hosts (srv-backup-1): Init host

britter · Mar 2, 2025 · 650c2a0 · 650c2a0
1 parent 9ffa0d5
commit 650c2a0
Show file tree

Hide file tree

Showing 7 changed files with 3,701 additions and 25 deletions.
diff --git a/.github/workflows/ci-build.yaml b/.github/workflows/ci-build.yaml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        configuration: ["pulse-14", "srv-prod-1", "srv-prod-2", "srv-test-1", "srv-test-2", "srv-eval-1"]
+        configuration: ["pulse-14", "srv-prod-1", "srv-prod-2", "srv-test-1", "srv-test-2", "srv-eval-1", "srv-backup-1"]
     steps:
       - name: Free disk space
         uses: jlumbroso/free-disk-space@main

diff --git a/.sops.yaml b/.sops.yaml
@@ -5,6 +5,7 @@ keys:
   - &srv-test-1 age1gnt60tjm9k8v25a3cs8yhtrq5xnrgylvmxwyhkglq2c5lq0q2fcs4slgkx
   - &srv-test-2 age1jafz4xf567lgtcqv7lwxl7np0gf332yedghdlxgcxd0lfqmtxd2qpg0p4x
   - &srv-eval-1 age15vkuesucjf60x8dcfyre4aus4djyxamsk20ce2u7nrprml2j533qcsc7pd
+  - &srv-backup-1 age192l3tcamrrgnqnwv8ffm07l83kn0hlkjd04agqnmw6a5kvcudf0stqlc9e
   - &directions age1tqwmx8ge4fxkj2l8sfam94eg52km2w3dqjgazjez46m4ywln7qls0unsdw
 creation_rules:
   - path_regex: systems/host-keys\.yaml$
@@ -36,6 +37,11 @@ creation_rules:
       - age:
         - *pulse-14
         - *srv-eval-1
+  - path_regex: systems/x86_64-linux/srv-backup-1/secrets\.yaml$
+    key_groups:
+      - age:
+        - *pulse-14
+        - *srv-backup-1
   - path_regex: systems/aarch64-linux/directions/secrets\.yaml$
     key_groups:
       - age:

diff --git a/scripts/setup-vm.sh b/scripts/setup-vm.sh
@@ -29,12 +29,12 @@ trap cleanup EXIT
 install -d -m755 "$temp/etc/ssh"
 
 # copy public ket to the temporary directory
-sops -- decrypt ../systems/host-keys.yaml --extract "[\"$host\"]["public-key"]" --output "$temp/etc/ssh/ssh_host_ed25519_key.pub"
+sops -- decrypt ../systems/host-keys.yaml --extract "[\"$host\"][\"public-key\"]" --output "$temp/etc/ssh/ssh_host_ed25519_key.pub"
 # Set the correct permissions so sshd will accept the key
-chmod 644 "$temp/etc/ssh/ssh_host_ed25519_key"
+chmod 644 "$temp/etc/ssh/ssh_host_ed25519_key.pub"
 
 # copy private ket to the temporary directory
-sops -- decrypt ../systems/host-keys.yaml --extract "[\"$host\"]["private-key"]" --output "$temp/etc/ssh/ssh_host_ed25519_key"
+sops -- decrypt ../systems/host-keys.yaml --extract "[\"$host\"][\"private-key\"]" --output "$temp/etc/ssh/ssh_host_ed25519_key"
 # Set the correct permissions so sshd will accept the key
 chmod 600 "$temp/etc/ssh/ssh_host_ed25519_key"
 

diff --git a/systems/host-keys.yaml b/systems/host-keys.yaml
@@ -1,21 +1,24 @@
-directions:
-    public-key: ENC[AES256_GCM,data:mzKggGr2/WBqBc5QauVBdoQYZC3dQFH+m/QhQG/zaOLYbAAuyaSHwQ1u92R+N+LeoRM/8eWcW375H6ywVdc47febM4teG4wCyeZun2quFGRixfoHOUzb2wZyPQ51tw==,iv:qk3SbFvcMjIJ6acJEeFTHtmDaOmWy2A5jnq4BASekSY=,tag:iflmsEglNGmBBMa0/GOjjw==,type:str]
-    private-key: ENC[AES256_GCM,data:OUWbPOlVO2NZgNK3Bd7S/wpHAuAphczBs3qgkS814LqhoXzAn0rNXhWlU3lwmLm0mlbEjg38YXIHzoNdLakkGyhbiwQtgDc7Us2tKjhF0Awbky8CQ5VzKdb4EMqIB/W1FETvTa7qykCr3HYrkUhM6srBq1gRLZ7m8es5HaTM+3Z5GJWILujZvieWWphXT6B2k9BykhxWB100Zv2xkRwqiU55ImhkHFBtVLl8cJMdpgXplqzvW1vcZKt5619HMKdr8CzxrXmXO6M6LWj69on6m0Ao3Zw/LwR5N6ofej96g+V94+mukik9IV7Si244E/24Js+hwJ4z3xq2a2KYk9Ga//jvwQK/f7MQGEu7SGyo00h0YXjEbZTZU2g7pZwruM66YUt7okVKH4qsHw/wzqLA8uy7QijAhbc9l6m8Erm8Fo8qG/zlYhFN2n6u2ReXTC5YxIMsYSgc8hIWpJBSgIYWrAYlmrVrvmT24SPQSQHRdnTOHqmRqIN1nP+OH9Z+uLgN/ifMGsiEc+D7ROLaNyJg,iv:BN6d5YVluysT/B+hWYu+KhMic9JJPay8ptY2JNUD7tA=,tag:KpOfmkQzKnwOex1vS4/xlQ==,type:str]
-srv-prod-1:
-    public-key: ENC[AES256_GCM,data:/eUnadm+b8Dqhl7pvlPLcM8fMLmKfe1zEowZ63tz4BpbSq8uIDNJb7F4+pzV5aowxFFdBesKu5gJQHaBqmx4twE3PcsWOy6X06+XBCaHLid02crQpB9HTW1kTAosRA==,iv:ZfBLi9JdINTJKgL+jSdd+nYH6AT1CF7/uY1pzMMl+wk=,tag:e5gdHGCGOEHAHtoQ4s/YoA==,type:str]
-    private-key: ENC[AES256_GCM,data:FaSqZbJF3KQSSadAF80UzwyL4tfXmpwbN93U9PMychaRmbYDSp0jE9pl4a9MawU1JEIw0C2XTMThHkCaJe0NUyKOxTSqMDmR8ThQThcKWBm7rEJ36mPFV+29/+SDiU31J2PFuG7T1sTx+NNmlA2OypIfsAYgg7wygBOLbWqqWq2iXg0OD6eaVElSBgHtLkhQV2RwEUZ35rW8hXYRrAqc/ecpbp6P/GiSQaXpICN9bLnvF/kJ7WinvyoMnU8d4FLRNmSfsrj47PuclDG5HiIiCfi/tXNHuimLgHTeG1CilzfRXEM4rQ8AtxJrn3oxN6PkqTHAj0APe5Ecy9LCP2Fu0Gjb0DgV9Ls3yLboRUbbU8go2NnEVSgB9JtyGssHrOejUPISTJB+OBxd/RVWL2w/k59XSG/auICYN5cXSmGav614zrq2q8UZTxzoKry7ja35mczVNhqm9ZGHT6h38pKb/bxJd0RfKSAHR+55I8RRChwe9Uq6XleMLknYo7osRrCUKiUxWHHq5BOukBgGPBTD,iv:jmHSBU4KvTfO4By04YzQRc9+LY3bQyoy8nK8tgvQkEo=,tag:4PbHQojEu38A/DGli5BRMw==,type:str]
 srv-prod-1:
-    public-key: ENC[AES256_GCM,data:rOTnStMRWEh9t95LNeXt+utobpsFRq5Ugef4crbIt0BbYUu4hZoiEBcaD++yvh3nUcJ7DYHXXi4zqf9CPFxgB6DVA2eCkoW+eFXOV62RDEjLftltoS3Qf7pueDsuGg==,iv:gp+KRCD9SZETMI9XmGLKfztf/zZst7QkV8iWvDd0VWE=,tag:u/JjyZjNHgYR2jjpnjQ0sA==,type:str]
-    private-key: ENC[AES256_GCM,data:hc5NnxaWJsie82YiGR3As0X1DcPVur++TuIsbvGSs1nhZFMl/XDqVYqiAzH9rjwJ4m4hIlV5AsBwLQk4ij6Qb7AMxWKz5SJCLPIkUnnVn11wuaLxSlKoZeJYoulexZHR3BBRLJdYVe7OkZFqGaKtM2YfrTrrCeXq0fyQ6xymdKWEt7bZ44AJdkxuiTUlipVUse9iH/e5YFw3fAycFmgryJKOIzBv6jZjr9DmzxYrrUpaKuL74vhT68clAJXM1qNmFhL6E4dYjXfsI9EWoN0GAaDbhkLh+TiuQt9jUQ/+mwj908HDMlmdCDZX93Ui57drssde8xkGMGrYoddgyPz6nOybT7hITvGggnurtK6UuxouWoB3iM/L+x7Lty9Phy+N3uO5Hur3aX8veHSDqUJMnCEQ3JUx1/wd6YVFo/EhIduHwqsmO49dQY66Nq+5KxWtUDybgy0QrNfz1NOL4WPypjtKCmF71SSpPVnZR0nSqaPFyKD/sV8tRgrnK88RColK6s4jB9x2IgX/jrqgtkA8,iv:BZvjIc7lgby4Vzs6p0f/D2HBy6uiFfER4mVOyYwdseE=,tag:rwLWLFqSAKrqHR8bwMBYVw==,type:str]
+    public-key: ENC[AES256_GCM,data:lFoVjJx0mtP7YuHaCLUHirwKnWMTayrEQ1ceReqo4iqZxUJSynXYG9WYvKAD9yqi8200rFTTgCjNyCpT7hILW9o29Uut0Emt/XsV7ormpPptlvBZD+Q5GzebfIkdnQ==,iv:Fs+VCxgOl12W6Ss7uuMBp+C+IncnMMribFnbI7fo7C4=,tag:Vsqk/eqeD6m03gTXK/hy5w==,type:str]
+    private-key: ENC[AES256_GCM,data:GQPbdNuKXTn/CYW+6xOBg2KKvHy7bKH+TFHqG6bBfLcvRmFypFATd4jMil1XcR6hkQXAJgNCWyr1ys3OLg6c2bg/tc8tLFDPEzhvS+6N8uXNJE88aqB6RIdysLkPdlFyYRGcroazxJ1YYgCo+KTDMK2+1jkmJ3LYT2Qi/TAxXSoQD+Wy16qVywrW2hKL56jOOOU2Bd3BhWtlu+R4Qu5OONcywjbaWrSu5MwF0j9QCWNXRBhHcyN67NFXtWU2rD+vnw3S0HbApTa3zTVEi0kbqYIS7x9TQf3L4PgSewQlF5k1BkDGDYITKfepBT6xLzvwijnxCqumwBoSxXtKLJ3hy4PQk63Qo7ksXf/2rKRgMmajJ2j/qoY+rM9gprtK/KBDs1SLBGnVusR8gMPbG2gKKOM7CHQs6teQP5JHSASZOFnfiak+DxNJFgFaLvW8+FU4PFpw+5KQ61p4OeflmE7IM+yf+52hMuRg1dg7ZnelZCOMn4Ork78MiR/JtMVH+bhBHDndo36PkqBMNJ7HJU9c,iv:dY7vWj18AYN3oIe6NEhqYt3JNV+uekmhEAM02EckbGI=,tag:t9A/L7EyYyGib2ACgRPPmA==,type:str]
+srv-prod-2:
+    public-key: ENC[AES256_GCM,data:SYi6qN1kIcMTaxEv1TyUd3qO067Pjtk6awKMUWAzSeyCyofhTIUOjbZL5v4omyEYOuXJZ57ZYBJ5UVvswlLQZVvgDNZwaLSPpIyYvc93M/fbXWYfLlehRfa8dJhyqw==,iv:qc2b82p5EkeNy6xoiUijgFGzqqF9Lp0IX54kJUmrAGs=,tag:Y2HRs2cWpPpqR5pY5N5LIQ==,type:str]
+    private-key: ENC[AES256_GCM,data:tvi9kYBPWSUVXcRA+ubP0IOs9stEi47cHaCIP2xywCVuygoOH4l7wfYkIwRRlUMVCVud8m0aF3vftBhfeIWJdiL8j+0jx3p9YWGC9L5WUqRkv4Scby+n2VQgLoWUNv4Yl4ftMjbk1dC1MdO3uZGVTE1mQ5G5bZzjvEBPaMR7AsQu5V9QiIaYM0KdbAMrd/PNJoZayRqsA7A3cn6jBjAa28ffp0o+yjLEhWRs61T3CoNX2H9OCO86eE7/K7xSKOW6SrpOsNt02Be9FMZ+0caiErzmnP/iZh+xdRru0PV/S2ASVPFSDVQ80D6P5/UxBlz6D8hlS7lJfnColRP1js1WxiirG+bF571FjjuX6ev9POzOQv8vPG95k+JjWpqakdyn6ZvvO4p5jPGPTsmZzcEFr5si5MGBsjEJYwhaAcVk5dbXtWzH4kVFrQBM6BZDK9ser4Jf7A/rEg2n646PwenGtKtLKqQD1bGBMrGr7l13rPCKKNAO6b30dtgTN9Qt9plb8GYU1kNxcyWwZ43iE4ch,iv:Q04dDVoH1ZJ2JULrPEU2rXECshv7RqEM3X/GWhjd4uU=,tag:N5cTNjYi1aalKnLhn/Be6A==,type:str]
 srv-test-1:
-    public-key: ENC[AES256_GCM,data:qUjaXX/zojLwuv6ZGr3tpfFZr+QzQpwXgNejEj+edNI888pWCYHSFndRbCSyLuyPK2m4Av4dp/f+Hse2zVc/UHenOYPY7EnXuy8+Z49UTUiaJTUsTPYNA7GZugCw2w==,iv:XqW7EATqC4oGOAX4RVsMl9FDY1nDrHpCrNutVGjCX7E=,tag:lcDslArKBWgYjp0DQt1h6g==,type:str]
-    private-key: ENC[AES256_GCM,data:DbzONsB/LdhKacN94NbQnQI8F4VN7pntAIdEbDVzAeZzz9D0apAIAjeBAliCktHjKrK/Khyxfe3X3CB6boGOWKv/clHAS/zLV1uqdRHW/fC1jQNOySSav3bjlFFRTwEDv1thHyTS+20u0B/BAVmrxbrYBtmdeLrGlq2gS8uDdqUQ7C4DbgQY1+F5NCf/MD8ElihZvmreH9bw4LkRFk/KUj3Typz4hL9HK+7IlMUtHdYpQxCPQT66hoj3gHbg4eirv3s94hRjBZt2WcFGjsMHXtGE0Ce7fcaqJJKsXYWkQvnrbXvNEUwum5i2M1PHHNpRXRi1mrnLOMxqsczlqwA71X6soPsu0JeBwnp20QEACdNzJBa2Vkrk84FRXkXHYnExV1113mHFhtXSJKx2noDZJP4+bu/aQBffjrp4egSC08mdsivME1OQQ12x25NyX4YGwiKH5KgP7OXaNNCFA6v54ewi65kiSkLI9P5UkEphQnbGnLcwUOBnKo4zrWDaLbS6z0/y+O771ksjIZfIaQDs,iv:Fw9ggQcbxPTwmQftypkZrdkgUWOR0Qn/GqW61zQFofc=,tag:WezwZlLF8VDcnfi7cgHZZg==,type:str]
+    public-key: ENC[AES256_GCM,data:TqGVICSKnk479fzat1eoZgQRAinAJal0Dfq/Wpm4CfrdjAwiMS+48jiadcN0UD4DEpWsrfuuhgsjlJaaHiIFNjbxiOolI3YKA3M4lByB74ykdb0PoKhybWaGTFo8zw==,iv:DHBvcqEHwGf5BXq02xnAL8/fmfQ1WEqB7lRPuJ7CGPU=,tag:g9pTX+taIW9kwM3mooj00Q==,type:str]
+    private-key: ENC[AES256_GCM,data:acKJ2MhDVPL/ex1Xw8WiPvagqzNRppJ1yC+8hqjmaseMhruUQ8z60vubE7ndU4MUPLcleOCfoSOWMNKRfT9HsGJb8/ElD8pbYuzfA2DwMDISiLgeZ+tgQPL5C/zUH0OcCZrxvVPuzGsUXKlYTW3atuAu/FcKzuwVcXLrl0E34z/MHtBZsCtB4pAxTWZRI4cUU/J438sOUdxw1ZosL7XsRkCJXpMWGUxWD2bLjrofijE9WipkuNlNB4M7OJsrBvIeGabh6N4ZH3R0Lj05+TWAIptgjCWiChrPTW5VUFrKSaYyvNryJkkrSdJkv1jpJtKn+YUWsT4XtNMIaNAAzcIiDozvJxbvUm1nPmJToXgKxGoTlBjXFYsDQaAJnCsXq1k9zYHxMSmYUbELmGfeCyX5k51bGC5NadGO4QkV4Zr3dLrTCTO6gThNc7xrBI+JxXtnMGsm9K6lt/sw7rB7DgfrnEgzrQxPybx1SHK09S6cO2ST3OvoqHdAnXRws1NPMK8sl+I7MLjFqJ7N0ATFrny4,iv:PF2vm2uAhlIvWMuk5aZVACVCnHt5n+pHjX3DoUq8qyY=,tag:DE2UAIhJqXrbrfCXntdgGQ==,type:str]
 srv-test-2:
-    public-key: ENC[AES256_GCM,data:Lh4LXtiDbyUUlgP16zLgiIVGaZeZkse0EtWpd086f8jd+yYKx6qcPwRUJwDr/58Vr0w4aSxZhoeNzWH1WemicWgvqm5PQwPMRPrhj3ZaXTE+G9o9lzMsjX8awmGCsg==,iv:B98fNXEKsBwmuLd3kjwDmChCGscmB3nBv0bwIBQzOpg=,tag:nnLlKQk5ex/2Z8NaSYVDBw==,type:str]
-    private-key: ENC[AES256_GCM,data:hG5//921ifXk34ps2aqveaDNGKxm9m8uAbY7Ge3Npp67WdOMDizjimMJcRYT/61pnFKsbgmFj5Y9REUHBBNu+rlahnDYDhDGhBqmOU69QYB768fq/DT7ukZk2elFjzRdI2muY4anebQP+0q4+nlO1m+8ZrF4bdBOAd66KnAJtErNP8GzmxC0cIjnLJY+6NNfcSN68Ba3QpUezi1swaoCFixDWCbpnriVD2ErdeJikbQ3ZQRmjT79CnpfF2J9OvDoyfmzBWYW4Lwk/yh/fVAADzqYTjOy0EarYW52u3zNJr7eOBozOmY3+sYwIalyyJ+1yLTkbF72i5qki6dcr3j6249d9Yh+K0n1SnZJ6YL9Oc9+FWQ/36O/11iQI0p08bBym+PG/tyJG+/FNrEVPdJk7McRszQN2IXoWOxPK+XWNc/iIieYvKW9UxGo11mni8KzcSEKAg94ZqYAVz+frZFfAwxrIu4RPpcVYL7OuIKI/gWG1qeDKEmQftlu2tQatg3Y8QMSoNpIiPP+hC63YUVm,iv:8FaS4iBxd/IFs5CHQOwW79NzMxGKSHrlniGG+8uIau8=,tag:9vnYs3w0RKhyFIIEKFVFCw==,type:str]
+    public-key: ENC[AES256_GCM,data:fTADjfS3vq5Ufug5gXPxt1cXC6MNxmQN+Zug5IVct6vWxMZtlOEM6LecqQmxIoQI202O+6Mt/x2rz6uObyvVfu4vskWA6B+wAZjR3vslaNwiahMtZAbunrJrLG/hIQ==,iv:TgBeJ6KODEvqLRkKGhNhTwVv8tfElpO3VHe5Vxx9amA=,tag:THYw5ja0ba11thdFmGJ4wA==,type:str]
+    private-key: ENC[AES256_GCM,data:yMPYwKJWAVhNwBlGfxQOKDLZA7g+zwX1szNtyC5M/WxT4fmKjoEZY6D0daIJKyQr9sfsAidtMa2fe9lN4RwCFKfXx1Vw6rMVXuoEKsXaH/JNHmP5qBf37fcb4fjiM+5c8OdYkc8/cr74lKeyV+Nnz3xiKoxo0MaqVxDUrRC1PoqK5wsRKkhvda7AQLCygdMjhL2VNNVhwTiZ2U/OLEth4E/UIeWfdogZ8kKGb/gop3qLxCtpik41+ftSqD1SHfMUeA6xjzG66KmMolo1KamuXd6ORilm+74XLpaNmdX6T+o8CAAWyzc7vrORhrsWMspCHqMi24NW/rCPZpQJENkBPg2FF7PcRi6OZz0URlOJrGUC8ZV2BpmfngJaLa0c6ShBDP+RXIN9CtF+xMRMXHpAilaTF7Ckxj+kOebsWSb5Nj9FWa4C3dwNah7dlxueZhbOtdXpQNd7MBggBORZrSwoxFphm1KKbI9h03asVGsHaY52/D7fvGxbYOXU0UfAKTjVpbic9UIFdH2J48q/Uy8l,iv:ogwekTj16G1tpG8cw95bsjhn540q/mKKoDCnWVPXHmo=,tag:z2mmpDDHvkYJwUm2YSouMw==,type:str]
 srv-eval-1:
-    public-key: ENC[AES256_GCM,data:Qm6Uos0uuSMF0hIKn8oJMtHDRQdeQMsANcW9TTDrdR81PxYT4Ljr7uQdohdy9/kHKBlaNqPM6N8+Ddtv/JBgmQ0pMhE82CTlBXzUlPAgfNOVtdCPx6NSrdxDzRNX7A==,iv:2HdCVmOWeF4hCGEqZu3ZA+bgKhE5govALQi9DNQaFJk=,tag:imi/gFq2BnI3zd3wdMwgWg==,type:str]
-    private-key: ENC[AES256_GCM,data:WvkztQpAGW0GAVLtZ+PROTbhHXXGooaBvu7l46KHaQmnd/6h6F9K0sEaL3LUxzePH5/vTBmbi6fAQ3NemfSeCZbk3k7LyZlXjSBdr6Wr7+66yBR8dp71eqiGv75nVy9HJ31JO+Rvzw9327iObKIW/VK46ZCZ5j+yCmkMlnEJ+/FcEIT7bEXTybSlIJdEsV3nRUVwk29E8ZSoaLfng+H6f7LWPeooNMFmP7e6Ysl9zb4PPHnr7E/zdCJ4DSNLQGxToe/DjCcJTpFAiLzkPL+i3k4hpHQdvyELcA/uEYTpJVxrvpD/pbpZXhz3SEG441cuDRmr0+4LREEcJ1+vkACLvGY1JV6oYbjIeZCZihVXuLDNdyPgc60BNIspHbJeZP0sAIrT7q6nHkart7tI8z4PhFEkxDHYtI8WKAtQkzeFPx3T0qpUxMHT6GZxhWyHEL7UpIJw01UEMLQdx43KJuXG00AHW6Z/agMywyWD5+2MLukzy2t92zdmkAqrTCEVnY9/UwKUPFBtVXWXTufTLyEL,iv:CLQjZI0NqwP670HY1gSVBvaOKYuaQd+VqRq6yiP9r4k=,tag:241WFXqPWsvxG+GP/eSUVA==,type:str]
+    public-key: ENC[AES256_GCM,data:YMGM8b4slmv8s6yKzkB8417XSU/T7NEUpovj7le9rlkzF5ok0+/ZSgIzxYL3xf0OgTIObL+h/+fjvB0jmKln4xNG/WA99/NxdlgWdriubloAuhIfs87mhPr6vDe6Tw==,iv:Mj8E8Rl9nhrS+1+ECx7ssjJlpkdZYkJZ9AEW0/n8nR4=,tag:yHnK/GVXYyCH5ZVum6T0NA==,type:str]
+    private-key: ENC[AES256_GCM,data:FDQKZqlymJPi5+qIQRmgw03MvH1A5mVvSrPQeiAG2ZyN8vCcqwFRbuNR5Z7UmW+wbPV5tcAolhv5Z8eVwgniJ8sOIyh9ohs8sNDo2T4oxJF1GmsC4gD0vT2RUzqUPer5ctP5z5szCAFVTe7n9PxJ2eTbdMZVYmj+E7etg/0B/bgiYxJqwVKAm1Ngc4pWRR3dK5OmOMS//Ojl5S8hY+mykwDC23zGyImu0+5WKaJJ8xF2GNvj552rYUHe6l3Zr7jdltmQ6C4b6eF/TP34/UJfb9eFbxdh3TCC5POA4K4zJybVduwO1ry6SmFMilcTV3KeJdJLyquDhv9lelaNqQTcgSsIexFH0FQSVlOM3fbO+4jVxGUDwyiV5c+2yMTUBDkHl4vecfGog9TmUs0dm3B/ALtNI618+TCbN79T91601xrOiqdZZc3pElr+hDbqDNrck2Q1lt8lvgJAzS+yEeozKlZvu2DL3WfmSXw8qmpX5IblKhjOJzz0m60Os5x4+e6gV0kxXhZZavwkoy7TxNzY,iv:mBTJosUbDlhjskNx1HYKxk8kZVk7BHcIud+ogklruvo=,tag:eTOO/SJeSVMIPu99OFcn8A==,type:str]
+srv-backup-1:
+    public-key: ENC[AES256_GCM,data:hUEzhuMbeVOzhDbsu9XjiOltTDBAQ5QbdX3Tn/qbMSsXN0Ia2Q3V9b36XZBHGMh3GdNKho0tspbxsZeiFnjJfoHRUAwEsARHYESdASAGREcDuLJkQ3tUKlVyTBTPdQ==,iv:DVmH/z2IrgJSc+O5sABv3cfzggc8fAUz+v667CUOslo=,tag:4KQMJVavYGI2wUOFBrJpuQ==,type:str]
+    private-key: ENC[AES256_GCM,data:yeAnV59Y6uzH2epmDGh3YZouXF7kt/8aplQ5LMsIA4759MPuQfaJMSzDumyvp/g2mkkK8Bp6vf0Aztjy1LcA0oaF4fLCNQNUihsqi1s08Bg1s+SXK3X2zylDjO6xJgs6pFHbDezSKE7ahtl7rA+dtcLt+YAcCyBBP5wNUEplDp7Wn/0GfjOWnD5u2uQVxx2fKbs5vMjyIiUv66ti+LDdYha8o/Z2uvkND3ekauYYliCrrRrsz0+QeCyFQvPydhgyRd0CWvByEHjQwwFqCcJtkeZ6aMM9Dkt7fXAzW/TlsadPquGu9zpy2QJwj8wHn0gWD1Jtkq53KhH+BfPm1cQErTqKetR3JD+z+2LZI2j9Mn51C8KuLVVGQzwtXdED41AORu2kLlcTxgu2RoLiH8MnMfWCalKMWQKQvVyEN3exY1Isrq8a0JlLZnWXYbOop+TcGrmlnmliFlURgS/+zfFCYUm1A6lHfa32LkG2JDUIF5LnBjTMs48TVtnXWMRs1RumGAZzJ2NaYGcJFavcwUdN,iv:2vhKPN68Nn7WgT4vHBspisIY1jtdE7hGaZv8RpgyW68=,tag:xx2GzuSY285/KL5mX+YI6Q==,type:str]
+directions:
+    public-key: ENC[AES256_GCM,data:KesP7u5LvSv5vIrSJuSq/ekWl2rrkJheXXUPwrZyaxVy7t89sfhfun5c4ag3mnLGX3Ci3rkO9ALjgBWV/9Adr/2SaplcbzaboKpx/i5NwJpZyOjc/JaTbVJsnGzUiQ==,iv:Efto4zh5Y0oJOjxNH18+ejzZCp5CszvFrvt4zQ+1cco=,tag:wCUbDvmRuRYkQj3KkOX7UQ==,type:str]
+    private-key: ENC[AES256_GCM,data:7NHpqnBiOQL7RkXKir4+EYvXlsAnq2eqWVtbXuxwuU8Ieq6X7fACstqyd/Sx6lM+48AjOmRe1EP29NZpjE8iJMUGm7qYzoL2mRbowSi2/yykafTCi852t5Nk1GBcSTLjqjBHpufK1wiqcqxXogQqUL3f6fjoPkOlgqjot1bK4T3GgwIhioeCsXSpgmzsyvd1h/5SiTErUGt0UP6NkVLBEa4HQE/hzR30ZSpXMYKbDjm2+5fxJzfwO4JJ2PUdubAuerx9eOiSf1I6Kh1Paxi/rNEtdHDF9EZmZ7FcQTHpPqYClI1JLLR8ahkOSnX3PK5hOsnCxNE/Ib84Q09OoHJ60qlH2ZqjFDta3RL2K8842ZTB4x5fWaJlpyP6S3lM68KXr42Jxwt0Yi9JSfWxxLHEiqKMH+IHkdIGvEjLKv6wzQFCGPoj0rg70O1AVYw/aNfja2YlSusmimuKjLsg6WiobJHfajw0YsV2swrrsUw280/gvoZ+xmGsHG/WnSBwNGbCewbmH1RlL3Ctl3Yr6pVL,iv:kvcgIWYRX2/vGgPs5yZKOHW8jnI3xNvCW8Xlg5rwqeg=,tag:B2V02dzfz1SBZ7Q9pxi1ng==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -25,14 +28,14 @@ sops:
         - recipient: age18mrc4ttzg8xldevwfvtxqd0942hlv2az75l060flc4c0tqnmkaus0ueqpl
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5bm0wN1dSbmZFNlNHd2tJ
-            cU5RMjl2VkxZMVlNMnlPbzZuaGlqcEN2MFRJCkpjMDhsSUNEOFNzV3NtWkEzNVJO
-            elV0SnRYbXp5V3RCcVRkbmZuRzVpZlkKLS0tIDlvWWtuTURRdjVpTElVRTkxSE81
-            U0dLUTMzZmpVcGd6Z0JFTlVkUzRqM2cKJrrdw/wiDJaJ6DYnQSI9GHAPF5kCqTFo
-            R7yC70MWbv8MOVtRTpQ5uCShoj4j6sdikYqA65ciKZF0mAPGkm07Uw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvb3ErOTdoUHgrNVljR25B
+            aUhQUjAyc2RuaUVocVQ1bklJZlhTZjlDcW5NCk5TeHZoOUpEaGpOTW1NWW8vS05s
+            UmE0Nkp2YmtyQlNwT2lBa0tlSUFDbU0KLS0tIG5NSWxkMW9vUmxOeGtFOWdZL0NU
+            Rk5iNFFrSjlYVEJyUElzdDhsUk9JSk0KnKWeNPedKCJCG4PiT/X7Etdvg/tSYXmz
+            GAZcnF2eOLM+7fkpjAGjBwcVfk14QUttQ/w4T5WbmK48eh3V3jN06A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-01T19:23:45Z"
-    mac: ENC[AES256_GCM,data:wogUz5rNkxdNdZEu1tIs9mL/1plpoSoOi7GmLabCnAFUy0Pa7oX5WEIqtR488prIuGH81sVLe4XVeGbiDjJBsuZw4rKulM0K6UXvaoF+IsYEe4h4G6ZR2JjZ+9ENdeG3gseULkqU12qSXNmV0FgcjPHMiCEiAJRKvS9jroqUMK8=,iv:w8SKcYGRwxaGj9xt66Jo/5tDNK3hrLG0rb+C2H30tkU=,tag:SYL2q7+1ugvvqaXJQ6jjLQ==,type:str]
+    lastmodified: "2025-03-02T13:31:08Z"
+    mac: ENC[AES256_GCM,data:fQH1F7VZ2bbTlDPKigq/uU9T08bYgpvAqjupnC98JLmlNppnLJC1XTeccjyVzeGNl359OPNHKeKUYNPUfrrjYvFzrmWn0EqEtA9cWUKx64Bif9OHzTLPGpBdaChBFT6Mj5vwoi2niGBqjd5u5LFl8RNdmlRO4haLnqSTYg4CFHI=,iv:vSqISULbEeaugvdGcKEaduPKFDHySC36ZZNkcKBEfLw=,tag:CLXtkbSLzC3Nq69YVWERKQ==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.4
diff --git a/systems/x86_64-linux/srv-backup-1/configuration.nix b/systems/x86_64-linux/srv-backup-1/configuration.nix
@@ -0,0 +1,24 @@
+{inputs, ...}: {
+  imports = [
+    ../../../modules
+    inputs.nixos-facter-modules.nixosModules.facter
+  ];
+
+  facter.reportPath = ./facter.json;
+  # see https://github.com/numtide/nixos-facter-modules/issues/62
+  facter.detected.dhcp.enable = false;
+
+  my = {
+    host.role = "server";
+    modules = {
+      disko = {
+        enable = true;
+        bootDisk = "/dev/sdb"; # 256GB
+        storageDisk = "/dev/sda"; # 2TB
+      };
+      tailscale.enable = true;
+    };
+  };
+
+  system.stateVersion = "24.11";
+}