fix(ui): blocking refresh of machine state after machine install

2025-09-05 09:26:39 +01:00
306 changed files with 3579 additions and 6653 deletions
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -8,6 +8,6 @@ jobs:
    runs-on: nix
    steps:
      - uses: actions/checkout@v4
-      - run: nix run --print-build-logs .#deploy-docs
+      - run: nix run .#deploy-docs
    env:
      SSH_HOMEPAGE_KEY: ${{ secrets.SSH_HOMEPAGE_KEY }}
--- a/.gitignore
+++ b/.gitignore
@@ -52,5 +52,3 @@ pkgs/clan-app/ui/.fonts
 *.gif
 *.mp4
 *.mkv
-
-.jj
--- a/README.md
+++ b/README.md
@@ -30,7 +30,7 @@ In the Clan ecosystem, security is paramount. Learn how to handle secrets effect

 The Clan project thrives on community contributions. We welcome everyone to contribute and collaborate:

- **Contribution Guidelines**: Make a meaningful impact by following the steps in [contributing](https://docs.clan.lol/guides/contributing/CONTRIBUTING/)<!-- [contributing.md](docs/CONTRIBUTING.md) -->.
+- **Contribution Guidelines**: Make a meaningful impact by following the steps in [contributing](https://docs.clan.lol/contributing/contributing/)<!-- [contributing.md](docs/CONTRIBUTING.md) -->.

 ## Join the revolution

--- a/checks/flake-module.nix
+++ b/checks/flake-module.nix
@@ -12,6 +12,7 @@ let
    elem
    filter
    filterAttrs
+    flip
    genAttrs
    hasPrefix
    pathExists
@@ -44,7 +45,7 @@ in
  flake.check = genAttrs [ "x86_64-linux" "aarch64-darwin" ] (
    system:
    let
-      checks = filterAttrs (
+      checks = flip filterAttrs self.checks.${system} (
        name: _check:
        !(hasPrefix "nixos-test-" name)
        && !(hasPrefix "nixos-" name)
@@ -56,7 +57,7 @@ in
          "clan-core-for-checks"
          "clan-deps"
        ])
-      ) self.checks.${system};
+      );
    in
    inputs.nixpkgs.legacyPackages.${system}.runCommand "fast-flake-checks-${system}"
      { passthru.checks = checks; }
--- a/checks/flash/flake-module.nix
+++ b/checks/flash/flake-module.nix
@@ -29,20 +29,9 @@
        imports = [ self.nixosModules.test-install-machine-without-system ];

        clan.core.vars.generators.test = lib.mkForce { };
+
        disko.devices.disk.main.preCreateHook = lib.mkForce "";
-
-        # Every option here should match the options set through `clan flash write`
-        # if you get a mass rebuild on the disko derivation, this means you need to
-        # adjust something here. Also make sure that the injected json in clan flash write
-        # is up to date.
-        i18n.defaultLocale = "de_DE.UTF-8";
-        console.keyMap = "de";
-        services.xserver.xkb.layout = "de";
-        users.users.root.openssh.authorizedKeys.keys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRWUusawhlIorx7VFeQJHmMkhl9X3QpnvOdhnV/bQNG root@target\n"
-        ];
      };
-
  };

  perSystem =
@@ -55,8 +44,6 @@
      dependencies = [
        pkgs.disko
        pkgs.buildPackages.xorg.lndir
-        pkgs.glibcLocales
-        pkgs.kbd.out
        self.nixosConfigurations."test-flash-machine-${pkgs.hostPlatform.system}".pkgs.perlPackages.ConfigIniFiles
        self.nixosConfigurations."test-flash-machine-${pkgs.hostPlatform.system}".pkgs.perlPackages.FileSlurp

@@ -96,10 +83,10 @@
          };
          testScript = ''
            start_all()
-            machine.succeed("echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRWUusawhlIorx7VFeQJHmMkhl9X3QpnvOdhnV/bQNG root@target' > ./test_id_ed25519.pub")
+
            # Some distros like to automount disks with spaces
            machine.succeed('mkdir -p "/mnt/with spaces" && mkfs.ext4 /dev/vdc && mount /dev/vdc "/mnt/with spaces"')
-            machine.succeed("clan flash write --ssh-pubkey ./test_id_ed25519.pub --keymap de --language de_DE.UTF-8 --debug --flake ${self.checks.x86_64-linux.clan-core-for-checks} --yes --disk main /dev/vdc test-flash-machine-${pkgs.hostPlatform.system}")
+            machine.succeed("clan flash write --debug --flake ${self.checks.x86_64-linux.clan-core-for-checks} --yes --disk main /dev/vdc test-flash-machine-${pkgs.hostPlatform.system}")
          '';
        } { inherit pkgs self; };
      };
--- a/clanServices/admin/default.nix
+++ b/clanServices/admin/default.nix
@@ -1,3 +1,4 @@
+{ ... }:
 {
  _class = "clan.service";
  manifest.name = "clan-core/admin";
--- a/clanServices/admin/flake-module.nix
+++ b/clanServices/admin/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules = {
--- a/clanServices/borgbackup/README.md
+++ b/clanServices/borgbackup/README.md
@@ -5,7 +5,7 @@ inventory.instances = {
  borgbackup = {
    module = {
      name = "borgbackup";
-      input = "clan-core";
+      input = "clan";
    };
    roles.client.machines."jon".settings = {
      destinations."storagebox" = {
--- a/clanServices/borgbackup/flake-module.nix
+++ b/clanServices/borgbackup/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules = {
--- a/clanServices/certificates/flake-module.nix
+++ b/clanServices/certificates/flake-module.nix
@@ -1,8 +1,12 @@
 {
+  self,
+  lib,
  ...
 }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix {
+    inherit (self) packages;
+  };
 in
 {
  clan.modules.certificates = module;
--- a/clanServices/coredns/README.md
+++ b/clanServices/coredns/README.md
@@ -8,7 +8,7 @@ The service consists of two roles:
 - A `server` role: This is the DNS-server that will be queried when trying to
  resolve clan-internal services. It defines the top-level domain.
 - A `default` role: This does two things. First, it sets up the nameservers so
-  that clan-internal queries are resolved via the `server` machine, while
+  thatclan-internal queries are resolved via the `server` machine, while
  external queries are resolved as normal via DHCP. Second, it allows exposing
  services (see example below).

--- a/clanServices/coredns/flake-module.nix
+++ b/clanServices/coredns/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules = {
--- a/clanServices/data-mesher/flake-module.nix
+++ b/clanServices/data-mesher/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules = {
--- a/clanServices/dyndns/flake-module.nix
+++ b/clanServices/dyndns/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules = {
--- a/clanServices/emergency-access/flake-module.nix
+++ b/clanServices/emergency-access/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 {
  clan.modules = {
-    emergency-access = ./default.nix;
+    emergency-access = lib.modules.importApply ./default.nix { };
  };
 }
--- a/clanServices/garage/flake-module.nix
+++ b/clanServices/garage/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules = {
--- a/clanServices/hello-world/default.nix
+++ b/clanServices/hello-world/default.nix
@@ -4,6 +4,7 @@
 # The test for this module in ./tests/vm/default.nix shows an example of how
 # the service is used.

+{ packages }:
 { ... }:
 {
  _class = "clan.service";
@@ -33,17 +34,20 @@
        settings,

        # The name of this instance of the service
+        instanceName,

        # The current machine
+        machine,

        # All roles of this service, with their assigned machines
+        roles,
        ...
      }:
      {
        # Analog to 'perSystem' of flake-parts.
        # For every instance of this service we will add a nixosModule to a morning-machine
        nixosModule =
-          { ... }:
+          { config, ... }:
          {
            # Interaction examples what you could do here:
            # - Get some settings of this machine
--- a/clanServices/hello-world/flake-module.nix
+++ b/clanServices/hello-world/flake-module.nix
@@ -5,7 +5,9 @@
  ...
 }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix {
+    inherit (self) packages;
+  };
 in
 {
  clan.modules = {
--- a/clanServices/importer/flake-module.nix
+++ b/clanServices/importer/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 {
  clan.modules = {
-    importer = ./default.nix;
+    importer = lib.modules.importApply ./default.nix { };
  };
 }
--- a/clanServices/internet/default.nix
+++ b/clanServices/internet/default.nix
@@ -31,6 +31,7 @@
      {
        roles,
        lib,
+        settings,
        ...
      }:
      {
--- a/clanServices/internet/flake-module.nix
+++ b/clanServices/internet/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules = {
--- a/clanServices/localbackup/flake-module.nix
+++ b/clanServices/localbackup/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules.localbackup = module;
--- a/clanServices/matrix-synapse/default.nix
+++ b/clanServices/matrix-synapse/default.nix
@@ -144,7 +144,7 @@
              };
            }
            // lib.mapAttrs' (
-              _name: user:
+              name: user:
              lib.nameValuePair "matrix-password-${user.name}" {
                files."matrix-password-${user.name}" = { };
                migrateFact = "matrix-password-${user.name}";
--- a/clanServices/matrix-synapse/flake-module.nix
+++ b/clanServices/matrix-synapse/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules.matrix-synapse = module;
--- a/clanServices/monitoring/default.nix
+++ b/clanServices/monitoring/default.nix
@@ -1,3 +1,4 @@
+{ packages }:
 { ... }:
 {
  _class = "clan.service";
@@ -10,15 +11,15 @@
      { lib, ... }:
      {
        options.allowAllInterfaces = lib.mkOption {
-          type = lib.types.nullOr lib.types.bool;
-          default = null;
-          description = "Deprecated. Has no effect.";
+          type = lib.types.bool;
+          default = false;
+          description = "If true, Telegraf will listen on all interfaces. Otherwise, it will only listen on the interfaces specified in `interfaces`";
        };

        options.interfaces = lib.mkOption {
-          type = lib.types.nullOr (lib.types.listOf lib.types.str);
-          default = null;
-          description = "Deprecated. Has no effect.";
+          type = lib.types.listOf lib.types.str;
+          default = [ "zt+" ];
+          description = "List of interfaces to expose the metrics to";
        };
      };
  };
--- a/clanServices/monitoring/flake-module.nix
+++ b/clanServices/monitoring/flake-module.nix
@@ -1,24 +1,22 @@
 {
-  lib,
  self,
+  lib,
  ...
 }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix {
+    inherit (self) packages;
+  };
 in
 {
  clan.modules.monitoring = module;

  perSystem =
-    { pkgs, ... }:
+    { ... }:
    {
      clan.nixosTests.monitoring = {
-        imports = [
-          (lib.modules.importApply ./tests/vm/default.nix {
-            inherit (self) packages;
-            inherit pkgs;
-          })
-        ];
+        imports = [ ./tests/vm/default.nix ];
+
        clan.modules.monitoring = module;
      };
    };
--- a/clanServices/monitoring/telegraf.nix
+++ b/clanServices/monitoring/telegraf.nix
@@ -11,54 +11,34 @@
          ...
        }:
        let
+          jsonpath = "/tmp/telegraf.json";
          auth_user = "prometheus";
        in
        {
-          warnings =
-            lib.optionals (settings.allowAllInterfaces != null) [
-              "monitoring.settings.allowAllInterfaces is deprecated and and has no effect. Please remove it from your inventory."
-              "The monitoring service will now always listen on all interfaces over https."
-            ]
-            ++ (lib.optionals (settings.interfaces != null) [
-              "monitoring.settings.interfaces is deprecated and and has no effect. Please remove it from your inventory."
-              "The monitoring service will now always listen on all interfaces over https."
-            ]);

-          networking.firewall.allowedTCPPorts = [
+          networking.firewall.interfaces = lib.mkIf (settings.allowAllInterfaces == false) (
+            builtins.listToAttrs (
+              map (name: {
+                inherit name;
+                value.allowedTCPPorts = [
+                  9273
+                  9990
+                ];
+              }) settings.interfaces
+            )
+          );
+
+          networking.firewall.allowedTCPPorts = lib.mkIf (settings.allowAllInterfaces == true) [
            9273
            9990
          ];

-          clan.core.vars.generators."telegraf-certs" = {
-            files.crt = {
-              restartUnits = [ "telegraf.service" ];
-              deploy = true;
-              secret = false;
-            };
-            files.key = {
-              mode = "0600";
-              restartUnits = [ "telegraf.service" ];
-            };
-
-            runtimeInputs = [
-              pkgs.openssl
-            ];
-
-            script = ''
-              openssl req -x509 -nodes -newkey rsa:4096 \
-                -keyout "$out"/key \
-                -out "$out"/crt \
-                -subj "/C=US/ST=CA/L=San Francisco/O=Example Corp/OU=IT/CN=example.com"
-            '';
-          };
-
          clan.core.vars.generators."telegraf" = {
+
            files.password.restartUnits = [ "telegraf.service" ];
            files.password-env.restartUnits = [ "telegraf.service" ];
            files.miniserve-auth.restartUnits = [ "telegraf.service" ];

-            dependencies = [ "telegraf-certs" ];
-
            runtimeInputs = [
              pkgs.coreutils
              pkgs.xkcdpass
@@ -77,37 +57,11 @@
            enable = true;
            wantedBy = [ "multi-user.target" ];
            after = [ "telegraf.service" ];
-            requires = [ "telegraf.service" ];
+            wants = [ "telegraf.service" ];
            serviceConfig = {
-              LoadCredential = [
-                "auth_file_path:${config.clan.core.vars.generators.telegraf.files.miniserve-auth.path}"
-                "telegraf_crt_path:${config.clan.core.vars.generators.telegraf-certs.files.crt.path}"
-                "telegraf_key_path:${config.clan.core.vars.generators.telegraf-certs.files.key.path}"
-              ];
-              Environment = [
-                "AUTH_FILE_PATH=%d/auth_file_path"
-                "CRT_PATH=%d/telegraf_crt_path"
-                "KEY_PATH=%d/telegraf_key_path"
-              ];
              Restart = "on-failure";
-              User = "telegraf";
-              Group = "telegraf";
-              RuntimeDirectory = "telegraf-www";
-            };
-            script = "${pkgs.miniserve}/bin/miniserve -p 9990 /run/telegraf-www --auth-file \"$AUTH_FILE_PATH\" --tls-cert \"$CRT_PATH\" --tls-key \"$KEY_PATH\"";
-          };
-
-          systemd.services.telegraf = {
-            serviceConfig = {
-              LoadCredential = [
-                "telegraf_crt_path:${config.clan.core.vars.generators.telegraf-certs.files.crt.path}"
-                "telegraf_key_path:${config.clan.core.vars.generators.telegraf-certs.files.key.path}"
-              ];
-              Environment = [
-                "CRT_PATH=%d/telegraf_crt_path"
-                "KEY_PATH=%d/telegraf_key_path"
-              ];
            };
+            script = "${pkgs.miniserve}/bin/miniserve -p 9990 ${jsonpath} --auth-file ${config.clan.core.vars.generators.telegraf.files.miniserve-auth.path}";
          };

          services.telegraf = {
@@ -115,7 +69,6 @@
            environmentFiles = [
              (builtins.toString config.clan.core.vars.generators.telegraf.files.password-env.path)
            ];
-
            extraConfig = {
              agent.interval = "60s";
              inputs = {
@@ -151,12 +104,10 @@
                metric_version = 2;
                basic_username = "${auth_user}";
                basic_password = "$${BASIC_AUTH_PWD}";
-                tls_cert = "$${CRT_PATH}";
-                tls_key = "$${KEY_PATH}";
              };

              outputs.file = {
-                files = [ "/run/telegraf-www/telegraf.json" ];
+                files = [ jsonpath ];
                data_format = "json";
                json_timestamp_units = "1s";
              };
--- a/clanServices/monitoring/tests/vm/default.nix
+++ b/clanServices/monitoring/tests/vm/default.nix
@@ -1,95 +1,24 @@
-{ ... }:
 {
  name = "monitoring";

  clan = {
    directory = ./.;
    inventory = {
-      machines.peer1 = {
-        deploy.targetHost = "[2001:db8:1::1]";
-      };
+      machines.peer1 = { };

      instances."test" = {
        module.name = "monitoring";
        module.input = "self";

        roles.telegraf.machines.peer1 = { };
+
      };
    };
  };

-  nodes = {
-    peer1 =
-      { lib, ... }:
-      {
-        services.telegraf.extraConfig = {
-          agent.interval = lib.mkForce "1s";
-          outputs.prometheus_client = {
-            # BUG: We have to disable basic auth here because the prometheus_client
-            # output plugin will otherwise deadlock Telegraf on startup.
-            basic_password = lib.mkForce "";
-            basic_username = lib.mkForce "";
-          };
-        };
-      };
-  };
-
-  # !!! ANY CHANGES HERE MUST BE REFLECTED IN:
-  # clan_lib/metrics/telegraf.py::get_metrics
  testScript =
-    { nodes, ... }:
+    { ... }:
    ''
-      import time
-      import os
-      import sys
-      import subprocess 
-      import ssl
-      import json
-      import shlex
-      import urllib.request
-      from base64 import b64encode
      start_all()
-
-      peer1.wait_for_unit("network-online.target")
-      peer1.wait_for_unit("telegraf.service")
-      peer1.wait_for_unit("telegraf-json.service")
-
-      # Fetch the basic auth password from the secret file
-      password = peer1.succeed("cat ${nodes.peer1.clan.core.vars.generators.telegraf.files.password.path}").strip()
-      credentials = f"prometheus:{password}"
-
-      print("Using credentials:", credentials)
-      peer1.succeed(f"curl -k -u {credentials}  https://localhost:9990/telegraf.json")
-      peer1.succeed(f"curl -k -u {credentials}  https://localhost:9273/metrics")
-
-      cert_path = "${nodes.peer1.clan.core.vars.generators.telegraf-certs.files.crt.path}"
-      url = "https://192.168.1.1:9990/telegraf.json"  # HTTPS required
-
-      print("Waiting for /var/run/telegraf-www/telegraf.json to be bigger then 200 bytes")
-      peer1.wait_until_succeeds(f"test \"$(stat -c%s /var/run/telegraf-www/telegraf.json)\" -ge 200", timeout=30)
-
-      encoded_credentials = b64encode(credentials.encode("utf-8")).decode("utf-8")
-      headers = {"Authorization": f"Basic {encoded_credentials}"}
-      req = urllib.request.Request(url, headers=headers)  # noqa: S310
-
-      # Trust the provided CA/server certificate
-      context = ssl.create_default_context(cafile=cert_path)
-      context.check_hostname = False
-      context.verify_mode = ssl.CERT_REQUIRED
-
-      found_system = False
-      with urllib.request.urlopen(req, context=context, timeout=5) as response:
-          for raw_line in response:
-              line_str = raw_line.decode("utf-8").strip()
-              if not line_str:
-                  continue
-              obj = json.loads(line_str)
-              if obj.get("name") == "nixos_systems":
-                  found_system = True
-                  print("Found nixos_systems metric in json output")
-                  break
-
-      assert found_system, "nixos_systems metric not found in json output"
-
    '';
 }
--- a/clanServices/monitoring/tests/vm/sops/machines/peer1/key.json
+++ b/clanServices/monitoring/tests/vm/sops/machines/peer1/key.json
@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1ntpf7lqqw4zrk8swjvwtyfak7f2wg04uf7ggu6vk2yyt9qt74qkswn25ck",
-    "type": "age"
-  }
-]
--- a/clanServices/monitoring/tests/vm/sops/secrets/peer1-age.key/secret
+++ b/clanServices/monitoring/tests/vm/sops/secrets/peer1-age.key/secret
@@ -1,15 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:ACFpRJRDIgVPurZwHYW0J1MnvyuiRGnXMeQj1nb9rDAIqHbZzZk8+E0Nu1+EdXwk78ziP6tHR1GQP2ILTtpLME4lXXRVjouW5Eo=,iv:ctR1HENO3XGIq1/gzYi47nateYzsSK317EKn92ptqDI=,tag:q1yuk/ZMx3nuORkiT/XXqg==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvMUtabnp3V0dzNFFYRzk0\nd0ZJbUtDMXRPRGxpRjhYR1MyQzdJYWdJTUFrCjBNV0pPTTlIOHBBbzlEQkFzVy92\ndENxcDdIZlNDSm1oZTNveUtIeVc3MXcKLS0tIGtocENjMFNYT0s1LzhYNy92QU5G\nREVEdjErb0xPSE1yb0g5bGlackh6bEUKwxBoDteD7+JfnlFF71CHx4oEdV/TFYcF\n3JPYUbTWAIyMtUu/CLbX+Pn9Mv+McrEIqhwT7TWL/YbELKVadX/k5Q==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-18T14:33:37Z",
-		"mac": "ENC[AES256_GCM,data:4631iJmioJ2vZ2PTFbdEJu7UqtyQbp43XBlgEbFAviGZdugb3weVI24rJ8m1Rdnxq8uciEeiX6YHBhURdWQY4JNm2wTGnjz7e2PwQ8FCwOmxCcIQPpdKKsziq/M4HArgD66eUxIWfTt1yJfHgBcUuuANbrbH8MirllT+hJTBhqE=,iv:rM8a/MpKbK7DlqjuR4BG77XDHLK11Q+E2rzZLDJalhk=,tag:bbGMn4anXrLHg4eLA0/CXA==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/clanServices/monitoring/tests/vm/sops/secrets/peer1-age.key/users/admin
+++ b/clanServices/monitoring/tests/vm/sops/secrets/peer1-age.key/users/admin
@@ -1 +0,0 @@
-../../../users/admin
--- a/clanServices/monitoring/tests/vm/sops/users/admin/key.json
+++ b/clanServices/monitoring/tests/vm/sops/users/admin/key.json
@@ -1,4 +0,0 @@
-{
-  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-  "type": "age"
-}
--- a/clanServices/monitoring/tests/vm/vars/per-machine/peer1/state-version/version/value
+++ b/clanServices/monitoring/tests/vm/vars/per-machine/peer1/state-version/version/value
@@ -1 +0,0 @@
-25.11
--- a/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf-certs/crt/value
+++ b/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf-certs/crt/value
@@ -1,33 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIFuTCCA6GgAwIBAgIUMXnA00bMrYvYSq0PjU5/HhXTpmcwDQYJKoZIhvcNAQEL
-BQAwbDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRYwFAYDVQQHDA1TYW4gRnJh
-bmNpc2NvMRUwEwYDVQQKDAxFeGFtcGxlIENvcnAxCzAJBgNVBAsMAklUMRQwEgYD
-VQQDDAtleGFtcGxlLmNvbTAeFw0yNTA5MTgxNDMzMzZaFw0yNTEwMTgxNDMzMzZa
-MGwxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEWMBQGA1UEBwwNU2FuIEZyYW5j
-aXNjbzEVMBMGA1UECgwMRXhhbXBsZSBDb3JwMQswCQYDVQQLDAJJVDEUMBIGA1UE
-AwwLZXhhbXBsZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC7
-sdy27E/XMAyKrgeFcXY70R/vX0gx6EcZlWGp2vZSUVAfW1ni/Vq/LVC02sxGEGwv
-10+42yP2yghi89doKo8oCoLsbVu+Pi+TmRsgAijy4jN8pHqbn9/Vk8M8utLa1u4z
-VonSIx9pzCYd2+IIdwVuWoyPAAnK/JIKS3n0A8KWkZ/1lq6YDl2whj8iY4YF2Ekg
-M0SWhquLZiaApAs7STTYvcP7iLfL4U6cH65dRAbwWMpMErPuLf/CedkXiSUp8Zqx
-YIXXE5lf7wqt7tM6k6BHic9FEzAo1HnBWBXV5eB5fs1lX9M1VPmx43XINCfzKwxE
-xODtIBrmvj+qOp6/ihBsu3LlOoOikxmL+T9Wgvf7fOuFC4BgmX85mGUV+EMZCDoJ
-44jlwFF8wgrfG/ZawkP+opNsQLsdOm9DbAdWpx5+JYdgWBahjxuH4z2eIiBmMKgj
-puqDgXdZzcERiYtOEEn0p0tvIkVLO3Tm2GjtHbmg1yF2nwsZjupGfcOGTVX4Zi5x
-ZCs7vYgBtZy96kNAuyZcFl8eBUr/oVg//i3Zc9Vnw/UJryB7I6dvj228hlrSz0Ve
-pGoeZXbcCzRv8NX2V0V1VTtrblSA3w5WRxVzK7UAVetPZ4dlJX+eyx3x2wiC3TiW
-ZYH8haFubQqr1h9oXFHgDE5xYZKr51T3SRGfpn6KvQIDAQABo1MwUTAdBgNVHQ4E
-FgQUJHOErJYWaGdla1XhxWha4XBKFYgwHwYDVR0jBBgwFoAUJHOErJYWaGdla1Xh
-xWha4XBKFYgwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAXqcg
-DW6qzFccR+JTqNR5HBOneB07LxaUqfBTAzU5GTRljY3mVpnTa6vVvXlStChqdmwU
-JJdRhWzTpzE4K92l4UKiYKy486PT1ff34aPLPX5BB9OzL4dgvC3gO0MYDJ84AFZl
-6BN/MRTinioG+s14SsxmgcUTl+HXsxt75r3WKjXvqECqhONLPXEXDJ6TVmfb2yd5
-X9cE6HLS2IXqfvs0EdXmQhSQVS7AlUQWZPDeoBTDUA1tT6ZKCcG0BuHEFnHxg4Yg
-W9xp/wMJCEly+9eNJYZYzyK1AHRGnTMRCSifTJEybwI4A35v68FyRLfAC0lM2qVL
-yQIGjj55+r4yGCK7bySSKjs59LLLxi6Px3S61OxAYq9KMT65nBLK9JAPFyTnikw9
-q/xW208lL+kcRtG+ARo5ycx5QUjWdsHn7TCnqxnDhHznwSV4KGbJFaGQZTtgfcz0
-g5a1GwxqHjEZ9IWiN38f2l4kpLLybKhwVQMYeG000s7rDa5hgjbh13qtQN6vUvI6
-VozzZPnFcR1Rsa8RR9njDugxbVwlJQfGkoMiMZwNGgXnZRC2XaI6SCyPwqTPBuVP
-ZR1eWv4qwsIGKJzJYcdChb5dimlTuVSfZmONpnrOP/4mhQLyaWr3XLqxxP3mIXsz
-k1PNWTkgLsXO8DNkCudxcvPElXfmaw6zwaLrZys=
-----END CERTIFICATE-----
--- a/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf-certs/key/machines/peer1
+++ b/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf-certs/key/machines/peer1
@@ -1 +0,0 @@
-../../../../../../sops/machines/peer1
--- a/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf-certs/key/secret
+++ b/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf-certs/key/secret
@@ -1,19 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:eWZyDgPQppMI/wNGSGsXowQ35I1KW1KH9p3GfxMFKNfoG2rnNwiBG11ARd9CDVMnY5OUt6RxL2sRKBlvqqjouCICDEEj3CWNnEpA55JGnmp3jj+kCRiA/te67F5vDXWus/mLGgI00apHwqUkwRkdck0URgniEIektncP9mQhcKDT7Lksm1S8oTHGDRcdiG4MxhrOq0qumVWdwS3qkAuwOvFMlYeCec6nfKBV5QTGeDxe8m8tijr7RTfM8cEaXrwaJDct1IIiHsl1U+V7+rz0KEvJ8ofeyOLP2zNSq4JfwM9rg/EwVuPsKf6LNmm6G/JdePlaCrwTaLchwb20/Tnf9nvrZu3P5w86IuniIyjFByvLR3bc6wKjxkWDU/+9UoTXfms5qKYNsgylFdg1xfqPjK0SgWiUL4IlxTBYPoPouNp/NZO+vzB+nkAcljCNGnYrfCz53F3gsTwBXIGmye2gvmNMvP+rs2/ySEt3XIzMEiWlBjDlurpAaYgqHhxVuc2jiqX56W8nu/QStopKP6sziPQbRqKDERSACxJ/WWumXTVO56dVJzqTpYnkqpq28tFoRd2yG7cJjlAbgqyxRuNkcLwnTEjGeGSSdVvmBeCqr4LuIh5qd2B4lrHQ6fR9xE/EHuJ2bcAH/x8ukOE7CZrACIEr6HfcpsnNhnpFYdA6gf4Gle21UJpK7hpY3+nCMNEPdfTjYkCvi/guzjG+X+UQPY466qbiVhUnNK4sg35axAJyNH1Jk6lK6+L/o4EVHBvnEUagLN2xFD5w0kXYMpzvQWEMaexyciDs6Natn7MzYVhmea8OfKXVE6dQz3Y5YFJ3uEQGGjuNO4fPyfnVgUULeaAs/IWkoPl2HV0x0KdxMEKGw2CAl7XuHYfV1rFTur+Wvf72rECUiiDmOgDU1g4plcBxQ6ocp34kize3lt1PdEL0R9lWg5c6l8LsqFhLqK8lpPV6neRdXX4UDzPjxnf3Ra/p1Hn283QSAv55pIwJQAo+kjWGckzr9CleUnLfPxQUKJQ7Jpjb/HtuhTQGA0mTsCbEHR6VWM/EYS4WzUd6opmfBstzSplD+kSBFIBoee+0dkUjfZcdFIWJRcabtjnn2TEsHHCK+dAguYY77OGeAh+tw7r66gONgtNlwjCN+KrzWH8cTu8BEaUoZH35lExs/wn+Ucj8IXDUXYLTTzGgokBybEeis+BDWFpDrhsZKFSwRE8tsrxfpgr7R1Ue9zMLoHnKeDZ6ndkm6fMinZ81OOchfE8bElRecCEzs9N/zU9nCtXKSAiYc86VntdbDFcPAm+bZ4hVkQpiRvQVGFYhgLuol7i9xhKD86TuIkqwMybEnT0ruqMNEVljxMWK7Cy+CAWg68w+hY2Pd54vXyC9ORndrYG7zbtVEe2dR7peeWTDTjU+5gVqIlC9lIhnIjgDprzvjszukHzc6TE98W9bnEKieSNGbQntm+YPohprg3CdVoPc1GfVueRqyXfXG0WVkLgfrhgfuLaJGKgwo438cUcRV8qH2wgCa7CGPMgvxzXJrK2dSRmZA/vPgZDpX9r78YlFGo+g/ghGhiNVonMYtMhohlSrzrQARA2AYuMgM91aXPnoKtqDy8+UL4g344bu7Jh3SKyGoqBo3TFLJyQgutzIx6EHG/eIDnTfc/I/3RgBtwo7RR/g+g899nhsiBLKVQId0/EZ+rKSndRTguCnFkjwCvXNW1z5uoiom/J5Q+J0xC1lqcjWF0zn9UwStQmvXDOABJUsGu+AZnj5l27MdRWvTfP2p3r12TXbyPEwOGuJa2LKSL/k4XmuaO8HkxSsfC1ImPOuPGbjgVkh62Y2oMqI90dtVrZ2HyosHwxv4tKzGAZbvH5vkK7TZXgoXCgAq+XwCPG9gtW2sIA2qoxw+SLOG5CEnHt6VlSgelLce9lU6kETdJ13fSqjMwZTQD07vXVnrtCHhsC6s+aY/7/2lJ2x8VmRBXVW7yREF56AdjYYVYgiAoHQqaQ0/OHpr6hacckqBTP0VzlNHLAzwm5zlgsZLDt3NxjTUZdgJEvFxF+rjzZHgyXwMA8hfzPbfVjftDW8hCMD1p8wJSY+CqaH+6/Ui9Q0X4F3YcZbhn/i9ZmMrB+CzBcjVzGrZIA0FLFoJWD2bFVPmMbcmDsT5ei0HafGBb2NBQ1gYvceGlN3WVQbTYCG54QavABNAyGFH+eQHvnk5jCg2DYspoCOPjEvIHjKM+gluIrozrnzMO2+hzp4Z+AscJCOm91LmL4PIFviyWzqy6AV1BLYPMLybdqrbEqUCFIzkXdFW3AZxV69hwhnBaZbLAaLeOG9YUz48o7oOITsDKVtuzUxkYDj+vBxI6zf7SvqjmopNXuZ2+4J+oa/p7xCpNUJTi0V4Ac38BZMiUcpXidu1V0pkGWbca4Dfqf2vBOzOcpLxrorizsyROv1SJAA7mR8KQut28HnkXgshIhB4cY99tnmKN/E1oiLGU0NkUHR6fCBtV2Ak8k7PNCVzhU0y6/NCJoSKqKQpuPEMVT+0QaKNfjtGvWgvZrvcchoMNAAGQa1OMSkmcZ4KdnAUaMROrS5LH3IBwpmSwtTBFkx9Shl3xMm2SpF6SdWnpweUbRAQqKNmRvSQLsXiEwOwxIO018mo8CgyiDyyIf4k0gFlNTapYyacwRO4vTMc3vfXjTcwK1LzUZVeG+e61WVDmmu2e6zls0JhXe7V58OkbnYWnzNzBSxWJluicno/P9h5vefBOHfysKe6SlGye/H0BO7piVG96cjqC0hTul8k1ysQoXtFgf4fbrlqs/D1kR9xVHcr3hAeWd9c4LwXEcSCeVuBd0bsoo2sYIeNSWNdJo9bSF0vb49snroh/RgbzntW3+geL94DEZaXMmf+RLujLEIgoNLlZ6r2jTMvlV6DWbSRE3cii6LFOXdQq53fmG/cI73R3hGNdQaLhZDaOi7hLnxbAMAjtEVQQOQg93a43d/BDGFzgNhKjYqyjZ9mM/Tk37DLlZ+xeIEJpALLIAaOguSG5cg3ALBrdGRec+SPf0r6M6DVkS1VHFz54kPx1eGkJQyQTotcykafNIt1Ahbqif0Z7U2bF0LxUbrZxcoldFteBNzihlXxa4zrY5Uj3BWEOrd6E8zHUIW97KwUAdttMTlNoOrMOgLY4790cVX+K7sa9ZPWz8Lts7o99sdcF7+dHoVxvfM0O3vXdzA/2O1opKqD6ZfPmU1UyWL/N2d4d9JerDhD6RFuBJP7nsv8osf2NHyWdHV9Luj0gOiBZvoOuSI4nvE05rPIXR/UEjXBw+1XaGHqcj8x/6rE6oTAma/1DH+E+N0j6mUd97vHFa48rbABCLWK4n9MrjXpQAVYNlXsSRgmEaVcq3S4RdRHKIp6yhhsUfNI8B8i8obQ3lBj7ktx1BNynnSJKTbQVOritYsQEY3t/+PvCdr4RKflftx0KzwcFTscVSrX22+aZZD+VrPZ3o8OUH8yxBWUsK5hdhuVOfNEjL6TpgDUZgbFUdlTDHmzPm5RxDxK6qGLxr0JwfLNm/+nYliKoyiTFKVKWFDE5Z+Rt0yKj+pDrWXBpKPySTfWX80VbioPW0curpiLt4tjVFfzhZ6V60vPfjcCjHlGz/pA5atUTGlZBP6DynDFJVV4QO0uhRYRfDvk+D6YOjZSHAX0e82IFg5l4d3fcF9WveqIfKRhJEVt3s4PLhCul/ESTWp45h1IA9ZfI4wvmuP0hCUvLgTOKx75QnwfVQRKJ5xa+R0e2Igywnobz63LaX9+yC8KJ23U8ZHS0Wc3E2NqTVEiP93ds98pMRMepoln20bsLUypcW2/py0WYb/YEGzlww9MxywAEQX+Pce8XhI7iylSfUzUmk863Y8cE1RMAiDeMFIQ8vZBT+LKwJ5zdik8jqJFED5XVGtYai7vEjj1tZKrfL+fR6CtDdQqyP1fWS+Xi5CZ7rdr2HiD943Vre1ZA8B7byozkMuahiYVzfTKIGI6lUMvXmmVNkdWXmj26YRy4l4X1KYM9L7f4NX8jRe61sUXanWJgcScxQTNKfGDOiKWRFQjo5UgCXOvjGtFCpRQyksY19TatFHRGrNdV2CmZhFTaaGbCbqD5QlfdoY1StT0Ko3x/YJR4/4Yoa2oCr2cVzNZ0/xPW0bC5NszLnKMjVI8Nj1nNFvMm4yZBpaz6YKk2REf9nndbkbhcppdrZN4Vt7wdt2gV2+5OpXRZ8OaxnegFpNiYuJb61gzXFYmYjWCkU6V9ncGV/71fXWMlxSlu4kLVhIQqD2+RI/VWAcS+cFEvb0Ntjft/gkyQcrLCeeFzdxXSNnlX1h5DigeRwyNtW4Mrk8vFQ6o2Oi3HiBKmvAD7sPkJg+lOJngQ/hI0477c0=,iv:q3j8EAokyyxiszf+wyRqxEr2igaD1bX7YnFx/NbsGg8=,tag:HKKYWRJEUwW2/TxL+5dSng==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1ntpf7lqqw4zrk8swjvwtyfak7f2wg04uf7ggu6vk2yyt9qt74qkswn25ck",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaeXRjU214aWk5ajl1aW9E\naGJlb1ViaVRmMTBHdkFDQUNDZS94WFZiNUNvCllmWTJBck9hR3U3V09VWDZwQ2xI\nd3ZEQnBIUG5ZSTVIdS8rQ2FMYVhyNk0KLS0tIEE1UG8rSzFyU01sVXhGVHpoaE9i\nSis4Qi9tMGFqbTNMTDZUVk1ZdXkrM28Km4VkfaOsZ69ckjvrg+os43H/O1IoWHzC\nt4LqZRz1Tk7/d1aLWavSPPjVYrCOMZeNBqGbQpGfjjuXrafClRNQdQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3R1RHTGViTnRLVVkyM3J0\nbm96cGVPTlo4NXBNL0g1eEVSNG9DUkgwVFRBCmRKVTlMRmV3Tmg2RTZIclBlWlcr\ndzI5MUxhcllzbE1IMDNxa08zVkpITmsKLS0tIG01Y2dyQkY3UmRudFk2d0p6bThn\nemlaWnZoS3p4VHhMTFFwTm9VN0ttYzQKVbLFgtK6NIRIiryWHeeOPD45iwUds4QD\n7b8xYYoxlo+DETggxK6Vz3IdT/BSK5bFtgAxl864b5gW+Aw4c6AO5w==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-18T14:33:37Z",
-		"mac": "ENC[AES256_GCM,data:XKCnd0QrAlOCECSeSvbLYHMLbmUh4fMRnLaTb5ARoP4Zc9joWGsCaRZxokc2/sG4BXA/6pkbQXHyIOudKbcBpVjjvs9E+6Mnzt53nfRoH/iOkYPbN2EO49okVZJXW0M1rlBxrxvGuiDlz2p2p6L7neKLy4EB482pYea5+dUr2Yw=,iv:oj/MkZCfkvCmAb79uzEvKwEAm1bKtWhS4rPRAWSgRgw=,tag:h5TPPILXkhJplnDT2Gqtfw==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf-certs/key/users/admin
+++ b/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf-certs/key/users/admin
@@ -1 +0,0 @@
-../../../../../../sops/users/admin
--- a/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/miniserve-auth/machines/peer1
+++ b/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/miniserve-auth/machines/peer1
@@ -1 +0,0 @@
-../../../../../../sops/machines/peer1
--- a/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/miniserve-auth/secret
+++ b/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/miniserve-auth/secret
@@ -1,19 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:Q0Vn7J0nERccBYT8HZxHF0Zi5qxmMu40n0H1c+L2SCRF6vRLdURxXKDwvh8xtTU=,iv:ucExjoYDFYy19GsBbNNldJRPBSpT+L+x4PrwTG+m2K8=,tag:/Quupyy/nnUNZsDudEMmNA==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1ntpf7lqqw4zrk8swjvwtyfak7f2wg04uf7ggu6vk2yyt9qt74qkswn25ck",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQWWo5OEJ5N1RTR0xMaDhL\nQnlUV2RrRXIzM01OemhQWjVkd3FNZjRhR2dzCi9IeE56b3VZTkNkdW9DMzVia3Zx\nbklxWmFpenRjdEIrc0ZDTGdmSTAxRTQKLS0tIHZJdjdYUzhhY0YzQjRqS0psZmpI\nVHJpUjNZNHRpc2ZWSml1TVNNejhiT28K8TTP/J+XspXZ7TVYj9YaBhEodPIXjojB\nRLqAIgJXRaK4NCLukC6l0IMii6w5J/512RnO2ZBTGhKfbdLfyLOFqg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrZVc5b0FhbzNXcG1zUDlD\neEVWcWpSRkRCMkxBTHdBM3dCbjVpR3FBa0VjCitlTmx4eUJOMHlaU0dFZEhpK3ZD\nZzlMQXVuZWpnaUNmQW9kOGtOaGVDMU0KLS0tIFNlUi9LSzF0UEJCSVBiRlRSNFQz\nNHhMbmNlRXd4ZEJQWVcvTWdCRWEzMUkKls7RbmNOdPDx8z15F+7qay9qIWx6jNsN\nTahT+GgbG29t1aGQCb0yEzKuUyAp39maxxSWToPsfCgJSYJ8RYiUng==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-18T14:33:39Z",
-		"mac": "ENC[AES256_GCM,data:g+9/fRiqom2+W28ZpiF+oBj9V6ieq5Xz3sRz3GyzvHoLr6yw51JvpG2QuYNYANW0WCiUjFDkU0qPj/9gLHcuX52nc+gNaTzznb1QGPg7WCGSQI7xaMzyYsPxHpg/BOdj5CL8GyLiOWstD1ch0kc3bJmyu68sJUs04uGtHAADzsE=,iv:oASrYaZarEPDu0R3hd/jMazLgwG5r//hIdMyU/tN15o=,tag:o1fgf5oy+rlWXg88FN5Nfw==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/miniserve-auth/users/admin
+++ b/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/miniserve-auth/users/admin
@@ -1 +0,0 @@
-../../../../../../sops/users/admin
--- a/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/password-env/machines/peer1
+++ b/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/password-env/machines/peer1
@@ -1 +0,0 @@
-../../../../../../sops/machines/peer1
--- a/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/password-env/secret
+++ b/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/password-env/secret
@@ -1,19 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:4NIUEK05kEQAKjR8F9mU3M/XvtZXw+X6CejVI0usMcb4WzagNz7XTVDhLWXZ9St5Ev0Y,iv:bD2+rDLMoWSqUAIZRJof0wRrJVya1xwZUTIJBdCs98I=,tag:g2s4byFHTzwU3ikcBGMElA==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1ntpf7lqqw4zrk8swjvwtyfak7f2wg04uf7ggu6vk2yyt9qt74qkswn25ck",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQeVh2M2tqSGlOVkpzNlhU\nd0pMd1R0c0tQWnZzdXViWmtxcjl1Wk1Ka0FNCnBUUWJVbjlyR1hSNGpXNWlPRHJB\nNnMzN3BMQ2NDamFBMlhHbVdJUEZ6cjQKLS0tIEJjWmI0ZDl1NXgrSW9uc0R0LzAr\neEwwOC9DdDg2RTJHQ0M3QTFlcVBaSE0K2Du4NguefdEyY1gS6OuVdO3gHga4omcR\n8B+K1wUfIQbArxZLawPxrj7WNDoW5d4mF9fA3MeV1DFyc4KwtYZmUw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvWkdBakVrMVR4RU8xdDlF\nRDkvL0Mrb3ltazhIMjRLZDVlSTVlaFY2ODBBCnlQM2s0SGEvZjFDN3dGWDhIN0dK\nenhQbjZ1ZS9QZzg5SE5XazZXS3dFSkkKLS0tIHJhKzhadGpjTXd4L3hOQkhpR0Fy\nYzhTN2dxVSt3OE5uZFpuWmVlYW4vd1kKwHOxP0C5mLcm4oIT/sGQtUsdsmu3LSN0\nSola5+N+IrAZ+HKnuZlDLZ5JmJSc5j/YhGNn7KR1xhkhfGSS1e3UZw==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-18T14:33:39Z",
-		"mac": "ENC[AES256_GCM,data:ehbrYqTJcsBKGHUB25JHFnKXrJ6z3LkcElZ89xVr4XxLet+odbhsjIoP2FCcxex7PlXcegMduhHBpXwNGUbX+IUNAXTxlWA9CLDmYhWuS2WLiEVXrS11NE03/zUyHdVx/C38dbIPrWD9iaYSrAiuOyfqDTh9k/Bn7vehLTtadoE=,iv:Nk2WVuJydi5tfsb1Mib4A6NocBCDp9QoIbSadq3bIDI=,tag:IaoyfCv3SkmtemXMR9XnkA==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/password-env/users/admin
+++ b/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/password-env/users/admin
@@ -1 +0,0 @@
-../../../../../../sops/users/admin
--- a/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/password/machines/peer1
+++ b/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/password/machines/peer1
@@ -1 +0,0 @@
-../../../../../../sops/machines/peer1
--- a/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/password/secret
+++ b/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/password/secret
@@ -1,19 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:0BmP+NwG/NGe6R5yU55/MdPEQ8E5u+VXWtvstHc4GpDtmBY=,iv:vo8XBcN7KcYjiyKvvp+XDOdP9yR9B7wJi0XlaiCdVbk=,tag:brK9ntAPSuOvw/C+oDo51g==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1ntpf7lqqw4zrk8swjvwtyfak7f2wg04uf7ggu6vk2yyt9qt74qkswn25ck",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4Tk1INGtybUVlejlNNlZE\nVms3TkdRVVF1T0E4TmV3NmxvYWVEL2U3WVhNCjJIaHhBcWVlMEYxRjg5bzJpTWdJ\neUhaRTNRTmtlTW0zUXQxTVZEMkQ2MFEKLS0tIFNGWDI4b2FXTE8xQ2xqb0cyK3FI\ncktHWnE5c1ZSVFpmQU1HZmU2VVB1QmcK/s1fVmwpMMg4BYkkAJzSY7hVQWae1F7g\nmfH8EGlr74mifWUNEbd49/K13nl8atQx6bcau83JIEQR+yyihuY4Jw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsL2FXVytUUVZnVU90bG5L\nYURiYjgwN3RuTldWMGl4clpUWmxkeUsrVzM0CkhKZFgwWHl4dWhNSWRQRXVPNDR6\na3hHNmp2RG9YNDhNM2MyV2FuOGY2UlUKLS0tIFpNU2tNOHdhRDRTdHhYWVh2NGZa\nU3J3S0hpclZzWGIwTlFyczdNZkZSZTAKXCZrLaIOVq90ejoKMaRiK0xNw8WOPcnm\nz2uxProEYvQhY8k29mhCFX5HCN0tGn1XTtHeDL7uHuKuFsnSG/fgYQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-18T14:33:39Z",
-		"mac": "ENC[AES256_GCM,data:QkGJKj/H+MI9Mr9Up5NDUToSddY5eTz47egc2+IatfxR8RebKJ2/mYaeLV26vPdmY60bIac4N/nZkoa6IVBhkHHMvsEHsx3nD6Lro9Wf/pWP8Zddzr90LF5p2+wusq25JutKQiPKOb2gmrcagmSsH/7V/UqI/my3PMeKmw6irhw=,iv:hOtHF/cDFdNfvqCKRhJsOwAHEiQmCPjENzsg23sKG+Q=,tag:K7qG9b4fQD0VbAV8OYp3vw==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/password/users/admin
+++ b/clanServices/monitoring/tests/vm/vars/per-machine/peer1/telegraf/password/users/admin
@@ -1 +0,0 @@
-../../../../../../sops/users/admin
--- a/clanServices/mycelium/flake-module.nix
+++ b/clanServices/mycelium/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules = {
--- a/clanServices/packages/flake-module.nix
+++ b/clanServices/packages/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules = {
--- a/clanServices/sshd/flake-module.nix
+++ b/clanServices/sshd/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules = {
--- a/clanServices/syncthing/flake-module.nix
+++ b/clanServices/syncthing/flake-module.nix
@@ -5,7 +5,9 @@
  ...
 }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix {
+    inherit (self) packages;
+  };
 in
 {
  clan.modules = {
--- a/clanServices/syncthing/vars.nix
+++ b/clanServices/syncthing/vars.nix
@@ -11,9 +11,7 @@
      pkgs.syncthing
    ];
    script = ''
-      export TMPDIR=/tmp
-      TEMPORARY=$(mktemp -d)
-      syncthing generate --config "$out" --data "$TEMPORARY"
+      syncthing generate --config "$out"
      mv "$out"/key.pem "$out"/key
      mv "$out"/cert.pem "$out"/cert
      cat "$out"/config.xml | grep -oP '(?<=<device id=")[^"]+' | uniq > "$out"/id
--- a/clanServices/tor/default.nix
+++ b/clanServices/tor/default.nix
@@ -58,7 +58,7 @@
          priority = lib.mkDefault 10;
          # TODO add user space network support to clan-cli
          module = "clan_lib.network.tor";
-          peers = lib.mapAttrs (name: _machine: {
+          peers = lib.mapAttrs (name: machine: {
            host.var = {
              machine = name;
              generator = "tor_${instanceName}";
--- a/clanServices/tor/flake-module.nix
+++ b/clanServices/tor/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules = {
--- a/clanServices/trusted-nix-caches/README.md
+++ b/clanServices/trusted-nix-caches/README.md
@@ -7,7 +7,7 @@ inventory.instances = {
  clan-cache = {
    module = {
      name = "trusted-nix-caches";
-      input = "clan-core";
+      input = "clan";
    };
    roles.default.machines.draper = { };
  };
--- a/clanServices/trusted-nix-caches/flake-module.nix
+++ b/clanServices/trusted-nix-caches/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules.trusted-nix-caches = module;
--- a/clanServices/users/README.md
+++ b/clanServices/users/README.md
@@ -8,7 +8,7 @@
    user-alice = {
      module = {
        name = "users";
-        input = "clan-core";
+        input = "clan";
      };
      roles.default.tags.all = { };
      roles.default.settings = {
@@ -35,7 +35,7 @@
    user-bob = {
      module = {
        name = "users";
-        input = "clan-core";
+        input = "clan";
      };
      roles.default.machines.bobs-laptop = { };
      roles.default.settings.user = "bob";
--- a/clanServices/users/flake-module.nix
+++ b/clanServices/users/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules.users = module;
--- a/clanServices/wifi/default.nix
+++ b/clanServices/wifi/default.nix
@@ -1,3 +1,4 @@
+{ packages }:
 { lib, ... }:
 let
  inherit (lib)
@@ -28,15 +29,6 @@ in
                  default = true;
                  description = "Automatically try to join this wifi network";
                };
-                keyMgmt = lib.mkOption {
-                  type = lib.types.str;
-                  default = "wpa-psk";
-                  description = ''
-                    Key management used for the connection. 
-                    One of "none" (WEP or no password protection), "ieee8021x" (Dynamic WEP), "owe" (Opportunistic Wireless Encryption), "wpa-psk" (WPA2 + WPA3 personal), 
-                    "sae" (WPA3 personal only), "wpa-eap" (WPA2 + WPA3 enterprise) or "wpa-eap-suite-b-192" (WPA3 enterprise only).
-                  '';
-                };
              };
            }
          )
@@ -58,7 +50,7 @@ in
            ssid_path =
              network_name: config.clan.core.vars.generators."wifi.${network_name}".files.network-name.path;

-            secret_generator = name: _value: {
+            secret_generator = name: value: {
              name = "wifi.${name}";
              value = {
                prompts.network-name.type = "line";
@@ -88,7 +80,7 @@ in
                wifi.mode = "infrastructure";
                wifi.ssid = "$ssid_${name}";
                wifi-security.psk = "$pw_${name}";
-                wifi-security.key-mgmt = networkCfg.keyMgmt;
+                wifi-security.key-mgmt = "wpa-psk";
              }
            );

--- a/clanServices/wifi/flake-module.nix
+++ b/clanServices/wifi/flake-module.nix
@@ -1,8 +1,12 @@
 {
+  self,
+  lib,
  ...
 }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix {
+    inherit (self) packages;
+  };
 in
 {
  clan.modules.wifi = module;
--- a/clanServices/wireguard/flake-module.nix
+++ b/clanServices/wireguard/flake-module.nix
@@ -1,6 +1,6 @@
-{ ... }:
+{ lib, ... }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules.wireguard = module;
--- a/clanServices/yggdrasil/README.md
+++ b/clanServices/yggdrasil/README.md
@@ -1,33 +0,0 @@
-This module sets up [yggdrasil](https://yggdrasil-network.github.io/) across
-your clan. 
-
-Yggdrasil is designed to be a future-proof and decentralised alternative to
-the structured routing protocols commonly used today on the internet. Inside
-your clan, it will allow you to reach all of your machines.
-
-## Example Usage
-
-While you can specify statically configured peers for each host, yggdrasil does
-auto-discovery of local peers.
-
-```nix
-inventory = {
-
-  machines = {
-    peer1 = { };
-    peer2 = { };
-  };
-
-  instances = {
-    yggdrasil = {
-
-      # Deploy on all machines
-      roles.default.tags.all = { };
-
-      # Or individual hosts
-      roles.default.machines.peer1 = { };
-      roles.default.machines.peer2 = { };
-    };
-  };
-};
-```
--- a/clanServices/yggdrasil/default.nix
+++ b/clanServices/yggdrasil/default.nix
@@ -1,125 +0,0 @@
-{ ... }:
-{
-  _class = "clan.service";
-  manifest.name = "clan-core/yggdrasil";
-  manifest.description = "Yggdrasil encrypted IPv6 routing overlay network";
-
-  roles.default = {
-    interface =
-      { lib, ... }:
-      {
-        options.extraMulticastInterfaces = lib.mkOption {
-          type = lib.types.listOf lib.types.attrs;
-          default = [ ];
-          description = ''
-            Additional interfaces to use for Multicast. See
-            https://yggdrasil-network.github.io/configurationref.html#multicastinterfaces
-            for reference.
-          '';
-          example = [
-            {
-              Regex = "(wg).*";
-              Beacon = true;
-              Listen = true;
-              Port = 5400;
-              Priority = 1020;
-            }
-          ];
-        };
-
-        options.peers = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-          description = ''
-            Static peers to configure for this host.
-            If not set, local peers will be auto-discovered
-          '';
-          example = [
-            "tcp://192.168.1.1:6443"
-            "quic://192.168.1.1:6443"
-            "tls://192.168.1.1:6443"
-            "ws://192.168.1.1:6443"
-          ];
-        };
-      };
-    perInstance =
-      { settings, ... }:
-      {
-        nixosModule =
-          {
-            config,
-            pkgs,
-            ...
-          }:
-          {
-
-            clan.core.vars.generators.yggdrasil = {
-
-              files.privateKey = { };
-              files.publicKey.secret = false;
-              files.address.secret = false;
-
-              runtimeInputs = with pkgs; [
-                yggdrasil
-                jq
-                openssl
-              ];
-
-              script = ''
-                # Generate private key
-                openssl genpkey -algorithm Ed25519 -out $out/privateKey
-
-                # Generate corresponding public key
-                openssl pkey -in $out/privateKey -pubout -out $out/publicKey
-
-                # Derive IPv6 address from key
-                echo "{\"PrivateKeyPath\": \"$out/privateKey\"}" | yggdrasil -useconf -address | tr -d '\n' > $out/address
-              '';
-            };
-
-            systemd.services.yggdrasil.serviceConfig.BindReadOnlyPaths = [
-              "%d/key:/key"
-            ];
-
-            systemd.services.yggdrasil.serviceConfig.LoadCredential =
-              "key:${config.clan.core.vars.generators.yggdrasil.files.privateKey.path}";
-
-            services.yggdrasil = {
-              enable = true;
-              openMulticastPort = true;
-              # We don't need this option, because we persist our keys with
-              # vars by ourselfs. This option creates an unnessesary additional
-              # systemd service to save/load the keys and should be removed
-              # from the NixOS module entirely, as it can be replaced by the
-              # (at the time of writing undocumented) PrivateKeyPath= setting.
-              # See https://github.com/NixOS/nixpkgs/pull/440910#issuecomment-3301835895 for details.
-              persistentKeys = false;
-              settings = {
-                PrivateKeyPath = "/key";
-                IfName = "ygg";
-                Peers = settings.peers;
-                MulticastInterfaces = [
-                  # Ethernet is preferred over WIFI
-                  {
-                    Regex = "(eth|en).*";
-                    Beacon = true;
-                    Listen = true;
-                    Port = 5400;
-                    Priority = 1024;
-                  }
-                  {
-                    Regex = "(wl).*";
-                    Beacon = true;
-                    Listen = true;
-                    Port = 5400;
-                    Priority = 1025;
-                  }
-                ]
-                ++ settings.extraMulticastInterfaces;
-              };
-            };
-            networking.firewall.allowedTCPPorts = [ 5400 ];
-          };
-      };
-  };
-}
--- a/clanServices/yggdrasil/flake-module.nix
+++ b/clanServices/yggdrasil/flake-module.nix
@@ -1,24 +0,0 @@
-{
-  self,
-  lib,
-  ...
-}:
-let
-  module = lib.modules.importApply ./default.nix {
-    inherit (self) packages;
-  };
-in
-{
-  clan.modules = {
-    yggdrasil = module;
-  };
-  perSystem =
-    { ... }:
-    {
-      clan.nixosTests.yggdrasil = {
-        imports = [ ./tests/vm/default.nix ];
-
-        clan.modules.yggdrasil = module;
-      };
-    };
-}
--- a/clanServices/yggdrasil/tests/vm/default.nix
+++ b/clanServices/yggdrasil/tests/vm/default.nix
@@ -1,67 +0,0 @@
-{
-  name = "yggdrasil";
-
-  clan = {
-    test.useContainers = false;
-    directory = ./.;
-    inventory = {
-
-      machines.peer1 = { };
-      machines.peer2 = { };
-
-      instances."yggdrasil" = {
-        module.name = "yggdrasil";
-        module.input = "self";
-
-        # Assign the roles to the two machines
-        roles.default.machines.peer1 = { };
-        roles.default.machines.peer2 = { };
-      };
-    };
-  };
-
-  testScript = ''
-    start_all()
-
-    # Wait for both machines to be ready
-    peer1.wait_for_unit("multi-user.target")
-    peer2.wait_for_unit("multi-user.target")
-
-    # Check that yggdrasil service is running on both machines
-    peer1.wait_for_unit("yggdrasil")
-    peer2.wait_for_unit("yggdrasil")
-    peer1.succeed("systemctl is-active yggdrasil")
-    peer2.succeed("systemctl is-active yggdrasil")
-
-    # Check that both machines have yggdrasil network interfaces
-    peer1.wait_until_succeeds("ip link show | grep -E 'ygg'", 30)
-    peer2.wait_until_succeeds("ip link show | grep -E 'ygg'", 30)
-
-    # Get yggdrasil IPv6 addresses from both machines
-    peer1_ygg_ip = peer1.succeed("yggdrasilctl -json getself | jq -r '.address'").strip()
-    peer2_ygg_ip = peer2.succeed("yggdrasilctl -json getself | jq -r '.address'").strip()
-
-    # Compare runtime addresses with saved addresses from vars
-    expected_peer1_ip = "${builtins.readFile ./vars/per-machine/peer1/yggdrasil/address/value}"
-    expected_peer2_ip = "${builtins.readFile ./vars/per-machine/peer2/yggdrasil/address/value}"
-
-    print(f"peer1 yggdrasil IP: {peer1_ygg_ip}")
-    print(f"peer2 yggdrasil IP: {peer2_ygg_ip}")
-    print(f"peer1 expected IP: {expected_peer1_ip}")
-    print(f"peer2 expected IP: {expected_peer2_ip}")
-
-    # Verify that runtime addresses match expected addresses
-    assert peer1_ygg_ip == expected_peer1_ip, f"peer1 runtime IP {peer1_ygg_ip} != expected IP {expected_peer1_ip}"
-    assert peer2_ygg_ip == expected_peer2_ip, f"peer2 runtime IP {peer2_ygg_ip} != expected IP {expected_peer2_ip}"
-
-    # Wait a bit for the yggdrasil network to establish connectivity
-    import time
-    time.sleep(10)
-
-    # Test connectivity: peer1 should be able to ping peer2 via yggdrasil
-    peer1.succeed(f"ping -6 -c 3 {peer2_ygg_ip}")
-
-    # Test connectivity: peer2 should be able to ping peer1 via yggdrasil
-    peer2.succeed(f"ping -6 -c 3 {peer1_ygg_ip}")
-  '';
-}
--- a/clanServices/yggdrasil/tests/vm/sops/machines/peer1/key.json
+++ b/clanServices/yggdrasil/tests/vm/sops/machines/peer1/key.json
@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age1p8trv2dmpanl3gnzj294c4t5uysu7d6rfjncp5lmn6redyda8fns6p7kca",
-    "type": "age"
-  }
-]
--- a/clanServices/yggdrasil/tests/vm/sops/machines/peer2/key.json
+++ b/clanServices/yggdrasil/tests/vm/sops/machines/peer2/key.json
@@ -1,6 +0,0 @@
-[
-  {
-    "publickey": "age107mprppm3r9u7f26e6t5mhtdny0h5ugfmfjy8kac2tw9nrh9a3ksex0xca",
-    "type": "age"
-  }
-]
--- a/clanServices/yggdrasil/tests/vm/sops/secrets/peer1-age.key/secret
+++ b/clanServices/yggdrasil/tests/vm/sops/secrets/peer1-age.key/secret
@@ -1,15 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:jDEog7FFXl28Le3rh5VTiY0DFmLhIy2ZccFjuYWx+OQrKNEqTLI1fzaeMWIcgu6ln6wfGUk640d3IhmrF45MVZiJGkpkOU8UFx0=,iv:4oGaoxhFQwr9OQfdLL7y1N/gJo/uGkTPG/xicVprIAQ=,tag:Smu0/P2bQB66w+0J2Bjlxw==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpQ2hib2Mrb0plWUVwNWU5\nWmpxNlduaUVJckhuQlhQbUJpanloWGFLelJ3CjJJMlBGbGRTWEhGUHh2VVkzUzNa\nL3FGVkF3R3JJT051UTg4UlkwOHRNanMKLS0tIDVWcHU4NmFMUWp3STFTYmg5YmNp\nVzd1Uzg2Wkp5QnJ3V1Qyb2lwSXdBRDgK/V5lgw2TePhUC9ngW53ZapIMkcwPvJus\ns0jUYkStHXjsvEiN7BG8cG7/vRbLD8CnKXnmieM20mT6o7GHGfhHMg==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-17T07:12:51Z",
-		"mac": "ENC[AES256_GCM,data:gy/1NFmpFz/tdhgU/Vr+xg46DUjy9ZbrAtCBnIxclwZLJ/fneBpblv8TFgdysY4Ay6jp1S/TOc8eyr+KLHMqcBlje09wd1ac/Y3ee6GccXitB+/c5ayuXX/ShVCdicsr/9COw7vfndAQPU8XIz6tdy0dbL7jgVTyViZW/P5CXEU=,iv:BQ/INwTTCshl5BVnJbVzHW8rwafERS6bKh2JAJsMv9s=,tag:QhsbjeEBivbl8fQLHjiKtQ==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/clanServices/yggdrasil/tests/vm/sops/secrets/peer1-age.key/users/admin
+++ b/clanServices/yggdrasil/tests/vm/sops/secrets/peer1-age.key/users/admin
@@ -1 +0,0 @@
-../../../users/admin
--- a/clanServices/yggdrasil/tests/vm/sops/secrets/peer2-age.key/secret
+++ b/clanServices/yggdrasil/tests/vm/sops/secrets/peer2-age.key/secret
@@ -1,15 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:1rVgSwg2qPHuXUOQCgOunaNYiBbsh99dZ2y0BV4TxzACwdb3lb6/XnLeDenLELOpKruZQoNJax/NziRr+VHzmh/TlQhNgTkS71A=,iv:Wi5/cFOETb1rhAYeyzkpppzSSm+S+8cCQYc7zkp74FY=,tag:JQHFZJwYMQH4jUqSw6Ld8Q==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGV3ZLZmNrejlvTFF6NDZW\nYmljS0VXQUtCR3IzMG9tMksvSllVVkIxVTEwCi9Fd1dBbmFlYmF2cE1raVJoS3RR\nWmxQY3RwanRZUE5aN1Q2SzhJOFU1elEKLS0tIG9RMElDMEo3TFJjU0RvU3FMQk12\nT1pNc1VjeUliejk3YmJ6d29zUU15aDQKuZ62Q/ywLrpyu1jB34OCPKQEDd150qH6\nHzyw+MasUlzKNs0ZrALwfhnCKiNb/Pq0Lu660Dx5/sFxI/TAqC7NGg==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-17T07:13:24Z",
-		"mac": "ENC[AES256_GCM,data:N7mmiEZxinOgWdd7QcZBAumnWaApjlQVww4EzAQ1/JH5i8r8CIfPh/7lGMQntlJj5ob+UgrS96nl6XKdvs3Bt7z34zPq7KV3c0mSmclEctRfcZiG4F+rZ0QIMIRJjq7xJL/M9WupSn8Lgms7qHJMdJyHdDkw47bmXz3MIw9c9zo=,iv:ZYPoo5jTIGnZ1HcAWlr26gloVhSjfhwbO/xH5YCbgF0=,tag:UKMVMGEfqyfo04cIkuKD0A==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/clanServices/yggdrasil/tests/vm/sops/secrets/peer2-age.key/users/admin
+++ b/clanServices/yggdrasil/tests/vm/sops/secrets/peer2-age.key/users/admin
@@ -1 +0,0 @@
-../../../users/admin
--- a/clanServices/yggdrasil/tests/vm/sops/users/admin/key.json
+++ b/clanServices/yggdrasil/tests/vm/sops/users/admin/key.json
@@ -1,4 +0,0 @@
-{
-  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-  "type": "age"
-}
--- a/clanServices/yggdrasil/tests/vm/vars/per-machine/peer1/state-version/version/value
+++ b/clanServices/yggdrasil/tests/vm/vars/per-machine/peer1/state-version/version/value
@@ -1 +0,0 @@
-25.11
--- a/clanServices/yggdrasil/tests/vm/vars/per-machine/peer1/yggdrasil/address/value
+++ b/clanServices/yggdrasil/tests/vm/vars/per-machine/peer1/yggdrasil/address/value
@@ -1 +0,0 @@
-200:fa3b:ad0e:6821:9a51:3ad5:62a4:9ab1
--- a/clanServices/yggdrasil/tests/vm/vars/per-machine/peer1/yggdrasil/privateKey/machines/peer1
+++ b/clanServices/yggdrasil/tests/vm/vars/per-machine/peer1/yggdrasil/privateKey/machines/peer1
@@ -1 +0,0 @@
-../../../../../../sops/machines/peer1
--- a/clanServices/yggdrasil/tests/vm/vars/per-machine/peer1/yggdrasil/privateKey/secret
+++ b/clanServices/yggdrasil/tests/vm/vars/per-machine/peer1/yggdrasil/privateKey/secret
@@ -1,19 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:oLWxmCqCLyKCdN90eScYC4eMsY5mcpXexk03P+KfQX9hCUg7iOSv+BTujvAFuJA0z2Pgg7B/L0noYSImE3208gDC2exdZme+szpNwxD6oh1bBx5XuYGc/TDzEl7IdPrf1piuqCkWgD6wNb9aFVA9NB/CrNaszY8=,iv:pU8OGFwtqkxy0+iyhWaOnWdSVvaxYBUgnQwv89CTfKc=,tag:V/GVEvjEpeaf3Tl3XCVL7w==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1p8trv2dmpanl3gnzj294c4t5uysu7d6rfjncp5lmn6redyda8fns6p7kca",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBidXZxMVg2bkFCekFza3FV\naGVJTjRSSnQrVkgyTVU4Vk9YZFR2Nk1Xcnl3ClNTZnJsR2xZc3hGRFA0NGp2L2Uy\nU2w0N1ZON0xQRXRKL0NId1J3dWNSeXcKLS0tIFlKNk5walJrM2FGM0ozYTBUNVN1\nNHd0N3g2VWFjTUZtbHExdmsvSjJQUGMKDHgRMyTf4CuoIRdsfl6TmPLgcjxHdR4N\nzNmnSmT6QXJr4gBQ7e/3zpMdq4sKzyAOjJPkQra8nJ/KvhpFwXkdtg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1L3hBYnNTdEhTK1M0TEUx\nM1BFb3IwWDZPc2tkN0JUNXRPWkhEWHpXaFFNCkFlZ3Ixb1hhVWMvUmpKdCtjbW5h\nTVpLSkdxUXI4SVE3MW5LZkFVSmM3dDgKLS0tICtKWGYzbFQ1VGQydktHSDVadVQy\nM3JTSGc0NWVHWGl4akV2VUNNVjVvT00KKmbkGJ2KclTBb7NI0MamWZnlWMaXscws\nYO261RHc/j4s3KdbWATklh2KTicKpgta0mh294Y+hKYLGgBpnXjtOw==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-17T07:12:51Z",
-		"mac": "ENC[AES256_GCM,data:YG4k+PvsF0NVfjqKY/MBhCOwn9Kcn5orq8aD41X3NEPBT+wU5RlN0XqXhH2nkZ52ZHdCN84Ulbd4guwBcJcUtGvxqOpfE4SJ9RFE+SjYw+2+S9wlArQx5R5Zd+Sr+Rgtaip3moENbxETxHZazbEK3u5o0aXKrZvoXH2xgPRYUOg=,iv:lDnNELLpqykrsmoORMW7p6gF43C2QvPwf0PZep2pEo8=,tag:CZNOBx3Aeoq5WeDbANqFVw==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/clanServices/yggdrasil/tests/vm/vars/per-machine/peer1/yggdrasil/privateKey/users/admin
+++ b/clanServices/yggdrasil/tests/vm/vars/per-machine/peer1/yggdrasil/privateKey/users/admin
@@ -1 +0,0 @@
-../../../../../../sops/users/admin
--- a/clanServices/yggdrasil/tests/vm/vars/per-machine/peer1/yggdrasil/publicKey/value
+++ b/clanServices/yggdrasil/tests/vm/vars/per-machine/peer1/yggdrasil/publicKey/value
@@ -1,3 +0,0 @@
-----BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEAguIpeMvvMtdilU6tsqdBClci2YUgBKEUPQ5ID55zOVY=
-----END PUBLIC KEY-----
--- a/clanServices/yggdrasil/tests/vm/vars/per-machine/peer2/state-version/version/value
+++ b/clanServices/yggdrasil/tests/vm/vars/per-machine/peer2/state-version/version/value
@@ -1 +0,0 @@
-25.11
--- a/clanServices/yggdrasil/tests/vm/vars/per-machine/peer2/yggdrasil/address/value
+++ b/clanServices/yggdrasil/tests/vm/vars/per-machine/peer2/yggdrasil/address/value
@@ -1 +0,0 @@
-200:3975:b69f:fd15:f39a:bf24:f644:432b
--- a/clanServices/yggdrasil/tests/vm/vars/per-machine/peer2/yggdrasil/privateKey/machines/peer2
+++ b/clanServices/yggdrasil/tests/vm/vars/per-machine/peer2/yggdrasil/privateKey/machines/peer2
@@ -1 +0,0 @@
-../../../../../../sops/machines/peer2
--- a/clanServices/yggdrasil/tests/vm/vars/per-machine/peer2/yggdrasil/privateKey/secret
+++ b/clanServices/yggdrasil/tests/vm/vars/per-machine/peer2/yggdrasil/privateKey/secret
@@ -1,19 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:Ik+mzD41SwfGZrqGi5oy0u8ZS8qCKgV34aohIt7J/11S3ayhKKN8451cYPltGg+2i/+2DWRSkqYZsctgIahvthnvb30r91XHRUCtE3oT8iPOKwEuW2xnZBL2dK0qHrKFGn8B/o3Bl/+4cWuR5Jt9QHlN4oF3o50=,iv:a9mSIr7TT9im19P5XKiDGL71hMLfQE8IB6NV8WABZ+s=,tag:dVQ0HZdpbkcmFA37Il+VIw==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age107mprppm3r9u7f26e6t5mhtdny0h5ugfmfjy8kac2tw9nrh9a3ksex0xca",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3WEtncHIrd2YrbHduUm4y\nYkh1U0NERDR0MzRNQXZ0elNMZzl0ZmJPMlVVCnJ1UC9uNnk0dC9JVzdReUxLZmdR\nMGIwSjBKUW8yQmQ1R3dqU29ZM2czMEUKLS0tIFpMM3l6YnVFRUtLOFRvSTBXRXU0\nQUJWNk5obzBINS90dWwybXlXdEZFZjgKrZtViJwgPpKT+Bhx6ymEhf6QmnMmZ6Jf\n3kIxzDWxGbxrDTrrdXm33gYs9bRvtXsTACRT3TRAKIwSjIV/ycCUBA==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArY1A4blFZNjdTU3lGUFA3\nb1hscVhLVmtuQnJMS3VHZVVEOXBDRktXNVhjCkdLZEFFZXhubFJrZTU3RjRDN1lh\nVzgyd3E3a0NGTGh1N2lPQWZBVG9BaW8KLS0tIFN1eEhpMk5mUkNaL29MS2NlWDdP\nVXFtb3c0Y25MT3NLK0N2RStkY1R0MGsKLv8yOSl2iQx39JRJA/e0dOtIz7ZND0+o\nzmqxapD6pxbj8RGswj0szLrxaveWT6Vkmmy/a4fz35uw3xuF7uiJJA==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-17T07:13:24Z",
-		"mac": "ENC[AES256_GCM,data:KCBHfavyg1U/Z1e3rr0jdHivUa5/rl42N/K6c0BR47srdYqcpAS+SWW6tH7kPI3EO+P7TgXVoGlmcXaKgrlRpe37eNzdAT6PJYm7rhe6rm2UgZ1yw/NFqA11p/i3dDbTzYHaHMNGGGg9t/BdT1tD0zCICfptGQnSSBx/BEmT3ak=,iv:GOk8/z1mLIVKxFX4ayt9HvA90gv0Af1KqcDbdJRUYu4=,tag:hJpOBFRESQXmE7iMqDqO6g==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}
--- a/clanServices/yggdrasil/tests/vm/vars/per-machine/peer2/yggdrasil/privateKey/users/admin
+++ b/clanServices/yggdrasil/tests/vm/vars/per-machine/peer2/yggdrasil/privateKey/users/admin
@@ -1 +0,0 @@
-../../../../../../sops/users/admin
--- a/clanServices/yggdrasil/tests/vm/vars/per-machine/peer2/yggdrasil/publicKey/value
+++ b/clanServices/yggdrasil/tests/vm/vars/per-machine/peer2/yggdrasil/publicKey/value
@@ -1,3 +0,0 @@
-----BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEA40UksAF1BjKgbYTd3motmeXa/belhNOoRfaaPQTXy8E=
-----END PUBLIC KEY-----
--- a/clanServices/zerotier/README.md
+++ b/clanServices/zerotier/README.md
@@ -5,7 +5,7 @@ inventory.instances = {
  zerotier = {
    module = {
      name = "zerotier";
-      input = "clan-core";
+      input = "clan";
    };
    roles.peer.tags.all = { };
    roles.controller.machines.jon = { };
@@ -18,6 +18,7 @@ All machines will be peers and connected to the zerotier network.
 Jon is the controller machine, which will will accept other machines into the network.
 Sara is a moon and sets the `stableEndpoint` setting with a publicly reachable IP, the moon is optional.

+
 ## Overview

 This guide explains how to set up and manage a [ZeroTier VPN](https://zerotier.com) for a clan network. Each VPN requires a single controller and can support multiple peers and optional moons for better connectivity.
--- a/clanServices/zerotier/default.nix
+++ b/clanServices/zerotier/default.nix
@@ -8,25 +8,8 @@

  roles.peer = {
    perInstance =
+      { instanceName, roles, ... }:
      {
-        instanceName,
-        roles,
-        lib,
-        ...
-      }:
-      {
-        exports.networking = {
-          priority = lib.mkDefault 900;
-          # TODO add user space network support to clan-cli
-          module = "clan_lib.network.zerotier";
-          peers = lib.mapAttrs (name: _machine: {
-            host.var = {
-              machine = name;
-              generator = "zerotier";
-              file = "zerotier-ip";
-            };
-          }) roles.peer.machines;
-        };
        nixosModule =
          {
            config,
@@ -62,7 +45,7 @@
            It will be reachable under the given stable endpoints.
          '';
          example = ''
-            [ "1.2.3.4" "10.0.0.3/9993" "2001:abcd:abcd::3/9993" ]
+            [ 1.2.3.4" "10.0.0.3/9993" "2001:abcd:abcd::3/9993" ]
          '';
        };

--- a/clanServices/zerotier/flake-module.nix
+++ b/clanServices/zerotier/flake-module.nix
@@ -5,7 +5,7 @@
  ...
 }:
 let
-  module = ./default.nix;
+  module = lib.modules.importApply ./default.nix { };
 in
 {
  clan.modules.zerotier = module;
--- a/devFlake/flake.lock
+++ b/devFlake/flake.lock
@@ -84,11 +84,11 @@
    },
    "nixpkgs-dev": {
      "locked": {
-        "lastModified": 1758573205,
-        "narHash": "sha256-0ybDco+HjG5h46wx7ww4JIyg3y/mBDgkMCVX/Ua0e/Q=",
+        "lastModified": 1757007868,
+        "narHash": "sha256-zekS8JUSNEiphLnjWJBFoaX4Kb8GxiiD6FvoKZI+8b0=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "803b1683f562edc00665874bf98c1aad0b111482",
+        "rev": "36420cc41abb467f89082432cfe139f5fdbdcea3",
        "type": "github"
      },
      "original": {
@@ -107,11 +107,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1758272005,
-        "narHash": "sha256-1u3xTH+3kaHhztPmWtLAD8LF5pTYLR2CpsPFWTFnVtQ=",
+        "lastModified": 1756738487,
+        "narHash": "sha256-8QX7Ab5CcICp7zktL47VQVS+QeaU4YDNAjzty7l7TQE=",
        "owner": "NuschtOS",
        "repo": "search",
-        "rev": "aa975a3757f28ce862812466c5848787b868e116",
+        "rev": "5feeaeefb571e6ca2700888b944f436f7c05149b",
        "type": "github"
      },
      "original": {
@@ -165,11 +165,11 @@
        "nixpkgs": []
      },
      "locked": {
-        "lastModified": 1758206697,
-        "narHash": "sha256-/DbPkh6PZOgfueCbs3uzlk4ASU2nPPsiVWhpMCNkAd0=",
+        "lastModified": 1756662192,
+        "narHash": "sha256-F1oFfV51AE259I85av+MAia221XwMHCOtZCMcZLK2Jk=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "128222dc911b8e2e18939537bed1762b7f3a04aa",
+        "rev": "1aabc6c05ccbcbf4a635fb7a90400e44282f61c4",
        "type": "github"
      },
      "original": {
--- a/docs/mkdocs.yml
+++ b/docs/mkdocs.yml
@@ -1,4 +1,4 @@
-site_name: Documentation
+site_name: Clan Documentation
 site_url: https://docs.clan.lol
 repo_url: https://git.clan.lol/clan/clan-core/
 repo_name: "_>"
@@ -45,80 +45,76 @@ exclude_docs: |
  /drafts/

 nav:
-  - Getting Started:
-      - Overview: index.md
-      - Creating Your First Clan: guides/getting-started/index.md
-      - Add Machines: guides/getting-started/add-machines.md
-      - Add User: guides/getting-started/add-user.md
-      - Add Services: guides/getting-started/add-services.md
-      - Deploy to Physical Machine:
-          - Create USB Installer: guides/getting-started/create-installer.md
-          - Deploy Physical Machine: guides/getting-started/hardware-report-physical.md
-      - Deploy to Virtual Machine: guides/getting-started/hardware-report-virtual.md
-      - Configure Disk Config: guides/getting-started/choose-disk.md
-      - Update Machine: guides/getting-started/update.md
-      - Continuous Integration: guides/getting-started/flake-check.md
-      - Convert Existing NixOS Config: guides/getting-started/convert-flake.md
+  - Home: index.md
  - Guides:
-      - Inventory:
-          - Introduction to Inventory: guides/inventory/inventory.md
-          - File Autoincludes: guides/inventory/autoincludes.md
-
-      - Clan Services:
-          - Inventory Guide: guides/inventory/clanServices.md
-          - Author Your Own Service: guides/services/community.md
-      - Vars:
-          - Introduction to Vars: guides/vars/vars-overview.md
-          - Minimal Example: guides/vars/vars-backend.md
-          - Diving deeper: guides/vars/vars-concepts.md
-          - Advanced Examples: guides/vars/vars-advanced-examples.md
-          - Troubleshooting: guides/vars/vars-troubleshooting.md
-          - Sops Backend:
-              - Yubikeys & Age Plugins: guides/vars/sops/age-plugins.md
-          - Managing Users (OLD): guides/secrets.md
-      - Networking:
-          - Introduction to Networking: guides/networking/networking.md
-          - Zerotier VPN: guides/networking/mesh-vpn.md
-      - Disko Templates:
-          - Community Disko Templates: guides/disko-templates/community.md
-      - Backups:
-          - Introduction to Backups: guides/backups.md
-      - Flake-parts: guides/flake-parts.md
-      - NixOS Rebuild: guides/nixos-rebuild.md
-      - macOS:
-          - Managing macOS Machines: guides/macos.md
-      # Should be part of the respective sections above
-      # machines, disko, clan
-      - Templates: concepts/templates.md
-      - Migrations:
-          - clan modules --> clan services: guides/migrations/migrate-inventory-services.md
-          - Facts --> Vars: guides/migrations/migration-facts-vars.md
-          - Disk id: guides/migrations/disk-id.md
+      - Getting Started:
+          - Creating Your First Clan: guides/getting-started/index.md
+          - Add Machines: guides/getting-started/add-machines.md
+          - Add User: guides/getting-started/add-user.md
+          - Add Services: guides/getting-started/add-services.md
+          - Deploy to Physical Machine:
+              - Create USB Installer: guides/getting-started/create-installer.md
+              - Deploy Physical Machine: guides/getting-started/hardware-report-physical.md
+          - Deploy to Virtual Machine: guides/getting-started/hardware-report-virtual.md
+          - Configure Disk Config: guides/getting-started/choose-disk.md
+          - Update Machine: guides/getting-started/update.md
+          - Continuous Integration: guides/getting-started/flake-check.md
+          - Convert Existing NixOS Config: guides/getting-started/convert-flake.md
+      - ClanServices: guides/clanServices.md
+      - Backup & Restore: guides/backups.md
      - Disk Encryption: guides/disk-encryption.md
-      - Disable Secure Boot: guides/secure-boot.md
+      - Age Plugins: guides/age-plugins.md
+      - Secrets management: guides/secrets.md
+      - Networking: guides/networking.md
+      - Zerotier VPN: guides/mesh-vpn.md
+      - How to disable Secure Boot: guides/secure-boot.md
+      - Flake-parts: guides/flake-parts.md
+      - macOS: guides/macos.md
      - Contributing:
-          - Hacking: guides/contributing/CONTRIBUTING.md
-          - Advanced Debugging: guides/contributing/debugging.md
+          - Contributing: guides/contributing/CONTRIBUTING.md
+          - Debugging: guides/contributing/debugging.md
          - Testing: guides/contributing/testing.md

+      - Writing a Service Module: guides/services/community.md
+      - Writing a Disko Template: guides/disko-templates/community.md
+      - Migrations:
+          - Migrate from clan modules to services: guides/migrations/migrate-inventory-services.md
+          - Facts Vars Migration: guides/migrations/migration-facts-vars.md
+          - Disk id: guides/migrations/disk-id.md
+  - Concepts:
+      - Inventory: concepts/inventory.md
+      - Generators: concepts/generators.md
+      - Autoincludes: concepts/autoincludes.md
+      - Templates: concepts/templates.md
  - Reference:
      - Overview: reference/index.md
-      - Clan Options: reference/options/clan.md
-      - Clan Inventory Options: reference/options/clan_inventory.md
-
-      - Clan Service API: reference/clanServices/clan-service-author-interface.md
-
-      - clan.core (Machine Options):
-          - Overview: reference/clan.core/index.md
-          - reference/clan.core/backups.md
-          - reference/clan.core/deployment.md
-          - reference/clan.core/facts.md
-          - reference/clan.core/networking.md
-          - reference/clan.core/postgresql.md
-          - reference/clan.core/settings.md
-          - reference/clan.core/sops.md
-          - reference/clan.core/state.md
-          - reference/clan.core/vars.md
+      - Browse Options: "/options"
+      - Services:
+          - Overview:
+              - reference/clanServices/index.md
+              - reference/clanServices/admin.md
+              - reference/clanServices/borgbackup.md
+              - reference/clanServices/certificates.md
+              - reference/clanServices/coredns.md
+              - reference/clanServices/data-mesher.md
+              - reference/clanServices/dyndns.md
+              - reference/clanServices/emergency-access.md
+              - reference/clanServices/garage.md
+              - reference/clanServices/hello-world.md
+              - reference/clanServices/importer.md
+              - reference/clanServices/localbackup.md
+              - reference/clanServices/matrix-synapse.md
+              - reference/clanServices/mycelium.md
+              - reference/clanServices/monitoring.md
+              - reference/clanServices/packages.md
+              - reference/clanServices/sshd.md
+              - reference/clanServices/syncthing.md
+              - reference/clanServices/trusted-nix-caches.md
+              - reference/clanServices/users.md
+              - reference/clanServices/wifi.md
+              - reference/clanServices/wireguard.md
+              - reference/clanServices/zerotier.md
+          - API: reference/clanServices/clan-service-author-interface.md

      - CLI:
          - Overview: reference/cli/index.md
@@ -137,7 +133,19 @@ nav:
          - reference/cli/vars.md
          - reference/cli/vms.md

-      - HTTP API: api.md
+      - clan.core (NixOS Options):
+          - Overview: reference/clan.core/index.md
+          - reference/clan.core/backups.md
+          - reference/clan.core/deployment.md
+          - reference/clan.core/facts.md
+          - reference/clan.core/networking.md
+          - reference/clan.core/postgresql.md
+          - reference/clan.core/settings.md
+          - reference/clan.core/sops.md
+          - reference/clan.core/state.md
+          - reference/clan.core/vars.md
+
+      - Developer-api: api.md

      - Decisions:
          - Architecture Decisions: decisions/README.md
@@ -148,35 +156,7 @@ nav:
          - 05-deployment-parameters: decisions/05-deployment-parameters.md
          - Template: decisions/_template.md
      - Glossary: reference/glossary.md
-  - Services:
-      - Introduction to ClanServices: reference/clanServices/index.md
-      - Official:
-          - reference/clanServices/admin.md
-          - reference/clanServices/borgbackup.md
-          - reference/clanServices/certificates.md
-          - reference/clanServices/coredns.md
-          - reference/clanServices/data-mesher.md
-          - reference/clanServices/dyndns.md
-          - reference/clanServices/emergency-access.md
-          - reference/clanServices/garage.md
-          - reference/clanServices/hello-world.md
-          - reference/clanServices/importer.md
-          - reference/clanServices/localbackup.md
-          - reference/clanServices/matrix-synapse.md
-          - reference/clanServices/mycelium.md
-          - reference/clanServices/monitoring.md
-          - reference/clanServices/packages.md
-          - reference/clanServices/sshd.md
-          - reference/clanServices/syncthing.md
-          - reference/clanServices/trusted-nix-caches.md
-          - reference/clanServices/users.md
-          - reference/clanServices/wifi.md
-          - reference/clanServices/wireguard.md
-          - reference/clanServices/yggdrasil.md
-          - reference/clanServices/zerotier.md
-      - Community: community/services/index.md
-
-  - Search Clan Options: "/options"
+  - Browse Options: "/options"

 docs_dir: site
 site_dir: out
@@ -234,7 +214,8 @@ extra:

 plugins:
  - search
+  - macros
  - redoc-tag
  - redirects:
      redirect_maps:
-        guides/getting-started/secrets.md: guides/vars/vars-overview.md
+        guides/getting-started/secrets.md: concepts/generators.md
--- a/docs/nix/default.nix
+++ b/docs/nix/default.nix
@@ -37,6 +37,7 @@ pkgs.stdenv.mkDerivation {
  ++ (with pkgs.python3Packages; [
    mkdocs
    mkdocs-material
+    mkdocs-macros
    mkdocs-redoc-tag
    mkdocs-redirects
  ]);
--- a/docs/nix/flake-module.nix
+++ b/docs/nix/flake-module.nix
@@ -11,6 +11,7 @@
      ...
    }:
    let
+      buildClanOptions = self'.legacyPackages.clan-internals-docs;
      # Simply evaluated options (JSON)
      # { clanCore = «derivation JSON»; clanModules = { ${name} = «derivation JSON» }; }
      jsonDocs = pkgs.callPackage ./get-module-docs.nix {
@@ -72,7 +73,8 @@
            # A file that contains the links to all clanModule docs
            export CLAN_MODULES_VIA_SERVICE=${clanModulesViaService}
            export CLAN_SERVICE_INTERFACE=${self'.legacyPackages.clan-service-module-interface}/share/doc/nixos/options.json
-            export CLAN_OPTIONS_PATH=${self'.legacyPackages.clan-options}/share/doc/nixos/options.json
+
+            export BUILD_CLAN_PATH=${buildClanOptions}/share/doc/nixos/options.json

            mkdir $out

--- a/docs/nix/options/flake-module.nix
+++ b/docs/nix/options/flake-module.nix
@@ -13,6 +13,7 @@
    let
      inherit (lib)
        mapAttrsToList
+        flip
        mapAttrs
        mkOption
        types
@@ -40,7 +41,10 @@
          prefix = [ ];
        }).config.manifest;

-      settingsModules = module: mapAttrs (_roleName: roleConfig: roleConfig.interface) (getRoles module);
+      loadFile = file: if builtins.pathExists file then builtins.readFile file else "";
+
+      settingsModules =
+        module: flip mapAttrs (getRoles module) (_roleName: roleConfig: roleConfig.interface);

      # Map each letter to its capitalized version
      capitalizeChar =
@@ -95,7 +99,7 @@

            **${manifest.description}**

-            ${lib.optionalString (manifest ? readme) manifest.readme}
+            ${loadFile (module._file + "/../README.md")}

            ${
              if manifest.categories != [ ] then
@@ -111,7 +115,7 @@
            instances.${name} = lib.mkOption {
              inherit description;
              type = types.submodule {
-                options.roles = mapAttrs (
+                options.roles = flip mapAttrs (settingsModules module) (
                  roleName: roleSettingsModule:
                  mkOption {
                    type = types.submodule {
@@ -134,7 +138,7 @@
                      ];
                    };
                  }
-                ) (settingsModules module);
+                );
              };
            };
          };
@@ -201,31 +205,25 @@
      # };

      packages = {
-        docs-options =
-          if privateInputs ? nuschtos then
-            privateInputs.nuschtos.packages.${pkgs.stdenv.hostPlatform.system}.mkMultiSearch {
+        docs-options = privateInputs.nuschtos.packages.${pkgs.stdenv.hostPlatform.system}.mkMultiSearch {
+          inherit baseHref;
+          title = "Clan Options";
+          # scopes = mapAttrsToList mkScope serviceModules;
+          scopes = [
+            {
              inherit baseHref;
-              title = "Clan Options";
-              # scopes = mapAttrsToList mkScope serviceModules;
-              scopes = [
-                {
-                  inherit baseHref;
-                  name = "Flake Options (clan.nix file)";
-                  modules = docModules;
-                  urlPrefix = "https://git.clan.lol/clan/clan-core/src/branch/main/";
-                }
-                {
-                  name = "Machine Options (clan.core NixOS options)";
-                  optionsJSON = "${coreOptions}/share/doc/nixos/options.json";
-                  urlPrefix = "https://git.clan.lol/clan/clan-core/src/branch/main/";
-                }
-              ];
+              name = "Flake Options (clan.nix file)";
+              modules = docModules;
+              urlPrefix = "https://git.clan.lol/clan/clan-core/src/branch/main/";
            }
-          else
-            pkgs.stdenv.mkDerivation {
-              name = "empty";
-              buildCommand = "echo 'This is an empty derivation' > $out";
-            };
+            {
+              name = "Machine Options (clan.core NixOS options)";
+              optionsJSON = "${coreOptions}/share/doc/nixos/options.json";
+              urlPrefix = "https://git.clan.lol/clan/clan-core/src/branch/main/";
+
+            }
+          ];
+        };
      };
    };
 }
--- a/docs/nix/render_options/init.py
+++ b/docs/nix/render_options/init.py
@@ -27,7 +27,6 @@

 import json
 import os
-import sys
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any
@@ -41,7 +40,7 @@ from clan_lib.services.modules import (
 # Get environment variables
 CLAN_CORE_PATH = Path(os.environ["CLAN_CORE_PATH"])
 CLAN_CORE_DOCS = Path(os.environ["CLAN_CORE_DOCS"])
-CLAN_OPTIONS_PATH = Path(os.environ["CLAN_OPTIONS_PATH"])
+BUILD_CLAN_PATH = os.environ.get("BUILD_CLAN_PATH")

 # Options how to author clan.modules
 # perInstance, perMachine, ...
@@ -327,7 +326,7 @@ Each `clanService`:

    See [Migration Guide](../../guides/migrations/migrate-inventory-services.md) for help on migrating.

-Learn how to use `clanServices` in practice in the [Using clanServices guide](../../guides/inventory/clanServices.md).
+Learn how to use `clanServices` in practice in the [Using clanServices guide](../../guides/clanServices.md).
 """

    with indexfile.open("w") as of:
@@ -443,84 +442,6 @@ Typically needed by module authors to define roles, behavior and metadata for di
        of.write(output)


-def produce_inventory_docs() -> None:
-    if not CLAN_OPTIONS_PATH:
-        msg = f"Environment variables are not set correctly: CLAN_OPTIONS_PATH={CLAN_OPTIONS_PATH}. Expected a path to the optionsJSON"
-        raise ClanError(msg)
-
-    if not OUT:
-        msg = f"Environment variables are not set correctly: $out={OUT}"
-        raise ClanError(msg)
-
-    output = """# Inventory
-This provides an overview of the available options of the `inventory` model.
-
-It can be set via the `inventory` attribute of the [`clan`](./clan.md#inventory) function, or via the [`clan.inventory`](./clan.md#inventory) attribute of flake-parts.
-
-"""
-    # Inventory options are already included under the clan attribute
-    # We just omitted them in the clan docs, because we want a separate output for the inventory model
-    with Path(CLAN_OPTIONS_PATH).open() as f:
-        options: dict[str, dict[str, Any]] = json.load(f)
-
-        clan_root_option = options_to_tree(options)
-        # Find the inventory options
-        inventory_opt: None | Option = None
-        for opt in clan_root_option.suboptions:
-            if opt.name == "inventory":
-                inventory_opt = opt
-                break
-
-        if not inventory_opt:
-            print("No inventory options found.")
-            sys.exit(1)
-        # Render the inventory options
-        # This for loop excludes the root node
-        for option in inventory_opt.suboptions:
-            output += options_docs_from_tree(option, init_level=2)
-
-    outfile = Path(OUT) / "options/clan_inventory.md"
-    outfile.parent.mkdir(parents=True, exist_ok=True)
-    with Path.open(outfile, "w") as of:
-        of.write(output)
-
-
-def produce_clan_options_docs() -> None:
-    if not CLAN_OPTIONS_PATH:
-        msg = f"Environment variables are not set correctly: CLAN_OPTIONS_PATH={CLAN_OPTIONS_PATH}. Expected a path to the optionsJSON"
-        raise ClanError(msg)
-
-    if not OUT:
-        msg = f"Environment variables are not set correctly: $out={OUT}"
-        raise ClanError(msg)
-
-    output = """# Clan Options
-This provides an overview of the available options
-
-Those can be set via [`clan-core.lib.clan`](./clan.md#inventory) function,
-or via the [`clan`](./clan.md) attribute of flake-parts.
-
-"""
-    # Inventory options are already included under the clan attribute
-    # We just omitted them in the clan docs, because we want a separate output for the inventory model
-    with Path(CLAN_OPTIONS_PATH).open() as f:
-        options: dict[str, dict[str, Any]] = json.load(f)
-
-        clan_root_option = options_to_tree(options)
-        # Render the inventory options
-        # This for loop excludes the root node
-        # Exclude inventory options
-        for option in clan_root_option.suboptions:
-            if "inventory" in option.name:
-                continue
-            output += options_docs_from_tree(option, init_level=2)
-
-    outfile = Path(OUT) / "options/clan.md"
-    outfile.parent.mkdir(parents=True, exist_ok=True)
-    with Path.open(outfile, "w") as of:
-        of.write(output)
-
-
@dataclass
 class Option:
    name: str
@@ -635,7 +556,6 @@ def options_docs_from_tree(

 if __name__ == "__main__":
    produce_clan_core_docs()
-    produce_inventory_docs()
-    produce_clan_options_docs()
+
    produce_clan_service_author_docs()
    produce_clan_service_docs()
--- a/docs/site/community/services/index.md
+++ b/docs/site/community/services/index.md
@@ -1,27 +0,0 @@
-Services provided by the community
-
-!!! tip "Add your own!"
-
-    Have you built a service or a tool for? Open a PR adding a link to this page!
-
-<div class="grid cards" markdown>
-
-  [Your Service Foo](https://example.com) :octicons-link-external-16:
-
-    ---
-
-    Does this and that
-
-  [Your Service Foo](https://example.com) :octicons-link-external-16:
-
-    ---
-
-    Does this and that
-
-  [Your Service Foo](https://example.com) :octicons-link-external-16:
-
-    ---
-
-    Does this and that
-
-</div>
--- a/docs/site/guides/inventory/autoincludes.md
+++ b/docs/site/guides/inventory/autoincludes.md
--- a/docs/site/guides/vars/vars-backend.md
+++ b/docs/site/guides/vars/vars-backend.md
@@ -1,21 +1,26 @@
-The `clan vars` subcommand is a powerful tool for managing machine-specific variables in a declarative and reproducible way. This guide will walk you through its usage, from setting up a generator to sharing and updating variables across machines.
+# Generators

-For a detailed API reference, see the [vars module documentation](../../reference/clan.core/vars.md).
+Defining a linux user's password via the nixos configuration previously required running `mkpasswd ...` and then copying the hash back into the nix configuration.

-In this guide, you will learn how to:
+In this example, we will guide you through automating that interaction using clan `vars`.

-1. Declare a `generator` in the machine's NixOS configuration.
-2. Inspect the status of variables using the Clan CLI.
-3. Generate variables interactively.
-4. Observe the changes made to your repository.
-5. Update the machine configuration.
-6. Share the root password between multiple machines.
-7. Change the root password when needed.
+For a more general explanation of what clan vars are and how it works, see the intro of the [Reference Documentation for vars](../reference/clan.core/vars.md)

-By the end of this guide, you will have a clear understanding of how to use `clan vars` to manage sensitive data, such as passwords, in a secure and efficient manner.
+This guide assumes
+- Clan is set up already (see [Getting Started](../guides/getting-started/index.md))
+- a machine has been added to the clan (see [Adding Machines](../guides/getting-started/add-machines.md))

+This section will walk you through the following steps:

-## Declare the generator
+1. declare a `generator` in the machine's nixos configuration
+2. inspect the status via the Clan CLI
+3. generate the vars
+4. observe the changes
+5. update the machine
+6. share the root password between machines
+7. change the password
+
+## Declare a generator

 In this example, a `vars` `generator` is used to:

@@ -109,7 +114,7 @@ If we just imported the `root-password.nix` from above into more machines, clan
 If the root password instead should only be entered once and shared across all machines, the generator defined above needs to be declared as `shared`, by adding `share = true` to it:
 ```nix
 {config, pkgs, ...}: {
-  clan.core.vars.generators.root-password = {
+  clan.vars.generators.root-password = {
    share = true;
    # ...
  }
@@ -136,3 +141,8 @@ Updated var root-password/password-hash
  new: $6$OyoQtDVzeemgh8EQ$zRK...
 ```

+
+## Further Reading
+
+- [Reference Documentation for `clan.core.vars` NixOS options](../reference/clan.core/vars.md)
+- [Reference Documentation for the `clan vars` CLI command](../reference/cli/vars.md)
--- a/docs/site/guides/inventory/inventory.md
+++ b/docs/site/guides/inventory/inventory.md
@@ -17,13 +17,13 @@ The following tutorial will walk through setting up a Backup service where the t

 ## Prerequisites

- [x] [Add some machines](../getting-started/add-machines.md) to your Clan.
+- [x] [Add some machines](../guides/getting-started/add-machines.md) to your Clan.

 ## Services

-The inventory defines `instances` of clan services. Membership of `machines` is defined via `roles` exclusively.
+The inventory defines `services`. Membership of `machines` is defined via `roles` exclusively.

-See each [modules documentation](../../reference/clanServices/index.md) for its available roles.
+See each [modules documentation](../reference/clanServices/index.md) for its available roles.

 ### Adding services to machines

@@ -31,8 +31,9 @@ A service can be added to one or multiple machines via `Roles`. Clan's `Role` in

 Each service can still be customized and configured according to the modules options.

- Per role configuration via `inventory.instances.<instanceName>.roles.<roleName>.settings`
- Per machine configuration via `inventory.instances.<instanceName>.roles.<roleName>.machines.<machineName>.settings`
+- Per instance configuration via `services.<serviceName>.<instanceName>.config`
+- Per role configuration via `services.<serviceName>.<instanceName>.roles.<roleName>.config`
+- Per machine configuration via `services.<serviceName>.<instanceName>.machines.<machineName>.config`

 ### Setting up the Backup Service

@@ -43,17 +44,16 @@ Each service can still be customized and configured according to the modules opt

    See also: [Multiple Service Instances](#multiple-service-instances)

-    ```{.nix hl_lines="9-10"}
-    {
-        inventory.instances.instance_1 = {
-            module =  {
-                name = "borgbackup";
-                input = "clan-core";
+    ```{.nix hl_lines="6-7"}
+    clan-core.lib.clan {
+        inventory = {
+            services = {
+                borgbackup.instance_1 = {
+                    # Machines can be added here.
+                    roles.client.machines = [ "jon" ];
+                    roles.server.machines = [ "backup_server" ];
+                };
            };
-
-            # Machines can be added here.
-            roles.client.machines."jon" {};
-            roles.server.machines."backup_server" = {};
        };
    }
    ```
@@ -66,8 +66,8 @@ It is possible to add services to multiple machines via tags as shown

 !!! Example "Tags Example"

-    ```{.nix hl_lines="5 8 18"}
-    {
+    ```{.nix hl_lines="5 8 14"}
+    clan-core.lib.clan {
        inventory = {
            machines = {
                "jon" = {
@@ -76,16 +76,13 @@ It is possible to add services to multiple machines via tags as shown
                "sara" = {
                    tags = [ "backup" ];
                };
+                # ...
            };
-
-            instances.instance_1 = {
-                module =  {
-                    name = "borgbackup";
-                    input = "clan-core";
+            services = {
+                borgbackup.instance_1 = {
+                    roles.client.tags = [ "backup" ];
+                    roles.server.machines = [ "backup_server" ];
                };
-
-                roles.client.tags =  [ "backup" ];
-                roles.server.machines."backup_server" = {};
            };
        };
    }
@@ -101,34 +98,22 @@ It is possible to add services to multiple machines via tags as shown

    In this example `backup_server` has role `client` and `server` in different instances.

-    ```{.nix hl_lines="17 26"}
-    {
+    ```{.nix hl_lines="11 14"}
+    clan-core.lib.clan {
        inventory = {
            machines = {
                "jon" = {};
                "backup_server" = {};
-                "backup_backup_server" = {};
+                "backup_backup_server" = {}
            };
-
-            instances = {
-                instance_1 = {
-                    module =  {
-                        name = "borgbackup";
-                        input = "clan-core";
-                    };
-
-                    roles.client.machines."jon" = {};
-                    roles.server.machines."backup_server" = {};
+            services = {
+                borgbackup.instance_1 = {
+                    roles.client.machines = [ "jon" ];
+                    roles.server.machines = [ "backup_server" ];
                };
-
-                instance_2 = {
-                    module =  {
-                        name = "borgbackup";
-                        input = "clan-core";
-                    };
-
-                    roles.client.machines."backup_server" = {};
-                    roles.server.machines."backup_backup_server" = {};
+                borgbackup.instance_2 = {
+                    roles.client.machines = [ "backup_server" ];
+                    roles.server.machines = [ "backup_backup_server" ];
                };
            };
        };
--- a/docs/site/guides/age-plugins.md
+++ b/docs/site/guides/age-plugins.md
@@ -0,0 +1,59 @@
+## Using Age Plugins
+
+If you wish to use a key generated using an [age plugin] as your admin key, extra care is needed.
+
+You must **precede your secret key with a comment that contains its corresponding recipient**.
+
+This is usually output as part of the generation process
+and is only required because there is no unified mechanism for recovering a recipient from a plugin secret key.
+
+Here is an example:
+
+```title="~/.config/sops/age/keys.txt"
+# public key: age1zdy49ek6z60q9r34vf5mmzkx6u43pr9haqdh5lqdg7fh5tpwlfwqea356l
+AGE-PLUGIN-FIDO2-HMAC-1QQPQZRFR7ZZ2WCV...
+```
+
+!!! note
+    The comment that precedes the plugin secret key need only contain the recipient.
+    Any other text is ignored.
+
+    In the example above, you can specify `# recipient: age1zdy...`, `# public: age1zdy....` or even
+    just `# age1zdy....`
+
+You will need to add an entry into your `flake.nix` to ensure that the necessary `age` plugins
+are loaded when using Clan:
+
+```nix title="flake.nix"
+{
+  inputs.clan-core.url = "https://git.clan.lol/clan/clan-core/archive/main.tar.gz";
+  inputs.nixpkgs.follows = "clan-core/nixpkgs";
+
+  outputs =
+    { self, clan-core, ... }:
+    let
+      # Sometimes this attribute set is defined in clan.nix
+      clan = clan-core.lib.clan {
+        inherit self;
+
+        meta.name = "myclan";
+
+        # Add Yubikey and FIDO2 HMAC plugins
+        # Note: the plugins listed here must be available in nixpkgs.
+        secrets.age.plugins = [
+          "age-plugin-yubikey"
+          "age-plugin-fido2-hmac"
+        ];
+
+        machines = {
+          # elided for brevity
+        };
+      };
+    in
+    {
+      inherit (clan) nixosConfigurations nixosModules clanInternals;
+
+      # elided for brevity
+    };
+}
+```
--- a/docs/site/guides/backups.md
+++ b/docs/site/guides/backups.md
@@ -1,3 +1,4 @@
+
 This guide explains how to set up and manage
 [BorgBackup](https://borgbackup.readthedocs.io/) for secure, efficient backups
 in a clan network. BorgBackup provides:
@@ -17,7 +18,7 @@ inventory.instances = {
  borgbackup = {
    module = {
      name = "borgbackup";
-      input = "clan-core";
+      input = "clan";
    };
    roles.client.machines."jon".settings = {
      destinations."storagebox" = {
@@ -176,7 +177,7 @@ storagebox::username@username.your-storagebox.de:/./borgbackup::jon-storagebox-2

 ### Restoring backups

-For restoring a backup you have two options.
+For restoring a backup you have two options. 

 #### Full restoration

@@ -193,3 +194,6 @@ To restore only a specific service (e.g., `linkding`):
 ```bash
 clan backups restore --service linkding jon borgbackup storagebox::u444061@u444061.your-storagebox.de:/./borgbackup::jon-storagebox-2025-07-24T06:02:35
 ```
+
+
+
--- a/docs/site/guides/inventory/clanServices.md
+++ b/docs/site/guides/inventory/clanServices.md
@@ -1,3 +1,5 @@
+# Using the Inventory
+
 Clan's inventory system is a composable way to define and deploy services across
 machines.

@@ -68,7 +70,7 @@ inventory.instances = {
 ## Module Settings

 Each role might expose configurable options. See clan's [clanServices
-reference](../../reference/clanServices/index.md) for all available options.
+reference](../reference/clanServices/index.md) for all available options.

 Settings can be set in per-machine or per-role. The latter is applied to all
 machines that are assigned to that role.
@@ -155,13 +157,13 @@ inventory.instances = {

 You can use services exposed by Clan's core module library, `clan-core`.

-🔗 See: [List of Available Services in clan-core](../../reference/clanServices/index.md)
+🔗 See: [List of Available Services in clan-core](../reference/clanServices/index.md)

 ## Defining Your Own Service

 You can also author your own `clanService` modules.

-🔗 Learn how to write your own service: [Authoring a service](../services/community.md)
+🔗 Learn how to write your own service: [Authoring a service](../guides/services/community.md)

 You might expose your service module from your flake — this makes it easy for other people to also use your module in their clan.

@@ -177,7 +179,7 @@ ______________________________________________________________________

 ## What's Next?

- [Author your own clanService →](../services/community.md)
- [Migrate from clanModules →](../migrations/migrate-inventory-services.md)
+- [Author your own clanService →](../guides/services/community.md)
+- [Migrate from clanModules →](../guides/migrations/migrate-inventory-services.md)

 <!-- TODO: * [Understand the architecture →](../explanation/clan-architecture.md) -->
--- a/docs/site/guides/disk-encryption.md
+++ b/docs/site/guides/disk-encryption.md
@@ -4,8 +4,6 @@ This guide provides an example setup for a single-disk ZFS system with native en
 !!! Warning
    This configuration only applies to `systemd-boot` enabled systems and **requires** UEFI booting.

-!!! Info "Secure Boot"
-    This guide is compatible with systems that have [secure boot disabled](./secure-boot.md). If you encounter boot issues, check if secure boot needs to be disabled in your UEFI settings.

 Replace the highlighted lines with your own disk-id.
 You can find our your disk-id by executing:
--- a/Show More
+++ b/Show More