From 5ff5149628fc45805d144b393495fdd689c4d267 Mon Sep 17 00:00:00 2001
From: jz8132543 <i@dora.im>
Date: Sun, 25 Feb 2024 14:30:34 +0800
Subject: [PATCH] test

---
 home-manager/modules/tippy/ssh.nix         |   2 +
 nixos/hosts/arx8/default.nix               |   1 +
 nixos/hosts/isk/default.nix                |   4 +-
 nixos/hosts/isk/hardware-configuration.nix |   6 +-
 nixos/modules/base/dns-client.nix          |  73 +++++++++
 nixos/modules/base/network.nix             |   6 +-
 nixos/modules/desktop/apps.nix             |   2 +-
 nixos/modules/desktop/clash.nix            | 127 ++++++++++++++++
 nixos/modules/services/ddns.nix            |  50 +++---
 nixos/modules/services/derp.nix            |  11 +-
 nixos/modules/users/tippy/default.nix      |   2 +-
 pkgs/_sources/generated.json               |  21 ++-
 pkgs/_sources/generated.nix                |  15 +-
 pkgs/clash-webui-yacd-meta/default.nix     |  26 ++++
 pkgs/nvfetcher.toml                        |   4 +
 secrets/common.yaml                        | 167 +++++++++++----------
 secrets/terraform.tfstate                  | 154 ++++++++++++-------
 terraform/cloudflare.tf                    |  10 +-
 18 files changed, 503 insertions(+), 178 deletions(-)
 create mode 100644 nixos/modules/base/dns-client.nix
 create mode 100644 nixos/modules/desktop/clash.nix
 create mode 100644 pkgs/clash-webui-yacd-meta/default.nix

diff --git a/home-manager/modules/tippy/ssh.nix b/home-manager/modules/tippy/ssh.nix
index c8ca81f9..c666abe8 100644
--- a/home-manager/modules/tippy/ssh.nix
+++ b/home-manager/modules/tippy/ssh.nix
@@ -16,6 +16,8 @@
         "CanonicalizeHostname" = "yes";
         "CanonicalDomains" = "dora.im ts.dora.im users.dora.im";
         "CanonicalizeMaxDots" = "0";
+        # fix kde connection for android
+        "HostKeyAlgorithms " = "+ssh-rsa";
       };
       matchBlocks = {
         "github.com" = {
diff --git a/nixos/hosts/arx8/default.nix b/nixos/hosts/arx8/default.nix
index 1e9c1707..8e713047 100644
--- a/nixos/hosts/arx8/default.nix
+++ b/nixos/hosts/arx8/default.nix
@@ -16,6 +16,7 @@
     refind
     efibootmgr
   ];
+  services.dnscrypt-proxy2.enable = true;
   services.create_ap = {
     enable = true;
     settings = {
diff --git a/nixos/hosts/isk/default.nix b/nixos/hosts/isk/default.nix
index 87be0b7d..3d257a05 100644
--- a/nixos/hosts/isk/default.nix
+++ b/nixos/hosts/isk/default.nix
@@ -15,7 +15,9 @@
       nixosModules.services.derp
       (import nixosModules.services.matrix {PG = "127.0.0.1";})
     ];
-  environment.isNAT = true;
+  # environment.isNAT = true;
   environment.isCN = true;
   networking.firewall.enable = lib.mkForce false;
+
+  ports.derp-stun = lib.mkForce 3440;
 }
diff --git a/nixos/hosts/isk/hardware-configuration.nix b/nixos/hosts/isk/hardware-configuration.nix
index da6ec2b1..eaa795ca 100644
--- a/nixos/hosts/isk/hardware-configuration.nix
+++ b/nixos/hosts/isk/hardware-configuration.nix
@@ -6,14 +6,10 @@
   imports = [
     (modulesPath + "/profiles/qemu-guest.nix")
   ];
-  boot.initrd.availableKernelModules = ["uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
+  boot.initrd.availableKernelModules = ["uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" "e1000" "e1000e"];
   boot.kernelModules = ["kvm-intel"];
   utils.disk = "/dev/sda";
   networking = {
-    nat = {
-      enable = true;
-      # dmzHost = "192.168.1.111";
-    };
     interfaces.enp6s18 = {
       useDHCP = true;
       ipv4.addresses = [
diff --git a/nixos/modules/base/dns-client.nix b/nixos/modules/base/dns-client.nix
new file mode 100644
index 00000000..c850eea2
--- /dev/null
+++ b/nixos/modules/base/dns-client.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.services.dnscrypt-proxy2;
+in {
+  networking =
+    if cfg.enable
+    then {
+      nameservers = ["127.0.0.2" "127.0.0.55"];
+      # resolvconf.enable = lib.mkForce false;
+      dhcpcd.extraConfig = "nohook resolv.conf";
+      networkmanager.dns = lib.mkForce "none";
+      # resolvconf.useLocalResolver = true;
+    }
+    else {};
+  services = {
+    resolved =
+      if cfg.enable
+      then {
+        enable = true;
+        dnssec = "allow-downgrade";
+        extraConfig = ''
+          MulticastDNS=true
+          DNSStubListener=no
+        '';
+        fallbackDns =
+          if config.services.tailscale.enable
+          then ["100.100.100.100"]
+          else [];
+      }
+      else {};
+    dnscrypt-proxy2 = {
+      enable = lib.mkDefault false;
+      settings = {
+        listen_addresses = ["127.0.0.55:53"];
+        ipv4_servers = true;
+        ipv6_servers = true;
+        require_dnssec = true;
+        doh_servers = true;
+        odoh_servers = true;
+        require_nolog = true;
+        bootstrap_resolvers = ["1.0.0.1:53" "1.1.1.1:53" "9.9.9.9:53"];
+        cache = true;
+
+        sources.public-resolvers = {
+          urls = [
+            "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
+            "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md"
+          ];
+          cache_file = "/var/lib/dnscrypt-proxy/public-resolvers.md";
+          minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
+        };
+
+        # You can choose a specific set of servers from https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v3/public-resolvers.md
+        server_names = [
+          "cloudflare"
+          "google"
+          "quad9-doh-ip4-port443-filter-pri"
+          "quad9-doh-ip4-port5053-filter-pri"
+          "quad9-doh-ip6-port443-filter-pri"
+          "quad9-doh-ip6-port5053-filter-pri"
+          #"cloudflare-security-ipv6"
+          #"doh-crypto-sx"
+        ];
+      };
+    };
+  };
+  # systemd.services.dnscrypt-proxy2.serviceConfig = {
+  #   StateDirectory = "dnscrypt-proxy";
+  # };
+}
diff --git a/nixos/modules/base/network.nix b/nixos/modules/base/network.nix
index 3cc44c40..8f0a8dc0 100644
--- a/nixos/modules/base/network.nix
+++ b/nixos/modules/base/network.nix
@@ -1,11 +1,11 @@
-{...}: {
+{lib, ...}: {
   networking = {
-    nameservers = ["1.1.1.1" "1.0.0.1"];
+    nameservers = lib.mkDefault ["1.1.1.1" "1.0.0.1"];
     domain = "dora.im";
     search = ["dora.im"];
     firewall.enable = true;
     dhcpcd.extraConfig = "nohook resolv.conf";
-    networkmanager.dns = "none";
+    networkmanager.dns = lib.mkDefault "none";
   };
 
   boot = {
diff --git a/nixos/modules/desktop/apps.nix b/nixos/modules/desktop/apps.nix
index 13254587..2ab7b707 100644
--- a/nixos/modules/desktop/apps.nix
+++ b/nixos/modules/desktop/apps.nix
@@ -6,7 +6,7 @@
   programs = {
     clash-verge = {
       enable = true;
-      autoStart = true;
+      # autoStart = true;
       tunMode = true;
     };
   };
diff --git a/nixos/modules/desktop/clash.nix b/nixos/modules/desktop/clash.nix
new file mode 100644
index 00000000..a211b968
--- /dev/null
+++ b/nixos/modules/desktop/clash.nix
@@ -0,0 +1,127 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  enable = true;
+  configFile = "/var/lib/sing-box/config.json";
+  updateTimeoutMin = "720";
+  subscriptionEnv = config.sops.secrets.sing-box.path;
+
+  uiPackage = pkgs.clash-webui-yacd-meta;
+in {
+  sops.secrets.sing-box = {};
+
+  systemd.services.sing-box = optionalAttrs enable (
+    let
+      caps = ["CAP_NET_ADMIN" "CAP_NET_BIND_SERVICE"];
+    in {
+      description = "Sing-box networking service";
+      wantedBy = ["multi-user.target"];
+      requires = ["network-online.target"];
+      after = ["network-online.target"];
+      path = with pkgs; [curl sing-box];
+
+      environment = {
+        SB_WORK_DIR = "/var/lib/sing-box";
+        SB_CONF_FILE = configFile;
+      };
+
+      serviceConfig = {
+        Type = "simple";
+        # User = "sing-box";
+        # Group = "sing-box";
+        StateDirectory = "sing-box";
+        EnvironmentFile = [subscriptionEnv];
+        ExecStart = "${pkgs.sing-box}/bin/sing-box run -D $SB_WORK_DIR -c $SB_CONF_FILE";
+
+        # Sing-box Auto Update
+        Restart = "always";
+        # RuntimeMaxSec = "${updateTimeoutMin}min";
+
+        # OOM Killer
+        OOMPolicy = "kill";
+        MemoryMax = "200M";
+
+        # DynamicUser = "yes";
+        # Capabilities
+        CapabilityBoundingSet = caps;
+        AmbientCapabilities = caps;
+        # Proc filesystem
+        ProcSubset = "pid";
+        ProtectProc = "invisible";
+        # Security
+        NoNewPrivileges = true;
+        # Sandboxing
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        # PrivateDevices = true;        # NOT WORK on Tun Mode
+        PrivateMounts = true;
+        PrivateTmp = true;
+        # PrivateUsers = true;          # NOT WORK on Tun Mode
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_NETLINK"];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        # System Call Filtering
+        SystemCallArchitectures = "native";
+        SystemCallFilter = ["~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" "setrlimit"];
+      };
+
+      preStop = ''
+        if [[ -f $SB_CONF_FILE ]] && test `find $SB_CONF_FILE -mmin -2`; then
+          :
+        else
+          curl --connect-timeout 5 --retry 3 --retry-delay 1 \
+            -L $SB_SUBSCRIPTION_URI \
+            -o $SB_CONF_FILE || true
+        fi
+      '';
+
+      preStart = ''
+        [[ -d $SB_WORK_DIR ]] || mkdir -p $SB_WORK_DIR
+
+        if [[ -f $SB_CONF_FILE ]] && test `find $SB_CONF_FILE -mmin -3`; then
+          :
+        elif [[ -f $SB_CONF_FILE ]] && test `find $SB_CONF_FILE -mmin -${updateTimeoutMin}`; then
+          curl --connect-timeout 5 \
+            -L $SB_SUBSCRIPTION_URI \
+            -o $SB_CONF_FILE || true
+        else
+          curl --connect-timeout 5 --retry 3 --retry-delay 1 \
+            -L $SB_SUBSCRIPTION_URI \
+            -o $SB_CONF_FILE || true
+        fi
+
+        [[ -f $SB_CONF_FILE ]] && chmod 0600 $SB_CONF_FILE || exit 1
+      '';
+    }
+  );
+
+  services.lighttpd = {
+    inherit enable;
+    port = 80;
+    document-root = "${uiPackage}/share/clash/ui";
+    extraConfig = ''server.bind = "127.0.0.88"'';
+  };
+
+  networking.hosts = {
+    "127.0.0.88" = ["yacd.local"]; # Yacd Dashboard
+    "127.0.0.64" = ["singbox.local"]; # Sing-box
+  };
+
+  environment.global-persistence.directories = [
+    "/etc/sing-box"
+  ];
+}
diff --git a/nixos/modules/services/ddns.nix b/nixos/modules/services/ddns.nix
index e7286eff..783e5e3d 100644
--- a/nixos/modules/services/ddns.nix
+++ b/nixos/modules/services/ddns.nix
@@ -1,17 +1,33 @@
-{config, ...}: {
-  sops.secrets = {
-    "traefik/cloudflare_token" = {};
-  };
-  services.ddclient = {
-    enable = true;
-    interval = "5min";
-    username = "token";
-    passwordFile = config.sops.secrets."traefik/cloudflare_token".path;
-    protocol = "cloudflare";
-    zone = config.networking.domain;
-    domains = [config.networking.fqdn];
-    ssl = true;
-    use = "web,web=ifconfig.me/ip";
-    verbose = true;
-  };
-}
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (config.networking) enableIPv6;
+in
+  with lib; {
+    sops.secrets = {
+      "traefik/cloudflare_token" = {};
+    };
+    services.ddclient = {
+      enable = true;
+      interval = "5min";
+      username = "token";
+      passwordFile = config.sops.secrets."traefik/cloudflare_token".path;
+      protocol = "cloudflare";
+      zone = config.networking.domain;
+      domains = [config.networking.fqdn];
+      ssl = true;
+      # use = "web,web=ifconfig.me/ip";
+      extraConfig = mkMerge [
+        (mkIf enableIPv6 ''
+          usev6=webv6, webv6=https://ipv6.nsupdate.info/myip
+        '')
+        ''
+          usev4=webv4, webv4=https://ipv4.nsupdate.info/myip
+          max-interval=1d
+        ''
+      ];
+      verbose = true;
+    };
+  }
diff --git a/nixos/modules/services/derp.nix b/nixos/modules/services/derp.nix
index cf320eaa..215f9cf8 100644
--- a/nixos/modules/services/derp.nix
+++ b/nixos/modules/services/derp.nix
@@ -10,7 +10,7 @@
       Restart = "always";
       DynamicUser = true;
       ExecStart =
-        if !config.environment.isCN
+        if !config.environment.isNAT
         then "${pkgs.tailscale-derp}/bin/derper -a ':${toString config.ports.derp}' -stun-port ${toString config.ports.derp-stun} --hostname='${config.networking.fqdn}' -c /tmp/derper.conf -verify-clients"
         else "${pkgs.tailscale-derp}/bin/derper -a ':${toString config.ports.derp}' -stun-port ${toString config.ports.derp-stun} -http-port='-1' --hostname='${config.networking.fqdn}' -c /tmp/derper.conf -certdir '$CREDENTIALS_DIRECTORY' -certmode manual -verify-clients";
       LoadCredential = [
@@ -35,7 +35,10 @@
     services = {
       derp.loadBalancer = {
         passHostHeader = true;
-        servers = [{url = "http://localhost:${toString config.ports.derp}";}];
+        servers =
+          if !config.environment.isNAT
+          then [{url = "http://localhost:${toString config.ports.derp}";}]
+          else [{url = "https://localhost:${toString config.ports.derp}";}];
       };
     };
   };
@@ -56,6 +59,6 @@
   #   after = ["derper.service"];
   #   requiredBy = ["derper.service"];
   # };
-  networking.firewall.allowedTCPPorts = [3478];
-  networking.firewall.allowedUDPPorts = [3478];
+  networking.firewall.allowedTCPPorts = [config.ports.derp-stun];
+  networking.firewall.allowedUDPPorts = [config.ports.derp-stun];
 }
diff --git a/nixos/modules/users/tippy/default.nix b/nixos/modules/users/tippy/default.nix
index c6d79d64..4a011289 100644
--- a/nixos/modules/users/tippy/default.nix
+++ b/nixos/modules/users/tippy/default.nix
@@ -10,7 +10,7 @@ in {
   users.users.${name} = {
     isNormalUser = true;
     shell = pkgs.zsh;
-    extraGroups = ["wheel" "cdrom" "libvirtd" "acme"];
+    extraGroups = ["wheel" "cdrom" "libvirtd" "acme" "systemd-resolve"];
     openssh.authorizedKeys.keys = [config.lib.self.data.ssh.i];
     hashedPassword = "$6$0gRnTBQjBv9ipXZz$AEBVrBbWXgzZ0IICD1HVWeCwqELFe85.ePsOOdkvFM1E6/sKvQUUesvXhQN519Ud33RsqA3h5z.4luO8Jk4Ls/";
   };
diff --git a/pkgs/_sources/generated.json b/pkgs/_sources/generated.json
index 4473c25f..3cdb0cb7 100644
--- a/pkgs/_sources/generated.json
+++ b/pkgs/_sources/generated.json
@@ -28,11 +28,26 @@
     "pinned": false,
     "src": {
       "name": null,
-      "sha256": "sha256-Nj0xWRtR9uQjPlRaZjEq9hBjL+o/RY3sAMMo/QTguPU=",
+      "sha256": "sha256-7J4mZcryqkErAfSRZMWjaK+wALa9Xe1w9RsUy9xOmsU=",
       "type": "url",
-      "url": "https://github.com/alist-org/alist/releases/download/v3.30.0/alist-linux-musl-amd64.tar.gz"
+      "url": "https://github.com/alist-org/alist/releases/download/v3.31.0/alist-linux-musl-amd64.tar.gz"
     },
-    "version": "v3.30.0"
+    "version": "v3.31.0"
+  },
+  "clash-webui-yacd-meta": {
+    "cargoLocks": null,
+    "date": "2023-12-29",
+    "extract": null,
+    "name": "clash-webui-yacd-meta",
+    "passthru": null,
+    "pinned": false,
+    "src": {
+      "name": null,
+      "sha256": "sha256-S6gLic5TeCkYDQsKmasr4/H5+ca8hP5qTzpVDXZHzdY=",
+      "type": "url",
+      "url": "https://github.com/MetaCubeX/Yacd-meta/archive/b66b1d0393bd284b7a40329f95eae3746bb102be.zip"
+    },
+    "version": "b66b1d0393bd284b7a40329f95eae3746bb102be"
   },
   "kitty-catppuccin": {
     "cargoLocks": null,
diff --git a/pkgs/_sources/generated.nix b/pkgs/_sources/generated.nix
index c29c19b5..e52e6976 100644
--- a/pkgs/_sources/generated.nix
+++ b/pkgs/_sources/generated.nix
@@ -19,12 +19,21 @@
   };
   alist = {
     pname = "alist";
-    version = "v3.30.0";
+    version = "v3.31.0";
     src = fetchurl {
-      url = "https://github.com/alist-org/alist/releases/download/v3.30.0/alist-linux-musl-amd64.tar.gz";
-      sha256 = "sha256-Nj0xWRtR9uQjPlRaZjEq9hBjL+o/RY3sAMMo/QTguPU=";
+      url = "https://github.com/alist-org/alist/releases/download/v3.31.0/alist-linux-musl-amd64.tar.gz";
+      sha256 = "sha256-7J4mZcryqkErAfSRZMWjaK+wALa9Xe1w9RsUy9xOmsU=";
     };
   };
+  clash-webui-yacd-meta = {
+    pname = "clash-webui-yacd-meta";
+    version = "b66b1d0393bd284b7a40329f95eae3746bb102be";
+    src = fetchurl {
+      url = "https://github.com/MetaCubeX/Yacd-meta/archive/b66b1d0393bd284b7a40329f95eae3746bb102be.zip";
+      sha256 = "sha256-S6gLic5TeCkYDQsKmasr4/H5+ca8hP5qTzpVDXZHzdY=";
+    };
+    date = "2023-12-29";
+  };
   kitty-catppuccin = {
     pname = "kitty-catppuccin";
     version = "d7d61716a83cd135344cbb353af9d197c5d7cec1";
diff --git a/pkgs/clash-webui-yacd-meta/default.nix b/pkgs/clash-webui-yacd-meta/default.nix
new file mode 100644
index 00000000..1b171c43
--- /dev/null
+++ b/pkgs/clash-webui-yacd-meta/default.nix
@@ -0,0 +1,26 @@
+{
+  source,
+  lib,
+  unzip,
+  stdenv,
+}:
+stdenv.mkDerivation rec {
+  inherit (source) pname version src;
+
+  nativeBuildInputs = [unzip];
+  unpackPhase = ''
+    unzip $src
+  '';
+  sourceRoot = "Yacd-meta-${version}";
+
+  installPhase = ''
+    mkdir -p $out/share/clash/ui
+    cp -r * $out/share/clash/ui
+  '';
+
+  meta = with lib; {
+    description = "Yet Another Clash Dashboard for Clash Meta";
+    homepage = "https://github.com/MetaCubeX/Yacd-meta";
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/nvfetcher.toml b/pkgs/nvfetcher.toml
index e6cf614c..be87101a 100644
--- a/pkgs/nvfetcher.toml
+++ b/pkgs/nvfetcher.toml
@@ -10,3 +10,7 @@ src.git = "https://github.com/catppuccin/alacritty"
 [alist]
 src.github = "alist-org/alist"
 fetch.url = "https://github.com/alist-org/alist/releases/download/$ver/alist-linux-musl-amd64.tar.gz"
+[clash-webui-yacd-meta]
+src.git = "https://github.com/MetaCubeX/Yacd-meta"
+src.branch = "gh-pages"
+fetch.url = "https://github.com/MetaCubeX/Yacd-meta/archive/$ver.zip"
diff --git a/secrets/common.yaml b/secrets/common.yaml
index c0288a75..2b9bf251 100644
--- a/secrets/common.yaml
+++ b/secrets/common.yaml
@@ -1,63 +1,64 @@
 traefik:
-    KID: ENC[AES256_GCM,data:lun9FBDabi9hBaiI+R3gcFkNJyzvlA==,iv:KtAAt3hDUgMrdmiNlpq4+/tsFg/9MtRve6ZjL5oNcgc=,tag:FaH3SJQ2e9BZEJvNhEMOgQ==,type:str]
-    HMAC: ENC[AES256_GCM,data:Iq5+V7jTIUg7+m5XicS08gJMb95FStt1ifrlNP8tsu+2LS4oKgcv4sJ4DkGGNmXQpYGVCO+SOG4yY6vUQt+mPH36o9kHmuFuM8tmyk91hfMYOXzoRUA=,iv:ZUfW5oOevS8e/nf6vq3Wjzrj5+Utb1RylJRBQkw77Pk=,tag:JotKZ+M3bZse9dxEfyWKnQ==,type:str]
-    hmacEncoded: ENC[AES256_GCM,data:xoj55rq67DEmA+BaBjNJSODl3hLC2lBssCil+1XWcQjf7svyi+uF7f1LftbKwFkLGdO5OkEfs5eY1OzSBeZTSFcAo2BHROZqENDfxDxRM/JR2cQKf4mlsK9meFWN0sZ8QDWjd3inNAuixjxJMRxkm1Tk49c=,iv:HzxPpOQGrA6l0kPMa+bPmkLB9tbOnpeI+T+Dw+PTk1Q=,tag:YERVkAE/zCKsjsU/fsqv8Q==,type:str]
-    cloudflare_token: ENC[AES256_GCM,data:hm/Dbxf03EHbTAWHtuJDkVHchyAIJu046f0KIBi4qexqDbTdnBdZZg==,iv:UQzEsDH5T7yW08TGiWsKviAmzLXN2abq6NY+5FmMfQA=,tag:savEjd4/7fZt0uIf5mW1SA==,type:str]
-    TRAEFIK_AUTH: ENC[AES256_GCM,data:CHCf7wL84j1c3GL0KSsk7iVOun/G6kt2wzjcYVBJv1lxu5PKWpp0cTOzSnlCw6Q75oNm1HpJW5smI1dueRjiwcTb,iv:mBrysMjUy+lXD71l9TbmQEvEWXSsghkOii3EIMOefbw=,tag:hlLpZcTeVGj0sI2ge3TQqA==,type:str]
+    KID: ENC[AES256_GCM,data:oI+ilb7lQVWxxX59znJYo5dpS+g7cQ==,iv:DA2HZazMFO/oiou0H/1udH/F0lS5qJOPKh3W71dtB5I=,tag:CPLGheeMOigCCkdP1Jovuw==,type:str]
+    HMAC: ENC[AES256_GCM,data:4dtMrYshgv3Tl4VwPd6TrgJaRg6YyEFUlnIO1TIk2jBvceR2Ki6Z76sVxXX5BTn8StwBfA2XkIO+McgXYJAxf6JxKrvOBKHnPO5GIK/MPrLKLQcEVwE=,iv:FGWDRRA4j15V7IAHEOWb1GZGbbtWxaerO53yags+RYw=,tag:tvKlrnA9CDCl8hg0N4SoyQ==,type:str]
+    hmacEncoded: ENC[AES256_GCM,data:g+otMEThZtZdi//BtU/Azg1tPZgrMxQKqoch1j4912nv1NWN2WvBZYNDMBpYZD/Q4N/2Z9myhsWYrP7Y+XmcJaoYMN8FgA75gGb6uNmqn8UOFnEOmYGH9HafIxZJ4L//EAmQMZUN2CeZHxguDewpKjkj+gM=,iv:5zrBu+kfAzF29jvrYqcco1ccAldV62LKFlLWmOJyBaQ=,tag:yD8LUElyNRGMbksslZuGmw==,type:str]
+    cloudflare_token: ENC[AES256_GCM,data:iRmyDG+inzyIF0Ca6jyCPic0uJeluqBpnzED1iVll12CU6tr/Qcawg==,iv:fvN8u49RmQH4MeRucM9yDPc8D2+U6rJJAkXlnYzPqh8=,tag:TyNQQ6Nq+qtR1cGXa0n+YQ==,type:str]
+    TRAEFIK_AUTH: ENC[AES256_GCM,data:ZHHzlBEgWLCADvSgFELBN5jqffHNFQpmf51JM7yMmX7B01I1ds/Z2L8A03lTts5a9LUMUtAO8WLqcvWv+FiPToty,iv:xo59CTPD5Fx7lSltw+a/32GLygm0oOOBIIT4rSqEddY=,tag:+djMxhxC/SYvftCwNgtzBQ==,type:str]
 proxy:
-    uuid: ENC[AES256_GCM,data:CLAqzq1NrfLq2xcNYIoMGnFNQa0BO9LuywMKTiqbesBLKWSe,iv:AI+YowbQd94IVGna/g80S4Tg+FLhZvfMseKt69hAHH0=,tag:blrlSeLw0IMauGxvTDCrhw==,type:str]
-    passwd: ENC[AES256_GCM,data:SFF5P/y8u0fx5+CHq3nbSLsdRcwK5Veb9BcQ4QAGvEYrfb+Z,iv:29TA64/dlxCuR92G3DuY2MNDuDzhwbsBnC+0ilJcR54=,tag:Zj6mSiRlyfTQbCQxzmrbeg==,type:str]
+    uuid: ENC[AES256_GCM,data:1Uwyjduckly51RGKTdseLyLOSmcmg2maDhQJ0Rr6F6qB0IPy,iv:SsCuYXU5jlA9oYIMJpUtjJ/JONjF55SKzW+QZueKtoU=,tag:Z5qhwHwYX8zFgGGO0hhUfg==,type:str]
+    passwd: ENC[AES256_GCM,data:CzYHMo5/qJn03S+TBMY7ih0bYhxy91fCwiXfZKWXGOsDG54E,iv:KkEDiJKOmU01TsqevzkPX/JoxzaWIwdiE1T+HxyszHY=,tag:u26gzDkdBVpSWgxUciaADA==,type:str]
 vaultwarden:
-    ADMIN_TOKEN: ENC[AES256_GCM,data:X//e/Ur3KWHbIXZbYW1FAV3lKNaOuOrNhwFfxaPzzF8DRcxkVA6o7Wj+K5jnqu+Zk7/3/SFgmMWk+7ETuWqAhZzoYNdXHJ9LsJ3XD3tahj2P85WnQ9iQ5c1J5Ym7E7fon5B8xO6K7qF8wrqPtHE7gH6ZIqLT9YIbTUVaeN+vcAGP6G3SNaY=,iv:MnDvOz2cX07c9EV6Z/8hXyPZQjj4628UV6LNVYUesLY=,tag:MUNOK8w6pgA4SJsyUlicLQ==,type:str]
-    mail: ENC[AES256_GCM,data:rcUnKCWoxg7uvzxFU/42MV6/xVxaMha24/HEicuhMWY5Z5s5oCUI8zuTeiOOs34i,iv:5Dj1opvbPolcEpe1B2HVo2N0Ja0TuzdBzzwVIl9ECdA=,tag:7YdNdzxHAiuXAZzxKcPbyg==,type:str]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:Q9XeOFC1xuxT9l1CC9Nh16Wt1cMEeAp7GO7bBznyyR1Oe1kDxGsTQRo67xv/TjViRdl1UASZbXF4URbzNoLu7Hhuq8VCgCRhLqGiLq3DZCZBISJ0Dq7PYclAVqtocm3O6zaSEVDrfImZ6C//w2CbA/YCN4htHA4hp85wqoa3eZn+rfuXWP8=,iv:HT0ChvD6qY9VvL0KMDsPSJODbycKXrrmdjiNTuZ8wbk=,tag:3jSYVIlmac8wl7zfk1oZsw==,type:str]
+    mail: ENC[AES256_GCM,data:ZqQ5+OKqXxtlrF0zGN62WCj37xaMVXvXrEHV6XzY98Q4sEog37xt+KrZ8vnj11Tw,iv:hKxepOlIXfrxPXoInfDCr8lU6B7ZVjqGr/xYl4BbfOE=,tag:VhJhG0LnrqEUi3HuiwoOAg==,type:str]
 matrix:
-    signing-key: ENC[AES256_GCM,data:gh2lg9cv0bIZI35lSmZQq5nkz+vCKB3TovsS5+XPa89JX4tzGghrnj8PrUicmdpnx1MtyE6t7T2k+Q==,iv:R6bBVczmXyee4hpFe+/nlaz/zNuaysCXFkn7y16il2c=,tag:1CchVaF1bWw67WLgCVVRxg==,type:str]
-    mail: ENC[AES256_GCM,data:hPETu3JKt/bgDEvfNv0a1MkgbH3knmMFI20USR/LRZu5DDoiedP1//mDANGG+jh9,iv:LqJynX6AxkCNjl26+TZ4Bxe5jwLIbBKyt+qqGM7f/b0=,tag:lP5nJI1PbABDlfth2V8tFg==,type:str]
-    oidc-secret: ENC[AES256_GCM,data:3zDlGBDnamw9dqQX2d6XFGO7SFXpjlr+IMdR1xjGRwU=,iv:Bl1D+z8lQ/cLlN8+ZE9hFhwdtWN2XFdAaHMsPw2rkWM=,tag:53j+UE7AZZ1GKxAZNMIG1g==,type:str]
-    registration_shared_secret: ENC[AES256_GCM,data:9UA1w/zNOYFrf2krzIeB1VF2AFHUtnQJ1ACIeZyRezg=,iv:1dOQ1ir8iY5EWaR/6GXr9dijh+rD0UTuH5XIJwtUOrk=,tag:Fnsr2140DFW8eqsFzPWHBw==,type:str]
-    turn_shared_secret: ENC[AES256_GCM,data:iWpxpeHoN1QyORfs04cpVN0TCtAeSSIOcC+7iKDvJPk3VicpbdnXJb8gzxxAOlBl9rMM3U+qraYgNJOvKPjm6w==,iv:LjOSo7wStCQCv9zCydtr5Dsdpi1tZZlUB4OqEoEf0yQ=,tag:ScaIxmVmcAc9kglKZjuX+w==,type:str]
+    signing-key: ENC[AES256_GCM,data:SYl4S65ov2xoErlhiFj0igA+XubprOth9Wu87rV8VfCBeQmxXC1u/jbDCgxlBlMQT9X9LUJqaLoWPQ==,iv:s3TIpYPOKHAJ4SYWvbFO4fFDbW0p7RbZQID8dkEReXU=,tag:df0/6ZE/yovaE8Bq00J+4Q==,type:str]
+    mail: ENC[AES256_GCM,data:AJkZgis7wp12u1LfxQ4TVU8GRVqehZI52B6UTyRgy5sUZm0Mi8VhuZ+rzDw0jp08,iv:Su6uCd/bG2XMEe+L0B3mZ5UqzQDmYJ+S0rynzaK8tg8=,tag:owm1A41cqfR7RFpSkg/0KA==,type:str]
+    oidc-secret: ENC[AES256_GCM,data:TedBVD6I8TOTt+ZUuQ3SI/6ufRWAETheN8N9KcnzcGM=,iv:mtKTeoM3AO5U1XxGabeCD2UCgpPZOsGC/EN2lzhOpBw=,tag:K8sodyDlVCZyMnhDdwT0xw==,type:str]
+    registration_shared_secret: ENC[AES256_GCM,data:vqfHQ+L/n9of6FNkD7FP8sJwfdRujDC8/7ykq33j/oo=,iv:BoMz4ci2BuJe+ohLVvVRXxefaktQw8IkwglXMiMRFJY=,tag:2gHUjQq2JsoiOXFGWK+IKw==,type:str]
+    turn_shared_secret: ENC[AES256_GCM,data:NQnWXPazmG58uvyA+WDGbgZtBfNlw+XVt14P+ka1HrAwVe1uqNzzKjn0kYHCfTy3Tk9NnZIDm+I3C3XxNkdMyQ==,iv:JOA0S0edomTQ09KkH0ILzqGLKHLpLuzSWC4Q3RnuCN8=,tag:ax5lnV4rg54EUzJYC6JWYA==,type:str]
 b2:
-    keyID: ENC[AES256_GCM,data:rWcGNVoMh1hQTohzFqYiJqfFhjyRljt+8g==,iv:9yhk7u6GuOuVyoK6gLCJRtoZli/RaEWmi20nGqIiPgU=,tag:q9p/LR2D+wqtiynqHxy7AA==,type:str]
-    applicationKey: ENC[AES256_GCM,data:uJNcPHsw6PBC/+5yG5JMBETkb7/7rtSqIXJpmYc1pQ==,iv:E9PMZVrp/OP41MWLhmHcgObWasTByR7oh0W1V8OEbEU=,tag:S0DKAAfoWHO2gn7ky696jQ==,type:str]
+    keyID: ENC[AES256_GCM,data:Cr7JypbYOlXl/tlJrfxeVp7VUxlSI0TtJA==,iv:CsAHuaDOq2XSLf15hN8GEXWqZ/ZGp9rPMvooV0HNALI=,tag:p5+mn3+RG/3vMHQnbEKlmg==,type:str]
+    applicationKey: ENC[AES256_GCM,data:NpQLlOTMcowjQflfKrlMtCfvEzfo9N6oNWA+7jfQ2Q==,iv:8ibyz/kfqO6fKC3Ud1+z4auxkYM5nDWwqcJgGMyoyYo=,tag:dRJm42SaKCt0PhQ0LQ87cA==,type:str]
 mail:
-    ldap: ENC[AES256_GCM,data:TGn3qu8gJelnuVmTrmnB84IuPYiFUkzrWAXVGQ/OosEGyD+wEkJV6AqwZu0jXvfs,iv:YYT9t6hljE4rfVj01cNeY+zmwgjLRAbzjzl8BBa4Heg=,tag:Z75XdhsRWJZ8oA1Iw3c0/w==,type:str]
+    ldap: ENC[AES256_GCM,data:zW4zKen3nOi0CYvGIrSGgp1M3ga7HgiU5Pm1YMzJXeCLePkWWq0fQQnvwaLHCxU8,iv:huqpi7h0aiu5s5esEuOgBcAEz1IruNPTyWDIYXgBqWc=,tag:J/M5AnI/6H2QlOAyTASCbQ==,type:str]
 lldap:
-    jwt_secret: ENC[AES256_GCM,data:pad3VSgv2z9gMS/kFlfqLpQ8QVYymhYBvW9N4eu6nSA=,iv:lRgK5RidQw9Kxvp8K77Qs+PUs/ZtJ/0XnmNytcgn4Ow=,tag:LHg/I/DIevq/ORv7BP+gTw==,type:str]
-    LLDAP_SERVER_KEY_SEED: ENC[AES256_GCM,data:YDAY++5K56m7uoUbBwYEJdCePW1fZqbNXf5IY/6/crXneHv7wv631fp6VegLG5ht,iv:QZdHg8woPGIGM1raQThrX6x6qW8QsLZ6/Rj2kgtyrIk=,tag:I6tKJMik6SiikWK+OxlE1A==,type:str]
+    jwt_secret: ENC[AES256_GCM,data:4rEyGpYWJ4WyIVhhx5MaMEeHqPiyJmB0TfNTaySR6qU=,iv:ZW4vXw1w8znfs73lsJjSJMbgTVgsO3jgCJmBvwxiifQ=,tag:NNE7DakH6IgXkfrB89i3yg==,type:str]
+    LLDAP_SERVER_KEY_SEED: ENC[AES256_GCM,data:kHeXn+hD/njWlpZThmuVSKKsCVNSg/o9DUgyKVHzavJeblG9ae522yuq3hhni7GC,iv:YBS0bktvjxwF3w3QzF16sV2KIYFQC3TW5WVxCjHdYxg=,tag:huVjrSdU2T8ggYZ9LOo1bg==,type:str]
 seafile:
-    oidc-secret: ENC[AES256_GCM,data:umMoe4z07sE6DBPGeDI7C+tcOX0s8ncNtwel9JkrR+g=,iv:VIbpJHtfnwX4sIncCACfQaL91ZtRHh/3eb/6U6ATY9Q=,tag:6fPep9p4q14jQfH9cJf6+A==,type:str]
-    password: ENC[AES256_GCM,data:S5/bQ0B/0446nBBANPYqxqX0+1w5aZNiFDZQZ3AsvtbvrRA/Stiib/eQ84uzwzyG,iv:32i42usr37S7H18PHEYtVY3a5DZ7mlWYnL9w+zj5rxI=,tag:pjmElroBR1MCe4Q9gmHZOQ==,type:str]
-    mail: ENC[AES256_GCM,data:vCKLXSMXq8cQ+c4sRM8Wm7xksm+B8ncjxjIzJOqORGkS3JGGLoFgM+rjHIv5lzkB,iv:6M1CPKEosZQOwWv9JoE1lqhwykQUDczdzXwTqr1ULcc=,tag:yfiwwsFbVy4k9317hk/saw==,type:str]
+    oidc-secret: ENC[AES256_GCM,data:AqFSSUMCzQYt3llQGb5ArWnInahuOQmOviRypSJpRI4=,iv:6fOgQiP1oGHoMIRy6+zp9G7ZwzVRSgjKfUgye5zfjsc=,tag:B9//G7IZsdtUps98YLROhQ==,type:str]
+    password: ENC[AES256_GCM,data:TYCWkuvPPq+VVpfnQK9g+Sn+8mkYX2jdDHzu2+zb5Rhu4QE0uki1uwE59qgng4Ke,iv:Cx9jmP+7MvRa3Bdd+ku+11I8Xp120f9XCdn5N1vyZAA=,tag:LUqNDQq08J9jRBAM9juprw==,type:str]
+    mail: ENC[AES256_GCM,data:FStg9iX83UHVILCAA7ueEbMK3v0k8OX6Bc0Du7KXOS+MIDSTlKHAYQ+rHgEE+WPU,iv:AToLschOU6hu7MuP5kFwNk102c7V9OTB2durwqUnZ/M=,tag:w3B86IzVGORQj49uuQnTQQ==,type:str]
 restic:
-    RESTIC_REPOSITORY: ENC[AES256_GCM,data:XG4Zt23C3awYa+txQASmdkJ1HlrTHEwLCillm1+PvQIG1zHpAgiW4TlI0c9bq2SpbEq78uPFJKMbyOu2LCOeZn4=,iv:wyzhO/tUhBS1Tt2dG1f9giSZ/fz2VykVK6A4H0Nc2Xk=,tag:kXEhSWEkkvLv7cWSB2AeHw==,type:str]
-    RESTIC_PASSWORD: ENC[AES256_GCM,data:zYfdJ94uyUE0z1wU3T4W4pRb8UGCBvQjCBl2yZXUipNdkNILUtI9EZJu01AQ/bfb,iv:sXZAfLSMEWmJBzCo+lkQ0PslSYguWYoUGyWGC7oSgEI=,tag:ihu6+/kzfClGCJwUa7C5PA==,type:str]
+    RESTIC_REPOSITORY: ENC[AES256_GCM,data:3ZV9vNRp4TDJ2UMsXN9otgE5Sm9kOpcPFQN0Vs7ZHpKaXPPH+hq106NFenrfDd3ZwjLvGwQvaCKQB4O1jdEgQOY=,iv:PR2LqQ61Jqs6IzDF9tsYa4gXmT2f7Ny1cIxi7h5mWhg=,tag:w2xKkHtQPecjL3a5T4fAAQ==,type:str]
+    RESTIC_PASSWORD: ENC[AES256_GCM,data:IL+jHt8cDrBGwwsb4RwuhmTCChGa6tewQC8/nSPCR61sE0/lU1srRvjrQj6juRUK,iv:V7ga0Yv09nMyWfg8XqtegQn2rtWPHTiR7kYdt2J3JdE=,tag:ERZ+BELWJutZDAI62OkLWw==,type:str]
 ocis:
-    oidc-secret: ENC[AES256_GCM,data:tt3HbvY8PAn/rAiySMGpfvsaX302ksVlUufLnfX6Btk=,iv:U4DJx3FB5jPZ1ZAjQWzPTTdrt+pHBaHwPwKCn/uZ0Yk=,tag:fcUiS3HcxiBdGZX4x7wG7A==,type:str]
+    oidc-secret: ENC[AES256_GCM,data:rVl/d66A/U8LVJMW6NGJEc4VQNjbxlAFLxs07557lTs=,iv:uC3LQOPb/IcPIc4VxMPGsHipOAB+7FqVnxwaPRqn2J8=,tag:+e72c08EIhf2YFswtT//dA==,type:str]
 searx:
-    SEARX_SECRET_KEY: ENC[AES256_GCM,data:GX4lTknm6Jl7V/62WWa91EpW6mSFl1HmZHhejtuc9y4=,iv:0QArqqQ6MXC0WcPkR/vu6kpbro67RRrYcTrnD27iJIQ=,tag:zqKnMLE1Y29Jo+G2FJZm1A==,type:str]
+    SEARX_SECRET_KEY: ENC[AES256_GCM,data:87pIkLcZRqvi3m76VMPtwpK2ZeHnYo9p+TM4/9gCzcs=,iv:rugaEUbLkSS0bgd2hie3jqZ36L96NUi3WptnROpTPFQ=,tag:9KhtfwEr06zfjjfrBCVFpQ==,type:str]
 minio:
-    user: ENC[AES256_GCM,data:4+PvVMY=,iv:6rHLHO7NddOzZib7dRrGAJeMsGlYRbNosMYIMQB987g=,tag:FHGOZ50jQcjcal1mwsMcvw==,type:str]
-    password: ENC[AES256_GCM,data:vZ8tOLoMQckb/PqjLYS9kGPLtRa73/dal+2tygJK8M2LA2/T8UgewTeoF9tDm+Il,iv:OzYgSBc6JDXFcm6RTtcs2Put5oAJ7fbVOt2QULDmp7g=,tag:ZAu2QwTlrEr6sYIpQvFy3w==,type:str]
-    ACCESS_KEY: ENC[AES256_GCM,data:RxiGgiL1cWTyZzpCTbih/jG/EZQ=,iv:k4i/zEgeEGMxq320EJYk+OuYkFuTDYzT5LyvGbSb0fk=,tag:SFjZaaxBLty91aSV3wyQ4g==,type:str]
-    SECRET_KEY: ENC[AES256_GCM,data:8voYn+ZFQ5y56BZ5FrCxvJeNpSgHhl0TxKbKvara/+el+mCFOCZbdg==,iv:WTnvxzWU4uy7HPJ0e7jS2bXTYaNDUhZnc7ZCgWT1dbM=,tag:8zQHVgV46csZdNh0RSh2/g==,type:str]
+    user: ENC[AES256_GCM,data:DPZlvQs=,iv:G524LHi9CjDKyv91wwLAgdv09xSHjuZ5vr/purG53aM=,tag:yfpn5bwO/6sGGa9AVjIGJQ==,type:str]
+    password: ENC[AES256_GCM,data:Gf1oz4jWz0pF3wHpBOeklMDKNhGFlrYfBYkWEKVGU4aqMcNTPunzeF1i7SaxoHvJ,iv:qQyJdW/0l8glNLczIV2Q/Gj3qcIgf7YNDzufj/ZlpSI=,tag:rY3PQp3tqayH6ObCmmKcqA==,type:str]
+    ACCESS_KEY: ENC[AES256_GCM,data:NHQXLEdZEO6HOhlnrk2CmGDOnYk=,iv:fP1xsWLrPcz1cZB/vVg87FidgJADmk93ODko9qSrVuM=,tag:L1gFyRAVbkXKxLj9zHq3vQ==,type:str]
+    SECRET_KEY: ENC[AES256_GCM,data:t/psvMk8lTc0d0Ot9kNEbVBio0w463oal183KyLYXfhs5S/t8hHulw==,iv:yHrGJ+b3ZzgwKRjawizutYRg/LBywrUYmxsqImlMzCA=,tag:DyZhAkMAo1a+CNDOoDvQjQ==,type:str]
 mastodon:
-    mail: ENC[AES256_GCM,data:Urc7sA3SwrvU/F1pwrmkxIzSp0Q5OIH8vTPONxg/ES+98YsoNhmqq/7/gIchFOIV,iv:xyuK732hc+NCdmyqnpAueciah095MATdii9Oux2uZPc=,tag:SEa/R8HibjgpOiSXi23CbA==,type:str]
-    oidc-secret: ENC[AES256_GCM,data:n1RNm2OmXcu6tv9cywPn09GdAsKS5gsArZ26lX2/cAs=,iv:MEmgJJdT4OGRSGNAF8Z5e+ostyD8T0dDrbDxaD/ZScM=,tag:doP/LZFodiqqIqxl3bg4Ow==,type:str]
-    SECRET_KEY_BASE: ENC[AES256_GCM,data:d8m45UELpI1DSZPaQ16KVMVJIWI4G0ox3XiUK46vBoHqMvX/BF1hLCqhyUP7pgZCkWesJdEon3TCtfqqZBVXD20bwnqmmoxXi4c5l2I4fNx2/1MLKvVjSdhp5Bos1kFWaeqMzzmsfiqEPbc3HoG78uhg/XxU3degp8hnZ46e4Ig=,iv:4zyOO8rPTro2ybAXR/I7gykgt6Rma+jTOzBM2870KnU=,tag:yC2OrzfD6NYHiq997rmy3g==,type:str]
-    OTP_SECRET: ENC[AES256_GCM,data:vBK++IZdUw7ROXbKalSNelNhT6ehAtAoQcVOTg+IUy5YWqdoMsWRFnGONGk5VHu9mg/4b0xgS9NtMf7KIOmXVpXw5AC40+geCWbVi4fnj4lhNUO2KbRdfi2jQhInUSsOGUkkiJhilRudQiPGhLq7aUQj9My5S8P5wlQ3IL4v9yU=,iv:72SWiLl53rnsc6WUH6jATRwjJgge1PHRo9boc0hTGzY=,tag:+xdkGs+Ix71nX1TwShI9/A==,type:str]
-    VAPID_PRIVATE_KEY: ENC[AES256_GCM,data:mOwMxc/GwrPW7C8XJYZSUc/ywJ12UwOV2cHXyPcyV5BVDswYLlTXQOZQRqs=,iv:4opdr5n67lKPkXHYXJft/ymkLERunrI8BLx48E4L+3Q=,tag:EroH9eJB4FKKBbBSJX0Arg==,type:str]
-    VAPID_PUBLIC_KEY: ENC[AES256_GCM,data:qg04In5FoPuxIrcL+uXri58a7HSkMJAF7qSNDFR3i1fbf46oQ7GaNNkjqDy+wynfnAS1OQjReNcWZaELOVz03YSmzc2dodnQmokWuggxWv8tvTLWjsBp8w==,iv:LomSd2YMotK0Egh+/Df0SEKZ+42Oh5Zyu/EUgyCVx4M=,tag:1LsrmSJrLucvD6TAnxjxew==,type:str]
-    deepl: ENC[AES256_GCM,data:ZpPdov7hapujxjOhZ07A27iIFnCGgSXGvDsOC1HnIBaZcpv+i6iX,iv:QBfUKk44nD/G8QDTzfLiN5lnxCyFqE5NIpCjjaYLpYM=,tag:svwdHT181+RFvA17jqjSUQ==,type:str]
+    mail: ENC[AES256_GCM,data:926DDO/aKcGr+miRk/waoY0TZkJmFtQXujSi850tHS1YFGmmu7ppvFyIoVbqXh4t,iv:/EDv16kqPtvYcRqlxysMXmiZmQTzrvyVxejpjfeOgng=,tag:RSbCnQlpDwMVKaI029rK3w==,type:str]
+    oidc-secret: ENC[AES256_GCM,data:Pcvo3u3MYRv20IHo8d1eg0crzEnziOffinM+OVATDJQ=,iv:/e32wwsIqGhcNfRxla5XKXP0ZePOsN8VxtQyYHGAnrM=,tag:k+9nRth2JvPzRE+tpUCIfw==,type:str]
+    SECRET_KEY_BASE: ENC[AES256_GCM,data:AZVUceNpAdjk3KBM3+m0pvADnAfI3T/iWoagQwHy+wf4pi3lPmSp1udub+ewlF2sTYvvoObNllbCimNUsGAp7dgs4/PW6FVTmEAoSGk7ZU0oLNwqV7ptoQ8QY8wMK/O4xZkYO9FJdN4ejvWnSK0h5TNiL9OV802LVdH4uhMGl8w=,iv:k19beqUKmqdA3g8Bb4Q6ildZ4Zg+ahIyg2Hv6MQ1Wys=,tag:W72kzH5WkGkwbY737b1a3A==,type:str]
+    OTP_SECRET: ENC[AES256_GCM,data:bqRWAPceKFacr686UKyOIbr/fnezw++UW8p4WDrwmygPEjgzl7hlnUwhmoYi2pWKkZOGZz2vqKNmeu2p4vrg61VL+PMmv4QAbGIB8gCpusLzLGIjwyg2oWYSNOUHCiz+8IC95sTNF8HlvZK769UYYd8wEMRcYCAfkTgnmRY0WS8=,iv:Vr/eV+ovdp5685Ewmn6QUkw28oagnklzQVMaKLG66XE=,tag:eF0jgNVsoc3/7jZTtXRR1g==,type:str]
+    VAPID_PRIVATE_KEY: ENC[AES256_GCM,data:sjwurPPepDid2zW8SClUeLYk33HBWO6Dp9nwHb+8++6Pee2aWCRW/lQVur8=,iv:EF0ADsrfkcT1D+Bv3cLIqTaFHPJW8RaV9hcRIJJBxqA=,tag:ON4ake53VEQqFY63piNWcg==,type:str]
+    VAPID_PUBLIC_KEY: ENC[AES256_GCM,data:n6R0uMAxFYl7tNChcyC3CJntE0qKRmD1S/tH3I2NNb0aBVZH2YT41gxUucYcLokNO2Y1IfmBNd2KiqNa1/qf/a+d5qDtAhbz3gGKW6bhSbTzyviZo0oKSQ==,iv:ENijEwXNnwf9klOorw8txBv3M3rNNhoVuPEWUbNZ8NQ=,tag:aKBWrPoaFc2A6SPBwWgcxw==,type:str]
+    deepl: ENC[AES256_GCM,data:1FDtWy5YAJT9otNKRB4qLX4lqlRt9WJj0xcJOAHuKfugPeiCFADK,iv:FKj8IeE+Ee5XD6S1q9Gj5mFVB4qn310wFyz7BRgmPxQ=,tag:Z7eGqPnt7u4Agn2jKjuudA==,type:str]
 hydra:
-    cache-dora-im: ENC[AES256_GCM,data:F+84PbtVZjigiPVPq3rgJX7nHV6IUeyxpnjq7OGns7PP9oc5y+Fy27ZBXgWxXf578F3jUpH9pmcVxg8mciYtusSRC6HBImJ2f1mEkZ/sTx8gNHNxX7LC5rY90/PQHFaiv2SbtGPj,iv:94xIBnyMb1g8qxFHX7SasOXP5aYEVahJm8uu14HVT5s=,tag:8NgiuARCooKsvTTMa6bpaw==,type:str]
-    github-token: ENC[AES256_GCM,data:NR3UeKt8/HWWGAp2Q4HAVHKO/PkuC3aYO2yZgQZSQwMgNihgNRYUKQ==,iv:+ciLX0WcgEb1gQECjWp4kBvOo6SxAHpC66TawHMZQVw=,tag:fgKUXiqUBppkyvzPKc1SXA==,type:str]
-    mail: ENC[AES256_GCM,data:KPOAaopO3E3qapNjLjT5ttrZGE2WN+vX4rIfErIVX6SDhm38xqxMoNtbKnsN9eUY,iv:bn356S1nvGS+np7LeS3+0zD+njoaJTrGLDYb/jS4kxo=,tag:HhnfYQrQZs8Hm+1Diw9/yg==,type:str]
-    builder_private_key: ENC[AES256_GCM,data:ConviQd0UWK2CMKrKje2IpkMELLK8BQzYNoMmBPv7KtXa74Dv0sHVVuNFc39vf/eLTg5KcUzdWbDO8Xyd+GAy3g6cIAZyCpJpGiH6qQG0SI8RWbF8dX3t5YlG1UuXCOnAOsBMKemH2DDTmZkwZiBVSgvhr+r83dP34Fn986p418s5MWoZzhnOa92JLt2pnyBLcg3UwjYFQuheWLjXyQ0aGP0ZfkTUZbqA5NNRxLct/phcPk046EMVXWTAyxgKDIM87hT2nXdjOb99vDJo5+jXFHq4VMSdiQpzuoDUENiWFII8yJSJgF29iCyrEgKnZN2hzy9Yx9W5EhMcLjhUWwH00+hGQ/ZzP4rp2iX3gRLCVrhFZr+ttkhjU8WW6lWInXRC50rFdZEWSbw2dn2aoO6yOc8iW0H93JKBDUuqsUZiel5y1AcaysFYCGvmaHiWqelEMj6MgSrLg7wodA36Hq9Y36B3KfltRUfQFV8UuMB1J6k3LtYFcUBo40VMvd2bvMjFeyioN7Ah5Icjtu4Up+f,iv:FbMdtwsspLERR8xJoBxoiUBYZVIdRn7ymxBwNG1Fo8I=,tag:QwuQpUdUCaP67PdNfWO+2g==,type:str]
+    cache-dora-im: ENC[AES256_GCM,data:x634SibBKWOSnToetM6yh8JbijmZxRPipKVXmFQDvAGj6oV8AFF/Xb+oLtFqj9MCE00HbUXDP6S/28X/0ngBcEXwoQHcDIWASjvsayEZPsoDA8ke+r6XtCPRjT9h3p9JUTLjOAQu,iv:+7HVvW4X7P4BXt3JeVjM6e3CplT1oiSCq2urh6TJfcs=,tag:94E1gPhpmpAcoTCodZlNJA==,type:str]
+    github-token: ENC[AES256_GCM,data:yCZV4/frLSUQ2kGNPt0XBcHjRV2quSZ+ZjbcoZlTSiiUE/0xbsOP+w==,iv:jU7riuOgkgdHRnvf9s2P9uqiq7OGGJ5mwseb7+Duu1o=,tag:jEXkU4zUMpM510Xsay27sQ==,type:str]
+    mail: ENC[AES256_GCM,data:ZIX64PF5/bNWYsIOaBoNY07O7OvJs8PFZxQOoCHKssjpQgkx6bpA5d7Qk1YZ+ot5,iv:oIwgzwz+RfQ1B5Pwly+nCOxQwEA9uzWmp0gKqOv2PQ4=,tag:hT/ZmhsC1w5qeuSH6Dg8cA==,type:str]
+    builder_private_key: ENC[AES256_GCM,data:S8gZj5r4vam1lYAC/6gWrn1jjpwG0YfvY2KPgf0cBpQkLsvVsiftEl7Y2zr2nstmRI1bNLU2bDaMF1msa6JalRBAnhh0+3Gi8kVBbpcrom8J1JsdoQPJG2y2eiJtRH+sDG0BEaGQl6MwP0a8V95VTzdMvLdabFpZ4Rsgcy82fYCYIQYPLnJkWTLOMST8wwFUMHPa9o12Hh/9CiHRuWYinyw3biVtmg7PXR4WrpPLk57ix0KGQxajZzL1RgrN7Y+sJIAlQX7vZZJ4v7vM9zQcTENGsDtGSLWpA0jAVtfvNGBLknmHrkBCpb8BEaj1QA8NMvYzQOy4OEMJjV3ZIV73aOAmmWjoS3Qxusn4h5uMnSOaO6YG4atBk2ojgU93He0X2RJY3WmdCcErtNAHY5kgsU5yX/qelT49uaAdAYwgJsW0ydAKX+/n+nHDE3daCR2j6LYI2QRhvcIrTO/4NpX5x0ydRjepf7fTmLYsmjA26BqFITDsBo1FrLgnyRAvSP6Jjw+E3tWHfSkrLDtIEfi8,iv:EQ1VgOn6V4wVSMse7ORGQ0Q12JpF27xCKJSLVBmtItQ=,tag:zJMRnkwNmvHuAZLbDd9POA==,type:str]
 alist:
-    JWT: ENC[AES256_GCM,data:v6KpY6AtrYSVecKkouZjNw==,iv:+VC5k9uPEkFlikmRy0HDJ1QnYOEfeAY1pq0uxPsnB94=,tag:N96qq5OB9JzpGbac28iG1g==,type:str]
+    JWT: ENC[AES256_GCM,data:U4NvF7dq1pwLUbVP+kAbDw==,iv:cvpbZMTj1kBrvyCFESLhzz4mMYFTF6nYt6Qz9Cr1Aqo=,tag:WnKj+4wFYaXRvTCRAFK1Bw==,type:str]
+sing-box: ENC[AES256_GCM,data:F9zBTXfscY9vECclSGuWf6RFJPBgqur2VifAp+eIiYsYhTAUWyP6nVr28VbKx90GJoVrerUqk1s89dsNie0WCZ7fzmYq,iv:aFxzA4rbePuQUd98yUZqtNVw8c9FLfWxhjbiipeoNjQ=,tag:U1QsDK9eYVOLWEBUNJcc3A==,type:str]
 ssh:
-    id_ed25519: ENC[AES256_GCM,data:P54OmI5kuheTy231EUhgtzTez+juhPZx3KvcS6v0PqrFmyOvivPxluxpxMFxbVA54gvXRCdwzjIUQD3RTWmAQ3OWkkcg7T2AgynRvx98AVBM/6KXXMpERbE/RKjbOE3jxUc8ezYDUEDUJ0NCEYEr8KbfkxWiDMEj2uWV+9ZlsLjeQU+4Ypnjn41naAnv90+ULgxlOMIibh2XXH7edgb3yuRmvPoH3mCeo89mgaLcQ+of4abh2LWI+JIhjlFGiUxf6EU/Xv3oVPVV+JOcLaUaDq+N/tKscYpahSStGFigC46lu1w/soGViwaa8ya/hgbzLE0WQ6Dqu0QfAfcO2UddbZyg238PBFcqIONmGVdVJGknehlp6o27B0FT/oq1JPy7ZWAtSeZhIpyPBvXAxUgPCWv6vf4srp/ZIjjbG8RIlD6OuVDGRwlWRu7rkeVRO4wHAZoNv9NSmR+83X75KkWZQ6DAaxtia0wzqguLeXEJHk/FM+LYYDUcebg/TJaG8yByiVfauLAcdW2ztC6eWfzm,iv:yBaQmFjKtzFdgnO3i8NPCRI4SHPvZmrt6AGA+UkRGfg=,tag:YFhceA3Mu7vRfwOXG+0tJw==,type:str]
-dkim: ENC[AES256_GCM,data:pfMHLt3hCl9mY8gXf5fVfPcVroAXIiCEML1FITjxvQMzoiNIUVWKEtueTub6MjNwOc4sVtg9yMV4YIrzJ5j1RfJi/hxuB1LFw1FklLauXhKeb2IXshxni6j5YJepSNwqt8lwV/83vV1WH9j22ZK8w5tsQAw0AS/GWDwSXtzS0qykcJmYhbiD1Bu8xWcBI73fHsZBp5KF+mXNjLL66RiMFcVTT7acUcuTTfOd+epF+rwaeOa8NRByRmm+BTHVn0sXdoLdSM4NT3vbNtpa/pVWGjnhAvdAscj9KR8gWzD6v5uAg18ic5oniBAe2ybGkobxTCsmIRYgcExsNj06R9yCJtF7p2aQ7A4NLjUsBaHLq9gJ3v0T7RC+Y/QHC1S7UI/ksVw0dlIez3HIyN5itzuQkLusdvhhzfRrXOKhMUWAUgoqyQ0YDdE3V/F51LshGqmcCcDx36pJW1q4lWJ5oeXqPqbJOoFeIe/JBZcmKehqFmqO+nQEBgYZB0BoSxw2izaQTilG8EQankMt1J5BDH9PQjZUvz3POhnSp4jbaQbKmXqJ9gD8GYMIvjNIKJFaldXgEa41zGCBIwsaGl+njDbR5OYfka8L5xApiFMgtEnPVHtVcMGo4lSTxz4K1Qws2i9pK3bYM88qstir6B6crs1/7mLxdMkkasg4EwJ/XWZ3nbXyqHaQIG3tXChg8vdvI64FCYthqgeN2RIXn/RqHky6Sk5Hr0yTACc2Bk5DDF5yaWObZNMaPyt23mxpmNYMN7RDKPfHZca2yc0JuHe3lXUc3wh927tDMCSYx16a/1lR17njUGX85xsRDSj3ur14Zki+ed/WVgF00jtydwJ9aRHGWV+Jn1KYenBRjnrqMc0t3kxe9sCfMSRs9OqTM2jdHCm+JB5vCXjg9lEj7lDw0n4OE9okW4OUMC3BpiL9hx74tzs3ixO5cHcItKV7ahcZ6ZLn6Nd7rikyyDNcX/n57AMVSuj/Q34VbQNQ4JmM1PInzgxjpwrm3nc87WYZkXPgjSlhM2TGeTHUIeYgjdbxwoHPRuZbhMc+xta6mT5tINbYrbXoQhfHP8RxoLnCLSMV8R9ie4AWVAj9l9H/q5mPlO9aT08ptppB2Wa/WwK9XThFYKdIMlpTpWGZH/I38Cy1sDYo3xnoxltBNbH/bc9E3rQSGtP73j4LqaMdMs2GuG0POPZKbeBmJGhqCKa6j9v9G9Q/DcEvW6nv71SQvN2Ol9ItWE7eXRskimu2lxV+yZMWVDwpS/ZcARrCX9miGDxnXsMzX89Z3uWMLTPCSFxof/TpHcA4QNaykIo6hyBhwqdj2YhbeinNhFa1trRr+klqHDGsFT4J4uiTmNwgK3zm925HZBWR7P5njbNCiBM//94UKeo4d5TtZ26QUos4E1lAgKw5euOwEsPgb18ZXID1E09ifJ5+HEhq87dpDaTtbu7B1dcx4cCGYRJHicZMyAy2K2rIzwUUi6KhSS6eQcoXXcmaTA3wrVuGsKYXWlTWC45Dt8aY1+kQ6pOFWgVPElulQS7Ne0d/iFVItIIs5i/CTozjTK7ELwv7P6ZV5gylYEVzT21DjeP6wJAI0s25QxCiuerk33NEKU45WqhZiJvwnbJXEnN84+vhmu14EghzGRSj33VOw0WqvwN6eIp0m2xC9PIEz4qy2uD+yW2r/2Tuxn/huYaaqohOzz2txxWgeSM1ilso3PNEKa0C5YFk6iyfp28MFfeMbvM32LMlJEctfy3zc9SLDGEptAnQJI+ybviQNiebvoO5KRVrxDVNoejVebKzyBmmCJPpI+AYLQYuumUK+2A2vtGbp9U1EgqXtWPdZj146hP/SbcvuMn7gmGo0cdA5L/9Gsyh9iZaHnMCmBYsxmLDdLAAfQ5mltGPcUNhqcuEBG9GavU5SGD2iLf7FU3s8HcZeREaFM6DeWcaNxwXoJYamMZm//5XfNtnxF8OFo/tYHoftcgflt9NWJRVWkA90LvRYF2ByKnmsxcbhoAFjrlyzt2AZMNpF5AMyHvOjcxCpBWqSWSWz9aUYvWqB7fGGrHPgjDj+30+HSMMZuyYmhfaJvMsS+EQh1F9pDdU09oXRa8f8Ncd4xSFWFao78AayeEEyb/vgHs6uuJ8N89cdcTUHLdaRienr4nq/ttdujvZKy3YQRyIQBQ4Cge8RwiOk+5mf7BI1uduvQg6hW0X3FG8daQWMsNuujHLDSdkjp3w486WQ34wiOyiufXQ7uTZNrxedFFqZYm/i2jD6f7ay3LZQ4bEAXTa,iv:JrgCHqdYQiLZ6SpSvNFHENlf576Yu5v8i9eZPhmKwLM=,tag:NLlm2Cfvlt5dcLjti5iWag==,type:str]
+    id_ed25519: ENC[AES256_GCM,data:sZNjVKhHFpiuJ4f1I+8sClajtCfoYzIWlw/IhYc1hCzFfrT4cTJvq4MGewSdroeAhQ+SNMJcI6q+EFm9E/8QuTlFcuMKqIqvJF3HsgYthvFe089rBIBFI5/KYwxC2b9hjiDGHpIdgAAfaG7gRzkXiZMQTlEN26p6RG345XxbXLjsPr5OHeTHajFAMGJG9bTOJLHECkAJ05RNa8QFwh2UbHMvxyXlHBLMXhAcE3hWQ3uVZtOxUWQNsyLU1wOMbSK6C5wVImdGXav8Ddua320AhDc2PfpyP1wo8PkSUmR/Oop31MtZCD2eG8KW3zdjmsRRT2jlE3lF3sKpIO64EMV2rT4IU8qgiA/EQIQneDQRyYMkD8g+wnp7On2/p9DT3J8brUSnpgWY2RWs3RB4noV0mze78+XSBMkhagoJ/0oBrqYpH1f/B9lmGmzhDPTxxDtHdKJhYyQ9CjICmghe4NqvLk1+AzPNXAqWw1jGTN9rYJEfDx5ikKac6dW21U22b6REOYXTtmffCoghLyfJma0z,iv:PTrEBD53o888nqxg7izJ176S6HETfwXOTwZm+c4yAIs=,tag:hDb71Uc+Uy4yd785bFcJKA==,type:str]
+dkim: ENC[AES256_GCM,data:64NeVyUy42PKy8QZjHueFa5cg5PnuL5hLHBG+/8KSAT4iUbPjaPpiZvCJEwOEUuVNF97AJSPW5DzRArNMerOiBEAQYaNhCPYLL8X34v8LT4kNDVqKChhAHXQFkTl7wSH3YisODOvimli1tA6ZlJgdU7mrZ96KJYgefNJhTOGuXMj+s+z20OF19l1zOrf5BzH7XAariZ5iv77va+FEqt9ZIlcssp1csj0x3bJs5vHJWaPoIGxUl0GD7qJeTbRs0+qU/mzgTF6BZCH/5aqZnAx8ksAHs5YKbtFx6icRmoVQpL/nrB3H59UXxXf+akWu7YCJxbGx4a0NMr08uZO//s4PGVJb3XYxFudu4FNMeVdvRFlVheKxMBsFnak2yVrn/QGBI8KLu9xW1ZVjD9TzVB14n8BrmB5qCCVkCGSNpjh1+1BlUvDsMVmHtqEQJazlcTi/D3Z39biKC7TK87eKMsf5mEPhwNUgEn6FmFfSC1MmuDU2zv1b8pqMyiB/L/JMnb4t61C/W9KAuc8mRl1Xtzp8A/4VGF/2/m5fLQGAa7Mxegs0gvlVpZDsWuWAOX2ypMMb8ijpN+lmRtH8j899HZ1la/8Y3NpyySpAdP3gRV5GpCWNlxz5M+EvoWKdfOUONAQfhhAp0muRir88bBXw8Q+j5i7QGkT14YD/EDtZ+1sZZgEVOcDUIyxVGoL7npFDD5MZ+uc4GJS9nKKGUZK4rRt8nuYUR4YQQrkswExwTAXw13AF/6P65ctL9g7ufLNlTtEKsu8xtTuBQMTDnkL1s7AHQ8hst0OObyjrGiYBk3pTGloG1CwhtjV+/mYn0uV+AJc9dzxRlp1oKQ9l5RKdryo7NByaVN06d7IcEjy5zvyuJzT5URbUU7t/rx9yslouGbx8ZJxtTSFiSDPF/ngEuYBrkbCUsVCQcNKc3spbcJOvCX3k3Zx8Qb443N73wU6wCuRmCRRKBSB6dDblgeyYfAH1IL00gA/C5WwWBpaX6BDK96rU46Dlc3xwiBosWi2XN/brsv9HQ7Wmj5tFZVmJDsbADIgxiehqOYuP6MlDxPSiMR5u3FfsskFmX3dAQbEX24w2XeL1AOdaKa6CTmMNZBgFTPu21niQjTJ/dfGm0eABWbphZEmcGLLnvIhINWOmKPtSGd9v8bfjK4NrcfxWC8FNrAzm91FunVdRI4EpOGSutcRJEVq3Lmo42CxhSjkZbNHv0e6wpbK8ZqXPCv37TGc0NMWR5l1SPMYYwrot7V85yqomFSNUjdiZ3jsp4adC/oKlhUyJ5Ycg5OMd9cmPMBW8JEBxUHF7pSJmCHF0eJ9xzpxI9PTfWJQ48XfwW4jJMxzWf5HWYKVLOW1h5/Y6pktrIdVTbLoXAX8H1RFKwmb9s/U9f/WtgZpYAm1SMI5MMK8+Z00+dfS8dMx8m+jkftV5Rn6ZCjlBKW2sHXO5qQWBLP35cIi3BF0QjYF+YoESaSJ7qP21rOwCdTX9N11glD7JhQPuVyxQjSOwcS+J/iD1fJv17Qrggz1wPc/kg0gxvC/0q2yVHaJPIsdioeeCKTtjm4PcgYrLixeXe6XoByUfpcr1CogassK6EuEtH58hwVtfCfUyq+hyD34sj7oVb4KwRfd+Mo+XmDHKfQH0jeHhWVczqO4ktabuvEB7ExA7o3bh79rxg9bANsmHw66msD4sro8unlrgfXunVwwomI88PwADjAJn4WbyZKPxcl1qLKqE6UukuIkiZ1xLHLA5qa2nWx+QWHgJuPgf81UvGokjmfWEOEH7Z3pCmYrHZ3bfG2VbS2KwIrGx4EQvjsWUEuUU5cudagIBdWgLSBi9t/6uxrjx01VBOwwEmr2WxSZSMzT2AyT1cYpnLTeyTMxYPTAilRZN0QZmeFubwhEWfH9q+TxHMkun2x5RQ9/dL1SGmOHLvzy6nKnXdrYXX8iYX3AuJxpe+CUvbGTrX7jBcdGzjBtiK9f9OQn4N+ePJhtd5nk9fW9F+V7EeQrraPzXezg5TZIIwpz55I1p7C5pAJv0aDeNHwGuJBpgXob0/zh0mASoVh5mgSc93IfUG/qxPPYY7yVZNnkh404Etj2fX/XrMOfHQHp8fhn5muAY/kVvglFpoSPSuoF7+eYMZg314Bs8T/O7/vDXolj8KmKiS1uzb1swCgZTi3Fa1YaZ/KXze4tkbrwRZLTpczteJFE0rvIFquUXrpxO185yARvDQLtKWiilSEYVYbDCXyk7O+K0dEIGdvQv6tLm3/+VpVCEcFM/zYuabJlr+mP,iv:8hdVFJT84tW+qawijaz/6a7MclqgYjJtKyNS0/9XOzs=,tag:EgMgkLPvaB2f2m8TQOyryQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -67,70 +68,70 @@ sops:
         - recipient: age16rc6cs8fhplzwh938d3zxq8pke7pgxerzms0dgkdgq7he99c3ccs4emnhd
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoZFBnaXRQck90Vlk4S2FJ
-            V0wyRzJ6Zk9zODM4NXhqOEk2b3dlTGpOU1I0CmlqTWNDWmZQYkJ3REYvUmhXSjVI
-            bUNvbkR2YUxsOUdsemVmeVQ2T3J6WUUKLS0tIFBocWZkTXQ5UmlKc2cwTjA2MWlD
-            emZUaUQrTzhGdjdNT2NoaCtYcDQrbkUKY4sjlDu/freepxTvDJlbZX+hJz0dqotJ
-            ATOYl5Yy5vdfgO9A1LLsCeonY8uDW+BnG+QAxrgPIKlMjvDzfNJGQg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtYjM3cThKREdaTUZuSmxY
+            YndWenhNQWtiU3R0SU13K05sMExOSnA0NUFrCm1oQk9OZ2RlaExUZnB0UlJDZGJY
+            RnlqcXJmTUJVZDdjYXdLNkNidUpMUnMKLS0tIG5jdUJSVjlJZTR3SGNIY1FEOU1T
+            N1NYanpsWnNxN3FHalUySVhxSDhaeVkKMC56ZF4VSUmocvuITtscy35l9hSh4/vT
+            my2MDAZwUuMsvH7eSupFcmxElhor6mpnZrLBOl+lWi6ULoXctulmcw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1yrns84azc959kqy3lwh0jqxjlg98lf4mlccx8v3q9d4rphpy4e8s2sprwg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDTzNDTnFrczNBcGMvR0Vr
-            NnhnVjhIOWFsNWJpYStPYll2WEkyOGp5NVV3ClptREVLMGlUOVQwZVJ0ZU9wSysr
-            RDlUTTZ4MmduMWpVajhMdjFzRXNJUXcKLS0tIGRWNXFTK2ZITDBVWUJKNmRtREZl
-            TTFRU0Z4ZjZMTFZjdllib0VtOUEvMmcKd1WWZ6Tjg5y46ShBLRgukU7B4R/KrWsd
-            7NoVHRbUWl/mcvtEP/G/XS9+UoxFJdjGgv5v29h3d6cO5lxPlMm1fQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXQUQrNTh3YkEyaFZibDI1
+            bGJxN2dJdVY5Q256ZERUYTBxekxqcnprQlZzClBERXREUTNBQ0lMdEFYY1ZlVlZK
+            ME9TRGE1VlBkTTZodHFYQUVuSTB0bG8KLS0tIHdKbGVPeEl2WUtLUWYycGwxL1pl
+            SVFNMWFQek12SjRCZEM3NFNPVUk1LzQKduvFdmTTcmRz9r07caUwNgXthLe19Fs/
+            aGUtH/WWOI70mXSXc7Pd42DZGhEz9++XDHUQH3bZ9Ww6liZyvw8C+Q==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1tvfl7y78hv2egs45nqtp7nlydqrrq2twjr47m2028lh68qtqwuxs9wxk3v
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRRk5zdHZORmxpb3FEQmx2
-            RFQzNWRqcFhnYm9VdHo5dU4vSXpYMUNXQVFJCjNkWnQ4REQ4L29ZVmk4VWNiODF1
-            V0tHOXJlN29qZ05hOGhXWTM4ZjAvMzQKLS0tIEVMZjBZNUdhRCszb0M4ZGJjMlZE
-            Mzd2TzFLR1phMlgrbWpjSWxDZ1ZrcjAKN7UB9kCyhz74H43WXmDyMYw1oWHj7AC2
-            DQ0cGVTTS0Q5hBPYEOuwr6neVyrQe+A39ACJhpOdm3JlvZstFL/rIw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxK1Y5b1FYOVpmRGthK1A5
+            eFlpd2RBZExncjhBYkhqZDJ3dDRyaXNUa0ZnCmRya0t1eEtTK3ZSNExRVlF3OHhz
+            bVRuOUtHRW5HTFZRTy9XQk8waTNWWmcKLS0tIDFVUG1veGdqaHdYVFpvQmE3Ry9l
+            RWJkYnRyQXlVZytpMncxOERTMW14YWsKZ20AXZPJ+siGrKJonJVkzRYwY299AXo1
+            caPSrihkbJx2NbWGIjPaEUwP3+CxeAXnyVlF2Bv6rXzhCziAiOTVrg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1uy5aqnm948p6zd2jy9enw5rppemgxcdfswgvf3qv7d2y05zfla5sqwzhhs
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQWWtQTEpkSkJkdUg3UFhY
-            YzJ4SUpkUUE1dElwdFVIMUtoNW5KZjNDc3lVCm1YWU1VQjBtRWU4RVZtZzFUVWRs
-            NFI1bVV6Y1granlHcTBHeHhXMSthUlkKLS0tIFN2aWRvT0thK24xTUMrbDBTZSsw
-            WmEybUlLMmhwbG12WEhNWGI3Zk9XSHcKqNn0k0DvsYjl+RKbTqo4PguB1jzh/OHG
-            PcH0rEWfAjLeOuiJB401R1+dMM4Hp58swb1rr9MrCTdfaTqr1Kfo9A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaaS91VzliTmNwbUhVa2hG
+            R3JlNElmcUhxcGVYUlJHMEg5RG5RdXdrSHdBCjJKZmQ5ZlhHMzRKeVpQVm44OGp0
+            d2lrUndoeExjREJDbkFVNU00Qitta1kKLS0tIDNldlZTcS8vN1g0SndnS21wckNt
+            RUkzRlU3c05kL2g3N1RudTJGZndoQTQK+QscmN9FAJem9nn/KbA7Ibt6JVboYiPf
+            c/E7ACKT96CF4V2Z6tUS9UQ81HWYx07249hjgVNeQbMQs4K4nqVGmw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1934xpm9at83g823dzwm3wxj64apvrx40wcv8ms2p9gvgxdxwsp3s0rvpyc
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKSGFyb1FMRDA1aE9pRDJG
-            NEJydXhMODRaZks3ZkN5TG5EV2Z4dEhQODBVCm45M1dqWWxDOUZKcmhteStGamNS
-            bWtVMldrUjhVNTMrMHB3akdPNDZ1MncKLS0tIDUwaEJKNk90b2YxMFNpNTB2SFhB
-            bXo3TUZmdUk2SGN2blUzTDZUM1JsYUUKD0ZbSt8omMjcJ2niEpAqXQ+TnjANn3r2
-            D0B6AEhFCz/Uh9FS/OZZCkidZ5hFkNVJ0lB6cfuqHnq25LkcQer6jw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1RmlJdmJuSnVESk15L1VV
+            NklzRlZWOGhDc21lcVNUUXVyRWd6emsreWhVCkIxZkwyOVRLQW9HRjlvNFhhcWgv
+            dHdqMVJSWGhzTC90VVkxSHZlT0cyTHMKLS0tIE4zRk4yY2xHYXRLUHVzNTRrck9n
+            UVVTb0cvQ0tURk1pL0hYTFlOMzFSZWcKem0wc6jnfd4f3X5EKwst0ABKJKFVR2v9
+            BOjRzOnzrvFt5LWK0x2NZ/hXYdEcncSwiCcgCGjVRKS3mjvz1L7SQA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age170nax8h00thyfumectwsrz2vk2l39k80urwzghez84acppq97fushqjtrd
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXdzRmQi92SUVTMHhsY0pq
-            MUlDY3M2a0ZvM0FZd1l2MGQveHFPd3JKRnljClhVdkl3MzdPQW9kaE0yemhpN2F1
-            MzBEdnozY0Nram8wMy9nYlFoSmJyMjQKLS0tIE5KM0RUNkVKZFpvVlI1MVZqVXI1
-            NTdGdkpMcjNUVVdML2FEY0pzZTBUemMKPCxsaZTJwBzddnUKGh5e+KQ63wjW9vDc
-            SlwhDlBYKQF3/vItfZ5bhy93c0D6bx7OPgd8Xt8ZEULwsOxknYQvxw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3R1VNRHZWbE9MbkxkbUQ5
+            QndGTk9lTTN1TTVFbDlDRFNxRFpIZnFwVkJ3CnhrRVR0bjJCa1pkMCtIOGdmL3Jz
+            dFFSbGQ0RXZFVzRwSHgxVzM4WGNUWVkKLS0tIHlDdis2c3p6eGltQThwY3JTTXQv
+            bGY5OW11U3hiL05jQ0dQTUVEZEsrOTQK9vv86L7ls3rn6wRByw1KOu5x7amDwvbB
+            8fmvUlQhDMZAQSBdeLnqQIdqtQPAq/5+uqJ2MfrT3SvKAoc1j/V/EA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-02-04T00:36:30Z"
-    mac: ENC[AES256_GCM,data:vQuLltd9aPxQonA5N4aNcvNm/MZplVWd7bKBK9j6+w+lMn5OIYCLmBBTkGSwursya6/ptUdVlEWs+7zd6Oagb+bnpNIYmdVfjKgxJU9cSegQA97OC62u3IktGdO1N/NVoTA0hwf7Bh9N3Kcof2xC6o2oNoulOp0rRCbNoAYsx14=,iv:7vWiR0puGhHEV2KL06wfznBv5jV5jqTtPzKyJ4n/UTU=,tag:QImldFbiKeJVZP3WQHalbA==,type:str]
+    lastmodified: "2024-02-24T15:43:58Z"
+    mac: ENC[AES256_GCM,data:luC1Pi4h3Kq7dDtDLXHvlL/3fvizLCs2HfGNEd7CWOSEO1p5OgmB64r+NBz0DsjVD+O/HsHMKnlzrrGDJxFqBSsJJSVteXBVltppnpvjQP5Eg6hxCsCKLeF+PkV/SuvPSTi9bzrWIh6y/kBQeQJal6HkwHAz9zZbFt4LevUlWQM=,iv:Th4sOg27G4GgGI37HtZcUa+eb1tlUlXnFT1Xzi0ogJM=,tag:8ld6WENDyCVkQc+w+vBf8g==,type:str]
     pgp:
-        - created_at: "2024-02-07T17:31:13Z"
+        - created_at: "2024-02-24T15:43:58Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hF4DhQRDCIk4Ky8SAQdAPb4xVrXwUYHGUdX452Dnupnf3PsUd/FFPCjPvj9b0gsw
-            0DVmFZEgRl5R1x4j5CnN7Cl5o58j2UiabfssuadiyuKFxx8/dueD/ua5306GPFEy
-            1GgBCQIQZ3LtNdXLgYoO66UZqT7LUsEhQB8rOYjnjd10jJbhvVSTkH2hXMeem1hB
-            BGq+XBQ+6Hk/gIRqk9Wz/6VcWqdlW4NthNxzXvsy3VhnizkDL3dzSm0vO87fypCy
-            M8DqfjfZzmZe3A==
-            =jh5J
+            hF4DhQRDCIk4Ky8SAQdAgIgxuNOMOQn9vSRy7heg9+LMlsxIR9FAoQAhCp5XrFEw
+            c3Chi9YprhUs9gB2DcH0yYklUxjJiZnJ7n8pVhC+PFMol/VG/CY3RTtEtPjdWoNS
+            1GYBCQIQ7TPSFuUVEtyAdVC8EhkYd2tjfXfymyLi5cpwIh1Pm4cZSFg5ByX+r1tq
+            zBeqT5XrETUkmJvtqfhPT0lINKjdTvYF5FVk3+0Y+iTVTFB29FeN7ptZSV4IMsAZ
+            sMUonym2VNE=
+            =SHgp
             -----END PGP MESSAGE-----
           fp: 23232A6D050ACE46DF02D72B84A772A8519FC163
     unencrypted_suffix: _unencrypted
diff --git a/secrets/terraform.tfstate b/secrets/terraform.tfstate
index 68dde9aa..2b75943b 100644
--- a/secrets/terraform.tfstate
+++ b/secrets/terraform.tfstate
@@ -1,7 +1,7 @@
 {
 	"version": "ENC[AES256_GCM,data:DA==,iv:GdBEVcE2ToUdwgww1++fh60GGL96PucOILGPjKEeHLE=,tag:GvIYxDPL9EJu2EuNCXYtfw==,type:float]",
 	"terraform_version": "ENC[AES256_GCM,data:s+lt+C0=,iv:QTliFVJ4Fv2/BNyEBsXcbn0il5fwF/wdYSSSc7DZOHw=,tag:agzN8FCZyQz6yswEsLjPtw==,type:str]",
-	"serial": "ENC[AES256_GCM,data:76G9,iv:yyazTOHGHAFji7l3w+xdbYyuNdnRbat3uFdqaTNkxEo=,tag:845S2jlBcz00B2vT0NvOZQ==,type:float]",
+	"serial": "ENC[AES256_GCM,data:lCGf,iv:ziGsprwL7AVUh4St0ggxNQIB2YcWwOkQDVGt+wtnO6I=,tag:IX+kbvQQ+as8NS7pHM/W+g==,type:float]",
 	"lineage": "ENC[AES256_GCM,data:Sb4CNlQprBlipfl9raqhcDOI3sSl3AHXsH6RwFc9hBUjlWp7,iv:IgEWvow6VgNFcoya2s0fYGCrjjZEtCl/u0Z9nZva9a8=,tag:B9sYMaj74F9wfqj+bYG1Kw==,type:str]",
 	"outputs": {
 		"b2_download_url": {
@@ -558,7 +558,7 @@
 				{
 					"schema_version": "ENC[AES256_GCM,data:BQ==,iv:Qej/dQ3fEnFT/KutZj6BFDS4ttA0J1ssJ/S4PGZoz+c=,tag:f18e26nlMalvzBqtvarBbA==,type:float]",
 					"attributes": {
-						"account_auth_token": "ENC[AES256_GCM,data:aQN+5wb2afQBTf7tctHJjVoIysWGvA5a3y6jlrLZcW14zEjeo719fWt42Xc8KtfF2x8vCnv8WQiqNrpxCDEvs6ZqlnmYYA17CqMw5TE=,iv:VvXhk4T+MvJpkbRQL8lojBOZYhfwrAQKaoM6Jy7vOPE=,tag:IYT3ynt/HdpwRK13YQbwQw==,type:str]",
+						"account_auth_token": "ENC[AES256_GCM,data:R6UKm7d8P9rPs6N/9vNMw2ma9/txf+h1yYLDS2rBdsC5GloVgu383CQT57c4MYZvkCqR739QZ5Ro2WMwULmDPCAbE9pwzYIS35Wc6Ds=,iv:8beGuoe5ZVGCiEiKvUJ9vL2PGA29lo+NS8ivH0+EjvA=,tag:NGaoR2hqbac4klUcbXi/Mg==,type:str]",
 						"account_id": "ENC[AES256_GCM,data:QewE+/YBQ1OablFU,iv:Am+Nb5FTd7V72IjakAXExYzjXkMe/Nk8zKca64QecUQ=,tag:oby4APzbN5y9/kMCuneJuw==,type:str]",
 						"allowed": [
 							{
@@ -1577,6 +1577,48 @@
 				}
 			]
 		},
+		{
+			"mode": "ENC[AES256_GCM,data:9YEdweN39g==,iv:7uD7Z4hvBgtJsCdssNGM9MqCLp2k/MZ5awobbrgBinY=,tag:rm5rtkWN3r0ysCHjmM+kPQ==,type:str]",
+			"type": "ENC[AES256_GCM,data:fC46WZQq8oFYUhM5eFdtD5c=,iv:R3JIrJS1FVpi0CHEw0FmBXyrooHfivdfuUxx3KhJzPs=,tag:2ibqe8JhvqNTD1uP0ZAQrA==,type:str]",
+			"name": "ENC[AES256_GCM,data:WuH4AjuqJpUV,iv:6ZRSupxM1IZX2xaC2K06anPzb+4+MNBIJfCrYL6N+2U=,tag:N/mV/1nR+4Rw39GWn8b5ug==,type:str]",
+			"provider": "ENC[AES256_GCM,data:bHyDSBAhtuGcdls65QzsG5CWKck4dS+DwCA/MV2GMnlo8N/MmxkcLKBAffT2ORe0Nfec/9pPuA==,iv:wNgBNkhBots2fzDTxxqHxICKG6URXMr4m9xgi5YGh70=,tag:ifzLHqt4HibUAdWt30bRRg==,type:str]",
+			"instances": [
+				{
+					"schema_version": "ENC[AES256_GCM,data:WQ==,iv:mL3jPY4R2NVjwosNJsj62hTvEpH7cUEc7xf6t4YaRoA=,tag:3McD5BPGks65HaHvmysxCA==,type:float]",
+					"attributes": {
+						"allow_overwrite": "ENC[AES256_GCM,data:nDHP8/Y=,iv:qmD4yOJ5WwE7ATtyw5YY5KqEWkKPQ9hystouHFaFwo0=,tag:E2T04NLHlexPqIZfAsYXmg==,type:bool]",
+						"comment": "",
+						"created_on": "ENC[AES256_GCM,data:LTMMe1tjzKKRKDHvLROndp2dKqbU4HSoO3o=,iv:bfsePRBiQGWactofuP9rBs10ZIlUOdfB2HvaqXL1WBU=,tag:bS5VAoFN9Bhq70sRs4Estg==,type:str]",
+						"data": [],
+						"hostname": "ENC[AES256_GCM,data:ZmPT5hHPn1uJx2gS,iv:l3ZP+0/3N9/+ec3pKdtZWZipw0vsd7/25sEWTpL24vw=,tag:hHfp5b11l8c2O9/qcdcJDA==,type:str]",
+						"id": "ENC[AES256_GCM,data:YXuJLRezFy5F17O5Gjj4lbUCuzuFrhxCKgMYOgJbVOY=,iv:/xHTW0aUK1PvCD4SP3Li/LMYBSj0qQ1/W1R4V/DuxNI=,tag:JaTZ5f6CJtJGeWOTSaQ7Kg==,type:str]",
+						"metadata": {
+							"auto_added": "ENC[AES256_GCM,data:V/Fb3pQ=,iv:DBo9vVWu+mNRpMJ2t+wUYc+nF1zw2PT4m/Lo80Ml1uc=,tag:2fURzVnI+TVqXWfQbTnZiw==,type:str]",
+							"managed_by_apps": "ENC[AES256_GCM,data:zA/X74U=,iv:hALlV25V/e6qaMCJbfbNnkhutd5QJCh8Y2OT/AtPiFQ=,tag:wV0vNhgMUA+8PENddDLkmw==,type:str]",
+							"managed_by_argo_tunnel": "ENC[AES256_GCM,data:xHvpaog=,iv:p0P1Btm/viQwvCCFpaQfACNZV+kTjx4hxXYly4CRXZU=,tag:wdrQS+P0Z5wWKkTbNBUd3Q==,type:str]",
+							"source": "ENC[AES256_GCM,data:/qe6+d1/Ow==,iv:rnWRGWIzu0SiV+2Sa6NRGkoY10r3kkHhOxBw9UUgqRQ=,tag:h4fIKF55I5vlDCaUQpz3OA==,type:str]"
+						},
+						"modified_on": "ENC[AES256_GCM,data:tPz52ZJm1gnfWYVb48Q/M/G7uFkJAhpJSHs=,iv:KSAwOVL3mv+iFdxbGoKJiLZpS2f5V+XiFlVruojl9es=,tag:he/F5rSzBeSBZgwiIHxw1A==,type:str]",
+						"name": "ENC[AES256_GCM,data:22RYiw==,iv:+ACjoVGaYeLQYeU6binbW+QSPi6SqkeuxZu0DeDbzOM=,tag:iUAXFnePYv1pSKALPmhf9Q==,type:str]",
+						"priority": null,
+						"proxiable": "ENC[AES256_GCM,data:t850OQ==,iv:WiswvcBLYZaC22/vfVP7wHIHeterHbYtKZsigsr6XQU=,tag:VoPnyaxcsMH/pPQ2uk2w1g==,type:bool]",
+						"proxied": "ENC[AES256_GCM,data:Gj/XvL0=,iv:cacKpUeqNfo67oix+L9JVqB89xRAtCXsz2FjZladD1s=,tag:hpBAA4yhuPooWW0eGoe7Ig==,type:bool]",
+						"tags": null,
+						"timeouts": null,
+						"ttl": "ENC[AES256_GCM,data:Xg==,iv:cAqUsv0ncrbVe9fHJ3Us1wfGKniCfWCHC/eHDliY1mg=,tag:yT620bKr9cyA6oUFnI0IfQ==,type:float]",
+						"type": "ENC[AES256_GCM,data:dd5shD8=,iv:z9LnV4WnzsBLClMtuLOsSTbbXQ9k3thibXs3sy8Ui9k=,tag:6/8jx8RQe1c5YPcW5/9lBQ==,type:str]",
+						"value": "ENC[AES256_GCM,data:1APtE4QGZYf7ToBkmefuPQ==,iv:TA3WvZxgwG3gO2h6vWXZxwy+vy94uZJRqm/a0e5bDYc=,tag:Dt9q6IPjsFfot7pCrYrLxg==,type:str]",
+						"zone_id": "ENC[AES256_GCM,data:Ym33sWlYfplIYlA9puc3n32J/h6Ao79xc5UeCjqZ5D8=,iv:RWIXFe7XrdEYnE/+kpiHRW+GwuWV35b3cW19iIEXbQE=,tag:nX3mEbYz8O00T9VusWIG7A==,type:str]"
+					},
+					"sensitive_attributes": [],
+					"private": "ENC[AES256_GCM,data:eQpoykVBvx3m+cQededUyz5Q2uLDD/gXU+IQIxsc0U00pJ6HiUPEfQ5X5Bwq+NqVsirRXqx0M3sqw5yqHJEv/BA8sTSaGmiSlCPTxHbVkih80LhUNs05ebEBxbamNLrBc4MKGx0XUFx/PdaYNhc/fArGjAT9zJgACoRvCuKk0r2p680e1o4HQUKQlZQ=,iv:zfrH0HDH0+uePJPAzvHP+xB+jFWnlze5IQ50E8X97vQ=,tag:4s09JR9BkStUnujzTgCW2g==,type:str]",
+					"dependencies": [
+						"ENC[AES256_GCM,data:j551f0G5LBwpJTmK1u6Qo9sG1FXVvjk=,iv:iittvyonSfUdNv8mUrZeTLlBjNWEd/xikQlczkakfhE=,tag:e9Dxs7lh31VvtOOGLzmnZw==,type:str]",
+						"ENC[AES256_GCM,data:0PNqiPVb8gigJe2mdEygIQpOalG7IOJ9,iv:nwXpcRKLlFhAQA5yjZcVda+WDlcFAyiYM8Hd9PbcQvI=,tag:jXdllEd0uHkcB6pYCZ0TgQ==,type:str]"
+					]
+				}
+			]
+		},
 		{
 			"mode": "ENC[AES256_GCM,data:9YEdweN39g==,iv:7uD7Z4hvBgtJsCdssNGM9MqCLp2k/MZ5awobbrgBinY=,tag:rm5rtkWN3r0ysCHjmM+kPQ==,type:str]",
 			"type": "ENC[AES256_GCM,data:fC46WZQq8oFYUhM5eFdtD5c=,iv:R3JIrJS1FVpi0CHEw0FmBXyrooHfivdfuUxx3KhJzPs=,tag:2ibqe8JhvqNTD1uP0ZAQrA==,type:str]",
@@ -1619,6 +1661,48 @@
 				}
 			]
 		},
+		{
+			"mode": "ENC[AES256_GCM,data:9YEdweN39g==,iv:7uD7Z4hvBgtJsCdssNGM9MqCLp2k/MZ5awobbrgBinY=,tag:rm5rtkWN3r0ysCHjmM+kPQ==,type:str]",
+			"type": "ENC[AES256_GCM,data:fC46WZQq8oFYUhM5eFdtD5c=,iv:R3JIrJS1FVpi0CHEw0FmBXyrooHfivdfuUxx3KhJzPs=,tag:2ibqe8JhvqNTD1uP0ZAQrA==,type:str]",
+			"name": "ENC[AES256_GCM,data:82n6kphF18xYzq92dLDFXYU=,iv:n3PbhCDtQ20WzASwjTzyhdgi6Q1GXOB1HCJTNCW2yRE=,tag:v6758ylcLvGLUEHyB578Wg==,type:str]",
+			"provider": "ENC[AES256_GCM,data:bHyDSBAhtuGcdls65QzsG5CWKck4dS+DwCA/MV2GMnlo8N/MmxkcLKBAffT2ORe0Nfec/9pPuA==,iv:wNgBNkhBots2fzDTxxqHxICKG6URXMr4m9xgi5YGh70=,tag:ifzLHqt4HibUAdWt30bRRg==,type:str]",
+			"instances": [
+				{
+					"schema_version": "ENC[AES256_GCM,data:WQ==,iv:mL3jPY4R2NVjwosNJsj62hTvEpH7cUEc7xf6t4YaRoA=,tag:3McD5BPGks65HaHvmysxCA==,type:float]",
+					"attributes": {
+						"allow_overwrite": "ENC[AES256_GCM,data:nDHP8/Y=,iv:qmD4yOJ5WwE7ATtyw5YY5KqEWkKPQ9hystouHFaFwo0=,tag:E2T04NLHlexPqIZfAsYXmg==,type:bool]",
+						"comment": "",
+						"created_on": "ENC[AES256_GCM,data:kLIRENL9aA9Uhfk8BJiMffHyYGx98+sAmYka,iv:xgBoQ94RM6TChwLjHYE2S9ACLuW9qGvJTR8frPc2+3c=,tag:Tz54PiSVq4fBooJG99Y8EA==,type:str]",
+						"data": [],
+						"hostname": "ENC[AES256_GCM,data:XNNfZjPduyPTuIu5VOEh5L2kkBU=,iv:00hDRQRjlAC9/IMzr+EOftmI3MI9eA5j+BSXCRYiejU=,tag:N4pLdJOww9i4qwAudpB3OQ==,type:str]",
+						"id": "ENC[AES256_GCM,data:wjsQOb9oaZ5AMzN73FYhCV8OY3oaD7fh6Jy0/eNYpTI=,iv:99Q00NvlNGIqLxEtAZ1mKiUWl5ousb9X3jbYQSfKcWE=,tag:Rp4e8XgTYFE6S5G97BvgtA==,type:str]",
+						"metadata": {
+							"auto_added": "ENC[AES256_GCM,data:V/Fb3pQ=,iv:DBo9vVWu+mNRpMJ2t+wUYc+nF1zw2PT4m/Lo80Ml1uc=,tag:2fURzVnI+TVqXWfQbTnZiw==,type:str]",
+							"managed_by_apps": "ENC[AES256_GCM,data:zA/X74U=,iv:hALlV25V/e6qaMCJbfbNnkhutd5QJCh8Y2OT/AtPiFQ=,tag:wV0vNhgMUA+8PENddDLkmw==,type:str]",
+							"managed_by_argo_tunnel": "ENC[AES256_GCM,data:xHvpaog=,iv:p0P1Btm/viQwvCCFpaQfACNZV+kTjx4hxXYly4CRXZU=,tag:wdrQS+P0Z5wWKkTbNBUd3Q==,type:str]",
+							"source": "ENC[AES256_GCM,data:/qe6+d1/Ow==,iv:rnWRGWIzu0SiV+2Sa6NRGkoY10r3kkHhOxBw9UUgqRQ=,tag:h4fIKF55I5vlDCaUQpz3OA==,type:str]"
+						},
+						"modified_on": "ENC[AES256_GCM,data:n+ZS5OTtAlxsdE7BlpTZCjgQaDzvpXJaMmm3,iv:PfiLUjKx6nMAehTuY5HD/ncutETJjDKan10IGDB0UIc=,tag:gx0PZ6WDZAF/D3Fskxcjlg==,type:str]",
+						"name": "ENC[AES256_GCM,data:WxPVNuEkcnxB2LFX,iv:7iNxz+gciM4xwjTb0C9TkhMew6nXJC0lYcSPhTVCPQY=,tag:arq3xk3aUSXVdTuYP2Ik9g==,type:str]",
+						"priority": null,
+						"proxiable": "ENC[AES256_GCM,data:t850OQ==,iv:WiswvcBLYZaC22/vfVP7wHIHeterHbYtKZsigsr6XQU=,tag:VoPnyaxcsMH/pPQ2uk2w1g==,type:bool]",
+						"proxied": "ENC[AES256_GCM,data:Gj/XvL0=,iv:cacKpUeqNfo67oix+L9JVqB89xRAtCXsz2FjZladD1s=,tag:hpBAA4yhuPooWW0eGoe7Ig==,type:bool]",
+						"tags": null,
+						"timeouts": null,
+						"ttl": "ENC[AES256_GCM,data:Xg==,iv:cAqUsv0ncrbVe9fHJ3Us1wfGKniCfWCHC/eHDliY1mg=,tag:yT620bKr9cyA6oUFnI0IfQ==,type:float]",
+						"type": "ENC[AES256_GCM,data:dd5shD8=,iv:z9LnV4WnzsBLClMtuLOsSTbbXQ9k3thibXs3sy8Ui9k=,tag:6/8jx8RQe1c5YPcW5/9lBQ==,type:str]",
+						"value": "ENC[AES256_GCM,data:00P7qehVZ8YSpk0wePnbDzuSXoQ=,iv:aOkqwbAuy64q25ehUDsxmsYzMwRTdLW9rl/VlM4pxKE=,tag:DdRXxvNog0Yrk+9wL8omzA==,type:str]",
+						"zone_id": "ENC[AES256_GCM,data:Ym33sWlYfplIYlA9puc3n32J/h6Ao79xc5UeCjqZ5D8=,iv:RWIXFe7XrdEYnE/+kpiHRW+GwuWV35b3cW19iIEXbQE=,tag:nX3mEbYz8O00T9VusWIG7A==,type:str]"
+					},
+					"sensitive_attributes": [],
+					"private": "ENC[AES256_GCM,data:eQpoykVBvx3m+cQededUyz5Q2uLDD/gXU+IQIxsc0U00pJ6HiUPEfQ5X5Bwq+NqVsirRXqx0M3sqw5yqHJEv/BA8sTSaGmiSlCPTxHbVkih80LhUNs05ebEBxbamNLrBc4MKGx0XUFx/PdaYNhc/fArGjAT9zJgACoRvCuKk0r2p680e1o4HQUKQlZQ=,iv:zfrH0HDH0+uePJPAzvHP+xB+jFWnlze5IQ50E8X97vQ=,tag:4s09JR9BkStUnujzTgCW2g==,type:str]",
+					"dependencies": [
+						"ENC[AES256_GCM,data:j551f0G5LBwpJTmK1u6Qo9sG1FXVvjk=,iv:iittvyonSfUdNv8mUrZeTLlBjNWEd/xikQlczkakfhE=,tag:e9Dxs7lh31VvtOOGLzmnZw==,type:str]",
+						"ENC[AES256_GCM,data:0PNqiPVb8gigJe2mdEygIQpOalG7IOJ9,iv:nwXpcRKLlFhAQA5yjZcVda+WDlcFAyiYM8Hd9PbcQvI=,tag:jXdllEd0uHkcB6pYCZ0TgQ==,type:str]"
+					]
+				}
+			]
+		},
 		{
 			"mode": "ENC[AES256_GCM,data:9YEdweN39g==,iv:7uD7Z4hvBgtJsCdssNGM9MqCLp2k/MZ5awobbrgBinY=,tag:rm5rtkWN3r0ysCHjmM+kPQ==,type:str]",
 			"type": "ENC[AES256_GCM,data:fC46WZQq8oFYUhM5eFdtD5c=,iv:R3JIrJS1FVpi0CHEw0FmBXyrooHfivdfuUxx3KhJzPs=,tag:2ibqe8JhvqNTD1uP0ZAQrA==,type:str]",
@@ -2180,48 +2264,6 @@
 				}
 			]
 		},
-		{
-			"mode": "ENC[AES256_GCM,data:9YEdweN39g==,iv:7uD7Z4hvBgtJsCdssNGM9MqCLp2k/MZ5awobbrgBinY=,tag:rm5rtkWN3r0ysCHjmM+kPQ==,type:str]",
-			"type": "ENC[AES256_GCM,data:fC46WZQq8oFYUhM5eFdtD5c=,iv:R3JIrJS1FVpi0CHEw0FmBXyrooHfivdfuUxx3KhJzPs=,tag:2ibqe8JhvqNTD1uP0ZAQrA==,type:str]",
-			"name": "ENC[AES256_GCM,data:QcgDSAj8rA==,iv:WAKzIYgEONwr0Ya9cp1PyqP82OuklxVg/UOTkxfQJ+Q=,tag:UezI6NTxOPMeOqK3TDSDVw==,type:str]",
-			"provider": "ENC[AES256_GCM,data:bHyDSBAhtuGcdls65QzsG5CWKck4dS+DwCA/MV2GMnlo8N/MmxkcLKBAffT2ORe0Nfec/9pPuA==,iv:wNgBNkhBots2fzDTxxqHxICKG6URXMr4m9xgi5YGh70=,tag:ifzLHqt4HibUAdWt30bRRg==,type:str]",
-			"instances": [
-				{
-					"schema_version": "ENC[AES256_GCM,data:WQ==,iv:mL3jPY4R2NVjwosNJsj62hTvEpH7cUEc7xf6t4YaRoA=,tag:3McD5BPGks65HaHvmysxCA==,type:float]",
-					"attributes": {
-						"allow_overwrite": "ENC[AES256_GCM,data:nDHP8/Y=,iv:qmD4yOJ5WwE7ATtyw5YY5KqEWkKPQ9hystouHFaFwo0=,tag:E2T04NLHlexPqIZfAsYXmg==,type:bool]",
-						"comment": "",
-						"created_on": "ENC[AES256_GCM,data:fTAXgVudsRgqlL4bCIBFNIyb53PHO+gfSIc=,iv:O88ksgkqlYnpxIP22WbomhTJuxOGNNDBznLnv5Kzihg=,tag:ve6jW4qfV1Rd1AhAfHfkeA==,type:str]",
-						"data": [],
-						"hostname": "ENC[AES256_GCM,data:ZmPT5hHPn1uJx2gS,iv:l3ZP+0/3N9/+ec3pKdtZWZipw0vsd7/25sEWTpL24vw=,tag:hHfp5b11l8c2O9/qcdcJDA==,type:str]",
-						"id": "ENC[AES256_GCM,data:HGzmqcf3R9fQ+UagTqqjziMAPcyCBimQcpQw59RoFGk=,iv:mfIMY5baTDOmTrYxajL42+Kkia6N5SDYAn6stUkvTU8=,tag:/lDg6AYvLNTEJjbkQJvZ5A==,type:str]",
-						"metadata": {
-							"auto_added": "ENC[AES256_GCM,data:V/Fb3pQ=,iv:DBo9vVWu+mNRpMJ2t+wUYc+nF1zw2PT4m/Lo80Ml1uc=,tag:2fURzVnI+TVqXWfQbTnZiw==,type:str]",
-							"managed_by_apps": "ENC[AES256_GCM,data:zA/X74U=,iv:hALlV25V/e6qaMCJbfbNnkhutd5QJCh8Y2OT/AtPiFQ=,tag:wV0vNhgMUA+8PENddDLkmw==,type:str]",
-							"managed_by_argo_tunnel": "ENC[AES256_GCM,data:xHvpaog=,iv:p0P1Btm/viQwvCCFpaQfACNZV+kTjx4hxXYly4CRXZU=,tag:wdrQS+P0Z5wWKkTbNBUd3Q==,type:str]",
-							"source": "ENC[AES256_GCM,data:/qe6+d1/Ow==,iv:rnWRGWIzu0SiV+2Sa6NRGkoY10r3kkHhOxBw9UUgqRQ=,tag:h4fIKF55I5vlDCaUQpz3OA==,type:str]"
-						},
-						"modified_on": "ENC[AES256_GCM,data:1DCJZWXeZmSBZccMeciWhREFkG2TSZIRhrM=,iv:za069cWn6EGMkxLjh9fSUON5oAQSNd3rDGSeLkbmTF0=,tag:OaejFORq90Yj2YdkBS+UJQ==,type:str]",
-						"name": "ENC[AES256_GCM,data:22RYiw==,iv:+ACjoVGaYeLQYeU6binbW+QSPi6SqkeuxZu0DeDbzOM=,tag:iUAXFnePYv1pSKALPmhf9Q==,type:str]",
-						"priority": null,
-						"proxiable": "ENC[AES256_GCM,data:t850OQ==,iv:WiswvcBLYZaC22/vfVP7wHIHeterHbYtKZsigsr6XQU=,tag:VoPnyaxcsMH/pPQ2uk2w1g==,type:bool]",
-						"proxied": "ENC[AES256_GCM,data:Gj/XvL0=,iv:cacKpUeqNfo67oix+L9JVqB89xRAtCXsz2FjZladD1s=,tag:hpBAA4yhuPooWW0eGoe7Ig==,type:bool]",
-						"tags": [],
-						"timeouts": null,
-						"ttl": "ENC[AES256_GCM,data:Xg==,iv:cAqUsv0ncrbVe9fHJ3Us1wfGKniCfWCHC/eHDliY1mg=,tag:yT620bKr9cyA6oUFnI0IfQ==,type:float]",
-						"type": "ENC[AES256_GCM,data:dd5shD8=,iv:z9LnV4WnzsBLClMtuLOsSTbbXQ9k3thibXs3sy8Ui9k=,tag:6/8jx8RQe1c5YPcW5/9lBQ==,type:str]",
-						"value": "ENC[AES256_GCM,data:1APtE4QGZYf7ToBkmefuPQ==,iv:TA3WvZxgwG3gO2h6vWXZxwy+vy94uZJRqm/a0e5bDYc=,tag:Dt9q6IPjsFfot7pCrYrLxg==,type:str]",
-						"zone_id": "ENC[AES256_GCM,data:Ym33sWlYfplIYlA9puc3n32J/h6Ao79xc5UeCjqZ5D8=,iv:RWIXFe7XrdEYnE/+kpiHRW+GwuWV35b3cW19iIEXbQE=,tag:nX3mEbYz8O00T9VusWIG7A==,type:str]"
-					},
-					"sensitive_attributes": [],
-					"private": "ENC[AES256_GCM,data:eQpoykVBvx3m+cQededUyz5Q2uLDD/gXU+IQIxsc0U00pJ6HiUPEfQ5X5Bwq+NqVsirRXqx0M3sqw5yqHJEv/BA8sTSaGmiSlCPTxHbVkih80LhUNs05ebEBxbamNLrBc4MKGx0XUFx/PdaYNhc/fArGjAT9zJgACoRvCuKk0r2p680e1o4HQUKQlZQ=,iv:zfrH0HDH0+uePJPAzvHP+xB+jFWnlze5IQ50E8X97vQ=,tag:4s09JR9BkStUnujzTgCW2g==,type:str]",
-					"dependencies": [
-						"ENC[AES256_GCM,data:j551f0G5LBwpJTmK1u6Qo9sG1FXVvjk=,iv:iittvyonSfUdNv8mUrZeTLlBjNWEd/xikQlczkakfhE=,tag:e9Dxs7lh31VvtOOGLzmnZw==,type:str]",
-						"ENC[AES256_GCM,data:0PNqiPVb8gigJe2mdEygIQpOalG7IOJ9,iv:nwXpcRKLlFhAQA5yjZcVda+WDlcFAyiYM8Hd9PbcQvI=,tag:jXdllEd0uHkcB6pYCZ0TgQ==,type:str]"
-					]
-				}
-			]
-		},
 		{
 			"mode": "ENC[AES256_GCM,data:9YEdweN39g==,iv:7uD7Z4hvBgtJsCdssNGM9MqCLp2k/MZ5awobbrgBinY=,tag:rm5rtkWN3r0ysCHjmM+kPQ==,type:str]",
 			"type": "ENC[AES256_GCM,data:iXgNbqlc81DrRGsxv552,iv:JVygPtFxMuJNDVKza6NpgPYKT5X2a/gHRLeVAGw5+DY=,tag:7iteavNk2e3lIGY/F73v9Q==,type:str]",
@@ -2791,7 +2833,7 @@
 						"comment": "",
 						"created_on": "ENC[AES256_GCM,data:D3f7U2CVfn3hCpZjE8AmICvbaMpJsKS3osDS,iv:JTRLYtlXttVBM1Van54A+udzxqL1vhwAPZ2fcLHP63g=,tag:hmr32uncZ6OZnpYsXio3sQ==,type:str]",
 						"data": [],
-						"hostname": "ENC[AES256_GCM,data:9wTqVqu06pcVbWY=,iv:v3+g7PtrJN775l5j9nPWi3KJcC/9sgcDnkX+oZPlDZk=,tag:CIWhcThr2MOMe/LwaJuZpA==,type:str]",
+						"hostname": "ENC[AES256_GCM,data:WQp5V+XqDEJtnlk=,iv:CuHt3YUoIl8O2ETghJCmflnhr64BkWDu1QxhR4Mzel8=,tag:ICvJMBZ7GiFbgCHQExlxuQ==,type:str]",
 						"id": "ENC[AES256_GCM,data:pjRItv9CMmTu0qXqXttIuaDApeMtGRIMEMsUKlXgBGQ=,iv:ebYRzcRyiKydlalSgWCfYt6xFWnguKm6yUf8wPoWaKs=,tag:jLYtgEdPt7CH6F8hqTXQcw==,type:str]",
 						"metadata": {
 							"auto_added": "ENC[AES256_GCM,data:V/Fb3pQ=,iv:DBo9vVWu+mNRpMJ2t+wUYc+nF1zw2PT4m/Lo80Ml1uc=,tag:2fURzVnI+TVqXWfQbTnZiw==,type:str]",
@@ -2799,16 +2841,16 @@
 							"managed_by_argo_tunnel": "ENC[AES256_GCM,data:xHvpaog=,iv:p0P1Btm/viQwvCCFpaQfACNZV+kTjx4hxXYly4CRXZU=,tag:wdrQS+P0Z5wWKkTbNBUd3Q==,type:str]",
 							"source": "ENC[AES256_GCM,data:/qe6+d1/Ow==,iv:rnWRGWIzu0SiV+2Sa6NRGkoY10r3kkHhOxBw9UUgqRQ=,tag:h4fIKF55I5vlDCaUQpz3OA==,type:str]"
 						},
-						"modified_on": "ENC[AES256_GCM,data:kVE882dso0UaxBHW+037DUHHJoFVv7M2CYPY,iv:vW+28aJaskz3bl7SxIVPIqskVT7Pvo5EhL8QkqZFVIk=,tag:APlxRgBtyeyAMB1qgS+a9g==,type:str]",
-						"name": "ENC[AES256_GCM,data:f8uK,iv:JSxvS13k6wIBVXhrCpkZmggI7ZtjRB/ptloBEY1wz1I=,tag:Lvuu1JHWyn4R5GPxvs6CZw==,type:str]",
+						"modified_on": "ENC[AES256_GCM,data:TCyKVSLlYMDo5jYzJqh0tEBli7eINvLUp2TI,iv:rSB24bAdKJFB4gESVaPZbXjKLNjfTbF5mgvlZ4MJU7Q=,tag:hYLYiUwLf7fQDWRjUzDuNw==,type:str]",
+						"name": "ENC[AES256_GCM,data:4eOO,iv:bJErsUsc7X+A9uMcI5MRl6N8HASbx9gLTNACqtn+5po=,tag:j+J95TcxZFgxvduF+v8jRg==,type:str]",
 						"priority": null,
-						"proxiable": "ENC[AES256_GCM,data:auUpQV4=,iv:sH/DkffebRne5X9uTR1qkJnsvYjArSIPS/beqAB/MIQ=,tag:71xFqFM7bfn51hIkYFBcPQ==,type:bool]",
+						"proxiable": "ENC[AES256_GCM,data:t850OQ==,iv:WiswvcBLYZaC22/vfVP7wHIHeterHbYtKZsigsr6XQU=,tag:VoPnyaxcsMH/pPQ2uk2w1g==,type:bool]",
 						"proxied": "ENC[AES256_GCM,data:Gj/XvL0=,iv:cacKpUeqNfo67oix+L9JVqB89xRAtCXsz2FjZladD1s=,tag:hpBAA4yhuPooWW0eGoe7Ig==,type:bool]",
-						"tags": null,
+						"tags": [],
 						"timeouts": null,
 						"ttl": "ENC[AES256_GCM,data:Xg==,iv:cAqUsv0ncrbVe9fHJ3Us1wfGKniCfWCHC/eHDliY1mg=,tag:yT620bKr9cyA6oUFnI0IfQ==,type:float]",
 						"type": "ENC[AES256_GCM,data:ng==,iv:EBx2MlZYLf6bXqoY9i+xWML7n7dmoY6UjhVenkhec78=,tag:1o10u4pkOoGJQXfxRNQtKg==,type:str]",
-						"value": "ENC[AES256_GCM,data:K9g0vfck/uHM,iv:QczuA+XOrLwsCaoLeGuPfmWWaKvxa2o/rVFzWlu6KeA=,tag:02i3GFMbg1wa8HAMJmm4oQ==,type:str]",
+						"value": "ENC[AES256_GCM,data:tHeWj0fsU9ObEXbP+10=,iv:SbVPyaNECC/6Y7ZsfqeVEG589zbvgr3NfVXAEeg//Uw=,tag:Leis0OH0zaKKJTCZUYq5Lg==,type:str]",
 						"zone_id": "ENC[AES256_GCM,data:Ym33sWlYfplIYlA9puc3n32J/h6Ao79xc5UeCjqZ5D8=,iv:RWIXFe7XrdEYnE/+kpiHRW+GwuWV35b3cW19iIEXbQE=,tag:nX3mEbYz8O00T9VusWIG7A==,type:str]"
 					},
 					"sensitive_attributes": [],
@@ -2834,16 +2876,16 @@
 							"managed_by_argo_tunnel": "ENC[AES256_GCM,data:xHvpaog=,iv:p0P1Btm/viQwvCCFpaQfACNZV+kTjx4hxXYly4CRXZU=,tag:wdrQS+P0Z5wWKkTbNBUd3Q==,type:str]",
 							"source": "ENC[AES256_GCM,data:/qe6+d1/Ow==,iv:rnWRGWIzu0SiV+2Sa6NRGkoY10r3kkHhOxBw9UUgqRQ=,tag:h4fIKF55I5vlDCaUQpz3OA==,type:str]"
 						},
-						"modified_on": "ENC[AES256_GCM,data:Zr1J9Yd+OO9PyHzDd01vd+DnbZIxbIfGHX4=,iv:B7HwCfYZv1VfEDw5+/TACv0KE4wXFVVjQwEK5C9v5fY=,tag:agpmeWJHZhE19/qJIcrsYQ==,type:str]",
+						"modified_on": "ENC[AES256_GCM,data:Y8zBK6nTRLDA/5RrASL5dE+iYj1S4hrIoc+E,iv:Vn1VpGJs/QLIRmBd8MYoM7/C84ecPuGAzTVOoDy8wO4=,tag:36A5tTX4KRBYzlOz31wD5Q==,type:str]",
 						"name": "ENC[AES256_GCM,data:4eOO,iv:bJErsUsc7X+A9uMcI5MRl6N8HASbx9gLTNACqtn+5po=,tag:j+J95TcxZFgxvduF+v8jRg==,type:str]",
 						"priority": null,
-						"proxiable": "ENC[AES256_GCM,data:auUpQV4=,iv:sH/DkffebRne5X9uTR1qkJnsvYjArSIPS/beqAB/MIQ=,tag:71xFqFM7bfn51hIkYFBcPQ==,type:bool]",
+						"proxiable": "ENC[AES256_GCM,data:t850OQ==,iv:WiswvcBLYZaC22/vfVP7wHIHeterHbYtKZsigsr6XQU=,tag:VoPnyaxcsMH/pPQ2uk2w1g==,type:bool]",
 						"proxied": "ENC[AES256_GCM,data:Gj/XvL0=,iv:cacKpUeqNfo67oix+L9JVqB89xRAtCXsz2FjZladD1s=,tag:hpBAA4yhuPooWW0eGoe7Ig==,type:bool]",
-						"tags": null,
+						"tags": [],
 						"timeouts": null,
 						"ttl": "ENC[AES256_GCM,data:Xg==,iv:cAqUsv0ncrbVe9fHJ3Us1wfGKniCfWCHC/eHDliY1mg=,tag:yT620bKr9cyA6oUFnI0IfQ==,type:float]",
 						"type": "ENC[AES256_GCM,data:8q5RZg==,iv:UesaF5uAu7l5xvKPPnQAOntx7ofafEXseLp3V1iH6+I=,tag:Q5s8rMDcsJT5+9huipPQaA==,type:str]",
-						"value": "ENC[AES256_GCM,data:9mdN,iv:t0PLXsv0E2UPvxuKezuMnCCAVvlczE+N0fuM2veA/gY=,tag:bab6eQNdGJ34d24JL+FTXA==,type:str]",
+						"value": "ENC[AES256_GCM,data:ZzB6yfdKqfHdEJmo5McSrXhbM0UefY7Hktavxg99ELFtTlVBo0w=,iv:TyWPs3PxX5begBcP4ULUE5A3ARfyG1Qa0WTesc8m3RQ=,tag:MHXwlXxa+dNFcfPg93xjcw==,type:str]",
 						"zone_id": "ENC[AES256_GCM,data:Ym33sWlYfplIYlA9puc3n32J/h6Ao79xc5UeCjqZ5D8=,iv:RWIXFe7XrdEYnE/+kpiHRW+GwuWV35b3cW19iIEXbQE=,tag:nX3mEbYz8O00T9VusWIG7A==,type:str]"
 					},
 					"sensitive_attributes": [],
@@ -2868,8 +2910,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0WVhVSmJoVzhPOVVuRHU2\nWmd3OUV2bDloWXpmR240NmgwcGV0TCs1Y25NCkVTQ1VyLzJwSW8vSE05SHJWRGFT\nZVpRZTdIL3Q1YThUbG5wMHlLSE9vWUEKLS0tIGl2RTRmTHpPSkdSMmhJSzRDVTBF\nUHJkNVpya3VHaGNMNlVSR2IxYW5wZjgKIcyE5De8f2UFjhmdlzupw5IThpvQdQI4\ngrnShrME+Zg8YuG+qSbteUQr05lAuxsQhIeueAh+MeKNY4i6gy7vxw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2024-02-23T05:22:12Z",
-		"mac": "ENC[AES256_GCM,data:4IATnDz15wLN3KZ0AEv+a+1yx6Sy42PBu0G8mI4FOvutf9P4sDOtXFqlzk+mhpylnuIKsDEse9urk0RcZFD0JSecvep41YaSwiS8IFw+a0nXZ4MzrtgkQApla3SSM4ikXoVDW1J8aFM+/kd3qMKHhGR0QrOrnJWqkyTkx2FJSJ0=,iv:yoSn+Zr0f5CMSAAUIz/SqqBmdIwBf+63eRqgjTuma+c=,tag:1z6JMJXkry8L3OKECnPTMA==,type:str]",
+		"lastmodified": "2024-02-24T15:42:30Z",
+		"mac": "ENC[AES256_GCM,data:yZz8+CezCyJGTV/eTcjUjt4laMbSy6Byv4vmmPPtf1y92xDeQMZ+qkMEQ4HFmfQ/wcLc5kZCapVWOZisA1Cp7g2pz0cg5ri0bkwBgBSrp+pvtowEFfLkB6X9nywFdDEXi6r9AVwUL/aYlellORg3YvAqsulAEVr9AQ+671Jf68s=,iv:toavDpSdln4AUrpT//bb9JYgqaQk0JaNkxGqHCVyl4w=,tag:xaVd8NLPTl+6GKKwj2ycAw==,type:str]",
 		"pgp": [
 			{
 				"created_at": "2023-06-18T10:50:13Z",
diff --git a/terraform/cloudflare.tf b/terraform/cloudflare.tf
index f0515f3d..5ff75e36 100644
--- a/terraform/cloudflare.tf
+++ b/terraform/cloudflare.tf
@@ -53,7 +53,7 @@ resource "cloudflare_zone_settings_override" "im_dora" {
 
 # CNAME records
 
-resource "cloudflare_record" "im_dora" {
+resource "cloudflare_record" "dora_shg0" {
   name    = "shg0"
   proxied = false
   ttl     = 1
@@ -61,6 +61,14 @@ resource "cloudflare_record" "im_dora" {
   value   = "home.sots.eu.org"
   zone_id = cloudflare_zone.im_dora.id
 }
+resource "cloudflare_record" "dora_subscription" {
+  name    = "subscription"
+  proxied = false
+  ttl     = 1
+  type    = "CNAME"
+  value   = "cname.vercel-dns.com."
+  zone_id = cloudflare_zone.im_dora.id
+}
 
 locals {
   service_cname_mappings = {