sops: restructure secrets files

hosts/alto/secrets.json

@@ -1,21 +1,22 @@
 {
   "seb-password": "ENC[AES256_GCM,data:oGrXukkbK9qYYo0ci+F4RwiwlRyme/+ypJozgiqH2DFd33SyjYnzX6u2f6a0+rIfwxO45dUrXCJyidWE2Fw26xE/uH9nPmDzuw==,iv:GpBQNm1jspU8PCN+SzfAUKSps3YySg6JJVYOLOFetOI=,tag://NpB2SnxWlJPHNp92hdVA==,type:str]",
-  "tailscale-auth-key": "ENC[AES256_GCM,data:lGXbnNHnlKSv2Po4J7yTVOdCxwgxENBglp/MLZnIpdqVxEkO3D2Risi4iPkVPnPyKBuI4hog4xtGyiUH5L4=,iv:Cvc8+VPRpPrNYTcWjBYBPzYAwy80hJv1VCR8hrMh4AM=,tag:+qt5Caaxfig6TqoJm/uCwg==,type:str]",
+  "tailscale": {
-  "service-tailscale-auth-key": "ENC[AES256_GCM,data:9tcgzoRvxKaop1wztCIQmyej7mhou/wGlLlX7JY9r9RibxAmDX61mO28hFrsFQQfdmQTulbcSGPgZQN0xl8=,iv:8kA0iTunR6E9GRy7lrRVv2R6oYA4IijlbTuT9w6NqOI=,tag:pdkr9HeNGD38zZe6zSQFzQ==,type:str]",
+    "auth-key": "ENC[AES256_GCM,data:oTy6saTT7W8SJl0nkt8KvdvTYzfhJYrCYB9WtfU2EUDYSv+CO1HyO3z37wZIF5TmiJKhy/ZZ5sRBMiIq9Fs=,iv:IWwGbGzSAt4RQCFUbNuZOdS3oRwsVfBJg3wR9mgo76g=,tag:hiKl95p1sUf619sWK3ITjA==,type:str]",
-  "nextcloud": {
+    "service-auth-key": "ENC[AES256_GCM,data:XLrjiJcwwBXElFMymxo/mmizM07SXscnlEbwijwT9G4mT5/PAFWXZQ/9/yxgkVVHk/1Sp4wNFLj2OV4+l+M=,iv:eZE7TpMPK8/urVm047vP3GO8ai+zzee6pMkd+EnIG0I=,tag:dYvMrulDX8q/lRXXvnjHIA==,type:str]"
-    "admin-password": "ENC[AES256_GCM,data:TepYe5rZox6aoa3jeIhmBxaZIQGpjjf+SAG8E39y,iv:cAanc3a5e3PF+BkiFjcME+PiTSRaNj/e78kT/RTbaxY=,tag:wbn4vWeDnSJH7jWu7hutVw==,type:str]"
   },
-  "hedgedoc": {
+  "nextcloud": {
-    "seb-password": "ENC[AES256_GCM,data:+pejm+Ju9l1jqY/8gpWRR6I5z3VEFzPxzw==,iv:0ji6ayKljy7LoZW423xcMmKJqsbon3JGzEb8KlbR2zs=,tag:sz8Szb8wA00U9Es0q0N/tw==,type:str]"
+    "admin-password": "ENC[AES256_GCM,data:OGiUZx7r8vDHDBkYy5HqglPrNFRH5lOx3oOjbMXn,iv:amsWIkrqNvvrCgAUlRXwpmS63Z8DlLRXMrs8rGYxRzQ=,tag:TOtR7mVa1MgAOOuh/+5vsw==,type:str]"
   },
   "restic": {
-    "backblaze": {
+    "password": "ENC[AES256_GCM,data:0tQzfrSShJ6mrwjB7LRdO2LTRUxgTwn4mkA4Sze6,iv:q5qJkB3+feZyEm778hKI8ikNz9/9dj+Z1hda6M4eHfQ=,tag:GzqZtsHQ+7+uZkXp0fUheg==,type:str]"
-      "key-id": "ENC[AES256_GCM,data:NLi1oxFyJGtxUiYmQpLbiwiu5aKHek4jUw==,iv:99ZWKy7ZVQx8LxMddu/s3LoIl5Ap6RKWcp8Cc4AK9Rc=,tag:luq5+koITm69eiOTESGMHg==,type:str]",
+  },
-      "application-key": "ENC[AES256_GCM,data:15z8f1TpIh5IWpPd5bDSXAMgkX3Y2SCUFPBATQAjIg==,iv:GatmQHcMQxCBNiELorVUtPu/MCqenNUk/jkmTM0kmr0=,tag:jVCWqGKqFnzqod6Xb6n2Bg==,type:str]"
+  "backblaze": {
-    },
+    "key-id": "ENC[AES256_GCM,data:76iz4VgC7tlGcRH9eXFToW7uUDV/NpVRMw==,iv:TEtsDdGmB5MVuIOPVr6UxOaLAfbGKOeZxXwaW86X+t8=,tag:TtyZ2YSR3I0UwWY72ZD8Dg==,type:str]",
-    "password": "ENC[AES256_GCM,data:NVeqrWqtdgbhu3U7dAgwFeNLS9oPtnAPSrkGtvYD,iv:3l+9+bZfOpZdSCBKzXn5PqJvqo7mz/rj1tkihJqMHIs=,tag:JXigRR1adGlm8ehRv5wzIA==,type:str]"
+    "application-key": "ENC[AES256_GCM,data:BOoQGhdgwcOgxNBMZkU6Pnr4QafaHVrwZgK+VGyP0Q==,iv:UTn1iz3fTCVleFSe1yP6fOJB4DKKQJEG7naZclJ+i2M=,tag:pJ1K6LK1hwDwLJKS3wqJUg==,type:str]"
+  },
+  "healthchecks": {
+    "ping-key": "ENC[AES256_GCM,data:DbCOHc13LrdjZ3OOqH8nwliEi3IrSw==,iv:caY1tuMTxNyl8USsgKiSuAOIczvn/Xdx6Taj7BQRCyE=,tag:W2EBgrnCg69Hli0f2+5Zrg==,type:str]"
   },
-  "healthchecks-ping-key": "ENC[AES256_GCM,data:Cbk04CrYd9WcHnVRUed9aIImHbULhA==,iv:70cOOk5LfYciBx5baftFiBuquXY2welnjhoYmIB1iAQ=,tag:I5hqoai/HLdqUqonK77ubA==,type:str]",
   "syncthing": {
     "cert": "ENC[AES256_GCM,data:GZBD/nicqDLs0j/6HUMhkJkpb9P2u31Nf90THuLx0JzQL7MwD6xd1wMPWwszZquQgAF0SHPvZN6H+xstBeKYenu5VQ9rmcEBZd/60hLxaeuD1qXM2puZMwFNrzS1AOow/5BHPSI19a7jgewYPr5h2wlVD4ynMTuPWrJY2BPYB6rGEZwudiK+HxQEN0f3xtLramfCkYaeKypPLUfYN94AaXLU9MPxZx0ZNo7les4yQgvXusVXYzwk+pb59isJpdyX4fOeIfG4O9ri1v+lBxNo4bTj8DwFj4v8txXOW1BFcwEd298ixpz/z9FvrNZHCcOuTZKwJHiAQRj6+DDxpvrjEmBMBs3PaioXT7gNjahYfXLkxSPlF8JIwCyU3WN3gR9kYRBts6ypQYEOXEp+kyR2arha3LQmmg8/CXpzNnv0rKu/Ad+MEa5QJvU0MRtQePBxWxRG/yvR1oAQFsPI1YWOqo8xswxMBZGVDTMNBGW1ZCvZpNkVbX+YCCWLvXMK2fv9bxgxfUDQmI2R9Ajx+lXCDN15bM5gHEhgFNfMjWuMHQzAvXr5Ghye4ugw5TBYQpxV3/2ye2FxmKdPn7gVUYF+Rr5x+TyQux0/hpKHyAdI1SnzmkIIF3t4WwRmwI9U41LD0LYC0mZRGJT2CjDYjc8ZvC74xcPrbeQ6YFjF0SfFoEcFdtiNulzk++AZ0M7ogU/mGEXLxdLY4kaF1Ub2fpnwRxPx/LJbZssl5H/uWV579uVoX/g8f6bzNeE79W9eQUUaQIpimNwXTy9iZ+AUS88pjUy8PkabrBKgdszGSzIU/I1Yqego91njPefXbC5J8QglD06SFqUOGemOuZ2OLtUIsvj3WMzTEJTisG4YVOoyFW8Z8y5AfnVhsyGUj1mOSXVgmPEA8X3lidsg3Uk6pljAB/+hRO4OU94OrxneNkJdXBRFmw7V0sKALG/gOGE07l+MqL3NAFFZO4v2RYfOwWCvEguxhfVswg8GrIszqSNh8ZwIOsuCzCI3TOymsGkXdvEH9ayTkeSq+Bw1xRHpxeRAzXInpzWvclsPpUc=,iv:bJfo1JZ8muYmxoZfCx3x40DOrnstSChjUnzF+ZJjc2s=,tag:/Na5Vn9jxuHUCNsMDdT+yw==,type:str]",
     "key": "ENC[AES256_GCM,data:vXMeQOsLT0D5oGkJ06cihrUpWvApZkBHJeR4NBF7bls7/b9dxuxyOBjPQQqHKHB0Hh6jFuDP+DTRI0Xrhwr6592CgBdzSxoV35GJBCXtaF/z539RlT0S06UECk71OCauQ7FNVZPgnkjjZ7VzdQLsgZZDAqtzT5bzmExZwI3hcj41VHz7pzRnv8ctax3qKpkf2A61Q3C2OC6l6I+n5/aOm0pTjKskNCO3mGUqX8UWw0ocP40roNTkABnyMZTXx38F1Nvy7NFA5FaLMhCZItQLYjYIKxd8ep6GxjKcq8etvTWvJi0hE6d5cfs0Of9IKR9ESuPd5seRN9HCSWSZo2LqdMXjeu+KQPTarz4FNRf2cY7nv8R9ZWHRjbzNMTZZ7c5j,iv:IXlcy7FmBJHf6fP0B/HhkcGZxKUu3VivhFm8u3jYxkc=,tag:JUFwZn3zIXcax3IDHChOvw==,type:str]"
@@ -31,8 +32,8 @@
         "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBac0VBTXZVdmpjc29oMkJT\nVXhoZnJaWkFjVEVtelphMzlBM1BaNjM3VjBNCjV3U2JwUnRjeEhWWVlMbmZHcjJP\nT1VNUDlNUTM1UjlVdkNGN1BrWHNpVTQKLS0tIDkyWGZVTWFIQzJrVDQ2U0ErQXRm\ndEhnSkQ5SDlnbmhGSVdYaDNuc3ZkM00K7WPEZRYWAd7uGY0IcDwGgQVPrpkF/tnz\nncj03JXM4BXwvEQOmD/i6wS4U4WCwkh9EauGJljVFTeu6TciomDULQ==\n-----END AGE ENCRYPTED FILE-----\n"
       }
     ],
-    "lastmodified": "2025-07-20T12:56:16Z",
+    "lastmodified": "2025-07-20T17:36:35Z",
-    "mac": "ENC[AES256_GCM,data:Y3DLDLiSnNpgQnEMoHadbTKR3HfX6foWS5u7/g0WdNnsCupMcPz8+oXkcMbSBXxQsl5aMiMV3o0Rlsdn5jpUFhp9A8sBgzTyB8bIU4+VI1ONjg4UUkgq2amC0QE+QgkEHTCWhafMOtD8MKh9BJsky7fVrQ5mNdwt+JEBonMZgrY=,iv:dRaF+spRvHmnA4l9LrX/XqTprqZP41demvhiS1n2k4w=,tag:bE4Jd6Vx/8whsWrRUQbmnQ==,type:str]",
+    "mac": "ENC[AES256_GCM,data:oRmWED7+FMKcwobi7mL5rsHW6QpNox2fjChVT2p/NO/808MRV/uP36oO1BYqbnfJTC0NWPhJRxJ34IkPRRI7UkG22v/PGQ2pKpo7qIMu0ZnfofEwFYH1tXyUG+M0SyWYABS//cuUbPl8G9OPQQSQPTxVsjdcNI5cqbkIxzV/GyA=,iv:ddPkLM69Biaz/vLnhuxCjz1VaiHdHOqGYE3p84HtU6s=,tag:qCDw9GUuatbk23vKINARSQ==,type:str]",
     "unencrypted_suffix": "_unencrypted",
     "version": "3.10.2"
   }

hosts/cirrus/secrets.json

@@ -1,6 +1,8 @@
 {
   "seb-password": "ENC[AES256_GCM,data:/J83cgpBhjl6VveVZTX0ElEyexn3G3pZp6RKgfbR39QoG/5mExOk2xM999YFb5/vGaivogGQeFhwQ0j5Ij0KdaWCTXkFIQtfBw==,iv:GpBQNm1jspU8PCN+SzfAUKSps3YySg6JJVYOLOFetOI=,tag:QTqmyyywH0cV5rGQhPBBGg==,type:str]",
-  "tailscale-auth-key": "ENC[AES256_GCM,data:u4F4B7cxqX5S+25lsB/X3WUYJFlLrIcqA+pWABDn0j08nL6a1Vg4n94LjkWYlcLIj9Axj9UCRurgPVwNpA0=,iv:iKZzHTD00h9/vwkewo14Ox+9EMuo5GawemRVjn1gLuM=,tag:ikLoAEbMDNlRZ3PGke2OZQ==,type:str]",
+  "tailscale": {
+    "auth-key": "ENC[AES256_GCM,data:sH9ZuawDD1QIA99hqkXBaSjoZK9z3UpXCd0p3jAMdpeYkXcPITM8UbzWQJcA4TWKVQdBbTvssFmRMaBE/TM=,iv:ae8IyhCwxroI8PnTaKHnAIhfEIiCf8qJePUOYUNctcs=,tag:HtLWrxj4wO8SEpjDsVTEMg==,type:str]"
+  },
   "hedgedoc": {
     "seb-password": "ENC[AES256_GCM,data:hzUFWZ3m6oIUOySTHfRyEDSNqYIfJndYSg==,iv:wg8aMAEbvCYVfqMhikF1tbEdB+CYzLB4azlLN6OU/HE=,tag:Yf7xUBwIetnkUnncOi/V8Q==,type:str]",
     "gitlab-auth-secret": "ENC[AES256_GCM,data:vxgXbP+6mtWpjgfsEaFHJd5IVM+oPPHhYNqwO76+Zw9j2fZZane4T9YUixUvM3kYQwW+Ml/gRHn9GjgM1fIYRRKAsbO1wA==,iv:lyfWZFwZjdP005X4USGKM1OWKu3W8YTZ0oWODhF/uPI=,tag:3Kj1/pUjMo8GjIDTdPBo1A==,type:str]"
@@ -9,13 +11,15 @@
     "admin-password": "ENC[AES256_GCM,data:DOZah26AGeR89kgeIvWPCJlVRxML9r7F2g==,iv:4BCOmHxzCr4Z3975MN4mr/lyeEVyJhwuGfDxek6GiSI=,tag:IsgsIhrTEMRp1/FFFQbyhA==,type:str]"
   },
   "restic": {
-    "backblaze": {
-      "key-id": "ENC[AES256_GCM,data:PWe/VRiXKmL4/fPlKj6HyYqugJ4wssWKjA==,iv:tSVeVcbZI+AuXXllEax+IKD2gkNQSDC5cW0yJa8Dfyc=,tag:5A5YgQnM/Br47sYCQbJOcg==,type:str]",
-      "application-key": "ENC[AES256_GCM,data:0W3eE8sxS6seWX9L1koksN6lQLJ8gFBNGh8fSadSIw==,iv:8Eyu9vKX9IcY/Ixgy1jigl4Ef4e55duyZZX4nKU/At0=,tag:S+LwXW0Q6q6/JN7AjyZ+3g==,type:str]"
-    },
     "password": "ENC[AES256_GCM,data:gMd4G8o83r3sTZEH1kRkn05Mye96sHV2mdRWNbbS,iv:E2hBYbvpCMDul81lgUBNVr5Fm7x0u1f9cEkma9jKwYE=,tag:CeFrP3pO1VmGxcvj7b7pYA==,type:str]"
   },
-  "healthchecks-ping-key": "ENC[AES256_GCM,data:HT6bEtZ4ii3na8VDRA59GHtRuaOV+w==,iv:ZZlnpDPoPUYgq/jHOfCqHMUmKpPUTpXmZp3GWxYAL3I=,tag:Lg97lItvoGzXqoz6Pwadfw==,type:str]",
+  "backblaze": {
+    "key-id": "ENC[AES256_GCM,data:f/diWMmhlyenBfNJKpFHFXQ0QxcW7iS4TA==,iv:FOG6YYp7IeZ/m5p5TRTpzlg2w0ElKXte84ZKU5+3Wlo=,tag:lzhjZDPYWZsCITTmdS0JJg==,type:str]",
+    "application-key": "ENC[AES256_GCM,data:/ONsUFVMHBOHydGpYpsZVpoZ00k6mrhf5e0l3GjINw==,iv:hTCeTWLuUwePgVSksg8EKOJ42b1SmfhTifFk0PDYoMA=,tag:mHo+uBTmT0Y4Sd4PoNT1EA==,type:str]"
+  },
+  "healthchecks": {
+    "ping-key": "ENC[AES256_GCM,data:Lwn1O9M9jXmLYv203lUqSxD02qUDpA==,iv:3pfIJ4LhgOw2hHm75OiWdrqcBTD8h5yCwik50tXDp4E=,tag:T4ND3XCnevBGqpriugu8HQ==,type:str]"
+  },
   "crowdsec": {
     "enrollment-key": "ENC[AES256_GCM,data:gcoLmZGUqH0brtvcXiZwXr7CSc9GfEWkvA==,iv:ZLz/3LXSYVXQtcyPZ62qOuslexdXh7jvX0MzoXjlRgM=,tag:V/SwXnNDQkiRQEu90ZTnTg==,type:str]"
   },
@@ -30,8 +34,8 @@
         "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhc1E4VFJWUTl0Nkhjc1VL\namRLN3pLcVUvc1diWmhHTVdTYjd5SmxYS2hBCkpQSXFnQlVqcndtejNoL2xQQlRh\ncG1uNlQxSUpJc0tRZHZFOVhibnFZOUUKLS0tIE84UGtkdldzM2oyTmF0Y0xPckpZ\naHNody9YR2ZKTDNINmNvbGNHb0dCRVkKXcUQxU0Craqkze0l0mH75MKTnkf7a/ae\nXeqWVJRO1WpG+UhF3QB3yMq9uy0vlc3JnD3LsE0inWUSl0s6AgDZOg==\n-----END AGE ENCRYPTED FILE-----\n"
       }
     ],
-    "lastmodified": "2025-06-30T21:14:35Z",
+    "lastmodified": "2025-07-20T17:33:21Z",
-    "mac": "ENC[AES256_GCM,data:2fDTzibwzBLx1L46M55s494wlbdvAPEvba4T5ZqgspQxxiyiN4FTnhwrDFu5a8WeRTSIxsa2dGTjtPX7z2LCe8lbyxdBDDMtD0neJuHK18Ht80r4dhGR/h0KPvvf3yjCLytpP8Fouo/bv8G1kGscwh7nr419vIMcZKB89zmXpJE=,iv:DHMJ4f+BpJ6EslQAOV/c5Evu1gwNL9bxJ8PLNQUPkgE=,tag:3nkwNDpO7chRz3GcjN+1Hw==,type:str]",
+    "mac": "ENC[AES256_GCM,data:vDFnuDDAgiYF3Pb00DsgqQ8i3PMBskCPjccqT7NXY8hMyCD8NNLr7FT0R1k3zv1g7Uz5QI62vcmRhhGOdTib7vbqChSFvSbspFVW6j4ZPrUrOvHJDb9xEi3AiJ0fvaCwHq9V2L7d9KqZ9DgUeZNfTFZtVqoEHwCVG/XeEo4aN2M=,iv:4PKy+GXJrCGWkE2EOtxSCCDcEbebIfsHVs1ZOyDe75s=,tag:UYleTirwuc2Dr5D63+upwg==,type:str]",
     "unencrypted_suffix": "_unencrypted",
     "version": "3.10.2"
   }

hosts/cumulus/secrets.json

@@ -1,8 +1,12 @@
 {
   "seb-password": "ENC[AES256_GCM,data:laGJomW5c5TB3alpPgZKElQ3Y46OBxPrA0AxVNgx/09oSuG0EM63cnnkwZkrTeZxqjBH2UOryLqCr9DUr9mhZsovqNtZ2t8Uzg==,iv:GpBQNm1jspU8PCN+SzfAUKSps3YySg6JJVYOLOFetOI=,tag:2nARGI9XwzLfJFRhDyGBSw==,type:str]",
-  "tailscale-auth-key": "ENC[AES256_GCM,data:FKHQsrLhELUKUg/nuf/UakS14Qj8z3arRR3366Cc3wag8+lpLrVjKXT8a5ZFd4ZtIghrCSvyXUefAKcVmQ==,iv:jvuoo8DD7ls0WZA6ZrCbz3w4O8NCyXZjv1mscnx/T94=,tag:HczecDubwKkCVu04rqhh9w==,type:str]",
+  "tailscale": {
-  "service-tailscale-auth-key": "ENC[AES256_GCM,data:S1LXXdGd78y1LAAeBxQ/yC8ggm/Mq8JkXVx7umMEk6nlOx0NLHqklSJ8JX+QUhgmx9hoCBSKJ9q1DxbFzsw=,iv:uDAG/00sl/n+Tp11SmsEQFKWQ9KOxcWfvgnFnIUuMcw=,tag:3A8vv97+HmTzBVxH9hqEfg==,type:str]",
+    "auth-key": "ENC[AES256_GCM,data:hF6SMEZhCSXq0+4IYiFIUPbe+OdaBw6YctV9d7z5SGPktYJBi+Bz2Y7vjcW1gwAqIeueZWcYHXsWpoc6Kw==,iv:9KRhsNdOu0LHGBlgeovJcC1DHaiHZTXD2Z52ZRBV4XQ=,tag:b/+W+O1kmKRmuzmiPjk+3w==,type:str]",
-  "healthchecks-ping-key": "ENC[AES256_GCM,data:j2AJZ0VvRxJMsy1VSA/7mOmCBka2KA==,iv:5LjD9u08wdU3W+RlL8UK5AaU9GSy+6FqTUTkIJkea2c=,tag:wKOjFncxgURIlQSCBLXLSw==,type:str]",
+    "service-auth-key": "ENC[AES256_GCM,data:eW+qrl8STML5c3TuSDCn6VRK5hwsgr1+4VjyBw10oYSw8y2tf9yQyN8Q9U5+pscFMDncg6bmATDO3sZpNdQ=,iv:gH44PlSM8qNqiB+NXg+YiwsfL2kc++CaHbXc3YnTDiY=,tag:EfTfUYzGS+bwJlnhLjtGsw==,type:str]"
+  },
+  "healthchecks": {
+    "ping-key": "ENC[AES256_GCM,data:wlrgEbJ9B57kjmB+0hof/fJOBb4tcA==,iv:ibMBpcrSocLBhtumsSV00+KVN6Pi4SzE7soCkZcU4fY=,tag:wqYBB0Bi3M+UYinhd8pY+w==,type:str]"
+  },
   "sops": {
     "age": [
       {
@@ -14,8 +18,8 @@
         "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhSDhRQmpXaGdocDMvaS9u\na0ZyOEtNT2N4bG01NERFQTErc1hFaE1xWFFVClA4YjBwdGVhbTZ3dE9ZSFV2M1Zu\nZCtuVHN4R0NMQU16UXFRdVVqQlJLazgKLS0tIDdmWVc4ejFNRWVhY1piSTBXU0cx\nV1F2cjlmRWNKWkN1U3hwNWl6U2lEb1kKgsj22mpgxpgA5oXTXhoA5DtkySqqcn17\nOrpUiZmfOABXEZ0b5pnkAD06aW+7j2SqajYpvguxIrD9x1w562FmZA==\n-----END AGE ENCRYPTED FILE-----\n"
       }
     ],
-    "lastmodified": "2025-06-19T22:27:27Z",
+    "lastmodified": "2025-07-20T17:35:21Z",
-    "mac": "ENC[AES256_GCM,data:HPVe70zuMv3AKwxJdBeY4LXlg+Yod6HeJmfPV/h9+ykA3z9jW4JniHzdtkTa9ZE//92zdkJgaQyJK560h+tCEoZSmLplS5Wig2t9oKI+NBl4z1me4waKXSgAmhlc4J2/j+QZcUcUHRkMrUFu69ioOHE2V41WQnQ7w6sCIm6ZSx8=,iv:TNFL5PlOpN824zPX9yOmM3cpYm6vKmlHX1IvuKTvtB8=,tag:QFxiRi36TAg//xkLTaWz9A==,type:str]",
+    "mac": "ENC[AES256_GCM,data:02nsVlOpVzSCXNlLtLAEwHyaYD9+6CUUWF/t0zjIBnXtbcQYjDKG6o3b3b9kJI+mVXUhHt9JLTIVwy4QrQ/zfm1p6CVQPmtGQILADBtoC19+zwlomzo8Mq0oXYpNxut0UtKlZcHqijgbYkj1cjtLlMLltdU9M0rns8/RXZttdyo=,iv:HbDNgd7VfscKewPj1hKu5sEkACwwWER0FaAwamuQsHM=,tag:mYtc0x3R6FBBjVWyhoE4hQ==,type:str]",
     "unencrypted_suffix": "_unencrypted",
     "version": "3.10.2"
   }

hosts/fern/secrets.json

@@ -1,6 +1,8 @@
 {
   "seb-password": "ENC[AES256_GCM,data:JUmWW1wuVWiRoJc//u09Sv7UXQR7yR9b9hxANBmKEzDPRCeEL0R9Go5lJvffIeBaE9b9Mue2OhzwYqri3he7uaqfT2GPUdZjfw==,iv:oWQj47oxjxR3DBHhFwUD/Emj5ziZHwcbXzD69ChRmHU=,tag:51ncpCWbc4bd6qRO3Cv7iw==,type:str]",
-  "tailscale-auth-key": "ENC[AES256_GCM,data:4xRwzt0FLmQLpy6OIKWeouo+0lWEZAvXpSOgwAYojVSKPO3OdV4rpayAOC05TQKhgtN/3AoTsvjLof6wY2c=,iv:uW2l5Z8YuLaSHUGVj8SMZox1gx9OdmBnf7a8QtH+3hY=,tag:Jj3652MPXocHrwhr4hWKLw==,type:str]",
+  "tailscale": {
+    "auth-key": "ENC[AES256_GCM,data:JsChMH7RsPoAQIOJYd9wQRzfiHGHTLtX4Q2l/8HFnapnAs3dMZmkpFi9T39hwMs3UwCj0aJkXq5rP7PVOw4=,iv:mTv5nEyjCGunO5eSX4oWOAy5VscQKHesB7ATldI9aJw=,tag:mJW60xzgw6X2WMM6cn11Yw==,type:str]"
+  },
   "iwd": {
     "EW90N.psk": "ENC[AES256_GCM,data:wq5soegd7vQBUnIR71XPN06Hz1maJIY3eAUA6Su6X1MEQLfaSUPHYP8xxaGP8DmL,iv:RIh/45UhkyEtjh5Q0FOS63p1RRgLlrRF+QTiFozm4eU=,tag:tV6eVHRs19k+bKyjaAdPmg==,type:str]",
     "Fairphone4.psk": "ENC[AES256_GCM,data:LMspUmUJSggSa7TvM/KRR2gfcnk88/OXICEZRrZLIF/tCMSiCFPw7mi3fLqF,iv:p80LlUGQkBdeEK63dBDWgWe0n6GtEC2rcn8fToOvD5I=,tag:OWCeGhHACnkrJent/A1t/Q==,type:str]",
@@ -23,8 +25,8 @@
         "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyTVpkazRqVHdNZVNjZ0VZ\nUjk0OXZnZDlpVW14WkFxdUdNaC9mSnE5MERzCkxXKzYzSzVXWFBXV1loV0FlUHZy\nY1VaZnI3MmNpUnk4aWdlOWs3MVVlU2MKLS0tIEhucHd4MlVpMGo3a1pQSW1LMlBW\nNGxZaktVa2V1ZU5JNG5HbWlDaVhnMXcKBHy42a77B2OoXBRJdwdK4D8TQ72aJzey\nI9uP7+UdbLIabIlpoe2RUd4f9vbfXHzZTD26b0WFQT9kkdKG8jWrzw==\n-----END AGE ENCRYPTED FILE-----\n"
       }
     ],
-    "lastmodified": "2025-07-20T15:04:54Z",
+    "lastmodified": "2025-07-20T17:37:21Z",
-    "mac": "ENC[AES256_GCM,data:rbFfTg9DuL7XeQdbyFMr5DD3dTMZkx5vShO9R30CtQVe8HvAoAZwVOEx93mFFBu99KAulMVyqlxyaLgj4BfeDpAcG6iVcpgCwLK6cTWgpHTSajXUB1Bsd7LLXorfIq21tv+eLfo0wO++Gx4mA9H0zYvw/9NJ/pqYsFSxQTkpGAc=,iv:myZX5afSN/Y1RoKu694Oi403yiPdN6aBIkjXWtY+lvc=,tag:tw3bYaPhK9qIKSMneiQVQA==,type:str]",
+    "mac": "ENC[AES256_GCM,data:/GIMKxtQIleHjImbvR5l0mezIAxDlKmFyHMALyQiB1Vb/W3rOttlqa+ZP9yk1L/w4/cYASm8ovEvZeCccgxHVNOZ+JdV8qe/c80AhBHuje93sK3Ja44xEnkjntTGk5FG09DM2LvSP374qscxG0oWZ6jLLMPvlUFdY+TI6Mwo5vk=,iv:NiqQJ1dKhxoJyTW4IruhyGnFo+vsZLsWsng8AQvEwXk=,tag:n9yX3HDMt/olFQ32b2sKSw==,type:str]",
     "unencrypted_suffix": "_unencrypted",
     "version": "3.10.2"
   }

hosts/north/secrets.json

@@ -1,6 +1,8 @@
 {
   "seb-password": "ENC[AES256_GCM,data:dlItcb6M0ZBmfbFz9k1QBces/hZ4bBaRQ8zCPinvXOZSNHDE4SIQfSDQSttP1LjccuQXj5U864zJz9XuFybvQn5X4Z80VEGXZw==,iv:vORmRgBgZvdafRa8vFF4LL3fw44yZV3yNq3L8eOcQRI=,tag:Jj2QBMGZzvPx6x3NriHYvQ==,type:str]",
-  "tailscale-auth-key": "ENC[AES256_GCM,data:FkAOpUBaAmOK4f3yUHbRKoFukXIu/a/QBnM/18khO7xYeohWt9r3mMlF6+4kxbiG7ixlgYrPSfZZpHycsA==,iv:5s0VDYe3gXc5S3P4MUP1xoKUm6+06BqSjoxzQrmGvv0=,tag:bJPZhzLoMIhkWrW24rMwLA==,type:str]",
+  "tailscale": {
+    "auth-key": "ENC[AES256_GCM,data:7feIp6Zlhr9ULNwinCWfcHo552ZX4y0f/Wc4JJWzw8bAhZLNTMzXRqYqHkNacgsmBstUtGlkqcafn6RjNw==,iv:bCXH6b12hP4QsiPwgH8jeeGexuBdxvqWGPMkhYlB+oY=,tag:9kacgiepaFJ7FT3shMRSKw==,type:str]"
+  },
   "syncthing": {
     "cert": "ENC[AES256_GCM,data:fzBodmdkw0Zan9fj+7WDAUCsKMNAu1yG1KMkFhW/Qc84h6TBs6pm5EpdaT+n53A+Fa9qTHqGlQeU6JGEtluYWa2vM75V/75/GUOqOuRgK4+rRTwCIjAcXlf1U2KKvoGNpfAsgqIdiExWPmuOWFARjfaNYjHGiEZBrl24g33vguy96jxzwsq/mWfkBfi/CQUJLgTgHVlY5c6FWLZHRWWB5RfK8NQgyA6/ALpnDU8l7hSgkE/1m6eHVDs9XFRvaxATC7DYNp3hkRSPnKUi78oxDWJ/I/pTm9iGG6j3s9cq9CnR6abOzqO0fHFseB8MJ8K1+FefgL89q+dZ8AzI42GivmNwcJzRBoetM3kk1eN3a3RLawj76yxWa7VyPh0NziuHAoXCH06z0ZrXOWYJBJeole2vKiHG1GbIoQmUZRU2kLWq7aQMBVsRqVQp44yPjbyCBaSr/mqCU44HsWouufr8ppjVE6mxI1VjucEGlXsT6eqrp+afk9CXm/jwAy756Wx2jiXi7RQfFoRrXZ/ZzUb2RveiytWk23kAAscdj43N0/o2+UH+8TBlbXcbeI0boe7PGD3Og3suqbhK4+zBMRar8lKU6jwA1u4GPCyMx9RQVZW052auEXpQtfT5quueGqjF8T81N7ewcD2piroPRQLI+NGJkRLgmzaWAtBTe3LZDjeJJjyzPjsg+PlgSX0hjqh3cVn6BYgeLCBhdncfhpaGOztTNPlhwOT0mPL5+lzB/qFW04hv31jj1qnhYB0tCq5gP/ZqOm3QxqMGUrPdNL4cujLcjhRKahdCy/3OXY4pCDFUt59QwbGlNusS8wtD3Vg8aY7ibC5/5tm75EQf1w054f9TRqFxn5iBYnQaG41n4Hln1xU99GNHVUc6DvEeS5dXdNoJ8T+ML7S9IFHOn5v9cQIaADS/Y+Urd6kXRBy21FFbdaQHmroVeJ2hj4yBpw8hJ6+LAJlmMKE/JAVs+O3UCsDkiIJntNks8n+5lVFXFecOXlPiTcHEzuF5mb/JC8nXbRfAyclTuujNw1bwD8nflBBi3ipPUa+1DWs=,iv:72+0+hlBxKtuhjhrLD1EMlx8LcJtskxO+MCpYj7rpes=,tag:ZClFYFa9pCedk8wP9LF0Kg==,type:str]",
     "key": "ENC[AES256_GCM,data:1KiNYgkaFQvttJPOM2B9OrYbSwcmSWxHYJ/0qyAqYz5J17WvqP74BIY4t+w7PMrvSUHrmo2ml+EeuFax7CKuiVBsZUBXdnUnrnOPvdFuls0WC15oxXz+ZbHtlfkut2WaiDLDF+6fRR3Pd/VY8uDD4+IvD+jXddkCiGQsME8Wh9NQNQTS9KiW6upNpXuOS6ipX1VZKQ37o7z+7w+lgVLPaPlS/vWww1CARjYddiOMNG8YvAmhaBYjdBLTTrNOW6T2iDDHNh+Hj8V8ISYDY5U6f7J+tXRbsow/0xKdPTGoPLek0k8zqpGJjfo+c3DrAZnMLn+dVHCZVJlsTWcPaiiBC1/ZQzD5cavzGMjXY3kuyP3XV3m7L+bHn9SEfHhQZ1PB,iv:lkGS4uR0Xd7FnahXLjVc8g0PiRPxyUS6YQY3EM3B5G0=,tag:bXgBUFiQomMWgXsN1d6J5g==,type:str]"
@@ -16,8 +18,8 @@
         "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvK2dObkIyWC9JRWphaWVm\ndHlnMjlic0IrV2dqNEFPY2xDemxrRXZVc1Q0CllYVVRTaWR5YmRBc1JYK05ISFYz\nYkVFT2NQTXJDaXREQ3B3blA2QXY2dHMKLS0tIDRBVVViREh2WVdUUGFVVitFTWJV\nbzF0cEFGM2M2UDBNd1pVVGhuMTYyMGcKubGAn3lr58t3Hfi2t3FPbDWH/b5rp4Qo\no+M+QW/cOyR5zITSDNhcJobt+iabeIM1aHWFo8Am8XzUWRch7NROMg==\n-----END AGE ENCRYPTED FILE-----\n"
       }
     ],
-    "lastmodified": "2025-07-20T12:54:07Z",
+    "lastmodified": "2025-07-20T17:37:03Z",
-    "mac": "ENC[AES256_GCM,data:FAtOoCTkT8xK6D4l9hekMhAincaNr29+qvOWwI2Do3YFsvfTmHf7nlYIyxwk0tC76XqOqRwRC6qx+Kwoy6NnbdgVlgM+8DHOIuuju0Tp487GEWprwhKbW9px9ZRp/+1i9vap14mRRskhxI01ruSDwOUqnelxQ5WosYB0tHlZ73o=,iv:43Gcc2wDyPoib5MsQJHg9K4ooG549vZv4RVdYSan8eU=,tag:pUn0vISQfgZk6lh/lJkwcQ==,type:str]",
+    "mac": "ENC[AES256_GCM,data:c+DGlnaEkut4BPm4tufLIa4sutM+7z3oMMkdO3JchrLgngqTOOo1ICD4vm+jEDEM2dahwfbZ/ceSg/j0nSzE19zwcHzBHcxIFqRPdhlLrHANkO/+Ybz3NQNKFd2J3SUdAV1WMogvFqaPqdDHjdwXR9/ICdASQsiaiwOYRbNaEYM=,iv:FR4x/sVgZ0wb24V8qYeIl9GGQ8z/9fPNbvrjYS9/XTU=,tag:eJMb73XyxPiIsgkKicN9gQ==,type:str]",
     "unencrypted_suffix": "_unencrypted",
     "version": "3.10.2"
   }

modules/system/services/caddy.nix

@@ -79,13 +79,13 @@ in
       }
 
       (lib.mkIf tailscaleHostsExist {
-        sops.secrets."service-tailscale-auth-key".owner = config.services.caddy.user;
+        sops.secrets."tailscale/service-auth-key".owner = config.services.caddy.user;
 
         services.caddy = {
           package = caddyWithTailscale;
           globalConfig = ''
             tailscale {
-              auth_key {file.${config.sops.secrets."service-tailscale-auth-key".path}}
+              auth_key {file.${config.sops.secrets."tailscale/service-auth-key".path}}
             }
           '';
         };

modules/system/services/gatus.nix

@@ -96,9 +96,9 @@ in
     };
 
     sops = {
-      secrets."healthchecks-ping-key" = { };
+      secrets."healthchecks/ping-key" = { };
       templates."gatus.env".content = ''
-        HEALTHCHECKS_PING_KEY=${config.sops.placeholder."healthchecks-ping-key"}
+        HEALTHCHECKS_PING_KEY=${config.sops.placeholder."healthchecks/ping-key"}
       '';
     };
 

modules/system/services/restic-backups/default.nix

@@ -27,14 +27,14 @@ in
   config = lib.mkIf (resticBackups != { }) {
     sops = {
       secrets = {
-        "restic/backblaze/key-id" = { };
+        "backblaze/key-id" = { };
-        "restic/backblaze/application-key" = { };
+        "backblaze/application-key" = { };
         "restic/password" = { };
       };
 
       templates."restic/environment".content = ''
-        AWS_ACCESS_KEY_ID=${config.sops.placeholder."restic/backblaze/key-id"}
+        AWS_ACCESS_KEY_ID=${config.sops.placeholder."backblaze/key-id"}
-        AWS_SECRET_ACCESS_KEY=${config.sops.placeholder."restic/backblaze/application-key"}
+        AWS_SECRET_ACCESS_KEY=${config.sops.placeholder."backblaze/application-key"}
       '';
     };
 

modules/system/services/restic-backups/healthchecks.nix

@@ -22,7 +22,7 @@ in
   };
 
   config = lib.mkIf (backupsWithHealthchecks != { }) {
-    sops.secrets."healthchecks-ping-key" = { };
+    sops.secrets."healthchecks/ping-key" = { };
 
     systemd.services = lib.mkMerge [
       {
@@ -32,7 +32,7 @@ in
           scriptArgs = "%i";
           script = ''
             ${lib.getExe pkgs.curl} --fail --silent --show-error --max-time 10 --retry 5  https://hc-ping.com/$(cat ${
-              config.sops.secrets."healthchecks-ping-key".path
+              config.sops.secrets."healthchecks/ping-key".path
             })/$(echo $1 | tr _ /)
           '';
         };

modules/system/services/tailscale.nix

@@ -16,11 +16,11 @@ in
   config = lib.mkIf cfg.enable {
     meta.ports.list = [ config.services.tailscale.port ];
 
-    sops.secrets."tailscale-auth-key" = { };
+    sops.secrets."tailscale/auth-key" = { };
 
     services.tailscale = {
       enable = true;
-      authKeyFile = config.sops.secrets."tailscale-auth-key".path;
+      authKeyFile = config.sops.secrets."tailscale/auth-key".path;
       openFirewall = true;
       useRoutingFeatures = if cfg.exitNode.enable then "server" else "client";
       extraUpFlags = [ "--reset=true" ];