feat(age): add zw's tpm module as age master key

2026-07-17 08:46:19 -06:00 · 2026-07-17 08:46:19 -06:00 · beff41369f
commit beff41369f
parent f5e7f7b8fa
39 changed files with 175 additions and 131 deletions
--- a/common/rekey.nix
+++ b/common/rekey.nix
@ -15,9 +15,6 @@
      {
        identity = ".age/zw.master.identity.age";
      }
-      # {
-      #   identity = ".age/zw.tpm.identity.age";
-      # }
    ];
    storageMode = "local";
  };
--- a/common/secrets/opencode-context7-api-key.age
+++ b/common/secrets/opencode-context7-api-key.age
--- a/common/secrets/opencode-github-mcp-pat.age
+++ b/common/secrets/opencode-github-mcp-pat.age
--- a/systems/jellybee/secrets/nix_serve_cache_key.age
+++ b/systems/jellybee/secrets/nix_serve_cache_key.age
@ -1,5 +1,14 @@
 age-encryption.org/v1
-> X25519 28ryRfapiYyN47AE4xg6umLDE75UUBOwN2SWaX3cJmo
-JJSwf4uOqdlcAeWafisDbSakyI/Op9IrIBUFFpBHypg
--- QYabiHNdlRqFVzbr9JFuSEWIOaK34wIN0H2wvCxy304
-±ÍU9åÝugN4¾UÌfN˜7»Ðµ|_!È>Ó‹8¸MQÓeV¯%Lí“$¿ìç|¦ù=™„’‘Øî6"R‚*xÖ<78>ÔDhëŽŽéAÕyThÒ¶pE@¨¯›®—$&çÜ5Â%îañŠ™®£\šbò—)Kœ{ónøOiN™áÊ0[ç•r
+-> gopass EBmkfE5+IZDQSmSVzSccDhBQepqbGixbp0bekIFlz1w
+X9++rwcH0LgVnU+yG4EMg/+olJFKIKwz0AoG9aucgTI
+-> gopass xY31bJBz5Pytmfajezcuh6ddQN9gVK1Ob6wmriMpEkY
+8UXjh6HJyJxUbBsvuv3iWSS5OVijO7qUMN0k3xZ9tyA
+-> p256tag o2TBTw BCklj0FX234e41wbXhkmeTbdcum2IoaCmzOpEo6z/5xwYTuGAryw4fkHNMbiZWz6P8ypYT9SFuauI07dBSg5kTM
+PiKJo+hZtdH8ISZpuU8tTdTLHrQTDGse8dcRYYhUsm8
+-> XIMQ#v-grease
+TrdnbuZd1WlB1yLeNubTeo2K3DMybN3UL8FQiRBFf2qF7UW1a7MY3ROXcjq4ZC3d
+puVY5HcVTzgxAL+BJzgpoii4GLkVk0njk+MSDZa2KyKaQr0WfzT4mw
+--- 0hYuVzRRisqRSKBwYpZThr8u0rvkgb8eE9P3ePN4gHU
+Ö5¯7[9§`¹	ýŸª™;Š¡Çq½˜ø"s ƒ——dÿÝ™™)Ð0 uÂKö¼Ã»”šd1ý½ô%×l{<7B>ßÈä^æ»ý&QÜeó3×®h`¡'¼íÈ!±£n-Ù
+ÞšA;MÑPŠl6 
+|£äJx,tÞhI<68>€¤	nÚ‘
--- a/systems/jellybee/secrets/opencloud_b2.age
+++ b/systems/jellybee/secrets/opencloud_b2.age
@ -1,11 +1,12 @@
 age-encryption.org/v1
-> gopass uZ23G4J4yBlVNHooSOdLwvHdMVoH3bVgHRAnRpJMIUE
-Ib/k0Fij/NXJAQmU1jAMU+Pg012y6TXyswfzRuEHYJ0
-> gopass aikqmf37icY1M8+sFwVgxzgxz/Bn94nRL50VDrKz2Rg
-riwXqqTOtxud/p5TwH+etLigjWRf1nGva4FFuNpjQEo
-> j"{zIT)X-grease %;a</r
-wuishhBgcsAiNw0keuC+e20rv3wDqzYKaJ2Ohx23Xv0OMdmf02VOAVoW44vy4Oxv
-pxyf
--- h972xFzfSeTwrqKVDog7oAGx7yvIUaNUFHTtnQtD10k
-¨õ%föÍ	ßÌzµ—EPµwK$ÐîYM8ZøÙEÛúìï”Ç•Y[ÍEë‡ç<E280A1>µN-<2D>w^×d$1YÍwãX¯EÖ®zN6ˆcÔQÜ~O|Ä¶¶Æ)œ´puÓiB‚žqú²£&thžnü˜V6.€þ¸êr†|1M¸\Í° 5M5%VƒÞï„‘<¡ËçÏphtGux‚d¼sQ
-_-áÏð@/B¥õ
+-> gopass pBxCSkbbxXqYdqhjyb1Qht5zoJwBQj/Ig69mIUDgGmo
+r7qYmIv2Xh0IP4xD4r6pCFko8oeY+nbgnZC8peeBj3U
+-> gopass 3IeHgAF6wvC7SQsAu/so2BJLdnfwIjx32J1XLWO1GFE
+898mx0bBG54bqOBs1rwIRUfASxGg1IoOnsv+5kAQenw
+-> p256tag Zr77UQ BBg++FkTLdv+IFXaXn07vjPPsqfQPIFkmy1iqrwk/pUVLvdltLK6OT1fqFaGwhZpt/nFPoiD8Eh36wmmSoiKTFQ
+HKSCj/6NHLEJcRgL3I4lxbGn0aRM+4VPeIVzraJlAxg
+-> Y1{`m-grease +&*(F Pm v" BJ5
+o4HVB4RjPf6GorV34vWYZ4WthxodpVPdRayWGKl/ejXWBtVwZbAGPIM4fn2GLkdI
+zwZYvWEYqPU
+--- 6qoUuRckbZA9UCuEuYT2Agy4YFclv49oekZUTil8KkE
+p<>ę±c$ŃµMpľ‰]đ<ËŢ äËC;má:kĽËě‹.0ů:7~b+<2B>>„¤,<TůI–´2Ą(‹:®‰G ¤C.ßr<C39F>ď‡Ű>o•Ć
dÂŚvöŘŹŃWëÍ8 ÷Ţŕ×Ť-Ď@-r€łý9ă3vłˇú:By<42>PÜ·33šú1e5,Ö‡Éi~™ĘQ•$Xá	ź¨_i±Ň)u‚ŘŚÓŹ
--- a/systems/jellybee/secrets/opencloud_webdav_password.age
+++ b/systems/jellybee/secrets/opencloud_webdav_password.age
@ -1,11 +1,11 @@
 age-encryption.org/v1
-> gopass H2k7GEE/Kl+jYD5dXqjz9LnSImbuMaN9Hz6njvG9XRM
-s+7G+pN/Il1QGb4S0K2YiOVyOeOwsYpbIcjYYrGvPDw
-> gopass A2b+SVh6ngti/U9hsG/fe0eZ0a+4BASda5SQ4BhzBUI
-YWc1cOhTIY1oPuSy4X3yDlTzxAW5CsjRyhpBHSjadhM
-> %88-grease *El_
-H0QQOEJT+jbJhGlip+OyTz9WQ0MbIkT3ZhgcJTWfPR9QnCPnhM1BGkfZEXzeojGq
-ahq4GgGRqjEX3fdhJB+KoDsiIg1mfpggXPjSfZHs6RXhKkTPt4A7OIsT209w/K8m
-tOk
--- BDtwqYKqzvzMAUiniRVrsZcQTwZClcB4wQNeHpFM0Mk
-®ŹíćköÝ›a>|éĄ°ČësÇť‰~x×ń˙ *”Íć[Ă“¶™ú'-ćpDQ¤„¦|pń ňöÎsđ‘âa8ßq':ü˘yŃż‘ZAŤ+
+-> gopass tKtL24dHuoi7hH78j3NKBVLoAmW6u/ILU2r2g0PUEUw
+1X4WtJRJtCZGO85kZLlsq+Mlatt1E2JMi7lp/prpciM
+-> gopass MMBiMYod+Xw4Lbvb+2j8R4cAYP0cJwmSDImN4/uoB10
+voSyFRk5vx/O3QugFlIbC5v9QxwQXMdPAtWJlKcIGl4
+-> p256tag otFhDw BHlFdR/mg6Jcw5wlrzE8ZEa7e6OeWl8F+kxigoHKyWrXtZFY/Zfila/xZ2ZfPJYr2JKyYpfYYn/u3go4ehRWxyQ
+KPHk/MDc6zDezbEJkaR2RcDtJ0OMOYl4sfem2fVPrKI
+-> wH)[-grease tjxfdq|G |,u~V
+Y/RSykUhZW9xGiKw0PtJeMA9VSEx71FMwr92taxBlLP9wmVssy8f0PkjHeFo
+--- fuukS+xZvrY9yYcgMQ84rJSMeM1O8XkzkJ9V2jLk80U
+çqÚÛ[‡TÐ¿Cñ:Á6Õ¨(£Y;Ö22d>xç¦e''»Æ‰¨»6>ìO-=Šâl«)oÄJtE3¿±ÌAÂC¶ ¦üA®]
--- a/systems/jellybee/secrets/rekeyed/jellybee/0c605eea4495e69e36740f2f485d435e-tailscale_key.age
+++ b/systems/jellybee/secrets/rekeyed/jellybee/0c605eea4495e69e36740f2f485d435e-tailscale_key.age
@ -0,0 +1,17 @@
+age-encryption.org/v1
+-> ssh-rsa CI3zLg
+C+qwIQZ2VC7kMAzEDw8L99lkKLggJ8nETu67Z8xwfaSh2Gxk+EcEznAisTQEFmQS
+eZdTc1Uy+1Um0rSd7slQyh7jsb7yy8ppSm+ms+1HwUeR0T/qFw6YxiVEmp+ayyWw
+qmWhVeus7l3TXTTQr3zGtjWTr5ndqCoqZhx626XlWsW8P1evT3uk6GcjrD8FPhLj
+GOPDZLD0GnHQ34hpkhqXCGUmFyom58qxMPTFXk/HPYaLBmXatAHQZAHgCrdSxj7o
+LwJfEqHOkLS9NYaSAPprEVPbZUnGIUaePk12n1zNaMalgUezDNopIGqbb8lU1ehk
+e2Cn2k94U3oQHxA0Dr243+/khmn9BUUUf6OgTIMmVwDIcOS/SwpuG0RRXs5vZNWj
+kqyMd/IAsXigM81QbU4/ZOkswj4/la9MrJA57c0T1XdYW/jN3etTXobHNFzRGi6n
+atQMHFMCwJvsfptVu1doHnIS0o8igW/xeZojTyBw6kKRydCmvpp5fsEGkgNKj1Jm
+ycpX5Y3GnWMB2GCvQ5SOVF32O4wZkopRmtA+t5A6zwF8/E7hLpc0pXJFpHrogutt
+Czfn/nJQfs9Bp2UfX+0TzBqHQvEhJQrRrEgyVlvCmMzgRCCh2JQFmdA+OozOVz6G
+d6wKP4vwPIx4NHUcaW30oZx4sISAxmk9wL5RTH6HUhM
+-> f-grease "qBzDq < tzJEi:0Y
+FNN/p8YfYLjS7BUnjIUsQ0wdN+AS2pD3VDJjt/mZxIA
+--- y+FpJr17SwTc13bkom+2JC6odQ7QMCcRMr/qo3NAsvQ
+Kx–|Ã/WuSÛdîÈü}¬]ÌI§SÐ"3Æé”3éUµ-Î»ðáj¸Ä<C2B8>Ë(×m<™À\•#•“|5Ño/ ?Ÿ(B¢‚±m<C2B1>¤fÖ$t<05>+aÈDlô±Œ
--- a/systems/jellybee/secrets/rekeyed/jellybee/114724bbbe210954e6376c8176323ad6-nix_serve_cache_key.age
+++ b/systems/jellybee/secrets/rekeyed/jellybee/114724bbbe210954e6376c8176323ad6-nix_serve_cache_key.age
@ -0,0 +1,18 @@
+age-encryption.org/v1
+-> ssh-rsa CI3zLg
+W/pB+FNxZmbNbRSYAUEGnYrx3Nnom8C3BqOcgs3epe3dz4WP6SVmQKcfL8iG+hAW
+Dq1JVKvICzuTebp1zoQUGPGojZqbukAbnK2/b79seLi0y4wskQzjT7TPVokS+a1n
+ffGzuYEf6S3d7R3IfgHBxsIrUbv5Syonu0f6+f7NX5oqOOLaoDFwLyWfO4ceT7iF
+29zAGpTeruQOaDDRUfvcrQMqGnVAhC3qDJRP216Aoxx+xSYAnNLz62SKTh7bs0lB
+pbmrknk6ONJeUwSrvi/qTWylL/4pwobl4S5MS012QTYsIDX9R+OjscCjYD1u+uHJ
+Pn5VrzBvqYLernM6rjgWxvJIcjdIXvi4PlwqK3h7ddTlzELrKrLrizeTmYpLrRGV
+JVYgxwInDARjwPVuxdGrw4DHOLAIDrhvHYuHJIvuGiNwIUIuLflmcxK2jr+BuNkZ
+LGVUtQU+YnINKRM4BM2G0FbQ5IFIt5tWKboW44KC6UwTKuN4mDlrECS0PRA6XopK
+2CX7QDSj6UZiZh052MxjrAfMImJG5KBdyaHFRNO+VIxIYLVL5cS+pUAVNJwmVPao
+Qv1lvuvcI/e4fwZnWeLUA0aHYwHJ08b5IxQhFl2377J1UL1eJjEF52i4DsiNGrIZ
+TcUwSEqKtNcXOYcB6VcbYMsh3t8pdVbQPVfS30xFdVI
+-> --grease q N3
+AX/IzO+8m3Lw391oJ+pjiP0aLXN0Cqd32iM4D0koe/9SqEG/1FjlD8JCtCR8e+aI
+JX0hOy8vQtxzFtI
+--- fx9tkpKVnniR6oSR1vFOtSYWWbmW9nf3YxSZvzcUXME
+âjçÆ?§îª¯íéœ”Öt€µh¾"}U"ö¬<C3B6>äñjý«ó‡ô °TKx-°à}IUìnê>€l“öékS¶¹^ŽÜ×Y%xÁ‚Øa…ãÑRú§ý(xQZør»‚»Š…¡ðýÁÝMc~b˜…UžäÑ…ýµ)›U˜)+
--- a/systems/jellybee/secrets/rekeyed/jellybee/1ecf1ad1854f69f93cf8e0fb05708841-wireless_networks.age
+++ b/systems/jellybee/secrets/rekeyed/jellybee/1ecf1ad1854f69f93cf8e0fb05708841-wireless_networks.age
@ -1,18 +0,0 @@
-age-encryption.org/v1
-> ssh-rsa CI3zLg
-VcoJmv5HRuGUMciX91OWx95cIiubRche0EohINcLtZxYKZhkimAcVM+gHr/rHVNO
-ik05mRuO9EIQJIMKNu+S1WvVv0KvTjLwP18+4eOtnhJ7sGTqixYfzXB5hB6gZ3yn
-FX7VQrkB+9UdbUvLOoCywKf24tX8LPljlFWju2OETZFIuTjyoKbr9jX0hJn2SEwm
-TQJT6UPSz8Ft5CDhJtTwe7YaGArQ0ZUPxEqtASB/8ltGsrXcyIKdgxzVGHNV0M+l
-cygN1BAT6AYOzKoXvP3/j3Ssm+8L1dsu1KvidhGGIXeg9Ih/G+yRTrbu2FzxuSIC
-CfXDQPuxjn8cbbvRD3D21Z3/LxJfZ0xFv2oJRRmySzGIyknZfk2knrlHXJhJz/5n
-xE82nFDrPJMMcdGPODpBY4lgWDasmZiG5NgmfE9i+HH4sbSDeG33wyzcHpemND4W
-ajiJp0GbsK7iEhGx44WttpsQvvtOyVVYPz62U8aiLsaE5AjSoabpSnQx5nZvKc+d
-Vp5PLXgyEZTDgkMFgUoJR+S3ou3RfAJawFivV20QHskSCKTlgvEAGCV7K53ems/D
-b5smR2EjuBIDZd+aHy+3AROJ+CFozSL83/faqJ45A/CRbyN6PmiCC4/IxLQnWfcH
-2n+six/KfKrEYUgEk/qn811swFTHYAlkAdQu0UQ2rUg
-> K^h7F%[W-grease f#s!B *KD%$
-ieciZ8UYKUDMfJeCAH26IsQkH8nSJlDH2AHU7xn4/GaszGVXio6FM8W2YiRhr5Dv
-sUjhoRPi7qU
--- HJE9wE/c7AnTRmA07C9k/TGVgGe+b4e5okGfa2iWbFI
-09làËG»mû¢9BÓWmÂv^©Ö®7b5–QË×5iB*“SŠªÑ€áÓv’²bH_
--- a/systems/jellybee/secrets/rekeyed/jellybee/2930d175d861fbdc6cd203c172045f30-opencloud_webdav_password.age
+++ b/systems/jellybee/secrets/rekeyed/jellybee/2930d175d861fbdc6cd203c172045f30-opencloud_webdav_password.age
--- a/systems/jellybee/secrets/rekeyed/jellybee/37af55be4bd2bc9fb49bb10f7046292f-opencloud_b2.age
+++ b/systems/jellybee/secrets/rekeyed/jellybee/37af55be4bd2bc9fb49bb10f7046292f-opencloud_b2.age
--- a/systems/jellybee/secrets/rekeyed/jellybee/65f7030a283a01e383c3b5546faf6453-opencloud_b2.age
+++ b/systems/jellybee/secrets/rekeyed/jellybee/65f7030a283a01e383c3b5546faf6453-opencloud_b2.age
--- a/systems/jellybee/secrets/rekeyed/jellybee/ac5b196295f9ab1103261754823f9966-tailscale_key.age
+++ b/systems/jellybee/secrets/rekeyed/jellybee/ac5b196295f9ab1103261754823f9966-tailscale_key.age
@ -1,19 +0,0 @@
-age-encryption.org/v1
-> ssh-rsa CI3zLg
-jagm4mu6qhBNG0oojDn40g+YetZVdKURkxehbvUOq9+9PglCKYH91koHRyr20Nr3
-mmij/9xkcW9e/NYfUTSKc0PrfTdqR1b+aAWzHU6v08uZ5sZO9Ei5thDnUoc+N7w+
-Ia52V0llQUs0mAhnvk8mWTXjojPbOggtcmtujKSIhc4ejTk5sm3DFCcGtC1EeEDq
-96Mlp+Baf5ZRXBxfFuDqerP85c8Upko5g0FeXNyfIFqkd58FSMFUpVxXJLG4owjH
-Xo2PpNUyiliTPkiuEhJPp5Qc5IE7H5JDCEF0FHvbSqvjmWqSY+3xJ6xqjiMsUzKg
-FA1TYol9nZVje0HP1+oICZ83g9VnfPYDc1D3cCXeNJViFwuE1iVSZqSiK1VAhH/V
-Q8DwjMf1FttjFFIMtANIKErAuMZTOiwkbVTJWIkuB09Khfp81PUPwgddhh3wga8L
-RFvprLEhmuNZMKf9572WymWUSny60k+ZgHG9wIIjAsoUNC4koVSk7KBltx10WGFU
-4O/uGtROjsXL2RGaSaUIoIbTJ5Mp9+iLwYDmZDnNo41RmyoN4O6CDfjMKWixW6yE
-o3dUaL0elR8kwreTh2k2bFpdB68Dt6WtL49b4YS6B1qTeGxCz2VdNXm6Ae4dFMob
-g+wR96VU7jMcgfWUEx4haW2bw2ZE8H0MmQ/t1z+ZZ1I
-> =bWC]d&0-grease
-cuVlhftHQQq3IpKENzeVcAj0by7kas3a9loxPD8HKHvOlzmAAESACSXOqFmgHSTS
-2s0HtPaVWQsBJD51cKHxsE0+i6PO8evjYzwMHme+SJhLASqR2p4OpQ55vmfm3Q
--- /PrGwwrQHTY8Cb114OW6hdavxtlOIBVcQczfB5SzlRo
-X+{¨(Ñ‹xhDaÆìB<C3AC>pY»
-|¯ž~ÉÝm¾î‚ç/Çæ³¾˜í¤õ×Ñ2ºð»£·´§NÛÕRUºSIWú4§Çª°éj~%iBZ`‡‘SëK‹¾à‰ˆÿ$
--- a/systems/jellybee/secrets/rekeyed/jellybee/b805280776315539bcda75527bc5e644-opencloud_webdav_password.age
+++ b/systems/jellybee/secrets/rekeyed/jellybee/b805280776315539bcda75527bc5e644-opencloud_webdav_password.age
@ -0,0 +1,18 @@
+age-encryption.org/v1
+-> ssh-rsa CI3zLg
+bICC3KmAWvFEuibbB2ANcaSDVWLmxuCXb+6K39IdblBEy3lyZ9RF3DA+BE69mUbl
+Qd/6xASrKX1CR3cL2kK/zw4mB9FD7okI0Q7quk1WsYmIcZ7IVSayGK9esjAs+2Io
+WeyIEh9gUnJ5y+6TpgL7MVATOka68Tkjka8XrqlG4EVD3kT4SyrWgnf7VktZlZi
+02afsW/ef9pyiQt6iOHDqVp4rtNBte2NemoddEtpsByaswDy39XYvKZsYPSW50fb
+l1zgGOFJbv5J4B8DUh7t/X/oKJP3XfToNAlY+75K6DJbl8AiMiFoJTbuZwYYZCse
+YX1kb5y35btTA0urlcyFSndYEWPyV/t4KQAYkk2v5IAKXhzKCKoMaBo4rcSPKi5Y
+2KMCuQhXuubQiVtbYDkEfACuklhQOPXzRwDX9UCe94h32I+M+cBI8YRwZo+PHenX
+I71zr0eC514/Ueq7AavR6BxAhUDrXChVijswhXbtBZgpYkE7deZ0eKtAncxA7xRa
+xj2zEo5otMOCp3dmY2TIIMoNYKESEj5W8u/FgK+GudFWrjp9j4qIUMGODu6JTwQM
+yiRVHjGvbRg1WpCkGgDe+NK6eUt0Jf8nEaVkoeHHMFCw4AE++Z0KYupp89AO+xbE
+wXipNtqKS/C7ktv0LLcNOm43DRyF/Lij6avQYtiEXbk
+-> 4]2Zo-grease u 6qfN '
+Go+w1ZRTGA
+--- yMQo8WEn6BH3+O7X4WKiG44fj2tTa4bcC79er5UMPL0
+G(‡%uÙ˜Œ<CB9C>ÓëÆÇœ³…Í~ñü¯‘ —ÿ×!ªç”~¨ßQòNƒ9í§Në<4E>
+œ/X[V³J‹jCN»ÕþA²gLÑ–”‰%ÚmÝ¹
--- a/systems/jellybee/secrets/rekeyed/jellybee/d753d448813fabfc875fd3ba6a7c378a-nix_serve_cache_key.age
+++ b/systems/jellybee/secrets/rekeyed/jellybee/d753d448813fabfc875fd3ba6a7c378a-nix_serve_cache_key.age
@ -1,17 +0,0 @@
-age-encryption.org/v1
-> ssh-rsa CI3zLg
-RsnwLudwxp2ra/UjotoZObsHNtlIFMDw2kqpEL5QwZblCwDEGFSWqpRNl4HAepyJ
-YvuJWSBBM3zB3uxmjX/nHwFbMIDFwRcAo4mPUGW0YVodPI0VqlMJdI6dwPgZOIz1
-OWfEOAx5XFkoCJFjQ6NFicHaFV3KqNzSy1R/cv1GoypWq1Ky9OzbNgjxd/KwVWko
-UlJPLBHgrHeZ1BiFqM2Aog14OtZ9ep8gGo4cgRfg1xisl1OnzVQl1IS31SdpGd2g
-FUj5Q6iaWv/xPPPn4Hp41bSLrHkGdEgaPL3YcWtKNyOMwm5jRCBWFmGjq1UjtLTU
-zcwBaGR+5ftIhF1dgqordCnTwszlg+2s27ZfhAQ/wwHLyVJl7MzSibW0IYfeH9nh
-CiHHIg5cYwytWM33Cym3nlnYLqMQ/h2UXS3hJOrHotAWs7IcCcXy7F3XccAElVFT
-B4NqKsNoepRH6qnh2gxwPCs0yupG38fSVEgNWci4R0MkfOSqTWImXj4tTmNplfug
-WxSmJvETyZ1z3/bY0Ih1EdHOmdFq0vH8R/j25ZYADxzSN4zVam20jXLGqDCBi7Vj
-yvpoumVAA1POpJzKPDavb0ccvvCPAm+f8HdYpk3w11//dGncJezzWiS9lGfKhO/1
-ufRgITQLYduQ1j/5vQb0DOkXd4z/J8Zbfq4xRv2r8Zk
-> S3-grease *PPpHQ lx}
-8fY1rW08QhZG
--- Kb+TRax2ioZYNURYx8+7xz77/v3wgtne6lYsc5U7GYk
-H:Í@…ÔÔ0?LÄ™3{¤èüÁÎÆÓ»[<5B>@NØ³*µ´Ë-{¿‡³z<‡øÞÙÅ¯³ÞžÄµ¿(Î;yP#3øèÅ,t(ðîŒÖÏiê÷ \N<><4E>”ù·°	~³Ÿ?UÁ^La…qË‰º%åÃëCÎú‹5 &g
--- a/systems/jellybee/secrets/rekeyed/jellybee/fc29d11dd534d71a1f813280ad74a711-wireless_networks.age
+++ b/systems/jellybee/secrets/rekeyed/jellybee/fc29d11dd534d71a1f813280ad74a711-wireless_networks.age
--- a/systems/jellybee/secrets/tailscale_key.age
+++ b/systems/jellybee/secrets/tailscale_key.age
@ -1,6 +1,12 @@
 age-encryption.org/v1
-> X25519 KwkB0kyPSKk7ajppD239Zn1gzsxMmvY3kWHKaBcXriQ
-Vb84MjFmMLttqERZhNFJ+6/vOf9haUDbxr4BH4r36EU
--- CQW7nkMz7k+xb1dA/10f0PnxI5aTpSiAyoEZacRFRs0
-¯6Öb÷d×,h\ëÏ[§ÑƒIEÏkv^îÝÆnþFè ùÒ¨.H—¥9ÿT¢¢Òé4Ðæ¹T<C2B9>êûaäœ&%ï.¹“ž¾1Ñûezƒ
-4Ÿ³
+-> gopass 4rjUQNSvjwVWl6lPH4Hv+wLF171ukitooI0dxRxJv2U
+nl1INASlmK9CZqeUXhmxIUejKBa/+emCWRwlLHF9joc
+-> gopass gy+ho9d9J5rnzpfRt9L6jcAIQu1G3PSk/MZaIwzLzxw
+yxdbRRvF1QvXsIgziSEDrL8UsuVjN4ijL6NnRRznWks
+-> p256tag EYFjiw BEabkRJJepF4Mh1CaxfImoOZbVqveWMQqd681fBkYRUrXoWgLDNT4NezKk40GrInZ1nLNAdp8AF86Sw4lhthqZQ
+DIRoi2WIF1puSsZ3JtvoCQny0Xu++q989WHWLQqSgMU
+-> 5Rw-grease
+vWQkkMfDcWGlc5GVgniMviH9kPp5NV4OThL8EMIltFBNNhbl2mJCcikBmFe3d5CG
+OPvhJcecKrqa0Asr27vQtzTgLrtK+cMigst3BPjNbA
+--- 4Auwe/NmRbZLBZA6uQFQ3TCq22kBRa7eWDLK/fnT+CM
+3Ç'ø©Å\Ö¶Yt¢,@M<>ÐËYZIŒ•f£ÛXÊÔûEÉñ‚Ge3¤dÑÿUñ×<&D«ñó<15> MÈä<›)åÚ"üÊJ,ÞÞŸìÑO…›Y]ôñ<18>uÄ¬í‘%×´
--- a/systems/jellybee/secrets/wireless_networks.age
+++ b/systems/jellybee/secrets/wireless_networks.age
@ -1,6 +1,11 @@
 age-encryption.org/v1
-> X25519 PsDqZDbawfdowuIoa1ihgyfvtkcv2k66ko6Kk+lR7HI
-unVFG3VFjx+rysoorujhDx3C0YiXFrZTFOnvekivqFc
--- rFhJYhuHXiklesCQNS3tiqiYOuL128O80ZpX26uuNI8
-·lépÁÿ
-$‚õö	È½AãnJ˜Ý-ožÍ5/—<[ì½»Ž-•	…,Îü¬þè—šWo
+-> gopass iubBcM6OQiUnyroP+DsOmecbcNEVlUWvANpxEP7AkEE
+VmjGe412FGzmp0P1NH4KqWiTqf/I9DIBRF5oi0hLe34
+-> gopass l8Q7fzJYSsnI+TVlCVOdcuco3nlVboxShx/W2cFNqRI
+oIewkqqXOGLdg6aukcZh3fOiBgJ+qqwXCNA6UWXdUsM
+-> p256tag fkzkjg BDjZ0JGgZl3EEC3lrbDTtA1b1pQcXKBIV3SJHtpyXzgenwkLf2NjYA1j0Tard2A3H9pqvc5322YK2ADmsHHj0VM
+LGmWRkOJ8+uG2CCk3pWUNHX5zScjxHtQ8SA8kgkLXr4
+-> !l-grease UmH?IYaV <v+$uf N{)1qv) W=
+rdXLi2MRdWAZm/r6ics+6jQ0KT92KQ/Z56vQq8v7Jjga7g
+--- 7jVbeXL3BUcVHk0a8YY1m/WH9LWGTvn1EHbq1uVWLpA
+>0TÁâ…™AR:<3A>ý€®Mk?U[<5B>}<śrĐéZÄ´Ła]§LU˘ĄŞŇÎúoY?;
--- a/systems/zw/configuration.nix
+++ b/systems/zw/configuration.nix
@ -24,6 +24,12 @@
      rekey = {
        hostPubkey = "age1ffpemt4x5l55wr42emf0f5v9lej84x7w7l44la30p329rc8cwftqach2t5";
        localStorageDir = ./. + "/secrets/rekeyed/${config.networking.hostName}";
+        masterIdentities = [
+          {
+            identity = ".age/zw.tpm.identity.age";
+            pubkey = "age1tag1qd9268qnywa9udlsql249ven7fguqskxc0ffgdwvfrvd3g9748sf787yjcq";
+          }
+        ];
      };
      secrets = {
        opencode-github-mcp-pat = {
--- a/systems/zw/home/secrets/rekeyed/37a17fb68b061ceffe8bbe6b9474a3e5-opencode-github-mcp-pat.age
+++ b/systems/zw/home/secrets/rekeyed/37a17fb68b061ceffe8bbe6b9474a3e5-opencode-github-mcp-pat.age
@ -0,0 +1,15 @@
+age-encryption.org/v1
+-> ssh-rsa QGRkYA
+nBsFQ1mNMq4wVVtxBQiCrKxJ6UgNMVkJRkw7FcOmDmNPsCRRXipfVRAX0rdUHm3S
+X/sEUgy+S0MlFf8f/LiKK9ivRsy4NoT7wVCZRDbNnnqK0Fjx3TVRxJCBPbsCBfR/
+ifxX9odVW457+UQRUUHvGCMJ6t3fadpenx9jfACOXKsZbIDH3soKRWCOc0p2vI6x
+0NZAigQexvuIgCJItKJ6J+41EHkDCona1NH3lftafOqKeIUH2HE+erddwDKfBPJh
+9QPrOmyeWT8oyc1PrH5o3X8d8DhA/0VwF0nQJ4euHwVMaQqwtAa27FopmwnQ/fSd
+85QC8Qnwe4UHGGhvuIeszfSJnmG+bBKkGa6wOgGi+JkvQSeJhe5eRZlDvNIvCBN0
+zq5P1j8YHJ2Iaq78CUxkIVB2Geeev1j1zEpCwIgfezfDYGpL18zVpDxYB44uqYY1
+hehWlhHuqr7R6uL7Jxy4ufhlAl/kuEKgYkicpVCL1FqYJ2nlZWZ8N32Tl5a3Ur1F
+
+-> |ZQT}Cb-grease 9ENw.{~t AiF!wF[ -^{4r{
+17yCIq46g6MH
+--- mhR7l9F59YpkqE3JWSOI2i5xAbDGiDnB8aqT3CXydFo
+xòã²ß—zgßÑB5nˆzí¼]ÞTlCO½Ñ9N8ÈA5”¯‘S¦ÑÛÊ¤Î“’ZeÓ$]ÜèÓ75êÄ’q?þà`üsh”])
--- a/systems/zw/home/secrets/rekeyed/99468c22c7aa4ff7e94ed522d65b5cfe-opencode-context7-api-key.age
+++ b/systems/zw/home/secrets/rekeyed/99468c22c7aa4ff7e94ed522d65b5cfe-opencode-context7-api-key.age
@ -0,0 +1,15 @@
+age-encryption.org/v1
+-> ssh-rsa QGRkYA
+mciKZzfcnFT2QLoDmlD23b+Uy6CFmtIfOQwrMQ66mhrflJjXqIFYK2liIq43jgG/
+Sit/MP7fcH9816AYmrWJ4R564JsUTiL2EmPnbeW+S9Qtqw+LH7LIjh21+G60ITNu
+WzxaxDhJIwJDA0Wr0aLTWWgXXTSZVyVvgtqfVoXftVE4yQ5hz5sDGDvM31ruEWNI
+QXrHewto1FE/EDpxoc09QnZ+LraCYAqEHXeC33GtNv1jiYTHycBN6oRhOvenpCsQ
+eqEbBass4pxuQVvqTjPCHWSpZGkc7lgdu3c3Hs7gM5vghTz47sEVifaGXJMdXQ9R
+sF/XlO7qKIsmdo63IduoQlK3bU+3Suo+vscyocaDHht8WlpsOT8Gs73WvhtMx5ah
+p4G9/du3x89nXNZAmHJ/t/qeRd3fNZtck55TrJuUqo090nhvv3/op2Rv/In9Dxl/
+pa7VJFKKdud58aQ7YkTeKPk1Ddkrxv8/PTKNbn3LyXl5oHp/3ORVahm0KkVhIMmL
+
+-> "*#JOm2-grease ao Z_Lofu LNhsQ
+9ugkTK02
+--- XhdRyUoXiFSc9szSbUBlY8oEW5e/LffRkuh8o/ZCpMc
+KÝ¬/Õ¡ZÕq9l5…%/„R¥”<07>b!ä³¼fó\6Bè÷JÀàîšbak-…g§uÜ‰»òVŠ”Ó.ïí]”Ò¥þ|
--- a/systems/zw/home/secrets/rekeyed/a31c0a50d72f6afae94801010bc80301-opencode-context7-api-key.age
+++ b/systems/zw/home/secrets/rekeyed/a31c0a50d72f6afae94801010bc80301-opencode-context7-api-key.age
@ -1,16 +0,0 @@
-age-encryption.org/v1
-> ssh-rsa QGRkYA
-DHxpgRUKnmpWy/Zoj/XME21glFjEGYBcurdVNupoeFtwl/jbinaA8sEVg0KSTxUP
-tmjKX3l1RPPoMNDDTazakZzPC8QUWnwgeDHfw0hP/RZaKzuF0ooyoLWd5Z4AEO7Q
-/U9usDAv9Jf8PGTv8AGoe/wOepRrwtfgHuJVfyZyOXhVDwJemvScuyCeFkkzdLli
-1GEMd3PWXH0IpcnNHhP8yrAhTVfJi8VLLsNfjbfuVdnPCHK8HboU1RbgM1tSRxbh
-FIbvYLmGr3wBfeqbG9CaOx0ODmn4JUcMKnEWQZ6n1xcreQW/OpvFWNyHzVw63WW7
-TRG0cd/0XgWWqL4ww6Id+bdJb/DwuqX7rtU6rdZF1vVymMtWZWhI4rYqYQuvFMSI
-nhhLQZcC7QRgrmWN6e8CPctWyAmANt1qaw8/ZGMesZRn7FY/cJ3TWmGjkmPkw4gB
-XEVVkPh1pUiV27cFfW6tNI3L3Lo9ycXGaSgq21OtOPK7sf4W5iKJOHHJkSGKIKSz
-
-> Ya-grease
-hNNPM9YnrR9h1N4w2rbVFnM0JjHfd/sIGguBaXn181Szm/IOHYUqERdYxey7ZWSH
-okS8TinWq0DKwumJev1aQw
--- 4bc1dhNQ5CwtAblBJd95yFUKeFpIezkadSt5WuXXqEQ
-b«J(.Ái”ðdÒ¦¬]œS<C593>‚Oê…—veæxT.)9¡sôÃ0Bxð½2¥Û+ÃÎ„‡!è%•±!¨ <20>M$ˆ1oì8ì™)[åXGˆIÁ
--- a/systems/zw/home/secrets/rekeyed/f6f654b935986b8e09d9ca5e46be12df-opencode-github-mcp-pat.age
+++ b/systems/zw/home/secrets/rekeyed/f6f654b935986b8e09d9ca5e46be12df-opencode-github-mcp-pat.age
--- a/systems/zw/secrets/nomad_token.age
+++ b/systems/zw/secrets/nomad_token.age
--- a/systems/zw/secrets/rekeyed/zw/16f74bc9db6848d7396bf386da12ca93-nomad_token.age
+++ b/systems/zw/secrets/rekeyed/zw/16f74bc9db6848d7396bf386da12ca93-nomad_token.age
@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> X25519 zM4IwC1NAJkmkOlgiE6C1hMQLhUAHMsJefbeTry0yg0
+F4kDbX9ldayxcBhqkkt0I3H6JN5DFvG5YhBU9LVXLZQ
+-> QB*IhF2N-grease 'Y?[ :Y apv%QEA 5>
+UkuRsgvQ7AB4smb+Kw
+--- q/cMidPEMzTwr5wYiymWBaJAkiWeJuZVLf5XEQ84VVE
+ù˜Ÿ&Y/ògÝ6£d2ÔzÖRyl7ük<>æ`{Ø
+g^
-šˆ<XpFT6ÉðØÇ¢ 6´‹>Ý^ôÓÀ<C393>T¢Tü*<2A>fÐ"½Zê~}Ôò
--- a/systems/zw/secrets/rekeyed/zw/3aa48e60208044e057b04dbb1ba5eeda-opencode-context7-api-key.age
+++ b/systems/zw/secrets/rekeyed/zw/3aa48e60208044e057b04dbb1ba5eeda-opencode-context7-api-key.age
--- a/systems/zw/secrets/rekeyed/zw/432615294adfe98f288da3a9e5bb09a7-opencode-github-mcp-pat.age
+++ b/systems/zw/secrets/rekeyed/zw/432615294adfe98f288da3a9e5bb09a7-opencode-github-mcp-pat.age
--- a/systems/zw/secrets/rekeyed/zw/54bd6dd0705aab9d4efe3a92aa3f3d01-spotify_password.age
+++ b/systems/zw/secrets/rekeyed/zw/54bd6dd0705aab9d4efe3a92aa3f3d01-spotify_password.age
@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> X25519 gcsQJc8VHlDrXF1O+x5IziwyXnaAEC88EnUhSYJYb2Q
+ox2nKmITyTgB84ZFLvYE1r+yg10aGUMmZKY7M7yzEB0
+-> C2Wo-grease
+ZBft6Bt6Ei6WQt32WTDW9Z2ujK3YH7rXtfwww/z0SH/Rn6C8HRpl0tX5oHzc8/TE
+nYejfAMBdQRER+hMxcgx/Mq4F9XVvsD4yLE
+--- +Eg5ri9clCHVKG2HG5kampp1wGhpMXdZUCBhESBl2MY
+ä©ØÞ^3÷‡Êöyof¬ bxû·ÓW¡oÄÝ-?Ÿ>À²
%óLÜÝËz<C38B>oÿF…–(cvs
"E
--- a/systems/zw/secrets/rekeyed/zw/62b10355b59a8228640472057d820c42-spotify_password.age
+++ b/systems/zw/secrets/rekeyed/zw/62b10355b59a8228640472057d820c42-spotify_password.age
@ -1,10 +0,0 @@
-age-encryption.org/v1
-> X25519 yTOAJ09ZRcity/FvSPQxXWcz9AAIf0cVwTgKmBkte3I
-mxWoeLkw/1wJk/UBLp4dQPYluXxyISz+MZrjHmDjQWk
-> Ir{Q*n-grease Y{Lku'
-iOtzFbkPmZ1LTGyoloxdUBCoPmWuhyj1WZ93lBxr3KAojEGeW5+NEmZzizwXUlC3
-1M0VM+cSVOENVuLK1AkmliAcghUr+nTWbfZWckMETg
--- y0Ecmf2AkkhcOrZ/EWJyPNFaqivIP1ZZ4eAsE4tAqzY
-Hu<EFBFBD>àqã$Í]D&iÕ$¸‘¶È<C2B6>ÌË"|Wd
-ðáW€íŠ<EFBFBD>
-jî|
2råGóí”i}Ì'k^ïª¼P:
--- a/systems/zw/secrets/rekeyed/zw/6b85491d837f7b2381b8861350f692fd-wireless_networks.age
+++ b/systems/zw/secrets/rekeyed/zw/6b85491d837f7b2381b8861350f692fd-wireless_networks.age
--- a/systems/zw/secrets/rekeyed/zw/9b5a2e6e9b648a6d51038ddd0731e765-opencode-github-mcp-pat.age
+++ b/systems/zw/secrets/rekeyed/zw/9b5a2e6e9b648a6d51038ddd0731e765-opencode-github-mcp-pat.age
@ -1,7 +0,0 @@
-age-encryption.org/v1
-> X25519 TH4jHE8mTSfjTodqcHUqaSeD1h0tIOFJUsaOKZGSJ2c
-BgRMgv/G88U7xBB4Gh2v1ERTmiK5L1lfkG6GNh6VNy8
-> I5+<Pnr-grease cJ
-DXYZ3oES
--- Gx4q3z3QfIs0pvuq93Y4S2TOqH3HkiyOhn0VlxAmhL4
-Øã¥§¢©"Bõ¬ô	†mõtòÀ&=…<>w‹33<‡ã4˜åE|Ï22îû³“$îA\-…\6Â.ñ«É+Xëní«
--- a/systems/zw/secrets/rekeyed/zw/a25aacf3ff1dcb78d25d4dbeddde600e-opencode-context7-api-key.age
+++ b/systems/zw/secrets/rekeyed/zw/a25aacf3ff1dcb78d25d4dbeddde600e-opencode-context7-api-key.age
@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> X25519 csc3rbx3NWoZLIzGMLv61x+htQZV4fuSIa3zkkGUuGE
+ugw2uYvpCgjrIdM6MA39kCn3bx7/+gfJwEzqKqBgC3k
+-> z4,-grease FPPe (=.aTFiQ 7S P%DI]Jv
+
+--- bQf3aIwKiR4zpCUQ68eSn/ywCwAIXeqSB0z3L9yzeGE
+y5hqV{,ÜálÔ8örhGa<47>c©¯›x¯$A0¨åå¦ðÜf8 yÇ|Z¦[°¹!Ð†™vh!å<>ÝQŒ{ì<^ÚPaúò‡Eƒ
--- a/systems/zw/secrets/rekeyed/zw/ae22e9057784ce682dbcfb31c67f7797-tailscale_key.age
+++ b/systems/zw/secrets/rekeyed/zw/ae22e9057784ce682dbcfb31c67f7797-tailscale_key.age
@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> X25519 zaP8KkJ5SZtMtTi53A9e+CY9iIZm+03V+zDnaCuA+Es
+5RHLc6CglbhkUhImHNPr0fwP3ZIEVnb2zGJjwv8VcpU
+-> v}Z-grease hS J 8 dF&)63)+
+FjPVL7jbWpUoapAqUfoxagrochU
+--- lkk7ktW/bGKkbAq+BiK4FM6jA4rRnUdTeVq9R9kssXE
+«Ñ"œ`…£!Ü?"ÂÐ_‚Ê“Ëò·Ò)›R1È¹t$L·áNà
+V"¥pÇ ¦ë”aB4’<34>o+P¤á»³>óS 6ŒÊÄÈÙ„³òŠÍUÂ¥[ì‹i`+d
--- a/systems/zw/secrets/rekeyed/zw/c523bd957de060e5302fadd27391313a-nomad_token.age
+++ b/systems/zw/secrets/rekeyed/zw/c523bd957de060e5302fadd27391313a-nomad_token.age
--- a/systems/zw/secrets/rekeyed/zw/db022a00c4f637b9e0920c7f59b33f7d-wireless_networks.age
+++ b/systems/zw/secrets/rekeyed/zw/db022a00c4f637b9e0920c7f59b33f7d-wireless_networks.age
--- a/systems/zw/secrets/rekeyed/zw/f8a02f4d753f98ee8b30c41e17317944-tailscale_key.age
+++ b/systems/zw/secrets/rekeyed/zw/f8a02f4d753f98ee8b30c41e17317944-tailscale_key.age
@ -1,7 +0,0 @@
-age-encryption.org/v1
-> X25519 AE3lSUF1WGyZQz7q7lP0ZPwMlplk91Y5ckpG0GpwWiQ
-zIxclse/jP/eGaHKWy1+DQD3d4caMcQ2CR/k9lJl1NA
-> :E-grease ?gc@K
-7uJr20G3m2Xy4NqNqOEOdNrjE5Q
--- j77nR9zS5GYjleqM74KoGC0ddx2XcU14bVjUeU//Fuk
-ë¼UÔÕ<1A>C±<1D>Ÿ,ÕdÎ <>¤p“fïhõ/Žñ¿ø
¨¶Ð~<7E>=d'ÄûHõ€u+ýh<C3BD>Z/P|›¢s‡þ&&Ä‰Z=
Ò¥ò<C2A5>O]"¯k=í¿ZFe
--- a/systems/zw/secrets/spotify_password.age
+++ b/systems/zw/secrets/spotify_password.age
--- a/systems/zw/secrets/tailscale_key.age
+++ b/systems/zw/secrets/tailscale_key.age
--- a/systems/zw/secrets/wireless_networks.age
+++ b/systems/zw/secrets/wireless_networks.age