Kickstart Ranni

2025-05-12 22:31:34 +01:00
parent dd5d771387
commit fb2370516e
18 changed files with 196 additions and 163 deletions
--- a/flake.nix
+++ b/flake.nix
@@ -159,7 +159,7 @@
      ranni = hostSystem {
        hostname = "ranni";
        headless = false;
-        np = nixpkgs-stable;
+        np = nixpkgs;
      };
    };
    homeConfigurations = {
--- a/hosts/ranni/configuration.nix
+++ b/hosts/ranni/configuration.nix
@@ -10,7 +10,7 @@
  }: {
    name = "${service}.${baseUrl}";
    value = {
-      listenAddresses = ["100.91.249.54"];
+      listenAddresses = ["100.76.159.53"];
      extraConfig = ''
        tls {
        	dns porkbun {
@@ -144,51 +144,102 @@ in {
    guiAddress = "localhost:8387";
  };

+  services = {
+    jellyfin.enable = true;
+    jellyfin.group = "media";
+  };
+
  users.groups."media".name = "media";

-  # age.secrets = {
-  #   caddy_porkbun_api_env.file = ../../secrets/caddy_porkbun_api_env.age;
-  # };
+  age.secrets = {
+    caddy_porkbun_api_env.file = ../../secrets/caddy_porkbun_api_env.age;
+    danflix_hetzner_storage_box_pub_key.file = ../../secrets/danflix_hetzner_storage_box_pub_key.age;
+    danflix_rclone_config.file = ../../secrets/danflix_rclone_config.age;
+  };

-  # services.sabnzbd = {
-  #   enable = true;
-  #   group = "media";
-  # };
+  services.sabnzbd = {
+    enable = true;
+    group = "media";
+  };

-  # services.radarr = {
-  #   enable = true;
-  #   group = "media";
-  # };
+  containers.radarr = {
+    autoStart = true;
+    bindMounts = {
+      "/data" = {
+        hostPath = "/var/media";
+        mountPoint = "/var/media";
+        isReadOnly = false;
+      };
+    };
+    config = {config, pkgs, lib, ...}: {
+      services.radarr = {
+        enable = true;
+        user = "root";
+        group = "root";
+      };
+      system.stateVersion = "24.11";
+    };
+  };

-  # services.caddy = {
-  #   enable = true;
-  #   enableReload = false;
-  #   environmentFile = config.age.secrets.caddy_porkbun_api_env.path;
-  #   package = pkgs.caddy.withPlugins {
-  #     plugins = ["github.com/caddy-dns/porkbun@v0.2.1"];
-  #     hash = "sha256-X8QbRc2ahW1B5niV8i3sbfpe1OPYoaQ4LwbfeaWvfjg=";
-  #   };
-  #   logFormat = "level INFO";
-  #   virtualHosts =
-  #     (mkVHosts "broccoli.town" [
-  #       {
-  #         service = "radarr";
-  #         port = 7878;
-  #       }
-  #       {
-  #         service = "sonarr";
-  #         port = 8989;
-  #       }
-  #       {
-  #         service = "sab";
-  #         port = 8085;
-  #       }
+  containers.sonarr = {
+    autoStart = true;
+    bindMounts = {
+      "/data" = {
+        hostPath = "/var/media";
+        mountPoint = "/var/media";
+        isReadOnly = false;
+      };
+    };
+    config = {config, pkgs, lib, ...}: {
+      services.sonarr = {
+        enable = true;
+        user = "root";
+        group = "root";
+      };
+      system.stateVersion = "24.11";
+    };
+  };
+
+  services.prowlarr = {
+    enable = true;
+  };
+
+  services.caddy = {
+    enable = true;
+    enableReload = false;
+    environmentFile = config.age.secrets.caddy_porkbun_api_env.path;
+    package = pkgs.caddy.withPlugins {
+      plugins = ["github.com/caddy-dns/porkbun@v0.2.1"];
+      hash = "sha256-X8QbRc2ahW1B5niV8i3sbfpe1OPYoaQ4LwbfeaWvfjg=";
+    };
+    logFormat = "level INFO";
+    virtualHosts =
+      (mkVHosts "broccoli.town" [
+        {
+          service = "radarr";
+          port = 7878;
+        }
+        {
+          service = "sonarr";
+          port = 8989;
+        }
+        {
+          service = "sab";
+          port = 8085;
+        }
  #       {
  #         service = "transmission";
  #         port = 9091;
  #       }
-  #     ])
-  #     // {
+      ])
+        // {
+        "http://ranni:8085" = {
+          listenAddresses = ["100.76.159.53"];
+
+          extraConfig = ''
+            reverse_proxy localhost:8085
+          '';
+        };
  #       "danielpatterson.dev" = {
  #         extraConfig = ''
  #           header {
@@ -199,49 +250,19 @@ in {
  #           file_server
  #         '';
  #       };
-  #       "movies.danielpatterson.dev" = {
-  #         extraConfig = ''
-  #           reverse_proxy localhost:8096
-  #         '';
-  #       };
+        "movies.danielpatterson.dev" = {
+          extraConfig = ''
+            reverse_proxy localhost:8096
+          '';
+        };
  #       "git.broccoli.town" = {
  #         extraConfig = ''
  #           reverse_proxy localhost:3030
  #         '';
  #       };
-  #     };
-  # };
+      };
+  };

-  # containers.radarr = {
-  #   autoStart = false;
-  #   bindMounts = {
-  #     "/data" = {
-  #       hostPath = "/var/media";
-  #       mountPoint = "/data";
-  #       isReadOnly = false;
-  #     };
-  #   };
-  #   forwardPorts = [
-  #     {
-  #       containerPort = 7878;
-  #       hostPort = 7979;
-  #     }
-  #   ];
-  #   config = {config, pkgs, lib, ...}: {
-  #     services.radarr = {
-  #       enable = true;
-  #     };
-  #   };
-  # };
-
-  # services.sonarr = {
-  #   enable = true;
-  #   group = "media";
-  # };
-
-  # services.prowlarr = {
-  #   enable = true;
-  # };

  environment.systemPackages = with pkgs; [
    helix
--- a/hosts/ranni/hardware-configuration.nix
+++ b/hosts/ranni/hardware-configuration.nix
@@ -32,6 +32,11 @@
    fsType = "zfs";
  };

+  fileSystems."/var/media" = {
+    device = "root_pool/media";
+    fsType = "zfs";
+  };
+
  fileSystems."/boot/efi" = {
    device = "/dev/disk/by-uuid/555A-CAFA";
    fsType = "vfat";
--- a/secrets/age_identity.age
+++ b/secrets/age_identity.age
--- a/secrets/bigding_backup_repo_password.age
+++ b/secrets/bigding_backup_repo_password.age
--- a/secrets/bigding_backup_s3_creds.age
+++ b/secrets/bigding_backup_s3_creds.age
--- a/secrets/caddy_porkbun_api_env.age
+++ b/secrets/caddy_porkbun_api_env.age
@@ -1,18 +1,20 @@
 age-encryption.org/v1
-> ssh-ed25519 eYYv1Q NMOzu06cEoaiI0jPATOvxKgOPcJr0oFSZexR2blP70Y
-VAIUgLH8nk9ZR0U34ubW3SOBs+y5Al4hn8VZ/VpLOy8
-> ssh-ed25519 Bp5IaA 3e7/QtdPlWrfWdk8aIUDN+HPUtUSKGw84OzEwZTMnls
-LYCfI6XHlttfDprfFPmftRnRo2WPWoVz3o8rLNZKLbc
-> ssh-ed25519 T/DpgA mbBHrL4D2HEnNIE6/QqTBm16xUCWbKZWvL5Mv3J0xAk
-/JIcU0ZlIE3arzPr5QzwMjnjfG1lMqSsPwT6K1f3uiw
-> ssh-ed25519 qMgRFg DdJYH7prTsNycymQyCCC5BU6i4iLRgtbfAO2p7Ojxj8
-boo9aenQcqfr9NpRq1UGbWgaOo9th57OXcjz6i9GlXs
-> ssh-ed25519 dMZXNw s1K0+I4vxiAyA/T1uOttZJu57GNlw/06SWlN4k8p6Hc
-Oiv/Ob6aZV2vS+tD8dlW6PqxPZ3lJUsvYCfDHL6BmWs
-> ssh-ed25519 +shbwg kJxVGJ6VXQ5TiCsrS/vmPVcAk2B9ClEdGq7DIyjhpQA
-sFN2Otg+IPCdk8MT6FSkiD/1zwLXTA/z/VqZ28l7sU0
-> ssh-ed25519 70Nt2Q NmQ/EgBs+a1nmZnlOjW3nf+L5kQR4++HUXROTzFX+AA
-iOdjmEttvuKdhAT6d1lFIDX2tQMzKn7XQ7Os8674H5w
--- w/mG7pqkQygCcPnQbETg/eIw0RxN473GMSM4Cd0DvKE
-{LCS<43><53>L<0E>a<EFBFBD>O-Xe<58>I)@<40>QM<51><4D>l^<5E><><EFBFBD><EFBFBD>v~<7E>?<3F>X(#sHRs<52><73><EFBFBD><06><>#h<><68>0<17>2<EFBFBD>@<40><>52<35>]th<74>K<EFBFBD>tu<74><75><EFBFBD><EFBFBD><EFBFBD>$<03><><EFBFBD>_<EFBFBD>8<EFBFBD><38>p<EFBFBD>]V&_<08>KwQ2VL]r<><72><11>|<7C><><EFBFBD><16>M<EFBFBD>A?[%<25><03><><EFBFBD><EFBFBD>3<EFBFBD>Ē<><C492><EFBFBD>qqR4<52>v<EFBFBD>:
-<EFBFBD>|P<><06>e<EFBFBD><65>Tg<54><67><EFBFBD><EFBFBD><EFBFBD>h<EFBFBD><68><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>pL$hoU<6F><55><EFBFBD><EFBFBD><EFBFBD>'w)<29>MC<4D><43>ީ<EFBFBD><DEA9><EFBFBD>
+-> ssh-ed25519 eYYv1Q rVsIPgVhjo10brWN1BFiPhsVUkqLpADs/RwAC/0e0XA
+hwy4T5yFEaNrNE/WaKhH2jFmi6KHQv+HPcVE+LGQIqI
+-> ssh-ed25519 Bp5IaA oXZMzYEYfilr0XJhpv6KEn7tloF0wiiTEREX1X9301E
+L3VdyOmNy18+7xdnT8+6ZpEKDoYd9ftdfY0OEfuyoG4
+-> ssh-ed25519 T/DpgA /uBVSvdvYl3Wx+Rn1RcSPXRm9we9x4xhwYz1zjh7320
+RBePasGticMa83tR3BB+e6L/ijp68ojimpgDHHWlRHA
+-> ssh-ed25519 qMgRFg 3gYoMffkqyTfK+Uevars9zcrnZu1Wrxm1IcuS5MiiUQ
+DuA3AHbhU8l7GtiNKIBszZcDXuE0V5SsmhM4YDn89Ho
+-> ssh-ed25519 dMZXNw 4QxPt7cyXOFYzfD3NNu0s762Q8fUq3xnSMFlFLIuW20
+Mt+/Qp5aHmBmCpS7XY1YA/sPmkG4278GQFykkS5zytc
+-> ssh-ed25519 +shbwg RiP0/XkFjX5+QkEKnIIvimnpzUGfhDtJsIhrZOvDKXY
+FwFKPr1SphnnbGbT7/X4Ocn6E9zt+ciZ1IQIimRq4fs
+-> ssh-ed25519 70Nt2Q PeLAFhxpQAQDWHjT19VX6sxLB+wo72irpNSw5irwjCk
+CGtAKDuFMlH1+Apbd+Wj1XZ/ZHQvZs4TeOFE6cTmaqA
+-> ssh-ed25519 YAvvLw DC2byXFwxj5lcvcgIQCU/k7bPaCYYwjXxsFXMRUNswU
+2BuZpjyJalXYkouut/8iyW+E8K7sK1x2e2Q5oJs6mvE
+--- X/NOW1Ukj+Aqs8CB9FzbXXEXNyCHooaXkuaihgfJ5b8
+hv8<EFBFBD><1B>!*I<>Gԋ<47>|<7C>c<EFBFBD><63>5<EFBFBD><35>@<40>7x<37><78>OJ<4F>S<EFBFBD>d`<60><>o
+<EFBFBD><EFBFBD>\Y욞<59><EC9A9E><EFBFBD>`Y<>BN<42>8J[b!4*Ϝ<>~;<02><><EFBFBD><EFBFBD>;<3B><15><><17>o<0F><>Ӳ<EFBFBD>Hù<>"<22><>x<EFBFBD>h<EFBFBD>q&W<>><3E><><EFBFBD>p2<01>)<29><>W<EFBFBD><<3C><0F>u<EFBFBD><0F>i<EFBFBD><69><EFBFBD>V<EFBFBD>IA<49>I){<7B><18>*\<5C><><EFBFBD>g<EFBFBD>H<EFBFBD>o@<40>}<7D><>¶<EFBFBD>ψ<EFBFBD><CF88>Ow<><77>	<09><>?<3F>qgN<67>o<EFBFBD><6F>5tu1H9<48><39>Zh<5A>^.<2E>0<EFBFBD>^H
--- a/secrets/danflix_env_file.age
+++ b/secrets/danflix_env_file.age
@@ -1,17 +1,21 @@
 age-encryption.org/v1
-> ssh-ed25519 eYYv1Q zcDqD7TbDvxFmCVzmhKjxBe0TEZknhb0vAm+kI5FTSs
-iH4cuAKpAQD1pqFd4+MuL1gF6yvabwWp5qJ8zWbJw/c
-> ssh-ed25519 Bp5IaA +HjCMq3kdvyDfWJymoYyMVpdHBNrPtBskdGSQouv9XM
-4FOaZn7IQWMNhit/L48USatJrI959QHQ081NWsVDhvw
-> ssh-ed25519 T/DpgA cqEx80rncRu44EcMz8BDF5i17Ht8fKgUB+Kf8yn2gzY
-IaOG5bXIan6N+EFEVXFISXY+Qz4fzXp2qK0M5ZQ9KNs
-> ssh-ed25519 qMgRFg meXlkC1ZJJk+WHecLsHl4Cl3ra+rE4h58Vl/x9v+kkA
-0TauiqMGIHxC3jmFXlz4dIkHAtXkuiyM+uohh2piz8c
-> ssh-ed25519 dMZXNw /3de9iqLGlXnkQzsIfJ0aKyxU/c7PzhJKL6SO+AQsDM
-bl3bKPwfDNzwVAoKi5rtyFDFti1XOIMob4CblKenlCg
-> ssh-ed25519 +shbwg BQY8lsOtSXDQaOWi97pIx+0ifkoeZy+PZQJ/JfyBLjw
-lNwbVucIxywE28bYug5LD4CvkxWhfFMkf3pVHYK6nb8
-> ssh-ed25519 70Nt2Q /Ri8E22dkPFrXMwf5GKCqZeR1jy4iYlbo8kY3Xym53M
-CH+5RNvz9yoOrfFWBl+vL6ulYC/BQ+UsEh+Z9HoyoQE
--- ZSIbZYcBWn47aKRY8hNMJQ+6wItLL7YmggEVZ4CQimo
-<EFBFBD>f <20>5i|<7C><><EFBFBD>:<3A>:E7`p̻<70>X<EFBFBD>n<EFBFBD><6E>A<EFBFBD>ΠeΏ;<3B>	k<><6B>4<EFBFBD><07><><EFBFBD>Nwn_<6E>$<24><>U<EFBFBD><55>6<EFBFBD><36><EFBFBD>k<EFBFBD><6B>ɣY<C9A3>+<>r5H*<2A><>w<>L"pJ<70><4A><07>e.<2E>y5<K<>(B?<03><>t<EFBFBD>۸<EFBFBD>p<>°]s(<01><>	<09><1A><>
+-> ssh-ed25519 eYYv1Q /FJ1oyRr1NdpjRjDkCt9EqlhnlNfHk4Nr3Q+3ZzfzHs
+kttnif9pfO0B1KJAR9+PN71l6ASHE0cUgdgGOV5sg+I
+-> ssh-ed25519 Bp5IaA pWSfR3AvezhCV1OawRgL/7GaqPfHAQqdca/0feUDtmE
+XrBA8V6HGVYTVhYIMEjSeUqt6xo1Eheu0i9gsGvPmzA
+-> ssh-ed25519 T/DpgA JoY5P9O3gIUI+5ZzKFGb/3pBaU3VoIZMzj/N7Y52Slc
+MxiT2J8zQuxt0Bi47s4Azn/VjBA0jwl7GNmLNciPLqw
+-> ssh-ed25519 qMgRFg hiiefMaeC3Lull8BNmQS8LOW133yh+bZF5Ul8lJD12g
+VB+LvQ3u773EnICwHTwnbz6t3QRiXUeqZ80ORpyYxl8
+-> ssh-ed25519 dMZXNw 7hecbrFkb1pEX7nfSc2waSVVjXWjBq1WRYlriXBiw3Q
+uYX/yp5BFsvnSZvFrg7++TF2orhkIfeyY3P9anyW3tY
+-> ssh-ed25519 +shbwg k6+8YGkOEf8vsva95dLcCcWcoHz61bc3govBmbr8aSw
+HUip2uMG7NabSiNbepZlQud+5CZuZDRjYa/WXr0UR9o
+-> ssh-ed25519 70Nt2Q Yf7AMUayjTROhs3kehSNH24pfvP+q2Ckym8nPOiYPVA
+2dDJCiAK6D+SayP08IObBGzBNxp4lG34nGHOZdeQ9Dc
+-> ssh-ed25519 YAvvLw XFtl1w6vh4G2pZWxwsGYRtDtH1tKLiRbRkf8MlpBlWA
+Iv6dy3675mX4TPtVt4rHC3X2WuplLu6ZYDd8GhpDebs
+--- 6QOw5zJaUQstwwOUxz7yNSgBXBu+rW5rIc6CVoKLCZs
+<EFBFBD><1D><><EFBFBD>F<EFBFBD><46><EFBFBD><EFBFBD>7<EFBFBD><10><><10><>`<60>QeR<65><52><EFBFBD>j<EFBFBD><6A>gX<67>R
+<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><15>҄<EFBFBD>+s<><73><EFBFBD>-<2D>k2<6B><32>"Ҫq<03><>U0<>S/)<08>;d!7<><37>F<EFBFBD><46><EFBFBD>X<EFBFBD>g<EFBFBD>-<2D>*{<7B>pz<0C>mrm<72>T<EFBFBD><54><05><>{=<3D><><EFBFBD><EFBFBD><EFBFBD>.<2E>i<EFBFBD>۵<EFBFBD><19>o<EFBFBD><19><><EFBFBD>l<EFBFBD><6C><1A>5<EFBFBD><35><EFBFBD>G<EFBFBD><47>̡<EFBFBD>9"U"<22><0B>VЮ<56>[q<>x<EFBFBD><78>
+<2B><><EFBFBD>!<13>65v<35>SA"'@<40>
--- a/secrets/danflix_hetzner_storage_box_pub_key.age
+++ b/secrets/danflix_hetzner_storage_box_pub_key.age
--- a/secrets/danflix_rclone_config.age
+++ b/secrets/danflix_rclone_config.age
--- a/secrets/danflix_storage_box_crypt_obscured_pw.age
+++ b/secrets/danflix_storage_box_crypt_obscured_pw.age
--- a/secrets/danflix_storage_box_crypt_pw.age
+++ b/secrets/danflix_storage_box_crypt_pw.age
@@ -1,18 +1,17 @@
 age-encryption.org/v1
-> ssh-ed25519 eYYv1Q 7htRxf3zqdJ9mdMFWPph4cWKDsLH8eDE/VATFMqsmC8
-dpDckS29f0IvXtD6Hu+M8Qr2PAlcv8dp7Vp/hF/VI60
-> ssh-ed25519 Bp5IaA 1sOnWAz7sbT3W1PUWJlGA37nmnGY5/9g9QzXl3uknhU
-mJLpSWuzhFrO6PgWI/KzozthQAr1GcIT6LXGEc/7TK4
-> ssh-ed25519 T/DpgA 0VpqbU4UhMeKAi2FDlgVK4ykPT/PFCSa1hatLKg9I1c
-hk+twdOZgtLzq96sk0i+xcHbtbYpr7+MZ/sc/sP/pQk
-> ssh-ed25519 qMgRFg i5mKD8xoyDdI3SBp1Wjlw+3hbEJaoZcZSZQ2B7rJ9zk
-RlE5kgRTNO7By43FgF6CPO9eHH28EDcNUty+hgL4ETA
-> ssh-ed25519 dMZXNw OWuqUT3Idp97ltAFdRNr8B6gOEVOIru7nJbVAyXB+Rw
-jQBn7gsU31TQCIs+wwEpdjeT1KUYlRIRbkZJOgmobBw
-> ssh-ed25519 +shbwg t1VSfw0ZxYoX8ezjMx+9KLc5j56OCAf/XL84moEAPS4
-f9fThuOoQldAp2cxizVUN3pNAGRvL+Ns0+0BvTpLE+s
-> ssh-ed25519 70Nt2Q cBpA8+KQZR/Wma8QpCPbummFLD2ttbrZGmplq/zCjg0
-HiTMOp06ypyXDTTlKSGKQrwFb+iBJSb1/UPcPXGrpss
--- jgD7+nOpCuCuYtatonw3QywtiDWWr4qOuGpBLGu1jCI
-<EFBFBD>C<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>8<EFBFBD>Kp<G<>%<25><>s<EFBFBD><73>dgp<67><EFBFBD><EFBFBD><EFBFBD>xk<EFBFBD>
-_<EFBFBD><15><>*<2A><><EFBFBD>^<5E>U<EFBFBD><55>]<05>l<EFBFBD>6;?<1E><02>b<EFBFBD><62>1><3E>f<EFBFBD>j<EFBFBD><6A>GW<>|><3E>w?
+-> ssh-ed25519 eYYv1Q OVrTdX6/IeZTwVuL5vNqeJCcCHPwM3JDjmyYhw7a7hc
+9j9k83/gE5273rM7BLdCtehiOUDCmIRMoWSAYxcolMo
+-> ssh-ed25519 Bp5IaA Hm8ZlSC6oC25eWWcab2u+7AUYaznl2LtXDCyb7jXUF0
+GlJsvW2RjSB0o3uDm7qhATucWXXAKHoGPqGJEEOIKPw
+-> ssh-ed25519 T/DpgA w5STeqIu1OM400VtFRCYhwLWsAvngoh9epasa80puEQ
+EvNihPcHgbJFlIgBNAKeqvFBulklp0c5Z4G1soTFGoU
+-> ssh-ed25519 qMgRFg x1lKqUWyi2g6b3Fx+5DgoUyJrm5J4pr5KovZHahYlDE
+ni8IinnSIkyb/gEIRrR68wUz0RmxPwgmZXQrXc+qNCI
+-> ssh-ed25519 dMZXNw ZbAEtoAfsGvcv2SOCMpMjVEHhW27bA8BcqhoZYxOmk0
+qAGl8+XpzOboy6oEee5KienTjqUMborfwp1/ovc208U
+-> ssh-ed25519 +shbwg S2wiZA48sOeUQAtGfLL92Wh4TsYKgAYGsIHGAd9Ivwg
+LbHGG4DpuAyw4cRGd+pwmVe/PKQ2/+9/VO7WSTrQ2Bg
+-> ssh-ed25519 70Nt2Q IYF9364DhRSNY6NT4M1bZ22zMAzPO1rcYn8QWg8ecjA
+Up15ieiwKTHsWNt5Sv2QCRPKNJydMko23qgy2gya7g8
+--- vMk1t7JRnLp2p7cj9gqTQgOj8zxqL0Y/as1fvr5ySO8
+c@D<><44><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>i<EFBFBD>x<>1a<31><61>K<EFBFBD>pm<70>b<EFBFBD><62>2 <0E>t<EFBFBD>	e,;!<21><><EFBFBD>1˛<31><CB9B>x<EFBFBD><78>a	<1A>G<EFBFBD>$rN~<7E><><1E>m]y <20><>#<EFBFBD><EFBFBD><EFBFBD>S<EFBFBD>
--- a/secrets/gitea_actions_runner_token.age
+++ b/secrets/gitea_actions_runner_token.age
@@ -1,17 +1,19 @@
 age-encryption.org/v1
-> ssh-ed25519 eYYv1Q +YBn7DJ8i2t6LOAJ0488L6bSOiny7ELYxubRocfLWxg
-d/ncgUmeC447Enlrlk832jR8IxcmNQLruOhTgxd0WOQ
-> ssh-ed25519 Bp5IaA rkbgg52MyAeGreyVgOoShXYwN861M3YFM9XhZBzKgxE
-2hBS80T/R1W0UNMqUrkeZy7gcxU85cRB6idsKtJp/r8
-> ssh-ed25519 T/DpgA fqs7F1aNlYCvHgmTtM7OP1S4dtVxOjO5XaaT7Qih4hs
-+OaQ3Fg5B/YQUd8UnF1y7idFb3FIxMzzYvwYyQC6KIM
-> ssh-ed25519 qMgRFg B8jCmvTE0XfYNgCd5Mxz/HvuDLhEQIqhgdrJ+CNph2E
-gHBGEtUN91+GU7HWfRXCpEmi0m/PJTDdi6T7iAHPGdo
-> ssh-ed25519 dMZXNw v2EUwnAGwXOc8B+e14jl0EMpRytkLsW/HCNxZXkHZQM
-N/muGOXT4mxJQbwin/RNK96HWJqjgUTpmWQi3Eqpw6c
-> ssh-ed25519 +shbwg hYY1T5L2zwuxLpuA50Ve7pv+N+i2kjoGiwUz79EA2hQ
-R7mVf3VCs4Ox7UOaohzhfWi4eiwB2CXBgg8wQ9Hits0
-> ssh-ed25519 70Nt2Q 0XF9IUZjnhfFiIPJ8aFDsIwKnCqsEXMtap6KUzlKkkw
-FK4YfA2nxrpcrgftbBMHFRomtvsYbrqhAu5GdviyHIY
--- Xw1Z/dgVKNjggzaN0zCcZvW6MLwrULrPRrH3wQAS8b8
-<EFBFBD><EFBFBD><EFBFBD>,<2C>;<3B>0E<30><45>	Mk5<6B><35><EFBFBD><EFBFBD>K<EFBFBD><4B><EFBFBD>u3TI&N<>!<21>\JdC<64><43><EFBFBD>w<14><><EFBFBD>ΆQ<CE86><51> 뚐<0E>(?bsp<73><70><EFBFBD>p<>fQvmcJ<>
+-> ssh-ed25519 eYYv1Q UXIcxbKj5W1NupI0CpaFxLppMCy1ogABjJmrPrdtgj0
+H0nPi/Rbrdl3SvmL8yttjGYeK11AZYPrHntStknlGbs
+-> ssh-ed25519 Bp5IaA +jfI6PsuBMmMxbLLmbKFi5lubuDS2w1jpwYW7xXUfH4
+CoDWFDf3cGgLOH7q2usK7HXAyBpN8fP5vSb318XxEM4
+-> ssh-ed25519 T/DpgA Llf5Z/2bPU+roE1sYzD7nk+OSqypp9lbjdwF9RA0dUM
+w+KuaZAX3yEV2UsVT1UH2LGlPaxRX3yTmMDv1hZEtFs
+-> ssh-ed25519 qMgRFg nPvPNnuJL/+8Z06KJMvDCHzPNdRRSydVl/EJAklG3y0
+yyhTW5IOnGKtGrP73Ng4f0XTVjPIoYjDpiUNT4XwxWg
+-> ssh-ed25519 dMZXNw 1M7QevdGvzm1FZqyb1RHgTWEZcSzZZtXoJz0mo7JixA
+Zw9KQgwfg6ikr3WNFZPallshniPx1lr0TIRlvGkyZaA
+-> ssh-ed25519 +shbwg DxHb7VM8pEaoiXl3eq4hCt89pxWiJw3FsqApRwPZhWQ
+08tu5y9rv/ni+VieCvFImaJQHPZ/f6OPlUbbJfHUYEQ
+-> ssh-ed25519 70Nt2Q i+r0HJI4SNGpIzuVgtHMhEkZGCRL3JcWhoYKH687vHM
+5mkfXvRuCN3+G8UkTE3zklkAd0DrTVyMG6ukDEJDs4I
+--- 1M0mHhOXN1Mf+T5Ru8N+NBbVmUPeeKJpTcaR348JSFM
+<EFBFBD>>QHX:<3A><><EFBFBD><EFBFBD><EFBFBD>.<11>jq'x<><78>E{<7B>X/<2F><><EFBFBD>PH<50>=5<><35><EFBFBD><EFBFBD><EFBFBD>,<2C><1B>	<09>Z<EFBFBD><5A>"Sx
+<07>b<EFBFBD>8T<>
+{<7B><><EFBFBD>@<40>,`<60>!o
--- a/secrets/minisign_private_key.age
+++ b/secrets/minisign_private_key.age
--- a/secrets/rclone_password1.age
+++ b/secrets/rclone_password1.age
--- a/secrets/rclone_password2.age
+++ b/secrets/rclone_password2.age
@@ -1,19 +1,19 @@
 age-encryption.org/v1
-> ssh-ed25519 eYYv1Q eN+PhTRllPuIhVJUCGy8RLGQwyydaTjdzQqjqZ030w8
-PQYmqWBgHyLvS1VSc3RsVfV29Wxm58fOrnD9Z2ujSEI
-> ssh-ed25519 Bp5IaA QMGX/0Z/qjZgqMN+b4D3xUDJ1ySZbYXAm5sEyM8ZVTQ
-lK59GKy7M15aS9XhL5QgRaAggbO77olimH5ym1Hvh4k
-> ssh-ed25519 T/DpgA KGGxX/XgBM27itarBGUACKQC232jvnBSByx0z5a1LjY
-XK6zGLui27OY+kcK3WGSvI7Gz5I+nB3NzOYw5/PrvYs
-> ssh-ed25519 qMgRFg 9MKSUH2iP6EE/BxzcFHSmlt0UhXZAsBPdyYeQ88UJRw
-aLD2u/Ci1ErYM04GVRdyE1g2LFoCkHlvOM90YJc7S0c
-> ssh-ed25519 dMZXNw 7auvor9CRSps4IhXtk3DMdLQth+Hq1Ayjux4sWIBflY
-AjLnFiptviP0U7bw6xRIS3LjBSZhZNH9udhw/ObziHA
-> ssh-ed25519 +shbwg TKpFnW0rUqRbKu4ZpAJxrtbgAFFr5ReP04hCGuW9vSw
-M7mB8VvCmjR2h2xC+Y+t+SoCI5WWYbGLoplpeRLtEsQ
-> ssh-ed25519 GzHGXw 2ZDX1UWHAcAYgw7ajjrClfUu4LwgtRmpRCEIfaNuPyQ
-V13Qen2AvATlue7fJM1eg2JEw3TmDKue+pN9Qa/pplo
-> ssh-ed25519 70Nt2Q N2qWL6b8h4vEK1f4l3WoZ4ggwvIf/PY2Yje4ZkPw1XI
-oSJuTZ/NbtBzTLlDECiP9cWY7XaGV9LhmphnwcY7sDQ
--- Jk5mYwglsxFv22tyS3nk0KeKvBYPyOfUrGj8iS+mabw
-<10>m!<21>x"6y` <20>xa$r/<01><><EFBFBD><EFBFBD>}<7D><><EFBFBD><EFBFBD>@<40><><14><03><>O<EFBFBD>0<EFBFBD>`<60>t.<2E>g<EFBFBD>!T<><54><EFBFBD>M<EFBFBD>s<EFBFBD>
+-> ssh-ed25519 eYYv1Q N4l07Kmf3b7b69uKJrQ6nNThBrl/WbAmN57ihC6ZjQ8
+2oCASRRc1qY7ruScP757xaZ3vSlrimWNRYajbqvEruY
+-> ssh-ed25519 Bp5IaA UiiJj3sGm34sFQEfYEb/+MRbdcLJQIcvcna7Dodqojw
+vqS1RePJ1pfvThr4zllPg30T97JuL2ebp4ZXqf1n4x0
+-> ssh-ed25519 T/DpgA Tg/toD5n8zs/GeyjEOzPVTK8dXnzA1ieSU3st4vGAyU
+DySirOIZiB6e7SHkTH9ZSHjsU8L0a21vDpqqq5CzjuI
+-> ssh-ed25519 qMgRFg xD/GsOCpw5kwJnSn+IQXPIgL3rYWJInA6RWYyVlrLzg
+2ApxGOhCWdggoS8FiYpAr8enOGX60x1ZwRnUE4Xl7c4
+-> ssh-ed25519 dMZXNw 1EDPyLIR4bY+nbwU583HNq1FobJpwbm5UUUa23SjxhQ
+0FZN6SQD8k/WIcnGTSrM5jQjTPh2obBJqCIG6WvRwDQ
+-> ssh-ed25519 +shbwg /A8nm8jMT+GYbYrpuFQREAEMTBwb2aGy6MgP9GV1lQA
+4k2SHB7JcmH1RVUq82NRYtg6UfMvngvmd2d/taL5IgA
+-> ssh-ed25519 GzHGXw 0/LHMO8FjcikUiHglUxsWMLEDxQGAsyJsSFZa+/6FA0
+xVRk7Ekf4BNxS0BiDEG2Sk7N50ETl/NZjCVF+D8vS5s
+-> ssh-ed25519 70Nt2Q BsNN322tifiglQwn1h6oDAgT52wzlH3eDXqrOlE7yV0
+f52H1I8DbK15UW6+pNHayYWuV9z4tPKkg0t6hHippfs
+--- psLzR6pho+xpxI4aNw2xGh+zfdgfxDghBRbwZE8O+X0
+<EFBFBD>q<18>c<EFBFBD><63>Z<EFBFBD><5A>q*(<28>g<EFBFBD>}\<5C><05>b<EFBFBD><62><EFBFBD>Li<4C>ʔ<>_<EFBFBD><5F>^<5E>56<35>1<EFBFBD><31>jŧ9<C5A7>PX<50><58>^<EFBFBD>
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -31,10 +31,10 @@ in {
  "bigding_backup_repo_password.age".publicKeys = users ++ [system4];
  "sendmail_email_key_gitea.age".publicKeys = users ++ [system4];
  "gitea_actions_runner_token.age".publicKeys = users ++ [system4];
-  "danflix_hetzner_storage_box_pub_key.age".publicKeys = users ++ [system4];
+  "danflix_hetzner_storage_box_pub_key.age".publicKeys = users ++ [system4 system5];
  "danflix_storage_box_crypt_pw.age".publicKeys = users ++ [system4];
  "danflix_storage_box_crypt_obscured_pw.age".publicKeys = users ++ [system4];
-  "danflix_env_file.age".publicKeys = users ++ [system4];
-  "danflix_rclone_config.age".publicKeys = users ++ [system4];
-  "caddy_porkbun_api_env.age".publicKeys = users ++ [system4];
+  "danflix_env_file.age".publicKeys = users ++ [system4 system5];
+  "danflix_rclone_config.age".publicKeys = users ++ [system4 system5];
+  "caddy_porkbun_api_env.age".publicKeys = users ++ [system4 system5];
 }
--- a/secrets/sendmail_email_key_gitea.age
+++ b/secrets/sendmail_email_key_gitea.age