diff --git a/modules/home/cli/scripts/generate-ssl-certs.nix b/modules/home/cli/scripts/generate-ssl-certs.nix index 414a2ba..f1c3aec 100644 --- a/modules/home/cli/scripts/generate-ssl-certs.nix +++ b/modules/home/cli/scripts/generate-ssl-certs.nix @@ -125,10 +125,38 @@ pkgs.writeShellScriptBin "generate-ssl-certs" '' "${pkgs.openssl}/bin/openssl" genrsa -out "$tempdir/server.key" "$bits" + # Wildcard certs must use SANs. Some clients also reject wildcard CNs, + # so use the apex as CN and put both names in subjectAltName. + cn="$domain" + declare -a sans + if [[ "$domain" == "*."* ]]; then + apex="''${domain#*.}" + cn="$apex" + sans+=("$apex" "$domain") + else + sans+=("$domain") + fi + + extfile="$tempdir/openssl-ext.cnf" + { + echo "[v3_req]" + echo "basicConstraints = critical,CA:FALSE" + echo "keyUsage = critical,digitalSignature,keyEncipherment" + echo "extendedKeyUsage = serverAuth,clientAuth" + echo "subjectAltName = @alt_names" + echo "" + echo "[alt_names]" + i=1 + for name in "''${sans[@]}"; do + echo "DNS.$i = $name" + i=$((i + 1)) + done + } > "$extfile" + "${pkgs.openssl}/bin/openssl" req -new \ -key "$tempdir/server.key" \ -out "$tempdir/server.csr" \ - -subj "/CN=$domain" + -subj "/CN=$cn" ca_crt="$ca_path/ca.crt" ca_key="$ca_path/ca.key" @@ -139,7 +167,11 @@ pkgs.writeShellScriptBin "generate-ssl-certs" '' exit 1 fi - touch "$ca_srl" + # OpenSSL expects the serial file to contain a valid (hex) integer. + # An empty file causes `a2i_ASN1_INTEGER:short line`. + if [[ ! -s "$ca_srl" ]]; then + echo 01 > "$ca_srl" + fi "${pkgs.openssl}/bin/openssl" x509 -req \ -in "$tempdir/server.csr" \ @@ -148,7 +180,10 @@ pkgs.writeShellScriptBin "generate-ssl-certs" '' -CAserial "$ca_srl" \ -CAcreateserial \ -out "$cert_file" \ - -days "$days" + -days "$days" \ + -sha256 \ + -extfile "$extfile" \ + -extensions v3_req cat "$cert_file" "$ca_crt" > "$fullchain_file" diff --git a/secrets/crypt/ssl/ca.srl b/secrets/crypt/ssl/ca.srl index 1b8bc3d..219d795 100755 Binary files a/secrets/crypt/ssl/ca.srl and b/secrets/crypt/ssl/ca.srl differ diff --git a/secrets/sops/tsuki.yaml b/secrets/sops/tsuki.yaml index 8b0d11c..1b9bdbe 100644 --- a/secrets/sops/tsuki.yaml +++ b/secrets/sops/tsuki.yaml @@ -13,8 +13,8 @@ ssh: public: ENC[AES256_GCM,data:pKqp0dHHmB0nIVexYTDAPq3dfHW04O44o5imwwKt+NzYqvHpLuk+ML2jmWbMK6olOSZhDiHb4vGZUOr6GZEXSMGEjIT+1bWAnk+EgV1ehHEdU10thvsDb65+3zMpoFE=,iv:UK4EmLIgMP4V0UAh/4fiufFrCJPWjpzi3O4Nwk2H4q0=,tag:1QlH2c0j555mf4JXQ6x5Mw==,type:str] ssl: wildcard_yumeami_sh: - cert: ENC[AES256_GCM,data:kR1Z+Z6af8oOxiLs4gAoMWZav/gZcaJiWAc/UWUwhRjk4boyOFE5QwS9YJ8VPVddqBxWgQmcimZrva3g3sZaRO7KciNnieCrWYN7WZZHvOiuvMDV9EiBYxV1r6NfIKf7jUywVKu6FSqU1ydalk2U76O7W8oIWQ8jF0EAvMGVgXiseVqDLSEy4NpWFxfsrXADKhgm5nQy08jFT0KUynBrARjNjbLsxQYSF4oyl3xBemdUzDGps1mM7OxkzxC1GGlDCDFBP9GfL5cPiHrXYS1j45GK6JHwXeKKgTJWWWFywWJkZQbrXg2Wmn+u1GubidRh777gGO1x48o4TD5GDOOEdu6f197TI1eES+8l8cZybZiwKl25Y+PrF8Na3iAyZe0nYmdrOEJDTUUc1nmZaVNXa1HtHf7cyUqHvVnHHL3bdfYHDTlb/bKFf+L9l+VGMAKKK19r229S0l5jlrMFRQd/3bJMgeSRz+NgrKT/huKuh49uxbWW1dOo3mqFOzaz7eYI1Mh2xlC+EEJFD0Gq/ijMmD7HKSRa62kXLCXyYScJPR0HSzjWFgFZBO/dKb9puNcQnYamj7Q7ZZOzxwnt4mm6Wpxs347r6n5LV6nFmX8cYFlIO0UpRQLdA5YJEhRldoBOPpkbgdtUOtr76/y2cVatT/JKbdZEs0FuzNviS1wY2CkRGSimpDz+IGchLcHfUGb2PyukzVpSlSoIGslT0z5DK/zhA/AjQfwuu1GDeuK4IK8Yef9kv+UXso5BbRTL3OzSv8+TPuHcr1QDb/VmqyAAN1Xh9trPcFbejdrBDzia/bTLqwNsRlQp7T8zvbPKA1VlgGd8pEjkuD7/2B1niMC56LC8h/UVn9WhnPYRgadNskHhV8EQtYAkpqiruSh3JObAka9R5tO8FR+KOacdfWpMDDi7jR7E+BwBKMJtLOrTmT4ThyJ3znUUIRaAfR0UZ6Hy7MEpK5snZMBut+vgI1VZlE6BVXmVnJ386n25ZSmxV1eT62LTYdKuavvYs/DscCn4PTXDIpN9Hwum7yLV4qvDZe1z7g2QPuhpr9/K6kx+GkgGJxvijd1wJRFe2nQGDdhuy0DLi1wE1gDGpEPQSgZE3mvQH4md5hwrizXhlUdwFG1jx+eUUcbwt8YPEioKy/lyIVYmKkldCjVz40dHZfRqtROnTK/a8itzYdOcQKq8eHuPNYydePJ85ArujgagBbS1zngY3BSLKHbqGy8KnFFfrDdT5V47w30Gduulp7RTDONZgZza8T6gTDgoUjgX5t9vQ5dIysv3q2NyrHu6GMeBOX59Zsol6DP1NBt+pq1LD96av4L7pe95870Y8180yMgkm22HLQ5ZvOJmsOCfifJ2kwuax6y69xnkEA7HGe/pt4Ayy6EMeFa/IH1C+2HVh3e8oYjTkv3VKA6UqhwBplzbPquOCKoHGBZ2QQmIL+dKy1AdRNUjmbyJWK06TTmJ0orqWdQKO+K1ACHQ6LIlTjgzR+40XMLOWD0+FGozGEmbqcJihimRsxb4lESb093f099okz+NT0mPWgWJQA50bajxXhG++57ajhoAArUWO7nmGamWjCzrskdD72ykacZ1/y+iQfpJESOmiSI3fwERF8wPgI7sE0JmyOvRnyCB+s+MoKITtR7CCcKHI7wJdzM/wCAjIZX9iZf8rX3OjgNRj/biBVzgFcQN7wXeyJS3BrWaeHre6jPekf+90AAiItMNbjSe7HbMFdN2eViHVMy+Cf4nOl5HBlN4pNNUNOx+baVeBt+UpvjkckMOFT01D7Jmg0oPbbgY8aovSBJJ2Re4wDmW0wOhc2/Gw8QrV70EvcAHRLjXNV/ZeYNnseWQf/TDZSa/zx0ZxkbMskYvh/zZx1wJtKDWFnQJMenrwkdem4JzfX8Eso2m3DorM/Xja8mFR/CYIZKYtbmgcGMDzlcMv0YmgrGbX5H1R5mowjrYsoRW/BLWkSvk1uzTTftk4EA5dAOR2d+lwX8rG4IR24iJSVo+yjoff7VntZRs5njEoii6Bisgobe37HIysQw91DVu2j6Rk+RsEPSbHfqtzQ4cqC1OZRLDizZSTJ2Goq6cZvoh8UMFfph8vdo3lURpz55pEmg0KAs0keOISVkOALvCyTQwjqDMLT5l+GTedKUsRzjUCamWJLcaXb9htmjcB1Yg2LBxodrvgtx6cuLYynNCa5O0O1IW5rkBUju986XxPNA90HTlxw3BIbNDZ3doaZNZfpgGp5MJJIpx0iux40mH4l7SFI7grK8inZJrZARbWmjTLzhEerdBgBpVlkfyyOBXj02OAc6SpT80iaTgle54kJz/MXpfhl0jEjjmsWoGHMVdnFoYuIhbodSAxhn/qxjylaJQhRPw2N4So2Hrd1ksZf09rLmyYgffl/7/DuoMyNI=,iv:Ulla9U0kgeeNdKYJ4WL6lUTSgdFwp3c35WjrOoenoQQ=,tag:Y9Pkf+0D+mRDXaqLTLzUvw==,type:str] - key: ENC[AES256_GCM,data:oJ1/hkVN2wUShbDYayHB3PeMDy9qKA4QiPLgRDbBGkBF3jbydSYEXPcGQm9CbPGwUeAX92dR/jl7ZFbqHzUcCf377h+rQN08xkEHylm7QxWx1PJ49zzkmPFnG7QzBSjGMgGlvG9gI9zDRQFAqTc6LMrL9iEEniFTLl5rryGO4l6rg/gPx3FNtGL9BFkLnQLhELGIvLrvJygz7Qqc6KNr8eYDdty95eZ6dxprSp8ELRmNXIoxoLXeZ36eMRAwB4coBvD4LBDhoDqqaQPCw7DLd/hL8sO2tOy984cxFni7INAYcRLSPicW25tb/bXjaLz5DMswzFG/MMTa2azK2hGLK5jCBnt0bEg5/VyopuEwxliEph0ftC+cwHQEJJxLNSLjrfUXR8rYFk6AGJjnbmCQ6fYWDjEPcTY7kG0arjTyWqKIUA9F//Qv0j4XvvdQhNajfQSiL53PCmGX7+HCAlCfEUNeZg+ywIhL0edpvwlUQ/izfwWGZEGutHft5P+q5nIno1z3TqUdVL5ntgpFwiVvSR6tANz9E8rF5K7Z+SVl6fFNzMrWZMmRQuVfreD0c86ycCBzsVbF5T9TOuzwto7yWCfGZLz682fsVA6R0K5RidakeMgbt67I10L8QyaszuJz21rDEE9PC/L1lgjJnbIjtt8vCJmN5+sDDVPOw6cs50LMlPRlesSuJW+0iL+FNn9IBVlPZQnH0JXuXHTtlshAFeaY21xGq1mEjVsGnUgt3ZPMgFMMUjml2mu+fr+iq5o0q1fbY1PS/5GkCnT6GJyAZtMelp6Tsbe3d/GZeyKebvuZb/TJ2hYdaEWTB7gB7uvywRDV1kbkocIlwAT0k9QkfN6BmUOBtl/MpZwEtiD1Ivh4ut1LnpAcvandYUDZr5IQgU7pQSc1KJ8RxJO0HomPa5FvTUDmcc9HFAtN5ESlL+J401FbBARrq8JYrZkEZV6peElCE2D4YIDQ2B7H8R5fws+HoLY1gWvuVZBMJRhkvr4SoP/+TpfRL2RTjMvazlyJC4HicbFauavTJADxAk/1EduayAACpvXFDu47CsyGCeP50fjURNH1ZjpF8/rTy4DQMC5oLbyC8IW9B9D72DbRPGL7dBm7WuFoG5tAcRWv5vAbrZs+g9NUHULT5r8JKtp+z5r6AOGNNSqycCIJL+Hnh/aTWYHabQ15jQlqm+FAdpGAJFL2xoJfdTXGY9io/vpLAIERaOPtJn2GT1Nhk1fvLiuxeo/quWG6U4oIIEsK5DESS0nLKVLhE8bIZvXTnJk9jIdltpML1nbOOUHE6JdOqEpBnB9joSzkip7jXeI2L46aLIepdYzGJdp/IHyVLvcPAUCothz9xtVb6n70qLBrJynnTmDGzhJ5P14sTM5A51eHpT3iy9vNx3NQvWLepEi3BaeQZHQ0WJtmp2yp0uQU5tRbDa44ACAuzhVF133EckIOUrWEPcp9yeWOe69K37tq8FcYy6ahbCdrm++cbqRZRHo+V4jsRUWBUxrcI7K/7TpeAF7r/qxLR9nkWxTyM89BZVzyPsbcqMCKBCG3kKdIg0q+PneJSYnZIvhPzQKwPedX0qb9r7FLWC3ulJZPWfPtyrHEq/tKkRaiwUoWtZx5End/boQKKcnSP8AsfjmmBct3jGLm208r/yDlhVfw3m0rT0iqzRw47+goxpXEtnWHA6EY1+RxvbKZPk3ustnc7+AG1oxHtyuyXBX2mkSvvLM7MY/uFUI/qHH4UvhMmfN6DYLQv603X7sPUGXhHPdoepRGZ3x3Fa8pg4cfRQcPKHt5vMVfCfPsJQIygSsJ5IJ9LyavVm6eXPxbcEpNllvfEtltb+ehoKB3oLPQ+F/T4uJN7vYSLoV3NC4cZM7zMB0dicLN3boxDBdceN9VGlAt/ssubTtr0F3O3R54nIXh0azrqIfAzjCNpSQJQjnICZvDXKcjVaETNrO7QSjDDxz4M7FoJMKDTCZFfk7Cq0PfMLVCRRSC5AYj4tjiINSrtSHNTS+lNmmNuofW7K/QonaUL+CMQ9ti092ToA+6Tgh1af+LQV4Pi1vYvAo+lQsnzq+CO6ntbMIstaDr4Pmv1lrHt60jKb1bFQFLFIoG6rsiYXIMmvrHVUuFFcaPCC2h//HpJNS3frdFRoxCHBHO88SJOXs3TmPNUzhRNXL/NBmex6PGHS4v/dbr2aN6IGDRJWmTTfy7uEKwt1WQ3vj1eoI6yy54MBy0uv9fqTvkOOfVTULKy7+2r/M34pvDqjq4mUTGey/N8W+O4CYwbDtZhBtjEtwpDbjfn3X3Y0mx35ZBV/IJ1aAVEenNJg0DXqa+1pxMAOaiNyMtXtn0QypQe9SRqNKMZys+vVVtPfkLom7H8tuABbLiDTJLqRpmEbzinRppZGX3JKxSct38pfG9A8hqfUvu6YliRUWRKXFwWT3QUVIzwnrAXwFZOyWlOtoniO1qlDQ9I7kVXL2Te2mU22XfBU43Z0gNOeMO5yuW2Ez8t2OlziuNnRiJIHCjpDSAPT5bQyfJMnqum2rtCrcH6C4sApYhD8jSnb/M8VW+1ZPqRKYxrX2N7MXkIx5/6ss0h3KR1a10niBASivOc5mg3gsSsJcc5jKzZIVSDMen/pCmP/xjApNQdJTZIlVYZcSG798SF5zO4FX7PD6HYfMIm0NkEaYwpyZoc6Gw/XDdhkp5ncDvbOpSxx6HQo2LT3OEZY3jqGRLgA9OWFTSNw/CqdVkIWr4lidImssM5btJtjIrLMeqBg6dwlcc1q2k6nRMAFtnn7eYdn/TQXmc0ZtP9yAMNTj3FYf4a2baFLOKmSA0/YAuOwgniudzwkxzeAIJweHg71DLG5GhOkhSn1uOwyauXkSHwvcNYYml2kwjw19Rxfl6ufpGHC5E5kYZ6hOlpVpMKkbJMrz8adEaAGI0F5pOpaejUdjhfzbeM7HEh+LAHmEhU9lhnkwzNO1tOdBTKbcgzrbaynZU8q/sCFtIj14oVKgtyGFpqt69s62H7JHT6KHVgjFc+965j6uJjfr6r3CDvMdampb1wD6mL9siHGK3OmTdXONqoaSU4q+sBqFkJVdPKc29yOhY9hU36pGeKhvgkZYUfledhFZnwaOFT/tnQ77qhcpiZP8BZxBLAC1uanqabAOvfof1Rewpp7bqcMSbYn0OfE7ecWR1h/oDVKtxaz4c28MuDADvN9G3+1enudbfGzMZFFUntH5lysH7PVjwe347OnJI78my6K/ld5mNenQpLrui7CdD0yFHzghwK45N1mivTF2JzFyloZxD7MAwQyyA0vWS5zH5kyxVenIoJrq/UqmTYW7YGVdtIxik04ThiH+DsP2+6yzDrDWTVn3Ssdd/rbgIu2l1QETCyujRXT1Whb5iee9xTTXWOKBxNkIV6kw6OKDjDwAVlwL5n+TNEwJKYO5slN84aQTIcLTu61qoP11EEyEx7pkSV7aMIN0V0DgyrE/FXrvqhz666LmRzOqAsE6ZHzazlT8wYK7EJUVepR5UdlGkCgxR46i3txtY9yNWPhroVlXZm2gCAZGDL5/tuIvDpkDKBR3NF3cVE4mJ8cIwgwtfAKNT4M3ydDifqtXRE6DhAkPluc2605h+dl+Y2G9qlfXdG6KQm2rYatloEwv1R/QHh7g/rY6MynUEIdzGfp19Ib7v4PHwGruHB1rRJDrEP2eQxl1196rNDEDGmQOVqGnclsm81IKaBVVYdhgTmU9T/DiXNYaWPB4py7JqM8Lsq2dRdPPp2TXz/G2Kd3G3z/RNyrZV3KiMiC5cGRXJYvIU2h0Dpcp3LgskhYkFw2+mRb8L5YkhC16CNj61SzUybPFbktCQLJRuTq7NbHNoEWCADuEGeWMuWeMxue3r2g2fv3a70ZSqIloWpOKxo4D6CaH3/5nLMWCRmFmfFBlOZb2ZcsFC++Q5kNHkpLcJuO5kdqs4ZxMr4CWfjJPkgwo07t2de4Tj4clwifOdXj3EVpfH/YB4XYn9YJxvM2DF78mkbXIiEwyuvPLcB4IgN4izvhp9mLH7WfMMkyCCiyRsHTmF0KA7UXxATZxJcZJAOwk6nHAHFmby4Ki1WIaTcYLqshZ4lPDobMpooXTQwgUgDIANLWVP0nSSzPIIsVIGwxE2mH7DQSw08Kd0dCLUQrzBGiVZMWUZ4EmA/swenhAtyiTKs3OkmS9/IxOBcVOS91gvJoKUtd12neXhfHZW3xpSzDN83qde/iJqh6td8wd1Vndkw1v7/3kXUKqPOHboA7FOM6q07OZwsKObWCrknBPdGa8yceqEOejHbAeFuZkdKwbodEcsXS9VEdoK+NH9sUzC/dgNL4qQow09GnSC4Zett20tTQU9sJZwj7W/UNBi+BArMMM=,iv:/MLZfydmJpJh8xRJ9XD/POV4YtmUM0Vo0BJ54Oqfwbk=,tag:LBqQ+6X9rjUeSjo6uR5mRQ==,type:str] + cert: ENC[AES256_GCM,data:zsdC73l94s/t358XA4YRnz8elSLDTySogTYJutYTFGpXkXDIOIRagyI9bG43AKmuP93k257nH9V0TB5O3uH8Ia2FVXoFaU2/YtcRTJ1npTN6P3kxYndLevRnzbZbfy5qHTyCmVQcbZzpqJPfNDSTSn3/mH11NaZwP48qMPWUhPrJkJKtyRyGrdWQEYLtlWWlohO8+eAegJVlLXHaRlOq2V+T9yTKtqA01TOeLgoJDbalY8TLTUqAm7tW/RerSKKoaL3kh2wn0XjoDc6zRPA+zRwQwEGKDJXPwP4GzjtWTLc7NxlQbrdcOzoDQACnUxxtjEbGqvzZ5+CLFr6kt7ivV3c3J7ukW5PR9GP30zKV9G/VypmvjXGQQ5s+CJYIo4CdhJGmGM5vQ910Dvu7NGV7lnhQoe0+auiiZ0rnPkmtQi1wB8zRh+HvSXdw6Bu+GgK8b6UOg3FjQR0ZOj1wAvxESIES5Lo07NoX273lP/Z9vMIBMlgyzkjQGHziblk6LJ6PP4cfGS+q2bBQyml86ktDY0RZ68Y1Sl+BspeOf5pGTPRK+C/kFEkdmEI0UQx7F7cgKpfaU7UhU7SdIcf4kmuPLot3wgFjteMj/iyB8IFABvqBo/QTMGCJpdE7LqtBqAl+KEm9TTBcXHz8kkG8sbZJzOhkvOfM8Zps+sWS/LZgXKxqqVJ7Kfy8Jd9lih3TOBW45CsA0jLENrsOid/M44Va2uqdi+HQEsONdF+Dx7iiJjiUTdO7iHh5ZBwpEO5hJCi7iou85qhWOJrYgemJvC0Fdd9jh13Zqd9LRmWzAfXFoHr/Jv6j1oKBHdbEV9fOeo7L4LR9RZx/AdTHeBNhHj2LN1eI29kKR2qh/iSPvGO3wsrFt6pwn0MCjQjBji7WuBi5iAxUJXOVA9S4cfSiWoTkrg9LsBbXqYNQUn6EE7zuiwxUQcVKBWrTbFex3x3Tkkwj5I5MbmDtBH4Sz6v6yyysL2JPpKCQkWDpm60XnbsAnGmhQ1XJRAlCURc29Mib17Z1u7JsdufX6Il+U4+2oaYabFZH9a9qw5dcElG/hFtW+FyeTd8Ui1tgKVD4EX432Wykiwhtik4VLNo4LqnJ90Dx6K34Pg+5DIoWh+ZU7hsLS1rohlD36uW1JFooRhk0dIhh5q+BcuMITVRCoI0DMIFwHoWF+/8rb++ofVJoSsR+2k3s7K16rTaxRb6JPC6t8PAWaTmLCuOtDdbPPEsv7jpHVNRn+NlElRflfiQye+0S6HFdMfrpyVBwH2eFx+dULVf/O6LcN4oCuk4ptR/9Y5qwiiighaIcNxK202UTRBv6DqyNfBDWFMTHh87+btwV5Or0DI2INFR3BZloNSzh8NJHwJkUsZ7L/6/IC5OAABbGojU2/6pvdoesQGheHBLbdOH47swQeDNkc2LawkHLY2eZ3BhtdSza8YjAxEF4xLAv8hVqHyDCv2RfyPh+CUHjwNoM1Sb5dqS5DvpF1upn1T68rclPwNCf/2P5bxTe25krf6QeM59TFdqiREapiWiMgBsqvrrCKUPzuGaeksbIFvwPbNe2LNIZV6JV/I73APwoaJUbVslQnvVOmyqUGtDFFUm1ZhAgwuSiXKqEmxoJ9OLOGBTJkgn0PphcODKQLn/oXVWgpxeVm+Hjbz+9RlJ/4w+556edlzdn1S0E8mEEAvzXjsyW009LK/9V1r6wIuvN+oH1VNkIxkN+11GrgYcnISfVAlkd2FLoU9Gh7BEb1dFu5f0VTmchG97J24HLRREP9AEEFHfGnzqyQ5gGdt2qe++odrP1sjt6J3SgMl0mTguxaReEmVAEGzrZX26wQtNSLgrJghHgknJ6MdxEJTmm4k1lzN23HLV3nf76ApeS/vj2aYb/VTeKI9y3NznaLIKjuljdap7edNrWv0i/yKv3YMlzihDC8euZiMRYrlFMM0R1ZdrBf/OcL8Vg7waHq5jY4sgjCmur8Y3fmLGgBcREHuuWfnz36SO97JcOqg58iiTE8NnQyzy9v0U3hZUIGV/tfsHQXNYYV+ZW6K6vGROmjQhpDdyKwjqn9pCfEtGVxPp9AZxmzM6bgkfOD5GT5XcGlddhHjrTblLVX9tkq9v/CBraNsFWLg/TVHLuEIWiSxPUk9aTI6zXY2YLjIrN72omRvou1zor0LGzL0pKZMVar5q2rVjgdWFBLimO/VCrDvY6pgpabr4iEBQuJz5akHiiOCoklboOUajA3N/pbPXBUKWBbcc/fPQUcLTRgr8eJrW4kgYfz4AwcoppfnKgCc+e/pIUytVrvUpamDoPeVl5WvpjXUVvAgInjPwlmk0dta8J7FiGqhOK2oWKCYBDAEN9lVdCt59QZFQJl5ShZG9wKH+gp4BlwsPcbmt9sQcn5GlgGf1LZpTC2XFU9AUCqkPlj+0aQe96LCAE7yS9aZQKvmY6TSBDkd3hHAtYsSTfbl8mwA56cXhAxSsQOD8oeEExs8KmHSgeSGcZ0Mk9NYEyuaVhtYEvYreFmwUiJPpY3jvOOMnIHMTNSkvyZWAfusdlYTKgWN5R6hMLAxv2OxiNxeI05utoal6E6+murIMazxBNRuJ3Kw==,iv:NbuHaMRQN3qc6bU7IMLUP11G/aPnwJtMsGcvQug408g=,tag:hwWFW4EU7ULm7Mu63dxREA==,type:str] + key: ENC[AES256_GCM,data:qqrlqLaaxFgCSZ/QigAVw2un+8C6VPNpPLvfMoi6+6r3WuwnG0ie6BnOmY27zQun7ekO8DrVIxtBit56gyWPSiKumwxTo7lnlPv+ccFKIlaaFjDE7hffA3xf5bLgKUX4LTkhqEmk5lb+3qf+GwasqCTgBgESalSB9iED7tw6JMIWmlp7zaOxG3uUbzHUdsAof4VTjGffQitWzKKRai4xffFNP7ArQ14+gc/4Byq+4kIp6GapByVyrBIzrfd574V37SY8wkPpwm9T2p/5yiVbUTCfEH2raS2JvBQSogluMet2QCbKqe8TNCUlkz5PAWJk7C6huv0v75aher4IPRoy0RhuBDkyhA2Q7NB0+XNXv1IlHjbejFacoGeBZuWhZPGXZHMiQ3EhcYoC/igDeGwoi0F8QZ0/klIeDmh9mtWGEwDGifKW8czASfnRwatMr8z+s4hcC94dtZm7bW8GSUXMog70d4i1TJFGBM1Z3nVgD+xzPRd2vcm4+Y9joLNXGgv816xGiuZy+comJfxEVuM9vev+IUy7InMnn4XWmlH/Z/hbDxNM/X6pFd0GmOZiUXewiWcUKfp5N11745uf5pYfcSW7v/9LnmBpsZ4qfYi07QrFV/M+MT56bG4pSLGITafAqoLSxX34ARdZr6TUZAPKgCYBiFOLWCrpoPGAMNAVTAMZ0b2LS438f37qEjpdIlxVhojM/l3PDWsT1sWdSYdKPaOm+D6Gb9UUDNMgeotwItoLQ0KunKP5PfH+4DKDUjCXPn924YCyfmN36zj1up4sZK7aHq8Nha0aIaOK/DxgY7UxkkgZL0oXcNpnRqLP+0ufequ74RWNsEXQQKvo7eVQZxKFgusKleuFJqsJNVnApPZu7MzEOpSbRnFGMXtjT+uqvZniUfIGywrhAh3ODbK+pgQqCDvfqE55Cne4uLRBUDAo220Af5zLIIGsVV/d7pg6IqZbuRyHqJx1lzJoM+lz4x7ncEhgqIGM2TPSG9EqVvh2vqQSxQsB3kyMUPZbX3TqWIQ0McZutXmCejqyb7HgkAYjzZKi5E4K8pCsabC6306ntHVIzASIDK5z5It+2AKNyePXdmmV5pwS3CbGXEtz/jzfcvxc1VmYpuJV/cZMHXxaNSBECFoD36Am7R/BPNRhp+eCRc4rk+3pVarWWUimdZIH2+9w/kX6juEyN5fQY/gNtwASSNFyBNE9U/WlPd9nAEwMTTjqt/ixd4cYYseJe4VyCfou24yMKCUGOB+fyopbWE8x6446htNi6j0QESstzN70IslMp1o0clm01Js2LjaPWPDYC7zzCwYETJfX1wdLQGnusR66MRZVlKoeF3c9MHhZty6vbDViVORnCiltls1Zzb/WK2b/5QovsVEGvWnc9PbbMotmx0AhhpXY+FWZ3LATL4WKFoDDSi31syJ+s+kbZK8MQtBhxzZBlxVBlMCpXUimvsKzB4bZqia9Aa64NQCZisCB4a+BCp2+0jknXRiul0HfxjA/+kWInnTBk51kLV2kdEEWQTML9DiR63bybxoSY5qrqOS03+RWR7S0vRc8qlBkW9XP4J5/6Rtjd6MC1QqG4Hg8XE78XSOpm32ZhyuvD8lV3jUbtz+H7Mr6ajJx2bGku5xE7mCq2nKgliELrOBcxijLrDbLD5elJf8NZ6OzuJIBFRvRt2vXd2Xx/iJU4FslaiMykSmneLARrw7zaQsruhJWLtCkiSpzwl6jrYwl28I6dcD8GCwNdGvw4CXtjTyGrAsCrVRLxDukAmiT9KqnqMuOKyWs4rbgVtlNwEEBpAgOIyzJpWwLRH6ql65kSVyA3UCEeQU4AUIzmUCFek3AnFwWAEdGPfUU4d8QzhQHKekLGCZbfMWlraQW1WB3xPR0CTdSPgwlCv+444Y642bAwuGQZyTzcHwCrJtbQIMCDtbPtRVCPf4yfeC1x4w5d0pkImV+eADbabnBFZNlhJgr0VZzyTBqszcwAEwyG48LDzqk3Yi2E0pSyElomaNmVbVW+cAv+pmZAIOmKCE2HxwerhJKldtoqs4xWg0hDIQac7gX+yTqOa6Y7BMv1rm0VpXx6v3O4m8NkGe2wp0+/MNXD2SgO2Mbbc4kFQw0+TR00iEiROZv2YOsclE33Au35UbBpfBJO0g+U/TWGrnY4z2+QJyj5noQzhd8mfnmd2J5HiIEgZIqtLrgrv2GjVTOGu0uisVFj7VXfdXHorztZLmCTQtwE6TogIzl6bPJAXGCh1ubQK/uiMguVtle1Crt74OlQ7SAa29FJBbE0YPVqd4L36NBjOMC+rloNJXkDX3NwmJgw6ogLWRPlET+V4GXpYMKbBKDXMDhcdD/HGoNbsVjtEGXyNHgV1ct2+++RrShaSkrpGkUsfctdE4h3pXOOoFQCzjoFT+fHr/GfjEb10v1WwFiG1mRhE2QcUYmKabfch2z43PTTZhw5QV3706aP1YuqX8VLJ5mdZZ60YvJq5LVcJPYx5yfkUCW0aSLAGjsWnsUUwSM5P+7wVsrXoUNb+638Qo9WN3OKfdl2mYnr5hT+J+1sqS5MzfggfJoYSOGjKz6oGwqyv4tckzQoBbxuKbiJP9ePna9Bd6mQUqitxQ5gsqF6CNmdhMGw6L11pQ55t/slBypYC0KJ5LdP5NOxMIA0DaGr78QGu1qRcJljVdeSRu8xU8LrM/Y2ozrM8c4RZ+Vhd1hwfU9CDKiHYpC4/bNbhAD0RPz2IggKBkNDw+3WkMuODxHOAhKkQYc9jn24X0ZObq2HIKjnglpR4JRay6d9rsIQMlWTVoQn8CD9FxwepeCFy2szjTi45wk+PUlM7gS2mD/0RUIxz+TmKrhYy9jEQC8KnF6Y8nhqw84k7yB4W6vaulJLstfNXLrOoytPdxIRb15QZ8HAyEbKYSlDKdz2vgAa8CpwH26kJ0G+7nJUcp4YYPNI18RK0/ysSQxif1Ge4ZHnBcZiwqpakFxLB7DfiPw9hoCJYfeG8rhgxeYxCU4jElxwQ8mwe7VG/71brWViVD8ElvwDG1gbXFs6AKux8rIIZSmCK1E0BAguk/hc018PXqhmyJF/y7uubMOD/6yPtHayjmX+WMzhE1AM9a/eR0tGXzV/L5fnLfxfIMsGvyTw5XkGzCl+Zp3+ABvYk20uiVGyVoK94sTvRLlO5MZ51JWQZqqd2L7LLIeQhn+BjcL3vnGwFM+5PTCiRVEs42wtB/LCVB98jqBSY4a6tMuKJiVpTC0Taed9988sx1DQoSoXDa05j4q7dOVe5xYkp//La+zbK1a6LWaE+IN9GzhWYRSD+6ZmFwRvj6zleweGaXJM6KtbA6E9JvtjXHt0tKuxUG0BkeuAT33sq0RmgWu3ozNoZBxfIq+a+gbflRkRkuJw11xKQwi34/2bIPR2Na/m7r6v4jVP7/C74sIbfxAf8kISjRsOpWHLlckehfpEMf6MqRb5q23iTAsywtSJGvWcZP4cGgt4GPtIfD27/rtVQ/NtV2ILWzB70slC3BII85KoaKxEHiIj09FQq1UOLAWJqaUHbBqnYVpPRQd7xPZOJzTKIjLpEZvgC0h+OAy9+XtpUGY/KOOvYSWZVX7wjvsfh5bAIhQV/2jPWVV7CveqfBSoptX0M6/VVLmpQRuGCAw9yR8SZ7LnY24yI6Y4uqVa/qa9dnEZuWvFA3wB7HKBuTeIfNsiOpB03rVtSLkUtPnbQM/dMtd3B6os0qLw/gw6yKq+tfrQ6QjUM4bb96wrM2ZjrnYo04jJgSS2NhfmlFikFB9mpdByfJ+r0j8oTzgyJlbdwvso0AzjDXPaGl5q/157B5uWQ7KJW1VrJIQIovZJD3itKgVqoQGZtQI7Hmd6XhO5GckqWqJjxn2s2ihj4hJdNcaBGbXz/RgoCMUzXK7ALA9b0pWtygKidbl4kggrNIyoamvZrJJz5hz5jFHq47ce6bKDw54o2FCYeOQDABGAIzZLQqRIcpet0kc4IUUxzRbD5muIwGukSJiRKxg4BW6t4vQARLQIbtZP39Sm02DSL0WVEEEyfEYIt+pmmFhUvf/Z1zPo8NkFBH7Gp0Hb6EAmQKm4xnKCLJGa+cV/G+8qngbzUkpzJ5yvkQsBTvUf1i6UO7T5bnvtE8UFi+DW0yADszlx5UomQz0TqtEoJ/I6YFwe0FvCl22c3vEqq6HQuWviUKs7pyQmH0VlznnhcK2K+RNWi+2AyDxSLsqwVSA+Wrsi7WusS0179W5YD2pOXoyN02nl2rQtJJB6CO4Dvl0SqGroTn5ahvY4Kr9n+yWHGoqMI+2IuKMsUtrFs4GTFc48snRiY8ZKal+C7/RjRrDvDf/1wJqOpV1YNtlHkX+YDqAPd48oH+x2JV6JP8Y5EE=,iv:5gTxj65Jbe7nZGXqDZpD2wOg2yq50op60e8oFSBycAY=,tag:LqOQQrV/beRxxnvI6lRsHg==,type:str] syncthing: cert: ENC[AES256_GCM,data:O69rvnmYHWytEz0NwIEko4w/zJaVedqZ0YHfIWNm921dfUELTxOReaeQDa3YGcTu0Q0Gwk0bu9be8tomyMPv+TC/uSL7pCyoh1qIPB8XLMcbovGzW+zDi9/BUsGOFhOZ5fbiMXr/42hYxXj+oS73LXRJ16xUwME1i59dHKSJiBquagJVFCIxdCZc2eooQWL6RzeZKA3c14mGit7gxuXjVOjyC4quRxPAAXnCZ7lgtKYXsLzQv3K3o70MAAggVU/2jQzdx9Go/ZPvkNskEeXgvzzvvsCUjzzwo+ZTgvJ7pNGj7WDM5pSmKUlSWpI712z7SI7Pyhf2N4IZ/HcJg1jH5FAdnXC0kSMrcmDvdnO5SzXsa0qmr1oA8vHi21FnpXvJnmRZ35gKnnSDlRVheqIm5QB3LvgyLo7x1psGIv2sT+gFr+Nu0V0+g8nlTTjmgWGvpnLd3JJz8ONaIoNhTbdGyACjAS3pOTsNoU9t/qw5pyfeBulkRkjVQ7FHa+++e9PubIZkElNn/d04IlxHwMIgWk1aVJEaRQLNF/aPPNXON7dzlQ5b2rRz7zL20prvSsU2D04AWRXYcBkhx8YbuuGp3lbDfKPTP//onmG+1IQfXK3X1IBPl7C8ZCpro1YpsQVm5rMNv3gmpqwQ2btjpfiBrU176qPdV/HoGw1l7bL/evcQ8zvn3LPZ7WpfhFhNxEio5oI/+Za6nHoMynccnUXC0bKKIxSfJRVuWRDvEaBc6+2B/SPsfEw6UuZseVtFVYuaCfklUgpuxojoVHrEahg4HsLZp3c4S6bSoyg3pbLf6U9nZpAmLeJAOIh+6AaQJcmDUlUc4AlK8D4gCRocQRun1rXRdMFc+Vl165b8wUXqj9bY19roFRullx9YSNeg+0GDCw2qySKsOksI4fBo0kscayOaARdZLvqRoNawNmWX4s/TWWz7xNLXviLjW7NWL6kfSEUgZ2pnIBmleBC/RlKC1++SX6uzTTBr5h4O8YttsrN4YX6KmBg1QBybvt2Vh6L7ubPMjJlhTg1NS5VbX+CxMDwejOm+DhLZdDLpbJVScxBov2N7050=,iv:9O+nBJYStylXnrP1+f1rtlrzKAv1eMdoJxX8xmPESiY=,tag:x3iSyrOhcZ4bfoB0xhKv5w==,type:str] key: ENC[AES256_GCM,data:f1SEublliftWKYO9ivnG3QlmnO+7BVEQTpX6eKq2rgzdSHKUnJm5rADbKdaycYF2zLQ1IwwKwO6QThUY4XutmAE2xb0PIjJNZVDhE7dqjkTZWsv/uqeKq6UQFR2KeqkuTSF0RDBlqFGUaFRFRORb0tsqq5VB+zJwRvFYa80abvo0kTt/xoVRNCbELNuzFuFa7m607CArR7iYpAsEvXC7ZOa69GzsFvc01YtnrI/odtcQEVLkSvHW8mZZ9C32mH9j72Qtb+8e3Pk30C4XvD2D5gvCd9OHAYE/2zL6HAH6YVOqh/2MT5SwYpnVGeebdY9q0KqPopoz+vWG/0aTpaprUjVs+OYqafX5XLhzqnyyuTSUN6uojrUBLdLNne9CgRO7+37FjI3R/ebyjeJa3iRc0icJ,iv:Qon1ytRWeR8XIjZYk3msKtVvUgdGbax5JFCiXLzefAY=,tag:QgIsj4zjFLoozm1UKEopwA==,type:str] @@ -38,7 +38,7 @@ sops: UXd3TE5JM1pTcnpJbFcrMkdyWTNVdFkKC1+rcSm1kWa4AC8xxGvMEvBJ7GQC6CyK 5yO7Iudjr2X8ToBhrcjt9hzF9R+yJIE8OHMnLkzpSa4XwsCaiToRtg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-05-22T20:45:16Z" - mac: ENC[AES256_GCM,data:GlepMGI+e7+VMwHXLIs1U5stcgJwbQu23YB76Ci2/sgaxPavRtzhLf8QLc4jJyNNXgAbcBpEQl3Tr0qSSPiSmC9/svql+f67kkzzROLalEPgbeTPyKkx59tCOlLtMgwfzj4tnQtZPdYqN6UUoFa2Sfmq8egdMpDk3ahz3H+OnuE=,iv:zoXcJLrsVxbQY4Hlt8tYzd+weiSD8EDBGDxDy8K5rps=,tag:Uv3UKPTEM5hQ45GBprnGHA==,type:str] + lastmodified: "2026-05-22T22:25:21Z" + mac: ENC[AES256_GCM,data:/u61lru+wniPkC5UFVfS2RKKMz1eoUYiSL2tZEyHohkAo1DWGNi33X+/cOy3xIFneD54d0GFbmgO1AYdIYV3D8RXIUbNKYIJF+UCeIwoNx/nbURzZi9BqimFFtF+P3bA/3uPRsVk2PORNxwHF4VHNUOsDts/lWWkqQfBRPv3OuU=,iv:yVgDZw3wMZ12Er6USaPpb0YDB/CcNWiSV0yRpnyYBfk=,tag:C57pCh45nH0T66NStibJFA==,type:str] unencrypted_suffix: _unencrypted version: 3.12.1