moby: build/deploy kaiteki

```
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/912f9ff41fd9353dec1f783170793699789fe9aa' (2022-09-26)
  → 'github:Mic92/sops-nix/0ce0449e6404c4ff9d1b7bd657794ae5ca54deb3' (2022-10-09)
• Updated input 'sops-nix/nixpkgs':
    'github:NixOS/nixpkgs/ff9793cfd1a25145a7e591af604675b3d6f68987' (2022-09-26)
  → 'github:NixOS/nixpkgs/7b06206fa24198912cea58de690aa4943f238fbf' (2022-10-08)
• Updated input 'sops-nix/nixpkgs-22_05':
    'github:NixOS/nixpkgs/00f877f4927b6f7d7b75731b5a1e2ae7324eaf14' (2022-09-26)
  → 'github:NixOS/nixpkgs/b3783bcfb8ec54e0de26feccfc6cc36b8e202ed5' (2022-10-09)
```

the only change appears to be that sops updated its own reference to
nixpkgs.

.sops.yaml

@@ -19,7 +19,7 @@ creation_rules:
       - *host_lappy
       - *host_servo
       - *host_moby
-  - path_regex: secrets/servo.yaml$
+  - path_regex: secrets/servo*
     key_groups:
     - age:
       - *user_desko_colin

flake.lock

@@ -39,11 +39,11 @@
     "mobile-nixos": {
       "flake": false,
       "locked": {
-        "lastModified": 1661716773,
-        "narHash": "sha256-uxf0aC+kx8av3/IT8/UecxSMElC9i4UQvH25RHFwna4=",
+        "lastModified": 1664852186,
+        "narHash": "sha256-t0FhmTf3qRs8ScR8H9Rq7FAxptNELLSpxZG2ALL1HnE=",
         "owner": "nixos",
         "repo": "mobile-nixos",
-        "rev": "09e388c42298fa777caa7738cd8d8d2b6d1ac8db",
+        "rev": "ca872f1a617674c4045e880aab8a45037e73700b",
         "type": "github"
       },
       "original": {
@@ -54,26 +54,26 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1663067291,
-        "narHash": "sha256-1BTrqhLMamWf53sJobtMiUDI91PEw6xF8YEwg2VE8w4=",
+        "lastModified": 1665081174,
+        "narHash": "sha256-6hsmzdhdy8Kbvl5e0xZNE83pW3fKQvNiobJkM6KQrgA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d86a4619b7e80bddb6c01bc01a954f368c56d1df",
+        "rev": "598f83ebeb2235435189cf84d844b8b73e858e0f",
         "type": "github"
       },
       "original": {
         "id": "nixpkgs",
-        "ref": "nixos-22.05",
+        "ref": "nixos-unstable",
         "type": "indirect"
       }
     },
     "nixpkgs-22_05": {
       "locked": {
-        "lastModified": 1662864125,
-        "narHash": "sha256-AtjyEFK7Zp9+hOOUNO1/YZRADV/wC94R3yeKN8saUK4=",
+        "lastModified": 1665279158,
+        "narHash": "sha256-TpbWNzoJ5RaZ302dzvjY2o//WxtOJuYT3CnDj5N69Hs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e6f053b6079c16e7df97531e3e0524ace1304d4d",
+        "rev": "b3783bcfb8ec54e0de26feccfc6cc36b8e202ed5",
         "type": "github"
       },
       "original": {
@@ -83,13 +83,28 @@
         "type": "github"
       }
     },
-    "nixpkgs_2": {
+    "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1662818301,
-        "narHash": "sha256-uRjbKN924ptf5CvQ4cfki3R9nIm5EhrJBeb/xUxwfcM=",
+        "lastModified": 1665132027,
+        "narHash": "sha256-zoHPqSQSENt96zTk6Mt1AP+dMNqQDshXKQ4I6MfjP80=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a25f0b9bbdfedee45305da5d1e1410c5bcbd48f6",
+        "rev": "9ecc270f02b09b2f6a76b98488554dd842797357",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-22.05",
+        "type": "indirect"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1665197809,
+        "narHash": "sha256-dRUzv/zNYV2EYtnxFG31pPBk0nErT+MBTu6ZJHm1o2A=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "7b06206fa24198912cea58de690aa4943f238fbf",
         "type": "github"
       },
       "original": {
@@ -105,6 +120,7 @@
         "impermanence": "impermanence",
         "mobile-nixos": "mobile-nixos",
         "nixpkgs": "nixpkgs",
+        "nixpkgs-stable": "nixpkgs-stable",
         "sops-nix": "sops-nix"
       }
     },
@@ -114,11 +130,11 @@
         "nixpkgs-22_05": "nixpkgs-22_05"
       },
       "locked": {
-        "lastModified": 1662870301,
-        "narHash": "sha256-O+ABD+WzEBLVH6FwxKCIpps0hsR6b5dpYe6fB3e3Ju8=",
+        "lastModified": 1665289655,
+        "narHash": "sha256-j1Q9mNBhbzeJykhObiXwEGres9qvP4vH7gxdJ+ihkLI=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "20929e1c5722a6db2f2dbe4cd36d4af0de0a9df0",
+        "rev": "0ce0449e6404c4ff9d1b7bd657794ae5ca54deb3",
         "type": "github"
       },
       "original": {

flake.nix

@@ -4,7 +4,8 @@
 
 {
   inputs = {
-    nixpkgs.url = "nixpkgs/nixos-22.05";
+    nixpkgs-stable.url = "nixpkgs/nixos-22.05";
+    nixpkgs.url = "nixpkgs/nixos-unstable";
     mobile-nixos = {
       url = "github:nixos/mobile-nixos";
       flake = false;
@@ -13,11 +14,12 @@
       url = "github:nix-community/home-manager/release-22.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    # TODO: set these up to follow our nixpkgs?
     sops-nix.url = "github:Mic92/sops-nix";
     impermanence.url = "github:nix-community/impermanence";
   };
 
-  outputs = { self, nixpkgs, mobile-nixos, home-manager, sops-nix, impermanence }:
+  outputs = { self, nixpkgs, nixpkgs-stable, mobile-nixos, home-manager, sops-nix, impermanence }:
   let
     patchedPkgs = system: nixpkgs.legacyPackages.${system}.applyPatches {
       name = "nixpkgs-patched-uninsane";
@@ -48,11 +50,14 @@
           nixpkgs.overlays = [
             (import "${mobile-nixos}/overlay/overlay.nix")
             (import ./pkgs/overlay.nix)
-            (next: prev: {
+            (next: prev: rec {
               # non-emulated packages build *from* local *for* target.
               # for large packages like the linux kernel which are expensive to build under emulation,
               # the config can explicitly pull such packages from `pkgs.cross` to do more efficient cross-compilation.
               cross = (nixpkgsFor local target) // (customPackagesFor local target);
+              stable = import nixpkgs-stable { system = target; };
+              # pinned packages:
+              electrum = stable.electrum;
             })
           ];
         }

machines/lappy/default.nix

@@ -7,6 +7,7 @@
   # sane.users.guest.enable = true;
   sane.gui.sway.enable = true;
   sane.impermanence.enable = true;
+  sane.nixcache.enable = true;
   boot.loader.efi.canTouchEfiVariables = false;
   sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
 

machines/moby/default.nix

@@ -1,13 +1,18 @@
 { config, pkgs, lib, mobile-nixos, ... }:
 {
   imports = [
-    # (import "${mobile-nixos}/lib/configuration.nix" {
-    #   device = "pine64-pinephone";
-    # })
     ./firmware.nix
     ./fs.nix
     ./kernel.nix
   ];
+
+  # cross-compiled documentation is *slow*.
+  # no obvious way to natively compile docs (2022/09/29).
+  # entrypoint is nixos/modules/misc/documentation.nix
+  # doc building happens in nixos/doc/manual/default.nix
+  # TODO: we could *maybe* inject pkgs.buildPackages.xyz = cross.buildPackages.xyz?
+  documentation.nixos.enable = false;
+
   # XXX colin: phosh doesn't work well with passwordless login
   users.users.colin.initialPassword = "147147";
   services.getty.autologinUser = "root";  # allows for emergency maintenance?
@@ -17,26 +22,6 @@
     ".librewolf"
   ];
 
-  # sane.home-manager.extraPackages = [
-  #   # for web browsers see: https://forum.pine64.org/showthread.php?tid=13669
-  #   pkgs.angelfish  # plasma mobile web browser; broken on phosh (poor wayland support)
-  #   # pkgs.plasma5Packages.index  # file browser
-  #   pkgs.plasma5Packages.konsole  # terminal
-  #   # pkgs.plasma5Packages.pix  # picture viewer
-  #   pkgs.plasma5Packages.kalk  # calculator; broken on phosh
-  #   # pkgs.plasma5Packages.buho  # (plasma mobile?) note application
-  #   pkgs.plasma5Packages.kasts  #  podcast app; works on phosh after setting QT envar
-  #   pkgs.plasma5Packages.koko  # image gallery; broken on phosh
-  #   pkgs.plasma5Packages.kwave  # media player.
-  #   # pkgs.plasma5Packages.neochat  #  matrix client. needs qcoro => no aarch64 support
-  #   # pkgs.plasma5Packages.plasma-dialer  # phone dialer
-  #   # pkgs.plasma5Packages.plasma-mobile  # the whole shebang?
-  #   # pkgs.plasma5Packages.plasma-settings
-  #   pkgs.plasma5Packages.bomber  # arcade game; broken on phosh
-  #   pkgs.plasma5Packages.kapman  # pacman
-  #   pkgs.st  # suckless terminal; broken on phosh
-  #   # pkgs.alacritty  # terminal; crashes phosh
-  # ];
   # sane.home-packages.enableGuiPkgs = false;  # XXX faster builds/imaging for debugging
   sane.home-manager.extraPackages = [
     pkgs.plasma5Packages.konsole  # terminal
@@ -47,10 +32,21 @@
   sane.gui.phosh.enable = true;
 
   boot.loader.efi.canTouchEfiVariables = false;
+  # /boot space is at a premium. default was 20.
+  boot.loader.generic-extlinux-compatible.configurationLimit = 10;
   # mobile.bootloader.enable = false;
   # mobile.boot.stage-1.enable = false;
   # boot.initrd.systemd.enable = false;
   # boot.initrd.services.swraid.enable = false;  # attempt to fix dm_mod stuff
+  # disable proximity sensor.
+  # the filtering/calibration is bad that it causes the screen to go fully dark at times.
+  boot.blacklistedKernelModules = [ "stk3310" ];
+
+  # without this some GUI apps fail: `DRM_IOCTL_MODE_CREATE_DUMB failed: Cannot allocate memory`
+  # this is because they can't allocate enough video ram.
+  # the default CMA seems to be 32M. we could probably get by with as little as 64M, and safely with 128M.
+  # `cat /proc/meminfo` to see CmaTotal/CmaFree if interested in tuning this.
+  boot.kernelParams = [ "cma=256M" ];
 
   # mobile-nixos' /lib/firmware includes:
   #   rtl_bt          (bluetooth)
@@ -70,5 +66,16 @@
   # enable rotation sensor
   hardware.sensor.iio.enable = true;
 
+  # from https://gitlab.manjaro.org/manjaro-arm/packages/community/phosh/alsa-ucm-pinephone
+  # mobile-nixos does this same thing, with *slightly different settings*.
+  # i trust manjaro more because the guy maintaining that is actively trying to upstream into alsa-ucm-conf.
+  # an alternative may be to build a custom alsa with the PinePhone config patch applied:
+  # - <https://github.com/alsa-project/alsa-ucm-conf/pull/134>
+  # that would make this be not device-specific
+  environment.variables.ALSA_CONFIG_UCM2 = "${./ucm2}";
+  systemd.services.pulseaudio.environment.ALSA_CONFIG_UCM2 = "${./ucm2}";
+
   users.groups.feedbackd.gid = config.sane.allocations.feedbackd-gid;
+
+  hardware.opengl.driSupport = true;
 }

machines/moby/firmware.nix

@@ -4,7 +4,7 @@
   # only actually need 1 MB, but better to over-allocate than under-allocate
   sane.image.extraGPTPadding = 16 * 1024 * 1024;
   sane.image.firstPartGap = 0;
-  system.build.img = pkgs.runCommandNoCC "nixos_full-disk-image.img" {} ''
+  system.build.img = pkgs.runCommand "nixos_full-disk-image.img" {} ''
     cp -v ${config.system.build.img-without-firmware}/nixos.img $out
     chmod +w $out
     dd if=${pkgs.tow-boot-pinephone}/Tow-Boot.noenv.bin of=$out bs=1024 seek=8 conv=notrunc

machines/moby/kernel.nix

@@ -114,7 +114,7 @@ in
   # - phone rotation sensor is off by 90 degrees
   # - ambient light sensor causes screen brightness to be shakey
   # - phosh greeter may not appear after wake from sleep
-  boot.kernelPackages = pkgs.linuxPackagesFor pkgs.cross.linux-megous;
+  boot.kernelPackages = pkgs.cross.linuxPackagesFor pkgs.cross.linux-megous;
 
   boot.kernelPatches = [
     (patchDefconfig (kernelConfig //

machines/moby/ucm2/PinePhone/HiFi.conf

@@ -0,0 +1,148 @@
+SectionVerb {
+	EnableSequence [
+		cset "name='Headphone Playback Switch' off"
+		cset "name='Headphone Source Playback Route' DAC"
+		cset "name='Line In Playback Switch' off"
+		cset "name='Line Out Playback Switch' off"
+		cset "name='Line Out Source Playback Route' Mono Differential"
+		cset "name='Mic1 Playback Switch' off"
+		cset "name='Mic2 Playback Switch' off"
+		cset "name='AIF1 DA0 Playback Volume' 160"
+		cset "name='AIF3 ADC Source Capture Route' None"
+		cset "name='AIF2 DAC Source Playback Route' AIF2"
+		cset "name='DAC Playback Switch' on"
+		cset "name='DAC Playback Volume' 160"
+		cset "name='ADC Digital DAC Playback Switch' off"
+		cset "name='AIF1 Slot 0 Digital DAC Playback Switch' on"
+		cset "name='AIF2 Digital DAC Playback Switch' off"
+		cset "name='DAC Reversed Playback Switch' off"
+		cset "name='Earpiece Playback Switch' off"
+		cset "name='Earpiece Source Playback Route' DACL"
+
+		cset "name='Line In Capture Switch' off"
+		cset "name='Mic1 Capture Switch' off"
+		cset "name='Mic1 Boost Volume' 7"
+		cset "name='Mic2 Capture Switch' off"
+		cset "name='Mic2 Boost Volume' 7"
+		cset "name='Mixer Capture Switch' off"
+		cset "name='Mixer Reversed Capture Switch' off"
+		cset "name='ADC Capture Volume' 160"
+		cset "name='ADC Gain Capture Volume' 7"
+		cset "name='AIF1 AD0 Capture Volume' 160"
+		cset "name='AIF1 Data Digital ADC Capture Switch' on"
+		cset "name='AIF2 ADC Mixer ADC Capture Switch' off"
+		cset "name='AIF2 ADC Mixer AIF1 DA0 Capture Switch' off"
+		cset "name='AIF2 ADC Mixer AIF2 DAC Rev Capture Switch' off"
+		cset "name='AIF2 ADC Mixer AIF1 DA0 Capture Switch' off"
+		cset "name='AIF2 ADC Mixer AIF1 DA0 Capture Switch' off"
+	]
+
+        DisableSequence [
+        ]
+
+	Value {
+	}
+}
+
+SectionDevice."Speaker" {
+	Comment "Internal speaker"
+	EnableSequence [
+		cset "name='AIF1 DA0 Stereo Playback Route' Mix Mono"
+		cset "name='Line Out Playback Switch' on"
+		cset "name='Line Out Playback Volume' 100%"
+	]
+
+	DisableSequence [
+		cset "name='Line Out Playback Switch' off"
+	]
+
+	Value {
+		PlaybackVolume "Line Out Playback Volume"
+		PlaybackSwitch "Line Out Playback Switch"
+		PlaybackChannels 2
+		PlaybackPriority 300
+		PlaybackPCM "hw:${CardId},0"
+	}
+}
+SectionDevice."Earpiece" {
+	Comment "Internal Earpiece"
+	EnableSequence [
+		cset "name='AIF1 DA0 Stereo Playback Route' Mix Mono"
+		cset "name='Earpiece Playback Switch' on"
+		cset "name='Earpiece Playback Volume' 100%"
+	]
+
+	DisableSequence [
+		cset "name='Earpiece Playback Switch' off"
+	]
+
+	Value {
+		PlaybackVolume "Earpiece Playback Volume"
+		PlaybackSwitch "Earpiece Playback Switch"
+		PlaybackChannels 2
+		PlaybackPriority 200
+		PlaybackPCM "hw:${CardId},0"
+	}
+}
+SectionDevice."Mic" {
+	Comment "Internal Microphone"
+	ConflictingDevice [
+		"Headset"
+	]
+	EnableSequence [
+		cset "name='Mic1 Capture Switch' on"
+	]
+	DisableSequence [
+		cset "name='Mic1 Capture Switch' off"
+	]
+	Value {
+		CapturePriority 100
+		CapturePCM "hw:${CardId},0"
+		CaptureChannels 2
+		CaptureMixerElem "ADC"
+		CaptureVolume "ADC Capture Volume"
+		CaptureSwitch "Mic1 Capture Switch"
+	}
+}
+SectionDevice."Headset" {
+	Comment "Headset Microphone"
+	ConflictingDevice [
+		"Mic"
+	]
+	EnableSequence [
+		cset "name='Mic2 Capture Switch' on"
+	]
+	DisableSequence [
+		cset "name='Mic2 Capture Switch' off"
+	]
+	Value {
+		CapturePriority 500
+		CapturePCM "hw:${CardId},0"
+		CaptureChannels 2
+		CaptureMixerElem "ADC"
+		CaptureVolume "ADC Capture Volume"
+		CaptureSwitch "Mic2 Capture Switch"
+		JackControl "Headset Microphone Jack"
+	}
+}
+SectionDevice."Headphones" {
+	Comment "Headphones"
+	EnableSequence [
+		cset "name='AIF1 DA0 Stereo Playback Route' Stereo"
+		cset "name='Headphone Playback Switch' on"
+		cset "name='Headphone Playback Volume' 70%"
+	]
+
+	DisableSequence [
+		cset "name='Headphone Playback Switch' off"
+	]
+
+	Value {
+		PlaybackVolume "Headphone Playback Volume"
+		PlaybackSwitch "Headphone Playback Switch"
+		PlaybackChannels 2
+		PlaybackPriority 500
+		PlaybackPCM "hw:${CardId},0"
+		JackControl "Headphone Jack"
+	}
+}

machines/moby/ucm2/PinePhone/PinePhone.conf

@@ -0,0 +1,11 @@
+Syntax 2
+
+SectionUseCase."HiFi" {
+	File "HiFi.conf"
+	Comment "Default"
+}
+
+SectionUseCase."Voice Call" {
+	File "VoiceCall.conf"
+	Comment "Phone call"
+}

machines/moby/ucm2/PinePhone/VoiceCall.conf

@@ -0,0 +1,153 @@
+SectionVerb {
+	EnableSequence [
+		cset "name='Headphone Playback Switch' off"
+		cset "name='Headphone Source Playback Route' DAC"
+		cset "name='Line In Playback Switch' off"
+		cset "name='Line Out Playback Switch' off"
+		cset "name='Line Out Source Playback Route' Mono Differential"
+		cset "name='Mic1 Playback Switch' off"
+		cset "name='Mic2 Playback Switch' off"
+		cset "name='AIF1 DA0 Playback Volume' 160"
+		cset "name='AIF2 DAC Playback Volume' 160"
+		cset "name='AIF3 ADC Source Capture Route' None"
+		cset "name='AIF2 DAC Source Playback Route' AIF2"
+		cset "name='DAC Playback Switch' on"
+		cset "name='DAC Playback Volume' 160"
+		cset "name='ADC Digital DAC Playback Switch' off"
+		cset "name='AIF1 Slot 0 Digital DAC Playback Switch' on"
+		cset "name='AIF2 Digital DAC Playback Switch' on"
+		cset "name='DAC Reversed Playback Switch' off"
+		cset "name='Earpiece Playback Switch' off"
+		cset "name='Earpiece Source Playback Route' DACL"
+
+		cset "name='Line In Capture Switch' off"
+		cset "name='Mic1 Capture Switch' off"
+		cset "name='Mic1 Boost Volume' 0"
+		cset "name='Mic1 Playback Volume' 7"
+		cset "name='Mic2 Capture Switch' off"
+		cset "name='Mic2 Boost Volume' 0"
+		cset "name='Mic2 Playback Volume' 7"
+		cset "name='Mixer Capture Switch' off"
+		cset "name='Mixer Reversed Capture Switch' off"
+		cset "name='ADC Capture Volume' 160"
+		cset "name='ADC Gain Capture Volume' 7"
+		cset "name='AIF1 AD0 Capture Volume' 160"
+		cset "name='AIF1 Data Digital ADC Capture Switch' on"
+		cset "name='AIF2 ADC Capture Volume' 160"
+		cset "name='AIF2 ADC Mixer ADC Capture Switch' on"
+		cset "name='AIF2 ADC Mixer AIF1 DA0 Capture Switch' off"
+		cset "name='AIF2 ADC Mixer AIF2 DAC Rev Capture Switch' off"
+		cset "name='AIF2 ADC Mixer AIF1 DA0 Capture Switch' off"
+		cset "name='AIF2 ADC Mixer AIF1 DA0 Capture Switch' off"
+	]
+
+        DisableSequence [
+        ]
+
+	Value {
+		PlaybackRate 8000
+	}
+}
+
+SectionDevice."Speaker" {
+	Comment "Internal speaker"
+	EnableSequence [
+		cset "name='AIF1 DA0 Stereo Playback Route' Mix Mono"
+		cset "name='Line Out Playback Switch' on"
+		cset "name='Line Out Playback Volume' 100%"
+	]
+
+	DisableSequence [
+		cset "name='Line Out Playback Switch' off"
+	]
+
+	Value {
+		PlaybackVolume "Line Out Playback Volume"
+		PlaybackSwitch "Line Out Playback Switch"
+		PlaybackChannels 2
+		PlaybackPriority 300
+		PlaybackPCM "hw:${CardId},0"
+	}
+}
+SectionDevice."Earpiece" {
+	Comment "Internal Earpiece"
+	EnableSequence [
+		cset "name='AIF1 DA0 Stereo Playback Route' Mix Mono"
+		cset "name='Earpiece Playback Switch' on"
+		cset "name='Earpiece Playback Volume' 100%"
+	]
+
+	DisableSequence [
+		cset "name='Earpiece Playback Switch' off"
+	]
+
+	Value {
+		PlaybackVolume "Earpiece Playback Volume"
+		PlaybackSwitch "Earpiece Playback Switch"
+		PlaybackChannels 2
+		PlaybackPriority 500
+		PlaybackPCM "hw:${CardId},0"
+	}
+}
+SectionDevice."Mic" {
+	Comment "Internal Microphone"
+	ConflictingDevice [
+		"Headset"
+	]
+	EnableSequence [
+		cset "name='Mic1 Capture Switch' on"
+	]
+	DisableSequence [
+		cset "name='Mic1 Capture Switch' off"
+	]
+	Value {
+		CapturePriority 200
+		CapturePCM "hw:${CardId},0"
+		CaptureMixerElem "ADC"
+		CaptureVolume "ADC Capture Volume"
+		CaptureSwitch "Mic1 Capture Switch"
+		CaptureChannels 2
+	}
+}
+SectionDevice."Headset" {
+	Comment "Headset Microphone"
+	ConflictingDevice [
+		"Mic"
+	]
+	EnableSequence [
+		cset "name='Mic2 Capture Switch' on"
+	]
+	DisableSequence [
+		cset "name='Mic2 Capture Switch' off"
+	]
+	Value {
+		CapturePriority 500
+		CapturePCM "hw:${CardId},0"
+		CaptureChannels 2
+		CaptureMixerElem "ADC"
+		CaptureVolume "ADC Capture Volume"
+		CaptureSwitch "Mic2 Capture Switch"
+		JackControl "Headset Microphone Jack"
+	}
+}
+SectionDevice."Headphones" {
+	Comment "Headphones"
+	EnableSequence [
+		cset "name='AIF1 DA0 Stereo Playback Route' Stereo"
+		cset "name='Headphone Playback Switch' on"
+		cset "name='Headphone Playback Volume' 100%"
+	]
+
+	DisableSequence [
+		cset "name='Headphone Playback Switch' off"
+	]
+
+	Value {
+		PlaybackVolume "Headphone Playback Volume"
+		PlaybackSwitch "Headphone Playback Switch"
+		PlaybackChannels 2
+		PlaybackPriority 500
+		PlaybackPCM "hw:${CardId},0"
+		JackControl "Headphone Jack"
+	}
+}

machines/moby/ucm2/ucm.conf

@@ -0,0 +1,8 @@
+Syntax 3
+
+UseCasePath {
+	legacy {
+		Directory "PinePhone"
+		File "PinePhone.conf"
+	}
+}

machines/servo/default.nix

@@ -6,18 +6,7 @@
     ./hardware.nix
     ./net.nix
     ./users.nix
-    ./services/ddns-he.nix
-    ./services/gitea.nix
-    ./services/ipfs.nix
-    ./services/jackett.nix
-    ./services/jellyfin.nix
-    ./services/matrix.nix
-    ./services/navidrome.nix
-    ./services/nginx.nix
-    ./services/pleroma.nix
-    ./services/postfix.nix
-    ./services/postgres.nix
-    ./services/transmission.nix
+    ./services
   ];
 
   sane.home-manager.enable = true;

machines/servo/services/default.nix

@@ -0,0 +1,17 @@
+{ ... }:
+{
+  imports = [
+    ./ddns-he.nix
+    ./gitea.nix
+    ./ipfs.nix
+    ./jackett.nix
+    ./jellyfin.nix
+    ./matrix
+    ./navidrome.nix
+    ./nginx.nix
+    ./pleroma.nix
+    ./postfix.nix
+    ./postgres.nix
+    ./transmission.nix
+  ];
+}

machines/servo/services/gitea.nix

@@ -13,7 +13,7 @@
   services.gitea.appName = "Perfectly Sane Git";
   services.gitea.domain = "git.uninsane.org";
   services.gitea.rootUrl = "https://git.uninsane.org/";
-  services.gitea.cookieSecure = true;
+  services.gitea.settings.session.COOKIE_SECURE = true;
   # services.gitea.disableRegistration = true;
 
   services.gitea.settings = {
@@ -60,7 +60,7 @@
     };
   };
   # options: "Trace", "Debug", "Info", "Warn", "Error", "Critical"
-  services.gitea.log.level = "Info";
+  services.gitea.settings.log.LEVEL = "Warn";
 
   systemd.services.gitea.serviceConfig = {
     # nix default is AF_UNIX AF_INET AF_INET6.

machines/servo/services/ipfs.nix

@@ -12,15 +12,15 @@
     # TODO: mode? could be more granular
     { user = "261"; group = "261"; directory = "/var/lib/ipfs"; }
   ];
-  services.ipfs.enable = true;
-  services.ipfs.localDiscovery = true;
-  services.ipfs.swarmAddress = [
+  # services.ipfs.enable = true;
+  services.kubo.localDiscovery = true;
+  services.kubo.swarmAddress = [
     # "/dns4/ipfs.uninsane.org/tcp/4001"
     # "/ip4/0.0.0.0/tcp/4001"
     "/dns4/ipfs.uninsane.org/udp/4001/quic"
     "/ip4/0.0.0.0/udp/4001/quic"
   ];
-  services.ipfs.extraConfig = {
+  services.kubo.extraConfig = {
     Addresses = {
       Announce = [
         # "/dns4/ipfs.uninsane.org/tcp/4001"

machines/servo/services/jellyfin.nix

@@ -5,7 +5,10 @@
     # TODO: mode? could be more granular
     { user = "jellyfin"; group = "jellyfin"; directory = "/var/lib/jellyfin"; }
   ];
-  users.users.jellyfin.uid = config.sane.allocations.jellyfin-uid;
-  users.groups.jellyfin.gid = config.sane.allocations.jellyfin-gid;
-  services.jellyfin.enable = true;
+
+  # users.users.jellyfin.uid = config.sane.allocations.jellyfin-uid;
+  # users.groups.jellyfin.gid = config.sane.allocations.jellyfin-gid;
+  # TODO: re-enable after migrating media dir to /var/lib/uninsane/media
+  # else it's too spammy
+  # services.jellyfin.enable = true;
 }

machines/servo/services/matrix/default.nix

@@ -0,0 +1,86 @@
+# docs: https://nixos.wiki/wiki/Matrix
+# docs: https://nixos.org/manual/nixos/stable/index.html#module-services-matrix-synapse
+{ config, lib, ... }:
+
+{
+  imports = [
+    # ./discord-appservice.nix
+    ./discord-puppet.nix
+    # ./irc.nix
+  ];
+
+  sane.impermanence.service-dirs = [
+    { user = "matrix-synapse"; group = "matrix-synapse"; directory = "/var/lib/matrix-synapse"; }
+  ];
+  services.matrix-synapse.enable = true;
+  services.matrix-synapse.settings.log_config = ./synapse-log_level.yaml;
+  services.matrix-synapse.settings.server_name = "uninsane.org";
+
+  # services.matrix-synapse.enable_registration_captcha = true;
+  # services.matrix-synapse.enable_registration_without_verification = true;
+  services.matrix-synapse.settings.enable_registration = true;
+  # services.matrix-synapse.registration_shared_secret = "<shared key goes here>";
+
+  # default for listeners is port = 8448, tls = true, x_forwarded = false.
+  # we change this because the server is situated behind nginx.
+  services.matrix-synapse.settings.listeners = [
+    {
+      port = 8008;
+      bind_addresses = [ "127.0.0.1" ];
+      type = "http";
+      tls = false;
+      x_forwarded = true;
+      resources = [
+        {
+          names = [ "client" "federation" ];
+          compress = false;
+        }
+      ];
+    }
+  ];
+
+  services.matrix-synapse.settings.admin_contact = "admin.matrix@uninsane.org";
+  services.matrix-synapse.settings.registrations_require_3pid = [ "email" ];
+
+  services.matrix-synapse.extraConfigFiles = [
+    config.sops.secrets.matrix_synapse_secrets.path
+  ];
+
+  # services.matrix-synapse.extraConfigFiles = [builtins.toFile "matrix-synapse-extra-config" ''
+  #   admin_contact: "admin.matrix@uninsane.org"
+  #   registrations_require_3pid:
+  #     - email
+  #   email:
+  #     smtp_host: "mx.uninsane.org"
+  #     smtp_port: 587
+  #     smtp_user: "matrix-synapse"
+  #     smtp_pass: "${secrets.matrix-synapse.smtp_pass}"
+  #     require_transport_security: true
+  #     enable_tls: true
+  #     notif_from: "%(app)s <notify.matrix@uninsane.org>"
+  #     app_name: "Uninsane Matrix"
+  #     enable_notifs: true
+  #     validation_token_lifetime: 96h
+  #     invite_client_location: "https://web.matrix.uninsane.org"
+  #     subjects:
+  #       email_validation: "[%(server_name)s] Validate your email"
+  # ''];
+
+  # new users may be registered on the CLI:
+  #   register_new_matrix_user -c /nix/store/8n6kcka37jhmi4qpd2r03aj71pkyh21s-homeserver.yaml http://localhost:8008
+  #
+  # or provide an registration token then can use to register through the client.
+  #   docs: https://github.com/matrix-org/synapse/blob/develop/docs/usage/administration/admin_api/registration_tokens.md
+  # first, grab your own user's access token (Help & About section in Element). then:
+  #   curl --header "Authorization: Bearer <my_token>" localhost:8008/_synapse/admin/v1/registration_tokens
+  # create a token with unlimited uses:
+  #   curl -d '{}' --header "Authorization: Bearer <my_token>" localhost:8008/_synapse/admin/v1/registration_tokens/new
+  # create a token with limited uses:
+  #   curl -d '{ "uses_allowed": 1 }' --header "Authorization: Bearer <my_token>" localhost:8008/_synapse/admin/v1/registration_tokens/new
+
+
+  sops.secrets.matrix_synapse_secrets = {
+    sopsFile = ../../../../secrets/servo.yaml;
+    owner = config.users.users.matrix-synapse.name;
+  };
+}

machines/servo/services/matrix/discord-appservice.nix

@@ -0,0 +1,69 @@
+{ config, lib, ... }:
+
+{
+  sane.impermanence.service-dirs = [
+    { user = "matrix-appservice-discord"; group = "matrix-appservice-discord"; directory = "/var/lib/matrix-appservice-discord"; }
+  ];
+
+  sops.secrets.matrix_appservice_discord_env = {
+    sopsFile = ../../../../secrets/servo/matrix_appservice_discord_env.bin;
+    owner = config.users.users.matrix-appservice-discord.name;
+    format = "binary";
+  };
+
+  services.matrix-synapse.settings.app_service_config_files = [
+    # auto-created by discord appservice
+    "/var/lib/matrix-appservice-discord/discord-registration.yaml"
+  ];
+
+  # Discord bridging
+  # docs: https://github.com/matrix-org/matrix-appservice-discord
+  services.matrix-appservice-discord.enable = true;
+  services.matrix-appservice-discord.settings = {
+    bridge = {
+      homeserverUrl = "http://127.0.0.1:8008";
+      domain = "uninsane.org";
+      adminMxid = "admin.matrix@uninsane.org";
+      # self-service bridging is when a Matrix user bridges by DMing @_discord_bot:<HS>
+      # i don't know what the alternative is :?
+      enableSelfServiceBridging = true;
+      presenceInterval = 30000; # milliseconds
+      # allows matrix users to search for Discord channels (somehow?)
+      disablePortalBridging = false;
+      # disableReadReceipts = true;
+      # these are Matrix -> Discord
+      disableJoinLeaveNotifications = true;
+      disableInviteNotifications = true;
+      disableRoomTopicNotifications = true;
+    };
+    # these are marked as required in the yaml schema
+    auth = {
+      # apparently not needed if you provide them as env vars (below).
+      # clientId = "FILLME";
+      # botToken = "FILLME";
+      usePrivilegedIntents = false;
+    };
+    logging = {
+      # silly, verbose, info, http, warn, error, silent
+      console = "verbose";
+    };
+  };
+  # contains what's ordinarily put into auth.clientId, auth.botToken
+  # i.e. `APPSERVICE_DISCORD_AUTH_CLIENT_I_D=...` and `APPSERVICE_DISCORD_AUTH_BOT_TOKEN=...`
+  services.matrix-appservice-discord.environmentFile = config.sops.secrets.matrix_appservice_discord_env.path;
+
+  systemd.services.matrix-appservice-discord.serviceConfig = {
+    # fix up to not use /var/lib/private, but just /var/lib
+    DynamicUser = lib.mkForce false;
+    User = "matrix-appservice-discord";
+    Group = "matrix-appservice-discord";
+  };
+  users.groups.matrix-appservice-discord = {};
+  users.users.matrix-appservice-discord = {
+    description = "User for the Matrix-Discord bridge";
+    group = "matrix-appservice-discord";
+    isSystemUser = true;
+  };
+  users.users.matrix-appservice-discord.uid = 2134;  # TODO: move to allocations
+  users.groups.matrix-appservice-discord.gid = 2134;  # TODO
+}

machines/servo/services/matrix/discord-puppet.nix

@@ -0,0 +1,52 @@
+{ lib, ... }:
+{
+  sane.impermanence.service-dirs = [
+    { user = "matrix-synapse"; group = "matrix-synapse"; directory = "/var/lib/mx-puppet-discord"; }
+  ];
+
+  services.matrix-synapse.settings.app_service_config_files = [
+    # auto-created by mx-puppet-discord service
+    "/var/lib/mx-puppet-discord/discord-registration.yaml"
+  ];
+
+  services.mx-puppet-discord.enable = true;
+  # schema/example: <https://gitlab.com/mx-puppet/discord/mx-puppet-discord/-/blob/main/sample.config.yaml>
+  services.mx-puppet-discord.settings = {
+    bridge = {
+      # port = 8434
+      bindAddress = "127.0.0.1";
+      domain = "uninsane.org";
+      homeserverUrl = "http://127.0.0.1:8008";
+      # displayName = "mx-discord-puppet";  # matrix name for the bot
+      # matrix "groups" were an earlier version of spaces.
+      # maybe the puppet understands this, maybe not?
+      enableGroupSync = false;
+    };
+    presence = {
+      enabled = false;
+      interval = 30000;
+    };
+    provisioning = {
+      # allow these users to control the puppet
+      whitelist = [ "@colin:uninsane\\.org" ];
+    };
+    relay = {
+      whitelist = [ "@colin:uninsane\\.org" ];
+    };
+    selfService = {
+      # who's allowed to use plumbed rooms (idk what that means)
+      whitelist = [ "@colin:uninsane\\.org" ];
+    };
+    logging = {
+      # silly, debug, verbose, info, warn, error
+      console = "debug";
+    };
+  };
+
+  systemd.services.mx-puppet-discord.serviceConfig = {
+    # fix up to not use /var/lib/private, but just /var/lib
+    DynamicUser = lib.mkForce false;
+    User = "matrix-synapse";
+    Group = "matrix-synapse";
+  };
+}

machines/servo/services/matrix/irc.nix

@@ -1,86 +1,19 @@
-# docs: https://nixos.wiki/wiki/Matrix
-# docs: https://nixos.org/manual/nixos/stable/index.html#module-services-matrix-synapse
-{ config, ... }:
+{ config, lib, ... }:
 
 {
   sane.impermanence.service-dirs = [
     # TODO: mode?
     # user and group are both "matrix-appservice-irc"
     { user = "993"; group = "992"; directory = "/var/lib/matrix-appservice-irc"; }
-    { user = "224"; group = "224"; directory = "/var/lib/matrix-synapse"; }
-  ];
-  services.matrix-synapse.enable = true;
-  services.matrix-synapse.settings.server_name = "uninsane.org";
-
-  # services.matrix-synapse.enable_registration_captcha = true;
-  # services.matrix-synapse.enable_registration_without_verification = true;
-  services.matrix-synapse.settings.enable_registration = true;
-  # services.matrix-synapse.registration_shared_secret = "<shared key goes here>";
-
-  # default for listeners is port = 8448, tls = true, x_forwarded = false.
-  # we change this because the server is situated behind nginx.
-  services.matrix-synapse.settings.listeners = [
-    {
-      port = 8008;
-      bind_addresses = [ "127.0.0.1" ];
-      type = "http";
-      tls = false;
-      x_forwarded = true;
-      resources = [
-        {
-          names = [ "client" "federation" ];
-          compress = false;
-        }
-      ];
-    }
   ];
 
-  services.matrix-synapse.settings.admin_contact = "admin.matrix@uninsane.org";
-  services.matrix-synapse.settings.registrations_require_3pid = [ "email" ];
-
-  services.matrix-synapse.extraConfigFiles = [
-    config.sops.secrets.matrix_synapse_secrets.path
-  ];
-
-  # services.matrix-synapse.extraConfigFiles = [builtins.toFile "matrix-synapse-extra-config" ''
-  #   admin_contact: "admin.matrix@uninsane.org"
-  #   registrations_require_3pid:
-  #     - email
-  #   email:
-  #     smtp_host: "mx.uninsane.org"
-  #     smtp_port: 587
-  #     smtp_user: "matrix-synapse"
-  #     smtp_pass: "${secrets.matrix-synapse.smtp_pass}"
-  #     require_transport_security: true
-  #     enable_tls: true
-  #     notif_from: "%(app)s <notify.matrix@uninsane.org>"
-  #     app_name: "Uninsane Matrix"
-  #     enable_notifs: true
-  #     validation_token_lifetime: 96h
-  #     invite_client_location: "https://web.matrix.uninsane.org"
-  #     subjects:
-  #       email_validation: "[%(server_name)s] Validate your email"
-  # ''];
   services.matrix-synapse.settings.app_service_config_files = [
     "/var/lib/matrix-appservice-irc/registration.yml"  # auto-created by irc appservice
   ];
 
-  # new users may be registered on the CLI:
-  #   register_new_matrix_user -c /nix/store/8n6kcka37jhmi4qpd2r03aj71pkyh21s-homeserver.yaml http://localhost:8008
-  #
-  # or provide an registration token then can use to register through the client.
-  #   docs: https://github.com/matrix-org/synapse/blob/develop/docs/usage/administration/admin_api/registration_tokens.md
-  # first, grab your own user's access token (Help & About section in Element). then:
-  #   curl --header "Authorization: Bearer <my_token>" localhost:8008/_synapse/admin/v1/registration_tokens
-  # create a token with unlimited uses:
-  #   curl -d '{}' --header "Authorization: Bearer <my_token>" localhost:8008/_synapse/admin/v1/registration_tokens/new
-  # create a token with limited uses:
-  #   curl -d '{ "uses_allowed": 1 }' --header "Authorization: Bearer <my_token>" localhost:8008/_synapse/admin/v1/registration_tokens/new
-
-  # IRC bridging
   # note: Rizon allows only FOUR simultaneous IRC connections per IP: https://wiki.rizon.net/index.php?title=Connection/Session_Limit_Exemptions
   # Rizon supports CertFP for auth: https://wiki.rizon.net/index.php?title=CertFP
-  # services.matrix-appservice-irc.enable = true;
+  services.matrix-appservice-irc.enable = true;
   services.matrix-appservice-irc.registrationUrl = "http://127.0.0.1:8009";
   # settings documented here: https://github.com/matrix-org/matrix-appservice-irc/blob/develop/config.sample.yaml
   services.matrix-appservice-irc.settings = {
@@ -161,9 +94,4 @@
       };
     };
   };
-
-  sops.secrets.matrix_synapse_secrets = {
-    sopsFile = ../../../secrets/servo.yaml;
-    owner = config.users.users.matrix-synapse.name;
-  };
 }

machines/servo/services/matrix/synapse-log_level.yaml

@@ -0,0 +1,27 @@
+version: 1
+
+# In systemd's journal, loglevel is implicitly stored, so let's omit it
+# from the message text.
+formatters:
+    journal_fmt:
+        format: '%(name)s: [%(request)s] %(message)s'
+
+filters:
+    context:
+        (): synapse.util.logcontext.LoggingContextFilter
+        request: ""
+
+handlers:
+    journal:
+        class: systemd.journal.JournalHandler
+        formatter: journal_fmt
+        filters: [context]
+        SYSLOG_IDENTIFIER: synapse
+
+# default log level: INFO
+root:
+    level: WARN
+    handlers: [journal]
+
+disable_existing_loggers: False
+

machines/servo/services/pleroma.nix

@@ -92,8 +92,8 @@
       backends: [{ExSyslogger, :ex_syslogger}]
 
     config :logger, :ex_syslogger,
-      level: :warn
-    #  level: :debug
+      level: :debug
+    #  level: :warn
 
     # XXX colin: not sure if this actually _does_ anything
     config :pleroma, :emoji,

machines/servo/services/transmission.nix

@@ -44,6 +44,7 @@
   systemd.services.transmission.serviceConfig = {
     # run this behind the OVPN static VPN
     NetworkNamespacePath = "/run/netns/ovpns";
+    LogLevelMax = "warning";
   };
 }
 

modules/gui/phosh.nix

@@ -60,6 +60,8 @@ in
     };
 
     sane.home-manager.extraPackages = with pkgs; [
+      phosh-mobile-settings
+
       # TODO: see about removing this if the in-built gnome-settings bluetooth manager can work
       gnome.gnome-bluetooth
     ];

modules/gui/sway.nix

@@ -33,6 +33,9 @@ in
       };
     };
 
+    # some programs (e.g. fractal) **require** a "Secret Service Provider"
+    services.gnome.gnome-keyring.enable = true;
+
     # unlike other DEs, sway configures no audio stack
     # administer with pw-cli, pw-mon, pw-top commands
     services.pipewire = {

modules/impermanence.nix

@@ -14,6 +14,10 @@ in
       default = false;
       type = types.bool;
     };
+    sane.impermanence.home-files = mkOption {
+      default = [];
+      type = types.listOf types.str;
+    };
     sane.impermanence.home-dirs = mkOption {
       default = [];
       type = types.listOf (types.either types.str (types.attrsOf types.str));
@@ -35,6 +39,15 @@ in
     map-home-dirs = map-dirs { user = "colin"; group = "users"; mode = "0755"; directory = "/home/colin/"; };
     map-sys-dirs = map-dirs { user = "root"; group = "root"; mode = "0755"; directory = ""; };
     map-service-dirs = map-dirs { user = "root"; group = "root"; mode = "0755"; directory = ""; };
+
+    map-home-files = files: builtins.map (f: {
+      parentDirectory = {
+        user = "colin";
+        group = "users";
+        mode = "0755";
+      };
+      file = "/home/colin/${f}";
+    }) files;
   in mkIf cfg.enable {
     sane.image.extraDirectories = [ "/nix/persist/var/log" ];
     environment.persistence."/nix/persist" = {
@@ -45,12 +58,13 @@ in
         ".cargo"
         ".rustup"
         ".ssh"
+        ".local/share/keyrings"
         # intentionally omitted:
         # ".config"  # managed by home-manager
         # ".local"   # nothing useful in here
       ] ++ cfg.home-dirs)) ++ (map-sys-dirs [
         # TODO: this `0700` here clobbers the perms for /persist/etc, breaking boot on freshly-deployed devices
-        { mode = "0700"; directory = "/etc/NetworkManager/system-connections"; }
+        # { mode = "0700"; directory = "/etc/NetworkManager/system-connections"; }
         # "/etc/nixos"
         # "/etc/ssh"  # persist only the specific files we want, instead
         "/var/log"
@@ -94,12 +108,19 @@ in
         # "/etc/group"
         # "/etc/passwd"
         # "/etc/shadow"
-      ];
+      ] ++ map-home-files cfg.home-files;
     };
 
     systemd.services.sane-sops = {
+      # TODO: it would be better if we could inject the right dependency into setupSecrets instead of patching like this.
+      # /run/current-system/activate contains the precise ordering logic.
+      # it's largely unaware of systemd.
+      # maybe we could insert some activation script which simply waits for /etc/ssh to appear?
       description = "sops relies on /etc/ssh being available, so re-run its activation AFTER fs-local";
-      script = config.system.activationScripts.setupSecrets.text;
+      script = ''
+      ${config.system.activationScripts.setupSecrets.text}
+      ${config.system.activationScripts.linkIwdKeys.text}
+      '';
       after = [ "fs-local.target" ];
       wantedBy = [ "multi-user.target" ];
     };

modules/universal/allocations.nix

@@ -31,6 +31,10 @@ in
     sane.allocations.sshd-gid = mkId 2001;  # 997
     sane.allocations.polkituser-gid = mkId 2002;  # 998
     sane.allocations.systemd-coredump-gid = mkId 2003;  # 996
+    sane.allocations.nscd-uid = mkId 2004;
+    sane.allocations.nscd-gid = mkId 2004;
+    sane.allocations.systemd-oom-uid = mkId 2005;
+    sane.allocations.systemd-oom-gid = mkId 2005;
 
     # found on graphical machines
     sane.allocations.nm-iodine-uid = mkId 2101;  # desko/moby/lappy

modules/universal/env/default.nix

@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ./feeds.nix
     ./home-manager.nix
     ./home-packages.nix
     ./system-packages.nix
@@ -12,10 +13,12 @@
     EDITOR = "vim";
     # git claims it should use EDITOR, but it doesn't!
     GIT_EDITOR = "vim";
+    # TODO: these should be moved to `home.sessionVariables` (home-manager)
     # Electron apps should use native wayland backend:
     #   https://nixos.wiki/wiki/Slack#Wayland
     # Discord under sway crashes with this.
     # NIXOS_OZONE_WL = "1";
+    # LIBGL_ALWAYS_SOFTWARE = "1";
   };
 }
 

modules/universal/env/feeds.nix

@@ -0,0 +1,41 @@
+{ lib, ... }:
+
+with lib;
+{
+  options = {
+    sane.feeds.podcastUrls = mkOption {
+      type = types.listOf types.str;
+      default = [
+        "https://lexfridman.com/feed/podcast/"
+        ## Astral Codex Ten
+        "http://feeds.libsyn.com/108018/rss"
+        ## Econ Talk
+        "https://feeds.simplecast.com/wgl4xEgL"
+        ## Cory Doctorow
+        "https://feeds.feedburner.com/doctorow_podcast"
+        "https://congressionaldish.libsyn.com/rss"
+        ## Civboot
+        "https://anchor.fm/s/34c7232c/podcast/rss"
+        "https://feeds.feedburner.com/80000HoursPodcast"
+        "https://allinchamathjason.libsyn.com/rss"
+        "https://acquired.libsyn.com/rss"
+        "https://rss.acast.com/deconstructed"
+        ## The Daily
+        "https://feeds.simplecast.com/54nAGcIl"
+        "https://rss.acast.com/intercepted-with-jeremy-scahill"
+        "https://podcast.posttv.com/itunes/post-reports.xml"
+        ## Eric Weinstein
+        "https://rss.art19.com/the-portal"
+        "https://feeds.megaphone.fm/darknetdiaries"
+        "http://feeds.wnyc.org/radiolab"
+        "https://wakingup.libsyn.com/rss"
+        ## 99% Invisible
+        "https://feeds.simplecast.com/BqbsxVfO"
+        "https://rss.acast.com/ft-tech-tonic"
+        "https://feeds.feedburner.com/dancarlin/history?format=xml"
+        ## 60 minutes (NB: this features more than *just* audio?)
+        "https://www.cbsnews.com/latest/rss/60-minutes"
+      ];
+    };
+  };
+}

modules/universal/env/home-manager.nix

@@ -14,6 +14,9 @@ let
   pkglist = pkgspec: builtins.map (e: e.pkg or e) pkgspec;
   # extract `dir` from `extraPackages`
   dirlist = pkgspec: builtins.concatLists (builtins.map (e: if e ? "dir" then [ e.dir ] else []) pkgspec);
+  # extract `persist-files` from `extraPackages`
+  persistfileslist = pkgspec: builtins.concatLists (builtins.map (e: if e ? "persist-files" then e.persist-files else []) pkgspec);
+  # TODO: dirlist and persistfileslist should be folded
 in
 {
   options = {
@@ -67,6 +70,7 @@ in
       "Videos"
       vim-swap-dir
     ] ++ (dirlist cfg.extraPackages);
+    sane.impermanence.home-files = persistfileslist cfg.extraPackages;
 
     home-manager.useGlobalPkgs = true;
     home-manager.useUserPackages = true;
@@ -75,6 +79,10 @@ in
     # see: https://github.com/nix-community/home-manager/issues/589#issuecomment-950474105
     home-manager.users.colin = let sysconfig = config; in { config, ... }: {
 
+      # run `home-manager-help` to access manpages
+      # or `man home-configuration.nix`
+      manual.html.enable = true;
+
       home.packages = pkglist cfg.extraPackages;
       wayland.windowManager = cfg.windowManager;
 
@@ -82,6 +90,14 @@ in
       home.username = "colin";
       home.homeDirectory = "/home/colin";
 
+      home.activation = {
+        initKeyring = {
+          after = ["writeBoundary"];
+          before = [];
+          data = "${../../../scripts/init-keyring}";
+        };
+      };
+
       # XDG defines things like ~/Desktop, ~/Downloads, etc.
       # these clutter the home, so i mostly don't use them.
       xdg.userDirs = {
@@ -96,19 +112,40 @@ in
         templates = "$HOME/.xdg/Templates";
         videos = "$HOME/Videos";
       };
+
+      # the xdg mime type for a file can be found with:
+      # - `xdg-mime query filetype path/to/thing.ext`
       xdg.mimeApps.enable = true;
       xdg.mimeApps.defaultApplications = {
+        # HTML
         "text/html" = [ "librewolf.desktop" ];
         "x-scheme-handler/http" = [ "librewolf.desktop" ];
         "x-scheme-handler/https" = [ "librewolf.desktop" ];
         "x-scheme-handler/about" = [ "librewolf.desktop" ];
         "x-scheme-handler/unknown" = [ "librewolf.desktop" ];
+        # RICH-TEXT DOCUMENTS
+        "application/pdf" = [ "org.gnome.Evince.desktop" ];
+        "text/markdown" = [ "obsidian.desktop" ];
+        # IMAGES
+        "image/heif" = [ "org.gnome.gThumb.desktop" ];  # apple codec
         "image/png" = [ "org.gnome.gThumb.desktop" ];
+        "image/jpeg" = [ "org.gnome.gThumb.desktop" ];
+        # VIDEO
+        "video/mp4" = [ "vlc.desktop" ];
+        "video/quicktime" = [ "vlc.desktop" ];
+        "video/x-matroska" = [ "vlc.desktop" ];
+        # AUDIO
+        "audio/flag" = [ "vlc.desktop" ];
+        "audio/mpeg" = [ "vlc.desktop" ];
+        "audio/x-vorbis+ogg" = [ "vlc.desktop" ];
       };
 
       # convenience
       home.file."knowledge".source = config.lib.file.mkOutOfStoreSymlink "/home/colin/dev/knowledge";
       home.file."nixos".source = config.lib.file.mkOutOfStoreSymlink "/home/colin/dev/nixos";
+      home.file."Videos/servo".source = config.lib.file.mkOutOfStoreSymlink "/mnt/servo-media/Videos";
+      home.file."Videos/servo-incomplete".source = config.lib.file.mkOutOfStoreSymlink "/mnt/servo-media/incomplete";
+      home.file."Music/servo".source = config.lib.file.mkOutOfStoreSymlink "/mnt/servo-media/Music";
 
       # nb markdown/personal knowledge manager
       home.file.".nb/knowledge".source = config.lib.file.mkOutOfStoreSymlink "/home/colin/dev/knowledge";
@@ -136,48 +173,52 @@ in
          }
         }
       '';
+      home.file.".librewolf/librewolf.overrides.cfg".text = ''
+        // if we can't query the revocation status of a SSL cert because the issuer is offline,
+        // treat it as unrevoked.
+        // see: <https://librewolf.net/docs/faq/#im-getting-sec_error_ocsp_server_error-what-can-i-do>
+        defaultPref("security.OCSP.require", false);
+      '';
 
       # aerc TUI mail client
       xdg.configFile."aerc/accounts.conf".source =
         config.lib.file.mkOutOfStoreSymlink sysconfig.sops.secrets.aerc_accounts.path;
 
+      # make Discord usable even when client is "outdated"
+      xdg.configFile."discord/settings.json".text = ''
+      {
+        "SKIP_HOST_UPDATE": true
+      }
+      '';
+
       # sublime music player
       xdg.configFile."sublime-music/config.json".source =
         config.lib.file.mkOutOfStoreSymlink sysconfig.sops.secrets.sublime_music_config.path;
 
       xdg.configFile."vlc/vlcrc".text =
       let
-        podcast_urls = lib.strings.concatStringsSep "|" [
-          "https://lexfridman.com/feed/podcast/"
-          ## Astral Codex Ten
-          "http://feeds.libsyn.com/108018/rss"
-          ## Econ Talk
-          "https://feeds.simplecast.com/wgl4xEgL"
-          ## Cory Doctorow
-          "https://feeds.feedburner.com/doctorow_podcast"
-          "https://congressionaldish.libsyn.com/rss"
-          ## Civboot
-          "https://anchor.fm/s/34c7232c/podcast/rss"
-          "https://feeds.feedburner.com/80000HoursPodcast"
-          "https://allinchamathjason.libsyn.com/rss"
-          ## Eric Weinstein
-          "https://rss.art19.com/the-portal"
-          "https://feeds.megaphone.fm/darknetdiaries"
-          "http://feeds.wnyc.org/radiolab"
-          "https://wakingup.libsyn.com/rss"
-          ## 99% Invisible
-          "https://feeds.simplecast.com/BqbsxVfO"
-          "https://rss.acast.com/ft-tech-tonic"
-          "https://feeds.feedburner.com/dancarlin/history?format=xml"
-        ];
+        podcastUrls = lib.strings.concatStringsSep "|" sysconfig.sane.feeds.podcastUrls;
       in ''
       [podcast]
-      podcast-urls=${podcast_urls}
+      podcast-urls=${podcastUrls}
       [core]
       metadata-network-access=0
       [qt]
       qt-privacy-ask=0
       '';
+      xdg.configFile."gpodderFeeds.opml".text =
+      let
+        entries = builtins.toString (builtins.map
+          (url: ''\n    <outline xmlUrl="${url}" type="rss"/>'')
+          sysconfig.sane.feeds.podcastUrls
+        );
+      in ''
+        <?xml version="1.0" encoding="utf-8"?>
+        <opml version="2.0">
+          <body>${entries}
+          </body>
+        </opml>
+      '';
 
       # gnome feeds RSS viewer
       xdg.configFile."org.gabmus.gfeeds.json".text = builtins.toJSON {
@@ -221,12 +262,14 @@ in
           "https://www.lynalden.com/feed" = { tags = [ "infrequent" "pol" ]; };
           "https://austinvernon.site/rss.xml" = { tags = [ "infrequent" "tech" ]; };
           "https://oversharing.substack.com/feed" = { tags = [ "daily" "pol" ]; };
+          "https://doomberg.substack.com/feed" = { tags = [ "weekly" "tech" ]; };
           ## David Rosenthal
           "https://blog.dshr.org/rss.xml" = { tags = [ "weekly" "pol" ]; };
           ## Matt Levine
           "https://www.bloomberg.com/opinion/authors/ARbTQlRLRjE/matthew-s-levine.rss" = { tags = [ "weekly" "pol" ]; };
 
           # RATIONALITY/PHILOSOPHY/ETC
+          "https://samkriss.substack.com/feed" = { tags = [ "infrequent" "uncat" ]; };  # ... satire? phil?
           "https://unintendedconsequenc.es/feed" = { tags = [ "infrequent" "rat" ]; };
 
           "https://applieddivinitystudies.com/atom.xml" = { tags = [ "weekly" "rat" ]; };
@@ -249,9 +292,13 @@ in
           # COMICS
           "https://www.smbc-comics.com/comic/rss" = { tags = [ "daily" "visual" ]; };
           "https://xkcd.com/atom.xml" = { tags = [ "daily" "visual" ]; };
+          "http://dilbert.com/feed" = { tags = ["daily" "visual" ]; };
 
           # ART
           "https://miniature-calendar.com/feed" = { tags = [ "daily" "visual" ]; };
+
+          # CODE
+          "https://github.com/Kaiteki-Fedi/Kaiteki/commits/master.atom" = { tags = [ "infrequent" "tech" ]; };
         };
         dark_reader = false;
         new_first = true;
@@ -300,6 +347,11 @@ in
             # run p10k configure to configure, but it can't write out its file :-(
             POWERLEVEL9K_DISABLE_CONFIGURATION_WIZARD=true
           '';
+          initExtra = ''
+            # zmv is a way to do rich moves/renames, with pattern matching/substitution.
+            # see for an example: <https://filipe.kiss.ink/zmv-zsh-rename/>
+            autoload -Uz zmv
+          '';
 
           # prezto = oh-my-zsh fork; controls prompt, auto-completion, etc.
           # see: https://github.com/sorin-ionescu/prezto
@@ -471,6 +523,10 @@ in
             })
           ];
           extraConfig = ''
+            " let the terminal handle mouse events, that way i get OS-level ctrl+shift+c/etc
+            " this used to be default, until <https://github.com/neovim/neovim/pull/19290>
+            set mouse=
+
             " copy/paste to system clipboard
             set clipboard=unnamedplus
 

modules/universal/env/home-packages.nix

@@ -11,6 +11,7 @@ let
     ifuse
     ipfs
     libimobiledevice
+    libsecret  # for managing user keyrings
     lm_sensors  # for sensors-detect
     lshw
     ffmpeg
@@ -24,14 +25,17 @@ let
     # ponymix
     pulsemixer
     python3
+    # python3Packages.eyeD3  # music tagging
     rmlint
     sane-scripts
     sequoia
     snapper
     sops
     speedtest-cli
+    sqlite  # to debug sqlite3 databases
     ssh-to-age
     sudo
+    # tageditor  # music tagging
     unar
     visidata
     w3m
@@ -53,9 +57,17 @@ let
 
     emote  # TODO: package [smile](https://github.com/mijorus/smile) for probably a better mobile experience.
     evince  # works on phosh
-    fluffychat
+
+    # { pkg = fluffychat-moby; dir = ".local/share/chat.fluffy.fluffychat"; }  # TODO: ship normal fluffychat on non-moby?
+
     foliate
     font-manager
+
+    # XXX by default fractal stores its state in ~/.local/share/<UUID>.
+    # after logging in, manually change ~/.local/share/keyrings/... to point it to some predictable subdir.
+    # then reboot (so that libsecret daemon re-loads the keyring...?)
+    { pkg = fractal-next; dir = ".local/share/fractal"; }
+
     gimp  # broken on phosh
     gnome.cheese
     gnome.dconf-editor
@@ -67,8 +79,18 @@ let
     gnome-podcasts
     gnome.gnome-system-monitor
     gnome.gnome-terminal  # works on phosh
+    gnome.gnome-weather
+
+    { pkg = gpodder-configured; dir = "gPodder/Downloads"; }
+
     gthumb
     inkscape
+
+    kaiteki  # Pleroma client
+    gnome.zenity # for kaiteki (it will use qarma, kdialog, or zenity)
+
+    kid3  # audio tagging
+    krita
     libreoffice-fresh  # XXX colin: maybe don't want this on mobile
     lollypop
     mesa-demos
@@ -78,6 +100,7 @@ let
     { pkg = obsidian; dir = ".config/obsidian"; }
 
     pavucontrol
+    picard  # music tagging
     playerctl
     soundconverter
     # sublime music persists any downloaded albums here.
@@ -86,8 +109,12 @@ let
     #   possible to pass config as a CLI arg (sublime-music -c config.json)
     { pkg = sublime-music; dir = ".local/share/sublime-music"; }
     tdesktop  # broken on phosh
-    vlc  # works on phosh
+
+    # vlc remembers play position in ~/.config/vlc/vlc-qt-interface.conf
+    { pkg = vlc; persist-files = [ ".config/vlc/vlc-qt-interface.conf" ]; }
+
     whalebird # pleroma client. input is broken on phosh
+    xdg-utils  # for xdg-open
     xterm  # broken on phosh
   ]
   ++ (if pkgs.system == "x86_64-linux" then
@@ -101,9 +128,6 @@ let
       nss = pkgs.nss_latest;
     }); in { pkg = discord; dir = ".config/discord"; })
 
-    # kaiteki  # Pleroma client
-    # gnome.zenity # for kaiteki (it will use qarma, kdialog, or zenity)
-
     logseq
     losslesscut-bin
     makemkv

modules/universal/fs.nix

@@ -28,31 +28,37 @@ in
     device = "colin@uninsane.org:/var/lib/uninsane/media";
     inherit (sshOpts) fsType;
     options = sshOpts.optionsColin;
+    noCheck = true;
   };
   fileSystems."/mnt/servo-media-lan" = {
     device = "colin@servo:/var/lib/uninsane/media";
     inherit (sshOpts) fsType;
     options = sshOpts.optionsColin;
+    noCheck = true;
   };
   fileSystems."/mnt/servo-root-wan" = {
     device = "colin@uninsane.org:/";
     inherit (sshOpts) fsType;
     options = sshOpts.optionsRoot;
+    noCheck = true;
   };
   fileSystems."/mnt/servo-root-lan" = {
     device = "colin@servo:/";
     inherit (sshOpts) fsType;
     options = sshOpts.optionsRoot;
+    noCheck = true;
   };
   fileSystems."/mnt/desko-home" = {
     device = "colin@desko:/home/colin";
     inherit (sshOpts) fsType;
     options = sshOpts.optionsColin;
+    noCheck = true;
   };
   fileSystems."/mnt/desko-root" = {
     device = "colin@desko:/";
     inherit (sshOpts) fsType;
     options = sshOpts.optionsRoot;
+    noCheck = true;
   };
 
   environment.systemPackages = [

modules/universal/net.nix

@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, lib, pkgs, ... }:
 
 {
   # if using router's DNS, these mappings will already exist.
@@ -8,5 +8,62 @@
     "192.168.0.5" = [ "servo" ];
     "192.168.0.20" = [ "lappy" ];
     "192.168.0.22" = [ "desko" ];
+    "192.168.0.48" = [ "moby" ];
+  };
+
+  # the default backend is "wpa_supplicant".
+  # wpa_supplicant reliably picks weak APs to connect to.
+  # see: <https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/474>
+  # iwd is an alternative that shouldn't have this problem
+  # docs:
+  # - <https://nixos.wiki/wiki/Iwd>
+  # - <https://iwd.wiki.kernel.org/networkmanager>
+  # use `iwctl` to control
+  networking.wireless.iwd.enable = true;
+  networking.networkmanager.wifi.backend = "iwd";
+
+  system.activationScripts.linkIwdKeys = let
+    unwrapped = ../../scripts/install-iwd;
+    install-iwd = pkgs.writeShellApplication {
+      name = "install-iwd";
+      runtimeInputs = with pkgs; [ coreutils gnused ];
+      text = ''${unwrapped} "$@"'';
+    };
+  in (lib.stringAfter
+    [ "setupSecrets" ]
+    ''
+    mkdir -p /var/lib/iwd
+    ${install-iwd}/bin/install-iwd /run/secrets/iwd /var/lib/iwd
+    ''
+  );
+
+  # TODO: use a glob, or a list, or something?
+  sops.secrets."iwd/community-university.psk" = {
+    sopsFile = ../../secrets/universal/net/community-university.psk.bin;
+    format = "binary";
+  };
+  sops.secrets."iwd/friend-libertarian-dod.psk" = {
+    sopsFile = ../../secrets/universal/net/friend-libertarian-dod.psk.bin;
+    format = "binary";
+  };
+  sops.secrets."iwd/friend-rationalist-empathist.psk" = {
+    sopsFile = ../../secrets/universal/net/friend-rationalist-empathist.psk.bin;
+    format = "binary";
+  };
+  sops.secrets."iwd/home-bedroom.psk" = {
+    sopsFile = ../../secrets/universal/net/home-bedroom.psk.bin;
+    format = "binary";
+  };
+  sops.secrets."iwd/home-shared-24G.psk" = {
+    sopsFile = ../../secrets/universal/net/home-shared-24G.psk.bin;
+    format = "binary";
+  };
+  sops.secrets."iwd/home-shared.psk" = {
+    sopsFile = ../../secrets/universal/net/home-shared.psk.bin;
+    format = "binary";
+  };
+  sops.secrets."iwd/iphone" = {
+    sopsFile = ../../secrets/universal/net/iphone.psk.bin;
+    format = "binary";
   };
 }

modules/universal/secrets.nix

@@ -29,7 +29,7 @@
   #   $ cat /run/secrets/example_key
 
   # sops.age.sshKeyPaths = [ "/home/colin/.ssh/id_ed25519_dec" ];
-  # This will add secrets.yml to the nix store
+  # This will add secrets.yaml to the nix store
   # You can avoid this by adding a string to the full path instead, i.e.
   # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
   sops.defaultSopsFile = ./../../secrets/universal.yaml;

modules/universal/users.nix

@@ -98,6 +98,10 @@ in
     users.groups.polkituser.gid = config.sane.allocations.polkituser-gid;
     users.groups.sshd.gid = config.sane.allocations.sshd-gid;
     users.groups.systemd-coredump.gid = config.sane.allocations.systemd-coredump-gid;
+    users.users.nscd.uid = config.sane.allocations.nscd-uid;
+    users.groups.nscd.gid = config.sane.allocations.nscd-gid;
+    users.users.systemd-oom.uid = config.sane.allocations.systemd-oom-uid;
+    users.groups.systemd-oom.gid = config.sane.allocations.systemd-oom-gid;
 
     # guarantee determinism in uid/gid generation for users:
     assertions = let

nixpatches/10-flutter-arm64.patch

@@ -10,15 +10,15 @@ index 565c44f72e9..f20a3d4e9be 100644
  }:
  
 +let vendorHashes = {
-+  x86_64-linux = "sha256-j5opwEFifa+DMG7Uziv4SWEPVokD6OSq8mSIr0AdDL0=";
-+  aarch64-linux = "sha256-gPz/j7oHO2f3DVNNy7DpY/8XTjWt2Kcf3XjFmH81HDs=";
++  x86_64-linux = "sha256-p5EJP2zSvWyRV1uyTHw0EpFsEwAGtX5B9WVjpLmnVew=";
++  aarch64-linux = "sha256-Ps0HmDI6BFxHrLRq3KWNk4hw0qneq5hqB/Mp99f+hO4=";
 +};
 +in
  flutter.mkFlutterApp rec {
    pname = "fluffychat";
-   version = "1.2.0";
+   version = "1.6.1";
  
--  vendorHash = "sha256-j5opwEFifa+DMG7Uziv4SWEPVokD6OSq8mSIr0AdDL0=";
+-  vendorHash = "sha256-SelMRETFYZgTStV90gRoKhazu1NPbcSMO9mYebSQskQ=";
 +  vendorHash = vendorHashes."${stdenv.hostPlatform.system}" or (throw "unsupported system: ${stdenv.hostPlatform.system}");
  
    src = fetchFromGitLab {
@@ -33,7 +33,7 @@ index 9eba6773448..e9d352169b2 100644
        };
 +      "${dartVersion}-aarch64-linux" = fetchurl {
 +        url = "${dartSourceBase}/stable/release/${dartVersion}/sdk/dartsdk-linux-arm64-release.zip";
-+        sha256 = "sha256-3p0cUoNn+Du9GSvVZa9bfZ1I9295uqTA5M9kcj4/uL4=";
++        sha256 = "sha256-BIK6kUx+m+/GfR/wBXv8rjVNbP6w1HFvH/RGIwiaJog=";
 +      };
      };
    };

nixpatches/11-flutter-3.3.3-189338.patch

@@ -0,0 +1,646 @@
+diff --git a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
+index d50e7118cc1..22bbeb212f0 100644
+--- a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
++++ b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
+@@ -1,16 +1,16 @@
+ { lib
+ , fetchFromGitLab
+-, flutter
++, flutter2
+ , olm
+ , imagemagick
+ , makeDesktopItem
+ }:
+ 
+-flutter.mkFlutterApp rec {
++flutter2.mkFlutterApp rec {
+   pname = "fluffychat";
+   version = "1.2.0";
+ 
+-  vendorHash = "sha256-co+bnsVIyg42JpM9FimfGEjrd6A99GlBeow1Dgv7NBI=";
++  vendorHash = "sha256-1PDX023WXRmRe/b1L+6Du91BvGwYNp3YATqYSQdPrRY=";
+ 
+   src = fetchFromGitLab {
+     owner = "famedly";
+diff --git a/pkgs/development/compilers/flutter/default.nix b/pkgs/development/compilers/flutter/default.nix
+index 4529d2adc1a..02188335129 100644
+--- a/pkgs/development/compilers/flutter/default.nix
++++ b/pkgs/development/compilers/flutter/default.nix
+@@ -4,34 +4,40 @@ let
+   getPatches = dir:
+     let files = builtins.attrNames (builtins.readDir dir);
+     in map (f: dir + ("/" + f)) files;
+-  version = "3.0.4";
+-  channel = "stable";
+-  filename = "flutter_linux_${version}-${channel}.tar.xz";
+-
+-  # Decouples flutter derivation from dart derivation,
+-  # use specific dart version to not need to bump dart derivation when bumping flutter.
+-  dartVersion = "2.17.5";
+-  dartSourceBase = "https://storage.googleapis.com/dart-archive/channels";
+-  dartForFlutter = dart.override {
+-    version = dartVersion;
+-    sources = {
+-      "${dartVersion}-x86_64-linux" = fetchurl {
+-        url = "${dartSourceBase}/stable/release/${dartVersion}/sdk/dartsdk-linux-x64-release.zip";
+-        sha256 = "sha256-AFJGeiPsjUZSO+DykmOIFETg2jIohg62tp3ghZrKJFk=";
++  flutterDrv = { version, pname, dartVersion, hash, dartHash, patches }: mkFlutter {
++    inherit version pname patches;
++    dart = dart.override {
++      version = dartVersion;
++      sources = {
++        "${dartVersion}-x86_64-linux" = fetchurl {
++          url = "https://storage.googleapis.com/dart-archive/channels/stable/release/${dartVersion}/sdk/dartsdk-linux-x64-release.zip";
++          sha256 = dartHash;
++        };
+       };
+     };
++    src = fetchurl {
++      url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${version}-stable.tar.xz";
++      sha256 = hash;
++    };
+   };
+ in
+ {
+   inherit mkFlutter;
+-  stable = mkFlutter rec {
+-    inherit version;
+-    dart = dartForFlutter;
++  stable = flutterDrv {
+     pname = "flutter";
+-    src = fetchurl {
+-      url = "https://storage.googleapis.com/flutter_infra_release/releases/${channel}/linux/${filename}";
+-      sha256 = "sha256-vh3QjLGFBN321DUET9XhYqSkILjEj+ZqAALu/mxY+go=";
+-    };
+-    patches = getPatches ./patches;
++    version = "3.3.3";
++    dartVersion = "2.18.2";
++    hash = "sha256-MTZeWQUp4/TcPzYIT6eqIKSPUPvn2Mp/thOQzNgpTXg=";
++    dartHash = "sha256-C3+YjecXLvSmJrLwi9H7TgD9Np0AArRWx3EdBrfQpTU";
++    patches = getPatches ./patches/flutter3;
++  };
++
++  v2 = flutterDrv {
++    pname = "flutter";
++    version = "2.10.5";
++    dartVersion = "2.16.2";
++    hash = "sha256-DTZwxlMUYk8NS1SaWUJolXjD+JnRW73Ps5CdRHDGnt0=";
++    dartHash = "sha256-egrYd7B4XhkBiHPIFE2zopxKtQ58GqlogAKA/UeiXnI=";
++    patches = getPatches ./patches/flutter2;
+   };
+ }
+diff --git a/pkgs/development/compilers/flutter/flutter.nix b/pkgs/development/compilers/flutter/flutter.nix
+index 28a78c3e306..f2c861356ab 100644
+--- a/pkgs/development/compilers/flutter/flutter.nix
++++ b/pkgs/development/compilers/flutter/flutter.nix
+@@ -65,7 +65,7 @@ let
+       popd
+ 
+       local revision="$(cd "$FLUTTER_ROOT"; git rev-parse HEAD)"
+-      ${dart}/bin/dart --snapshot="$SNAPSHOT_PATH" --packages="$FLUTTER_TOOLS_DIR/.packages" "$SCRIPT_PATH"
++      ${dart}/bin/dart --snapshot="$SNAPSHOT_PATH" --packages="$FLUTTER_TOOLS_DIR/.dart_tool/package_config.json" "$SCRIPT_PATH"
+       echo "$revision" > "$STAMP_PATH"
+       echo -n "${version}" > version
+ 
+diff --git a/pkgs/development/compilers/flutter/patches/disable-auto-update.patch b/pkgs/development/compilers/flutter/patches/flutter2/disable-auto-update.patch
+similarity index 100%
+rename from pkgs/development/compilers/flutter/patches/disable-auto-update.patch
+rename to pkgs/development/compilers/flutter/patches/flutter2/disable-auto-update.patch
+diff --git a/pkgs/development/compilers/flutter/patches/flutter2/git-dir.patch b/pkgs/development/compilers/flutter/patches/flutter2/git-dir.patch
+new file mode 100644
+index 00000000000..0136ef93106
+--- /dev/null
++++ b/pkgs/development/compilers/flutter/patches/flutter2/git-dir.patch
+@@ -0,0 +1,80 @@
++diff --git a/dev/bots/prepare_package.dart b/dev/bots/prepare_package.dart
++index 468a91a954..5def6897ce 100644
++--- a/dev/bots/prepare_package.dart
+++++ b/dev/bots/prepare_package.dart
++@@ -525,7 +525,7 @@ class ArchiveCreator {
++ 
++   Future<String> _runGit(List<String> args, {Directory? workingDirectory}) {
++     return _processRunner.runProcess(
++-      <String>['git', ...args],
+++      <String>['git', '--git-dir', '.git', ...args],
++       workingDirectory: workingDirectory ?? flutterRoot,
++     );
++   }
++diff --git a/packages/flutter_tools/lib/src/version.dart b/packages/flutter_tools/lib/src/version.dart
++index f2068a6ca2..99b161689e 100644
++--- a/packages/flutter_tools/lib/src/version.dart
+++++ b/packages/flutter_tools/lib/src/version.dart
++@@ -106,7 +106,7 @@ class FlutterVersion {
++     String? channel = _channel;
++     if (channel == null) {
++       final String gitChannel = _runGit(
++-        'git rev-parse --abbrev-ref --symbolic @{u}',
+++        'git --git-dir .git rev-parse --abbrev-ref --symbolic @{u}',
++         globals.processUtils,
++         _workingDirectory,
++       );
++@@ -114,7 +114,7 @@ class FlutterVersion {
++       if (slash != -1) {
++         final String remote = gitChannel.substring(0, slash);
++         _repositoryUrl = _runGit(
++-          'git ls-remote --get-url $remote',
+++          'git --git-dir .git ls-remote --get-url $remote',
++           globals.processUtils,
++           _workingDirectory,
++         );
++@@ -326,7 +326,7 @@ class FlutterVersion {
++   /// the branch name will be returned as `'[user-branch]'`.
++   String getBranchName({ bool redactUnknownBranches = false }) {
++     _branch ??= () {
++-      final String branch = _runGit('git rev-parse --abbrev-ref HEAD', globals.processUtils);
+++      final String branch = _runGit('git --git-dir .git rev-parse --abbrev-ref HEAD', globals.processUtils);
++       return branch == 'HEAD' ? channel : branch;
++     }();
++     if (redactUnknownBranches || _branch!.isEmpty) {
++@@ -359,7 +359,7 @@ class FlutterVersion {
++   /// wrapper that does that.
++   @visibleForTesting
++   static List<String> gitLog(List<String> args) {
++-    return <String>['git', '-c', 'log.showSignature=false', 'log'] + args;
+++    return <String>['git', '-c', 'log.showSignature=false', '--git-dir', '.git', 'log'] + args;
++   }
++ 
++   /// Gets the release date of the latest available Flutter version.
++@@ -730,7 +730,7 @@ class GitTagVersion {
++ 
++   static GitTagVersion determine(ProcessUtils processUtils, {String? workingDirectory, bool fetchTags = false, String gitRef = 'HEAD'}) {
++     if (fetchTags) {
++-      final String channel = _runGit('git rev-parse --abbrev-ref HEAD', processUtils, workingDirectory);
+++      final String channel = _runGit('git --git-dir .git rev-parse --abbrev-ref HEAD', processUtils, workingDirectory);
++       if (channel == 'dev' || channel == 'beta' || channel == 'stable') {
++         globals.printTrace('Skipping request to fetchTags - on well known channel $channel.');
++       } else {
++@@ -739,7 +739,7 @@ class GitTagVersion {
++     }
++     // find all tags attached to the given [gitRef]
++     final List<String> tags = _runGit(
++-      'git tag --points-at $gitRef', processUtils, workingDirectory).trim().split('\n');
+++      'git --git-dir .git tag --points-at $gitRef', processUtils, workingDirectory).trim().split('\n');
++ 
++     // Check first for a stable tag
++     final RegExp stableTagPattern = RegExp(r'^\d+\.\d+\.\d+$');
++@@ -760,7 +760,7 @@ class GitTagVersion {
++     // recent tag and number of commits past.
++     return parse(
++       _runGit(
++-        'git describe --match *.*.* --long --tags $gitRef',
+++        'git --git-dir .git describe --match *.*.* --long --tags $gitRef',
++         processUtils,
++         workingDirectory,
++       )
+diff --git a/pkgs/development/compilers/flutter/patches/flutter2/move-cache.patch b/pkgs/development/compilers/flutter/patches/flutter2/move-cache.patch
+new file mode 100644
+index 00000000000..a81d2def242
+--- /dev/null
++++ b/pkgs/development/compilers/flutter/patches/flutter2/move-cache.patch
+@@ -0,0 +1,72 @@
++diff --git a/packages/flutter_tools/lib/src/asset.dart b/packages/flutter_tools/lib/src/asset.dart
++index ed42baea29..12941f733a 100644
++--- a/packages/flutter_tools/lib/src/asset.dart
+++++ b/packages/flutter_tools/lib/src/asset.dart
++@@ -11,11 +11,11 @@ import 'base/file_system.dart';
++ import 'base/logger.dart';
++ import 'base/platform.dart';
++ import 'build_info.dart';
++-import 'cache.dart';
++ import 'convert.dart';
++ import 'dart/package_map.dart';
++ import 'devfs.dart';
++ import 'flutter_manifest.dart';
+++import 'globals.dart' as globals;
++ import 'license_collector.dart';
++ import 'project.dart';
++ 
++@@ -504,7 +504,7 @@ class ManifestAssetBundle implements AssetBundle {
++         }
++         final Uri entryUri = _fileSystem.path.toUri(asset);
++         result.add(_Asset(
++-          baseDir: _fileSystem.path.join(Cache.flutterRoot!, 'bin', 'cache', 'artifacts', 'material_fonts'),
+++          baseDir: _fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter', 'artifacts', 'material_fonts'),
++           relativeUri: Uri(path: entryUri.pathSegments.last),
++           entryUri: entryUri,
++           package: null,
++diff --git a/packages/flutter_tools/lib/src/cache.dart b/packages/flutter_tools/lib/src/cache.dart
++index defc86cc20..7fdf14d112 100644
++--- a/packages/flutter_tools/lib/src/cache.dart
+++++ b/packages/flutter_tools/lib/src/cache.dart
++@@ -22,6 +22,7 @@ import 'base/user_messages.dart';
++ import 'build_info.dart';
++ import 'convert.dart';
++ import 'features.dart';
+++import 'globals.dart' as globals;
++ 
++ const String kFlutterRootEnvironmentVariableName = 'FLUTTER_ROOT'; // should point to //flutter/ (root of flutter/flutter repo)
++ const String kFlutterEngineEnvironmentVariableName = 'FLUTTER_ENGINE'; // should point to //engine/src/ (root of flutter/engine repo)
++@@ -322,8 +323,13 @@ class Cache {
++       return;
++     }
++     assert(_lock == null);
+++    final Directory dir = _fileSystem.directory(_fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter'));
+++    if (!dir.existsSync()) {
+++      dir.createSync(recursive: true);
+++      globals.os.chmod(dir, '755');
+++    }
++     final File lockFile =
++-      _fileSystem.file(_fileSystem.path.join(flutterRoot!, 'bin', 'cache', 'lockfile'));
+++      _fileSystem.file(_fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter', 'lockfile'));
++     try {
++       _lock = lockFile.openSync(mode: FileMode.write);
++     } on FileSystemException catch (e) {
++@@ -382,8 +388,7 @@ class Cache {
++ 
++   String get devToolsVersion {
++     if (_devToolsVersion == null) {
++-      const String devToolsDirPath = 'dart-sdk/bin/resources/devtools';
++-      final Directory devToolsDir = getCacheDir(devToolsDirPath, shouldCreate: false);
+++      final Directory devToolsDir = _fileSystem.directory(_fileSystem.path.join(flutterRoot!, 'bin/cache/dart-sdk/bin/resources/devtools'));
++       if (!devToolsDir.existsSync()) {
++         throw Exception('Could not find directory at ${devToolsDir.path}');
++       }
++@@ -536,7 +541,7 @@ class Cache {
++     if (_rootOverride != null) {
++       return _fileSystem.directory(_fileSystem.path.join(_rootOverride!.path, 'bin', 'cache'));
++     } else {
++-      return _fileSystem.directory(_fileSystem.path.join(flutterRoot!, 'bin', 'cache'));
+++      return _fileSystem.directory(_fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter'));
++     }
++   }
++ 
+diff --git a/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch b/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch
+new file mode 100644
+index 00000000000..21b676a2af3
+--- /dev/null
++++ b/pkgs/development/compilers/flutter/patches/flutter3/disable-auto-update.patch
+@@ -0,0 +1,36 @@
++diff --git a/bin/internal/shared.sh b/bin/internal/shared.sh
++index ab746724e9..1087983c87 100644
++--- a/bin/internal/shared.sh
+++++ b/bin/internal/shared.sh
++@@ -215,8 +215,6 @@ function shared::execute() {
++     exit 1
++   fi
++ 
++-  upgrade_flutter 7< "$PROG_NAME"
++-
++   BIN_NAME="$(basename "$PROG_NAME")"
++   case "$BIN_NAME" in
++     flutter*)
++diff --git a/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart b/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
++index 738fef987d..03a152e64f 100644
++--- a/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
+++++ b/packages/flutter_tools/lib/src/runner/flutter_command_runner.dart
++@@ -241,7 +241,6 @@ class FlutterCommandRunner extends CommandRunner<void> {
++           globals.flutterUsage.suppressAnalytics = true;
++         }
++ 
++-        globals.flutterVersion.ensureVersionFile();
++         final bool machineFlag = topLevelResults['machine'] as bool? ?? false;
++         final bool ci = await globals.botDetector.isRunningOnBot;
++         final bool redirectedCompletion = !globals.stdio.hasTerminal &&
++@@ -250,10 +249,6 @@ class FlutterCommandRunner extends CommandRunner<void> {
++         final bool versionCheckFlag = topLevelResults['version-check'] as bool? ?? false;
++         final bool explicitVersionCheckPassed = topLevelResults.wasParsed('version-check') && versionCheckFlag;
++ 
++-        if (topLevelResults.command?.name != 'upgrade' &&
++-            (explicitVersionCheckPassed || (versionCheckFlag && !isMachine))) {
++-          await globals.flutterVersion.checkFlutterVersionFreshness();
++-        }
++ 
++         // See if the user specified a specific device.
++         globals.deviceManager?.specifiedDeviceId = topLevelResults['device-id'] as String?;
+diff --git a/pkgs/development/compilers/flutter/patches/git-dir.patch b/pkgs/development/compilers/flutter/patches/flutter3/git-dir.patch
+similarity index 86%
+rename from pkgs/development/compilers/flutter/patches/git-dir.patch
+rename to pkgs/development/compilers/flutter/patches/flutter3/git-dir.patch
+index 0c736f945ea..42ad756f8ea 100644
+--- a/pkgs/development/compilers/flutter/patches/git-dir.patch
++++ b/pkgs/development/compilers/flutter/patches/flutter3/git-dir.patch
+@@ -1,8 +1,8 @@
+ diff --git a/dev/bots/prepare_package.dart b/dev/bots/prepare_package.dart
+-index 468a91a954..5def6897ce 100644
++index 8e4cb81340..2c20940423 100644
+ --- a/dev/bots/prepare_package.dart
+ +++ b/dev/bots/prepare_package.dart
+-@@ -525,7 +525,7 @@ class ArchiveCreator {
++@@ -526,7 +526,7 @@ class ArchiveCreator {
+  
+    Future<String> _runGit(List<String> args, {Directory? workingDirectory}) {
+      return _processRunner.runProcess(
+@@ -12,7 +12,7 @@ index 468a91a954..5def6897ce 100644
+      );
+    }
+ diff --git a/packages/flutter_tools/lib/src/commands/downgrade.dart b/packages/flutter_tools/lib/src/commands/downgrade.dart
+-index bb0eb428a9..4a2a48bb5e 100644
++index 666c190067..b6c3761f6f 100644
+ --- a/packages/flutter_tools/lib/src/commands/downgrade.dart
+ +++ b/packages/flutter_tools/lib/src/commands/downgrade.dart
+ @@ -118,7 +118,7 @@ class DowngradeCommand extends FlutterCommand {
+@@ -34,19 +34,19 @@ index bb0eb428a9..4a2a48bb5e 100644
+        if (parseResult.exitCode == 0) {
+          buffer.writeln('Channel "${getNameForChannel(channel)}" was previously on: ${parseResult.stdout}.');
+ diff --git a/packages/flutter_tools/lib/src/version.dart b/packages/flutter_tools/lib/src/version.dart
+-index f2068a6ca2..99b161689e 100644
++index dc47f17057..8068e2d1f5 100644
+ --- a/packages/flutter_tools/lib/src/version.dart
+ +++ b/packages/flutter_tools/lib/src/version.dart
+-@@ -106,7 +106,7 @@ class FlutterVersion {
++@@ -111,7 +111,7 @@ class FlutterVersion {
+      String? channel = _channel;
+      if (channel == null) {
+        final String gitChannel = _runGit(
+--        'git rev-parse --abbrev-ref --symbolic @{u}',
+-+        'git --git-dir .git rev-parse --abbrev-ref --symbolic @{u}',
++-        'git rev-parse --abbrev-ref --symbolic $kGitTrackingUpstream',
+++        'git --git-dir .git rev-parse --abbrev-ref --symbolic $kGitTrackingUpstream',
+          globals.processUtils,
+          _workingDirectory,
+        );
+-@@ -114,7 +114,7 @@ class FlutterVersion {
++@@ -119,7 +119,7 @@ class FlutterVersion {
+        if (slash != -1) {
+          final String remote = gitChannel.substring(0, slash);
+          _repositoryUrl = _runGit(
+@@ -55,7 +55,7 @@ index f2068a6ca2..99b161689e 100644
+            globals.processUtils,
+            _workingDirectory,
+          );
+-@@ -326,7 +326,7 @@ class FlutterVersion {
++@@ -298,7 +298,7 @@ class FlutterVersion {
+    /// the branch name will be returned as `'[user-branch]'`.
+    String getBranchName({ bool redactUnknownBranches = false }) {
+      _branch ??= () {
+@@ -64,7 +64,7 @@ index f2068a6ca2..99b161689e 100644
+        return branch == 'HEAD' ? channel : branch;
+      }();
+      if (redactUnknownBranches || _branch!.isEmpty) {
+-@@ -359,7 +359,7 @@ class FlutterVersion {
++@@ -331,7 +331,7 @@ class FlutterVersion {
+    /// wrapper that does that.
+    @visibleForTesting
+    static List<String> gitLog(List<String> args) {
+@@ -73,16 +73,16 @@ index f2068a6ca2..99b161689e 100644
+    }
+  
+    /// Gets the release date of the latest available Flutter version.
+-@@ -730,7 +730,7 @@ class GitTagVersion {
+- 
+-   static GitTagVersion determine(ProcessUtils processUtils, {String? workingDirectory, bool fetchTags = false, String gitRef = 'HEAD'}) {
++@@ -708,7 +708,7 @@ class GitTagVersion {
++     String gitRef = 'HEAD'
++   }) {
+      if (fetchTags) {
+ -      final String channel = _runGit('git rev-parse --abbrev-ref HEAD', processUtils, workingDirectory);
+ +      final String channel = _runGit('git --git-dir .git rev-parse --abbrev-ref HEAD', processUtils, workingDirectory);
+        if (channel == 'dev' || channel == 'beta' || channel == 'stable') {
+          globals.printTrace('Skipping request to fetchTags - on well known channel $channel.');
+        } else {
+-@@ -739,7 +739,7 @@ class GitTagVersion {
++@@ -718,7 +718,7 @@ class GitTagVersion {
+      }
+      // find all tags attached to the given [gitRef]
+      final List<String> tags = _runGit(
+@@ -91,7 +91,7 @@ index f2068a6ca2..99b161689e 100644
+  
+      // Check first for a stable tag
+      final RegExp stableTagPattern = RegExp(r'^\d+\.\d+\.\d+$');
+-@@ -760,7 +760,7 @@ class GitTagVersion {
++@@ -739,7 +739,7 @@ class GitTagVersion {
+      // recent tag and number of commits past.
+      return parse(
+        _runGit(
+diff --git a/pkgs/development/compilers/flutter/patches/move-cache.patch b/pkgs/development/compilers/flutter/patches/flutter3/move-cache.patch
+similarity index 83%
+rename from pkgs/development/compilers/flutter/patches/move-cache.patch
+rename to pkgs/development/compilers/flutter/patches/flutter3/move-cache.patch
+index 5cb7c71e9bd..008c5959e5b 100644
+--- a/pkgs/development/compilers/flutter/patches/move-cache.patch
++++ b/pkgs/development/compilers/flutter/patches/flutter3/move-cache.patch
+@@ -1,13 +1,9 @@
++diff --git a/packages/flutter_tools/lib/src/artifacts.dart b/packages/flutter_tools/lib/src/artifacts.dart
+ diff --git a/packages/flutter_tools/lib/src/asset.dart b/packages/flutter_tools/lib/src/asset.dart
+-index ed42baea29..12941f733a 100644
++index 9dd7272fbe..642c8e48e4 100644
+ --- a/packages/flutter_tools/lib/src/asset.dart
+ +++ b/packages/flutter_tools/lib/src/asset.dart
+-@@ -11,11 +11,11 @@ import 'base/file_system.dart';
+- import 'base/logger.dart';
+- import 'base/platform.dart';
+- import 'build_info.dart';
+--import 'cache.dart';
+- import 'convert.dart';
++@@ -16,6 +16,7 @@ import 'convert.dart';
+  import 'dart/package_map.dart';
+  import 'devfs.dart';
+  import 'flutter_manifest.dart';
+@@ -15,17 +11,18 @@ index ed42baea29..12941f733a 100644
+  import 'license_collector.dart';
+  import 'project.dart';
+  
+-@@ -504,7 +504,7 @@ class ManifestAssetBundle implements AssetBundle {
+-         }
++@@ -530,8 +531,7 @@ class ManifestAssetBundle implements AssetBundle {
+          final Uri entryUri = _fileSystem.path.toUri(asset);
+          result.add(_Asset(
+--          baseDir: _fileSystem.path.join(Cache.flutterRoot!, 'bin', 'cache', 'artifacts', 'material_fonts'),
+-+          baseDir: _fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter', 'artifacts', 'material_fonts'),
++           baseDir: _fileSystem.path.join(
++-            Cache.flutterRoot!,
++-            'bin', 'cache', 'artifacts', 'material_fonts',
+++            globals.fsUtils.homeDirPath!, '.cache', 'flutter', 'artifacts', 'material_fonts',
++           ),
+            relativeUri: Uri(path: entryUri.pathSegments.last),
+            entryUri: entryUri,
+-           package: null,
+ diff --git a/packages/flutter_tools/lib/src/cache.dart b/packages/flutter_tools/lib/src/cache.dart
+-index defc86cc20..7fdf14d112 100644
++index dd80b1e46e..8e54517765 100644
+ --- a/packages/flutter_tools/lib/src/cache.dart
+ +++ b/packages/flutter_tools/lib/src/cache.dart
+ @@ -22,6 +22,7 @@ import 'base/user_messages.dart';
+@@ -36,7 +33,7 @@ index defc86cc20..7fdf14d112 100644
+  
+  const String kFlutterRootEnvironmentVariableName = 'FLUTTER_ROOT'; // should point to //flutter/ (root of flutter/flutter repo)
+  const String kFlutterEngineEnvironmentVariableName = 'FLUTTER_ENGINE'; // should point to //engine/src/ (root of flutter/engine repo)
+-@@ -322,8 +323,13 @@ class Cache {
++@@ -318,8 +319,13 @@ class Cache {
+        return;
+      }
+      assert(_lock == null);
+@@ -51,7 +48,7 @@ index defc86cc20..7fdf14d112 100644
+      try {
+        _lock = lockFile.openSync(mode: FileMode.write);
+      } on FileSystemException catch (e) {
+-@@ -382,8 +388,7 @@ class Cache {
++@@ -378,8 +384,7 @@ class Cache {
+  
+    String get devToolsVersion {
+      if (_devToolsVersion == null) {
+@@ -61,7 +58,7 @@ index defc86cc20..7fdf14d112 100644
+        if (!devToolsDir.existsSync()) {
+          throw Exception('Could not find directory at ${devToolsDir.path}');
+        }
+-@@ -536,7 +541,7 @@ class Cache {
++@@ -532,7 +537,7 @@ class Cache {
+      if (_rootOverride != null) {
+        return _fileSystem.directory(_fileSystem.path.join(_rootOverride!.path, 'bin', 'cache'));
+      } else {
+@@ -70,8 +67,7 @@ index defc86cc20..7fdf14d112 100644
+      }
+    }
+  
+-diff --git a/packages/flutter_tools/lib/src/artifacts.dart b/packages/flutter_tools/lib/src/artifacts.dart
+-index 2aac9686e8..32c4b98b88 100644
++index c539d67156..4e0a64f7a9 100644
+ --- a/packages/flutter_tools/lib/src/artifacts.dart
+ +++ b/packages/flutter_tools/lib/src/artifacts.dart
+ @@ -346,10 +346,10 @@ class CachedArtifacts implements Artifacts {
+@@ -82,8 +78,8 @@ index 2aac9686e8..32c4b98b88 100644
+ +        final String path = _dartSdkPath(_fileSystem);
+          return _fileSystem.directory(path);
+        case HostArtifact.engineDartBinary:
+--        final String path = _fileSystem.path.join(_dartSdkPath(_cache), 'bin', _hostArtifactToFileName(artifact, _platform.isWindows));
+-+        final String path = _fileSystem.path.join(_dartSdkPath(_fileSystem), 'bin', _hostArtifactToFileName(artifact, _platform.isWindows));
++-        final String path = _fileSystem.path.join(_dartSdkPath(_cache), 'bin', _hostArtifactToFileName(artifact, _platform));
+++        final String path = _fileSystem.path.join(_dartSdkPath(_fileSystem), 'bin', _hostArtifactToFileName(artifact, _platform));
+          return _fileSystem.file(path);
+        case HostArtifact.flutterWebSdk:
+          final String path = _getFlutterWebSdkPath();
+@@ -91,12 +87,12 @@ index 2aac9686e8..32c4b98b88 100644
+        case HostArtifact.dart2jsSnapshot:
+        case HostArtifact.dartdevcSnapshot:
+        case HostArtifact.kernelWorkerSnapshot:
+--        final String path = _fileSystem.path.join(_dartSdkPath(_cache), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform.isWindows));
+-+        final String path = _fileSystem.path.join(_dartSdkPath(_fileSystem), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform.isWindows));
++-        final String path = _fileSystem.path.join(_dartSdkPath(_cache), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
+++        final String path = _fileSystem.path.join(_dartSdkPath(_fileSystem), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
+          return _fileSystem.file(path);
+        case HostArtifact.iosDeploy:
+-         final String artifactFileName = _hostArtifactToFileName(artifact, _platform.isWindows);
+-@@ -461,11 +461,13 @@ class CachedArtifacts implements Artifacts {
++         final String artifactFileName = _hostArtifactToFileName(artifact, _platform);
++@@ -465,11 +465,13 @@ class CachedArtifacts implements Artifacts {
+    String _getAndroidArtifactPath(Artifact artifact, TargetPlatform platform, BuildMode mode) {
+      final String engineDir = _getEngineArtifactsPath(platform, mode)!;
+      switch (artifact) {
+@@ -125,8 +121,8 @@ index 2aac9686e8..32c4b98b88 100644
+ -      case Artifact.frontendServerSnapshotForEngineDartSdk:
+        case Artifact.constFinder:
+        case Artifact.flutterMacOSFramework:
+-       case Artifact.flutterMacOSPodspec:
+-@@ -594,14 +596,10 @@ class CachedArtifacts implements Artifacts {
++       case Artifact.flutterPatchedSdkPath:
++@@ -586,14 +588,10 @@ class CachedArtifacts implements Artifacts {
+          // For script snapshots any gen_snapshot binary will do. Returning gen_snapshot for
+          // android_arm in profile mode because it is available on all supported host platforms.
+          return _getAndroidArtifactPath(artifact, TargetPlatform.android_arm, BuildMode.profile);
+@@ -142,27 +138,27 @@ index 2aac9686e8..32c4b98b88 100644
+        case Artifact.icuData:
+          final String engineArtifactsPath = _cache.getArtifactDirectory('engine').path;
+          final String platformDirName = _enginePlatformDirectoryName(platform);
+-@@ -797,7 +795,7 @@ class CachedLocalEngineArtifacts implements LocalEngineArtifacts {
+-         final String path = _fileSystem.path.join(_hostEngineOutPath, 'dart-sdk', 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform.isWindows));
++@@ -776,7 +774,7 @@ class CachedLocalEngineArtifacts implements LocalEngineArtifacts {
++         final String path = _fileSystem.path.join(_hostEngineOutPath, 'dart-sdk', 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
+          return _fileSystem.file(path);
+        case HostArtifact.dartdevcSnapshot:
+--        final String path = _fileSystem.path.join(_dartSdkPath(_cache), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform.isWindows));
+-+        final String path = _fileSystem.path.join(_dartSdkPath(_fileSystem), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform.isWindows));
++-        final String path = _fileSystem.path.join(_dartSdkPath(_cache), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
+++        final String path = _fileSystem.path.join(_dartSdkPath(_fileSystem), 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
+          return _fileSystem.file(path);
+        case HostArtifact.kernelWorkerSnapshot:
+-         final String path = _fileSystem.path.join(_hostEngineOutPath, 'dart-sdk', 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform.isWindows));
+-@@ -922,9 +920,7 @@ class CachedLocalEngineArtifacts implements LocalEngineArtifacts {
+-       case Artifact.windowsUwpCppClientWrapper:
++         final String path = _fileSystem.path.join(_hostEngineOutPath, 'dart-sdk', 'bin', 'snapshots', _hostArtifactToFileName(artifact, _platform));
++@@ -901,9 +899,7 @@ class CachedLocalEngineArtifacts implements LocalEngineArtifacts {
++       case Artifact.windowsCppClientWrapper:
+          return _fileSystem.path.join(_hostEngineOutPath, artifactFileName);
+        case Artifact.frontendServerSnapshotForEngineDartSdk:
+ -        return _fileSystem.path.join(
+ -          _hostEngineOutPath, 'dart-sdk', 'bin', 'snapshots', artifactFileName,
+ -        );
+ +        return _fileSystem.path.join(_hostEngineOutPath, 'gen', artifactFileName);
+-       case Artifact.uwptool:
+-         return _fileSystem.path.join(_hostEngineOutPath, artifactFileName);
+      }
+-@@ -1034,8 +1030,8 @@ class OverrideArtifacts implements Artifacts {
++   }
++ 
++@@ -1011,8 +1007,8 @@ class OverrideArtifacts implements Artifacts {
+  }
+  
+  /// Locate the Dart SDK.
+@@ -174,12 +170,12 @@ index 2aac9686e8..32c4b98b88 100644
+  
+  class _TestArtifacts implements Artifacts {
+ diff --git a/packages/flutter_tools/test/general.shard/artifacts_test.dart b/packages/flutter_tools/test/general.shard/artifacts_test.dart
+-index d906511a15..adfdd4bb42 100644
++index aed3eb9285..81b8362648 100644
+ --- a/packages/flutter_tools/test/general.shard/artifacts_test.dart
+ +++ b/packages/flutter_tools/test/general.shard/artifacts_test.dart
+-@@ -153,10 +153,6 @@ void main() {
+-         artifacts.getArtifactPath(Artifact.windowsUwpDesktopPath, platform: TargetPlatform.windows_uwp_x64, mode: BuildMode.release),
+-         fileSystem.path.join('root', 'bin', 'cache', 'artifacts', 'engine', 'windows-uwp-x64-release'),
++@@ -141,10 +141,6 @@ void main() {
++         artifacts.getArtifactPath(Artifact.flutterTester, platform: TargetPlatform.linux_arm64),
++         fileSystem.path.join('root', 'bin', 'cache', 'artifacts', 'engine', 'linux-arm64', 'flutter_tester'),
+        );
+ -      expect(
+ -        artifacts.getArtifactPath(Artifact.frontendServerSnapshotForEngineDartSdk),
+@@ -188,7 +184,7 @@ index d906511a15..adfdd4bb42 100644
+      });
+  
+      testWithoutContext('precompiled web artifact paths are correct', () {
+-@@ -322,11 +318,6 @@ void main() {
++@@ -310,11 +306,6 @@ void main() {
+          artifacts.getHostArtifact(HostArtifact.engineDartSdkPath).path,
+          fileSystem.path.join('/out', 'host_debug_unopt', 'dart-sdk'),
+        );
+@@ -197,6 +193,6 @@ index d906511a15..adfdd4bb42 100644
+ -        fileSystem.path.join('/out', 'host_debug_unopt', 'dart-sdk', 'bin',
+ -          'snapshots', 'frontend_server.dart.snapshot')
+ -      );
+-     });
+- 
+-     testWithoutContext('getEngineType', () {
++       expect(
++         artifacts.getHostArtifact(HostArtifact.impellerc).path,
++         fileSystem.path.join('/out', 'host_debug_unopt', 'impellerc'),
+diff --git a/pkgs/os-specific/linux/firmware/firmware-updater/default.nix b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
+index fb9d3a9a36c..cc906b763e8 100644
+--- a/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
++++ b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
+@@ -1,13 +1,13 @@
+ { lib
+-, flutter
++, flutter2
+ , fetchFromGitHub
+ }:
+ 
+-flutter.mkFlutterApp {
++flutter2.mkFlutterApp {
+   pname = "firmware-updater";
+   version = "unstable";
+ 
+-  vendorHash = "sha256-3wVA9BLCnMijC0gOmskz+Hv7NQIGu/jhBDbWjmoq1Tc=";
++  vendorHash = "sha256-7uOiebGBcX61oUyNCi1h9KldTRTrCfYaHUQSH4J5OoQ=";
+ 
+   src = fetchFromGitHub {
+     owner = "canonical";
+diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
+index 4f25d9b20d8..c282471c464 100644
+--- a/pkgs/top-level/all-packages.nix
++++ b/pkgs/top-level/all-packages.nix
+@@ -13448,6 +13448,7 @@ with pkgs;
+   flutterPackages =
+     recurseIntoAttrs (callPackage ../development/compilers/flutter { });
+   flutter = flutterPackages.stable;
++  flutter2 = flutterPackages.v2;
+ 
+   fnm = callPackage ../development/tools/fnm {
+     inherit (darwin.apple_sdk.frameworks) DiskArbitration Foundation Security;

nixpatches/12-flutter-arm64-2.patch

@@ -0,0 +1,66 @@
+diff --git a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
+index 22bbeb212f0..c07bd8e9fd4 100644
+--- a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
++++ b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
+@@ -4,13 +4,19 @@
+ , olm
+ , imagemagick
+ , makeDesktopItem
++, stdenv
+ }:
+ 
++let vendorHashes = {
++  x86_64-linux = "sha256-Gi0mfxaMtPI/TxrxnvzQvH9M8CtLADKJfYO2JnzAz+Y=";
++  aarch64-linux = "sha256-iq8bMSJoYbDNtR82QunrpQdPUv0nceUKXRqAwDvxCpE=";
++};
++in
+ flutter2.mkFlutterApp rec {
+   pname = "fluffychat";
+   version = "1.2.0";
+ 
+-  vendorHash = "sha256-1PDX023WXRmRe/b1L+6Du91BvGwYNp3YATqYSQdPrRY=";
++  vendorHash = vendorHashes."${stdenv.hostPlatform.system}" or (throw "unsupported system: ${stdenv.hostPlatform.system}");
+ 
+   src = fetchFromGitLab {
+     owner = "famedly";
+diff --git a/pkgs/development/compilers/flutter/default.nix b/pkgs/development/compilers/flutter/default.nix
+index 02188335129..c264565e50a 100644
+--- a/pkgs/development/compilers/flutter/default.nix
++++ b/pkgs/development/compilers/flutter/default.nix
+@@ -11,7 +11,11 @@ let
+       sources = {
+         "${dartVersion}-x86_64-linux" = fetchurl {
+           url = "https://storage.googleapis.com/dart-archive/channels/stable/release/${dartVersion}/sdk/dartsdk-linux-x64-release.zip";
+-          sha256 = dartHash;
++          sha256 = dartHash.x86_64-linux;
++        };
++        "${dartVersion}-aarch64-linux" = fetchurl {
++          url = "https://storage.googleapis.com/dart-archive/channels/stable/release/${dartVersion}/sdk/dartsdk-linux-arm64-release.zip";
++          sha256 = dartHash.aarch64-linux;
+         };
+       };
+     };
+@@ -28,7 +32,10 @@ in
+     version = "3.3.3";
+     dartVersion = "2.18.2";
+     hash = "sha256-MTZeWQUp4/TcPzYIT6eqIKSPUPvn2Mp/thOQzNgpTXg=";
+-    dartHash = "sha256-C3+YjecXLvSmJrLwi9H7TgD9Np0AArRWx3EdBrfQpTU";
++    dartHash = {
++      x86_64-linux = "sha256-C3+YjecXLvSmJrLwi9H7TgD9Np0AArRWx3EdBrfQpTU";
++      aarch64-linux = "sha256-zyIK1i5/9P2C+sjzdArhFwpVO4P+It+/X50l+n9gekI=";
++    };
+     patches = getPatches ./patches/flutter3;
+   };
+ 
+@@ -37,7 +44,10 @@ in
+     version = "2.10.5";
+     dartVersion = "2.16.2";
+     hash = "sha256-DTZwxlMUYk8NS1SaWUJolXjD+JnRW73Ps5CdRHDGnt0=";
+-    dartHash = "sha256-egrYd7B4XhkBiHPIFE2zopxKtQ58GqlogAKA/UeiXnI=";
++    dartHash = {
++      x86_64-linux = "sha256-egrYd7B4XhkBiHPIFE2zopxKtQ58GqlogAKA/UeiXnI=";
++      aarch64-linux = "sha256-vmerjXkUAUnI8FjK+62qLqgETmA+BLPEZXFxwYpI+KY=";
++    };
+     patches = getPatches ./patches/flutter2;
+   };
+ }

nixpatches/list.nix

@@ -1,57 +1,47 @@
 fetchpatch: [
-  # phosh: allow fractional scaling
+  # Flutter: 3.0.4 -> 3.3.3, flutter.dart: 2.17.5 -> 2.18.2
+  # merged 2022/10/07
+  # (fetchpatch {
+  #   url = "https://github.com/NixOS/nixpkgs/pull/189338.diff";
+  #   sha256 = "sha256-HRkOIBcOnSXyTKkYxnMgZou8MHU/5eNhxxARdUq9UWg=";
+  #   # url = "https://git.uninsane.org/colin/nixpkgs/commit/889c3a8cbc91c0d10b34ab7825fa1f6d1d31668a.diff";
+  #   # sha256 = "sha256-qVWLpNoW3HVSWRtXS1BcSusKOq0CAMfY0BVU9MxPm98=";
+  # })
+  #
+  # XXX this is a cherry-pick of all the commits in PR 189338 (as appears in tree).
+  # the diff yielded by Github is apparently not the same somehow (maybe because the branches being merged had diverged too much?)
+  ./11-flutter-3.3.3-189338.patch
+
+  # phosh-mobile-settings: init at 0.21.1
   (fetchpatch {
-    url = "https://github.com/NixOS/nixpkgs/pull/175872.diff";
-    sha256 = "sha256-mEmqhe8DqlyCxkFWQKQZu+2duz69nOkTANh9TcjEOdY=";
+    url = "http://git.uninsane.org/colin/nixpkgs/commit/0c1a7e8504291eb0076bbee3f8ebf693f4641112.diff";
+    # url = "https://github.com/NixOS/nixpkgs/pull/193845.diff";
+    sha256 = "sha256-OczjlQcG7sTM/V9Y9VL/qdwaWPKfjAJsh3czqqhRQig=";
   })
 
+  # kaiteki: init at 2022-09-03
+  (fetchpatch {
+    url = "https://git.uninsane.org/colin/nixpkgs/commit/e2c7f5f4870fcb0e5405e9001b39a64c516852d4.diff";
+    # url = "https://github.com/NixOS/nixpkgs/pull/193169.diff";
+    sha256 = "sha256-UWnfS+stVpUZ3Sfaym9XtVBlwvHWJVMaW7cYIcf3M5Q=";
+  })
+
+  # Fix mk flutter app
+  # closed (not merged). updates fluffychat 1.2.0 -> 1.6.1, but unstable hashing
+  # (fetchpatch {
+  #   url = "https://github.com/NixOS/nixpkgs/pull/186839.diff";
+  #   sha256 = "sha256-NdIfie+eTy4V1vgqiiRPtWdnxZ5ZHsvCMfkEDUv9SC8=";
+  # })
+
   # for raspberry pi: allow building u-boot for rpi 4{,00}
   # TODO: remove after upstreamed: https://github.com/NixOS/nixpkgs/pull/176018
   #   (it's a dupe of https://github.com/NixOS/nixpkgs/pull/112677 )
   ./02-rpi4-uboot.patch
 
-  # # flutter.dart: 2.16.1 -> 2.16.2
-  # (fetchpatch {
-  #   url = "https://github.com/NixOS/nixpkgs/pull/172873.diff";
-  #   sha256 = "sha256-HGYk83XOhFe1wWNCKNdF6s/7laWJ0Jisb8bDJcHVlsQ=";
-  # })
-  # # Flutter: 2.10.1->3.0.4
-  # (fetchpatch {
-  #   url = "https://github.com/NixOS/nixpkgs/pull/173200.diff";
-  #   sha256 = "sha256-g1tZdLTrAJx3ijgabqz8XInC20PQM3FYRENQ7c6NfQw=";
-  # })
-  # # dart: 2.17.3 -> 2.18.0
-  # (fetchpatch {
-  #   url = "https://github.com/NixOS/nixpkgs/pull/189841.diff";
-  #   sha256 = "sha256-E3rTNex7PiFHsLgtb0x9/Q/naqDYD1vFuGyduV4Z6qY=";
-  # })
-  # # # Flutter: 3.0.4->3.3.2, flutter.dart: 2.17.5->2.18.1
-  # # (fetchpatch {
-  # #   url = "https://github.com/NixOS/nixpkgs/pull/189338.diff";
-  # #   sha256 = "sha256-MppSk1D3qQT8Z4lzEZ93UexoidT8yqM7ASPec4VvxCI=";
-  # # })
-  # enable aarch64 support for flutter's dart package
-  ./10-flutter-arm64.patch
-
-
-  # whalebird: support aarch64
-  (fetchpatch {
-    url = "https://github.com/NixOS/nixpkgs/pull/176476.diff";
-    sha256 = "sha256-126DljM06hqPZ3fjLZ3LBZR64nFbeTfzSazEu72d4y8=";
-  })
-
   # TODO: upstream
   ./07-duplicity-rich-url.patch
 
-  # zecwallet-lite: init at 1.7.13
-  (fetchpatch {
-    url = "https://github.com/NixOS/nixpkgs/pull/180960.diff";
-    sha256 = "sha256-HVVj/T3yQtjYBoxXpoPiG9Zar/eik9IoDVDhTOehBdY=";
-  })
-
-  # makemkv: 1.16.7 -> 1.17.1
-  (fetchpatch {
-    url = "https://github.com/NixOS/nixpkgs/pull/188342.diff";
-    sha256 = "sha256-3M4DpvXf5Us70FX5geE0L1Ns23Iw2NG82YNlwSd+WzI=";
-  })
+  # enable aarch64 support for flutter's dart package
+  # ./10-flutter-arm64.patch
+  ./12-flutter-arm64-2.patch
 ]

pkgs/fluffychat-moby/default.nix

@@ -0,0 +1,20 @@
+{ pkgs }:
+
+(pkgs.symlinkJoin {
+  name = "fluffychat-moby";
+  paths = [ pkgs.fluffychat ];
+  buildInputs = [ pkgs.makeWrapper ];
+
+  # ordinary fluffychat on moby displays blank window;
+  # > Failed to start Flutter renderer: Unable to create a GL context
+  # this is temporarily solved by using software renderer
+  # - see https://github.com/flutter/flutter/issues/106941
+  postBuild = ''
+    wrapProgram $out/bin/fluffychat \
+      --set LIBGL_ALWAYS_SOFTWARE 1
+    # fix up the .desktop file to invoke our wrapped fluffychat
+    orig_desktop=$(readlink $out/share/applications/Fluffychat.desktop)
+    unlink $out/share/applications/Fluffychat.desktop
+    sed "s:Exec=.*:Exec=$out/bin/fluffychat:" $orig_desktop > $out/share/applications/Fluffychat.desktop
+  '';
+})

pkgs/gpodder-configured/default.nix

@@ -0,0 +1,24 @@
+{ pkgs
+, writeShellScript
+, config
+}:
+
+(pkgs.symlinkJoin {
+  name = "gpodder-configured";
+  paths = [ pkgs.gpodder ];
+  buildInputs = [ pkgs.makeWrapper ];
+
+  # gpodder keeps all its feeds in a sqlite3 database.
+  # we can configure the feeds externally by wrapping gpodder and just instructing it to import
+  # a feedlist every time we run it.
+  # repeat imports are deduplicated -- assuming network access (not sure how it behaves when disconnected).
+  postBuild = ''
+    makeWrapper $out/bin/gpodder $out/bin/gpodder-configured \
+      --run "$out/bin/gpo import ~/.config/gpodderFeeds.opml"
+
+    # fix up the .desktop file to invoke our wrapped application
+    orig_desktop=$(readlink $out/share/applications/gpodder.desktop)
+    unlink $out/share/applications/gpodder.desktop
+    sed "s:Exec=.*:Exec=$out/bin/gpodder-configured:" $orig_desktop > $out/share/applications/gpodder.desktop
+  '';
+})

pkgs/kaiteki/default.nix

@@ -2,39 +2,63 @@
 , fetchFromGitHub
 , flutter
 , makeDesktopItem
+, imagemagick
+, xdg-user-dirs
 }:
 
 flutter.mkFlutterApp rec {
   pname = "kaiteki";
-  version = "unstable-2022-06-03";
+  version = "unstable-2022-09-03";
 
-  # this hash seems unstable -- depends on other nixpkgs, perhaps?
-  vendorHash = "sha256-IC3FAPFASuMcNOpUuaB+MDcm9nqGCtq/6A2dCxIXHEg=";
+  vendorHash = "sha256-Y0BXQ7xt9w+J896ar6o+FiVGcDJw7dPHo7tgij+p6R0=";
 
   src = fetchFromGitHub {
     owner = "Kaiteki-Fedi";
     repo = "Kaiteki";
-    rev = "0a322313071e4391949d23d9b006d74de65f58d9";
-    hash = "sha256-ggDIbVwueS162m15TFaC6Tcg+0lpcVGi4x/O691sxR8";
+    rev = "fd1e26c98f37ad6a98ed549da879c91721f997d0";
+    hash = "sha256-N7n6o/B9s0DCYf9HFMZSCPShpE65wKl9FaQ5dbFnr1E=";
+    fetchSubmodules = true;
   };
 
-  desktopItems = [ (makeDesktopItem {
+  nativeBuildInputs = [ imagemagick ];
+
+  desktopItem = makeDesktopItem {
     name = "Kaiteki";
-    exec = "kaiteki";
+    exec = "@out@/bin/kaiteki";
     icon = "kaiteki";
     desktopName = "Kaiteki";
     genericName = "Micro-blogging client";
     comment = meta.description;
     categories = [ "Network" "InstantMessaging" "GTK" ];
-  }) ];
+  };
 
   sourceRoot = "source/src/kaiteki";
 
+  postInstall = ''
+    wrapProgram $out/bin/kaiteki \
+      --prefix PATH : "${xdg-user-dirs}/bin"
+
+    FAV=$out/app/data/flutter_assets/assets/icon.png
+    ICO=$out/share/icons
+
+    install -D $FAV $ICO/kaiteki.png
+    for s in 24 32 42 64 128 256 512; do
+      D=$ICO/hicolor/''${s}x''${s}/apps
+      mkdir -p $D
+      convert $FAV -resize ''${s}x''${s} $D/kaiteki.png
+    done
+
+    mkdir $out/share/applications
+    cp $desktopItem/share/applications/*.desktop $out/share/applications
+    substituteInPlace $out/share/applications/*.desktop \
+      --subst-var out
+  '';
+
   meta = with lib; {
     description = "The comfy Fediverse client";
     homepage = "https://craftplacer.moe/projects/kaiteki/";
     license = licenses.agpl3Plus;
-    # maintainers = with maintainers; [ colinsane ];
+    maintainers = with maintainers; [ colinsane ];
     platforms = platforms.linux;
   };
 }

pkgs/linux-megous/default.nix

@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.18.14";
+  version = "6.0.0";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -14,8 +14,8 @@ buildLinux (args // rec {
   src = fetchFromGitHub {
     owner = "megous";
     repo = "linux";
-    # branch: orange-pi-5.18
-    rev = "3ef835b665191e4833ae1363245be48e96013df6";
-    sha256 = "sha256-nQsBXeGLZhpem1p7Vnc8z7XB354AO1mn7VTj/hH5twY=";
+    # branch: orange-pi-6.0
+    rev = "b16232c6156de17e1dfdb63fdaea8e317baa07a7";
+    sha256 = "sha256-Tb05IQKFdX/T7elGNnXTLVmgGLvXoeBFBq/8Q7jQhX0=";
   };
 } // (args.argsOverride or { }))

pkgs/matrix-appservice-discord/01-puppet.patch

@@ -0,0 +1,13 @@
+diff --git a/src/clientfactory.ts b/src/clientfactory.ts
+index b7fea47..587acfd 100644
+--- a/src/clientfactory.ts
++++ b/src/clientfactory.ts
+@@ -53,7 +53,7 @@ export class DiscordClientFactory {
+         });
+ 
+         try {
+-            await this.botClient.login(this.config.botToken, true);
++            await this.botClient.login(this.config.botToken, false);
+             log.info("Waiting for shardReady signal");
+             await waitPromise;
+             log.info("Got shardReady signal");

pkgs/matrix-appservice-discord/02-auto-approve.patch

@@ -0,0 +1,16 @@
+diff --git a/src/provisioner.ts b/src/provisioner.ts
+index c1568af..28a44c5 100644
+--- a/src/provisioner.ts
++++ b/src/provisioner.ts
+@@ -99,8 +99,9 @@
+         this.pendingRequests.set(channelId, approveFn);
+         setTimeout(() => approveFn(false, true), timeout);
+ 
+-        await channel.send(`${requestor} on matrix would like to bridge this channel. Someone with permission` +
+-            " to manage webhooks please reply with `!matrix approve` or `!matrix deny` in the next 5 minutes");
++        // await channel.send(`${requestor} on matrix would like to bridge this channel. Someone with permission` +
++        //     " to manage webhooks please reply with `!matrix approve` or `!matrix deny` in the next 5 minutes");
++        approveFn(true);
+         return await deferP;
+ 
+     }

pkgs/matrix-appservice-discord/03-no-edits.patch

@@ -0,0 +1,14 @@
+diff --git a/src/bot.ts b/src/bot.ts
+index 8bc73d4..1e6ea67 100644
+--- a/src/bot.ts
++++ b/src/bot.ts
+@@ -568,7 +568,8 @@ export class DiscordBot {
+             }
+             const link = `https://discord.com/channels/${chan.guild.id}/${chan.id}/${editEventId}`;
+             embedSet.messageEmbed.description = `[Edit](${link}): ${embedSet.messageEmbed.description}`;
+-            await this.send(embedSet, opts, roomLookup, event);
++            log.warn("not editing sent Matrix -> Discord message");
++            // await this.send(embedSet, opts, roomLookup, event);
+         } catch (err) {
+             // throw wrapError(err, Unstable.ForeignNetworkError, "Couldn't edit message");
+             log.warn(`Failed to edit message ${event.event_id}`);

pkgs/matrix-appservice-discord/04-no-kickbans.patch

@@ -0,0 +1,88 @@
+diff --git a/src/bot.ts b/src/bot.ts
+index 8bc73d4..1e6ea67 100644
+--- a/src/bot.ts
++++ b/src/bot.ts
+@@ -795,82 +796,7 @@ export class DiscordBot {
+         roomId: string, kickeeUserId: string, kicker: string, kickban: "leave"|"ban",
+         previousState: string, reason?: string,
+     ) {
+-        const restore = kickban === "leave" && previousState === "ban";
+-        const client = await this.clientFactory.getClient(kicker);
+-        let channel: Discord.Channel;
+-        try {
+-            channel = await this.GetChannelFromRoomId(roomId, client);
+-        } catch (ex) {
+-            log.error("Failed to get channel for ", roomId, ex);
+-            return;
+-        }
+-        if (channel.type !== "text") {
+-            log.warn("Channel was not a text channel");
+-            return;
+-        }
+-        const tchan = (channel as Discord.TextChannel);
+-        const kickeeUser = await this.GetDiscordUserOrMember(
+-            kickeeUserId.substring("@_discord_".length, kickeeUserId.indexOf(":") - 1),
+-            tchan.guild.id,
+-        );
+-        if (!kickeeUser) {
+-            log.error("Could not find discord user for", kickeeUserId);
+-            return;
+-        }
+-        const kickee = kickeeUser as Discord.GuildMember;
+-        let res: Discord.Message;
+-        const botChannel = await this.GetChannelFromRoomId(roomId) as Discord.TextChannel;
+-        if (restore) {
+-            await tchan.overwritePermissions([
+-                {
+-                    allow: ["SEND_MESSAGES", "VIEW_CHANNEL"],
+-                    id: kickee.id,
+-                }],
+-                `Unbanned.`,
+-            );
+-            this.channelLock.set(botChannel.id);
+-            res = await botChannel.send(
+-                `${kickee} was unbanned from this channel by ${kicker}.`,
+-            ) as Discord.Message;
+-            this.sentMessages.push(res.id);
+-            this.channelLock.release(botChannel.id);
+-            return;
+-        }
+-        const existingPerms = tchan.permissionsFor(kickee);
+-        if (existingPerms && existingPerms.has(Discord.Permissions.FLAGS.VIEW_CHANNEL as number) === false ) {
+-            log.warn("User isn't allowed to read anyway.");
+-            return;
+-        }
+-        const word = `${kickban === "ban" ? "banned" : "kicked"}`;
+-        this.channelLock.set(botChannel.id);
+-        res = await botChannel.send(
+-            `${kickee} was ${word} from this channel by ${kicker}.`
+-            + (reason ? ` Reason: ${reason}` : ""),
+-        ) as Discord.Message;
+-        this.sentMessages.push(res.id);
+-        this.channelLock.release(botChannel.id);
+-        log.info(`${word} ${kickee}`);
+-
+-        await tchan.overwritePermissions([
+-            {
+-                deny: ["SEND_MESSAGES", "VIEW_CHANNEL"],
+-                id: kickee.id,
+-            }],
+-            `Matrix user was ${word} by ${kicker}.`,
+-        );
+-        if (kickban === "leave") {
+-            // Kicks will let the user back in after ~30 seconds.
+-            setTimeout(async () => {
+-                log.info(`Kick was lifted for ${kickee.displayName}`);
+-                await tchan.overwritePermissions([
+-                    {
+-                        allow: ["SEND_MESSAGES", "VIEW_CHANNEL"],
+-                        id: kickee.id,
+-                    }],
+-                    `Lifting kick since duration expired.`,
+-                );
+-            }, this.config.room.kickFor);
+-        }
++        return; // this is about letting Discord users know when Matrix users are kicked/banned
+     }
+ 
+     public async GetEmojiByMxc(mxc: string): Promise<DbEmoji> {

pkgs/matrix-appservice-discord/05-no-meta.patch

@@ -0,0 +1,13 @@
+diff --git a/src/matrixeventprocessor.ts b/src/matrixeventprocessor.ts
+index f1f4611..7b57ff3 100644
+--- a/src/matrixeventprocessor.ts
++++ b/src/matrixeventprocessor.ts
+@@ -278,6 +278,8 @@ export class MatrixEventProcessor {
+             return;
+         }
+ 
++        return; // disable all meta notifications
++
+         msg += " on Matrix.";
+         const channel = await this.discord.GetChannelFromRoomId(event.room_id) as Discord.TextChannel;
+         await this.discord.sendAsBot(msg, channel, event);

pkgs/matrix-appservice-discord/default.nix

@@ -0,0 +1,19 @@
+{ pkgs }:
+
+(pkgs.matrix-appservice-discord.overrideAttrs (upstream: {
+  # 2022-10-05: the service can't login as an ordinary user unless i change the source
+  doCheck = false;
+  patches = (upstream.patches or []) ++ [
+    # don't register with better-discord as a bot
+    ./01-puppet.patch
+    # don't ask Discord admin for approval before bridging
+    ./02-auto-approve.patch
+    # disable Matrix -> Discord edits because they do not fit Discord semantics
+    ./03-no-edits.patch
+    # we don't want to notify Discord users that a Matrix user was kicked/banned
+    ./04-no-kickbans.patch
+    # don't notify Discord users when the Matrix room changes (name, topic, membership)
+    ./05-no-meta.patch
+  ];
+}))
+

pkgs/overlay.nix

@@ -21,10 +21,14 @@
   };
 
   #### customized packages
+  fluffychat-moby = prev.callPackage ./fluffychat-moby { pkgs = prev; };
+  gpodder-configured = prev.callPackage ./gpodder-configured { pkgs = prev; };
   # nixos-unstable pleroma is too far out-of-date for our db
   pleroma = prev.callPackage ./pleroma { };
   # jackett doesn't allow customization of the bind address: this will probably always be here.
   jackett = prev.callPackage ./jackett { pkgs = prev; };
+  # TODO: delete matrix-appservice-discord
+  matrix-appservice-discord = prev.callPackage ./matrix-appservice-discord { pkgs = prev; };
   # mozilla keeps nerfing itself and removing configuration options
   firefox-unwrapped = prev.callPackage ./firefox-unwrapped { pkgs = prev; };
   # fix abrupt HDD poweroffs as during reboot. patching systemd requires rebuilding nearly every package.
@@ -35,6 +39,8 @@
 
   #### TEMPORARY: PACKAGES WAITING TO BE UPSTREAMED
   kaiteki = prev.callPackage ./kaiteki { };
+  # kaiteki = prev.kaiteki;
+  # TODO: upstream, or delete nabla
   nabla = prev.callPackage ./nabla { };
 })
 

pkgs/pleroma/default.nix

@@ -49,6 +49,8 @@ beamPackages.mixRelease rec {
     done
   '' else "";
 
+  stripDebug = false;
+
   mixNixDeps = import ./mix.nix {
     inherit beamPackages lib;
     overrides = (final: prev: {

pkgs/sane-scripts/default.nix

@@ -24,7 +24,7 @@ resholve.mkDerivation {
         findutils
         gnugrep
         ifuse
-        inotifyTools
+        inotify-tools
         ncurses
         oath-toolkit
         openssh
@@ -33,6 +33,7 @@ resholve.mkDerivation {
         ssh-to-age
         sops
         sudo
+        util-linux
         which
       ];
       keep = {

pkgs/sane-scripts/src/sane-mount-servo

@@ -15,4 +15,5 @@ then
 fi
 
 # symlink the fastest mount point into place
+# uncomment if i see the bug again: sudo unlink /mnt/servo-media  # XXX ln gets confused if the destination is a symlink to a stale mount
 sudo ln -sf $mnt /mnt/servo-media

pkgs/sane-scripts/src/sane-mount-servo-root

@@ -15,4 +15,5 @@ then
 fi
 
 # symlink the fastest mount point into place
+# uncomment if i see the bug again: sudo unlink /mnt/servo-root  # XXX ln gets confused if the destination is a symlink to a stale mount
 sudo ln -sf $mnt /mnt/servo-root

pkgs/sane-scripts/src/sane-reclaim-disk-space

@@ -1,16 +1,41 @@
 #!/usr/bin/env bash
-set -ex
 # script to reclaim some hard drive space
+set -e
+
+options=$(getopt -l "fast" -o "f" -- "$@")
+do_rmlint=true
+for arg in $options; do
+  case $arg in
+    -f|--fast)
+      do_rmlint=false
+      ;;
+    --)
+      ;;
+  esac
+done
+
+set -x
+
+# always claim nix garbage
 sudo nix-collect-garbage
-# identify duplicate files in the nix store
-rmlint --types="duplicates" --config=sh:handler=clone --output=sh:/tmp/rmlint.sh --progress /nix/store
-# link the dupes together (uses ioctl_fideduperange)
-#   see: https://btrfs.wiki.kernel.org/index.php/Deduplication
-#   see: https://rmlint.readthedocs.io/en/latest/tutorial.html
-sudo mount -o remount,rw /nix/store
-/tmp/rmlint.sh -d || true  # on failure, we still want to remount ro
-# XXX this doesn't work: 'mount point is busy.'
-sudo mount -o remount,ro /nix/store
+
+if [ $do_rmlint = true ]
+then
+  # identify duplicate files in the nix store
+  rmlint --types="duplicates" --config=sh:handler=clone --output=sh:/tmp/rmlint.sh --output=json:/dev/null --progress /nix/store
+  # link the dupes together (uses ioctl_fideduperange)
+  #   see: https://btrfs.wiki.kernel.org/index.php/Deduplication
+  #   see: https://rmlint.readthedocs.io/en/latest/tutorial.html
+fi
+
+if [ $do_rmlint = true ]
+then
+  sudo mount -o remount,rw /nix/store
+  # XXX: does rmlint really need to be invoked as root?
+  sudo /tmp/rmlint.sh -d || true  # on failure, we still want to remount ro
+  # XXX this doesn't work: 'mount point is busy.'
+  sudo mount -o remount,ro /nix/store
+fi
 
 # TODO: instead of using rmlint, could use dduper: https://github.com/Lakshmipathi/dduper
 #   better perf for btrfs (checksum tests)

pkgs/zecwallet-lite/default.nix

@@ -1,30 +0,0 @@
-{ lib, fetchurl, appimageTools }:
-
-appimageTools.wrapType2 rec {
-  pname = "zecwallet-lite";
-  version = "1.7.13";
-
-  src = fetchurl {
-    url = "https://github.com/adityapk00/zecwallet-lite/releases/download/v${version}/Zecwallet.Lite-${version}.AppImage";
-    hash = "sha256-uBiLGHBgm0vurfvOJjJ+RqVoGnVccEHTFO2T7LDqUzU=";
-  };
-
-  extraInstallCommands =
-    let contents = appimageTools.extract { inherit pname version src; };
-    in ''
-      mv $out/bin/${pname}-${version} $out/bin/${pname}
-
-      install -m 444 -D ${contents}/${pname}.desktop -t $out/share/applications
-      substituteInPlace $out/share/applications/${pname}.desktop \
-        --replace 'Exec=AppRun' 'Exec=${pname}'
-      cp -r ${contents}/usr/share/icons $out/share
-    '';
-
-  meta = with lib; {
-    description = "A fully featured shielded wallet for Zcash";
-    homepage = "https://www.zecwallet.co/";
-    license = licenses.mit;
-    maintainers = with maintainers; [ colinsane ];
-    platforms = [ "x86_64-linux" ];
-  };
-}

readme.md

@@ -24,3 +24,10 @@ this can then be `dd`'d onto a disk and directly booted from a EFI system.
 there's some post-processing to do before running a rebuild on the deployed system (deploying ssh keys, optionally changing fs UUIDs, etc).
 refer to flake.nix for more details.
 
+## building packages
+
+to build one of the custom sane packages, just name it:
+
+```
+nix build ./#fluffychat-moby
+```

scripts/init-keyring

@@ -0,0 +1,18 @@
+#!/bin/sh
+# initializes the default libsecret keyring (used by gnome-keyring) if not already initialized.
+# this initializes it to be plaintext/unencrypted.
+
+if [ -f ~/.local/share/keyrings/default ]
+then
+        echo 'keyring already initialized: not doing anything'
+        exit 0
+fi
+
+keyring=~/.local/share/keyrings/Default_keyring.keyring
+
+echo 'initializing default user keyring:' "$keyring"
+echo '[keyring]' > "$keyring"
+echo 'display-name=Default keyring' >> "$keyring"
+echo 'lock-on-idle=false' >> "$keyring"
+echo 'lock-after=false' >> "$keyring"
+echo -n "Default_keyring" > ~/.local/share/keyrings/default

scripts/install-iwd

@@ -0,0 +1,20 @@
+#!/bin/sh
+# usage: install-iwd.sh <source_dir> <dest_dir>
+# source_dir contains plain-text .psk files of any filename.
+# for each file, this extracts the SSID and creates a symlink in dest_dir which
+# points to the original file, using the SSID name as filename.
+#
+# this is because iwd extracts the SSID from the filename, but users might
+# prefer the SSID be kept separate from the filename.
+
+src_dir="$1"
+dest_dir="$2"
+for f in $(ls "$src_dir")
+do
+        ssid=$(sed -rn 's/# SSID=(.*)/\1/p' "$src_dir/$f")
+        # not sure that iwd can deal with un-writeable symlinks
+        # ln -sf "$src_dir/$f" "$dest_dir/$ssid.psk"
+        cp "$src_dir/$f" "$dest_dir/$ssid.psk"
+        # not strictly necessary, but iwd does default to rw
+        chmod 600 "$dest_dir/$ssid.psk"
+done

secrets/servo/matrix_appservice_discord_env.bin

@@ -0,0 +1,28 @@
+{
+	"data": "ENC[AES256_GCM,data:7j1l4XJ8cp8MVuSmOedOZwGDWV11hmwFyLW43ixUBaZLWbUZ6Z4P4Gt+o7bj8gc/X8aiPV8sxAR/jY28Sc5DIaAnkKnXjesPVlG0c3oRAsXemKGX8fANkoNX5iEPbWAkFiJdLS6Fgdv2g4z6DQ4odvZQKrMchx8MPYq8icBvvbhKiGs5xo+MGrMBVRCZOERM2FJSy/q9zLv6hU5SfnnYDTMt,iv:poHHiCs0YOCv74dQ2kyXogdgTUqmKRgGq2r7lcxe4bQ=,tag:rz1/FLC5Q8S13TTWNKcYyQ==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2TjVWenJkYVdjeExzYjVj\nUVdFeUdMRUtwOWJNYUx6dFRWRXdEUWJhdkVFClM1UnhtWndYbE91RCtVRnl4TGp4\nZHNJNUliOWhqcUorZVBEQWR0eXZaMVEKLS0tIDdsVFJ2bmdNeVk5b3FJVDQ3T1BG\nU0taQlA1QVEvYVJweDQ5L2YwTmo2ek0K+nbzpIpjAhRgJ5Lw+mx/doGMjw0aMNkZ\n5sAnPJo88Sa/TW3qBN48xFBMLWMp/SKs2JTaMu0xW0u2SkQX38TLlw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyUFBSYVJZUmRBcGJXclNP\nRDRUZnRKMmYwdFhQcE1oWUhrZGxNTk5YOFIwCldUMW92NGl0VVBsS0JtYjJOTW9E\nK2ZZdm9GK3FOMitUdEU3QStsR2svQWMKLS0tIE9SWXAzVndsdGY3Uzh2eHpBRjdO\nTVc4cWNDUWRuSWRmZC8rK1ZFS2l4WEkKQR9mApDjb0k14W3jK+CEz3Dez6wSBpg+\nZ7uUfSbPXFxRxvNEascRn/+EHPcd/A7MZjViDUyWVcP6fSMPsQvxhw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkWHlteTRDcHRneW9hbzlh\nMHBjZ2RHeDBIbDM2QXVxK09mcERVSUliVWw0Ckg1dGFkUUxPQW1HcDFXcEEyejFD\nWW5qUkNwRkdIdjRiTFJNd0Q5NWpLUUEKLS0tIG1wTnk1aEhudm9VZjZRVGRWWnR0\nVHlFbUJHaitadDVOSG1FMTBqeHJGV0kKAjuuw3j4dx3QfNcjyl8XCP9Q6oOkLZBN\nsW7uCqbVgBCG+uIggwefLWAy8g6PYlLj0aumgLPYVsXShbQYi32m/g==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2022-10-06T05:07:20Z",
+		"mac": "ENC[AES256_GCM,data:9WR8xfs5XIkWxDlJVX1EiSJBLBgWMR99PJJXCK9RcbuChK7QvjWjEflwq419qeNbMWdHLkUwSQrBsoHomaiGWFOPZ0C8bqcqDl0zzXMk7nBxM4UgTjRLmML2tdI2bCS0DC0AtytThYPvkW+JHgKB6bOAEw/bVWVP4YJQKWEf6FY=,iv:nG+J7jCdqZHp6x6Vlvye7BbK7YSl0Y9cjTWbW/BZLxo=,tag:OWqXktZE52Q3j7D2KG+vHw==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}

secrets/universal/net/community-university.psk.bin

@@ -0,0 +1,48 @@
+{
+	"data": "ENC[AES256_GCM,data:JJk6bnHkxhfMNecslbm/iA2hdnC/C1DdeiesZrkUpJru8DMBs9ExhcHcYSRfxwzcZ1FDPLv3a9Mnickgb9uIz9UWbNZBfPUg2xEIHIs=,iv:dWqSRR+tCSXch0OebLQPzaBtNJieMHLFUeR7yXe4NTA=,tag:C/kAerUFRhugyf91puhKYg==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGQnVZQ3NvWUhMSy8wQzJM\nWkZnc09UaldLc3M4RjlKZjN4ZWY3NC8ybWk0CnRwTUtmZ0NMU2tCMmM5SzRnUHht\nSUg5MWpGV010b3N3WWU5UkljV0VBWU0KLS0tIHRjUER0RkhwbmVKOXBYR0RnbCtC\nd0hUd0VuZm1wQjNhclpTL0RLZnBybE0KA1ZTaq3D3UgV4g/mhwgss4uBE0LPuPNC\niFs7ixvRBF591VWvraVWUpTqOZW5dMybMBu5EjGHYtHl7f9dbhY5aA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDdCtBd0tjWmtyVGZmbHNJ\ncTZwa2xzd3VoN3RFcjZ6TUtLcUdhMm01Tm1nCnVvaDBnNG9jOVd5SFNiTjJzZnV1\nZkltV0RtYS8zays1ZVdKcENGV2J3N1kKLS0tIDF4V2gxdEoySDR2azR6THVGY3BQ\nTFE1ZE9rZ0JFZWd2TDd0Z0pQc0VZWmsKgFEfMB2W76AVPOTkGszqDLiw8aTGJ3Ym\n1Tv+OXtdaqcgD+MY67Fa396oJiD/K2zY5CfQvH2YV+VYNeAfZsRM+g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCbGErdE5idTNnZzVtcXJy\neUJIbDBncytYVlcwandMUU9nRXB6TE1IUVEwCjFrZEU3VVltbVlkNW1MTk1LQkZB\nTGZ1Z3hJSFBsNEtQZVZFemZBKzZGUmsKLS0tIERpY29zZWkzcnJsRU00SDhhWXYw\nSE9tK1JJSlZpTTJ0ZUtoV0RlQ2xkOE0KCBuW93P3rgeaFewybt27fmA6BE9HY08f\n+0kix/idWFkdxtzS/v+WFHnaac2lhIl+X3EQQoU6PJGVrlV4q/qqAw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiNGZZQlowTXhtZkRMNGx0\nQ0xUL1hkaWtUTkY3Ti9BMHhKS2NtTEd6MmlZCjg1WFJVZkFwOE1yQzhQbWs1bThP\nQlU4dFZWZnJOWjM5aTZZLytiMnNEdTgKLS0tIGFuRFkrakZWMmNPSmVycEdYUnVs\nTk96RWdOYmlLUmYwNGJIZ1IxVk92R2sKARCSlcel/yqCPKDXSNNDV+ej8jU3CiPI\nMktemcTe9FjEpQzRDEQQJ1izlHIqpSwlOSx0UZsUgQOFFP+fwQGUaA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBZnorZkFYTkJ3d1pXMWor\ndnpjSGJYYlhCMWJaSnJJUXRLMlIzNjZhOW53CjZQdWVPdTN3eldFN3FvWW9VNmdk\nYnp1QkpoaW56bFdnL2Z3RjJERWZlK2cKLS0tIG9vUFJzNTNZVklob2hnWnMxaDNF\nWW9tV2ZJcVEyS0QvbGZaK0d4MzBIVXMKMtIMAwa+HJwAHhbM4NhLiPYgXbIZUzD8\nGwjFTyRi6K1vOw2/c+w0BYb1ZIvaChrsl9ISfU4+e3gjvSX1MP0Cyw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQenF0YnRscjJSQUFTbHNI\nSGNTS21LNklxaW9uTGlxT2pDTE5SZmJMUkRNCnBwYXRDUHJ2TDh5QXMvWjVYRWFs\nL1FjRFJyQ0hkVkpRWjNnQlVNczZjb0UKLS0tIGk0U1RFVVRMcHBLU1VtaHdxeXRj\nblRlekhIQmRYZnczcGNqNFQ0RG9UcDAKAbFvm1CGCqbd8FBbubfJNCjEFTO4LdfX\ncUBaV9xFvFD5Gy/576KBNUO4NjIEnd14JL93TC/okakJAsxnHMG/iA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCQmh1dE1LZGI4SlUza2Zq\nVTc4K2NWeHFxNXVmUzgvNUNDanlQOTZXOVd3CkthcWZRby9ZbzFlang0RytsZEI1\nczVodG52MFV6RklhVGNBcUxjQXZJWVUKLS0tIFExRjM2N3N1MUtHRWpGN3I0bjEy\nWHlJN2phSW9FMUVhQ05iSDM0dUkxdkEKoNIaw3OW2JfoPL6viItBWRwm78x5j12v\nlV0/Ui3MBKoKwxbzti25mxwGRshw7dwStuGpkCVRbp1Gx3JQbggrLw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVWU9YcEs3Zzk3L0RNZTFJ\ndDJleXZlOHFKNk5KUlp1REllNTFaZTlSYUY0CmdaYzU2aE40cnZUYm4xajdzK3NO\ncXlnalFZVHZ5bnlSc0RpQjBEMHBEV0kKLS0tIHNYSks5QUI0WkxJc3VBVjFmbGhP\nR1RIaDk0RnN3VXBBcmY2L1JBamx0RUUKnTymF1GRV1Zz7q0XNGLz61xkMXGuhoRs\nPpE3hFbQNrap+vf8NhpElJJ7dTnrndfZNftBco+YsocOxlVXWw52Fg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2022-09-29T11:34:03Z",
+		"mac": "ENC[AES256_GCM,data:ozFWkM2SFgTicicB1l2pMCfKVvVxoUV7k93VyR9OWtVhUqH7DYgrKWFzFCwGbR6xBSMSIZU7haeVJP8r7n3S9wwQNu7FsS/PfqVcsTfpT+g5Q83vfdVFcFnV4VsalsZ8HvTQ3OiVbNVLn3J8M94KL+5ya8mf1oNHwq8xbAYcM6U=,iv:AtHuh1VIAdUqmazPbesmmYq6gXEBE241Ejos73AFkUQ=,tag:bM9Z//NV43U5buXJ7VMSlw==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}

secrets/universal/net/friend-libertarian-dod.psk.bin

@@ -0,0 +1,48 @@
+{
+	"data": "ENC[AES256_GCM,data:iRxcs8VpOA6dFng9B3wHwxpEx0hhLpKUb+Eu09CFzPiZKPfQ00pecfbpQeXJpT4uvVxmkl5zuGkksSzBEJDBIA==,iv:Ii65q3V8dGz1TfhQNxKa7gSM3w8T9mnP3C8vUJpBbrg=,tag:ge94QompXmUtdl9o7306sg==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZQURjcVlTRDNRM0IwbDdB\nRXJOM3BkTWNhSXBYRkRicWlFbkR2QWJtVUFNCmZMeEs2SmpuN0RDK0JFQ1VUOHdk\nSnNxSkxPR2R2cHNZZ0c0SGtNWXVTZGsKLS0tIG93T3JCU0dTUEFRNzg1L3NlTEpr\nWlpHcHhKcTRKM0tZd1dXdGxlMTlyVEEKt8dheToHMyd/kGnQoUoerdIaexgY1jb6\ndOYZfwizrTE5mhYFzcApkChnjSHWfPTlWE0EzG4pBkTGkmoAx8LU0w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAraUp0eHVGYnBZOUtMOVdu\nMTI5ZjBraEY1aFk1ajVLcmdqcGhhRzZ4UzBvCjVXWGtBaytkdWVnMDBEb1R3VWh2\nZnNYVzljMWRGYjVzZng5c0p4aVFXTzgKLS0tIDlVTzdrZENZaXFLWEtZWXUzQWFR\nTTFLYnR0WUgzcFhMU0V0VzcwQzQyV2MKdPvZdrfidA+k+PO9q7ruNlAbLkj3Hcvm\nvDcsTlYUA1ZG5SBsEhsztzNa7dSDX4EYrf5j1WSPu0/a0UYXkrR20g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrNzZUc0hVWVhsKzVFcng5\nQ0VnbWZyL2RwT0FIMDhtR1FBNmxEZzR3OFhzCmRTTnpxcCsvZ1dvaE10NHppVW14\nVk95bUlRck5jUU5kWUZ1ZDVFUkdVdDAKLS0tIDduSWMydy9Gc0hmQWU4ZkI3VktN\nd0xUeUdYbExYREcvazlZZk9uSjJtZzAKkTW5axKqwBuo75Z6bGI3+4wXf5ilAXaO\nQOhyWWTLTdnCq0TOPt5eZlFgMleOsJD66wHTQR5Eb+Cw0+9w+XZmag==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLWlBSald4czhxRGNoR1Np\nOElFNGJsT1M1NWRpbXF1bmJ3eE54UGVNbUFRCnV4K2pQMzR6ZXdqVU9yWXNqMTQ3\nQ2NzUkpNdkcrSldqNks3YXlyS20wTW8KLS0tIGVaVzIydEtHeWZiVXRZbnNiNEJR\ndXp4WmxmRVppYWNDaTNoUTVZZ2N2LzQKPRFZQD6TJXBewxurVsHlazTE0HsygOVD\nRuTjEj+F9DRVc4scne8GhHkQYUJSe1iVsb31WK9/JNpXBpOaSNvZUQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZZlEyMEJOay93blhnUGZ0\neEhreE14b01Wdk1CTW9TVHVTV0pmZ1crNVFzCitiaVd5TjNiZWIwaVcyL3FaSmtl\nSzBJZVVGSi9tU0lUMk54UTZIZm9YMjgKLS0tIHpoK0ZVVUY3enZoNDhXSlVoUi9p\nUmxtU0ZBU05iVjdpSDVYc0tuamdHcDgKUzf5zX9oN63tHY2fYFAUKShS+rJIg6/2\nMX/QUGUDT44TBSw6forKS5qrlyuMkxr3PpgB1+P2isZNR9UK+dOcmw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEeStqei9pSmcvYU9FMDlQ\nQ2lNWXhjaFBTK3p3WjdoMmhKcFptYXA2eHdFCnFHSnZ1ckRNUUFDa2l5L0tJM2pD\naC9LZjY3N053Y3g0RFNKYnhIdUsveUEKLS0tIGFHZDJrdXRReElxcTRXY3JNK0dH\nSG9TNHFFUmtidWpDV29ZZlcvNERRdW8KUqP2zeYjBv1JhAjZMIY2LByZahRwhAzo\nLsCb2/kp1uWF/2jYllFmP3mtxJE3cijeHuN/1cwaMkJfFr5pyR1feA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMcEVzZWhoZzYvbVBCd0lD\nQzJPMmlvN2F4dlJUN1pQMTNKQ3lkb01XaWdZCmhHMHh5Q25aeVpZN0pNWVAvUmpr\nMGg0cXNyNFRuTVUySG5pUEJuTXJLYU0KLS0tIEk4NXNGV1RWYTdvZWU3QllnSXNN\nZ2JPNkZHMFpxRHE1Q09KN3kxbEFaQmMKAgmnPBq25Be+v4UJcYZXG6Cg4RNUI1yu\nw3HK1X1TcI1M4f7PuChbPzhp9+LVgWNkftDoSTjq0WFKsBlW95alRw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrSTFlZ2s3dGlxNi9pV081\nSjI3Q2U2Z0pxR0RhUFJ6cmZWTFVnNFFUdURJCjJkRkRody9KZ1EvMTRNOG4yaXNa\nTHliSmE1Y3dKRTIrNjFzMnpuSmdYVkkKLS0tIGxaYW8rUHk4clo3aGt0VTJlcGZ4\nZTdVTkxrNFRYS01Wb0ZYUTRoU1JocVUKX6VXkWHWma+3D8Vd6OC72mIelgXWMbrj\nwRIO2fHsy9M+TBQzHHxhdCdKefAYMu/hfXEFL47/Wn5yBJmSWjYEeg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2022-09-29T11:27:51Z",
+		"mac": "ENC[AES256_GCM,data:dgJ/bcxkcCrTSAPKDa4T1djvZVTnWofmb1nTx+V3X0C0g0xCYrffpcieSPusKoQC+AzaZSy4H/RyLlW9We8+t41hrWdjdPkGcLd7n2u2e5o/AIgdSv/ODdFnX2E13ZTKMnfI7kUHsSaNLUF7TvitdXCO/hICGkGoJwRFwbV8bxU=,iv:WeQByrD8To8wqOwfbZYonci2gTm42Mv94zKKKNufq2k=,tag:avhJCmvNdZhkd3mTtx7cRQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}

secrets/universal/net/friend-rationalist-empathist.psk.bin

@@ -0,0 +1,48 @@
+{
+	"data": "ENC[AES256_GCM,data:zhMmmsRibiS5Akobs2hEZnyFZRitEyXguYolhUmXNSMdhybLWealGNPF5D0v5MzEV0dhncmvXs8oz3k=,iv:xtQtYnbXfndMyB/I1ruL/F4k0omQeShDP8QuaK2SVkU=,tag:MfxdSbk3OR6mBVggsw2I6w==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1T29tc1Y3RElhY1hCR3JO\nMDMrV0VGdUVLNVBsV1VWenlXRCtucDhZbHdZCjdnU0ZjOGN5Vit5OGxqL1RMaUJo\nT0ttZDFLaTAzd3g1Nk5VMVgrMEt3c1EKLS0tIFJEakR1cTNETGpVdGxqTE5xVVU3\nWGlDZkY4dGZPVFIxRGJmdXF0WFoxS3MK7xGioj8OTPTL+WGYRjJbXEHbgU20qoA4\n/usblY/fawOBNbAGttpSEWyHb1qlQTWwVl00XNb/LqUd/Qa6O1uoiA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBySmQxSTJOVmtVVFhTMmxN\nWUFpekVqZzVZSXQrRW1ZYWk4bWpSbUJvV2dRCjlBLzR3YmxlWGQxYXI4MzdQVkZW\nSlU5QVhNUTNrMFM0VVV0dkRnLzhHVDAKLS0tIE0va3hhNlJCR0VzVVVNQlk2bTFV\nZXpNS0JvS290TlA3MXYxWWVueE5TNU0K9cq49fk1ip9CBAoPkifyZfY8NqFo5zgo\n2UsL9qla2F/DzA8Kl2l2DXaU9PaRngrj8AoFdvtUtO67r0NwmQ3zaQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxNGVmWGJmUzZweXVCUzlK\neEI4VUl0V2t0WFFoRDAxZjZvd1dJRnZ2VmdBClVXZVZpd2lhMEdTUFlpMUZjVmNi\nV2xKaktRbmRtVzA2UlhJVmZtcnErYlEKLS0tIHlyME1OdHIrWG5uODQzbmt1Q0Zp\nRXJLTithVXBnditUc0tPd0dJYXZjMlEKWOL7CXR0wn8TkQtuBssx6cErNZQdonxr\nzcDUJeAQ6SPFsnyCZ6BH972z0izmRkHYaqVRj5Pl2Ogrr+UHIxSqeQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1T2VFTlZHSDdvWWFaS3pO\nVHg2aEdZNDd1ZnFwbGpQWE5MYkdPZ1lkRWswCjRuQU5zN1cyTXRwa0ZaWEs2Qkg4\nMHZGWDBqSE5kNHVCVzRqb2JEb0lrSFEKLS0tIFJ4Vm9RUm1WZXdXcHVqYjNBMU1W\nT2srSGZNUUFZSlpaM2RyREk1aHJab1UKBpY37flWrKKeRgjs2BzWof/6E3k3DZp9\n1b/Ctvyebvxx0C9jxBzajqgbVahN/167JGwHrz87vTqp8907sFEbkQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDN2IzVExDUXNwTlBDVndz\nZERnUmxTK0Jqeng3d2xWMVgvS3h4M1dYbm44Cmh0YnZ3UmltaFlxTXY1VFN5dTNT\nSzY4cjBkVldESXZSZndrMUdMZDJNQmsKLS0tIGlUOHZoMXBjNFFXbno1WWxsVEJm\nakUvSzBST0t1a2o0RG9zVXpOWlU2NWsKRJ80nHXMzEwPS0BZIAT4KKTDYtxufC3s\nFlcLzDQVVN+JLAdu9viayUrLrKfAaKvPKGY0YUFgIV3YyA4/vBLIpg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWUmxSS0U5bE8xdHVmQkpz\nZ1JrdlVHMFF2VFJiMFVMejJGNU1xbStJWXh3CllRYWxyT0dORHlSWFVMeGcyMXI2\nRy9lM0N4L0w5VDRMK0dueVV6OUE5WlEKLS0tICsrQ21FU3d2Q1hoNGZuSGdzUkxD\nalhRTkNZNCtoQ0xmRzBYMzlvRnlNNEEKzL4v1ZRwfJ9aYHYZZNwrsHzXeZdQzk/R\nw5BdRWOqrTpk8DLwCxYO/bwxieidocaBhUufDZFPqooxSz/s6HaawQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByVTg0MzMrcEZobzFFaVVv\ndytJeVFjRnVuR21vTlJIUk9rUHVBbFFiREFNCmxxMHQ5bjRqQ2x6Mm1yeFN3Q0Yr\nY056bXZmSWVuQUxWaitIN0Q1RE91SjAKLS0tIGZCZm9yTE1tcHZoblBrekcvQndn\nZWgrN0FyQklCUHBFSWpheS82M3ZKR1UKD5UpmL6mPXVDyOP++o7+MTRq85omDmbg\nINDnSX/CiPfLb09GukRLMymcaVvBJqKTmySalgHSC+EKTo5uXBHehA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3NU94L3BTczBuekoxQkxZ\nMnQ2T0ZYcTdrYWZqYSt0RFB1Z0ZRODBHUnlFCjVob3JuVHJ0UXFBQmVaT0ZJRHVq\nZ09ScWpxaXl0Y2ZJZnpkVk9HSE1FKzAKLS0tIHA4YWJ2Um1QeUNlaFhuQksxQ25I\nM0VSbmlLVktWYW9aWmcyS3U2WnRiTWsKqa31gg1zZ6qTkwTsgmqM/Rbd0PSk44fA\nxVN8wL4dQNM/JvSYLggxV1vPvUW9Y6f+Ch+moFrtcKdOy8NDipNHKQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2022-09-29T11:28:38Z",
+		"mac": "ENC[AES256_GCM,data:SvIBnGuNXzR4ZWlsIJ8e1J5UoYciQ+howQmFFqEDcu/lZupvv3Ns+YZ/J5nm3Zpl0j0YGoAXUBBvENfi4TS38AMqkA0ZxX7fqfd7I9+RgCMaKyo/JGLwO7Ef6+7wvwiNVV4y3OpPkZC8AB7157d4QEczb32X1aQtRdisWQnaBBs=,iv:huJ6Rr8dWW2GiYv06DU133iFUHpxzpzI50QRlFbaeb0=,tag:of3scYamp2AFXN6h/cY1bg==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}

secrets/universal/net/home-bedroom.psk.bin

@@ -0,0 +1,48 @@
+{
+	"data": "ENC[AES256_GCM,data:X5RxPa26vyMk6+z0HB6xwXqTmPeR0MJ6nR5oA4GSEL+s/7SrCn8wWbdaM8iGE2U4ljyC1LJgyd4lZc4r1V/u3Gg5Ynmr3tIRhQ==,iv:rlguW/Aev3Q64lda2bxES7RbZjngVGo8l8CX50nuESQ=,tag:6kqdDV3f7QHiIEif16EEUw==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJZzg4QXpkSExIYUptNkRC\nMGFuNHEzN3drcEZTbEl0alBpS2FDM2ljV0hnClZJMkc5Yko5TTI3Q0twQi9UNE02\nemV5RTNNL3N2S1pOcXVqNGVKWWp5c1kKLS0tIEYrMElhM09zSFdCMnV0SnRBMkQr\nWitjSktQSHJDV2lhajhlaHVXdkYxTkEKPK7SY2zesUHKmLHrt62vFwm8mOZ8n2DY\nb2hZFcA8r2Ozc6+BY62k+rr4PTkE1sTeeTPY4nvL7+k5lvFPqwZ34Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArb2cvN2VaTnMzRW5IWGpU\nRm9KZWVpcXNTZVhGWXpMNmZGNFdCc3dJTDJjClVhcVlhQmpLRmZSRWJEQVJWMVk5\neUdOWEtUZGs2UWRXZXhZTlFPY0swd2MKLS0tIENKKzlEaFB5b1VGbEIrT2RjUzNU\ncHFvbEJ1a2JnZDBmd2llOHptUXBERGsKMzgbI0h4ewsb3dmgXEjqKHLxr0ZzQGiH\nX85GwYTDh/UU8mol5xMHEj//uJnKumCaPdNZeM8uoHOCOnMZcOBj2w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5ZmlYY1p0UE9Oa3BZYldk\nUmpWbVZHWVdtRG1NK2U1eXdjdHYybTdFM0J3CklFdWZBM01BTUY0ZzU0eG9KZjBE\nd3lucWw1aFlhYUJzT3JQK0FOS1o4OWsKLS0tIHV0dVJMdFlVL1BXTkJUWnlDaFlN\nc3QyOC90NmVTTDlEOFZxMUNSWTR4QTAKQ2I2cYMJOzGHaou84UQ8jsEBlcZK+4nS\nVEBkcArZpfxDlYSajr1ZJ9Io5rdFFOs5gEjHh43ScLf88+Qs/QW9TA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzTHRtb1R4QThKd1c3cnZx\nbDFVbzM2azRabEdzZFVQbzlpcGV1U292RlhrCllBWWN3UXc4U3loQUg0M0RUVDlp\nalNFcVg0eUF3Rmc3NVF3UkNRUUF6NnMKLS0tIHV0bzFsUzAyY2Q1WWRIWWhDSnFU\nMGtxT0JmWmUvQnVQOEw5V3ovNGpsUDgKbYso2M273aaZhvlRQuRcGHq/9g3IK1Od\nqBXpSmEzPI033gVo5x0r3ShloXzG5/7j0Oy/JdWQifQZuzhUTYsA5A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxdmFndHY5Y1NnWk9zMys4\ndGw3eXM4UFRNVUZQTkNCdndWSHFxYjFjZnlZClI1ZlBlTlpkREhKOTRXTmJJSHht\ncFhSOEs4aDloVWZ1R241NTJVNnRhV0kKLS0tIGFIbGtSMFVZKzc0MUlIajIyRHI1\ndUs2YUN0Q3pnN0Z0N0ZTcTZidzVobVkKUvE9wpyUnG59isJfoAzrKP+wqIO871XQ\njV27WpKOqwtCq6Jv3Fv43soGITpb6Tylv1pYCBvL83knlGNMzvvZnA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2VG1CeU9WQURrZDIwdXlD\nb05iOGIxNzZTVmZlTGxyZ0pFd1ZhdGU5ZTMwCml5Z2s1aWp5NGJNdFcycmVGR1pK\nN1dwOCtkNHlWbmNGQW80ek9LR2R3YlEKLS0tIDlZRElhMktiUzhKUEQ5Tk0vVU9F\nRGJrZ2IyaGxmOVlEKytSOFlDaThZU3cK9zUGyA+0FDXnh1MhO6oM91DODp0Fpb1M\nGhO0uCxk9k23IumgWvRfE9bwM+bQ0QToBSIxfbdFq1QVdqgz3Z44IQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVS3BiVUdFSTg3UW5nSWQ0\nRWFZQXZMZ1lxN1hPeU1kWng4QU9EVkNhMFNRCkRuSXJBdFo1N1NPdmNCM2VjcHRk\nOEdzTWdDZ1F2clRmTHFqRTRNb3MreHcKLS0tIDJZZDlQdWNSNVJ3SEdWbkVPSnM2\nM2lqMTFmN0VBRHQ3bUNGdDJMSmlBNTgKqVXysfSFxrdMUDVv66JZRPape/M6Im6S\nj1f9VN/ZNrwnRU0ZzPtFWeMyYWIc6c726cweP9xB7ZGoGw2Qfiy8EQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsRk5qdktjQnFJNTgrcUR4\nL0VhcHZCT2VjMDNZeWRSUlZoMXRiY1FEYlVJCjVSK0J4WGFOcUErTE9GWFAzNFNY\ndkIyRXZYVUlHTmJ0L0t5TnIzbS9sYnMKLS0tIFY3NDZBY0IwU2kxSmhvZEJ3Uk5N\ncDdDTVZTWi9pTmR3dkdMVTR3cWRzZ2sKfsRBXdxnjflGnfMexej0rJDRVfnKsPYO\nVGHcl26QJ+7aF3eVhiNmReuQn0i8mqbrcNMKSp+XXLiFyfu89IfoIA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2022-09-29T11:29:10Z",
+		"mac": "ENC[AES256_GCM,data:DPQZVQfAh002aE2X/qgVTuQoWD3AkcbxNU8NAuVY5sgPFhoLtjbm0vNtN0ql2h1HUVENS+BpNsHpLQej7musTL+mJ9KSlHtoUfK0sY56Gx/B0OxMzHF8EHQyYmM/IOtWLuzzMYpFVM2gCeQWgHYZo0W7zNDwZaBVLTAyWN1lAhI=,iv:bTdE+Hma+IIzwy3vMhYW8Rc3sfDkQamW1QQK+bBzELE=,tag:Zd56FoS15pmuoNhCvjckwQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}

secrets/universal/net/home-shared-24G.psk.bin

@@ -0,0 +1,48 @@
+{
+	"data": "ENC[AES256_GCM,data:ZYCyNfJdnYij3ZPNftCq+shfLs1Du/WjRyXMnphEltKr1MRr+f5RY++na3VVtREHYq/NMFNHMjlkcsBREt8KrPOlk5CUh4oNfwrFLsvDN9mJmW7mw0h0Nl0kxwPMI+SRHh1cKsmSjDYWBQ7pLKXbDfv46wyrFKT1v2mI5OiFjWNtL/Gtq8xeA9XQPN9plkqKc1oaazT4TsBgV0kqBlsH7cWuI2l8A7dLpKGqf+fhQ0xvdCo76WcvYuphgE2Wru8xWALPx+OttRTLc2nLHX0=,iv:A7+QdWvSRVRIWf+yW9QgVXQjVY47F2Jj2FqcYbqkz+I=,tag:cU+6Kc2LC/30c2hNv2GVgw==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2d1JLZkNZeHBFNGVTalk4\nNkRDYytGUXFYQVNSNWlOV0ttYTgzZ0lQZ1VBClZKaTVadjFlVnJPRWZXWm5hdjJh\nTGgyNG9sd2hha242dzZ3dkRPYklVQU0KLS0tIDZzNGpTMFZKMzJYeUpnV0NqSjI1\nRm4rY2ZVZ29UdFhXZEZUWENVNkFCYVEKbmeZAn5yA6N8WrftBqpnfdtA1UHFyT4s\nTjQ4uDBGBNAYZzG3X1Dj/W9BBOqT/ErOVKcgeP/oSTsno4kjCnW4kw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOWTRwazVzRTVuUkFRQmdy\nNmpMeHdxQk9WeEg1SHJxMncxT3l0SnBqUzJZClpoN1RLdlVBRmNWMTRSOUNOY1E1\nOEJEYWdta285czhCRTJ5cCsvY2NrT00KLS0tIEVIMFE3aEFWb2VHc3pXNjQzSE14\nQUhjTTBURVBGYW5PSGh0QUdnd3R6SXMKqyBEOod76LFDheCl5FHlj8eqBEW6b5AT\nDkc83TH9DRm9g7Y3sgVBJAm1mPOhTlnAQuYvd70P3t2Joj33yO4AyQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoRFF5WTk1blRQWHdjbnRt\ncVFLZGlyWkdTSzNrb1k5ZTdWRm5xN3ExdUJJCng4ejdIZytsSzBaZmxsRUlwNEZW\nVnJoZlMySnVFUWFsZnRTWDF2V3pSREEKLS0tIFRuM28raTJkaENneDJFQVpxNGNx\nY0tiY0NpS05XTXpVdzJJMHJaRHg4UzQK/YPArPdC8KwdAz4lui6zhhjbJJNWgp3X\n/CfdVr405/xuNJxnshVr81a/wEog5HmuosAGEy60d/mFh4gs2BTmjg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJNGp4NDlaR2E5WXFJWTJ4\nN2cwS3Q1cjJSaU1aQ2k1VGpFTlRxN09YNkNJCjdGL2dGcHZzS0lxMzF3UXBMbXg3\nVjVrS295ekExb056cHZ1UVVvZThjd1UKLS0tIGZsRkR0TXlEaHpST1dMZHE3UWNX\nZGpGOEE0WnB3MlZISzdWVGMxclZkdDAKSo5iN8AuUYGgmCIMx89ou9muZkW71FRb\noX4Zkht/v9RtxKp0TGjujQeXnjC1iT97wFdR0iNTWjxLyUl9TtkIXg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwaTNhdmhSSXFrcWhUMkQv\nSlByVkh1akw2RU1rSEkzdjJ4bUp5Wnpjd0VFCkJIZmJZZEdXNEtkaWw1OWM5OXdn\nWHV5NE9JNnc3QXpyay9mOVN3QXNrcU0KLS0tIDRMOFpTL0JuNWlUWUNwTDNjNEVy\nNnZQVUVlQmRyaE11eU5KZUw4azlTRXcK50EEoR+iOQmgMNNI79bVd02UkOr8hEDL\n1KTy4s3MErfv8kGH8du12iNvCPRNYOulyk/CQEkYaUksP59g6k7mgQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRZ3VNcmJ2T2dzaUNGU2FY\nZGcvUHI2OHdrNTNad2Zoc1ZtUk5HNzV4ckY4Cm5YSzdRWDdXRUdFOXBqZGE2YkZE\nS0ROVDJFL3ZOWEZBM3FUME1tdm45U0UKLS0tIC9xNDRTdTJFcURPT3RvQ1J0MDZ1\nRnllMVdiNmU4ZDRLclZVL1lubGp1aXMKskqFVf8FPrBOaW9GPfm2gLnE5Zyq7Dq2\ntBGN6U4wXivLdC10e6BO4MrGjyCIeiuOJyE5f3XpkQ6RqkGl4P/P0A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrdU82c0EwSUR2aFJYMVhS\nZ2c0WkJOUzJjb1Q2N1BZakdZZnhyQWdERVdvClJmMkREQlROZi9TdVhGR1lndUhi\na1FOSFdjWmdybHRVaDFFTDlIN21GTzgKLS0tIHFKK2VUUjIyRExwUDFGUjkreVhh\nSjdGcGpUU1NFRXRHcFNXSEJuS0gyMmcK6oMgKmwsstDNCyoVuhXU9z257+a5Hs4e\n9NsiKSd6BJVtfUBrBOAgRlkij9/x/zC5BvTd3tCNqNL0HUWxhdXPyw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHVTQyV0o3eWtQTEsxTXNZ\ndGJjcjQwWjA2QXFubmJSdGwyRHliRmtQSW1VCmh1K2l0NnVmNUlMUjdmd09IeG5a\nTVgvOWh1RWZZZnB1RkNHMjVSMG1pVG8KLS0tIElNbk53dnJxRE90WHZSbFVYRVAr\nNjcraVhhWVdpTDZJOG9uaUVmWFF2T00KGyNISTg/g7v1+VFlCg0MjDTjbcahdSQk\nQpxdjvqQ3qtcfOS/+OO5CZYEJIVp6YybXyHJ4SSbaED22YtTJGmRNw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2022-10-08T03:30:39Z",
+		"mac": "ENC[AES256_GCM,data:0qrOFciOrb0Q0ZaaYbjKMOJwaZxsOiodPJomWVliVt7OFmxIdBorE/SGgtgQGQz6twJqeSCJi9NiEFWTfnitO0NH//jaMFiAZVGBbk3r8YrZ4UyzhQsEYCED036y0cIU31qxX2DbwNBA2R69mJqzCcTgpZORVsKOoyANp+HDhzc=,iv:B7Uopjj6jS4rIYZ0uHU6nfBMBvHUJkg6CCBZIQZNaYU=,tag:Qdi1bHKpp80XhniokLHLJw==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}

secrets/universal/net/home-shared.psk.bin

@@ -0,0 +1,48 @@
+{
+	"data": "ENC[AES256_GCM,data:ou55VGY+beKMouNj4qQaBOAZK/5UKu6A521lNW2i0KlSmgJ8qQ501lesy0bEmDkZqqhluP8XE5FZLwEXvqqMh/TBuN1OkCsQis53/M1s0g==,iv:Ir5uD1P8OlHlcjGCHVkUHr0AjoXzd7kOcAeajo66hUE=,tag:m+rReK9o/8TG4LBkNN1ZZQ==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvNzNHZWcvTmVVaGFabUU3\ndnZwVFdVcFBXZkoxTFA5WEZMMnRvUDBsS1NrCnRKUTNDZExFL1drSjBTakw1VmZW\nYWJzTUtVN0lrWXdiRk9QaVNmZmRqSjAKLS0tIGtHTzNUUnlnU2duNDF6UUlzUUJa\nSXhxQmRXZEZKK2htenF6N1kzV1VvancKP8jZotJe9188kId6cwVzITNwtELegpzi\nOKrWPWuIveSdMGmMsRDAcQbL0xVN0qd+Y4qsZ9l6e+cVAT3cHb1vDg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLemhLZUwzSVJLNUhYQXQ3\nY3ExU1BJUzY4a24vUjRmazhtc1RIcVpyem1jCmFEVzlIZkxjSUc0RTdqQWRLTGNS\nL3FaRFhjdnZqNFk0WDFSY0xOTENxMkEKLS0tIDVzK1lPM1FlWmZLZFA0ZDlPKzla\naXRqTk90aVNTRHlNZ2FmcVY3b1JKbEkKTu8tiEKyab1bOsgdsRlEWeG9wzdg/d/s\nPfh7rnvf7Ex8Jl6qSq6xMPkv+19EbSpfSq0FRtCue/Wcce3cUmGToA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyZUY4OW5UNXFjOXQrUklu\nK3poU3RNVnBtc251TmRtMGJ6Z0ordDFhUGhjCms2a1o1Z1plNlpwSlYrUEEzRDZm\naHdEVVIzRnExNVhzci8vN0ZIODh3QzgKLS0tIGUxZ2gvbGM3YnMwVXU1RnNOSlBO\nVE94UFdKaDkwbmV5YjlBWm9ZZkk4Q0UK6CaPAtRrXKUzR29ZfXV8MvqszTu8LkT2\nQPlNJ4ckgTyivyseukR8X5fPKrrXIVtE+C6Xk5mJ6nGKD+oLprhpag==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUUk1yL3dLUnBpNWNxMzQw\ncDdVa0szNjBVNnNXdmZwNVNEK1RwUzJTMlhZCm9oV3NaZ3k0SERKMEZCQTRtRUI2\nVmdzWndQT1c4UUh2MzQyMEErdm96NG8KLS0tIG1aUElzK2VjUTNYOGRpbkpZTDVz\ncG9jR0VzNi9jYmdCTU1qMmJtNFNUaU0KkrIx2BKjj7l+52Kk/L8rNZYAsa87z9UH\nDtxhLTnQu8DPtm5o2sbGdEZgt9qKPJiylLNKVne3EyscMaehdB17RA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUSUtONWlzZ0JQbDB0L1FU\nWlhCL0p4d3lpamg3YWdIUVhDc1hVRWR1MVhFCkdZbEhnUG0vYTJVZnphdTZNSXBW\nVGdpemc5Q3hSenN4V09ZbTFOK3kzK0UKLS0tIG9ZWkdSMHhzTGJleFF5L2RsdUxK\nSEdtSlB0L2d4TTVWcDJWaE13NjFiTkkKWgfem58/ZKqVaXiL0UGVTjA7AhSkD8Fq\ne/i5HKN1Pvgv8TVPnZ9mtGP2gwwkoFYgxM8/0jBjJUm4QDbTkocVJw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNR05jQnJZZDNndmZnOVNO\nRFhVU3pLUzBxeC9rQlRoVWFCN1Y0bjhBM25VCmJKSzhkMjF1L3pGRjZmOURNeUZE\nTU8vN2pYVmZzdWdpaVdqcXloNGhTSlUKLS0tIGovSG84amhyTFZHZ2FNdTl3SzJj\nN1dObkd6K2J0Y2Q5bG5DR0VaUk1uSlUKxShDW7BD6sENlFjqp7/wFbV4g4gD7u5d\npidF9F+vXhpoBIwLlhruzvwyNXG4hQcKfWCnliXhVvNYbgaooDDhRw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1MkJ1RkVBeHJnR1FGeDVi\nN0htdHZ3cVNCcTJabnlkSUQ4aHUxRndvbVhZClk2d2ZRTlJIVTg1T3dkKzdMRXJt\nNXh5OWtud3gvNWNkRWI1UE1kSytYOUUKLS0tIHhhQVpmRWtTYVFjSUN5aEVYWDJx\nS3hDMlFkVGQyM2U5QjlJMko4OGRWdkEKG98s0QVSs1o4MQ9937okXDS4WH41S1Aq\nUSL8idmlPUJzgdHshuLv2Ic2RXVjJu8V508trO8bTymrqkNAQ0miMA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAraXJQOHR6ZzE5TjNQYmpB\nSStEQS9mcUpMSXlFQ05DcllFSjNOT1pWdVJZCmtSL3FkZ2Q1cU1Fc1dZbG13eXJC\nTXJkN0NzWTlDOEFMRGNQUG5HQUNUVDgKLS0tIGRwcmVxS0lNQ09GdmxKY2pkQ2Yz\nSkpZam1ZQUN1L1FZZ010ZlhUV1N4VlkKqsFAE+xZ24IMzIFjbsgANdjiGwVZk5rq\n66y00bjw+uj6WOwQuE1I9WcYDhCXEUQB9u4Q+hzejaFzCJ90N/WF4w==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2022-10-08T03:39:12Z",
+		"mac": "ENC[AES256_GCM,data:4Rr2iqmzLtE9i45Hn10wuf8unKt+YNAYTF3RWwEW1AjN+pF7ZvwMbrUutRCb6uMxCQUyNl+adfFRu8Xae0/SqFBfdAPxzeQZGrBjb384seLrNS0XyUacfdoSCczrRUF8+F3mIHetaJCd2jOpoh5HotoSN3fx+nZNhD+56XmJBr0=,iv:YlDMimhG+a9Wzq0ZN0tnZ1gH69e7olyHGWhIV2/4K64=,tag:GjVzbNa/NdzVmdPyE5etXw==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}

secrets/universal/net/iphone.psk.bin

@@ -0,0 +1,48 @@
+{
+	"data": "ENC[AES256_GCM,data:XGhxqtkmLOKQqcdmJvQ9rKdUW0qassF2glLvUpAs6uyO6WHVKvXKhAIJIsZZbd1RRlJ5PuwBvu7lKIrcVIswKvwF/MhXTCqfoB0fpmysaCpKdkLYojiSvsHQAXB9gIAnL0dVIEvZ+s7MRG5wp8s2+y18JsgS8jBM0vMFoLxVF41isocMcxO0a1wnCjAWy2s0845OOjhVSNCuVSjI5Oc1dTO9vycDHV4Y6MulFoBSlwfJdUf2nVR/FNuCxyxFX//wgRuN3cg1zkmoBblnvkccMGIzkmuByUAlqdaaug/Q,iv:9HIUqe5dTjVrHM5a9IrpYLtsDpg3Ts3mX9H8M8M572o=,tag:2EK0Zj6DTM/QmbVL+lG8wg==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1tnl4jfgacwkargzeqnhzernw29xx8mkv73xh6ufdyde6q7859slsnzf24x",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqWUdWVkN2UGNBUzBqV0hK\nb0hnc1YxZWoyYkNIOVhreHlzOUJKVEdjdVJJCnRVSXYzWkl5ZktHdnJqTjIyUE9O\nQ2Jya0NuLzlDWDVoR3JTQVB3STJYSk0KLS0tIHllNisyMmJSNTBsZU85U0FuRWpU\ncnEvdGVhZlBXMjIzVUV3YTdQOXJjcE0Km66SgSPKbEC5bkCZI7l00QuPvgAH8kuD\no0A9w/lRBgcP787lqyUwULA+gu4YwvNIupvuABXm9KaFHtVqYDVJJw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1j2pqnl8j0krdzk6npe93s4nnqrzwx978qrc0u570gzlamqpnje9sc8le2g",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsMXJYUytzRFVMYjNyZ0ZM\nb3dsVjV6blJ0K0JmcU1QYjNVY1JvSXQzTFQ0ClI5SG1tOTFYOWxuMWF3bFNxaWxL\nRDBiR2FZMVdOOVhoc1Via2xRd0t6SlkKLS0tIGUrRGZCZmxwOVl5dnVqVzJSdDNU\nUWE1VnkzSjJJZU9aOVdETklRa3VyeDgKqQpyc7UR7ValJuTD+NKIUSjKHNNAkPsS\nEgqI8DxjCvaSERKOYH/6pMSdRGklzS0ECuW5TNm0d4BvlbaFEiozlg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1z8fauff34cdecr6sjkre260luzxcca05kpcwvhx988d306tpcejsp63znu",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHWVRINUFUa1lqZHZybHR5\nWmRuYmQyUTB5Z1RPaXJNc3VMUkFQZmhGMGhrCklaa3ZaNVYxYlAzaWsxRXN3c2E4\nNnB5S3VXa01ZdExzazRFcnRmdmNaQncKLS0tIEFpTksxUkVrMldSbDdPcXFMbnhB\nUGJyOVB5TFI3TU5hRXdKK25ORzIrUlUKjDGNOoLb7N+UKCEOwMXWklyQt0xapeMr\nKDFMcuxTX7WouiCF+GCXegQYfsXLsrETbbz+L6BOsV6O4uNNtYMZNA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1zsrsvd7j6l62fjxpfd2qnhqlk8wk4p8r0dtxpe4sdgnh2474095qdu7xj9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5dnFSRVlvc293MWJlTC9k\nMGtLVmNlbWlXZVczdDlnQVhXTDJjZHE1U2tzClFucGhya1M1SFpheFVEM3JmWDlG\nSzZCd1JwalNYVVZqQWdKVWNhRDUwbE0KLS0tIGtpd3huNUtld0V0SzBJK0FXMkxC\nT3VJckV3aHFMc3c0K1V6S1d0NitNaVEKe73p65j2fb4Hd7TLJqiX6NUyKbv7K2te\nNzPxOZQCBrSogqbnT2qDt5Yptr2nk5qK4CkoELw1/Iha8xLg96qcRA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1vnw7lnfpdpjn62l3u5nyv5xt2c965k96p98kc43mcnyzpetrts9q54mc9v",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrSmJGNTNpTS9QKzc0dUNt\ndGxxbnY3eTYzc1lPcXRrdjBJdlZwNm50R0hNCjE0OWdDdEdvb0ZMNlA3SkZERWhs\ndk5FMTdQc3VUTUgwQ0t5NTVZZWEzc1UKLS0tIEJNNjVrN0h2Qjl5UVh3KzRVNzBR\ndS9nL2U3T2l4MG5XNndjYkg3WnQ3cHMKUcW4kwhoqw/2VRO+qD65Hy789fppwpLg\n7PZ2YZTa/OWufYweYQnSDCtRC1dCdtOUE3mhjtBsGaqKp0pOzOmNwg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1w7mectcjku6x3sd8plm8wkn2qfrhv9n6zhzlf329e2r2uycgke8qkf9dyn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4SElrMkprWXk3OUExaGEz\nQXBOM0Z1cHQzUUd3Q2ZWWC92bVJ0dmtSNGtnCk04d2E1NDkyUDhFNW5tSUtGMFQy\nMkMxR3p0QVNCUSs5UkE2Rjg1cStmc1kKLS0tIEhTS3hUcTNlT0lxRmdlK0VRSzNP\nUllGcHJ1TkpHTGVyaXFEUmhoZURVVlUKidC2z1cN6iwswN5+FKYEXSpif82MW5oC\nR1axSWsIJc7P2hPf4ua5BVoDqEn/Vei92NOcbQNfYUtEdkCGFbkYzw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1tzlyex2z6t88tg9h82943e39shxhmqeyr7ywhlwpdjmyqsndv3qq27x0rf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVNjN1cHhtYUlOQngzYjhH\nUEZzbTVwT3dSalJBQlc1b2ZBRmwwSHoyZURNCjd4WllKSTE0OElFSGd3K1dzR2oz\ncWprejcrOUJuOVZWdDBkMXNVejJsaFkKLS0tIHkvNHZ0SVdnOUlTTnBvdVZLcUFp\nNTlXSlU0UGh6NFZUYUIraEpSRTJVaGsKb85V2N1dgP65R/xdjq7vEKO+b9NdJ9D+\nh7pVfx9ghSKdmcADWxyRhpmjc7Yyfx5wzpWbuV0mAibPLS9RdLry5Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age18vq5ktwgeaysucvw9t67drqmg5zd5c5k3le34yqxckkfj7wqdqgsd4ejmt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtYlJWZ2t6WDlRdUJqU2pG\nYkE3T005bUhCcUJ0TEw0MEdDY1JFUzJjcVMwCkhCckRzcldLWTJPSEVjbHk3VE1p\nY21rRWR3cUVscmNiL29NL3M1QjZsYlUKLS0tIDJ4M3JtdGFRbUhFR2FtSGVuZk9n\nL1VjS1hnbzZwT1lQalJBbFU0SjFOWkUKUkGyPmpilSZdupNlR+cD4+HUOwyNm8WF\nu3vS7Ec4FJcjnx2t185yXEStZSVGptw/wKTxJiJ5P9by75XkAJZFmg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2022-10-09T02:24:20Z",
+		"mac": "ENC[AES256_GCM,data:AIRI5vLpVvWuxjvPerwzsBnwsSPrtazgCMPjP2be5aUcglT9e+98Dlg+jX60XjiO/1DvEepoCLd5Xnr6GHOkgRRR90YPsZT9eRttwhBavXaOF2Da7zwP5ZOg3cO0JGQsegTxJYFMmROCZppybL6EOsT2n18pc2M2HdEBt5oKP2k=,iv:ive5dqvbBQ3Ef5ycZP+l1Vuc38ylFTJhGh5+ksMCyAc=,tag:OP9EgZN2q2OKPRpOv2x7Tg==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}