Merge pull request 'pinned-clan-core' (#3574) from pinned-clan-core into main

Reviewed-on: https://git.clan.lol/clan/clan-core/pulls/3574

.gitea/workflows/update-clan-core-for-checks.yml

@@ -0,0 +1,29 @@
+name: "Update pinned clan-core for checks"
+on:
+  repository_dispatch:
+  workflow_dispatch:
+  schedule:
+    - cron: "51 2 * * *"
+jobs:
+  update-pinned-clan-core:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - name: Update clan-core for checks
+        run: nix run .#update-clan-core-for-checks
+      - name: Create pull request
+        run: |
+          git commit -am ""
+          git push origin HEAD:update-clan-core-for-checks
+          curl -X POST \
+            -H "Authorization: token $GITEA_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d '{
+              "head": "update-clan-core-branch",
+              "base": "main",
+              "title": "Automated Update: Clan Core",
+              "body": "This PR updates the pinned clan-core for checks."
+            }' \
+            "${GITEA_SERVER_URL}/api/v1/repos/${GITEA_OWNER}/${GITEA_REPO}/pulls"

.gitignore

@@ -14,8 +14,12 @@ example_clan
 nixos.qcow2
 **/*.glade~
 /docs/out
+/pkgs/clan-cli/clan_cli/select
 **/.local.env
 
+# MacOS stuff
+**/.DS_store
+
 # dream2nix
 .dream2nix
 
@@ -39,3 +43,6 @@ repo
 node_modules
 dist
 .webui
+
+# TODO: remove after bug in select is fixed
+select

CODEOWNERS

@@ -0,0 +1,2 @@
+nixosModules/clanCore/vars/.* @lopter
+pkgs/clan-cli/clan_cli/(secrets|vars)/.* @lopter

checks/app-ocr/default.nix

@@ -0,0 +1,41 @@
+{ self, pkgs, ... }:
+{
+  name = "app-ocr-smoke-test";
+
+  enableOCR = true;
+
+  nodes = {
+    wayland =
+      { modulesPath, ... }:
+      {
+        imports = [ (modulesPath + "/../tests/common/wayland-cage.nix") ];
+        services.cage.program = "${self.packages.${pkgs.system}.clan-app}/bin/clan-app";
+        virtualisation.memorySize = 2047;
+        # TODO: get rid of this and fix debus-proxy error instead
+        services.cage.environment.WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS = "1";
+      };
+    xorg =
+      { pkgs, modulesPath, ... }:
+      {
+        imports = [
+          (modulesPath + "/../tests/common/user-account.nix")
+          (modulesPath + "/../tests/common/x11.nix")
+        ];
+        virtualisation.memorySize = 2047;
+        services.xserver.enable = true;
+        services.xserver.displayManager.sessionCommands = "${
+          self.packages.${pkgs.system}.clan-app
+        }/bin/clan-app";
+        test-support.displayManager.auto.user = "alice";
+      };
+  };
+  testScript = ''
+    start_all()
+
+    wayland.wait_for_unit('graphical.target')
+    xorg.wait_for_unit('graphical.target')
+
+    wayland.wait_for_text('Welcome to Clan')
+    xorg.wait_for_text('Welcome to Clan')
+  '';
+}

checks/backups/flake-module.nix

@@ -36,7 +36,7 @@
         # Borgbackup overrides
         services.borgbackup.repos.test-backups = {
           path = "/var/lib/borgbackup/test-backups";
-          authorizedKeys = [ (builtins.readFile ../lib/ssh/pubkey) ];
+          authorizedKeys = [ (builtins.readFile ../assets/ssh/pubkey) ];
         };
         clan.borgbackup.destinations.test-backup.repo = lib.mkForce "borg@machine:.";
 
@@ -45,7 +45,7 @@
 
         programs.ssh.knownHosts = {
           machine.hostNames = [ "machine" ];
-          machine.publicKey = builtins.readFile ../lib/ssh/pubkey;
+          machine.publicKey = builtins.readFile ../assets/ssh/pubkey;
         };
 
         services.openssh = {
@@ -60,7 +60,7 @@
           ];
         };
 
-        users.users.root.openssh.authorizedKeys.keyFiles = [ ../lib/ssh/pubkey ];
+        users.users.root.openssh.authorizedKeys.keyFiles = [ ../assets/ssh/pubkey ];
 
         # This is needed to unlock the user for sshd
         # Because we use sshd without setuid binaries
@@ -68,21 +68,21 @@
 
         systemd.tmpfiles.settings."vmsecrets" = {
           "/root/.ssh/id_ed25519" = {
-            C.argument = "${../lib/ssh/privkey}";
+            C.argument = "${../assets/ssh/privkey}";
             z = {
               mode = "0400";
               user = "root";
             };
           };
           "/etc/secrets/ssh.id_ed25519" = {
-            C.argument = "${../lib/ssh/privkey}";
+            C.argument = "${../assets/ssh/privkey}";
             z = {
               mode = "0400";
               user = "root";
             };
           };
           "/etc/secrets/borgbackup/borgbackup.ssh" = {
-            C.argument = "${../lib/ssh/privkey}";
+            C.argument = "${../assets/ssh/privkey}";
             z = {
               mode = "0400";
               user = "root";
@@ -147,29 +147,11 @@
   perSystem =
     { pkgs, ... }:
     let
-      clanCore = self.filter {
-        include = [
-          "checks/backups"
-          "checks/flake-module.nix"
-          "clanModules/borgbackup"
-          "clanModules/flake-module.nix"
-          "clanModules/localbackup"
-          "clanModules/packages"
-          "clanModules/single-disk"
-          "clanModules/zerotier"
-          "flake.lock"
-          "flakeModules"
-          "inventory.json"
-          "nixosModules"
-          # Just include everything in 'lib'
-          # If anything changes in /lib that may affect everything
-          "lib"
-        ];
-      };
+      clanCore = self.checks.x86_64-linux.clan-core-for-checks;
     in
     {
       checks = pkgs.lib.mkIf pkgs.stdenv.isLinux {
-        backups = (import ../lib/container-test.nix) {
+        backups = self.clanLib.test.containerTest {
           name = "backups";
           nodes.machine = {
             imports =
@@ -182,11 +164,6 @@
               # import the inventory generated nixosModules
               self.clanInternals.inventoryClass.machines.test-backup.machineImports;
             clan.core.settings.directory = ./.;
-            environment.systemPackages = [
-              (pkgs.writeShellScriptBin "foo" ''
-                echo ${clanCore}
-              '')
-            ];
           };
 
           testScript = ''

checks/borgbackup/default.nix

@@ -1,4 +1,4 @@
-(import ../lib/test-base.nix) (
+(
   { ... }:
   {
     name = "borgbackup";
@@ -12,7 +12,7 @@
           {
             services.openssh.enable = true;
             services.borgbackup.repos.testrepo = {
-              authorizedKeys = [ (builtins.readFile ../lib/ssh/pubkey) ];
+              authorizedKeys = [ (builtins.readFile ../assets/ssh/pubkey) ];
             };
           }
           {
@@ -21,7 +21,7 @@
             environment.etc.state.text = "hello world";
             systemd.tmpfiles.settings."vmsecrets" = {
               "/etc/secrets/borgbackup/borgbackup.ssh" = {
-                C.argument = "${../lib/ssh/privkey}";
+                C.argument = "${../assets/ssh/privkey}";
                 z = {
                   mode = "0400";
                   user = "root";

checks/clan-core-for-checks.nix

@@ -0,0 +1,6 @@
+{ fetchgit }:
+fetchgit {
+  url = "https://git.clan.lol/clan/clan-core.git";
+  rev = "1e8b9def2a021877342491ca1f4c45533a580759";
+  sha256 = "0f12vwr1abwa1iwjbb5z5xx8jlh80d9njwdm6iaw1z1h2m76xgzc";
+}

checks/container/default.nix

@@ -1,19 +1,44 @@
-(import ../lib/container-test.nix) (
+(
   { ... }:
   {
     name = "container";
 
-    nodes.machine =
+    nodes.machine1 =
       { ... }:
       {
-        networking.hostName = "machine";
+        networking.hostName = "machine1";
         services.openssh.enable = true;
         services.openssh.startWhenNeeded = false;
       };
+
+    nodes.machine2 =
+      { ... }:
+      {
+        networking.hostName = "machine2";
+        services.openssh.enable = true;
+        services.openssh.startWhenNeeded = false;
+      };
+
     testScript = ''
+      import subprocess
       start_all()
-      machine.succeed("systemctl status sshd")
-      machine.wait_for_unit("sshd")
+      machine1.succeed("systemctl status sshd")
+      machine2.succeed("systemctl status sshd")
+      machine1.wait_for_unit("sshd")
+      machine2.wait_for_unit("sshd")
+
+      p1 = subprocess.run(["ip", "a"], check=False, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+      assert p1.returncode == 0
+      bridge_output = p1.stdout.decode("utf-8")
+      assert "br0" in bridge_output, f"bridge not found in ip a output: {bridge_output}"
+
+      for m in [machine1, machine2]:
+          out = machine1.succeed("ip addr show eth1")
+          assert "UP" in out, f"UP not found in ip addr show output: {out}"
+          assert "inet" in out, f"inet not found in ip addr show output: {out}"
+          assert "inet6" in out, f"inet6 not found in ip addr show output: {out}"
+
+      machine1.succeed("ping -c 1 machine2")
     '';
   }
 )

checks/dont-depend-on-repo-root.nix

@@ -0,0 +1,122 @@
+{
+  ...
+}:
+{
+  perSystem =
+    {
+      system,
+      pkgs,
+      self',
+      lib,
+      ...
+    }:
+    let
+      clanCore = self'.packages.clan-core-flake;
+      clanCoreHash = lib.substring 0 12 (builtins.hashString "sha256" "${clanCore}");
+      /*
+        construct a flake for the test which contains a single check which depends
+        on all checks of clan-core.
+      */
+      testFlakeFile = pkgs.writeText "flake.nix" ''
+        {
+          inputs.clan-core.url = path:///to/nowhere;
+          outputs = {clan-core, ...}:
+            let
+              checks =
+                builtins.removeAttrs
+                  clan-core.checks.${system}
+                  [
+                    "dont-depend-on-repo-root"
+                    "package-dont-depend-on-repo-root"
+                    "package-clan-core-flake"
+                  ];
+              checksOutPaths = map (x: "''${x}") (builtins.attrValues checks);
+            in
+            {
+              checks.${system}.check = builtins.derivation {
+                name = "all-clan-core-checks";
+                system = "${system}";
+                builder = "/bin/sh";
+                args = ["-c" '''
+                  of outPath in ''${toString checksOutPaths}; do
+                    echo "$outPath" >> $out
+                  done
+                '''];
+              };
+            };
+        }
+      '';
+    in
+    lib.optionalAttrs (system == "x86_64-linux") {
+      packages.dont-depend-on-repo-root =
+        pkgs.runCommand
+          # append repo hash to this tests name to ensure it gets invalidated on each chain
+          # This is needed because this test is an FOD (due to networking) and would get cached indefinitely.
+          "check-dont-depend-on-repo-root-${clanCoreHash}"
+          {
+            buildInputs = [
+              pkgs.nix
+              pkgs.cacert
+              pkgs.nix-diff
+            ];
+            outputHashAlgo = "sha256";
+            outputHash = "sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=";
+          }
+          ''
+            mkdir clanCore testFlake store
+            clanCore=$(realpath clanCore)
+            testFlake=$(realpath testFlake)
+
+            # copy clan core flake and make writable
+            cp -r ${clanCore}/* clanCore/
+            chmod +w -R clanCore\
+
+            # copy test flake and make writable
+            cp ${testFlakeFile} testFlake/flake.nix
+            chmod +w -R testFlake
+
+            # enable flakes
+            export NIX_CONFIG="experimental-features = nix-command flakes"
+
+            # give nix a $HOME
+            export HOME=$(realpath ./store)
+
+            # override clan-core flake input to point to $clanCore\
+            echo "locking clan-core to $clanCore"
+            nix flake lock --override-input clan-core "path://$clanCore" "$testFlake" --store "$HOME"
+
+            # evaluate all tests
+            echo "evaluating all tests for clan core"
+            nix eval "$testFlake"#checks.${system}.check.drvPath --store "$HOME" --raw > drvPath1 &
+
+            # slightly modify clan core
+            cp -r $clanCore clanCore2
+            cp -r $testFlake testFlake2
+            export clanCore2=$(realpath clanCore2)
+            export testFlake2=$(realpath testFlake2)
+            touch clanCore2/fly-fpv
+
+            # re-evaluate all tests
+            echo "locking clan-core to $clanCore2"
+            nix flake lock --override-input clan-core "path://$clanCore2" "$testFlake2" --store "$HOME"
+            echo "evaluating all tests for clan core with added file"
+            nix eval "$testFlake2"#checks.${system}.check.drvPath --store "$HOME" --raw > drvPath2
+
+            # wait for first nix eval to return as well
+            while ! grep -q drv drvPath1; do sleep 1; done
+
+            # raise error if outputs are different
+            if [ "$(cat drvPath1)" != "$(cat drvPath2)" ]; then
+              echo -e "\n\nERROR: Something in clan-core depends on the whole repo" > /dev/stderr
+              echo -e "See details in the nix-diff below which shows the difference between two evaluations:"
+              echo -e "  1. Evaluation of clan-core checks without any changes"
+              echo -e "  1. Evaluation of clan-core checks after adding a file to the top-level of the repo"
+              echo "nix-diff:"
+              export NIX_REMOTE="$HOME"
+              nix-diff $(cat drvPath1) $(cat drvPath2)
+              exit 1
+            fi
+            touch $out
+          '';
+    };
+}

checks/dummy-inventory-test/default.nix

@@ -26,6 +26,7 @@ clanLib.test.makeTestClan {
               roles.admin.machines = [ "admin1" ];
             };
           };
+
           instances."test" = {
             module.name = "new-service";
             roles.peer.machines.peer1 = { };
@@ -33,25 +34,33 @@ clanLib.test.makeTestClan {
 
           modules = {
             legacy-module = ./legacy-module;
-            new-service = {
-              _class = "clan.service";
-              manifest.name = "new-service";
-              roles.peer = { };
-              perMachine = {
-                nixosModule = {
-                  # This should be generated by:
-                  # ./pkgs/scripts/update-vars.py
-                  clan.core.vars.generators.new-service = {
-                    files.hello = {
-                      secret = false;
-                      deploy = true;
-                    };
-                    script = ''
-                      # This is a dummy script that does nothing
-                      echo "This is a dummy script" > $out/hello
-                    '';
-                  };
+          };
+        };
+        modules.new-service = {
+          _class = "clan.service";
+          manifest.name = "new-service";
+          roles.peer = { };
+          perMachine = {
+            nixosModule = {
+              # This should be generated by:
+              # nix run .#generate-test-vars -- checks/dummy-inventory-test dummy-inventory-test
+              clan.core.vars.generators.new-service = {
+                files.not-a-secret = {
+                  secret = false;
+                  deploy = true;
                 };
+                files.a-secret = {
+                  secret = true;
+                  deploy = true;
+                  owner = "nobody";
+                  group = "users";
+                  mode = "0644";
+                };
+                script = ''
+                  # This is a dummy script that does nothing
+                  echo -n "not-a-secret" > $out/not-a-secret
+                  echo -n "a-secret" > $out/a-secret
+                '';
               };
             };
           };
@@ -69,7 +78,15 @@ clanLib.test.makeTestClan {
           print(peer1.succeed("systemctl status dummy-service"))
 
           # peer1 should have the 'hello' file
-          peer1.succeed("cat ${nodes.peer1.clan.core.vars.generators.new-service.files.hello.path}")
+          peer1.succeed("cat ${nodes.peer1.clan.core.vars.generators.new-service.files.not-a-secret.path}")
+
+          ls_out = peer1.succeed("ls -la ${nodes.peer1.clan.core.vars.generators.new-service.files.a-secret.path}")
+          # Check that the file is owned by 'nobody'
+          assert "nobody" in ls_out, f"File is not owned by 'nobody': {ls_out}"
+          # Check that the file is in the 'users' group
+          assert "users" in ls_out, f"File is not in the 'users' group: {ls_out}"
+          # Check that the file is in the '0644' mode
+          assert "-rw-r--r--" in ls_out, f"File is not in the '0644' mode: {ls_out}"
         '';
     }
   );

checks/dummy-inventory-test/sops/machines/admin1/key.json

@@ -1,6 +1,6 @@
 [
   {
-    "publickey": "age1hd2exjq88h7538y6mvjvexx3u5gp6a03yfn5nj32h2667yyksyaqcuk5qs",
+    "publickey": "age12yt078p9ewxy2sh0a36nxdpgglv8wqqftmj4dkj9rgy5fuyn4p0q5nje9m",
     "type": "age"
   }
 ]

checks/dummy-inventory-test/sops/machines/peer1/key.json

@@ -1,6 +1,6 @@
 [
   {
-    "publickey": "age19urkt89q45a2wk6a4yaramzufjtnw6nq2snls0v7hmf7tqf73axsfx50tk",
+    "publickey": "age12w2ld4vxfyf3hdq2d8la4cu0tye4pq97egvv3me4wary7xkdnq2snh0zx2",
     "type": "age"
   }
 ]

checks/dummy-inventory-test/sops/secrets/admin1-age.key/secret

@@ -1,15 +1,15 @@
 {
-	"data": "ENC[AES256_GCM,data:hhuFgZcPqht0h3tKxGtheS4GlrVDo4TxH0a9lxgPYj2i12QUmE04rB07A+hu4Z8WNWLYvdM5069mEOZYm3lSeTzBHQPxYZRuVj0=,iv:sA1srRFQqsMlJTAjFcb09tI/Jg2WjOVJL5NZkPwiLoU=,tag:6xXo9FZpmAJw6hCBsWzf8Q==,type:str]",
+	"data": "ENC[AES256_GCM,data:GPpsUhSzWPtTP8EUNKsobFXjYqDldhkkIH6hBk11RsDLAGWdhVrwcISGbhsWpYhvAdPKA84DB6Zqyh9lL2bLM9//ybC1kzY20BQ=,iv:NrxMLdedT2FCkUAD00SwsAHchIsxWvqe7BQekWuJcxw=,tag:pMDXcMyHnLF2t3Qhb1KolA==,type:str]",
 	"sops": {
 		"age": [
 			{
 				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGaGVHeTgrN3dJQ2VITFBM\neWVzbDhjb0pwNUhBUjdUc0p5OTVta1dvSno4ClJxeUc4Z0hiaFRkVlJ1YTA4Lyta\neWdwV005WGYvMUNRVG1qOVdicTk0NUkKLS0tIFQvaDNFS1JMSFlHRXlhc3lsZm03\nYVhDaHNsam5wN1VqdzA3WTZwM1JwV2sKZk/SiZJgjllADdfHLSWuQcU4+LttDpt/\nqqDUATEuqYaALljC/y3COT+grTM2bwGjj6fsfsfiO/EL9iwzD3+7oA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzb2tWb1ExKzdmUTRzaGVj\nK3cyYTBHZTJwVjM1SzUvbHFiMnVhY05iKzFZCnJTSE1VSVdpcUFLSEJuaE1CZzJD\nWjZxYzN2cUltdThNMVRKU3FIb20vUXMKLS0tIFlHQXRIdnMybDZFUVEzWlQrc1dw\nbUxhZURXblhHd0pka0JIK1FTZEVqdUEKI/rfxQRBc+xGRelhswkJQ9GcZs6lzfgy\nuCxS5JI9npdPLQ/131F3b21+sP5YWqks41uZG+vslM1zQ+BlENNhDw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-04-09T15:10:16Z",
-		"mac": "ENC[AES256_GCM,data:xuXj4833G6nhvcRo2ekDxz8G5phltmU8h1GgGofH9WndzrqLKeRSqm/n03IHRW0f4F68XxnyAkfvokVh6vW3LRQAFkqIlXz5U4+zFNcaVaPobS5gHTgxsCoTUoalWPvHWtXd50hUVXeAt8rPfTfeveVGja8bOERk8mvwUPxb6h4=,iv:yP1usA9m8tKl6Z/UK9PaVMJlZlF5qpY4EiM4+ByVlik=,tag:8DgoIhLstp3MRki90VfEvw==,type:str]",
+		"lastmodified": "2025-05-04T12:44:13Z",
+		"mac": "ENC[AES256_GCM,data:fWxLHXBWolHVxv6Q7utcy6OVLV13ziswrIYyNKiwy1vsU8i7xvvuGO1HlnE+q43D2WuHR53liKq1UHuf1JMrWzTwZ0PYe+CVugtoEtbR2qu3rK/jAkOyMyhmmHzmf6Rp4ZMCzKgZeC/X2bDKY/z0firHAvjWydEyogutHpvtznM=,iv:OQI3FfkLneqbdztAXVQB3UkHwDPK+0hWu5hZ9m8Oczg=,tag:em6GfS2QHsXs391QKPxfmA==,type:str]",
 		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.1"
+		"version": "3.10.2"
 	}
 }

checks/dummy-inventory-test/sops/secrets/peer1-age.key/secret

@@ -1,15 +1,15 @@
 {
-	"data": "ENC[AES256_GCM,data:rwPhbayGf6mE1E9NCN+LuL7VfWWOfhoJW6H2tNSoyebtyTpM3GO2jWca1+N7hI0juhNkUk+rIsYQYbCa/5DZQiV0/2Jgu4US1XY=,iv:B5mcaQsDjb6BacxGB4Kk88/qLCpVOjQNRvGN+fgUiEo=,tag:Uz0A8kAF5NzFetbv9yHIjQ==,type:str]",
+	"data": "ENC[AES256_GCM,data:W3cOkUYL5/YulW2pEISyTlMaA/t7/WBE7BoCdFlqrqgaCL7tG4IV2HgjiPWzIVMs0zvDSaghdEvAIoB4wOf470d1nSWs0/E8SDk=,iv:wXXaZIw3sPY8L/wxsu7+C5v+d3RQRuwxZRP4YLkS8K4=,tag:HeK4okj7O7XDA9JDz2KULw==,type:str]",
 	"sops": {
 		"age": [
 			{
 				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWY0hKQ1dnV0tMYytDMCtj\nTDV4Zk5NeVN0bCtqaWRQV3d4M0VlcGVZMkhZCm02dHZyOGVlYzJ5Z3FlUWNXMVQ0\nb2ZrTXZQRzRNdzFDeWZCVGhlTS9rMm8KLS0tIEJkY1QwOENRYWw3cjIwd3I0bzdz\nOEtQNm1saE5wNWt2UUVnYlN4NWtGdFkKmWHU5ttZoQ3NZu/zkX5VxfC2sMpSOyod\neb7LRhFqPfo5N1XphJcCqr5QUoZOfnH0xFhZ2lxWUS3ItiRpU4VDwg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxRC83b3dtSVpXcGovNnVs\nTzFka2J2MEFhYkF1ajVrdjMrNUtPWGRObjM4Cm5zSUR5OGw0T0FaL3BaWmR6L29W\nU2syMFIyMUhFRUZpWFpCT28vWko2ZU0KLS0tIFpHK3BjU1V1L0FrMGtwTGFuU3Mz\nRkV5VjI2Vndod202bUR3RWQwNXpmVzQKNk8/y7M62wTIIKqY4r3ZRk5aUCRUfine\n1LUSHMKa2bRe+hR7nS7AF4BGXp03h2UPY0FP5+U5q8XuIj1jfMX8kg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-04-09T15:10:41Z",
-		"mac": "ENC[AES256_GCM,data:pab0G2GPjgs59sbiZ8XIV5SdRtq5NPU0yq18FcqiMV8noAL94fyVAY7fb+9HILQWQsEjcykgk9mA2MQ0KpK/XG8+tDQKcBH+F+2aQnw5GJevXmfi7KLTU0P224SNo7EnKlfFruB/+NZ0WBtkbbg1OzekrbplchpSI6BxWz/jASE=,iv:TCj9FCxgfMF2+PJejr67zgGnF+CFS+YeJiejnHbf7j0=,tag:s7r9SqxeqpAkncohYvIQ2Q==,type:str]",
+		"lastmodified": "2025-05-04T12:44:16Z",
+		"mac": "ENC[AES256_GCM,data:yTkQeFvKrN1+5FP+yInsaRWSAG+ZGG0uWF3+gVRvzJTFxab8kT2XkAMc+4D7SKgcjsmwBBb77GNoAKaKByhZ92UaCfZ2X66i7ZmYUwLM1NVVmm+xiwwjsh7PJXlZO/70anTzd1evtlZse0jEmRnV5Y0F0M6YqXmuwU+qGUJU2F8=,iv:sy6ozhXonWVruaQfa7pdEoV5GkNZR/UbbINKAPbgWeg=,tag:VMruQ1KExmlMR7TsGNgMlg==,type:str]",
 		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.1"
+		"version": "3.10.2"
 	}
 }

checks/dummy-inventory-test/vars/per-machine/admin1/dummy-generator/generated-password/secret

@@ -1,19 +1,19 @@
 {
-	"data": "ENC[AES256_GCM,data:bxM9aYMK,iv:SMNYtk9FSyZ1PIfEzayTKKdCnZWdhcyUEiTwFUNb988=,tag:qJYW4+VQyhF1tGPQPTKlOQ==,type:str]",
+	"data": "ENC[AES256_GCM,data:T8edCvw=,iv:7/G5xt5fv38I9uFzk7WMIr9xQdz/6lFxqOC+18HBg8Q=,tag:F39Cxbgmzml+lZLsZ59Kmg==,type:str]",
 	"sops": {
 		"age": [
 			{
-				"recipient": "age1hd2exjq88h7538y6mvjvexx3u5gp6a03yfn5nj32h2667yyksyaqcuk5qs",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvZDZYYXdpcXVqRFRnQ2Jx\nTFhFWEJTR290cHZhTXZadFFvcHM4MHVIN3lFCmJhOEZrL3g4TFBZVllxdDFZakJn\nR3NxdXo0eE8vTDh3QlhWOFpVZ0lNUHcKLS0tIEE4dkpCalNzaXJ0Qks3VHJSUzZF\nb2N3NGdjNHJnSUN6bW8welZ1VDdJakEKGKZ7nn1p11IyJB6DMxu2HJMvZ+0+5WpE\nPLWh2NlGJO3XrrL4Fw7xetwbqE+QUZPNl/JbEbu4KLIUGLjqk9JDhQ==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age12yt078p9ewxy2sh0a36nxdpgglv8wqqftmj4dkj9rgy5fuyn4p0q5nje9m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPNUhiYkZWK3dPMHNiRTVM\nRHNvaHFsOFp1c0UxQitwVG0zY01MNDZRV1E4CjEybENoTVIzN29vQ3FtUTRSYmFU\nNXIzQllVSllXRGN2M1B6WXJLdHZSajgKLS0tIDllZ0ZmZUcxMHhDQUpUOEdWbmkv\neUQweHArYTdFSmNteVpuQ3BKdnh0Y0UKs8Hm3D+rXRRfpUVSZM3zYjs6b9z8g10D\nGTkvreUMim4CS22pjdQ3eNA9TGeDXfWXE7XzwXLCb+wVcf7KwbDmvg==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHckJCQVFyb21aT1R0d2Rr\nMWxNMHVqcGxabHBmS0RibW9sN0gyZDI1b1dFCnRWUk5LSWdxV3c4RWVZdUtEN1Fv\nRk4xVmwwT2xrdWVERkJXUVVlVXJjTVUKLS0tIC9ERG9KMGxTNEsrbzFHUGRiVUlm\nRi9qakxoc1FOVVV1TkUrckwxRUVnajQKE8ms/np2NMswden3xkjdC8cXccASLOoN\nu+EaEk69UvBvnOg9VBjyPAraIKgNrTc4WWwz+DOBj1pCwVbu9XxUlA==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKSDhpT3cvck9PenZYVEZH\ndFQreVRBdG93L1dBUGlvYjFWcDlHWUJsZUVBCm9DMTJ4UytiYzlEVHNWdUcwS1ds\nT0dhbzAzNDdmbDBCU0dvL2xNeHpXcGsKLS0tIFArbmpsbzU3WnpJdUt1MGN0L1d0\nV1JkTDJYWUxsbmhTQVNOeVRaSUhTODQKk9Vph2eldS5nwuvVX0SCsxEm4B+sO76Z\ndIjJ3OQxzoZmXMaOOuKHC5U0Y75Qn7eXC43w5KHsl2CMIUYsBGJOZw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-04-09T15:10:30Z",
-		"mac": "ENC[AES256_GCM,data:cIwWctUbAFI8TRMxYWy5xqlKDVLMqBIxVv4LInnLqi3AauL0rJ3Z7AxK/wb2dCQM07E1N7YaORNqgUpFC1xo0hObAA8mrPaToPotKDkjua0zuyTUNS1COoraYjZpI/LKwmik/qtk399LMhiC7aHs+IliT9Dd41B8LSMBXwdMldY=,iv:sZ+//BrYH5Ay2JJAGs7K+WfO2ASK82syDlilQjGmgFs=,tag:nY+Af9eQRLwkiHZe85dQ9A==,type:str]",
+		"lastmodified": "2025-05-04T12:44:14Z",
+		"mac": "ENC[AES256_GCM,data:6fKrS1eLLUWlHkQpxLFXBRk6f2wa5ADLMViVvYXXGU24ayl9UuNSKrCRHp9cbzhqhti3HdwyNt6TM+2X6qhiiAQanKEB2PF7JRYX74NfNKil9BEDjt5AqqtpSgVv5l7Ku/uSHaPkd2sDmzHsy5Q4bSGxJQokStk1kidrwle+mbc=,iv:I/Aad82L/TCxStM8d8IZICUrwdjRbGx2fuGWqexr21o=,tag:BfgRbGUxhPZzK2fLik1kxA==,type:str]",
 		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.1"
+		"version": "3.10.2"
 	}
 }

checks/dummy-inventory-test/vars/per-machine/admin1/dummy-generator/host-id/value

@@ -1 +1 @@
-13898
+18650

checks/dummy-inventory-test/vars/per-machine/peer1/dummy-generator/generated-password/secret

@@ -1,19 +1,19 @@
 {
-	"data": "ENC[AES256_GCM,data:ImlGIKxE,iv:UUWxjLNRKJCD2WHNpw8lfvCc8rnXPCqc2pni1ODckjE=,tag:HFCqiv31E9bShIIaAEjF0A==,type:str]",
+	"data": "ENC[AES256_GCM,data:vp0yW0Gt,iv:FO2cy+UpEl5aRay/LUGu//c82QiVxuKuGSaVh0rGJvc=,tag:vf2RAOPpcRW0HwxHoGy17A==,type:str]",
 	"sops": {
 		"age": [
 			{
-				"recipient": "age19urkt89q45a2wk6a4yaramzufjtnw6nq2snls0v7hmf7tqf73axsfx50tk",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpTEROZjh6NjBhSlJSc1Av\nSHhjdkhwVUd3VzBZemhQb3dhMlJXalBmZlFjCkZPYkhZZGVOVTNjUWdFU0s4cWFn\nL2NXbkRCdUlMdElnK2lGbG5iV0w1cHMKLS0tIFREcmxDdHlUNVBFVGRVZSt0c0E5\nbnpHaW1Vb3R3ZFFnZVMxY3djSjJmOU0KIwqCSQf5S9oA59BXu7yC/V6yqvCh88pa\nYgmNyBjulytPh1aAfOuNWIGdIxBpcEf+gFjz3EiJY9Kft3fTmhp2bw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age12w2ld4vxfyf3hdq2d8la4cu0tye4pq97egvv3me4wary7xkdnq2snh0zx2",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjaFVNMEd2YUxpSm5XVVRi\nY2ZUc3NTOStJUFNMWWVPQTgxZ2tCK1QrMW1ZCjYwMlA4dkIzSlc0TGtvZjcyK3Bi\nM3pob2JOOFUyeVJ6M2JpaTRCZlc1R0kKLS0tIDJMb1dFcVRWckhwYWNCQng0RlFO\nTkw3OGt4dkFIZVY5aVEzZE5mMzJSM0EKUv8bUqg48L2FfYVUVlpXvyZvPye699of\nG6PcjLh1ZMbNCfnsCzr+P8Vdk/F4J/ifxL66lRGfu2xOLxwciwQ+5Q==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArN3R4TThibjdYbE9TMDE1\naUhuNDlscExjaktIR2VmTk1OMWtVM0NpTUJZClJUNEcwVDlibExWQk84TTNEWFhp\nMjYyZStHc1N0ZTh1S3VTVk45WGxlWWMKLS0tIHFab25LY1R1d1l6NE5XbHJvQ3lj\nNGsxUldFVHQ5RVJERDlGbi9NY29hNWsKENBTcAS/R/dTGRYdaWv5Mc/YG4bkah5w\nb421ZMQF+r4CYnzUqnwivTG8TMRMqJLavfkutE6ZUfJbbLufrTk5Lw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnZ2dDbVhoQngxM3lTSmZF\nUTAwS1lCTGhEMU1GVXpFUzlIUFdqZy9LajF3Ck9mdVpBRjlyVUNhZXZIUFZjUzF1\nNlhFN28vNmwzcUVkNmlzUnpkWjJuZE0KLS0tIHpXVHVlNk9vU1ZPTGRrYStWbmRO\nbDM4U2o1SlEwYWtqOXBqd3BFUTAvMHcKkI8UVd0v+x+ELZ5CoGq9DzlA6DnVNU2r\nrV9wLfbFd7RHxS0/TYZh5tmU42nO3iMYA9FqERQXCtZgXS9KvfqHwQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-04-09T15:11:04Z",
-		"mac": "ENC[AES256_GCM,data:JdJzocQZWVprOmZ4Ni04k1tpD1TpFcK5neKy3+0/c3+uPBwjwaMayISKRaa/ILUXlalg60oTqxB4fUFoYVm8KGQVhDwPhO/T1hyYVQqidonrcYfJfCYg00mVSREV/AWqXb7RTnaEBfrdnRJvaAQF9g2qDXGVgzp3eACdlItclv4=,iv:nOw1jQjIWHWwU3SiKpuQgMKXyu8MZYI+zI9UYYd9fCI=,tag:ewUkemIPm/5PkmuUD0EcAQ==,type:str]",
+		"lastmodified": "2025-05-04T12:44:18Z",
+		"mac": "ENC[AES256_GCM,data:1ZZ+ZI1JsHmxTov1bRijfol3kTkyheg2o3ivLsMHRhCmScsUry97hQJchF78+y2Izt7avaQEHYn6pVbYt/0rLrSYD7Ru7ITVxXoYHOiN5Qb98masUzpibZjrdyg5nO+LW5/Hmmwsc3yn/+o3IH1AUYpsxlJRdnHHCmoSOFaiFFM=,iv:OQlgmpOTw4ljujNzqwQ5/0Mz8pQpCSUtqRvj3FJAxDs=,tag:foZvdeW7gK9ZVKkWqnlxGA==,type:str]",
 		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.1"
+		"version": "3.10.2"
 	}
 }

checks/dummy-inventory-test/vars/per-machine/peer1/dummy-generator/host-id/value

@@ -1 +1 @@
-30661
+6745

checks/dummy-inventory-test/vars/per-machine/peer1/new-service/a-secret/machines/peer1

@@ -0,0 +1 @@
+../../../../../../sops/machines/peer1

checks/dummy-inventory-test/vars/per-machine/peer1/new-service/a-secret/secret

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:prFl0EJy8bM=,iv:zITWxf+6Ebk0iB5vhhd7SBQa1HFrIJXm8xpSM+D9I0M=,tag:NZCRMCs1SzNKLBu/KUDKMQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age12w2ld4vxfyf3hdq2d8la4cu0tye4pq97egvv3me4wary7xkdnq2snh0zx2",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0S0RZRWxaZVZvTUhjdWVL\naU9WZmtEcm1qa2JsRmdvdmZmNENMaWFEVUFRCmdoVnRXSGlpRlFjNmVVbDJ5VnFT\nMnVJUlVnM3lxNmZCRTdoRVJ4NW1oYWcKLS0tIFFNbXBFUk1RWnlUTW1SeG1vYzlM\nVVpEclFVOE9PWWQxVkZ0eEgwWndoRWcKDAOHe+FIxqGsc6LhxMy164qjwG6t2Ei2\nP0FSs+bcKMDpudxeuxCjnDm/VoLxOWeuqkB+9K2vSm2W/c/fHTSbrA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2VU5jOEpwYUtDVEVFcVpU\nQkExTVZ3ejZHcGo5TG8zdUQwNktoV09WdUZvCmQ0dE1TOWRFbTlxdVd4WWRxd3VF\nQUNTTkNNT3NKYjQ5dEJDY0xVZ3pZVUUKLS0tIDFjajRZNFJZUTdNeS8yN05FMFZU\ncEtjRjhRbGE0MnRLdk10NkFLMkxqencKGzJ66dHluIghH04RV/FccfEQP07yqnfb\n25Hi0XIVJfXBwje4UEyszrWTxPPwVXdQDQmoNKf76Qy2jYqJ56uksw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-05-04T12:44:20Z",
+		"mac": "ENC[AES256_GCM,data:FIkilsni5kOdNlVwDuLsQ/zExypHRWdqIBQDNWMLTwe8OrsNPkX+KYutUvt9GaSoGv4iDULaMRoizO/OZUNfc2d8XYSdj0cxOG1Joov4GPUcC/UGyNuQneAejZBKolvlnidKZArofnuK9g+lOTANEUtEXUTnx8L+VahqPZayQas=,iv:NAo6sT3L8OOB3wv1pjr3RY2FwXgVmZ4N0F4BEX4YPUY=,tag:zHwmXygyvkdpASZCodQT9Q==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}

checks/dummy-inventory-test/vars/per-machine/peer1/new-service/a-secret/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

checks/dummy-inventory-test/vars/per-machine/peer1/new-service/hello/value

@@ -1 +0,0 @@
-This is a dummy script

checks/dummy-inventory-test/vars/per-machine/peer1/new-service/not-a-secret/value

@@ -0,0 +1 @@
+not-a-secret

checks/flake-module.nix

@@ -14,12 +14,14 @@ in
     ./installation/flake-module.nix
     ./morph/flake-module.nix
     ./nixos-documentation/flake-module.nix
+    ./dont-depend-on-repo-root.nix
   ];
   perSystem =
     {
       pkgs,
       lib,
       self',
+      system,
       ...
     }:
     {
@@ -33,33 +35,79 @@ in
             inherit (self) clanLib;
           };
           nixosTests = lib.optionalAttrs (pkgs.stdenv.isLinux) {
-            # import our test
-            secrets = import ./secrets nixosTestArgs;
-            container = import ./container nixosTestArgs;
             # Deltachat is currently marked as broken
             # deltachat = import ./deltachat nixosTestArgs;
-            borgbackup = import ./borgbackup nixosTestArgs;
-            matrix-synapse = import ./matrix-synapse nixosTestArgs;
+
+            # Base Tests
+            secrets = self.clanLib.test.baseTest ./secrets nixosTestArgs;
+            borgbackup = self.clanLib.test.baseTest ./borgbackup nixosTestArgs;
+            wayland-proxy-virtwl = self.clanLib.test.baseTest ./wayland-proxy-virtwl nixosTestArgs;
+
+            # Container Tests
+            container = self.clanLib.test.containerTest ./container nixosTestArgs;
+            zt-tcp-relay = self.clanLib.test.containerTest ./zt-tcp-relay nixosTestArgs;
+            matrix-synapse = self.clanLib.test.containerTest ./matrix-synapse nixosTestArgs;
+            postgresql = self.clanLib.test.containerTest ./postgresql nixosTestArgs;
+
+            # Clan Tests
             mumble = import ./mumble nixosTestArgs;
             dummy-inventory-test = import ./dummy-inventory-test nixosTestArgs;
             data-mesher = import ./data-mesher nixosTestArgs;
             syncthing = import ./syncthing nixosTestArgs;
-            zt-tcp-relay = import ./zt-tcp-relay nixosTestArgs;
-            postgresql = import ./postgresql nixosTestArgs;
-            wayland-proxy-virtwl = import ./wayland-proxy-virtwl nixosTestArgs;
           };
 
+          packagesToBuild = lib.removeAttrs self'.packages [
+            # exclude the check that checks that nothing depends on the repo root
+            # We might want to include this later once everything is fixed
+            "dont-depend-on-repo-root"
+          ];
+
           flakeOutputs =
             lib.mapAttrs' (
               name: config: lib.nameValuePair "nixos-${name}" config.config.system.build.toplevel
             ) (lib.filterAttrs (n: _: !lib.hasPrefix "test-" n) self.nixosConfigurations)
-            // lib.mapAttrs' (n: lib.nameValuePair "package-${n}") self'.packages
+            // lib.mapAttrs' (n: lib.nameValuePair "package-${n}") packagesToBuild
             // lib.mapAttrs' (n: lib.nameValuePair "devShell-${n}") self'.devShells
             // lib.mapAttrs' (name: config: lib.nameValuePair "home-manager-${name}" config.activation-script) (
               self'.legacyPackages.homeConfigurations or { }
             );
         in
-        nixosTests // flakeOutputs;
+        nixosTests
+        // flakeOutputs
+        // {
+          # TODO: Automatically provide this check to downstream users to check their modules
+          clan-modules-json-compatible =
+            let
+              allSchemas = lib.mapAttrs (
+                _n: m:
+                let
+                  schema =
+                    (self.clanLib.inventory.evalClanService {
+                      modules = [ m ];
+                      prefix = [
+                        "checks"
+                        system
+                      ];
+                    }).config.result.api.schema;
+                in
+                schema
+              ) self.clan.modules;
+            in
+            pkgs.runCommand "combined-result"
+              {
+                schemaFile = builtins.toFile "schemas.json" (builtins.toJSON allSchemas);
+              }
+              ''
+                mkdir -p $out
+                cat $schemaFile > $out/allSchemas.json
+              '';
+
+          clan-core-for-checks = pkgs.runCommand "clan-core-for-checks" { } ''
+            cp -r ${pkgs.callPackage ./clan-core-for-checks.nix { }} $out
+            chmod +w $out/flake.lock
+            cp ${../flake.lock} $out/flake.lock
+          '';
+        };
       legacyPackages = {
         nixosTests =
           let
@@ -74,6 +122,8 @@ in
             # import our test
             secrets = import ./secrets nixosTestArgs;
             container = import ./container nixosTestArgs;
+            # Clan app tests
+            app-ocr = self.clanLib.test.baseTest ./app-ocr nixosTestArgs;
           };
       };
     };

checks/flash/flake-module.nix

@@ -43,6 +43,7 @@
     let
       dependencies = [
         pkgs.disko
+        pkgs.buildPackages.xorg.lndir
         self.nixosConfigurations."test-flash-machine-${pkgs.hostPlatform.system}".pkgs.perlPackages.ConfigIniFiles
         self.nixosConfigurations."test-flash-machine-${pkgs.hostPlatform.system}".pkgs.perlPackages.FileSlurp
 
@@ -56,7 +57,7 @@
     in
     {
       checks = pkgs.lib.mkIf pkgs.stdenv.isLinux {
-        flash = (import ../lib/test-base.nix) {
+        flash = self.clanLib.test.baseTest {
           name = "flash";
           nodes.target = {
             virtualisation.emptyDiskImages = [ 4096 ];
@@ -80,7 +81,7 @@
 
             # Some distros like to automount disks with spaces
             machine.succeed('mkdir -p "/mnt/with spaces" && mkfs.ext4 /dev/vdb && mount /dev/vdb "/mnt/with spaces"')
-            machine.succeed("clan flash write --debug --flake ${../..} --yes --disk main /dev/vdb test-flash-machine-${pkgs.hostPlatform.system}")
+            machine.succeed("clan flash write --debug --flake ${self.checks.x86_64-linux.clan-core-for-checks} --yes --disk main /dev/vdb test-flash-machine-${pkgs.hostPlatform.system}")
           '';
         } { inherit pkgs self; };
       };

checks/installation/flake-module.nix

@@ -8,7 +8,6 @@ let
     { modulesPath, pkgs, ... }:
     let
       dependencies = [
-        self
         self.clanInternals.machines.${pkgs.hostPlatform.system}.test-install-machine-with-system.config.system.build.toplevel
         self.clanInternals.machines.${pkgs.hostPlatform.system}.test-install-machine-with-system.config.system.build.diskoScript
         self.clanInternals.machines.${pkgs.hostPlatform.system}.test-install-machine-with-system.config.system.clan.deployment.file
@@ -16,6 +15,7 @@ let
         pkgs.bash.drvPath
         pkgs.nixos-anywhere
         pkgs.bubblewrap
+        pkgs.buildPackages.xorg.lndir
       ] ++ builtins.map (i: i.outPath) (builtins.attrValues self.inputs);
       closureInfo = pkgs.closureInfo { rootPaths = dependencies; };
     in
@@ -51,7 +51,7 @@ let
       };
       users.users.nonrootuser = {
         isNormalUser = true;
-        openssh.authorizedKeys.keyFiles = [ ../lib/ssh/pubkey ];
+        openssh.authorizedKeys.keyFiles = [ ../assets/ssh/pubkey ];
         extraGroups = [ "wheel" ];
       };
       security.sudo.wheelNeedsPassword = false;
@@ -183,7 +183,7 @@ in
       # vm-test-run-test-installation-> target: Guest root shell did not produce any data yet...
       # vm-test-run-test-installation-> target:   To debug, enter the VM and run 'systemctl status backdoor.service'.
       checks = pkgs.lib.mkIf (pkgs.stdenv.isLinux && !pkgs.stdenv.isAarch64) {
-        installation = (import ../lib/test-base.nix) {
+        installation = self.clanLib.test.baseTest {
           name = "installation";
           nodes.target = {
             services.openssh.enable = true;
@@ -195,10 +195,10 @@ in
           testScript = ''
             installer.start()
 
-            installer.succeed("${pkgs.coreutils}/bin/install -Dm 600 ${../lib/ssh/privkey} /root/.ssh/id_ed25519")
+            installer.succeed("${pkgs.coreutils}/bin/install -Dm 600 ${../assets/ssh/privkey} /root/.ssh/id_ed25519")
 
             installer.wait_until_succeeds("timeout 2 ssh -o StrictHostKeyChecking=accept-new -v nonrootuser@localhost hostname")
-            installer.succeed("cp -r ${../..} test-flake && chmod -R +w test-flake")
+            installer.succeed("cp -r ${self.checks.x86_64-linux.clan-core-for-checks} test-flake && chmod -R +w test-flake")
 
             installer.succeed("clan machines install --no-reboot --debug --flake test-flake --yes test-install-machine-without-system --target-host nonrootuser@localhost --update-hardware-config nixos-facter >&2")
             installer.shutdown()
@@ -210,15 +210,15 @@ in
           '';
         } { inherit pkgs self; };
 
-        update-hardware-configuration = (import ../lib/test-base.nix) {
+        update-hardware-configuration = self.clanLib.test.baseTest {
           name = "update-hardware-configuration";
           nodes.installer = installer;
 
           testScript = ''
             installer.start()
-            installer.succeed("${pkgs.coreutils}/bin/install -Dm 600 ${../lib/ssh/privkey} /root/.ssh/id_ed25519")
+            installer.succeed("${pkgs.coreutils}/bin/install -Dm 600 ${../assets/ssh/privkey} /root/.ssh/id_ed25519")
             installer.wait_until_succeeds("timeout 2 ssh -o StrictHostKeyChecking=accept-new -v nonrootuser@localhost hostname")
-            installer.succeed("cp -r ${../..} test-flake && chmod -R +w test-flake")
+            installer.succeed("cp -r ${self.checks.x86_64-linux.clan-core-for-checks} test-flake && chmod -R +w test-flake")
             installer.fail("test -f test-flake/machines/test-install-machine/hardware-configuration.nix")
             installer.fail("test -f test-flake/machines/test-install-machine/facter.json")
 

checks/lib/container-driver/package.nix

@@ -1,25 +0,0 @@
-{
-  extraPythonPackages,
-  python3Packages,
-  buildPythonApplication,
-  setuptools,
-  util-linux,
-  systemd,
-  nix,
-  colorama,
-  junit-xml,
-}:
-buildPythonApplication {
-  pname = "test-driver";
-  version = "0.0.1";
-  propagatedBuildInputs = [
-    util-linux
-    systemd
-    colorama
-    junit-xml
-    nix
-  ] ++ extraPythonPackages python3Packages;
-  nativeBuildInputs = [ setuptools ];
-  format = "pyproject";
-  src = ./.;
-}

checks/lib/container-test.nix

@@ -1,52 +0,0 @@
-test:
-{ pkgs, self, ... }:
-let
-  inherit (pkgs) lib;
-  nixos-lib = import (pkgs.path + "/nixos/lib") { };
-in
-(nixos-lib.runTest (
-  { hostPkgs, ... }:
-  {
-    hostPkgs = pkgs;
-    # speed-up evaluation
-    defaults =
-      { config, options, ... }:
-      {
-        imports = [
-          self.clanLib.test.minifyModule
-        ];
-        config = lib.mkMerge [
-          (lib.optionalAttrs (options ? clan) {
-            clan.core.settings.machine.name = config.networking.hostName;
-          })
-          {
-            documentation.enable = lib.mkDefault false;
-            boot.isContainer = true;
-
-            # needed since nixpkgs 7fb2f407c01b017737eafc26b065d7f56434a992 removed the getty unit by default
-            console.enable = true;
-
-            # undo qemu stuff
-            system.build.initialRamdisk = "";
-            virtualisation.sharedDirectories = lib.mkForce { };
-            networking.useDHCP = false;
-
-            # we have not private networking so far
-            networking.interfaces = lib.mkForce { };
-            #networking.primaryIPAddress = lib.mkForce null;
-            systemd.services.backdoor.enable = false;
-
-            # we don't have permission to set cpu scheduler in our container
-            systemd.services.nix-daemon.serviceConfig.CPUSchedulingPolicy = lib.mkForce "";
-          }
-        ];
-      };
-    # to accept external dependencies such as disko
-    node.specialArgs.self = self;
-    _module.args = { inherit self; };
-    imports = [
-      test
-      ./container-driver/module.nix
-    ];
-  }
-)).config.result

checks/matrix-synapse/default.nix

@@ -1,4 +1,4 @@
-(import ../lib/container-test.nix) (
+(
   { pkgs, ... }:
   {
     name = "matrix-synapse";

checks/morph/flake-module.nix

@@ -24,7 +24,7 @@
     }:
     {
       checks = pkgs.lib.mkIf (pkgs.stdenv.isLinux && !pkgs.stdenv.isAarch64) {
-        morph = (import ../lib/test-base.nix) {
+        morph = self.clanLib.test.baseTest {
           name = "morph";
 
           nodes = {
@@ -32,7 +32,6 @@
               { pkgs, ... }:
               let
                 dependencies = [
-                  self
                   pkgs.stdenv.drvPath
                   pkgs.stdenvNoCC
                   self.nixosConfigurations.test-morph-machine.config.system.build.toplevel
@@ -44,14 +43,18 @@
               {
                 environment.etc."install-closure".source = "${closureInfo}/store-paths";
                 system.extraDependencies = dependencies;
+
                 virtualisation.memorySize = 2048;
+                virtualisation.useNixStoreImage = true;
+                virtualisation.writableStore = true;
+
                 environment.systemPackages = [ self.packages.${pkgs.system}.clan-cli-full ];
               };
           };
           testScript = ''
             start_all()
             actual.fail("cat /etc/testfile")
-            actual.succeed("env CLAN_DIR=${self} clan machines morph test-morph-template --i-will-be-fired-for-using-this --debug --name test-morph-machine")
+            actual.succeed("env CLAN_DIR=${self.checks.x86_64-linux.clan-core-for-checks} clan machines morph test-morph-template --i-will-be-fired-for-using-this --debug --name test-morph-machine")
             assert actual.succeed("cat /etc/testfile") == "morphed"
           '';
         } { inherit pkgs self; };

checks/morph/template/configuration.nix

@@ -8,5 +8,8 @@
     (modulesPath + "/profiles/minimal.nix")
   ];
 
+  virtualisation.useNixStoreImage = true;
+  virtualisation.writableStore = true;
+
   clan.core.enableRecommendedDefaults = false;
 }

checks/mumble/default.nix

@@ -6,6 +6,8 @@
 }:
 clanLib.test.makeTestClan {
   inherit pkgs self;
+  # TODO: container driver does not support: sleep, wait_for_window, send_chars, wait_for_text
+  useContainers = false;
   nixosTest = (
     { lib, ... }:
     let

checks/postgresql/default.nix

@@ -1,4 +1,4 @@
-(import ../lib/container-test.nix) ({
+({
   name = "postgresql";
 
   nodes.machine =

checks/secrets/default.nix

@@ -1,4 +1,4 @@
-(import ../lib/test-base.nix) {
+{
   name = "secrets";
 
   nodes.machine =

checks/syncthing/default.nix

@@ -1,105 +1,83 @@
-(import ../lib/test-base.nix) (
-  # Using nixos-test, because our own test system doesn't support the necessary
-  # features for systemd.
-  { lib, ... }:
-  {
-    name = "syncthing";
+{
+  pkgs,
+  self,
+  clanLib,
+  ...
+}:
+clanLib.test.makeTestClan {
+  inherit pkgs self;
+  # TODO: container driver does not support wait_for_file() yet
+  useContainers = false;
+  nixosTest = (
+    { lib, ... }:
+    {
+      name = "syncthing";
 
-    nodes.introducer =
-      { self, ... }:
-      {
-        imports = [
-          self.clanModules.syncthing
-          self.nixosModules.clanCore
-          {
-            clan.core.settings.directory = ./.;
-            environment.etc = {
-              "syncthing.pam".source = ./introducer/introducer_test_cert;
-              "syncthing.key".source = ./introducer/introducer_test_key;
-              "syncthing.api".source = ./introducer/introducer_test_api;
+      clan = {
+        directory = ./.;
+        inventory = {
+          machines = lib.genAttrs [
+            "introducer"
+            "peer1"
+            "peer2"
+          ] (_: { });
+          services = {
+            syncthing.default = {
+              roles.peer.machines = [
+                "peer1"
+                "peer2"
+              ];
+              roles.introducer.machines = [ "introducer" ];
             };
-            clan.core.facts.services.syncthing.secret."syncthing.api".path = "/etc/syncthing.api";
-            services.syncthing.cert = "/etc/syncthing.pam";
-            services.syncthing.key = "/etc/syncthing.key";
-            # Doesn't test zerotier!
-            services.syncthing.openDefaultPorts = true;
-            services.syncthing.settings.folders = {
-              "Shared" = {
-                enable = true;
-                path = "~/Shared";
-                versioning = {
-                  type = "trashcan";
-                  params = {
-                    cleanoutDays = "30";
-                  };
-                };
+          };
+        };
+      };
+
+      nodes.introducer = {
+        # Doesn't test zerotier!
+        services.syncthing.openDefaultPorts = true;
+        services.syncthing.settings.folders = {
+          "Shared" = {
+            enable = true;
+            path = "~/Shared";
+            versioning = {
+              type = "trashcan";
+              params = {
+                cleanoutDays = "30";
               };
             };
-            clan.syncthing.autoAcceptDevices = true;
-            clan.syncthing.autoShares = [ "Shared" ];
-            # For faster Tests
-            systemd.timers.syncthing-auto-accept.timerConfig = {
-              OnActiveSec = 1;
-              OnUnitActiveSec = 1;
-            };
-          }
-        ];
+          };
+        };
+        clan.syncthing.autoAcceptDevices = true;
+        clan.syncthing.autoShares = [ "Shared" ];
+        # For faster Tests
+        systemd.timers.syncthing-auto-accept.timerConfig = {
+          OnActiveSec = 1;
+          OnUnitActiveSec = 1;
+        };
       };
-    nodes.peer1 =
-      { self, ... }:
-      {
-        imports = [
-          self.clanModules.syncthing
-          self.nixosModules.clanCore
-          {
-            clan.core.settings.directory = ./.;
-            clan.syncthing.introducer = lib.strings.removeSuffix "\n" (
-              builtins.readFile ./introducer/introducer_device_id
-            );
-            environment.etc = {
-              "syncthing.pam".source = ./peer_1/peer_1_test_cert;
-              "syncthing.key".source = ./peer_1/peer_1_test_key;
-            };
-            services.syncthing.openDefaultPorts = true;
-            services.syncthing.cert = "/etc/syncthing.pam";
-            services.syncthing.key = "/etc/syncthing.key";
-          }
-        ];
+      nodes.peer1 = {
+        services.syncthing.openDefaultPorts = true;
       };
-    nodes.peer2 =
-      { self, ... }:
-      {
-        imports = [
-          self.clanModules.syncthing
-          self.nixosModules.clanCore
-          {
-            clan.core.settings.directory = ./.;
-            clan.syncthing.introducer = lib.strings.removeSuffix "\n" (
-              builtins.readFile ./introducer/introducer_device_id
-            );
-            environment.etc = {
-              "syncthing.pam".source = ./peer_2/peer_2_test_cert;
-              "syncthing.key".source = ./peer_2/peer_2_test_key;
-            };
-            services.syncthing.openDefaultPorts = true;
-            services.syncthing.cert = "/etc/syncthing.pam";
-            services.syncthing.key = "/etc/syncthing.key";
-          }
-        ];
+      nodes.peer2 = {
+        services.syncthing.openDefaultPorts = true;
       };
-    testScript = ''
-      start_all()
-      introducer.wait_for_unit("syncthing")
-      peer1.wait_for_unit("syncthing")
-      peer2.wait_for_unit("syncthing")
-      peer1.wait_for_file("/home/user/Shared")
-      peer2.wait_for_file("/home/user/Shared")
-      introducer.shutdown()
-      peer1.execute("echo hello > /home/user/Shared/hello")
-      peer2.wait_for_file("/home/user/Shared/hello")
-      out = peer2.succeed("cat /home/user/Shared/hello")
-      print(out)
-      assert "hello" in out
-    '';
-  }
-)
+
+      testScript = ''
+        start_all()
+        introducer.wait_for_unit("syncthing")
+        peer1.wait_for_unit("syncthing")
+        peer2.wait_for_unit("syncthing")
+        peer1.execute("ls -la /var/lib/syncthing")
+        peer2.execute("ls -la /var/lib/syncthing")
+        peer1.wait_for_file("/var/lib/syncthing/Shared")
+        peer2.wait_for_file("/var/lib/syncthing/Shared")
+        introducer.shutdown()
+        peer1.execute("echo hello > /var/lib/syncthing/Shared/hello")
+        peer2.wait_for_file("/var/lib/syncthing/Shared/hello")
+        out = peer2.succeed("cat /var/lib/syncthing/Shared/hello")
+        assert "hello" in out
+      '';
+    }
+  );
+}

checks/syncthing/introducer/introducer_device_id

@@ -1 +0,0 @@
-RN4ZZIJ-5AOJVWT-JD5IAAZ-SWVDTHU-B4RWCXE-AEM3SRG-QBM2KC5-JTGUNQT

checks/syncthing/introducer/introducer_test_api

@@ -1 +0,0 @@
-fKwzSQK43LWMnjVK2TDjpTkziY364dvP

checks/syncthing/introducer/introducer_test_cert

@@ -1,14 +0,0 @@
------BEGIN CERTIFICATE-----
-MIICHDCCAaOgAwIBAgIJAJDWPRNYN7/7MAoGCCqGSM49BAMCMEoxEjAQBgNVBAoT
-CVN5bmN0aGluZzEgMB4GA1UECxMXQXV0b21hdGljYWxseSBHZW5lcmF0ZWQxEjAQ
-BgNVBAMTCXN5bmN0aGluZzAeFw0yMzEyMDUwMDAwMDBaFw00MzExMzAwMDAwMDBa
-MEoxEjAQBgNVBAoTCVN5bmN0aGluZzEgMB4GA1UECxMXQXV0b21hdGljYWxseSBH
-ZW5lcmF0ZWQxEjAQBgNVBAMTCXN5bmN0aGluZzB2MBAGByqGSM49AgEGBSuBBAAi
-A2IABEzIpSQGUVVlrSndNjiwkgZ045eH26agwT5RTN44bGRe8SJqBWC7HP3V7u1C
-6ZQZALSDoDUG5Oi89wGrFnxU48mYFSJFlZAVzyZoqfxVMof3vnk3uFDPo47HA4ex
-8fi6yaNVMFMwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr
-BgEFBQcDAjAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuCCXN5bmN0aGluZzAKBggq
-hkjOPQQDAgNnADBkAjB+d84wmaQuv3c94ctxV0sMh23xeTR1cPNcE8wbPQYxHmbO
-HbJ3IWo5HF3di63pVgECMBUfzpmFo8dshYR2/76Ovh573Svzk2+NKEMrqRyoNVFr
-JNQFhCtHbFT1rYfqYWgJBQ==
------END CERTIFICATE-----

checks/syncthing/introducer/introducer_test_key

@@ -1,6 +0,0 @@
------BEGIN EC PRIVATE KEY-----
-MIGkAgEBBDBvqJxL4s7JFy0y6Ulg7C9C0m3N9VZlW328uMJrwznGuCdRHa/VD4qY
-IcjtwJisdaqgBwYFK4EEACKhZANiAARMyKUkBlFVZa0p3TY4sJIGdOOXh9umoME+
-UUzeOGxkXvEiagVguxz91e7tQumUGQC0g6A1BuTovPcBqxZ8VOPJmBUiRZWQFc8m
-aKn8VTKH9755N7hQz6OOxwOHsfH4usk=
------END EC PRIVATE KEY-----

checks/syncthing/peer_1/peer_1_test_cert

@@ -1,14 +0,0 @@
------BEGIN CERTIFICATE-----
-MIICHTCCAaKgAwIBAgIIT2gZuvqVFP0wCgYIKoZIzj0EAwIwSjESMBAGA1UEChMJ
-U3luY3RoaW5nMSAwHgYDVQQLExdBdXRvbWF0aWNhbGx5IEdlbmVyYXRlZDESMBAG
-A1UEAxMJc3luY3RoaW5nMB4XDTIzMTIwNjAwMDAwMFoXDTQzMTIwMTAwMDAwMFow
-SjESMBAGA1UEChMJU3luY3RoaW5nMSAwHgYDVQQLExdBdXRvbWF0aWNhbGx5IEdl
-bmVyYXRlZDESMBAGA1UEAxMJc3luY3RoaW5nMHYwEAYHKoZIzj0CAQYFK4EEACID
-YgAEBAr1CsciwCa0vi7eC6xxuSGijY3txbjtsyFanec/fge4oJBD3rVpaLKFETb3
-TvHHsuvblzElcP483MEVq6FMUoxwuL9CzTtpJrRhtwSmAs8AHLFu8irVn8sZjgkL
-sXMho1UwUzAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
-AQUFBwMCMAwGA1UdEwEB/wQCMAAwFAYDVR0RBA0wC4IJc3luY3RoaW5nMAoGCCqG
-SM49BAMCA2kAMGYCMQDbrtLgfcyMMIkNQn+PJe9DHYAqj8C47LQcWuIY/nekhOu0
-aUfKctEAwyBtI60Y5zcCMQCEdgD/6CNBh7Qqq3z3CKPhlrpxHtCO5tNw17k0jfdH
-haCwJInHZvZgclHk4EtFpTw=
------END CERTIFICATE-----

checks/syncthing/peer_1/peer_1_test_key

@@ -1,6 +0,0 @@
------BEGIN EC PRIVATE KEY-----
-MIGkAgEBBDA14Nqo17Xs/xRLGH2KLuyzjKp4eW9iWFobVNM93RZZbECT++W3XcQc
-cEc5WVtiPmWgBwYFK4EEACKhZANiAAQECvUKxyLAJrS+Lt4LrHG5IaKNje3FuO2z
-IVqd5z9+B7igkEPetWlosoURNvdO8cey69uXMSVw/jzcwRWroUxSjHC4v0LNO2km
-tGG3BKYCzwAcsW7yKtWfyxmOCQuxcyE=
------END EC PRIVATE KEY-----

checks/syncthing/peer_2/peer_2_test_cert

@@ -1,14 +0,0 @@
------BEGIN CERTIFICATE-----
-MIICHjCCAaOgAwIBAgIJAKbMWefkf1rVMAoGCCqGSM49BAMCMEoxEjAQBgNVBAoT
-CVN5bmN0aGluZzEgMB4GA1UECxMXQXV0b21hdGljYWxseSBHZW5lcmF0ZWQxEjAQ
-BgNVBAMTCXN5bmN0aGluZzAeFw0yMzEyMDYwMDAwMDBaFw00MzEyMDEwMDAwMDBa
-MEoxEjAQBgNVBAoTCVN5bmN0aGluZzEgMB4GA1UECxMXQXV0b21hdGljYWxseSBH
-ZW5lcmF0ZWQxEjAQBgNVBAMTCXN5bmN0aGluZzB2MBAGByqGSM49AgEGBSuBBAAi
-A2IABFZTMt4RfsfBue0va7QuNdjfXMI4HfZzJCEcG+b9MtV7FlDmwMKX5fgGykD9
-FBbC7yiza3+xCobdMb5bakz1qYJ7nUFCv1mwSDo2eNM+/XE+rJmlre8NwkwGmvzl
-h1uhyqNVMFMwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr
-BgEFBQcDAjAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuCCXN5bmN0aGluZzAKBggq
-hkjOPQQDAgNpADBmAjEAwzhsroN6R4/quWeXj6dO5gt5CfSTLkLee6vrcuIP5i1U
-rZvJ3OKQVmmGG6IWYe7iAjEAyuq3X2wznaqiw2YK3IDI4qVeYWpCUap0fwRNq7/x
-4dC4k+BOzHcuJOwNBIY/bEuK
------END CERTIFICATE-----

checks/syncthing/peer_2/peer_2_test_key

@@ -1,6 +0,0 @@
------BEGIN EC PRIVATE KEY-----
-MIGkAgEBBDCXHGpvumKjjDRxB6SsjZOb7duw3w+rdlGQCJTIvRThLjD6zwjnyImi
-7c3PD5nWtLqgBwYFK4EEACKhZANiAARWUzLeEX7HwbntL2u0LjXY31zCOB32cyQh
-HBvm/TLVexZQ5sDCl+X4BspA/RQWwu8os2t/sQqG3TG+W2pM9amCe51BQr9ZsEg6
-NnjTPv1xPqyZpa3vDcJMBpr85Ydboco=
------END EC PRIVATE KEY-----

checks/syncthing/sops/machines/introducer/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1wjp0vvvy4d2c0pdrth0kl505rzpz37804swf6rrny9xa208mrg2s0r5m67",
+    "type": "age"
+  }
+]

checks/syncthing/sops/machines/peer1/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age14faw2l6rskw2gcv3rrkygmwmrp2ev9yclzq4fh8xf8sjeke8p97sw4dxuq",
+    "type": "age"
+  }
+]

checks/syncthing/sops/machines/peer2/key.json

@@ -0,0 +1,6 @@
+[
+  {
+    "publickey": "age1dutdww4x48f0e3tzmjlye9n852wx0qqhhcghsrefsq9m8c5flpfs2lxexf",
+    "type": "age"
+  }
+]

checks/syncthing/sops/secrets/introducer-age.key/secret

@@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:f/KzvxsoWQFTSB17lPhe/MThYu4ZjJwvkCxKp7XkLyspFF9Dal4A+H+SY6vPG7yM3+dlE3ZnxjniUeivydDTwwJiWJ6E6XIhnPI=,iv:xat6pYzYV8sfyMKX4OMsr6oSOEOc09DDXGykKKoP14Y=,tag:xMxsIpYv7KrSYvpmvBvSUw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArUGdWK1BnNjdCL1l1WlNB\nUEswYm1tYlIxWXltemdlQm1OcmlNbSsvTkdrClpRUjR6TUNUcGtxWWhGdDg5SG84\nSFFiV2p6ZHJwR1VKYW4vVFBHRGFSYTgKLS0tIERJa3hRM28ySHBUME4vTUE1UUFr\nQklDdTBWdWJpdGg0cnR1ZUNWREl6K1EKbRFOr3Rhb2aGnQUHiX+3DzGgrY9C2Dvz\nVlyZ0q6lWtn4qFWPVez03T8QAtLjv2UaGtYTFnyFIWiykhhrWy2PBg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-23T07:54:54Z",
+		"mac": "ENC[AES256_GCM,data:LJCCaGNhBgFAKtWYMD6OcXg2FMq1DYDOySIpEY91ILXDUuJSSsuYyQqE6ZvCoThlogHd9inAajsW0GbzYpSflu/WyrqlQsNJSMFkBFBQh/FIjd18GUtZ4flHWRfHqAk/xM/g+n7iOgKMvaBrG1MG1DplLRfk/8ehcqlWX4Wxof0=,iv:PrjIiUYkePPXBRGF/Wnqi1ZgA2j4YtzL/uMC5KchfIQ=,tag:yMMrJ7vGt6urz4WfRAyaNg==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}

checks/syncthing/sops/secrets/introducer-age.key/users/admin

@@ -0,0 +1 @@
+../../../users/admin

checks/syncthing/sops/secrets/peer1-age.key/secret

@@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:q6mWG65NflVEvX1QUyRVFuRGOVg9wtyWDYQ8Plqw038pEyOrsVcj6Cmo6SRaRcAaxQmAUeplzYfzm2MgXMz1l/DySErH+mCyVSk=,iv:7X4mFSJXpUii+sppSAq8H7vYWGoDq3LnFJMAAjhhm7U=,tag:ep9vzbkzVtC2A8otat8vSg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5bjNlZkppR01JT0F0TklO\nSnpIcFgwb0E5dStHQlZLdGNLQ3UxRDNBdEVVCnlpdWlPVVNIdFB3ZjlpSXZURjdS\nMVlCbFV5RXI0d2t5bHJvR3U5b2NDa2MKLS0tIDJLZlE0RjhNaGhBeFVsSE93Z0NX\nVVcyUjJPL1FVTEVOUktYTEMvVFNEdlUKYkmyVjcbAf5IVb/RWBfhbmoBbuz+u8X0\n3J8a/SJsgX3vLJIpVeSQSSFTNXu0+8/QeRiXsV7GCyHu+lwL75ycmA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-23T07:54:59Z",
+		"mac": "ENC[AES256_GCM,data:rhi/f3r81Cm+yXJXpnPmyK7jNqJ1Pg4tU7gsOwjCv5CeJn8U6N78ZBiHndjdwzqSdp7+qwx/9gPpLQVoPzO2IhY+uRhg0l6v6N9iK9UD6tjNzsCw8zTIb/ehObRqqpzVn2BGkUte+g0Hu2/bpHFbq6qmGm8YOYnD8K7U2FoiuGQ=,iv:o7RaD5oogpjSgdfFPqb8Tfgn43ydSzA0ZTP2ayNZI9c=,tag:e/zmTPAIWX1uDQxLNznIWQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}

checks/syncthing/sops/secrets/peer1-age.key/users/admin

@@ -0,0 +1 @@
+../../../users/admin

checks/syncthing/sops/secrets/peer2-age.key/secret

@@ -0,0 +1,15 @@
+{
+	"data": "ENC[AES256_GCM,data:2EaSVKRIMKVF9+qAozKl703entUWB04J61UM1QRj1omKUb5sDaOwnQKCZDZxO/CCtam/kz1jHoxCeFiJFcx+DpTyYptpSpYq1dI=,iv:syZ2HKRxQ73urS4Vwz7/3IMBYY6nk78zaooPMDkU1w4=,tag:uGaqxbU6/9DvkGY1Jq/XRw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUMnJrb2VHYVdMRHJhYjFH\nL25nN2RIZ3pVeDdYTllrUkF0TkREYmNMMVdrCkNSaGlRd3c3YXZPZmIxWExCaytu\nU3FGTmhUZ0pUUjJJNS9vcVBISmFyZHcKLS0tIHMwaFlEYkFFb2RwS3JDb2VxRFcw\nZmd6S3RXVGcwbmtHVVRmWXkwSnF1RkkKTbg6igFHIakR8EAPuf+x9yhmQHF3TPp/\nC+B1FuorpovudtxmJ1UzBmkE0r13cY6iu9Vdjh1g7tBcXUWoHZsvIA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-23T07:55:03Z",
+		"mac": "ENC[AES256_GCM,data:HuQQvWOGIjISxnNShYHLj4QinNoeOTwxpJK35swpcBnJ4JtDnA6F2JjpJI8DXIwO42eDbXIF22lJjqynRFRo6kQrrD8uhBHEFD2R+6U7zFxJ4gknWR1iF3fbM1+2VDiu8L9InpZcfb6Z8tpKPdPiYS3NGdoAJ0ClSw+8WlVsS5E=,iv:pJxsCP5Y6NTNAck0mphbLRnZ48sRRZ/YaYUobi6mGYU=,tag:ewR5QLBh3WRLkHlSGH5MsQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}

checks/syncthing/sops/secrets/peer2-age.key/users/admin

@@ -0,0 +1 @@
+../../../users/admin

checks/syncthing/sops/users/admin/key.json

@@ -0,0 +1,4 @@
+{
+  "publickey": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+  "type": "age"
+}

checks/syncthing/vars/per-machine/introducer/syncthing/apikey/machines/introducer

@@ -0,0 +1 @@
+../../../../../../sops/machines/introducer

checks/syncthing/vars/per-machine/introducer/syncthing/apikey/secret

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:UVv08bXHtWMWcMC7tBb+xy7+3JRiOfVpRPD/q/TR1/+5,iv:ZNb3GDvtuZFbXlcJyN/kzy8cRppRqWnN308mAAkOc/4=,tag:Jv5MsPQ+gTBROzG6oo0ztg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBha2t2enBPWUhHcXIveGJJ\nZklLeVNkNkhkcXFLczJjeHdFT2haSGF6UnhNCjh1MHJobSs4dmVKTVdzL1JRTXJK\nUlo2MzFOelV5UVNqVjladStHdUlqSGcKLS0tIGlqa1RZVHpva2ZmNnpSRjhseGUw\na0hmSER6VlZsZ1A2TE84OTVyQVVTRDgKoE3UzWOqYhV9Y/vayIGY6ak4MEPR+q5t\n5NY6VDkCwYiactvcSo36jiaru47jRr6ovk5Vfkq/jFO2njDND5mLqQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1wjp0vvvy4d2c0pdrth0kl505rzpz37804swf6rrny9xa208mrg2s0r5m67",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZGZUVmVBOENtZTJmRTQz\ndUpzYXBwb1NUWmhPU1g0VWFkWUp3Y2JGQ0JVCjZPS1lxL3N0YlU5T2owSS9FSC9L\naWtScmdyclhqcTE3blFEZHRNRHhjOXMKLS0tIGR2MnhRdUpHZ2tqTzVLWFo0WVhm\neXlpWUdwc3ZHOGRXWTNlZC9UMHd2M3cKgabJLSO2rT1u+I4V/XdCt8iDXuFQw+2w\nwr2juhtq3IwBuO6VqQKwAy6hHNbEWa+e/6bPaoXiJAOdA6+LbzfSmg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-23T07:54:56Z",
+		"mac": "ENC[AES256_GCM,data:ajkYjU6vAqrNiknSLZOYgFYiL7A6/ut+m3bt/x22Ms7LGZv5BgsTtLDw70gbAQh9fMbQCxCngkUrHk6bvVe9afpNvdw3fPQ9hfMkXquvDjhGHMvr3bmawsBJrShuywYRZY2z++f6FA0ApGVkSG1tSFDt/Tob1wkhxbPonGnsliQ=,iv:6H2X+4RkW48+w1dHWxa4nogKbHHriGyvAOr9ODf7m68=,tag:RWv+zSyqfaKcLAjxFHhqXw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}

checks/syncthing/vars/per-machine/introducer/syncthing/apikey/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

checks/syncthing/vars/per-machine/introducer/syncthing/cert/machines/introducer

@@ -0,0 +1 @@
+../../../../../../sops/machines/introducer

checks/syncthing/vars/per-machine/introducer/syncthing/cert/secret

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:DdiIZhVVosBWWyQu52g9bZm4PHlYalIeNQZtiqzN6p0Q3GcIPZkrA7EUtiI/jLOY9ILRKX3yreJWlDQHiEdfjQhqR1Oneb3JVv41GASEIumhuxPU4VQyIMV3u5MNO7H+NkzsBx8JHvm0MOIar76B4Bc+7ZoaahHacNzog+rGxUplecoY8A22Cr9G71OFj4JPQJTK40DhdSxdmSaiI3FzqxyuzbYfMViVqm6X3hX/CUv5nxlNeFUw5ZKruOTq4sjgiy859dOTiTG1L4X5T2G9UNevg5eRAqGdmjB/DB8is8yMUXYloD5TSvoDXCS8rAB7DgrtcF91nv9Wxq5aYGv6ovHpG7sL/aOY507PyaWtItir1+Gy9M8ECQq50wgj308KEMSbllFIhiHaHklpqTZdJejIzVB5nxbMIrcF2537Nfw3T2awveBk7ZjuYFQ3lIZVWNe9mbVubH1JLZS6x/Fm+rY85KnT3hZHCRLuUTvb5b3My73UMmWmAN3DekSr/m7z51cxtvJQJrM9GV6Lv4PAbgzvz8BvWps/9pIQlqVPYk8fRBvKqIAtbM7V6nIH1Fx8hmoMYM+c2CIHhMKxh1b+SGTk3BYXRuF/MX/btAt0kwUh+qPQJEd+i+9qFCS2I26BzoFsjm4M9e5tp1tx0KazrsIrWRAi6faGI+i48VpYxP60BQdK0YZTczTVLw4nIZGWJ1m0cHzeViR/P3mvP0tROo4GyAloUP3QWAwC88I2btHmC008Ldg7XRmOrPtwMuj1Z38Sj1mlRSu3+5hYS7T9wbOg3J/S9o3xbGDzJFAVU5YouAhU3qWwKvmrTKn6WRPyGFafcbBxzoNyOwK1U8MtrvDEUyoevN9kP/nGbD7sfyJpStN5zrn/9NxANVAAWjje1vWVmjFlTdip9USRzmrSIbPb4PwgXjJJObF6VWXF9RTdlZNq486BTC2eE4XQ3stOJ6UJmRwsowU3TuI8xb9wNXZBFmwfkrNhvgOrpf6LTc6ouL5QfSgcj6Gg/mXvE24Y4yhRZA4lnDqbuyl7lIyzTyfiwSEmDbJTVkc=,iv:Sby7ZpP5/ThihlnmxBX485/dtdxHQBPEoHPhbRVc7hk=,tag:9azO7wAzCSkYj/Awv6X+7Q==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBreW1Cd3NQWE13NUJHR2Ur\nSmdWK3hvVHpNMzZ1cGxHbEdHd2FETm1tSkZBCkhNMHdReGRpZmVJVUJ6aDY4MW1G\nOFhHRVhpUE1FWThwZ1BDZFJxRnZqYzAKLS0tIDd6QTROa2JYLzd4RmtDODJhM2hJ\nU1NwSTE3TVQ5WEdGVzB5YVdYWWNPazQKot8O9EYCfw4r59Fn/9lYZ0xYd7SUo9lJ\nEsus6BeNg2VLFa5V5q3hlVgRHUgNM4LMqIhdDf9mkxULKt1ilmoB6A==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1wjp0vvvy4d2c0pdrth0kl505rzpz37804swf6rrny9xa208mrg2s0r5m67",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1Q213dEI0d2FMUDB2Z2F3\nOVp6anVnVVZSNTdGMktnL2Z1c3JxNEt6ZUhZCnhrRUFrcnRpRVJXbmNjSWJRQ2hO\nVnlCRVdCRUZidUwwNDQyc1UwemRWbkkKLS0tIER1WWhNNERtaEZ1NVZNOXZoczZN\nZHd3U3UrOC9PZWhPMTBCVG03ZVdRdW8KY3bksqIx78GETGEg8q63HvEp+b8GnLFM\nqE7hiC9sNN8THvXV5rZeJdIPYZ6Kan2Q09GxRzDEJBavK3ZK0DKblA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-23T07:54:57Z",
+		"mac": "ENC[AES256_GCM,data:SckFGU9nPJi6t3bJdRqE49i7tqzcJQB4+ZZzuzSUTnPJV+Bn+/nr6zqbf40jG4qWPPV1PJsiXoJrTOQZ5O/skLg4++c4op5U+brRZqggeJepHVdHpxe7ldVak64Of7gMJ9S5fsynyRa+96kxf/qN2qZ1f63sk0u9bImPovYOJKA=,iv:EWWRbnySYk07m8oAio71VftGhRUJWiXYKJxsnErx2ng=,tag:MS7JFdlny6OA+MjCCz3kHA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}

checks/syncthing/vars/per-machine/introducer/syncthing/cert/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

checks/syncthing/vars/per-machine/introducer/syncthing/id/value

@@ -0,0 +1 @@
+Y45RCSC-Y2OENC7-OI2NQ6Y-VUU6W7X-TQDROMD-JZNYC3B-BZJA2TI-7IMW4Q4

checks/syncthing/vars/per-machine/introducer/syncthing/key/machines/introducer

@@ -0,0 +1 @@
+../../../../../../sops/machines/introducer

checks/syncthing/vars/per-machine/introducer/syncthing/key/secret

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:DkRR6AfyQJh0rnuzIO9gOs+xSmtncpo4zQOOLMeyfRcMRYYMnfzFIDYrOg4AYEmyd/KDfX8O7r/9dfrg4t4VJIFtA78h7hVA3KFpVhyA55AMfiWKJUQZhTvZG2eRP89+S0tChu6spgTXFDXIwCXa8EwzUc5Cqd/3UHs1DFdsuwWpmcbbXY1P3k4iaSpvQse/7BC0TNn2bg2ZPd4i9ovdY9kyMyOT9/54JRr21PeJ2SJYzLEMhzc+VirU4xIWdRMvK+LJRPWQEhvDGUjxAE5B90rHYmAi8eAaEEB52wpQBthJKUdBoZHlZ/DUbk9CVF2UF4B1rBLOtnt+pN9EfBFqrq0my/6bElEQV3P5UcdC7Z/sOjWVQvjBkHc9wkJp0g6e,iv:T0qYtoUeX7FZA8omE4heI6Beeh4gmbYoJ4Ww+6ix5AY=,tag:0FpsipDR1pfQA2/Z+4ogQQ==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWam5QUlF2K2ZQa3RjYkxt\nZXBmbmhKcC9HeklPL2c3UFRsUGhxL212T25rCmpCYzF4MFd3REk5cWtsSSt4ZFlK\nMzlLUUg3M1J4am1ZSVg0ait3eHFtVjgKLS0tIGpzYXJzWXJ4emhIOS9oL1E1SVBR\nRXZSZlVtMENGR2RNRzRMcGxCZW8xS1UK1BuhZV2eVb545eTg7I+wk5Dth6ZUwb9R\n5KkJ8oNSahtk9J27ZmJNIuof+fEj9yNueKHbvkDGo5rUoeH9u/awsw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1wjp0vvvy4d2c0pdrth0kl505rzpz37804swf6rrny9xa208mrg2s0r5m67",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0c1FmdlRUSXBsaDcvMmlj\nUVovdlRoMzAxeGh1blh1OU1JWTh0OElhZkFZClpyZ0JpcGVFbHRJdHhqNDRnaHhY\nQVVSS3NwcXZWMm83R1BPOTAySmF6QTgKLS0tIDd1OE5VYm5qWUZtd2VvYmdob2lG\nODlpUDAzdENDT1Nvdlo2bnVHRjVRSzQKFiKoA9JY6vY6+StLnLq3Fx0SmCRDro6+\nTLy2MmJM2VjdixMBvSDJATIXdf2T5lRFqGeJIlmLftzwCSJNmar+qg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-23T07:54:57Z",
+		"mac": "ENC[AES256_GCM,data:xZlGmeBeMrM4bCYU0j/1rz/lh33Zm3SUKJCSHWQ9rkVzBqD6Zxok+8OLYPIXKmEUQLuD6A3Jj8BIELm7poC0ycDqTCHRP6crPR3TZ9Ha/8ws5yjpbvQA5lvYcF+GindIhTHifo0LlkXsr0Yr3ViErvHHwLifmB2RBYw++gUhxHY=,iv:DT0GgfCrKpVLaBtljUMzSMZ0vP8o24VIiUfp0etNn9Q=,tag:+4kYXei4E1AMpNAusQKcVg==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}

checks/syncthing/vars/per-machine/introducer/syncthing/key/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

checks/syncthing/vars/per-machine/peer1/syncthing/apikey/machines/peer1

@@ -0,0 +1 @@
+../../../../../../sops/machines/peer1

checks/syncthing/vars/per-machine/peer1/syncthing/apikey/secret

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:j/cBGXgSdfB1NOuNdj6w8rdF5dVQ6ngu/pIDys7NIwoX,iv:9G2mTyHNtryKqR0hk8sceaYvQMvIMeprH2M34RphhuY=,tag:8eSMKD5PVwGB+rPS7/XBng==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age14faw2l6rskw2gcv3rrkygmwmrp2ev9yclzq4fh8xf8sjeke8p97sw4dxuq",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4NVlLSjEyZGFoRXVkR2ZE\nSE9NeXV2V3ZDVXF0RVBUamxWdzNIL2ZYdXhjCisyVWxLak54TS9wVU1VUzVjQVEw\nZlZUaXFqSEdFd3BuMmZzNllKSkxxT28KLS0tIHNqai9wYm5oUHdjbElmRlZrRVg1\nK3BSeG9rTGJyQUpKZU95cjNQakRKajQKUBXxIEwTiz5grVKfbWlJnCC9OiHhDFCi\nG5gNsUHcj74tTWSM+nIAzjRsRWXHpz7kWk/05EQ4W0auOhQ2FaHSTw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxSkwrclJrRUVqYjZXZ2ZR\naDBMKzdocjBJNlN2U3A3T09jUmNkVDk1aDJNCkQyQVU2RWpGYzJqdVBKdVRCUHdZ\ndENMbGl2VjNCQXE5Q1lBMEVHYVp3UWsKLS0tICtaZFZGRmxpMTdodGd1a2dEMDYr\nNUowMy9MNTQ1bzVxTlJ2bDdmWjJSREUKJUZ8lQ45pQBXrOfeW25v84ywXN52Og1F\nkmtXkBNAOTr5OkJVZbUXa1lQ0CahLluleVufX0wJIyCpBfhmnjHYFQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-23T07:55:01Z",
+		"mac": "ENC[AES256_GCM,data:kUDSBhylpGSwaHDw6HK62UgtIAmG6gnAnoooFTBC5XLS/FX1KhWIg+8fmJK8mHbPVGE/Ju7Qa8cxAEEIWa12xoVlsu6UlaHOIwiOTab6gHnxAA/WL+vYjf5H4IVzh6uOJwGIl+Wc//Yovlifs5Kg2ftkiU7rlrm5aMN6GkVGS70=,iv:hRtDatGis5VgWZcyzky5MZADba4ApZhclOxjQNgDXiI=,tag:iHcjmXiHoOHTJ88kFwezdg==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}

checks/syncthing/vars/per-machine/peer1/syncthing/apikey/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

checks/syncthing/vars/per-machine/peer1/syncthing/cert/machines/peer1

@@ -0,0 +1 @@
+../../../../../../sops/machines/peer1

checks/syncthing/vars/per-machine/peer1/syncthing/cert/secret

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:PWIDQ2EF758/YMlZ6LKB7ofyCKQJuAi0ksg70oB+Km0O5JLJ1O4nz0gpf4dk3qoHRyoyEHH2UvMHD9c7Wuxvy/2YNsIkocpDKiNLUBymYlbqA8TAbg5aZU6q5P7KT5kEujFHZlRxeDoYVgV+wtSs19nGnuZmkkqqkJ/cLWEau42YNTZ+Zu+qnahVI42eGxDK3Hz4Gynm0t5xXCHf3IQI/6eXbDxOdcTepx4hkYnE6zWIsJdS+yK+aw9dtz1NJlpaPTV9OACFZXqlEtP7H3d9XVVyGd8Gx1FbjcJZosMBEB9fG+bmxFm20gBksB1oGBaKh5sOB8OGhZEvxGqFjsJXYt1WPbm/POIvu9oDaWwAz3q9QRC60IbRSogiKLnGkeavnKqC5qYEFTcFr+9JbM9g6+pyI7PosKt5GACpqFODPx/U8iu3ooxseeI7ncDuiNbmWrDAhBcELmclWrRN879nDlfAw+Ct9EIVmP97oFYVAM6fvbxzhQ0uFe9Xrh+G0gsKnfc+XYiEhG35Ge//PdXUI1HDIaGEqcEMpH4dqzbYqkx9CKZ5+fhIcL8R0WBr4I2MI80gvD2ga9k6jpnhnlu6izAajEMNcOjCXrwc47dh5ytRi949gg/HLu38NUU8cG5JtnNP2qqHmn/hFVtTDWL7BDGGAIopC1vyJCjHY1s6pedoJkfFOEPJoKBl1bU8WCbz68GkQ5f0LrFK4026iiI0ExKXP8BApbBEU+UROqzEPcvcC24+5wUbWCnBO0O4S1k7Z4rZdfUVe9XqN2qTLFUgyaEUAnov48aB09+wsnol4xxbkkD3eihpihG58yzwBrPIhsttApOcEhMwjMwrXvbrDcV1wedglZdDCjTa7z0lPwxHaAIf4obYyddlZ36whBU8fsJEoLD2dzTzXFEmGPUKPFwtocJ4IJbNYvNBBmjeH2Eh+wcZyO0dpEuQdMY1zWeYMGWbHSuQC0LdfSvx+hCmsr2rfu8ISVqAgI7YgJc5rNro+poMl5kLpwbSFwH0TdXUJfeRuGFzi7iDgLduf5ZuUMUDsPbw7w==,iv:d6QjUKGw6zfp0Me1YjzkcEtR2fgXuKMjISB4LTbkHI0=,tag:AVyZuNbT81ER6e5/eq9WMg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age14faw2l6rskw2gcv3rrkygmwmrp2ev9yclzq4fh8xf8sjeke8p97sw4dxuq",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVSGxaVXN3LzFQaUFnN2Fk\nUStGY1J0a2YydFNVOXZBbjBxMmpLOUdSVVM0Ck5NWTVjNkZTSEVHT3N1UzltVDhN\ndnM3czdvV1pTVG5OV0QwN1hjRC9FYjAKLS0tIFRpS25rL0NEMGJKUHhrOG1TQVNS\nODkybmFPMnBwT3J2T2N5eUdnWlNuWk0K77EWBMrWSRcOgJz2VMTWG8b2VF3hsnfN\nlB24D6g6X+NyYqA5sr6tt2CokSelHvDmdQPp+9ctFUd8MZZOG80odg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3TTlVS0R3K0N5QlRmOXlz\nU0JFVmx5VktaYlhKTnNYRkp4YmVHa00xbkc0ClZVQ0ozQXhNRlNvbHJ3M3VpdUFy\nK01kV1hJeG1iSVZDUTFGUVlZdHF2VjgKLS0tIFRLcldTdWpmS2RFM3lkcUlIbWg4\nelNxYlowWlRQbmhlUFRON0lOTG5FdFkKFPvYOu22il6Sq2YSHmV1p5ffOafiUQVz\n19YU773ENRNtodhqigpyJJYsC53gI4lbQC70taJciICdcmdFo/OdSA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-23T07:55:01Z",
+		"mac": "ENC[AES256_GCM,data:+jHseVVdCG1Y/0D9hnO8DP7mZIV60nG1AHw11R+pGy7EHhKfLlHT7/MwCRSCbP2hwekUtfrOsuRxSCnckv29h+BMGSi3NZNPXY04tScvEmMECXia7UQWE2o0gQHHLEfSVoWYJ2dcC60cQlpXYocNY47pFx0eq0Q/u6F0SOZwEjU=,iv:GNFszYeZUVdnonQgyVNp5RPofInAOFwyk1wi506wdrI=,tag:Ix0/OieMU7KNwx6y7i8LyQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}

checks/syncthing/vars/per-machine/peer1/syncthing/cert/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

checks/syncthing/vars/per-machine/peer1/syncthing/id/value

@@ -0,0 +1 @@
+BZMMAO2-WNUTFFN-GMRL6TM-QZX57TS-Q3NXHVU-V3VPNGX-QHQMBIX-LWQUQQA

checks/syncthing/vars/per-machine/peer1/syncthing/key/machines/peer1

@@ -0,0 +1 @@
+../../../../../../sops/machines/peer1

checks/syncthing/vars/per-machine/peer1/syncthing/key/secret

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:e9zI2AphJlfeoK08uohWw+uQKdBBitrMnJCEwE5EPxD6w1qq/yoR5d94fwmEW+PzMRC+eg838I0sACEWJ0XIBb6uOECbKbhgqfqKi67GwXaobtjfQMpYe2xZvODb0LWQdZ33hJ1h23mGnbNlsafVMFySi0ydeul7rCLdNULhIBR6ph+JQHCsOO0G9BVZWSjKc1P/ItcoapMHhS0KzEhY87E6p6jkZFKrVi+bz9e1rF9uSemPF3kE/MAz3PBaqp2JbSrYHUgvDIFuQVt1AK+47rnB3Lmvk2iBD5aYXn+q6ZMRA7M5pYDxTglTlOpALikbjuUmiRZpMuJR+vCsmIEfO/MtoTah2Rawvbyn+80J/iD0C10xF4XvTgv+CAYtJhiw,iv:FZywq4cjxcMpWOYZyBKVCXHPWUNRAp01ufx3LIexfGw=,tag:Rc2iAT6CdP3UYvHf5nvDgw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age14faw2l6rskw2gcv3rrkygmwmrp2ev9yclzq4fh8xf8sjeke8p97sw4dxuq",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOUmNuaWlsZXMwWE9OTVZz\nVWR3MGE0TnN4eW94TzA3a3RHK000Yy9XS1MwCm8rN2xSWTFRSG02c285UUVLTFM5\nNHN0Lyt2T1c1K0tqZEdkd0VCYTVMSHMKLS0tIHpOY1hKS2xwazd3bmJIZWZvc1h6\nR2VocjBudk10bm5JVDIydVpiTnFBcnMKS5Ip6wMtZ0lfyGXLE0CJsgY6JYATPId7\nKQB3iY4YcDnW4Kz3Y8mouJcS3wGpu5l5CvBBpjbP3uUQRD1r6ex2HA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaL1QvcXh3UzZVcFkzK1Zu\ncGtkNlptWlJSZlhxSjNzUzZlM2pzUGFYRFNRCm9xdU9HZ29oT2NNM0lkTVFrWjY1\nbFNPU3BsUWVDbW9EcWlLM3NzbTNTanMKLS0tIEtJQmdwNnBXa1lveEovOC9jRkZs\nbkxOL1dkdGpCQkkvMTNrQ2FZWDF2TTAKptb/vJ5kzpULSm8LeAJqqR5Tks33Vf52\nJaVEMSbHJxcIWWR1Sf954pOOgoOyVpB3BB/DFOAf6VOeVt8RBalvBw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-23T07:55:01Z",
+		"mac": "ENC[AES256_GCM,data:WuvkahW8Nm091/eyitO/fmUJE0c8V2G2LAkfr0QdoLqppevEjV+YGNmtqtkVYFnxoQYhzysjVT54eVHVWoeZV7yUg2P9gwMIShT+skayJfXvZfJyvEaNkHWloWeGOLn5gv93P908srTKhHeufsnfGl/hkd+TuNwzzE2mS7k2gMs=,iv:9CPjqSABHJY/sXhzU3AVvtWW5tLMHDqjAV0/Hu9/Jsc=,tag:FYMbuN/BoSowzuoyoFlYxw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}

checks/syncthing/vars/per-machine/peer1/syncthing/key/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

checks/syncthing/vars/per-machine/peer2/syncthing/apikey/machines/peer2

@@ -0,0 +1 @@
+../../../../../../sops/machines/peer2

checks/syncthing/vars/per-machine/peer2/syncthing/apikey/secret

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:4KwVxOYKVLymyDXQ9GswpxJi6Fi5BCDJzMj4d/02nNa4,iv:9uGX3BRswPRlgPpPjdodzfwjbj7vmTqTcDNClKdGGlw=,tag:jLkefKqBfdRVy+qV073Ksg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1dutdww4x48f0e3tzmjlye9n852wx0qqhhcghsrefsq9m8c5flpfs2lxexf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTWmdQb1VNRUM4NHViYzRU\nOEkzdnhneFBQaGJ5ek1NTUxYcG5YdDhUQWhvCm1RTVc1aFRkczBYLzVZTUdhbjBz\nWXJqTDUyUXRmQVJ1R1p6cC9wSTNVbUkKLS0tIEgwSTVhMTFsdzRHdW9QcVRlZ3l3\nd2xrQkYzVFBTYldlZGtwakFnUHF2WmMKJa1A6a7umGgaFHSq8JqdwUQ6oBu65r1E\nCHSdEt7vviRXS6TRhdMdH0OiKQPTpHdspz6NRwn9KjMbrANq9Cxl6g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsSnMxNHBJNXVyd0RKTFYw\nUW5VMGJFdDI4dTNDTTNKL0xOZ1dvQTlGN2hNCkFPbGRhc0pEUGNlN2NManV0MHRV\nOXZtTGQwbWo3cWN5d0kxd3UwcHh2NlUKLS0tIGs3NERZRTRvc0h5T0h0SFV0VzBv\nL0hCVXE1TmFKV25lWHZvOGQ5YzM0ek0K19o2HCcCHlI55kQ1khuyXMnYGf7X5YI8\nsOgm6sM//6qB2I1DC/IwrHT5+yq/3CkqKcHYfinr3ClaKNDLV4hpAw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-23T07:55:05Z",
+		"mac": "ENC[AES256_GCM,data:5S1c4kdweAoikTnowDMWYXbSOS4v97CVMTeq+OFb78FHDKVwlnk1mT43cOLVyF02i589Lxf1rMXl7T9mXyYpY6fTvWKpRBewryS58eUaI01K8NFtS/+aqdgtXoqx5jO4BHrITTlJUjQh0PfXf5Lv7cZBPiNZnu9lfwrxsNbRRPE=,iv:NQeuNVZaVjBOGydA3aCPWHTX7rlG2/I4+YhOTli+nIE=,tag:wzuOuMECuitwewGArGZMeA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}

checks/syncthing/vars/per-machine/peer2/syncthing/apikey/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

checks/syncthing/vars/per-machine/peer2/syncthing/cert/machines/peer2

@@ -0,0 +1 @@
+../../../../../../sops/machines/peer2

checks/syncthing/vars/per-machine/peer2/syncthing/cert/secret

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:BEFeUE9tN3sjDQmLICGXziA5VPDfHNyjHaMmQlcjJj/AUmhMPOdBUAo28rPPXE+ici0vPLZmXVEcgd4ad02YpBfd1EfUMZW9vz10sv51I7ac/ClFfmbRU1q1CNDiIAHJUErDbCTghnpJMNAiz3CDg409uF8LJ/UmDo73uN8O6UVYI+jB1nxbUD8zPKpQnydRSf6MIrUSluZ3ckDNuoBe2ZcHrvBpbnzhEYHEnEwoM9C9uQQCWtEOjyrahWKr+7wCd7kgVhQfPJLeiSZDgmnnLw0q61dPWNrTyRa48DX5wMgKOOYUM0fMtPI2HGOEqTcel/smNR/4uHVyjsQBuwK/mSdwmfKxVACu6Hxb9is+qkK7pQuPYYLyyubn/nbIhflOLlH5CxbVj/4LK1wDfMbrCOueVq5Fshsj51AgNipi0b+srlDeVnWuQ1BWoCHQ4YTMdIUB5PMYPLCONWlbsb9OQoaAnD03JA3ucCUvpEEtVkqxXMVh+5VjzPX+VoenyVP6O1amiwO1FKIGh0sRd8OJRTD4ait885T4xx2e/Evi9gxZpirFmmn8enZ+oi+zL7YFLRBp+GVso/TRHHEesCHLmsqCaclt6i6BQCK4z2lLd1bXu5ATtx27ka54qdD7sTf1XhcU8Za0d+wmDNzwOCiuMMir37XDWFnR6HP1MS9cgCAVMCxmP4ETZa3FXlA0muwSWOifMlk5OZBoorMNAq543Cmffteh883NRkHUF/SAfr7hVCzUfPsDC3px7MvgqiNaUAi+bvjxlTU1NBZOMvTYtkBcpXzSyjuQ2pVGVEUKNxG8w4QS+5UoUtBBvGCF61D7iWIEHvTfJ8U6agWpcJLSMTAhNjQ8WAbYm3zMbv0J4r4qDvqe8Jn6+3lzZ5EYk4dUvd/6r/pzVJhhhzgEuGn6hfcJusb9xV92hTAVqkLocrwGzvDJ1R/kNx3shm+8H0VRiigrANoRpiTGNPF66qUynkaGU/S6K4Oo2fjCeOrpkO/XwhWsK6ZQ/24a10pO+diBLsGGoW7boqC3ff6sSxhO+Dpl4IEV9Q==,iv:Pc8ZfMZ1ZW94tRkQeVs4VZUfeXUj3WG1h4+mFW7Zafc=,tag:Q2SzduFZATYjEZJeurUMfw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1dutdww4x48f0e3tzmjlye9n852wx0qqhhcghsrefsq9m8c5flpfs2lxexf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwUDBxUm4yUXgybmdzZHBV\nZVJXcFNuN3FENU91Y2U3bDEwN2t2ZmlCQW5rCjdta1FvWWgwb042alUybVZ4WVB1\naGIrdUR3aDNmazZSd3YwSTNxb3d6b2cKLS0tIEc3dHhuRW5SaWI1YUhHQnpSR3Vr\nQ1paemJKWld6SENUbmQ3dHFmNnNoZkEKBAO21R4igmxdkZWg64tNj/wVQql4zDI/\nM6Huuoy0KqaMNGnQZyYpHOoXaA0V2Z3wRIiqBpYmpF9yPX41TWDqAw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKamJ5TDNlUHBUSm1aOW1z\nMjNEODZJWk42NlJFTW1Zdk1XWnFMU2NuZndFClJpZGVwdWtFRWgrU1EwMndxRTZK\nR0UvNzJwckZMMzdaNDBwMWZKeGppUm8KLS0tIGxsbVhqcGpZRlNGRE5JWXo4MXYy\nZGlzcVFlNHUxRmEvRkNPU3dGWlJxVXcKO/qq4BD40ctBTLKbTUb5elD/QOlFfeSL\n1a9ioyiNVehXsOWmgjg2x6POfY/1FTqB3x6PG7CxdSw5Qg31d4qcWw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-23T07:55:05Z",
+		"mac": "ENC[AES256_GCM,data:JW1ACIn9FnOYm0a18UanYeXgdoyuGXaBzvGMBdSTUBJAF/soeN/DP41mpyzWl9JknzId+R6qooSJ3Zs9asekeUc+9ehc2ra9KdKDNEliwB1Hi5GswIYo1fYRdRrPPBV0EnWg3lLT9Sa3vDDDKQJiMUA30jnGIkN4rNOA4xD4KeE=,iv:Eyvx/ZkqM63jaamPRk5rjjeWQsA3c0rmB2Xhl28HAYc=,tag:KTzwnPsVw9uTYQU2al5mhw==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}

checks/syncthing/vars/per-machine/peer2/syncthing/cert/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

checks/syncthing/vars/per-machine/peer2/syncthing/id/value

@@ -0,0 +1 @@
+TB7HCPA-CIEXTMA-KXMBEL3-V2UIPND-C2VBRVP-BJTYZP3-G62QKYA-HFF2CQ4

checks/syncthing/vars/per-machine/peer2/syncthing/key/machines/peer2

@@ -0,0 +1 @@
+../../../../../../sops/machines/peer2

checks/syncthing/vars/per-machine/peer2/syncthing/key/secret

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:H4xEba34JvUXuHAIxXapjcBgtScEBn++uzXqKKeCttTgHbMTHuFczAHRbNraPn6qMJj8dkgPgHuAf2xbwnIxoabnFK9C34f84DyN0QdiIUSi7WweWLK6u6HtfaL4w1yoQSwlnv3t/wYPFObMmbEivfPi7zR1ojdoZhKflCBg8piUWzh915PDiZzJ/jrdsQs1gzPD05JWPm759TgQb7vRsueXl+Cvl/sTpSQsR4TyOzJ4UveJnpGskpJiKHODkUcON5l7Dp1PJWum2Vy86bIYdsIKtm2JWysPxIbGhXHCGhrgbg5IbtTzc/XAd4P8OD2cRWeVO9zho5mUzSrHhMwdI33vmw3CvT4eLsE4i9a3NioiZP+skUm9+DIWISlaV7NS,iv:2/XetmHh4rKd3P4wjMPvmSId08u+C34g/Bo7H12G890=,tag:x9r6j87FGYex16eGhgwXVA==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1dutdww4x48f0e3tzmjlye9n852wx0qqhhcghsrefsq9m8c5flpfs2lxexf",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyd2J1VWJ5b1RHUS9QWVN5\nakRWNjFsVWRzWHVkQ1Jld2E5d2ovNWMyRkRjClhQY0dWN3IrWlI1L3Y0c2l0VlFY\ndWphNkRiWGFQZnB6Wlh6eWR4KzRwREUKLS0tIFVMQTk1YUpKZGJHUzQwZlRLN1hV\nTkRud2gwdE5VQlJrNVZvcmluZ2dOUVUK/TxbSStfbidfeiT6oxqXwY5xNqRQ8bbf\nRsrUR7904v41JgwawFFcTgf701SM4D0O85Nc9Sog8OkGO36jMqOEtg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qm0p4vf9jvcnn43s6l4prk8zn6cx0ep9gzvevxecv729xz540v8qa742eg",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWYWlJSTVCWWdOY2Yybnda\neExPU1Byb0REOGc0S3Z0MlFuWHFLdkdXbnpBClk1c1pMR2V2ZFBWckNRMmJJc3Jp\ncG9qMmU1NElVeVUxS0xpeFV4VmxqS1kKLS0tIHZYYktYaHFIZXVwWkh2bThDclcr\nQlNhcDduOXJnelI2cmNEdXVzSDhlVFkKTOXZB7SJ4vl++Du5hFi9T3nMhxPNmm8s\nkODjnmPxyKYvRMfrDzPkHtzQKaPMHRls9yzZzE2imUhwKpVlvwu2lA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-23T07:55:05Z",
+		"mac": "ENC[AES256_GCM,data:PJ0CH2G8tYNnAQV++BNTZbG2emMTp0EEY29NLXUEGxwdWfuHTZxc8QnYx1ck+4Rs28a9U7KHffnPfh4/8NwnnR9MmDcyoLN6/JMHWzUJQZhuMpGGoDxJCaxs/dFaiitlvhNdazSf1f2t8ng+OKokG6L15Mi34oXNTQ/0dyYG4Hc=,iv:YzZBO69nY4p9ut3e8NBGD1EV6Rbq/6z6z2Oh2OnM8JI=,tag:KUQqxuxJfMRSvbbRP2fLng==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.1"
+	}
+}

checks/syncthing/vars/per-machine/peer2/syncthing/key/users/admin

@@ -0,0 +1 @@
+../../../../../../sops/users/admin

checks/wayland-proxy-virtwl/default.nix

@@ -1,4 +1,4 @@
-import ../lib/test-base.nix (
+(
   {
     config,
     pkgs,

checks/zt-tcp-relay/default.nix

@@ -1,4 +1,4 @@
-(import ../lib/container-test.nix) (
+(
   { pkgs, ... }:
   {
     name = "zt-tcp-relay";

clanModules/auto-upgrade/roles/default.nix

@@ -4,10 +4,10 @@
   ...
 }:
 let
-  cfg = config.clan.autoUpgrade;
+  cfg = config.clan.auto-upgrade;
 in
 {
-  options.clan.autoUpgrade = {
+  options.clan.auto-upgrade = {
     flake = lib.mkOption {
       type = lib.types.str;
       description = "Flake reference";
@@ -15,7 +15,7 @@ in
   };
   config = {
     system.autoUpgrade = {
-      inherit (cfg.clan.autoUpgrade) flake;
+      inherit (cfg) flake;
       enable = true;
       dates = "02:00";
       randomizedDelaySec = "45min";

clanModules/data-mesher/shared.nix

@@ -13,10 +13,10 @@ let
   defaultBootstrapNodes = builtins.foldl' (
     urls: name:
     if
-      builtins.pathExists "${config.clan.core.settings.directory}/machines/${name}/facts/zerotier-ip"
+      builtins.pathExists "${config.clan.core.settings.directory}/vars/per-machine/${name}/zerotier/zerotier-ip/value"
     then
       let
-        ip = builtins.readFile "${config.clan.core.settings.directory}/machines/${name}/facts/zerotier-ip";
+        ip = builtins.readFile "${config.clan.core.settings.directory}/vars/per-machine/${name}/zerotier/zerotier-ip/value";
       in
       urls ++ "${ip}:${cfg.network.port}"
     else
@@ -105,10 +105,7 @@ in
           private_key = {
             inherit owner;
           };
-          public_key = {
-            inherit owner;
-            secret = false;
-          };
+          public_key.secret = false;
         };
 
       runtimeInputs = [
@@ -134,10 +131,7 @@ in
           private_key = {
             inherit owner;
           };
-          public_key = {
-            inherit owner;
-            secret = false;
-          };
+          public_key.secret = false;
         };
 
       runtimeInputs = [

clanModules/dyndns/default.nix

@@ -210,14 +210,18 @@ in
                   data_dir = Path('data')
                   data_dir.mkdir(mode=0o770, exist_ok=True)
 
+                  # Create a temporary config file
+                  # with appropriate permissions
+                  tmp_config_path = data_dir / '.config.json'
+                  tmp_config_path.touch(mode=0o660, exist_ok=False)
+
                   # Write the config with secrets back
-                  config_path = data_dir / 'config.json'
-                  with open(config_path, 'w') as f:
+                  with open(tmp_config_path, 'w') as f:
                       f.write(json.dumps(config, indent=4))
 
-                  # Set file permissions to read and write
-                  # only by the user and group
-                  config_path.chmod(0o660)
+                  # Move config into place
+                  config_path = data_dir / 'config.json'
+                  tmp_config_path.rename(config_path)
 
                   # Set file permissions to read
                   # and write only by the user and group

clanModules/iwd/roles/default.nix

@@ -7,7 +7,7 @@
 
 let
   cfg = config.clan.iwd;
-  secret_path = ssid: config.clan.core.facts.services."iwd.${ssid}".secret."iwd.${ssid}".path;
+  secret_path = ssid: config.clan.core.vars.generators."iwd.${ssid}".files."iwd.${ssid}".path;
   secret_generator = name: value: {
     name = "iwd.${value.ssid}";
     value =
@@ -15,17 +15,20 @@ let
         secret_name = "iwd.${value.ssid}";
       in
       {
-        secret.${secret_name} = { };
-        generator.prompt = "Wifi password for '${value.ssid}'";
+        prompts.${secret_name} = {
+          description = "Wifi password for '${value.ssid}'";
+          persist = true;
+        };
+        migrateFact = secret_name;
         # ref. man iwd.network
-        generator.script = ''
+        script = ''
           config="
           [Settings]
             AutoConnect=${if value.AutoConnect then "true" else "false"}
           [Security]
-            Passphrase=$(echo -e "$prompt_value" | ${lib.getExe pkgs.gnused} "s=\\\=\\\\\\\=g;s=\t=\\\t=g;s=\r=\\\r=g;s=^ =\\\s=")
+            Passphrase=$(echo -e "$prompt_value/${secret_name}" | ${lib.getExe pkgs.gnused} "s=\\\=\\\\\\\=g;s=\t=\\\t=g;s=\r=\\\r=g;s=^ =\\\s=")
           "
-          echo "$config" > "$secrets/${secret_name}"
+          echo "$config" > "$out/${secret_name}"
         '';
       };
   };
@@ -72,7 +75,7 @@ in
         _: value: "C /var/lib/iwd/${value.ssid}.psk 0600 root root - ${secret_path value.ssid}"
       ) cfg.networks;
 
-      clan.core.facts.services = lib.mapAttrs' secret_generator cfg.networks;
+      clan.core.vars.generators = lib.mapAttrs' secret_generator cfg.networks;
 
       # TODO: restart the iwd.service if something changes
     })

clanModules/root-password/README.md

@@ -7,8 +7,12 @@ features = [ "inventory" ]
 After the system was installed/deployed the following command can be used to display the root-password:
 
 ```bash
-clan secrets get {machine_name}-password
+clan vars get [machine_name] root-password/root-password
 ```
 
+See also: [Vars](../../manual/vars-backend.md)
 
-See also: [Facts / Secrets](../../getting-started/secrets.md)
+To regenerate the password run:
+```
+clan vars generate --regenerate [machine_name] --generator root-password
+```

clanModules/static-hosts/default.nix

@@ -26,8 +26,8 @@
   config.networking.hosts =
     let
       dir = config.clan.core.settings.directory;
-      machineDir = dir + "/machines/";
-      zerotierIpMachinePath = machines: machineDir + machines + "/facts/zerotier-ip";
+      machineDir = "${dir}/vars/per-machine";
+      zerotierIpMachinePath = machine: "${machineDir}/${machine}/zerotier/zerotier-ip/value";
       machinesFileSet = builtins.readDir machineDir;
       machines = lib.mapAttrsToList (name: _: name) machinesFileSet;
       networkIpsUnchecked = builtins.map (

clanModules/syncthing-static-peers/default.nix

@@ -6,10 +6,9 @@
 }:
 let
   dir = config.clan.core.settings.directory;
-  machineDir = dir + "/machines/";
-  machineVarDir = dir + "/vars/per-machine/";
-  syncthingPublicKeyPath = machines: machineVarDir + machines + "/syncthing/id/value";
-  machinesFileSet = builtins.readDir machineDir;
+  machineVarDir = "${dir}/vars/per-machine/";
+  syncthingPublicKeyPath = machine: "${machineVarDir}/${machine}/syncthing/id/value";
+  machinesFileSet = builtins.readDir machineVarDir;
   machines = lib.mapAttrsToList (name: _: name) machinesFileSet;
   syncthingPublicKeysUnchecked = builtins.map (
     machine:
@@ -19,7 +18,7 @@ let
     if builtins.pathExists fullPath then machine else null
   ) machines;
   syncthingPublicKeyMachines = lib.filter (machine: machine != null) syncthingPublicKeysUnchecked;
-  zerotierIpMachinePath = machines: machineDir + machines + "/facts/zerotier-ip";
+  zerotierIpMachinePath = machine: "${machineVarDir}/${machine}/zerotier/zerotier-ip/value";
   networkIpsUnchecked = builtins.map (
     machine:
     let

clanModules/syncthing/README.md

@@ -1,6 +1,13 @@
 ---
 description = "A secure, file synchronization app for devices over networks, offering a private alternative to cloud services."
+features = [ "inventory" ]
+
+[constraints]
+roles.introducer.min = 1
+roles.introducer.max = 1
 ---
+**Warning**: This module was written with our VM integration in mind likely won't work outside of this context. They will be generalized in future.
+
 ## Usage
 
 We recommend configuring this module as an sync-service through the provided options. Although it provides a Web GUI through which more usage scenarios are supported.

clanModules/syncthing/default.nix

@@ -1,210 +1,6 @@
+# Dont import this file
+# It is only here for backwards compatibility.
+# Dont author new modules with this file.
 {
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-{
-  options.clan.syncthing = {
-    id = lib.mkOption {
-      description = ''
-        The ID of the machine.
-        It is generated automatically by default.
-      '';
-      type = lib.types.nullOr lib.types.str;
-      example = "BABNJY4-G2ICDLF-QQEG7DD-N3OBNGF-BCCOFK6-MV3K7QJ-2WUZHXS-7DTW4AS";
-      default = config.clan.core.facts.services.syncthing.public."syncthing.pub".value or null;
-      defaultText = "config.clan.core.facts.services.syncthing.public.\"syncthing.pub\".value";
-    };
-    introducer = lib.mkOption {
-      description = ''
-        The introducer for the machine.
-      '';
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-    };
-    autoAcceptDevices = lib.mkOption {
-      description = ''
-        Auto accept incoming device requests.
-        Should only be used on the introducer.
-      '';
-      type = lib.types.bool;
-      default = false;
-    };
-    autoShares = lib.mkOption {
-      description = ''
-        Auto share the following Folders by their ID's with introduced devices.
-        Should only be used on the introducer.
-      '';
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      example = [
-        "folder1"
-        "folder2"
-      ];
-    };
-  };
-
-  imports = [
-    {
-      # Syncthing ports: 8384 for remote access to GUI
-      # 22000 TCP and/or UDP for sync traffic
-      # 21027/UDP for discovery
-      # source: https://docs.syncthing.net/users/firewall.html
-      networking.firewall.interfaces."zt+".allowedTCPPorts = [
-        8384
-        22000
-      ];
-      networking.firewall.allowedTCPPorts = [ 8384 ];
-      networking.firewall.interfaces."zt+".allowedUDPPorts = [
-        22000
-        21027
-      ];
-
-      assertions = [
-        {
-          assertion = lib.all (
-            attr: builtins.hasAttr attr config.services.syncthing.settings.folders
-          ) config.clan.syncthing.autoShares;
-          message = ''
-            Syncthing: If you want to AutoShare a folder, you need to have it configured on the sharing device.
-          '';
-        }
-      ];
-
-      # Activates inotify compatibility on syncthing
-      # use mkOverride 900 here as it otherwise would collide with the default of the
-      # upstream nixos xserver.nix
-      boot.kernel.sysctl."fs.inotify.max_user_watches" = lib.mkOverride 900 524288;
-
-      services.syncthing = {
-        enable = true;
-        configDir = "/var/lib/syncthing";
-
-        overrideFolders = lib.mkDefault (
-          if (config.clan.syncthing.introducer == null) then true else false
-        );
-        overrideDevices = lib.mkDefault (
-          if (config.clan.syncthing.introducer == null) then true else false
-        );
-
-        dataDir = lib.mkDefault "/home/user/";
-
-        group = "syncthing";
-
-        key = lib.mkDefault config.clan.secrets.syncthing.secrets."syncthing.key".path or null;
-        cert = lib.mkDefault config.clan.secrets.syncthing.secrets."syncthing.cert".path or null;
-
-        settings = {
-          options = {
-            urAccepted = -1;
-            allowedNetworks = [ config.clan.core.networking.zerotier.subnet ];
-          };
-          devices =
-            { }
-            // (
-              if (config.clan.syncthing.introducer == null) then
-                { }
-              else
-                {
-                  "${config.clan.syncthing.introducer}" = {
-                    name = "introducer";
-                    id = config.clan.syncthing.introducer;
-                    introducer = true;
-                    autoAcceptFolders = true;
-                  };
-                }
-            );
-        };
-      };
-      systemd.services.syncthing-auto-accept =
-        let
-          baseAddress = "127.0.0.1:8384";
-          getPendingDevices = "/rest/cluster/pending/devices";
-          postNewDevice = "/rest/config/devices";
-          SharedFolderById = "/rest/config/folders/";
-          apiKey = config.clan.core.facts.services.syncthing.secret."syncthing.api".path or null;
-        in
-        lib.mkIf config.clan.syncthing.autoAcceptDevices {
-          description = "Syncthing auto accept devices";
-          requisite = [ "syncthing.service" ];
-          after = [ "syncthing.service" ];
-          wantedBy = [ "multi-user.target" ];
-
-          script = ''
-            set -x
-            # query pending deviceID's
-            APIKEY=$(cat ${apiKey})
-            PENDING=$(${lib.getExe pkgs.curl} -X GET -H "X-API-Key: $APIKEY" ${baseAddress}${getPendingDevices})
-            PENDING=$(echo $PENDING | ${lib.getExe pkgs.jq} keys[])
-
-            # accept pending deviceID's
-            for ID in $PENDING;do
-            ${lib.getExe pkgs.curl} -X POST -d "{\"deviceId\": $ID}" -H "Content-Type: application/json" -H "X-API-Key: $APIKEY" ${baseAddress}${postNewDevice}
-
-            # get all shared folders by their ID
-            for folder in ${builtins.toString config.clan.syncthing.autoShares}; do
-              SHARED_IDS=$(${lib.getExe pkgs.curl} -X GET -H "X-API-Key: $APIKEY" ${baseAddress}${SharedFolderById}"$folder" | ${lib.getExe pkgs.jq} ."devices")
-              PATCHED_IDS=$(echo $SHARED_IDS | ${lib.getExe pkgs.jq} ".+= [{\"deviceID\": $ID, \"introducedBy\": \"\", \"encryptionPassword\": \"\"}]")
-              ${lib.getExe pkgs.curl} -X PATCH -d "{\"devices\": $PATCHED_IDS}" -H "X-API-Key: $APIKEY" ${baseAddress}${SharedFolderById}"$folder"
-              done
-            done
-          '';
-        };
-
-      systemd.timers.syncthing-auto-accept = lib.mkIf config.clan.syncthing.autoAcceptDevices {
-        description = "Syncthing Auto Accept";
-
-        wantedBy = [ "syncthing-auto-accept.service" ];
-
-        timerConfig = {
-          OnActiveSec = lib.mkDefault 60;
-          OnUnitActiveSec = lib.mkDefault 60;
-        };
-      };
-
-      systemd.services.syncthing-init-api-key =
-        let
-          apiKey = config.clan.core.facts.services.syncthing.secret."syncthing.api".path or null;
-        in
-        lib.mkIf config.clan.syncthing.autoAcceptDevices {
-          description = "Set the api key";
-          after = [ "syncthing-init.service" ];
-          wantedBy = [ "multi-user.target" ];
-          script = ''
-            # set -x
-            set -efu pipefail
-
-            APIKEY=$(cat ${apiKey})
-            ${lib.getExe pkgs.gnused} -i "s/<apikey>.*<\/apikey>/<apikey>$APIKEY<\/apikey>/" /var/lib/syncthing/config.xml
-            # sudo systemctl restart syncthing.service
-            systemctl restart syncthing.service
-          '';
-          serviceConfig = {
-            WorkingDirectory = "/var/lib/syncthing";
-            BindReadOnlyPaths = [ apiKey ];
-            Type = "oneshot";
-          };
-        };
-
-      clan.core.facts.services.syncthing = {
-        secret."syncthing.key" = { };
-        secret."syncthing.cert" = { };
-        secret."syncthing.api" = { };
-        public."syncthing.pub" = { };
-        generator.path = [
-          pkgs.coreutils
-          pkgs.gnugrep
-          pkgs.syncthing
-        ];
-        generator.script = ''
-          syncthing generate --config "$secrets"
-          mv "$secrets"/key.pem "$secrets"/syncthing.key
-          mv "$secrets"/cert.pem "$secrets"/syncthing.cert
-          cat "$secrets"/config.xml | grep -oP '(?<=<device id=")[^"]+' | uniq > "$facts"/syncthing.pub
-          cat "$secrets"/config.xml | grep -oP '<apikey>\K[^<]+' | uniq > "$secrets"/syncthing.api
-        '';
-      };
-    }
-  ];
+  imports = [ ./roles/peer.nix ];
 }

clanModules/syncthing/roles/introducer.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  imports = [
+    ../shared.nix
+  ];
+}

clanModules/syncthing/roles/peer.nix

@@ -0,0 +1,20 @@
+{ config, lib, ... }:
+let
+  instanceNames = builtins.attrNames config.clan.inventory.services.syncthing;
+  instanceName = builtins.head instanceNames;
+  instance = config.clan.inventory.services.syncthing.${instanceName};
+  introducer = builtins.head instance.roles.introducer.machines;
+
+  introducerId = "${config.clan.core.settings.directory}/vars/per-machine/${introducer}/syncthing/id/value";
+in
+{
+  imports = [
+    ../shared.nix
+  ];
+  clan.syncthing.introducer = lib.strings.removeSuffix "\n" (
+    if builtins.pathExists introducerId then
+      builtins.readFile introducerId
+    else
+      throw "${introducerId} does not exists. Please run `clan vars generate ${introducer}` to generate the introducer device id"
+  );
+}

clanModules/syncthing/shared.nix

@@ -0,0 +1,214 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  options.clan.syncthing = {
+    id = lib.mkOption {
+      description = ''
+        The ID of the machine.
+        It is generated automatically by default.
+      '';
+      type = lib.types.nullOr lib.types.str;
+      example = "BABNJY4-G2ICDLF-QQEG7DD-N3OBNGF-BCCOFK6-MV3K7QJ-2WUZHXS-7DTW4AS";
+      default = config.clan.core.vars.generators.syncthing.files."id".value;
+      defaultText = "config.clan.core.vars.generators.syncthing.files.\"id\".value";
+    };
+    introducer = lib.mkOption {
+      description = ''
+        The introducer for the machine.
+      '';
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+    };
+    autoAcceptDevices = lib.mkOption {
+      description = ''
+        Auto accept incoming device requests.
+        Should only be used on the introducer.
+      '';
+      type = lib.types.bool;
+      default = false;
+    };
+    autoShares = lib.mkOption {
+      description = ''
+        Auto share the following Folders by their ID's with introduced devices.
+        Should only be used on the introducer.
+      '';
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [
+        "folder1"
+        "folder2"
+      ];
+    };
+  };
+
+  imports = [
+    {
+      # Syncthing ports: 8384 for remote access to GUI
+      # 22000 TCP and/or UDP for sync traffic
+      # 21027/UDP for discovery
+      # source: https://docs.syncthing.net/users/firewall.html
+      networking.firewall.interfaces."zt+".allowedTCPPorts = [
+        8384
+        22000
+      ];
+      networking.firewall.allowedTCPPorts = [ 8384 ];
+      networking.firewall.interfaces."zt+".allowedUDPPorts = [
+        22000
+        21027
+      ];
+
+      assertions = [
+        {
+          assertion = lib.all (
+            attr: builtins.hasAttr attr config.services.syncthing.settings.folders
+          ) config.clan.syncthing.autoShares;
+          message = ''
+            Syncthing: If you want to AutoShare a folder, you need to have it configured on the sharing device.
+          '';
+        }
+      ];
+
+      # Activates inotify compatibility on syncthing
+      # use mkOverride 900 here as it otherwise would collide with the default of the
+      # upstream nixos xserver.nix
+      boot.kernel.sysctl."fs.inotify.max_user_watches" = lib.mkOverride 900 524288;
+
+      services.syncthing = {
+        enable = true;
+
+        overrideFolders = lib.mkDefault (
+          if (config.clan.syncthing.introducer == null) then true else false
+        );
+        overrideDevices = lib.mkDefault (
+          if (config.clan.syncthing.introducer == null) then true else false
+        );
+
+        key = lib.mkDefault config.clan.core.vars.generators.syncthing.files."key".path or null;
+        cert = lib.mkDefault config.clan.core.vars.generators.syncthing.files."cert".path or null;
+
+        settings = {
+          options = {
+            urAccepted = -1;
+            allowedNetworks = [ ];
+          };
+          devices =
+            { }
+            // (
+              if (config.clan.syncthing.introducer == null) then
+                { }
+              else
+                {
+                  "${config.clan.syncthing.introducer}" = {
+                    name = "introducer";
+                    id = config.clan.syncthing.introducer;
+                    introducer = true;
+                    autoAcceptFolders = true;
+                  };
+                }
+            );
+        };
+      };
+      systemd.services.syncthing-auto-accept =
+        let
+          baseAddress = "127.0.0.1:8384";
+          getPendingDevices = "/rest/cluster/pending/devices";
+          postNewDevice = "/rest/config/devices";
+          SharedFolderById = "/rest/config/folders/";
+          apiKey = config.clan.core.vars.generators.syncthing.files."apikey".path;
+        in
+        lib.mkIf config.clan.syncthing.autoAcceptDevices {
+          description = "Syncthing auto accept devices";
+          requisite = [ "syncthing.service" ];
+          after = [ "syncthing.service" ];
+          wantedBy = [ "multi-user.target" ];
+
+          script = ''
+            set -x
+            # query pending deviceID's
+            APIKEY=$(cat ${apiKey})
+            PENDING=$(${lib.getExe pkgs.curl} -X GET -H "X-API-Key: $APIKEY" ${baseAddress}${getPendingDevices})
+            PENDING=$(echo $PENDING | ${lib.getExe pkgs.jq} keys[])
+
+            # accept pending deviceID's
+            for ID in $PENDING;do
+            ${lib.getExe pkgs.curl} -X POST -d "{\"deviceId\": $ID}" -H "Content-Type: application/json" -H "X-API-Key: $APIKEY" ${baseAddress}${postNewDevice}
+
+            # get all shared folders by their ID
+            for folder in ${builtins.toString config.clan.syncthing.autoShares}; do
+              SHARED_IDS=$(${lib.getExe pkgs.curl} -X GET -H "X-API-Key: $APIKEY" ${baseAddress}${SharedFolderById}"$folder" | ${lib.getExe pkgs.jq} ."devices")
+              PATCHED_IDS=$(echo $SHARED_IDS | ${lib.getExe pkgs.jq} ".+= [{\"deviceID\": $ID, \"introducedBy\": \"\", \"encryptionPassword\": \"\"}]")
+              ${lib.getExe pkgs.curl} -X PATCH -d "{\"devices\": $PATCHED_IDS}" -H "X-API-Key: $APIKEY" ${baseAddress}${SharedFolderById}"$folder"
+              done
+            done
+          '';
+        };
+
+      systemd.timers.syncthing-auto-accept = lib.mkIf config.clan.syncthing.autoAcceptDevices {
+        description = "Syncthing Auto Accept";
+
+        wantedBy = [ "syncthing-auto-accept.service" ];
+
+        timerConfig = {
+          OnActiveSec = lib.mkDefault 60;
+          OnUnitActiveSec = lib.mkDefault 60;
+        };
+      };
+
+      systemd.services.syncthing-init-api-key =
+        let
+          apiKey = config.clan.core.vars.generators.syncthing.files."apikey".path;
+        in
+        lib.mkIf config.clan.syncthing.autoAcceptDevices {
+          description = "Set the api key";
+          after = [ "syncthing-init.service" ];
+          wantedBy = [ "multi-user.target" ];
+          script = ''
+            # set -x
+            set -efu pipefail
+
+            APIKEY=$(cat ${apiKey})
+            ${lib.getExe pkgs.gnused} -i "s/<apikey>.*<\/apikey>/<apikey>$APIKEY<\/apikey>/" ${config.services.syncthing.configDir}/config.xml
+            # sudo systemctl restart syncthing.service
+            systemctl restart syncthing.service
+          '';
+          serviceConfig = {
+            BindReadOnlyPaths = [ apiKey ];
+            Type = "oneshot";
+          };
+        };
+
+      clan.core.vars.generators.syncthing = {
+        migrateFact = "syncthing";
+
+        files."key".group = config.services.syncthing.group;
+        files."key".owner = config.services.syncthing.user;
+
+        files."cert".group = config.services.syncthing.group;
+        files."cert".owner = config.services.syncthing.user;
+
+        files."apikey".group = config.services.syncthing.group;
+        files."apikey".owner = config.services.syncthing.user;
+
+        files."id".secret = false;
+
+        runtimeInputs = [
+          pkgs.coreutils
+          pkgs.gnugrep
+          pkgs.syncthing
+        ];
+
+        script = ''
+          syncthing generate --config "$out"
+          mv "$out"/key.pem "$out"/key
+          mv "$out"/cert.pem "$out"/cert
+          cat "$out"/config.xml | grep -oP '(?<=<device id=")[^"]+' | uniq > "$out"/id
+          cat "$out"/config.xml | grep -oP '<apikey>\K[^<]+' | uniq > "$out"/apikey
+        '';
+      };
+    }
+  ];
+}

clanModules/user-password/README.md

@@ -13,9 +13,12 @@ If setting the option prompt to true, the user will be prompted to type in their
 After the system was installed/deployed the following command can be used to display the user-password:
 
 ```bash
-clan secrets get {machine_name}-user-password
+clan vars get [machine_name] root-password/root-password
 ```
 
-See also: [Facts / Secrets](../../getting-started/secrets.md)
+See also: [Vars](../../manual/vars-backend.md)
 
-To regenerate the password, delete the password files in the clan directory and redeploy the machine.
+To regenerate the password run:
+```
+clan vars generate --regenerate [machine_name] --generator user-password
+```