ctucx.git: nixfiles

machines: move `wanderduene` to new host, keep old host as `wanderduene-old`

diff --git a/flake.nix b/flake.nix
@@ -49,6 +49,7 @@
 
       trabbi           = import ./machines/trabbi/configuration.nix;
       wanderduene      = import ./machines/wanderduene/configuration.nix;
+      wanderduene-old  = import ./machines/wanderduene-old/configuration.nix;
     };
 
     nixosConfigurations = (import (inputs.colmena + "/src/nix/hive/eval.nix") {

diff --git a/machines/wanderduene-old/configuration.nix b/machines/wanderduene-old/configuration.nix
@@ -0,0 +1,85 @@
+{ nodes, config, lib, pkgs, ... }:
+
+{
+
+  deployment.buildOnTarget = false;
+
+  #this enables the following services: dns
+  deployment.tags          = [ "dnsServer" ];
+
+  documentation.nixos.enable = false;
+
+  imports = [
+    ./hardware-configuration.nix
+  ];
+
+  dns.zones."ctu.cx".subdomains."${config.networking.hostName}" = (pkgs.dns.lib.combinators.host config.networking.primaryIP4 config.networking.primaryIP);
+
+  boot = {
+    # Use the systemd-boot EFI boot loader.
+    loader.systemd-boot.enable = true;
+    loader.efi.canTouchEfiVariables = true;
+
+    initrd.network = {
+      enable = true;
+      ssh    = {
+        enable         = true;
+        port           = 22;
+        hostKeys       = [ /etc/ssh/ssh_host_rsa_key ];
+        authorizedKeys = with lib; concatLists (mapAttrsToList (name: user: if elem "wheel" user.extraGroups then user.openssh.authorizedKeys.keys else []) config.users.users);
+      };
+
+      postCommands = ''
+        ip link set dev ens3 up
+        ip addr add ${config.networking.primaryIP}/128 dev ens3
+        ip route add default via fe80::1 dev ens3 onlink
+
+        ip addr add ${config.networking.primaryIP4}/22 dev ens3
+        ip route add default via 89.58.40.1 dev ens3 onlink
+        echo 'cryptsetup-askpass' >> /root/.profile
+      '';
+    };
+  };
+
+  networking = {
+    primaryIP    = "2a03:4000:66:f61::1";
+    primaryIP4   = "89.58.41.187";
+
+    resolvconf.enable = false;
+    nameservers       = [ "8.8.8.8" "1.1.1.1" ];
+
+    defaultGateway  = {
+      interface = "ens3";
+      address   = "89.58.40.1";
+    };
+
+    defaultGateway6 = {
+      interface = "ens3";
+      address   = "fe80::1";
+    };
+
+    interfaces.ens3 = {
+      ipv4.addresses = [{
+        address = config.networking.primaryIP4;
+        prefixLength = 24;
+      }];
+
+      ipv6.addresses = [{
+        address      = config.networking.primaryIP;
+        prefixLength = 64;
+      }];
+    };
+  };
+
+  ctucxConfig.programs = {
+    gpg.enable    = false;
+    ssh.enable    = false;
+    git.enable    = false;
+  };
+
+
+  system.stateVersion = "23.05";
+  home-manager.users.leah.home.stateVersion = "23.05";
+
+}
+

diff --git a/machines/wanderduene/hardware-configuration.nix b/machines/wanderduene-old/hardware-configuration.nix

diff --git a/machines/wanderduene/configuration.nix b/machines/wanderduene/configuration.nix
@@ -45,17 +45,23 @@
         ip route add default via fe80::1 dev ens3 onlink
 
         ip addr add ${config.networking.primaryIP4}/22 dev ens3
-        ip route add default via 89.58.40.1 dev ens3 onlink
+        ip route add default via ${config.networking.defaultGateway.address} dev ens3 onlink
         echo 'cryptsetup-askpass' >> /root/.profile
       '';
     };
   };
 
   networking = {
-    primaryIP    = "2a03:4000:66:f61::1";
-    primaryIP4   = "89.58.41.187";
+    primaryIP    = "2a03:4000:4d:5e::1";
+    primaryIP4   = "194.36.145.49";
 
-    defaultGateway  = "89.58.40.1";
+    resolvconf.enable = false;
+    nameservers       = [ "8.8.8.8" "1.1.1.1" ];
+
+    defaultGateway  = {
+      interface = "ens3";
+      address   = "194.36.144.1";
+    };
     defaultGateway6 = {
       interface = "ens3";
       address   = "fe80::1";

@@ -135,7 +141,7 @@
     '';
   };
 
-  ctucxConfig = {
+  ctucxConfig.programs = {
     gpg.enable    = false;
     ssh.enable    = false;
     git.enable    = false;

diff --git a/machines/wanderduene/hardware-configuration.nix b/machines/wanderduene/hardware-configuration.nix
@@ -14,18 +14,25 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/2aa59099-e383-4a66-acfb-37cd85d31d64";
+    { device = "/dev/disk/by-uuid/8db47ae4-c5e4-4297-aaec-31a6669f4dc4";
       fsType = "ext4";
     };
 
-  boot.initrd.luks.devices."root".device = "/dev/disk/by-uuid/8d24523f-4d43-4354-a46f-de7a449e1ff4";
+  boot.initrd.luks.devices."root".device = "/dev/disk/by-uuid/3b1fb60e-e443-4cf8-b5ea-acb5a502e3bd";
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/0A3A-948D";
+    { device = "/dev/disk/by-uuid/D496-A891";
       fsType = "vfat";
     };
 
   swapDevices = [ ];
 
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens3.useDHCP = lib.mkDefault true;
+
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}-
\ No newline at end of file
+}

diff --git a/secrets/passwords/leah-at-f2k1-de.age b/secrets/passwords/leah-at-f2k1-de.age
@@ -1,15 +1,18 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBENTVmaGw5RWllaW9lUGFz
-QnE4WmpzNExNRi84Vk4rbmVGVk04SkQ0NWtjCmhmeHkwczJPdDlud05ldDBXSCt3
-QVNNcU5TdXV2OWlXcFFvcDFUM0RwMEEKLT4gc3NoLWVkMjU1MTkgVjB1VXJ3IFZY
-KzVXb3Jab1A3OXlLMlRZaG9KSkpwZWJzS2RENDMrRDNLZW54WDh2MUkKUGw3dG9Q
-YUxSc1BiaUwwNXVPbTRyMWtpZE9mRG9TaEtZYWRCUFNuMTdJZwotPiBzc2gtZWQy
-NTUxOSBaY3hiNmcgQjVPNXh6Rm9KZEF4QkROSnRsaXgwSDdPWG1SMC9rRDR2V2ZR
-ajNVVTJVdwpiclVoZXYyTVB3MUxBSlh3bGd2M3Nvb0VveWFlRkpXbnJLZTI4ZUMx
-SDhvCi0+IHNzaC1lZDI1NTE5IDRoS0NNdyBtSVZmZjI2MnNubERQaHEyV2dvMExS
-d0RqcVVwbVVjU3pXdml3c3d2M204CnJXMEdSRjVTUDVFNmZkd3EyNFAxRUpWUVEx
-RWtudVppNHkwcjRLM1VkNEkKLT4gQj9vUS1ncmVhc2UgPipzQVMlUlYKMFp3cmky
-ZDFMaUhWWGRONnYxLytVVzFmMzNydHBnCi0tLSBKbWVuR2Q1bWtxZ2ZrcWxTL29C
-VEM2d0ZUa2NRMytURnNmUVRjOVUxWTFRCmsd9q/50cLvFUsZQlRtD3MsYJVo7QAI
-lwPIEMsQ8QqkrRBvhLMPy2jaJU6V4YpxakY=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5K2psUk4yUnpnQk52cFFQ
+bjlqdnE1a3Y1d3lWdk92eGt6bUNiTzNhY3lFCllXampJU3hmZXpCV1hGYjh3NkpD
+aEEyRDNheFNTRk92R3NDMkwxMC9WSWsKLT4gc3NoLWVkMjU1MTkgcThvY3pnIHNn
+THYwTUxydzQzMk50WnUxYnlIR2Y5UjlkNTZ2dmg1dnJkTGhJdXZnbFEKQ3hPUlRQ
+VDd6UXY2bWtMMG5qYkhnK2FxbVd4UzBGcU16SnVUZGdWMlkwNAotPiBzc2gtZWQy
+NTUxOSBPSlFWRFEgcE5LdDhmbFpFcml0djZjOVhCZWpqemwrOTAxbGw2c3VJYXlk
+NUplejhsSQpON0FtUW85QWJ3MGt0ejBUK0tJNGpDQWc0a1MwZHpjNDVvZDRSV2Fs
+Y3pnCi0+IHNzaC1lZDI1NTE5IFpjeGI2ZyBZTFErYnlyS2ZJRWZFUktURHVPQXZ5
+U1owLzRRM2lUVzUvMUhZTUhvRXlzCjV2UnV1bnIrR2lqWFpPV1ZSd3ZKZzJmWHQy
+Um5CU2g3UDJMU2pOSDNwZU0KLT4gc3NoLWVkMjU1MTkgNGhLQ013IHdxSUZSYm1j
+VkJWUk5PZEY2a1ZpSzd1eDBmS1NhMHI5TVZJUE5rMUk3U2cKSVhCVTg2YnQxVFZB
+YjlCRERUNDdvUzJvK1NTdzRkOFJFbHhEV3llN2pRWQotPiBiWV1dLWdyZWFzZQp4
+blZySnNnaGp5ekFYN1NiUUFKV0g2aUZGRjhFOGUwY2dLTXZoZ01hdVpmaWRSeXAz
+c2N5NmprMmNnCi0tLSBrUEpTVzBLZUloMlNuZStrN205dWlqcFJteHVTYlJlZXlD
+YzdhM1NlUEs0ClqlTiJm0VEqoqdXcDoBTsOAvwOuctTy+xI2OE/hJtgI+396VbWN
+bGxuJpO2Fq+zXRA=
 -----END AGE ENCRYPTED FILE-----

diff --git a/secrets/passwords/leah.age b/secrets/passwords/leah.age
@@ -1,20 +1,22 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvaGI4ZVhoSGtSSVo1NGF0
-b25nNFIwaFk5RDA5RXlrbXdRdjluME8vaDA0ClhMb3QrMHRUcFJSajBZK2RZV0o5
-TmxBNXhBTk0vRmhlZXN4bmRPMHBPQWcKLT4gc3NoLWVkMjU1MTkgVjB1VXJ3IGYy
-MWtza1JOOUxpdjJRVk9hUThRcnJGSzVGelRBQ3dkbDYzM0p5ZVBVZzAKdmxuNEE4
-M3Rselp5U3BPdnR3Q0FCMWtid3N6amxNejcxdFZiV1pTeVRnUQotPiBzc2gtZWQy
-NTUxOSBaY3hiNmcgL3F1cmdIZEEzMis0TDgyVk01UURWenNtcjVZb1ZDK0dZRWJC
-dHc4bkR4bwpHdWZVZFlobk0wT3JoVG5ZQVA1UE94YWFzMnkvVStOYlU1WXkxYlJY
-WGhnCi0+IHNzaC1lZDI1NTE5IDRoS0NNdyBETjJRaVkzeUlXa0lwczU1K0FpaW8y
-RWxPdjNlM1dVcjlBVURLY3JQcWk0CjJhclZBS2ZNMGxGdXlHNTZieXY5a0UxZnp4
-MmUwTTkvUUM3UlJoY1hXbTQKLT4gc3NoLWVkMjU1MTkgVkVVRUNBIDlDV2R3aGhp
-dWpLMU4wQ2FESURFcEFHRTNPL0crOW80NlhxTHo5U3J5QUEKWk1yT2orZkRYaVU1
-MTc0V2ZMdVRsU3pOVmpHc1kyRTI5T1JnVUN3Z29nZwotPiBbWjVUVi1ncmVhc2Ug
-cTJIR2RiKiA+J0dwbCBIPkA+TWYgRCxSNApDemlwTitsTHptMGZtZExKdklyTDRa
-bE1NZCsvSDUvSDIwcEFhMklHMGcKLS0tIFNpZXByNlFNK1JMT3ZHWjFFd3IrUlBx
-THNiWVkwaEhsZWc3VTFaZHUxNlkK0QXx5BCMqowhSa7V8C8Hk88QirPoOv0I3fqm
-KCSw8qgIuzMYKNIH4uX8JeiFci5VACyve9Vy34H+MrppAbfpUw1vFGjOgKPv+g43
-xWJJ0VZCQLDhg0c70gu84jdQ9LmPx1ATMtxLWD9XpRvVK44ykq856AR/579XPdGY
-ZXyrT7NN/XtOoqm9Sh6w
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUbFlqTmhlaWUzbzZibE9H
+cEFnRTNwRXNQcGpTRTJhRitpYUdFU3l4aVhJCmVPSVAxQ1RVQzFmYlpYV2dOeGUr
+aFY4K0ZpUmxIR2EwY1N4eFZ2aWFqMUkKLT4gc3NoLWVkMjU1MTkgcThvY3pnIGU2
+VGlYeFFJaGg5UGxmS2NERzVLWUVtNXVLRGdRZXdEaGtOak12bmtFam8KOFQ2dWVs
+N1J4a09abWJZK09EL0dDeCtkQmtsR0RrdjVCRUV4aXIxZ29NcwotPiBzc2gtZWQy
+NTUxOSBPSlFWRFEgWWtTLysxKys1cFNkcDhLNGl5ZmFVcjZ1SytKVmEvKzZ1YTBm
+aTVTa2J6RQpMV0ViU210M0xXVzA3VXpLOUNTQ2NKNkQxUWY2Q1QycDUybjF4MEF3
+NXhJCi0+IHNzaC1lZDI1NTE5IFpjeGI2ZyBLR24yQ2xBb1NrWWxnL3ZqVzBKQjN1
+OVE3eUt1MFM5RGFFcmZCTHZXMjFNCm9JR1p0WTRZdDhEd0xRRnZCcVVVNWNqZkNQ
+NmhWRVhrb0ZWOEVGak5PTzAKLT4gc3NoLWVkMjU1MTkgNGhLQ013IDlScG1tRXNP
+QnFXL0Nqa0J5ZFpJcm83V091ajQwNHdSUXlBejhtbEVyelUKajVCSmJhRjlkV3RB
+MjFINENJT1NVdGlkVUdQa0wyQ0xZaXdFL1h5Ull0NAotPiBzc2gtZWQyNTUxOSBW
+RVVFQ0EgeSt6M0FQRHFCL2I4S1NVNDluNXRIczNGcDZkWlkreHJMSzN3Y2V2TkdE
+awpWa29VWjVCMm16Vkc5MXp0TTVxTW5sSk40ZnZnR0JLbzJwR0ZtOWxndlJNCi0+
+IGFmMVYwLWdyZWFzZSAyI3sgaUh2IGMKeWhtQU5nbUFFYms5TENxQmk1bTdrV1N6
+a3k0TXJocFd6T3RUWk9IazFXR0JYTmczazA1WUxHZkdCTFJ4Ci0tLSBrMElyOEJC
+YkUwYndrNnBaSDdpMEUwV0lkdlFZaUEzRzl1eVpHMVdZeGNFCqhMMjjwf3gF9RF4
+k2sk8+6XslISMs5YgFqq+i/qcXpRv0VuxG8ZdjvM0goj72mpU+waJ0C7hp7V0Zc/
+46iLLoDlWikKxVbiN5zxzSWCk4CFpeJ9Cwz1O6Xqv2g25ocx5ghPHsNzOr09seL/
+Iklrwp+jYc4pRAlYdLVehId8aMonJszUEAxcETVpIQ==
 -----END AGE ENCRYPTED FILE-----

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
@@ -8,11 +8,12 @@ let
   briefkaestchen = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP6TmPYuTFIVnLZx6MxnGcRkxC6fRuEqKlLQjMmQHHkE";
 
   trabbi          = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLBBZJ9/644d71E8A7IFU7dvDHI+OR/7q79KvqmI/i/";
-  wanderduene     = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEff3QkAesMYwquc49H5e2CjRH9Dv50/DjzqpCw97lPQ";
+  wanderduene-old = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEff3QkAesMYwquc49H5e2CjRH9Dv50/DjzqpCw97lPQ";
+  wanderduene     = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH8uAvUnwhg3pnCdaaoclWDKV275SyNSyrkJON+R5Boi";
 
 in {
-  "passwords/leah-at-f2k1-de.age".publicKeys                        = [ leah trabbi wanderduene briefkasten ];
-  "passwords/leah.age".publicKeys                                   = [ leah trabbi wanderduene briefkasten coladose ];
+  "passwords/leah-at-f2k1-de.age".publicKeys                        = [ leah trabbi wanderduene wanderduene-old briefkasten ];
+  "passwords/leah.age".publicKeys                                   = [ leah trabbi wanderduene wanderduene-old briefkasten coladose ];
 
   "restic-server/briefkasten.age".publicKeys                        = [ leah trabbi briefkasten ];
   "restic-server/wanderduene.age".publicKeys                        = [ leah trabbi briefkasten ];

diff --git a/secrets/wanderduene/rclone-config.age b/secrets/wanderduene/rclone-config.age
@@ -1,22 +1,24 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXdFdMUGQwZ0ZqMWs3U2xB
-bjYwajFzcnV1d0NTdGdzNWJrdXlCcnJHTEdNCmpwNTVUdnRXWTRwd0Q4VzY5OG5Y
-V3lFV2dmMk9qT3JSbGNzeFJaN2l1ZHMKLT4gc3NoLWVkMjU1MTkgWmN4YjZnIFZF
-am10Zm94V0ttTEs0ajcxSVlQaUFvcklyZmlGb3FhUy9OdVUycmk4aG8KZlN4ZzA1
-NG0vZ01uL1U5YUtKSWZMWElibjFjMC9iTklRa0VadGVTdXE0MAotPiAiSGV7Ijso
-YS1ncmVhc2UgJ2xIKVVpayBgMns6SzUgYlghaDFwL3EgTF04CmVaM1MKLS0tIEQ1
-eitaTjh6clhoYkdrSTljSVAxS2lGR2o2Ny9DOExnd0FIdXV0VmlWS3MKL3sD/faH
-lujnn2ENXhEO2IOEtKn9E6jZ11wsgVCsjRfGPrSBP6cbZCLR4C2/jXCXZgdL5Exe
-NVj3kae0mrQa9gbtBzCalpYBU/zo3aFAQxyKCav4H3GFGu+vzDBGhJrdUbwp8Dyl
-SPYQZIHtlfk0l8FF1/HoF5ltUSPUFyaLBtmeiewoo/mF7EQggMxYShgJ+SOYpDTG
-M/W0vjEWLJ+1ehMyWe4VNW5iiLX0NjwKjZFLfQqIiuw4kc3x5msKWLEJezzyMULA
-ysVBVHj1DfvD15xpuMvEal98VtMlXg6sKB38RorWD9mpN/TFSS/ETH4hsZv5gONf
-iz5OqX+2y6O7CMkDPc336TkPKYYoDScMZQKOeM9+iSlHd0hScJMa7GqPp3jJMxU1
-pRwqAeMIASdMgIzDmgNLEKAJWDZelzAJwteNPbiVyWXpTxaLWo5UKtrb5Xz1k8N2
-kETy8P4Qq1jX9+oSBJPj8mgl/AAEMQnY+pgu5TiBzztSQU9yHAySsNTksEVCHGOI
-kiPOKAOWc1SacDyQxCmuani7w20Z+u498QcFqDxc42kxsIjkzAS1aM7Bqaa7puav
-F8sx5JUf8xcdiqVavTXAR0T5JYJfY5297b2U3/PJTJGTuIPdbULWn8aFMJk0Qnya
-UgteHRRwE5ARZSRhe3RRjWIhBGGqFz1IIIw+pVNE9vd1OjYuIFs7hVOGs3UtHnnK
-8SAjuzAX9m8M2rV2mrUkNr5Sf2P41uYL71WMu/4TaA5i3e8op646Xfhr4wGO7C1T
-ggmQ9P9UeO+bSbLfoJOldUbM4NcN7ss=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmVVV1Q0hLeURQb2xLRGhL
+SExkdUp4RWF5a2RuOWVqbnFJajZYR1kySlEwCmkxRG9iUFJxZWs5YjJmbGVJZkdQ
+NFgvVDIxS2NOQjVzWXFxZjR6K3A4ZzAKLT4gc3NoLWVkMjU1MTkgT0pRVkRRIEZE
+UW5yL3ZlMWJFYzNlci80TUFFU1dPS3hmczFxVzZJVzdCcU5DeWNWazAKTEFNdVB3
+blRremJYVnh5Q0tNMVZCd0NvWHZVZFhPVVcxODBhRVMrNGNJYwotPiBWYTM+WlE+
+LWdyZWFzZSBbKVhXdyBMZyBAbjVESyh9CkdBSEQyNFFSdkkzVmVIdi9GU0tWTisz
+ZUk0QkNDM3pmNjlqVjh4WXZFQUNDZWdJQ0lnc2wxUlRJU1QzZkJDN3YKL2JERDdx
+R05vcHUvN1dkNlhtaDJPam1jRUpYM0dpMWlLQWJRCi0tLSBhNlhsMm5NMlo5emV4
+SURpWmRSTURGeE9QRzZucExYMUtOUFZaMjExSFhBCjenBAmqgEWepTziEhBd5IJk
+Vma/9MHEkFvXXYQGPfx1RR/udJxeYol+SV2AxDs1xQMSJ2xeobVhMvVE6AMCfh1U
+8Asyl5yeBF8HwxYqJo3QGasJ17cfXktR0I6x6YL3Xd7CGzCGBMaIJGHf5+KejJ0+
+sQz1jGC0xVYWgrwl4QQvxUT3uZ8VIDTv4D2rRPojtsvNEeNm6spGLHWRVa4YWEzA
+Y3OoW2RTK9kF+4cjaO9Y/TZRDBf0tmHCMg/pGELqp9jOQVXJks0nTimcfpJ9vg9w
+HdE3sNK6Od1XkgmIfUpsRcf3+m6Bqn/+qHvpIgw+Jj8kEpHQ2+GEe0Pg4PAD9gt2
+mPcKtDFdzWoVJhU9i9lOBZO9NceD9LiTmicmuIG+zXGCNAVcfre1NAAI1HO4Le7D
+ha8QI32mxBGWi/2bNnq6DP3D+9SK/fcA4Mdb0RP4g+rHj1O1y8CZOT/x5iUEp38b
+ZafzOUJ/HgBBqVM21Yq5PBcWVHX0e5OJFu3INYmrW5VVeY0yyqymYpb+sI0ISbpW
+K+Bu5OyGt/gXUDVdqXZZkSxBvtUraNIDJbVKzOsX4RhxGGqR58fJTvloZ/IzWUWY
+YV4+1vvb9/WAjPjF/UX+vcFhYfzJimVN/sj9QcjKgZhMVYyKHMk3f3mXsEVeOJxM
+N09WG3e4G21VDL5T0DFDjkn9LoLd0IAtxohlaWzAlHicKkvKF/M3C+YCpCjRAvv7
+ol7i3sWYEzHY8scmILz8qxkPQSd6wm7pA5Hs51w0ZVagMFgXfii1KDq5d2PJJ6LH
+FNoIoSwPg5iF15Y4
 -----END AGE ENCRYPTED FILE-----

diff --git a/secrets/wanderduene/restic-server-htpasswd.age b/secrets/wanderduene/restic-server-htpasswd.age
@@ -1,12 +1,14 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPQk1ocVFrNGh3elp1eTlv
-V1dIOFFZRWcxSVllbkFwQmRsbDBlQWVDenljClB1TDhpSTQwWElwaFErZmhlZVlY
-REUwZ2lJZEJ6WXl2Z1hma0NtUWQ5dmcKLT4gc3NoLWVkMjU1MTkgWmN4YjZnIEFN
-NFAyY2pNaTIwa1RyYjVja3hReDVubi9FeHlvNGxjdmNLbkJiK0V0RDgKa3o3d21T
-ejRWdjM3Sk50VmNCUGFXLzZLVDA0Q0RFNHJqN1hQNUZnT3NOUQotPiBYYXYtZ3Jl
-YXNlCjZtREJwUHo1ZVI4cDUxS3R4SzBMMVcwYXcvRHJHajY2U1l3WSt2NmdPOUN2
-cnBHRnM4Y00vUEJmekEKLS0tIFRhRjhWbE9NUC9oV3AxYUpyL2FPcmNuVTAxb3dO
-ekNjQ2Z6ajNFWWI3ZUUKGYRkVl6PPGwo9MN7uooPuJTxqn8ypu9W5ivRTyu2TYjE
-AXI69QiWopgS9eebHY+x0wUIHh2OYXgygnMqbo7G+/8jrXS/yNLzUs0WEFAdoWkI
-MPdjrOoTsc0JqNcC9+UjJJLANS4i/8LFrQ3E018=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMd1ZydkkzS3dqRTY5UXNs
+akZDRmdueE50b0tUR09nZW5BVFRhb3RvOUI0ClJGM2VEZFRZRVRFTkhveVVWZ3Ix
+anFVYkR0YXJWU0NmSnkxUHMwZkxFemsKLT4gc3NoLWVkMjU1MTkgT0pRVkRRIGRo
+eDlHcm1FeENMdE04WkhrN1hvei9FNWdvQ0Y0dEtBQzFheGZ0bnNjSEEKVHJJNmZ0
+LysrREtvTHhKVUF3WHpNUmFwWnhOYXczWmtTMW9qR2ZxdERzWQotPiBTSzdULWdy
+ZWFzZSBxZS1uXyA2cmQKU3ZTYmRVZVNaYjRtMWZWaXQ0NklHT2o0Zk8yZldxdlNh
+RW5DRVVjSzRmSXpFM0l0aWxyeVA0RzJRTEdKUk8xNgoveXFNWjA0T3dPb1p2VE1X
+a2JHSW5lMVlxZGtVTHYyMUFQQnkwUlF2eG9OUTREMkJqeDFGZ2FuaFg5dncKLS0t
+IDcvSXV5OUphV3hEYnlRSXIyS2x2MEp6N3ZmZk0zU21BMDdzMDJCYnFEbHcKT7nY
+Bg19wZZrT22vVD18dqmXvkwca55hjMNzIaA8lLApsu8x5pxj44DC/7ObuxMFFYDE
+NYC3FuFFm8hrB+Q7NJ5FWWrF/2HosPaR4qa1t4PYiC31/7vPZ5jk7gLsSopaEjpe
+UaoAkPEKxMg40t0=
 -----END AGE ENCRYPTED FILE-----

diff --git a/secrets/wanderduene/wireguard-privkey.age b/secrets/wanderduene/wireguard-privkey.age
@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBncE1BaTREcncrTTNwdnhl
-YVRxZTIwSmduOTcxS1ZXSzdVTjd4YVB0SFNzClU1c0QvdGRpOFZhczl2b0d5ajJB
-eGR2UCtXZml3eWlsZjB6QVJqcW5TS1kKLT4gc3NoLWVkMjU1MTkgWmN4YjZnIGdw
-cFFXc1YvcnpVNWpQbmJkZGF4U1B1d2tQN2lNNjRqVFRjWHRzd0ZEQ1EKdk4vbUt4
-TllhWlRlRS8vWTNrcmdYQlFwVkJYZWtHRzdDNDZkT3oyQjdwYwotPiBVXCo0Mi1n
-cmVhc2UKWWNVWTBNektIazdibjNtY1gxaGt2YWIvU0ErRWJLMDFBQi9oWmg2dVNI
-Nko0RnRZMGVOWE5hWjNhclFFaGtlZQphSlBOdTNPSDBOd09EWERndkNqZms3MmU0
-Y3ZkdHJaazZwMThCMUlDMXVoQkh3Ci0tLSBHbHZPNXpPOFh3aVQ3eHNFYUZLand6
-cTJPZThBZ2g2K1hKQmgyVkJmOGFZCnxbbuP3ixUJJ0QEkkMBRkEjhxqs5UdblDMs
-EJZ/D8teYjLZMzUmAoyfTevVzJXKtkoXnKWcz0vTPkI6h8X4Q+Wqo7FidYHr2i+1
-d1M=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVSHdCSDNlWFhPWmFWb1JN
+RktRMWVybHJ1SEt2b0IwcmswcjY4OUdkaUQ4CnM0eXpDNXczV3hvQlJ0NWVmTjJN
+Q1psV3pzN0xoRUJBM1RPT2YwQW1tZGsKLT4gc3NoLWVkMjU1MTkgT0pRVkRRIG8v
+ZHhnOFk1RlQrdFpOSzgwQWlsUTNzeGJkR3FIS205d2l6a3pQTkRQM0EKREsrZEx0
+UDRvM0hQQU04dkhTNkN3Y3RabjgyOXEvcmtOYVRJYmhodzQ2VQotPiBATnAtZ3Jl
+YXNlCmtkbkUyU0lxbnRwMmNHeFNldmI5NmFpR2xZSDlaYk5nQnpRT1BGaHRLYVFT
+Ri9VdzVlaDBnN3lUblZBSGhaUEkKQkNVWnVhYW9jRndqeXgxZklleTlJVnNvVS9y
+eXhlNTdIUDlFWXV0NlhTWncrOXVBRVByVjg0M3hQKzFyZGExMQpLV2Z6Ci0tLSBl
+VTRmbUNVZ25UWXlCaGszaThVL3ZiUXV4d2lZSVBoQ1cxdlBpUVdmUUJBCowzAHGB
+5+6JTb77FmkPFNpv35za53pxws0N/fTFACuaVAIWfWFJKS1hoH+O6/NqE9UyJ9Ws
+2AuuxxRrnqziYBwEomLKk49I2OBGkyA=
 -----END AGE ENCRYPTED FILE-----