ctucx.git: nixfiles

machines: remove `wanderduene-old`

diff --git a/flake.nix b/flake.nix
@@ -56,7 +56,6 @@
 
       trabbi           = import ./machines/trabbi/configuration.nix;
       wanderduene      = import ./machines/wanderduene/configuration.nix;
-      wanderduene-old  = import ./machines/wanderduene-old/configuration.nix;
     };
 
     nixosConfigurations = (import (inputs.colmena + "/src/nix/hive/eval.nix") {

diff --git a/machines/wanderduene-old/configuration.nix b/machines/wanderduene-old/configuration.nix
@@ -1,145 +0,0 @@
-{ nodes, config, lib, pkgs, ... }:
-
-{
-
-  deployment.buildOnTarget = false;
-
-  documentation.nixos.enable = false;
-
-  imports = [
-    ./hardware-configuration.nix
-
-    ../../configurations/linux/services/prometheus-exporters.nix
-    ../../configurations/linux/services/dns.nix
-
-  ];
-
-  networking.primaryIP    = "2a03:4000:1:45d::1";
-  networking.primaryIP4   = "46.38.253.139";
-
-  dns.zones."ctu.cx".subdomains."${config.networking.hostName}" = (pkgs.dns.lib.combinators.host config.networking.primaryIP4 config.networking.primaryIP);
-
-  age.secrets.wireguard-privkey.file = ../../secrets/wanderduene/wireguard-privkey.age;
-
-  boot = {
-    loader.grub = {
-      enable  = true;
-      device  = "/dev/vda";
-    };
-
-    initrd.network = {
-      enable = true;
-      ssh    = {
-        enable         = true;
-        port           = 22;
-        hostKeys       = [ /etc/ssh/ssh_host_rsa_key ];
-        authorizedKeys = with lib; concatLists (mapAttrsToList (name: user: if elem "wheel" user.extraGroups then user.openssh.authorizedKeys.keys else []) config.users.users);
-      };
-
-      postCommands = ''
-        ip link set dev ens3 up
-        ip addr add ${config.networking.primaryIP}/128 dev ens3
-        ip route add default via fe80::1 dev ens3 onlink
-
-        ip addr add ${config.networking.primaryIP4}/22 dev ens3
-        ip route add default via 46.38.253.1 dev ens3 onlink
-        echo 'cryptsetup-askpass' >> /root/.profile
-      '';
-    };
-  };
-
-  networking = {
-    useDHCP     = false;
-    nameservers = [ "8.8.8.8" ];
-
-    defaultGateway  = "46.38.253.1";
-    defaultGateway6 = {
-      interface = "ens3";
-      address   = "fe80::1";
-    };
-
-    interfaces.ens3 = {
-      ipv4.addresses = [{
-        address = config.networking.primaryIP4;
-        prefixLength = 24;
-      }];
-
-      ipv6.addresses = [{
-        address      = config.networking.primaryIP;
-        prefixLength = 64;
-      }];
-    };
-
-    wireguard = {
-      enable = true;
-
-      interfaces.wg-mikrotik = {
-        listenPort             = 51820;
-        privateKeyFile         = config.age.secrets.wireguard-privkey.path;
-        generatePrivateKeyFile = true;
-        postSetup              = "ip link set dev wg-mikrotik mtu 1500";
-        ips                    = [ "172.16.0.1/24" ];
-
-        peers = [
-          {
-            persistentKeepalive = 10;
-            allowedIPs          = [ "172.16.0.0/24" "10.0.0.0/8" ];
-            publicKey           = "nvyhYuWJl/dKyV/2+bDrUisvL3mi38PsNzfdIDDwSjY=";
-          }
-        ];
-      };
-
-      interfaces.wg-briefkasten = {
-        listenPort             = 51821;
-        privateKeyFile         = config.age.secrets.wireguard-privkey.path;
-        generatePrivateKeyFile = true;
-        postSetup              = "ip link set dev wg-briefkasten mtu 1500";
-        ips                    = [ "172.17.0.1/24" ];
-
-        peers = [
-          {
-            persistentKeepalive = 10;
-            allowedIPs          = [ "172.17.0.0/24" ];
-            publicKey           = "nvyhYuWJl/dKyV/2+bDrUisvL3mi38PsNzfdIDDwSjY=";
-          }
-        ];
-      };
-
-      interfaces.wg-stasicont = {
-        listenPort             = 51822;
-        privateKeyFile         = config.age.secrets.wireguard-privkey.path;
-        generatePrivateKeyFile = true;
-        postSetup              = "ip link set dev wg-stasicont mtu 1500";
-        ips                    = [ "172.18.0.1/24" ];
-
-        peers = [
-          {
-            persistentKeepalive = 10;
-            allowedIPs          = [ "172.18.0.0/24" ];
-            publicKey           = "Sh5le4IsR5jW1+jSrR5N/dcuTE+OEcEB6ou7bqwriAg=";
-          }
-        ];
-      };
-
-    };
-
-    firewall.enable = true;
-    firewall.allowedTCPPorts = [ 5201 2201 2202 2203 ];
-    firewall.allowedUDPPorts = [ 5201 51820 51821 51822 ];
-    firewall.extraCommands = ''
-      iptables  -A nixos-fw -i wg-mikrotik   -j nixos-fw-accept
-      iptables  -A nixos-fw -i wg-briefkasten -j nixos-fw-accept
-      iptables  -A nixos-fw -i wg-stasicont   -j nixos-fw-accept
-    '';
-  };
-
-  services.iperf3 = {
-    enable = true;
-    bind   = "172.17.0.1";
-  };
-
-  system.stateVersion = "21.11";
-  home-manager.users.leah.home.stateVersion = "21.11";
-
-}
-

diff --git a/machines/wanderduene-old/hardware-configuration.nix b/machines/wanderduene-old/hardware-configuration.nix
@@ -1,31 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/c5db3732-3c1d-4b93-96be-ee288525fa31";
-      fsType = "ext4";
-    };
-
-  boot.initrd.luks.devices."root".device = "/dev/disk/by-uuid/b19a5e06-b540-4c2a-acb9-dcc969c50fe6";
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/A855-01F5";
-      fsType = "vfat";
-    };
-
-  swapDevices = [ ];
-
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

diff --git a/secrets/passwords/leah-at-f2k1-de.age b/secrets/passwords/leah-at-f2k1-de.age
@@ -1,18 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGd09SbG1NMzZ1R0o5c3RL
-cTVoY3Bwdjh4RVk3MlJMNzV2dUIvc1QxMFNvCjhPUXpldThpN003QmdlcDV4aS9L
-QjdkMUhoQXlXMWo4OU83VHI2WXNqZmMKLT4gc3NoLWVkMjU1MTkgVjB1VXJ3IFFL
-d2Zjb0JtV1BCN2doS0psSVlUaC9TeHBqOG9WMmVTRUVrWitGa0FURmsKSEZONE80
-VGpyUW8xenN1Yml4WWgxQnJPRU1LWDc5K1Y5dWp2d3RqUHIvVQotPiBzc2gtZWQy
-NTUxOSBaY3hiNmcgcjBmVlQyWEgzR2ZsbmxPUm03d081RkZUQWtZcFg5SlNUQmhv
-TVFuN0syNApNWC80RUVnY25uMTJuSjY1KzNYWGRRSzZXNlFic0FPS0pmSWVpN3ZZ
-NnVNCi0+IHNzaC1lZDI1NTE5IHNoOFBPUSA2bThFcjJKTG8xRmV4ZC9hbXlqbnY3
-TUJIdDBOZ281cVRjbDMza0MyQ1JFCm05WUhKUTNKajhCWWFxSTNCQmQ0TjlxTUUv
-bTF0SkRLSE13c1VGaGxOTHcKLT4gc3NoLWVkMjU1MTkgNGhLQ013IGN5SVo4ckhs
-aFh1cEREdk9yZm95Z0ZqekREWFErWWpxb3Qwb3hhMXBaVEkKME1uQW9aU1VNNlFp
-OStEQzN6MGNBUHNZdGhOMGZUYytSQ2Era3htWEtwYwotPiBNamx+U3AtZ3JlYXNl
-IEJdK1EgaDdyPS4gMmA+bEkKNlJNQnFIODZ6TFkwWDI4eXNaZnFNWUVnQlJadFpX
-MGZBWVZkYUg1eUN5YwotLS0gc1owbFlaeHljc1lKdHVYT1c0RXlzNEU5WW1ldHpH
-ZE03NFdzK0pVVGpQbwp7bqmgn4/0wfymYi0say3UcwKwohQYld4mMaYnAsGPNVXm
-CT+gWsdN+DOmQvW9C8PI
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBENTVmaGw5RWllaW9lUGFz
+QnE4WmpzNExNRi84Vk4rbmVGVk04SkQ0NWtjCmhmeHkwczJPdDlud05ldDBXSCt3
+QVNNcU5TdXV2OWlXcFFvcDFUM0RwMEEKLT4gc3NoLWVkMjU1MTkgVjB1VXJ3IFZY
+KzVXb3Jab1A3OXlLMlRZaG9KSkpwZWJzS2RENDMrRDNLZW54WDh2MUkKUGw3dG9Q
+YUxSc1BiaUwwNXVPbTRyMWtpZE9mRG9TaEtZYWRCUFNuMTdJZwotPiBzc2gtZWQy
+NTUxOSBaY3hiNmcgQjVPNXh6Rm9KZEF4QkROSnRsaXgwSDdPWG1SMC9rRDR2V2ZR
+ajNVVTJVdwpiclVoZXYyTVB3MUxBSlh3bGd2M3Nvb0VveWFlRkpXbnJLZTI4ZUMx
+SDhvCi0+IHNzaC1lZDI1NTE5IDRoS0NNdyBtSVZmZjI2MnNubERQaHEyV2dvMExS
+d0RqcVVwbVVjU3pXdml3c3d2M204CnJXMEdSRjVTUDVFNmZkd3EyNFAxRUpWUVEx
+RWtudVppNHkwcjRLM1VkNEkKLT4gQj9vUS1ncmVhc2UgPipzQVMlUlYKMFp3cmky
+ZDFMaUhWWGRONnYxLytVVzFmMzNydHBnCi0tLSBKbWVuR2Q1bWtxZ2ZrcWxTL29C
+VEM2d0ZUa2NRMytURnNmUVRjOVUxWTFRCmsd9q/50cLvFUsZQlRtD3MsYJVo7QAI
+lwPIEMsQ8QqkrRBvhLMPy2jaJU6V4YpxakY=
 -----END AGE ENCRYPTED FILE-----

diff --git a/secrets/passwords/leah.age b/secrets/passwords/leah.age
@@ -1,21 +1,19 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByUU1iVTBTK2d1cTkwNEpY
-MnkrT3dLeko1cUtVNk8wTnROSHJLNnNMK1dFCmdvRURyYWZHbVRtRlBvM3FRVzhi
-Vjg1UksxSkxWdEdkZnBUd3ptZnVJMDQKLT4gc3NoLWVkMjU1MTkgVjB1VXJ3IGV3
-Ni90WFRibnhHTmIrTkpWQXpjNzdObjNQa1dNejNZS1M2WVBHQ2J6bDgKcU9YeDJr
-VlpXMFZSaTRBSGdpWXVNSHNHMmppeGdtejYxK1VMSnNYQ2VxRQotPiBzc2gtZWQy
-NTUxOSBaY3hiNmcgOEZ5TjZpb3ZFazBuaEU4Q3k5aWJiajVCL2NWNFN0d1dTbC85
-VW9FajQxQQo2TGM4WU1nZFdEaDBzRWdYYThob2NCMUovRHBLelpQeUtaQnBVUE9I
-UmUwCi0+IHNzaC1lZDI1NTE5IHNoOFBPUSA4V0xyT3BwODl5SlBNSGxENlh2MWhP
-cVd2WjdTRCt5N2JqZXdlKzdxaVQwCnVFQUtHV3dkMllxOG9jVE1mb3AxQ3pwS2ZK
-TmU1M0R1T3BUV1pXRE8zdlEKLT4gc3NoLWVkMjU1MTkgNGhLQ013IGZnenBiWElS
-cm9Ud2JISVJJU3AzaDBZajNOMFp4UUx5L1d0SjFGUzRzQWMKZ1VBUGpYekRJUXhv
-Y3Z2ZlVNM2tNR3lzMWdqTE9BdDdYbG5qcnRxZnlCTQotPiBzLnItZ3JlYXNlIGl2
-VQpydEtzSGpCTStMcEZCMmFTSmlDK3Z1YXgwT3B1WnlZbnBkdzdoaFgxK3RCZEJU
-S043bkMyTGxkMmJOYy94OEc4CjlaTGxxV0Zlb2VQTnpUR3VsbDRvc1BZS2xMcy9j
-WTVabCtaWGo5eWpQZ0JPMlBVWUNaOAotLS0gaVVQbXVTckRaUTNsbVFCeEZUYThF
-dlhxWk95UEwwM0lzTmMwclAyNFRScwovV9odv9RliL7A9yIJhpEbFRcub05mAFAj
-vVZ3wb3/ndfhQLbFItQ98MKXz7ngm1HfGmlCXMzTirn+Fxx7KeLtJI8SpdGWl7h4
-UE5FB2MRcNaSEko5sN9rpXHV/JvrKTm9ZHzra2RM1NF1gE48DHgDfLDnmXWenZJ2
-Qw84LVr6y4rfGR04Nwz8MyE=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZWEV2RE02Tld6Uml2aXVK
+ZmdNU1hOdlBxeUpOdm4zRk5Ta05WNmJTQlhRCnN6ZVNsL09IQXowY0t4M0NTa1pL
+QXUydkRXTG5yRzhMSGtzWER2N3ZSNlEKLT4gc3NoLWVkMjU1MTkgVjB1VXJ3IGxD
+QjRWYmhyUnNyRkRRKzVzR1VmYUNjd1FuMTRKSzh0YTRGbkJSdHk4blEKczc3M1o1
+R09zVnNkYndpaGRjSE42bnZTaytIaDFzUDl5Q2p2TXVnTlBMYwotPiBzc2gtZWQy
+NTUxOSBaY3hiNmcgZnY5NU9kbEVEbWRKcEJMSWVManRIakVTeXVyYkJqMVg2MHRO
+NEVDMXdENApTVmhOejJsMWFIR0xrVEFUNkxLN1BCNnZLNEJFSm40NnFXTnhsbm11
+RW0wCi0+IHNzaC1lZDI1NTE5IDRoS0NNdyBUMkUyY1lBSzdoSDZ0T2h2QkVCTTFN
+bFRuK2R4NE92bzZtYXV0VWtudFRvCi95NmFFQVJSOCthMlAxVk4yNWgrRkltOFUz
+SXNBMWwwUTBLQ1Y3aURDWGcKLT4gMUpSWnhIclktZ3JlYXNlIFYofG0sCmdFZU9w
+L2t1eXVpaW03enlBVkpEaldWYXdJVG4weTM3N1RUaDR0K280Sjl4NzlzYjdCOTBu
+QklnWitlS2xSZmkKanpMVnZUY29ZRERIQkFOUjRaWHYvMU9DVGNubHNaNy9YMXE2
+NFBaMnlxVWtlcmhvbUJudgotLS0gM2crbUtJM0kvVVpTb1JvVXMzcVNzOEpJazhy
+eWRyNnkweG9NRmJ4cUJXOAq+Lz9IOVLCR98VAbG5uqzm4lTNiahZVH+v8KssBuov
+sD5KtTX0ldU8uNmFpyxKpUjgnu5cCJvoCJQeJhVQTX26sV3qygKh10Av4SZJYBlK
+sCMU87evMGutCj2HSlS6mPfb2B5UJ7YB+yrH4v5A8m4uG5UmT3K5urxR+hEZIh7f
+xXX7diWOA/5DxKE=
 -----END AGE ENCRYPTED FILE-----

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
@@ -9,11 +9,10 @@ let
 
   trabbi          = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLBBZJ9/644d71E8A7IFU7dvDHI+OR/7q79KvqmI/i/";
   wanderduene     = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEff3QkAesMYwquc49H5e2CjRH9Dv50/DjzqpCw97lPQ";
-  wanderduene-old = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+HWYkFCmuHR8HeExYXc2L9CxRdvYZ1UCkbbeDCvF0u";
 
 in {
-  "passwords/leah-at-f2k1-de.age".publicKeys                        = [ leah trabbi wanderduene wanderduene-old briefkasten ];
-  "passwords/leah.age".publicKeys                                   = [ leah trabbi wanderduene wanderduene-old briefkasten ];
+  "passwords/leah-at-f2k1-de.age".publicKeys                        = [ leah trabbi wanderduene briefkasten ];
+  "passwords/leah.age".publicKeys                                   = [ leah trabbi wanderduene briefkasten ];
 
   "restic-server/briefkasten.age".publicKeys                        = [ leah trabbi briefkasten ];
   "restic-server/wanderduene.age".publicKeys                        = [ leah trabbi briefkasten ];

@@ -23,8 +22,8 @@ in {
   "blechkasten/syncthing/cert.age".publicKeys                       = [ leah blechkasten ];
 
 
-  "blechkaestchen/syncthing/key.age".publicKeys                        = [ leah blechkasten ];
-  "blechkaestchen/syncthing/cert.age".publicKeys                       = [ leah blechkasten ];
+  "blechkaestchen/syncthing/key.age".publicKeys                     = [ leah blechkasten ];
+  "blechkaestchen/syncthing/cert.age".publicKeys                    = [ leah blechkasten ];
 
 
   "briefkasten/syncthing/key.age".publicKeys                        = [ leah briefkasten ];

@@ -89,8 +88,8 @@ in {
   "trabbi/mail/password-mail-zug.network.age".publicKeys            = [ leah trabbi ];
 
 
-  "wanderduene/wireguard-privkey.age".publicKeys                    = [ leah wanderduene wanderduene-old ];
-  "wanderduene/restic-server-htpasswd.age".publicKeys               = [ leah wanderduene wanderduene-old ];
-  "wanderduene/rclone-config.age".publicKeys                        = [ leah wanderduene wanderduene-old ];
+  "wanderduene/wireguard-privkey.age".publicKeys                    = [ leah wanderduene ];
+  "wanderduene/restic-server-htpasswd.age".publicKeys               = [ leah wanderduene ];
+  "wanderduene/rclone-config.age".publicKeys                        = [ leah wanderduene ];
 
 }

diff --git a/secrets/wanderduene/rclone-config.age b/secrets/wanderduene/rclone-config.age
@@ -1,26 +1,22 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjNWR6YjFyK2lDRU16cVAr
-Wit2UzByOE5CQWhEVm42dUtPSlB1UmFGRkFrCmVJNVRLZlJGZUptRnd0bUZ5VUNv
-TkNTemlDL3NpQUpIZnFUSlZxQXdSUG8KLT4gc3NoLWVkMjU1MTkgWmN4YjZnIG15
-YWRPSGEwNUNCMHFxa21pdExRQUdOdHZ2b1lJTWkwRXp3aGxma2JTd2cKRVZmenZm
-MktHLzhjdjBRR3plcUVBNTU4MUxWRDhLOWFGTzZHMm9zblRJTQotPiBzc2gtZWQy
-NTUxOSBzaDhQT1EgK084Y3grZUxXMHkrUkFNKzYzNmtSQ0FOTEhMeE5za2JmakVQ
-akRHbXZRVQo3MUVDdGxHa1FXaUIyeWdaaithbldPODNISlhwbWlDemtYV2IzaTVs
-Z2tvCi0+IChvIVw8VXZBLWdyZWFzZSB4T0kyV0JATyAhJwovejVSTngxRWdjRXV2
-ZnhaK0ZZbkd0cktMRUd0Y2p2YWVicVRleUVwcU9vZkhSZFBrQm9zUktBRjdoY0gz
-MFhzCjNKQnhSQldBRWRmd2krK0ZHOVhHVmtZRnExZlJ1N2djcjAvRmp6ZFBpR2sK
-LS0tIDNHdWYxN3FCeGZIQzB0d3RKdStHaGpnbk50dXhISGtBa3ZjZHNiVnBmZTQK
-fNdxtnPYTbC5dTecqheToRIw/wPohVCYtxlMTsh3i7OiUBMINTaUlawFKBHPHXdv
-t4hHkscGYU7XPKKjTLIOO60Mkir4yZxajRgV+76oAyK4xfsh9Rsa2lhOfBRyuWG6
-2uoXB4tDq1yoq4sc8VJBHZ/ixhXsb57d6URagTDr1ywnLrmO3XyK/kq+8q1Tb8YU
-SQ59QCMwqWhogf9eHAXMF0sTyB2kIrq/rp50HTzYY3KimD4+t2n1V3RHEUHu+s5j
-S463b8UKLE9k+GGmE27RiBSVDTglT5te3/0O92yLpakC0UmUn/caRgW40a5TNebh
-dXgQZjQaKhdfirM6qnIFurp5AUpdvTsbHJxB3tGR411/4MYVCtIaF96ndlYHm9Ss
-obu9KaRQ7YseuZNp0HshvtHQVLqkicfHsMHLUYeU9S3XcClmgF1dZSlUr9qq+wyy
-nxcAaIWestv/+EZlokCEJRs4rZ0dpIe3l/lGzsym/PQ7jc9Nwb+wTTjM0OaZ0u0q
-+eVlWT7iq9YFiCq1nTHp15N7GB/o2VCls7IhGcHUrk32jCiTVtrr8JkehtePXrD2
-nAoT+xFsf92d7kVUPafS7rN0ceh79/mCGGKd/g+O97ESxgUHnXmjUPQnqV0EMPyN
-LBUi8bR+dcBbW9GXythhVnDtKX4NFj25DCYUev2OiKyQX3MTFpV9cqUeND4Krd88
-n8OeQAu5gtldlqFSH4bKkaMMkl3m2MpwcZPfjIPjLQIZyUnB8umkouarnTrzzTGb
-GM0+L/zuIMmY2EChjTwiREJn7qYnwlEl9RiFVeo=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXdFdMUGQwZ0ZqMWs3U2xB
+bjYwajFzcnV1d0NTdGdzNWJrdXlCcnJHTEdNCmpwNTVUdnRXWTRwd0Q4VzY5OG5Y
+V3lFV2dmMk9qT3JSbGNzeFJaN2l1ZHMKLT4gc3NoLWVkMjU1MTkgWmN4YjZnIFZF
+am10Zm94V0ttTEs0ajcxSVlQaUFvcklyZmlGb3FhUy9OdVUycmk4aG8KZlN4ZzA1
+NG0vZ01uL1U5YUtKSWZMWElibjFjMC9iTklRa0VadGVTdXE0MAotPiAiSGV7Ijso
+YS1ncmVhc2UgJ2xIKVVpayBgMns6SzUgYlghaDFwL3EgTF04CmVaM1MKLS0tIEQ1
+eitaTjh6clhoYkdrSTljSVAxS2lGR2o2Ny9DOExnd0FIdXV0VmlWS3MKL3sD/faH
+lujnn2ENXhEO2IOEtKn9E6jZ11wsgVCsjRfGPrSBP6cbZCLR4C2/jXCXZgdL5Exe
+NVj3kae0mrQa9gbtBzCalpYBU/zo3aFAQxyKCav4H3GFGu+vzDBGhJrdUbwp8Dyl
+SPYQZIHtlfk0l8FF1/HoF5ltUSPUFyaLBtmeiewoo/mF7EQggMxYShgJ+SOYpDTG
+M/W0vjEWLJ+1ehMyWe4VNW5iiLX0NjwKjZFLfQqIiuw4kc3x5msKWLEJezzyMULA
+ysVBVHj1DfvD15xpuMvEal98VtMlXg6sKB38RorWD9mpN/TFSS/ETH4hsZv5gONf
+iz5OqX+2y6O7CMkDPc336TkPKYYoDScMZQKOeM9+iSlHd0hScJMa7GqPp3jJMxU1
+pRwqAeMIASdMgIzDmgNLEKAJWDZelzAJwteNPbiVyWXpTxaLWo5UKtrb5Xz1k8N2
+kETy8P4Qq1jX9+oSBJPj8mgl/AAEMQnY+pgu5TiBzztSQU9yHAySsNTksEVCHGOI
+kiPOKAOWc1SacDyQxCmuani7w20Z+u498QcFqDxc42kxsIjkzAS1aM7Bqaa7puav
+F8sx5JUf8xcdiqVavTXAR0T5JYJfY5297b2U3/PJTJGTuIPdbULWn8aFMJk0Qnya
+UgteHRRwE5ARZSRhe3RRjWIhBGGqFz1IIIw+pVNE9vd1OjYuIFs7hVOGs3UtHnnK
+8SAjuzAX9m8M2rV2mrUkNr5Sf2P41uYL71WMu/4TaA5i3e8op646Xfhr4wGO7C1T
+ggmQ9P9UeO+bSbLfoJOldUbM4NcN7ss=
 -----END AGE ENCRYPTED FILE-----

diff --git a/secrets/wanderduene/restic-server-htpasswd.age b/secrets/wanderduene/restic-server-htpasswd.age
@@ -1,15 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0WkZSODBhcm8xY0owUVl0
-K1pNK0V4QWJNVUlia1RCbUxDdXR0OWZOVGh3CmhDUFVBeHZtUzVvR21aTWJBbVJS
-cW5CNDR1djJWbEQ5UFU2RXFSSXZPaW8KLT4gc3NoLWVkMjU1MTkgWmN4YjZnIDlM
-aktadWM1Ky9sM0JEN1VPYTJxMVN6YXN3QTE5Nk1PWUNzbUY2R3JZRGMKUTRIeDFi
-VWtlU016ZzRXaDZlaWNBUE80MkFZdFF2bHNTbFI5VUdZUFZwTQotPiBzc2gtZWQy
-NTUxOSBzaDhQT1EgQXdWMjRTeDJmeFNETWppeXVSVi9KcUZCTUtJZHhCZXBoeFFH
-ejFBVHN6OApWZXpWNDBqZ1RmejQ4eFkraG1PdzRmTEZET05OZkFaSDhoTXhqZFRE
-QVdjCi0+IGUtWGJ0Mi1ncmVhc2UgRjgzYC04IFUKb3IzK3BEZlJhSUV2ZFlzaGd6
-UmlCaEZGendLWU9YcmtlWDdGNnJQVjBDV3lLd1dYamlqSWxKbUJMKzFXRDRESQo3
-YkJzalRMc2ZsZFRMSENuaVJLeHIxZ0haN2ZCU0EKLS0tIEZzUnFMa3czd2xtaUph
-ODkyTzFabmU2bzJCS1FHdE03YUVwc01WWVhXcXMKvRsMkcj1Dds/3MQuLt82H5me
-8f2LkaGCJLIVrX1sxXHfjROUwxIwQtxaytAMOLaSCTvUFxoaa+5rxsccx9mNe9Lc
-5K86XxajOlJk98Mz/dwsf2Z/Ii2m6WemxzATHBTWch2Ki+gDx3mbFRRbeVg=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPQk1ocVFrNGh3elp1eTlv
+V1dIOFFZRWcxSVllbkFwQmRsbDBlQWVDenljClB1TDhpSTQwWElwaFErZmhlZVlY
+REUwZ2lJZEJ6WXl2Z1hma0NtUWQ5dmcKLT4gc3NoLWVkMjU1MTkgWmN4YjZnIEFN
+NFAyY2pNaTIwa1RyYjVja3hReDVubi9FeHlvNGxjdmNLbkJiK0V0RDgKa3o3d21T
+ejRWdjM3Sk50VmNCUGFXLzZLVDA0Q0RFNHJqN1hQNUZnT3NOUQotPiBYYXYtZ3Jl
+YXNlCjZtREJwUHo1ZVI4cDUxS3R4SzBMMVcwYXcvRHJHajY2U1l3WSt2NmdPOUN2
+cnBHRnM4Y00vUEJmekEKLS0tIFRhRjhWbE9NUC9oV3AxYUpyL2FPcmNuVTAxb3dO
+ekNjQ2Z6ajNFWWI3ZUUKGYRkVl6PPGwo9MN7uooPuJTxqn8ypu9W5ivRTyu2TYjE
+AXI69QiWopgS9eebHY+x0wUIHh2OYXgygnMqbo7G+/8jrXS/yNLzUs0WEFAdoWkI
+MPdjrOoTsc0JqNcC9+UjJJLANS4i/8LFrQ3E018=
 -----END AGE ENCRYPTED FILE-----

diff --git a/secrets/wanderduene/wireguard-privkey.age b/secrets/wanderduene/wireguard-privkey.age
@@ -1,14 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTeGFneU03NUJ3aU1CcFJB
-eFNMaWkwUnFXdHQ2aUFuZ2MvZHNOeVA3SFRFCmNnOUVRVFNRa3dyWTFVNmhZZUN3
-WGVSLzhEblp5eGhFd1lvbUEyV0ZNYlkKLT4gc3NoLWVkMjU1MTkgWmN4YjZnIGxr
-eUE1eVNqTk1BYXVBaXphK2RieWNYRkhtYzZ6ZTFQNHd6ekRURGNRbGcKV2dhVEoz
-NWxyeXk5dU92N0tSbzk5dVpiM1dtWXdJWURtRGdRQU9rQzFFWQotPiBzc2gtZWQy
-NTUxOSBzaDhQT1EgUXphUTc0VWJBdm00a0xsQjFQY2VIL2RTSUxuVG1xc1pBT0F1
-WmR6RUVoZwoyNXFFMFQybUVEdlRiTVBXYWE5cy95U1B1cWJXd043QVVZL3UwaEVV
-VExZCi0+IDgwLWdyZWFzZSBlVy1dIygKVkoweGRaVXRSVGsrUXNjRFI1VjN5eUxQ
-QlNxd1gyOVFKNm0xejZpaCs5d2hubXptaHdUdAotLS0gSUxMWW4raFJjSjkyakE2
-YkFBVnBtb3JDalljLzFtaHBJWGYxVWF2L0RkUQrJs0TMMqvIdIUpJvebBa66+0fT
-lD4m1XpYQ753cAO60M30hKjkzI2UW5yBzT4pQC7cDSdauCncHoQlFyd7XfVZLHGj
-PKFSvo7cuf2t
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBncE1BaTREcncrTTNwdnhl
+YVRxZTIwSmduOTcxS1ZXSzdVTjd4YVB0SFNzClU1c0QvdGRpOFZhczl2b0d5ajJB
+eGR2UCtXZml3eWlsZjB6QVJqcW5TS1kKLT4gc3NoLWVkMjU1MTkgWmN4YjZnIGdw
+cFFXc1YvcnpVNWpQbmJkZGF4U1B1d2tQN2lNNjRqVFRjWHRzd0ZEQ1EKdk4vbUt4
+TllhWlRlRS8vWTNrcmdYQlFwVkJYZWtHRzdDNDZkT3oyQjdwYwotPiBVXCo0Mi1n
+cmVhc2UKWWNVWTBNektIazdibjNtY1gxaGt2YWIvU0ErRWJLMDFBQi9oWmg2dVNI
+Nko0RnRZMGVOWE5hWjNhclFFaGtlZQphSlBOdTNPSDBOd09EWERndkNqZms3MmU0
+Y3ZkdHJaazZwMThCMUlDMXVoQkh3Ci0tLSBHbHZPNXpPOFh3aVQ3eHNFYUZLand6
+cTJPZThBZ2g2K1hKQmgyVkJmOGFZCnxbbuP3ixUJJ0QEkkMBRkEjhxqs5UdblDMs
+EJZ/D8teYjLZMzUmAoyfTevVzJXKtkoXnKWcz0vTPkI6h8X4Q+Wqo7FidYHr2i+1
+d1M=
 -----END AGE ENCRYPTED FILE-----