karitham.dev
nix all the things
pds on reg
+245
-30
+10
.sops.yaml
+10
.sops.yaml
···
1
+
# https://github.com/Mic92/sops-nix
2
+
keys:
3
+
- &ozen age17cxj5zwkkxjkjvmpskpkyh6yt4xj4l8h6jyjxez3nmq6y9tvhqjsdp0m5j
4
+
- &server_reg age1j6j2ldpsj7jmchstwl3nktvatut9hzxnemmy6py84rrga5eaf93q5w8s39
5
+
creation_rules:
6
+
- path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
7
+
key_groups:
8
+
- age:
9
+
- *ozen
10
+
- *server_reg
+24
-3
flake.lock
+24
-3
flake.lock
···
592
592
"niri": "niri",
593
593
"nixos-wsl": "nixos-wsl",
594
594
"nixpkgs": "nixpkgs_7",
595
+
"sops-nix": "sops-nix",
595
596
"ssh-keys": "ssh-keys",
596
597
"stable": "stable",
597
598
"starship-jj": "starship-jj",
···
678
679
"original": {
679
680
"owner": "oxalica",
680
681
"repo": "rust-overlay",
682
+
"type": "github"
683
+
}
684
+
},
685
+
"sops-nix": {
686
+
"inputs": {
687
+
"nixpkgs": [
688
+
"nixpkgs"
689
+
]
690
+
},
691
+
"locked": {
692
+
"lastModified": 1760998189,
693
+
"narHash": "sha256-ee2e1/AeGL5X8oy/HXsZQvZnae6XfEVdstGopKucYLY=",
694
+
"owner": "Mic92",
695
+
"repo": "sops-nix",
696
+
"rev": "5a7d18b5c55642df5c432aadb757140edfeb70b3",
697
+
"type": "github"
698
+
},
699
+
"original": {
700
+
"owner": "Mic92",
701
+
"repo": "sops-nix",
681
702
"type": "github"
682
703
}
683
704
},
···
809
830
"tree-sitter-nu": {
810
831
"flake": false,
811
832
"locked": {
812
-
"lastModified": 1761142283,
813
-
"narHash": "sha256-OSazwPrUD7kWz/oVeStnnXEJiDDmI7itiDPmg062Kl8=",
833
+
"lastModified": 1761314688,
834
+
"narHash": "sha256-WY1qZbRLLTKNcyt7eQTzoQ2YKwyWSuUpVdt3YST6yx8=",
814
835
"owner": "nushell",
815
836
"repo": "tree-sitter-nu",
816
-
"rev": "18b7f951e0c511f854685dfcc9f6a34981101dd6",
837
+
"rev": "47d4b4f5369c0cae866724758ae88ef07e10e4f1",
817
838
"type": "github"
818
839
},
819
840
"original": {
+5
-1
flake.nix
+5
-1
flake.nix
···
2
2
inputs = {
3
3
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
4
4
stable.url = "github:NixOS/nixpkgs/nixos-25.05";
5
-
6
5
home-manager = {
7
6
url = "github:nix-community/home-manager";
8
7
inputs.nixpkgs.follows = "nixpkgs";
···
45
44
topiary-nushell = {
46
45
url = "github:blindFS/topiary-nushell";
47
46
flake = false;
47
+
};
48
+
49
+
sops-nix = {
50
+
url = "github:Mic92/sops-nix";
51
+
inputs.nixpkgs.follows = "nixpkgs";
48
52
};
49
53
};
50
54
outputs = inputs @ {
+9
-26
hosts/reg/default.nix
+9
-26
hosts/reg/default.nix
···
4
4
username,
5
5
...
6
6
}: {
7
-
imports = [./hardware.nix];
7
+
imports = [
8
+
inputs.sops-nix.nixosModules.sops
9
+
./hardware.nix
10
+
./pds.nix
11
+
./pds-backup.nix
12
+
];
8
13
9
14
boot.tmp.cleanOnBoot = true;
10
15
zramSwap.enable = true;
16
+
sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
11
17
services = {
12
18
tailscale.enable = true;
13
19
tailscale.useRoutingFeatures = "server";
···
17
23
enable = true;
18
24
host = "0.0.0.0";
19
25
};
20
-
21
-
writefreely = {
22
-
enable = true;
23
-
host = "notes.0xf.fr";
24
-
nginx.enable = true;
25
-
acme.enable = true;
26
-
settings = {
27
-
server.port = 3003;
28
-
app.host = "https://notes.0xf.fr";
29
-
app.site_name = "writefreely";
30
-
app.site_description = "writefreely";
31
-
app.single_user = true;
32
-
};
33
-
};
34
-
};
35
-
36
-
networking.firewall.allowedTCPPorts = [80 443];
37
-
38
-
security.acme = {
39
-
defaults.email = "netop@0xf.fr";
40
-
acceptTerms = true;
41
26
};
42
27
43
28
users.users = {
44
29
${username}.openssh.authorizedKeys.keyFiles = [inputs.ssh-keys];
45
30
};
46
31
47
-
environment.systemPackages = with pkgs; [helix writefreely];
32
+
environment.systemPackages = with pkgs; [helix];
48
33
server = true;
49
34
50
-
system = {
51
-
stateVersion = "25.05";
52
-
};
35
+
system.stateVersion = "25.05";
53
36
}
+109
hosts/reg/pds-backup.nix
+109
hosts/reg/pds-backup.nix
···
1
+
{
2
+
config,
3
+
pkgs,
4
+
...
5
+
}: let
6
+
restoreScript = pkgs.writeShellScriptBin "pds-restore" ''
7
+
set -e
8
+
9
+
echo "Starting PDS restore..."
10
+
11
+
set -a
12
+
source ${config.sops.secrets.s3.path}
13
+
set +a
14
+
15
+
LATEST=$(${pkgs.awscli2}/bin/aws s3 ls s3://$S3_BUCKET/backups/ | sort | tail -1 | awk '{print $4}')
16
+
[ -z "$LATEST" ] && echo "No backups found." && exit 1
17
+
18
+
echo "Latest backup: $LATEST"
19
+
${pkgs.awscli2}/bin/aws s3 cp s3://$S3_BUCKET/backups/$LATEST /tmp/$LATEST
20
+
21
+
systemctl stop bluesky-pds
22
+
rm -rf /var/lib/pds/*
23
+
24
+
${pkgs.gnutar}/bin/tar -xzf /tmp/$LATEST -C /var/lib/pds
25
+
chown -R pds:pds /var/lib/pds
26
+
27
+
systemctl start bluesky-pds
28
+
29
+
echo "Restore completed."
30
+
'';
31
+
backupScript = pkgs.writeShellScript "pds-backup-script" ''
32
+
SOURCE_DIR="$PDS_DATA_DIR"
33
+
S3_BUCKET="$S3_BUCKET"
34
+
LOG_DIR="/var/log/pds-backup"
35
+
DATE_LABEL=$(date +"%Y%m%d-%H%M")
36
+
LOG_FILE="$LOG_DIR/$DATE_LABEL.log"
37
+
ARCHIVE_FILE="/tmp/pds-backup-$DATE_LABEL.tar.gz"
38
+
MAX_RETRIES=3
39
+
RETRY_INTERVAL=60
40
+
41
+
fail() {
42
+
echo "$(date): ERROR: $1" | tee -a "$LOG_FILE"
43
+
systemctl restart "$PDS_SERVICE" 2>/dev/null || echo "$(date): WARNING: Failed to restart PDS service after failure." >> "$LOG_FILE"
44
+
exit 1
45
+
}
46
+
47
+
mkdir -p "$LOG_DIR"
48
+
49
+
systemctl list-units --full -all | grep -Fq "$PDS_SERVICE.service" || fail "PDS service not found."
50
+
51
+
systemctl stop "$PDS_SERVICE" 2>/dev/null && echo "$(date): Stopped PDS service." >> "$LOG_FILE" || echo "$(date): Failed to stop PDS service." >> "$LOG_FILE"
52
+
53
+
[ -d "$SOURCE_DIR" ] || fail "Source directory $SOURCE_DIR does not exist."
54
+
"$TAR_CMD" -czf "$ARCHIVE_FILE" -C "$SOURCE_DIR" . 2>> "$LOG_FILE" || fail "Failed to create archive."
55
+
56
+
attempt=1
57
+
while [ $attempt -le $MAX_RETRIES ]; do
58
+
if "$AWS_CMD" s3 cp "$ARCHIVE_FILE" "s3://$S3_BUCKET/backups/$DATE_LABEL.tar.gz" 2>> "$LOG_FILE"; then
59
+
echo "$(date): Upload successful." >> "$LOG_FILE"
60
+
break
61
+
else
62
+
[ $attempt -lt $MAX_RETRIES ] && sleep $RETRY_INTERVAL || fail "Upload failed after retries."
63
+
fi
64
+
((attempt++))
65
+
done
66
+
67
+
rm -f "$ARCHIVE_FILE"
68
+
69
+
systemctl start "$PDS_SERVICE" 2>/dev/null || fail "Failed to start PDS service."
70
+
71
+
find "$LOG_DIR" -name "*.log" -mtime +90 -delete
72
+
[ $(find "$LOG_FILE" -mtime +30) ] && mv "$LOG_FILE" "$LOG_FILE.old" && touch "$LOG_FILE"
73
+
[ $(wc -l < "$LOG_FILE") -gt 1000 ] && mv "$LOG_FILE" "$LOG_FILE.old" && touch "$LOG_FILE"
74
+
75
+
echo "$(date): Backup completed." >> "$LOG_FILE"
76
+
'';
77
+
in {
78
+
sops.secrets.s3 = {
79
+
format = "dotenv";
80
+
sopsFile = ../../secrets/pds-backup-s3.env;
81
+
};
82
+
83
+
environment.systemPackages = [restoreScript];
84
+
85
+
systemd.services.pds-backup = {
86
+
description = "Backup PDS data to S3";
87
+
path = [pkgs.awscli2 pkgs.coreutils pkgs.gnutar pkgs.gzip];
88
+
serviceConfig = {
89
+
ExecStart = "${backupScript}";
90
+
Environment = [
91
+
"PDS_DATA_DIR=${config.services.bluesky-pds.settings.PDS_DATA_DIRECTORY}"
92
+
"PDS_SERVICE=bluesky-pds"
93
+
"TAR_CMD=${pkgs.gnutar}/bin/tar"
94
+
"AWS_CMD=${pkgs.awscli2}/bin/aws"
95
+
];
96
+
EnvironmentFile = [config.sops.secrets.s3.path];
97
+
User = "root";
98
+
Type = "oneshot";
99
+
};
100
+
};
101
+
102
+
systemd.timers.pds-backup = {
103
+
wantedBy = ["timers.target"];
104
+
timerConfig = {
105
+
OnCalendar = "daily";
106
+
Persistent = true;
107
+
};
108
+
};
109
+
}
+54
hosts/reg/pds.nix
+54
hosts/reg/pds.nix
···
1
+
{config, ...}: {
2
+
sops = {
3
+
secrets.pds = {
4
+
format = "dotenv";
5
+
sopsFile = ../../secrets/pds.env;
6
+
restartUnits = ["bluesky-pds.service"];
7
+
};
8
+
secrets.cloudflare-api = {
9
+
format = "dotenv";
10
+
sopsFile = ../../secrets/cloudflare-api.env;
11
+
};
12
+
};
13
+
14
+
services.bluesky-pds = {
15
+
enable = true;
16
+
settings = {
17
+
PDS_HOSTNAME = "0xf.fr";
18
+
};
19
+
environmentFiles = [config.sops.secrets.pds.path];
20
+
};
21
+
22
+
networking.firewall.allowedTCPPorts = [80 443];
23
+
24
+
security.acme = {
25
+
defaults.email = "netop@0xf.fr";
26
+
acceptTerms = true;
27
+
28
+
certs."0xf.fr" = {
29
+
dnsProvider = "cloudflare";
30
+
credentialsFile = config.sops.secrets.cloudflare-api.path;
31
+
group = config.services.nginx.group;
32
+
33
+
domain = "0xf.fr";
34
+
extraDomainNames = ["*.0xf.fr"];
35
+
reloadServices = ["nginx"];
36
+
};
37
+
};
38
+
39
+
services.nginx = let
40
+
pass = {
41
+
useACMEHost = "0xf.fr";
42
+
forceSSL = true;
43
+
locations."/" = {
44
+
proxyPass = "http://127.0.0.1:${builtins.toString config.services.bluesky-pds.settings.PDS_PORT}";
45
+
proxyWebsockets = true;
46
+
};
47
+
};
48
+
in {
49
+
enable = true;
50
+
recommendedProxySettings = true;
51
+
recommendedTlsSettings = true;
52
+
virtualHosts."~(.*)\\.0xf\\.fr$" = pass;
53
+
};
54
+
}
+9
secrets/cloudflare-api.env
+9
secrets/cloudflare-api.env
···
1
+
CLOUDFLARE_DNS_API_TOKEN=ENC[AES256_GCM,data:+fg0tls3FnG8BsKs5Btl7CLJiTlKqhvI97y8NNttEODb3wcCnAikeQ==,iv:KvAw3rwYNnMrMBz45NYDs9Fmncn1zlllK40rphGA1Z0=,tag:UOPjy4YFKnmPx4Wao6O8kA==,type:str]
2
+
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4VkhkMExId0IrSllMcGdw\nZEJsWkpBYkN5ejRnVDNpUGlYK1NQN0cyRWxjClR0dDBOM1N3NytMeGljdFV0bGdB\nSkxDT3JHcllFMGJKdnUya0VXQVdqN1EKLS0tIE1XWDE0OUcvdDJwdjV5WTVUcXYr\nTkdLb09yNlMrUVBwTmNkUkJaSThVNTgKqJatfgKN9WVeN9zlUClFWq5hBfiAlfvC\nwOLPxrc/VzNeUYlP5kLpuhGtsLAhHii21r0dawZlekKFoMXaPleDLw==\n-----END AGE ENCRYPTED FILE-----\n
3
+
sops_age__list_0__map_recipient=age17cxj5zwkkxjkjvmpskpkyh6yt4xj4l8h6jyjxez3nmq6y9tvhqjsdp0m5j
4
+
sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4OVhveExOajZRWFBicWpI\nMG80aEdvV3cyNGI4Q2lTZmxKOTBaT2ZvU0RRCnYwWFZ1T0QxY09ESEhmVDMxUHBB\nbmZwSWpNK0dGc1dGNlp1SWwwQVJDbGsKLS0tIEdseUJUZlhkbks2TWRVVkd6TFo5\ncGhnV2I5Q1NvYkFGbTkydVRHQm5ZTUkKBECA5NN+Gw8UBMvbdZ0Ky/LNDRCqcVYd\nQHEZgfhJh3PWcbfHGhZIl9ylYdcpv9LQ+3NZRr2VgRzL5TT1mpeGgA==\n-----END AGE ENCRYPTED FILE-----\n
5
+
sops_age__list_1__map_recipient=age1j6j2ldpsj7jmchstwl3nktvatut9hzxnemmy6py84rrga5eaf93q5w8s39
6
+
sops_lastmodified=2025-10-24T20:43:23Z
7
+
sops_mac=ENC[AES256_GCM,data:/+KeoI3T69vXm+duvhViX1a58LHmFxRXHLacpmpHZ+bDzp+8e26uPZ0hX00XqIQWv3xgez62r/LphaJmjvNoUhGe9lI12QjUpRtilAbDXLUpJVF2bYaQh08SdGcey4OhaTj7oITBMP+V2EVlhOx/T5/qfrWCZqkef4OKqSBBD7g=,iv:gWqyF7cQel9NtIEMYWGZ4vBDKWVwKbJpDTQVu9nb/Do=,tag:c+gT0jxGfhhSHRqr6YOv/g==,type:str]
8
+
sops_unencrypted_suffix=_unencrypted
9
+
sops_version=3.11.0
+12
secrets/pds-backup-s3.env
+12
secrets/pds-backup-s3.env
···
1
+
AWS_ACCESS_KEY_ID=ENC[AES256_GCM,data:5oKU0U+FeR666BTNL7gdb8Wnts/nvhCYDlGtetcq+Dc=,iv:i3i4ykyAR3tpfpDoke6renys9tZp/a6/JpRe7ajAnsg=,tag:S3yDGCIl+wG9tedXbcPbmw==,type:str]
2
+
AWS_SECRET_ACCESS_KEY=ENC[AES256_GCM,data:3UEACvF1q20QRdSxVcTrMJNsjZmSsGHmX0fq98KMvnJJffjYO6h+ClNT+38aDhgh8Dd2VRujYMVTI6RXPn28DQ==,iv:bBEs9lMhDMoeH3HymUQEOT8Y13457xcrevKI89nXBeg=,tag:eSekCTOKUu2u1S7/Mcy9sg==,type:str]
3
+
AWS_ENDPOINT_URL=ENC[AES256_GCM,data:bqp2c1pPg1ZWG2w8XF9dm+3wKMYFucxzNLmvlhoKYuIxJX5CZwUSrmDXsx4FXZtq0l2fIWUIMCRurE49Jq8QtL8M6GQ=,iv:j4uL5y6E3qd6KS7DALc/GdL2/HgpheQj2J/uuLZ7XZU=,tag:dWVbavob4IC02bY+EqfYGA==,type:str]
4
+
S3_BUCKET=ENC[AES256_GCM,data:1q3k8mjG6kM=,iv:3nktB4AvrGmH6MfIijV3mPajO9088UWfuBOeM99hwCQ=,tag:cfLCokyYHWqvtCeokIGrtg==,type:str]
5
+
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2SkJUdWdYclR0U1pPUHpn\nc3pWSml5b3FOR3cvaVhNczJrbHA4NG83U1JZClVibTgyc3JBWC9LSXVJVmhZckxT\nSk1sN040MmRKd3BodUdFOVRxMTdGcUEKLS0tIHhjZUs5TXhhMm1nK3RQc3BJMTJG\nZmQ5cGlRbXNiczBwUnd1aTFaWk94bUkKjQEr03lQRuWxzQ6uTCRgpTj3C/FwBFwz\nQoYYAyqN5RBAJvN+7TFewgGgSBu+bE2RFazAxOizdXQXAmgceZnT5A==\n-----END AGE ENCRYPTED FILE-----\n
6
+
sops_age__list_0__map_recipient=age17cxj5zwkkxjkjvmpskpkyh6yt4xj4l8h6jyjxez3nmq6y9tvhqjsdp0m5j
7
+
sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpdEo3Nlp6RmgvZER2ZWtS\nU2dFazU0Q2FndnZBL1g2Ky9lcjNKRDBoaGlBCmlIVG9iUXVmazkzb2NTeDhXKzhT\nc3JQZjhhb0h3VjI2b2tpcGxiVG9NQmMKLS0tIG9tTjlPLzVQSjRLSkw2djM5QzQ2\nenJ6RFJUazlmQStJRStudlhuV1Rsc1UKMaAFJszBkgONafeLGMYO1zzS+dHzX3Uh\n8wwni17QDZTTE5Q2P8KPBquVWyzh7UUI3GhbxuZhANfs/RA5AQlg2w==\n-----END AGE ENCRYPTED FILE-----\n
8
+
sops_age__list_1__map_recipient=age1j6j2ldpsj7jmchstwl3nktvatut9hzxnemmy6py84rrga5eaf93q5w8s39
9
+
sops_lastmodified=2025-10-24T22:20:59Z
10
+
sops_mac=ENC[AES256_GCM,data:h7telhUinjAmbijnepEv3NXjvtYuCvQzCfQ6PA5vqr9QY8kAUlqICLofOP9+SVocUR0LlXsoKfmLcdIMMpZG1Jb6D0PQ8RuG4sTm5BSrWvvPj+U/Cm8JuPAqtOie0vWPBsL8vHg9BQGrUWEVtiK9fBLVmEvafVj9mmKzbwBZNOg=,iv:hzi5UOVUAdQW2wY8fAxLysfaLUertVLYo1D4H9Ubz+4=,tag:fRB9Lerke0aDkmcu+OzIfw==,type:str]
11
+
sops_unencrypted_suffix=_unencrypted
12
+
sops_version=3.11.0
+13
secrets/pds.env
+13
secrets/pds.env
···
1
+
PDS_JWT_SECRET=ENC[AES256_GCM,data:7rkOzDdKVBgBIBDperVfo1lv39/TD5LrXeSto4+FT8s=,iv:eFUiIdDH5xxFxIxq4njilmTframihV99CYZQiKt9Wto=,tag:fHPsW6hudDKjhPnKHems0Q==,type:str]
2
+
PDS_ADMIN_PASSWORD=ENC[AES256_GCM,data:GHtiwkT7SMqTDP91CpsdBvakeg==,iv:ka8bXoFJL23P3TDkXON1yuF6z1NOfFjRRaGv5L2wAB4=,tag:FriN0YZAgAE/S5nwcMoGng==,type:str]
3
+
PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=ENC[AES256_GCM,data:OjAyEohVNTmWKapzJX1e/ed6ZbWL3I5+SgM93Bm89qymJWGX90ssca+fAcny38g2sZJkiJWjfUulE5sTMAbGog==,iv:vquXtXGhDMEFNJ6tqE76HTv1PZtGjtIL3+K05eY7KxE=,tag:sVDuGtkxfYL6csJ4d80+dQ==,type:str]
4
+
PDS_EMAIL_SMTP_URL=ENC[AES256_GCM,data:u2ylh4YK4aR5WhOFTazwLk3i2CU71Yakcb3pyoc2D+i94KMX0xEWKLb0xKpBnKyVBEI9CLMpiLUOPR1CuJRVv/aOR4yBIA==,iv:/NuzdQxYq0r4z9iTLGRi4aa/qBxFp0NeyNIOxIoEjbY=,tag:3dhfx9BbMdTahW02mYwKjA==,type:str]
5
+
PDS_EMAIL_FROM_ADDRESS=ENC[AES256_GCM,data:Xqly+3nqg8VpOQ==,iv:Dx0YD81azbMt2iT6EaqmJRXCXxhycM/pyW9eFH1cHGE=,tag:zi6bE3BNu443IFaTZDe3Wg==,type:str]
6
+
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwS0dHSU9pd2tWVzZPZDlQ\nYVd6NjF0SkFrSGNUUUprUGN0c1Yzdk5BYXpZCnBiajU0cGVDQ0UwUVl6dHg5SjFO\nU3RScFhiTlZuYUJ6aC84K1F6YnEza2cKLS0tIDNFZ21BdHRTQTFGMkR3MDBxOHhG\nOVByYktJdjlsbTlNSDMvOTkvK0FyeU0KYBMndJPeIMpnqSrAUs0Em5Pbm7GBo/0e\nsaBKyYhn/pIPtJCyOiISqfXwMFHsiWCtd3dEejunG0x9eEkjWzDKqw==\n-----END AGE ENCRYPTED FILE-----\n
7
+
sops_age__list_0__map_recipient=age17cxj5zwkkxjkjvmpskpkyh6yt4xj4l8h6jyjxez3nmq6y9tvhqjsdp0m5j
8
+
sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2WW9pWHVZSWl4eWdCUGUv\nT3VSdVVPdVh0bENRanFjNnJVdlhQS2JvbzNRCmY2YnZmVlNhSDFYZ2VDWnN1MHp5\nS3lyMEpOa0hmTVdFeUtIQ1lrMWZVODgKLS0tIC93Q2hzb0pxdUNySEYwa1VyUjFN\nNk9tekkvUC9JT3NpcENqTHF5TUIyWXMKJ082QrvQ6QRfJ1RZqL9sSyKCmTLi+I9R\nxuo8E1SfP/204OQaihP6+9cCbLh3yYtESaAFw2Alisnoe4PvSR2I9g==\n-----END AGE ENCRYPTED FILE-----\n
9
+
sops_age__list_1__map_recipient=age1j6j2ldpsj7jmchstwl3nktvatut9hzxnemmy6py84rrga5eaf93q5w8s39
10
+
sops_lastmodified=2025-10-24T21:30:51Z
11
+
sops_mac=ENC[AES256_GCM,data:T7pttRlFl7HQwRY+AAXIX00wsABEyiHJsKPxXatl50Auaa+S3JJss56tVhphp2iMch7Z0nxnVT9kS03eAU1RUV0wHgCyu0QWNAib7PbUQIQvVq7pqF8SXORNuvwHJj2S9niASIDQqIenLYzUCRyq6tBnJ/XkW9JbiaOxs6w75G4=,iv:nvo7iAVjYkN45RZsqV3nGWzoaPcg74NRdhzy44lIi+Y=,tag:nIPrJy1srFn/nFTRjtdLbg==,type:str]
12
+
sops_unencrypted_suffix=_unencrypted
13
+
sops_version=3.11.0