workflow: always() cache

.github/workflows/build-machines-and-homes.yml

@@ -3,6 +3,16 @@ on:
   workflow_dispatch:
   push:
   pull_request:
+env:
+  ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
+  NIX_CONFIG: |
+    show-trace = true
+    extra-substituters = https://cache.cy7.sh/main
+    extra-trusted-public-keys = main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0=
+    experimental-features = nix-command flakes
+    extra-experimental-features = nix-command flakes
+    accept-flake-config = true
+  TERM: ansi
 jobs:
   build-machines:
     strategy:
@@ -27,20 +37,11 @@ jobs:
           remove-docker-images: 'true'
           build-mount-path: /nix
       - name: Install Nix
-        uses: cachix/install-nix-action@v30
-        with:
-          install_url: https://releases.nixos.org/nix/nix-2.25.4/install
-          extra_nix_config: 'accept-flake-config = true'
+        uses: nixbuild/nix-quick-install-action@master
       - name: Sync repository
         uses: actions/checkout@v4
         with:
           persist-credentials: false
-      - uses: cachix/cachix-action@v14
-        with:
-          name: cything
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-          useDaemon: false
-          installCommand: nix profile install nixpkgs#cachix
       - name: Restore and cache Nix store
         uses: nix-community/cache-nix-action@v5.1.0
         with:
@@ -58,9 +59,24 @@ jobs:
           purge-primary-key: never
           # always save the cache
           save-always: true
-      - run: nix build -L .#nixosConfigurations.${{ matrix.machine }}.config.system.build.toplevel
+      - name: setup attic
+        run: |
+          nix profile install github:zhaofengli/attic
+          attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN"
+      - name: build
+        run: |
+          package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel"
+          nix build -L "$package"
+      - name: cache
+        if: always()
+        run: |
+          package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel"
+          derivation="$(nix path-info --derivation "$package")"
+          cache="$(nix-store --query --requisites --include-outputs "$derivation")"
+          xargs attic push main <<< "$cache"
   build-homes:
     strategy:
+      fail-fast: false
       matrix:
         home:
           - yt@ytnix
@@ -86,12 +102,6 @@ jobs:
         uses: actions/checkout@v4
         with:
           persist-credentials: false
-      - uses: cachix/cachix-action@v14
-        with:
-          name: cything
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-          useDaemon: false
-          installCommand: nix profile install nixpkgs#cachix
       - name: Restore and cache Nix store
         uses: nix-community/cache-nix-action@v5.1.0
         with:
@@ -109,4 +119,18 @@ jobs:
           purge-primary-key: never
           # always save the cache
           save-always: true
-      - run: nix build -L .#homeConfigurations."${{ matrix.home }}".activationPackage
+      - name: setup attic
+        run: |
+          nix profile install github:zhaofengli/attic
+          attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN"
+      - name: build
+        run: |
+          package=".#homeConfigurations."${{ matrix.home }}".activationPackage"
+          nix build -L "$package"
+      - name: cache
+        if: always()
+        run: |
+          package=".#homeConfigurations."${{ matrix.home }}".activationPackage"
+          derivation="$(nix path-info --derivation "$package")"
+          cache="$(nix-store --query --requisites --include-outputs "$derivation")"
+          attic push main --stdin <<< "$cache"

.github/workflows/build-packages.yml

@@ -6,6 +6,16 @@ on:
         description: "package to build"
         required: false
         type: string
+env:
+  ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
+  NIX_CONFIG: |
+    show-trace = true
+    extra-substituters = https://cache.cy7.sh/main
+    extra-trusted-public-keys = main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0=
+    experimental-features = nix-command flakes
+    extra-experimental-features = nix-command flakes
+    accept-flake-config = true
+  TERM: ansi
 jobs:
   build-packages:
     strategy:
@@ -22,17 +32,26 @@ jobs:
     steps:
       - name: Install Nix
         uses: cachix/install-nix-action@v30
-
       - name: Sync repository
         uses: actions/checkout@v4
         with:
           persist-credentials: false
-
-      - uses: cachix/cachix-action@v14
-        with:
-          name: cything
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-          useDaemon: false
-          installCommand: nix profile install nixpkgs#cachix
-
+      - name: setup attic
+        run: |
+          nix profile install github:zhaofengli/attic
+          attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN"
       - run: nix build -L ${{ matrix.package }}
+      - name: cache result
+        if: always()
+        run: |
+          derivation="$(nix path-info --derivation "${{ matrix.package }}")"
+          cache="$(nix-store --query --requisites --include-outputs "$derivation")"
+          xargs attic push main <<< "$cache"
+      - name: prepare tarball to upload
+        run: nix run github:nixos/nixpkgs#gnutar hcvf result.tar result
+      - name: upload result
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.os }}
+          path: result.tar
+          if-no-files-found: error

.sops.yaml

@@ -118,9 +118,8 @@ creation_rules:
       - age:
           - *chunk
           - *cy
-
   - path_regex: secrets/services/searx.yaml
     key_groups:
       - age:
           - *chunk
-          - *cy
+          - *cy

flake.lock

@@ -342,6 +342,38 @@
         "type": "github"
       }
     },
+    "garage": {
+      "inputs": {
+        "crane": [
+          "crane"
+        ],
+        "flake-compat": [
+          "flake-compat"
+        ],
+        "flake-utils": [
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": [
+          "rust-overlay"
+        ]
+      },
+      "locked": {
+        "lastModified": 1741360584,
+        "narHash": "sha256-5UkuvKllBRhU943imyc0jHDXQDVhIFx5WWUr3qrLEWQ=",
+        "owner": "deuxfleurs-org",
+        "repo": "garage",
+        "rev": "c96be1a9a8aa3b51075678888b80c2414ead2909",
+        "type": "github"
+      },
+      "original": {
+        "owner": "deuxfleurs-org",
+        "repo": "garage",
+        "type": "github"
+      }
+    },
     "git-hooks": {
       "inputs": {
         "flake-compat": [
@@ -1002,6 +1034,7 @@
         "flake-compat": "flake-compat_2",
         "flake-parts": "flake-parts_2",
         "flake-utils": "flake-utils",
+        "garage": "garage",
         "home-manager": "home-manager",
         "lanzaboote": "lanzaboote",
         "lix": "lix",

flake.nix

@@ -88,6 +88,16 @@
         crane.follows = "crane";
       };
     };
+    garage = {
+      url = "github:deuxfleurs-org/garage";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        rust-overlay.follows = "rust-overlay";
+        crane.follows = "crane";
+        flake-compat.follows = "flake-compat";
+        flake-utils.follows = "flake-utils";
+      };
+    };
 
     nvim-github-theme = {
       url = "github:projekt0n/github-nvim-theme";
@@ -103,15 +113,12 @@
   nixConfig = {
     extra-substituters = [
       "https://nix-community.cachix.org"
-      "https://cache.garnix.io"
-      "https://cything.cachix.org"
+      "https://cache.cy7.sh/main"
     ];
     extra-trusted-public-keys = [
       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-      "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
-      "cything.cachix.org-1:xqW1W5NNL+wrM9wfSELb0MLj/harD2ZyB4HbdaMyvPI="
+      "main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0="
     ];
-    builders-use-substitutes = true;
   };
 
   outputs =

home/codium.nix

@@ -10,8 +10,7 @@
       extensions =
         # if unfree
         # with pkgs.vscode-marketplace;
-        with pkgs.open-vsx;
-        [
+        with pkgs.open-vsx; [
           vscodevim.vim
           jnoortheen.nix-ide
           github.github-vscode-theme
@@ -21,6 +20,8 @@
           tomrijndorp.find-it-faster
           streetsidesoftware.code-spell-checker
           emilast.logfilehighlighter
+          tamasfe.even-better-toml
+          golang.go
         ];
       userSettings =
         let

home/yt/ytnix.nix

@@ -102,6 +102,7 @@
       pixelflasher
       element-desktop
       freetube
+      gopls
     ];
 
   home.sessionVariables = {
@@ -112,13 +113,13 @@
     RUSTC_WRAPPER = "${lib.getExe pkgs.sccache}";
     SCCACHE_BUCKET = "sccache";
     SCCACHE_REGION = "us-east-1";
-    SCCACHE_ENDPOINT = "https://e3e97aac307d106a7becea43cef8fcbd.r2.cloudflarestorage.com";
+    SCCACHE_ENDPOINT = "https://s3.cy7.sh";
     SCCACHE_ALLOW_CORE_DUMPS = "true";
     SCCACHE_S3_USE_SSL = "true";
     SCCACHE_CACHE_MULTIARCH = "true";
     SCCACHE_LOG = "warn";
     AWS_DEFAULT_REGION = "us-east-1";
-    AWS_ENDPOINT_URL = "https://e3e97aac307d106a7becea43cef8fcbd.r2.cloudflarestorage.com";
+    AWS_ENDPOINT_URL = "https://s3.cy7.sh";
     AWS_ACCESS_KEY_ID = "$(cat /run/secrets/aws/key_id)";
     AWS_SECRET_ACCESS_KEY = "$(cat /run/secrets/aws/key_secret)";
 

hosts/chunk/default.nix

@@ -22,7 +22,6 @@
     ./forgejo.nix
     ./garage.nix
     ./tailscale.nix
-    ./tor.nix
   ];
 
   sops.age.keyFile = "/root/.config/sops/age/keys.txt";
@@ -101,22 +100,18 @@
           ${tc} qdisc del dev ens18 root || true
 
           # create HTB hierarchy
-          ${tc} qdisc add dev ens18 root handle 1: htb default 30
+          ${tc} qdisc add dev ens18 root handle 1: htb default 10
           ${tc} class add dev ens18 parent 1: classid 1:1 htb rate 100% ceil 100%
-          # tailscale
-          ${tc} class add dev ens18 parent 1:1 classid 1:10 htb rate 30% ceil 100%
-          # caddy
-          ${tc} class add dev ens18 parent 1:1 classid 1:20 htb rate 30% ceil 100%
           # rest
+          ${tc} class add dev ens18 parent 1:1 classid 1:10 htb rate 60% ceil 100%
+          # caddy
           ${tc} class add dev ens18 parent 1:1 classid 1:30 htb rate 40% ceil 100%
 
           # mark traffic
-          iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/tailscaled.service" -j MARK --set-mark 1
-          iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/caddy.service" -j MARK --set-mark 2
+          iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/caddy.service" -j MARK --set-mark 3
 
           # route marked packets
-          ${tc} filter add dev ens18 parent 1: protocol ip prio 1 handle 1 fw flowid 1:10
-          ${tc} filter add dev ens18 parent 1: protocol ip prio 1 handle 2 fw flowid 1:20
+          ${tc} filter add dev ens18 parent 1: protocol ip prio 1 handle 3 fw flowid 1:30
         '';
     };
     interfaces.ens18 = {

hosts/chunk/garage.nix

@@ -10,15 +10,13 @@
         api_bind_addr = "[::]:3900";
         root_domain = "s3.cy7.sh";
       };
-      s3_web = {
-        bind_addr = "[::]:3902";
-        root_domain = ".web.s3.cy7.sh";
-        index = "index.html";
-      };
       admin.api_bind_addr = "[::]:3903";
       rpc_bind_addr = "[::]:3901";
       replication_factor = 1;
       db_engine = "lmdb";
+      disable_scrub = true;
+      block_size = "10M";
+      compression_level = "none";
     };
     environmentFile = config.sops.secrets."garage/env".path;
   };
@@ -31,10 +29,6 @@
         reverse_proxy localhost:3900
       '';
     };
-    "*.web.s3.cy7.sh".extraConfig = ''
-      import common
-      reverse_proxy localhost:3902
-    '';
     "admin.s3.cy7.sh".extraConfig = ''
       import common
       reverse_proxy localhost:3903

hosts/chunk/grafana.nix

@@ -29,6 +29,14 @@
           }
         ];
       }
+      {
+        job_name = "garage";
+        static_configs = [
+          {
+            targets = [ "127.0.0.1:3903" ];
+          }
+        ];
+      }
     ];
   };
 

hosts/chunk/rclone.nix

@@ -15,9 +15,16 @@
     serviceConfig = {
       Type = "notify";
       ExecStartPre = "/usr/bin/env mkdir -p /mnt/photos";
-      ExecStart = "${lib.getExe pkgs.rclone} mount --config ${
-        config.sops.secrets."rclone/config".path
-      } --cache-dir /var/cache/rclone --transfers=32 --checkers=32 --dir-cache-time 72h --vfs-cache-mode writes --vfs-cache-max-size 2G photos: /mnt/photos ";
+      ExecStart = ''
+        ${lib.getExe pkgs.rclone} mount \
+          --config ${config.sops.secrets."rclone/config".path} \
+          --cache-dir /var/cache/rclone \
+          --transfers=32 \
+          --dir-cache-time 30d \
+          --vfs-cache-mode writes \
+          --vfs-cache-max-size 2G \
+          photos: /mnt/photos
+      '';
       ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -u /mnt/photos";
     };
   };
@@ -32,9 +39,22 @@
     serviceConfig = {
       Type = "notify";
       ExecStartPre = "/usr/bin/env mkdir -p /mnt/garage";
-      ExecStart = "${lib.getExe pkgs.rclone} mount --config ${
-        config.sops.secrets."rclone/config".path
-      } --cache-dir /var/cache/rclone --transfers=32 --checkers=32 --vfs-cache-mode writes --vfs-cache-max-size 5G --allow-other rsyncnet:garage /mnt/garage ";
+      ExecStart = ''
+        ${lib.getExe pkgs.rclone} mount \
+          --config ${config.sops.secrets."rclone/config".path} \
+          --allow-other \
+          --cache-dir /var/cache/rclone \
+          --transfers=32 \
+          --vfs-cache-mode full \
+          --vfs-cache-min-free-space 5G \
+          --dir-cache-time 30d \
+          --no-checksum \
+          --no-modtime \
+          --vfs-fast-fingerprint \
+          --vfs-read-chunk-size 10M \
+          --vfs-read-chunk-streams 32 \
+          rsyncnet:garage /mnt/garage
+      '';
       ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -u /mnt/garage";
     };
   };

hosts/chunk/tor.nix

@@ -1,16 +0,0 @@
-{ ... }:
-{
-  services.tor = {
-    enable = true;
-    openFirewall = true;
-    relay = {
-      enable = true;
-      role = "relay";
-    };
-    settings = {
-      ORPort = 9001;
-      Nickname = "chunk";
-      # MaxAdvertisedBandwidth = "20MBytes";
-    };
-  };
-}

hosts/common.nix

@@ -10,16 +10,12 @@
         "@wheel"
       ];
       trusted-public-keys = [
-        "niri.cachix.org-1:Wv0OmO7PsuocRKzfDoJ3mulSl7Z6oezYhGhR+3W2964="
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
-        "cything.cachix.org-1:xqW1W5NNL+wrM9wfSELb0MLj/harD2ZyB4HbdaMyvPI="
+        "main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0="
       ];
-      substituters = [
-        "https://niri.cachix.org"
+      trusted-substituters = [
         "https://nix-community.cachix.org"
-        "https://cache.garnix.io"
-        "https://cything.cachix.org"
+        "https://cache.cy7.sh/main"
       ];
     };
     channel.enable = false;
@@ -33,9 +29,6 @@
       persistent = true;
       options = "--delete-older-than 14d";
     };
-    extraOptions = ''
-      builders-use-substitutes = true
-    '';
     registry.nixpkgs.flake = inputs.nixpkgs;
   };
 

hosts/ytnix/containers.nix

@@ -1,4 +1,4 @@
-{ 
+{
   config,
   pkgs,
   lib,
@@ -6,20 +6,22 @@
 }:
 {
   virtualisation.oci-containers.containers = {
-    immich-ml = let
-      modelCache = "/opt/immich-ml";
-    in {
-      image = "ghcr.io/immich-app/immich-machine-learning:release";
-      autoStart = true;
-      pull = "newer";
-      ports = [ "3003:3003" ];
-      environment = {
-        REDIS_HOSTNAME = "immich-redis";
-        DB_HOSTNAME = "immich-db";
+    immich-ml =
+      let
+        modelCache = "/opt/immich-ml";
+      in
+      {
+        image = "ghcr.io/immich-app/immich-machine-learning:release";
+        autoStart = true;
+        pull = "newer";
+        ports = [ "3003:3003" ];
+        environment = {
+          REDIS_HOSTNAME = "immich-redis";
+          DB_HOSTNAME = "immich-db";
+        };
+        volumes = [ "${modelCache}:/cache" ];
+        networks = [ "immich-net" ];
       };
-      volumes = [ "${modelCache}:/cache" ];
-      networks = [ "immich-net" ];
-    };
   };
 
   systemd.services.create-immich-net = rec {
@@ -33,4 +35,4 @@
       ${lib.getExe pkgs.podman} network create immich-net
     '';
   };
-}
+}

hosts/ytnix/default.nix

@@ -144,49 +144,52 @@
     "docker"
     "disk"
     "adbusers"
+    "podman"
   ];
 
-  environment.systemPackages = with pkgs; lib.flatten [
-    tmux
-    vim
-    wget
-    tree
-    kitty
-    borgbackup
-    htop
-    file
-    dnsutils
-    q
-    age
-    compsize
-    wireguard-tools
-    traceroute
-    sops
-    sbctl # secure boot
-    lm_sensors
-    sshfs
-    openssl
-    just
-    killall
-    lshw
-    bubblewrap
-    fuse-overlayfs
-    dwarfs
-    wineWowPackages.stagingFull
-    (with gst_all_1; [
-      gst-plugins-good
-      gst-plugins-bad
-      gst-plugins-ugly
-      gst-plugins-base
-    ])
-    vulkan-loader
-    (heroic.override {
-      extraPkgs = pkgs: [
-        pkgs.gamescope
-        pkgs.gamemode
-      ];
-    })
-  ];
+  environment.systemPackages =
+    with pkgs;
+    lib.flatten [
+      tmux
+      vim
+      wget
+      tree
+      kitty
+      borgbackup
+      htop
+      file
+      dnsutils
+      q
+      age
+      compsize
+      wireguard-tools
+      traceroute
+      sops
+      sbctl # secure boot
+      lm_sensors
+      sshfs
+      openssl
+      just
+      killall
+      lshw
+      bubblewrap
+      fuse-overlayfs
+      dwarfs
+      wineWowPackages.stagingFull
+      (with gst_all_1; [
+        gst-plugins-good
+        gst-plugins-bad
+        gst-plugins-ugly
+        gst-plugins-base
+      ])
+      vulkan-loader
+      (heroic.override {
+        extraPkgs = pkgs: [
+          pkgs.gamescope
+          pkgs.gamemode
+        ];
+      })
+    ];
 
   environment.sessionVariables = {
     NIXOS_OZONE_WL = "1";
@@ -384,4 +387,5 @@
   programs.ccache.enable = true;
   nix.settings.extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
   programs.fuse.userAllowOther = true;
+  nix.settings.sandbox = false;
 }

modules/attic.nix

@@ -21,7 +21,7 @@ in
         allowed-hosts = [ "cache.cy7.sh" ];
         require-proof-of-possession = false;
         compression = {
-          type = "zstd";
+          type = "none";
           level = 3;
         };
         database.url = "postgresql:///atticd?host=/run/postgresql";
@@ -44,4 +44,4 @@ in
       reverse_proxy localhost:8091
     '';
   };
-}
+}

modules/containerization.nix

@@ -28,8 +28,11 @@ in
           dns_enabled = true;
           ipv6_enabled = true;
         };
+        # answer on /var/run/docker.sock
+        dockerSocket.enable = true;
       };
-      oci-containers.backend = lib.mkIf cfg.usePodman "podman";
+      docker.enable = lib.mkIf (!cfg.usePodman) true;
+      oci-containers.backend = lib.mkIf (!cfg.usePodman) "docker";
     };
   };
 }

modules/searx.nix

@@ -44,4 +44,4 @@ in
       reverse_proxy 127.0.0.1:8090
     '';
   };
-}
+}

modules/vaultwarden.nix

@@ -29,4 +29,4 @@ in
       };
     };
   };
-}
+}

overlay/attic/default.nix

@@ -0,0 +1,7 @@
+final: prev: {
+  attic-server = prev.attic-server.overrideAttrs {
+    patches = [
+      ./prefetch-32-chunks.patch
+    ];
+  };
+}

overlay/attic/prefetch-32-chunks.patch

@@ -0,0 +1,13 @@
+diff --git a/server/src/api/binary_cache.rs b/server/src/api/binary_cache.rs
+index 02e4857..71eeee8 100644
+--- a/server/src/api/binary_cache.rs
++++ b/server/src/api/binary_cache.rs
+@@ -262,7 +262,7 @@ async fn get_nar(
+ 
+         // TODO: Make num_prefetch configurable
+         // The ideal size depends on the average chunk size
+-        let merged = merge_chunks(chunks, streamer, storage, 2).map_err(|e| {
++        let merged = merge_chunks(chunks, streamer, storage, 32).map_err(|e| {
+             tracing::error!(%e, "Stream error");
+             e
+         });

overlay/bitwarden/default.nix

@@ -1,7 +1,9 @@
 final: prev: {
-  bitwarden-desktop = prev.bitwarden-desktop.overrideAttrs (finalAttrs: prevAttrs: {
-    patches = prevAttrs.patches ++ [
-      ./ssh-agent-no-confirm.patch
-    ];
-  });
-}
+  bitwarden-desktop = prev.bitwarden-desktop.overrideAttrs (
+    finalAttrs: prevAttrs: {
+      patches = prevAttrs.patches ++ [
+        ./ssh-agent-no-confirm.patch
+      ];
+    }
+  );
+}

overlay/default.nix

@@ -3,6 +3,7 @@ let
   overlays = [
     ./zipline
     ./bitwarden
+    ./attic
   ];
   importedOverlays = map (m: import m) overlays;
 in
@@ -14,12 +15,16 @@ in
       pkgFrom = flake: pkg: flake.packages.${prev.system}.${pkg};
     in
     {
-      conduwuit =
-       pkgFrom inputs.conduwuit "static-x86_64-linux-musl-all-features-x86_64-haswell-optimised";
+      conduwuit = pkgFrom inputs.conduwuit "static-x86_64-linux-musl-all-features-x86_64-haswell-optimised";
       pixelflasher = nixpkgsFrom inputs.pixelflasher "pixelflasher";
       attic-server = pkgFrom inputs.attic "attic-server";
       attic = pkgFrom inputs.attic "attic";
+      garage = (
+        (pkgFrom inputs.garage "default").overrideAttrs {
+          meta.mainProgram = "garage";
+        }
+      );
     }
   )
 ]
-++ importedOverlays
+++ importedOverlays

secrets/yt/aws.yaml

@@ -1,6 +1,8 @@
 aws:
-    key_id: ENC[AES256_GCM,data:9tWAMzUv4f6Ea27XsmYhO11NroYnLmED/FVrCCGO0Vc=,iv:YP1xRjVd1M1MB7IKVAw0Sdx0E4AokBrsaAcDLvTLHD4=,tag:SEmEr3NoZvch9LeaJHbCww==,type:str]
-    key_secret: ENC[AES256_GCM,data:AK+vER4T1p0AknKzsxZQJ0JTpfIstnnTWSAZ26zJSCwJYgRYwj8RF98CS7HM+KWvz5VNGENxhVdUnjlGkrTB4w==,iv:3o79gwp5b4KGsixW02qFWYFvpagY/hykbYJ/WNz6PB8=,tag:GW2T8ggKYHa1CQ6DRomJDQ==,type:str]
+    key_id: ENC[AES256_GCM,data:euyq+QtSXv1UR5eOJfvZARhm5L2AuzKIOk8=,iv:RseSyVArmrawNzlwjNh6FScJF2O+F4FBuIq47uMQQEA=,tag:bkZJeX3rUHb1yZu8dytgcg==,type:str]
+    key_secret: ENC[AES256_GCM,data:27BHAU5suCIiSKAf0+1yNa/VJ0umErb6Ry8HI+Zfv6LV+7eB+wk8H3kxdV4wmY2XayHsUrD4FZa30O0a9PdJgA==,iv:oI2X7PCXDZBkUOikHM8S7gHsnMtWp7jxBqdmfbUlrwU=,tag:9mZ3H2jobKqYmw6S4NNpjw==,type:str]
+    _r2_key_id: ENC[AES256_GCM,data:R0xwzUx+6l9SR3Fd93PfJw+WPV0ByzOKMxoJQtn4pEE=,iv:qHmr/HssM8U3znbGznSIOwkAhNaORkCkG9lqAmCKmfw=,tag:LhuiiKSq/VnNEulgrS71vg==,type:str]
+    _r2_key_secret: ENC[AES256_GCM,data:Dw5Gq1URjMpy9Bh1IBYf+/EnkvQA/4yAC4kdoACpCUuJQxdQphFKwWmxJX+Q/oztO1imWoGIxlZNNDr5QCqXaA==,iv:hGePo+Ffe48n1BXI1f2V12C9Gn1CC1nTwbSsfqUGQ3c=,tag:AIy/F3jPGz2WHge3Mk43Ag==,type:str]
     _garage_key_id: ENC[AES256_GCM,data:2lLS1nBhrwBkJh/ei7FwBoR6jOI6KCJkvOs=,iv:jwB7ZEaKOPIwghcGRs3qaICypoHgSxkFBOyB6e5hpYI=,tag:Iqwv3j1R1uLLUDKLhN1Atg==,type:str]
     _garage_key_secret: ENC[AES256_GCM,data:5iwwMfojHrR79cOIY+9O2oVY8v1cbPcECMSOMhWuGAdc2lfCogKBwLM4TFwBH9X1Vx56QvUoxCQ2uSyfOMLR7A==,iv:Q523ttz6ijmv8/JlVZuldFR4IabEKiVN4sGmJ9xDJU0=,tag:ZZ4LRG4DXOC7LY8hEjXYHQ==,type:str]
 sops:
@@ -27,8 +29,8 @@ sops:
             UlYrTExEUVc0dURLR1czN3BnYzZ2VGMKCbAgM50jvs9VciA1Pb/VY+2I4x62LBGe
             j7eHkfTFc8Gnk/rZA9/ZJDLFr/FUPMQWK/NVoz6oLjO6oVFXqN6OqA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-02-27T02:50:27Z"
-    mac: ENC[AES256_GCM,data:FjlbCqqYHPn/FDPUR1flWgg6wwHhLJx1uKOedwkvsTxuPhlVJHghTHWYetdmplOQyEpOEbyv+iqKTGDYHzDdgU2jIZ0TKM66iHq+1yft4TatBu75/0N3I+SfZv97vKNehxN/zvIY3FQF4O8qVy9c1dZRmr7q27Wq2pdHSOe4Myg=,iv:YkUXcOwb6UZr0vXazbLrVeGTvBTtnwuEIY3O+GSrnNk=,tag:kQBh7urSnHoiV18TIGlPEg==,type:str]
+    lastmodified: "2025-03-16T16:45:13Z"
+    mac: ENC[AES256_GCM,data:DCx4uVuy53Gz9Ha2p/GjxTigKw/dJ0gvWIAII9AtKQCURu1OfiJ6Lp/ht6ndJwn25em11uppN371pQGxa8FRtLL+dX/YgoDmOw3Tgo3lc5VLBzalRqXHInOGHfgv9k1jHNq6zokKbBLDItBnUNOCvsLTXXenVRYdnkiuf3QPGhk=,iv:gBbbH/nJExK/dEXKHo+cCr+rxQ4uJQWweK0lYT7amsM=,tag:9GaCGFrcinqGfpibUNQ75w==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.4