flake.lock updates

flake.lock

@@ -18,11 +18,11 @@
     },
     "flake-file": {
       "locked": {
-        "lastModified": 1781217157,
+        "lastModified": 1784255282,
-        "narHash": "sha256-N3q/SP2Ropk336e9KSgLh7kpROY6P70dprYdbPIfd5c=",
+        "narHash": "sha256-srM+PTqxfyvbQ0BevsOtP8vQv/Ox6OMtY4DktoDxLKg=",
         "owner": "vic",
         "repo": "flake-file",
-        "rev": "ce63eaf7ebfe04a176653f66385a7f0a36380cee",
+        "rev": "66ddd2f69a5c4677f0095c6f70eea1217dc45749",
         "type": "github"
       },
       "original": {
@@ -51,27 +51,6 @@
         "type": "github"
       }
     },
-    "flake-parts_2": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "nvf",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1778716662,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
     "flake-utils": {
       "inputs": {
         "systems": "systems"
@@ -95,11 +74,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1783134515,
+        "lastModified": 1784351324,
-        "narHash": "sha256-qMoZazubXlXUD9k/syJ/aiWC4X4g73mwVmZ7Z4+rdpM=",
+        "narHash": "sha256-By+kuRJZRqs2TuXgtR8vJ8cTKWXw33YG/Yollu5cO1U=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b885baad531fa3d3beae2ba9a0712d22974d8016",
+        "rev": "460108009ca1ff69ca2ff19079ca2c838d6e3080",
         "type": "github"
       },
       "original": {
@@ -110,11 +89,11 @@
     },
     "import-tree": {
       "locked": {
-        "lastModified": 1778781969,
+        "lastModified": 1784254960,
-        "narHash": "sha256-Jjuz5CmSkur8KvLDoGa+vylEp+RkQtv4mt/qcMznpH0=",
+        "narHash": "sha256-iI88R3wHz8wTKQb5orvpc51L/Xr64AJyxid/0MKa/b8=",
         "owner": "vic",
         "repo": "import-tree",
-        "rev": "d321337efd0f23a9eb14a42adb7b2c29313ab274",
+        "rev": "4ebb10ae17d5f1ad366e7aef5b92cb8eecf24f69",
         "type": "github"
       },
       "original": {
@@ -162,11 +141,11 @@
     "nixos-hardware": {
       "flake": false,
       "locked": {
-        "lastModified": 1782562157,
+        "lastModified": 1784310968,
-        "narHash": "sha256-a7+T6QSeowynwZ1ZJJbP8T8ntAytvrui8kFGJmIZt2c=",
+        "narHash": "sha256-rkSPTePrKqs4dg+i7ZFCq93+HrClac6oSwXX927SVjA=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "a9cf7546a938c737b079e738de73934a13de9784",
+        "rev": "779c32a00155994c86cde8213a8dd4df139d4355",
         "type": "github"
       },
       "original": {
@@ -177,11 +156,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1782175435,
+        "lastModified": 1783604885,
-        "narHash": "sha256-EMzXKmnOtBQ2MnvpiNOm7E+kOMvdPrIKaeg52Tip2Uk=",
+        "narHash": "sha256-tzMgSkV7kljEkqIjlgV6F+n+xD+/a35Db8bs7a4BFAo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "89570f24e97e614aa34aa9ab1c927b6578a43775",
+        "rev": "767b0d3ec98a143ad9ed7dfc0d5553510ac27133",
         "type": "github"
       },
       "original": {
@@ -193,11 +172,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1782948114,
+        "lastModified": 1784347607,
-        "narHash": "sha256-VGtEDss4T0hPTnlWiiaa29y/lXM9SxuSMVtzPYf3wS0=",
+        "narHash": "sha256-oJoPGsmXO7Xm5YagCr0La+dSTu5Lpfx35WN8vNG18BU=",
-        "rev": "9e92285f211dad236540fd617d7e30e0b99bc0e1",
+        "rev": "31cd72fdba8fa052e437ce7e6879c4fe62def10f",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1026211.9e92285f211d/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1036759.31cd72fdba8f/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -207,19 +186,17 @@
     "nvf": {
       "inputs": {
         "flake-compat": "flake-compat",
-        "flake-parts": "flake-parts_2",
         "mnw": "mnw",
         "nixpkgs": [
           "nixpkgs"
-        ],
+        ]
-        "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1783164413,
+        "lastModified": 1784320861,
-        "narHash": "sha256-7DMamcvS35/tI+KZKXt45bHAq2Vnucl74Xetvp7DR3I=",
+        "narHash": "sha256-sPUghbl8wMmESus7KvsmHIUEyD2mi13/xu7/u2H5SZU=",
         "owner": "notashelf",
         "repo": "nvf",
-        "rev": "c8386ccfbc7053d454fa2d12d716c6ebb4167d51",
+        "rev": "43fdcbf2e00290479d3f9b97b7f61edd08c4e584",
         "type": "github"
       },
       "original": {
@@ -278,21 +255,6 @@
         "type": "github"
       }
     },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "wrapper-modules": {
       "inputs": {
         "nixpkgs": [
@@ -320,11 +282,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782375095,
+        "lastModified": 1784213309,
-        "narHash": "sha256-bRepNpAluz2i0IIk7Tmzw/4BkyOrwABvc66NEgXPEhA=",
+        "narHash": "sha256-A9C90KsA6FsRkFPTA1C1sHP13d6AMuGOvsvI7qjHz8g=",
         "owner": "lassulus",
         "repo": "wrappers",
-        "rev": "cd780e92c0fa66c2e721e1d91894f3db13b9f2b4",
+        "rev": "a04c2ee17fb9679198d0a852ad8709bc152dfac2",
         "type": "github"
       },
       "original": {

modules/features/forgejo.nix

@@ -3,6 +3,18 @@
     let
       cfg = config.forgejo;
       needsPrivilegedPort = cfg.port < 1024;
+      wrappedForgejo = (inputs.self.wrappers.forgejo.forgejo.apply {
+        inherit pkgs;
+        serviceConfig = config.services.forgejo;
+      }).wrapper;
+      cleanForgejo = (inputs.self.wrappers.forgejo.clean.apply {
+        inherit pkgs;
+        serviceConfig = config.services.forgejo;
+      }).wrapper;
+      cleanPostgres = (inputs.self.wrappers.forgejo.clean-postgres.apply {
+        inherit pkgs;
+        serviceConfig = config.services.postgresql;
+      }).wrapper;
     in
     {
       options.forgejo = {
@@ -11,6 +23,23 @@
           type = lib.types.str;
         };
 
+        pocketId = {
+          enable = lib.mkEnableOption "Configure Pocket ID as a Forgejo OIDC provider";
+
+          discoveryUrl = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "https://id.example.com";
+            description = "OpenID Connect discovery URL for Pocket ID.";
+          };
+
+          name = lib.mkOption {
+            type = lib.types.str;
+            default = "pocket-id";
+            description = "Forgejo external auth source name for Pocket ID.";
+          };
+        };
+
         port = lib.mkOption {
           type = lib.types.port;
           default = 3000;
@@ -27,8 +56,20 @@
       };
 
       config = lib.mkIf cfg.enable {
+        assertions = [
+          {
+            assertion = !cfg.pocketId.enable || cfg.pocketId.discoveryUrl != null;
+            message = "forgejo.pocketId.discoveryUrl must be set when forgejo.pocketId.enable is true.";
+          }
+        ];
+
         networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.port ];
 
+        mtls = lib.mkIf cfg.https {
+          certReaders = lib.mkAfter [ config.services.forgejo.user ];
+          renew.reloadUnits = lib.mkAfter [ "forgejo.service" ];
+        };
+
         systemd.services.forgejo.serviceConfig = lib.mkIf needsPrivilegedPort {
           AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
           CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
@@ -40,6 +81,9 @@
           "forgejo/internal_token".owner = config.services.forgejo.user;
           "forgejo/jwt_secret".owner = config.services.forgejo.user;
           "forgejo/lfs_jwt_secret".owner = config.services.forgejo.user;
+        } // lib.optionalAttrs cfg.pocketId.enable {
+          "forgejo/pocket_id/client_id".owner = config.services.forgejo.user;
+          "forgejo/pocket_id/client_secret".owner = config.services.forgejo.user;
         };
 
         services = {
@@ -48,9 +92,7 @@
             lfs.enable = true;
             database.type = "postgres";
             settings = {
-              DEFAULT = {
+              DEFAULT.RUN_MODE = "dev";
-                RUN_MODE = "dev";
-              };
               server = lib.mkMerge [
                 {
                   HTTP_PORT = cfg.port;
@@ -71,13 +113,9 @@
                 ACCOUNT_LINKING = "login";
                 REGISTER_EMAIL_CONFIRM = false;
               };
-              repository = {
+              repository.ENABLE_PUSH_CREATE_USER = true;
-                ENABLE_PUSH_CREATE_USER = true;
-              };
               ui.SHOW_USER_EMAIL = false;
-              markup = {
+              markup.ENABLED = true;
-                ENABLED = true;
-              };
             };
 
             secrets = {
@@ -109,39 +147,122 @@
           --work-path ${config.services.forgejo.dump.backupDir}
         '';
 
-        environment.systemPackages =
+        systemd.services.forgejo-pocket-id-oidc = lib.mkIf cfg.pocketId.enable {
-          let
+          description = "Ensure Pocket ID OIDC auth source exists in Forgejo";
-            systemctl = lib.getExe' pkgs.systemd "systemctl";
+          after = [ "forgejo.service" ];
-            clean-forgejo = (pkgs.writeShellScriptBin "clean-forgejo" ''
+          requires = [ "forgejo.service" ];
+          wantedBy = [ "multi-user.target" ];
+
+          serviceConfig = {
+            Type = "oneshot";
+            User = config.services.forgejo.user;
+            Group = config.services.forgejo.group;
+            WorkingDirectory = config.services.forgejo.stateDir;
+          };
+
+          script = ''
             set -euo pipefail
-              sudo ${systemctl} stop forgejo.service
+
-              ${lib.getExe' pkgs.coreutils "echo"} "Stopped Forgejo"
+            client_id="$(<${config.sops.secrets."forgejo/pocket_id/client_id".path})"
-              sudo ${lib.getExe' pkgs.coreutils "rm"} -rf ${config.services.forgejo.stateDir}
+            client_secret="$(<${config.sops.secrets."forgejo/pocket_id/client_secret".path})"
-              ${lib.getExe' pkgs.coreutils "echo"} "Removed ${config.services.forgejo.stateDir}"
+            provider_name="${cfg.pocketId.name}"
-            '');
+            forgejo_bin="${lib.getExe wrappedForgejo}"
-            clean-postgres = (pkgs.writeShellScriptBin "clean-postgres" ''
+
-              set -euo pipefail
+            auth_id="$(
-              sudo ${systemctl} stop postgresql.service
+              "$forgejo_bin" admin auth list \
-              ${lib.getExe' pkgs.coreutils "echo"} "Stopped PostgreSQL"
+                | ${lib.getExe' pkgs.gawk "awk"} '$2 == "'"$provider_name"'" { print $1; exit }'
-              sudo ${lib.getExe' pkgs.coreutils "rm"} -rf ${config.services.postgresql.dataDir}
+            )"
-              ${lib.getExe' pkgs.coreutils "echo"} "Removed ${config.services.postgresql.dataDir}"
+
-            '');
+            if [ -n "$auth_id" ]; then
-          in [
+              "$forgejo_bin" admin auth update-oauth \
-            clean-forgejo
+                --id "$auth_id" \
-            clean-postgres
+                --name "$provider_name" \
-            (pkgs.writeShellScriptBin "clean-all" ''
+                --provider openidConnect \
-              set -euo pipefail
+                --key "$client_id" \
-              GREEN_CHECK="\e[32m✔\e[0m"
+                --secret "$client_secret" \
-              YELLOW_BANG="\e[33m!\e[0m"
+                --auto-discover-url "${cfg.pocketId.discoveryUrl}" \
-              ${lib.getExe' pkgs.coreutils "echo"} -n -e "$YELLOW_BANG Remove everything related to Forgejo and the PostgreSQL database behind it?"
+                --scopes openid \
-              read -p " (y/n) " -n 1 -r
+                --scopes profile \
-              if [[ $REPLY =~ ^[Yy]$ ]]; then
+                --scopes email
-                ${lib.getExe clean-forgejo}
+            else
-                ${lib.getExe clean-postgres}
+              "$forgejo_bin" admin auth add-oauth \
-                ${lib.getExe' pkgs.coreutils "echo"} -e "$GREEN_CHECK Removed everything related to forgejo"
+                --name "$provider_name" \
+                --provider openidConnect \
+                --key "$client_id" \
+                --secret "$client_secret" \
+                --auto-discover-url "${cfg.pocketId.discoveryUrl}" \
+                --scopes openid \
+                --scopes profile \
+                --scopes email
             fi
-            '')
+          '';
+        };
+
+        environment.systemPackages = [
+            wrappedForgejo
+            cleanForgejo
+            cleanPostgres
           ];
       };
     };
+
+  flake.wrappers.forgejo = {
+    forgejo = inputs.wrappers.lib.wrapModule ({ config, lib, wlib, ... }: {
+      options = {
+        serviceConfig = lib.mkOption { type = lib.types.attrs; };
+      };
+      config = let
+        cfg = config.serviceConfig;
+        forgejo_config="${cfg.customDir}/conf/app.ini";
+        forgejo_work_path="${cfg.stateDir}";
+      in {
+        binName = "my-forgejo";
+        package = cfg.package;
+        args = [
+          "--config" forgejo_config
+          "--work-path" forgejo_work_path
+        ];
+      };
+    });
+    clean = inputs.wrappers.lib.wrapModule ({ config, lib, wlib, ... }: {
+      options = {
+        serviceConfig = lib.mkOption { type = lib.types.attrs; };
+      };
+      config = let
+        cfg = config.serviceConfig;
+        pkgs = config.pkgs;
+      in {
+        binName = "forgejo-clean";
+        package = pkgs.coreutils;
+        exePath = lib.getExe' pkgs.coreutils "rm";
+        extraPackages = [ pkgs.systemd ];
+        preHook = ''
+          sudo systemctl stop forgejo.service
+          echo "Stopped Forgejo"
+        '';
+        args = [ "-rf" cfg.stateDir ];
+        postHook = ''echo "Removed ${cfg.stateDir}"'';
+      };
+    });
+    clean-postgres = inputs.wrappers.lib.wrapModule ({ config, lib, wlib, ... }: {
+      options = {
+        serviceConfig = lib.mkOption { type = lib.types.attrs; };
+      };
+      config = let
+        cfg = config.serviceConfig;
+        pkgs = config.pkgs;
+      in {
+        binName = "postgres-clean";
+        package = pkgs.coreutils;
+        exePath = lib.getExe' pkgs.coreutils "rm";
+        extraPackages = [ pkgs.systemd ];
+        preHook = ''
+          sudo systemctl stop postgresql.service
+          echo "Stopped Postgres"
+        '';
+        args = [ "-rf" cfg.dataDir ];
+        postHook = ''echo "Removed ${cfg.dataDir}"'';
+      };
+    });
+  };
 }

modules/features/mtls/config.nix

@@ -28,6 +28,11 @@
         type = lib.types.str;
         default = "${config.certDir}/mtls.pem";
       };
+      certGroup = lib.mkOption {
+        description = "Group that should be granted read access to generated certificate material.";
+        type = lib.types.str;
+        default = "mtls";
+      };
       subject = lib.mkOption {
         description = "Subject for the cert";
         type = lib.types.str;

modules/features/mtls/mtls-wrappers.nix

@@ -11,7 +11,11 @@ in
         binName = "mtls-generate";
         package = config.pkgs.step-cli;
         extraPackages = with config.pkgs; [ coreutils step-cli systemd ];
-        preHook = "mkdir -p ${config.certDir}";
+        preHook = ''
+          mkdir -p "${config.certDir}"
+          chgrp "${config.certGroup}" "${config.certDir}"
+          chmod 0750 "${config.certDir}"
+        '';
         args = [
           "ca" "certificate"
           "${config.subject}" "${config.certFile}" "${config.keyFile}"
@@ -25,7 +29,11 @@ in
         ++ lib.optionals config.overwrite [ "-f" ]
         ++ mkSANArgs config.SANs;
         postHook = ''
+          chgrp "${config.certGroup}" "${config.certFile}" "${config.keyFile}"
+          chmod 0640 "${config.certFile}" "${config.keyFile}"
           (umask 077; cat "${config.certFile}" "${config.keyFile}" > "${config.bundleFile}")
+          chgrp "${config.certGroup}" "${config.bundleFile}"
+          chmod 0640 "${config.bundleFile}"
         '';
       };
     });
@@ -45,7 +53,11 @@ in
           "${config.certFile}" "${config.keyFile}"
         ];
         postHook = ''
+          chgrp "${config.certGroup}" "${config.certFile}" "${config.keyFile}"
+          chmod 0640 "${config.certFile}" "${config.keyFile}"
           (umask 077; cat "${config.certFile}" "${config.keyFile}" > "${config.bundleFile}")
+          chgrp "${config.certGroup}" "${config.bundleFile}"
+          chmod 0640 "${config.bundleFile}"
         '';
 
         systemd = {

modules/hosts/soteria/default.nix

@@ -3,9 +3,11 @@
 let
   username = "john";
   hostname = "soteria";
+  forgejoDomain = "forgejo.john-stream.com";
   ipv4 = "192.168.1.233";
   ipv6 = "fded:fb16:653e:25da:be24:11ff:fe54:aa39";
-  names = [ "${hostname}.john-stream.com" ipv4 ipv6 ];
+  sshNames = [ "${hostname}.john-stream.com" ipv4 ipv6 ];
+  mtlsNames = sshNames ++ [ forgejoDomain ];
 in
 {
   flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
@@ -42,19 +44,24 @@ in
         mtls = {
           enable = true;
           subject = hostname;
-          san = names;
+          san = mtlsNames;
+          certDir = "/etc/mtls";
           # lifetime = "12h";
           # renew.onCalendar = "*:3/15";
           # renew.reloadUnits = [ "forgejo.service" "restic-rest-server.service" ];
           # certReaders = [ config.services.forgejo.user "restic" ];
         };
 
-        # forgejo = {
+        forgejo = {
-        #   enable = true;
+          enable = true;
-        #   root_url = "https://forgejo.john-stream.com";
+          root_url = "https://forgejo.john-stream.com";
-        #   https = true;
+          https = true;
-        #   port = 443;
+          port = 443;
-        # };
+          pocketId = {
+            enable = true;
+            discoveryUrl = "https://pocketid.john-stream.com/.well-known/openid-configuration";
+          };
+        };
 
         # resticServer = {
         #   enable = true;
@@ -79,7 +86,7 @@ in
           provisioner = "admin";
           host = {
             enable = true;
-            extraPrincipals = names;
+            extraPrincipals = sshNames;
             autoRenew = true;
           };
           user.enable = true;
@@ -112,13 +119,4 @@ in
       })
     ];
   };
-
-  # flake.homeConfigurations.soteria = withSystem "x86_64-linux" (ctx@{ config, inputs', ...}:
-  #   inputs.home-manager.lib.homeManagerConfiguration {
-  #     pkgs = inputs'.nixpkgs.legacyPackages;
-  #     modules = [
-  #       inputs.self.modules.homeManager."${username}"
-  #       inputs.self.modules.homeManager.soteria
-  #     ];
-  # });
 }

modules/hosts/soteria/secrets.yaml

@@ -1,42 +1,45 @@
 forgejo:
-    #ENC[AES256_GCM,data:/wtm0uXbiWFoGNWtlTzVuNxBR7CPm2FMB98t3AxSj5V5rltLvzF9BjgWoJCiX3ltzmU=,iv:xaZXbUIGJHxPrLRQzEQI7hgRgc0y061jIhoE3zlcMaA=,tag:fQGheCIdBKm6wE+vtj7g6A==,type:comment]
+    #ENC[AES256_GCM,data:H3xdtb9TA/VStpOzLxboPTck0iasvAAS77hVFQOI1hmIwwYNYuRXTWb9N0M9kBEv/ho=,iv:PkLd3iHLzjnsPZtfQq/LJcwHQDm+gyxQJX/jWrpRmUw=,tag:qHtHvotCqr4IGs0vi5AOhw==,type:comment]
-    secret_key: ENC[AES256_GCM,data:/jcyeDcsryLqu9Q3VnNaENb71/Tl5JUr0zDzxt8L5UCtnJ/YHA6MKItrQ9ZHFv1XROtnSfZl9D5kKomeM8EVqA==,iv:HxMKAMVQ08gkq6SWENj0/d8i9PhcgPCp5eqbztj9bSg=,tag:nO2dFWT/vfgGc/9JIDZrGw==,type:str]
+    secret_key: ENC[AES256_GCM,data:h1TOZGnV4yBX/wFVlpyxP/KhtKbjqpvxWL7/bxONfoi3PQMtkQfwWbjd/FTC72XyCAHO/yDsCtHRQjPQcyeXmw==,iv:XgdO/i8FKBCYsRfFc5JAg+9yA3TbreIJw4J8p0xif0s=,tag:TgrJREyZuc7cdUcru1Qk0w==,type:str]
-    #ENC[AES256_GCM,data:TADqVsZwXpH/zfrXNclavH8Sv++jX081UjK/Mkys5x52gU5fU0ikk478EmwzeergsHpmxxon,iv:v9HsIsud+eiko7F0u622MBrTVDsIxlpqru0Viifvqow=,tag:FLgNTW0EcGhHT6iI9I6Bsg==,type:comment]
+    #ENC[AES256_GCM,data:43sjaBcdtJol6ySQKUuhZfSM4TvS6HLrjI/CLSlFcBfIYIe8UoPK6ZSsG7u3knVc58u8YreH,iv:aHaCmk5lr05PbXAKASPy22t88f//LOEVgSRzbZ6KKow=,tag:U3wsAmEwbaKUzjwdp6ekcg==,type:comment]
-    internal_token: ENC[AES256_GCM,data:7eZM+misgHZz1p6HH9VzCAPIIFjp2vT0kyc9B1KllE+x2URyrgs5IR9SZ+T5vNdMdnlNzF25pUhKzjbak8tVN554rYWp06SczzqhLyaoHKs8iGBohMqfJkoZxxIVSB7g7GC+/SAsb719,iv:XbBXqXh/PqjEcAj0qsajR7Ij56KGT/9Spdp5T549p9I=,tag:o4ONucOkIE2VJ6VjOlPb6w==,type:str]
+    internal_token: ENC[AES256_GCM,data:tFzyCj02HXauxCqKFsZD0CB/W4FAxv4t0KSIZPPXV6a2N6PdDuL0W5+Wdd9O17E/Pa8mrourwjpqipON+FUNARp4bLsFp1bgBPeq52BLS1neSXC1YrxsO3W9/12Y5wpXI5mz7WwVJUvt,iv:uyxZlZ8vVnwkQBwNvPLgbeomyhx/lfSgi5xJyB2LLb8=,tag:oXfWY1wGL3NvlpfeGyIWxg==,type:str]
-    #ENC[AES256_GCM,data:ZqwgnKjaolJtjcy287fnDOkb/oSLnBpfWfsTeVPwbIE8YLRSoPP4gbCnHJBLq+TJNNI=,iv:zTvw4ZS6C1ifUwOijNLuTfUQ3JM+5gj1X2f/s8MwWXc=,tag:Y1yKlL+jIRHVBulGlSErog==,type:comment]
+    #ENC[AES256_GCM,data:8sFQ0j8jmDAmnl5FD6FFtHv6t34rFVu9O658hlGktKKFDpgXnj/IIaelvqSrsSlS6nA=,iv:HWYldmocbK/auGAXB/01zmC/vC58Z/2UYla6CFoaAL8=,tag:3dhcO0ip/w54Cf2pHwXqiQ==,type:comment]
-    jwt_secret: ENC[AES256_GCM,data:e59MlATOorsTIQjtTUKfX5Yo3CVsbbfuKczp1gh1m2D1kkZK3ORFztYpjg==,iv:JH3PVUmXToiThEKDkDJ8MGVMAPlIEgPSWhru+9WgNjk=,tag:FfDpaCPejpw6kGDkxJwDWw==,type:str]
+    jwt_secret: ENC[AES256_GCM,data:uIIHBk3m5DNHXRJ7pyg0Xvz1cxUFqfxUzFtBZGY59E4dPj9qHHe3RC7jEg==,iv:krZHjrU3QziSuHihpVLHaSIzHU5VZ1UUBeLBd3kWW3Y=,tag:3Z0UCV9+9nc+FU9vXFutbQ==,type:str]
-    lfs_jwt_secret: ENC[AES256_GCM,data:xi9PEKFUGRyc3YOg3JM3KrrENi9xsbeBjiz4R16SK5WDafoGFLazN6KRJQ==,iv:1IhPyQDwA8tZ22pfZJiU8TRTCLCHC/HAnKdmSGDfvcM=,tag:rLdREVSKBm67rt8ayN16Vw==,type:str]
+    lfs_jwt_secret: ENC[AES256_GCM,data:LGemlQqpCwy1HlQI3BfW6Qir8cjYgtpoyFkoKhYgGR5x+F3shCaiUNEwFA==,iv:3C3S4gUpk1szU/7Dg9RObpv3/DMpzCpFg3qyrfFMot0=,tag:dwIRfA6PoQo09+YEs6o8fg==,type:str]
-restic_password: ENC[AES256_GCM,data:u7QOZXJkxVG4J75K5nphb2uJGdz6jbWuVSsKKu+41fshp7cVoRijtr/Cs02LjVse,iv:bt1W2FeBTG6ypBFYzMPXPIkYTSn0uHURY2ui6MRgYY8=,tag:DObAMws/zQcM+UKUe9EECA==,type:str]
+    pocket_id:
+        client_id: ENC[AES256_GCM,data:0aju1RTsGGpKRWHoBIydKUzijX5iHYWlAW/q5Ykam1WUs+py,iv:pkcZrlE1OZnEUZPnveWWkShA225tinm0eDIpmg1YbWY=,tag:vz168jIJzbJ7+DrZzn4BmA==,type:str]
+        client_secret: ENC[AES256_GCM,data:dXqdSqwc6aDmWOD3sYla0KWdk3CUQxLpKaQ0b5uozRI=,iv:N/LHumamZMqtqOdx3Mmj25zlsvYfriYahdxtd/goCAk=,tag:kYjcXzwrsnTN5pBGfDi1Yw==,type:str]
+restic_password: ENC[AES256_GCM,data:4OOYu5+BabBtRkGjvXwIAxb+L5H3ADkqTWZFwSKIV0eOhRvNfBTlL7HBvvMCFXcP,iv:wBmht7AbnZwcKV3vBygrcuV02KoCStVn3AYt3iLOBpI=,tag:cMcCqwb6wPMm9ZKk59me4A==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLM3NML2ozWExSTlY3ZXJH
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVV2FrSURwdEozZ0l6MjRJ
-            ZEpaN1RIOWVjNXRRQTlLQVZKTUUvZnBxREd3Cmp6b29aRDlUdDFwMVhwS2thODNO
+            VWU4YTVVMmN1OHNEWWJ1RmJrU1ltcFhGVW00CkFTWDRtYWtKSFRBcVRKZXZtUCtQ
-            QzNWSVIrak1uMGRuUlBONkR2aW1nbXMKLS0tIDh2YmFaRXBvZ0Q2blhjTVphL3J3
+            Zi9pa21BcGJaMmJTa3Jab1VRUW5LVUUKLS0tIHlUY2d3OXVVTDY4UDhOamYrSnNW
-            TkROaHdwWWN4YnkyczZLbDJYRTNrQTQKvHSXjP9EZkq9DrPZZHTIlFrPUhez6jZT
+            R1orWGIwUFpPVnpQRUFuNm00OEZ5MWsKwH1QahhZWw4aUbAcST+fL2HefrJdKktD
-            LJvkmQgKluer7+lWr8XuuqtQsvhtef1di82SBG6C6YK0zWIxrMjFkA==
+            G5sLmNPa3aEKx0Y3CSIvgww23iQYw31iXJS9sVcPyMVt99YP21KbvA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1p4gyh5260ewp7t2ctzv5ewj4a06szl389fm4gzy6vltxhjj73ers87u33g
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwWThXZGtFSjFZVU1UWG9v
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBReFNXY3c0UnZ3cGZnbnFO
-            Wk9sVEVWemtVWTJ6TGlOd3ZhVUZBYnJ1OFFRClpFNmEwTG1PR0pQUFJuTTVVZGRD
+            K3dZS2w4S0UzeFE4YXg0V3BjbzNISm8xdWdZCkc4NUdBMktMbStSZkFtTFBHcGNQ
-            bnpPdjZGVUJvS0NyWGJQbEV4cUlHZncKLS0tIDFNU1VxNjZYSks1OTMrblJPbDI1
+            eDdlQXRXb3NKaUtLWXlqN0txOGxoMTgKLS0tIEZPV1BCWUFRaldIMDlSRXZzMmtN
-            bHIrUnhsMWNhWVpVc3hCazlKTlV5YncKgR/AbgCE9JU8U8PH3ouYTZJOqL7rRODr
+            aW14MnNtZVM0M0M0ajk2UElCWklhaVUKZewlYVMefFqC+ddzrgmAXVTiuBqhhxEL
-            5D2zT9pcTC3LQGZrhNtgjAi6IucU4yDAU7UhT3D7cZawwFTKVaoplw==
+            Q3cUhxGk5DUhCn30ia/ztQIb79kVBrdhY6zA2bKcBdYH4HSzV+rNAA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3K054SHE0V1RCYlRlTXJT
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhbVRyNmN3WU5SbTNtbzZV
-            bXo4ZnE1cFozY3R2dmg5S1BacC9xb2oweWpBClJJVnkrSytFaG8xR1l4SU5FNGxi
+            cGoybXo0dWtpRDNkR2drZTN0VFhoQ0REQ0ZvCkNSSm9hbmZDNUsxTjBGWm5QL3M2
-            UndnNzYwMUlXSjRYK3c3MzI4NmRVRVEKLS0tIFQ4NFdPeGI4LytWK0JPcUV4VjM2
+            VElMSi8ybFRVM3hpNUlYdVAyME1RTUEKLS0tIGJVRis5WkRDRkxCVVdJVENlZ3Ru
-            b1dtYWdFTTFQcW5PQml2OWs1Z0VZOFUKrDX7y3cU8KPRLKlO/HI/jdynqwO1TAS0
+            aGw3cW51Vno4emFMckxqRTVGcGhoemcK4WBC2EZEx7hVlUQnsD4V5QH9peNjUoWE
-            WY4F0qFKmWwsJJjbnjdpYYP3O1/8RNeXjnUg8fGYY75sf7iAYWSe/w==
+            XjCvw0twhPRi9uXd4HmHqlDpxdGMk0oFQ77O7h7Q3z2uqsJ2v8p/SA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
-    lastmodified: "2026-04-04T23:18:43Z"
+    lastmodified: "2026-07-10T04:31:57Z"
-    mac: ENC[AES256_GCM,data:qBgeli5lHb4pyA8nAADBuRBAaq8VbAIsFI37OZtgnbnoHW2crxo3YC+EknaIYnZpZ48kwVhQS5lGRjI6JsWWhTH3+LVAhTmS2Qj/pZTD/JDLK6XJGXS4U9nB7m9aGYyW8gFCy9/DfoJWGsS//+ZmUikKPfd5kMZgh1zGoYCIGug=,iv:h+2fA+bO2SMCNrEslP36x3BPRaIy25cU/DNX8CYSC6A=,tag:RvVyUZ4ONRaKaqGiT31eUQ==,type:str]
+    mac: ENC[AES256_GCM,data:uytG0nhJ/Gp0KbOovD1SVXx0G27e12gMPwmpkU0lPW01cAXNe0rv4SjhHGP0FOR6vLimcPAmekVjVqiKxie8Zevo/Jf9ZRTkQ6ixWLvhH2NMHra4T5TWtUjfMdFM8tiilwcvjsXpqAoaJDZ0HHY5NYhXG/khobAwBRc26RtICVw=,iv:6gB28VE17+NoM/tR9lIlJoMPD91Aud+kH95Vo+fWLjs=,tag:QMUQPsCnr1TUsQE66GVBBg==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.12.2
+    version: 3.13.1