unbound(role): fix systemd unit of prometheus exporter

z9-router(host): fix systemd-networkd configs
unbound(role): fix unbound prometheus exporter install on debian
2026-06-22 21:09:43 +02:00 · 2026-06-22 21:03:12 +02:00 · 2026-06-21 20:13:29 +02:00 · 2026-06-21 20:07:59 +02:00 · 2026-06-21 20:01:55 +02:00 · 2026-06-20 18:33:37 +02:00
87 changed files with 2352 additions and 1590 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@ -39,8 +39,6 @@ keys:
        - &host_mjolnir_ansible_pull_age_key age1hv7m3xypesdfm0dfzwgctde8v307g9xaunnfu2687y0lagcs5q7s3eg0kj
        - &host_diday_staging_runner_ansible_pull_age_key age1522f3qzddm82w63j7ajdkr0khvced6ht7tzp3grvp0j3hewtvesssr5kpf
        - &host_auth_dns_ansible_pull_age_key age18zgt4y2sd75hxnpe333zz39048ctxpr0q8a3uqh3jajjkyawsdrq8yg5ve
-        - &host_forgejo_runner_ansible_pull_age_key age1az0k6cadssk6r8qcqxfr8cyu5mndy59pwt8yqq6w065ew6au4ezsmg2vkf
-        - &host_forgejo_runner_external_ansible_pull_age_key age1pq1jqrcp3te50xugmv5wst3s9ahj0d38rfktxt43wlcqz7vnwyn3y2h7kyfr6rckrvmuk9m7yvp4efjnfsuxx6d8r9gn222r2eal5593arywrjwrgeypf745wyuvf3z2xk9tm5fgnwckftuvdggk66fph59rw69nt5dpjeewuww4vzt9gs4xelre952s7zjz56qv8tvesg2c89sp8rmy9dvhwfd6tucjhs6sjr6yp2njjra2u6w7c7f0sch3rwkw3wf2dc9su9aaa9q2f22sh5yf0fqejxa2qqpq4pg752589st5xsa5g8tpkjglj4tn35gd4hjj0xet9cjwhydmkmmkffy3nr8zdtctqu6pqsyf7aphvktryez39ru3qe7m6nvr465ffxr0ltvr85nddzxvcwpwpac64nu5tdfrxgjfqzc99vr3zxv8carpsw5evmruqlvrq6v6a4m2cwsz5gqw7nyk3jlj75kp5cnafzjn5dyrf8ppfhp5g5s34zsl7pejmmx2uuudjt7ru2y7as9mtagykrgqgt80fvp3eeh4gsmmd3ujgtp0ranq28aq9x0xdekqh49pfhhprjj6zqdfac5gxtjj736kh5jktc4ls4mjs3p33rzt6ze54uqsfept3qhua2pmugypup6hm6j2ek5sgxjnwvqyfj2l8vz4yfgkaxf699v7jqlwf7g68ang5kzqrjsu78lyardm4zen8zhrr24j334qdgs4zr8dhsfsnmvx9cdvu0swx27tcz8txs46zds9kekgmua7w7fnw3l2lf6zla956ssycac4zjy87rawr4thusxtcqgfzfzh2za9np0s34e5dwkp2l2k06cq09myxqfe7ze6a53d8sl5j43qcekh6kfvl9k0t7903q99pc35630zwm3hwxgnw354du5gngnz56skq9zx3pcnkr5eyh8r8t0dqudmvrrwmxreu6tgrklxw7yvu3zkjgt3gyjhc8kqcrevlukay45sz4k9zqxx9yrs88hzt4h52r2g74alf3cedes3atufy06q4lfq3nxdlnve0kqcwstzr6z6u7fqpqvacezdrr62ycteju6dqawkpthu0drtlxj547htfjcsnrmhgvhskwtuhk6yp7wp30p7qc5vkk8fegg6qx5kc9xs4trx7hj9xgydu7vd30hkceuxsczywjs9v2fl3svkwfypg62882yq6ltv7gfj4ajuy8ezd76g0z7juwspe7q6zs5ceshd6038tvvh2nlpjty6rg6a9qfzhgmjx9s6hynyk7xnq9zra6hxstg8p58x75hapd2mk6rapfunlnnkz5dsxjf4ud4dsvgjfjpzxcdy7sp8dzxtengrsdyu4824mqlw8p63d7m2z4mcyme4tm2qkugtdgrkyphe7akk2geukf6xkfkzd2pkdq5s3qm9fkvfkgrv6yw5kdgjak8xcgesg6tumans4fs8yrxtqlvv2z3emdvwchrjfq4xpzsj27yt4gdg8pknwz9tqpjkjxq6lysutrvwkvt2fwyj8wvv8wtmdl6fk6rsd9kq9a6wkhuq7vvrgwgj3xg2s229sprj4g2vzhy2dfesrp403gs64jqkrjuezwm4zd6uw2x4e2qkj8xqcf7c0zprdzu959x23u878vqqetgpjwt0z3kedt8l6dgpm0rf5dmrya5h3wgzfa0jjvgjphyxgxrwlrzpv4czgal933zs64tn90ks66ejjdaw4t67sch8r3q0kljeqnpdgmw0cpj6arc6k46wcqaccygczy76zt9362vslakvzqqv33tv3sjldp6qxprharmpm9uykgpx66343wuur5xj2aw0rgutpm4ztjzycn3a8d2jq2zpdzwmevezm7mkp9dmndkc3qz0kklgkxq9yehrk5ayfly97umhws0jll8qqg0r7gzxgw5vv76
    external:
      age: &host_external_age_keys
        - &host_status_ansible_pull_age_key age1p546j6whqsyfkjuf674lawrnk2ex653fuvwhcwt46gkrspkq59sqzm5y87
@ -50,6 +48,7 @@ keys:
        - &host_light_ansible_pull_age_key age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q
        - &host_waybackproxy_ansible_pull_age_key age197tmckjll9999v5apqh5h70dktdxzxn92uyzce5j7jmesvnneecs9p7m5j
        - &host_yate_ansible_pull_age_key age1yc9s8r7zt6tc7scfyxc3345khdwqrx0lwj4z6yp56h6rmauev50s5yqr22
+        - &host_z9_router_ansible_pull_age_key age1tx03yh67f052jzehvtvzmhe5ja6ca0rlugw8pr9v7q67z38w2ahs2a4alp

 creation_rules:
  ## group vars
@ -211,18 +210,6 @@ creation_rules:
          *admin_gpg_keys
        age:
          - *host_auth_dns_ansible_pull_age_key
-  - path_regex: "inventories/chaosknoten/host_vars/forgejo-runner\\.sops\\..+"
-    key_groups:
-      - pgp:
-          *admin_gpg_keys
-        age:
-          - *host_forgejo_runner_ansible_pull_age_key
-  - path_regex: "inventories/chaosknoten/host_vars/forgejo-runner-external\\.sops\\..+"
-    key_groups:
-      - pgp:
-          *admin_gpg_keys
-        age:
-          - *host_forgejo_runner_external_ansible_pull_age_key
  # external hosts
  - path_regex: "inventories/external/host_vars/status\\.sops\\..+"
    key_groups:
@ -255,6 +242,12 @@ creation_rules:
          *admin_gpg_keys
        age:
          - *host_yate_ansible_pull_age_key
+  - path_regex: "inventories/z9/host_vars/z9-router\\.sops\\..+"
+    key_groups:
+      - pgp:
+          *admin_gpg_keys
+        age:
+          - *host_z9_router_ansible_pull_age_key
  # general
  - path_regex: ".+\\.sops\\..+"
    key_groups:
--- a/README.md
+++ b/README.md
@ -2,7 +2,7 @@

 Folgende Geräte und Server werden duch dieses Ansible Repository verwaltet:

-* Diverse VMs auf dem ThinkCCCluster
+* Diverse VMs auf dem z9 (PVE Cluster)
 * Diverse VMs auf dem Chaosknoten

 Host-spezifische Konfigurationsdateien liegen unter `resources/` und werden für jeweils über eine `host_vars`-Datei im Inventory geladen.
--- a/inventories/chaosknoten/group_vars/all.sops.yaml
+++ b/inventories/chaosknoten/group_vars/all.sops.yaml
@ -2,433 +2,384 @@ msmtp__smtp_password: ENC[AES256_GCM,data:xcBVBTb6mfr5Ubyfga9ibKWKhrfrEEaDWD98vI
 metrics__chaos_password: ENC[AES256_GCM,data:al234VSAH7oxka8X0hTvEJKVLD6O/WCrCKfVLLvm,iv:+TmA+0hXMV4OxvK7RH2g1dIzm88Lpm3zevxSZxK23QQ=,tag:txCVr5SEW3dVHgNFInR94g==,type:str]
 sops:
  age:
-    - enc: |
+    - recipient: age1ss82zwqkj438re78355p886r89csqrrfmkfp8lrrf8v23nza492qza4ey3
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArVmdjZ0ZqeCtBMVZDQXRa
-        T3hJZXhDZkRYOUpXTHBydWtsSXNnZVZYckFvCnVHWjQ0dXdwWjIzbFpkWmRoa3cx
-        TlJ5amhrOExBaHowb3BqNjlpaUxPTW8KLS0tIDF3NGZIUWs0aEU0TlcyZmZSa1Z6
-        dUdSUVowYUh2bkZZL1F0eVBwekQxbDgKkhdASE+YCLmk1o1/m4thUG0snNX2HIeP
-        rNLk4ga516qNBCensSpN8N9jNgupOTMbCXHDOL4j3DbMklk4oi/07A==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0SHFlOFVSbisycXk3em1N
+        V3RvaXNNOFIvdDJobk9kSVBmOG0ycCs1T1E0ClZ1NnVGK3VNNVplQkxjVUw2dUxu
+        SXU1RjNLTE5mZm5yUVBDa0NTTkVhck0KLS0tICtpTDNmeFhWazk1U0FQd21wM1FZ
+        RkdwVXBSK2xySW5qMDg3TzhVeG1Rd0UKXfj3aSYJWBn7EhsUgHnreeARsjWfjs6T
+        79kvBkQ+Ovn9zvUZZ23I72rtEjab3Wt9gK2FdmEWVkHYS0ZvA8ymbw==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age1ss82zwqkj438re78355p886r89csqrrfmkfp8lrrf8v23nza492qza4ey3
-    - enc: |
+    - recipient: age1gdfhx5hy829uqkw4nwjwlpvl7zqvljguzsnjv0dpwz5q5u7dtf6s90wndt
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYSVJ5S2pZb0c4SlpzV0NI
-        aXRvUnZDN21KN3NoeVRSMkNFNDVpRTIxV3lBCmRhSHdBYkJZRitndy9vTUhTRzNu
-        b0RqWkloaFhaOTFuemJES1ZkdlZVZ2sKLS0tIDdvaVgzcE1XcmR3cUJKNzdFSEhV
-        NzJ5emJtOTNDbDIvUG4rc3BXcGM3SmsKEzinKFMsJwNByhm0Z1fZGqGHuHOzkbcQ
-        XMRtfnncFH1AY4Ameav0+lqZ0eXyYb+Z1xpCV+V5yQ3mJQnbnnMqMw==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5dTdXN0xPaWliOGVqS2NU
+        aCt3OWl3K2FXcTlYU3NDOXhGc2paRmZnMmtJClN3L0JJRXZDeWloaGJqRURWU3ZT
+        Sk54TGZHdFF6OUkrTVU4RDF5dXpIeTgKLS0tIGM1Z21TZW96TjA0Mm1WUGZoZnpF
+        WVBJaTUyQWpyY2ZZeHM2VXhMZ0VvSmMKTfmZnaNx7jz320cco7HThAsOPsnQOtCZ
+        MbVNfu7iltvgQDhoYwhSrnHlqFV4ogeacT2KXS5mO2M7xZK7N/IegA==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age1gdfhx5hy829uqkw4nwjwlpvl7zqvljguzsnjv0dpwz5q5u7dtf6s90wndt
-    - enc: |
+    - recipient: age13nm6hfz66ce4wpn89fye05mag3l3h04etvz6wj7szm3vzrdlfupqhrp3fa
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwNzFDcC9rcVdaR3kxQnlI
-        UjhxZXMweFIxRU1lR3ZyY0JIVTlVcmZIYUdrCk5SV1RRT1lqcm5lU2h5c3NvZHBG
-        ay8xN1NPSkZ1UHhUazJmcnRrZkE3UTQKLS0tIGh2SG9NN1YydjAxTE5CaWNrbnZa
-        NnpkVjBJNGhCaStiakdMN0JFZFA1MGcKVqrFb6S+InLLQWqC8/RwrrysAf+3KMLJ
-        1Y+4u3VdzA3BlU6cPNbeOYvdCnOo/qO6a0omHnrtls8e9ZVFB9Wi/A==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAySnZSb1UvOFJGZzFCWmZl
+        MzgwWGxTOTlIM1lJVjBRRmpXc1YwUHQwcmtNCmRFSTVFUGFJQ2dSS29jNWJ5QWlP
+        RTIzcGpCWmEzVUc4dUZRVy9uSEtBQlUKLS0tIGUzQm5GZ2EwZDY0NEoxME1ZTTll
+        Nks2Mzk0M0pCZWZ6ME02dWovSktMMWcKgHTs5kzaIpuobI6KbjzWB9W2VOh50mB1
+        Y+Z99tY96p47nRKOrYCNxkPMytxZEPZYg2hkz8gXH4UKC2eHJj6+Dw==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age13nm6hfz66ce4wpn89fye05mag3l3h04etvz6wj7szm3vzrdlfupqhrp3fa
-    - enc: |
+    - recipient: age1jtusr294t8mzar2qy857v6s329ret9s353y4kuulxwnlyy4dvpjsvyl67m
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQaThDV3YySWkwcG1Ucys5
-        V3dLZGpKMUV4M29kTU9PWjVDa0E1Y2JpdG5jClZJTk1McWFFU2EvdHdTeXQ5RTIz
-        bVE1WHJTUG5lc3hjZG05ZkM5OG5QMmsKLS0tIE9qbFJYTmJIeC9NeU9yUFJRZHQr
-        eiszNk1LQnZyVmhFUGdva2ljSW9ndlUKx1ba5S/jCXTiXIa+6uOzgbarXNYZ8BeQ
-        PteQmwTk68ic3WiEHi0BTGW/Fx/vVEPAgBAZZd3Ea6gByKTmeRFKIw==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxRmpQTVVqTDNTYnZRYW0z
+        Q0VWcitOR2VYc3QzbUdvbVQvamptaDh4Q1dvCkhkMWNoL1JPcVozVWE3VTBtU0R1
+        L1JwdTd5WXNEam1KeXFBSUVaeFUyTVEKLS0tIFNmWkx5ZWVtUGxMcGl2dWNWSnpy
+        WWhVSzIxblJsNHZRZ2JseFUvNmxLclUKh8akajMIkvAdYhwG9AAIB4br8EKJvVng
+        Nc4E/bUm5t6xxw7SVfxJ3HXWHYT6O5zC2sOspGi39oodgUKtQdwiGw==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age1jtusr294t8mzar2qy857v6s329ret9s353y4kuulxwnlyy4dvpjsvyl67m
-    - enc: |
+    - recipient: age1a27euccw8j23wec76ls8vmzp7mntfcn4v8tkyegmg8alzfhk3suqwm6vgv
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBad0dONG0xaXVzSEx0bVc2
-        Sm5Wc1h0cXdBL00yTUpSWHNxWUczdDdibEFBCnAxekx6dkJJNWFjMVlILzZNRkdh
-        dDRWVFovVitsZVI5WnlBanZGZU9yRGcKLS0tIE9zM0ltT3h3RGZnNDB0QmVCVEpD
-        di9PWXpLc0ZCK28wL1V3NUNNN285VzQKqY3LelUaCtWM9vl0eLEVgtn65+Dfch1o
-        IJssAkB9pSSyUeLAs9hrFdLYjwKG+S8XB2Suw9Y7XXdYqE7dSLMiEw==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTejVEYlEwZE10OGt2TTFn
+        cDdVV2VXeGpIclhCMCswTGY5UHlld09RSmdvCkYvdzJJTGVYYjZSS0xtWk05MWtr
+        ai9tQzhJTE92d1NzQ3hpZEY2Z0xzTUkKLS0tIDhSbnR5UzJjNjN2SXlWUlJubU9a
+        bEVNK3Y1c29DVXBCRGQ2Y1dOejZ1WUEKh9ehZCtmNeErAPbfFdjkE2Bs5Y+CuLtL
+        bgoUrGv8rBt+rmtgRLSBAj3frYRsR7kA5TsYtcVF3CBGqsZuCn/8/Q==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age1a27euccw8j23wec76ls8vmzp7mntfcn4v8tkyegmg8alzfhk3suqwm6vgv
-    - enc: |
+    - recipient: age133wy6sxhgx3kkwxecra6xf9ey2uhnvtjpgwawwfmpvz0jpd0s5dqe385u3
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZQXlLT2Z1L29zUzgwY0tW
-        RHYycmtyM21BMjd5QUNvQUV0TkRsWFh2QlNJCmprSE9lSnh0Vmhkb0hSenNIamlC
-        RTBlTFVvUkVMejBobXlvTlg2Wm5TY2cKLS0tIDdPK0VlckcweVdCeWdQbTJoMDE5
-        RDJNYkUxZWZhWnptT2U5a1pYR0FtaUkKqhBidpla+0NW7dq2FnsYUoW4T4A8fmFy
-        cUMWuQBYM2QAxZRguyFXJ3dkUAxo7mIhUjKQuTIMOCRTyxqRlTW4SA==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2dytYNExPdFFVWmF6Y3RP
+        VnpySExpMURISnVhYWFtR3Y0bksxN0JLOTIwCm1JU3JiNldCZW40b3J6cGsxd2g0
+        c1RMVG1Mb0FURlN5QXZzL3ZMK3JlVUUKLS0tIDVaV2IwcUQyTlBENnZWeC9BMkpH
+        eDZ5aFFHZWd6VnNGSkgrcjR6Q2hxTXcKush+dylamXtpu6XB3nLjXYW2KbOymCWj
+        C4uK7OTmOyNXobQh5k2S120J581BihmQpef5LMhxM835VNEFoQ0G2w==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age133wy6sxhgx3kkwxecra6xf9ey2uhnvtjpgwawwfmpvz0jpd0s5dqe385u3
-    - enc: |
+    - recipient: age1na0nh9ndnr9cxpnlvstrxskr4fxf4spnkw48ufl7m43f98y40y7shhnvgd
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZDFQMTVPb1F1aGo1VE1O
-        bE1IUitZRkVMSlNmclZHMC9qaWJodUEwV1IwCitzWTRKeEpodVpwaE5UbnkvTExC
-        Z3VYYTlqWndEOXM0MkFTZDRpOERFVlEKLS0tIEV2RGszU29MUCtONzFsWG1aZDZJ
-        WDhMeFdqcVZFWHlVVDRtbmErMUtlS0EKkrK7s5d8GUqX9PvOE3clrqoHVpmuXbai
-        dm3Bv+pUbNMjHFlx4sXVAPVlWahN0noo4fy69J/m6F7/DnuoDHEq3g==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0TWg5UHp2cHIzeDZtOE5j
+        bGg1MzFxQjhnTUdFc21kbVJxa2JYOTA3MUVNCndDUXM2NHRqOHFWN0VzdVdUYzhX
+        ZFZEelRVbm52UmZYa1BMeE1qU3RnL28KLS0tIHlNd0VNblFBQ0ZlbUtxM3dXbGJr
+        TUFTZ2hTbnU4RUlHU0Z6bzZqK3hIdlkKpxlcZipq7aBCHc9DDqCmOFlER+ed+LY5
+        LBBSsL6ReDgJDFOVx2XGEuMO3mRP1vSOXnro/pa6oP+qodW8fJjCPg==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age1na0nh9ndnr9cxpnlvstrxskr4fxf4spnkw48ufl7m43f98y40y7shhnvgd
-    - enc: |
+    - recipient: age1sqs05anv4acculyap35e6vehdxw3g6ycwnvh6hsuv8u33re984zsnqfvqv
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiYUM1a1NlVmRlZGJvNld5
-        NWJMckRXVE11RzRmdWVETXhwYW5SdCtzRUU0ClZJQm5LL2swT21TaUYySnRuNHFz
-        Z0JHUTdRNkwrRkdJNGVzK21uZzJ4MHMKLS0tICtEcGI2b2xkY3RKaDNQVmN4OTQ3
-        VXBrUjQ0Mjl3czBXbFd1WE9LN2U0WGcK1BvTUqw/41CzYUbaJz8C4q4hZ23TFOtd
-        g1NuSfsJm1BHN8vPk0QUOb+jw7J5YyFplFLHTFIf6kslMXP4WNc1Rw==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3eHNmWThRcFA2VE9qYnkr
+        YkdDU21palBseEZOUCtmNkZKZE1ncEdtc0FrCnBWMXBKRHhBUitMZGt3c3FIeWFS
+        ZVJMNXdpUTJsTG0wd09lLzJDV25pOGMKLS0tIHlib0YrU0xKRUJHN1dZRVJDN1Zk
+        QVhDS0ZrU1A4NUFIekphZjFvT21TNlUKviQt+DZlmp5ZFxdlkmdlfqW2+BTotYJU
+        j/St6J3Ibt0nnflz+oiRunndHsaeZG6xBY3ueRThcjlInF2ycYsJoQ==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age1sqs05anv4acculyap35e6vehdxw3g6ycwnvh6hsuv8u33re984zsnqfvqv
-    - enc: |
+    - recipient: age18qam683rva3ee3wgue7r0ey4ws4jttz4a4dpe3q8kq8lmrp97ezq2cns8d
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGOGlPOUVlaU5JVWl0TlJL
-        SVFIT0gxdGhTVENzZTJiMEtkZnpMVHFCdUNFClF6cU8rdENSODdQNzd0MFV2TGFW
-        bHM5YjJJeU1UMVp2WUpCL0U0T0NCNHcKLS0tIGpKN2prUEF6QndiQkk4RExSRUtx
-        OFg3QUFjOERJb29wOTd2dXpLYW11c0EKK/R3LPiTDBvFRM3thWaaepKeOnF3Zt7u
-        6IGcJPDuo6uHVcUMS7qE6qBWNH8ZBtMtNQio+BHx4s6G5DR2XszdBA==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWlVS0o2ZC9sOGd3S1JI
+        RWdPZ21Hd016WlE1QjBONlVLTUMxWFA5dERNCjBtYXVMajBDSnhMbUlFY0ZQQ0dr
+        YitraTV5ZUlDbS9XMWxKSUQ5QXFpU1UKLS0tIEk1Z05NUDB3enVvNDdNRkpnU1Q3
+        R1RnWWFaSmRtdDFVVW9jaGZUdUFQWFEKCE1osno869cTyuxQhQC3TjIfo5becoQk
+        ItN0+DrfbJtIs51+gu9sv92TFOWgdnvkCI0M6wzYnYCT6hH7ibwfrw==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age18qam683rva3ee3wgue7r0ey4ws4jttz4a4dpe3q8kq8lmrp97ezq2cns8d
-    - enc: |
+    - recipient: age19rg2cuj9smv8nzxmr03azfqe69edhep53dep6kvh83paf08zv58sntm0fg
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5bW44eElOWEs4NlV5am02
-        d0ZNemdBRXBURmd1ckVxelQ1UkJadTNxUFY4CkdRa05vSzlCeFFDTjFna3RoQllo
-        aThrNXB1elhSQWUxd3QxdUZnbUlmSnMKLS0tIGdWZ2loUENBTmZXc1R2aWdyMEsv
-        cW8wLzNlUjYyazVxZ3ZrZ0RpUGZ6TkkK3a9IoujcGL2FiOf3zGCF4KvUfGeh04q1
-        QQR+xlzqe6iMepeD0fPZvYedc1Yo2wXbWS/j7ehJh1jnWcB57NSsew==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3OEtZYSthRmZVbFY1dGx1
+        TFVTRGh4QTVUZU1VVWRpU0FXMlVyQUhTWlhNCmZRdjc0ZGRGdFJCYk9weXJjSU5P
+        WE1GbWprT3RHeE5KbzNMNk1lYVdaVEEKLS0tIHJ3ZWdzbEVrNWJFZUIwSUplQUFm
+        WmpuWC9QWjdmUkxzSmhMa2R0K3ZYZ00Kl25L6Ya5bV4mPgq/OPxYq/D2xqszFVr9
+        FkdgDr1VfbvU5wdA0QjIo+gVaJI7EazUcy2UJerS+uvL0dIn+RwsWg==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age19rg2cuj9smv8nzxmr03azfqe69edhep53dep6kvh83paf08zv58sntm0fg
-    - enc: |
+    - recipient: age16znyzvquuy8467gg27mdwdt8k6kcu3fjrvfm6gnl4nmqp8tuvqaspqgcet
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTSTR0WStKTmRHMHJiYzhn
-        d2pjTmVzVVhtZHJncHZWZUVWOU9NTjNoZkJZClQxRVpudnE1bWNUV005TUpCU2Rq
-        RHhRc1IwMHVsZzhNd1JNeDRRM3VlbU0KLS0tIGQvdUEzUlEyRFl5aHM4V0daR3Bn
-        M3AvKzRKZ3VzMU5oekRiZjRnUWlwa00KoajoQ1ZSRoUL38OzNEG6TX923corR3NX
-        QRm1o1Qj4WPwuqY6cFXVnnvrU460qkxDGyrqsl9VpfQMiDSW1mdVUw==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYTlVXVlo2Ui9ISTY5dnNS
+        UFNzZGVueXA3dXkyb0NFNzlEVTcvM0Iwd2xzCkhsRGxRU3NBNURBR2FGay9wMlk3
+        M3ZBTzlRNlRCVTFQNGZndEJFeDZzZUUKLS0tIDVGcWJWSUlnV3dSWkdzMjdZQkJs
+        dTNYQlJiNmwrbGdNNlRxZnBKcGNJV2sKBw6OlaoIcb9hoJQY6i5tI2ln9ug8KySE
+        4jvaInODSz1eLaF/W+wxgiDxqgiB7cgeBxeCQiqNe8ZZz/7Mxhg6qQ==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age16znyzvquuy8467gg27mdwdt8k6kcu3fjrvfm6gnl4nmqp8tuvqaspqgcet
-    - enc: |
+    - recipient: age1azkgwrcwqhc6flj7gturptpl2uvay6pd94cam4t6yuk2n4wlnsqsj38hca
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBZ2NvN3dOb1FCUlhKcFg5
-        OUhGV2x2TCtuVkY5VWZMbHNFTW1wU2pSdWlVCndYczJRanhPZVhONWxLRkREdzJP
-        UnlZQklhejJrVkRudzh3YXpqZXpVV0EKLS0tIFUxWWducE9zcFlLWEdDQ2orbXQv
-        NDlCZmFsbFlYZ2VockpvdVlIU1BmRTAK8BQSeOPpe/CD37W8l9zc7oZikpDV1jE8
-        cU9m1jnN2qE0FnZTRLITQhPJhYSj/GIGmCq1HTsPNA7K1AyJsg5vCA==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhbXVyZjBsdlNOZS95ZkhN
+        VDZZQkxybTh5NGR2ZzI4VytMeTlseG5pdlhrCmdsdWY2cnZpa0xJaklvK3Z1bWRN
+        OWhCaHMyT1dLNmo0blBiU1g1Slpoa0EKLS0tIG42QUZuZFNVS1E2REV1UGVvRjI3
+        WnplM2ZKVkVlZ1FIYStzYnl6T0xtcWcKiUfgJWlz6dwyFg0ln5a9MwZuQwwHv9f/
+        AV4QcSWXR0rh8oV4PWw+EYYmtmX7GICNVjqruHmokU83xpcqu1g40Q==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age1azkgwrcwqhc6flj7gturptpl2uvay6pd94cam4t6yuk2n4wlnsqsj38hca
-    - enc: |
+    - recipient: age17x20h3m6wgfhereusc224u95ac8aj68fzlkkj5ptvs9c5vlz3usqdu7crq
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmQ0xLQjZLdnd6TmlZNW1N
-        SWJOU1RabDJ1TGZNNjM4UnhlVDdEWkNwZW5nCmV5WWFUM01YSTRRaU8zOUlRZFpz
-        Ritjb09LemZNcjUyRnQ0c2FGTUpWajgKLS0tIGFvWTU4NDRMbzgrRTVGaGExV3Jr
-        c0Q2NlhqYyt2Sy9vVHNVZTRIZzVSZFEKBagWqZgGM7L/4OvX7k0Mb16uDdxOneXU
-        V4IkEFxmVGavpUNWir77VnIX7WUThAmF4B2fhXB+qs0qlea4JbG7Tw==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0VGFBSTk1blRwM0g0Vnhp
+        ZnNKOXJ4V2MzRllqL1NNV2VSK3JsZHFTMlhzClpHYXVqa0ZmSGFVWVpjSitmT0pn
+        K0txWHpPcDVKNGNTZjR6bEowSWo3Q1UKLS0tICs4dEZQeGhIUFYvRHZlU3pQTmdB
+        a05lTEZ6My9jM28xdUVTOTdqSkRHMEEKjdhHDpQl8hkRiHheD9sxDZHnIeJmCjXU
+        GBpbbTjAoVcJDyK9YH43/jNr5rT4mxTogArNtk+cvUlV1Ryy+PED4w==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age17x20h3m6wgfhereusc224u95ac8aj68fzlkkj5ptvs9c5vlz3usqdu7crq
-    - enc: |
+    - recipient: age1wnympe3x8ce8hk87cymmt6wvccs4aes5rhhs44hq0s529v5z4g5sfyphwx
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvSFJmaDUxT0Z1amN2SGR6
-        dHhPUFVCdTk2cVlUYlp2KzgxZEY4dk1sN0dRCnAzWURSUkdia1c4aTZlWUFzUENC
-        aG9nUEVlaGdHdU9MU0VJMVF5ZTBSL0kKLS0tIEE4ZEZmMVhqZWdQNnBzNVRJNTlF
-        cDhJaStiRzlOOFQwc2h6QkRrUGQrTlEKHTekoVeaGKeZL9k7FKroHReRuQwBeHnG
-        Qjbib+9Qk17xd11q/33Lb1srn3FnaaLCoQhl+YufI67jdfluqVl5UQ==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBscjRHQ3lGaDJBOGxGTHIz
+        U2JmcjhyOVF3cEFCWXFFMU5Nc0hUU3pSWENRCm9vWXM4Rm9iSFZiTTNjeW1aNE5K
+        RjVoYUE2S3M3d0orVjFIcWhrVVgyUzgKLS0tIFpWeXNMWXg5Z2FTSkVDYytvdStU
+        MVNCQzVBSGIyUjAwL2NYK0ZSdE9kS0kK8Mo29wZlV/t1hixFL95NSyCvHfB1nUk3
+        m/z5yh8CFwozb7ovd6MkAlqXB3bYAmMOiL+TPlvtqKkzcuQ6DRmjeg==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age1wnympe3x8ce8hk87cymmt6wvccs4aes5rhhs44hq0s529v5z4g5sfyphwx
-    - enc: |
+    - recipient: age172pk7lyc6p4ewy0f2h6pau5d5sz6z8cq66hm4u4tpzx3an496a2sljx7x5
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUclY4MDRZTjNDSTRLd3hn
-        Tmo0ZThiZkVuWSsxTTB1c1hyWXovV0kybmo4CjB4Vjd5R0NoNjd3RHhyb1NJaWpH
-        cHVQYm1SL2ZPLythS3drUkFBcHVmQ2cKLS0tIFhrdFRMOHZ1L3hWRmswZzNLOUQv
-        NDFxMjJBZzFtRFRZSm5QeER4eUdVcGcK5sYxXaa0VJrbPDlns9AT3qOlI+DrRtza
-        b9bWBYrN2nFMNud4vZHyTdHXp/VZj/x5Ezo29ZHI+QDXOG+CopIL+g==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1Q3pRZWVSZUF0cmJDUVJj
+        bmY5T3RhSmMvVGpoRlBOU21jWDZ5elI3ZVFNCkVUWXQ1b0dlT2JLK0diZUZpU2VJ
+        RExZQkpBa2t4aUxiMndpeStCUmlQalUKLS0tIGtEM25qenNSbmpGMlEzc0xvSW1t
+        ejh5dmtBZ0tsL0lIMzhmcjg4TmozL1EKRKzgHd2n9OqFd9AYsjvu4mk2IOOgFeF3
+        x1toWH7frbK9/wyQ+jDJsWIthsvvGxOrU/bmiWYsFraEey3+8fJ3dA==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age172pk7lyc6p4ewy0f2h6pau5d5sz6z8cq66hm4u4tpzx3an496a2sljx7x5
-    - enc: |
+    - recipient: age1p7pxgq5kwcpdkhkh3qq4pvnltrdk4gwf60hdhv8ka0mdxmgnjepqyleyen
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZejZjbVBuTXN3TG9SWGZ5
-        cmdYZE0wbkpTVFAzd2dFQnRmb3krMHcwdEVjCktoMURmYkxMbk9iRFVTSnVMc3hl
-        QzVQK0lzdEdML0lkYXdqLzVOY1cxUEUKLS0tIFlWSDNTcWlJdVFsMHVYZnRZU2pP
-        a3YxQUhZcGE2UEpwWWRzVTVmWmVHbUkKZyuOLv3ri9WPN3gwuTesRr01plmgN+8k
-        fdfgPALn/peSFeuG+2mDBZfqaYphZvMq+l6USkbenkzyMh7o4pUNfQ==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpM1lUbGhIWmRIRnlJbEJa
+        NDRpN0QrQ0IrYSs5RG4zWGMzZUhoSjFqRW1rCmtNS3Z6N1d0WmNKM3VvSms1Qk5M
+        cTRjTFJnREVzUSsyN0N2K3NpMWFTTEUKLS0tIEhBZGphNVhuTkZVenhZcm9kejU3
+        bXdLWUV6elhUcWo1dTZOODB4Wm0yQ1kK0K3NSYoxjIdHt8mkfZ6/phTc+yDEbjOd
+        +23I/LtmUeGLDYbFMnUVrs6IHdt0Wf6XiHihFeAYBzJ+MZJiBGA/pg==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age1p7pxgq5kwcpdkhkh3qq4pvnltrdk4gwf60hdhv8ka0mdxmgnjepqyleyen
-    - enc: |
+    - recipient: age1sv7uhpnk9d3u3je9zzvlux0kd83f627aclpamnz2h3ksg599838qjgrvqs
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPQ2lIMDVIbkZJNEhvanNy
-        T2pLNjk2dXA2VmpNc29PTVFEcE9DbC9saUI0CkVJanlBMmpHN1ZtL1BnTUVPUnZI
-        U1VUcGpyUWtQZ2FJK3JxeEsxL2J3UjQKLS0tIEdxUmZrdXpDK1o0VjN3YXlqdGpH
-        QW10WnJrd2d0WlBlK2JIbWZqNXZVYWsKg/a9TdHoCkmkcnZnyvXc+sCxZsQVpJnh
-        R9r+2qmmQZDtdlnpPcemQhoAHDLdU4AkQgKNThX5IY74v2LhJgrPAg==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHYVh0aXlGRzRzVUtpcktG
+        RlNtUC93VjFYbzFDTGh3WUF6eStVNGpzOGpVCjM2dGM3ZXlzeW1hQ01SQlhIOElw
+        V1RaRG5kTDNHUzdSVm1WTEFaNXROVEEKLS0tIDdRM3IwRURrMWpWNlhPNFRMNmlu
+        UG10azZmL2J6ZTI5WXFjaFlhUWdzT1kKDiBjafMxI4hH5vXwYU0oKXa6N3VwwSh3
+        SYOWwZrrXzC2XEB2btqWxuPOu4gH9qVJXjIM4dS7AaHJM0DmrzBj1Q==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age1sv7uhpnk9d3u3je9zzvlux0kd83f627aclpamnz2h3ksg599838qjgrvqs
-    - enc: |
+    - recipient: age1dkecypmfuj0tcm2cz8vnvq5drpu2ddhgnfkzxvscs7m4e79gpseqyhr9pg
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvRUlzMmFDN0lNbXNIOHBD
-        Y2syV3FheTVVZ08yUFkzenY0dytMckFrT3pnCjRiZkErOGtYdVZUbEpBdm84RklC
-        OEgycEMyZjgyRVhmMEtoc1hOVnIxMkkKLS0tIG9ZR29BaEcxTUpvM1g0KzF2N0tp
-        cndqYi9aakczMWV0R3RIbmZMMjdBRHcKh9bEatt+Of89OK2v5zigcLTrLg2Od4fb
-        Wb8DR3ek8ysfcHCDIfAce/bBRX4nKbhZGB/2XYv7qJ/XVCaYWprKJA==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFNjlSQTE2SFJVUE9pTXFy
+        NHo5czVPWjJYWFo4ckhDeTVQU1lFdDhQc0IwCnV3VWx4U3Z1cGFKdVl6ajJJRU5J
+        bWc3dkFiUlJoQVc0bnZvNitHV1g3ajAKLS0tIHEvNCtmRjRHRzE3Y2oxRnpLRHNQ
+        dEtZOGRkdTZIYVJrRE1Xaks0NjI0T28K9y8wk3WVv0SpnWj0FK8U4cRHYeuXIHw8
+        tWL52iwJTf1Jm1uKw99S12ixhZIuNUM9J33EqH6PVQxDRCzM8/jW8A==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age1dkecypmfuj0tcm2cz8vnvq5drpu2ddhgnfkzxvscs7m4e79gpseqyhr9pg
-    - enc: |
+    - recipient: age1mdtnk78aeqnwqadjqje5pfha04wu92d3ecchyqajjmy434kwq98qksq2wa
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGOHdwUWhHODJHeThNTzdp
-        OTZ2b0ZxZlVIbHRNUExXS2lnaldrVTFMT21ZCnJiTk5UVlF1dFJndE5qL3FUZkUy
-        UzdIQlJuNlFNSThTYjRIN1V4QUtEbTgKLS0tIC9rejBHRmJqelNrcFFpb3M3OXBw
-        L3RmNVdERmdtaUlOQTBZbFFHWU1BY0kKyurS+2zWqwi9RpG7N+0Wpc+ubFpLprin
-        59q4E5PXsUDZ91R1MqbHbf8yjb8/I3vLn6QjUK4KPE/9CQCp2pNw1Q==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4UVRZNyt5QVdNMThiRlds
+        Z1ZjVWZlVlpMRzBrV1M1Y0k3M2xCRnVUVzNzCmZxVnlkMWNPNTlkOU1IVXVHTWJ2
+        MjByM09LTjR0UHNrYkwrOS9Uck1EY0EKLS0tIG9PTndzTDFSY1JzWXA4Y0l0QWFr
+        enA3QVpDZGwzaHZ6ZGpmK2JmMm5nVVkKrjkYCDyXtf4QMmC4IWh3ealGGFE2qsT+
+        01mAXWHGETiuezKRxJahSqWBk9JL8EvAPNGhi3o7B++H40U4G3dgLA==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age1mdtnk78aeqnwqadjqje5pfha04wu92d3ecchyqajjmy434kwq98qksq2wa
-    - enc: |
+    - recipient: age16pxqxdj25xz6w200sf8duc62vyk0xkhzc7y63nyhg29sm077vp8qy4sywv
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4MXFHc2VtMzdFbXUzd0NO
-        SlIxQ3FsSjZMT3UwMjkwN3JBVURPNHdxSnhRCmxINTF5N1dzL2V3c2dSemxpWkto
-        ZmE1a0MzWEFwb0REdzBJQ2Q5NkRyaW8KLS0tIDBGOU80aFExd0lHS014OUlJMldF
-        Y0I2RUhOVFNDMVRiRE9kTU9xUklBZG8KuNx5K+rdNXkfhRgn66VGLc2yfC9YuwhB
-        N1XaxkKu71rJ5ZsuCoFtzqSMyh4MManh9CXIwlMNAok7VfU1qtmtBw==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJU3AraDJyc1dPTlloN2M5
+        UGp5a3Z2cFpYWWJLaXFMdVByY3ROQ3ZDY2lvCjN3SHR1MjRTdTNERU16aGFyT0VG
+        NXVpTk9KVHp5dDdwNkQ5RDVsMzRsQWcKLS0tIFBjaVVZUTNzVDZJVlBQdGxZbG1L
+        MFh3MFVSS3lKK3NWdThGMzIwdUNoSzQKSREBS5WSMieyjWjuBN/faxsdF0Gv29OA
+        s5MLSR4YXdoENtBYJLl2NMU8+Qz/F1UlnuUtCzcW686Dy11T/CDnRQ==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age16pxqxdj25xz6w200sf8duc62vyk0xkhzc7y63nyhg29sm077vp8qy4sywv
-    - enc: |
+    - recipient: age1hv7m3xypesdfm0dfzwgctde8v307g9xaunnfu2687y0lagcs5q7s3eg0kj
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnRElTWUV1RXd1bGxSZzI4
-        b0l6aUsxa1EyTW0vTmtyOGlRazE3alZXaFFNCjhQNUo5Y3R3ZHVPbnVrUEpKN1g2
-        MVRzVXpwWjd5Y1R1VENLVUtlNnAvWWcKLS0tIHRualVOd0g4cE40UEpseDFEeW9I
-        aGdBRW1TazZZVlE0cXlZSzNrTTQyZ0kKZdUpkVXkeAkHkIv7W4/ZQVU+uS2th92P
-        e78iITFOJlrw2L3ZiAh5asnv3ee1ZH62eKLJVnCrEprmR+hhlUVhmQ==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjd0NpQjFVOHAyUkdYMzZs
+        VUplU3hpbzc1YVRzS2lMSExHb09uOFFRaFJ3CjBqZS9rYXl3aGZkdVVUM0FuU2Jv
+        cHRXdlNFRnYyK2dXaE9EbytOTXhxTDAKLS0tIGlEU1RpQWlkZGovR3JTOUNTck5N
+        RlJWZVJ0aWlHSngwUmRhUHpYNUNlNDQKX4jKugCpD5usjuQkSimKhEIPbvq6cTT+
+        DcVYEw1hNRieZ3hrjMIqcoCjPOlXq0+hkQmAkZvrMvO2e1CAlm/DZQ==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age1hv7m3xypesdfm0dfzwgctde8v307g9xaunnfu2687y0lagcs5q7s3eg0kj
-    - enc: |
+    - recipient: age1522f3qzddm82w63j7ajdkr0khvced6ht7tzp3grvp0j3hewtvesssr5kpf
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1TmlwblRNS3ZiaWQ5anVj
-        UFBVYlcyL2I1Z3VZckRxV3h0WWxPa3VtMWkwClJ6aXJnQnNQeEtPZFdKYkM1THpH
-        V2h5S0tXenZMZWUydVlld3hhS2cvQlEKLS0tIHZMbjVJVXF5bE80SU5JbEF1K2I4
-        Y1F2NWdia3MyeTVNZFhNWkZlSS9aSXcK9bCrSomL8gY54AgeT6mUr4vZ8VCt8S9K
-        yEMGDls04Ab6a5U4PAM2ytzyqilJ6agE7t5Tfpz1PvdL5lTTQrx5hQ==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTc2ptTGlGU0VaMnVCb2ly
+        dzNUUldEeVBIbnpEdlM0QkI1Zkhua1IzNmhFCjBUQk1lanFWVGNjeDVGdG55TTVE
+        Z2lIWXNqY0Y1YUEwQjI5dC9UY01jSE0KLS0tIFVlOXN2cThQdldjWEs3b2pDRHNB
+        cks5WjFuMTBCMVhMYnJjbkpFclgwNUkKPh/RpdUCKYn76fm5MG47ePBmNHLATnFp
+        rrN+PHxj85vL/3u00j2kNY28dM7IH3qymMYKu1Dm+BO2RFI/4hPFsA==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age1522f3qzddm82w63j7ajdkr0khvced6ht7tzp3grvp0j3hewtvesssr5kpf
-    - enc: |
+    - recipient: age18zgt4y2sd75hxnpe333zz39048ctxpr0q8a3uqh3jajjkyawsdrq8yg5ve
+      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6ZHQ2R0Q0UWhwbFdNOUFh
-        S2xPRUJ6ZkpoVy9ucTlHb0JUTGZ0a1dXSTNvCjZFZ2RLUEdUWTV3QUtZY3YwVjhj
-        bmpib0VoMEhVZ0Jrb2k2WmQ0SGtDb2sKLS0tIGxYclJ5cVBic01oRGkwbGpkUW0x
-        T05lT1M4RlN3Y3AvUURyTEwxUDRkUkkKLJ76ju/Mqpc0MS4J5hk+hEOONA6ignmt
-        nh34vnEKBg20p6CfsrmJf3yAnXuEeWsERm5k5KsGzbxzWV7I++mGlg==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYcHJaVExSbFl6anlLd2do
+        QlMyNU9zT1lJM3NTeThjYVlibTh6VVMweFQ4ClFrSDRXaTlDME50WlNJNG52SVoy
+        NEFvdko4QUdYRDNJSkIyTHo2aVlWTncKLS0tIHAvRlNISVd4WU1WMGZGcVk3aEhh
+        SUo2QWV6bEZGNFdaLy9BU3ZsQUY4eXMKaW/0KSpGic5BDOdmWmCHJ3NzBNC/+3/K
+        I9GEF07iK0tvIFupQToFuZ6uV0BdLmpHPfNBnSKY2+Q3r7siomPTIA==
        -----END AGE ENCRYPTED FILE-----
-      recipient: age18zgt4y2sd75hxnpe333zz39048ctxpr0q8a3uqh3jajjkyawsdrq8yg5ve
-    - enc: |
-        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMOU9YVVZIZDRHejd4aHpO
-        azZyOE10bmFJT2dNTWxYSFkybE9NS2pkYlNNCkl2ekczYW40TVhjNXBGOUdlQTRT
-        aTlaeWcxMlBPS0h0NXNiWDlJQXZMR1kKLS0tIDZBb2pUb0J2MnA2SlFsNTJYdjA5
-        a1BwNHRma001NFd4YzJ4OUFteFlvM0UK0tVTZmK1h6yC+aVwg6Pr/y6uaB12wj8B
-        oJx+p9Ty9NTSM5THBNt6paR+xHzCP1kRYNulV4PABq0IsGSpxFk+wQ==
-        -----END AGE ENCRYPTED FILE-----
-      recipient: age1az0k6cadssk6r8qcqxfr8cyu5mndy59pwt8yqq6w065ew6au4ezsmg2vkf
-    - enc: |
-        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IG1sa2VtNzY4eDI1NTE5IDNXK2UrZlFH
-        a2tGRTMzdXJKWXhOeFo4QWdwV1A1Z1hnMHJ4VTlPMlN5Si9IS2JQQkxHeGFOdVB5
-        Y1pwOG8wK0V6OGZjcmRNalFJaGczbGozV2djZGw2Z2hkN21WeTlPSEpFUkl3RXJU
-        OXloNktubldBa0g0ckptSzVBTmg5OW95cGlGOGlBTG92YldDV3Q1T3RhN0RudXN2
-        UzFUZjhtaFlGSWtLd3ZPL2NKeUNYMWNYcDBRQWtSbE9FTnUwaFRIQnRSVmczT3Yx
-        alNOWU5UQXVWNGtTaFZxbE95dTFOOC9mMFhwUTJ1N0FSR252VHhrNGRYRjlXMWxT
-        RUsraWhXK0lhdHo1bzZDRy9mellza1RRNUtyYVkwT2doUWhBeEpvTDdKZS9WWHNs
-        U2QyN1RaWitoUDJkY2d4SysvOEhGR3NnY3A1OXhVR1NhdUJLdWJ3bGkvdnNPZERV
-        OEdjbW5FNEpSOEJRTWFtem4zU2x2bGp2V3lOUStIMU9ick1zZEQ4V0N1QUM2UHB0
-        TzVGZ1pKZHM4c01FblM3N1pnV2NENmltVVNISEI1bzZTRE9LUW9oQk5qMkJ4Z2Vt
-        NmZHWWREKyt0a3NJSXo3VFBiQWJWSXQvY0F5bCt5aktGTTJTc1R1eEpCSjRwRDhS
-        U0hpQ3BOT3g5NXFMSVZsQWphN0IwSjJkOVhHbHlhMHdzSFcxQW0wQUJEbWlZYlNk
-        di9HVlYzUVZDMmNzSnRLOUk3OC94Yk5GK0lESGduRDZRc2JabHk5ZFd5cDZrL3FC
-        eFBSQWU5NE9uR05IeDNrQkJOMW4zUjlyaWdPYXlqMitpNGJ5YzNZK0NISGx2Vmxi
-        VXNOc0JSMUxuSUVVR1NBTE9kZ2NvUEloTW5Mem82T0NPVHFVU0Qzci8zWDdaWkEz
-        bG5zdnZZNUNITXM2K1gyektYdTkxZHhXU2tmd2tLVTN1NUt2WGR5aDh0Z2U0dVhU
-        Ynh6VUNuemx0ejMycnRIWVZxdzBzc0krV1RyMjlveUpGdnZQb1RSbVdBY3R6ZkM3
-        RUFXNFVYR0pScU5NRjNIUTFkeDZFKzhtTFlNdVpzZDBSeHRuaDlWNHYybW5qV2J1
-        bm1Zd0tPZGxRRXRTVjZrN3FLZDlJL3B3Tk5iT1pUbmg3SU5xSEdqeWNRZmQxS09s
-        MTNhZVBZSmoweCtkVEhEQzlnVlFtWk9xVHMwWngwck1xWU9hL2d4V1VvK0l4RURQ
-        QnpzWUhnZjFOa1JvZWJFVklJd0dma0diYzBmVk9YZlZURmo0U3MvRVJOek1iTzh4
-        SVN0UkdQYkx3YWZMdnVibklHRW5RdGhIK3RqZHBLZ3drWEdaNDg0cmVhdkhocCtX
-        aGVQQVlFOGdkdHhXZkZ0YkZYaWFXR2hkK3M4dy9GOUZSQmhDVk5RUmpTSStRTWxt
-        aTNsNXJyL3g1ZjhzLy9RdkwzdER5YmFSWnFDV0ZDZCtTV2V6RktXNHRtbWVPc2ha
-        SzdSRGNVRWJTTG5KVm5LZHRzRFdrMGwyRWk4d0hpN1RoNFRFUnM5ZnN6Z040dXNT
-        ZkdqQUR0MGRMUlV3cmxmUTJxRTZVVXF0YWtOUThibEhLM2FVcXJqeUNDOUtVY3M5
-        ajNJQ1paRzhvM01tZElqcjFsQnFtQkJTaDFIMFA2MVZQNjBYZnpWN0FJMkZRcXVr
-        WW1uQUJtUTNDcVo5Mm9kYmxSUGJqd0thdGV3ZVlxMS9SNVg2eGhMRm1UaGlWekRu
-        bFJkaGNFbytPb2REZ3JUWlp4NjhxbU4wTzlTOHN2TzV1blJCMTNTNnFuWThqdXds
-        K094Q3M3UGE5MVZyUVYvZDNrZ3Jmbm4wNkJMS3JqR1lKSWpCZ2IvUk9ZRWFmc0Z0
-        b2xVcm5ZK2NtbmVscUxOM3laZnBUYlRLSnR5L1g4RW1zMWxYQmFjZm13YloxNjM4
-        bXV4ZllJdG16UDR3bTY4UWVJeVZOSjArU2pGS2J5elRJVXNCdm95bTFsenNLQQoz
-        MFlJelE3N2gyS2JPZXNpOGFTMWpiZWRvSWhsMUJxSXh3VytBZElQaTZnCi0tLSBN
-        cnNUVHIrZWd5THhhaFpQZmRQVUpEMytJOTFHeG5La1lBc3Fpb01XNE5zCsXR7ibA
-        urENnyvOwCOgW9OosPDqhjsC1wElMtNf9W/Th+20h8S2ApNTMbINUbc/7KPZpIKT
-        KQKilX08+r7RAw4=
-        -----END AGE ENCRYPTED FILE-----
-      recipient: age1pq1jqrcp3te50xugmv5wst3s9ahj0d38rfktxt43wlcqz7vnwyn3y2h7kyfr6rckrvmuk9m7yvp4efjnfsuxx6d8r9gn222r2eal5593arywrjwrgeypf745wyuvf3z2xk9tm5fgnwckftuvdggk66fph59rw69nt5dpjeewuww4vzt9gs4xelre952s7zjz56qv8tvesg2c89sp8rmy9dvhwfd6tucjhs6sjr6yp2njjra2u6w7c7f0sch3rwkw3wf2dc9su9aaa9q2f22sh5yf0fqejxa2qqpq4pg752589st5xsa5g8tpkjglj4tn35gd4hjj0xet9cjwhydmkmmkffy3nr8zdtctqu6pqsyf7aphvktryez39ru3qe7m6nvr465ffxr0ltvr85nddzxvcwpwpac64nu5tdfrxgjfqzc99vr3zxv8carpsw5evmruqlvrq6v6a4m2cwsz5gqw7nyk3jlj75kp5cnafzjn5dyrf8ppfhp5g5s34zsl7pejmmx2uuudjt7ru2y7as9mtagykrgqgt80fvp3eeh4gsmmd3ujgtp0ranq28aq9x0xdekqh49pfhhprjj6zqdfac5gxtjj736kh5jktc4ls4mjs3p33rzt6ze54uqsfept3qhua2pmugypup6hm6j2ek5sgxjnwvqyfj2l8vz4yfgkaxf699v7jqlwf7g68ang5kzqrjsu78lyardm4zen8zhrr24j334qdgs4zr8dhsfsnmvx9cdvu0swx27tcz8txs46zds9kekgmua7w7fnw3l2lf6zla956ssycac4zjy87rawr4thusxtcqgfzfzh2za9np0s34e5dwkp2l2k06cq09myxqfe7ze6a53d8sl5j43qcekh6kfvl9k0t7903q99pc35630zwm3hwxgnw354du5gngnz56skq9zx3pcnkr5eyh8r8t0dqudmvrrwmxreu6tgrklxw7yvu3zkjgt3gyjhc8kqcrevlukay45sz4k9zqxx9yrs88hzt4h52r2g74alf3cedes3atufy06q4lfq3nxdlnve0kqcwstzr6z6u7fqpqvacezdrr62ycteju6dqawkpthu0drtlxj547htfjcsnrmhgvhskwtuhk6yp7wp30p7qc5vkk8fegg6qx5kc9xs4trx7hj9xgydu7vd30hkceuxsczywjs9v2fl3svkwfypg62882yq6ltv7gfj4ajuy8ezd76g0z7juwspe7q6zs5ceshd6038tvvh2nlpjty6rg6a9qfzhgmjx9s6hynyk7xnq9zra6hxstg8p58x75hapd2mk6rapfunlnnkz5dsxjf4ud4dsvgjfjpzxcdy7sp8dzxtengrsdyu4824mqlw8p63d7m2z4mcyme4tm2qkugtdgrkyphe7akk2geukf6xkfkzd2pkdq5s3qm9fkvfkgrv6yw5kdgjak8xcgesg6tumans4fs8yrxtqlvv2z3emdvwchrjfq4xpzsj27yt4gdg8pknwz9tqpjkjxq6lysutrvwkvt2fwyj8wvv8wtmdl6fk6rsd9kq9a6wkhuq7vvrgwgj3xg2s229sprj4g2vzhy2dfesrp403gs64jqkrjuezwm4zd6uw2x4e2qkj8xqcf7c0zprdzu959x23u878vqqetgpjwt0z3kedt8l6dgpm0rf5dmrya5h3wgzfa0jjvgjphyxgxrwlrzpv4czgal933zs64tn90ks66ejjdaw4t67sch8r3q0kljeqnpdgmw0cpj6arc6k46wcqaccygczy76zt9362vslakvzqqv33tv3sjldp6qxprharmpm9uykgpx66343wuur5xj2aw0rgutpm4ztjzycn3a8d2jq2zpdzwmevezm7mkp9dmndkc3qz0kklgkxq9yehrk5ayfly97umhws0jll8qqg0r7gzxgw5vv76
  lastmodified: "2026-01-25T18:06:26Z"
  mac: ENC[AES256_GCM,data:plHNLOgGWwNWbakKG6X5EOxwERE3rvYO4EOAzY/sz+uM7cZBEnqU5LZwjlD8B75hgRHqpnDBF0JbHgsEwVxfJJRL1phkeMJFOapQMjZVWMz6j7eb1hOwpdktd+bpuimy4XCD1aOxOoInKpFSK33usxLfyqSxjFDM5+i6D22qBTs=,iv:/iOIfNuSIDsa/UKLP0d63tpOrYMFO3Bk1qPssY0AzuI=,tag:k+824MXD+r0lNUcuvisudw==,type:str]
  pgp:
-    - created_at: "2026-07-07T22:14:48Z"
+    - created_at: "2026-05-20T02:08:48Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hQIMAxK/JaB2/SdtAQ//VbqnkID+k4jUtKcBe3yZ0Wp59g/oqpBjxk/XfVDH8cWf
-        qUm4lOzoHGvaJXBOtTqaQh1q9oHhKkAdb6gC0+Upo9t1dY1ewPUYlnV/bh1Zqu0Z
-        531H7vQL3k5378SnuUmPMZ2oizYd9AF0klGj58blmJAX97df1DHDdUtXXUhl8uVz
-        BqiMJN3lkC2h2dhgiZyHxMcpFhfcpJ6pkyghVvg7ldnLsvydRIfjQbfqHgLCOq/t
-        OI0VZoaemOU5n8uESyiFAoQsCNSG8wQVO91MOu9XtUobaBKpi8YS2d3CjIRNALkH
-        ObSi8OBJ2EDL4xcyBFoRq6QJfi0bTOx1a3RcRpA9gYMz9L3TxWN6F5H6g2oSgyhq
-        z+jFE42oMMr1afrUyufvIhxfNmweYb15wRtBZMTTTN+GRZUePHet1yCwoYTgcIit
-        u7bzoNS+BtCbMmfmntXRgB80SlzTT1CofIwXL4gPjBGt0iSwh4nn0rytQSuc8lmY
-        Wk+JM0Wdgh9v8v6tyiBFOasEkwXuiLevHOnXv3q/tK5mpJsXAT8IMpyTJbuFYxkl
-        VlpvGyPjweFrbpdZAFuai1kfx+YTsekremyG9gM7ZjMjiOM3Temeu3VwgnmSHmw+
-        UyvNk+Hbs8/2b4IW6c6bGLGgz37P77E4njMIZGUCW1IKjAEB978+UDGPMMmNoB3S
-        XAGM4ogMXRll3TJ0QKwxG88CCUYuJE+TBawBoOZxMLCQWdAiR1rW/HYNWQszvezm
-        zVx3EYVkci80sY5nobfqDd7w47klBti3+f5yfC1naelCyfPsIquqHMtA+U7e
-        =i3K9
+        hQIMAxK/JaB2/SdtARAAgG60jnqSqxqyG5tpmOyODv8QP5CQ+2bhDUg9gZtaAn6R
+        CLseD2MGUkOn0JzJfDbLFNr0yCkNCq8hiCQl/4IuX1eCV1Yskbo0N9VS6aLVeN2H
+        GLkOkVBnA0/ipckcnqBk2kvxJLy39N4k5n6PAopen8rQcIuEN9Ljso8ItB1BJhKu
+        1AQqZLw41aCyXFnK5fvT0s6U77VOjwO5CA/c3Cgz4HzR1cmZSr65a6oBBIOBkQCH
+        J3SSSGCJ/SgAAduQy5eHMLtCm/J20NYzLDCadwHTgGJMHkTaL49E7/JbYG3t1aEO
+        Le4mG9hXz2vC5CbZSaXzmbwv1APQ9PWRzjqeBsJFZx3rkmj8xhRdZcU/nqCXTvls
+        l+yG0rbMz1vHPW65nzKw+6AU974Mt/55TRxpdCQGg7EqlzS+JnbEGxnqtSHd46Sq
+        a7apnd0rbaZpUD94tYcUkG3MePslarCcv5hBPUD4hGjC5yfkkCdcRES2JnNDcCQy
+        40mknB95dXomQf7Rf3bOpbXp/zagaFaWw2X/n3eEQZwXl6UCQQf5n1VriKMbCTJo
+        vlJsDGSsaZgA4c3O9Fa64hECnp5Uj1jtBbC4xxjljZMUjDnAokzWbJPpWh2wS6rQ
+        EKndLx23h6gHEOS+Qa3EixF+yVRHCSZs1WTWPlOEsXWJf3gduvmXY6FzLN4MPWbS
+        XgG8DyR91pv5Uj3/2V3eDExA0m+HyXhZZEo3j+0Fda9HZkvQERsE2lvkTt1hyB+f
+        cBU+7eXEWzOrulWpFFtKetk3lNdGEhSWXomGZ8CRCHrmu37settg4QqWZlUwXWQ=
+        =4FYu
        -----END PGP MESSAGE-----
      fp: EF643F59E008414882232C78FFA8331EEB7D6B70
-    - created_at: "2026-07-07T22:14:48Z"
+    - created_at: "2026-05-20T02:08:48Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hQEMA1QflAioE8i3AQgAuNNo/As0/3bo7DU8/LliUdKkI+58Z2bxREFqdogWnTxg
-        913DRwLpd15NsLx1zaSf8eqYnGeHkpDFEFThstxMNpKXPwa0qex5tiv33Wvf1gkU
-        hH0Volh2HhauWAoBw2vdOqZo0+P1TtVR1i8uTXtCg7SnjdF2Ftg7JWpmL8DkNtl9
-        s7DAAG/aPo3h2wGGDCzgWkQHnfR+lC645DZOJ2Dgrmcl6EOC8u5TlrpK4KsU9ivg
-        J1zQxvm9znExcZHwwOZOnFWRUWBGmBkE4fLKsTsVko3KWmx6mQatVF/wsUW1bFIg
-        Z2+EkuBPmsvRBhhT7JQGVWkp4NX0RBlDlaBjRGS5B9JcAe0NXVGCq9+ObHZ7ybIO
-        ZlMvZHikbwhj8HWpK6jC9cIe5CiPdEhLMbesH1Cc8nffXW2HUeMAU/0/AnkzHSEE
-        ipd39CzvlT7HQHtrTizdydox13MUYFfUZfFvlRY=
-        =jnhj
+        hQEMA1QflAioE8i3AQf9GnjRfyFcHOBCSMvAQTzSH1u68A51lgK8wPyxHhEvwipc
+        6ZwTJi/V8tLJQzsgYq642dCRwHwvz0c0s8xNv0EyTjxLL/ituxcsGf3UeoigaQGN
+        053vxufwSCuglWCgSVGy2nBXMw/v4oj+3dAl83cmmZFDaiMfN3i+cs8un/fkHLCD
+        IPDhDgvkfYfHAkezQ0mwQbiTtZGLURFMefXxdXcDTmgRJ4TsKER16uLwA8wOVe46
+        bV4QzGY3+s1VJGuIXmYpsb79u54vch6M6SDy9VT7k0T3KA+tHYxB2k1WbgvHRZ+r
+        KNyITbqa6Vvwbd8LW9TvAdkmye3p/StlOD4DJH0GJtJeAVDkJ6Balsd1JEsHQqzX
+        8iYRNCueqLorWncsJerH95dBvV3DZ7Cba9askEaIxNjtFTBO47ZyK7C/MwaTNDAr
+        3qEh+mGsMC7ONl8erx1MheDoN24A9qUPQc6eJE97gg==
+        =6ciM
        -----END PGP MESSAGE-----
      fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7
-    - created_at: "2026-07-07T22:14:48Z"
+    - created_at: "2026-05-20T02:08:48Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hQIMAz5uSgHG2iMJAQ//V5uDlJxHej0+edePUQwy0WK4UOtV5Q4xp/fRrW8y2SKJ
-        jHAYe2S/W8qcTtvjAz1Vpf7lXAO8Bfu8IjaBuctvs+xZoK9fYi1BUsvPjrguR77g
-        yVN8rUGwsWFJDP1Yi5wS7vNqcS81YcUc0/4ALQuSgr5DRYusMJs8tZClqcJB+IOl
-        vrvI1+0H/1E35VW1El1+auWf2wBDfTCdWjCBStW9eGaQ6ooNuqI1ki+p02dEiCHy
-        WtSFoZVLgEe6BIhseWScfEnfOSO5xgfvG8gsq/sPY81uBDvnZYp3cg7ZaIr7jfcm
-        k1qh42nEt+I3fKQmXu+WFD79MYVxd9SqR1s5f+Z071KLjcPVXnbhVP/d/2te4rWu
-        9CJyxO0FvIwd+ijqd13T4H3e8zOjaP9oSXwAfsyuOFcHtZCgFdUkiDyQ6/WlRlxx
-        FyefuDqagwBl7tXEjsoYT1ZZKB/fd/rdJiEaCYsfcVgxyZXxiQBVcNTW69UgG8gv
-        /4ADaNILKRp6PzUcyPd9t4OIV90lyPZbpXOw0LUKbBakpp0ge1KagjhAY3YHblPo
-        ubtyEDmOhgRRc4pdAg0PXRmYmgPqAGr71qlVN6JttXOF/QnhEt/43tXsQIU3X9lN
-        h7aw9s2jrtlzikYZd9UBq0eZjDcO6p9HjyQJB8bSlZfQTnfER0OxYgRmcJb2L9fS
-        XAFGBLxy6n0C4EP32T/lLqOCkfQ3RKi1PcI4KozgtCLSXcbCuIDLl9s/xHG3LyOW
-        6uGRG3LsAmFrBVbf6fQh0O4EERjBM1DBdxpuECPGJxqjsmCWXH0kckjx5U9r
-        =ZjWJ
+        hQIMAz5uSgHG2iMJARAA0ojb8p8uQLivFc8DCYMeolgJa2APcE674herpCNDFHqF
+        bqwTiXFlfwtgHq8MEXW9ZzmLjGtv1xefNyV7FcsWIxLARTlm6vD7lXhbACVzDEt6
+        NArvbZ7S9DNOqjmWMPZMBw+isSp49IWL6su4ayxDylX5T+lCtCt11xDVehkwThyn
+        espWaTTxePfEhvfa2qV/KlUNg0bUM/D2hGtccwoN9o6PKZ61XJXs22xRsAUAvIJQ
+        qVj5KzxtFuuMQoYpWKL/pbI5yTyyDxnv4hBiRm5c00Jh/pt+C56gOpHMFyoZz5Qm
+        Hs/Yx7IIExMJv64AcXxWSXVSUPwi6/5N4kuQNUyF+IGyP5ChiBANZG/1b77sSay0
+        YXLp0s59NcgVk+qwokBnWjlM9SBvVSYe8UCKP2fmcGsX8z8BnRSLMgv7Vf7dp0Vz
+        2Tn8KPORJOvl4AM5PrPLyGB22enBfNCwKNFnrc7vrxR6FRjY6ev3H3KfGpOFhFyW
+        niz419fK7suqzHealm0DW9bfW+/5DqQvhqhU6D+yaL3f258LGa+3xM3fKNxE6SKi
+        aoUo75/ejnVl0vdT53vS9WMERdCuuN2ye0EGsU/k+Ir92ZOV7wan8P62Sz5aE/sI
+        x9buFx1Mem7amIoAPLJ0iMjt8znoqguPMxI7nKp8PYJ+sv/z2oaBZf2ZpO6k64LS
+        XgE80imgQYw0LP02tolznROVwYUL4zKYUrRvU7DK/dj1ymXWePdfvBQ7QCJ8C2d+
+        O1K1y1Ym0NusWbxz1sG85MTnANYwzHlmzFhJwsoJvdzs8c0SUxgsL7+m5/++qbc=
+        =HerR
        -----END PGP MESSAGE-----
      fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
-    - created_at: "2026-07-07T22:14:48Z"
+    - created_at: "2026-05-20T02:08:48Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hF4DsZXvxFXTXoQSAQdAHGNsY5+ISnGYSlHmBXBqayFgTl7ILhbTdVrCynRsDjQw
-        UcVUj1P6ZjgfgxS44x4e2blQQTgEIfrmB/8W28d/i60ebMIQEuQC4iiyX8ioDaCs
-        0lwBbis/tlst+O2gS5tWCJ97fuAbIF8zrbBUmkxR5C/ojgfrcCa4e4Zqz252bInw
-        rxxZrSP8Mw+RDqI7baKLKrRDoaRZRFvN6Uj3aHR+yj6ZDdidjU5e5Rnff09uOg==
-        =Mf4l
+        hF4DsZXvxFXTXoQSAQdAozv/NDuwLWMHca7CXMS6eAyeIspdNr0G8Vrt1qUohlEw
+        O3zOGfc5EKGNAWremAO/cvqY1lBiftDKmn+nhP/+ODde0QyIMuZesTKW/RjqsHK5
+        0l4B51zXNybVL+WK0eHXdR9jBsJt2ml+B6Dm8Vrc09ivjy91rKh2fkE57LWpQYHN
+        Bzs/9tL3Go4cDKmm4ziiw6Gisw7dMJPI2Ys5goheG7KBoGtCzyX1qUZHElyiGHtK
+        =PEO7
        -----END PGP MESSAGE-----
      fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE
-    - created_at: "2026-07-07T22:14:48Z"
+    - created_at: "2026-05-20T02:08:48Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hF4DerEtaFuTeewSAQdA6qEEGHwoDODsqCiBNsSxYW/mr23EYieH89un7j/hox4w
-        yP08OBYxBVep1/ep77aFnVfHqvPibcDjmC3ee3zEjXcYDnTiUaDWr+nxq6K7wvS6
-        0lwBqfbYxJF43dLtXmK+Wtmxw1fT2/ha1pxogiEGwyF+3M8Dz2plpQSswq/tGYOB
-        p+Pkb7ULGTT5rmUxBjjtJF0h1RKadMwiHfxshcGYOQ6flvBn9r4dZlLHHVBl+A==
-        =I+Rk
+        hF4DerEtaFuTeewSAQdAh75Enh942cD3+HgiJEtjw//W7OV37U0rZvXi0y/Mxikw
+        0XNYiOER3IIwoFS7a8eiBSZe1bbfnFD/0qOfbpD85orDiJzrnWAU5bq+NMHlBgzx
+        0l4BXAmkkumjh0ZeaSRUayYmvaa/sKVnNFlbI8ieU7qb3zNUaC4mqU2MHQ0KHRJE
+        Aa4eqVFhsLEh+ULUmeXrbPYo8q3+IQZteQ4bpEv4c7vh92h2mw/bj8XphSxN5q8C
+        =Dvky
        -----END PGP MESSAGE-----
      fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912
-    - created_at: "2026-07-07T22:14:48Z"
+    - created_at: "2026-05-20T02:08:48Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hQIMAxjNhCKPP69fAQ//exw+ncdkKqlY35AxDJUclAoN/QYhpjX4GiQkO7v8/HFB
-        T9h2VNBQNX4oDbYosQWI1Q5f7DDnCeWyJl3sDFcxh2DzL4neR28p4xb5MNT3rO0J
-        IrGIPVx+abib+f0T4RzcL+QLZb8ou1/odzGVMLoNq5q5SHOuskDODg2SGjXRSI2H
-        yqRGVG+N5D3JVoo/waiCA1CtUpIhStjeGNKbtLfM7LY4jshmU5n9MZEDF+7GMl8R
-        7dhodAgWcGM1Fqyi/xDaryKgP60Tu8mFufmlcDGJiXR9BOmMo2z2JDBhVGU+LeIH
-        Favb7qJVwRLJKcFRPdIRJFHaq5eOLEVhRm83Uk06K0MpxLZNC4jiXQKVEPjEdcZ8
-        CfEQ/x462LtI9Z5ArfF9H56gMSFpT7t+yPEKXAllY1K0E1mCy2m9NzkzjSHx6y+k
-        dAsL4xkIbw6Q+Zkaaes3GQ9TkR7vxx7RMk1BXjQp2vjkkeu73EYnHU26XyrL4xJi
-        slVkxCvbEORr9ju/I8Ysxsva3Bgz067v7q83LOl09kKen1VB5/9Cgxjt2W0xOBUn
-        WtxLorWU0mHm9BB5WtTQy+KnqLN0s2SeSyT2SPMRXZKF3T+Wwf/Azoc6vrB7m9Th
-        WnQVbpwooys5/Y8jZYat534b2jiUh2JeYB6lFSp3C2i7JsKxGSxND/DVSJ60vH7S
-        XAHSLkAKOu5hgnUAIxdCghjAIUx7MHeFAcb8S1QiFXenqUI8OWaZ/bI4RHQuBoZV
-        aC6dAObpp79LnuoCNCUEhgR9APh37mvSnKnqk8x3R+hIxTl0PtL1eyYpRsZS
-        =lMvc
+        hQIMAxjNhCKPP69fAQ//ZHA6fVzyT2n4i4AHHMXii+pJPEJN/8QRdAnxZYNZ1n8k
+        G8T/0a0l5xb6o9WmsqE2OYU554uzoHkyMIlM1kZqKZBeBXle7r1De/T10fv2pwBr
+        1wclXJjP8NwyTECASKR10+iGoc0d7R7RZ74dnu5cE8Loj48oZqbZjIedNrQk4YBY
+        PhTyeGsRLpxVSlL3T6aHmw1MfcIQ+P8NVLlSP/61IM4GF5/mY1zl3XAu/GUg7hBS
+        L0mpLwSNHJ0frMKQpTwSSfg9Pi++0NqTSBgUh/ZoikPGmGQl1eFxQ5tFD811mHMo
+        w4xFTzt89pD6Q2cv4KAH7qWdrWBdEvx6O4uTLdK9Pp9zKzB7CEujco8sZWrRmwEz
+        apWI1Mq238fCEtmOvWos0dKZie/dHgYEkPkECcUtDD6kAMP8Y/b1XQ3HZcwuDRi2
+        7LyplVyZ7Qu24vSqK3JuMUghoJL+fqsfKcNAmUBq0ELI1HY1P6ad3PvjrMkHPNpM
+        5MhxpBk61YUc704GFEZK13KNbJLcygA/d8KUB/ouDR/uRjN0xw6cSN2VmTHpGA0A
+        98+3hrzJ3ANmLFxX7eoGKrTltk1m7sIPACw9pkj41z1goPiK9sFawGUN2M6o/7W5
+        UXPL0GfBMTI1Jbgxvbnq05lNDAM7DkahagcmR+Rr7CJdmmQw1ovjFnt4knnC0k/S
+        XgGQM9gT6th0CGAJ3DHJm2yoY2GikeoLhDTzaksgCZM4d00WC21yD8dNPv66KuUh
+        +4pxu8xvyQpPQ2Lr+H4yvEgf8s6CINgYntbmzZIyWTu9mOKJD0iHpBQM3I+3iYs=
+        =zdup
        -----END PGP MESSAGE-----
      fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
-    - created_at: "2026-07-07T22:14:48Z"
+    - created_at: "2026-05-20T02:08:48Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hQIMA46L6MuPqfJqARAAhPGILMoc6wjvefVN6MY1wrTnc5cghbic3mQl/81Td33a
-        1vb0u2E3mU942KLI4a5/DL0FHsCOsuaO+HPgf5zPViGGrkAP+ze6Zll5SmMCu81U
-        /GIEZq9gkhy2mmtJ1OVSGVz7nG8Yvd4LYHaklAbveJnpj7+voR/mztZd5i7t5ISB
-        HTren/1TV52ZzUV9vaESugzd/Fb1iVnxvZDbuYjIpCpeGEwAvZ/UfFI9vbXUkugT
-        krbHRJfq7UPE9S46QVrtfZ2BBOo22U6+3gCzQtNZ5VySTrEksaP+PMl0V7OG+4+z
-        ih6NRN+4lZMeMvUZITz/kP8nvU6xuOXZ+ueRBi3SOySB3MH9txsA/avin4i3/JH/
-        +axLWdkiGzvdWpHIKdtGh6knQWHKMjbkHyu09ml6YLsSdFWPtfOpOwtBI8WumWqY
-        S7qepU9X9Rd4c0152R1nSO05U4dhlnOxt84e8vLdOd+/tMZdCl2iEnWcHyvsI+6C
-        Rt7AIVrwumf5LYtxyJWQzBIcR6AajKv8OhzV39kGVFxuUue6RdJlXVjynZF3Zcp4
-        7MbEBjWZwvyTZYGF/tmvy3piNlhMvbFR4thJDZFbz7OD4Szva1XQhDmMYMO/B337
-        I+vd/iG3rV+K1uZa14nCUn5tPc7ykGnuBMr2swTdvu8MUts18CEGml3rv3ox46nS
-        XAG3Gx179+MRrb0PppuXr6lNLtBqja/Zr90MM41bpIjzK7/iYYeX2i8DZfcymfQP
-        cn+KZK3Krk3R6TIn1dJP5UuKsb7WWsZVBXXsiUtixBH90Ygtoju+g1JIzDAu
-        =ZQbw
+        hQIMA46L6MuPqfJqAQ//ZRYrl3A0QNnXXnK9u1yOATNq5DlbIPpKNo7KeX8HL12k
+        km8LM4s2mLyruJkdoGfEWY0THpGhUGrnXMx2QDxVYf47BWxmBvGinQTw3FAHEpt1
+        fl5PACh0g5tqGkwLHIowAPMjjmTNKn5pCgNC9NGfuco2yx8tZUfdUNWej+/ZFtu+
+        Y14hn4nOSIvl565qT2T62uuPdaRa0pT3gu2Pr5Z1Tn9hGl47swnuq6b81IeqaPu5
+        ukbT0S8UNcW1AxgN+pXfQiLg+Iro53DDxKyZ0usMKSi9eBl7uayf/063RIAZoYl7
+        PkdjaUuhflsF6RFKof8qC2vDHRnQNtIW31u+gNxk8852uuJtYspDR6ke3LdZru7K
+        QpmendFKZUC+9EtUJwahLSeQQJ5Q/xgNuIxCCPIlDftfX6kY3Oi55rl1t7J1lu2N
+        D0cRIAszEC9thcyGlzg6g/C2LyqeHbHdPxpFePN4MOOA5FuATftxwxd248jnEJes
+        wuX6PdaZ0LrcLBdSMSmpgBoVgv8bcyxD3K0SmqfbpZbtFCkDiXIe00yy0KtStjx+
+        b6YfVpojcnXuWEN+lZQDFU7bvMZnruo0L+Z8MFrUb+wLZ9Pini20M3QhH61VSQJP
+        O+s0gEKwaDYp8125iW+mV9o9nw3fMEE49BMjlOxTXCHZk7RVKADzbpmvZ8rWHnbS
+        XgG7HFzmVNeECKLtbVO4rgjLqDw+q9aJ/wFyXNjxuMJKa5FGgl8/g38KpfbDq7jV
+        ogBSYhLpr2cSsQ/sLoLJZZyfjYTmvmSLZpFPqzSRofUUTrBs8/jKtzSCCd36AfQ=
+        =Aa7t
        -----END PGP MESSAGE-----
      fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
-    - created_at: "2026-07-07T22:14:48Z"
+    - created_at: "2026-05-20T02:08:48Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hF4DQrf1tCqiJxoSAQdA0t7VkYBD9+Z0hwHrW0OvjyminASVE/BrCcOD6i3t/3Ew
-        cKKiH6zB7qmCNElnd9lfGWCZ++67afh59mq4/MUH/bWzdE00TPqF7l5DhqdYOEkI
-        0lwB5QrtYGtWddT1n2xiTSELkQY6EgwB96CXS7IEqCL4ab9J2mlM/NGo7Nq/UoKd
-        EzyZGlTbEiOvBnaP9razjSYWMVNlTAew7q5fTNXFyI3iXTbRumsxV58XC9DviQ==
-        =13df
+        hF4DQrf1tCqiJxoSAQdAFAf/+8TjczYTVpr5nrNKG2VHhOGfhHtswIg3pBbEsTkw
+        90waRIH7AQb7pYgaqkfHZc1pfuA2EunAvEL8VsRUxrpueiWH0Yb1AoosjWn7VRuJ
+        0l4BqsK0RFro18Q0xtIh+AEEYkFVJxPS2yJMD9e8Oc9uiRe8JCrBOa/inDGWHHVN
+        o4SY8heM7eWYW4qw/RnTayq4jqsA6vXJhgZHCSTC056RzELa4+WrtF5IVpv0lARf
+        =iTIp
        -----END PGP MESSAGE-----
      fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
-    - created_at: "2026-07-07T22:14:48Z"
+    - created_at: "2026-05-20T02:08:48Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hF4DzAGzViGx4qcSAQdAs6OThibGPTtEdwj47cmmpL0vqA2NYrxbWzBILN6oex0w
-        LFQ37sijoSOWkTppVZPWZnDfF76A31ZrOrXqZJCzBGX6MjaHl9qSUX8Ew/318fKx
-        0lYB7b7sU1scA6spas2j21e7hu8fBRWu0b+bNto10762aesfjOEAYtSBgd88PDbF
-        0mEbs+9MFGkGeBVFg1HczJsR3KyvM+MMzsH+hQfg4Le9NoiQ7tB++w==
-        =W83v
+        hF4DzAGzViGx4qcSAQdAt08Be192JdaBTk1XW0dqa20rDfFtMJh7lJhFLMXW0mAw
+        ff13W+ZxJ2AJAVOnqiza2lHqE0nxTC/TZwvxXmmIbZKjxpzjoV2f5HcW9FBkrZZy
+        0lgBlVtniohqUAz7vbbfyqi/t/6Un/8Z32Cvr060vIvBSANX+Dd4J6Gel4ZA7F6m
+        5rSP4eipg5yhlGyeUhbXzT8l/NcGytbEAGjwMA4olC4dnsdRkrCiZY14
+        =bhCX
        -----END PGP MESSAGE-----
      fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD
-    - created_at: "2026-07-07T22:14:48Z"
+    - created_at: "2026-05-20T02:08:48Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hQIMA2pVdGTIrZI+AQ/5AbMQlNWfcfRPPN139Rn4J8d+2tC4ict5PsauE388LLx8
-        BDycTpjR3nyp+Jg95PEuP5WBngofjwHrn6b0u//T6wqAgNIYFbZRQzOzjRI2Ipgk
-        201sV5YLK8P/TfYo8I032r9PIlc6xK9kR6OCjVrgfTPveNrNDstPvrlZHWe6RLuu
-        kVPInCHKWXppL9noE8r1OUpRPe5cXNlAWULrFE9MoxwEnn9GPRqj5HK2dpOM1Jvy
-        kEo+XNoqGK2ZBRoONRJwQ03FF/LeorDlEHS6RMuCgJxNHzX+JacJJOAH8f1bRRcd
-        4dKvRZGLI472d04sPz8QtGl9LCBk6CwjLSSiuQI2r1vf00HSx/zDWRGKNJyjzyfr
-        1eGZRjZdbEBQqyP738jfSGbHNkH/Io+uVlUTYXrifPBdc6rAACu7ExVkc6/+Zq7e
-        EdVv95GXUfvll+k4OSH9/zqF5io5OT5e2wei6KEghm0ZxaWcEtJn97WAQDM0TY4Y
-        TsfPoPagFRTbBWtw6oMy6POV+g+efjxPsg2KuY/ovsJ0/vbsW5DlC/t8/DLKyPgT
-        CerSNLwr7EzmUfMUZD55PBMIu1rCja+UJ3mrXTYUhPr0G2NPBynl3O+BnVQl8iTC
-        19H5aH/TZOxPqhPWzjXRCpxVLSUd2VTN3myfslfQfO3NXt43OS79wnoet43ezuHS
-        XAHzLeUz6Zs8YD2YpYwbAPlarFRN6S4s5WhMY3/YPsLsrWN9eH42KuYpvLDemRyn
-        dJG5YT+0dOE4ZQxz5Lwc+xKPFrbBKHbak5pykDO+Q4LS7Eesog1NEQ8So3k4
-        =HMER
+        hQIMA2pVdGTIrZI+AQ/8DjyU67Mch06O1rnBp5UpDTJYMsTL9hqfjQcxpsZG1gLJ
+        t5fCtwSgJaxVfx3BfegWuwpS2jNQvuH/oNs6T4yBeN6GpLOzwQGXUe+JBV+aXSEb
+        5J6jyJ7UKwICyE2kN8iwsKMNy/NXa0hhkAt1GIYb0CgEJ6/FOAGxEh7D1lL4WpYx
+        iiNRtmWqJAiTKGE8jnMmFamddKc3wkh16Z7mu2tkdaODNwrzqXhlIrukUAnn/plc
+        NPTws9gsnnOw8pYydQcSDYkKnM3z20pUk6fAfIWZ6JSH7Bt3WJ/Ftrhwixr9Ld5a
+        TXgiyxzfJMo9eUb/GMh1NpRJjLMBflfA3DsoD6dlvUEQAhCpO58xz94dEMrzb1wI
+        mNPwFPMgtWesCzJqXZwVLrtFbU9+e+ZlJL4n/BtgPoe9qhPQpb+hjIJLL6P10vG4
+        YTx0M0v03vHsNy57uBh+ukV0jkm6kcQR8cVm8i1HcX4T0b8UbGyh+FXuMbLPahMF
+        CAPexpw4Ai+lAQm9jpRdhxX4xkXleNfo5WKNjrM2VUxiayi4EElQ71y4MuYbLPgM
+        njYLEwwyRKUjMegOrTBnEsPwxDi0NpKrZ6Wjy/G4h2b7PZNWrOCKE/2MiCcVUm86
+        V+9ZMhpMWfpnAV3cez5Xyj6juR4nL3bOTb4KH+R1hB5yCN9NSKxoZ5+iLBHKT/LS
+        XgFfJrAwCBbD4KBR1uzbo9qcu/VP2/dRTUODxZESpX6sdycg7mrPxhFDDULCR3cN
+        swfbQqfinaD8wI+dwaUOUwKnO2hiXj0wbnt1J7Bh2C9uiyPP7bVMSizO/rAJE/Q=
+        =xcBs
        -----END PGP MESSAGE-----
      fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533
-    - created_at: "2026-07-07T22:14:48Z"
+    - created_at: "2026-05-20T02:08:48Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hF4DKKbvh61jX5USAQdANgMJk05gSevKHsZ2rKCnIvo7E/8a580pWclaJA+kWRYw
-        PE//9dr/VKmnZhWCLwSDM54NnIMgfMwxr6POS4wibOLExW+nvm38ZcKyQQJlRHrg
-        0lwBfTonVmBXBQuVieavjwu0rTn5msed8esmOKrC0mzpmu8juFijhzPMelW8z7Rj
-        uW0zM32lrpoRvASz3Oa0dS1dbN/vjYXGhP1wIwnpTZbsOzxPPsmkBPyegoHaaA==
-        =hfXP
+        hF4DKKbvh61jX5USAQdAWSpHk+R/CKDaO8c1UPr6fOMnivWMuIrBzZh2Q2JPPXww
+        C0C8VLfIorI6P3PbgbJi+BdKIPx4Vi8n/4t1y5fcPk/1NfALPaF2T0QuwhWiMpgT
+        0l4BPZ5BAMvNLSuAiSIloGO59jHpsRNCxBcVQBPIYqMVCTZxwMy+gBki64+ypavz
+        UvHyj3/0Wpy1tHL/V9QSMhWW06S3jHMKS2040LYEY+WWW2+pmV+WJz94zL7+tw31
+        =YBfK
        -----END PGP MESSAGE-----
      fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
  unencrypted_suffix: _unencrypted
--- a/inventories/chaosknoten/host_vars/forgejo-runner-external.sops.yaml
+++ b/inventories/chaosknoten/host_vars/forgejo-runner-external.sops.yaml
@ -1,219 +0,0 @@
-ansible_pull__age_private_key: ENC[AES256_GCM,data:moFPOIyQyFs7Js0sNjlV2Qdr24DdEYJsngDNqsiVJEIiu8mJS9qE9xdXozUympR99NF/dOgcsiBXmSSb4Bhv99OKZp8Kfto/s4eUSx4=,iv:biRudbCF5mdXnXim1p2N+5w9F0z3M9titSVBNJmDXwM=,tag:ESOBA5urjeLdUvTkUyDDOw==,type:str]
-secret__forgejo_runner_codeberg_diday_website_token: ENC[AES256_GCM,data:RDXT2MfYdtVOBIlSrwEnfMQsxKOaloinKFNoXT1lBHrGac9E7ayQOA==,iv:ljt5bELla9rb5H4yhCarNav5qcj0KR2yD66KTKYBVqs=,tag:OZ9G8vS9Wt5/vk34nh6sPQ==,type:str]
-sops:
-  age:
-    - enc: |
-        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IG1sa2VtNzY4eDI1NTE5IElJdEwzbTdB
-        dkRDR0NsY2sxNm40aXcxTFVGYVNZQ1QvZXhLK0dWcVR1eGJHZDV2UjQ1M0tmY3ZO
-        NWdCTUFVNGZRcXI4SjJzN3c0OURKcUc2RVI2VW84dUFrY2gyQVVVZ0ZncUxrZkZ0
-        WkhtcmRwUHc1K3JaNjVHQ0VOYVpKejJWNXV2SzlKS0lnOTcvNkg1am56RUdkS056
-        dnRtL3lSSEVRMmg2cGJKcjhZRTRoVm1jbVFZeE00VUd2dTlBWXZVZmw2VE5DdEtj
-        eHRucXZHYzgzcVFJQ25iT0h5WjF1bEI0Zm90dEtTRWU3ejRmaXI1SGtQK0tsY0Vy
-        T1NCU0FrbG1Eam1FMktQWndDckxqOGErTXU3UjRJM01HbkEzKy8zWC9Ld2lldUhV
-        MVhIM25rN0tpNGp4T3FITU5MVUhjclM0S0ZTaVVrR2hOanB2YVZWdS9TYU1ESUgv
-        SVd2ZmJkS3grYmRCaUZrN2xvS2xnZlhiclRoVEFOaHB1RE9WT2pwLzJKbW1XYlF4
-        TStkbk9HRXNjczNDMThUM0xXelRGcmdwRGxaNThjbE1Td291bmo4TjVEZ0dWSWNK
-        SStBZTlISGNlU0Fib3dmTTJyMDZaNGZYVG13ZWlMWXpuUEFQQjBUa0VJc2ZhQjZV
-        bktYdCtKYm1QVXJaL3JvOFlDSDgzNG1EakpsMkcvSFg5anV4Tk5GcHl1S2hWRnFW
-        NjFFVjJMM0xMYTVRTks0UUR2ZWZuYXlDcElidURTQmVFalB2WHNWd0JnN01XajVN
-        SUs3dWZSTUhZZk40NXNEdk9KM3RrNHYwL3pyRzg4eXVuMDRVR3JHNWMyTVE0QVRD
-        dHFzTEJxMmJUMmNrQjRKMjJRVVZGdWV5bnc2TTFCbHBleEtBVFk3dFQ4cGhlaEU4
-        eG5KN0VBRVAzKzFqb21QWEZhVlNENVBDRkVoT3F1c1ozalpyM0RDQzQxc0pRaWVh
-        bzd0ajJobVV4bDllT2hDRTViQ05wMktXSzRReUE1LzRkMWU5VFIvWU4yT0QxY1NF
-        SjZaRzZOU2VVUnlNWklkRHlTNy9oc2ZyczdkVSs4MUx1ay9xMTE2WjkzNDlybGN5
-        YS9KUHNiek0xMXQrekk2b21hK2U0UGEyc2YrRE5jdmZDT2JIVkVpeEpEMnlZYWJO
-        RFM3SVFwanJEcmpZNnI4UGV6KzFHKzluNUN6KzRLRlBBRFpoUVFJdHpFMVBUdy9l
-        R2R0VTg2QTJRNk9xZmZ2Rk9mSGwyaW1NVElraUVJOHlaT2NNMlNNaGtpc3FVQzQx
-        RkdkMEpoYjZsYzk0bUU4c3lpREJaZHV2NlBqWjNzL2ZNZmljazdCZzRlZWxmR1VN
-        eFlnQWlVbnhza01ZdVZRR01jelJZWEx1NExXbkVKVUthZndtVjI2TzFDdDZpbzUx
-        ZGlLSHJCV3BGakdlUENBZDRDUzdRTW1DSnk0TkYvdy9SY2FjcVB3TDJZc2c0cFBP
-        bGFTZEhkOTM1ME9vdmZ0YjA0SlR2ZXlwZE0wKzJQbFc3M1ZOUEh6OVVsM3AxS01E
-        U0tid2dHMmZnV3NGaUpISHBVTHU4THZSejVUTkN3dk01Y1RMUG5KTkxvQlV4eTVw
-        c0VGYlRGbHZQRkRnR2YreS9XVmVBbHB4V2llNTlybVVlcy9XRzB2aFZLYzJobGN5
-        Ym1TRHo0WVJjaHpsTkRuWUN4cURjcmw2ZEZBdXZYWE1rZ2Y0SDU1K3JML3ZDeGJJ
-        NDhka1lHN1lKWkVIbWwxd2VWWXc5ZTZiTFBCTGtITnYxZVF6WjBOQUhrTFhXWm5E
-        a2xCZ1ptVWN4dkF5am85bGovMHU4NHcxczMrR3ZiSU9lRUZRNkpIVGRJaGZ6c1JO
-        Tmk4QysydGJISDVzNHRiMnJXczFXUzFqRjVCTGRkNnBIS3h4Z01yeHlHODJxRzZj
-        d21zMlljOThZTUQzdGsweE5wSDlRNlFPelp3dHZFd045K1ZOVWd3YTBrUHFBUQpt
-        dWdxc0lxK0JqOE1lMTMxb3AvOGcxd3Q2VHdtaGtHMW5FZDl0VERZenhjCi0tLSBL
-        a0s2Rm9SektBejY2bDR0aHFvekQ1MXk4ZVJ6ZzZLNFljN2g0QXQwM1o4CsinD2qM
-        T72KtziBIb8L/An7xABTWPsNSKfp2n6ypnqy0XZ65jEZ0Xe8B2my6PDk7vihbLAi
-        1U7Q2Eo+C+Xq7OM=
-        -----END AGE ENCRYPTED FILE-----
-      recipient: age1pq1jqrcp3te50xugmv5wst3s9ahj0d38rfktxt43wlcqz7vnwyn3y2h7kyfr6rckrvmuk9m7yvp4efjnfsuxx6d8r9gn222r2eal5593arywrjwrgeypf745wyuvf3z2xk9tm5fgnwckftuvdggk66fph59rw69nt5dpjeewuww4vzt9gs4xelre952s7zjz56qv8tvesg2c89sp8rmy9dvhwfd6tucjhs6sjr6yp2njjra2u6w7c7f0sch3rwkw3wf2dc9su9aaa9q2f22sh5yf0fqejxa2qqpq4pg752589st5xsa5g8tpkjglj4tn35gd4hjj0xet9cjwhydmkmmkffy3nr8zdtctqu6pqsyf7aphvktryez39ru3qe7m6nvr465ffxr0ltvr85nddzxvcwpwpac64nu5tdfrxgjfqzc99vr3zxv8carpsw5evmruqlvrq6v6a4m2cwsz5gqw7nyk3jlj75kp5cnafzjn5dyrf8ppfhp5g5s34zsl7pejmmx2uuudjt7ru2y7as9mtagykrgqgt80fvp3eeh4gsmmd3ujgtp0ranq28aq9x0xdekqh49pfhhprjj6zqdfac5gxtjj736kh5jktc4ls4mjs3p33rzt6ze54uqsfept3qhua2pmugypup6hm6j2ek5sgxjnwvqyfj2l8vz4yfgkaxf699v7jqlwf7g68ang5kzqrjsu78lyardm4zen8zhrr24j334qdgs4zr8dhsfsnmvx9cdvu0swx27tcz8txs46zds9kekgmua7w7fnw3l2lf6zla956ssycac4zjy87rawr4thusxtcqgfzfzh2za9np0s34e5dwkp2l2k06cq09myxqfe7ze6a53d8sl5j43qcekh6kfvl9k0t7903q99pc35630zwm3hwxgnw354du5gngnz56skq9zx3pcnkr5eyh8r8t0dqudmvrrwmxreu6tgrklxw7yvu3zkjgt3gyjhc8kqcrevlukay45sz4k9zqxx9yrs88hzt4h52r2g74alf3cedes3atufy06q4lfq3nxdlnve0kqcwstzr6z6u7fqpqvacezdrr62ycteju6dqawkpthu0drtlxj547htfjcsnrmhgvhskwtuhk6yp7wp30p7qc5vkk8fegg6qx5kc9xs4trx7hj9xgydu7vd30hkceuxsczywjs9v2fl3svkwfypg62882yq6ltv7gfj4ajuy8ezd76g0z7juwspe7q6zs5ceshd6038tvvh2nlpjty6rg6a9qfzhgmjx9s6hynyk7xnq9zra6hxstg8p58x75hapd2mk6rapfunlnnkz5dsxjf4ud4dsvgjfjpzxcdy7sp8dzxtengrsdyu4824mqlw8p63d7m2z4mcyme4tm2qkugtdgrkyphe7akk2geukf6xkfkzd2pkdq5s3qm9fkvfkgrv6yw5kdgjak8xcgesg6tumans4fs8yrxtqlvv2z3emdvwchrjfq4xpzsj27yt4gdg8pknwz9tqpjkjxq6lysutrvwkvt2fwyj8wvv8wtmdl6fk6rsd9kq9a6wkhuq7vvrgwgj3xg2s229sprj4g2vzhy2dfesrp403gs64jqkrjuezwm4zd6uw2x4e2qkj8xqcf7c0zprdzu959x23u878vqqetgpjwt0z3kedt8l6dgpm0rf5dmrya5h3wgzfa0jjvgjphyxgxrwlrzpv4czgal933zs64tn90ks66ejjdaw4t67sch8r3q0kljeqnpdgmw0cpj6arc6k46wcqaccygczy76zt9362vslakvzqqv33tv3sjldp6qxprharmpm9uykgpx66343wuur5xj2aw0rgutpm4ztjzycn3a8d2jq2zpdzwmevezm7mkp9dmndkc3qz0kklgkxq9yehrk5ayfly97umhws0jll8qqg0r7gzxgw5vv76
-  lastmodified: "2026-07-07T22:27:10Z"
-  mac: ENC[AES256_GCM,data:bxgvYhfbWMQKhLhPbhw4GO5lbEBkdKHtf6kzUrZZ9UEmcM4JHfbX+RvtDSptcI6R3HOEwEzqVc6UUfvbLMaHgFzWcJP+Xl/5hghd7sauO3YQ7c6hRTpEHDRdBMeUvEO9Xcui27Gi30sSL8QMizkEenvVbdVtyM9bsfbwWHRwE/4=,iv:PbJ1sKqsuQOZqyl4Q3ccSyfx269gGlTAuwiEsxoYVpI=,tag:D94E/JPqnOJ3T6salPzUrA==,type:str]
-  pgp:
-    - created_at: "2026-07-07T22:15:14Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQIMAxK/JaB2/SdtARAAlBL/0MsCmwYp6yV/9kMP5+zlMd+RA5wqX9t7EYhHHEoa
-        klhscRh7m/417PHAyPKoFY/6z4AajhssiaLS5pJ5nRYT52EEjHqGKCaUREKKqeA4
-        DbTfTwWoVre+Fs8ukT+/rE5el/w0O0vX6/G2dGXZH8VgvXW2CpYKFmm3gqVWM97d
-        Boma+FBZ9QV3E9GUwCG1oYdpdWAE73MCy0poXkclWHwDNFgxh930GjlSry3aB3i/
-        EprRQZ5VAN/aaWznr7eewpITVkWTDCtjeXLbgLhk56Fday5VOSMWRhsiDLOEc7c/
-        h8YxDMwtUrlRZdAy4uXt1O9oPBKAalZ1XU6Fi89mA30jh865RkPL1306G4qAv8xp
-        qS2NQ5c8ZgQ2ZmRWgtBUae/zcRl31Wi5SpUUWAC8iHYYOECo+21fHGpipGBEjTTK
-        bWuIyjq9mzJsIGCPkV7+jgIxQ/HSh2ZboHF8cVJA9OXXsNhMIiip39fzjpPHdgBS
-        6/g48mzcmnaWX1VEJBmR4BnEcnPQTOlZuXSldnl/RMLCntONBRhDUk3kn0gfvbO2
-        VRXjwUTgHTHb2+gfOiAloqvugOsCnuO5tUF7JUae+cPYBaP6hzvc/8rQ6181nq7W
-        039OmzD6sT3ixZap3qv3KkfCP2Xurg/OXxDadxRToBP/N6V2+yge0rtBUV94fYzS
-        XgEFrlQ/wSncX6szebjJXXBWHeAIXSW5wRjJkfzmUFexb6M3/oRKIADZ7Q5o8VQD
-        w1ijdz2dPoDtGfqwu3kUU7q2fls8hAFeC1muANnz/dMoZZTFzu+OdHvQLn7knZs=
-        =FzvD
-        -----END PGP MESSAGE-----
-      fp: EF643F59E008414882232C78FFA8331EEB7D6B70
-    - created_at: "2026-07-07T22:15:14Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQEMA1QflAioE8i3AQgAl7ei2+TDXC7Nu7hxpC02oVrL6I94x0z97nR/K14QELwr
-        zuwV4LBIlkBcALKtpU70ywvaqfraSEnbax1CXtTVdYojnZ22NO0FmetnNFCr5zT1
-        YFyMMsgsGx/+RVkhe+hPv7Jm7zHAusHwyip9q+ZcvMKuVmjBV06QmGPkd9gFKS98
-        EHQbwUhC7rrySo7ctHT3/8YSzV98zJZHh/VFmEDWRO6zNfMmsQV+IkX2IXqxvsK7
-        CS/c+ugKLDHXYKJMVmqvNuyVr7mzsE0cBuuETEGawBZwk4jXzJxQY4yHlshuyQjk
-        PkdSlH3UUArwurhvZvjWyywRNT/EI3Q2ylBujsD2edJeAeCMOGuP2pLt8fuJcT7g
-        Cvqrk4jrfqwNrGWblD0Z5o6FlrPXfKDIRIEmgTQHgxplTCqcCqc61l1iEcbuITtq
-        giFCUZlN2GCG2d/C5opDG+p0dBGcDxq5lQ4KkJ+NSw==
-        =dCrs
-        -----END PGP MESSAGE-----
-      fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7
-    - created_at: "2026-07-07T22:15:14Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQIMAz5uSgHG2iMJARAAy5wBkzFMf7HhDMBLdmBOPAYcxtDI6KTfvFejY+/26rnD
-        s8UZX6H25b38vwvsWhc6Qx0+T6imo/qNTgvqaMaL51kJk8hrzFLI7W0iTOMDo0ow
-        XWUJlv4qA9XSXCNBEvSOfffFYnZ5c1wJp1KiHfbye1yfF40w3kXD21LcogTKjEdF
-        EOzkIn6KVXfqJXuXVy1d2YdT1dZKguUEoMY+IAT+Blvhm/mbLDlRyX2ibGOSQRaX
-        pM+/Vy30ioEvCvbka00sycLIkhMpUTHUG2+OGuNxJZPv9lq9FpAaoO1cgJk0NWLa
-        Q5hzPoEGxA4SPE9SajXLE8IqSop/VI4rcPPxi/JDn/EDUpCGcSJxJV1GVHfs/xvy
-        +kHcl13Mm42es24008WwxOnGVCJKvWJLPozT29JrGmMqKZN0NYfSAHFUzILBkrIw
-        Lbukx4E2KVM7aGxm9qJtnc1SIK8WeVgDCnBd1ktzB6IZk2iq5xbLxW9XQ6O7bVSd
-        Ie0c+vaG9tNIvK0y6bCLwcT1C/8PaEvCvmGhuPVOWq/1bzHoNA6jxyEJEQZqTRlZ
-        uUgE0wkpuYw8884bnicrRgOZ7UmK/r7WCGs2zLBq+lXkGSCLvnZWuc7rtiPtVtUX
-        1uizEERC8Slj7ovt9L7sG6YabCfUPpSevcw4ZFJuPLpotOWt29ES0lO2zLJmxmDS
-        XgFdSep/pNxa+lXtOF1lG5Y311tIe2bhY+/QBXCXEsl6CCkiMIAXHrflKEawYKkH
-        /+9Fix86UW9TcQFjC3f0mekxa5OjhtBoVY8y4IqysC+H5neOo7uBBLgTyPiZ9H0=
-        =1QTh
-        -----END PGP MESSAGE-----
-      fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
-    - created_at: "2026-07-07T22:15:14Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hF4DsZXvxFXTXoQSAQdAmFbXjxmh1e91bblV7z0ixYgcdsXbNe8OcfCtNuRv+WYw
-        8xK7cUl9GEcCpCD9BKVD+bQlcW8SwSKwTzQipZzKJdHtJ0OTf4ytTu3axKCOBC2r
-        0l4BMtZZP4eZAutf2JwFEZgNHRBaSniLVBFHgR3YwQnRH11ofqeq4pp8+jHJhV8s
-        SA2SE8Ph4i9/MSI6dfmZzPCwiitG+/zHb9/68kgYml9NKpIUAHoKbY38GiMy9xow
-        =KMco
-        -----END PGP MESSAGE-----
-      fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE
-    - created_at: "2026-07-07T22:15:14Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hF4DerEtaFuTeewSAQdAj+DsoGtl/2lhiGDkDO75FxS4fJiSRWSX+PJJvpVroSMw
-        1e9Z6W8eM70OUxXbPc6ZTQADBbWUylmBzr8effZ/j1Tztl7T5GUEHfXdub+9ZZ03
-        0l4B8f+kLl2T6DsmFB5VXIe3WFShVrJAH7qG1Ig1YTO7x7JnuD6/hS8ku/qCt3RX
-        MBAhv5wm9QpvtZMONFVWZR9ItqUW7jXGPseXzc7OfbZp5VI2grCLKCML7vjrc7bl
-        =NVUO
-        -----END PGP MESSAGE-----
-      fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912
-    - created_at: "2026-07-07T22:15:14Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQIMAxjNhCKPP69fAQ/+POtJNVm+mKYT0ghdjM8p1w0yIuRKw8xsGJ0ux7ngRZUB
-        nAJKI3iPFuSLxTMIuGptE0UCiY59V4C8io2L850CGdYoFMPgE9XblBUmUzeRE/ab
-        JzzWgjfmxEWJhupKM3QMeHVvpI/BL30/cCFpLfcDfRi5AEJ+TvRcg0e2FSg8VaiN
-        cUr8A5dgX7KfrBwv+9G6N6n5Dn/LTayjo4Pox7PCvWHqJDVfisWiJQCvdT5Pj5+0
-        W59A5C3gt9vdDiBJ5N68CiduGUQ6r3m353QrebvnOo6SJNWW1z6GtXN0+WeT2uc9
-        nIzOqXVC3bQOFF31cnX98U8gHau2//1Xg4QZkQUyrZxLG4jufP7qD4sE/Huk7e3e
-        KonzLo9KDQBMxjrqDT5KAcD2Vb75MCwPpLkWID23lHhPQ6dpRroBKslqU9X5TW4x
-        M3V5UC09XSVMZccOjChqOL/lE1BTjWDhtUMey9IJ8ob/xNpbmHTEpGUZcA4yteme
-        y5KmyYEOFhALgNUAepsqr22YH9+mGAAdVoXKcsSMx7ilNWaxY3Zsquum4kyWnuyI
-        hJtgyb+se1Zj4KqfbSg41faN8k9FQHLYlBpdhYwWpNf6mUJtF84u+BP0NtG58s1J
-        9iSVwg9g1RjVj9NVr0vhi0LWxGCKOdE0xZj0bkpd3a6OnhVKiil0u/ZwwwyZxCXS
-        XgF+dZtHIg12bB3kwQWkvlHRRdlWWWjTrzQFm6fxZ9ln+ZwwrzivSW7P5Iel2dqx
-        8gryMssJZYA0B85OKH4tzsxLDvTlJDcdPTneYRTkK+Rhr184PWcFJlwshAvK6sA=
-        =cTSV
-        -----END PGP MESSAGE-----
-      fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
-    - created_at: "2026-07-07T22:15:14Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQIMA46L6MuPqfJqAQ/+MgoNL2xv83PWouyvSxy3oK8W5Ktt3PgRishl6SIUtPu9
-        5787cU+8I5z6WOKJg40BBlsZH4FD9w/ej0HzRJEfWnm4Oy7rAAWyeXHvh2KudxXc
-        2hHSHpaRS/hbO9LPgCFZ0fh77nCKigd05Oqav4pbQusbiE40A6Oz0F7Fu/da8jXZ
-        4AWeFE6e1s6IAinwGWqU/Mig+h4dLipsjUBN64unS9NXD25Tmg8WcNFl4VH4W9zw
-        fuszZd8cro7pu/GLIqtUotf8MHSnF3XoZcWOmleiApMJlpTmeCIuWQEn2DCMziM3
-        LHzmI5s4y8pZOFSgR+ozszPVPHOhdCDdpTV5mNw8njljEIm/BjYbhaL6EXUaoWuU
-        1G1T4CYvCl0GHFRNxpJonigH9vLPKK8H7/c2+FTKkMJNjcjRf9xWUJm9CCShFyAJ
-        k+19quPL0lHRz+vh1EEqUPuCLDSDvEPkNM5ZKkq2PV4Un6nml+OqLLUWuxWiEzFd
-        Zmu/+ww7GL7msxgfdIuBm5tqxG03pl4QE5aZDDQYBLYiXXok+3dP3ZTXKLU/iwsw
-        hdjecaQymqHSTNKN/0cFW+08sKKjlI1dpTsEKC0KtUATwOnc9c/f3Z5cTl78a2Gd
-        a5Oib9N/yZ9Ec8EWNAQZvZlVvnvirujb7iu5g66T5PVAmi3vvJXTV5ZekEmXb0HS
-        XgHoo0biVdvjLVlqA8BOkVpNCnMhsNC0ccoW3QK7+H4Yl2ytaDk/fXF/fsc3ZFwu
-        Xg1M+CmsoRA3BgtLsLpjc9ibH1zw9P4pYJGq90PC8Qp5uq2C7KU3UgS5Y5c1WiA=
-        =Uk6Y
-        -----END PGP MESSAGE-----
-      fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
-    - created_at: "2026-07-07T22:15:14Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hF4DQrf1tCqiJxoSAQdAInOGTOBg8qS9hDUqOJwNiu68zpxikVgCH2X+tW7ImzMw
-        yApo0haLTfw5xlQte7aMIPmZtxM94bzoPaU0i5hXpql7s8Wn8cfrjosceh/xu1Qu
-        0l4Bu0YljO9Ehx/5SlxhP/mhC/tGigmKy4z1hLdUuUTSSBmZ/DejYRjL+nGI1riZ
-        K3A9fHW6hztj0kELKiguR9rYVvxpny7/NX/3Dze1NlwHcTSKT5l6yDiwCpd/8Qi+
-        =mAcm
-        -----END PGP MESSAGE-----
-      fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
-    - created_at: "2026-07-07T22:15:14Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hF4DzAGzViGx4qcSAQdAN3UbYHJEWKRYalqraIlAc3wSgTzzAZbht6TIncNOg1Aw
-        kIgZ1xlQiKE7hJ1piZZx8ZMNZHy3BSgbxZ+a/ieknyULAw8GZsOzo8LDrLA4SJgL
-        0lgBWDTbNIM0hkouonaZZSuefuU0k7fcqFFtHXw4jkFNfi+jimx11LpGsRbTJzIr
-        dMoKp1JYyxWkagZLBGUGQ4wyYaWEKduSb+UlBsonnIdehjuLR6uYFrNj
-        =Lj6l
-        -----END PGP MESSAGE-----
-      fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD
-    - created_at: "2026-07-07T22:15:14Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQIMA2pVdGTIrZI+AQ//dvJKQU2EQGPUBtBXuVgMHP8yFMQagCDKM1sTJQLNWgz3
-        86Ey3XatwPw0YGYOBgqVyxe+XYG+XQUtfPoTo2oius3HyqZcvkb194QG/h5R5Tpa
-        +zMzLLe/YgENTkLcfRB/BStLyzzwv8sTQiI2RLTb3jX80PYCYU5VzKhz9KU74Nrv
-        l/TJE4fELFih164yt04Xqm6jAyEraJu2SavxZvyLl97driEwLuwfRMXPnjeaXkiw
-        Yv850rmZwF72b08F5Vw3Le1HCm2pRaTpw1bm58v4PNSjTuGThZKoYWToYrCDApHk
-        1we0N6lZu2AOtXsO71PYJYWeyX0EHb9Ye6CG0TAsJ8Z5iM++Z9mZ8mzdMCbPoMk5
-        srdKo6mT6y0HodyyRC3zcqLUGDFqq0ihcHxmaWCavFxpTEjC2cbLK/punklIS4e7
-        IQPX0Lth2JB3VsGS9IXYqm0FDw8ldshAxBgtNIYoV6xhIAhTofQyH5P5fEyAE28n
-        uYW3v5V7qKRhSidIj19Etwu885OaWlo0XE0hapYffQZpA/fGDOZenf+XlbMpYePZ
-        E2Rj68SFq7S6xw5cqA26vk+4Dab5TeJ9PtI6RjnI7+Sqj0CLhrUzDLjQjrCZuAWY
-        GGBzWz6vP249G/sJAp/DClo1PsdIqyykkkRM/An5h5xUJXUkIB6+Ia0bCsupn4bS
-        XgGfbBBt1LgmkdSrHubLpAJ39W/uRfO0CbfXW+Btm1dxffgMxEh8WKkByoDEHAzu
-        kCEZNerjPRP5fpj5rDB0dq1H46IXXtbLZ48yocuhJWke0Ywmztjxffwxtu3nMW0=
-        =HrwC
-        -----END PGP MESSAGE-----
-      fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533
-    - created_at: "2026-07-07T22:15:14Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hF4DKKbvh61jX5USAQdAvj+VoDF+LUWyZlvdPNDEYZ7DsrNiacFlI1rgID+kHFow
-        yqbYk26DVNGfYlxAihq1wAKlMLQ1U1+VGsQANGZIz8OH9NhvhTkAwpz9HLHtdmtq
-        0l4BdyPumBkzSOz+oWcVv+iOfINONOY2+ms8+X6lF9hBRWFeNIjxZOI/YE8JjIp5
-        DrALA7UgZxCXJyQErNbxF/HLCP7aPBvYkd2lCz93TcEQLEtAkG82cNrjtIVQ3yxg
-        =NEpg
-        -----END PGP MESSAGE-----
-      fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
-  unencrypted_suffix: _unencrypted
-  version: 3.13.1
--- a/inventories/chaosknoten/host_vars/forgejo-runner-external.yaml
+++ b/inventories/chaosknoten/host_vars/forgejo-runner-external.yaml
@ -1 +0,0 @@
-forgejo_runner__config: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/forgejo-runner-external/forgejo-runner/configuration.yaml.j2') }}"
--- a/inventories/chaosknoten/host_vars/forgejo-runner.sops.yaml
+++ b/inventories/chaosknoten/host_vars/forgejo-runner.sops.yaml
@ -1,188 +0,0 @@
-ansible_pull__age_private_key: ENC[AES256_GCM,data:fEly3EIovZ4n5xMnD5Aqtbn1+DUszR0MvBHcM383G40qfHxrbF/lqc8iftshInoHSU77Vugignyb0dTSCTS1cWmEg8I/+ZFjgwc=,iv:Y1XunCfdIUC5nTu+vkr0Q0LUBWeIwP/bGNkbnDb1cpA=,tag:6UrkMx6yEGB46VVvtAkDMQ==,type:str]
-secret__forgejo_runner_ccchh_git_token: ENC[AES256_GCM,data:5igicsbBCLvsWI6YSFN2A/XD4An1l31YBe7Ngm7nHopWR/Ge266I9g==,iv:sVXBSeEWNs7GIXasZdbIoiaeXFTJMkM6T8vZCNX5Tek=,tag:aVIX3+8pr1lyEy1pcu1UNQ==,type:str]
-sops:
-  age:
-    - enc: |
-        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKcFhwNmRXTnptOUMrN0dZ
-        UnN0bFdCVjJQamNvTzZmMkxRdk0zL0E4bm4wCmRIVmVrVW1Jb3BKOVNnNnM5MXJm
-        SXU4ODdwUTVaSE9oSU1tWm5ZZUpLNlEKLS0tIHVUY0pUUlg5SDhJZjd6ZFhsSnBQ
-        VVI1TnN3UkcxUzdOWjJQTzZLOHNlaDQKx/HqW9sEYmNYIMYvLVF/9eJfcgRH/cJv
-        YqcDNZc8L9Rap2TfwsiJZourqDTe/8sWgQ0yHC4mcKS1HJOTUMNwqQ==
-        -----END AGE ENCRYPTED FILE-----
-      recipient: age1az0k6cadssk6r8qcqxfr8cyu5mndy59pwt8yqq6w065ew6au4ezsmg2vkf
-  lastmodified: "2026-06-23T19:38:01Z"
-  mac: ENC[AES256_GCM,data:3FSmib8bQgi3sf5OSZvKOeXNgPphCM2LtUEscXD1c916UC0l6WSJsB86CpwPolInL79o5148ond7u0lDiM+/yLx4QUmxLkJXK5hi0KqMmUCp8L/oVslO6Q1rAJnhKkfcPpnVUwk6lRvcb+4NXIG+3w9EBPSWXL2yBLhRMXmtiBA=,iv:sVJgqoNMZY9jwdq6eJJoTZ7rAqBBmfxsiDXV9yFhPws=,tag:NQwpxfBGwAoW83CMl/mitA==,type:str]
-  pgp:
-    - created_at: "2026-05-20T02:11:43Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQIMAxK/JaB2/SdtARAAjLRV2OOq9LMCn8jfeXXeQV14nliYJW51ry/lyAAT0mK/
-        UrZFjXJon1HibzvpKVscCN+8i75RamsEp0/iKOoQKORUNZMWvaURPtzkzEFwZxja
-        tLKzraEl38y89UCP6XzM/D9gLxbGjioz8eSZ7InXowHFGS5HykeZQpPKN939l+lV
-        0fxZH/yl0uDVOdjWb5NWVqK0xhVToi2u7uiwQiL/PdfvglCEsF+a7Q0bBRJIko+k
-        DN/rfq0xhb0bMo52lZvHrqOAod0Kj5ROebvwqOpXCSTFi0JcrVDiE+jq1wdqofni
-        VkL+V2Lu1Wi7zGQ/gjkLWWfd6IqKxcepsmtedy5Fs3ZcGKQ7jBw0fqvVRXE7FUFc
-        H74QWr5JSSjQxJFCugBTFgeOU3t4VcYeVt32FhlmfKsQ9I8B4xPuvTvmM4S5uELF
-        Sj2CHzR7D52mmWykUKx3h2f4AgQDv79IPLKOcRpLbJeOkI6kdDV/KfQeLcL3/RDA
-        FIHQDa27n62os11WmcKSqb7dI7W5SYKd0eGHfhynjQlV4LKRvrI//vYsIz1bY+Qm
-        27eKe6KodvijhR/aok9fT9vhRpD8OyeLw/1f46azuxdxPUNEdQ6HYSu/w0sLhqte
-        OtM7q+NK7G5I19KP7+e9tJBxou7zpm+poseNQCl2j1nBGjahSYy4zhct5fQfKLHS
-        XgFZVUiV88yP42Jd+lxHZ/bs2RJ+RuQPvPj43c5jrBiRNEqKRcEXViHrJctwKHkZ
-        +6j+LuEKKszsWNGN9cOpdyVBcL5PUJ8mRribr3SnsEaFk+swutFm2sA5gLSYdB0=
-        =IxLP
-        -----END PGP MESSAGE-----
-      fp: EF643F59E008414882232C78FFA8331EEB7D6B70
-    - created_at: "2026-05-20T02:11:43Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQEMA1QflAioE8i3AQf/cKHMPmpFsvqyJJWZsgNB1tWeNh/aiKkCIS4Paf3hBeur
-        Ca4WElrH+M9feFH7qR3zXHviJXB0zt8oyUUNiR/xg1GNGw2wfVh3EGUWbZ7THog6
-        sqN/2KxP7tIk74mjlaMBmIpyr7xd5OkjhQy4IkAFr0PBRGunVVa8d+73uUDsZBdI
-        XLpaDUZXpANOxZbXxBGzeYgG55yBs2LiXKLcjOkIi9G9w7Rtk2gdH4tI1miRstGS
-        jSB9xDCtszxm3kWmcDAG3nAORDCgYnlpeZrPGUhTqh7JzLhTZo46EHSKY1ThdVnM
-        cbbx0CNfcTCDWVxZEv6GHogAFSELn/gzFiWXjlcHoNJeAUNMxzW73TD7mB7he4EG
-        Phlz6+l5XbcSmC42QaLG7IIMNIpg1pai/fyBpKTYoHAGEGuDRcDgjKGOPTQH3N+0
-        eIMu44nYPUh69kvzeMLCCbzFgDRyu5J4pbCDEiY/8g==
-        =VDJ1
-        -----END PGP MESSAGE-----
-      fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7
-    - created_at: "2026-05-20T02:11:43Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQIMAz5uSgHG2iMJAQ//cTX8KOVgAdIQNYMKP3pDK5tpjUV+idiMr4Y60ny0UNM9
-        SlNHmG3RLkZwyBaHdeJ1eTQYSIaWasUUhCcI6sA5A7SYPhMDtYU5lsNgmiue9J0T
-        Z6SrCe9T15Z4bDCS8M/fli3NlkImkGUN36Ou6BXzAVKAKfglzVnPAT2+J6JGBHbs
-        z9ailkVGBonU2QQzJ262FZYY3a+Rpw8w4mDCoIsfbEwxHrB8lLyf7AX81qtlcaHp
-        ib90CCk2aqifudBfLKRIsmxBDkD+hffF6HSX6t3q1Tvw7Cg8Hpc+LWs+ZNPkmf/a
-        0/SrMUTBey28gDoDloRfd8wdPzm3Adxsy/bTRkAX0Gzm5W+sZAjeUyqi5MfSefgR
-        yr0aff6D0oWRn1geLdcNJmWfvRM35K2b3KU5uxqshT7WjA0i/rJCHu5pjpsEVypA
-        itPmVt1BPDSHcaQddaXOSpSMqYUOltvHN8pV6zGBAAsUzSor7GugClnMHCdp251T
-        som8Nsb6IziKWs4dPPR8DHYMFVFrLrtfkBi3XO8fWVncwcEofmYsRQotsHLUAkjV
-        5exEu0OwSKVzlbqmDuZ3z0RByrPpfZWsJWshBIug9Br6PL17RauFY0cuCF0FPA9J
-        FGlNHH/XG+YqFEj6kcVYzQFue1fL4gD7HP9u5yOQ/D8JoBgtei9r42xetlBCFyjS
-        XgEoIc4qDC3aPKBB7jhGV6Sc8x/4fdjpDWMA32pzKR8n/BlQzYv8+b5X1m3ngPhf
-        bhGiZMIv3HgEQm2M1PP/x3ViqkJAa1EphGG5yOlm9dGq1ynreGxWVdaqEWWHhrA=
-        =W9zk
-        -----END PGP MESSAGE-----
-      fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
-    - created_at: "2026-05-20T02:11:43Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hF4DsZXvxFXTXoQSAQdAR75j7EdRO8U91jSZn9RGZLZmVHQ2wt6dEWWE4lZU+Agw
-        GKy5yFdG4ZfWxZ3QQUllIqA5Mn1Tapbz7XigK9D5/hF/oF5gedq8EmzyX6FWZYCn
-        0l4BBTyZdlsWswCeE9zCvKkfm+L08kmnNrm9I/F8cOXx1BrxS5zXdhtNTGvGZ3Ww
-        hJMt6Rw4rmX2Mwm6dbpcjpZPjRp19Fb2nwnTwQ8YTRCSNulDRtJj3FQ8P6IT9HKN
-        =/5xR
-        -----END PGP MESSAGE-----
-      fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE
-    - created_at: "2026-05-20T02:11:43Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hF4DerEtaFuTeewSAQdAQNCm56yr/4kGtjRJ0rM1tUnRTHXRPmGul39NNGiJdQcw
-        J3EOCTeg1HPR1CoC0FQ0qSAHQQymkcjttutY2D/oU2tLdqc1UsW01+ycscZ7XLwn
-        0l4BQ8s8gN/6oIkFPvsN+oUP5Zs1izGsc0yozg42resT6qlsML/jFBvP9LLGBBlJ
-        0VCK22OPMOXSHnCofSbYelhyahw7+xdr38juIxuQaYS4Lx5TPZ8HaKMkzXzduBt1
-        =4xwZ
-        -----END PGP MESSAGE-----
-      fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912
-    - created_at: "2026-05-20T02:11:43Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQIMAxjNhCKPP69fAQ//T8mW0sDkD6e2hWSxIkhVYRE7l8bsFbDcbHkz47ahUrfK
-        lUDnvzEnX/MEt+PZJxzuzfLrRDmm0VmOmskJrpguwpY27AWyq9zKqHgxLtB9EkJt
-        MP3I8oNL+scjhX3cr/HogtIdaCpb9+JSCxZ+idABYMjyDb7+csFpHzyK/G6rToMr
-        EpvWD3BduP/tr+frVmRH5zxUku6jt/GfkiIq/a8mEFyyLzqsxG5FofzDCx01MbYA
-        DU3try5vX8HYUeuYFHhU7qOHIk7G5xen/92m35P8LlllNTjTcgz9oqxGuHrfA2Rz
-        K/RS9FoI4v/NNKHqUjI6Rd530/zezfWCOi4QdEdXLwUs8YyTyEhS3jTwIops70bt
-        Diun8OQ+TIE+iQopjBCoX4IH5M05N9KE1dVURzWQAy/F9tZj9GEhRRYgo43k7Zd7
-        BpiFFAoC3uVDYCCznjd9IuupO4WnKnLGEWenWvxcdXkTxXvzO6KfonWq4GUKmXja
-        n4qu6pYIAi9ZYhXqKhHAm4+kgbsvhAM09Es6LX5718rJrfkYiYM9aIxVFO3pz7CQ
-        PI2fknrnw4TXKrKEvej5q6XYlKu7nSuSoMSv8P+NNPEivpVVZ+KPU+pbsNKRqEI4
-        vfUYuAdg3t1isEtV+kI5CS3aIg+uU9RGgSGfF4Di0WTog2MZ5tyelvtAa+e82i3S
-        XgHGXuiPatmZyu2mXJZv2kWxp9UjKkDaZttKNAbTGWEtWAE0uyjmfuvMLt7r61/a
-        yjWDzQCMST8+v3jjjzDV40B0kOJ9+6vzAQcmoPtnA5vf0dW803OifUB6nWcVKtA=
-        =lxsO
-        -----END PGP MESSAGE-----
-      fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
-    - created_at: "2026-05-20T02:11:43Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQIMA46L6MuPqfJqAQ//RXIqipr1bcZkBfjokXOnulmcTCZkhv28NuxQjwYHWa77
-        WYZpBwVTN0SqtGArF+E6yFvOdzoDwNeA11nB/AguU1NugROg60nP/169gCb6ydE+
-        mHtTmO3jU2GIj83i82GVDnGNji8/TIh6ccz1a3pQeaygFnFZnDLwx/DJSy0CTKTs
-        SjnU879teK3CiFCG4A8f3RvB2LxvXkYWYEQ9ky72zUxTFVij3GdbP+fXsrZQHQ/7
-        WrbdROvoTdtd4nAsFQVtiRab1Y+TCcHQdxxjWFoY0pI4pOcjHtbVh/fTYCwxmLez
-        s0hm9aKI/xS6WNXna6CGOjN+oFO70EBNUZNZutmDUf7kBXPSlgINBy/HPXgspOAk
-        Ww9D7JwM1uMOFYdLclbP/DVkUk8X6nVYTnJR44SwlHoZEqYSs0qNVosjWQWVi/Dq
-        D5LO1Ynek+u4GSK6guiCdj/arUaiKjlTQOXgnk6P0Pu1Y1F2kgzR+Kv/AkRTokmM
-        xFXpHCXVMA0ZrQyZCX8Z7eNrV9vzEfNhwm7hNrASxEnORxHRZP4Kzc4SNqiWeikU
-        f/2giFZkTjQoKjGwvcRgtPRDRYuS0EVG34Ha5LOQ/ViAsvhu6eQD2EZhEYENhmIP
-        TO9jeZZY3GMwRp/lwHaKFfiLRfmed4kVG2I/YDnaGeQv6dU3RGx5XDBW/ifBBeHS
-        XgHyN3Ys9YNg2DB4RXwQfkTSTNwHO8EUwuhvnONlSUFlPBe5pDTiTqJChIFGRui4
-        AE6m5x79h1L+s41eMJfXES9THlw0H1Ok5UbrRgdFeqDnFxrbPga7ZY3b2UlU5BM=
-        =je+P
-        -----END PGP MESSAGE-----
-      fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
-    - created_at: "2026-05-20T02:11:43Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hF4DQrf1tCqiJxoSAQdAFK4dMZNE3rBCTZx4vpomMP1tdAAdb9lBOcY2S9Tz3zww
-        5c0ioplBR3Z+vIGfczw7RPCCqUwGU2VWdhCcagLXWa+YEQcTRN8h2jZRWg4p8hNW
-        0l4ByPozkxL+sA6XX9YvGxFAt1TwCoceMlDgqP3gX/olL18Jj0EcIkGTnrzQYNBD
-        Hq0zbuJdJkQhWafgE4g/BL7v6ERsPQnMyt0xAv4o+MW5T2I+9zBhOKEeh59RWrsx
-        =cptl
-        -----END PGP MESSAGE-----
-      fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
-    - created_at: "2026-05-20T02:11:43Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hF4DzAGzViGx4qcSAQdAkilW27qVaY9/x/Y1IAQbMtDpkSt71uM1N7WXEnX0oTcw
-        RK7MpWp9JsdqLhAr4kxFzjupxRuyrQzyBn/3Tczm6Rp46l0VIbkuWwcaDQbcjqSh
-        0lgB4jPzEE8CvDBh10D09bkYyDjMi5SRj4NGZnULrXK+nOMRcvS3t+yDHYVf3VbI
-        fmqRKisWCVt0WB61n3VoSE3E6nKVi8crUu0PLbbPP1PdRWlihdKb2wWK
-        =yR2L
-        -----END PGP MESSAGE-----
-      fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD
-    - created_at: "2026-05-20T02:11:43Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQIMA2pVdGTIrZI+AQ//cQEQIceF4S9yhIaAs5ZHR1sHAp5nN56yNuoWHU+BxfWd
-        IDk/0JS/2oyPIviCmN/BjzaBBz33mptIfUVrk4W7V7SWCjo1SOAbDLm3L4+xz9eF
-        pW0a90ZoCIr31ZzQWn+mV4c4+tpaz9pO119PZdAiWDbmv2aAG1Dc6vEP31V3gt8j
-        OFXVrRtNKar9j+8v1/ZjOwZYgH5r3JQRcjflD2gLEoDec6QXVzpkG3V/8F1SPOos
-        M+tHloplQMWkY5frhgv1qjPCYFf8pMAs1bwO0o3FubTgXWepbtJ3Y4SAiOuXgp5e
-        uZpo3M3pP+uqzUGak/G2c850bgDJFb8tTYYYoDQ+EmADfXYN2rts+vye0qNmkDit
-        +4hjiIpUnqI/2xR/V1dnInBysGRNgOyWLrRJ6qBTso+xxjF63DTraPxX4dTGQyhQ
-        uW0R+d57Uinc1C+lqNwbacptqQ+d0a5lKLkq1xJWsZyAM7xDwFECTZNlBCavwRlg
-        e1lCPBcj6oBwVyYLGatlx/lYpnYqoL8bOGa8YjHdfuUzDfZJoJMgnm+EaYfPXbsR
-        alUXvkuK5F5IXGkTBEwt+ilKFh+LMUREBvzsSsQMOM3eYd5leb+y5qYciejJtrUF
-        /cvDR1mu6Gv5eDBAIxgZqBAZsJTk4MCB9qChJijiLREoYOWccKIxkhYwx31KiyHS
-        XgHzZBEa37fzigfWlSCSjiW/Mb0BzMZknv7ecEMwV3WJYNH9ixmGzNiBp7QOA68P
-        21DbV7Slj3zZrX7K4KWSU0mHcPmS1V7OkfGB1+yurnS40cJy7qv3TbuQYjQ/1OA=
-        =f07d
-        -----END PGP MESSAGE-----
-      fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533
-    - created_at: "2026-05-20T02:11:43Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hF4DKKbvh61jX5USAQdAsrS/gPOqsUf5SSdki8Tz4YB+EH1W9xDU5XZZrnWZZ2gw
-        E/ceAF8IlHAXh5QLAfbXiaCq1j11t3jHpkSdXO8JJtkeFuGLfMVNiMGf1j4doEhi
-        0l4BAJGJ/3Y94vsOSiC9Sku9zjjaB86XFUxJChgdPzfbqhcKHtnBLMW9sm93qE6C
-        0c5EoyKBvBoJPUYm9nv3AGHmCjhZ006Iybvm3xtrWcmFfQ1IUdm2qOVtoTn3xs2J
-        =tlQa
-        -----END PGP MESSAGE-----
-      fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
-  unencrypted_suffix: _unencrypted
-  version: 3.13.1
--- a/inventories/chaosknoten/host_vars/forgejo-runner.yaml
+++ b/inventories/chaosknoten/host_vars/forgejo-runner.yaml
@ -1 +0,0 @@
-forgejo_runner__config: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2') }}"
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@ -93,14 +93,6 @@ all:
    auth-dns:
      ansible_host: auth-dns.hamburg.ccc.de
      ansible_user: chaos
-    forgejo-runner:
-      ansible_host: forgejo-runner.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
-    forgejo-runner-external:
-      ansible_host: forgejo-runner-external.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
 hypervisors:
  hosts:
    chaosknoten:
@ -130,8 +122,6 @@ base_config_hosts:
    spaceapiccc:
    mjolnir:
    auth-dns:
-    forgejo-runner:
-    forgejo-runner-external:
 systemd_networkd_hosts:
  hosts:
    router:
@ -244,8 +234,6 @@ infrastructure_authorized_keys_hosts:
    mjolnir:
    auth-dns:
    lists:
-    forgejo-runner:
-    forgejo-runner-external:
 wiki_hosts:
  hosts:
    eh22-wiki:
@ -280,8 +268,6 @@ ansible_pull_hosts:
    spaceapiccc:
    mjolnir:
    auth-dns:
-    forgejo-runner:
-    forgejo-runner-external:
 msmtp_hosts:
  hosts:
 renovate_hosts:
@ -289,7 +275,3 @@ renovate_hosts:
    renovate:
 secrets_hosts:
  hosts:
-forgejo_runner_hosts:
-  hosts:
-    forgejo-runner:
-    forgejo-runner-external:
--- a/inventories/external/hosts.yaml
+++ b/inventories/external/hosts.yaml
@ -24,5 +24,3 @@ ansible_pull_hosts:
    status:
 secrets_hosts:
  hosts:
-forgejo_runner_hosts:
-  hosts:
--- a/inventories/z9/group_vars/all.sops.yaml
+++ b/inventories/z9/group_vars/all.sops.yaml
@ -2,213 +2,225 @@ metrics__chaos_password: ENC[AES256_GCM,data:seOU504dZ9K21+NK1MBf9isee2L2rueP6Bl
 msmtp__smtp_password: ENC[AES256_GCM,data:FAih8FghRYDx3QGFCjKoJ8Zq0TkeCIx4n1jTx4/sASgECqvucg==,iv:8NDn3wj/bXsbHbuce3ycJTBVWde6XAVxv4NuMUkMbIM=,tag:jeE2b0i/8JPtguLYQvdV1w==,type:str]
 sops:
  age:
-    - recipient: age1j0876shgsn7f2thxh9kx9x5uwnh45z6sy2jlk2qz5jhgedm26g5srn9kax
-      enc: |
+    - enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1VWJQWnBhcDc3VXh3TnMy
-        RFljQU0vNS9iY3AvTWFraUxneHIremlDeUZvCmdzd0twWHZEdTZSbHpLbEpRRDNX
-        aGI4ZlczN0tFbC94TzJ4bm9aUjkwcVEKLS0tIHRGSGdkQkN6ZEVTUjl1cGhMZzVI
-        S2FtSktoWmF2TjZCZnNlYWpWYzQ4MzQKeK7f+UPSanQsOIXNjzZa9B5FafNFsN3W
-        sjssDdbNQ1OEn2CLWRVQl1umKrADuvd85fMu3gUZrycZRDCCfsBzVg==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxTzAzaVFSRDQwN2llbmdl
+        alBBVDZwTWhWUkV2L3ZLZmNDUDRyTitDaFVzCkNRTEN4ODV5ekxRVlBZT3ZIM2pj
+        Z0JxYUlobHZCeGxxNE9PcENkR2h2VDAKLS0tIFZiVXJHSU5naXhSSEFobVZBN1Rl
+        NnVDUVRyVWxlUnMydVhiQ2s0bGMzTGcKh97/UOPxrKieK5dKdGyRqCRi8Sm5UNcT
+        I9jLCPqX8Utt0e2EEp+ivJwFxgo7QuNCYWu6jtPCO/Zmc5Q/2tJQ9Q==
        -----END AGE ENCRYPTED FILE-----
-    - recipient: age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q
-      enc: |
+      recipient: age1j0876shgsn7f2thxh9kx9x5uwnh45z6sy2jlk2qz5jhgedm26g5srn9kax
+    - enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkSmVEVyt3OCtvUUNqV2FR
-        QW5WaDBFcnZVMTV3QWdSLzhxRENCdGNaVFU0CmxqM0xIWUVCSUwvY1pBVjQ0RCtq
-        T0psSG84VWdpY1dYa2doeFZXd2RKNVEKLS0tIGNFeDFRYzBDN3NWcnpUSVhEWitY
-        RXhLRkp3ajdlNGY4R3hRcWVSUU04T0UKdprDhBpp0aMc733Wx/K7hS/nLVohvlft
-        N9aSQdcRoqT3/iMGu/6xdqbeq0/7a/U+6JvhYyWLkLsrzw2mlVRoIw==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuVUtpb0FmeUduNW9EdHJw
+        WEY0WllWdE8vRlVhODU1dUcxUnF3WE5mUG5vCnBQRlNkblNHbUFESXhvQ05YdGVW
+        UkhjdjdvclRmTk55UXRGRStXREFiVVkKLS0tIDlkMHhxVkxEK1BjV2orQUtndGc2
+        Mk8rZm14SzFWTjJTanVXaE53UmViS28KQmnPfzLhgLasSuu1Aflp/JDWo1hqvYjb
+        BijruPUZ3NuoZ4Wuo56FLlTLrch051fI3ottzy85FfX3lRnWZ2IK8g==
        -----END AGE ENCRYPTED FILE-----
-    - recipient: age197tmckjll9999v5apqh5h70dktdxzxn92uyzce5j7jmesvnneecs9p7m5j
-      enc: |
+      recipient: age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q
+    - enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQWWM1WFdidkY4a2hLNm03
-        TGdNNE9ZK2lvelhYQndTYy9sUzM4TkN5elRZClJwQU1qeCtwUlFzeVE2d0FSSCsz
-        WTdzQWZLYXpqUHcxc3VEWHZvNmZibU0KLS0tIElCTWdraXRLcHNHMjR2eDVxVCta
-        bHhVdFpOdDB0eUR5d2hhdWJlcmJDMjgKBbVkm7LNwnoUVrUF3NPI7d25b6tAIr1t
-        HelMjQU5YFM7DvRYFOlNpgO7WmddNSq3C6WYa8AZDGpsjc6GypcLVw==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQSm9FZ1VmVWhadldRY0JU
+        c2R5d0tNMDV5U2tzbVorai91RTFyZFdUMWo0CmxLVUJYdVFUN296U3Q3MTJQM0JW
+        LzNTYlVVVitRYmk3azQ4VXBLWTZiZjQKLS0tIDhXdFZaK1BWVFp4M09jbk0zdGpF
+        dGxmUUZkQS9sMXZoeTJETGpvQW5VQ0EK9Y/trD7VhjQnqY+KryPfEv1J/D4NCWsx
+        CHv0R1ps6A0qoRJzS1UNxU5bLXDX1RGQiU/arhJ7LXFxHrNOdObsZQ==
        -----END AGE ENCRYPTED FILE-----
-    - recipient: age1yc9s8r7zt6tc7scfyxc3345khdwqrx0lwj4z6yp56h6rmauev50s5yqr22
-      enc: |
+      recipient: age197tmckjll9999v5apqh5h70dktdxzxn92uyzce5j7jmesvnneecs9p7m5j
+    - enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzTmRaRXorMzBQZWwyNFp5
-        VHdUUElyd1V2dUcvQ3k2STQ0d1QyMytsRG1BCm5CVCtRWU5FVmErQWl2N3Y4QTc1
-        Mnh3K01QUnk2MGpSZk1NRVJWUlhFYWMKLS0tIEFOM0pMa3RVNUppS2xOakFVM1lR
-        cnlBL29XQVlsL1ZCenBIYTQ3S3JxQjQKq09vbn1XOC1jIXDpv+ThFMk9k7SyYknr
-        MBJRBp/0PrKBo/Xk+RCSWSLjgali5Cc8KTjDTJyBG8rFzzvLIazBRg==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBreTY4bzJ3T1FHOVdhS05v
+        dG40VWdVeWRpamdqd2ttajFJUjdYVHB0ZXdVCmk0UUJuRHdsUnE3ZThNakpwY3po
+        b3dtWXNNSUlvbzVHcXVIclNlaVNub00KLS0tIEMwL2FYcEZ1dkZ5MFl0S3pWSWFJ
+        NGdXVXA4UGJIOTN4UnhoMjRYaTRNWXMKGJNomXuB5TqXZKWk3Ub/rEc69CrfYABw
+        bBBidbCQBrv7cnsvjsVpHHGaTwyP9Nk1ceF/gbv9fD9gZ7dwt3SA1A==
        -----END AGE ENCRYPTED FILE-----
+      recipient: age1yc9s8r7zt6tc7scfyxc3345khdwqrx0lwj4z6yp56h6rmauev50s5yqr22
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrQWhjNHlDU0RKRmdKTzh0
+        M3dhOGcrc1N5SnozMHhSQWNUdERPSjRrZ3lZClBpd1lrbXY5OEVnMVgwTGl4YmUw
+        bWpJR0Z6RDZubG9lS1BIVnEvMWhEdlkKLS0tIFhSbVFhVnZIN2xETXlWNlh3TVVG
+        N1VTSWN3SEU5U2Uxc2lRUmwwaWc0L1UKfPWAEs93dF10GZdlQt3yeDltk/9Djmuh
+        3ZeGLgkOjcJPXO2hFQMZoJY7a2ZRIxN5Oa8PGwuy7DEtmQ9PdP/mbg==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1tx03yh67f052jzehvtvzmhe5ja6ca0rlugw8pr9v7q67z38w2ahs2a4alp
  lastmodified: "2026-05-23T22:10:20Z"
  mac: ENC[AES256_GCM,data:JbnKG1qyAkvFDXr2iHu+gk7nRjedmm+dEK8vBFW5YzndWE4QKoYWeaqRHBk7wdWO9kpZgU2rFiu4Be+ikotoMS8jKAcd5wWSrWtSreaZxxiD2TWMWX8HwPtETnYe0rjrEZ3kPcUj4QPyNTphfbH3ARLjthedRXNF70NDc+DIpAY=,iv:4LN3oslWUWqoY3rQNVDSmlJn1o0c8JQELzsWd5btn7Y=,tag:c8X1q9XMMUkXed93j9C6ww==,type:str]
  pgp:
-    - created_at: "2026-05-20T02:08:49Z"
+    - created_at: "2026-05-25T17:17:13Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hQIMAxK/JaB2/SdtAQ//VIMBtLL8lhncJeItw53fQW4Lia0hs84yuKLuSBucNXhy
-        x3LT5r21C5CZ+JnucrGPxur4clsLnDnng2CgyWhksJNknk6smQIq3ZhyBd/OJzS4
-        zNGUJIbitJsDaKjTrYDCdsQ3KVcRBDMu3ow7vzeP4wnL4qU5fUuQ7S2rK6a1hfMB
-        eTQmn4wD/Rl+Q0AWEo2V/X8UgchwGPeuOXfju2t9+1UVE0kUJdXw/JIrGyR8XrYM
-        6ZGXB3mPnlZTZjqhXVSFSSOUTRYu/0g+s/JuDLpgl8gVP+oDvSCPrB2pDNK+o2Oo
-        VbQbJMg6lMbIuewd0ZTTeCv/TFU9O51RtkFyxHIEW7dVelDrNkuciAG1mDUHFUUw
-        MHeWDjngeCzr1hj1Z78P1bvR7I2pqBQiWT+d/e50S5quNRVjtLVEjuU7r1eKiPDu
-        pL1lYJZZu5+uY1nWE4qeJiI1KambjP9/C+RUCF38yT1wNvxrbwsM9haXGbI3t2cU
-        X/RRpK5VKKKwbBqyQmkZX7xaDR13hLF2vLtdVw6L9nYVVactfnFr9HKDV95HUnhO
-        uevmzu+ShtAt9FMXz86dLYmBx90A2BSWxb6sKvZkG8UDY+vVT1K0gNK4kwxR9rKt
-        LFzCq1a3ftx3UvrNMCwaboGQZLpRtiKr0lNQvGLpH/SRDZ2HksinV16FNVuN74HS
-        XgG5HnRO9/lkL2Bn+ms7Q6+ki9QmC21FlLGJOBQIi+VHNVwy6J8XQlrs5NZPy6Ib
-        LmWIV6BdIRejCAITlVeBRBpXymdUBicPLa/VQMK2s9L3SS7MUcv+4j+vje9YR5M=
-        =IEFm
+        hQIMAxK/JaB2/SdtAQ//cayg/ELKtybgayA4z+xOUK10zQJDE/U43BcPRMrBN0+x
+        VLu/C96Eom/dJN62SM2QamThHu454HMZj1PjDynMUzgfVqXEg/eG45bBBweWrI65
+        s0tuzLmsqpdt9TJ5t0znliL2DYS3MPfmYRNbAsYsCbQd4I0YpxdzQwTvURdzjpUG
+        nVBUfzfcYH1Yqq8BVtR40MKfa/DbOsJGENHtpkQ9UDAa3gwVQs0NyZRQzg5w364C
+        UvItYlU77ZCKPkyOQuciLn4sM5poihu3UNWp855QsDK6fZVuxPTS4Cn54cfwdOTe
+        rL/ZQjLcHJ7PRmZUiWR6GVNDrY55u7zhORD4b8BgrpWW4hhxpp/ENjnRmNt8jKR2
+        dJ/5/uC4HBX0fM3mbfpUn19BxCk9+gFPmNUOUZ93UxpQ28l1lZxeiLBOHAw1srEs
+        7ZfFrJ0osedPGHu8rVOe93DCAtb/oNxr1xvGuDK/licRkEh8t8cvuoVsVhYFjNBc
+        UKXIPrhvuSj69c3OiHa+u9fNZJX2XAi0oOcZqGp+sQCCgUCA15I5QiqTpalCSTKt
+        /Stoj9BsmlSiy8YD2XBjmzHHVxJHfl8XHcuONKc3e4UmVjKlzkzc0bI73Y6XiEvt
+        zRIUmWxfvAvqP/zPcMSwaZke5h7N7ywKcjM+RHB4NqRUVYlBNwIWXvi7f5BdLhrU
+        aAEJAhBcA//3NJxuDzlf1zoXGKOhGIwNv5/Qb1n13OKIT2s0nfbqEHgAUm+tX3gk
+        VKKMqFuVmq2mkAaxXWFq20VC6djTJJS1QOaNsc6x3bJ6iDtYV19Ddn/20jbmbqmn
+        XbCDvb50nubC
+        =ZByJ
        -----END PGP MESSAGE-----
      fp: EF643F59E008414882232C78FFA8331EEB7D6B70
-    - created_at: "2026-05-20T02:08:49Z"
+    - created_at: "2026-05-25T17:17:13Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hQEMA1QflAioE8i3AQf7BB0RdJbe8Ro2Fv4Phw+VaR0rUIuQKWOb7zf3/9YCbV2w
-        rICGVIx7V1vJF5R5RgSfk0RDrLN3Pfoq/7Jfkq6bMoHIVCHSFdryHfjG5Dgm49Xv
-        gDZ2CPAHPn15mG0Rr/67YUWsC2Jy4y6/JY478wzYu4Og9IkxkeBd6ufBFB6bTn4H
-        qB7B2hfkyQzA66zoxc0r2O1mchbJ3A4pVJw0v2I/sWCiZoJQKmt8ksoEK8BAQCWC
-        E8sozb2opRzFaUCZSNEdhz/rnbV8u5wW378kd8kHSOlWxaFZNkWUP42YQiNTkd9/
-        YpxxGvwCTIpHGAYFtU7CV7QfQHzTuAOz7ZElPZsYkdJeAZCwUFO24nzwpxYS43AV
-        29IHXvlKAQkjJunix0bPGcE3D6T8CUs0wXL2sUSDcvgOOQZSezRn4UNEqFCftjJ4
-        Gmldo/baMO2Y054/iA0jvNmHRk6sJCY8aRYv9m5Fqg==
-        =n7Qb
+        hQEMA1QflAioE8i3AQgAm+iazJdcOXiq08MvSGMQ9/NAvrgcDav4561Hew23n4Ms
+        tKC5VLXf3l1f6yjhBZy6mnslYOWWdJ+X4XK0OqWkRr/t7zxEK4M6PC6g1W5hkaFU
+        +9DrkBLKss8atz3EhexK6GeljTuRpVWM629BtvMPBo/41eyue78TLf81vCkbUJkC
+        UpeB4alsETvD9Oz0ZRT8fipuXzdpGSjobOIgQa9bKwFMXXGY2fwBuKW8gVtSgbXP
+        mKwqvGaSdHz30BxQExmLne5ERKHOvzac2woG5tOmKPaihg8pbvuq/VjS2K0mzS5q
+        cbwyq/u4d5fGEFQYqMARW1aiyo3NjYk4xWDcGo5Ql9JeAdwhj3Wgm1wccULt2Hj7
+        z/V1utNINoB0bPFb8ZQMmPpwAeH6nnoqjWmmoRSW0tL/EaPh5xQXdEuU+DloT5f+
+        k8c2KQC+v4bh6BMUcycAeIG/h4vKsgz/Jc6BWKKD2g==
+        =G51B
        -----END PGP MESSAGE-----
      fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7
-    - created_at: "2026-05-20T02:08:49Z"
+    - created_at: "2026-05-25T17:17:13Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hQIMAz5uSgHG2iMJARAA4zyDJtNqK5w6QPYMyEtjuoAmva91yLA4oAU/diRpFXHx
-        D4UzksW8moYqmaiWblFy1HeQJFwZWrxnXeqg9B7PFOkhriIG7al4DpV2wXoCjami
-        DIkewGoeZjTbPNxsDVl0SbDafCARQFnQ8LNTmM2hi2X/ACg+c8mSM7eK6C3mh8yG
-        Bo2EsuCnIqzwzV6XbGCKnfOUh0QekWM7Jc/e3oYGSgCP2N5wb2PLVsW1220qdPvo
-        8D1l5cDVj2Pgq7fnfbxZGJYSfdgJb1YweH8mjHk3gHU68AGeeSkV+VwcBGV2HObg
-        hKSbVWcyGAHrP1ppCNyXr5ZkBgyvdB/EjxjLqTLq7sdTnqjLLbMLgi9CCI0NuDMI
-        jfgMjOdaImjUvvr8lCl7dOMyp9wc6ks0bwRbfG3AMLGKWeR+un3uaDYujD0bQLqZ
-        m0g5mx1wHxNCJIb2ZQ6UVjDlnatTYGBnxEupqxr9PFyny0MRhaiYkuDIh4tHW3nH
-        xyCHN9QIO2/EktLkM4wcfhOeVgdpfvKgT+cMG9kS/yfInZ5ZAGvXznzvfNZZtKDL
-        fLvvF5AqYbN05c0h56WJa65tIT75P2wI6ZBncCSLqSAzyXWlZFV6UBP+5QLEkQaE
-        WtY8y2907OAx1v8g6vc5v5oHMqfwfWC4nuFbkoJo/ZbfvtDWq4eFZfkUKY3Au5LS
-        XgE/l6NTtWknF4nPYIRaibum4527ke053JdD/50eqfuRv8MFIHbRPfWE4lE6lgev
-        +/j0Ef9sYRu726Sv3wAgT7K6PmCFsLN1319OmjkZpBAJiNsxx9qwXyqgTpTvb34=
-        =Hr9J
+        hQIMAz5uSgHG2iMJAQ/+NjXRTghMiYErsXenuJRaWdwHZ+6DkkG8nC5b+Aigljgu
+        OJg5UQgYtX5W5T79uUuEh5BWKO5bMHBwDNHQC7Hn1FseYgrOxcoSYOsewlb8t2QH
+        fqGLLhv82nRnU0nTs8W/yvrBH/ub0kAtuko1jkPSAWnoonmeEW970iLVIF9lCVYJ
+        idF+DDSiic9RDpHd4Csuxdv+1Q8OcaOW1HVAUrfrKOvC17sawd1Cat2DWC8EcOVD
+        clNn6A91FBCTxVnxwM4j2J/NXP1JRIGnlxaa4lATQMiX8lfheu0LyEpsFZai55RC
+        dq20HWqPgYHiamp6eGQ+Uqe5edx6F5YX/25S2Jfrx4D5vRh0PFx6blY0kgZJp16a
+        ywNiMtLPh7HjOMbB1v7bcWtIDWrIhWDtyJ7axny8sMamCLCPOwPpPvdL/B5YOntm
+        +0wMXHXCLCaljzsa5GFIyVYj3pTY/6O0Fgkv+6ow08ndPjsViHNikufCSW0ueIFF
+        ehv0V2+AHhedoHChFZI/DEbGzIKVcr7JAA+GHAIWcklg7O5hss+/rr7nYxVB0A+t
+        Sfp5kVMInLpCPLRm2retun3zPF8+R0kN/ZrkLy02K7z4rrD8wVE5QUvSCWbpKdfS
+        deWIy4lp9wRXSunag1/CxqvrH3ZszlxSZPEQkC4hez+xOS//L/5QsiP52SavB9PS
+        XgHvkL3slXXsdnIgm3cYnHqEBf2rXLQR/ZTzusXMLEBaGCd9JB33T/Lz+TUftCUI
+        xxLwzFvm+dEvQ6bOB6/OvSMBIsvVzMZxaIblwZRdIYfQovEdKLCRc+F4lTqV8fE=
+        =1lXS
        -----END PGP MESSAGE-----
      fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
-    - created_at: "2026-05-20T02:08:49Z"
+    - created_at: "2026-05-25T17:17:13Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hF4DsZXvxFXTXoQSAQdAp7TsXm2MaBAh0qB3eOjtFuegcEsmtdQHsMP0rs0N/m0w
-        bbbzXLwq1TGL82l5Qon4NnX9Jg5gXnKydWOiKWhxCsQ0iHJ7eupJLxyfDD/kzga+
-        0l4BRUpbBFslWWa8Fb7zfNA7kslhkaQIJAmN92Yh/2NdkpmNEpMMaIrx2p2jK4Iz
-        mwGUQlUz4ZkK10xy+9LMaAtmLhBJgBhDTKKzw7OAsRAnASq2gXA/4wqEVgBU9BxB
-        =tBBK
+        hF4DsZXvxFXTXoQSAQdAJAr+RX2f5gW5PpXJ/WA+1qMPFjuWuDccIk1ecWzc4kEw
+        sNH69jVC0JL7l5RMrJTAaY0GRTMrJffoz28JxpVbUVFEpeHsd+myGCcD1jZyS1MX
+        0l4BllCKEsOVnEKKxOscOIctaIw8/MDNnLSoP04JI2xVKKThor+UwUhRzg+fVwxH
+        uEiHsx0xA/q0HVXhTNIvIWn0CKx/4uV8JwVa9JqjSSyQVm8PBwU+UTfXMQ5VcuHv
+        =uxSy
        -----END PGP MESSAGE-----
      fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE
-    - created_at: "2026-05-20T02:08:49Z"
+    - created_at: "2026-05-25T17:17:13Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hF4DerEtaFuTeewSAQdAlBZhTjLL3YPqorSXq0jet/0CXmeZeLL8inGvm/HgmgIw
-        aplmjWHB80err0ffZeRfcvqx9DGujpwlgoFGDxjqn4LIqoNg6YK/VfFb9pXUvIOv
-        0l4B9xQ4DlaYOX1egCQUBw3KcdcnNlcEZwTOwTKn0Hg3gXp0u3TYlJFZAchw2G+l
-        XJjlWiwJN2gKfEG7hrtZ7MJkYJFsqMFa1aC1oWHduxU4jmdRdQqdIaQDsqkcqJc3
-        =KNVY
+        hF4DerEtaFuTeewSAQdA2k3VLlMvCocHQ1ULFwTJKqscSb2FScq8A2I1TIdlfXAw
+        jWLzGphdsfHuNBEsocoixm4nKAdhjgBsud2rfYkuwxpqX2MlBr6ikpN73dXlHtt2
+        0l4BkUvmqlioN961OV7nssbeQLzb49C9Gzm5S1dQqBQVCt/7qGodTHHiQON7bYJp
+        +OgUaI6bKZjd9Lhm/u98dTH2cdPm1B5bUQPDzptWX5vG8euzBQxXc7OrGsTFyYME
+        =e/rg
        -----END PGP MESSAGE-----
      fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912
-    - created_at: "2026-05-20T02:08:49Z"
+    - created_at: "2026-05-25T17:17:13Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hQIMAxjNhCKPP69fARAAhSBdgW04fKM8tAU8sC6h8/4e0Io3W/D2l6P7nZiD9WVR
-        2pUqS12mlNCoRt1I2empyJ5vm1wjor34BCuSCiyfLQ1WIlBJlDro96ygpsHZGmam
-        tNcrgwc7y6rg4ycqUWr+H+WVZ0kw1IYYKbfAjMAJF5lQqzz+VMvET9BbmvA595MO
-        l/dnMColnjxxBiYBIzO7mnli+uqRHB79rM2VVlrqoT+C2s9zuPfpJfY0PJaCbbdg
-        BlffAMqs9m2JZdDr2r0lrN/jyLUB2d3l9NCcF6UYP6tjgZsKmHv/JxSgXLf6IklE
-        wolO04qgDRK7jeO2UGEniweVQNi7hqA4vkp2TskGbfVsS10PyLYKw4N19GedLS3c
-        ZxRGde42Fze/PrccWq8bGdOfWhPBo2/MEyqVW4lgTeCCwrFRO3UNyYcWo7cmaN1q
-        lz7uaV6ffqbUDJSkjkphvxnJtuX62x9Uv/wcwrJuZUarSNclQ0nQV/e5wc7SzPgM
-        B+GLeR4tnconDZGFq8q+KKuHe7MSx2uwiZsJIVXohcZwhkd9wk5YQBPc8i4aP0NQ
-        wsb+QptuM8VpCEVAwKOUjp7IRRfUyqAIlmIRDkTijmHknSmI9HZXPyCvTLoy1Szf
-        KDrN1MAma6b4gsru1fFnVizXQyZozl5RVZFP2Uv+ndugdvRE5sv5aevlzgaWFg3S
-        XgFqaFwId78UDNTrxcs4EzjHmlwg4E05G9pUqbA9zBDdCqwlD4+6CfAgQ46A6ptY
-        5p2QQJ3KXgJXrtlJySq8piReyq3mpagtWZJfAazovJA/ZF4o/xs9ZIu/q3qxHSE=
-        =nR8y
+        hQIMAxjNhCKPP69fAQ//VLyOILC6lpvlq0W7NeYfUzL7KtKYXVDF7aSQ/b6Vn7Of
+        ggc9n40n6FkMJqknhbvSnhhlFdzVOCZkLy/hinNk+jF2POBlLbzBjCuzQSP+ZDyC
+        Dll2UJ/khITd+tQ4zwrFLpixr518Fgcj8NOgtljUovxR1bGIzYogpmiVFJEd0cT4
+        k7ldv5WbZtB2UprhPPpNe+98BaUvuSvA9RWCogaBbuQpY2p3g9t9Zo58spOawbP4
+        ccz7Pu03Esy3cenlnCt3G7gl19viIh+wHKrIXPa8dGO6TEsrRMPT0tNEs8iUJyDO
+        TNEgo6+yxQ2p+08EzAh0BCRwljqnPLjS/h2s2s208Z5rBOCpLY9RuoXz7JRvZ06p
+        gBgPFSIH12VBGjfqCB1uZIatbtLQLjOo6+UU0evM65WhKw3//tUnLrox1reoiRzO
+        ro4JuytP+f4PylQRsr3jOYKRKCBzoZOOPZbVEpwQeBOe9zzxDgVQqHgVDDZQzCcw
+        VTHCrs4XVHxPH0aRMlS4A80xbH7VncYbcbf8a6VrTpnPflv0OryWMWDqLBzmIPgM
+        W1Bz/hq/o6br+g4uAKjt4GTdTwWYxptA5L84aMoihpXRu0MaPhG+7MRsXpEa/+Ll
+        +ybl2DLpm6zm0iixkJuxwtOdQOGjqJqC/GLw/EZJTt2aO+ZUb8dLrChNmR7HJAjS
+        XgGBpFYao1AQqLZU3c+5B2/9/3rtOoVX1DQXhUsji5NkaHyYO8usauj9evPUf4qx
+        FAQRWua5/zp/cTlNWU3GknqtJ1G0g1mrkiVeBZCRxIK2Iyvyav7RALJ1jlkyW5c=
+        =meb0
        -----END PGP MESSAGE-----
      fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
-    - created_at: "2026-05-20T02:08:49Z"
+    - created_at: "2026-05-25T17:17:13Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hQIMA46L6MuPqfJqARAAjpM3MO83b2EUtzyZs66HWH6Kd60rl3QODTqs4PQm1cH5
-        HdzfVJ2IDo1y+FMTMmfJov6xBqnlalNaOvg8XFAkKTUkZgUHRW/q1WXP4FywTWmP
-        aJV47x4dOQXQgj/i/ykMspUgsxA5049/nG1y06Wsm2agLO3KjL6KIJAx0LI28XPU
-        qA/NFtfNuEAv7DGS2LGz1+X1hnRYcBX/oUgpihzActWmMORD6VS7xZGcMdF2/+Ex
-        OCDAnwT0cBSAihBSLTmEMJ4xfmMG228nbLqm9r/gELgVIsIL5hXWz0CtxaewwLQQ
-        XFMm/ZV/G6bZKRJzKPOR9EcPMF7Z+nnBts9wKNlE+WA32p7zu7hjvEFZhLiDKYlN
-        +nFcx/rvyWB6sbFK0xn2x5MonxWNVUy58PnqGWmPi2VtXT1al1zSAoKAgg8Xdw21
-        PQENtxqeUSLXXb0SZXFptMmYStwqoaFusLOCLW42DogFU246o14veDDtsS619T5G
-        RrszsNg543i3ra7MIm99YRXyniUaDp5VlKufPkWRexIT5YZYalOLtdLcaTTzfr7J
-        x4PNVOK2ddtmlKbbakvvmPWS3iBEUGMqw69dPhEdpY8yy7HJ2jpXX7TiezNqGJ9w
-        XqtI9RJmWrr0/zSoim0EpHDwXZhSf7YVcwTs0XCtwrXcQT6DLaZJr8cny/G1ErLS
-        XgEdnUqFpB1D0bacmRpfHA3PLZJd/x0QfwZ/b7gzz3f1xRfMXgnsM4iYu1S8+VAW
-        Dy21iVFZledWfrmuXh/PkLFftLipYK6tc0n922kFFxCn/xSP0yx9qKlNwzyduNI=
-        =4+Bv
+        hQIMA46L6MuPqfJqAQ/+NK0D10olgDK4KcArzoMtrJR7qwbrceSeKwaQGsUB1+RZ
+        xv6pZJ0zyw7McTuUV2I4bLYHy/TffSyJk5vLSSTGFXgHVdfKmjvm7VDEp5d2uKku
+        GW3Qh73quldfhd5GjO+F9V/S3rCysrNMpTmPnR5ha877FKGtc8168XRhIpe/1+mP
+        mvlE6h0Xizbx9myGR+ie17nHpoH+tjTtQFH640s38+xDgH6AozwWGUe/g5TdLaLJ
+        8SKHyQnS8hOHQDkttvhWRbyhKa8WuGyOKSjuQ81HIv+/UPxh1fs7vovPHM8rtIyy
+        xGcWPzUeoKQiV2nyXUP3BqglhOhD1vokh3ejDcxwWWKuyASCSXhhvW7KMsV3Stdd
+        E3O1nyOi4+2I2E4TQo0NLt5mTJonPbvSn4IvV0LuatrG902UeNNZRRwQv3ZrVp6f
+        G2ZJ9HNSs+Tp9H8cJzBGjDBYjC6/d3GGWi7N/5G/n6C7T6W81BgO8UiQOleEDF1c
+        Bi6NPNeoGL8fivVGlGTHpLcpPpbYz+1ynsFs1ho4+v5bHS5w+UfvVvQC7dlDKmR0
+        fUAkllcxLSnzKkpKis1HF+Gp+lSNc75/BzOeTA2gS3c8H9jMuncRolndPX1rVJA3
+        mrLiQE/Mja9NaYHzUROKIHDEUOQ1ZzvpcRduggvfj6Gb2wzNdUdR5QrXnLeI2jbS
+        XgHO7Jr0HrHzr/+p+w89U+uH4b7onseYDiAjfLjAZpcYwkzuy7b2ZUmpLq1BjZRo
+        zs+rSqv4BP0Xa7LNIFrHj4OeL9ivwP7Kw/Tb36hU8DJ8xDfilx81n69Fer/cJ8Y=
+        =BNfm
        -----END PGP MESSAGE-----
      fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
-    - created_at: "2026-05-20T02:08:49Z"
+    - created_at: "2026-05-25T17:17:13Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hF4DQrf1tCqiJxoSAQdActtZQL4KWrCP8UUZa/fLeDltuNV9JjxTYiI9upoH12Qw
-        6n8EBLgKKNw1Hsb40u9M5Ro7Xzbys7zwZsL5CxEgFGDBxthtcdaI/ykjU0W3poLE
-        0l4BcMpLoCyxxwIn49GpFxHiv84Q9xhouSMmCTe2p3bn5zCRBnKsetVHtEti4iRF
-        sY9FipGcyiNHfkp8KsWeUxD/j1QUIkGODXt2RqYkO8ltA5QS3kUCPErmWYymEAEu
-        =RFaD
+        hF4DQrf1tCqiJxoSAQdA7az9ylWMB3fWHwSVRmU8Gu4Qnd6HIyMuiG46weuS/Cww
+        QMCknkfCG06HtMrOcroNigaj7G6FEvDm64sUkpW/ggWkHUUEMuwi5jcKIdx7XdbJ
+        0l4BDGUF81uOghQUq/JqDtiYPD8IzRHMXbJmXiO+4y6DE5b1t99wBUt3C5K5H91D
+        U3blcYO6GROPSkVp8ZIzfnWLvyVoWInd1ZiRs19n9MN6Yf8uWfx9/3xvN2kKQyvj
+        =4X+A
        -----END PGP MESSAGE-----
      fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
-    - created_at: "2026-05-20T02:08:49Z"
+    - created_at: "2026-05-25T17:17:13Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hF4DzAGzViGx4qcSAQdAoNdta1fDVjzrPWeSfKrmslkoFi86I2nWplPOli/gFXsw
-        2Cx+wmejLlc61RE5sqAaQJc+0ctRezwXzBJbkuqznZ2jWPCK2A1EQ7r3Q7USCCca
-        0lgB6XOo0ByOj/W4TrrGn7VmwLvEqIiWCt5zk4BEUSVc62Ffv48dcwL3hsB3HlRw
-        6FXyR+2zwyEU5fuddFO4nMi8AXB6cfU6F4ugFgwn92lCgTom7IULY1D7
-        =Czq/
+        hF4DzAGzViGx4qcSAQdA/+jZ9/0jHioWKE2TK24OFDKjJ8futm2TP8z6Xat3uxww
+        DGwSznxagIkVgdTNKqAWmzGvOum8xDBqzP232CM8B/oxmwIjuIV8+FXtJuFHA/4b
+        0lgBN9loSuX5uL5O4uWzPulEhqjFElrWRZXLHZn7uIWipW/7mP8CGu02wwV/lme5
+        jvtJ6EjgopmHrxyaJqRk+e65gxBYKvxTQ1H1iETCUq8lOnxSBZVY5m5K
+        =7H6g
        -----END PGP MESSAGE-----
      fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD
-    - created_at: "2026-05-20T02:08:49Z"
+    - created_at: "2026-05-25T17:17:13Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hQIMA2pVdGTIrZI+AQ/7B7h5br3PMgum71smOTJMBfl4OaxkQAirJeG/z2fjqbAG
-        l9q62H1cutGKS/IYOFLE0OQaRwmHtkdTkrdmf9yIuAktcdAGAeqwnYW3LwM3t7U1
-        nfZRJH5Hi4xcSVVaWHn5mX0QpxzrCye1EIjHvPRx6/bWHD5sW9qnkZAlAvEJS3/K
-        jdyBLLlK8AITpsX4eeVnmVLZBjbVEXPlXfFCh9PFyqrl+iyBBY9bO2aMzWldbQIr
-        j1551Xe1wKAOn5SJTg2Mrm5ehBKfH53HY6ubCy9acbv5ZTe6JuStseWordtRNNXY
-        9eVmR3MRVoFWgK4Ccb9Qq8l+uEHRuQfG9K7dSnxQIJpHCOAQO9oi3/ykDt9Vgvo6
-        WKPpvyuJpWc5Tn+WF1qhz5wDTRX6XY+cUoHkUqZXG0qMTIfMLIAFZ6MuslHU9f6J
-        PlY0FTnwp5/v9rK/rjXZkfIxKjQtSWZwkZCszZ0WtNVuaY3KO6KYrd9rolFFYjqn
-        I2xFGnTNZwh3tjG/3INoMwilOkIUNXr18k6FsPqVCAhj1Oo0iNxb3j+3pGJsH9iN
-        ciTLeM8MsFW9MYXG23i65a5WVXi8hMTcyqCy9GyxLeFprt2DaH2HaBahF3RIWPop
-        KTNsvW1aawy+lDUyr4mBy9F0TA8Z1/db3l950Gtuz5s9/7D6bbmRn72O++W1RD3S
-        XgE3QuksqaIh7ZGt8tVPREEHpBWmPCskh35vLoqeO1QxGxzJcjrcuNeHtOH44EEj
-        mHzYUydn0e1jwKZkATG23DiBCyMpcNAWmsMH45wmk0fgNLdQhuslhKLqOUDLpN0=
-        =Ygd+
+        hQIMA2pVdGTIrZI+AQ//aZjaPgcAM6RSG6QCnYJgn8EDEhG7HDvXmb58G7VfxArr
+        m+K4Hc3hW0Hh/c7/bzu2QWniN1ie4apqFSvQmAIJ3zQZSyOsqhzvbmyTFRAyzpzO
+        lOAo/s0xMu8s5V055vC2KWnKuqb9+WtWgJPotkpOf7wQM3aqtvXKFnPa74ihjXdt
+        uuopRsOsZPiG8MLcqkCrTy+pd1PywrqwjKeva+mfgbM8zpypw4kwLwrljsxCThkZ
+        To4dH+K8oesvSeyVOKWtAwnjQsPa3Zn5CFWXNwPnn2kpjyMoNRo07xuRkfHYI4L/
+        7D8zz07XdN47kJbEj2BYjChURtbxkFbAxq+IUDgbNDW+M7VQCKZW+vOFjwmFJAlT
+        CCco2I3lmrVX1j9BTMRr/3aQNbY/OzOxk0qjYZGnPqV1bH4IazaDFUB8pOdmit2t
+        KBzDt1L26V0Ek1CpOp1dcJxneITXX1j5IqjMbl0TzyoJ9CxsSaOWfZ6XsBBSXZNZ
+        VnDENbBAOGcJgatjmC2qH5FCNio7vMRRncX5j82sytDRWbj/7XHENFpfXyGPIuYg
+        AaHyxSVegFCeRUHpzXo+qeFpNFR4407v+otVaEdxbfj6MQfMZ7tDUOde+97NNRow
+        tAMUOAN9yhGuEPMPr4stQUz4lHseGMX3VdpJH8UQH+BxVdJhzKg0H/+6bAmnRi/U
+        aAEJAhAi7DZdrKpPPkDijPKnXCPJB+IzdAJdOCsnIhZFzaiDUo+RLvP9bEpoqv4m
+        ZFMtiF7P7bXyeNIObCCsgKhdX0thXI9lZvv7k9M4lAbFhPS9vlmDwf25t2Nm9Um8
+        2tbINg+K23jp
+        =syE6
        -----END PGP MESSAGE-----
      fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533
-    - created_at: "2026-05-20T02:08:49Z"
+    - created_at: "2026-05-25T17:17:13Z"
      enc: |-
        -----BEGIN PGP MESSAGE-----

-        hF4DKKbvh61jX5USAQdA8qtjYHoUe+GUdy3obbF+pNmvfuKQUqkMHa6V5ZXOpXAw
-        M/kx52Vu5xOdynB3NMBXsfTVH7KXh0f06HcehTREOkhlwVMYPcvDQQdzgJ3Xodpc
-        0l4BdYtmbmk9ETTqr+wXvf+6BMYIuvyhsLLSqyWyCxJv7blQYsxsc3EAHZ4LB0ZS
-        /lw6gQ5lmQyvVt9PQZayt6Iku0+WMJcgrf9xykOAm3N2QrtUnr4jHV3FydvTiUwR
-        =snV0
+        hF4DKKbvh61jX5USAQdAHw+hxKofus/fR32ThZOHfkL+8TIPvWeYnTYe5UUCC1ww
+        AtCE+MfZvMgRx7gUpVPcdWtch6nlFzun+r84QfPopFk4S824JFEkK8jG0scYCpy3
+        1GgBCQIQm+g/LWX0T3Do0NXrRGIuw0fiKrQiOpEhbO6a6ez/pES0zKKBdlH+scQl
+        +nLZoz6Mw5mkwhY6zIKsrikuQ/+sciO2fIq9tI4MR6cvD5gmVrGEjIyOZ4xgl3X9
+        nX6OVR9w8cR7rA==
+        =voeW
        -----END PGP MESSAGE-----
      fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
  unencrypted_suffix: _unencrypted
--- a/inventories/z9/group_vars/all.yaml
+++ b/inventories/z9/group_vars/all.yaml
@ -40,7 +40,7 @@ alloy_config_default: |
      source_labels = ["instance"]
      target_label = "instance"
      regex  = "([^:]+)"
-      replacement = "${1}.z9.ccchh.net"
+      replacement = "${1}.ccchh.net"
      action = "replace"
    }
  }
--- a/inventories/z9/host_vars/light.sops.yaml
+++ b/inventories/z9/host_vars/light.sops.yaml
@ -1,11 +1,9 @@
 ansible_pull__age_private_key: ENC[AES256_GCM,data:VEGxr8C7RlEhyQhf+to/OrbfPPKkyL7iUU1yDXGAzmmPCQ4VftK71eiyN7OS6pG8J89Mj4Sy/dcY4SUX+rTl/q1csZMn9t4NBN8=,iv:JcrdyFLX5srZfRj9SA+RXf+CRZi5GEcApgyYsHoHTGE=,tag:xdJ4GmK3afZDkXmkrriStg==,type:str]
 secret__acme_dns_api_key_light_ccchh_net: ENC[AES256_GCM,data:SLUNVJQ4Nkos+tYH0l9ndJI8mrfZFC9i/qQqkcHgfLaNjL1tFuAFfQ==,iv:cc7DsiqzMlc2lh3D63cElMQcOeYT7oNxmRy7irSr9/s=,tag:dBnTAJXvgWlmq5vVGxrykw==,type:str]
-secret__acme_dns_api_key_light_z9_ccchh_net: ENC[AES256_GCM,data:m6+Sk533qTRfhrwv7U2RydJh/j7KjJKHiEetyzgvJV1dgWXmE5AhYA==,iv:lAGv4vfxA+DQfwaHiDp3NMel0tjmZl96nKUAN8QGFe4=,tag:h0wM/F9E4dIy+NYLIVUpxg==,type:str]
 secret__acme_dns_api_key_light_werkstatt_ccchh_net: ENC[AES256_GCM,data:zJ9hQo1jmQ5+d0oU+CD+cQh89HshPpguZCak7Nfjdb2bygUXJrEIIw==,iv:y+FSB/k5LixKJOm9egWsjhByQAdv7TfJHvv3job2oYg=,tag:CmuUqnCI3V/aOOUitzYT9Q==,type:str]
 sops:
  age:
-    - recipient: age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q
-      enc: |
+    - enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSNzBtc3lkZHlqeTFIa2RX
        ZWgyV0lZQ0wxRm4vZ0Q3Y1d4RTlhYzk0ZUdzCkQ5VjdlSldCc0ZqZlBIOTMrclV6
@ -13,8 +11,9 @@ sops:
        azNiRDFuU2V4V25iV3dORW42UGZPRmsKOsa+36+NKjmS8xMAoCueJdhIIUtdhl15
        3grlxNwv4axlKNy1ynSSmneyAZ6g+OF80b4YNxzZYcfnECB1VnDENA==
        -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2026-04-11T01:24:10Z"
-  mac: ENC[AES256_GCM,data:D7qAgDZX8B0oNdZovHE74sSZI5X3qd8oDPHWl13Q2ohLnp9vJsFxrKntXxeeHASzQceDv2RQ1exwq7ZPor62sLFx+xO1Dc0Awpq1eoclDlHPyKlvT3pgkcB8IxDO/FuO+7hg/bJkmTHhbHTiHLGQDWN2sQev309Eka86lQyCzIQ=,iv:OBCobeUp+GwdDQhrNtTJhiRVMxRJafq5g1rhMoEFhjc=,tag:OSAWMn2NPZnVKcRX+eJf+Q==,type:str]
+      recipient: age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q
+  lastmodified: "2026-05-26T09:09:21Z"
+  mac: ENC[AES256_GCM,data:NGVGI70dGuJS4qMfpy3tE9MTvX9O8Rwt+Nv+gdqLUkleMEe8sWKbAgfFyWIYxroo7AXFEl3jIFQ7pmcvnSTUBprR7mL3//3QcXQXthxW/mVCf4DRtr7fcqAtctTrC2iRZnZ1YrOz/sSO7G0bgmcx43tYDZPZ+udNKO2pvZvclCE=,iv:xvDS6QVfOPcLk0C12YES2CVKCs6pWl7xPReWtgCyMIw=,tag:pXfFkbWWQpMlwE6g6nO2hQ==,type:str]
  pgp:
    - created_at: "2026-05-20T02:08:48Z"
      enc: |-
@ -187,4 +186,4 @@ sops:
        -----END PGP MESSAGE-----
      fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
  unencrypted_suffix: _unencrypted
-  version: 3.12.2
+  version: 3.13.1
--- a/inventories/z9/host_vars/light.yaml
+++ b/inventories/z9/host_vars/light.yaml
@ -67,12 +67,6 @@ certbot__certs:
      subdomain: "e59f55ee-9013-469d-a146-a159721b6fea"
      apiUser: "33e96ec7-1f98-4f70-92be-85a42dabd211"
      apiKey: "{{ secret__acme_dns_api_key_light_ccchh_net }}"
-  - commonName: "light.z9.ccchh.net"
-    challengeType: "dns-01-acme-dns"
-    dns_01_acme_dns:
-      subdomain: "3bc9e7ce-03dd-4533-a059-b5d38407eaa5"
-      apiUser: "c3b00882-ca2a-4d11-9ebd-fccfb8618b75"
-      apiKey: "{{ secret__acme_dns_api_key_light_z9_ccchh_net }}"
  - commonName: "light-werkstatt.ccchh.net"
    challengeType: "dns-01-acme-dns"
    dns_01_acme_dns:
--- a/inventories/z9/host_vars/opensourcetorrents.sops.yaml
+++ b/inventories/z9/host_vars/opensourcetorrents.sops.yaml
@ -1,8 +1,7 @@
 ansible_pull__age_private_key: ENC[AES256_GCM,data:QB0xpxP8pLfE2ExpCRD4joQzoEcbQZTiVEJbX3t9GyFEseZUtnUCO0ysFUc6hRs2BC9hoPXz6k/dZ0vNkniBmqcN5zTofZ8bg94=,iv:3NVVsae+pgbriTNzgT6rGCEzJjw368WgAKfQCi2qsmQ=,tag:AQSIxJCZOZ8dtlvcu4WMuw==,type:str]
-transmission__rpc_password: ENC[AES256_GCM,data:PPEIdI/OcuvX8Mh+zNFSOw==,iv:AgHwT6FGmE9sY3H+MQQc291ILbpNKatEoK8W09wrtr4=,tag:M1E0iS8TTNvu2MABboqCSQ==,type:str]
 sops:
-  lastmodified: "2026-06-28T11:50:14Z"
-  mac: ENC[AES256_GCM,data:c03dDTwriK3lk9HYK5h85ESxC3nvVjBZVIva1ZAbeFu1n8u1IfazBS3NN4NSEZ+TkSW1WdQVKXFiQ9WBawLwLzXSKcmxaOPZuIvxcmbsYGuHAMpO1ODNgvuPP6D6vFl/C+Ew0yRVd72MqlvQKrg46+x6uD+1cvi9w30+EkzV+UY=,iv:UlSDF/0aF0dWYaQc9KAv3pXE1DUflQfFrHIlSt5stJU=,tag:Uj0W//Du0TOugByNFHFf9g==,type:str]
+  lastmodified: "2026-06-01T19:05:50Z"
+  mac: ENC[AES256_GCM,data:ms4yaDEY/2DxC56rxagBRgfkHuy2/AGhZ0om3+gTVfG8/1p7v+qWXuWrNlDjefjhLKVCaf5yl749JZIjs8PP6rTKyTcteqVfoKwx+CFaEA9OmPOaENBV8Kpy2Rrkw8J4UBBKSoTKGFDAGtyysmqbS8eqDuEpb/TbfbbybJUNfe4=,iv:g4IHNmQELptweaqRE7P3LlBTwV+7jt6AfrPowzuziv4=,tag:YkBnOJA5IN1xDhI+umYSow==,type:str]
  pgp:
    - created_at: "2026-06-01T19:05:22Z"
      enc: |-
@ -178,4 +177,4 @@ sops:
        -----END PGP MESSAGE-----
      fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
  unencrypted_suffix: _unencrypted
-  version: 3.13.1
+  version: 3.12.2
--- a/inventories/z9/host_vars/opensourcetorrents.yaml
+++ b/inventories/z9/host_vars/opensourcetorrents.yaml
@ -1,93 +1 @@
 # add /etc/transmission-remote/settings.json here
-transmission__settings:
-  alt-speed-down: 50
-  alt-speed-enabled: false
-  alt-speed-time-begin: 540
-  alt-speed-time-day: 127
-  alt-speed-time-enabled: false
-  alt-speed-time-end: 1020
-  alt-speed-up: 50
-  announce-ip: ""
-  announce-ip-enabled: false
-  anti-brute-force-enabled: false
-  anti-brute-force-threshold: 100
-  bind-address-ipv4: ""
-  bind-address-ipv6: ""
-  blocklist-enabled: false
-  blocklist-url: http://www.example.com/blocklist
-  cache-size-mb: 4
-  default-trackers: ""
-  dht-enabled: true
-  download-dir: /torrents/complete
-  download-limit: 100
-  download-limit-enabled: 0
-  download-queue-enabled: true
-  download-queue-size: 5
-  encryption: 1
-  idle-seeding-limit: 30
-  idle-seeding-limit-enabled: false
-  incomplete-dir: /torrents/incomplete
-  incomplete-dir-enabled: true
-  lpd-enabled: true
-  max-peers-global: 200
-  message-level: 2
-  peer-congestion-algorithm: ""
-  peer-limit-global: 200
-  peer-limit-per-torrent: 50
-  peer-port: 51413
-  peer-port-random-high: 65535
-  peer-port-random-low: 49152
-  peer-port-random-on-start: false
-  peer-socket-tos: le
-  pex-enabled: true
-  pidfile: ""
-  port-forwarding-enabled: false
-  preallocation: 1
-  preferred_transport: utp
-  proxy_url: ""
-  queue-stalled-enabled: true
-  queue-stalled-minutes: 30
-  ratio-limit: 2
-  ratio-limit-enabled: false
-  rename-partial-files: true
-  reqq: 2000
-  rpc-authentication-required: false
-  rpc-bind-address: 0.0.0.0
-  rpc-enabled: true
-  rpc-host-whitelist: ""
-  rpc-host-whitelist-enabled: true
-  rpc-password: '{{ transmission__rpc_password }}'
-  rpc-port: 9091
-  rpc-socket-mode: "0750"
-  rpc-url: /transmission/
-  rpc-username: ""
-  rpc-whitelist: 127.0.0.1,::1,172.31.200.*,172.31.201.*,213.240.180.39,2a01:170:118b::1
-  rpc-whitelist-enabled: true
-  scrape-paused-torrents-enabled: true
-  script-torrent-added-enabled: false
-  script-torrent-added-filename: ""
-  script-torrent-done-enabled: false
-  script-torrent-done-filename: ""
-  script-torrent-done-seeding-enabled: false
-  script-torrent-done-seeding-filename: ""
-  seed-queue-enabled: false
-  seed-queue-size: 10
-  sequential_download: false
-  sleep-per-seconds-during-verify: 100
-  speed-limit-down: 100
-  speed-limit-down-enabled: false
-  speed-limit-up: 100
-  speed-limit-up-enabled: false
-  start-added-torrents: true
-  start_paused: false
-  tcp-enabled: true
-  torrent-added-verify-mode: fast
-  trash-original-torrent-files: false
-  umask: "022"
-  upload-limit: 100
-  upload-limit-enabled: 0
-  upload-slots-per-torrent: 8
-  utp-enabled: true
-  watch-dir: /torrents/torrents
-  watch-dir-enabled: true
-  watch-dir-force-generic: false
--- a/inventories/z9/host_vars/z9-router.sops.yaml
+++ b/inventories/z9/host_vars/z9-router.sops.yaml
@ -0,0 +1,209 @@
+ansible_pull__age_private_key: ENC[AES256_GCM,data:TlMDo9sUTYznxKOGityGLexk54mM7LU9+U4ln0YYhO5fhXXmwvySxyMLHlaKzSlpU2/mRRy/0v7AIOuRVZx5XqV8X2JJsv3/NeY=,iv:r66g2UQ663KvWyAISitbHBRaLBlJ0gB2g/TW9JiL0Ls=,tag:VEq3Fqj+t40uBo9g4Icfew==,type:str]
+secrets__secrets:
+  - name: ENC[AES256_GCM,data:gt9BarzsfE/GJ5gQeelgePquW6KAgE3Exv4=,iv:IPpUQI+zkf8O+ej+ZxLFyWUOrxGGlZvmDRG0ut2cNsA=,tag:GP66MvcKyCqyKV814+uMYg==,type:str]
+    content: ENC[AES256_GCM,data:2ljp324rAsF2zk2631TI7bV1xKxdFr4u4NxrsPYnjWsL0PX0n0KhJ1qvJCs=,iv:0+DxsTTiNLOg5iH83bFT/d+0uW2rn6bATSm3xc5PEdE=,tag:XbBDrrjriXPedyT4+sBBwA==,type:str]
+  - name: ENC[AES256_GCM,data:9i4hZU7Hv/IMlI/1oYthx8g57nrst9LHZQk=,iv:IQanD/CA64A+hVyTQBiTvWdXyY8qNF9BpehWZxI5a9c=,tag:RiY0OJe2xbFPG6wfe5XjiA==,type:str]
+    content: ENC[AES256_GCM,data:68GUwG1Q2s2jH92HS0FQWrcMHJP8fHjrOqr21gsdswxKekQrpxX5B3BBFfM=,iv:HOsNUAKE5rOmKgZft2JK1NnZUuhk261d9WYWJS22nLM=,tag:3husFvB57AGVFzF7hKzLpw==,type:str]
+  - name: ENC[AES256_GCM,data:2lJUcDJ7ECJ1bF4Fg1VwOR2tBIQ77ZvDAbFF8w==,iv:HrPWIetjN/lOyQ7Mvk0sM1w+bWldlNfWhvw7/sfqKN8=,tag:AJL0s+f0O/yR4G3RVd1IHQ==,type:str]
+    content: ENC[AES256_GCM,data:68GUwG1Q2s2jH92HS0FQWrcMHJP8fHjrOqr21gsdswxKekQrpxX5B3BBFfM=,iv:HOsNUAKE5rOmKgZft2JK1NnZUuhk261d9WYWJS22nLM=,tag:3husFvB57AGVFzF7hKzLpw==,type:str]
+  - name: ENC[AES256_GCM,data:ESxpEp9k9BdD1GJv+af+U3ny0+RPuaJjWDhQ,iv:DxsZLiDF8F+ixepbUdlitMJ7DLHjGNFNuxRwLl7efo8=,tag:STnv/oLzbchdiwXfKP3fow==,type:str]
+    content: ENC[AES256_GCM,data:W2h5AcoT85OkekPeRkrf1m0bDdBjG/YNSbWlrcZtP7FjaPh/F+cx+J6oRRI=,iv:CLVXTqfstpIU3BX/Zdcnp9w0gWxeGDI/G1MNl6xr4ZU=,tag:yCqN4r1MV/VTWQvZ6COfIw==,type:str]
+  - name: ENC[AES256_GCM,data:IRwwy+WQxgQ8cDpB8HaCLpKwJj7oC87p0XOxWRo=,iv:BLXNMcigvaOeY6y4NlLPMMWQt9XFi6nodRwIYFgAAnU=,tag:OdQalmujOgrzW8oi64xMRg==,type:str]
+    content: ENC[AES256_GCM,data:C5oIcuEYtODsvjQZnbqbWVfP63mQzcRuh8f5rlBCyjwSq2mZiYGQe9t0T78=,iv:sITUDo9SKZTSwPfsMv4m4U0ruuVCcaxu7SUT52U4FSE=,tag:4CsSMJWQQPAIeK8DwUDBqg==,type:str]
+  - name: ENC[AES256_GCM,data:r0sbpjaGjezoNlyl1khy+Dly+8xbbfQZNB8om/E4/tj9lmM=,iv:MLrglBJA6BrHGmFRprlQcf5/Hqh952e5OyQQ9nPxumY=,tag:Se05kMBkSQ7TRxzij7Fo8A==,type:str]
+    content: ENC[AES256_GCM,data:/c1nRf1eZhbUmoQWvcj8yDaVPtyAN7Uu+S054q3C1/kXlQ7CgOe4CrMXnmk=,iv:ppar0aCKuIU3DOjwAoliZ5TOL199Z+Ffo4pCktjs0W8=,tag:nfaGutK+5KnlWBKU1MTxkQ==,type:str]
+  - name: ENC[AES256_GCM,data:7mwuykEqbGISOa2n+pWb6INLsHYdjyf2HxTtWpAr5xP1,iv:NMcg+L2DFtBO1nhyPid31yzLr+ZX7DUGl/WxV1MnrqU=,tag:65/BiUEI8v5oMlQqpKNDRg==,type:str]
+    content: ENC[AES256_GCM,data:SObbA3D/sGN5/i5ps4Zz3alygIXKbSgptFjfPHlwC8G588O+gKAkvKQwU/s=,iv:PY2vLfI3gInFeQbse49KC2/zZ9O4jeXAQ0fpP84GHHE=,tag:214Mb8hIYDkQ4+UkRWtc9w==,type:str]
+  - name: ENC[AES256_GCM,data:bES9O6JI4wTnuZsup9gflfaozeUDkfjVGNIFn8RnZQ==,iv:98kigM3KZIN5qXNdgfLg5WLmxzAsYCjNqVzyUPco/BI=,tag:1fwEtwQ6i9QQC3OCewN0eA==,type:str]
+    content: ENC[AES256_GCM,data:flO3Nb4u2WfWNVhn8k5Bgo3LmsHo2cVnLCsrz8ST9Ip7gO9FY9d27FQgphM=,iv:aiDoq+41cSjwcCZRaIPLtbltkOpc7FeuNN7swPqkHXQ=,tag:OhzcY2xKKJF2jZVRseXCFg==,type:str]
+  - name: ENC[AES256_GCM,data:ERsggezMBbs1YwbIgwzKSAEHWWOWYxap8IDdn2YtEKvZexqu,iv:XbObLp2QERgt57tc/Cpha1CWXi+GttcIU8hJFGSp8e8=,tag:FqCuSbvLRERpVnQTzQsfpQ==,type:str]
+    content: ENC[AES256_GCM,data:QPoZA71CwE8EFE0I+6z0z0O1bUCMQDDDG7wGNoxXKt3ovLkFt21r8WG7VhA=,iv:InX6A71f3DGTg1wO4G0ECf488+FnKgTHffVwvJ9hHQ0=,tag:EVxwJlneN1CbMLXto7uLFw==,type:str]
+sops:
+  age:
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxallVTFdueHBucXBVNzIx
+        cENqanlOOUticExzVnlERS90b2hWQ2VldUE4Cm9SVmhZejVzanRDTkJhQzhwM3BM
+        MGcwTEZ4YVQvdjc3clBHei93VEN5SkkKLS0tIGI3KzRPbjlNTFFBL2huYlZSVTZh
+        OVdXYVRkVVJwbVltSHBXRktIY3BYL2sKe+eqKzYeCUWx0KmT0+aM+TwWRj+P0Ecp
+        tnFHmQgnEPypIhVvZtzL7i64kL6sHizTmNhbw+hlnCztvsdEV5T0cw==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1tx03yh67f052jzehvtvzmhe5ja6ca0rlugw8pr9v7q67z38w2ahs2a4alp
+  lastmodified: "2026-05-25T17:15:30Z"
+  mac: ENC[AES256_GCM,data:IW9eN5H2J5cnXUHlK2aD+yd2ORx+weSFKBGWd7pIolFb5txg0WlGVp8UpD4h+Tv0SJ9NkQOT6KpcXDez/L7r7xNYtmgf7AdrdGpy3IOkEYzHJ+oHUMd/aL+h5w6/RahrpxlPSrNKAC+AfpY+l0iodwQ09iuLp4YXFxRaRDGpGZw=,iv:6M7RkDN9D9Zlyq1MCRoiT4f1bd6OBZNg+C65oEuSWn4=,tag:wRsq4lt4mHVyY6ruGkYNKQ==,type:str]
+  pgp:
+    - created_at: "2026-05-25T17:17:14Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMAxK/JaB2/SdtARAAlyJLMDlT4FLpMKaC3ygn1cfA2390Dz24lzKlHmwl5GgE
+        yS9bdTGMpcM8zPOQoqaoy/my3kgx2/U3q7WiCTMdUyYePAWuJFh8ZRZjw/hPpv6n
+        GwYgK3M2C1I9++zmZD5LlR4TaTTpr99+hctYrrp79QJddgozUzAQ44g7WvDm5VhI
+        bb2UVSo0MpWvLEMXHqH9YZcjkQyVg/DL+IaU1rM9pmpZxoN7+0jQY4ci1ZeHVo9e
+        DbYcjMazBLakjZxxdtHrqx3DjZgbYCancMy/dUKVuvDF/lN35WWSxslv14BNHljL
+        +/9YBDRgIr11x9j1hq241UwBW+6mSFxWF3qQ5esdR5xlLEqbm27PYGtqC4LIdzRX
+        ZUvdujuQ2PHCYJY/jKWSf0cdfXKEGorc1ZGOV9FNq9L+aKvfmRLWfzX4D0Hp47H2
+        d3itVuA9KYOdzmk6O+8FZv/VK1042L90tOPJhrtE287KhcJ2CvfT/Az4Qot8xg3c
+        tXmO3cWQpigXxJPfKRPjmmLJ9nq0BnBXj5ngkVz7d8R3FR1J/+TWG0F1VU7YeW2+
+        Z04RAbbKf36xUTqnaV34EDum4QLLdTMra6fPYPy0KiQYIKDcRSdHeM/hEs7JXP1c
+        zbUX4xuBOXl7kWYR0e3MUTzxYiQBr9BvSDY+7sGQCb+fPw+AKvFxig1grjsnZvPU
+        ZgEJAhAUE/ebqBa2nGimcAPn3PfeihehcmjLg7HmyWBPkHHMt/TIOztjkbGiQSC/
+        jBP+rhjmFxm0WKUGM4dkh14JkMgz7DZ9fozzLfo8zN8beuSDDzX1BndTIMBQJj8P
+        Q/rk1NL6pg==
+        =UXJ9
+        -----END PGP MESSAGE-----
+      fp: EF643F59E008414882232C78FFA8331EEB7D6B70
+    - created_at: "2026-05-25T17:17:14Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQEMA1QflAioE8i3AQgAg+PBxAqWTfRhxP7GxDfQBPK3d52zshP9xhutqANzszhs
+        nbo3nHWj/vjvHlEuD+Rr/lr9qxsE3qS4ON7FG929RoB1YFHJnQl29Xym2Q34T0Hy
+        Ih3dibykm0t/NE+fuxsU4iU0imtjqhqA6P0+8FNF3UeCg60brcqlrBTXM9jFqlZ2
+        9nuvk75HkM1FoHiKx837qAd+RjNNO7xKUpn+EX0l0l9tScuPqUkWNQxLrbHrcO5M
+        bcEC1syZHQKCiucsesS1pJ7TFWOJsnamZyaqhzANGwWdhYwGQv37bWKr6dYTCy3q
+        rsT2NxQK4/N9CxmP6xWeAZbX00BDhNMfEQVtTlYLgdJcAS433Hiw+DSEwGu2zvTa
+        pHtQlGlaoOZemNnthw0NO6JQWGhz6Bx5QqYmbrshtVKNPh87vNVV0HhL/fQ7qwLp
+        uCgnMi3P59r8EKDZqTSp0YGfE2bx2hpBDnyJ42A=
+        =rOz4
+        -----END PGP MESSAGE-----
+      fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7
+    - created_at: "2026-05-25T17:17:14Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMAz5uSgHG2iMJAQ/7BOewbq1xQgTOruTFebugbSrodtfUlIDpCez+FZMw3Gos
+        uwfp6jslBKXHidsA39CRktJ40EYqygmBgcxGTvHGC94VwSl7OfCjHsyfD/93L358
+        XsjpTHXBO/mOjQmJ2smhZx+q+iMLpJnq2QA8mGUI5uzPTjXD19sD9QdYdHF2p8D6
+        mdpVWED2gRf/sDoN+y3c/iZvMTN2HeDCx5d/wIgl3mmoHLvWRO8pNBV3EUg3ZBiv
+        fc0Y7m/0KOqW1itE4yg9IoPBWJg2jYSZTkRnQMPEkKEEHNtbx6dq5tLOYUIIwOwC
+        5JlL76BRoaul6ousBSHV8OWCAvS2N8OC+l0ATzk99p/h4zY7PCG7NhkKAOgYfWFa
+        /z5u6J6TMrmeLZjknFXepuVAzNmDU0CmuhMwZankGKq6lmsQQnHvdq8+ExGGWhfK
+        m6I8nPvG654md9H7Y3HusHa6y1rkf9gZp1UFzhvXQgZdvc7K5pJrhxjGUnEg6sS0
+        m4daDRuNLW32PXiwoWTtTJfOQFv0t1f1eEKI9DO/O8/4fNtIvmI/8HDcdF1XzDnt
+        lGnyD9cZ5jKsKjGrT9DcvJhyTGWDFeBDTY+rlt52E8NbrzWUjX4J7Gyz8QRY9j7m
+        wRi4uaVt5KBmB8Ibo2bMTUXU3Db/0p8nCAg/89D1fP6FF4izg3GU4oD3vJyl81XS
+        XAH8tGT9wbjXuhomyhqemDYb0QdTRfpAznm4AS36qbeU/Tvj4M+Nm64qLpj7FFtK
+        aeDas4lzgeQf6/cdd5ItLlRHhlBOJEmjHVzRR4npabCWZojP8PTac1IlBgvS
+        =OH/y
+        -----END PGP MESSAGE-----
+      fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
+    - created_at: "2026-05-25T17:17:14Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hF4DsZXvxFXTXoQSAQdAIjnFVslIKlmP0X12z6AdWNqxkpVBDFvf03ToWQEQv3Uw
+        8ka0OYl32rH6UiiSE1Vve1wZ/iVvK9/il6UhTpeAt8bIiCq6gEGR9Ba5NJnm6rSG
+        0lwBwzEtaARPJbbcWu7Jl+dAQ0quP6uVS55OYBuSannlaPrQ5qBuS14AtuQ3UEVz
+        EbcLJ0b4lGL7hgyAf2E6nuDTkPGPChAJ5H5DfrB74ZB30GcYBTzwj13+jWx/VQ==
+        =Hxuh
+        -----END PGP MESSAGE-----
+      fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE
+    - created_at: "2026-05-25T17:17:14Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hF4DerEtaFuTeewSAQdANsYlCeGhhqmBgnqcSuNdQBUwYKpucDrb6aR9Siyukjww
+        72Gin/635k9bYXwknA1rPyTMvG00giQgjUr/QK6PSD/eGi0QOtMZLj1JRi8f5EU+
+        0lwB+MIM9+EEzHJ96ouzL3bu0e++NvRY1Qjyx1Xi43bM96eBeLZ5DAc1eTSdWizQ
+        EWTorcmXffkdfOQx1zrlGZo/qvfj5F706VcwX4aZwok/ASRmSeCfEXLgGLCwqQ==
+        =ccBm
+        -----END PGP MESSAGE-----
+      fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912
+    - created_at: "2026-05-25T17:17:14Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMAxjNhCKPP69fAQ/+IRYUQhf7zzIZy3AKAtQgyMKRINOUUqOEv6IKmNQaaQP7
+        K5JXnVi2gjgBuG+2gH9iCEimIggnWxFhHerfOps+NkAI6y7kFz5hnMtOY2Qf3vxT
+        Hoyq4l6Yn+gG1HSLozVr9dTQPjyGOKJkm36ZKpM7gqSuLNP2ijKARzay4Chg3i+p
+        E1TVTVoEczrPdLg3O2fd5mi2UT1k3E4QREti0k6K4juMWqMz+5iJ5X98qCdmE1eX
+        L5dmW0QSUChzBVw+7NEcxeNx5WsbhWgPA5m2+bng3V8tHqAwrRUCoxn2+yabnsZB
+        Z0Z7TgcLk0Xnezw+BkT3bOsKgv+atE5lm2rBiRUHRDR3S04j0Ju6fJHf24CNy5ES
+        xMF7BE23SgmqUq0BrvdJB0ToNKYGMM0C5Xg4vGRiE61+18TiFIeC3mF9suvFFKc+
+        houq6Cy7q3O5PEqEbu6t5vXAZHwL9Th+ZatIIe9jSToiZiLEOIEmiYptR009/OWq
+        v6ADzaAE6+i6HZ62xBYQuZFkiUrRKxYzTHFn0A10QUJrJgbWr8QjS76oKi8feEDC
+        BJAOwE/0aK+l46hI6mlh6rgeSy8XdOPLEnL4+1HjlshhTTiW1rE2cr0ZiTTA6UFX
+        UhABIUi6jiLnM13L+auulU1UZQ8wxp73okrcuu6g2bPT/l7zO9YNOCocWVPQa5vS
+        XAH7qrW533ttg2XAczCdALMulV2N5GHl7TbgRQBkdoBAKL+6oKfxbOZeQM2nrfZT
+        arytZbnjgCcy5ygnjeziRvWwLk7sysEpAQqQNRm50m2Cq+2ccedRP6zFzUhc
+        =4hCA
+        -----END PGP MESSAGE-----
+      fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
+    - created_at: "2026-05-25T17:17:14Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMA46L6MuPqfJqAQ/9G5pRNmw775xCYA+foCx9rM7eLXJFl2DjaI3a/O0yVc6t
+        32xtPuaHwTnP00Pbbo5Vc9QG7k0Fr3Rgy+ep1lGzeCMoHwF9xk98LspDtYZoKopE
+        6/L6KLldSauRv0rPVhCQHpZFsnx1VxaJiXn9vAW17+imC9SgqLYGWyrxAtLCOOqH
+        N68RnTsEDquXixEs82ao0EmQXPquimJgSx+xVSF4yitYYLLLHyUL+drMNuVb9q9Y
+        oAIdEL1svDIieTbTKGQUqZ8Alf8f/0cqPWpEkDwYIyB/i9KDkH5Oj7uBBRtVLGxQ
+        VxE32wO1xpXvKgUY2PhWD2rOBVDG8dW/hyqvc1WgIeo1A6FTq34b5dGC2lmTRngB
+        9mBjUd59zeOvdXLmoGwXgbjVhpgnm/5wlUeiIC3xR9MjW3znRBT6ujCaglpAdXBC
+        0AIugssGcuXbP9Tj5zMVlbdi2dj6Ylc8S1Tj/OjwxHCCj6AWRqpxN5vY28RiLFGy
+        +eAsryzPk6UTCPIydiWwsrP+w8EhbllFxzZM+Sn+fshAHdRug+EeyT3h5V5JF+Ko
+        BZCrZkwYqAcVkJjEYlukjvxVFvo+T6tRMz4F4yNgjqFjneUaeLCc6RllaT696H0Y
+        8+lw5rK+XpcXBZqso6vsLChRdZQJjoj9lkjRDbmhOkaRglikC6Cx+mpY1/XnGvDS
+        XAFWOuNKjN/xIRtaDc6tmeWsKkuqghjHiMeRqw10/kTBjniMLLJIN9ssj4HjYqC3
+        CsqyHqZmrbITUMr718gX1kkAvzF/fVAXT8YshOcK7rQbiMQJCZqeBp3fY7FC
+        =5yPR
+        -----END PGP MESSAGE-----
+      fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
+    - created_at: "2026-05-25T17:17:14Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hF4DQrf1tCqiJxoSAQdAfLqKILCrCv2s2V7bLntk5lHI6Dc1FQlCg3LAefc8oTIw
+        a3UZU3OajQ1CCIhhu02JSlTKZm2z+pZKVHy+s5EgCqwAWTfPNAnyPT0ZGrhIdcah
+        0lwBdg2Tq3+Nhix1ZuA/mUgcrbRBcFKlHY+IGEgOHKLJld9UPF2xEjTX6nmLyuTR
+        6x+HW/7vVuc/jcFeQEmokhQw/SICVdyD7NQua4k1agLkty3hGcm1XCsfyKfj+w==
+        =Bxf9
+        -----END PGP MESSAGE-----
+      fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
+    - created_at: "2026-05-25T17:17:14Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hF4DzAGzViGx4qcSAQdAr2tfPiCpUkxFj4rgSiLf7y4iyKbsgEY87iYH3GAZTVcw
+        vK2YpjSVgFRoJNx9s3bFr+9UG0LFmKvDZEP83ThQizYs2I/N7MSU8ERRImshaQMH
+        0lYB4At0RHC1mp8eKqhRgXenOtpfCiBACtlIdS9m1aqcU6i9Drgt86Bk/LC/HSvJ
+        MUOit2PP7QZVRWV6F8wAHlUFd6bdTKv9eOCZLSB6mY6DQmkp93FIMg==
+        =lQcB
+        -----END PGP MESSAGE-----
+      fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD
+    - created_at: "2026-05-25T17:17:14Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hQIMA2pVdGTIrZI+ARAAjNHCArTtU9D8zw5yJzvf0KSwQoOaQWHui7AqQkvQ8mJv
+        8+Vo9sb+JoSuFHQqqDbOU+VFpmc9CZ6HCJaWqO2gZVgjxrsrPgyfq795LBd6GhX5
+        6zwUH2huxv+n7XkfjN4HHJAlSj0pRyL3fyojdOdtXCTuBGbofLIBJUbuD1wro1K+
+        nSHLvdBEitn8afKt5/SaatB8Prwyet6E6J4HluXFQjl+KdrRHHvXImmhNSR4yfIr
+        yQt2s8qapSvLhrUw9/GFXqM/jg4ZlDhPUhCAKI2Pr5PbsRMBqwdkSrDeB7MHdsU6
+        tI4uyb7j8m3VMbFKNVpuluwgk47V+W/h+jtZetSR6ewYsXJjgHNmX6JX73XzR7R+
+        q4EBfSAxR7ByZ/HHuumUH6BKBj8IcNJQwtEkLIZmLZ3OdFtJP3YY0esV+gEhG6K7
+        m2Zl9C7axuYmvoLrqygaChmxMhMiebTPNkD/dH5Ircwl2cXfHC+bvF2WO73DTk9G
+        emHzrkniEtuUs+svMhT3NKM3/mpOJTiNezdH39HZADzkBwZ5Mmkfe4mbXByfRN7F
+        AEJWmnOcpXwXE9//sRbkRr+CGmB86raZE22wHPuk6U9IyVFJm8hJbOzFc7rwu1Eo
+        0YWBCsc9dA+jH8hIKrIfXwqnfhYjTrX+oZJeK/8McOwfF7I2G9YrPAgwbokQmtLU
+        ZgEJAhC8ryOvXwp2kP9sv6nbXIEcwrX8lRjkEWduf6ZAWAfQ5FGBSPzR8WnZWGzN
+        PCxjg7utA9AHBChF1duwOV2Qr5XW8HTUGAx4fc0T0rjC862vSwf8yAY89WWJyUfk
+        n8qhhdw1uw==
+        =KgOe
+        -----END PGP MESSAGE-----
+      fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533
+    - created_at: "2026-05-25T17:17:14Z"
+      enc: |-
+        -----BEGIN PGP MESSAGE-----
+
+        hF4DKKbvh61jX5USAQdAYrtySnoCK7k4ZZIyllSAr23fozsiZb9Nf6Q+r56i3lAw
+        7IxBdJc2ipMxafy1Ntq0wfAYYk7nY6Vz1XtB+ekVeYLOjDmHRnJWq/Jw0K8wLvWT
+        1GYBCQIQ/0zDLdFOrMNjVPMutGVJOkpm7mbD30GpgRugzEf2NZePGtptqnP6i1t1
+        izBqFRByftV1MUw1uWgTFgB8zEVDh6gG0QAYeRuu3NS9QhwR71Wlu2J4eu+VhZi7
+        AKabk3T3Z00=
+        =A2ad
+        -----END PGP MESSAGE-----
+      fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
+  unencrypted_suffix: _unencrypted
+  version: 3.13.1
--- a/inventories/z9/host_vars/z9-router.yaml
+++ b/inventories/z9/host_vars/z9-router.yaml
@ -0,0 +1,7 @@
+systemd_networkd__config_dir: 'resources/z9/z9-router/systemd_networkd/'
+systemd_networkd__global_config: "{{ lookup('ansible.builtin.file', 'resources/z9/z9-router/systemd_networkd_global_config.conf') }}"
+nftables__config: "{{ lookup('ansible.builtin.file', 'resources/z9/z9-router/nftables/nftables.conf') }}"
+ansible_pull__timer_on_calendar: "*-*-* 04:00:00 Europe/Berlin"
+ansible_pull__timer_randomized_delay_sec: 0min
+unbound_access_control: [ "10.89.208.0/20" ]
+kea_dhcp__include_vars: resources/z9/z9-router/kea_dhcp.yaml
--- a/inventories/z9/hosts.yaml
+++ b/inventories/z9/hosts.yaml
@ -1,20 +1,28 @@
 all:
  hosts:
    dooris:
-      ansible_host: dooris.z9.ccchh.net
+      ansible_host: dooris.ccchh.net
      ansible_user: chaos
    light:
-      ansible_host: light.z9.ccchh.net
+      ansible_host: light.ccchh.net
      ansible_user: chaos
    opensourcetorrents:
      ansible_host: opensourcetorrents.ccchh.net
      ansible_user: chaos
+    pve01:
+      ansible_host: pve01.ccchh.net
    waybackproxy:
      ansible_host: waybackproxy.ccchh.net
      ansible_user: chaos
    yate:
      ansible_host: yate.ccchh.net
      ansible_user: chaos
+    z9-router:
+      ansible_host: z9-router.ccchh.net
+      ansible_user: chaos
+base_config_hosts:
+  hosts:
+    z9-router:
 certbot_hosts:
  hosts:
    dooris:
@ -29,13 +37,14 @@ foobazdmx_hosts:
    light:
 hypervisors:
  hosts:
-    thinkcccore0:
+    pve01:
 infrastructure_authorized_keys_hosts:
  hosts:
    dooris:
    light:
    waybackproxy:
    yate:
+    z9-router:
 nginx_hosts:
  hosts:
    dooris:
@ -44,24 +53,34 @@ nginx_hosts:
 ola_hosts:
  hosts:
    light:
-transmission:
-  hosts:
-    opensourcetorrents:
 proxmox_vm_template_hosts:
  hosts:
-    thinkcccore0:
+    pve01:
+systemd_networkd_hosts:
+  hosts:
+    z9-router:
+nftables_hosts:
+  hosts:
+    z9-router:
+unbound_hosts:
+  hosts:
+    z9-router:
+kea_dhcp_hosts:
+  hosts:
+    z9-router:
 alloy_hosts:
  hosts:
    light:
    yate:
    dooris:
+    z9-router:
 ansible_pull_hosts:
  hosts:
    dooris:
    light:
    waybackproxy:
    yate:
+    z9-router:
 secrets_hosts:
  hosts:
-forgejo_runner_hosts:
-  hosts:
+    z9-router:
--- a/playbooks/deploy.yaml
+++ b/playbooks/deploy.yaml
@ -27,6 +27,20 @@
  tags:
    - nftables

+- name: Ensure unbound deployment on unbound_hosts
+  hosts: unbound_hosts
+  roles:
+    - unbound
+  tags:
+    - unbound
+
+- name: Ensure kea_dhcp deployment on kea_dhcp_hosts
+  hosts: kea_dhcp_hosts
+  roles:
+    - kea_dhcp
+  tags:
+    - kea_dhcp
+
 - name: Ensure deployment of infrastructure authorized keys
  hosts: infrastructure_authorized_keys_hosts
  roles:
@ -150,23 +164,9 @@
  tags:
    - eh22_styleguide_dir

- name: Ensure forgejo-runner is setup on forgejo_runner_hosts
-  hosts: forgejo_runner_hosts
-  roles:
-    - forgejo_runner
-  tags:
-    - forgejo_runner
-
 - name: Setup authoritative dns servers
  hosts: auth-dns
  roles:
    - knot
  tags:
    - knot
-
- name: Setup transmission
-  hosts: transmission
-  roles:
-    - transmission
-  tags:
-    - transmission
--- a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone
+++ b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone
@ -16,6 +16,8 @@ $TTL 60	; 1 minutes
 ;
 rt-wan         A    185.161.129.134
               AAAA 2a07:c481::1:2
+z9-router      A    10.89.213.1
+               AAAA 2a07:c481:1:36::1
 sw-rack-1      A    10.89.213.2
               AAAA 2a07:c481:1:36::2
 sw-rack-2-poe  A    10.89.213.3
@ -41,28 +43,100 @@ pve04          A    10.89.213.14
 pbs            A    10.89.213.15
               AAAA 2a07:c481:1:36::15
 unifi          A    10.89.213.21
+;               AAAA 2a07:c481:1:36::21


 ;
 ; Club-Services
 ;
-xr18           A    172.31.200.29
-dooris         A    172.31.200.16
-               AAAA 2a07:c481:1:d0::1c
-hmdooris-ccu   A    172.31.200.17
+xr18                A     10.89.208.15
+AtemMini            A     10.89.212.234

-;club-assistant                  AAAA  2a07:c481:1:d0::a
-;;_acme-challenge.club-assistant CNAME d50ad73a-f82d-4244-87f0-6f5195b37d21.auth.acmedns.hamburg.ccc.de
-;esphome                         AAAA  2a07:c481:1:d0::66
-;zigbee2mqtt                     A     185.161.129.132
-;light                           AAAA  2a07:c481:1:d0::16
-;_acme-challenge.light           CNAME e59f55ee-9013-469d-a146-a159721b6fea.auth.acmedns.hamburg.ccc.de.
-;light-werkstatt                 AAAA  2a07:c481:1:d0::16
-;_acme-challenge.light-werkstatt CNAME f408acc0-d9f5-4525-bb01-28938e3bb7d0.auth.acmedns.hamburg.ccc.de.
-;buba                            A     10.31.211.137
-;_acme-challenge.dooris          CNAME 37caae1f-b77f-4eb1-aa71-dc3f7ed24360.auth.acmedns.hamburg.ccc.de.
-;yate                            A     10.31.208.12
-;staubiv2                        A     10.31.210.233
+beamer              A     10.89.208.11
+ir-bridge-beamer    A     10.89.212.213
+Big-Room-Beamer     A     10.89.208.14
+
+prusamk3            A     10.89.212.3
+prusamk4            A     10.89.212.4
+
+wled-kueche         A     10.89.212.33
+wled-serverschrank  A     10.89.212.34
+wled-couch          A     10.89.212.35
+
+laser               A     10.89.212.36
+laser-eth           A     10.89.212.37
+
+okilaser            A     10.89.212.235
+
+t-mix               A     10.89.212.42
+fritz-fon           A     10.89.212.86
+
+staubi              A     10.89.212.232
+staubiv2            A     10.89.212.233
+
+hp-color            A     10.89.209.28
+
+
+club-assistant                  A     10.89.213.22
+                                AAAA  2a07:c481:1:36::32
+_acme-challenge.club-assistant  CNAME d50ad73a-f82d-4244-87f0-6f5195b37d21.auth.acmedns.hamburg.ccc.de
+
+
+esphome                         A     10.89.212.210
+                                AAAA  2a07:c481:1:34::66
+hauptraum-esphome               A     10.89.212.211
+werkstatt-esphome               A     10.89.212.212
+
+
+light                           A     10.89.213.28
+                                AAAA  2a07:c481:1:36::31
+_acme-challenge.light           CNAME e59f55ee-9013-469d-a146-a159721b6fea.auth.acmedns.hamburg.ccc.de.
+light-werkstatt                 CNAME light.ccchh.net.
+_acme-challenge.light-werkstatt CNAME f408acc0-d9f5-4525-bb01-28938e3bb7d0.auth.acmedns.hamburg.ccc.de.
+
+pi-dmx-werkstatt                A     10.89.212.215
+
+
+dooris                          A     10.89.208.16
+                                AAAA  2a07:c481:1:33::1c
+_acme-challenge.dooris          CNAME 37caae1f-b77f-4eb1-aa71-dc3f7ed24360.auth.acmedns.hamburg.ccc.de.
+
+hmdooris-ccu                    A     10.89.208.17
+
+dooris-ng                       A     10.89.209.29
+
+
+buba                            A     10.89.212.137
+
+yate                            A     10.89.213.24
+
+muzak                           A     10.89.208.13
+
+encoder-ccchh                   A     10.89.209.166
+
+ki10                            A     10.89.209.254
+
+Ziggy                           A     10.89.212.11
+
+legacy                          A     10.89.212.12
+
+foobarpay                       A     10.89.212.23
+
+foobackup                       A     10.89.212.24
+
+ender3v2-sonic-pad              A     10.89.212.27
+
+octopi                          A     10.89.212.31
+
+433mhz-bridge                   A     10.89.212.32
+
+
+;SIP-T46S                        A    10.89.212.227
+;SIP-T46S                        A    10.89.212.230
+
+;cisco-slm248p                   A     10.89.208.27
+
+;zigbee2mqtt                     A     185.161.129.132    ; Old entry probably deprecadet


 ;
@ -71,3 +145,4 @@ hmdooris-ccu   A    172.31.200.17

 opensourcetorrents  A     185.161.130.67
                    AAAA  2a07:c481:1:35::42
+
--- a/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone
+++ b/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone
@ -514,8 +514,6 @@ www3.hosts                          IN  AAAA            2a00:14b0:42:102::15
 diday-staging-runner.hosts          IN  AAAA            2a00:14b0:42:102::16
 public-web-static.hosts             IN  AAAA            2a00:14b0:42:102::17
 forgejo-actions-runner.hosts        IN  AAAA            2a00:14b0:42:102::18
-forgejo-runner.hosts                IN  AAAA            2a00:14b0:42:102::19
-forgejo-runner-external.hosts       IN  AAAA            2a00:14b0:42:102::1a

 ; acme-challenges
 _acme-challenge.sunders                 CNAME           a5ee8a99-3cdf-4212-972e-c0b6fda1242f.auth.acmedns
--- a/resources/chaosknoten/forgejo-runner-external/forgejo-runner/configuration.yaml.j2
+++ b/resources/chaosknoten/forgejo-runner-external/forgejo-runner/configuration.yaml.j2
@ -1,52 +0,0 @@
-log:
-  level: info
-  job_level: info
-
-runner:
-  file: .runner
-  capacity: 4
-  timeout: 1h
-  shutdown_timeout: 30m
-  insecure: false
-  fetch_timeout: 30s
-  fetch_interval: 2s
-  report_interval: 1s
-  labels:
-    # https://forgejo.org/docs/latest/admin/actions/configuration/#choosing-labels
-    - docker:docker://docker.io/library/node:lts
-    # Provide ubuntu labels similar to the images running at Codeberg.
-    # https://github.com/catthehacker/docker_images
-    # https://codeberg.org/actions/meta
-    - ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest
-    - ubuntu-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04
-    # Alpine
-    - alpine:docker://docker.io/library/alpine:latest
-    # Debian
-    - debian:docker://docker.io/library/debian:latest
-
-cache:
-  enabled: false
-
-container:
-  # Leave emtpy to create a network automatically.
-  network: ""
-  enable_ipv6: true
-  privileged: false
-  ## Something like this once gVisor can be used.
-  ## options: "--runtime=runsc --mount type=bind,src=/etc/gvisor-helper-resolv.conf,dst=/etc/resolv.conf,ro=true"
-  # Leave empty for default /workspace to be used.
-  workdir_parent:
-  ## Something like this once gVisor can be used.
-  ## Add /etc/gvisor-helper-resolv.conf to valid_volumes to make the bind-mount in options work.
-  ## valid_volumes: ["/etc/gvisor-helper-resolv.conf:ro"]
-  # Leave "-", so no docker host will be mounted in the job container.
-  docker_host: "-"
-  force_pull: true
-  force_rebuild: false
-
-server:
-  connections:
-    codeberg-diday-website:
-      url: https://codeberg.org/
-      uuid: 9e145f54-2263-4fb1-8151-9efb205f88d1
-      token: {{ secret__forgejo_runner_codeberg_diday_website_token }}
--- a/resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2
+++ b/resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2
@ -1,52 +0,0 @@
-log:
-  level: info
-  job_level: info
-
-runner:
-  file: .runner
-  capacity: 4
-  timeout: 1h
-  shutdown_timeout: 30m
-  insecure: false
-  fetch_timeout: 30s
-  fetch_interval: 2s
-  report_interval: 1s
-  labels:
-    # https://forgejo.org/docs/latest/admin/actions/configuration/#choosing-labels
-    - docker:docker://docker.io/library/node:lts
-    # Provide ubuntu labels similar to the images running at Codeberg.
-    # https://github.com/catthehacker/docker_images
-    # https://codeberg.org/actions/meta
-    - ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest
-    - ubuntu-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04
-    # Alpine
-    - alpine:docker://docker.io/library/alpine:latest
-    # Debian
-    - debian:docker://docker.io/library/debian:latest
-
-cache:
-  enabled: false
-
-container:
-  # Leave emtpy to create a network automatically.
-  network: ""
-  enable_ipv6: true
-  privileged: false
-  ## Something like this once gVisor can be used.
-  ## options: "--runtime=runsc --mount type=bind,src=/etc/gvisor-helper-resolv.conf,dst=/etc/resolv.conf,ro=true"
-  # Leave empty for default /workspace to be used.
-  workdir_parent:
-  ## Something like this once gVisor can be used.
-  ## Add /etc/gvisor-helper-resolv.conf to valid_volumes to make the bind-mount in options work.
-  ## valid_volumes: ["/etc/gvisor-helper-resolv.conf:ro"]
-  # Leave "-", so no docker host will be mounted in the job container.
-  docker_host: "-"
-  force_pull: true
-  force_rebuild: false
-
-server:
-  connections:
-    ccchh-git:
-      url: https://git.hamburg.ccc.de/
-      uuid: 8f2a39a7-0c58-4c57-a272-01893b2f1a6d
-      token: {{ secret__forgejo_runner_ccchh_git_token }}
--- a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
@ -22,7 +22,7 @@

 services:
  keycloak:
-    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.6.3
+    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.6.0
    pull_policy: always
    restart: unless-stopped
    command: start --optimized
--- a/resources/z9/dooris/docker_compose/compose.yaml.j2
+++ b/resources/z9/dooris/docker_compose/compose.yaml.j2
@ -10,8 +10,5 @@ services:
      DOORIS_BASE_URL: https://dooris.ccchh.net
      DOORIS_CCUJACK_USER: "dooris"
      DOORIS_CCUJACK_PASSWORD: "{{ secret__dooris_ccujack_password }}"
-      DOORIS_AUTHORIZED_KEYS_FILE: "/srv/state/dooris_authorized_keys"
    network_mode: host
    restart: unless-stopped
-    volumes:
-      - "./state:/srv/state/:rw"
--- a/resources/z9/light/nginx/light.conf
+++ b/resources/z9/light/nginx/light.conf
@ -13,7 +13,7 @@ server {
    ssl_trusted_certificate /etc/letsencrypt/live/light-werkstatt.ccchh.net/chain.pem;

    # replace with the IP address of your resolver
-    resolver 10.31.208.1;
+    #resolver 10.31.208.1; # is this needed?

    location / {
        proxy_pass http://127.0.0.1:8081;
@ -25,23 +25,6 @@ server {
    }
 }

-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    http2 on;
-
-    server_name light.z9.ccchh.net;
-
-    ssl_certificate /etc/letsencrypt/live/light.z9.ccchh.net/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/light.z9.ccchh.net/privkey.pem;
-    # verify chain of trust of OCSP response using Root CA and Intermediate certs
-    ssl_trusted_certificate /etc/letsencrypt/live/light.z9.ccchh.net/chain.pem;
-
-    location / {
-        return 307 https://light.ccchh.net$request_uri;
-    }
-}
-
 server {
    listen 443 ssl;
    listen [::]:443 ssl;
@ -55,7 +38,7 @@ server {
    ssl_trusted_certificate /etc/letsencrypt/live/light.ccchh.net/chain.pem;

    # replace with the IP address of your resolver
-    resolver 10.31.208.1;
+    #resolver 10.31.208.1; # is this needed?

    location / {
        proxy_pass http://127.0.0.1:8080;
--- a/resources/z9/yate/docker_compose/regexroute.conf.j2
+++ b/resources/z9/yate/docker_compose/regexroute.conf.j2
@ -81,7 +81,7 @@ ${called}^fo370381tr317349_00$=inbound_fonial
 ^.*$=echo [z9] "\0" ${caller}->${called}			; log

 								; test service numbers
-^91$=sip/sip:ha@10.31.208.10:5060; called=ha;format=opus	; Homeassistant
+^91$=sip/sip:ha@10.89.213.22:5060; called=ha;format=opus	; Homeassistant
 ^98$=external/playrec/echo.sh					; Echotest
 ^99$=external/play/tts.sh;mode=text;text=Hallo Hallo Hallo	; TTS test
 
--- a/resources/z9/z9-router/kea_dhcp.yaml
+++ b/resources/z9/z9-router/kea_dhcp.yaml
@ -0,0 +1,316 @@
+kea_dhcp__dns_servers:
+  v4:
+    - 185.161.129.134
+  v6:
+    - 2a07:c481::1:2
+
+kea_dhcp__dhcp4:
+  enable: true
+  interfaces: [ "netlan.51", "netlan.52", "netlan.54" ]
+  control-sockets:
+    - socket-name: /var/run/kea-dhcp4-ctrl-agent.sock
+      socket-type: unix
+  lease-database:
+    type: memfile
+    persist: true
+  option-data:
+    - name: "domain-name-servers"
+      code: 6
+      csv-format: true
+      data: "{{ kea_dhcp__dns_servers.v4 | join(',') }}"
+  subnets:
+    - id: 1
+      subnet: 10.89.208.0/22
+      pools:
+        - pool: "10.89.208.32 - 10.89.211.250"
+      reservations:
+        - ip-address: 10.89.208.11
+          hostname: beamer
+          hw-address: "ac:87:a3:18:9e:01"
+        - ip-address: 10.89.208.12
+          hostname: Brother-CCCHH
+          hw-address: "00:80:77:04:3a:55"
+        - ip-address: 10.89.208.13
+          hostname: muzak
+          hw-address: "00:11:24:5f:4f:80"
+        - ip-address: 10.89.208.14
+          hostname: Big-Room-Beamer
+          hw-address: "64:d2:c4:db:08:5c"
+        - ip-address: 10.89.208.15
+          hostname: xr18
+          hw-address: "34:8d:13:13:1f:33"
+        - ip-address: 10.89.208.16
+          hostname: dooris
+          hw-address: "bc:24:11:b3:93:9c"
+        - ip-address: 10.89.208.17
+          hostname: hmdooris-ccu
+          hw-address: "bc:24:11:5f:2d:b1"
+        - ip-address: 10.89.208.27
+          hostname: cisco-slm248p
+          hw-address: "00:23:eb:b0:fc:3f"
+        - ip-address: 10.89.208.47
+          hw-address: "6c:df:fb:0b:34:21"
+        - ip-address: 10.89.208.48
+          hw-address: "6c:df:fb:0d:91:63"
+        - ip-address: 10.89.209.28
+          hostname: hp-color
+          hw-address: "3c:52:82:29:21:79"
+        - ip-address: 10.89.209.29
+          hostname: dooris-ng
+          hw-address: "6c:4b:90:19:21:a1"
+        - ip-address: 10.89.209.166
+          hostname: encoder-ccchh
+          hw-address: "00:4e:01:a2:40:d7"
+        - ip-address: 10.89.209.254
+          hostname: ki10
+          hw-address: "dc:a6:32:a9:ff:82"
+      option-data:
+        - name: routers,
+          csv-format: true
+          data: 10.89.208.1
+    - id: 2
+      subnet: 10.89.212.0/24
+      pools:
+        - pool: "10.89.212.32 - 10.89.212.250"
+      reservations:
+        - ip-address: 10.89.212.3
+          hostname: prusamk3
+          hw-address: "10:9c:70:2e:59:3e"
+        - ip-address: 10.89.212.4
+          hostname: prusamk4
+          hw-address: "10:9c:70:2e:6e:f0"
+        - ip-address: 10.89.212.11
+          hostname: Ziggy
+          hw-address: "44:17:93:53:65:57"
+        - ip-address: 10.89.212.12
+          hostname: legacy
+          hw-address: "00:15:65:a1:ed:98"
+        - ip-address: 10.89.212.23
+          hostname: foobarpay
+          hw-address: "f4:f2:6d:09:a6:73"
+        - ip-address: 10.89.212.24
+          hostname: foobackup
+          hw-address: "bc:24:11:20:1a:a8"
+        - ip-address: 10.89.212.27
+          hostname: ender3v2-sonic-pad
+          hw-address: "fc:ee:91:00:0e:14"
+        - ip-address: 10.89.212.31
+          hostname: octopi
+          hw-address: "b8:27:eb:0f:d8:09"
+        - ip-address: 10.89.212.32
+          hostname: 433mhz-bridge
+          hw-address: "0c:b8:15:fe:e3:34"
+        - ip-address: 10.89.212.33
+          hostname: wled-kueche
+          hw-address: "30:ae:a4:7a:8d:a0"
+        - ip-address: 10.89.212.34
+          hostname: wled-serverschrank
+          hw-address: "18:fe:34:a6:64:76"
+        - ip-address: 10.89.212.35
+          hostname: wled-couch
+          hw-address: "64:b7:08:40:ab:c0"
+        - ip-address: 10.89.212.36
+          hostname: laser
+          hw-address: "b8:27:eb:be:38:fa"
+        - ip-address: 10.89.212.37
+          hostname: laser-eth
+          hw-address: "b8:27:eb:eb:6d:af"
+        - ip-address: 10.89.212.42
+          hostname: t-mix
+          hw-address: "40:a5:ef:d9:eb:93"
+        - ip-address: 10.89.212.137
+          hostname: ccchh-buba
+          hw-address: "b8:27:eb:29:bd:77"
+        - ip-address: 10.89.212.86
+          hostname: fritz-fon
+          hw-address: "00:1f:3f:c9:e5:b2"
+        - ip-address: 10.89.212.210
+          hostname: esphome
+          hw-address: "7e:3c:f0:77:8a:f4"
+        - ip-address: 10.89.212.211
+          hostname: hauptraum-esphome
+          hw-address: "e8:db:84:e8:18:d2"
+        - ip-address: 10.89.212.212
+          hostname: werkstatt-esphome
+          hw-address: "3c:71:bf:26:42:32"
+        - ip-address: 10.89.212.213
+          hostname: ir-bridge-beamer
+          hw-address: "8c:ce:4e:51:93:dd"
+        - ip-address: 10.89.212.215
+          hostname: pi-dmx-werkstatt
+          hw-address: "b8:27:eb:65:e5:31"
+        - ip-address: 10.89.212.227
+          hostname: SIP-T46S
+          hw-address: "80:5e:c0:09:bf:55"
+        - ip-address: 10.89.212.230
+          hostname: SIP-T46S
+          hw-address: "80:5e:c0:22:33:08"
+        - ip-address: 10.89.212.232
+          hostname: staubi
+          hw-address: "b8:4d:43:98:51:2b"
+        - ip-address: 10.89.212.233
+          hostname: staubiv2
+          hw-address: "70:c9:32:82:25:b2"
+        - ip-address: 10.89.212.234
+          hostname: AtemMini
+          hw-address: "7c:2e:0d:13:72:a8"
+        - ip-address: 10.89.212.235
+          hostname: okilaser
+          hw-address: "2c:ff:65:22:b4:63"
+        - ip-address: 10.89.212.236
+          hw-address: "b8:27:eb:29:bd:77"
+      option-data:
+        - name: routers,
+          csv-format: true
+          data: 10.89.212.1
+    - id: 3
+      subnet: 10.89.213.0/24
+      pools:
+        - pool: "10.89.213.32 - 10.89.213.250"
+      reservations:
+        - ip-address: 10.89.213.2
+          hostname: sw-rack-1
+          hw-address: "F0:9F:C2:10:C3:AA"
+        - ip-address: 10.89.213.3
+          hostname: sw-rack-2-peo
+          hw-address: "44:d9:e7:06:69:5d"
+        - ip-address: 10.89.213.4
+          hostname: sw-main-1
+          hw-address: "a8:9c:6c:16:df:cc"
+        - ip-address: 10.89.213.5
+          hostname: sw-main-2
+          hw-address: "a8:9c:6c:16:e8:86"
+        - ip-address: 10.89.213.6
+          hostname: sw-shop-1
+          hw-address: "C0:4A:00:FB:DA:C5"
+        - ip-address: 10.89.213.7
+          hostname: sw-shop-2-peo
+          hw-address: "f4:e2:c6:bf:20:ee"
+        - ip-address: 10.89.213.8
+          hostname: sw-shop-3-peo
+          hw-address: "d8:b3:70:85:72:76"
+        - ip-address: 10.89.213.11
+          hostname: pve01
+          hw-address: "38:05:25:30:80:35"
+        - ip-address: 10.89.213.12
+          hostname: pve02
+          hw-address: "b8:85:84:b1:57:b6"
+        - ip-address: 10.89.213.13
+          hostname: pve03
+          hw-address: "98:fa:9b:a2:ed:e8"
+        - ip-address: 10.89.213.15
+          hostname: pbs
+          hw-address: "BC:24:11:D6:2C:81"
+        - ip-address: 10.89.213.21
+          hostname: unifi
+          hw-address: "BC:24:11:25:77:60"
+        - ip-address: 10.89.213.22
+          hostname: club-assistant
+          hw-address: "7a:55:61:c3:a2:89"
+        - ip-address: 10.89.213.23
+          hostname: automation
+          hw-address: "f2:20:75:5a:2f:8c"
+        - ip-address: 10.89.213.24
+          hostname: yate
+          hw-address: "bc:24:11:73:3e:f7"
+        - ip-address: 10.89.213.25
+          hostname: ptouch-print-server
+          hw-address: "bc:24:11:f2:cf:8f"
+        - ip-address: 10.89.213.26
+          hostname: mqtt
+          hw-address: "bc:24:11:48:85:73"
+        - ip-address: 10.89.213.27
+          hostname: factorio
+          hw-address: "bc:24:11:a3:43:7f"
+        - ip-address: 10.89.213.28
+          hostname: light
+          hw-address: "72:61:ea:e6:49:e3"
+        - ip-address: 10.89.213.29
+          hostname: homematic
+          hw-address: "fe:3a:42:77:3a:be"
+        - ip-address: 10.89.213.30
+          hostname: proxmox-backup-server
+          hw-address: "8a:48:dd:a3:22:40"
+      option-data:
+        - name: routers,
+          csv-format: true
+          data: 10.89.213.1
+
+kea_dhcp__dhcp6:
+  enable: true
+  interfaces: [ "netlan.51", "netlan.52", "netlan.54" ]
+  control-sockets:
+    - socket-name: /var/run/kea-dhcp6-ctrl-agent.sock
+      socket-type: unix
+  lease-database:
+    type: memfile
+    persist: true
+  option-data:
+    - name: "dns-servers"
+      code: 23
+      csv-format: true
+      data: "{{ kea_dhcp__dns_servers.v6 | join(',') }}"
+  subnets:
+    - id: 1
+      subnet: "2a07:c481:1:33::/64"
+      pools:
+        - pool: "2a07:c481:1:33::1:1 - 2a07:c481:1:33::FFFF:FFFF"
+      reservations:
+        - ip-address: "2a07:c481:1:33::1c"
+          hostname: dooris
+          hw-address: "bc:24:11:b3:93:9c"
+    - id: 2
+      subnet: "2a07:c481:1:34::/64"
+      pools:
+        - pool: "2a07:c481:1:34::1:1 - 2a07:c481:1:34::FFFF:FFFF"
+      reservations:
+        - ip-address: "2a07:c481:1:34::66"
+          hostname: esphome
+          hw-address: "7e:3c:f0:77:8a:f4"
+    - id: 3
+      subnet: "2a07:c481:1:36::/64"
+      pools:
+        - pool: "2a07:c481:1:36::1:1 - 2a07:c481:1:36::FFFF:FFFF"
+      reservations:
+        - ip-address: "2a07:c481:1:36::2"
+          hostname: sw-rack-1
+          hw-address: "F0:9F:C2:10:C3:AA"
+        - ip-address: "2a07:c481:1:36::3"
+          hostname: sw-rack-2-peo
+          hw-address: "44:d9:e7:06:69:5d"
+        - ip-address: "2a07:c481:1:36::4"
+          hostname: sw-main-1
+          hw-address: "a8:9c:6c:16:df:cc"
+        - ip-address: "2a07:c481:1:36::5"
+          hostname: sw-main-2
+          hw-address: "a8:9c:6c:16:e8:86"
+        - ip-address: "2a07:c481:1:36::6"
+          hostname: sw-shop-1
+          hw-address: "C0:4A:00:FB:DA:C5"
+        - ip-address: "2a07:c481:1:36::7"
+          hostname: sw-shop-2-peo
+          hw-address: "f4:e2:c6:bf:20:ee"
+        - ip-address: "2a07:c481:1:36::8"
+          hostname: sw-shop-3-peo
+          hw-address: "d8:b3:70:85:72:76"
+        - ip-address: "2a07:c481:1:36::b"
+          hostname: pve01
+          hw-address: "38:05:25:30:80:35"
+        - ip-address: "2a07:c481:1:36::c"
+          hostname: pve02
+          hw-address: "b8:85:84:b1:57:b6"
+        - ip-address: "2a07:c481:1:36::d"
+          hostname: pve03
+          hw-address: "98:fa:9b:a2:ed:e8"
+        - ip-address: "2a07:c481:1:36::f"
+          hostname: pbs
+          hw-address: "BC:24:11:D6:2C:81"
+        - ip-address: "2a07:c481:1:36::21"
+          hostname: unifi
+          hw-address: "BC:24:11:25:77:60"
+        - ip-address: "2a07:c481:1:36::31"
+          hostname: light
+          hw-address: "72:61:ea:e6:49:e3"
+        - ip-address: "2a07:c481:1:36::32"
+          hostname: club-assistant
+          hw-address: "7a:55:61:c3:a2:89"
--- a/resources/z9/z9-router/nftables/nftables.conf
+++ b/resources/z9/z9-router/nftables/nftables.conf
@ -0,0 +1,114 @@
+#!/usr/sbin/nft -f
+
+## Variables
+
+# Hosts
+
+
+# Interfaces
+define if_netwan = "netwan"
+define if_netlan = "netlan"
+define if_wg55_management   = "wg55"
+define if_netwan_400_fux_uplink = "netwan.400"
+define if_netlan_51_clients = "netlan.51"
+define if_netlan_52_iot = "netlan.52"
+define if_netlan_53_public = "netlan.53"
+define if_netlan_54_management = "netlan.54"
+
+# Interface Groups
+define wan_ifs = { $if_netwan_400_fux_uplink }
+define lan_ifs = { $if_netlan_51_clients,
+                   $if_netlan_52_iot,
+                   $if_netlan_53_public,
+                   $if_netlan_54_management }
+define v4_exposed_ifs = { $if_netlan_53_public }
+define v6_exposed_ifs = { $if_netlan_53_public }
+define v4_nat_ifs = { $if_netlan_51_clients,
+                      $if_netlan_52_iot,
+                      $if_netlan_54_management }
+
+
+## Rules
+
+table inet reverse-path-forwarding {
+    chain rpf-filter {
+        type filter hook prerouting priority mangle + 10; policy drop;
+
+        # Only allow packets if their source address is routed via their incoming interface.
+        # https://github.com/NixOS/nixpkgs/blob/d9d87c51960050e89c79e4025082ed965e770d68/nixos/modules/services/networking/firewall-nftables.nix#L100
+        fib saddr . mark . iif oif exists accept
+    }
+}
+
+table inet host {
+    chain input {
+        type filter hook input priority filter; policy drop;
+
+        iifname "lo" accept comment "allow loopback"
+
+        ct state invalid drop
+        ct state established,related accept
+
+		    ip protocol icmp accept
+        # ICMPv6
+        # https://datatracker.ietf.org/doc/html/rfc4890#autoid-24
+        # Allowlist consisting of: "Traffic That Must Not Be Dropped" and "Traffic That Normally Should Not Be Dropped"
+        # Error messages that are essential to the establishment and maintenance of communications:
+        icmpv6 type { destination-unreachable, packet-too-big } accept
+        icmpv6 type { time-exceeded } accept
+        icmpv6 type { parameter-problem } accept
+        # Connectivity checking messages:
+        icmpv6 type { echo-request, echo-reply } accept
+        # Address Configuration and Router Selection messages:
+        icmpv6 type { nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert } accept
+        # Link-Local Multicast Receiver Notification messages:
+        icmpv6 type { mld-listener-query, mld-listener-report, mld-listener-done, mld2-listener-report } accept
+        # SEND Certificate Path Notification messages:
+        icmpv6 type { 148, 149 } accept
+        # Multicast Router Discovery messages:
+        icmpv6 type { 151, 152, 153 } accept
+
+        # Allow SSH access.
+        tcp dport 22 accept comment "allow ssh access"
+
+        # Allow WireGuard access.
+        udp dport 51820 accept comment "allow WireGuard access"
+
+        # Allow DHCP server access.
+		    iifname { $lan_ifs } udp dport 67 accept comment "allow dhcp server access"
+
+        # Allow DNS server access from lan_ifs
+        iifname { $lan_ifs, $if_wg55_management } udp dport 53 accept comment "allow dns server access from lan_ifs"
+    }
+}
+
+table ip v4nat {
+    chain prerouting {
+        type nat hook prerouting priority dstnat; policy accept;
+    }
+
+    chain postrouting {
+        type nat hook postrouting priority srcnat; policy accept;
+
+        iifname { $v4_nat_ifs, $if_wg55_management } oifname $wan_ifs masquerade
+    }
+}
+
+table inet forward {
+    chain forward {
+        type filter hook forward priority filter; policy drop;
+
+        ct state invalid drop
+        ct state established,related accept
+
+        # Allow internet access.
+		    iifname { $lan_ifs, $if_wg55_management } oifname $wan_ifs accept comment "allow internet access"
+
+        # Allow access to exposed networks from internet.
+        meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access"
+        meta nfproto ipv6 oifname $v6_exposed_ifs accept comment "allow v6 exposed network access"
+
+        # Allow clients and management to most
+        iifname { $if_netlan_51_clients, $if_netlan_54_management, $if_wg55_management } oifname $lan_ifs accept comment "Allow clients and management to lan interfaces"
+    }
+}
--- a/resources/z9/z9-router/systemd_networkd/00-netlan.link
+++ b/resources/z9/z9-router/systemd_networkd/00-netlan.link
@ -0,0 +1,6 @@
+[Match]
+MACAddress=BC:24:11:72:A3:27
+Type=ether
+
+[Link]
+Name=netlan
--- a/resources/z9/z9-router/systemd_networkd/00-netwan.link
+++ b/resources/z9/z9-router/systemd_networkd/00-netwan.link
@ -0,0 +1,6 @@
+[Match]
+MACAddress=BC:24:11:CF:65:57
+Type=ether
+
+[Link]
+Name=netwan
--- a/resources/z9/z9-router/systemd_networkd/10-netlan.51.netdev
+++ b/resources/z9/z9-router/systemd_networkd/10-netlan.51.netdev
@ -0,0 +1,8 @@
+[NetDev]
+Name=netlan.51
+Kind=vlan
+MACAddress=BC:24:11:BD:D3:F9
+
+[VLAN]
+Id=51
+
--- a/resources/z9/z9-router/systemd_networkd/10-netlan.52.netdev
+++ b/resources/z9/z9-router/systemd_networkd/10-netlan.52.netdev
@ -0,0 +1,8 @@
+[NetDev]
+Name=netlan.52
+Kind=vlan
+MACAddress=BC:24:11:88:28:15
+
+[VLAN]
+Id=52
+
--- a/resources/z9/z9-router/systemd_networkd/10-netlan.53.netdev
+++ b/resources/z9/z9-router/systemd_networkd/10-netlan.53.netdev
@ -0,0 +1,8 @@
+[NetDev]
+Name=netlan.53
+Kind=vlan
+MACAddress=BC:24:11:3C:3C:BE
+
+[VLAN]
+Id=53
+
--- a/resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev
+++ b/resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev
@ -0,0 +1,8 @@
+[NetDev]
+Name=netlan.54
+Kind=vlan
+MACAddress=BC:24:11:D2:65:B4
+
+[VLAN]
+Id=54
+
--- a/resources/z9/z9-router/systemd_networkd/10-netwan.400.netdev
+++ b/resources/z9/z9-router/systemd_networkd/10-netwan.400.netdev
@ -0,0 +1,8 @@
+[NetDev]
+Name=netwan.400
+Kind=vlan
+MACAddress=BC:24:11:C3:27:45
+
+[VLAN]
+Id=400
+
--- a/resources/z9/z9-router/systemd_networkd/10-wg55.netdev
+++ b/resources/z9/z9-router/systemd_networkd/10-wg55.netdev
@ -0,0 +1,90 @@
+[NetDev]
+Description=Admin-Wireguard
+Kind=wireguard
+Name=wg55
+
+[WireGuard]
+ListenPort=51820
+PrivateKeyFile=/etc/ansible_secrets/wireguard_wg55_private_key
+
+# WireGuard Peers
+
+[WireGuardPeer]
+# friendly_name = stb
+AllowedIPs = 10.89.214.2/32,2a07:c481:1:37::2/128
+PublicKey = vILSL4dbaC5IaTsRhJviamV18ssxWSj+qLVyowLQ214=
+PersistentKeepalive = 30
+
+[WireGuardPeer]
+# friendly_name = fi
+AllowedIPs = 10.89.214.3/32,2a07:c481:1:37::3/128
+PublicKey = UHi/if5uW2V3+8Q3R+uk6/XpRi4fPXbw7chsKI4xlkI=
+PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_fi_psk
+
+[WireGuardPeer]
+# friendly_name = jtbx
+AllowedIPs = 10.89.214.4/32,2a07:c481:1:37::4/128
+PublicKey = NyyEqdWgScgsnTF8Zz/Om4Lc84fdFMwVtvaCmLEkUlQ=
+
+[WireGuardPeer]
+# friendly_name = June
+AllowedIPs = 10.89.214.6/32,2a07:c481:1:37::6/128
+PublicKey = 6jAEB+f9przBGxPhuvv9U9gvZDEBQNqpQSD0BoGqXQQ=
+PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_June_psk
+
+[WireGuardPeer]
+# friendly_name = Max
+AllowedIPs = 10.89.214.7/32,2a07:c481:1:37::7/128
+PublicKey = oC1hJjtlAgLX/CmbwTC+LPmd1uwluQTwsN8RaMNmHn0=
+PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_Max_psk
+
+[WireGuardPeer]
+# friendly_name = dario
+AllowedIPs = 10.89.214.9/32,2a07:c481:1:37::9/128
+PublicKey = bYF2EGRGpEGjiKcasi/oaWoWeLsgqsF6FGaq3Z4ERww=
+PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_dario_psk
+
+[WireGuardPeer]
+# friendly_name = June-mobile
+AllowedIPs = 10.89.214.11/32,2a07:c481:1:37::11/128
+PublicKey = 6edjXykegUgGjbkIG1aJyBlX1SgTKcqXXaSBVPHdKDc=
+PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_June-mobile_psk
+
+[WireGuardPeer]
+# friendly_name = djerun_at_ferrum.local
+AllowedIPs = 10.89.214.12/32,2a07:c481:1:37::12/128
+PublicKey = aHbdkTHhPkd+o7wWfTua9nd72aF4OVp66zGtpaoD8Fg=
+
+[WireGuardPeer]
+# friendly_name = c6ristian
+AllowedIPs = 10.89.214.13/32,2a07:c481:1:37::13/128
+PublicKey = 6ndwj3Ur6AqfUPWuyPYXIaGZs2ujJKawSQ9LEvlYzEc=
+PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_c6ristian_psk
+
+[WireGuardPeer]
+# friendly_name = langoor
+AllowedIPs = 10.89.214.14/32,2a07:c481:1:37::14/128
+PublicKey = qTnVQlQa1m4SucFFNli/xM6QWfsdWx2baRAit7Cg8RM=
+PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_langoor_psk
+
+[WireGuardPeer]
+# friendly_name = langoor_home
+AllowedIPs = 10.89.214.15/32,2a07:c481:1:37::15/128
+PublicKey = NeMDs2+5rHuKO5ZYXVUR76GorgdesFUnDOFECQ3RzG4=
+PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_langoor_home_psk
+
+[WireGuardPeer]
+# friendly_name = lilly-lillysLaptop
+AllowedIPs = 10.89.214.16/32,2a07:c481:1:37::16/128
+PublicKey = IBsI+N8qUNpQnDc5HnqQ2Zo/1graFM0RMIecHmAF+Vk=
+
+[WireGuardPeer]
+# friendly_name = bitwhisker
+AllowedIPs = 10.89.214.17/32,2a07:c481:1:37::a/128
+PublicKey = DvEGvQPGi+IxeRTIA72Gx3WNINcrV9HRNB1v7mHnhjA=
+
+[WireGuardPeer]
+# friendly_name = forestcat
+AllowedIPs = 10.89.214.18/32,2a07:c481:1:37::b/128
+PublicKey = PdJ7KlIeASizj0WTY87d7oSi14/MebrhRa+L8YiPoQE=
+
--- a/resources/z9/z9-router/systemd_networkd/20-netlan.network
+++ b/resources/z9/z9-router/systemd_networkd/20-netlan.network
@ -0,0 +1,16 @@
+[Match]
+Name=netlan
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+LinkLocalAddressing=no
+DHCP=no
+IPv6AcceptRA=no
+
+VLAN=netlan.51
+VLAN=netlan.52
+VLAN=netlan.53
+VLAN=netlan.54
+
--- a/resources/z9/z9-router/systemd_networkd/20-netwan.network
+++ b/resources/z9/z9-router/systemd_networkd/20-netwan.network
@ -0,0 +1,13 @@
+[Match]
+Name=netwan
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+LinkLocalAddressing=no
+DHCP=no
+IPv6AcceptRA=no
+
+VLAN=netwan.400
+
--- a/resources/z9/z9-router/systemd_networkd/20-wg55.network
+++ b/resources/z9/z9-router/systemd_networkd/20-wg55.network
@ -0,0 +1,6 @@
+[Match]
+Name=wg55
+
+[Network]
+Address=10.89.214.1/24
+Address=2a07:c481:1:37::1/64
--- a/resources/z9/z9-router/systemd_networkd/21-netlan.51-clients.network
+++ b/resources/z9/z9-router/systemd_networkd/21-netlan.51-clients.network
@ -0,0 +1,27 @@
+[Match]
+Name=netlan.51
+Type=vlan
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+Description=clients
+
+# Masquerading done in nftables (nftables.conf).
+IPv6SendRA=yes
+
+[Address]
+Address=10.89.208.1/22
+
+[IPv6SendRA]
+UplinkInterface=netwan.400
+EmitDomains=true
+Domains=ccchh.net
+Managed=true
+
+[IPv6Prefix]
+Prefix=2a07:c481:1:33::/64
+Assign=true
+Token=static:::1
+
--- a/resources/z9/z9-router/systemd_networkd/21-netlan.52-iot.network
+++ b/resources/z9/z9-router/systemd_networkd/21-netlan.52-iot.network
@ -0,0 +1,27 @@
+[Match]
+Name=netlan.52
+Type=vlan
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+Description=IoT
+
+# Masquerading done in nftables (nftables.conf).
+IPv6SendRA=yes
+
+[Address]
+Address=10.89.212.1/24
+
+[IPv6SendRA]
+UplinkInterface=netwan.400
+EmitDomains=true
+Domains=ccchh.net
+Managed=true
+
+[IPv6Prefix]
+Prefix=2a07:c481:1:34::/64
+Assign=true
+Token=static:::1
+
--- a/resources/z9/z9-router/systemd_networkd/21-netlan.53-public.network
+++ b/resources/z9/z9-router/systemd_networkd/21-netlan.53-public.network
@ -0,0 +1,27 @@
+[Match]
+Name=netlan.53
+Type=vlan
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+Description=public
+
+# Masquerading done in nftables (nftables.conf).
+IPv6SendRA=yes
+
+[Address]
+Address=185.161.130.65/28
+
+[IPv6SendRA]
+UplinkInterface=netwan.400
+EmitDomains=true
+Domains=ccchh.net
+Managed=true
+
+[IPv6Prefix]
+Prefix=2a07:c481:1:35::/64
+Assign=true
+Token=static:::1
+
--- a/resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network
+++ b/resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network
@ -0,0 +1,27 @@
+[Match]
+Name=netlan.54
+Type=vlan
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+Description=Management
+
+# Masquerading done in nftables (nftables.conf).
+IPv6SendRA=yes
+
+[Address]
+Address=10.89.213.1/24
+
+[IPv6SendRA]
+UplinkInterface=netwan.400
+EmitDomains=true
+Domains=ccchh.net
+Managed=true
+
+[IPv6Prefix]
+Prefix=2a07:c481:1:36::/64
+Assign=true
+Token=static:::1
+
--- a/resources/z9/z9-router/systemd_networkd/21-netwan.400-fux_uplink.network
+++ b/resources/z9/z9-router/systemd_networkd/21-netwan.400-fux_uplink.network
@ -0,0 +1,28 @@
+[Match]
+Name=netwan.400
+Type=vlan
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+Description=fux-uplink
+
+DNS=185.161.128.66
+DNS=2a07:c481:0:4::2
+DNS=185.161.128.67
+DNS=2a07:c481:0:4::3
+
+IPv6AcceptRA=no
+# Masquerading done in nftables (nftables.conf).
+IPv6SendRA=no
+
+[Address]
+Address=185.161.129.134/25
+[Address]
+Address=2a07:c481::1:2/64
+
+[Route]
+Gateway=185.161.129.129
+[Route]
+Gateway=2a07:c481::1
--- a/resources/z9/z9-router/systemd_networkd_global_config.conf
+++ b/resources/z9/z9-router/systemd_networkd_global_config.conf
@ -0,0 +1,3 @@
+[Network]
+IPv4Forwarding=true
+IPv6Forwarding=true
--- a/roles/docker/README.md
+++ b/roles/docker/README.md
@ -16,10 +16,7 @@ None.

 ## Optional Arguments

- `docker__gvisor_setup`: Whether or not to set up [gVisor](https://gvisor.dev/) (`runsc` runtime).  
-  > Note: gVisor doesn't work with the embedded DNS server Docker forces for user-defined bridges (see the [relevant GitHub issue](https://github.com/google/gvisor/issues/7469)). A workaround would be to bind mount a `resolv.conf` not relying on localhost DNS (note however that this still doesn't provide local container name resolution). When enabling this option such a helper `resolv.conf` pointing to Quad9 gets deployed to `/etc/gvisor-helper-resolv.conf` for bind-mounting. See the file for usage instructions.
-  
-  Defaults to `false`.
+None.

 ## Links & Resources

--- a/roles/docker/defaults/main.yaml
+++ b/roles/docker/defaults/main.yaml
@ -1 +0,0 @@
-docker__gvisor_setup: false
--- a/roles/docker/templates/daemon.json.j2
+++ b/roles/docker/templates/daemon.json.j2
@ -1,7 +1,7 @@
 {
    "log-driver": "journald",
    "log-opts": {
-        "tag": "{{ '{{.Name}}' }}"
+        "tag": "{{.Name}}"
    },
    "ipv6": true,
    "ip6tables": true,
@ -10,10 +10,5 @@
        "bridge": {
            "com.docker.network.enable_ipv6":"true"
        }
-    }{% if docker__gvisor_setup %},
-    "runtimes": {
-        "runsc": {
-            "path": "/usr/bin/runsc"
-        }
-    }{% endif %}
+    }
 }
--- a/roles/docker/files/gvisor-helper-resolv.conf
+++ b/roles/docker/files/gvisor-helper-resolv.conf
@ -1,9 +0,0 @@
-# resolv.conf pointing to Quad9 for bind-mounting into containers on user-defined bridges and using the gVisor runsc runtime.
-# Example: docker run --runtime runsc --mount type=bind,src=/etc/gvisor-helper-resolv.conf,dst=/etc/resolv.conf,ro=true --network your-user-defined-network -it --rm docker.io/library/debian /bin/bash
-
-nameserver 9.9.9.9
-nameserver 149.112.112.112
-nameserver 2620:fe::fe
-nameserver 2620:fe::9
-
-options edns0
--- a/roles/docker/handlers/main.yaml
+++ b/roles/docker/handlers/main.yaml
@ -2,9 +2,3 @@
  ansible.builtin.systemd_service:
    daemon_reload: true
  become: true
-
- name: restart the docker service
-  ansible.builtin.systemd:
-    name: docker.service
-    state: restarted
-  become: true
--- a/roles/docker/meta/argument_specs.yaml
+++ b/roles/docker/meta/argument_specs.yaml
@ -1,6 +0,0 @@
-argument_specs:
-  main:
-    options:
-      docker__gvisor_setup:
-        type: bool
-        required: false
--- a/roles/docker/tasks/main/01_repo_setup.yaml
+++ b/roles/docker/tasks/main/01_repo_setup.yaml
@ -1,36 +1,15 @@
- name: ensure Docker repo
-  block:
-    - name: Ensure Dockers GPG key is added
-      ansible.builtin.get_url:
-        url: https://download.docker.com/linux/debian/gpg
-        dest: /etc/apt/trusted.gpg.d/docker.asc
-        mode: "0644"
-        owner: root
-        group: root
-      become: true
+- name: Ensure Dockers GPG key is added
+  ansible.builtin.get_url:
+    url: https://download.docker.com/linux/debian/gpg
+    dest: /etc/apt/trusted.gpg.d/docker.asc
+    mode: "0644"
+    owner: root
+    group: root
+  become: true

-    - name: Ensure Docker APT repository is added
-      ansible.builtin.apt_repository:
-        repo: "deb [arch=amd64 signed-by=/etc/apt/trusted.gpg.d/docker.asc] https://download.docker.com/linux/debian {{ ansible_facts['distribution_release'] }} stable"
-        filename: docker
-        state: present
-      become: true
-
- name: ensure gVisor repo
-  when: docker__gvisor_setup
-  block:
-    - name: Ensure gVisors GPG key is added
-      ansible.builtin.get_url:
-        url: https://gvisor.dev/archive.key
-        dest: /etc/apt/keyrings/gvisor.asc
-        mode: "0644"
-        owner: root
-        group: root
-      become: true
-
-    - name: Ensure gVisors APT repository is added
-      ansible.builtin.apt_repository:
-        repo: "deb [arch=amd64 signed-by=/etc/apt/keyrings/gvisor.asc] https://storage.googleapis.com/gvisor/releases release main"
-        filename: gvisor
-        state: present
-      become: true
+- name: Ensure Docker APT repository is added
+  ansible.builtin.apt_repository:
+    repo: "deb [arch=amd64 signed-by=/etc/apt/trusted.gpg.d/docker.asc] https://download.docker.com/linux/debian {{ ansible_facts['distribution_release'] }} stable"
+    filename: docker
+    state: present
+  become: true
--- a/roles/docker/tasks/main/02_docker_install.yaml
+++ b/roles/docker/tasks/main/02_docker_install.yaml
@ -9,12 +9,3 @@
    state: present
    update_cache: true
  become: true
-
- name: Ensure gVisors packages are installed
-  when: docker__gvisor_setup
-  ansible.builtin.apt:
-    name:
-      - runsc
-    state: present
-    update_cache: true
-  become: true
--- a/roles/docker/tasks/main/03_docker_config.yaml
+++ b/roles/docker/tasks/main/03_docker_config.yaml
@ -2,21 +2,10 @@
 # - log to systemd journal
 #   https://docs.docker.com/engine/logging/drivers/journald/
 - name: Ensure Docker daemon configuration
-  ansible.builtin.template:
-    src: daemon.json.j2
+  ansible.builtin.copy:
+    src: daemon.json
    dest: /etc/docker/daemon.json
    owner: root
    group: root
    mode: "0644"
  become: true
-  notify: restart the docker service
-
- name: Ensure helper gVisor resolv.conf is deployed
-  when: docker__gvisor_setup
-  ansible.builtin.copy:
-    src: gvisor-helper-resolv.conf
-    dest: /etc/gvisor-helper-resolv.conf
-    owner: root
-    group: root
-    mode: "0644"
-  become: true
--- a/roles/forgejo_runner/README.md
+++ b/roles/forgejo_runner/README.md
@ -1,9 +0,0 @@
-# `forgejo_runner`
-
-Ensures Forgejo Runner is installed and set up.  
-See: https://forgejo.org/docs/latest/admin/actions/
-
-## Required Arguments
-
- `forgejo_runner__config`: The configuration to run the Forgejo Runner with.  
-  A configuration can be generated using `forgejo-runner generate-config`. Also see the [relevant docs](https://forgejo.org/docs/latest/admin/actions/configuration/).
--- a/roles/forgejo_runner/files/EB114F5E6C0DC2BCDD183550A4B61A2DC5923710.asc
+++ b/roles/forgejo_runner/files/EB114F5E6C0DC2BCDD183550A4B61A2DC5923710.asc
@ -1,71 +0,0 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
-Comment: EB11 4F5E 6C0D C2BC DD18  3550 A4B6 1A2D C592 3710
-Comment: Forgejo <contact@forgejo.org>
-Comment: Forgejo Releases <release@forgejo.org>
-
-xjMEY3T/yhYJKwYBBAHaRw8BAQdAVxqCQrSbpDNrx8CiTM8PUAVqdCyv2UmBDhpP
-HZIpoIDNHUZvcmdlam8gPGNvbnRhY3RAZm9yZ2Vqby5vcmc+wsB+BBMWCgDmAhsD
-BQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAhkBFiEE6xFPXmwNwrzdGDVQpLYaLcWS
-NxAFAmSc08VBFIAAAAAAEAAocHJvb2ZAYXJpYWRuZS5pZGh0dHBzOi8vY29kZWJl
-cmcub3JnL2Zvcmdlam8vZ2l0ZWFfcHJvb2Y2FIAAAAAAEAAdcHJvb2ZAYXJpYWRu
-ZS5pZGh0dHBzOi8vZmxvc3Muc29jaWFsL0Bmb3JnZWpvMRSAAAAAABAAGHByb29m
-QGFyaWFkbmUuaWRkbnM6Zm9yZ2Vqby5vcmc/dHlwZT1UWFQACgkQpLYaLcWSNxDM
-2wEA6bOel3R25z3YUXL4hI2S8jRkJbOQawq0vgUnYNgS9hcBAK2zq4Zt4ctvSB+x
-TqhR6Zi6aqSD3QrRnUVvV1xZhdkEwsCABBMWCgDoAhsDBQsJCAcDBRUKCQgLBRYC
-AwEAAh4BAheAAhkBFiEE6xFPXmwNwrzdGDVQpLYaLcWSNxAFAmScz7JDFIAAAAAA
-EAAqcHJvb2ZAYXJpYWRuZS5pZGh0dHBzOi8vY29kZWJlcmcub3JnL2Zvcmdlam8v
-Zm9yZ2Vqb19wcm9vZjYUgAAAAAAQAB1wcm9vZkBhcmlhZG5lLmlkaHR0cHM6Ly9m
-bG9zcy5zb2NpYWwvQGZvcmdlam8xFIAAAAAAEAAYcHJvb2ZAYXJpYWRuZS5pZGRu
-czpmb3JnZWpvLm9yZz90eXBlPVRYVAAKCRCkthotxZI3EBJ1AP9UeN1HFGz90r34
-PGrOj1225HfJzdWgamEUkEKEwShcIQD+K/o7sLJM+C/mJXaCixAZgvRd9/rYq27T
-9Y2rTQybSwnCwH4EExYKAOYCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4ACGQEW
-IQTrEU9ebA3CvN0YNVCkthotxZI3EAUCY3spkjYUgAAAAAAQAB1wcm9vZkBhcmlh
-ZG5lLmlkaHR0cHM6Ly9mbG9zcy5zb2NpYWwvQGZvcmdlam8xFIAAAAAAEAAYcHJv
-b2ZAYXJpYWRuZS5pZGRuczpmb3JnZWpvLm9yZz90eXBlPVRYVEEUgAAAAAAQAChw
-cm9vZkBhcmlhZG5lLmlkaHR0cHM6Ly9jb2RlYmVyZy5vcmcvZm9yZ2Vqby9naXRl
-YV9wcm9vZgAKCRCkthotxZI3EC+hAQCxsUupyqMChFMqk/74PqzSlmCd6RXtbezP
-W66YostSbgD9G+N+c9or1cBkcSejREOSy7TFrDrvek+ZhdZVhCp1UALCwEcEExYK
-AK8CGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4ACGQEWIQTrEU9ebA3CvN0YNVCk
-thotxZI3EAUCY3inA0EUgAAAAAAQAChwcm9vZkBhcmlhZG5lLmlkaHR0cHM6Ly9j
-b2RlYmVyZy5vcmcvZm9yZ2Vqby9naXRlYV9wcm9vZjEUgAAAAAAQABhwcm9vZkBh
-cmlhZG5lLmlkZG5zOmZvcmdlam8ub3JnP3R5cGU9VFhUAAoJEKS2Gi3FkjcQNV8B
-AJfcHBzskW78lJVJeQwCI70qorOhC/QUp80jjNzs5lO7AQCujYgrae3vZb/476sc
-wM33ufSpBguNwTLbCI6C5g8+B80mRm9yZ2VqbyBSZWxlYXNlcyA8cmVsZWFzZUBm
-b3JnZWpvLm9yZz7CkAQTFgoAOAIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgBYh
-BOsRT15sDcK83Rg1UKS2Gi3FkjcQBQJjeKH0AAoJEKS2Gi3FkjcQC5YBAKwCGFDD
-SpX0JwBrzIP8W8ElwHvdBz2XDg8LwyQgr722AP9r01rbFwY4axDxpNj+BUFxwD5F
-hza1cE3932eTsSOPDsKQBBMWCAA4FiEE6xFPXmwNwrzdGDVQpLYaLcWSNxAFAmN4
-k+kCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQpLYaLcWSNxBHrQD+PFo/
-ii8p72HP0KsJbHPGnS/Sk9pFGd16fs1Hd88JHj0A/10XNyGQgwbe+X+K/a97vWW8
-vAzA1EtFIMfCGhIO8EoIzjMEY3UANBYJKwYBBAHaRw8BAQdAKvAs2Ij2RamYUzz4
-sBgsc2J+4fEwvSMcTp6rPZizRhfCwDUEGBYIACYWIQTrEU9ebA3CvN0YNVCkthot
-xZI3EAUCY3UANAIbAgUJAeEzgACBCRCkthotxZI3EHYgBBkWCAAdFiEE98vwIJTn
-Zl4X7WxE44G/PlDVNwcFAmN1ADQACgkQ44G/PlDVNwdIlgD+K15nuEec+VTFdP7Y
-Y3SxM8Rjg2EtXk007+LM7XQfN9sBAOLjBTzIdaaKOpoAkGQ9Th/IphSUOnPYZVO5
-a6cN+wAM458A/itf3urQehI5SbKtbRqIDhqQZQVAcEeG2eQFunuofjDWAQDt/gE5
-XgTiQgnkTcqAX7GQeE74O/Q5vDtX10NjbzV7D84zBGeOav0WCSsGAQQB2kcPAQEH
-QI2JXHjIx25g9WZHNyjkdUiRBPl5Y1JjjJCPvXM0/9RjwsA1BBgWCAAmFiEE6xFP
-XmwNwrzdGDVQpLYaLcWSNxAFAmeOav0CGwIFCQO1OAAAgQkQpLYaLcWSNxB2IAQZ
-FggAHRYhBA9SfPk6PQ0JJdPFXtCoIAUOFgnlBQJnjmr9AAoJENCoIAUOFgnljUwA
-+wSjU/mk4xGIlwzJdPnnNzIsiMeqtuYokbSrOIxXIhP1AP93qtVr+kOu3pDs9JC+
-8CYG0DK1QD1LmlGP59WRGevSCXChAQDy6SCfnfcr5P4fYaz04+Tl0CDUkFOGP+sV
-S/isPTssbAD9H2hKJKEmwuAd2MeFA3Bo3z5rUVWkfAcnv7Oy7u+OWQfOMwRlfHnh
-FgkrBgEEAdpHDwEBB0DGoKPPOOx7rnqT318eykUkMJbk83MhcBqrecOADO3i2sLA
-NQQYFggAJhYhBOsRT15sDcK83Rg1UKS2Gi3FkjcQBQJlfHnhAhsCBQkCx+oAAIEJ
-EKS2Gi3FkjcQdiAEGRYIAB0WIQTfMxnqNtWZwdSmg9SzsfYKxXfyogUCZXx54QAK
-CRCzsfYKxXfyoocRAP48OQpiBTkwC7kLLyuqVlP1t0hBQddr4i4rIV8Ug5tHzwEA
-pl8Q+S4k/ROQS5FOhy7GBC337SncJFJYDD0pTcSecw+J3AEAn4qax72Oyfb0vaPY
-m+WdqsfVBd2Hd2vJIwCjglp55B0BALIJE6nvACcKzTRUj7AQSLGvELGfJfM320xX
-E0ZVBZkKzjMEaUFtxRYJKwYBBAHaRw8BAQdA1AZR9j6PksmArHjaoqOHIOQ4H1iw
-0KZyLKLgu1onR8fCwDUEGBYIACYWIQTrEU9ebA3CvN0YNVCkthotxZI3EAUCaUFt
-xQIbAgUJAsfqAACBCRCkthotxZI3EHYgBBkWCAAdFiEEO/ToE/hIEkEdoB5bxBht
-9m9LZ1AFAmlBbcUACgkQxBht9m9LZ1DQHAD9EUEM23tJJUae0L1DbGnWEp3GnZOQ
-G3Z34uWv16wRV3EA+gJuHa9Zr1TXAEXXBwQzZIrAFby+7I5smWPVM84c7xYA/qEA
-/2dQMMZcRelFC0fIPvGQMGfYeBr8bkHKlJBQOTdukeSPAQCcd9rqJT7NNZlPtJ1T
-wNAfAa3L23bdp/dEtKhE+d09CM44BGN0/8oSCisGAQQBl1UBBQEBB0CZnRfIHxTV
-hOF8kdhbe4YJsePyVFi8USfuDXy4HgIHRgMBCAfCeAQYFggAIBYhBOsRT15sDcK8
-3Rg1UKS2Gi3FkjcQBQJjdP/KAhsMAAoJEKS2Gi3FkjcQdroA/jHFqt7y/r/5zdK4
-TYYp+5jlOgM5ZI7pNhWhtIFbqmx9AQCKSJf2YgPBLNJSL/86vpE9b6IvTE/8ENR/
-7xYaIA7oAg==
-=D+4T
-----END PGP PUBLIC KEY BLOCK-----
--- a/roles/forgejo_runner/files/forgejo-runner.service
+++ b/roles/forgejo_runner/files/forgejo-runner.service
@ -1,19 +0,0 @@
-# Source: https://code.forgejo.org/forgejo/runner/src/branch/main/contrib/forgejo-runner.service
-[Unit]
-Description=Forgejo Runner
-Documentation=https://forgejo.org/docs/latest/admin/actions/
-After=docker.service
-Requires=docker.service
-
-[Service]
-ExecStart=/usr/local/bin/forgejo-runner daemon -c /etc/forgejo-runner-config.yaml
-ExecReload=/bin/kill -s HUP $MAINPID
-
-User=runner
-WorkingDirectory=/home/runner
-Restart=on-failure
-TimeoutSec=0
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target
--- a/roles/forgejo_runner/handlers/main.yaml
+++ b/roles/forgejo_runner/handlers/main.yaml
@ -1,10 +0,0 @@
- name: systemd daemon reload
-  ansible.builtin.systemd_service:
-    daemon_reload: true
-  become: true
-
- name: restart the forgejo-runner service
-  ansible.builtin.systemd:
-    name: forgejo-runner.service
-    state: restarted
-  become: true
--- a/roles/forgejo_runner/meta/argument_specs.yaml
+++ b/roles/forgejo_runner/meta/argument_specs.yaml
@ -1,6 +0,0 @@
-argument_specs:
-  main:
-    options:
-      forgejo_runner__config:
-        type: str
-        required: true
--- a/roles/forgejo_runner/meta/main.yaml
+++ b/roles/forgejo_runner/meta/main.yaml
@ -1,3 +0,0 @@
---
-dependencies:
-  - role: docker
--- a/roles/forgejo_runner/tasks/main.yaml
+++ b/roles/forgejo_runner/tasks/main.yaml
@ -1,7 +0,0 @@
- name: Ensure Forgejo Runner is installed
-  ansible.builtin.import_tasks:
-    file: main/01_install.yaml
-
- name: Ensure Forgejo Runner is set up
-  ansible.builtin.import_tasks:
-    file: main/02_setup.yaml
--- a/roles/forgejo_runner/tasks/main/01_install.yaml
+++ b/roles/forgejo_runner/tasks/main/01_install.yaml
@ -1,96 +0,0 @@
- name: get latest release info
-  ansible.builtin.uri:
-    url: "https://data.forgejo.org/api/v1/repos/forgejo/runner/releases/latest"
-    return_content: true
-  register: forgejo_runner__latest_release_info
-
- name: set latest version
-  ansible.builtin.set_fact:
-    forgejo_runner__latest_version: "{{ forgejo_runner__latest_release_info.json.name | replace('v', '') }}"
-
- name: set latest version forgejo-runner binary path
-  ansible.builtin.set_fact:
-    forgejo_runner__latest_version_binary_path: "/usr/local/bin/forgejo-runner-{{ forgejo_runner__latest_version }}"
-
- name: check if latest version forgejo-runner binary is installed already
-  ansible.builtin.stat:
-    path: "{{ forgejo_runner__latest_version_binary_path }}"
-  register: forgejo_runner_latest_version_binary_stat
-
- name: download and install latest version, if not already present
-  when: not forgejo_runner_latest_version_binary_stat.stat.exists
-  block:
-    - name: set download url
-      ansible.builtin.set_fact:
-        forgejo_runner__download_url: "https://code.forgejo.org/forgejo/runner/releases/download/v{{ forgejo_runner__latest_version }}/forgejo-runner-{{ forgejo_runner__latest_version }}-linux-amd64"
-
-    - name: temporary directory for download
-      ansible.builtin.tempfile:
-        state: directory
-        suffix: forgejo_runner_download
-      become: true
-      register: forgejo_runner__download_tempdir
-
-    - name: download the forgejo-runner binary
-      ansible.builtin.get_url:
-        url: "{{ forgejo_runner__download_url }}"
-        dest: "{{ forgejo_runner__download_tempdir.path }}/forgejo-runner"
-        owner: root
-        group: root
-        mode: "0755"
-      become: true
-
-    - name: download the signature
-      ansible.builtin.get_url:
-        url: "{{ forgejo_runner__download_url }}.asc"
-        dest: "{{ forgejo_runner__download_tempdir.path }}/forgejo-runner.asc"
-        owner: root
-        group: root
-        mode: "0644"
-      become: true
-
-    - name: copy key for verification
-      ansible.builtin.copy:
-        src: "EB114F5E6C0DC2BCDD183550A4B61A2DC5923710.asc"
-        dest: "{{ forgejo_runner__download_tempdir.path }}/forgejo-runner-key.asc"
-        owner: root
-        group: root
-        mode: "0644"
-      become: true
-
-    - name: ensure sq (Sequoia-PGP) is installed
-      ansible.builtin.apt:
-        name: sq
-      become: true
-
-    - name: verify signature
-      ansible.builtin.command:
-        cmd: /usr/bin/sq verify --signer-file ./forgejo-runner-key.asc --signature-file forgejo-runner.asc --signatures 1 forgejo-runner
-        chdir: "{{ forgejo_runner__download_tempdir.path }}"
-      become: true
-      changed_when: false
-
-    - name: install forgejo-runner binary of this latest version
-      ansible.builtin.copy:
-        remote_src: true
-        src: "{{ forgejo_runner__download_tempdir.path }}/forgejo-runner"
-        dest: "{{ forgejo_runner__latest_version_binary_path }}"
-        owner: root
-        group: root
-        mode: "0755"
-      become: true
-
-    - name: ensure symlink points to binary of this latest version
-      ansible.builtin.file:
-        src: "{{ forgejo_runner__latest_version_binary_path }}"
-        dest: "/usr/local/bin/forgejo-runner"
-        state: link
-        owner: root
-        group: root
-      become: true
-  always:
-    - name: delete temporary download directory
-      ansible.builtin.file:
-        path: "{{ forgejo_runner__download_tempdir.path }}"
-        state: absent
-      become: true
--- a/roles/forgejo_runner/tasks/main/02_setup.yaml
+++ b/roles/forgejo_runner/tasks/main/02_setup.yaml
@ -1,46 +0,0 @@
- name: ensure runner group exists
-  ansible.builtin.group:
-    name: runner
-    system: true
-  become: true
-
- name: ensure runner user exists
-  ansible.builtin.user:
-    name: runner
-    group: runner
-    password: '!'
-    system: true
-    create_home: true
-    groups:
-      - docker
-  become: true
-
- name: ensure the configuration is deployed
-  ansible.builtin.copy:
-    content: "{{ forgejo_runner__config }}"
-    dest: /etc/forgejo-runner-config.yaml
-    owner: root
-    group: runner
-    mode: "0640"
-  become: true
-  notify:
-    - restart the forgejo-runner service
-
- name: ensure systemd service exists
-  ansible.builtin.copy:
-    src: forgejo-runner.service
-    dest: /etc/systemd/system/forgejo-runner.service
-    owner: root
-    group: root
-    mode: "0644"
-  become: true
-  notify:
-    - systemd daemon reload
-    - restart the forgejo-runner service
-
- name: ensure systemd service is started and enabled
-  ansible.builtin.systemd_service:
-    name: forgejo-runner.service
-    state: started
-    enabled: true
-  become: true
--- a/roles/kea_dhcp/README.md
+++ b/roles/kea_dhcp/README.md
@ -0,0 +1,102 @@
+# Role `kea_dhcp`
+
+Install and manage Kea DHCP and [Stork Agent](https://stork.readthedocs.io/en/latest/man/stork-agent.8.html).
+
+## Supported Distributions
+
+Should work on Debian-based distributions.
+
+## Required Arguments
+
+None.
+
+## Optional Arguments
+
+- `kea_dhcp__stork_agent.enable`: Enable Kea DHCP stork agent.
+  Defaults to `false`.
+- `kea_dhcp__stork_agent.prometheus_only`: Only enable the prometheus endpoint in stork agent.
+  Defaults to `true`.
+- `kea_dhcp__dns_servers.v4`: List of IPv4 DNS Servers in DHCP response.
+  Defaults to FUX DNS Servers.
+- `kea_dhcp__dns_servers.v6`: List of IPv6 DNS Servers in DHCP response.
+  Defaults to FUX DNS Servers.
+- `kea_dhcp__include_vars`: Path to YAML File to separately load VARs for Kea config templating.
+- `kea_dhcp__dhcp4.enable`: Enable Kea DHCP4 Service.
+  Defaults to `false`.
+- `kea_dhcp__dhcp4.interfaces`: List of interfaces the DHCP4 Server should listen to and serve.
+  Defaults to the empty list (`[ ]`).
+- `kea_dhcp__dhcp4.control-sockets`: List of Kea DHCP4 control sockets.
+  Defaults to the list with one entry (see below).
+- `kea_dhcp__dhcp4.control-sockets.*.socket-name`: Control socket name.
+  Defaults to `kea_dhcp__dhcp4.control-sockets.0.socket-name: /var/run/kea-dhcp4-ctrl-agent.sock`.
+- `kea_dhcp__dhcp4.control-sockets.*.socket-type`: Control socket type.
+  Defaults to `kea_dhcp__dhcp4.control-sockets.0.socket-type: unix`.
+- `kea_dhcp__dhcp4.lease-database.type`: Type of lease database.
+  Defaults to `memfile`.
+- `kea_dhcp__dhcp4.lease-database.persist`: Persist the lease database.
+  Defaults to `true`.
+- `kea_dhcp__dhcp4.option-data`: List of DHCP4 Options.
+  Defaults to a list with one entry (see below).
+- `kea_dhcp__dhcp4.option-data.*.name`: Name of DHCP4 Option.
+  Defaults to `kea_dhcp__dhcp4.option-data.0.name: "domain-name-servers"`.
+- `kea_dhcp__dhcp4.option-data.*.code`: DHCP4 Option code.
+  Defaults to `kea_dhcp__dhcp4.option-data.0.code: 6`.
+- `kea_dhcp__dhcp4.option-data.*.csv-format`: DHCP4 Option as csv format.
+  Defaults to `kea_dhcp__dhcp4.option-data.0.csv-format: true`.
+- `kea_dhcp__dhcp4.option-data.*.data`: DHCP4 Option data.
+  Defaults to `kea_dhcp__dhcp4.option-data.0.data: "{{ kea_dhcp__dns_servers.v4 | join(',') }}"`.
+- `kea_dhcp__dhcp4.subnets`: List of subnets the DHCP4 server should manage.
+  Defaults to the empty list (`[ ]`).
+- `kea_dhcp__dhcp4.subnets.*.id`: ID of interface (starts with 1).
+- `kea_dhcp__dhcp4.subnets.*.subnet`: Subnet on interface.
+- `kea_dhcp__dhcp4.subnets.*.pools`: List of DHCP pools in subnet.
+- `kea_dhcp__dhcp4.subnets.*.pools.*.pool`: DHCP pool in range format.
+- `kea_dhcp__dhcp4.subnets.*.reservations`: List of DHCP lease reservations.
+- `kea_dhcp__dhcp4.subnets.*.reservations.*.ip-address`: IP address of reservation.
+- `kea_dhcp__dhcp4.subnets.*.reservations.*.hostname`: Hostname of reservation.
+- `kea_dhcp__dhcp4.subnets.*.reservations.*.hw-address`: Hardware address of reservation.
+- `kea_dhcp__dhcp4.subnets.*.option-data`: List of DHCP lease reservations.
+- `kea_dhcp__dhcp4.subnets.*.option-data.*.name`: Name of DHCP4 Option.
+- `kea_dhcp__dhcp4.subnets.*.option-data.*.code`: DHCP4 Option code.
+- `kea_dhcp__dhcp4.subnets.*.option-data.*.csv-format`: DHCP4 Option as csv format.
+- `kea_dhcp__dhcp4.subnets.*.option-data.*.data`: DHCP4 Option data.
+- `kea_dhcp__dhcp6.enable`: Enable Kea DHCP6 Service.
+  Defaults to `false`.
+- `kea_dhcp__dhcp6.interfaces`: List of interfaces the DHCP6 Server should listen to and serve.
+  Defaults to the empty list (`[ ]`).
+- `kea_dhcp__dhcp6.control-sockets`: List of Kea DHCP6 control sockets.
+  Defaults to the list with one entry (see below).
+- `kea_dhcp__dhcp6.control-sockets.*.socket-name`: Control socket name.
+  Defaults to `kea_dhcp__dhcp6.control-sockets.0.socket-name: /var/run/kea-dhcp6-ctrl-agent.sock`.
+- `kea_dhcp__dhcp6.control-sockets.*.socket-type`: Control socket type.
+  Defaults to `kea_dhcp__dhcp6.control-sockets.0.socket-type: unix`.
+- `kea_dhcp__dhcp6.lease-database.type`: Type of lease database.
+  Defaults to `memfile`.
+- `kea_dhcp__dhcp6.lease-database.persist`: Persist the lease database.
+  Defaults to `true`.
+- `kea_dhcp__dhcp6.option-data`: List of DHCP6 Options.
+  Defaults to a list with one entry (see below).
+- `kea_dhcp__dhcp6.option-data.*.name`: Name of DHCP6 Option.
+  Defaults to `kea_dhcp__dhcp6.option-data.0.name: "domain-name-servers"`.
+- `kea_dhcp__dhcp6.option-data.*.code`: DHCP6 Option code.
+  Defaults to `kea_dhcp__dhcp6.option-data.0.code: 6`.
+- `kea_dhcp__dhcp6.option-data.*.csv-format`: DHCP6 Option as csv format.
+  Defaults to `kea_dhcp__dhcp6.option-data.0.csv-format: true`.
+- `kea_dhcp__dhcp6.option-data.*.data`: DHCP6 Option data.
+  Defaults to `kea_dhcp__dhcp6.option-data.0.data: "{{ kea_dhcp__dns_servers.v6 | join(',') }}"`.
+- `kea_dhcp__dhcp6.subnets`: List of subnets the DHCP6 server should manage.
+  Defaults to the empty list (`[ ]`).
+- `kea_dhcp__dhcp6.subnets.*.id`: ID of interface (starts with 1).
+- `kea_dhcp__dhcp6.subnets.*.subnet`: Subnet on interface.
+- `kea_dhcp__dhcp6.subnets.*.pools`: List of DHCP pools in subnet.
+- `kea_dhcp__dhcp6.subnets.*.pools.*.pool`: DHCP pool in range format.
+- `kea_dhcp__dhcp6.subnets.*.reservations`: List of DHCP lease reservations.
+- `kea_dhcp__dhcp6.subnets.*.reservations.*.ip-address`: IP address of reservation.
+- `kea_dhcp__dhcp6.subnets.*.reservations.*.hostname`: Hostname of reservation.
+- `kea_dhcp__dhcp6.subnets.*.reservations.*.hw-address`: Hardware address of reservation.
+- `kea_dhcp__dhcp6.subnets.*.option-data`: List of DHCP lease reservations.
+- `kea_dhcp__dhcp6.subnets.*.option-data.*.name`: Name of DHCP6 Option.
+- `kea_dhcp__dhcp6.subnets.*.option-data.*.code`: DHCP6 Option code.
+- `kea_dhcp__dhcp6.subnets.*.option-data.*.csv-format`: DHCP6 Option as csv format.
+- `kea_dhcp__dhcp6.subnets.*.option-data.*.data`: DHCP6 Option data.
+
--- a/roles/kea_dhcp/defaults/main.yaml
+++ b/roles/kea_dhcp/defaults/main.yaml
@ -0,0 +1,68 @@
+kea_dhcp__stork_agent:
+  enable: false
+  prometheus_only: true
+kea_dhcp__dns_servers:
+  v6:
+    - "2a07:c481:0:4::2"
+    - "2a07:c481:0:4::3"
+  v4:
+    - "185.161.128.66"
+    - "185.161.128.67"
+kea_dhcp__include_vars:
+
+kea_dhcp__dhcp4:
+  enable: false
+  interfaces: [ ]
+  control-sockets:
+    - socket-name: /var/run/kea-dhcp4-ctrl-agent.sock
+      socket-type: unix
+  lease-database:
+    type: memfile
+    persist: true
+  option-data:
+    - name: "domain-name-servers"
+      code: 6
+      csv-format: true
+      data: "{{ kea_dhcp__dns_servers.v4 | join(',') }}"
+  subnets:
+    - id: 0
+      subnet: nil
+      pools:
+        - pool: nil
+      reservations:
+        - ip-address: nil
+          hostname: beispiel.test
+          hw-address: "00:11:22:33:44:55"
+      option-data:
+        - name: nil,
+          code: nil,
+          csv-format: true
+          data: nil
+kea_dhcp__dhcp6:
+  enable: false
+  interfaces: [ ]
+  lease-database:
+    type: memfile
+    persist: true
+  control-sockets:
+    - socket-name: /var/run/kea-dhcp6-ctrl-agent.sock
+      socket-type: unix
+  option-data:
+    - name: "dns-servers"
+      code: 23
+      csv-format: true
+      data: "{{ kea_dhcp__dns_servers.v6 | join(',') }}"
+  subnets:
+    - id: 0
+      subnet: nil
+      pools:
+        - pool: nil
+      reservations:
+        - ip-address: nil
+          hostname: beispiel.test
+          hw-address: "00:11:22:33:44:55"
+      option-data:
+        - name: nil,
+          code: nil,
+          csv-format: true
+          data: nil
--- a/roles/kea_dhcp/handlers/main.yml
+++ b/roles/kea_dhcp/handlers/main.yml
@ -0,0 +1,30 @@
+---
+- name: Systemd.daemon_reload
+  become: true
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+
+- name: Kea_dhcp4.restarted
+  ansible.builtin.service:
+    name: kea-dhcp4
+    state: restarted
+    enabled: true
+
+- name: Kea_dhcp6.restarted
+  ansible.builtin.service:
+    name: kea-dhcp6
+    state: restarted
+    enabled: true
+
+- name: Kea_ctrl.restarted
+  ansible.builtin.systemd:
+    name: kea-ctrl-agent
+    state: restarted
+    enabled: true
+
+- name: Stork_agent.restarted
+  become: true
+  ansible.builtin.systemd:
+    name: isc-stork-agent
+    state: restarted
+    enabled: true
--- a/roles/kea_dhcp/meta/argument_specs.yaml
+++ b/roles/kea_dhcp/meta/argument_specs.yaml
@ -0,0 +1,125 @@
+---
+argument_specs:
+  main:
+    short_description: "Role for managing Kea DHCP server"
+    options:
+      kea_dhcp__stork_agent:
+        type: "dict"
+        description: "Configuration for Stork Agent"
+        options:
+          enable:
+            type: "bool"
+            default: false
+          prometheus_only:
+            type: "bool"
+            default: true
+      kea_dhcp__version_repo:
+        type: "str"
+        description: "Version of Kea DHCP repository to use"
+        default: "kea-3-0"
+      kea_dhcp__dns_servers:
+        type: "dict"
+        description: "Default DNS servers for DHCP clients"
+        options:
+          v6:
+            type: "list"
+            elements: "str"
+          v4:
+            type: "list"
+            elements: "str"
+      kea_dhcp__dhcp4:
+        type: "dict"
+        description: "Configuration for DHCPv4 service"
+        options:
+          enable:
+            type: "bool"
+            default: false
+          interfaces:
+            type: "list"
+            elements: "str"
+            default: [ ]
+          control-sockets:
+            type: "list"
+            elements: "dict"
+          lease-database:
+            type: "dict"
+          option-data:
+            type: "list"
+            elements: "dict"
+          subnets:
+            type: "list"
+            elements: "dict"
+            options:
+              id:
+                type: "int"
+              subnet:
+                type: "str"
+              pools:
+                type: "list"
+                elements: "dict"
+                options:
+                  pool:
+                    type: "str"
+              reservations:
+                type: "list"
+                elements: "dict"
+                options:
+                  ip-address:
+                    type: "str"
+                  hostname:
+                    type: "str"
+                  hw-address:
+                    type: "str"
+                  duid:
+                    type: "str"
+              option-data:
+                type: "list"
+                elements: "dict"
+      kea_dhcp__dhcp6:
+        type: "dict"
+        description: "Configuration for DHCPv6 service"
+        options:
+          enable:
+            type: "bool"
+            default: false
+          interfaces:
+            type: "list"
+            elements: "str"
+            default: [ ]
+          control-sockets:
+            type: "list"
+            elements: "dict"
+          lease-database:
+            type: "dict"
+          option-data:
+            type: "list"
+            elements: "dict"
+          subnets:
+            type: "list"
+            elements: "dict"
+            options:
+              id:
+                type: "int"
+              subnet:
+                type: "str"
+              pools:
+                type: "list"
+                elements: "dict"
+                options:
+                  pool:
+                    type: "str"
+              reservations:
+                type: "list"
+                elements: "dict"
+                options:
+                  ip-address:
+                    type: "str"
+                  hostname:
+                    type: "str"
+                  hw-address:
+                    type: "str"
+                  duid:
+                    type: "str"
+              option-data:
+                type: "list"
+                elements: "dict"
--- a/roles/kea_dhcp/tasks/install_debian.yml
+++ b/roles/kea_dhcp/tasks/install_debian.yml
@ -0,0 +1,25 @@
+---
+- name: Install Kea packages
+  become: true
+  when: ansible_facts['distribution'] == "Debian"
+  block:
+    - name: Install Kea dhcp4
+      when: kea_dhcp__dhcp4.enable
+      ansible.builtin.apt:
+        name:
+          - isc-kea-dhcp4
+    - name: Install Kea dhcp6
+      when: kea_dhcp__dhcp6.enable
+      ansible.builtin.apt:
+        name:
+          - isc-kea-dhcp6
+    - name: Install Kea ctrl agent
+      when: kea_dhcp__stork_agent.enable
+      ansible.builtin.apt:
+        name:
+          - isc-kea-ctrl-agent
+    - name: Install Kea admin
+      when: kea_dhcp__stork_agent.enable
+      ansible.builtin.apt:
+        name:
+          - isc-kea-admin
--- a/roles/kea_dhcp/tasks/kea.yaml
+++ b/roles/kea_dhcp/tasks/kea.yaml
@ -0,0 +1,47 @@
+---
+- name: Include config vars
+  when: kea_dhcp__include_vars != None
+  ansible.builtin.include_vars:
+    file: "{{ kea_dhcp__include_vars }}"
+
+- name: Deploy kea-dhcp4 configuration file
+  become: true
+  when: kea_dhcp__dhcp4.enable
+  ansible.builtin.template:
+    src: kea-dhcp4.conf.jinja
+    dest: /etc/kea/kea-dhcp4.conf
+    backup: true
+    owner: root
+    group: kea
+    mode: "u=rw,g=r,o="
+    validate: kea-dhcp4 -T %s
+  notify:
+    - Kea_dhcp4.restarted
+
+- name: Deploy kea-dhcp6 configuration file
+  become: true
+  when: kea_dhcp__dhcp6.enable
+  ansible.builtin.template:
+    src: kea-dhcp6.conf.jinja
+    dest: /etc/kea/kea-dhcp6.conf
+    backup: true
+    owner: root
+    group: kea
+    mode: "u=rw,g=r,o="
+    validate: kea-dhcp6 -T %s
+  notify:
+    - Kea_dhcp6.restarted
+
+- name: Copy kea-ctrl-agent configuration file
+  become: true
+  when: kea_dhcp__stork_agent.enable
+  ansible.builtin.template:
+    src: kea-ctrl-agent.conf.j2
+    dest: /etc/kea/kea-ctrl-agent.conf
+    owner: root
+    group: kea
+    mode: "u=rw,g=r,o="
+    validate: kea-ctrl-agent -t %s
+  notify:
+    - Kea_ctrl.restarted
+    - Stork_agent.restarted
--- a/roles/kea_dhcp/tasks/main.yml
+++ b/roles/kea_dhcp/tasks/main.yml
@ -0,0 +1,13 @@
+---
+- name: Setup Kea DHCP
+  block:
+    - name: Install Kea on Debian
+      when: ansible_facts['distribution'] == "Debian"
+      ansible.builtin.import_tasks: install_debian.yml
+
+    - name: Configure Kea
+      ansible.builtin.include_tasks: kea.yaml
+
+- name: Run stork-agent tasks
+  when: kea_dhcp__stork_agent.enable
+  ansible.builtin.include_tasks: stork-agent.yaml
--- a/roles/kea_dhcp/tasks/stork-agent.yaml
+++ b/roles/kea_dhcp/tasks/stork-agent.yaml
@ -0,0 +1,39 @@
+---
+- name: Install stork-agent
+  block:
+    - name: Install isc-stork-agent
+      when: ansible_facts['distribution'] == "Debian"
+      become: true
+      ansible.builtin.apt:
+        name: isc-stork-agent
+
+    - name: Add stork-agent user to _kea group on Debian
+      when: ansible_facts['distribution'] == "Debian"
+      become: true
+      ansible.builtin.user:
+        name: stork-agent
+        groups: [ "_kea" ]
+        append: true
+
+    - name: Config for stork-agent
+      ansible.builtin.template:
+        src: stork-agent.env.jinja
+        dest: /etc/stork/agent.env
+        owner: root
+        group: root
+        mode: "0660"
+      notify:
+        - Systemd_daemon_reload
+        - Stork_agent.restarted
+
+    - name: Flush handlers
+      ansible.builtin.meta: flush_handlers
+
+    - name: Ensure that stork kea exporter is working
+      ansible.builtin.uri:
+        url: "http://localhost:9547/metrics"
+        method: GET
+      register: kea_dhcp_stork_status_code
+      retries: 6
+      delay: 5
+      until: kea_dhcp_stork_status_code.status == 200
--- a/roles/kea_dhcp/templates/kea-ctrl-agent.conf.j2
+++ b/roles/kea_dhcp/templates/kea-ctrl-agent.conf.j2
@ -0,0 +1,20 @@
+{
+"Control-agent": {
+	"http-host": "127.0.0.1",
+	"http-port": 8000,
+	"control-sockets": {
+		{% if kea_dhcp__dhcp4.enable | default(false) %}
+		"dhcp4": {
+			"socket-type": "{{ kea_dhcp__dhcp4['control-sockets'][0]['socket-type'] }}",
+			"socket-name": "{{ kea_dhcp__dhcp4['control-sockets'][0]['socket-name'] }}"
+		}{% if kea_dhcp__dhcp6.enable  %},{% endif %}
+		{% endif %}
+		{% if kea_dhcp__dhcp6.enable | default(false) %}
+		"dhcp6": {
+			"socket-type": "{{ kea_dhcp__dhcp6['control-sockets'][0]['socket-type'] }}",
+			"socket-name": "{{ kea_dhcp__dhcp6['control-sockets'][0]['socket-name'] }}"
+		},
+		{% endif %}
+	}
+}
+}
--- a/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja
+++ b/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja
@ -0,0 +1,27 @@
+{
+  "Dhcp4": {
+    "interfaces-config": {
+      "interfaces": {{ kea_dhcp__dhcp4.interfaces | to_nice_json }}
+    },
+    "control-sockets": {{ kea_dhcp__dhcp4['control-sockets'] | to_nice_json }},
+    "lease-database": {{ kea_dhcp__dhcp4['lease-database'] | to_nice_json }},
+    {% if kea_dhcp__dhcp4['option-data'] is defined and kea_dhcp__dhcp4['option-data'] %}
+    "option-data": {{ kea_dhcp__dhcp4['option-data'] | to_nice_json }},
+    {% endif %}
+    "subnet4": [
+      {% for subnet in kea_dhcp__dhcp4.subnets %}
+      {
+        "id": {{ subnet.id }},
+        "subnet": "{{ subnet.subnet }}",
+        "pools": {{ subnet.pools | to_nice_json }},
+        {% if subnet.reservations is defined and subnet.reservations %}
+        "reservations": {{ subnet.reservations | to_nice_json }},
+        {% endif %}
+        {% if subnet['option-data'] is defined and subnet['option-data'] %}
+        "option-data": {{ subnet['option-data'] | to_nice_json }}
+        {% endif %}
+      }{% if not loop.last %},{% endif %}
+      {% endfor %}
+    ]
+  }
+}
--- a/roles/kea_dhcp/templates/kea-dhcp6.conf.jinja
+++ b/roles/kea_dhcp/templates/kea-dhcp6.conf.jinja
@ -0,0 +1,27 @@
+{
+  "Dhcp6": {
+    "interfaces-config": {
+      "interfaces": {{ kea_dhcp__dhcp6.interfaces | to_nice_json }}
+    },
+		"control-sockets": {{ kea_dhcp__dhcp6['control-sockets'] | to_nice_json }},
+		"lease-database": {{ kea_dhcp__dhcp6['lease-database'] | to_nice_json }},
+    {% if kea_dhcp__dhcp6['option-data'] is defined and kea_dhcp__dhcp6['option-data'] %}
+    "option-data": {{ kea_dhcp__dhcp6['option-data'] | to_nice_json }},
+    {% endif %}
+    "subnet6": [
+      {% for subnet in kea_dhcp__dhcp6.subnets %}
+      {
+        "id": {{ subnet.id }},
+	      "subnet": "{{ subnet.subnet }}",
+        "pools": {{ subnet.pools | to_nice_json }},
+        {% if subnet.reservations is defined and subnet.reservations %}
+        "reservations": {{ subnet.reservations | to_nice_json }},
+	      {% endif %}
+        {% if subnet['option-data'] is defined and subnet['option-data'] %}
+        "option-data": {{ subnet['option-data'] | to_nice_json }}
+        {% endif %}
+      }{% if not loop.last %},{% endif %}
+      {% endfor %}
+    ]
+	}
+}
--- a/roles/kea_dhcp/templates/stork-agent.env.jinja
+++ b/roles/kea_dhcp/templates/stork-agent.env.jinja
@ -0,0 +1,20 @@
+### Stork Agent env file
+### (created and managed by ansible kea_dhcp role)
+
+
+{% if kea_dhcp__stork_agent.prometheus_only %}
+### listen for Prometheus requests only, but not for commands from the Stork server
+STORK_AGENT_LISTEN_PROMETHEUS_ONLY=true
+{% endif %}
+
+### settings for exporting stats to Prometheus
+### the IP or hostname on which the agent exports Kea statistics to Prometheus
+STORK_AGENT_PROMETHEUS_KEA_EXPORTER_ADDRESS=localhost
+### the port on which the agent exports Kea statistics to Prometheus
+# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_PORT=
+
+### Logging parameters
+
+### Set logging level. Supported values are: DEBUG, INFO, WARN, ERROR
+STORK_LOG_LEVEL=DEBUG
+
--- a/roles/transmission/files/update-transmission-settings
+++ b/roles/transmission/files/update-transmission-settings
@ -1,14 +0,0 @@
-#!/bin/sh
-
-#
-# Update the transmission settings.json. For the update, stop transmission,
-# put the new file in place, and restart it. This is necessary because
-# transmission is constantly rewriting the settings file while it is running.
-#
-
-set -e
-
-systemctl stop transmission-daemon
-cp /etc/transmission-daemon/settings-ansible.json /etc/transmission-daemon/settings.json
-chmod 0660 /etc/transmission-daemon/settings.json
-systemctl start transmission-daemon
--- a/roles/transmission/handlers/main.yaml
+++ b/roles/transmission/handlers/main.yaml
@ -1,5 +0,0 @@
- name: update transmission settings
-  ansible.builtin.command: /usr/local/sbin/update-transmission-settings
-  become: true
-  # When it runs, this should always report changed.
-  changed_when: true
--- a/roles/transmission/tasks/main.yaml
+++ b/roles/transmission/tasks/main.yaml
@ -1,23 +0,0 @@
- name: ensure transmission-daemon is installed
-  ansible.builtin.apt:
-    name: transmission-daemon
-    state: present
-  become: true
- name: ensure update-transmission-settings is deployed
-  ansible.builtin.copy:
-    src: "update-transmission-settings"
-    dest: "/usr/local/sbin/update-transmission-settings"
-    owner: root
-    group: root
-    mode: "0750"
-  become: true
-  notify: update transmission settings
- name: ensure transmission settings are deployed
-  ansible.builtin.copy:
-    content: '{{ transmission__settings | to_json(indent=4, sort_keys=True) }}'
-    dest: "/etc/transmission-daemon/settings-ansible.json"
-    owner: debian-transmission
-    group: debian-transmission
-    mode: "0750"
-  become: true
-  notify: update transmission settings
--- a/roles/unbound/README.md
+++ b/roles/unbound/README.md
@ -0,0 +1,20 @@
+# Unbound DNS resolver
+
+Role fora a validating, recursive, caching DNS resolver based on [Unbound](https://nlnetlabs.nl/projects/unbound/about/). 
+It is designed to be fast and lean and incorporates modern features based on open standards.
+
+- [Documentation](https://unbound.docs.nlnetlabs.nl/en/latest/)
+
+## Role Customization
+
+The following variables can be used to customize this role:
+
+| Variable                                 | Type            | Default         | Description                                                                                                                                                                               |
+|------------------------------------------|-----------------|-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| unbound_install_prometheus_exporter | Boolean         | `true`          | Whether [Unbound Exporter](https://github.com/letsencrypt/unbound_exporter) should also be installed to expose resolver statistics in prometheus format.                                  |
+| unbound_bind_interfaces             | List of Strings | `[0.0.0.0, ::]` | List of interface names or IP addresses on which unbound will listen for dns queries                                                                                                      |
+| unbound_enable_unbound_control      | Boolean         | `true`          | Whether the [remote control](https://unbound.docs.nlnetlabs.nl/en/latest/getting-started/configuration.html#set-up-remote-control) feature of unbound should be configured.               |
+| unbound_enable_dnssec               | Boolean         | `true`          | Whether dnssec validation should be enabled                                                                                                                                               |
+| unbound_access_control              | List of Strings | `[]`            | **Required** List of [unbound access control values](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#:~:text=access-control:%20%3CIP%20netblock%3E%20%3Caction%3E) |
+| unbound_disable_systemd_networkd    | Boolean         | `true`          | If true, systemd-networkd is disabled and the local system is pointed towards the configured dns resolver.                                                                                |
+| unbound_thread_count                | Integer         | Max vCPU Count | The number of threads unbound uses |
--- a/roles/unbound/defaults/main.yml
+++ b/roles/unbound/defaults/main.yml
@ -0,0 +1,7 @@
+unbound_install_prometheus_exporter: true
+unbound_bind_interfaces: [ "0.0.0.0", "::" ]
+unbound_disable_systemd_networkd: true
+unbound_enable_unbound_control: true
+unbound_enable_dnssec: true
+unbound_access_control: [ ]
+unbound_private_domain: [ ]
--- a/roles/unbound/files/no-resolved.resolv.conf
+++ b/roles/unbound/files/no-resolved.resolv.conf
@ -0,0 +1 @@
+nameserver 127.0.0.1
--- a/roles/unbound/files/prometheus-unbound-exporter.service
+++ b/roles/unbound/files/prometheus-unbound-exporter.service
@ -0,0 +1,12 @@
+[Unit]
+Description=Prometheus exporter for Unbound metrics, written in Go with pluggable metric collectors. The metrics exporter converts Unbound metric names to Prometheus metric names and labels by using a set of regular expressions.
+Documentation=https://github.com/letsencrypt/unbound_exporter
+After=network.target
+
+[Service]
+Type=simple
+EnvironmentFile=/etc/prometheus-unbound-exporter.conf
+ExecStart=/bin/unbound_exporter $UNBOUND_EXPORTER_ARGS
+
+[Install]
+WantedBy=multi-user.target
--- a/roles/unbound/handlers/main.yml
+++ b/roles/unbound/handlers/main.yml
@ -0,0 +1,18 @@
+- name: unbound.restarted
+  become: true
+  ansible.builtin.systemd:
+    name: unbound.service
+    state: restarted
+
+- name: unbound.reloaded
+  become: true
+  ansible.builtin.systemd:
+    name: unbound.service
+    state: reloaded
+
+- name: prometheus-unbound-exporter.restarted
+  become: true
+  ansible.builtin.systemd:
+    name: prometheus-unbound-exporter.service
+    state: restarted
+    enabled: true
--- a/roles/unbound/tasks/main.yml
+++ b/roles/unbound/tasks/main.yml
@ -0,0 +1,52 @@
+- name: unbound role main
+  block:
+
+    - name: install unbound dns resolver
+      become: true
+      ansible.builtin.package:
+        name: unbound
+
+    - name: install unbound-anchor
+      become: true
+      ansible.builtin.package:
+        name: unbound-anchor
+
+    - name: ensure correct directory permissions
+      become: true
+      ansible.builtin.file:
+        path: /etc/unbound
+        state: directory
+        mode: u=rwX,g=rX,o=rX
+        recurse: true
+        owner: unbound
+        group: unbound
+
+    - name: configure unbound dns resolver
+      become: true
+      notify: unbound.restarted
+      ansible.builtin.template:
+        src: unbound.conf.j2
+        dest: /etc/unbound/unbound.conf
+        owner: unbound
+        group: unbound
+        mode: u=rw,g=r,o=r
+
+    - name: disable systemd-resolved
+      when: unbound_disable_systemd_networkd
+      ansible.builtin.include_role:
+        name: deploy_systemd_resolved_config
+      vars:
+        deploy_systemd_resolved_config__enable: false
+        deploy_systemd_resolved_config__dns:
+          - 127.0.0.1
+
+    - name: ensure unbound is running and enabled
+      become: true
+      ansible.builtin.systemd:
+        name: unbound.service
+        state: started
+        enabled: true
+
+    - name: install and configure prometheus-exporter for unbound
+      ansible.builtin.import_tasks: prometheus-exporter.yml
+      when: unbound_install_prometheus_exporter
--- a/roles/unbound/tasks/prometheus-exporter.yml
+++ b/roles/unbound/tasks/prometheus-exporter.yml
@ -0,0 +1,63 @@
+---
+- name: install unbound prometheus exporter
+  become: true
+  vars:
+    prometheus_unbound_exporter_version: "0.6.0"
+    prometheus_unbound_exporter_filename: "unbound_exporter-v{{ prometheus_unbound_exporter_version }}.x86_64.deb"
+    prometheus_unbound_exporter_github_api_url: "https://api.github.com/repos/letsencrypt/unbound_exporter/releases/tags/v{{ prometheus_unbound_exporter_version }}"
+  block:
+    - name: request github api
+      ansible.builtin.uri:
+        url: "{{ prometheus_unbound_exporter_github_api_url }}"
+        method: GET
+        body_format: json
+        headers:
+          'Accept': 'application/vnd.github+json'
+      register: unbound_exporter_github_api_result
+
+    - name: get prometheus-unbound-exporter download url and digest
+      ansible.builtin.set_fact:
+        unbound_exporter_download_url: "{{ unbound_exporter_github_api_result.json.assets[0].browser_download_url }}"
+        unbound_exporter_download_digest: "{{ unbound_exporter_github_api_result.json.assets[0].digest }}"
+
+    - name: Download prometheus-unbound-exporter deb package with verified checksum
+      ansible.builtin.get_url:
+        url: "{{ unbound_exporter_download_url }}"
+        dest: "/tmp/{{ prometheus_unbound_exporter_filename }}"
+        checksum: "{{ unbound_exporter_download_digest }}"
+        mode: "u=r,g=r,o=r"
+
+    - name: Install prometheus-unbound-exporter deb package
+      become: true
+      ansible.builtin.apt:
+        deb: "/tmp/{{ prometheus_unbound_exporter_filename }}"
+        state: present
+      notify: prometheus-unbound-exporter.restarted
+
+- name: deploy prometheus-unbound-exporter systemd service
+  become: true
+  ansible.builtin.copy:
+    src: "prometheus-unbound-exporter.service"
+    dest: "/etc/systemd/system/prometheus-unbound-exporter.service"
+    owner: root
+    group: root
+    mode: '0644'
+  notify: systemd-daemon-reload
+
+- name: enable unbound prometheus exporter
+  become: true
+  ansible.builtin.systemd:
+    name: prometheus-unbound-exporter.service
+    enabled: true
+    daemon_reload: true
+
+- name: configure unbound exporter
+  become: true
+  ansible.builtin.copy:
+    dest: /etc/prometheus-unbound-exporter.conf
+    content: |
+      UNBOUND_EXPORTER_ARGS="-unbound.ca "" -unbound.cert "" -unbound.host "unix:///run/unbound.ctl"
+    owner: root
+    group: root
+    mode: '0644'
+  notify: prometheus-unbound-exporter.restarted
--- a/roles/unbound/templates/unbound.conf.j2
+++ b/roles/unbound/templates/unbound.conf.j2
@ -0,0 +1,69 @@
+# ref: https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html
+#      unbound.conf(5) man page
+server:
+  {% if unbound_enable_dnssec -%}
+  # location of the trust anchor file that enables DNSSEC
+  # this file is generated by the `unbound-anchor` command
+  trust-anchor-file: "/usr/share/dns/root.key"
+  {% endif -%}
+
+  # num of threads
+  num-threads: {{ unbound_thread_count | default(ansible_facts['processor_vcpus']) }}
+
+  # more cache memory
+  rrset-cache-size: 60m
+  msg-cache-size: 30m
+
+  # prefetch to keep the cache up to date
+  prefetch: yes
+
+  # fetch the DNSKEYs earlier in the validation process, when a DS record is encountered
+  prefetch-key: yes
+
+  # Faster UDP with multithreading (only on Linux).
+  so-reuseport: yes
+
+  # disable special large send buffer handling and just use kernel defaults
+  so-sndbuf: 0
+
+  # send minimal amount of information to upstream servers to enhance privacy
+  qname-minimisation: yes
+
+  # specify the interface to answer queries from by ip-address.
+  {% for i in unbound_bind_interfaces -%}
+  interface: "{{ i }}"
+  {% endfor %}
+
+  # addresses from the IP range that are allowed to connect to the resolver
+  {% for i in unbound_access_control -%}
+  access-control: {{ i }} allow
+  {% endfor -%}
+
+  {% for i in unbound_private_domain -%}
+  private-domain: {{ i }}
+  {% endfor -%}
+
+  # The number of seconds between printing statistics to the log for every thread.
+  statistics-interval: 0
+
+  # Extended statistics are printed, Keeping track of more statistics takes time.
+  extended-statistics: yes
+
+remote-control:
+  control-enable: {{ "yes" if unbound_enable_unbound_control else "no" }}
+  control-interface: "/run/unbound.ctl"   # debian appamour does not allow any other path!!!
+  control-use-cert: no
+
+
+# configure some zones for which this resolver will act authoritatively
+# https://www.dns.icann.org/services/axfr/
+{% for i in [ ".", "in-addr.arpa.", "arpa.", "root-servers.net.", "ip6.arpa.", "ip6-servers.arpa.", "mcast.net." ] %}
+auth-zone:
+  name: "{{ i }}"
+  primary: "lax.xfr.dns.icann.org"
+  primary: "iad.xfr.dns.icann.org"
+  fallback-enabled: yes
+  for-downstream: no
+  for-upstream: yes
+
+{% endfor %}
Author	SHA1	Message	Date
bitwhisker	724d537cd5	unbound(role): fix systemd unit of prometheus exporter All checks were successful / Ansible Lint (pull_request) Successful in 2m42s Details / Ansible Lint (push) Successful in 2m43s Details / build (pull_request) Successful in 33s Details	2026-06-22 21:09:43 +02:00
bitwhisker	a62d265db8	z9-router(host): fix systemd-networkd configs	2026-06-22 21:03:12 +02:00
bitwhisker	eb186c4152	unbound(role): fix unbound prometheus exporter install on debian Some checks failed / build (pull_request) Failing after 2m46s Details / Ansible Lint (push) Successful in 3m3s Details / Ansible Lint (pull_request) Successful in 3m8s Details - download debian image from github und verify checksum - setup systemd service unit	2026-06-21 20:13:29 +02:00
bitwhisker	aec4ea4090	unbound(role): fix unbound config template - fix some indentation problems - fix access control - fix remote control unix socket and thrust anchor file (because debain appamour ist annoying) - add unbound-anchor package	2026-06-21 20:07:59 +02:00
bitwhisker	dc29dd8b13	kea_dhcp(role): fix include wars check	2026-06-21 20:01:55 +02:00
bitwhisker	9d5215e6ec	z9(pve01): change thinkcccore0 to pve01 Some checks failed / Ansible Lint (pull_request) Successful in 2m34s Details / Ansible Lint (push) Successful in 2m37s Details / build (pull_request) Failing after 2m42s Details	2026-06-20 18:33:37 +02:00
bitwhisker	1fbc903125	z9(group): remove all old ip references and change them to new ones Some checks failed / Ansible Lint (push) Successful in 2m26s Details / Ansible Lint (pull_request) Successful in 2m28s Details / build (pull_request) Failing after 2m40s Details	2026-06-20 18:03:47 +02:00
bitwhisker	be71af3a2f	z9(group): remove all z9 references as subdomain	2026-06-20 18:01:20 +02:00
bitwhisker	5e857dd5e7	unbound(role): move resolvd vars to task	2026-06-20 17:59:54 +02:00
bitwhisker	a0d9fc2e77	unbound(role): make unbound thread number configurable	2026-06-20 17:59:54 +02:00
bitwhisker	fb397541e4	unbound(role): reformat config template and use all vcpus	2026-06-20 17:59:54 +02:00
bitwhisker	cfb06cdc9f	unbound(role): remove tags inside role	2026-06-20 17:59:54 +02:00
bitwhisker	a602ed9f9e	unbound(role): add FIXME note to unbound prometheus exporter install	2026-06-20 17:59:53 +02:00
bitwhisker	e649933337	unbound(role): use existing deploy_systemd_resolved_config role and some reordering	2026-06-20 17:59:53 +02:00
bitwhisker	4c802c8081	kea_dhcp(role): make stork-agent.env smaller and add link to documentation	2026-06-20 17:59:53 +02:00
bitwhisker	95aa6e37f1	kea_dhcp(role): fix indentation in template	2026-06-20 17:59:53 +02:00
bitwhisker	117b11b773	kea_dhcp(role): add README.md	2026-06-20 17:59:53 +02:00
bitwhisker	151b6c5bf7	kea_dhcp(role): some fixes and removing arch part - remove tags from tasks - remove archlinux part - use debian default package for kea	2026-06-20 17:59:53 +02:00
bitwhisker	20e8423e60	z9-router(host): fix some spelling and a wireguard peer address	2026-06-20 17:59:53 +02:00
bitwhisker	4626d04fb6	z9-router(host): add ansible pull	2026-06-20 17:59:52 +02:00
bitwhisker	ffe6d5c07a	z9-router(host): rename rt1 to z9-router	2026-06-20 17:59:52 +02:00
bitwhisker	0986e45735	rt1(z9 host) unbound(role) kea_dhcp(role): create unbound and kea_dhcp role for rt1 - create unbound role - create kea_dhcp role - configure unbound and keadhcp on rt1(z9 host)	2026-06-20 17:59:52 +02:00
bitwhisker	8b829781de	rt1(z9 host): create host and configure networkd and nftables	2026-06-20 17:59:52 +02:00
				`@ -1 +0,0 @@`
				`forgejo_runner__config: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/forgejo-runner-external/forgejo-runner/configuration.yaml.j2') }}"`