Update facts/secrets for service zerotier in machine moritz-laptop

Update secret moritz-laptop-zerotier-identity-secret
Update vars via generator user-password for machine moritz-laptop
2025-04-19 12:19:30 +02:00 · 2025-04-19 12:19:28 +02:00 · 2025-04-19 12:19:27 +02:00 · 2025-04-19 12:19:26 +02:00 · 2025-04-19 12:19:25 +02:00 · 2025-04-19 12:19:24 +02:00
44 changed files with 4772 additions and 58 deletions
--- a/flake.nix
+++ b/flake.nix
@ -100,6 +100,7 @@
        inventory = {
          machines = {
            moritz-desktop.tags = ["peer"];
+            moritz-laptop.tags = ["peer"];
            moritz-server.tags = [];
          };
          services.zerotier.default = {
--- a/machines/moritz-laptop/configuration.nix
+++ b/machines/moritz-laptop/configuration.nix
@ -0,0 +1,245 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+{
+  pkgs,
+  inputs,
+  ...
+}: {
+  imports = [
+    ./disko.nix
+    ../../modules/moritz/default.nix
+    ../../modules/shared.nix
+  ];
+
+  time.timeZone = "Europe/Berlin";
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    ''
+      ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDHlemuKagHwz2T5rEwgJNlVUdUdOXyPtCEzD73CrwY2zmpR4AMj7y9u3Rm7HwHUDjLap1ZFwg+53bAsVP6HFZccCXoIfO/8BL0WDGQJrfgb+A+UiRhSqSvyZ77bGJkadbBkadguz3qR3PHcb41DOlhuqVcHxsY8ceHMxAuyb0pLJVJLeytMD+CHS/r7hoj2hckTNAZ+VhCXBtdZfZ7uPUBxLfluYRNNMmdwCglsg3RUS242nJUzy3A84+CXIGeWmNG9Fu45IDkwMthxSW9klyU9R38R9DBDcugkyb6vz+JKSuRVAa47qh/kmtsYekfL3ul9D2JN32P8S+6ZoXx+gXupGJ0ltwJWAFkhLJ+yeXj9kCOv/mIUmCB14jMGsvKiSwV25O/twyjqe2LEkMVgimgrjEYoHu+ZTyp0iFtUvSrFo4tsAhfWPV9yj4F/hUksW7xKIwq5Niyx7he5M/XddudtnAximyiBDGCdJm1Ejl0UaGa6ZQv7y6VZdx0PyZuraT7l9ub8so6JlE4cVgSSU9vE0IS2QqBuHhsIjh8RVksoTR2NQbeDdGaGpGnq2C8y0rDXwE/EJA4LK45khX/GPn73n8F0kBG8dBrWgRDAEODpmebScO7d5mCeM0z3lPcRmh+3e3DPnVVOl+uR7udlc7NauLzl7q913UtxZaF1PlD7Q== cardno:15_584_308
+    ''
+  ];
+
+  # Set this for clan commands use ssh i.e. `clan machines update`
+  # If you change the hostname, you need to update this line to root@<new-hostname>
+  # This only works however if you have avahi running on your admin machine else use IP
+  clan.core.networking.targetHost = "root@moritz-laptop";
+
+  my = {
+    ai.enable = true;
+    profiles = {
+      desktop.enable = true;
+      personal.enable = true;
+      personal.mail = true;
+      personal.contacts = true;
+      personal.calendar = true;
+      impermanence.enable = true;
+    };
+    programs.aider.enable = true;
+  };
+
+  users.users.moritz.packages = with pkgs; [
+    poetry
+    wl-clipboard
+  ];
+
+  home-manager.users.moritz.services.kanshi.settings = [
+    {
+      profile.name = "undocked";
+      profile.outputs = [
+        {
+          criteria = "eDP-1";
+          scale = 1.0;
+        }
+      ];
+    }
+    {
+      profile.name = "docked-scads";
+      profile.outputs = [
+        {
+          criteria = "eDP-1";
+          position = "640,1800"; # NOTE: 2160 / 1.2 = 1800
+        }
+        {
+          criteria = "Dell Inc. DELL P4317Q";
+          scale = 1.2;
+          position = "0,0";
+        }
+      ];
+    }
+  ];
+
+  services.kanata = {
+    enable = true;
+    keyboards = {
+      laptop = {
+        devices = [
+          "/dev/input/by-path/platform-i8042-serio-0-event-kbd"
+        ];
+        config = "
+          (defsrc
+            grv  1    2    3    4    5    6    7    8    9    0    -    =    bspc
+            tab  q    w    e    r    t    y    u    i    o    p    [    ]    \
+            caps a    s    d    f    g    h    j    k    l    ;    '    ret
+            lsft z    x    c    v    b    n    m    ,    .    /    rsft
+            lctl lmet lalt           spc            ralt      rctl
+          )
+
+          (deflayermap (default)
+            ;; tarmak 1a
+            j n
+            n k
+            k e
+
+            ;; tarmak 1b
+            h m
+            m h
+
+            ;; tarmak 2a
+            b z
+            z x
+            x c
+
+            ;; tarmak 2b
+            e f
+            f t
+            t b
+
+            ;; tarmak 3
+            c d
+            d s
+            s r
+
+            ;; tarmak 4
+            r p
+            p ;
+            ; o
+            o y
+            y j
+
+            ;; tarmak 5
+            u l
+            l i
+            i u
+
+            ;; caps-word tap-dance
+            lsft (tap-dance 200 (_ (caps-word 2000) _ _))
+
+            ;; change ctrl alt and meta
+            lctl lalt
+            lmet lctl
+            lalt (tap-dance 200 (lmet (multi lmet alt) lmet lmet))
+
+            ;; hjkl layer
+            ralt (tap-hold 200 200 (layer-switch hjkl) (layer-while-held hjkl)) ;; tap: switch   hold: switch while held
+
+            ;; switch to normal keyboard layout
+            rctl (layer-switch normal)
+          )
+
+          (deflayermap (normal)
+            rctl (layer-switch default))
+
+          (deflayermap (hjkl)
+            h left
+            j down
+            k up
+            l right
+
+            ralt (layer-switch default))
+        ";
+      };
+    };
+  };
+
+  # BOOT
+  boot = {
+    supportedFilesystems = ["zfs"];
+    loader.systemd-boot.enable = true;
+    loader.efi.canTouchEfiVariables = true;
+    initrd.availableKernelModules = ["rtsx_pci_sdmmc"];
+  };
+
+  # SERVICES
+  services = {
+    libinput.enable = true;
+    libinput.touchpad.disableWhileTyping = true;
+    printing.enable = true;
+    logind.lidSwitch = "hybrid-sleep";
+  };
+
+  # NETWORKING
+  networking = {
+    networkmanager.enable = true;
+
+    useDHCP = false;
+    interfaces.wlp1s0.useDHCP = true;
+    # interfaces.enp4s0f4u2.useDHCP = true;
+  };
+
+  console.keyMap = "en";
+
+  # needed for enabling hibernation
+  security.protectKernelImage = false;
+
+  # Powersaving
+  services.tlp.enable = true;
+  powerManagement.enable = true;
+  powerManagement.powertop.enable = true;
+
+  systemd = {
+    # Hibernare on low battery
+    timers.hibernate-on-low-battery = {
+      wantedBy = ["multi-user.target"];
+      timerConfig = {
+        OnUnitActiveSec = "120";
+        OnBootSec = "120";
+      };
+    };
+    services.hibernate-on-low-battery = let
+      batteryLevelSufficient = let
+        batteryPath = "/sys/class/power_supply/BATT";
+      in
+        pkgs.writeShellScriptBin "battery-level-sufficient" ''
+          test "$(cat ${batteryPath}/status)" != Discharging \
+            || test "$(cat ${batteryPath}/capacity)" -ge 5
+        '';
+    in {
+      serviceConfig.Type = "oneshot";
+      onFailure = ["hibernate.target"];
+      script = "${batteryLevelSufficient}/bin/battery-level-sufficient";
+    };
+    services.asus-touchpad-numpad = {
+      description = "Activate Numpad inside the touchpad with top right corner switch";
+      documentation = ["https://github.com/mohamed-badaoui/asus-touchpad-numpad-driver"];
+      path = [pkgs.i2c-tools];
+      script = ''
+        cd ${inputs.asus-touchpad-numpad-driver}
+        # In the last argument here you choose your layout.
+        ${
+          pkgs.python3.withPackages (ps: [ps.libevdev])
+        }/bin/python asus_touchpad.py m433ia
+      '';
+      # Probably needed because it fails on boot seemingly because the driver
+      # is not ready yet. Alternatively, you can use `sleep 3` or similar in the
+      # `script`.
+      serviceConfig = {
+        RestartSec = "1s";
+        Restart = "on-failure";
+      };
+      wantedBy = ["multi-user.target"];
+    };
+  };
+
+  # Trackpad
+  # i2c for https://github.com/mohamed-badaoui/asus-touchpad-numpad-driver
+  hardware.i2c.enable = true;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "22.05"; # Did you read the comment?
+}
--- a/machines/moritz-laptop/disko.nix
+++ b/machines/moritz-laptop/disko.nix
@ -0,0 +1,104 @@
+{pkgs, ...}: {
+  # needed for zfs pool
+  networking.hostId = "9c85d185";
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/nvme0n1";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            zfs = {
+              size = "100%";
+              content = {
+                type = "zfs";
+                pool = "zroot";
+              };
+            };
+          };
+        };
+      };
+    };
+    zpool = {
+      zroot = {
+        type = "zpool";
+        rootFsOptions = {
+          compression = "zstd";
+          "com.sun:auto-snapshot" = "false";
+          "acltype" = "posixacl"; # NOTE: needed for systemd https://github.com/NixOS/nixpkgs/issues/16954
+        };
+        mountpoint = null;
+
+        datasets = {
+          encrypted = {
+            type = "zfs_fs";
+            options = {
+              mountpoint = "none";
+              encryption = "aes-256-gcm";
+              keyformat = "passphrase";
+            };
+            # use this to read the key during boot
+            postCreateHook = ''
+              zfs set keylocation="prompt" "zroot/$name";
+            '';
+          };
+          "encrypted/root" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/";
+            postCreateHook = "zfs snapshot zroot/encrypted/root@blank";
+          };
+          "encrypted/nix" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/nix";
+          };
+          "encrypted/persist" = {
+            type = "zfs_fs";
+            options.mountpoint = "legacy";
+            mountpoint = "/persist";
+            options."com.sun:auto-snapshot" = "true";
+          };
+        };
+      };
+    };
+  };
+  # rollback to blank
+  boot.initrd.systemd.services.rollback = {
+    description = "Rollback ZFS datasets to a pristine state";
+    wantedBy = [
+      "initrd.target"
+    ];
+    after = [
+      "zfs-import-zroot.service"
+    ];
+    before = [
+      "sysroot.mount"
+    ];
+    path = with pkgs; [
+      zfs
+    ];
+    unitConfig.DefaultDependencies = "no";
+    serviceConfig.Type = "oneshot";
+    script = ''
+      zfs rollback -r zroot/encrypted/root@blank && echo "rollback complete"
+    '';
+  };
+  boot.initrd.systemd.enable = true;
+  fileSystems."/persist".neededForBoot = true;
+  services.zfs = {
+    autoScrub.enable = true;
+    trim.enable = true;
+    autoSnapshot.enable = true;
+  };
+}
--- a/machines/moritz-laptop/facter.json
+++ b/machines/moritz-laptop/facter.json
--- a/machines/moritz-laptop/facts/zerotier-ip
+++ b/machines/moritz-laptop/facts/zerotier-ip
@ -0,0 +1 @@
+fd77:acc0:1d56:2265:499:9316:a1c:47f3
--- a/modules/moritz/profiles/personal_contacts.nix
+++ b/modules/moritz/profiles/personal_contacts.nix
@ -47,7 +47,7 @@ in {
      prompts.password.type = "hidden";
      prompts.password.persist = true;
      share = true;
-      files.password.owner = "moritz";
+      files.password.owner = lib.mkForce "moritz";
    };
  };
 }
--- a/modules/moritz/profiles/personal_mail.nix
+++ b/modules/moritz/profiles/personal_mail.nix
@ -69,7 +69,7 @@ in {
      prompts.password.type = "hidden";
      prompts.password.persist = true;
      share = true;
-      files.password.owner = "moritz";
+      files.password.owner = lib.mkForce "moritz";
    };
  };
 }
--- a/sops/machines/moritz-laptop/key.json
+++ b/sops/machines/moritz-laptop/key.json
@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1smgaynkzdfmhg8yymr49l75cax7fzspgppg2dtjadv269j78vsuqdedhmh",
+    "type": "age"
+  }
+]
--- a/sops/secrets/moritz-laptop-age.key/secret
+++ b/sops/secrets/moritz-laptop-age.key/secret
@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:553wV6tWJSDfqRBHRyrj3ZUyJ9h0ocRMEWlubpzHk+QYdKBAdIajVgd5x4tTAoMg19wbmskWeufoUxoKjOZh3XW7Xv857alwX2k=,iv:/VGkG0bEHKIY4xgVitnpAXx2l92Ili3DZvx92sc1WYI=,tag:XSVWHfN8xCvdjbGyK4KdDA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBUEtFa214Ylk0OURvZlE5\nays1WENWSFlGRXpINHg0OERTWnE2VkQvTkdBCnl6ZnJCMlB5bDVXODREKzZFNkl6\nQ1M2eFJqMTNYa3MyYTBDRnFSdHQ5ZjgKLS0tIFgwenB5UEZMVGszK3MyODVETGRO\neTg1S001UTJnQk1EUGFzVnFzUWEyVHMKKt/luuV1NSJ2V1FPpdHmyC87Ig8kTAMJ\n4zWyvHEpXYAo2x4eFI14MFIY/6UooDoeJGLg8PrS3bCsgDYbHL/n0Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-19T09:55:16Z",
+		"mac": "ENC[AES256_GCM,data:2KSB/GAGFqI8qlKC9ZaSxWcEbJPkHIP5kLUbE0TODQ5Qcoat6MKiqhODqSzPpF8YeLN4luX4Y04qRvsGSXzpFHfFjVP5egUcWVnYY379RgtaRH9KuMmB6kGgRoYesoQle/stee95EZzW4Of1oy6mp7zmv325rubFJLyP48nwUy4=,iv:VOYVpLPMVCvU3oMV9Zo/RKs0uk9qeYH1RlG6D65ntxA=,tag:XAq/lsSiinheC4LLK6Wd4A==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}
--- a/sops/secrets/moritz-laptop-age.key/users/moritz
+++ b/sops/secrets/moritz-laptop-age.key/users/moritz
@ -0,0 +1 @@
+../../../users/moritz
--- a/sops/secrets/moritz-laptop-zerotier-identity-secret/machines/moritz-laptop
+++ b/sops/secrets/moritz-laptop-zerotier-identity-secret/machines/moritz-laptop
@ -0,0 +1 @@
+../../../machines/moritz-laptop
--- a/sops/secrets/moritz-laptop-zerotier-identity-secret/secret
+++ b/sops/secrets/moritz-laptop-zerotier-identity-secret/secret
@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:BLgNb7+OPIDVOxtc+td1UiQ1UvFSA2xLP3Wgvp5K7c36YAP90yPDZRPM828RsUdoLi8HO5peolJz9zleTURaVWDgWMYv39HdsSSVU8qEUXb56QQLsIkJhzrQ86dhvarUIHeyu6rRbGT+cE1UovplLMoXRmIoyo4hnJ+6YljXv6S6IwZIeSZHjr1mnypAHNhJjfpWJysiEaLDH7HkulFpl6BBYd/YCbbPYHe9yiAquqWTUHJiA3RISxAkRBvFJcmQBe80xfkQqig/TSSrvqq78s0fOm64RvhA+nGucIC85lvOJacqFmj0u4T/k9OK+Q8o9IlGJj1kTR1S2G3waklEfLwClt+tgXxlNWjvzz7y,iv:LzBfXNb1p4+vYxSGhQkJg1bjOSfN5XJuhQqY56Go12Q=,tag:2DSS1Cos9RF+kvQqdmOE8A==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqV0Y0ckRQbE43UXlKTVlX\nc3NDcnRZNFZodGpLUi9GTWQvTnJxdGRYN0hBCm9iTERvRFZzYzRoZndmMUkxYTVR\nVDRrY1d2dEZkL0RsNGtpWE1QcDZYaDAKLS0tIEtsdmFDdDgrM1RxTXg5bi80dm5G\nRS9pbUl3QU1aRCtuSXRaTHZoZWFEUVkKmdFE4RvlxGDEECjwiTLfw67yHFhRjpGS\nJ+MoJ102i23Er+dsSLOYMaMHgB4EIw1y2wxjnYw4688vpcb0xhzNOw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1smgaynkzdfmhg8yymr49l75cax7fzspgppg2dtjadv269j78vsuqdedhmh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2cXVuZmV1dURGSFdPTDhO\nRFJIbUZuRGxZdWhaMXZCcGdCeXY5V1JVU204CkYxdkN6Vkkra2NpSlRMUit6cWlE\nanM3aEJqUTJqSXZ0NzdWL1BWdzVlN1UKLS0tIGZLY3J0eFVxdXQrSzZSWHN5aWxE\nSDN6SS9IM2hxOENqR29BOS9KaEdMWXcK1EilL9fj1P/L8Ov8fEs3yQ08wc8Ai4z7\nWZACTJSPPThIVvMdxexT82dv6B+CFCLWDr16tQvHNj3MulVbW0o3DA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-19T10:05:34Z",
+		"mac": "ENC[AES256_GCM,data:4ERWxTLbqmn3wA74wtVwliz2ff8x2xPYV9Ok7Z5Ur6k9msLbYZjB8og6du8MzP7riwRnXHv2zfaMKZvjJIEKYzQk/kCS+iFJGaG8sYTQqbmGjsK9xG3eubfn7NY8m95vbRlOMMmTloOMVDK8S+p8aZcDE4rUmpJA9lfE3O+l950=,iv:cnks0m/ENl4kK8/moppFVxvvfkCIzHbFjqtwx/Fe/IU=,tag:15uwynbok653t+kN/eBttA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}
--- a/sops/secrets/moritz-laptop-zerotier-identity-secret/users/moritz
+++ b/sops/secrets/moritz-laptop-zerotier-identity-secret/users/moritz
@ -0,0 +1 @@
+../../../users/moritz
--- a/vars/per-machine/moritz-laptop/machine-id/machineId/value
+++ b/vars/per-machine/moritz-laptop/machine-id/machineId/value
@ -0,0 +1 @@
+a73f6aaa27ee4ac39f0f3610f0697e41
--- a/vars/per-machine/moritz-laptop/openssh/ssh.id_ed25519.pub/value
+++ b/vars/per-machine/moritz-laptop/openssh/ssh.id_ed25519.pub/value
@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxM1EucXBzhDNyWi9AjAPcIM5W5KE5JL5EWyDw4Nntr nixbld@moritz-laptop
--- a/vars/per-machine/moritz-laptop/openssh/ssh.id_ed25519/machines/moritz-laptop
+++ b/vars/per-machine/moritz-laptop/openssh/ssh.id_ed25519/machines/moritz-laptop
@ -0,0 +1 @@
+../../../../../../sops/machines/moritz-laptop
--- a/vars/per-machine/moritz-laptop/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/moritz-laptop/openssh/ssh.id_ed25519/secret
@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:B4w8dbGL1tmaaGjvMmup+dY5W6NAQTvmgvM06V/zvhSP71mcIXjd3xBfwL173jci17VYsEWW2hVdvk0/JFBPRwoykXPsD/INyKi2YhJauQ2lLWs8JgUeYjFcJqyNF7Bz3Scd+Eox5lNI2rX+qZ+hOizjGEYDggM4h5cM2RZ/+T9a3I30hBjNnEp6sc+Rm5Q5rjV9aQX+90EMn2yEPc3AHpBDvsyd/iyFMHgnNTxwBVEMvcCVMQkHetz5uGEK9SA7C0T2SOypeQGA1TKwpb7Nl70jphjH48KnFcjkYkOgcPLecayYIws78nXdgOIaA0Xh7Q/RBiMlNytIlg81rN2zdZAw4iszyaLoEBY/yHFgr7Dms1EnOFQK5o0T4cnFI13WqnZd66wit7CiVVhvdsoF72KxitzOn2dzyxbfze5U1TDcXjv98dUYI1VOtjNoXzCFHIIYtOfZ/z6+GghfwBVS/rVJm0kOIFFWB+EGfc4PjpomwczLOB50qVAfZNkeVn9aPtGFNUV3WAqPdXZb7z12pNtMnFTl150j/OH9,iv:q0h+2hAR2xiCrZtGfQC4HijZBFYq8dkPy72S+5A8i88=,tag:fJTqvIYRr0lMxLnzqi/3Rg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCcllpTXowVkxaRjJ2U05O\nUzR6MEtIWFZUZWZrY0RLVFVuKzNOaUMwL2prCis2VXNFWjQ4akx1a2UvdmR0Rkt3\nMThsNElWNkgwSWZLVWFHbzNmMFhwbmMKLS0tIFRMQ3FBZUxKWnc4S0hRbnVlOWJq\nTFZmU3hibjM4ZmsxTVJJSG9VK1Y0eUUKdo3dYshOM3RlQHDpxzqvgcDKefRwmR4x\nQ857vZwGRlIsU9/BGjhR9zCa8F2Ti7NWTf3qUNqZXkLMvH0lEfzSCw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1smgaynkzdfmhg8yymr49l75cax7fzspgppg2dtjadv269j78vsuqdedhmh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5VlpvRk5xeXhzMnRPazQ5\nTzRSb0R5T2N2WjVkNlh5STNtNVM1MzVEZVRjCk5LaHhCc2l6eVdoa1ZmWkNGRk02\ncEliTGdyL0w0SS9ZYVdnRktlT0t5NzgKLS0tIHR5cjM4UXpjSUdDWms2L1JaVVRX\nVTN3bVpKRzMycUw5azZIWks3L2NzejQK6yyLIXo/Q5Jcz5iia/LfOr+FUjhblkdz\n0jdKMhlDdM3EGfzBRv1NkHdBN16yZu2YVGV2hGm92yDa+8JKRInzFg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-19T09:57:10Z",
+		"mac": "ENC[AES256_GCM,data:KLylmujN5POofP0dimUGVLvXnIKuUO5UmhItX661Frt2JlFHWrM/F8PDIN/C0j6+KU1o9oMerb32sn9eIDm5BAF1ewWMUX7HLTtEAQVg247Kxb1Jr2A0KKA1f3b0rRY7oWpwzXvHQ5C4l8r9zvTs1u3SLL0mc1iSuh4cW75JsPk=,iv:6vHlHpK0ufhLPubEr0ko55NoNg5OmrE22EUexcCt09Q=,tag:gwsnS5FzBbTgRvGruSNmGw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}
--- a/vars/per-machine/moritz-laptop/openssh/ssh.id_ed25519/users/moritz
+++ b/vars/per-machine/moritz-laptop/openssh/ssh.id_ed25519/users/moritz
@ -0,0 +1 @@
+../../../../../../sops/users/moritz
--- a/vars/per-machine/moritz-laptop/root-password/password-hash/machines/moritz-laptop
+++ b/vars/per-machine/moritz-laptop/root-password/password-hash/machines/moritz-laptop
@ -0,0 +1 @@
+../../../../../../sops/machines/moritz-laptop
--- a/vars/per-machine/moritz-laptop/root-password/password-hash/secret
+++ b/vars/per-machine/moritz-laptop/root-password/password-hash/secret
@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:0uEh/gTBJlH3trRWyABOINon/QsCCi6OPLAklzlsVhPhiI3q+UE3AIZTv/tM+a4u115paZJje7hETebCLYsdplr+5/c4YQYsRr2chS81JMZ3T0WIS6ptqv+Lxom3f9UDeZIHvXb+FagVYw==,iv:YusEJHpQRT0gYyghGgMWr1a/2cCl2gj6HWnOzyldc3k=,tag:vbpymKrYtIuiX4ignyQeng==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmQ1FabjN5b2Y0MW5oNWtr\nVExYUDVNY3owTEFidXpLQUpWTlBKUlQyZVZRCnVGdmdhNnh6bUpqQVRmVFRnVEt2\nSVJMQVZ1bjF4clZkRm56dTNNOExLck0KLS0tIHc2SjFQQjc2MXNNdFZBWDAxQWh5\nWXhEZUFqc0x3SXpqY211RERSRjVsMzgKUNgfoVVr9Iq0TnlIUYS1h5c5laWk3y5t\ndSaQ7AROKeUmTIPJcrYdE8bX+wDzmG27EiZb+mn2mliHPFp1rPcbdA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1smgaynkzdfmhg8yymr49l75cax7fzspgppg2dtjadv269j78vsuqdedhmh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAra2VBMlVPemdTQktwSnJE\nMmZ3NDNiV1hQMzRWT3pmam5iWlVha1hsT0JRCkRBZml0WVBuM3dWSjBJOElXcFJ5\nWnlBYUt4SStHOTNyOHB3MUhFZ1QwUzQKLS0tIEd5WHcwMEJzbnhPemNXazhpd0xX\nOTNYTDBRcEVweEE1bCs5NWhFRWQ0bmsKbnOI06Coqh9Icm7pWYN17xn8ayVdAZLg\nlD4kHEVFIKNDaGNE4wJA/e0p6NBTsF8rQ4XSMQJdMQvmENUPQwJnmQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-19T09:57:53Z",
+		"mac": "ENC[AES256_GCM,data:kg1o9H3lGTmbtGMUq7D2cClddEmXtlwWLrSwkDUmMpFs1kaZiPfom6A5k2PrB5a3wkMHRMZ1L6kW76RBdOBfm6yY0tpS477Boiaem/YnUbYGN81CIjBdl5U4xfDCUc1fmYs7FUQiN5kPNpvORdnGjBafj8HIBPa/VXOA0KerDFo=,iv:Sro+NJb0yAXAzGtyg1XobsrSsG3C+4ggvsIB5IUptOU=,tag:8LJF+lA+T096Vvagd2Dm1g==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}
--- a/vars/per-machine/moritz-laptop/root-password/password-hash/users/moritz
+++ b/vars/per-machine/moritz-laptop/root-password/password-hash/users/moritz
@ -0,0 +1 @@
+../../../../../../sops/users/moritz
--- a/vars/per-machine/moritz-laptop/root-password/password/secret
+++ b/vars/per-machine/moritz-laptop/root-password/password/secret
@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:kTxZFpg4wLL7cTSNcMa4psfw2UqRJ1kn4C9dpNy2/w==,iv:9h7IwH5esMwtHXEk/SXDDwHiXvuOgC6eEXSxH4fqm+8=,tag:mDtco8BEOUcSJfDwqu315A==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUdEE1bGFRT3dWb1FldFQx\naVgxSXJsUk1WQk4relpmaTlyNlFQMmFyRGpFCk16KytwRmtTY3FyWExDUHY4UmRT\nZ005V2h4SjR4Skh2a0E4K2o2WlRETlkKLS0tIGRQbzNCcHZEcGhBbndsU21GekE2\nYzdWZHplZTYxWTB5U3k0UHRINnBYS3MK9JAV3n99W4X4MhvpZaQasxivL71AMWq9\nm0oGES+c1G/3Tvj/UVIUXuinrQ50FFsEcYO2VHRHcSjP/Xe26uTJhQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-19T09:57:39Z",
+		"mac": "ENC[AES256_GCM,data:ktVtGbffk9TwNOPgo08u3l8iTqfExKE/WsEUZdzzs8SDX+ApOJdvipcRi8dmXD8y7W6YsujgTfrPp2Pbh7BKWnbCvnMGGl2pygL9P0+jurxkvKdiaU2eVgOb5K8vdnVkXnfTbC9J5srAOcvtMnKTzjLbj8Qd8EDMf4giHsrqiE8=,iv:b2CTZ/82z1byK/B7e7RXzLtd7eSNRBxVOfYflDlnxL4=,tag:13bQT8i3YDUxn7YEpbWudA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}
--- a/vars/per-machine/moritz-laptop/root-password/password/users/moritz
+++ b/vars/per-machine/moritz-laptop/root-password/password/users/moritz
@ -0,0 +1 @@
+../../../../../../sops/users/moritz
--- a/vars/per-machine/moritz-laptop/state-version/version/value
+++ b/vars/per-machine/moritz-laptop/state-version/version/value
@ -0,0 +1 @@
+22.05
--- a/vars/per-machine/moritz-laptop/user-password/user-password-hash/machines/moritz-laptop
+++ b/vars/per-machine/moritz-laptop/user-password/user-password-hash/machines/moritz-laptop
@ -0,0 +1 @@
+../../../../../../sops/machines/moritz-laptop
--- a/vars/per-machine/moritz-laptop/user-password/user-password-hash/secret
+++ b/vars/per-machine/moritz-laptop/user-password/user-password-hash/secret
@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:fCiF1YJl2IkR6nBDWK99axlyVjtU03c/BQkowxVlTedhvOXgpCKQob373wwD/d6K7m6wOJaOeULKb9v9QtEWjvFMWwTlfZOkVxlB74J+z05WXsR1EsMy7tiKJ7UBqngUerLszQP+X3EPtg==,iv:O4iXvidvipDnd/5ZNyuIWCBxcNmAiaOdeciMVKrqvzU=,tag:IycDRHmYki9/Swspz5Fp0g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6TFJRVmNwLzdKNlYyNDgz\nbkx0Mm9LRnBYR2xZb2lpN0ppTWxhZm1DUnkwCi8zWVJ4bkhMTWhucDdxM0RvRWRN\nbkZHZVJCSzJZSlJVbERqV2RQN3FNc0kKLS0tIHdhRm9renBUTlpudTJvUDI4VkVx\nek1zM0RTWkZpODJCTThtUDltTDZXcEEKo2EftFiW4hL9tA1GzGMq+YK/seTPeoJB\ngXMpTE3UFzjAW5j0aD67Wsskxizqljtpv/g4PIyslHUImutNSMu6SQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1smgaynkzdfmhg8yymr49l75cax7fzspgppg2dtjadv269j78vsuqdedhmh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZlZyMlljSmdCZithZzNQ\nOVV1bC9GYW9EdXJvR1NtU0g4MU1vbTh5cGlnCi9qbGhrd0NGWUZMQ2c3UStQM1JT\nY1I3ZlhidmlUeW5VdWdGMnVubVgrbnMKLS0tIEVqcHZaVnlmcWdnTGdVMUhKeXhM\naGVTQ2xUamsrNUxrSzVWK3FEcXVWcDgKKHKmOOHRHYJrmaVOflghJbPC02jEAkV0\nZA+VucYRcrlVUT5liugj1saJuyW3sgoVPicq1TgWMlOX2qooK8jZnQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-19T09:58:42Z",
+		"mac": "ENC[AES256_GCM,data:ZpncfTEdfz9W5EQmpNXub4w+2NweBZzIEQCOPzyfF2GtnS43/rY4f1YKQBIo5a/JUuHamPa0uI0K51SSYCo5rwdp+NkRJFrw7cuFtonjFOd+HTAKLxOOoMyP2faFYdPc0WTQYQCquaxUz+fFYjXalXeFUNitmt16xMEA2J+rPXI=,iv:A08+XUkpRhBfi4EJLWrCEDIRXyXJeGJDWwy4j8FJCrE=,tag:CY3T+MWXUdkt1GqnHCI4VA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}
--- a/vars/per-machine/moritz-laptop/user-password/user-password-hash/users/moritz
+++ b/vars/per-machine/moritz-laptop/user-password/user-password-hash/users/moritz
@ -0,0 +1 @@
+../../../../../../sops/users/moritz
--- a/vars/per-machine/moritz-laptop/user-password/user-password/secret
+++ b/vars/per-machine/moritz-laptop/user-password/user-password/secret
@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:rIb+wQHNyTSG8uY=,iv:AXnaVl4XydVywsO5snsab/Al2nsgdgB7rycICd9qNkg=,tag:TeMFASSDSKoNO1dkjSfbBQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwVzM2b1Y4d0JIOTBGWndu\nS0oxcnJ2azljdTZsYVZSSnBVN1VadWdYUmhnCkxNL0puSktIbWs3RGJZaTRJZUlU\nNHdmUW9jVlV0Vnc4czJ0aWVFVml0TU0KLS0tIFhLOXBnRWJQc09vZUd4Qnp1SGVW\nK1VCajFoMWZ6UVJjV1hsck1WVXJzTzgK5P6Pom1cJv1MCHhjQ/pMfV6Eo5qxZQLJ\n/cZyfxmahLtHGvRySYh4uu3HdsQZoVRu7lFXeTa6wB3T10A9jNSkDQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-19T09:58:34Z",
+		"mac": "ENC[AES256_GCM,data:hK/IQVTm7N47HUF9IxO4Bq+J65yuRQQ1iQ/nmSr5PYu5QAMWSdpgZZaoRKd91MaboflZtIA92gBaLOonPS9KR++0ZqSFoG04bOvkzm0j2REAtRiMkCGwwefiLGFC1f0oiNeCVm5SKzM8U8VfdrtBlThpIlJimzQE7XFrf62vQLg=,iv:xE3TleNKOikt7VBcIEENz9HDacSNs+LNa0o+tsm1Dm4=,tag:H5LjMaOEirjbQcZfPZLOxA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}
--- a/vars/per-machine/moritz-laptop/user-password/user-password/users/moritz
+++ b/vars/per-machine/moritz-laptop/user-password/user-password/users/moritz
@ -0,0 +1 @@
+../../../../../../sops/users/moritz
--- a/vars/shared/moritz-anthropic/api-key/machines/moritz-laptop
+++ b/vars/shared/moritz-anthropic/api-key/machines/moritz-laptop
@ -0,0 +1 @@
+../../../../../sops/machines/moritz-laptop
--- a/vars/shared/moritz-anthropic/api-key/secret
+++ b/vars/shared/moritz-anthropic/api-key/secret
@ -1,24 +1,23 @@
 {
 	"data": "ENC[AES256_GCM,data:wpsshBNZjV7/se0EvTjRe2TmqlkIhktPc+kGTMIaqu/jQuDfcX38JL040wOYCM4eTfatcS7T4xvyQkv1XykTVQ8dh56oTJwUjXnO+0yN4UoSPMtYTQVyVNhfPvsxTEpcd8/tCp3jWzKdusc0,iv:NCqF8NUuNnhBLj+hY7zbsLs59ZnLmGop5b3notscTrc=,tag:7IZmP6cWhrfwVpxsfV/dNQ==,type:str]",
 	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
 		"age": [
 			{
 				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4dXRxV0VIK05neGpYTnhN\nMUR4OVZlcXRkYWI2TkY0K1U0eEZKMkpHaFhrCnUrRFFZMEx6bm1oaU5UVXhVc0lO\nWE9UTjZ4UmR5c1c2OWdNVGNMaU83SkEKLS0tIGI1c0pnQkMrbWExdVYzbGdIVThs\nZW9Rb0JwMGsxVE4relRLMU9mbmNtV2sKFCr6ToYy9eDrF6jAQPnxcwQQSb5unEsa\ng5s5Z1aphVvjai3/xxObWpntR8oezagJ0t8Z2j3NJ1KvBK0Xcdbx5g==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlMTEwY2tpSkxreEY3a3dK\nR2FEZVdUdWEvMW52NUVUQ3cvRHhzVDFsdEdrCnRvMUdqeitMeWxjYXJxaW9DUyto\nNE50dXVZQ1diTDBraXp4dGpaa3U4RkkKLS0tIHA2aElEeFdnblorWWJWRnc1a0Nz\nMmtXYzkvZ2NBbU1wMWYybWg4d2tFc0kK+p5k9hHhOfn8GzOGYzUzc0NDZrZyGahQ\nmNYYhwqjovWGKb3t1whsMi+8ahJ5Fc00B6nyFCPmAdqjOMAYkZfwoQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1smgaynkzdfmhg8yymr49l75cax7fzspgppg2dtjadv269j78vsuqdedhmh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZlFnMndsaUhiRExCT0lL\nU3g5RmR3MURKWjBkZW9SSlEwdzdJZTkvb1Y0ClZ4REY4L3p3TzJQVWZLNU5HY3pq\ndTJ6VTJvUHZxeGpJblB1M2lzS3RmMFkKLS0tIDk4Y3AwMGVya3lSQzNjdWZ5MlRR\nUDhBT2ZMWlRjSG9rVUswRm1kbUpleFkKvD4Hq+jE4Njc/ebNpI470UXIh0xgo5Zx\n/OgUuAf+xwOuhvHthRWlHJuyFHsgtFrz7od0tsOYUOWW+0SEzr7LXQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age13u2jaly7xxpehmh0r9573gzrh5ffcstfx7u7py57lrugm09nxqeqx5w265",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxeW1Od1ZXQzFuT1MxeHcx\nZVJrV2xFR21qK1NBRDZuZDN3cng1RXhsYlNVCnNkSk52QVR5WGhBR2kwWVlESEp4\ndWo4eUhib3N4MjVKSlFuQmduMDV1V28KLS0tIHBOVDR4eTNydDBkZU5GSCtzdytU\nNEJyMGlwWDUydTlKRjAzMGlxZE8wL1kKSb7QTBSK8MsI2QDBZ9U4a5M6J3NLs5/d\nA64LWJXJUNWWApravqBaTWbv3hCS5RbHRb9kXWVYgULxNtudclzH0A==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDcG55cXRIMnlWenFya0xU\nZFJQWlcwczl0aHhzbjFNcnAycXc2bFlCdWpJCk5uU08yU0l5cWFiSm50WWlTWFFS\nSWpMWUpLTkZFMnBFbE9YektVcVZISG8KLS0tIE4zUWlsa1Y4Y1BYMXRJT0VmV1RU\nWkR2SmZsOUd2M3lkRmtacm4waFc3NU0K2AIK49WmpGZJYlRpPVlh+niCRScOZqhv\n6Hn2qqedS32UAZn2V023tFaYknYOwNYKh3KvlH5ACsN8w4hQY+J6eg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-03-30T13:55:55Z",
 		"mac": "ENC[AES256_GCM,data:8p7KLs5rMkKOAKmQ6zjaoarK68XNAQiHY+VJFEMQa6ojTllxdSEr44SH4YC/seUOfCZjvuo8JBV8vtxa28D4ugCkv2LNq8kyCiLjjADwUC5YLRBuW72vAqSdSkDT8V3Ks23Jy80xXVhnYjfylIM0lxvIGKlNIT7xkXDXAEgMTlc=,iv:Jkdz4DQggrolhsrhxD/9edrZERzHzgrp/CZajX9+Kt0=,tag:+nBz0Uj5z1zJg6gTNKFZ6w==,type:str]",
-		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.9.4"
 	}
-}
+}
--- a/vars/shared/moritz-email/password/machines/moritz-laptop
+++ b/vars/shared/moritz-email/password/machines/moritz-laptop
@ -0,0 +1 @@
+../../../../../sops/machines/moritz-laptop
--- a/vars/shared/moritz-email/password/secret
+++ b/vars/shared/moritz-email/password/secret
@ -1,24 +1,23 @@
 {
 	"data": "ENC[AES256_GCM,data:ekeDeTfnR+5hWzJ+VwJ32d2wjiTkasgpvy8EMJkrOpk=,iv:wmMprCQDGxGXLx1YeUe8hj72FlfrZQ1aPIfe4NVK2AY=,tag:mJyNudJzD3jFoKl/QQhOWw==,type:str]",
 	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
 		"age": [
 			{
-				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrek14RER2bngxa0tHT09p\nSnhoa0gwRE9ENXJHVzlNYU9pYVJXZjlzajBZCkd1NkdJVytxTlNCZnhZRUxWWmEv\nbDN0QXd0RkZQWmRQaVZmRG1JWkFhNDgKLS0tIHVBeWJNR016cXR0emdqTmtnTW45\naDBzdjVEdEFlVTNTamJVcXRlVnJPK1UKKq2sq8hrcOw/CDzd7WY/UW7xEdSRX8ZL\nBDhbQxXh7TyCmpKv6UV6/kcPBNAaVUyOX4On7Sxu2x+5EIw3IGMPGg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age13u2jaly7xxpehmh0r9573gzrh5ffcstfx7u7py57lrugm09nxqeqx5w265",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVT1dVTk1vZmYwaVcrNHpt\nTlZraEdOYU1HN1lJVnBUZDk1QWtBUjJ6a25zCkdmdWd6RldDejZqRnQwSjIyU2Qw\nQU9QSWJQNnhXbSt5WXBYaTY0bytVK2cKLS0tIFhnSzM2eVV5WWV5RUpjZHBkdWZK\nVzN6WUxSeWtDbjl0dlBJS0lMNCtDZTAKHzS/xYiCxD0zwFld6ii/3c+USs64MlVp\nOSi/LmPirSD7TSrU2E/iynXoH+crn44G+klvoODS2Si84RR6HqzG0w==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age13u2jaly7xxpehmh0r9573gzrh5ffcstfx7u7py57lrugm09nxqeqx5w265",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3eFhoWkhPTnAxaGl5dU1Z\naHcxNUxJRUdUWDE4cGNIeWxhZGJrVFhEWlFJCllqY0dpSFNzQUsrby9HWEZkM2Y0\nVnI5bXk0MFJJaHZkWXVRTlBJQjREemMKLS0tIHZoc2k4ZDBVQTJBc0w4UUFQaEVW\nR0Ntd3RMZzdHU3c5VTNYSFA4cGdseGMKlpV1zErv0/Vm/fZ6/fi7KmpljsGxzHr1\n1Oj7xR5WWAcW3h9fbHSOIdWHlgPrar6E4iQ7oRA1tre1fMMRFO/QXw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLN1A1ZGhvcUJwWEtpaCtH\ncEhSMkFTWnhKRjZndVdoajJwTXVnN3ZZMUhVCjNuMXFJaVNONjg3a1NwS0ltWXI4\nbUR0OGptdTEvWmZYR2p4Zzl0NDFwdUEKLS0tIDAvN0RpUFgzTElEalVsSmhheENO\nRVhqWTRleUxrNzAzMDRkVUNVQkZWKzAK9hD39NOdHZCBs3ZM35q6rFFmIPpGotcc\nc5r4JukhbqEOBid9rwd/0hB6b3yedEXYE5Sua9uCg5NkC4yQq8khBg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1smgaynkzdfmhg8yymr49l75cax7fzspgppg2dtjadv269j78vsuqdedhmh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0UGJuYWtVR0JSSGl4RHVL\nRkRReDhVSjZtUGpmWHV3UzhhWTk2alFLMlZVCkw2STY2N0dxbUV1TXcrVkhCVFBG\nRDRrWjAxYUUyL0ltTXlMR0lGUDhDa0EKLS0tIHFKWFlUdDBEVXZtV0ErOWR5WFVt\nZHhldC9KSmtacW45bmZwT3JrczBYT2cKXvmlxZ3hJeSCO3kyvqR204wWY0WG3+t8\n6CTfehlsCj60l3cQsJjyQ6DRJm8O66lsKyOw7zPzja3Tt1yQyQVHFg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-03-30T13:56:27Z",
 		"mac": "ENC[AES256_GCM,data:YtTyMg5pp86ikvIM2ivhbzFrIb2p0AISYol117toZzQ5pGSQeEGuLVt9lvQbHdsOayoPbg5BC8cMW5H5fYat8bx0wQu85fBxCxpQNF5EuIvr97ox9LUKRxjjmdh+Ph6kdNtw89OLRKl9GrMnvyHSA1F2uDdMj2gUHpHetjasX1E=,iv:wPqMzgrUM8mTzphtSCZajKOrjoO9Zaaimi8QPnHtj00=,tag:D6tBqkmmNOlhU5N45xK5JQ==,type:str]",
-		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.9.4"
 	}
-}
+}
--- a/vars/shared/moritz-nextcloud/password/machines/moritz-laptop
+++ b/vars/shared/moritz-nextcloud/password/machines/moritz-laptop
@ -0,0 +1 @@
+../../../../../sops/machines/moritz-laptop
--- a/vars/shared/moritz-nextcloud/password/secret
+++ b/vars/shared/moritz-nextcloud/password/secret
@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:uNA9UikV7gu7MZoRO+tSkxuUWEiZHqXm2Pz9vAHKRSg=,iv:ViNggY5RUGCdrVwSZDl2xnxSPhG0d5X9oRqm6unBd38=,tag:rEaMjk2hpByHn4iqD7guYA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPWjcxNUtrTXNRYWtDTmJt\nYTZTNHVzd3NVZEo3NUZocnh3OU9WVzV2YzFvCm9sRkZwZmloK3d3NkJkalpwTFlr\nWS9lZTJNaVdWVld0OUxUTXJBdVdCdVEKLS0tIGtDZEoxUFJ3M29qSmxKYmczSmpo\nWERzZkZvaFRJcFBNMmNRT09oSGljb3MK/pFpF6c5Lx3tz32PWiLYl5SVezM/pzct\nt3j21/UeiOCTEeIC6sxYVP/AY7aK0T16D2/ipLmYaBMWIZ4+zKWBzg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1smgaynkzdfmhg8yymr49l75cax7fzspgppg2dtjadv269j78vsuqdedhmh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkanRqRFdMNjdBYkk3Y0I2\nb09mUFdCMk4vdmZxcDdJWE9JOGYzc0J6ZUhFCmFRL2NDWEFhcmdzYVBPdnFPOU5k\nUzIxZXJMS2tiNmxmbnJINWhvcVRxVzQKLS0tIGk1V2llZmRaOVlvR1VuRnlzbTVU\nd2pWKzNmV09OeXVxanpadlpKMy9vVlEKWQdm5S0BQInz04YuzQqnY9RGNTmsKBrM\nE5XUx3LzIRO3HyUKkTnwyWd3RVFvVhe86RmL5etAh1VTNdI3tebXTg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-19T09:56:52Z",
+		"mac": "ENC[AES256_GCM,data:dRqO3mpErcgE6icMYnvabE7rY1B/Op2z4FWLKjsE38BWHiGRt2Ala6Xwh/PuCACsSke75mR2XwH/trYFzajXPFzrml2OIp8ngv7yZttJB4RShaiJAZWuCKr3IdHpnhNRBewNU+xaV0otCJ0jnLaW15iFaNPhoWiYUwmWnYBXxJg=,iv:9EmW8r8pvT7GThKsoVxawePHpNGtJDJaZYpr/yTDlIU=,tag:iBNIawOTIA7SsCXnScxq3A==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}
--- a/vars/shared/moritz-nextcloud/password/users/moritz
+++ b/vars/shared/moritz-nextcloud/password/users/moritz
@ -0,0 +1 @@
+../../../../../sops/users/moritz
--- a/vars/shared/moritz-openai/api-key/machines/moritz-laptop
+++ b/vars/shared/moritz-openai/api-key/machines/moritz-laptop
@ -0,0 +1 @@
+../../../../../sops/machines/moritz-laptop
--- a/vars/shared/moritz-openai/api-key/secret
+++ b/vars/shared/moritz-openai/api-key/secret
@ -1,24 +1,23 @@
 {
 	"data": "ENC[AES256_GCM,data:V8oXaA/df8rrJm5lM0QBNHSphRh6o/7ezPxPyaStLfEeXDHWrE+I/3Obzj/t8uP+d0tcA1QYlvJmGZo4eQT5c9lNdQJemxBG3joV5Hiu+CWbaL+7ogK6QOeaybpn6wiFoRFENuimnDVoP89nKYPPxHyO22xIBPxWUFB1AkMBAGQeJg3fxMAtcpEhWo3dQE3Qt2e6BwrVnOv9R+89s/sWjAmBjf8=,iv:01SFpB+P1q4kHn8uUyA/3Ih9xfpk6CQvqgIJfMtds18=,tag:PUWukTGby3O8FPsczoNA6A==,type:str]",
 	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
 		"age": [
 			{
-				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3QTVDNWQ2UDRONVBwMlNl\nc2ttZ0MydkhMTXRrOFZXTmt0NlBaUys2Y2lvCnRtRDBEbG84VnZmQ2NBT0R3Wmpr\naGR0YTVjd0VWRm9ranlsZmRJalA1SWcKLS0tIGhFalV6Q2NGRkk1T3RNMnFSRGNQ\nWlFPR01OQlROT2k4RDVOc3BHazdsVUUKS9hSuUXJFxSTT6Sx/HwWbeplXvdxe2BC\nuK7pHFBFZpip98Fcc7SUoRfwb5kPciRLQ1nWf+DLwPbZEfRPbIJ4JA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age13u2jaly7xxpehmh0r9573gzrh5ffcstfx7u7py57lrugm09nxqeqx5w265",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQRThST01OTk0zUmwrY2ow\nN3JvQ1J5K1E1RDlnNVZ1YUQ4cndnV3laYkdnClQ3bUZOMHFuNUNMR041UHFEdHI2\nZ3AzMWlIbEgrZ094NllPOWRoaDdNSE0KLS0tIGtRQUFlbkRGZ0swOEhjdXNXTzBa\na3pwSktEQVFJK3BqM2FTRnUzamxSRmMKO/RDh75euLBXFAfH4096VNT7RU42ayrA\n79sh277aKv7NRIOEh0xHksPt+nlBwpMMpvLOtLPQDw1bWbFPZM6Mrg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age13u2jaly7xxpehmh0r9573gzrh5ffcstfx7u7py57lrugm09nxqeqx5w265",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqeE4wc3Jsd0FSYmdNdU9J\nRG8wNGI1SnNXRWoxK3RGNmZsREFGNCtIOVZFCmxFem9qS09jSlEzNkY0TTFROWFz\nUjczcm1ING5nQUpLdDgrbkRjKzlRZ1EKLS0tIDQ0cys3MkFCNy9pWlF0U09mdUsv\nVnFoSUFCU0hxaUNVRWxkOUh3aHZ2VHMKJwoayLfZyTaB5ttt1K/RtFpZidhfLCxa\nH/QmEYYHRMsRClUtjWhgEnOb+7CxwjUN8CV1/BjiB3BynfItEMmhNg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXNWV4aERBbERMbFVlQ1FL\nV1hJNHF1Z3JZeGZpbjluUnBXdVpOUnh2TG40CmJWQ1FGTUdnSGw4YWVRY0Y4Nms2\nNiszbnlzSzBBZjhIZ2dCRG1kODNrdzgKLS0tIEtuM2VTU05pMkxXM2Y4NkdrMXQz\nSWF2aXV6UkNidXFBYzhOajlCcHlkeVEKDxHFjzumtXqBdzxGfv/VsNxoH99ghQzF\n3nmzz0wub3N+tj7Qj+vJtkxOg++4b9jc25VkaD477x2I7pqXUVPsTA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1smgaynkzdfmhg8yymr49l75cax7fzspgppg2dtjadv269j78vsuqdedhmh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsLzlETWlxa2VjQmRrOVpC\nMmd5YVVoOXVFV2crZFpKeG1zSzgyMzEvTjFNClQyU3lHLzVrWlordXhXSnlpdk4z\nYUxnNnErRmtueEJ5K1M1R2x2OXhCbXcKLS0tIFdQNXdnTlBrTXMxRG5lM2t1YU5r\nMWFucVRJd1AxYUZsa08wNVUyZ2JtcEkKxYca4AsIL6S4RpCM3E49xOfBAdXbS/kB\nVkLy38qnxNoVZmjyP2rleaWBoOaDgBtTA2nIZEv27jLlqq7WSHSiPg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-03-30T13:56:47Z",
 		"mac": "ENC[AES256_GCM,data:hSVqJE9K16BhrXhL7W9JdHBNPcg+oWRD4C4791zDie77XhGt7EoppWQ+u1nhT3gHEaCqr9D+WOpPhvEzbgAHspqIoAdPJwvUpaWZOoGDzsirnrH97t4PC6P2Bp9QtIJ+xpRIwlKxqeGnFCfuNRuQFhkxtqljt60CdQs2+4+mbCs=,iv:sEff+fczI2BsArRTlw6h8mQwkC0jor+hbWFA3Ol7dRI=,tag:nPvVI592gZTEFCTvZg46uQ==,type:str]",
-		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.9.4"
 	}
-}
+}
--- a/vars/shared/moritz-openconnect/password/machines/moritz-laptop
+++ b/vars/shared/moritz-openconnect/password/machines/moritz-laptop
@ -0,0 +1 @@
+../../../../../sops/machines/moritz-laptop
--- a/vars/shared/moritz-openconnect/password/secret
+++ b/vars/shared/moritz-openconnect/password/secret
@ -1,24 +1,23 @@
 {
 	"data": "ENC[AES256_GCM,data:/MVGIg1frJxIQoTEtLYzXCuX+jK5w3P8AV37zTO6vSdfqD+SUrJGVccx40GpP+KSaQ==,iv:OLhclvcp9Q4P1hZM3Pu4yQNz3UBAuEyCS34PIFpAgR8=,tag:wJQtZjJBVo2BWEZWaUbUzA==,type:str]",
 	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
 		"age": [
 			{
 				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCcDcrcHA4TndoaGNYT0lt\nZGU0YUtRbDlDR0kyTUhiMU5kTTkrUldFUEVrCjdEcm41OXdqOExBd3NpaFliT010\nOEl0MTk3bHlYLzcxNzE2cWduTFNPckUKLS0tIHNxT2VRZ3RrK1VKdCt6UkxYU3R2\nOGZES1Eya3BEeExkV25rT0pjdVpaTm8KyyZ5+FOByI2TFs8hUMS8bhsUemdFTd6a\nwq9WOzPwxj7RDYHMJ+P25KLC6vqLs0fdcqd1uSFqJ6zKxMNQPyFDnw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqOXZYbnl2eFVrWFpaSTNa\nV1pXb1lEVFk5Zkl5VVdFTXA4WUVweUpOTjI4Ckh3akROY05Yak5ZQ2dCNERRcUN1\nNGpRdGJXU2hoM0FVdFQ4YktzSjRzOTQKLS0tIElzODVpU3g1U2s2b1ZLUDg1cjlC\na0Q5bjFPc2tpbkZibDhwSWw3SzlScTgKe3CNGfWJerptKFdwTNsOigjpTIxz3ZO3\nPErjF97FubIc0yok/QdHFs/i73Ut7UNoH5urxqZKBDFrt5NFa/uLLw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1smgaynkzdfmhg8yymr49l75cax7fzspgppg2dtjadv269j78vsuqdedhmh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2cVM3STBNa1NhNTEzUUd4\nK0h1dXhQMHBJWVNEWWlHYTdObE9ZZit1Q3g4CkdncG5xSjZDLzU4NkhXdDd4Zkx5\nMGh2RDFMMWFucHhtbDlqVjBRTTN4TTAKLS0tIGt5SFhaUWVSSkJNc2ZGODlGUkQw\nRXBzR050T0psUjBIYWVpTm1vMHJBRzAKfPF/YzddzaTMsfSG7ScZSzenjwyxb8BU\nefZ4m7bIUl3co6/3002LENV6MFJiac9YBzd6xJwqBOZ7I8HWvK1RHg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age13u2jaly7xxpehmh0r9573gzrh5ffcstfx7u7py57lrugm09nxqeqx5w265",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2VnlhUVBxN2lwNDc3elhM\ndjF6Zm0vSU9jN2RudXZvUjE5L2ovTHl5MTFrClh6ZlBtc2tBbjNrcDgrWXAxQVBB\nYy96NDVFbktFQ09JdDZrMjlmemJzbzAKLS0tIEVFM3p6THdJMzRzcFRsZGhjUzJk\nTUZZNkRUZEg2ais3SDBycnJlS245ZVEKMEC9TcYM4C06ycEE76CD7V1I9BJMqeqi\nNdiZwqfEwS/DbAGDmPAnLX8exue1rHdaN3xEXR1im56xKVcZoiZBLg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4djVuUFhlYng5L3kzZXVN\nSHkyZ00ySHlJZVNhekRhTG1mNUJOVlpuNm1zCjFybllJNk1FbXREZDVpU0xJSnZp\nQ29hazVkQWxFb01JWm5KYkF2ajdocVEKLS0tIEVqYjlmREptMkNLT0lhM3p1bkZy\nZmd3OU1YOTUreDBWNTFSTitQdUxVS1kKGN3PUbp1b+PvEOB6WjcHXqKsy7lZN2s0\nJ3Va5zMu5F1zC77vJDT17FEZ5S4VtVXosmOdOxlpDH2CxU9UyBzolQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-03-30T14:04:14Z",
 		"mac": "ENC[AES256_GCM,data:pYzz5BZQu+zXK2olJp9j2HpZXGd9tAA4G6uVCu88dlM08ysOxo86cbRS2yOU0ttEG2GPi5227vkVQtFYVfb2RZ4PhWwoFRhyQI86oqoIPeK9GcvSdIRXINrNgcIQpIpCg/LNzdBH3PRCAlrY4YPT9+qejnmov64TQOIdF1+xan4=,iv:PZ1DLgoNhL8yAcTlxTg0tuBUQ3EWwMuJDWVwC8nxLZc=,tag:EPCPqcXoM6WruOsnd425Cg==,type:str]",
-		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.9.4"
 	}
-}
+}
--- a/vars/shared/moritz-wireguard/preshared-key/machines/moritz-laptop
+++ b/vars/shared/moritz-wireguard/preshared-key/machines/moritz-laptop
@ -0,0 +1 @@
+../../../../../sops/machines/moritz-laptop
--- a/vars/shared/moritz-wireguard/preshared-key/secret
+++ b/vars/shared/moritz-wireguard/preshared-key/secret
@ -1,24 +1,23 @@
 {
 	"data": "ENC[AES256_GCM,data:5TY3YhsCVOfOCZRDRC11Fn26hFDDnj8SGDDKvpHLfhGPZ3jvXTQkTJ7Irt8=,iv:vCZJsKg5xfxwWS5N12BjmqP2UU/HcpXDVFmN8VWidn0=,tag:pgsmygwbTzfxYIk7wyIeFQ==,type:str]",
 	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
 		"age": [
 			{
-				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLRGlLOThIMEc5SzhHNERo\nV29iYy9Xa0g1NUNRd1JDNlJLQ3ZSc0E3K2prClJncCtrc1RDbFpLZEc4S0E1UWgy\nVzJqRGhmT1YxQ2hsTzlpVEU0WTZjWmsKLS0tIGh0WHBIRkc5L0xlSGp1Yzg1bEcy\nc09DbUdsRG1TaEF5QUFxMWpPRERneUEK87OFG8LoIU1bquvoM/wz5GCsXTDed94C\n0jn6QVcoAxhrfaMfkj6VH6lLRNDDtDXPlX39B7iuqI+tP9MUiCwmig==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age13u2jaly7xxpehmh0r9573gzrh5ffcstfx7u7py57lrugm09nxqeqx5w265",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBISlg2cFo2c3VxMWdhWEdx\nZWluVlBOaG5HUDQyRHU5dWd4aWh5U2pzZlJzCjBOTE1TWkhRRnlxM3dSNDQzVGxZ\nN09qUy93cVdkRjY3cm5yNzNhV3hZR3MKLS0tIGUySDNNQ0N4SHVEV3M2dS9IaU4v\nR3Zxdy9oRjMzL1ZMenBUN0FrcDI3QlEK/gHDNzEX75r76RJFXp/DyTJV432//3ky\nYrIg4cWh+KjELo9l8OdCalO/5UmVOqQbjpjCZdhOatPNij5/1xqtqQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age13u2jaly7xxpehmh0r9573gzrh5ffcstfx7u7py57lrugm09nxqeqx5w265",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAreWg0SVVEVTZFMkk1RjNS\nU3c0aGhyZ1F6OURHNzZRVGQ5OEJNdWdyZW5ZCkZWZS9YcTRGV1Z4ZTEyc1lTancz\ndkU1VlhMM2RNSW94Sy9jK1NMbHNLMTgKLS0tIFZmUjdyL3VndlM4TDJpVUhzdVR1\nRUpQUUx1Zm5nVTFxTDB2bkVpaSt4T28KMZXB9yyzePiC5NvcamCCZwqSdihAAaIE\nvKRNm1cEZBifpcHihitQln36iWbFqN3HDky19uFPBvN4pl7PKNI6Bw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQUis2enVuOVUySmZBSUx4\nYUpZcm50VlZGRkVDYkxKaTRhT0pTUFVramtjCitHV2Zld0tSVFNQSkcwanhLam9N\ncVNpTUtIM3Yzd1ByTzVvM1pOQkgzOG8KLS0tIHFaOFVHcUlESmRvb0s1TUFpSEJn\nL05RUTM3WnFSaTJVV2tEV3o4Q3dBbGMKX6GBLMQETWbVbwgVYz+u6k1H9jAIBZZ/\njWDzZ7kc0gBfhwb8YWdO9xGfI16ulx83Eg4QbzzKcxytouuQn70wAQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1smgaynkzdfmhg8yymr49l75cax7fzspgppg2dtjadv269j78vsuqdedhmh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjb1JNZEx0b0JWZWlOQU0v\ndjNTWUNhTXFHT1ZGVDIrV1VoY0tGeVlsOG04CnNMZ2RTSklFWWdzdEZtSHl4TFlQ\nREtKbjdSM0I5T0phV1ZYWGM0aEl5R2MKLS0tIFVzb1RuYzhsQ2pXTk9BVTlXMHpi\nZXNRMW8xUm54em40aUFXSWJIQVJ2OUEKN+vYHEPhrin066NojUmwZJhIaIw0MLRs\nIyfXJ0y7X5IB7iN1YV4Z9Rmn1VFP35iYdaQaTyspoU63MIpRkwx5oA==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-03-30T13:58:43Z",
 		"mac": "ENC[AES256_GCM,data:GmH/cw//gfbzVfe91v/1CBs7eH3ui0EpI3HzeEspzZUL0WWob44T3DxeRPfIKPAmehV0MPjMQqWzPE/ZfVOm77lBpBxOjs/ejlvL+pnlSt0cRaYSfb0dcv6cTC9QXPyCmEkguHp0nL0x46UQidwWpVBpA2I8Uwxar7xzh6b7hv0=,iv:ediYZeREicKfr42gxVdJE/GGz+s0pRtGeX2dYFjUJlg=,tag:RMMhIurnYreU27iYNX3lUw==,type:str]",
-		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.9.4"
 	}
-}
+}
--- a/vars/shared/moritz-wireguard/private-key/machines/moritz-laptop
+++ b/vars/shared/moritz-wireguard/private-key/machines/moritz-laptop
@ -0,0 +1 @@
+../../../../../sops/machines/moritz-laptop
--- a/vars/shared/moritz-wireguard/private-key/secret
+++ b/vars/shared/moritz-wireguard/private-key/secret
@ -1,24 +1,23 @@
 {
 	"data": "ENC[AES256_GCM,data:AL/UzwRC9DQr20NZ+Rg0Dz1nIqA5UOig07wRqHyHrJ7UETLHCYblo6S1R7o=,iv:O3tpCTiVQN6C+h+CDFIKq5PcI2cT4DjydRKy+XSQfPA=,tag:3Z5R7Vj0YUER5HFJPmG8uw==,type:str]",
 	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
 		"age": [
 			{
-				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2SHpST0wyNEtiL0pkQ1RD\nVEkvV0tZSFMrWmNFSWtrejRvUE1WZksrTWowCmxvSUNrcWRuTDJ6TFg4Zzc0Vkww\nMVdUM2hUZE9ReElsRmVsaWZyS3JWYzQKLS0tIEhNa2JYUGFEcXJFdi9JN0tzanBL\nbGUrU3lvdk1kTEdUUnVadDVzbTloVTAKMebVSVUxE2WQO+CQqT4zZ5yOl6lGvryy\nPGvpj6OpUWvBlAD8Pig9YjY9ZyzK9mwNv8hHb/5rAxG+gszm7wMV/w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age13u2jaly7xxpehmh0r9573gzrh5ffcstfx7u7py57lrugm09nxqeqx5w265",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMS3JKc1ZUYkY4ZkFUT1c2\nUkVab2tJQU9tOGl3dklBVVNEb2J5MlNSVlJzCjQwVFhEYTJFbTAvNXA0TURxbWxv\nY3B4Y0dBdzlhUC9SZG0wRGI1c2Jva0UKLS0tIDdXOVBjM05TZjg1bUEvNUsrNE04\nQlhjUzhrcUEzUWVLNVQ5NExra0FQeUEKFsvfO+Wi6MX3Jw2IoJDb+yxhFxyG5qQL\n5TEiA6W+tCgd5cW3fwYq4EFapoJcE/UOJYElGZKA/KFHCHZ8Bs4g4g==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age13u2jaly7xxpehmh0r9573gzrh5ffcstfx7u7py57lrugm09nxqeqx5w265",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxT2Zoc29WRGcxY1FqRVVX\naWsxSDRXQytjSTk2UDlYUDhIZENMM1hZbTNZCkZrSjVNb210dHdQMFJIOXZQY3Mr\nV0lyRjFuYkxUb29RSHFtdFcrNVlNckkKLS0tIENpbFV3MWhqQlE1b25SR0p4bUxH\ndGlVTGtoNUNtc2ZRSVR2czc0dTdkSVUKQOwSg7hq3xVdTgp91L3OCoancPKtfNHv\nzCkoLZACNzfmB9Sb9ngI+Sq4IPYnVGeFemnSqeVgZHm6H03kyDLexA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age12jlzcjwwhtgws4ku4nemwknsps3a6um74kdpxfv9pzvgdlhufp8q08c0j7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSS2tlaFJ0N2RJTzdlV0xR\nV3lzdXpad1NzaFFvdWlyRkc4eEJiLzBGTmhVClFsVk44MTgrSzBHYU5OY3UxdUlk\nTXAvTkpVcS9pcTRMdGxVYnI5R09razQKLS0tIDZwRWgxSDBzY2tQT2pNMkhyV2Ju\nM0RmMFIxeUF5NW5FZDAyWWo3QW9CczQK3gV2LaYizEMutTauJpi2HeSGaWedTDB+\ngfj4gvZPxKTkjJJX48fn650rmL4Os6t8C6XX/uKlNEarh3q5Zwm87w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1smgaynkzdfmhg8yymr49l75cax7fzspgppg2dtjadv269j78vsuqdedhmh",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTL2RFV1p5WXVkRGI2bWNa\nWDI2M3pkL1ZidlpwK2lJUXJGb20ycm5OOGxjCitDQjM2SVBaMUJSY2lXQ0tYbXF6\nQklZajBlK01qRFQ1UE9sU2pZZW1UL2MKLS0tIEJsd3pSSTFabTRadW8rS2dXb1gz\nb2xGOHdacnA2NFYyUDJLdTNTK01YOGsKkFSxv5w+ju7om5qvhCV+/LxPvlx3lYnq\nyfUqIofDMKU298d9mBJA+/4n1n+IkwxDoHKZyo+A07mOcLObFL2Ing==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-03-30T13:58:44Z",
 		"mac": "ENC[AES256_GCM,data:WqHNGdMyso+LTKCEYjcTEFbsGIJEchUEnyog2nZXzZE4p2RM8sP3IEDLkyqwDqGt86IGV8N9ug8sriVJRRBdGhNNIYJDhCaJEDYUoD50tJwMVbLSHGRtzkp5BY5Y8Kwc+rKJLvbFir2yIJMEWY3Qut9Z2rXtSU6MmjAuX3SgIIs=,iv:ohhIZFTlBaf9467NnWUXuM1PGBWzPDU0ayKKrg/RueY=,tag:ohkYVRfuiqyFocLKP1CCOg==,type:str]",
-		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.9.4"
 	}
-}
+}
Author	SHA1	Message	Date
Moritz Böhme	bdefe8ccd3	Update facts/secrets for service zerotier in machine moritz-laptop	2025-04-19 12:19:30 +02:00
Moritz Böhme	39d9834a2b	Update secret moritz-laptop-zerotier-identity-secret	2025-04-19 12:19:28 +02:00
Moritz Böhme	51f625aa17	Update vars via generator user-password for machine moritz-laptop	2025-04-19 12:19:27 +02:00
Moritz Böhme	abf1209b47	Update vars via generator state-version for machine moritz-laptop	2025-04-19 12:19:26 +02:00
Moritz Böhme	84b826a52f	Update vars via generator root-password for machine moritz-laptop	2025-04-19 12:19:25 +02:00
Moritz Böhme	f5c3b2520e	Update vars via generator openssh for machine moritz-laptop	2025-04-19 12:19:24 +02:00
Moritz Böhme	49884065a0	Update vars via generator moritz-nextcloud for machine moritz-laptop	2025-04-19 12:19:23 +02:00
Moritz Böhme	a34fa7898f	Update vars via generator machine-id for machine moritz-laptop	2025-04-19 12:19:22 +02:00
Moritz Böhme	a48c0c3dde	Add moritz-laptop to secret	2025-04-19 12:19:20 +02:00
Moritz Böhme	001b6a6327	Add moritz-laptop to secret	2025-04-19 12:19:19 +02:00
Moritz Böhme	1dd17fbbc0	Add moritz-laptop to secret	2025-04-19 12:19:18 +02:00
Moritz Böhme	63f8ee82f4	Add moritz-laptop to secret	2025-04-19 12:19:17 +02:00
Moritz Böhme	a930b121e0	Add moritz-laptop to secret	2025-04-19 12:19:16 +02:00
Moritz Böhme	f56b321cd3	Add moritz-laptop to secret	2025-04-19 12:19:15 +02:00
Moritz Böhme	51ab6ae76a	Add machine moritz-laptop to secrets	2025-04-19 12:19:14 +02:00
Moritz Böhme	3470a98537	Update secret moritz-laptop-age.key	2025-04-19 12:19:13 +02:00
Moritz Böhme	9873148fcd	feat: add moritz-laptop	2025-04-19 12:19:11 +02:00
				`@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxM1EucXBzhDNyWi9AjAPcIM5W5KE5JL5EWyDw4Nntr nixbld@moritz-laptop`
				`@ -0,0 +1 @@`
				`../../../../../../sops/machines/moritz-laptop`