feat(authentik): update authentik to 2026.5.2 (from 2026.2.3)

config/mail-postfix.nix

@@ -0,0 +1,21 @@
+{
+  config,
+  ...
+}:
+{
+  services.postfix = {
+    enable = true;
+    enableSubmissions = true;
+    settings.main = {
+      relayhost = [ "smtp.protonmail.ch:587" ];
+      smtp_use_tls = "yes";
+      smtp_tls_security_level = "may";
+      myhostname = "mail.plg.m0rel.eu";
+      mydomain = "m0rel.eu";
+      smtp_sasl_auth_enable = "yes";
+      smtp_sasl_security_options = "";
+      smtp_sasl_password_maps = "texthash:${config.age.secrets.mail-smtp-relay.path}";
+      virtual_alias_maps = "inline:{ { root=home@m0rel.eu } }";
+    };
+  };
+}

config/vault-vaultwarden.nix

@@ -34,8 +34,13 @@ in
       SSO_SCOPES = "openid profile email offline_access";
       SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION = false;
       SSO_CLIENT_CACHE_EXPIRATION = 0;
-      SSO_ONLY = true; # Set to true to disable email and master password login and require SSO
+      SSO_ONLY = false; # Set to true to disable email and master password login and require SSO
       SSO_SIGNUPS_MATCH_EMAIL = true; # Match first SSO login to an existing account by email
+
+      SMTP_HOST = "192.168.68.33";
+      SMTP_PORT = "25";
+      SMTP_SECURITY = "off";
+      SMTP_FROM = "home@m0rel.eu";
     };
     dbBackend = "postgresql";
   };

containers/mail.nix

@@ -11,18 +11,14 @@ in
       swap = 512;
     };
     system = {
+      importConfig = [
+        ../config/mail-postfix.nix
+      ];
       port = 80;
       additionalPorts = [
         25 # smtp
         465 # smtps
       ];
-      services.postfix = {
-        enable = true;
-        enableSubmission = true;
-        enableSubmissions = true;
-        mailname = "mail.m0rel.eu";
-        domain = "plg.m0rel.eu";
-      };
     };
     logging = {
       enable = true;

flake.lock

@@ -23,25 +23,8 @@
         "type": "github"
       }
     },
-    "authentik-go": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1771856219,
-        "narHash": "sha256-zTEmvxe+BpfWYvAl675PnhXCH4jV4GUTFb1MrQ1Eyno=",
-        "owner": "goauthentik",
-        "repo": "client-go",
-        "rev": "4c1444ee54d945fbcc5ae107b4f191ca0352023d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "goauthentik",
-        "repo": "client-go",
-        "type": "github"
-      }
-    },
     "authentik-nix": {
       "inputs": {
-        "authentik-go": "authentik-go",
         "authentik-src": "authentik-src",
         "flake-compat": "flake-compat",
         "flake-parts": "flake-parts",
@@ -54,16 +37,16 @@
         "uv2nix": "uv2nix"
       },
       "locked": {
-        "lastModified": 1778768653,
-        "narHash": "sha256-cPvRrhNhKk88iCaZYahNOYciCbnRONfMtwGiuW7axKQ=",
+        "lastModified": 1780582607,
+        "narHash": "sha256-zAJcOvOHBdaqnmGXxeXPwIgQ3p4VDMt8ecJ2sl4cdjQ=",
         "owner": "nix-community",
         "repo": "authentik-nix",
-        "rev": "646a0fdaca63006b306578f8decfa7c5762a39f4",
+        "rev": "7611d20f7a0db3e08bd94b3cb3948d8e38958776",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "version/2026.2.3",
+        "ref": "version/2026.5.2",
         "repo": "authentik-nix",
         "type": "github"
       }
@@ -71,16 +54,16 @@
     "authentik-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1778615640,
-        "narHash": "sha256-tTBGwajdtEPuk36va5HgnnqR8sTuSwIt/c48bIinRlA=",
+        "lastModified": 1779981174,
+        "narHash": "sha256-djsdph2E+JIIu9Sy5gJwBG378nunXXK2LPW5z/oneMs=",
         "owner": "goauthentik",
         "repo": "authentik",
-        "rev": "095e2897d52397962d153be2d689cedcdb71906c",
+        "rev": "2d26ce9b538df68b9d78dccdd5ac5bfb4c1b2983",
         "type": "github"
       },
       "original": {
         "owner": "goauthentik",
-        "ref": "version/2026.2.3",
+        "ref": "version/2026.5.2",
         "repo": "authentik",
         "type": "github"
       }
@@ -151,11 +134,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1779931123,
-        "narHash": "sha256-ZJ855S3iWO6FkGQjmzR+kToGVBEJrm7NQG6/PEovTvs=",
+        "lastModified": 1782305913,
+        "narHash": "sha256-CW+mSdVBvJ1kuuXPrx05Kmee8YZUhOQ3gI8H8roFDOY=",
         "owner": "cachix",
         "repo": "devenv",
-        "rev": "40574661afa960888226da4d122a74132fb36835",
+        "rev": "5f6233e19a31955435e667c20e056ae147498ecc",
         "type": "github"
       },
       "original": {
@@ -201,11 +184,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1769996383,
-        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
+        "lastModified": 1778716662,
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
         "type": "github"
       },
       "original": {
@@ -453,11 +436,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779391158,
-        "narHash": "sha256-NUKwtyaooPLJPBOdg0piBgR6NIzY/n2W45+qkYdh+h8=",
+        "lastModified": 1779748925,
+        "narHash": "sha256-meIhqGC04O5VXbKSFXSQoOKp+XCq5RMnwAk1Guo0VQo=",
         "owner": "cachix",
         "repo": "nix",
-        "rev": "b58ad8fb752809db919ae865c6b2aa3be7d55e1f",
+        "rev": "0bc443c8ff235c3547d09327b48aaa2ab98b15f2",
         "type": "github"
       },
       "original": {
@@ -510,11 +493,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771848320,
-        "narHash": "sha256-0MAd+0mun3K/Ns8JATeHT1sX28faLII5hVLq0L3BdZU=",
+        "lastModified": 1779560665,
+        "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2fc6539b481e1d2569f25f8799236694180c0993",
+        "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
         "type": "github"
       },
       "original": {
@@ -526,11 +509,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1769909678,
-        "narHash": "sha256-cBEymOf4/o3FD5AZnzC3J9hLbiZ+QDT/KDuyHXVJOpM=",
+        "lastModified": 1777168982,
+        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "72716169fe93074c333e8d0173151350670b824c",
+        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
         "type": "github"
       },
       "original": {
@@ -541,11 +524,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1779560665,
-        "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
+        "lastModified": 1781577229,
+        "narHash": "sha256-lrp67w8AulE9Ks53n27I45ADSzbOCn4H+CNW1Ck8B+8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
+        "rev": "567a49d1913ce81ac6e9582e3553dd90a955875f",
         "type": "github"
       },
       "original": {
@@ -571,11 +554,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771423342,
-        "narHash": "sha256-7uXPiWB0YQ4HNaAqRvVndYL34FEp1ZTwVQHgZmyMtC8=",
+        "lastModified": 1779676664,
+        "narHash": "sha256-MbXylBTkWqVm8/VYjoULtMoVRgWBN1gSHbeRKsOsPlU=",
         "owner": "pyproject-nix",
         "repo": "build-system-pkgs",
-        "rev": "04e9c186e01f0830dad3739088070e4c551191a4",
+        "rev": "7bff980f37fc24e09dbc986643719900c139bf12",
         "type": "github"
       },
       "original": {
@@ -592,11 +575,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771518446,
-        "narHash": "sha256-nFJSfD89vWTu92KyuJWDoTQJuoDuddkJV3TlOl1cOic=",
+        "lastModified": 1778901413,
+        "narHash": "sha256-GSKXTAnFqRAMlZkJrIPcQMYf+lpMr66K3i60mB9STvc=",
         "owner": "pyproject-nix",
         "repo": "pyproject.nix",
-        "rev": "eb204c6b3335698dec6c7fc1da0ebc3c6df05937",
+        "rev": "a228447c3e179d477c1b6246ef3efa8cfe3c469a",
         "type": "github"
       },
       "original": {
@@ -753,11 +736,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772187362,
-        "narHash": "sha256-gCojeIlQ/rfWMe3adif3akyHsT95wiMkLURpxTeqmPc=",
+        "lastModified": 1779411315,
+        "narHash": "sha256-IMFlxeyClau51KplhhSRGhdGTvD/knShHdybP1UOTuk=",
         "owner": "pyproject-nix",
         "repo": "uv2nix",
-        "rev": "abe65de114300de41614002fe9dce2152ac2ac23",
+        "rev": "fdf2a76275d7a9c27deb5d2f2ab33526ac9052ff",
         "type": "github"
       },
       "original": {

flake.nix

@@ -19,7 +19,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     authentik-nix = {
-      url = "github:nix-community/authentik-nix/version/2026.2.3";
+      url = "github:nix-community/authentik-nix/version/2026.5.2";
       # inputs.nixpkgs.follows = "nixpkgs";
     };
     agenix = {

modules/containers-terraform-proxmox.nix

@@ -1,14 +1,12 @@
 {
   config,
-  tools,
-  lib,
   ...
 }:
 let
   cfg = config.my-lxc;
 in
 {
-  proxmox_lxc = lib.mapAttrs (
+  proxmox_lxc = builtins.mapAttrs (
     name: def:
     let
       c = def.container;
@@ -25,7 +23,7 @@ in
       network = {
         name = "eth0";
         bridge = "vmbr0";
-        ip = tools.build_ip_cidr name;
+        ip = "192.168.1.${name}";
         gw = config.globals.gateway;
         type = "veth";
       };
@@ -37,7 +35,7 @@ in
       };
       swap = c.swap;
       vmid = config.id.${name};
-      tags = lib.strings.join ";" ([ "terraform" ] ++ c.tags);
+      tags = builtins.strings.join ";" ([ "terraform" ] ++ c.tags);
     }
     // c.overrides
   ) cfg;

modules/containers.nix

@@ -334,15 +334,6 @@ in
       (import ./containers-terraform-proxmox.nix { inherit config tools lib; })
       (import ./containers-terraform-authentik.nix { inherit config tools lib; })
     ];
-    tf.data.authentik_outpost.embedded = {
-      name = "authentik Embedded Outpost";
-    };
-    tf.data.authentik_flow.default-authorization-flow = {
-      slug = "default-provider-authorization-implicit-consent";
-    };
-    tf.data.authentik_flow.default-invalidation-flow = {
-      slug = "default-provider-invalidation-flow";
-    };
 
     nixosModule = lib.mapAttrs (
       container: def:

secrets/db-postgres-initscript.age

@@ -1,10 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 jxhkLg xNDlDdho+Amh4Wf77L/0OfMWevmRQUB49fjNAgj4sXo
-iRHPgcqPqsBJVtv4Map3WRpG173YQlwZ9hJI1hgbIB4
--> ssh-ed25519 tqMvRA MGYTH08khPjQrLGFbq2Evd1fFkFbI3ap/jM9jiDnoBo
-sgWaeJ3IWV4E6LYgmFVHTIOrGZ2ZHUmFRJY+CvAFjbk
--> ssh-ed25519 720szw sC+xKVyWtGH8Hq9hwcg4X6gylYDYphP1/NanE07hhBc
-30HqQ7wdYr0n1vVNwx8pkUrm+6vxtPTz/70QkJxXrlg
---- qpQfmx0AAz4q5Z7UT+vhiwRztZ0dDAotEUDJy7xR75c
-ÑSFN3C¸QáBv窂Ÿl©L|8kLâÛ…ô lm¶¹Cëß
-QÓÍÚ™%	ª‚¨zRTœÌ-.�Qºv0-ÿ‚{‚Ç$Ï€züzJz“ôð²³ã"ÀÄ,‡íPh¹¬^Š:ÍXá9/
+-> ssh-ed25519 jxhkLg YNVl9EvnlsfS8rqCORhExodr4U7doD2sc2V2Igh6wyM
+2+9ccgcBxgtZiRARbYb3CGt3t/iUbJ1Z4GppNuxKpWU
+-> ssh-ed25519 tqMvRA P5GUVZrILJSE/ZvF/cmSAeocAP3XWsohA8kQtW3zU2s
+EFmkyCY0QZsqRhhUjYIdjV5Tqy1JrdaV0Px4rImB3j0
+-> ssh-ed25519 720szw AuUmyABlgdDYkotBpRF7MmNXjz/bgnSeIF7c6t7GnBE
+MfJt7x8ChIAaGNCs46gM1GbXPKTfU08/e+A2v+G+4I0
+--- 78XdYtCgrNbwHYR3wk2cyVTz7nJNvbbvU2a/Vv5JIBA
+ áþX¸;¾%ÖIr†X9«—/‡¡$àŒë

secrets/finances-app-key.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 jxhkLg mwMAP1IoULmBo8MiQbF7/OTFqHGEDvQAWtyu88KPkWA
-b7rx/IbvpHppKH0nkomglxRkcjE6L0/SHlZ0rwSKVi4
--> ssh-ed25519 tqMvRA 08jdQsatahCoJu552xIsjf6aeKR2kfHqcpigtVEN6lA
-R8VfTa9BUs7B6LZD3ZeW91VaMRGwNbP7+WkBi7mU2ec
--> ssh-ed25519 UJuwpQ ZFeIg0jF3Wgp3Az9XRaqynaAA9gVETjqMHAAHpn5o2I
-v+9C2KHhDPzDDGJjBgA03pbuALaBm0VP29qtpzeDe1c
---- ucg+XE0J0RL8ZN4pH4BAly3A5eMoSUSG/AqQSfXJ9Ro
-lBEÞüRÀÀIÁ½@8¥ÕP´,©à¬]¿ú–?Ÿ alÒmKž2*á:½á¨—crF^׿:S&ÁõÆqÞyÙÏØ 	—ˆ¿Œ"²†žö¨âò¸*é
+-> ssh-ed25519 jxhkLg jmZEdYs0k0ZW68F6fhW9fCtyT4WWNUeBfvoMqAdLBxY
+PW8qcAecC7ouQWBz4lyEYS/Tssc7U9D9RyI99tO+D4o
+-> ssh-ed25519 tqMvRA VKn6tGS4/gim8rLKoi9N/NrsGLgUph2Xjl0ek3LwyjE
+m0fNiJqN47AM7NRgFY+Wda2QL1FJYt7zKMKx4ngutLQ
+-> ssh-ed25519 UJuwpQ UydkFFa+9kSqWRmhLe7878GPVrC+wAPCIhxidM93VgA
+YDeQwo+b/bDrCSNyar7Je12RkhFKkN5BRKgk037uPVA
+--- 7OoH3mHI3xhpIR9wG7x99bpAgRz3f/cATOo7bC1mUFI
+¤hÿ#¾²Ò>žë~"þËÏðÞ‹ÿ‚{,æ±³;žèPu‚aÍ‘¥Ð¦Š®§túGÈ’i¶Â•Ùšêè–"ó>)Ñ…rÐ 	CÀ£›ÙÖižÌã®

secrets/mail-smtp-relay.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 jxhkLg +poePGAJ/ZVLHPXEK/Yr8tpmWZBRwB3bdx5FnLARY3A
+9/OA2Mix1X+uvrFEEpZVOJZHoloVRSL35iGhxWqv2XM
+-> ssh-ed25519 tqMvRA DQ+gJqcSfjmYxs+L/6DJ86yEkGtV4v+Y4xJExYNuVDI
+lqv5OaNuHKtXjpgEQwlyuahp1O5a3nc83W8joaNn/mw
+-> ssh-ed25519 SEy3Fw 09q3eW5ppW9JO0DWQo34VdaXHEllKlxnTdCy+K2SoAQ
+bQfnSNiy5ZZCT7hpfNiLVVionG/UMVsYBxMWj/1359w
+--- yiuElsPJeYH/0XB2YRd3gnwYFMPtPDXJQ71zVypdJew
+¥ah)øožZŒHp
ü@Öÿ/®¶ÀîfM.[u!Òp”=gŒ¸
+°s½�Þ×F�`‚
FEáŸê2ÁK%w‘¸˜ÎK¬mi&`L.›*þ@R€"

secrets/mqtt-password-frigate.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 jxhkLg ZLzOFFu6isbAWkrXF/etG1sjvE2O0hvDCz/BFsvONQg
-gagibzhJwfpwgr3XGZJcaaD7IztcAH+HlxLwlhaYah0
--> ssh-ed25519 tqMvRA c7VvH+2ZhDozgIH24PiUaWzkEgYYHgjIq2QrQ9XAWy0
-SGsGZOVSCsodoc3unWEgaG2swbZ61G39rcQFJX6utQI
--> ssh-ed25519 5VK9ng g1XMAKsB6l8vWxAAnIJIJWhzBVBeLFLg7JqzadibyBM
-2Drr46dDuVJOyH0kp91K/qVdQsq1+Xd7hgoan0yc6K0
---- ApI3P3YMJmzY8eFcZ+YzZeGvJRdqvgpMtW+I0KM0Y3c
-Yﾓ}6ｩ･ｶsﾆ(ﾑq葛ﾌ轅�ｺcﾁﾁﾗj蜿ｱ｣?ﾚｾ
+-> ssh-ed25519 jxhkLg WOtezChzCSmy1x5ob8CFUKcjA8tTTJaLrUj0dhKUgiA
+iYFJ0cdtpHdsK4FXRgTRAaZI7CYS8VAUKmvHC0TP0x8
+-> ssh-ed25519 tqMvRA 7AQf+l0+15W34unEqO3IyqD8qu2mIMXpVTActsUd8y0
+3xcW7LAmcUXxQKBO36WACH44IziCiHt0G1SmT4SFC/I
+-> ssh-ed25519 5VK9ng Pvw6cet2AVlGx5F1F/5OM63r0fgGYEc7dCsipRPAkVQ
+3HtvmxOzT4bGn9aECfusyNCpaTCNFSRgUSbeRik1wwA
+--- 9dSUckyaEH5FpzcEdNTnC6M+5v7BwJapMIcSIFR29Tg
+¶n@Yß½”h'ÖÛ¯Ó¬³”ž»&è¢ìw%ö “ ýé

secrets/mqtt-password-mqtt.age

@@ -1,11 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 jxhkLg B1+QK5IUkrya5HgZLF8oWpMiL7cBK+OYNCvNeodmqkw
-mTglq5BlxDDKiYBe78Cs8tNMv0yksrvS4tyhCZKJu/M
--> ssh-ed25519 tqMvRA la4nh/Nr0sNaV6JVhSi7cYLkI+kgbIhEr2fTTa/wKRA
-W5qaU2lfPLVPomrkHvdwB52LxJPcUvvcgI6wN/gqeYk
--> ssh-ed25519 5VK9ng vsmrq5wf3y4CiSgyNT0aQvrxLTJ0WcdG8B+zAbdpgGo
-hDADh9v99hacIc85T+QP2oywVDyqJjlKVa0skJuf3BI
---- GT+Ns1ZRlOOO0HwG2WcpgG1XLf5NJzX2Hg3aJAL+vOA
-Š0‰¥ràÉÊO>ýµ¦�¸xI48ϲ¹s<Ù×ÜànÍgâ‘Ïïq'¨DM�FP*ŸòŒöQ¿P+ߥ¿fŽ÷ÖgÄ
f6˜£è$xoúfðq“Z$Þ�8r|=›vÁ&Ÿ
-¿ãLý�ó>,šô
ÛK¾Ñõ5YI\¤Uc0Ñ<#dë3u˜Õ�|tÅÊ�Œ}sÆíP
-æv8=AÓ¡À?•­Òìó¼çÖøŸ}Êÿ«+á5™P¨­?1Ñ×´mÔpèÚçZ&cžËŒ¸îù«N'€¢ò³¶¼¼
+-> ssh-ed25519 jxhkLg dADzUsvWJkprV9aYYdTQ4tLd3V6H/lMRNLaAC6fNty8
+NVzvSEd7KBDfkqbkrZgVgRJkFi6UmlqEIPr2sK+o6t8
+-> ssh-ed25519 tqMvRA XnsNo926VyUqSppFZ50N1KtzK/QCbi1lF6LJZYWUsGM
+atsaJ7XjRum1dWvIjxdUq3Fr3Ypp7/RO7kqSqWfgUrM
+-> ssh-ed25519 5VK9ng PJRg2ljsArsWYgAsHk8optwi7P/vZirhhX5FbINHjhs
+pFJ2uibaYO2hWfSnyElxrvoFCC3BpcZOrnxET8ynBUI
+--- 3vf+8iS73Sk0CeHRLkxxX4kGg+py39sAQVVDniljAEY
+\­þE~D×3xèžœ™ `Ù{ð
+‰å4[Ÿ‚&V­2\]Üc4/n=”P.ø
+\E8os�wÉbÞtC(9›ÇJŽŠçÿ4ˆF-Ï+—dÓR$Ùœ:#¡÷óÙa)ŠYYHãY3yg
+ð
+¨Šâh„ÅÌu	n‹K˜È=kWnWýŒÍÇáîÛžßçž<?ÀYŸØá¶Q}zò¼óGýõ…µyA«ý†%x¥Ÿ“ÈãxkîHÈÌø3 Ô¯cjZR=j–©Y×¼

secrets/mqtt-password-z2m.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 jxhkLg RCq2VAcmya10eK7zwPVFB0klV0zSNkHmF+WlnJXaWzw
-8ySn0NB5FNb7a2qJOzx1yiCdH2MTJWBUUPc2i5ytly0
--> ssh-ed25519 tqMvRA sB9nTKSEnh1AQ0rYf1uYmd2CzCabz2hEJF1XTsvrtkk
-ASWOYP+4XiLxf2OLbYXRDRTXfiuLqvxN5gkoEauL8c8
--> ssh-ed25519 5VK9ng KkXWseT01qSmhEAeotqEi6CG4zzz+50TrKclYdn57AA
-hThUinxaRHWTD/wAhELcYWj6qcQ8V0Ybi60cnUc7pdk
---- h3P58TD8hmBfKLliCDSL4m3bCJHLs80yZ4i/croZp48
-�]sM`gｨ愃ﾓ�Z｢=0'荿ﾖcﾜﾐ┨�果菅_ﾙ･T纎
+-> ssh-ed25519 jxhkLg FFstKIybiFO48aoLNDSnDSdwIHAZEwe7CSWt6+YnqyA
+3i7YRHdvQ2kD+frqH1+wvCnWx4py78fahA7AWAEMx1I
+-> ssh-ed25519 tqMvRA 5KeC4teldBf/QTudaRtHbP+6LfpZ/m75wxVq4M8LxEU
+H8Ee4v44FRfapY8tRGEFOneVzji8QOv/u1uIUD/mrJs
+-> ssh-ed25519 5VK9ng K/C8z7WTlyjLsH4n4ufAVrCMCkVgQuFPpyNz6Mcxl24
+dsZ/aO4DIzni7Dkiju8JVPnklhvAdiujunaL7WfAaOc
+--- kJ92gmMAzGRD8THcfjF/k00eo3+oMSiETAYR4wJOsj8
+£éûÇtçü¤�ãXâ¥&Ú½§�ÂÖÈÄnIÄ3qÙ÷:²š<<ÿYÐàÞC'¦ñì

secrets/papers-environment-file.age

@@ -1,11 +1,11 @@
 age-encryption.org/v1
--> ssh-ed25519 jxhkLg BZflK7sIBRQVRQFl06h25sX5KiWHsu3g39r/8uMpcwE
-beZ8ZBKgRvJvY3EEhJ/ylKdDdWTz2u08pvWbVaFg8m8
--> ssh-ed25519 tqMvRA CQtMI9v79kBZoiBrxLY91756LiAJGogbTb+ayd6cRmo
-F2MiE9whRNZ73cskxhXeuudvMgA4JOvbtzotNpHMIf4
--> ssh-ed25519 KkzjXA uH+5mcV0ZZ5oKNfq88ihWHY/Z8YpgPjzvkcvhMJOKU8
-4z8x8XyAYsaIkXFylMEAwacHyQEJ/1mYFXsEsdnZ74w
---- vlF5pHK/D7m3ErKazggz4xxdn2hcwGvvIYrZtn2sT8Q
-o¯ñ5àÐ
-ã2¦ƒÅx6óN/NóHèù_�òSH»B­^Lhµ«›
-{å‚,Cjî†Æ½©˜Âå•�4„€ì51È%ëc_`§41Ñ@Ú‘T׸¦«|>¬Ðòvè¥ôvî­ 6
+-> ssh-ed25519 jxhkLg b83U678xLJlB1FFoxSaeG7JN/4v1sVU4QsITY3j/awc
+Dhc/V5R3bK9x7i2ws9FQ4O4HHT6xTlaEKt3SXJhihTk
+-> ssh-ed25519 tqMvRA KPLjl31HwXs/ucQ/LJwEL2+px2mSkCk812bGk9rTiWs
+qADzPQi44e9QiQpXpoyhNNDuULJhTXo9x0109lyOq10
+-> ssh-ed25519 KkzjXA 6Xwc9hqBdR7LPYNmfEn5+M0n6QTEBkuNTBk/t7ofh3Q
+GjcVMhPZ6X4ybBxtIabKFegicdTZbq+zQWvn9PYNeME
+--- 3ZY5ysyGfwJ6Y0/FEO7YpsFkAJkn9B4D3gIzpZBPx10
+;v"Þ‘ÛÏ×ÔF¼>´›J”4Ú^G«Èe´ÇZÔ�$Íʱòc¯L¦Ü�•
+n®–jŽ‹ì%HM”Ù=[]J±¾ªÚ}IWAE¶dgÝûŽWŒ«¹ŽÕbßšÞB�|_©1
+óŸùþÿ\HeLz¨šÑŽ¦U™F}E*‚Ô½}

secrets/power-password-file.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 jxhkLg tYj2oLp8OWZtYmj0gKJnEE5G+3tmfPul8tGt5fnnwDs
-/SujjcZxvPmZurlLWETwR8JhH8LIJh/MeoogW5VxP8w
--> ssh-ed25519 tqMvRA qY8Cv7G1UJm139N9NxA4dAXAfje42n6p7ZajU8r8Fgo
-Qw4WobdnlixxHxAwiTCGyeJGzcfOWxslOmS/sYhiTug
--> ssh-ed25519 DVDL4g Lkxuay1WN05O7uO+onML4INymrsBf8DrBHyGPhSW5xQ
-sAdASiFmiCDRl7WfI5k6Qz+fKY/FG5H9dLucFluSFTI
---- NjnXZAi+St4JHuxdQ6/rpT//nwTwY3MA59MotWicycA
-EwL�Kﾈﾘ?�･ｱi6jw€ｾ2ｯ�YMｹﾋ�rVOP?股-ﾛ
+-> ssh-ed25519 jxhkLg Jt0tBomUSwoxIf+D0n2leQ8ULQcrpWJDN4Tm/obLnyg
+yct3YGS4BiDsAZPlKZybD7GVoqQdL1EZ6dlHXSY5b8U
+-> ssh-ed25519 tqMvRA amDzRhpIGTVsZxAHWSUacZ629OEttMU1VAOVKdCLyFE
+2fRvar0fSfbYyw+O4zpE3DusNKtuFDOCVxSzMccaMKg
+-> ssh-ed25519 DVDL4g QIXLyMveRBfhcNCrbI0ZpZqjaB5j76ROsXs7pUquZXI
+vYciNWwJrTuGOZToE7eoCYhrGOlwqd6tuYeIUXQGjTs
+--- 0J/foPauSiv/wNTq2TkTVBnQOqm1dll+xyqwFqM9lpY
+¸›øÆ‚1L<¬ÊÎ!ƒ©5T>ØKÜßm‹×+»×Šê5bµüoù‡•ƒÈ

secrets/secrets.nix

@@ -31,6 +31,10 @@ in
       group = "nginx";
     };
   };
+  "mail-smtp-relay.age" = {
+    publicKeys = users ++ [ keys.mail ];
+    extra.owner = "postfix";
+  };
   "matrix-maubot-cfg.age".publicKeys = users ++ [
     keys.matrix
   ];