Cleanup xnet module and add baseline modules

With these changes, the xnet module is useable as a system builder. At
this point, it is still undecided whether all configuration will be
generalized into this module, rather than keeping mini-modules local to
the machine they will run on.

16 files changed, 337 insertions, 317 deletions

diff --git a/modules/xnet/default.nix b/modules/xnet/default.nix
index 87d17e7..6cb2e5e 100644
--- a/modules/xnet/default.nix
+++ b/modules/xnet/default.nix
@@ -4,11 +4,13 @@ let
 in
 {
   imports = [
-    ./disk
+    ./disk.nix
+    ./users.nix
+    ./nginx.nix
     ./net
     ./desktop
+    ./gitserver
     # ./monitoring
-    # ./users
   ];
 
   i18n.defaultLocale = mkDefault "en_US.UTF-8";
@@ -29,4 +31,9 @@ in
     doc.enable = mkDefault false;
     info.enable = mkDefault false;
   };
+
+  security.sudo = {
+    execWheelOnly = true;
+    extraConfig = "Defaults lecture = never";
+  };
 }
diff --git a/modules/xnet/desktop/default.nix b/modules/xnet/desktop/default.nix
index f919798..2eeb272 100644
--- a/modules/xnet/desktop/default.nix
+++ b/modules/xnet/desktop/default.nix
@@ -32,18 +32,20 @@ in
       extraPackages = with pkgs; [
         foot
         fuzzel
-        grim
+        imv
         mako
-        pwvucontrol
+        mpv
         playerctl
         pop-icon-theme
         pwvucontrol
-        slurp
         sway-contrib.grimshot
         swayidle
         swaylock
+        tigervnc
         waybar
         wl-clipboard
+        xwayland
+        zathura
       ];
       extraSessionCommands = ''
         export MOZ_ENABLE_WAYLAND=1
diff --git a/modules/xnet/disk/default.nix b/modules/xnet/disk.nix
index aca6ae2..caef61d 100644
--- a/modules/xnet/disk/default.nix
+++ b/modules/xnet/disk.nix
@@ -15,7 +15,6 @@ let
 in
 {
   imports = [
-    ./boot.nix
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
@@ -28,10 +27,8 @@ in
 
     device = mkOption {
       type = types.str;
-      description = "Underlying device that build the root ZFS pool.";
+      description = "Device used for zroot ZFS pool.";
     };
-
-    extraDatasets = mkOption { };
   };
 
   config = mkIf cfg.enable {
@@ -43,15 +40,57 @@ in
       trim.enable = true;
     };
 
+    # With root running in memory, swap should be required unless
+    # otherwise specified
     zramSwap.enable = mkDefault true;
 
     boot = {
       kernelParams = [ "nohibernate" "elevator=none" ];
       supportedFilesystems = [ "vfat" "zfs" ];
       zfs.devNodes = "/dev/disk/by-partuuid";
+      loader = {
+        systemd-boot.enable = true;
+        efi.canTouchEfiVariables = true;
+      };
+      initrd = {
+        systemd.enable = true;
+        availableKernelModules = [
+          "xhci_pci"
+          "ahci"
+          "nvme"
+          "usb_storage"
+          "sd_mod"
+          "sdhci_pci"
+        ];
+      };
+      tmp.cleanOnBoot = mkDefault true;
     };
 
-    disko.devices = (import ./layouts/single.nix cfg.device) // {
+    disko.devices.disk.main = {
+      type = "disk";
+      device = cfg.device;
+      content = {
+        type = "gpt";
+        partitions.ESP = {
+          size = "1G";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+          };
+        };
+        partitions.ZFS = {
+          size = "100%";
+          content = {
+            type = "zfs";
+            pool = "zroot";
+          };
+        };
+      };
+    };
+
+    disko.devices = {
       nodev."/" = {
         fsType = "tmpfs";
         mountOptions = [ "defaults" "size=2G" "mode=755" ];
@@ -67,13 +106,7 @@ in
         datasets = {
           "local" = {
             type = "zfs_fs";
-            options = commonOpts;
-          };
-
-          "local/reserved" = {
-            type = "zfs_fs";
-            options = {
-              refreservation = "10G";
+            options = commonOpts // {
               mountpoint = "none";
             };
           };
@@ -84,30 +117,23 @@ in
             options.mountpoint = "legacy";
           };
 
-          "local/certs" = {
+          "local/reserved" = {
             type = "zfs_fs";
-            mountpoint = "/certs";
-            options.mountpoint = "legacy";
+            options = {
+              refreservation = "10G";
+              mountpoint = "none";
+            };
           };
 
           "persist" = {
             type = "zfs_fs";
             mountpoint = "/persist";
-            options = { mountpoint = "legacy"; } // commonOpts;
-          };
-
-          "persist/data" = {
-            type = "zfs_fs";
-            mountpoint = "/persist/data";
-            options.mountpoint = "legacy";
+            options = commonOpts // {
+              mountpoint = "legacy";
+            };
           };
-        } // cfg.extraDatasets;
+        };
       };
     };
-
-    users.groups.backup = {
-      members = [ config.services.syncoid.group ];
-      gid = 2001;
-    };
   };
 }
diff --git a/modules/xnet/disk/boot.nix b/modules/xnet/disk/boot.nix
deleted file mode 100644
index 65be2f3..0000000
--- a/modules/xnet/disk/boot.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib) mkDefault;
-in
-{
-  boot = {
-    loader.systemd-boot.enable = true;
-    initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" "sdhci_pci" ];
-    kernelModules = [ "kvm-intel" "kvm-amd" ];
-    swraid.mdadmConf = "MAILADDR = nobody@example.com";
-    tmp.cleanOnBoot = mkDefault true;
-  };
-}
diff --git a/modules/xnet/disk/layouts/mirror.nix b/modules/xnet/disk/layouts/mirror.nix
deleted file mode 100644
index 5a9835b..0000000
--- a/modules/xnet/disk/layouts/mirror.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-devices: {
-  disk = builtins.listToAttrs (map
-    (device: {
-      name = device;
-      value = {
-        type = "disk";
-        device = "/dev/${device}";
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "mdraid";
-                name = "boot";
-              };
-            };
-            ZFS = {
-              size = "100%";
-              content = {
-                type = "zfs";
-                pool = "zroot";
-              };
-            };
-          };
-        };
-      };
-    })
-    devices);
-  mdadm = {
-    boot = {
-      type = "mdadm";
-      level = 1;
-      metadata = "1.0";
-      content = {
-        type = "filesystem";
-        format = "vfat";
-        mountpoint = "/boot";
-      };
-    };
-  };
-}
diff --git a/modules/xnet/disk/layouts/single.nix b/modules/xnet/disk/layouts/single.nix
deleted file mode 100644
index b779a39..0000000
--- a/modules/xnet/disk/layouts/single.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-device: {
-  disk = {
-    "${device}" = {
-      type = "disk";
-      device = "/dev/${device}";
-      content = {
-        type = "gpt";
-        partitions = {
-          ESP = {
-            size = "1G";
-            type = "EF00";
-            content = {
-              type = "filesystem";
-              format = "vfat";
-              mountpoint = "/boot";
-            };
-          };
-          ZFS = {
-            size = "100%";
-            content = {
-              type = "zfs";
-              pool = "zroot";
-            };
-          };
-        };
-      };
-    };
-  };
-}
diff --git a/modules/xnet/gitserver/default.nix b/modules/xnet/gitserver/default.nix
new file mode 100644
index 0000000..5e04398
--- /dev/null
+++ b/modules/xnet/gitserver/default.nix
@@ -0,0 +1,53 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.xnet.gitServer;
+  inherit (lib) mkOption mkIf types;
+in
+{
+  imports = [ ./gitweb.nix ];
+
+  options.xnet.gitServer = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Serve git repos over SSH.";
+    };
+
+    path = mkOption {
+      type = types.path;
+      default = "/persist/repo/git";
+      description = "Directory where repos will be stored.";
+    };
+
+    keys = mkOption {
+      type = types.listOf types.str;
+      description = "SSH public keys used for git operations.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.users.git = {
+      group = "git";
+      initialPassword = "";
+      isSystemUser = true;
+      home = cfg.path;
+      createHome = true;
+      shell = "${pkgs.git}/bin/git-shell";
+      openssh.authorizedKeys.keys = cfg.keys;
+    };
+
+    users.groups.git = { };
+
+    programs.git = {
+      enable = true;
+      config = {
+        init = {
+          defaultBranch = "master";
+        };
+        safe = {
+          directory = "*";
+        };
+      };
+    };
+  };
+}
diff --git a/modules/xnet/gitserver/gitweb.nix b/modules/xnet/gitserver/gitweb.nix
new file mode 100644
index 0000000..c3696ab
--- /dev/null
+++ b/modules/xnet/gitserver/gitweb.nix
@@ -0,0 +1,74 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.xnet.gitServer.gitweb;
+  inherit (lib) mkOption mkIf types;
+in
+{
+  options.xnet.gitServer.gitweb = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable web interface to git repos.";
+    };
+
+    hostName = mkOption {
+      type = types.str;
+      default = "src.web.4kb.net";
+      description = "Hostname the webUI is served from.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    xnet.nginx.enable = true;
+
+    services.cgit.main = {
+      enable = true;
+      scanPath = config.xnet.gitServer.path;
+      package = pkgs.cgit-pink;
+      nginx = {
+        virtualHost = cfg.hostName;
+        location = "/";
+      };
+      extraConfig = ''
+        mimetype.gif=image/gif
+        mimetype.html=text/html
+        mimetype.jpeg=image/jpeg
+        mimetype.jpg=image/jpeg
+        mimetype.pdf=application/pdf
+        mimetype.png=image/png
+        mimetype.svg=image/svg+xml
+        readme=:readme
+        readme=:readme.md
+        readme=:readme.txt
+        readme=:README
+        readme=:README.md
+        readme=:README.txt
+      '';
+      settings = {
+        about-filter = "${pkgs.cgit-pink}/lib/cgit/filters/about-formatting.sh";
+        clone-url = "https://${cfg.hostName}/$CGIT_REPO_URL git@${cfg.hostName}:$CGIT_REPO_URL";
+        enable-commit-graph = true;
+        enable-http-clone = false;
+        enable-index-links = true;
+        enable-remote-branches = true;
+        remove-suffix = true;
+        robots = "noindex, nofollow";
+        root-desc = "What I cannot create, I do not understand";
+        root-title = cfg.hostName;
+        section-from-path = true;
+        snapshots = "tar.gz tar.bz2 zip";
+      };
+    };
+
+    # required for rendering markdown readme
+    environment.systemPackages = with pkgs; [
+      python312
+      python312Packages.markdown
+    ];
+
+    # services.nginx.virtualHosts."${cfg.gitweb.hostName}" = {
+    #   useACMEHost = "4kb.net";
+    #   addSSL = true;
+    # };
+  };
+}
diff --git a/modules/xnet/net/default.nix b/modules/xnet/net/default.nix
index 143f189..2255f53 100644
--- a/modules/xnet/net/default.nix
+++ b/modules/xnet/net/default.nix
@@ -5,6 +5,10 @@ let
   prefix = "10.26.4";
 in
 {
+  imports = [
+    ./sshd.nix
+  ];
+
   options.xnet.net = {
     interface = mkOption {
       type = types.str;
@@ -17,12 +21,6 @@ in
       description = "Final octet for xnet address.";
       example = 4;
     };
-
-    sshd = mkOption {
-      type = types.bool;
-      default = false;
-      description = "Enable hardened SSH service.";
-    };
   };
 
   # TODO:
@@ -42,28 +40,5 @@ in
         prefixLength = 24;
       }];
     };
-
-    services.openssh = {
-      enable = cfg.sshd;
-      startWhenNeeded = true;
-      settings = {
-        X11Forwarding = false;
-        UsePAM = false;
-        PermitRootLogin = "prohibit-password";
-      };
-      extraConfig =
-        let
-          p = [
-            "sk-ssh-ed25519-cert-v01@openssh.com"
-            "ssh-ed25519-cert-v01@openssh.com"
-            "ssh-ed25519"
-          ];
-        in
-        "PubkeyAcceptedKeyTypes ${lib.strings.concatStringsSep "," p}";
-      hostKeys = [{
-        path = "/certs/ssh/ssh_host_ed25519_key";
-        type = "ed25519";
-      }];
-    };
   };
 }
diff --git a/modules/xnet/net/sshd.nix b/modules/xnet/net/sshd.nix
new file mode 100644
index 0000000..ef225db
--- /dev/null
+++ b/modules/xnet/net/sshd.nix
@@ -0,0 +1,46 @@
+{ config, lib, ... }:
+let
+  cfg = config.xnet.net.sshd;
+  inherit (lib) mkOption mkIf types;
+in
+{
+  options.xnet.net.sshd = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable hardened SSH service.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.openssh = {
+      enable = true;
+      startWhenNeeded = true;
+      openFirewall = true;
+      hostKeys = [{
+        path = "/persist/certs/ssh/ssh_host_ed25519_key";
+        type = "ed25519";
+      }];
+      settings = {
+        UsePAM = true;
+        X11Forwarding = false;
+        PermitRootLogin = "no";
+        PasswordAuthentication = false;
+        Ciphers = [ "chacha20-poly1305@openssh.com" ];
+        Macs = [ "hmac-sha2-512-etm@openssh.com" ];
+        KexAlgorithms = [ "curve25519-sha256@libssh.org" ];
+      };
+      sftpServerExecutable = "internal-sftp";
+      sftpFlags = [ "-f AUTHPRIV" "-l INFO" ];
+      extraConfig =
+        let
+          pubkeyTypes = lib.strings.concatStringsSep "," [
+            "sk-ssh-ed25519-cert-v01@openssh.com"
+            "ssh-ed25519-cert-v01@openssh.com"
+            "ssh-ed25519"
+          ];
+        in
+        "PubkeyAcceptedKeyTypes ${pubkeyTypes}";
+    };
+  };
+}
diff --git a/modules/xnet/net/vpn-gateway.nix b/modules/xnet/net/vpn-gateway.nix
deleted file mode 100644
index d26ced1..0000000
--- a/modules/xnet/net/vpn-gateway.nix
+++ /dev/null
@@ -1,103 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.xnet.net.vpnGateway;
-  inherit (lib) mkOption mkIf types;
-
-  iface = "enp2s0";
-  fwmark = "0x1";
-  ip = "192.168.2.113";
-  vpn = {
-    iface = "wg0";
-    endpoint = "149.88.22.129:51820";
-    addr = "10.69.70.71/32";
-    peers = [
-
-    ];
-  };
-in
-
-{
-  # options.xnet.net.vpnGateway = {
-  #   interface = mkOption {
-  #     type = types.str;
-  #     description = "Interface to forward VPN routed packets to internet";
-  #   };
-  #
-  #   vpn = types.subModule {
-  #     interface = mkOption {
-  #       type = types.str;
-  #       default = "wg0";
-  #       description = "Name of VPN interface.";
-  #     };
-  #
-  #     endpoint = mkOption {
-  #       type = types.str;
-  #       description = "ip:port of the VPN endpoint.";
-  #     };
-  #
-  #     addr = mkOption {
-  #       type = types.str;
-  #       description = "Address of the VPN interface.";
-  #     };
-  #
-  #     privateKeyFile = mkOption {
-  #       type = types.str;
-  #       description = "Path to private key.";
-  #     };
-  #
-  #     peers = types.listOf types.subModule {
-  #
-  #     };
-  #   };
-
-  boot.kernel.sysctl = {
-    "net.ipv4.ip_forward" = 1;
-    "net.ipv6.conf.all.forwarding" = 1;
-  };
-
-  networking = {
-    wg-quick.interfaces."${vpn.iface}" = {
-      address = [ vpn.addr ];
-      privateKeyFile = "/certs/wg/private.key";
-
-      peers = [{
-        publicKey = "yxyntWsANEwxeR0pOPNAcfWY7zEVICZe9G+GxortzEY=";
-        allowedIPs = [ "0.0.0.0/0" ];
-        endpoint = "149.88.22.129:51820";
-        persistentKeepalive = 25;
-      }];
-    };
-
-    nat = {
-      enable = true;
-      externalInterface = "wg0";
-      internalInterfaces = [ "enp2s0" ];
-    };
-
-    firewall = {
-      extraCommands = ''
-        # Create a new routing table for forwarded traffic
-        echo "200 vpn" >> /etc/iproute2/rt_tables
-
-        # Mark packets from other hosts
-        iptables -t mangle -A PREROUTING -i enp2s0 ! -s 192.168.1.113 -j MARK --set-mark 0x1
-
-        # Route marked packets through WireGuard
-        ip rule add fwmark 0x1 table vpn
-        ip route add default dev wg0 table vpn
-
-        # Allow forwarding
-        iptables -A FORWARD -i enp2s0 -o wg0 -j ACCEPT
-        iptables -A FORWARD -i wg0 -o enp2s0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-
-        # NAT only forwarded traffic
-        iptables -t nat -A POSTROUTING -o wg0 ! -s 192.168.1.113 -j MASQUERADE
-      '';
-
-      extraStopCommands = ''
-        ip rule del fwmark 0x1 table vpn 2>/dev/null || true
-        ip route flush table vpn 2>/dev/null || true
-      '';
-    };
-  };
-}
diff --git a/modules/xnet/nginx.nix b/modules/xnet/nginx.nix
new file mode 100644
index 0000000..1a3df78
--- /dev/null
+++ b/modules/xnet/nginx.nix
@@ -0,0 +1,30 @@
+{ config, lib, ... }:
+let
+  cfg = config.xnet.nginx;
+
+  inherit (lib) mkOption mkIf types;
+in
+{
+
+  options.xnet.nginx = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable optimized nginx.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+    services.nginx = {
+      enable = true;
+      recommendedBrotliSettings = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      recommendedZstdSettings = true;
+    };
+  };
+}
diff --git a/modules/xnet/users.nix b/modules/xnet/users.nix
new file mode 100644
index 0000000..d9f6081
--- /dev/null
+++ b/modules/xnet/users.nix
@@ -0,0 +1,62 @@
+{ pkgs, lib, config, ... }:
+let
+  cfg = config.xnet.users;
+  inherit (lib) mkOption mkIf types;
+in
+{
+
+  options.xnet.users = {
+    enable = mkOption {
+      type = types.listOf (types.enum [ "kle" ]);
+      default = [ ];
+      description = "Users to enable.";
+    };
+  };
+
+  config = {
+    users.mutableUsers = false;
+
+    users.users.kle = mkIf (builtins.elem "kle" cfg.enable) {
+      hashedPassword = "$6$R4dDhaftX.vapGMd$.An36hlp3DXfkIC7bPZ0MDPo6Zvpk8JRrhy2LES.lZZj6JDa74oJkcMW3DCsIySvLJxOPXSShos0TpgJ/w0fH/";
+      isNormalUser = true;
+      createHome = true;
+      extraGroups = [ "wheel" "users" "networkmanager" "video" ];
+      packages = with pkgs; [
+        btop
+        curl
+        fzf
+        git
+        jq
+        lynx
+        neovim
+        ranger
+        rsync
+        sshfs
+        tree
+        zip
+      ];
+    };
+
+    programs.ssh.extraConfig = ''
+      Host github
+        HostName github.com
+        User git
+        PreferredAuthentications publickey
+    '';
+
+    programs.git = {
+      config = {
+        init = {
+          defaultBranch = "master";
+        };
+        push = {
+          default = "upstream";
+          autoSetupRemote = true;
+        };
+        fetch = {
+          prune = true;
+        };
+      };
+    };
+  };
+}
diff --git a/modules/xnet/users/default.nix b/modules/xnet/users/default.nix
deleted file mode 100644
index c567c23..0000000
--- a/modules/xnet/users/default.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ ... }: {
-  imports = [ ./radicale.nix ];
-
-  security.sudo = {
-    execWheelOnly = true;
-    extraConfig = "Defaults lecture = never";
-  };
-}
diff --git a/modules/xnet/users/radicale.nix b/modules/xnet/users/radicale.nix
deleted file mode 100644
index 7d752f0..0000000
--- a/modules/xnet/users/radicale.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ config, ... }:
-let path = "/persist/data/radicale"; in {
-  services.radicale = {
-    enable = false;
-    settings = {
-      server.hosts = [ "127.0.0.1:5232" ];
-      storage.filesystem_folder = "${path}/collections";
-      auth = {
-        type = "htpasswd";
-        htpasswd_filename = "${path}/users";
-        htpasswd_encryption = "plain";
-      };
-    };
-  };
-
-  systemd.tmpfiles.rules = [
-    "d ${path} 0700 radicale radicale -"
-    "Z ${path} 0700 radicale radicale - -"
-  ];
-
-  services.nginx.virtualHosts."dav.web.4kb.net" = {
-    useACMEHost = "4kb.net";
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:5232/";
-    };
-  };
-}
diff --git a/modules/xnet/users/secret.yaml b/modules/xnet/users/secret.yaml
deleted file mode 100644
index 0381dea..0000000
--- a/modules/xnet/users/secret.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-root: ENC[AES256_GCM,data:N0CdjX9uY9IeLX95SSzQYsV/6IVfs0r1rX0JTCbb6WD7/oID0/y9CwErPKhCP03x7aKS4mqwgU6dVECAqsEIs35AS/O84FELTw==,iv:8+jKwsBfUfiEkclW2moLtzwB6MDouNq7N4U24f18kiQ=,tag:Ekw+vOXyhMgw5oPRTzV/Qg==,type:str]
-kleidi: ENC[AES256_GCM,data:r0C5/fuY/RwNv9FFCrDMr4UnDK4cA1vFcDPlGTHSKYExzd+T6zrw5Zl/YO98uB3WC4mEtIgfZQxGwMgYyCVU2piJeW40/wftLA==,iv:hRa2eUx7tgyoV/hh6H+e5QCrTtQc/rOYIYefs32yzNg=,tag:Z/m+f+SvOHGleLtWU49nsA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age15f6mcwjjav4z757kad8wksalgemael364wwxz7qsral5gmjzmd2qre78d5
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaRE85OWRmR1VtcWg0cnBz
-            SW9JRDJpN1RwRER5alAwUDBNM2ZrQ0Jna2tJClEweStEdmsyTnZNcXBsN3RIRXln
-            eUxUcUZwYU9CMDBjejlQRG0rdVRCUG8KLS0tIGt6MS9kN05MY0xhbWY5cjBBMlBG
-            dmpXeloxTDNydGRtd0ZFUVhKOWlMT1kKNj6BpUhgq6/AAHvFfNaEeHPsB2eRMzjS
-            lH7Vxn0mj00LdilatnWMajr8u3FWq+XYc2kPIo/XM8AmM/u17rMoag==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1nw5yklj57fegqllhqfjuy9f89cx9f9p0xptw9uv58rzleh8fdyssv0zyp4
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTWXBuWGZ3NzI4ZHJOZllm
-            UVJYYnB5RklPTkh3ODdhY3hXUnFnWnBEaTNvClQ4RXpkWDI0ZUF2NHdvT2lOZDUv
-            dmgvSWtXU3p0WjhWeHV3L0VjRGdweE0KLS0tIE1kSm4xajd6MVNsNUlsSHhlbXUz
-            c2NGY3luQ2prUFNLKytEVFlFdDhtWEUKl3tUxQIpJA9RJLs2Fvb7s4Cn21CEC3r6
-            XZ1BXjXKxHoEPyTARvxDqJXJxSvaH76283rhSG1vcQzmGUm56LZcLw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-31T01:49:17Z"
-    mac: ENC[AES256_GCM,data:ye2kvRJCGn/h1QviQ+Zrhykau7gCSe78QWEd2QgvfIPMgcDh3COdhavsd9zDRmDMNJBAiDTWQkrgTtYDzx859TsxfJdEDp6X7xRWhI/2dU94aRVGQGxdKTRiswJR+RzHmO0Cf4tNqYYjIySym4v39yWKioQlV4Vm9BW2eUTYLNo=,iv:gSvqxLggrf085IY+u/VeNkYAho/gMC5U2xkqgfSpeTc=,tag:gRTfIoFqta+7udwANTqO2A==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.1