rebase

Ninlives · Nov 26, 2022 · 26184a3 · 26184a3
commit 26184a3
Show file tree

Hide file tree

Showing 175 changed files with 23,645 additions and 0 deletions.
diff --git a/.gitattributes b/.gitattributes
@@ -0,0 +1 @@
+bombe/encrypt/** filter=sops-nix diff=sops-nix
diff --git a/.gitignore b/.gitignore
@@ -0,0 +1 @@
+.commit-unfinished
diff --git a/.sops.yaml b/.sops.yaml
@@ -0,0 +1,26 @@
+keys:
+  - &server age1s6hznqs4cukna8ernacyh29fx6znpucmplvt3udvd7xxexwymg3suz0x37
+  - &local age17asv6vjafasyup5fz0l30muu96h2xdrrga0u5fwf7qxuch2n7yfsu5zjln
+  - &home age1xz7t3w8l36ls8ds264875zqtulv9vwvj37ayy87u3ccacqxax9hs6nfq8r
+creation_rules:
+
+  - path_regex: .*/server/.*
+    age: *server
+
+  - path_regex: .*/local/.*
+    age: *local
+
+  - path_regex: .*/home/.*
+    age: *home
+
+  - path_regex: .*/infra/.*
+    age: *server
+
+  - path_regex: .*/tfstate.json
+    age: *server
+
+  - key_groups:
+    - age:
+      - *server
+      - *local
+      - *home
diff --git a/README.md b/README.md
@@ -0,0 +1,15 @@
+# nixos-config
+
+## Info
+
+My personal config files for my daily environment, configured for Dell Inspiron 7590.
+
+## Usage
+
+```sh
+git clone https://github.com/Ninlives/emerge.git
+cd emerge
+
+# Activate the system
+sudo nix run .#apply -- boot # switch/test
+```
diff --git a/bombe/data/general/tokens.yaml b/bombe/data/general/tokens.yaml
@@ -0,0 +1,45 @@
+v2ray:
+    id: ENC[AES256_GCM,data:vkKVp2IR5fiGtqE2oeGf6H5InRRAbxB0sLm9K4mCJOpFaW84,iv:rce/2x3vwd0vKVDBB/qpLdwsdZi3+d/+jjbl6Z3yzco=,tag:80vTbtI3ntlFaE4cO/D9pg==,type:str]
+rathole:
+    token:
+        immich: ENC[AES256_GCM,data:UVfuWy8FjYVLFYrg6SBYj7FJgcoJ+bpIL+dLlk2oSER0rRTtwHUmaqzipckvffIirqSbdu1GXoTjYc/MuL/Y6Q==,iv:VOVbM0cYbtK+O2VVE6b/xs8aNdBfJ4e6lp2roUUNIus=,tag:fuLPsKVZkqU50cMXsIT5Dw==,type:str]
+        ssh: ENC[AES256_GCM,data:A18IevNywneZBZZoJ+RfnWHZ0O0u76Rd0MAWYaz3ntTXSpl6OjyMy+ZxN7vo1K27hCiPo/HDDVJkl6Skxc8XLQ==,iv:0nqVpJXGbiJdq0mp+iK2R2N7nqbLWVSKVJBxT99IWiw=,tag:lNFc5O+StRTbMBoDJiQyyA==,type:str]
+        nfs: ENC[AES256_GCM,data:nssXmI6kzjMvbQY8KACclBOcp/uAmU1C6cKB8PaVGasyWd4uYsznJT/eTV9PvIQRZMKlWAyGHaoWr60O+KGW5Q==,iv:groCHP1o9f68NVCPpyooqB7XhBqKYsT9Nzk/hkfKPuQ=,tag:VxoITT2iXt1pLGJfmZXAPw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1s6hznqs4cukna8ernacyh29fx6znpucmplvt3udvd7xxexwymg3suz0x37
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5TDRMQkx5YkNvakg1OTRT
+            dUIzZitvWWdvWUFHL3lSUC9jYnVIYXM0RkFZCkJWMGpFd1VpV1RtQzV1WURLVmZs
+            WkpIeEVLdTBHVEdOOWZ0QUpVWXQ2M1EKLS0tIGlpNnU1eFdlSXg3by9acVRrTThm
+            NElRc01rZU91UXVFa0N1Q053YnEybTQKsddgcnrVin/eeMwt/dTBu8UYylLVHThK
+            AuD7JNhVH+OSKtwVrgpNnfwwPDIMrnO6vZ8zyh56oHiPG0L0fdxDRg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age17asv6vjafasyup5fz0l30muu96h2xdrrga0u5fwf7qxuch2n7yfsu5zjln
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6S3FkZFBQZTFKRTRyNjVy
+            ZVBCTzhidGQxU0M3bUR3T3RpZFdtVVJ2WjFNCnhvd0tTaGptaGVMeWFUaWtnVnVr
+            WEhuNU5zSDUzMG5TM0xVTzNUSlRHdGsKLS0tIEZpR3UwTWd4SXdmT3BQNWc5NStZ
+            UzBDRFRVMGxxWVlVTzZ1d2g4MExBZjQKCMbDrUk2Y5HWAslJvsooXaaiKJexbwZ/
+            ZYLY9c2q0raiDi3s+r2TOByxsmSbTOBvE/JqrFVQPzCWtZklOlckjw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1xz7t3w8l36ls8ds264875zqtulv9vwvj37ayy87u3ccacqxax9hs6nfq8r
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrQUxjV01lNitlVzZ1UURw
+            STFDbExBMUdTY3piWWhKZDZ0bWVrVGhKMzJRCktMS3BqQUZSS00xcENKeU1YWE14
+            SnlDVGdFaDBIR2YzSU5UZm4zditJY3MKLS0tIGJwK3JNUlFiSTJNV3hJTVFIbVRs
+            T2V2aVZGbnltVGNqVzdLYTM4YkVORDgK8ZJqQYrgDqrzxg09iCISK4KWHcvI2Pvp
+            cFN7RqI1btkJyKy6vtzrwOMx/ic0IG/HLjoLhD0gAxi8fkfs/KfeZA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-11-04T08:25:15Z"
+    mac: ENC[AES256_GCM,data:LMS6G4I1Fmd8vHS5a3ECDYPfDhGyS123bXNhyWp0dSyvNgIvxQkN1Tr7nxZRciRMR9yRGK6u7N6YO+BMiMMi49S8OeoA7shrvf36Sc5e1CTo55VziZENCs0GglKJBkslzuvT504oI9wVl54jKQ/MU6FGp2n9vVpx3ZB+rlpHXWs=,iv:k+wa0E5Q5vx3WxibciaczhjQOBKqKw0ATt2rlsDbWbo=,tag:T/btVbCYJZ7DqWfzg9VjQw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
diff --git a/bombe/data/home/tokens.yaml b/bombe/data/home/tokens.yaml
@@ -0,0 +1,31 @@
+immich:
+    postgres:
+        username: ENC[AES256_GCM,data:ndf9cw/4x5BjS9tyShI=,iv:7AnlhU6GHOtq5XbK/+ZOklXiG49xL6T01eN7bLlazZg=,tag:0vgzqf5/xA8tYMZ9kv1t0w==,type:str]
+        password: ENC[AES256_GCM,data:iugREo1MFWGM+g0n5575P7iYtSYGfJWxHzLg/w+hNvhvT9oEeAJC0JFE/p3p13QTnW/7ZkbF+DJCcbe2tP9HEA==,iv:+nReb/Wy2ozYk5m2kSKsWbVgavUrjFMsUzKwcf8/jXQ=,tag:XW0kU035JC7gJ4rXPB+7qw==,type:str]
+    jwt: ENC[AES256_GCM,data:sehMmosY3di0g6sy4TqANF2O4/Zsvhu2qEVyVDRm/3eXk1+5yOaPnAtIKKCl5F+cb++O0uY5TbG5MFWaNZ55vQ==,iv:DXFA/reC9uhtqrXksohrsc8KLlq/V7XLC77OY5VPq/c=,tag:VxSSSLHAq250up4BXl44Bw==,type:str]
+sshca: ENC[AES256_GCM,data:Qmm4K05O8MBqgWm5IpiIttFANb6xNGzx0mjLDUqknOz+WHDYyFHmCZXWieEcVdC3yXj7V2RCS28R28WGhvkXsaoLGcYSLkC6XnX73rVJlx8SjLi0GiMw9avlAXyTZzJu0fpyJiMM1z2EZyFeZBLbo+jtd73G2Xd2FQd5KWWs0LZddm3fRGz+R0ggLPrp3rUvDalebHq9inNE//dKqH6QnzGucOJ6PEhp6fFgRhP5WhtWeO6gy2CV9WgOUxO+UzbTKDaJO2D93Vxxg4RXrY5hoA/yzu+1XsQSPsO1EpJJn30jTVeUjb2lQzc3MVZjX9q8gdYfErlAmMpJM5KsUWE/SizUXnNGOSiTX4+ScyRgJDCvr9xmgET8SZ2frlEgR4+6yWdUo/AiDU2bp3qkFtjTXcgpM2QuiVCVSoFgAlfKy8jKkw2r/OapqZFYwfil9at0GncU32WBo3HnZa1sjCtHQUdiPE8U4Sm2T3tALvL/udO3TBqr+O4EjiMyxR9okgon/F+j2S50vMIe8kQNit8B,iv:ckYqZDLrWM49NJMuLVOaRcnxSKIuP1Weg9pz/yBFovI=,tag:7gTuxSp8ZirBfFlam2V5FQ==,type:str]
+hashed-password: ENC[AES256_GCM,data:iy5SM/NYRqGMamtBjcuZBXxI3jvrhwCS3sZ7YSv4nxtsuO4mxRj+onEhDo6QNJniiFrMrDvX95G4lgYIXKPxCq426mK1ENIfTMJOI4XQBXQ+i9k9gd7JfxRgN43UBDkVRRgcbkRk3FyPQw==,iv:ECU2xVphKmshCO/T50aDVaN+WsofJ8Vx3mmoBREEg0s=,tag:Oyo/tyGa9rR3ocOf3J3KLA==,type:str]
+wpa-psk: ENC[AES256_GCM,data:cSc2ad/nvFc=,iv:Sq6YAFZS49eQ72v8K5ATKB14jlJJTR9LWmTuPiop1DE=,tag:tqlDK8BSwt0fQ3WcnsT96A==,type:str]
+rathole:
+    local-private-key: ENC[AES256_GCM,data:LkOPjyeVeBuLss1O7y9C9H3ZrtE/hN5f31Z0wKr2VleoDit8EE/FB6P0xDU=,iv:GF74zAz6z/sDOmylAsRLb38162AdhzeGUuBbH7BHsfE=,tag:bgqt1cNYVsClLaTE0nv1XQ==,type:str]
+    remote-public-key: ENC[AES256_GCM,data:weM163wSgqwpU0B+48WIKZUiDIQ9eu+8dqtIiJqSPqoTceQJZ6lDPl1sAWw=,iv:kuIhZKo1Hub3hfuO0rFJjz9C+gRE++wFh70Rnn+bMqY=,tag:ZrvV3IzaBDDmmWpgYY1qng==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1xz7t3w8l36ls8ds264875zqtulv9vwvj37ayy87u3ccacqxax9hs6nfq8r
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuaXU4aXhKYldFQmIzcENO
+            SFVoWWp3R0gvYlI5S2E0eEFQQ2E1S1RBa21ZCldkQU8va2ZMMXQySUpmMDdkWFZq
+            ZGc2ZDM4d0lGb3VVbUpOWnU0YXhtWW8KLS0tICtpUUI2S0FUbkJhZGdYY0pjNU5i
+            VXROYnlPWksxZURBMTNZcWc1YkV4dFkKwaWOkABCraSbPXHcoTA54D301nU/zB0Q
+            xZ2vghMvz41MQxIKS+yXPiAUX9ex37HlS8t438JaAMOooFaq77IZjg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-10-31T13:56:15Z"
+    mac: ENC[AES256_GCM,data:5uRR0X9+PPQVwCuCraJhUfvBHpTUBN/l6Rl3guqts5kpbiNFvUkqsWH989SBH9QIn0UQ0LoKnLW24YyCb/tqmXJHmBiai4gAyak8CPYZGd5UWXnfLBUE09d1aFIakoNPnVZXedTKdyo/OdPeApMUuB8mzzyhu61S4GOPEhJ+H4Q=,iv:dZguzbIB1hjtINIIFcG9rWqmnyllr6ifva9HLFpZqIM=,tag:M6+Bu2iXDoHGBG3PEbByhg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
diff --git a/bombe/data/local/tokens.yaml b/bombe/data/local/tokens.yaml
@@ -0,0 +1,27 @@
+vaultwarden:
+    client-id: ENC[AES256_GCM,data:KpsWBu0dgCN9/ac5fBuo3Why+Ydm7rs2yGMCAMUzrOdtucvwUM9PS5Y=,iv:cfW9m93AUUs81OjufLBlJOIbpSxEGvdGJXDKgP+lJrA=,tag:HXzy++sM1QoYdeMUJJ5Zlg==,type:str]
+    client-secret: ENC[AES256_GCM,data:CpVCo07IZsObU3JHhH4l+BbDlgwJoXSBmbdY+GVf,iv:EHrEUXI7uXN08o1sdIK6e9J2c4F9xcUyiMlWx9ZteJk=,tag:HsoJa41auKbsi3xPKilwQQ==,type:str]
+u2f: ENC[AES256_GCM,data:3T8JTVcUntTlUbK10qbVhopa1WobIxG6Z4TeenxJtvN2V4asx2VIaAMuE7P6mtElicP1AblXVRQXONstjcggcw4mjw8dWdhtFP2KKvohGaJLWoRAqM1ebXvfiwsZ2sXZtrj1KeXHAecK/yJIzk0yHTt/TuOL657Sw6CP43n2qtleX96m6M1ekhrYZS7K/7gQ73kJUnFBfHa8VwE3P+N4Raesn2AZUMMbwDvk+9ESvOxvTT0rmOaBYrh+i82iUIGikWElzmhLn8U=,iv:59fhfG+vhTkHGzgTrsIxZAQAtvkPoDDzW8BVy+dUgfo=,tag:lOF1N4sbgTrEPwRZ3dUneA==,type:str]
+hashed-password: ENC[AES256_GCM,data:CtSOtN8lpVBgcHv0m5M1XsIgpU/hgCwElD6ZZPuICakt0CUvJae7p5ZbZEJbMxb8P4xvFvwQRsCsdVxEGTBdTbZNtzF6sYJISza4HUzYrleX2tw/u+054O0MbLb9jJgQa1PT,iv:g8EKhGB/Yg/UqZN3fco55XdnxUoW1KL0khssskDPolo=,tag:14DL3nqs9VsdqVAvJnw3aw==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:zFcaBJTq7YSit57V0BW+bRTHzMGZ8lkt5hj32PoXePIvAd6zlHOFaeyPvOs=,iv:CT4JZXp50plQEeHvHI1hZHW/Aj+ROicz6tjtqLlsQlk=,tag:1DTBEEz7rQKtPKKV2hxWkw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age17asv6vjafasyup5fz0l30muu96h2xdrrga0u5fwf7qxuch2n7yfsu5zjln
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4aUgwVkIzTlg4Mm42OEs0
+            Q0tzU3daRWtMMTNKNnRXNHZBdFhWdE5pRFE0CkI3bHU4aGxBK2VqejBENGJxOHVy
+            YzNTTlY3VGVSY1oyc0FSUWMvWEdqWEkKLS0tIHRFb0E5M3EyRDlyYzlaSTJDZ0c3
+            N2FRS1F2RzZDWEZ2U3krZi9BRCttdlUKVh1ezfFBN1P7NxbWanoIRzjEf+QzkRSb
+            tvVh8sOkQ6l4PVDZTFQd/XR4CzyxAzElHlUCikb8EHZiza+FGYwZPA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-10-28T18:24:50Z"
+    mac: ENC[AES256_GCM,data:2DIssLxm9jG1aUsvcPKOaEJ+LuDLTzaopK6/F2At1ew3KU7MKl+Wvu/rX/9SHxb/GFuPDSrQXojGthYp9f6Rk3BVS3ZPWdeol57Up0lJc2QyfUtNvz2OloK4/7vD5EPcX4Va7CqudcuN7Lj+1am11lqN08pR+9p7/DjIe5ML6qs=,iv:Rl7H0WvHyPuOOFS8Q2crPUBh8jQ3iIeUFQHxvTUiskE=,tag:r1wFskN5nbMFO8gm/vl2EQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
diff --git a/bombe/data/server/infra.yaml b/bombe/data/server/infra.yaml
@@ -0,0 +1,30 @@
+server-age-key: ENC[AES256_GCM,data:YYzcDD+Md6vD6bujCEBPrAXUkuda98vpkrQch3dJNWQv+DLW7tFF72G2tM1PHrZxjBtnjrZvojSqrmsc/AOQTIeMQJ151Lnxhmc=,iv:p7R3wNBrCviOtHQty6AqWnQC/HLyNT6yzdGTocZMDOE=,tag:Zrn/uEnCTPSA1sYPiCBfLg==,type:str]
+sign-key: ENC[AES256_GCM,data:3SqzswF85cw/wrGici+hDBbZonRW9AY/uiaUJZcim21pPeHweXRdiYdr0gctnM/qiK+XsHLJkV1CweM9RX49SlVtB50wro8ch98jbotufQvx7tDyqu2JelMFfb7E,iv:+CcgPJQ2UlVl8Xf3qOZUcKJkPnVbd/u35CjaNwxgF1M=,tag:MSJ2EFtYaYlKVobxwphxCQ==,type:str]
+restic-passwd: ENC[AES256_GCM,data:aTyNti1W7JBAQWFAK2foff/QrYytbDQFTMfPUbIwGqYZOncos+nCM0AtwekdWCSIhThGY+z72KGiPFtFUfe5fQ==,iv:kapoz75Et4kRK21p4jCm1f89XmCJLpm5HJD3DOApKPA=,tag:sTKfR+gj1gc+8QwG4mYYmw==,type:str]
+api-key:
+    vultr: ENC[AES256_GCM,data:Dw6z38ouNVvK/GpC2JVmM0uiNTsxJ6lLVGMf7PEeDp8s/Tof,iv:gTE86S1u0D2+yYFSMq2JYtxcFMS8azp1SXbP0dYWrvY=,tag:UkLSfr2YsBnONWcVO33kAg==,type:str]
+    github: ENC[AES256_GCM,data:bommqRSGRlu73QfEJ2cfJrzwRNbZ67JKexP9gZqlaF1LCAuQLLUZUw==,iv:HzxOkZ1JQ4vaJxzxkNRi2CIsHvxY0+W5gIb6tSu7E60=,tag:cULMeBfeOUOsZnRsdlvOPw==,type:str]
+    b2:
+        id: ENC[AES256_GCM,data:S+SRbb1PKyXCnn72tE63HfYlRsJocf7NXQ==,iv:CmbY3he8lZHbk2R8y9mZc5jL/lCrKMP0rAyO/bCKfVA=,tag:DxSV4M4eBwdxBkWQCJigYQ==,type:str]
+        key: ENC[AES256_GCM,data:GN8wai9R54xOY8jBcYqjBsgu0Ma0xP3nfaOU5/1dGA==,iv:KnLh3JguNd/HYMemCKvOQEr0hWYSVLca1tlXRtphbxM=,tag:DHftDhHwbvaqkKsyqafeHA==,type:str]
+fqdn: ENC[AES256_GCM,data:psnEm2nW0JeBLTgzOtw=,iv:1OYq5O82Ja5ty3jA3D04j9lpTYiZiUnKB2e4ba2QCFw=,tag:JaYOelUaTV5aIy/Nz+TvaQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1s6hznqs4cukna8ernacyh29fx6znpucmplvt3udvd7xxexwymg3suz0x37
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQRXR1YU5wNlRYdVk5Y29F
+            dy9HdGpuZjlGZ1h3ZkxVcGJMbW5LbVBnTUQ4CkhsY2FRelc4VU1FKy83QkJNeXhs
+            MjlFMDJFNVdyU1dDdGJUdGJrM0I3ODgKLS0tIGhuL1ZxTGpMOWFUY2VuaDFWWWNn
+            OHFXSmlNSGJldi9GMkNDMXJXc1B4UjgK5irPfdZ5lk+2SJ6rgMFLY2RiqFZZ34Sb
+            EG38r133Hu68ZIsVThXbftzkTjrL4qOOFv2CGgQrcMENSlj41+SYsQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-10-15T16:08:27Z"
+    mac: ENC[AES256_GCM,data:1uGUe/YDGVWAlTPZvnarGaZYL374GO9m2NRYhb5Fp8WAmJhzmRF0hZh621FoLocwluUgZo5Dn81igaSYvjmlVa2CCUrjkSeD9SWIsU+OWAptj5QFLjrHX7oeqzAJX66fmvi12hsssO3WHOvq5X1Pqa9Llu9/hsEB5vpARdISjYE=,iv:n2F1jlc+bbeNVbA2LHlz6jvkCMYg4kIJxPdi2NHuvsY=,tag:nrmPcStF2pHu5G8j5KFPJg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
diff --git a/bombe/data/server/tokens.yaml b/bombe/data/server/tokens.yaml
@@ -0,0 +1,32 @@
+vikunja:
+    smtp-username: ENC[AES256_GCM,data:HWGDz+8/oBhidR0fEjeXpVgAFw==,iv:h8CGUx3R5WksRboVmz0t7BsFLSccBbczt2W2/15vkG4=,tag:/w2qM/lefRhu+HWmxZlWYg==,type:str]
+    smtp-password: ENC[AES256_GCM,data:oAGl/TrD8UfYfm+wgbT6VJIJQrul53Z4Yq/jLZbRyKc=,iv:ofcPKPgtlzbFmHxK2kQoiJvbDO8ubHQFADDNzZ0JFUE=,tag:sG1SQjUdrZFBG2MhNg5H9w==,type:str]
+telegram:
+    nix-bot-token: ENC[AES256_GCM,data:iomGBHjAGcxno8/2Bs2LZpuSIArhFD7hzND3KgHyjCeuom9FX+Z4wW5cb3vDMg==,iv:0o/kx1vt8UEiMa64alyPca7SND1X3LZXHxhaAzINCuU=,tag:aIqvzmiYomxC+1YLCpVeLw==,type:str]
+vaultwarden:
+    admin-token: ENC[AES256_GCM,data:MrfQeB0uBDF331IwgHgvGb63kcLtVIB3TxuK+xpAAL/ValX6c2qi8zBx3njSzxXTX4vR528UNklVtLvclanO+iLgPKdedrMnfMMyUI/dt/mLdTEqFZ8e2Q==,iv:/E3F9pCjpYJKlFWOrZ+j+BlpqZrE2z/RnnjO5fw6he4=,tag:DOE4jmZjQvFf1xIyA0A7lA==,type:str]
+sshca: ENC[AES256_GCM,data:7aPY+6E8ZHYxW91oUZgY04v6pneG9k8/SMTtnpMrMovWqXPkI+W5DqJ2rFIM33A+Qxq79fDbStIrAD0IRQrr7Pm+1BzAajklNCnmwzR6htnln/jwwz2EZdj9RZ0Sj7IPxoilKojt2NF8z9PVvaSnFnmVe6x1/+fTV4Igy7bYgp3fytFpP42KOcYA8viKjHT1DxImLWgb9Sid6QBzTpUjDM4n+Bu9ZNuLQqB1pU2jhJS1OvTfMy0ncE55+yV94Lw90+Thnc9LMmUwqqwZg8818vzjnAjgS7NmBtjaxrfR0BA23PMlLGxXjnyLOeyrnEPZmQfsLoNuz1pD5111xMEnO0ezWt4NETRP33rp+oZuvLkz+GrrR/CBSQHtcrwMvP1yFakHhuEzYHLC6+sLHuOGReYuvuxtmB4qpGjZ/f4jqzLak9EBjF9+IpKrUD7xRLcmTEb2P6E+st9mc28UzO19PgAhX7EAMHMmvGJh5S7LPwlT7Iuq2mKVIR2i+QGsfcesvwxyofeXXLQfx7qeJMIY,iv:nM64qCUk7DMazyR6vVr0h9uxKPfCSIxKT4KtNx5fOKA=,tag:nxO99G9G0bJV8CAdKC1tzA==,type:str]
+hashed-password: ENC[AES256_GCM,data:xzLQ1kCmvWmVGBeOJMsmCwQeCRf0S1mpBpAC+ygd6QMz+LU3d8SUYUZY2Hdp1vnMe/FBRryqYqtmGi6IWWDEIUI58+2GcmGGS7nbiKQabdbK8YHKbZUmdLl08+HLVbUA8kgNvkhVJhphpw==,iv:n81UqR8OuBrkqCMnVkbvJpCwRk8ZwlZMXMWZN0fVQM8=,tag:V8AUtVlC7Ty9MLaZinhwtw==,type:str]
+rathole:
+    local-private-key: ENC[AES256_GCM,data:zzXxyGA7uFWHjAfNiEkJw8fJpC2weV/g2nFcXKwpdlPyOgI+xZ3A8ufO5Mk=,iv:hkLWJh6aoxjdkKhIkADZScThv/Y5PDTAnu32Z9pNs1g=,tag:ZHSnTdSUWUSF3NnRF0v6Lg==,type:str]
+    remote-public-key: ENC[AES256_GCM,data:gOl66NQ/abJwLzUH/xyL7TcR5eGjM//Dn7UR8hHcQw2lRWlxVh2YHTsWU5w=,iv:fe+RlcWfEFYtMXrYcHXTvd93IYhT0QaTzYhazE9Yjkc=,tag:uBdco6idKSSakl6jgMUuzA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1s6hznqs4cukna8ernacyh29fx6znpucmplvt3udvd7xxexwymg3suz0x37
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBINFRNNTlsQkpjYWxjYzJt
+            RlpESVNwcU5oNERiZGxPQ2dkU3FDS1A3QnpNCjAwWElWMEp6aWZDMHZTMUFSYVlN
+            d0dGVGRZYTJOcmozeWRtMXRKdCszTUkKLS0tIEh3YS8yTUh4K1FBRzRXYXlWTng1
+            WTk3cll6SEJ2Q0xzMmlwNlpvblA0NWcKmvk1LcuXDBeQbKN4wcbSO0l0dzDOcqZk
+            jrqYZfvKsOZLceD33HzvowMK/NYIsSH7BhL3iTgI6MCBgAt9PoTFiQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-10-31T13:55:34Z"
+    mac: ENC[AES256_GCM,data:jOUqMYq5cBwijuVcKVKw824f/yDKM7kPkoRh7zwiGYNKpviumxJZ/CGOnHxy0+SEjIY0zo4zw+ySkfzF1xY8VHvavZPWuXYzA49qwDjwbuqx0Xt5NEFxGAhRgS8AZU1zCFt8eSV8bu8dVZiEAAQFDjzDgCu1hhJfuh+GWBcIP50=,iv:iGOY7m5UuXQb8w3rk1C8i6MJZhm9mWItwxjgU7Y+yPo=,tag:o43xWs45N+yiKdGKxWU+uw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3
diff --git a/bombe/default.nix b/bombe/default.nix
@@ -0,0 +1,49 @@
+{ config, pkgs, lib, profile, ... }:
+
+with lib;
+with pkgs;
+with builtins;
+with lib.filesystem;
+
+let
+  isYAML = f: hasSuffix ".yaml" (toString f);
+  importYAML = path:
+    fromJSON (readFile (runCommandLocal "content.json" { }
+      "${yaml2json}/bin/yaml2json < ${path} > $out"));
+
+  keys = profile:
+    let
+      sources = filter (f: isYAML f) (listFilesRecursive ./data/${profile});
+      contents = map (f: { file = f; content = removeAttrs (importYAML f) [ "sops" ]; }) sources;
+      generateKeys = attr:
+        concatLists (map (k:
+          if isString attr.${k} then
+            [ k ]
+          else
+            map (subkey: "${k}/${subkey}") (generateKeys attr.${k}))
+          (attrNames attr));
+      keyFiles = { file, content }: map (key: { inherit key file; }) (generateKeys content);
+    in listToAttrs (map ({ key, file }: {
+      name = key;
+      value = {
+        format = "yaml";
+        sopsFile = file;
+      };
+    }) (concatLists (map keyFiles contents)));
+
+  binaries = profile:
+    let files = listFilesRecursive ./data/${profile};
+    in listToAttrs (map (f: {
+      name = removePrefix ((toString ./data) + "/${profile}/") (toString f);
+      value = {
+        format = "binary";
+        sopsFile = f;
+      };
+    }) (filter (f: !(isYAML f)) files));
+in {
+  imports = [ ./secrets.nix ];
+  sops.defaultSopsFile = ./data/general/tokens.yaml;
+
+  sops.secrets = keys "general" // keys profile 
+          // binaries "general" // binaries profile;
+}