From f7e385d696d7c0dd0721648c35864253aec6ca34 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nikodem=20Rabuli=C5=84ski?= <nikodem@rabulinski.com>
Date: Sun, 25 Feb 2024 23:02:15 +0100
Subject: [PATCH] hosts/kazuki/ntfy: set up users declaratively

---
 hosts/kazuki/ntfy.nix           |  38 ++++++++++++++++++++++++++++++--
 secrets/alert-nrab-lol-pass.age |  12 +++++-----
 secrets/alert-plain-pass.age    |  12 +++++-----
 secrets/attic-creds.age         | Bin 452 -> 452 bytes
 secrets/github-token.age        |  26 +++++++++++-----------
 secrets/hercules-cache.age      | Bin 979 -> 979 bytes
 secrets/hercules-secrets.age    |  27 +++++++++++------------
 secrets/hercules-token.age      | Bin 888 -> 888 bytes
 secrets/leet-nrab-lol-pass.age  | Bin 384 -> 384 bytes
 secrets/legion-niko-pass.age    |  12 +++++-----
 secrets/nrab-lol-cf.age         |  13 ++++++-----
 secrets/ntfy-alert-pass.age     |  17 ++++++++++++++
 secrets/ntfy-niko-pass.age      |   7 ++++++
 secrets/secrets.nix             |   5 +++++
 secrets/storage-box-creds.age   |  12 +++++-----
 secrets/storage-box-webdav.age  | Bin 382 -> 382 bytes
 secrets/vault-cert-env.age      | Bin 380 -> 380 bytes
 17 files changed, 122 insertions(+), 59 deletions(-)
 create mode 100644 secrets/ntfy-alert-pass.age
 create mode 100644 secrets/ntfy-niko-pass.age

diff --git a/hosts/kazuki/ntfy.nix b/hosts/kazuki/ntfy.nix
index b6ae50d..54bde13 100644
--- a/hosts/kazuki/ntfy.nix
+++ b/hosts/kazuki/ntfy.nix
@@ -1,14 +1,27 @@
-{ config, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 {
   age.secrets.nrab-lol-cf = {
     file = ../../secrets/nrab-lol-cf.age;
     owner = config.services.nginx.user;
   };
+  age.secrets.ntfy-niko-pass = {
+    file = ../../secrets/ntfy-niko-pass.age;
+    owner = config.services.ntfy-sh.user;
+  };
+  age.secrets.ntfy-alert-pass = {
+    file = ../../secrets/ntfy-alert-pass.age;
+    owner = config.services.ntfy-sh.user;
+  };
 
   services.ntfy-sh = {
     enable = true;
     settings = {
-      base-url = "ntfy.nrab.lol";
+      base-url = "https://ntfy.nrab.lol";
       listen-http = "127.0.0.1:9800";
       behind-proxy = true;
       upstream-base-url = "https://ntfy.sh";
@@ -16,6 +29,27 @@
     };
   };
 
+  systemd.services.ntfy-sh.postStart =
+    let
+      ntfy = lib.getExe' config.services.ntfy-sh.package "ntfy";
+      script = pkgs.writeShellScript "ntfy-setup-users.sh" ''
+        ${ntfy} access everyone '*' deny
+
+        if ! ${ntfy} user list | grep -q 'user alert'; then
+          NTFY_PASSWORD="$(cat ${config.age.secrets.ntfy-alert-pass.path})" \
+            ${ntfy} user add alert
+          ${ntfy} access alert '*' write-only
+        fi
+
+        if ! ${ntfy} user list | grep -q 'user niko'; then
+          NTFY_PASSWORD="$(cat ${config.age.secrets.ntfy-niko-pass.path})" \
+            ${ntfy} user add niko
+          ${ntfy} access niko '*' read-only
+        fi
+      '';
+    in
+    toString script;
+
   users.users.nginx.extraGroups = [ "acme" ];
   networking.firewall.allowedTCPPorts = [
     80
diff --git a/secrets/alert-nrab-lol-pass.age b/secrets/alert-nrab-lol-pass.age
index d76c462..a41dc38 100644
--- a/secrets/alert-nrab-lol-pass.age
+++ b/secrets/alert-nrab-lol-pass.age
@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 84j9mw E/UAAPU36fEbTLcJqSHuXLkT9gM9SKJc69lHYZ6vsxA
-qtW5rBrMVMZlB9QAl1dJQW5wlXL9Xzzb6v0TgsVUH+I
--> ssh-ed25519 GKhvwg LVyoMAJOOeyBUUDvehyKVCMyaECs5f5nFiWFIWVcXlM
-zvoD1iS6LkgcuBwRlq8I7dL0js/881Flutn+aiWk4x8
---- qQutAtaqLW7+tjxs/t34QquhxIg+OZiGTmjGW4okQc8
-��0N�G%�*m��]~�����T�P]C�Ӛ�L��f�a�ì��To�T��
�E����{À��X�
�}�9��_�
���	nϏ|(f�-��
\ No newline at end of file
+-> ssh-ed25519 84j9mw 4n/zqW5iLJrCV7DkJjWVLqznKo5tCAtS3Ps42D3pGlA
+DikYMkhNvvXqVpuzLbKYrILImwYow6yS9zHHBEQbEi8
+-> ssh-ed25519 GKhvwg ZQmLaXauWbnXb/4/MSbYB5h9usBY02oowXNEkixBgRc
+LEV0jDifVtosFZYVOk5jBrd+koAh/B0uXnYO18HDU4g
+--- Uwt3RGREkK2dHLhhhjz+kGzAL8ik/mA3oPWnEuocXhk
+M�e�5~#�zB�]��F���k�7�5�%���!t|�T����ɖ���"c��K�8�I
�����ni��S��ؙ���a���]������8�
\ No newline at end of file
diff --git a/secrets/alert-plain-pass.age b/secrets/alert-plain-pass.age
index 0e3aee9..e638fc8 100644
--- a/secrets/alert-plain-pass.age
+++ b/secrets/alert-plain-pass.age
@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 ioPMHA bzpHiPf01dn6o2RorgjHtJLxEXTdX2vk5gzqeurKYWY
-PCZiMqJOHaVUfTmQAxfSi4R4K9EJv9lRlvzifcZBdlg
--> ssh-ed25519 GKhvwg 9LIgHkI9ai9sG5105/cckINKLZG1ZDLJoK4VseW4+Vo
-cRJkPh2P1qIeLiC8FBMaf3Q0mdcH6KMmhKIZ8AE7oxk
---- ak5uMosvoFn03re13Wvb5izecSpHrrtmJ21YdWAvNs0
-�t�<0�C2�QϾ�G�(���$���GGwB��� H3����rK���
\ No newline at end of file
+-> ssh-ed25519 ioPMHA 631XxPesBw0DC687j0Du8gyvwHuN8DrRMtVVVPJ3kEA
+A0zq6X8YgNVGMUBtpozcwXmy8pVQwtJRpelSPVywJ+Q
+-> ssh-ed25519 GKhvwg NPPNc8ZreWcjYkriM0fn76AoYO5HSFmGY2Dnbhjchlg
+fpchA60ze8fx3ooQlyRk9lapL+m90NLn+p6eKRoyy64
+--- KYS9LOiN9+RIlzyPZ71iqQ0c6I7MptxKzjfZzrEeAhs
+z	[�i��_�1x��>���G7�2�L��!�K,����[7��Q���
\ No newline at end of file
diff --git a/secrets/attic-creds.age b/secrets/attic-creds.age
index d72389c12613eb313170ed0abe7238fa766c58f7..94875acfec8cd6d05aa14ce5589d3c1956857d79 100644
GIT binary patch
delta 418
zcmX@Ye1v&|PQ7bMzH@L^xPh^LP(+lkWl?}xYO;QAX@$FKp;JLcc79rho26H(aYj&O
zD3@o7L3nssMMYF;in(LHxv8IJXn3GkfLD5MRg`&9RAq@tV5n=Bn~SzVI+w1ULUD11
zZfc5=si~o*g1dJ{S$VobkxPiFNtR)%VX0$gU{*+BRDEQyc1Uhgaga}lUv8GWVWEMu
zak@)hS#DlBmqAsKn_)<RWw^GNqot#<c6gYXr-y}0L2gN5aZXgeS!AMda*=<9xskUg
zm#(g^LTYNLSERXldZbg9PoS@FWt2&%OR#H|qnn9Elt*}`OM!v5Nrg+ezHezVmoKwh
z?t(7qZS|9S&%|V>mYn%K=Xingg~Izer)Q~ci1j-9?exD_9BQTBlfTuhv_0t9zx&6D
zc}4wwnVLoh+dnxfe#lAmJ8yAVtaDQ7!3v+V%ipKY6wH3gytvN%>0vJy>FNzaU5kEr
zX0h(Opfu&>C5Ce6_bZO2GV9ep>Y5o<Ae_p&<>LzP%bOoPmfomi>eRNeHt<=j#LwzF
SiH6R6F~uDLfA_5a*a-j)b)<>_

delta 418
zcmX@Ye1v&|PQAB5v1w{VxtWnykWqxUSz&6Jw|hWDiMM%JWqMF<q=`>hfpM~rQAkma
zBUeG1qjrUNiicZyl#9D*igB2WNw8T!VQHa3R!EVHhetrMpLvd>eqdf^AeXM4LUD11
zZfc5=si~o*g1dJ{S$VobrE!sORaHf>Uw&zZk6%bxWxZvhepY3GX<Bx^L6W<_pIc?J
zK}trpt8;`Smv4@FVNSY#WpR#Yh_Sv$RBnp9zo&0*US6esc)p`Yuz`C}wu?)8QKU&A
zm#(g^f_Ft_NP3}1S%_;+xMxvXc2$;7V7R|eO0uzkNN}06c4V=cYj93dd6-i<7Z2Ye
z{ST9F?yaA+*6pkDkC?9TiIXfV=lzxQ^zNUsU!(caK9zPefv*ioAEQKN<*UEEmTobX
zo#B4Cv*2g|$I4Sbg}Ib>+{u!b<q)_tYu}FRE^%cpaSiUX*Zk<{pI8xET@-!cjh2An
z+@IVUOB)*#J~~Gw-9G94cUB_9tu-g=Wjgu4=7mMD{YgG8ZOta;m-*+jaKXt*MJrAB
RXTI7R7N@v8H)O(<r2r*;qI&=U

diff --git a/secrets/github-token.age b/secrets/github-token.age
index 57261b7..516eb0e 100644
--- a/secrets/github-token.age
+++ b/secrets/github-token.age
@@ -1,14 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 IFuY+w BRVOB+nGZJ/43pUOJBXtYN9x65vGz+PeFBpUta4E7kM
-an/9NC1sk2IzT+YdaPYvGfdn5ZR8eU21/h5OjL4yddE
--> ssh-ed25519 84j9mw ndRBUsTQo3k/MQeQALBWZ8ZV86I+TjXbImDqm/ogMwU
-eTyKCxGOLdq+mVq88cqSn5Y8tPQx3tcOk2B41uCf3KM
--> ssh-ed25519 ioPMHA He7pM+kv7Mix/TsjevaXNnFt+a6uKAHdgqi/crJeIWQ
-0YWZf3na17QYViOVG3D7h7S/jgXWwZrslYHD+uFq3U4
--> ssh-ed25519 5A7peQ lNXbVWvO6oJyvuYZBzJOsgSSCW3jKqKU/FHiVStKfGw
-DckkP45wQ6i6vOqknKKoEYnERzBydM8Mgjt/17bPKc0
--> ssh-ed25519 GKhvwg Y+VUXd0xlQ5FdCb+cWDO8Gb6ATHRpxrnJqsh5FXWnzU
-q/g44328iKsulGNpZXW0FIPL59JBjJLVV8bH+WuNKkg
---- P6ctzFyIxW72c+hxF6UaR3J8bCUHPql0IsNI6TktKxg
-�
�Y��Gl^iսeg���T<t]YaJ|uY>��w�{��y�
r&p!vu���:V��=
-C�Lj����g�O�@b
\ No newline at end of file
+-> ssh-ed25519 IFuY+w G6FFvEMeBtfhAyS2FxF+uxxd3DlYAGepXDEPR9NdBEA
+ClECByd51Kby8eoJFWbzbVedoH/ouz+BMehRKMVOQqw
+-> ssh-ed25519 84j9mw b4eFV+AZ3ubWWoRGTF6IFOxsoAuBkCTyz5QzsVDsagA
+k+rDZ8aFgDRvqIyWGFiKkYPePBWbMERWGPDYUfwWZTc
+-> ssh-ed25519 ioPMHA W4jTnofv9qZxft/PlGbH9uS+KBgUXL86vB1B2MEO8Cg
+7/ZcbO2YqMCJX9NGuyG4t0+svkGxkE9MaylmpGuIQKQ
+-> ssh-ed25519 5A7peQ 7AzjFajaowcZCLrASPJbYbV+OPSZ8UZyxzy8B0kCqj8
+LNWG6lA5XRp25bBj/OJ6591780BM56tS8Cb85QcbdQw
+-> ssh-ed25519 GKhvwg f5gR3WtCGEk/7XpB6Ah3Ns4TegcTFq8+2JuWCC0pU2U
+tG1C60WknYYWwYe23pxlud1hT9uBEHaVYjF4sX5sTYg
+--- yMoAb6D7Q9IOOR9l3gnQnbxuKoCZI0HR5+PZLGjYmKk
+ߜYbq�7�(�$����Q ���|�2��cA�Eչ��?���o���QZ߈>,�
+q�W5Aa��3�f��%F 
\ No newline at end of file
diff --git a/secrets/hercules-cache.age b/secrets/hercules-cache.age
index ff6b60b20bd890deae554282f1462d96483d9e7c..5d7c19baf07540244be7522dec8e7b57475d46c8 100644
GIT binary patch
delta 891
zcmcc2ewlrOPJLNfL1CVsletTTv4yvLP-2ySut~mUqJLspVz_>`g?>rCNl=bKs&Q&?
zGM9<7zn5uwRdA$RUZjtHo|kt~rA1Iyu(o?eRIZD$X>xd;vt@cfdboF(FPE;JLUD11
zZfc5=si~o*LS}w|uZN?8dwH3WzmJPYWl6EAL3pK^w_Ap1esM&&k5focsG(_Teo|qs
zZ@FP!WkhH;S7upGSY=3PPN;rBxo@z4iJ4JSg^O24p;2g5pqaL|XP%|0iA$B4b9hMc
z#E;_PM#(PaQHF)4-i|qi=4GLwzD1s<ks(38!CoouxkX7OIf({l2Ck9$q2<L~Wnod~
zE_vxrrWR%ezJ7&aQ9dEb26?U_hFKNfS%Ik*#p#KW`X#0=uBOG4;~B-nwM%n?^D`2&
z9g8hX!wV}@^TXY}0s}*W&GXaULcDU^qWoMu!kxmC%?y0G+`UVS+=H?+i-L=jQa#iC
zj1r9t(^3t+6T{5YEL_9A-I6T~bF@=@1Jhh5pJf!UcPUHO4h%}GFwHkC3~_M{Gw=zF
z2n^2fG4S_s4>WfyaB($E%d030s>mtl^7SgIii-5hNi_6I4R<Tg3keT!Ov-WbO)>J!
z&5Q`MOiD{JEjG~iFHSSy($&>fFts$-Pb^F>w<xYO^l&Y8_O1*x4)ZLvH1RNwaxE!y
zG%IwePc%u+EKYLw<(l(v_N5(~XXU3o*!1F~#e{e+)!u)V)!SP(R2T&&Z7}A1p}s<N
z-V)v>4-t=L?Wbh<of}RXbG;XFyzH~ynkVi@)tfJpEm3b13LJm#lVQ2J*JDkT&i=O^
zejzIal?+?%tk70XN;)UWzVYlL6DGAw9{g`F2%X6ae_rqDmQfRTl5Y-6@aOfqPqjkc
zg<S3b7ag)vvC66J<iFVl4=!wa%jJDXve(3fsq3=N5snp=S&vVsHzXb0U=Y&$S5JSs
z`PSTvH@}OU{|wSUAX=byxAFeDX##p{WILShZsUsdoH^sbuBi*>uk2ir+#>YZ-omqZ
zQpG=^XR*EYPaaIxEK;hQ#TB;g<+spDm0l&kg@r?9&SiFlT>i2C&}DA%iE{D_-_LCd
z%=p&-hP!J+!Qm_kmgvI#=Y`SlkNd~$oYV8~)k^M-Z>yVk=`V87usSnSx>D%w?4#ML
i{t6-Dj~y>+gxoAzm#J{*+lPgFxaV4|lrTAEI0FD?ja@bX

delta 891
zcmcc2ewlrOPJOY7MM#)MSY}dXeq?x-g;TDhvuU!APjY~pTexeMmt|3IdVz<VS8-lM
zHdm#yK|z(1QK?~`PnBPmzH5m`gr}ofm|<y!S&?>yhr4G`uC}*{SzvB<D3`9CLUD11
zZfc5=si~o*LS}w|uZN?8N4R%>q<KzodTK?WX<m-6yIW;YXrNoDSyp90W~ymsj%l#J
znL)6bw!WJ$S9oxwe^qHtc!+0desMr}W>vU(glD3WXOU}RlzDchSGl3Kzh8)NVo_M=
z#E;_Pg{FxW?oP!8W;xnb;b|6?E_uFXM&3q#1?~a9mD$-P78afs&PAqv+D0Z^`ep_J
zd8yv%rOqK?{)H~tZbp&bNmZd?d8vLW#`zYOCB+e8o{{Bc<x!E7;~B-n{c|(jP2BQI
zJd6C&{enVGl2QU(P4q(zi%Y^QeZsPh(oB85vVsFMBXf$myuF+v{6h;Z%KY>FlC+CL
z3yqSKOELp}wJie-Jq(J?EiwZG(<`0aeOv=4pJf!U_w#THv2=C`3^GVE$qx$%56-C6
zwzM>kaxJdVc1lhw(T>XX^awZ9)^;)B3inR;$nnxP4vQ#s3d~PQv`h)iPH}U}D|Iz8
zD{!mGEitX|DJ%}Q%u5gC($&>faL!FjOvx?|aCOeG%&<st4G6MK@^mW<^fAx%NsaOi
z2@Hs;Pc|xxbaDzc;M#r9-Riruw0xq_O@oByvsc%}-4Hsm+kS?+{prFL-&i!KRxdmA
zmoJO`kLU$s+dt-I2B+t3;6M78=YMa#;@^Jr@`$WB&*i_*cwXY4B5(0gXR}Hn(^pr6
zEvFAB+tun{T{HcJ_POGBm8~DIIt7TU8#Zm^UTnnjzNbFmFSiT3i}>lBu!$uW*JS3T
zZr?S{eU3A4)D?cuV_ObyS{38qRnX;Oni8EGuG;eYN^e$+U-RUx9CkqtPTT_F3Z_ak
zidRHE+r24Q@T}LAf2MjD4m(zrXijmtHC1A(HaFW}HNia%qNWYn?mcf`y^Q^vnDF$+
z7QWb%nQtr=HZ!IcZP{^Wja04Zjg72wsf)FR%C_jKJ4K}3dp&c9NWrOyx3%f>ocFA|
z>N%xk@xv=EO6+T9v_=LC>8R^Ix~+8amgMy!QLV3H<tHtc*___?*pO+@zAZCb?0N%C
hPkiXUdA7ZZqxsmI{ie6fqlK+@GdvUy<n4Y`4gg8qR=WTI

diff --git a/secrets/hercules-secrets.age b/secrets/hercules-secrets.age
index 7ad7dca..6df036f 100644
--- a/secrets/hercules-secrets.age
+++ b/secrets/hercules-secrets.age
@@ -1,15 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 84j9mw SzwJ0Fb3oan5QQXr10AEQzdg1Q4LNgUxPpYDftHywwo
-lt+uQHpu9u1wu1UEq3aSJZ++sBpoeX/PhCRqNoZ3vN8
--> ssh-ed25519 ioPMHA OQe9Skg2JjtWT/YnOlOexhxifueYp4sMMCuokxg0NEQ
-g2AaKoA8KBkpl7twrn/CL5YipDZ2vKiHCjF72D0dVYE
--> ssh-ed25519 IFuY+w exr87EhCeLY9Zlrxi10d9K5a2WtLXZYSbxSKUvAJ7ys
-GK9FiOWDtOWBfck0BoWt4GiCPhMysDyiUu2zDcminII
--> ssh-ed25519 5A7peQ FI5uoSKhGYWXnZyA9rcKK5N0x7+8wrHY/pCoYdOCY1g
-JRJc8uz5GgVkHCLdxfQdPFEEaRVHAzL791bYAw4DePM
--> ssh-ed25519 GKhvwg ffDs2wAJAgQt9s2R4v1UAWg5vxC5c+TnfjYJ6RRw53s
-BjF6ExVMjFmdc3WizPsH2XRqdI3vOjz9ffnsLvGeJws
---- hiMPtBqjjdtSDBXaG+ZPlKr3l75B3vS0m98y3yemh4E
-6�
ڥ�d���X�,/�`�>�-�a�e����`Y��phz:��Vl�&kJ{�U�mM�)���ۻk
�t�`$+Qu�BA�XE�IOP~�n)��h�����v-
/xN��k�4���p>}��v0幐�k%���A�R+�I�.�-
-1�ѷ>�6g�3�V����h�0>��'���N8���Y62*������W�֙����{�</-
->�LI{u�?[&S��jcS�KE��2�kU�~b�5�(B3��~�T)��A&�썸�y�^Ξ���#����yE9m�d���rͣܣ`{��+c
\ No newline at end of file
+-> ssh-ed25519 84j9mw vY3nxZWjk7h4F4hZBkp2NJrC9HULrOJ4b9nVcix3LAA
+G9PQPGVI8g61fAFUs8FWKajmPOti5hCgNladdAlo0h0
+-> ssh-ed25519 ioPMHA Y/qWQGVvQhri80M7Ci+CF85VCbKJRVZ1AF3ueQzVTCo
+gcjYjXLqxvnD12wV5zhl9ELvaX987EyBAHL7nuUmdEE
+-> ssh-ed25519 IFuY+w bl9m9HfnL/aGEe0TrjJMChNgFS1Ox2NsffazhmA4ZUU
+p4PqXZGk1pNF6Bdbh504I324OErbiwZgwKI1+bwUCJg
+-> ssh-ed25519 5A7peQ h6kXKa9g0WbUbAExL53Z3KO/8J3q/75ERJqpTj0kGCA
+nSKw2+ehVY9ZAFYLHGNPtykSn7GpYm5hSHWrosZtsAM
+-> ssh-ed25519 GKhvwg KOG4A6BbJdE95hHbUTlSGz+VleTXDzPjmlPGFMtrPls
+/mGzr+PynGrELwJsV+KTupzLfbG+eLisOtwWvOL2ZfY
+--- iioMB0ae1QZccJnjieAjCxIbbj7SPfiMu+G99WjEM/o
+&6�i�T����a�#<V�fGZ�!:��b����-�E�)~+z��!}�ľ��,���Z�4Ip�ZK�<��s���07Y�fB�Yni�x�>����˳}��pAxc{�HH����cA-��-��4�������.C�ig�0kD>��WR��
+$'~�m�d�J�J�<�!�#���m�P���JC�T�<����qZc�6���E��9~�&�C��B�jO�O����x��Xd�������{n��Y�ڄ�e��v�y�Sڶ����.�|�8ɽ�rT����˺�ӯo@��~
\ No newline at end of file
diff --git a/secrets/hercules-token.age b/secrets/hercules-token.age
index e0f7204ef62e7892d2befe3dcbcc6ed57f536364..bd83defc39fee0ae1a325bd52f8b367c2e89cb9b 100644
GIT binary patch
delta 800
zcmeyt_JeJLPQ8(NnqO&7T54IQV{l@AW=>jFKu$`QyLOhbae9V(iF3YlglnQ{k#D78
zK9^%bL1C$PR)mF%YhIaQroXeNw_89&NmZ4nn@?(SacHhZfU$Xrdw_{^D3`9CLUD11
zZfc5=si~o*LS}w|uZN>TnX6%Pk!gCkak+^_S$UPdzME%7xJ!Vsk9MFzQeb{zKxTQN
zrM7m6e{Om*SCEBglx13qTZM5zxus=Vio1z#N}yAPi)W~IZd71#c}a++L1a~UK(0ag
z#E;_PmQ|+d5$-PT&PBNqzFscI`W01PsX=8v+D56S+F?-v-r8wqQKpW`VUCep1<5WE
znfgYK{#Dv09;q3wrolcTKKcGmm9B}7CjJqD!7e$e`k{GQ-s#Dc;~B-nb0b4aJi>il
z48px44NKkKGTlNA^NiCBbIPK;qO>y{P15|6(=7dcv|Y=&s=O?UT+)-0f+9*SEh<6+
zvYktf3N1a2(hO3a{Y*SUOEOYROUpvaEDDn+pJf!U4@jvp%=Gi~3JA*x)%VKCaV{{*
z_btdv&(F&@$|<ch%t#6>ElSGvDll;5GR_Gob`8wTEe}dcuktM_@lVdT@b}O+%y!C5
zODXoQ2r_bt@Nw}E&r46{($&>f$PdzXNpW&?&8jR2PBHT^$qzSm@pUQliwFoc)DAK-
zG7L|wFLE<1H7N=V<l3V8lvki}nos;0jxSPke&l<J9un71jXgVab<*MdsV=@5ZeQQ%
z2`Y%^=qRjNt2Qg>WB>7mGP$A5aiM2kbd-PHRT+KN<Dt=EfsQth_Qq2(e{xrP1@<le
z!u|h!mF$n1s~jJgq_pOq`}BG4bY~m)r#E&NyEbVrV5<LfuBiCylU-|iyjcZGp6^fD
zrW|rTQ=MVq8cAPniG`21{TJr=CjCqHi23|^3QN~{t~TBg7hB!9VDY5R2MPOB8878$
zn9TA1eXjjMkS_a{P@O#!H`yg_-*J9*$uzI`{@m}6N4KZ1Y?TyP&2mt%cd}4>`Nzoc
qEDHuLql^=iq{3YV#NW<;cQmKju<lc+q=aR6mpGGdz~-r^{{sL$G%qXw

delta 800
zcmeyt_JeJLPQ9UHaduLOMU+WuWU!I9cBZ~-xKUbOVQxjXt4C07N<dYyPo;LQYiU@z
z3730hnxC<8p}V8IVY*4WnX`{}X>dhuv35zGrID+XNqCTXc4VoqS$dU^374*&LUD11
zZfc5=si~o*LS}w|uZN>TxQ}*}c~p3Ec}AvbkXv?DkXyD%RjN~nS!sb^rBhXrZ%SlQ
zd1+))Qf5UYS5QfSxx2f8PiT;(lSQO^MX^_@c5+c_VT6Z&kXKY{m}jJAWRPWPV3c3-
z#E;_PjzLwGWoeEc6~+-o8CkxChJ`7)>A{Af`e|Od#+8xzC7CWRVSyO|epR7d7XB&T
zp@C*@m3}$NfnGVz<&~91iDp@4&RLe3;l`2ap=p7I7D?IW;pXL&;~B-nLqfdLJ@ed)
z9Q`Yj9izg1!V7YpjRUL9^NM|QvpozmJcA8Ql1qH^0}ac$(tUixBSWL2svIrd48pT5
zO2gAba)Ql+Jk1j`3%#Nue1gp?l5>0uOAFE`pJf!U&(d}b4A(Z#j4-w^j5ILTc1`xn
zNh`2OD+({j%+5^Av<yx6F^nuTFmW>AaxyH-2=jIf)y^<1$|^21jVMS>ayRr#N^uG>
zjr0jh^-KxKGs`zFDRPVC($&>fC<?aljml2<EeI`kPK&VgbkPqiEid!VGD|V>%Qtqd
zEY3};FANCuDN8G|;F_^nzIgrT)1PMbIrz)gO<&yY9Xxr4=c0)xdmY>Q)s;Pttv-DC
zM7zzp+$pBlw>vAmTi)Wef7-)c5n4AK#Tj3$I2~Kc(_6x^;<>@K<h(5X)3P2C+;7h2
zOgU2hK`=9Z`8u29UuNZRDzKA#Y7l3fb>+MB>Ygw9np5l9-BY#Fjwh_iTW_^=r|SDh
zy*J*@tJ!s|YyO0n+(Nz6Z5C+z9@D+^AWL;?_$K!1%wvK3)~a)Do_Q|J<^4x-t0R2k
zb2fj8e6vKK?X2ROu8N9zn~z5uDE_pV<Q>g^<ha0>^U2GP`}8IrG*MEpe`YRZuy@^o
qD+@O}l*)8wN8f$N7%9%@8pfV})Yhvf%*d86)ca<wGW*>hYR>^{G&8XP

diff --git a/secrets/leet-nrab-lol-pass.age b/secrets/leet-nrab-lol-pass.age
index 18707167f3565ad5352ed404e424dbc2e6d533c5..6788736ea66bd89ebcfd68aeb65c3621f3214924 100644
GIT binary patch
delta 349
zcmZo*ZeX6EQ}0t!lvNrU?r-d$m}^v)mFZ*YWm+0w=pEvk=Mqq9l44M3nje`I<R9sg
z&Xr~8>zY*HWSnf^R1y(ZnVOz#Vqz3o?o}8RWLy;GZDwg^>EjgT>6w$0&82InP+Xj$
zo0?)|YHDby;O?DKR-Ueqos=6IWs#d39;96y65#GrULR2IQm*f25fb6%WfJZb8mgb;
zo1I%?V4j)H<>Bt{YHE^_QR!M1=o_ADl%MG9<5HC56zb-dW|~u4TIQIM?4D>;VeD+d
zrK_u};BJ{{USLri=@jN<Qd(@8p5v1h>1>*kZQ<sc6X>EJP-;}@UlE#}?c!s=wIJC*
z>qu^DYS<BlzYg=8G6d{4O$m0_UN!rx(#-|A%dPoOg|^JTnZCZ{jCupFzzxk;RUiHx
xoE|-G^PfeVE@nRVbn%=iFVhzAP=34OREFJ84_>+dd$aMeyjD&(=6C9;2LLdIfQSG9

delta 349
zcmZo*ZeX6EQ?Fm-@8xV6T;X2eVxAZg>XVh2lV51!XlY{U;$Prpk!Km{m+cV|kf?2J
z!WEE~TAmbPkXq@RROoLWl4j}Uo$H|;o?0AQl9Ezo=^Nq}X%vxX9+a5n%cX0lP+Xj$
zo0?)|YHDby;O?DKR-Ud<9A!}86X=_hW)!BM6;f$pSs&n@6Y7-W<LqJ<l<J+H@0{ga
zny;M`Y-$k5RpytR<6T)`98{55Y+;#alAT^<6lU(~k{VE%=~Qk~W)Njqoa~w8XJ%2(
zrK_u}V3BO%T9xdQ>6&kxk)EmV<`tFdk{fEAZ((7SRqW(qoM%+-=N%sEl2H}N)v&KO
z*}vzSaTs5_!-BF&;j^yGT+r%R&?RWFt0QL1Ti?)X<4VWak85Pizr9?2YEGTghDTca
w8{$oNDP0M!>NsQ~R(+4jVIfySe-`f_<@+41zMM~3WsWo2%{V*pW!I%C0G)n)fB*mh

diff --git a/secrets/legion-niko-pass.age b/secrets/legion-niko-pass.age
index 97bce1a..b6e5efb 100644
--- a/secrets/legion-niko-pass.age
+++ b/secrets/legion-niko-pass.age
@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 ioPMHA pWCwNDvXfVMuPXbMw4cvdz8iztUdPcJZcYBUU6Hfg34
-NW49fnk6FjLMbkDBeXnGylXpdOecHxrFjlkv+4lSde0
--> ssh-ed25519 GKhvwg bqVjtgocY6+SPikUfDOn/7gUmEIsMG7Rq0A0dyxdcn8
-EHbB9KLG3S/skQOKCKtJC4VXL2bz9sO0Lym9uI+hz6c
---- EUFvmoeavLuLPnufqmgtwEPKoK3HEgMhgBKCaD4FDho
-;���D���9Ì{*X���ĩUfh��y���C�R�h�Z~�k�F��)UP<Dj�+q�
"'�޵��������(b;�4黨)>}Ȗ����S+"�lm��K���[�H�
\ No newline at end of file
+-> ssh-ed25519 ioPMHA jkLofh/bWIQ2C6GuMO2rj3txFSZqbygxmw2Wqf6BRnI
+cEN5l7MtRup7CrcvErWqQkjoswJhHVSwLYHlwbVHHGU
+-> ssh-ed25519 GKhvwg sLzHoAm6XHQnOdZLNkjyMgNcV1LCzH5JoYprzu0bgEs
+uDrJR546WgW8PBoKRg+hZYzNwRtwUErT6jWFj9pDHlo
+--- N8Tmhynh1k7quJdAgqNPnsa7tjkt/Ev5LrdhojbiM9E
+��A�hW����+�X岆G�*Ӎ�L���Mo���U+m�/%zP����.��o���%�mc�U;�~[�g�ϰ5�82O�-\�L���2MX�J�2n�f���?O
\ No newline at end of file
diff --git a/secrets/nrab-lol-cf.age b/secrets/nrab-lol-cf.age
index 76591dc..31220f1 100644
--- a/secrets/nrab-lol-cf.age
+++ b/secrets/nrab-lol-cf.age
@@ -1,7 +1,8 @@
 age-encryption.org/v1
--> ssh-ed25519 84j9mw meAuaVxNefi92UFGVqX2tKHu5XSIWDykpmiM7zjtMlM
-wcI5WePiDt9IuC9RH06PH30Sn7wbkDDk9ZEt/iQkeTA
--> ssh-ed25519 GKhvwg 6AcyxHMd2g99rdhd/s4e95LU7PtMesyD2kd7Rt6u3yg
-KXPAV17yyq94pTJdmNGVowO6DVoDLhC9UlCyAmSk59I
---- mR8BQg3dMF2IqUqDmrWIvD7hOfTeJYCpR5QlPXNcgzM
-b�qI��l	_�A��;���~��O�4�noݳ*;�[<;{�̛����-Z`�*��!�v����mx�-V���l��ԫ]|�%%��x���;5
\ No newline at end of file
+-> ssh-ed25519 84j9mw J8KF1LlgpFaq/LBh5/4H+RZ6et86bdDFOvi8+kpZXRA
+gs3mQE2r0uizPXVhiOv93DpIWFkQ8KkmNqEZ71p8KFk
+-> ssh-ed25519 GKhvwg xh1ZHY499FomptXCxj5a1NO3j0KtIKXpsYZFF5erXik
+bmDBVcJLUzrDPEGzZO0kVgXDaWXbm5RpyCq8/A+Zk4I
+--- TIKd5u8wRwrMAeDIkm9sIzeW2m+jXuzBewAVd5w5iqk
+���1I��4��q�ԙ?b�oU��2�ٍeC:���P�����
+��L#�Y�+�R�,���Cb���X�EuRD i,�1��o�Z�x&
\ No newline at end of file
diff --git a/secrets/ntfy-alert-pass.age b/secrets/ntfy-alert-pass.age
new file mode 100644
index 0000000..f67b830
--- /dev/null
+++ b/secrets/ntfy-alert-pass.age
@@ -0,0 +1,17 @@
+age-encryption.org/v1
+-> ssh-ed25519 H0Rg/A JBVUqzrPx6XwOHdMl5Qp/doUyJUwchW/GeXu50f24Fo
+ISVMQtq9mpkRshvwamwmWwYeyKZFgtyWtw+IiaQYuB4
+-> ssh-ed25519 84j9mw XiH+tWfMOZQFJmS0QyQxOe9VjTaMo9kvU3rDSu4kdyM
+dZ5P8ndFUR2yU5J8D1m3eaGQd1CVzNKtT4VowXdFtrQ
+-> ssh-ed25519 5A7peQ UytC66TWuyHd5TepfV6EIvYuyUXKXoFBctYB8cfgU1M
+sWIqvAqUJvN0J+Je3WBFFYRAff2+CexAagd4+VR37Yw
+-> ssh-ed25519 ioPMHA 7QcH5Wyljwhoj0jLMQz977gFggfehG7f2ugmnfX+tCI
+Dfe6BwfLoDRmfV8O5COBMqBYWaanC2I32OU3+ldaKig
+-> ssh-ed25519 g2vRWw 1pnce+XKob7qrB0ufkdZvHucvk9NiXATRUmczvNGMhA
+zf0ak4p+qYCtsdnWZwHtTnfjn75WPzdc+hEHk7H0exw
+-> ssh-ed25519 IFuY+w 6ujRC18VThMj4ocX3loqq2DISxS68aVu9T2w7kiKhhw
+j8ZgoMH0DIS21bDeLdRPeCRO01hX+MAv6YYpvNMLkFk
+-> ssh-ed25519 GKhvwg O+JfpLfrxaIl8PL+StLA8hb2fADlgUTOn0lujlu4k2M
+YZ03palVRAtSvldZQatrl45EvuIIkdd45IZZKjZO7js
+--- 40DpLeXN4B2bpTfcakCZ8CdUzOGREmAba4atOzsyGiM
+f_�E���d>�"e�y�L���{�ln�����5W3�-I���B�O7}9'�#=U����A5�))�
\ No newline at end of file
diff --git a/secrets/ntfy-niko-pass.age b/secrets/ntfy-niko-pass.age
new file mode 100644
index 0000000..34a4c45
--- /dev/null
+++ b/secrets/ntfy-niko-pass.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 84j9mw 9fO0Uss0X8+FmibHo84aRYKDB+Mavp9X2Cg9lqGTixc
+SnOdbe+GzL01jJ4rSSh+4Xb/CIJ/23bb0/+D686TnTU
+-> ssh-ed25519 GKhvwg u3V5o3Mtk5YiwzETseVfBYlPT29HS1mwheCUCyJUh2M
+jko5Sdf+4E61I5dpjH4bUth60B8BnnOsOcAIdcMzBFw
+--- CO2Ky/1xxfSu/Tb3f0a8ORtCoRkfeh1cDtJiaP/1MDI
+l*[�'�A��u27��#u趶�IQm�,XC7�|ٞ/Ήr���-�<
\ No newline at end of file
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 9ebebd9..e24aa29 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -67,4 +67,9 @@ in
     keys.system.kazuki
     keys.other.bootstrap
   ];
+  "ntfy-niko-pass.age".publicKeys = [
+    keys.system.kazuki
+    keys.other.bootstrap
+  ];
+  "ntfy-alert-pass.age".publicKeys = (builtins.attrValues keys.system) ++ [ keys.other.bootstrap ];
 }
diff --git a/secrets/storage-box-creds.age b/secrets/storage-box-creds.age
index 53a9b27..ddc30e0 100644
--- a/secrets/storage-box-creds.age
+++ b/secrets/storage-box-creds.age
@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 84j9mw g6s+z6YHbfOvZI7ZDp18eMu5Cjz+BoFXMx51+2lxUFY
-3q/ymTUaBQz1ZzexbPOyfIuqDa6RaXpjECfVo5wfXak
--> ssh-ed25519 GKhvwg F/e+lEu0+0pKBRRrbZJV3Dd2OaKcAwHrQAAtABrezRQ
-LcWXLsWe+izfAkA1CI6l1672SPhaEk4Kp/rHjIQtJCQ
---- YxR7bdc//u/axG37zmoSav5YBwhBqjti1aKLF4l4X2o
-�0ᨾ�ީ��������-�A%V2�1��z�~��Ƙ̒�h���f��y���	D�����c="QnC14
l��
\ No newline at end of file
+-> ssh-ed25519 84j9mw cEEM1sFBEx0VLeOpToON4hb6d21gJEYMMn/vlHu/wBs
+khAgpAFxFGKBIG2z0f5qqh122KGsrlkt5FM+5daqQcY
+-> ssh-ed25519 GKhvwg Zac7w0M77F9n0QjqEFe/mpyjanhH6YH2fc1UPPapx2o
+6AvDBxnlMZhQ/6inLj7d72k1P0EI43wBniwa5ieTgYk
+--- zEz2LeBNXbH433jUfugEYHVMeEB64yq2/01Xd18tPgg
+��g�]��i�7����R�l4���p	��C&�)o�^ʅIs�i�:��[ɥ7w���yeX��6$
���ٗ��

\ No newline at end of file
diff --git a/secrets/storage-box-webdav.age b/secrets/storage-box-webdav.age
index 3b20f1c310073bc33c5b1c46dffd5f94f6550785..bd650f9451261e1ccb3ffa14457270e18a35f803 100644
GIT binary patch
delta 347
zcmeyz^p9zRPQ7VBNv4-+kcFXzU$K|Jd1kqBXklqZL5gX<Ur}k1X{BF!N>!qFMz~*<
z0as>fh;OoCa&l>rt5-l|Mx>i>h<UE5ahaD{g|T0lYo=><kiWK1Xl`<;BbTn7LUD11
zZfc5=si~o*g1dJ{S$Vobj)8uVPjXRNmX~)%k$Y8SWqo?Ee_E)ef2qG^PNh?@hgWK_
zmzj2jg?V5kS44@0n}@NZyM?}QKx#x)np;$Gq<4s;v5#M3fxmZUaFDmQiD71$rHiv8
zm#(g^LU5^NQDIO<T5*A4K!ARBu%C&(si%8kabU1xP*$LRL{fNYUU*<yWUfgzS3L7O
z#pOo3L_&-oFFJo|mE>8kxy4<R`DVy&^{V~#EXd7UH+@&l2dzua?hLyxXdeCCs<_qs
w=Go~ALf16APxnq_-Xd{2-EhU<naih43=i2`G%s%c+3!0(Rr2hAoVdLM062Yt<^TWy

delta 347
zcmeyz^p9zRPJLprM^2(?x|d6EWuB+Ae|dpfx=)3xg_}i4vSpcNafy4Rsd-spWw51V
zB$r7=M0sLHj=7&pUT{QKhHprgleTA?o0Ds*ue*0pmPwj+aG6VLM1iNdBbTn7LUD11
zZfc5=si~o*g1dJ{S$VpGuZw|yxO1XoT9tNINr0i3W4*trOHhcfMWko2S4pK;XtrZc
zn18-yxqrDQmqD^ox^bnKQ$(?gbBU*?Q$=!cp-Gsbhp(@TV`)H?WtoAYcTl2pScat|
zm#(g^LR5xnwwrcISyH-Ds!K?=SAj*2X-1JnR)A}vdzHImN~xQxS7dmRVR4Wvmw;{^
z$45hzeIWt~vRhW_3;mYenDvw6Z-ThuqC0MVF>_<5B&ctif9+WM&)2uYrgr}l6pj|N
u{q;WG%#z!bjXS#S`Lnhu{eG+ConB9yvW<mXBTx2umfR<+{&%5!%xwUu=6k#V

diff --git a/secrets/vault-cert-env.age b/secrets/vault-cert-env.age
index 1a7e601c3fc1d2b8ba81b6764f218c4bfc5b5f7e..070e2d3d801aefb03f4479a42f94163d63049a63 100644
GIT binary patch
delta 345
zcmeyv^oMDJPQ7zxuwhwRRcWbTW_EFEM2bghL|R~0a$cfyM2c5dioc;tac*95rb%XA
zHdkJ5dSG&TWT2t9sYO;~Zmy4$S*~x9m$ScPm}_}hX@HwiZj!l?f3bl@HkYoQLUD11
zZfc5=si~o*g1dJ{S$Vobc#f-AVyH<#kyEIThnq`;dA&)tUrLFqk$;$zp}upfx1mY6
zbFo*lSH62Om$P@ev1eFvP*_rCRA6FAVTxI0aZ;pTxmmWpMSf;pzMqq&ze&1wazSw<
zm#(g^LXKsrdz7z!n2}4NrA1kCSfz`XLAqsFPH>cme~zbtUrBOMQE7HzcxGrim-iNr
z9ZnPer3XEiIn5z(zHt7%GTt3EDUxO{qS>2`Q(J$QoUJ+5EPP>w7f<kV!LD6ficZf|
tuls&h?hbS6oxZK&-)^Q!K2N`}vu}oQ)S)X3raT9j0^em7U4Iq#3jk^JfjR&H

delta 345
zcmeyv^oMDJPJLQ#VX|dWUQSg;wpU7cg;$WFX?BTgprLa`KzezRV^WD<u(yS!TS}%=
zHdkP_W16=`k-n3Eeqc_dSBbWEsj;6&vWs&-abB2qhHF$tc~q9SWpR>aIhU@TLUD11
zZfc5=si~o*g1dJ{S$VpGXGM5cu(n5}zM*$|QF2jXUcJAGsY_~LxWA=oL54|Gl4(dz
zP-Tj%i<3b*SBOEBzHwl&Ur2<zbGcJ-SV&5WdtS0pQF5eLlwoA1w`*yLu}hVsr<1lT
zm#(g^f_9X<enfUel8dE9Xt+;_K~<7tMQ~V^ae#@oe@Q@?Q&>o0Zeo~ESh;}(SNJ#1
zE2UR2Yz%UZ-!o;`jRnTfW<Ivkdepsg(sqxBFI|OJ>n>TqX|i{F$|R$umn9}1dmj`d
uY$5EosrG)dNbIq%UsA8yRoPDX#kv0fYooQc2bNtH+t3)&yhYDggdG420D!gt