change rustic backup settings

2024-01-19 17:58:20 +03:00 · 2024-01-19 17:58:20 +03:00 · 426ac25e56
commit 426ac25e56
parent b0602ce587
8 changed files with 190 additions and 112 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@ -2,6 +2,7 @@ keys:
  - &ataraxia ad382d058c964607b7bbf01b071a8131bf166e80
  - &suomi-vps d286fd9431753cb455537070235ec7bc757002ca
  - &nixos-vps 20d2e2b90c6aa179585b6b6b34cafb9db82f1d40
+  - &home-hypervisor a32018133c7afbfd05d5b2795f3b89af369520c6
 creation_rules:
  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
    key_groups:
@ -9,6 +10,7 @@ creation_rules:
      - *ataraxia
      - *suomi-vps
      - *nixos-vps
+      - *home-hypervisor
  - path_regex: secrets/suomi-vps/[^/]+\.(yaml|json|env|ini)$
    key_groups:
    - pgp:
@ -19,3 +21,9 @@ creation_rules:
    - pgp:
      - *ataraxia
      - *nixos-vps
+
+  - path_regex: secrets/home-hypervisor/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+    - pgp:
+      - *ataraxia
+      - *home-hypervisor
--- a/keys/hosts/home-hypervisor.asc
+++ b/keys/hosts/home-hypervisor.asc
@ -0,0 +1,28 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+xsFNBAAAAAABEADIckpTgLln/NwJ4wqu4yVZMGkwEUC9ut6wdf4DPY/NJKQ95hYW
+R7TGRS9hccsmrp/129V2ex29McXMDxTCIJfLx5F+OyAzqYkkXFeBhCQNBfb6Q9F+
+gb9YjndO8gkFsq6x+AYRwO9TOZJ2aVHNBSOq/59eaocZirfHsA9oTxRZOZR3kUz8
+2Zj/4BTuYW2bBrdsvoiqHvof/E2fwFLVETISAKe0y8hIFI8Eq31NVV28uC+Zfy5d
+lUTKCTLBU1Esn9vlVQ9BATlDGIl4lcOfWDhxZD3EtmHBTCIVv5LieYbj229p4gq2
+ooUDqyoLScPUiNCEz8sSqwKt50SNGeABFxR+2xoYmZ1WWpcYOBlTZmj8cDMaZyXQ
+s3l4Eo3LK1F97ow9wRpwEdJRvA0/tyGspCTuPeHbrKnsDqDbk282XrLJJ9jQNmH2
+PFahmUYYVmETHnxBZ5qQw6ni5sh6l1RcwQ5PDcD5O9DhJCzAU9oP7Xug4YLIsTCM
+WSWkUWupoQq0I+78REv74+4/P4pCeParO9Qtl0WmHeABY4fGsnahyo7lNYaLqxB
+0ymYxRmOUp/+eHU3G30wb+QU9upZBsE96xWjfZoci7J3TT23yr0g/z1rNiUqlaAW
+X/PtYtAkIc3FoNhTM+4FQj5T+RgJEXrXTdzA74V0VPvIsj+RK0uPxFeu4wARAQAB
+zSlyb290IChJbXBvcnRlZCBmcm9tIFNTSCkgPHJvb3RAbG9jYWxob3N0PsLBYgQT
+AQgAFgUCAAAAAAkQXzuJrzaVIMYCGw8CGQEAAFx1EAAJVCv0ueK5iANOy+vrswHO
+23fh+Ta6mNoqhEwQUv/ReMnx9LPPbYwxChPzwR+yFGe/133eG6R5F73KykhJE4Yv
+qOysTEbEUbTYs02X2c/9/mCcTXN2V2XXRYryIfejf5jZTICUU5FH/juvXiZhU9/x
+7+qIRhM3iXnwK+Q17LUwlxM370gs0ZrYMEoANADWY5ZmguYhQ9VVJ7qhFdXzO4ll
+STFGO6XCyAD9FFCzK0IyAPfbb4oob1v7DBI0JxXbElPMeoDzgZL+iaptiTt05HJX
+L4G4uqs9hq40QgnLY6N9wIUoTM+/6BbXpuz2vsPRYtS3yeZAYr5/4eVGV5BXssNt
+BEmpCfBMlSHZAnCLHish98l4k/QVS13TIF9nXznqr3bePYz/02Y/u5JJdk5vBtkW
+80Q4AeHOfeWhTSIMcYwnMfSFr8jXkB7UrXU4wqmnLDRJ8W6Tu8wOEKEi65pDpU3l
+MSrtDcpQ1US43D3Pk2CmjYIupzVoTQXqpll6HcnzxXAR4V4NS6PJUOP/EuijFbWt
+co59yDurWeG14JLdeO/Yqb6YmhNUTOpLQjIDhDDMeHNlmoph9Jsh0ngY+JwPnxBl
+FZuN73gQfJSq7UD4IoWV/+zw7HFAE1hcZ3+4DXJEd2lWf5YdVQCU0p+PabnKFJdD
+9apG7j0wFgNmGgdm41XP/A==
+=RHFO
+-----END PGP PUBLIC KEY BLOCK-----
--- a/machines/Home-Hypervisor/backups.nix
+++ b/machines/Home-Hypervisor/backups.nix
@ -1,39 +1,32 @@
-{ config, ... }:
-let
-  secret-conf = { services = [ "rustic-backups-nas.service" ]; };
-in {
-  secrets.rustic-nas-pass = secret-conf;
-  secrets.rclone-nas-config = secret-conf;
-  services.rustic.backups = let
-    label = "hypervisor";
-  in rec {
+{ config, inputs, ... }: {
+  sops.secrets.rustic-nas-pass.sopsFile = inputs.self.secretsDir + /backup-conf.yaml;
+  sops.secrets.rclone-rustic-backups.sopsFile = inputs.self.secretsDir + /backup-conf.yaml;
+  services.rustic.backups = rec {
    nas-backup = {
      backup = true;
      prune = false;
      initialize = false;
-      rcloneConfigFile = config.secrets.rclone-nas-config.decrypted;
+      extraEnvironment = { https_proxy = "http://192.168.0.6:8888"; };
+      rcloneConfigFile = config.sops.secrets.rclone-rustic-backups.path;
+      rcloneOptions = { fast-list = true; };
+      pruneOpts = [ "--repack-cacheable-only=false" ];
      timerConfig = {
        OnCalendar = "05:00";
        Persistent = true;
      };
-      settings = {
+      settings = let
+        bucket = "rustic-backups";
+        label = "hypervisor-nas";
+      in {
        repository = {
-          repository = "rclone:rustic-b2:ataraxia-nas-backup";
-          password-file = config.secrets.rustic-nas-pass.decrypted;
-        };
-        copy = {
-          targets = [{
-            repository = "rclone:gdrive:rustic-backup/nas-backup";
-            password-file = config.secrets.rustic-nas-pass.decrypted;
-          }];
-        };
-        repository.options = {
-          timeout = "10min";
+          repository = "rclone:rustic-backups:${bucket}/${label}";
+          password-file = config.sops.secrets.rustic-nas-pass.path;
        };
        backup = {
          host = config.device;
          label = label;
          ignore-devid = true;
+          group-by = "label";
          glob = [
            "!/media/nas/**/cache"
            "!/media/nas/**/.cache"
@ -51,10 +44,11 @@ in {
        };
        forget = {
          filter-label = [ label ];
+          group-by = "label";
          prune = true;
-          keep-daily = 5;
+          keep-daily = 4;
          keep-weekly = 2;
-          keep-monthly = 1;
+          keep-monthly = 0;
        };
      };
    };
@ -63,7 +57,7 @@ in {
      prune = true;
      createWrapper = false;
      timerConfig = {
-        OnCalendar = "Mon, 07:00";
+        OnCalendar = "Mon, 06:00";
        Persistent = true;
      };
    };
--- a/machines/Home-Hypervisor/default.nix
+++ b/machines/Home-Hypervisor/default.nix
@ -2,6 +2,7 @@
 let persistRoot = config.autoinstall.persist.persistRoot or "/persist";
 in {
  imports = with inputs.self; [
+    inputs.sops-nix.nixosModules.sops
    ./boot.nix
    ./hardware-configuration.nix
    ./virtualisation.nix
--- a/machines/NixOS-VPS/services/backups.nix
+++ b/machines/NixOS-VPS/services/backups.nix
@ -1,38 +1,44 @@
 { config, inputs, ... }: {
-  sops.secrets.rustic-repo-pass.sopsFile = inputs.self.secretsDir + /rustic-b2.yaml;
-  sops.secrets.rclone-backup-config.sopsFile = inputs.self.secretsDir + /rustic-b2.yaml;
-
-  services.rustic.backups = let
-    label = "vps-containers";
-  in rec {
+  sops.secrets.rustic-vps-pass.sopsFile = inputs.self.secretsDir + /backup-conf.yaml;
+  sops.secrets.rclone-rustic-backups.sopsFile = inputs.self.secretsDir + /backup-conf.yaml;
+  services.rustic.backups = rec {
    vps-backup = {
      backup = true;
      prune = false;
-      rcloneConfigFile = config.sops.secrets.rclone-backup-config.path;
+      initialize = false;
+      rcloneConfigFile = config.sops.secrets.rclone-rustic-backups.path;
+      rcloneOptions = { fast-list = true; };
+      pruneOpts = [ "--repack-cacheable-only=false" ];
      timerConfig = {
        OnCalendar = "01:00";
        Persistent = true;
      };
-      settings = {
+      settings = let
+        bucket = "rustic-backups";
+        label = "vps-containers";
+      in {
        repository = {
-          repository = "rclone:rustic-b2:ataraxia-nas-backup";
-          password-file = config.sops.secrets.rustic-repo-pass.path;
+          repository = "rclone:rustic-backups:${bucket}/${label}";
+          password-file = config.sops.secrets.rustic-vps-pass.path;
        };
        repository.options = {
-          timeout = "10min";
+          timeout = "5min";
+          retry = "10";
        };
        backup = {
          host = config.device;
          label = label;
          ignore-devid = true;
+          group-by = "label";
          sources = [{
            source = "/srv/marzban /srv/nextcloud/config /srv/nextcloud/data";
          }];
        };
        forget = {
          filter-label = [ label ];
+          group-by = "label";
          prune = true;
-          keep-daily = 5;
+          keep-daily = 4;
          keep-weekly = 2;
          keep-monthly = 1;
        };
@ -43,7 +49,7 @@
      prune = true;
      createWrapper = false;
      timerConfig = {
-        OnCalendar = "Tue, 02:00";
+        OnCalendar = "Mon, 02:00";
        Persistent = true;
      };
    };
--- a/modules/rustic.nix
+++ b/modules/rustic.nix
@ -30,6 +30,17 @@ in
          '';
        };

+        extraEnvironment = lib.mkOption {
+          type = lib.types.attrsOf lib.types.str;
+          default = { };
+          example = lib.literalExpression ''
+            {
+              http_proxy = "http://server:12345";
+            }
+          '';
+          description = lib.mdDoc "Environment variables to pass to rustic.";
+        };
+
        rcloneOptions = mkOption {
          type = with types; nullOr (attrsOf (oneOf [ str bool ]));
          default = null;
@ -153,6 +164,19 @@ in
          ];
        };

+        pruneOpts = mkOption {
+          type = types.listOf types.str;
+          default = [ ];
+          description = lib.mdDoc ''
+            A list of options for 'rustic prune', which is run before
+            pruning.
+          '';
+          example = [
+            "--repack-cacheable-only=false"
+          ];
+        };
+
+
        backupPrepareCommand = mkOption {
          type = with types; nullOr str;
          default = null;
@ -193,10 +217,6 @@ in
  };

  config = {
-    # assertions = mapAttrsToList (n: v: {
-    #   assertion = (v.backup == true) || (v.prune == true);
-    #   message = "services.rustic.backups.${n}: either one of or both backup and prune options should be enabled.";
-    # }) config.services.rustic.backups;
    systemd.services =
      mapAttrs'
        (name: backup:
@ -205,7 +225,7 @@ in
            extraOptions = concatMapStrings (arg: " -o ${arg}") backup.extraOptions;
            rusticCmd = "${backup.package}/bin/rustic -P ${lib.strings.removeSuffix ".toml" profile}${extraOptions}";
            pruneCmd = optionals (backup.prune) [
-              (rusticCmd + " forget --prune ")
+              (rusticCmd + " forget --prune " + (concatStringsSep " " backup.pruneOpts))
              (rusticCmd + " check " + (concatStringsSep " " backup.checkOpts))
            ];
            # Helper functions for rclone remotes
@ -213,7 +233,7 @@ in
            toRcloneVal = v: if lib.isBool v then lib.boolToString v else v;
          in
          nameValuePair "rustic-backups-${name}" ({
-            environment = {
+            environment = backup.extraEnvironment // {
              # not %C, because that wouldn't work in the wrapper script
              RUSTIC_CACHE_DIR = "/var/cache/rustic-backups-${name}";
            } // optionalAttrs (backup.rcloneConfigFile != null) {
--- a/secrets/backup-conf.yaml
+++ b/secrets/backup-conf.yaml
@ -0,0 +1,89 @@
+rclone-rustic-backups: ENC[AES256_GCM,data:78Ch7VVk/9rPy8pTQCTmuSSXWVKlNwlaTxnrM4yBi8/AQ6B4QJYQr1ibtxbgFs4aGHMddJbARLILT9afzXVF3dwyZ5490v8b+6NmGQ/ECdLpQ3LUGWzQHSkTQRib8s2ks2v3XC7AAzUr4hNdXHxL4/11WrKIL5wJyn2YP/KngQoIjijkpzoAoKZgr9cTZDSQ3FsnDv6WlQ4lTneRSkssFmHrytgFWEj/EXTqeZo5/2E7GrqFC161iO/p6+ZM9dNFoSsLxj4SI5gF2HsUChZbDfMyMdzYCHTt,iv:a1Vgs89rKIDJ//CCN94F3rzUSBtbrBB9fB8nZpFacTg=,tag:Y4QA6YKOUAWN5uhnG2C95Q==,type:str]
+rustic-nas-pass: ENC[AES256_GCM,data:uDiQQRxlpBfbwihXDR32aGjP41iZ,iv:qx6FJEllahkP9BPYFFfv9LHnnVTOl6B7Jv9OSfNkPok=,tag:MBUT77ccG/acr/U/X2zrCA==,type:str]
+rustic-vps-pass: ENC[AES256_GCM,data:LMdVK6j/TV9JLAxwWUtIfF//nf6r,iv:PjOYcNeLjlRx6uoZo+jr0oA9N60NJNNPloc9fc44raw=,tag:AjOzsfVIhDCb5a5D3yIdUA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-01-19T11:27:22Z"
+    mac: ENC[AES256_GCM,data:EskxLpbdlrpB5yvUsyzgjoozqwPgDnqPLSkA8WcHmreqR+v1mEM/xY2GAije2TA4Bg7WGSKEBonuapk5hMHtehXy7+9iytdloDNQtXJWAoOy2PLd55E7shUdBVilEAa2mCUz5VDBz9jXMtlW0jv13W4iwXQ9ixKmzaUr/JSpnCk=,iv:t2MBxAtKrMOG/BoBOszkTu+o4bELfmU2cVLbvZK+BZw=,tag:u6E7DZDrC58zbpYf9tqDYA==,type:str]
+    pgp:
+        - created_at: "2024-01-19T11:39:40Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQEMAwcagTG/Fm6AAQf9GHyWG9uFys96UFgblo2g48BkvqjE0E2PCwwXlop1s6Uh
+            pN7Rpcckfurmx3DaSMXBjIfY2R8M6Wain0Jpf2TzBQ0IdOF4l9p6jakFFXgaWV5a
+            boW7Fznnido8Zdx5sgMnehKImDM3L/v8eYlD+Eyn94ZCBYbtwCMFfWKtWSAbpl0o
+            399th+JpHoFvKKTI/wDKjz4jUJqFC5Hks9HOhIKCdz2dlkPLd9UCfeJi5q2p1NV+
+            3B+MtYIO/Zn3BuFmb1+vky9TL5r3IYkIaqHZuuQGaUBXn1B8sfrGEjvz/ya3+cJ7
+            i3SXHJ2X2C6kIGXXkYhemaFkVzEF+12eiLsUmG3BItJYATwwqAnVm/HDCY/VKUTd
+            +dEr2r9C+0oBxEqVO/F4oejqO2nmQnGQCKi1+bhGANmQrwEYbkTBfDYn0bfTDEMl
+            D5SRIgYZCgp6LnVe9F6Sk9zeDAF4ft3gbg==
+            =sTEw
+            -----END PGP MESSAGE-----
+          fp: ad382d058c964607b7bbf01b071a8131bf166e80
+        - created_at: "2024-01-19T11:39:40Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAyNex7x1cALKAQ/8CNjH5k/sDtgBUm9DCKaIPCL2SYrhXrksrlZDPY+PaPZ4
+            WaSRYpfYjzyQof8HxhMBSVQXA763HAz2mlq8Y8ySsgVQf5OyWU+xK+aYE/rmz+P4
+            vzRjI8PYeBqCJ52G2RTpd9ddQsvuoB+U2IJ8dsG3jVKW5JPcwC7O5JU7JIadebRD
+            TYSZISarvOyOjxP4YO7pYFQxT7BdAIKx0hYGZxfIni40XQrUbOvRUC3D+qzW00tA
+            bsn3NihF7FJpJmC74T9JTeC21sN5TDbMzSYzDcr5+9m5pQJJtzJkrzb+fz9n10j1
+            zOr45bay8OeoZHgRsUupAoOC9bxm0ZY2Jju9upv+EDnXL0sCtdYl8qTlty3FOrOd
+            wCT6IUmJfp6cexSBj6pekiSuPr2xm0Q5FW/gb12fxlVRxpFI6c+ZwZfS4Zwbjsuu
+            Lpl5SF3Wx4KSMeMhH8MbQWt1ROr7Qr1pnWjKPPIZxZRnuP+L2ldvhan58NOS/3Yn
+            Hixx+IcA5b5wotLgL8pmu+iItJXMq3TAIoeST9KjAUCS1+YNNOxHG7XM7g45kjMd
+            icowmFrj1ec9zX8bcm+yaUXX/D9JqO6+fS0GgAUEwxnCu+uu7xYvQLwJmsENo8sn
+            oJw89ixp8Vlsr2oNPcRXVuY7v1AsoyqFEcmy7wtLMo4gutfPBqPYvs5kclXaemrS
+            WAHfVCM3M71940Wp6Ti49RcePJy8XZTuPAN7NSHg2KZTbpCcqo2XaBZnfDtYi7+I
+            iwiSbCovg/aLWjb4xtHEn9RjJARFLpw50UDg5dbk+exU5skeoVvLq+4=
+            =T51N
+            -----END PGP MESSAGE-----
+          fp: d286fd9431753cb455537070235ec7bc757002ca
+        - created_at: "2024-01-19T11:39:40Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAzTK+524Lx1AARAAgUzT1i9Jy9IcXPw8ybgJ+/DMyQ9OHfQ+Lykb1ylE7m5n
+            vVg+AuDLuRYp7Es/Y2jD3K9QKZiPdrcFt99Dd3TVK2FMjnLdLspdJybVl3pquJ9a
+            oE0pTNLDtoV4lN96BD3CAFvvMvfDOaXyNDUF07k7TsAbibfU6j5QSdXUGaKqSaKp
+            SPm8sKKD/VDBBPzXt/M0Pv+zHwKjwbpkbE4Sfqc8ArwftEu/yeqxiIWCnpURAeWf
+            CkdIWFYAPhCKXn+0grGw++oBVPeMHMDrugMSNyzWx4pkNBezbchckRnmOfzQzYYg
+            Hnxjq+1ozVa+eRJfBrFwY942g6c3SKtkVNOe5ZuSGER8xJbp1zmNVGZnm0Barqkp
+            wudaBnztd4wPPKdd7XALJDO2KVQJk3uIi6J2dxxTF91qMMupIHKDGwh54OSdqayX
+            64oh0NRPDk97GezSr254X3NGxcY0t5BMt3TSOoUUOcybxEU/fhiE9KzcUEi1VNzm
+            unFUGdbNYQrpjTOdKFA4xtY9o97g98yZvYYS8dtxcx2Q4hMla06Y9aRBeMBJe3Um
+            kIZTonVbwCesP+mJ+lUiXusJcF5Smr6LZvL/E/472nFTsy3+25rLOPQUb6XVKU1h
+            sjiVRPfhVf30WBxk6BJP94yzJZF2YW8eCRsJ4rmgIN6VeL9oneOXHI2T52DYEgnS
+            WAGScD1Z7MwCEiMB2Zh1vpJWOBMUAfq3FznHLNxx7fCKaggEM0/qAq4oCRZi0SFL
+            v/oJUxtWWKpoNicO4KGuHZIr96JhI4P7YcpaT9DKLdy7hkwA7rmr604=
+            =ARNh
+            -----END PGP MESSAGE-----
+          fp: 20d2e2b90c6aa179585b6b6b34cafb9db82f1d40
+        - created_at: "2024-01-19T11:39:40Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA187ia82lSDGARAAkxgDFQREsA4XDxn1Jm63JxPf4yIyZn0mgqPmGPKOkk9i
+            SLuRXBGvD+VHAE/e/AZNGzR3B8VBl8ueF6ZFcZHna2SE8wWqFFk+a3VLRZpavj0p
+            5swfvaveZlOPrKMPlo3EHSLZmOe91DPMD9/5xeez6gNzL3y+HGvcTgpothiBbg4f
+            FDbxdFL409pKHOhL5g4qzrTvBt6mhTu+h9bd6LRnQzV0XOfIbG2qA8I4ydnYe0sX
+            DncxkEUk1c/2XpdNVOAl9HrEfjP1Nb3AGNJwqjlSiEUEibYIcXz/AnZ1d1ej0PfO
+            boi4+wuUmuJY+pn+2CZaVWvGrQsocErB/lsB7C0pxNhZKfyyvf4GuMY191ez2lnW
+            AP2IEL/tXm7LTEMs0am8fo/+btkmNm2gnta1BNfP2B1BFBQH5YNrB1/ZfzG9K35E
+            TyIlB6em5ghzAUeiDRqnOPqQkW9hyfjDsxDLjiOTALmX7QOkQ0s37nUI8mVs2MaQ
+            RMDIjicvvnXz9r6m+X60bpqNPw6y23kc/nB8WNIvWOERuS7nNY2KgI0rfKagNjuj
+            eoRHVv8YsM4IDJS092PbGzhekrGSQqvrVauPzL6Xdl4rESs/jXVajdyi9CAET14E
+            ul5SK1ofIuHAf1Jc3siAMg5IxGIx5xJZDC5Q+NfMgqtBfr+jtIfJp8cSOCBfUyPS
+            WAERvNTcoNGi+bnPcZWcxWesjEZw+3yacUnSZLApbAZa+yNb5lMiXqkeUwYRx5Kg
+            Lzxc0n+VvwquAI/qVKvwjCKcDcUJolpOy37JVFltq8FcwHv6ArQ8X7E=
+            =TV0x
+            -----END PGP MESSAGE-----
+          fp: a32018133c7afbfd05d5b2795f3b89af369520c6
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1
--- a/secrets/rustic-b2.yaml
+++ b/secrets/rustic-b2.yaml
@ -1,68 +0,0 @@
-rustic-repo-pass: ENC[AES256_GCM,data:kgSEAaZBxQCUrJBgo7fp6PeqXxpC,iv:8NU8xrifhp8FAYvvepeZWj/8yqMnIcK8uhuRjTp3gqs=,tag:YEtfgT4pipURFbOLVyXZZg==,type:str]
-rclone-backup-config: ENC[AES256_GCM,data:80QhKNkoZmMOj8xv2GoMdwxAlSoRG3bkqr8zBPYedoiEMKptzLKAjDCtUY0jA4jeEewikibLvDdyxwCIi9aA9EH9nu6FaimEt3+u1vjp5ZoKEQzxnncQKep1YF0s7mhVwdefI7utVdvF6PTmHXEaB2bHnW8cWVcpNqR/y6crZc2hZhsxB2eJtn4eetPka1s5Wz6NqxYxP5O4jcpIoGYATTn5MrYWmO1VNImYMJCTXWOQtMMT6AGIT83kEMdLju3hozEuY4IUdN2pmEJsk2PMazByY7ufDjKsPVKCbGcm9hXwvDaQvqclZ5xqCuBKhMm467WVIa/sgZY2Pt2CKUJ6x6E+XXhE6QhmuU8O+Y0vjmG0skLqNuc2+9DVq/Z22/VbWwOJ3yS7mzWBGlL5sW9pRPC6kCADWiWjyEduCrfBky6zaIGuT8py/AQcZn6IhMdkXwOf3SsOoGTKzhYy79+mzip6Lk+jyKEKqDKylxq+ABwpV65mhf6r6VixZj66WpiY5imN18xJgc2tirblzmoX0fHAHXUsdksu3ecJb31uOrhke+GJjkICwyAFB6BP4Ef1lw/nmsjYMBMbhXD3tmZP6+XaQnDuB+QDlIAQXXBqPXmRn2mrRYITZxnIuuH46oSdOlKi788XpkTSZtrdAsbaOjZlJ9M/IdZYGqtegSTKP7ecbgUVmzdpSMrqjl2ylR76qSeLZlnDDQQA3ph0g8685mdc5Kz3PlEEJYDbf4IQXxIW0Uz5Oyo5r51+yMOSbm5OmiEMZiDpKtH46ngmlZPGAe+NjotCoD7v0eCVJCTsGFyuwcRJkdRwUAGxXXBJ7KHQvBkC+3MuhGaa0/9dlzMTaIoXBuZ75jHfLLsifZtwRHYqpk8ZeJ9toODgn7OGpO90NsqqPChRISw/o2XWKF4yv3PdM5/dYxTlC8qXNPpUjOQ3JX9e2JEBVA8euAqJseC4a9YGcdXyaLAwAt6VU+6vC39VdA5iQOuB7FpuSC3wDbRN5gPVuvShglc3oNtQ7vS9acBhlogX1A==,iv:Rc20cDfKUJsWcYX2nhdRkV6JJyui+nMVd7f6FjGHte4=,tag:T5XKGHZSPFDl3BalF9gOgQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-11-23T20:51:04Z"
-    mac: ENC[AES256_GCM,data:UQ1EnSQGeURqpafzyS88ZmeEU+QEimWzL1TwzpNtOC7QojaPve05RfiCw7dPZnkH7FJblAkDjHSCrT71f8EQuRSSwLSC9xmQYpihctRGh+0Cg8tY09xUQbHj9TtqJvYj9dOYXj4YfjXpwBr1zts31WlX5tCNSLKVO4Wmx84s1Ic=,iv:G54KDYEs/mJsjyC/CUWmK4QDSY/zw4jseKv6pTZkk/o=,tag:ZO2wo1WccIznidbdXUf8dA==,type:str]
-    pgp:
-        - created_at: "2023-12-18T03:46:49Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQEMAwcagTG/Fm6AAQf/Qx0seTeR0SzvNGgC159nPX+iM6zO6GfVPyq2DYlzPBav
-            roF+g6mT+3j7d7IC38MigyNlAtHYehIxjpJsxOTqa7FeENaiB6A5VCfJAyr6WBYS
-            l4pha7635j4YqV06R3uPNn1QZHoBFrYJUha8CYhUXXHE+RNs5jviVx8YrGU1HIbP
-            C1JFNK3xQjHi3UlYfy1goPPZ1F1gJb5oNLPEM1AZEuOwNJPkIyKzfmt96VsbWujA
-            4a5zha606K8AElp1uhtsTco5sWrw9I3FNR59W3VRXdYDrriXIWSSUNbwU2RZuFVK
-            fpRt5o+iLsZoSS6xwHhTOFic+wFsyqmFtiKp5bs1DdJYAU81dl3PTsFY4DSsncWD
-            +4TWmGXIf4QIvIkMiYPf+2x4ztJJTsrPuVbnl2hJe5R1FbxQxg5wfUaTeNbnH/5J
-            AslH++tb+o42OCg08ZFU/Tg3s8LawNWXdw==
-            =2kxp
-            -----END PGP MESSAGE-----
-          fp: ad382d058c964607b7bbf01b071a8131bf166e80
-        - created_at: "2023-12-18T03:46:49Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAyNex7x1cALKAQ/8D50TIw2O6twaO44mLPW9dmIkJ/GiPjZp+S5+jrlCI12N
-            vIDl+MWooesawOR9OrHFH21j9ev6/HplNCX7hupwnBa5KEtdAA+SPBUAySBQiWMk
-            f3SGiJ8zFkOmjeO/Fy8bQmt5j445SxRluZB3ZCbdKItOb5unP3fOZZRA+MPlHf2O
-            GyBJm9kDtqBJxmm6JWhvUzQVRZMyR5Nt9c7QUDPLxGFXS+s32eT9zVhkIiVBFXOs
-            WmkAVJCoQGs/7YqBdfxPAWGHZfEcgZw6y4m+qVEjGjJLYz4wcH5oSFKoLQtQmcXc
-            V22nu2F+HRzJ3TgB1s7BMjbEwwX1cPsiQCNBUVtC8mL7P70Rby7gr6TDRoIogO9h
-            ffv5vCodcDv6nMSjl3E4a7FFAqN+H+H7pFOBdQNnAFpdGVKR3LlyEzXlViUCjsG5
-            gEa904DgFE9F6znjhnvoWOcL0xvz55mMfaGnln1QSXK5IF27cDGwf2QO6kd7DCuP
-            DkrkvzfVSM1OsIfN7U3BQosIPpGsx2XFYSQhSCBfsTMdsg39kuhVMM5awAREmPFh
-            VmsWBllqPP2xYOL9PbFVAHRXEs1f1GE2RD2VVpPtIQo4qoHPYvlSm/1eRqItgwN6
-            m7GFKfU3MrJ/hqqlex+DxROecxv8b1dPtBnd17UUVSQ51MmGyeBtZE9vv+lrqGzS
-            WAHz+4uenFiIj27KhXhSrRGxA4RIyZ1x64rOF8dh7vEwgcSjLkZ8wHgGCHXAR6/X
-            ReEXlRYZ05a0R/SKnfUo6FEH/eaERQzH2TY1V6KIJKsfRij8At+R+Bg=
-            =fR0e
-            -----END PGP MESSAGE-----
-          fp: d286fd9431753cb455537070235ec7bc757002ca
-        - created_at: "2023-12-18T03:46:49Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzTK+524Lx1AARAAtL+t7jpuowt0inwTSojEdg+AocUdLopI222jst190Fy0
-            b4JfEtx8VRwJ4CIbyTqasKpKzVdzVaQXM+YnITrvxupIC+RIbUXQDjrpt+Ze9eLh
-            JFhKh9SDGJ4PTM6dfx/crjvMX9V0yufAEltFY3MRyA0zUIXoehh0TNLMX6DA9S5P
-            MalJfDXaPQtzBN3bNUCVVlKjX9Tp/BA6Ukow5WjAd4kGEgcGC0i1Z05gpftAdxtN
-            2wrwK14jVhoJpeeFrtwP/AHnvSKiy0HzP2qddJFMN2pqLbnB9uYYIWT4DCGt+OxE
-            GHaDjOwTg53Xg1fTb8eouOafXLxf8XfI2JQdX7FDAK68pHiOC/uZ6Dc5IvgvUjLP
-            b6BrAPmPeeKkWVR9D8LqyWrHwL9KJSEV+tVc2+o+YgWVPX4wtyWz4rYqus7e0TAF
-            PQBOOA1VgG033YCMtaYlSeFKhkmAfKgVpfrqfa8JC1M3x7pEIf04sVDiTeeY06rd
-            uzg/5ioQxwmtsI9M2Ns01NUL7w12TCli61Hl75MnxY9evLEDWIdyvuT1mRvhFNuL
-            ZMMae4rHrH09UZSiVGSAyhE7gDVeyggrQg/ZCIY38OQ7VVvwVAfZsMUak4SoRZwy
-            g94Id1NCxwTAKfrNv/97AmAFyr4af8OZZB74uhU78C2lWmKX2xSbymqSXwY/rrTS
-            WAGYGu0je07QYBVvUH44b8yHwegYRZpAU7JlIuDhyl6WlgadAOT4GP5YxRQVDMjG
-            waiPRGD3KECFhYW/4DzFD0jaD/nuzROKZiqTMRqKKt90NV1IBl1GmdE=
-            =Bnwr
-            -----END PGP MESSAGE-----
-          fp: 20d2e2b90c6aa179585b6b6b34cafb9db82f1d40
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1