ft: sops-nix + secrets

.sops.yaml

@@ -0,0 +1,7 @@
+keys:
+  - &nixbook age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5
+creation_rules:
+  - path_regex: secrets/.*\.bin$
+    key_groups:
+      - age:
+          - *nixbook

README.md

@@ -3,7 +3,6 @@
 NixOS configuration for my three main machines (nixbook, nixpad, tuxcomp).
 
 
-<!-- TODO: rewrite rest of this file  -->
 ## Layout
 
 | Path | Contents |
@@ -45,12 +44,3 @@ To add a machine, give it a key before its first boot with
 `mkdir -p -m 700 ~/.config/sops/age && age-keygen -o ~/.config/sops/age/keys.txt`,
 put the public key this prints in `.sops.yaml`, and run `sops updatekeys` on
 every `.bin` from a machine that can already decrypt them.
-
-`thunderbird-creds.bin` isn't text: it's a tarball of Thunderbird's
-`logins.json` and `key4.db`, and it only seeds profiles that have no
-`logins.json` yet. To update it, change the password in Thunderbird, close
-Thunderbird, and update the tarball:
-
-```sh
-tar -C ~/.thunderbird/main -cf - logins.json key4.db | sops encrypt --filename-override secrets/thunderbird-creds.bin --output secrets/thunderbird-creds.bin /dev/stdin
-```

hosts/nixbook/default.nix

@@ -22,34 +22,4 @@
 
   # explicitly override videoDrivers (nvidia doesnt like us on nixbook )
   services.xserver.videoDrivers = lib.mkForce [ "intel" ];
-
-  # BELOW IS OLD!! remove as we make more modular
-  # TODO: move certs to secrets, make this a module not a host based thing
-  # custom certificates
-  # security.pki.certificateFiles = [
-  #   ./certs/npm-caddy-private.crt
-  #   ./certs/npm-caddy-public.crt
-  #   ./certs/npm-caddy-shared.crt
-  # ];
-
-  # TODO: move to secrets
-  # tunnel
-  networking.wg-quick.interfaces = {
-    npm = {
-      address = [ "10.8.0.3/32" ];
-      privateKeyFile = "/root/wireguard-keys/npm";
-      peers = [
-        {
-          publicKey = "YlQfDLqOET0RCTfbeRTDUicF/RA6dic/ThHLy25w4nQ=";
-          presharedKeyFile = "/root/wireguard-keys/npm_preshared";
-          allowedIPs = [
-            "10.9.11.0/24"
-            "10.8.0.0/24"
-          ];
-          endpoint = "wg-easy.u.djairo.dev:51820";
-          persistentKeepalive = 25;
-        }
-      ];
-    };
-  };
 }

hosts/nixbook/wireguard.nix

@@ -0,0 +1,8 @@
+{ ... }:
+
+{
+  networking.wg-quick.interfaces.npm = {
+    configFile = config.sops.secrets."wg-config-nixbook".path;
+    autostart = true;
+  };
+}

modules/certificates.nix

@@ -0,0 +1,9 @@
+{ config, ... }:
+
+{
+  security.pki.certificateFiles = [
+    config.sops.secrets."npm-certificate-private".path
+    config.sops.secrets."npm-certificate-shared".path
+    config.sops.secrets."npm-certificate-public".path
+  ];
+}

modules/default.nix

@@ -1,9 +1,10 @@
 {
   imports = [
-    # ../secrets # TODO: uncomment
+    ../secrets 
     ./apps.nix
     ./audio
     ./base.nix
+    ./certificates.nix
     ./desktop
     ./dev.nix
     ./email.nix

modules/email.nix

@@ -3,84 +3,3 @@
 {
   programs.thunderbird.enable = true;
 }
-
-# TODO: use thunderbird seeding config
-
-# Thunderbird with all mail accounts declared. Thunderbird can't read passwords
-# from a command, so its credential store (logins.json + key4.db) is kept in
-# sops and copied into a fresh profile once. The Microsoft 365 account still
-# needs its OAuth consent once per machine.
-
-# let
-#   realName = "Djai Hougee";
-#   profile = "/home/djai/.thunderbird/main";
-#
-#   # without this thunderbird picks OAuth2 for gmail.com accounts, but these need app passwords
-#   passwordAuth = id: {
-#     "mail.server.server_${id}.authMethod" = 3;
-#     "mail.smtpserver.smtp_${id}.authMethod" = 3;
-#   };
-#
-#   oauthAuth = id: {
-#     "mail.server.server_${id}.authMethod" = 10;
-#     "mail.smtpserver.smtp_${id}.authMethod" = 10;
-#   };
-#
-#   account = flavor: address: auth: {
-#     inherit flavor address realName;
-#     userName = address;
-#     thunderbird = {
-#       enable = true;
-#       settings = auth;
-#     };
-#   };
-# in
-# {
-#   # Only seeds a profile that has no logins.json yet, so the live store (with
-#   # Thunderbird's own token refreshes) is never overwritten.
-#   systemd.services.thunderbird-seed-creds = {
-#     description = "Seed Thunderbird credential store from sops (first run only)";
-#     wantedBy = [ "multi-user.target" ];
-#     after = [
-#       "sops-install-secrets.service"
-#       "home-manager-djai.service"
-#     ];
-#     serviceConfig = {
-#       Type = "oneshot";
-#       User = "djai";
-#       RemainAfterExit = true;
-#     };
-#     script = ''
-#       set -eu
-#       secret="${config.sops.secrets."thunderbird-creds".path}"
-#       if [ ! -d "${profile}" ]; then
-#         echo "profile ${profile} not present yet; skipping seed"
-#         exit 0
-#       fi
-#       if [ -e "${profile}/logins.json" ]; then
-#         echo "logins.json already present; leaving live store untouched"
-#         exit 0
-#       fi
-#       if [ ! -r "$secret" ]; then
-#         echo "secret $secret not readable; skipping"
-#         exit 0
-#       fi
-#       ${pkgs.gnutar}/bin/tar -C "${profile}" -xf "$secret"
-#       echo "seeded Thunderbird credential store into ${profile}"
-#     '';
-#   };
-#
-#   home-manager.users.djai = {
-#     programs.thunderbird = {
-#       enable = true;
-#       profiles.main.isDefault = true;
-#     };
-#
-#     accounts.email.accounts = {
-#       djai = account "kolabnow.com" "ljxjah@mykolab.com" passwordAuth // {
-#         primary = true;
-#       };
-#       uni = account "gmail.com" "d.hougee@student.rug.nl" oauthAuth;
-#     };
-#   };
-# }

secrets/default.nix

@@ -0,0 +1,48 @@
+# All sops secrets are edclared here (ssot).
+# Each secret is a file stored in this directory as binary files (edit with `sops edit <filename>`)
+let
+  # make secrets readable by our processes
+  djaiOnly = {
+    format = "binary";
+    owner = "djai";
+    mode = "0400";
+  };
+in
+{
+  # machine's age key, also used by `sops edit`.  
+  sops.age.keyFile = "/home/djai/.config/sops/age/keys.txt";
+  # gotta make these lists empty or sops-nix will try to import our ssh keys 
+  sops.age.sshKeyPaths = [ ];
+  sops.gnupg.sshKeyPaths = [ ];
+
+  sops.secrets = {
+    # ssh config (exposes hostnames/ips/ports)
+    "ssh-config" = djaiOnly // {
+      sopsFile = ./ssh-config.bin; # TODO: actually use this
+    };
+
+    # npm caddy certificates
+    "npm-certificate-private" = djaiOnly // {
+      sopsFile = ./npm-certificate-private.bin;
+    };
+    "npm-certificate-shared" = djaiOnly // {
+      sopsFile = ./npm-certificate-shared.bin;
+    };
+    "npm-certificate-public" = djaiOnly // {
+      sopsFile = ./npm-certificate-public.bin;
+    };
+
+    # wireguard tunnels
+    "wg-config-nixbook" = djaiOnly // {
+      sopsFile = ./wg-config-nixbook.bin;
+    };
+    "wg-config-tuxcomp" = djaiOnly // {
+      sopsFile = ./wg-config-tuxcomp.bin;
+    };
+
+    # thunderbird's logins.json + key4.db as a tarball, seeded on fresh hosts.
+    "thunderbird-creds" = djaiOnly // {
+      sopsFile = ./thunderbird-creds.bin;
+    };
+  };
+}

secrets/npm-certificate-private.bin

@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:qGohcsnq4S1YGThawZO6USuV5p1lGRMFZ/b44C/7uFMSM/K7DH4vmZMngt47BKVRXzKD8axa/t7wLp3py1lVG50/RQf6OTfE+JXEn3KOPb+Hw2YBn+IAbPU/zlxarBS5LjvLowmvZoGnU3SK5kZZnT7V9sGmEUEL8DRzhFBCQXMB8XV0cMxT6Z6+OoMTTIFD7mbXo1IkHumZ8CcWo2FVeLiiOpgs00L88PaxkwRgmxumgB7jJl9/xk6zlBsS2Wl4KCsC9tAvvPlvt9rFztC6GC/q/6xHksCsYNa8cU+vWlKYpoNtQFCrdPqmpDIeSygXxjm3gHRDJm/4BgrzC/MUGMXX360Uoq32nlToRAWK1xVVxUGQ+xZMZrnluRkJUYujQcevHBAIFgSnjMpGvksmbUX4QxKW1pqIUzy0Q7e3qcSFmHJD7yYmVVBx7V4RksCE7lSvQD2H6jrCFPJGsKIhu/dAgQzotKKgfotjCi7vqTt6ZF/skpQVLl0PewglQ+aQTFcuqWovk7K2oPW7WfGfeVWygWCtMJ1Rbu5BJARZXH9bHk0qnl6ptcSdZpbJGtmKtFwNVY2zxIHIhg+wastquDytSry92ILM5W31hYuk2eyxA1fZvkfPQuhkRknaKQqlKFSVG1EFu4giclJHRx+DMEhSCqzgMBRG5I1SpzGL04BZNgsD2ZdFlwwJQm8g/+vi0ngAApFXL5UHl7+K388BE79niN/e8brHszURu6GqWWnJYPh+lVXpZEq6EiEAMjrtirYMalJHgGUM8wONy1KUFiPIoP99Z/I0xYfS+XKwxEYpW57uvJe8WswNlT2xWa20yycwChvV/u0=,iv:hX9+zPsymhI8DySZV9TMnrsWZBmtEF6LvyxWQ2cuPuA=,tag:Cyyv3oPaN/NIIm5zb6F9iw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVUEpIWXRvTStYdVBzN205\nSFBGVkc4SS9GWnpiSlJSSGhXZ0tRUkxDMGlrClM4SE96SHVYOTgwVnNyZTlqSlpI\nckdoeFNESXRQMkk4ekRHY0U3b2R1b2cKLS0tIDNZdTZIcDJMdEVsNTlrSWU0azB1\nNkVnR3puQVpHKy81NGNWZkVBVUN5Y1kKRGiETG0GLigaBxGoY1NxHLgg4erj/uBM\nSlyLHOU9eq7z47EqHQ7W3qOwTvM4dW1k2MkpepxoGXRqs5FqI3FH1Q==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5"
+			}
+		],
+		"lastmodified": "2026-09-27T19:51:40Z",
+		"mac": "ENC[AES256_GCM,data:VAcgp/EqsghoMyGhkMujPtGFfLy9dswbEEzsNZPS53Q0azQH+xy9aDYjn4r3+y/VI9ogQIUIRijDTRVMhcyFbewEHLJSM8CqtZOL7N4eSOxQ3ayq06E1UIXlVVTIH+ss0VZJXDLnQyd/gZnGDxYneuUsJqfTFDFNpLKOf6pv7IU=,iv:aokwJDSRaDQVIsEh12SMhXfMsARX3xytkVU2Ff4+SKM=,tag:vCdsAQ6Cf6Lbd5XkiIZyhg==,type:str]",
+		"version": "3.13.3"
+	}
+}

secrets/npm-certificate-public.bin

@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:FyRde2ms6MPYsUQZ0fplSyeQsJBVAFCc0hdAO52DFRRcRUyUtjcdJ0b/X7iHGttvF7pu1CJ4dTYo3YMYmYvPG16GiRR9NnyHxhoSWQUuPJ0YhS/l/8m0t3pksFBHGPv02yLzCR4YMa4kxPprol8IEws+hg10wVOIBK4obWovA6u76TWf/TTugxbzCohrP2kwLmY9grXEvI5c5LPdVh8lwRUWGHmIGfEK8q7o3LVUipj/phapcCFu1urOpCTamTBqmQrWRP4chONuf7WK3EzcsKm9vZpe+YP5zoMa8biuhcuoMdqINM3ZlspAXVQvMdPXqvFkgrhLB1K5kDC6eaPQL6oUBxzxFsBagOBHJpNSsZ5aydBabCbn/UeufBjyEFDkYYWLE3UYXB3aI+NDac4aS1a4cLY2hybAzSz8tu9XZ7Le+zpsZYifFQqbdBYMSUKv+INZAGNkLXwkfeful3GKFDnGo4+EZGSxbXOUosjCBpc8md4o0OUYQv3H6A5OCOEDQck9WSO9PzQSWkM8l5mmch2vaz9FcTc+RTDMfYGeoLHkfHeYx9pjRcjd97bOjFnUHdgPNzrjcOdUZ5TYndxRklyvSSWylkpSRP+IjCfIGKmVkQkVulJ1bEr/JqCDb5MNwIVj11ugmE1LqydflrzjQ+AR0PiVpIQeBbd/zo10UKxBNq3ozvEixYeGg8N74eNnXEBXlk0efnV18VwZ5V2zKUm0IHkCui2YiBRX9YCOvXi5y7VdLf32za1gvKIpgAJfLuI7KpzPuqwcHbtKQfas/e+BN27SQFriViGu+gtoWkjVABqC5p3S9/nTqcC4opYMMKwKoRj7Xiw=,iv:CWrpdT7KYoLZ9Eh7WUeb1fT2pwDUjnYIMHGS3tqIXSU=,tag:Z/PdZLpvIym7pb5ActewhA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEY3JlOXk4Y0FXZkE4Vk4z\nV0ZxZDk0Z0hEMlFsR0ErMkhxQ0d2VGc0S0NVCkNWR28rd2VPbkdmMXcxSE9Scklt\nZUNQZ2NYT3ZpUHM4UWxrYUZoVkNXdncKLS0tIE1XczdiemdlVW9seDJKMTYwMHla\nUjdsSk1YeDdmTkc3ZnlYd2JSbzZyTkUKw7XRqJkaiywps4wAiMAzFtvZW58MQUH7\n3Ckhk3syc2tgCWRjPU3mkxKbDhg/IjnZFc+IJdqfSxnmHvQRHprc0A==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5"
+			}
+		],
+		"lastmodified": "2026-09-27T19:52:00Z",
+		"mac": "ENC[AES256_GCM,data:vyoVS5zuO8xzg8WpLZ16CAi0nIfFDRgC0jCArHzpdZgBSqZ9oYKXcn0mF7V3N5ipUa3jwShNRCxCiuHdpFOSW9xYah3m6gusSYia6y3cLQH3pXd1+K4UXi13EYIqSmj7Kg3rw0TcXmTA7BouWl0pVZK3dRZogtdDjFZycKderKs=,iv:JSN+RKXuSagkgl57++FwxkAFrTrV911RWDe6bMAvah4=,tag:Q1OkVROXTnGU5pUIv2Ws3Q==,type:str]",
+		"version": "3.13.3"
+	}
+}

secrets/npm-certificate-shared.bin

@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:5H1G+TdTbbCOI2pe/SFsj19forEa0VNpGsdkDPRP8D1hoXDCechA5plZbXm8PdoGoEk5iZCzjPppIpJ6D0Y+QDf4fmUubnSXWPYJyLpxuO9QC4a0f2BBKO5MPveGXtLwsoclo44zBuzE5GqlUobNd7x612wYOXv3cmDEwHoAi3xAq/ny9emg+sZGr+dj6tXVil2GK4isRV93UC8FfiWlPC4aitJFFR3ikNuUam7UDwugjzV7W4b6zrFzFUzzlMT/z2XoV71VfGmVDonC+/M0fCODKEHXPMpSm9EJ1eMgYfWheB489y35jAvAFKVH9qAUwsEh24pCnkeaJES4aYStSaWgdQzpZ3PSbCLprxgENVA61uSYzDTxZXB/q+YSm9c4E4MnSUbiE7YATcN7iN8nRQANPlg0gOK3GutkWWM2072mDlqyBwYPY9PyUBA7X7YPY8ZKXZFkKOu2pvCgFXUESdf5TZzSpMecV1KDXEtvcUQyQn8VnP4giOsU9/3TE0wqB5emtmqwbJPfsQEwMuJZO9MVdHe6rvSBtuuMerQSJOT11vsZi2QYNwkaHuV7ezYQAEq1oGrEcg34RqY+4gPupFFDtvwYcUZCM95e3oJrvtg603OS+H+1Ff/grFAtE1BF3sxc9ap/U8XvOJGLNn09NWjE/On3LIwp4MdQi8JfTdYPeG5qhGHO1mWtRyhgVzP0vxkqzhybS5nFuUbDpAXmrmNN5GcAVMg7SgF2qaGwwIa8ARKu6KPT9A1etgLX6OX5ai9+5bQU+Wh1Vau3ZEwqMb3WY6/IqJ2LWccKKwt8zJrSfPg40aHovHWgDo4tC2c6B3Xjeg==,iv:Hg3U4qFWvRkGDMLyL6sP+7KlL0msJMqIfKgp6DhoSLg=,tag:tUS4freYJNuOtE+63koqZQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6bzdpZm9vZU12bjZ6dnJK\nR0h3M3hMMlNteUtmdktpalZvMExZZXBwMFZzCnZqbm9JNDgyalZORHN3Slp4OUpi\nMnRYVm9KRjFKYjJlSXdKbUVuT0o5a0kKLS0tIEFxNW1NSm9NaTVJRC94WnNvTkww\nZnV0SzNqT0g0Qms4WHdVQWY1akVuM00Kag5BlPZX197XU+FiSE7pjfLxJJjaAF79\nWO+YuaVOWgX6e5/FRt+34HE07XoYlO3dIN2FyZOA+Fg2EftksY+BZg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5"
+			}
+		],
+		"lastmodified": "2026-09-27T19:51:50Z",
+		"mac": "ENC[AES256_GCM,data:zHhYw6nyXhwE+yBwVAo2RhTKDQkM5zBr0eXXt/KhnKsOoQoa7lJdnv0eOtrb8WWm4TivkoFoW7hFPRzLSN/XsY+3Ocz2ojhlZXTQtPxQjlfiLR8pEV9JJ6P53WZLr7hZMobJCHAIi6PlJf7tHoYTs9UeO0v7BCtxV/WYMAJYQvo=,iv:Htg1o3BX13AbH+P2gJR1/mHff6CSp6NVrFi612i29zU=,tag:k/LmBy7jnlN2NEQerj2SKg==,type:str]",
+		"version": "3.13.3"
+	}
+}

secrets/ssh-config.bin

@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:vEAyc4eVrWusSNtrmqUlDg7ybFCVVOsnLBNSlQXUHGaYp622Jtnlvrw=,iv:kWxgJhWGF3kI5p0D+n5b9QMc1EXKJ8y5ZLwIRbcrFVk=,tag:wGmFdL1s1pkXp8TN/+w27Q==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDMmRDUTBGdHFuckdqZnNj\ncGtmeko0bi9mU3FUVEJqaHVVc0cwaUZuUHdJCmRPdGFWUVFpczBlVzJ1dm10ajNt\nL21LZE45aDllQzJzY21yRHNpbU1SSkUKLS0tIGtwOVkzV2NvRE1LelhFaGl6b24v\ncFlyM0dRVlhHL1QvZGpIVXc5a1lZM2sK7Yeh16J6CoT+Tn8OMEMbA+rfSlsGrQco\nHdjWc09pq6os9WN/gxa5gq+T4UsnolOB/adLCOWUtWIb3lxXpv0FGA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5"
+			}
+		],
+		"lastmodified": "2026-09-27T20:04:33Z",
+		"mac": "ENC[AES256_GCM,data:CC/TS4vliSrRmRnyNCaig/GO0pRQIUQUa9PIR8v1XOr0DtKE+0ozxptBIsg/gSWayrGvVJf2fIM0gD/iU1LHeeWplqD10kSLI/XtqVzT0oLC8H86PEc3BQo2L5WTv64XuTygXiU8MrgjiK3dFL21kIxKTllbhhd8Z3ULTE6rbk0=,iv:AY9h2Ihh6XaIGl7iyAgtMELV9woT3REg62CBBPKTkD4=,tag:bii6YbVjOtB8iUrkj6kALQ==,type:str]",
+		"version": "3.13.3"
+	}
+}

secrets/wg-config-nixbook.bin

@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:uu+owewHj4IqtZie9lgEWeuDfMv6/fbLkd6Ff8GMPOuQkbnTSzNl7t2UEx9s6znapWlfsNMHRp4wHEzVM6IemPa7fSyi5GUrHx6YN1eUXb8o8sH8cXYhLs02eObtEtY81aJsNpyyU1aStxa/E9HZvm4oLv3Us8Hv32vJAXF3UyyFde/pdT3oO9XJlKsYcRPa+p0MjZ28g3IwT9SPVtCCEvtqxiTR0eICGH6kK8X4F8jvpSmqxkAbdfF83JW1H3ibaDOfDIXgZtSqOtByO7PiE1eqBYU161jwgeQIxInhtVL3WS6mGx+sCp9YHOhORlChr4ZmPF7Ypkn+vpZ8qWDRBq8aJTT29GC7GDvCN6FiB/s83mruodRFTwT3/Rbf12xqRk5xNm29WMzSua6juvQLjOexCulWnunh4Su1SGrdbxjSjSJ0VNsFQCwx,iv:Tv/DlMJ9pJgFQQJn9IRo3mmK+qjXuIhRTEwVzLlWKPQ=,tag:ZSEfapTOm5wMlJzHpy5qjA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiV3V6Uy9kcmo1N3NCTWpu\nQWRJTHlEM1hWNGlLSzk5MzlOc0c1ODZFYkRzClhLaEJtU3Z3aktod1lleFdLeFRZ\nWnNCWS93b3VoOFVWcXEyNHBEaXB3Wm8KLS0tIDJNVUVueXMzMU9kTjRubVpnRkkx\neVVFM2RPLzFabC9iVHozU0pXTkpZMVUK9l8dsll0BPwwx2vDcvNTiClp35p6g7+v\nlvdjAu7SscfS0OYWidr0ade/MhjBvrKSxjnbPXh994HXjwGotYZJHg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5"
+			}
+		],
+		"lastmodified": "2026-09-27T19:54:01Z",
+		"mac": "ENC[AES256_GCM,data:LA/dh+KhuOmopCuvvYXuY4MKEctXdEy2DeZbWEVed5d58d4Rh3iS/oWLVXbfL6ff4e4cF4lKwXpvSatxrUY7ZKlM2nbD9EgqZMFuaEOqM2CeKKBIkGe5YE2OuS9tyhNOzVYYKMGL2fJVjqH2GXoVdmcCrB1elXTZ31sEV7OuQbA=,iv:KTQU8WOswO3wCUfvgPJFR00u9yUp+VaKfw0Wop3h/2A=,tag:S82Uj2aRXwTNNnAwMvRuBQ==,type:str]",
+		"version": "3.13.3"
+	}
+}

secrets/wg-config-tuxcomp.bin

@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:kWithuLuVPw4zPHoB3QmBgycNNDoq+IlIvx4Xv+Y6N7Dyp+LoRophEm9B7mnIEYxRPA+L07vAKHkfr5gRK6nvsapNo2Ckp5iVKVr6M0eCbfbO/2QvXwRa4URmLYe6OSlTGAxBIw1kcaTpjzD18kj5rMfVoPq1pDR7Yt2kOzoz46AZWXmZmckOuEhum7FIYt++yL0dviKhSrZ36V6j2irQ9MdjmzIvoxysWyTSXjNXVPHEvCAa5Gi/EIeap8odnWnJzJiv2ARVZ154D8T8PWIRb7sbOgbNPeo9BDwB5d7RyhSXPlwA8hgPPggIoaVbTRtM5InxshfmsYWFUEApqemcPJWq9jYkmXaiAoQldVpM2/1eWKhpdsou39yYu4dpnnm1vtxKAPh7+NbJUP83gRzxKAlT8aTV3Sp/ydQua4Xc01gpVwZCqwvqxsX,iv:VjFrf0UXiWIFvQirwTjqSk7YHE9wj0LY26yNx8+8QGs=,tag:CqIsdFVQIw5atl+wAPu7bA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTbkZMc2c5YTNRV0VrZ2hn\ncElRaXlvMUl1NnZlOXB1bnJtTFEwc01CZ3hFClNPOXM0K1plaktqcDVhMjk4VnFP\nckphazRXSWtZcWxEbDR3NVlmUmJjUncKLS0tIGxoSGRDRVNqQ2QrNHFJeitHQjZW\nem9iNjcrb2VYc3ZQNEl1VDRRWFc2YjgKs40DWyILQgObJaKCDHBtBEwLt36sPrZ+\nBdVfZVXjNQD+2FwJNtaEhlsbKEJj0/XYvaE07xS8X3UeEelEvCvUeA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1x7rkj5gpqe9rgp6wjs24r68u5vlg0628qafvdvwczm2gy27uup0q66vkv5"
+			}
+		],
+		"lastmodified": "2026-09-27T19:54:24Z",
+		"mac": "ENC[AES256_GCM,data:xrl/yr7Uy3NPLhZzZRcslQGuZYY5ZTK7W4pYTt3XK5hmd4PWpg5Yvwl8WB3OZVC4D6dbJy8Cs8pC1ZpfUT6aoYETfMPYKjTrIUC4HsKN6YC8W1vKrqYkIHXWdcCNbDpQ/8rC/reFRW1Z4id616RI2m4lVQe5EOr8fexCSr6qyNk=,iv:aqecolbcJYfgY1arN+8p0bYo6hDpyrccSF91njPsVRE=,tag:AdmsE6avWbsYX1RmTZazhA==,type:str]",
+		"version": "3.13.3"
+	}
+}