From 3e0e98f9aa13c95742faa757df42cc1ec8bf78e4 Mon Sep 17 00:00:00 2001
From: Patrick <patrick@failmail.dev>
Date: Wed, 27 Mar 2024 17:05:20 +0100
Subject: [PATCH] feat: enable scrutiny smartd monitoring chore: update
 your_spotify

---
 hosts/elisabeth/fs.nix                        |  28 +++++
 hosts/elisabeth/guests.nix                    |   6 +-
 .../netbird/generated/dhparams.pem.age        | Bin 1422 -> 0 bytes
 .../secrets/yourspotify/spotifyPublic.age     | Bin 747 -> 0 bytes
 modules/config/users.nix                      |   1 +
 modules/services/your_spotify_m.nix           | 102 ++++++------------
 modules/services/yourspotify.nix              |   9 +-
 pkgs/your_spotify.nix                         |  51 +++++----
 pkgs/your_spotify_client.nix                  |  27 +++--
 secrets/secrets.nix.age                       | Bin 5733 -> 5639 bytes
 .../scrtiny-patrick/keys/elisabeth.age        |  16 +++
 .../scrtiny-patrick/keys/elisabeth.pub        |   1 +
 12 files changed, 134 insertions(+), 107 deletions(-)
 delete mode 100644 hosts/elisabeth/secrets/netbird/generated/dhparams.pem.age
 delete mode 100644 hosts/elisabeth/secrets/yourspotify/spotifyPublic.age
 create mode 100644 secrets/wireguard/scrtiny-patrick/keys/elisabeth.age
 create mode 100644 secrets/wireguard/scrtiny-patrick/keys/elisabeth.pub

diff --git a/hosts/elisabeth/fs.nix b/hosts/elisabeth/fs.nix
index 24ea2e7..3abaac0 100644
--- a/hosts/elisabeth/fs.nix
+++ b/hosts/elisabeth/fs.nix
@@ -123,6 +123,34 @@
     };
   };
 
+  wireguard.scrtiny-patrick.server = {
+    host = config.secrets.secrets.global.domains.web;
+    port = 51831;
+    reservedAddresses = ["10.44.0.0/16" "fd00:1766::/112"];
+    openFirewall = true;
+  };
+  services.scrutiny = {
+    enable = true;
+    openFirewall = true;
+    collector = {
+      enable = true;
+      settings.host.id = "elisabeth";
+    };
+  };
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/influxdb2";
+      mode = "0700";
+      user = "influxdb2";
+    }
+  ];
+  environment.persistence."/state".directories = [
+    {
+      directory = "/var/lib/private/scrutiny";
+      mode = "0700";
+    }
+  ];
+
   fileSystems."/state".neededForBoot = true;
   fileSystems."/persist".neededForBoot = true;
   boot.initrd.systemd.services."zfs-import-panzer".after = ["cryptsetup.target"];
diff --git a/hosts/elisabeth/guests.nix b/hosts/elisabeth/guests.nix
index 61a7bfc..d826150 100644
--- a/hosts/elisabeth/guests.nix
+++ b/hosts/elisabeth/guests.nix
@@ -200,10 +200,10 @@ in {
         }
       ])
       (blockOf "paperless" {maxBodySize = "5G";})
-      #(blockOf "ttrss" {port = 80;})
+      (blockOf "ttrss" {port = 80;})
       (blockOf "yourspotify" {port = 80;})
       (blockOf "apispotify" {
-        port = 80;
+        port = 3000;
         upstream = "yourspotify";
       })
       (blockOf "nextcloud" {
@@ -308,7 +308,7 @@ in {
     // mkContainer "vaultwarden" {}
     // mkContainer "ddclient" {}
     // mkContainer "ollama" {}
-    #// mkContainer "ttrss" {}
+    // mkContainer "ttrss" {}
     // mkContainer "yourspotify" {}
     // mkContainer "netbird" {}
     // mkContainer "kanidm" {}
diff --git a/hosts/elisabeth/secrets/netbird/generated/dhparams.pem.age b/hosts/elisabeth/secrets/netbird/generated/dhparams.pem.age
deleted file mode 100644
index 2e98730bb2e70a75a25b90454bd483d20fc92962..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1422
zcmY+=_ft~`0KjpqiW;qgh+5C9DNw7thJ=ubip|R)A@haoQh~heokun<Mu(mQ6kOn?
za1KNTR4P&sPm#KcC{{UHRaz?Gs0t2{LhBFx!N1^h-*2W~i_zL(#P4t!?Y1~OqQ`pT
zQJ5sO0#78yQ_(oR*a_MLOoSt(F?jZPHifM7D_8`8>6UwKCcBhtPZ8s}*31L~$|`V+
z_4X8)m!J#K`9vm6pmSAr5DyaEHZcUSC;_#Z?Qt4GJm<aOFnTZ!JduP}NFcM6hNcDB
z8l_yM!)o9xB`9(NIH?K3@gb1L<!dEm4MD;I6?%$FOT$Abz#{e}bCSvN8Y$OFOyGI=
z9Ely2!Ezf(sNfoK8mydSKsd@|hx7wW#nKx&UNp_0s)f`pua0F0EJB0H!XnYFFp&*7
zD14dE&nM}eUPMEdskD$4C6&l5YCcT0ks!Jgr0e_^DiabCR6?xGiKIZ{<anu(V})=M
z9qt2*=&_1i5Sm7%AS{m0X0Y=>k<lcei>-dHQjCZabmjzx08S;k30gU#b}Rfm6jP$g
zbYO)9w_GidQ|Ss4%tQ1_hRK#<bhC+E04otFaV87FVfoPdzl-eAD^yMwIScpSZ=+a`
zu(>W%Kw}VTwLXVQh)+&VW$097*k`by#7wW7<u$6<YBPz76-d==Cc%xR33#A~sAe$?
zcD*?(*_f$~7gFALS+OEG3ZqA~nORyiC*6rcVK5l9OD<*;=w1g`MPc%@Qjq|GngDnO
zpwohd`2gRib32J<KxdIiaHy`OBW-6tcP}di8u}W_(jLsVy+EI0-6_t%8jcmb>|lsP
zJ9saI8HeHq?SxABSjEm@#ovE~l90}gqsme?*zL!}cC1)nx;9)m(Rg#DclXOILr32Z
zTkxi!Ulj<6>>_Qxc>x)>OFtGfhNiJ)bvJS;cg9*;dDME%;|Eo@i$0O%sjJe>#P15f
zo(PGrU#@0MChlBZx`~wr&il=400vIywrz6b%k%l?f|VfrGQIp_RNWrgb82XI&9BdQ
zt<L%sDrww2`p?@{Wh-+tvQ7J+w8%S)dPYLOm*w|upa4%RN@Jrrv1tq2Mso&^_-3_?
z%l<sQm>iC&`K4&E8un^6?Iym;^CY_nrZxrlgVj@x?Aq(ge17(*IAd-2>W4V|bzRIt
z+3tuN$m`YHcC}u4lk@ZC$S>xW9q;E9AC}>NV%};2r-u=6SDXF1(k(V#^SQElR|;MX
zZ4M7an(+_AR;;^lT<MEeQ)Av;m|Ajgk8D-HGOs9I-J@W&&p8x=s-#5>b*)&xb=%T9
z=y*|Fb^8Kpa4O~A0akN;_son(@ch1r!P2p)+3Tam-%T$*g=s8(J(1Viba6-5lbt#s
zJ3Ec~X6?O>^pb;>&A%tQ?+3%@Udg+-=7-vod%K~UqeBOqS60nTvM-N*8cGRUGHu=D
z8Pu}DRaQn!df%FDkJP&tZuN0ff{{JXiUX#eSDOYL3iMgAD9BqA@nEFM@%9kVaLwCm
z+FXBkY&>W2>a9uF4-3jJecPLl9uyj(+*<RD_=>tk<twW;=1xKfQv0nX+S=iF+fxV1
zcXf8opA&ul$L)o~lTm>F>ZX%@Gm1@rEkbU+NkuglaH!|II-90$$$!<cE+Q}XtKnm}
zLIzJ)Ptn$Yw4obE&YARtod`3#?#EsSC+|+g77vfMZ0JZ#^e{_@$Y*Mn$Sw`@uMsz<
zh>ZIt9tTf!HCDt0q$1{8JU(f>z+M$h!{#-gZ2R&|`m&hY=TEfn>!dKkCQ!F#eO7X(
zcb?!)59w`?T?;&IpXXfMVA%EyEOephQ_>IbD_gJFUbbbd^_%R9h|7W7ovwrb0=G?J
A1^@s6

diff --git a/hosts/elisabeth/secrets/yourspotify/spotifyPublic.age b/hosts/elisabeth/secrets/yourspotify/spotifyPublic.age
deleted file mode 100644
index adc3e170cb06c33a342733a3018c46825df84bff..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 747
zcmY+=JFC-R0Dxg}5X>(SU5Y3Op{GrgG>wDs<+N$iG)dDWZQ9AS`I_d^FPApgvpcyt
zxVeZZE)EKUlW-<=brf|F1QEgI%<AB9e!;{0+AeHDv`(w|;6>;tO5IjYV9h%Xt3%TS
z+fa6z!1y%BY&+XXUEt1vYy+>HatFCwDt(|CENK$E0U?;!SRL1OCUym{E%(NH3RX5>
zfo^P}iQDsuS-$DA#X=D&-2ErSUfzs5bhlv{T3~_(K+{gLLavjyhGCl)OirsEmBM{~
zwP(<5Cm&D1kV=*aDr0Pow$_4HX+ATke#HBuzB(kp!YV=nZpu9=7g5Qp%JI0}J7+C<
z*At5dNMk|PU>Z}AXxE|YtqW;Z1pzP*N**ZlT^Y;=out?XYaQbxp0;dJ;x;@#6csfx
zBrrfW7f*wd3$2BoW^!f~iWL^;EIQv!4q5|HC>LN0cd}8(Fji`6T07QSX*&6Log_eG
zZ^?E6jHNTnv3k~nrc?D%zSlN6>9mkXIL6>m$2<sng@+ID%pYwMX?gzP|E{PLk>pl~
z39nTqwbvsQ!?hGmj|&B~r83=@SvH;oqE!pn1TpRs=6=U$b?YGTHnU7%;0%bfpyJ)h
za2`UcKJKP#SN_)pnr;g1J;cavxDzHDcRVsslv{d0CPv_8w!dky&|9&hQtH#gG}kG)
zPcITU$HmriNG5w7&nA^2Vid=Xux7K_KvfLPoay<#&Nw_|hHTp<P-P{Gjs%i%eFM%7
z)?Tw&gq=LO{r>aiv#U3rz4&_N`OjZ>U%h<uNV<M{T6~cnV?SQMJrO_M1P`9Be_sUm
ZE`9HRxb^S|Kf6z!g{RjpeEWFx?hlK#{}KQI

diff --git a/modules/config/users.nix b/modules/config/users.nix
index fcf72ed..59f1628 100644
--- a/modules/config/users.nix
+++ b/modules/config/users.nix
@@ -32,6 +32,7 @@
     authelia-main = uidGid 222;
     kanidm = uidGid 223;
     oauth2_proxy = uidGid 224;
+    influxdb2 = uidGid 225;
     paperless = uidGid 315;
     systemd-oom = uidGid 300;
     systemd-coredump = uidGid 301;
diff --git a/modules/services/your_spotify_m.nix b/modules/services/your_spotify_m.nix
index 9e97b50..3eb2ffe 100644
--- a/modules/services/your_spotify_m.nix
+++ b/modules/services/your_spotify_m.nix
@@ -17,6 +17,7 @@
     mkPackageOption
     optionalAttrs
     types
+    mkDefault
     ;
   cfg = config.services.your_spotify;
 
@@ -32,7 +33,7 @@
   configFile = pkgs.writeText "your_spotify.env" (concatStrings (mapAttrsToList (name: value: "${name}=${value}\n") configEnv));
 in {
   options.services.your_spotify = let
-    inherit (types) nullOr port str path bool package;
+    inherit (types) nullOr port str path package;
   in {
     enable = mkEnableOption "your_spotify";
 
@@ -51,35 +52,35 @@ in {
 
     clientPackage = mkOption {
       type = package;
-      default = cfg.package.client.override {apiEndpoint = cfg.settings.API_ENDPOINT;};
       description = "Client package to use.";
     };
-    spotifyPublicFile = mkOption {
-      type = path;
-      description = ''
-        The public key of your Spotify application
-        [Creating the Spotify Application](https://github.com/Yooooomi/your_spotify#creating-the-spotify-application)
-      '';
-    };
 
     spotifySecretFile = mkOption {
       type = path;
       description = ''
-        The secret key of your Spotify application
-        [Creating the Spotify Application](https://github.com/Yooooomi/your_spotify#creating-the-spotify-application)
-        Note that you may want to set this using the `environmentFile` config option to prevent
-        your secret from being world-readable in the nix store.
+        A file containing the secret key of your Spotify application.
+        Refer to: [Creating the Spotify Application](https://github.com/Yooooomi/your_spotify#creating-the-spotify-application).
       '';
     };
 
     settings = mkOption {
+      description = ''
+        Your Spotify Configuration. Refer to [Your Spotify](https://github.com/Yooooomi/your_spotify) for definitions and values.
+      '';
+      example = lib.literalExpression ''
+        {
+          CLIENT_ENDPOINT = "https://example.com";
+          API_ENDPOINT = "https://api.example.com";
+          SPOTIFY_PUBLIC = "spotify_client_id";
+        }
+      '';
       type = types.submodule {
         freeformType = types.attrsOf types.str;
         options = {
           CLIENT_ENDPOINT = mkOption {
             type = str;
             description = ''
-              The endpoint of your web application
+              The endpoint of your web application.
               Has to include a protocol Prefix (e.g. `http://`)
             '';
             example = "https://your_spotify.example.org";
@@ -93,28 +94,18 @@ in {
               internet.
               Has to include a protocol Prefix (e.g. `http://`)
             '';
-            default = "https://localhost:3000";
+            example = "https://localhost:3000";
           };
-          CORS = mkOption {
-            type = nullOr str;
-            description = ''
-              List of comma-separated origin allowed, or nothing to allow any origin
-            '';
-            default = null;
-          };
-          MAX_IMPORT_CACHESIZE = mkOption {
+          SPOTIFY_PUBLIC = mkOption {
             type = str;
             description = ''
-              The maximum element in the cache when importing data from an outside source,
-              more cache means less requests to Spotify, resulting in faster imports
+              The public client ID of your Spotify application.
+              Refer to: [Creating the Spotify Application](https://github.com/Yooooomi/your_spotify#creating-the-spotify-application)
             '';
-            default = "Infinite";
           };
           MONGO_ENDPOINT = mkOption {
             type = str;
-            description = ''
-              The endpoint of the Mongo database.
-            '';
+            description = ''The endpoint of the Mongo database.'';
             default = "mongodb://localhost:27017/your_spotify";
           };
           PORT = mkOption {
@@ -122,47 +113,19 @@ in {
             description = "The port of the api server";
             default = 3000;
           };
-          TIMEZONE = mkOption {
-            type = str;
-            description = ''
-              The timezone of your stats, only affects read requests since data is saved with UTC time
-            '';
-            default = "Europe/Paris";
-          };
-          LOG_LEVEL = mkOption {
-            type = str;
-            description = ''
-              The log level, debug is useful if you encouter any bugs
-            '';
-            default = "info";
-          };
-          COOKIE_VALIDITY_MS = mkOption {
-            type = str;
-            description = ''
-              Validity time of the authentication cookie
-            '';
-            default = "1h";
-          };
-          MONGO_NO_ADMIN_RIGHTS = mkOption {
-            type = bool;
-            description = ''
-              Do not ask for admin right on the Mongo database
-            '';
-            default = false;
-          };
         };
       };
     };
   };
 
   config = mkIf cfg.enable {
+    services.your_spotify.clientPackage = mkDefault (cfg.package.client.override {apiEndpoint = cfg.settings.API_ENDPOINT;});
     systemd.services.your_spotify = {
       after = ["network.target"];
       script = ''
-        export SPOTIFY_PUBLIC=$(< "$CREDENTIALS_DIRECTORY/SPOTIFY_PUBLIC")
         export SPOTIFY_SECRET=$(< "$CREDENTIALS_DIRECTORY/SPOTIFY_SECRET")
-        ${pkgs.your_spotify}/bin/your_spotify_migrate
-        exec ${pkgs.your_spotify}/bin/your_spotify_server
+        ${lib.getExe' cfg.package "your_spotify_migrate"}
+        exec ${lib.getExe cfg.package}
       '';
       serviceConfig = {
         User = "your_spotify";
@@ -176,26 +139,23 @@ in {
         StateDirectoryMode = "0700";
         Restart = "always";
 
-        LoadCredential = ["SPOTIFY_PUBLIC:${cfg.spotifyPublicFile}" "SPOTIFY_SECRET:${cfg.spotifySecretFile}"];
+        LoadCredential = ["SPOTIFY_SECRET:${cfg.spotifySecretFile}"];
 
         # Hardening
         CapabilityBoundingSet = "";
         LockPersonality = true;
-        #MemoryDenyWriteExecute = true;
-        #NoNewPrivileges = true; # Implied by DynamicUser
+        #MemoryDenyWriteExecute = true; # Leads to coredump because V8 does JIT
         PrivateUsers = true;
-        #PrivateTmp = true; # Implied by DynamicUser
         ProtectClock = true;
         ProtectControlGroups = true;
         ProtectHome = true;
-        ProtectHostname = false; # breaks bwrap
-        ProtectKernelLogs = false; # breaks bwrap
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
         ProtectKernelModules = true;
-        ProtectKernelTunables = false; # breaks bwrap
+        ProtectKernelTunables = true;
         ProtectProc = "invisible";
-        ProcSubset = "all"; # Using "pid" breaks bwrap
+        ProcSubset = "pid";
         ProtectSystem = "strict";
-        #RemoveIPC = true; # Implied by DynamicUser
         RestrictAddressFamilies = [
           "AF_INET"
           "AF_INET6"
@@ -203,7 +163,6 @@ in {
         ];
         RestrictNamespaces = true;
         RestrictRealtime = true;
-        #RestrictSUIDSGID = true; # Implied by DynamicUser
         SystemCallArchitectures = "native";
         SystemCallFilter = [
           "@system-service"
@@ -218,6 +177,8 @@ in {
       virtualHosts.${cfg.nginxVirtualHost} = {
         root = cfg.clientPackage;
         locations."/".extraConfig = ''
+          add_header Content-Security-Policy "frame-ancestors 'none';" ;
+          add_header X-Content-Type-Options "nosniff" ;
           try_files = $uri $uri/ /index.html ;
         '';
       };
@@ -226,4 +187,5 @@ in {
       enable = true;
     };
   };
+  meta.maintainers = with lib.maintainers; [patrickdag];
 }
diff --git a/modules/services/yourspotify.nix b/modules/services/yourspotify.nix
index 707818f..dea2c77 100644
--- a/modules/services/yourspotify.nix
+++ b/modules/services/yourspotify.nix
@@ -13,19 +13,14 @@
     mode = "440";
     rekeyFile = config.node.secretsDir + "/spotifySecret.age";
   };
-  age.secrets.spotifyPublic = {
-    owner = "root";
-    mode = "440";
-    rekeyFile = config.node.secretsDir + "/spotifyPublic.age";
-  };
   services.your_spotify = {
     enable = true;
     spotifySecretFile = config.age.secrets.spotifySecret.path;
-    spotifyPublicFile = config.age.secrets.spotifyPublic.path;
     settings = {
+      SPOTIFY_PUBLIC = "5397a3f2a75949459da343a5e7851bd9";
       CLIENT_ENDPOINT = "https://sptfy.${config.secrets.secrets.global.domains.web}";
       API_ENDPOINT = "https://apisptfy.${config.secrets.secrets.global.domains.web}";
-      MONGO_NO_ADMIN_RIGHTS = false;
+      MONGO_NO_ADMIN_RIGHTS = "false";
     };
     enableLocalDB = true;
     nginxVirtualHost = "sptfy.${config.secrets.secrets.global.domains.web}";
diff --git a/pkgs/your_spotify.nix b/pkgs/your_spotify.nix
index 6bacf5a..b02da18 100644
--- a/pkgs/your_spotify.nix
+++ b/pkgs/your_spotify.nix
@@ -1,29 +1,30 @@
 {
-  mkYarnPackage,
+  callPackage,
   fetchFromGitHub,
   fetchYarnDeps,
-  makeWrapper,
-  nodejs,
-  yarn,
-  prefetch-yarn-deps,
   lib,
-  callPackage,
+  makeWrapper,
+  mkYarnPackage,
+  nodejs,
+  prefetch-yarn-deps,
+  yarn,
 }: let
-  version = "1.8.0";
+  version = "1.10.1";
   src = fetchFromGitHub {
     owner = "Yooooomi";
     repo = "your_spotify";
     rev = "refs/tags/${version}";
-    hash = "sha256-umm7J5ADY2fl+tjs6Qeda5MX2P55u0eCqwW+DWLK8Kc=";
+    hash = "sha256-e82j2blGxQLWAlBNuAnFvlD9vwMk4/mRI0Vf7vuaPA0=";
   };
   client = callPackage ./your_spotify_client.nix {inherit src version;};
 in
   mkYarnPackage rec {
     inherit version src;
-    pname = "your_spotify";
+    pname = "your_spotify_server";
+    name = "your_spotify_server-${version}";
     offlineCache = fetchYarnDeps {
       yarnLock = src + "/yarn.lock";
-      hash = "sha256-pj6owoEPx9gdtFvXF8E89A+Thhe/7m0+OJU6Ttc6ooA=";
+      hash = "sha256-5SgknaRVzgO2Dzc8MhAaM8UERWMv+PrItzevoWHbWnA=";
     };
 
     configurePhase = ''
@@ -32,33 +33,47 @@ in
       export HOME=$(mktemp -d)
       yarn config --offline set yarn-offline-mirror $offlineCache
       fixup-yarn-lock yarn.lock
-      yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
-      patchShebangs node_modules/
-
       runHook postConfigure
     '';
 
     buildPhase = ''
       runHook preBuild
-      ls -lah
+
+      yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+      patchShebangs node_modules/
+
       pushd ./apps/server/
       yarn --offline run build
       popd
+
+      rm -r node_modules
+      export NODE_ENV="production"
+      yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+      patchShebangs node_modules/
+
       runHook postBuild
     '';
     nativeBuildInputs = [makeWrapper yarn prefetch-yarn-deps];
     installPhase = ''
-      mkdir -p $out
-      cp -r node_modules $out/node_modules
+      mkdir -p $out/share/your_spotify
+      cp -r node_modules $out/share/your_spotify/node_modules
       cp -r ./apps/server/{lib,package.json} $out
       mkdir -p $out/bin
       makeWrapper ${lib.escapeShellArg (lib.getExe nodejs)} "$out/bin/your_spotify_migrate" \
-        --add-flags "$out/lib/migrations.js"
+        --add-flags "$out/lib/migrations.js" --set NODE_PATH "$out/share/your_spotify/node_modules"
       makeWrapper ${lib.escapeShellArg (lib.getExe nodejs)} "$out/bin/your_spotify_server" \
-        --add-flags "$out/lib/index.js"
+        --add-flags "$out/lib/index.js" --set NODE_PATH "$out/share/your_spotify/node_modules"
     '';
     doDist = false;
     passthru = {
       inherit client;
     };
+    meta = with lib; {
+      homepage = "https://github.com/Yooooomi/your_spotify";
+      changelog = "https://github.com/Yooooomi/your_spotify/releases/tag/${version}";
+      description = "Self-hosted application that tracks what you listen and offers you a dashboard to explore statistics about it";
+      license = licenses.gpl3Only;
+      maintainers = with maintainers; [patrickdag];
+      mainProgram = "your_spotify_server";
+    };
   }
diff --git a/pkgs/your_spotify_client.nix b/pkgs/your_spotify_client.nix
index 05fbcf6..e764023 100644
--- a/pkgs/your_spotify_client.nix
+++ b/pkgs/your_spotify_client.nix
@@ -1,19 +1,20 @@
 {
-  mkYarnPackage,
-  makeWrapper,
+  apiEndpoint ? "http://localhost:3000",
   fetchYarnDeps,
-  apiEndpoint ? "localhost:8080",
+  your_spotify,
+  mkYarnPackage,
+  prefetch-yarn-deps,
   src,
   version,
   yarn,
-  prefetch-yarn-deps,
 }:
 mkYarnPackage rec {
   inherit version src;
   pname = "your_spotify_client";
+  name = "your_spotify_client-${version}";
   offlineCache = fetchYarnDeps {
     yarnLock = src + "/yarn.lock";
-    hash = "sha256-pj6owoEPx9gdtFvXF8E89A+Thhe/7m0+OJU6Ttc6ooA=";
+    hash = "sha256-5SgknaRVzgO2Dzc8MhAaM8UERWMv+PrItzevoWHbWnA=";
   };
   configurePhase = ''
     runHook preConfigure
@@ -29,18 +30,26 @@ mkYarnPackage rec {
   buildPhase = ''
     runHook preBuild
     pushd ./apps/client/
-    pwd
     yarn --offline run build
+    export API_ENDPOINT="${apiEndpoint}"
+    substituteInPlace scripts/run/variables.sh --replace-quiet '/app/apps/client/' "./"
+
+    chmod +x ./scripts/run/variables.sh
+    patchShebangs --build ./scripts/run/variables.sh
+
+    ./scripts/run/variables.sh
+
     popd
     runHook postBuild
   '';
-  nativeBuildInputs = [makeWrapper yarn prefetch-yarn-deps];
+  nativeBuildInputs = [yarn prefetch-yarn-deps];
 
   installPhase = ''
     mkdir -p $out
     cp -r ./apps/client/build/* $out
-    substituteInPlace $out/variables-template.js --replace-quiet '__API_ENDPOINT__' "${apiEndpoint}"
-    mv $out/variables-template.js $out/variables.js
   '';
   doDist = false;
+  meta = {
+    inherit (your_spotify.meta) homepage changelog description license maintainers;
+  };
 }
diff --git a/secrets/secrets.nix.age b/secrets/secrets.nix.age
index 5330234e836597efdc6e3e07213e70992eb22c84..e48814c2b5b79385d89a2c2e317e0b6b73b5f382 100644
GIT binary patch
literal 5639
zcmV+i7WnC5XJsvAZewzJaCB*JZZ2<fXD@a!3N1b$STZ#=F*zVlG<a4<d1Y8<H&|n4
zRCF&-aBEg#YcD}BZ)8(7MrAg1b6H4KD>*krcS#B|dUkj*Z)7x2b~RyDW<)bZOEgPr
zaC%yCSu0CyRzz`OZDm+<cy>ZrFi{FEJ|J*ub}eu+H8vnvR8ebHK_EdiaX2w}YjI3Y
zT5K_JcX(H2SyVzVRZuTXb#z2nO;<uqNLEgHdP-ShR&EM2NNjB@S7K>OZE|K%c6BQ>
zWK%~)R%}Bub2B$dS#(Kyb#iM;YGf-jd20$SJ|J*ub}eu+H8vnxMrUbBcOXG9VtI0Q
zbx=kzD>zqnR7pf+S9MxQHd!?}S7mcHFk^UnOJi|EcVtR0GfWCpT5MHSH8n+Sc}Hku
zFm`T9Nl|D=acg8mP<n7|QfWyvNKb2YbVWfcZZrxlJ|J*ub}eu+H8vnMc5P5}Q6NEa
zc6Ts%QF3~6Y({5IO>k{5G*dZJFitCPX*f@DD@0FcQekasP*-S4crXe~XG>yMOKoLC
zVOlU}NHi-<dPy^7dUH=VQ%7@EaYJH6F>G~ocWq2CVnGTmJ|J*ub}eu+H8vnxMrUbB
zcOXG+H8^)tO=3AQY*tESZ*6QeZEtc^Z&Ft|PBLa!c5r!jF;-AacSbfbPC*JaHF9n?
zMOP~`K{-<}O><^gGg@?YQDsD7M|D_BFJ)$Wb5KxBT4zQzGF1vKJ|J!_XL4m>b7dej
zAXz?TAaY+}Ej(duW(s;ya92rhX>K-hYBymuQ&ciaV=FI0PjhKe3N0-yAZcM}L2EBf
zI74h{GH7f_D|cpaLU&|0Z&P_eT24_%Pcu<wSW<RrMsYz+3KrppH<DNoUKa|Ari?ea
zz~RwqN@k6tx<_LLP(jX+s43MDt9=Tnh38RWZN4fGziX8En()CgdCM{I7rk9MLkrw7
z7b;W>h5bkqcTa@z?NI7VjD#Qo9CRLBE@2HCtck;^2yLW};7dbUsCa3%Wvu}ylweTX
ze!42R%N>~%Pltd`tsXlGu>USodpD(sMs=-Km#&LrN6S|(&(qTwFCLtp8|IrT`gz$;
z+Sy6apDRD0gKcuSPYH9S<QBPxcP{dxLV{9Rl)>Xz@T#d#gmJcbDEEIVyKBg#2R+dh
zJDD3{<1Pe&&HF3YZ!_@JX`CI~Ynw0n`uRKXlNDn2RH!xmKj`u#VcNW>4k|womb5Hb
z4elwx$+F5|j1p#)Z}YGM1JB4NxJKpy00+aJ15-y#+%)SrbYRVq0GZWKVUFiLGq3n)
z3w!v5!RYa3p6vVNM3OeR&k(FSWKMh3g#Ru#sibY?oE<m(6R#yyShIJtlT;Cf#!1_y
z|ESZ^qdNoL_~&E0JlYWs{db0>Z5zd7J|fsGKfp@ZAI-~6AU`c+3J_WENX=J~@)V8d
z43k>?G-{{(%P3$W>rK#K&^~T!jyA0>OF+*Pu;?@%;QZ_6&SNH{q#C9vtFdclS7olR
zJNKgb<Dcd1(mDV+Zi=T9g$mtrlRWD+k8cq+k=(d?Mr)Z>mGBy=4W%dk+M3se7&T<X
zN(0r^KN1((&|#chRqDtKlKV(=oN&>PfzZ~)J8M>^VHTQ8XwK2}d=e+yjAyY5(7f*w
z>x@UN7)lF8r#qcanDUN()!wxwOf-tMl_VEQM9=^ndH){NlMlYEcBx0pZ_@i*LVI#<
z@4eOl)RNlRCo>*yFtMyp_*N19=h2se52|pMGf8|zx;%hhlP_rXi$@Hd&yLk~yKNFe
zsYTPl>(mm<N8(RhI{x$0$&J4u_BaQxmS19axf)TV*{CYD!ng=fMblAZ6#F*;T;Sj+
z#>lEEf^&5@7hsDNm1AveU3OCgjp8;u2o%Y!dj_6et^Glm7+dA6T`@<UNo4LL%$`;J
zd6X7N7_gg}8S@H?7eee$^deHq$byGRg_4$aJNSw3aF`v0XX`c%at;X|&I%K&6fc@S
zLYzG1T(&H_%kTr1_hrP{A)^aC3eDz@Xd8NLJXFhzlwfG7Lz<`Us@<>+jxxo-%OPfG
zjrtxKF&R+s4qNjd13Ghksa3k{`7&Ez*G+CR?{|j_N;<q|PSw=Ve&D7*mf%lP49c-j
z!V=lmLnam0Y+2quy8}0g;gevvnIHJyA!7-``9j3J0f0EkA;I(SN7=LJ;sbT*$BZVI
zjkhM_geP&&9_wxU;qLT$LINx)K$?`6kY(8!#1a3m$FdA)`0hIhI#VXHLgS%`LxXBA
z$djp(m{e$pE`?v1ibpd+RFxw3z~cEu;5KXpn$@H)aV$ebl(L;ooUP%Jo0ldvW#xUw
zxdPMb|75fPj$P`fN?T5Rbma)T4!;Sr{KBjo4v+9u{u1aOIRQ4lK{V|gY_4XdPw#$-
zHfPM@pWcm!lxIy7K@`X4#r^utGq7r-L(zy8Z1t;Wgg{hkI@gQW?Y}!sj`-lJb|)&8
zuU+?ohpsUqv9Zzc+r4F(W660mvUqg^-`dzM2Ny0^!dR9QuoQHOs($s4r_I=j6B*2W
zsa|)*V6bJtH6=6H?FQYqgS_ldYztjdik|FIFSgO(1<JyAzJpcyJa(u_IYpJ{Xst*!
zd)hB*VM{l1OUVq(H#5ugpO>SW$*2OjQJ7@PQti*S2Wh}s`HN^O_xsviB_~)6kh<Wn
znvLuiV$h<pc_$RK*fTuWS~R2S(3T@(HfyU`=nk&jJ5Mn8NyqkMB~q(SO=()uEsxIv
z6uC*Fla@|ro*UGtd2@oP$SG7|mdpLjVz+AUa-(uD6GTt()02Gz<f_EgKls#kla(O3
zDzyqFPI)O{HWW}2qd8>av(l(QTE1%ARmY^N6kXNT|JzQbA=z7UYSJuv)@!(t-iqs3
zL=QpMK_C8RO2uJb(Xz#}<&S16tQsuNScJJJBs)TXUlTW}&`nAqtsD}JL6>`|ih2OI
z@Z$7BO^EUzh(>>&tL*RvIV`Oc)hA#fCNKbJ+OakI>>`g(`8qhA=>|55EAG0aj#z+r
zg)CxSR3R?*h`KKt)56D7S3rrNt4R#ik5RaH!S5*CAU)snqftEl0Y>1q^|SMlOeLlq
zTkRK39*Xg0UjdJoY#eXCl0#JU%;17}mL70_i|n*wRi|96`m>H(y=}d&%7j|9&a=Hg
ziaAaADd=AN<Bu=%aq*cj&?9vY-jVm2!6XSMuT|jL)X^B)X|_9OpX%fh<Uv+p^ZHY1
zGJ2%@gFqF4MDl_VJ8?pQu<I`m?OmM%UEwe!PHD_3E;6Z1B|2B+`YmW?_=HuOYBE}Y
zk|qaIKr`R#=;nj-*jyg^thZA-kb-k$A6bcNjqtTtKQAdiuJyuP<~g!!QUf+Lba{cI
z^m+1ex?8?5$1FfA;iWU@w&O(HJkwCCkmO<p8v(|vxO+C`A{D2sJtx_D3pjiuBZE4z
z{|(O--qp%ccm_9GlwHrCvO=ejAL5=8{&!GvTD>qlCd&6cUg0F%pXFVSjLuzAPGQ^3
zu*EuBx1h^{`sxd%u1&qAdeUH!%rVuM=#(GkX5>xR^0R^EFaDmyyu)It7!)0S;&JY8
zmy6C0_hC-ne+Q?aaiD)Km#_1q%T^G3uA0(rcsOII(vRvpX5XMCf+gD<slT0sW?oXc
zDQ$t{(iS0o^{p1&^&E2Xnhh;AIvQ<tG06}~;JmtU1P74x7U%4^V7~6oyiP_SZVY<6
zU2^YMfJ-!>m4V=Q-;C*hgsu|RBQMNq|F!O?`5vO;7mTH&h<WrPN1su2CW!90BI{*Q
zc;Lv((tu2cXUc#Bp$s|k-T=bhyis`-?&hLusjvDNRD%Q&5j#zFcVY`!uAy1CtyW^*
z6vU_sHiq&QF}CWSwW)6ddIE?52Dg80dh@H(AZ}mWz!8Fyl)sEHykylF&UjV6OnFsA
z!_yINHDKu!5-}}rf08XLwW0c#J5^RQPt%kmi<$owUstZek?DIw&v|E3_lbLI2r3AQ
zf=c*)&{VQ7Rmj?zTqf*wbpD&1$@CY3?S)QVN0184{6kksz{~hc4+}M|Ph^;aG{17!
z+_|4Vr?l31x+MIBd>gw14(s^1U*w&6i}@Wg8h8=bLPlRfmn5%O2k-?&H2+`+pyJMx
zQTA?NV9o=U8h8~Vd159NN%q<&p@vW}W88s?bHw%~1H(xgbH>%SpcRWy1gr<$4@Hv+
z%4V+Tsq6O=ZjzInWeQ>Hz6sOdTfHG2lN}zf9~zduc@kE;Su?J{O(?Kk@j7GI`&kCv
zCU!Pig>cfM{ar_(NuiifXX00|Hml4B<@<#KI4hX&Nkk2#l*mahzxwa2;aL*iPB4Jf
zSCr$5Of4`{f>tcz{f_tLs_giz&Y_3%n7g8M@_<K8(Vu9~8yAnB>LB(bM@@8lK-X>`
zFHY|ksh8|wR2r;G{Rpi#TgcSy5)kCVkTpEkZTaNqu*oQxg`ZOO+~ues&Jz_x=9pv}
z_zllE$z#2r)S@9jte>^03**PIoHSX_NtBkBMiQWRJG*?Y+>F#-o$a8YkTNt=85zvL
zmd#{KzeM((Qf+b1?gFh?!#ao({w+;^VvmjVMps5Lo9uxJ2C_Q2v0;yz<P9vjP3tTP
z%op+aF9eJP1>z`s{D6Gs2{>^K1N1nf@NbrPKwZ+TiR?;>+l7>b`;eNM1I}7;*|l{y
zt=WT&V2nE=-j4wY(jp<xJIrreFYlTDF=kHN=pgEsj=}R)Y#YNY^M`a27^Q)k5FqL8
zZf_7dfwcUYCZy)6btRPyE&aEX9{JI#p-7vd4iq7`y7)wU_uNI&1Ke(8IZY5I0qLT_
z<5p035HRvb6=EINt>d9u@uP&DBfI?)iaJ7@n2lySi6R3w{*mfSpN65wRc?WpS7bw@
ztM@xXB-oy7h4{yK?}jOvaYN9OSq1W!j}`B#O)!)ehaR`EIj;h%$C%L&l<>Gq76o%G
z&~@oQK<-zgp%SDmiw!Uo&2S}o50zy?b%%hq(G1rT0T|F18>AEO%H2j*Ho`|pa|Kmx
z*<G5KhVr!5-Iwomt$_8l=b)GDz$dqm)9nfdQQcuBLC?C9)cUsV49T#mEIglR21?<Y
z+?&e}sKYf!mvZr+-xuKDV_R0q(9f!#VUyMHUR>@n1<*k+oxR~dug>Kq0akl=G=D2Y
z)=~hhWgJ*T<hRT9e~GFTMAY+UgAhg?$R^!rR}?b8AZ%X<r%}XCk1vDZH9-^_lrNhF
zijD6ZkI+sVQJOTYRg_(xHe7f`uLL)sen8%s0k#*4-9f8@#Un>aM<DvdE-_~<udbHv
z(?74-;uL0`xtsb}-B~M;;WHACb(L62+J#WJ3t8Jh!EJ4Bv%OS+4hN#wl=(1F)$SjF
zdGyI3p^-WALFRnNcSKu=p=r;9hUnNOlh(L<BPW!{wpi;o92s4fe1K&ZSEv)b>+AaN
zH%>*l)V<!@$KZP!!n&sCiD$l0`U1(NgF;POey59eF~h9?sNr%OUvlZe404o4-zRcG
z?=9D;oU>#yjXx>{K$bjZ3eetQbz$juhCm$KamQuH+!(k)T}Om6RpC}88<%oQPF!*M
z04(yH)`)A~`HjCjKJ+hWEfb}&Dh1gZ{$MrYl%YNRYJWg*N{vLze2Ze>h}^|@^u+Rp
z?0*>WVQ`~Tg;*{>=PiJ%KOGCIhB#-*Krzs8w^IR>avjE#`6{snAhGQW?p*!ZqU#@@
z6M0JrCZJReGnA{122vtmXzyA~Fp^HnLLkmPtJL*)X`7GeM*c!~SDzDZaihLEuru=#
zg+Wt~SJvV+%{1T1l}`hfk6X(Z;IOtnF5Fy#ciAle+UIl0k24W2G!5fv)`(TpEDy+{
zdjtzt*n;Ik<B!5xlC7A&|C{bvah49vMTfI8NPNSwjBxiHlSz72A6i|gKM)fb&$QQz
zaCT5SVbl_zjK?9}uM%n00q7S4+F_puicCkSf@aBh9{D3dPy&ts#O{@WQ5%;piYGq2
zcDd*kgRhOBcm<6QFV3O$m&u!CfkQ)jAr}=B6fitsO~y47A?WtpH#i)BV3rrl$?V&x
z3Et|*XuOD$;ys)~5T}Az)?b7IiLRMK4d^m1=H1P>{f?1Wmq|N<)oRD<P@VV42paZz
zR|3vH6X*@I<;Kwc?@@$ATQU>{HeDim<63dwjF6US%5SrO>dk31Am>v8x3`0T`R+*S
zm}`&EsTcl{&ZyW*=Jbdf7NCUB1&{B7<Yb!_qk1Hzg@x;2^V^A;^fg4z@IMvqWNkVz
z415ctw7z|}`wlAYp|}NlgAp<kUrln9=9IKhPldi5gj9xO;^SydjtbB2M!OlBmRvU}
zoXTQo7gT8Z{&b|8JDln3)wJ7H+NS*jQZL=W0gA8c+ZHKa-<@IrwG#SBq{3;I(VFuO
zDNn1jDm&1DCA0ckx?oZffMjo<DuxZtEEPgEobZ_FI;aRW#yL~pr<IK84Rm;6+Akm%
zyt?r@gYy5OA!ynFS}5|z`ovIZRXrJiKsyiFM%CA><|cZ=T}(-^Rex`Qp!sEB3WmH0
ziwg<6>cRciO>hR{rDBE`ESIWi$ZbLp0GW71v>>fGY+2(2ndyAcyGe}YX8T3J3r*_H
znqIr%7{GvGHFt!b@^ukf>wJz;dNX@3R3e27VF4IAu<+p26IS(k)(1;A?tfV+L_KOs
z-U1m?2^8JTm}t3X)>vZUY`T5$OvI-Rv58`RaD;nJ-n<nCH0-kZw=oJBQdzW`LP>dg
zdRQnETmZ1}7P;J^Z}vW!qEt7a^j6NJW4o0tr#->VsgeGixQEiSfRt|BL_lBqtTbou
z?r7|*Fn93zA@*@|7PeMp0Q~0#q<WmY(kh|LmKRE|_K=(IDN{bRkGP;K^Yzkg&LWpD
z+=l8Cj*iz#1|yDN+#JLEgOQe|&hqg5=|-%g5oiMoDO{^gV}$Gnfb%evKSBy9S6Y9F
zbA`6^`c$Udp2`~c=X^5isu!pWErDhG=zliEs8_<hPgm@A^Evc2Nl14L*t<kPdoc9t
zhwu47xFMK3qhqpFp?ql9E`>jRGfqXQ)2}MVX;AD=101Yc7AyL;s2y0Q#2t&SlFL{}
zha#YEFHi%;zG`!@>+}Od1}81%D_n?Mz@hAvOdF>FxpFb&6!%f~Srhn!0lD@;;e3O}
zV09^+bBZg9zXz9IXvwq}>Zb;;?`FC3Df4a;?}?2GGcm6hlR!9<$lM-KK-ixrJs)}{
zlV`2r<Mir~(*8p6@_$l-peG`VbWN>9?6ctr@lk#ophf<hbG>a*Nj=$*6vYFd4CGW}
zD)XAhg`_8RL)fc(P>|;AM5Nw^>Atcl7&7_>m}2G((=hL0B?;nL#aZ_;AGnc!ziqGw
zzud-m{UmnRxd*ba!Bl}4j<wLd%bjsPNv9j@f9?A~!K^vuCj4c9@lE}P&Gsdkia5S$
hLdNnMGg0-%0jA{ZqvqxQ!9;d?<Dw5TM~_ERsH+jeknjKi

literal 5733
zcmV-r7Mkf{XJsvAZewzJaCB*JZZ2<fXD@a!3N1b$STZ#=F*zVaR5*EKLu*<wc|%4-
zYHxN@Y)yE0XGK|4ZB95xcxXdzYHc`gPGT}<Ml=d;K}l;XZ)GnlOlx#*MNdm%cuG!H
zWo2YeabtK!cSuQ5X>K=dZcI^DNn;8vJ|J*ub}eu+H8vnvR8ebHK_EdiW<zslWO7Mi
za!q(qG&M{wc5*dqNl7_Mab`7VXLdw5Y<6LEayNG|YD@|=D>5}>NJ&L9dUQ)iSad^G
zMO9N$cT7}NcU4F)G<bJYOmaqdFL+HeO;rjlJ|J*ub}eu+H8vnxMrUbBcOXG-Wi~TH
zX=zMWIWbyHW-?<-crbH$Lvm6$XLVI>Np@3Ma70f_LQ`--bz=%<PDgh%PBcSFYA<q6
zabhcDPf06Kc|k}|M@vXKSTtiROgB(%Ni=v#MRy7<J|J*ub}eu+H8vnMc5P5}Q6NEa
zb9GfYN@hn=G<Y*aRda1hHF#!7OH*ZVSY=~nFmFvmdRTXNd2UZeY<UVdP*`DYZ#FPv
zZZ&98Wkg9tHgH)-NLVp$QB80;Fib~BP&jm9ZBKMhb2JJqJ|J*ub}eu+H8vnxMrUbB
zcOXGCZACLeMRj;GG<GmGT5Ci$Y%4`ELuqYAc{wXnRaikoW<+pdS50R%M_39kL2o!k
zZ$U*&ct~YxRCh5*RcTjRR8>`QN=`+3HF9=CS9y9)OG`9sQ+En2J|Jo@N-bw{Wnpt=
zAZA{0aSBpKGfG1^LP%FeO-WQkF;{qUVr*(wX+%tQIaWerR8MwtT0}2ZS~yiuSz%Lj
zI8rY}Y<6gFHf2OmV`wo$LUjs7YfO1?Fj_HCHZ@W<MRrGYQe#vyGH`ZhNl!OJR6;{S
zVoFM6D^7AxF?LsCaYi?5b6R(0VsT11L@PLQW>pF;EiE8NFLiG#W-nP}Y*24QLpNG4
zR(WhoYj<`qOJ^@@V@PUPP&sK+cQ8myWHbs0beZdE@Qccxt%Y>h*|}x9HGld1b9Hj3
zJS8S5P1Zoq!-*3^;XJ3qJrwy*Rq<qZxboX?!Q?VksF<+Ooi`2&Ia7@4Nqa_H%Hvx#
zEe6?Z`~GLs`V$x+D`D_K7lQ7IiU*^EfMIyZoWgdRIvv@Y26+VJ;ZW_FSVBK{*7(?3
zMqPa1`7h0qU1I<9v{;Vc=YlN&^_PdwW{*p52rQ*lE4z-$z|~sWcb&b2C4FtdIAIW#
zv5@4!)CSv=<aa<%iK;M~OjI3!;We}fvDsSdj|4j9D2mTg$c>Q?ck5^wkqQ`Gz;Wr`
z6O1R0ahj=xrStI+DG$BE-}THu7Os=x?*@!@+sa-NW}p~Ik132^{yXCgWW9yGdphX1
z-aL)0$wp#?(FTbcL^orEMT%j86`aSGI{IkIgx-cfP%N_NBU+J(b~rPslGrEj$`5AA
z`v9Q~E9XbLDojc4PYoEP(hyF-nKJO3X|m5+O_2dtq=V_&r$J+A=f2Po5})g7hI7pe
zm6!^1^NLcyPnu+rdRO=W%LVK`uUTUlvKZ?AUI^m9n3*}<!7EM9L79$hp&(7ne#fLi
zHZLgP(+7(MNx3Lq!gN74yFHf=ULI1&+vc^Pe*vWUns1N19Ff?!Nqv>@9#VOIPD?d}
zE9$cyIX^y#<=@@DaI{6yrw9@fq6J_~IXAQ&KuhBR@v!Y|<##g~hXfDCb+qKwScCYG
zEFI=cG-6W3HlDS<oXr|mai#)B13)_;vlRm`@Ds)tP2g@PlhTe%DMWb<=J>iaa}(n^
zgel%N2Hn|i-u<u9&^RbR)w232k&eHn*VD+OpGJ}b`6rH7eUWfrK0HnReqN^L!)q{8
zC9$6+8!h&NJ=2=AVY4lBQLMuBDJ&_O7#f%~*S#dg+8E^ITUShQ&E9-@JG6>c+HAs1
z(X2h((oaCQ)TU6Ut)(s_t|BYdQE-lebv*$Fgb7Ptle0Yq7I4>$bXS}4YqFZi1mxA>
zT6Nl8U(m<Rfk}I_VL@WnQV}Iz6K5?gCtu~w7{wzDk?$qfl@3_m5|$G?Mn4wDnvaBB
zUG7kY&`k;>a55}@EL(pTVXH{jB~%g`6(B_`Jf-Gm=)H1kGkZ<Ek@V;G-bXZ2d<;w@
z8;Wl1X(by;PxrT+|D02~CiR{n_|8K;&}u+P0A!+mJ)`dQr$mHh+)!h*0<jRl(NsnC
z*^KUZK^j!@fN^n>j1|hoD3R2muq=)OISia4;F9=EC?JqBM;|JLBk-^d0JNS0akDku
z;s;pqvcY0%&OHX$PZ=+Og~)vjo;XzIu@kO)YrB6d(sdRz3%UR@2Z`O+`C2MbE)iLK
z&QYq{1iCFSeGgxwn0<yE!hPkS&0ibw@<9ZI$VA&)mm-QUR=_mBHHUWUq=t$8E<z!w
z=8GL#FfO*lqeM1}rn?n>$94rOaT8R;p&pE5pq4F*lKOUGs7VmgykUTWYV>4xAQ$n&
zPas(U;b?DM_HG1n^l9{_fMl<%g9qfXN~^T+l_}Z-<PpWo+h-2Ol<#U%)#kec1m=1W
zqqoJFn4wYUy#6~&N;HR_>X6EjjQjkCdcuL=_{6RKqN#{Mz11tnj%KCb&~EBBSr+Uo
z|3&)h$7lEqfw2#d5gOIY8)OmvHKNZUTcgguI(_G8FB(;>ErT?;(L#;$XQ%-Ixkk85
zHRST(YqXZ@;EyvAht5e0u&S|$cJ~1NsPBpe+Rz3u8Jj_ZZ;y4;Cg6+=i`~nFn4&uZ
z5}|Oxd-fI)!h~U%=ZbuPfDQ)9GFIq5_NlOOwkZstGrFgcqKT?aM>;i1I4=~&jdWJ<
zY^!(U|GGUh9$ri5YO9E$p7P9XKeWLA0!Kb5th9C(ou)l!I8f{J?t#lf1cs<Qga3Hd
z30?uu$r`m$0LL~06w()iYN#{Z+7qSUDvx=P1ApJ$eD>@_yeW1!MWR3HJ)&wdew6^u
zMDQ+ax#;%;rELPxzuDJ?kuMGD;0bKnhU2Y1Qk7t5`I)ITV86AKp|I<+apkD)wTfGl
zqdJNzG$zCC{2AUY0N7QY(nw*MT)vHUzUa*cA}BA#!7{{Qpv0>ehz}xV=jfxM>_td^
zdMhRib{uDwp~Y<#HG6Tesq^K}+s5}5IyNALM65*WvAwTZ8d#2dXgY-`T~KoF)UKel
z8iEc8rFPUuW*<ur*=^gnuLP=5PTg+bCVRm&s<c$H?_)%$Q<F0qj+BX(6+3l(%y~li
z?RETd(wp{OpjPYny75)b)Mhu^^j8;8^%Fte%L8dn5Lm&?rrLdq3xm%XnfnyG70PK>
zyX&UZlJSuw@8~D64sQ;)eVt(v!HZn4jVL>b)s%c}V8tMXbG4I0lA$Zw+h_M#ogY4d
zVPXQvjrrh?qV8mH$cx17H16w$P0#&afAzbX%T_%oez`gCO<I!>t1tQtyqcayfM`*4
z!SC_-nR++xgn205#@2>o(>lABkQ%^9Zq_!Cj}!uxEmdrH<%6V$c>{lKlj8+^VfEs*
zzA<s~HkccGWfMA-b80QzeKG-nEZM;ovED=|@Nb^)Noz#~ko3h^?5ktIu4rxz`-1)%
z`WDRo$oX_tJ`8J_w3$(Ynw4!lYqtc59YkY!QJz9yJ|kxy1lvY)%Q`@dfnQ+3jeN9G
z2>JZV<|uz$x4yqmE5$XzhxT<Og4JsnwGxR?Vg5jdDQ%9UWT{ENRL1gq5d9D)v8xla
z16T2Zv%LK@tsjj1gL&p)7j<fl3^(@oHn`m<QBkG|tR;l7L%rEt#|Xv2pn^NW7YLAa
zv30q+15<>VA`&JaV1^ZGa8D(HsSx=A+^i7|tw@C;H~-TA+N`TQUb9ykN^s?yIvJf`
zT~7#!AQMg$LY#c<>=mL+xDP8e+bPob8TF$1k%P_B=M_$s#cX>@!|ZBaa*jh|ENXU%
zJJqAjF68mOm1XT=SKP<~!s=XVZA_{|y^LGijk%}>$Lw4@U<cUv-DZ(PjonDBAXilJ
z88P32Hi}ab9<6UWP|fNT3Ydxx&jQ4}s<n4fjZ<!%C`L(OON28$@#aYdl$XZ>QsK!G
zAY&xdy2JTgp>x3y7AO>_LCU+D#2~IYgJZ8c(~={{?^?O?B=+E|+CMOx82l$i|A4J%
zzgvb@bCxyB*IxZ}^d2Dacz*%_=bunhcA|E&f0AQt?Ys*)cO6hq!L-Sh3#>UB6(hG2
zf>q{fRk$;We^6#r;%{;!(<|@Ffizh9!@u4-;La;)1m5Fja>gtq1x!hc*I)z9G~#3i
z;bUc`Q(%xgi`^pTdFUc1>u<GX!;(SC21MTtVZ*GNyf%kM=wpJ`7G-iW-EAs9ZP57h
zxo#<?rH+hjLCiqA8)?_mAXBPzOk4=QP82F8+3&S`VvKO-8k4;3n3nJas|w%k(#tM;
zWAh^5Qf=<(4O1&8;(b3|18)0s$onR!VB3?MNP0~5AZ_kVy#Si8)EXd~mT2(;pToyf
zCsE;K_c}keAz8lTMnq(5IDkFE|49rXcjM0F;U!mJtO&~N#$G9ang2oSP~`8fejnAt
z-)1bwRU~AfE5j;>bDG%n9FanKCslBpv==%1rDJ0s|IY$Bvl;VI@$kABV3U?xAglKl
z!iRgA{e^%;y*}5cNuI#LU6Q#VMd6bE@Q%cyluip=^6rAR%*ADXG`Z!bMG`0igS;<r
zW-<eO;KnT#bDZZLp(ts_HJ-uk9RL{Bh-jfRyvD$;?4En?cM2`n4D5OSk+h?e{+eW9
z%4#}aMVZ_hLZlUGjl=Fp>XHB-^GC!v<gl?;Mp3ELQf@6Fd|KT`jkSN+i+)BYx{JWj
zg5%Z1Mp7XE^9;!7N0$l-+@kE4%*fpq&|tx^@P}$_3Rx01opuPeY3uj}VO7`^b~LUl
zS(MX-KrHFz#U;X{x}K5MM+ukiOM)YRa0|Mi|7=mwKYL9N6-#|%bX$wy$30f*M8UQz
zoee{B)MnAk&6=)JlG1x8fdg7_7{vm@mm%frahT!f<*mM%HOf^ydZ9`;U_gEVCp3)?
zIoP9-u@hYz6*L{DtO0q%z@b3%G+UV)p7XBW*%%ggD>`d5Bz)%Lsgsn9dT7ET0~Uhq
zF%aP&j~2Go>=ZZk(U2__<a~Sr;mL@V>kx#UVH~iJ3>2ml5IH;7!0(3u%_KZp#@sx{
zM-hj2{Gt#Om&aQ$^`7PQy_D4i{UXCrJKiaTt>sPZ@~J(cssxJS7F$1QVa(A*QUc$v
z6dO7Zm463k6SbQCY!%w~{6TLLy|#Xu4MtdcK{6Ay!d1Tfmd`^}jtuu{WQx@&QmnBZ
z4pNAN+0RHQwnw0^dV^UtNtmycZ^X0g)cp&j`aMT&yv@~n)gwr@TfBmtBJV}unCK+S
zqAei1<X@rT#KpUX-LN&P`-Oafi?&ld-l*IBpd=Ca15p<}rkMdoIyFKkPI1lbNOorP
z!6MX1^SfaBdiVF!_^*uJo^OSb*H_JB;?hc)Y@)9pVIlucD!6S%H20rNrdM{9$(E^-
z1NhvPNBatP$NR9<J1Qd`kH<rG#mnauA7;h!%PdNOZME5QlF??8Gltvr>Ox;6He#)|
zWQEAevw@tGvM_{?Cabv(aRZV$K-YYTt|lN8|EQaq@|b47jqZeR!ro2u2@@FL^H<#m
z*otQh)Ywgqj+k1t(KGlWwF}dStcFs&dO7Jp!fn`x2D8B>7H5u`%>9aI;j?dGXM*iN
zG%nGvsBGGI23Va~;+V*gWHT<UFOchrIlQ^Q+%j973HC^D;HEYJ%$_LfB$tNOffWqG
zA5ZYpo)1+#E(rcx#;hVG&yTEDCZ`E0=JPiZyl~-Z=xaDV!p>-NZ^4^~8I}$3S-{)~
zv3MYEDbcm-3k_PPA<P{0d8z#M)IYt6O^j#~!xYLf5{HWI*wP(3G|FA3aLSME#k*D!
z2ZMSYLv46z2kO5J6>exKS)<Bb49`Z;0Ua4GR;Ipskv_2Lf)kC!J`2SMg86Sz*L#!K
zP%^ZDz1xstO#&0G$`#=Q0{lNqR*&|1l4eXxBT19v4r&CriPM*`q>{CKZZ0o?12O*q
zyA_x*aLp`A^4y}*3d;KJ+rr`d*qT0Xer2Vk;r3t&6HdVT;cCC~0g6s{i`Pw0q5+qS
z7t71X_@V}lMR{PUgY%MrVWG1bJ;9z0Ikry3M1!IS$#i8nkBN97>U7h|=%A-#0n+Dy
z>@$gzqJ-y^G*p8Z4kl&O{Y$CUIhbZKOqW%4Z90uY?rHyR4pbo4sYo8iv9dBP!G*>d
z1>x)ZgK(!;;K}u(IPfeUN4&tzlr93tAK<?<k<5wmYGMpF=~iDEI_EW_rk4k8+)6hm
za9X{ZtZ<!2QwEKF$r8FR;Ry1joFX){{d{2nnjQ|~UM@iIw#w<g%@?0lzT-}4E_!*^
z1;nUo`+C~cm$dB-_)LrxK^a-OaSSz~9x3pzS|IlVhy{%r5)`=S45I4YK5-<`j8NS;
zB+y1TOokb`PhFsRe8C90*}Cn>@fl@}3*D0NOO5ws#92#<VyJR=wB7MqGK+dRC*#0A
z#gqqfZ~Z8fyRxTczInQk2lx<&YG&D()yX<?Ul#jcitC_<c!`qW73@5@PdTJ?r(?iD
z_?oz{xv-W79LDh^@(%WN9~DEdNJOtaOrALuum$y_`vvBDA2M1G@X$j_r6>vG`v1=s
z5ajF#N7`i-FZl=LpPf@f+`J|2VDb#o&c|EJ1QgE0xBLLT`wYHNRUm1+$1UKus`eY6
z;yNY76ccPVGGw~K+%|KjoAc_DU84r1Azky$Y9x`QWEFEKr3sYidcB-$&4U7^%@YWY
z+}$<;b^F};)4#y|H!(4WVL)VziDXr05GIli(GbkP9~mwspAY2FH@uqM;ohIciTh|&
zy9z5+pW(wItwr;!0YU0ePXT|+Ez5`4BmQt8>xdg>(qIO8TY&F4N2`oY(4xvae*AfW
z-YC4VP66_{Y=<2W<-)ezflOmzkn1s<9g=lqEB#OM=g$&(l6XTar|~`X#R4q3VNw46
zFsZpqbuV;hLSs3SGub$Z$-4u0gLKoqJ^u{e0KsoL_rY+N>)TmFCV>t`F`1f84T%p<
zJ^N+EViLCMF>5(T-(cf6<`{o05sO@Ug|id&tKsuSA@l^3l}vqV+!hPDh_U^q&%);O
zLO4h^Hbuu&&}S|?KZd{=|D3H>+3)ixw}bO)P>Vxj2iM>{Cli-0rT-osXPk*I!+vMr
zY*PxkfceNalQ#OwrK9xaApODNv9z<kaR2MgAxJ+_asO)0CLOz^-(IDS;(4JF$Zh=B
z-Od>P#DD|-<G0+4+^(J#>PMt_#6`GgUOKNOakbwGh<0XQ-~DjkzL^=EWc_?^XzuIS
zhGEZ@9p>aom<SMu*TwaIXqo6A(>ryX><e*8(NSR4v2%ajON~9B(Q?b0V*is#7XI2<
zDE8R<IpZ8xpV9<%QaPs6y$-2OD4U6)Q4*y>kRv4FowzgOD8f(z2YPRJ;HjS&Rl#oX
zd{QbOIsWXzOikqKFrqT<9ihctmv_~%fnVF)p*mDj%nBi;`q&z;dP#q8X+<geV2(SD
Xz7R4ziX(cDj}5)0YS8<*yHL{3S+uh>

diff --git a/secrets/wireguard/scrtiny-patrick/keys/elisabeth.age b/secrets/wireguard/scrtiny-patrick/keys/elisabeth.age
new file mode 100644
index 0000000..f594cab
--- /dev/null
+++ b/secrets/wireguard/scrtiny-patrick/keys/elisabeth.age
@@ -0,0 +1,16 @@
+age-encryption.org/v1
+-> X25519 dUgBIIGKuR7jCfDHrVWvku15MhegXbRaGVAJvQ4G+FE
+G1B2zJrK5P8jW5fwboLcwnUw6sTQ+rolXsZdLkh1NYg
+-> piv-p256 XTQkUA AqCwFM9PXH41lIClU3/8w7nB334kYtXwy29qqZvKD6W6
+2PvTP9Ru5i4W9N3N5BOre6OoctsVNXzMK3HS22VFgRE
+-> piv-p256 ZFgiIw Ao/vA/FGcaNm3VonTzkZYM7rQZ3pYlXYcH6OHxIPxyBG
+Jseiz60VbsygKZMZu1GpkoDsyoGwl23/+CFe6DL9aR4
+-> piv-p256 5vmPtQ A8TcW3GJHKfN+kRUH3KSYTi2Tcn7hAyN/PpsA5GqwD+d
+O2D6CO0rp7SFqOz//p2gbl6HCPD55qNbnqRnwNUrSDo
+-> piv-p256 ZFgiIw AtDrLdrYjUegvT1qi2X3X8CyqJU05Z48iAe01piNm5G3
+hrnn4uALqPzNsMOcdBFdqSmwV+L0r5sxSXWcTZz980I
+-> k"-grease E[ZXL RpX[yO>J a3h4 a
+ooUbsf5wnVPZ8Y0yjm8IrQMP+9oqQGIqcdi2fiGiKN2Q2gL8FGRcIRIEE0ZdpQIp
+/06QStoFSQOgoI13SqpoHhg5cHSzWT4S2z0UFCpKsLZDZ+q1S7bxV1ST
+--- zaXNrqNEe3bTj3oSGJljjj1ruZ5sBLBWRijLRr8Jxk4
+����Z���݅�.�PF�3BC ���t�
O��@T̔��6����
s��:1w���R}*���%�- �l,ld��a,V�
\ No newline at end of file
diff --git a/secrets/wireguard/scrtiny-patrick/keys/elisabeth.pub b/secrets/wireguard/scrtiny-patrick/keys/elisabeth.pub
new file mode 100644
index 0000000..ca8ee00
--- /dev/null
+++ b/secrets/wireguard/scrtiny-patrick/keys/elisabeth.pub
@@ -0,0 +1 @@
+QPZrzkguRzNQDyMfnC6O5b49QZRCAsv28N91nR2lal0=