nixos/hosts: add README documenting host roles + deploy flow

Deferred Phase-1-completion task from the de-platform-from-GitHub roadmap (vimwiki/diary/2026-05-03.md). Documents: - per-host role + current services (sunken-ship, phantom-ship, vps-relay, distant-shore, foreign-port, daniel-macbook-air, wsl); - ZT mesh topology + ASCII overview; - the auto-rebuild path (dm-pull-deploy push from sunken-ship → pull/ rebuild on roles.default hosts within ~15 m); - the manual clan-cli flow, including the env -u SSH_AUTH_SOCK and --no-check gotchas we hit in practice; - the vps-relay reverse-proxy pattern for new public apps; - SSH key quick-reference.
2026-06-07 19:05:06 +02:00
46 changed files with 223 additions and 531 deletions
--- a/flake-modules/clan.nix
+++ b/flake-modules/clan.nix
@ -21,8 +21,6 @@ let
  sunkenShipZTv6 = "fdd5:53a2:de33:d269:6499:93d5:53a2:de33";
  phantomShipZTv6 = "fdd5:53a2:de33:d269:6499:936c:48a:bbdc";
  vpsRelayZTv6 = "fdd5:53a2:de33:d269:6499:9305:339f:2ed3";
-  distantShoreZTv6 = "fdd5:53a2:de33:d269:6499:93b6:ef1a:c3b3";
-  foreignPortZTv6 = "fdd5:53a2:de33:d269:6499:9389:9b18:6c52";

  # Shared across both servers: /etc/hosts entries so data-mesher's
  # libp2p /dns/<machine>.clan/... bootstrap multiaddrs resolve over ZT.
@ -31,8 +29,6 @@ let
      "${sunkenShipZTv6}" = [ "sunken-ship.clan" ];
      "${phantomShipZTv6}" = [ "phantom-ship.clan" ];
      "${vpsRelayZTv6}" = [ "vps-relay.clan" ];
-      "${distantShoreZTv6}" = [ "distant-shore.clan" ];
-      "${foreignPortZTv6}" = [ "foreign-port.clan" ];
    };
  };
 in {
@ -51,8 +47,6 @@ in {
    inventory.machines.sunken-ship = { };
    inventory.machines.phantom-ship = { };
    inventory.machines.vps-relay = { };
-    inventory.machines.distant-shore = { };
-    inventory.machines.foreign-port = { };

    # ZeroTier mesh VPN. sunken-ship is the controller (manages network
    # membership); phantom-ship is a peer. The mac joins manually as an
@ -64,8 +58,6 @@ in {
      roles.peer.machines.phantom-ship = { };
      roles.peer.machines.sunken-ship = { };
      roles.peer.machines.vps-relay = { };
-      roles.peer.machines.distant-shore = { };
-      roles.peer.machines.foreign-port = { };
    };

    # data-mesher — signed-file gossip protocol over libp2p (port 7946).
@ -78,8 +70,6 @@ in {
      module.input = "clan-core";
      roles.default.machines.sunken-ship = { };
      roles.default.machines.phantom-ship = { };
-      roles.default.machines.distant-shore = { };
-      roles.default.machines.foreign-port = { };
      roles.bootstrap.machines.sunken-ship = { };
    };

@ -97,8 +87,6 @@ in {
      };
      roles.default.machines.sunken-ship.settings.action = "switch";
      roles.default.machines.phantom-ship.settings.action = "switch";
-      roles.default.machines.distant-shore.settings.action = "switch";
-      roles.default.machines.foreign-port.settings.action = "switch";
    };

    # `clan machines update` connection target. Priority 2000 > ZT's 900
@ -123,18 +111,6 @@ in {
        host = "89.167.39.251";
        user = "danny";
      };
-      # distant-shore: LAN IP for the first update (not yet on ZT). Swap to
-      # its generated ZT IPv6 after it joins the mesh, like the others.
-      roles.default.machines.distant-shore.settings = {
-        host = "192.168.1.182";
-        user = "danny";
-      };
-      # foreign-port: WiFi-only LAN IP for the first update; swap to its
-      # generated ZT IPv6 after it joins the mesh.
-      roles.default.machines.foreign-port.settings = {
-        host = "192.168.1.223";
-        user = "danny";
-      };
    };

    # Preserve current network / init stack (no systemd-networkd/resolved,
@ -181,55 +157,6 @@ in {
      ];
    };

-    # distant-shore — ThinkPad X13 Gen 2, WiFi, Secure Boot via shim+MOK
-    # (installed standalone, then migrated into clan). targetHost is the LAN
-    # IP for the first `clan machines update`; switch to its ZT IPv6 once the
-    # mesh is up. buildHost = sunken-ship: it's an x86_64 builder whose key is
-    # already in distant-shore's authorized_keys, so the closure copy works
-    # (building on distant-shore itself needs a fragile self-SSH).
-    machines.distant-shore = {
-      imports = [
-        {
-          clan.core.enableRecommendedDefaults = false;
-          clan.core.networking.targetHost = "danny@192.168.1.182";
-          clan.core.networking.buildHost = "danny@sunken-ship";
-        }
-        clanHostsModule
-        ../nixos/hosts/distant-shore.nix
-        config.flake.nixosModules.monitoring-node-exporter
-        inputs.home-manager.nixosModules.home-manager
-        (hmModule {
-          user = "danny";
-          homeDirectory = "/home/danny";
-          stateVersion = "25.11";
-        })
-      ];
-    };
-
-    # foreign-port — WiFi-only laptop server, locally-signed boot chain
-    # (installed standalone, migrated into clan). targetHost is the LAN IP
-    # for the first `clan machines update`; switch to its ZT IPv6 once the
-    # mesh is up. buildHost = sunken-ship for the closure copy (avoids
-    # self-SSH).
-    machines.foreign-port = {
-      imports = [
-        {
-          clan.core.enableRecommendedDefaults = false;
-          clan.core.networking.targetHost = "danny@192.168.1.223";
-          clan.core.networking.buildHost = "danny@sunken-ship";
-        }
-        clanHostsModule
-        ../nixos/hosts/foreign-port.nix
-        config.flake.nixosModules.monitoring-node-exporter
-        inputs.home-manager.nixosModules.home-manager
-        (hmModule {
-          user = "danny";
-          homeDirectory = "/home/danny";
-          stateVersion = "25.11";
-        })
-      ];
-    };
-
    machines.phantom-ship = {
      imports = [
        {
--- a/flake-modules/distant-shore.nix
+++ b/flake-modules/distant-shore.nix
@ -0,0 +1,14 @@
+# Standalone nixosSystem registration for distant-shore.
+# Temporary: clan integration (zerotier/data-mesher/dm-pull-deploy) needs
+# vars generated via sops on the admin machine. Until that runs, this
+# keeps the box buildable without clan deps. Delete this file when
+# distant-shore moves into flake-modules/clan.nix.
+{ inputs, ... }: {
+  flake.nixosConfigurations.distant-shore = inputs.nixpkgs.lib.nixosSystem {
+    system = "x86_64-linux";
+    modules = [
+      inputs.disko.nixosModules.disko
+      ../nixos/hosts/distant-shore.nix
+    ];
+  };
+}
--- a/nixos/disko-foreign-port.nix
+++ b/nixos/disko-foreign-port.nix
@ -1,36 +0,0 @@
-# Declarative disk layout for distant-shore. UEFI/systemd-boot, no
-# encryption: it's a headless, WiFi-only server that must reboot
-# unattended (clan dm-pull-deploy), so a LUKS passphrase prompt at boot
-# would hang it. Mirrors sunken-ship's plain-ext4 choice. Device is wiped
-# + repartitioned at install time by clan/nixos-anywhere.
-{
-  disko.devices = {
-    disk.main = {
-      type = "disk";
-      device = "/dev/nvme0n1";
-      content = {
-        type = "gpt";
-        partitions = {
-          ESP = {
-            size = "512M";
-            type = "EF00";
-            content = {
-              type = "filesystem";
-              format = "vfat";
-              mountpoint = "/boot";
-              mountOptions = [ "fmask=0022" "dmask=0022" ];
-            };
-          };
-          root = {
-            size = "100%";
-            content = {
-              type = "filesystem";
-              format = "ext4";
-              mountpoint = "/";
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/nixos/hosts/README.md
+++ b/nixos/hosts/README.md
@ -0,0 +1,206 @@
+# Hosts
+
+Per-host NixOS configs for the homelab and admin Mac. Each `<host>.nix`
+declares the host's role and services; the `<host>-hardware.nix` siblings
+(where present) describe disks, kernel modules, firmware. Bootstrap +
+disko configs live one level up in `../`.
+
+## Topology
+
+```
+                              ┌────────────────────────────────────────────┐
+                              │  vps-relay  (Hetzner, public IP, ZT peer)  │
+public traffic ──TLS:443──────│  Caddy + Let's Encrypt → reverse_proxy     │
+                              │  over ZeroTier to a clan backend           │
+                              └──────────────────┬─────────────────────────┘
+                                                 │ (ZeroTier mesh)
+                                                 │
+              ┌──────────────────────┬───────────┴───────────┬──────────────────────┐
+              │                      │                       │                      │
+        sunken-ship             phantom-ship           distant-shore           foreign-port
+        (LAN, wifi)             (LAN, wired)           (LAN, wifi)             (LAN, wifi)
+        ZT controller           NAT for                blank slate             blank slate
+        media + mulbo           rusty-anchor           (room to grow)          (room to grow)
+                                services hub
+
+  ── outside the clan ──────────────────────────────────────────────────────────────────────
+        Daniel-Macbook-Air                                        rusty-anchor
+        (admin, runs clan-cli)                                    (downstream of phantom-ship's NAT)
+```
+
+ZeroTier IPv6 addresses for the four clan machines are declared in
+`../../flake-modules/clan.nix` (`sunkenShipZTv6` / `phantomShipZTv6` /
+`vpsRelayZTv6` / etc.). They land in every host's `/etc/hosts` as
+`<machine>.clan` so data-mesher and ad-hoc SSH can resolve over the mesh.
+
+---
+
+## Hosts
+
+### sunken-ship  ·  media + ZT controller
+
+- **Hardware:** see `sunken-ship-hardware.nix`. WiFi-only, no LUKS (boots
+  unattended).
+- **Network:** LAN over WiFi, on the ZT mesh as the **controller** (manages
+  ZT membership for the whole fleet). ZT IPv6 is the clan's "internet"
+  target for `clan machines update`.
+- **Role:** media + the long-running personal services that don't fit on
+  phantom-ship.
+- **Current services:** `navidrome` (subsonic API, `/srv/music`), `uxplay`
+  (AirPlay receiver), `mulbo-server` (+ `-pull` / `-backfill` / `-enrich`
+  timers), `fitness-bot` (+ `-pull` / `-shipyard` variants),
+  `dm-pull-deploy-push` (announces origin/main rev to the mesh every 15 m).
+
+### phantom-ship  ·  services hub + LAN NAT
+
+- **Hardware:** see `phantom-ship-hardware.nix`. WiFi for WAN, wired
+  ethernet (`enp0s31f6`) serves the lab subnet (NAT + dnsmasq for
+  `rusty-anchor`).
+- **Network:** LAN over WiFi, on the ZT mesh. Backends are exposed only on
+  the ZT interface (`firewall.interfaces."zt+".allowedTCPPorts = [ … ]`)
+  so vps-relay's Caddy can reach them. WAN side stays closed.
+- **Role:** where new self-hosted apps default to going. Hosts a growing
+  list of mini-app backends + a couple of long-running daemons.
+- **Current services:** `forgejo` (`git.dannydannydanny.me`),
+  `claude-channels` (Telegram bridge for `@HarakatBot`),
+  `hara-gmail-mcp` + `hara-heartbeat` (timer),
+  Mini-App backends (`shelfish`, `scuttle`, `bananasimulator`,
+  `komtolk`, `escape-hormuz`, `bon`), `ollama` (local LLM), `shipyard`,
+  `dnsmasq` (lab subnet DHCP/DNS). `openclaw-gateway` is disabled —
+  superseded by `claude-channels` but kept for easy rollback.
+
+### vps-relay  ·  public reverse proxy
+
+- **Hardware:** Hetzner Cloud vServer (BIOS-boot, virtio). Disk via
+  `../disko-cloud.nix`.
+- **Network:** public IP `89.167.39.251`. Inbound: SSH/22, HTTP/80,
+  HTTPS/443 only. fail2ban guards SSH. Outbound to clan backends over ZT.
+- **Role:** terminates public TLS, reverse-proxies subdomains over ZT to
+  whichever clan host runs the backend. **No application data ever lands
+  here** — this box is a relay. New public app = add a `virtualHosts`
+  entry + a GoDaddy A record pointing at `89.167.39.251`.
+- **Current vhosts:** `navidrome.`, `bbbot.`, `shelfish.`, `scuttle.`,
+  `bananasimulator.`, `komtolk.`, `git.`, `escapehormuz.`, etc.
+
+### distant-shore  ·  ThinkPad X13 Gen 2, blank slate
+
+- **Hardware:** see `distant-shore-hardware.nix`. Intel i5-1145G7, 16 GB.
+  WiFi-only, headless, no LUKS. Secure-Boot-chained boot (shim + MOK,
+  see comments in `distant-shore.nix`).
+- **Network:** LAN over WiFi, on the ZT mesh.
+- **Role:** _to be assigned_. In the clan inventory; auto-rebuilds via
+  dm-pull-deploy. Drop a service in to give it a purpose.
+
+### foreign-port  ·  laptop, blank slate (WIP)
+
+- **Hardware:** see `foreign-port-hardware.nix`. WiFi-only, headless,
+  no LUKS. Vendor-signed-shim boot chain.
+- **Status:** still being wired up — not in the clan inventory yet.
+- **Role:** _to be assigned_, same flow as `distant-shore`.
+
+### daniel-macbook-air  ·  admin
+
+- **Hardware:** MacBook Air (the daily driver).
+- **Role:** outside the clan. Runs `clan machines update` to push to
+  the servers + holds the SSH keys that authorize root@ on each clan
+  host. Also a ZT peer.
+
+### wsl
+
+- **Role:** WSL development environment (legacy / occasional).
+
+---
+
+## Deployment
+
+### Automatic (the default)
+
+`dm-pull-deploy` (clan-community module wired in `clan.nix`):
+
+1. **Push announcement:** sunken-ship's `dm-pull-deploy-push` timer runs
+   `dm-send-deploy` every 15 m. It signs and broadcasts the current
+   `origin/main` rev over the data-mesher gossip protocol.
+2. **Pull + rebuild:** each `roles.default` machine (currently
+   `sunken-ship`, `phantom-ship`) runs a `.path` watcher that fires when
+   the gossiped rev changes; it `git fetch`es and `nixos-rebuild switch`es.
+
+So **a push to `origin/main` rolls out within ~15 m** on the two
+production hosts. No SSH-from-Mac required.
+
+`vps-relay` and `distant-shore` are **not** in `roles.default` — they
+need a manual deploy (see below) until/unless their role changes.
+
+### Manual
+
+From `~/dotfiles` on the Mac:
+
+```
+nix run 'git+https://git.clan.lol/clan/clan-core#clan-cli' -- \
+  machines update <host>
+```
+
+Caveats encountered in practice:
+
+- The Mac's `ssh-agent` often has the wrong key loaded for clan deploys.
+  Prefix with `env -u SSH_AUTH_SOCK` to force `~/.ssh/config` identity
+  selection.
+- A nixpkgs bump may register a new generation but refuse to live-switch
+  due to "switch inhibitors". Add `--no-check` to force.
+- `vps-relay` only accepts `~/.ssh/id_ed25519_sunken_ship` (the Mac's
+  copy of sunken-ship's authorized key). The agent's other keys won't
+  open it.
+
+Putting both together:
+
+```
+env -u SSH_AUTH_SOCK nix run 'git+https://git.clan.lol/clan/clan-core#clan-cli' \
+  -- machines update phantom-ship --no-check
+```
+
+### From sunken-ship
+
+`vps-relay` was originally only reachable from sunken-ship's SSH key.
+That still works as a fallback — SSH to sunken-ship and run the same
+`nix run … -- machines update vps-relay` command from `/etc/dotfiles`
+there. The dotfiles checkout at `/etc/dotfiles` is maintained by
+dm-pull-deploy.
+
+---
+
+## Public traffic pattern
+
+```
+user → DNS *.dannydannydanny.me → 89.167.39.251 (vps-relay)
+     → Caddy (Let's Encrypt, ports 80/443)
+     → reverse_proxy http://[<backend ZT IPv6>]:<port>
+     → service on sunken-ship or phantom-ship
+```
+
+To add a new public app:
+
+1. Add a `virtualHosts` entry to `vps-relay.nix` pointing at the
+   backend's ZT IPv6 and port.
+2. Add the GoDaddy A record `<sub>.dannydannydanny.me → 89.167.39.251`.
+3. Run the backend on the chosen host. Either:
+   - bind to `127.0.0.1:<port>` (if backend + Caddy are co-resident — not
+     the case here), **or**
+   - bind to `0.0.0.0` (or `::`) and add the port to
+     `networking.firewall.interfaces."zt+".allowedTCPPorts` on the
+     backend host so only the ZT interface accepts inbound.
+4. Push dotfiles. Production hosts auto-rebuild via dm-pull-deploy.
+   vps-relay needs a manual `clan machines update vps-relay`.
+
+---
+
+## SSH keys (quick reference)
+
+- **`~/.ssh/id_ed25519_phantom_ship`** (Mac) — authorized as `danny@` and
+  `root@` on phantom-ship.
+- **`~/.ssh/id_ed25519_sunken_ship`** (Mac) — authorized as `danny@` (and
+  via root mirror) on sunken-ship; also the authorized key on `vps-relay`.
+- **sunken-ship `~/.ssh/id_ed25519`** — sunken-ship's own key; used by
+  cluster-internal ops (mulbo-pull, dm-send-deploy, fallback path for
+  vps-relay deploys).
+- **`~/.ssh/id_ed25519_github`** (Mac) — GitHub auth, not clan.
+
+Authorized-keys lists live in each host's `users.users.{danny,root}.openssh.authorizedKeys.keys`.
--- a/nixos/hosts/foreign-port-hardware.nix
+++ b/nixos/hosts/foreign-port-hardware.nix
@ -1,18 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}
--- a/nixos/hosts/foreign-port.nix
+++ b/nixos/hosts/foreign-port.nix
@ -1,111 +0,0 @@
-# NixOS laptop server. WiFi-only, headless, unattended auto-rebuild via
-# clan dm-pull-deploy. No LUKS (mirrors sunken-ship) so reboots don't
-# block on a passphrase.
-#
-# Blank-slate server for now — no application services. Give it a purpose
-# later (just add services here and let dm-pull-deploy roll it out).
-{ config, lib, pkgs, ... }:
-
-{
-  imports = [
-    ./foreign-port-hardware.nix
-    ../disko-foreign-port.nix
-  ];
-
-  boot.loader.systemd-boot.enable = true;
-  # Firmware-locked Secure Boot: we can't enrol our own keys into the
-  # firmware key DB, so a vendor-signed shim is the firmware-booted binary
-  # and chain-loads a locally-signed systemd-boot + kernel. The NVRAM
-  # entry points at shim; bootctl is kept away from EFI variables so
-  # rebuilds don't clobber the entry.
-  boot.loader.efi.canTouchEfiVariables = false;
-  boot.loader.efi.efiSysMountPoint = "/boot";  # matches disko ESP mountpoint
-
-  # --- Locally-signed boot chain --------------------------------------------
-  # On every bootloader install: re-sign systemd-boot and every kernel
-  # image, refresh the shim binary on the ESP, and place the helper binary
-  # beside it. Re-runs on each nixos-rebuild so auto-deployed generations
-  # stay bootable. Signing material lives in /etc/secrets, never the repo.
-  boot.loader.systemd-boot.extraInstallCommands = ''
-    # NixOS's bootloader-install systemd unit runs with a minimal PATH that
-    # doesn't include coreutils, so use absolute paths for cp/mv.
-    KEY=/etc/secrets/MOK.key
-    CRT=/etc/secrets/MOK.crt
-    sb() { ${pkgs.sbsigntool}/bin/sbsign --key "$KEY" --cert "$CRT" --output "$2" "$1"; }
-    # systemd-boot -> shim's chain-load target
-    sb /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/grubx64.efi
-    # shim is the firmware-booted binary; helper binary sits beside it
-    ${pkgs.coreutils}/bin/cp -f /etc/secrets/shimx64.efi /boot/EFI/BOOT/BOOTX64.EFI
-    ${pkgs.coreutils}/bin/cp -f /etc/secrets/mmx64.efi  /boot/EFI/BOOT/mmx64.efi
-    # sign each kernel (skip if already signed; leave initrds untouched)
-    for k in /boot/EFI/nixos/*bzImage.efi; do
-      [ -e "$k" ] || continue
-      if ! ${pkgs.sbsigntool}/bin/sbverify --cert "$CRT" "$k" >/dev/null 2>&1; then
-        ${pkgs.sbsigntool}/bin/sbsign --key "$KEY" --cert "$CRT" --output "$k.tmp" "$k" \
-          && ${pkgs.coreutils}/bin/mv -f "$k.tmp" "$k"
-      fi
-    done
-  '';
-
-  networking.hostName = "foreign-port";
-  # WiFi via NetworkManager. The wpa_supplicant stack hit two issues on this
-  # box: (1) it strips CAP_CHOWN so wpa couldn't create its ctrl_interface,
-  # and (2) dhcpcd didn't grab a lease after the (late) association at boot,
-  # needing a manual restart — fatal for an unattended headless server. NM
-  # handles association + DHCP atomically and connected first-try here.
-  # The PSK stays out of the repo: it's substituted from /etc/secrets/nm.env
-  # ($PSK_INTENO) into the declared profile at activation.
-  networking.networkmanager.enable = true;
-  networking.networkmanager.ensureProfiles.environmentFiles = [ "/etc/secrets/nm.env" ];
-  networking.networkmanager.ensureProfiles.profiles."Inteno-89FE-5GHz" = {
-    connection = { id = "Inteno-89FE-5GHz"; type = "wifi"; autoconnect = true; };
-    wifi = { ssid = "Inteno-89FE-5GHz"; mode = "infrastructure"; };
-    wifi-security = { key-mgmt = "wpa-psk"; psk = "$PSK_INTENO"; };
-    ipv4.method = "auto";
-    ipv6.method = "auto";
-  };
-  hardware.enableRedistributableFirmware = true;  # WiFi firmware blobs
-  time.timeZone = "Europe/Copenhagen";
-
-  # It's a laptop acting as a server: keep running with the lid shut.
-  services.logind.settings.Login.HandleLidSwitch = "ignore";
-  services.logind.settings.Login.HandleLidSwitchExternalPower = "ignore";
-
-  # Reduce screen burn-in / power: blank the TTY after a minute.
-  boot.kernelParams = [ "consoleblank=60" ];
-
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
-  programs.nix-ld.enable = true;  # run dynamically linked binaries (e.g. Claude Code remote CLI)
-  nix.settings.trusted-users = [ "root" "danny" ];
-  system.stateVersion = "25.11";
-
-  users.users.danny = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" "video" "audio" ];
-    openssh.authorizedKeys.keys = [
-      # Mac admin / fleet key (~/.ssh/id_ed25519_sunken_ship) — the key the
-      # Mac uses to reach the fleet; clan machines update relies on it.
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKW/akfIiVU5o63YrTAJVZhMj7kXfYHOnXDtlpVFW7pf danny@mac-admin"
-      # TODO: add a per-host key (~/.ssh/id_ed25519_foreign_port) for
-      # plain `ssh foreign-port`. Generate when convenient.
-      # sunken-ship (dm-pull-deploy push node) — reach foreign-port over ZT.
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB9t4YAaoHvVouqp+qyFOq8o3SAtXMiAmjF6J0ldyx4g danny@sunken-ship"
-    ];
-  };
-  users.users.root.openssh.authorizedKeys.keys =
-    config.users.users.danny.openssh.authorizedKeys.keys;
-
-  services.openssh = {
-    enable = true;
-    settings = {
-      PasswordAuthentication = false;
-      KbdInteractiveAuthentication = false;
-    };
-  };
-
-  security.sudo.wheelNeedsPassword = false;
-
-  # mokutil + sbsigntool — manage the shim trust chain and inspect signed
-  # bootloader/kernel images when debugging.
-  environment.systemPackages = with pkgs; [ git mokutil sbsigntool ];
-}
--- a/nixos/hosts/phantom-ship.nix
+++ b/nixos/hosts/phantom-ship.nix
@ -50,11 +50,11 @@ in

  # KomTolk (:8080), Shelfish (:8081), Scuttle (:8082), Bananasimulator
  # (:8083), Forgejo (:3000), Escape Hormuz (:8090), bon (:8091),
-  # notes (:8092), TDPixi (:8093) are reachable only over the ZeroTier mesh —
-  # the vps-relay Caddy reverse-proxies into them. Same pattern as
+  # notes (:8092) are reachable only over the ZeroTier mesh — the
+  # vps-relay Caddy reverse-proxies into them. Same pattern as
  # sunken-ship's bbbot. Not in global allowedTCPPorts, so the WAN side
  # stays closed.
-  networking.firewall.interfaces."zt+".allowedTCPPorts = [ 3000 8080 8081 8082 8083 8084 8090 8091 8092 8093 ];
+  networking.firewall.interfaces."zt+".allowedTCPPorts = [ 3000 8080 8081 8082 8083 8090 8091 8092 ];

  hardware.enableRedistributableFirmware = true;  # iwlwifi (Intel 8260) + GPU + BT firmware

@ -176,7 +176,6 @@ in
    "d /home/danny/.local/share/shelfish 0755 danny users - -"
    "d /home/danny/.local/share/scuttle 0755 danny users - -"
    "d /home/danny/.local/share/bananasimulator 0755 danny users - -"
-    "d /home/danny/.local/share/bananasimulator-beta 0755 danny users - -"
    "d /home/danny/.local/share/komtolk 0755 danny users - -"
    "d /home/danny/.local/share/escape_hormuz 0755 danny users - -"
    "d /home/danny/.local/share/scuttle/tiles 0755 danny users - -"
@ -386,40 +385,6 @@ in
    };
  };

-  # Bananasimulator BETA — cheat-instance for testing the full progression
-  # end-to-end. Separate DB, exposes /api/cheat/* (gated by BS_BETA_MODE=1)
-  # so the frontend cheat menu can seed canonical states and reset.
-  # Faster ripening (0.2 min/stage = ~3 min to compost) so cycles are
-  # testable in real time. Same code base; deploy to a sibling dir.
-  # vhost in vps-relay.nix → bananasimulator-beta.dannydannydanny.me.
-  systemd.services.bananasimulator-beta = let
-    pythonEnv = pkgs.python3.withPackages (ps: with ps; [
-      fastapi
-      uvicorn
-      httpx
-      python-telegram-bot
-    ]);
-  in {
-    description = "Bananasimulator BETA (cheat instance) FastAPI server";
-    after = [ "network-online.target" ];
-    wants = [ "network-online.target" ];
-    wantedBy = [ "multi-user.target" ];
-    path = [ pythonEnv ];
-    environment = {
-      SHIPYARD_BOT_TOKEN_FILE = "/home/danny/.secrets/telegram-bot-token-shipyard";
-      BS_DB_PATH = "/home/danny/.local/share/bananasimulator-beta/bananasimulator.db";
-      BS_RIPE_MIN_PER_STAGE = "0.2";  # ~3 min to compost — testable in real time
-      BS_BETA_MODE = "1";             # exposes /api/cheat/* + flips beta=true in /api/me
-    };
-    serviceConfig = {
-      WorkingDirectory = "/home/danny/bananasimulator-beta";
-      ExecStart = "${pythonEnv}/bin/python -m uvicorn server:app --host :: --port 8084";
-      Restart = "on-failure";
-      RestartSec = 10;
-      User = "danny";
-    };
-  };
-
  # Escape Hormuz — turn-based boat-race Mini App (Hara's first build).
  # Code lives at /home/danny/escape_hormuz/. Same vps-relay-fronted ZT path
  # as the others; binds :: so the ZeroTier IPv6 address is reachable.
@ -562,29 +527,6 @@ in
    };
  };

-  # TDPixi — Idle Tower Defence Telegram Mini App by @plasmagoat.
-  # Pure static serve, no DB. Code rsync'd to /home/danny/tdpixi/.
-  # Upstream: https://github.com/plasmagoat/TDPixi
-  systemd.services.tdpixi = let
-    pythonEnv = pkgs.python3.withPackages (ps: with ps; [
-      fastapi
-      uvicorn
-    ]);
-  in {
-    description = "tdpixi — Idle Tower Defence Mini App";
-    after = [ "network-online.target" ];
-    wants = [ "network-online.target" ];
-    wantedBy = [ "multi-user.target" ];
-    path = [ pythonEnv ];
-    serviceConfig = {
-      WorkingDirectory = "/home/danny/tdpixi";
-      ExecStart = "${pythonEnv}/bin/python -m uvicorn server:app --host :: --port 8093";
-      Restart = "on-failure";
-      RestartSec = 10;
-      User = "danny";
-    };
-  };
-
  # Hara morning heartbeat — daily email check + Telegram good-morning ping.
  # Runs claude in print mode with the Gmail MCP, then sends output via Bot API.
  # Token lives in ~/.claude/channels/telegram/.env (managed by the telegram plugin).
--- a/nixos/hosts/vps-relay.nix
+++ b/nixos/hosts/vps-relay.nix
@ -124,11 +124,6 @@
      "bananasimulator.dannydannydanny.me".extraConfig = ''
        reverse_proxy http://[fdd5:53a2:de33:d269:6499:936c:48a:bbdc]:8083
      '';
-      # Bananasimulator BETA — separate service on port 8084 with
-      # BS_BETA_MODE=1 (cheat menu + faster ripening for testing).
-      "bananasimulator-beta.dannydannydanny.me".extraConfig = ''
-        reverse_proxy http://[fdd5:53a2:de33:d269:6499:936c:48a:bbdc]:8084
-      '';
      # KomTolk (formerly translate-platform) — same backend, port 8080.
      "komtolk.dannydannydanny.me".extraConfig = ''
        reverse_proxy http://[fdd5:53a2:de33:d269:6499:936c:48a:bbdc]:8080
@ -147,10 +142,6 @@
      "bon.dannydannydanny.me".extraConfig = ''
        reverse_proxy http://[fdd5:53a2:de33:d269:6499:936c:48a:bbdc]:8091
      '';
-      # TDPixi — Idle Tower Defence Mini App by @plasmagoat, port 8093.
-      "tdpixi.dannydannydanny.me".extraConfig = ''
-        reverse_proxy http://[fdd5:53a2:de33:d269:6499:936c:48a:bbdc]:8093
-      '';
      # notes — markdown blog (notes.X) + apex landing (X). Same backend
      # service on phantom :8092 routes by Host header.
      "notes.dannydannydanny.me".extraConfig = ''
@ -169,11 +160,6 @@
      "map.dannydannydanny.me".extraConfig = ''
        reverse_proxy http://[fdd5:53a2:de33:d269:6499:936c:48a:bbdc]:8092
      '';
-      # studio — Kyranna's private art-learning archive. Same notes
-      # service on phantom :8092, routed by Host header (STUDIO_HOST).
-      "studio.dannydannydanny.me".extraConfig = ''
-        reverse_proxy http://[fdd5:53a2:de33:d269:6499:936c:48a:bbdc]:8092
-      '';
    };
  };

--- a/sops/machines/distant-shore/key.json
+++ b/sops/machines/distant-shore/key.json
@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1hjhqyuvcjuh62xh9m5ek3aa2rluaz8c28hgh2pm435jkqtpry9ssdn2l0z",
-    "type": "age"
-  }
-]
--- a/sops/machines/foreign-port/key.json
+++ b/sops/machines/foreign-port/key.json
@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1lwl2z6ymqjshknr79277qnr7hvffcc8n7qdqt98sz3t709a5yutq8d7gka",
-    "type": "age"
-  }
-]
--- a/sops/secrets/distant-shore-age.key/secret
+++ b/sops/secrets/distant-shore-age.key/secret
@ -1,14 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:WTerGWNmve9/q+TLYi8HoGUQI0UgYMZN2zuC/FABX0MC6VuUsz9Doz36X8lsy+MRJzcHNPqdaHmAHopY/hODHLBirfUPLVZjEKI=,iv:ilp+cJivxY2us1jO85dWUHAqLJSsJ7ZKpmYMyi2476I=,tag:H0k2CZDhcH9lYSxz6BAPrg==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1g6y8gvcampqj5y3yzdajke2h5n7k6ckdg6a424cghy5325px7cmqjmmd28",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZS2ZhQlJacmR4R3JMek5l\nZlFRajM4VllmK2R6NFlRMEkwNUJOL05OUUhzCmpWQ0gxQ1BHUkZOVm80QzRUc1BY\nTDNRZDZOL3EyS1FWK1A4UUd6MTFaTjAKLS0tIEUxU3hBSkZqRmc5d0dXZm0rNTYw\nQ0hrZUF5dDJLN0MvM2RQZlVFZkNPc28Kvq8yV+VwqQIuG1SPI/mMYbGwuD7oUOeR\nCzAuZvqGtludjW7+wX5uIwRzHMudU/yP/iME8vsDC3dL6sf75+arHg==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-06-07T16:36:36Z",
-		"mac": "ENC[AES256_GCM,data:g35f5YmoneVewxmTh3E8ECDGAl0OwUj4v/2bjFs9Dd7MaT3in7PHvu30jJ4WHalYC8pkT5IlpBwsp1nVUnKsgh+2V+jN4JiGizlvTwByaYoalOoGZStIyQa+k8XRQqoUDbV3ESdI5q+dwS5PCWYIOH3MoA0o5b42iQPghrViaeY=,iv:v0UUy4LtQ5SRLB01vbcfNpcm8zgs1Vp3KCK552peXlA=,tag:45b8czXYtNh02q7P42FJmQ==,type:str]",
-		"version": "3.12.2"
-	}
-}
--- a/sops/secrets/distant-shore-age.key/users/danny
+++ b/sops/secrets/distant-shore-age.key/users/danny
@ -1 +0,0 @@
-../../../users/danny
--- a/sops/secrets/foreign-port-age.key/secret
+++ b/sops/secrets/foreign-port-age.key/secret
@ -1,14 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:MH/ib8WAbzucbm2dhhoo6ESSSLKtKMWmjUwtpAOZhU7KyhOoechpJRSkBBmFV4LzbSP1qeaFbid6USJBnRsxkoz6XvhMzP0kzS0=,iv:9sPwc/JIlo5mzxelNzLCB26k2f+n2C9tB8Y/HEdPvHw=,tag:hJBhzTMsTWd9PDydS4aosg==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1g6y8gvcampqj5y3yzdajke2h5n7k6ckdg6a424cghy5325px7cmqjmmd28",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6L2JGejlzQlhiNFhES1lT\nNTZsNFFMT1NzZEV0T28rNDA3STJ1UXNRcUZFCkxoenpFYWJicHpGVDhtMUdwNXBo\nS29EazVsRGFST2ZodDJMTkxQN2I1RjAKLS0tIFpib0RoOTJ6bkU0b1F6NnRaV3lF\nVHhvYjNOUUtMbGF5ejdaVk5WdGt2d1kKNU5JR1nIYPQLALUM3wRO945Sk6GLxJpn\nTVmVUEgXcwHcSij10a/cQOyPXNNnsfIC+WJFMJcjHfsjBnwS5W/Bgw==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-06-07T19:41:18Z",
-		"mac": "ENC[AES256_GCM,data:mVobAhXUhbs49+g0bXfi4TjPG667F7pM8Kk518a7kRZ/HtN2kLYcSyl3XpspTosAs4x3QbFQUbFCgsBgqx+gS6xlw3OAJXM3iG2fNu2qoj9Q7viAEHoWVHwT+ftjA0qVTUf0BDD1r4ow6BNhe6kQy5bQqVu0MhjDfsK9BNTXAu4=,iv:aFHo3bQKgr1XSnwGUajkSFa4UftTWdZbPtXY05N7qOM=,tag:VymYJf4XFLaEGvxQmvF6rA==,type:str]",
-		"version": "3.12.2"
-	}
-}
--- a/sops/secrets/foreign-port-age.key/users/danny
+++ b/sops/secrets/foreign-port-age.key/users/danny
@ -1 +0,0 @@
-../../../users/danny
--- a/vars/per-machine/distant-shore/data-mesher-node-identity/identity.cert/machines/distant-shore
+++ b/vars/per-machine/distant-shore/data-mesher-node-identity/identity.cert/machines/distant-shore
@ -1 +0,0 @@
-../../../../../../sops/machines/distant-shore
--- a/vars/per-machine/distant-shore/data-mesher-node-identity/identity.cert/secret
+++ b/vars/per-machine/distant-shore/data-mesher-node-identity/identity.cert/secret
@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:esTlopK7VkLLnWvxsLoZtAGgbYKWKfu0XJde2fzxDuOaf9yUCU6NHpnyRAZnChceEZ3frwS7Lh/LWqX9CTKQ1LHTV8HrJERSERDzrQDHbIXFLtDbeF+qN7M1wYFEwCUa8PVAg4XHMN/ZGy6H71+J8UrktcbxcHUr+8L3pj4DZb5930kT3U02rzSoan8zb4zMhGqA0keq9QJ04uNJEN2Bly1kCBvdgc7kVUBNHwS78s+jfsa3PyOiLy5AI4CEbQ5r/xBjNgY/aSEOzRMoZtVWUFlh5Kxc47gz7MlK2x/2iXyCIAw3qeTIxor30GIL,iv:QbSPukR5aMrhBfYOM6lOb0qSEPm4oEqqQp59WDv0p6Y=,tag:KrMyGleLjIhT1LTlS3S63g==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1g6y8gvcampqj5y3yzdajke2h5n7k6ckdg6a424cghy5325px7cmqjmmd28",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyWlpRS1hhQThqaFUyNE4y\nYU1YVDFtazZnSHpTOWRFQkZYVThsRk9RQ1RZCnI4ZlFacTRRSHlub2hWVTNSSkhN\ndWExR202RG1nZ2dQTzQ5LzBNNW1kc2sKLS0tIHZlZXNhSm9wdElTZzRXZjQxaDAx\nRXpvcEkwK3dMNHZ2M21OSFluWnhDOFEKv0/yC/Llmhsm3+kV3AUJ2PPF817rOyL5\n6GkqTrb/gB8q8jnQabDr2sHUz7AB4w7zlQaNLRSo3Ba8KFbW7GZNRg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hjhqyuvcjuh62xh9m5ek3aa2rluaz8c28hgh2pm435jkqtpry9ssdn2l0z",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvcEdVdTBsUThiOE1EVWZW\nYXh2NUNCZTVieUZKbjByY2dSZVU2c0Q4L2hBCm1mNzVrcTRTTFpUTkJDZlArYTBZ\nWXhEMERmd1J3VTYxa2dWTlFxOW45N00KLS0tIHNLVzRCdDJGdWk2K0JoY1dJbzIz\nQU9DR2tXU3l2aU9YMGd1RjBGbUJYM0UKYmdAj535wvaGxN6m2VBBVtWRAD5RzQ7K\nbiJjvf8NH4A0aO9RVTFCevqRXUOKBu7jNIpFFfEyUEGHEUCWOuVSlA==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-06-07T16:36:36Z",
-		"mac": "ENC[AES256_GCM,data:QVkNUsAO6BsVoPAL5GG1/DProapF8ryaUGDr8Y8mYPpD1Y2YXAF2sBRJ4FWkFZkWl4L2sp5DLXfqs+z0tpvi6rpG0jfpgJzy3Du2QKnk5W78WENlK+M74tSzAUfCUPn6RodykLJ8ik+EvxR+yxRmfjStAWsS6eqoTYowa4TGeJ0=,iv:qousMcaNKMtl8hGcfiS1WYBe0ftyb9ohHdBG+gqTio0=,tag:j64zgZpB7cmDfPcq4csjMQ==,type:str]",
-		"version": "3.12.2"
-	}
-}
--- a/vars/per-machine/distant-shore/data-mesher-node-identity/identity.cert/users/danny
+++ b/vars/per-machine/distant-shore/data-mesher-node-identity/identity.cert/users/danny
@ -1 +0,0 @@
-../../../../../../sops/users/danny
--- a/vars/per-machine/distant-shore/data-mesher-node-identity/identity.key/machines/distant-shore
+++ b/vars/per-machine/distant-shore/data-mesher-node-identity/identity.key/machines/distant-shore
@ -1 +0,0 @@
-../../../../../../sops/machines/distant-shore
--- a/vars/per-machine/distant-shore/data-mesher-node-identity/identity.key/secret
+++ b/vars/per-machine/distant-shore/data-mesher-node-identity/identity.key/secret
@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:kAzaF+nxyux0zwjoqC5QYrx5UyEhMPW0v9hGcYUXExZl6ShMMgCWhKN82al2jY6OnU/CQ7UT9USH6PC+eecimyM6A5YXQ0GvvU3uus0t46GKqXqcGVl4BdgVO6tm8ienIcfjF6ml3LyvMXirjDdIluVkrH/P0vM=,iv:BSQrtg9kgBHRkCV8+nODNyPX3PchkTEjPPTYy5JZrfo=,tag:dPtjxWqDh1Bce9rlW6czyw==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1g6y8gvcampqj5y3yzdajke2h5n7k6ckdg6a424cghy5325px7cmqjmmd28",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMNkR1YTZNU1FyU2VWaUJR\nbjBOc0RSMW1SL1ZkZ1ozVHRmcVdkS01sdkZnCndTbGJlOVFrdDJHVDUxS1JFUmcy\nZS9jWGhRbWFCeGZOMHQwdzYxTFlrSjgKLS0tIEFaZmFzOXdXVjVOeUJuMDdpQ3hK\ndnRkUytmZk1zaXhUTSt1OTljUkNYK2MKpe6f3GHGCfduiidzYh0qaKEBaKyBZY4s\ne/f5QvZVApMiI4HFkOwFmNITOv6JdjGMQOw+OI6po0nqg0mqVnNIVA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hjhqyuvcjuh62xh9m5ek3aa2rluaz8c28hgh2pm435jkqtpry9ssdn2l0z",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpa0p1NCtUeGFLRzJFOFQv\nVXh4MThqOVR4TU9SK3Mrc21Ga1BPdUZrM1c0CmJxQzNyam56aTdUVVB5NVhEenlV\nOTkwb2YyRWdoVXc4K2VEaXhwZXM3TEUKLS0tIEFBajAycEQzelNoR2tCU3l6cVJo\nc3lHbWJZQWFQTkVxd0lBamxlQStZWlkKopG1Z2E0Smt/z/y1+cQeTKUKyJKBXzZr\nCQNkGfi1Dk/7n/WeKwePHWVF/19WqVfOIZW0E3tOKOIqDQZa0Io1Nw==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-06-07T16:36:36Z",
-		"mac": "ENC[AES256_GCM,data:B6UAFOrK0QIngkf5OA3+BnLAouBvsr0AbW8lKI8RH7ylGQNOyXfnN06fYshi+jQyu5EAZBqovfSZzgcTDm7MDRAjzzmTToT5ekHPZnquleU/F7pF/D7JF78M6rQyw3uG0nwhnJcRqlCAXy+56++kTJhoKEW+B5fUsbvlHTmxwLk=,iv:BXDbLObPBXsL3Uj+TRwIFtNDRzWYJeM0mJyDDluz70s=,tag:eTANaLmNaUUSYBNcIhuIFQ==,type:str]",
-		"version": "3.12.2"
-	}
-}
--- a/vars/per-machine/distant-shore/data-mesher-node-identity/identity.key/users/danny
+++ b/vars/per-machine/distant-shore/data-mesher-node-identity/identity.key/users/danny
@ -1 +0,0 @@
-../../../../../../sops/users/danny
--- a/vars/per-machine/distant-shore/data-mesher-node-identity/identity.pub/value
+++ b/vars/per-machine/distant-shore/data-mesher-node-identity/identity.pub/value
@ -1,3 +0,0 @@
-----BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEAABhcRTNvFEyWkyRBX17KkM5nDuqOvR1xTY5vDqTygvk=
-----END PUBLIC KEY-----
--- a/vars/per-machine/distant-shore/data-mesher-node-identity/peer.id/value
+++ b/vars/per-machine/distant-shore/data-mesher-node-identity/peer.id/value
@ -1 +0,0 @@
-12D3KooW9pjiKnqmnHSwGRhgyUqKeFydDUE8RvYJDAqHb5PZvzue
--- a/vars/per-machine/distant-shore/dm-pull-deploy-status-key/signing.key/machines/distant-shore
+++ b/vars/per-machine/distant-shore/dm-pull-deploy-status-key/signing.key/machines/distant-shore
@ -1 +0,0 @@
-../../../../../../sops/machines/distant-shore
--- a/vars/per-machine/distant-shore/dm-pull-deploy-status-key/signing.key/secret
+++ b/vars/per-machine/distant-shore/dm-pull-deploy-status-key/signing.key/secret
@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:tLR5iZ7Iro3BuBJlpvkKO7RrA9X2pO2H9Isi6jc8y8krh+a89Eug0PCNb4U/aSASjQgDfZgwg9+SU1y4iIoc3qC4sxw3f4uTdjCWRDEgfAvY3DVWiWI/EbWcfX7bVvl/GCQtHSwBW5z3KwhJV2McLK6Fpblx6fM=,iv:exFXncN3SA9zqSTFxX6o3kstwMGL9y8x0IOqJVNqK+I=,tag:dEkDG3meaWoq74hkRHbplg==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1g6y8gvcampqj5y3yzdajke2h5n7k6ckdg6a424cghy5325px7cmqjmmd28",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3YWliNzFKWnZqdnZYeHRs\nVy8wdk1ZZWpJTlg2WWc4eEpUM2diZEFoamg0CnJnVDZJT3lWaUZlV3NHY1NpN0tW\nMXdRTnNGSjBhSFpLY0xvaER6UDI5RlEKLS0tIDloRHJFV2I1RVN6TXh6dmd5dzV0\nZ1AvZmpOM0VkaVZjNHlFdFBNd0FhTVkKEVFjtN66i+8f7P03ODYgoWZsTUiEcPiL\nYaV4UZKbjnp3SKTAeWk1P/lEj5DkicW3hq0ONQf2xrYriCpAc3/gKw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hjhqyuvcjuh62xh9m5ek3aa2rluaz8c28hgh2pm435jkqtpry9ssdn2l0z",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0VG1wZE52RFQ2ekl1R1ZY\nN2pmYWd1cStGZzU0Tk1LTmNuMnc5c1UwMnlVCmJrMjB6Qzc5ZUE3aXhmUmVuTTN1\neVFWbGhOUUNYUFJJVHF0OGtaR1FvVG8KLS0tIFp4aHgwN1QvWVVnaTNDVG42SXVB\nYVlLRndmQ1ovQjFMcHZYU0dqNS9ML2sKtHjmgLODafDcmrpYQyXRc/ajAR2saGs8\nlh4NVYYYwoXE6sNKSXwzgXXSjGEXGTVLxVvp9OKnSloI5/LsbrxANQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-06-07T16:36:37Z",
-		"mac": "ENC[AES256_GCM,data:20RiSc6b3o3xy23NDQRw4pcSf/akdcUMO6ciSFSZMQrhreYPBEa+Tb85qqqZ0dqQHRQFanzE3Usomp+Ux4FhFfSsCxljxdOjkQCAfkQKrg+GQ7/NOUhgdVQtep2+gT7MFrEzo5Jv8kctNuT18kqUjv5CwCOR35QJ98yHeAUULoo=,iv:ocUDNN4vhOX9pCUJKqQiBRhjTHbdRdw96csN6EWFdUg=,tag:Lps0aJy0ctWU5ilCUn9Uww==,type:str]",
-		"version": "3.12.2"
-	}
-}
--- a/vars/per-machine/distant-shore/dm-pull-deploy-status-key/signing.key/users/danny
+++ b/vars/per-machine/distant-shore/dm-pull-deploy-status-key/signing.key/users/danny
@ -1 +0,0 @@
-../../../../../../sops/users/danny
--- a/vars/per-machine/distant-shore/dm-pull-deploy-status-key/signing.pub/value
+++ b/vars/per-machine/distant-shore/dm-pull-deploy-status-key/signing.pub/value
@ -1,3 +0,0 @@
-----BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEAPVF7m/+s1YroGdvSMxPwKmenJjk4yNrP8tNtZGHEhJI=
-----END PUBLIC KEY-----
--- a/vars/per-machine/distant-shore/zerotier/zerotier-identity-secret/machines/distant-shore
+++ b/vars/per-machine/distant-shore/zerotier/zerotier-identity-secret/machines/distant-shore
@ -1 +0,0 @@
-../../../../../../sops/machines/distant-shore
--- a/vars/per-machine/distant-shore/zerotier/zerotier-identity-secret/secret
+++ b/vars/per-machine/distant-shore/zerotier/zerotier-identity-secret/secret
@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:9BN/+IBbsAmgABYuTEZvgB3cJOwiZ1aKu5GqcBEvCBoY3K4T5lDPqHrwdH48msu9/KD435SSz336+Stq8bQB87AXdfDMEhVIUwi8SV/CQg3urXvyqp0+lkbbrP9xyFzcH16L7NDmfD/SlZeFXQoPA3YHLvoYSsWnfjzHqrt0600IhAgq0TK+c+5hCzke9k89pgOrO6ypueHV+6GMx0g4JMcwq17bqT3fOQZ+hHSp9uOWDP1kJrO2TktwR/9AWAN+IG1sjUcaKYg+W34pG4XDkNPnp30NPfXSGMXjrM++MkIxyow1zFeSRI+bP5iLQEFpm1AvFFRdYIGN66hQVCgv0kxaOEJknlrG4QT4TyEJ,iv:MUsdjMEBvuaFkJJ6t3NNDrgECjheLJ0FtdrBsztOKZ8=,tag:lTcmyWAoKYPUhDjkHTd+Iw==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1g6y8gvcampqj5y3yzdajke2h5n7k6ckdg6a424cghy5325px7cmqjmmd28",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLQ0Y3Y1N5aEo5ZDQwZ2g4\neXBDMldtWU42cUFaaTBmS1B6YW5QWktNcVZvCjBMYmNKWjR6cmVIRjhNK2Y2aWg5\nM093ZFhFWW0yZnVrOUxGQ3MzSGY5UkUKLS0tICtTbHFTMUtGQWEycGNDNFlXcTBS\nWmNWbDZSNE5sWUpzQ0dTNTgyemhNdzgKdPZIFY/m3IpEMH1PGsYToyLe9Qzj6LpW\nJhOTJbT9L0dTfE3OzdaG8BkwCkb8XCWxzveLPTLPCOvbP8DmOpjjHA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1hjhqyuvcjuh62xh9m5ek3aa2rluaz8c28hgh2pm435jkqtpry9ssdn2l0z",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvcXQ4NjE4d00ramdsemhI\nb1dxcldHS040TkVyL2lxUjdxL3J1WUlCdEZNCnExMDRqcmh5MGUxNFpJd3k4MzZT\nMXljSW5ncWxlSGRsYlJBdkoxQjIyZHMKLS0tIEhUSkRpeXhOM3BnTEsrNEpDb1I2\nUlhvZzFjRVNCcng2c3lsYS8vZHVHN00KFMMGm6BJY7/cn5WSP/RgjK6bVo4r7ps2\nkMcPoyMyenPiZrzWdL4iIb5azFB3CI8DAQS84Mt6KPR/wkYNoErxJg==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-06-07T16:36:38Z",
-		"mac": "ENC[AES256_GCM,data:Cy3KGFXu58LAWSCUYJGpMeJxBboQxEPS1TzoK8iCFUyTT7Xfak9M9omaBd2r2fEel61iuSDVoDvQbZgNy2RwuiG0HhTXliMXR6G4oOheQIsSQix81tOWoPipu77qoeVkOSUDRhBzHdQVQQmiN7VJvw1kHvCq20u2ZM0057vf91g=,iv:uAmwqd0gpCD7pTFWwgKdkKjjxVadnHeRYUEv+vUgvL8=,tag:iDbx80+08AqhvdZIXJzdgQ==,type:str]",
-		"version": "3.12.2"
-	}
-}
--- a/vars/per-machine/distant-shore/zerotier/zerotier-identity-secret/users/danny
+++ b/vars/per-machine/distant-shore/zerotier/zerotier-identity-secret/users/danny
@ -1 +0,0 @@
-../../../../../../sops/users/danny
--- a/vars/per-machine/distant-shore/zerotier/zerotier-ip/value
+++ b/vars/per-machine/distant-shore/zerotier/zerotier-ip/value
@ -1 +0,0 @@
-fdd5:53a2:de33:d269:6499:93b6:ef1a:c3b3
--- a/vars/per-machine/foreign-port/data-mesher-node-identity/identity.cert/machines/foreign-port
+++ b/vars/per-machine/foreign-port/data-mesher-node-identity/identity.cert/machines/foreign-port
@ -1 +0,0 @@
-../../../../../../sops/machines/foreign-port
--- a/vars/per-machine/foreign-port/data-mesher-node-identity/identity.cert/secret
+++ b/vars/per-machine/foreign-port/data-mesher-node-identity/identity.cert/secret
@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:wnNPCB0+f3dcxMW1/pcFZFauUVYTC1mfWoWBV2EJmyRzZS3Uux5Un3R/GbYQeDSFZDLzLH+zCZFaxq3mpb3NGTTUzF8vnGMk/OnjlolA8OjAfiODI0mahTiQA7WcWSk1hkkZ15Ri1o+uyumx9hmvJU3dIsKIJe7AizCzwP5bHg1jgRhG2wPKKyIDWKoh4JTlR6SxK6/tOaUPx2gb2ddz2Lk56Xdw7GCbb/9I9D6sRwxdWMCoWFKdTllLsdsD48b8Jfq4ewD+LudYEtiVByk5SpyOjQoAmMLYaGlD+nxFgZz53hePRIXnp0fL0pm4,iv:fA607yxD/yHJatEiGh1SVGDcqKxB+EFeyCUQeF/Z5hA=,tag:glaq+MBCp6ptKqDsw4RM/Q==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1g6y8gvcampqj5y3yzdajke2h5n7k6ckdg6a424cghy5325px7cmqjmmd28",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0MklDUkpWbEdFcFgxTVJZ\ndEs1OTJtZFhVaEsyb2pobGlUOGhtcTY4RWpVCjFDV3lqRmNGclZMbTR3UXlhcjJv\nVEY1Tjk1YWR4Tmt0SmgvR3laZnNIRUkKLS0tIHB1TURnYmVzZW4xSERMR0ZrRXl5\nbWVJbW1keGkyUkhuQXE0MEFTaXFsS1EKHlsS3FDr9RuMBRU5r4T3bCZWZn38V3k+\nfLUfuZK2IF+xyD7kEiBuATB57wwfd8RzZ1lBwz4fD4jlb+fz0BXoJQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1lwl2z6ymqjshknr79277qnr7hvffcc8n7qdqt98sz3t709a5yutq8d7gka",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6TnNqc284WkZqdXNLVFBU\nRTJndEFmNjY0Q1YyUnRPLy9jWllpSy9ZaFNFCkFkNmpYenQ2dk1Fb2dRZTNvM0Jl\nemNqUmdjQmpJQUF4M3ZNRmo4UEhXOHcKLS0tIFp4OTZJTGR1algxTEVWemdkQTB5\nME4xTTdlelN6bXJiTGRSM1VSWG5vZUEKOYc71rLx7RTq4DR6ZggrtgllK58sYJ6h\ngw156OTQl3fKWxlrKDd1l4o72M1qmfAIQ1z5YJJ+CfNPk/iMz/R3rQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-06-07T19:41:18Z",
-		"mac": "ENC[AES256_GCM,data:AkcOoNTxMNkpF0SrwFlNujBrB8fxL1diu+mGq/kbsiWIj6UqvVD+dimDSvTgVqvnU4HF7/7b9zKriC6SbG42Kz8zScFv7m3idD2tHr+7SE/iR7CowDQs70CRMo1b85wLq8WAxhfQb93NHdum6I2biNVIf0ZXs1+kZ2iNBxtjqfQ=,iv:kWOCWCe953ekq0n0HLe3S2JprIBnBe9QXwIzDFyQMH8=,tag:tLz7VZwj7RrbpJ7QTrBqcg==,type:str]",
-		"version": "3.12.2"
-	}
-}
--- a/vars/per-machine/foreign-port/data-mesher-node-identity/identity.cert/users/danny
+++ b/vars/per-machine/foreign-port/data-mesher-node-identity/identity.cert/users/danny
@ -1 +0,0 @@
-../../../../../../sops/users/danny
--- a/vars/per-machine/foreign-port/data-mesher-node-identity/identity.key/machines/foreign-port
+++ b/vars/per-machine/foreign-port/data-mesher-node-identity/identity.key/machines/foreign-port
@ -1 +0,0 @@
-../../../../../../sops/machines/foreign-port
--- a/vars/per-machine/foreign-port/data-mesher-node-identity/identity.key/secret
+++ b/vars/per-machine/foreign-port/data-mesher-node-identity/identity.key/secret
@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:1Hq98rN3U+8DcxIFJpYkvv31gUpSm0WBjfZxivYn7/ZkH6zbJ57fzeU+9PH9SRF6QBuekZKZNIBup3fteI5VqQ/moEyQE9aSvnqGCrkcamDwDQfN5GwKX+rb7W96atESRm/VqhgDWC2KTc3892515gBPpkDG+nc=,iv:tAlghG1jpDPcYgTvEzAlnB2upAetl8mz8IIQercHe4k=,tag:mz3fvVlKolg5JzrjhBNPaw==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1g6y8gvcampqj5y3yzdajke2h5n7k6ckdg6a424cghy5325px7cmqjmmd28",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlaEk2Z1NMZnVtNlJPdXgw\nTWNaTFBCRXo3T2JRUEY2Q2hBY0xpMVV6ckE0ClJOVUpKNDZTcEhGS2RzQm1tSjNp\ndmxQWjl5aHord0RUMHRvTlhyMkVqc1UKLS0tIHlDRXlReUgzZVdLcE9kMFhsTDRq\nOGxpZE9KcUR0VEhyOE9VUkVUVlIyRlEKsnU17famN/qr2M8BdvVpRl5bSWseegrZ\nnB9yljvm+pxsE55xM1WyguNfUwXtHj0YTiVgBl5PIUolj3/J8R76sg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1lwl2z6ymqjshknr79277qnr7hvffcc8n7qdqt98sz3t709a5yutq8d7gka",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjTGdDVlB0RGlTcng3M3pE\nNzEvNFpBUzF0aDJDaUJFTFFGWlB3bEVVdHhFClZOZGNDanlMTkxIMk9lbzVGRzAv\nZG93NUFFL3NIM3Z0TlhucFlMTTYwc3MKLS0tIFFQcTIwekNEM0k0MElGZys2QldS\nMDZpRVk5OVNZYVVWSWJDTFZqVFdiRWcKgwuwZgKhKx1PiQwH2CgMoCl0WUQR5Rv9\nx4mpZgkoD5pkEx896117CyAy2BRzrDWo+4SsjEijSMlDynYsbxLReA==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-06-07T19:41:18Z",
-		"mac": "ENC[AES256_GCM,data:DX9+9MH8ZPtc6sPbYSc+54soAIXJWWEoEWBZdbJ6gT5RhVdzUjMHuEbmb9eMcb+nVu4KSUCoXiJOT9XActSU2dcTNIIiLX1lqpw0aWRS2sAWM+Go4hT4/P98z/0vcsdN/uQOBl3cDlygqKhN9GSoPfJTMT+QTSZsVjxwYxW1pPM=,iv:B9RiMMX+yS1Y+3E1ifTJI30pvLrah5SCPwW6CZKZGNU=,tag:MA007hv+nMIMutOdl5ewkQ==,type:str]",
-		"version": "3.12.2"
-	}
-}
--- a/vars/per-machine/foreign-port/data-mesher-node-identity/identity.key/users/danny
+++ b/vars/per-machine/foreign-port/data-mesher-node-identity/identity.key/users/danny
@ -1 +0,0 @@
-../../../../../../sops/users/danny
--- a/vars/per-machine/foreign-port/data-mesher-node-identity/identity.pub/value
+++ b/vars/per-machine/foreign-port/data-mesher-node-identity/identity.pub/value
@ -1,3 +0,0 @@
-----BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEAZqy+mwYOfJy3GSHfeC80TFn1c0kYte5zzzbwrP8xww0=
-----END PUBLIC KEY-----
--- a/vars/per-machine/foreign-port/data-mesher-node-identity/peer.id/value
+++ b/vars/per-machine/foreign-port/data-mesher-node-identity/peer.id/value
@ -1 +0,0 @@
-12D3KooWGjAXheQGEfy13JQJP8pSrwcivxoXw5ijRzesfXVDFuyW
--- a/vars/per-machine/foreign-port/dm-pull-deploy-status-key/signing.key/machines/foreign-port
+++ b/vars/per-machine/foreign-port/dm-pull-deploy-status-key/signing.key/machines/foreign-port
@ -1 +0,0 @@
-../../../../../../sops/machines/foreign-port
--- a/vars/per-machine/foreign-port/dm-pull-deploy-status-key/signing.key/secret
+++ b/vars/per-machine/foreign-port/dm-pull-deploy-status-key/signing.key/secret
@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:dDO6hu8prxHvoP41Oxky0mGGbrwqcCcrrkg0tbr/Sv8K16gNoQaX2wvaRDExOmt0BZkv5Oe8p5pvKudmm5JN0AS7oaPexW0lE+vFJ+zrRpq01c5BbCYZ0SuuafJ3VmRS/dlYU0/SZ4MyK3eijLzX3rGHPOi3b0g=,iv:hbh49ExGMYyshxcus/5sTIs/ZcOL9pod/3H/oHG1Qs8=,tag:fjHnl2uunGEU0i2FtgZB+g==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1g6y8gvcampqj5y3yzdajke2h5n7k6ckdg6a424cghy5325px7cmqjmmd28",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZNTlkTWVleld5K3Q5Vklm\nMlphdVduQ0RKY0pEVGdVTm5scHRWR0lNVjAwClV4V3drQnFLUkhpUVk1ZElGcFM1\ncit3UTdURExTRDVjVW1ZdklTZzRINDAKLS0tIHFMYnNycmh1Y0h4OC9UNUtHUmMw\nVXdpVk9QWHlBYmtCS3FOam9SWnRFZG8KDnggBRH/wSh1tfiCGOn1sF/Fdfxkf1us\n7Lzxexrmh+lllns/KY2of9L2HUgDavp+ju/5QVFfT7O3SuSTB6aoow==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1lwl2z6ymqjshknr79277qnr7hvffcc8n7qdqt98sz3t709a5yutq8d7gka",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5eVpNUmV5QlllaXlPaGgr\ndXZYMURzT3I4UWxWSHBSbnAyZVNsOWNaZ2xJClhkRmZ2ejBYVCtkTVBZZE82YXE5\nWkdZWFJFM0lVQXFFYm5rYnRVZDFEdlkKLS0tIHZ5OUgzcFRLZnFWK3pDUUtWUUJj\nWFF4Zk5IeDl5VFNQWlVsTk1lQWlLQmMKJzaOm0cwOshmwoO+eHovf6i6mGkezjIP\ncXJlDaJyxfPKJxc36XlJ5KT9c4RqTX7WFOifHoKRh4EN58KnvtFj+A==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-06-07T19:41:18Z",
-		"mac": "ENC[AES256_GCM,data:UX7265pubBBssugQk4pZsQH5WedsmnqFa77bJQZwu2ixNUTkO9VfR8r9CUiugDOmbDj9Y7TJtoN4JR+v6hBmDOnjHO5w0WO5dONNJebGmO+pGU7r/K6WwSGi5nPANiYjGuHqYZwq7PJe8ZCF/vu/ZI8q7iJijw6xGWuGHaP/Gvw=,iv:Ezo1z5n+pHPdhjh9l+HvmsgElEwJR4eoMPtZKdDhHAI=,tag:57yLRXReSRz098sDxyiQZQ==,type:str]",
-		"version": "3.12.2"
-	}
-}
--- a/vars/per-machine/foreign-port/dm-pull-deploy-status-key/signing.key/users/danny
+++ b/vars/per-machine/foreign-port/dm-pull-deploy-status-key/signing.key/users/danny
@ -1 +0,0 @@
-../../../../../../sops/users/danny
--- a/vars/per-machine/foreign-port/dm-pull-deploy-status-key/signing.pub/value
+++ b/vars/per-machine/foreign-port/dm-pull-deploy-status-key/signing.pub/value
@ -1,3 +0,0 @@
-----BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEA6xYjcIT5B5NDduIARf2EAoE+vsnZK+NWcyiI0fQc0Fg=
-----END PUBLIC KEY-----
--- a/vars/per-machine/foreign-port/zerotier/zerotier-identity-secret/machines/foreign-port
+++ b/vars/per-machine/foreign-port/zerotier/zerotier-identity-secret/machines/foreign-port
@ -1 +0,0 @@
-../../../../../../sops/machines/foreign-port
--- a/vars/per-machine/foreign-port/zerotier/zerotier-identity-secret/secret
+++ b/vars/per-machine/foreign-port/zerotier/zerotier-identity-secret/secret
@ -1,18 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:PO0Thn6D7kcIGWr7MwmS8H58+9JYSDDGQZlx28B7T6noXTA6tWqMJlqY4aMn1dXJ1CKAqV4q5VZpd/kP9KQvSL4DRnRrFteRe0C+k/mlLfwsWVqLGFY7eqoG1QTZwc4w8cw3FB7R0YUfxRlHq3mIyrbf+8POX2Rq2r5L5GNWVkGTKZOPRtNawPxTrUgfVM4B9ksc1vtTZeWn1GymSwevnt4KPX/8efFAgIclTUHh+Eh+F9xSU9efnkT+Phsh3QLf+3+UHiXQXlpMgwuKrvBJdHWLxJz/3aTpU2+nByqv0IANhGhR8ut0EbFXr8Zr1pIYrt4mWCAyYJvnwxR6iljQ1zyhI0GXUNAHJPQ7wRYq,iv:yDOBYu2+HK/KfS/hbR5QgOi2QHp9RzGPiKxojQX2s8c=,tag:q6s6LemFyoFBEq+ojd4D6A==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1g6y8gvcampqj5y3yzdajke2h5n7k6ckdg6a424cghy5325px7cmqjmmd28",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1bEkwSUhxR0JQR2psZ3Uy\nUlFpWi93NTBhZ0s0TlpkQ2VkVUdDWHIyNmhFClBhVFBnb1h0c2o2cm9OODZpZWMy\nQTB2YmxnWmN5Ylo4M1JHMVVVdklWeWMKLS0tIDBSY2NQdmRTZnA1QUtnaHloUFJJ\nb0VvZGlwSko0UitTa2t6TDZ4bnhsSWMKt5awUoFdny/Qg5krgUAzHeqIoIhprPmF\nBNleiSJdAvSsK53a7CT2rGInnl3dcrtpkEWluK7WJlFTJBdekMwQuA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1lwl2z6ymqjshknr79277qnr7hvffcc8n7qdqt98sz3t709a5yutq8d7gka",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6TFZjRjk4Wm8vcEcxN0ZP\na05yd282UmR3NllXM2MyeUpSb0VuWURvTHp3CmJzL0cwcU5WWGJuME1KcmtxSFVw\nL1lFdzg3Z2t4TXBiaWduZ2tSZXc3bjAKLS0tIEp6NWpIMlhoSEtvQ3IyNXJNVnE1\nb1lSczR2eG1JY1NScnkyNWMxWWN0aWcKrnfv9dGrWpmBjt8u+FdtwojU5hLDyV/Z\n6vgaW35SvFYLYR53Zo18MPkYbqGcaNldyr68qbYMLxqVdQUJwv3LSg==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-06-07T19:41:19Z",
-		"mac": "ENC[AES256_GCM,data:joT4cUsVDxTVJqF9OJyETkC0lxQ6sT3XonBIjy80/PZ6cs7lcEyboWWSVuBcG+CTPzcUv1uXmdNjUBNc/TDdF8P0vEGnMBgmNRnSrxb0OwENW+c08GOB+c4AJev58H+V1wmzmyr9NJAKxpvQaE/cWIS1wS7c5QdiKAj8HsYd2ns=,iv:H2xSAU0jTH0bKS+P5W+FwbOtzl/Wb5xTfirkZMmtPq8=,tag:o+b9ESO3d8XnIU/bcH09zw==,type:str]",
-		"version": "3.12.2"
-	}
-}
--- a/vars/per-machine/foreign-port/zerotier/zerotier-identity-secret/users/danny
+++ b/vars/per-machine/foreign-port/zerotier/zerotier-identity-secret/users/danny
@ -1 +0,0 @@
-../../../../../../sops/users/danny
--- a/vars/per-machine/foreign-port/zerotier/zerotier-ip/value
+++ b/vars/per-machine/foreign-port/zerotier/zerotier-ip/value
@ -1 +0,0 @@
-fdd5:53a2:de33:d269:6499:9389:9b18:6c52
				`@ -1 +0,0 @@`
				`../../../../../../sops/machines/distant-shore`
				`@ -1 +0,0 @@`
				`12D3KooW9pjiKnqmnHSwGRhgyUqKeFydDUE8RvYJDAqHb5PZvzue`
				`@ -1 +0,0 @@`
				`../../../../../../sops/machines/foreign-port`
				`@ -1 +0,0 @@`
				`12D3KooWGjAXheQGEfy13JQJP8pSrwcivxoXw5ijRzesfXVDFuyW`