OpenEBS

.gitignore

@@ -1,12 +1,5 @@
-k3s-cluster-config.kubeconfig.yaml
-*.agekey
-
-.terraform
-.terraform.tfstate*
-terraform.tfstate*
-.env*
-
 *.tmp
 *.log
 *.key
 .secret*
+tags

.pre-commit-config.yaml

@@ -1,9 +1,7 @@
 repos:
 - repo: https://github.com/k8s-at-home/sops-pre-commit
-  rev: v2.1.0
+  rev: v2.1.1
-  hooks:
+  hooks: [{id: forbid-secrets}]
-  - id: forbid-secrets
 - repo: https://github.com/zricethezav/gitleaks
-  rev: v8.6.1
+  rev: v8.8.11
-  hooks:
+  hooks: [{id: gitleaks}]
-    - id: gitleaks

ansible/build-k3s-cluster.yml

@@ -1,119 +0,0 @@
-- name: debug stuff
-  hosts: all
-  tasks:
-    - name: set token fact for k3s-nodes hosts
-      run_once: true
-      with_items: '{{ groups["k3s-nodes"] }}'
-      delegate_to: '{{ item }}'
-      set_fact:
-        fake_hostname: '{{ hostvars[item]["inventory_hostname"] }} for {{ item }}'
-
-    - name: debug token fact for k3s-nodes hosts
-      run_once: true
-      with_items: '{{ groups["k3s-nodes"] }}'
-      delegate_to: '{{ item }}'
-      debug:
-        msg: '{{ hostvars[item]["fake_hostname"] }} for {{ inventory_hostname }}'
-
-- name: install k3s on k3s-nodes
-  hosts: k3s-nodes
-  gather_facts: yes
-  roles:
-    - role: k3s-node
-
-# TODO: ensure odd number of k3s-control-nodes hosts
-
-- name: intialize k3s cluster on first control plane node
-  hosts: k3s-control-nodes[0]
-  tasks:
-    - name: create config directory
-      file:
-        recurse: yes
-        path: /etc/rancher/k3s/
-        state: directory
-        mode: '0700'
-
-    - name: copy initial config
-      become: true
-      copy:
-        src: ./templates/k3s-initial-server-config.yaml
-        dest: /etc/rancher/k3s/config.yaml
-
-    - name: run initial k3s server
-      become: true
-      ansible.builtin.command: systemctl enable --now k3s
-
-    - name: fetch token
-      become: true
-      slurp: 
-        src: /var/lib/rancher/k3s/server/node-token
-      register: slurped_k3s_node_token
-
-    - name: set token fact for initial node
-      set_fact:
-        k3s_node_token: '{{ slurped_k3s_node_token.content | b64decode }}'
-
-- name: configure remaining nodes
-  hosts: k3s-nodes,!k3s-control-nodes[0]
-  gather_facts: no
-  tasks:
-    - name: debug info
-      ansible.builtin.debug:
-        msg: '{{ ansible_facts }}'
-
-    # - name: debug token fact for k3s-nodes hosts
-    #   run_once: true
-    #   debug:
-    #     msg: '{{ hostvars[groups["k3s-control-nodes"][0]]["k3s_node_token"] }}'
-
-    - name: set token fact
-      set_fact:
-        k3s_node_token: '{{ hostvars[groups["k3s-control-nodes"][0]]["k3s_node_token"] }}'
-
-    - name: configure k3s server with token
-      lineinfile:
-        path: /etc/systemd/system/k3s.service.env
-        state: present
-        line: K3S_TOKEN={{ k3s_node_token }}
-        create: yes
-
-    - name: configure k3s agent with token
-      lineinfile:
-        path: /etc/systemd/system/k3s-agent.service.env
-        state: present
-        line: K3S_TOKEN={{ k3s_node_token }}
-        create: yes
-
-    - name: create config directory
-      file:
-        recurse: yes
-        path: /etc/rancher/k3s/
-        state: directory
-        mode: '0700'
-
-    - name: configure k3s server endpoint
-      lineinfile:
-        path: /etc/rancher/k3s/config.yaml
-        state: present
-        line: 'server: https://{{ hostvars[groups["k3s-control-nodes"][0]]["ansible_default_ipv4"]["address"] }}:6443'
-        create: yes
-
-    # TODO: assert token is valid?
-    # - name: debug info2
-    #   ansible.builtin.debug:
-    #     msg: '{{ k3s_node_token }}'
-    # TODO: wait for initial control node to come up?
-
-- name: start remaining control nodes
-  hosts: k3s-control-nodes,!k3s-control-nodes[0]
-  tasks:
-    - name: run k3s
-      become: true
-      ansible.builtin.command: systemctl enable --now k3s
-
-- name: start remaining agent nodes
-  hosts: k3s-agent-nodes
-  tasks:
-    - name: run k3s
-      become: true
-      ansible.builtin.command: systemctl enable --now k3s-agent

ansible/inventory/hosts.yml

@@ -1,20 +0,0 @@
-k3s-nodes:
-  hosts:
-    "root@10.0.0.87":
-    "root@10.0.0.138":
-
-  vars:
-    ansible_python_interpreter: /usr/bin/python3.10
-    k3s:
-      version: v1.23.3+k3s1
-
-k3s-control-nodes:
-  hosts:
-    "root@10.0.0.87":
-
-k3s-agent-nodes:
-  hosts:
-    "root@10.0.0.138":
-
-  vars:
-    k3s_command: agent

ansible/k3s-node/.travis.yml

@@ -1,29 +0,0 @@
----
-language: python
-python: "2.7"
-
-# Use the new container infrastructure
-sudo: false
-
-# Install ansible
-addons:
-  apt:
-    packages:
-    - python-pip
-
-install:
-  # Install ansible
-  - pip install ansible
-
-  # Check ansible version
-  - ansible --version
-
-  # Create ansible.cfg with correct roles_path
-  - printf '[defaults]\nroles_path=../' >ansible.cfg
-
-script:
-  # Basic role syntax check
-  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
-
-notifications:
-  webhooks: https://galaxy.ansible.com/api/v1/notifications/

ansible/k3s-node/tasks/aur.yml

@@ -1,58 +0,0 @@
-- name: AUR | get package metadata for {{ pkg_name }}
-  connection: local
-  become: no
-  uri: >
-    url=https://aur.archlinux.org/rpc?v=5&type=info&arg={{ pkg_name | mandatory }}
-    return_content=yes
-    timeout=6
-  register: api_info
-
-- assert:
-    that:
-      - api_info.status == 200
-      - api_info.json is defined
-      - api_info.json.type == 'multiinfo'
-      - api_info.json.resultcount == 1
-      - api_info.json.results is defined
-
-- name: AUR | download tarball for package {{ pkg_name }}
-  become: no
-  connection: local
-  get_url: >
-    url='https://aur.archlinux.org{{ api_info.json.results[0].URLPath }}'
-    dest='/tmp/'
-  register: aur_tarball
-
-- name: AUR | cleanup old {{ pkg_name }} builds
-  ansible.builtin.file:
-    path: /tmp/{{ pkg_name }}
-    state: absent
-
-- name: AUR | upload and extract package {{ pkg_name }} tarball to host
-  become: yes
-  become_user: '{{ makepkg_nonroot_user }}'
-  unarchive: >
-    src={{ aur_tarball.dest }}
-    dest=/tmp/
-  register: extracted_pkg
-
-- name: AUR | get dependencies and build package {{ pkg_name }}
-  when: extracted_pkg.changed
-  become: yes
-  become_user: '{{ makepkg_nonroot_user }}'
-  command: >
-    makepkg --noconfirm --noprogressbar -mfs
-    chdir=/tmp/{{ pkg_name }}
-  register: aur_makepkg_result
-
-- shell: 'ls -1 /tmp/{{ pkg_name | quote }} | grep pkg.tar'
-  register: compiled_package_name
-
-- name: AUR | install {{ pkg_name }} with pacman
-  when: aur_makepkg_result.changed
-  become: yes
-  shell: >
-    pacman --noconfirm --noprogressbar --needed -U {{ compiled_package_name.stdout | quote }}
-    chdir=/tmp/{{ pkg_name }}
-  register: pacman_install_result
-  changed_when: pacman_install_result.stdout is defined and pacman_install_result.stdout.find('there is nothing to do') == -1

ansible/k3s-node/tasks/create-aur-builder-user.yml

@@ -1,9 +0,0 @@
-# source: https://wiki.archlinux.org/title/Ansible#AUR
-- user: name=aur_builder
-
-- lineinfile:
-    path: /etc/sudoers.d/aur_builder-allow-to-sudo-pacman
-    state: present
-    line: "aur_builder ALL=(ALL) NOPASSWD: /usr/bin/pacman"
-    validate: /usr/sbin/visudo -cf %s
-    create: yes

ansible/k3s-node/tasks/install-aur-helper.yml

@@ -1,15 +0,0 @@
-- name: Check if AUR helper ({{ aur_helper_pkg }}) is already installed
-  shell: pacman -Q 2>&1 | grep '^{{ aur_helper_pkg }} ' >/dev/null 2>&1
-  register: is_aur_helper_exist
-  ignore_errors: yes
-
-# - name: debug is_aur_helper_exist
-#   debug:
-#     msg: '{{ is_aur_helper_exist }}'
-
-- name: install AUR helper ({{ aur_helper_pkg }})
-  include_tasks: aur.yml
-  when: is_aur_helper_exist.failed
-  vars:
-    makepkg_nonroot_user: aur_builder
-    pkg_name: '{{ aur_helper_pkg }}'

ansible/k3s-node/tasks/install-k3s.yml

@@ -1,10 +0,0 @@
-- name: download k3s installer
-  ansible.builtin.get_url:
-    url: https://get.k3s.io
-    dest: /tmp/k3s-installer.sh
-    mode: '0777'
-
-- name: run k3s installer
-  become: true
-  ansible.builtin.command: >
-    env INSTALL_K3S_EXEC={{ k3s_command | default('server') }} INSTALL_K3S_SKIP_START=true INSTALL_K3S_VERSION="{{ k3s.version }}" sh /tmp/k3s-installer.sh

ansible/k3s-node/tasks/main.yml

@@ -1,9 +0,0 @@
-- include_tasks: ./prepare-host.yml
-- include_tasks: ./install-k3s.yml
-
-# TODO: rpi4 loadbalancer? haproxy? metallb?
-
-# TODO: generate secret
-# TODO: start first control node
-# TODO: start remaining control nodes
-# TODO: start agent nodes

ansible/k3s-node/tasks/prepare-host.yml

@@ -1,23 +0,0 @@
-# arch linux
-- include_tasks: ./create-aur-builder-user.yml
-  when: ansible_facts.os_family == 'Archlinux'
-
-- include_tasks: ./install-aur-helper.yml
-  when: ansible_facts.os_family == 'Archlinux'
-  vars:
-    aur_helper_pkg: paru-bin
-
-- include_tasks: ./upgrade-all-packages.yml
-  vars:
-    aur_helper_command: paru
-
-# TODO: is per-node host-level time sync necessary?
-
-- name: install necessary utilities for longhorn
-  when: ansible_facts.os_family == 'Archlinux'
-  community.general.pacman:
-    executable: 'paru'
-    name: 
-      - nfs-utils
-      - open-iscsi
-    state: present

ansible/k3s-node/tasks/upgrade-all-packages.yml

@@ -1,8 +0,0 @@
-- name: upgrade all packages
-  when: ansible_facts.os_family == 'Archlinux'
-  community.general.pacman:
-    executable: '{{ aur_helper_command }}'
-    force: yes
-    state: latest
-    update_cache: yes
-    upgrade: yes

ansible/nuke-k3s-cluster.yml

@@ -1,30 +0,0 @@
-- name: purge k3s from k3s-nodes
-  hosts:
-    - k3s-nodes
-    - k3s-control-nodes
-    - k3s-agent-nodes
-  become: true
-  gather_facts: no
-  any_errors_fatal: true
-  tasks:
-    - name: Kill k3s
-      ansible.builtin.command: /usr/local/bin/k3s-killall.sh
-    - name: Uninstall k3s
-      ansible.builtin.command:
-        cmd: /usr/local/bin/k3s-uninstall.sh
-        removes: /usr/local/bin/k3s-uninstall.sh
-    - name: Uninstall k3s agent
-      ansible.builtin.command:
-        cmd: /usr/local/bin/k3s-agent-uninstall.sh
-        removes: /usr/local/bin/k3s-agent-uninstall.sh
-    - name: Gather list of CNI files to delete
-      find:
-        paths: /etc/cni/net.d
-        patterns: "*"
-      register: files_to_delete
-    - name: Delete CNI files
-      ansible.builtin.file:
-        path: "{{ item.path }}"
-        state: absent
-      loop: "{{ files_to_delete.files }}"
-

ansible/requirements.yml

@@ -1,7 +0,0 @@
-collections:
-  - name: community.general
-    version: 4.4.0
-  - name: community.sops
-    version: 1.2.0
-  - name: ansible.posix
-    version: 1.3.0

ansible/templates/k3s-initial-server-config.yaml

@@ -1 +0,0 @@
-cluster-init: true

cluster/base/cluster-secrets.sops.yml

@@ -1,32 +0,0 @@
-hello: ENC[AES256_GCM,data:WRa2G/VPbEab7pAWaJe58iMxMQ3k0pW671e73eaY5MdAUxJDRmijcIi267IDGg==,iv:LGpJ15ogFuvGJBwh3cfHGThct/DKiiUfGi8Kn4biV+M=,tag:LpuYBCVw7ht39qEgcgfJqw==,type:str]
-example_key: ENC[AES256_GCM,data:3cOB2ySdABOvn3yhkg==,iv:bMTUp1WXDHuLDqrAbR5NIzVHHUw746OMeXoEZ6aWAow=,tag:sRA2h8aRJNwNXFrMdanGzw==,type:str]
-#ENC[AES256_GCM,data:dP+/OZYhivb7M7v7tBGC7g==,iv:epJJoKQ8Xv4g5Aa4jYXvMuYtiNhXBg/XIBD35ut+AKY=,tag:+fjSkV3k+Fv89v++wnG2kw==,type:comment]
-example_array:
-    - ENC[AES256_GCM,data:v+Eim64hePvfKUR29Yk=,iv:l/do6zgAy8MIc7x7lyb9kj/29V0V4yFDA0vWsYG16tM=,tag:pKrUwUPDM3/xzzKT+pThMg==,type:str]
-    - ENC[AES256_GCM,data:jfgUnbtQEyYb1kJSLbE=,iv:ELDLS+72aIZuSwHnfD697bP6N7mHJ3iaLRWj+6FSSQw=,tag:ZHxguigP5FWPOEzUcKtHaQ==,type:str]
-example_number: ENC[AES256_GCM,data:H37w/XGwzcdSHQ==,iv:z74bRD6gmVJr9NAcPRmjjPmZ7X1WEpBSAV/gzWesBgg=,tag:Nrk9CwNQXEPvaoK6lC3DJg==,type:float]
-example_booleans:
-    - ENC[AES256_GCM,data:8xXjdA==,iv:n0vwMOb2Eu8dE6ca1ycdgrML1UKOY9Gl1RTgIJ+bfGw=,tag:Rgit1wPAQ+YSQmffEn7/sw==,type:bool]
-    - ENC[AES256_GCM,data:JBUqSeg=,iv:VM4SqHzVUlW93aEebiaLIzr1loJV6uFELoPGAZyNiBY=,tag:U/JIvS+gwb8HjfeenajCMw==,type:bool]
-    - ENC[AES256_GCM,data:cPLgZDwCKwrGJKFSFELcqeg5BQWz2g==,iv:JlWnjRLm971L8IUg71yr2HOJzV6V0xz6oPe6sScGchk=,tag:r+AgykXqD9nNwaOl+NlQfA==,type:str]
-example_name: ENC[AES256_GCM,data:9EQWrTyojQ==,iv:/tgGPH/v49bHW3Vh4qwr2OARBiJTyxNJ//rs9l8p83E=,tag:qqyZ9cP3a/1pko9DoWZyRQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1a8v4ac7l20vly3838el7f4m7t9nt56tlxznzv084ulpltw6k7vyq9gh49q
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBERGxGRXF5OVJLV0RKTDZF
-            UGw0UTBJWWFmVlkraEQyZDZEaXlqdmhUUFZFCjBvSDJWWEhyZEdWR3lLYzQvQ013
-            TzJVVWhQVkYxYUxqOWNxTWRZeHJZN00KLS0tIGhzblZkRmtBeDNJYldKZVBUQTU3
-            Mi9lVkRDNFBrNDNISFIwckFXLzBaQ0UKCjkMUhXLn6IO5aC6At37a+TmVFt09sXa
-            g4hod4hBGGtgEbPi/uCgCMme/E59eLvs6xyhXvJY12PYYdC+xlTu0A==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2022-02-08T03:51:26Z"
-    mac: ENC[AES256_GCM,data:bNXbabUuJD/l6Ab+pjDNZzBU45I1vB9CYhrq6NQ5x6RIjw6gwpSNAjQHFiNwWq9BvRXhuSfbqlNw3F8QjOXO5EOyOwh6BZMvGBEZPB6MQXvhjqmOiBWjuvpmDIIBqj2qPldReQHhyoQ7HLN4LRjNd1vw34GCgcgvjv1Df21eOuQ=,iv:gL7Yt9a5f9ChUFPR1qjmKk25Re02kbxdTEK2qmxYZ0s=,tag:K7MjVm4BWEfOQdi7TV7psg==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.1

cluster/home/default/my-nginx.yml

@@ -1,37 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: my-nginx
-  namespace: default
-spec:
-  selector:
-    matchLabels:
-      run: my-nginx
-  replicas: 2
-  template:
-    metadata:
-      labels:
-        run: my-nginx
-    spec:
-      containers:
-      - name: my-nginx
-        image: nginx
-        ports:
-        - containerPort: 80
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: my-nginx
-  labels:
-    run: my-nginx
-  namespace: default
-spec:
-  allocateLoadBalancerNodePorts: false
-  type: LoadBalancer
-  ports:
-  - port: 8000
-    targetPort: 80
-    protocol: TCP
-  selector:
-    run: my-nginx

cluster/home/flux-system/gotk-sync.yaml

@@ -1,27 +0,0 @@
-# This manifest was generated by flux. DO NOT EDIT.
----
-apiVersion: source.toolkit.fluxcd.io/v1beta1
-kind: GitRepository
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 1m0s
-  ref:
-    branch: master
-  secretRef:
-    name: flux-system
-  url: ssh://git@git.lyte.dev:2222/lytedev/k8s-clusters.git
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-kind: Kustomization
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 10m0s
-  path: ./cluster/home
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system

cluster/home/longhorn-system/0namespace.yml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: longhorn-system
-  labels:
-    name: longhorn-system

cluster/home/longhorn-system/longhorn-helm.yml

@@ -1,32 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1beta1
-kind: HelmRepository
-metadata:
-  name: longhorn
-  namespace: longhorn-system
-spec:
-  interval: 20m
-  url: https://charts.longhorn.io/
----
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: longhorn
-  namespace: longhorn-system
-spec:
-  interval: 20m
-  chart:
-    spec:
-      chart: longhorn
-      version: 1.2.3
-      sourceRef:
-        apiVersion: source.toolkit.fluxcd.io/v1beta1
-        kind: HelmRepository
-        name: longhorn
-        namespace: longhorn-system
-      interval: 20m
-  install: 
-    remediation:
-      retries: 5
-  upgrade:
-    remediation:
-      remediateLastFailure: false

helm-charts/chart/.helmignore

@@ -1,23 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/

helm-charts/chart/Chart.yaml

@@ -1,24 +0,0 @@
-apiVersion: v2
-name: chart
-description: A Helm chart for Kubernetes
-
-# A chart can be either an 'application' or a 'library' chart.
-#
-# Application charts are a collection of templates that can be packaged into versioned archives
-# to be deployed.
-#
-# Library charts provide useful utilities or functions for the chart developer. They're included as
-# a dependency of application charts to inject those utilities and functions into the rendering
-# pipeline. Library charts do not define any templates and therefore cannot be deployed.
-type: application
-
-# This is the chart version. This version number should be incremented each time you make changes
-# to the chart and its templates, including the app version.
-# Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.0
-
-# This is the version number of the application being deployed. This version number should be
-# incremented each time you make changes to the application. Versions are not expected to
-# follow Semantic Versioning. They should reflect the version the application is using.
-# It is recommended to use it with quotes.
-appVersion: "1.16.0"

helm-charts/chart/templates/NOTES.txt

@@ -1,22 +0,0 @@
-1. Get the application URL by running these commands:
-{{- if .Values.ingress.enabled }}
-{{- range $host := .Values.ingress.hosts }}
-  {{- range .paths }}
-  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
-  {{- end }}
-{{- end }}
-{{- else if contains "NodePort" .Values.service.type }}
-  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "chart.fullname" . }})
-  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
-  echo http://$NODE_IP:$NODE_PORT
-{{- else if contains "LoadBalancer" .Values.service.type }}
-     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "chart.fullname" . }}'
-  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "chart.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
-  echo http://$SERVICE_IP:{{ .Values.service.port }}
-{{- else if contains "ClusterIP" .Values.service.type }}
-  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "chart.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
-  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
-  echo "Visit http://127.0.0.1:8080 to use your application"
-  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
-{{- end }}

helm-charts/chart/templates/_helpers.tpl

@@ -1,62 +0,0 @@
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "chart.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "chart.fullname" -}}
-{{- if .Values.fullnameOverride }}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- $name := default .Chart.Name .Values.nameOverride }}
-{{- if contains $name .Release.Name }}
-{{- .Release.Name | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "chart.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Common labels
-*/}}
-{{- define "chart.labels" -}}
-helm.sh/chart: {{ include "chart.chart" . }}
-{{ include "chart.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "chart.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "chart.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
-{{/*
-Create the name of the service account to use
-*/}}
-{{- define "chart.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create }}
-{{- default (include "chart.fullname" .) .Values.serviceAccount.name }}
-{{- else }}
-{{- default "default" .Values.serviceAccount.name }}
-{{- end }}
-{{- end }}

helm-charts/chart/templates/deployment.yaml

@@ -1,61 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "chart.fullname" . }}
-  labels:
-    {{- include "chart.labels" . | nindent 4 }}
-spec:
-  {{- if not .Values.autoscaling.enabled }}
-  replicas: {{ .Values.replicaCount }}
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "chart.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "chart.selectorLabels" . | nindent 8 }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "chart.serviceAccountName" . }}
-      securityContext:
-        {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      containers:
-        - name: {{ .Chart.Name }}
-          securityContext:
-            {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}

helm-charts/chart/templates/hpa.yaml

@@ -1,28 +0,0 @@
-{{- if .Values.autoscaling.enabled }}
-apiVersion: autoscaling/v2beta1
-kind: HorizontalPodAutoscaler
-metadata:
-  name: {{ include "chart.fullname" . }}
-  labels:
-    {{- include "chart.labels" . | nindent 4 }}
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: {{ include "chart.fullname" . }}
-  minReplicas: {{ .Values.autoscaling.minReplicas }}
-  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
-  metrics:
-    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
-    - type: Resource
-      resource:
-        name: cpu
-        targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
-    {{- end }}
-    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
-    - type: Resource
-      resource:
-        name: memory
-        targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
-    {{- end }}
-{{- end }}

helm-charts/chart/templates/ingress.yaml

@@ -1,61 +0,0 @@
-{{- if .Values.ingress.enabled -}}
-{{- $fullName := include "chart.fullname" . -}}
-{{- $svcPort := .Values.service.port -}}
-{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
-  {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
-  {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
-  {{- end }}
-{{- end }}
-{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
-apiVersion: networking.k8s.io/v1
-{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
-apiVersion: networking.k8s.io/v1beta1
-{{- else -}}
-apiVersion: extensions/v1beta1
-{{- end }}
-kind: Ingress
-metadata:
-  name: {{ $fullName }}
-  labels:
-    {{- include "chart.labels" . | nindent 4 }}
-  {{- with .Values.ingress.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
-  ingressClassName: {{ .Values.ingress.className }}
-  {{- end }}
-  {{- if .Values.ingress.tls }}
-  tls:
-    {{- range .Values.ingress.tls }}
-    - hosts:
-        {{- range .hosts }}
-        - {{ . | quote }}
-        {{- end }}
-      secretName: {{ .secretName }}
-    {{- end }}
-  {{- end }}
-  rules:
-    {{- range .Values.ingress.hosts }}
-    - host: {{ .host | quote }}
-      http:
-        paths:
-          {{- range .paths }}
-          - path: {{ .path }}
-            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
-            pathType: {{ .pathType }}
-            {{- end }}
-            backend:
-              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
-              service:
-                name: {{ $fullName }}
-                port:
-                  number: {{ $svcPort }}
-              {{- else }}
-              serviceName: {{ $fullName }}
-              servicePort: {{ $svcPort }}
-              {{- end }}
-          {{- end }}
-    {{- end }}
-{{- end }}

helm-charts/chart/templates/service.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "chart.fullname" . }}
-  labels:
-    {{- include "chart.labels" . | nindent 4 }}
-spec:
-  type: {{ .Values.service.type }}
-  ports:
-    - port: {{ .Values.service.port }}
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    {{- include "chart.selectorLabels" . | nindent 4 }}

helm-charts/chart/templates/serviceaccount.yaml

@@ -1,12 +0,0 @@
-{{- if .Values.serviceAccount.create -}}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "chart.serviceAccountName" . }}
-  labels:
-    {{- include "chart.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}

helm-charts/chart/templates/tests/test-connection.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: "{{ include "chart.fullname" . }}-test-connection"
-  labels:
-    {{- include "chart.labels" . | nindent 4 }}
-  annotations:
-    "helm.sh/hook": test
-spec:
-  containers:
-    - name: wget
-      image: busybox
-      command: ['wget']
-      args: ['{{ include "chart.fullname" . }}:{{ .Values.service.port }}']
-  restartPolicy: Never

helm-charts/chart/values.yaml

@@ -1,82 +0,0 @@
-# Default values for chart.
-# This is a YAML-formatted file.
-# Declare variables to be passed into your templates.
-
-replicaCount: 1
-
-image:
-  repository: nginx
-  pullPolicy: IfNotPresent
-  # Overrides the image tag whose default is the chart appVersion.
-  tag: ""
-
-imagePullSecrets: []
-nameOverride: ""
-fullnameOverride: ""
-
-serviceAccount:
-  # Specifies whether a service account should be created
-  create: true
-  # Annotations to add to the service account
-  annotations: {}
-  # The name of the service account to use.
-  # If not set and create is true, a name is generated using the fullname template
-  name: ""
-
-podAnnotations: {}
-
-podSecurityContext: {}
-  # fsGroup: 2000
-
-securityContext: {}
-  # capabilities:
-  #   drop:
-  #   - ALL
-  # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
-  # runAsUser: 1000
-
-service:
-  type: ClusterIP
-  port: 80
-
-ingress:
-  enabled: false
-  className: ""
-  annotations: {}
-    # kubernetes.io/ingress.class: nginx
-    # kubernetes.io/tls-acme: "true"
-  hosts:
-    - host: chart-example.local
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-  tls: []
-  #  - secretName: chart-example-tls
-  #    hosts:
-  #      - chart-example.local
-
-resources: {}
-  # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-  # limits:
-  #   cpu: 100m
-  #   memory: 128Mi
-  # requests:
-  #   cpu: 100m
-  #   memory: 128Mi
-
-autoscaling:
-  enabled: false
-  minReplicas: 1
-  maxReplicas: 100
-  targetCPUUtilizationPercentage: 80
-  # targetMemoryUtilizationPercentage: 80
-
-nodeSelector: {}
-
-tolerations: []
-
-affinity: {}

home/manifests/apps/kustomization.yaml

@@ -2,4 +2,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./initialization/
+  - ./minecraft/

home/manifests/apps/minecraft/forge-1.18.2-create/deployment.yaml

@@ -0,0 +1,60 @@
+# docker run -d -it -v /path/on/host:/data -e EULA=TRUE -p 25565:25565 --name mc itzg/minecraft-server
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: minecraft-forge-server
+  labels:
+    app: minecraft-forge-server
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: minecraft-forge-server
+  template:
+    metadata:
+      labels:
+        app: minecraft-forge-server
+    spec:
+      volumes:
+      - name: minecraft-forge-data
+        persistentVolumeClaim:
+          claimName: minecraft-forge-data-pvc
+      containers:
+      - name: minecraft-forge-server
+        image: itzg/minecraft-server:latest
+        resources:
+          limits:
+            memory: 6Gi
+          requests:
+            memory: 2Gi
+        env:
+          - name:  EULA
+            value: 'TRUE'
+          - name: MODE
+            value: suvival
+          - name: MOTD
+            value: SURVIVE. GATHER. CREATE.
+          - name: ALLOW_FLIGHT
+            value: 'TRUE'
+        ports:
+        - containerPort: 30020
+          name: minecraft
+        volumeMounts:
+          - name: minecraft-forge-data
+            mountPath:  /data
+        readinessProbe:
+          exec:
+            command:
+            - mcstatus
+            - 127.0.0.1
+            - ping
+          initialDelaySeconds: 30
+          periodSeconds: 30
+        livenessProbe:
+          exec:
+            command:
+            - mcstatus
+            - 127.0.0.1
+            - ping
+          initialDelaySeconds: 30
+          periodSeconds: 30

home/manifests/apps/minecraft/forge-1.18.2-create/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: minecraft
+resources:
+  - ./namespace.yaml
+  - ./storage-class.yaml
+  - ./persistent-volume.yaml
+  - ./pvc.yaml
+  - ./deployment.yaml
+  - ./service.yaml

home/manifests/apps/minecraft/forge-1.18.2-create/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: minecraft

home/manifests/apps/minecraft/forge-1.18.2-create/persistent-volume.yaml

@@ -0,0 +1,21 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: minecraft-forge-data
+spec:
+  capacity:
+    storage: 8Gi
+  volumeMode: Filesystem
+  accessModes: [ReadWriteOnce]
+  persistentVolumeReclaimPolicy: Delete
+  storageClassName: local-storage
+  # local:
+# path: /minecraft-forge
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: kubernetes.io/hostname
+          operator: In
+          values: [chromebox]

home/manifests/apps/minecraft/forge-1.18.2-create/pvc.yaml

@@ -0,0 +1,10 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: minecraft-forge-data-pvc
+spec:
+  storageClassName: local-storage
+  accessModes: [ReadWriteOnce]
+  resources:
+    requests:
+      storage: 8Gi

home/manifests/apps/minecraft/forge-1.18.2-create/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: minecraft-forge-server
+  labels:
+    app: minecraft-forge-server
+spec:
+  type: NodePort
+  ports:
+    - port: 30020
+      nodePort: 30020
+  selector:
+    app: minecraft-forge-server

home/manifests/apps/minecraft/kustomization.yaml

@@ -1,5 +1,5 @@
+---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- gotk-components.yaml
+  - ./forge-1.18.2-create/
-- gotk-sync.yaml

home/manifests/initialization/argocd/kustomization.yaml

@@ -1,6 +1,7 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: argocd
 resources:
   - namespace.yaml
   - https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

home/manifests/initialization/openebs-jiva/config.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: pulumi
+  name: openebs-jiva-csi-iscsiadm
+  namespace: openebs
+data:
+  iscsiadm: |
+    #!/bin/sh
+    iscsid_pid=$(pgrep iscsid)
+
+    nsenter --mount="/proc/${iscsid_pid}/ns/mnt" --net="/proc/${iscsid_pid}/ns/net" -- /usr/local/sbin/iscsiadm "$@"    

home/manifests/initialization/openebs-jiva/daemonset.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: openebs-jiva-csi-node
+  labels:
+    app: openebs-jiva-csi-node
+  namespace: openebs
+spec:
+  template:
+    spec:
+      hostPID: true

home/manifests/initialization/openebs-jiva/kustomization.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # - namespace.yaml
+  - https://openebs.github.io/charts/openebs-operator.yaml
+  #- https://openebs.github.io/charts/hostpath-operator.yaml
+  #- https://openebs.github.io/charts/jiva-operator.yaml
+  - ./volume-policy.yaml
+  #- ./storage-class.yaml
+  # - https://openebs.github.io/charts/cstor-operator.yaml
+  # - https://openebs.github.io/charts/zfs-operator.yaml
+  # - https://openebs.github.io/charts/lvm-operator.yaml
+# patchesStrategicMerge:
+  # - ./daemonset.yaml
+  #- ./config.yaml

home/manifests/initialization/openebs-jiva/storage-class.yaml

@@ -0,0 +1,33 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: openebs-jiva-csi-sc
+provisioner: jiva.csi.openebs.io
+allowVolumeExpansion: true
+parameters:
+  cas-type: "jiva"
+  policy: "example-jivavolumepolicy"
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: openebs-hostpath
+  annotations:
+    openebs.io/cas-type: local
+    cas.openebs.io/config: |
+      # hostpath type will create a PV by 
+      # creating a sub-directory under the
+      # BASEPATH provided below.
+      - name: StorageType
+        value: "hostpath"
+      # Specify the location (directory) where
+      # where PV(volume) data will be saved. 
+      # A sub-directory with pv-name will be 
+      # created. When the volume is deleted, 
+      # the PV sub-directory will be deleted.
+      #Default value is /var/openebs/local
+      - name: BasePath
+        value: "/var/openebs/local/"
+provisioner: openebs.io/local
+volumeBindingMode: WaitForFirstConsumer
+reclaimPolicy: Delete

home/manifests/initialization/openebs-jiva/volume-policy.yaml

@@ -0,0 +1,9 @@
+apiVersion: openebs.io/v1alpha1
+kind: JivaVolumePolicy
+metadata:
+  name: example-jivavolumepolicy
+  namespace: openebs
+spec:
+  replicaSC: openebs-hostpath
+  target:
+    replicationFactor: 1

home/readme.md

@@ -1,5 +1,7 @@
 # Home Cluster
 
+> **NOTE**: Scripts below are in `fish` shell.
+
 ## TODO
 
 - **Netboot**: https://www.sidero.dev/v0.5/getting-started/prereq-dhcp/
@@ -20,19 +22,36 @@
 
 > **Source**: https://www.talos.dev/v1.1/introduction/getting-started/
 
-- Boot the Talos image on the initial node
+```bash
+#!/usr/bin/env fish
+# these are my values, you will want your own
+set CLUSTER_NAME 'home'
+set CLUSTER_ENDPOINT 'https://kube-cluster.home.lyte.dev:6443'
+set NODE_ADDR '10.0.0.101'
+set AGE_KEY (pass age-key | rg '# public key: ' | awk '{printf $4}')
+```
+
+- Setup talos directory if needed
+  - `mkdir -p talos; cd talos`
 - If you are not using _this_ configuration:
-  - `talosctl gen config "cluster-name" "cluster-endpoint"`
+  - `talosctl gen config "$CLUSTER_NAME" "$CLUSTER_ENDPOINT"`
-  - Edit files as needed
+  - Edit files as needed, making sure only one of the controlplane nodes is the `endpoint` in the `talosconfig`
-- Apply the control plane config to the initial node
+  - `mv talosconfig talosconfig.yaml`
-  - `talosctl apply-config --insecure --nodes "$INITIAL_NODE_ADDR" --file controlplane.yaml`
+  - Encrypt via `sops` with `age`
-  - You will need to wait a bit for the configuration to be applied, Talos to
+    - `for f in *; sops yaml --encrypt --age-key "$AGE_KEY" --in-place "$f"; end`
-    install itself, for the node to reboot, and for post-boot initialization
+- Setup the `talosctl` client to use your configuration
-- Setup the client to communicate with the newly-configured node
+  - `sops exec-file talosconfig.yaml 'talosctl config merge {}'`
-  - `talosctl --talosconfig=./talosconfig config endpoint "$INITIAL_NODE_ADDR"`
+- For each node in the cluster as specified in `talosconfig.yaml`, do the
-    - Optionally also make this the default with `talosctl config merge ./talosconfig`
+  following:
+  - Boot the Talos image on the node
+    - Disconnect boot media from the node after it's booted otherwise your
+      Ventoy will get wiped
+  - Apply the appropriate configuration to the node
+    - `sops exec-file (controlplane.yml|worker.yml) 'talosctl apply-config --insecure --nodes '"$NODE_ADDR"' --file {}'`
+    - This can take a moment to finish, but you can move on to the next node
+      while you wait
 - Bootstrap the cluster
-  - `talosctl bootstrap --nodes "$INITIAL_NODE_ADDR"`
+  - `talosctl bootstrap --nodes "$NODE_ADDR"`
   - You will need to wait a bit for Kubernetes to initialize
 - Pull down the kubeconfig
   - `talosctl kubeconfig`
@@ -42,14 +61,26 @@ able to `kubectl get nodes`.
 
 #### Adding Nodes
 
-> **Note**: UNTESTED
+> **TODO**: This process is untested!
 
-- Boot the Talos ISO on the target node
+- Boot the Talos image on the target node
-- Apply the appropriate configuration to the target node
+- Add the node to `talosconfig.yaml`
-  - `talosctl apply-config --insecure --nodes "$TARGET_NODE_ADDR" --file controlplane.yaml`
+  - `sops talos/talosconfig.yaml`
-  - You will need to wait a bit for Kubernetes to initialize, start up, and
+- Setup the `talosctl` client to use your configuration
-    then join the cluster
+  - `sops exec-file talos/talosconfig.yaml 'talosctl config merge {}'`
-- Add the node to `talosconfig` as needed
+- Apply the appropriate configuration to all nodes in the cluster
+
+#### Removing Nodes
+
+> **TODO**: This process is untested!
+
+- Cordon and drain the node
+- Remove the node from `talosconfig.yaml`
+  - `sops talos/talosconfig.yaml`
+- Update the `talosctl` client to use your configuration
+  - `sops exec-file talos/talosconfig.yaml 'talosctl config merge {}'`
+- Apply the appropriate configuration to all nodes in the cluster
+- Power down the node
 
 #### Untaint Masters
 
@@ -60,10 +91,12 @@ things:
 kubectl taint nodes --all node-role.kubernetes.io/master-
 ```
 
-### Apply Initialization Manifests
+### Apply Initial Manifests
+
+Some manifests must be applied before we can let GitOps take over.
 
 ```bash
-kubectl apply -k manifests/initialization
+kubectl apply -k --enable-helm manifests/initialization
 ```
 
 ### Setting up GitOps

home/talos/.gitignore

@@ -1,3 +0,0 @@
-talosconfig
-*.yaml
-!*.encrypted.yaml

home/talos/controlplane.yaml

@@ -29,29 +29,47 @@ machine:
         #ENC[AES256_GCM,data:YNgmKMEk0DwjiEneJ5u1Fy0=,iv:LyXLLVGykIbZPbZQaUHlW4O6m3Pb8CFn/MzUSlFgXcw=,tag:K9vcUKk+UfM0GhkmArJmLA==,type:comment]
         #ENC[AES256_GCM,data:Pe6nNFuQK0+WU9jWPAhdc5EoTQ==,iv:4+6ueRVck1aFqs6YBerJy0D3agHNV3AlZ5rDSzQSKXA=,tag:8FrSdpaSD/tNu/m4PfQ7cw==,type:comment]
         #ENC[AES256_GCM,data:WfHi2PF24hWHj27cCIAb7epUTOtvNjizG0m+cwSvRyzVw3bSy/0BtfAdt7Q3zJHnWoOwkIQAbsiJ1evljdIoioqhpPOeKO+4Se6IvA==,iv:NYCqAI7WTkJd+Q4PCm4BvKCpJdZgJn49R77mcAlr01k=,tag:laMhCt3TlirTti0NaWRCnQ==,type:comment]
-        #ENC[AES256_GCM,data:r78X7o3X0oHJWHA=,iv:6+m/YLZWChNuxhNKfY26Tg3Zd4ndSRgwrmRz2e7kgwU=,tag:xNFqpvbBa0u33UTHVT4BfA==,type:comment]
+        extraArgs:
-        #ENC[AES256_GCM,data:y3o9XtUjIotsu1P+uLGo,iv:mXXdkvohdo11RrBaR4b/cCN/ehv8NSktQQd4snZk7C4=,tag:tSg417abxg2nhxvZBZeeag==,type:comment]
+            node-labels: ENC[AES256_GCM,data:U1AWmkWadoUBdoHIjxYia47AgTzKlglX4C8=,iv:chCeEFNVSz5+bvIwK+zBkSuBDig6WwnK+e5oqmnDI+4=,tag:WItChLm4Ix4roacWDe7mCQ==,type:str]
         #ENC[AES256_GCM,data:TvKjKI1PgKEBygZHoMgspILqDQjDUEnjbhIhTpgCB6EmxPTUsiM0zJnyQUy9TVwk9cpL4eAzydOVS1Iogw8fsIJgPpL6aA6EpgZYAcA7YqlxbCmNmw==,iv:b/7p5e3YJFF9DKT2Wzz1NvaaT46jQFoWiQhOL+8G+qU=,tag:LeEJaUe4o0/OO/twbHpwBw==,type:comment]
-        #ENC[AES256_GCM,data:s3OX3m+CeBbsBMZ0Qw==,iv:7VjFpeo0exXT+aA3/dpde9dX9EMaH95bfuNQ29z0z/w=,tag:OhDSWHu8L8uz6n0aV0oJSw==,type:comment]
+        extraMounts:
-        #ENC[AES256_GCM,data:ZAkIF6fMvJZn1mTvbUtnmoGfOhPQL58uKl9r5iwUlUWgsnOw,iv:xMC6KTke2BR67AZYJk2alLh2Q/LwXkUD5WZLvU+RsTM=,tag:MxD/SrlK8SFlHXhSYgb4QA==,type:comment]
+            - destination: ENC[AES256_GCM,data:JnflF6juS0OXsbxZA7xrQgW4,iv:1FFSj6lFqYUu5K7TCcqMYcT8/OqsHc1G+77dhBVeXC8=,tag:bf/Ve7wpmYfwl1zUyNO/iQ==,type:str]
-        #ENC[AES256_GCM,data:/+vGpOk9WwXni2FXkbk5Rds=,iv:ii82V8Gmg8u7iZ4zZL/Uxzb3LiAjOkyTZSsEf/qVevk=,tag:K5lnLRvEfViNUG7Noy2lVA==,type:comment]
+              type: ENC[AES256_GCM,data:imQRww==,iv:DrCnTuDt4OXUiXWXnDTb9XpNB/iKcF+R9XvCdMAmZt0=,tag:vNrs2RTXROPfdbzcYfJdLQ==,type:str]
-        #ENC[AES256_GCM,data:A5qIm7Y188CbyaFWVoA95H5nkmFExxdUhPFZpyR2wA==,iv:OFVXRbhT4NRG6z+htMACzGOfHiq9xdmRTZSmPm/reSk=,tag:+QOrQds7zo+0M8MotZMKBw==,type:comment]
+              source: ENC[AES256_GCM,data:dHNqc+ddPW5f0J0ZZNOkHVEU,iv:Uo5vUQnzYYaVd5D1jpBWwe+K5vT/SG0X5q+FUzol4Qc=,tag:Nlh6OFWf4u3/1XDyIoEcAw==,type:str]
-        #ENC[AES256_GCM,data:IWJezKe2NdJfPmUMDmXq,iv:olH4pTJ/OzgQRvRIyGw45A1KCwef+MIo2FTBwO38evc=,tag:OQ0qFQ+J0FmqzRoR1rS/Ww==,type:comment]
+              options:
-        #ENC[AES256_GCM,data:kQdLSqT4KJ+jbg/upGVp,iv:m5ay2XwBq+JXv3WXdy140nOF2IKgEBsEikU7A5QjI8c=,tag:zGDqnzMJJRgzhlGHUf0jXw==,type:comment]
+                - ENC[AES256_GCM,data:1yR2WA==,iv:ockde3w8Z+CkjooBnnJU2kSxPpOs+kwgc4JXkept04I=,tag:IVyZpteKZLTwoaA9SgaMDg==,type:str]
-        #ENC[AES256_GCM,data:d8MMugR1Bn3iwzvobL0Sbve+,iv:WfDqyStth2rFORmx5jBxLoa2O6mL2nGzYAs6eBPUTv8=,tag:dDI65VvKH6PEMXUlP7p9TQ==,type:comment]
+                - ENC[AES256_GCM,data:KRW4s8yweg==,iv:lfngqwIBSMuTZaKJ1lM11GdRp4xyXlllm45dtjzBO1Q=,tag:9n4obs02BUICWcNob3d4dg==,type:str]
-        #ENC[AES256_GCM,data:h7EzK1zEgF7+O8Kjow==,iv:QhkiH61APe/AjW9hQ7rVeQbK3WBOOh13CuS46LdZoRw=,tag:g7uBUd1z6jbo7pdBoBxwAA==,type:comment]
+                - ENC[AES256_GCM,data:TtU=,iv:BIvBn5tXT00W3hf/q14OWhnkk+WHWksSJZV9YEAnwfc=,tag:NINvwhieDs8XFPumu1tNcA==,type:str]
-        #ENC[AES256_GCM,data:j6IOCj/V8XcrQYAT+3Ub8K89fciDWKZmuUQ81SH1M75G125oBK3UUUc4Pd26TCMxrR13PKIRjtujdae/eIivkscGLmL4NIZg0FaUyTuk,iv:iChU5uDL8L9xdwhxNQRwy0UDvhQnfAeNA13J/qEnZkE=,tag:336FZ3TozP8QQGRixp6T9A==,type:comment]
+                - ENC[AES256_GCM,data:/lzcr4nN3wVKPZc/OYWHEH2f3LIN1dwM56M0+Mea/anbZZR4EzNs1hZ7TcwtQRj3bnjhc7BfU6Za9NQ0DVNvEE8jX3Ak3Mzq86Vbzg9R,iv:SZbfq9JJyIZXs05q7Up7jP/FHO6bbUPhJ5KN4QT4eiQ=,tag:v/JC3BL8QInRUIKd0gMc1g==,type:comment]
-        #ENC[AES256_GCM,data:9Gq5UkfpldaxwgsLUg==,iv:1HiwDkl3PVzlaeEXH5G4zoal3+bI0jhuCWHITLTpFGQ=,tag:AWe4qNStOB1A5xvRFpy+ng==,type:comment]
+                - ENC[AES256_GCM,data:tWlNGxgWvDRLzJ4ZTA==,iv:MOXA9dvZpEX8lyGRA0VtUs6+gbMMOVYuERGsAsREPek=,tag:yaAXNmZsBxE5XHJWyUzVFA==,type:comment]
-        #ENC[AES256_GCM,data:ihNghhn+DAZ42P5dDsn3RLiqi62+6OjTn2+7mTg=,iv:gzmLNaM7bW23JCikTb1p+wxuSXHVUHbA5yaiGpD3OMo=,tag:X9lPdSBX+QI3avJGxln9mw==,type:comment]
+                - ENC[AES256_GCM,data:osT8GsgvDSPolv/cOCMCepH2SAFCe0Lfu+tjto0=,iv:ifX5Lhu6CzTrGdcurLf68SMYUM6si/5UCx4n/gRI8hk=,tag:PgguNzVf5V0/zOuuVaSZFg==,type:comment]
-        #ENC[AES256_GCM,data:e3w1YCwfc1vkMo5EMTxqrEGg9w4zOelr/mH68gAWIdINE4MjQ2CmabV0CKh7WumLYNBRMk+2Hq3tbxa4Jw7IBv3Ob1WSXUuZZ2WUUw==,iv:7PFLsVAYoBqRJJNKnJ/QjRNS3EvY/znWmzNfd+f4OlA=,tag:dzrX0Id8bv77k61SnleYKg==,type:comment]
+                - ENC[AES256_GCM,data:O/5NhcUcza2MXPSa56/yTGVN1AAtbHDrQvPKe8CrMPAuR1h3c6qyUFjk7+sEz/htMJni2mUMHg7HKfkZeTHnd0d/e4EicBCxVboKOQ==,iv:ZBsFyXRiN8CvmdB9jsFzYsJJRbpGS4EjShEBv9ZLDKo=,tag:9GaKGHJ54ADFpsaqlNy8Uw==,type:comment]
-        #ENC[AES256_GCM,data:g7BdUQmezc4=,iv:p6Meng/b9O+lRtvZhpBoh5M975g3/S5hRSLipQxuSuE=,tag:4Ups1L7S0FA0SRJFSU0CVA==,type:comment]
+                - ENC[AES256_GCM,data:rbSs2y13eAM=,iv:/ilskxmTFM8KorDazAOQBtyBbx2dfoMYOCVbp7avcwc=,tag:ePuTXWjqjXga0ngU/TOIYQ==,type:comment]
-        #ENC[AES256_GCM,data:rh18xifP5K4S6lnCKdTa6LLmiGcF+ijNmT4wIj+3+MDT+DENBOazmCA7fV3TxETcB9NdxX3HiGKacynxGUA06NxiF8xG+JhfhpEssknie7MxRSNCRg==,iv:WbA8kCgv3jL6ut+K2Ateyrh7EfqGJMNc2HzyKrwTReI=,tag:OjqEDI1vfhTUaZOzCWFDHA==,type:comment]
+                - ENC[AES256_GCM,data:IKcWRXNJBesWf7ldOGV+F2X99HHjnVpySmJopOhLuBmK+WLwBDvH3kVmlc8874SbhuXywzR/0oqpBNSaqzkFZWujm1EugG2bbNbu029v7z229P1AmA==,iv:rq69X2aD6qWtEsiX3SGm1KoSYqL3yw8RlfmzB8b5E2c=,tag:U3WUoc1FAX5t6QVwJxCBGQ==,type:comment]
-        #ENC[AES256_GCM,data:J0uwOKfO75HiY3Zx3BVlVPRU,iv:R0h8bxx//vsDibko0c5vve/HRpoTb34GuwKLAYG5hq4=,tag:PMDfKNMgJpTyIHADdcH+fw==,type:comment]
+                - ENC[AES256_GCM,data:rWnr+1K2vAm0wyKLj/tm9B2i,iv:BqK/KEnTgr11NnJu5Saf7/4EqFwbFvOUt9zOlyllleY=,tag:LBMz1myNp4JiWPGDOdV8tg==,type:comment]
-        #ENC[AES256_GCM,data:7+HjoNFKpGdsU/MTCSRxTOHZSQcl,iv:6Ch6IqnzdzmDcO/9R6ldn0bqfBZ2VtbyT7KEJB2oWgk=,tag:RDGKljcOciUK2nI6iqd3JQ==,type:comment]
+                - ENC[AES256_GCM,data:K0z0l1vjzoLk9iROJ54mgZ9sZMR0,iv:VLFmA1ukXVfWELUg9Rx63UylyGDY6GTfpqLDqZjhOR0=,tag:rrCwOisXVqi3XPkY9+pD3w==,type:comment]
-        #ENC[AES256_GCM,data:8/yOf7PgPO4frcZbLXKa5PcQ5UNuCYzG+Q==,iv:xubhlVl9JDcjWk7kPchirOM5JzSEiQr2iEzktfYD4ys=,tag:V2eEr8CdaWPbx0rNn8P7DA==,type:comment]
+                - ENC[AES256_GCM,data:I+iOunJHth6RkA/E1/wiPxyvPTsY/mrDgQ==,iv:LEAoRmBU2KY3Zy8DhrOZHRqvXbG7tZX9ieyLmr86Xzw=,tag:iuTGUTKNhNqBQ9njp05clg==,type:comment]
-        #ENC[AES256_GCM,data:Ab8AzGmzdPw7UClnyoGVd+JjidU=,iv:DTMJFBFD4luV5azgXn3TzczSJPxdYcrux/c9U8EYrsQ=,tag:wWQgpPnjod8Put3r+Ueo0w==,type:comment]
+                - ENC[AES256_GCM,data:AaaJpMO5IDUEZ6Hn5RS43rdSC8M=,iv:Tusy/8dP3ZAlTewfUMFpnCYSiJ+YWs0ZH6/L3wjaJ0c=,tag:/41cxMV/a/aULb/zux7Ojg==,type:comment]
     #ENC[AES256_GCM,data:Ut2K6cTZca1rhGB//5tYEpIlhyK88kykU5Iu1v7O4ptHno9uSHDsNYnjRnQa/Ybhw8joNamFrL+7,iv:3jyblt8LeEaTjZiSQYdot/dLKBt7sWwTY6p7nmS8j20=,tag:raL0BGaLXghheXAx+K6fBQ==,type:comment]
     network: {}
+    sysctls:
+        vm.nr_hugepages: ENC[AES256_GCM,data:6k0hBw==,iv:tmd1fITLkZmDAXO1XaRE3jDdAR3/bCPaQNzTcKQ5avo=,tag:sFn5fUyzysurYD4wYC13gA==,type:str]
+    files:
+        - ENC[AES256_GCM,data:9wnmYB4GmUDu4dhgIF/e2zsfRzeCFp+6u90=,iv:FlEiFb9eNNzdir21WdGozp9t+/s0psl6M7uGTjJpWok=,tag:2nepckdx7qyRyd1aqJsS9g==,type:comment]
+        - content: ""
+          #ENC[AES256_GCM,data:AYv6LJIeNzbbXISRgpKHfdzAwQLyFvzNPrhHIqUYxbkq,iv:8fgM3NuFTPC/csH5Z6L2f4US9neWF2/9YFaBxv9hCmY=,tag:/RtI4HO1MYYVLEcrrr5c6g==,type:comment]
+          permissions: ENC[AES256_GCM,data:T+MX,iv:WyGx59SyKaFc8k1mlqGNv71GtScQMsBlRN3jLH7jveE=,tag:uRsebL5CLcaMUHaOeZ0+hQ==,type:int]
+          #ENC[AES256_GCM,data:7mw0K+IQxXx7V9JJt77+dLu43Zn07w==,iv:x6u2kGYLap/CNjGF1N5OCZFMhMrefrdFsRflHMKqsus=,tag:B3jgRTVUHI62qP4UjSkRDg==,type:comment]
+          path: ENC[AES256_GCM,data:uhrd0CsJq/XWeRJtAT+mrX6tW1doy5dn6dRF4VrE,iv:w7xR2ya3PVHIo3yRssyx0eK+4Jajw3Uf6i3vuzQeFxU=,tag:6bJXpmoR6HU8+iw+93hwoQ==,type:str]
+          #ENC[AES256_GCM,data:UUnK8DNEbmUH0EoMLKzNySt/uRwN,iv:QUHAuDn8O9bQA4I11iSuQQwGcCznWskHtrwlw75xHog=,tag:8dgt35IAfWa+LE2yUk7SJw==,type:comment]
+          op: ENC[AES256_GCM,data:CaVAEoet,iv:JUzKnazny3mc5OalLkDirDvAFhJaqkQhX41m96fuzvk=,tag:4koVvXiE5F6ZVfo/m9NZ7A==,type:str]
+        - content: ""
+          #ENC[AES256_GCM,data:AYv6LJIeNzbbXISRgpKHfdzAwQLyFvzNPrhHIqUYxbkq,iv:8fgM3NuFTPC/csH5Z6L2f4US9neWF2/9YFaBxv9hCmY=,tag:/RtI4HO1MYYVLEcrrr5c6g==,type:comment]
+          permissions: ENC[AES256_GCM,data:T+MX,iv:WyGx59SyKaFc8k1mlqGNv71GtScQMsBlRN3jLH7jveE=,tag:uRsebL5CLcaMUHaOeZ0+hQ==,type:int]
+          #ENC[AES256_GCM,data:7mw0K+IQxXx7V9JJt77+dLu43Zn07w==,iv:x6u2kGYLap/CNjGF1N5OCZFMhMrefrdFsRflHMKqsus=,tag:B3jgRTVUHI62qP4UjSkRDg==,type:comment]
+          path: ENC[AES256_GCM,data:jiJpcJBKpRQI6qNOCi38EATwf4x0b3nLuafog2gqWi6x/XJ1EQ==,iv:wHjmYBclfQzyj3ipRd36yftHCHynwH23tLRtmzdNYBQ=,tag:IjvDeRx7k1o7NmefQcoKJg==,type:str]
+          #ENC[AES256_GCM,data:UUnK8DNEbmUH0EoMLKzNySt/uRwN,iv:QUHAuDn8O9bQA4I11iSuQQwGcCznWskHtrwlw75xHog=,tag:8dgt35IAfWa+LE2yUk7SJw==,type:comment]
+          op: ENC[AES256_GCM,data:CaVAEoet,iv:JUzKnazny3mc5OalLkDirDvAFhJaqkQhX41m96fuzvk=,tag:4koVvXiE5F6ZVfo/m9NZ7A==,type:str]
     #ENC[AES256_GCM,data:tCbsY9D6A8JlUmUmt9L6kv71G2BesvwEaG0ILPVXQQg0oQqBBZOZ8R3R1r7di+2Moy+/OBpO6o5fYKJBZAYseBKuMiIcvg==,iv:1fBxLZhbRfu3mL86A/adTSqFoX96Zu3o2+Y3byOebMc=,tag:izh+qxyJWbJ7VLgP1JEOnA==,type:comment]
     #ENC[AES256_GCM,data:G7nndI5D9l+jsDiJ,iv:esUWHURQwkWKuL8+Imrt7e3xXBN6aIzHkhO+8xdlSwE=,tag:aeQmX9/I+BBLkHcxKSkuRw==,type:comment]
     #ENC[AES256_GCM,data:HYqRrFxEYrK3sMImJ5XZM4pnYn5XXIoqp/ZlTWOnUqvsl0nwZWXAHDMCing=,iv:1HErx6KC+0bdOP1Hqr84TD3jpW9iSqGPVuAis/la1Ag=,tag:DvMbZV3drjhykw4FoTnpSg==,type:comment]
@@ -67,7 +85,7 @@ machine:
     #ENC[AES256_GCM,data:11igbjYwcw==,iv:fJdkymXd4Wxb959PpfxZu6zSEJFRtHs/No8mLIIoDzs=,tag:9x8u32dP3jngd5Q/TuAT1Q==,type:comment]
     #ENC[AES256_GCM,data:B8GK/WTQoS+zaV3yGy+wLFEWntDAlwSXXHSSt/2mh/tDJXkbg5gaDvFz1p10IyxdyBfkH4c=,iv:KN0xR6lEBActQ8Ba/yKsXgvvpaY0csOzOyISDWIWmhE=,tag:sT7Q2DVNBobroOPjvRKeRA==,type:comment]
     #ENC[AES256_GCM,data:kZitgWG9l+iMuGegsbJ5AHGL96SsHchjDzOjm7xUA5o+lgCtyherIaF2B0/MyrJo,iv:16Ow/FEr+6htMfYduX6md4NaI8lfU9au1oIpkuY2tTY=,tag:S/+tCevh8qjw5JeNJhEmHw==,type:comment]
-    #ENC[AES256_GCM,data:ibpl8haU0x9beBoaZsGksnVvIDJcL5UA,iv:IaHhwyXeZUgzDsaFy4mnWFnnNajTAisi3hcTXe8Pbeg=,tag:VaEWWPHuIfSJeSNM7LoPxQ==,type:comment]
+    #ENC[AES256_GCM,data:yt0GIcQIjEMatMZHbPsSZGPlM1yD4Kgs,iv:nbH8h4mU1BoRKO2mimFVcYKStr5HZtWj/c7627Vxavo=,tag:3r5jH30Luh19nyEDoRVcpg==,type:comment]
     #ENC[AES256_GCM,data:j+VKLJxba+Zb6rBW3HaD7v2qdoog8NS24v0X4nBzEwVLwMFxblFV8oCyKugA6IgstsBNwYlPPlMX8wW0PKeDP2dTqBhTLvr73RE6fkEnGDE=,iv:U0MbHuFfIPtEkbrsc23u/Sx233f5y9X8f1tHhR5fuOY=,tag:FhaHDWsIzfSe0LtTFvAYDg==,type:comment]
     #ENC[AES256_GCM,data:L1z7Hw5IRvq4y9BiNDxyM6GASTIXa6SR0uL6mU13dsS8CS5R80gn9BR3CgPPEslLH7//zyNOqlo5D0EuzRWNcFxdo0WM6JNKU3y3Ztky9luynJjyz1NvCXfi,iv:Mvmrh0fahByq0grSxz2ryxWj1OYuqUlrBkHC1o+5zH8=,tag:zZL+YSPi9n13el6BxjdX5w==,type:comment]
     #ENC[AES256_GCM,data:yt0GIcQIjEMatMZHbPsSZGPlM1yD4Kgs,iv:nbH8h4mU1BoRKO2mimFVcYKStr5HZtWj/c7627Vxavo=,tag:3r5jH30Luh19nyEDoRVcpg==,type:comment]
@@ -88,16 +106,16 @@ machine:
     #ENC[AES256_GCM,data:IHFGBB9M9wWH1vhoZf2eO2r9XCDfmgYghRtyvS1UYFbBONTdhyyPXHK8/X+fgmurv+IXtET3AA1I9cLyZbfNDEwTsyJpRlWbPjlwAnZE,iv:VTjNqEQKZ46V2nx7z6LwekxwnnoGSBVyri+xeAOWqM4=,tag:RCRRIni939Wa8oRGxC3iZw==,type:comment]
     #ENC[AES256_GCM,data:0zqHrSmBLH6zD++ki9JFgxT8Z5ivcAGqObPZgzNbm8D+tlKUN1IufFat1+Y=,iv:OpL5csIl4arEqxeDjxy+I9yHlNPYTYVA9SvJy0St7jI=,tag:UOB22fIB3tz26oJFTYM17w==,type:comment]
     #ENC[AES256_GCM,data:uETlCOfYCtmaIwP8fKHlDuxftFczZ+VYWe0WvE35Odh6cWs=,iv:zXhH8e35tKTDvQTmDfDSAyiT2zc2NxYAVlsK89hbqOI=,tag:5ZuCbGGL27t2xkUtgylwmg==,type:comment]
-    #ENC[AES256_GCM,data:082U9ce6hTl50tj6HsShjwT3BQ==,iv:4opJ23/Rw1x9srS8e25zaylCIkwc6Km/3V4/1csk3uU=,tag:COOKvLedDUUSESPbLghULw==,type:comment]
+    #ENC[AES256_GCM,data:XLW+2RIcA2x8TxWPBDsg96ET3A==,iv:5m9kJ4fkX9Ad/cGmhd+HFYDnlbR0WKf5IySCut5ny+M=,tag:o+o3zgCV7Zg2iDnkq2Xxcg==,type:comment]
-    #ENC[AES256_GCM,data:HWgsQWIO+QUq25U4NOsLv8O5iY0kxDQQgfgeQVi1ky8BqSxwcsRllRe9mN/ep75G9efh+dAu6ksjGPkpW6OV9RPjeKHnAMYlR4uW5RoCiAMs8nNg9GALKxEJqPQ=,iv:Ev3t3mu470qUXGV53UfgXPa2/CC9xLSZ2/3NxlHTK1U=,tag:GlCHghE2LjSD4MaoQMDZkw==,type:comment]
+    #ENC[AES256_GCM,data:DmUef5KkGM3FMueKPiT8fXtm+F2ZRFc4ou1Vd0K6OpN/jx/1m7BaHZwZTH/oSuXB2KI3dvYY38l493tq7g8nm+Qhy8b+Im552d85zVhMaHzAITl+8HWCWh7Dzvs=,iv:uriaxruqgZpC2zlnDHxJEatUItYaSGlTH28CrlkNLIw=,tag:tM4/3QoZgrcsvFOCfjrlAA==,type:comment]
     #ENC[AES256_GCM,data:HA+G61zjKbR+vCZy375gSLKTKq1NVXFp98OQfw8xuRSQ7gORdBySz+T5BOlL8qghLMxE2v3NEn1DAEOnOaVamKGX+779,iv:4n7eMR/iomFLZnvTQvZnUjVs3ijMFfPkd07za/GSVBo=,tag:TDTV++U4dW1wxnIkyhK2xA==,type:comment]
-    #ENC[AES256_GCM,data:6ZR3YV8WwAxmqBN44C1qM8HQD6yKr6edBzpgaMeb5rG8h++8cOnNALNODuDTB1JbbKrKEK5VloQLOTkp9HR91d4EqOqGBuWY3JC6Kw==,iv:gD3zc0eWj3RXMo0gKZrJhP9pbzhxO4eDdYSeO+lkcPA=,tag:zi89YduEVIbZrRWEYJvPOw==,type:comment]
+    #ENC[AES256_GCM,data:ptND6+bXmJ1OQ/mCjf3Y2UbDt6tweUEvprCRkGdV245wbcFrkQoOQqVrjSIK1RcXA3t26B+WdFH7sbCtBN7yaXSqDVoegAv5o4G0Iw==,iv:8wCLczB3PBsSC38wETWTvLuUJaTKeDhrsvGhZISzVuA=,tag:yVQCsGfgcNxN6NMxxrw1pQ==,type:comment]
-    #ENC[AES256_GCM,data:6qC0p+pqmrOHzdjESEJ1u3df1g==,iv:GEd1dc2X7TJXY1mMPF7FYUId6VzBuyWFWEKAGFsn+Jo=,tag:x4BqTrZZIN2NpozyPv+stQ==,type:comment]
+    #ENC[AES256_GCM,data:+myuWXIcxmn61E6XaWgnlSfVxQ==,iv:bz+xeXv7EEYebkhZL1WXOF+LMfPKZSMHkmrzftD3vxY=,tag:xYjVW64r3FzU0K9DLtzrCw==,type:comment]
-    #ENC[AES256_GCM,data:dK7BilFOF0HPC/Iaf+NZNS3CFNIZHXvQcwSnZfNxbLG0ezmkl4p9Ju3lyZlVQXYrUaTfoDgGnzfqlbma4jI5wrX3v/qXjkuGs2rezu+6as0=,iv:xCT5VXts7Mj56tufVd5zzk3QPaqJvKJpA5aUSByWNdM=,tag:Qvw8e/sBvaaJnYv8J6lVjA==,type:comment]
+    #ENC[AES256_GCM,data:Dsbv+LaiZ6I59yBSH+fn0i8yfFsc4EJy0z5XI1n2hRLwNi5wcQ0J2GRmw3pkm+BrfhaUW0W1UY/5gR7ZpjpScDr+qZK64rlSc5f7uSIu3iw=,iv:4xT+i2P4nOSlg4/EGWMdxgw9o8Iz0KJnnHDHaNaeuF8=,tag:9aaaFoAxldJdVNh+fLr2UA==,type:comment]
     #ENC[AES256_GCM,data:kEKMkyOUvSWHcNeYHjE4vAKvKONuQsqYkoMHMHmL3MiBbTyAYNUuF+yTDmo9tT0TLM5QQOKDSRB6t7kOeh4dUt4ISbVkR6gPZJRis9ExqcgisFi33g==,iv:vkbpQ7uASODmofOLM7Yi3Ppo4NtNVDgusc3cnTfMCsI=,tag:kzw0ZY1c4RFyA/8cljQQvw==,type:comment]
-    #ENC[AES256_GCM,data:gDaLSfgDm//OvIn6t+U3u2C+TGH0PldQTJqoD+8m4cFA5wb17/OryUvbeh3R0Ae/tJAHnXzact9NyXIKt3RnFOzEicS7CqbX4qhgDEAxEWThiRzE1H3sbitKKHocO85VjJLG+lO2LfU=,iv:1rdVK22n+2GB66pb2kgqjcCVbzDXSO3B1B0KphXWRpA=,tag:9sSM1hrKLnmFpqZX2OTUiQ==,type:comment]
+    #ENC[AES256_GCM,data:56jWLPOT6C2Bvo6bGYapK5D45j1mZtCl9vHIF8GT8Id3HUj7LDssvTarZLl6o3KZPuWONkdC7j3fXVTQTvjoQJkSe69z/aCjs6jbBq5rZDvvFHvgVv9PPPuvDo6txGUK9HGkrFI84ls=,iv:pK3LR+9gMg6L153NbLNczlSWOv97ZjtUrQfQymHuPBY=,tag:+B9S8D78DAg0+63n2cP3aQ==,type:comment]
-    #ENC[AES256_GCM,data:lwcUpW0bw8nbbHjZ6XLZCpdEzs86Hjhr/FEGrDNz,iv:ESaH2Lv/+2lzvwbIDRWVM6sLNE/CT3K96wNRVieJBEw=,tag:Up16ZyNUMIDqJ1hG3Fk+zg==,type:comment]
+    #ENC[AES256_GCM,data:sAfrqnGUz9HqM6PClTMlJ6p1Us1iWPzZLIReefFe,iv:nwywtfwQuFESdx8EkKfRzZcqzptme85VP+my7E2U3i8=,tag:2qAbhQq0HnPFhuKjVBi8Fg==,type:comment]
-    #ENC[AES256_GCM,data:3NmkMQ3QvDdDa/opEe4tYoGC8wHiA4qbjT7aZBoSns/uuGF81Q==,iv:BIkPayady+JBLVzLAXBgCiUxEBMRo4wK7S1+IraG1BI=,tag:2wzDQd96k7uSCQYtpFTwQQ==,type:comment]
+    #ENC[AES256_GCM,data:WCx0kGsSwfvIqcfQXlrCYCI1VugNBWsRLj6/pBksZSD64zxnAQ==,iv:tFrHozpJ8LCIu/WLS2GclHGxAuoNSoWc6Tk5q01Ru1Q=,tag:tHuaHOAYvKCEkTt+bI04Tw==,type:comment]
     #ENC[AES256_GCM,data:sDNHBt8ksKCivezDy+JvkQ4cdFTuHLdB3i25KT0VrciV,iv:ZHK6xtd59c0nFM7L6mOYY7YhU//1slCRYeS8TleWihs=,tag:TnbljzWk77p/rjbynrpCFQ==,type:comment]
     #ENC[AES256_GCM,data:XLW+2RIcA2x8TxWPBDsg96ET3A==,iv:5m9kJ4fkX9Ad/cGmhd+HFYDnlbR0WKf5IySCut5ny+M=,tag:o+o3zgCV7Zg2iDnkq2Xxcg==,type:comment]
     #ENC[AES256_GCM,data:DmUef5KkGM3FMueKPiT8fXtm+F2ZRFc4ou1Vd0K6OpN/jx/1m7BaHZwZTH/oSuXB2KI3dvYY38l493tq7g8nm+Qhy8b+Im552d85zVhMaHzAITl+8HWCWh7Dzvs=,iv:uriaxruqgZpC2zlnDHxJEatUItYaSGlTH28CrlkNLIw=,tag:tM4/3QoZgrcsvFOCfjrlAA==,type:comment]
@@ -147,7 +165,8 @@ machine:
         #ENC[AES256_GCM,data:yU68IcS7trR5Joyqc3zksDyfU9458vj8b1P6,iv:YVugjGaZP7AUBNWmrHgc1hQ5cmGuaSUhYy4avjCGFIw=,tag:mApXub4sasAjBZ12iV9tmw==,type:comment]
         #ENC[AES256_GCM,data:5VJjCkKNuTlSYfkMh2U/,iv:ptHBP3LYzCAqJo6p9msfyddICvdnjmTA3OSpvFwmUj8=,tag:guCRhRMaLiAofP7B0MZCww==,type:comment]
         #ENC[AES256_GCM,data:3KVm0VrW0IyWuOoj1P2JHuoyZxXfbrqmgP8ePlHVP3nZL1xe9aRv3mAL6w3AOLshwXgaxzwUT4pxQcX9wPJxH/1DtnJmYBqeAfATWFCfnd8M7R/lU9HxmMexmgR60dCDpg==,iv:m4/9YWXuUcpZcRt96Q3VY2gw98vyWYPHjqKTA0WfvZE=,tag:4wfTddlgnv2bDwb4FyxanA==,type:comment]
-        #ENC[AES256_GCM,data:tnXPS5w8e5/lRjwrYJkU6OPqqCH+mf2GBddUm2yaY6oH97K8ywb3pWdC8jxY/NeWfqAaBqwY6gk=,iv:PiWujwikfh+hH+fyDlQvD+ZWVMr1paCf+8R1liQBOvo=,tag:2wuP2fUqzRxEYLdST7+juA==,type:comment]
+        extensions:
+            - image: ENC[AES256_GCM,data:vBxEKwjeSNKA9EijaCHeFvArxDK2J+H04Pv15DOfyDZ2pH9izA==,iv:qMM7bya5+bUB8RFuji6ybqdU1lJk5d/hqUv9hS0+B4I=,tag:estL1lPnDfuNjL08fHJYSg==,type:str]
     #ENC[AES256_GCM,data:VNSJq8NnkAKRW9TYkp+y474SuReJ2GJs4j51UKmw9WFmZukffCjRQ/TYS92SfOlc9os8BiZnV093hZ0qm4VCbgmMMKhiDU6/oJBNVA==,iv:4WOvOZwAKqrhTF+Hb3wCRdG1W6oVVZLXpfcPYmVtCiU=,tag:Q33bCAGQN9Ll6ZXg+Xu7Kw==,type:comment]
     features:
         #ENC[AES256_GCM,data:6nZTgw0VVHvuFRs/qeFDY6p/j8G+dLmavNoWD1GzRqLwIiw8djHBuCo=,iv:+BAuZV/GFePom55+fWRV3IY8dslh6C8vB3A+FN3A7Q8=,tag:9e0WgyBxME+BfplGUFPHBQ==,type:comment]
@@ -187,99 +206,93 @@ machine:
         #ENC[AES256_GCM,data:MBMHMUU0uTlw7/nQm3sizHDx2ZGkOOIWU/7OZyg=,iv:jI8sof7VoYBPy2GFbI14sKHbFrmyfvd6A6cYFxe/D4U=,tag:uQ47CJEXJjXnCz/+YeVkGw==,type:comment]
         #ENC[AES256_GCM,data:Xtr1NKrcLXvMGtUGNKsPrsrW+pzDAcLbsalxdvy+Sq8xYGhHxFWzBGSjNb0w0RU=,iv:S1XtCPzfSGOoTsXU0wf/++GcsJICxdhUZ2Hj0HFsyJY=,tag:H7ZpTapgy4/Fd91IlsLnGw==,type:comment]
         #ENC[AES256_GCM,data:KUIV1miJDt+6BejvAN685gPdYfhbRMCAyZV+wnnC,iv:9NTrVTw1fVksfOB4Ux/49/XfjrMtzAN8AARRVnL/HGs=,tag:ehvRmjAMi93BDEPCJhVn+w==,type:comment]
-        #ENC[AES256_GCM,data:ooUbl/xnzQ==,iv:3dgS9pGhc0kpalv5jcToAQZUiBWwGcRbnUCawYwqah8=,tag:Bjveskq5C8Ril2uTBpkELA==,type:comment]
+        #ENC[AES256_GCM,data:+qt5MEXvSCC/A2phlf/fenTNgDqE3P9lbYZ8661Lks4/ezYYs5jfFC6Ov6+ejAFqOF9965j/ta+EYTyLSJLKO7NGeuw=,iv:qzk9SHsKr0bMExvxkFAPdEF72slvUBYGO+lj5RhS5Uc=,tag:92NC5TgkmLICcD57A6gEiQ==,type:comment]
-        #ENC[AES256_GCM,data:fzKg9SGFczf/3+XiAvldHcyUnP6wLpNGF1xtWXc+GFBclMB5cPhnMS91eeKxH30aeg==,iv:qGsm3WUox1ULLQStTM/gEU5/6qG6BaXDp/3eTZqj0+g=,tag:4iooJVjHfKZGPk79Dpx0mQ==,type:comment]
+        #ENC[AES256_GCM,data:LahK/GpOHu76I/xw7x0qYVaPu51kgE5foKxPfEhO0BVVEQbbE1D5YeFpnpoJ,iv:hYWar0DXXVJE6JvaC9+x+B6nt1BzbjjzD+nxF/mXiMQ=,tag:R9haJtfeneW2TnEpEo4aWg==,type:comment]
-        #ENC[AES256_GCM,data:QU8VDvdx2nRpHWj/BexDEGi51TJcR2G7aRrp2GberJ/kR7VstXwIFwnTDz90UqcZOuOl4Xr0yNHanYzx,iv:iYj4ocR5/tmp1XpSjcQfZms7KyFyRhWhNvUEhSYGEy8=,tag:O/iVkPQOa6N8HYeClKXqYw==,type:comment]
+        #ENC[AES256_GCM,data:tfFjPC4=,iv:Ff/UPZ8bev7A68KPTsLVcgIkH3jMSAB3qMb7L2Gpyvw=,tag:LtCv6YAZ9DNd7RYLCT4wJA==,type:comment]
-        #ENC[AES256_GCM,data:v8zzsc0dwBCHqqxykje2u8wdMlFQFf/ViReVsBHu8pAxC0CtN25dejqSMWcFh9Ystyg=,iv:uRw/RyUx0QlMHB/rAJ4Aj62G89IUgKk/HELRM97G32M=,tag:Tg4JgiWnWNbLml9mzMH4+w==,type:comment]
+        #ENC[AES256_GCM,data:+zz4ofj0L7L+2mK4V4y0iQ/QFh3dvw2k/Ahd7VzUtHwu8LmIxw==,iv:kNUM2+xd067NT9IiS+V6FfoZP0Gji7TL/xlMdfyne6k=,tag:O5Zg6N1difwGv6d/IY9fRQ==,type:comment]
-        #ENC[AES256_GCM,data:e4wSOLF2z0CF7PqLE602X/tb7u0m17T8YRz94qNok1kziUdDlG4Atw==,iv:5E84f5gQ8a8MVozJrxk0QcUc20Qp7NEDotnlXgRtti0=,tag:eccsFhoAz18xhYqMRqPUow==,type:comment]
+        #ENC[AES256_GCM,data:oqW1VGw277p2uQHVW3JNMxV2AXeTOWzTES3ONagUvhA1QHwKkXA=,iv:DOFix7Z9Qh6Tr+tToN0xWEXpQ0WmL44CXUlfqL6cD0g=,tag:uuOO82I4c9/i6hjUaHmAXA==,type:comment]
-        #ENC[AES256_GCM,data:O8pp7A41EFjB2ohIeUF1L1fb6iWBWwM0wfxiamY5gWyrtJe49vFkqEnxR33STB8TWGN+hEf6byxwABUcg968AiaO/yI=,iv:EFDpb4RuY2uw2vw/mnnqk8HmWsbX5X8KMtBgfVmn4Tg=,tag:43WwRq1xDpM8WzJx1Nc3XQ==,type:comment]
+        #ENC[AES256_GCM,data:2TAc1rVEZ6vaE0Z42qwGMULIPE7kFi0UvYqx/G7lKcyPftteYw==,iv:CjDRVe+Cc119Aidn1jLuXCsZ6UJMvS0foPuC4eHhmUs=,tag:Tq3ewpEB0uUkQgr4GGYbWA==,type:comment]
-        #ENC[AES256_GCM,data:HXxVHrCpvAJYyPMRIdqB/wX8h3Y9WP11GEZMG2TjUR0h/w7jgDbhanfYbsmD,iv:QQLPA+WUwRJoJHauSt0PF66QTFnvMETxak8+b7GJWqo=,tag:unZQ3RBOjRmJeYtqPBHxpA==,type:comment]
+        #ENC[AES256_GCM,data:tfFjPC4=,iv:Ff/UPZ8bev7A68KPTsLVcgIkH3jMSAB3qMb7L2Gpyvw=,tag:LtCv6YAZ9DNd7RYLCT4wJA==,type:comment]
-        #ENC[AES256_GCM,data:kbo66UE=,iv:MQeopD8X0vgGcqNmSZq9L6aeV9d2bAnl9nvM4j7TSMU=,tag:S3mvTTAaHflxcPBHozZUQw==,type:comment]
+        #ENC[AES256_GCM,data:88LO8u2oNF+43Y3+bMphkI806Alv73LhIjFTmr6CRpgPH4VroR4=,iv:n/VgCjulOKy47twtZra5WXADQCAynIdF+vh5u8EJ1L4=,tag:z5WgIXhqlYKYimk0rkfk6A==,type:comment]
-        #ENC[AES256_GCM,data:KFXrfmvIPJyOWFhiAtMZfV2ZnnwLe+ge52ySossIXj3rgP/vAw==,iv:OO9/VFE/ZB8L5dgfK6dwyTGLF5FBJaOmK97ILFD8t6M=,tag:mifp7jfBPLYA7l0YmIYdaA==,type:comment]
+        #ENC[AES256_GCM,data:IygwZLPYBPSi68mqm9mbbliOHuN3IbQA7rpvd6uhGpto2DGJmcq9T7s8H0mhwf6/Wr75tyfvcAc=,iv:ibi6N17GeePDhzxvLYLcwtwgCyQLUhCUj1ArCu4gPZQ=,tag:M6ve1OAM953mzfyaQQCPKA==,type:comment]
-        #ENC[AES256_GCM,data:h1VsFeZOu7hZZARpUql0ug9bSVQvSndqig+yUrC+hfDyD5mZ38s=,iv:CrSlvvXzTljdKZt9EunQ1F7SF8HnLHVC89oSjzXEJmk=,tag:q84Y0kSkKATUtwOR/jsdGA==,type:comment]
+        #ENC[AES256_GCM,data:tfFjPC4=,iv:Ff/UPZ8bev7A68KPTsLVcgIkH3jMSAB3qMb7L2Gpyvw=,tag:LtCv6YAZ9DNd7RYLCT4wJA==,type:comment]
-        #ENC[AES256_GCM,data:VOEDrWBcyWYQ5o5vVQcmiwB2AC8NIJltz6KrTOphibtqPFndmg==,iv:twYvJdqQsONt7C8tjXGsv0BmnU1CesPuhpObQp6+pHk=,tag:s58nldcLUpEWPUaVgFlwhQ==,type:comment]
+        #ENC[AES256_GCM,data:KIoiLcYxTtjXoeU223Hk/EW7TmFWQP4wc0m1Oe4QhS//fs8SExF9IYIrT0azCWLVw2fTua8JFf11VbkxnWQ=,iv:gixT3PyhStZpvsfHaHoXnuqmQKuRh7g/HGv7WDFHMW8=,tag:NwHwvPzKtLry6UQqC8Q0IA==,type:comment]
-        #ENC[AES256_GCM,data:eqrRuek=,iv:rhOlhKz+m/NEu0AdZlR5Hr7zMEbJW7HrM6b1vUvBBew=,tag:+NXUJW16aEVWJQBrP3CNYQ==,type:comment]
+        #ENC[AES256_GCM,data:8PZjgDxFsC7hK+VcMuBYbtGqnux7SvlyOiCw+qRBTz3yVSswJSM0HURjwljKNIoPKA==,iv:CFBHZiduwB0KXR88nE6Qm0sqk4uDafSAnzF4ndhoSK4=,tag:6ABsiy2VrpYfIZ5RJd4XHw==,type:comment]
-        #ENC[AES256_GCM,data:4iharG23u/6nmnsU7G5jCiWGF70T3RztmiS8aBd/CLLND5mVfxs=,iv:zA0K+hqQXKMsq3EwZuXfN2T9UgB+d5W9MjyZexfnzAQ=,tag:0bsb+R7/Goa60zPeGNj4/A==,type:comment]
+        #ENC[AES256_GCM,data:pTT7Ki8tdwVTJAPwj8XqBnfcsRJWGVBvNivWYG2K1ppyWWO+svMZRo0DCjDsFo+BKcKi,iv:Q/CYFlVYY8Ok6euV4MRl24/etIzmwdJuwuNactlaFSE=,tag:60QbYfln6LeyCV0roOZTqw==,type:comment]
-        #ENC[AES256_GCM,data:DfaJWTpRa1fHjERW/2Qv7f8qg86mx5KQFDQ/YrtDvfJop6Qn4z96Pu3SHncd4Ro5+psFhro8VYU=,iv:CLhDd4UJ/JUA/Fj+h/aZJVUo0iIgbfNhWPetjbdFmJs=,tag:8ISQaKNMu4K+oZLZ5BEXhQ==,type:comment]
+        #ENC[AES256_GCM,data:pfIgnGzF,iv:NPo8UN6qYKe2bjn2G+iK8Gx4G3kJdaAURpU8BF6FHBs=,tag:HUbkCf2XLxAE1aZZHe2eng==,type:comment]
-        #ENC[AES256_GCM,data:N6Lce/4=,iv:tz88vmG1eYGhzlQ9mkj8+dUFsWLOQcT8wsxvEXUQsDc=,tag:+CJeuK6fPmOM6cA8HDrLTg==,type:comment]
+        #ENC[AES256_GCM,data:DSK9N3VeqByxheEHQt4wg6w03iyERnLadgyCfZ+wZXOUUqbyAVoA/3TdWTXZwUrUtTA5xM/VL/mUSnSjNsxhw4Fdj49jyYfl3A2KODuVzXFk,iv:Dttq16zKpp8onCSYqWkQk28a/Nmp9kHL/h+a4+2HEnk=,tag:1FsQ0pAWEo1OrGLk0+s1wQ==,type:comment]
-        #ENC[AES256_GCM,data:vd8/Mo7cKMYGV6SJh3tiM6wXKVjQOY5Mab50HEcdRMHf40OSSJFVf0IkF7wcLTtUIglifK3AUDWwPM4JCfY=,iv:qh6VHFH17h1JjK3bC32ndxuBQFt/Dc/H4yzpHnNseKM=,tag:e1wRr0g/5nIPmo2tUm/Gdg==,type:comment]
+        #ENC[AES256_GCM,data:jculK3k7wxLq2QjoR9Q+gE8stV0DscidD/wK94peF3lB/QWbojrD63vCiASUo3AL5catkTE+EnDSuxEssbgB9kZPpaN7U2Y=,iv:+9OQvawBOrmlqGuMbPpibyk+fylWN1dOfZLl3Ve4Uyg=,tag:VJzs3lbD6Dd+ZKR33BiGDw==,type:comment]
-        #ENC[AES256_GCM,data:UJ5CH08e/xoe7GpYGqu4BTTPbE5zVLYzAkNhA2SGI2uw4LHvmoQC5HamUCSDKNNlGQ==,iv:J4IKVYDvTdwc50HUK1IQpeTvSIOwQaJKHAuC0Lr8qwo=,tag:12yYVFMDtf+xHEtQLtfEgg==,type:comment]
+        #ENC[AES256_GCM,data:LeV74IOb+Q0VO1MIQw==,iv:aRSb5jZZa+2e08We1sbKMau1UIzseNoIgA6R/7vPoJo=,tag:9Ri3UUtT1WxXTvYdz5Dyeg==,type:comment]
-        #ENC[AES256_GCM,data:0/Boe0pnC5gg7uKJ7CNN5DxE03RsqxU3/kwbnQVbiDG8GPdkJnRKXCUsex37dz/tBb/z,iv:5xve8bFL7k9L6UimjxTPrTUv+OG24HFx4sxcwRJGIeo=,tag:HQ/qT65mB0J8lxF1wZYybw==,type:comment]
+        #ENC[AES256_GCM,data:S3UxK00sr0sj/HPcBpVg98Bv0FrldgCBL/KjNvXc,iv:FTYA7qp0vqR1kEqIoIZ011hAcJwDHGaW27wHrPbn3vo=,tag:qcrbUJNIBLZqlbDRcUL4hQ==,type:comment]
-        #ENC[AES256_GCM,data:1S6MVlMl,iv:E5kXuk6xNoJdfaBeSP8rDPU9gX/JgqMIumZpUWUFgqw=,tag:eKP6Bp1tUDrHPgBWuDX9ew==,type:comment]
+        #ENC[AES256_GCM,data:H/1D8zsL4taIkGG/3w9EPqpfeCy2FTj5yCS73gUMvh2hlHQLUK/CIwcXFKAZpN9XiyzbvLKaHokInpLUimGveJhxwhSMzHFpGqBVZ4oQpten66aa+XVuUTvdAg8GqP6E4r0zIisAQ6hCfuD+mHH2nxYkM4yyJDEIhIY=,iv:SQoft3EzXpqBZP6yl6kV0JZL7M/GkcqY0IzeMkG8c44=,tag:vgRMiM9kWIarG8hw196LNw==,type:comment]
-        #ENC[AES256_GCM,data:YXwLX2VcB7pUnifKaipgQ79Zwq36tCC2m2srncNziIbtEvQKFuT1xmjCowV6NFYQX8UsbHhgLSJdKyvM0WTu9c3HUyFST70zU7RrtqS6EYni,iv:R1rbhfHZIrY71FPInqc2C5PHWyuH1S0URsCdLUrBJJc=,tag:YUOERnud9dD8eeCIH7sCQw==,type:comment]
+        #ENC[AES256_GCM,data:pReW95Xrc2BJTC1xAKJZMWZX53dMs1DGZq9IOzyUwzD758rTXKEviKcY/g==,iv:dWRKmox+d5sdVxrJLNlLxJhVfjY/QE/tUgnkfoffWAY=,tag:YEnFcGipQnC7BkHMzBKDrQ==,type:comment]
-        #ENC[AES256_GCM,data:kGzGwJ1OwZHThnsixn/Q7homoDZhMATxVBWk5Ae8u/T0cqfXPXA4VpR3h2rkCwq9Szh7Jwj5lGUf/DIrapIa7de/0amgVpg=,iv:aX9C0aPUuPVvMLZHRqITwtkGXAkZagh3nuoqkhti7m8=,tag:ga4Pt2EQ+A2qna10AmbPfA==,type:comment]
+        #ENC[AES256_GCM,data:nxWclpF1oLBLBd/BHTTf+PR8kyS4eKSXxWBZshZzMvg=,iv:BFthDsfOqVPFtnIW0NfeSHyMgSY/+7iTw8BSvV2v8rQ=,tag:5txPD7r80yQ+vyTJK737Bg==,type:comment]
-        #ENC[AES256_GCM,data:FPBAsHVay6kmvYTD8w==,iv:OqLTXZNj3bwzlJuUEfZLQmM0KunWkXkiCMJlgWgexr0=,tag:P5zA5O9dufj9iJZBW/HB9A==,type:comment]
+        #ENC[AES256_GCM,data:ZjbdgPP8TmHp5E0KmJP+c37L3CGEgQQZMsCHDY5cGjxX,iv:MQxMDDbYTm7ap7ahSSu6tW+dsTLR+i6nb7VdL+cp4Uw=,tag:EHxKNed6NFD4M0mCzVC3bg==,type:comment]
-        #ENC[AES256_GCM,data:Mb6fQqksuAP9HsC+bWC9wLrhVBD+9eQ/Nxy9VNu7,iv:QKs8xecrtc1xRiEzAumDSXfDy5vLrVAo/MFWq5ny05U=,tag:y2svJp6vufFPzGJcVej8Lg==,type:comment]
+        #ENC[AES256_GCM,data:vVKs21rS6LIFhCaSFYoC0h8dpjq8FwTGLBNB8Hs=,iv:8vfThDRUTI29QB6ZIkPzwc9dlIjn/F9uVIKN9ajA81A=,tag:FZYQUf2ds9wZBGD47nEebQ==,type:comment]
-        #ENC[AES256_GCM,data:jldvHO/cJ1ALXrb3c46jjMs5WVZd+vVSh+Z+J39iOnyYnWyuMqpB6w/lkISfR496DBYKaNkvUuzgPnRhVsXul9Neswe0pP4QmEQB4Rxje5+1/hvnOogVpcDQ9OkaDTDt3gyf1EBILmnpGqKdeatQjfN14L9TgfKLGKs=,iv:0R4qrDTgZJHodm1hO5s3lxnI5avgmx6+ZoldTUu96hg=,tag:gfL3/ymA/ISmui4uBMD3JA==,type:comment]
+        #ENC[AES256_GCM,data:n0kgDjU4XNo+knVSCFvH8bFtsiJos5qnpQSEikJ8Hr205BUHJ3wjPCM=,iv:+GBNhBtiWPlr9HziMob76xA5uOa6EhuEYRg86RkTPAM=,tag:bIcSkfE9AnMMYVLJNmFxPA==,type:comment]
-        #ENC[AES256_GCM,data:i7tdXE7SHcN9h4UU6b4XYCc18NCY2dCvP8aLH88VI6LJ3kMUtPzIDL77aw==,iv:BLS7OB51STSpIhhhIqZfGDK4iTw5KpKDBMdazte85mI=,tag:kkIUTyRdMLZ6+Efr2EG0UA==,type:comment]
+        #ENC[AES256_GCM,data:IkPTZEzeV0/tFBb04DFQ+ZKhq+PoWSHh19iELphP,iv:ejtG5ygsbs2e+1hE/7nRWTegOG13/oQ5z2fhM4n+cM4=,tag:4bpgVfLj3ywC9B83vVuS1g==,type:comment]
-        #ENC[AES256_GCM,data:zVOFsMMRbZcPOU79mwINFDQ0F1uAr4aYQIMO9jDueBg=,iv:8WU6pXu5BX/CWKjLmDMX+QFXT8m6q/Ukwjpw5O+6VdQ=,tag:gOTaCRaG4vbXgIfDuAhMiQ==,type:comment]
+        #ENC[AES256_GCM,data:CdAaN87O/Q==,iv:m4z34JA9E7rWpHDNXHHb8K4ieqIVLEr47yZpZRALbI8=,tag:IrQmFMMvYZ2Z0Zfuh9ajrQ==,type:comment]
-        #ENC[AES256_GCM,data:JR6CTLWZl/Kz,iv:pR3jN4A2hhP60kty6Kx0Sp+Jvo6mq81nWa4SGHCV3Pc=,tag:HurVtXEZ9tApDEzOSXR8Og==,type:comment]
+        #ENC[AES256_GCM,data:zYfcIE88Njr7TMFEtwmEnKevQHxoH/tzasf357DvlF9puVPDO5dVaA15AMrgZb4n9Hj8DJSOQa70Q+XIaCssUG/p,iv:1SBikL6u2neDhnTfXz3mPhCs11JNvtmDs1w7BsqJvck=,tag:ZkGrp+B6n+UX1JWoOMDDrw==,type:comment]
-        #ENC[AES256_GCM,data:O5QpZvTKUlIYHKO6FrBnK/RJ9JiPGl13MqsdLHc5xeZP,iv:tcEz97r2KVBHKLXXHDDgNQtzEFPfguvrb9rinSwySVg=,tag:5J2cXuSCq3vTAfTbicb5Tw==,type:comment]
+        #ENC[AES256_GCM,data:8R+TDiEE31K++lKeJbDLN/6noSq7kKD8NIY/t+xwZ0fgkP13lVDFerAibUY/2Ko2BZ3I4w+TuH0+en8I5qGox6qtHjI=,iv:aLGjXL9RDVVmE3JKeDjiAF6cf7upE4VmqhhGJt5sKhU=,tag:/2QZgxi2a7M+9M4iROYnTg==,type:comment]
-        #ENC[AES256_GCM,data:7hQA5mH2++fC/9pEPyy8Kj/WvSyVPT1gfaRMQQI=,iv:uMPTJjiw+FdJ+PR97R9N80U0lJCisu7BS61Pd/8NWqI=,tag:/3X+e3wjsC9TgIVNVp418A==,type:comment]
+        #ENC[AES256_GCM,data:c+pxgoSUiy1Pdp38,iv:Ck8oqdcRjDDH9ausiDOrwppsxTaqbXe5EzywraStthQ=,tag:/99jhwynYkR53SwdozwrDQ==,type:comment]
-        #ENC[AES256_GCM,data:VV4VLZlJHRvmRNcGHXOJkl6v7WH9e4ZExswoGHILS4pbrDTgoIem6CQ=,iv:g7ZQoDKoH+yQ+m//byaXT7zUZdBPJ5ney+7LtjM2sIY=,tag:Ai/PxNQYQES6538OUAF53Q==,type:comment]
+        #ENC[AES256_GCM,data:un/hvK8hbpIVQumcc35djAJmCBXW+m1a9BqPMj9tzinjrThXDbw0YzbhSU38NdJW6TA32Y68UK4=,iv:Tnh/vAZ6MfkuyZX2+08rI43dqP5qsek2+csoqwVw3B4=,tag:12Z1K8BYmdRF5ZRhGtOQoA==,type:comment]
-        #ENC[AES256_GCM,data:TzJ55vI3i4FUwLNS22Iz10YcwP6G2n1qOjx4V6Bh,iv:sYDoC5azaABz3O4hZjflfr0K0RbB1N8r/8L1s5AmFD4=,tag:tGisma/KeJFDJ6aMBaRBvg==,type:comment]
+        #ENC[AES256_GCM,data:mGCCMary7XNIjVsq1w==,iv:qt1XCpNkAE63NEoTX5wrqApGMMu7t0x8bu8K4G7ywZs=,tag:zu4lxAVyUGAwpbekKDdpHA==,type:comment]
-        #ENC[AES256_GCM,data:T9UdZZAe/w==,iv:a8GVcbTBsq/XlYxa0iZSTIQKAmDATJ04Cm6s3TdGhIc=,tag:VCkVFWTw/F0fNt6EDbhvhQ==,type:comment]
+        #ENC[AES256_GCM,data:6lU0bgIKlpiA8fySKGLLVyQ=,iv:X4K3bqrvBA/NlLa485mC//As2WlT+dfRQfwCjAIvjho=,tag:q2JdJkkxaTYOJm9q3liBVw==,type:comment]
-        #ENC[AES256_GCM,data:c71m6+ItJ7p0d7RfVf/o9TblxNh87uz42LqQSoEQOjlGmIciSiOkFu3PDRlPTlH5c1SLOZ8A0JRLs/SJi4L/fenR,iv:VB3A2Xrq1JAHxl4w79MpkENdyUs25mXf4AS8bhRe1V8=,tag:FvuTFlh+0hGH5AEK26vw7Q==,type:comment]
+        #ENC[AES256_GCM,data:Ax2enwCrY551aPYEptV2HJn7KeaO3UbvWRAzw/LR2sZ/UEL6sypuncF7Qv3cxt4lY6DFDgFVvlxQGvh4U29Get50rN0=,iv:H2DkoE6mEyUfQ3XCG8K8/rzwPW34VdMvtqdsBUlRcls=,tag:nBAhIuLjX1RxZQM+20w89g==,type:comment]
-        #ENC[AES256_GCM,data:+D83NWZ3Ai5eFYuxja9hIDA4NRQXEJhRUpnG/YGGFuy25rovC6ESuLWivZ4uqOTeabj07/+JQTUb4CjnqgP3GB4QeBI=,iv:U48D42c1bUC5gw2jSMs5sM/hUr7WN4c2gd7Ju0pE2fY=,tag:HIicdTsnuBkdBf2tg9Uqkg==,type:comment]
+        #ENC[AES256_GCM,data:JWRjbhF1vTflPmaWZ7Sz/VNxP8CX15g=,iv:RhzzPOHROlZbOU8czSwkHduUOSxx/od8ohTOKvwMugo=,tag:5eu9xqZ1UQf7Zq/6dqIepA==,type:comment]
-        #ENC[AES256_GCM,data:dhkhplcflc1qmofI,iv:BSv7PS7ce2O/C84WlgebE86CVA2liPFJ5+VSQmYQHts=,tag:SbH95ukTcGFHzFSLtlCCzA==,type:comment]
+        #ENC[AES256_GCM,data:9Xn1PTk87HBmc7mk7m3gOyjAt5PhZFqHnx9nBeBt0IIKHSoN2Wl/u0T+lB4=,iv:J0rMPnR6tiS6eNIKwFh6uexTx/9POov0r1lq82IJaho=,tag:/ZChWxYWnSE8jullUFgMCw==,type:comment]
-        #ENC[AES256_GCM,data:MJV82Oz8n06WD5qm/ym1hUvJ3AtURmX2khDYN3kDj6oircw+S5IrZY539b+1iKV0+uw0ZSSqA8U=,iv:faxwlPhpuGFQWY0Kr8HuzqgJlHvM8osFFd/aCmVdkkA=,tag:uIckpqDqUxJJSa5QZzSEmQ==,type:comment]
+        #ENC[AES256_GCM,data:sxuZXazEK97AUz2xXhS/hZhWTyYNHTH3qzYArDpnU2+qSvGlYs0=,iv:XZzFOMg/3/gjIa3Op8zOS5vGfj6z5jcVG2uc1NPi0J0=,tag:hQIqkXYWpDQNFy11kjVgMQ==,type:comment]
-        #ENC[AES256_GCM,data:phWTF7k1hrY98MQgdA==,iv:xIR+3sZV0ipGUId2W6g8BrD1U2uozpmd/jWDaXDgEog=,tag:6ovyEYoFUf9qIKBY2jV9FA==,type:comment]
+        #ENC[AES256_GCM,data:RySqj9vjTtjpd6ZwWUHhmzfarxGYqPD8KqY0ARhon2JolnRSQNal/+kydvNsEE0Wa0q7g1thqzHy+MMo6qy4fSfX7DJw,iv:JTTgp0fTICZc4KblJOmviATtPVI2MT35HgZv2ws4gsI=,tag:Y/JMzR7tJ9mr4j9EPVr+BQ==,type:comment]
-        #ENC[AES256_GCM,data:yTSrHO8UyfC8fZHVBlGnM04=,iv:Cc+LXM0wYC7T8a22MgfuIwjyhU/AsR6iSMfBCh2ky8M=,tag:uQEWEjtll/Ry4rjMfGlnjA==,type:comment]
+        #ENC[AES256_GCM,data:OZXBW1EMahm6O4N9,iv:bYOcvClL7RVB71n6/n4s7lSfCwCvV+HHtw5IwufRd2I=,tag:nV5/QR01dSJZjY9CE//J0w==,type:comment]
-        #ENC[AES256_GCM,data:CcAREeIx6u0ObZJw8kNi0v2bL7D4lhjxyuXW3rIppwry7LWEykaCngEUymdIGqtMygyOo7q6FX9A9g29mFyiVgS6T3o=,iv:Y7ThgEhQkaj7dEes5ruruA8M/YLGq2N1C64uABQlD44=,tag:1oRk6F/W59ZGDsHYcNzMIA==,type:comment]
+        #ENC[AES256_GCM,data:mqMK5UEDZO1zxv7dQPjWXl2H1O5zQv4bC2hq,iv:yupcK9f/OszDivmcgR1gGDRwlyaLLUVlhxSpWOn9VEQ=,tag:baOkNQ+WVGpyJ+bwrYMwQg==,type:comment]
-        #ENC[AES256_GCM,data:UhGOjBCr21uUH9pejyKsghcqBBczJEY=,iv:HQrniu25QE72WMTB/a8ima9veF/6r2l3wUGUnN79gYo=,tag:tD9VZLUaCYLKdWSdfK5WRg==,type:comment]
+        #ENC[AES256_GCM,data:1DXk7n0DMOZuZh8k6HjAZnCjb7496vjUo5SsvHAzYAB9mdIevpsdivCTSpf8VLbeZjhSG2sG,iv:768qpMmLdV4LQDL7i3PGiTIcU2553XUkdV85kFBhk1M=,tag:piE40pRJKd6039gOoUDdrA==,type:comment]
-        #ENC[AES256_GCM,data:0jMYZhqvIvc77xVq9N4g/ZWy+VCeo2sZp3Ive+DVsSrds/ZPIJs8SCtm9l4=,iv:qU7timMELaYzy49o96C6r0CF1F7sMgAeoUcT6wQzrG8=,tag:Jt0J7OaEEaT4qXENlWYH9w==,type:comment]
+        #ENC[AES256_GCM,data:C/kSQgBm9rWJFicG0yeciNQ=,iv:Ifi3d13pHRhBEmmpORkUsClrSX6WhpDU/VPs2AnNWmg=,tag:CHXE3nki8re9i6ypdWgEOg==,type:comment]
-        #ENC[AES256_GCM,data:Mz74F3j+buGmRYHb0kvBdeqS585AZwEgZCwtAgi4z2VeSA8W+Iw=,iv:tZopOL21OUXD49k7j7A8btmQA2w/Z4GvotfmcYiK7/0=,tag:hMTAMmM6qwPIgqX3xtYX2w==,type:comment]
+        #ENC[AES256_GCM,data:1kbqsbMYAyECm4PUh/x1HE6aEfKqLUWn7PTFeE1ZWbjuWC0vbgipWrmF3ad12/EsCbwMJ41/OtvprzfX3+qp92DO/4X0sMLIZGddxuoUR+vUinzQO7aE5JB+RxpHhoZkwL50I3HwUA==,iv:FPr5J5l49EnhG0Ej48WAANR8tZbxwza1/DfoxFxYe8E=,tag:fMLpQuVwviYMppiPTHaOAw==,type:comment]
-        #ENC[AES256_GCM,data:HyjnRDnbuPN7JR0DQZ93prFDomwNHLTDKF7C9RVsGuhX8QqRXtKz+yTqarNYLJ/O1uKjCENf3namGXTZjD9ARcVFAEXY,iv:CI0bT7NqY6E3gm+B7onvK+7p3xuNND80+i4d6C8OzM0=,tag:691PsWzSn1pQi6XlNNo6MA==,type:comment]
+        #ENC[AES256_GCM,data:dJh0oCwV8dQHLC6h3zP+oK4=,iv:YxHgfILRviyAur0IcaKfCKvzhoEIPel3NugLOIsKkP0=,tag:Eu92hhv/4ODJ6rbwq8hrQw==,type:comment]
-        #ENC[AES256_GCM,data:TG9hVo0ikPhIh7Lk,iv:rghHTL7MCPREh70F+rNU0xPpwHe1ePyStNG9EBGLMqo=,tag:GoPggBpQbgLiWzI6B5eXng==,type:comment]
+        #ENC[AES256_GCM,data:0lDLVDXIw8rn4TY437jRn1wjP4wiI6y5FNiiw/rgCjT4I6a8iPfV0Bl9NmjHzqnYRHpkUzVcs/lAepcfor/oJSp0Cpz6T5t2,iv:f7DMAr+gfLiBE5AO+H+IlIL6qN5fwpMJY9P2bInHSs8=,tag:0iigJzKmkwX4vdwCcUrokg==,type:comment]
-        #ENC[AES256_GCM,data:twpqHyU5Js4NIsVqKlSlR+N+cHwDsYfj+3qc,iv:00qF0m9cpDEDimO3D5tECMpuKwXjrywY6rueu45/sPQ=,tag:Ib/Xkft0jaEA5fRrs6SORw==,type:comment]
+        #ENC[AES256_GCM,data:49FPDIaA9Q8iGwKtO/qWzG0taetmaVeBJnNkbVAMSk5QdQ==,iv:ZEUQxD1JIiCLWzQd5MaB8+8vG7YifVN4VxPqNHT3v8Y=,tag:bI6Ro2oB6B5piQe/ohg1SA==,type:comment]
-        #ENC[AES256_GCM,data:yhpF8urLHGh4us6tD9MfFMVLCQhZipxtkKtflnKRJw09oV/6/CSS91RfVG2A9gvTZRrGeYjC,iv:gmjLW5WlZZ59i+TAm9IlOoIp8urR5Bxm7BBvXmv2mw8=,tag:oWnIhM5mdG7KRha9yUv7kQ==,type:comment]
+        #ENC[AES256_GCM,data:09CIYAcrW2/nEkpQwppD2U8hsoj5OPBZN6uhCCICpG4jTi5L63IsijHWRyXNX7rT1jY1c0biGwoVsXWWEpep7g==,iv:B9P2mUCUPHyg12Iaj7A0883YrphaSDdTc3mQcEhwK8I=,tag:oXmBaPGcuUhhWP9bzqX5QA==,type:comment]
-        #ENC[AES256_GCM,data:nTrLy0d8aldsvogp81Xm8LM=,iv:hJRek4BnW52uO4+kdlybA43SiudjkzP80nRj3FIKY4M=,tag:hOvGRrNCgGcnLJB/DExTmw==,type:comment]
+        #ENC[AES256_GCM,data:UXkzp1DTZgidzlghwraF+rvPLtht/WMoMs/kH7q0TINn0kTBV+mDa3syr5Py5dEWjTBwqv4feuM=,iv:sSb+rZLF3tO+a9R0S0eReW20fZhBMrd9EDOku93tQ8w=,tag:amIXe3vmhdlChdxb4Zfrfw==,type:comment]
-        #ENC[AES256_GCM,data:lZn5pNr0bXxgXijgCFnCjD+IjzyLTWYM7/jyraPOEQE/hnQY5WiXHtlpDvQq8Uyjw1CfBeHk4/FHq0uty86pPQetFb4sixav1pcCWVuPkdmpjIkvOAp7jFM7U49xt7KfewMIxGCfGg==,iv:ng4ESuuY/hMdC4NI18zRfRaMx39LqWWNju79lJTpy7U=,tag:hy0z6nYhaCS1u0CiOUApbw==,type:comment]
+        #ENC[AES256_GCM,data:XBTpXyQlFI67ucFphw==,iv:KWcRf4GC3xP/MoCtC1/kU+yWwKXQspcvQf2lQx1mYrA=,tag:R6AYpqnnkxTtU6WhTjtEmA==,type:comment]
-        #ENC[AES256_GCM,data:2PlDeUyspwXLL++JuhFJTzI=,iv:fCdiPoaQiw+6Cw53LIRFlKeqsv3ZzeEPHfJT5uRJCC8=,tag:xdja+c7BFCstyINWsrPpvw==,type:comment]
+        #ENC[AES256_GCM,data:4wulvIxzncfcG3FLYOOd2eh4w+4l9p9he5svoKb0mSNuT1Calq22LxN7mFe6U2PnBNXBCDQcUlozYA==,iv:ZifghfwBuS8vnVVmJ2J1mAESFXBPw9c7iM9RQwyth8Q=,tag:0l91oJ/yfN/3qZtJ8uYhGA==,type:comment]
-        #ENC[AES256_GCM,data:rDUXPJ8UBCoBJEY2FsPgAqXcRXEKFkd7HtAjLMVJxoo3jbHmQsDmjBKtqAvrm/TgzRBTzGl3B/O2pVNFiQRFib+JuswwMGxt,iv:wNQnSUPb7lwPtwJC2CF3mGMdlbR35n7z7fumA0cLV5s=,tag:oLhfBJu9UqlQNojE3y5jEw==,type:comment]
+        #ENC[AES256_GCM,data:d29yS0zTqDo7TZYKkyPSjWOPJSA=,iv:D5naMksoKfpdgocIE6GZqzrfJb64JHcYxel95osbh5k=,tag:zfF/1FUjUMVQc49/JicGwQ==,type:comment]
-        #ENC[AES256_GCM,data:yWbCTsDZBDRLMH/2rpPSuMkq+K7YOhT+OWIY7jvC/Okm/Q==,iv:peXZL2YycMPsjwFVlHHVy4/ZV4NlRUoRmZPqX00YEBw=,tag:qvQ2UbDYa8UJCw+PNt5wGA==,type:comment]
+        #ENC[AES256_GCM,data:Tb9k1wYQli7qBhYK1IJkqS0I1hkakQsXqmkrjxvi7XUVDoKstGpNOxxL8RWAOIp5ggQFXzhBoNcwBr5B4ykjgrOJ1o3tzxwlXw==,iv:JH4ylNcqWIx8eSMzbAHSKo6KEyormDEUPAtm6KLQCio=,tag:2AGeYGqp6cav5sYGqrXbyw==,type:comment]
-        #ENC[AES256_GCM,data:qVd54KKMCmNn1kLOEclbHjpcVMQqS4Ni5QkdLCuwoDMMn0g2pDcmyw3Bs9LbeJFwV910mRi42NjoCkC80qCB3Q==,iv:sqPDYmP+FxmE5BEjYra/KqIGXRVnpre7VEABU8di/ns=,tag:0zRW9xqtfCMFQDovMNO4Tw==,type:comment]
+        #ENC[AES256_GCM,data:zT/2c5hLZKhJS5R1G2KOLLLMYy7iCTGJWgfksw4w4g88TUStWWit6OwJ3MDC1I5+TZhyDQC1r+jnW33oYoD0yoPc2XHCrJGOQw==,iv:nRebgGPzfEBQs5SoFO2mRg0tVXi61fTJpow1Tg20870=,tag:VqbWiRDjKG+fQyGi8NqvYA==,type:comment]
-        #ENC[AES256_GCM,data:9+gpJvIsS0LMaawT9ASPCHwGXhcBIXqGCdle9s5KiyUEwJEJyg3fqviA2XGz6sDA8CqCeK3FgTM=,iv:qkVV7UDPXynUDU8VigYVlhs5KUPj2q/uHkHkKISPKmA=,tag:S99ZX+6mT1XYFRety8dQMw==,type:comment]
+        #ENC[AES256_GCM,data:ye66GGkzzG4jWRdPYiwKp8puxHChXitbHfbGXrgtNJHaBrHt6JgsLKdDm6smXoAk,iv:it1g4imbWg79gr7drU0vj5eCpBL4WygH54TXZMK90lo=,tag:QpmFVYbdZkeSr4p3Hw+/Jg==,type:comment]
-        #ENC[AES256_GCM,data:hX/rRGylCHXUCKZdUg==,iv:yJvcnz+bWXyWgGxaRAuvF2ianSE5fvgPVph+i2KrQVE=,tag:nke4I60IBVXMuYXI78q/sA==,type:comment]
+        #ENC[AES256_GCM,data:n4p95jzIxdeqRgX5ifu1kIXQ9eZ2/w==,iv:grKDLZM/dz+AuhwWnP052OYHDKMI3GnAC14CgxQ54SY=,tag:H8eltHdI81X6QDt5Wqzs5A==,type:comment]
-        #ENC[AES256_GCM,data:5gmsDecR1mNsc1t8BENm4N9BL3LgYyCDsku14FcgWvprCR/SsxYfJRPO7FGfZyjjrELeCy62yFshbQ==,iv:bSZKISLo3/NLG5Gu/ruwcyGbrLdqIhpqpLl3j9iS+9U=,tag:fJcgtGuHZau+AoMy0WkxvA==,type:comment]
+        #ENC[AES256_GCM,data:a1dV5mz5Pw2gLKXrVYPpwEAkm7+hQ1Du1JqCLpVtf0/ra3iYk30=,iv:VU60NiGKT8ODUUcQ42ta5+ox5o6or1sSVAbjKHFX98o=,tag://foIM5DaiBNFjPpO6S2kQ==,type:comment]
-        #ENC[AES256_GCM,data:YpGhPYohd1HUG1UmRTsIrbYPuCM=,iv:8XKRJo0HY0xmZODwaoLNl/2tfCef6ab74SG6qX/cc3A=,tag:RdhRN6EvQDj1MpEH/oEs+g==,type:comment]
+        #ENC[AES256_GCM,data:XV/OuF7iQmSZ6F57PgRY,iv:2ZgawncM7Yr8MFgz1cLYMlqBZykB3imJeuRt7JfZUdI=,tag:uoKnPu3YVcKazPrku6/6Hg==,type:comment]
-        #ENC[AES256_GCM,data:WGyLQ+eXsa42kYURfKNkIcnLi6yhtnOGWQep+mhihdbFostfM9cF3T3GFWc7HifEGUaatVwRqFKI/WndTQNgzLFRa4XMOl0/uQ==,iv:aBuEThMmuGoY82PvMwwFuUBy9HNZP6PQjgZ8Zp0GuRc=,tag:vMtyOoTechLMY9pzXWxrYw==,type:comment]
+        #ENC[AES256_GCM,data:MdLy3dxl9NR9Egcr9uF0DX+7yqoTNHzAEhCE1IMezDnK5ZcOvPUnxqZ4iogfFqY04L+fa3GDe5iHIACO5CQjZ6UggkrJrOYKeA==,iv:3VEyUMZzQKd8PCwjQAg0NIxHWKTiuOyUx9ixFtU7vg0=,tag:hDi7FW4YrH43zlhD14TlQA==,type:comment]
-        #ENC[AES256_GCM,data:5QO2Tp4l+xkN5iHl+gzFZQ6E1nP0i8Kb/r8FSG7zwtHa9G/6fr9p3Yig58Yb4PKArULepjN3V+7D2ItoArCp3RXIHE6inIHYEA==,iv:ytAHiefM1E3RuzJU/aR/4bx/nE2hjGk0vr6FDtGA3bU=,tag:2HyHA6Wna1JJXYOho93G7g==,type:comment]
+        #ENC[AES256_GCM,data:ZpYGFVlzl39LxOdCz8L5qagE8L6HO5ucmAKbGLkXWdjQbB9XnKReMukfwn3cufijzZOV/7ugS+4AhQEExKwoux3dQJdb,iv:JdMuJ+WCbWjUzkYE8vmayaAH93OW9rgBr8TsKVIX8ak=,tag:/dAeJ+h06EAtFEa1C6o9cw==,type:comment]
-        #ENC[AES256_GCM,data:6mJ42kc+HLpkX0fJDvjPD4ncex46YsHC6EFjce+a06giuMX95m0IkRZa0U7r8wg1,iv:iy9YHCYKKVfpnhe6ATuap0atLel5nTdewAUmqCiww0U=,tag:bMKD6KQwRG0aGEWMLossxQ==,type:comment]
+        #ENC[AES256_GCM,data:CdlR2QFfPDlFCvISg/A=,iv:XX7OooAjEWFKDl/Zla127bLsrsSTNgxNncO1nK+ZFSM=,tag:VWkVeYToxqJ+Jea8jWseXQ==,type:comment]
-        #ENC[AES256_GCM,data:/hXeJrco16xsvSu7vLohfoIzHUnp1A==,iv:YNCtyxhMnOpW3tjjkCRlTYFaQervMf6V3Jh7SVDOyPs=,tag:obzvSWhCfvKxgJ3PtFoCGQ==,type:comment]
+        #ENC[AES256_GCM,data:JA6V+4xIjre7IvgBehN6Rwn3M6GD+GAfMkrZ9GsD5jQJmQ6a8IVc3GgTZ90/qvbObNbOA4q1UQZYB6mLoav05tMjkcL09sY89o4TZuAFX3khs6pcFcnm,iv:LEwLojP4PS2dy+UwMuwiNxoj8l5PF8v6Ml8BlBktJog=,tag:M5b8r0hEwc0JyYD+Td3E5A==,type:comment]
-        #ENC[AES256_GCM,data:wpKJZ8MAclFKBL4ys6PH501Qp9zStAGHdp8ZOWr7QS0xCk3JosY=,iv:fCX+W1GOCQNOv54Oe/BYrZvWQGM+T9/RAvXD99PtK28=,tag:rFhOFZHttU2ihriNsGBQHA==,type:comment]
+        #ENC[AES256_GCM,data:Qe4kwfv/wmO3kWO9obMooZC026aZ5hCnsg==,iv:8dGePO/WVKm/uoehEOpHiA7V5USNTTdyv2YroPm4b2A=,tag:Hr3TEjq7UYH65IkRfMTBWg==,type:comment]
-        #ENC[AES256_GCM,data:L+yXt/AftA0GMpA9C8cW,iv:ROSxMqD0Ua9o7c3Mquieta/Qc0ngLKWsc0BjB5Q7uls=,tag:GyYSKWlo/Nqi1LE6p2At5A==,type:comment]
+        #ENC[AES256_GCM,data:2YB76SmZEBn2MIjAuvMFVkkdRSfcVR7Ne+692v4exFwyCjSvSSSGlYXjFfbM0xATJYeN/sOlUfUELN91gJ0=,iv:pOG9N2AnHdHmtL+iNifoLpordE+WQOKMGhiQkfvmzaE=,tag:Ud1EKVOrJxZB1wrXU+zFmw==,type:comment]
-        #ENC[AES256_GCM,data:XGzMuLOKC4pZ/eobZv60UW8okbH0aAtv/K9sk6sRDEnrID0P0Zw1r/bgmwR9qwO/Vx4htk9LqLtxs8Z7IGIg3U8h3XmH9Y0F6A==,iv:ZvKSvo6fPwXyHZftzYR+p60VVOsqycqZHvZmv52YNxM=,tag:gmaqD1MLT30tgEBIm1rK3w==,type:comment]
+        #ENC[AES256_GCM,data:9p1WLZfMYqLA,iv:2rK3zQp7juxN012p431wBTR2fCBc+MIMJzhmoYmw4/E=,tag:O3GuUaP3VfnadYEqe5QkFg==,type:comment]
-        #ENC[AES256_GCM,data:HVpLoAqprQfaH2mLMcLdIqd0dzFc42oQdEpODdB2YW330syr8woygQTBsULAzqFfSG6ZbpBbswI/0w2nCEJVzZurecNR,iv:my+T70QBLZuX7LM7sGFXb5juQ+nsPdEd0FvRDkMuw9g=,tag:1ewsSJ+aJ9RKGp/xHxhONQ==,type:comment]
+        #ENC[AES256_GCM,data:lXjUlM4KiW/mrZUYkHRPiH8J/Hz07BSeCZcd77PjTGM4gP2uIkSaHZE1Cda+FSkGtorw0UZqMtnGYDOJcLZ7N75ZLhvUE5SGQl5/THUykG0I4rlF45MX,iv:8yNljyRuEbxYT/kZkTKjgkftQ15PFgOK0RLHg6tN97s=,tag:a7NTj/ov8W/N3/DZcYP+Qw==,type:comment]
-        #ENC[AES256_GCM,data:wu+OV6+q+ZJ0Rph4XoQ=,iv:WmjxyrNKuBuuNoC19fYzY7mKCpcNoFi75EsOeNHiG6Y=,tag:Ka0hvwpOOo593OTCMSSnRw==,type:comment]
+        #ENC[AES256_GCM,data:j6104Evu/ukPfGsqOSvgLvloxfzXcFmhu0MGIg9rTCxTng==,iv:KSjliPdU0Hmk1O5UEGp2GMosAZwgm18Z9q7zyYmi2cY=,tag:js+9VqsR4wDOIpaBwF8tEw==,type:comment]
-        #ENC[AES256_GCM,data:fWptqOYKcE5nml3Kn2+A9SnSsMk+jPfPt+7MEALnrVVVMKjma28lHyaQM8/tcPNbgBb58YEdGS1pN8nsXSLcPX8leSXpnkjXy+v/wGN+Oh0ArERVDFuO,iv:qbvCQmAfh30kGM2rNhIaiI3+NNzbgIgk1Hy9qX5eIko=,tag:HGGJG4rRgRSMJiprqwQxew==,type:comment]
+        #ENC[AES256_GCM,data:qp7iEISxxEhaLrv4gl229JbqdhfGRKqHHULdf767cw7yxzkM1IjBjYMcKMi8/wAs,iv:f1/KDjNSQQAqWWBREm8l8WQ939j1H+riK4TR3czyUa8=,tag:2GCIcOAiiCxLXC8aO+cbEQ==,type:comment]
-        #ENC[AES256_GCM,data:Jnrs8ODParxij6AMQYT2tJ86VVg7ww4PCg==,iv:KbMMDpAsn3z4nTwOctCRzW4SMGB6xvDutHwhyCcy9nk=,tag:ZFAHLQ2qUgrb+1kiH9QfXQ==,type:comment]
+        #ENC[AES256_GCM,data:uSUMVHuUylkAIDP++XEAL1poiusMDKbcIEM=,iv:3dnOzY3ECT9CVb1vKRVYB7aLFWAFgV+yjHOUGoe0j0I=,tag:AEzWvKeTbh1+EBXtNsW45w==,type:comment]
-        #ENC[AES256_GCM,data:/rU5sLyxS+i5g1ElCcJB6Ziy/H8WeAQA6Nknj8jMUYyfNsuJHHfskTiCRAwPOEbl0YVgLHd7EDt8xRxKQzc=,iv:1xy5iPmXeowy7yEfRHS4EgiIiUGh1Og+HF6AMj1AkZs=,tag:n6IF2fzndmzxsZxI/ElE/g==,type:comment]
+        #ENC[AES256_GCM,data:T9XWgefXL2nJUmJSkhAStJw9G+l3OfdjeL84Xk443ofvGUlyjmz4GTVsKE1XFGq+L5FDWfeJSxNqq6xi/h6SrbVIDQ==,iv:8plESEKUUQNQHFsg6Dqlk3Z20wQtesX2g6ZiArbOYEM=,tag:/p1Jtg3nc5JgyfT9VPdMSg==,type:comment]
-        #ENC[AES256_GCM,data:VfogELnZ4HQb,iv:nuAtr0bFQKA1zgYLzrfmxG6/4+mqR+qsFtttseuDdo0=,tag:bBvWQio2ZTVEJFKIXtGvAw==,type:comment]
+        #ENC[AES256_GCM,data:D5YZLdFDUIktt+AXhXRs0A+Jeg==,iv:TaT4Dw9akRtMIJW1e5XkpM3rc/huc7dTEWAkCveOimM=,tag:ExOHxx5YCshqYHcX14kkKg==,type:comment]
-        #ENC[AES256_GCM,data:SLE/16KN/43K0SXiUJhZWeA9XYkwiF6KHAEm9yKuIFvHZ8v0+s1svHsAnFn8g9YJWJUL/VeXfU7ffvxvsIPdvoojy7kffUpn3YZLfhJYLEdLGPPQwQAe,iv:E9x1Uwi6fXqQswd337WcQu8ypO3c25noSZBJIMX7dgc=,tag:A6vxdsl/eDSbavtOwnLinw==,type:comment]
+        #ENC[AES256_GCM,data:5vQuPfbLd+h/MRMj4SHVF8Qrjj03kjNaEij3FvKJF2R4mQ==,iv:sLVEZCxb0kCu+fnOdL6cIVp5XcezTzn83kDKp/HnkBc=,tag:+Hb9ly4ZMAEuu49ZFRBBQA==,type:comment]
-        #ENC[AES256_GCM,data:9FpQz7O+9hp5tx8+aZjiflXXzF3o57nz+6GYeXuUdeZsqw==,iv:mMwIxKdMJLa2D2pwsYcv29MgFoYc5UkOiy4FYLvi4To=,tag:ivs9Jcppgb+6Wc9VAasJ1g==,type:comment]
+        #ENC[AES256_GCM,data:Yyqjxtuqjc9xwVRoZ4WcXoGR88HFA/9Mm483YDTwYaQdzWo=,iv:RV+okb+llogj4PdBNa2Wpqw++iLGyWT5AzlI9oyu3K4=,tag:XQ8CId+RCN1Pxe/jHfSkCg==,type:comment]
-        #ENC[AES256_GCM,data:9x5WRxY/EpjvBFSWt84rp80YGDL5ME31MIuSKSgYhe0NfdQI4yU8geQaxQ7QGmXa,iv:dWd0UsPHD/nbn9ff/7nJpXS2rzR1xHUA494SL2T3VyE=,tag:69NNST3rgr0vDsLx3GNcug==,type:comment]
+        #ENC[AES256_GCM,data:NQiAjhfMOOEvrseoEk1bTrxi5PDwgnewT2gT+JWI,iv:8qThmtuyxk6vn+uxsITrCOaMbmTZectFPeU2jrdFl+Q=,tag:Ta2MTdnugM2zaMt55m/2Og==,type:comment]
-        #ENC[AES256_GCM,data:pLzH4B2GQeUu8aYG06Q0dj1i+69LvP+CCIQ=,iv:EFfSnVV69kKQzZXfhdl30zB/QVWWBqpQTRFfj8cemkU=,tag:WYCp0Mo+DLnPWM10Xwp6Kw==,type:comment]
+        #ENC[AES256_GCM,data:u/wHOUL0,iv:ixl+vNBhocOmAG63qK8VqthoMOAy8Zz4zOcuf+Jgjek=,tag:SeeHyMNyAYVZRg06Osx4Bg==,type:comment]
-        #ENC[AES256_GCM,data:ta5UUL8KkDb6Zm3PByIWig0iDXz1fT8nAbaw1lS6dEqKilmhHLmWCIb5n3hXIdfgZYDJHWfq37VVGRyGQrGrSBZlAA==,iv:OOoUw9UNsvOhMjiSuQf8N9aihpFCw8z+gjuqcfi6F6g=,tag:dvf1i76pLgnZItsczP+HfQ==,type:comment]
+        #ENC[AES256_GCM,data:rOzmRthnMPRYob1rGJY9o5NN31wSwt8Vzx1vNPYHv/mg3DDBdAVC1Rv01OMMAOzyn5Z/+gM=,iv:9OSjEj3MkY2mhOqmlNowwoGjrGPzZ1LsM/pkrFDFANM=,tag:09jkzZNi/p3xYr6RxxdGHA==,type:comment]
-        #ENC[AES256_GCM,data:ILiOuv4xSH8bKGiUOoLeEFc1Ig==,iv:IfiAZkV46gQnC2QMSZe1+tLsXkK15TMUI9wUWfwCPLQ=,tag:TMQBXWWQOA+Jb+9s1Mkyag==,type:comment]
+        #ENC[AES256_GCM,data:Jz1/aooBmQt+dvI=,iv:MneUaHoWieM00vJJgCX23VFvBRMNvIWKGVXVLgvEnu8=,tag:224YV2w0zubaYdoCbaOMVw==,type:comment]
-        #ENC[AES256_GCM,data:P8ptfnt+3zs5KUJpy6jLcS5V9dVBC7eOaNHEghOAJ50Ccw==,iv:SW6D7TDWahbMtWzsQDuihZqoYvjPxs3I8oUHKX2ll94=,tag:lNsTrgMD52p2PtIau7vFZw==,type:comment]
+        #ENC[AES256_GCM,data:Orof6UaU8m9uwKbCAsAqmr2QZugOH11C73sbGcbK0WQ6warscoShMBnq20ZuhfFSlQURy2uLOrexb+yDZS16YHw5UyyG76X6,iv:cvwwlgaEPkx2oN3zBZmnT3dACCjA5y7YYvER4oT4/Zk=,tag:ruO6HAQmI4yc3nCFS4xirg==,type:comment]
-        #ENC[AES256_GCM,data:M0go5xeXyES++0nPNLp7z+5oe+Y87loEHZv+cA6wAtMNa9I=,iv:nWU7oa+ftzXpHgHta8sjnLBSwj26htWbryTcq9UP+MU=,tag:oILhf0i91WgvlatLzBaOWQ==,type:comment]
+        #ENC[AES256_GCM,data:4E0IqaCGRpxi5AJsSZYutJNj6f35Fm/pYhxcLI4N2quz,iv:wEeD5Q4omw3SbEFFpc25S+VEXCrblpHaUnsPspcMw0M=,tag:WIqKSstlth8kNLD6ZNT5Wg==,type:comment]
-        #ENC[AES256_GCM,data:V+12sln5vMYFzuK9JDEgHUJNkTinOXBQfkl8l6t+,iv:NydNfDyCYZUVnlxNsmzXHQXJG8jHHUeKjmwalrJOFNo=,tag:cwkNqOol3aE9Nd+2uecY8g==,type:comment]
+        #ENC[AES256_GCM,data:v+ibAASV2Ics,iv:x6JIJBW43XbKjtyF4Y8TMdCOAPdJSPUFBGZ+JV0gEZ4=,tag:qzYV2qdsOO0ZFaIqEk1B8Q==,type:comment]
-        #ENC[AES256_GCM,data:YAp95xPn,iv:aGiK+J57G82D/Eh7TiL+kF2eSxKD5sEmZIkO3EFyFh4=,tag:8lMDcHqitBMH4StD8IkRXQ==,type:comment]
+        #ENC[AES256_GCM,data:eiSBBpXY1a4eZROFIeMwplK5VcGfQd5l3sfC,iv:QQYfn/MgrEs+zGJoGZBjmmSd/EdW9SL94D6jaNlLdss=,tag:ZNVG3kN9/t98Cquf6GdBRQ==,type:comment]
-        #ENC[AES256_GCM,data:xGXTGwCTdWV10CZh4PQZGH+xB3JDzUKrNABhk2SJkHBSL7+wc8XK1JUINO1zvOqtWLO53Ic=,iv:qzWPiUbvPTs4qgngetdJymA8XvYB/BdQaaflPEdoVDc=,tag:5bSoVaOAGiNN1u23I6vhhA==,type:comment]
+        #ENC[AES256_GCM,data:dxRbmlmUD61BGSCeMsTsZZTg,iv:Vs6iQS26HJWbEmK8xTAypnu7MKbk8R1JfDUlzvHhNag=,tag:tF3y82C+9gTtrTCCuxJeyw==,type:comment]
-        #ENC[AES256_GCM,data:A3ZDGZvJJ2jsnHQ=,iv:Uw1IrC19sOJlSWPAwA2xFp2epAQNMs8Lb7snQ/JLA60=,tag:ihL+OlUp8EeI++gleUJUIg==,type:comment]
+        #ENC[AES256_GCM,data:7i/LP09s9LlQ2TaJ3L8Slg53lhBeny6bhZoe9cnbsUlQlXGgxPxSDjJgUB0tWUSes3ilHJsAMGgB3+E5iS7xdF72qnFu0gDTQZoU3AfTk2JSUPNO1P3m98AwZZk2CpGRsZH1fIvAbg==,iv:TTxfUMZSPxphkNDg5FoWtnn/wihzgkgli7nz5dA40QU=,tag:uU5dzqO9KXjcOq9xIEzzVA==,type:comment]
-        #ENC[AES256_GCM,data:ySZhN/xKN4AzRbD5azXHJmtvybGfdF/Go5l56ln9CWLOXWAxYY5VlhNMYib74WTSoontjkSxqMaUAvxzpa2Kx3W87ScCyWSg,iv:rt6g9tiXMQ+fSAAHer0OgD3pB1V7TtpVh9NBZ9WBHGQ=,tag:Uq15oDgV9D5wJ0HXUWTnLg==,type:comment]
+        #ENC[AES256_GCM,data:wjFc/HyMArkqrvz1359iLI+fc8qoeGDApjh+y+sqyydH3/Dej5R73Ppy83o=,iv:QngRy4bK+n+JQnWXI4cEqpklzZGHyqF/mK9Z54UFH1M=,tag:WaxeWH016lrMCSw01x67Hw==,type:comment]
-        #ENC[AES256_GCM,data:l8bkQlMrcB8Rj+LLxGECj0G5JU7uJOUB/NpRiFmGNnjy,iv:ebZXPTpUqY13EqaQNsLvJwelIOBT6FQoOaYTjsfUSLA=,tag:KoopHWgcT8pLcNI+0YI1jg==,type:comment]
+        #ENC[AES256_GCM,data:P9NFZnzDgxTha0nvH6DxoZiEKoNaZ6PynQ==,iv:+n/oSgfclcXzgyxc9FOo6RulbgYX3zIiMgNW1lJKbbA=,tag:HtYBDZu7pdSESyTVWF/SRA==,type:comment]
-        #ENC[AES256_GCM,data:oNs/UvwYToSq,iv:AthR2skxqlCoU3ANjm0L3EOx/4Zcdqi2mf4Ovgh5zC0=,tag:sYalnM5qEEz5ruo8aCjvig==,type:comment]
+        #ENC[AES256_GCM,data:TkyOqEYh+Cs=,iv:Fm+HTJE9EtziNkyRXTa7CiOLeNGhM+WVickBREHLWzE=,tag:WchbiPFhctLlzpH2OJ2nTQ==,type:comment]
-        #ENC[AES256_GCM,data:Ns7xV8hBRv8TA7SVjAL1CTK3tyOzMY++J5FA,iv:JDLRl0dbTqtH8lfObKkP+6e+uTGwCN1IlegcJcKU0Zg=,tag:ReK5L/SajbNzBCa6v4QQsA==,type:comment]
+        #ENC[AES256_GCM,data:xzuJjD2FgL2D4Z3fBn2EONxCc2WkrUdhd2ibniSX,iv:lrJ1+0kawLF+/X2hAnzoR6E8vh6sjd/rNJMLwizzKYo=,tag:R7khxVVIwBiOPlUecaDGWQ==,type:comment]
-        #ENC[AES256_GCM,data:/dIsPxaZleDCIP8/LHAS8KaC,iv:jFRa+zuCJqS3R/7F+fF1vTYEdpcLV+x9Zz3eEGlv5JY=,tag:S8nUqBluAPz8ckV48Zks7w==,type:comment]
+        #ENC[AES256_GCM,data:HauZWVzVn9ZD6k2qIw==,iv:XXvmWd/9JauQUPHhyXfe8Ux7ks03ogI23YdIEqosJm8=,tag:Ssga3vezCZvPACzHnTfa/g==,type:comment]
-        #ENC[AES256_GCM,data:m5ivkYOud3WPlm8RVItxTzhsLxaWVtZtt1imbYntKvHHjWiRPq4QusF8wjzMSLpA1R0zVnc0gomZwyteKM1uSIjW8OWl30FzxbOd1cKz6otiV4I9WJD41GWURvbPxrrXjEtXeweX0g==,iv:RXJ3lt6gx62OZTA+x8efU3wBIgcD/ejcSf3RFDd8efU=,tag:ScQxIhTMEsybcsFu1ia7Wg==,type:comment]
+        #ENC[AES256_GCM,data:CK0MUmtykFfptupi/M5beFxHcQFGyddiGaMB8gknTGpay+7T0w==,iv:DgzxeD3DkoD1rRzHmEaiOYnm6GN3d+Kpd4/Rqqh1La0=,tag:ko6gTjYzBKDBlouJ2SLUCg==,type:comment]
-        #ENC[AES256_GCM,data:GtssiKOLvjKBu4WY9AqDQW55bvoXtCY3+Mr5fdFoMryFggV91azRMfGU76g=,iv:HjDBJg1N/ekcrcN9htLxE5fOZsMHzvHKGk1WbXL5GNM=,tag:RUpLTIkhpagQBTb2QFrP4g==,type:comment]
-        #ENC[AES256_GCM,data:0AlXxcAyR6Y4lI47mpeQustRYTnkFCgFxQ==,iv:8RuJLxOlAr7EvzMnV+cz+OZYrf6q297k302erAXlJ5o=,tag:1L23Ja56Ad1IhEI8kEeI2Q==,type:comment]
-        #ENC[AES256_GCM,data:cYKlrMbsLK0=,iv:l8HoGjZJnf6iIZltTDAA1Gd3jTVy3WEuwLx+T0JnWNU=,tag:8Scymv0iRWKjMAry52Zdew==,type:comment]
-        #ENC[AES256_GCM,data:WHEZSFHpIU3gjEIB0zWH2iFq9yy6TLutU3lsh2yb,iv:SQKqEdk92FXQ0SZI4BQ4BTlAzLUHqQnz+MgmtoWUQ/g=,tag:mlodf/7wCljQBn18vwmvNw==,type:comment]
-        #ENC[AES256_GCM,data:qh4VAu5QAJpE9Zb4CQ==,iv:RFugl3f4kZpx6rjphzZ2IUWDaY1w7DsgX+vv9jyQJfQ=,tag:YOXoQXPtLMdNcLA12i3DkQ==,type:comment]
-        #ENC[AES256_GCM,data:8IOklGvK/FYDkxI45+LTLGPiqDwfrDl2WvGLbrPi1fKmQseY3w==,iv:8aMW5no59jB+Qx4mQSUqP0RDf0F3/Hq0zsMYaLFfFfU=,tag:FwGKrKjI52iJOKCwyPAJmQ==,type:comment]
 #ENC[AES256_GCM,data:GciEjAJG1vSEnjBv7pxSi0PR8Bo5W6LZDd4ulWnyA8GJ6SCtHDjo0bwiHmzAxip0ew==,iv:4XTOTMB/CWE4GVKMWQEFaPYW2n8yU4TJpMqsMmnbHcU=,tag:6sIRqae8xOeQJPw542qrEg==,type:comment]
 cluster:
     #ENC[AES256_GCM,data:MbfDEgUdp7lsQnOMNSNLm9ZObf1v5ZYIZCly9nfa9/hTdnDbGpRZ8JkaJUpvDyrJfgPnrvBW64rgGRuemSeOsYkt0hlFgx1yDD4iFJHl,iv:x+zpEhdUYTbCeZGnv350o5ePAVo1Kn4qei5ferVyvMQ=,tag:+Z6MnYZa7HEtrNuJJxdZaQ==,type:comment]
@@ -334,7 +347,7 @@ cluster:
         disablePodSecurityPolicy: ENC[AES256_GCM,data:qwL2LQ==,iv:PQREZLJLBCl10IqodfEFzC1GEKQ6hzp1Dl92+Fdk0m0=,tag:+o/JTdT8oXJGicpqTjL5ZQ==,type:bool]
         #ENC[AES256_GCM,data:WAVeRzYT/SjZvEuV+1pHqBxDTPEkXDlmZcHlMc+23KSAtQBw7d+ZU80rdVo=,iv:f0FNw0h/TfLuU7pCUtxX8mduB/IqSJbG3xBOyD6joyw=,tag:+VKhLVAojThj6zz5r4c+FQ==,type:comment]
         admissionControl:
-            #ENC[AES256_GCM,data:6V62Glp6BZFIG1Absj6bRPzF0qYvoumN665Xw2pWA9WrTvpmYc6MShhaWDqFag==,iv:FREuzZ0Y+glyR3TmjWyY6+TkZuNAs+/rj5lVP8sFzh8=,tag:xiojz8SWRsc9Wq2mj8nBOg==,type:comment]
+            - ENC[AES256_GCM,data:6V62Glp6BZFIG1Absj6bRPzF0qYvoumN665Xw2pWA9WrTvpmYc6MShhaWDqFag==,iv:FREuzZ0Y+glyR3TmjWyY6+TkZuNAs+/rj5lVP8sFzh8=,tag:xiojz8SWRsc9Wq2mj8nBOg==,type:comment]
             - name: ENC[AES256_GCM,data:SlcqWTzSzPUdASs=,iv:3PNWhkVD6tHLq5f50qcJtoj5d6mRlreIVHsFChBbNQQ=,tag:cS3/HiWqJci489MJWfrmmw==,type:str]
               #ENC[AES256_GCM,data:v+qahljvIqReCGlwrJ1bzryv4J8DbEszH1vMnSJmqqOL6J0PS1KTX8bxb9cpJ+nZQnROay1Fp2108OavML6OZoojtYqnx3TPCtPBqog=,iv:egZpFsV0dlLimm0BZIcWth20PNtPAtqpmXk3C2Iqh48=,tag:dnPIYcRjHITEbCh/eDje8w==,type:comment]
               configuration:
@@ -397,7 +410,7 @@ cluster:
     #ENC[AES256_GCM,data:BjDD2DsdvvucHBZWe92YTWMaBnW2,iv:2T7oLb2eaAsenawH7/2/jv3ecfmLKMZcIaJnqXXYRtg=,tag:o4KydEF2oEziPI8KplfXMg==,type:comment]
     #ENC[AES256_GCM,data:s4NuTva2eh7H/BAxcvVb/v6O/dt5bA==,iv:gSHfSDX74DyPYBxbpoa9ogWlqz6PtuTKnt29VoVfMhE=,tag:/YwPSzORAbQZZT4Nzdxkpg==,type:comment]
     #ENC[AES256_GCM,data:14ARa/Ge9rLFW8ppyTqnxw==,iv:YU7vfnLYyB68Zhg+1CBOhR7jyMPZuGtxvnxm651pXa8=,tag:A/Piz/uzrHqjjf4UB2AEVQ==,type:comment]
-    #ENC[AES256_GCM,data:prIHtwgur83D7e2naI4jsQ==,iv:lGo2Lk4mMOGoHJmGr7Uy3ZgrvKOz1dh93y/ROgmV7g8=,tag:hedf84k5SgIoGPVeS6HRHg==,type:comment]
+    #ENC[AES256_GCM,data:C8gNNtLXNGIP6CBcLqQOEgt8GA==,iv:AfXSYZiF/qAzNZmT7BBCXufMKoe3KH2cuWy4qk/Zpfw=,tag:HfXxsNXEPGFlzr44zLrkgg==,type:comment]
 #ENC[AES256_GCM,data:w5rvst6HLpnRMW28lKDQBqiquRBY4o/B9Da5C3deZmfobowLO0MMUmq2fg==,iv:67o+ZdBdfCk58Ly1BhiD5yijGAXRaWK2WIo0CxlyfjI=,tag:i1omZ0N8HT+jyKTLh8KzXg==,type:comment]
 #ENC[AES256_GCM,data:X09t7aG3iBoL,iv:imRoyWch/LO1mGPVPkKUS/TblqhQQoervv4kfng7kGg=,tag:3Jt1tX6oqGvmeOB0MdU9Ug==,type:comment]
 #ENC[AES256_GCM,data:EBGNThSXd71++ZUlNJbcQO478G9Sr980adMeLSOWDN4jX1gXlvWCp27oe8apqO+vDn9F9NWjaZTZQql+JQ1mpI6EIsR30lySlHM5wg79tkenjnN+soSN6qPZk5jBddr6kfVJuz3scmfBIvam,iv:vyoWOgtmQbpXPYRTuL/kdrw5Dqh78I1sqW6jerbO3UY=,tag:KRxmONIR+s95XPe02vzMYw==,type:comment]
@@ -430,8 +443,8 @@ sops:
             WHNVU2YzVmNvMlVnMzdSd3BINk5BS1UKPWtAJmmZGR70s7ML2926W76dq8fPApWP
             5NHjyHjEcryMvf7w07aSIvl+ZzYWkYYat7g/2EcHfyYDuUkNpjQ5HQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2022-07-05T18:57:08Z"
+    lastmodified: "2022-07-18T16:45:26Z"
-    mac: ENC[AES256_GCM,data:XFxuaZXPE5e6FxmOO9cozJB2UfVWM1kdqCyq7KfuQh7T2TwCgGCdJ2D3UUr14IUZAjciszi4eqrd3GQrh1AIYdLFrGA7i7xWqRXY7Jvgb+qxY/fQpFU/9dv+ySkarb5L6mnm0TUDxbz1eL+7NMkYw02QQZZdzjQePcbk/hypV/A=,iv:vNcnAHNU/Cz/a8/Y64wWqtJ8GsVmdX0+3JHe3U5+2Mc=,tag:ZR3/uNmOZAdBOqjsVTzdOA==,type:str]
+    mac: ENC[AES256_GCM,data:p4Tvz1LcxJgyiLbU+X/USXS/0psL5by4Z49PVa1peJGubV76tNEjY36Pv0pJIOEZk8jrBfdVIpPZzM54I0W3LH/M9gqa9pHHOMKmqHuqgP2mCiykbFE9fiYPqvleW2IyFjY0HNKtZAAtwb4C80C3PwdwDsG3WCVOdcKW4pcti6A=,iv:zYTGrqY0kUQTiiKx9Z3NUBS5ehN0vbprQBagZ0ReNew=,tag:IGBRSnX8AdhdKFZZfqfCuw==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.7.3

home/talos/talosconfig.encrypted

@@ -1,20 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:FUBoK1fRvUkqeWeGgb1bHzloj4PwbEjlq+Y1tOkAkuY/f/r0RdjMfVXi9xDsWH9CsDo+C1z5hzzG6BULdvdxSuZl8Rqt6rugZ9otHjhrE4Q0VK0qNcV0YAcw7EEVkxTSmfkoUSf/eNLMTtWfvV/Kg/YHcqy+ycfVPHGgHvNgLglwY/gldpYi1nnOzzvLUUDZofLIMnm1tfRxPQdtDCZfr6cdcbVz2/DBAFd5JKxW+jgy0D9CLJZELUzwFgLJyPgs0bzDH+3POWzTilM9W6RDQH78V9He2NO+Id0cV84am+y/FKcN0LVxyE7hnmC90ZTbWwt83+xMKWfK9kYKPFv2W47aahIOm8ATu6YYtplQlaBPQgyvcvrf8lQ/QD11B73TZswL8wr+rzNG+XxqaCiUcxZ5xKHqPLsrF/FrOlA2esfCf/iU955RXIYgYBiKz7Q+UvHtTjPQ62pUQFmGfIHNmlHffOYnYar4ge2ytOzSJOY1RwtmdBS7p9Watot/BEgCJyqyynfmePfKVbJn9u5a4bcvpsnJUV6tQFw1rIbQt8n8l32ShV/aZX50sCfjr6Q99pRwT9GFQ+zgRzNlnB38tKQYnfWg/974gB9L7PoROeLfOiY/xaeZxfH66QnHxswze2dMR/dl4PBovanOf+ttsDZOa7mzx8wxEiNNkzAL64e/65G9geWvTn3MICBDV/IzixNvzS7Wsyvtybocs7/yyr4COEklYnhUOBFYEfm2H5S4yFwbFClXFb7g9AY2j7NR9MiRZu3XtDUPnp0643V1tGE9Ddcv3U9oSdWU6vT8uAEDy0xqBuPuxY8PhPOmFd0f3BQ4XHisVOekIvpWWgf+oIzsE45wWIhzOGTR14pcfVIvCAHFbhFANX4tYKukUYTszrqYsECPx65KHEnZB7hLBv0FRjDHB5genRUOqENvpocvYQZDKPagN/PfvWckLb3GchEubPe5QnqCVF29PVn3Ulr/Tc0E7afdtHkC2367IbHnKiCjRG/UB72XGqtkL8s3XgGxE+vNuEzBTYVGeySF4I4d1BoLa8hO8BMzVmC3IMFto8lH1DuF/8/VOqBQfeZoONpRRvUtFbszFqoI+GnVQmrL4mIikKTGMdTrP/l1xc1QJkuemzM+S3ZSW+D0i+ITBLdJAtcnuDuqp6yw0lLdSgGEKFw6ggLgUZQSh3aIu0BGt3u3KV8ZsrCDa5OOLbzLrYcMaVkLInJeFsfDgaJYsSi9TIwgcOHG0cfFw+TpmoJUMIdwkAhW5yhq4b5nmFZrO1kiWxsu5W3NG+lu/M0TJV+iNWzpXIDdFVJew7pNaw5WfbM5SxNSDNakXwHdJC+5WZ1i6HKyGzKC/xBB98HWCif7NTAjBNcNhrm6HNxGI1kyf7BjPUHl8Aa/tPZJg4IuqzowsIsKkWxgWBDPx035E8nvZ1+sTbXff/vqtIdlTXlUJLz4W+3EVCo79dKiyJ/7tmgPfz0beJaMxKu4KKeopxhq7XmPqRzU950Gzzr57kW/Y5+ChV5lA9u55c52UoTC67eqdw0KNs6lpK2lwqQdZefNx7ktHro6l/K/a8ql8/Lslg4w2wbP8sGrtBI0Ty+G7Dkl6sKJevg6WncVg3PT4jgdYlsDuuURhxGb3U2vC0SIVghf1zHsrKyK/rTOnYMgDcf8aHMYwlikrJVdYNkdFatHaQtMXFpi/NhoBCF/NROKUlHLncQIjSLNJcfHXa0LieglVtNEQyhZ3vSXh5TLEn9roZ+b0vmYjZnBjY4tUIVozcgDy5g7KnSPXu7Sjw7Y7r10+eh7UlQeGR9hUZ5cU7AAHUwLdkauzAfueZjHIKx7tqPmhiJFhuOVyqPlPpQhQi9LahLgY6wH5Q4XTdtCHrJwgG7jR44JFCaraC0Epbea4FJDS2r2pQ4uPYPR2W84rO5kM4ydk/oBJFV2sPYhAMVpXxoC6Q2BUBrElyJghuklbW9xtzEEZ5ADaNWPkfhPHWEpPmkTCihkMSgLRLR2LkgNDL+xj2gfItpHQctMgKwSUsY5MN9rB+XdqrGIPNCMNXeg1EPIG5jwkEv/M7wylUBHBGi5+kkv6EvfXqo9h6wgzg0fNnvLiCatZwsvIGnJ4OfTgYtSsCCptFeedWCmg0BveqNnn4rI3vB0sPrmIeQJ8pjrVVrnvab6dZnTU/y+FfB+,iv:6x0EQU4VG+UoXQRoHHrMSpnJXzlY94mnzWQAV7HD/FU=,tag:kYS5e1ml5inLAzadEakKXg==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1stdue5q5teskee057ced6rh9pzzr93xsy66w4sc3zu49rgxl7cjshztt45",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1TEx6VE9meXdremlCRnYw\ncVdXL3VsbXNtc09rTVBrZWpWNG15U2VUTUh3CnZTS25mVGdMWWFGKzBJUmk4MlNu\nKzc0bjZDVS9VRXdveEUxZmZLT1lEZ0UKLS0tIDFzQlB1ZGV1SFhYUnFRRjJSTENR\nT0kwajVLWEg2QnFBaFQxVUd0ajJIaGsKIKGWG26vdayVGx1lzGbkp9sfdkLGTaiG\nLzUFijaQaDhPU2fcD1eTqcSRO3YIbOag+9RGAmktOat1HfeKUcDBog==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2022-07-05T18:57:23Z",
-		"mac": "ENC[AES256_GCM,data:6HhQJRRpb41XMP9taxWV045lZeNCSpfCadocpERvuMeYvD/zr8khvVUa7qJYwho8JtadnlpXxzgZo0egtLgnTf5DQbJSU4teKGTNEgSYmWTBgF8Xl/rOYPLcfR+XaeKrGd/kD3d9hg2d/r+yq96VuVuBCSWTq54bdMsnqNdbO94=,iv:aCeDCPEyy2zuN4hdA8b/LKv18Awq5WAi0aTOxX6w0Ws=,tag:3Xqw3RMz2d4iJfDgydYwLw==,type:str]",
-		"pgp": null,
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.7.3"
-	}
-}

home/talos/talosconfig.yaml

@@ -0,0 +1,32 @@
+context: ENC[AES256_GCM,data:NZOysQ==,iv:gzOWxJneFlV7GPOLEzGWKh22Y9NVX5O8JnczqBuIDcI=,tag:mz9vPyAM8j6cGg0K3HXYuQ==,type:str]
+contexts:
+    home:
+        endpoints:
+            - ENC[AES256_GCM,data:om2r6VID3T5zKA==,iv:SheHwLA9l+40WJ50fdjjvOdc1WolemDlqwkrW3cd/bk=,tag:ST2CfIlAxEB7ureLSQKyKA==,type:str]
+        nodes:
+            - ENC[AES256_GCM,data:KU8HJ8/OxtJlfQ==,iv:riiqdyGe9uwllqJyDH/r35ETRr+cFOze/WmY8A2iRd4=,tag:4C93NVDci811np+WPNBoJg==,type:str]
+            - ENC[AES256_GCM,data:7sk2YeWV3PXq,iv:+V/1HARCqpwlgYguXXD3WbYObyCRMn+M9H6daDO2cpU=,tag:wblsXjYcAE6riDxi89xPiQ==,type:str]
+            - ENC[AES256_GCM,data:0Gkas5pX8ccL6g==,iv:HUqoYPRHVAS/wpsXIQZOd0AiqoK85B+O8wB5uRk1qJI=,tag:VDrDZxCpMKjO0f8GabfxWg==,type:str]
+        ca: ENC[AES256_GCM,data:cC3shZmH3HMIoIdXzWGfktJ5oWT6KjW9ddzNko6oBpOTC3RFPxTkAp7YLjocUgSjflPLdXKHroGMLDz9GUsnV9B5VSyGSbz8uaR/cbK82I4S7poiZeiQ+elIPjhg+foAjDDdQm9CcSqW/dyf++OocIK20imSklnUQiZ/MfR0wgrcRSPfEs0DYsrXAhbL9k/wJcxkjoTJBkYuYzIB/vqtNqrb0Mc/RZsG5gWIzmITWdvwDTao/j1uN4t2aA9hcerl7RCRznCQtznm6OEk4UWjo1FDA4J15zMIUZBw0DfY/u1/0xSZUCA20iua83D0gyQ32pBGea/yVbOeEX6LMQGQAFCt0JRXPKzSAqBmSUp+Nzm84fo+odHbbU+fVMME0BqSpkF859c73qXniS/2ACKGDcHn40cPDruz3lzHadmdQFOZV/RtriM78vbnBLwjAAVl3wG7+l0yQzFp+k2vjVnCXnnnlvZyt2l7TkcfctS2nRb1tvEfJl42pZxopTaaAYqJSZto3gMGKwZXklT+VBVaOr0p8EDJYsVdRAWNLOgETGueH4yQJQKj4k4GsyHrokHM6FY6ERuEkFtIDgY+wRZBb+ockgJk9vBL4RAxUYgEOfmZ4aWTY+EuzQ6LUy5zvcH6kazJnKJSXoS1NEHxTrJMlu+NRxPYEkdgIhiqpn+zTzQBrxT4igO5RB3vgwL6j8WDnzKI1eITzzN+Q4SZk7vQqP5QTDnjRZZJJY9oPMi9SSrMmBp5s1noOJLIqAwQLKVa5ZjD4MKGQPPhse/1i+Un6IIVwRuQp3rxfL4mm56PwwiBpMvXPAP+EZtr3fqfOIy1MisirTj41gmQtwc8VoQijre8KAKBq/shTQwWy4axLmKBYKnA,iv:8U5eMYpui9k0xcr4qEH8FOdJnLY5G5iC6nBbTjP71Zo=,tag:LV1W9mO3KV1ZfRvxU6pltw==,type:str]
+        crt: ENC[AES256_GCM,data:JFwroJueVl9UBzFQwe5C+FD/ww7EryBFi+YEMsgp3OzLE9Ci9B14ja8afL7G1c6mr31ZvHFfs4U1Ij5hh2R4jLGQbVCp/OI/5ZxCjzopypxuP2HeAhUgnIwBaS6pQNpCUGHHScc4JpH2rHLi2gPtwuQ5WXsPwtF0TkwCiw1f0+QcPqqWs99D+jm4hiqJEqVoatx79jHEoqviSoll7K3JS3yfB1hfOq05r57c2lHEEJGFn/3aEE7Z7jgYUs2zDvIacUTZN+VWVbb57f4Zle48+xuxuiezJofFOoHWpj+usdipCoV0bpidutIjH2F9nmTeeCcasHDOqMR5IdPcDFCeY7mkY+2qGS+Y9QHAypRs13wMPcrM8iFuOd6eqyzFhHR0bxSmRnsb68CEAF6Bd8Z4s/Z6taOsa/tOm5ittFQwESin3yvHBN1lA66i+zlW0lxKlpSLM2k//AB9lAUaV7yuxUgx2mHQ6bkXXTEA307Eym0HIEqyDGsZGfBSNMVblfDyd5yeKZAPBKugg5xSlZe89j72LeJbT92qutiIOworWCA0DFERo0gKH+UKFTtt2Jw83rX3HfGSkzMtWxo1D+CLMEweqDfcDBht7nQCU9VCkY2sllGhH791+wRklqlgLFvaH7xTFXGkvR+DD8KJdzRybDSW+H+MvWnodUomo0nhCStFY1Gy+HFwLy5VQUTD+6Lwk1BYz0AS3tMvJii/C67JuOUSvrCkv94JgMepoeg1rXuIKIowEqOhz8+XmO6DnASoTASmBweRutm/h9dovfZUq6dymvXYxYxhOQ67LFUq75MQSBBPOjfve1HmsIGGpCtOt9bxZmWtu9YAxPel,iv:Tuy58blNTMHEnLWkgo0sOMjwl41KABK5nqmLOFO9aAQ=,tag:aM29zOmwmoExKqn+UTvrWQ==,type:str]
+        key: ENC[AES256_GCM,data:OexgSMZDgpdc6jjx+3R1ddXutztaSX8s8p4lt5ufm0bpYvJRztcBYjAw1tpk9Upp15rXRHaZpKDh3mZwsC6j5737pys56tE5F5aOw2UwlstK15XF6zQetzCfJFGwozEcEeDtSPhaThcnVidYP2GU0GUE3uRZBkeDcpkF2yn1azt2qYUe020miOv8JwV6seGXvTvzNGlTIssoyBuqXPI9jJpsXTaI1GqQYDbdggGNWZ1hBiYu,iv:Pn4vIpmyQGZnkF4aA4IdJ2aIDQDI6W/8FHpduKO0kOU=,tag:oS8jNxbJogQAH/Qj2ghY4g==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1stdue5q5teskee057ced6rh9pzzr93xsy66w4sc3zu49rgxl7cjshztt45
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMVDJ2TXJ2ZmxUNFFrZmFq
+            blRubHo4QThrSzFXalVHck82RzVWVzVjSXlZCldoaGpYYk0rSzlpVmdzMzQ0MXRn
+            c1dxRi9oaVhXc1B4NXNEK3kyQTBnYUkKLS0tIG1kQk1zTm5Mb013YTc4d2JPc3N0
+            K0ZSdkdJVERYNUZLeVV3cHJnT3FzekkK2mXf8DZPNU1wN6h96hewpPwUOrGr4Kv9
+            jYnpPIrdy0kyAKKEvWZse7PZfOQbKz2XQLYjWbqQnC9gdtC3hRJwlA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-07-07T00:46:18Z"
+    mac: ENC[AES256_GCM,data:HUyeJbB4Mnhd2B1qdd1zsj70sx19D9nsl6kIr27I/IyX52DISGUn8Fvi1YS/z8uzxcyKnfu+KY7hdmDTPkm8UJZyuE+ES5O3coLyAdWODlwRQ5nBYYslXVd+DghrIj7sK03QYmkIF7Qm3rjp6Z6bfN/jteKYXsEnHxGFB+A9u68=,iv:qhVmx2BUFMHnuJZYhoZJtsKkJDbEAq5E/rNKD2od6is=,tag:SmQWcczltEF28H7TzfTqRQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3

readme.md

@@ -3,9 +3,8 @@
 [🖥️ Upstream][upstream] • [🐙 GitHub Mirror][github]
 
 This repository contains the configuration, scripts, and other goodies for
-building and managing my kubernetes clusters (right now, that's just my home
+building and managing my kubernetes clusters. I share the source with you so
-cluster). I share the source with you so you can make exactly the same mistakes
+you can make exactly the same mistakes as I do.
-as I do.
 
 ## Setup
 
@@ -17,87 +16,9 @@ pre-commit install --install-hooks
 pre-commit autoupdate
 ```
 
-## Provision Machines
+## Usage
 
-Before we interact with the cluster, we have some manual work to do.
+See each cluster's individual readme for more information
-
-### Manual Preparation
-
-- Currently, my nodes are Arch Linux machines on bare metal
-  - Nodes must be ready to be controlled via Ansible
-    - Have `python3` installed
-    - Need to be `ssh`-able from a controller (my workstation)
-      - `curl -L files.lyte.dev/key.pub >> ~/.ssh/authorized_keys`
-  - Nodes must support Longhorn: https://longhorn.io/docs/1.2.3/deploy/install/#installation-requirements
-    - Nodes must be running on a host filesystem that supports `file extents`
-    - Provisioning takes care of the rest
-
-### Automated Provisioning
-
-- Setup Ansible on the controller (from `./ansible`)
-  - `pushd ansible && ansible-galaxy install -r requirements.yml --force`
-- Verify Ansible can reach hosts (from `./ansible`)
-  - `pushd ansible && ansible all -i inventory/hosts.yml --list-hosts`
-  - `pushd ansible && ansible all -i inventory/hosts.yml -m ping`
-- Use Ansible to build the cluster as configured on all nodes (from `./ansible`)
-  - `pushd ansible && ansible-playbook -i inventory/hosts.yml ./build-k3s-cluster.yml`
-
-And the cluster is up! If you want to interact with it from your controller,
-you can do this:
-
-- Copy the cluster information from the `./k3s-cluster-config.kubeconfig.yaml` file into
-  your existing `~/.kube/config` (or just copy it there if it doesn't exist)
-  - You will need to edit the host from `localhost`/`127.0.0.1` to the correct host
-
-```bash
-ansible -i ansible/inventory/hosts.yml $REMOTE_HOST -m fetch \
-  -a "src=/etc/rancher/k3s/k3s.yaml dest=./k3s-cluster-config.kubeconfig.yaml flat=yes"
-# TODO: this did not work for me
-# env KUBECONFIG="~/.kube/config:./k3s-cluster-config.kubeconfig.yaml" \
-# kubectl config view --flatten | sed "s/127.0.0.1/$REMOTE_HOST/" > ~/.kube/new-config
-sed -i 's/127\.0\.0\.1/10.0.0.87' ~/.kube/config
-```
-
-### Automated Teardown
-
-```bash
-cd ansible
-ansible-playbook -i inventory/hosts.yml ./nuke-k3s-cluster.yml
-```
-
-## Setting up Flux
-
-- Install the `flux` CLI on a machine that can `kubectl` into the shiny, new cluster
-  - `paru -S flux-bin`
-  - or `curl -s https://fluxcd.io/install.sh | sudo bash`
-  - https://fluxcd.io/docs/installation/
-- Run the pre-flight check (you must have `~/.kube/config` setup!)
-  - `flux check --pre`
-- Create the `flux-system` namespace
-  - `kubectl create namespace flux-system --dry-run=client -o yaml | kubectl apply -f -`
-- Add the `sops-age` encryption key to the namespace
-  ```bash
-  pass k8s-clusters | grep age-secret-key | awk '{printf $2}' | \
-    kubectl --namespace flux-system create secret generic sops-age \
-    --from-file=age.agekey=/dev/stdin
-  ```
-- Install Flux (note the `fish`-isms here, so you may need to translate to `bash`-isms)
-  ```
-  flux bootstrap git --url=(git remote get-url origin) --branch=master \
-    --path=./cluster/home --private-key-file=$HOME/.ssh/flux-k8s-clusters
-  ```
-
-### Troubleshooting
-
-If you screw something up here, here are some things you can do:
-
-- `flux uninstall` will nuke flux from the cluster so you can retry from the
-  beginning of this section
-- If you get something like `sync path configuration ... would overwrite path ... of existing Kustomization`, you can edit the `path: ...` field in the
-  `flux-system/gotk-sync.yaml` file in whatever you're passing as `--path`,
-  commit, and try the bootstrap again
-- You can pretty easily nuke the entire cluster and start from scratch as
-  a last resort?
 
 # To Do & Status
 
@@ -118,10 +39,6 @@ If you screw something up here, here are some things you can do:
     - Change dummy domain to real domain
     - Change domain's nameserver to cloudflare
     - Should be all set!
-- I want to look into Talos/Sidero + PXEBoot, since that could remove a lot of the ansible stuff?
-- `k3s` has a decent amount of magic AFAICT, so I'd like to learn more about it
-  and all its components so I better understand what my system is actually
-  _doing_
 
 [upstream]: https://git.lyte.dev/lytedev/k8s-clusters
 [github]: https://github.com/lytedev/k8s-clusters