From 6ee5593da68ecd46d0ed7820ba97e8ae614ed4cf Mon Sep 17 00:00:00 2001
From: Tyler Starr <starrtyler88@gmail.com>
Date: Fri, 13 Sep 2024 20:26:41 -0700
Subject: [PATCH 1/4] add tree for backup

---
 provision/hosts/default/backup.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/provision/hosts/default/backup.nix b/provision/hosts/default/backup.nix
index 9f8bd6cd..48a71c1c 100644
--- a/provision/hosts/default/backup.nix
+++ b/provision/hosts/default/backup.nix
@@ -3,6 +3,7 @@
   services.borgmatic.enable = true;
   environment.systemPackages = with pkgs; [
     borgbackup # Deduplicating backup program 
+    tree
     (pkgs.writeScriptBin "stop-docker-containers" ''
       #!/bin/sh
       [ -e /tmp/docker_images ] && rm /tmp/docker_images

From 9be3ce3f96e410168257ef5a72fa959df3bf9c14 Mon Sep 17 00:00:00 2001
From: Tyler Starr <starrtyler88@gmail.com>
Date: Sat, 14 Sep 2024 08:47:56 -0700
Subject: [PATCH 2/4] move secrets out of modules into relevant config files

---
 provision/hosts/bulwark/configuration.nix |  1 -
 provision/hosts/default/configuration.nix |  3 +-
 provision/hosts/default/default.nix       |  2 +-
 provision/hosts/default/git.nix           | 15 +++++++
 provision/hosts/kestrel/backup.nix        | 24 ++++++++++
 provision/hosts/kestrel/configuration.nix |  1 -
 provision/hosts/shivan/configuration.nix  |  1 -
 provision/hosts/torus/backup.nix          | 25 ++++++++++-
 provision/hosts/torus/configuration.nix   |  1 -
 provision/modules/gaming/emulation.nix    | 11 +++++
 provision/modules/system/default.nix      |  2 +-
 provision/modules/system/secrets.nix      | 53 -----------------------
 provision/modules/system/terminal.nix     |  3 --
 13 files changed, 78 insertions(+), 64 deletions(-)
 create mode 100644 provision/hosts/default/git.nix
 delete mode 100644 provision/modules/system/secrets.nix

diff --git a/provision/hosts/bulwark/configuration.nix b/provision/hosts/bulwark/configuration.nix
index 54b863f7..2b4cee51 100644
--- a/provision/hosts/bulwark/configuration.nix
+++ b/provision/hosts/bulwark/configuration.nix
@@ -46,7 +46,6 @@
       nipr.enable = true;
       ssh.enable = true;
       terminal.enable = true;
-      secrets.enable = true;
       wireguard-client.enable = false;
     };
   };
diff --git a/provision/hosts/default/configuration.nix b/provision/hosts/default/configuration.nix
index 14fbdb73..1bf28dcc 100644
--- a/provision/hosts/default/configuration.nix
+++ b/provision/hosts/default/configuration.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, user, lib, ... }:
+{ config, pkgs, user, lib, inputs, ... }:
 {
   nix = {
     package = pkgs.nixFlakes;
@@ -46,6 +46,7 @@
   
   environment.systemPackages = with pkgs; [
     cowsay # A program which generates ASCII pictures of a cow with a message
+    inputs.agenix.packages.x86_64-linux.default 
   ];
 
   # Did you read the comment?
diff --git a/provision/hosts/default/default.nix b/provision/hosts/default/default.nix
index 24dc40c6..08e821e2 100644
--- a/provision/hosts/default/default.nix
+++ b/provision/hosts/default/default.nix
@@ -1,4 +1,4 @@
 { ... }:
 { 
-  imports = [ ./backup.nix ./configuration.nix ./home-configuration.nix ];
+  imports = [ ./git.nix ./backup.nix ./configuration.nix ./home-configuration.nix ];
 }
diff --git a/provision/hosts/default/git.nix b/provision/hosts/default/git.nix
new file mode 100644
index 00000000..815072b0
--- /dev/null
+++ b/provision/hosts/default/git.nix
@@ -0,0 +1,15 @@
+{ config, pkgs, user, lib, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    git # Version control system for tracking changes in source code during software development.
+    git-annex # Manages files with git, without checking the file contents into git.
+    lazygit # Terminal-based GUI for git, making it easier to use and visualize git repositories.
+  ];
+
+  age.secrets."git/github_personal" = {
+    file = ../../secrets/git/github_personal.age;
+    owner = "${user}";
+    group = "users";
+  };
+}
+          
diff --git a/provision/hosts/kestrel/backup.nix b/provision/hosts/kestrel/backup.nix
index d1d9fdf1..1220e930 100644
--- a/provision/hosts/kestrel/backup.nix
+++ b/provision/hosts/kestrel/backup.nix
@@ -1,9 +1,33 @@
 { config, pkgs, user, lib, ... }:
 {
+  age.secrets."ssh/torus/id_ed25519.pub" = {
+    file = ../../secrets/ssh/torus/id_ed25519.pub.age;
+    owner = "${user}";
+    group = "users";
+  };
+  age.secrets."ssh/kestrel/id_ed25519" = {
+    file = ../../secrets/ssh/kestrel/id_ed25519.age;
+    owner = "${user}";
+    group = "users";
+  };
+  age.secrets."ssh/kestrel/id_ed25519.pub" = {
+    file = ../../secrets/ssh/kestrel/id_ed25519.pub.age;
+    owner = "${user}";
+    group = "users";
+  };
+
   # Password-less logins for backup
   users.users."${user}".openssh.authorizedKeys.keyFiles = [
     config.age.secrets."ssh/torus/id_ed25519.pub".path
   ];
+
+  # Password-less login for root
+  programs.ssh.extraConfig = ''
+    Host torus 
+      AddKeysToAgent yes
+      IdentityFile /run/agenix/ssh/kestrel/id_ed25519 
+  '';
+
   systemd.tmpfiles.rules = [
     "d /store 0775 ${user} users -"
   ];
diff --git a/provision/hosts/kestrel/configuration.nix b/provision/hosts/kestrel/configuration.nix
index 1f456d31..0a425723 100644
--- a/provision/hosts/kestrel/configuration.nix
+++ b/provision/hosts/kestrel/configuration.nix
@@ -61,7 +61,6 @@
     };
     system = {
       nipr.enable = true;
-      secrets.enable = true;
       ssh.enable = true;
       terminal.enable = true;
       wireguard-client = {
diff --git a/provision/hosts/shivan/configuration.nix b/provision/hosts/shivan/configuration.nix
index 47578228..4d79885a 100644
--- a/provision/hosts/shivan/configuration.nix
+++ b/provision/hosts/shivan/configuration.nix
@@ -49,7 +49,6 @@
     };
     system = {
       nipr = true;
-      secrets.enable = true;
       ssh.enable = true;
       terminal.enable = true;
       wireguard-client.enable = false;
diff --git a/provision/hosts/torus/backup.nix b/provision/hosts/torus/backup.nix
index d7f3444d..35667fc3 100644
--- a/provision/hosts/torus/backup.nix
+++ b/provision/hosts/torus/backup.nix
@@ -1,8 +1,31 @@
 { config, pkgs, user, lib, ... }:
 {
-  # Password-less logins for backup
+  age.secrets."ssh/kestrel/id_ed25519.pub" = {
+    file = ../../secrets/ssh/kestrel/id_ed25519.pub.age;
+    owner = "${user}";
+    group = "users";
+  };
+  age.secrets."ssh/torus/id_ed25519" = {
+    file = ../../secrets/ssh/torus/id_ed25519.age;
+    owner = "${user}";
+    group = "users";
+  };
+  age.secrets."ssh/torus/id_ed25519.pub" = {
+    file = ../../secrets/ssh/torus/id_ed25519.pub.age;
+    owner = "${user}";
+    group = "users";
+  };
+
+  # Password-less login for user
   users.users."${user}".openssh.authorizedKeys.keyFiles = [
     config.age.secrets."ssh/kestrel/id_ed25519.pub".path
   ];
+
+  # Password-less login for root
+  programs.ssh.extraConfig = ''
+    Host kestrel
+      AddKeysToAgent yes
+      IdentityFile /run/agenix/ssh/torus/id_ed25519 
+  '';
 }
           
diff --git a/provision/hosts/torus/configuration.nix b/provision/hosts/torus/configuration.nix
index 9fc28838..6d02a219 100644
--- a/provision/hosts/torus/configuration.nix
+++ b/provision/hosts/torus/configuration.nix
@@ -102,7 +102,6 @@
     system = {
       terminal.enable = true;
       ssh.enable = true;
-      secrets.enable = true;
     };
   };
 
diff --git a/provision/modules/gaming/emulation.nix b/provision/modules/gaming/emulation.nix
index ac6ec00f..5808242f 100644
--- a/provision/modules/gaming/emulation.nix
+++ b/provision/modules/gaming/emulation.nix
@@ -21,5 +21,16 @@ in {
         ];
       })
     ];
+
+    age.secrets."emu/switch/prod.keys" = {
+      file = ../../secrets/emu/switch/prod.keys.age;
+      owner = "${user}";
+      group = "users";
+    };
+    age.secrets."emu/switch/title.keys" = {
+      file = ../../secrets/emu/switch/title.keys.age;
+      owner = "${user}";
+      group = "users";
+    };
   };
 }
diff --git a/provision/modules/system/default.nix b/provision/modules/system/default.nix
index af779f98..4172fc51 100644
--- a/provision/modules/system/default.nix
+++ b/provision/modules/system/default.nix
@@ -1,4 +1,4 @@
 { ... }:
 {
-  imports = [ ./nipr.nix ./secrets.nix ./ssh.nix ./terminal.nix ./wireguard-client.nix ];
+  imports = [ ./nipr.nix ./ssh.nix ./terminal.nix ./wireguard-client.nix ];
 }
diff --git a/provision/modules/system/secrets.nix b/provision/modules/system/secrets.nix
deleted file mode 100644
index ab846bfd..00000000
--- a/provision/modules/system/secrets.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-{ config, lib, pkgs, user, inputs, ... }:
-
-let cfg = config.modules.system.secrets;
-in {
-  options.modules.system.secrets.enable = lib.mkEnableOption "secrets";
-  config = lib.mkIf cfg.enable {
-     
-    environment.systemPackages = [
-      inputs.agenix.packages.x86_64-linux.default 
-    ];
-   
-    # git secrets
-    age.secrets."git/github_personal" = {
-      file = ../../secrets/git/github_personal.age;
-      owner = "${user}";
-      group = "users";
-    };
-
-    # ssh secrets
-    age.secrets."ssh/kestrel/id_ed25519" = {
-      file = ../../secrets/ssh/kestrel/id_ed25519.age;
-      owner = "${user}";
-      group = "users";
-    };
-    age.secrets."ssh/kestrel/id_ed25519.pub" = {
-      file = ../../secrets/ssh/kestrel/id_ed25519.pub.age;
-      owner = "${user}";
-      group = "users";
-    };
-    age.secrets."ssh/torus/id_ed25519" = {
-      file = ../../secrets/ssh/torus/id_ed25519.age;
-      owner = "${user}";
-      group = "users";
-    };
-    age.secrets."ssh/torus/id_ed25519.pub" = {
-      file = ../../secrets/ssh/torus/id_ed25519.pub.age;
-      owner = "${user}";
-      group = "users";
-    };
-
-    # emu secrets
-    age.secrets."emu/switch/prod.keys" = {
-      file = ../../secrets/emu/switch/prod.keys.age;
-      owner = "${user}";
-      group = "users";
-    };
-    age.secrets."emu/switch/title.keys" = {
-      file = ../../secrets/emu/switch/title.keys.age;
-      owner = "${user}";
-      group = "users";
-    };
-  };
-}
diff --git a/provision/modules/system/terminal.nix b/provision/modules/system/terminal.nix
index 165c4523..2c5ace73 100644
--- a/provision/modules/system/terminal.nix
+++ b/provision/modules/system/terminal.nix
@@ -6,9 +6,6 @@ in {
   config = lib.mkIf cfg.enable {
 
     environment.systemPackages = with pkgs; [
-      git # Version control system for tracking changes in source code during software development.
-      git-annex # Manages files with git, without checking the file contents into git.
-      lazygit # Terminal-based GUI for git, making it easier to use and visualize git repositories.
       killall # Command-line utility to terminate processes by name.
       pciutils # Utilities for inspecting and manipulating devices connected to the PCI bus.
       chezmoi # Manages your dotfiles across multiple machines, ensuring consistency and version control.

From eda2998b0b06b7f48923db7b51c02e7d6e4b409c Mon Sep 17 00:00:00 2001
From: Tyler Starr <starrtyler88@gmail.com>
Date: Sat, 14 Sep 2024 08:59:15 -0700
Subject: [PATCH 3/4] add secret for torus borg backup

---
 provision/hosts/torus/backup.nix          |   5 +++++
 provision/secrets/borg/torus/password.age | Bin 0 -> 561 bytes
 provision/secrets/secrets.nix             |   1 +
 3 files changed, 6 insertions(+)
 create mode 100644 provision/secrets/borg/torus/password.age

diff --git a/provision/hosts/torus/backup.nix b/provision/hosts/torus/backup.nix
index 35667fc3..db3d3db3 100644
--- a/provision/hosts/torus/backup.nix
+++ b/provision/hosts/torus/backup.nix
@@ -15,6 +15,11 @@
     owner = "${user}";
     group = "users";
   };
+  age.secrets."borg/torus/password" = {
+    file = ../../secrets/borg/torus/password.age;
+    owner = "${user}";
+    group = "users";
+  };
 
   # Password-less login for user
   users.users."${user}".openssh.authorizedKeys.keyFiles = [
diff --git a/provision/secrets/borg/torus/password.age b/provision/secrets/borg/torus/password.age
new file mode 100644
index 0000000000000000000000000000000000000000..0d96fea3b686b2097d4a7214407d79c72ebcd7ee
GIT binary patch
literal 561
zcmZ9_yRMU9007|QinE)E3~mIWT#JJddQO2-C_hjN-ME!fD3k*I3te<~^8uVqTpUc?
z-CT`>i<^Uq`T)kkz26IbL7L!686EpWn^onL>X;Iz5rRKMn`VnAF~zbY0p*s4IRfYg
zIBvL~gbcZm8`H%Y#k6!M?l^bsoU}YiPrdBLD~*yWWV1VhgWJkApX`D`p?55}1!@r`
zRn7*)ye?Ws4(St(X?NG#bRZf4(UL3MMxZo{5cPRG5Ji^wk~6R?U`JDp?~b8NI)S2N
zQy=lVnPs(05mZ{CMasxd^`*97bB4cSjY5@pi(Z6@uhcwqy)nEz01<Vvm9;1sel?IG
zCFc{@&YiJz$5b6ZCgFJ}#Ea2(qp7DYKuEuls1g*+;;eg7zqTmO5to<<4Cv63v#$0H
zo9Hk#75{pJk;<0<^=T^Sj|Vpwdbs1Pz3NFVoU*x_?{DLwRTVaz*;wQqC=y{LN-vp-
zXIpb!J_PFtX?O%Zt6>M#^I)f$VoMg^&Epy(IF6$uO`7R;oh><2PCeccNtNuynMn7d
zVrK$0VM^Yv1(5Y5^7^mbzW*EyFVpF_^ZhUK8{_%cn}1L9kMC}N{rLIk^7h5|5PS9b
Q-Usnh{qVt~;&S=@9~0NPGXMYp

literal 0
HcmV?d00001

diff --git a/provision/secrets/secrets.nix b/provision/secrets/secrets.nix
index 3aef6f06..75ac0b7b 100644
--- a/provision/secrets/secrets.nix
+++ b/provision/secrets/secrets.nix
@@ -21,5 +21,6 @@ in
   "ssh/kestrel/id_ed25519.pub.age".publicKeys = users ++ systems;
   "ssh/torus/id_ed25519.age".publicKeys = [ tstarr_torus ] ++ systems;
   "ssh/torus/id_ed25519.pub.age".publicKeys = users ++ systems;
+  "borg/torus/password.age".publicKeys = [ tstarr_torus ] ++ systems;
 }
 

From d84e57d9a2b39ef7d12439fd94d1a0f885cae7d8 Mon Sep 17 00:00:00 2001
From: Tyler Starr <starrtyler88@gmail.com>
Date: Sat, 14 Sep 2024 09:40:25 -0700
Subject: [PATCH 4/4] password-less login for rsync.net

---
 home/private_dot_ssh/config.tmpl            |   4 ++++
 provision/hosts/torus/backup.nix            |  14 ++++++++++++++
 provision/secrets/borg/rsync/id_rsa.age     | Bin 0 -> 4033 bytes
 provision/secrets/borg/rsync/id_rsa.pub.age | Bin 0 -> 1390 bytes
 provision/secrets/secrets.nix               |   2 ++
 5 files changed, 20 insertions(+)
 create mode 100644 provision/secrets/borg/rsync/id_rsa.age
 create mode 100644 provision/secrets/borg/rsync/id_rsa.pub.age

diff --git a/home/private_dot_ssh/config.tmpl b/home/private_dot_ssh/config.tmpl
index 0f158f45..9d3e7df7 100644
--- a/home/private_dot_ssh/config.tmpl
+++ b/home/private_dot_ssh/config.tmpl
@@ -1,6 +1,10 @@
 Host github.com
   AddKeysToAgent yes
   IdentityFile /run/agenix/git/github_personal 
+
+Host fm2120.rsync.net
+  AddKeysToAgent yes
+  IdentityFile /run/agenix/borg/rsync/id_rsa
 {{ if eq .chezmoi.hostname "kestrel" }}
 Host torus
   AddKeysToAgent yes
diff --git a/provision/hosts/torus/backup.nix b/provision/hosts/torus/backup.nix
index db3d3db3..392e95ff 100644
--- a/provision/hosts/torus/backup.nix
+++ b/provision/hosts/torus/backup.nix
@@ -20,6 +20,16 @@
     owner = "${user}";
     group = "users";
   };
+  age.secrets."borg/rsync/id_rsa" = {
+    file = ../../secrets/borg/rsync/id_rsa.age;
+    owner = "${user}";
+    group = "users";
+  };
+  age.secrets."borg/rsync/id_rsa.pub" = {
+    file = ../../secrets/borg/rsync/id_rsa.pub.age;
+    owner = "${user}";
+    group = "users";
+  };
 
   # Password-less login for user
   users.users."${user}".openssh.authorizedKeys.keyFiles = [
@@ -31,6 +41,10 @@
     Host kestrel
       AddKeysToAgent yes
       IdentityFile /run/agenix/ssh/torus/id_ed25519 
+
+    Host fm2120.rsync.net
+      AddKeysToAgent yes
+      IdentityFile /run/agenix/borg/rsync/id_rsa
   '';
 }
           
diff --git a/provision/secrets/borg/rsync/id_rsa.age b/provision/secrets/borg/rsync/id_rsa.age
new file mode 100644
index 0000000000000000000000000000000000000000..10337aa107eeb5270abafca64f1cfc37d4ba9be2
GIT binary patch
literal 4033
zcmZ9|_dgU40{~zn$;u|#Byn-)oHH`-vd#_btVnKhwi{MtuL~u6BobMXL?}^OM#_j#
zR#qr`WWDdt-@oAbd>#)nQH|(_4+;&SdHMUP`v;MM3=M8ILpdtdQ;kRfYiVid%He@Q
zK#+|b5O)<D=IukV0Na4*Kn*WXM|&Iy>TmBs(?**HdU(SaKp-r{7w=;4&5aBMV!;3(
zIL-nZYVL_bW6VrlD6~L7#~=a#3=9r|_(2ISRGKfAV)9=NibY#%*vO&$O#y)b5G}wI
z1M%<-2r@_5+aWOk48hg`j19c%;*SIeo0<k|0l`%65IZv+Z+mT$Q*aoFWMd1vilDoA
zX~TRF*dQz%?|}$23xrr}zyi=z@BeCMVL+-)u$(grj`T6n4P%h45O^C$oG!?RYytG3
zIR?_vKp+VLbM`aSAqAOwS%A2`7zBR;S(A>z(fv%XYKGt};Q$K=mf`Kku=Vyt5*$O}
zFc8^CM;8M5uLjXJ53@0mb0&tOLY$~T91I7h`8pA?XmXeq-4{%EG67?CQGT#M4AcU5
z)zKSE=C;>FITLlDNGF_MAP7bDpy~!AHEb-wzM62jhNA<WjKYyIL@MO}9skvW@s`?t
zHgX_;E5~3g#0g*>gmprhXqX|efB+jSkcO?l7SZ1aWoBhcBnD~GY{^t^sGVtmm$?f<
z$IBjPiGU%jX#r-QbRrH&wui%Pt_Ew^Lj8z7crr;#hg(feO^yQ423rT1>T1JiCLRzS
ze<y|yo#^cg4++7WK+tfSt&cNQ$CnmHboS<Mf5lY%Aa!njXa44*@i=sHRz6-l#^H>4
z%0z(5icw>DzlCB4IC83nS!vD>QPg|w?>tS)udOfh9*TZ;@A~z3a?=&3Gacj1W)eqj
z*6m~^0aM1OOF;doicE|C6^@^`y#8qIvX+G#Rls!?CmwaZ7xXGXLT%R%E};qaEjtA$
zggYCLnbixPJ0ZA#gI%D@mGw1UlV4a<kAJxqhkWvV8-~y?Hwl6Zoaz)$*W@{_oPaAa
zN)#fVbM%yC0P~knTO+gM*O`^&$~A?z9e1PzcEyeQcP#b(O>RD;x`t7nD^E2jZ*#&H
z^_dkc$s*(D8>yi<XXsh<Soh9q#^x+MyX@;{E@`&Ue5yA~x&V0Ig`@AO@hK_#`UNCE
zmEJe%0oUw?YKy|%d_5{TWji<%KIS|*+|*8f@yM<v{PYA3Iu3xa;t^Yt%3r!}%g8){
z9et=Z@cnuBhOT5w?i)@UnAQ8JfuiQg6TL1+#oULgvY|^K<)heq1&nJF1&h4)2zpJ`
zEN?rLSSCX2lVm8FZI1O47qI-fr7g(aiCcFikK-O|M!ptfQ+FQ|ET0R%p9l+FYjErJ
zDA|9RuE9P2YT)|^5k<3KHbuQ99~d;@uU08ubM+rabe0z-)-KFhiy5?u0DpJ?=Dp~b
zwkuP-#}O@dU8qy^c<OC8=czNY_wU%<ztjA>nj-U<T6gdL5}@d>Vf6G&YMg+g=RL5}
z^(}jjJmm<iUl!pJrgoEkk*U@tRAtG(aKBpS5FQ%ac)FJnFK|U`#KAxe+sItbGt-Ma
z+VjpqNoF!M+(#PiKDm60KK=sKXgh9pm+uyBUU6l<+vAgc#DO=c<E#)QlFMGsfobiZ
z?+!rD5#ly0zRosfMGEayErApBhmOk?5`T*e<?ua{wBouEo#)2L!M$t9%EwDoQli~F
z*~_M~44{V_0@^UX?%fPlZz0lJPxPO5FSHEruPa^2%u6a*7ADGE!>ZMv<6DKbk@C%^
zxFP$sOsS&r2a~zdMTC8mE^xpCAbvDk(KGYZzUHGGXh!2l*ML|b+50=1E8H1n;52&0
z7R97^AM=$0Ja;&DrQGgkukA#vFHv@L^6;P4o8Zobzf2kHMAWxl)UBpV!OFV|l^x}F
zo9L_kzORQX=|bWS7!4-8wiJ=1ng6Bm0!<YC?&M!~Q+(Cn<eZXop>5KS0Y#P5QPIT|
zm5Iw|%YEOVm#-{%x#7yA2a`MWi;4WmClY~xEx>V5dLFgA75e78Ig5zv<`>2a=|c<;
z?}2-%{TW{QXH)(Mo5R;So+`n)qAlki!(tK&&A(;I-v?)#J6D&7yB!we6Wu}HT-G@T
za}!$-vOrOI8XK6INHagk`J;97YwZfJ!schqp}=_<+KyHJ9pZ<}UHk0y7d*t@@3>E@
z6Sl9|fmmNh@FV6<b^62WW|}bXRePOF{;|s81&7?O_iKpqyf}i_W6CL^9Y^5~joVcz
zZrtgw!x^tU*6VW%)_VIo6ZbTT26Zhd4MsSVTE)y(P9EtU9FMb|m&(ZAw1CkLn%`5D
zwwpAr_=Zb={sV^P*Z1ESeyy(D;}<mhq+;9=xDzdxj=nOME4Lmo`Tccly5JwT#HW<u
zZi>KjgMaCgWUEtYgw%nl1(#*Kz;os<+jvtEHh%U9gG^}@wh~q9PSR~<OM}#Oh@stT
zv)u&U=xH74&O<)Y6bYQhnN&XeTfsrK5x4isxg4KbMYLvJdnD_6lGVTFg{fQOY^?>m
zKcFV1)mzEm$oK61h^@(6AA!7?mol3kYP>!<5$m#@YLsZ{+B0AQZ1XUzrLRZ+p>isc
zZdZi0QFmhv_k!be-(EdNtcjQ^eoc0b+g1+h4=>{b=&P1-LhR%yd4hUvNuS&Kdary;
z{@d-fY?hjSF@a1x3;CO{zq<BQ72q^-_xtRvf)9+WhkH4P;w^szi=~>Lt)Bg7;rS#m
zRTs)Z_U71^=t+G@pGcA+QR4&>s(-9e6V57M@~J4ASQCtXuQsk85zsj<o>6_cs8eL;
zM^<Y!E~Ghi3s<jC{I)x~2piJezCFHsqMz)(p_Oy<-gHk!tp3=ukd$uxl1<;~4;Q6Z
zWR!69w1n^r&a2B^ZzmUo7Ud|GUMJzAcWg)!TUGk6ZrNS^`1EI_to3L`v*QF{j#?<@
z@Zq7akOke4EZko#k>`#X(0l!<!ztfdSg`9>!@#uy#pH`xfKwumS8N})es_vHosTF;
zI%66xm@wS;@VYSvME>UO^M^c9@Xo1|boQAt-6qRAJJs65v&^7!I;1J%CFi9S=+f~<
z-XRMJ8C@*&;8(4pj@-P<Ht+fM(pb7;O)*F#mDJQ-qUyh`HvOlSr+e|%{DUOhdbvrD
zP~qIM2q#oov)OoP`=;g@r21EPEnoK33zLIc`UJ|L>s-Dz+IUPP&TJW*N0#i^=vmw4
ztGjgiaazLK<i#4#LCc3f*}b-(mlW*hJh>Co#Tr-ZNbYf+Tl-QZ-iT0tQ!G2L96YnH
z97N(D4()0oMcr>3FV-u3%Gf|JmFBZ<3>+NV@LneN-u2zv=#oDd!K55H^0Ml0ESE&%
znR^Uovf@~-LgjZBShI2Fs#d7<EyFu?OZbd|M`oksYv0aKp1Z|O>wbKXq{r*pFd9Vr
zez)jjm_izNyYWGV_K;+4<tgE&(I<0*?ZmT{{C!W7)WR&j)&oIun72u92aYCC35l!s
zEC_<?fPj^6Q4)1ue7e^S9kauQ`ZZrP>2du@C1E*FNAApY7+)}m5c&4wvTAz$H`GbG
zp<$0?uv4SA(oo`llhLu0jf!pD4Q7<6cG4vz6PL3BBu?LEBL|fq!^-wJst+9;MxGuT
z1ZQ!#S58&vuUHwy9G&N{Tg)~AI@pwXk1Ym1bvt*1&zHjLtE<BO`3mID-I4eELk(<%
zQqBZtCOsR_-B3}YP$h1DA(Q>7W-<SJX)#<@3i}T_j~8+sO7~3>7RqD~0LY#f?@-5A
z#f?ZkP-kdXd`2Br6l$|_t$cLiuu_l84CftHu6~$L+syj*;DvDPh(qTAZ^1mLV@~*L
zuElTh8>4-+CZESPjwk!23ajl$jjFTkB<PL_7yqed^T7~gU~r$SnLh*8&ncE3brR7<
z8qD?9l{zEVLe5BNmR!KS|84bHHB4*Bu&_lgVihFStX}m@k<}$J0*Qyq8hvWDJz3{S
zmvRaNguP6aVt#R45M8~p-wIRGu>JFHlsj_crC#a}N%TtgBS{W0e_Q7A)7OTi7}Usu
z<)+@gQoPsaOS%vGFUpcELIY#EMe@!;+k2#+AdTp2F<h+2p`Cr2p^SeHcN8Pyuy-;g
zTT|qolQu6kzxqWAy*FmJ&fBxGlQ8vlm@+#(uTDM|A)1$VPL)S-i5}F5!%TaAP4k&#
znP0>38n2tL-sc+WYUAT%zrCf=PBInbZ(oA3NY=a<KFbptM{u*&6dn{2s~UXL72L$;
z=jVE4*S%wIxODx%Jbu#IOEg`&89^1FYksTW>g2%FM>Rmk)GiMTVL8OCT6#IM!OkO;
z9;KuV+iz+vN!PZ3IP9!UCj;8sg9+S~+A11pkGZ)P-CGmAES%7N_I|{<h8+|BzF}4I
z+-0RclY1X}S)|2vFZfy1n&U2l3JIL=q(^?~%pBymjKq~@IYITi+5eiQv!QTu?QGB2
zZ3t$jIoVc*RO=AT=I(@ic|zvw&sRMU5i`pd&*ingM8(S0imPAwt!8fNQp*+|tB`VI
zeFZe*d5u79Qkf}ixk!j~Z&HaQxxYJg#=XBYwYoFSB>qpgUD0L9e1!`?aN(3G(ORke
z2cN8uUl(-749ou>Pqv+wi8}N#Oi8&m>1}RXqKyes9-UX+cI{>Gsf@mtXFU&}G&m3(
zr!y9fk!|AWjC6M5<_{(D+Ik*%B$;Yl%IRy+dlAA@vvJ$_Cg_PZY5s9+vNOxtR;BRT
z_gNL$*e35brbv<`{i=B&^2YPrFeq&Wy`etcrD8Hxf0TATzKu}835{1Rg%l7!7lu_Y
z&E`AIl(Os*B!0;p6!&Fc<}Jb_3!m{+W*cpckGbFLmjpCyLTW5OP7EzxK3}|us@RXJ
z{jBiA5K?9P>H+>4pDE5LFD1t*E4pSOyVy>uoc+_ab;x-i)2MfiQ7cWVOX1Q3+&Kcl
z?9<muu9jyIM`gF^5h+>G>&~9;d%&ubiXaBc@2=mM@=D4AkF=6jjfqnoc26QB^0}&J
zS96LYxCV{q^K*#@eCxEFf9Xqj;g2@dmYYRBeoQ~F7{&lyr~(Sae4hUo(w|=iu!_3!
z6yd>_P;)o}O{}bXgN+Mjo^P~Vk55d?G}^j}K0&LBer+gf4n14sg^3#wZcH0U|Dp7C
zvmoFf=b%3SjDe6*KJ9wk&yN(!--1HZI@Nc_Ia9-W2_}&Urs+B{<(|>AmuU)0U)~<`
zE*Dm_^Do-}30Yzlz>RMoes_=<Egq{+-vXRT`Xt}AKuUR`yDzdI&g@IzT^hHa4;Jfs
Y1#phs!aUnbLZZjptN=X2I)1zV13c|;GXMYp

literal 0
HcmV?d00001

diff --git a/provision/secrets/borg/rsync/id_rsa.pub.age b/provision/secrets/borg/rsync/id_rsa.pub.age
new file mode 100644
index 0000000000000000000000000000000000000000..b3ec7c0b113cb0da6f27630a94d3059cae6d6046
GIT binary patch
literal 1390
zcmZY4`A<^^007{Dx&dA&Ljj4FOJx;bU+-6=SlZJ2gq~BReJzFF_iH;8Q3);%Hi2ac
z43)4gDquv#c_6D1PzMHvG8IIoRw6Kr2n!%6+t2PV`0}asx-^{ycKB?r0;^@a)u9JG
zU_{z3l+&4?rqf~x1Q0^OfCIpYQ3`<$c4jj`y3ekr+34(SzJ;%|IV@a-hJn$GIeJ*a
z%<{9zLL3r-Ll8C5-~vT{ffQ|Wfrx=CP(l_!Z1=z}w1F;QcoZ135_W0WA8SOZKm>|W
zRz6WJ5VNFKw_0ZBvp|wj!gA^uWW1Cu!+G<J4z$_>;cRrF1&*-FO<oaJW(RFHc81B7
z&jK(eKn=5)R2;*f?{&gF0ZDE4VA!7jX_<b&DMnDdOuO9yqK$G`s6#{w2+zp0f#Q4!
zBzZtNsMY8}P)5gMRrySQgiqi@yR8fd4^Nfgg&v{}r?9zQ(tHSG2BZZ%4nZtJoPIeC
z6yiU=;Ym!tn2IuCsXPmdqeAk0TDghF_dET3B>|m5@DuV>WWI@x6(Vja6|u9d5qh6T
zY;Z~os0dr5g@hV5EKw2ZM1Zem!5)X!!Nt?*8Ye>6x|APl2+Sr~#3;7Y2m=;aXYm-J
ztO6H85D7Fc6=2qph<=)y$d@ri<UF@pjAZa5sJJX4nGIN67At|t<uMc*GmYjGU|dXc
zrpkx0`{a2_j*pq4%lhw@mWIOkj2=OjB-1Y_Kx4oHt=B2kYjjYS8t;UNTC<z1!jbcs
znmjz29r2;L`LrUm44YJfC`jd<KdyWi+;S(M8sk=UCKaqeDD{JZTmR%#o!jd`1;-~t
z6Q8D-D=Xerw{ARjd&l)Nsz3r~NdC49x>09{J9xiu2%QnRI@$anS^73)?CGIjZKj<I
zwH^Cu{+3g(9?NpVS@D;mpBO*e`GGOIb!bCzaIsEUc%a_c5?8vdsOX4zV~2Nh?;HF1
zc`R5fdox_o7Z0tF_Z#P8L#GQL*QJBmtLZUchW4L0zwUWz_Yc2kjF9@YG2ot(ii_B>
z$06ly2KhiErH0D%W6mUv#GG#P%IAdXw@H10&`GLeXJB!jnqaSw<=n5zl=<eCo(Yc$
ze)AF?SK{RhI@^c21K%aiH}3B$`a*K2o_;vYSMyhB$GY*+4L@C+={a<3pnJ$)b#lk1
z9dY|Q&C*Acb>qP6sML_DM5zy)5Y)Ex_^-uYfWjJUbKhS_mp2>Z&`p-~nyFg+o7cz7
z$_&?!zPNW^x%tVOmlLRcRpGm<k6jV&i9D2=vvoCRK0tlTE9?bI12TK`DiR@5q8}l$
zcg(fgTABBhH)j*OM^(Rkn$o<t@cR%69WZ{ft0k2hR#Y=z(w)JXGMg?|t)W20{Bc&`
zKu&8{&~1$$jX@*tjOWS|qf>gPq1cmm*?WdJzJjNIelRjHcX(B0N<b5nIY!}JUB*4y
z+VO<vF-;`&KhuN&m1E|x+35>knS#%^-H7U3e1GD^#AWO=)Lp^SOV0+|-OA1E8gWX)
zNfuo3+};!}I(inrgrfZLn!9dcRZCb@@a66;$6cI`mB-q+rH#;9_hCn2L-GcQSbab~
zP_n6`Bv^#&nN2P3)jS%^m8Tq`T~43VM*Tr&_AOQ`q)iFerYdKzwwFyd^e=p#n2Sy>
zjieMWTL$|6jLtoap2?ytZ@hB~J~-e4*8i3?y*|EU;o%GA+H>FX84q)pQ;l7JKYg{`
zFjJVF?sybjf2HBZAQoqDBMlBO@NZUm@nh`?J&w`$S5G&=GlnHr%GXy6q@^MHe*u}*
BMNR+!

literal 0
HcmV?d00001

diff --git a/provision/secrets/secrets.nix b/provision/secrets/secrets.nix
index 75ac0b7b..865f6230 100644
--- a/provision/secrets/secrets.nix
+++ b/provision/secrets/secrets.nix
@@ -22,5 +22,7 @@ in
   "ssh/torus/id_ed25519.age".publicKeys = [ tstarr_torus ] ++ systems;
   "ssh/torus/id_ed25519.pub.age".publicKeys = users ++ systems;
   "borg/torus/password.age".publicKeys = [ tstarr_torus ] ++ systems;
+  "borg/rsync/id_rsa.age".publicKeys = users ++ systems;
+  "borg/rsync/id_rsa.pub.age".publicKeys = users ++ systems;
 }