changes

17 files changed, 83 insertions, 261 deletions

diff --git a/flake.lock b/flake.lock
index 4544044..65c8570 100644
--- a/flake.lock
+++ b/flake.lock
@@ -180,6 +180,18 @@
         "type": "github"
       }
     },
+    "geolite-db": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-+9DF7PHaxaMdrnf3IPnuM1Eyyr8MgUCiBBsO0PuaAD4=",
+        "type": "file",
+        "url": "https://github.com/P3TERX/GeoLite.mmdb/releases/latest/download/GeoLite2-City.mmdb"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://github.com/P3TERX/GeoLite.mmdb/releases/latest/download/GeoLite2-City.mmdb"
+      }
+    },
     "gitignore": {
       "inputs": {
         "nixpkgs": [
@@ -202,26 +214,6 @@
         "type": "github"
       }
     },
-    "glide-browser": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1768858368,
-        "narHash": "sha256-EqqShMa+LXRymE8Vc3or5lHU2ftYTSEgixYtqwRpr0M=",
-        "owner": "glide-browser",
-        "repo": "glide.nix",
-        "rev": "93646ce641920fa1ed4917cc9dbfa56f15e90a06",
-        "type": "github"
-      },
-      "original": {
-        "owner": "glide-browser",
-        "repo": "glide.nix",
-        "type": "github"
-      }
-    },
     "hjem": {
       "inputs": {
         "nix-darwin": "nix-darwin",
@@ -375,22 +367,6 @@
         "type": "github"
       }
     },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1746663147,
-        "narHash": "sha256-Ua0drDHawlzNqJnclTJGf87dBmaO/tn7iZ+TCkTRpRc=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "dda3dcd3fe03e991015e9a74b22d35950f264a54",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "pre-commit": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -422,7 +398,7 @@
         "disko": "disko",
         "firefox-csshacks": "firefox-csshacks",
         "fx-autoconfig": "fx-autoconfig",
-        "glide-browser": "glide-browser",
+        "geolite-db": "geolite-db",
         "hjem": "hjem",
         "lanzaboote": "lanzaboote",
         "nix-index-database": "nix-index-database",
@@ -430,7 +406,6 @@
         "nixpkgs": "nixpkgs",
         "tmux-tsunami": "tmux-tsunami",
         "uc-css-js": "uc-css-js",
-        "vermilion": "vermilion",
         "yoshi-lua": "yoshi-lua"
       }
     },
@@ -567,24 +542,6 @@
         "type": "github"
       }
     },
-    "vermilion": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_2"
-      },
-      "locked": {
-        "lastModified": 1770166629,
-        "narHash": "sha256-8gP9fuYIN6epnPskX12rm2vEu/u/MjwJ8ZvIAjoPmLk=",
-        "owner": "vaxerski",
-        "repo": "Vermilion",
-        "rev": "7b77acdeb4563351af215a13d77ba4a8cd93cd6c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "vaxerski",
-        "repo": "Vermilion",
-        "type": "github"
-      }
-    },
     "yoshi-lua": {
       "flake": false,
       "locked": {
diff --git a/flake.nix b/flake.nix
index 3a70fd3..0c64294 100644
--- a/flake.nix
+++ b/flake.nix
@@ -29,19 +29,14 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    glide-browser = {
-      url = "github:glide-browser/glide.nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    vermilion = {
-      url = "github:vaxerski/Vermilion";
-    };
-
     copyparty = {
       url = "github:9001/copyparty";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    geolite-db = {
+      url = "file+https://github.com/P3TERX/GeoLite.mmdb/releases/latest/download/GeoLite2-City.mmdb";
+      flake = false;
+    };
 
     tmux-tsunami = {
       url = "github:bluedragon1221/tmux-tsunami";
diff --git a/hosts.toml b/hosts.toml
index b249345..812d620 100644
--- a/hosts.toml
+++ b/hosts.toml
@@ -13,7 +13,3 @@ host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPB7feUHl5qoD5zF9AMOV2meViA+w
 [hosts.io]
 hostnames = ["io", "192.168.50.3"]
 host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXSvoVpMh/Y84THjKAYqkbuPmmv/yIU8DunMov7tKKT"
-
-[hosts.gliese]
-hostnames = ["gliese", "20.251.8.247"]
-host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBRa7adrNY1CskUWepNexmh86a6Lei8xuVzTCyEwbsnY"
diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix
index 6fe1e3e..c4d9109 100644
--- a/hosts/ganymede/config.nix
+++ b/hosts/ganymede/config.nix
@@ -8,11 +8,6 @@
         owner = "wpa_supplicant";
       };
 
-      "gliese-key" = {
-        file = ../gliese-key.age;
-        owner = "collin";
-      };
-
       "caddy-env".file = ./secrets/caddy-env.age;
 
       "collin-copyparty-password" = {
@@ -55,18 +50,9 @@
     services = {
       sshd = {
         enable = true;
-        portConfig = [
-          {
-            port = 2222;
-            listenAddr = "0.0.0.0";
-            rootLogin = true;
-          }
-          {
-            port = 22;
-            listenAddr = "0.0.0.0";
-            rootLogin = true;
-          }
-        ];
+        port = 22;
+        listenAddr = "0.0.0.0";
+        rootLogin = true;
       };
 
       goaccess = {
@@ -83,21 +69,16 @@
         privateUrl = "git.ganymede";
       };
 
-      agate = {
-        enable = true;
-        publicUrl = "williamsfam.us.com";
-      };
+      # agate = {
+      #   enable = true;
+      #   publicUrl = "williamsfam.us.com";
+      # };
 
       minecraft = {
         enable = true;
         listenAddr = "0.0.0.0";
       };
 
-      polaris = {
-        enable = true;
-        privateUrl = "music.ganymede";
-      };
-
       qbittorrent = {
         enable = true;
         privateUrl = "bittorrent.ganymede";
diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix
index a2314ee..a706b5f 100644
--- a/hosts/ganymede/nixos.nix
+++ b/hosts/ganymede/nixos.nix
@@ -16,8 +16,6 @@
 
   facter.reportPath = ./facter.json;
 
-  virtualisation.oci-containers.backend = "docker"; # fix weird issue with minecraft server (only thing running in docker right now)
-
   # backup usb teather configuration
   systemd.network.networks."80-usb-teather" = {
     name = "enp0s20f0u2";
@@ -31,43 +29,8 @@
     wantedBy = ["default.target"];
   };
 
-  # VPN to server
-  systemd.network = {
-    netdevs."10-wg0" = {
-      netdevConfig = {
-        Kind = "wireguard";
-        Name = "wg0";
-      };
-      wireguardConfig = {
-        PrivateKeyFile = config.collinux.secrets."wireguard-pk".path;
-        ListenPort = 51820;
-      };
-      wireguardPeers = [
-        {
-          PublicKey = "seOq75FUGb+KThvOXCEAGdabWbb+jTRUntITpuAPgWA=";
-          AllowedIPs = "0.0.0.0/0";
-          Endpoint = "20.251.8.247:51820";
-          PersistentKeepalive = 25;
-        }
-      ];
-    };
-    networks."wg0" = {
-      matchConfig.Name = "wg0";
-      address = ["10.100.0.2/24"];
-      DHCP = "no";
-      networkConfig.IPv6AcceptRA = false;
-    };
-  };
-
   services.fail2ban.enable = true;
 
-  programs.ssh.extraConfig = ''
-    Host gliese
-      HostName 10.100.0.1
-      User green
-      IdentityFile ${config.collinux.secrets."gliese-key".path}
-  '';
-
   # merge logs from subdomains
   services.caddy.virtualHosts."up.williamsfam.us.com".logFormat = lib.mkForce ''
     output file /var/log/caddy/access-williamsfam.us.com.log
diff --git a/hosts/gliese-key.age b/hosts/gliese-key.age
deleted file mode 100644
index 6fc5ce5..0000000
--- a/hosts/gliese-key.age
+++ /dev/null
@@ -1,18 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyA0RCtu
-NWFrbW0zTU53Rk05NzRUUG1oRG4rK05EM1pnYTYwaEpCYWZBbFFrCmM3TmtRandq
-TnBVVk9ZRm1oMzlIajR1b1RJdHl4MERtbkw1MmQ3em55cncKLT4gc3NoLWVkMjU1
-MTkgSmc0eVdRIGJPcG56L3c0QUovSVJsVDlrTkJhNTBaSXlzQkkweU1mcTB5dEtK
-SDhKekUKaWEzdTUvbU5seVkvZUJDQW9XTVQ1bEJzWU5XVU5VREhIMnFxd0FRWHhS
-dwotPiAyQC1ncmVhc2UgLE85NyBOZ2ssbmIKMEN1MWNWL2dWZwotLS0gazN5U0xM
-ZjhXV1B2MmlhUm5rQXJGcWJKcVRUdXZ5Z3cxWEN2a3FVdEJWMAqoHBpRSjJB1CKI
-fWVLuRxB5c/gBXoiE8VfQ7O5v1JN6ZJ7C9m+d6PcgSKaCjEgPdnRxxe7JCDc3dUS
-cnebY/h7q+vAkLTqvtuiBMw67c5p79/EW7FpN6Wzzmc9wIHvbPf0zsn4EOqfc24I
-cuB55uviE0//E3Xh6iRvvx5XEgSBUGLeycZa5P0fmUJUOhG9CtJya4D2tB6huyNK
-2+dJgQdFkXghinzPQimnDXYhoD7PTM6yGaJQdrB0GT6lXMCBlRB9p2uEArrVYhJu
-/vAXFsGxENjI7XvH1RabM1gLN7Eytq/ptz+9/S/sMQ4D4FPp3L2gHklEqepOv3Df
-z1b7PA5aOQj3+jlpcAUkfKtgA32vT7KddlRXQWHzC7VyuEpGjT+qydNet+tBW5Z6
-DDNc/LJ/sNvOsBQE2wqvi4/bLpAG2By6CKrZYZrE+l1zJMWkbT6QnOR9/aby15am
-iSq4agnTdxsx3JrJ+V5thUyDNrAIY/DQg0rLfoGy37g877vENco+3USdoOeRJjHD
-1yRjq39y8h4EQCyeaAx0h3MQEJMiReHxbQ==
------END AGE ENCRYPTED FILE-----
diff --git a/hosts/mercury/config.nix b/hosts/mercury/config.nix
index 12518f4..d2164c4 100644
--- a/hosts/mercury/config.nix
+++ b/hosts/mercury/config.nix
@@ -2,12 +2,7 @@
   collinux = {
     theme = "catppuccin";
 
-    secrets = {
-      "gliese-key" = {
-        file = ../gliese-key.age;
-        owner = "collin";
-      };
-    };
+    secrets = {};
 
     user.useRun0 = true;
 
diff --git a/hosts/mercury/nixos.nix b/hosts/mercury/nixos.nix
index 3f5c0b0..8fcb504 100644
--- a/hosts/mercury/nixos.nix
+++ b/hosts/mercury/nixos.nix
@@ -1,19 +1,20 @@
 {
   lib,
   inputs,
-  config,
   ...
 }: {
   imports = [
     ./disks.nix
     ./battery.nix
-    # ./ai.nix
 
     inputs.nixos-facter-modules.nixosModules.facter
     inputs.lanzaboote.nixosModules.lanzaboote
   ];
 
   facter.reportPath = ./facter.json;
+  services.dbus.implementation = "broker";
+
+  environment.defaultPackages = lib.mkForce []; # im not a noob
 
   services.syncthing = {
     enable = true;
@@ -26,14 +27,14 @@
       name = "ganymede";
       user = "collin";
       monitoringPort = 20000;
-      extraArguments = "-N -D 9090 -L 4141:localhost:4141 collin@williamsfam.us.com";
+      extraArguments = "-N -D 9090 collin@williamsfam.us.com";
     }
   ];
-
-  services.dbus.implementation = "broker";
-
-  environment.defaultPackages = lib.mkForce []; # im not a noob
-
+  programs.ssh.extraConfig = ''
+    Host ganymede
+      HostName williamsfam.us.com
+      Port 22
+  '';
   security.pki.certificates = [
     ''
       -----BEGIN CERTIFICATE-----
@@ -50,22 +51,6 @@
     ''
   ];
 
-  programs.ssh.extraConfig = ''
-    Match host ganymede exec "nc -z -w1 192.168.50.2 2222"
-      HostName 192.168.50.2
-      Port 2222
-
-    Host ganymede
-      HostName williamsfam.us.com
-      Port 22
-
-    Host gliese
-      HostName 10.100.0.1
-      User green
-      IdentityFile ${config.collinux.secrets."gliese-key".path}
-      ProxyJump collin@ganymede
-  '';
-
   programs.firefox.policies.ExtensionSettings = {
     "foxyproxy@eric.h.jung" = {
       installation_mode = "force_installed";
diff --git a/modules/desktop/hjem/programs/firefox.nix b/modules/desktop/hjem/programs/firefox.nix
index 46d2dd5..cf9c532 100644
--- a/modules/desktop/hjem/programs/firefox.nix
+++ b/modules/desktop/hjem/programs/firefox.nix
@@ -35,6 +35,8 @@ in
 
       "${profileDir}/chrome/JS/test.uc.js".source = "${inputs.fx-autoconfig}/profile/chrome/JS/test.uc.js";
 
+      "${profileDir}/chrome/JS/aboutCfg.sys.mjs".source = "${inputs.uc-css-js}/JS/aboutCfg.sys.mjs";
+
       "${profileDir}/chrome/JS/aboutUserChrome.sys.mjs".source = "${inputs.uc-css-js}/JS/aboutUserChrome.sys.mjs";
       "${profileDir}/chrome/resources/aboutuserchrome".source = "${inputs.uc-css-js}/resources/aboutuserchrome";
 
@@ -62,6 +64,4 @@ in
         "compact_extensions_panel"
       ];
     };
-
-    packages = [pkgs.firefox];
   }
diff --git a/modules/desktop/hjem/wm/sway.nix b/modules/desktop/hjem/wm/sway.nix
index 03450d2..c880a1b 100644
--- a/modules/desktop/hjem/wm/sway.nix
+++ b/modules/desktop/hjem/wm/sway.nix
@@ -59,7 +59,7 @@
 
       Mod4+Return   exec ${pkgs.foot}/bin/foot
       Mod4+Space    exec tofi-drun
-      Mod4+b        exec ${pkgs.firefox}/bin/firefox
+      Mod4+b        exec firefox
       Mod4+Shift+b  exec ${pkgs.qutebrowser}/bin/qutebrowser
       Mod4+w        exec '${pkgs.iwmenu}/bin/iwmenu -l fuzzel -i font -s 2'
 
diff --git a/modules/services/nixos/copyparty.nix b/modules/services/nixos/copyparty.nix
index cfc69bc..0e607e2 100644
--- a/modules/services/nixos/copyparty.nix
+++ b/modules/services/nixos/copyparty.nix
@@ -78,21 +78,6 @@ in {
                 e2ts = true; # enable music indexing
               };
             };
-
-            "/incoming" = {
-              path = "/media/incoming";
-              access = {
-                wG = "*";
-                A = "@admin";
-              };
-              flags = {
-                fk = 6;
-                dk = 6;
-                lifetime = 21600; # files deleted after 6hrs
-                nosub = true; # must upload to top-level folder
-                maxb = "20g,21600"; # each IP can upload a max of 20GB every 6 hrs
-              };
-            };
           }
         ]
         ++ lib.lists.flatten (cfg.users
@@ -100,16 +85,13 @@ in {
             {
               "/${k}" = {
                 path = "/media/${k}";
-                access.A = k;
+                access.rwd = k;
               };
             }
             (lib.optionalAttrs v.hasPublicDir {
               "/public/${k}" = {
                 path = "/media/${k}/public";
-                access = {
-                  r = "*";
-                  A = k;
-                };
+                access.r = "*";
               };
             })
           ])));
diff --git a/modules/services/nixos/goaccess.nix b/modules/services/nixos/goaccess.nix
index bb174cb..703e263 100644
--- a/modules/services/nixos/goaccess.nix
+++ b/modules/services/nixos/goaccess.nix
@@ -1,22 +1,18 @@
 {
   config,
   pkgs,
+  inputs,
   lib,
   ...
 }: let
   cfg = config.collinux.services.goaccess;
 
-  geoip = pkgs.fetchurl {
-    url = "https://github.com/P3TERX/GeoLite.mmdb/releases/download/2026.03.01/GeoLite2-City.mmdb";
-    hash = "sha256-SZ/m8b53sawF86Ak46uX7CxdzEMFrmob7Yd12Y+xJfA=";
-  };
-
   settings = {
     date-format = "%s";
     log-format = "CADDY";
     tz = config.time.timeZone;
     log-file = "/var/log/caddy/access-williamsfam.us.com.log";
-    geoip-database = geoip;
+    geoip-database = inputs.geolite-db;
 
     ws-url =
       if cfg.publicUrl != null
diff --git a/modules/services/nixos/minecraft.nix b/modules/services/nixos/minecraft.nix
index fa7ae40..1b8b047 100644
--- a/modules/services/nixos/minecraft.nix
+++ b/modules/services/nixos/minecraft.nix
@@ -24,5 +24,7 @@ in
       image = "itzg/minecraft-bedrock-server";
       ports = ["${cfg.listenAddr}:${toString cfg.port}:19132/udp"];
       volumes = ["/var/lib/minecraft/:/data"];
+
+      extraOptions = ["--no-healthcheck"];
     };
   }
diff --git a/modules/services/nixos/openssh.nix b/modules/services/nixos/openssh.nix
index be2b51c..2d0c45c 100644
--- a/modules/services/nixos/openssh.nix
+++ b/modules/services/nixos/openssh.nix
@@ -7,9 +7,6 @@
 }: let
   cfg = config.collinux.services.sshd;
 
-  anyAttr = attr: cfg.portConfig |> builtins.map (x: x.${attr} != null) |> builtins.any (x: x);
-  anyOTP = cfg.portConfig |> builtins.map (x: x.otp == true) |> builtins.any (x: x);
-
   authorizedKeys =
     hosts
     |> builtins.mapAttrs (_: data: data.user_pubkey or null)
@@ -17,7 +14,7 @@
     |> builtins.filter (x: x != null);
 in {
   config = lib.mkIf cfg.enable {
-    networking.firewall.allowedTCPPorts = cfg.portConfig |> builtins.map (x: x.port);
+    networking.firewall.allowedTCPPorts = [cfg.port];
 
     services.openssh = {
       enable = true;
@@ -30,12 +27,12 @@ in {
         }
       ];
 
-      listenAddresses =
-        cfg.portConfig
-        |> builtins.map (x: {
-          addr = x.listenAddr;
-          port = x.port;
-        });
+      listenAddresses = [
+        {
+          addr = cfg.listenAddr;
+          port = cfg.port;
+        }
+      ];
 
       # Lock down everything by default
       settings = {
@@ -46,30 +43,26 @@ in {
         AllowAgentForwarding = false;
       };
 
-      extraConfig =
-        cfg.portConfig
-        |> builtins.map (x:
-          lib.concatStringsSep "\n" [
-            "Match LocalPort ${toString x.port}"
-            (
-              if x.otp
-              then ''
-                ChallengeResponseAuthentication yes
-                PubkeyAuthentication yes
-                KbdInteractiveAuthentication yes
-                AuthenticationMethods publickey,keyboard-interactive:pam
-              ''
-              else ''
-                PubkeyAuthentication yes
-                AuthenticationMethods publickey
-              ''
-            )
-            (lib.optionalString x.rootLogin "PermitRootLogin yes")
-          ])
-        |> lib.concatStringsSep "\n\n";
+      extraConfig = lib.concatStringsSep "\n" [
+        "Match LocalPort ${toString cfg.port}"
+        (
+          if cfg.otp
+          then ''
+            ChallengeResponseAuthentication yes
+            PubkeyAuthentication yes
+            KbdInteractiveAuthentication yes
+            AuthenticationMethods publickey,keyboard-interactive:pam
+          ''
+          else ''
+            PubkeyAuthentication yes
+            AuthenticationMethods publickey
+          ''
+        )
+        (lib.optionalString cfg.rootLogin "PermitRootLogin yes")
+      ];
     };
 
-    security.pam.services = lib.optionalAttrs anyOTP {
+    security.pam.services = lib.optionalAttrs cfg.otp {
       login.googleAuthenticator.enable = true;
 
       sshd.text = ''
@@ -86,7 +79,7 @@ in {
     };
 
     users.users.${config.collinux.user.name}.openssh.authorizedKeys.keys = authorizedKeys;
-    users.users."root".openssh.authorizedKeys.keys = lib.mkIf (anyAttr "rootLogin") authorizedKeys;
+    users.users."root".openssh.authorizedKeys.keys = lib.mkIf cfg.rootLogin authorizedKeys;
 
     systemd.services."openssh" = {
       after = lib.mkAfter ["network-online.target"];
diff --git a/modules/services/options.nix b/modules/services/options.nix
index 17a4e6b..70fd695 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -56,26 +56,19 @@ in {
     sshd = {
       enable = mkEnableOption "OpenSSH server";
 
-      portConfig = mkOption {
-        description = "List of ssh bind hosts. see submodule options for details";
-        type = lib.types.listOf (lib.types.submodule {
-          options = {
-            port = mkOption {
-              description = "Port to run on";
-              type = lib.types.port;
-            };
-
-            listenAddr = mkOption {
-              description = "Address to listen on";
-              type = lib.types.str;
-              default = "127.0.0.1";
-            };
+      port = mkOption {
+        description = "Port to run on";
+        type = lib.types.port;
+      };
 
-            otp = mkEnableOption "Whether to require TOTP (Google Authenticator) 2fa codes for this port";
-            rootLogin = mkEnableOption "Whether to allow root login for this port";
-          };
-        });
+      listenAddr = mkOption {
+        description = "Address to listen on";
+        type = lib.types.str;
+        default = "127.0.0.1";
       };
+
+      otp = mkEnableOption "Whether to require TOTP (Google Authenticator) 2fa codes";
+      rootLogin = mkEnableOption "Whether to allow root login";
     };
 
     forgejo = webserviceOptions {
diff --git a/modules/terminal/hjem/programs/helix.nix b/modules/terminal/hjem/programs/helix.nix
index a544616..5a8db19 100644
--- a/modules/terminal/hjem/programs/helix.nix
+++ b/modules/terminal/hjem/programs/helix.nix
@@ -33,6 +33,9 @@
         command = "${pkgs.superhtml}/bin/superhtml";
         args = ["lsp"];
       };
+      golsp = {
+        command = "${pkgs.gopls}/bin/gopls";
+      };
       dhall-lsp-server.command = "${pkgs.dhall-lsp-server}/bin/dhall-lsp-server";
     };
 
diff --git a/secrets.nix b/secrets.nix
index 75733c7..67ab5fd 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -2,7 +2,6 @@ let
   inherit ((builtins.fromTOML (builtins.readFile ./hosts.toml)).hosts) mercury ganymede jupiter;
 in {
   "modules/terminal/nixos/github-ssh-key.age".publicKeys = [mercury.host_pubkey jupiter.host_pubkey ganymede.host_pubkey];
-  "hosts/gliese-key.age".publicKeys = [mercury.host_pubkey ganymede.host_pubkey];
 
   "hosts/ganymede/secrets/caddy-env.age".publicKeys = [ganymede.host_pubkey];
   "hosts/ganymede/secrets/williams-psk.age".publicKeys = [ganymede.host_pubkey];