireguard.yaml
+sops rotate -i secrets/shared/wireguard.yaml
+```
+
+### 8.5 在 nas 上替换 key
+
+确认 repo 里的文件已经更新后：
+
+```bash
+sudo mv /var/lib/sops-nix/key.txt.new /var/lib/sops-nix/key.txt
+sudo chmod 0400 /var/lib/sops-nix/key.txt
+```
+
+然后：
+
+```bash
+sudo nixos-rebuild switch
+```
+
+### 8.6 成功后删除旧 key
+
+```bash
+sudo shred -u /var/lib/sops-nix/key.txt.old
+```
+
+如果文件系统不保证 `shred` 有意义，例如 CoW 文件系统，直接删除即可，但不要保留旧 key 的备份。
+
+---
+
+## 9. 常用操作速查
+
+### 编辑某台机器的 secret
+
+```bash
+sops secrets/hosts/nas.yaml
+```
+
+### 查看明文，不落盘
+
+```bash
+sops -d secrets/hosts/nas.yaml
+```
+
+### 修改 `.sops.yaml` 后同步 recipients
+
+```bash
+sops updatekeys -y secrets/hosts/nas.yaml
+```
+
+### 移除 key 后轮转 data key
+
+```bash
+sops rotate -i secrets/hosts/nas.yaml
+```
+
+### 批量更新所有 host secrets
+
+```bash
+find secrets/hosts -name '*.yaml' -print0 |
+  xargs -0 -n1 sops updatekeys -y
+```
+
+### 批量 rotate 所有 host secrets
+
+```bash
+find secrets/hosts -name '*.yaml' -print0 |
+  xargs -0 -n1 sops rotate -i
+```
+
+---
+
+## 10. 实际安全边界
+
+这个方案能保证：
+
+```text
+nas 不能解 pve.yaml
+pve 不能解 nas.yaml
+你的 admin key 能解所有
+Git 里只存加密文件
+每台机器只需要持有自己的 private key
+```
+
+这个方案不能保证：
+
+```text
+删除某机器 key 后，它无法解历史 Git 版本
+机器被攻破后，攻击者无法读取该机器当前可访问的 secret
+admin key 泄露后其他 secret 仍然安全
+```
+
+所以额外建议：
+
+```text
+admin age private key 备份到密码管理器或离线介质；
+机器 key 不进 Git；
+机器 key 不复用；
+shared secrets 少用；
+删除机器时同时轮转真实业务 secret；
+不要给 CI 一个能解所有 secret 的 key，除非 CI 本身就是高信任环境。
+```
+
+最终模型可以概括为：
+
+```text
+每个 secret 文件 = admin key + 最小机器 key 集合
+每台机器 = 只能解自己声明需要的 YAML
+所有权限变化 = 改 .sops.yaml + updatekeys
+撤销访问 = updatekeys + rotate + 轮转真实业务凭证
+```
+
+[1]: https://getsops.io/docs/ "SOPS: Secrets OPerationS | SOPS: Secrets OPerationS"
+[2]: https://github.com/Mic92/sops-nix/blob/master/README.md "sops-nix/README.md at master · Mic92/sops-nix · GitHub"
+[3]: https://getsops.io/?utm_source=chatgpt.com "SOPS: Secrets OPerationS"
+[4]: https://sops.pages.dev/ "SOPS Documentation"

flake.lock

@@ -21,6 +21,168 @@
         "type": "github"
       }
     },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_3": {
+      "inputs": {
+        "systems": "systems_3"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_4": {
+      "inputs": {
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_5": {
+      "inputs": {
+        "systems": "systems_5"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_6": {
+      "inputs": {
+        "systems": "systems_6"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_7": {
+      "inputs": {
+        "systems": "systems_7"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_8": {
+      "inputs": {
+        "systems": "systems_8"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_9": {
+      "inputs": {
+        "systems": "systems_9"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -65,16 +227,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1775888245,
-        "narHash": "sha256-nwASzrRDD1JBEu/o8ekKYEXm/oJW6EMCzCRdrwcLe90=",
+        "lastModified": 1778443072,
+        "narHash": "sha256-zi7/fsqM/kFdNuED//4WOCUtezGtKKqRNORjMvfwjnA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "13043924aaa7375ce482ebe2494338e058282925",
+        "rev": "da5ad661ba4e5ef59ba743f0d112cbc30e474f32",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -111,6 +273,185 @@
         "type": "github"
       }
     },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1775888245,
+        "narHash": "sha256-nwASzrRDD1JBEu/o8ekKYEXm/oJW6EMCzCRdrwcLe90=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "13043924aaa7375ce482ebe2494338e058282925",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "o4dev-admin": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "oparic-flakes",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779025142,
+        "narHash": "sha256-K1BJ3qlxfYQUrGgn965NAo1w0ltl/OXNQnxUNE3c3O8=",
+        "ref": "refs/heads/main",
+        "rev": "8794956f942027ae9c70d7a83312cf7f64eb24c7",
+        "revCount": 10,
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/admin"
+      },
+      "original": {
+        "ref": "refs/heads/main",
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/admin"
+      }
+    },
+    "o4dev-backend": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": [
+          "oparic-flakes",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779021375,
+        "narHash": "sha256-CXMq9jzeAWeTWkQ+zY01GZeSQ1kjl/LuiQvxz4Sfdvo=",
+        "ref": "refs/heads/main",
+        "rev": "d71b82129ecf9dd73743d22e89cb4b5a48bc1bd8",
+        "revCount": 220,
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/backend"
+      },
+      "original": {
+        "ref": "refs/heads/main",
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/backend"
+      }
+    },
+    "o4dev-workflows": {
+      "inputs": {
+        "flake-utils": "flake-utils_3",
+        "nixpkgs": [
+          "oparic-flakes",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778945408,
+        "narHash": "sha256-9yx4Ya7X/MOeHSIeUKHe1p08RmGuekHN/m9SQIjHS8c=",
+        "ref": "refs/heads/main",
+        "rev": "7458a1db6621fe4cc1df57e8841975dff2aad866",
+        "revCount": 114,
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/workflows"
+      },
+      "original": {
+        "ref": "refs/heads/main",
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/workflows"
+      }
+    },
+    "oparic-flakes": {
+      "inputs": {
+        "nixpkgs": "nixpkgs",
+        "production-admin": "production-admin",
+        "production-backend": "production-backend",
+        "production-workflows": "production-workflows",
+        "sops-nix": "sops-nix",
+        "staging-admin": "staging-admin",
+        "staging-backend": "staging-backend",
+        "staging-workflows": "staging-workflows"
+      },
+      "locked": {
+        "lastModified": 1779032883,
+        "narHash": "sha256-gMtQWHa7FQl/r592oPMxT1welkrtNa3xxSBvlpdV1RQ=",
+        "ref": "refs/heads/main",
+        "rev": "b0a076dd4b6085210bbda35b223d69273ec6ebab",
+        "revCount": 34,
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/container-flake"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/container-flake"
+      }
+    },
+    "production-admin": {
+      "inputs": {
+        "flake-utils": "flake-utils_4",
+        "nixpkgs": [
+          "oparic-flakes",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779025142,
+        "narHash": "sha256-K1BJ3qlxfYQUrGgn965NAo1w0ltl/OXNQnxUNE3c3O8=",
+        "ref": "refs/heads/main",
+        "rev": "8794956f942027ae9c70d7a83312cf7f64eb24c7",
+        "revCount": 10,
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/admin"
+      },
+      "original": {
+        "ref": "refs/heads/main",
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/admin"
+      }
+    },
+    "production-backend": {
+      "inputs": {
+        "flake-utils": "flake-utils_5",
+        "nixpkgs": [
+          "oparic-flakes",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779021375,
+        "narHash": "sha256-CXMq9jzeAWeTWkQ+zY01GZeSQ1kjl/LuiQvxz4Sfdvo=",
+        "ref": "refs/heads/main",
+        "rev": "d71b82129ecf9dd73743d22e89cb4b5a48bc1bd8",
+        "revCount": 220,
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/backend"
+      },
+      "original": {
+        "ref": "refs/heads/main",
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/backend"
+      }
+    },
+    "production-workflows": {
+      "inputs": {
+        "flake-utils": "flake-utils_6",
+        "nixpkgs": [
+          "oparic-flakes",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778945408,
+        "narHash": "sha256-9yx4Ya7X/MOeHSIeUKHe1p08RmGuekHN/m9SQIjHS8c=",
+        "ref": "refs/heads/main",
+        "rev": "7458a1db6621fe4cc1df57e8841975dff2aad866",
+        "revCount": 114,
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/workflows"
+      },
+      "original": {
+        "ref": "refs/heads/main",
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/workflows"
+      }
+    },
     "root": {
       "inputs": {
         "darwin": "darwin",
@@ -118,12 +459,19 @@
         "home-manager-darwin": "home-manager-darwin",
         "nixpkgs-darwin": "nixpkgs-darwin",
         "nixpkgs-linux": "nixpkgs-linux",
-        "sops-nix": "sops-nix"
+        "o4dev-admin": "o4dev-admin",
+        "o4dev-backend": "o4dev-backend",
+        "o4dev-workflows": "o4dev-workflows",
+        "oparic-flakes": "oparic-flakes",
+        "sops-nix": "sops-nix_2"
       }
     },
     "sops-nix": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
+          "oparic-flakes",
+          "nixpkgs"
+        ]
       },
       "locked": {
         "lastModified": 1777944972,
@@ -138,6 +486,228 @@
         "repo": "sops-nix",
         "type": "github"
       }
+    },
+    "sops-nix_2": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1777944972,
+        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
+    "staging-admin": {
+      "inputs": {
+        "flake-utils": "flake-utils_7",
+        "nixpkgs": [
+          "oparic-flakes",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779025142,
+        "narHash": "sha256-K1BJ3qlxfYQUrGgn965NAo1w0ltl/OXNQnxUNE3c3O8=",
+        "ref": "refs/heads/main",
+        "rev": "8794956f942027ae9c70d7a83312cf7f64eb24c7",
+        "revCount": 10,
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/admin"
+      },
+      "original": {
+        "ref": "refs/heads/main",
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/admin"
+      }
+    },
+    "staging-backend": {
+      "inputs": {
+        "flake-utils": "flake-utils_8",
+        "nixpkgs": [
+          "oparic-flakes",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779021375,
+        "narHash": "sha256-CXMq9jzeAWeTWkQ+zY01GZeSQ1kjl/LuiQvxz4Sfdvo=",
+        "ref": "refs/heads/main",
+        "rev": "d71b82129ecf9dd73743d22e89cb4b5a48bc1bd8",
+        "revCount": 220,
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/backend"
+      },
+      "original": {
+        "ref": "refs/heads/main",
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/backend"
+      }
+    },
+    "staging-workflows": {
+      "inputs": {
+        "flake-utils": "flake-utils_9",
+        "nixpkgs": [
+          "oparic-flakes",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778945408,
+        "narHash": "sha256-9yx4Ya7X/MOeHSIeUKHe1p08RmGuekHN/m9SQIjHS8c=",
+        "ref": "refs/heads/main",
+        "rev": "7458a1db6621fe4cc1df57e8841975dff2aad866",
+        "revCount": 114,
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/workflows"
+      },
+      "original": {
+        "ref": "refs/heads/main",
+        "type": "git",
+        "url": "ssh://gitea@git.inclyc.cn:20122/oparic/workflows"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_5": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_6": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_7": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_8": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_9": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -17,9 +17,32 @@
       inputs.nixpkgs.follows = "nixpkgs-darwin";
     };
     sops-nix.url = "github:Mic92/sops-nix";
+    oparic-flakes.url = "git+ssh://gitea@git.inclyc.cn:20122/oparic/container-flake";
+    o4dev-backend = {
+      url = "git+ssh://gitea@git.inclyc.cn:20122/oparic/backend?ref=refs/heads/main";
+      inputs.nixpkgs.follows = "oparic-flakes/nixpkgs";
+    };
+    o4dev-admin = {
+      url = "git+ssh://gitea@git.inclyc.cn:20122/oparic/admin?ref=refs/heads/main";
+      inputs.nixpkgs.follows = "oparic-flakes/nixpkgs";
+    };
+    o4dev-workflows = {
+      url = "git+ssh://gitea@git.inclyc.cn:20122/oparic/workflows?ref=refs/heads/main";
+      inputs.nixpkgs.follows = "oparic-flakes/nixpkgs";
+    };
   };
 
-  outputs = { nixpkgs-linux, nixpkgs-darwin, home-manager, home-manager-darwin, ... }@inputs: {
+  outputs = { nixpkgs-linux, nixpkgs-darwin, home-manager, home-manager-darwin, ... }@inputs:
+  let
+    o4devContainer = inputs.oparic-flakes.lib.mkOparicContainer {
+      name = "o4dev";
+      containerConfig = import ./hosts/oparic-local-dev/containers/o4dev/config.nix;
+      secretsFile = ./hosts/oparic-local-dev/containers/o4dev/secrets.yaml;
+      backendInput = inputs.o4dev-backend;
+      adminInput = inputs.o4dev-admin;
+      workflowsInput = inputs.o4dev-workflows;
+    };
+  in {
     nixosConfigurations = {
       "eris" = nixpkgs-linux.lib.nixosSystem {
         system = "x86_64-linux";
@@ -30,7 +53,7 @@
       };
       "oparic-local-dev" = nixpkgs-linux.lib.nixosSystem {
         system = "x86_64-linux";
-        specialArgs = { inherit inputs; };
+        specialArgs = { inherit inputs o4devContainer; };
         modules = [
           ./hosts/oparic-local-dev/configuration.nix
         ];

home/hosts/oparic-local-dev.nix

@@ -8,6 +8,9 @@
     ../modules/shell.nix
     ../modules/zsh.nix
     ../modules/shell-develop.nix
-    ../modules/ssh.nix
   ];
+
+  programs.zsh.initContent = ''
+    zstyle ':prompt:grml:*:items:user' pre '%F{green}'
+  '';
 }

home/standalone/.zsh.d/nix.zsh

@@ -1,5 +1,7 @@
 #!/usr/bin/env zsh
 
+export O4_FLAKES="$HOME/flakes"
+
 if command -v direnv &> /dev/null; then
     eval "$(direnv hook zsh)"
 fi
@@ -16,7 +18,7 @@ o4-home-switch() {
   home-manager switch --flake ~/flakes#$(whoami)@$(hostname)
 }
 
-sops-update-file() {
+o4-sops-update-file() {
   local src_file="$1"
   local yaml_file="$2"
   local age_key_file="$HOME/.config/sops/age/keys.txt"
@@ -53,12 +55,12 @@ sops-update-file() {
   return $rc
 }
 
-sops-update-ssh-config () {( set -e
+o4-sops-update-ssh-config () {( set -e
     local SSH_CONFIG=$HOME/.ssh/config
-    local FLAKES=$HOME/flakes
+    local FLAKES=$O4_FLAKES
 
     $EDITOR $SSH_CONFIG
-    sops-update-file $SSH_CONFIG $FLAKES/secrets/ssh-config.yaml
+    o4-sops-update-file $SSH_CONFIG $FLAKES/secrets/ssh-config.yaml
     pushd $FLAKES
     if [[ -z "$(git status --porcelain)" ]]; then
         git add .
@@ -66,3 +68,40 @@ sops-update-ssh-config () {( set -e
     fi
     popd
 )}
+
+O4_SOPS_MACHINE_KEY_DIR="/var/lib/sops-nix"
+O4_SOPS_MACHINE_KEY_FILE="$O4_SOPS_MACHINE_KEY_DIR/key.txt"
+
+o4-sops-machine-key-init () {
+  # use sudo echo "require sudo" to get sudo
+  sudo echo "require sudo" > /dev/null
+
+  # check folder and file
+  local key_dir="$O4_SOPS_MACHINE_KEY_DIR"
+  local key_file="$O4_SOPS_MACHINE_KEY_FILE"
+  sudo mkdir -p $key_dir
+  if [[ -f "$key_file" ]]; then
+    echo "key exists: $key_file" >&2
+    return 1
+  fi
+
+  # keygen
+  sudo install -d -m 0700 -o root -g root $key_dir
+  sudo age-keygen -o $key_file
+  sudo chmod 0400 $key_file
+  sudo age-keygen -y $key_file
+
+  # print pub key
+  sudo grep "^# public key: " $key_file | cut -d ' ' -f 4
+}
+
+o4-sops-machine-key-print-pubkey () {
+  local key_file="$O4_SOPS_MACHINE_KEY_FILE"
+  if [[ ! -f "$key_file" ]]; then
+    echo "key file not found: $key_file" >&2
+    return 1
+  fi
+
+  sudo grep "^# public key: " $key_file | cut -d ' ' -f 4
+}
+

hosts/eris/configuration.nix

@@ -9,9 +9,9 @@
     [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      inputs.sops-nix.nixosModules.sops
       ../modules/nix-cache.nix
       ../modules/users/origami.nix
+      ../modules/sops.nix
     ];
 
   boot.loader = {
@@ -150,13 +150,14 @@
   users.users.origami.extraGroups = [ "wheel" "networkmanager" ];
   security.sudo.wheelNeedsPassword = false;
 
-  sops.defaultSopsFile = ../../secrets/ssh-private.yaml;
-  sops.defaultSopsFormat = "yaml";
-  sops.age.keyFile = "/home/origami/.config/sops/age/keys.txt";
-
   # List services that you want to enable:
 
   # Enable the OpenSSH daemon.
   services.openssh.enable = true;
+
+  # 密钥管理: 这是日用机器
+  sops.defaultSopsFile = ../../secrets/ssh-private.yaml;
+  sops.age.keyFile = "/home/origami/.config/sops/age/keys.txt";
+
   system.stateVersion = "23.11";
 }

hosts/hypnos/configuration.nix

@@ -7,6 +7,17 @@
 
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
 
+  nix.buildMachines = [{
+    hostName = "192.168.2.22";
+    systems = [ "x86_64-linux" ];
+    sshUser = "origami";
+    sshKey = "/Users/origami/.config/sops-nix/secrets/ssh-private";
+    protocol = "ssh-ng";
+    maxJobs = 4;
+    supportedFeatures = [ "nixos-test" "big-parallel" "kvm" ];
+  }];
+  nix.distributedBuilds = true;
+
   networking.hostName = "hypnos";
   time.timeZone = "Asia/Shanghai";
 

hosts/modules/sops.nix

@@ -0,0 +1,11 @@
+{ inputs, pkgs, ... }:
+{
+  imports = [ inputs.sops-nix.nixosModules.sops ];
+
+  environment.systemPackages = with pkgs; [
+    sops
+    age
+  ];
+
+  sops.defaultSopsFormat = "yaml";
+}

hosts/oparic-local-dev/configuration.nix

@@ -1,12 +1,12 @@
-{ config, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, o4devContainer, ... }:
 
 {
   imports =
     [
       ./hardware-configuration.nix
-      inputs.sops-nix.nixosModules.sops
       ../modules/nix-cache.nix
       ../modules/users/origami.nix
+      ../modules/sops.nix
     ];
 
   # BIOS + GRUB, 安装到 MBR
@@ -24,7 +24,7 @@
     prefixLength = 24;
   }];
   networking.defaultGateway = "192.168.2.1";
-  networking.nameservers = [ "119.29.29.29" ];
+  networking.nameservers = [ "119.29.29.29" "223.5.5.5" "114.114.114.114" ];
 
   time.timeZone = "Asia/Shanghai";
 
@@ -83,11 +83,74 @@
   users.users.origami.extraGroups = [ "wheel" ];
   security.sudo.wheelNeedsPassword = false;
 
-  sops.defaultSopsFile = ../../secrets/ssh-private.yaml;
-  sops.defaultSopsFormat = "yaml";
-  sops.age.keyFile = "/home/origami/.config/sops/age/keys.txt";
-
   services.openssh.enable = true;
 
+  # Mihomo 代理
+  services.mihomo = {
+    enable = true;
+    configFile = "/etc/mihomo/config.yaml";
+    tunMode = true;
+  };
+
+  # 密钥管理: 这是对外机器
+  sops.defaultSopsFile = ../../secrets/hosts/oparic-local-dev.yaml;
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+
+  sops.secrets.caddy_cloudflare_api_key = {
+    owner = "caddy";
+  };
+  # Caddy 反向代理 + Cloudflare DNS challenge 通配符证书
+  services.caddy = {
+    enable = true;
+    package = pkgs.caddy.withPlugins {
+      plugins = [ "github.com/caddy-dns/cloudflare@v0.2.4" ];
+      hash = "sha256-VHm9POg2KixGsMsAcfFFDMK9x6niRJ1iJV9kkSwkSjc=";
+    };
+    virtualHosts."oparic.luo.ee, *.oparic.luo.ee" = {
+      extraConfig = ''
+        tls {
+          dns cloudflare {file.${config.sops.secrets.caddy_cloudflare_api_key.path}}
+          propagation_timeout -1
+          propagation_delay 30s
+        }
+        reverse_proxy 192.168.2.22:40000
+      '';
+    };
+  };
+  networking.firewall.allowedTCPPorts = [ 80 443 40000 ];
+
+  networking.nat = {
+    enable = true;
+    internalInterfaces = [ "ve-o4dev" ];
+    externalInterface = "ens18";
+    forwardPorts = [{
+      sourcePort = 40000;
+      destination = "10.233.1.2:80";
+      proto = "tcp";
+    }];
+  };
+
+  # NixOS container: o4dev
+  containers.o4dev = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = "10.233.1.1";
+    localAddress = "10.233.1.2";
+    bindMounts."/data" = {
+      hostPath = "/home/origami/data";
+      isReadOnly = false;
+    };
+    bindMounts."/var/lib/sops-nix/key.txt" = {
+      hostPath = "/home/origami/data/sops-age-key.txt";
+      isReadOnly = true;
+    };
+    forwardPorts = [{
+      containerPort = 80;
+      hostPort = 40000;
+      protocol = "tcp";
+    }];
+    path = o4devContainer.config.system.build.toplevel;
+  };
+
   system.stateVersion = "23.11";
 }

hosts/oparic-local-dev/containers/o4dev/config.nix

@@ -0,0 +1,24 @@
+{
+  domainSuffix = "oparic.luo.ee";
+  dataDir = "/data";
+
+  backend = {
+    port = 54289;
+    chatApiBaseUrl = "https://api.deepseek.com/v1";
+    suggestTitleModel = "deepseek-chat";
+  };
+
+  applogGateway = {
+    port = 9100;
+  };
+
+  clickhouse = {
+    httpPort = 8123;
+    database = "oparic_applog";
+  };
+
+  admin = {
+    basicauthUser = "admin";
+    basicauthHash = "$2a$14$oeoymHjMd5cPY3jWtbLax.Uyo4nvNLf/CbnbbjwclfYDhEzfBmc1C";
+  };
+}

hosts/oparic-local-dev/containers/o4dev/secrets.yaml

@@ -0,0 +1,17 @@
+oparic:
+    backend: ENC[AES256_GCM,data:GSyPaHF56jqubIDxhbhJJuFfoFuWWudWQqJHFZtftHnG1gC02kBurGTMdS+zLKhRueWWwPYp9RjWoP1I+nzUjrtGzy9muAm4cECwpMup/7w14wRy+7SpfmqmcMY2n5zljV/Cg856RTHauQUyGYLChlLG3PtXwgxr6eDn5q7yO46qv43uPdkzr8QO5U/Q0V2lNsW4r00n4rpaB/oIgoWIx8SVLL9tCOlOGzpudlmIHqj0Sotqc/na+OSFkLLQvsg4O4jd+Leuze65B7RvtwesYcxje+uiGoYrn2YJWPyfA8fdIQwSLBjEz1fQUNPhIY/fpDt2+3/VxV/K1UmS2loYpTYjOsCT6UYJWLXNzeNp/KLu5oGMvt846U5oGIBETgzPm7ExgiVtWvG5Kp444JgT+DhGaiCzxV3fFgoSDALP7FguKWNKd0MuTYJbmFyunM4g+Y3vo5NrF/zVJmMnXlJ7KBQrJw==,iv:M/ORauW8DWc5/c+3pLyeOXdT+i7jpLcyrathDKS1V2o=,tag:wGqKUkxOLOC5ttcJcyBuRw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArOEw2TiswN25nWEZaSEFo
+            czFUWmV0dVJKQ3JIRnF3TzV2YXZ5L0ROQ1ZnCnYwZUFmMzIwWWJEUWlkTVpOa3A2
+            cHA4UWg3SGdHNkFPOHIxMks4OWV0TUEKLS0tIEF4OUt4NHk1QThnM0dwL3RtMitj
+            UkxzbDhJejA4a0V1Lzd6d0JQSzAyUWMKqhUWjNPpsBrrALq7un53Qxhbp/RfKx67
+            tp3NWjMly9FI3RR+clQ82ZYaIK0Bm3YAlRI+wdzM7OiAbhNZdwh3Hw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e80f6ea37ha7udmcctaggak9l44khtcn6e966fhcldrzjjxwzals65yasf
+    lastmodified: "2026-05-17T11:17:24Z"
+    mac: ENC[AES256_GCM,data:DGTgnEl+ehkA3zLDueXdcfaTgCzAsa1fp7ZAuUl8DOsltF0rCSf4Nc5mGqSsaIyZphkzibU1e/ZD259s3Uw12ZojBG/AWPhVMgr6SxpKpKjQSl+a1dg+8nZuAR7OXoLZUSMWO3H8xkyusA2UrQXMKEmDruZTdhB7abP6vwySUS0=,iv:JBMiqCayLCSVMcbPWWJUsVCNjrXTvKmf8nTAipib+3Y=,tag:aPD0ddGNONtrW7kbzj/vkw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.0

secrets/hosts/oparic-local-dev.yaml

@@ -0,0 +1,25 @@
+caddy_cloudflare_api_key: ENC[AES256_GCM,data:AXil/BHboMREDOXfgV/F0BIWYE9+Rq/kdpQhtOkh+yTOLsF9mmP89HQV7VFiOWjXGMvvAlU=,iv:CmqMVBLv55lwt371FJ/1qXY2On1Ilhdm3mzM6cKCw/o=,tag:36poStmxIS9cXk5a7tsNSw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzSjk0cDFsY1JFRFR5WE1Q
+            ZXlJRTJCNjIyT29XYXkranJqbjAySVA0aEE0CmVEWGo5bVhvd1c5MEVDTjZ2NWpp
+            VEtTd2Z4bGZLd3R4YnhVKzZLS3pnckkKLS0tIEorcW5aejFtMnlEZjhTNmhZWXdt
+            RFM1MEFjT29BOUptT0lNazdQK1BNeUEK29JlPkRvbz7HRyB0s+0JHv7fd3i9uMKF
+            SBEoPrIXWuoNUKmCuZlqJVNIWPEV2v3/tpFWbL9sXN/6qoGpt30csw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1nlta6ek2fsre42g38ytwg3fxtra4h444psd7g986md0gzmvv6d5qqlwwjy
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsVmhxemI1S05zTW9sMzFB
+            WHVsaEpuNFU5cFZuWWI0Vnd2NFFQb1pvWWwwCmtHU2Y2ZFY2TTVIL1oxckVHbWxt
+            aVFTVW4wa3JWa2hNcjVmYm51VGZYNlkKLS0tIG44OGJWL0tab2diWkt4M1hEUmFS
+            ZXlBbjUramhvMXYxQlVSMEh4OEh5eDgKTJMgvoo2Wgn/FsoXsA0mCweUhmqhAGp/
+            nIvGJsDz88QS+nVGybLkekl6LM+UR+sRy7fttDzX49Oxre7ovkSVyw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1mgxmpfpy6qg374kyq66cc5yw68qfw0mlk89rcdy3lkzw9q93jvwqg73395
+    lastmodified: "2026-05-17T04:26:09Z"
+    mac: ENC[AES256_GCM,data:XVocfoUXqh7ntKfM64sveo36xHgIX/4zM1dN1ML7Iu4qEsOB1YvHfS80z8KtJxY6ZTWl/XjqeT8YzQ2TSgpPAnND6DQ5dUiXz3G5jqZ8Foa6SQGdfqD5Yk6yBW+GRPHQUIhxBbJLeNtacRQRAC3vBuMdTqX7W/C9leLEt73B1WQ=,iv:XhwXnIXLqBfGRk9lymCGGby+SzYY0dDByPZL8AWk+xg=,tag:ryfQteA2Ul2rP8Y1NgdaOQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.0

secrets/ssh-config.yaml

@@ -1,16 +1,16 @@
-ssh-config: ENC[AES256_GCM,data:j5mr3R29SKjra7TMgm0O2sR1RzSeSiFZurDTfoXMu3rJropGPiIS958Jh1+fyMTmCL9y81iCESYpxQH4Ssv2vcKQ6ppy/agjL77YVply8uGwPmZ6F9x3WA37j98UuEsYfCkVPTbDafK8bnMiCwDF6Mkr64HmxKXlN36W5lL9GXVjFiWwb0mz6QFl0JtL+FhyzNa2BrZ/xNtAFu0T36pTh/fS7gS4oi4ubegsxUMO82wnpJTaxSqTCLM3LCoaC+tlW+Zm//rUnKufbCx6bDfJAZ7eym5AhHXUF//fgNq8qYAA84oF5GZueIPTEbCKd6QEBbwh7ADf7ku+ibxJWrQS4IMhyj0EQxI2BtAYN1GVPhKxVTYAYJKM1UufRBYPANQgVn8dr++QxhnHUYeIt5DXhI2FKya66F9yqHroiRTZNEF29l/kykhCmJeTFxSzzpX1NOoaw/i01Q71wK75jmNDOvXTHmfmvcTEt7zm+XMTDsnFUDhJgKNK4x3CpBydQ9IB/zMvATP540FBI3QxW33jYgxs5Ln+f7ZGwGCrJ3dwwf8Ji7bdPJN3SFJiu4hY7MNLdi8AdXoFb/8pRvCJs1d9Ao/rrev4va8CDeyyt2fVMDtmTcJcBkU6RALvv3GlSwBfyH/4sd62Uvn6dsu9PmhsEOxxmOua8qt5ghnklKURHC/+nGou7QnH8o5z+XvsXV7hW7vKQLbptkSZQNGOqpJRTtCR5YWpoJUYY8gx1VAv3A6+AgPA8YWK3oWJ9B038kk5xJDDOOM5l/a1A5SsK63PksXpL9+SBzPnTxfJ8DMoHy0wf36oLF8m6oI2e4t6JGEDwJJVeMKvM406EkXNNjCHlTmVjlW+TQurTZEh6yZxwYlPcYj+RBxHKyImJM9dzs4O1nr1OYwBmZkGzc+FpqE1E6JS2xQ8LnvB+ZFXjhHtSrO6Xtkfm7oA0d8f1JD+JktQjVCsy6cjy4WEHKXwELFXBJeWysxdtF2B15o0cmv+rfkmGJ73yoRX4c+JSHHpNav13A8Ls+Lpy3MOw+axItq9OaxOAvyql5abaslsS03wSUymMYGZQRVM8mpqHz7uZ1eiwv6FkQmYwmSp5JBfGRP8i346km6R21B/SHyWXOGaLlyM5ecmE6nLexgVTCRvyR7hu+lO2knV/F+vKzt/bHzGE4pf/aA9Sm180g8dejMMNvsr8ZJalfr8DODZZhT89pcpiA30aYm3waEDa22cWc6dOHE6U+4gu57Hor69+O+nW4EvVDrW4xRy2a3OzTYOnQr/xI+QDr8O42CWsv2GY2/XD8qseUiAD+d0DMNNdv5jWiFrazzdPnItVjb/XutqCmxAPmNmDAs/3zE2vUTbl0pgHjK8cwPb+glpM+fi4maf6ybm4QN6A4XpKL4YB1/wFVasdflYMv+LACG18BLuBPvVMbZZSdrDmfHeJNFwb0pdn1Ef34gPspO1JlMEdTEEsVmvxPFIalx4xsXoQ60iUolIfHBDxNl7gF9VD4b/Dn98i5Po7mJUW+T40Gw9Li5Li+NGWcOt4WF+F7JATcDCM9lfEHMTUAhnzSpFTwcFefGVJLVgNXTM3F/xr3Um8ClP4nkgzaNPjK82LoY8Q+H5AI1cFTUE9gx7+ZcjjIRE8Yh0FIdg9/PGDfowwzxt3GzW+ZBrnf+P4mLQgCovCUBCb4Kb5YBdMpUziw9KopOM/3BE6d51Z3LSKGNTw0Ibf1nytaCVnP3rwAQMs8EDIx1N3cTbwyExXP20caOkaamoTBP7r5kcxU4Ahg1MADDmyPkYQNPCBZOnFlGHQ9qzyaQpwUb9xckupl05CqNyzc6AokjDOu+I8q+Gv68kxYczJDhF70ANKSzzlpRNICm9xOtfyRUYYJTOBWSW/e70yrNWKK1sqmaZxAqiPNF8fBXzjD8X74SDl6GW6Rfn93OGjwEwGk2jTSU4Gux5KEOmYvlckwWFL4L/NzavShp9nKtTaHP1JBxP6vf015eiyLpFzhO6Jdmh2iCGz/vxfYSE4Nglp2hc7vhAfDECJP4Hd1kjRR4bjLMBKQZBk279UcG0JkxO+YfJoyZ0YkYlkMHYt9ee1v/gqztdVeRg5Ae/B5CVkL0fqotfqvhI4pJkAqUEUZWQtx756+vwDJ0WDlmoJT/K2UqakSXNF692Q1kz+Y67rwHRupqxdDEsM027VolUanSM28omcIstSGXGNDs4Uc8U/zxUkZ1GA88Ql7IOKtoAVRtywv1HpEC+E7SVE2o9yf7kNoyl0TeS6z0ndUW3HCkrGAJfPUb52CRmHPe2gmvk4y/eIa7vt16hKEml8GY8JzUZXOztQXVWoxsad2ZNaeYQT6dzKmZoYqQgDAr0hIO7GlP16y1tLUUhWBI+iE8WClJqHfAPelYy9EhzK+2gfUCOSOS+6c7496uQk4fdbdrM51aIbGtdDDQpvJj9i8zrLISPoxZe5MiyIv4GjpDr9doMKchBX2epXN+Dz0yoDf44736LvjZ8916epjUdN/4+lUXiEKEXkebwRyhiwzbBuK0GfxM2agab2wrdqx3ylp3zcBtHLvGE5z1DbibmJFSB+1oCzga/SJAKXUelHhhVqDJYy2U+YQGtlxuzKIM/UqXgb0zPyiQ8gWUZakuAOIvDN1WWTZhj2RnXCML4ouYSYxmcorxuD2K7U9VfFujcy9Xm6wyO6rCMU/ZlLKMOTwXAivaYynUoxaGu5aQyLRu/eei36yqrMGQ9wbTNtNfJG4T3eP3ZlI5IbCtdRT1n7bbmxbmnaJ0nY7Y5vJeVTrIDhTLHZ8k173X9FHftpvSrvUB/uk06n6fwxjG1jSykw+dQsfZagFG4Ko5caRsd9NJCqUmN0ebfkX72fMapbQRKNgD/hIpGLL7RutxegumlQOfe9ej5GfeM3uqekNC8L37w0YkRWO4IsU3YfcemRXJlDkpy3fwrldt63KbblcoIqGIfgXuCOy7mYmtbC38RWlONV6XrgKwbIckoOlYgzisAU9XN7/mnwqhrFO/KMhrfilAO3TKcAcHTjZ5MDLKiXVzrVbYX+Wbp8pkVtl08Xmh4AX7bhF1sOCfFmn6svBnOJoRg0leXswbBZBclEZhjAFN7kMVpzUw+7WHitqodsIINXtwrK9PiBV+839Nrju49kOoTSJEL55E0agrB496cFWn7GP1HqtzRbctjz9EgI8SnBV/cObxv3SIddrFpPIZAVjdYBCcGSU85Yif78d8bY2TEHzmt8UBFD1oXJB9+pROQtcpyGDSfC7wftQZIselaRy9RBab6u76uGKeHTUzFfjGaFohmSKaGZhV+9Ww0I7d5Wjl3MkOYN9g151e+BrRMq+HCOkKI+r/0paLJ3lNZNkIqwMnOXWQn42cRMJSxoliwzz4DlFd5DyrwcvxpbUiFPku2oMnoWt16C+8PEMrwAlqSY3QplosgsSxS5apKtf5Cqev39euA9900zwYOHuijJorWM8infc9fyaw+NTci2zb+j4QNgj+r1g6/F8++Zbks2rhUgb4YaZDdXJxXxd6cLHf8St4u9g==,iv:fEmaF1T7BxT+wDYfZR+u1+0Oh4dR02ITExpHjWdiah4=,tag:EzJl8epBZyPc58Bi6PR1mw==,type:str]
+ssh-config: ENC[AES256_GCM,data:yMZ3/cU1QrOucfL1nSVWpGOpXenKTd7eDLwGOfiC6Z3Le6uv5yin9Ovvf8oPY3vge63U2c+1G7X8+rNx/gkB37rBZrkkxb7MVPPxupmgbNxTTnIZm7+cfTZscEsXrxjCD9EribJVmY+BY5oSTy8QN6b7n8WH9xJTzgQvSAoRsZtedP6LoN8EaTP3+asbkdf0SwqgQhLHM3oWE5JL5Lb916rtD7JuQ30FRcNypUhkbzKWRSAmssTsT8i2DQToyskTD5OzujwWxlSH0SGaB1GFsmipPPqeZVyrQ61jRgdurwMfYfhaskzKJd1m0fpD8rD0YMYNT4E16boci7pVRqDolrgVLAF4P4I3AoW9eVHPmyEtmd0o84r+tXpz3DmGsmFbxHhY7YJxo8ysVXCk7DGKiaiGF6/qwftzQ3BxpZovylXh9nZj0WoY5LefXLGq0+fTEVk6gRQNM9qeRQuss+Uds/j1QYZjC7WAfJovh03k00Y9jBqA0FXvdCd8by1GX9j9md7HdugV57/erSs03QEaZ/RdyInWWjf/FuEbZYl3YvPWFNtpBBGJPN/qZ4gO4Vc3OAGdrAxg67sqmwPKslwleiDOslJs3BAr/gAwUDPeQCoL3yWQM9fTktu6LgP8gMau5xTascmvgvKg1QVsTn8l7BqNGY9aMhQouv5vQthgdiiQURzXi4GJe1nDb6+50JoG76Q2M4VJoWJjoV6lV0Hy5+02476UeaitrRJOealUIqD+e7B6BIC1IWYaCC6FNq8OZo4W7Zc0vQRwTHqWZ0lC6ApgkrUrCft2jgeFue9Zfrcpv4ZdCQXBpZf4SysqY6WXq+sMHIrYypbfBLdSnoOCA4ArS+k6tQCm8WeJS02dLmXm6gL3OPoAfoTljvt9GfZrOTbBjiJ1P0A47kI3ycavH8T7v1KLDyba9OWJBTXA9tCyAh3IHXR3gnH5DJWeqql5W8basH9rUDYAZnr/9MiNudWFlHJrDkVyg4WRhTqDXbd8mkg3uvd0KPaLf4WfeV0hDN0fUwiWAaM/SUKYRu+8Dd/d+O6My1yEdGuEpBJ6yRifu8NNtKqD9NWw6fJR+n/pmT/kY6O65kMQQ4AtnEiRqXazSD0sz/F7XJp3UBGRD542MTv0xKOKHPrITelk/IBT/77uDNNEfnae+wU32fsGfcaMkv6fO4A2KRv0rxPSX61zP0tEZGt+DWFZXq3ItwRQIxjJJFuoERWWHWB+UbLCFSFv0XDVI3t90PtKbTr0oLzHEF6z4ZAAcpHLte/aXD1d3FWjI2quCQ4rKD5Hh2Thz1cecn+bmu5SmJMoHjbDDRWQyaL3nswIAr5dgaGPhMipWqxn2oRbf34VltYAdF1UED8VXDWbkMuEOZ9ISw2gQOQuulDP2KYfDHgZspDt9T7/0Vf5XLT0ofKhmkMUqEhZ9nb+u6R+UC6YOnOVHcLocSzUQSu068sfPY6H1QU2wFi+F4ytEfEGVRA9CXIgzMBERkd2VrdzMv6bFxSimfzqLCpVLsdnn6dISSrA0uXN02s7VoAanzrim2+MiYtyVQ0/5P0IQYZNjT5zKcHqgjUOcqd1+oWCmdUT5TXWQKpKYoD4h6FAsOSf6DE1RSlbMvZ90n+LuurQnuP8gzITCA99FrDerw6g1b5h0oOHqS5hk23eIZeujQZnpWQheV9YkPlpggpSBIgmmn7A8gr0WE51s5lgvUSEhUX+PFZudeHXJYQRh5kq9rg0Icsc97FrREbsGLFKspQUysrlxCRJbq6CYwiszZqVpD3Yp2gJrHBsUhLeBydnyBF0RAaVYXgXGgr8ZoXVX2Mm/bA7hVzuXlI/01S6cfF4QSfHk+eCymhbvYbowE5EBgp7uIPaQt0bHNOcnOABe5u8OWcOvnEgA5wE3ZLlmJDEHn2a09UDUaqJs1ZGcIxosAUQqJb1oRZY8iOxKF4x/Z/ogUrac/vAzkeX+P+NE0sISacNxhdDfjUBLUDXIPFYBJGKe2oK14DrdTDcHsUhFgHGq0iFpRtjdjcs3qJI5dOsIi8NlnuhdSQ4xgg94M74AL+etUwYNqG52V8Mm+AZjjbT4+uCjs21DiB5rFZDTrkraWUBORE3+WLsLyDGvpsWPxDSGAICzfNnxDjrlYAO2Fxc15sPiOJwlmBakciEiF83QQG2fu6y86+dzpJTpzes5jADHTdHpJpbYG5Glo1bLoBMwyjT8fnAr9pOONUnjOkpBq0HSWR8k70THFV9p3igHaUSirFsSfF+8men1d6xhu5z8zTkQbMUl/SfjxpHKlIHu35iPD8n2UGk+6uGQDXPsWeGf0pYLaw7TBvd2SPef/Yso2SCXbZ6XT1UVLNrp/CciNa/RN8RgSe/DtbQFsQP5bUrd5npjERd3xMk7/0uYT7OBIqDv3LGlaqyVzyv6Jp+IgUzntwjl/9C5Cw5iQYwV/qXiwYksFkKMSWzsJbCyEd+tWrDNHDDHvo0MxlKKoDoh48a/8ulUOVZ2/ddms+Dgte5JCVcPbl+u2mspngm4YCaL0UEDYj9VjL7MkynlGANfx/e/oTplTZUxRcV50Cky2WGO9uvugWZYoeKsSuyG29RRRMJPud+27JU53aPGrwXHc/BvENXA/0At8wSjtqKTyM1LPHCI/5PJ26yaeSEo1Z219UcN1jrix4mICK3K5y/lym57kWPJgtag5Dhc/dePkHEzj2jjYxyNowp7pdxJa4q4bEpssJdzIjjLzyMYb+qzYFLU6cQ6A4msm2uBPvKojc3d1WHVwqvaqMbjxb7QPRWS1wIR1BSiK9HK6tgfywhZ8mOHIg1P7eFk4zoCmiYq6iSRTbyMDWMxaCvHR/L4RmG10BeXl1vb8faZi8sBmWE41bC5Gpz8eGluTYTxTa8rJpe+DIKogyOCe8Tfa+9GypIPkAhG57sNHJVkdp3dp5C4kd96IU8+f8SkOsZXlDZwBJN9rmLFHxS3ceFinNEpg6H41x6EW2GiouAduYZnshj61tQrAQtkX9xyQJU3orDw/f2Nq1fPIRfEtOLEz77K/gfQoyuaEXq6v1sFbplsYqbsZFtI2E0IS64C6pkgrfYTORFHh6hE1mBbaYmwphgYlUdQEmrBO/Z9bf8PPtoVpYlisPbscR7SuTYXEELpSimBKi6plgkZI7hcgcJjbxpZI+y7C6pdXunjPoMJhGkMHQvr7tta5SWBqYIzzI7kZeMBfBBPiuYKy5Ov2t9MWfV0DbXadzEqM+bvBhQAF62Xtk5CHj7kQF8/2npCGSXzJ6oq2Fo+vmKuaxTx5JvQ7DrUqHFAcLgWYCmHHX/TJPflzq8HYeZgkzOHR7/u4Cn5uzkGVqgsFcO31y+OsPKBLsySOsT2yx0+qV/dhYdHAeJQ5yutNsdmbo4Xn9D3AJFUUAa2/JUCJdXlkH48bNsRvgVgiv+zsaSLs/lTxrMHHJy+UZECTU5ZIfzt5GnvgGvM6SE7fhLEADtrMhwBW2JCwZSYhF6+BH97pYFb4MwcxqXRS4KGVzay0osnvbP+DE7FKviaByvIxa8mIYfrNCn/r/pa5ysjOBjstkqNtpaEP5KhmwUSjmFxnKB0lsXCSWOZL8KjGeycRyK7IopwBxfw6FA/Conx3ehKFr+wOsmJ2XbPTYOcg==,iv:KlRODFs7u3WGzHKQJpMkjiNf+rqBBW1oMx02APGcuyg=,tag:472ZgRVE6dkHBnvEcMOWHQ==,type:str]
 sops:
     age:
-        - recipient: age1nlta6ek2fsre42g38ytwg3fxtra4h444psd7g986md0gzmvv6d5qqlwwjy
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2TVNCWjduWXVGU2EwWFlu
-            b2pKN29BbE1xcmNKc3R6WVJ3SG45OEM5T1FvCnZXQWJrdnNwZ1NyU0w4K1BDQXp3
-            bS80NllZODhBcDVnUXYwRUtJUWhTaE0KLS0tIElCaE16c0J6dW1WaTJrUzZpczFT
-            MFJINjBUMTBQVklkTG9KYVVvZXczZG8KH56Vo0jc8nLp+nAnVKSPfDSFb+Mw/L0k
-            O1/X5MeF4Z2O80noGH2LaP5WKvy+h/kMW9c0hjBnayJBunf3VbhH3A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2U0daVmk4YXoxMUtxNkhL
+            ODc5a2p4aGcwbjZha3BsM3MwZmdLZTFaZXdzCkM2cE90QlpJNmQrTzlFbnA2dzdw
+            MkJhM2JqNUlpcW5VTklMeFVDSGVwTTAKLS0tIDN3MFFBcGNlLzUxd01tK0V5YzVP
+            VzFxL1hkdklLWUV5TFFrekt6dXBHa28K00ChSpcAKizcqoORF4rYQUvmblgIQ2sB
+            NzkzR86t2mEKdI2NU4CmYayOZrNN9sjd+mMaJmFwaTAeERaw0UuM8w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-16T17:02:16Z"
-    mac: ENC[AES256_GCM,data:6QDpFeS+42KTeklQZ+lt7fpGTIQmVU/NjlmX6SUxQEgNkJ4c5lMEP49SIR7MxnYo3zm6X6v2OM8O5kj3fFiOA49GdK5Bnuy/+Y2146rb0fa5aNNhVJwLs/L9CFVXzCVlCLqjsEPQkzq0EluwMAvW7HzkhvHb/IpeJkEct8NgqRU=,iv:URy/A9NkO/xTWGbToIhN61gC1FaexNO5RMRE00Y1VGA=,tag:jr634ex3sxg8khfWWYVCxw==,type:str]
+          recipient: age1nlta6ek2fsre42g38ytwg3fxtra4h444psd7g986md0gzmvv6d5qqlwwjy
+    lastmodified: "2026-05-17T11:25:42Z"
+    mac: ENC[AES256_GCM,data:bqNgucTbqPlbDgkrPjagVlXpeTIOev43gKAhkborN7HGi72aAoXpUirGIBOsZTvCnu4IrhkH9Kj5GRppjMmcaJ+b5FzpzLXEjJjbQU7PeKeuPFOdy8GsY6RafKLFosUwyDw0ZGBOosNzcc3Srd6af67Dutd2Kr0ke8pEVX4tKV8=,iv:jBGiuotm4wHUA/cQxY9MEgzHVn2giwQvP0aWvSbJl3w=,tag:P/cAyeowoexR0r2Lepp6hA==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.13.0