linux-postmarketos-exynos5: build with LIMA/MALI enabled as well (experimental)

it doesn't boot, not sure why

.sops.yaml

@@ -3,6 +3,7 @@ keys:
   - &user_lappy_colin age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g
   - &user_servo_colin age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu
   - &user_moby_colin age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9
+  - &host_crappy age1hl50ufuxnqy0jnk8fqeu4tclh4vte2xn2d59pxff0gun20vsmv5sp78chj
   - &host_desko age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v
   - &host_lappy age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn
   - &host_servo age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf
@@ -15,6 +16,7 @@ creation_rules:
       - *user_lappy_colin
       - *user_servo_colin
       - *user_moby_colin
+      - *host_crappy
       - *host_desko
       - *host_lappy
       - *host_servo

TODO.md

@@ -84,6 +84,8 @@
 
 #### sudo-free world
 - `systemctl restart FOO`: needs `sudo`
+- `systemctl daemon-reload`: needs sudo
+- `watch ifconfig`: needs `SANEBOX_DISABLE=1`
 
 ### user experience
 - rofi: sort items case-insensitively

doc/adding-a-host.md

@@ -0,0 +1,25 @@
+to add a host:
+- create the new nix targets
+  - hosts/by-name/HOST
+  - let the toplevel (flake.nix) know about HOST
+- build and flash an image
+- optionally expand the rootfs
+  - `cfdisk /dev/sda2` -> resize partition
+  - `mount /dev/sda2 boot`
+  - `btrfs filesystem resize max root`
+- setup required persistent directories
+  - `mkdir -p root/persist/private`
+  - `gocryptfs -init root/persist/private`
+  - then boot the device, and for every dangling symlink in ~/.local/share, ~/.cache, do `mkdir -p` on it
+- setup host ssh
+  - `mkdir -p root/persist/plaintext/etc/ssh/host_keys`
+  - boot the machine and let it create its own ssh keys
+  - add the pubkey to `hosts/common/hosts.nix`
+- setup user ssh
+  - `ssh-keygen`. don't enter any password; it's stored in a password-encrypted fs.
+  - add the pubkey to `hosts/common/hosts.nix`
+- allow the new host to view secrets
+  - instructions in hosts/common/secrets.nix
+  - run `ssh-to-age` on user/host pubkeys
+  - add age key to .sops.yaml
+  - update encrypted secrets: `sops updatekeys path/to/secret.yaml`

doc/recovery.md

@@ -0,0 +1,12 @@
+## deploying to SD card
+- build a toplevel config: `nix build '.#hostSystems.moby'`
+- mount a system:
+  - `mkdir -p root/{nix,boot}`
+  - `mount /dev/sdX1 root/boot`
+  - `mount /dev/sdX2 root/nix`
+- copy the config:
+  - `sudo nix copy --no-check-sigs --to root/ $(readlink result)`
+    - nix will copy stuff to `root/nix/store`
+- install the boot files:
+  - `sudo /nix/store/sbwpwngjlgw4f736ay9hgi69pj3fdwk5-extlinux-conf-builder.sh -d ./root/boot -t 5 -c $(readlink ./result)`
+    - extlinux-conf-builder can be found in `/run/current-system/bin/switch-to-configuration`

flake.lock

@@ -1,329 +1,6 @@
 {
   "nodes": {
-    "flake-compat": {
-      "locked": {
-        "lastModified": 1688025799,
-        "narHash": "sha256-ktpB4dRtnksm9F5WawoIkEneh1nrEvuxb5lJFt1iOyw=",
-        "owner": "nix-community",
-        "repo": "flake-compat",
-        "rev": "8bf105319d44f6b9f0d764efa4fdef9f1cc9ba1c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-parts": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "nixpkgs-wayland",
-          "nix-eval-jobs",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1712014858,
-        "narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "9126214d0a59633752a136528f5f3b9aa8565b7d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "lib-aggregate": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs-lib": "nixpkgs-lib"
-      },
-      "locked": {
-        "lastModified": 1716725378,
-        "narHash": "sha256-bNTVDAVBLFSSTU+q54cJnntmFKBi+F/D8sSqlZwBGiM=",
-        "owner": "nix-community",
-        "repo": "lib-aggregate",
-        "rev": "dbc9130fe1455e0f6ee4d8f5f799f9be551f866b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "lib-aggregate",
-        "type": "github"
-      }
-    },
-    "mobile-nixos": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1694749521,
-        "narHash": "sha256-MiVokKlpcJmfoGuWAMeW1En7gZ5hk0rCQArYm6P9XCc=",
-        "owner": "nixos",
-        "repo": "mobile-nixos",
-        "rev": "d25d3b87e7f300d8066e31d792337d9cd7ecd23b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "d25d3b87e7f300d8066e31d792337d9cd7ecd23b",
-        "repo": "mobile-nixos",
-        "type": "github"
-      }
-    },
-    "nix-eval-jobs": {
-      "inputs": {
-        "flake-parts": "flake-parts",
-        "nix-github-actions": "nix-github-actions",
-        "nixpkgs": "nixpkgs",
-        "treefmt-nix": "treefmt-nix"
-      },
-      "locked": {
-        "lastModified": 1715804156,
-        "narHash": "sha256-GtIHP86Cz1kD9xZO/cKbNQACHKdoT9WFbLJAq6W2EDY=",
-        "owner": "nix-community",
-        "repo": "nix-eval-jobs",
-        "rev": "bb95091f6c6f38f6cfc215a1797a2dd466312c8b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nix-eval-jobs",
-        "type": "github"
-      }
-    },
-    "nix-github-actions": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs-wayland",
-          "nix-eval-jobs",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1703863825,
-        "narHash": "sha256-rXwqjtwiGKJheXB43ybM8NwWB8rO2dSRrEqes0S7F5Y=",
-        "owner": "nix-community",
-        "repo": "nix-github-actions",
-        "rev": "5163432afc817cf8bd1f031418d1869e4c9d5547",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nix-github-actions",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1715037484,
-        "narHash": "sha256-OUt8xQFmBU96Hmm4T9tOWTu4oCswCzoVl+pxSq/kiFc=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "ad7efee13e0d216bf29992311536fce1d3eefbef",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-lib": {
-      "locked": {
-        "lastModified": 1716684580,
-        "narHash": "sha256-sIbMJWJr4hl2PWd9/iWlh89QfVzBn1NJ3u5RjeZADuM=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "d0d27192931680482081aa1c38389da2af84a651",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
-    "nixpkgs-next-unpatched": {
-      "locked": {
-        "lastModified": 1717243271,
-        "narHash": "sha256-M3VxP6DtREz5Lq6MKg1gQ2EeVdIbq6AEp/N1tDSrvoc=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "f7de25c01e4c073c06e0525226a0c2311d530cee",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "staging-next",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-stable": {
-      "locked": {
-        "lastModified": 1716655032,
-        "narHash": "sha256-kQ25DAiCGigsNR/Quxm3v+JGXAEXZ8I7RAF4U94bGzE=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "59a450646ec8ee0397f5fa54a08573e8240eb91f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "release-23.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-unpatched": {
-      "locked": {
-        "lastModified": 1717242134,
-        "narHash": "sha256-2X835ZESUaQ/KZEuG9HkoEB7h0USG5uvkSUmLzFkxAE=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "61c1d282153dbfcb5fe413c228d172d0fe7c2a7e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "master",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-wayland": {
-      "inputs": {
-        "flake-compat": "flake-compat",
-        "lib-aggregate": "lib-aggregate",
-        "nix-eval-jobs": "nix-eval-jobs",
-        "nixpkgs": [
-          "nixpkgs-unpatched"
-        ]
-      },
-      "locked": {
-        "lastModified": 1717175759,
-        "narHash": "sha256-KiM5ue/UNQt8ktoqCV4yFqhHxM31U94Mf/piKW9dZ4c=",
-        "owner": "nix-community",
-        "repo": "nixpkgs-wayland",
-        "rev": "93b225ddba91179248b378913a91defbc6aeb899",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs-wayland",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "mobile-nixos": "mobile-nixos",
-        "nixpkgs-next-unpatched": "nixpkgs-next-unpatched",
-        "nixpkgs-unpatched": "nixpkgs-unpatched",
-        "nixpkgs-wayland": "nixpkgs-wayland",
-        "sops-nix": "sops-nix",
-        "uninsane-dot-org": "uninsane-dot-org"
-      }
-    },
-    "sops-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs-unpatched"
-        ],
-        "nixpkgs-stable": "nixpkgs-stable"
-      },
-      "locked": {
-        "lastModified": 1716692524,
-        "narHash": "sha256-sALodaA7Zkp/JD6ehgwc0UCBrSBfB4cX66uFGTsqeFU=",
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "rev": "962797a8d7f15ed7033031731d0bb77244839960",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "type": "github"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "treefmt-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs-wayland",
-          "nix-eval-jobs",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1711963903,
-        "narHash": "sha256-N3QDhoaX+paWXHbEXZapqd1r95mdshxToGowtjtYkGI=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "49dc4a92b02b8e68798abd99184f228243b6e3ac",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
-    },
-    "uninsane-dot-org": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs-unpatched"
-        ]
-      },
-      "locked": {
-        "lastModified": 1715894399,
-        "narHash": "sha256-h1EdA/h74zgNPNEYbH+0mgOMlJgLVcxuZ8/ewsZlgEc=",
-        "ref": "refs/heads/master",
-        "rev": "e6f88f563bdd1700c04018951de4f69862646dd1",
-        "revCount": 240,
-        "type": "git",
-        "url": "https://git.uninsane.org/colin/uninsane"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.uninsane.org/colin/uninsane"
-      }
-    }
+    "root": {}
   },
   "root": "root",
   "version": 7

flake.nix

@@ -21,71 +21,8 @@
 #   - `nix flake lock --update-input nixpkgs`
 
 {
-  # XXX: use the `github:` scheme instead of the more readable git+https: because it's *way* more efficient
-  # preferably, i would rewrite the human-readable https URLs to nix-specific github: URLs with a helper,
-  # but `inputs` is required to be a strict attrset: not an expression.
-  inputs = {
-    # branch workflow:
-    # - daily:
-    #   - nixos-unstable cut from master after enough packages have been built in caches.
-    # - every 6 hours:
-    #   - master auto-merged into staging and staging-next
-    #   - staging-next auto-merged into staging.
-    # - manually, approximately once per month:
-    #   - staging-next is cut from staging.
-    #   - staging-next merged into master.
-    #
-    # which branch to source from?
-    # - nixos-unstable: for everyday development; it provides good caching
-    # - master: temporarily if i'm otherwise cherry-picking lots of already-applied patches
-    # - staging-next: if testing stuff that's been PR'd into staging, i.e. base library updates.
-    # - staging: maybe if no staging-next -> master PR has been cut yet?
-    #
-    # <https://github.com/nixos/nixpkgs/tree/nixos-unstable>
-    # nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=nixos-unstable";
-    nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=master";
-    # nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=nixos-staging";
-    # nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=nixos-staging-next";
-    nixpkgs-next-unpatched.url = "github:nixos/nixpkgs?ref=staging-next";
-
-    nixpkgs-wayland = {
-      url = "github:nix-community/nixpkgs-wayland";
-      inputs.nixpkgs.follows = "nixpkgs-unpatched";
-    };
-
-    mobile-nixos = {
-      # <https://github.com/nixos/mobile-nixos>
-      # only used for building disk images, not relevant after deployment
-      # TODO: replace with something else. commit `0f3ac0bef1aea70254a3bae35e3cc2561623f4c1`
-      # replaces the imageBuilder with a "new implementation from celun" and wildly breaks my use.
-      # pinning to d25d3b... is equivalent to holding at 2023-09-15
-      url = "github:nixos/mobile-nixos?ref=d25d3b87e7f300d8066e31d792337d9cd7ecd23b";
-      flake = false;
-    };
-    sops-nix = {
-      # <https://github.com/Mic92/sops-nix>
-      # used to distribute secrets to my hosts
-      url = "github:Mic92/sops-nix";
-      # inputs.nixpkgs.follows = "nixpkgs";
-      inputs.nixpkgs.follows = "nixpkgs-unpatched";
-    };
-    uninsane-dot-org = {
-      # provides the package to deploy <https://uninsane.org>, used only when building the servo host
-      url = "git+https://git.uninsane.org/colin/uninsane";
-      # inputs.nixpkgs.follows = "nixpkgs";
-      inputs.nixpkgs.follows = "nixpkgs-unpatched";
-    };
-  };
-
   outputs = {
     self,
-    nixpkgs-unpatched,
-    nixpkgs-next-unpatched ? nixpkgs-unpatched,
-    nixpkgs-wayland,
-    mobile-nixos,
-    sops-nix,
-    uninsane-dot-org,
-    ...
   }@inputs:
     let
       inherit (builtins) attrNames elem listToAttrs map mapAttrs;
@@ -97,28 +34,13 @@
       # mapAttrs but without the `name` argument
       mapAttrValues = f: mapAttrs (_: f);
 
-      # rather than apply our nixpkgs patches as a flake input, do that here instead.
-      # this (temporarily?) resolves the bad UX wherein a subflake residing in the same git
-      # repo as the main flake causes the main flake to have an unstable hash.
-      patchNixpkgs = variant: nixpkgs: (import ./nixpatches/flake.nix).outputs {
-        inherit variant nixpkgs;
-        self = patchNixpkgs variant nixpkgs;
-      };
+      nixpkgs' = import ./pkgs/additional/nixpkgs;
+      nixpkgsUnpatched = nixpkgs' { doPatch = false; localSystem = "x86_64-linux"; };
+      nixpkgsCompiledBy = { system, variant ? "master" }:
+        (nixpkgs' { inherit variant system; }).legacyPackages."${system}";
 
-      nixpkgs' = patchNixpkgs "master" nixpkgs-unpatched;
-      nixpkgsCompiledBy = system: nixpkgs'.legacyPackages."${system}";
-
-      evalHost = { name, local, target, variant ? null, nixpkgs ? nixpkgs' }: nixpkgs.lib.nixosSystem {
-        system = target;
-        modules = [
-          {
-            nixpkgs.buildPlatform.system = local;
-          }
-          (optionalAttrs (local != target) {
-            # XXX(2023/12/11): cache.nixos.org uses `system = ...` instead of `hostPlatform.system`, and that choice impacts the closure of every package.
-            # so avoid specifying hostPlatform.system on non-cross builds, so i can use upstream caches.
-            nixpkgs.hostPlatform.system = target;
-          })
+      evalHost = { name, local, target, variant ? null, nixpkgs ? nixpkgs' { localSystem = local; system = target;} }: nixpkgs.nixos (
+        [
           (optionalAttrs (variant == "light") {
             sane.maxBuildCost = 2;
           })
@@ -126,16 +48,15 @@
             sane.maxBuildCost = 0;
           })
           (import ./hosts/instantiate.nix { hostName = name; })
-          self.nixosModules.default
-          self.nixosModules.passthru
+          (import ./modules)
+          (nixpkgs.appendOverlays [ self.overlays.pkgs ]).sops-nix.nixosModules.sops
           {
             nixpkgs.overlays = [
-              self.overlays.passthru
               self.overlays.sane-all
             ];
           }
-        ];
-      };
+        ]
+      );
     in {
       nixosConfigurations = let
         hosts = {
@@ -144,18 +65,39 @@
           desko-light = { name = "desko";  local = "x86_64-linux"; target = "x86_64-linux";  variant = "light"; };
           lappy       = { name = "lappy";  local = "x86_64-linux"; target = "x86_64-linux";  };
           lappy-light = { name = "lappy";  local = "x86_64-linux"; target = "x86_64-linux";  variant = "light"; };
-          lappy-min =   { name = "lappy";  local = "x86_64-linux"; target = "x86_64-linux";  variant = "min"; };
+          lappy-min   = { name = "lappy";  local = "x86_64-linux"; target = "x86_64-linux";  variant = "min"; };
           moby        = { name = "moby";   local = "x86_64-linux"; target = "aarch64-linux"; };
           moby-light  = { name = "moby";   local = "x86_64-linux"; target = "aarch64-linux"; variant = "light"; };
-          moby-min  =   { name = "moby";   local = "x86_64-linux"; target = "aarch64-linux"; variant = "min"; };
+          moby-min    = { name = "moby";   local = "x86_64-linux"; target = "aarch64-linux"; variant = "min"; };
+          # crappy is technically armv7a, and armv7l uses only a _subset_ of the available ISA.
+          # but it's not as widely cached.
+          crappy      = { name = "crappy"; local = "x86_64-linux"; target = "armv7l-linux"; };
+          crappy-min  = { name = "crappy"; local = "x86_64-linux"; target = "armv7l-linux"; variant = "min"; };
+          crappy-7a   = { name = "crappy"; local = "x86_64-linux"; target = "armv7a-linux"; variant = "min"; };
           rescue      = { name = "rescue"; local = "x86_64-linux"; target = "x86_64-linux";  };
         };
         hostsNext = mapAttrs' (h: v: {
           name = "${h}-next";
-          value = v // { nixpkgs = patchNixpkgs "staging-next" nixpkgs-next-unpatched; };
+          value = v // {
+            nixpkgs = nixpkgs' {
+              localSystem = v.local;
+              system = v.target;
+              variant = "staging-next";
+            };
+          };
+        }) hosts;
+        hostsStaging = mapAttrs' (h: v: {
+          name = "${h}-staging";
+          value = v // {
+            nixpkgs = nixpkgs' {
+              localSystem = v.local;
+              system = v.target;
+              variant = "staging";
+            };
+          };
         }) hosts;
       in mapAttrValues evalHost (
-        hosts // hostsNext
+        hosts // hostsNext // hostsStaging
       );
 
       # unofficial output
@@ -180,54 +122,37 @@
       hostPkgs = mapAttrValues (host: host.config.system.build.pkgs) self.nixosConfigurations;
       hostPrograms = mapAttrValues (host: mapAttrValues (p: p.package) host.config.sane.programs) self.nixosConfigurations;
 
-      patched.nixpkgs = nixpkgs';
-
       overlays = {
         # N.B.: `nix flake check` requires every overlay to take `final: prev:` at defn site,
         #   hence the weird redundancy.
         default = final: prev: self.overlays.pkgs final prev;
         sane-all = final: prev: import ./overlays/all.nix final prev;
         pkgs = final: prev: import ./overlays/pkgs.nix final prev;
-        pins = final: prev: import ./overlays/pins.nix final prev;
         preferences = final: prev: import ./overlays/preferences.nix final prev;
-        passthru = final: prev:
-          let
-            mobile = (import "${mobile-nixos}/overlay/overlay.nix");
-            uninsane = uninsane-dot-org.overlays.default;
-            wayland = final: prev: {
-              # default is to dump the packages into `waylandPkgs` *and* the toplevel.
-              # but i just want the `waylandPkgs` set
-              inherit (nixpkgs-wayland.overlays.default final prev)
-                waylandPkgs
-                new-wayland-protocols  #< 2024/03/10: nixpkgs-wayland assumes this will be in the toplevel
-              ;
-            };
-          in
-            (mobile final prev)
-            // (uninsane final prev)
-            // (wayland final prev)
-          ;
-      };
-
-      nixosModules = rec {
-        default = sane;
-        sane = import ./modules;
-        passthru = { ... }: {
-          imports = [
-            sops-nix.nixosModules.sops
-          ];
-        };
       };
 
       # this includes both our native packages and all the nixpkgs packages.
       legacyPackages =
         let
-          allPkgsFor = sys: (nixpkgsCompiledBy sys).appendOverlays [
-            self.overlays.passthru self.overlays.pkgs
-          ];
+          allPkgsFor = variant: additionalOverlays: system:
+            (nixpkgs' { inherit system variant; localSystem = "x86_64-linux"; })
+            .appendOverlays (
+              [
+                self.overlays.pkgs
+              ] ++ additionalOverlays
+            );
+          allPkgsFor' = system: allPkgsFor
+            "master"
+            [(self: super: {
+              # build `pkgsNext.FOO` to build the package FOO from nixpkgs staging-next branch
+              pkgsNext = allPkgsFor "staging-next" [] system;
+              pkgsStaging = allPkgsFor "staging" [] system;
+            })]
+            system
+          ;
         in {
-          x86_64-linux = allPkgsFor "x86_64-linux";
-          aarch64-linux = allPkgsFor "aarch64-linux";
+          x86_64-linux = allPkgsFor' "x86_64-linux";
+          aarch64-linux = allPkgsFor' "aarch64-linux";
         };
 
       # extract only our own packages from the full set.
@@ -242,17 +167,12 @@
             && (passthruPkgs.lib.meta.availableOn passthruPkgs.stdenv.hostPlatform pkg)
           )
           (
-            # expose sane packages and chosen inputs (uninsane.org)
-            (import ./pkgs { pkgs = passthruPkgs; }) // {
-              inherit (passthruPkgs) uninsane-dot-org;
-            }
+            import ./pkgs { pkgs = passthruPkgs; }
           )
         )
         # self.legacyPackages;
         {
-          x86_64-linux = (nixpkgsCompiledBy "x86_64-linux").appendOverlays [
-            self.overlays.passthru
-          ];
+          x86_64-linux = nixpkgs' { localSystem = "x86_64-linux"; };
         }
       ;
 
@@ -405,16 +325,19 @@
           };
 
           deploy = {
-            desko       = deployApp "desko"       "desko" "switch";
-            desko-light = deployApp "desko-light" "desko" "switch";
-            lappy       = deployApp "lappy"       "lappy" "switch";
-            lappy-light = deployApp "lappy-light" "lappy" "switch";
-            lappy-min   = deployApp "lappy-min"   "lappy" "switch";
-            moby        = deployApp "moby"        "moby"  "switch";
-            moby-light  = deployApp "moby-light"  "moby"  "switch";
-            moby-min  =   deployApp "moby-min"    "moby"  "switch";
-            moby-test   = deployApp "moby"        "moby"  "test";
-            servo       = deployApp "servo"       "servo" "switch";
+            crappy       = deployApp "crappy"       "crappy" "switch";
+            crappy-light = deployApp "crappy-light" "crappy" "switch";
+            crappy-min   = deployApp "crappy-min"   "crappy" "switch";
+            desko        = deployApp "desko"        "desko"  "switch";
+            desko-light  = deployApp "desko-light"  "desko"  "switch";
+            lappy        = deployApp "lappy"        "lappy"  "switch";
+            lappy-light  = deployApp "lappy-light"  "lappy"  "switch";
+            lappy-min    = deployApp "lappy-min"    "lappy"  "switch";
+            moby         = deployApp "moby"         "moby"   "switch";
+            moby-light   = deployApp "moby-light"   "moby"   "switch";
+            moby-min     = deployApp "moby-min"     "moby"   "switch";
+            moby-test    = deployApp "moby"         "moby"   "test";
+            servo        = deployApp "servo"        "servo"  "switch";
 
             # like `nixos-rebuild --flake . switch`
             self        = deployApp "$(hostname)"       "" "switch";
@@ -427,31 +350,38 @@
               nix run '.#deploy.moby'
               nix run '.#deploy.desko'
               nix run '.#deploy.servo'
+              nix run '.#deploy.crappy'
             '');
           };
           preDeploy = {
             # build the host and copy the runtime closure to that host, but don't activate it.
-            desko       = deployApp "desko"       "desko" null;
-            desko-light = deployApp "desko-light" "desko" null;
-            lappy       = deployApp "lappy"       "lappy" null;
-            lappy-light = deployApp "lappy-light" "lappy" null;
-            lappy-min   = deployApp "lappy-min"   "lappy" null;
-            moby        = deployApp "moby"        "moby"  null;
-            moby-light  = deployApp "moby-light"  "moby"  null;
-            moby-min    = deployApp "moby-min"    "moby"  null;
-            servo       = deployApp "servo"       "servo" null;
+            crappy       = deployApp "crappy"       "crappy" null;
+            crappy-light = deployApp "crappy-light" "crappy" null;
+            crappy-min   = deployApp "crappy-min"   "crappy" null;
+            desko        = deployApp "desko"        "desko"  null;
+            desko-light  = deployApp "desko-light"  "desko"  null;
+            lappy        = deployApp "lappy"        "lappy"  null;
+            lappy-light  = deployApp "lappy-light"  "lappy"  null;
+            lappy-min    = deployApp "lappy-min"    "lappy"  null;
+            moby         = deployApp "moby"         "moby"   null;
+            moby-light   = deployApp "moby-light"   "moby"   null;
+            moby-min     = deployApp "moby-min"     "moby"   null;
+            servo        = deployApp "servo"        "servo"  null;
             type = "app";
             program = builtins.toString (pkgs.writeShellScript "predeploy-all" ''
               # copy the -min/-light variants first; this might be run while waiting on a full build. or the full build failed.
               nix run '.#preDeploy.moby-min' -- "$@"
               nix run '.#preDeploy.lappy-min' -- "$@"
+              nix run '.#preDeploy.crappy-min' -- "$@"
               nix run '.#preDeploy.moby-light' -- "$@"
               nix run '.#preDeploy.lappy-light' -- "$@"
               nix run '.#preDeploy.desko-light' -- "$@"
+              nix run '.#preDeploy.crappy-light' -- "$@"
               nix run '.#preDeploy.lappy' -- "$@"
               nix run '.#preDeploy.servo' -- "$@"
               nix run '.#preDeploy.moby' -- "$@"
               nix run '.#preDeploy.desko' -- "$@"
+              nix run '.#preDeploy.crappy' -- "$@"
             '');
           };
 
@@ -495,7 +425,11 @@
             program = builtins.toString (pkgs.writeShellScript "sync-to-moby" ''
               sudo mount /mnt/moby/home
               sudo mount /mnt/desko/home
+              sudo mount /mnt/servo/media/Books
+              # copy photos/screenshots from moby to desko:
               ${pkgs.rsync}/bin/rsync -arv --exclude servo-macros /mnt/moby/home/Pictures/ /mnt/desko/home/Pictures/moby/
+              # copy books from servo to moby; delete old/untracked ones, but keep KOreader state files (sdr)
+              ${pkgs.rsync}/bin/rsync -arv --delete --exclude unprocessed --exclude '*.sdr' /mnt/servo/media/Books/ /mnt/moby/home/Books/local/servo/
               # N.B.: limited by network/disk -> reduce job count to improve pause/resume behavior
               ${pkgs.sane-scripts.sync-music}/bin/sane-sync-music --compress --compat --jobs 4 /mnt/servo/media/Music /mnt/moby/home/Music "$@"
             '');
@@ -528,7 +462,7 @@
                 --option restrict-eval true \
                 --option allow-import-from-derivation true \
                 --drv-path --show-trace \
-                -I nixpkgs=${nixpkgs-unpatched} \
+                -I nixpkgs=${nixpkgsUnpatched} \
                 -I nixpkgs-overlays=${./.}/hosts/common/nix/overlay \
                 -I ../../ \
                 | tee  # tee to prevent interactive mode
@@ -551,41 +485,48 @@
                 # this gives me a minimal image i can deploy or copy over, early.
                 ${checkHost "lappy-min"}
                 ${checkHost "moby-min"}
+                ${checkHost "crappy-min"}
 
                 ${checkHost "desko-light"}
                 ${checkHost "moby-light"}
                 ${checkHost "lappy-light"}
+                ${checkHost "crappy-light"}
 
                 ${checkHost "desko"}
                 ${checkHost "lappy"}
                 ${checkHost "servo"}
                 ${checkHost "moby"}
+                ${checkHost "crappy"}
                 ${checkHost "rescue"}
 
                 # still want to build the -light variants first so as to avoid multiple simultaneous webkitgtk builds
                 ${checkHost "desko-light-next"}
                 ${checkHost "moby-light-next"}
+                ${checkHost "crappy-light-next"}
 
                 ${checkHost "desko-next"}
                 ${checkHost "lappy-next"}
                 ${checkHost "servo-next"}
                 ${checkHost "moby-next"}
+                ${checkHost "crappy-next"}
                 ${checkHost "rescue-next"}
 
                 echo "desko: $RC_desko"
                 echo "lappy: $RC_lappy"
                 echo "servo: $RC_servo"
                 echo "moby: $RC_moby"
+                echo "crappy: $RC_crappy"
                 echo "rescue: $RC_rescue"
 
                 echo "desko-next: $RC_desko_next"
                 echo "lappy-next: $RC_lappy_next"
                 echo "servo-next: $RC_servo_next"
                 echo "moby-next: $RC_moby_next"
+                echo "crappy-next: $RC_crappy_next"
                 echo "rescue-next: $RC_rescue_next"
 
                 # i don't really care if the -next hosts fail. i build them mostly to keep the cache fresh/ready
-                exit $(($RC_desko | $RC_lappy | $RC_servo | $RC_moby | $RC_rescue))
+                exit $(($RC_desko | $RC_lappy | $RC_servo | $RC_moby | $RC_crappy | $RC_rescue))
               ''
             );
           };
@@ -631,6 +572,19 @@
           path = ./templates/env/python-data;
           description = "python environment for data processing";
         };
+
+        pkgs.make = {
+          # initialize with:
+          # - `nix flake init -t '/home/colin/dev/nixos/#pkgs.make'`
+          path = ./templates/pkgs/make;
+          description = "default Makefile-based derivation";
+        };
+        pkgs.python = {
+          # initialize with:
+          # - `nix flake init -t '/home/colin/dev/nixos/#pkgs.python'`
+          path = ./templates/pkgs/python;
+          description = "python package";
+        };
         pkgs.rust-inline = {
           # initialize with:
           # - `nix flake init -t '/home/colin/dev/nixos/#pkgs.rust-inline'`
@@ -643,12 +597,6 @@
           path = ./templates/pkgs/rust;
           description = "rust package fit to ship in nixpkgs";
         };
-        pkgs.make = {
-          # initialize with:
-          # - `nix flake init -t '/home/colin/dev/nixos/#pkgs.make'`
-          path = ./templates/pkgs/make;
-          description = "default Makefile-based derivation";
-        };
       };
     };
 }

hosts/by-name/crappy/default.nix

@@ -0,0 +1,37 @@
+# Samsung chromebook XE303C12
+# - <https://wiki.postmarketos.org/wiki/Samsung_Chromebook_(google-snow)>
+{ ... }:
+{
+  imports = [
+    ./fs.nix
+  ];
+
+  sane.hal.samsung.enable = true;
+  sane.roles.client = true;
+  # sane.roles.pc = true;
+
+  users.users.colin.initialPassword = "147147";
+  sane.programs.sway.enableFor.user.colin = true;
+  sane.programs.calls.enableFor.user.colin = false;
+  sane.programs.consoleMediaUtils.enableFor.user.colin = true;
+  sane.programs.epiphany.enableFor.user.colin = true;
+  sane.programs."gnome.geary".enableFor.user.colin = false;
+  # sane.programs.firefox.enableFor.user.colin = true;
+  sane.programs.portfolio-filemanager.enableFor.user.colin = true;
+  sane.programs.signal-desktop.enableFor.user.colin = false;
+  sane.programs.wike.enableFor.user.colin = true;
+
+  # sane.programs.pcGuiApps.enableFor.user.colin = false;  #< errors!
+
+  sane.programs.blueberry.enableFor.user.colin = false;  # bluetooth manager: doesn't cross compile!
+  # sane.programs.brave.enableFor.user.colin = false;  # 2024/06/03: fails eval if enabled on cross
+  # sane.programs.firefox.enableFor.user.colin = false;  # 2024/06/03: this triggers an eval error in yarn stuff -- i'm doing IFD somewhere!!?
+  sane.programs.mepo.enableFor.user.colin = false;  # 2024/06/04: doesn't cross compile (nodejs)
+  sane.programs.mercurial.enableFor.user.colin = false;  # 2024/06/03: does not cross compile
+  sane.programs.nixpkgs-review.enableFor.user.colin = false;  # 2024/06/03: OOMs when cross compiling
+  sane.programs.ntfy-sh.enableFor.user.colin = false;  # 2024/06/04: doesn't cross compile (nodejs)
+  sane.programs.pwvucontrol.enableFor.user.colin = false;  # 2024/06/03: doesn't cross compile (libspa-sys)
+  sane.programs."sane-scripts.bt-search".enableFor.user.colin = false;  # 2024/06/03: does not cross compile
+  sane.programs.sequoia.enableFor.user.colin = false;  # 2024/06/03: does not cross compile
+  sane.programs.zathura.enableFor.user.colin = false;  # 2024/06/03: does not cross compile
+}

hosts/by-name/crappy/fs.nix

@@ -0,0 +1,16 @@
+{ ... }:
+{
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-uuid/55555555-0303-0c12-86df-eda9e9311526";
+    fsType = "btrfs";
+    options = [
+      "compress=zstd"
+      "defaults"
+    ];
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/303C-5A37";
+    fsType = "vfat";
+  };
+}

hosts/by-name/desko/default.nix

@@ -35,7 +35,6 @@
   sane.programs."gnome.geary".config.autostart = true;
   sane.programs.signal-desktop.config.autostart = true;
 
-  boot.loader.efi.canTouchEfiVariables = false;
   sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
 
   # needed to use libimobiledevice/ifuse, for iphone sync
@@ -52,7 +51,4 @@
     # TODO: ALLOW_USERS doesn't seem to work. still need `sudo snapper -c nix list`
     ALLOW_USERS = [ "colin" ];
   };
-
-  # docs: https://nixos.org/manual/nixos/stable/options.html#opt-system.stateVersion
-  system.stateVersion = "21.05";
 }

hosts/by-name/lappy/default.nix

@@ -13,7 +13,6 @@
   # sane.ovpn.addrV6 = "fd00:0000:1337:cafe:1111:1111:0332:aa96/128";
 
   # sane.guest.enable = true;
-  boot.loader.efi.canTouchEfiVariables = false;
   sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
 
   sane.programs.stepmania.enableFor.user.colin = true;
@@ -34,7 +33,4 @@
     SUBVOLUME = "/nix";
     ALLOW_USERS = [ "colin" ];
   };
-
-  # docs: https://nixos.org/manual/nixos/stable/options.html#opt-system.stateVersion
-  system.stateVersion = "21.05";
 }

hosts/by-name/lappy/xkb_mobile_normal_buttons

@@ -1,7 +0,0 @@
-xkb_keymap {
-	xkb_keycodes  { include "evdev+aliases(qwerty)"	};
-	xkb_types     { include "complete"	};
-	xkb_compat    { include "complete"	};
-	xkb_symbols   { include "pc+us+inet(evdev)"	};
-	xkb_geometry  { include "pc(pc105)"	};
-};

hosts/by-name/moby/bootloader.nix

@@ -1,22 +0,0 @@
-# tow-boot: <https://tow-boot.org>
-# docs (pinephone specific): <https://github.com/Tow-Boot/Tow-Boot/tree/development/boards/pine64-pinephoneA64>
-# LED and button behavior is defined here: <https://github.com/Tow-Boot/Tow-Boot/blob/development/modules/tow-boot/phone-ux.nix>
-# - hold VOLDOWN: enter recovery mode
-#   - LED will turn aqua instead of yellow
-#   - recovery mode would ordinarily allow a selection of entries, but for pinephone i guess it doesn't do anything?
-# - hold VOLUP: force it to load the OS from eMMC?
-#   - LED will turn blue instead of yellow
-# boot LEDs:
-# - yellow = entered tow-boot
-# - 10 red flashes => poweroff means tow-boot couldn't boot into the next stage (i.e. distroboot)
-#   - distroboot: <https://source.denx.de/u-boot/u-boot/-/blob/v2022.04/doc/develop/distro.rst>)
-{ config, pkgs, ... }:
-{
-  # we need space in the GPT header to place tow-boot.
-  # only actually need 1 MB, but better to over-allocate than under-allocate
-  sane.image.extraGPTPadding = 16 * 1024 * 1024;
-  sane.image.firstPartGap = 0;
-  sane.image.installBootloader = ''
-    dd if=${pkgs.tow-boot-pinephone}/Tow-Boot.noenv.bin of=$out/nixos.img bs=1024 seek=8 conv=notrunc
-  '';
-}

hosts/by-name/moby/default.nix

@@ -9,16 +9,13 @@
 { config, pkgs, lib, ... }:
 {
   imports = [
-    ./bootloader.nix
     ./fs.nix
     ./gps.nix
-    ./kernel.nix
-    ./polyfill.nix
   ];
 
+  sane.hal.pine64.enable = true;
   sane.roles.client = true;
   sane.roles.handheld = true;
-  sane.programs.zsh.config.showDeadlines = false;  # unlikely to act on them when in shell
   sane.services.wg-home.enable = true;
   sane.services.wg-home.ip = config.sane.hosts.by-name."moby".wg-home.ip;
   sane.ovpn.addrV4 = "172.24.87.255";
@@ -32,11 +29,6 @@
   sops.secrets.colin-passwd.neededForUsers = true;
 
   sane.programs.sway.enableFor.user.colin = true;
-  sane.programs.swaylock.enableFor.user.colin = false;  #< not usable on touch
-  sane.programs.schlock.enableFor.user.colin = true;
-  sane.programs.swayidle.config.actions.screenoff.delay = 300;
-  sane.programs.swayidle.config.actions.screenoff.enable = true;
-  sane.programs.sane-input-handler.enableFor.user.colin = true;
   sane.programs.blueberry.enableFor.user.colin = false;  # bluetooth manager: doesn't cross compile!
   sane.programs.fcitx5.enableFor.user.colin = false;  # does not cross compile
   sane.programs.mercurial.enableFor.user.colin = false;  # does not cross compile
@@ -52,10 +44,6 @@
   # sane.programs."gnome.geary".config.autostart = true;
   # sane.programs.calls.config.autostart = true;
 
-  sane.programs.firefox.mime.priority = 300;  # prefer other browsers when possible
-  # HACK/TODO: make `programs.P.env.VAR` behave according to `mime.priority`
-  sane.programs.firefox.env = lib.mkForce {};
-  sane.programs.epiphany.env.BROWSER = "epiphany";
   sane.programs.pipewire.config = {
     # tune so Dino doesn't drop audio
     # there's seemingly two buffers for the mic (see: <https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/FAQ#pipewire-buffering-explained>)
@@ -72,53 +60,7 @@
     max-quantum = 8192;
   };
 
-  boot.loader.efi.canTouchEfiVariables = false;
   # /boot space is at a premium. default was 20.
   # even 10 can be too much
   boot.loader.generic-extlinux-compatible.configurationLimit = 8;
-  # mobile.bootloader.enable = false;
-  # mobile.boot.stage-1.enable = false;
-  # boot.initrd.systemd.enable = false;
-  # boot.initrd.services.swraid.enable = false;  # attempt to fix dm_mod stuff
-
-  # hardware.firmware makes the referenced files visible to the kernel, for whenever a driver explicitly asks for them.
-  # these files are visible from userspace by following `/sys/module/firmware_class/parameters/path`
-  #
-  # mobile-nixos' /lib/firmware includes:
-  #   rtl_bt          (bluetooth)
-  #   anx7688-fw.bin  (USB-C chip: power negotiation, HDMI/dock)
-  #   ov5640_af.bin   (camera module)
-  # hardware.firmware = [ config.mobile.device.firmware ];
-  # hardware.firmware = [ pkgs.rtl8723cs-firmware ];
-  hardware.firmware = [
-    (pkgs.linux-firmware-megous.override {
-      # rtl_bt = false probably means no bluetooth connectivity.
-      # N.B.: DON'T RE-ENABLE without first confirming that wake-on-lan works during suspend (rtcwake).
-      # it seems the rtl_bt stuff ("bluetooth coexist") might make wake-on-LAN radically more flaky.
-      rtl_bt = false;
-    })
-  ];
-
-  system.stateVersion = "21.11";
-
-  # defined: https://www.freedesktop.org/software/systemd/man/machine-info.html
-  # XXX colin: not sure which, if any, software makes use of this
-  environment.etc."machine-info".text = ''
-    CHASSIS="handset"
-  '';
-
-  # enable rotation sensor
-  # hardware.sensor.iio.enable = true;
-
-  services.udev.extraRules = let
-    chmod = "${pkgs.coreutils}/bin/chmod";
-    chown = "${pkgs.coreutils}/bin/chown";
-  in ''
-    # make Pinephone flashlight writable by user.
-    # taken from postmarketOS: <repo:postmarketOS/pmaports:device/main/device-pine64-pinephone/60-flashlight.rules>
-    SUBSYSTEM=="leds", DEVPATH=="*/*:flash", RUN+="${chmod} g+w /sys%p/brightness /sys%p/flash_strobe", RUN+="${chown} :video /sys%p/brightness /sys%p/flash_strobe"
-
-    # make Pinephone front LEDs writable by user.
-    SUBSYSTEM=="leds", DEVPATH=="*/*:indicator", RUN+="${chmod} g+w /sys%p/brightness", RUN+="${chown} :video /sys%p/brightness"
-  '';
 }

hosts/by-name/moby/kernel.nix

@@ -1,271 +0,0 @@
-{ pkgs, ... }:
-let
-  dmesg = "${pkgs.util-linux}/bin/dmesg";
-  grep = "${pkgs.gnugrep}/bin/grep";
-  modprobe = "${pkgs.kmod}/bin/modprobe";
-  ensureHWReady = ''
-    # common boot failure:
-    # blank screen (no backlight even), with the following log:
-    # ```syslog
-    # sun8i-dw-hdmi 1ee0000.hdmi: Couldn't get the HDMI PHY
-    # ...
-    # sun4i-drm display-engine: Couldn't bind all pipelines components
-    # ...
-    # sun8i-dw-hdmi: probe of 1ee0000.hdmi failed with error -17
-    # ```
-    #
-    # in particular, that `probe ... failed` occurs *only* on failed boots
-    # (the other messages might sometimes occur even on successful runs?)
-    #
-    # reloading the sun8i hdmi driver usually gets the screen on, showing boot text.
-    # then restarting display-manager.service gets us to the login.
-    #
-    # NB: the above log is default level. though less specific, there's a `err` level message that also signals this:
-    # sun4i-drm display-engine: failed to bind 1ee0000.hdmi (ops sun8i_dw_hdmi_ops [sun8i_drm_hdmi]): -17
-    # NB: this is the most common, but not the only, failure mode for `display-manager`.
-    # another error seems characterized by these dmesg logs, in which reprobing sun8i_drm_hdmi does not fix:
-    # ```syslog
-    # sun6i-mipi-dsi 1ca0000.dsi: Couldn't get the MIPI D-PHY
-    # sun4i-drm display-engine: Couldn't bind all pipelines components
-    # sun6i-mipi-dsi 1ca0000.dsi: Couldn't register our component
-    # ```
-
-    if (${dmesg} --kernel --level err --color=never --notime | ${grep} -q 'sun4i-drm display-engine: failed to bind 1ee0000.hdmi')
-    then
-      echo "reprobing sun8i_drm_hdmi"
-      # if a command here fails it errors the whole service, so prefer to log instead
-      ${modprobe} -r sun8i_drm_hdmi || echo "failed to unload sun8i_drm_hdmi"
-      ${modprobe} sun8i_drm_hdmi || echo "failed to load sub8i_drm_hdmi"
-    fi
-  '';
-in
-{
-  # kernel compatibility (2024/05/22: 03dab630)
-  # - linux-megous: boots to ssh, desktop
-  #   - camera apps: megapixels (no cameras found), snapshot (no cameras found)
-  # - linux-postmarketos: boots to ssh. desktop ONLY if "anx7688" is in the initrd.availableKernelModules.
-  #   - camera apps: megapixels (both rear and front cameras work), `cam -l` (finds only the rear camera), snapshot (no cameras found)
-  # - linux-megous.override { withMegiPinephoneConfig = true; }: NO SSH, NO SIGNS OF LIFE
-  # - linux-megous.override { withFullConfig = false; }: boots to ssh, no desktop
-  #
-  boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.linux-postmarketos.override {
-    withModemPower = true;
-  });
-  # boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux-megous;
-  # boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.linux-megous.override {
-  #   withFullConfig = false;
-  # });
-  # boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.linux-megous.override {
-  #   withMegiPinephoneConfig = true;  #< N.B.: does not boot as of 2024/05/22!
-  # });
-  # boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux-manjaro;
-  # boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_latest;
-
-  # nixpkgs.hostPlatform.linux-kernel becomes stdenv.hostPlatform.linux-kernel
-  nixpkgs.hostPlatform.linux-kernel = {
-    # defaults:
-    name = "aarch64-multiplatform";
-    # baseConfig: defaults to "defconfig";
-    # baseConfig = "pinephone_defconfig";  #< N.B.: ignored by `pkgs.linux-megous`
-    DTB = true;  #< DTB: compile device tree blobs
-    # autoModules (default: true): for config options not manually specified, answer `m` to anything which supports it.
-    # - this effectively builds EVERY MODULE SUPPORTED.
-    autoModules = true;  #< N.B.: ignored by `pkgs.linux-megous`
-    # preferBuiltin (default: false; true for rpi): for config options which default to `Y` upstream, build them as `Y` (overriding `autoModules`)
-    # preferBuiltin = false;
-
-    # build a compressed kernel image: without this i run out of /boot space in < 10 generations
-    # target = "Image";  # <-- default
-    target = "Image.gz";  # <-- compress the kernel image
-    # target = "zImage";  # <-- confuses other parts of nixos :-(
-  };
-
-  # boot.initrd.kernelModules = [
-  #   "drm"  #< force drm to be plugged
-  # ];
-  boot.initrd.availableKernelModules = [
-    # see <repo:postmarketOS/pmaports:device/main/device-pine64-pinephone/modules-initfs>
-    # - they include sun6i_mipi_dsi sun4i_drm pwm_sun4i sun8i_mixer anx7688 gpio_vibra pinephone_keyboard
-    "anx7688" #< required for display initialization and functional cameras
-    # full list of modules active post-boot with the linux-megous kernel + autoModules=true:
-    # - `lsmod | sort | cut -d ' ' -f 1`
-    # "8723cs"
-    # "axp20x_adc"  #< NOT FOUND in megous-no-autoModules
-    # "axp20x_battery"
-    # "axp20x_pek"
-    # "axp20x_usb_power"
-    # "backlight"
-    # "blake2b_generic"
-    # "bluetooth"
-    # "bridge"
-    # "btbcm"
-    # "btqca"
-    # "btrfs"
-    # "btrtl"
-    # "cec"
-    # "cfg80211"
-    # "chacha_neon"
-    # "crc_ccitt"
-    # "crct10dif_ce"
-    # "crypto_engine"
-    # "display_connector"  #< NOT FOUND in pmos
-    # "drm"
-    # "drm_display_helper"
-    # "drm_dma_helper"
-    # "drm_kms_helper"
-    # "drm_shmem_helper"
-    # "dw_hdmi"
-    # "dw_hdmi_cec"  #< NOT FOUND in pmos
-    # "dw_hdmi_i2s_audio"
-    # "ecc"
-    # "ecdh_generic"
-    # "fuse"
-    # "gc2145"  #< NOT FOUND in megous-no-autoModules
-    # "goodix_ts"
-    # "gpio_vibra"  #< NOT FOUND in megous-no-autoModules
-    # "gpu_sched"
-    # "hci_uart"
-    # "i2c_gpio"
-    # "inv_mpu6050"  #< NOT FOUND in megous-no-autoModules
-    # "inv_mpu6050_i2c"  #< NOT FOUND in megous-no-autoModules
-    # "inv_sensors_timestamp"  #< NOT FOUND in megous-no-autoModules
-    # "ip6t_rpfilter"
-    # "ip6_udp_tunnel"
-    # "ip_set"
-    # "ip_set_hash_ipport"
-    # "ip_tables"
-    # "ipt_rpfilter"
-    # "joydev"
-    # "led_class_flash"  #< NOT FOUND in megous-no-autoModules
-    # "leds_sgm3140"  #< NOT FOUND in megous-no-autoModules
-    # "ledtrig_pattern"  #< NOT FOUND in megous-no-autoModules
-    # "libarc4"
-    # "libchacha"
-    # "libchacha20poly1305"
-    # "libcrc32c"
-    # "libcurve25519_generic"
-    # "lima"
-    # "llc"
-    # "mac80211"
-    # "macvlan"
-    # "mc"
-    # "modem_power"
-    # "mousedev"
-    # "nf_conntrack"
-    # "nf_defrag_ipv4"
-    # "nf_defrag_ipv6"
-    # "nf_log_syslog"
-    # "nf_nat"
-    # "nfnetlink"
-    # "nf_tables"
-    # "nft_chain_nat"
-    # "nft_compat"
-    # "nls_cp437"
-    # "nls_iso8859_1"
-    # "nvmem_reboot_mode"
-    # "ov5640"
-    # "panel_sitronix_st7703"
-    # "phy_sun6i_mipi_dphy"
-    # "pinctrl_axp209"  #< NOT FOUND in pmos
-    # "pinephone_keyboard"  #< NOT FOUND in megous-no-autoModules
-    # "poly1305_neon"
-    # "polyval_ce"
-    # "polyval_generic"
-    # "ppkb_manager"  #< NOT FOUND in megous-no-autoModules
-    # "pwm_bl"
-    # "pwm_sun4i"
-    # "qrtr"
-    # "raid6_pq"
-    # "rfkill"
-    # "rtw88_8703b"
-    # "rtw88_8723cs"
-    # "rtw88_8723x"
-    # "rtw88_core"
-    # "rtw88_sdio"
-    # "sch_fq_codel"
-    # "sm4"
-    # "snd_soc_bt_sco"
-    # "snd_soc_ec25"  #< NOT FOUND in megous-no-autoModules
-    # "snd_soc_hdmi_codec"
-    # "snd_soc_simple_amplifier"
-    # "snd_soc_simple_card"
-    # "snd_soc_simple_card_utils"
-    # "stk3310"  #< NOT FOUND in megous-no-autoModules
-    # "st_magn"
-    # "st_magn_i2c"
-    # "st_magn_spi"  #< NOT FOUND in pmos
-    # "stp"
-    # "st_sensors"
-    # "st_sensors_i2c"
-    # "st_sensors_spi"  #< NOT FOUND in pmos
-    # "sun4i_drm"
-    # "sun4i_i2s"
-    # "sun4i_lradc_keys"  #< NOT FOUND in megous-no-autoModules
-    # "sun4i_tcon"
-    # "sun50i_codec_analog"
-    # "sun6i_csi"
-    # "sun6i_dma"
-    # "sun6i_mipi_dsi"
-    # "sun8i_a33_mbus"  #< NOT FOUND in megous-no-autoModules
-    # "sun8i_adda_pr_regmap"
-    # "sun8i_ce"  #< NOT FOUND in pmos
-    # "sun8i_codec"  #< NOT FOUND in megous-no-autoModules
-    # "sun8i_di"  #< NOT FOUND in megous-no-autoModules
-    # "sun8i_drm_hdmi"
-    # "sun8i_mixer"
-    # "sun8i_rotate"  #< NOT FOUND in megous-no-autoModules
-    # "sun8i_tcon_top"
-    # "sun9i_hdmi_audio"  #< NOT FOUND in megous-no-autoModules
-    # "sunxi_wdt"  #< NOT FOUND in pmos
-    # "tap"
-    # "typec"  #< NOT FOUND in pmos
-    # "udp_tunnel"
-    # "uio"  #< NOT FOUND in pmos
-    # "uio_pdrv_genirq"
-    # "v4l2_async"
-    # "v4l2_cci" #< NOT FOUND in pmos
-    # "v4l2_flash_led_class"  #< NOT FOUND in megous-no-autoModules
-    # "v4l2_fwnode"
-    # "v4l2_mem2mem"
-    # "videobuf2_common"
-    # "videobuf2_dma_contig"
-    # "videobuf2_memops"
-    # "videobuf2_v4l2"
-    # "videodev"
-    # "wireguard"
-    # "xor"
-    # "x_tables"
-    # "xt_conntrack"
-    # "xt_LOG"
-    # "xt_nat"
-    # "xt_pkttype"
-    # "xt_set"
-    # "xt_tcpudp"
-    # "zram"
-  ];
-
-  # disable proximity sensor.
-  # the filtering/calibration is bad that it causes the screen to go fully dark at times.
-  # boot.blacklistedKernelModules = [ "stk3310" ];
-
-  boot.kernelParams = [
-    # without this some GUI apps fail: `DRM_IOCTL_MODE_CREATE_DUMB failed: Cannot allocate memory`
-    # this is because they can't allocate enough video ram.
-    # see related nixpkgs issue: <https://github.com/NixOS/nixpkgs/issues/260222>
-    # TODO(2023/12/03): remove once mesa 23.3.1 lands: <https://github.com/NixOS/nixpkgs/pull/265740>
-    #
-    # the default CMA seems to be 32M.
-    # i was running fine with 256MB from 2022/07-ish through 2022/12-ish, but then the phone quit reliably coming back from sleep (phosh): maybe a memory leak?
-    # bumped to 512M on 2023/01
-    # bumped to 1536M on 2024/05
-    # `cat /proc/meminfo` to see CmaTotal/CmaFree if interested in tuning this.
-    # kernel param mentioned here: <https://cateee.net/lkddb/web-lkddb/CMA_SIZE_PERCENTAGE.html>
-    # i think cma mem isn't exclusive -- it can be used as ordinary `malloc`, still. i heard someone suggest the OS default should just be 50% memory to CMA.
-    "cma=1536M"
-    # 2023/10/20: potential fix for the lima (GPU) timeout bugs:
-    # - <https://gitlab.com/postmarketOS/pmaports/-/issues/805#note_890467824>
-    "lima.sched_timeout_ms=2000"
-  ];
-
-  systemd.services.unl0kr.preStart = ensureHWReady;
-}

hosts/by-name/moby/polyfill.nix

@@ -1,45 +0,0 @@
-# this file configures preferences per program, without actually enabling any programs.
-# the goal is to separate the place where we decide *what* to use (i.e. `sane.programs.firefox.enable = true` -- at the toplevel)
-# from where we specific how that thing should behave *if* it's in use.
-#
-# NixOS backgrounds:
-# - <https://github.com/NixOS/nixos-artwork>
-#   - <https://github.com/NixOS/nixos-artwork/issues/50>  (colorful; unmerged)
-#   - <https://github.com/NixOS/nixos-artwork/pull/60/files>  (desktop-oriented; clean; unmerged)
-# - <https://itsfoss.com/content/images/2023/04/nixos-tutorials.png>
-
-{ lib, pkgs, sane-lib, ... }:
-{
-  sane.programs.firefox.config = {
-    # compromise impermanence for the sake of usability
-    persistCache = "private";
-    persistData = "private";
-
-    # i don't do crypto stuff on moby
-    addons.ether-metamask.enable = false;
-    # sidebery UX doesn't make sense on small screen
-    addons.sidebery.enable = false;
-  };
-  sane.programs.swaynotificationcenter.config = {
-    backlight = "backlight";  # /sys/class/backlight/*backlight*/brightness
-  };
-
-  sane.programs.alacritty.config.fontSize = 9;
-
-  sane.programs.sway.config = {
-    font = "pango:monospace 10";
-    mod = "Mod1";  # prefer Alt
-    workspace_layout = "tabbed";
-  };
-
-  sane.programs.waybar.config = {
-    fontSize = 14;
-    height = 26;
-    persistWorkspaces = [ "1" "2" "3" "4" "5" ];
-    modules.media = false;
-    modules.network = false;
-    modules.perf = false;
-    modules.windowTitle = false;
-    # TODO: show modem state
-  };
-}

hosts/by-name/rescue/default.nix

@@ -4,7 +4,6 @@
     ./fs.nix
   ];
 
-  boot.loader.efi.canTouchEfiVariables = false;
   sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
   sane.persist.enable = false;  # what we mean here is that the image is immutable; `/` is still tmpfs.
   sane.nixcache.enable = false;  # don't want to be calling out to dead machines that we're *trying* to rescue
@@ -12,7 +11,4 @@
   # auto-login at shell
   services.getty.autologinUser = "colin";
   # users.users.colin.initialPassword = "colin";
-
-  # docs: https://nixos.org/manual/nixos/stable/options.html#opt-system.stateVersion
-  system.stateVersion = "21.05";
 }

hosts/by-name/servo/default.nix

@@ -38,7 +38,6 @@
   # using root here makes sure we always have an escape hatch
   services.getty.autologinUser = "root";
 
-  boot.loader.efi.canTouchEfiVariables = false;
   sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
 
   # both transmission and ipfs try to set different net defaults.
@@ -46,13 +45,5 @@
   boot.kernel.sysctl = {
     "net.core.rmem_max" = 4194304;  # 4MB
   };
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "21.11";
 }
 

hosts/by-name/servo/services/gitea.nix

@@ -53,6 +53,8 @@
     session.COOKIE_SECURE = true;
     repository = {
       DEFAULT_BRANCH = "master";
+      ENABLE_PUSH_CREATE_USER = true;
+      ENABLE_PUSH_CREATE_ORG = true;
     };
     other = {
       SHOW_FOOTER_TEMPLATE_LOAD_TIME = false;

hosts/common/boot.nix

@@ -0,0 +1,50 @@
+{ lib, pkgs, ... }:
+{
+  boot.initrd.supportedFilesystems = [ "ext4" "btrfs" "ext2" "ext3" "vfat" ];
+  # useful emergency utils
+  boot.initrd.extraUtilsCommands = ''
+    copy_bin_and_libs ${pkgs.btrfs-progs}/bin/btrfstune
+    copy_bin_and_libs ${pkgs.util-linux}/bin/{cfdisk,lsblk,lscpu}
+    copy_bin_and_libs ${pkgs.gptfdisk}/bin/{cgdisk,gdisk}
+    copy_bin_and_libs ${pkgs.smartmontools}/bin/smartctl
+    copy_bin_and_libs ${pkgs.e2fsprogs}/bin/resize2fs
+  '' + lib.optionalString pkgs.stdenv.hostPlatform.isx86_64 ''
+    copy_bin_and_libs ${pkgs.nvme-cli}/bin/nvme  # doesn't cross compile
+  '';
+  boot.kernelParams = [
+    "boot.shell_on_fail"
+    #v experimental full pre-emption for hopefully better call/audio latency on moby.
+    # also toggleable at runtime via /sys/kernel/debug/sched/preempt
+    # defaults to preempt=voluntary
+    # "preempt=full"
+  ];
+  # other kernelParams:
+  #   "boot.trace"
+  #   "systemd.log_level=debug"
+  #   "systemd.log_target=console"
+
+  # moby has to run recent kernels (defined elsewhere).
+  # meanwhile, kernel variation plays some minor role in things like sandboxing (landlock) and capabilities.
+  # simpler to keep near the latest kernel on all devices,
+  # and also makes certain that any weird system-level bugs i see aren't likely to be stale kernel bugs.
+  # servo needs zfs though, which doesn't support every kernel.
+  boot.kernelPackages = lib.mkDefault pkgs.zfs.latestCompatibleLinuxPackages;
+
+  # hack in the `boot.shell_on_fail` arg since that doesn't always seem to work.
+  boot.initrd.preFailCommands = "allowShell=1";
+
+  # default: 4 (warn). 7 is debug
+  boot.consoleLogLevel = 7;
+
+  boot.loader.grub.enable = lib.mkDefault false;
+  boot.loader.generic-extlinux-compatible.enable = lib.mkDefault true;
+
+  hardware.enableAllFirmware = true;  # firmware with licenses that don't allow for redistribution. fuck lawyers, fuck IP, give me the goddamn firmware.
+  # hardware.enableRedistributableFirmware = true;  # proprietary but free-to-distribute firmware (extraneous to `enableAllFirmware` option)
+
+  # default is 252274, which is too low particularly for servo.
+  # manifests as spurious "No space left on device" when trying to install watches,
+  # e.g. in dyn-dns by `systemctl start dyn-dns-watcher.path`.
+  # see: <https://askubuntu.com/questions/828779/failed-to-add-run-systemd-ask-password-to-directory-watch-no-space-left-on-dev>
+  boot.kernel.sysctl."fs.inotify.max_user_watches" = 1048576;
+}

hosts/common/default.nix

@@ -1,9 +1,9 @@
 { config, lib, pkgs, ... }:
 {
   imports = [
+    ./boot.nix
     ./feeds.nix
     ./fs.nix
-    ./hardware
     ./home
     ./hosts.nix
     ./ids.nix
@@ -13,12 +13,18 @@
     ./persist.nix
     ./polyunfill.nix
     ./programs
+    ./quirks.nix
     ./secrets.nix
     ./ssh.nix
     ./systemd.nix
     ./users
   ];
 
+
+  # docs: https://nixos.org/manual/nixos/stable/options.html#opt-system.stateVersion
+  # this affects where nixos modules look for stateful data which might have been migrated across releases.
+  system.stateVersion = "21.11";
+
   sane.nixcache.enable-trusted-keys = true;
   sane.nixcache.enable = lib.mkDefault true;
   sane.persist.enable = lib.mkDefault true;
@@ -26,9 +32,6 @@
   sane.programs.sysadminUtils.enableFor.system = lib.mkDefault true;
   sane.programs.consoleUtils.enableFor.user.colin = lib.mkDefault true;
 
-  nixpkgs.config.allowUnfree = true;  # NIXPKGS_ALLOW_UNFREE=1
-  nixpkgs.config.allowBroken = true;  # NIXPKGS_ALLOW_BROKEN=1
-
   # time.timeZone = "America/Los_Angeles";
   time.timeZone = "Etc/UTC";  # DST is too confusing for me => use a stable timezone
 

hosts/common/feeds.nix

@@ -238,7 +238,7 @@ let
     (fromDb "youtube.com/@TomScottGo")
     (fromDb "youtube.com/@Vihart")
     (fromDb "youtube.com/@Vox")
-    (fromDb "youtube.com/@Vsauce")
+    # (fromDb "youtube.com/@Vsauce")  # they're all like 1-minute long videos now? what happened @Vsauce?
 
     # (fromDb "youtube.com/@rossmanngroup" // pol // tech)  # Louis Rossmann
   ];

hosts/common/fs.nix

@@ -216,6 +216,7 @@ lib.mkMerge [
     programs.fuse.userAllowOther = true;  #< necessary for `allow_other` or `allow_root` options.
   }
 
+  (remoteHome "crappy")
   (remoteHome "desko")
   (remoteHome "lappy")
   (remoteHome "moby")

hosts/common/hardware/default.nix

@@ -1,99 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  imports = [
-    ./x86_64.nix
-  ];
-
-  boot.initrd.supportedFilesystems = [ "ext4" "btrfs" "ext2" "ext3" "vfat" ];
-  # useful emergency utils
-  boot.initrd.extraUtilsCommands = ''
-    copy_bin_and_libs ${pkgs.btrfs-progs}/bin/btrfstune
-    copy_bin_and_libs ${pkgs.util-linux}/bin/{cfdisk,lsblk,lscpu}
-    copy_bin_and_libs ${pkgs.gptfdisk}/bin/{cgdisk,gdisk}
-    copy_bin_and_libs ${pkgs.smartmontools}/bin/smartctl
-    copy_bin_and_libs ${pkgs.e2fsprogs}/bin/resize2fs
-  '' + lib.optionalString pkgs.stdenv.hostPlatform.isx86_64 ''
-    copy_bin_and_libs ${pkgs.nvme-cli}/bin/nvme  # doesn't cross compile
-  '';
-  boot.kernelParams = [
-    "boot.shell_on_fail"
-    #v experimental full pre-emption for hopefully better call/audio latency on moby.
-    # also toggleable at runtime via /sys/kernel/debug/sched/preempt
-    # defaults to preempt=voluntary
-    # "preempt=full"
-  ];
-  # other kernelParams:
-  #   "boot.trace"
-  #   "systemd.log_level=debug"
-  #   "systemd.log_target=console"
-
-  # moby has to run recent kernels (defined elsewhere).
-  # meanwhile, kernel variation plays some minor role in things like sandboxing (landlock) and capabilities.
-  # simpler to keep near the latest kernel on all devices,
-  # and also makes certain that any weird system-level bugs i see aren't likely to be stale kernel bugs.
-  # servo needs zfs though, which doesn't support every kernel.
-  boot.kernelPackages = lib.mkDefault pkgs.zfs.latestCompatibleLinuxPackages;
-
-  # TODO: remove after linux 6.9. see: <https://github.com/axboe/liburing/issues/1113>
-  # - <https://github.com/neovim/neovim/issues/28149>
-  # - <https://git.kernel.dk/cgit/linux/commit/?h=io_uring-6.9&id=e5444baa42e545bb929ba56c497e7f3c73634099>
-  # when removing, try starting and suspending (ctrl+z) two instances of neovim simultaneously.
-  # if the system doesn't freeze, then this is safe to remove.
-  # added 2024-04-04
-  sane.user.fs.".profile".symlink.text = lib.mkBefore ''
-    export UV_USE_IO_URING=0
-  '';
-
-  # hack in the `boot.shell_on_fail` arg since that doesn't always seem to work.
-  boot.initrd.preFailCommands = "allowShell=1";
-
-  # default: 4 (warn). 7 is debug
-  boot.consoleLogLevel = 7;
-
-  boot.loader.grub.enable = lib.mkDefault false;
-  boot.loader.generic-extlinux-compatible.enable = lib.mkDefault true;
-
-  # non-free firmware
-  hardware.enableRedistributableFirmware = true;
-
-  # default is 252274, which is too low particularly for servo.
-  # manifests as spurious "No space left on device" when trying to install watches,
-  # e.g. in dyn-dns by `systemctl start dyn-dns-watcher.path`.
-  # see: <https://askubuntu.com/questions/828779/failed-to-add-run-systemd-ask-password-to-directory-watch-no-space-left-on-dev>
-  boot.kernel.sysctl."fs.inotify.max_user_watches" = 1048576;
-
-  # powertop will default to putting USB devices -- including HID -- to sleep after TWO SECONDS
-  powerManagement.powertop.enable = false;
-  # linux CPU governor: <https://www.kernel.org/doc/Documentation/cpu-freq/governors.txt>
-  # - options:
-  #   - "powersave" => force CPU to always run at lowest supported frequency
-  #   - "performance" => force CPU to always run at highest frequency
-  #   - "ondemand" => adjust frequency based on load
-  #   - "conservative"  (ondemand but slower to adjust)
-  #   - "schedutil"
-  #   - "userspace"
-  # - not all options are available for all platforms
-  #   - intel (intel_pstate) appears to manage scaling w/o intervention/control from the OS.
-  #   - AMD (acpi-cpufreq) appears to manage scaling via the OS *or* HW. but the ondemand defaults never put it to max hardware frequency.
-  #   - qualcomm (cpufreq-dt) appears to manage scaling *only* via the OS. ondemand governor exercises the full range.
-  # - query details with `sudo cpupower frequency-info`
-  powerManagement.cpuFreqGovernor = "ondemand";
-
-  # see: `man logind.conf`
-  # don’t shutdown when power button is short-pressed (commonly done an accident, or by cats).
-  #   but do on long-press: useful to gracefully power-off server.
-  services.logind.powerKey = "lock";
-  services.logind.powerKeyLongPress = "poweroff";
-  services.logind.lidSwitch = "lock";
-
-  # services.snapper.configs = {
-  #   root = {
-  #     subvolume = "/";
-  #     extraConfig = {
-  #       ALLOW_USERS = "colin";
-  #     };
-  #   };
-  # };
-  # services.snapper.snapshotInterval = "daily";
-}

hosts/common/hosts.nix

@@ -2,6 +2,14 @@
 
 {
   # TODO: this should be populated per-host
+  sane.hosts.by-name."crappy" = {
+    ssh.user_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMIvSQAGKqmymXIL4La9B00LPxBIqWAr5AsJxk3UQeY5";
+    ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMN0cpRAloCBOE5/2wuzgik35iNDv5KLceWMCVaa7DIQ";
+    # wg-home.pubkey = "TODO";
+    # wg-home.ip = "10.0.10.55";
+    lan-ip = "10.78.79.55";
+  };
+
   sane.hosts.by-name."desko" = {
     ssh.user_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPU5GlsSfbaarMvDA20bxpSZGWviEzXGD8gtrIowc1pX";
     ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFw9NoRaYrM6LbDd3aFBc4yyBlxGQn8HjeHd/dZ3CfHk";

hosts/common/net/default.nix

@@ -4,6 +4,8 @@
   imports = [
     ./dns.nix
     ./hostnames.nix
+    ./modemmanager.nix
+    ./networkmanager.nix
     ./upnp.nix
     ./vpn.nix
   ];
@@ -24,41 +26,4 @@
   # this is required separately by servo and by any `sane-vpn` users,
   # however Nix requires this be set centrally, in only one location (i.e. here)
   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
-
-  # the default backend is "wpa_supplicant".
-  # wpa_supplicant reliably picks weak APs to connect to.
-  # see: <https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/474>
-  # iwd is an alternative that shouldn't have this problem
-  # docs:
-  # - <https://nixos.wiki/wiki/Iwd>
-  # - <https://iwd.wiki.kernel.org/networkmanager>
-  # - `man iwd.config`  for global config
-  # - `man iwd.network` for per-SSID config
-  # use `iwctl` to control
-  # networking.networkmanager.wifi.backend = "iwd";
-  # networking.wireless.iwd.enable = true;
-  # networking.wireless.iwd.settings = {
-  #   # auto-connect to a stronger network if signal drops below this value
-  #   # bedroom -> bedroom connection is -35 to -40 dBm
-  #   # bedroom -> living room connection is -60 dBm
-  #   General.RoamThreshold = "-52";  # default -70
-  #   General.RoamThreshold5G = "-52";  # default -76
-  # };
-
-  # plugins mostly add support for establishing different VPN connections.
-  # the default plugin set includes mostly proprietary VPNs:
-  # - fortisslvpn (Fortinet)
-  # - iodine (DNS tunnels)
-  # - l2tp
-  # - openconnect (Cisco Anyconnect / Juniper / ocserv)
-  # - openvpn
-  # - vpnc (Cisco VPN)
-  # - sstp
-  #
-  # i don't use these, and notably they drag in huge dependency sets and don't cross compile well.
-  # e.g. openconnect drags in webkitgtk (for SSO)!
-  networking.networkmanager.plugins = lib.mkForce [];
-
-  # keyfile.path = where networkmanager should look for connection credentials
-  networking.networkmanager.settings.keyfile.path = "/var/lib/NetworkManager/system-connections";
 }

hosts/common/net/modemmanager.nix

@@ -0,0 +1,78 @@
+{ config, lib, pkgs, ... }:
+{
+  networking.modemmanager.package = pkgs.modemmanager-split.daemon.overrideAttrs (upstream: {
+    # patch to allow the dbus endpoints to be owned by networkmanager user
+    postInstall = (upstream.postInstall or "") + ''
+      substitute $out/share/dbus-1/system.d/org.freedesktop.ModemManager1.conf \
+        $out/share/dbus-1/system.d/networkmanager-org.freedesktop.ModemManager1.conf \
+        --replace-fail 'user="root"' 'group="networkmanager"'
+    '';
+  });
+
+  systemd.services.ModemManager = {
+    # aliases = [ "dbus-org.freedesktop.ModemManager1.service" ];
+    # after = [ "polkit.service" ];
+    # requires = [ "polkit.service" ];
+    wantedBy = [ "network.target" ];  #< default is `multi-user.target`, somehow it doesn't auto-start with that...
+    # path = [ "/run/current-system/sw" ];  #< so it can find `sanebox`
+
+    # serviceConfig.Type = "dbus";
+    # serviceConfig.BusName = "org.freedesktop.ModemManager1";
+
+    # only if started with `--debug` does mmcli let us issue AT commands like
+    # `mmcli --modem any --command=<AT_CMD>`
+    serviceConfig.ExecStart = [
+      ""  # first blank line is to clear the upstream `ExecStart` field.
+      "${lib.getExe' config.networking.modemmanager.package "ModemManager"} --debug"
+    ];
+    # --debug sets DEBUG level logging: so reset
+    serviceConfig.ExecStartPost = "${lib.getExe config.sane.programs.mmcli.package} --set-logging=INFO";
+
+    # v this is what upstream ships
+    # serviceConfig.Restart = "on-abort";
+    # serviceConfig.StandardError = "null";
+    # serviceConfig.CapabilityBoundingSet = "CAP_SYS_ADMIN CAP_NET_ADMIN";
+    # serviceConfig.ProtectSystem = true;  # makes empty: /boot, /usr
+    # serviceConfig.ProtectHome = true;  # makes empty: /home, /root, /run/user
+    # serviceConfig.PrivateTmp = true;
+    # serviceConfig.RestrictAddressFamilies = "AF_NETLINK AF_UNIX AF_QIPCRTR";
+    # serviceConfig.NoNewPrivileges = true;
+
+    serviceConfig.CapabilityBoundingSet = [ "CAP_NET_ADMIN" ];  #< TODO: make sure this is *really* taking effect, and isn't supplemental to upstream's `CAP_SYS_ADMIN` setting
+    serviceConfig.LockPersonality = true;
+    # serviceConfig.PrivateUsers = true;  #< untried, not likely to work since it needs capabilities
+    serviceConfig.PrivateTmp = true;
+    serviceConfig.ProtectClock = true;  # syscall filter to prevent changing the RTC
+    serviceConfig.ProtectControlGroups = true;
+    serviceConfig.ProtectHome = true;  # makes empty: /home, /root, /run/user
+    serviceConfig.ProtectHostname = true;  # prevents changing hostname
+    serviceConfig.ProtectKernelLogs = true;  # disable /proc/kmsg, /dev/kmsg
+    serviceConfig.ProtectKernelModules = true;  # syscall filter to prevent module calls
+    serviceConfig.ProtectKernelTunables = true;
+    serviceConfig.ProtectSystem = "strict";  # makes read-only all but /dev, /proc, /sys
+    serviceConfig.RestrictAddressFamilies = [
+      "AF_NETLINK"
+      "AF_QIPCRTR"
+      "AF_UNIX"
+    ];
+    serviceConfig.RestrictSUIDSGID = true;
+    serviceConfig.SystemCallArchitectures = "native";  # prevents e.g. aarch64 syscalls in the event that the kernel is multi-architecture.
+
+    # from earlier `landlock` sandboxing, i know it needs these directories:
+    # - # "/"
+    # - "/dev" #v modem-power + net are not enough
+    # - # "/dev/modem-power"
+    # - # "/dev/net"
+    # - "/proc"
+    # - # /run  #v can likely be reduced more
+    # - "/run/dbus"
+    # - "/run/NetworkManager"
+    # - "/run/resolvconf"
+    # - "/run/systemd"
+    # - "/run/udev"
+    # - "/sys"
+  };
+
+  # so that ModemManager can discover when the modem appears
+  # services.udev.packages = lib.mkIf cfg.enabled [ cfg.package ];
+}

hosts/common/net/networkmanager.nix

@@ -0,0 +1,268 @@
+{ config, pkgs, ... }:
+let
+  # networkmanager = pkgs.networkmanager;
+  networkmanager = pkgs.networkmanager.overrideAttrs (upstream: {
+    src = pkgs.fetchFromGitea {
+      domain = "git.uninsane.org";
+      owner = "colin";
+      repo = "NetworkManager";
+      # patched to fix polkit permissions (with `nmcli`) when NetworkManager runs as user networkmanager
+      rev = "dev-sane-1.48.0";
+      hash = "sha256-vGmOKtwVItxjYioZJlb1og3K6u9s4rcmDnjAPLBC3ao=";
+    };
+    # patches = [];
+  });
+  # split the package into `daemon` and `nmcli` outputs, because the networkmanager *service*
+  # doesn't need `nmcli`/`nmtui` tooling
+  networkmanager-split = pkgs.networkmanager-split.override { inherit networkmanager; };
+in {
+  networking.networkmanager.enable = true;
+  # plugins mostly add support for establishing different VPN connections.
+  # the default plugin set includes mostly proprietary VPNs:
+  # - fortisslvpn (Fortinet)
+  # - iodine (DNS tunnels)
+  # - l2tp
+  # - openconnect (Cisco Anyconnect / Juniper / ocserv)
+  # - openvpn
+  # - vpnc (Cisco VPN)
+  # - sstp
+  #
+  # i don't use these, and notably they drag in huge dependency sets and don't cross compile well.
+  # e.g. openconnect drags in webkitgtk (for SSO)!
+  # networking.networkmanager.plugins = lib.mkForce [];
+  networking.networkmanager.enableDefaultPlugins = false;
+
+  networking.networkmanager.package = networkmanager-split.daemon.overrideAttrs (upstream: {
+    # postPatch = (upstream.postPatch or "") + ''
+    #   substituteInPlace src/{core/org.freedesktop.NetworkManager,nm-dispatcher/nm-dispatcher}.conf --replace-fail \
+    #     'user="root"' 'user="networkmanager"'
+    # '';
+    postInstall = (upstream.postInstall or "") + ''
+      # allow the bus to owned by either root or networkmanager users
+      # use the group here, that way ordinary users can be elevated to control networkmanager
+      # (via e.g. `nmcli`)
+      for f in org.freedesktop.NetworkManager.conf nm-dispatcher.conf ; do
+        substitute $out/share/dbus-1/system.d/$f \
+          $out/share/dbus-1/system.d/networkmanager-$f \
+          --replace-fail 'user="root"' 'group="networkmanager"'
+      done
+
+      # remove unused services to prevent any unexpected interactions
+      rm $out/etc/systemd/system/{nm-cloud-setup.service,nm-cloud-setup.timer,nm-priv-helper.service}
+    '';
+  });
+
+  # fixup the services to run as `networkmanager` and with less permissions
+  systemd.services.NetworkManager = {
+    serviceConfig.RuntimeDirectory = "NetworkManager";  #< tells systemd to create /run/NetworkManager
+    # serviceConfig.StateDirectory = "NetworkManager";  #< tells systemd to create /var/lib/NetworkManager
+    serviceConfig.User = "networkmanager";
+    serviceConfig.Group = "networkmanager";
+    serviceConfig.AmbientCapabilities = [
+      # "CAP_DAC_OVERRIDE"
+      "CAP_NET_ADMIN"
+      "CAP_NET_RAW"  #< required, else `libndp: ndp_sock_open: Failed to create ICMP6 socket.`
+      "CAP_NET_BIND_SERVICE"  #< this *does* seem to be necessary, though i don't understand why. DHCP?
+      # "CAP_SYS_MODULE"
+      # "CAP_AUDIT_WRITE"  #< allow writing to the audit log (optional)
+      # "CAP_KILL"
+    ];
+    serviceConfig.LockPersonality = true;
+    serviceConfig.NoNewPrivileges = true;
+    serviceConfig.PrivateDevices = true;  # remount /dev with just the basics, syscall filter to block @raw-io
+    serviceConfig.PrivateIPC = true;
+    serviceConfig.PrivateTmp = true;
+    # serviceConfig.PrivateUsers = true;  #< BREAKS NetworkManager (presumably, it causes a new user namespace, breaking CAP_NET_ADMIN & others).  "platform-linux: do-change-link[3]: failure 1 (Operation not permitted)"
+    serviceConfig.ProtectClock = true;  # syscall filter to prevent changing the RTC
+    serviceConfig.ProtectControlGroups = true;
+    serviceConfig.ProtectHome = true;  # makes empty: /home, /root, /run/user
+    serviceConfig.ProtectHostname = true;  # probably not upstreamable: prevents changing hostname
+    serviceConfig.ProtectKernelLogs = true;  # disable /proc/kmsg, /dev/kmsg
+    serviceConfig.ProtectKernelModules = true;  # syscall filter to prevent module calls (probably not upstreamable: NM will want to load modules like `ppp`)
+    serviceConfig.ProtectKernelTunables = true;  # but NM might need to write /proc/sys/net/...
+    serviceConfig.ProtectSystem = "strict";  # makes read-only: all but /dev, /proc, /sys.
+    serviceConfig.RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+      "AF_NETLINK"  # breaks near DHCP without this
+      "AF_PACKET"  # for DHCP
+      "AF_UNIX"
+      # AF_ALG ?
+      # AF_BLUETOOTH ?
+      # AF_BRIDGE ?
+    ];
+    serviceConfig.RestrictSUIDSGID = true;
+    serviceConfig.SystemCallArchitectures = "native";  # prevents e.g. aarch64 syscalls in the event that the kernel is multi-architecture.
+    # from earlier `landlock` sandboxing, i know it needs these directories:
+    # - "/proc/net"
+    # - "/proc/sys/net"
+    # - "/run/NetworkManager"
+    # - "/run/systemd"  # for trust-dns-nmhook
+    # - "/run/udev"
+    # - # "/run/wg-home.priv"
+    # - "/sys/class"
+    # - "/sys/devices"
+    # - "/var/lib/NetworkManager"
+    # - "/var/lib/trust-dns"  #< for trust-dns-nmhook
+    # - "/run/systemd"
+  };
+
+  systemd.services.NetworkManager-wait-online = {
+    serviceConfig.User = "networkmanager";
+    serviceConfig.Group = "networkmanager";
+  };
+
+  # fix NetworkManager-dispatcher to actually run as a daemon,
+  # and sandbox it a bit
+  systemd.services.NetworkManager-dispatcher = {
+    after = [ "trust-dns-localhost.service" ];  #< so that /var/lib/trust-dns will exist
+    # serviceConfig.ExecStart = [
+    #   ""  # first blank line is to clear the upstream `ExecStart` field.
+    #   "${cfg.package}/libexec/nm-dispatcher --persist"  # --persist is needed for it to actually run as a daemon
+    # ];
+    # serviceConfig.Restart = "always";
+    # serviceConfig.RestartSec = "1s";
+
+    # serviceConfig.DynamicUser = true;  #< not possible, else we lose group perms (so can't write to `trust-dns`'s files in the nm hook)
+    serviceConfig.User = "networkmanager";  # TODO: should arguably use `DynamicUser`
+    serviceConfig.Group = "networkmanager";
+    serviceConfig.LockPersonality = true;
+    serviceConfig.NoNewPrivileges = true;
+    serviceConfig.PrivateDevices = true;  # remount /dev with just the basics, syscall filter to block @raw-io
+    serviceConfig.PrivateIPC = true;
+    serviceConfig.PrivateTmp = true;
+    serviceConfig.PrivateUsers = true;
+    serviceConfig.ProtectClock = true;  # syscall filter to prevent changing the RTC
+    serviceConfig.ProtectControlGroups = true;
+    serviceConfig.ProtectHome = true;  # makes empty: /home, /root, /run/user
+    serviceConfig.ProtectHostname = true;  # probably not upstreamable: prevents changing hostname
+    serviceConfig.ProtectKernelLogs = true;  # disable /proc/kmsg, /dev/kmsg
+    serviceConfig.ProtectKernelModules = true;  # syscall filter to prevent module calls
+    serviceConfig.ProtectKernelTunables = true;
+    serviceConfig.ProtectSystem = "full";  # makes read-only: /boot, /etc/, /usr. `strict` isn't possible due to trust-dns hook
+    serviceConfig.RestrictAddressFamilies = [
+      "AF_UNIX"  # required, probably for dbus or systemd connectivity
+    ];
+    serviceConfig.RestrictSUIDSGID = true;
+    serviceConfig.SystemCallArchitectures = "native";  # prevents e.g. aarch64 syscalls in the event that the kernel is multi-architecture.
+  };
+
+  # harden wpa_supplicant (used by NetworkManager)
+  systemd.services.wpa_supplicant = {
+    serviceConfig.User = "networkmanager";
+    serviceConfig.Group = "networkmanager";
+    serviceConfig.AmbientCapabilities = [
+      "CAP_NET_ADMIN"
+      "CAP_NET_RAW"
+    ];
+    serviceConfig.LockPersonality = true;
+    serviceConfig.NoNewPrivileges = true;
+    # serviceConfig.PrivateDevices = true;  # untried, not likely to work. remount /dev with just the basics, syscall filter to block @raw-io
+    serviceConfig.PrivateIPC = true;
+    serviceConfig.PrivateTmp = true;
+    # serviceConfig.PrivateUsers = true;  #< untried, not likely to work
+    serviceConfig.ProtectClock = true;  # syscall filter to prevent changing the RTC
+    serviceConfig.ProtectControlGroups = true;
+    serviceConfig.ProtectHome = true;  # makes empty: /home, /root, /run/user
+    serviceConfig.ProtectHostname = true;  # prevents changing hostname
+    serviceConfig.ProtectKernelLogs = true;  # disable /proc/kmsg, /dev/kmsg
+    serviceConfig.ProtectKernelModules = true;  # syscall filter to prevent module calls
+    serviceConfig.ProtectKernelTunables = true;  #< N.B.: i think this makes certain /proc writes fail
+    serviceConfig.ProtectSystem = "strict";  # makes read-only: all but /dev, /proc, /sys.
+    serviceConfig.RestrictAddressFamilies = [
+      "AF_INET"  #< required
+      "AF_INET6"
+      "AF_NETLINK"  #< required
+      "AF_PACKET"  #< required
+      "AF_UNIX"  #< required (wpa_supplicant wants to use dbus)
+    ];
+    serviceConfig.RestrictSUIDSGID = true;
+    serviceConfig.SystemCallArchitectures = "native";  # prevents e.g. aarch64 syscalls in the event that the kernel is multi-architecture.
+
+    # from earlier `landlock` sandboxing, i know it needs only these paths:
+    # - "/dev/net"
+    # - "/dev/rfkill"
+    # - "/proc/sys/net"
+    # - "/sys/class/net"
+    # - "/sys/devices"
+    # - "/run/systemd"
+  };
+
+  networking.networkmanager.settings = {
+    # keyfile.path = where networkmanager should look for connection credentials
+    keyfile.path = "/var/lib/NetworkManager/system-connections";
+
+    # wifi.backend = "wpa_supplicant";  #< default
+    # wifi.scan-rand-mac-address = true;  #< default
+
+    # logging.audit = false;  #< default
+    logging.level = "INFO";
+
+    # main.dhcp = "internal";  #< default
+    main.dns = if config.services.resolved.enable then
+      "systemd-resolved"
+    else if config.sane.services.trust-dns.enable && config.sane.services.trust-dns.asSystemResolver then
+      "none"
+    else
+      "internal"
+    ;
+    main.systemd-resolved = false;
+  };
+  environment.etc."NetworkManager/system-connections".source = "/var/lib/NetworkManager/system-connections";
+
+  # the default backend is "wpa_supplicant".
+  # wpa_supplicant reliably picks weak APs to connect to.
+  # see: <https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/474>
+  # iwd is an alternative that shouldn't have this problem
+  # docs:
+  # - <https://nixos.wiki/wiki/Iwd>
+  # - <https://iwd.wiki.kernel.org/networkmanager>
+  # - `man iwd.config`  for global config
+  # - `man iwd.network` for per-SSID config
+  # use `iwctl` to control
+  # networking.networkmanager.wifi.backend = "iwd";
+  # networking.wireless.iwd.enable = true;
+  # networking.wireless.iwd.settings = {
+  #   # auto-connect to a stronger network if signal drops below this value
+  #   # bedroom -> bedroom connection is -35 to -40 dBm
+  #   # bedroom -> living room connection is -60 dBm
+  #   General.RoamThreshold = "-52";  # default -70
+  #   General.RoamThreshold5G = "-52";  # default -76
+  # };
+
+  # allow networkmanager to control systemd-resolved,
+  # which it needs to do to apply new DNS settings when using systemd-resolved.
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if (subject.isInGroup("networkmanager") && action.id.indexOf("org.freedesktop.resolve1.") == 0) {
+        return polkit.Result.YES;
+      }
+    });
+  '';
+
+  users.users.networkmanager = {
+    isSystemUser = true;
+    group = "networkmanager";
+    extraGroups = [ "trust-dns" ];
+  };
+
+  # there is, unfortunately, no proper interface by which to plumb wpa_supplicant into the NixOS service, except by overlay.
+  nixpkgs.overlays = [(self: super: {
+    wpa_supplicant = super.wpa_supplicant.overrideAttrs (upstream: {
+      # postPatch = (upstream.postPatch or "") + ''
+      #   substituteInPlace wpa_supplicant/dbus/dbus-wpa_supplicant.conf --replace-fail \
+      #     'user="root"' 'user="networkmanager"'
+      # '';
+      postInstall = (upstream.postInstall or "") + ''
+        substitute $out/share/dbus-1/system.d/dbus-wpa_supplicant.conf \
+          $out/share/dbus-1/system.d/networkmanager-wpa_supplicant.conf \
+          --replace-fail 'user="root"' 'group="networkmanager"'
+      '';
+
+      postFixup = (upstream.postFixup or "") + ''
+        # remove unused services to avoid unexpected interactions
+        rm $out/etc/systemd/system/{wpa_supplicant-nl80211@,wpa_supplicant-wired@,wpa_supplicant@}.service
+      '';
+    });
+  })];
+}

hosts/common/programs/assorted.nix

@@ -71,12 +71,14 @@ in
       "man-pages"
       "man-pages-posix"
       # "miniupnpc"
+      "mmcli"
       "nano"
       #  "ncdu"  # ncurses disk usage. doesn't cross compile (zig)
       "neovim"
       "netcat"
       "nethogs"
       "nmap"
+      "nmcli"
       "nvme-cli"  # nvme
       # "openssl"
       "parted"
@@ -238,6 +240,7 @@ in
       # "powermanga"    # STYLISH space invaders derivative (keyboard-only)
       "shattered-pixel-dungeon"  # doesn't cross compile
       "space-cadet-pinball"  # LMB/RMB controls (bindable though. volume buttons?)
+      "steam"
       "superTux"  # keyboard-only controls
       "superTuxKart"  # poor FPS on pinephone
       "tumiki-fighters" # keyboard-only
@@ -371,7 +374,6 @@ in
       # "slic3r"
       "soundconverter"
       "spotify"  # x86-only
-      "steam"
       "tor-browser"  # x86-only
       # "vlc"
       "wireshark"  # could maybe ship the cli as sysadmin pkg

hosts/common/programs/brave.nix

@@ -1,6 +1,12 @@
-{ ... }:
+{ pkgs, ... }:
 {
   sane.programs.brave = {
+    # convert eval error to build failure
+    packageUnwrapped = if (builtins.tryEval pkgs.brave).success then
+      pkgs.brave
+    else
+      pkgs.runCommandLocal "brave-not-supported" {} "false"
+    ;
     sandbox.method = "bwrap";
     sandbox.wrapperType = "inplace";  # /opt/share/brave.com vendor-style packaging
     sandbox.net = "all";

hosts/common/programs/default.nix

@@ -81,13 +81,11 @@
     ./mepo.nix
     ./mimeo
     ./mmcli.nix
-    ./modemmanager.nix
     ./mopidy.nix
     ./mpv
     ./msmtp.nix
     ./nautilus.nix
     ./neovim.nix
-    ./networkmanager.nix
     ./newsflash.nix
     ./nheko.nix
     ./nicotine-plus.nix
@@ -144,7 +142,6 @@
     ./wine.nix
     ./wireplumber.nix
     ./wireshark.nix
-    ./wpa_supplicant.nix
     ./wvkbd.nix
     ./xarchiver.nix
     ./xdg-desktop-portal.nix

hosts/common/programs/eg25-control.nix

@@ -4,7 +4,7 @@ let
 in
 {
   sane.programs.eg25-control = {
-    suggestedPrograms = [ "modemmanager" ];
+    suggestedPrograms = [ "mmcli" ];
 
     services.eg25-control-powered = {
       description = "eg25-control-powered: power to the Qualcomm eg25 modem used by PinePhone";

hosts/common/programs/modemmanager.nix

@@ -1,81 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.sane.programs.modemmanager;
-in
-{
-  sane.programs.modemmanager = {
-    packageUnwrapped = pkgs.modemmanager-split.daemon.overrideAttrs (upstream: {
-      postInstall = (upstream.postInstall or "") + ''
-        substitute $out/share/dbus-1/system.d/org.freedesktop.ModemManager1.conf \
-          $out/share/dbus-1/system.d/networkmanager-org.freedesktop.ModemManager1.conf \
-          --replace-fail 'user="root"' 'group="networkmanager"'
-      '';
-
-      meta = upstream.meta // {
-        mainProgram = "ModemManager";
-      };
-    });
-    # mmcli needs /run/current-system/sw/share/dbus-1 files to function
-    enableFor.system = lib.mkIf (builtins.any (en: en) (builtins.attrValues cfg.enableFor.user)) true;
-
-    suggestedPrograms = [ "mmcli" ];
-
-    # bwrap sandboxing works, but requires the real user to be root.
-    # landlock sandboxing works, and allows the real user to be someone else (like `networkmanager`).
-    # non-root is very important, because of how many things in e.g. /dev are r/w based on uid=0.
-    # TODO: have the services run as `networkmanager` user
-    sandbox.method = "bwrap";
-    # sandbox.method = "landlock";
-    sandbox.wrapperType = "inplace";  #< .pc files, GIR files with absolute paths,
-    sandbox.net = "all";  #< needed for modem bringup
-    # sandbox.isolatePids = false;
-    sandbox.capabilities = [
-      "net_admin"
-      "net_raw"
-    ];
-    sandbox.extraPaths = lib.warn "TODO: modemmanager: sandbox more aggressively" [
-      # "/"
-      "/dev" #v modem-power + net are not enough
-      # "/dev/modem-power"
-      # "/dev/net"
-      "/proc"
-      # /run  #v can likely be reduced more
-      "/run/dbus"
-      "/run/NetworkManager"
-      "/run/resolvconf"
-      "/run/systemd"
-      "/run/udev"
-      "/sys"
-      # "/var"
-    ];
-  };
-
-  systemd.services.ModemManager = lib.mkIf cfg.enabled {
-    aliases = [ "dbus-org.freedesktop.ModemManager1.service" ];
-    after = [ "polkit.service" ];
-    requires = [ "polkit.service" ];
-    wantedBy = [ "network.target" ];
-    path = [ "/run/current-system/sw" ];  #< so it can find `sanebox`
-
-    serviceConfig.Type = "dbus";
-    serviceConfig.BusName = "org.freedesktop.ModemManager1";
-
-    # only if started with `--debug` does mmcli let us issue AT commands like
-    # `mmcli --modem any --command=<AT_CMD>`
-    serviceConfig.ExecStart = "${lib.getExe cfg.package} --debug";
-    # --debug sets DEBUG level logging: so reset
-    serviceConfig.ExecStartPost = "${lib.getExe config.sane.programs.mmcli.package} --set-logging=INFO";
-
-    serviceConfig.Restart = "on-abort";
-    serviceConfig.StandardError = "null";
-    serviceConfig.CapabilityBoundingSet = "CAP_SYS_ADMIN CAP_NET_ADMIN";
-    serviceConfig.ProtectSystem = true;
-    serviceConfig.ProtectHome = true;
-    serviceConfig.PrivateTmp = true;
-    serviceConfig.RestrictAddressFamilies = "AF_NETLINK AF_UNIX AF_QIPCRTR";
-    serviceConfig.NoNewPrivileges = true;
-  };
-
-  # so that ModemManager can discover when the modem appears
-  services.udev.packages = lib.mkIf cfg.enabled [ cfg.package ];
-}

hosts/common/programs/mpv/default.nix

@@ -135,65 +135,54 @@ let
         'cycle_key = "c"' 'cycle_key = "v"'
     '';
   });
-  mpv-unwrapped = pkgs.mpv-unwrapped.overrideAttrs (upstream: {
-    version = "0.37.0-unstable-2024-03-31";
-    src = lib.warnIf (lib.versionOlder "0.37.0" upstream.version) "mpv outdated; remove patch?" pkgs.fetchFromGitHub {
-      owner = "mpv-player";
-      repo = "mpv";
-      rev = "4ce4bf1795e6dfd6f1ddf07fb348ce5d191ab1dc";
-      hash = "sha256-nOGuHq7SWDAygROV7qHtezDv1AsMpseImI8TVd3F+Oc=";
-    };
-    patches = [];
-  });
 in
 {
   sane.programs.mpv = {
-    packageUnwrapped = pkgs.wrapMpv
-      (mpv-unwrapped.override rec {
+    packageUnwrapped = pkgs.mpv-unwrapped.wrapper {
+      mpv = pkgs.mpv-unwrapped.override rec {
         # N.B.: populating `self` to `luajit` is necessary for the resulting `lua.withPackages` function to preserve my override.
         # i use enable52Compat in order to get `table.unpack`.
         # i think using `luajit` here instead of `lua` is optional, just i get better perf with it :)
         lua = pkgs.luajit.override { enable52Compat = true; self = lua; };
-      })
-      {
-        scripts = [
-          pkgs.mpvScripts.mpris
-          pkgs.mpvScripts.mpv-playlistmanager
-          pkgs.mpvScripts.mpv-webm
-          uosc
-          visualizer
-          # pkgs.mpv-uosc-latest
-        ];
-        # extraMakeWrapperArgs = lib.optionals (cfg.config.vo != null) [
-        #   # 2023/08/29: fixes an error where mpv on moby launches with the message
-        #   #   "DRM_IOCTL_MODE_CREATE_DUMB failed: Cannot allocate memory"
-        #   #   audio still works, and controls, screenshotting, etc -- just not the actual rendering
-        #   #
-        #   #   this is likely a regression for mpv 0.36.0.
-        #   #   the actual error message *appears* to come from the mesa library, but it's tough to trace.
-        #   #
-        #   # 2024/03/02: no longer necessary, with mesa 23.3.1: <https://github.com/NixOS/nixpkgs/pull/265740>
-        #   #
-        #   # backend compatibility (2023/10/22):
-        #   # run with `--vo=help` to see a list of all output options.
-        #   # non-exhaustive (W=works, F=fails, A=audio-only, U=audio+ui only (no video))
-        #   # ? null             Null video output
-        #   # A (default)
-        #   # A dmabuf-wayland   Wayland dmabuf video output
-        #   # A libmpv           render API for libmpv  (mpv plays the audio, but doesn't even render a window)
-        #   # A vdpau            VDPAU with X11
-        #   # F drm              Direct Rendering Manager (software scaling)
-        #   # F gpu-next         Video output based on libplacebo
-        #   # F vaapi            VA API with X11
-        #   # F x11              X11 (software scaling)
-        #   # F xv               X11/Xv
-        #   # U gpu              Shader-based GPU Renderer
-        #   # W caca             libcaca  (terminal rendering)
-        #   # W sdl              SDL 2.0 Renderer
-        #   # W wlshm            Wayland SHM video output (software scaling)
-        #   "--add-flags" "--vo=${cfg.config.vo}"
-        # ];
       };
+      scripts = [
+        pkgs.mpvScripts.mpris
+        pkgs.mpvScripts.mpv-playlistmanager
+        pkgs.mpvScripts.mpv-webm
+        uosc
+        visualizer
+        # pkgs.mpv-uosc-latest
+      ];
+      # extraMakeWrapperArgs = lib.optionals (cfg.config.vo != null) [
+      #   # 2023/08/29: fixes an error where mpv on moby launches with the message
+      #   #   "DRM_IOCTL_MODE_CREATE_DUMB failed: Cannot allocate memory"
+      #   #   audio still works, and controls, screenshotting, etc -- just not the actual rendering
+      #   #
+      #   #   this is likely a regression for mpv 0.36.0.
+      #   #   the actual error message *appears* to come from the mesa library, but it's tough to trace.
+      #   #
+      #   # 2024/03/02: no longer necessary, with mesa 23.3.1: <https://github.com/NixOS/nixpkgs/pull/265740>
+      #   #
+      #   # backend compatibility (2023/10/22):
+      #   # run with `--vo=help` to see a list of all output options.
+      #   # non-exhaustive (W=works, F=fails, A=audio-only, U=audio+ui only (no video))
+      #   # ? null             Null video output
+      #   # A (default)
+      #   # A dmabuf-wayland   Wayland dmabuf video output
+      #   # A libmpv           render API for libmpv  (mpv plays the audio, but doesn't even render a window)
+      #   # A vdpau            VDPAU with X11
+      #   # F drm              Direct Rendering Manager (software scaling)
+      #   # F gpu-next         Video output based on libplacebo
+      #   # F vaapi            VA API with X11
+      #   # F x11              X11 (software scaling)
+      #   # F xv               X11/Xv
+      #   # U gpu              Shader-based GPU Renderer
+      #   # W caca             libcaca  (terminal rendering)
+      #   # W sdl              SDL 2.0 Renderer
+      #   # W wlshm            Wayland SHM video output (software scaling)
+      #   "--add-flags" "--vo=${cfg.config.vo}"
+      # ];
+    };
 
     suggestedPrograms = [
       "blast-to-default"

hosts/common/programs/neovim.nix

@@ -14,7 +14,8 @@ let
       # docs: https://github.com/nvim-treesitter/nvim-treesitter
       # config taken from: https://github.com/i077/system/blob/master/modules/home/neovim/default.nix
       # this is required for tree-sitter to even highlight
-      plugin = nvim-treesitter.withPlugins (_: nvim-treesitter.allGrammars ++ [
+      # XXX(2024/06/03): `unison` removed because it doesn't cross compile
+      plugin = nvim-treesitter.withPlugins (_: (lib.filter (p: p.pname != "unison-grammar") nvim-treesitter.allGrammars) ++ [
         # XXX: this is apparently not enough to enable syntax highlighting!
         # nvim-treesitter ships its own queries which may be distinct from e.g. helix.
         # the queries aren't included when i ship the grammar in this manner
@@ -167,9 +168,27 @@ in
               vim.mpack.decode = vim.mpack.unpack
               vim.lpeg = require 'lpeg'
             "
-        '' + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-          substituteInPlace runtime/CMakeLists.txt --replace-fail \
-            'COMMAND $<TARGET_FILE:nvim_bin>' 'COMMAND ${pkgs.stdenv.hostPlatform.emulator pkgs.buildPackages} $<TARGET_FILE:nvim_bin>'
+        ''
+        # + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+        #   # required for x86_64 -> aarch64 (and probably armv7l too)
+        #   substituteInPlace runtime/CMakeLists.txt --replace-fail \
+        #     'COMMAND $<TARGET_FILE:nvim_bin>' 'COMMAND ${pkgs.stdenv.hostPlatform.emulator pkgs.buildPackages} $<TARGET_FILE:nvim_bin>'
+        # ''
+        + ''
+          # disable translations and syntax highlighting of .vim files because they don't cross x86_64 -> armv7l
+          substituteInPlace src/nvim/CMakeLists.txt --replace-fail \
+            'add_subdirectory(po)' '# add_subdirectory(po)'
+          # substituteInPlace src/nvim/po/CMakeLists.txt --replace-fail \
+          #   'add_dependencies(nvim nvim_translations)' '# add_dependencies(nvim nvim_translations)'
+          substituteInPlace runtime/CMakeLists.txt \
+            --replace-fail '    ''${GENERATED_SYN_VIM}' '    # ''${GENERATED_SYN_VIM}' \
+            --replace-fail '    ''${GENERATED_HELP_TAGS}' '    # ''${GENERATED_HELP_TAGS}' \
+            --replace-fail 'FILES ''${GENERATED_HELP_TAGS} ''${BUILDDOCFILES}'  'FILES ''${CMAKE_CURRENT_SOURCE_DIR}/nvim.desktop' \
+            --replace-fail 'FILES ''${GENERATED_SYN_VIM}'  'FILES ''${CMAKE_CURRENT_SOURCE_DIR}/nvim.desktop' \
+            --replace-fail 'if(''${PACKNAME}_DOC_FILES)' 'if(false)'
+          # --replace-fail '    ''${GENERATED_PACKAGE_TAGS}' '     # ''${GENERATED_PACKAGE_TAGS}' \
+          # --replace-fail 'list(APPEND BUILDDOCFILES' '# list(APPEND BUILDDOCFILES'
+          # --replace-fail '  FILES ''${GENERATED_HELP_TAGS} ' '  FILES ' \
         '';
       });
     in pkgs.wrapNeovimUnstable

hosts/common/programs/networkmanager.nix

@@ -1,209 +0,0 @@
-# Network Manager:
-# i manage this myself because the nixos service is not flexible enough.
-# - it unconditionally puts modemmanager onto the system path, preventing me from patching modemmanager's service file (without an overlay).
-#
-# XXX: it's normal to see error messages on an ethernet-only host, even when using nixos' official networkmanager service:
-# - `Couldn't initialize supplicant interface: Failed to D-Bus activate wpa_supplicant service`
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.sane.programs.networkmanager;
-  networkmanager = pkgs.networkmanager.overrideAttrs (upstream: {
-    src = pkgs.fetchFromGitea {
-      domain = "git.uninsane.org";
-      owner = "colin";
-      repo = "NetworkManager";
-      rev = "dev-sane-1.46.0";
-      hash = "sha256-S5ZiOfCpwtVVVO+DP6OPodJqzSc/LW4waI42DRkT+RA=";
-    };
-    # patches = [];
-  });
-  networkmanager-split = pkgs.networkmanager-split.override { inherit networkmanager; };
-in
-{
-  config = lib.mkMerge [
-    {
-      sane.programs.networkmanager = {
-        packageUnwrapped = networkmanager-split.daemon.overrideAttrs (upstream: {
-          # postPatch = (upstream.postPatch or "") + ''
-          #   substituteInPlace src/{core/org.freedesktop.NetworkManager,nm-dispatcher/nm-dispatcher}.conf --replace-fail \
-          #     'user="root"' 'user="networkmanager"'
-          # '';
-          postInstall = (upstream.postInstall or "") + ''
-            # allow the bus to owned by either root or networkmanager users
-            # use the group here, that way ordinary users can be elevated to control networkmanager
-            # (via e.g. `nmcli`)
-            for f in org.freedesktop.NetworkManager.conf nm-dispatcher.conf ; do
-              substitute $out/share/dbus-1/system.d/$f \
-                $out/share/dbus-1/system.d/networkmanager-$f \
-                --replace-fail 'user="root"' 'group="networkmanager"'
-            done
-
-            # remove unused services to prevent any unexpected interactions
-            rm $out/etc/systemd/system/{nm-cloud-setup.service,nm-cloud-setup.timer,nm-priv-helper.service}
-          '';
-        });
-
-        suggestedPrograms = [ "nmcli" "wpa_supplicant" ];
-        enableFor.system = lib.mkIf (builtins.any (en: en) (builtins.attrValues cfg.enableFor.user)) true;
-
-        # this contains both the NetworkManager service and the NetworkManager-dispatcher service
-        # the latter of which calls a lot of user code.
-        # as a result, this needs all the perms which my hook in modules/services/trust-dns/trust-dns-nmhook needs.
-        sandbox.method = "landlock";
-        sandbox.capabilities = [
-          # "dac_override"
-          "net_admin"
-          "net_raw"
-          "net_bind_service"  #< TODO: is this needed? why? (DNS?)
-          # "sys_module"
-          "audit_write"  #< allow writing to the audit log
-          # "kill"
-        ];
-        sandbox.extraPaths = [
-          "/proc/net"
-          "/proc/sys/net"
-          "/run/NetworkManager"
-          "/run/systemd"  # for trust-dns-nmhook
-          "/run/udev"
-          # "/run/wg-home.priv"
-          "/sys/class"  #< TODO: specify this more precisely
-          "/sys/devices"
-          "/var/lib/NetworkManager"
-          "/var/lib/trust-dns"  #< for trust-dns-nmhook
-        ];
-
-        sandbox.whitelistDbus = [ "system" ];
-      };
-    }
-
-    (lib.mkIf cfg.enabled {
-      # add to systemd.packages so we get the service file it ships, then override what we need to customize (taken from nixpkgs)
-      systemd.packages = [ cfg.package ];
-      systemd.services.NetworkManager = {
-        wantedBy = [ "network.target" ];
-        aliases = [ "dbus-org.freedesktop.NetworkManager.service" ];
-
-        path = [ "/run/current-system/sw" ];  #< so it can find `sanebox`
-        serviceConfig.RuntimeDirectory = "NetworkManager";  #< tells systemd to create /run/NetworkManager
-        serviceConfig.StateDirectory = "NetworkManager";  #< tells systemd to create /var/lib/NetworkManager
-        serviceConfig.User = "networkmanager";
-        serviceConfig.Group = "networkmanager";
-        serviceConfig.AmbientCapabilities = [
-          # "CAP_DAC_OVERRIDE"
-          "CAP_NET_ADMIN"
-          "CAP_NET_RAW"
-          "CAP_NET_BIND_SERVICE"  #< this *does* seem to be necessary, though i don't understand why. DHCP?
-          # "CAP_SYS_MODULE"
-          "CAP_AUDIT_WRITE"  #< allow writing to the audit log
-          # "CAP_KILL"
-        ];
-      };
-
-      systemd.services.NetworkManager-wait-online = {
-        path = [ "/run/current-system/sw" ];  #< so `nm-online` can find `sanebox`
-        wantedBy = [ "network-online.target" ];
-        serviceConfig.User = "networkmanager";
-        serviceConfig.Group = "networkmanager";
-      };
-
-      systemd.services.NetworkManager-dispatcher = {
-        wantedBy = [ "NetworkManager.service" ];
-        after = [ "trust-dns-localhost.service" ];  #< so that /var/lib/trust-dns will exist
-        path = [ "/run/current-system/sw" ];  #< so it can find `sanebox`
-        # to debug, add NM_DISPATCHER_DEBUG_LOG=1
-        serviceConfig.ExecStart = [
-          ""  # first blank line is to clear the upstream `ExecStart` field.
-          "${cfg.package}/libexec/nm-dispatcher --persist"  # --persist is needed for it to actually run as a daemon
-        ];
-        serviceConfig.Restart = "always";
-        serviceConfig.RestartSec = "1s";
-        serviceConfig.User = "networkmanager";
-        serviceConfig.Group = "networkmanager";
-      };
-
-      environment.etc = {
-        "NetworkManager/system-connections".source = "/var/lib/NetworkManager/system-connections";
-        "NetworkManager/NetworkManager.conf".text = ''
-          [device]
-          # wifi.backend: wpa_supplicant or iwd
-          wifi.backend=wpa_supplicant
-          wifi.scan-rand-mac-address=true
-
-          [logging]
-          audit=false
-          # level: TRACE, DEBUG, INFO, WARN, ERR, OFF
-          level=INFO
-          # domain=...
-
-          [main]
-          # dhcp:
-          # - `internal` (default)
-          # - `dhclient` (requires dhclient to be installed)
-          # - `dhcpcd`   (requires dhcpcd to be installed)
-          dhcp=internal
-          # dns:
-          # - `default`: update /etc/resolv.conf with nameservers provided by the active connection
-          # - `none`: NM won't update /etc/resolv.conf
-          # - `systemd-resolved`: push DNS config to systemd-resolved
-          # - `dnsmasq`: run a local caching nameserver
-          dns=${if config.services.resolved.enable then
-            "systemd-resolved"
-          else if config.sane.services.trust-dns.enable && config.sane.services.trust-dns.asSystemResolver then
-            "none"
-          else
-            "internal"
-          }
-          plugins=keyfile
-          # rc-manager: how NM should write to /etc/resolv.conf
-          # - regardless of this setting, NM will write /var/lib/NetworkManager/resolv.conf
-          rc-manager=unmanaged
-          # systemd-resolved: send DNS config to systemd-resolved?
-          # this setting has no effect if dns="systemd-resolved"; it's supplementary, not absolute.
-          systemd-resolved=false
-          # debug=...  (see also: NM_DEBUG env var)
-        '';
-      };
-
-      hardware.wirelessRegulatoryDatabase = true;
-      networking.useDHCP = false;
-      services.udev.packages = [ cfg.package ];
-      security.polkit.enable = lib.mkDefault true;
-
-      security.polkit.extraConfig = lib.concatStringsSep "\n" [
-        # allow networkmanager unbounded control over modemmanager.
-        # i believe this was sourced from the default nixpkgs config.
-        ''
-          polkit.addRule(function(action, subject) {
-            if (subject.isInGroup("networkmanager")
-              && (
-                action.id.indexOf("org.freedesktop.NetworkManager.") == 0
-                || action.id.indexOf("org.freedesktop.ModemManager")  == 0
-              )
-            ) {
-                return polkit.Result.YES;
-            }
-          });
-        ''
-        # allow networkmanager to control systemd-resolved,
-        # which it needs to do to apply new DNS settings when using systemd-resolved.
-        ''
-          polkit.addRule(function(action, subject) {
-            if (subject.isInGroup("networkmanager") && action.id.indexOf("org.freedesktop.resolve1.") == 0) {
-              return polkit.Result.YES;
-            }
-          });
-        ''
-      ];
-
-      users.groups.networkmanager.gid = config.ids.gids.networkmanager;
-      users.users.networkmanager = {
-        isSystemUser = true;
-        group = "networkmanager";
-        extraGroups = [ "trust-dns" ];
-      };
-
-      boot.kernelModules = [ "ctr" ];  #< TODO: needed (what even is this)?
-      # TODO: NetworkManager-ensure-profiles?
-    })
-  ];
-}

hosts/common/programs/sane-input-handler/default.nix

@@ -85,7 +85,7 @@ in
       "playerctl"
       "procps"
       "sane-open"
-      "sway"
+      # "sway"  #< TODO: circular dependency :-(
       "wireplumber"
       # optional integrations:
       "megapixels"

hosts/common/programs/sane-input-handler/sane-input-handler

@@ -85,21 +85,38 @@ log() {
 
 ## HELPERS
 
-isTouchOn() {
-  # success if all touch inputs have their events enabled
+# swaySetOutput true|false
+# turns the display on or off
+swaySetOutput() {
+  swaymsg -- output '*' power "$1"
+}
+# swaySetTouch enabled|disabled
+# turns touch input on or off
+swaySetTouch() {
+  # XXX(2024/06/09): `type:touch` method is documented, but now silently fails
+  # swaymsg -- input type:touch events "$1"
+
+  local inputs=$(swaymsg -t get_inputs --raw | jq '. | map(select(.type == "touch")) | map(.identifier) | join(" ")' --raw-output)
+  for id in "${inputs[@]}"; do
+    swaymsg -- input "$id" events "$1"
+  done
+}
+
+# success if all touch inputs have their events enabled
+swayGetTouch() {
   swaymsg -t get_inputs --raw \
     | jq --exit-status '. | map(select(.type == "touch")) | all(.libinput.send_events == "enabled")' \
     > /dev/null
 }
-isScreenOn() {
-  # success if all outputs have power
+# success if all outputs have power
+swayGetOutput() {
   swaymsg -t get_outputs --raw \
     | jq --exit-status '. | all(.power)' \
     > /dev/null
 }
 
 isAllOn() {
-  isTouchOn && isScreenOn
+  swayGetOutput && swayGetTouch
 }
 
 isInhibited() {
@@ -134,12 +151,12 @@ unmapped() {
 }
 
 allOn() {
-  swaymsg -- output '*' power true
-  swaymsg -- input type:touch events enabled
+  swaySetOutput true
+  swaySetTouch enabled
 }
 allOff() {
-  swaymsg -- output '*' power false
-  swaymsg -- input type:touch events disabled
+  swaySetOutput false
+  swaySetTouch disabled
 }
 
 toggleKeyboard() {

hosts/common/programs/sway/default.nix

@@ -28,7 +28,7 @@ let
       passthru.sway-unwrapped = configuredSway;
     };
 
-  wlroots = (pkgs.waylandPkgs.wlroots.override {
+  wlroots = (pkgs.nixpkgs-wayland.wlroots.override {
     # wlroots seems to launch Xwayland itself, and i can't easily just do that myself externally.
     # so in order for the Xwayland it launches to be sandboxed, i need to patch the sandboxed version in here.
     xwayland = config.sane.programs.xwayland.package;
@@ -60,7 +60,7 @@ let
     '';
   });
   swayPackage = wrapSway (
-    (pkgs.waylandPkgs.sway-unwrapped.override {
+    (pkgs.nixpkgs-wayland.sway-unwrapped.override {
       inherit wlroots;
       # about xwayland:
       # - required by many electron apps, though some electron apps support NIXOS_OZONE_WL=1 for native wayland.
@@ -107,6 +107,14 @@ in
               default font (for e.g. window titles)
             '';
           };
+          locker = mkOption {
+            type = types.str;
+            default = "swaylock";
+            description = ''
+              name of program to use as the screenlocker
+            '';
+            example = "schlock";
+          };
           mod = mkOption {
             type = types.str;
             default = "Mod4";
@@ -140,7 +148,6 @@ in
       "fontconfig"
       # "gnome.gnome-bluetooth"  # XXX(2023/05/14): broken
       # "gnome.gnome-control-center"  # XXX(2023/06/28): depends on webkitgtk4_1
-      "networkmanager"
       "pipewire"
       "playerctl"  # for waybar & particularly to have playerctld running
       "rofi"  # menu/launcher
@@ -153,7 +160,6 @@ in
       # "splatmoji"  # used by sway config
       "sway-contrib.grimshot"  # used by sway config
       "swayidle"  # enable if you need it
-      "swaylock"  # used by sway config
       "swaynotificationcenter"  # notification daemon
       "sysvol"  # volume notifier
       "unl0kr"  # greeter
@@ -180,6 +186,8 @@ in
       # xdg-desktop-portal-wlr provides portals for screenshots/screen sharing
       "xdg-desktop-portal-wlr"
       "xdg-terminal-exec"  # used by sway config
+    ] ++ [
+      cfg.config.locker
     ];
 
     sandbox.method = "bwrap";
@@ -221,6 +229,7 @@ in
       inherit (cfg.config)
         extra_lines
         font
+        locker
         mod
         workspace_layout
       ;

hosts/common/programs/sway/sway-config

@@ -16,6 +16,7 @@ set $volume_up wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+
 set $volume_down wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-
 set $mute wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle
 set $default_workspace_layout @workspace_layout@
+set $locker @locker@
 
 set $out_tv "LG Electronics LG TV 0x01010101"
 set $out_projector "MS Telematica TV 0x00000001"
@@ -79,7 +80,7 @@ bindsym --locked XF86MonBrightnessDown exec brightnessctl set 5%-
 #### special functions
 bindsym Print exec sane-open --application sane-screenshot.desktop
 bindsym $mod+Print exec sane-open --application sane-screenshot.desktop
-bindsym $mod+l exec s6-rc -b start swaylock
+bindsym $mod+l exec s6-rc -b start $locker
 bindsym $mod+s exec sane-open --application rofi-snippets.desktop
 # bindsym $mod+slash exec sane-open splatmoji.desktop
 bindsym $mod+d exec sane-open --application rofi.desktop

hosts/common/programs/swayidle.nix

@@ -44,7 +44,13 @@ let
   });
   screenOff = pkgs.writeShellScriptBin "screen-off" ''
     swaymsg -- output '*' power false
-    swaymsg -- input type:touch events disabled
+    # XXX(2024/06/09): `type:touch` method is documented, but now silently fails
+    # swaymsg -- input type:touch events disabled
+
+    local inputs=$(swaymsg -t get_inputs --raw | jq '. | map(select(.type == "touch")) | map(.identifier) | join(" ")' --raw-output)
+    for id in "''${inputs[@]}"; do
+      swaymsg -- input "$id" events disabled
+    done
   '';
 in
 {
@@ -74,6 +80,11 @@ in
       command = lib.mkDefault "";
     };
 
+    suggestedPrograms = [
+      "jq"
+      # "sway"  #< required, but circular dep
+    ];
+
     sandbox.method = "bwrap";
     sandbox.whitelistDbus = [ "user" ];  #< might need system too, for inhibitors
     sandbox.whitelistS6 = true;

hosts/common/programs/sysvol.nix

@@ -7,6 +7,9 @@
 
     fs.".config/sys64/volume.css".symlink.text = ''
       window {
+        background: transparent;
+      }
+      window > box {
         background: #000000B4;
         border-radius: 19px;
       }
@@ -58,12 +61,13 @@
       # options:
       # -p {0,1,2,3}  to attach to top/right/bottom/left screen edge
       # -t N          for the notifier to be dismissed after N seconds (integer only)
+      # -T N          reveal/hide transition time in milliseconds
       # -m N          to set the indicator this many pixels in from the edge.
       #               it considers sway bars, but not window titles
       # -{H,W} N      to set the height/width of the notifier, in px.
       # -i N          to set the size of the volume icon
       # -P            to hide percentage text
-      command = "sysvol -p 0 -t 1 -m 22 -H 39 -W 256 -i 32 -P";
+      command = "sysvol -p 0 -t 1 -T 0 -m 22 -H 39 -W 256 -i 32 -P";
     };
   };
 }

hosts/common/programs/wpa_supplicant.nix

@@ -1,77 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.sane.programs.wpa_supplicant;
-in
-{
-  config = lib.mkMerge [
-    {
-      sane.programs.wpa_supplicant = {
-        packageUnwrapped = pkgs.wpa_supplicant.overrideAttrs (upstream: {
-          # postPatch = (upstream.postPatch or "") + ''
-          #   substituteInPlace wpa_supplicant/dbus/dbus-wpa_supplicant.conf --replace-fail \
-          #     'user="root"' 'user="networkmanager"'
-          # '';
-          postInstall = (upstream.postInstall or "") + ''
-            substitute $out/share/dbus-1/system.d/dbus-wpa_supplicant.conf \
-              $out/share/dbus-1/system.d/networkmanager-wpa_supplicant.conf \
-              --replace-fail 'user="root"' 'group="networkmanager"'
-          '';
-
-          postFixup = (upstream.postFixup or "") + ''
-            # nixpkgs wpa_supplicant generates a dbus file which has a path like
-            # /nix/store/abc-wpa_supplicant/nix/store/abc-wpa_supplicant/sbin/...
-            # upstreaming status: <https://github.com/NixOS/nixpkgs/pull/315346>
-            substituteInPlace $out/share/dbus-1/system-services/* --replace-fail \
-              "$out$out" "$out"
-
-            # remove unused services to avoid unexpected interactions
-            rm $out/etc/systemd/system/{wpa_supplicant-nl80211@,wpa_supplicant-wired@,wpa_supplicant@}.service
-          '';
-        });
-        # bwrap sandboxing works, but requires the real user to be root.
-        # landlock sandboxing works, and allows the real user to be someone else (like `networkmanager`).
-        # non-root is very important, because of how many things in e.g. /dev are r/w based on uid=0.
-        # sandbox.method = "bwrap";
-        sandbox.method = "landlock";
-        sandbox.capabilities = [
-          # see also: <https://github.com/NixOS/nixpkgs/pull/305722>
-          "net_admin" "net_raw"
-        ];
-        # sandbox.extraConfig = [ "--sanebox-keep-namespace" "all" ];
-        sandbox.net = "all";
-        sandbox.extraPaths = [
-          "/dev/net"
-          "/dev/rfkill"
-          "/proc/sys/net"
-          "/sys/class/net"
-          "/sys/devices"
-        ];
-        sandbox.whitelistDbus = [ "system" ];
-      };
-    }
-    (lib.mkIf cfg.enabled {
-      services.udev.packages = [ cfg.package ];
-      systemd.packages = [ cfg.package ];  #< needs to be on systemd.packages so we get its service file
-      systemd.services.wpa_supplicant = {
-        path = [ "/run/current-system/sw" ];  #< so it can find `sanebox`
-        serviceConfig.User = "networkmanager";
-        serviceConfig.Group = "networkmanager";
-        serviceConfig.AmbientCapabilities = [
-          "CAP_NET_ADMIN"
-          "CAP_NET_RAW"
-        ];
-      };
-      # systemd.services.wpa_supplicant = {
-      #   aliases = [ "dbus-fi.w1.wpa_supplicant1.service" ];
-      #   before = [ "network.target" ];
-      #   wantedBy = [ "network.target" ];
-      #   serviceConfig = {
-      #     Type = "dbus";
-      #     BusName = "fi.w1.wpa_supplicant1";
-      #     ExecStart = "${cfg.package}/bin/wpa_supplicant -u";
-      #     Restart = "always";
-      #   };
-      # };
-    })
-  ];
-}

hosts/common/quirks.nix

@@ -0,0 +1,30 @@
+# quirks: temporary patches with the goal of eventually removing them
+{ lib, ... }:
+{
+  # TODO: remove after linux 6.9. see: <https://github.com/axboe/liburing/issues/1113>
+  # - <https://github.com/neovim/neovim/issues/28149>
+  # - <https://git.kernel.dk/cgit/linux/commit/?h=io_uring-6.9&id=e5444baa42e545bb929ba56c497e7f3c73634099>
+  # when removing, try starting and suspending (ctrl+z) two instances of neovim simultaneously.
+  # if the system doesn't freeze, then this is safe to remove.
+  # added 2024-04-04
+  sane.user.fs.".profile".symlink.text = lib.mkBefore ''
+    export UV_USE_IO_URING=0
+  '';
+
+  # powertop will default to putting USB devices -- including HID -- to sleep after TWO SECONDS
+  powerManagement.powertop.enable = false;
+  # linux CPU governor: <https://www.kernel.org/doc/Documentation/cpu-freq/governors.txt>
+  # - options:
+  #   - "powersave" => force CPU to always run at lowest supported frequency
+  #   - "performance" => force CPU to always run at highest frequency
+  #   - "ondemand" => adjust frequency based on load
+  #   - "conservative"  (ondemand but slower to adjust)
+  #   - "schedutil"
+  #   - "userspace"
+  # - not all options are available for all platforms
+  #   - intel (intel_pstate) appears to manage scaling w/o intervention/control from the OS.
+  #   - AMD (acpi-cpufreq) appears to manage scaling via the OS *or* HW. but the ondemand defaults never put it to max hardware frequency.
+  #   - qualcomm (cpufreq-dt) appears to manage scaling *only* via the OS. ondemand governor exercises the full range.
+  # - query details with `sudo cpupower frequency-info`
+  powerManagement.cpuFreqGovernor = "ondemand";
+}

hosts/common/systemd.nix

@@ -7,19 +7,6 @@ let
   haltTimeout = 10;
 in
 {
-  systemd.extraConfig = ''
-    # DefaultTimeoutStopSec defaults to 90s, and frequently blocks overall system shutdown.
-    DefaultTimeoutStopSec=${builtins.toString haltTimeout}
-  '';
-
-  services.journald.extraConfig = ''
-    # docs: `man journald.conf`
-    # merged journald config is deployed to /etc/systemd/journald.conf
-    [Journal]
-    # disable journal compression because the underlying fs is compressed
-    Compress=no
-  '';
-
   # allow ordinary users to `reboot` or `shutdown`.
   # source: <https://nixos.wiki/wiki/Polkit>
   security.polkit.extraConfig = ''
@@ -38,4 +25,24 @@ in
       }
     })
   '';
+
+  services.journald.extraConfig = ''
+    # docs: `man journald.conf`
+    # merged journald config is deployed to /etc/systemd/journald.conf
+    [Journal]
+    # disable journal compression because the underlying fs is compressed
+    Compress=no
+  '';
+
+  # see: `man logind.conf`
+  # don’t shutdown when power button is short-pressed (commonly done an accident, or by cats).
+  #   but do on long-press: useful to gracefully power-off server.
+  services.logind.powerKey = "lock";
+  services.logind.powerKeyLongPress = "poweroff";
+  services.logind.lidSwitch = "lock";
+
+  systemd.extraConfig = ''
+    # DefaultTimeoutStopSec defaults to 90s, and frequently blocks overall system shutdown.
+    DefaultTimeoutStopSec=${builtins.toString haltTimeout}
+  '';
 }

hosts/modules/default.nix

@@ -3,11 +3,11 @@
 {
   imports = [
     ./derived-secrets
+    ./hal
     ./hosts.nix
     ./nixcache.nix
     ./roles
     ./services
     ./wg-home.nix
-    ./yggdrasil.nix
   ];
 }

hosts/modules/hal/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  imports = [
+    ./pine64.nix
+    ./samsung
+    ./x86_64.nix
+  ];
+}

hosts/modules/hal/pine64.nix

@@ -0,0 +1,343 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.sane.hal.pine64;
+in
+{
+  options = {
+    sane.hal.pine64.enable = lib.mkEnableOption "pine64-specific hardware support";
+  };
+
+  config = lib.mkIf cfg.enable {
+    # kernel compatibility (2024/05/22: 03dab630)
+    # - linux-megous: boots to ssh, desktop
+    #   - camera apps: megapixels (no cameras found), snapshot (no cameras found)
+    # - linux-postmarketos-allwinner: boots to ssh. desktop ONLY if "anx7688" is in the initrd.availableKernelModules.
+    #   - camera apps: megapixels (both rear and front cameras work), `cam -l` (finds only the rear camera), snapshot (no cameras found)
+    # - linux-megous.override { withMegiPinephoneConfig = true; }: NO SSH, NO SIGNS OF LIFE
+    # - linux-megous.override { withFullConfig = false; }: boots to ssh, no desktop
+    #
+    boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.linux-postmarketos-allwinner.override {
+      withModemPower = true;
+    });
+    # boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux-megous;
+    # boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.linux-megous.override {
+    #   withFullConfig = false;
+    # });
+    # boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.linux-megous.override {
+    #   withMegiPinephoneConfig = true;  #< N.B.: does not boot as of 2024/05/22!
+    # });
+    # boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux-manjaro;
+    # boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_latest;
+
+    # nixpkgs.hostPlatform.linux-kernel becomes stdenv.hostPlatform.linux-kernel
+    # ^ but only if using flakes (or rather, if *not* using `nixpkgs.nixos` to construct the host config)
+    # nixpkgs.hostPlatform.linux-kernel = {
+    #   # defaults:
+    #   name = "aarch64-multiplatform";
+    #   # baseConfig: defaults to "defconfig";
+    #   # baseConfig = "pinephone_defconfig";  #< N.B.: ignored by `pkgs.linux-megous`
+    #   DTB = true;  #< DTB: compile device tree blobs
+    #   # autoModules (default: true): for config options not manually specified, answer `m` to anything which supports it.
+    #   # - this effectively builds EVERY MODULE SUPPORTED.
+    #   autoModules = true;  #< N.B.: ignored by `pkgs.linux-megous`
+    #   # preferBuiltin (default: false; true for rpi): for config options which default to `Y` upstream, build them as `Y` (overriding `autoModules`)
+    #   # preferBuiltin = false;
+
+    #   # build a compressed kernel image: without this i run out of /boot space in < 10 generations
+    #   # target = "Image";  # <-- default
+    #   target = "Image.gz";  # <-- compress the kernel image
+    #   # target = "zImage";  # <-- confuses other parts of nixos :-(
+    # };
+
+    # boot.initrd.kernelModules = [
+    #   "drm"  #< force drm to be plugged
+    # ];
+    boot.initrd.availableKernelModules = [
+      # see <repo:postmarketOS/pmaports:device/main/device-pine64-pinephone/modules-initfs>
+      # - they include sun6i_mipi_dsi sun4i_drm pwm_sun4i sun8i_mixer anx7688 gpio_vibra pinephone_keyboard
+      "anx7688" #< required for display initialization and functional cameras
+      # full list of modules active post-boot with the linux-megous kernel + autoModules=true:
+      # - `lsmod | sort | cut -d ' ' -f 1`
+      # "8723cs"
+      # "axp20x_adc"  #< NOT FOUND in megous-no-autoModules
+      # "axp20x_battery"
+      # "axp20x_pek"
+      # "axp20x_usb_power"
+      # "backlight"
+      # "blake2b_generic"
+      # "bluetooth"
+      # "bridge"
+      # "btbcm"
+      # "btqca"
+      # "btrfs"
+      # "btrtl"
+      # "cec"
+      # "cfg80211"
+      # "chacha_neon"
+      # "crc_ccitt"
+      # "crct10dif_ce"
+      # "crypto_engine"
+      # "display_connector"  #< NOT FOUND in pmos
+      # "drm"
+      # "drm_display_helper"
+      # "drm_dma_helper"
+      # "drm_kms_helper"
+      # "drm_shmem_helper"
+      # "dw_hdmi"
+      # "dw_hdmi_cec"  #< NOT FOUND in pmos
+      # "dw_hdmi_i2s_audio"
+      # "ecc"
+      # "ecdh_generic"
+      # "fuse"
+      # "gc2145"  #< NOT FOUND in megous-no-autoModules
+      # "goodix_ts"
+      # "gpio_vibra"  #< NOT FOUND in megous-no-autoModules
+      # "gpu_sched"
+      # "hci_uart"
+      # "i2c_gpio"
+      # "inv_mpu6050"  #< NOT FOUND in megous-no-autoModules
+      # "inv_mpu6050_i2c"  #< NOT FOUND in megous-no-autoModules
+      # "inv_sensors_timestamp"  #< NOT FOUND in megous-no-autoModules
+      # "ip6t_rpfilter"
+      # "ip6_udp_tunnel"
+      # "ip_set"
+      # "ip_set_hash_ipport"
+      # "ip_tables"
+      # "ipt_rpfilter"
+      # "joydev"
+      # "led_class_flash"  #< NOT FOUND in megous-no-autoModules
+      # "leds_sgm3140"  #< NOT FOUND in megous-no-autoModules
+      # "ledtrig_pattern"  #< NOT FOUND in megous-no-autoModules
+      # "libarc4"
+      # "libchacha"
+      # "libchacha20poly1305"
+      # "libcrc32c"
+      # "libcurve25519_generic"
+      # "lima"
+      # "llc"
+      # "mac80211"
+      # "macvlan"
+      # "mc"
+      # "modem_power"
+      # "mousedev"
+      # "nf_conntrack"
+      # "nf_defrag_ipv4"
+      # "nf_defrag_ipv6"
+      # "nf_log_syslog"
+      # "nf_nat"
+      # "nfnetlink"
+      # "nf_tables"
+      # "nft_chain_nat"
+      # "nft_compat"
+      # "nls_cp437"
+      # "nls_iso8859_1"
+      # "nvmem_reboot_mode"
+      # "ov5640"
+      # "panel_sitronix_st7703"
+      # "phy_sun6i_mipi_dphy"
+      # "pinctrl_axp209"  #< NOT FOUND in pmos
+      # "pinephone_keyboard"  #< NOT FOUND in megous-no-autoModules
+      # "poly1305_neon"
+      # "polyval_ce"
+      # "polyval_generic"
+      # "ppkb_manager"  #< NOT FOUND in megous-no-autoModules
+      # "pwm_bl"
+      # "pwm_sun4i"
+      # "qrtr"
+      # "raid6_pq"
+      # "rfkill"
+      # "rtw88_8703b"
+      # "rtw88_8723cs"
+      # "rtw88_8723x"
+      # "rtw88_core"
+      # "rtw88_sdio"
+      # "sch_fq_codel"
+      # "sm4"
+      # "snd_soc_bt_sco"
+      # "snd_soc_ec25"  #< NOT FOUND in megous-no-autoModules
+      # "snd_soc_hdmi_codec"
+      # "snd_soc_simple_amplifier"
+      # "snd_soc_simple_card"
+      # "snd_soc_simple_card_utils"
+      # "stk3310"  #< NOT FOUND in megous-no-autoModules
+      # "st_magn"
+      # "st_magn_i2c"
+      # "st_magn_spi"  #< NOT FOUND in pmos
+      # "stp"
+      # "st_sensors"
+      # "st_sensors_i2c"
+      # "st_sensors_spi"  #< NOT FOUND in pmos
+      # "sun4i_drm"
+      # "sun4i_i2s"
+      # "sun4i_lradc_keys"  #< NOT FOUND in megous-no-autoModules
+      # "sun4i_tcon"
+      # "sun50i_codec_analog"
+      # "sun6i_csi"
+      # "sun6i_dma"
+      # "sun6i_mipi_dsi"
+      # "sun8i_a33_mbus"  #< NOT FOUND in megous-no-autoModules
+      # "sun8i_adda_pr_regmap"
+      # "sun8i_ce"  #< NOT FOUND in pmos
+      # "sun8i_codec"  #< NOT FOUND in megous-no-autoModules
+      # "sun8i_di"  #< NOT FOUND in megous-no-autoModules
+      # "sun8i_drm_hdmi"
+      # "sun8i_mixer"
+      # "sun8i_rotate"  #< NOT FOUND in megous-no-autoModules
+      # "sun8i_tcon_top"
+      # "sun9i_hdmi_audio"  #< NOT FOUND in megous-no-autoModules
+      # "sunxi_wdt"  #< NOT FOUND in pmos
+      # "tap"
+      # "typec"  #< NOT FOUND in pmos
+      # "udp_tunnel"
+      # "uio"  #< NOT FOUND in pmos
+      # "uio_pdrv_genirq"
+      # "v4l2_async"
+      # "v4l2_cci" #< NOT FOUND in pmos
+      # "v4l2_flash_led_class"  #< NOT FOUND in megous-no-autoModules
+      # "v4l2_fwnode"
+      # "v4l2_mem2mem"
+      # "videobuf2_common"
+      # "videobuf2_dma_contig"
+      # "videobuf2_memops"
+      # "videobuf2_v4l2"
+      # "videodev"
+      # "wireguard"
+      # "xor"
+      # "x_tables"
+      # "xt_conntrack"
+      # "xt_LOG"
+      # "xt_nat"
+      # "xt_pkttype"
+      # "xt_set"
+      # "xt_tcpudp"
+      # "zram"
+    ];
+
+    # disable proximity sensor.
+    # the filtering/calibration is bad that it causes the screen to go fully dark at times.
+    # boot.blacklistedKernelModules = [ "stk3310" ];
+
+    boot.kernelParams = [
+      # without this some GUI apps fail: `DRM_IOCTL_MODE_CREATE_DUMB failed: Cannot allocate memory`
+      # this is because they can't allocate enough video ram.
+      # see related nixpkgs issue: <https://github.com/NixOS/nixpkgs/issues/260222>
+      # TODO(2023/12/03): remove once mesa 23.3.1 lands: <https://github.com/NixOS/nixpkgs/pull/265740>
+      #
+      # the default CMA seems to be 32M.
+      # i was running fine with 256MB from 2022/07-ish through 2022/12-ish, but then the phone quit reliably coming back from sleep (phosh): maybe a memory leak?
+      # bumped to 512M on 2023/01
+      # bumped to 1536M on 2024/05
+      # `cat /proc/meminfo` to see CmaTotal/CmaFree if interested in tuning this.
+      # kernel param mentioned here: <https://cateee.net/lkddb/web-lkddb/CMA_SIZE_PERCENTAGE.html>
+      # i think cma mem isn't exclusive -- it can be used as ordinary `malloc`, still. i heard someone suggest the OS default should just be 50% memory to CMA.
+      "cma=1536M"
+      # 2023/10/20: potential fix for the lima (GPU) timeout bugs:
+      # - <https://gitlab.com/postmarketOS/pmaports/-/issues/805#note_890467824>
+      "lima.sched_timeout_ms=2000"
+    ];
+
+    # defined: https://www.freedesktop.org/software/systemd/man/machine-info.html
+    # XXX colin: diabled until/unless it's actually needed.
+    # environment.etc."machine-info".text = ''
+    #   CHASSIS="handset"
+    # '';
+
+    # hardware.firmware makes the referenced files visible to the kernel, for whenever a driver explicitly asks for them.
+    # these files are visible from userspace by following `/sys/module/firmware_class/parameters/path`
+    #
+    # mobile-nixos' /lib/firmware includes:
+    #   rtl_bt          (bluetooth)
+    #   anx7688-fw.bin  (USB-C chip: power negotiation, HDMI/dock)
+    #   ov5640_af.bin   (camera module)
+    # hardware.firmware = [ config.mobile.device.firmware ];
+    # hardware.firmware = [ pkgs.rtl8723cs-firmware ];
+    hardware.firmware = [
+      (pkgs.linux-firmware-megous.override {
+        # rtl_bt = false probably means no bluetooth connectivity.
+        # N.B.: DON'T RE-ENABLE without first confirming that wake-on-lan works during suspend (rtcwake).
+        # it seems the rtl_bt stuff ("bluetooth coexist") might make wake-on-LAN radically more flaky.
+        rtl_bt = false;
+      })
+    ];
+
+    # enable rotation sensor
+    # hardware.sensor.iio.enable = true;
+
+    ## TOW-BOOT: <https://tow-boot.org>
+    # docs (pinephone specific): <https://github.com/Tow-Boot/Tow-Boot/tree/development/boards/pine64-pinephoneA64>
+    # LED and button behavior is defined here: <https://github.com/Tow-Boot/Tow-Boot/blob/development/modules/tow-boot/phone-ux.nix>
+    # - hold VOLDOWN: enter recovery mode
+    #   - LED will turn aqua instead of yellow
+    #   - recovery mode would ordinarily allow a selection of entries, but for pinephone i guess it doesn't do anything?
+    # - hold VOLUP: force it to load the OS from eMMC?
+    #   - LED will turn blue instead of yellow
+    # boot LEDs:
+    # - yellow = entered tow-boot
+    # - 10 red flashes => poweroff means tow-boot couldn't boot into the next stage (i.e. distroboot)
+    #   - distroboot: <https://source.denx.de/u-boot/u-boot/-/blob/v2022.04/doc/develop/distro.rst>)
+    # we need space in the GPT header to place tow-boot.
+    # only actually need 1 MB, but better to over-allocate than under-allocate
+    sane.image.extraGPTPadding = 16 * 1024 * 1024;
+    sane.image.firstPartGap = 0;
+    sane.image.installBootloader = ''
+      dd if=${pkgs.tow-boot-pinephone}/Tow-Boot.noenv.bin of=$out bs=1024 seek=8 conv=notrunc
+    '';
+
+    sane.programs.swaynotificationcenter.config = {
+      backlight = "backlight";  # /sys/class/backlight/*backlight*/brightness
+    };
+
+    services.udev.extraRules = let
+      chmod = "${pkgs.coreutils}/bin/chmod";
+      chown = "${pkgs.coreutils}/bin/chown";
+    in ''
+      # make Pinephone flashlight writable by user.
+      # taken from postmarketOS: <repo:postmarketOS/pmaports:device/main/device-pine64-pinephone/60-flashlight.rules>
+      SUBSYSTEM=="leds", DEVPATH=="*/*:flash", RUN+="${chmod} g+w /sys%p/brightness /sys%p/flash_strobe", RUN+="${chown} :video /sys%p/brightness /sys%p/flash_strobe"
+
+      # make Pinephone front LEDs writable by user.
+      SUBSYSTEM=="leds", DEVPATH=="*/*:indicator", RUN+="${chmod} g+w /sys%p/brightness", RUN+="${chown} :video /sys%p/brightness"
+    '';
+
+    systemd.services.unl0kr.preStart = let
+      dmesg = "${pkgs.util-linux}/bin/dmesg";
+      grep = "${pkgs.gnugrep}/bin/grep";
+      modprobe = "${pkgs.kmod}/bin/modprobe";
+    in ''
+      # common boot failure:
+      # blank screen (no backlight even), with the following log:
+      # ```syslog
+      # sun8i-dw-hdmi 1ee0000.hdmi: Couldn't get the HDMI PHY
+      # ...
+      # sun4i-drm display-engine: Couldn't bind all pipelines components
+      # ...
+      # sun8i-dw-hdmi: probe of 1ee0000.hdmi failed with error -17
+      # ```
+      #
+      # in particular, that `probe ... failed` occurs *only* on failed boots
+      # (the other messages might sometimes occur even on successful runs?)
+      #
+      # reloading the sun8i hdmi driver usually gets the screen on, showing boot text.
+      # then restarting display-manager.service gets us to the login.
+      #
+      # NB: the above log is default level. though less specific, there's a `err` level message that also signals this:
+      # sun4i-drm display-engine: failed to bind 1ee0000.hdmi (ops sun8i_dw_hdmi_ops [sun8i_drm_hdmi]): -17
+      # NB: this is the most common, but not the only, failure mode for `display-manager`.
+      # another error seems characterized by these dmesg logs, in which reprobing sun8i_drm_hdmi does not fix:
+      # ```syslog
+      # sun6i-mipi-dsi 1ca0000.dsi: Couldn't get the MIPI D-PHY
+      # sun4i-drm display-engine: Couldn't bind all pipelines components
+      # sun6i-mipi-dsi 1ca0000.dsi: Couldn't register our component
+      # ```
+
+      if (${dmesg} --kernel --level err --color=never --notime | ${grep} -q 'sun4i-drm display-engine: failed to bind 1ee0000.hdmi')
+      then
+        echo "reprobing sun8i_drm_hdmi"
+        # if a command here fails it errors the whole service, so prefer to log instead
+        ${modprobe} -r sun8i_drm_hdmi || echo "failed to unload sun8i_drm_hdmi"
+        ${modprobe} sun8i_drm_hdmi || echo "failed to load sub8i_drm_hdmi"
+      fi
+    '';
+  };
+}
+

hosts/modules/hal/samsung/default.nix

@@ -0,0 +1,245 @@
+# device support for samsung XE303C12 "google-snow" model, specifically.
+# see: <https://wiki.postmarketos.org/wiki/Samsung_Chromebook_(google-snow)>
+# - build logs: <https://images.postmarketos.org/bpo/edge/google-snow/console/>
+# see: <https://github.com/thefloweringash/kevin-nix>
+# - related "depthcharge" chromebook, built with nix
+# see: <https://mobile.nixos.org/devices/lenovo-wormdingler.html>
+# - above module, integrated into an image builder
+# - implementation in modules/system-types/depthcharge
+# see: <https://web.archive.org/web/20191103000916/http://www.chromium.org/chromium-os/firmware-porting-guide/using-nv-u-boot-on-the-samsung-arm-chromebook>
+# - referenced from u-boot `doc/` directory
+# - <https://web.archive.org/web/20220813062811/https://www.chromium.org/chromium-os/how-tos-and-troubleshooting/using-an-upstream-kernel-on-snow/>
+# - <https://web.archive.org/web/20240119111314/https://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices/custom-firmware/>
+# - google exynos5_defconfig: <https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/%2B/HEAD/eclass/cros-kernel>
+# see: <repo:postmarketOS/pmaports:device/community/device-google-snow>
+# - <https://gitlab.com/postmarketOS/boot-deploy/-/blob/5f08ebb05a520d0e6bccfcda324f12e4aac1623f/boot-deploy-functions.sh#L872>
+# - deviceinfo:
+#   - deviceinfo_flash_method="none"
+#   - deviceinfo_cgpt_kpart="/boot/vmlinuz.kpart"
+#   - deviceinfo_cgpt_kpart_start="8192"
+#   - deviceinfo_cgpt_kpart_size="16384"
+#   - deviceinfo_kernel_cmdline="console=null"
+#   - deviceinfo_depthcharge_board="snow"
+#   - deviceinfo_generate_depthcharge_image="true"
+#   - deviceinfo_generate_extlinux_config="true"
+# - modules-initfs:
+#   - drm-dp-aux-bus
+#   - panel-edp
+#   - drm-kms-helper
+#   - cros-ec-keyb
+#   - sbs-battery
+#   - tps65090-charger
+#   - uas
+#   - sd-mod
+# - pmOS also uses a custom alsa UCM config
+# - pmOS kernel package: linux-postmarketos-exynos5
+# - pmOS firmware packages (for WiFi/Bluetooth): linux-firmware-mrvl linux-firmware-s5p-mfc
+#
+# pmOS image has disk layout:
+# /dev/sdb1    8192    24575    16384    8M ChromeOS kernel
+# /dev/sdb2   24576   548863   524288  256M EFI System
+# /dev/sdb3  548864 31336414 30787551 14.7G Microsoft basic data
+# - built using `depthcharge-tools`: <https://github.com/alpernebbi/depthcharge-tools>
+# - expected chromeos disk layout documented: <https://www.chromium.org/chromium-os/developer-library/reference/device/disk-format/>
+#
+# typical boot process:
+# - BIOS searches for a partition `ChromeOS Kernel Type GUID (fe3a2a5d-4f32-41a7-b725-accc3285a309)`
+# - first 64K are reserved for sigantures (when verified boot is active)
+# - then kernel, some datastructures (i.e. config.txt, the command line passed to the kernel), bootloader stub
+# - BIOS loads kernel blob into RAM, then invokes the bootstub
+# - bootloader stub is an EFI application. it setups up tables and jumps into the kernel.
+#   - so potentially i could put any EFI application here, and load the kernel myself from somewhere else?
+# - partitions are all 2MiB-aligned
+# according to depthcharge-tools, max image size is 8 MiB, though i don't know how strict that is.
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.sane.hal.samsung;
+  # sus commits:
+  # - ad3e33fe071dffea07279f96dab4f3773c430fe2 (drm/panel: Move AUX B116XW03 out of panel-edp back to panel-simple)
+  #   says i should switch to `edp-panel`; chrome is lying about the panel.
+  #   - discussion: <https://patchwork.freedesktop.org/patch/559389/>
+  #   - was tested for exynos5-peach -- which worked with the patch and uses panel_simple
+  #   - snow was *not* tested, but previously used panel_edp
+  linuxSourceHashes = {
+    "6.2.16" = "sha256-dC5lp45tU4JgHS8VWezLM/z8C8UMxaIdj5I2DleMv8c=";  #< boots
+    "6.3.13" = "sha256-bGNcuEYBHaY34OeGkqb58dXV+JF2XY3bpBtLhg634xA=";  #< boots
+    "6.4.16" = "sha256-hDhelVL20AMzQeT7IDVDI35uoGEyroVPjiszO2JZzO8=";  #< boots
+    "6.5.13" = "sha256-lCTwq+2RyZTIX1YQa/riHf1KCnS8dTrLlljjKAXudz4=";  #< boots
+    "6.6.0-rc1" = "sha256-DRai7HhWVtRB0GiRCvCv2JM2TFKRsZ60ohD6GW0b8As=";  #< boots. upstream/torvalds' tag is `v6.6-rc1`
+    "6.6.0-rc3" = "sha256-/YcuQ5UsSObqOZ0YIbcNex5HJAL8eneDDzIiTEuMDsQ=";
+    "6.6.0-rc4" = "sha256-Kbv+jU2IoC4soT3ma1ZV8Un4rTQakNjut5nlA1907GQ=";  #< boots. upstream/torvalds' tag is `v6.6-rc4`
+    "6.6.0-rc5" = "sha256-ia0F/W3BR+gD8qE5LEwUcJCqwBs3c5kj80DbeDzFFqY=";
+    "6.6.0-rc6" = "sha256-HIrn3fkoCqVSSJ0gxY6NO8I3M8P7BD5XzQpjrhdw//s=";  #< boots. upstream/torvalds' tag is `v6.6-rc6`
+    "6.6.0-rc6-bi-5188" = "sha256-TmRrPy2IhnvTVlq5bNhzsvNPgRg0qk1u2Mh3q/lBask=";  #< boots
+    "6.6.0-rc6-bi-5264" = "sha256-BXt5O9hUC9lYITBO56Rzb9XJHThjt6DuiXizUi2G6/0=";  # *does not boot*. this is commit ad3e33fe071dffea07279f96dab4f3773c430fe2; actually 6.6.0-rc1, because of merge order
+    "6.6.0-rc7" = "sha256-u+seQp82USt63zgMlvDRIpDmmWD2Pha5d41CorwY7f8=";  #< *does not boot*. upstream/torvalds' tag is `v6.6-rc7`
+    "6.6.0" = "sha256-iUTHPMbELhtRogbrKr3n2FBwj8mbGYGacy2UgjPZZNg=";  #< *does not boot*. upstream/torvalds' tag is `v6.6`
+    "6.7.12" = "sha256-6Fm7lC2bwk+wYYGeasr+6tcSw+n3VE4d9JWbc9jN6fA=";  #< *does not boot*
+    "6.10.0-rc3" = "sha256-k9Mpff96xgfTyjRMn0wOQBOm7NKZ7IDtJBRYwrnccoY=";  #< *does not boot*. upstream/torvalds' tag is `v6.10-rc3`
+  };
+in
+{
+  options = {
+    sane.hal.samsung.enable = lib.mkEnableOption "samsung-specific hardware support";
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot.initrd.compressor = "gzip";
+    # boot.initrd.compressorArgs = [ "--ultra" "-22" ];
+
+    hardware.firmware = [
+      (pkgs.linux-firmware.overrideAttrs (_: {
+        # mwifiex_sdio seems to require uncompressed firmware (even with a kernel configured for CONFIG_MODULE_COMPRESS_ZSTD=y)
+        passthru.compressFirmware = false;
+      }))
+    ];
+
+    boot.initrd.availableKernelModules = [
+    # boot.initrd.kernelModules = [
+      # from postmarketOS
+      "drm-dp-aux-bus"
+      "panel-edp"
+      "drm-kms-helper"
+      "cros-ec-keyb"
+      "sbs-battery"
+      "tps65090-charger"
+      "uas"
+      "sd-mod"
+    ];
+    # N.B: mobile-nixos says these modules break udev, if builtin or run before udev:
+    #  "sbs-battery"
+    #  "sbs-charger"
+    #  "sbs-manager"
+
+    # boot.kernelPackages = with pkgs; linuxPackagesFor (linux_6_1.override {
+    #   preferBuiltin = false;
+    #   extraConfig = "";
+    #   structuredExtraConfig = with lib.kernel; {
+    #     SUN8I_DE2_CCU = lib.mkForce no;  #< nixpkgs' option parser gets confused on this one, somehow
+    #     NET_VENDOR_MICREL = no;  #< to overcome broken KS8851_MLL (broken by nixpkgs' `extraConfig`)
+    #     # KS8851_MLL = lib.mkForce module;  #< nixpkgs' option parser gets confused on this one, somehow
+    #     #v XXX: required for e.g. SECURITY_LANDLOCK (specified by upstream nixpkgs) to take effect if `autoModules = false`
+    #     #v seems that upstream linux (the defconfigs?), it defaults to Yes for:
+    #     # - arch/x86/configs/x86_64_defconfig
+    #     # - arch/arm64/configs/defconfig
+    #     # but that it's left unset for e.g. arch/arm64/configs/pinephone_defconfig
+    #     # SECURITY = yes;
+    #   };
+    # });
+    # boot.kernelPackages = with pkgs; linuxPackagesFor linux_6_1;
+    # boot.kernelPackages = with pkgs; linuxPackagesFor linux-exynos5-mainline;
+    boot.kernelPackages = with pkgs; linuxPackagesFor (linux-postmarketos-exynos5.override {
+      # linux = let version = "6.6.0-rc1"; rev = "6.6.0-rc6-bi-5264"; in {
+      #   # src = pkgs.fetchzip {
+      #   #   url = "https://git.kernel.org/stable/t/linux-6.2.16.tar.gz";
+      #   # };
+      #   src = pkgs.fetchFromGitea {
+      #     domain = "git.uninsane.org";
+      #     owner = "colin";
+      #     repo = "linux";
+      #     rev = "v${rev}";
+      #     hash = linuxSourceHashes."${rev}";
+      #   };
+      #   inherit version;
+      #   modDirVersion = version;
+      #   extraMakeFlags = [];
+      # };
+      # linux = linux_6_6;
+      # linux = linux_6_8;
+      # linux = linux_6_9;
+      linux = linux_latest;
+      # optimizeForSize = true;
+      # useEdpPanel = true;
+      revertPanelSimplePatch = true;
+    });
+    # boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux-postmarketos-exynos5;
+    # boot.kernelPackages = pkgs.linuxPackagesFor (pkgs.linux_latest.override {
+    #   kernelPatches = [
+    #     pkgs.linux-postmarketos-exynos5.sanePatches.revertPanelSimplePatch
+    #   ];
+    # });
+
+    system.build.u-boot = pkgs.buildUBoot {
+      defconfig = "snow_defconfig";
+      extraMeta.platforms = [ "armv7l-linux" ];
+      filesToInstall = [
+        "u-boot"  #< ELF file
+        "u-boot.bin"  #< raw binary, load it into RAM and jump toit
+        "u-boot.cfg"  #< copy of Kconfig which this u-boot was compiled with
+        "u-boot.dtb"
+        "u-boot.map"
+        "u-boot-nodtb.bin"
+        "u-boot.sym"
+      ];
+      # CONFIG_BOOTCOMMAND: autoboot from usb, and fix the ordering so that it happens before the internal memory (mmc0)
+      extraConfig = ''
+        CONFIG_BOOTCOMMAND="env set bootcmd_usb0 \"devnum=0; run usb_boot\"; env set boot_targets \"usb0 mmc2 mmc1 mmc0\"; run distro_bootcmd"
+      '';
+    };
+
+    system.build.platformPartition = pkgs.runCommandLocal "kernel-partition" {
+      nativeBuildInputs = with pkgs; [
+        vboot_reference
+        dtc
+        ubootTools
+      ];
+    } ''
+      # according to depthcharge-tools, bootloader.bin is legacy, was used by the earliest
+      # chromebooks (H2C) *only*.
+      dd if=/dev/zero of=dummy_bootloader.bin bs=512 count=1
+      echo auto > dummy_config.txt
+
+      # from uboot snow_defconfig, also == CONFIG_SYS_LOAD_ADDR
+      CONFIG_TEXT_BASE=0x43e00000
+
+      cp ${config.system.build.u-boot}/u-boot.bin .
+      ubootFlags=(
+        -A arm         # architecture
+        -O linux       # operating system
+        -T kernel      # image type
+        -C none        # compression
+        -a $CONFIG_TEXT_BASE  # load address (CONFIG_TEXT_BASE)
+        -e $CONFIG_TEXT_BASE  # entry point (CONFIG_SYS_LOAD_ADDR), i.e. where u-boot `bootm` should jump to to execute the kernel
+        -n nixos-uboot # image name
+        -d u-boot.bin  # image data
+        u-boot.fit     # output
+      )
+      mkimage "''${ubootFlags[@]}"
+
+      futility \
+        --debug \
+      vbutil_kernel \
+        --version 1 \
+        --bootloader ./dummy_bootloader.bin \
+        --vmlinuz u-boot.fit \
+        --arch arm \
+        --keyblock ${pkgs.buildPackages.vboot_reference}/share/vboot/devkeys/kernel.keyblock \
+        --signprivate ${pkgs.buildPackages.vboot_reference}/share/vboot/devkeys/kernel_data_key.vbprivk \
+        --config ./dummy_config.txt \
+        --pack $out
+    '';
+
+    # the platform partition presently only holds u-boot,
+    # and it seems possibly a limitation of depthcharge that it can't launch anything > 8 MiB (?)
+    # still, give a little extra room so i'm free to rearrange stuff if i find a way how.
+    sane.image.platformPartSize = 256 * 1024 * 1024;
+
+    # depthcharge firmware is designed for an A/B partition style,
+    # where partition A holds a kernel and partion B holds a different kernel.
+    # an update is to flash the currently inactive partition and then mark that one as active,
+    # either switching the default boot from partition A to partition B, or from B to A.
+    # anyway, this relies on the partitions having some extra metadata, which we add here.
+    # i believe this metadata is stored in a depthcharge-specific format, not anything
+    # which can be generalized.
+    sane.image.installBootloader = ''
+      ${lib.getExe' pkgs.buildPackages.vboot_reference "cgpt"} add ${lib.concatStringsSep " " [
+        "-i 1"  # work on the first partition (instead of adding)
+        "-S 1"  # mark as successful (so it'll be booted from)
+        "-T 5"  # tries remaining
+        "-P 10" # priority
+        "$out"
+      ]}
+    '';
+  };
+}
+

hosts/modules/hal/x86_64.nix

@@ -1,7 +1,14 @@
-{ lib, pkgs, ... }:
-
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.sane.hal.x86_64;
+in
 {
-  config = lib.mkIf (pkgs.system == "x86_64-linux") {
+  options = {
+    sane.hal.x86_64.enable = (lib.mkEnableOption "x86_64-specific hardware support") // {
+      default = pkgs.system == "x86_64-linux";
+    };
+  };
+  config = lib.mkIf cfg.enable {
     boot.initrd.availableKernelModules = [
       "xhci_pci" "ahci" "sd_mod" "sdhci_pci"  # nixos-generate-config defaults
       "usb_storage"   # rpi needed this to boot from usb storage, i think.

hosts/modules/roles/handheld.nix

@@ -13,6 +13,51 @@
       "consoleMediaUtils"  # overbroad, but handy on very rare occasion
       "handheldGuiApps"
     ];
+    sane.programs.sway.suggestedPrograms = [
+      "sane-input-handler"
+    ];
+
+    sane.programs.alacritty.config.fontSize = 9;
+
+    sane.programs.firefox.config = {
+      # compromise impermanence for the sake of usability
+      persistCache = "private";
+      persistData = "private";
+
+      # i don't do crypto stuff on moby
+      addons.ether-metamask.enable = false;
+      # sidebery UX doesn't make sense on small screen
+      addons.sidebery.enable = false;
+    };
+    sane.programs.firefox.mime.priority = 300;  # prefer other browsers when possible
+    # HACK/TODO: make `programs.P.env.VAR` behave according to `mime.priority`
+    sane.programs.firefox.env = lib.mkForce {};
+    sane.programs.epiphany.env.BROWSER = "epiphany";
+
+    sane.programs.sway.config = {
+      font = "pango:monospace 10";
+      locker = "schlock";
+      mod = "Mod1";  # prefer Alt
+      workspace_layout = "tabbed";
+    };
+
+    sane.programs.swayidle.config = {
+      actions.screenoff.delay = 300;
+      actions.screenoff.enable = true;
+    };
+
+    sane.programs.waybar.config = {
+      fontSize = 14;
+      height = 26;
+      persistWorkspaces = [ "1" "2" "3" "4" "5" ];
+      modules.media = false;
+      modules.network = false;
+      modules.perf = false;
+      modules.windowTitle = false;
+      # TODO: show modem state
+    };
+
+    sane.programs.zsh.config.showDeadlines = false;  # unlikely to act on them when in shell
   };
 }
 

hosts/modules/yggdrasil.nix

@@ -1,30 +0,0 @@
-# docs: <nixpkgs:nixos/modules/services/networking/yggdrasil.md>
-# - or message CW/0x00
-
-{ config, lib, ... }:
-
-let
-  inherit (lib) mkIf mkOption types;
-  cfg = config.sane.yggdrasil;
-in
-{
-  options.sane.yggdrasil = {
-    enable = mkOption {
-      type = types.bool;
-      default = false;
-    };
-  };
-  config = mkIf cfg.enable {
-    services.yggdrasil = {
-      enable = true;
-      persistentKeys = true;
-      settings = {
-        IFName = "ygg0";
-        Peers = [
-          "tls://longseason.1200bps.xyz:13122"
-        ];
-      };
-    };
-  };
-}
-

modules/image.nix

@@ -17,11 +17,6 @@ let
 in
 {
   options = {
-    sane.image.enable = mkOption {
-      default = true;
-      type = types.bool;
-      description = "whether to enable image targets. even so they won't be built unless you specifically reference the `system.build.img` target.";
-    };
     # packages whose contents should be copied directly into the /boot partition.
     # e.g. EFI loaders, u-boot bootloader, etc.
     sane.image.extraBootFiles = mkOption {
@@ -57,9 +52,23 @@ in
       default = (16 * 1024 * 1024 - 34 * 512) * 1024 * 1024 - 1;
       type = types.nullOr types.int;
     };
+    sane.image.platformPartSize = mkOption {
+      default = null;
+      type = types.nullOr types.int;
+      description = ''
+        size of the platform firmware (or, bootloader) partition, in bytes.
+        most platforms don't need this. the primary user is "depthcharge" chromebooks.
+        the partition contents is taken from `config.system.build.platformPartition`.
+      '';
+    };
     sane.image.bootPartSize = mkOption {
-      default = 512 * 1024 * 1024;
+      default = 1024 * 1024 * 1024;
       type = types.int;
+      description = ''
+        size of the boot partition, in bytes.
+        don't skimp on this. nixos kernels are by default HUGE, and restricting this
+        will make kernel tweaking extra painful.
+      '';
     };
     sane.image.sectorSize = mkOption {
       default = 512;
@@ -102,11 +111,11 @@ in
     vfatUuidFromFs = fs: builtins.replaceStrings ["-"] [""] (uuidFromFs fs);
 
     fsBuilderMapBoot = {
-      "vfat" = pkgs.imageBuilder.fileSystem.makeESP;
+      "vfat" = pkgs.mobile-nixos.imageBuilder.fileSystem.makeESP;
     };
     fsBuilderMapNix = {
-      "ext4" = pkgs.imageBuilder.fileSystem.makeExt4;
-      "btrfs" = pkgs.imageBuilder.fileSystem.makeBtrfs;
+      "ext4" = pkgs.mobile-nixos.imageBuilder.fileSystem.makeExt4;
+      "btrfs" = pkgs.mobile-nixos.imageBuilder.fileSystem.makeBtrfs;
     };
 
     bootFsImg = fsBuilderMapBoot."${bootFs.fsType}" {
@@ -153,7 +162,7 @@ in
         cp -v ${closureInfo}/registration ./nix-path-registration
       '';
     };
-    img = (pkgs.imageBuilder.diskImage.makeGPT {
+    img = (pkgs.mobile-nixos.imageBuilder.diskImage.makeGPT {
       name = "nixos";
       diskID = vfatUuidFromFs bootFs;
       # leave some space for firmware
@@ -161,7 +170,16 @@ in
       # Tow-Boot manages to do that; not sure how.
       headerHole = cfg.extraGPTPadding;
       partitions = [
-        (pkgs.imageBuilder.gap cfg.firstPartGap)
+        (pkgs.mobile-nixos.imageBuilder.gap cfg.firstPartGap)
+      ] ++ lib.optionals (cfg.platformPartSize != null) [
+        {
+          name = "kernel";  #< TODO: is it safe to rename this?
+          filename = "${config.system.build.platformPartition}";
+          # from: <https://www.chromium.org/chromium-os/chromiumos-design-docs/disk-format>
+          partitionType = "FE3A2A5D-4F32-41A7-B725-ACCC3285A309";
+          length = cfg.platformPartSize;
+        }
+      ] ++ [
         bootFsImg
         nixFsImg
       ];
@@ -171,19 +189,21 @@ in
       };
     };
   in
-  lib.mkIf cfg.enable
   {
-    system.build.img = (if cfg.installBootloader == null then
-      img
-    else pkgs.runCommand "nixos-with-bootloader" {} ''
-      cp -vR ${img} $out
-      chmod -R +w $out
-      ${cfg.installBootloader}
-    '') // {
+    system.build.img = pkgs.runCommandLocal "nixos-with-bootloader" {
       passthru = {
         inherit bootFsImg nixFsImg;
-        withoutBootloader = img;
+        withoutBootloader = img;  #< XXX: this derivation places the image at $out/nixos.img
       };
-    };
+    } (
+      if cfg.installBootloader == null then ''
+        ln -s ${img}/nixos.img $out
+      '' else ''
+        cp ${img}/nixos.img $out
+        chmod +w $out
+        ${cfg.installBootloader}
+        chmod -w $out
+      ''
+    );
   };
 }

modules/programs/default.nix

@@ -529,24 +529,24 @@ let
       "program ${name} specified no `sandbox.method`; please configure a method, or set sandbox.enable = false."
     ];
 
-    system.checks = lib.optionals (p.enabled && p.sandbox.enable && p.sandbox.method != null && p.package != null) [
+    system.checks = lib.mkIf (p.enabled && p.sandbox.enable && p.sandbox.method != null && p.package != null) [
       p.package.passthru.checkSandboxed
     ];
 
     # conditionally add to system PATH and env
     environment = lib.optionalAttrs (p.enabled && p.enableFor.system) {
-      systemPackages = lib.optionals (p.package != null) [ p.package ];
+      systemPackages = lib.mkIf (p.package != null) [ p.package ];
       # sessionVariables are set by PAM, as opposed to environment.variables which goes in /etc/profile
       sessionVariables = p.env;
     };
 
     # conditionally add to user(s) PATH
     users.users = lib.mapAttrs (userName: en: {
-      packages = lib.optionals (p.package != null && en && p.enabled) [ p.package ];
+      packages = lib.mkIf (p.package != null && en && p.enabled) [ p.package ];
     }) p.enableFor.user;
 
     # conditionally persist relevant user dirs and create files
-    sane.users = lib.mapAttrs (user: en: lib.optionalAttrs (en && p.enabled) {
+    sane.users = lib.mapAttrs (user: en: lib.mkIf (en && p.enabled) {
       inherit (p) persist services;
       environment = p.env;
       fs = lib.mkMerge [
@@ -578,7 +578,7 @@ let
 
     # make secrets available for each user
     sops.secrets = lib.concatMapAttrs
-      (user: en: lib.optionalAttrs (en && p.enabled) (
+      (user: en: lib.mkIf (en && p.enabled) (
         lib.mapAttrs'
           (homePath: src: {
             # TODO: use the user's *actual* home directory, don't guess.

nixpatches/02-rpi4-uboot.patch

@@ -1,16 +0,0 @@
-diff --git a/nixos/modules/system/boot/loader/raspberrypi/uboot-builder.nix b/nixos/modules/system/boot/loader/raspberrypi/uboot-builder.nix
-index a4352ab9a24..8a191e0f694 100644
---- a/nixos/modules/system/boot/loader/raspberrypi/uboot-builder.nix
-+++ b/nixos/modules/system/boot/loader/raspberrypi/uboot-builder.nix
-@@ -16,7 +16,10 @@ let
-       else
-         pkgs.ubootRaspberryPi3_32bit
-     else
--      throw "U-Boot is not yet supported on the raspberry pi 4.";
-+      if isAarch64 then
-+        pkgs.ubootRaspberryPi4_64bit
-+      else
-+        pkgs.ubootRaspberryPi4_32bit;
- 
-   extlinuxConfBuilder =
-     import ../generic-extlinux-compatible/extlinux-conf-builder.nix {

nixpatches/2023-03-03-qtbase-cross-compile.patch

@@ -1,21 +0,0 @@
-diff --git a/pkgs/development/libraries/qt-6/modules/qtbase.nix b/pkgs/development/libraries/qt-6/modules/qtbase.nix
-index e71b0a7613d..72779ac57a5 100644
---- a/pkgs/development/libraries/qt-6/modules/qtbase.nix
-+++ b/pkgs/development/libraries/qt-6/modules/qtbase.nix
-@@ -5,6 +5,7 @@
- , version
- , coreutils
- , bison
-+, buildPackages
- , flex
- , gdb
- , gperf
-@@ -224,6 +225,8 @@ stdenv.mkDerivation rec {
-   ] ++ lib.optionals stdenv.isDarwin [
-     # error: 'path' is unavailable: introduced in macOS 10.15
-     "-DQT_FEATURE_cxx17_filesystem=OFF"
-+  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-+    "-DQT_HOST_PATH=${buildPackages.qt6.full}"
-   ];
- 
-   NIX_LDFLAGS = toString (lib.optionals stdenv.isDarwin [

nixpatches/2023-06-02-qt6-qtwebengine-cross.patch

@@ -1,31 +0,0 @@
-diff --git a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
-index fadbc5d2bfa..e4f2aec5a32 100644
---- a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
-+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
-@@ -97,6 +97,9 @@
- , xnu
- }:
- 
-+let
-+  buildPython = buildPackages.python3.withPackages (ps: with ps; [ html5lib ]);
-+in
- qtModule {
-   pname = "qtwebengine";
-   qtInputs = [ qtdeclarative qtwebchannel qtwebsockets qtpositioning ];
-@@ -108,7 +111,7 @@ qtModule {
-     gperf
-     ninja
-     pkg-config
--    (python3.withPackages (ps: with ps; [ html5lib ]))
-+    buildPython
-     which
-     gn
-     nodejs
-@@ -304,6 +307,7 @@ qtModule {
- 
-   preConfigure = ''
-     export NINJAFLAGS="-j$NIX_BUILD_CORES"
-+    export CMAKE_PREFIX_PATH="${buildPython}/bin:$CMAKE_PREFIX_PATH"
-   '';
- 
-   meta = with lib; {

nixpatches/2023-06-06-jellyfin-no-libsForQt5-callPackage.patch

@@ -1,60 +0,0 @@
-diff --git a/pkgs/applications/video/jellyfin-media-player/default.nix b/pkgs/applications/video/jellyfin-media-player/default.nix
-index e781f80e455..d1990294141 100644
---- a/pkgs/applications/video/jellyfin-media-player/default.nix
-+++ b/pkgs/applications/video/jellyfin-media-player/default.nix
-@@ -1,7 +1,6 @@
- { lib
- , fetchFromGitHub
- , fetchzip
--, mkDerivation
- , stdenv
- , Cocoa
- , CoreAudio
-@@ -12,21 +11,20 @@
- , libGL
- , libX11
- , libXrandr
-+, libsForQt5
- , libvdpau
- , mpv
- , ninja
- , pkg-config
- , python3
--, qtbase
--, qtwayland
--, qtwebchannel
--, qtwebengine
--, qtx11extras
- , jellyfin-web
- , withDbus ? stdenv.isLinux, dbus
- }:
- 
--mkDerivation rec {
-+let
-+  inherit (libsForQt5) qtbase qtwayland qtwebchannel qtwebengine qtx11extras wrapQtAppsHook;
-+in
-+stdenv.mkDerivation rec {
-   pname = "jellyfin-media-player";
-   version = "1.9.1";
- 
-@@ -69,6 +67,7 @@ mkDerivation rec {
-     ninja
-     pkg-config
-     python3
-+    wrapQtAppsHook
-   ];
- 
-   cmakeFlags = [
-diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
-index eb309c9b283..d8a718db698 100644
---- a/pkgs/top-level/all-packages.nix
-+++ b/pkgs/top-level/all-packages.nix
-@@ -5289,7 +5289,7 @@ with pkgs;
- 
-   jellyfin-ffmpeg = callPackage ../development/libraries/jellyfin-ffmpeg { };
- 
--  jellyfin-media-player = libsForQt5.callPackage ../applications/video/jellyfin-media-player {
-+  jellyfin-media-player = callPackage ../applications/video/jellyfin-media-player {
-     inherit (darwin.apple_sdk.frameworks) CoreFoundation Cocoa CoreAudio MediaPlayer;
-     # Disable pipewire to avoid segfault, see https://github.com/jellyfin/jellyfin-media-player/issues/341
-     mpv = wrapMpv (mpv-unwrapped.override { pipewireSupport = false; }) { };

nixpatches/flake.lock

@@ -1,25 +0,0 @@
-{
-  "nodes": {
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1675123384,
-        "narHash": "sha256-RpU+kboEWlIYwbRMGIPBIcztH63CvmqWN1B8GpJogd4=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "e0fa1ece2f3929726c9b98c539ad14b63ae8e4fd",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "type": "indirect"
-      }
-    },
-    "root": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

nixpatches/flake.nix

@@ -1,72 +0,0 @@
-{
-  inputs = {
-    # user is expected to define this from their flake via `inputs.nixpkgs.follows = ...`
-    nixpkgs = {};
-  };
-  outputs = { self, nixpkgs, variant ? "master" }@inputs:
-    let
-      patchedPkgsFor = system: nixpkgs.legacyPackages.${system}.applyPatches {
-        name = "nixpkgs-patched-uninsane";
-        version = nixpkgs.sourceInfo.lastModifiedDate;
-        src = nixpkgs;
-        patches = builtins.filter (p: p != null) (
-          nixpkgs.legacyPackages."${system}".callPackage ./list.nix { } variant nixpkgs.lastModifiedDate
-        );
-      };
-      patchedFlakeFor = system: import "${patchedPkgsFor system}/flake.nix";
-      patchedFlakeOutputsFor = system: (patchedFlakeFor system).outputs {
-        self = self // self._forSystem system;
-      };
-
-      extractBuildPlatform = nixosSystemArgs:
-        builtins.foldl'
-          (acc: mod: ((mod.nixpkgs or {}).buildPlatform or {}).system or acc)
-          (nixosSystemArgs.system or null)
-          (nixosSystemArgs.modules or []);
-    in
-    {
-      # i attempt to mirror the non-patched nixpkgs flake outputs,
-      # however the act of patching is dependent on the build system (can't be done in pure nix),
-      # hence a 100% compatible interface has to be segmented by `system`:
-      _forSystem = system: {
-        inherit (patchedFlakeOutputsFor system) lib;
-        legacyPackages = builtins.mapAttrs
-          (system': _:
-            (patchedFlakeOutputsFor (if system != null then system else system'))
-              .legacyPackages."${system'}"
-          )
-          nixpkgs.legacyPackages;
-      };
-
-      # although i can't expose all of the patched nixpkgs outputs without knowing the `system` to use for patching,
-      # several outputs learn about the system implicitly, so i can expose those:
-      lib.nixosSystem = args: (
-        self._forSystem (extractBuildPlatform args)
-      ).lib.nixosSystem args;
-
-      legacyPackages = (self._forSystem null).legacyPackages;
-
-      # sourceInfo includes fields (square brackets for the ones which are not always present):
-      # - [dirtyRev]
-      # - [dirtyShortRev]
-      # - lastModified
-      # - lastModifiedDate
-      # - narHash
-      # - outPath
-      # - [rev]
-      # - [revCount]
-      # - [shortRev]
-      # - submodules
-      #
-      # these values are used within nixpkgs:
-      # - to give a friendly name to the nixos system (`readlink /run/current-system` -> `...nixos-system-desko-24.05.20240227.dirty`)
-      # - to alias `import <nixpkgs>` so that nix uses the system's nixpkgs when called externally (supposedly).
-      #
-      # these values seem to exist both within the `sourceInfo` attrset and at the top-level.
-      # for a list of all implicit flake outputs (which is what these seem to be):
-      # $ nix-repl
-      # > lf .
-      # > <tab>
-      inherit (nixpkgs) sourceInfo;
-    } // nixpkgs.sourceInfo;
-}

overlays/cross.nix

@@ -698,6 +698,12 @@ in with final; {
   #   ];
   # });
 
+  # upstreaming: <https://github.com/NixOS/nixpkgs/pull/317477>
+  libvpx = prev.libvpx.overrideAttrs (upstream: {
+    # fails building neon extensions for armv7l; see <https://github.com/NixOS/nixpkgs/issues/208746>
+    configureFlags = builtins.map (lib.replaceStrings [ "armv7l-linux-gcc" ] [ "armv7-linux-gcc" ]) upstream.configureFlags;
+  });
+
   # 2024/05/31: upstreaming blocked on qtsvg, libgweather, appstream, glycin-loaders
   loupe = prev.loupe.overrideAttrs (upstream: {
     postPatch = (upstream.postPatch or "") + ''
@@ -709,9 +715,9 @@ in with final; {
 
   # 2024/05/31: upstreaming blocked on qtsvg, appstream, maybe others
   mepo = (prev.mepo.override {
-    # nixpkgs mepo correctly puts `zig_0_11.hook` in nativeBuildInputs,
+    # nixpkgs mepo correctly puts `zig_0_12.hook` in nativeBuildInputs,
     # but for some reason that tries to use the host zig instead of the build zig.
-    zig_0_11 = buildPackages.zig_0_11;
+    zig_0_12 = buildPackages.zig_0_12;
   }).overrideAttrs (upstream: {
     dontUseZigCheck = true;
     nativeBuildInputs = upstream.nativeBuildInputs ++ [
@@ -1223,6 +1229,7 @@ in with final; {
   # });
 
   # 2024/05/31: upstreaming is unblocked
+  # implemented: <https://github.com/NixOS/nixpkgs/pull/315119>
   webp-pixbuf-loader = prev.webp-pixbuf-loader.overrideAttrs (upstream: {
     # fixes: "Builder called die: Cannot wrap '/nix/store/kpp8qhzdjqgvw73llka5gpnsj0l4jlg8-gdk-pixbuf-aarch64-unknown-linux-gnu-2.42.10/bin/gdk-pixbuf-thumbnailer' because it is not an executable file"
     # gdk-pixbuf doesn't create a `bin/` directory when cross-compiling, breaks some thumbnailing stuff.

pkgs/additional/delfin/default.nix

@@ -1,84 +0,0 @@
-{ lib
-, stdenv
-, appstream
-, cargo
-, desktop-file-utils
-, fetchFromGitea
-, gitUpdater
-, gtk4
-, libadwaita
-, libglvnd
-, libepoxy
-, meson
-, mpv-unwrapped
-, ninja
-, openssl
-, pkg-config
-, rustc
-, rustPlatform
-, wrapGAppsHook4
-, devBuild ? false, git
-}:
-
-stdenv.mkDerivation rec {
-  pname = "delfin";
-  version = "0.4.4";
-
-  src = if devBuild then fetchFromGitea {
-    domain = "git.uninsane.org";
-    owner = "colin";
-    repo = "delfin";
-    rev = "dev-sane";
-    hash = "sha256-l/Lm9dUtYfWbf8BoqNodF/5s0FzxhI/dyPevcaeyPME=";
-  } else fetchFromGitea {
-    domain = "codeberg.org";
-    owner = "avery42";
-    repo = "delfin";
-    rev = "v${version}";
-    hash = "sha256-qbl0PvGKI3S845xLr0aXf/uk2uuOXMjvu9S3BOPzxa0=";
-  };
-
-  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}";
-    hash = "sha256-Js1mIotSOayYDjDVQMqXwaeSC2a1g1DeqD6QmeWwztk=";
-  };
-
-  nativeBuildInputs = [
-    appstream
-    desktop-file-utils
-    meson
-    ninja
-    pkg-config
-    rustPlatform.cargoSetupHook
-    cargo
-    rustc
-    wrapGAppsHook4
-  ] ++ lib.optionals devBuild [
-    git
-  ];
-
-  buildInputs = [
-    gtk4
-    libadwaita
-    libglvnd
-    libepoxy
-    mpv-unwrapped
-    openssl
-  ];
-
-  mesonFlags = lib.optionals (!devBuild) [
-    "-Dprofile=release"
-  ];
-
-  passthru.updateScript = gitUpdater {
-    rev-prefix = "v";
-  };
-
-  meta = with lib; {
-    description = "stream movies and TV shows from Jellyfin";
-    homepage = "https://www.delfin.avery.cafe/";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ colinsane ];
-  };
-}

pkgs/additional/firefox-extensions/bypass-paywalls-clean/default.nix

@@ -38,9 +38,10 @@ stdenv.mkDerivation rec {
 
   passthru = {
     extid = "magnolia@12.34";
-    updateScript = gitUpdater {
-      rev-prefix = "v";
-    };
+    # XXX: disabled because the upstream repo has disappeared, and gitlab auth hangs the updater
+    # updateScript = gitUpdater {
+    #   rev-prefix = "v";
+    # };
   };
 
   meta = {

pkgs/additional/firefox-extensions/default.nix

@@ -1,11 +1,13 @@
 { stdenv
 , callPackage
 , concatTextFile
+, fetchpatch
 , fetchurl
 , gnused
 , jq
 , lib
 , newScope
+, nix-update
 , nix-update-script
 , runCommandLocal
 , strip-nondeterminism
@@ -15,6 +17,18 @@
 , zip
 }:
 let
+  nix-update' = nix-update.overrideAttrs (upstream: {
+    patches = (upstream.patches or []) ++ [
+      (fetchpatch {
+        # u-block releases betas, and worse, deletes them later.
+        # i don't know how to ignore them through the nix-update-script API,
+        # but this patch handles that.
+        name = "github: Use API to properly tag prereleases";
+        url = "https://github.com/Mic92/nix-update/pull/246.patch";
+        hash = "sha256-cwajliS1YMEcS2MtrKtpNn64rWHjwNDLI49LKhnlQYM=";
+      })
+    ];
+  });
   wrapAddon = addon: args:
   let
     extid = addon.passthru.extid;
@@ -111,15 +125,7 @@ let
       cp $src $out
     '';
 
-    passthru.updateScript = nix-update-script {
-      extraArgs = [
-        # uBlock mixes X.YY.ZbN and X.YY.ZrcN style.
-        # default nix-update accepts the former but rejects the later as unstable.
-        # that's problematic because beta releases later get pulled.
-        # ideally i'd reject both, but i don't know how.
-        "--version=unstable"
-      ];
-    };
+    passthru.updateScript = (nix-update-script.override { nix-update = nix-update'; }) { };
     passthru.extid = extid;
   };
 
@@ -139,8 +145,8 @@ in (lib.makeScope newScope (self: with self; {
       extid = "webextension@metamask.io";
       pname = "ether-metamask";
       url = "https://github.com/MetaMask/metamask-extension/releases/download/v${version}/metamask-firefox-${version}.zip";
-      version = "11.16.0";
-      hash = "sha256-GqogHIqPneZ/Ngpf5ICm/LSMB3PIC2OjdZYZ5FSKJrk=";
+      version = "11.16.8";
+      hash = "sha256-32KkO72afC9Cm0siiobkCZKmfZqm8/Z6SJK8KwNdeTw=";
     };
     fx_cast = fetchVersionedAddon rec {
       extid = "fx_cast@matt.tf";
@@ -160,15 +166,15 @@ in (lib.makeScope newScope (self: with self; {
       extid = "sponsorBlocker@ajay.app";
       pname = "sponsorblock";
       url = "https://github.com/ajayyy/SponsorBlock/releases/download/${version}/FirefoxSignedInstaller.xpi";
-      version = "5.6";
-      hash = "sha256-7HnWgGxDtkr0LXIGec+V1ACV/hhKAa3zII+SgMC7GSo=";
+      version = "5.6.1";
+      hash = "sha256-b2FIVcOaRyJjWOTtXT9XrLWzcptcuxKJltDGFjpWPRQ=";
     };
     ublacklist = fetchVersionedAddon rec {
       extid = "@ublacklist";
       pname = "ublacklist";
       url = "https://github.com/iorate/ublacklist/releases/download/v${version}/ublacklist-v${version}-firefox.zip";
-      version = "8.7.0";
-      hash = "sha256-70hdLWU8kfu7VO//aXeBi6HO6LvY20vT61zDw/pdQIg=";
+      version = "8.7.1";
+      hash = "sha256-FvZ2IFlvoAYMmZFXTkGtCZ+44MmXioA271DXvNY96j8=";
     };
     ublock-origin = fetchVersionedAddon rec {
       extid = "uBlock0@raymondhill.net";

pkgs/additional/fractal-nixified/default.nix

@@ -347,6 +347,15 @@ let
         }
       ];
     };
+    matrix-sdk-ui = crates.matrix-sdk-ui // {
+      dependencies = lib.forEach crates.matrix-sdk-ui.dependencies (d:
+        if d.name == "matrix-sdk" then d // {
+          # XXX(2024/06/04): experimental-oidc feature drags in p384, which fails armv7l cross
+          features = lib.remove "experimental-oidc" d.features;
+        } else
+          d
+      );
+    };
   };
 
   cargoNix = import ./Cargo.nix {

pkgs/additional/linux-exynos5-mainline/default.nix

@@ -0,0 +1,25 @@
+{ buildLinux
+, fetchFromGitLab
+#v nixpkgs calls `.override` on the kernel to configure additional things
+, features ? {}
+, randstructSeed ? ""
+, ...
+}:
+buildLinux {
+  src = fetchFromGitLab {
+    owner = "exynos5-mainline";
+    repo = "linux";
+    rev = "20e7d0fbd9213858325dfeb9be0da1a3756744a1";
+    hash = "sha256-tbNYuOk4XHRH12B3EdMCgO7EUKaAs6Q7G+/r3r35ZFY=";
+  };
+  version = "6.8.0-rc2";
+  # modDirVersion = "6.8.0-rc2";
+  modDirVersion = "6.8.0-rc2-next-20240201-postmarketos-exynos5";
+  extraMeta.branch = "6.8";
+
+  defconfig = "exynos5_defconfig";
+  autoModules = false;
+  # preferBuiltin = false;
+
+  inherit features randstructSeed;
+}

pkgs/additional/linux-postmarketos-allwinner/default.nix

@@ -2,6 +2,7 @@
 , fetchurl
 , linux-megous
 , linuxManualConfig
+, sane-kernel-tools
 , writeTextFile
 #v nixpkgs calls `.override` on the kernel to configure additional things, but we don't care about those things
 , features ? null
@@ -22,39 +23,7 @@ let
     };
   };
 
-  # parseKconfigValue = str: let
-  #   inherit (lib) kernel;
-  # in
-  #   if str == "y" then
-  #     kernel.yes
-  #   else if str == "m" then
-  #     kernel.module
-  #   else
-  #     # kernel.freeform (lib.removePrefix ''"'' (lib.removeSuffix ''"'' str))
-  #     kernel.freeform str
-  #   ;
-  parseKconfigLine = line: let
-    pieces = lib.splitString "=" line;
-  in
-    if lib.hasPrefix "#" (lib.head pieces) then [
-      # this line is a comment.
-      # N.B.: this could be like `# CONFIG_FOO is not set`, which i might want to report as `n`
-    ] else if lib.length pieces == 1 then [
-      # no equals sign: this is probably a blank line
-    ] else [{
-      name = lib.head pieces;
-      # value = parseKconfigValue (lib.concatStringsSep "=" (lib.tail pieces));
-      # nixpkgs kernel config is some real fucking bullshit: it wants a plain string here instead of the structured config it demands eeeeeeverywhere else.
-      value = lib.concatStringsSep "=" (lib.tail pieces);
-    }]
-  ;
-  parseKconfig = wholeStr: let
-    lines = lib.splitString "\n" wholeStr;
-    parsedItems = lib.concatMap parseKconfigLine lines;
-  in
-    lib.listToAttrs parsedItems;
-
-  KconfigStr = (builtins.readFile ./config-postmarketos-allwinner.aarch64) + ''
+  defconfigStr = (builtins.readFile ./config-postmarketos-allwinner.aarch64) + ''
     #
     # Extra nixpkgs-specific options
     # nixos/modules/system/boot/systemd.nix wants CONFIG_DMIID
@@ -79,11 +48,11 @@ in linuxManualConfig {
 
   configfile = writeTextFile {
     name = "config-postmarketos-allwinner.aarch64";
-    text = KconfigStr;
+    text = defconfigStr;
   };
   # nixpkgs requires to know the config as an attrset, to do various eval-time assertions.
-  # this forces me to include the Kconfig inline, instead of fetching it the way i do all the other pmOS kernel stuff.
-  config = parseKconfig KconfigStr;
+  # this forces me to include the defconfig inline, instead of fetching it the way i do all the other pmOS kernel stuff.
+  config = sane-kernel-tools.parseDefconfig defconfigStr;
 
   # these likely aren't *all* required for pinephone: pmOS kernel is shared by many devices
   kernelPatches = [

pkgs/additional/linux-postmarketos-exynos5/default.nix

@@ -0,0 +1,106 @@
+{ lib
+, linux ? linux_6_1, linux_6_1
+, linuxManualConfig
+, optimizeForSize ? false
+, useEdpPanel ? false  #< use `edp-panel` driver in snow device tree (fails to fix graphics)
+, revertPanelSimplePatch ? false  #< revert the commit which removed B116XW03 panel from panel-edp driver (fixes display output)
+, sane-kernel-tools
+, writeTextFile
+#v nixpkgs calls `.override` on the kernel to configure additional things
+, features ? []
+, randstructSeed ? ""
+, ...
+}@args:
+
+let
+  defconfigPmos = builtins.readFile ./config-postmarketos-exynos5.arm7;
+
+  patches = {
+    useEdpPanel = {
+      name = "snow: use edp-panel driver";
+      patch = ./snow-panel-fix.patch;
+    };
+    revertPanelSimplePatch = {
+      name = "revert ad3e33fe071dffea07279f96dab4f3773c430fe2, and get snow to use edp-panel again";
+      patch = ./snow-panel-revert-b116xw03.patch;
+    };
+  };
+
+  # remove CONFIG_LOCALVERSION else nixpkgs complains about mismatched modDirVersion
+  withoutOsFlavor = defconfig: lib.replaceStrings
+    [ ''CONFIG_LOCALVERSION="-postmarketos-exynos5"'' ]
+    [ ''CONFIG_LOCALVERSION='' ]
+    defconfig
+  ;
+
+  # XXX(2024/06/06): if this module is loaded before udev, then kernel panic.
+  # see: <repo:NixOS/mobile-nixos:devices/families/mainline-chromeos/default.nix>
+  withModuleFixes = defconfig: lib.replaceStrings
+    [ ''CONFIG_BATTERY_SBS=y'' ]
+    [ ''CONFIG_BATTERY_SBS=m'' ]
+    defconfig
+  ;
+
+  withOptimizations = defconfig: if optimizeForSize then
+    lib.replaceStrings
+      [ ''CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y'' ]
+      # XXX(2024/06/06): if the bzImage is too large, it fails to boot.
+      # probably an issue with the uboot relocations; not sure exactly what the size limit is.
+      # XXX(2024/06/08): it now boots fine with the stock optimizations, though the difference in size is only 500KiB (about 10%).
+      # perhaps this was mis-diagnosed
+      [ ''CONFIG_CC_OPTIMIZE_FOR_SIZE=y'' ]
+      defconfig
+  else
+    defconfig
+  ;
+
+  withNixosRequirements = defconfig: defconfig + ''
+    #
+    # Extra nixpkgs-specific options
+    # nixos/modules/system/boot/systemd.nix wants CONFIG_DMIID
+    # nixos/modules/services/hardware/udev.nix wants CONFIG_MODULE_COMPRESS_ZSTD
+    #
+    CONFIG_DMIID=y
+    CONFIG_MODULE_COMPRESS_ZSTD=y
+
+    CONFIG_DRM_LIMA=y
+    CONFIG_DRM_MALI_DISPLAY=m
+
+    #
+    # Extra sane-specific options
+    #
+    CONFIG_SECURITY=y
+    CONFIG_SECURITY_LANDLOCK=y
+    CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,bpf";
+  '';
+
+  defconfigStr = withNixosRequirements (
+    withOptimizations (
+      withModuleFixes (
+        withoutOsFlavor (
+          defconfigPmos
+        )
+      )
+    )
+  );
+in (linuxManualConfig {
+  inherit (linux) extraMakeFlags modDirVersion src version;
+  inherit features randstructSeed;
+  kernelPatches = (args.kernelPatches or []) ++ lib.optionals useEdpPanel [
+    patches.useEdpPanel
+  ] ++ lib.optionals revertPanelSimplePatch [
+    patches.revertPanelSimplePatch
+  ];
+
+  configfile = writeTextFile {
+    name = "config-postmarketos-exynos5.arm7";
+    text = defconfigStr;
+  };
+  # nixpkgs requires to know the config as an attrset, to do various eval-time assertions.
+  # this forces me to include the defconfig inline, instead of fetching it the way i do all the other pmOS kernel stuff.
+  config = sane-kernel-tools.parseDefconfig defconfigStr;
+}).overrideAttrs (base: {
+  passthru = (base.passthru or {}) // {
+    sanePatches = patches;
+  };
+})

pkgs/additional/linux-postmarketos-exynos5/snow-panel-fix.patch

@@ -0,0 +1,13 @@
+diff --git a/arch/arm/boot/dts/samsung/exynos5250-snow-common.dtsi b/arch/arm/boot/dts/samsung/exynos5250-snow-common.dtsi
+index 65b000df176e..bc8060890137 100644
+--- a/arch/arm/boot/dts/samsung/exynos5250-snow-common.dtsi
++++ b/arch/arm/boot/dts/samsung/exynos5250-snow-common.dtsi
+@@ -205,7 +205,7 @@ backlight: backlight {
+ 	};
+ 
+ 	panel: panel {
+-		compatible = "auo,b116xw03";
++		compatible = "edp-panel";
+ 		power-supply = <&fet6>;
+ 		backlight = <&backlight>;
+ 

pkgs/additional/linux-postmarketos-exynos5/snow-panel-revert-b116xw03.patch

@@ -0,0 +1,100 @@
+diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
+index 95c8472d878a..feb665df35a1 100644
+--- a/drivers/gpu/drm/panel/panel-edp.c
++++ b/drivers/gpu/drm/panel/panel-edp.c
+@@ -976,6 +976,32 @@ static const struct panel_desc auo_b116xak01 = {
+ 	},
+ };
+ 
++static const struct drm_display_mode auo_b116xw03_mode = {
++	.clock = 70589,
++	.hdisplay = 1366,
++	.hsync_start = 1366 + 40,
++	.hsync_end = 1366 + 40 + 40,
++	.htotal = 1366 + 40 + 40 + 32,
++	.vdisplay = 768,
++	.vsync_start = 768 + 10,
++	.vsync_end = 768 + 10 + 12,
++	.vtotal = 768 + 10 + 12 + 6,
++	.flags = DRM_MODE_FLAG_NVSYNC | DRM_MODE_FLAG_NHSYNC,
++};
++
++static const struct panel_desc auo_b116xw03 = {
++	.modes = &auo_b116xw03_mode,
++	.num_modes = 1,
++	.bpc = 6,
++	.size = {
++		.width = 256,
++		.height = 144,
++	},
++	.delay = {
++		.enable = 400,
++	},
++};
++
+ static const struct drm_display_mode auo_b133han05_mode = {
+ 	.clock = 142600,
+ 	.hdisplay = 1920,
+@@ -1699,6 +1725,9 @@ static const struct of_device_id platform_of_match[] = {
+ 	}, {
+ 		.compatible = "auo,b116xa01",
+ 		.data = &auo_b116xak01,
++	}, {
++		.compatible = "auo,b116xw03",
++		.data = &auo_b116xw03,
+ 	}, {
+ 		.compatible = "auo,b133han05",
+ 		.data = &auo_b133han05,
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index dd7928d9570f..95959dcc6e0e 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -919,38 +919,6 @@ static const struct panel_desc auo_b101xtn01 = {
+ 	},
+ };
+ 
+-static const struct drm_display_mode auo_b116xw03_mode = {
+-	.clock = 70589,
+-	.hdisplay = 1366,
+-	.hsync_start = 1366 + 40,
+-	.hsync_end = 1366 + 40 + 40,
+-	.htotal = 1366 + 40 + 40 + 32,
+-	.vdisplay = 768,
+-	.vsync_start = 768 + 10,
+-	.vsync_end = 768 + 10 + 12,
+-	.vtotal = 768 + 10 + 12 + 6,
+-	.flags = DRM_MODE_FLAG_NVSYNC | DRM_MODE_FLAG_NHSYNC,
+-};
+-
+-static const struct panel_desc auo_b116xw03 = {
+-	.modes = &auo_b116xw03_mode,
+-	.num_modes = 1,
+-	.bpc = 6,
+-	.size = {
+-		.width = 256,
+-		.height = 144,
+-	},
+-	.delay = {
+-		.prepare = 1,
+-		.enable = 200,
+-		.disable = 200,
+-		.unprepare = 500,
+-	},
+-	.bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG,
+-	.bus_flags = DRM_BUS_FLAG_DE_HIGH,
+-	.connector_type = DRM_MODE_CONNECTOR_LVDS,
+-};
+-
+ static const struct display_timing auo_g070vvn01_timings = {
+ 	.pixelclock = { 33300000, 34209000, 45000000 },
+ 	.hactive = { 800, 800, 800 },
+@@ -4134,9 +4102,6 @@ static const struct of_device_id platform_of_match[] = {
+ 	}, {
+ 		.compatible = "auo,b101xtn01",
+ 		.data = &auo_b101xtn01,
+-	}, {
+-		.compatible = "auo,b116xw03",
+-		.data = &auo_b116xw03,
+ 	}, {
+ 		.compatible = "auo,g070vvn01",
+ 		.data = &auo_g070vvn01,

pkgs/additional/megapixels-next/default.nix

@@ -52,7 +52,6 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "The Linux-phone camera application";
     homepage = "https://gitlab.com/megapixels-org/Megapixels";
-    changelog = "https://gitlab.com/megapixels-org/Megapixels/-/tags/${finalAttrs.version}";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ colinsane ];
     platforms = platforms.linux;

pkgs/additional/mobile-nixos/default.nix

@@ -0,0 +1,19 @@
+{ pkgs
+, fetchFromGitHub
+}:
+let
+  src = fetchFromGitHub {
+    owner = "nixos";
+    repo = "mobile-nixos";
+    # XXX: commit `0f3ac0bef1aea70254a3bae35e3cc2561623f4c1`
+    # replaces the imageBuilder with a "new implementation from celun" and wildly breaks my use.
+    # pinning to d25d3b... is equivalent to holding at 2023-09-15
+    rev = "d25d3b87e7f300d8066e31d792337d9cd7ecd23b";
+    hash = "sha256-MiVokKlpcJmfoGuWAMeW1En7gZ5hk0rCQArYm6P9XCc=";
+  };
+  overlay = import "${src}/overlay/overlay.nix";
+  final = pkgs.appendOverlays [ overlay ];
+in src.overrideAttrs (base: {
+  # passthru only mobile-nixos' own packages -- not the whole nixpkgs-with-mobile-nixos-as-overlay:
+  passthru = base.passthru // (overlay final pkgs);
+})

pkgs/additional/nixpkgs-wayland/default.nix

@@ -0,0 +1,37 @@
+{ pkgs
+, fetchFromGitHub
+, lib
+, nix-update-script
+}:
+let
+  src = fetchFromGitHub {
+    owner = "nix-community";
+    repo = "nixpkgs-wayland";
+    rev = "021a0a37c336730956f5ce741c2a5c0e5c113b40";
+    hash = "sha256-NiBJ7EgvGmDmXy1MG1r++afIzFJBmir2PQ4wmMNIaWw=";
+  };
+  flake = import "${src}/flake.nix";
+  evaluated = flake.outputs {
+    self = evaluated;
+    lib-aggregate.lib = lib // {
+      # mock out flake-utils, which it uses to construct flavored package sets.
+      # we only need the overlay (unflavored)
+      flake-utils.eachSystem = sys: fn: {};
+    };
+  };
+  overlay = evaluated.overlay;
+
+  final = pkgs.appendOverlays [ overlay ];
+in src.overrideAttrs (base: {
+  # attributes required by update scripts
+  pname = "nixpkgs-wayland";
+  version = "0-unstable-2024-06-08";
+  src = src;
+
+  # passthru only nixpkgs-wayland's own packages -- not the whole nixpkgs-with-nixpkgs-wayland-as-overlay:
+  passthru = base.passthru // (overlay final pkgs) // {
+    updateScript = nix-update-script {
+      extraArgs = [ "--version" "branch" ];
+    };
+  };
+})

pkgs/additional/nixpkgs/default.nix

@@ -0,0 +1,90 @@
+# XXX: this is in the bootstrap path;
+# this means it has to be evaluatable using only builtins,
+# though i'm free to include optional functionality (e.g. update scripts) so long as i gate it behind availability checks.
+#
+# branch workflow:
+# - daily:
+#   - nixos-unstable cut from master after enough packages have been built in caches.
+# - every 6 hours:
+#   - master auto-merged into staging and staging-next
+#   - staging-next auto-merged into staging.
+# - manually, approximately once per month:
+#   - staging-next is cut from staging.
+#   - staging-next merged into master.
+#
+# which branch to source from?
+# - nixos-unstable: for everyday development; it provides good caching
+# - master: temporarily if i'm otherwise cherry-picking lots of already-applied patches
+# - staging-next: if testing stuff that's been PR'd into staging, i.e. base library updates.
+# - staging: maybe if no staging-next -> master PR has been cut yet?
+{ variant ? "master"
+, doPatch ? true
+, localSystem ? builtins.currentSystem  #< not available in pure mode
+, system ? localSystem
+#VVV these may or may not be available when called VVV
+, fetchzip ? builtins.fetchTarball
+, nix-update-script ? null
+}:
+let
+  lock = {
+    master.rev = "33605cdf028a6bfb96ce5d6e6e87d4779555f35f";
+    master.sha256 = "sha256-Lp669vFtN0vaCyOmXiA1UWrBXyyTlxYu2cZhaD10gn4=";
+    staging.rev = "33605cdf028a6bfb96ce5d6e6e87d4779555f35f";
+    staging.sha256 = "sha256-Lp669vFtN0vaCyOmXiA1UWrBXyyTlxYu2cZhaD10gn4=";
+    staging-next.rev = "33605cdf028a6bfb96ce5d6e6e87d4779555f35f";
+    staging-next.sha256 = "sha256-Lp669vFtN0vaCyOmXiA1UWrBXyyTlxYu2cZhaD10gn4=";
+  };
+  lock' = lock."${variant}";
+  unpatchedSrc = fetchzip {
+    url = "https://github.com/NixOS/nixpkgs/archive/${lock'.rev}.tar.gz";
+    inherit (lock') sha256;
+  };
+  unpatchedNixpkgs = import unpatchedSrc { inherit localSystem; };
+
+  patchedSrc = unpatchedNixpkgs.applyPatches {
+    name = "nixpkgs-patched-uninsane";
+    # version = ...
+    src = unpatchedSrc;
+    patches = unpatchedNixpkgs.callPackage ./list.nix { };
+    # skip applied patches
+    prePatch = ''
+      realpatch=$(command -v patch)
+      patch() {
+         OUT=$($realpatch "$@") || echo "$OUT" | grep "Skipping patch" -q
+      }
+    '';
+  };
+
+  src = if doPatch then patchedSrc else { outPath = unpatchedSrc; };
+  args = {
+    inherit localSystem;
+    config = {
+      allowUnfree = true;  # NIXPKGS_ALLOW_UNFREE=1
+      allowBroken = true;  # NIXPKGS_ALLOW_BROKEN=1
+    };
+  } // (if (system != localSystem) then {
+    # XXX(2023/12/11): cache.nixos.org uses `system = ...` instead of `hostPlatform.system`, and that choice impacts the closure of every package.
+    # so avoid specifying hostPlatform.system on non-cross builds, so i can use upstream caches.
+    crossSystem = system;
+  } else {});
+
+  nixpkgs = import "${src}" args;
+in
+  # N.B.: this is crafted to allow `nixpkgs.FOO` from other nix code
+  # AND `nix-build -A nixpkgs`
+  if src ? overrideAttrs then
+    src.overrideAttrs (base: {
+      # attributes needed for update scripts
+      pname = "nixpkgs";
+      version = "24.05-unstable-2024-06-08";
+      passthru = (base.passthru or {}) // nixpkgs // {
+        src = unpatchedSrc // {
+          inherit (lock') rev;
+        };
+        updateScript = nix-update-script {
+          extraArgs = [ "--version" "branch" ];
+        };
+      };
+    })
+  else
+    nixpkgs

pkgs/additional/nixpkgs/list.nix

@@ -1,5 +1,4 @@
 { fetchpatch2, fetchurl, lib }:
-variant: date:
 let
   fetchpatch' = {
     saneCommit ? null,
@@ -8,7 +7,6 @@ let
     hash ? null,
     title ? null,
     revert ? false,
-    merged ? {},
   }:
     let
       url = if prUrl != null then
@@ -19,18 +17,33 @@ let
       else
         "https://github.com/NixOS/nixpkgs/commit/${nixpkgsCommit}.patch"
       ;
-      isMerged = merged ? "${variant}" && lib.versionAtLeast date merged."${variant}";
-    in if !isMerged then fetchpatch2 (
+    in fetchpatch2 (
       { inherit revert url; }
       // (if hash != null then { inherit hash; } else {})
       // (if title != null then { name = title; } else {})
-    ) else null;
-in [
-  # if a patch has been merged, use
-  #   merged.staging = "<date>";
-  #   merged.master = "<date>";
-  # etc, where "date" is like "20240228181608"
-  # and can be found with `nix-repl  > :lf .  > lastModifiedDate`
+    );
+in
+[
+  # TODO: apply this once it's fixed for aarch64
+  # (fetchpatch' {
+  #   title = "libvpx: fix cross compiling for armv7";
+  #   prUrl = "https://github.com/NixOS/nixpkgs/pull/317477";
+  #   hash = "sha256-5W/5/u2CXJJEgTjPx/do6SRZ6WEfhlAi/qXYS/Lsb14=";
+  # })
+
+  (fetchpatch' {
+    title = "sysvol: init at 0-unstable-2024-06-07";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/318440";
+    hash = "sha256-zVuZHGIFpXrXnpYM1v0IJ6zw5gwTgkTxq08QfBVSLpI=";
+  })
+
+  (fetchpatch' {
+    title = "nixos/networkmanager: split ModemManager bits into own module";
+    prUrl = "https://github.com/NixOS/nixpkgs/pull/316824";
+    hash = "sha256-u0hd2VfEcqkhs4xgv1gF6sXqnVJYVRgmSKBrmYUw29c=";
+    # saneCommit = "23bfba9b76757ffc00fc2be810009dcf92e2eaf2";
+    # hash = "sha256-cn6ihwO3MyzdpVoJoQNKAHyo8GuGvFP6vr//7r9pzjE=";
+  })
 
   (fetchpatch' {
     title = "trust-dns: rebrand as hickory-dns";
@@ -38,14 +51,6 @@ in [
     hash = "sha256-N4DfNhCeg9etVeTPVzJ73CwiZzf43SozK8nrfXIm0uQ=";
   })
 
-  (fetchpatch' {
-    title = "libphonenumber: fix cross compilation";
-    prUrl = "https://github.com/NixOS/nixpkgs/pull/316094";
-    saneCommit = "151fb5ea9c43847dbd114cb80c04ce7118fef95d";
-    # hash = "sha256-dvgpuldhBlSrpwkqNEtgAHqhaGsrMwoAT+Q5J27NYrQ=";
-    hash = "sha256-N8ZA/93qTmrCE9eE8VPgkXD/ciTOHdD5zRz9JJLU5gA=";
-  })
-
   (fetchpatch' {
     title = "passt: support cross compilation";
     saneCommit = "3ef36d3aa139f94e8716b0721856c5808937c9f2";
@@ -54,7 +59,8 @@ in [
 
   # branch: wip-ffado-cross
   (fetchpatch' {
-    # TODO: send out for review (after jtolnar's stuff is merged)
+    # TODO: send out for review (after jtojnar's stuff is merged)
+    # - <https://github.com/NixOS/nixpkgs/pull/306407>
     title = "ffado: support cross compilation";
     saneCommit = "001fe13a735cb9c6fad80525531e863f949e1495";
     hash = "sha256-rVsFR8vRTHqFJgDQFHI/E0LtllqKr79FyR92HPeLUb8=";
@@ -74,8 +80,8 @@ in [
     hash = "sha256-IW+0u5lytIPU3xhgGtYgexXUrS2VFXAV6GC50jJS5ak=";
   })
 
-  # 2024/02/25: still outstanding
   # (fetchpatch' {
+  #   # 2024/06/08: still outstanding
   #   title = "hspell: remove build perl from runtime closure";
   #   prUrl = "https://github.com/NixOS/nixpkgs/pull/263182";
   #   hash = "sha256-Wau+PB+EUQDvWX8Kycw1sNrM3GkPVjKSS4niIDI0sjM=";
@@ -160,18 +166,6 @@ in [
   #   hash = "sha256-oQEM3EZfAOmfZzDu9faCqyOFZsdHYGn1mVBgkxt68Zg=";
   # })
 
-  # (fetchpatch {
-  #   # stdenv: fix cc for pseudo-crosscompilation
-  #   # closed because it breaks pkgsStatic (as of 2023/02/12)
-  #   url = "https://github.com/NixOS/nixpkgs/pull/196497.diff";
-  #   hash = "sha256-eTwEbVULYjmOW7zUFcTUqvBZqUFjHTKFhvmU2m3XQeo=";
-  # })
-
-  # for raspberry pi: allow building u-boot for rpi 4{,00}
-  # TODO: remove after upstreamed: https://github.com/NixOS/nixpkgs/pull/176018
-  #   (it's a dupe of https://github.com/NixOS/nixpkgs/pull/112677 )
-  # ./02-rpi4-uboot.patch
-
   # (fetchpatch' {
   #   title = "gnustep: remove `rec` to support `overrideScope`";
   #   saneCommit = "69162cbf727264e50fc9d7222a03789d12644705";
@@ -200,28 +194,4 @@ in [
   #   saneCommit = "7a4191c570b0e5a1ab257222c26a4a2ecb945037";
   #   hash = "sha256-FiPJhHGqZ8MFwLY+1t6HgbK6ndomFSYUKvApvrikRHE=";
   # })
-
-  # (fetchpatch' {
-  #   # doesn't apply cleanly. use build result in <working/zcash>
-  #   title = "zcash: 5.4.2 -> 5.7.0";
-  #   prUrl = "https://github.com/NixOS/nixpkgs/pull/229810";
-  #   hash = "sha256-ProoPJ10rUtOZh2PzpegviG6Ip1zSuWC92BpP+ux9ZQ=";
-  # })
-  # (fetchpatch' {
-  #   # disabled, at least until the PR is updated to use `pkg-config` instead of `pkgconfig`.
-  #   # the latter is an alias, which breaks nix-index
-  #   title = "phog: init at 0.1.3";
-  #   prUrl = "https://github.com/NixOS/nixpkgs/pull/251249";
-  #   hash = "sha256-e38Z7sO7xDQHzE9UOfbptc6vJuONE5eP9JFp2Nzx53E=";
-  # })
-
-  # fix qt6.qtbase and qt6.qtModule to cross-compile.
-  # unfortunately there's some tangle that makes that difficult to do via the normal `override` facilities
-  # ./2023-03-03-qtbase-cross-compile.patch
-
-  # qt6 qtwebengine: specify `python` as buildPackages
-  # ./2023-06-02-qt6-qtwebengine-cross.patch
-
-  # Jellyfin: don't build via `libsForQt5.callPackage`
-  # ./2023-06-06-jellyfin-no-libsForQt5-callPackage.patch
 ]

pkgs/additional/sane-backgrounds/default.nix

@@ -1,3 +1,8 @@
+# NixOS backgrounds:
+# - <https://github.com/NixOS/nixos-artwork>
+#   - <https://github.com/NixOS/nixos-artwork/issues/50>  (colorful; unmerged)
+#   - <https://github.com/NixOS/nixos-artwork/pull/60/files>  (desktop-oriented; clean; unmerged)
+# - <https://itsfoss.com/content/images/2023/04/nixos-tutorials.png>
 { stdenv
 , inkscape
 }:

pkgs/additional/sane-kernel-tools/default.nix

@@ -0,0 +1,26 @@
+{ lib
+, newScope
+}:
+lib.makeScope newScope (self: with self; {
+  parseDefconfigLine = line: let
+    pieces = lib.splitString "=" line;
+  in
+    if lib.hasPrefix "#" (lib.head pieces) then [
+      # this line is a comment.
+      # N.B.: this could be like `# CONFIG_FOO is not set`, which i might want to report as `n`
+    ] else if lib.length pieces == 1 then [
+      # no equals sign: this is probably a blank line
+    ] else [{
+      name = lib.head pieces;
+      # nixpkgs kernel config is some real fucking bullshit: it wants a plain string here instead of the structured config it demands eeeeeeverywhere else.
+      value = lib.concatStringsSep "=" (lib.tail pieces);
+    }]
+  ;
+  # parseDefconfig: given the entire text of a defconfig file
+  # parse it into an attrset usable by the nixpkgs kernel config tools.
+  parseDefconfig = wholeStr: let
+    lines = lib.splitString "\n" wholeStr;
+    parsedItems = lib.concatMap parseDefconfigLine lines;
+  in
+    lib.listToAttrs parsedItems;
+})

pkgs/additional/sane-scripts/src/sane-reboot

@@ -7,8 +7,10 @@ shift
 host="$(hostname)"
 if [ "$host" = "$target" ]
 then
-  # N.B.: anything other than just `reboot` with no args requires `sudo` privilegs (to write to /run/systemd/)
-  reboot "$@"
+  # N.B.: anything other than just `reboot` with no args requires `sudo` privileges (to write to /run/systemd/).
+  # `systemctl reboot -i` tells systemd to ignore inhibitors (i.e. other users logged in).
+  reboot "$@" || \
+    systemctl reboot -i "$@"
 else
   echo "WRONG MACHINE. you're on $host."
   exit 1

pkgs/additional/signal-desktop-from-src/default.nix

@@ -118,7 +118,7 @@
 , yarn
 }:
 let
-  version = "7.8.0";
+  version = "7.11.1";
 
   ringrtcPrebuild = fetchurl {
     # version is found in signal-desktop's package.json as "@signalapp/ringrtc"
@@ -165,11 +165,11 @@ let
     repo = "Signal-Desktop";
     leaveDotGit = true;  # signal calculates the release date via `git`
     rev = "v${version}";
-    hash = "sha256-CBcLk54cu4PGGZbQsPeYjjWnRFmFPxM9+mxLdQKCPP0=";
+    hash = "sha256-A+VcVo+avtIg7IbO1NWaG2nitnFG5mRfB55wgSiDsbA=";
   };
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${src}/yarn.lock";
-    hash = "sha256-ImkJyphN0YfXOUuU14HII/3798kbQ4iwgXr600k4PHU=";
+    hash = "sha256-q9kBoGXti37sgNhhYTqw+w8NHO35zp+v77mxKQTqv7g=";
   };
 
   nodejs' = mkNodeJs pkgs;
@@ -400,8 +400,8 @@ stdenv.mkDerivation rec {
   passthru = {
     # inherit bettersqlitePatch signal-fts5-extension;
     updateScript = gitUpdater {
-      # TODO: prevent update to betas
       rev-prefix = "v";
+      ignoredVersions = "beta";
     };
     nodejs = nodejs';
     buildYarn = buildYarn;

pkgs/additional/sops-nix/default.nix

@@ -0,0 +1,36 @@
+{ pkgs
+, fetchFromGitHub
+, nix-update-script
+}:
+let
+  src = fetchFromGitHub {
+    owner = "Mic92";
+    repo = "sops-nix";
+    rev = "d4555e80d80d2fa77f0a44201ca299f9602492a0";
+    hash = "sha256-8Q6mKSsto8gaGczXd4G0lvawdAYLa5Dlh3/g4hl5CaM=";
+  };
+  flake = import "${src}/flake.nix";
+  evaluated = flake.outputs {
+    self = evaluated;
+    nixpkgs = pkgs;
+    nixpkgs-stable = pkgs;  #< shameless lie :)
+  };
+  overlay = evaluated.overlays.default;
+  final = pkgs.appendOverlays [ overlay ];
+in src.overrideAttrs (base: {
+  # attributes required by update scripts
+  pname = "sops-nix";
+  # nix-update-script insists on this weird `assets-` version format
+  version = "assets-unstable-2024-06-03";
+  src = src;
+
+  passthru = base.passthru
+    // (overlay final pkgs)
+    // { inherit (evaluated) nixosModules; }
+    // {
+      updateScript = nix-update-script {
+        extraArgs = [ "--version" "branch" ];
+      };
+    }
+  ;
+})

pkgs/additional/sysvol/default.nix

@@ -3,49 +3,47 @@
 , gtk4-layer-shell
 , gtkmm4
 , pkg-config
-, pulseaudio
+, nix-update-script
+, wireplumber
 , wrapGAppsHook4
 }:
-stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation {
   pname = "sysvol";
-  version = "0-unstable-2024-04-11";
+  version = "0-unstable-2024-06-07";
 
   src = fetchFromGitHub {
-    owner = "AmirDahan";
+    owner = "System64fumo";
     repo = "sysvol";
-    rev = "a26809de285ee194436bc55ef701476765c5b15e";
-    hash = "sha256-WiFm5SRQV2up9EBCR9oF0p9F+DQHDQZhxsaUuvpbMw8=";
+    rev = "56d7dcda4b246e71b2c6d29cbb2315bddf446032";
+    hash = "sha256-WOcy2R0El1vl57Zimb7Hoh9XYTnH/zJS1n+gcaTU4V8=";
   };
-  postPatch = let
-    # i don't know how else to escape this
-    var = v: lib.concatStrings [ "$" "{" v "}" ];
-  in ''
+  postPatch = ''
     substituteInPlace Makefile \
-      --replace-fail 'pkg-config' '${var "PKG_CONFIG"}' \
-      --replace-fail 'g++' '${var "CXX"}' \
-      --replace-fail 'strip sysvol' ""
+      --replace-fail 'pkg-config' ''${PKG_CONFIG}
   '';
 
   nativeBuildInputs = [
     pkg-config
     wrapGAppsHook4  #< to plumb `GDK_PIXBUF_MODULE_FILE` through, and get not-blurry icons
   ];
+
   buildInputs = [
     gtk4-layer-shell
     gtkmm4
-    pulseaudio
+    wireplumber
   ];
 
-  installPhase = ''
-    mkdir -p $out/bin
-    install -m755 sysvol $out/bin/sysvol
-  '';
+  makeFlags = [ "DESTDIR=${placeholder "out"}" ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version" "branch" ];
+  };
 
   meta = {
     description = "A basic GTK4 volume indicator";
-    inherit (finalAttrs.src.meta) homepage;
+    homepage = "https://github.com/System64fumo/sysvol";
     mainProgram = "sysvol";
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ colinsane ];
   };
-})
+}

pkgs/additional/uassets/default.nix

@@ -5,12 +5,12 @@
 }:
 stdenv.mkDerivation {
   pname = "uassets";
-  version = "0-unstable-2024-05-27";
+  version = "0-unstable-2024-06-08";
   src = fetchFromGitHub {
     owner = "uBlockOrigin";
     repo = "uAssets";
-    rev = "deb1f47b49461e1c2f307931fc6a02c76137168b";
-    hash = "sha256-IhzNUSkGnGuY9YBq9rN7l2rwxHzRMQTp3aPJ6xF46lU=";
+    rev = "e79260cc653865b9b562e1153d0b7c5e2b93a0a9";
+    hash = "sha256-2qnrB+GV5LXlA5TgstbOc/YRewuExYtAQakfrE1XuuQ=";
   };
 
   dontBuild = true;

pkgs/additional/uninsane-dot-org/default.nix

@@ -0,0 +1,12 @@
+{ callPackage
+, fetchFromGitea
+}:
+let
+  src = fetchFromGitea {
+    domain = "git.uninsane.org";
+    owner = "colin";
+    repo = "uninsane";
+    rev = "e6f88f563bdd1700c04018951de4f69862646dd1";
+    hash = "sha256-h1EdA/h74zgNPNEYbH+0mgOMlJgLVcxuZ8/ewsZlgEc=";
+  };
+in callPackage "${src}/default.nix" { }

pkgs/default.nix

@@ -5,7 +5,7 @@
 # using the correct invocation is critical if any packages mentioned here are
 # additionally patched elsewhere
 #
-{ pkgs ? import <nixpkgs> {}, final ? null }:
+{ pkgs ? import ./additional/nixpkgs { }, final ? null }:
 let
   lib = pkgs.lib;
   unpatched = pkgs;
@@ -28,7 +28,6 @@ let
     chatty-latest = callPackage ./additional/chatty-latest { };
     codemadness-frontends = callPackage ./additional/codemadness-frontends { };
     codemadness-frontends_0_6 = codemadness-frontends.v0_6;
-    delfin = callPackage ./additional/delfin { };
     eg25-control = callPackage ./additional/eg25-control { };
     eg25-manager = callPackage ./additional/eg25-manager { };
     feeds = lib.recurseIntoAttrs (callPackage ./additional/feeds { });
@@ -52,16 +51,26 @@ let
     libdng = callPackage ./additional/libdng { };
     libmegapixels = callPackage ./additional/libmegapixels { };
     lightdm-mobile-greeter = callPackage ./additional/lightdm-mobile-greeter { };
+    linux-exynos5-mainline = callPackage ./additional/linux-exynos5-mainline { };
     linux-firmware-megous = callPackage ./additional/linux-firmware-megous { };
     # XXX: eval error: need to port past linux_6_4
     # linux-manjaro = callPackage ./additional/linux-manjaro { };
     linux-megous = callPackage ./additional/linux-megous { };
-    linux-postmarketos = callPackage ./additional/linux-postmarketos { };
+    linux-postmarketos-allwinner = callPackage ./additional/linux-postmarketos-allwinner { };
+    linux-postmarketos-exynos5 = callPackage ./additional/linux-postmarketos-exynos5 { };
     mcg = callPackage ./additional/mcg { };
     megapixels-next = callPackage ./additional/megapixels-next { };
+    mobile-nixos = callPackage ./additional/mobile-nixos { };
     modemmanager-split = callPackage ./additional/modemmanager-split { };
     mx-sanebot = callPackage ./additional/mx-sanebot { };
     networkmanager-split = callPackage ./additional/networkmanager-split { };
+    nixpkgs = callPackage ./additional/nixpkgs {
+      localSystem = stdenv.buildPlatform.system;
+      system = stdenv.hostPlatform.system;
+    };
+    nixpkgs-staging = nixpkgs.override { variant = "staging"; };
+    nixpkgs-next = nixpkgs.override { variant = "staging-next"; };
+    nixpkgs-wayland = callPackage ./additional/nixpkgs-wayland { };
     peerswap = callPackage ./additional/peerswap { };
     phog = callPackage ./additional/phog { };
     pipeline = callPackage ./additional/pipeline { };
@@ -70,6 +79,7 @@ let
     sane-backgrounds = callPackage ./additional/sane-backgrounds { };
     sane-cast = callPackage ./additional/sane-cast { };
     sane-die-with-parent = callPackage ./additional/sane-die-with-parent { };
+    sane-kernel-tools = lib.recurseIntoAttrs (callPackage ./additional/sane-kernel-tools { });
     sane-open = callPackage ./additional/sane-open { };
     sane-screenshot = callPackage ./additional/sane-screenshot { };
     sane-scripts = lib.recurseIntoAttrs (callPackage ./additional/sane-scripts { });
@@ -77,6 +87,7 @@ let
     sanebox = callPackage ./additional/sanebox { };
     schlock = callPackage ./additional/schlock { };
     signal-desktop-from-src = callPackage ./additional/signal-desktop-from-src { };
+    sops-nix = callPackage ./additional/sops-nix { };
     static-nix-shell = callPackage ./additional/static-nix-shell { };
     sublime-music-mobile = callPackage ./additional/sublime-music-mobile { };
     swaylock-mobile = callPackage ./additional/swaylock-mobile { };
@@ -89,6 +100,7 @@ let
     tree-sitter-nix-shell = callPackage ./additional/tree-sitter-nix-shell { };
     trivial-builders = lib.recurseIntoAttrs (callPackage ./additional/trivial-builders { });
     uassets = callPackage ./additional/uassets { };
+    uninsane-dot-org = callPackage ./additional/uninsane-dot-org { };
     wvkbd-mk = callPackage ./additional/wvkbd-mk { };
     inherit (trivial-builders)
       copyIntoOwnPackage

pkgs/python-packages/default.nix

@@ -1,5 +1,6 @@
 { callPackage, pkgs }:
 {
+  depthcharge-tools = callPackage ./depthcharge-tools { };
   feedsearch-crawler = callPackage ./feedsearch-crawler { };
   pa-dlna = callPackage ./pa-dlna { };
   pyln-bolt7 = callPackage ./pyln-bolt7 { };

pkgs/python-packages/depthcharge-tools/default.nix

@@ -0,0 +1,30 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools
+}: buildPythonPackage rec {
+  pname = "depthcharge-tools";
+  version = "0.6.2";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "alpernebbi";
+    repo = "depthcharge-tools";
+    rev = "v${version}";
+    hash = "sha256-3xPRNDUXLOwYy8quMfYSiBfzQl4peauTloqtZBGbvlw=";
+  };
+
+  propagatedBuildInputs = [
+    setuptools  #< needs `pkg_resources` at runtime
+  ];
+
+  pythonImportsCheck = [
+    "depthcharge_tools"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/alpernebbi/depthcharge-tools";
+    description = "Tools to manage the Chrome OS bootloader";
+    maintainers = with maintainers; [ colinsane ];
+  };
+}

scripts/health-check

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl -p dig -p iputils -p lftp
+#!nix-shell -i bash -p curl -p dig -p iputils -p lftp -p openssh
 
 echo "this script will check that uninsane.org is baseline operational"
 echo "it doesn't check all services, just the most critical ones"
@@ -45,6 +45,10 @@ check "git.uninsane.org" git ls-remote origin --quiet
 
 check "ftp://uninsane.org" lftpget ftp://uninsane.org/README.md && rm README.md
 
+echo ""
+echo "systemctl --failed:"
+ssh uninsane.org systemctl -q --failed
+
 echo ""
 if [ $last_error -eq 0 ]; then
   echo "SUCCESS"

scripts/update

@@ -0,0 +1,91 @@
+#!/bin/sh
+
+showHelp() {
+  echo "update: updates flake inputs"
+  echo "usage: update [flags] [input [input ...]]"
+  echo ""
+  echo "flags:"
+  echo "  --help"
+  echo "  --dry-run"
+  echo "inputs:"
+  echo "  all: update every input"
+  echo "  safe: update inputs which rarely break the build, or are trivial to patch"
+  echo "  unsafe: update inputs which may be annoying to patch if they break the build"
+  echo "  nixpkgs"
+  echo "  next"
+}
+
+inputs=()
+dryRun=
+
+parseArgs() {
+  for arg in "$@"; do
+    case $arg in
+      (--help)
+        showHelp
+        exit 1
+        ;;
+      (--dry-run)
+        dryRun=1
+        ;;
+      (*)
+        addInputs "$arg"
+        ;;
+    esac
+  done
+  # if no inputs were specified, assume "all"
+  if [ ${#inputs} -eq 0 ]; then
+    addInputs all
+  fi
+}
+
+# add $1 to `inputs` array, after parsing it
+addInputs() {
+  case $1 in
+    (all)
+      addInputs safe
+      addInputs unsafe
+      ;;
+    (next)
+      addInputs nixpkgs-next-unpatched
+      addInputs nixpkgs-staging-unpatched
+      ;;
+    (safe)
+      addInputs next
+      addInputs nixpkgs-unpatched
+      addInputs sops-nix
+      addInputs uninsane-dot-org
+      ;;
+    (unsafe)
+      # these tend to break more frequently
+      addInputs mobile-nixos
+      addInputs nixpkgs-wayland
+      ;;
+    (mobile-nixos|nixpkgs-next-unpatched|nixpkgs-staging-unpatched|nixpkgs-unpatched|nixpkgs-wayland|sops-nix|uninsane-dot-org)
+      inputs+=("$1")
+      ;;
+    (*)
+      echo "unknown input '$1'"
+      exit 1
+      ;;
+  esac
+}
+
+# exec $@, unless we're in a dry-run in which case just print what would be done
+doEffect() {
+  if [ -n "$dryRun" ]; then
+    echo "dry-run: $*"
+  else
+    "$@"
+  fi
+}
+
+parseArgs "$@"
+
+echo "updating:" "${inputs[@]}"
+nixFlags=()
+for i in "${inputs[@]}"; do
+  nixFlags+=("--update-input" "$i")
+done
+
+doEffect nix flake lock "${nixFlags[@]}"

secrets/common/aerc_accounts.conf.bin

@@ -8,35 +8,39 @@
 		"age": [
 			{
 				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDdDR3YitDWkxvVFpOWTFS\nQXNrbHZHSzZzanpnR1Z0bE82aFpiUmNMR3djCitYT0J4K0daZmlXTzhJbWR3K0tY\nZFA0QS9rdXV5bVVXRXVuUStVd3RMeUEKLS0tIExicUdTcEFMZHZEOEFmdkV1T0tE\nc01seHdzS3RyMjc4dXF0ME1seEUzUFUKvctFuHiqCIBYGqIKQhMO7imfylxlKXBY\nezzfi0MMlfoSMmz8XqkCYT1kdgYVM1cCOwtBBmTzE2muhWK7o0zPCQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnTVJOMHVUZkFydmp3elo5\nRHlETmJUZFhpbVhpOUJPRzFXMVdGOWR6d0ZNClkrdWJBMkQ3ZHNkMWlQZDlVMWxk\nVXFrT2h6R24ya0F6VFRMTDNXaHkwZk0KLS0tIElmdTU0TC9QSzZXb3Y5ZUpLenl3\nN0gwbWVuMnQ3bGpqeU94V3kzVlFyT1EKJqdCjXhQchEXOB02EwtqmNE0TWiaR7Hz\nT8FKJXMM+2ZX7kuhv0rp7bdS+mp5Guv2vO0aIF0rDmE1/7ety2OLfQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxWnhldzk0UFdIcU03UUtE\nZ0VRVzBBRHp2cFA5Q2RjbU9kT3V4eHR1SFE0CkJRSndMZ3JOVjFRVytXSXBIbEk1\nKzBUR2pZWTVXTTRhQ2J5VlR0ejRpa00KLS0tIDZveWl3dUJZL0tIVUhKTDJPalBF\nVFVWcDBDdUt4ZlBZejQ4MGNJTGNzSGcKM9jHMEkRCmil2GO4DRVJMdPd4wikyNyP\nbI86+Z7llsMSWZdl+M/ZcTuJSq9Lh69hVNzKObuuW2GgApwoju9Lsg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBadnFScW1Zb0FKU1ErTXBM\nS01mMzNqZ3lRdDBQMHg4OFM4c1A4MEFPb1FNCktseFpzVVQ0SzZ4ZHVncm0rZkwv\nVnIwbkV5OW1TbGEveHlqenFSblRRblUKLS0tIGw2V3lYeHR6MnFQUjFqVzBKRE1P\nQ0pqVHNNekJzdWxFckdwUDBOQkt0UUUKN4/UFM2Po0yoQQNuhjh7E+kHUMqeyj3M\nxnH4ZEq4DK1VG2E816dKrsPjo6Zy4/FA6WEezPRkQ/l3j/OmtlzpHQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5NUJpc2hpY0Vwb09GbHUv\nRWRjbjRHS2xxWWNhN3BlbHlOcUgranYxZG5jCnhQOWdBM1dKdGNTL2ZuamxjSlNS\nU2VCYTZQZVJTOE1sWEYvV0cyZUlNMmcKLS0tIHk0WXNyZHIxaHJ1Wm1xVk5ZZ1lj\nL1JnTjZrK3JjK25FdEFEdzlvTURrV0UKL0HMaRQBg4KJTW+pb8RWe6iZVMJhtwrI\naH83tABhElaf1JKx8YiCG9+RHkis35nzxqSoJDN0bN5jRgVVG6C1iw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKYVh3dUZ4RFA5TmErc0Ry\nL0NGR1o2L3ZzZDhHcnFTM3dwYVl0UTFyakJZCmhxVGNTWFRRWDhQODd5c25rdGN2\nOTk4M0Q3VHp6TVQxRitkOTVZcllPTTAKLS0tIDY5MGhyZ2xqZ1B6ZDZVOGdVNkhI\nSHhSQjdFbHpXSzVQN3g0bmZLS3BQUVUKvofjws2goszgGwS9l/q6EB7C4IprEkv3\nTnAvPF67F7sneWA5nEW/VnToJWKfdGuOHKim8BEiqfPB1CC9dMke9A==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxbGt3d0k1SlZCemd2V01z\nd2R2NVAxZVlJdWpkVVh3bXBUcTZ0T05kTmtFCkQzWFVqd2pQelAzNGE5MnFSeVQr\nbjRjaUJKVVN6aGlQSWdTUGdHRjR1QWcKLS0tIGdrTTF6eUl6UHFlaTlQMENiMzFP\nQlJJWlZwMjdvNUdhVnBiRlRKL3hzcXMKNF9IEoY0seK15jiJqxWrOtMSPmBUU0jS\ndSY9KXeYLQNHuCzSC2T01UHmq5FDxDszRH3O8JQ+rBSLxNx3dLpetg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSdDhQbE9mY0Q0T3Y0WDdF\nNk9QbWVCWnNvWVRmNm9EbzBFSkJrd2xiREJzClJoOHYrQ25mVTlWR0tSRlNHQXdO\nRlA2bWZIL3JpSkxQNVc3bWhpbFpuK1EKLS0tIFFEVTRKaWxDU0tuejNLL0JuV1gx\nNHA3MWlOVzJJMDMzVGtubjg0b1h1UG8KVQ/tzduOz0P6pfVSnzBf8Bnd4bXA9sqy\nOWlSeB9HmFbHkqJx825r4lmbwozOqLHMMSc7c7HUPDsX7PUs7lzAJA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hl50ufuxnqy0jnk8fqeu4tclh4vte2xn2d59pxff0gun20vsmv5sp78chj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHd2hBcTBubGRXeWlWekRi\nTU52OE1pVVdWRU1ENkdJZ3dWWlFCNitYSlVrCnJXdGtnZUtyLzhrZ3FTRzdOMHhM\nL21iMzVpb1ZjR3FoRkUwT3A4c1VHczQKLS0tIFh0c25YSXNmcDBsZnlJNmVJbklp\ndDBhckVOakp1WFp1bGZ5QTl1WDZ6WVEKy0UHGQWGgPZ5sO3XsdMEqkFAz4Pl1pHq\nBRnpnl2oJ2SnwzkaS0Z/Ul+a456yPXHVFQbc3chYYwHlnD6cxt6EZQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCMEdCbHhFNWNuODRSNDU2\na0FzK09MME8rUWw0QnhpNG9NK0twNVp5RWcwCnBxZXJrZCtMRkFSR0lnRzl0TC9s\nUkpoQjFiU2t4djJNamt4NzQweUdOR1UKLS0tIFNoQTB4ODM1RTkrdGJxaCtSOG1D\nbFNUWktMRWZueWpDc2dkL2I0OTA3V0kKhWPOoRDueGpQntCeofze8yKgMtXH7Hn9\n04tlU0BFAWML7Rv2n9OeHAFcPe+n1DBoIZDF6U7ChItomIVmsYQZcg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3c0MrdWpneUNSMVlSWE96\nYlFJNjZpMkxTOFVuR1Z1d1BrQVlBN0piTUJJCjJkOXNjSm5meG10RENCUXRtMDRs\nZ3I2Q0lqZUo4TTY5Vi9sMEFxYmpRQncKLS0tIHJhSkV5dGZGamppUkFPcFFiK09z\nYXNGanF5SlN1bHNoeFhqQ3F6K01nUHcKeA4FMD01eAJ2jqkzwuOD5ZZIuooa8yPg\nGIboavpLao2xumV/3P7JCKrF8RTX+5YigaC2ZqrHR3Fgg/sCujAHBg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2cFRvc3BVOVFwb3QyaFBs\ndURLUlFWRGhqV2lpRkRrdDA3dFQ5c2V3aEhvCno2QmFDWEt1SGVRTGtkWnhHRUJn\nWTNmVlh4Tm8wZUpYSG11czBxS0hIRmMKLS0tIGZmd2NHWlhmTTVhSVVmS25XL1dp\naFVsQmJPdTF4K1g2WnBCKzJ4aDg4R3cK27ztxAUVvTFhaKvO4RorZaHNFtJ3LPv4\nFzpsko2dXTaksBHukBLsESCF89NlvxIJosgOMSqJzHwhODUeBPYwIQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWbmsxNmt6NTRHYXQzazdM\naWNScVNOZEo5eDJvclhsSno4aFNDakdoa0hrCjNpb0xKMWxuZWRUVW00clIvK1pJ\ncnVqQWQ0cVh6aDBHWU9pZGEvdHRNbG8KLS0tIFlNbjdPc2NpMzM3NjUzUWFsMkRV\nTzZHbnY0MExiTUJPd1U3N1lHK0tYU2sKOo5f+aJ9b9JVCWcSug+u9phwh2B4tk0v\nGslRh0FffQyfhDCPbe8RZTGZXatw9gxM8Sbl/CVWaUR2ULD4iYJKKQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4SXZDNFgzL1VBMFRlWlhx\nY21SYyt6aVdSdW41a0RYU3dIOXM4OThPMXlVCjllbk1VbVNpRmc0QkZwMGtmZERR\nMitjWjI0bkQ3ZlVLcWhjaE95Y3lFdnMKLS0tIGxYTnlEclhkc3dub2kvalVyUHZC\nak5IVTdaTjI5NHU2VHVWSWw3K004OG8KK2E91q5yKGXCqtjC49f7snkvZtfSRQhM\nh7d7ZcudW4OzrFaPFzmoj9OdD1kBMHR5QQQHu/aCV+ObFrp+by0utw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzMk54cU5sY0h3Y1dLS1pT\nSXgweTJMNmxtRXp2MlpwejFEYWEwZThjVVJvClQvUXVBLzdLUWNTWENlT3lQeGNx\nZWJWbk9BRmx6RTlVVjlxSGpKM3V3M1EKLS0tIExCbjlqR2xiYnVxbW1xMmxJWEZ0\nRjNrSkROd3JmUXpwM01hYlRTTEkxWUEKj+g43whHMLHcRuSAonSs8PnyHxzFi/7z\nOtYmmewimxLhRVowYWXxM7owm7ZxGqWw3jzdp+Xwl2FVIL8nxPgyrQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWU0xDUFRJZXVocGwreEVo\nSVFqRWpLSktBaFpoTXYvMTNYMHEzZjRraTI0CmoyN2pHL003TnBUdnFpSE1NdnJZ\nd0k3Q1ZvaXk3aWZtNEo2dWpTU1N5Y1EKLS0tIHdRNklxOWI4YytWcC9NSVVxTkhn\nTnZ5SzZaMnV5Rms5Q2NrZFkrSGRtT1UK/yBKQzkC+HQveQJtAJ+qulDCxjEhwJ1/\nSqEojNY/OV8q7YSR+PNJBsllQYS64z72hCyPpkQ67v5C2Xk5LCd+PQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0Z3dkRGZFczZubFpGU2M0\nUkN4TDh1VGdiM3h2MWRLcEdBbHRtUWcya2dJCjQ5c20wc1hxMGlSVGVDMWVBWTU0\nRERVUjVReFRTSDRJWjhzMW9nRmpsbE0KLS0tIFM0bGd3eHlqb3VRV0dhRGlHR0Fx\nMG9wWmtOOVlYMHg4dXhqVEljRTV0ZVkKNkuFVZ9yWgXy69yxGBJ9R4x2x762HbFg\njWrNW5HtDYyB8Q1vHVPaeG7beIbF6KbvK1/HfD0GVoQFkCk/XWjlfQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2023-06-30T11:08:58Z",

secrets/common/bt/car.bin

@@ -8,35 +8,39 @@
 		"age": [
 			{
 				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhRW1DZmVTVCs0Ym9vLytG\nUm1DWGZHaUhsZkNSTW9RWURDWmxhRFY4QkRZCkMvbExwWGplTFFnQUdDdG5RdFhY\nYWNEM1cxR0hIQS90dS9nVE1rMmhSdDAKLS0tIDFjcEVTZ3pQc2pwVU5yeEJDQjFl\nUmFLZGlQN29saTlramcxejFaWDcyamsKX3GnzkjF3Yqc3T2g0sw+8d0MHUCUDaGg\nG/HBpGBS2ESTH+jAVxv5PFbnS5VFpf4nlPxhUzdE3j7KTikvmAJoAA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtVGtlZFE4clZJdVFyczlY\ndjh3Y0pEeEdNaGpsTlpNQUloSGdqb1BQQ1RjCm1ScVNyZElOMG1iYjNRWmlZczFM\nR2RDMTN1aDgvZTlhSmZPQWFpWTFWeU0KLS0tIFpENEtobFZ0cFRURFZ5MjJ5THNj\nMGFDeGM0RmNxSXoxOVJBTmxwUzVYUzQK4Kc5JyoDCN0/rVEjg39QdHSivd2gpxdV\nXbn/KCXVTox05VnKpqflucWuegpSXgGYuvJ7DucljvgItVXyxEa28g==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6eWhOc0xNTDY4YUdyYmcv\nQWQ4WEFFcVpmZEhNbGthRVlVcVM1RzQraFZvCmN5L00zTTV2MXFTcWxaWC8ydytu\nQ0NTbDVsRXBaWTVMSzI2VTFCWGFxZFUKLS0tIFoxSTUvREVreEo5dmdmYmExSDB1\nckp5ZnUrOGZxSjB0SHFMaTB2VFFEUVEKqn/1aXfZ/WHtDDVOmGjOT/PUas+5eZ/S\n+QY0qc6mjeJ8yn8ULOmm9M1E4zk5dJGiOIHzJ/rSFZDO0ayR0tcbwg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhY1R6SGU4ZTNFaWlkWkZ5\nSUdFVHV2RlFYR0c4RSs5VldLSW1TK0ZaV2pVClNDeEZScUlnSVN6QlBMOXBCSEFH\nZmFNVHdNSWNYam03MHdYUjI2eUxSTG8KLS0tIFlhN1Z2ZitFeU5Md1pwTTA5NjIz\nWmJYMThYMGVIaENBeGhYWkd1WWNxWmcKQNtQgvPWYhm03zkE+uFNbzXXIN+8C4nz\nZiZlTVWV+I4FcnGwo0J80ZtaHrNxCBfRVgJmXYc5W0aXK3z9Pja6jg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiay9zZ3lCYk9oOVk1bzVi\naEhCeU9WOHFMdE5xb0RxeEhoTEpPT3B4em5RClhrWjN3YXRsd1E4WTVVc2RPMzJ1\nai94Y0RsUUxOSTlCTSs0SXdTL3ROVGMKLS0tIHBIcXFGc2h4WmtPZGxNM1hQamFt\nM1I3U1cySWtGK29BS0lXZ3paRXhVVFUKf/blwoKGYVgb1YbvDU8/gZbcQJaArKTw\n6oFb7R4bVAkmTtTuSEjRylGomu4tde562zuT3IiZ/ReNnNdcQOSi2g==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOQ2JOajJ4K29xeE0xelgv\nQUdGVHhydjA0dXN3RGZDNzIyUXVMS20yeUNrClpRWUt2VHRodjNIdkVrWkJpWEhE\ndW9XV2FvYVY0MFhFWGVpbDRDTmNKeU0KLS0tIFhCREJSRFBoYlVGZFVocnpIYTl5\nYVhuVldtaXpsOUFrWDN4eHZ1eEN2U0UK1EP1VbD7bwAirOrmBZ5zAzkJYLx1ZEKF\nX7kfjcuWUMDGYx9ed0/tfJqAi0BVBi78MRlKHRs6D+s9gQbKVe5klQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSaVpFTHVlTjJYdEJVVVp0\ndTZobFc2dlorTUx5STd4c3k3K2VzTTVSMlVjCnBtaDdaMjAzOUQ1ejlUMGFmQjJO\nM1hPSXJMa0NmYmgza0lYeWRkaHc1VWMKLS0tIFZJTTM1TFRSZU5GejlRSTQxMlVW\nMXJ3VTNzUjJET1dpaEg5emk0T0xrbEUKBBYPgzSCKXU9jMD9Sc5YRNqBxoxN340R\njf4sBD2LWTofriB1E+ltrd82o0Gz3+JH21/+0cEI0MTD8H5o1r6Sqg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwcmsxRjZyK2JEK3dTb3p3\nejVQWkVIWnV5MTBGYnlxazZ0UDBSaUcyelNFCjhCNWxMOTl0a3BWMUJhNXNWL2Z5\nbHBNU29ySmJpWk1ReU9uS2xhLzRZTWcKLS0tIGwzWTdEVE1sSTd1Z1ZUcDVpZnR6\nbTdEcHJaSTFsZGdWK2NOT201amlWMDgKhPa8GRkNpyf7DJ7FWMYt1Jgffe3mtPNi\n7emn/1gCCtaoYwyLmoG3K+QNH0QuF4uK2dkOFZOhASt38BVH4iyyvw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hl50ufuxnqy0jnk8fqeu4tclh4vte2xn2d59pxff0gun20vsmv5sp78chj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxN2RtQ2ZqMzA4alpmRGtl\nTERGL1FzdmNmUERNeGlOczAwZ2hXb3piYTBRCktVa2JudlNUOE15aksvb0hDS0tI\nQzFzSXUxdTZ2LzZtOEhNOFlIV25FSTAKLS0tIGJ6ZTRtaGpKVzcwR1c0ekhPNkRQ\nanVKSnUza0R3MUdySW5sdExJZ1lCdmcKqp8hsFxhTjs27PLyuHYb3WV34yF3KUJd\nWaeKyUEDkbDwcjykJHz0O3D27YsSIRg5iBR7qVDN5jxxuuZcnO6Nkw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMOVR3S1pDZzlmZVJibENs\nU0k0M1NEQWRacW1oOXY3eVREWE5LVkNaN0NVCk9DNE5CVnpvcGFGSWxZOUFCQ1hn\nS1BQdXBVWm9ta1pMWFZlMm43Zm44WGMKLS0tIDViYmdYWENhc3Y1eDdXYXFDWUR1\na1dBQWtHRTJRTjFySytzSHliaGJ0MlEKKN+Nrqi2NHhV9debUfIIbgYo0eClSUkY\nb24VJc1vj9WBHu6xP0fOfhDaue5oOk0g+7w1RQE7yI5lYBR7DQyxJA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTdWZtN0Fvd1NzQmpSSjBZ\naUZQd003bm1OdWtjRHI2eU0vWW8xUTlPVDFVCm4wekNyUndJZE1IcG5XUnZKNlhG\nRzYwUGVHZlgrdkl2cUVSYlBrSXhsbm8KLS0tIFd1ejllaWc1ZUN4U1c4TC9Da3ha\nYzN5VzdBRlRTN29IUzJsbXFOU0VvVTgK2xxoAvCtV1Px8m6pgLoJjmYsqg49rtS5\nKnt+SFcpXY2uMMNwTEk0aaK+yDqlwlIL8rDhWBPJXwa9c9DxywytIA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6U1B4aHRyem9INTIzU3py\nby9OS1AxYkRlbVlHSTFCVVdRU21INGdVclY4CllvQVZWTVVPajUrSDBFaFdPaGFR\naVhRU0xpNExreVFQZUNzVUlyTzdTbU0KLS0tICtCVVBCWndGNTQvSm1naGY2OVZ4\nY3BDMzZuek5XeXIySEI3MEF2eHhNOUkKPVFHVOVyatt141Nb4EMXR7KdrVIIoDNI\njb86cX3Nq4CyrajmnXKJmBbNoSMHdiehUEaFoimMccnTmQhhxtXKVw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFQ1hobEVQdTJOT0dlUXZN\naUwrT2FzUm9SaHcxeTFGODRwWmdNQzNoaTA4CjdZSTd6UHA1RjAzb3FPYTk1cFBz\nZUE4MC9GcFhPQmFLV1JTa3lUb3IyajQKLS0tIEtGT3duRXRYU2swdTVQSEdpMlhO\neWRla3AybzRJeVgrL2tIZU4rZnhUM0EKDwmpESRyY8vZbQ8WexrxYEv9eCf0YqiC\nRqAg6Wmd2xafAtlo0HWZzLtG9wYmHgeeZycYXiY8xWv8ps524AMHvQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtbFNpQy9XWTlJTThOUmFD\nMWYyNEs5ZkVESkp3TFVPOXpIRUJrYTkzRXlvCndzZ1JsOXphZkRSY1BPd3NWdjFB\nY1dzQ3FZVi9rM21QNE9wRnVKdzB0a1EKLS0tIEsycmRiYTJGRFVUNTVoU1N5c0RZ\nTDlKclFZQVkrYXVaWEJtenRXcW5hOEEKFhbLhR2HH5j8iId1PEt2Qr4uLIcSSoiP\nmka7YtK2fe1W9012xKUqKtqZvjtbuFrHb/L7p+UfvCxBXy2c+bXG8w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmSFUwUklRVHUxZFh5RG9o\nWVlUay9RN2FpVDZ3NW1LcVAveDRHWTZiUkFVCnFTanNJTlc5cURaTWlEc3JlUE4w\nbDE4NWVmbGhVc1lkNDMwWUtrSXI0ZHcKLS0tIDN6R1loaTg4M3NZNEkyRW5MUDc2\nald2QWpvMlQxblRpWXdEWTRGNERMb3MKzECmbE1RX92YrvRBfRApiPKtjbj5Z9h5\nYOxmHnb2QWe4p+FiO7qTmNVrTD9OQ/VKt8u1gbclcjT1p0q+xPVM4A==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDQW52MVVRell4eWVnMzZt\nenFqbnVtVGpGRlpVR0NnNkVvUk9Ed25qTXpZCjhlaTFzZXlUZHRsS3dHWDNUMUVI\nOVlmbkdiZnN2RnhVY3F2OWRqQUJBQzgKLS0tIHRJMHJ2d3RJV0JUVUdJTmMxYk1U\nTjQrUkZuQ0xVbWQxZm8xMm5RYzB1WGsKovG+0ueoZS0CQbTsC44upsX1tAXBtxn/\nxgdkUe7EiDX5QLq+AldVc0UzvEY5/ROBBf4d2LzSqp3jJPtEJbYc9Q==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHZjhZSzQzT21GUHlJT0Y0\nTG92dUs4bVphU0VIKzFMYXRoOWdNVzNCMEI0CnJhZ0xzZlNBU3pjTUs5NEQ5M3l0\neGEydllJMDFSYTFwaXhjb2hRZzRrRzQKLS0tIHVTaVJleTlXSFpXd2x5NjhGZUo1\ncVFhMlozNmpnYVd5dGRxQWxhbXBLd2sKg3fhvpfcOkUQIdlNmmqT7zJ+aB86QqqG\n+f2Mo4AtTx+lzf1En9KzeaIIHn4rbNpwsMMzQkTgbooPCe7svntwww==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2022-12-04T10:55:44Z",

secrets/common/bt/earbuds.bin

@@ -8,35 +8,39 @@
 		"age": [
 			{
 				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrVGl5WEhVWEtGMjNZSUMx\nMStIUGpaQ2ttdmxjNUtyS1J0bVViY1k3Snk0CkhZMmhMQVQrM0lQL05hcFlTOTdv\ncFU2N01VNmlwWS9Tczd1aVlkUUpRem8KLS0tIDNXQ0xLVmUwYW5Edy8rSW9CaWhW\ndUVYRFdGMjVwV2w0My9PT0NHS1JtakEK/KjEcC0Ubci8hInUqc2G6uFs2hd9TN76\nPgMDTi8Mt1dM1cGNj7uiPeTo8/ft26yuAtikybpLGMdayuEXp6aTPA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBscVFva0cwbjh2QzN2WUNo\ncCs1QXJIWDhyN1NmNVVPU3dyN2kwTVFsMG1FCjMxZHNHTHYyaVQ1a3hkOHQ4ak1p\nUUdQWWhwL1ZodWhmT2FDcy9PbENwTUEKLS0tIGtKb0xaNjJUYm1YWHdiVk1yZEdp\ndHpTMTU1b1UwaklUQXdpZlR6c0dJZjQKmvMqC6v7NjlNijmvg9D4OjbVozPMwPPp\nC/hgv/PDLaH+y8VAd0tJTch6w5B5b6lCbOL1bySIUkqSs9gqRmFkWg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCTkNzYVowcGxwek4rdUow\nc3VYbndpSWVscVdmaXB2VFdVS3JpYWdPbGprCmtiQUJzSStjeTVpdGRodDRjcVlQ\nb2NFczZjUzNxSVd3Y0puYUV5WnM1V28KLS0tIC9HdlgxUVBFZ2hPdlBVcVRha05v\nb05hbmRqV29scGE5bjltVVNHZ2V5UU0KfKu9wvY0EfTxUB8Qiy7jc4eI5zoUBtIT\nDUdb6MO7OUHJxtq5YzVJcPui5krR4ehJI7vB5IRWXxT/Yx+BjUd2qw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIdHBNVE1SUG1MVlBHMW8r\nM21qNTFYcis0TWZuNW1pLzRIMFc5M3JDM1RRCmprbmJVcURzVEpWeWNHMkdGUzUy\nOUpualV5WnpJRWZYdEJkeVlzR1c3clUKLS0tIDZYSzNPTDRsQlVZWEI0SVArbDBF\na3A2TVZDMWRmOFBnOUlNWGxDbmllOW8KqGYOL/mXBMEFepD4qjOMSMPYmUJmLpx4\nAeR9gTeXr4cp0HkEtabo+EHLX2hZt9sg5Y4S1w7nIjy/o7yWzE5o5A==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzUEZmNHBmTlUrSVNON0Vx\nU0kwRTNyQTY0UTdjaDVwUjZFSzdPaWgyL2trCkJCZU1MdFlhSndHNjZZb3VBdE9V\na3Iza3FyTUhEcTB3azBURXJKS3dkakkKLS0tIFNMNkZtWXNralFRM1FKVlZuL09p\ncHJGeUJxSXFSMDA4MU1lNU9jWWl4OXcKK71tw9/Xg9uCANFgDQ+kC9sgVP5UEa9S\nqaWPn+VGCMMiGb3TAb9BoRonfmj9eI+NxA/er5jpyT5g2GxKymTN9w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXQktYNmFYQXppRHVsYzE0\nNW9hQlFIMStzZWpYc1lBdUdjQ0VQalVlVldjCmQ5TGpKeTZySkhKZ3IzbTBiSS8x\nWGVoeVpnczVJWmxOZXNlYWR2eXFxTWMKLS0tIHM2OURCQ1FBakY4N0wxTFJyWmIw\nMW95UVpXTzB0TXJxRnQrM3pHWkxsUkkKNushqbOZqHca5f1ZUdf3YAurqeTW8Zgs\nzcmMZ10YQjhyPzH4cN325wG80EP+DX17GDhP5Ke+2ZIUtIlmv8o+tQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwUThqL2k0ZW9maHMzSVhm\nbFBBUEl1Vzh0ZW52S1ZxM1BBTG1ZdUxFQ0ZzClV6aE4zTzlkbW4vMjczMHBJNjRS\nUEs2a21xMndxK1FDMDZqN2xUTHFka0EKLS0tIG5paTZCUmJnN2Z2Y3JncWxPWTli\nSmd3dHZzT3l4MDBIeS9FMC9Bc1F2c0EK4jplLargqOCN5eSpsAqU7zmdEvZzN6Bd\nTLgiuOPwFeQwCJ28lPFXNtPYFQzXhoASatd4Sn/MOKWCQJeVJOhDog==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwTnFIdEQ4SzhEdXdDSmk2\neGtVN1Fhd3pLSGl6ZTJYOE1XTlFuMDExTmhBCmtQdUVNUDUzdzZTS083SFcrR2w2\neHBuMk9KUHZGcGY0WFRRT3pkeXBMMDAKLS0tIHpYdXN4a3FqTm9xVDNCdms3UHR2\ndVNQckw2cjk2dkswcSsrdFdzN09qRUEKOg55hpkIba7uqGBjwsW7ACN4Wxh7V98b\n3x7iR0TujTLDYyNmu2IqWQbKjsDi9U/V4au40luLnWwcQ0qMuy6FNQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hl50ufuxnqy0jnk8fqeu4tclh4vte2xn2d59pxff0gun20vsmv5sp78chj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvM1hrNGwvZXVFZ1Awd3ZE\nejNkZUN0NmY2THFTRU5CcHI0cVBPTnErR2pjCkg1VGE5M21PSVBIL0h5cmY5ZFRU\nZFdsZllDSFVhZk5VTWRRZW1OOWVqc0kKLS0tIGdiU0ZSQS9Sd3dzMlVGeG05L2VL\ndkhaUmUybHZCTXNnTmFERFlpQncyRDgKqy9AQmZvZ0zf3hgVYYOEE5yM/Xrf1zqv\nV+wdNgPNPyn0DraYKbiFBV2f4J8yk8xLG8II5T08WWlVH1Br3Zb9/w==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSb1hNd1k2ZUM3U1REVTlo\ndkhLUG81WGFxQlRVd2cvUU9WVmNSb09Ub1RFCmhINEdhT1I2WS9rUE9CNlppbDRa\nVlgwNzB6RmIra2NRUjU0Ni9abVNSd1kKLS0tIG5pbityUFc2RVJGQTlTend1YTV0\nbStYSWIxSjdGYU0rMHQrTHFkSGNjd2sKBymQa50r5Uo727VI+nM+qc3YAGzM+ZDI\nU6T+MA8L5noCb/ZzKYZFAEN8z8a/xHT7nRiqp8NWQ8OJ0KJDzQvE3w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHOHZZYVJJSzFRbnBSTE5j\nYmxEY3lzK3NYMHVhWkFJN3JGblJXT1diYVRnClJxV01mVWFLOGtCTnJNMDh6c0w0\nd1kzNlQzRmpWZm9ORVlxWVAyU2xNcW8KLS0tIHVZVE5LL1M3OEpWRy9PaUNNVkhP\nMjJyT0doZ1Bkc2NFRThkRUNDZWV0VDAKBES6A/o7BomJ0v+XaeFTahVv7Q6hyTLw\nz0cGUZKfVJKd2lt05Jhd6Z+nfrZbx2FEKGBIGMhaU7gOPyxviGvnaQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxSHJtWVpWVE5mVmZ4RVV0\nS3J6MGhQY3NsYTk2S2FFbGJTQTBjaUlaNWc4CmZRamZmZ2l2OENKZWpOWU1IQXdo\nN29TSVM4dUJXbmZISkVyL0RCTFBrZ1UKLS0tIHY2SDBndG1PRVZqcGxJSjNXUWU5\nL3RyZ0JIblJPS0lmc1pDc2pGK2dTeHMKB1T/43hZDb4lP+seHsKt+aB1TdNyP6FZ\nOt8rezQZqeJ+GnHwV6qsdEtX1DE30niqe3upUS+igkHJ65RGd5TAuQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlb09Da2FmZGVBYVpjY2Rj\nNVBRS3FvV09zUEk4OWludk1vRHMyL051SURVCk9OVXdkMHdjaFN2WVRqTGt2dUdP\ncjhqSFhHcHpXekhMUmF2NlFFeFpCSUEKLS0tIGhNU2FCU0dGSFVpSlhLNXJTNHcz\ndk1ZSGxsYnlZblJTREFnckRFS2tCdjAK2oDI7PpNapR+ko835T2PwJpGTYq9zK7x\nswo56rL8y4rOKkARn5JS5L6/2ltcF91OC4/zMVg8HkEoSjBWmKYeXg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFOU9TWXlCRFh3Sk9aZkF3\nTDVUMWhzQkQ2OW1YbVlQSHUvdHBIWGx1R2tnCi9ubVJyV0lnUHYreDQwNFYxNTM0\nMEk0M1ZRQmliL0ZUVlZlYTM3aG01eXcKLS0tIDZxR3V1ZVpEWHRJajdCcU16NUZS\nNFpGanJxNlpKcm1VS1cxWHNieHVmbTgK0ggrvlCvK+j8F77b4gl1RsWGDfGiFmg/\ns0cMGtIflPT/0D43R/jczrJ/Xp1aBL0TeHyf9YxZu254QeZ5ZPa5kQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBreklVVUkwQ3h5VFpsYjAr\nUTYxZm10a29BcjN6aEtGZHpVS05kdUhQM1FjCjJ1Nm10VzZQMUs5dlpZT2xrNXNQ\nQldSdFFncUFHcUpManpJak1YMVUxWkUKLS0tIFVtMEIzY3VtWGVZaFRZVFhyaHF1\najNXMHZNU0RuWndDZG1jMlVUNHFKUVEK4PAvUJt2ayy5iXCEi5b/veaxnyFvVohl\nRhbhZR58hFzsTRSwqy2pIMqSO3tgtErr9B/KYPlQNOifgPamMbR4WA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXTVg0YTFFL1owd1RNUEEx\nMWJOeGttbTI1elhZMTU1VXcwcWt4ZzdJSW5VCnlQRk5OakJJU0grczlHRnhJTWxI\nd21pTDdVTk1vc0dsdVpuWGNrVUpEVDAKLS0tIGNYQVNjellNajR3czlKc0ZYbWpL\nbkt6QnZ1MGRGL0hSS2F6aktXMzB3aVEKb/XnuAMiB6Zn2Hr+LUlPdCii5G7TKYgp\njE7Loh9mPY/WPK2KvCAPYFcjNCmu0JYzCYgpU/i+4Wm7ObsrXh+lGw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOWFFJb2F1NU5TL2k1aGdq\nNGFYcWtveXd2WGxFRVc4RUVLbUgydVNUaGg0CkFhT2hVWlpoTExnWVhhKzJQSWZp\nWFFFV0lrY3lSU2lCUEMxdk9DTzRVVlUKLS0tIDM4REg4QW4wZWNUM01nbkJoWnkx\nYzhaN0VMRTFZWTZheGcrS2V0dU9hNHMKgmKgF1py9n9Ez49RDlsyDakNTiac0bB1\nkg+44Kb3aO+R/KOEHw3klHc+TetPWXgHPnuP2phmq/arSwpYyogAzw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2022-12-04T11:32:25Z",

secrets/common/bt/portable-speaker.bin

@@ -8,35 +8,39 @@
 		"age": [
 			{
 				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqTXp0RHN2bW9wUDdvWlJa\nNFhyMEJ0OUhSS2RvLyswejc3ZUx2SW1rdDFVCmtZVG9wZitidEZMaE1rdjZSZito\nclB1N2s2bU93S0IwK1UrYlk4NjU1UFUKLS0tIEdvcytSOElhRHlKY1FyRTlTYUlR\najdHeGh6d2FROUJab3d1cExkYlJLQUEKJQUv1/2YuAOEQGaaJ5itEtXrfwB18RcI\nC3V0MXuLqpQpVzsMz6tBU66+343gPTVMZXi/cLLKjpzARKUCPJ3ghA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0ZCt2UzIvQ01pQ2dMamd3\nVXF2WnRmMDB4MTZsYzhlclcyR2k4TVhtdUJvClZtQVVYOXpuZnlOY21zTWltU2E0\nQmJ1cDNVRGsvV0xKbk9KNHJ5enRmMGsKLS0tIFhMcXhzazBlN0lTc3gwbmZpVEhJ\nTlZqOFVxOUl2NFl5QXhyUDNhMEk4NlEKvrWdvyL9lQ8kc/QJQKFBlAXw+NLmVO2W\nYo44HNxj+jbWFLhimV4qsdaZKb4w0z/YSSLPwP3cfAOblOVYHh8eRA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNdmtuT0NaUEplbzQ0WWV2\nQUsrOFRYN0ZET2lwNkhMeTE3bTV6OUUzWW5jCmtsT3dNbXdlSFQyTmlNdndqT0V6\nSGFDM3BaY1plUVYrRkZRSXQ3eno4dWsKLS0tIGRBSzQzVVdCQ3Q2WGpwdTlsSHJO\nZGR5NjRrbW1lWW80NCtVUWtIUEhGcTAKSRPJHEUFWCCe4v2nLnaDY3FIeWvc75jd\nMb8+grC61jBRO3kpMLrHb5dn3/okLX33nZtJNnkCA8jDlR1tyCXUuA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBONmxhcGNHN3BKcUlITkdX\nUWlCZ09ER0xlN2w1MXVNSVFaNkczeVoxbDJZCmdaOVFBakdJZzNYTkFnYUVxT0xN\nVmN4eHBXMkpTNldKYk1yL2V4cENaSFUKLS0tIHhSYit2YVVYbEd1WEVTcnNBclFu\nVytldE9XUlZPVmlnQWxCMHVEWVFWeHMK0r/c/cV4CyIc3HnKiPvHXwOUOdBj8lu8\nHMjdK+QMcZGSiSW87gmDr1wUf/aROYA8LTYZbuqkaf5zPYhFUpYykg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvRWZFWkVWVWlpWjBWenE3\naHp2d1RVcmNrQVVYNkVuWHRUcGRBNTBFbmdNCk4zUGFFSm5lWXhzR05RelNvbnBX\neHhoZDZjZTJPWndQT0dJajh0K2xhWGsKLS0tIHIyeUVoQ0szZHpBQkdBc0hVbFVF\nU29JWFNPT2VtaEFTSTc0OEpsYVVRbWMKLq33uUYhelMgkz/zuI3wmYTPbn+fv4uB\nkwUX2KDOzunPkfznFJ0/uGDHBRgTj5kYKid53IPPAByCGrWemXbbBA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmVHExL1U4WWVZK0hNcGpl\nUGJFc3R5cURxYzdyeTVSM3FESGNRayswVWtvCjJKMU9OWDNHenFNVy9DZ0RLTFN0\neFdUcXBTWFBvQ2NzYTJmbk45QUFQVU0KLS0tIGJQNlRURzZUL2xoZHhMNU01TTY1\nYXhvYXhkTFB0NGpzWkY2MTFBUjNJYlkK6CBy8Jkue18ru8eIl2ad0ud7FuRiEIf4\nKBkb15yhF+RlPOfpaKrmLgynEZILPfaiyNEaj0YOlIYP1qas5TNYyQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVNlFGNGZyZWdLQnRkSE1z\nTUgwOWFvL2ZQSWVOVTBBOHJOM0RSaHNFOWlBCmljOTdKQzB1UTU3ZFFENDJFRnps\nYi8xa0czTTNvTFFGc2QydWVmTmN2bEUKLS0tIFJQMkNQOUhDazlsRTlrRDR3TFJP\nLzl3UGRSakhITXdnYzEvMXdsZ3M2RjgKbXJw6e5aFsrL52zknH5vva3y7sLvqVTd\nsyOnStwaTwBWEMRAvG+vtEhgLIJDVCJGEYqKIBzzoOOujJ9ojuzOqw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBacm8xcklMZVZnRzBLWFhC\ndTljclRNU1R6clhObW9KZUFzRFNteWhmK0Q4Cmx1dzg3bWtQT0ZtUUhCbndDa1dl\nS2VwU29LaFQzeU1wVmpVSWJqTXU1UHMKLS0tIDU5WmU5YjRhTjFuZWRzcE1waGRx\na2t1cHliRlJ1aEJnNjQ1SFo0OFllcmMKIuaI/OnYpIB3RSU2zZWazLnNPdYJcWUk\n1oD8pEOZDqiu4Cf8ZqqhLmkN+jBLZuBAi0IJLIgbRvVjbaN0j7NtvA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hl50ufuxnqy0jnk8fqeu4tclh4vte2xn2d59pxff0gun20vsmv5sp78chj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtL2gvV28vMVEwbDdhcFNq\nNnBqTS8xZnFGMXl0dndiZUJLa1diV3ljbG1nCk5QV2grR0Z1TnRta1FBZzl0MnJo\nYlZ2MGlIUi91ZDhoM3FNdmU4Mk1vT2sKLS0tIEJSUEsyQStlSzdoTlJuR0JETWFY\nUmxBUXBYN2g5eSttVE4zNWxFWnJpb2sK9SQTiCHz5eQ2RMrydMZCoXAFCIl40f7i\nfsskeK45e9lgstetJfu8rDLOrCKr2GnIpR53wiJyPAq5TscGUBlcNQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRRmh3R05RNXhjclRHYnB6\ndmxIV1dPQTNud0htRFFHN3ZveUd3NSt1RENRCkRmQzJvNUxZQzc3enlvZjRGTE9x\nWmFxaGRrYzNTUm5WNUtkaHJzbmo1Q3cKLS0tIFVJdXliL0xnZHRnYVBwYkcrTnhx\nc1M2bzQvNmxHcEsyZmZNVUYycDh5QTQKyOSJlIwrwUaglkvdAw24NxxdZnmy88J5\nNWo04oEImdlMCEZQBQ3/o1xyftU8BNY+ovNy7Nym0darKM9f8ka1PA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRZTZMN0Y1VklpczdDTnFh\neEs5c3hLb2Fxd2Nkc1VOUjVkdWpBT0o2NkRZCnp0dlZpUXloMitlNFFiL3F4WEZn\nUS95cDRvRXFiTDVWSzV5cmlPY2JBME0KLS0tIDVxeGY1YS95ZDJrNUtVYnlteWU0\nL1E0SDVnYkFvdTBGZHZnV2lSYWVKZ2sK1N3lvvQP9DdPsCGYJXtjoqv4gLjSF3xW\nq0VmAQFynm3mSPfF+hOfF23+msudWcObHu818YjPshyjOzQXHXURWg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiR3VhRUZybjJuVVFrNXVo\nMkJwNDgweFFmb3BIeEhSZ01RNWk0dEQ1bHlVCkI5Wm42d3haTms3bjlJdldpSGtW\nSGN5cnlkZmlpSm11VjBFeHI4blI0aUkKLS0tIHhESkdjbGFPZis4V0tQcUpXaVJ1\nTEpadHlVL3NUeUZudU15WldZWlpKNXMKVxsLBUb7BwJJ0lJRQk1ZppMID8bt/cbC\namvKeagoT6QDR42FyA6W2Rp8+tBrrkBD3CGRAcXMfUSPIzN9p6kcQg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCQ1E5RXo1RzI2MkVudXhS\nUGIrbkhMS1NNb29kaWg1c3cyYWdFbnhtSzJRCjdZWER2NmRBTTJaS3RWd1gvOFFR\nZjZQQXBWQ0lPQnJlYytNNzMxODh0UncKLS0tIFRxNzdoM3RJWlkzTXZHL3R5UWpP\nV1lPcUNyRHVCOHprRWJJQWNTYUxZT0EKNcCmkEcxPd+V4MLnE20qUMTrCc5ibmoV\nZHGDbkGuy1dBYZhbbOlVucXOppovyLzT+yH41mnt0GV38BR252E4+g==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPSXRPbW9OeGFpYng5RXR4\nT3BUMDZmOTRoNlVsVlp3endKOEJCWno2TjFZClpYWklWbDU3OGoySFFJUkRjS2tw\nUFhtZ0puTkV2ckRPMUhLY01MVW1kR2MKLS0tIGJkdHhaNzQ3WG9JRXF6OTNMNnF5\nQ3FVU2FVVDJyYUNqaVlhSkEyZmd6RGcKMRxyVMpxCYxoWXK6zlAPyo3YcPJtTWIO\no2RUlS8oSTB05G7sGkjq3VSFRSgNnekvXOBE513Qmym/cDDbusxpAQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYRHM3NE5Qa1JxRGZmbU9v\naEdVS05ZL2FyN0VKajk5emp4ZDQyTnNDMmpJCnRMbWNFRmlVNGdaM3FRa1NXUG80\nbzdRZUNuMndHS0EyYmV5WFR3WUs1S2cKLS0tIGdUY1BRM1pNT1VmNFVxRGZ3OGNy\nWjY4MXpCei9MV3BmTkRoTCtBWDBXV1EKzfx+IgDo4Dm1PchA32mv1gRGOE+4dI2J\n0iTQPkHeHCX3UwtQteyNKccoA1ztSRVwjV6gZXAmuhLy4Za7i9bnhA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzYnMxbDNUR2xyV3B5VzFQ\nM1IxQzV5OXM5L1VYdFRYWUt0cWl4ZUdsQVNJCmRjUjdPMmhoaEFmUUxrVmJCRlFl\nNzZqY3p0YUF3T2lYdysvakx4WVg0bFUKLS0tIFFlazJzb3hmVXNyUU5leUFKL3p0\nNlN0TGxVbGtoUHFtK3hBS2RiYUViVFEKii4w04zeDD6HWURzmAhJdxNdNmQgsPw/\nawI6HSVbbmEGXyL23Pe0oultY8k/ZVE4oHRKBkHh00XoCZM/Ye6neA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3ZHNES3BDYUhGcGlyTFQ1\naXVnZm1TeVovOFppck42Q0ZaRnA2dFJHTkVVCjZUY2h3MG9RS1g2aTdoeW9NS241\nWTJZbk00ZTMwSVpJOWNRMjRmdzdpV1kKLS0tIDFiS2tJRHIrMVNrZExKWE5EMzNt\nNGJCQXFMVk1zM0dIV084NHB5b0VLa2MKINozqIGHiddSjRXkcTLFRBR7HjRnseUP\nuu52jRstFcMEGmToXhNWsl0g3S4VOqNcA7jAGz7PMPTrD5l5sQ6w+w==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2023-01-07T11:04:42Z",

secrets/common/geary_account_02.ini.bin

@@ -8,35 +8,39 @@
 		"age": [
 			{
 				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVZXVTQmg4YlFEWlRKV0h4\nZm5mQzRYY3VoUExXRkQ2MC9FSGFXdnJnUFZFClBJMjFOSzdxc1R3NDJvUWZXb1R3\nc0E0WjRkNUpIcStEM0c5SzAxRUVoMFkKLS0tIDB2WDJ0cjdMa0FEbEcvTWxmczhP\nblE5Rk5Dc0RKUWlkc3EyWEJFa1V4ck0KEH636R2nV8u3YWL/Hfz2cXwLZMlkanMs\nVLDSUv99DlT0LoZGb2/bBweH7XR9eYuNeicyS+5uzopxG4ExK8t6jw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWdVJ6WmVyR2pUcjhtWTFX\nZzljQ1ZObGhzWjlYVjBERTlTZzBnbm1melZFCi9kVThDWFNKQnl4bFQzQXVyRTFZ\nN1Q1OUtjT25NS2pBNzFMY3hvaTVuVjAKLS0tIE13bDRTTENWRnZWNmNrTTNUUSs2\nQUNpdm9ITEFrZWtZMVhGU0dpMURlVDAK+x+tlgDECioZsiWdsaSKtmddQsl97SRb\n12mUcsvG4Fd6DQUQ0SWeu6gVo7tZgm6o7j86mdm7ECj9NzOgHrijxA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzZE9pUFZnVU9laTZWWGo0\nbUJoTHdEM3pab3JOcjJob1ZxZ1BGRWVKR2hnCjdXM1RIaW1sdjVaM1BVU2NzdkRO\nK1NnR3FJWWJKUkRrRFo1ZjhhMjhBMWMKLS0tIFhBZU85bk84K0JmdEhZSkJ6aFdD\nL2d0S3U5SGZjd0tCY3laMWt2dGg3TGMKvGZTW3UJpRFeBF7A86BpFzxl6cHMyoLB\nyZlsaK4Xk8fxaIg/W2PIYGzNGmiNPQ36IKJygBDdN/hz7eWMdbDpcQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOTlZxdU5md3hUSXV6Q0Vt\nRVZacnZDV2txd3hFM0p1eTNNZnlBSk1DWDJzCkhVanEwT3JKbEQwSEZCK2xqaVBI\nZEJ4d0ozQmV1WE5xeWF4RUxLbkFlSlEKLS0tIHpWcmdjZkZkQmkvNHRTdFVaT2cz\nU0poT2d5ei85TVBndWcrMFpTVWFpVm8KfPCOuicVZW+vp01owIfxkgN0V5MgfqGl\nE9K/WcJ3aDu2jLi1RQaYCmEeoaJbGsyjiOqIxCNcf0VomAqx0eIooA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYeHphd2JkeVNMOUdrS2c0\nSGZhQTNkTHBoSERCWnkrUmU3WWwwSStzWVY4CkZJMkZxcmtVQmFMWHhmVDNGeitI\nVVJVYytoRE8vN1QvMEFqZHRHSXBUNkEKLS0tIEl4MVc3aW5KM1I2MTVzbjlvNjRY\nVUZRdE5LMDMwb0lpVUVPekJqMHRjb2sKpAElXfn5q92FXNWlRKm82CTkzDwT/mgs\npXhGAQf6PWRxcQ2sonwze6JJGosS7dW8ULdxlkhg5KhZMbeuaBtKCg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1OHRid3FESkNJbTljMFFO\nVEg3WUhHOWdTaXBvM3lHOEdBamN2TVAyT1YwCkMyY1RhYlFFVk1FK3VvZHhoRXVO\nSE9CQ3UzcGxkTTJwM3VQVzFMOUJQQ3cKLS0tIEFTQldldTN6bnFzVS9QV0JaZk4w\ncGMvd0d3QWJ2SHJSMGZ3cnc1T2d4d00KBzNCz3oe78DS5zBu2Bth3qznHYKMFEBn\nCS5uZy/Or0U6CI7p1+ykoLBLTjVWV2bwYJOQzZAQmTmuSidbe4UKZw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrL2xKbkMvditBZzFrZlRm\nMS84RDN4VVlESEhzV3ptczFkVWd6cGJ2VUJrCnh2dVhBcnkwMjl6ektsRitoNXNS\nYldxcHh5ay9ZdnVrWFFzWFpNakRzeDAKLS0tIGtiUC9Rckg0d3JBbDhvcGFMMTBk\nUTVYbktHS3pMaHVpLzlSU0VKVVB0QnMKVJ/j1+L+fr8RiBTgT5J0gaeKSLzu1+lF\nPUMfnO/ciEmqa6uQW0YC5zplupSYCbtQa4FpCcz2ZZI2WORXd6jADw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTcHNUc1A1Rjc1S1J4aEVk\ncUxYYytQb1lWZmViQ1F2OUFaTXptZk9Ea0hvCmdvbmRNNVBBcVh2ZDkwOWFiZ1JS\nRzY4UDFnd2hSQml6OUp0QWlvQ3F2WncKLS0tIGxSNDBXWUlJdVFFWHBqY0FPbFpK\nTW1pL0c3bk5iTEVibDZoTW0yRkNaMlEKuHLkB/9dWPOXxcTyXW0WduEcnF2YRUpo\nEZNwre0P/62xX3RAjG6g/JSUwAt2cST9z+9K3SgxXUyunkPG0XDv+w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hl50ufuxnqy0jnk8fqeu4tclh4vte2xn2d59pxff0gun20vsmv5sp78chj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGQ3E3SEU0Sy9XbmQ5N3pa\ncVpqeFBmaEY2ZmtEbU5CTHJZZU1Db1ZxL0R3CnpNand3UmZISXJHMVVPUTlqeFhn\nWnJqSGdsSU9HWHU2YXU5Y04yN3hnbXMKLS0tIEUzSCtWTDdpUGx1WVZXeTRBRFRx\nNlhobUFuWllFcXhaVldYSXZJbjI3dEUKSl9Z1lKMurwbLtTqivGSLvNV7t3y+5z5\nImGeXwA8UE4PmQWwQPDD48kOmo4yf9fD25bVfps78NNjW2hGMBJ2Ig==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1Rm5ZZ1MyZWI0MU9OdHFt\nTElKMVJKTVpNMi9FVTBuWDV4eS9rZC9aNFdBClZRMFpUeHlKMHJZc0VDa1ErZHFa\nSVovQXpuV3d1ZFFMK3M3bVNmVGsrc3MKLS0tIHpFU3p6ZlJYQno3dlBCd1RFWDhy\ndDExSTFKTFA5dFZkdDhJaUNuTVJMWW8KH8w/rBCkcDMoAhyqDu+AdyOgqI2e/JZe\nfLLnpaSQ+Ss96Tr4rvY3Fmf8PbttyJN2Hmbxjba0FAxHP0RdQhoVww==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1Rjk4RkoydDg0ZGF3OENI\nNVYvVCtCRncwRmUyQnJjVnhEalFrU1BtWXlzCjg4ZXZ0K1BmaGkvMVZ3WWJNSEVZ\nRWFndE14VWxMWFVDTlJDMkg4endiWmMKLS0tIEdMS2hYMHJRK09UVGFrZncxQ2tU\nWFBOalR0MXFGeE1tOWRZTWhqRjd6R0EKTJlLInIJGek9GsNSlpz44M58m0KyJjYJ\nJG39R8sByUuRVGLCw8JH4cNfKfKFxvCsAaWFzSxJjqo7K00d1n0dEw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjMGZkMy9QdEk0K25hN3RU\nM1JZdXpKVUVvVXBObGUzWlBHM1NNWDNXekdJClVaMC90dGJ6ZmJaTGN6KzhsRHB4\nRCtuWHAraDhYZHNnQm5yYmpiejJzYTgKLS0tIE02d05mdVhjYlhseDhOZjRBMlB2\nT2hVeWxHeWZRbkp5TFNPVDIwQ0NrNkEK9++qo227xeA2dTCuoUZozpokp9Ldjh32\nKl+4OTR2ivVgMJXN0sQ1y9EjkOk+lsK0jGSkcKxkw1OoEirzMCPUPg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1dDFoUkRCenRDNzh2U2dM\nRlZVNVIycmE4RmtZMTg0eHJwemRuL3hjT3dnCk9YaUd2dERFc2FDUHRyQ3A2dFlU\nZWFBTlNkV1lyWnlxKzlCQkhsUnZqNlUKLS0tIDVaWHE3QjhCTExHa1EybVNKc1Nv\nVk95WnNEL0RnTk41ZU5mamdnYnlHdlUKJNDsuMM5KrvW2JLTdaATtw6oS1LXnXT2\nOwsGm6aep93Pq2lvwLIUb2+KU+NJ2xrpZF30roVjXMMdpcpNsQWWRA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyd2ppUHZEcC9VRnp3Y0ZW\ncXl5RGl0UTVmK3djSlY3Qk1IV1NhU1dpV25jCnhacVRmOUpWWDNqY1NvVHNMYkNy\nTk9LWFdaR21WaUN4TFZhSEsyQmFRWG8KLS0tIEhERmFuZDB2TFR2dU1lNGZCUFlV\nSmtIMlhqVEFwWWRYcjYxQm41YXc5WEUK85kHEESZXk82GAbJtxxc8g5ogT+tMu27\nAE/Nk1geTylCD+F9CoZNq96AkNYLf04gh2FZ/oVR/z+9wd4T5c5DhA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkOXl3ZVdzcG1zZTVBUHNE\nTGFGRmlsZzlNNGxtTVJ6RE1JMEx4a1RDdHdNCmxGWWFCYndtS3A0RGN5TFNHekRh\nU3prTTlRNEJoeFdGbUc3Q0NjY01HZGMKLS0tIGVFejh2R0l6Y3pjU3lHMTh6QjBN\nOUt3ZlI5SENhUWg1TFZ2SEMyWEE1REUK3tt4C58+lk95ztX7KbRt/nT15XcEaglj\nX9llxVse8npEDqfn6vf3SCegcexUZlc7BD/Ti9RJzSw8QPjtwKkTlg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBERnB1bUExMDJ2TDZ5dm5L\nNXMvZEJGWlloZmE1ZFJNUE9WUWc2d2dacUFRCjNMM3hVVkVvbUNiYnVJMGRINXlP\nNzF0VkVSQU9UbFhNUEdZRjQrdzY4a2sKLS0tIHdwMndHOW54MnlNT3gwMWRrdVU1\ndW1ucENid3VxYlhtcTF1dWp6K3Z2UTQKjAZd4uw3kChy5aM5qTFxbGYN0oFs41J7\nsrSpgwxzx+hu1kDRkBIQJZ/QfiF68NFd6qfX6zk8baF1AdML58U1Rw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvTzkvcExIaWhrcG5EenJD\ndVJGK0kxdFFHNWRaNU9KVXFqYWFZcVBQUkNnCnV4clNNTnJBUEw3Vm0xeGZlZERa\nKzUzdVhsVWtrR3NTMWtZdDBKYit4UEUKLS0tIGFXWmplVnhNbzhkdGloZnRjdDd3\nY3dia3FOOEZGRjJQekpFY1M2dENlcXMKrfkvzKJXnw+vwytqC5HUDKQXHX7jF+/i\niatE7sfxzJOhnrmcEfEdDzMF1Uh5RmtF2AeqB05GmC78r2//nQga6Q==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2023-11-27T07:45:58Z",

secrets/common/gnome_calls_sip-account.cfg.bin

@@ -8,35 +8,39 @@
 		"age": [
 			{
 				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxVHRGWEJ2T0pZZW5CZXE3\neFpvOXd4RC8ya3JhbXl5eVZtYkFZUERsOUIwCitncXZrVXBXdWpZVjJJN1pqK0sw\nTm1ZRG5Ga2VBaytLbmFVeTcxY2tRbVUKLS0tIGhyajNjSUF1dFZyOU4vUjJtcjQ0\naXAzL0kycTROSkVMck01UlNURmZPVjQKZ1lYv+tjIi8LvYtkFcfHUprNM2+/Nyab\nVOf28VE6p8H4Qfre8+KvUcfIch2guWGPpqY/IKGZaanszFtplw8UBQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIQTdTMVIzUDNDUTM0Mmh2\nNFZhcnlVTGJYRkJveGxxR1R0NTVNMEM4ZG1VClNmTGZBZWVWU3hVbWQzMG9lc1k4\nVUVaYjdoYXJsUHhVQTZzdlBqc1YxbkkKLS0tIDIwOGlFbjBHaXNwNG9MeUtBaElV\nQ29IK3ArS25sU3FRK21jMmhsNjl4SlEKCB5Lt7TuGwgNqh7/4NpSRjR+TUrHDYwl\nDkVMEm96VludN+QpmD7P/WhZvkTZG2rt+jFcA/f6JNEBVMJxEw9SeA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBielNxYTBpNklVeWkxY3pq\nL2RrUUZnSll3dGxVL1AxOTlEeGNBMlpFbndNCk94N2xsQkZhaGdsQ1BYa3lTZDVE\naG5KSDRyYWZ3MlpYYTN4Uld4Wi9vak0KLS0tIEVINHRLNnhlVjJTbzVjb1BSRWlN\nZFdPcEZoa3VQbHpOQWZTRVFESFE3TGMK4UqfVpy6tDlZaE9t8gays8KX6cN8Gt77\nRWZYbBKYhotlDCEAOQ28J8DQZwBVEPZNPp/KTCQs3DA5cQi5esiVUw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtcVFucjJERWlQekhnQ0J1\neCtyV1VoU3R4blV4cGd0V2loWmxYQXRxRDNVCmtUdGNkMGFNNU9xQk1qajhHMjlF\ndU1yZ2pldUdRT3F5ZzdtQ3IzWVV4ZFEKLS0tIGN3WklIbTluUVVObGJ0ZWFKaVVM\nRktNRjhEekYrczFPajBEV1ZVeWlvQkkKYGHFm7IYxnRW58CRUHE4p1bnVvQZrMpp\nWX2Cdi/ZV9DBMUsQ3hOJlVBbZP8F6ODvXRkH8fipjNuQylJNWeG4Tg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwWGIwRmQ5cFZ2VjRBNXpa\nYVYvamVWN3Jsd0Y4amE1R1JnVjM5U3c1eEJjCjRxRXNKMmFtZkRJamtzSUlpVHVq\nVnV5cDVtUzY0SUVuNUU2eGdKUHd5UEUKLS0tIFY0aHN2Y2wraXR3cHZXWERoK1dJ\nWm8wS0wzSFB3ZzJVbExaczFjTjZwOUUKasub5axckBoqLwTzM2zEjg7j8nMl3xgh\n5ttxPBXZDpMAi6ORRNnIHKXleYaRcHCN7rvLOSWCYC3QEnemwGEQ5A==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvcFZCUnBDZ0UwTjVIRmJS\nZFBDaHBPQnBtT1dxRGlwaEtBZFBJdksvYVFzClBMRVd5TUdqSk9GbXNJMDBaai8w\nd2RRb3VrMzZ4aTNTSEVJL2NTYnB3N2MKLS0tIDNlREpUMTVtVXRZeDBXeitybERq\nN1h5TXkyZFNLdzhvZEd2SkxveS91VTAKzI4lJfFtD+MFpCFxoyYmTV+137rL90Fi\nPl2itQrDSC6epx9dInc/fpdajOcToDoGamNRXC2sMC8WqHAI92buvQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAydUt4aHY0bm9FbjZOTGQz\nTUxYM2RhL0gyYmdYQ3pabnN3cTJBUFMzeDBJCmo0MVNhWEs5OFBzZ3hNd2VVT3Q3\ndFRMbC94WXR1Qng5NldEZHVFK0owQkkKLS0tIG45SzBLd1V4R1RWTlFObUN0NGdD\nWkFFbkZMRnN5SU95blV3cVZsRzI0MTgKpqqeHrlVZDoeCSUgVB0n6GQF2BGDF4cs\nJCqZJd3XrPq28tqzfc8xwgGrX3JDKUSB1mnNHKT6oj858W2MjD5+Hg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGTWpvTXVYRmVQV1Y2d0g1\nL2Q5R3NKRXl5NWZubGpJdUppQzUzRjIxQWhjCnB2ZFgvMUhEb3l3cDNXc0dIMWxm\nSTI2bUxqY0F3RWo3RXVub0hhT1Rrb0EKLS0tIGt1TTFaU0RmRjFFRCtEYXUzMHRB\nd29BUWVzOUJXYU9EK1JSVlpiVXl4eVkKJK/f29Uoyd1v8GIdzgXlqkZpd4TPwwtn\nwHMPE8u11e0YVZYxovGZAqxyrnuywhWu2BXhtkc0ZCRc6r7OYbH7wg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hl50ufuxnqy0jnk8fqeu4tclh4vte2xn2d59pxff0gun20vsmv5sp78chj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoV0VqWklIbHZCaW8wM0Qy\neXhpaFFSZHlBL1VndmN6dThqdFJGNUxsUlhnCk1tMEs2eDNqaTBCaHdFZmxaUldP\nTXBzTXI5dE4yaldVa00xZUx2UHFyaW8KLS0tIEpuLzJ1SWFTRjZ4UWtHb0FaUi9T\nQzY0UmNaRHJZU3hVd1hNS1hoaG9zWEkKa5vaqYn3YQ8y2UEP4BHQYKUCrJmSHn6V\nuL7L/kP9H4rloroudvxYdiQXLK1VJYn2MyG46xn7/KvH6vx+HHL94A==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVSVpRYlpIc0ppN2RVRU02\nenR1aXQ1bnFLeWVEc3FnTHpTaGNaTk5LY3hFCk5rUVBLNTM0ellwTDltd1ZvaHNj\nQUxZVThFT2RlWS9WdWlQYTFPMUk3L0UKLS0tIFJsaTZTRUhhc3JmWlI5QytheXVw\nSnlhUG5jOEJJMjhvT0tnVDltR01kaDAK4sWF7asgU/8VxQeNqMfKtzhEGxHFozO4\nu5OG8I4SP9ev0+nEytDP+hg+iWK8/MQPT8iPUuxfROVaVflyjr/hTw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIRlgwOUNZTWhyQ0s3ZlNW\nYkFLdHJXSnRyVGRJdmx6ODJqbXFyQ1pCdHpBCm1DK3BjRWtWUDh4L295bThsUGFX\nK1ArQ2ZJQjZMKzNrendOcFQwRHJJRVEKLS0tIHIrMjBYc2t0WmRpMjdTdDhnaXFy\nUm9ZNDhHMitRekl0SWVLUGlNSk9taFEKe/z+tEwjuARxuzFBW0vfrg4+GvMt919Z\nrYnIWVWR3cjHDI5UMzROjB9mVLdJxyBQAr8CzcPu+aatGGS+VsFonQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDZmJDV1hEUnhoNnlIVFRD\nY1d5Q3lZV3VtN0FTVzhkaC9WVHd5TVZtZmpjCnlJcmpYUjlNeTM4L0lRWjNzNW5T\nUmF6TzRYd3plNzJxd1hWMHlTY0RaRjQKLS0tIDFvRlcvUVE3S1RYbFJTMktrRWFh\nMjlONG5OcWRjOG15WHhpcVJ4QzNHMDQKDS1AjMxuf/mYTviqUgpNC2w8b1WOuU/E\nU/H++S6xRNtMDyPxQ3dlp5C8s6kxTYmQ6Fr9xV7ffXzOQ8rIiXg7TQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzSmFmdkhDb2hhNHhMbVVN\nWGxvblliZkh4eEJ5b1dZcjJjbVZ3M1I1d1NrCmJQS0hnMGI0T1F5aGZaK0dJQlkw\nVjY3K0JoT2tiRjF2eWMrMG9CTENvbjgKLS0tIDgwanErVDFXZE9OQUx3M2NudWVO\nZ2xrOFFtblZDQk95bGJ3WDA2V0VRRlUKEExB40RDfdHavKZWnDEMrzkJ8DI4iv5E\nvSxlX+IHjNXld1BmjIUdf/YN+ld7WAQwEKi9DfLWEsYLwVAPFHQsnQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtSTJVc2RLRmdSaGRCUUVl\nR0dWY2lsREhTL0Z1bDNJY3lzbXN5OHVrTkFrCkF1VVB3RWliakx6Kzg3bVJoMFln\nUzZVMXgvNzE4TS9iTktVZlM0T1dEN3MKLS0tIHBDaDFvVFQrZmZsNUdiQmVCM2gv\nOHF3TWJ1SDFuNE92MEtKTmhkK0ZNWkkKnuUh5MIkiedv8tTaX6LDSdkjTb/hvZg4\n0RYk6HQL1fZ5udEfPNxAu08tQwMXlb1RNpJAriMw+WXOvar0q8lyKQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2bDNiMEsxVFZhS0hpVXhO\nSThEcC9KZ081bVAra2lwYmFlUHVVS01PclZRCjJMTktJV05yNU0reG1mOWlrM0Nq\naHN1VmxkQkNadlJCdmVMSzBjcm5zaFkKLS0tIHRIM1IwOTJFaEZwZnl5SWdnTE9i\ndXZCcHFyeGtDSkZmZnNZbXg0ZEJQS2sKwWQHUg8OxQlHF2/SH17/whioqLV1vV61\nSRYGCrQhNzXxgZ/uLsk5O8o4r1qat0XT4GPX9zvPWH5GztS/op1+KA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzejNMN2U3b0ZyVlhnVHJ6\nL0QrWGFzNitLVE9kZXAxd1V1M3pRTjBZOFN3CkVuL3p2bGZDY2dMWGthZDg2WXVR\nWUN6R1p4ZVhvWS9XaU9XN1A4OCt4T2sKLS0tIFhzRTMyTlRpS0pxeUFwUGR4cUtM\nMG5rU0JKZlVPQ3pHYnI5aksrUVZuUnMKPatZ8cN058GwYeM+iizhVbE9xxDOBvvw\nnNNeWkKZoND7lboNu1r6UWqhcXh6kR1xBgutLMjFQaJBfu9XivurRQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3YjJaQXNGd1pEa05WRS9q\ndTF6VDJPRGpJRDBUUHgrMUh5eURFQjZhamdjCkhEWG00UTVGZnhyNG1UclNwZDhq\nR21aMW9tUXU4MVFhSElTTUhma1lYdDgKLS0tIE96RHhzOWphZlFsZENMWWFid2Ro\nVGhRcUYxL2I2TTQ2MHBZWjQ1YnJQMGMKkWYY1Cs8bfdeGm0baKZS83Hl5kdhZ6yY\nGCtPpx0QfRLqT/aXgwGb/rYsnbGJmhcqyaXCautFzpq1+sjgrgsynQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2023-09-17T05:47:50Z",

secrets/common/jackett_apikey.bin

@@ -8,35 +8,39 @@
 		"age": [
 			{
 				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0SzNaeExweSs2bnFSbWRn\nMFFubFZHMDIzbVprZ1lMWjhFa2JmNk82R0hVCnJKdGdUWElQeG5FUFpLcmV3YURS\ndW1hQTgrN2hINEhBaUY3M1JTUi85QUkKLS0tIE8vM2pRWHdneEwvanBVMmoxaEV3\nM3BBM2QvK3hsZXl6K3VBaEZDSGxXeW8KLUdwhY10aDwFxWs66EVfDNKB4U4mLmeg\nplp68lCfCSIsU8nddPudAY9e9rKYOqyIEfY1+5xki4dCTJurq5F4aQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiNFp4bWhmanJtMWpGTGFs\nUjRUMFI4TjgrVW5lQnhxMm1ESVg4US8wVFY4CllwOFdtOHNsWjVxa3NzdS92SzNY\nYjViekJpd2h6dlFGdlMwZlFqQ1hZeTgKLS0tIEpHWUdkMFhlOEl1ZTRpOVB1QWov\nSy9xVThmQkd1cHhSMXg1YjIvWEUwU0EK3eF7waxzs0T7eTXGRz5rYlRixd4kU21b\nvoIskWz2e3HHWFEAvuaxU7rw1YGgDOm9hjKdhEy0YniAimKT3auExw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwV2dzeFZNeVA3SzF4UkpD\nU2xsSkF6ZEp0RlBOaUxOQVgvUnljTlVRYjNzCnByeDZLWlpqRmdzZzJSQUU4a2FH\nbk01djYvRDFhTUhaRlFCVE1YdU80b2cKLS0tIDVENDRCR3R4b2k3b3FxSmRreTdW\nRWt5eFpGVnQwNjJjSU0wN3FMVTJVRW8KY0oLtP087AZkBvG+JcGOBRs1a6P36W/F\nq/zhK/dMWJNCbOHEXyZxsn0I6Az322qCyRIarcnd16zQd0/ZW7kbaw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrVXBqSWt4REFqRjh6amMx\nMW5sZTNQSzRZUG1ONFpkcUxDU0pxczhQd2xRCmtRRTBKcnZJZjdnMFNwMjlBazdx\nOFlHMWNyYWUwRjhaTWZQcUhTY3U1MkUKLS0tIG9FQUpWc2tJOUkrMVEyOXBmdjFv\ncmxuY0JQUFg1bDBGRU9KVG42UWxxT1kK4OSJU5GrzPamKdQFPcKbCgNdNeuZBL/W\nZ7bmxD1YRGmlqtz9RS07dr9L6HO7TLlbkk9Ya4n5LLo9dFF9ev3lag==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2MjBpU0Fld0dsdlBCWmkx\nejFmdGhPSW1VckxYSzI2cDIvZi8wTHY2UzFRCjFaazA2MFgyblc4emc4SjN4RURr\nWnlyWGJNMnRmNys5M20wWGNSRGJRZVEKLS0tIHhLQ0pyTVRvRS92cFlabFRrWFpO\nelpxcndPQkN3bWllTUtpZXpOMzJ1bHcKmdHYvaUWpuLLznSZ9lK9zBpRUyZQJEmA\nxyEaIFRQrSDPs3MrAo9+oCvkYkJXTTe2Fnt3XZiBpSVU4Gy6doN+gg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzRDFLOFptQ3dxZ3FtaUk4\nL1lhODgxUnphWHJmTVlEbWNmLzlZamdVVmtFClE3RXB5elljeDlyUzZGenAwRTdE\nV3lGcUtmelIvNE9pMXJqT3dLWldjU0kKLS0tIG5KZ25XWGhXMjdsSi9XWFJBSUVO\nOXFVTjd2c2lET1loZytvVS9UNitHV3MKnzzEfokZnb6p7Z6ORAw19s2TZaI8u+53\nKJ6VQp0vjkp29LXLJiS+S8uqsdV4Dn/tkwXRhQV8CFfQHkqfKe4KMQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0UVpNenh0ZWZkRnBnWXF1\nbnUzQng2ZnRnU0gvUmFmOVRlRzRGbnd3cWtJCmFuc2ZRL0VYZ1dzZXE0REFmbURS\ncVZiU3IyVnBPQTZXS2diZXU4Mm16b3cKLS0tIHNsWTlZcWN5Y1JBbGlVa2lvZkpY\nQkEzcnk4Mm12SnIwZ3RqREJxSkVsU28Kg3wnYRmr+Ut/6Gq0AWzh8V7LgYpm6nsQ\nu7aUU7oOmvYb089X+/D7PtTINWMRXUR7fCmNVQ9AgQG2MydK5G2i7A==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaNlhoaURJdURxNlp1Z0Jm\nbWFYYTlpcnNmZUZqWmRDd3RVSk50ZDRUcUdBClFzQ01GSmxwOStJVnhYMzJhZEdD\neS9Oa1JERFROc2N3OXZCZmowUDhUdlUKLS0tIEtKSEFRWmRyYlhVMk1lU1dvK2Fu\nSHpWWUkzNzg5T2hSWDlhMzlOSzlEZkkKNi4oVwsv8y2qpLeT7DvuCABsNyd03M1H\naHyrXTpE5v94cdkUuMTgS63+LeV3v1i/FzbaTd5IPZNMFTB6lyAVLg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hl50ufuxnqy0jnk8fqeu4tclh4vte2xn2d59pxff0gun20vsmv5sp78chj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMSFMrVTBxM1hUQUR0SU1q\neVY1NUVHd1MvWDh4Mm5JbDR1aURQRFdMdmg4CmxNZXFKeGgxVGJxR0FiTkkrRWtR\nNlVpTFg5RUpETytsTEo4Q3J3NGtwdG8KLS0tIGdkTHdOeDVuQndmZ3I2eTc5Z0NJ\ndTFRVHNteDErS05MTmRlU20zRkg5K1UKCN9+YK9I3MZXC/cIpnKKHUjI2/msLoNg\n9ANRBrqYe9YEbGffnd5U63XWxPRLD0lJO4NW3MOvnPSA6Wyrqx2eyw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKaWdhU2xpVm1vTkk5dDJx\nT3pIZ0ltUWpCemdackZ4TjBiTlQyVDFGbDBnCmhzTjQyeHJaVktwUjd3TzVHc1c0\nOHhKUUpYMzh5WXRvTnd6cUtDc3F0Uk0KLS0tIFJRU1FHQVljVURaRzd0cDVPOTBD\nd3FZVG9tWGpLeTIybHV3TUJNUjcwSjAKXcHCF5PO0QjlVJgGFstDo/LTwxDzRCaU\nyXdxyq/t7TiJo9ACWHoyYQECFfgM/Mx/4jOPFlSQtJYIzgSFXLKyZw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvKzRZeUlsVDJBVWVpTVQ1\nT1pZZ1E1SVhnR3lUdXp6MDhmaUkyTGlUY1Q4Cm5Jempnem5ralJ5cUtWbVI3dld1\nb3RTcHpndXBVV3Q0enVDQ0QzWUVPSzgKLS0tIC9WUEQ0ZkdidnJpa0c0R2lsMDZF\nbVBWaGZGL1VRaEVYL3UxMGVlSTFwOUEK4cLU3Mo2CeYLMlyeNH2t56BgzJPdq3d+\njgVoF9PMKzZiMa4UjUozNOXAqRygNcFSY7BBcjX/CRJ+QFYAid5tMg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIUVN1RjlHVEFDVzdIY05K\nT0o3M0FXOWl3c3FydjdqaEFJN1ZuQW5ocFRRCjdLNHlMYUcwL3JJRDI4cTMyNFYr\nZFcrbUhZN1BneXJaZElNK1o1eEpYancKLS0tIFhPSFJBL2RNRzd5R3ZVcDVYR1V4\nbHMraVVGQmV2TEJHM3YzWlhCWWx1OFEK1QCIKqng6nLwgzqqjwFXSrw7ownjM3xZ\nQsOR+6cKgrTHKSI0jYOUtAtLIkSpoxBipsKhtdwNapvs80uMyrcsyg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjT1U4TmJJZ3lJdkdwWmN1\na0Rhd2swY250QTNDajBKRGoxdkdhckpORUIwCjJlVkJqM0EreXl2bWlpREcxT3ZU\nNDZaTldpQ1RqTHFBLzV4OXh0RStaN2sKLS0tIDQ0NWpTdXlsNEJ4RFFRb0tBN0JX\nUEVHdGJYYzNBVkZzTkpHdWtpNnpqQVEKJe3DZrlb/9hFFnqquHVWWifSDiINn7hR\nFCdkA7/eqqu2fdH4tGFHz4tG25b+H55soDQHvFUPH/3nBB9il6PwLA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRUDBaZ3JKdElhYkFNN2g2\nRFJZWEdvVjRmTnhHVG5weFlLalF2K3BvWW5NClZERGtjS3ZYUHlVMGx6SkJRWnFh\nMTNFVk01VmlHMlgxcTQyTkJiSFNLa0EKLS0tIHkvbGczaEdiN1VQQUJkVEJVaXJM\ndmVFSnY1TDBnWEtzR1dVaEpTbVVXSFUKoYbEHnTx1zLbr+L+8Kv7GFJ8uJcyJc7+\nMPk5uJob4GJXKAxNlklJpM7z9RuZTZslf/pXeW+rrehy7C/DbWweEw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxcjlOcEltQ080Tzg2enpR\nV0RmblVva2FDS25uNmlJWDdiTHQxbXFKZm5RCkZRaDFXUFRxNFlPQ2JxZzdwbFE2\nQm5xR3FZUjFCcU9VUldCcElqWFREWWsKLS0tIDRMZ1g4UEhJMmEvL2E3dTlsSURR\nY1ZMYjRQSU0vN1BLQmVlTGpDMnZGM2cKvsBhl+entE8HvdWtO6+f0Se9J/psoGST\n5sBTUSj/F1OUwVMAnSZPWsnSjOMpJqoy3GemcCO+hqNORJ3DxxnHDQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwNy9FaFNpVUNMaUpaQkhU\nbklaM3UvSnd5U1ROMlNBdGZ1VlVLUllGRnhFCnJobUh5ODN2OWwzUGJkU1pOYjVt\nS0EwOVNwOGhnaE16WlM4b1dyc0Z6NzgKLS0tIDVKbXR1Sm9mWnlGR0MySi9YK1pw\nV1FVRlJncVZXdXpwWGIxRi9CUnFvbWsKEAKVX9SZ1c8PnkpRQi7b5J9INS5YWLNj\nRsJk1kCXCJKIS+49EJc8Pt0CrvET4sTlnxEl9KKA0WJu/ZixBLcq5Q==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVVTdybk1ySitMUmlwcVJo\nUWh1Nk5zL0kvbEsvNy9kNGZ3RzVVZ1diZmhJCm5ZSmR6bUdKOXB2cVlJeDhYRXNW\nY2J3aWdvc0tmM01yZzlEL0o5Q0VRdncKLS0tIEJaS3FER1gybUM5NzJaVWJuWGln\nTmdTMzdBOUxTNy9tZFlrVzUvMzg2azgKVPlWpt6EqzFn0FARLM847yCqeWb/dJH0\nggnHAMbzqhKaq/H9ZFyXvl0VCxlJ/5E4QZj53SAGeG10DfezlWLUuA==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2023-05-14T08:02:16Z",

secrets/common/komikku_accounts.json.bin

@@ -8,35 +8,39 @@
 		"age": [
 			{
 				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTY1loeFVEYkRYclRuMVZl\nVjVKTE53ZUZUV29wci9hZU9acG1EVVhZOHhvCnR5RGo3OE5CN0Q4R2FOV0ZaMXYr\nOFVTYTVmbkxxbmZqajlGaFR5cm9VSlEKLS0tIDk4VVVkVjVxci8xakN0R1Q3TEpn\nd3hwbk4zUDlmK3lERWkzajc2Sk1zT2MKstjQeXTdt7HJlhAeHInk+yPxcOmPv+zE\nQ8tB8do8lvSpDGVA8tWzCE0dXiX8AGXp2eW9Vu8dDLkToT9V7MDVeA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxV1RwRTlzR3dYZnJtSXp6\nWEhTaTJHRmtYaVF2bW1WOFhBWWw3UElKb1NrCjZTWGpZMVp0UlJHWnR4Z1pJR2VJ\nYlJpbElRZ2IxSVBWR1FFYkZadU5wUlEKLS0tIExxck93dUdyYU9ZYXRINVJ0MzBV\nVG43NkFLNElqTW5UL1NVT1F2UDZmeHMKSX30kfXXKNrbwmc/Tps4F44uvrlNWBPw\naivJSN3/o4qvrpsvnQ6HHx4/FS3Fvy88liW7qDA9IMtTpYChDo/Qbw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFeGdTV2FzS0pMZkFWRjVG\nbkxhL2pOdG9peUJZbXR1TGhOSWtoRzlvS2pBCm1LRXpqV3BqekVQejk4ZzcydEFs\nRk5tM1dLYS93dmRWMkMxR3R4T0dRM1UKLS0tIHN5U2ZwaVBCcmZSa09GSTlTZmxI\naEZ6SE1KODd5SUU4bDQzbXlldmRMOG8Kw3VGUaRVi/rdo7PsVDS8+TELqZYuQ91u\nknpWJyliPG+Yhst1FmxDTZGksRZcYBiwt3gYuHuBKm1WTwYVUevWEw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWa3pyK09vQmNuaXhnT2do\nUmpnN2JTVzdVUlFMQWdJR05tdTZQbHBxMkFzCnAxTytSbENWTGhQNHVWK1JTSzNO\nSllaZHIzSzBJMi9rSkZIczRsYk45K2cKLS0tIG83Ny9TYnpBVzUxYTllY2IwMlZo\nd2JpbEhpRkNUTXdWRi9XNWYxS1BvRjgKDu/vq8LyxpjvCG5yE5k2JeNfgTpP3yPc\n2Hv43IsvYELnpgYZ3DqCASFsk0dbP5R6vEcqMC1A+4Av5EsjW91dqA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOM0NVS1V0MEVrSzFkc0Q3\nb3dSUzcwVDNWVmFyVEVKdkdEZGdoY0lHSVNFCmZqVjRiSFZrb3N6NndFTG8rMXJS\nbkdzeXlOTE1qUFBtM05uMjJsakdKcFEKLS0tIHJPQTFwdVlWTlVYTEM4bmc3eHQ5\nSHVYeFZ3ZVAvUW8reHBjMkVVY25acVEKY9XbOaFURubHh4fTpVVkuTpQnYoABgxy\n/XyA79WpjRlzvXa52ac9K9QgE8R/HSIeIH1j2M3yRWXs+Jw2TtGaGg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIYWVzaGhVTlNFcVF0d1Vh\nSmdMVnNhTmVZMDV1Z21LcThDbUVYdWlwTXlJCkhzd1VraUpmMWVaK25kZ0VtUVhl\nZmdOeVhVYzBMTC9OWnp4ZEtYNEVqRUkKLS0tIE1SS28xS1ltUk02L0U4aTZFLzQ1\nR1VTenhtQTNJd3M5VCt1WHpkWHBKS2MKOsRIAgc7LoTdgjW1JnCGO5qNzBUYId+F\nNQ4cU0FDJyu5MSimQ2tMgLYjo1tHh/AKGT/niydx3d+uFpVrjUmUQg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZC9SWGhUdzlYNWdLc21w\nbkVlUVZvbjJCL3pPOEJ5Rk5pQVVLRUN6clFrCkphUVUvOHc0OCtIRnNWWVRaWlNV\nQ20xSGo0b3htd1NlUXJQa2E3bFZSZFEKLS0tIHJhTkNoeC90RlRyUWlCNGtReTl6\nanNjV1NQeG1PempPOVNaMjJ0S3FLTTgK0EcUFCHfm47HEBHiEvs3TbylsSxAJ15p\nNOwgCIMFeaTNgkLuXDEYurNN0H6ioXaBNV2ecy7aHNLLgOyayW/jew==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDZVFJcCsyOGJCTHo0Mmpv\nOFdjQmI1M3JmeDE3c3d2OFdFa24xR0pzem1NCnl6STVYRXRydmgwMlBsMGx5TThq\nUHZ2SEI4MEJhZGpuZzhFMHU0clVSdkkKLS0tIHdyVWp1VGhDZDd5M0JaVmI5VS9E\ncHd4b0hFNEo2djJLaGFnaVpGbWdzRTAK0XNX+8xOfmR2JPe1syZ5hTSqhp6pUGdg\nEL7yIhoyVLedyDHTZLAk1XFfodXnbjMB+r3eSBfBHwS0PJRYdgnNxw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hl50ufuxnqy0jnk8fqeu4tclh4vte2xn2d59pxff0gun20vsmv5sp78chj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBadUlZUXhublJvVXFNdG1L\nWkJUSkR6OTdJOUpWVTE4Wk5ISTFtT3d3cjJNCldzcTl5R21FUlNyUThGTTdhUDNh\naDlKcDVlMlJtR21xVGlyTHgyeTBmUUkKLS0tIGMyYitnWnpzM1JhcXFGbUtTek81\nTUlFVzJEMUZFNVFCUkNicXh1aStXTTgKderfUTU74b4NA9vScYiMT8FwyWx/DoGZ\nYcdCp1ciEuC8j08QeLcPAyGrWtZBkKlZU/HxEA/QDM+PvF2I2GYNag==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1THg4QlVXQ2dFSG0zL29h\ndW1ubnpzeWt4cE8xMkVQbTU3QU9wQlkyWmk0Cm02VmlVTGRnVmhDdytuQ3VxdGRS\nTWh6UkpKajRiUnJxU0YvaWdhMmN3akEKLS0tIHJvYVAvMjl6eDltSWZsNjFvOHNX\nbzQweHc1d3FRK2VaVmQ1UjN1R0pEbFEKU/nabtnnzwoTjrJ7Rib44Fwfcce52Obl\nsoz5ZSOSGJSn4h/usUg/WoEJYe7Ill7skxlUXExAdnvIpMrBpQlcbQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqUUg4M3hVRm1UMzBzSkNt\nVFU5bXNMaW9LU0ZpRHlITlQ1dTUzemhEMmwwClF3d29xVDQxVFpuc29kMUYvUk1w\ndW91dDFYbmwyQmJ0T0Z3alVncUIzazgKLS0tIERGek5Oc3pMaTRDNmJXRjY2V0Z1\nM0hMa1RiWVFDeEh4UTlRa3FpSm80L0kKU6uM8MAztxg9v0kGRChJu/DkTF/rnu0j\nxFU0VqCP9VhLMXCkyr+DxgwGRvTkWbKwlSmpffi6WxhOj/GWkY457w==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCUkE5L2RPRG4weUVBVGcr\nam9FVm0vYSt1NFZJVjV1ZStNRi8zUFZsSURRClRkY1d4R0xLaUw3ZWpZdnZUUFM1\nVmF3cFF5OWY3enR6TVNiOVhwOGRNVTgKLS0tIFhXdzZzTlN3VCt6UHVncTB1bHZK\nRkY4YjU4QVpFTU16VENMVnR0ZVl0QjAKMbnsrwvGcAVVpMMVmKR1XANWoI3ZmuCI\nXHQh+XzKcCOQ1tRG071RthuptK8ALxxXuGzNfXYqAhjF02v6U5SBmA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2TlpZM2doelowYmE2NklE\nR3UxK1oreHJ3Ni9LMmN4UjRrZGxtOWVJZlIwCkNVL3ViRGJybEh5L2JzS2ZBOTVU\nQkMvVGRYbGJsS3FXVTNTVCs0WmFLcW8KLS0tIHJLc1Z1dFlVTlFxR1FpTXluQ0JW\nVVVmcW1XdGhMTU9XWlhkUE5SRmNnb3MKyAjvmUuoFQmowdUPdvjWncfcmLTAQso6\nzxwgarw/Aj3h/ed4TYcufGOGjPPe3EBDEUaOnmRiaSOQ4IKqFYn30w==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvQ2tTSHJiV3FreXFnTGdn\nM2xsWHdEeTY0U1VwaERzTlM0UlhkZ3RERXdZCmFHdFRrTC9wOHdLazNBVDhHcVM1\ndkZFdnZIV3VUZWtXbjFkNkF6SjhLWTAKLS0tIFppaUxZM3ZSamFrR3RCSlJsWXRy\nYmtPa0UyK3JlbHZ2VVUyeUE5VEJDdW8KO6AE2G7E08C+TAhEa0F25kD4fm/VLftT\nFrkA5KoAwv5tbtrLbRN7hS1JPoh2zktuH/v4o+bXhoKBOcftcbTa2w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVNHRycW9UK01XS01yZXhM\nSko4SXdlcGl1dFF2Q2hmZ1FTcHZiUkFyaVNnCjJLazZmWGFWSTN5dVNMQjVMblRY\nWVQySWtza2FwTTNrdzJ1aGlRd1F5ZDgKLS0tICsyYlNTam83Ym9kajViZnZ1aEVT\nVCt4M3hrUHp1cWZoQkpPa2t6ektOeVkKurB5LWVwA5Mc3iDe3DK91lLtEQUs3pRB\nrRAdrLhQqZUGFKTN9layYkjXRSt/tdTjhUlVZG/VvKwnNHJiVAlU0A==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMUGZJckY2Q3VqSXZYQWp5\nNEc0WkFsSitmWEwvaTFWUW82YUlYMm40eW5zClBOeDBsb3Z3a1I3OHFMT1RxTHZ1\nbnNBRUZlaE5jcnVvQjQxaktkaTZkT1kKLS0tIEcvK0tieTZvdjEyTHVVckFZUERj\nQkFxc3dLQWd4dERiZGhza2NMM3JoSTAKkm3T5FYSo4DU7Pw4wjVoDtMk3WognNH0\niJ8f6kW907ypotbAH0NZffQtikzhO63F0cPI3zQxbx2/7Bf8lw6QjA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5SE02WXpFWVNWa3hUTGNr\nL2k4d2h1aENCNG1LQ21NeGdtQTd4VHRqOGhNCk1IMFphWGRhN3NMQUcrc1BzNmJQ\nS3FWT0lGQVRGL3FQSGVFQ0xnYkI3Y0EKLS0tIEt3aEkrUzRWdnhlR3RBSXBIN1Vp\nSWFoVldVZ2NtaWlxZm9oWUovUTdDTDgKRSA8p9CYvnnNEX2WARCJyqzMXKwQ1CBk\nKMh00D15+nQZO4Z2VCeOm3s1m7h9AuYzjYLK/igWGy0ZgAMfrpo9Hw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2023-06-13T04:08:00Z",

secrets/common/mopidy.conf.bin

@@ -8,35 +8,39 @@
 		"age": [
 			{
 				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQSGNFU00rSERHQXJJTnpL\nRXNoYm4xazN6Z3dvMDZ1OTA2Q1g3OURrRFdjCkgxaUZaN3k5RHFGM0hTWkRybFBV\ncnVZVkFiV0NWeXJoWGloV0c5Um01cncKLS0tIGZFODFxeXVpNmkyRFN0SE1ZK2J3\nTkd6dzFNT0F5dTJ6VGVVYTJwY2xCL2MKTDHVtRp1uojeHJ2dILTvjQTXtWU0A2ZT\n6KEe5pkoadVoI3lu70RLyGGQuImGgc/ZsEJiV2CHIuKG17J3bexBBw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0SGlxaVB4enJ3QjhmcC82\ndVlyc0JYUmhBbmQ0a3ZnSXRVUURmalZqZ3hjCm4yekRSeHZTc1A1dy9iL3c2WkNB\nSTIyNVVEWkNkRGlWSlVoaVZCNlo2WFUKLS0tIG94dFVNdzd3UDdBbStHWVhNTGp4\nYVFOcDNOaTFJN1hYZXVFSUh5WVpWSEkKzxXo3hCvdIROwi1v6nt73B+Sj03o5Mzx\n6di5nQH8X70hype2vEr85zfI92ON4fU6HdQXbJLVzyI1nrh5s9ZkiA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2TWYwdmQxVzRESGR4Q0J1\nN0JXK2V3SXB1SWJxeHJKNjFpOXI3ZkFTbFNJCmNQeHRiM281MXliNDVHNExVMGtX\nR3FZcmtTdWhtaU1NSmlwbjdkcUJtVGcKLS0tIEtJaXBsZXVBSFRnZjRWRGdVcVBQ\nQ0RqQmhMZEJ5cXBkVk1CdWZsMFROSTAKx+uAnbpXblkJi8zSiyJXO3UtHTydGbM4\naSN58lAR3yCuSuNHdUlDXr9TQfF4rTHEBGMBFh0ey/CmX8hzoJXiDQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxU0xIQzNHOUF5bVdua3hN\nY0ZzZkpKYzN2ZmZtd0VZN1ZMcHQrZjFnTndNClVMUmFzdWdxMk1LZnJwNFFKdkdj\naVlucjZibHhyY3Vxa0VjUyt4QVd1cEkKLS0tIEN3WkRzOG9XVEJDSzBvZUFEcHor\nVUZSTUJaSktuUDN1dkMrdHAzNU1udGsK90HcoYT9ojDuTux4LHBafFo2iTRVq9iq\nrcyJpnJnquLtyhK72CnRkfHNrXYWMOT5k6b0DTwvKERcLtyrbOnU8g==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpZllMSHRDN0tUajdwdzR6\nOTdadjN3L2JFR2RNcVVob0NLWGlycFdMNm5RCk5XbTExc09leGpsMUxUTWFBYjhy\nMnNDazI5WHprMFRNWVc1QkdKTkppZmsKLS0tIEJWRzhBb2lKeDc5bHl6OXdvMDZD\nS0UxSXM5R2xOUU1Ud2s2UmRkVE5uNlkKAHjY/gUahrkgAbb+2Q43asvVrgdaKfWC\nO5JPHo+krBydvNZ2k4261lBF8zwJ++D+qZK396WxChMH/RhiiPUBSQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNUFhCY1FpeGhjRkFWUjdL\nclFpU1VYQk94bUFvMy9seW53em04d0xrTFQwClNGUFZlOW1tU0FJYjlBdDlRM0RX\nRDBQVXVSRFJ1VXVOcnJFdmE1bVdiU0kKLS0tIE9WSDJxWHZuLzhFa09QZFoydlNM\nVDZsUUZKU1BSOFg4dlZGVDkvYmFmc2sKf5rZdc/grXqm8HHSKoDqkjVaJV/ayIt7\nSlGFHu8W3TES2jsKZr/2BtXxGBQv9D5i9Upm2xM8MWn2mx/hWDf2uA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxYVJYL3pmVjRmczJjaTlF\nUW9OOGU5dzdWTHg1bzh2OHR5d0tNTGF0NmdRClQxNVF4b0Z6ZzF0YndvWmZoMlBD\nQXB0dmZhQ3N6S2VjRFh5bko1LzJYR3MKLS0tIEgxS3kzWHJSUStUcDRDRG84bGJ3\nYmRNeEMybDB3b1dFV1QxNmhJeTNCM2MKywwuf2TNR0VuEQcaZB4uYdxSyG6dzNiy\nX2/ke2xG8yApIKW5WIrOO+UgGB9i7ZdiGKUx73YUKgm/4IECfbHxSg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZR052NWQrRExVRGMwWlJ4\nV0lIQlI4bW5Rc1ByK3lTT3prMmc1azBoVUVvClpvaFRDdG5QQXBxNmlyUEF5N24x\nQS81QTZyRS8xT2V3RFVKZWY0YzdhRVEKLS0tIE00aDdzRm1sWmpVd21XY3dwZHBz\nWTVYaU11elB2S0JxK1lvUFF4NWRMVVkKqTMfsdlWzzpbSR54W8VANzIbzYQtZ/11\nwHF2cZHlrwTnucpoIWugynGsvu9R8x5i9lFjaNlavUwIJ2VR+BRMhA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hl50ufuxnqy0jnk8fqeu4tclh4vte2xn2d59pxff0gun20vsmv5sp78chj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0SlJWRUk4Y3R3MitrbjRy\naTQzTHlUR095S0VSTkdIVE1ualJibVVML1RJCnZtVlJjUFpkYXZhUElGZXo4TEZ1\nanFLcmtnNm5aSWI2Wk5OYXpyMlBPTW8KLS0tICtRcWxDd2c3ZHUyV2gweHdoNTlv\ndG0zTWJUa0d1U1RuN1VSbHc2VVNjeVUK4a5tW0cqY6su54HRDS+ZNdw+DB8ipxxA\ngMOE7vQwCzofvME5Vxg5Yf09nlsSwdhkoBZwegM/0vTTREM/oiwznA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLdmtEWXJDUUdKdjF6QmNY\nUGd3dW5BNXY0NnB3WE9aSWF3RWxiNi9TMDJnCmhxaDBEVHRWelpLdEgvT2d5Uy9Y\nOUFBK1ZNdHl1Mi9kZ0dZSmpVUVJyQzAKLS0tIFNpeDBFa25wNmhqZk5vT0dOYk1B\nSWhKV2JKMmh4RllQWC9EQ08wVmZ4UmsKQVCwHKBSFOTrG7z3njR7HV1CC/ijQksT\nB4iYhs8Vt91QPLvVte7P9PYk5yNu3cjeV65h4jHn9G/RzfUnnNyfPw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0L25BcUNmTmNqTldjc2xV\nVnB5bWxsNzdXWnI2MmlBOHVQamJqeU5ac2dRCmcwMUw5VHFuUUlGWlAxTlhaNC96\nSUdVcXJ4QUlGWS9xSmQ4ckVMMEJNZU0KLS0tIEpsRys5MVMzVnk4LzBFWElWV1N6\nRUVRMHVheGp3MXpsVlR2SjE1VDcxYUUK/eum+yorcNj3CuAhZVL7vUqGTNHW6yBO\ntF2RpTpIXp3dje+LH+o4wMFdFhi7x8EiL+o11NvTwOfDU4nyWWn73w==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBRm9PMWpxMjlsTHpnMVk1\nRmFNclNqdFRPc1N0bU12VEpPcjhDS2JIbXpVCmo1TDdKYTZrNW8vSUdScnRSQnVP\nMENQUGg4Nm1ocEpYS2JGaCtsdloxc28KLS0tIHNjaWE4dFFyU1FBakhoa0VMZFBT\nTG1FODZGYUQwb2w5Z1pvV2tuS0xFajAKAADHxS6UTmdsAxtbR7ioemPLmxVqTEd/\nD1rhXomfMQ7NSkb5SUh8z7axGxY8BziVheQJWGwdIn6+u2KiI8b1ow==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBONlVFVkV5bzNud3FLdzhh\nYUJFbWxORTFaVTlOK2pscllub1Z5K05SMGk4CjN5cG5sUlY5VEpGd2w0M2VFc0M0\nT3FtTnBIbk9iNXh1ZlVaZ1UzUnRRY1EKLS0tIDhMWjhZUFhXYU1BNVdTVUhjRG5W\nY2NQamlDcjIyNW5tTkRWdVFCZUQzeWsKkms0SeBMI3MVdOPSq6e3QcTrLrDmuEOn\nOVK1NHeV7wYspVXjRMcCUX3d86Asf0E7rV942vlVxHX+rq9ueP6O3A==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYYUp4VjV5d05xQWFXRjR2\nd1crNVZyRmtuM05aZHAzNE02NC9zVER4SVRFCjN2c0VlZjh6NUJheEFuSFE1cVlW\nTUhTdjhRNXJXanJFTEhlbGhaRUczVWsKLS0tIGlwRTZBWEhQSzFhY1BYQXdyMVVk\nRUFZcHQ5c1MyaVp5ZVJNamxuc1pXOUEKTsSzOuNOReMPZ99ICOW8/TCQBt8jjP6a\nO9DnwjImazq0i3HKjT+dgNYNlwG+MaUqUNdqIixjbE7s7pskSZlgjw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqODRqeEY3ZHQ5cHYzTUdv\ndXVrRmZIaEdrTGdKRGIwcDcwSVQzQy9RbW00CjJrQ2RFL1ZPSUMvQURZMTV6NkFt\nSUxvd3lkeTFYdnpsc1pGK1ByY2doUm8KLS0tIG5SRVdCcTBPTHgxdnl1TVFGR29z\nb3FPVWNzWGxxdWNlMXVVbDRmajVyMUEKWHTmJz7z2kHgHibJcy7258NY09T5H6Iw\nz6piXOYaZmFRDjj27HPz5pTEI4VXnO/7oWXcqodjGSvh2+427NSLBA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMUGlWNkg3aVpwZnppTUpY\nVzdaeXlHWUhFeTZsTDNkY1B2a1RRajQ5YUJvCmI1a0pOTjlnai91MjIrM1I2d3hI\nd0ZkOGk2WWo0U0hOdnRmaW1FQm8zR3cKLS0tIHBYdnFqdHRHbTM2OHpRcXFNN3Bz\nQUZVNnZSQkUxZGhRM2liSXZTRVRHcWsKGMhYTWmtcRy/WjxD9uWe+iQCEMncebzr\nnkOmOPHOdnvJY+WynTAbHs7nYKKRLizchN7WHLxWah39C5KzmTSQyg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmemhzSU45SE9VNzZwTE94\ndDQ5cUJBRDZPQ1dETGNZTGxUNEFaTGo2VzNjCmdBSndxQTB4eVhxejQxWUlSaDAy\nU2dEMFRlYlFOQ05ubEFXSVVJeHdudTQKLS0tIHk4VG1zWXBLUXpNVjNUMDRUM3Vn\nMUtueXJ4U0o0UXN3b3ZHaVpZOUJrTU0Kbs9GkyKT7efYaUpbt6bPFmtCb4sS9uM1\nJIINWHrWaa1QqVC1eCswuH/LVO0xPNxfnDU8i0Hk7HEcVCcBKjLtEQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2023-08-13T10:17:15Z",

secrets/common/msmtp_password.txt.bin

@@ -8,35 +8,39 @@
 		"age": [
 			{
 				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGcEdPbGJ6RWFZYUVKRUtZ\ncDFYQUxEYWhIYUtxQ1FFZmtrbWdSTU5GM3g4ClFXdE1GQTZiM0ttZTlMVlQ3bVpt\nY2w4blVpRFppclp5WFlSWnNzRm5JT1EKLS0tIFFvZUdqUHE4VGVOR0RxR3BUQnJo\nVngrVlVtTHhCd1NML3ZpeC9XdHU4c3MKDXdy69z+LjN4qpVyoGDdCxFJBrJpNYY5\nr7eD0LXGxQ7Z5/YemPzc2FJQ+IUkxnwB1z7o0hYGQIrvX0TvpjlHig==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwSzRTVHN0TEJPeU5MRDdn\nOUV4UjM1TlhoY2E5eklMWVFWa3JmYjdnekJzCm90dDZOS0sxWnlqbE5tY2NGL3FV\nZWs3Mm9WZnJIQWpYeW8xQ0gyZWRVazgKLS0tIHk0Wk1YWG16dFJBTXp1OS9wSHd6\nZ2RrWlMrdjk3UG1YeGlZYWpydWxkUUUK1TPTtHRwq4ET1cNY5Ioq9hni+0wqzf7+\nBh8k4DFP+ana376xkL0JolJebZJk/pKiQwo9Ts4irZPSujDcIlUZEg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRUEZCdmdmZHJmUjhUTUV1\nZnFBQzl2M29MY2tKcnRyeGhNYUZlSEEyT0ZnCjRuMGgzZWtYQWZaZGpYWlJHMHVo\nNi9WU1grK01lVGZkdGZENU5XOTBCbWMKLS0tIFN5SkNhbXZTZDEwbE84T1Z6M0RS\nQmhlbHQwN2ZzSXR5Q1ZsbHBvOUdiZ2cKSTLrKPM0TELStaqGZ7PvTyQeotREzYll\nbVNpxfpHadfOYTu0Qn2d/H8haY58hYia6tzKrMFRrnxl8r5fnk4jeg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkTk8xWk56dkx5N3RXZ1Jt\naSs1a1dscVExS3VZK0M2bEJodWRhQnMwMDFRCnFuQ3Z2eDMxQ3dpeFl6MmpLYW9C\nM2tFTkhYNHZVMzVJbDBydkNqODRsUmMKLS0tIFN6UnM3MEFEMUFzNjRIZ3p3Wlpl\nQ2JoOEs4MDB3a0pIdzBka21DL2JsTEEKX1/oYpk2uNxfaMd5UDApN4/5wJAlybvY\nWKHCHctWxd8GFMHR9r0vQmy91zEkeXpCSGUTIe8fPD0hfJfSnbeGfQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjMjV5WjI2YmYzdWNtU1Fw\ndVNlUFZQYmVmallCNFYvOWxxdHVZRjgzWWxRCmovenJqL2JpRHMxYkZXS2RBcUtL\nWmRndFZuaW5WMFlGSWgrVFZuaDJid0UKLS0tIDVpaGZhVmFSYVkrQzlSeGFxQkFQ\nMklCNDlndkFTb2l1aU5Pa0FEZ2UveHMKQnm7zJxPNvCw92Jog76nDaDQYUQpSXZ+\nmbIf0daqIu4yQhKlen/I6p4hWvr8a4mvmVqIkwL13MNRS4hzKb3NLg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0RGJoYTZnS3ZGc09Sek9K\nS0NibFA4VFZGSXlCbnRCQU53WkR1ZGZPdG5rCnhmdDVEYmxVMXUwcmZLYzhJMzh0\nUFcwS1U5QTI4ZHZDdVNTSXhYZ0xNNncKLS0tIFV5eitHVGtUWDNIQkRJTVp4QUhm\nQjRjQ0NpNittcHRtUnNGa05wUzExS1EKU0GbPeVaKjhp+wBbF36EmAuAcYLSSDCF\nGat1MvC96CjULlWrTKVZkjMN4TDA5akPObij7PcsWHVRawaYM0bOpQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYTEZONjRZa0FvWVcxSkMy\nYjZKaFpxcnBYbFI3SFVzc2Y0cWVEZGlCVHpVCi9tZGFnazVOeHZEZVdnSmUvL2FE\nQnJJbS9KNmtwNElvcWE1WGVQcG1Rd1kKLS0tIFpzQXp2ODBiaWtCbnVtTEZyYlRD\nSU5KTWdJdW5oNUpLQmVIZXM5bGxMK0kKNMTR3OpNL0POPmS9SbMAPFzW33uaz5EJ\nnOTnSlaSe/50bBPiHY9P5UAmNSr6prA86FV4sneGDz9C8yxFGaA0fw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtQW1vUU5WZWovcm9zMUVs\nY0xXN3h6SlFuR0pPU1YzNC9QWERSVEgrVmlRCjZKTFhaVE11SWM2a0hLN05TbnBC\nemk0VnlveVVhNzdtQms2SUR5c2I5eDAKLS0tIHY0S0lueE9xWEw3dGRxS00ycmZ1\nYWNoVFVhVjd1a2oyeWc5cStLekoxSVkKs2GtyhNYE9ZfskfxBf3Y8nJN87Hh1baU\ns5pRlp5NTNKwtLwXUp5Cn7jBHd8KmiBIyJ/GMqaLJO5AP5+6KNJwGQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hl50ufuxnqy0jnk8fqeu4tclh4vte2xn2d59pxff0gun20vsmv5sp78chj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIQkxLOGk0ZVBPL3hFVjAv\nUytSZm1iR2dCcDVvUWEvOEtCcHpQdm9VU20wCndDZXRjQlBtT0MzOE1YNVR2R3Vm\nSi9FRTJkeHFLNHRjbjMwUHNLRjZzMFEKLS0tIHY0MWhveVg3VWhxekhWTTZ6NnBJ\nS2xtanlweElyZ0RKUUJDSHNtdFlYWEUKVgQS1G4mCeDrfA6Ugyj7qRF6aGho2AfR\nUpEp/Zv3SaWLRLGiqtwV9+6l0yDj+L7As6c3ldkLVPrNnXfWEMshcg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtS3JDY2NpeFpJNi9HZHF5\nVkViTkJvdUsyTmVEMUN2UVFBQ0dybUFLY1UwCnl1L1RTdGlkYlhSTEQ3N0xYQzBj\nV3lTRGFyVzgwWDhJTXMweVhsWm1nQUUKLS0tIEErL1k5QmpkektkNm1ocjJ0Mlg5\nakpySVdjQ1c4Y05PUi9uYTR5V3p1bU0KCM7XHKnwS356DuKE/P0uOXO4Yu6Eyi58\nDtmgsaojXMnD9+dIP0Y1+2BY6L/uXizEakdfLTaGJcELq2sZX9Qmdw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjT3hWMzVaMTh0RFJkRGND\ndC9zUHpJYUcrQllFVkZRZWVBNmFRa3ozZkZzCkxtNDFacmMzTWtiV1VyZXdzRkg2\nZUhhV3Mvc2FYSW9nWkp3eVRKTjdCOEUKLS0tIGUrYjlCQXBLcVhHWmFTV3BRc0FR\nZGVEUjVYSVEwSmpuVXpSa3Z2UUw4SE0KzuTxHeZ0eODvQvHzgjop5FOWhDTR8MeO\nkF9Kv6kurpZuRNRmWZ5hlaMoyT2D94SV/YtW+PGvC/7ZeqTObSiUNA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiK24zS0h0Q1FEZDBKM2t3\nUHdlWXpaYzNQQzQrN0NPUXVVdWo5dmY4dVZrCktNRXNvVDZpejIxT2FvZmlHWlRU\nWmRZb1N1VFJ0ampRRVhuZGJIQU9pL0UKLS0tIEFXZk1zLzh1NFFKQnF5RzVSM2J1\ndlRXYnFUTFVDS1pybjRzNWkyaUlyQmcKysTv+9YJ7E+KBBtzlAlilZlkGg94nWGE\nE773pduaDN12ojMfc+JPdOU5oTISZk4/QvBL+kmAQI8AlmSap9Ix4w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaVENPRTgrUUNZYnovalk5\nUDdRbmdSVW9kdUxrZ1dpeGp1K2YrSjJGZ1FRCjZJT2p6L0lRTkhTZmlOWUkyZjh0\nS1Nqbk05L2krS2xTU3B4L2JJQWMxOUEKLS0tIDlyUHB6d1pURHN5TjRaWU1GS0o4\ndXVldWJGVmpDVExNcHA2NHpYSHAwZDAKfqXzRXCTAhCYme3Wf+bJqQU4kFCy1wT7\nPPqjex3eeYBSFkwTzx/cPNOAJkTXwIPziVGjJ1dvqaI4LKPel9QZ8Q==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhciswMkkrRDVBZmdSeml4\nTkhHeUh6UkVUb2tielkydmh5U0NmaGVWUEFVCndra0ZLeHYwaS9lMHladzVybWNX\nL1hsYlFPTzJCMElJZ2hWVGcyYTdCZkkKLS0tIHI0b3lyaldqNS9WT3BZUjVKMmZu\nZzBmakRFeHFxT0RMWCtONVIwV0VpT28KizkDpls5SVyypJY7aUF4v1DGdVLTMLLM\n2efp7mQB5YYvjKzXCiG+hYRWSbIS/5sHtE40ofmcCPijj7jY3wegUA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3WVlGdXFFVGo0RlZiYzFn\nZzdiWUpaV3ZhVlJEWkVmM2NZUlpBbGNWcUJrCnlITTBNL000WE0zY0lVeWplZmRh\nU0cxTnhWeVpEcEgwWnRzWDFiVld1ODgKLS0tICtHNFpyVEx1aGZIWnBhWXhCTElG\nNmVqeWgwNlFWbzkrd3FTcVo5ekRZbDAK8yGUHZbfwBgKuhY9lJN6X4ZewQLGqNjN\nysEAeLppIqLoz96lmFmhuIOju+z40wBq/lLn4YoAwkaMV9z0dvKA3Q==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHNHlhMkpscUJzdk5JMXVI\naGpjdEYxV3BvdFd5bjJLaUNQVndRWERkOXk4CnU5NW9aS0NNVEM4b2xvemtEc05V\nT3h4UjNOZ3F3ZW9VclQvOTNtcER0dU0KLS0tIGN5WisxWHBNQk9sYWlDbUp2eE8z\nR2RweVR4ZEo2ek45N0UwQWM1eVBFdUkK4e2noR5Xn8evKxh7GbAi7szT8uXBfn8K\nqgWlCWkUusUanRqJkmdi0y3zJxjtgs5bMU8JSF14hTwWveoIc/Ec+A==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXeUovMXBJRTQraUt4NGd2\nL2JkdWIyYWo0S1RJT0hlZlVaTldadFNRSTNRClc3c0QwYVJ2bkZBWmE5cG55TnQ0\nbGxOS21id2lrV2pia05XUW9nKzRaTXcKLS0tIG5tQmdXVkh4czdzRDZwa1l0bmN6\nSWcvRlpNTFNpZEdQRnBIclJiaUhSMGsKgEOyyfSggqWUrS9hW1t0e1nOFxXzHVq8\n3tTEiMwpQTtJ8WSC1H+gPBUxoSBt/5S56XCHDQrLCojIseYW8FFR1g==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2023-06-30T23:57:28Z",

secrets/common/mx-sanebot-env.bin

@@ -8,35 +8,39 @@
 		"age": [
 			{
 				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNcmNwbU14bnFkTjMzYTZp\nblRGR0R0cDlrMDl6VDRRZmFGanM4NHY5Q1MwCjg3U2dtSGhHUmgrRzZVREZsL0ZH\nQTRyRTMxc05NaC85eW5Pc0ZJdHdFYzQKLS0tIDZFdGI0cTUxSlEwN1ZpMzFzMHlk\nWlJKNzZGN3N5bVk5cUI4T3Fya2NaMm8K3R99wPFdFiEtPCen2Wa9YzwxXnEcJobc\nuG8xvQUfUY/n0C2Ch4NJ5m9r+76WrnY3uG8f5o3OgWE9AiY1PUSZfQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZbjRLeFR2eUJzUENSajh6\nblFTMkNBRU5yak9BSUtnRnJpRjk1b1I5VzNJCk1ZVk8zaURnd3dISE1FWkpiYi9W\neFpXb2tvdExMT1ZlWlJoemdMUHczZEkKLS0tIGxkSGk5NzNOcVNNU0N4c3YxbFdE\nZGlMRzlRZWxaZ1ovSnU2Mlp1Qzc3Uk0Kf/jxKZF0dsYUFJHMXlk2mRV25s44nkOR\nxNHN9+Oq7h8fcPsE3dpFTajhVlbYNNY0Bkp1eBf6AVTfSQM5vhJUIg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzQnBHM0JJc0FJRUtnK1dV\ndmVwS3dnN2pKOHd1dU5SZ2hDT0grZEFHRFQ0ClRxcWw3NlM1Q0ZNVnY4N2JlUXpK\nb2l4cWVDNzViU1lYaStyK3pUM1Z3R28KLS0tIHhoVGtNUHVUUFJ3bFUraTJDdGY2\nMEc5ekh1a3hkTHZCNTRUVytieDhtNVkK7MR1CCPii79Yk3xJ4A+6oYnI54ykEXQM\nquEYdontLyX5s061p3PmHutEHOIGpQDQDDunbAnfIdSKngZuX/kY/A==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxWGFIMFNOK1VneTk5Mkx3\naEQzdlo5WnFSQkplVjdyZFRveC95MVBHUTI4CmJDd200bnhUekRWOGExcWltUXUr\naGNmZERyT2FZQUNQN0JPU3V1MTFpSVkKLS0tIDJDcXgyN2trc29EcElRbHArWVdt\nSDdMT2xJS0J4QURiZFVjaU1ud2ZzY1UKecdHxE7a63R4qXg0sEPZ8K4JY3Opix2W\nVGs5fE6uV4NqGmOyiC+wAM+b5/5PJHX9TnhN1/QOwOUt5KNHljHV1g==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUUTJLbEFsUW9LWEJrRjIz\nQ1dhZ2dGZFF1TDFSYUFmcERMemhaT1RXYUZzCmhCN2dSM0RJSDQ4WEtDcVN3RGhK\nUldnWHpnc1FWV2FOOGVINjZydCtBZ2MKLS0tIEJpaHB1KzBnQWg4ajA1dE9zU1FL\naHUrMnJQYk1BM1NpbEsrNWVBa1hXOGMK2gLe3Ddj9ErlzkR0RjlsmnEiY84VBMj8\nKV0NklDpxRdhYgrEKcJi6b+RZEKDLu1vlwGj70AzJUv3OK5uZoLCSw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGN3RZQUZUcThqWUpnQnhp\nc0lSK2lIbS9LSmpLZitnMGVkZEVJdjJaQ3pNCkZ6cG1mVm5kMzdhcHdVTjBuR0Nh\nNXZidDE0Z0greTZLanhrdm1ibHNzbWMKLS0tIERrQ0d1cEpUeit0UkkrbVBRU1dn\nSHZ5aWVkUWVNVSthOGp2eEtHZFM4L28K0fgqEtTV9z6IDRK7MXvgkIn3L+IZpVfP\nhJCcy1Qu48UZ8eCDaxPkG0VQwjdEHQXh+a+goMDaX+fmfpshQoF4qg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0WkhZZVlFaHFqeFp6aVdB\nMGRJSGVPRmJJeCttRjIva1pKM3EwMGVkdDFZCnFGTDdMc2ZURXR6NmRDTkRVYWg5\nbmd2V0FhdjNmQUx4b1NCRXEyU0lxL0UKLS0tIHJQRy82V0RkS2VNUGg0cnFFdHA4\nYUdMUStqM3NmRnVHQys2dzJ1cmhWYXcKxWRun88b2lClrI5zKl/XC8glXbE7nUFH\ncPdqSz4mYsPO8f5KZ8GZ8UZ68HBjrlS1vW6Zt1WmkUfXK3wOh2oKVg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0QjNKbGY0ajdnL1NDNzBU\nTlFuWnFWSFBManRTVnc3dHlER3c3OVQvTFdnCi8zVXplbzI5cktYOGxoUjdOY3BJ\nNC9jRlJwejZYQ09ReFBxN0RvSkpMcFUKLS0tIGxnczdZMnAvdm9PZWpUcGNSWndQ\nalFTM3VEUVhYeC96MTlZdFF4WmVZUUEKzEt0CxX88E7UggFs8zYARCC45L9aL8XM\nZdvAWnFmgEStZZUMb2pLUihGW97mjuOyyCQPzwrFRiu23HjHgoU0ZA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1hl50ufuxnqy0jnk8fqeu4tclh4vte2xn2d59pxff0gun20vsmv5sp78chj",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAySFBJSklZTHo4dE45K1I4\nUlExQnFTYW5MRTVVSVRJWEl2S1FRaWp4ZUU0Ck9jTzhVUlo5RWZaMFQ2KzVONjJa\nalVtaGhQS3JIOWhsVE1MYm4zZjZ0aHMKLS0tIHpqUFV1VDc2bmpuYVp1ZzAyNmFW\nY01lL0RiYzVkWXd0RmlOcFNKc2duVW8KltSO3djgCUNcSZTHH1rWYqVdgVfZayGQ\ndCuL6pBM2wH2qJrPnVJ+JpwIFKiw+8cT8GKWUsnTqzbuvcLPrP0Yjw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIWXZXM29MWVlzQ2dEdi9L\nSkNlTXhUMkpwUC9UdXNwZTFsWjF1M0pZNzN3CkFKcHVyaHRzbVVNK3ZvRXBrTHNQ\naEhLL0puRklJbkgxK1VoaHZkRFF2ZzAKLS0tIFh2NVFJbTBmWnFueFlDWnkyVXBE\nZGdGTkhMQzdUQmpCdGFyRjVXeWZoMU0Km9gc4GdQFFL3+O54TT50YtqkDtFYQggF\nqbVBXNjX8saxODceotz5+Kb2M4nkNl9k94K0dPIdbckLZasTfFHuWw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnb2ZweHF4TUdBVHRrN2hJ\nQm5hSVlhelVYTEN1dWxvdC8zR2s1eXFDZ0hnClh4cFdqeFE4ZzdOVTRXZlJsaGtk\nc1NadHhhNVYrc0xBc3BmNk9Qd3k3T2sKLS0tIFVlcDV6c0UwL2R6Qm93a256UEpJ\nd0MyWC95NmFwdWw1MUlNajhMdzF0TVUKVbkgJowUZhmUWZxlcpxvnpobNRcKZSjj\nL6gIV0pBc0eDlTokgDSdQXfODckZLu4pH8m3ki6SFSfdEUKPQia4ew==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJSDQ5TFRXOTkvZmZLS1JP\nYkh5M2pXNjRoakt1cnd1R1hpZnREUEtJVUNJCldCTEhMaUVDY3pHOU9IUFh5Yml4\nN1VLd2w3Z2dFZFdqNjIxa2pWTFBKLzQKLS0tIFpXMDl3bitkaDJIYWxFaWdibSth\nRDI2SGpxVFdKSmIveFIvLzQrMEVySVEKUOwds3HEfKN1KtmkU1z3Q8c9RUkYH8my\n3+1vjanX2pgYhdEd4X0N6Yfn0JohFQWUbc2k426D0OSQQal3V38zqg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIUDYwTUhkczVtQWIvM0Fq\nYTM2RGtDakd2dW5ZTk9jL2pBMUllVFJ1QkN3CkdqemhWYm1MWmE2YUdxdW9tVG9k\neTAvTHBQZm5rWFd5UjgvWUZPbU11ZjgKLS0tIHg3REMyc3RjMkNxZWkwd3lDc01u\ncHZPMjVhaVU1Y1d3RDVRMFIzRzk4d3MKL/kyWl4hR8iOI1/7RbDw20WKmKHf6xNM\nzc/rs8OVgOcLjjVLFq3XaQ65kI4uQ7NdbKJNv+PpDMg/7T/M5icEJg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhN3BzeFU0d1lOSTVLWWw0\nZ21POE53bXRtVVcxbEZyY1dVMUxrNDdvd1FZClZmdk1MQVhXMDk4Zm8ya01lWURx\nSGRBVEp3RmQ4MldVOFE3OWlnbXkzQmMKLS0tIG82MGg4TjhGV2cvbEJtak1QdkpG\nUnMwM215WWF2UU5aNlhsUHpOcGQ4RkkK5V2ldURjODktz57kq/Sw95HM5xt+qsZb\nkt51MqxZvVfOqBTtBljwv//7HofLj2i7igz8L2NC2xOMJfNLT+SCrw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTSWlXeWp2bmYrV3RTK2RX\namhyVmIxOXlENndPa0FCWUIwS2RoUkVHZG0wCjNva2IrbmhZU2lXanBuWDQ2Y1E4\ndVMxaTV5MmkrWDFjaWJtK3dyL3VmRm8KLS0tIHZ0bG05Nk93ZTlUTCttamcrK3B6\nbWlzendodm03M1VmYmJCVGJsKzJBalkKgVhZ/nmbqVhL+pBVOnM4pCPev6do+GP1\nSSeycSfnrLnxfSNFB7FXcq0VNshzeMo9RD/3qNjRfehXvXgzD5MnDQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2bjdDQXJYRythVTc0bDhD\ncWtWUmpBQXZrSW1PRThKS0VmK3A4V1FPa1JRCnhLVVFRT040bVdyZWVXRi80cS9j\nK2RvRjNWZ0ZieTh0WlA3aGxHZUdYWUkKLS0tIFI4TG84TVJnaXJEcDdYS29SZTRy\ndjYya1BmT0JhWVZQZ01FbTJsNGVvcnMK6yi1gBnKlXgEk/EzJUXMeXmsocDHF0ZM\n+yxXP/8YnBwpvArxO2hSNjjOrbU2NFfug4S1UAlYcBlK3Z7/tRAF9w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIYmt3UWpVZHF0VDV3WCtj\neEpndlZkVjVsS3FiTXBUMWMxc04ramZndFNZCnQ4empHUTBCUEh1SWM2cEkya2Fn\nRk9FYlk1VmFzSURrWUg1djU2elpuNWMKLS0tIDIrOWpmQVZaVG9wc0VSa2Y5ZU5K\nZnNSQ1BGT2VYUVUvNzZZSkNJY2xBSTgKLHMhtBgBYxxoGQ7GfLzc0tR0rvccqCrX\n2Ibez3//z7MeF2ZDhx98m2i+JQ07/l8S8T0Y0nqDeuv8KWbvszCkcg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2023-04-27T21:10:14Z",