mautrix-signal: configure correct permissions so that i can use the bridge

it looks like mautrix-signal reads the appserver token (AS_TOKEN) from
its config file -- which we place in the nix store. as such, we have no
easy way of getting the token from registration.yaml over to
mautrix-signal. this is presumably what the environmentFile stuff is
meant for, but it doesn't *really* help much.

i think it makes sense to pursue coffeetables' nix-matrix-appservices
module, which has good-looking AS_TOKEN support:
<https://gitlab.com/coffeetables/nix-matrix-appservices>

flake.lock

@@ -60,37 +60,38 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-5eJxyBRYQCoRt92ZFUOdT237Z0VscuNRd0pktDYWJYE=",
-        "path": "nixpatches",
+        "narHash": "sha256-ERkw+xJQ2mZMztI8hzWjilnvHQtKHslNyuG9TXM/lCI=",
+        "path": "/nix/store/zy5rd2m4ww1wwllfq8sgwvdslganf1ks-source/nixpatches",
         "type": "path"
       },
       "original": {
-        "path": "nixpatches",
+        "path": "/nix/store/zy5rd2m4ww1wwllfq8sgwvdslganf1ks-source/nixpatches",
         "type": "path"
       }
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1673163619,
-        "narHash": "sha256-B33PFBL64ZgTWgMnhFL3jgheAN/DjHPsZ1Ih3z0VE5I=",
-        "owner": "NixOS",
+        "lastModified": 1673704454,
+        "narHash": "sha256-5Wdj1MgdOgn3+dMFIBtg+IAYZApjF8JzwLWDPieg0C4=",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "8c54d842d9544361aac5f5b212ba04e4089e8efe",
+        "rev": "a83ed85c14fcf242653df6f4b0974b7e1c73c6c6",
         "type": "github"
       },
       "original": {
-        "id": "nixpkgs",
+        "owner": "nixos",
         "ref": "nixos-22.11",
-        "type": "indirect"
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "nixpkgs-stable_2": {
       "locked": {
-        "lastModified": 1673100377,
-        "narHash": "sha256-mT76pTd0YFxT6CwtPhDgHJhuIgLY+ZLSMiQpBufwMG4=",
+        "lastModified": 1673740915,
+        "narHash": "sha256-MMH8zONfqahgHly3K8/A++X34800rajA/XgZ2DzNL/M=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9f11a2df77cb945c115ae2a65f53f38121597d73",
+        "rev": "7c65528c3f8462b902e09d1ccca23bb9034665c2",
         "type": "github"
       },
       "original": {
@@ -102,17 +103,18 @@
     },
     "nixpkgs-unpatched": {
       "locked": {
-        "lastModified": 1673226411,
-        "narHash": "sha256-b6cGb5Ln7Zy80YO66+cbTyGdjZKtkoqB/iIIhDX9gRA=",
-        "owner": "NixOS",
+        "lastModified": 1673631141,
+        "narHash": "sha256-AprpYQ5JvLS4wQG/ghm2UriZ9QZXvAwh1HlgA/6ZEVQ=",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "aa1d74709f5dac623adb4d48fdfb27cc2c92a4d4",
+        "rev": "befc83905c965adfd33e5cae49acb0351f6e0404",
         "type": "github"
       },
       "original": {
-        "id": "nixpkgs",
+        "owner": "nixos",
         "ref": "nixos-unstable",
-        "type": "indirect"
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "root": {
@@ -134,11 +136,11 @@
         "nixpkgs-stable": "nixpkgs-stable_2"
       },
       "locked": {
-        "lastModified": 1673147300,
-        "narHash": "sha256-gR9OEfTzWfL6vG0qkbn1TlBAOlg4LuW8xK/u0V41Ihc=",
+        "lastModified": 1673752321,
+        "narHash": "sha256-EFfXY1ZHJq4FNaNQA9x0djtu/jiOhBbT0Xi+BT06cJw=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "2253120d2a6147e57bafb5c689e086221df8032f",
+        "rev": "e18eefd2b133a58309475298052c341c08470717",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,24 +1,44 @@
-# docs:
-# - <https://nixos.wiki/wiki/Flakes>
+# FLAKE FEEDBACK:
+# - if flake inputs are meant to be human-readable, a human should be able to easily track them down given the URL.
+#   - this is not the case with registry URLs, like `nixpkgs/nixos-22.11`.
+#   - this is marginally the case with schemes like `github:nixos/nixpkgs`.
+#   - given the *existing* `git+https://` scheme, i propose expressing github URLs similarly:
+#     - `github+https://github.com/nixos/nixpkgs/tree/nixos-22.11`
+# - need some way to apply local patches to inputs.
+#
+#
+# DEVELOPMENT DOCS:
+# - Flake docs: <https://nixos.wiki/wiki/Flakes>
+# - Flake RFC: <https://github.com/tweag/rfcs/blob/flakes/rfcs/0049-flakes.md>
+#   - Discussion: <https://github.com/NixOS/rfcs/pull/49>
 # - <https://serokell.io/blog/practical-nix-flakes>
 
 {
+  # XXX: use the `github:` scheme instead of the more readable git+https: because it's *way* more efficient
+  # preferably, i would rewrite the human-readable https URLs to nix-specific github: URLs with a helper,
+  # but `inputs` is required to be a strict attrset: not an expression.
   inputs = {
-    nixpkgs-stable.url = "nixpkgs/nixos-22.11";
-    nixpkgs-unpatched.url = "nixpkgs/nixos-unstable";
+    # <https://github.com/nixos/nixpkgs/tree/nixos-22.11>
+    nixpkgs-stable.url = "github:nixos/nixpkgs?ref=nixos-22.11";
+
+    # <https://github.com/nixos/nixpkgs/tree/nixos-unstable>
+    nixpkgs-unpatched.url = "github:nixos/nixpkgs?ref=nixos-unstable";
     nixpkgs = {
-      url = "path:nixpatches";
+      url = "./nixpatches";
       inputs.nixpkgs.follows = "nixpkgs-unpatched";
     };
     mobile-nixos = {
+      # <https://github.com/nixos/mobile-nixos>
       url = "github:nixos/mobile-nixos";
       flake = false;
     };
     home-manager = {
-      url = "github:nix-community/home-manager/release-22.05";
+      # <https://github.com/nix-community/home-manager/tree/release-22.05>
+      url = "github:nix-community/home-manager?ref=release-22.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     sops-nix = {
+      # <https://github.com/Mic92/sops-nix>
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
@@ -43,10 +63,12 @@
 
       evalHost = { name, local, target }:
         let
-          # XXX: we'd prefer to use `nixosSystem = (nixpkgsCompiledBy local).nixos`
+          # XXX: we'd prefer to use `nixosSystem = (nixpkgsCompiledBy target).nixos`
           # but it doesn't propagate config to the underlying pkgs, meaning it doesn't let you use
           # non-free packages even after setting nixpkgs.allowUnfree.
-          nixosSystem = import ((nixpkgsCompiledBy local).path + "/nixos/lib/eval-config.nix");
+          # XXX: patch using the target -- not local -- otherwise the target will
+          # need to emulate the host in order to rebuild!
+          nixosSystem = import ((nixpkgsCompiledBy target).path + "/nixos/lib/eval-config.nix");
         in
           (nixosSystem {
             # we use pkgs built for and *by* the target, i.e. emulation, by default.
@@ -60,6 +82,7 @@
                 nixpkgs.overlays = [
                   self.overlays.default
                   self.overlays.passthru
+                  self.overlays.pins
                 ];
               }
             ];
@@ -96,11 +119,12 @@
 
       overlays = rec {
         default = pkgs;
-        pkgs = import ./pkgs/overlay.nix;
+        pkgs = import ./overlays/pkgs.nix;
+        pins = import ./overlays/pins.nix;  # TODO: move to `nixpatches/` input
         passthru =
           let
             stable = next: prev: {
-              stable = nixpkgs-stable.legacyPackages."${prev.stdenv.hostPlatform}";
+              stable = nixpkgs-stable.legacyPackages."${prev.stdenv.hostPlatform.system}";
             };
             mobile = (import "${mobile-nixos}/overlay/overlay.nix");
             uninsane = uninsane-dot-org.overlay;

hosts/common/cross.nix

@@ -1,5 +1,12 @@
-{ ... }:
+{ config, ... }:
 
+let
+  mkCrossFrom = localSystem: pkgs: import pkgs.path {
+    inherit localSystem;
+    crossSystem = pkgs.stdenv.hostPlatform.system;
+    inherit (config.nixpkgs) config overlays;
+  };
+in
 {
   # the configuration of which specific package set `pkgs.cross` refers to happens elsewhere;
   # here we just define them all.
@@ -8,8 +15,8 @@
       # non-emulated packages build *from* local *for* target.
       # for large packages like the linux kernel which are expensive to build under emulation,
       # the config can explicitly pull such packages from `pkgs.cross` to do more efficient cross-compilation.
-      crossFrom."x86_64-linux" = (prev.forceSystem "x86_64-linux" null).appendOverlays next.overlays;
-      crossFrom."aarch64-linux" = (prev.forceSystem "aarch64-linux" null).appendOverlays next.overlays;
+      crossFrom."x86_64-linux" = mkCrossFrom "x86_64-linux" next;
+      crossFrom."aarch64-linux" = mkCrossFrom "aarch64-linux" next;
     })
   ];
 }

hosts/common/default.nix

@@ -30,6 +30,9 @@
     "/var/lib/machines"            # maybe not needed, but would be painful to add a VM and forget.
   ];
 
+  # some services which use private directories error if the parent (/var/lib/private) isn't 700.
+  sane.fs."/var/lib/private".dir.acl.mode = "0700";
+
   nixpkgs.config.allowUnfree = true;
 
   # time.timeZone = "America/Los_Angeles";
@@ -39,6 +42,11 @@
   nix.extraOptions = ''
     experimental-features = nix-command flakes
   '';
+  # allow `nix-shell` (and probably nix-index?) to locate our patched and custom packages
+  nix.nixPath = [
+    "nixpkgs=${pkgs.path}"
+    "nixpkgs-overlays=${../..}/overlays"
+  ];
 
   # TODO: move this into home-manager?
   fonts = {

hosts/common/feeds.nix

@@ -41,6 +41,8 @@ let
       );
     } // lib.optionalAttrs (raw.is_podcast or false) {
       format = "podcast";
+    } // lib.optionalAttrs (raw.title or "" != "") {
+      title = lib.mkDefault raw.title;
     };
 
   podcasts = [

hosts/common/ids.nix

@@ -21,6 +21,10 @@
   sane.ids.freshrss.uid = 2401;
   sane.ids.freshrss.gid = 2401;
   sane.ids.mediawiki.uid = 2402;
+  sane.ids.signald.uid = 2403;
+  sane.ids.signald.gid = 2403;
+  sane.ids.mautrix-signal.uid = 2404;
+  sane.ids.mautrix-signal.gid = 2404;
 
   sane.ids.colin.uid = 1000;
   sane.ids.guest.uid = 1100;

hosts/common/users.nix

@@ -86,6 +86,7 @@ in
       "Pictures"
       "Videos"
 
+      ".cache/nix"
       ".cargo"
       ".rustup"
     ];

hosts/moby/kernel.nix

@@ -125,6 +125,9 @@ in
         # aarch64-unknown-linux-gnu-gcc: error: unrecognized command line option '-mfpu=neon'
         # make[3]: *** [../scripts/Makefile.build:289: drivers/video/fbdev/sun5i-eink-neon.o] Error 1
         FB_SUN5I_EINK = no;
+        # used by the pinephone pro, but fails to compile with:
+        # ../drivers/media/i2c/ov8858.c:1834:27: error: implicit declaration of function 'compat_ptr'
+        VIDEO_OV8858 = no;
       })
     ))
   ];

hosts/servo/services/ejabberd.nix

@@ -46,6 +46,8 @@
   }];
 
   # provide access to certs
+  # TODO: this should just be `acme`. then we also add nginx to the `acme` group.
+  #   why is /var/lib/acme/* owned by `nginx` group??
   users.users.ejabberd.extraGroups = [ "nginx" ];
 
   security.acme.certs."uninsane.org".extraDomainNames = [

hosts/servo/services/matrix/default.nix

@@ -6,6 +6,7 @@
   imports = [
     ./discord-puppet.nix
     # ./irc.nix
+    ./signal.nix
   ];
 
   sane.persist.sys.plaintext = [

hosts/servo/services/matrix/signal.nix

@@ -0,0 +1,35 @@
+# config options:
+# - <https://github.com/mautrix/signal/blob/master/mautrix_signal/example-config.yaml>
+{ config, pkgs, ... }:
+{
+  services.signald.enable = true;
+  services.mautrix-signal.enable = true;
+  services.mautrix-signal.environmentFile =
+    config.sops.secrets.mautrix_signal_env.path;
+
+  services.mautrix-signal.settings.signal.socket_path = "/run/signald/signald.sock";
+  services.mautrix-signal.settings.homeserver.domain = "uninsane.org";
+  services.mautrix-signal.settings.bridge.permissions."@colin:uninsane.org" = "admin";
+  services.matrix-synapse.settings.app_service_config_files = [
+    # auto-created by mautrix-signal service
+    "/var/lib/mautrix-signal/signal-registration.yaml"
+  ];
+
+  systemd.services.mautrix-signal.serviceConfig = {
+    # allow communication to signald
+    SupplementaryGroups = [ "signald" ];
+    ReadWritePaths = [ "/run/signald" ];
+  };
+
+  sane.persist.sys.plaintext = [
+    { user = "mautrix-signal"; group = "mautrix-signal"; directory = "/var/lib/mautrix-signal"; }
+  ];
+
+  sops.secrets.mautrix_signal_env = {
+    sopsFile = ../../../../secrets/servo/mautrix_signal_env.bin;
+    format = "binary";
+    mode = "0440";
+    owner = config.users.users.mautrix-signal.name;
+    group = config.users.users.matrix-synapse.name;
+  };
+}

modules/data/keys.nix

@@ -21,4 +21,10 @@
       servo.root = root;
     };
   };
+
+  com.github = rec {
+    # documented here: <https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints>
+    # Github actually uses multiple keys -- one per format
+    root = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
+  };
 }

modules/feeds.nix

@@ -16,6 +16,10 @@ let
         type = types.enum [ "text" "image" "podcast" ];
         default = "text";
       };
+      title = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+      };
       url = mkOption {
         type = types.str;
         description = ''

modules/gui/snippets.txt

@@ -1,6 +1,7 @@
 https://search.nixos.org/options?channel=unstable&query=
 https://search.nixos.org/packages?channel=unstable&query=
 https://nixos.wiki/index.php?go=Go&search=
+https://nixos.org/manual/nix/stable/language/builtins.html
 https://github.com/nixos/nixpkgs/pulls?q=
 https://nur.nix-community.org/
 https://nix-community.github.io/home-manager/options.html

modules/lib/feeds.nix

@@ -12,8 +12,24 @@ rec {
   # transform a list of feeds into an attrs mapping cat => [ feed0 feed1 ... ]
   partitionByCat = feeds: builtins.groupBy (f: f.cat) feeds;
 
+  xmlTag = tag: close: attrs:
+    let
+      fmt-attrs = builtins.concatStringsSep
+        " "
+        (lib.mapAttrsToList (name: value: ''${lib.escapeXML name}="${lib.escapeXML value}"'') attrs);
+      fmt-close = if close then "/" else "";
+    in
+      ''<${tag} ${fmt-attrs} ${fmt-close}>'';
+
   # represents a single RSS feed.
-  opmlTerminal = feed: ''<outline xmlUrl="${feed.url}" type="rss"/>'';
+  opmlTerminal = feed: xmlTag "outline" true (
+    {
+      xmlUrl = feed.url;
+      type = "rss";
+    } // lib.optionalAttrs (feed.title != null) {
+      title = feed.title;
+    }
+  );
   # a list of RSS feeds.
   opmlTerminals = feeds: lib.concatStringsSep "\n" (builtins.map opmlTerminal feeds);
   # one node which packages some flat grouping of terminals.

modules/packages.nix

@@ -102,7 +102,9 @@ let
     gnome.gnome-terminal  # works on phosh
     gnome.gnome-weather
 
-    { pkg = gpodder-configured; dir = [ "gPodder/Downloads" ]; }
+    # XXX: we preserve the whole thing because if we only preserve gPodder/Downloads
+    #   then startup is SLOW during feed import, and we might end up with zombie eps in the dl dir.
+    { pkg = gpodder-configured; dir = [ "gPodder" ]; }
 
     gthumb
     handbrake
@@ -151,7 +153,9 @@ let
     # vlc remembers play position in ~/.config/vlc/vlc-qt-interface.conf
     { pkg = vlc; dir = [ ".config/vlc" ]; }
 
-    whalebird # pleroma client. input is broken on phosh
+    # pleroma client (Electron). input is broken on phosh.
+    { pkg = whalebird; private = [ ".config/Whalebird" ]; }
+
     xdg-utils  # for xdg-open
     xterm  # broken on phosh
   ]

modules/persist/default.nix

@@ -103,7 +103,7 @@ let
     (orig: lib.recursiveUpdate
       (builtins.removeAttrs orig ["user" "group" "mode" ])
       {
-        acl = sane-lib.filterByName ["user" "group" "mode"] (orig.acl or {});
+        acl = sane-lib.filterByName ["user" "group" "mode"] orig;
       }
     )
     to;

modules/services/default.nix

@@ -4,6 +4,7 @@
     ./duplicity.nix
     ./dyn-dns.nix
     ./kiwix-serve.nix
+    ./mautrix-signal.nix
     ./nixserve.nix
     ./trust-dns.nix
   ];

modules/services/mautrix-signal.nix

@@ -0,0 +1,174 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  dataDir = "/var/lib/mautrix-signal";
+  registrationFile = "${dataDir}/signal-registration.yaml";
+  cfg = config.services.mautrix-signal;
+  settingsFormat = pkgs.formats.json {};
+  settingsFile =
+    settingsFormat.generate "mautrix-signal-config.json" cfg.settings;
+in
+{
+  options = {
+    services.mautrix-signal = {
+      enable = mkEnableOption (lib.mdDoc "Mautrix-Signal, a Matrix-Signal puppeting bridge");
+
+      settings = mkOption rec {
+        apply = recursiveUpdate default;
+        inherit (settingsFormat) type;
+        default = {
+          # defaults based on this upstream example config:
+          # - <https://github.com/mautrix/signal/blob/master/mautrix_signal/example-config.yaml>
+          homeserver = {
+            address = "http://localhost:8008";
+            software = "standard";
+            # domain = "SETME";
+          };
+
+          appservice = rec {
+            address = "http://${hostname}:${toString port}";
+            hostname = "localhost";
+            port = 29328;
+
+            database = "sqlite:///${dataDir}/mautrix-signal.db";
+            database_opts = {};
+            bot_username = "signalbot";
+          };
+
+          bridge = {
+            username_template = "signal_{userid}";
+            permissions."*" = "relay";
+            double_puppet_server_map = {};
+            login_shared_secret_map = {};
+          };
+
+          logging = {
+            version = 1;
+
+            formatters.precise.format = "[%(levelname)s@%(name)s] %(message)s";
+
+            handlers.console = {
+              class = "logging.StreamHandler";
+              formatter = "precise";
+            };
+
+            # log to console/systemd instead of file
+            root = {
+              level = "INFO";
+              handlers = ["console"];
+            };
+          };
+        };
+        example = literalExpression ''
+          {
+            homeserver = {
+              address = "http://localhost:8008";
+              domain = "mydomain.example";
+            };
+
+            bridge.permissions = {
+              "@admin:mydomain.example" = "admin";
+              "mydomain.example" = "user";
+            };
+          }
+        '';
+        description = lib.mdDoc ''
+          {file}`config.yaml` configuration as a Nix attribute set.
+          Configuration options should match those described in
+          [example-config.yaml](https://github.com/mautrix/signale/blob/master/mautrix_signal/example-config.yaml).
+        '';
+      };
+
+      environmentFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = lib.mdDoc ''
+          File containing environment variables to be passed to the mautrix-signal service,
+          in which secret tokens can be specified securely by defining values for e.g.
+          `MAUTRIX_SIGNAL_APPSERVICE_AS_TOKEN`,
+          `MAUTRIX_SIGNAL_APPSERVICE_HS_TOKEN`
+
+          These environment variables can also be used to set other options by
+          replacing hierarchy levels by `.`, converting the name to uppercase
+          and prepending `MAUTRIX_SIGNAL_`.
+          For example, the first value above maps to
+          {option}`settings.appservice.as_token`.
+
+          The environment variable values can be prefixed with `json::` to have
+          them be parsed as JSON. For example, `login_shared_secret_map` can be
+          set as follows:
+          `MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET_MAP=json::{"example.com":"secret"}`.
+        '';
+      };
+
+      serviceDependencies = mkOption {
+        type = with types; listOf str;
+        default = optional config.services.matrix-synapse.enable "matrix-synapse.service";
+        defaultText = literalExpression ''
+          optional config.services.matrix-synapse.enable "matrix-synapse.service"
+        '';
+        description = lib.mdDoc ''
+          List of Systemd services to require and wait for when starting the application service.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.groups.mautrix-signal = {};
+
+    users.users.mautrix-signal = {
+      group = "mautrix-signal";
+      isSystemUser = true;
+    };
+
+    systemd.services.mautrix-signal = {
+      description = "Mautrix-Signal, a Matrix-Signal puppeting bridge.";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ] ++ cfg.serviceDependencies;
+      after = [ "network-online.target" ] ++ cfg.serviceDependencies;
+      path = [ pkgs.ffmpeg ];  # voice messages need `ffmpeg`
+
+      # environment.HOME = dataDir;
+
+      preStart = ''
+        # generate the appservice's registration file if absent
+        if [ ! -f '${registrationFile}' ]; then
+          ${pkgs.mautrix-signal}/bin/mautrix-signal \
+            --generate-registration \
+            --no-update \
+            --base-config='${pkgs.mautrix-signal}/${pkgs.mautrix-signal.pythonModule.sitePackages}/mautrix_signal/example-config.yaml' \
+            --config='${settingsFile}' \
+            --registration='${registrationFile}'
+        fi
+      '';
+
+      serviceConfig = {
+        Type = "simple";
+        Restart = "always";
+
+        User = "mautrix-signal";
+
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+
+        PrivateTmp = true;
+        WorkingDirectory = pkgs.mautrix-signal;
+        StateDirectory = baseNameOf dataDir;
+        UMask = "0027";
+        EnvironmentFile = cfg.environmentFile;
+
+        ExecStart = ''
+          ${pkgs.mautrix-signal}/bin/mautrix-signal \
+            --config='${settingsFile}' \
+            --no-update
+        '';
+      };
+    };
+  };
+}

nixpatches/flake.nix

@@ -1,15 +1,14 @@
 {
   inputs = {
-    nixpkgs.url = "nixpkgs/nixos-22.11";
+    nixpkgs = {};
   };
-  outputs = { self, nixpkgs }:
+  outputs = { self, nixpkgs }@inputs:
     let
       patchedPkgsFor = system: nixpkgs.legacyPackages.${system}.applyPatches {
         name = "nixpkgs-patched-uninsane";
         src = nixpkgs;
         patches = import ./list.nix {
-          inherit (nixpkgs.legacyPackages.${system}) fetchpatch;
-          inherit (nixpkgs.lib) fakeHash;
+          inherit (nixpkgs.legacyPackages.${system}) fetchpatch fetchurl;
         };
       };
       patchedFlakeFor = system: import "${patchedPkgsFor system}/flake.nix";

nixpatches/list.nix

@@ -1,4 +1,4 @@
-{ fakeHash, fetchpatch }: [
+{ fetchpatch, fetchurl }: [
   # librewolf: build with `MOZ_REQUIRE_SIGNING=false`
   (fetchpatch {
     url = "https://github.com/NixOS/nixpkgs/pull/199134.diff";
@@ -13,10 +13,17 @@
     sha256 = "sha256-t4sG+xLDaxbJ/mV5G18N4ag8EC3IXPgtN5FJGANh1Dc=";
   })
 
-  # kiwix-tools: init at 3.4.0
+  # whalebird: 4.6.5 -> 4.7.4
   (fetchpatch {
-    url = "https://github.com/NixOS/nixpkgs/pull/206254.diff";
-    sha256 = "sha256-Z4V9mOv4HYg3kDnWoYcxz3ch03I/1USrLjzlq4X9YqI=";
+    # url = "https://git.uninsane.org/colin/nixpkgs/compare/master...pr.whalebird-4.7.4.diff";
+    url = "https://git.uninsane.org/colin/nixpkgs/commit/f5c7c70dde720e990fa7e0748d1dc4764d6e4406.diff";
+    sha256 = "sha256-L9Ie80loaP6yl5ZFnJ1b5WMDpvO1QFE8tbrW5HBauko=";
+  })
+
+  # nixos/mx-puppet-discord: move to matrix category
+  (fetchurl {
+    url = "https://git.uninsane.org/colin/nixpkgs/commit/87c877fff84717478a96d1b0c65bd2febd350dea.diff";
+    sha256 = "sha256-E5TonCj3f8j7kxApBq/suNT5mB7z8uD00NzI34Qh2SE=";
   })
 
   ./2022-12-19-i2p-aarch64.patch

overlays/pins.nix

@@ -0,0 +1,24 @@
+(next: prev: {
+  inherit (next.stable)
+    # TODO(unpin): broken on 2023/01/14 via mtxclient dep, aarch64-only:
+    #   error: builder for '/nix/store/gwidl0c9ksxjgx0dgwnjssix4ikq73v5-mtxclient-0.9.0.drv' failed with exit code 2;
+    #      last 10 log lines:
+    #      > make[2]: *** [CMakeFiles/matrix_client.dir/build.make:370: CMakeFiles/matrix_client.dir/lib/structs/events/encrypted.cpp.o] Error 1
+    #      > In file included from /build/source/include/mtxclient/crypto/client.hpp:17,
+    #      >                  from /build/source/lib/crypto/utils.cpp:17:
+    #      > /build/source/include/mtx/identifiers.hpp:12:10: fatal error: compare: No such file or directory
+    #      >    12 | #include <compare>
+    #      >       |          ^~~~~~~~~
+    #      > compilation terminated.
+    #      > make[2]: *** [CMakeFiles/matrix_client.dir/build.make:132: CMakeFiles/matrix_client.dir/lib/crypto/utils.cpp.o] Error 1
+    #      > make[1]: *** [CMakeFiles/Makefile2:83: CMakeFiles/matrix_client.dir/all] Error 2
+    #      > make: *** [Makefile:136: all] Error 2
+    #      For full logs, run 'nix log /nix/store/gwidl0c9ksxjgx0dgwnjssix4ikq73v5-mtxclient-0.9.0.drv'.
+    #   error: 1 dependencies of derivation '/nix/store/4i2d1qdh4x6n23h1jbcbhm8q9q2hch9a-nheko-0.11.0.drv' failed to build
+    #   error: 1 dependencies of derivation '/nix/store/k4f7k7cvjp8rb7clhlfq3yxgs6lbfmk7-home-manager-path.drv' failed to build
+    #   error: 1 dependencies of derivation '/nix/store/67d9k554188lh4ddl4ar6j74mpc3r4sv-home-manager-generation.drv' failed to build
+    #   error: 1 dependencies of derivation '/nix/store/5qjxzhsw1jvh2d7jypbcam9409ivb472-user-environment.drv' failed to build
+    #   error: 1 dependencies of derivation '/nix/store/hrb3qpdbisqh0lzlyz1g9g4164khmqwn-etc.drv' failed to build
+    #   error: 1 dependencies of derivation '/nix/store/ny21xyicbgim5wy7ksg2hibd9gn7i01b-nixos-system-moby-23.05pre-git.drv' failed to build
+    nheko;
+})

overlays/pkgs.nix

@@ -0,0 +1,67 @@
+(next: prev:
+  let
+    sane = rec {
+      #### my own, non-upstreamable packages:
+      sane-scripts = prev.callPackage ../pkgs/sane-scripts { };
+      feeds = prev.callPackage ../pkgs/feeds { };
+      tow-boot-pinephone = prev.callPackage ../pkgs/tow-boot-pinephone { };
+      tow-boot-rpi4 = prev.callPackage ../pkgs/tow-boot-rpi4 { };
+      bootpart-uefi-x86_64 = prev.callPackage ../pkgs/bootpart-uefi-x86_64 { };
+      bootpart-tow-boot-rpi-aarch64 = prev.callPackage ../pkgs/bootpart-tow-boot-rpi-aarch64 {
+        # not sure why i can't just do `next.callPackage` instead
+        inherit tow-boot-rpi4;
+      };
+      bootpart-u-boot-rpi-aarch64 = prev.callPackage ../pkgs/bootpart-u-boot-rpi-aarch64 {
+        # not sure why i can't just do `next.callPackage` instead
+        inherit ubootRaspberryPi4_64bit;
+      };
+      rtl8723cs-firmware = prev.callPackage ../pkgs/rtl8723cs-firmware { };
+      linux-megous = prev.callPackage ../pkgs/linux-megous {
+        kernelPatches = [
+          prev.kernelPatches.bridge_stp_helper
+          prev.kernelPatches.request_key_helper
+        ];
+      };
+
+      sublime-music-mobile = prev.callPackage ../pkgs/sublime-music-mobile { };
+
+      #### customized packages
+      fluffychat-moby = prev.callPackage ../pkgs/fluffychat-moby { };
+      gpodder-configured = prev.callPackage ../pkgs/gpodder-configured { };
+      # nixos-unstable pleroma is too far out-of-date for our db
+      pleroma = prev.callPackage ../pkgs/pleroma { };
+      # jackett doesn't allow customization of the bind address: this will probably always be here.
+      jackett = prev.callPackage ../pkgs/jackett { inherit (prev) jackett; };
+      # mozilla keeps nerfing itself and removing configuration options
+      firefox-unwrapped = prev.callPackage ../pkgs/firefox-unwrapped { };
+
+      # patch rpi uboot with something that fixes USB HDD boot
+      ubootRaspberryPi4_64bit = prev.callPackage ../pkgs/ubootRaspberryPi4_64bit { };
+
+      gocryptfs = prev.callPackage ../pkgs/gocryptfs { inherit (prev) gocryptfs; };
+
+      browserpass = prev.callPackage ../pkgs/browserpass { inherit (prev) browserpass; inherit sane-scripts; };
+
+      fractal-latest = prev.callPackage ../pkgs/fractal-latest { };
+
+      #### TEMPORARY: PACKAGES WAITING TO BE UPSTREAMED
+
+      pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+        (py-final: py-prev: {
+          feedsearch-crawler = py-final.callPackage ../pkgs/feedsearch-crawler { };
+        })
+      ];
+
+      kaiteki = prev.callPackage ../pkgs/kaiteki { };
+      lightdm-mobile-greeter = prev.callPackage ../pkgs/lightdm-mobile-greeter { };
+      browserpass-extension = prev.callPackage ../pkgs/browserpass-extension { };
+      gopass-native-messaging-host = prev.callPackage ../pkgs/gopass-native-messaging-host { };
+      tokodon = prev.libsForQt5.callPackage ../pkgs/tokodon { };
+      signaldctl = prev.callPackage ../pkgs/signaldctl { };
+      splatmoji = prev.callPackage ../pkgs/splatmoji { };
+      # trust-dns = prev.callPackage ../pkgs/trust-dns { };
+      # kaiteki = prev.kaiteki;
+    };
+  in sane // { inherit sane; }
+)
+

pkgs/feeds/default.nix

@@ -35,7 +35,7 @@
           # but in a way where the least could go wrong.
           pushd "$sources_dir"; mkdir -p "$name"; popd
 
-          ${./update.sh} "$url" "$json_path"
+          ${./update.py} "$url" "$json_path"
           cat "$json_path"
         '';
     }

pkgs/feeds/template.nix

@@ -14,10 +14,7 @@ stdenv.mkDerivation {
   src = fetchurl {
     inherit url;
   };
-  passthru.updateScript = [ ./update.sh url jsonPath ];
-  # passthru.updateScript = callPackage ./update.nix {
-  #   inherit url jsonPath;
-  # };
+  passthru.updateScript = [ ./update.py url jsonPath ];
   meta = {
     description = "metadata about any feeds available at ${feedName}";
     homepage = feedName;

pkgs/feeds/update.nix

@@ -1,18 +0,0 @@
-{ lib
-, curl
-, jq
-, runtimeShell
-, writeScript
-# feed-specific args
-, jsonPath
-, url
-}:
-
-let
-  apiQuery = "https://feedsearch.dev/api/v1/search?url=${url}";
-in
-writeScript "update-feed" ''
-  #!${runtimeShell}
-  PATH=${lib.makeBinPath [ curl jq  ]}
-  curl -X GET '${apiQuery}' | jq '.[-1]' > '${jsonPath}'
-''

pkgs/feeds/update.py

@@ -0,0 +1,24 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python3 -p "python3.withPackages (ps: [ ps.feedsearch-crawler ])"
+
+from feedsearch_crawler import search, sort_urls
+from feedsearch_crawler.crawler import coerce_url
+
+import json
+import sys
+url, jsonPath = sys.argv[1:]
+
+url = coerce_url(url, default_scheme="https")
+items = search(url)
+items = sort_urls(items)
+
+# print all results
+serialized = [item.serialize() for item in items]
+for item in serialized:
+        print(json.dumps(item, sort_keys=True, indent=2))
+
+# save the first result to disk
+keep = serialized[0] if serialized else {}
+results = json.dumps(keep, sort_keys=True, indent=2)
+with open(jsonPath, "w") as out:
+        out.write(results)

pkgs/feeds/update.sh

@@ -1,10 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl jq
-
-set -xeu -o pipefail
-
-url="$1"
-jsonPath="$2"
-
-apiQuery="https://feedsearch.dev/api/v1/search?url=$url"
-curl -X GET "$apiQuery" | jq '.[0]' > "$jsonPath"

pkgs/feedsearch-crawler/default.nix

@@ -0,0 +1,65 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+# nativeBuildInputs python packages
+, poetry-core
+# propagatedBuildInputs python packages
+, aiodns
+, aiohttp
+, beautifulsoup4
+, brotlipy
+, cchardet
+, feedparser
+, python-dateutil
+, uvloop
+, w3lib
+, yarl
+}:
+
+buildPythonPackage rec {
+  pname = "feedsearch-crawler";
+  version = "2022-05-28";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "DBeath";
+    repo = "feedsearch-crawler";
+    rev = "f49a6f5a07e796e359c4482fd29305b1a019f71f";
+    hash = "sha256-pzvyeXzqdi8pRjk2+QjKhJfgtxbgVT6C08K9fhVFVmY=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'w3lib = "^1.22.0"' 'w3lib = "*"' \
+      --replace 'aiodns = "^2.0.0"' 'aiodns = "*"' \
+      --replace 'uvloop = "^0.15.2"' 'uvloop = "*"'
+  '';
+
+  propagatedBuildInputs = [
+    aiodns
+    aiohttp
+    beautifulsoup4
+    brotlipy
+    cchardet
+    feedparser
+    python-dateutil
+    uvloop
+    w3lib
+    yarl
+  ];
+
+  pythonImportsCheck = [
+    "feedsearch_crawler"
+  ];
+
+  meta = with lib; {
+    homepage = "https://feedsearch.dev";
+    description = "Crawl sites for RSS, Atom, and JSON feeds";
+    license = licenses.mit;
+    maintainers = with maintainers; [ colinsane ];
+  };
+}

pkgs/gpodder-configured/default.nix

@@ -1,22 +1,28 @@
 { makeWrapper
 , gpodder
+, linkFarm
 , symlinkJoin
-, writeShellScript
-, config
 }:
 
+let
+  remove-extra = linkFarm "gpodder-remove-extra" [
+    { name = "bin/gpodder-remove-extra"; path = ./remove_extra.py; }
+  ];
+in
+# we use a symlinkJoin so that we can inherit the .desktop and icon files from the original gPodder
 (symlinkJoin {
   name = "gpodder-configured";
-  paths = [ gpodder ];
+  paths = [ gpodder remove-extra ];
   buildInputs = [ makeWrapper ];
 
   # gpodder keeps all its feeds in a sqlite3 database.
   # we can configure the feeds externally by wrapping gpodder and just instructing it to import
   # a feedlist every time we run it.
-  # repeat imports are deduplicated -- assuming network access (not sure how it behaves when disconnected).
+  # repeat imports are deduplicated by url, even when offline.
   postBuild = ''
     makeWrapper $out/bin/gpodder $out/bin/gpodder-configured \
-      --run "$out/bin/gpo import ~/.config/gpodderFeeds.opml"
+      --run "$out/bin/gpodder-remove-extra ~/.config/gpodderFeeds.opml" \
+      --run "$out/bin/gpo import ~/.config/gpodderFeeds.opml" \
 
     # fix up the .desktop file to invoke our wrapped application
     orig_desktop=$(readlink $out/share/applications/gpodder.desktop)

pkgs/gpodder-configured/remove_extra.py

@@ -0,0 +1,79 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python3 -p "python3.withPackages (ps: [gnome-feeds.listparser])" -p gpodder
+
+from dataclasses import dataclass, field
+import listparser
+import subprocess
+import sys
+
+@dataclass(repr=True)
+class Feed:
+    url: str
+    title: str  # Optional
+    def __init__(self, url: str, title: str):
+        self.url = url
+        self.title = title if title else None
+
+    def __eq__(self, other: 'Feed') -> bool:
+        return self.url == other.url and \
+            (self.title == other.title or None in [self.title, other.title])
+
+@dataclass(init=True)
+class Partitioned:
+    has_not_wanted: list[Feed] = field(default_factory=list)
+    wanted_not_has: list[Feed] = field(default_factory=list)
+    intersection:   list[Feed] = field(default_factory=list)
+
+
+def wanted_feeds(opml_file: str):
+    parsed = listparser.parse(open(opml_file).read())
+    return [Feed(url=p['url'], title=p['title']) for p in parsed.feeds]
+
+def has_feeds():
+    listing = subprocess.check_output(["gpo", "list"]).decode()
+    feeds = []
+
+    title = None
+    for line in listing.split("\n"):
+        if line.startswith("# "):  # title
+            title = line[2:].strip()
+        elif line.startswith("http"):  # feed URL:
+            feeds.append(Feed(url=line, title=title))
+            title = None
+
+    return feeds
+
+def partition_feeds(wanted: list[Feed], has: list[Feed]) -> Partitioned:
+    p = Partitioned()
+    for f in wanted + has:
+        w, h = f in wanted, f in has
+        if h and not w:
+            p.has_not_wanted.append(f)
+        elif w and not h:
+            p.wanted_not_has.append(f)
+        else:
+            assert w and h
+            p.intersection.append(f)
+
+    return p
+
+def remove_feed(feed: Feed):
+    subprocess.check_output(['gpo', 'unsubscribe', feed.url])
+
+def rationalize_feeds(opml_file: str):
+    wanted = wanted_feeds(opml_file)
+    has = has_feeds()
+    partitioned = partition_feeds(wanted, has)
+
+    print("extra feeds:", "" if partitioned.has_not_wanted else "(none)")
+    for f in partitioned.has_not_wanted:
+        print("  ", f)
+    print()
+
+    for f in partitioned.has_not_wanted:
+        remove_feed(f)
+
+if __name__ == "__main__":
+    wanted_opml, = sys.argv[1:]
+    rationalize_feeds(wanted_opml)
+

pkgs/linux-megous/default.nix

@@ -5,7 +5,7 @@ with lib;
 let
   base = "6.1.0";
   # set to empty if not a release candidate
-  rc = "-rc7";
+  rc = "-rc8";
 in buildLinux (args // rec {
   version = base + rc;
 
@@ -16,9 +16,15 @@ in buildLinux (args // rec {
   extraMeta.branch = versions.majorMinor version;
 
   src = fetchFromGitHub {
+    # HOW TO UPDATE:
+    # - `git fetch` from megous' github.
+    # - there should be some new tag, like `orange-pi-6.1-blah`. use that.
+    # - megi publishes release notes as the most recent commit on any stable branch, so just `git log`.
+    # - orange-pi is listed as the "main integration branch".
+    #   - specific branches like `pp` (pinephone) are dev branches, and probably less stable.
     owner = "megous";
     repo = "linux";
-    rev = "orange-pi-6.1-20221128-1027";
-    hash = "sha256-kEujs4v5rPHPYy4YLyEWHa1Bu0sxoXLgSvmOH9QPWos=";
+    rev = "orange-pi-6.1-20221211-1046";
+    hash = "sha256-TgFXH8bHWHs26rlf7a/zNO9zubFazC8Ie6J1gj4gLgw=";
   };
 } // (args.argsOverride or { }))

pkgs/overlay.nix

@@ -1,60 +0,0 @@
-(next: prev:
-  let
-    sane = rec {
-      #### my own, non-upstreamable packages:
-      sane-scripts = prev.callPackage ./sane-scripts { };
-      feeds = prev.callPackage ./feeds { };
-      tow-boot-pinephone = prev.callPackage ./tow-boot-pinephone { };
-      tow-boot-rpi4 = prev.callPackage ./tow-boot-rpi4 { };
-      bootpart-uefi-x86_64 = prev.callPackage ./bootpart-uefi-x86_64 { };
-      bootpart-tow-boot-rpi-aarch64 = prev.callPackage ./bootpart-tow-boot-rpi-aarch64 {
-        # not sure why i can't just do `next.callPackage` instead
-        inherit tow-boot-rpi4;
-      };
-      bootpart-u-boot-rpi-aarch64 = prev.callPackage ./bootpart-u-boot-rpi-aarch64 {
-        # not sure why i can't just do `next.callPackage` instead
-        inherit ubootRaspberryPi4_64bit;
-      };
-      rtl8723cs-firmware = prev.callPackage ./rtl8723cs-firmware { };
-      linux-megous = prev.callPackage ./linux-megous {
-        kernelPatches = [
-          prev.kernelPatches.bridge_stp_helper
-          prev.kernelPatches.request_key_helper
-        ];
-      };
-
-      sublime-music-mobile = prev.callPackage ./sublime-music-mobile { };
-
-      #### customized packages
-      fluffychat-moby = prev.callPackage ./fluffychat-moby { };
-      gpodder-configured = prev.callPackage ./gpodder-configured { };
-      # nixos-unstable pleroma is too far out-of-date for our db
-      pleroma = prev.callPackage ./pleroma { };
-      # jackett doesn't allow customization of the bind address: this will probably always be here.
-      jackett = prev.callPackage ./jackett { inherit (prev) jackett; };
-      # mozilla keeps nerfing itself and removing configuration options
-      firefox-unwrapped = prev.callPackage ./firefox-unwrapped { };
-
-      # patch rpi uboot with something that fixes USB HDD boot
-      ubootRaspberryPi4_64bit = prev.callPackage ./ubootRaspberryPi4_64bit { };
-
-      gocryptfs = prev.callPackage ./gocryptfs { inherit (prev) gocryptfs; };
-
-      browserpass = prev.callPackage ./browserpass { inherit (prev) browserpass; inherit sane-scripts; };
-
-      fractal-latest = prev.callPackage ./fractal-latest { };
-
-      #### TEMPORARY: PACKAGES WAITING TO BE UPSTREAMED
-      kaiteki = prev.callPackage ./kaiteki { };
-      lightdm-mobile-greeter = prev.callPackage ./lightdm-mobile-greeter { };
-      browserpass-extension = prev.callPackage ./browserpass-extension { };
-      gopass-native-messaging-host = prev.callPackage ./gopass-native-messaging-host { };
-      tokodon = prev.libsForQt5.callPackage ./tokodon { };
-      signaldctl = prev.callPackage ./signaldctl { };
-      splatmoji = prev.callPackage ./splatmoji { };
-      # trust-dns = prev.callPackage ./trust-dns { };
-      # kaiteki = prev.kaiteki;
-    };
-  in sane // { inherit sane; }
-)
-

pkgs/sane-scripts/src/sane-bt-search

@@ -1,4 +1,5 @@
-#!/usr/bin/env python
+#!/usr/bin/env nix-shell
+#!nix-shell -i python3 -p "python3.withPackages (ps: [ ps.natsort ps.requests ])"
 """
 usage: sane-bt-search <query_string>
 
@@ -67,5 +68,6 @@ q = " ".join(sys.argv[1:])
 
 client = Client()
 res = client.query(q)
+print(f"found {len(res)} result(s)")
 for r in res[:5]:
     print(r)

secrets/servo/mautrix_signal_env.bin

@@ -0,0 +1,32 @@
+{
+	"data": "ENC[AES256_GCM,data:5n4FNKyblSOQCC17LmLNfF49+z6ZxX9bAv/xTsyQTR+NglhEtUa+JFziu2Il0w2pscAO37sBvE9SvsM9jNG0v4GxlxlLrgEuam6Tf7Ch71lDdxDXJWMTR032WqMF7q6rYbflw8D4fkpQ9yDbgDJUErrds1JvbNhcv6oqoJ/TuhiQZLakNTprtRkw4gCDJDsyDakhv440EK80o/O1CnO+xnSmBj6mLxljQ0EeFzwhjVr1UlhWJ4wQC8TNAAvYN5gILYP0U11kROI=,iv:JZougqWF29K9mDE0kwe03FGad1CglSlxQt5xM9l7wK8=,tag:DQXUPqMvvnqP2kyYikI2ZQ==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2M01sL1JsODFvVWRHOVZX\nTk1wQlRkclFVZnlKK2lBOUQ1M053SUZxUVYwCjVkVmoxdkRvd3YvQmxvMmd6Ly9k\nWlZGc3M1Yi9lZ3ZRUFJiYWNlRjZ6M2cKLS0tIElTRnplV25wTmFkSVU1clRNa0NZ\nNW5IaDJWYVNCdDNhYTFSU0J6RUJQN28K4XJGpANIuIfHZuk4cinpsPeZ8mMI2jBH\nT2JGyRNm9Jyr3muV8oC/I22fAKLev8f9Svc+o/VAO4R6ZTWmTwk+dA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkQnpqLy83eW9HaExkYWxL\nMHRKY3FsemZQcmVwVWx0a0YvRCtCclZrT1ZRCjJ6UVVjSm85TnVTaHFMRlg0YkNa\nOEQ4eUNyV0lEalVXbi9TVDZLUEVvaXcKLS0tICtvaHhHdmRIY2NNTFBZZ2taS0lX\nak45eW5oT2tIWVNRNmkxbUQ5K2lublUKkLfW5vRfjTpfTOeirLXRik9SJDm92pUX\nXcv9L5klKUb0O3+T0pwb9rYFfhk4eGSxS6ZFQnGrLv0lLTRZq6eocw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhM25NNlRaNDJYZlJkMjVh\nelZPekdjSHJ4ZnZEbnBCZGV4OVN2RVJCOHpNCnVFWFBNTkd4SkJ0SkdvcUdYUzRF\ncnpPUUQyWEpMU0FqQyszTXp0ZFhQeFkKLS0tIDFua2dscEtxQmdUTm14OWlqMjBI\nSXY5cTJEajd3WmNMNlB1eGtQN3RHUEEK3+zoziFJq/rzpnz8ROL5oGqnHUpJTXG8\nhCQEIOA6dO6PjoXUKd6B8bVPzlDLO5daPh0TS5NGiMlZ8qQe706Syw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByc1EzcmVzeHYyTkQ3N2Uw\nTERtdENyeGNONVpjU0FKRE1wR0RlSnhNUjM0ClU4MGwvQjFhM2xXYkNITjFMUHdF\naU50YWVjU08zWXhweXVOWU13enpMQlUKLS0tIDdIRm5GV2IxU1AxcFZldDBBeTBt\nZnRJV25IbGo5R1RySmx4ampnNzdYU0EK7PF9BEGfX6T+1Wit9MG+02sGZTXRUR0M\noVC+oHsCAojhnMP17xyDosnJQqwrNKFwKMQbH7mqBW5Ku4hGy56cGQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2023-01-16T11:17:12Z",
+		"mac": "ENC[AES256_GCM,data:SqOusB8Hd713NYDOkRq2Ju6q4ClN0zOeeCTCAAv+EorKHN7vgz15LuCNWj7iLX4EWrWufzHhG7JFtm6q5h64hxlfzisx3JCtMLRlb40PkDip+2gShH7X4eWcdsRw7/a40e2Qnp/hiXrhH11P1pMqbn6drUPmLy307CyRzThVrcw=,iv:gFcF4i4dqk4rOus4ZKUojD/AAkIuWzGDfqEQTej83Co=,tag:AYknOJm7QTEBR6OzN8dsiw==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}