moby: patch alsa instead of special-casing PinePhone config

unfortunately, this forces us to recompile *everything* above alsa,
without leveraging the nixos.org cache. several hours, and probably
necessary after any nixpkgs update, so not super practical.

.sops.yaml

@@ -19,7 +19,7 @@ creation_rules:
       - *host_lappy
       - *host_servo
       - *host_moby
-  - path_regex: secrets/servo*
+  - path_regex: secrets/servo.yaml$
     key_groups:
     - age:
       - *user_desko_colin

flake.lock

@@ -39,11 +39,11 @@
     "mobile-nixos": {
       "flake": false,
       "locked": {
-        "lastModified": 1664852186,
+        "lastModified": 1661716773,
-        "narHash": "sha256-t0FhmTf3qRs8ScR8H9Rq7FAxptNELLSpxZG2ALL1HnE=",
+        "narHash": "sha256-uxf0aC+kx8av3/IT8/UecxSMElC9i4UQvH25RHFwna4=",
         "owner": "nixos",
         "repo": "mobile-nixos",
-        "rev": "ca872f1a617674c4045e880aab8a45037e73700b",
+        "rev": "09e388c42298fa777caa7738cd8d8d2b6d1ac8db",
         "type": "github"
       },
       "original": {
@@ -54,11 +54,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1665081174,
+        "lastModified": 1664017330,
-        "narHash": "sha256-6hsmzdhdy8Kbvl5e0xZNE83pW3fKQvNiobJkM6KQrgA=",
+        "narHash": "sha256-919WZKBTxFdTkzIK6uJXE7hwSPQb7e/ekybxxWaotR4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "598f83ebeb2235435189cf84d844b8b73e858e0f",
+        "rev": "fde244a8c7655bc28616864e2290ad9c95409c2c",
         "type": "github"
       },
       "original": {
@@ -69,11 +69,11 @@
     },
     "nixpkgs-22_05": {
       "locked": {
-        "lastModified": 1665279158,
+        "lastModified": 1664063819,
-        "narHash": "sha256-TpbWNzoJ5RaZ302dzvjY2o//WxtOJuYT3CnDj5N69Hs=",
+        "narHash": "sha256-5wXa+9uboo7UizMDeUTMoANv3pm0g9ze1NdTleY3rCE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b3783bcfb8ec54e0de26feccfc6cc36b8e202ed5",
+        "rev": "aee4db5b9eaccd3fb7f16c742685fef9dc355077",
         "type": "github"
       },
       "original": {
@@ -83,28 +83,13 @@
         "type": "github"
       }
     },
-    "nixpkgs-stable": {
-      "locked": {
-        "lastModified": 1665132027,
-        "narHash": "sha256-zoHPqSQSENt96zTk6Mt1AP+dMNqQDshXKQ4I6MfjP80=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "9ecc270f02b09b2f6a76b98488554dd842797357",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-22.05",
-        "type": "indirect"
-      }
-    },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1665197809,
+        "lastModified": 1664028844,
-        "narHash": "sha256-dRUzv/zNYV2EYtnxFG31pPBk0nErT+MBTu6ZJHm1o2A=",
+        "narHash": "sha256-wwGqnvROHW54ma0h4q6GL5toKxTVVKvAypv0CcJkraU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7b06206fa24198912cea58de690aa4943f238fbf",
+        "rev": "72bdd03f0d5696412b25a93218acaad530570d30",
         "type": "github"
       },
       "original": {
@@ -120,7 +105,6 @@
         "impermanence": "impermanence",
         "mobile-nixos": "mobile-nixos",
         "nixpkgs": "nixpkgs",
-        "nixpkgs-stable": "nixpkgs-stable",
         "sops-nix": "sops-nix"
       }
     },
@@ -130,11 +114,11 @@
         "nixpkgs-22_05": "nixpkgs-22_05"
       },
       "locked": {
-        "lastModified": 1665289655,
+        "lastModified": 1664080128,
-        "narHash": "sha256-j1Q9mNBhbzeJykhObiXwEGres9qvP4vH7gxdJ+ihkLI=",
+        "narHash": "sha256-obau1+3+QiTtNGfoTcbSYB5Z4Gvf4o0Or85yLttSYt8=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "0ce0449e6404c4ff9d1b7bd657794ae5ca54deb3",
+        "rev": "17f009daf09992d2342657f9bd7b44d877cd00e1",
         "type": "github"
       },
       "original": {

flake.nix

@@ -4,7 +4,7 @@
 
 {
   inputs = {
-    nixpkgs-stable.url = "nixpkgs/nixos-22.05";
+    # nixpkgs.url = "nixpkgs/nixos-22.05";
     nixpkgs.url = "nixpkgs/nixos-unstable";
     mobile-nixos = {
       url = "github:nixos/mobile-nixos";
@@ -14,12 +14,11 @@
       url = "github:nix-community/home-manager/release-22.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    # TODO: set these up to follow our nixpkgs?
     sops-nix.url = "github:Mic92/sops-nix";
     impermanence.url = "github:nix-community/impermanence";
   };
 
-  outputs = { self, nixpkgs, nixpkgs-stable, mobile-nixos, home-manager, sops-nix, impermanence }:
+  outputs = { self, nixpkgs, mobile-nixos, home-manager, sops-nix, impermanence }:
   let
     patchedPkgs = system: nixpkgs.legacyPackages.${system}.applyPatches {
       name = "nixpkgs-patched-uninsane";
@@ -50,14 +49,11 @@
           nixpkgs.overlays = [
             (import "${mobile-nixos}/overlay/overlay.nix")
             (import ./pkgs/overlay.nix)
-            (next: prev: rec {
+            (next: prev: {
               # non-emulated packages build *from* local *for* target.
               # for large packages like the linux kernel which are expensive to build under emulation,
               # the config can explicitly pull such packages from `pkgs.cross` to do more efficient cross-compilation.
               cross = (nixpkgsFor local target) // (customPackagesFor local target);
-              stable = import nixpkgs-stable { system = target; };
-              # pinned packages:
-              electrum = stable.electrum;
             })
           ];
         }

machines/moby/default.nix

@@ -1,18 +1,13 @@
 { config, pkgs, lib, mobile-nixos, ... }:
 {
   imports = [
+    # (import "${mobile-nixos}/lib/configuration.nix" {
+    #   device = "pine64-pinephone";
+    # })
     ./firmware.nix
     ./fs.nix
     ./kernel.nix
   ];
-
-  # cross-compiled documentation is *slow*.
-  # no obvious way to natively compile docs (2022/09/29).
-  # entrypoint is nixos/modules/misc/documentation.nix
-  # doc building happens in nixos/doc/manual/default.nix
-  # TODO: we could *maybe* inject pkgs.buildPackages.xyz = cross.buildPackages.xyz?
-  documentation.nixos.enable = false;
-
   # XXX colin: phosh doesn't work well with passwordless login
   users.users.colin.initialPassword = "147147";
   services.getty.autologinUser = "root";  # allows for emergency maintenance?
@@ -22,6 +17,26 @@
     ".librewolf"
   ];
 
+  # sane.home-manager.extraPackages = [
+  #   # for web browsers see: https://forum.pine64.org/showthread.php?tid=13669
+  #   pkgs.angelfish  # plasma mobile web browser; broken on phosh (poor wayland support)
+  #   # pkgs.plasma5Packages.index  # file browser
+  #   pkgs.plasma5Packages.konsole  # terminal
+  #   # pkgs.plasma5Packages.pix  # picture viewer
+  #   pkgs.plasma5Packages.kalk  # calculator; broken on phosh
+  #   # pkgs.plasma5Packages.buho  # (plasma mobile?) note application
+  #   pkgs.plasma5Packages.kasts  #  podcast app; works on phosh after setting QT envar
+  #   pkgs.plasma5Packages.koko  # image gallery; broken on phosh
+  #   pkgs.plasma5Packages.kwave  # media player.
+  #   # pkgs.plasma5Packages.neochat  #  matrix client. needs qcoro => no aarch64 support
+  #   # pkgs.plasma5Packages.plasma-dialer  # phone dialer
+  #   # pkgs.plasma5Packages.plasma-mobile  # the whole shebang?
+  #   # pkgs.plasma5Packages.plasma-settings
+  #   pkgs.plasma5Packages.bomber  # arcade game; broken on phosh
+  #   pkgs.plasma5Packages.kapman  # pacman
+  #   pkgs.st  # suckless terminal; broken on phosh
+  #   # pkgs.alacritty  # terminal; crashes phosh
+  # ];
   # sane.home-packages.enableGuiPkgs = false;  # XXX faster builds/imaging for debugging
   sane.home-manager.extraPackages = [
     pkgs.plasma5Packages.konsole  # terminal
@@ -38,15 +53,6 @@
   # mobile.boot.stage-1.enable = false;
   # boot.initrd.systemd.enable = false;
   # boot.initrd.services.swraid.enable = false;  # attempt to fix dm_mod stuff
-  # disable proximity sensor.
-  # the filtering/calibration is bad that it causes the screen to go fully dark at times.
-  boot.blacklistedKernelModules = [ "stk3310" ];
-
-  # without this some GUI apps fail: `DRM_IOCTL_MODE_CREATE_DUMB failed: Cannot allocate memory`
-  # this is because they can't allocate enough video ram.
-  # the default CMA seems to be 32M. we could probably get by with as little as 64M, and safely with 128M.
-  # `cat /proc/meminfo` to see CmaTotal/CmaFree if interested in tuning this.
-  boot.kernelParams = [ "cma=256M" ];
 
   # mobile-nixos' /lib/firmware includes:
   #   rtl_bt          (bluetooth)
@@ -66,16 +72,5 @@
   # enable rotation sensor
   hardware.sensor.iio.enable = true;
 
-  # from https://gitlab.manjaro.org/manjaro-arm/packages/community/phosh/alsa-ucm-pinephone
-  # mobile-nixos does this same thing, with *slightly different settings*.
-  # i trust manjaro more because the guy maintaining that is actively trying to upstream into alsa-ucm-conf.
-  # an alternative may be to build a custom alsa with the PinePhone config patch applied:
-  # - <https://github.com/alsa-project/alsa-ucm-conf/pull/134>
-  # that would make this be not device-specific
-  environment.variables.ALSA_CONFIG_UCM2 = "${./ucm2}";
-  systemd.services.pulseaudio.environment.ALSA_CONFIG_UCM2 = "${./ucm2}";
-
   users.groups.feedbackd.gid = config.sane.allocations.feedbackd-gid;
-
-  hardware.opengl.driSupport = true;
 }

machines/moby/firmware.nix

@@ -4,7 +4,7 @@
   # only actually need 1 MB, but better to over-allocate than under-allocate
   sane.image.extraGPTPadding = 16 * 1024 * 1024;
   sane.image.firstPartGap = 0;
-  system.build.img = pkgs.runCommand "nixos_full-disk-image.img" {} ''
+  system.build.img = pkgs.runCommandNoCC "nixos_full-disk-image.img" {} ''
     cp -v ${config.system.build.img-without-firmware}/nixos.img $out
     chmod +w $out
     dd if=${pkgs.tow-boot-pinephone}/Tow-Boot.noenv.bin of=$out bs=1024 seek=8 conv=notrunc

machines/moby/kernel.nix

@@ -114,7 +114,7 @@ in
   # - phone rotation sensor is off by 90 degrees
   # - ambient light sensor causes screen brightness to be shakey
   # - phosh greeter may not appear after wake from sleep
-  boot.kernelPackages = pkgs.cross.linuxPackagesFor pkgs.cross.linux-megous;
+  boot.kernelPackages = pkgs.linuxPackagesFor pkgs.cross.linux-megous;
 
   boot.kernelPatches = [
     (patchDefconfig (kernelConfig //

machines/moby/ucm2/PinePhone/HiFi.conf

@@ -1,148 +0,0 @@
-SectionVerb {
-	EnableSequence [
-		cset "name='Headphone Playback Switch' off"
-		cset "name='Headphone Source Playback Route' DAC"
-		cset "name='Line In Playback Switch' off"
-		cset "name='Line Out Playback Switch' off"
-		cset "name='Line Out Source Playback Route' Mono Differential"
-		cset "name='Mic1 Playback Switch' off"
-		cset "name='Mic2 Playback Switch' off"
-		cset "name='AIF1 DA0 Playback Volume' 160"
-		cset "name='AIF3 ADC Source Capture Route' None"
-		cset "name='AIF2 DAC Source Playback Route' AIF2"
-		cset "name='DAC Playback Switch' on"
-		cset "name='DAC Playback Volume' 160"
-		cset "name='ADC Digital DAC Playback Switch' off"
-		cset "name='AIF1 Slot 0 Digital DAC Playback Switch' on"
-		cset "name='AIF2 Digital DAC Playback Switch' off"
-		cset "name='DAC Reversed Playback Switch' off"
-		cset "name='Earpiece Playback Switch' off"
-		cset "name='Earpiece Source Playback Route' DACL"
-
-		cset "name='Line In Capture Switch' off"
-		cset "name='Mic1 Capture Switch' off"
-		cset "name='Mic1 Boost Volume' 7"
-		cset "name='Mic2 Capture Switch' off"
-		cset "name='Mic2 Boost Volume' 7"
-		cset "name='Mixer Capture Switch' off"
-		cset "name='Mixer Reversed Capture Switch' off"
-		cset "name='ADC Capture Volume' 160"
-		cset "name='ADC Gain Capture Volume' 7"
-		cset "name='AIF1 AD0 Capture Volume' 160"
-		cset "name='AIF1 Data Digital ADC Capture Switch' on"
-		cset "name='AIF2 ADC Mixer ADC Capture Switch' off"
-		cset "name='AIF2 ADC Mixer AIF1 DA0 Capture Switch' off"
-		cset "name='AIF2 ADC Mixer AIF2 DAC Rev Capture Switch' off"
-		cset "name='AIF2 ADC Mixer AIF1 DA0 Capture Switch' off"
-		cset "name='AIF2 ADC Mixer AIF1 DA0 Capture Switch' off"
-	]
-
-        DisableSequence [
-        ]
-
-	Value {
-	}
-}
-
-SectionDevice."Speaker" {
-	Comment "Internal speaker"
-	EnableSequence [
-		cset "name='AIF1 DA0 Stereo Playback Route' Mix Mono"
-		cset "name='Line Out Playback Switch' on"
-		cset "name='Line Out Playback Volume' 100%"
-	]
-
-	DisableSequence [
-		cset "name='Line Out Playback Switch' off"
-	]
-
-	Value {
-		PlaybackVolume "Line Out Playback Volume"
-		PlaybackSwitch "Line Out Playback Switch"
-		PlaybackChannels 2
-		PlaybackPriority 300
-		PlaybackPCM "hw:${CardId},0"
-	}
-}
-SectionDevice."Earpiece" {
-	Comment "Internal Earpiece"
-	EnableSequence [
-		cset "name='AIF1 DA0 Stereo Playback Route' Mix Mono"
-		cset "name='Earpiece Playback Switch' on"
-		cset "name='Earpiece Playback Volume' 100%"
-	]
-
-	DisableSequence [
-		cset "name='Earpiece Playback Switch' off"
-	]
-
-	Value {
-		PlaybackVolume "Earpiece Playback Volume"
-		PlaybackSwitch "Earpiece Playback Switch"
-		PlaybackChannels 2
-		PlaybackPriority 200
-		PlaybackPCM "hw:${CardId},0"
-	}
-}
-SectionDevice."Mic" {
-	Comment "Internal Microphone"
-	ConflictingDevice [
-		"Headset"
-	]
-	EnableSequence [
-		cset "name='Mic1 Capture Switch' on"
-	]
-	DisableSequence [
-		cset "name='Mic1 Capture Switch' off"
-	]
-	Value {
-		CapturePriority 100
-		CapturePCM "hw:${CardId},0"
-		CaptureChannels 2
-		CaptureMixerElem "ADC"
-		CaptureVolume "ADC Capture Volume"
-		CaptureSwitch "Mic1 Capture Switch"
-	}
-}
-SectionDevice."Headset" {
-	Comment "Headset Microphone"
-	ConflictingDevice [
-		"Mic"
-	]
-	EnableSequence [
-		cset "name='Mic2 Capture Switch' on"
-	]
-	DisableSequence [
-		cset "name='Mic2 Capture Switch' off"
-	]
-	Value {
-		CapturePriority 500
-		CapturePCM "hw:${CardId},0"
-		CaptureChannels 2
-		CaptureMixerElem "ADC"
-		CaptureVolume "ADC Capture Volume"
-		CaptureSwitch "Mic2 Capture Switch"
-		JackControl "Headset Microphone Jack"
-	}
-}
-SectionDevice."Headphones" {
-	Comment "Headphones"
-	EnableSequence [
-		cset "name='AIF1 DA0 Stereo Playback Route' Stereo"
-		cset "name='Headphone Playback Switch' on"
-		cset "name='Headphone Playback Volume' 70%"
-	]
-
-	DisableSequence [
-		cset "name='Headphone Playback Switch' off"
-	]
-
-	Value {
-		PlaybackVolume "Headphone Playback Volume"
-		PlaybackSwitch "Headphone Playback Switch"
-		PlaybackChannels 2
-		PlaybackPriority 500
-		PlaybackPCM "hw:${CardId},0"
-		JackControl "Headphone Jack"
-	}
-}

machines/moby/ucm2/PinePhone/PinePhone.conf

@@ -1,11 +0,0 @@
-Syntax 2
-
-SectionUseCase."HiFi" {
-	File "HiFi.conf"
-	Comment "Default"
-}
-
-SectionUseCase."Voice Call" {
-	File "VoiceCall.conf"
-	Comment "Phone call"
-}

machines/moby/ucm2/PinePhone/VoiceCall.conf

@@ -1,153 +0,0 @@
-SectionVerb {
-	EnableSequence [
-		cset "name='Headphone Playback Switch' off"
-		cset "name='Headphone Source Playback Route' DAC"
-		cset "name='Line In Playback Switch' off"
-		cset "name='Line Out Playback Switch' off"
-		cset "name='Line Out Source Playback Route' Mono Differential"
-		cset "name='Mic1 Playback Switch' off"
-		cset "name='Mic2 Playback Switch' off"
-		cset "name='AIF1 DA0 Playback Volume' 160"
-		cset "name='AIF2 DAC Playback Volume' 160"
-		cset "name='AIF3 ADC Source Capture Route' None"
-		cset "name='AIF2 DAC Source Playback Route' AIF2"
-		cset "name='DAC Playback Switch' on"
-		cset "name='DAC Playback Volume' 160"
-		cset "name='ADC Digital DAC Playback Switch' off"
-		cset "name='AIF1 Slot 0 Digital DAC Playback Switch' on"
-		cset "name='AIF2 Digital DAC Playback Switch' on"
-		cset "name='DAC Reversed Playback Switch' off"
-		cset "name='Earpiece Playback Switch' off"
-		cset "name='Earpiece Source Playback Route' DACL"
-
-		cset "name='Line In Capture Switch' off"
-		cset "name='Mic1 Capture Switch' off"
-		cset "name='Mic1 Boost Volume' 0"
-		cset "name='Mic1 Playback Volume' 7"
-		cset "name='Mic2 Capture Switch' off"
-		cset "name='Mic2 Boost Volume' 0"
-		cset "name='Mic2 Playback Volume' 7"
-		cset "name='Mixer Capture Switch' off"
-		cset "name='Mixer Reversed Capture Switch' off"
-		cset "name='ADC Capture Volume' 160"
-		cset "name='ADC Gain Capture Volume' 7"
-		cset "name='AIF1 AD0 Capture Volume' 160"
-		cset "name='AIF1 Data Digital ADC Capture Switch' on"
-		cset "name='AIF2 ADC Capture Volume' 160"
-		cset "name='AIF2 ADC Mixer ADC Capture Switch' on"
-		cset "name='AIF2 ADC Mixer AIF1 DA0 Capture Switch' off"
-		cset "name='AIF2 ADC Mixer AIF2 DAC Rev Capture Switch' off"
-		cset "name='AIF2 ADC Mixer AIF1 DA0 Capture Switch' off"
-		cset "name='AIF2 ADC Mixer AIF1 DA0 Capture Switch' off"
-	]
-
-        DisableSequence [
-        ]
-
-	Value {
-		PlaybackRate 8000
-	}
-}
-
-SectionDevice."Speaker" {
-	Comment "Internal speaker"
-	EnableSequence [
-		cset "name='AIF1 DA0 Stereo Playback Route' Mix Mono"
-		cset "name='Line Out Playback Switch' on"
-		cset "name='Line Out Playback Volume' 100%"
-	]
-
-	DisableSequence [
-		cset "name='Line Out Playback Switch' off"
-	]
-
-	Value {
-		PlaybackVolume "Line Out Playback Volume"
-		PlaybackSwitch "Line Out Playback Switch"
-		PlaybackChannels 2
-		PlaybackPriority 300
-		PlaybackPCM "hw:${CardId},0"
-	}
-}
-SectionDevice."Earpiece" {
-	Comment "Internal Earpiece"
-	EnableSequence [
-		cset "name='AIF1 DA0 Stereo Playback Route' Mix Mono"
-		cset "name='Earpiece Playback Switch' on"
-		cset "name='Earpiece Playback Volume' 100%"
-	]
-
-	DisableSequence [
-		cset "name='Earpiece Playback Switch' off"
-	]
-
-	Value {
-		PlaybackVolume "Earpiece Playback Volume"
-		PlaybackSwitch "Earpiece Playback Switch"
-		PlaybackChannels 2
-		PlaybackPriority 500
-		PlaybackPCM "hw:${CardId},0"
-	}
-}
-SectionDevice."Mic" {
-	Comment "Internal Microphone"
-	ConflictingDevice [
-		"Headset"
-	]
-	EnableSequence [
-		cset "name='Mic1 Capture Switch' on"
-	]
-	DisableSequence [
-		cset "name='Mic1 Capture Switch' off"
-	]
-	Value {
-		CapturePriority 200
-		CapturePCM "hw:${CardId},0"
-		CaptureMixerElem "ADC"
-		CaptureVolume "ADC Capture Volume"
-		CaptureSwitch "Mic1 Capture Switch"
-		CaptureChannels 2
-	}
-}
-SectionDevice."Headset" {
-	Comment "Headset Microphone"
-	ConflictingDevice [
-		"Mic"
-	]
-	EnableSequence [
-		cset "name='Mic2 Capture Switch' on"
-	]
-	DisableSequence [
-		cset "name='Mic2 Capture Switch' off"
-	]
-	Value {
-		CapturePriority 500
-		CapturePCM "hw:${CardId},0"
-		CaptureChannels 2
-		CaptureMixerElem "ADC"
-		CaptureVolume "ADC Capture Volume"
-		CaptureSwitch "Mic2 Capture Switch"
-		JackControl "Headset Microphone Jack"
-	}
-}
-SectionDevice."Headphones" {
-	Comment "Headphones"
-	EnableSequence [
-		cset "name='AIF1 DA0 Stereo Playback Route' Stereo"
-		cset "name='Headphone Playback Switch' on"
-		cset "name='Headphone Playback Volume' 100%"
-	]
-
-	DisableSequence [
-		cset "name='Headphone Playback Switch' off"
-	]
-
-	Value {
-		PlaybackVolume "Headphone Playback Volume"
-		PlaybackSwitch "Headphone Playback Switch"
-		PlaybackChannels 2
-		PlaybackPriority 500
-		PlaybackPCM "hw:${CardId},0"
-		JackControl "Headphone Jack"
-	}
-}

machines/moby/ucm2/ucm.conf

@@ -1,8 +0,0 @@
-Syntax 3
-
-UseCasePath {
-	legacy {
-		Directory "PinePhone"
-		File "PinePhone.conf"
-	}
-}

machines/servo/default.nix

@@ -6,7 +6,18 @@
     ./hardware.nix
     ./net.nix
     ./users.nix
-    ./services
+    ./services/ddns-he.nix
+    ./services/gitea.nix
+    ./services/ipfs.nix
+    ./services/jackett.nix
+    ./services/jellyfin.nix
+    ./services/matrix
+    ./services/navidrome.nix
+    ./services/nginx.nix
+    ./services/pleroma.nix
+    ./services/postfix.nix
+    ./services/postgres.nix
+    ./services/transmission.nix
   ];
 
   sane.home-manager.enable = true;

machines/servo/services/default.nix

@@ -1,17 +0,0 @@
-{ ... }:
-{
-  imports = [
-    ./ddns-he.nix
-    ./gitea.nix
-    ./ipfs.nix
-    ./jackett.nix
-    ./jellyfin.nix
-    ./matrix
-    ./navidrome.nix
-    ./nginx.nix
-    ./pleroma.nix
-    ./postfix.nix
-    ./postgres.nix
-    ./transmission.nix
-  ];
-}

machines/servo/services/ipfs.nix

@@ -12,15 +12,15 @@
     # TODO: mode? could be more granular
     { user = "261"; group = "261"; directory = "/var/lib/ipfs"; }
   ];
-  # services.ipfs.enable = true;
+  services.ipfs.enable = true;
-  services.kubo.localDiscovery = true;
+  services.ipfs.localDiscovery = true;
-  services.kubo.swarmAddress = [
+  services.ipfs.swarmAddress = [
     # "/dns4/ipfs.uninsane.org/tcp/4001"
     # "/ip4/0.0.0.0/tcp/4001"
     "/dns4/ipfs.uninsane.org/udp/4001/quic"
     "/ip4/0.0.0.0/udp/4001/quic"
   ];
-  services.kubo.extraConfig = {
+  services.ipfs.extraConfig = {
     Addresses = {
       Announce = [
         # "/dns4/ipfs.uninsane.org/tcp/4001"

machines/servo/services/matrix/default.nix

@@ -1,16 +1,13 @@
 # docs: https://nixos.wiki/wiki/Matrix
 # docs: https://nixos.org/manual/nixos/stable/index.html#module-services-matrix-synapse
-{ config, lib, ... }:
+{ config, ... }:
 
 {
-  imports = [
-    # ./discord-appservice.nix
-    ./discord-puppet.nix
-    # ./irc.nix
-  ];
-
   sane.impermanence.service-dirs = [
-    { user = "matrix-synapse"; group = "matrix-synapse"; directory = "/var/lib/matrix-synapse"; }
+    # TODO: mode?
+    # user and group are both "matrix-appservice-irc"
+    { user = "993"; group = "992"; directory = "/var/lib/matrix-appservice-irc"; }
+    { user = "224"; group = "224"; directory = "/var/lib/matrix-synapse"; }
   ];
   services.matrix-synapse.enable = true;
   services.matrix-synapse.settings.log_config = ./synapse-log_level.yaml;
@@ -65,6 +62,9 @@
   #     subjects:
   #       email_validation: "[%(server_name)s] Validate your email"
   # ''];
+  services.matrix-synapse.settings.app_service_config_files = [
+    "/var/lib/matrix-appservice-irc/registration.yml"  # auto-created by irc appservice
+  ];
 
   # new users may be registered on the CLI:
   #   register_new_matrix_user -c /nix/store/8n6kcka37jhmi4qpd2r03aj71pkyh21s-homeserver.yaml http://localhost:8008
@@ -78,6 +78,90 @@
   # create a token with limited uses:
   #   curl -d '{ "uses_allowed": 1 }' --header "Authorization: Bearer <my_token>" localhost:8008/_synapse/admin/v1/registration_tokens/new
 
+  # IRC bridging
+  # note: Rizon allows only FOUR simultaneous IRC connections per IP: https://wiki.rizon.net/index.php?title=Connection/Session_Limit_Exemptions
+  # Rizon supports CertFP for auth: https://wiki.rizon.net/index.php?title=CertFP
+  # services.matrix-appservice-irc.enable = true;
+  services.matrix-appservice-irc.registrationUrl = "http://127.0.0.1:8009";
+  # settings documented here: https://github.com/matrix-org/matrix-appservice-irc/blob/develop/config.sample.yaml
+  services.matrix-appservice-irc.settings = {
+    homeserver = {
+      url = "http://127.0.0.1:8008";
+      dropMatrixMessagesAfterSecs = 300;
+      domain = "uninsane.org";
+      enablePresence = true;
+      bindPort = 9999;
+      bindHost = "127.0.0.1";
+    };
+
+    ircService = {
+      servers = {
+        "irc.rizon.net" = {
+          name = "Rizon";
+          port = 6697;  # SSL port
+          ssl = true;
+          sasl = true;  # appservice doesn't support NickServ identification
+          botConfig = {
+            # bot has no presence in IRC channel; only real Matrix users
+            enabled = false;
+            # nick = "UninsaneDotOrg";
+            nick = "uninsane";
+            username = "uninsane";
+          };
+          dynamicChannels = {
+            enabled = true;
+            aliasTemplate = "#irc_rizon_$CHANNEL";
+          };
+          ircClients = {
+            nickTemplate = "$LOCALPARTsane";
+            # by default, Matrix will convert messages greater than (3) lines into a pastebin-like URL to send to IRC.
+            lineLimit = 20;
+          };
+          matrixClients = {
+            userTemplate = "@irc_rizon_$NICK";  # the :uninsane.org part is appended automatically
+          };
+
+          # this will let this user message the appservice with `!join #<IRCChannel>` and the rest "Just Works"
+          "@colin:uninsane.org" = "admin";
+
+          membershipLists = {
+            enabled = true;
+            global = {
+              ircToMatrix = {
+                initial = true;
+                incremental = true;
+                requireMatrixJoined = false;
+              };
+              matrixToIrc = {
+                initial = true;
+                incremental = true;
+              };
+            };
+          };
+          # sync room description?
+          bridgeInfoState = {
+            enabled = true;
+            initial = true;
+          };
+
+          # hardcoded mappings, for when dynamicChannels fails us. TODO: probably safe to remove these.
+          # mappings = {
+          #   "#chat" = {
+          #     roomIds = [ "!GXJSOTdbtxRboGtDep:uninsane.org" ];
+          #   };
+          #   # BakaBT requires account registration, which i think means my user needs to be added before the appservice user
+          #   "#BakaBT" = {
+          #     roomIds = [ "!feZKttuYuHilqPFSkD:uninsane.org" ];
+          #   };
+          # };
+          # for per-user IRC password:
+          #   invite @irc_rizon_NickServ:uninsane.org to a DM and type `help`  => register
+          #   invite the matrix-appservice-irc user to a DM and type `!help`   => add PW to database
+          # passwordEncryptionKeyPath = "/path/to/privkey";  # appservice will generate its own if unspecified
+        };
+      };
+    };
+  };
 
   sops.secrets.matrix_synapse_secrets = {
     sopsFile = ../../../../secrets/servo.yaml;

machines/servo/services/matrix/discord-appservice.nix

@@ -1,69 +0,0 @@
-{ config, lib, ... }:
-
-{
-  sane.impermanence.service-dirs = [
-    { user = "matrix-appservice-discord"; group = "matrix-appservice-discord"; directory = "/var/lib/matrix-appservice-discord"; }
-  ];
-
-  sops.secrets.matrix_appservice_discord_env = {
-    sopsFile = ../../../../secrets/servo/matrix_appservice_discord_env.bin;
-    owner = config.users.users.matrix-appservice-discord.name;
-    format = "binary";
-  };
-
-  services.matrix-synapse.settings.app_service_config_files = [
-    # auto-created by discord appservice
-    "/var/lib/matrix-appservice-discord/discord-registration.yaml"
-  ];
-
-  # Discord bridging
-  # docs: https://github.com/matrix-org/matrix-appservice-discord
-  services.matrix-appservice-discord.enable = true;
-  services.matrix-appservice-discord.settings = {
-    bridge = {
-      homeserverUrl = "http://127.0.0.1:8008";
-      domain = "uninsane.org";
-      adminMxid = "admin.matrix@uninsane.org";
-      # self-service bridging is when a Matrix user bridges by DMing @_discord_bot:<HS>
-      # i don't know what the alternative is :?
-      enableSelfServiceBridging = true;
-      presenceInterval = 30000; # milliseconds
-      # allows matrix users to search for Discord channels (somehow?)
-      disablePortalBridging = false;
-      # disableReadReceipts = true;
-      # these are Matrix -> Discord
-      disableJoinLeaveNotifications = true;
-      disableInviteNotifications = true;
-      disableRoomTopicNotifications = true;
-    };
-    # these are marked as required in the yaml schema
-    auth = {
-      # apparently not needed if you provide them as env vars (below).
-      # clientId = "FILLME";
-      # botToken = "FILLME";
-      usePrivilegedIntents = false;
-    };
-    logging = {
-      # silly, verbose, info, http, warn, error, silent
-      console = "verbose";
-    };
-  };
-  # contains what's ordinarily put into auth.clientId, auth.botToken
-  # i.e. `APPSERVICE_DISCORD_AUTH_CLIENT_I_D=...` and `APPSERVICE_DISCORD_AUTH_BOT_TOKEN=...`
-  services.matrix-appservice-discord.environmentFile = config.sops.secrets.matrix_appservice_discord_env.path;
-
-  systemd.services.matrix-appservice-discord.serviceConfig = {
-    # fix up to not use /var/lib/private, but just /var/lib
-    DynamicUser = lib.mkForce false;
-    User = "matrix-appservice-discord";
-    Group = "matrix-appservice-discord";
-  };
-  users.groups.matrix-appservice-discord = {};
-  users.users.matrix-appservice-discord = {
-    description = "User for the Matrix-Discord bridge";
-    group = "matrix-appservice-discord";
-    isSystemUser = true;
-  };
-  users.users.matrix-appservice-discord.uid = 2134;  # TODO: move to allocations
-  users.groups.matrix-appservice-discord.gid = 2134;  # TODO
-}

machines/servo/services/matrix/discord-puppet.nix

@@ -1,52 +0,0 @@
-{ lib, ... }:
-{
-  sane.impermanence.service-dirs = [
-    { user = "matrix-synapse"; group = "matrix-synapse"; directory = "/var/lib/mx-puppet-discord"; }
-  ];
-
-  services.matrix-synapse.settings.app_service_config_files = [
-    # auto-created by mx-puppet-discord service
-    "/var/lib/mx-puppet-discord/discord-registration.yaml"
-  ];
-
-  services.mx-puppet-discord.enable = true;
-  # schema/example: <https://gitlab.com/mx-puppet/discord/mx-puppet-discord/-/blob/main/sample.config.yaml>
-  services.mx-puppet-discord.settings = {
-    bridge = {
-      # port = 8434
-      bindAddress = "127.0.0.1";
-      domain = "uninsane.org";
-      homeserverUrl = "http://127.0.0.1:8008";
-      # displayName = "mx-discord-puppet";  # matrix name for the bot
-      # matrix "groups" were an earlier version of spaces.
-      # maybe the puppet understands this, maybe not?
-      enableGroupSync = false;
-    };
-    presence = {
-      enabled = false;
-      interval = 30000;
-    };
-    provisioning = {
-      # allow these users to control the puppet
-      whitelist = [ "@colin:uninsane\\.org" ];
-    };
-    relay = {
-      whitelist = [ "@colin:uninsane\\.org" ];
-    };
-    selfService = {
-      # who's allowed to use plumbed rooms (idk what that means)
-      whitelist = [ "@colin:uninsane\\.org" ];
-    };
-    logging = {
-      # silly, debug, verbose, info, warn, error
-      console = "debug";
-    };
-  };
-
-  systemd.services.mx-puppet-discord.serviceConfig = {
-    # fix up to not use /var/lib/private, but just /var/lib
-    DynamicUser = lib.mkForce false;
-    User = "matrix-synapse";
-    Group = "matrix-synapse";
-  };
-}

machines/servo/services/matrix/irc.nix

@@ -1,97 +0,0 @@
-{ config, lib, ... }:
-
-{
-  sane.impermanence.service-dirs = [
-    # TODO: mode?
-    # user and group are both "matrix-appservice-irc"
-    { user = "993"; group = "992"; directory = "/var/lib/matrix-appservice-irc"; }
-  ];
-
-  services.matrix-synapse.settings.app_service_config_files = [
-    "/var/lib/matrix-appservice-irc/registration.yml"  # auto-created by irc appservice
-  ];
-
-  # note: Rizon allows only FOUR simultaneous IRC connections per IP: https://wiki.rizon.net/index.php?title=Connection/Session_Limit_Exemptions
-  # Rizon supports CertFP for auth: https://wiki.rizon.net/index.php?title=CertFP
-  services.matrix-appservice-irc.enable = true;
-  services.matrix-appservice-irc.registrationUrl = "http://127.0.0.1:8009";
-  # settings documented here: https://github.com/matrix-org/matrix-appservice-irc/blob/develop/config.sample.yaml
-  services.matrix-appservice-irc.settings = {
-    homeserver = {
-      url = "http://127.0.0.1:8008";
-      dropMatrixMessagesAfterSecs = 300;
-      domain = "uninsane.org";
-      enablePresence = true;
-      bindPort = 9999;
-      bindHost = "127.0.0.1";
-    };
-
-    ircService = {
-      servers = {
-        "irc.rizon.net" = {
-          name = "Rizon";
-          port = 6697;  # SSL port
-          ssl = true;
-          sasl = true;  # appservice doesn't support NickServ identification
-          botConfig = {
-            # bot has no presence in IRC channel; only real Matrix users
-            enabled = false;
-            # nick = "UninsaneDotOrg";
-            nick = "uninsane";
-            username = "uninsane";
-          };
-          dynamicChannels = {
-            enabled = true;
-            aliasTemplate = "#irc_rizon_$CHANNEL";
-          };
-          ircClients = {
-            nickTemplate = "$LOCALPARTsane";
-            # by default, Matrix will convert messages greater than (3) lines into a pastebin-like URL to send to IRC.
-            lineLimit = 20;
-          };
-          matrixClients = {
-            userTemplate = "@irc_rizon_$NICK";  # the :uninsane.org part is appended automatically
-          };
-
-          # this will let this user message the appservice with `!join #<IRCChannel>` and the rest "Just Works"
-          "@colin:uninsane.org" = "admin";
-
-          membershipLists = {
-            enabled = true;
-            global = {
-              ircToMatrix = {
-                initial = true;
-                incremental = true;
-                requireMatrixJoined = false;
-              };
-              matrixToIrc = {
-                initial = true;
-                incremental = true;
-              };
-            };
-          };
-          # sync room description?
-          bridgeInfoState = {
-            enabled = true;
-            initial = true;
-          };
-
-          # hardcoded mappings, for when dynamicChannels fails us. TODO: probably safe to remove these.
-          # mappings = {
-          #   "#chat" = {
-          #     roomIds = [ "!GXJSOTdbtxRboGtDep:uninsane.org" ];
-          #   };
-          #   # BakaBT requires account registration, which i think means my user needs to be added before the appservice user
-          #   "#BakaBT" = {
-          #     roomIds = [ "!feZKttuYuHilqPFSkD:uninsane.org" ];
-          #   };
-          # };
-          # for per-user IRC password:
-          #   invite @irc_rizon_NickServ:uninsane.org to a DM and type `help`  => register
-          #   invite the matrix-appservice-irc user to a DM and type `!help`   => add PW to database
-          # passwordEncryptionKeyPath = "/path/to/privkey";  # appservice will generate its own if unspecified
-        };
-      };
-    };
-  };
-}

modules/gui/phosh.nix

@@ -60,8 +60,6 @@ in
     };
 
     sane.home-manager.extraPackages = with pkgs; [
-      phosh-mobile-settings
-
       # TODO: see about removing this if the in-built gnome-settings bluetooth manager can work
       gnome.gnome-bluetooth
     ];

modules/gui/sway.nix

@@ -33,9 +33,6 @@ in
       };
     };
 
-    # some programs (e.g. fractal) **require** a "Secret Service Provider"
-    services.gnome.gnome-keyring.enable = true;
-
     # unlike other DEs, sway configures no audio stack
     # administer with pw-cli, pw-mon, pw-top commands
     services.pipewire = {

modules/impermanence.nix

@@ -14,10 +14,6 @@ in
       default = false;
       type = types.bool;
     };
-    sane.impermanence.home-files = mkOption {
-      default = [];
-      type = types.listOf types.str;
-    };
     sane.impermanence.home-dirs = mkOption {
       default = [];
       type = types.listOf (types.either types.str (types.attrsOf types.str));
@@ -39,15 +35,6 @@ in
     map-home-dirs = map-dirs { user = "colin"; group = "users"; mode = "0755"; directory = "/home/colin/"; };
     map-sys-dirs = map-dirs { user = "root"; group = "root"; mode = "0755"; directory = ""; };
     map-service-dirs = map-dirs { user = "root"; group = "root"; mode = "0755"; directory = ""; };
-
-    map-home-files = files: builtins.map (f: {
-      parentDirectory = {
-        user = "colin";
-        group = "users";
-        mode = "0755";
-      };
-      file = "/home/colin/${f}";
-    }) files;
   in mkIf cfg.enable {
     sane.image.extraDirectories = [ "/nix/persist/var/log" ];
     environment.persistence."/nix/persist" = {
@@ -58,7 +45,6 @@ in
         ".cargo"
         ".rustup"
         ".ssh"
-        ".local/share/keyrings"
         # intentionally omitted:
         # ".config"  # managed by home-manager
         # ".local"   # nothing useful in here
@@ -108,19 +94,12 @@ in
         # "/etc/group"
         # "/etc/passwd"
         # "/etc/shadow"
-      ] ++ map-home-files cfg.home-files;
+      ];
     };
 
     systemd.services.sane-sops = {
-      # TODO: it would be better if we could inject the right dependency into setupSecrets instead of patching like this.
-      # /run/current-system/activate contains the precise ordering logic.
-      # it's largely unaware of systemd.
-      # maybe we could insert some activation script which simply waits for /etc/ssh to appear?
       description = "sops relies on /etc/ssh being available, so re-run its activation AFTER fs-local";
-      script = ''
+      script = config.system.activationScripts.setupSecrets.text;
-      ${config.system.activationScripts.setupSecrets.text}
-      ${config.system.activationScripts.linkIwdKeys.text}
-      '';
       after = [ "fs-local.target" ];
       wantedBy = [ "multi-user.target" ];
     };

modules/universal/allocations.nix

@@ -33,8 +33,6 @@ in
     sane.allocations.systemd-coredump-gid = mkId 2003;  # 996
     sane.allocations.nscd-uid = mkId 2004;
     sane.allocations.nscd-gid = mkId 2004;
-    sane.allocations.systemd-oom-uid = mkId 2005;
-    sane.allocations.systemd-oom-gid = mkId 2005;
 
     # found on graphical machines
     sane.allocations.nm-iodine-uid = mkId 2101;  # desko/moby/lappy

modules/universal/env/default.nix

@@ -13,12 +13,10 @@
     EDITOR = "vim";
     # git claims it should use EDITOR, but it doesn't!
     GIT_EDITOR = "vim";
-    # TODO: these should be moved to `home.sessionVariables` (home-manager)
     # Electron apps should use native wayland backend:
     #   https://nixos.wiki/wiki/Slack#Wayland
     # Discord under sway crashes with this.
     # NIXOS_OZONE_WL = "1";
-    # LIBGL_ALWAYS_SOFTWARE = "1";
   };
 }
 

modules/universal/env/feeds.nix

@@ -18,12 +18,6 @@ with lib;
         "https://anchor.fm/s/34c7232c/podcast/rss"
         "https://feeds.feedburner.com/80000HoursPodcast"
         "https://allinchamathjason.libsyn.com/rss"
-        "https://acquired.libsyn.com/rss"
-        "https://rss.acast.com/deconstructed"
-        ## The Daily
-        "https://feeds.simplecast.com/54nAGcIl"
-        "https://rss.acast.com/intercepted-with-jeremy-scahill"
-        "https://podcast.posttv.com/itunes/post-reports.xml"
         ## Eric Weinstein
         "https://rss.art19.com/the-portal"
         "https://feeds.megaphone.fm/darknetdiaries"

modules/universal/env/home-manager.nix

@@ -14,9 +14,6 @@ let
   pkglist = pkgspec: builtins.map (e: e.pkg or e) pkgspec;
   # extract `dir` from `extraPackages`
   dirlist = pkgspec: builtins.concatLists (builtins.map (e: if e ? "dir" then [ e.dir ] else []) pkgspec);
-  # extract `persist-files` from `extraPackages`
-  persistfileslist = pkgspec: builtins.concatLists (builtins.map (e: if e ? "persist-files" then e.persist-files else []) pkgspec);
-  # TODO: dirlist and persistfileslist should be folded
 in
 {
   options = {
@@ -70,7 +67,6 @@ in
       "Videos"
       vim-swap-dir
     ] ++ (dirlist cfg.extraPackages);
-    sane.impermanence.home-files = persistfileslist cfg.extraPackages;
 
     home-manager.useGlobalPkgs = true;
     home-manager.useUserPackages = true;
@@ -79,10 +75,6 @@ in
     # see: https://github.com/nix-community/home-manager/issues/589#issuecomment-950474105
     home-manager.users.colin = let sysconfig = config; in { config, ... }: {
 
-      # run `home-manager-help` to access manpages
-      # or `man home-configuration.nix`
-      manual.html.enable = true;
-
       home.packages = pkglist cfg.extraPackages;
       wayland.windowManager = cfg.windowManager;
 
@@ -90,14 +82,6 @@ in
       home.username = "colin";
       home.homeDirectory = "/home/colin";
 
-      home.activation = {
-        initKeyring = {
-          after = ["writeBoundary"];
-          before = [];
-          data = "${../../../scripts/init-keyring}";
-        };
-      };
-
       # XDG defines things like ~/Desktop, ~/Downloads, etc.
       # these clutter the home, so i mostly don't use them.
       xdg.userDirs = {
@@ -112,40 +96,19 @@ in
         templates = "$HOME/.xdg/Templates";
         videos = "$HOME/Videos";
       };
-
-      # the xdg mime type for a file can be found with:
-      # - `xdg-mime query filetype path/to/thing.ext`
       xdg.mimeApps.enable = true;
       xdg.mimeApps.defaultApplications = {
-        # HTML
         "text/html" = [ "librewolf.desktop" ];
         "x-scheme-handler/http" = [ "librewolf.desktop" ];
         "x-scheme-handler/https" = [ "librewolf.desktop" ];
         "x-scheme-handler/about" = [ "librewolf.desktop" ];
         "x-scheme-handler/unknown" = [ "librewolf.desktop" ];
-        # RICH-TEXT DOCUMENTS
-        "application/pdf" = [ "org.gnome.Evince.desktop" ];
-        "text/markdown" = [ "obsidian.desktop" ];
-        # IMAGES
-        "image/heif" = [ "org.gnome.gThumb.desktop" ];  # apple codec
         "image/png" = [ "org.gnome.gThumb.desktop" ];
-        "image/jpeg" = [ "org.gnome.gThumb.desktop" ];
-        # VIDEO
-        "video/mp4" = [ "vlc.desktop" ];
-        "video/quicktime" = [ "vlc.desktop" ];
-        "video/x-matroska" = [ "vlc.desktop" ];
-        # AUDIO
-        "audio/flag" = [ "vlc.desktop" ];
-        "audio/mpeg" = [ "vlc.desktop" ];
-        "audio/x-vorbis+ogg" = [ "vlc.desktop" ];
       };
 
       # convenience
       home.file."knowledge".source = config.lib.file.mkOutOfStoreSymlink "/home/colin/dev/knowledge";
       home.file."nixos".source = config.lib.file.mkOutOfStoreSymlink "/home/colin/dev/nixos";
-      home.file."Videos/servo".source = config.lib.file.mkOutOfStoreSymlink "/mnt/servo-media/Videos";
-      home.file."Videos/servo-incomplete".source = config.lib.file.mkOutOfStoreSymlink "/mnt/servo-media/incomplete";
-      home.file."Music/servo".source = config.lib.file.mkOutOfStoreSymlink "/mnt/servo-media/Music";
 
       # nb markdown/personal knowledge manager
       home.file.".nb/knowledge".source = config.lib.file.mkOutOfStoreSymlink "/home/colin/dev/knowledge";
@@ -173,12 +136,6 @@ in
          }
         }
       '';
-      home.file.".librewolf/librewolf.overrides.cfg".text = ''
-        // if we can't query the revocation status of a SSL cert because the issuer is offline,
-        // treat it as unrevoked.
-        // see: <https://librewolf.net/docs/faq/#im-getting-sec_error_ocsp_server_error-what-can-i-do>
-        defaultPref("security.OCSP.require", false);
-      '';
 
       # aerc TUI mail client
       xdg.configFile."aerc/accounts.conf".source =
@@ -262,7 +219,6 @@ in
           "https://www.lynalden.com/feed" = { tags = [ "infrequent" "pol" ]; };
           "https://austinvernon.site/rss.xml" = { tags = [ "infrequent" "tech" ]; };
           "https://oversharing.substack.com/feed" = { tags = [ "daily" "pol" ]; };
-          "https://doomberg.substack.com/feed" = { tags = [ "weekly" "tech" ]; };
           ## David Rosenthal
           "https://blog.dshr.org/rss.xml" = { tags = [ "weekly" "pol" ]; };
           ## Matt Levine
@@ -296,9 +252,6 @@ in
 
           # ART
           "https://miniature-calendar.com/feed" = { tags = [ "daily" "visual" ]; };
-
-          # CODE
-          "https://github.com/Kaiteki-Fedi/Kaiteki/commits/master.atom" = { tags = [ "infrequent" "tech" ]; };
         };
         dark_reader = false;
         new_first = true;
@@ -347,11 +300,6 @@ in
             # run p10k configure to configure, but it can't write out its file :-(
             POWERLEVEL9K_DISABLE_CONFIGURATION_WIZARD=true
           '';
-          initExtra = ''
-            # zmv is a way to do rich moves/renames, with pattern matching/substitution.
-            # see for an example: <https://filipe.kiss.ink/zmv-zsh-rename/>
-            autoload -Uz zmv
-          '';
 
           # prezto = oh-my-zsh fork; controls prompt, auto-completion, etc.
           # see: https://github.com/sorin-ionescu/prezto
@@ -523,10 +471,6 @@ in
             })
           ];
           extraConfig = ''
-            " let the terminal handle mouse events, that way i get OS-level ctrl+shift+c/etc
-            " this used to be default, until <https://github.com/neovim/neovim/pull/19290>
-            set mouse=
-
             " copy/paste to system clipboard
             set clipboard=unnamedplus
 

modules/universal/env/home-packages.nix

@@ -11,7 +11,6 @@ let
     ifuse
     ipfs
     libimobiledevice
-    libsecret  # for managing user keyrings
     lm_sensors  # for sensors-detect
     lshw
     ffmpeg
@@ -25,17 +24,14 @@ let
     # ponymix
     pulsemixer
     python3
-    # python3Packages.eyeD3  # music tagging
     rmlint
     sane-scripts
     sequoia
     snapper
     sops
     speedtest-cli
-    sqlite  # to debug sqlite3 databases
     ssh-to-age
     sudo
-    # tageditor  # music tagging
     unar
     visidata
     w3m
@@ -57,17 +53,9 @@ let
 
     emote  # TODO: package [smile](https://github.com/mijorus/smile) for probably a better mobile experience.
     evince  # works on phosh
-
+    { pkg = fluffychat-moby; dir = ".local/share/chat.fluffy.fluffychat"; }  # TODO: ship normal fluffychat on non-moby?
-    # { pkg = fluffychat-moby; dir = ".local/share/chat.fluffy.fluffychat"; }  # TODO: ship normal fluffychat on non-moby?
-
     foliate
     font-manager
-
-    # XXX by default fractal stores its state in ~/.local/share/<UUID>.
-    # after logging in, manually change ~/.local/share/keyrings/... to point it to some predictable subdir.
-    # then reboot (so that libsecret daemon re-loads the keyring...?)
-    { pkg = fractal-next; dir = ".local/share/fractal"; }
-
     gimp  # broken on phosh
     gnome.cheese
     gnome.dconf-editor
@@ -79,17 +67,9 @@ let
     gnome-podcasts
     gnome.gnome-system-monitor
     gnome.gnome-terminal  # works on phosh
-    gnome.gnome-weather
+    gpodder-configured
-
-    { pkg = gpodder-configured; dir = "gPodder/Downloads"; }
-
     gthumb
     inkscape
-
-    kaiteki  # Pleroma client
-    gnome.zenity # for kaiteki (it will use qarma, kdialog, or zenity)
-
-    kid3  # audio tagging
     krita
     libreoffice-fresh  # XXX colin: maybe don't want this on mobile
     lollypop
@@ -100,7 +80,6 @@ let
     { pkg = obsidian; dir = ".config/obsidian"; }
 
     pavucontrol
-    picard  # music tagging
     playerctl
     soundconverter
     # sublime music persists any downloaded albums here.
@@ -109,10 +88,7 @@ let
     #   possible to pass config as a CLI arg (sublime-music -c config.json)
     { pkg = sublime-music; dir = ".local/share/sublime-music"; }
     tdesktop  # broken on phosh
-
+    vlc  # works on phosh
-    # vlc remembers play position in ~/.config/vlc/vlc-qt-interface.conf
-    { pkg = vlc; persist-files = [ ".config/vlc/vlc-qt-interface.conf" ]; }
-
     whalebird # pleroma client. input is broken on phosh
     xdg-utils  # for xdg-open
     xterm  # broken on phosh
@@ -128,6 +104,9 @@ let
       nss = pkgs.nss_latest;
     }); in { pkg = discord; dir = ".config/discord"; })
 
+    # kaiteki  # Pleroma client
+    # gnome.zenity # for kaiteki (it will use qarma, kdialog, or zenity)
+
     logseq
     losslesscut-bin
     makemkv

modules/universal/fs.nix

@@ -28,37 +28,31 @@ in
     device = "colin@uninsane.org:/var/lib/uninsane/media";
     inherit (sshOpts) fsType;
     options = sshOpts.optionsColin;
-    noCheck = true;
   };
   fileSystems."/mnt/servo-media-lan" = {
     device = "colin@servo:/var/lib/uninsane/media";
     inherit (sshOpts) fsType;
     options = sshOpts.optionsColin;
-    noCheck = true;
   };
   fileSystems."/mnt/servo-root-wan" = {
     device = "colin@uninsane.org:/";
     inherit (sshOpts) fsType;
     options = sshOpts.optionsRoot;
-    noCheck = true;
   };
   fileSystems."/mnt/servo-root-lan" = {
     device = "colin@servo:/";
     inherit (sshOpts) fsType;
     options = sshOpts.optionsRoot;
-    noCheck = true;
   };
   fileSystems."/mnt/desko-home" = {
     device = "colin@desko:/home/colin";
     inherit (sshOpts) fsType;
     options = sshOpts.optionsColin;
-    noCheck = true;
   };
   fileSystems."/mnt/desko-root" = {
     device = "colin@desko:/";
     inherit (sshOpts) fsType;
     options = sshOpts.optionsRoot;
-    noCheck = true;
   };
 
   environment.systemPackages = [

modules/universal/net.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, ... }:
 
 {
   # if using router's DNS, these mappings will already exist.
@@ -11,59 +11,37 @@
     "192.168.0.48" = [ "moby" ];
   };
 
-  # the default backend is "wpa_supplicant".
+  sops.secrets."nm-community-university" = {
-  # wpa_supplicant reliably picks weak APs to connect to.
+    sopsFile = ../../secrets/universal/net/community-university.nmconnection.bin;
-  # see: <https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/474>
+    format = "binary";
-  # iwd is an alternative that shouldn't have this problem
+  };
-  # docs:
+  sops.secrets."nm-friend-libertarian-dod" = {
-  # - <https://nixos.wiki/wiki/Iwd>
+    sopsFile = ../../secrets/universal/net/friend-libertarian-dod.nmconnection.bin;
-  # - <https://iwd.wiki.kernel.org/networkmanager>
+    format = "binary";
-  # use `iwctl` to control
+  };
-  networking.wireless.iwd.enable = true;
+  sops.secrets."nm-friend-rationalist-empathist" = {
-  networking.networkmanager.wifi.backend = "iwd";
+    sopsFile = ../../secrets/universal/net/friend-rationalist-empathist.nmconnection.bin;
+    format = "binary";
+  };
+  sops.secrets."nm-home-bedroom" = {
+    sopsFile = ../../secrets/universal/net/home-bedroom.nmconnection.bin;
+    format = "binary";
+  };
+  sops.secrets."nm-home-shared-24G" = {
+    sopsFile = ../../secrets/universal/net/home-shared-24G.nmconnection.bin;
+    format = "binary";
+  };
+  sops.secrets."nm-home-shared" = {
+    sopsFile = ../../secrets/universal/net/home-shared.nmconnection.bin;
+    format = "binary";
+  };
 
-  system.activationScripts.linkIwdKeys = let
+  environment.etc = {
-    unwrapped = ../../scripts/install-iwd;
+    "NetworkManager/system-connections/nm-community-university".source = config.sops.secrets.nm-community-university.path;
-    install-iwd = pkgs.writeShellApplication {
+    "NetworkManager/system-connections/nm-friend-libertarian-dod".source = config.sops.secrets.nm-friend-libertarian-dod.path;
-      name = "install-iwd";
+    "NetworkManager/system-connections/nm-friend-rationalist-empathist".source = config.sops.secrets.nm-friend-rationalist-empathist.path;
-      runtimeInputs = with pkgs; [ coreutils gnused ];
+    "NetworkManager/system-connections/nm-home-bedroom".source = config.sops.secrets.nm-home-bedroom.path;
-      text = ''${unwrapped} "$@"'';
+    "NetworkManager/system-connections/nm-home-shared-24G".source = config.sops.secrets.nm-home-shared-24G.path;
-    };
+    "NetworkManager/system-connections/nm-home-shared".source = config.sops.secrets.nm-home-shared.path;
-  in (lib.stringAfter
-    [ "setupSecrets" ]
-    ''
-    mkdir -p /var/lib/iwd
-    ${install-iwd}/bin/install-iwd /run/secrets/iwd /var/lib/iwd
-    ''
-  );
-
-  # TODO: use a glob, or a list, or something?
-  sops.secrets."iwd/community-university.psk" = {
-    sopsFile = ../../secrets/universal/net/community-university.psk.bin;
-    format = "binary";
-  };
-  sops.secrets."iwd/friend-libertarian-dod.psk" = {
-    sopsFile = ../../secrets/universal/net/friend-libertarian-dod.psk.bin;
-    format = "binary";
-  };
-  sops.secrets."iwd/friend-rationalist-empathist.psk" = {
-    sopsFile = ../../secrets/universal/net/friend-rationalist-empathist.psk.bin;
-    format = "binary";
-  };
-  sops.secrets."iwd/home-bedroom.psk" = {
-    sopsFile = ../../secrets/universal/net/home-bedroom.psk.bin;
-    format = "binary";
-  };
-  sops.secrets."iwd/home-shared-24G.psk" = {
-    sopsFile = ../../secrets/universal/net/home-shared-24G.psk.bin;
-    format = "binary";
-  };
-  sops.secrets."iwd/home-shared.psk" = {
-    sopsFile = ../../secrets/universal/net/home-shared.psk.bin;
-    format = "binary";
-  };
-  sops.secrets."iwd/iphone" = {
-    sopsFile = ../../secrets/universal/net/iphone.psk.bin;
-    format = "binary";
   };
 }

modules/universal/users.nix

@@ -100,8 +100,6 @@ in
     users.groups.systemd-coredump.gid = config.sane.allocations.systemd-coredump-gid;
     users.users.nscd.uid = config.sane.allocations.nscd-uid;
     users.groups.nscd.gid = config.sane.allocations.nscd-gid;
-    users.users.systemd-oom.uid = config.sane.allocations.systemd-oom-uid;
-    users.groups.systemd-oom.gid = config.sane.allocations.systemd-oom-gid;
 
     # guarantee determinism in uid/gid generation for users:
     assertions = let

nixpatches/10-flutter-arm64.patch

@@ -10,8 +10,8 @@ index 565c44f72e9..f20a3d4e9be 100644
  }:
  
 +let vendorHashes = {
-+  x86_64-linux = "sha256-p5EJP2zSvWyRV1uyTHw0EpFsEwAGtX5B9WVjpLmnVew=";
++  x86_64-linux = "sha256-PSZK5frmQGeiTuEJNZ6Fh8NXSLIrLnoOzQk1Xa4jqHw=";
-+  aarch64-linux = "sha256-Ps0HmDI6BFxHrLRq3KWNk4hw0qneq5hqB/Mp99f+hO4=";
++  aarch64-linux = "sha256-tU83EeFwakTNkEaLo90ZJV55CnmN+NcicHgBJ0u/RKM=";
 +};
 +in
  flutter.mkFlutterApp rec {

nixpatches/11-flutter-3.3.3-189338.patch

@@ -1,646 +0,0 @@
-diff --git a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
-index d50e7118cc1..22bbeb212f0 100644
---- a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
-+++ b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
-@@ -1,16 +1,16 @@
- { lib
- , fetchFromGitLab
--, flutter
-+, flutter2
- , olm
- , imagemagick
- , makeDesktopItem
- }:
- 
--flutter.mkFlutterApp rec {
-+flutter2.mkFlutterApp rec {
-   pname = "fluffychat";
-   version = "1.2.0";
- 
--  vendorHash = "sha256-co+bnsVIyg42JpM9FimfGEjrd6A99GlBeow1Dgv7NBI=";
-+  vendorHash = "sha256-1PDX023WXRmRe/b1L+6Du91BvGwYNp3YATqYSQdPrRY=";
- 
-   src = fetchFromGitLab {
-     owner = "famedly";
-diff --git a/pkgs/development/compilers/flutter/default.nix b/pkgs/development/compilers/flutter/default.nix
-index 4529d2adc1a..02188335129 100644
---- a/pkgs/development/compilers/flutter/default.nix
-+++ b/pkgs/development/compilers/flutter/default.nix
-@@ -4,34 +4,40 @@ let
-   getPatches = dir:
-     let files = builtins.attrNames (builtins.readDir dir);
-     in map (f: dir + ("/" + f)) files;
--  version = "3.0.4";
--  channel = "stable";
--  filename = "flutter_linux_${version}-${channel}.tar.xz";
--
--  # Decouples flutter derivation from dart derivation,
--  # use specific dart version to not need to bump dart derivation when bumping flutter.
--  dartVersion = "2.17.5";
--  dartSourceBase = "https://storage.googleapis.com/dart-archive/channels";
--  dartForFlutter = dart.override {
--    version = dartVersion;
--    sources = {
--      "${dartVersion}-x86_64-linux" = fetchurl {
--        url = "${dartSourceBase}/stable/release/${dartVersion}/sdk/dartsdk-linux-x64-release.zip";
--        sha256 = "sha256-AFJGeiPsjUZSO+DykmOIFETg2jIohg62tp3ghZrKJFk=";
-+  flutterDrv = { version, pname, dartVersion, hash, dartHash, patches }: mkFlutter {
-+    inherit version pname patches;
-+    dart = dart.override {
-+      version = dartVersion;
-+      sources = {
-+        "${dartVersion}-x86_64-linux" = fetchurl {
-+          url = "https://storage.googleapis.com/dart-archive/channels/stable/release/${dartVersion}/sdk/dartsdk-linux-x64-release.zip";
-+          sha256 = dartHash;
-+        };
-       };
-     };
-+    src = fetchurl {
-+      url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${version}-stable.tar.xz";
-+      sha256 = hash;
-+    };
-   };
- in
- {
-   inherit mkFlutter;
--  stable = mkFlutter rec {
--    inherit version;
--    dart = dartForFlutter;
-+  stable = flutterDrv {
-     pname = "flutter";
--    src = fetchurl {
--      url = "https://storage.googleapis.com/flutter_infra_release/releases/${channel}/linux/${filename}";
--      sha256 = "sha256-vh3QjLGFBN321DUET9XhYqSkILjEj+ZqAALu/mxY+go=";
--    };
--    patches = getPatches ./patches;
-+    version = "3.3.3";
-+    dartVersion = "2.18.2";
-+    hash = "sha256-MTZeWQUp4/TcPzYIT6eqIKSPUPvn2Mp/thOQzNgpTXg=";
-+    dartHash = "sha256-C3+YjecXLvSmJrLwi9H7TgD9Np0AArRWx3EdBrfQpTU";
-+    patches = getPatches ./patches/flutter3;
-+  };
-+
-+  v2 = flutterDrv {
-+    pname = "flutter";
-+    version = "2.10.5";
-+    dartVersion = "2.16.2";
-+    hash = "sha256-DTZwxlMUYk8NS1SaWUJolXjD+JnRW73Ps5CdRHDGnt0=";
-+    dartHash = "sha256-egrYd7B4XhkBiHPIFE2zopxKtQ58GqlogAKA/UeiXnI=";
-+    patches = getPatches ./patches/flutter2;
-   };
- }
-diff --git a/pkgs/development/compilers/flutter/flutter.nix b/pkgs/development/compilers/flutter/flutter.nix
-index 28a78c3e306..f2c861356ab 100644
---- a/pkgs/development/compilers/flutter/flutter.nix
-+++ b/pkgs/development/compilers/flutter/flutter.nix
-@@ -65,7 +65,7 @@ let
-       popd
- 
-       local revision="$(cd "$FLUTTER_ROOT"; git rev-parse HEAD)"
--      ${dart}/bin/dart --snapshot="$SNAPSHOT_PATH" --packages="$FLUTTER_TOOLS_DIR/.packages" "$SCRIPT_PATH"
-+      ${dart}/bin/dart --snapshot="$SNAPSHOT_PATH" --packages="$FLUTTER_TOOLS_DIR/.dart_tool/package_config.json" "$SCRIPT_PATH"
-       echo "$revision" > "$STAMP_PATH"
-       echo -n "${version}" > version
- 
-diff --git a/pkgs/development/compilers/flutter/patches/disable-auto-update.patch b/pkgs/development/compilers/flutter/patches/flutter2/disable-auto-update.patch
-similarity index 100%
-rename from pkgs/development/compilers/flutter/patches/disable-auto-update.patch
-rename to pkgs/development/compilers/flutter/patches/flutter2/disable-auto-update.patch
-diff --git a/pkgs/development/compilers/flutter/patches/flutter2/git-dir.patch b/pkgs/development/compilers/flutter/patches/flutter2/git-dir.patch
-new file mode 100644
-index 00000000000..0136ef93106
---- /dev/null
-+++ b/pkgs/development/compilers/flutter/patches/flutter2/git-dir.patch
-@@ -0,0 +1,80 @@
-+diff --git a/dev/bots/prepare_package.dart b/dev/bots/prepare_package.dart
-+index 468a91a954..5def6897ce 100644
-+--- a/dev/bots/prepare_package.dart
-++++ b/dev/bots/prepare_package.dart
-+@@ -525,7 +525,7 @@ class ArchiveCreator {
-+ 
-+   Future<String> _runGit(List<String> args, {Directory? workingDirectory}) {
-+     return _processRunner.runProcess(
-+-      <String>['git', ...args],
-++      <String>['git', '--git-dir', '.git', ...args],
-+       workingDirectory: workingDirectory ?? flutterRoot,
-+     );
-+   }
-+diff --git a/packages/flutter_tools/lib/src/version.dart b/packages/flutter_tools/lib/src/version.dart
-+index f2068a6ca2..99b161689e 100644
-+--- a/packages/flutter_tools/lib/src/version.dart
-++++ b/packages/flutter_tools/lib/src/version.dart
-+@@ -106,7 +106,7 @@ class FlutterVersion {
-+     String? channel = _channel;
-+     if (channel == null) {
-+       final String gitChannel = _runGit(
-+-        'git rev-parse --abbrev-ref --symbolic @{u}',
-++        'git --git-dir .git rev-parse --abbrev-ref --symbolic @{u}',
-+         globals.processUtils,
-+         _workingDirectory,
-+       );
-+@@ -114,7 +114,7 @@ class FlutterVersion {
-+       if (slash != -1) {
-+         final String remote = gitChannel.substring(0, slash);
-+         _repositoryUrl = _runGit(
-+-          'git ls-remote --get-url $remote',
-++          'git --git-dir .git ls-remote --get-url $remote',
-+           globals.processUtils,
-+           _workingDirectory,
-+         );
-+@@ -326,7 +326,7 @@ class FlutterVersion {
-+   /// the branch name will be returned as `'[user-branch]'`.
-+   String getBranchName({ bool redactUnknownBranches = false }) {
-+     _branch ??= () {
-+-      final String branch = _runGit('git rev-parse --abbrev-ref HEAD', globals.processUtils);
-++      final String branch = _runGit('git --git-dir .git rev-parse --abbrev-ref HEAD', globals.processUtils);
-+       return branch == 'HEAD' ? channel : branch;
-+     }();
-+     if (redactUnknownBranches || _branch!.isEmpty) {
-+@@ -359,7 +359,7 @@ class FlutterVersion {
-+   /// wrapper that does that.
-+   @visibleForTesting
-+   static List<String> gitLog(List<String> args) {
-+-    return <String>['git', '-c', 'log.showSignature=false', 'log'] + args;
-++    return <String>['git', '-c', 'log.showSignature=false', '--git-dir', '.git', 'log'] + args;
-+   }
-+ 
-+   /// Gets the release date of the latest available Flutter version.
-+@@ -730,7 +730,7 @@ class GitTagVersion {
-+ 
-+   static GitTagVersion determine(ProcessUtils processUtils, {String? workingDirectory, bool fetchTags = false, String gitRef = 'HEAD'}) {
-+     if (fetchTags) {
-+-      final String channel = _runGit('git rev-parse --abbrev-ref HEAD', processUtils, workingDirectory);
-++      final String channel = _runGit('git --git-dir .git rev-parse --abbrev-ref HEAD', processUtils, workingDirectory);
-+       if (channel == 'dev' || channel == 'beta' || channel == 'stable') {
-+         globals.printTrace('Skipping request to fetchTags - on well known channel $channel.');
-+       } else {
-+@@ -739,7 +739,7 @@ class GitTagVersion {
-+     }
-+     // find all tags attached to the given [gitRef]
-+     final List<String> tags = _runGit(
-+-      'git tag --points-at $gitRef', processUtils, workingDirectory).trim().split('\n');
-++      'git --git-dir .git tag --points-at $gitRef', processUtils, workingDirectory).trim().split('\n');
-+ 
-+     // Check first for a stable tag
-+     final RegExp stableTagPattern = RegExp(r'^\d+\.\d+\.\d+$');
-+@@ -760,7 +760,7 @@ class GitTagVersion {
-+     // recent tag and number of commits past.
-+     return parse(
-+       _runGit(
-+-        'git describe --match *.*.* --long --tags $gitRef',
-++        'git --git-dir .git describe --match *.*.* --long --tags $gitRef',
-+         processUtils,
-+         workingDirectory,
-+       )
-diff --git a/pkgs/development/compilers/flutter/patches/flutter2/move-cache.patch b/pkgs/development/compilers/flutter/patches/flutter2/move-cache.patch
-new file mode 100644
-index 00000000000..a81d2def242
---- /dev/null
-+++ b/pkgs/development/compilers/flutter/patches/flutter2/move-cache.patch
-@@ -0,0 +1,72 @@
-+diff --git a/packages/flutter_tools/lib/src/asset.dart b/packages/flutter_tools/lib/src/asset.dart
-+index ed42baea29..12941f733a 100644
-+--- a/packages/flutter_tools/lib/src/asset.dart
-++++ b/packages/flutter_tools/lib/src/asset.dart
-+@@ -11,11 +11,11 @@ import 'base/file_system.dart';
-+ import 'base/logger.dart';
-+ import 'base/platform.dart';
-+ import 'build_info.dart';
-+-import 'cache.dart';
-+ import 'convert.dart';
-+ import 'dart/package_map.dart';
-+ import 'devfs.dart';
-+ import 'flutter_manifest.dart';
-++import 'globals.dart' as globals;
-+ import 'license_collector.dart';
-+ import 'project.dart';
-+ 
-+@@ -504,7 +504,7 @@ class ManifestAssetBundle implements AssetBundle {
-+         }
-+         final Uri entryUri = _fileSystem.path.toUri(asset);
-+         result.add(_Asset(
-+-          baseDir: _fileSystem.path.join(Cache.flutterRoot!, 'bin', 'cache', 'artifacts', 'material_fonts'),
-++          baseDir: _fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter', 'artifacts', 'material_fonts'),
-+           relativeUri: Uri(path: entryUri.pathSegments.last),
-+           entryUri: entryUri,
-+           package: null,
-+diff --git a/packages/flutter_tools/lib/src/cache.dart b/packages/flutter_tools/lib/src/cache.dart
-+index defc86cc20..7fdf14d112 100644
-+--- a/packages/flutter_tools/lib/src/cache.dart
-++++ b/packages/flutter_tools/lib/src/cache.dart
-+@@ -22,6 +22,7 @@ import 'base/user_messages.dart';
-+ import 'build_info.dart';
-+ import 'convert.dart';
-+ import 'features.dart';
-++import 'globals.dart' as globals;
-+ 
-+ const String kFlutterRootEnvironmentVariableName = 'FLUTTER_ROOT'; // should point to //flutter/ (root of flutter/flutter repo)
-+ const String kFlutterEngineEnvironmentVariableName = 'FLUTTER_ENGINE'; // should point to //engine/src/ (root of flutter/engine repo)
-+@@ -322,8 +323,13 @@ class Cache {
-+       return;
-+     }
-+     assert(_lock == null);
-++    final Directory dir = _fileSystem.directory(_fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter'));
-++    if (!dir.existsSync()) {
-++      dir.createSync(recursive: true);
-++      globals.os.chmod(dir, '755');
-++    }
-+     final File lockFile =
-+-      _fileSystem.file(_fileSystem.path.join(flutterRoot!, 'bin', 'cache', 'lockfile'));
-++      _fileSystem.file(_fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter', 'lockfile'));
-+     try {
-+       _lock = lockFile.openSync(mode: FileMode.write);
-+     } on FileSystemException catch (e) {
-+@@ -382,8 +388,7 @@ class Cache {
-+ 
-+   String get devToolsVersion {
-+     if (_devToolsVersion == null) {
-+-      const String devToolsDirPath = 'dart-sdk/bin/resources/devtools';
-+-      final Directory devToolsDir = getCacheDir(devToolsDirPath, shouldCreate: false);
-++      final Directory devToolsDir = _fileSystem.directory(_fileSystem.path.join(flutterRoot!, 'bin/cache/dart-sdk/bin/resources/devtools'));
-+       if (!devToolsDir.existsSync()) {
-+         throw Exception('Could not find directory at ${devToolsDir.path}');
-+       }
-+@@ -536,7 +541,7 @@ class Cache {
-+     if (_rootOverride != null) {
-+       return _fileSystem.directory(_fileSystem.path.join(_rootOverride!.path, 'bin', 'cache'));
-+     } else {
-+-      return _fileSystem.directory(_fileSystem.path.join(flutterRoot!, 'bin', 'cache'));
-++      return _fileSystem.directory(_fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter'));
-+     }
-+   }
-+ 
-diff --git a/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch b/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch
-new file mode 100644
-index 00000000000..21b676a2af3
---- /dev/null
-+++ b/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch
-@@ -0,0 +1,36 @@
-+diff --git a/bin/internal/shared.sh b/bin/internal/shared.sh
-+index ab746724e9..1087983c87 100644
-+--- a/bin/internal/shared.sh
-++++ b/bin/internal/shared.sh
-+@@ -215,8 +215,6 @@ function shared::execute() {
-+     exit 1
-+   fi
-+ 
-+-  upgrade_flutter 7< "$PROG_NAME"
-+-
-+   BIN_NAME="$(basename "$PROG_NAME")"
-+   case "$BIN_NAME" in
-+     flutter*)
-+diff --git a/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart b/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
-+index 738fef987d..03a152e64f 100644
-+--- a/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
-++++ b/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
-+@@ -241,7 +241,6 @@ class FlutterCommandRunner extends CommandRunner<void> {
-+           globals.flutterUsage.suppressAnalytics = true;
-+         }
-+ 
-+-        globals.flutterVersion.ensureVersionFile();
-+         final bool machineFlag = topLevelResults['machine'] as bool? ?? false;
-+         final bool ci = await globals.botDetector.isRunningOnBot;
-+         final bool redirectedCompletion = !globals.stdio.hasTerminal &&
-+@@ -250,10 +249,6 @@ class FlutterCommandRunner extends CommandRunner<void> {
-+         final bool versionCheckFlag = topLevelResults['version-check'] as bool? ?? false;
-+         final bool explicitVersionCheckPassed = topLevelResults.wasParsed('version-check') && versionCheckFlag;
-+ 
-+-        if (topLevelResults.command?.name != 'upgrade' &&
-+-            (explicitVersionCheckPassed || (versionCheckFlag && !isMachine))) {
-+-          await globals.flutterVersion.checkFlutterVersionFreshness();
-+-        }
-+ 
-+         // See if the user specified a specific device.
-+         globals.deviceManager?.specifiedDeviceId = topLevelResults['device-id'] as String?;
-diff --git a/pkgs/development/compilers/flutter/patches/git-dir.patch b/pkgs/development/compilers/flutter/patches/flutter3/git-dir.patch
-similarity index 86%
-rename from pkgs/development/compilers/flutter/patches/git-dir.patch
-rename to pkgs/development/compilers/flutter/patches/flutter3/git-dir.patch
-index 0c736f945ea..42ad756f8ea 100644
---- a/pkgs/development/compilers/flutter/patches/git-dir.patch
-+++ b/pkgs/development/compilers/flutter/patches/flutter3/git-dir.patch
-@@ -1,8 +1,8 @@
- diff --git a/dev/bots/prepare_package.dart b/dev/bots/prepare_package.dart
--index 468a91a954..5def6897ce 100644
-+index 8e4cb81340..2c20940423 100644
- --- a/dev/bots/prepare_package.dart
- +++ b/dev/bots/prepare_package.dart
--@@ -525,7 +525,7 @@ class ArchiveCreator {
-+@@ -526,7 +526,7 @@ class ArchiveCreator {
-  
-    Future<String> _runGit(List<String> args, {Directory? workingDirectory}) {
-      return _processRunner.runProcess(
-@@ -12,7 +12,7 @@ index 468a91a954..5def6897ce 100644
-      );
-    }
- diff --git a/packages/flutter_tools/lib/src/commands/downgrade.dart b/packages/flutter_tools/lib/src/commands/downgrade.dart
--index bb0eb428a9..4a2a48bb5e 100644
-+index 666c190067..b6c3761f6f 100644
- --- a/packages/flutter_tools/lib/src/commands/downgrade.dart
- +++ b/packages/flutter_tools/lib/src/commands/downgrade.dart
- @@ -118,7 +118,7 @@ class DowngradeCommand extends FlutterCommand {
-@@ -34,19 +34,19 @@ index bb0eb428a9..4a2a48bb5e 100644
-        if (parseResult.exitCode == 0) {
-          buffer.writeln('Channel "${getNameForChannel(channel)}" was previously on: ${parseResult.stdout}.');
- diff --git a/packages/flutter_tools/lib/src/version.dart b/packages/flutter_tools/lib/src/version.dart
--index f2068a6ca2..99b161689e 100644
-+index dc47f17057..8068e2d1f5 100644
- --- a/packages/flutter_tools/lib/src/version.dart
- +++ b/packages/flutter_tools/lib/src/version.dart
--@@ -106,7 +106,7 @@ class FlutterVersion {
-+@@ -111,7 +111,7 @@ class FlutterVersion {
-      String? channel = _channel;
-      if (channel == null) {
-        final String gitChannel = _runGit(
---        'git rev-parse --abbrev-ref --symbolic @{u}',
--+        'git --git-dir .git rev-parse --abbrev-ref --symbolic @{u}',
-+-        'git rev-parse --abbrev-ref --symbolic $kGitTrackingUpstream',
-++        'git --git-dir .git rev-parse --abbrev-ref --symbolic $kGitTrackingUpstream',
-          globals.processUtils,
-          _workingDirectory,
-        );
--@@ -114,7 +114,7 @@ class FlutterVersion {
-+@@ -119,7 +119,7 @@ class FlutterVersion {
-        if (slash != -1) {
-          final String remote = gitChannel.substring(0, slash);
-          _repositoryUrl = _runGit(
-@@ -55,7 +55,7 @@ index f2068a6ca2..99b161689e 100644
-            globals.processUtils,
-            _workingDirectory,
-          );
--@@ -326,7 +326,7 @@ class FlutterVersion {
-+@@ -298,7 +298,7 @@ class FlutterVersion {
-    /// the branch name will be returned as `'[user-branch]'`.
-    String getBranchName({ bool redactUnknownBranches = false }) {
-      _branch ??= () {
-@@ -64,7 +64,7 @@ index f2068a6ca2..99b161689e 100644
-        return branch == 'HEAD' ? channel : branch;
-      }();
-      if (redactUnknownBranches || _branch!.isEmpty) {
--@@ -359,7 +359,7 @@ class FlutterVersion {
-+@@ -331,7 +331,7 @@ class FlutterVersion {
-    /// wrapper that does that.
-    @visibleForTesting
-    static List<String> gitLog(List<String> args) {
-@@ -73,16 +73,16 @@ index f2068a6ca2..99b161689e 100644
-    }
-  
-    /// Gets the release date of the latest available Flutter version.
--@@ -730,7 +730,7 @@ class GitTagVersion {
-- 
--   static GitTagVersion determine(ProcessUtils processUtils, {String? workingDirectory, bool fetchTags = false, String gitRef = 'HEAD'}) {
-+@@ -708,7 +708,7 @@ class GitTagVersion {
-+     String gitRef = 'HEAD'
-+   }) {
-      if (fetchTags) {
- -      final String channel = _runGit('git rev-parse --abbrev-ref HEAD', processUtils, workingDirectory);
- +      final String channel = _runGit('git --git-dir .git rev-parse --abbrev-ref HEAD', processUtils, workingDirectory);
-        if (channel == 'dev' || channel == 'beta' || channel == 'stable') {
-          globals.printTrace('Skipping request to fetchTags - on well known channel $channel.');
-        } else {
--@@ -739,7 +739,7 @@ class GitTagVersion {
-+@@ -718,7 +718,7 @@ class GitTagVersion {
-      }
-      // find all tags attached to the given [gitRef]
-      final List<String> tags = _runGit(
-@@ -91,7 +91,7 @@ index f2068a6ca2..99b161689e 100644
-  
-      // Check first for a stable tag
-      final RegExp stableTagPattern = RegExp(r'^\d+\.\d+\.\d+$');
--@@ -760,7 +760,7 @@ class GitTagVersion {
-+@@ -739,7 +739,7 @@ class GitTagVersion {
-      // recent tag and number of commits past.
-      return parse(
-        _runGit(
-diff --git a/pkgs/development/compilers/flutter/patches/move-cache.patch b/pkgs/development/compilers/flutter/patches/flutter3/move-cache.patch
-similarity index 83%
-rename from pkgs/development/compilers/flutter/patches/move-cache.patch
-rename to pkgs/development/compilers/flutter/patches/flutter3/move-cache.patch
-index 5cb7c71e9bd..008c5959e5b 100644
---- a/pkgs/development/compilers/flutter/patches/move-cache.patch
-+++ b/pkgs/development/compilers/flutter/patches/flutter3/move-cache.patch
-@@ -1,13 +1,9 @@
-+diff --git a/packages/flutter_tools/lib/src/artifacts.dart b/packages/flutter_tools/lib/src/artifacts.dart
- diff --git a/packages/flutter_tools/lib/src/asset.dart b/packages/flutter_tools/lib/src/asset.dart
--index ed42baea29..12941f733a 100644
-+index 9dd7272fbe..642c8e48e4 100644
- --- a/packages/flutter_tools/lib/src/asset.dart
- +++ b/packages/flutter_tools/lib/src/asset.dart
--@@ -11,11 +11,11 @@ import 'base/file_system.dart';
-- import 'base/logger.dart';
-- import 'base/platform.dart';
-- import 'build_info.dart';
---import 'cache.dart';
-- import 'convert.dart';
-+@@ -16,6 +16,7 @@ import 'convert.dart';
-  import 'dart/package_map.dart';
-  import 'devfs.dart';
-  import 'flutter_manifest.dart';
-@@ -15,17 +11,18 @@ index ed42baea29..12941f733a 100644
-  import 'license_collector.dart';
-  import 'project.dart';
-  
--@@ -504,7 +504,7 @@ class ManifestAssetBundle implements AssetBundle {
--         }
-+@@ -530,8 +531,7 @@ class ManifestAssetBundle implements AssetBundle {
-          final Uri entryUri = _fileSystem.path.toUri(asset);
-          result.add(_Asset(
---          baseDir: _fileSystem.path.join(Cache.flutterRoot!, 'bin', 'cache', 'artifacts', 'material_fonts'),
--+          baseDir: _fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter', 'artifacts', 'material_fonts'),
-+           baseDir: _fileSystem.path.join(
-+-            Cache.flutterRoot!,
-+-            'bin', 'cache', 'artifacts', 'material_fonts',
-++            globals.fsUtils.homeDirPath!, '.cache', 'flutter', 'artifacts', 'material_fonts',
-+           ),
-            relativeUri: Uri(path: entryUri.pathSegments.last),
-            entryUri: entryUri,
--           package: null,
- diff --git a/packages/flutter_tools/lib/src/cache.dart b/packages/flutter_tools/lib/src/cache.dart
--index defc86cc20..7fdf14d112 100644
-+index dd80b1e46e..8e54517765 100644
- --- a/packages/flutter_tools/lib/src/cache.dart
- +++ b/packages/flutter_tools/lib/src/cache.dart
- @@ -22,6 +22,7 @@ import 'base/user_messages.dart';
-@@ -36,7 +33,7 @@ index defc86cc20..7fdf14d112 100644
-  
-  const String kFlutterRootEnvironmentVariableName = 'FLUTTER_ROOT'; // should point to //flutter/ (root of flutter/flutter repo)
-  const String kFlutterEngineEnvironmentVariableName = 'FLUTTER_ENGINE'; // should point to //engine/src/ (root of flutter/engine repo)
--@@ -322,8 +323,13 @@ class Cache {
-+@@ -318,8 +319,13 @@ class Cache {
-        return;
-      }
-      assert(_lock == null);
-@@ -51,7 +48,7 @@ index defc86cc20..7fdf14d112 100644
-      try {
-        _lock = lockFile.openSync(mode: FileMode.write);
-      } on FileSystemException catch (e) {
--@@ -382,8 +388,7 @@ class Cache {
-+@@ -378,8 +384,7 @@ class Cache {
-  
-    String get devToolsVersion {
-      if (_devToolsVersion == null) {
-@@ -61,7 +58,7 @@ index defc86cc20..7fdf14d112 100644
-        if (!devToolsDir.existsSync()) {
-          throw Exception('Could not find directory at ${devToolsDir.path}');
-        }
--@@ -536,7 +541,7 @@ class Cache {
-+@@ -532,7 +537,7 @@ class Cache {
-      if (_rootOverride != null) {
-        return _fileSystem.directory(_fileSystem.path.join(_rootOverride!.path, 'bin', 'cache'));
-      } else {
-@@ -70,8 +67,7 @@ index defc86cc20..7fdf14d112 100644
-      }
-    }
-  
--diff --git a/packages/flutter_tools/lib/src/artifacts.dart b/packages/flutter_tools/lib/src/artifacts.dart
--index 2aac9686e8..32c4b98b88 100644
-+index c539d67156..4e0a64f7a9 100644
- --- a/packages/flutter_tools/lib/src/artifacts.dart
- +++ b/packages/flutter_tools/lib/src/artifacts.dart
- @@ -346,10 +346,10 @@ class CachedArtifacts implements Artifacts {
-@@ -82,8 +78,8 @@ index 2aac9686e8..32c4b98b88 100644
- +        final String path = _dartSdkPath(_fileSystem);
-          return _fileSystem.directory(path);
-        case HostArtifact.engineDartBinary:
---        final String path = _fileSystem.path.join(_dartSdkPath(_cache), 'bin', _hostArtifactToFileName(artifact, _platform.isWindows));
--+        final String path = _fileSystem.path.join(_dartSdkPath(_fileSystem), 'bin', _hostArtifactToFileName(artifact, _platform.isWindows));
-+-        final String path = _fileSystem.path.join(_dartSdkPath(_cache), 'bin', _hostArtifactToFileName(artifact, _platform));
-++        final String path = _fileSystem.path.join(_dartSdkPath(_fileSystem), 'bin', _hostArtifactToFileName(artifact, _platform));
-          return _fileSystem.file(path);
-        case HostArtifact.flutterWebSdk:
-          final String path = _getFlutterWebSdkPath();
-@@ -91,12 +87,12 @@ index 2aac9686e8..32c4b98b88 100644
-        case HostArtifact.dart2jsSnapshot:
-        case HostArtifact.dartdevcSnapshot:
-        case HostArtifact.kernelWorkerSnapshot:
---        final String path = _fileSystem.path.join(_dartSdkPath(_cache), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform.isWindows));
--+        final String path = _fileSystem.path.join(_dartSdkPath(_fileSystem), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform.isWindows));
-+-        final String path = _fileSystem.path.join(_dartSdkPath(_cache), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
-++        final String path = _fileSystem.path.join(_dartSdkPath(_fileSystem), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
-          return _fileSystem.file(path);
-        case HostArtifact.iosDeploy:
--         final String artifactFileName = _hostArtifactToFileName(artifact, _platform.isWindows);
--@@ -461,11 +461,13 @@ class CachedArtifacts implements Artifacts {
-+         final String artifactFileName = _hostArtifactToFileName(artifact, _platform);
-+@@ -465,11 +465,13 @@ class CachedArtifacts implements Artifacts {
-    String _getAndroidArtifactPath(Artifact artifact, TargetPlatform platform, BuildMode mode) {
-      final String engineDir = _getEngineArtifactsPath(platform, mode)!;
-      switch (artifact) {
-@@ -125,8 +121,8 @@ index 2aac9686e8..32c4b98b88 100644
- -      case Artifact.frontendServerSnapshotForEngineDartSdk:
-        case Artifact.constFinder:
-        case Artifact.flutterMacOSFramework:
--       case Artifact.flutterMacOSPodspec:
--@@ -594,14 +596,10 @@ class CachedArtifacts implements Artifacts {
-+       case Artifact.flutterPatchedSdkPath:
-+@@ -586,14 +588,10 @@ class CachedArtifacts implements Artifacts {
-          // For script snapshots any gen_snapshot binary will do. Returning gen_snapshot for
-          // android_arm in profile mode because it is available on all supported host platforms.
-          return _getAndroidArtifactPath(artifact, TargetPlatform.android_arm, BuildMode.profile);
-@@ -142,27 +138,27 @@ index 2aac9686e8..32c4b98b88 100644
-        case Artifact.icuData:
-          final String engineArtifactsPath = _cache.getArtifactDirectory('engine').path;
-          final String platformDirName = _enginePlatformDirectoryName(platform);
--@@ -797,7 +795,7 @@ class CachedLocalEngineArtifacts implements LocalEngineArtifacts {
--         final String path = _fileSystem.path.join(_hostEngineOutPath, 'dart-sdk', 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform.isWindows));
-+@@ -776,7 +774,7 @@ class CachedLocalEngineArtifacts implements LocalEngineArtifacts {
-+         final String path = _fileSystem.path.join(_hostEngineOutPath, 'dart-sdk', 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
-          return _fileSystem.file(path);
-        case HostArtifact.dartdevcSnapshot:
---        final String path = _fileSystem.path.join(_dartSdkPath(_cache), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform.isWindows));
--+        final String path = _fileSystem.path.join(_dartSdkPath(_fileSystem), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform.isWindows));
-+-        final String path = _fileSystem.path.join(_dartSdkPath(_cache), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
-++        final String path = _fileSystem.path.join(_dartSdkPath(_fileSystem), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
-          return _fileSystem.file(path);
-        case HostArtifact.kernelWorkerSnapshot:
--         final String path = _fileSystem.path.join(_hostEngineOutPath, 'dart-sdk', 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform.isWindows));
--@@ -922,9 +920,7 @@ class CachedLocalEngineArtifacts implements LocalEngineArtifacts {
--       case Artifact.windowsUwpCppClientWrapper:
-+         final String path = _fileSystem.path.join(_hostEngineOutPath, 'dart-sdk', 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
-+@@ -901,9 +899,7 @@ class CachedLocalEngineArtifacts implements LocalEngineArtifacts {
-+       case Artifact.windowsCppClientWrapper:
-          return _fileSystem.path.join(_hostEngineOutPath, artifactFileName);
-        case Artifact.frontendServerSnapshotForEngineDartSdk:
- -        return _fileSystem.path.join(
- -          _hostEngineOutPath, 'dart-sdk', 'bin', 'snapshots', artifactFileName,
- -        );
- +        return _fileSystem.path.join(_hostEngineOutPath, 'gen', artifactFileName);
--       case Artifact.uwptool:
--         return _fileSystem.path.join(_hostEngineOutPath, artifactFileName);
-      }
--@@ -1034,8 +1030,8 @@ class OverrideArtifacts implements Artifacts {
-+   }
-+ 
-+@@ -1011,8 +1007,8 @@ class OverrideArtifacts implements Artifacts {
-  }
-  
-  /// Locate the Dart SDK.
-@@ -174,12 +170,12 @@ index 2aac9686e8..32c4b98b88 100644
-  
-  class _TestArtifacts implements Artifacts {
- diff --git a/packages/flutter_tools/test/general.shard/artifacts_test.dart b/packages/flutter_tools/test/general.shard/artifacts_test.dart
--index d906511a15..adfdd4bb42 100644
-+index aed3eb9285..81b8362648 100644
- --- a/packages/flutter_tools/test/general.shard/artifacts_test.dart
- +++ b/packages/flutter_tools/test/general.shard/artifacts_test.dart
--@@ -153,10 +153,6 @@ void main() {
--         artifacts.getArtifactPath(Artifact.windowsUwpDesktopPath, platform: TargetPlatform.windows_uwp_x64, mode: BuildMode.release),
--         fileSystem.path.join('root', 'bin', 'cache', 'artifacts', 'engine', 'windows-uwp-x64-release'),
-+@@ -141,10 +141,6 @@ void main() {
-+         artifacts.getArtifactPath(Artifact.flutterTester, platform: TargetPlatform.linux_arm64),
-+         fileSystem.path.join('root', 'bin', 'cache', 'artifacts', 'engine', 'linux-arm64', 'flutter_tester'),
-        );
- -      expect(
- -        artifacts.getArtifactPath(Artifact.frontendServerSnapshotForEngineDartSdk),
-@@ -188,7 +184,7 @@ index d906511a15..adfdd4bb42 100644
-      });
-  
-      testWithoutContext('precompiled web artifact paths are correct', () {
--@@ -322,11 +318,6 @@ void main() {
-+@@ -310,11 +306,6 @@ void main() {
-          artifacts.getHostArtifact(HostArtifact.engineDartSdkPath).path,
-          fileSystem.path.join('/out', 'host_debug_unopt', 'dart-sdk'),
-        );
-@@ -197,6 +193,6 @@ index d906511a15..adfdd4bb42 100644
- -        fileSystem.path.join('/out', 'host_debug_unopt', 'dart-sdk', 'bin',
- -          'snapshots', 'frontend_server.dart.snapshot')
- -      );
--     });
-- 
--     testWithoutContext('getEngineType', () {
-+       expect(
-+         artifacts.getHostArtifact(HostArtifact.impellerc).path,
-+         fileSystem.path.join('/out', 'host_debug_unopt', 'impellerc'),
-diff --git a/pkgs/os-specific/linux/firmware/firmware-updater/default.nix b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
-index fb9d3a9a36c..cc906b763e8 100644
---- a/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
-+++ b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
-@@ -1,13 +1,13 @@
- { lib
--, flutter
-+, flutter2
- , fetchFromGitHub
- }:
- 
--flutter.mkFlutterApp {
-+flutter2.mkFlutterApp {
-   pname = "firmware-updater";
-   version = "unstable";
- 
--  vendorHash = "sha256-3wVA9BLCnMijC0gOmskz+Hv7NQIGu/jhBDbWjmoq1Tc=";
-+  vendorHash = "sha256-7uOiebGBcX61oUyNCi1h9KldTRTrCfYaHUQSH4J5OoQ=";
- 
-   src = fetchFromGitHub {
-     owner = "canonical";
-diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
-index 4f25d9b20d8..c282471c464 100644
---- a/pkgs/top-level/all-packages.nix
-+++ b/pkgs/top-level/all-packages.nix
-@@ -13448,6 +13448,7 @@ with pkgs;
-   flutterPackages =
-     recurseIntoAttrs (callPackage ../development/compilers/flutter { });
-   flutter = flutterPackages.stable;
-+  flutter2 = flutterPackages.v2;
- 
-   fnm = callPackage ../development/tools/fnm {
-     inherit (darwin.apple_sdk.frameworks) DiskArbitration Foundation Security;

nixpatches/12-flutter-arm64-2.patch

@@ -1,66 +0,0 @@
-diff --git a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
-index 22bbeb212f0..c07bd8e9fd4 100644
---- a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
-+++ b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
-@@ -4,13 +4,19 @@
- , olm
- , imagemagick
- , makeDesktopItem
-+, stdenv
- }:
- 
-+let vendorHashes = {
-+  x86_64-linux = "sha256-Gi0mfxaMtPI/TxrxnvzQvH9M8CtLADKJfYO2JnzAz+Y=";
-+  aarch64-linux = "sha256-iq8bMSJoYbDNtR82QunrpQdPUv0nceUKXRqAwDvxCpE=";
-+};
-+in
- flutter2.mkFlutterApp rec {
-   pname = "fluffychat";
-   version = "1.2.0";
- 
--  vendorHash = "sha256-1PDX023WXRmRe/b1L+6Du91BvGwYNp3YATqYSQdPrRY=";
-+  vendorHash = vendorHashes."${stdenv.hostPlatform.system}" or (throw "unsupported system: ${stdenv.hostPlatform.system}");
- 
-   src = fetchFromGitLab {
-     owner = "famedly";
-diff --git a/pkgs/development/compilers/flutter/default.nix b/pkgs/development/compilers/flutter/default.nix
-index 02188335129..c264565e50a 100644
---- a/pkgs/development/compilers/flutter/default.nix
-+++ b/pkgs/development/compilers/flutter/default.nix
-@@ -11,7 +11,11 @@ let
-       sources = {
-         "${dartVersion}-x86_64-linux" = fetchurl {
-           url = "https://storage.googleapis.com/dart-archive/channels/stable/release/${dartVersion}/sdk/dartsdk-linux-x64-release.zip";
--          sha256 = dartHash;
-+          sha256 = dartHash.x86_64-linux;
-+        };
-+        "${dartVersion}-aarch64-linux" = fetchurl {
-+          url = "https://storage.googleapis.com/dart-archive/channels/stable/release/${dartVersion}/sdk/dartsdk-linux-arm64-release.zip";
-+          sha256 = dartHash.aarch64-linux;
-         };
-       };
-     };
-@@ -28,7 +32,10 @@ in
-     version = "3.3.3";
-     dartVersion = "2.18.2";
-     hash = "sha256-MTZeWQUp4/TcPzYIT6eqIKSPUPvn2Mp/thOQzNgpTXg=";
--    dartHash = "sha256-C3+YjecXLvSmJrLwi9H7TgD9Np0AArRWx3EdBrfQpTU";
-+    dartHash = {
-+      x86_64-linux = "sha256-C3+YjecXLvSmJrLwi9H7TgD9Np0AArRWx3EdBrfQpTU";
-+      aarch64-linux = "sha256-zyIK1i5/9P2C+sjzdArhFwpVO4P+It+/X50l+n9gekI=";
-+    };
-     patches = getPatches ./patches/flutter3;
-   };
- 
-@@ -37,7 +44,10 @@ in
-     version = "2.10.5";
-     dartVersion = "2.16.2";
-     hash = "sha256-DTZwxlMUYk8NS1SaWUJolXjD+JnRW73Ps5CdRHDGnt0=";
--    dartHash = "sha256-egrYd7B4XhkBiHPIFE2zopxKtQ58GqlogAKA/UeiXnI=";
-+    dartHash = {
-+      x86_64-linux = "sha256-egrYd7B4XhkBiHPIFE2zopxKtQ58GqlogAKA/UeiXnI=";
-+      aarch64-linux = "sha256-vmerjXkUAUnI8FjK+62qLqgETmA+BLPEZXFxwYpI+KY=";
-+    };
-     patches = getPatches ./patches/flutter2;
-   };
- }

nixpatches/list.nix

@@ -1,47 +1,29 @@
 fetchpatch: [
-  # Flutter: 3.0.4 -> 3.3.3, flutter.dart: 2.17.5 -> 2.18.2
-  # merged 2022/10/07
-  # (fetchpatch {
-  #   url = "https://github.com/NixOS/nixpkgs/pull/189338.diff";
-  #   sha256 = "sha256-HRkOIBcOnSXyTKkYxnMgZou8MHU/5eNhxxARdUq9UWg=";
-  #   # url = "https://git.uninsane.org/colin/nixpkgs/commit/889c3a8cbc91c0d10b34ab7825fa1f6d1d31668a.diff";
-  #   # sha256 = "sha256-qVWLpNoW3HVSWRtXS1BcSusKOq0CAMfY0BVU9MxPm98=";
-  # })
-  #
-  # XXX this is a cherry-pick of all the commits in PR 189338 (as appears in tree).
-  # the diff yielded by Github is apparently not the same somehow (maybe because the branches being merged had diverged too much?)
-  ./11-flutter-3.3.3-189338.patch
-
-  # phosh-mobile-settings: init at 0.21.1
-  (fetchpatch {
-    url = "http://git.uninsane.org/colin/nixpkgs/commit/0c1a7e8504291eb0076bbee3f8ebf693f4641112.diff";
-    # url = "https://github.com/NixOS/nixpkgs/pull/193845.diff";
-    sha256 = "sha256-OczjlQcG7sTM/V9Y9VL/qdwaWPKfjAJsh3czqqhRQig=";
-  })
-
-  # kaiteki: init at 2022-09-03
-  (fetchpatch {
-    url = "https://git.uninsane.org/colin/nixpkgs/commit/e2c7f5f4870fcb0e5405e9001b39a64c516852d4.diff";
-    # url = "https://github.com/NixOS/nixpkgs/pull/193169.diff";
-    sha256 = "sha256-UWnfS+stVpUZ3Sfaym9XtVBlwvHWJVMaW7cYIcf3M5Q=";
-  })
-
-  # Fix mk flutter app
-  # closed (not merged). updates fluffychat 1.2.0 -> 1.6.1, but unstable hashing
-  # (fetchpatch {
-  #   url = "https://github.com/NixOS/nixpkgs/pull/186839.diff";
-  #   sha256 = "sha256-NdIfie+eTy4V1vgqiiRPtWdnxZ5ZHsvCMfkEDUv9SC8=";
-  # })
-
   # for raspberry pi: allow building u-boot for rpi 4{,00}
   # TODO: remove after upstreamed: https://github.com/NixOS/nixpkgs/pull/176018
   #   (it's a dupe of https://github.com/NixOS/nixpkgs/pull/112677 )
   ./02-rpi4-uboot.patch
 
+  (fetchpatch {
+    url = "https://github.com/NixOS/nixpkgs/pull/186839.diff";
+    sha256 = "sha256-NdIfie+eTy4V1vgqiiRPtWdnxZ5ZHsvCMfkEDUv9SC8=";
+  })
+
+  # # # Flutter: 3.0.4->3.3.2, flutter.dart: 2.17.5->2.18.1
+  # # (fetchpatch {
+  # #   url = "https://github.com/NixOS/nixpkgs/pull/189338.diff";
+  # #   sha256 = "sha256-MppSk1D3qQT8Z4lzEZ93UexoidT8yqM7ASPec4VvxCI=";
+  # # })
+  # enable aarch64 support for flutter's dart package
+  ./10-flutter-arm64.patch
+
+
   # TODO: upstream
   ./07-duplicity-rich-url.patch
 
-  # enable aarch64 support for flutter's dart package
+  # navidrome: adhoc hack to fix the build
-  # ./10-flutter-arm64.patch
+  (fetchpatch {
-  ./12-flutter-arm64-2.patch
+    url = "https://github.com/NixOS/nixpkgs/pull/191467.diff";
+    sha256 = "sha256-Np0J06RER/0GGUhL/PDuVjpYYIPzB9A3EPWwTWpS/D4=";
+  })
 ]

pkgs/alsa-ucm-conf/default.nix

@@ -0,0 +1,13 @@
+{ pkgs }:
+
+(pkgs.alsa-ucm-conf.overrideAttrs (upstream: {
+  patches = (upstream.patches or []) ++ [
+    (pkgs.fetchpatch {
+      # "Add UCM for PinePhone"
+      # we need this for audio to work on the Pinephone
+      url = "https://github.com/alsa-project/alsa-ucm-conf/pull/134.diff";
+      sha256 = "sha256-hFpp8jQo8fQRqKrSnBEi5eh1Zf/x+1o+p40ML5iuWJM=";
+    })
+  ];
+}))
+

pkgs/kaiteki/default.nix

@@ -2,63 +2,39 @@
 , fetchFromGitHub
 , flutter
 , makeDesktopItem
-, imagemagick
-, xdg-user-dirs
 }:
 
 flutter.mkFlutterApp rec {
   pname = "kaiteki";
-  version = "unstable-2022-09-03";
+  version = "unstable-2022-06-03";
 
-  vendorHash = "sha256-Y0BXQ7xt9w+J896ar6o+FiVGcDJw7dPHo7tgij+p6R0=";
+  # this hash seems unstable -- depends on other nixpkgs, perhaps?
+  vendorHash = "sha256-IC3FAPFASuMcNOpUuaB+MDcm9nqGCtq/6A2dCxIXHEg=";
 
   src = fetchFromGitHub {
     owner = "Kaiteki-Fedi";
     repo = "Kaiteki";
-    rev = "fd1e26c98f37ad6a98ed549da879c91721f997d0";
+    rev = "0a322313071e4391949d23d9b006d74de65f58d9";
-    hash = "sha256-N7n6o/B9s0DCYf9HFMZSCPShpE65wKl9FaQ5dbFnr1E=";
+    hash = "sha256-ggDIbVwueS162m15TFaC6Tcg+0lpcVGi4x/O691sxR8";
-    fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [ imagemagick ];
+  desktopItems = [ (makeDesktopItem {
-
-  desktopItem = makeDesktopItem {
     name = "Kaiteki";
-    exec = "@out@/bin/kaiteki";
+    exec = "kaiteki";
     icon = "kaiteki";
     desktopName = "Kaiteki";
     genericName = "Micro-blogging client";
     comment = meta.description;
     categories = [ "Network" "InstantMessaging" "GTK" ];
-  };
+  }) ];
 
   sourceRoot = "source/src/kaiteki";
 
-  postInstall = ''
-    wrapProgram $out/bin/kaiteki \
-      --prefix PATH : "${xdg-user-dirs}/bin"
-
-    FAV=$out/app/data/flutter_assets/assets/icon.png
-    ICO=$out/share/icons
-
-    install -D $FAV $ICO/kaiteki.png
-    for s in 24 32 42 64 128 256 512; do
-      D=$ICO/hicolor/''${s}x''${s}/apps
-      mkdir -p $D
-      convert $FAV -resize ''${s}x''${s} $D/kaiteki.png
-    done
-
-    mkdir $out/share/applications
-    cp $desktopItem/share/applications/*.desktop $out/share/applications
-    substituteInPlace $out/share/applications/*.desktop \
-      --subst-var out
-  '';
-
   meta = with lib; {
     description = "The comfy Fediverse client";
     homepage = "https://craftplacer.moe/projects/kaiteki/";
     license = licenses.agpl3Plus;
-    maintainers = with maintainers; [ colinsane ];
+    # maintainers = with maintainers; [ colinsane ];
     platforms = platforms.linux;
   };
 }

pkgs/linux-megous/default.nix

@@ -3,10 +3,10 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.0.0";
+  version = "6.0.0-rc4";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
+  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) + "-rc4" else modDirVersionArg;
 
   # branchVersion needs to be x.y
   extraMeta.branch = versions.majorMinor version;
@@ -15,7 +15,7 @@ buildLinux (args // rec {
     owner = "megous";
     repo = "linux";
     # branch: orange-pi-6.0
-    rev = "b16232c6156de17e1dfdb63fdaea8e317baa07a7";
+    rev = "6ada3caab0b37968f1257b3ea75e5b0466a77162";
-    sha256 = "sha256-Tb05IQKFdX/T7elGNnXTLVmgGLvXoeBFBq/8Q7jQhX0=";
+    sha256 = "sha256-jIhOE0ZMuoJm7NqAEJ4OTNLHN/h8i4cOphcw3le7RSw=";
   };
 } // (args.argsOverride or { }))

pkgs/matrix-appservice-discord/01-puppet.patch

@@ -1,13 +0,0 @@
-diff --git a/src/clientfactory.ts b/src/clientfactory.ts
-index b7fea47..587acfd 100644
---- a/src/clientfactory.ts
-+++ b/src/clientfactory.ts
-@@ -53,7 +53,7 @@ export class DiscordClientFactory {
-         });
- 
-         try {
--            await this.botClient.login(this.config.botToken, true);
-+            await this.botClient.login(this.config.botToken, false);
-             log.info("Waiting for shardReady signal");
-             await waitPromise;
-             log.info("Got shardReady signal");

pkgs/matrix-appservice-discord/02-auto-approve.patch

@@ -1,16 +0,0 @@
-diff --git a/src/provisioner.ts b/src/provisioner.ts
-index c1568af..28a44c5 100644
---- a/src/provisioner.ts
-+++ b/src/provisioner.ts
-@@ -99,8 +99,9 @@
-         this.pendingRequests.set(channelId, approveFn);
-         setTimeout(() => approveFn(false, true), timeout);
- 
--        await channel.send(`${requestor} on matrix would like to bridge this channel. Someone with permission` +
--            " to manage webhooks please reply with `!matrix approve` or `!matrix deny` in the next 5 minutes");
-+        // await channel.send(`${requestor} on matrix would like to bridge this channel. Someone with permission` +
-+        //     " to manage webhooks please reply with `!matrix approve` or `!matrix deny` in the next 5 minutes");
-+        approveFn(true);
-         return await deferP;
- 
-     }

pkgs/matrix-appservice-discord/03-no-edits.patch

@@ -1,14 +0,0 @@
-diff --git a/src/bot.ts b/src/bot.ts
-index 8bc73d4..1e6ea67 100644
---- a/src/bot.ts
-+++ b/src/bot.ts
-@@ -568,7 +568,8 @@ export class DiscordBot {
-             }
-             const link = `https://discord.com/channels/${chan.guild.id}/${chan.id}/${editEventId}`;
-             embedSet.messageEmbed.description = `[Edit](${link}): ${embedSet.messageEmbed.description}`;
--            await this.send(embedSet, opts, roomLookup, event);
-+            log.warn("not editing sent Matrix -> Discord message");
-+            // await this.send(embedSet, opts, roomLookup, event);
-         } catch (err) {
-             // throw wrapError(err, Unstable.ForeignNetworkError, "Couldn't edit message");
-             log.warn(`Failed to edit message ${event.event_id}`);

pkgs/matrix-appservice-discord/04-no-kickbans.patch

@@ -1,88 +0,0 @@
-diff --git a/src/bot.ts b/src/bot.ts
-index 8bc73d4..1e6ea67 100644
---- a/src/bot.ts
-+++ b/src/bot.ts
-@@ -795,82 +796,7 @@ export class DiscordBot {
-         roomId: string, kickeeUserId: string, kicker: string, kickban: "leave"|"ban",
-         previousState: string, reason?: string,
-     ) {
--        const restore = kickban === "leave" && previousState === "ban";
--        const client = await this.clientFactory.getClient(kicker);
--        let channel: Discord.Channel;
--        try {
--            channel = await this.GetChannelFromRoomId(roomId, client);
--        } catch (ex) {
--            log.error("Failed to get channel for ", roomId, ex);
--            return;
--        }
--        if (channel.type !== "text") {
--            log.warn("Channel was not a text channel");
--            return;
--        }
--        const tchan = (channel as Discord.TextChannel);
--        const kickeeUser = await this.GetDiscordUserOrMember(
--            kickeeUserId.substring("@_discord_".length, kickeeUserId.indexOf(":") - 1),
--            tchan.guild.id,
--        );
--        if (!kickeeUser) {
--            log.error("Could not find discord user for", kickeeUserId);
--            return;
--        }
--        const kickee = kickeeUser as Discord.GuildMember;
--        let res: Discord.Message;
--        const botChannel = await this.GetChannelFromRoomId(roomId) as Discord.TextChannel;
--        if (restore) {
--            await tchan.overwritePermissions([
--                {
--                    allow: ["SEND_MESSAGES", "VIEW_CHANNEL"],
--                    id: kickee.id,
--                }],
--                `Unbanned.`,
--            );
--            this.channelLock.set(botChannel.id);
--            res = await botChannel.send(
--                `${kickee} was unbanned from this channel by ${kicker}.`,
--            ) as Discord.Message;
--            this.sentMessages.push(res.id);
--            this.channelLock.release(botChannel.id);
--            return;
--        }
--        const existingPerms = tchan.permissionsFor(kickee);
--        if (existingPerms && existingPerms.has(Discord.Permissions.FLAGS.VIEW_CHANNEL as number) === false ) {
--            log.warn("User isn't allowed to read anyway.");
--            return;
--        }
--        const word = `${kickban === "ban" ? "banned" : "kicked"}`;
--        this.channelLock.set(botChannel.id);
--        res = await botChannel.send(
--            `${kickee} was ${word} from this channel by ${kicker}.`
--            + (reason ? ` Reason: ${reason}` : ""),
--        ) as Discord.Message;
--        this.sentMessages.push(res.id);
--        this.channelLock.release(botChannel.id);
--        log.info(`${word} ${kickee}`);
--
--        await tchan.overwritePermissions([
--            {
--                deny: ["SEND_MESSAGES", "VIEW_CHANNEL"],
--                id: kickee.id,
--            }],
--            `Matrix user was ${word} by ${kicker}.`,
--        );
--        if (kickban === "leave") {
--            // Kicks will let the user back in after ~30 seconds.
--            setTimeout(async () => {
--                log.info(`Kick was lifted for ${kickee.displayName}`);
--                await tchan.overwritePermissions([
--                    {
--                        allow: ["SEND_MESSAGES", "VIEW_CHANNEL"],
--                        id: kickee.id,
--                    }],
--                    `Lifting kick since duration expired.`,
--                );
--            }, this.config.room.kickFor);
--        }
-+        return; // this is about letting Discord users know when Matrix users are kicked/banned
-     }
- 
-     public async GetEmojiByMxc(mxc: string): Promise<DbEmoji> {

pkgs/matrix-appservice-discord/05-no-meta.patch

@@ -1,13 +0,0 @@
-diff --git a/src/matrixeventprocessor.ts b/src/matrixeventprocessor.ts
-index f1f4611..7b57ff3 100644
---- a/src/matrixeventprocessor.ts
-+++ b/src/matrixeventprocessor.ts
-@@ -278,6 +278,8 @@ export class MatrixEventProcessor {
-             return;
-         }
- 
-+        return; // disable all meta notifications
-+
-         msg += " on Matrix.";
-         const channel = await this.discord.GetChannelFromRoomId(event.room_id) as Discord.TextChannel;
-         await this.discord.sendAsBot(msg, channel, event);

pkgs/matrix-appservice-discord/default.nix

@@ -1,19 +0,0 @@
-{ pkgs }:
-
-(pkgs.matrix-appservice-discord.overrideAttrs (upstream: {
-  # 2022-10-05: the service can't login as an ordinary user unless i change the source
-  doCheck = false;
-  patches = (upstream.patches or []) ++ [
-    # don't register with better-discord as a bot
-    ./01-puppet.patch
-    # don't ask Discord admin for approval before bridging
-    ./02-auto-approve.patch
-    # disable Matrix -> Discord edits because they do not fit Discord semantics
-    ./03-no-edits.patch
-    # we don't want to notify Discord users that a Matrix user was kicked/banned
-    ./04-no-kickbans.patch
-    # don't notify Discord users when the Matrix room changes (name, topic, membership)
-    ./05-no-meta.patch
-  ];
-}))
-

pkgs/overlay.nix

@@ -21,14 +21,13 @@
   };
 
   #### customized packages
+  alsa-ucm-conf = prev.callPackage ./alsa-ucm-conf { pkgs = prev; };
   fluffychat-moby = prev.callPackage ./fluffychat-moby { pkgs = prev; };
   gpodder-configured = prev.callPackage ./gpodder-configured { pkgs = prev; };
   # nixos-unstable pleroma is too far out-of-date for our db
   pleroma = prev.callPackage ./pleroma { };
   # jackett doesn't allow customization of the bind address: this will probably always be here.
   jackett = prev.callPackage ./jackett { pkgs = prev; };
-  # TODO: delete matrix-appservice-discord
-  matrix-appservice-discord = prev.callPackage ./matrix-appservice-discord { pkgs = prev; };
   # mozilla keeps nerfing itself and removing configuration options
   firefox-unwrapped = prev.callPackage ./firefox-unwrapped { pkgs = prev; };
   # fix abrupt HDD poweroffs as during reboot. patching systemd requires rebuilding nearly every package.
@@ -39,8 +38,6 @@
 
   #### TEMPORARY: PACKAGES WAITING TO BE UPSTREAMED
   kaiteki = prev.callPackage ./kaiteki { };
-  # kaiteki = prev.kaiteki;
-  # TODO: upstream, or delete nabla
   nabla = prev.callPackage ./nabla { };
 })
 

pkgs/sane-scripts/default.nix

@@ -24,7 +24,7 @@ resholve.mkDerivation {
         findutils
         gnugrep
         ifuse
-        inotify-tools
+        inotifyTools
         ncurses
         oath-toolkit
         openssh
@@ -33,7 +33,6 @@ resholve.mkDerivation {
         ssh-to-age
         sops
         sudo
-        util-linux
         which
       ];
       keep = {

pkgs/sane-scripts/src/sane-mount-servo

@@ -15,5 +15,4 @@ then
 fi
 
 # symlink the fastest mount point into place
-# uncomment if i see the bug again: sudo unlink /mnt/servo-media  # XXX ln gets confused if the destination is a symlink to a stale mount
 sudo ln -sf $mnt /mnt/servo-media

pkgs/sane-scripts/src/sane-mount-servo-root

@@ -15,5 +15,4 @@ then
 fi
 
 # symlink the fastest mount point into place
-# uncomment if i see the bug again: sudo unlink /mnt/servo-root  # XXX ln gets confused if the destination is a symlink to a stale mount
 sudo ln -sf $mnt /mnt/servo-root

pkgs/sane-scripts/src/sane-reclaim-disk-space

@@ -1,41 +1,17 @@
 #!/usr/bin/env bash
+set -ex
 # script to reclaim some hard drive space
-set -e
-
-options=$(getopt -l "fast" -o "f" -- "$@")
-do_rmlint=true
-for arg in $options; do
-  case $arg in
-    -f|--fast)
-      do_rmlint=false
-      ;;
-    --)
-      ;;
-  esac
-done
-
-set -x
-
-# always claim nix garbage
 sudo nix-collect-garbage
-
+# identify duplicate files in the nix store
-if [ $do_rmlint = true ]
+rmlint --types="duplicates" --config=sh:handler=clone --output=sh:/tmp/rmlint.sh --output=json:/dev/null --progress /nix/store
-then
+# link the dupes together (uses ioctl_fideduperange)
-  # identify duplicate files in the nix store
+#   see: https://btrfs.wiki.kernel.org/index.php/Deduplication
-  rmlint --types="duplicates" --config=sh:handler=clone --output=sh:/tmp/rmlint.sh --output=json:/dev/null --progress /nix/store
+#   see: https://rmlint.readthedocs.io/en/latest/tutorial.html
-  # link the dupes together (uses ioctl_fideduperange)
+sudo mount -o remount,rw /nix/store
-  #   see: https://btrfs.wiki.kernel.org/index.php/Deduplication
+# XXX: does rmlint really need to be invoked as root?
-  #   see: https://rmlint.readthedocs.io/en/latest/tutorial.html
+sudo /tmp/rmlint.sh -d || true  # on failure, we still want to remount ro
-fi
+# XXX this doesn't work: 'mount point is busy.'
-
+sudo mount -o remount,ro /nix/store
-if [ $do_rmlint = true ]
-then
-  sudo mount -o remount,rw /nix/store
-  # XXX: does rmlint really need to be invoked as root?
-  sudo /tmp/rmlint.sh -d || true  # on failure, we still want to remount ro
-  # XXX this doesn't work: 'mount point is busy.'
-  sudo mount -o remount,ro /nix/store
-fi
 
 # TODO: instead of using rmlint, could use dduper: https://github.com/Lakshmipathi/dduper
 #   better perf for btrfs (checksum tests)

pkgs/zecwallet-lite/default.nix

@@ -0,0 +1,30 @@
+{ lib, fetchurl, appimageTools }:
+
+appimageTools.wrapType2 rec {
+  pname = "zecwallet-lite";
+  version = "1.7.13";
+
+  src = fetchurl {
+    url = "https://github.com/adityapk00/zecwallet-lite/releases/download/v${version}/Zecwallet.Lite-${version}.AppImage";
+    hash = "sha256-uBiLGHBgm0vurfvOJjJ+RqVoGnVccEHTFO2T7LDqUzU=";
+  };
+
+  extraInstallCommands =
+    let contents = appimageTools.extract { inherit pname version src; };
+    in ''
+      mv $out/bin/${pname}-${version} $out/bin/${pname}
+
+      install -m 444 -D ${contents}/${pname}.desktop -t $out/share/applications
+      substituteInPlace $out/share/applications/${pname}.desktop \
+        --replace 'Exec=AppRun' 'Exec=${pname}'
+      cp -r ${contents}/usr/share/icons $out/share
+    '';
+
+  meta = with lib; {
+    description = "A fully featured shielded wallet for Zcash";
+    homepage = "https://www.zecwallet.co/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ colinsane ];
+    platforms = [ "x86_64-linux" ];
+  };
+}

scripts/init-keyring

@@ -1,18 +0,0 @@
-#!/bin/sh
-# initializes the default libsecret keyring (used by gnome-keyring) if not already initialized.
-# this initializes it to be plaintext/unencrypted.
-
-if [ -f ~/.local/share/keyrings/default ]
-then
-        echo 'keyring already initialized: not doing anything'
-        exit 0
-fi
-
-keyring=~/.local/share/keyrings/Default_keyring.keyring
-
-echo 'initializing default user keyring:' "$keyring"
-echo '[keyring]' > "$keyring"
-echo 'display-name=Default keyring' >> "$keyring"
-echo 'lock-on-idle=false' >> "$keyring"
-echo 'lock-after=false' >> "$keyring"
-echo -n "Default_keyring" > ~/.local/share/keyrings/default

scripts/install-iwd

@@ -1,20 +0,0 @@
-#!/bin/sh
-# usage: install-iwd.sh <source_dir> <dest_dir>
-# source_dir contains plain-text .psk files of any filename.
-# for each file, this extracts the SSID and creates a symlink in dest_dir which
-# points to the original file, using the SSID name as filename.
-#
-# this is because iwd extracts the SSID from the filename, but users might
-# prefer the SSID be kept separate from the filename.
-
-src_dir="$1"
-dest_dir="$2"
-for f in $(ls "$src_dir")
-do
-        ssid=$(sed -rn 's/# SSID=(.*)/\1/p' "$src_dir/$f")
-        # not sure that iwd can deal with un-writeable symlinks
-        # ln -sf "$src_dir/$f" "$dest_dir/$ssid.psk"
-        cp "$src_dir/$f" "$dest_dir/$ssid.psk"
-        # not strictly necessary, but iwd does default to rw
-        chmod 600 "$dest_dir/$ssid.psk"
-done

secrets/servo/matrix_appservice_discord_env.bin

@@ -1,28 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:7j1l4XJ8cp8MVuSmOedOZwGDWV11hmwFyLW43ixUBaZLWbUZ6Z4P4Gt+o7bj8gc/X8aiPV8sxAR/jY28Sc5DIaAnkKnXjesPVlG0c3oRAsXemKGX8fANkoNX5iEPbWAkFiJdLS6Fgdv2g4z6DQ4odvZQKrMchx8MPYq8icBvvbhKiGs5xo+MGrMBVRCZOERM2FJSy/q9zLv6hU5SfnnYDTMt,iv:poHHiCs0YOCv74dQ2kyXogdgTUqmKRgGq2r7lcxe4bQ=,tag:rz1/FLC5Q8S13TTWNKcYyQ==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2TjVWenJkYVdjeExzYjVj\nUVdFeUdMRUtwOWJNYUx6dFRWRXdEUWJhdkVFClM1UnhtWndYbE91RCtVRnl4TGp4\nZHNJNUliOWhqcUorZVBEQWR0eXZaMVEKLS0tIDdsVFJ2bmdNeVk5b3FJVDQ3T1BG\nU0taQlA1QVEvYVJweDQ5L2YwTmo2ek0K+nbzpIpjAhRgJ5Lw+mx/doGMjw0aMNkZ\n5sAnPJo88Sa/TW3qBN48xFBMLWMp/SKs2JTaMu0xW0u2SkQX38TLlw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyUFBSYVJZUmRBcGJXclNP\nRDRUZnRKMmYwdFhQcE1oWUhrZGxNTk5YOFIwCldUMW92NGl0VVBsS0JtYjJOTW9E\nK2ZZdm9GK3FOMitUdEU3QStsR2svQWMKLS0tIE9SWXAzVndsdGY3Uzh2eHpBRjdO\nTVc4cWNDUWRuSWRmZC8rK1ZFS2l4WEkKQR9mApDjb0k14W3jK+CEz3Dez6wSBpg+\nZ7uUfSbPXFxRxvNEascRn/+EHPcd/A7MZjViDUyWVcP6fSMPsQvxhw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkWHlteTRDcHRneW9hbzlh\nMHBjZ2RHeDBIbDM2QXVxK09mcERVSUliVWw0Ckg1dGFkUUxPQW1HcDFXcEEyejFD\nWW5qUkNwRkdIdjRiTFJNd0Q5NWpLUUEKLS0tIG1wTnk1aEhudm9VZjZRVGRWWnR0\nVHlFbUJHaitadDVOSG1FMTBqeHJGV0kKAjuuw3j4dx3QfNcjyl8XCP9Q6oOkLZBN\nsW7uCqbVgBCG+uIggwefLWAy8g6PYlLj0aumgLPYVsXShbQYi32m/g==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2022-10-06T05:07:20Z",
-		"mac": "ENC[AES256_GCM,data:9WR8xfs5XIkWxDlJVX1EiSJBLBgWMR99PJJXCK9RcbuChK7QvjWjEflwq419qeNbMWdHLkUwSQrBsoHomaiGWFOPZ0C8bqcqDl0zzXMk7nBxM4UgTjRLmML2tdI2bCS0DC0AtytThYPvkW+JHgKB6bOAEw/bVWVP4YJQKWEf6FY=,iv:nG+J7jCdqZHp6x6Vlvye7BbK7YSl0Y9cjTWbW/BZLxo=,tag:OWqXktZE52Q3j7D2KG+vHw==,type:str]",
-		"pgp": null,
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.7.3"
-	}
-}

secrets/universal/net/community-university.nmconnection.bin

@@ -0,0 +1,48 @@
+{
+	"data": "ENC[AES256_GCM,data:Ei6XDLQznlR+FZjdpc/4Ff1yk386tvUw+v8eYyEVhlYWMbf3Im4uqdD2aylcthkLr/ypzTUBW/o6XVV/e2VtWLA/QBTM1uQKbuGKrlCxkW0uFt/L+ZzAGm6mc0EHBbRmiOLLbbZzQF3kxRlHsAUFwmuixjzjftv4ejo5jTKyK7r1DBt7Y4M8jb9paiBHGDxWmuc8wIkiTcLAlvKX7qySfl7zRO8EURI2h5YzQdcXqGLaZEpy22ktH5j8prAi2RYLGbCikKYqk3UmM/3c6Q4zI+BpF0eTpieUuUkzgv68lg/ek4PEeLa6cpPJrD/zuVlFKjVTzoo6779TFg==,iv:/8FfgfH173YrEDk9zGPUCfPjGvjEww1Q21/E1bL+YeI=,tag:0wGtRM5gGREWTefq2SGv8A==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxU0VtNFBIVlNxMCtLVXBJ\nZ0lTaXY5NnJvOElGV0dHWkUyK2V1blBOR0ZFCnJxWkhkVmRnR1FYVnMybUVHb3E1\nZHhGazFTaXFRRmh5Y3dDczJnWEZ6SEkKLS0tIGY0R2FiZlV2OHpSclA3RUdPa2tM\na1pPbUh2cGFibmFidUtQdFpMSGVrcEUKG81db/ZBzHNGV49Rgwc5hfeWc6uNbbLi\nZpPjZS6y14ZVMFoyE7XPD1+D7OL3BEP+rOwICrFXLAGKpyLEvBngBA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2MzlvUTdzK096ZkswUEJv\nRlF1c3ltKzBDQmVCcUgySVRhK0xMZFlhVGxvCnFIalFJb0lxMGlIdE51WXAvMVB6\nTkNjT0hKeTB5TDl3d1hnMXNoN1p2djAKLS0tIGNmcTUzZnIrVXl6aUhVYkpPUVRi\neFV1UWtwdHZvTlNEeDg0NG10bXV3dmsK4y9+g2cxRQvePeKhKjWvtO4/KZ7dG2Kn\nXGFLEUJAI9BG4PiJoIPjvXvugHndfahqmFtdbXA8mdso99QxbW4Few==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiTFQrMkdGc3ZBTFgwNVRO\nM1FOTHZ1VnVsWXlXMFBKR2NQajhmRnM0RXpzCmZ2QStTUllSelRIN3g3VnJQRG1Y\nalRKa1BaYzRPUXlwa2p5ZkxxVVBLNkEKLS0tIGd6TFNRZkVTRHA2NHNybWt3eDY3\nd2tkeXFMeVl5NDkxK3hOQkRJTXNiUlUKMrXMYYy+pGVmVW/ebmcKsAf2Xxjh0mJ4\nrWSUDmAb9sm2N9yCkkl5oQ9GRHHr3/HmS6Xek5Y8aJNdvuFJzkz8Og==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVeW5neXUxdDVjaGFKL0VX\nUDFCOFhta3Zpek1qVG9yQkYwdmlhU2N2T0VnCnJuai9qOFhIdGxzUlJjSkNaNFdI\nY0dOa1FaRTRGNU84YlNIWmg0dS9XNzAKLS0tIHdiYjlhWmNWUkhNY09nK2pPSEFV\nN1V4ZlZNU3JlQWdEVWZXTXh6UmNkWjQKD87Fm/TZGY33wqBedwHgkIhziUrKpSdw\nc8mRAUqjNdp4avomtoSAyhThPdilpKO0ES0NJiu9q8mqqK/aRwungg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDTjRjSXdVUDk2eTI5cm1X\ncDlhWUJVcWdEWk1jMVdUVEd1bytYY2tCSlNRClBsTVEwQmZ6cDZlbWpSd0NZMkt5\nMzhEVU93WVdkbGZDWEdoN1FvejJwZzQKLS0tIHVJKytaUStRaDV3Q01ZL29Eellv\ndGVMU25GWFdiT0FPVW9oYXdZbGJqNXMK0vdn85DKuobJo0baVLy+0hFvTonPJzoS\nD29tcM29rea+haH/EDRLXTKEXeOgQm99SBDaumgaUAraIiwlpDB9SQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlYUp2Zjdkbi9HTUh4RUZN\nemx0VUV0QUNFTitlNVV5YUFQUDErcTI5UFNnCmYySjFRcU5jMTJQOGNwdWtWU3lC\nWmxnVmxmWEhpbjZsZlRkdnNUQ0hTaEEKLS0tIGNCY05PSUhtTEZQejhDL01wbHY0\nSkNnNFVRTGpDbEJnMGUvdDlBQmV0L3cKBswixkjiGmJZP2sZ3kT+eJus4fxzORy3\nbM+6dRYu6O+1886gWVGjqcPNBnA9YPii0ClX8vhPWS/dPN0/k421tA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNRU00OG82bTZvbVBBNFdG\neTNOK3h6QWZEWWtlOUJEU2w0T28wcGVlakJZClZxR2VzajFpTmJLVWFQa1VUckdU\nOVhaeGcrYlZjY0c1RC9NWWY3cVhuVk0KLS0tIEY2SW5EY0I1N3RnM1h3VGxYMTNh\naUFXaWJoc3drMnFQNS9NTzYyK3VMbTgKGjnfsWmn8YfE9VqA4zMiALxfV1XW5FEr\nHsG3mTRnShcxiOO8XvH1cUO2tDZ3ekTz++DbA4xRvrd9aD87t56gww==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpL1ZpUGNJSkNBRUdkSEIz\nSXM1cnRwa1ovVG5NVE5URDlNeGkrSy9WOTBBCjIrTzhHZ29veGtMV1ZRUU9Xd2xF\nU2o2ckdSL3JjeEJuc0JEMjlGVXRuZ2MKLS0tIDFjVjVyMnFVVytNQVh2ZGJJUjhv\nMU1IZzNjaXJDa1lPWnUxTEtlRUYwODgKKWr698/3WsEmCrHSHFEG8LCsuQ/KyWmm\nDOMwUW6YBdF29X8tzA8845MTaOaWrPiK5f/i7RZRhZTekv1CiOZAWw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2022-09-26T01:01:07Z",
+		"mac": "ENC[AES256_GCM,data:RUWSeeRnF7sI5Rn748V5h1NYPrk488gMwf7lTJRjzJTGQJBuu+hxAeJsoeG7gWPxGYJp9C362dFyHzUYWyFmJqk+JK0p2wh6mFIDerfZS8lTxAEP9qtDcA1ZMFRJVm9X3IYq8CyOb/DHdQ1+ih7Oxbo5XDOyXMuDGvCCWD71N9o=,iv:Myy4VHpuWgS8mOJVFNkcbN3QyRIDl/h5V/YeOtPQ0kU=,tag:HaRPPUG4o2HRN0v70He0pw==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}

secrets/universal/net/community-university.psk.bin

@@ -1,48 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:JJk6bnHkxhfMNecslbm/iA2hdnC/C1DdeiesZrkUpJru8DMBs9ExhcHcYSRfxwzcZ1FDPLv3a9Mnickgb9uIz9UWbNZBfPUg2xEIHIs=,iv:dWqSRR+tCSXch0OebLQPzaBtNJieMHLFUeR7yXe4NTA=,tag:C/kAerUFRhugyf91puhKYg==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGQnVZQ3NvWUhMSy8wQzJM\nWkZnc09UaldLc3M4RjlKZjN4ZWY3NC8ybWk0CnRwTUtmZ0NMU2tCMmM5SzRnUHht\nSUg5MWpGV010b3N3WWU5UkljV0VBWU0KLS0tIHRjUER0RkhwbmVKOXBYR0RnbCtC\nd0hUd0VuZm1wQjNhclpTL0RLZnBybE0KA1ZTaq3D3UgV4g/mhwgss4uBE0LPuPNC\niFs7ixvRBF591VWvraVWUpTqOZW5dMybMBu5EjGHYtHl7f9dbhY5aA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDdCtBd0tjWmtyVGZmbHNJ\ncTZwa2xzd3VoN3RFcjZ6TUtLcUdhMm01Tm1nCnVvaDBnNG9jOVd5SFNiTjJzZnV1\nZkltV0RtYS8zays1ZVdKcENGV2J3N1kKLS0tIDF4V2gxdEoySDR2azR6THVGY3BQ\nTFE1ZE9rZ0JFZWd2TDd0Z0pQc0VZWmsKgFEfMB2W76AVPOTkGszqDLiw8aTGJ3Ym\n1Tv+OXtdaqcgD+MY67Fa396oJiD/K2zY5CfQvH2YV+VYNeAfZsRM+g==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCbGErdE5idTNnZzVtcXJy\neUJIbDBncytYVlcwandMUU9nRXB6TE1IUVEwCjFrZEU3VVltbVlkNW1MTk1LQkZB\nTGZ1Z3hJSFBsNEtQZVZFemZBKzZGUmsKLS0tIERpY29zZWkzcnJsRU00SDhhWXYw\nSE9tK1JJSlZpTTJ0ZUtoV0RlQ2xkOE0KCBuW93P3rgeaFewybt27fmA6BE9HY08f\n+0kix/idWFkdxtzS/v+WFHnaac2lhIl+X3EQQoU6PJGVrlV4q/qqAw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiNGZZQlowTXhtZkRMNGx0\nQ0xUL1hkaWtUTkY3Ti9BMHhKS2NtTEd6MmlZCjg1WFJVZkFwOE1yQzhQbWs1bThP\nQlU4dFZWZnJOWjM5aTZZLytiMnNEdTgKLS0tIGFuRFkrakZWMmNPSmVycEdYUnVs\nTk96RWdOYmlLUmYwNGJIZ1IxVk92R2sKARCSlcel/yqCPKDXSNNDV+ej8jU3CiPI\nMktemcTe9FjEpQzRDEQQJ1izlHIqpSwlOSx0UZsUgQOFFP+fwQGUaA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBZnorZkFYTkJ3d1pXMWor\ndnpjSGJYYlhCMWJaSnJJUXRLMlIzNjZhOW53CjZQdWVPdTN3eldFN3FvWW9VNmdk\nYnp1QkpoaW56bFdnL2Z3RjJERWZlK2cKLS0tIG9vUFJzNTNZVklob2hnWnMxaDNF\nWW9tV2ZJcVEyS0QvbGZaK0d4MzBIVXMKMtIMAwa+HJwAHhbM4NhLiPYgXbIZUzD8\nGwjFTyRi6K1vOw2/c+w0BYb1ZIvaChrsl9ISfU4+e3gjvSX1MP0Cyw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQenF0YnRscjJSQUFTbHNI\nSGNTS21LNklxaW9uTGlxT2pDTE5SZmJMUkRNCnBwYXRDUHJ2TDh5QXMvWjVYRWFs\nL1FjRFJyQ0hkVkpRWjNnQlVNczZjb0UKLS0tIGk0U1RFVVRMcHBLU1VtaHdxeXRj\nblRlekhIQmRYZnczcGNqNFQ0RG9UcDAKAbFvm1CGCqbd8FBbubfJNCjEFTO4LdfX\ncUBaV9xFvFD5Gy/576KBNUO4NjIEnd14JL93TC/okakJAsxnHMG/iA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCQmh1dE1LZGI4SlUza2Zq\nVTc4K2NWeHFxNXVmUzgvNUNDanlQOTZXOVd3CkthcWZRby9ZbzFlang0RytsZEI1\nczVodG52MFV6RklhVGNBcUxjQXZJWVUKLS0tIFExRjM2N3N1MUtHRWpGN3I0bjEy\nWHlJN2phSW9FMUVhQ05iSDM0dUkxdkEKoNIaw3OW2JfoPL6viItBWRwm78x5j12v\nlV0/Ui3MBKoKwxbzti25mxwGRshw7dwStuGpkCVRbp1Gx3JQbggrLw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVWU9YcEs3Zzk3L0RNZTFJ\ndDJleXZlOHFKNk5KUlp1REllNTFaZTlSYUY0CmdaYzU2aE40cnZUYm4xajdzK3NO\ncXlnalFZVHZ5bnlSc0RpQjBEMHBEV0kKLS0tIHNYSks5QUI0WkxJc3VBVjFmbGhP\nR1RIaDk0RnN3VXBBcmY2L1JBamx0RUUKnTymF1GRV1Zz7q0XNGLz61xkMXGuhoRs\nPpE3hFbQNrap+vf8NhpElJJ7dTnrndfZNftBco+YsocOxlVXWw52Fg==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2022-09-29T11:34:03Z",
-		"mac": "ENC[AES256_GCM,data:ozFWkM2SFgTicicB1l2pMCfKVvVxoUV7k93VyR9OWtVhUqH7DYgrKWFzFCwGbR6xBSMSIZU7haeVJP8r7n3S9wwQNu7FsS/PfqVcsTfpT+g5Q83vfdVFcFnV4VsalsZ8HvTQ3OiVbNVLn3J8M94KL+5ya8mf1oNHwq8xbAYcM6U=,iv:AtHuh1VIAdUqmazPbesmmYq6gXEBE241Ejos73AFkUQ=,tag:bM9Z//NV43U5buXJ7VMSlw==,type:str]",
-		"pgp": null,
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.7.3"
-	}
-}

secrets/universal/net/friend-libertarian-dod.nmconnection.bin

@@ -0,0 +1,48 @@
+{
+	"data": "ENC[AES256_GCM,data:gHFfxCihZwMfkgoTjRL4kKduzV6IbNIlIFPqjFHOFYBSOER0Olr/nxOahL3yNCcvKtriGa5zfBkAUQYpsGuknkUta6FfOLNNmyb1b5qajlLClaDWTR7q4ZAUacrdbFOjPtv1ljawADD7BWIgYPPtqwhHq354r5LpziF6bnmPkBU4PQYftSYrBzsOu3Ko1OyRogRWB3VzmMbEKyvBk84A9enNHOSHZDLv297AN3XC7n01oyr6l5kdu8TSwqIW+5lkLcQAujl4iq0n17LSdsZthYKOmkmlxLtJXNzlpBLROejr7PstQNuEhM1fgvPswIl72qiCsu00I5QOTW7sxkIjK2XnVVeMpIJS/ciy6Hrf7n+n8yVUHOq3gEC9YLwBvSZD,iv:fPze55Cmr7Pm3YEsU+dnwloEwjRPSx4DNSF969K+ijA=,tag:FmZFMbE8Sx1ix44kYoOVSw==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5RzBlN2VsUHV5RkZJdStF\ncFpiREpWeWlWMzV5Qk9Lay93U25TS3FMQ1hjCld1aWFjRGc2bXV4NHVFTVhYVDBR\nZDRIVFFRN05aQ0dVVkdxZHY3b0Z2TEUKLS0tIDF6NTFUM1ViSHFrSHlxS2FaR2tE\ncko3L3d0QTdYc1Y4V25ZdEVReWZkOTQKR7UzugT3eRyymjY8nT62OhLjScOv1BYj\ntmWjrK3y/DJcngFw/w+/xHGRJnMK73r90pgyukXXTJsbOJQmD/+G/A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDV2FUemlkKzJTUGpmVmJw\nNlJ5RGRGTlptY3VhQUtPdTRpRVNsU1lHaGxrCncwbnVtNlQvbE1pYkNvaHQvZisw\nZGNTMGpHcUhuRXMwRFRZY21NeEtTTEkKLS0tIGVORGpUVHpuZS9KMWFNVDZ6bktU\ndERnWm0yK0ZtN1hDUmZxOG11ZzJkc2cKgGiR1ZMbRTRvNBSwTNxemOepggOgaSn+\nnNf/2E+YY4i9dO1H5E2daqZQ9V6ohCpXC9v5NGMdPOzTkfXqOGwngQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAveGlKbUd0bENaSThaWE9C\nTXE1U29aazV1N0JsKzNiTG1KYS9Jd3I2NGdzClV3Y3FLK1JVcnlUWkJlUnErZnc5\namRMRm0xYTI0cnM5UzY0NnBteXFnM1EKLS0tIGZLdVRacHhoZkZnSUMvNndMQzdy\nUEtVL3NVb1B0ZnkvZjZYSGJvYk5zTmcK1niMCVoVFlBnkXn8zPDUNAuLBwxKpBAS\nP34gwYWst5Eo6lfPbC/R/3DIVWMgPnPmKxzwO1QQcRPS8wu2iw++EA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzUkZ6WldkS1NwMmc5ZVBI\nSWlVSmp0eFFVbVl5SDJGb1NSUTFlTU1NVDBBCm5jSi9HSTJTSFhvQVJmS2lDY1ZD\nSjdyNWlMZi82Y0FBWmEweVYyU3dBdmsKLS0tIDNNUWw2UWNPZXR2QjZGMWFpdXVK\nczF0RXNBR01QY0xwV2MzUzc0SkQ2SU0K9ZT4/l89s9kB0SrK+1STUnlMUgnGVtH1\noV6Xu4berh8t09paiqzKwjsCMUYAIhm12K67YJpiJfZiua9CK9fQcg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvYVZMR0RCM3hmWEdmcVBy\nYVJzcjBwZUZlUTNscUlWbDJQWk5RSnIwdENFCnBYRHQ5SDVFcGRBTjhRMTgwUjBk\nQzFEYVFxMTNHc29xSTJuS3o4Q1ZFdFkKLS0tIC9UZjc0MWJKa2VKMGRvdkhFbHo4\nd094RFlyL0psU3ZqMmpqK2NVLzZuSHcKwmaO5Z+qlZGZumjg8IBlr7cQZYsSzVoD\nYW1sohyOabz04Wto6IwL2XFJIG2rJMrynY6JY4Np++w2hjgwbVXkEw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOdy9vNmtsM3hjOTRkS014\nTWtORmxmQ0NIUHRScXh1aS9sZGNTQUF1MkJjCnBBODZUWlVFUDFCUmJQZCtsdy84\nUHZ6SDVqMmRrZlRFcWwyRHYxbCtraHMKLS0tIEU3Z1hjQ0VQeGZNYmhSK1RFU2xv\nWUNiVjFhLzRrMHFvdFJYUU40bzlmclUKI+Jjl5h+GANpSEoldLlxs1tggxAqtatF\ndpvt8Boa7mSDgEMrzI43XTVmMoz6Co2NJzaryie+jlnEsmxlxZiC6A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHVk0wSXJPRi9UYWd1a3FG\nTGpTN0tOejRMVUhzRDRvZzRnTDN4eG04TjE4CnNsRXZ0UC9ucWFWZ0tPVjFXNERn\nRFRWOTF5RGNEdFhGbXI2eFBrcEZLN0kKLS0tIGVNazZ4N2FFNFYxWEtqMFJucXlS\nRnNaQWNFMVIwaDlWUnhnOElxOVg5Y3MKgLbtex6wdbgjDhT+/wFs6KrZjMsR3gpo\nhqtt4zhTJnxjdaqMyn92ESQ8t1Fs4a74zpdzABYqEdDgYd2ORQim0A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArZlJQMXFBcEFDWDBhWTFa\nSUVId0V3RzV5VExhOEdLTTlUd2Uyd3M1d3dFClkwWWhJSWpoUmJzMW4yN1p1cDV2\nUDRTNUprdGlacWRiVUJGSXQ2R29YZ0EKLS0tIGthOU9TTTY4SjEyYVlCYzdzbm9X\nMkhSTGx4TjdrUDBRNVIxbm5meWVxRVUKdGNdKElkDW/kmyoJ/QM522A15XFqmUlA\nRkbszSXVAqWRJ9GsLYnvH+9D8Vt68dV/F2tN+IqRSn2ri7+fmf2ayQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2022-09-26T01:01:37Z",
+		"mac": "ENC[AES256_GCM,data:Y0OiO9/jbF1q2IAUxXZ+Ku6i+quG3pQwVc6h0P0xM8M8m3E3aDqrxloJgcuC0GxXhDresLERWSzlNLQOUsNjDmztSezTGqlYUjuezO3YXtpmAkdVMqQOIoC4lg9SnociVSn71WpxNOYNaPpwwuYuuieuvAq6k+Ny847dlkARPts=,iv:f3R7QxsjfgI94g1PwZ+R4+wC4P9wb23kp8U79e0Z2+E=,tag:pB+glpdh3/kcxw7cJbUPeA==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}

secrets/universal/net/friend-libertarian-dod.psk.bin

@@ -1,48 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:iRxcs8VpOA6dFng9B3wHwxpEx0hhLpKUb+Eu09CFzPiZKPfQ00pecfbpQeXJpT4uvVxmkl5zuGkksSzBEJDBIA==,iv:Ii65q3V8dGz1TfhQNxKa7gSM3w8T9mnP3C8vUJpBbrg=,tag:ge94QompXmUtdl9o7306sg==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZQURjcVlTRDNRM0IwbDdB\nRXJOM3BkTWNhSXBYRkRicWlFbkR2QWJtVUFNCmZMeEs2SmpuN0RDK0JFQ1VUOHdk\nSnNxSkxPR2R2cHNZZ0c0SGtNWXVTZGsKLS0tIG93T3JCU0dTUEFRNzg1L3NlTEpr\nWlpHcHhKcTRKM0tZd1dXdGxlMTlyVEEKt8dheToHMyd/kGnQoUoerdIaexgY1jb6\ndOYZfwizrTE5mhYFzcApkChnjSHWfPTlWE0EzG4pBkTGkmoAx8LU0w==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAraUp0eHVGYnBZOUtMOVdu\nMTI5ZjBraEY1aFk1ajVLcmdqcGhhRzZ4UzBvCjVXWGtBaytkdWVnMDBEb1R3VWh2\nZnNYVzljMWRGYjVzZng5c0p4aVFXTzgKLS0tIDlVTzdrZENZaXFLWEtZWXUzQWFR\nTTFLYnR0WUgzcFhMU0V0VzcwQzQyV2MKdPvZdrfidA+k+PO9q7ruNlAbLkj3Hcvm\nvDcsTlYUA1ZG5SBsEhsztzNa7dSDX4EYrf5j1WSPu0/a0UYXkrR20g==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrNzZUc0hVWVhsKzVFcng5\nQ0VnbWZyL2RwT0FIMDhtR1FBNmxEZzR3OFhzCmRTTnpxcCsvZ1dvaE10NHppVW14\nVk95bUlRck5jUU5kWUZ1ZDVFUkdVdDAKLS0tIDduSWMydy9Gc0hmQWU4ZkI3VktN\nd0xUeUdYbExYREcvazlZZk9uSjJtZzAKkTW5axKqwBuo75Z6bGI3+4wXf5ilAXaO\nQOhyWWTLTdnCq0TOPt5eZlFgMleOsJD66wHTQR5Eb+Cw0+9w+XZmag==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLWlBSald4czhxRGNoR1Np\nOElFNGJsT1M1NWRpbXF1bmJ3eE54UGVNbUFRCnV4K2pQMzR6ZXdqVU9yWXNqMTQ3\nQ2NzUkpNdkcrSldqNks3YXlyS20wTW8KLS0tIGVaVzIydEtHeWZiVXRZbnNiNEJR\ndXp4WmxmRVppYWNDaTNoUTVZZ2N2LzQKPRFZQD6TJXBewxurVsHlazTE0HsygOVD\nRuTjEj+F9DRVc4scne8GhHkQYUJSe1iVsb31WK9/JNpXBpOaSNvZUQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZZlEyMEJOay93blhnUGZ0\neEhreE14b01Wdk1CTW9TVHVTV0pmZ1crNVFzCitiaVd5TjNiZWIwaVcyL3FaSmtl\nSzBJZVVGSi9tU0lUMk54UTZIZm9YMjgKLS0tIHpoK0ZVVUY3enZoNDhXSlVoUi9p\nUmxtU0ZBU05iVjdpSDVYc0tuamdHcDgKUzf5zX9oN63tHY2fYFAUKShS+rJIg6/2\nMX/QUGUDT44TBSw6forKS5qrlyuMkxr3PpgB1+P2isZNR9UK+dOcmw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEeStqei9pSmcvYU9FMDlQ\nQ2lNWXhjaFBTK3p3WjdoMmhKcFptYXA2eHdFCnFHSnZ1ckRNUUFDa2l5L0tJM2pD\naC9LZjY3N053Y3g0RFNKYnhIdUsveUEKLS0tIGFHZDJrdXRReElxcTRXY3JNK0dH\nSG9TNHFFUmtidWpDV29ZZlcvNERRdW8KUqP2zeYjBv1JhAjZMIY2LByZahRwhAzo\nLsCb2/kp1uWF/2jYllFmP3mtxJE3cijeHuN/1cwaMkJfFr5pyR1feA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMcEVzZWhoZzYvbVBCd0lD\nQzJPMmlvN2F4dlJUN1pQMTNKQ3lkb01XaWdZCmhHMHh5Q25aeVpZN0pNWVAvUmpr\nMGg0cXNyNFRuTVUySG5pUEJuTXJLYU0KLS0tIEk4NXNGV1RWYTdvZWU3QllnSXNN\nZ2JPNkZHMFpxRHE1Q09KN3kxbEFaQmMKAgmnPBq25Be+v4UJcYZXG6Cg4RNUI1yu\nw3HK1X1TcI1M4f7PuChbPzhp9+LVgWNkftDoSTjq0WFKsBlW95alRw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrSTFlZ2s3dGlxNi9pV081\nSjI3Q2U2Z0pxR0RhUFJ6cmZWTFVnNFFUdURJCjJkRkRody9KZ1EvMTRNOG4yaXNa\nTHliSmE1Y3dKRTIrNjFzMnpuSmdYVkkKLS0tIGxaYW8rUHk4clo3aGt0VTJlcGZ4\nZTdVTkxrNFRYS01Wb0ZYUTRoU1JocVUKX6VXkWHWma+3D8Vd6OC72mIelgXWMbrj\nwRIO2fHsy9M+TBQzHHxhdCdKefAYMu/hfXEFL47/Wn5yBJmSWjYEeg==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2022-09-29T11:27:51Z",
-		"mac": "ENC[AES256_GCM,data:dgJ/bcxkcCrTSAPKDa4T1djvZVTnWofmb1nTx+V3X0C0g0xCYrffpcieSPusKoQC+AzaZSy4H/RyLlW9We8+t41hrWdjdPkGcLd7n2u2e5o/AIgdSv/ODdFnX2E13ZTKMnfI7kUHsSaNLUF7TvitdXCO/hICGkGoJwRFwbV8bxU=,iv:WeQByrD8To8wqOwfbZYonci2gTm42Mv94zKKKNufq2k=,tag:avhJCmvNdZhkd3mTtx7cRQ==,type:str]",
-		"pgp": null,
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.7.3"
-	}
-}

secrets/universal/net/friend-rationalist-empathist.nmconnection.bin

@@ -0,0 +1,48 @@
+{
+	"data": "ENC[AES256_GCM,data:0EjWtJmTwjKtNX4fV4SMWgeTFwvDbUBmiEdkVLhd62EU5Tk8hkKLlFLeZtkS7bvCxUDZnowRtIYuWz29Gv/beydtHmcLZjDHgB5Rew2VSo7uVTkOJtfeHuVs/qj3soYN6DrIY0qJbI+biL8WfkExxvodgzN55oGcQRx0+PLrpn6mCoDdxdVXHgUxhWKedOVxSiK8YaYSO7uspRMhe0ukJrIysUgIPZue2KCh0Lr01jryYCEe2JgTkz6wv/vGMB6vN8P7MZ5N3DqYwKaz7wGCmcQogXJJzSFxRCIwusWs5pmHzZ3pkloK+xR26JGR8/4nlPIi0wulP2wuFNQMam2okSvv60TqEodBBgoP5xk=,iv:ahlaBYrX8lR61f3qlAY7TDS8k+qxpIXjrHUUaTDsWFo=,tag:mO78yMIWUXBkM+P6UIiJxQ==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzUTEvZFhXaUdaaUVNMW1v\nYUxLMHF3RmRuWXpzT3lRSlltcHJDV0N6aUY0ClFzMVkzNy9YM200aUhqaCtlNG9q\nYS9zalcrOTJodXN2UkxFZXltYXZSancKLS0tIEFrdzFsNnVGUFlmMjJYZjh2Rmpj\ndHR0aFpUQmR6M3RsL3RxcHBzeldoWVUKdrg1fyXCXaKsadvyLni/sb9nQHHEXyMb\n0CS8SSxc3XE8qtOr+KDG81NnEKagz8CwfJThuNom6uPShFeuIrXr4w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXVDNiM1lOdUF1Qk5SMzVa\nQ3ArL1hxdHREY0UxanF6amsrWWpBbDlVMTBrCnd2dHhXMnJHWmFuSUNsYTJ5Vy85\nZitZOEhxY095U3pJSG9ZVU5mSk9NTmcKLS0tIHEwclJSZm9MMzlQVHNtUTJHaGox\nazlxODNjcnFnYmd6SzNlMjhncHRWYVEKdaHIg9/POjzVu5PDVGsL3hbFV5vG+kCA\nNpEKnOYD7qNvGFVffVXmWKbid7Djl+hllVA1p60qcMD6mKujObBbyA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOL0t2LzBONmpOOEh2N0pM\naHBKRzkvUmJMdURrRlNhUHJDMVlNdTBTOVRjCmN6aUhLc3VyZjkvMHh6RWs0cWl3\naStabGxieEJKeHZiaWQ2YmJIREpKencKLS0tIGFSMmVrMjBnbEdnVzAzMk9FWm1T\nV09qazRMMEVrb1ZsWTQ0NEQycW9YSTAKF2AfmSY0AyK2IBcs8KLY9qPem0fMqafn\nQP/ZYnZ8HxUdTFn8O8WAo9tPGd8FPIwa7h4cjHSCgeIE2vsp44Ggqw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXZWhhUEd6aUFGUmhMcHNM\nZ282WFJHZlM0UmI5SWkzbmRHY1FtRmFyVXlnCkJNRU51ZnFRVkFWNUt5OHZ3ZlZh\nQW9sVGZPQUQvUytVYzBMdm1KdnQ3UU0KLS0tIGtOSUpXNngvUEswWVNxSjdqZ3NK\nUzR0ZUZWN0VILzdnbTcrWkxRVThGczQKHY+9t84/DHfL9A8xuH4ywJOft86E9IMw\nTzuXWaNuveew7lm6ftyLCIDyPKuPAbHML6GGZ/eTntYvihm/HtQOPQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEM1VDYjQwTTA5R3FBTzZs\ndXN6M2ZjSXRiMXNzUVJadFJNUU9xWmVjTFdZCitLTlVZOW1YMERXaURFN2JXRUhv\neHFIRUFwTFVteW5BTzdHZnJEczQybFkKLS0tIFhiQk8raHZsRTRmTWRRNUpLcG15\nRGVzRVJIdEl2VzdOVmt1RlJHSFpKbXMKATMXl7FxIZjxHB8CDywi9w7oObw6KJNm\nc/3/z8Sd44jVuJF4caihhz5s2zqRCkZX97g78aGRJJkDUSuVpukk8Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArazV1bFpvL2NhQ2M1OUk3\ndE9pbjhzRHJtSEtvLy9IQ05GdlFBamVUTFI0CjNpbUN4YnlDS0R3b2lEb29SRmJu\nczN4SXBueUoxNmV4MjlwR3FIdHNET2MKLS0tIEQzUUxVRCtvTW9vNTNHenYyRnd1\nTUU5THN2TnBuYTNLZkc5ZzVYaGVaNm8KjJv+na2x8y9W0zrCnImInLIPwQz3sAAV\nRSW+9FCsQg6XoVtzZNHKKWMgtwLUnwLKxD4MbnWOJl+gJVYtArKryw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxTEFpTW5UWDBpOWlOS29C\nN2ZFOWd5OHpxdzB2UDY4WVRjVWhUdFdGdkZzCkdtejVzREo1dkkxVHNiaUZ4Z0FV\nOEZRbUlvQ0l3WE11L0NCVXA4NUUyVE0KLS0tIGgvc3FIMFI5UjFBa3lidUgvVTZl\nMnRIN1Z0YjZUQ2dMdFlxRmRmdlkwSjAKTFYzmzEAD+WoZ90BRYBgXNGaAypL7aao\nKHMB0cdIEg7ynxB8cEeA1VynYQ/H8SKau7s9CKjGJEN2kqQ3R16l0w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKZmtmUm5adzBUT1NHZTJw\nNmFZZ3pHNG5vRFgyQkFRWVNnTU9jNExKZkhrClk1OFFBdDlyalFNMzQwemt3UjRD\nRkRqUlI3eE1RVUhkdjBYOStKNm1qYzQKLS0tIGRtTHA0YlFCMjNLNllBZUp5NFRk\nNGl4VmdxRmg0K2JJc2ZQY1FSZXhOVE0Kfz3g/XU5NloEqn+rpvYBNRXk7bF5D1Mh\n6PqvdxzDBWODLSpC4gDenwHAukCANdR5khZRuP2TQXXHof0ckYegmw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2022-09-26T01:02:04Z",
+		"mac": "ENC[AES256_GCM,data:/EkX5suKDBUSs2SqJDh7+juCdzDh57qmfUMNVFjLW8ASOt3ltRuUyYykNTiDrN3BNlzepFZi/1Fu8C7GZGjB4j/6YweT8oAz3cBQlcNcal4AWG1Q5JG3izoEPs7b7+ouBHrRR523FacPTKYftAiASOK2z5/Bbf3LZUN2zwBQy1U=,iv:2HNBbJiXBNbhHZbcTYEuV3SZP4f71hiNYWes4Tbhj2k=,tag:fgMjYlHaFBfujuJuu9iu6w==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}

secrets/universal/net/friend-rationalist-empathist.psk.bin

@@ -1,48 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:zhMmmsRibiS5Akobs2hEZnyFZRitEyXguYolhUmXNSMdhybLWealGNPF5D0v5MzEV0dhncmvXs8oz3k=,iv:xtQtYnbXfndMyB/I1ruL/F4k0omQeShDP8QuaK2SVkU=,tag:MfxdSbk3OR6mBVggsw2I6w==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1T29tc1Y3RElhY1hCR3JO\nMDMrV0VGdUVLNVBsV1VWenlXRCtucDhZbHdZCjdnU0ZjOGN5Vit5OGxqL1RMaUJo\nT0ttZDFLaTAzd3g1Nk5VMVgrMEt3c1EKLS0tIFJEakR1cTNETGpVdGxqTE5xVVU3\nWGlDZkY4dGZPVFIxRGJmdXF0WFoxS3MK7xGioj8OTPTL+WGYRjJbXEHbgU20qoA4\n/usblY/fawOBNbAGttpSEWyHb1qlQTWwVl00XNb/LqUd/Qa6O1uoiA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBySmQxSTJOVmtVVFhTMmxN\nWUFpekVqZzVZSXQrRW1ZYWk4bWpSbUJvV2dRCjlBLzR3YmxlWGQxYXI4MzdQVkZW\nSlU5QVhNUTNrMFM0VVV0dkRnLzhHVDAKLS0tIE0va3hhNlJCR0VzVVVNQlk2bTFV\nZXpNS0JvS290TlA3MXYxWWVueE5TNU0K9cq49fk1ip9CBAoPkifyZfY8NqFo5zgo\n2UsL9qla2F/DzA8Kl2l2DXaU9PaRngrj8AoFdvtUtO67r0NwmQ3zaQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxNGVmWGJmUzZweXVCUzlK\neEI4VUl0V2t0WFFoRDAxZjZvd1dJRnZ2VmdBClVXZVZpd2lhMEdTUFlpMUZjVmNi\nV2xKaktRbmRtVzA2UlhJVmZtcnErYlEKLS0tIHlyME1OdHIrWG5uODQzbmt1Q0Zp\nRXJLTithVXBnditUc0tPd0dJYXZjMlEKWOL7CXR0wn8TkQtuBssx6cErNZQdonxr\nzcDUJeAQ6SPFsnyCZ6BH972z0izmRkHYaqVRj5Pl2Ogrr+UHIxSqeQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1T2VFTlZHSDdvWWFaS3pO\nVHg2aEdZNDd1ZnFwbGpQWE5MYkdPZ1lkRWswCjRuQU5zN1cyTXRwa0ZaWEs2Qkg4\nMHZGWDBqSE5kNHVCVzRqb2JEb0lrSFEKLS0tIFJ4Vm9RUm1WZXdXcHVqYjNBMU1W\nT2srSGZNUUFZSlpaM2RyREk1aHJab1UKBpY37flWrKKeRgjs2BzWof/6E3k3DZp9\n1b/Ctvyebvxx0C9jxBzajqgbVahN/167JGwHrz87vTqp8907sFEbkQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDN2IzVExDUXNwTlBDVndz\nZERnUmxTK0Jqeng3d2xWMVgvS3h4M1dYbm44Cmh0YnZ3UmltaFlxTXY1VFN5dTNT\nSzY4cjBkVldESXZSZndrMUdMZDJNQmsKLS0tIGlUOHZoMXBjNFFXbno1WWxsVEJm\nakUvSzBST0t1a2o0RG9zVXpOWlU2NWsKRJ80nHXMzEwPS0BZIAT4KKTDYtxufC3s\nFlcLzDQVVN+JLAdu9viayUrLrKfAaKvPKGY0YUFgIV3YyA4/vBLIpg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWUmxSS0U5bE8xdHVmQkpz\nZ1JrdlVHMFF2VFJiMFVMejJGNU1xbStJWXh3CllRYWxyT0dORHlSWFVMeGcyMXI2\nRy9lM0N4L0w5VDRMK0dueVV6OUE5WlEKLS0tICsrQ21FU3d2Q1hoNGZuSGdzUkxD\nalhRTkNZNCtoQ0xmRzBYMzlvRnlNNEEKzL4v1ZRwfJ9aYHYZZNwrsHzXeZdQzk/R\nw5BdRWOqrTpk8DLwCxYO/bwxieidocaBhUufDZFPqooxSz/s6HaawQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByVTg0MzMrcEZobzFFaVVv\ndytJeVFjRnVuR21vTlJIUk9rUHVBbFFiREFNCmxxMHQ5bjRqQ2x6Mm1yeFN3Q0Yr\nY056bXZmSWVuQUxWaitIN0Q1RE91SjAKLS0tIGZCZm9yTE1tcHZoblBrekcvQndn\nZWgrN0FyQklCUHBFSWpheS82M3ZKR1UKD5UpmL6mPXVDyOP++o7+MTRq85omDmbg\nINDnSX/CiPfLb09GukRLMymcaVvBJqKTmySalgHSC+EKTo5uXBHehA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3NU94L3BTczBuekoxQkxZ\nMnQ2T0ZYcTdrYWZqYSt0RFB1Z0ZRODBHUnlFCjVob3JuVHJ0UXFBQmVaT0ZJRHVq\nZ09ScWpxaXl0Y2ZJZnpkVk9HSE1FKzAKLS0tIHA4YWJ2Um1QeUNlaFhuQksxQ25I\nM0VSbmlLVktWYW9aWmcyS3U2WnRiTWsKqa31gg1zZ6qTkwTsgmqM/Rbd0PSk44fA\nxVN8wL4dQNM/JvSYLggxV1vPvUW9Y6f+Ch+moFrtcKdOy8NDipNHKQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2022-09-29T11:28:38Z",
-		"mac": "ENC[AES256_GCM,data:SvIBnGuNXzR4ZWlsIJ8e1J5UoYciQ+howQmFFqEDcu/lZupvv3Ns+YZ/J5nm3Zpl0j0YGoAXUBBvENfi4TS38AMqkA0ZxX7fqfd7I9+RgCMaKyo/JGLwO7Ef6+7wvwiNVV4y3OpPkZC8AB7157d4QEczb32X1aQtRdisWQnaBBs=,iv:huJ6Rr8dWW2GiYv06DU133iFUHpxzpzI50QRlFbaeb0=,tag:of3scYamp2AFXN6h/cY1bg==,type:str]",
-		"pgp": null,
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.7.3"
-	}
-}

secrets/universal/net/home-bedroom.nmconnection.bin

@@ -0,0 +1,48 @@
+{
+	"data": "ENC[AES256_GCM,data:CxIMcl3XWttHWj+itIiQLg10SCZnODo9ORLxfRpkktoMMk7/Uk72ndjOM4TQX+vSnNkjm5Pb7i3dIsmX6jJCtUXjEEJMZou3DjDLcQh4TkXJ/yoEJkZhcucNmI8Q9lhtEtlVarM8B9l2DU6Ltl1feTDv4CqELw+ai38dBoZsw6DHFQfUuavNR/yc4rQjlh9ZzJrhGtMD3Pv0DLPrrD2O/IiGHgFxUmRktiNZGmH2QS9hUq6zYdiT3VY8ApIKnyCWGoxBxT/JIwggvLBuYOT1R+50WCpATR4H6i5QSiHAzdVYihtpZBOydpiI2BpP5yXUH6kIOKQ+NYihiAAQ+jgF8hCx2cVU8879zRrywFrKlaYEAxcifjwrx1TQBY9hGRdthkeTDVe+/71Rl0DEhKJ5s65nmMtRx26gKp2UMBNMRJ4kuslfjTk=,iv:t5vjs2uKDETv8xrQrlz6J8YQKnVmpiIxcAHLcmTASW0=,tag:wjiIsqT53lwNEmo1NThJVw==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnVWo5QmZ6ZzJpMG1oLytJ\nZDVsQzU0VnN6Y052QmduRHBMM21wWXdmaEM0CllhZzZxVkhBMFNBZDUxSnhJaUtL\nRndYd1NPaENJUGxFWUN0Q2c2OGlJcGcKLS0tIGF3Q011SXRWTCt0MUljMk5KZnlS\nS2ZQcGVobGJ2cWZjVDFNNU4yZUFRQlUKYsIGUx7V6pwKBzI507ibtc2UfehwaYkJ\naiGoTk0awOF1Dh+QJ9iIix0yvlFVR1b58gzV8L/IzoP862x3nV5Ixw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuYSs3WThMNVVSV04wczZt\nVVFJOXR6M0lvSXNTREcxeTlnTDFFUTQ0Y0RjCkVzMEEyWUl1eEg2Um83bXFGSENU\nT0xpUTRPUzNBbUxDc1FJd0RoZTFZTVkKLS0tIC9JNk52bGVUa3pIZ3lSb1hYd2dz\nMUN1aTVKMldGUXFQVGVkWXRORzFGeU0KMXI0kKQ+LUjpfnijok5IFeU4eGJy3EgE\nWzyHN1e5BgyqsXHgayTKcM+PPghKje7W1MFQm4CFJlDfdkAOpY2TYQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlbWpVMVNpNEtXbUswdnV5\nOTl0VDUyamhmUGxNenRNRmZXTjVseCt6RndnCnBVWjBDOFJZNTZMeE5tWXF5TVBj\ndHV1N0EwUHhzNmpCSWF2RVd3NFFvdUkKLS0tIFgxVW5sWFBFZm5tdzVMejBwWEE1\nalc5aEErcmZYMVkzKzY4QzdIbXNUZUEKzjNtuYud4Nzeut9eDU0qXF+Gvcn4sOlu\npDL1ptq7/roDblMeM1YmBU3MDyxqdy0MKrsCUymRwOxndmBhV3hDnQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5S1hmQ2E5YTB0dE8ySit5\ncDRlLzhDV2FIMHcyVGhvQjNiUFZ0WFlyUUdBClpMMXhlQ0ZISitMV3VnS2JBVldD\nT1RPSXRlcXhoZVdRVFdiWm4vQ2duRFkKLS0tIHFhRTg2Z0UzWld3dXFvSFVaYkdS\nVC9MeVFUdW04U2h0UE1VV1p6VkpHYmsK60UwN8gc1Beo/y7SwTmP9A/d8fDzWC+z\nEy5etxod2CBfJ8RfDJutsQH0otyEbWYqz6FfLqaLWn8KG1m0x8rnUQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYSU5WTHZLUHJYVmg1UkpL\ncjJscFJ6NnNkclFrT1FJSjNtdUxLVmFvWnc0ClRZZzRCVmxpWktyaGNVdkk0WUpm\neEpLdDRLNG5iK0o2c3A1R2xPTndwMncKLS0tIEY1R09FenZOcTFFYm5ucHFGSWxB\nbmloZVlZc2RERHJxOTNVNzZkVWN5ZHMKXfZq2ko7IiazDukSRvRn4floHMa82utc\nco/sx/saIf11UaKrsEnEzsAMCRatR+YHb9GNlVof7ZFEDUsQ3tToOA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWR1VjaE1CSjJkdkpYVE1G\nSTMxRENkSzg3bWZjNXBkS0FaYWYxRklnRWg4Cjhua0xZR1gzVGxBZjdTc1JvN2sv\nZkhhbUlzNXg0QTQ4ak9ETHNNb1ZPUE0KLS0tIGh5SHh4YXNMUndnN042eHliU013\nTGpKNzc3b09CUWQzRHBjK2RVTmJ6c1UKNu8SdhNZoNsbisjKvg9KbkluMAjblkaL\nnR0SJ8QlNvBa6wc/mj9y5pSaCgj9zROvjpDd9zQgy71WdMXVhHN7Hg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzY3M1dnZUcVg5eDRUTTFZ\nQWM5TXloUGhCNk9jeFZWcDhqSlNWVGFrVHlFCnNiVW1XekxnNlVqb0phVzgzb2pv\nR292NmNBMjIyY2YvSTBMY2IrOFNLNXcKLS0tICtKdWVzbzNrWENLQTUwUTVNRXV2\nckFBeHFady8xYmFBR0VjbS9Xdk1IaVUKJfC8jx/iCkgHa4nPW8uv2H1F9W/RhYGt\n0y2rDSklVYx574Oh1mMSpps0GOjEXiOgbGPyfz5eqgycpU6q5PprDQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1Y2s0Z0NHL3VxMVpWSTZ5\nSzByWDAvSzNDOU9OQzBaMmR3OVJWWGdsR1Q0CkdmN1RITUc0b095SVBiRDhKSUNP\ndmhRWVFaRklVL0o1V0szcGFtUEROczgKLS0tIGtDeEVLcGlKVktqME9idUovcXVU\nVEQxWUV3Wmt4Rkphb05YSGJ1bWlCeEEKdAuxFMMYSnzt5vSwst7ZfxZcc8O241u2\nJJt+b2uU8iaHcLoW7FkaEUh+42+yit++uCzTlYh+m2Mt9H0UHXg1SQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2022-09-26T00:37:28Z",
+		"mac": "ENC[AES256_GCM,data:u1Dox97kcWqhqLPtXGF6lbkn7oSMVkX1Ls4CRNebKNO6gO84WpO+Bqcvx2Zy+OYrh+o3iJ2W3IM6Sot5LiTgamiCAoiZmYxgNSI6IJPy3b0+F+0RtlaZG9mUrV7r1NEeq84iMKqxjglafTlZbFAsrl4C/sOac1KK8/OigxNHl6k=,iv:Y9JYeRNFcwxWR6qhTTMwDc0hh5Y6eX66djABynaBMEM=,tag:pJDUProGl+flqA4sVpR+4A==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}

secrets/universal/net/home-bedroom.psk.bin

@@ -1,48 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:X5RxPa26vyMk6+z0HB6xwXqTmPeR0MJ6nR5oA4GSEL+s/7SrCn8wWbdaM8iGE2U4ljyC1LJgyd4lZc4r1V/u3Gg5Ynmr3tIRhQ==,iv:rlguW/Aev3Q64lda2bxES7RbZjngVGo8l8CX50nuESQ=,tag:6kqdDV3f7QHiIEif16EEUw==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJZzg4QXpkSExIYUptNkRC\nMGFuNHEzN3drcEZTbEl0alBpS2FDM2ljV0hnClZJMkc5Yko5TTI3Q0twQi9UNE02\nemV5RTNNL3N2S1pOcXVqNGVKWWp5c1kKLS0tIEYrMElhM09zSFdCMnV0SnRBMkQr\nWitjSktQSHJDV2lhajhlaHVXdkYxTkEKPK7SY2zesUHKmLHrt62vFwm8mOZ8n2DY\nb2hZFcA8r2Ozc6+BY62k+rr4PTkE1sTeeTPY4nvL7+k5lvFPqwZ34Q==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArb2cvN2VaTnMzRW5IWGpU\nRm9KZWVpcXNTZVhGWXpMNmZGNFdCc3dJTDJjClVhcVlhQmpLRmZSRWJEQVJWMVk5\neUdOWEtUZGs2UWRXZXhZTlFPY0swd2MKLS0tIENKKzlEaFB5b1VGbEIrT2RjUzNU\ncHFvbEJ1a2JnZDBmd2llOHptUXBERGsKMzgbI0h4ewsb3dmgXEjqKHLxr0ZzQGiH\nX85GwYTDh/UU8mol5xMHEj//uJnKumCaPdNZeM8uoHOCOnMZcOBj2w==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5ZmlYY1p0UE9Oa3BZYldk\nUmpWbVZHWVdtRG1NK2U1eXdjdHYybTdFM0J3CklFdWZBM01BTUY0ZzU0eG9KZjBE\nd3lucWw1aFlhYUJzT3JQK0FOS1o4OWsKLS0tIHV0dVJMdFlVL1BXTkJUWnlDaFlN\nc3QyOC90NmVTTDlEOFZxMUNSWTR4QTAKQ2I2cYMJOzGHaou84UQ8jsEBlcZK+4nS\nVEBkcArZpfxDlYSajr1ZJ9Io5rdFFOs5gEjHh43ScLf88+Qs/QW9TA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzTHRtb1R4QThKd1c3cnZx\nbDFVbzM2azRabEdzZFVQbzlpcGV1U292RlhrCllBWWN3UXc4U3loQUg0M0RUVDlp\nalNFcVg0eUF3Rmc3NVF3UkNRUUF6NnMKLS0tIHV0bzFsUzAyY2Q1WWRIWWhDSnFU\nMGtxT0JmWmUvQnVQOEw5V3ovNGpsUDgKbYso2M273aaZhvlRQuRcGHq/9g3IK1Od\nqBXpSmEzPI033gVo5x0r3ShloXzG5/7j0Oy/JdWQifQZuzhUTYsA5A==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxdmFndHY5Y1NnWk9zMys4\ndGw3eXM4UFRNVUZQTkNCdndWSHFxYjFjZnlZClI1ZlBlTlpkREhKOTRXTmJJSHht\ncFhSOEs4aDloVWZ1R241NTJVNnRhV0kKLS0tIGFIbGtSMFVZKzc0MUlIajIyRHI1\ndUs2YUN0Q3pnN0Z0N0ZTcTZidzVobVkKUvE9wpyUnG59isJfoAzrKP+wqIO871XQ\njV27WpKOqwtCq6Jv3Fv43soGITpb6Tylv1pYCBvL83knlGNMzvvZnA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2VG1CeU9WQURrZDIwdXlD\nb05iOGIxNzZTVmZlTGxyZ0pFd1ZhdGU5ZTMwCml5Z2s1aWp5NGJNdFcycmVGR1pK\nN1dwOCtkNHlWbmNGQW80ek9LR2R3YlEKLS0tIDlZRElhMktiUzhKUEQ5Tk0vVU9F\nRGJrZ2IyaGxmOVlEKytSOFlDaThZU3cK9zUGyA+0FDXnh1MhO6oM91DODp0Fpb1M\nGhO0uCxk9k23IumgWvRfE9bwM+bQ0QToBSIxfbdFq1QVdqgz3Z44IQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVS3BiVUdFSTg3UW5nSWQ0\nRWFZQXZMZ1lxN1hPeU1kWng4QU9EVkNhMFNRCkRuSXJBdFo1N1NPdmNCM2VjcHRk\nOEdzTWdDZ1F2clRmTHFqRTRNb3MreHcKLS0tIDJZZDlQdWNSNVJ3SEdWbkVPSnM2\nM2lqMTFmN0VBRHQ3bUNGdDJMSmlBNTgKqVXysfSFxrdMUDVv66JZRPape/M6Im6S\nj1f9VN/ZNrwnRU0ZzPtFWeMyYWIc6c726cweP9xB7ZGoGw2Qfiy8EQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsRk5qdktjQnFJNTgrcUR4\nL0VhcHZCT2VjMDNZeWRSUlZoMXRiY1FEYlVJCjVSK0J4WGFOcUErTE9GWFAzNFNY\ndkIyRXZYVUlHTmJ0L0t5TnIzbS9sYnMKLS0tIFY3NDZBY0IwU2kxSmhvZEJ3Uk5N\ncDdDTVZTWi9pTmR3dkdMVTR3cWRzZ2sKfsRBXdxnjflGnfMexej0rJDRVfnKsPYO\nVGHcl26QJ+7aF3eVhiNmReuQn0i8mqbrcNMKSp+XXLiFyfu89IfoIA==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2022-09-29T11:29:10Z",
-		"mac": "ENC[AES256_GCM,data:DPQZVQfAh002aE2X/qgVTuQoWD3AkcbxNU8NAuVY5sgPFhoLtjbm0vNtN0ql2h1HUVENS+BpNsHpLQej7musTL+mJ9KSlHtoUfK0sY56Gx/B0OxMzHF8EHQyYmM/IOtWLuzzMYpFVM2gCeQWgHYZo0W7zNDwZaBVLTAyWN1lAhI=,iv:bTdE+Hma+IIzwy3vMhYW8Rc3sfDkQamW1QQK+bBzELE=,tag:Zd56FoS15pmuoNhCvjckwQ==,type:str]",
-		"pgp": null,
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.7.3"
-	}
-}

secrets/universal/net/home-shared-24G.nmconnection.bin

@@ -0,0 +1,48 @@
+{
+	"data": "ENC[AES256_GCM,data:xk7sFZVtyR9hg5Rm4gidqH7JfvPa1xCKOE2lAm51oPRVq/A2EKrLrnLyJTJ9dwF9D5yqkxv9QA9SbCHV6QKH/HDdLr6+f3CSsCbgt3SIR5ol3CBPfiMMNQs14dE46ZH9sqo8BWCjzQxS2UU9KdpVz579fvMCSk+uDUE4H5JHiCnyi7f56BTOGhV5sPdsMjX0ktKzNPeQPYe1RtNtzVljlZWTM7L9AYCFhY4nnhJ7abqBZM8u0Do14pkdKj08HofzYZONAyb7U+4JPcNOYwsAWuXNPbTD6UMduw9mVF9rqjb42IGvB1v3mH3a/hhTfJfymaXI4NhJQLkpIahwCfxzZdK2yH03eYcw44kAAcwji7VW5tTurl4I1A9EnwouJ6HEBM2RUqfhlaVN5nu0AlHPuK8/0Vd6wuesUfntszl037yPCbB9ItrC5xVK/+BZRJujm14fYCUmMXHmtyMdZIFL,iv:v9xkoM9ed0nVkXj1Nw3MrF0b5qDktrA6tuEaHNDaJbo=,tag:knNHMNx5pJC6E+wFyh9qsQ==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOZTAzUFZnWkM2YUpJSXV3\nVlFZdDBvN3hxK29GYUZYWnlMQVQ3Rm1JaG04CkhsL28rM2p5RGdNNW9CVkdWS0k1\nT2NsZ0M0bXE3U1dIaUdaMm45V3JISUkKLS0tIG9kT0kxbi9BVUFRRDRNZjNhbTlQ\neVo5dTJLVFlkWEhmZTgzMEtoR3dvRzgKvdrs0hNdQWMpwmeq3D4SU9PIHeUVymj3\nqK/vewO9NR0EDTDxjJvDY9CE1Hqs5KjbTWNBJt6e7r78OCGfeNpUAQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQUlFXUXJnOHdmTnJDSkll\nb20zeERzRitXRHhpTzA2OGlYTVRvZGpDV2swCkZmcWJJODZZcitrTnBxK0k3SXB3\nc0NJUVRwUkp3cVJjenkwMFNKZGhnMVkKLS0tIDRmNGVXRFduRG43Qm9IempCSlRk\nN0xSSG53czZJazJKaFBRZHBJdjZDa0kKGbgdNG2ErBrMRZpojH8PMoLAt3m25Q6p\nuEzWTiksKCU/FS6DnAn7tvB+mOBzpbhjcb+m6c+E3eggCdFKgqW+YA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSRm45SFd3cDIyNUpwSGdP\nNVg2cnZiTzBIQ3dpem9VQjJLNU1BQnFLU1I4CkR6NnZOSENrdzhlUUc1T2s3c3Bj\nYWhXYWtCNkVrY0hHell3RUg1YjI0dTgKLS0tIE1rS1FkSnNpRHdPNGtra0lKbmRt\nV1hRNDVzeVZGZmlhMElsdFkvWkZ0WnMKqsZ5UKR3eoz3392OB9485y4/TjNM3D5M\nm67Abn6pQPjLiZsham8G5eoiGwKgJAeXIiUBxg5ihahKKGy5L9No8w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOellsejZiT3crbFhNM0J0\nQld4RUxFbVdWa0VsL1V5djhlbE94bFFoT1dBCjBFSFhnK1hwR1RxQzlmY0ZIblEx\nd2lWZ1c2UENqVDU2KzlwR2VTeE4rcUEKLS0tIHdwWDRHRHBvZ0FxNnJyMUQrdE1V\nVDlpSGVrU3JyRTR3dy9UaVU1cExBbjAKqGFpzoOJcWDpRQiXhpPV4FTkq97VWxHr\nlIUefxXABGKXnA5p24/bN1jYVeP5s3WO2w2laO/JQmD/bTknjUVj3A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBac2xBRkhJUllSemhGVU1E\nRjJHSFBwbEVRYUVPZndSQjZvK1l1ZVFicTA4Ckt1a0wvdVAyV0s0WmZUeWxxZ1FL\nU2RyVnpCMVVBb29oYmxuMTl2VERhejAKLS0tIGtNK3k3dkJKSk15YmRhZXVPblRa\nWjhCWDFtakhpY2ZJYk9zQ0NYM0RjMzQKAa8NF7fsNnYLDLS8exAZd6GttvLOV2hL\ni1sCoCr+MD3Y2XJvD2yoWaPwMtlbJD1QxnjZ/Ac0gDDSNdPA425yBQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFQkVJSWNlaWZxRnlJKzdQ\nTFVvWVhyNURlYlRTWFRsbVU3dllFWkxtdFE4CjQ4WDQ1T2k2Tk5yZk4xNnJmRmMr\nUjE5VlNDb3dLOGZwRnR4SDZFRXBqa28KLS0tIDVqWXphcGpmVTdxOVpFaWhaZEZw\nMnprWVZna05wVzh4T1JMRnNGS254dWMKXRFXOQkDhnZbansO8zBIpoTLx0dk1gKw\nylEJR7uaC7QWBG8Flb5Jfyy2SDMYNZqujTWm3eaZy0CkgTp2Z3bJvw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFdEFQenp3OGJWS1FnZ09n\nZUZKVVZQeEp3ZFFYYXBZcVM3MXdEYkZ0TmpJCjZncHdTOTUzbnNOYVNGUzBPSW03\nc2NSbjhRSG8wK1J1d3V2SVdSU3BHUkkKLS0tIGZsalBtdEtWSktEVGdYSnFTVHZq\nYkFlc3FDdFBtNThKdzJwTlF0Nk9Wc3cKn5nRJPjhKLNmq4DSl8CGN6BhmTrelN5r\noran8wSzaDPpELSFdhnvF8ljW1ETafZavck8y9I429W31n/xq21n8g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjcE5lTExBaWNkdzVwcU9x\nSmtxTUJjbUZkb0p1NDMzTyswTGdMOUNlVEI0CkVEZU1PMk44UExqdk45VEppKzZq\nQUtaYUQxQlY5cWVTaUdMWlhKODdhdUkKLS0tIEQvd0hFcTJmT3RkWEh6RTIwWFlx\ndGZHQmIrZkJuaEozVnFOK0ZXRXBiRzAK53/YP1rQ9VVuLzRYCGmmo9HqLpZmgOAj\nImFr+OpzdNpXDMN0JRorJfZ0p4CRob62zDIt1FDZb6jxmHa4PwLfhQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2022-09-26T01:02:32Z",
+		"mac": "ENC[AES256_GCM,data:y/9UiwCrOwC0BzcBj8pdeLTKrbsivyY2X3y7CbB+loRvFINql6VVgJ3n5Bu+kIwwErdfzCeouhD0RBv8pf1ygzG3tj7H8nhzeqFXrnUGuKCYb0Co0HJD5ZdprHyIq5jUxi/btRNKuvRkno+GSitE3uu1IPGUeu3viLl42SCCBKM=,iv:TfofNHw5MnhsJ+l8ZWVCz6gTGvhupsnfaRZKYTPY29M=,tag:IwN8TuJA4SPJgyEraU+8Bg==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}

secrets/universal/net/home-shared-24G.psk.bin

@@ -1,48 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:ZYCyNfJdnYij3ZPNftCq+shfLs1Du/WjRyXMnphEltKr1MRr+f5RY++na3VVtREHYq/NMFNHMjlkcsBREt8KrPOlk5CUh4oNfwrFLsvDN9mJmW7mw0h0Nl0kxwPMI+SRHh1cKsmSjDYWBQ7pLKXbDfv46wyrFKT1v2mI5OiFjWNtL/Gtq8xeA9XQPN9plkqKc1oaazT4TsBgV0kqBlsH7cWuI2l8A7dLpKGqf+fhQ0xvdCo76WcvYuphgE2Wru8xWALPx+OttRTLc2nLHX0=,iv:A7+QdWvSRVRIWf+yW9QgVXQjVY47F2Jj2FqcYbqkz+I=,tag:cU+6Kc2LC/30c2hNv2GVgw==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2d1JLZkNZeHBFNGVTalk4\nNkRDYytGUXFYQVNSNWlOV0ttYTgzZ0lQZ1VBClZKaTVadjFlVnJPRWZXWm5hdjJh\nTGgyNG9sd2hha242dzZ3dkRPYklVQU0KLS0tIDZzNGpTMFZKMzJYeUpnV0NqSjI1\nRm4rY2ZVZ29UdFhXZEZUWENVNkFCYVEKbmeZAn5yA6N8WrftBqpnfdtA1UHFyT4s\nTjQ4uDBGBNAYZzG3X1Dj/W9BBOqT/ErOVKcgeP/oSTsno4kjCnW4kw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOWTRwazVzRTVuUkFRQmdy\nNmpMeHdxQk9WeEg1SHJxMncxT3l0SnBqUzJZClpoN1RLdlVBRmNWMTRSOUNOY1E1\nOEJEYWdta285czhCRTJ5cCsvY2NrT00KLS0tIEVIMFE3aEFWb2VHc3pXNjQzSE14\nQUhjTTBURVBGYW5PSGh0QUdnd3R6SXMKqyBEOod76LFDheCl5FHlj8eqBEW6b5AT\nDkc83TH9DRm9g7Y3sgVBJAm1mPOhTlnAQuYvd70P3t2Joj33yO4AyQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoRFF5WTk1blRQWHdjbnRt\ncVFLZGlyWkdTSzNrb1k5ZTdWRm5xN3ExdUJJCng4ejdIZytsSzBaZmxsRUlwNEZW\nVnJoZlMySnVFUWFsZnRTWDF2V3pSREEKLS0tIFRuM28raTJkaENneDJFQVpxNGNx\nY0tiY0NpS05XTXpVdzJJMHJaRHg4UzQK/YPArPdC8KwdAz4lui6zhhjbJJNWgp3X\n/CfdVr405/xuNJxnshVr81a/wEog5HmuosAGEy60d/mFh4gs2BTmjg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJNGp4NDlaR2E5WXFJWTJ4\nN2cwS3Q1cjJSaU1aQ2k1VGpFTlRxN09YNkNJCjdGL2dGcHZzS0lxMzF3UXBMbXg3\nVjVrS295ekExb056cHZ1UVVvZThjd1UKLS0tIGZsRkR0TXlEaHpST1dMZHE3UWNX\nZGpGOEE0WnB3MlZISzdWVGMxclZkdDAKSo5iN8AuUYGgmCIMx89ou9muZkW71FRb\noX4Zkht/v9RtxKp0TGjujQeXnjC1iT97wFdR0iNTWjxLyUl9TtkIXg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwaTNhdmhSSXFrcWhUMkQv\nSlByVkh1akw2RU1rSEkzdjJ4bUp5Wnpjd0VFCkJIZmJZZEdXNEtkaWw1OWM5OXdn\nWHV5NE9JNnc3QXpyay9mOVN3QXNrcU0KLS0tIDRMOFpTL0JuNWlUWUNwTDNjNEVy\nNnZQVUVlQmRyaE11eU5KZUw4azlTRXcK50EEoR+iOQmgMNNI79bVd02UkOr8hEDL\n1KTy4s3MErfv8kGH8du12iNvCPRNYOulyk/CQEkYaUksP59g6k7mgQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRZ3VNcmJ2T2dzaUNGU2FY\nZGcvUHI2OHdrNTNad2Zoc1ZtUk5HNzV4ckY4Cm5YSzdRWDdXRUdFOXBqZGE2YkZE\nS0ROVDJFL3ZOWEZBM3FUME1tdm45U0UKLS0tIC9xNDRTdTJFcURPT3RvQ1J0MDZ1\nRnllMVdiNmU4ZDRLclZVL1lubGp1aXMKskqFVf8FPrBOaW9GPfm2gLnE5Zyq7Dq2\ntBGN6U4wXivLdC10e6BO4MrGjyCIeiuOJyE5f3XpkQ6RqkGl4P/P0A==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrdU82c0EwSUR2aFJYMVhS\nZ2c0WkJOUzJjb1Q2N1BZakdZZnhyQWdERVdvClJmMkREQlROZi9TdVhGR1lndUhi\na1FOSFdjWmdybHRVaDFFTDlIN21GTzgKLS0tIHFKK2VUUjIyRExwUDFGUjkreVhh\nSjdGcGpUU1NFRXRHcFNXSEJuS0gyMmcK6oMgKmwsstDNCyoVuhXU9z257+a5Hs4e\n9NsiKSd6BJVtfUBrBOAgRlkij9/x/zC5BvTd3tCNqNL0HUWxhdXPyw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHVTQyV0o3eWtQTEsxTXNZ\ndGJjcjQwWjA2QXFubmJSdGwyRHliRmtQSW1VCmh1K2l0NnVmNUlMUjdmd09IeG5a\nTVgvOWh1RWZZZnB1RkNHMjVSMG1pVG8KLS0tIElNbk53dnJxRE90WHZSbFVYRVAr\nNjcraVhhWVdpTDZJOG9uaUVmWFF2T00KGyNISTg/g7v1+VFlCg0MjDTjbcahdSQk\nQpxdjvqQ3qtcfOS/+OO5CZYEJIVp6YybXyHJ4SSbaED22YtTJGmRNw==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2022-10-08T03:30:39Z",
-		"mac": "ENC[AES256_GCM,data:0qrOFciOrb0Q0ZaaYbjKMOJwaZxsOiodPJomWVliVt7OFmxIdBorE/SGgtgQGQz6twJqeSCJi9NiEFWTfnitO0NH//jaMFiAZVGBbk3r8YrZ4UyzhQsEYCED036y0cIU31qxX2DbwNBA2R69mJqzCcTgpZORVsKOoyANp+HDhzc=,iv:B7Uopjj6jS4rIYZ0uHU6nfBMBvHUJkg6CCBZIQZNaYU=,tag:Qdi1bHKpp80XhniokLHLJw==,type:str]",
-		"pgp": null,
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.7.3"
-	}
-}

secrets/universal/net/home-shared.nmconnection.bin

@@ -0,0 +1,48 @@
+{
+	"data": "ENC[AES256_GCM,data:dAvCfwoUc5h+WXdRKjSQWWLwhQmEzH4qEcSpmmlVY/Bec2fMSmO9R8i0S1XiYs2e9kk/DXP2BiDTDQbhpYBsFa0+nTv3jJ372XoNyInQoAvbiQpIZqWN2hpBcK0RnfpYXrsXw1vnCgB4EYDXBmrXc0uJ4db3WuFfab7zTaKBegpGJstY9KthBTKMacbLvDTXvmm9ozvSrrHnWV14a7z2+Qz0MF5vYkJm463vocTpw8chak1N7eWTBY+sqJ8AMAGCIh3+rUxJN87D77/jCDiefYIB73nLLdsuo4fz8eNlA7Xi29tujDEcjVnE9iYhu4YNB3EPRSdTCiEj5p2oh7bqL/rOkWzkrPaGSJ+kp/XnmmKoUhf7owSlAzHC9qxpxOZltK3rvgVWYCyczI2khtAmhX+lgsZJ1LEYM+dOP/Msfa9SvN94aFDq3chmr6Hd2ookAVSqN10ECV7zHLeeGPZhLhI=,iv:8pNdSXfPeRvH/W3+qkQXySkpz29/yqIqGwMOl42XYbk=,tag:2d1ImDpxL8gikl3q6H7HLw==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkeGs1RHhHQkxLZVNDbVhV\nRG1oMVJRdkpnZlptakNkL0ZpT1FIUFdoNzBRClFqUXZDVyt2M0RkVFVXVE0wQVY2\nWUJ1Q0l3OGwrOWRKK2VOQ2pMSjZUdjgKLS0tIE5INjNkUWFiS215YzEzcFpPQ28z\nVzE3cEJBTGY5M2JtdHBScWVqZGc2NkUKoVw4Tz7keycFG4OWkz3QKOKwyLbnjooj\nxiLKkFhebTypzNhBdd0zPHZBHbbkbkugGHJRUM3vf2IT8DEAEdNQ4w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEZDZkTmxDQ0crOTRxR3dY\nVDlEK21UUGx1Q1pTVGdPSkl2MVJOaTJoQlVRCnd1aUhQeUxYZmhpSmRVYkNHUXNW\nYlI1QitlSkhxNjZHektDTzdNTjlYUk0KLS0tIFBDNGFKUkhRWTVZb0ZOcithUGZh\nakFETjdTb0JDblRjcWlJeHROeURpVU0KCkSsGQCIIKcdeKKUFcTDW+05kTAl3YR+\nEgXnCFI8TlADKlCGu3UmlpAJ0IVSsBbHviLlCn41W/0yOSyRTZi3zw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByNndPNks2REdPaytZQXVF\nRzFBWm9OYzJSRzRnNS95TXlFbVVjaEJ6emh3CjNQSytLNWVUOW4zak9aeHpqb09r\nbXYyY3NNUGI1ZnJyd0Nzbm5xOUk4eU0KLS0tIDhRRnVzRnk2OXRNSlBPQS9CZUhz\nUE5MMzdVNFpoTmtXQVZzdkVUUzRhbVkKRrDRkSqwbslLhNgHU4qyInL+LZvIc5RA\n0PC61EK7qIhgueZfxW8AMp5Zxs7id9jdfkKJw43cbxqGQbhdCUNSGQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBd09oRFlxVDdXT1V0N0sv\naEhxUlFFcVF6VXh6d2hEWUtQRGN4VnpCSWlvCiswbHdQMFkxNmZJbUFyNm51YXVt\nVndKSTErdXUvV0kxcGtrWm43VUo3WWMKLS0tIEcwOWFpeC9ROFMreGV5ckUwSm9R\naUpRTnBNcjRYaFhJRnpkQ3RKMUhOWjAKUTEsTX2H0pAii7O9Ftcy8uVazM12wiEN\nhB4Lt4uAeYOYr3wZ85IevVkamdPQC8N/Q8F+MtUHOklx4jWFti4jbw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrVnZGd2o5VDZaMFpQZUZn\nKzdhR3A5ZkxjM3M5SE5DSjFDMXRrOG91Z2lNCmFqYUJTZHlCUzcyVkFlTy9HUXo4\nM1JrL1BLRENpRFNCeEdCeVBzaXlQS3MKLS0tIEp4blVxcFludEZRSUNSRFhjZE9I\neDFpQ3NubzZTZVVJbTNHY0ptVVcrQmcKDBmc98NY0UczeMlJm8nrTVbUmcsWjcwn\nK+oSVmPXJzaGylVsjfgaxopfshnQnGoJ3Uh6LLCA7NYZFsrwmqKFqA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIRitVYTIrY1k1S0ZUT0c0\neTJzRHBnNnFGMHN0QjhRU3UzU2NnZGVaZVRjCmphT3l0T2JrVmVDSXB6T0YvaE1D\nTmVLREJ4RmxlK1hwNG03ZWh6amVWSWsKLS0tIDMrekdmZCt0c0Ewbzk5MzdMckJx\nSG9vWFh5NDluKzlQTnh3cjlUOW5RYXMKfOUdWQoAyFMFltYIt2lwjyUQLsr7BEyV\ny35DGau+yZiZPhxmGXPU09y+zmlyjXj3njIgsUkDTOnTJVvPmm4iJw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnZE4vdWdIZnZ1OGVhK3Zo\nQ29jcThwSnkrZzhoWU9kR1l1Uzc1MC9CMGg0Ci9PQ21ndVpQNGwyRDVuZFpWcnRx\neDVTMWZCV0FOWjh3K1l0MC9sdkxkKzAKLS0tIHRoOE53NWdnQXNBWEFDTFp4U0pP\nU1djU3NoMUVhM3cvT05kbVVPSHNHNTAKZ5MR2SGFvr0lU2FvxsqveX3PPk8B3aXJ\nQgNIg8chqVpycYTU4tLMBUUHFinX1e5WueBWOnd8OrBowMmb1UZtbQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuL2lOMmt4OVNkTEwwbmtI\nY3ZOb3A1andqNTRKcytoVjQ4OEY5M1lJL0NnCkR5RC9DYVM2c0hSaGpEbHVZWjNQ\nZ2hjaHk3WmhZSXhjNzE0VVJheVNTS2sKLS0tIGU2V1FqTjZ5YUFqL0pSd3U4bHNy\nUW9tRFc5Ym9wam4yNDFLdDN6V0w3ZnMKc5RCncbzmEKdAjaYFDq5UALIYkkszrwu\nBKlaUqpJf78muazrIcDZkaFtlZGWRjwE3d78e97ZJLYigi81Q8xRRw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2022-09-26T01:02:52Z",
+		"mac": "ENC[AES256_GCM,data:Rq50r2L4ABsmblGfeWI/9/nN6wvsX1Nz+GaAN3ph/8ScrzMhy/l8sMZhthaNGn1ENC+UMhuakgwwgwKic0Ut8Y+cS5ZazUWH5M9pqINEtdFYT+wZrw9dGaeEISdROxa+/oknAXeaRb8LNQKpOTja7/Lj0NidnrpOoqzv22ZVWGE=,iv:9tR8K89thHaJd5LFEmBtCAb8FjSYwbsETJjeNSAbUnM=,tag:tLBDl4+LGQY0MvDgTv88vQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}

secrets/universal/net/home-shared.psk.bin

@@ -1,48 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:ou55VGY+beKMouNj4qQaBOAZK/5UKu6A521lNW2i0KlSmgJ8qQ501lesy0bEmDkZqqhluP8XE5FZLwEXvqqMh/TBuN1OkCsQis53/M1s0g==,iv:Ir5uD1P8OlHlcjGCHVkUHr0AjoXzd7kOcAeajo66hUE=,tag:m+rReK9o/8TG4LBkNN1ZZQ==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvNzNHZWcvTmVVaGFabUU3\ndnZwVFdVcFBXZkoxTFA5WEZMMnRvUDBsS1NrCnRKUTNDZExFL1drSjBTakw1VmZW\nYWJzTUtVN0lrWXdiRk9QaVNmZmRqSjAKLS0tIGtHTzNUUnlnU2duNDF6UUlzUUJa\nSXhxQmRXZEZKK2htenF6N1kzV1VvancKP8jZotJe9188kId6cwVzITNwtELegpzi\nOKrWPWuIveSdMGmMsRDAcQbL0xVN0qd+Y4qsZ9l6e+cVAT3cHb1vDg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLemhLZUwzSVJLNUhYQXQ3\nY3ExU1BJUzY4a24vUjRmazhtc1RIcVpyem1jCmFEVzlIZkxjSUc0RTdqQWRLTGNS\nL3FaRFhjdnZqNFk0WDFSY0xOTENxMkEKLS0tIDVzK1lPM1FlWmZLZFA0ZDlPKzla\naXRqTk90aVNTRHlNZ2FmcVY3b1JKbEkKTu8tiEKyab1bOsgdsRlEWeG9wzdg/d/s\nPfh7rnvf7Ex8Jl6qSq6xMPkv+19EbSpfSq0FRtCue/Wcce3cUmGToA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyZUY4OW5UNXFjOXQrUklu\nK3poU3RNVnBtc251TmRtMGJ6Z0ordDFhUGhjCms2a1o1Z1plNlpwSlYrUEEzRDZm\naHdEVVIzRnExNVhzci8vN0ZIODh3QzgKLS0tIGUxZ2gvbGM3YnMwVXU1RnNOSlBO\nVE94UFdKaDkwbmV5YjlBWm9ZZkk4Q0UK6CaPAtRrXKUzR29ZfXV8MvqszTu8LkT2\nQPlNJ4ckgTyivyseukR8X5fPKrrXIVtE+C6Xk5mJ6nGKD+oLprhpag==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUUk1yL3dLUnBpNWNxMzQw\ncDdVa0szNjBVNnNXdmZwNVNEK1RwUzJTMlhZCm9oV3NaZ3k0SERKMEZCQTRtRUI2\nVmdzWndQT1c4UUh2MzQyMEErdm96NG8KLS0tIG1aUElzK2VjUTNYOGRpbkpZTDVz\ncG9jR0VzNi9jYmdCTU1qMmJtNFNUaU0KkrIx2BKjj7l+52Kk/L8rNZYAsa87z9UH\nDtxhLTnQu8DPtm5o2sbGdEZgt9qKPJiylLNKVne3EyscMaehdB17RA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUSUtONWlzZ0JQbDB0L1FU\nWlhCL0p4d3lpamg3YWdIUVhDc1hVRWR1MVhFCkdZbEhnUG0vYTJVZnphdTZNSXBW\nVGdpemc5Q3hSenN4V09ZbTFOK3kzK0UKLS0tIG9ZWkdSMHhzTGJleFF5L2RsdUxK\nSEdtSlB0L2d4TTVWcDJWaE13NjFiTkkKWgfem58/ZKqVaXiL0UGVTjA7AhSkD8Fq\ne/i5HKN1Pvgv8TVPnZ9mtGP2gwwkoFYgxM8/0jBjJUm4QDbTkocVJw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNR05jQnJZZDNndmZnOVNO\nRFhVU3pLUzBxeC9rQlRoVWFCN1Y0bjhBM25VCmJKSzhkMjF1L3pGRjZmOURNeUZE\nTU8vN2pYVmZzdWdpaVdqcXloNGhTSlUKLS0tIGovSG84amhyTFZHZ2FNdTl3SzJj\nN1dObkd6K2J0Y2Q5bG5DR0VaUk1uSlUKxShDW7BD6sENlFjqp7/wFbV4g4gD7u5d\npidF9F+vXhpoBIwLlhruzvwyNXG4hQcKfWCnliXhVvNYbgaooDDhRw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1MkJ1RkVBeHJnR1FGeDVi\nN0htdHZ3cVNCcTJabnlkSUQ4aHUxRndvbVhZClk2d2ZRTlJIVTg1T3dkKzdMRXJt\nNXh5OWtud3gvNWNkRWI1UE1kSytYOUUKLS0tIHhhQVpmRWtTYVFjSUN5aEVYWDJx\nS3hDMlFkVGQyM2U5QjlJMko4OGRWdkEKG98s0QVSs1o4MQ9937okXDS4WH41S1Aq\nUSL8idmlPUJzgdHshuLv2Ic2RXVjJu8V508trO8bTymrqkNAQ0miMA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAraXJQOHR6ZzE5TjNQYmpB\nSStEQS9mcUpMSXlFQ05DcllFSjNOT1pWdVJZCmtSL3FkZ2Q1cU1Fc1dZbG13eXJC\nTXJkN0NzWTlDOEFMRGNQUG5HQUNUVDgKLS0tIGRwcmVxS0lNQ09GdmxKY2pkQ2Yz\nSkpZam1ZQUN1L1FZZ010ZlhUV1N4VlkKqsFAE+xZ24IMzIFjbsgANdjiGwVZk5rq\n66y00bjw+uj6WOwQuE1I9WcYDhCXEUQB9u4Q+hzejaFzCJ90N/WF4w==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2022-10-08T03:39:12Z",
-		"mac": "ENC[AES256_GCM,data:4Rr2iqmzLtE9i45Hn10wuf8unKt+YNAYTF3RWwEW1AjN+pF7ZvwMbrUutRCb6uMxCQUyNl+adfFRu8Xae0/SqFBfdAPxzeQZGrBjb384seLrNS0XyUacfdoSCczrRUF8+F3mIHetaJCd2jOpoh5HotoSN3fx+nZNhD+56XmJBr0=,iv:YlDMimhG+a9Wzq0ZN0tnZ1gH69e7olyHGWhIV2/4K64=,tag:GjVzbNa/NdzVmdPyE5etXw==,type:str]",
-		"pgp": null,
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.7.3"
-	}
-}

secrets/universal/net/iphone.psk.bin

@@ -1,48 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:XGhxqtkmLOKQqcdmJvQ9rKdUW0qassF2glLvUpAs6uyO6WHVKvXKhAIJIsZZbd1RRlJ5PuwBvu7lKIrcVIswKvwF/MhXTCqfoB0fpmysaCpKdkLYojiSvsHQAXB9gIAnL0dVIEvZ+s7MRG5wp8s2+y18JsgS8jBM0vMFoLxVF41isocMcxO0a1wnCjAWy2s0845OOjhVSNCuVSjI5Oc1dTO9vycDHV4Y6MulFoBSlwfJdUf2nVR/FNuCxyxFX//wgRuN3cg1zkmoBblnvkccMGIzkmuByUAlqdaaug/Q,iv:9HIUqe5dTjVrHM5a9IrpYLtsDpg3Ts3mX9H8M8M572o=,tag:2EK0Zj6DTM/QmbVL+lG8wg==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqWUdWVkN2UGNBUzBqV0hK\nb0hnc1YxZWoyYkNIOVhreHlzOUJKVEdjdVJJCnRVSXYzWkl5ZktHdnJqTjIyUE9O\nQ2Jya0NuLzlDWDVoR3JTQVB3STJYSk0KLS0tIHllNisyMmJSNTBsZU85U0FuRWpU\ncnEvdGVhZlBXMjIzVUV3YTdQOXJjcE0Km66SgSPKbEC5bkCZI7l00QuPvgAH8kuD\no0A9w/lRBgcP787lqyUwULA+gu4YwvNIupvuABXm9KaFHtVqYDVJJw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsMXJYUytzRFVMYjNyZ0ZM\nb3dsVjV6blJ0K0JmcU1QYjNVY1JvSXQzTFQ0ClI5SG1tOTFYOWxuMWF3bFNxaWxL\nRDBiR2FZMVdOOVhoc1Via2xRd0t6SlkKLS0tIGUrRGZCZmxwOVl5dnVqVzJSdDNU\nUWE1VnkzSjJJZU9aOVdETklRa3VyeDgKqQpyc7UR7ValJuTD+NKIUSjKHNNAkPsS\nEgqI8DxjCvaSERKOYH/6pMSdRGklzS0ECuW5TNm0d4BvlbaFEiozlg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHWVRINUFUa1lqZHZybHR5\nWmRuYmQyUTB5Z1RPaXJNc3VMUkFQZmhGMGhrCklaa3ZaNVYxYlAzaWsxRXN3c2E4\nNnB5S3VXa01ZdExzazRFcnRmdmNaQncKLS0tIEFpTksxUkVrMldSbDdPcXFMbnhB\nUGJyOVB5TFI3TU5hRXdKK25ORzIrUlUKjDGNOoLb7N+UKCEOwMXWklyQt0xapeMr\nKDFMcuxTX7WouiCF+GCXegQYfsXLsrETbbz+L6BOsV6O4uNNtYMZNA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5dnFSRVlvc293MWJlTC9k\nMGtLVmNlbWlXZVczdDlnQVhXTDJjZHE1U2tzClFucGhya1M1SFpheFVEM3JmWDlG\nSzZCd1JwalNYVVZqQWdKVWNhRDUwbE0KLS0tIGtpd3huNUtld0V0SzBJK0FXMkxC\nT3VJckV3aHFMc3c0K1V6S1d0NitNaVEKe73p65j2fb4Hd7TLJqiX6NUyKbv7K2te\nNzPxOZQCBrSogqbnT2qDt5Yptr2nk5qK4CkoELw1/Iha8xLg96qcRA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrSmJGNTNpTS9QKzc0dUNt\ndGxxbnY3eTYzc1lPcXRrdjBJdlZwNm50R0hNCjE0OWdDdEdvb0ZMNlA3SkZERWhs\ndk5FMTdQc3VUTUgwQ0t5NTVZZWEzc1UKLS0tIEJNNjVrN0h2Qjl5UVh3KzRVNzBR\ndS9nL2U3T2l4MG5XNndjYkg3WnQ3cHMKUcW4kwhoqw/2VRO+qD65Hy789fppwpLg\n7PZ2YZTa/OWufYweYQnSDCtRC1dCdtOUE3mhjtBsGaqKp0pOzOmNwg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4SElrMkprWXk3OUExaGEz\nQXBOM0Z1cHQzUUd3Q2ZWWC92bVJ0dmtSNGtnCk04d2E1NDkyUDhFNW5tSUtGMFQy\nMkMxR3p0QVNCUSs5UkE2Rjg1cStmc1kKLS0tIEhTS3hUcTNlT0lxRmdlK0VRSzNP\nUllGcHJ1TkpHTGVyaXFEUmhoZURVVlUKidC2z1cN6iwswN5+FKYEXSpif82MW5oC\nR1axSWsIJc7P2hPf4ua5BVoDqEn/Vei92NOcbQNfYUtEdkCGFbkYzw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVNjN1cHhtYUlOQngzYjhH\nUEZzbTVwT3dSalJBQlc1b2ZBRmwwSHoyZURNCjd4WllKSTE0OElFSGd3K1dzR2oz\ncWprejcrOUJuOVZWdDBkMXNVejJsaFkKLS0tIHkvNHZ0SVdnOUlTTnBvdVZLcUFp\nNTlXSlU0UGh6NFZUYUIraEpSRTJVaGsKb85V2N1dgP65R/xdjq7vEKO+b9NdJ9D+\nh7pVfx9ghSKdmcADWxyRhpmjc7Yyfx5wzpWbuV0mAibPLS9RdLry5Q==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtYlJWZ2t6WDlRdUJqU2pG\nYkE3T005bUhCcUJ0TEw0MEdDY1JFUzJjcVMwCkhCckRzcldLWTJPSEVjbHk3VE1p\nY21rRWR3cUVscmNiL29NL3M1QjZsYlUKLS0tIDJ4M3JtdGFRbUhFR2FtSGVuZk9n\nL1VjS1hnbzZwT1lQalJBbFU0SjFOWkUKUkGyPmpilSZdupNlR+cD4+HUOwyNm8WF\nu3vS7Ec4FJcjnx2t185yXEStZSVGptw/wKTxJiJ5P9by75XkAJZFmg==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2022-10-09T02:24:20Z",
-		"mac": "ENC[AES256_GCM,data:AIRI5vLpVvWuxjvPerwzsBnwsSPrtazgCMPjP2be5aUcglT9e+98Dlg+jX60XjiO/1DvEepoCLd5Xnr6GHOkgRRR90YPsZT9eRttwhBavXaOF2Da7zwP5ZOg3cO0JGQsegTxJYFMmROCZppybL6EOsT2n18pc2M2HdEBt5oKP2k=,iv:ive5dqvbBQ3Ef5ycZP+l1Vuc38ylFTJhGh5+ksMCyAc=,tag:OP9EgZN2q2OKPRpOv2x7Tg==,type:str]",
-		"pgp": null,
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.7.3"
-	}
-}