ferrosonic

2026-07-05 20:00:36 -03:00 · 2026-07-05 20:00:36 -03:00 · 5f70e8be94
commit 5f70e8be94
parent 749bfdf50d
7 changed files with 293 additions and 84 deletions
--- a/firejail.nix
+++ b/firejail.nix
@ -0,0 +1,108 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  agentProfile = pkgs.writeText "agent.profile" ''
+    whitelist /nix/store
+    whitelist /nix/var
+    read-only /nix/store
+    whitelist ''${HOME}/.cache/nix
+    whitelist ''${HOME}/.local/state/nix
+    whitelist /etc/nix
+    whitelist /etc/nixos
+    whitelist /nix/var/nix/daemon-socket
+    whitelist ''${HOME}/dev
+    whitelist ''${HOME}/work
+    whitelist ''${HOME}/.config
+
+    blacklist ''${HOME}
+    blacklist /etc/nixos/secrets
+    blacklist /etc/shadow
+    blacklist /etc/sudoers
+    blacklist /etc/sudoers.d
+    blacklist /root
+
+    caps.drop all
+    nonewprivs
+    noroot
+    seccomp
+
+    no3d
+    nodvd
+    notv
+    nou2f
+    novideo
+
+
+    ignore net none
+
+    machine-id
+    disable-mnt
+    private-dev
+    private-tmp
+    private-cache
+  '';
+in
+{
+  programs.firejail = {
+    enable = true;
+    wrappedBinaries = {
+      claude = {
+        executable = "${pkgs.claude-code}/bin/claude";
+        profile = agentProfile;
+        extraArgs = [
+          "--private=~/.local/state/claude-home"
+        ];
+      };
+      opencode = {
+        executable = "${pkgs.opencode}/bin/opencode";
+        profile = agentProfile;
+        extraArgs = [
+          "--private=/home/user/.local/state/opencode-home"
+        ];
+      };
+      chromium-sandbox = {
+        executable = "${pkgs.chromium}/bin/chromium";
+        profile = "${pkgs.firejail}/etc/firejail/chromium-browser.profile";
+        extraArgs = [
+          "--netns=wg0ns"
+          "--whitelist=~/downloads"
+          "--env=TGK_THEME=Adwaita:dark"
+          "--dns=10.2.0.1"
+          "--private=/home/user/.local/state/chromium-home"
+        ];
+      };
+      google-chrome-stable = {
+        # executable = "${chrome-argumented}/bin/google-chrome-stable";
+        executable = "${pkgs.google-chrome}/bin/google-chrome-stable";
+        profile = "${pkgs.firejail}/etc/firejail/google-chrome-stable.profile";
+        extraArgs = [
+          "--env=GTK_THEME=Adwaita:dark"
+          "--netns=wg-br0ns"
+          "--dns=10.2.0.1"
+          "--whitelist=/home/user/downloads"
+          "--whitelist=/home/user/pictures"
+        ];
+      };
+      tor-browser = {
+        executable = "${pkgs.tor-browser}/bin/tor-browser";
+        profile = "${pkgs.firejail}/etc/firejail/tor-browser-en-us.profile";
+        extraArgs = [
+          "--netns=wg0ns"
+          "--dns=1.1.1.1"
+        ];
+      };
+      freetube = {
+        executable = "${pkgs.freetube}/bin/freetube";
+        profile = "${pkgs.firejail}/etc/firejail/freetube.profile";
+        extraArgs = [
+          "--netns=wg0ns"
+          "--dns=1.1.1.1"
+        ];
+      };
+    };
+  };
+}
--- a/flake.lock
+++ b/flake.lock
@ -40,6 +40,71 @@
        "type": "github"
      }
    },
+    "fenix": {
+      "inputs": {
+        "nixpkgs": [
+          "ferrosonic",
+          "nixpkgs"
+        ],
+        "rust-analyzer-src": "rust-analyzer-src"
+      },
+      "locked": {
+        "lastModified": 1782550137,
+        "narHash": "sha256-XvgBjuAmdT7fvltu56lvZULtDHCr0BLVdEAdfQQlYqw=",
+        "owner": "nix-community",
+        "repo": "fenix",
+        "rev": "4febf815bd2c2f1181e027c5b07fb66d85317cc6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "fenix",
+        "type": "github"
+      }
+    },
+    "fenix_2": {
+      "inputs": {
+        "nixpkgs": [
+          "ferrosonic",
+          "naersk",
+          "nixpkgs"
+        ],
+        "rust-analyzer-src": "rust-analyzer-src_2"
+      },
+      "locked": {
+        "lastModified": 1752475459,
+        "narHash": "sha256-z6QEu4ZFuHiqdOPbYss4/Q8B0BFhacR8ts6jO/F/aOU=",
+        "owner": "nix-community",
+        "repo": "fenix",
+        "rev": "bf0d6f70f4c9a9cf8845f992105652173f4b617f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "fenix",
+        "type": "github"
+      }
+    },
+    "ferrosonic": {
+      "inputs": {
+        "fenix": "fenix",
+        "naersk": "naersk",
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1782822043,
+        "narHash": "sha256-UsStOiULt4i7hO2dasJI4MqwK0i8JzsJKgzqQHEW6mA=",
+        "owner": "jaidaken",
+        "repo": "ferrosonic",
+        "rev": "ac0a146b515979238b9577a4b13f30479b02b07c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "jaidaken",
+        "repo": "ferrosonic",
+        "type": "github"
+      }
+    },
    "flake-compat": {
      "flake": false,
      "locked": {
@ -139,7 +204,7 @@
    "impermanence": {
      "inputs": {
        "home-manager": "home-manager_2",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs_3"
      },
      "locked": {
        "lastModified": 1769548169,
@ -155,6 +220,28 @@
        "type": "github"
      }
    },
+    "naersk": {
+      "inputs": {
+        "fenix": "fenix_2",
+        "nixpkgs": [
+          "ferrosonic",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1782220280,
+        "narHash": "sha256-thLTFbp9D5Qknmh8q/v4FRpLGphUSijT3E86cbLYTXo=",
+        "owner": "nix-community",
+        "repo": "naersk",
+        "rev": "9aa07bb0256d300219b30622d2454e85f7f3667e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "naersk",
+        "type": "github"
+      }
+    },
    "niri-branch": {
      "inputs": {
        "nixpkgs": [
@ -217,6 +304,22 @@
      }
    },
    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1782467914,
+        "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
      "locked": {
        "lastModified": 1768564909,
        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
@ -232,7 +335,7 @@
        "type": "github"
      }
    },
-    "nixpkgs_3": {
+    "nixpkgs_4": {
      "locked": {
        "lastModified": 1744536153,
        "narHash": "sha256-awS2zRgF4uTwrOKwwiJcByDzDOdo3Q1rPZbiHQg/N38=",
@ -248,7 +351,7 @@
        "type": "github"
      }
    },
-    "nixpkgs_4": {
+    "nixpkgs_5": {
      "locked": {
        "lastModified": 1781960011,
        "narHash": "sha256-66fKJZTRbxFJ48dE3kDdCaHTbux6nmApvIQhtwcaI0E=",
@ -263,7 +366,7 @@
        "type": "github"
      }
    },
-    "nixpkgs_5": {
+    "nixpkgs_6": {
      "locked": {
        "lastModified": 1781577229,
        "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
@ -282,7 +385,7 @@
    "nur": {
      "inputs": {
        "flake-parts": "flake-parts",
-        "nixpkgs": "nixpkgs_5"
+        "nixpkgs": "nixpkgs_6"
      },
      "locked": {
        "lastModified": 1781959811,
@ -302,15 +405,50 @@
      "inputs": {
        "disko": "disko",
        "dms": "dms",
+        "ferrosonic": "ferrosonic",
        "home-manager": "home-manager",
        "impermanence": "impermanence",
        "niri-branch": "niri-branch",
        "niri-scratchpad": "niri-scratchpad",
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": "nixpkgs_5",
        "nur": "nur",
        "sops-nix": "sops-nix"
      }
    },
+    "rust-analyzer-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1782469328,
+        "narHash": "sha256-EVrPvYr7VtAtiUWdKglwTSVT+KgQNcZ8EEWL/CnBC0o=",
+        "owner": "rust-lang",
+        "repo": "rust-analyzer",
+        "rev": "a77548188dbecc332bdc292b01a5077ec770cd98",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rust-lang",
+        "ref": "nightly",
+        "repo": "rust-analyzer",
+        "type": "github"
+      }
+    },
+    "rust-analyzer-src_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1752428706,
+        "narHash": "sha256-EJcdxw3aXfP8Ex1Nm3s0awyH9egQvB2Gu+QEnJn2Sfg=",
+        "owner": "rust-lang",
+        "repo": "rust-analyzer",
+        "rev": "591e3b7624be97e4443ea7b5542c191311aa141d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rust-lang",
+        "ref": "nightly",
+        "repo": "rust-analyzer",
+        "type": "github"
+      }
+    },
    "rust-overlay": {
      "inputs": {
        "nixpkgs": [
@ -334,7 +472,7 @@
    },
    "rust-overlay_2": {
      "inputs": {
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": "nixpkgs_4"
      },
      "locked": {
        "lastModified": 1772075164,
--- a/flake.nix
+++ b/flake.nix
@ -31,6 +31,7 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };
    dms.url = "github:AvengeMedia/DankMaterialShell";
+    ferrosonic.url = "github:jaidaken/ferrosonic";
  };

  outputs =
@ -73,6 +74,7 @@
          ./packages.nix
          ./kernel
          ./home
+          ./firejail.nix
          inputs.sops-nix.nixosModules.sops
          # inputs.microvm.nixosModules.host
          # (import ./vms)
@ -105,6 +107,7 @@
                    });
                  }
                );
+                ferrosonic = inputs.ferrosonic.packages.${prev.stdenv.hostPlatform.system}.default;
              })
              inputs.nur.overlays.default
              (_: prev: {
--- a/home/user.nix
+++ b/home/user.nix
@ -27,9 +27,12 @@

      sops.defaultSopsFile = ../secrets/home.yaml;
      sops.age.keyFile = "/.persist/${HOME}/.config/sops/age/keys.txt";
-      sops.secrets."user/ssh/desktop" = {
-        path = "${HOME}/.ssh/desktop";
-        mode = "0600";
+      sops.secrets = {
+        "user/ssh/desktop" = {
+          path = "${HOME}/.ssh/desktop";
+          mode = "0600";
+        };
+        "navidrome/user" = { };
      };
      home.file."/.ssh/desktop.pub".text =
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh";
@ -100,6 +103,24 @@
        };
      };

+      xdg.configFile."ferrosonic/config.toml".text = ''
+        BaseURL = "https://navidrome.icefox.sh"
+        Username = "user"
+        PasswordFile = "${config.sops.secrets."navidrome/user".path}"
+        Theme = "Catppuccin"
+        Cava = true
+        CavaSize = 40
+        Daemon = false
+        AutoContinue = false
+        RepeatMode = "Off"
+        CoverArt = true
+        CoverArtSize = 16
+        Scrobble = true
+        Notifications = true
+        RateSwitchDelayMs = 500
+        MusicFolderId = 1
+      '';
+
      xdg.desktopEntries = {
        google-chrome = {
          name = "Google Chrome";
--- a/kernel/default.nix
+++ b/kernel/default.nix
@ -15,7 +15,6 @@ let
        "$@"
  '';
  nsWrapper = pkgs.writeShellScriptBin "ns" ''
-
    exec /run/wrappers/bin/doas ${nsExec}/bin/ns-raw "$@"
  '';
 in
@ -24,17 +23,16 @@ in
    ./hardened.nix
    ./vfio.nix
    ./standard.nix
-    # ./apparmor.nix
  ];

  custom.kernel.hardened.enable = true;
  custom.kernel.vfio.enable = false;
  custom.kernel.standard.enable = true;
-  # security.apparmor.enable = false;
+  security.apparmor.enable = false;

  specialisation.unhardened.configuration = {
    custom.kernel.hardened.enable = lib.mkForce false;
-    # security.apparmor.enable = lib.mkForce false;
+    security.apparmor.enable = lib.mkForce false;
  };

  specialisation.vfio.configuration = {
@ -68,23 +66,6 @@ in
        noPass = true;
        keepEnv = false;
      }
-      {
-        users = [ "user" ];
-        runAs = "agent";
-        noPass = true;
-        keepEnv = true;
-      }
-      {
-        users = [
-          "user"
-          "agent"
-          "work"
-        ];
-        runAs = "root";
-        noPass = true;
-        keepEnv = true;
-        cmd = "${nsExec}/bin/ns-raw";
-      }
    ];
  };

--- a/packages.nix
+++ b/packages.nix
@ -14,7 +14,7 @@
    bluetuith
    bluez
    bluez-tools
-    cargo
+    cava
    clang
    clang-tools
    clevis
@ -27,6 +27,7 @@
    (import ./templates/extract.sh.nix { inherit pkgs; })
    eza
    fd
+    ferrosonic
    ffmpeg
    file
    fira-code-symbols
@ -185,51 +186,6 @@
    localNetworkGameTransfers.openFirewall = true;
  };

-  programs.firejail = {
-    enable = true;
-    wrappedBinaries = {
-      chromium-sandbox = {
-        executable = "${pkgs.chromium}/bin/chromium";
-        profile = "${pkgs.firejail}/etc/firejail/chromium-browser.profile";
-        extraArgs = [
-          "--netns=wg0ns"
-          "--whitelist=/home/user/downloads"
-          "--env=TGK_THEME=Adwaita:dark"
-          "--dns=10.2.0.1"
-          "--private=/data/sandbox/chromium"
-        ];
-      };
-      google-chrome-stable = {
-        # executable = "${chrome-argumented}/bin/google-chrome-stable";
-        executable = "${pkgs.google-chrome}/bin/google-chrome-stable";
-        profile = "${pkgs.firejail}/etc/firejail/google-chrome-stable.profile";
-        extraArgs = [
-          "--env=GTK_THEME=Adwaita:dark"
-          "--netns=wg-br0ns"
-          "--dns=10.2.0.1"
-          "--whitelist=/home/user/downloads"
-          "--whitelist=/home/user/pictures"
-        ];
-      };
-      tor-browser = {
-        executable = "${pkgs.tor-browser}/bin/tor-browser";
-        profile = "${pkgs.firejail}/etc/firejail/tor-browser-en-us.profile";
-        extraArgs = [
-          "--netns=wg0ns"
-          "--dns=1.1.1.1"
-        ];
-      };
-      freetube = {
-        executable = "${pkgs.freetube}/bin/freetube";
-        profile = "${pkgs.firejail}/etc/firejail/freetube.profile";
-        extraArgs = [
-          "--netns=wg0ns"
-          "--dns=1.1.1.1"
-        ];
-      };
-    };
-  };
-
  services.ollama = {
    enable = true;
    package = pkgs.ollama-cuda;
--- a/secrets/home.yaml
+++ b/secrets/home.yaml
@ -1,4 +1,6 @@
 deepseek_api_key: ENC[AES256_GCM,data:HJXkEErncaOb2up0B45qisM+rIHoNmX9n6RZrdGN2JZlur8=,iv:4Dx5AjtDhWfYKlRiUrADT7HdHy/F2sfkzuPKuLhBRt4=,tag:AC3Zm+NHnnIQDCnlmBDUcQ==,type:str]
+navidrome:
+    user: ENC[AES256_GCM,data:TkPLvX3AxC7Lbnh6s2j1q3XrQE1u16ykah9rSjlYPnuH,iv:dtjM4O4A4ABVyHQHPAUH5dVopgwLlKSUcbqFpCWV2eA=,tag:W2PVbIaLGbX4SR2ZNOGmsQ==,type:str]
 root:
    password: ENC[AES256_GCM,data:qA7sbNvWvfmWiLX4pIYOzDmuCwc3+7I1KvTHHYF5jDHR0CNRuya0XglP8TNK5qGLEJkdmD9WphdWvYY60NTOf5NFhDnqtm3ZIw==,iv:B42jl40hQbRqMRfV39fNne0E3KKCwriAQ5MQ0DF4QQA=,tag:hH/u0Qw6A2is4XOOQpnr2Q==,type:str]
    ssh:
@ -13,8 +15,7 @@ user:
        legacy_rsa: ENC[AES256_GCM,data:PWBAlpIUbxVGDZlxJGvYRiUgeGnR7Bl1hXjzVC6MIt4hLPmc5SksBj5TmW+i6j312RLaFzYTb6SerFlFs6vn3Rtmk5Q7p/IO4JSKondJrsw1xw52YePP29FfIe7gtOxDK/F9YJhHb1VJQghQoWTN++iZjjg80iNVofBtAcrPPkyfH43Yw8In6jMla/p2w6vAhXAJS+8SpEdmdILOQT4OnDvkzi4Nwae2uFEWcGJI/kxstgAL97MTmu06qK9/zt8vuq6bTYeBOOFnasoIL+V/0A5dAz3aw8QwdSoRrN5+PEHmeB9y4+WCf10MTv8P2JxJ9ul4pCwZd2IEdg2gWSQa/vbSJdG7ZjaCih+blNEf8DTVtRQT9soTvti7MYYYziLfHw8LUT+c3nt+c0nXxVxOgRx0sGSuHsHT5HHGBOjw9PsZ+arZuwnIyrmfkm8TkvD+j7je2fqLACRBkp3CXg8a647To4GQXK0Y0yuJUpt18YSbVak9etGj5z7+PWs86NKHQ+gOrMxeirRuHGIa53FQSORYlpBZnM9FCAs4g5Fs4IZard/0LkX1lrhVUOk7OokRstiIWKJMOqRFuN+toZbCWMNVX4Hd8otSFG3U/vo3vK08TEF+HDIhp4rStPjJpOdyZStKyol6sKlHcVdMcgk79fmzesMZoSpITP/GTYe46xZ6vMQ2tvqvd0QcVJfBZuy4q2UUgjY+r8zgVRKw+Wo37YUUr4UFK2W5E23cLFkr+H9nV/cz08V1vUXk2eCi62czFXpjkpubQXysK246wHtdVFGpOmtDxicS4Zn3iqm/UxF5vKKguRaTdejXxfkRbsFhwn6/GrRAW6nxJLLVnSIzJEnNivt88m9cxmb1VYAHRZDNlGDK7ca8IhCb5yzPalRI0KqUMKen3MDLae+eEjcZH/lgGdhsZJg6Kxg/v0XC4dCJxNW+/ckIs5bjYMoQRfJ6OknAVFLwZcY0QZ+5EWrWNDkBEfPKub/r+KcF2sxIrv7KB0qXDsW4pCEcE+85i8xEiFs49ebeV4d42tsLzdYi9iVdZO4I1gzi929rbUFJLzVJCfkyn7Eic1u92UgBAa58lUFZ5LMEH9+P1V4Gm0GPIwXYvd4X+LIGhbqGDjGel+YeeLUHVRj4qeuoz1aLUCF8Cv0e3djBuhJ+tRSKdZM2aSz6PNrK2THfdFSiaHZmfH7McVXNum8TD8lhbkKIPDYdb2La3MVgvvgRN8Gw8L/Xkp/ivuFWXJ8Gc41AIUI2gY2mWbq1YAiwEuMeDJCXXAROKLQrd2rJYI7epbcw2EyLgtc90zsjWa1gFrHfBJVh23B69vWc5uEVyt/ryg3n4tp9QLjNpg0DRMjPTR+vEbsEHl7oLJdPO3XKof0h6QXXJ1ZtgHkSFS9MoXCnNhiC9ZKWA6PM31Yftp82RKiy5CSpf2AIVIOa3p9GUhVI0YlEN5tfejZuhybUL44JZ2FcVlhbC+zzLPIhROguHF0Az4Qg7tzKM9poin4xVV3HXs/mvXAcA8qnlQxnpuei3Lob4Iq1MUb9oNoA0QJ7nKIybSYUhKnGOq0Cv4ZVmxlk+RkXfTS4si3qEg3UxXjonP/e2oU334CsdSS32taP0KNTQzEP6j3AM4Zv/iEobz6XvRsKXHzbrG4UQefuQ+ZDw1DGlr/BKDLq9T+adGCWaCTKJChOIwoEQvij6rxtnGOJu9XC+/Tk8FVuzI/gPnRBOia0uUwaYskgoXmNjMgT+P8yNkdqx7MFJVdrFADyGhSaefVNszQlxfJlpAZtKazEltxmUdW6/pPoG42dfIcX+HxhbX1GqQa3japO7NrPQwLIw4LusBXd/ShLMyxkkYCcAidSgaSWgTWCzEIO5RbxRoxFA4qnEd6fqH61Y6W5Wg0Yk4DwWW/KcKn8xkgPdNk4hPq7IPL/x6Z1Dwb9zYf3T0G+97iezI9ZCNImd82aDOT5UcMZGYDD9yW9sEfohniaJcbu5DocNLTJDBa3UgiWluY7u+q4I/zPKN+9chA7h8p5BYAZJc03d1UBvHL8Mv2D7JIb/GlLhseRoV3A+b2qm6uwcxHA6zksAAx1XOZYlU88ls9ykeKKIB+AmlZEx4EuZG+E98DFp5dndMCYzL/1uy+LEsmTNrdmG+gl7bQlbYq5hOHaqtOAEsft/0VFzteRjg5Lagh0cqB1Rc92EGzQq84G5QYQb/DDZLC4i17SZEvwJoo3Ai476B6JpKefcQ5pPNf219mD/V/rodHMxm5vMC3hBQLpaSQ7ZtZ2jmwsxsWkrVaMU+NGBShqVLV+wsPlIWrSybnZC7hOLawZLev1CJ9Udiy82U1SyL9vB4dfHnhEra85nzdNvKwKzAwnr5mG2w1leJOzdg5kz8I0D98GFxmgrnOeQZ6S7/pjD7Qcw38exvEtCI8fpreAb7djbZN2sUNaSe8oitgukqNajBHlFA2z75P4dZ+IH+tTH25Inem/COojWnVQHsic03eus8x4jinbU6fxgZ6sT0SlyItTFgAAv3XqT3oHBiXIvF8DCcw7EtOeW1aZx6wR6D8JFLXTkMiXeug2wvQxV7MMXt7DBNUPqWLYnsrzAY+UaGkQtlnGiffDjCwbWkDfRpHMutMoYMk9o4yD26XTv3oV79Rod4+R39A8WEQhiHKPKFBS7TW+NttKMQVGgcmWvfRFeem4Iqy6JG22xxQqM9GK8gsUKa8MmEuLAQCGenXHIj+dOVWJugjG4IOdaQR3nB4LgwWIXHciYD9KmjlDsvd0MjQTc1bUBkS3aqOF6uvnWJ5LlWv5gs+OsFRMTe8wyqwCOLkj1EmmfJW3leEl/ONMkuaKCJTl7Yw1gto9itnC7rXFSIuGtLfW+4BSJQDYNRBskBkf81t1b6qejkS/3FFKEl8CzLdnuZU5WM5EOkR8ReAYTF/c4LYQjKDYbTAkXsuf9I8QbJXNwwJrP0C7zR4MgZQ5csKyxMNhxy5prTol5TIfCtwjy9UWOurI8WRwfqf6dyq31HtIDxD+elAJOlnZ+yHYH0Al/AETNhzWej35XJTMpYAK5wyBInM3enzBDqzEXQh4OLBwFMP0RaaZYnGTjbjyTUjmOj6GnMSbjwKECCEJFXfmpGsaxIG5RXIU71eu1x7k/Ifm3HgvQ9Q5Jw+EF6vYo1WNjOf9UbQhEhI1+uKEYEkwD/qFu07l9/WqLp3/nDNS66lnyag8jGKeO9WDb07WBBpxywtlN0vE8q9VmY7wXDdkaf5Gb13VwpaAyStANeP2Mp7XlmvYIFudzAY6kxkxCBA5rCY5guI0ebREHnJgR9ARzK3MD85X5abk8sY7Urx01tVdmx7eqVVrjBsEq65SUg8Z0jA7uVHTpOkVxboxJEWsdQN3JYYXz7Tg7M0t1PEYlxhUFIlIyvD8hrmUfxyZB0YgVI3faTezb+1I6xqAyxGFEVKPBzjyv36V9eMJmGB1wiZv3mNFqMUI9AMUHJAmIg==,iv:oGGm7bveDXNmxqe5Zina03vSVLJx9P3VBC/DbuI6KzY=,tag:taEL0E4Uinv1MQPxeRbPzA==,type:str]
 sops:
    age:
-        - recipient: age1y0tj3kt67pfnj38t9c8g2ghry3a0mhcq8rrqv5xr4jekwepxaelqzu3dkf
-          enc: |
+        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOZ3dERmxMbEJmSVhVRmVw
            TUZZL0FzTHprci9ENHFodnRVWmRSbk1ab2xnCnZYeXN3MWRJZENlYmtWeFM0azdR
@ -22,8 +23,8 @@ sops:
            bFhna3RyY1kxK0IyVWlnR2FpMXk3UjQKvJaecXqAecBljJ9cNcHX13nxSxVey3LG
            NdvJaMfEV4m3SqRF7YUoTzGYhucYjtX58E5SuvHnaP2qa21aDF+AZQ==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age16v8w7q4wmn22hhakq2uzaus2508rhldm7lcwh0kukshzjzyhuqesqz44ze
-          enc: |
+          recipient: age1y0tj3kt67pfnj38t9c8g2ghry3a0mhcq8rrqv5xr4jekwepxaelqzu3dkf
+        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZnV1T0JKTXoyeUlZQ3o4
            QkR4OHZUbzQrbjdSK2VLTDNzMU9qdlUvVVUwClI4SDhMZTRDRXY3NlJSZ3REdmpJ
@ -31,7 +32,8 @@ sops:
            NVlzQlQvMVc2dHZNK2pEWk80MStwY1UK38mxk1dJWi6XRKSwzcDA9qt8i1Grw2KJ
            ac2EbJIFwYLOaMNOKF9hu+NrMdruRpU/2B8HlYYZjpNWmLb9jwI4wQ==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-04T12:41:30Z"
-    mac: ENC[AES256_GCM,data:OxKBSbx/NrkprIHTdI+iM2yMh1lhTMYuS7UO09NzxXHkyEoXtacDm7XtWIrELIxDIpqQGkousKcNRDmfiejzkpD6aLpdR1S0exXe1A+heWUMB9D+I+an51Nuv/LBGKeelK71RAq2H0VQZQgZd6OuzDECsK07lxnxUAWo8rxhScs=,iv:0cREbkAyUz1a6ze74MKmfeX8RJjMIrwgRoTPeGADEiE=,tag:DJaNf7gckCDoYLzzw+SRUg==,type:str]
+          recipient: age16v8w7q4wmn22hhakq2uzaus2508rhldm7lcwh0kukshzjzyhuqesqz44ze
+    lastmodified: "2026-07-05T22:42:52Z"
+    mac: ENC[AES256_GCM,data:La8bfH1u7pmukx9OZTUS9gdZODiYcY07dMU08kEkEeojHGoh/VAUrBK3Sj5W33WnbqpXnuiRKgF34mqVav5T9TE0ds31PMc/VceWkd5pJ2crCjbmlR6Zm/XCHgilIO4IoGlCO5Zz+LXpsPbD3vv1AwmzYBRwgik69vyWiXwT0UA=,iv:vSzK3eE+Jpy//dzdOT+PHmdOOKmNlbiFDeDdtZ9Lz9o=,tag:Fo6IUvyyMxWy1gsa7faV7w==,type:str]
    unencrypted_suffix: _unencrypted
-    version: 3.12.2
+    version: 3.13.1