enable impermanence for hopper

2025-05-27 23:14:40 +02:00 · 2025-05-27 23:14:40 +02:00 · e192a50071
commit e192a50071
parent 7be2e59a92
33 changed files with 155 additions and 111 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@ -3,7 +3,7 @@ keys:
    - &xun age17pdqkpfh6kc6wm7gxzdnwf6vphlwddv9yfpdu3j76e24y3amd9tq3avfc8
  - &hosts:
    - &nixdesk age155sscpw0x36t6s9usdrz7relpxqrtqnk98mrc7s0qcv2n0v3zd7sfl2xn8
-    - &hopper age15mgf89h220puhz48rjpwxwu4n2h4edur60w6cd8gku2hh4e5kqpsghvnyw
+    - &hopper age1e9nhfwfcg9krc03re4fwh0wu0cwf6jq4js5vfn26hcdqc2apgdes98fea7

 creation_rules:
  - path_regex: home/profiles/secrets
--- a/2
+++ b/2
@ -11,7 +11,7 @@ buildiso *FLAGS:
  nix build .#nixosConfigurations.liveiso.config.system.build.isoImage {{FLAGS}}

 updatekeys:
-  fd . sys/profiles/secrets -E '*.nix' -t f -x sops updatekeys
+  fd . sys/profiles/secrets -E '*.nix' -t f -x sops updatekeys -y


 remote OPERATION HOST REMOTEHOST *FLAGS:
--- a/flake.lock
+++ b/flake.lock
@ -664,6 +664,21 @@
        "type": "github"
      }
    },
+    "impermanence": {
+      "locked": {
+        "lastModified": 1737831083,
+        "narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=",
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "type": "github"
+      }
+    },
    "napalm": {
      "inputs": {
        "flake-utils": [
@ -1035,6 +1050,7 @@
        "flake-parts": "flake-parts_2",
        "hardware": "hardware",
        "home-manager": "home-manager",
+        "impermanence": "impermanence",
        "nix-gaming": "nix-gaming",
        "nix-index-database": "nix-index-database",
        "nix-minecraft": "nix-minecraft",
--- a/flake.nix
+++ b/flake.nix
@ -80,6 +80,8 @@
    roblox-playtime.url = "github:xunuwu/roblox-playtime";
    roblox-playtime.inputs.nixpkgs.follows = "nixpkgs";

+    impermanence.url = "github:nix-community/impermanence";
+
    own-website.url = "github:xunuwu/xunuwu.xyz";
    own-website.inputs.nixpkgs.follows = "nixpkgs";

--- a/sys/machines/hopper/default.nix
+++ b/sys/machines/hopper/default.nix
@ -11,11 +11,13 @@
      inputs.hardware.nixosModules.common-cpu-intel
      inputs.vpn-confinement.nixosModules.default
      inputs.nix-minecraft.nixosModules.minecraft-servers
+      inputs.impermanence.nixosModules.impermanence

      ./hardware.nix
      ./lab
      ./roblox-playtime.nix
      ./desktop.nix
+      ./persistent.nix

      {
        home-manager = {
--- a/sys/machines/hopper/hardware.nix
+++ b/sys/machines/hopper/hardware.nix
@ -1,4 +1,4 @@
-{config, ...}: {
+{lib, ...}: {
  nixpkgs.hostPlatform.system = "x86_64-linux";

  ## nvidia gpu
@ -37,6 +37,31 @@
    };
  };

+  boot.initrd.postResumeCommands = lib.mkAfter ''
+    mkdir /btrfs_tmp
+    mount /dev/disk/by-uuid/1297e638-f2ff-49a2-a362-314ac7eeaabc /btrfs_tmp
+      if [[ -e /btrfs_tmp/root ]]; then
+        mkdir -p /btrfs_tmp/old_roots
+        timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")
+        mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
+    fi
+
+    delete_subvolume_recursively() {
+        IFS=$'\n'
+        for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
+            delete_subvolume_recursively "/btrfs_tmp/$i"
+        done
+        btrfs subvolume delete "$1"
+    }
+
+    for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
+        delete_subvolume_recursively "$i"
+    done
+
+    btrfs subvolume create /btrfs_tmp/root
+    umount /btrfs_tmp
+  '';
+
  fileSystems = {
    "/" = {
      device = "/dev/disk/by-uuid/1297e638-f2ff-49a2-a362-314ac7eeaabc";
@ -53,6 +78,12 @@
      fsType = "btrfs";
      options = ["subvol=nix" "compress=zstd" "noatime"];
    };
+    "/persist" = {
+      device = "/dev/disk/by-uuid/1297e638-f2ff-49a2-a362-314ac7eeaabc";
+      neededForBoot = true;
+      fsType = "btrfs";
+      options = ["subvol=persist" "compress=zstd"];
+    };
    "/boot" = {
      device = "/dev/disk/by-uuid/8D4C-2F05";
      fsType = "vfat";
--- a/sys/machines/hopper/lab/acme.nix
+++ b/sys/machines/hopper/lab/acme.nix
@ -23,4 +23,6 @@ in {
      };
    };
  };
+
+  environment.persistence."/persist".directories = ["/var/lib/acme"];
 }
--- a/sys/machines/hopper/lab/adguard.nix
+++ b/sys/machines/hopper/lab/adguard.nix
@ -16,7 +16,7 @@
          "tls://unfiltered.adguard-dns.com"
          "https://dns10.quad9.net/dns-query"
        ];
-        bind_hosts = ["100.115.105.144"];
+        bind_hosts = [vars.tailnet.hopper];
        bootstrap_dns = ["1.1.1.1" "8.8.8.8"];
      };
      filtering = {
--- a/sys/machines/hopper/lab/audiobookshelf.nix
+++ b/sys/machines/hopper/lab/audiobookshelf.nix
@ -4,6 +4,7 @@
    host = "0.0.0.0";
  };

+  environment.persistence."/persist".directories = ["/var/lib/${config.services.audiobookshelf.dataDir}"];
  services.restic.backups.hopper.paths = [
    "/var/lib/${config.services.audiobookshelf.dataDir}"
  ];
--- a/sys/machines/hopper/lab/jellyfin.nix
+++ b/sys/machines/hopper/lab/jellyfin.nix
@ -1,6 +1,7 @@
 {
  services.jellyfin.enable = true;

+  environment.persistence."/persist".directories = ["/var/lib/jellyfin"];
  services.restic.backups.hopper.paths = [
    "/var/lib/jellyfin/data"
    "/var/lib/jellyfin/config"
--- a/sys/machines/hopper/lab/minecraft.nix
+++ b/sys/machines/hopper/lab/minecraft.nix
@ -45,5 +45,6 @@
    };
  };

+  environment.persistence."/persist".directories = ["/srv/minecraft"];
  services.restic.backups.hopper.paths = ["/srv/minecraft"];
 }
--- a/sys/machines/hopper/lab/navidrome/default.nix
+++ b/sys/machines/hopper/lab/navidrome/default.nix
@ -17,6 +17,8 @@
  };
  systemd.services.navidrome.serviceConfig.EnvironmentFile = config.sops.secrets.navidrome.path;

+  environment.persistence."/persist".directories = ["/var/lib/navidrome"];
+
  services.restic.backups.hopper = {
    paths = ["/var/lib/navidrome"];
    exclude = ["/var/lib/navidrome/cache"];
--- a/sys/machines/hopper/lab/prometheus.nix
+++ b/sys/machines/hopper/lab/prometheus.nix
@ -48,5 +48,6 @@
    systemd.enable = true;
  };

+  environment.persistence."/persist".directories = ["/var/lib/prometheus2"];
  services.restic.backups.hopper.paths = ["/var/lib/prometheus2"];
 }
--- a/sys/machines/hopper/lab/samba.nix
+++ b/sys/machines/hopper/lab/samba.nix
@ -63,5 +63,6 @@
    };
  };

+  environment.persistence."/persist".directories = ["/srv/vault"];
  services.restic.backups.hopper.paths = ["/srv/vault"];
 }
--- a/sys/machines/hopper/lab/slskd.nix
+++ b/sys/machines/hopper/lab/slskd.nix
@ -36,4 +36,6 @@
      };
    };
  };
+
+  environment.persistence."/persist".directories = ["/var/lib/slskd"];
 }
--- a/sys/machines/hopper/lab/transmission.nix
+++ b/sys/machines/hopper/lab/transmission.nix
@ -28,4 +28,6 @@
    };
    # credentialsFile = config.sops.secrets.transmission.path;
  };
+
+  environment.persistence."/persist".directories = ["/var/lib/transmission"];
 }
--- a/sys/machines/hopper/lab/vaultwarden.nix
+++ b/sys/machines/hopper/lab/vaultwarden.nix
@ -19,5 +19,6 @@
    };
  };

+  environment.persistence."/persist".directories = ["/var/lib/bitwarden_rs"];
  services.restic.backups.hopper.paths = ["/var/lib/bitwarden_rs"];
 }
--- a/sys/machines/hopper/persistent.nix
+++ b/sys/machines/hopper/persistent.nix
@ -0,0 +1,18 @@
+{
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/home/desktop"
+      "/home/deploy"
+      "/media"
+      "/var/log"
+      "/var/lib/nixos"
+      "/var/lib/bluetooth"
+    ];
+    files = [
+      "/etc/machine-id"
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+    ];
+  };
+}
--- a/sys/machines/hopper/roblox-playtime.nix
+++ b/sys/machines/hopper/roblox-playtime.nix
@ -10,5 +10,6 @@
    configFile = config.sops.secrets.roblox-playtime.path;
  };

+  environment.persistence."/persist".directories = ["/var/lib/roblox-playtime"];
  services.restic.backups.hopper.paths = ["/var/lib/roblox-playtime"];
 }
--- a/sys/machines/nixdesk/default.nix
+++ b/sys/machines/nixdesk/default.nix
@ -18,6 +18,7 @@
      ./restic-server.nix
      ./autologin.nix

+      inputs.impermanence.nixosModules.impermanence
      inputs.stylix.nixosModules.stylix

      {
@ -126,6 +127,8 @@
    android_sdk.accept_license = true;
  };

+  environment.persistence."/persist".enable = false;
+
  networking.interfaces.eno1.wakeOnLan.enable = true;

  system.stateVersion = "23.11";
--- a/sys/profiles/network/tailscale.nix
+++ b/sys/profiles/network/tailscale.nix
@ -4,4 +4,6 @@
    openFirewall = true;
    useRoutingFeatures = "client";
  };
+
+  environment.persistence."/persist".directories = ["/var/lib/tailscale"];
 }
--- a/sys/profiles/secrets/global/tailscale-auth.yaml
+++ b/sys/profiles/secrets/global/tailscale-auth.yaml
@ -1,39 +1,34 @@
 tailscale-auth: ENC[AES256_GCM,data:8+XTTS0YoJpQPYMhES6YTWGehQH992cfIjFed+kl2sXZ551PyvaA4Y0/7CuNM9udJe2ba2yte3DkN+AILWk=,iv:EK6ifjTYD4Y5zEjfty0eJyfDaQO8ooOHXdCcEAF3W0w=,tag:wfbrkPqHFk8dJaDkNeaChg==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
    age:
        - recipient: age17pdqkpfh6kc6wm7gxzdnwf6vphlwddv9yfpdu3j76e24y3amd9tq3avfc8
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHNjdjOTlnamxOZkhtUlRF
-            VTdpVVZYS3ptVEJ6cDJZSytCblhFRW1ITlZVCnVObmZHVW5mckpVSFZ2ZStsdVBU
-            SDZqME9odzRyK2R3SHNDR3g1MzNtT28KLS0tIDJCQ3V2eEtIU0g5NHE1R0lHVXRt
-            Y3VIZkh6V0JYQXlXaW9TMldNYVNUZTgKZxeO1era8Ozf8EOgBOUScBn3wPAjYSeW
-            BhO/LDqyb2edMLI/vDu3KeCkd8VOlGJTgk4E3jaqQ8PCYTQj50OWqQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlSXcvNTBOR29sMUhJV2tu
+            QXlySGFqNnZKaXNnOE5GZG82S1NsVkhKNDBzCjhBTjNJVTlPYlAwcmREV0dMUTFk
+            aG1UbXhtVklCK2UzekFjT3VGS1lVeXMKLS0tIG94V1hramdiNmJ6SDE3NkNoVlFO
+            ZGdTdGVqOE03VEM4MjNFeTZ1cE1iMVEKmc0l/Tfi2YEJQaxj4/T7sZDxGBP9gDBf
+            VGiKTOqfzOeZZ8LDELcC2vqf7LBDS3eiT9IgR1hhW0Ty/+o0tcuAcg==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age155sscpw0x36t6s9usdrz7relpxqrtqnk98mrc7s0qcv2n0v3zd7sfl2xn8
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzdkt3eFBVQTY4eGR4QXhr
-            WnJ1eTQwZmhZdjR6Q1NSQk9mRE51VG0zODJFCkg4TjBBaXd5bmNUOUNwSVNwYTdM
-            cXV5WDB5L3pWWE96MHJicjE1MXorcmMKLS0tIFVZUmlSRTV5TFk0Z0QyKzhTSlJU
-            MmZrRWF5TDlFMWZZZDlvZFdnMDFMOGcKUVhuMvgB3ssoRuZ6yOkfLHKLR2Z1X7Bq
-            cIiet0ypbAKt1sYpPl5L+xs5m3vnuNZQnUvv8gdW7VlepVmLR0IFEQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuc0d1SklGYXlxTXVxdVBu
+            NTRhT0h4TUptQTRWKzAyNmZ1S3pVKy9lSzB3CjZxTDIrTmhBRWF0WTZNL21kZkk3
+            QURLbW5JOEhBQ09iTS9KeGZINWdJeWMKLS0tIC9LeDRocS9KUXdYSHNCMVd4bXZI
+            N00zNXVrNEdLblM0M1RGTE0rVk9vOHcKtlIHbYAHJVBowOsn34+9FSTSOV1S1TYw
+            ve3VRmy71qkDZrazqgaOpbqtqMzQL2vWb/MI7nXfBU+S7GKnl542dg==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age15mgf89h220puhz48rjpwxwu4n2h4edur60w6cd8gku2hh4e5kqpsghvnyw
+        - recipient: age1e9nhfwfcg9krc03re4fwh0wu0cwf6jq4js5vfn26hcdqc2apgdes98fea7
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiR0doT0kxRXlwa2taY25P
-            WVJxZ3E0R1IwbWJVOG5OSlRtTDVqZ0R3dlhjCjFsN1NUc2hqYWlSTGJ4RGp1Y21F
-            djFkNzNzM0ZzMmhtd291OWtSWEZWWjgKLS0tIFJ2VnlCeHZibDUwYk05QzBYdkR3
-            eVpKdlRpSnprclN4Wm4wVHpjYzVnSEUK49UF2IeDXzF9PiISIo0QjltkoFIa6Y8D
-            w2DJIys0Pfw5kGrVTLAgHMOMYmss4EdD4mwY+DQYWHqxTX0P2TKM9w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZR0ZBVTlmS28va0RPTzJa
+            OEljcFJEMzM5NndIL0I4aWl6TS9rdjZnQ0VZCmlBajR3bnJ5aDdZTDU1MUFOTmw0
+            ZWFYZVZkQmYyMlBSaENybDRoTzBTREkKLS0tIGdvbyt4Vk0yTU01Um9qMU1idWEw
+            ZFFENlZONzEvK05pQjlORGZoL0pBMVEK/YhL92eTd/Kn1OawH0Ib/s2TMwdbFFzM
+            kMGltakjqVeHTORWNKbonfk+X4bxm4a3xnOTfvGschQnPN7ySziBMg==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2024-10-17T00:06:06Z"
    mac: ENC[AES256_GCM,data:EWKH7alUhTJWmHd1Y/hrtN7N2rc9DnIUxRghgGL6YwXz4kk1VoTlzEACw9NTv0qrQSfTVbFmD5f24vvdlrn7/SERmacv3GOe1/OM6kC11MTgO8rUCCwUGa+c5ublke7DQW/wQR7ay9a4pHRHf1DVBB3PrO7+A34CYWGP6gt0jcM=,iv:YzccaJSS14OPqEUftQUOhnFnF0vUNAtRvdCaDuZFoMM=,tag:R/fKcXST7LbzTahXD4uO6Q==,type:str]
-    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.9.1
--- a/sys/profiles/secrets/hopper/cloudflare
+++ b/sys/profiles/secrets/hopper/cloudflare
@ -1,23 +1,18 @@
 {
 	"data": "ENC[AES256_GCM,data:fwRCAES+TxczDPwrdzg6RG87PL1GrwaczA2uzD7PBX2q90ysnf+nFSI=,iv:akE8xpL7Pc4DA0WPMrtoawySxtYhx6L0UhrpkCpgTzw=,tag:c9omuljQ4rxrN4PzMq+MZA==,type:str]",
 	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
 		"age": [
 			{
 				"recipient": "age17pdqkpfh6kc6wm7gxzdnwf6vphlwddv9yfpdu3j76e24y3amd9tq3avfc8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqYlFaNmRuMUkzelJ4UkYz\nNXF1N2x5bjZVa0QvMmU2MDF6eVNDY3hsY0djClZETVpxT0Q3bCtJWFY5dU1HZi9i\nS1l4VWRCbldaeXVIVnM3c2t6YW03VWMKLS0tIFFIWE1TUjYzcHF4ckhXWGlkZEVK\nWnFlUUtrc1hsWFc0a0JzQTFyenZEY3cKcEma0LZKhlnvyKDIISTBDPAWkmTlUcOs\n73B8Hxtj3EDvEjUGimdu+oZPfHQuElgSMiOU0Zs0OwAvItOHg2NfKA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvdVZGSU9XcjZmQjR4dWt6\nRk8vK3VpYm5uc2l3MVM2d0NsOVlROW1xL0ZvCmVlZGttNHRUVDBITUh2bXMvM2dC\nSHdMR1V5Rk9FMDNWS05qcUFCOTRjcVUKLS0tIGkyR3Zmd05WK3JXMkcxWDZ2MjdP\nVG81YW45Wms0ZHhFczdhbHYxbUEyUWcKRFmr+r3ih0jikhIfOmPyoH8PX/4tAlIE\n79T585jBiOflj2wozGNUdZjVX3mvHajaxjT5f8oPclIF20cXUdWLwA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age15mgf89h220puhz48rjpwxwu4n2h4edur60w6cd8gku2hh4e5kqpsghvnyw",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwc0RSUHYyRWx2ZFVXVEc3\nUjUvZDdmWWJXNWtIWGVWWnNsbFA0OUpiSlE0ClhsaEpGeXpQOThYYmt1NkFLWlpy\nQUIwNERva1pReG5McmloR2gzQ09nWFUKLS0tIFUrSlZMdTFtV2hnL29Ua2lUTkQ0\nWTZTNVI5US81OVNoWndoSHdURE5uc28Kwegugtt4GjCUlj+f/1Dghy7Q1DsD4Vli\nmoPkciYTrbMhngi7n2Ya8+K5JU+q3Rfn0c9TjElEZP40dNiJF6+f/g==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1e9nhfwfcg9krc03re4fwh0wu0cwf6jq4js5vfn26hcdqc2apgdes98fea7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqMG1UblNJQVFaMXpGS1Rv\nMjNxRTRvTG1LZzQ2UWpwRmk3UXp0MjFjYmlFCjlmbll1YkVJVHJrR1lPR3RoNjU4\nOVpGZGZFdERIdU5Zb3I5ckdFajZLQ1UKLS0tIHFQWStLS0U3bEcyQlp6UTJXaHNm\nKyszQWhuMlc0VUlSQkxBRGRmOFhFMXMKsLsStvXWPVJODcTluP9LFwchO7Sin73T\ndyCdh2+T+9FcC3w4Nw22B3SrTgi5XZKkWSLqSHYDEYkJJsqDpYAxMw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2024-04-13T19:03:19Z",
 		"mac": "ENC[AES256_GCM,data:G9ZJ4fOek3RPLicg99SFS2HwBBIxqXy1NzOB8USIpjufcB9ncIypVh2ckEOiwSR4CBRIkAjnjnKaCRN0q/fHZhw5dQOwSto6nB+MQ4HMNNTErEK5tmGlN/y79+uGeYBPe7jyhsI6dIksXxHPS8VuMGFdtcXmw+nWjizeuLPP5kQ=,iv:PxP74PTFylp+P2MzNLsaVcilpkBQeYlIieoCpAIBVtE=,tag:mzo2jbPqXP0EpQgMypqvQA==,type:str]",
-		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.8.1"
 	}
--- a/sys/profiles/secrets/hopper/miniflux
+++ b/sys/profiles/secrets/hopper/miniflux
@ -1,23 +1,18 @@
 {
 	"data": "ENC[AES256_GCM,data:tNtcieUhH5rRfrpIbCD9DyTVnrfh0QMEdNJXT63D7DMb//HwZQL4IUGb3m3JMYzJ/Bdis5qUX3Z4hR0RAc4Z8VL5QDT2obMdwl+NEyymZCAhCEigGCAwx+D5QYMVN196y64t,iv:Q0QOz97dR1DyX3s9YbrQCkp8Af4Eii2+lRjvS1x/pcM=,tag:kjqASNrvzM1qIE1608GptQ==,type:str]",
 	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
 		"age": [
 			{
 				"recipient": "age17pdqkpfh6kc6wm7gxzdnwf6vphlwddv9yfpdu3j76e24y3amd9tq3avfc8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpTUJiczRUOGFZWXYzV2p1\nYzFEeXhMa2NtWTBadmJ6U0JiSVVHOGZVWXhZClY2UElDYkhJOHJJR09CMG1IQm4r\nTmZublloWFk5cWdYWHlqWnZkY3NIeWsKLS0tIGdxQXBQeXlKQlhlU1FkSWhtYjd0\nZnJ4T2lKVlFVVis5K3ZjK3JjMHVXYzgKcHManyk3uMEmx1mnfJM7+/wnA+ssxTKk\nsl0yOgWGVPMSN1CFU0zAW+rx07Z7tdnK1H7129nltyQy1FL/ep9xwg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzQjQzSkJUYTgwbStZVkRp\nUlU3ZEp5ZWVyTUEyNmxsSTRSRGVSbmhyaVh3CkNnZXhYSlBnNjNiYVNXZnlGcVVk\nd2F3em5YVHE5VTVWNzhvRnJoam11K0UKLS0tIFV2NmpQYWt0eFRTZm9GSWt3VFdj\nZVQyR3N2d2ZYOFNFZ0UyZmlvMkFuSUkKf5yz1O4lOEzrXR+E/+RV/Ja+EDUuBcqn\nr8YRy6Lat2eBOnhLVdtnlbSKAEEdezVJeXAcQqtsbuHnxnE7mVgZXw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age15mgf89h220puhz48rjpwxwu4n2h4edur60w6cd8gku2hh4e5kqpsghvnyw",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxTUtacGh3TEoreHBtTXlV\nRklKYkx1QUFXeU91Q0ZLOGp1WnJObE90eVhzCjVicDh1dHQ5WURJVlBjSWpjZmVC\nSjg2Tnk2L0hKTWp0RGFWSE1Fa1ZiVFUKLS0tIG94TjhoajZSQlppVjVLQXpRSVV3\nNDNKdSswUVRjRmd6ZkZYbzdRaTY3MFUKTbMm6YWWO+M4h9JmoqkRkCnoFxaEiF44\nNkHn+4QuKu7xPlQhIyjeYbWLMTMoiMN6QlzasU6M0lHv/9IZ2q/y3Q==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1e9nhfwfcg9krc03re4fwh0wu0cwf6jq4js5vfn26hcdqc2apgdes98fea7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWcWtJOThGbHBCd2x2MklS\nSnpEZ2JBTEp5czZpaHprL2daOUxHK1B5RmdzCnBWcUlEWXJwVjRNVWxPUEVxYUJC\nOGpSMWlmSU1BWm0zVUdlOVNQQzNORm8KLS0tIEtMdUkzYWRWTE9kdTJBbk9qZ1pv\nTjA2VHFqbHFQRkQyQWlmQ1BMTEM5VGsKj3ZuE9Cf9mCKWf3F67W7nG9CNLY6jq6D\nIK/oHT8HcUwlIUrlhMt2khPPK466J4FYKT/XtvZtOpjn9XLoPlIRSg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-03-14T15:57:56Z",
 		"mac": "ENC[AES256_GCM,data:ciKi5phjUGnqlRHizdYeYpMpRQqc4vuC558Awelp2rgPMbL1gZWkLCiGQnrlumIrw+PvA/ZSWQYAy4uRc61foAWj59KUIhCwLybNSbJeCZHKrT7opIRRGIy7BY2EA1SX3HHfuM3Fo0E59WOcaSavNywPjNpz5MZMWOEbuY/ZS1I=,iv:PU7iBqqovoTnqTIgAsg7EuEr7sWeyAypVw+Z+ZkVoAg=,tag:FgskiHmMtp5aV/PDhZrcuA==,type:str]",
-		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.9.4"
 	}
--- a/sys/profiles/secrets/hopper/navidrome
+++ b/sys/profiles/secrets/hopper/navidrome
@ -1,23 +1,18 @@
 {
 	"data": "ENC[AES256_GCM,data:dYVT36HolV8T7QxBNoAJ9WvK33eqwt9ijeeOAR33wFdzJ5cVhd6S+7syrhWHzVPjjd6s4sAaPvukFPg0PPRA7qtRtKAOqoJItmQvonkSJGsHdfce3mghFpOuWHUWmFw5pLefwhQ9IeG6tWOFq1e0NLjokYZ1QTQ019LBzvuyhcL0sLY7HMFS4jlTZ7gn+EhWalPiXSTJisjgZLcHZRiqk1A4ykN9Elz9roQayEYY/gCI8gOXKV/COHeijI6MX/5RyHug/SVl,iv:AOOqE4ywhBtPCys4nZE3TJhzpBWBfDzcCV/THUOdgkM=,tag:EIRLlmeCPsv99AJrsp2wZQ==,type:str]",
 	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
 		"age": [
 			{
 				"recipient": "age17pdqkpfh6kc6wm7gxzdnwf6vphlwddv9yfpdu3j76e24y3amd9tq3avfc8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArOUVOakRVNnFCcjlZTzVa\nRGE1RzJRWkMwMjlmM0RwcTJQbFVCcXB5d1UwCnJqWDVlc09nYllwMEFHL0VlWUt1\nR3N3VkdERURmcUpneFpzM21QZENqY0kKLS0tICtWMTd3ODlkZXdZeSszaDVJcnN4\nQWlha040VWNtRGNmWXRjelYxRzRKSlEKses5PsoJeK08YeE8G0qTAc3mLF4V2t4g\n5OXBUWExpqcYfoks8KSj0bb5NrJRrgaXTPQJQJ6yHZVz753Ct723/w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2SlJKS1VWY1drOWYwOTdE\nRmJOd1hOZXczVmhUQSs4NDBoWENlTnRubDJFCk9kZldPajZlM1JZdm15S1pQdkoz\nazh0cWZhZUNTRFNtbGthMHE5bjFFNlUKLS0tIE1PaXdSUXJpdHMvYUxVUys1V3ZO\nbE1NZXBVWDZWcng0NTZaa2xIaXVpaWcK+d28b9/tG0Or3B8WrvxWvZceTUHw3k02\nSExL89Qww8O6CHCtSKDD+ehq6ZMSYCCf6scVDWSzzPLkO7KTJOIj2Q==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age15mgf89h220puhz48rjpwxwu4n2h4edur60w6cd8gku2hh4e5kqpsghvnyw",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPVTVkRHIyTzB6c29NMjVR\nclhBcHZQd2hoTnpqSmxMc09ENGJ6cllUWWlNCjkvSlkyOW5pSmZ4TzFqK29xL3U3\najFoNE4ybkRjbVBpQWV0ZWxDZkZaRzAKLS0tIEQ0elZYS2pkdzZBT1I2dm14cTFC\nU1JoT05CRFlOcWxmVVl2azB2ZUdjc0EKqKnTyGu0KDDHSq3y15YL5rNLm90+/Msy\nE+leZHbn+uZcGi/q1Cja02zPjJweSKxQ4sh6H5DYadC29kjOZf7qXA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1e9nhfwfcg9krc03re4fwh0wu0cwf6jq4js5vfn26hcdqc2apgdes98fea7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoQVZycGI2aHh5Qi9xL1I3\nOW55aUhvbjJPdUlCdlA3RENlcUFkKzdDRDFFCnFCTkpEU1FSSG85Q2wxUFNMdTVR\nUXFWVUl5UytVZGcxVTk5T0ZIU0pRcnMKLS0tIDRPa1RhQ015SFFOQ1k3VnNiNGVM\nNmdpcU02Q3dOaDBrNUVmUHA2a3dwMVUKnK63EK2D5eL2nCT9Ua1JUMi1aZhVTe5z\nhv+3m3LSks8Jw3rQ06/6UtpSdTyMbMG5ep1toZtbrBfMKaY8ufINuw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-02-17T15:21:51Z",
 		"mac": "ENC[AES256_GCM,data:9pSqlHngFKLxmq2RVXGKzVFguljQjKJZYksSmNuuTJtYibqLan669nIwxdj+EFs9kH61LpI4VTxJNJi1mnLOLgpfTjUNAJzUW1FOUCpjBM2vAud138XuvmG+1PFQiT/U7KoAhI3X33YjPDgcLwLvE3+82//nt39MLJfMjHXduBE=,iv:FzTe05JSXrDze3uZoJgTIk2AobsBEjrZEudqkBfry7E=,tag:hJSsexvLw61ML8w3ST8OXA==,type:str]",
-		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.9.4"
 	}
--- a/sys/profiles/secrets/hopper/porkbun.yaml
+++ b/sys/profiles/secrets/hopper/porkbun.yaml
@ -1,31 +1,26 @@
 porkbun_api_key: ENC[AES256_GCM,data:XJPpQmR/Qif4SHkOgGCPmcWr0RQ3BDLcpmb0PMRjH052WFXoAdXglNjs0I6vMpunQo86WTrS1O2pE8FTuHb/28eDFoU=,iv:+6cqvjSSt8Yioco6AaZnYXBDCbDUyzY755E4Z9v+188=,tag:j1i88gG3dtE0aPojeH1Mjg==,type:str]
 porkbun_secret_key: ENC[AES256_GCM,data:UPEfnyl0cjBjCR1/Goljx0jLRH6FUQFrqeYQ5CmoXopp2n/9QYesPg2Zaue1p5HiUm+YUwR1XRxdrupUZhhcDEKYsPY=,iv:Jx1L3hO90DYfhnCdICIDHhT9xMdOZCkOUoOI/cmtbtM=,tag:ADTqd9PNrv5NS/XuUBT9yw==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
    age:
        - recipient: age17pdqkpfh6kc6wm7gxzdnwf6vphlwddv9yfpdu3j76e24y3amd9tq3avfc8
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYYkhHSDE1Rk10WUVETkYz
-            QnRkMTZRaW42dUFqYy93VzZMUTNsWkhBejJnClVpL0UzY0V6aHhtaS9hK3JwR3pX
-            TmZnZis0MXgyMHFtQXVPYTFpc092amMKLS0tIGM2VCtBQy9BcHkrbkVuU1JnNHlX
-            b2Q2Vm9JaXovSG01VjBXc0JHVlg4OUEKLu2dgxebe7TcHl8XD9uRWbB6bjToPfdz
-            Q33TWttTDYnBThM9FCzr3CXk+tpYIwQ75ZDRJsX5K7eo1XhdvKr7KA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGblBkUEZjSE94SzJnRmhT
+            R2pRQWVhYUhGdmRTbzF2Yk9qcjIyN1h0MXhnCitjL1FLaTdLZHJrRGx2ODc3VkFP
+            TlJVckxTeUpUSFlHYzh4NDhEOXFhQkUKLS0tIC91RmxDNnk4SGkyUWZ2bWgxcHNs
+            RDkxWklxdFZidVB6aEZidEE2QUxDVUEKP0KjKN5vz9uCnnJxnEAo5FOv7ll7fDsE
+            H17AUDhdYPipEM8+QZi2DfPVc1fr3FQHTZ+dCnknKKwMIzH/xLBOOQ==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age15mgf89h220puhz48rjpwxwu4n2h4edur60w6cd8gku2hh4e5kqpsghvnyw
+        - recipient: age1e9nhfwfcg9krc03re4fwh0wu0cwf6jq4js5vfn26hcdqc2apgdes98fea7
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQeEJJNVU4dEM3MjdOU0hZ
-            WlFPZlorSnlDOHNscnhRN3pNMWN1dGRyMlVnClVEeGI4L0RYZzAxcEFmLzYxbWdR
-            M0lnSE9sTDgwSStvY0J5Wk9ob1hnRjgKLS0tIHpFSHdVYmxCWFRZVk42bTVWaHB2
-            Yi9kNU5nNTVTbEdSQWxpYzY3OUFhQk0Kh4rW5YIyUo77/q3e+mpOua9LviOodSDo
-            BFq+GJ55vmTnnsWnNdZ75fA8D3NAGkt90J0vdHTY+S4O3kXK6deGyQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpOGVTSzhvQVdRcFFPUTQv
+            OGkwSzdubDJQdUhnRlNQd0dIS01VQVNkejFZCjVReVlVZENadDh2Yjh3TzF6bzJi
+            RWI1WWNMWExZSGVtM0RVWmlYT3ZSU0EKLS0tIGEzcjZLRCtWM2JIam11UWlXejFX
+            SnBHcXRpdmQ3ZVEvUTh4ejBkUmlraDAK1QXXu5JXAEzWCLnAAuwf/OHgNvhioEsz
+            fqybEkvVjMQIOfuPziZcxsN94NV6k+gqZUgoK4P7xNcLJ8GCyZKxQg==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2025-04-21T17:52:04Z"
    mac: ENC[AES256_GCM,data:FFDYoULGiuxvYbKPshbNAMVQxuSxC9y+UsEh27iXg77tkPm3h9nFD6kkGPn/WhSq22K3e4CPKcdh9OyloNmnj87zQ4U2yMC54L6ecDFv7s/wXx9QIfdjTptwMVHVmj/eWhiT/GNPXmIBQvQdO1WNgt/Phe7avbwMd2v3Z5QjKjM=,iv:T88XSRb1izA2xBidsgZaPkUWyxWeteZ1Lk837ah2dEU=,tag:r0OcLmwQ7SK3FQBpXrVJrA==,type:str]
-    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.9.4
--- a/sys/profiles/secrets/hopper/restic-password
+++ b/sys/profiles/secrets/hopper/restic-password
@ -1,23 +1,18 @@
 {
 	"data": "ENC[AES256_GCM,data:XNhDpv4BlJnVqP9j+acQb7UFOQMOBlbloZpt7u1otfrqcVL2N7ck2o8PRt3GjQmhLfF/pQSOoTiTVE4HhvlnzkU=,iv:8wlR+AqmKV332vbh4UnpUj8CLt0yafYQQOGxfQVcDiQ=,tag:lZ6tS69CAaG5Pn+mKek/Yw==,type:str]",
 	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
 		"age": [
 			{
 				"recipient": "age17pdqkpfh6kc6wm7gxzdnwf6vphlwddv9yfpdu3j76e24y3amd9tq3avfc8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2a0xtSy94alIrdjhEMjhu\nQW9sZGkzL3FQQlZkZ2ZyaUVlVFVKaVp6VjAwCm11dkJMZUhuQUY3QW1ORmJVZkJX\nU1g1VmdOUDcwMGlBQzFJTGx2ODlXaUUKLS0tIE9UQ0d2NVNpS1laQ0k5Ymp2QlBF\nSnZnZ2FORW9NdjBXU1lzVktFWmJvYzgKBRBg6T/jh3UqoHw76WrFQ0nWDdwm76aF\nglZ8Za23EHl+ZYO2h7rVLmpWp4QLJP1QlK21DWgV27km53lcnhL9Rg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpUm9OYXpnNnBKY3VVY1Q0\nUE9BblNkeit5WXNTZVBJZ1VrdWwrbmFvZUVzCmlLUVFiTDIwKzVVTzdQSUVHMURZ\ndEx2TDRpNkQrR2E1VHFaYzUzS1Nta2sKLS0tIERyNHlHdTR3N2hYZkJiR0NobDRZ\nZTBrVzlzekNJMXdjUjJJbldIZjBHV3MK1aghFbB8BWSoOkmn4oHeo8et8fbzvX0x\nV+4KbIzOA0cWRWYWMAqkv3OXuEi//+/voQeCCL8dj/2iiM69SFJdPQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age15mgf89h220puhz48rjpwxwu4n2h4edur60w6cd8gku2hh4e5kqpsghvnyw",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNRytVdS9hQmJFVUlxMDdU\nS0grVnpnOWlScXdhUG5KcEZSVWZ6VCsxcjBrCkR6aHFVVlVBTC9IbTVlQWhsNzRG\nMlVOSkdBYXJaRlZ4aXV6L0NFUFFwSDgKLS0tIEJoL1BPd01xa0hySE1yM0ZVamlx\nWGJzbFZWM3BDYjI4SEROUTlCV253eW8K139SG4amnHMID+deqyJ0bj1rG2GEgcus\nZPC3BpscpLopk1IAzniWqUE2jF9+b38WywxFAcTCPs/LEcp50RuaKg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1e9nhfwfcg9krc03re4fwh0wu0cwf6jq4js5vfn26hcdqc2apgdes98fea7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByekJQREJsbUwzUEl6UEF5\nN255Q0JsUDd1SlA5dFBWVFdhS0YxL0J2RlJNCjdkVlA2OXhNa0FqSVRtbE4yZkdq\ndnN6dWpVeml6c3BBeFIvTm9LZDZSZzgKLS0tIEtwZGd6NWQyVEdNbjgyclJSN0k3\nK3FnQVdNbmE2eDZzYUNNdGNoaktNbzAKfK1TJYTwlucqpbEaXz8eSkINB0fG/hQw\nHu8B9qDWMfO7ZLfFjvaCSkY1hSkDwZK0All8LSKdVQWu6JgxWaHtCw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-02-20T22:29:48Z",
 		"mac": "ENC[AES256_GCM,data:aKTE3BimqzIqj1c1a+fQZUP3bPaJx2xIDOu7zyZmGtwNk2bmlgqa7f8DN0Pu9LdDcVepSXMFBCM8NmuYGVh3700JV1OkF+YzlCNL1zHsGBHJIbw0ljbVgPmhDskXdl/btyCP8uX5vu1xDVOtNK5d6bDuZ1E9mBbz3C6+0CgnWXE=,iv:CblhoFr0+pmTtTb5GepPp78SfuP+h2uMfPIiBltYxB0=,tag:78zZxclVipkloBZkW9SFzg==,type:str]",
-		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.9.4"
 	}
--- a/sys/profiles/secrets/hopper/roblox-playtime
+++ b/sys/profiles/secrets/hopper/roblox-playtime
@ -4,11 +4,11 @@
 		"age": [
 			{
 				"recipient": "age17pdqkpfh6kc6wm7gxzdnwf6vphlwddv9yfpdu3j76e24y3amd9tq3avfc8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMSXN2S252dURkOWpwOGFF\nWGYzR3dacFNZWE83eVFlMEhoNHh0YzBTcERZCnhGdXk3S1d3ZERQUWRTaERpbTFi\nOGhGd3pFak1pUkFhMEZRZWxPMko1VTgKLS0tIHBEVFYwWUU2Y0J0Zm5nQnlEVkMx\nK1hSYVN5UjNMckFWRjNsYkpTNVlNRnMK7yCKn+kVxHabmmXngKc5nZG3WJA4jFqL\naj/FaZZ9d9J3CzD7hDt78lmpOH8dRUOXtgOgYaPDV6t4Soo6AXKt7Q==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkMWQxdnFnNURoeTQwL2d4\nL1dIV2hMTlMzMFY3Z2NuTHlDeGF5dlZLbkdNCnIyZlJJRzArWU1Iemx6RjhaUmx6\nYSsrbzI4VGJjYlpSN0tYbEhWUjNvTDAKLS0tIG83Zy9RZnNYbTlkeUlTR2hZOEpN\ncU8zU2srZFRrZVMwaGRMNUpRTmMrN0UKAYngY4jgm5Pitk4Hn14CiLi2/BUGA+6U\naRHvZX69nm0rVRUVIrQROGeaA6QyF47hxGPEe5Eg3A6XS77do0OkGQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age15mgf89h220puhz48rjpwxwu4n2h4edur60w6cd8gku2hh4e5kqpsghvnyw",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5T0FVcHhQOCtUZk1VMXc0\nakRJclEwUW5tRGYwQ1pyNHJiWi9LTWo5Q2tvCmY5UjRESHRWc1B2KzRodysybU5J\naFdsRExCRjVaeHAxRVJrS2lacVl5VWsKLS0tIG5EWVVEMmVPdUVGMWl3OFRKS1dM\nOWtuT2VQRmtSRFZpcEoyS0RuYXorMXMKCYkwea3kVW17iHSmBiqgF2GGQ3McbMXg\n1Q4YTkKyb2RWnulCOV1s8sllt8lbRRsd153+wCagkA8z6UuOnpNBdQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1e9nhfwfcg9krc03re4fwh0wu0cwf6jq4js5vfn26hcdqc2apgdes98fea7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpblhJQlNxb1oxWHgraUVY\nZTRtNVN5QUtSVFhyb1BHc1NEUGN4V3RWT3hVCnpDa3RBU1ozRnJiWnYrbERla1FJ\nMVZiT2JPRnlpb1A4TU0vcERMeDZtRkkKLS0tIE92Q1J1bTlHTG1ldGswTzVlZm5W\ndVhIOTl2cDErVnhuZlowZG9zRzh3ZGMKNL0P1zu07kQ5WaUSK4/AeinmrSk3sTXT\nlA+apVbdSn4wse9PVlFLwqxlwl3mxFVfqbB0xZMFkoe4KfFD0S1tpQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-04-27T16:36:16Z",
--- a/sys/profiles/secrets/hopper/slskd
+++ b/sys/profiles/secrets/hopper/slskd
@ -4,11 +4,11 @@
 		"age": [
 			{
 				"recipient": "age17pdqkpfh6kc6wm7gxzdnwf6vphlwddv9yfpdu3j76e24y3amd9tq3avfc8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwakcvTWdqUjY4elZUNFNu\nR2R6OHRvN1pNeGdHMUVGMXVVODBEcUJrTVJjClZTZG10UVNWR2NqVkhVMHo5c01M\nd0pPVnptVTdxMjhYVGNVZkdsRERRZlUKLS0tIHd3WmgzUUxVYkVDcTRoeUgwbktk\nVm9QNzBnTWxmM2t1MVByZ3FLaTNweDQK4VQWPRkKKnNyjQ0X2HZ8ACsTZsTrGKyw\nIV0qQujXDj0WVX9NtL2BcjbCIIENJH5pFp8XKQZ+mikqPGmHeunSgw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxQURwMTJnT0Z1MHJhSXZ1\nYkdhL0N5VlI3MGFPejJQa0JqVTV0NFpiekYwCmUyNnZYWjJtd3BOOVJYRlBiNHVG\nU3hQaGEyYnBPNmE4UTNabG9EZDhwb0kKLS0tIHdwMnJyU254VUUwQUw5TVh6ZzlU\nL2tPL2lSWVY0YzVjQ3ozdHpOcHRvU1EKXUU76hDmYZL5Wb7bl1Jb7CrEig+K3eYp\nLihczOqeaKx3J2XxbUiI1oqqA9x+eotSGSclf1199/IjssLaIuZnmg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age15mgf89h220puhz48rjpwxwu4n2h4edur60w6cd8gku2hh4e5kqpsghvnyw",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOWXNpZlpySndGK1hRR2ZF\nUXdZZVhJVC9YMy96N3BzSVBJQzBOMEliMm1ZCi9ZWTgvOXcxSXdvMldYZXdsbjlX\nc0VDZTZNY3dSUHFMVmNZbWY0dzl4VkkKLS0tIFRtSzhJdFdLVHAzTVdBMmd3T3ho\naDI2WnBnT1FGUkgxQ0NrenpIYWZRM2MKN6hXjBR+jS4UkYy1SS5uHtlHTugfxCwW\nAErlX+kU0g0uBIQbHExNSr0/Xjk+bIRNqSg2O0CfxULxbQRtZrsqMA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1e9nhfwfcg9krc03re4fwh0wu0cwf6jq4js5vfn26hcdqc2apgdes98fea7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRbjdlYkVJTElNZ05LalhR\neTdmV3hSN2NoQ1A5TXljMW9xQ3ZKcEJWOW1vCkRUYVJ4SjFmUG5OaVJMZHJreTMv\nMlZUOUVsYm9hNmJZdHhLNUdRU1JRZ1UKLS0tIDhZcjQ4K0RBSHJkV3I5OVViZzBt\nK0dKeWp5MlZnNUdnSlkycHNSZENUaUEKXE0zq6HbWIVNt+T1SK6llxPE2EmZS99E\nvOfE56qt+ZYp7sU6TLifSXQ+7IB8moRcL0U5aGkkmgM0jkW64/0bhg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-05-10T08:11:03Z",
--- a/sys/profiles/secrets/hopper/transmission
+++ b/sys/profiles/secrets/hopper/transmission
@ -1,23 +1,18 @@
 {
 	"data": "ENC[AES256_GCM,data:r/cojq4Krb+3JeDL+5P5wUlpehJHCRYR2fUAnGJoGSFMi2jMxQ4/rasSqZJlNxisReusu2cECUZT3LpjzUFZONsHQtHs0iC+xWMVZasJwxnWu62vLxQoJhTb/2EvnTKpV47WhAJeiaeVbFURKVCST6Z6xET/0kFxFB92iVFLIFWMfByMBMq34+xW41+fboOLA5vsWyNTcIQC2fVKc7wyi8Iq0ge+yAONm3QA2Qd24psuC5Dv,iv:sLLbYhE6tshYZo2HWGzNNmcDxb0ziPsDg+lsX6G92Ds=,tag:VRslfMCy1/GNGJ3vG9d+aQ==,type:str]",
 	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
 		"age": [
 			{
 				"recipient": "age17pdqkpfh6kc6wm7gxzdnwf6vphlwddv9yfpdu3j76e24y3amd9tq3avfc8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJNVpReEZBb0tsT0QyczBv\nTVVTcEdaN0hoTUY5ZWhEU2NWcjlEa0VsOUdVClFONjhncXduNEdaWlBFTUF4TUFU\nWVJmQTN5dmV2dGJkenZVaXMrbWxuZW8KLS0tIGEveFBPc0hrS3FvVFdTZGQ2TW1r\nS3NWNTBFbGtJYlpnTUNUN1IrMTZKd3MKBtEbUpRAfnbyyXXOLDIvEd7aQaKKWvqh\n8z/s5a/yWGdh4VB90FRZol8Te0Ahu3hYBWiaUWE8dELeAb0Joakm0A==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2NWp6czJuc3F0SU9JVGJH\nRGVrdTgzY3RFK2ZhZUxBaEFvMG5GcGoxdVI0Cm9oTUxjSC9wRVpQUGdmVnNwa1By\nZEQzOUp4czVlM1NLK2ZqRHJCakJ2V2cKLS0tIEVIaFFYRHpCa05tTmcwMmhBcVpi\nWjU4S3RSM3ZjNkxHdFFqcGlGQm5lZ2sKPLD0pT2V4LXbbLKAPEld702NnvwiGqXb\nzKDKX4RefOiYF6gDoFCQ8S/JdD8K+jkN/GPk5nmx0NquRl/cqnhzug==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age15mgf89h220puhz48rjpwxwu4n2h4edur60w6cd8gku2hh4e5kqpsghvnyw",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5dGh1VmFjM0FqRlEzMUoy\nblVscWNHQWkzTmVDV2hEaU9NNGtIOE5CbkRJCjcvTXdIaElqMmNrY2Q0RThUNWZr\ndDJvZzVVU01mUGJoR004MnRmZ2ZHKzgKLS0tIHUxSHJLc3RBWXdBT2pXU0lNZjVS\nSDdMeVppSkR5UXYyY0pUMVFjbllvVncKAp62v5o/vMgrbygJ1+5QWriRNbrdel5x\nPJAikvtzttEotMSVBww1Qj9T9H+NxfywqMT3PleZLeixz0eSr8vBAw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1e9nhfwfcg9krc03re4fwh0wu0cwf6jq4js5vfn26hcdqc2apgdes98fea7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYeEVmMm11ci9WT3g1dXor\nWlluNDBGRGZLbVh0Q2dxbkFkeFN6RU9IMndVCk16dDg1VTVsbTVlOXVLbmREZ3VT\nZkV6bFFSNURQRU43WmlRQ1VYaXhVL0UKLS0tIGNVQUNpSWROMWw1SmZjM0xqZUdq\nMU5XZHhJSk80OGNsWUFQTm1JbjJpMUUKpniiI9dpM9awrLCnoIs8WAv6tsPKYjM5\nBT91uhUMmCKmhCYK6VKqDZmAY7sK93F8AkShq+l6WZCkyC207Csrzg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2024-11-08T12:20:18Z",
 		"mac": "ENC[AES256_GCM,data:yjPmnEZOLT63kPaf8I634/QNHIoz76/KbrcbqlbxhageGf49vHSmoQabA+nZ+X0e4QKYJamP2w03SHaTkBiAWPibmy4DxIxaZONGDNZyB0kXwgQHVMJS4ioYitPlzkOxuuNA0YywJ0zfQr2UL7f8Pnjv5Ce9fJX1ywfNGZ2SJXg=,iv:Pew7Icme84LO5cwtVkUJ4wVF0mwJiNrlT6ulKHCb8/o=,tag:/98B67+gAEMM/BKWLULPfQ==,type:str]",
-		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.9.1"
 	}
--- a/sys/profiles/secrets/hopper/vaultwarden-env
+++ b/sys/profiles/secrets/hopper/vaultwarden-env
@ -1,23 +1,18 @@
 {
 	"data": "ENC[AES256_GCM,data:0ALRzx8OBDBx0fEv9slsbqpUtYgduSFFwe8BQDMWD/IYhUJEq+aop/azJqlFX8R+EUXN6A0uxDXjxra/fjF0jv72V+JZPAgFP7JVBS0OpbFDsCSAHrBODQjiU2FjXcYCY1hP5DCY02zzD+atDVgyq+2MpRKweCjVXgVhshmh2a1ZvjZqWg==,iv:PmAjxC+nfLLZCGJ4Ftow9ShvFlVy2jaxKpWS3UIDNqg=,tag:4zZmCrgTJSkHgDdJM7atiw==,type:str]",
 	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
 		"age": [
 			{
 				"recipient": "age17pdqkpfh6kc6wm7gxzdnwf6vphlwddv9yfpdu3j76e24y3amd9tq3avfc8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIU0ljQkk3Y3N0WVVLRElD\nYmFpVHMwVU5jMWdsT0dBdlVLTFQ4OUI3cDF3ClNPZUJRb3cwRk5ub2lMZTlUa0k5\nN2xCZ1RKeGJPWnlRM3plMEdjY3JNeUUKLS0tIFoyVnpBQW1ESEUyS1U4aGlpM1hM\ndFl4ZVpFSlkwL3BPUmpjSnltUG00U28KYgimIR5pc7WQMCBDStL49ZhjR1lGnwUO\nWKJaSQtGggaTwSPg8xJ1YyZadqVZ7GD00LtW2UWMJqAvpgdKEEJsAw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFd0t6c0tzc3VIcjFoRnFt\nMDI5MmFDVndhak1nNk05Unk4WVZsNTdOWEdvCnVFNWRjbUpya1lVaGh1NHJVMm02\nYUpkakJOQkdRWEJWVXNJZ2hDUzZZQ2MKLS0tIHJodGRZQkdVY09ZZGpqVEt4YWNm\nZERWYXpWQmc3T1ZIQUpIWll0Vzl5dVkKRLl9Tij3IGb17qE1ij309sFcBuhcJAkf\n9BVBeZ2+Kvz3JsnkcunORMmElZC+l0k1vZc4cBahhQvGhssXSCnxaA==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age15mgf89h220puhz48rjpwxwu4n2h4edur60w6cd8gku2hh4e5kqpsghvnyw",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwa0pGalI3VHdsNlRpd0hM\nK090S0M5YmRvUkNCbWFibHBrY0grNFFzNDBzCjNYMDBBcjFMa29EZ1oyd1dodU1U\neDE5YUlXZDduRUZETDdyemRQRTJQdkEKLS0tIHRzTkE3RGRRVGZ3RE0xMFRnKzYz\nMUpzazVWUzR1akc0SEplTTM0TVlPSFEKpHDK/odhvqBu2DcTxcJwnGUwR7FsiyE6\nGdXimYyPi3wErwnQ6L5XG8x/8l3OHTuCHvvHd+l2cpKVE+dgfFrFDQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1e9nhfwfcg9krc03re4fwh0wu0cwf6jq4js5vfn26hcdqc2apgdes98fea7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrWmRKVVNjRWxpQWZCR0Nx\nYVFKRWMxWEpJZTVpeWpvRW91dkNON2FWYzFFCnhXcldpWjhjOWwrVkVnanVoNGR0\nU0l4cjlHQlRtUmdKay8xOUFMQmRtbG8KLS0tIEk5eFRRYW9rM0tMZGJzNlVsOGxq\nam5HanpOTmVOZ2k3MUgvdHZ4MW5DdFUKQ2TnNWZHC60c+wvClPzMvXDKJiDBCTE8\nqoATnWUKpLpUya2byv85M/tP9uLaP4QvQX+I48ttbylikUnXaLYmig==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-02-28T08:48:24Z",
 		"mac": "ENC[AES256_GCM,data:uxeKqeG3H3RtzfJYCGoblLnQzRk3oCmqAsa5atS83Y0ium30ftnUBje1PGrvrtdeC6bWyuKmBgZUWLSqQIqhB1UyE1I5/Sbz86ZPf8F0S2Tdhg2lQBvHQvX8fQw4cjWguxZN5eBW4EKI6RlZAwgYGTI01wrQjhUO6//lPfvhbVU=,iv:e0ZGp+0du3Q+VRKjdV0DeXTzmqocVDuvA+QXPmekYk0=,tag:E5gizQlT6GReInVXLWwxEQ==,type:str]",
-		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.9.4"
 	}
--- a/sys/profiles/secrets/hopper/wireguard
+++ b/sys/profiles/secrets/hopper/wireguard
@ -1,23 +1,18 @@
 {
 	"data": "ENC[AES256_GCM,data:BCUmakHRS/iF+TZQSKK26Nrfc+qxTzfgdoQAoKLp2dqJNqzFfZQBdoN46bdfbzn1Ujmpo9bGW04khDuB6tU0UAkUI2wc73NTybM578lPyfrsSddKPDO4W0cB+s1kk6bqCKexaYzIdeJYVfSPzExP1BCLmw6TjByMkAU/MGxFlY8ohfVr5YaANHX4nymYaiuF6ksVpWL2epmpKA+Ql07lTY8MM+JPTrJQDk4gak+dwVDUYXkaw2EkR/jI1XFT05MNWgqloPG7y2GWnS2rYPyp5ti3NHQxJk8IQx6QH9znwI2EdtDQv7zLRHLeFXeLsd4mFngas5729e8F69YOHWPx5vtICaKHLTAVHU6sXQMruQu42ucoZFGUfu886QfXZCxAhVj1RGhnV4AI5NPucm5ZWI5gdfkBZDIKHg1ziy8qzFBXqNnoiOI/Ar9r/obSqTbLPFba4gdMRgAW+EaJdBMSa8yd7OZr/IYROIM8vDd5MR7whYWBArUMqIzzCbQ/8dWwBiRd7OHAxX9QuXhdfLDr49hHXEqpydDBiVzPxGwQ,iv:1VRvpdmFgvdvGD6uujJZNNHr+rSI2HnGPMSO7CxFy/M=,tag:Gf/4Mk/LpUL1K3Oc+dVEhw==,type:str]",
 	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
 		"age": [
 			{
 				"recipient": "age17pdqkpfh6kc6wm7gxzdnwf6vphlwddv9yfpdu3j76e24y3amd9tq3avfc8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnU0lRS0I5cXh1V0xjb1RS\nVTlla014WWVybmNOTml5ejdOaTFiWWpTbFc4CmdVZHdvazhoNnlaeG5ibTBZREdG\nTjd4cXBjSGpsdTQyb1lMQloxWUZhZjgKLS0tIHRxa0o1TERZNlYyQUQzZUhnTnhT\nWUxEM2dnWGZmV2d6SXJVSXQ2bU1Ic2cKbPQwJSlna6Vysi2TznU3ovmWQXBbwryF\nM2dlOwPjv+lWM1DLfJRR3zUCugTuz0xjdTDLZlo1F/aaeWiAPm5j1w==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhUzI4WVRmNHY1dkxCb25S\nQ0VqUTJRaXJ5eno3RWpYRzFvY1JHcTh6cFdBClMxNnlETUtLam9BL2M2Wm94MHNo\nZS9KVDVGdzFBY1FpSUUwQzQrbldybHMKLS0tIGxJS0orRWRRZU9OdzluSFN4clBZ\ncnpubmp4YVpxak05QVVkc1EzelFSMEEK6DFx1LrDAlNW4DCfnqg1B3N5o6slegqQ\n2bQ8MXPjM4kMYdxEkOOwEd46T+8VUYjDupVlF8kUE0XIGw9tpzk7Qw==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age15mgf89h220puhz48rjpwxwu4n2h4edur60w6cd8gku2hh4e5kqpsghvnyw",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2VDl2dnFCbUtRdnlDTGVv\ndzBwUTh1OXRONDlGK2hXZ29YRytLbU9sNXlFClViaG9xRGw2OHZLTmZEQk9nSXU5\nZHI2aWVNSXp2Z2JxakpKUkkzQ21XZzQKLS0tIEpSM3Z4dW9VeVVEQ2JKYU5EK0hP\nYzBnK2d6TkF4VGJ6dlBrc291ZDFBYW8KtEnivQ5aj9FhnNHRL3jEQPYxSuO8QAuz\n9tIXoiU13+GOmvn8XG25cZjUIgCamd9c/uBVXFYFx3muGlmBwvn9cQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1e9nhfwfcg9krc03re4fwh0wu0cwf6jq4js5vfn26hcdqc2apgdes98fea7",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4VHhzRHJDNGE0SlRNaU9L\nT1cvY0tvdU10VWhQdWF5M0ZuNVlGd3JrQ2g0CldZNTQxRzlRVkd4QzFnMEFrcld5\nMEhhcm9CSUpjanQxZHF2Q3Mrc2xFQ1EKLS0tIDhJSDFKdDFYZ2YxNmdDdFNFN2l1\ncVFDVjR0d0xuaVZrYzlEN3pwRlFoUncKlYqIYtsAErGCj0HobiLTpawofl3yLlyT\nMpUD4xIJmICkHnXej70ZXcoSU+zqsGZ7nLvnAZScK2jeja2akWzJ/w==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-03-12T22:36:00Z",
 		"mac": "ENC[AES256_GCM,data:3KqGUlTodgABZJWlndINA7+aGuU9Z/VgZxPm1Ur4rRsL7QX5cq9AjoQRJsCn5pIUq5U1GGfQVgZ6bSCDzi7Oqua8aoUmf7Bw4Uhjq6kkize6lEYm1N8ULJ1+N3CyW9Uz/KThvUE31flkGN5N0LYOUJ87oTcqV8rPzi3AzlxPCD0=,iv:/qffqhGqGDrXiuW4QcXT6/fD8ve0v4S1xFa9uDIed14=,tag:HPw5eKySdLJlTMYvmScQ1w==,type:str]",
-		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.9.4"
 	}
--- a/vars/default.nix
+++ b/vars/default.nix
@ -1,7 +1,7 @@
 {
  domain = "xunuwu.xyz";
  tailnet = {
-    hopper = "100.115.105.144";
+    hopper = "100.99.196.113";
    nixdesk = "100.104.163.5";
  };
  sshKeys = {