Merge branch 'main' into vaultwarden

flake.lock

@@ -1,12 +1,32 @@
 {
   "nodes": {
+    "kpp": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1688479784,
+        "narHash": "sha256-xCI0Q8pQK5JRHYwieQApHmLseuXLiHnsYVlxUVKLCQA=",
+        "owner": "fsr",
+        "repo": "kpp",
+        "rev": "bf78c8481cbd1a43a122da90a63bbd0ed257b244",
+        "type": "github"
+      },
+      "original": {
+        "owner": "fsr",
+        "repo": "kpp",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1685004253,
+        "lastModified": 1689048911,
-        "narHash": "sha256-AbVL1nN/TDicUQ5wXZ8xdLERxz/eJr7+o8lqkIOVuaE=",
+        "narHash": "sha256-pODI2CkjWbSLo5nPMZoLtkRNJU/Nr3VSITXZqqmNtIk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "3e01645c40b92d29f3ae76344a6d654986a91a91",
+        "rev": "8163a64662b43848802092d52015ef60777d6129",
         "type": "github"
       },
       "original": {
@@ -18,22 +38,23 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1684632198,
+        "lastModified": 1688868408,
-        "narHash": "sha256-SdxMPd0WmU9MnDBuuy7ouR++GftrThmSGL7PCQj/uVI=",
+        "narHash": "sha256-RR9N5XTAxSBhK8MCvLq9uxfdkd7etC//seVXldy0k48=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d0dade110dc7072d67ce27826cfe9ab2ab0cf247",
+        "rev": "510d721ce097150ae3b80f84b04b13b039186571",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "release-22.11",
+        "ref": "release-23.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "root": {
       "inputs": {
+        "kpp": "kpp",
         "nixpkgs": "nixpkgs",
         "sops-nix": "sops-nix"
       }
@@ -46,11 +67,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1684637723,
+        "lastModified": 1688873469,
-        "narHash": "sha256-0vAxL7MVMhGbTkAyvzLvleELHjVsaS43p+PR1h9gzNQ=",
+        "narHash": "sha256-9TMSXvXmrr7bDYi+WeskWe/yho9UP01dGbV9vW5bRVc=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "4ccdfb573f323a108a44c13bb7730e42baf962a9",
+        "rev": "b2047c8fc963407916ad3834165309007dc5a1f7",
         "type": "github"
       },
       "original": {

flake.nix

@@ -3,48 +3,33 @@
     nixpkgs.url = github:nixos/nixpkgs/nixos-23.05;
     sops-nix.url = github:Mic92/sops-nix;
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
+    kpp.url = "github:fsr/kpp";
+    kpp.inputs.nixpkgs.follows = "nixpkgs";
     # fsr-infoscreen.url = github:fsr/infoscreen; # some anonymous strukturer accidentally removed the flake.nix
   };
-  outputs = { self, nixpkgs, sops-nix, ... }@inputs:
+  outputs = { self, nixpkgs, sops-nix, kpp, ... }@inputs:
     {
-      #packages."aarch64-linux".sanddorn = self.nixosConfigurations.sanddorn.config.system.build.sdImage;
       packages."x86_64-linux".quitte = self.nixosConfigurations.quitte-vm.config.system.build.vm;
       packages."x86_64-linux".default = self.packages."x86_64-linux".quitte;
       formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixpkgs-fmt;
 
       nixosConfigurations = {
-        sanddorn = nixpkgs.lib.nixosSystem {
-          system = "aarch64-linux";
-          modules = [
-            {
-              # nixpkgs.overlays = [ fsr-infoscreen.overlay."aarch64-linux" ];
-              nixpkgs.config.allowBroken = true;
-              sdImage.compressImage = false;
-            }
-            ./hosts/sanddorn/configuration.nix
-            # ./modules/infoscreen.nix
-            ./modules/base.nix
-            ./modules/desktop.nix
-            ./modules/options.nix
-            "${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
-            {
-              fsr.enable_office_bloat = false;
-            }
-          ];
-        };
         quitte = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
           modules = [
             inputs.sops-nix.nixosModules.sops
+            inputs.kpp.nixosModules.default
             ./hosts/quitte/configuration.nix
             ./modules/options.nix
             ./modules/base.nix
             ./modules/sops.nix
-            ./modules/ldap.nix
+            ./modules/kpp.nix
+            ./modules/ldap
             # ./modules/keycloak.nix replaced by portunus
             ./modules/mail.nix
             ./modules/mailman.nix
             ./modules/nginx.nix
+            ./modules/userdir.nix
             ./modules/hedgedoc.nix
             ./modules/wiki.nix
             ./modules/ftp.nix
@@ -68,8 +53,7 @@
             ./hosts/quitte/configuration.nix
             ./modules/options.nix
             ./modules/base.nix
-            ./modules/ldap.nix
+            ./modules/ldap
-            # ./modules/keycloak.nix replaced by portunus
             ./modules/nginx.nix
             ./modules/mail.nix
             ./modules/mailman.nix

hosts/quitte/configuration.nix

@@ -30,7 +30,7 @@
 
   # Enable the OpenSSH daemon.
   services.openssh.enable = true;
-  services.openssh.settings.permitRootLogin = "yes";
+  services.openssh.settings.PermitRootLogin = "yes";
 
   # Open ports in the firewall.
   networking.firewall.allowedTCPPorts = [ 443 80 ];

hosts/sanddorn/configuration.nix

@@ -1,46 +0,0 @@
-{ config, lib, pkgs, ... }:
-{
-  boot = {
-    loader = {
-      grub.enable = false;
-      raspberryPi = {
-        enable = true;
-        version = 3;
-        uboot.enable = true;
-      };
-    };
-    kernelPackages = pkgs.linuxPackages_latest;
-    # No ZFS on latest kernel:
-    tmp.useTmpfs = true;
-  };
-
-  nix = {
-    settings.auto-optimise-store = true;
-  };
-
-
-  networking = {
-    hostName = "sanddorn";
-
-    useDHCP = false;
-    interfaces.eth0.useDHCP = true;
-    interfaces.wlan0.useDHCP = true;
-    firewall.enable = false;
-  };
-
-  programs.tmux.enable = true;
-
-  # Do not log to flash:
-  services.journald.extraConfig = ''
-    Storage=volatile
-  '';
-
-  security.sudo = {
-    enable = true;
-    wheelNeedsPassword = false;
-  };
-
-  documentation.enable = false;
-
-  system.stateVersion = "21.05";
-}

hosts/sanddorn/hardware-configuration.nix

@@ -1,48 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  #imports =
-  #  [ (modulesPath + "/installer/scan/not-detected.nix")
-  #  ];
-
-  boot.initrd.availableKernelModules = [ "usbhid" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-  boot.kernelParams = [ "snd_bcm2835.enable_headphones=1" ];
-  boot.blacklistedKernelModules = [ "vc4_hdmi" ];
-
-  fileSystems = {
-    "/boot" = {
-      device = "/dev/disk/by-label/FIRMWARE";
-      fsType = "vfat";
-    };
-    "/swap" = {
-      device = "/dev/disk/by-uuid/SWAP";
-      fsType = "btrfs";
-      options = [ "subvol=swap" "compress=lzo" "noatime" ]; # Note these options effect the entire BTRFS filesystem and not just this volume, with the exception of `"subvol=swap"`, the other options are repeated in my other `fileSystem` mounts
-    };
-    "/" = {
-      device = "/dev/disk/by-label/NIXOS_SD";
-      fsType = "ext4";
-    };
-  };
-
-  swapDevices = [{
-    device = "/swap/swapfile";
-    size = (1024 * 2);
-  }];
-
-  hardware.enableRedistributableFirmware = true;
-  #networking.wireless.enable = true;
-  boot.loader.raspberryPi.firmwareConfig = ''
-    gpu_mem=192
-    dtparam=audio=on
-  '';
-
-  powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
-}
-

modules/desktop.nix

@@ -1,42 +0,0 @@
-{ pkgs, lib, config, office_stuff, ... }:
-
-let
-
-  extra_office_packages = (lib.ifEnable config.fsr.enable_office_bloat (with pkgs; [
-    vlc
-    libreoffice-fresh
-    okular
-    texlive.combined.scheme-full
-  ]));
-
-
-in
-{
-  # enable XFCE as lightweight desktop environment
-  services = {
-    xserver.enable = true;
-    xserver.desktopManager.xfce.enable = true;
-    xserver.displayManager.defaultSession = "xfce";
-
-    # Configure keymap in X11
-    xserver.layout = "de";
-    xserver.xkbOptions = "eurosign:e,ctrl:nocaps,compose:prsc";
-
-    # enable touchpad support
-    xserver.libinput.enable = true;
-  };
-  # enable sound
-  sound.enable = true;
-  sound.mediaKeys.enable = true;
-  hardware.pulseaudio.enable = true;
-
-  # additional programs for a lightweight working office environment
-  environment.systemPackages = with pkgs; [
-    ## audio management
-    pavucontrol
-    ## terminal, browsers, text editing
-    #vscodium
-    firefox
-  ] ++ extra_office_packages;
-
-}

modules/infoscreen.nix

@@ -1,29 +0,0 @@
-{ pkgs, lib, config, ... }:
-let
-  fsr-infoscreen = pkgs.fsr-infoscreen;
-
-in
-{
-
-  systemd = {
-    services."fsr-infoscreen" = {
-      enable = true;
-      wantedBy = [ "multi-user.target" ];
-      script = ''
-        ${pkgs.python39}/bin/python39 ${fsr-infoscreen}/build/middleware/infoscreen.py
-      '';
-
-      serviceConfig = {
-        User = "infoscreen";
-        Restart = "on-failure";
-      };
-    };
-  };
-
-  users.users.infoscreen = {
-    name = "infoscreen";
-    description = "custom user for service infoscreen service";
-    isNormalUser = true;
-  };
-
-}

modules/kpp.nix

@@ -0,0 +1,15 @@
+{ config, ... }:
+let
+  domain = "kpp.${config.fsr.domain}";
+in
+{
+  services.kpp = {
+    enable = true;
+    hostName = domain;
+  };
+  services.nginx.virtualHosts."${domain}" = {
+    enableACME = true;
+    forceSSL = true;
+  };
+
+}

modules/ldap/0001-update-user-validation-regex.patch

@@ -0,0 +1,25 @@
+From f5c68898be345fb0dca5ab7b596b9cbe674f5dfb Mon Sep 17 00:00:00 2001
+From: Rouven Seifert <rouven@rfive.de>
+Date: Tue, 4 Jul 2023 15:14:00 +0200
+Subject: [PATCH] update user validation regex
+
+---
+ internal/core/validation.go | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/internal/core/validation.go b/internal/core/validation.go
+index 3e168b5..10dfc0a 100644
+--- a/internal/core/validation.go
++++ b/internal/core/validation.go
+@@ -30,7 +30,7 @@ import (
+ )
+ 
+ //this regexp copied from useradd(8) manpage
+-const posixAccountNamePattern = `[a-z_][a-z0-9_-]*\$?`
++const posixAccountNamePattern = `[a-z_][a-z0-9._-]*\$?`
+ 
+ var (
+ 	errIsMissing      = errors.New("is missing")
+-- 
+2.41.0
+

modules/ldap/default.nix

@@ -48,6 +48,9 @@ in
 
   services.portunus = {
     enable = true;
+    package = pkgs.portunus.overrideAttrs (old: {
+      patches = [ ./0001-update-user-validation-regex.patch ];
+    });
     user = "${portunusUser}";
     group = "${portunusGroup}";
     domain = "${domain}";
@@ -65,7 +68,7 @@ in
       #tls = true;
     };
 
-    seedPath = ../config/portunus_seeds.json;
+    seedPath = ../../config/portunus_seeds.json;
   };
 
   #users.ldap = {
@@ -123,18 +126,4 @@ in
       };
     };
   };
-
-  # nixpkgs.overlays = [
-  #   (self: super:
-  #     {
-  #       portunus = super.portunus.overrideAttrs (old: {
-  #         src = super.fetchFromGitHub {
-  #           owner = "revol-xut";
-  #           repo = "portunus";
-  #           rev = "4dc29febacb11c613785bc95352fa00e0ca9b14a";
-  #           sha256 = "sha256-6O2392aHXhgvgZf6ftDY5Bh6hG3OzzCnlriig/Vkkz8=";
-  #         };
-  #       });
-  #     })
-  # ];
 }

modules/mail.nix

@@ -39,7 +39,7 @@ in
       domain = "${domain}";
       origin = "${domain}";
       destination = [ "${hostname}" "${domain}" "localhost" ];
-      networks = [ "127.0.0.1" "141.30.30.169" ];
+      networksStyle = "host"; # localhost and own public IP
       sslCert = "/var/lib/acme/${hostname}/fullchain.pem";
       sslKey = "/var/lib/acme/${hostname}/key.pem";
       relayDomains = [ "hash:/var/lib/mailman/data/postfix_domains" ];
@@ -61,9 +61,13 @@ in
         dumper:         root
         operator:       root
         abuse:          postmaster
+        postmaster:     root
 
         # trap decode to catch security attacks
         decode:         root
+
+        # yeet into the void
+        noreply:        /dev/null
       '';
       config = {
         home_mailbox = "Maildir/";
@@ -98,6 +102,7 @@ in
         ];
         # smtpd_sender_login_maps = [ "ldap:${ldap-senders}" ];
         alias_maps = [ "hash:/etc/aliases" ];
+        alias_database = [ "hash:/etc/aliases" ];
         # alias_maps = [ "hash:/etc/aliases" "ldap:${ldap-aliases}" ];
         smtpd_milters = [ "local:/run/opendkim/opendkim.sock" ];
         non_smtpd_milters = [ "local:/var/run/opendkim/opendkim.sock" ];
@@ -105,10 +110,10 @@ in
         smtpd_sasl_path = "/var/lib/postfix/auth";
         smtpd_sasl_type = "dovecot";
         #mailman stuff
-        local_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp";
+        mailbox_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp";
 
         transport_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
-        local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" "ldap:${config.sops.secrets."postfix_ldap_aliases".path}" ];
+        local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" "ldap:${config.sops.secrets."postfix_ldap_aliases".path}" "$alias_maps" ];
       };
     };
     dovecot2 = {
@@ -152,37 +157,36 @@ in
         pkgs.dovecot_pigeonhole
       ];
       extraConfig = ''
-          auth_username_format = %Ln
+        auth_username_format = %Ln
-          passdb {
+        passdb {
-            driver = ldap
+          driver = ldap
-            args = ${dovecot-ldap-args}
+          args = ${dovecot-ldap-args}
+        }
+        userdb {
+          driver = ldap
+          args = ${dovecot-ldap-args}
+        }
+        service auth {
+          unix_listener /var/lib/postfix/auth {
+            group = postfix
+            mode = 0660
+            user = postfix
           }
-          userdb {
+        }
-            driver = ldap
+        service managesieve-login {
-            args = ${dovecot-ldap-args}
+          inet_listener sieve {
+            port = 4190
           }
-          service auth {
+          service_count = 1
-            unix_listener /var/lib/postfix/auth {
+        }
-                 group = postfix
+        service lmtp {
-                 mode = 0660
+          unix_listener dovecot-lmtp {
-                 user = postfix
+            group = postfix
-              }
+            mode = 0600
+            user = postfix
           }
-        	service managesieve-login {
+          client_limit = 1
-        	  inet_listener sieve {
+        }
-        	    port = 4190
-        	  }
-        	
-        	  service_count = 1
-        	}
-        	service lmtp {
-        	 unix_listener dovecot-lmtp {
-        	   group = postfix
-        	   mode = 0600
-        	   user = postfix
-        	  }
-        	  client_limit = 1
-        	}
       '';
     };
     opendkim = {
@@ -190,7 +194,7 @@ in
       domains = "csl:${config.fsr.domain}";
       selector = config.networking.hostName;
       configFile = pkgs.writeText "opendkim-config" ''
-        UMask                   0117
+        UMask 0117
       '';
     };
     rspamd = {

modules/sogo.nix

@@ -39,7 +39,6 @@ in
         SOGoSieveServer = sieve://127.0.0.1:4190;
         SOGoSieveScriptsEnabled = YES;
         SOGoVacationEnabled = YES;
-        SOGoForwardEnabled = YES;
       '';
       configReplaces = {
         "LDAP_SEARCH" = config.sops.secrets.ldap_search.path;

modules/userdir.nix

@@ -0,0 +1,53 @@
+{ config, lib, pkgs, ... }:
+let
+  domain = "users.${config.fsr.domain}";
+  port = 8083;
+  apacheUser = config.services.httpd.user;
+in
+{
+  # home directory setup
+  systemd.tmpfiles.rules = [
+    "d /etc/skel"
+  ];
+  environment.extraInit = /*sh*/ ''
+    if [[ "$HOME" != "/" && "$UID" != 0 ]]; then
+      umask 002
+
+      # home dir: apache may traverse only, creation mode is rw(x)------
+      setfacl -m u:${apacheUser}:x,d:u::rwx,d:g::-,d:o::- $HOME
+
+      mkdir -p $HOME/public_html
+      # public_html dir: apache and $USER have rwx on everything inside
+      setfacl -m u:${apacheUser}:rwx,d:u:${apacheUser}:rwx,d:u:$USER:rwx $HOME/public_html
+    fi
+  '';
+
+  services.httpd = {
+    enable = true;
+    enablePHP = true;
+
+    virtualHosts.${domain} = {
+      enableUserDir = true;
+      extraConfig = ''
+        <Directory "/home/*/public_html">
+          Options -Indexes
+          DirectoryIndex index.php index.html
+          AllowOverride FileInfo AuthConfig Limit Indexes Options=Indexes
+        </Directory>
+      '';
+      listen = [{
+        ip = "127.0.0.1";
+        inherit port;
+      }];
+    };
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/" = {
+      proxyPass = "http://localhost:${toString port}";
+    };
+  };
+}

pkgs/server.nix

@@ -1,75 +0,0 @@
-{ lib
-, pkgs
-  #, buildpythonApplication
-  #, buildPythonPackage
-, fetchFromGitHub
-  #, fetchPypi
-}:
-let
-
-  dvb = pkgs.python39Packages.buildPythonPackage rec {
-    pname = "dvb";
-    version = "1.2.0";
-
-    src = fetchFromGitHub {
-      owner = "revol-xut";
-      repo = "dvbpy";
-      rev = "66c975f58b9f831ff6044aa65da58c3246938e5e";
-      sha256 = "sha256-OzK9r6tyyjawdDzqrDw9CFh0lf8Bn11rJpQl60YCoT8=";
-    };
-
-    doCheck = false;
-    propagatedBuildInputs = with pkgs.python39Packages; [ pyproj numpy requests ];
-  };
-
-  flask-misaka = pkgs.python39Packages.buildPythonPackage rec {
-    pname = "flask-misaka";
-    version = "1.0.0";
-
-    src = fetchFromGitHub {
-      owner = "singingwolfboy";
-      repo = "flask-misaka";
-      rev = "d960e512ac1ea16225d236984fcf130a46bb7b83";
-      sha256 = "sha256-RYDD+Bj3+S2isTdccl04zvLjpbalQ5sqb3sYnUy1+bU=";
-    };
-
-    doCheck = false;
-    propagatedBuildInputs = with pkgs.python39Packages; [ flask misaka ];
-  };
-
-
-
-in
-pkgs.python39Packages.buildPythonApplication rec {
-  pname = "fsr-infoscreen";
-  version = "2.1.0";
-
-  src = fetchFromGitHub {
-    owner = "fsr";
-    repo = "infoscreen";
-    rev = "43fb1fdc9dd15ccf40ef28b448ac6cfd51f32bc4";
-    sha256 = "sha256-KVIuL9g5gYC+3o2U7HQRqHQnU02kn7E9P7ZydFc/tyA=";
-  };
-  nativeBuildInputs = with pkgs; [ pkg-config python3Packages.wrapPython ];
-  propagatedBuildInputs = with pkgs.python39Packages; [ flask python-forecastio flask-misaka dvb ];
-  buildInputs = with pkgs.python39Packages; [ flask python-forecastio flask-misaka dvb ];
-  pythonPath = with pkgs.python39Packages; [ flask python-forecastio flask-misaka dvb ];
-
-  installPhase = ''
-    mkdir -p $out/build/middleware
-    install -Dm755 middleware/infoscreen.py $out/build/middleware
-    mkdir -p $out/share/infoscreen
-    wrapPythonPrograms
-  '';
-
-  makeWrapperArgs = [
-    "--prefix PYTHONPATH : $out/share/fsr-infoscreen"
-  ];
-
-  meta = with lib; {
-    description = "A minimal python server which supplies the fsr infoscreen with information.";
-    homepage = "https://github.com/fsr/infoscreen";
-    license = licenses.mit;
-    maintainers = with maintainers; [ revol-xut ];
-  };
-}

secrets/quitte.yaml

@@ -14,8 +14,8 @@ rspamd-password: ENC[AES256_GCM,data:bOW6eAwr18Guq+BQt68It6O6i3aAthDv1ANZ02Q8zAZ
 mediawiki:
     postgres: ENC[AES256_GCM,data:XRfUc2PRMJcoILAnm5MWr2Cg5u4e/IhGMUnz/oIQSzY=,iv:8U+qlD1SQzxUyD/6QK4SdwRCDyMODK/lP0IDrLlcQ4U=,tag:2spNMj9dY2wWilOusq24yQ==,type:str]
     initial_admin: ENC[AES256_GCM,data:iET5rz9rygx49NDBjKwqAlRgpeS+jq5iM5zmjnoKcyk=,iv:11iDbCrpzjCdyAB22R8NknJ6vzcpVZXCXB3iWsGWXw0=,tag:1RCyg1ysOWaXKdqqdHqRrw==,type:str]
-    ldapprovider: ENC[AES256_GCM,data:CPsrWmUviUpFIVVN/2a1lRjJCoZCWR9zrHm3T5Tv/YuXSYXStZGfBgXN96zhJUUpZcwiJq95o1sajyit+6itZCcGAPu0BTHSnNXRu1fgifonXE0ghw6rvzwkYpfBS+rfmBcG2wxX+7uZG3ulANYpvvGMxpKgM5IzQjE1sAytRDir6QeMGcFHP2gV4xQAdTNUZK2V+EKOlrcV5vTSzDSy3eXg18TVUgZqdxaQFfwnr2UN0eEEZ4Dn83G3QWsROZ0A7R3tuEmdAzmR8AdWBxfqCcOA8vZaOIOWb1AyobLCUaqQOj/SbGdgehMOQn1UcbRHpYQ2E9mvxD572uc/U5kzy/TbOLM34pkvckNrGfxwvqwbvXZrVP3gONY5CnJpk5XfVdT5Au/uwE5ZRs83ZEx31+85mpK3HecyBWRfWID0z2XS8PAU6G7ASQsXCh6sd5LFhL7zhxBQ4ENjT8pDi0OLYvw9VzPhPrdzooULeMytGitVWRtLsSzCn/D+U4x6EJLivLW6jv9SAIKg54fAjNEBYHh7GuHbr/VGtmiWKj6av2e3/BLgPOIyINzNv+X5QSsopZ2/yamPs+ARTOqAZvSyRgqereYoLZ5ZV15jIWiGc7HVfj/+Bk7cN4+VwFhzSuttp1DmvNNIWueeX69rdSqe41Y2lqKZ4ajOSIJ+YLP/dR0wvrVbd7QSP2OVRAnMugmeekbIuyIKPNsNJ183Z4y1m/ihIdRAzLnjSYuYCdWw3LXl5gM0ZTtGb7K+cIYcyJrS3fcaErDmqyI/LJoXNTo5CJI=,iv:ycKt8/awCo3HoO6Oa8H77GH9+m+xgR4kiXb7Cbf0wSY=,tag:b6pBoZs+E4CP+V9oZXrcoQ==,type:str]
+    ldapprovider: ENC[AES256_GCM,data:XQwNas9UF+rtbtBVCXGiouRO+fATgU51558ttWPTthOeAiCbpdxQvrAosLsXg7b304S9s+Bp2pY1jHuDSbZVmqa4NIgzAeEcmJfrwtCbP2++vZmkPwQOSv7F18eRE+l154GMZyOcEpwXtrFb+zL4R65Op+38f0vQRCWNBKVrjBPxdYt0etFP1TjwWleiZ3ywLNNcsHqg1FqSoPyNxigXT4ZUVSC9pk/Z/FHnTcCydaXI9M3ab4pHZVsiyfELlp7fXoG/pq3bTgTPtLLUavYrL9vLK6bxE+JkCiDq8+y5qAkIexXiMC0LKKGm0yQKHPW3gAp5W7YRrim0Ke4SZmp5F+Ktsu4MRsq2ffbv+H0sOPno4OmCI6C8Zmuf6PUF25AgmjIkg/tFElWMfbEGmIKIAputiNnZbgO5f0uvGMXK7CsrwkDi/Uo0ClGsCrw/TksHvjg2bv7wfGj9BAujURzixNWsd4R8X0LOCYRNRbYn078lAobCaxJgGYxVvn8q/+8hPWQGsQl3awmfTx0skt7dyA/E9ElU/mV/Q/HHCto9Zcl2NdVMi2/njPjaLhZ90YQybU0DhVnC8XTyRmNEK4wlbpANsM0cjf2QA3WGOvW/8Bujv1SwDFMJFeyREzOBF715PaxKVcjm5kU6H+gpoWU1E95iBWnuuy4acDi9Ei2tfKRrkC5LV16tUywwKuyJkKsm6mPunvvzVNVc+URFKbrcEDeHsZhq5hopWDRoUCuBT4TBqp+kzhlte2HVcIod+MB7aQOMddAjsPyqEwSsDD/pAX8=,iv:c50bBkXgl6zJPyAawGG4W37x8JSW8Hv0dcBCFhTL8e8=,tag:WAc55Icpinx/LPT3CoteXw==,type:str]
-postfix_ldap_aliases: ENC[AES256_GCM,data:SFCncYQAY2ZOA4d8YO58HQvUIRpevU6dX3BDv/pnB1JlvNmQH7oy4NZ4zf24/1i11EV7Z0NvPsa4sAqj8xRR++yyzeG9RQk3Pcst3AkFtA+MkNP0ueZJYsvLKyUE6G7UpzVVuLI+L5R121JrRp6+r5xqckOBNCBo73ulb7tC67hSfLA+ZNmDw+bKbshHej4l3hvM/c2sHLbcPp/+vxLXqthPR+y8lf6J/QgZ8Yzw1JxFVDO8ypaWpWZZvA3HbAzRJXxk2zxg+lpmgFsyzTXLZGhvf7NdRHUmTP9OgDFt/efhxpUvDYpDinzVOuFrYJGL/4U0LLvxtGQQaQ==,iv:dUx+BsJWaiZ6MeNB+OhrSxQf+co2USjJM5rKt7OP5GI=,tag:nOVLxEyIRSNnxGa8eHMmFQ==,type:str]
+postfix_ldap_aliases: ENC[AES256_GCM,data:kpffdciWI08Of2fm2B1lZ4rOYIhWtoBTnpU1N0iwiStA81Yl/NMDgHDCVv79XY6SuFTCBd6npKNz/0ibBy1WDSrDQymV5MIUmWVPwLcBSNMjD0d69PJYdUDVLmyhNkjB2hEL9JaH1PiO4iBM5y9yZx1LT+zlauAZEJPFgO/MvjkMknHZPKnRpBtT8wKTWTYUtBvzQtlACLKdIF0t37Q2DZAMtWrAgsrH811zUbsxJbYDInvNDPDHZHS+ZfF0Q1vXDLWUm+zZij6KRAJdOuEU9dyzhU/t93+LO9zKADwyF1Xk+2Uh,iv:cEui6fcDDINpUUcLZxGwPBMP1PjQVNMdScgaWdnIJ80=,tag:/7/mZckPJ7YLuJMp/BqbOQ==,type:str]
 mautrix-telegram_env: ENC[AES256_GCM,data:2p5vYV+/vEDrrZItTcT1vxddv2tM7dLGBUmG+OXHccTzJ2UhyYpDGgUMr5KgObxvyssYBZTsvbV7QFN3sjcU/jVPx1qEUn6zyKO0HBQjrviVU3urx5zNOnCEHwDKyDrZ1Hu/CE6lpGNrtGlpewgOs/+84JZIZhC9qSuzDhN38sr4OGfMr29fMzafYC+TGHoZyA64GI9xz0KvXhwg6ci1hLtVWYEOFW2Nf8uLY8qkNLuDzA6bYx8rn3CEXoxiv0n4,iv:jmcWTyVkqu9nDc1ws2NxkMKrHPZ13i3jqDkk4Y0kejw=,tag:BjhmPc4lSbsZBmZ/q2CqGg==,type:str]
 vaultwarden_env: ENC[AES256_GCM,data:X8wdQSieXfgNUqtoFRgz43jsWyrUQ1wxsM9L5iHoE8YFR5O6SzfAcjMsr4I0r2t5by/C4YorVsN5GQKyyVWS4SwelTT3UmFX89/pAUnAsUqeBZENOPEWiLNJnC3R3Xic6B1tu0OsX1X9RxR/X9EQJf/MIEdiNfhXKBxy7gZ0tDsDyze5/ZGVJX8=,iv:foByTYQw1KnB1MmwSQqmwza9PJJmdYdZbIHKrZ9vog4=,tag:8VTcOSefWmyd8ozGXHbklw==,type:str]
 sops:
@@ -33,8 +33,8 @@ sops:
             NEJBTHE2end1RDlHRTNFYlZjTjhib2cKmQRHpBKZ2DbQ5CfOwcSPfZAm9fnnpxUk
             +LcR8haK//O3N2uNf9etDW3VsT5ipPucCdFU1m/v9L5tcN6ZP8WP+w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-07-04T12:17:15Z"
+    lastmodified: "2023-07-12T13:51:19Z"
-    mac: ENC[AES256_GCM,data:gP5HkzRPwCi4I41vOmhnRbBaBnMcZG8ao8o4MR2PkuU5jISi4Z0Mrvy04ioeRgmX3ESJ60UixbF1JJ4siB3oyZ651bLwbOhy3eaQFXHreTcZMy2TLMQRR+vWUGIooP/xCm3wFIo0qhqprzngBG319vzidxnEOJCaMzMTZyxk0dU=,iv:AlOg391SXo6H+NpS1XevJz90qMbXNS8kDVdZ4JPdzx0=,tag:53dxW47eipY7UCdjJ+hVPw==,type:str]
+    mac: ENC[AES256_GCM,data:4x8MICw4ruTQEtYNupP+TwA6hFa3s8w4YXwcTl7tE+G0N15omTADr4cUQ4K9wbi2btY+ITMmWX9Pj9viwyeLupozylUgYyK39EuKBYRyPIMLMqVloJ0hjpHUpL9BVIgyl7COZQ6oKe6sp+bPCRKnuXmmYzYc5sqG6C1BKnU6pdU=,iv:iItvAED0wnbCBa9CzLq3TFC0cDyWX9WK1rIm92XZknI=,tag:MV6eZ21WZz98nxxSTBHNrQ==,type:str]
     pgp:
         - created_at: "2023-04-23T17:48:54Z"
           enc: |