direnv: watch devShell

Add renoir to secret vars/shared/garage-shared/rpc_secret
Update vars via generator garage (machine: renoir)
2026-03-26 20:29:10 +01:00 · 2026-03-26 20:29:10 +01:00 · 2026-03-26 20:29:10 +01:00 · 2026-03-26 20:29:10 +01:00 · 2026-03-26 20:29:10 +01:00 · 2026-03-26 20:29:10 +01:00
84 changed files with 5644 additions and 49 deletions
--- a/.envrc
+++ b/.envrc
@ -1 +1,2 @@
+watch_file ./devShells/flake-module.nix
 use flake
--- a/clan/flake-module.nix
+++ b/clan/flake-module.nix
@ -32,10 +32,13 @@
  clan.inventory.instances.user-rpqt = {
    module.input = "clan-core";
    module.name = "users";
-    roles.default.machines.haze = {
-      settings = {
-        user = "rpqt";
+    roles.default.machines = {
+      haze = { };
+      crocus = { };
+      renoir = { };
    };
+    roles.default.settings = {
+      user = "rpqt";
    };
    roles.default.extraModules = [
      self.nixosModules.user-rpqt
@ -116,16 +119,16 @@
    roles.peer.tags.syncthing = { };
    roles.peer.settings.folders = {
      Documents = {
-        path = "~/Documents";
+        path = "/home/rpqt/Documents";
      };
      Music = {
-        path = "~/Music";
+        path = "/home/rpqt/Music";
      };
      Pictures = {
-        path = "~/Pictures";
+        path = "/home/rpqt/Pictures";
      };
      Videos = {
-        path = "~/Videos";
+        path = "/home/rpqt/Videos";
      };
    };
    roles.peer.settings.extraDevices = {
--- a/clan/machines.nix
+++ b/clan/machines.nix
@ -18,6 +18,11 @@
        "syncthing"
      ];
    };
+    renoir = {
+      tags = [
+        "syncthing"
+      ];
+    };
    verbena = {
      tags = [
        "garage"
--- a/clan/network.nix
+++ b/clan/network.nix
@ -32,6 +32,7 @@
      haze = { };
      crocus = { };
      genepi = { };
+      renoir = { };
    };
  };

@ -47,6 +48,14 @@
    roles.server.tags = [ "dns" ];
    roles.default.tags = [ "all" ];

+    roles.default.machines."renoir".settings = {
+      records = {
+        AAAA = [
+          "205:8a34:1a76:f16c:964c:36e:7240:630f" # yggdrasil
+        ];
+      };
+    };
+
    roles.default.machines."verbena".settings = {
      records = {
        AAAA = [
--- a/flake.lock
+++ b/flake.lock
@ -40,11 +40,11 @@
        "treefmt-nix": "treefmt-nix_2"
      },
      "locked": {
-        "lastModified": 1773163524,
-        "narHash": "sha256-0YKW/J7YBq5WtwES2FLCVDrmjy/A7qmzAcwqJTgq+nc=",
+        "lastModified": 1773332673,
+        "narHash": "sha256-p14NeXAqKJjW7/YlXmUFRdv5lY6DgdNHHFnH3ddTJ6s=",
        "ref": "refs/heads/main",
-        "rev": "6147bf310c98dfd4d5cb57695d44f2e36555c580",
-        "revCount": 13460,
+        "rev": "4bc7d0ca824a63c9f99be0716827ba8d8a026216",
+        "revCount": 13563,
        "type": "git",
        "url": "https://git.clan.lol/clan/clan-core"
      },
@ -84,11 +84,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1773068786,
-        "narHash": "sha256-fNdn9Bc5Sgfk0V7VYvwvk6Ah6ohl+5ch6glrsB115NY=",
-        "rev": "6265600b5a330985b901eab8eec3f17467ca8a02",
+        "lastModified": 1773259940,
+        "narHash": "sha256-zPr98JtgmA6FOEz1CysYfYod6lR5guHy2DsOtma/p/o=",
+        "rev": "83fe63ab625d6213e91dcd27b186847ccd0fbf06",
        "type": "tarball",
-        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/6265600b5a330985b901eab8eec3f17467ca8a02.tar.gz"
+        "url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/83fe63ab625d6213e91dcd27b186847ccd0fbf06.tar.gz"
      },
      "original": {
        "type": "tarball",
@ -271,11 +271,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1773093840,
-        "narHash": "sha256-u/96NoAyN8BSRuM3ZimGf7vyYgXa3pLx4MYWjokuoH4=",
+        "lastModified": 1773332277,
+        "narHash": "sha256-1V+wRrZD9Sw12AQBUWk9CR+XhDZQ8q6yBE0S3Wjbd1M=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "bb014746edb2a98d975abde4dd40fa240de4cf86",
+        "rev": "4aeef1941f862fe3a70d1b8264b4e289358c2325",
        "type": "github"
      },
      "original": {
@ -396,11 +396,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1772963539,
-        "narHash": "sha256-9jVDGZnvCckTGdYT53d/EfznygLskyLQXYwJLKMPsZs=",
+        "lastModified": 1773122722,
+        "narHash": "sha256-FIqHByVqxCprNjor1NqF80F2QQoiiyqanNNefdlvOg4=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "9dcb002ca1690658be4a04645215baea8b95f31d",
+        "rev": "62dc67aa6a52b4364dd75994ec00b51fbf474e50",
        "type": "github"
      },
      "original": {
@ -594,11 +594,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1772660329,
-        "narHash": "sha256-IjU1FxYqm+VDe5qIOxoW+pISBlGvVApRjiw/Y/ttJzY=",
+        "lastModified": 1773297127,
+        "narHash": "sha256-6E/yhXP7Oy/NbXtf1ktzmU8SdVqJQ09HC/48ebEGBpk=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "3710e0e1218041bbad640352a0440114b1e10428",
+        "rev": "71b125cd05fbfd78cab3e070b73544abe24c5016",
        "type": "github"
      },
      "original": {
--- a/home/.config/bash/config.sh
+++ b/home/.config/bash/config.sh
@ -0,0 +1,6 @@
+source $XDG_CONFIG_HOME/sh/aliases.sh
+source $XDG_CONFIG_HOME/sh/path.sh
+if [ -r $XDG_CONFIG_HOME/sh/$HOSTNAME.sh ]; then
+	source $XDG_CONFIG_HOME/sh/$HOSTNAME.sh
+fi
+source $XDG_CONFIG_HOME/bash/hooks.sh
--- a/home/.config/bash/hooks.sh
+++ b/home/.config/bash/hooks.sh
@ -0,0 +1,20 @@
+# Hook direnv if present
+if command -v direnv >/dev/null; then
+  eval "$(direnv hook bash)"
+fi
+
+# Prompt
+if command -v starship >/dev/null; then
+  source <(starship init bash)
+fi
+
+# Launch atuin if it is installed
+if command -v atuin >/dev/null; then
+  eval "$(atuin init bash)"
+fi
+
+# Init zoxide if present and alias cd to it
+if command -v zoxide >/dev/null; then
+  eval "$(zoxide init bash)"
+  alias cd=z
+fi
--- a/home/.config/fish/config.fish
+++ b/home/.config/fish/config.fish
@ -0,0 +1,33 @@
+set -Ux XDG_CONFIG_HOME $HOME/.config
+
+if status is-interactive
+    # Commands to run in interactive sessions can go here
+    source $XDG_CONFIG_HOME/sh/aliases.sh
+    source $XDG_CONFIG_HOME/sh/path.sh
+
+    # Per-host config
+    if test -r $XDG_CONFIG_HOME/sh/per-host/$hostname.sh
+        source $XDG_CONFIG_HOME/sh/per-host/$hostname.sh
+    end
+
+    if type -q atuin
+        atuin init fish | source
+    end
+
+    if type -q zoxide
+        zoxide init fish | source
+        alias cd=z
+    end
+
+    if type -q direnv
+        direnv hook fish | source
+    end
+
+    if type -q eza
+        alias ls=eza
+    end
+
+    if type -q starship
+        starship init fish | source
+    end
+end
--- a/home/.config/git/common.gitconfig
+++ b/home/.config/git/common.gitconfig
@ -30,6 +30,7 @@
    dft = -c diff.external=difft diff
 	lg1 = log --graph --abbrev-commit --decorate --format=format:'%C(bold blue)%h%C(reset) - %C(bold green)(%ar)%C(reset) %C(white)%s%C(reset) %C(dim white)- %an%C(reset)%C(auto)%d%C(reset)' --all
 	lg2 = log --graph --abbrev-commit --decorate --format=format:'%C(bold blue)%h%C(reset) - %C(bold cyan)%aD%C(reset) %C(bold green)(%ar)%C(reset)%C(auto)%d%C(reset)%n''          %C(white)%s%C(reset) %C(dim white)- %an%C(reset)'
+	root = rev-parse --show-toplevel
 [column]
 	ui = auto
 [branch]
--- a/home/.config/sh/aliases.sh
+++ b/home/.config/sh/aliases.sh
@ -1,15 +1,6 @@
 alias dotfiles="/usr/bin/git --git-dir=$HOME/.dotfiles/ --work-tree=$HOME"
 alias dots=dotfiles
-if command -v helix >/dev/null; then
-  alias h='helix'
-else
 alias h='hx'
-fi
-if command -v eza >/dev/null; then
-  alias ls='eza'
-else
-  alias ls='ls --color -h'
-fi
 alias lsa='ls -A'
 alias ll='ls -l'
 alias lla='ls -lA'
@ -22,3 +13,5 @@ alias g='git'
 alias c='cargo'
 alias MAKE='make clean && make'
 alias n='myrtle --notebook-dir=$HOME/notes'
+
+export EDITOR=hx
--- a/home/.config/sh/openchip.sh
+++ b/home/.config/sh/openchip.sh
@ -0,0 +1,8 @@
+echo Loading Openchip config
+
+# LLVM
+export PATH="/work1/rpaquet/llvm-project/build/bin:$PATH"
+
+# Other binaries
+export PATH="/work1/rpaquet/bin:$PATH"
+
--- a/home/.ssh/config
+++ b/home/.ssh/config
@ -9,3 +9,6 @@ Host verbena
 Host genepi
 	HostName genepi.val
 	User root
+
+Host renoir
+	HostName renoir.val
--- a/home/.zshrc
+++ b/home/.zshrc
@ -22,6 +22,6 @@ if [ -r ~/.profile ]; then
 fi

 # Load machine-specific config
-if [ -r ~/.config/zsh/$HOST.zsh ]; then
-  source ~/.config/zsh/$HOST.zsh
+if [ -r ~/.config/zsh/$HOSTNAME.zsh ]; then
+  source ~/.config/zsh/$HOSTNAME.zsh
 fi
--- a/inventory.json
+++ b/inventory.json
@ -13,6 +13,9 @@
    "genepi": {
      "installedAt": 1757633120,
      "description": "Raspberry Pi 4B"
+    },
+    "renoir": {
+      "installedAt": 1773698297
    }
  }
 }
--- a/machines/renoir/configuration.nix
+++ b/machines/renoir/configuration.nix
@ -0,0 +1,7 @@
+{
+  imports = [
+
+  ];
+
+  # New machine!
+}
--- a/machines/renoir/disko.nix
+++ b/machines/renoir/disko.nix
@ -0,0 +1,102 @@
+# ---
+# schema = "btrfs-single-disk-subvolumes"
+# [placeholders]
+# mainDisk = "/dev/disk/by-id/nvme-CT1000P3PSSD8_2313E6C35BC1" 
+# ---
+# This file was automatically generated!
+# CHANGING this configuration requires wiping and reinstalling the machine
+{
+  boot.loader.grub = {
+    efiInstallAsRemovable = true;
+    efiSupport = true;
+  };
+
+  disko.devices = {
+    disk = {
+      "main" = {
+        name = "main-d15332ecbf8b4063adcbfbebda63a3a8";
+        device = "/dev/disk/by-id/nvme-CT1000P3PSSD8_2313E6C35BC1";
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            "boot" = {
+              size = "1M";
+              type = "EF02"; # for grub MBR
+              priority = 1;
+            };
+            "ESP" = {
+              type = "EF00";
+              size = "500M";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            #"swap" = {
+            #  size = "8G"; # adjust
+            #  content = {
+            #    type = "swap";
+            #    discardPolicy = "both";
+            #  };
+            #};
+            "root" = {
+              size = "100%";
+              content = {
+                type = "btrfs";
+                extraArgs = [
+                  "--force"
+                  "--label root"
+                ];
+                subvolumes = {
+                  "@root" = {
+                    mountpoint = "/";
+                    mountOptions = [ ];
+                  };
+                  "@nix" = {
+                    mountpoint = "/nix";
+                    mountOptions = [
+                      "compress=zstd"
+                      "noatime"
+                    ];
+                  };
+                  "@home" = {
+                    mountpoint = "/home";
+                    mountOptions = [ "compress=zstd" ];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+
+  # Automatic local snapshots
+  # https://digint.ch/btrbk/doc/readme.html
+  #$ systemctl start btrbk-<instance>
+  services.btrbk = {
+    instances."nix" = {
+      onCalendar = "*/2:00";
+      settings = {
+        subvolume = "/nix";
+        snapshot_create = "onchange";
+        snapshot_dir = "/nix";
+        snapshot_preserve = "16h 7d 2w";
+        snapshot_preserve_min = "3d";
+      };
+    };
+    instances."home" = {
+      onCalendar = "*/2:00";
+      settings = {
+        subvolume = "/home";
+        snapshot_dir = "/home";
+        snapshot_preserve = "16h 7d 3w 2m";
+        snapshot_preserve_min = "3d";
+      };
+    };
+  };
+}
--- a/machines/renoir/facter.json
+++ b/machines/renoir/facter.json
--- a/nixosModules/steam.nix
+++ b/nixosModules/steam.nix
@ -7,4 +7,6 @@
  };

  programs.gamemode.enable = true;
+
+  nixpkgs.config.allowUnfree = true;
 }
--- a/sops/machines/renoir/key.json
+++ b/sops/machines/renoir/key.json
@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1gmnfmze2teqtaquxczjahvfltzzlrgcza5w4cej64tw0qzke5ftqh8c9ry",
+    "type": "age"
+  }
+]
--- a/sops/secrets/renoir-age.key/secret
+++ b/sops/secrets/renoir-age.key/secret
@ -0,0 +1,22 @@
+{
+	"data": "ENC[AES256_GCM,data:uGR/nnfUUHidErlgNdNUM7mVW/PX5I2a17hWE8OoEiAzg2KPjX/aYH3roACM1rvtbWBM22tV72RRj2tW50N72pQeaajbMGjN0pE=,iv:SLz6JxRX8588r8YQd3CfNke5ATkq3fnqFgs8eKiCVDI=,tag:p/rnI5g6kfILtV19dr4KsQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmZG50TEQvT29obGJGYmFD\nZ3c4Tmp2RmVTVGxxdUlyTVFSSnhZaDdYQkRNCmRWWXEwZHlFNHhQOE52djRhOEdl\nNnBHa2pKck96YWx3VzVsOVVQempVOUkKLS0tIGdYRjJjTEhQSk93Zzk2VGo4R0Fx\nZElpSkxOd09QaUdCQTd0U1RKc2wrK00K7v6HM9pOX3mZimfj+OjMPEzWhrcDvVR4\nuKl8zFs7zxOXdMcYgJdChGaxTYB8UsXmiziRaaAF8Ms5L9CQ69eZkA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBeVQvejFt\nRVFVdDBvNDFmaE1EQ2VJaWJHcEtMV1FzNWg4bzVjZFFuTGxwNgp6d0JqUGJqc1k2\nM0pFU2VlSUZFc05IekxqWHB3cEg0RG9yOXBicldzNTNzCi0tLSA5cm1EbXRJdndG\ncGg5ZkV3Yk1oZG56Y2hpMW9NSnE4cEI1MDBpQnhHZVAwCgxfH5U0Y+4tGAsSkqfS\navRlYRNtV/CpY66pMqkQvN7IiPLGI6wqRW+Js23h5zPehgPndpWys9Bf71XyqaSF\nFp8=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBd3VSTzd0\nOWtKNklSRGRWV1NnZzZQVU1ERGR1MEVKY0FCU0Y3eU1zbXZFZQpSeEF4WXUwdkcx\nK0krM2MxZG04VDFXTHArcnp1Yk5tNXRxcWlCMnQ1SFEwCi0tLSBNa2VKSkYyVjJ0\ndnFMRXNROEMvN1cxa3dkdDZYSThreG9kditLaFlMbUlZCpwDSpAT87eVH55f1Rfm\nlnwYUUUKk/5yi1X+evlQofZCz85HGEJUExrTZEY2v1rPIaanO+2RLgnTnxtu/INM\nYjc=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-16T18:46:44Z",
+		"mac": "ENC[AES256_GCM,data:9b5p9ICQmSRGOk++VRJG9y8/0Lx/Tf1Jis9XkP+cv/I2xiXVehRo0AaDghIwxSWULM2HD7jeKwabWT1yKhUH41q/CrUbg+zoistrlZyUvAhkeQQ62W42fE9XjuEskBQo+mFqRYdPcVaZo0pnZpbuRhgkoP6atG8vDi3ic4ebnm4=,iv:l4yuS5ydVkPFQKFICbUULj15eUt/9bTgFePZynv2u0I=,tag:nSJt8nxsxDSjfeoXuTJTrA==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/sops/secrets/renoir-age.key/users/rpqt
+++ b/sops/secrets/renoir-age.key/users/rpqt
@ -0,0 +1 @@
+../../../users/rpqt
--- a/vars/per-machine/renoir/atuin/key/machines/renoir
+++ b/vars/per-machine/renoir/atuin/key/machines/renoir
@ -0,0 +1 @@
+../../../../../../sops/machines/renoir
--- a/vars/per-machine/renoir/atuin/key/secret
+++ b/vars/per-machine/renoir/atuin/key/secret
@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:AXnjo4MQnVaTgkbjUDzXyhxxL5Rt69m3jEDM0pIqi+JYH3HtzghU96YDpuCxrrOj8rAQG4vCW3FcP4uSJQ19iQ==,iv:OeU/fwohNOrmE1Fr4oQ0ckNWleuFtRKoyDPw//BiZ0w=,tag:/zAImjHM8LIu0q9e1D2q4g==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1gmnfmze2teqtaquxczjahvfltzzlrgcza5w4cej64tw0qzke5ftqh8c9ry",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNRllpWUErZTdFSndEZ1Yx\nUFpCdWJncVVWVFZGcy9zdXUweHlCbXNBYkRFCmJSakE4VGJjdTA3S0ZQUGNCME95\nSGhIcnZTOVVCWGUzZkVud0JwWW9EQzQKLS0tIEFid2RhbVlPOXYrVlVxRjd4bXZS\nSVI4dEFGUjlvTTRNRUo0QTVaSkNSOVUKoZ/nnK8OwuNgZ4v3CZO0JiqPb5P8Bs8+\nMekM78M967KeWmoqoZociNLn4Yu7H4LGbubWHUuulbhZmZUVFz6jtw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhTUMxaWRZZm5IZ3NTRHZD\nZnlXY3F6cDZIS3VWL05jS1c0aDduWjZpb2p3Cm8zYUcya3hXVjlpUmM5RzZUTzVR\nRVE0TUZscG1JM0VNYVBFUW84UlRYRFEKLS0tIFhpL1J6QytaUmRpSnYzVys1dTVq\nNUlLZzgvVThRbFFPNnduY2FzL0xoRFUKPd04b+os1tnXLbisTt9r3Dknmvr2tGiC\nkokyDi+D+EFk7Ck2iq2Ku+A9lAzj7HyjUOEHJz/D455fnbg/nvnotw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBMlZQUWlQ\nLzFDbStBOTgzaGo1dUdqaUtTMktYa0xTTTQwdGl1RkVvQTQxeAp1TmV6OWVUc1pk\nLzROYkhTYlkzaWtkOXdLNmo5ZHBqb29xLzJ1NktraWRRCi0tLSBhakF6eVVVQ1VV\nMDJ3dVdvWVJERG5yeGdDdmdnZFcwcDcyeEJZSFZqcGJvCmtgkjQgMCAbl4KSrHt3\nsNgXN4dMTWvfhtGlDkIpHCz5AH7Vx7DgzdxgrAvvAd6L5ghYatM6Qy5tl4Z9IPo7\n344=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBaWF3Ry8x\najN3K1pQOHFNMFduYUIyZkY0WmFNR01GcmVYUWR4TWx3SlVJeApnd3ZBUXZ1cW1J\nN0UrQnF1NmttVUduZDBpWlExdHdmcG9ZSHdNZW1WV09rCi0tLSBadWkwcHNMem0y\nMVVRTGxGWWIvVGFobFNta0lYMnc0SjdUV2tiSG1EY3JrCilHcX9H2Wr57RAe7UCT\n2XCygaiOjhGTlgyjmTPn8efAumOmIDedJ/qdqgm60hpz1FomMpCicp06P08Bu3eq\nSwM=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-16T19:18:58Z",
+		"mac": "ENC[AES256_GCM,data:jl1Mfvlc+lbbwXYn8DIAA3i9kMF6jtvYNYIktMtPMfNd9e7pbWa5VgZ7O2A7kOhrU0RbyapOZNHCTuw4vjIv6oGiq0+Oz3xc1rahG3hlSmNBvK6BwAOnH/KbvW8ifkESV7LQahBYs+e70tIkrHchgD0UJfa331L+ZPR9MMDK0yc=,iv:Y5LAC3GjXCKjHkepJ89tUl+Onj3V8iTklNv/M8QUa1c=,tag:UNj8EAIB9RTdcggRK8jrFw==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/vars/per-machine/renoir/atuin/key/users/rpqt
+++ b/vars/per-machine/renoir/atuin/key/users/rpqt
@ -0,0 +1 @@
+../../../../../../sops/users/rpqt
--- a/vars/per-machine/renoir/cert-assistant/.validation-hash
+++ b/vars/per-machine/renoir/cert-assistant/.validation-hash
@ -0,0 +1 @@
+21b09ca83ff0587ef5e692e4fbf3044874acf70d3fecb1d8a7f95fce087a7eb0
--- a/vars/per-machine/renoir/cert-assistant/assistant.crt/value
+++ b/vars/per-machine/renoir/cert-assistant/assistant.crt/value
@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFGTCCAwGgAwIBAgIUaVgGzylg3imGHBvvjfAJ31gNJTwwDQYJKoZIhvcNAQEL
+BQAwFzEVMBMGA1UEAwwMQ2xhbiBSb290IENBMB4XDTI2MDMxNzIxMDE0MFoXDTI3
+MDMxNzIxMDE0MFowGDEWMBQGA1UEAwwNYXNzaXN0YW50LnZhbDCCAiIwDQYJKoZI
+hvcNAQEBBQADggIPADCCAgoCggIBANVACRvjEmcRYiwQGw3sLJ8ZjVZTB+LnlVEm
+P0XeNz36PKbVrZcl9PKyanEHm+EzbxCExP7wv4U98pz3qek/I5KjHgpgVGmRv7Dh
+eS2CADubNZn/tFfh3kj4OgqQgsJAajr4w3SdGDFUv6wW8VFVoxVHCKDf9GNd39XS
+qu3xm2XCTKYMLcHIO1JqW9RwXIimXfuE/x07UJNNRFOaXvu+y4L5ZtRtEPAQQCe5
+22xQbdVZ156Sq3MdTp3h3ZMcK10SWNh8+Ssf/LwGA2SWJVGZUWTKRk+jxrrvdMnM
+KHoQBdNKh55bvz5Cg4V1gwXSlOXkkcexTVwhoyZu8IBBCgo5D1pT1stSaUAeZB41
+l/VXOmpnDqweCT80pOjgsx6kiShlyUA8L/3oQazQJ42iY/9OJblnMV1yeurEZP2n
+VSPirdGhigEQkc4NicJPYxFXQVMz8nYhRAXudYllX0UKMXVY6AKlW3dV6GgjGdOg
+C7mCs9kP9cLm++dNRBw2NeHzTXs/ASOGy8ua8GCR4lhuBlJnPdMxIi5k/OTa8dWV
+fH+ptQNDyd3VauHwWOQVcZFsbEMSBkUL4erqtsR6aHI8JeoB0FILp5btHqfxRyYh
+x98NHOi9VganwUjGiA0Z1sL/hGFegEiK7b+v+OhayGgIbFXZr1BV9VqpBhuWh+2/
+3zPazYEvAgMBAAGjXDBaMBgGA1UdEQQRMA+CDWFzc2lzdGFudC52YWwwHQYDVR0O
+BBYEFCt2FnGp5rmRpW3oqXsu4jYdYVDqMB8GA1UdIwQYMBaAFAvrpB+eefpZNDIw
+a4sf3T/3w+u/MA0GCSqGSIb3DQEBCwUAA4ICAQBvDLZgFDB1bfvtluK2XxKBuWeT
+pBLOtVecYkIiTRl7WnCJgH7PKoVE5O8/UigEDJf7zwn1CkkF5S1GiuQxvXG7S6dg
+aEq73IjzvSwApTfDJ9uSxg13IAdCPjZ0vFrA+66Iz+WSNyxroavonp1A7c6A4fio
+5wvdSJYlCSlVru7vQB/rhR8lPalVQA0V4rEIr9OEg1fCimIA6wwZ3AREx0V09ecs
+ynj2KKMOMkovVwTtXdaNXrSTyTrEvobJvAavL7u6MtDGOR9ZkGYbZ4Z/NXd+6mPY
+GQ2gBMuUrmFBGcFMduj1JTVU7nRB4c4XT4ieT1jXx1HqnNJvZnWqPqTguvgkWhuh
+7130H6TGd+iX1BPrJfAeFCUZhPpw1v3kkLhNPU+pzgbXPAdfjCus+/RhHnvmADqh
+N3rpwdd57+CryrnXibbKJ3ppBmIazP9SyMl/GWkISFxha7riFYAOkmdz/fFK6C5q
+YPuja148X/pqbr0/SzXekekVIFk8OqT2/Lafkf3giQzFYALCwSPBEZkW1KCcL82j
+BAO/NTeVDYKYh9smA1UatADBfLcB+33rTOaes3Didh3MzYRquDAsAvbUFC2ayNgV
+me2ANAsH+I0RSx4uhp+bUzf9yk9xbtpnEF9laL1aKKU+RRyGZxku2n+0EzbC1vzs
+rH/68CbP+gxuPXIK2w==
+-----END CERTIFICATE-----
--- a/vars/per-machine/renoir/cert-assistant/assistant.fullchain.crt/value
+++ b/vars/per-machine/renoir/cert-assistant/assistant.fullchain.crt/value
@ -0,0 +1,60 @@
+-----BEGIN CERTIFICATE-----
+MIIFGTCCAwGgAwIBAgIUaVgGzylg3imGHBvvjfAJ31gNJTwwDQYJKoZIhvcNAQEL
+BQAwFzEVMBMGA1UEAwwMQ2xhbiBSb290IENBMB4XDTI2MDMxNzIxMDE0MFoXDTI3
+MDMxNzIxMDE0MFowGDEWMBQGA1UEAwwNYXNzaXN0YW50LnZhbDCCAiIwDQYJKoZI
+hvcNAQEBBQADggIPADCCAgoCggIBANVACRvjEmcRYiwQGw3sLJ8ZjVZTB+LnlVEm
+P0XeNz36PKbVrZcl9PKyanEHm+EzbxCExP7wv4U98pz3qek/I5KjHgpgVGmRv7Dh
+eS2CADubNZn/tFfh3kj4OgqQgsJAajr4w3SdGDFUv6wW8VFVoxVHCKDf9GNd39XS
+qu3xm2XCTKYMLcHIO1JqW9RwXIimXfuE/x07UJNNRFOaXvu+y4L5ZtRtEPAQQCe5
+22xQbdVZ156Sq3MdTp3h3ZMcK10SWNh8+Ssf/LwGA2SWJVGZUWTKRk+jxrrvdMnM
+KHoQBdNKh55bvz5Cg4V1gwXSlOXkkcexTVwhoyZu8IBBCgo5D1pT1stSaUAeZB41
+l/VXOmpnDqweCT80pOjgsx6kiShlyUA8L/3oQazQJ42iY/9OJblnMV1yeurEZP2n
+VSPirdGhigEQkc4NicJPYxFXQVMz8nYhRAXudYllX0UKMXVY6AKlW3dV6GgjGdOg
+C7mCs9kP9cLm++dNRBw2NeHzTXs/ASOGy8ua8GCR4lhuBlJnPdMxIi5k/OTa8dWV
+fH+ptQNDyd3VauHwWOQVcZFsbEMSBkUL4erqtsR6aHI8JeoB0FILp5btHqfxRyYh
+x98NHOi9VganwUjGiA0Z1sL/hGFegEiK7b+v+OhayGgIbFXZr1BV9VqpBhuWh+2/
+3zPazYEvAgMBAAGjXDBaMBgGA1UdEQQRMA+CDWFzc2lzdGFudC52YWwwHQYDVR0O
+BBYEFCt2FnGp5rmRpW3oqXsu4jYdYVDqMB8GA1UdIwQYMBaAFAvrpB+eefpZNDIw
+a4sf3T/3w+u/MA0GCSqGSIb3DQEBCwUAA4ICAQBvDLZgFDB1bfvtluK2XxKBuWeT
+pBLOtVecYkIiTRl7WnCJgH7PKoVE5O8/UigEDJf7zwn1CkkF5S1GiuQxvXG7S6dg
+aEq73IjzvSwApTfDJ9uSxg13IAdCPjZ0vFrA+66Iz+WSNyxroavonp1A7c6A4fio
+5wvdSJYlCSlVru7vQB/rhR8lPalVQA0V4rEIr9OEg1fCimIA6wwZ3AREx0V09ecs
+ynj2KKMOMkovVwTtXdaNXrSTyTrEvobJvAavL7u6MtDGOR9ZkGYbZ4Z/NXd+6mPY
+GQ2gBMuUrmFBGcFMduj1JTVU7nRB4c4XT4ieT1jXx1HqnNJvZnWqPqTguvgkWhuh
+7130H6TGd+iX1BPrJfAeFCUZhPpw1v3kkLhNPU+pzgbXPAdfjCus+/RhHnvmADqh
+N3rpwdd57+CryrnXibbKJ3ppBmIazP9SyMl/GWkISFxha7riFYAOkmdz/fFK6C5q
+YPuja148X/pqbr0/SzXekekVIFk8OqT2/Lafkf3giQzFYALCwSPBEZkW1KCcL82j
+BAO/NTeVDYKYh9smA1UatADBfLcB+33rTOaes3Didh3MzYRquDAsAvbUFC2ayNgV
+me2ANAsH+I0RSx4uhp+bUzf9yk9xbtpnEF9laL1aKKU+RRyGZxku2n+0EzbC1vzs
+rH/68CbP+gxuPXIK2w==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFDzCCAvegAwIBAgIUUPinyxUfxwhxvzVh9az7rsYIVuYwDQYJKoZIhvcNAQEL
+BQAwFzEVMBMGA1UEAwwMQ2xhbiBSb290IENBMB4XDTI2MDIxMzEyMTQwOVoXDTM2
+MDIxMTEyMTQwOVowFzEVMBMGA1UEAwwMQ2xhbiBSb290IENBMIICIjANBgkqhkiG
+9w0BAQEFAAOCAg8AMIICCgKCAgEAwxyooscyb3wqayzJZ6//S8Hd2C2esJ2gii39
+iEqfV3AXJC1TEm1bgydZ8DGByzbBl4HqvDuElG3a0uEOVZN1GO40KhF4qeusIwr
+8giobb+9z5V2BUjWWmAYR/rc14zLFm1hc4dOsXgw8j6AJn25NM9DtmAOTotcGoI8
+tkxAvgqK834bVldTGjhRzEpkkueu+hyqXHiPoRcRSySCxFcGmXOcG69YwpZdXRS8
+2qlLy60QjRTb/kk0wPYA26CCb9Mk63+MOu1afnkyQ1RJTzZiMm5sENxQqnFgKx5u
+qzsrmyVY21GDNKoUnNRl/cSD7ZYN44FBhL4PKvK7WmWv8t727hubpHRn3jKCkZzH
+RQCXHL/POaYz6ydtkVzzpuzXoo+mt7JatWPLPfSZZJG7z36lkVXUQFmz2i7ODKs/
+LTMAJGGMDzT5zilBIH0eQi50AgybxbY2/tpfADfFVEV85P5vzU3CrjN1wJlRdWe5
+nO2yIygjESgoLUnNM60xkFmLCR74u0i7C+5lUCUjLCi+uKV57TBa+vW8WgtRBVTj
+0tf3WLa5U1baXNj4oQI3EFc8XnZ0PUbfWZrsN6SPmYDNuxiAi1R+fUpZwNEMnfS3
+C1Baja/ubz9AHCB+a/q+0Zp2r37ghUjHuyKxbTjIKwmw728l46B36ktQDhne/Jsu
+Bwphyu8CAwEAAaNTMFEwHQYDVR0OBBYEFAvrpB+eefpZNDIwa4sf3T/3w+u/MB8G
+A1UdIwQYMBaAFAvrpB+eefpZNDIwa4sf3T/3w+u/MA8GA1UdEwEB/wQFMAMBAf8w
+DQYJKoZIhvcNAQELBQADggIBABohD3mrad2sGPbgw76j8zjmgNefA+yTVrruQna/
+KZyVL5A7tU1wMWkORViVfW9kApzegXXn9d36sURM5KSb+YB/xdcnKqDSsVGSltMA
+YWyEORWqm8kCe3X8sNG0gHNwaxWeZk6uD8LsfTvy2TdegsQSjaNt92HiaQ0vipgP
+qN/cRRIdHnMWfbnj1MXb1XDfC7V/o/k5Mfrr944zUi7m/tfh9pat2GqxWAXWLs26
+qtTCv6i92bQXo4R7mjEpDM6K6RqlzUgkeooKEyQ1LSYFl3EG3lAeno5a/+cmuz2f
+Mk57aycu29CtJTWY2CMwj5lkzKUDalTbBb/LN40mbVXZLhprxprLYy0nuMq+i5kV
+ckuswmR47Uz2+EljzTeR952dZqySBIzZh6o0X5NsBTlD/YaBA32TTa7w1lNd2FGs
+oKZ+9E4qdx/jdRsH/cL4O+G8ISl4mYt7Nv6xB3PkiWdte/1zs8sb+3e2rA2nRpsK
+uH9uyI9UcJhWU/P3trPC3EE6tKsS1Xwrih7YZ1xgYit37EEhVOpGPPvV8UkNWO3N
+RlRZp21vC6Q28AmvorDMBmCcdMpTLBkLIbpYikg7NF7wdd/VUxxu4T1z2VInTWPq
+T08+6n8liyTVBf9cHE2eyaXkclo4qlh4o9B0F5slJ1/C+9IadQMhQqQr6o+XFX52
+APqo
+-----END CERTIFICATE-----
--- a/vars/per-machine/renoir/cert-assistant/assistant.key/machines/renoir
+++ b/vars/per-machine/renoir/cert-assistant/assistant.key/machines/renoir
@ -0,0 +1 @@
+../../../../../../sops/machines/renoir
--- a/vars/per-machine/renoir/cert-assistant/assistant.key/secret
+++ b/vars/per-machine/renoir/cert-assistant/assistant.key/secret
@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:+LFI4K4fcRXeQ7fq4+gWpFHnTspOpVLu70GJcf8TipUFmszyq1JXv3Uv/wT3bMZilv2C0nZkmTJlPX0zDRLPQwMjbZfvxrvUoxa4rZUNak2WYS5CSVN1lbtK1wXUTM3dKTofgdlwEEMF0V/wpLhIraQGOVyaWAFTCx2BnFcFTjV0pR83/2vngxND7gxiayJADncK7Gl4pYPjtNkDKpmvovFPFQAxV07S4f+ywMqu7A+DXBs6hGxiEeRFd+WSdLZYHHb3LA0Cij2BjQ/kvFAVf5t28pcif0QRqXwZfPyLmt3sM8rXhvCsrzereJ/uQDx+BKYGATFcxhecnF4yudxNu1MJuASxARpg5gAgTreTXylf/2J5lW8vp5LS2P/vO9bbuuonkv+5v22LMDT5t04c34YvIyfqfIkfOkLdzMYmZE4PaUKn8Sxk2tKG+e5qjkZqlcmnstaOhgVqfL2JXXfhFA/Cha5qMKDMZUSD//LZquElDzfxdDOSdsg+hvtXNDQd33HXDBcPwK559x5akg4XCsmI18Q6xqRAa7i2KqDiFDYZXUzEigc+uszdtnhB7NUGIK15bTVYhvAb9sbdqa0I2HbdF4BlVq/je4jyJ5fr5hUYYFVW2rQgjCSxFYrV+WT+2aC2wxVZR6J0q84PJQhpS6IGzjl0bnpD7V4GfNyZwvR0X0FItrPEh0J0MOsuEcbhJejTfVAC03/5pp9EjhhUjSqSUo9T3xw50/6EB+QI7J9/IzgMOKm1x2Ob08fg6bKq+kTZFo1TCLvNg/9AKw3n7Ypfx5XXnzbgL9HskRevrsSiwiohOIuGWjyb2B/zHtUH4OdFQNcgzv+eRGR5EkB165dzyh6S1gWFF8z9Q6I/7LQOgsE801bNNvbbOMtOR9yPG9AsNWJK1dBP1w0UtxHx4cqGCCMdXHmxWuUnbUyH8bx0s/kLzu0JWAbOodaQnoXlHACcNTgsVI+JD2FuDnW2K8hSZWmJmwow36yIpEZL6TbFKcTiLkzeyAY4a51POWHd3mVZjJWXDpuN6Y6It4BQY5R2ERbjKI/5iVtZaNowtFgTRkSzC+UNxxjbv1uE2Udje2pi7ssrGUlloMs0Sw3i3ZkLC4TH8XFvw3r4suZs2VGt7u/NBT7cZXqjlczG+MyzIGpqYA9jmA07E2LkUTVjPHvBvIlHptfqJ1330FQLlNOw1xQUeD+Hzq6NU0QX8NifPvpsGizDVIyv2uMC47HususrPuttgndGdZQueiMNWL2U+YxHWDnhuOcbBcdzSe7vg3j2Iq3PhZ/6c9JAwZlibZA6R7dzUhNLX06qqOKu9FifzRd6gYgIyFqmRZ/3lzcjOKZ1LDd1KJyLuPDphpP3G53wfptSFtfLeJ/8eQYCEC2aq2P1IxVIG5fp0i4jbGR7Mmu1h8fDbkgPoi/IqizZSGsQaF87wtWru+1RebnqHFE/IDAwT2GMf41cDLR9eFOtscjwO8WuNCjm7Rwo+/uMjUR0Ul4EzcI+jEjdWxvAQzsG07D3/LkZOus5Ouett/2V4HodiWvjcJqPz8rGS2ibGFtV/eKRh2Q/tJzdXWU9wl/JcneQexVl/KamtEvBdJNrV8UdpCBIbY67O6dRXMq0WGLm+4JsNHDNLA3z6jGYbGS9l9e6v3oZN+H/G1RfGQzEOl4JSEUPS5VizDX+wpHV8pB99eawVlGLueCnkfD7Bef8y9vO1EqPeLFZEPQ4Zm+0ByheGsYjZWKickBpcyjwPxAoTdwFxK1gD7oXGJw6HelwptutFlfPOQKOZvjGCzOdizZcK9Zj3PyzWqjFWNCzcLJX3xxX13KfZc3ijM6AlucBjID5rimTic3YgmyyT/VdKewmVP+S9MrLCoN+MJTVpG7Gvmjyc4yVKLKQ5Nl8iJinBgZZrWHyo8jRoUuBk7oRX9tc9AF5kPaNOKlDOvTeOQFoeiVeaC5vBAYcj4aNfLV9hmuKux1kGiYoW6NAFJw/0OkvBQBf8n/9i+j+2ItYWcdLCrrf44Woo6yT9dJz7WFxGABoEFKdO8MIu1zIcDjIQM2ltqt0CFwAQJLGeT9iRIDvnWRTeNOe4xCAaTGvlSAKw+mhRRT73+1pdNogG/za62agq7zqN2/Bc/9L3ATiLySBhaNJr3ssnGMbjduQUI8dnmxgHck49ClMBL0evJQGfnb8Xjusa6rwRJyxsHtlQ3NGaRRlg8VvGA7NX9R1OlKBo7li4QEEEwWHHnCZJOI0r4rYib6VrtkNVk69+MNP9h/mPGnn87NSOPmm1Fdb4bK3EERy3papEIZWsDcdVzzDEXM4uMFditCCtZuBqxUVdGxhyGwhoo1kjSgbyo6rWn1X8v2qlh+emMxUzFISzlL1oQb5qWABIRzBhxgtL+8L8+GqDsKC2SQ/9182V7GdeGVrRvux2dnqYHzRUnjBPvtKPstcsU4nM+TLb4aCnoZbcmn0TRg6pWQ71VNLayZGPgSoTk5cotdr849TYZBdXk4cfy/HyYPa9O1RIDDhpbqWa1W7Hy/5PmhsvIdlplQdNqm3OVFRrM3sSvzlrzwb0re3K9OVNlzahxvMWSAK68k0DhqdyB/sUwS7NfzXZuHEo3s5t/iZ+IccqI5pTDZf9K3g5RaPXDWgHXnvY9ceKKc1aUtqJs+SzXPbZCGtgnIb3ly2I5HLcBfrB9XsMfthg8LfaBrMQBoOdfIUM5qpSUDxjm535ewWWOThHp4XsvWNHKwMVETNTDS6WDf88uuM1Opasw3nI2LBw3kbl0JDZpllZe7e5Vjq4AipAJpa6E1bU4nANAnpyMpvOqI+G/LA3NJVETG9CsiDydezVPk7u81pXVYDkmxafeMJ3jz35ZPPRnbVjK+ruktKuf4JVnCufpTYYHzj/kNTJX9Km+pLwC1agO86JP/jS1f/0uQBhREWeF56w1wCwe833J1Pgm6khvn5JQOOKEqgZ+itLH981yD8g7Zov3VnDs9h4GipvSJUA6W29DMNobM7ud0rCLppynKih0Ng2ubDu6oXTk82kiDT6bzXn7vUXR73ix6grCDcidkqJHRKHGxcwz9xEd/BQ+IQTZ7Oz0B4kLLDI2wFF7eLV14eoVOhOfXFIjUO28J6jYLHK/MUFiNi5ZIqqQu2QPWPusa5DC5/hJsV5z2rqG1bBO3tweC4nSj//ZUZ2M7vssaeH9Dk6stY0zfz7r3BG8YIRpxOVOdwkldY4wy0AvUA00fQTMGgx8qFmmKZiqeoJl2+QpA6L6rRNhEAb2+37sKRvf7SUeENTmusuVF9bCcnB6M7Ry1l8RTe+RcUgj6A0zaL4QiYMweu5FQYq6ULfuLqiVP2OY8p9HtO9txUcFoiK8AGzPCEUmimuLkghWrRQBjW8Zj+Pu/O85YBdZVgMy0+RXz2RjXIu6FHHTM71A1VxF1pHBXJbIFf6FMaiLFF8AaA6nBSZvwPpajgKrR9dkfKtukZu8OrC6bk/j+zrI8zaRUWEyc5yvt7LiQDBnP2tXbRBFVF935rVzEueUoOBGvBECSONk94LYCp9DB/RP0fud2u7/MWBlfzpHZyxKMyI4FVb6EFloWofNT9BB6ROB/oqaEPujj2QGBU4Xn36JCNnyWtcuTE5XD8Aa+zmkq9TJoRai7gq/qTFBlCGHATc3AwgtBxUOEsUDg5SNNk36ic4mcJvgi+AmLyou0prJ3EJl7qbIY6XgmlId5nUawCZmxOQR87wtwWNP4bd6nCpxZ99NjPGHer4aai2Eja3ajsgfvdls+gy1RhPjx2FYBLq7qzFudTesUQtIuGtwCAD9nGzOuyi+OES8RJDBqSTYWijZfbfem8EUTwFmadi5VGr4lpIgRJjUn86vd6IzxJYAWXnMaQMPzF0TamXp89ze8CbMgBkha1JQiJY+n+WlhyGDDnvBUiY5+qnRz6P3OOKGraN1jBehtviM16RL99seXRNmdgwkgDrRAu1qIugZjOIgMCcxZVHSH0LNs3vg1xLrTvWE0rG3jtkf/pceJNsttUe+U/LAidC0VWVBE29QmjKkJgMv7UEwjXna1AsDCJ5/IyRCHo+fVQFCrJaz0OD0y5+BVSd1doanc3j9ZfSMac9/t1RN4FuWtZRc/bP919mqbKGXYYgAZR9h0ZvGAKLrCtloqDSfHxXSBlH+2W3r4FtHIdgkOeDQzNLtxvUqikKm03TaR0uO2V5/c/6lBlwgKrJyRrKtOuiWdDP0h4YnYGWzL/7Pc2QvEOf1t/qElE45u4NYVL0CJfyUUMWBKVMzyIsbc3zVYSfK/DJ8QeGWMAIHmrjLmb52V40GhyyDFpZ8pltDY682wnNyHgsEk7zaMfWWupoKZbMQnQtuyWHJ/vCtxQ959oBtbKaMw=,iv:qOoauLlX5EmvI9vCtRq9tVDXP2Y3mQqaj2eahvXX6VM=,tag:+88XgokklF9CFSaUiQqhtA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1gmnfmze2teqtaquxczjahvfltzzlrgcza5w4cej64tw0qzke5ftqh8c9ry",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArQURaMWJKRDNmZWdTZzI3\nNU16SGI0amZqeGJkNWFCWTJVVnlCaFAwSjI4CndFUGtrdEZnQ3pGbFFDaXBWeVNK\nOVMvendoaWIvemhnN0VzeDV4U2VQTEUKLS0tIFVudndtYm1ZK3U3MHEyOWg1Z1d5\nWmkwd2pzVmRqMzFLdnlYdjNyUWdkZk0KBzhPR2KgsSUbc6lVR6TgRJP0e6juHpaN\n6CMXik0dEk5c82sckq/dRTc6mFxOzvir1Uwso35wiVtx2fjKiISAXg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRVHZoTzI2bU5hS1UxODdE\nUkhRTm1MMHVGdG5QZmliOTZWaDNxNVNSQkNnCmJjR3VxdUZoY1hpeGcxbFBIYmV2\nb3h4RXNxTlg0bmNUbGpWckpJOVI0UVUKLS0tIDZ5anFxRVVFa3J1eXZWbkt4TWth\nU3VxOGxDVzc1Mk1QSkJocDlzL2svdDgKzA3JNqQHYbczfn3xLm9cwW62VH7hrTKE\naYU4Qdx9eY92DpWF+cuSo3RcZ4yHXi6B7HGoZ+/mON++34PD1RRdDg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBaE1OOVRn\nSkRpLytPTUZiZWlpT0Z5NlFGdTd3QmtBemNLY0ZoNXAyMmhsNApQblNmZzdyWnlF\nUkNCOVhCdVF2UGN6TnpFN1l3MFVCYmJpVm9NT1pBeFZrCi0tLSBwdUptTStLZ0ts\nWTB5V2tsWXlkc0VXMmcvNEZFQ3I3cHpISjRLUnJXQ3UwCrm4cTrKs3lInQYEVVUd\nIiWMn7LlQNnQCUZc4X6u8NYwUvxdkMbQSMzXQz3huFGzG7noSwTpqWCdebr+Ad9R\nnoU=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBMG1wRWYx\nMmh1MEpNUTJSdXVBQjZ2TkdvekovalNtdkx1T29DeHpsby9KNQovTGk5clpscVNI\nR0NQZys3a0NCYzZjRjVhekducThLdlZjbDI1bXZDY3E4Ci0tLSAvVms2cVozYmFN\nd1JQMmZLSHVIbzNwaWpzUUJvMU8zTk5XdDR6SXY5bzBNChFcpAP6JuTnSmMaRvoP\ndVS+kdIppxrjBJOZ15oAEvRXVkU4rPwAQdxO+WwIqMHK1rjNzZzrfjo3L1NISzSo\n1bM=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-17T21:01:40Z",
+		"mac": "ENC[AES256_GCM,data:iGbUJ0tZfwIvCfJSTn1RcG4MlhetH2dNlR/DOf+TzYEa93hq0l72rG8wEAnGA/u1TiDWnf+8+X1V1n9xgeE7OiDXR4gMQdKOQO6AOzbZcXYBPDMQbBrpYI94hLWCGuQ0CUl7mkoZNsTjetB0dZzsT5kbNf04X32yu/hxWLIGUX4=,iv:qBHe8J7XmZE3n8eKlUJYkk8vaEZvkl9BGKRC2vVD/pU=,tag:9I+lJ4wvZyjFmOjVL9CwOw==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/vars/per-machine/renoir/cert-assistant/assistant.key/users/rpqt
+++ b/vars/per-machine/renoir/cert-assistant/assistant.key/users/rpqt
@ -0,0 +1 @@
+../../../../../../sops/users/rpqt
--- a/vars/per-machine/renoir/cert-firefox-sync/.validation-hash
+++ b/vars/per-machine/renoir/cert-firefox-sync/.validation-hash
@ -0,0 +1 @@
+ea48c7119cad4b0ca21b441ce74f52770d53f0fb9d14bce8df3631027d3dd7bf
--- a/vars/per-machine/renoir/cert-firefox-sync/firefox-sync.crt/value
+++ b/vars/per-machine/renoir/cert-firefox-sync/firefox-sync.crt/value
@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFHzCCAwegAwIBAgIUI9fKd1BjfRTep+5Ipg/A8/Eny6EwDQYJKoZIhvcNAQEL
+BQAwFzEVMBMGA1UEAwwMQ2xhbiBSb290IENBMB4XDTI2MDMxNzIyNDYxNloXDTI3
+MDMxNzIyNDYxNlowGzEZMBcGA1UEAwwQZmlyZWZveC1zeW5jLnZhbDCCAiIwDQYJ
+KoZIhvcNAQEBBQADggIPADCCAgoCggIBAL6hTHrXirIfYLgBimMV+uQlEP8vaZNA
+ImQMiC9ueZPUXG2rL2dtz81ck+A6QituPXmDYY4s34pfIOrP8HwL4sbaMuqw84JG
+cQ8GGEyASJoxghmqa372WiraaCbs3vp3D4XZZ09gyOY2o5lyaOAK+b+TXZIEmWG0
+Gepa+B44+PkhS6IMLVQJqM24trHJOYM5XFtD75k9zqv3lv4vOdY/c0TdQrJHK3nX
+JU27htIy8jYy77GqnLWfPOh3686+vaaI89Bu/ljPnF1GVOwxHvYmUjQA0/Wd4jtK
+YH7Dg9xVR8cx3wPUtB1g7J5Q0OkmKVzvISnLWe71YLzfjGgs0nm5n/3YH2VoZHrE
+1Jv5Y+hhFiBNffA29CixU9oSv6HzawrK+OO2eq9MvzmZgIU93bAfMIePBLNqkJYB
+NpVyPjzO01L7T7XxGdbEbUpp2LVGLtkw/EzAILOUMhlsxMXhWEUw45C0EjauLBHP
+Wc+tTth4MF+lDoju5Ip3ENlt381VhbL2KefR2esn21HPhM1epOs+R1uXY8FVT3O2
+jAag8gh40u/O7XxUqn3gmOoMKUFmhIegdf03f+yDOrl/RuzoKEKBIGm7DlHPux1p
+fEjaHMF8r128pN4RibvTGdXymtGlhYkUKwG/YJCkobnnEaHoJGVvs5O42h/Pojaq
+W571BkJqv7e1AgMBAAGjXzBdMBsGA1UdEQQUMBKCEGZpcmVmb3gtc3luYy52YWww
+HQYDVR0OBBYEFLmjSlcEdHg8hkWAouNd11MFC5j0MB8GA1UdIwQYMBaAFAvrpB+e
+efpZNDIwa4sf3T/3w+u/MA0GCSqGSIb3DQEBCwUAA4ICAQC4yLwL8WZmyP403I6c
+0G8CnvtDJ+Jnfi7+n7Wi6BlrmaJec2DKlq4btkKOsYNBjG1iW7B8jJ9UO9ZQGQI1
+hqnmx9A+DFBqHt2YppYb8vjVLsy07ge+fSrvcDMxd11C6SvHW4cW272k+LfGdCdR
+TeR2ENxzb0fIiaTMZ1/DLvLhzJSjkJMAT2x43FfYhx9g54FpoqtFu021GsyZdID9
+Xgejks7H8iavGJVLAmUgNcG9nCbVBs0YbMt7QqHLA00Kj6DjqBCfwt2eIEeZrHmH
+DQ8LDRiD15ucKC0MALi0UQGXXrb4ndyRlKhBnOpENKI9B5Eoa1DNIpAlLNiyWoLS
+KTWxaPLe2jHVfI0NbMHBZDDtzzLBEi6DoKdZLzciwy65EouvGF3vA4qErStPiU17
+NtDDOIU4KxB/fs9W8h62Fmn7E1yHgUGy13lsw1ldguerjb6IBhhX3LwVXo6olDzy
+GF4arrgfRFvzKJ66PgK1AGJRRprsNI9788d/Ejv/br/Tt8run/qhBSuhdYaEFnLo
+jLofPjcy71WHeyD4ST/rkfaYgzD7Fe2OCKU1eltOi922jWgvHT6R7wDFvx3NZTAE
+rSwZkobSSNEPC4TPO5cQ1H7C6U1LDxInfeZE7XlYCgnWmzNhiudsrS97g7bW2OaD
+vSj/6jlKCth5eNp9mDxCfP2bCw==
+-----END CERTIFICATE-----
--- a/vars/per-machine/renoir/cert-firefox-sync/firefox-sync.fullchain.crt/value
+++ b/vars/per-machine/renoir/cert-firefox-sync/firefox-sync.fullchain.crt/value
@ -0,0 +1,60 @@
+-----BEGIN CERTIFICATE-----
+MIIFHzCCAwegAwIBAgIUI9fKd1BjfRTep+5Ipg/A8/Eny6EwDQYJKoZIhvcNAQEL
+BQAwFzEVMBMGA1UEAwwMQ2xhbiBSb290IENBMB4XDTI2MDMxNzIyNDYxNloXDTI3
+MDMxNzIyNDYxNlowGzEZMBcGA1UEAwwQZmlyZWZveC1zeW5jLnZhbDCCAiIwDQYJ
+KoZIhvcNAQEBBQADggIPADCCAgoCggIBAL6hTHrXirIfYLgBimMV+uQlEP8vaZNA
+ImQMiC9ueZPUXG2rL2dtz81ck+A6QituPXmDYY4s34pfIOrP8HwL4sbaMuqw84JG
+cQ8GGEyASJoxghmqa372WiraaCbs3vp3D4XZZ09gyOY2o5lyaOAK+b+TXZIEmWG0
+Gepa+B44+PkhS6IMLVQJqM24trHJOYM5XFtD75k9zqv3lv4vOdY/c0TdQrJHK3nX
+JU27htIy8jYy77GqnLWfPOh3686+vaaI89Bu/ljPnF1GVOwxHvYmUjQA0/Wd4jtK
+YH7Dg9xVR8cx3wPUtB1g7J5Q0OkmKVzvISnLWe71YLzfjGgs0nm5n/3YH2VoZHrE
+1Jv5Y+hhFiBNffA29CixU9oSv6HzawrK+OO2eq9MvzmZgIU93bAfMIePBLNqkJYB
+NpVyPjzO01L7T7XxGdbEbUpp2LVGLtkw/EzAILOUMhlsxMXhWEUw45C0EjauLBHP
+Wc+tTth4MF+lDoju5Ip3ENlt381VhbL2KefR2esn21HPhM1epOs+R1uXY8FVT3O2
+jAag8gh40u/O7XxUqn3gmOoMKUFmhIegdf03f+yDOrl/RuzoKEKBIGm7DlHPux1p
+fEjaHMF8r128pN4RibvTGdXymtGlhYkUKwG/YJCkobnnEaHoJGVvs5O42h/Pojaq
+W571BkJqv7e1AgMBAAGjXzBdMBsGA1UdEQQUMBKCEGZpcmVmb3gtc3luYy52YWww
+HQYDVR0OBBYEFLmjSlcEdHg8hkWAouNd11MFC5j0MB8GA1UdIwQYMBaAFAvrpB+e
+efpZNDIwa4sf3T/3w+u/MA0GCSqGSIb3DQEBCwUAA4ICAQC4yLwL8WZmyP403I6c
+0G8CnvtDJ+Jnfi7+n7Wi6BlrmaJec2DKlq4btkKOsYNBjG1iW7B8jJ9UO9ZQGQI1
+hqnmx9A+DFBqHt2YppYb8vjVLsy07ge+fSrvcDMxd11C6SvHW4cW272k+LfGdCdR
+TeR2ENxzb0fIiaTMZ1/DLvLhzJSjkJMAT2x43FfYhx9g54FpoqtFu021GsyZdID9
+Xgejks7H8iavGJVLAmUgNcG9nCbVBs0YbMt7QqHLA00Kj6DjqBCfwt2eIEeZrHmH
+DQ8LDRiD15ucKC0MALi0UQGXXrb4ndyRlKhBnOpENKI9B5Eoa1DNIpAlLNiyWoLS
+KTWxaPLe2jHVfI0NbMHBZDDtzzLBEi6DoKdZLzciwy65EouvGF3vA4qErStPiU17
+NtDDOIU4KxB/fs9W8h62Fmn7E1yHgUGy13lsw1ldguerjb6IBhhX3LwVXo6olDzy
+GF4arrgfRFvzKJ66PgK1AGJRRprsNI9788d/Ejv/br/Tt8run/qhBSuhdYaEFnLo
+jLofPjcy71WHeyD4ST/rkfaYgzD7Fe2OCKU1eltOi922jWgvHT6R7wDFvx3NZTAE
+rSwZkobSSNEPC4TPO5cQ1H7C6U1LDxInfeZE7XlYCgnWmzNhiudsrS97g7bW2OaD
+vSj/6jlKCth5eNp9mDxCfP2bCw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFDzCCAvegAwIBAgIUUPinyxUfxwhxvzVh9az7rsYIVuYwDQYJKoZIhvcNAQEL
+BQAwFzEVMBMGA1UEAwwMQ2xhbiBSb290IENBMB4XDTI2MDIxMzEyMTQwOVoXDTM2
+MDIxMTEyMTQwOVowFzEVMBMGA1UEAwwMQ2xhbiBSb290IENBMIICIjANBgkqhkiG
+9w0BAQEFAAOCAg8AMIICCgKCAgEAwxyooscyb3wqayzJZ6//S8Hd2C2esJ2gii39
+iEqfV3AXJC1TEm1bgydZ8DGByzbBl4HqvDuElG3a0uEOVZN1GO40KhF4qeusIwr
+8giobb+9z5V2BUjWWmAYR/rc14zLFm1hc4dOsXgw8j6AJn25NM9DtmAOTotcGoI8
+tkxAvgqK834bVldTGjhRzEpkkueu+hyqXHiPoRcRSySCxFcGmXOcG69YwpZdXRS8
+2qlLy60QjRTb/kk0wPYA26CCb9Mk63+MOu1afnkyQ1RJTzZiMm5sENxQqnFgKx5u
+qzsrmyVY21GDNKoUnNRl/cSD7ZYN44FBhL4PKvK7WmWv8t727hubpHRn3jKCkZzH
+RQCXHL/POaYz6ydtkVzzpuzXoo+mt7JatWPLPfSZZJG7z36lkVXUQFmz2i7ODKs/
+LTMAJGGMDzT5zilBIH0eQi50AgybxbY2/tpfADfFVEV85P5vzU3CrjN1wJlRdWe5
+nO2yIygjESgoLUnNM60xkFmLCR74u0i7C+5lUCUjLCi+uKV57TBa+vW8WgtRBVTj
+0tf3WLa5U1baXNj4oQI3EFc8XnZ0PUbfWZrsN6SPmYDNuxiAi1R+fUpZwNEMnfS3
+C1Baja/ubz9AHCB+a/q+0Zp2r37ghUjHuyKxbTjIKwmw728l46B36ktQDhne/Jsu
+Bwphyu8CAwEAAaNTMFEwHQYDVR0OBBYEFAvrpB+eefpZNDIwa4sf3T/3w+u/MB8G
+A1UdIwQYMBaAFAvrpB+eefpZNDIwa4sf3T/3w+u/MA8GA1UdEwEB/wQFMAMBAf8w
+DQYJKoZIhvcNAQELBQADggIBABohD3mrad2sGPbgw76j8zjmgNefA+yTVrruQna/
+KZyVL5A7tU1wMWkORViVfW9kApzegXXn9d36sURM5KSb+YB/xdcnKqDSsVGSltMA
+YWyEORWqm8kCe3X8sNG0gHNwaxWeZk6uD8LsfTvy2TdegsQSjaNt92HiaQ0vipgP
+qN/cRRIdHnMWfbnj1MXb1XDfC7V/o/k5Mfrr944zUi7m/tfh9pat2GqxWAXWLs26
+qtTCv6i92bQXo4R7mjEpDM6K6RqlzUgkeooKEyQ1LSYFl3EG3lAeno5a/+cmuz2f
+Mk57aycu29CtJTWY2CMwj5lkzKUDalTbBb/LN40mbVXZLhprxprLYy0nuMq+i5kV
+ckuswmR47Uz2+EljzTeR952dZqySBIzZh6o0X5NsBTlD/YaBA32TTa7w1lNd2FGs
+oKZ+9E4qdx/jdRsH/cL4O+G8ISl4mYt7Nv6xB3PkiWdte/1zs8sb+3e2rA2nRpsK
+uH9uyI9UcJhWU/P3trPC3EE6tKsS1Xwrih7YZ1xgYit37EEhVOpGPPvV8UkNWO3N
+RlRZp21vC6Q28AmvorDMBmCcdMpTLBkLIbpYikg7NF7wdd/VUxxu4T1z2VInTWPq
+T08+6n8liyTVBf9cHE2eyaXkclo4qlh4o9B0F5slJ1/C+9IadQMhQqQr6o+XFX52
+APqo
+-----END CERTIFICATE-----
--- a/vars/per-machine/renoir/cert-firefox-sync/firefox-sync.key/machines/renoir
+++ b/vars/per-machine/renoir/cert-firefox-sync/firefox-sync.key/machines/renoir
@ -0,0 +1 @@
+../../../../../../sops/machines/renoir
--- a/vars/per-machine/renoir/cert-firefox-sync/firefox-sync.key/secret
+++ b/vars/per-machine/renoir/cert-firefox-sync/firefox-sync.key/secret
@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:NuO0e7sypiCk5JRQPFtq2ThodQK2slNy1aH1V5Y70Tv4a0fi6PIgaYZv9MfJvNGw8QjOEghF+cPJn/5HE7B08WLGn6tuK3mimq9FiLm6kcN3lihiab99AsyravVIrSY4jzUlfG0F4jMyD1cQWQFOkHYAc+/3T55GGPGoQU+de9qwAUl128ek2JZeXO5UOYT++k+wcEPuijDge5k+w/aKS5hM5OcQNAA/+/9vcwhpPqa+9gitkaEed+Ldg2YNjE4aTWAjiWZncrk85DvKAMveUlqNp1wEtLPW1Av7va9QVUUA1htdH7jCGcpKNNPZWImjWBGQqwkHF1QJtizfNUAUJZp6mTiCWbDnM4tK1PcwqbGSeDarf6rnRzPb/RoakIH/xY6MIusry4iJDGBZ9VNJv5fci4RqpUvccU08qp1IcslY1Q88FpRSJrheN4S0lXrv0Upz6LZIrtcRkA7VQ2MMcfyhMcnf4JyxESHi2vVu4ZFik/GWBfG+RBdaGmYQmZnreRZjSUXkEWVeKtAEOLL1EykKWjuA4bmbICpaJ2NOFQhnXfhOkW2QUU7PSY6dh7AnPMq0zd0CCDnwdUEk1xmJ1uUF+qkSE8Qa9PaVtG/GnnvzqVTK3RRE/4k/Wm0sI/0UAB7+BvR2QH/ns+a3/S/ZXj81l3yLkfktXnt76OxgdEAENlhIQyJM5L6UyXwI2LeZyN/O4cC8UJOC4EqWoKBiND9QY2rc7tdQiHyXttnIfbvzGpLa9zZr/en1GHuvcD3TND3TZ8UFlJEB8i9lgiepRn+xZv8lF6XSCYsbkOl7a/hPdpmu8x65FFUmLBrshJCYtdhkXq/3Inlmt5UVH410gKFDuI5oDkulSG7YYtVrgdwwhkZafgNXWVi9jGzb0qhTTKl9O7gSCVUmv8AbptxoCfwKerEzXqHePoH0QWUGbmHHRRsQTG/y9hVqFZNS8I+KD9Rxslv4ttadeoA7xXFdunRvxFMtEXKRmUBCBJzylVl60LErAbKahShXAq+jJO7IQG/lBPtj1YSSxQVPXSmSR4uFvxWOQ9Epqbd2E5B56bkdJ6FCxazfFdSnIj57/LH+7Fp1Uai14xX3GNokkTGyS7S1ZWy5ra359lKBrsVqqrqIP35egj2bBtjOUvHEh1e0jlqzxh2iZt5fijxav82ibtMwoWuX6iD4+PQDoHBGice1Ukzj03fHPyuxdqvhCkv6FI33AOqgHQ0oQKxRGUM5nfia3JCrW/cZqzIFbCAG2c/u6RQE/p3/AtfqI40O9//WEkbs+mPzipI5oBxwwdHxVxJRHPzbAjjvbgbleORwR9PTKYxoHBsvzKM8OBxxNzExLH+bPXzenCUBPMj8nPmoYfUnKQs8RR4aNJfZbJ3LPUrISvd9graz8ag3Es3X29hqAZYG8/jdIl2mVMbWZvyemb7Cbosgbjob4OWeWYbo3IwZ4lAlHheSIleE/TRiXx+qai4XJQ2dvkdmxKobXFth6dEB4oTCJ35VX71TuA++790dxVkKZbL2WHXRIFhIwHMsKXcMChha3kJSyRXWDA3Oy2cqQYbTWg8z2ZIli4sumkMveoiwVKDU763UgLdC/kM/kUha3pvFaZOQFDlVHkBIE8kAlq/fzPU26Q3VeTbW1OU0fmjWMVfwHh6zMR76o5OsI5wDV1fOEXHXrDT4ZzR1Q9KSx7RWcfAPVx9qqPwgZLye1ns/he0utindJTUj/lWNVSY0LB+aRlXIW6HVh5H6oU7d8qmaytMmR50EB0uW+btODR1I9VJdo1GPSEiA94yY9IJlEPB185QX7f/weMTGLrZHwlSdLRUm/+TSo6/stBy1j7/HdD+m0179FSSrTCPTPSYgmRI1pfp/ex3k7SS/OFEVuydyZVe9yZ70oQuA9SCaKo9rX7TmFicDrbBXOPKy+2EjtGQT/MDQOs9L0Zvoc2/jq5jWC899Zx9IpfswLppUzfpJslTza3tInBpnLgY60nkOPme7l2Go98cfWcBd4cSnktY2Tbk4ispP6eFgrK1C1LV5yDU9oD+BLAyXBe0YlzkrLU0xLlWmJVGJjwP4igtzDWOVsLZ4naDOezFJKHqSlt2Pc1KS2ul4fuNw4JcDVcZ91qzAc2MY+dfz8c/BAKujKKaBdK8IjZRfMR50hbxhxH9FKUCLHQ1MfractQ/r6u6PoxFynTDA3XWSTrjxPFJU3y+i/wMjh2qFDrUoNPRaa/x2g1VDw+shJ/WBba4PTrQJsjDQpzDAiyReW9DOqb+5ChyfiBu5V7SbvTb9R1GgjphwuAB8gw9BI1SOBAcMac7Nb7q4T5H8pIa+MshrVVbd5NlXYQ9bF9OYuk3JoR+qV57+CBKSNUBDolvgur/U6T/nvD6gUF1mCNgNuaVjezDNEpAiFOhYFQW994DNSyEdyYzVqyJ3J7YbfTAzhU2rNbbWMQ6s2ij/vInXOPDSlAYUAYbUrtA+UEnyUcfHVagRhqPgje0A+1i5o0PfGlSQpRSLoFg7ui9ORVttJmxWWCz7Ky7s8M9xjJdtPl/jpEKJQ+lYVTlrtz/Zy0Su+uNJsQMC8f8KbyZgDr37EKd8UACBGAUN5vbR1fGqIBWPKM+uGB6m+a/+avBQomfoxNcNjLbfqyD3lo11qRrJO7CJ6c7bP1VFbpA6QHG55EknoXBwnqVD0duat6EvLm3G4jYAYVlVcL5TVzqdn6Ir0VvkdZpxrT0ZAfm07W+7J9SRtVw6i9whyhE7h8qYl1g2XpSCr77krczkdL8qPXbc9tGV1/ZJV0E9Oe3Wl+p95rrAznvUDuqGti0GYMbasMudWkVIwqQGcW2hOxD7SZ0yo2949ta8Wr3DLNUQY/x5pv50cd62TflvxG/kam6Gv39z5KrzZBYntVN2Z4ghp/wOiu9EnT0FbNrW3fPLbyjo4G/7EpoQLp6NccX3v3ixFNJcVxP5ttgq5OvymztfYp8aajBRVNp1aab0AtIBM+wblKF2CPzYnbRgBaaNtgiyN1d9elnbgRDw6+rLRdZJrGTQ2o+QStMFPMZcFcOPSHKKUs122Z9DZ+6bGE6OJBEoOlsaGvu4+fwFWWmhbTR8eQYosBontgDM08MQjzSTQx2IlAK5q+4ONPk3JNs93WdmqxFHXebefO73lnMjuLCvfGUkkLnSvxKHcR29f0qy8L0nEwm8AXrzYkCgf8FQH0p47Fvf1JoZQV6+7oIu9zDB9mlmzyUPPEippCSnwU9Zfj1KhIDBNUqrH4Dddon0cDToFQ47l+1Ifjz7XfeZzP4pscgvZA2yZzdWafVSbW6sS7/9uVFagW5KwRUqWL/UCs1Fz1ZTR2Pgm5Ca9eGbEWeXiNEdxuld724gnA8rE1RzX+MDdOGB+fwTWxvGCZYr6xaAb9VFaSKgTfyIWeh3aaCg6TrTxFW1FnxRGoxPNKGy24ohVgu5ZB3wyb192xD3C+9gT51sfyYUtp7M6xZiF8Yd7GTMMXflLjzMXB9sPUVX2IIKe6HgkL/G8y2TPfHTaNILFmy3yUcDMKkTM4tNqS+8b8/gsyl8KZN99+HxQYM4i8JwquKg1iFjdeD2L7Rw8eEdcxkclvdYGyG1FPS5Rf/dgJt66pktGHCv2yvBkmpoS2U+12KesbIufjYpFXPPQwUoc34Ai0SeK9fW++OqFgZN0Yd+/LmyFxJIBMZHKPnDOK7trNkel4F3LdniJgiNvxuHIMDbmb0k7jqnTTlNo9Wui/gA/oz2wuZZfP+LUZJR4hVIUnPEsa8e2N824fx8GJVDJGjTavE4Ivy7fggv0unekyn8XcGRxpcKLVQGh9R42vml2362zQGkihgZbf9Mb+9TY8Lc/ZnIbTJj2r6FyquTHJcYjlmJQILzn7IHjyu7pmvYoFdMpe1FUxI+V7/zZ1j2gpKn25vcw3ZwR5g+97zJ2Q3K5ijQCO0010tB5mK6Vpyd0Km6nfVJsGgzkdf8dydWhp+btjSd2E8mk8Ehd3P3GP43qcDBG4n+uDnUvBfCMp+Qf6v+QKIKv3Jb6uqwhKdp6nuv59qLaTs0V5I5lIVhu9PrwP+vIr6DooaL9++9C9ZNQ/7+n8pa3kH7/tLNVbFQqDC3IHg45r0NBnK/I424XKt6gWyW4sjjZiZ1v6D5EGXVK93oXgK3tecyqBoF71sbWVEQvyLT0wFplbRcYDY93Z/GJrcyoWyBG2kAPKWM3S1Otzv3Z4Tsnfd5dv4TjvHvFFxEsbkuZpdSQei5DbjEwMQZ5DWife/MOBDIqoCplyShQ6eW+t/11VgYcN/21DERi4ldl0IVwVOjktjf54CMFS+PqiKype52pd0auU75NYOCrbMfAd5IX8auKCL2Fl0dTRO5Qy1eFYgZLXxn6D4=,iv:fURJ7xoWxoQA26Gzzvl3gBhLdI6Ryh9APzLz1b2DFnI=,tag:NXGde0qalmqHNqH3pU240w==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1gmnfmze2teqtaquxczjahvfltzzlrgcza5w4cej64tw0qzke5ftqh8c9ry",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNWU0yYWRrMWloSGxneHB5\nbDVCZlNXQzZaTU10RWNGa3gybER3bWZzVEJnCjh2K2V0aFdLdERaM1kxSEtNV3BR\nc3RVY0hCV3YvQzU3aWdpbjRpM1dEVVEKLS0tIEo4VWtOYmdMb1lsRlV4T05oNkJ2\nNDRiWWM4UEt3c0hKSk82VzhLWHpRSHcKgmLEf3L9cXnrKSsa+UqZh9PWioR7w+3W\nqc5d/LC8ojXNigqLCl+B+588dGWPHq6xSspr289V6Ck4+RUiO+Ct4g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzWFd0RHh4a29ib1lVZ1d3\nZUwrU3pRQ1dkdk1lNlJXMTVXd3FEcmMzUUM0Ckh4UnNsRzRkYnU0QjZ6NUNjRFJO\nYzVkTkh1WHNlZnBYUDk3Tkt0akR5MFUKLS0tIDlBZXErZFNoQzBsQ3V5bFJyOWZM\nRmFaQXkwT1J6SXFkTStHczc0eUw0Qm8KWvTCYE9dSVzrMTrIezcuIZJKU8XEiLub\nh6kHuQtI0T2XbzNtSr6x7sokMevN0DkcVD6VIl8CRSr/CfzEgKe4rQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBL1lSQWs4\nRkNLV01vTmxNZzRmYWZIWEI3UnFLSTE2MkVoelhnQkM3WlRtNgpNaWNYQVpLZDAx\nZ3ZuVnQ5UW9BYmZNS2xpZ3hYdkE0bGZqSzdrM05BaktrCi0tLSBIL0JocG0xa3lv\naVZNclRvQXdYRm1qRzF4Nm9tTUZkQ0liVThaMnpvV1dBCv2m25/LrfMDPe/uUihc\ntbu3mJ5Xo2G9NKqBqIIhXSasaBY7KRM/gj6oR4eB+dpfDHHKBGe1OLsw7RGDMDdr\nZCo=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBNE9Qak5E\nNGpoYmRDWGhjVFJHOHExU3BOcURUUTBsQ21ZQm5nUVFRWi9ybQpUSjdXSnkwN1Jn\nb3VSeDhXVUVXckxYNXR0b2ExUTVLRm85SE9ZK20wTXdBCi0tLSBFdHA2ck40VGhL\nR0w4WFJzdGlWUkVHY09QUXk3YnFyTE5zN2pFZEFzNG1rCnuZ5Fu1pN5osofvaNG1\n8+h+Ig79dNO09YlXpfySYQFpqiEliwTBxAXXxN9tMB2MXn9tjak7wuq7eRn4C19J\nczc=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-17T22:46:16Z",
+		"mac": "ENC[AES256_GCM,data:W/9/6I1g23UjYvEUAIfOlc9NT3Fy/flm7YZQ6iikOpJFguI6L9Rc7qXGXvLhlGhp6/NqbYmSA6FwGHCi65gp5Mt2917Jzq309lhSJWZAgv4ErSeXrGpvVaU8Y5waU7rJ+ESDMFBG3kWVgkICvWxFE9ovj4vuzEAWtqCzykCfJoY=,iv:HwBJRSTc+lFcMOQnk+pxuuVxTguAKBeENITglDfL0xY=,tag:NwxMLPRmNhxTIjrUSM3OFg==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/vars/per-machine/renoir/cert-firefox-sync/firefox-sync.key/users/rpqt
+++ b/vars/per-machine/renoir/cert-firefox-sync/firefox-sync.key/users/rpqt
@ -0,0 +1 @@
+../../../../../../sops/users/rpqt
--- a/vars/per-machine/renoir/firefox-syncserver/master_secret/machines/renoir
+++ b/vars/per-machine/renoir/firefox-syncserver/master_secret/machines/renoir
@ -0,0 +1 @@
+../../../../../../sops/machines/renoir
--- a/vars/per-machine/renoir/firefox-syncserver/master_secret/secret
+++ b/vars/per-machine/renoir/firefox-syncserver/master_secret/secret
@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:+o1nUXI8jaIBEAGQBI2sj3LXI6is8/ySWoxC7evQTc0ddinMRlEGbn8jpfnHxTBegK7J++Q4/5zFJ5I/4CWClta1vz+xfUWqVJhKIxd/kjXNeIAa4VPvPdRjLk0EduCgZd0vMEqzTLQZ+m00mxwqPfYLwFZp2mGrvuWW8ZhpQl4=,iv:9sxyQ24CsMC1lUNk98TqZQbcG+jPssH7jNfU+qwWgME=,tag:bpHSCJhpYOvf4JCWnyt6bA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1gmnfmze2teqtaquxczjahvfltzzlrgcza5w4cej64tw0qzke5ftqh8c9ry",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiQWxhYU1VNkVUWFlqck5D\nZzV4ZDRJbEJkNk5SQ0RlZ1dmcEdkRThXa1VrCjA0WUpVdnd2SUtoS0QxTVluWk5i\ncS8yRXRHUnZ6TXEzbk1uemtJYkxtVE0KLS0tIEtlQXBqZG1nbGhmSDBYZ1JTUXAv\ncERTaVZrUHZTRXI3d3QwaDlqN2IwaWMKQvZxsd5k9xYo0p8/KnRVVsThFnKw+C5k\n4RkisJcM43BrlHFQx54YJExvUiSuK8M//KrYWHOgeijSkHDzlIF45A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmd0orV01VeGQ0NlNBcUJS\ncWdlV3kvR2NsTjUydHh6ZnFPc2NzaHNiU3k4Ci8vNUNIdUxLelJJK1FEWEUwbU5F\nbzlsU1RNTStyT3dGbE5qY0R5b2haVU0KLS0tIE5adjIxRGtOdUFmcHFlQWtlVkFK\nY1FROE5EVTI1cllOOGkxMEhhQ3VEc3cK/1tjERQoPf3GNt0Ln4nA5QRoA0hPdmSQ\nGuipx20E3/PubrrZCiDbl3Dxto6QkeN8w5KgSJt/KA2TA2x/H+nZlg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBcTIzQXFh\nS1RDdXdxNUV0ai9laGNrTnd2bHkycGs0SExjZ2g0Z3FTcjV5dAoxNGx5dUlFWFkr\nV095REZiaU5pUUpEZk9PVWJsbDBYWEVUWHZMclBKck9rCi0tLSBGNnhKbUZvRXlI\ncFhoU0M4NC9zcjZrVC9IRzNrTGpQL3FXUGJ5WE93c2JNCni/qGr765+PzSgy/Ks+\nWfZcP3idsP9nM2ZNWqvfRBc9+6ypldYdjRR63Z+JiHNIlthsgXiBxnaJjdyUC4Uq\nT+Y=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBczhqSVRx\nUEFtdFNWRm9Pb09Qd2kyMlRLZ2JsTHZza3piajcramxqR2pwbwp3RHp5RGduaG9I\nSEJ0bTRETVdnK2NvZzJGVGtqTVJ3anBrU2Z5NGJBUk5ZCi0tLSB0S3VEeFNlUlRi\nSDFtUDNHNlhDK3YzR2FrbmllTUFGQ0M5N2RPTUg3MVo4CnFLzXMoRZfdQD6pU5ds\nfbmdJgfhCfP1U4I5TzMJtfO2cAgeX8J1loT91VaCrXCrue9Tf/ApW4cJ+dj2HXTj\nNDg=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-17T22:46:17Z",
+		"mac": "ENC[AES256_GCM,data:GIYAIjiCYER7va8Q3QNoIEYZjnFNaHBPvDlxNQZAwVjAqzjMTxpXHWGuGaR7opMSce9i3xXz79ygD8/lqEOT0Swhe/V6y9JR4wO8g6upWEtPjKDEITuDdk2fcyVRuWRP12OwzR5solOw7eNw8oYmPb2Oz72VETYDc9HY11Yfkpo=,iv:pPLNeuJJCgXok8Z93J/qipUhEArwYAPTMWS+eqvpgMM=,tag:JODKp6CG8jFAFMIo1EFjyA==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/vars/per-machine/renoir/firefox-syncserver/master_secret/users/rpqt
+++ b/vars/per-machine/renoir/firefox-syncserver/master_secret/users/rpqt
@ -0,0 +1 @@
+../../../../../../sops/users/rpqt
--- a/vars/per-machine/renoir/garage/admin_token/machines/renoir
+++ b/vars/per-machine/renoir/garage/admin_token/machines/renoir
@ -0,0 +1 @@
+../../../../../../sops/machines/renoir
--- a/vars/per-machine/renoir/garage/admin_token/secret
+++ b/vars/per-machine/renoir/garage/admin_token/secret
@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:HskteFsfzxQtBZGi7g3aUdimgOrHaOr6/S81cbyPdFyBJEh3FgUIK2/isszp,iv:LrV4/h8h0zq+KJTZGoW1Z5TrZls+ZGMVcuqKwCeSCzA=,tag:2yf7GnP5Xsfl8jmIx3S7Lg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1gmnfmze2teqtaquxczjahvfltzzlrgcza5w4cej64tw0qzke5ftqh8c9ry",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLb0lLNE44eThmTXkrREZv\ncjFNbUVQMHA5V092Y3djUWFGbmhpSUt6U0NjCktVMU8yejZxcUtabm1pWXd4Ly9Q\nOExBRnRacjN3QmlRUUowTzBiTXhqaGcKLS0tIG9OeWtHMWxTVVMzVFBmMjNpcnBO\nVUxrRGlscG9mMTc3cHB1c2lmelhMSGsKS1Yp3FmzNqgaAqXHs9qFvvf6IsQMvhqy\nkfxzzQHokHAGjA4pi/tADSvoBW10xvJ9uOvB+aXZJH9mRmW9Y6Ysyg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4NDFab1lBQjgrYW5aRnpE\nUUZweWwyMFV3VmI0d2s0MTZ4SEkrbk4vTEFVCm5oOXF4aDJBNzMzaFFzQnUvdGIz\naFNuZWxKdjBZdnRlZjRWUlpraTVpbXMKLS0tIDNCK2xyKzVvWHBwMGE1SFRYWFVE\nc0ZCWGM0SmFGT1dYcDFxc08vTkhOb28KK+EiyyqI4GfDT0y+inD3eIgxHySrAEUH\nu9GfhQHV4Z4visdzR/z4S96zpDg4MNnJv1SKHAE7EDlfZTCNl8lyow==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBcU9SUFJv\ncEFVYkJRVCtDU2dEUTJPUlFSbVpya2VyWjM3ZERldU01V2lHbwozNU5KOFR5QWl4\nQ2tQQS9HdlBNRHBOL0xZZUdZSmNEUFVPYTQwckRKNVU4Ci0tLSBoSlduSHNVb3Fh\nUnQvdVZGYTd5dkRvNW81MnhrRkd3aTFQeFdoZjhBMFRZCmp67Idar6MMD3HU5/W5\nLx1KRyYmA5ePy5zakSWsxcgp6KeA05UMHh00ZRgCizB6/cTrc1fOvtW22mHJLeNt\nUTM=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBcVk5Nlda\nQ1FvSVZpZGRXYWRBVHlBdzkrTlRYSHNqTXozTmIrWWtteEdXTwpHR1Y1M1JYd2RP\nODlxRmVpVjBXb0F3aERBS05KNUJCYld4YWZmeTRJTU1vCi0tLSBvblMwOHJJWHFy\na0FPcVk2WkZpSC83L0ttdUxiM3ZMQUZVM0V0UC9rNnlnCjHQO7KGNqZVPON7Mjnr\nBAOLZfvJJQZ4BsIJNzHYwlJJ0fByBWde3kNQaEm50JgihJ2Bt87Lcyanz8Vok2Sa\n9gc=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-22T19:28:29Z",
+		"mac": "ENC[AES256_GCM,data:sOqgKo833HCi6u+EKSVSz4T/Tnj1D8yKIq+o4kwFINQZ+PaF/oC4NemSYvM8b00i+XDiKOhwhHx9d1vNVNCeA/rMQDiWtIDEbq4AsXIZ6Zr7bkASPWmQkbsASoAxXIxJzsH+QG64G65hy21/QO5Od6bHmhetFzFbYYWNw8Fk6iM=,iv:0HNTN9P44zHLdlVGPsqtwWc4fnAEBvPbL8VLRCqwV44=,tag:pxSsM21AZv/G/4s3PpnMIw==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/vars/per-machine/renoir/garage/admin_token/users/rpqt
+++ b/vars/per-machine/renoir/garage/admin_token/users/rpqt
@ -0,0 +1 @@
+../../../../../../sops/users/rpqt
--- a/vars/per-machine/renoir/garage/metrics_token/machines/renoir
+++ b/vars/per-machine/renoir/garage/metrics_token/machines/renoir
@ -0,0 +1 @@
+../../../../../../sops/machines/renoir
--- a/vars/per-machine/renoir/garage/metrics_token/secret
+++ b/vars/per-machine/renoir/garage/metrics_token/secret
@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:BRaL6rqfcgh6G4OLNb1v+R+/7v35TQkd8+s4dKzn5RG2mfm3kzE3JQd8eQW1,iv:9gRThpi6PTCaQkmsFO1Ypfz/jhiGEypSSz92NM4pR+k=,tag:VaW6z3Zb/oB22qdmjut2gQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1gmnfmze2teqtaquxczjahvfltzzlrgcza5w4cej64tw0qzke5ftqh8c9ry",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYK2llUGpCNEhmVExsRXhV\nbkQrZTI4QmRESnp1ZGo2VDVrdnlramVpZTN3CldpNmFVbDJFWnJ3VzBuZTRaTTdy\nTkdCNXRzZndQT3EyTkI4YkM1K2JnZkEKLS0tIDRjU05pRG84d1drTG5jYTFFWjIy\nWGlaeGQ4ZGVoT1pGb0hmS2UzSWF6d3cKwTwKngDwZYhsDOU8f8pOITWLkKpg2khE\nFHblKsp7oaC/Gsajq9hyiPyCaShCJJO0TKm2k3OqUwGO+1zyNJYPkw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5eWRtdEdOZmN2TlFucG5W\nRng3LzlPVDFpM0x3QVN3b2x1MlBTeFZGMWpNCjBQTlpHdWNKK0Rkb1J6ZCtWdlJo\ndVU2ZG1zcTUwU0x4Qlp4KzZOT2lPYkEKLS0tIDQrOXEvK0Y3SFNud2FDL0NmS0pT\nZUYvQ0tINE4vWXlPZEZxNy9VTjc2OGcKHDtKjPrTqm4jTOVtDRFP1KYpdgCu35hM\n681V80J8+GeS4DuHMMzN1oCTrmj+bDNMUDuEj/Zr6XyEuVAsMB9v+A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBcXhEMlpr\nVnhQT1cvaHk1RFFTRGRQVklia1pDSUwrWkM0Z0xWYWZXSXdjNgpraGFOcHE1eVVy\nL0x3VHVGQmN4UzAxRzJObGorakJ5VjA3ZXZoMmNlT013Ci0tLSBsY0lsWWpYZGFt\nN3ZQU0VZUERzeU1xQk8xWnViNStEaGhkeDRMRnk2bHUwCuAPbIaKsuKBpy4UeGgA\nef+zRWhrJYb4z4zLDT4DOCxUSLu9z5obYodeS+ONNVpDrFFqKhbCCUjlIv08dZ2n\njt0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBdDFGVndn\nNC9EVnRUdGc2RlJDenE2TCs4elFvNytENkVtV0crVXBTcVZsVApHTFlzWWF2YUtw\nMVZDTUJHdmpEQUVpSDdFNXdFUTNKaDI3K3pBYUtpSnNFCi0tLSBzMUFjSkxpUFA1\nU0xFN0hQdGx1aElTTmlEN0RJL3VEZmpuRHA4WjJsM0dnCgTnKkpSEIVgtmZNTsne\nUvQhd2AjNVHaiFKMVEOI73gTxuOctkCKZbAyYd+sliChRyVPIKaFZllXp2Y30z9a\nBIw=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-22T19:28:30Z",
+		"mac": "ENC[AES256_GCM,data:CWGW/P2zl2fIuRZ2uNEMygY/LiivJKbhDj8y0LLx/PEaKx5zO7/GSA5vZ2n8Ouj5HNSGRtef6Un1r8zuOZvkSSogZ0ED0yYOcrAtza43ilft6K2BT5vKfhgaBmPn0GDWK1AlUcONMKNW4OQyuMD8Aj3rba/BHiwFMgEv9fhMwGM=,iv:Pk3FLK5glyX/K1Eyn5RD0CkHSBiBbRjMMBcm8X0pZ40=,tag:o3fAltzPkv8niYPmVCE/PQ==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/vars/per-machine/renoir/garage/metrics_token/users/rpqt
+++ b/vars/per-machine/renoir/garage/metrics_token/users/rpqt
@ -0,0 +1 @@
+../../../../../../sops/users/rpqt
--- a/vars/per-machine/renoir/openssh-cert/.validation-hash
+++ b/vars/per-machine/renoir/openssh-cert/.validation-hash
@ -0,0 +1 @@
+4295ec657818b294358ee0021867817c4a60a3e25c8a077588843fd660c02cf5
--- a/vars/per-machine/renoir/openssh-cert/ssh.id_ed25519-cert.pub/value
+++ b/vars/per-machine/renoir/openssh-cert/ssh.id_ed25519-cert.pub/value
@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIFB+HXa0RWl7tARwv+k4WIgcdPkfcTIf0ml4uAKpyFtQAAAAICswF5i+oApyYl4CwHBRrlYEvLr5Oql8vgw9d35uZHyeAAAAAAAAAAAAAAACAAAABnJlbm9pcgAAAA4AAAAKcmVub2lyLnZhbAAAAAAAAAAA//////////8AAAAAAAAAAAAAAAAAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIGE7R12pfvRSXsS8MwMkp57fuc+N2wc4VcXAYwo/eJJ7AAAAUwAAAAtzc2gtZWQyNTUxOQAAAEDEegGj5Q1Rnwu09aFiYAyDD+1kvrw5XKtOSpaX+t1QaJNL2sLZXjk7JOzK5QuHpyHhbyJdSbiOhzH8el4vgOQB /tmp/vars-nyhu7vev/in/openssh/ssh.id_ed25519.pub
--- a/vars/per-machine/renoir/openssh/ssh.id_ed25519.pub/value
+++ b/vars/per-machine/renoir/openssh/ssh.id_ed25519.pub/value
@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICswF5i+oApyYl4CwHBRrlYEvLr5Oql8vgw9d35uZHye 
--- a/vars/per-machine/renoir/openssh/ssh.id_ed25519/machines/renoir
+++ b/vars/per-machine/renoir/openssh/ssh.id_ed25519/machines/renoir
@ -0,0 +1 @@
+../../../../../../sops/machines/renoir
--- a/vars/per-machine/renoir/openssh/ssh.id_ed25519/secret
+++ b/vars/per-machine/renoir/openssh/ssh.id_ed25519/secret
@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:UYEEYxPXOZ2fs288JqGuffvZs6GVs5wDBlsXUrF3oa/gILPRykuSfNMctOYFVEYA0cn9Kg3mSnkbUEk+14VH3OCdN2qNNBH6usXx4bkDmwMbBqoahKjrF6oST0LDO5wWGkN+Y4DK7zuOvVeYoLExZ63Md9cGFW1bpRJTn45XFpogEVY4pYc7WozByBHpcAxKsJzS6plJrwE7/UpKF+RPnXjD8lRIBUX2CUcGpaX58RwfyKunxwyIjfmEfjbZagrOQyisOsl0LM0k1XtO4mUhRcmJ4ZyZaVdzhXPPMigqWL1kACsAST7aWPT+J+S0Z2IN03zGA5+M3SGsIezVKs+v1Mix6/zKXRelKz/t6o0eLhx3/4V68RTYqX3/6kCrVGCodT0d3h968DXTBuyBTWIsyNXtOu5WAYPOZ0Bv4l1NYFwh5quQeOJ/gQvfZoQpNBtv3TMt0HsTfCOHsYWiYwb/frWMqaseY+6V5BmO8WIxTOvvBVSiezdindIq7Q5TJ7H/YgV6,iv:0/bsV0yV46UFE8pTEjcAy++xaIdx814ieeoIUX9Tkf0=,tag:GmEd6PXkCXdFwLW7Gqps4w==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1gmnfmze2teqtaquxczjahvfltzzlrgcza5w4cej64tw0qzke5ftqh8c9ry",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1L2FMaC9mQ0pjVm1RVHZQ\nMGpCSVMzejd5QWI2bXFBZjA4N2drSWxoTnpNClkvWkdLNGZoTEpoaE5ObXBybWc0\nSDJyU1hDbjl4UG85N3ZQZ2Z5eEpnSnMKLS0tIGt0SkpPNHUyb1JHbFgwemd1WS9Y\nT1VkcnhXaVF1UjlxVlQvMGs1TUFZbzgKWFijEp/zCdTnl+93p4tA7dI53nipne5r\n1MlYFKqNBUB4xpvfN7QhM+ewJh51zyrDvc5spb9UBZ2M/ERiQVoeSA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzNEh4eEQyNFl0eVlic2ln\nQjB4MDlXNk5JYzl3QzRZUWllM2VwaWR1ZUJrCklCaU05NndkWmxqbG54Syt0cElJ\nbUpZUm1pT2ZtdTFZTDI5ZGdKWWVSVzAKLS0tIE9MNm84SmpMaWFOSUxrOGp6NnpU\neDVjNFhGMEtOT0Y1MG8zRDFuNDdQcjgKzbkKVXlAlKNetQ78klG79uhxotVvgDx5\nCoWR0C/Bp8O3n32O6oyo2DBtqwQLEmCoyfA/AdEvakeoiGbMRGQxnQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBeE1NdVhT\nUGM0Wnl3YmZIa2ZwOXlJT3ZuM3VrR3phQ1NNTzJFTUljRDVWago1eUFUMjJMSjFz\nNGlXQXF2U3dvTTAzejFWNS9mV2ttc3NsM0NlbmZrNjFFCi0tLSB3Nm14amdEMkVw\nU0piN2trdXFJczF3UWdjeHRJdzhkcldpTEhwVmNqdzRRCk7g+UBSNNMZq7S52OeE\nphMuKfImYz+/2abNfmMMP+HF4rtdf3dDfxQ4Zu5R71cfR4o73XEP+XI2gaI8D52/\nzQk=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBL0JUNnBD\nSEVwK2s5ODBuUmdoOENYdDZqVmtmMEpHTmRiOFhNQktmTkc4NAo2RkFYNUQvbmtm\nOXlJSElsT015NVM3K0h6c21VVE9TRU5LVWVlUmpuWjMwCi0tLSB5WWF6ZWkrd3d3\ncVV1cWdUaENyZ1R3OWgyNkFIaXBNUnhsdHNESU1rOWRnCh4ktCYZ7Rhrnjg9BRnA\nEvTW46TRq2AlKm4yP3D0UDZxVGdkS4CQ8xRRiEzw6zCMFw5UcxemWrWjhDYqOyBH\n5X0=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-16T18:46:44Z",
+		"mac": "ENC[AES256_GCM,data:LZ+DdLiMllVZ5qlo0kuIEzfYY0PeLWw+hym8gBvZQQHQ7Zw3pYF1qzOlBIYFCdheIgMFDWtX7YM3jIp2PUAeyiulBcvXlMYqhJaG0DWIOJH6gkEmhz3x+4/5ZIZqf697BJ+Ix4aPrK/5BTUy2LGO2YZlHCq5Uc+gnHkwmPaybdc=,iv:eEDeqNxv318N0dchnZOzEzkZ9Wu7HgY1Etho//7C95Y=,tag:YmKCZvFhFrOGERUbOxln6A==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/vars/per-machine/renoir/openssh/ssh.id_ed25519/users/rpqt
+++ b/vars/per-machine/renoir/openssh/ssh.id_ed25519/users/rpqt
@ -0,0 +1 @@
+../../../../../../sops/users/rpqt
--- a/vars/per-machine/renoir/state-version/version/value
+++ b/vars/per-machine/renoir/state-version/version/value
@ -0,0 +1 @@
+26.05
--- a/vars/per-machine/renoir/syncthing/api/machines/renoir
+++ b/vars/per-machine/renoir/syncthing/api/machines/renoir
@ -0,0 +1 @@
+../../../../../../sops/machines/renoir
--- a/vars/per-machine/renoir/syncthing/api/secret
+++ b/vars/per-machine/renoir/syncthing/api/secret
@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:ivXMIc1qHH1ZesW6d8Fz473rpm10nGJfn2EWqtbgnE0g,iv:HWqCmnX3o7AfkdMzpJiAe0eFgUH5hu6blRRNCv6psTU=,tag:6azLEHUTA2H8aEqwxJvggg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1gmnfmze2teqtaquxczjahvfltzzlrgcza5w4cej64tw0qzke5ftqh8c9ry",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUcXpWZmFtUHhVdmZ2b0po\naXVPbktKQ3hyVmY5M1FWcEMrVThzRERrV0QwCjZDd2szWEtFN0UzTGl1eUhoRkZa\nRWFmUjhSdytYM2lxNDVvcFQzaTJvZU0KLS0tIE90bjBac09ncldMZ25NTTFNb1JL\ncE9kNSs2eFFLVE1heFgwc1grMnIxV1kKj74Szsgma8jbdwypbFLYc3haMATggYBr\nfWKHS1pQ9XcxqWS8lWdCyFYeUUTP2MTpaVjENlNvkZYEcC6Wk7pPgg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjUzdmbXhORDJHU0MzM29L\ndWFlbit3a3YzUi9nTzZRZEgvUVpmcnJUQ3k4CjB5cERUSVdsVE5oZCsxOHFZamIr\nTzUycVFodXU5UE9jWW40UDNWK1A3R1kKLS0tIDlwQXlpK2w4Q1k1OURMQ2JmdDUx\naFNQL3ZrZTJibTFNMlBMcEFxV1RSaGMKZUZIqLAI9bWq4qrXT1LBmcu6cv/eIaDs\nSrhpd5GDVd321/bduoI5UdrYPL70EGLiiTl9U2XhjQ70KFqB1kqAeA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBanJhdjJY\nSnNmYXVCdDRhQkV4dkF1RVpjSEZzOCtwYk5FMkx5SW16MDl0awo2N1lRVXdvRkRX\ndkxXQjY2SE13MEdLNDBrdWlKblE2RHBwUUVDSDRmb3BzCi0tLSBDbHE3NUU4WEFR\nYjAxdmo1KzZoVnVtejRQN3dKV2xTK3NudC9hUWFRRW5FCj7Ww4QM+3AE8qzSvrRC\ntJxYNwT7AhIJetoZdabt8WufjRlZkAsX+j/fZdMEIR4T3Ercy6oIqsteWz4DIh0u\nCaA=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBL25tams4\nLy90UFBMV0dxanczdGFKNHdxV0VmNDRyUjRsdTBhQjFDMlpDOApMQ00vUVYxaWJz\ndm4yWFZ5dU9NUmRVdmVFNnV6dDBsejcyS29ZdE52bTNFCi0tLSBaem41a0dVZm83\nQ3ovMHA1eDRpOE5xOCtLdUZoeXpSV0ljZGFDSlY5VGdjClf3ZjxX26To5lfhSVBW\nnrpfIl66SmCGeggSX/c2Ky20wvRcP2yJBCl+YP14EfYFVpNFgDSSnpSyIX7ORuD3\ndGE=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-16T22:20:44Z",
+		"mac": "ENC[AES256_GCM,data:yDaUGkW+BAgQUjlqSJ6MhhK5XWGxLPLO9cDHrBipklnMV/zT+w+rBcfi3DyEj7Pa7Jz4QSPjYeJ4ZQbpnthZqSO8pd1mq045ZOjLCvLKuZtfcPwJJqDAiQZlUYO+PEAcUaE4oHky5Gt+XBZPaQcgMHlk1/idO4A7Jljs93Lb6Y0=,iv:V7jT3wYIn1NPF903Iz1IlNZS9y8Wz1UJnsye+YO+Ii8=,tag:WEtqSTXWGp59eAdjKgxM5Q==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/vars/per-machine/renoir/syncthing/api/users/rpqt
+++ b/vars/per-machine/renoir/syncthing/api/users/rpqt
@ -0,0 +1 @@
+../../../../../../sops/users/rpqt
--- a/vars/per-machine/renoir/syncthing/cert/machines/renoir
+++ b/vars/per-machine/renoir/syncthing/cert/machines/renoir
@ -0,0 +1 @@
+../../../../../../sops/machines/renoir
--- a/vars/per-machine/renoir/syncthing/cert/secret
+++ b/vars/per-machine/renoir/syncthing/cert/secret
@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:eOUk/tMSMhE0fcJCLWY0MmHmqcDkK8H/8KwqgDqiwvF/FM8MADKbEcZWkuVdgrHhi6emjNfiK/ZRB7c2WWZ3olwzfa9crRTxGHjx5xBntRcsZzrTcehDDGrDzJQF15FLLKCekSatuFSIRC5YvMA5Mk4aN7E7v8hYxLMWDi7D3xUjIp5Kz2M9NriBUmalkbe9leiKAI7YKYR8wFtiDKTbboQNHrUzg1YoPu2d5TQHeA/Qin1t540fqhQs17wg+5qTe8qjWbrfddewbn5nVsu8lUorKVSxEDdg+ioDaSAiEHDT52Ryh5mpZNxThaE4TM4p0eu8jwgqtl4Ru+GVt9vOOxXRq4LVeerPAWv2YVLeqfdYLLyQ3cvtxVRYKgZaSkD5mHjOB/9Xh+6oLN121CtLAm/4x0+7moVKB4bcuLVSzTXG2/vrI9S8cy3G32uhojEQ+cbogy+/bYIR+ZgQNjd+kCoc/Y9Ho8M9Id05ajrLq1kwW/CrpCLqJQcosqueriyapzPXM3M9VwDL8scdbnpzQegRAQYCrEflsnvHMjV7ki1a/yKFnAIixQog9lWjlA2Ncc+bwuye4KCYH1i3Ajo368YzRZhmcthIeKqDkDqz/7CrZ4TR0CAGMe5GJM4KgLdHQ5z9Utg2uppzz6yGRNe53iBeOH88dQ2Q2GRfARrCuvCRXPXC9tXYVyp1GAOMKSXQh1Q+p9yZsdEGmmh5os2risT+YwaULDU2V1lCubjEkwVSlc85N45jDiv8mQ2UZ6zNz8VDW8Jgd4o8O84fqZowAJxjx3Hc3IyuCYP5mrxpUsKeCg+u5Pfickf/hmHcRKM=,iv:flnbuW1IaqiUrEsl598aZRgYROqvLH0pCKAkj452KSg=,tag:iYOSRqlLo7/WxOzO1ww3rw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1gmnfmze2teqtaquxczjahvfltzzlrgcza5w4cej64tw0qzke5ftqh8c9ry",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmWS9qT1JSS245aEEyeVpo\nRGhadzZpL1pXeXl1emlzNUtKeTlZMXpCWm5vClNuVlRvVjVWeGhweU91QUFpQWxH\nZHlNKzV1ZzREc0Z1SmxGeWdnaTYzWEUKLS0tIGl3QXUxZTVod2ZoNWVBS2N6VzF0\nMWZGUnBHd2Q0VUJNalZVd2NpZ0llYkUKpZlKEIYfX7vI0EHRqOC0KGXtLQ8CkVZa\nVAH4W3WcugY331Ez1KeX4ut09kcIXS2D9a0wlYWtSjffXBql+QXWaQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKZnRjQmJCbHpVZDlkbExG\nSVRxNm1KMVZ6azREcmJTNHVzNUZ0dGd6ejNjCk16a2hRa0UzWXZNQWFKc24zR21p\nelhFU3pNL00zOXA1VUhDMXJmbXNTbWsKLS0tIHE2V1BBM2RoSkgzbjlaWlV4eUNy\naGU4enUzUEcvVnRLRCtQYzJrL3FjWXMKD+yYXh+ea+UubFOLSmmFg84gglb994oP\nB7+fKndkdxDsj1CUIzRPXqMmsvJ6vc2suIgS82BrvV+4ksWXjsiplw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBNkNYU002\nNm9JaUNJbE9jbkxoUlVCbXlzSm1Wdi9OZVVGNk53dHoxUm9XRQphMkxjWEFzMnBx\nZklWMyt0Z05LcHZrSk9MVEZXV29ZekxBL0UwdThQbktZCi0tLSBETUF4cGRHSkd1\na2x5Yy9DWklPb2ptdHFWUW9JUHk5cXpTZDg4c0pLSWRZCv3rOafvIJe23YlLZr+M\n/pvkQeculyyQnRf8uOgE0RXTPm7fF0jBrndxTzxg4lDnixQZYYKEtpTGlfz93dPi\nsPA=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBc1VGeEoz\nanoxOWl2K3lvcDZHN053K0NqdWRBeWZFazVXaEFOVTZWM3ptTgp3TlR5S1FSVkoy\nRDQwa2wxME9mSGlIK2d2K2xyQXJ0aGh1ODFISXBISlJvCi0tLSAxbFBiWlRHaCtq\nTjlzNnlLd3BxMVEwd3ppTGNibXNDZnY0UjRueCtVcUxRCldL6/yxBhrny0NlAZIp\nxxZq8cfyu77m2scF3GwcchPu7WogsBBkF4HQ/Bif47uEbQrPLVu0mq4WujynuEDH\n09s=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-16T22:20:44Z",
+		"mac": "ENC[AES256_GCM,data:YFw5AdLDQzL9YteVyYHJqqBw9VkWHNmDZi3yHouG5hXQ9iCKx9BtnhAao/EmRlsqBiFHpu3+g+CigMhWmDiK9kg5ef8ZbP0wjzyEmLhyDli5y9LzsIrK0wG4NEroa3KjTlxaXrRzSAGoYrmUN5RGI0ML1lFM9vON4GlE9oWnASw=,iv:wsmmzNxF4+1heeWZt9DUB6MwQfeWSHkRCrl6/frenok=,tag:p170m6myCZKoijwFRjsnMQ==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/vars/per-machine/renoir/syncthing/cert/users/rpqt
+++ b/vars/per-machine/renoir/syncthing/cert/users/rpqt
@ -0,0 +1 @@
+../../../../../../sops/users/rpqt
--- a/vars/per-machine/renoir/syncthing/id/value
+++ b/vars/per-machine/renoir/syncthing/id/value
@ -0,0 +1 @@
+NNNTVFT-YT5CTFG-OHWWZHV-UB4UXXI-UCX55RO-QRI7XUE-5SJ35WJ-CABBZQB
--- a/vars/per-machine/renoir/syncthing/key/machines/renoir
+++ b/vars/per-machine/renoir/syncthing/key/machines/renoir
@ -0,0 +1 @@
+../../../../../../sops/machines/renoir
--- a/vars/per-machine/renoir/syncthing/key/secret
+++ b/vars/per-machine/renoir/syncthing/key/secret
@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:fAXC0Z0yLV5gcQQd65EDPmulL8AYdQar9jxoD0HToxpvn1ZK/XwrEexZ2VhSO/yj0PRc/MGQ26n22z/wZj/FY6WeDyiWnpg4/h61a4pRHGZn5W4AFUtytzS10cqDqgGB0NMzRjmU0URoKadNFfEcHeqguMjR7AQ=,iv:TwxK5MBSkSmEP/Oho7dTcppwLku1oc/XNyRCsEz19mo=,tag:C6nTvUL0KsMj3XNqWmzf4A==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1gmnfmze2teqtaquxczjahvfltzzlrgcza5w4cej64tw0qzke5ftqh8c9ry",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVbFkyYXBkeXowZVNWempH\nNkI5OHduWExlTW0wMzBnMWVicXhyOURBeWl3Ck4xd1BqekVGMnpnS0dVZ0luNlM0\nUFZBUTgvRVhmZi8zL0dmckRrOGhQc2sKLS0tIEQrNURNR2NaTFUrWHBiTmFGRVBo\nZnJkTnB2cVBoa2ZFRlVXWnp4eityemMKbRzK0f1bNRT6egY8hcQeiAa/meqUvGUp\nSjMX3WsyV8/D2gnNV6v8tOuzyMm/iij5aUhPb59yw6afJfc6sPlYRA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCWlNxRHVmbnFscVQwd3Vt\ncDlxN1E1ZjdhaTJiN1AzZTRTMWE0ZVk3UTFjCnhBNjRwMzJLcnVMYTRrZnFuYnA3\nUDRWVVN0aXNReDErOUxPLzRIS25hWjQKLS0tIGxDYUJjbG9mNXhjbTJVMnFrajVz\ndGFhUVpYaTBWV1V1MkU4NzZSSi9mZFUKDyt6lvxHHwGbCQ0dd7xvM/2+orJLJd9z\nIxvA3w9spcCD7Vw5I+NhQiYArMutFR1v3lu6TOJbewLTs1XVNOPcPw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBcTVoWFVq\nMTZUM2ZpeklYWVYwTnJaRHBsOSthWlV5cmw2U3hkNnVjekZ3SwpWWHM2TjZxakxF\nR0VoYzV0aUtBTW0ydVAxdGN0cmlOQ1Bsalo5Rk04aWlJCi0tLSA2TFNLZitOVWNT\nTlNqaGtpdVlMdSsyVHd3WXU5MGtpcmQ0Wmp6UU1qK2V3CsYterPbcabIeo8hnuPb\nfP395l7lAtRjXwzssW8cGqd9jJSaPblbvuNeUFwy2YijEQONzkMpfDMZPncoAWe7\nW2I=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBMWxCclpB\nZ2xjcUhDaHQ3VEZMSFc3MHY1Z2I2U1Z2QXRONVdONWxOMzA4agptNlYrUkV6TUF3\nU1JSelg3Q3N6ZllSVUpmSzBic05YcERUMmpSeWg5TXljCi0tLSBWTjQ0ZUl6eWFU\nZVlFdFh0QmVYdGkwWlhVTXc0dEtUbFFnTzlMWHl1TWNBCloL9NmMP2ZVSzn1+lTk\n/VMIagH2lU114j/G23FdWPD/+WGidZ+Tt1uVi9VC39RABS3xCOH94Bc2NgFVTdLN\nvl0=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-16T22:20:44Z",
+		"mac": "ENC[AES256_GCM,data:t+5rLPDbhPsUDpIEfM80N8gmbd0P1h10fb1LpgoiqEP81lshZPfBqFEf9v+QtOoaEh9kS36npssjzE22o2UzlwaaVIlCb3cN+rg17xhWGW559ZsCpo9RnflsSFcG9r9agawKYlPe4jT7DW0KLkBhspqdnIw5KJSUP59LIFIoa/M=,iv:F2Y1kHyWzdwjwdge5CniOY4FbzCOKVsAg107pBySwz0=,tag:y5ts4RT/GKG5DMipoqGBRw==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/vars/per-machine/renoir/syncthing/key/users/rpqt
+++ b/vars/per-machine/renoir/syncthing/key/users/rpqt
@ -0,0 +1 @@
+../../../../../../sops/users/rpqt
--- a/vars/per-machine/renoir/user-password-rpqt/user-password-hash/machines/renoir
+++ b/vars/per-machine/renoir/user-password-rpqt/user-password-hash/machines/renoir
@ -0,0 +1 @@
+../../../../../../sops/machines/renoir
--- a/vars/per-machine/renoir/user-password-rpqt/user-password-hash/secret
+++ b/vars/per-machine/renoir/user-password-rpqt/user-password-hash/secret
@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:z7wqrwYlMa+Jo23FyyQHlXnYacQDWc/H98HfPkCfI7R6kkUvLJ7lNoyU5T86NWhj8EHMeh4sBwUcEgYOJJkcHJUqBlbqedsvPd6GH2Q/5YE+wtPpLd4+etiA97krHODGOoqgvV6yR/L3rg==,iv:LAgV99hzbutqhlLcdxwDdsO8qDvOo3DT8yRyxhq/yxY=,tag:ZrFx4vW2HHfMX9gBDTDDaw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1gmnfmze2teqtaquxczjahvfltzzlrgcza5w4cej64tw0qzke5ftqh8c9ry",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTWTNQbFUxeXJaKzd6UjhR\nVTVrSFZKSWIrVHNDck0zdnlFTDUvandDYkNnCnlHeCtzMTIrZWJHVXcvMkgrck5T\nQWRUbDNUQVlmYTRFRTlqa0VlNFArU00KLS0tIExzRHFZWGFkeFprY2lHU21ySXla\nd1N2QVo3akxqMFdaeDJBU0h2SW45U2sKHHVT52np5tIANfpOTm4F0SZwo6dFt+Go\ngYetXzFYDAeFuPhUnnm5z2Uki437hzj/gW/a5Sn+/O0nXHvJP7LUyA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXMkNzWWJTcHZIUElRczZw\nT1Y3MWIxeHF4MUVvZzVxVmdoS0dHVHdPb2hzClovQXhibFdwRFpJYlp3S1dNRlM1\nM2l4Z1lmbGZ0Y2YxV0VVZGs2ellRZ2sKLS0tIHJ2cE1rdjRYelJIcWtwZmpFR0lr\nbjFNOGcycXRqTnJ2MVJkZ3RvdFlMNzAKBw7YEO/tNzRV0C8Qno7ko6E1MzcbgI27\n2EMQi/t0Vhat0ZSxaCEEmw2oofvxZEhckQ4nX7WT67HC3oNlv+Muog==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBZ295bGQz\nemVhSDcwRWVTbGxBOW1URDlQMmc3NlFjTHFEczkwR3BtZEJBVwpXd2VIdFgrWEdY\nVlVqR2t0QjNFU2drVGFMZjFTeHMyNlF5NkZhMHdHZTJnCi0tLSBHMEIzWWlPVExa\nVkhFL3RGU1d3clBJMWkrSG4rYnpXNUxINmZ0a0M1dnRnCkQlaqW+8ToJU8e8OxWE\n9YdpDusObRGwT0FldAcZbMlOm79F8XnF2v/xOdktHlnCuISDNqIYkQ3C/Xks4HmF\ns9I=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBemh6ZTlJ\nMzF2VUJlYmIzVGhjUzlYbHI3QlhRbkRYWnhBS2RhTlEzaFVHawovZmVQVlI4T1Y4\na0lTT25qK1hSME9kMTZSYnNET2M3bXBHK2U5TkVuSTk4Ci0tLSBIc0NmZnBMWG5S\ndEtpWDEvalNkN0YxcVhEN01qOUwxcEVTVGdsNUNTRUZBClWqtyXIuTu/KZGkDQrX\nm9Ym6GCdeH+TqDuHcp1ajD6m0CRdQSUvKywVLLMyhrjgksduPfG0hktwWwa8o2TX\ns70=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-16T19:15:09Z",
+		"mac": "ENC[AES256_GCM,data:z4lvok21e/bjLFbJPT7iHKevLWttERpbBGPn913PRbZsbAGMF2UQYj3VI1nkpwlbkvSBuauwyHEETBmBYM8ceIOKDObPuanDz8v2KHl6jVTgkwNPKFQdOv7UvZZnWedRQ6a+ali8C7tUnECv/dZRNkTeZmH6OCuDDv017xd1Xfc=,iv:y7cpM3xFoi8zf6qY9IG66k/D990lLDo9UOHMP0gChx0=,tag:TN9kHQv3fjanIStxvtnsUQ==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/vars/per-machine/renoir/user-password-rpqt/user-password-hash/users/rpqt
+++ b/vars/per-machine/renoir/user-password-rpqt/user-password-hash/users/rpqt
@ -0,0 +1 @@
+../../../../../../sops/users/rpqt
--- a/vars/per-machine/renoir/user-password-rpqt/user-password/secret
+++ b/vars/per-machine/renoir/user-password-rpqt/user-password/secret
@ -0,0 +1,22 @@
+{
+	"data": "ENC[AES256_GCM,data:MqS3xDSh7OfKC0TY,iv:UOq4AUwyFvUNANcPYRxOpLJMcue232vlV8nsIcYDfiw=,tag:gKJwwX9yq0rAGaqAoTJVNA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByL0VxN2ovaGJZZFhwRCtX\nNThvRnBrNzhHOEtlM2hPMzRHUVVNM21iQ21JCm1wU2x3bkJCcTVHdHRsaU16aTJx\ndE5ERUg2dHFYUU9sOWZTSkp6SlFSclEKLS0tIFc4ZnBVYk55dkNPWGRSQ0w5K0Vj\nOWdaT1BPUlp4YXN5YTdFbUI2OHROUWMKHK1BULN87G5R5kjYWX31T58m4eEsjtmv\nxEbjSfCGHgB5RcDFA1eAC+LgxErghnUSKb3jmSMDnyrj50MPe03vJQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBeU93RWU1\nUW1EL01sTURla1A0RTcreDlka1cvbzBoQTBRMkJIaXZSSlhHTwpjKzNUTitxK2dJ\nalJSRDlKNmlxQVg2d2FDM2xBc1hWS1piM2gzWG1PTk5BCi0tLSBIYzRnWWVTbmZR\nSXMvMVEzVTY1TUxRbXp2d3pZRXZGZ1A3NU8xQnpQZnljCrzbA3ePuvk8uMRloSJH\n8F0QlChxZk8N/I2P1vfm7MyxcDj6Twco584+/hLURY4NRqhA61IyblZZ7lqWKHTa\nnd0=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBOUtwVGVV\nZXNTaGQzZ253QndsenRwc2FqM2JNeUs3S0c4VDM1MGErMFR0LwpVZEhoMVUvWmpV\ncVBPRCt3WEFUKzdzWm9PWGMyVWhvZGhqcHpZYVcyYnBrCi0tLSBnaThDWUtWYWxr\nTVVuRzlzYjVhVWN0VGxnYVFTNVczdVVHZkhLeTVUUy84ChplHk/s2dVv5ryza0It\n6ichUZ9D2ZBSBJT82N7QXWt/s2tawKpVyUvZUR7VyKmJJlMJQ1axQTHwYcopmQ4K\nDl4=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-16T19:15:09Z",
+		"mac": "ENC[AES256_GCM,data:zTmwcEegUqN+4LpLcv4OoxYkI8cJDhMeOhxcsuwaOKIGn7lon/WXQZiUZsruGJ6SERtnyoQZSmv1fMjfpx6z0Ab1SE6zUQ/mkz/cxaxdNS13om6lk4ob+8SmsMnu9UcjiDeccd02TmE16XLdL/ZXRsdBoEJRSI1vhiujzprwG4A=,iv:xD7iHvEmPwBNB76XmeLoSHaiSuhOla/3lK0ZujG2mlY=,tag:1WxoVUXsBzDbUNTBdtbiuw==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/vars/per-machine/renoir/user-password-rpqt/user-password/users/rpqt
+++ b/vars/per-machine/renoir/user-password-rpqt/user-password/users/rpqt
@ -0,0 +1 @@
+../../../../../../sops/users/rpqt
--- a/vars/per-machine/renoir/wireguard-keys-wireguard/privatekey/machines/renoir
+++ b/vars/per-machine/renoir/wireguard-keys-wireguard/privatekey/machines/renoir
@ -0,0 +1 @@
+../../../../../../sops/machines/renoir
--- a/vars/per-machine/renoir/wireguard-keys-wireguard/privatekey/secret
+++ b/vars/per-machine/renoir/wireguard-keys-wireguard/privatekey/secret
@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:5xxG9z2IqvES5ZZMvlOBVAQNJZ3nUVR4UPM7IWYs01Fe9nFbzf2oAwner0wh,iv:VUZp5z4tEek6P0qzfn+HXEcTpBugdnoHXYhuI9kJ1+A=,tag:nHF9uZniVM4Dv7HgQwI+BA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1gmnfmze2teqtaquxczjahvfltzzlrgcza5w4cej64tw0qzke5ftqh8c9ry",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCTFVmZ3BDNHZNQ29QZ2Yy\nY200cnJvWFp0ZjFSS1NYeWtKVERObWFlRkZZCnhhdTRtdGFVMExOYmhGNVBrL2FE\nY043RkpqZ1kwYngzbXJ1UlJNSEM0NmsKLS0tIEVadmkrdjloTWZvczA3amZVeVV0\nanZQV205S0E2RVBTVVU2OVVVMUVEUmcKTlHnqc/X4hyep12kQ1C5iyyrjd1vS4Y9\nv+HGAQqXfNJK/AHd+W2Qy7Z5ouojbgWD7A7BItrllBlxTQXupm+AtA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJTmljeER1Y2k2eVFQbTE4\nRHpPTVNnd0cxeEw1bWNOaVFJNWNuZXI2UnljCk1RVFMvQXh0SHNEU1ZGS2Iyck9i\nY1RGL040R2pUV25RZHFXMnFIUmc5Q0kKLS0tIExkdkxIYlQyQnJKL05NaVhyUTlN\nYWlud3hCU0xXVlhBcEpyRTgyYytHQlEKzGXJpcLhs4tAUg+p4pfgf+TaX1kccYuh\nSyiLCmrrWTFuavZOtz1j63s4/YiE09F8ppNuW3p7xSDta7DTi9EuSA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBNVRuZ2tt\nTEdyb3hJbnEzNk9TK0k1VHRHd3RwcFlla0QwY293dFNnMDV5QgpueWdDemNpZ2tX\nei9tNGZ3ZWdveXgwd3ZXMUtYQk5kZFl3c1lUWHRucGFvCi0tLSBodTlseXoyeWZQ\ndTd5UUNud0paWnROd2Jac0lqaDhmSU5jRVlJa3FkN3VvCq2ziqZj5xNoQJgP+E+O\nbOZdC+x3EgEaPX9wOJvq5zsQDNA4ILtR/AkVb4ojjkt6coax8KxdxwQaXEOs52K5\neMs=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBajY2ZnpX\nMkJoalVzS21QNGZUaFE5aGVkOWVTSGk2bDlRbkJDaGxkWGpYMgpQVVg5dFhRZTYv\nOG5JZms1OHBrSDNuQWlyc1c3VU9ycTdSMEJJV0FzdVcwCi0tLSBUa1dTTG9nZGhJ\nN1FRY3h4SUpzSkxZSDRQTDVMQ2dJRzdBWkRXUEYzdDVFCrMQxeJTtrtm17Z0CLkb\n+u73ATkVSVg7sgD31lDhM4eMOBaZ1l0iZ1C7kl+zUEFmuztEc80fPfd01gCLeqO3\ns4s=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-17T21:59:38Z",
+		"mac": "ENC[AES256_GCM,data:UX7hpeVANgQwpH1HNDx5hy94uSrQqn2GragjneojOz1LRmgVATnM4Sn3p5cmhImAAKaR3c+XezhOZBQXQVwZwVEZySy/wEn9yjol2eOnEYmIhNfx+5BjiXjakEKDlLmkwIsltNpQTBcfQ8B6OTsYSQQ0cIWWIVNXEyW872EFUVE=,iv:INBAZZLRknDkLJns1qyg4YkznrzWJerlMXHPT4nmH60=,tag:Ekp6yaDUNwt8N2UfEhlglA==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/vars/per-machine/renoir/wireguard-keys-wireguard/privatekey/users/rpqt
+++ b/vars/per-machine/renoir/wireguard-keys-wireguard/privatekey/users/rpqt
@ -0,0 +1 @@
+../../../../../../sops/users/rpqt
--- a/vars/per-machine/renoir/wireguard-keys-wireguard/publickey/value
+++ b/vars/per-machine/renoir/wireguard-keys-wireguard/publickey/value
@ -0,0 +1 @@
+1gJfzmvIItHRSOZKUVR6CH7W0L9bR8GMXfqDaQyOAgs=
--- a/vars/per-machine/renoir/wireguard-network-wireguard/.validation-hash
+++ b/vars/per-machine/renoir/wireguard-network-wireguard/.validation-hash
@ -0,0 +1 @@
+877c7548e6f75a4e214c45f21b7dc96f81171318d7ef4620bbdeaf11861644eb
--- a/vars/per-machine/renoir/wireguard-network-wireguard/suffix/value
+++ b/vars/per-machine/renoir/wireguard-network-wireguard/suffix/value
@ -0,0 +1 @@
+5c40:b48e:84d6:bceb
--- a/vars/per-machine/renoir/yggdrasil/address/value
+++ b/vars/per-machine/renoir/yggdrasil/address/value
@ -0,0 +1 @@
+205:8a34:1a76:f16c:964c:36e:7240:630f
--- a/vars/per-machine/renoir/yggdrasil/privateKey/machines/renoir
+++ b/vars/per-machine/renoir/yggdrasil/privateKey/machines/renoir
@ -0,0 +1 @@
+../../../../../../sops/machines/renoir
--- a/vars/per-machine/renoir/yggdrasil/privateKey/secret
+++ b/vars/per-machine/renoir/yggdrasil/privateKey/secret
@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:P2Fkv6A3YAS3QQABBtPO0qyg7OTPOVV7yzh00+utxGVPj+Ldtx0bZ9CeA9bYUdyx6KZBlSz7XYLv5lhAVPRPidnr8n1fp9zSzVUgm33Zz/VBG92bZOCDoXaE44f5Loph1FnFOA32dxae5MhOmZlmonGDGBA6faM=,iv:5mDSIXbJnUdUImxmjwlb8T8JrogUc4EFxWAlRkRdNlM=,tag:WQrFp5/W7MEWNbyXjqgEdA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1gmnfmze2teqtaquxczjahvfltzzlrgcza5w4cej64tw0qzke5ftqh8c9ry",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArM3UvWDdESE9BMGtlWXJa\nZXNIWXk2bjNSZ3A0d3YwMHVpS3ZXWWtGM3hZClpCdnVic3dOcHZGenZLbE1VbkVO\nWlZtcG43ZUJ6a0JIZWVqOHd4ZUNrakkKLS0tIHp1Q01TamgrcHZMTmFqOCtNS2dx\nVUY0N2tmMDdpWXo2T2pSWlkvZTYwN2cKaeTwZu0y5wNNF3eFiFhSDEVNjK9Eo/GE\nSXSZEoocLJ7uR1zDtW6f64N9xf+9oiwRA923H2lP2hqLcQ2V4OqgfA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBobzZUQnZSdnBQYkh4RDRX\nTTA3ZkJpQjNoY3l4cDc3TW8yeGpSWTZpRWtnCno5Zi9ZWVJVUlVqZ0orQlp6M0pm\nQ2JBUFAxeUpsaWtNN2c1WEo0aTJpUlkKLS0tIFNpTmM5b0oxblBQSEhKZWNFVyt2\nU3RTTWNiQ0xnVGx6cmdKak5kQlowSVUKdIuS4gbPYY5IsZgkiNu+vOBczNZ73BfY\nyBsX+98j/VBZDjPqf2Cvib+6lKvvJa47lUupw3N7vqG9t7M4oT+l6Q==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBeVdZYzJ1\nanVsMGFNZTZUYklkSmFoZnF6NzVJYUpFSVZ5UVFoTHV0NDVOTAorMWkyQm11OFhK\nV0JTN2NBTGt5eEU5K0FIVkJMY3Ftb09rNHkrYzM5bWdNCi0tLSAxK0xrWVhnTWsz\nNjJvWERTUiswQ2dSNG12aFZmVGh2KysvS1lxTm8rNm9JClUDga5+09XrxbEbC/Hp\nBbmmHJ5wionkAHp/iq44uP0bOvwCc83c0XLWbD5YFvTyXmGmM86+kPWahXvPJ5gm\nQ7k=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBeG5VWXB0\nbjhPd2hRT1B0cnhsZ1NMUEVpazI0dlF6M0RMRUFWNTR5VDNsNApUZFJpOG96OVdM\nTnloVDNpbzRTdkVUK1F6RDhHU2k0Q0cyYTFDcXd1MVZjCi0tLSBwM2xlTUI0WTYw\nTCtmVHVXWmZkU25UNUxNZjVSSHY3VmVMZ3lRbnlKS0cwCrigytnImmaTOctFSrTH\n+54xj2VJdE3t/dUs/VVXlRvYohSM46aKLhLMWINU0d9U+l3OrGN7IgBxz/B305GZ\naos=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-16T18:46:44Z",
+		"mac": "ENC[AES256_GCM,data:xz6bnEvQIxxhXcts4LjVT/KLJM9fZ+AqT52Gj9slXAsUC1UuRptqDijMHMYpy4Osz6Ae4Ov7Wv/OT+bmpuLnamhZVg5Y7EdsgqnAJlSd0NgI+cZNg9cjAovsOz5TF51jRMhOJfrmlwTxVmQOzFxWgklWG4sst4MgaW0x8wLw/58=,iv:j+T73ZiQyyDwkHZ2ROZa7kesW0wcz4rr4Nc2JEJ0FmM=,tag:m/BdA4C1a49GJpF1DQ9dRQ==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/vars/per-machine/renoir/yggdrasil/privateKey/users/rpqt
+++ b/vars/per-machine/renoir/yggdrasil/privateKey/users/rpqt
@ -0,0 +1 @@
+../../../../../../sops/users/rpqt
--- a/vars/per-machine/renoir/yggdrasil/publicKey/value
+++ b/vars/per-machine/renoir/yggdrasil/publicKey/value
@ -0,0 +1 @@
+05d72f96243a4da6cff24636fe73c0a852fe8fcfe14b3fcf14379ca65df4e317
--- a/vars/per-machine/renoir/zerotier/zerotier-identity-secret/machines/renoir
+++ b/vars/per-machine/renoir/zerotier/zerotier-identity-secret/machines/renoir
@ -0,0 +1 @@
+../../../../../../sops/machines/renoir
--- a/vars/per-machine/renoir/zerotier/zerotier-identity-secret/secret
+++ b/vars/per-machine/renoir/zerotier/zerotier-identity-secret/secret
@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:PheHswuH5xD9jzvepWIJg6iahEJi45IuLltBfFYvBe61Rog1jBgCDxiLHaK7w62xSKe+L6/9YH/iT0pnU8PfXt/w9gATsFmYSKhAhY7S5NjCb2cCv8qmDfxz87jplBEBe+BeaijjBJfKXzsUdIvOTOud15n2m3NES8A0t92FUG+VeP/tsYr6RcKCnZ1JKwmieMwcCyZSlykV3FQbGoWqkZIrJTUeOOE218K+Ms6RJ2llteinJWNPpzClR6bBfSCblF4dBmAUTNl5cuPm8MOUw5OrCKK/eIJhbBgUNjpqRD8IXx+eOzqKpyvqsogXf8D0Q97UFX6ZrhnDrkOfXM1Af4uARozR4ogBi+Dq8OyO,iv:FZjxuaZtlgLS+QUkDOlnRUzfcE8AOrAvJy6XIvNP450=,tag:D1USKcJC7FHe2iTtvNyJPw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1gmnfmze2teqtaquxczjahvfltzzlrgcza5w4cej64tw0qzke5ftqh8c9ry",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrL244Y1lJeXhxNC9DNTkw\nUGdEUUJPZW55WXhiM0U3QVpRNm5zVGZGVEVVCnA1NFNXRkJKUzlXMlJWWHpFY25P\nZG5YTTJYQWJXa1Z5U2J5c21FSEpDZW8KLS0tIFZRaEJ1dm5QeWQ3WE5nS3ZxNFB4\nOVN1R210d3dIdnkxSHpCNWhxYjZHa0kKBRncHSx8Sh3CusZpul4Fn9VLPBf904Kl\nTyg1ijhlNiJkNydRUhHiSWxUnGk294+8p31q0bwYi977JjmzlZdfPg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0bzRxbzR6VHZPRkNNeFlG\nb3NITVBEL0pXSHVtcDNJVUhJYVBFTmpObEdJCk5nK3JaUjl4TVZGNklIcEFvU0p0\nZUwvbUZjcWZpTXM2eHlyNnVibjJkRlUKLS0tIG13YnJ3SkVCZXRFMTZFZSs2dXZF\ndjl0VVZCUzZOOXY5M21YWUQ3WHN4NlEKB8MZYUhUrXGJs1F9bQGnygLWJSj11w8O\nZYmzw5v4OCYBnWmZbN3bHGAAj12PbZ/W5J9qvqy1zTFpcSxVrrqOlQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBNERBUU5D\nM1d2Q3QvMFF2ZUJFY1gwbk53TnpzUXJncldMd2ZrUnovMlVseQpyUjltK28vMk0w\nOCtpQmp4UlhiNjNHSWVFSEMwc0FtVkFTYkw4djNGeExZCi0tLSA0WUVnUjBzUFNn\nbTZUTTlFdnFTbFMyajBncG42b2lkQVVCMSsxOEwyNThzCji0L1eLbG/XspIJVC2r\nmXqeErQjZJd9xcdG5Yz28HvUKpwgGFfXEuEf52a7caVscIQJ0r01RNNrFaT3pQBg\nKaI=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBOXMzd1Z5\nKzVGMmVuUmtOU0NhemE5Qkw1TlF0akg4ZU5KRC9MWlVMc1ZIcApadC9Wb1FQcFIy\nYi9XbjJ3SXk2NVgzT2Z5UExXUGZMN1gyY3JvTDV5L3Y0Ci0tLSBLK3JMRmMwWXpW\nbHhGZDRQT2VJTGhUU1ZCejRRd0VlWWZZdjBNYzJyWVVrCvLlQ0U6blW/ZWNznqiF\nT7TetjjvAeyc0eqMw/BxJKqUHMphJ8t9iWK37AJ5WY1bxP2pMKEIOM8LkFSsgW5Y\n5V4=\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-16T18:46:45Z",
+		"mac": "ENC[AES256_GCM,data:oFp1dYycDLL+zW6tZEZF7mYtfLNhtcXcHUAUDISI3lw0pyOB5Q8Ghnoed3SD7VDHgOQ7QeM4ooqNvyO5N2aztHKygSEM4WK8iYWo6bIULcTcvs6JPbTsIBL8yENko8tQ2D/jvj+y8R9cvXcvo6BJgwO6mt6L/vGZezEO8ZvIy3c=,iv:/ljVG7j4KtH9PZ4x0Ogl9bY2CvHcfEHd7rC77WpvXkY=,tag:b1it5iDgN2TMCBBfAC+9aw==,type:str]",
+		"version": "3.12.1"
+	}
+}
--- a/vars/per-machine/renoir/zerotier/zerotier-identity-secret/users/rpqt
+++ b/vars/per-machine/renoir/zerotier/zerotier-identity-secret/users/rpqt
@ -0,0 +1 @@
+../../../../../../sops/users/rpqt
--- a/vars/per-machine/renoir/zerotier/zerotier-ip/value
+++ b/vars/per-machine/renoir/zerotier/zerotier-ip/value
@ -0,0 +1 @@
+fd80:150d:17cc:2ae:6999:93c5:696d:839
--- a/vars/shared/garage-shared/rpc_secret/machines/renoir
+++ b/vars/shared/garage-shared/rpc_secret/machines/renoir
@ -0,0 +1 @@
+../../../../../sops/machines/renoir
--- a/vars/shared/garage-shared/rpc_secret/secret
+++ b/vars/shared/garage-shared/rpc_secret/secret
@ -3,32 +3,36 @@
 	"sops": {
 		"age": [
 			{
-				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBeTZmMjE0ME9mZU1UTXNu\nNFdtbFFZT2YwODJtTkwrUlRzNDNZTWdQVFNNCkZ3YWpLWmxJMXRnNmkyYnIzU1Jv\nc2dyRUZSblM5b1hFazlUMVZmU1BpVUEKLS0tIDRKTTJPeFJiOGtjQjRuQ0xqd2lE\nNkFBblRKT1dPR3FmbmVlWVlVWkFyUGcKloraZGC3O2nMPx/4Zoy8yqGZiSP4ocyM\nsxWW6IYOrvKL6P6cP5OXV3fnHTQ2jjbeurrWNDJ+V4YMIVI1ZkEqig==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxUXBhMjBydHBQamdkaEt6\nWVo1L1FJSHgvWnVSL29KV2x2anlZMEw4ZEI4Ci9oV0xXSHhvdnk4N2sya1VScldX\ndFA5dGJyaWl1dmJqUnpKSGlXRDZRSlEKLS0tIHEvMW9OcU50RnFoVDNtdEdEM3cr\nRkpEV3VMSEJZRjd5OEJXUkRHQ1Z1SXMKYcTmR7MqQEQuvmE0/MUN2q7DZ2gpV1a+\nc9YVYzJoAPVK092ztVkeu4OAEz61t6Be6CD+yiMDGFAnWd0wSMl+4Q==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBL2p0cTVj\nOUxvb2ttREpka0ExQmxYRHczVi9RWElJemFOMWJFQ2tVQkR3cQpmdjdXM3o1NFZa\nVkZ4Ukgra3FQNjV3Yk16d0ZXb0lMdXdrRTV2OXo3T0pjCi0tLSByK2ZiTS9SV2JM\neTM5VE1jRVhPTUpwTnhBMU4xU1k2MWVHdE5iTVA2N0JNCi9wVqdMPBoo/RTrgWAt\nfBnxtMedy5+uSWjX6KV0OiydeOERCawIkaZPx9KWFoPQc74SCw1PQv4IeG5gk0ge\na6k=\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age10lf2vjmlkff25qyft9d3c0274gvkxsf255fw0ea60cuqc7703ajqu3yxx9",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1cGRaRGtqL1pIUldkRjdZ\nSTVSalJXcU11bW4ycGV6S0JTK2pweFVSVVVnCnE0NWc3ZTA1VkoyZnZVMzV1WUtp\na0gzS0tQY3IyNExVc3dzamJxSDRDMW8KLS0tIElMUCtJMkR2RnRoQjZDbjBIaVhH\ndURlcHlrempCS3BFREE0azcvVjNzMWsKnK5xD1HRV3CK1Bib6K3DDLQuOTebsOKI\nwHIrrw8P5EYN/OYTLjer3juiMmfBoD/bt5gAlj35ZORF/6Cg75DAkQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1yubikey1qwnawsag6k3lq7aklc92uq72vqx3r68ylg0x8fphn0qm8d7e00eq5ynu3wk",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBZ24vZXZl\nSDM0Sk1HeUh5V2VoZjhyekZ5alg0MlFsNXAvT1FlbUhya3JFNQpjZHZXSTVSZXlH\nUlF1RGdNSWFNSlV4V2phcnBrWENEQWxnSk5kTEVocERRCi0tLSBTZGhVZVA4bW5M\nZlpzYzZPMzQyQytpM0RRcldJcTJrUmwzVWZzSkxjTTFNCmTG9lZ5yzS0k11DV672\nbBb+wMpqsSgq05ObCs7EVcnYDLMOQ6L2yMJ8UH7V/tUiT0+kAq36Wfc2O0CafXYW\n+yY=\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IDJlWGZKZyBBZzFIQXlO\nN0xSMkdGL3EwL0toNmZnalBZbkhHYVJtT3FES2ZFR2JjYU1qdgpQUTgzLzAwM2ZN\nenBiSHhtakNnalFONWpLc1lYYVByVUhpWG5IMmVYRjRZCi0tLSBEeE9lUDFvRUZJ\ncHdocnVBL2tkaXlNUGVRVk5JejRYTnR3Y2dRZC9meGE4CoS/S3WuE+tK0oVOxozk\nxunz3alNRGwg+6d3fbn51LOJZVWwtx2Z/k6ciBpmTgk8/nL2W6h4zBgHeSlFgvpS\nrGg=\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1gmnfmze2teqtaquxczjahvfltzzlrgcza5w4cej64tw0qzke5ftqh8c9ry",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxU1dUdzB0RFJEZ29zajRh\nSGFRcEh3elhIMStzekMwR21IWTl1UEZ4YnhjCisySmVkbGFFMElXaEhndmdvU3F4\nTlZGV1dObU52YUh3TmZOT0JJTUdReDQKLS0tIHZXK0hnaWZxRGUycEs5Tk5zaEpT\ndmJJNk9JUTZPMkRFNFBFc01OZ2Nqa28KGBSBqgwhNRm0MgZmUBa6ruD0tteFVw/v\nS+LNvUHq+xPRaEiA4m+P8xZyujp3+yZwVagLVQOdfR2wZpU3A4Bq7Q==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1teege0n8gf9qcheuxtpy7cltf8aczt9ugh8ztp9v4fftn3wwd4jsz0lpeh",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwbmJZSGllbUNiellkWGlO\nQ2VINUZYQnoycnRYZDVnMmxxaW5EdHJqTlc0Ck84ZjVKRnp2cG9HSkRnWnpWZmRX\nUXhtVmF0bWp0WmVVdXBEU0s5ZmtIbk0KLS0tIE5sOW1ES3V5T2JCUmhKcnBQNFB2\nL3g5L015NFk1T0p3U0xTZWRNRVNlNzAKo1V3RVUwP9wCRCbFeOYEE5gAoWglUmAW\nLSUWSJSLU6L/BwHfp1iakKof9Y9sKdYsVWjelftLGEJp6QbkohjQbA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2eng5cEVOR2lHbzdmd0Rs\nTW5HVktMZTZmT3NmWG9OamY3VnBVNXhIQW1zCkQ1TkJPWTVHMUt0TzNTaFd5SnhV\nNVloN2FTVmdlTjFMRnFIUHRtVm9qZVkKLS0tIGVkekt5RFFxQWtiVTBid0N3eHhU\nOC9ZcDk1bzA5V3lVQkdrTVIrWHBwbUkKoS/dHx0SEZXcw6/R6B+zZQ7Pmj2ZsZ5w\nIbPq3xPNsRgaCK3NqZmEzZQyLTeSd5IndS/dxqXsRjUs9qqKVgxQQQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1h0vx6w4d89amt90j3u0vm96gvjt9lwczsjamaakyew524x9u8a8qu5qvg5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtOE90L3BUZFBsQ1hoemdx\nYTFTdTVmRUJFSVU1R0pZTmNQOGxGTmtsTFFzClhHYi9iN1BvSmc0aGpnNHczYUdS\nKzRYbGMrRWQvaWpyR001YTV1MEErOW8KLS0tIFR4M21SZGNucDN4N1Y0K3RERzJZ\nQ3E2MENzUWxwOVpDUnlzMko0bWRvVVEKoaMGCVivMJHUZriTgCkSDEaeCh45BcHG\nb5jgClScpwqqq/P5Smr+SL+OgaX28ibG+kPRSp0yIfOdfsd/ox6kPA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzbTY4U0J0OFo1ZHJoMUk4\nc2ZSbGhTQnQvYllvM0tuSEttaFB5eEJIVEJrClo1TE5EY3RrU2QrV3B6YXl1WFl6\nV0tsc1JSVEwzd2J2QSt3TTIvamZ1K0UKLS0tIDJNK2htU2dGcGd4SjZkMlBUWXBT\nbXFTemtsKzlCSWVINjNNTFBhallWL2sKUqfCB4Xlu/64zzSgAVtlTq6Ren+d8ZCI\nDN5Vj25szYj6ReHp7tRuje0GXxkZwhnyBUzwEu15njMOelc1ANoJQg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1yubikey1qd2d7qpxlw9lj9l573f34vdkrazdq6yk4mvnlug46m979dl6p2p5xlzr0wt",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHU2Nm1JdyBBNUljejNF\nT3Q2MWFnSjJaYTBqUnRSbHYzd3dGTXl0eXdWblZKRzUwV3k5UApodEQvWUNSVmZv\nU3pGV1l1bEt4RmE4MjZYaldsbkJuN1BDK2Q4L3VneE5vCi0tLSB3UEVDME5mRjNy\nRXREZjQ4SXA4RmIyVTRTdjFVcGJPeHlXUWlrL0FVLzd3CrjYM0JBwGNj4dKcNY69\ntcmwZSsv5cneGOKmUX+f0IKYnp57kjxWRB0wCzxUfCUqLeyyssKuiAcHieqQTnlT\nH18=\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1xkp0rmm5xwxurdxq3a0lxc77pjh5z4dylddvnf6ktrghyfhcxq4sdk3ysn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6OTVuUlphY2FiVHlpbGp6\nQlFiRWczTEkxUVcvb2V2R1E1TUFZM0pYSnhjCitaL2VSa04veU5vN0o0RWNneDdu\nNmIwMk4ycDJkSXIzV0xwaElPbEZhb1EKLS0tIDltVWErU2t1U0FoVHlhSW9DRFg1\nYmFRM0NWQlpNeGxjTzJHYXN3dzNZeUEKs/Jsj6iDHGIDHYN57MUYaYG5oKHFU6ZY\nug4YR9rOh889PF4xq3w51wJJiSEnQKfVrtNTaj67gxBXXC/EHI7fOQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1mqnmzn203hyj200psc982ehcedjmcdz8s0ncc50fm9jszjx7rgmqqmppw5",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsZUN4ekNyMjdRNW10ZUVU\nSDZOcVVraStneVl3eEJCVzdhWWIrQ0phRXlVCk5Ob2NwRHhqWnJtQ3RFUXlvRjgx\nanpuL25ST2Zva0JQVlJ5Z1FEbHo5QzgKLS0tIGJSV3pYcVU1WXcwUmdqa3dYam1M\nalpmbUVqSkZabXpCM25JZGp3cnRxWHcKNCXjj8zvR+cqXq2XkEsYkMSI+b1NLwh6\n1pkRibsoyhQwzC0vkMdYQV4Kt9SzheFqKTuNhthW9J5I0Jf4R9lR6A==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzYmhNVXhRbUVrYzNJS1Mz\nNHpRdGdQdm1WZUc0Z2tmREMrWEYrcys0TDJjCkUydHBVZkpObkF3OXd6RGZkSEZC\nS203VEZoaVl6RjBheFA5K0NEblVNcVEKLS0tIFVIMXJJb2h0OEVjVENiTTBhRm1R\nTGoyQ2xEZUw5TFhoYWI4K2xwL1RvTm8KIyaO1QZ35ozTFzUKDYv56qel4Vt7bk10\nXVV2TI8lDOdhtr5L8ezaiU3zRM4DyLdvIKpf0yU1jY4j9xUEn6EJQg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
 		"lastmodified": "2025-06-19T21:51:53Z",
Author	SHA1	Message	Date
Romain Paquet	d97f4bf439	direnv: watch devShell	2026-03-26 20:29:10 +01:00
Romain Paquet	c714045d71	Add renoir to secret vars/shared/garage-shared/rpc_secret	2026-03-26 20:29:10 +01:00
Romain Paquet	bbd7050be4	Update vars via generator garage (machine: renoir)	2026-03-26 20:29:10 +01:00
Romain Paquet	d5415bc699	clan: add renoir to yggdrasil	2026-03-26 20:29:10 +01:00
Romain Paquet	a755545a02	ssh: add renoir host alias	2026-03-26 20:29:10 +01:00
Romain Paquet	6b0cc09fa9	machines/renoir: change disko layout Remove impermanence since it takes too much time to configure	2026-03-26 20:29:10 +01:00
Romain Paquet	c394bd7d5e	modules/steam: allow unfree	2026-03-26 20:29:10 +01:00
Romain Paquet	22eea1eb49	machines/renoir: add syncthing tag	2026-03-26 20:29:10 +01:00
Romain Paquet	47b7210d31	update flake inputs	2026-03-26 20:29:10 +01:00
Romain Paquet	082dcd0d78	syncthing: expand home path This avoids confusion when changing the service user	2026-03-26 20:29:10 +01:00
Romain Paquet	905e88f6a7	clan: add rpqt user on renoir and crocus	2026-03-26 20:29:10 +01:00
Romain Paquet	9a69fc644d	Update vars via generator firefox-syncserver (machine: renoir)	2026-03-26 20:29:10 +01:00
Romain Paquet	6511bd6c97	Update vars via generator cert-firefox-sync (machine: renoir)	2026-03-26 20:29:10 +01:00
Romain Paquet	d07a4fd008	Update vars via generator wireguard-network-wireguard (machine: renoir)	2026-03-26 20:29:10 +01:00
Romain Paquet	039188a831	Update vars via generator wireguard-keys-wireguard (machine: renoir)	2026-03-26 20:29:10 +01:00
Romain Paquet	cd41f5f5df	Update vars via generator cert-assistant (machine: renoir)	2026-03-26 20:29:10 +01:00
Romain Paquet	f5981aca74	Update vars via generator syncthing (machine: renoir)	2026-03-26 20:29:10 +01:00
Romain Paquet	42d67e615d	update(inventory.json): Installed renoir	2026-03-26 20:29:10 +01:00
Romain Paquet	cb7611b991	machines/renoir/facter.json: update hardware configuration	2026-03-26 20:29:10 +01:00
Romain Paquet	31b6562cf3	Update vars via generator atuin (machine: renoir)	2026-03-26 20:29:10 +01:00
Romain Paquet	529ef124d9	Update vars via generator user-password-rpqt (machine: renoir)	2026-03-26 20:29:10 +01:00
Romain Paquet	cfc94557de	update(inventory.json): Installed renoir	2026-03-26 20:29:10 +01:00
Romain Paquet	343f4608f0	Set disk schema of machine: renoir to btrfs-single-disk-subvolumes-impermanance-rollback	2026-03-26 20:29:10 +01:00
Romain Paquet	d095b0b242	update(inventory.json): Installed renoir	2026-03-26 20:29:10 +01:00
Romain Paquet	ed7018374f	machines/renoir/facter.json: update hardware configuration	2026-03-26 20:29:10 +01:00
Romain Paquet	faf71cd11e	Update vars via generator openssh-cert (machine: renoir)	2026-03-26 20:29:10 +01:00
Romain Paquet	ca194ac765	Update vars via generator zerotier (machine: renoir)	2026-03-26 20:29:10 +01:00
Romain Paquet	0487c8c2fb	Update vars via generator yggdrasil (machine: renoir)	2026-03-26 20:29:10 +01:00
Romain Paquet	5f522f4109	Update vars via generator state-version (machine: renoir)	2026-03-26 20:29:10 +01:00
Romain Paquet	4ad516a8c9	Update vars via generator openssh (machine: renoir)	2026-03-26 20:29:10 +01:00
Romain Paquet	f4cf9616de	Add machine renoir to secrets	2026-03-26 20:29:10 +01:00
Romain Paquet	93a8132131	Update secret renoir-age.key	2026-03-26 20:29:10 +01:00
Romain Paquet	dc374c1e05	Add machine renoir	2026-03-26 20:29:10 +01:00
Romain Paquet	35c013ddf3	git: add git root alias	2026-03-25 14:25:30 +01:00
Romain Paquet	e5ecd337d9	fish: load starship if available	2026-03-25 10:17:50 +01:00
Romain Paquet	b6a398d649	fish: move host configs to per-host dir Also alias ls to eza if available and define XDG_CONFIG_HOME	2026-03-24 14:59:01 +01:00
Romain Paquet	d078b78b69	bash: add bash/config.sh	2026-03-23 17:07:34 +01:00
Romain Paquet	0ccb3dd5a7	change oc bin path	2026-03-18 15:21:08 +01:00
Romain Paquet	b33232fd9f	sh: add openchip paths	2026-03-18 14:57:47 +01:00
Romain Paquet	5a247abdc4	bash: add hooks	2026-03-18 14:37:09 +01:00
Romain Paquet	4d8ce1eac1	zsh: use HOSTNAME instead of HOST	2026-03-18 14:28:59 +01:00
Romain Paquet	f0d2836151	sh: simplify hx alias	2026-03-18 14:28:59 +01:00
Romain Paquet	3c55cbf688	add fish config	2026-03-18 14:28:59 +01:00
				`@ -0,0 +1 @@`
				`21b09ca83ff0587ef5e692e4fbf3044874acf70d3fecb1d8a7f95fce087a7eb0`
				`@ -0,0 +1 @@`
				`ea48c7119cad4b0ca21b441ce74f52770d53f0fb9d14bce8df3631027d3dd7bf`
				`@ -0,0 +1 @@`
				`4295ec657818b294358ee0021867817c4a60a3e25c8a077588843fd660c02cf5`
				`@ -0,0 +1 @@`
				ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIFB+HXa0RWl7tARwv+k4WIgcdPkfcTIf0ml4uAKpyFtQAAAAICswF5i+oApyYl4CwHBRrlYEvLr5Oql8vgw9d35uZHyeAAAAAAAAAAAAAAACAAAABnJlbm9pcgAAAA4AAAAKcmVub2lyLnZhbAAAAAAAAAAA//////////8AAAAAAAAAAAAAAAAAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIGE7R12pfvRSXsS8MwMkp57fuc+N2wc4VcXAYwo/eJJ7AAAAUwAAAAtzc2gtZWQyNTUxOQAAAEDEegGj5Q1Rnwu09aFiYAyDD+1kvrw5XKtOSpaX+t1QaJNL2sLZXjk7JOzK5QuHpyHhbyJdSbiOhzH8el4vgOQB /tmp/vars-nyhu7vev/in/openssh/ssh.id_ed25519.pub
				`@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICswF5i+oApyYl4CwHBRrlYEvLr5Oql8vgw9d35uZHye`
				`@ -0,0 +1 @@`
				`NNNTVFT-YT5CTFG-OHWWZHV-UB4UXXI-UCX55RO-QRI7XUE-5SJ35WJ-CABBZQB`
				`@ -0,0 +1 @@`
				`1gJfzmvIItHRSOZKUVR6CH7W0L9bR8GMXfqDaQyOAgs=`
				`@ -0,0 +1 @@`
				`877c7548e6f75a4e214c45f21b7dc96f81171318d7ef4620bbdeaf11861644eb`
				`@ -0,0 +1 @@`
				`05d72f96243a4da6cff24636fe73c0a852fe8fcfe14b3fcf14379ca65df4e317`