diff --git a/home/default.nix b/home/default.nix
index 64f83e7..25e5bcd 100644
--- a/home/default.nix
+++ b/home/default.nix
@@ -43,8 +43,8 @@
     enableNixpkgsReleaseCheck = false;
     stateVersion = "26.05";
     sessionVariables = lib.mkIf (!isDarwin && !isServer) {
-      GROQ_API_KEY = config.sops.secrets.GROQ_API_KEY.path;
-      OPENWEATHER_API_KEY = config.sops.secrets.OPENWEATHER_API_KEY.path;
+      GROQ_API_KEY = config.sops.secrets."api_keys/groq".path;
+      OPENWEATHER_API_KEY = config.sops.secrets."api_keys/openweather".path;
     };
     file = lib.mkIf (!isServer) {
       "Pictures/Avatar" = {
@@ -67,13 +67,13 @@
       else
         "/persist/secrets/age-key.txt";
     secrets = {
-      GROQ_API_KEY = { };
-      OPENWEATHER_API_KEY = { };
-      ssh_private_key = {
+      "api_keys/groq" = { };
+      "api_keys/openweather" = { };
+      "ssh/private_key" = {
         path = if isDarwin then "/Users/${primaryUser}/.ssh/ssh" else "/home/${primaryUser}/.ssh/ssh";
         mode = "0600";
       };
-      ssh_github_key = {
+      "ssh/github_key" = {
         path = if isDarwin then "/Users/${primaryUser}/.ssh/github" else "/home/${primaryUser}/.ssh/github";
         mode = "0600";
       };
diff --git a/home/desktop/waybar/common.nix b/home/desktop/waybar/common.nix
index 7adb87c..2f7fc98 100644
--- a/home/desktop/waybar/common.nix
+++ b/home/desktop/waybar/common.nix
@@ -150,11 +150,11 @@
       format = "{}";
       return-type = "json";
       exec = ''
-        curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/OPENWEATHER_API_KEY)&units=metric&lang=en" | jq -c '{text: "\(.name) \(.main.temp)C°"}'
+        curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/api_keys/openweather)&units=metric&lang=en" | jq -c '{text: "\(.name) \(.main.temp)C°"}'
       '';
       interval = 120;
       on-click = ''
-        data=$(curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/OPENWEATHER_API_KEY)&units=metric&lang=en")
+        data=$(curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/api_keys/openweather)&units=metric&lang=en")
         city=$(echo "$data" | jq -r '.name')
         temp=$(echo "$data" | jq -r '.main.temp')
         feels=$(echo "$data" | jq -r '.main.feels_like')
diff --git a/home/neovim/avante.nix b/home/neovim/avante.nix
index 40c9725..5acea28 100644
--- a/home/neovim/avante.nix
+++ b/home/neovim/avante.nix
@@ -1,5 +1,4 @@
 {
-  # Avante: AI-powered coding assistant (Cursor-like experience in Neovim)
   programs.nixvim = {
     plugins = {
       markdown-preview.enable = true;
@@ -13,7 +12,7 @@
           providers = {
             groq = {
               __inherited_from = "openai";
-              api_key_name = "cmd:cat /home/phil/.config/sops-nix/secrets/GROQ_API_KEY";
+              api_key_name = "cmd:cat /home/phil/.config/sops-nix/secrets/api_keys/groq";
               endpoint = "https://api.groq.com/openai/v1/";
               model = "qwen/qwen3-32b";
               system_promt = "You are a helpful coding assistant. Always respond in plain markdown format without using tool calls or JSON structures.";
@@ -29,9 +28,9 @@
 
             ollama = {
               endpoint = "http://10.10.0.2:11434";
-              model = "qwen2.5:3b"; # swap for "llama3.2:3b" or "deepseek-r1:1.5b"
-              timeout = 60000; # local + small model can be slow on first load
-              disable_tools = true; # these small models aren't reliable at tool calling
+              model = "qwen2.5:3b";
+              timeout = 60000;
+              disable_tools = true;
               is_env_set.__raw = ''require("avante.providers.ollama").check_endpoint_alive'';
               extra_request_body = {
                 options = {
diff --git a/hosts/cyper-controller/smb.nix b/hosts/cyper-controller/smb.nix
index 9cbb4d9..9613cf7 100644
--- a/hosts/cyper-controller/smb.nix
+++ b/hosts/cyper-controller/smb.nix
@@ -1,11 +1,12 @@
 {
   pkgs,
   primaryUser,
+  config,
   ...
 }:
 
 {
-  sops.secrets.smb_passwd = { };
+  sops.secrets."network/smb_passwd" = { };
 
   users.users.${primaryUser}.extraGroups = [ "sambashare" ];
 
@@ -93,7 +94,7 @@
           sleep 1
         done
 
-        PASSWORD=$(cat /run/secrets/smb_passwd)
+        PASSWORD=$(cat ${config.sops.secrets."network/smb_passwd".path})
         (echo "$PASSWORD"; echo "$PASSWORD") | ${pkgs.samba}/bin/smbpasswd -a -s ${primaryUser} || \
         (echo "$PASSWORD"; echo "$PASSWORD") | ${pkgs.samba}/bin/smbpasswd -s ${primaryUser}
       '';
diff --git a/hosts/cyper-desktop/hardware-configuration.nix b/hosts/cyper-desktop/hardware-configuration.nix
index a69f267..441a83b 100644
--- a/hosts/cyper-desktop/hardware-configuration.nix
+++ b/hosts/cyper-desktop/hardware-configuration.nix
@@ -34,12 +34,11 @@
   };
 
   sops = {
-    secrets.smb_passwd = { };
-
+    secrets."network/smb_passwd" = { };
     templates.smb_credentials = {
       content = ''
         username=${primaryUser}
-        password=${config.sops.placeholder.smb_passwd}
+        password=${config.sops.placeholder."network/smb_passwd"}
       '';
     };
   };
diff --git a/nixos/default.nix b/nixos/default.nix
index f8eb434..df79f08 100644
--- a/nixos/default.nix
+++ b/nixos/default.nix
@@ -23,9 +23,11 @@
     ./catppuccin.nix
   ];
 
-  sops.secrets."nix_cache_priv_key" = {
-
-    mode = "0400";
+  sops.secrets = {
+    "nix/cache_priv_key" = {
+      mode = "0400";
+    };
+    "nix/cachix_auth_token" = { };
   };
 
   nix = {
@@ -48,7 +50,7 @@
         "https://nix-community.cachix.org"
         "https://cyper-cache.cachix.org"
       ];
-      secret-key-files = [ config.sops.secrets."nix_cache_priv_key".path ];
+      secret-key-files = [ config.sops.secrets."nix/cache_priv_key".path ];
       trusted-public-keys = [
         "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
         "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
@@ -113,8 +115,6 @@
     };
   };
 
-  sops.secrets.cachix_auth_token = { };
-
   systemd.services.cachix-push = {
     description = "Push new store paths to Cachix";
     after = [ "multi-user.target" ];
@@ -122,7 +122,11 @@
     serviceConfig = {
       Type = "oneshot";
       RemainAfterExit = true;
-      ExecStart = "${pkgs.bash}/bin/bash -c 'CACHIX_AUTH_TOKEN=$(cat ${config.sops.secrets.cachix_auth_token.path}) ${pkgs.nix}/bin/nix path-info --recursive /run/current-system | CACHIX_AUTH_TOKEN=$(cat ${config.sops.secrets.cachix_auth_token.path}) ${pkgs.cachix}/bin/cachix push cyper-cache'";
+      ExecStart = "${pkgs.bash}/bin/bash -c 'CACHIX_AUTH_TOKEN=$(cat ${
+        config.sops.secrets."nix/cachix_auth_token".path
+      }) ${pkgs.nix}/bin/nix path-info --recursive /run/current-system | CACHIX_AUTH_TOKEN=$(cat ${
+        config.sops.secrets."nix/cachix_auth_token".path
+      }) ${pkgs.cachix}/bin/cachix push cyper-cache'";
     };
   };
 
diff --git a/nixos/roles/frontpage/frontpage.nix b/nixos/roles/frontpage/frontpage.nix
index 9af8cf1..dd25cfd 100644
--- a/nixos/roles/frontpage/frontpage.nix
+++ b/nixos/roles/frontpage/frontpage.nix
@@ -13,7 +13,7 @@ let
         "/var/lib/flame-${name}:/app/data"
       ]
       ++ extraVolumes;
-      environmentFiles = [ config.sops.secrets."flame_${name}_password".path ];
+      environmentFiles = [ config.sops.secrets."services/flame/${name}_password".path ];
     };
 
   instances = [
@@ -57,7 +57,7 @@ in
   ];
 
   sops.secrets = lib.listToAttrs (
-    map ({ name, ... }: lib.nameValuePair "flame_${name}_password" { }) instances
+    map ({ name, ... }: lib.nameValuePair "services/flame/${name}_password" { }) instances
   );
 
   virtualisation = {
diff --git a/nixos/roles/gitea.nix b/nixos/roles/gitea.nix
index f94bb17..9814d83 100644
--- a/nixos/roles/gitea.nix
+++ b/nixos/roles/gitea.nix
@@ -2,7 +2,6 @@
   pkgs,
   lib,
   config,
-  primaryUser,
   ...
 }:
 
@@ -20,27 +19,27 @@ let
 in
 {
   sops.secrets = {
-    "gitea/dbPassword" = {
+    "services/gitea/db_password" = {
       owner = "gitea";
       group = "gitea";
       mode = "0444";
     };
-    "gitea/internalToken" = {
+    "services/gitea/internal_token" = {
       owner = "gitea";
       group = "gitea";
     };
-    "gitea/lfsJwtSecret" = {
+    "services/gitea/lfs_jwt_secret" = {
       owner = "gitea";
       group = "gitea";
     };
-    "gitea/mailerPassword" = {
+    "services/gitea/mailer_password" = {
       owner = "gitea";
       group = "gitea";
     };
-    "gitea/runnerToken" = {
+    "services/gitea/runner_token" = {
       mode = "0444";
     };
-    "kanidm_gitea_secret" = {
+    "kanidm/gitea_secret" = {
       owner = "gitea";
       group = "gitea";
       mode = "0444";
@@ -75,7 +74,7 @@ in
         RemainAfterExit = true;
       };
       script = ''
-        pass=$(cat ${config.sops.secrets."gitea/dbPassword".path})
+        pass=$(cat ${config.sops.secrets."services/gitea/db_password".path})
         ${pkgs.postgresql_14}/bin/psql -c \
           "ALTER USER gitea WITH PASSWORD '$pass';"
       '';
@@ -126,7 +125,7 @@ in
         port = 5432;
         name = "gitea";
         user = "gitea";
-        passwordFile = config.sops.secrets."gitea/dbPassword".path;
+        passwordFile = config.sops.secrets."services/gitea/db_password".path;
       };
 
       settings = {
@@ -222,7 +221,7 @@ in
     gitea-actions-runner.instances."cyper_nix" = {
       enable = true;
       url = "https://git.cyperpunk.de";
-      tokenFile = config.sops.secrets."gitea/runnerToken".path;
+      tokenFile = config.sops.secrets."services/gitea/runner_token".path;
       name = "cyper-controller";
       labels = [ "nix:host" ];
 
diff --git a/nixos/roles/matrix/coturn.nix b/nixos/roles/matrix/coturn.nix
index 8c630ad..dd3101f 100644
--- a/nixos/roles/matrix/coturn.nix
+++ b/nixos/roles/matrix/coturn.nix
@@ -1,15 +1,14 @@
 { config, lib, ... }:
 {
   sops.secrets = {
-    coturn_static_auth_secret = {
+    "matrix/coturn_static_auth_secret" = {
       owner = "turnserver";
       group = "turnserver";
     };
-
     coturn_static_auth_secret_synapse = {
       owner = "matrix-synapse";
       group = "matrix-synapse";
-      key = "coturn_static_auth_secret";
+      key = "matrix/coturn_static_auth_secret";
     };
   };
 
@@ -21,7 +20,7 @@
       min-port = 49000;
       max-port = 50000;
       use-auth-secret = true;
-      static-auth-secret-file = config.sops.secrets.coturn_static_auth_secret.path;
+      static-auth-secret-file = config.sops.secrets."matrix/coturn_static_auth_secret".path;
       realm = "turn.cyperpunk.de";
       cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
       pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
diff --git a/nixos/roles/matrix/discord-bridge.nix b/nixos/roles/matrix/discord-bridge.nix
index a3c6fc4..39bc845 100644
--- a/nixos/roles/matrix/discord-bridge.nix
+++ b/nixos/roles/matrix/discord-bridge.nix
@@ -1,15 +1,15 @@
 { config, lib, ... }:
 {
   sops.secrets = {
-    discord_bot_token = {
+    "matrix/bridges/discord/bot_token" = {
       owner = "mautrix-discord";
       group = "mautrix-discord";
     };
-    discord_client_id = {
+    "matrix/bridges/discord/client_id" = {
       owner = "mautrix-discord";
       group = "mautrix-discord";
     };
-    discord_pickle_key = {
+    "matrix/bridges/discord/pickle_key" = {
       owner = "mautrix-discord";
       group = "mautrix-discord";
     };
@@ -35,9 +35,15 @@
         };
         script = ''
           mkdir -p /run/mautrix-discord
-          echo "DISCORD_BOT_TOKEN=$(cat ${config.sops.secrets.discord_bot_token.path})" > /run/mautrix-discord/env
-          echo "DISCORD_CLIENT_ID=$(cat ${config.sops.secrets.discord_client_id.path})" >> /run/mautrix-discord/env
-          echo "DISCORD_PICKLE_KEY=$(cat ${config.sops.secrets.discord_pickle_key.path})" >> /run/mautrix-discord/env
+          echo "DISCORD_BOT_TOKEN=$(cat ${
+            config.sops.secrets."matrix/bridges/discord/bot_token".path
+          })" > /run/mautrix-discord/env
+          echo "DISCORD_CLIENT_ID=$(cat ${
+            config.sops.secrets."matrix/bridges/discord/client_id".path
+          })" >> /run/mautrix-discord/env
+          echo "DISCORD_PICKLE_KEY=$(cat ${
+            config.sops.secrets."matrix/bridges/discord/pickle_key".path
+          })" >> /run/mautrix-discord/env
           chmod 600 /run/mautrix-discord/env
           chown mautrix-discord:mautrix-discord /run/mautrix-discord/env
         '';
diff --git a/nixos/roles/matrix/draupnir.nix b/nixos/roles/matrix/draupnir.nix
index a5735fa..5b0d735 100644
--- a/nixos/roles/matrix/draupnir.nix
+++ b/nixos/roles/matrix/draupnir.nix
@@ -1,6 +1,6 @@
 { config, ... }:
 {
-  sops.secrets.draupnir_access_token = { };
+  sops.secrets."matrix/draupnir_access_token" = { };
 
   environment.persistence."/persist".directories = [
     {
@@ -13,7 +13,7 @@
 
   services.draupnir = {
     enable = true;
-    secrets.accessToken = config.sops.secrets.draupnir_access_token.path;
+    secrets.accessToken = config.sops.secrets."matrix/draupnir_access_token".path;
     settings = {
       homeserverUrl = "https://matrix.cyperpunk.de";
       managementRoom = "!eErCimyDjLSebHjpJA:cyperpunk.de";
diff --git a/nixos/roles/matrix/livekit.nix b/nixos/roles/matrix/livekit.nix
index 9460a95..ce7e191 100644
--- a/nixos/roles/matrix/livekit.nix
+++ b/nixos/roles/matrix/livekit.nix
@@ -1,18 +1,20 @@
 { config, ... }:
 {
-  sops.secrets.livekit_key_file = { };
+  sops.secrets."matrix/livekit_key_file" = { };
 
-  services.livekit = {
-    enable = true;
-    openFirewall = true;
-    settings.room.auto_create = false;
-    keyFile = config.sops.secrets.livekit_key_file.path;
-  };
+  services = {
+    livekit = {
+      enable = true;
+      openFirewall = true;
+      settings.room.auto_create = false;
+      keyFile = config.sops.secrets."matrix/livekit_key_file".path;
+    };
 
-  services.lk-jwt-service = {
-    enable = true;
-    livekitUrl = "wss://cyperpunk.de/livekit/sfu";
-    keyFile = config.sops.secrets.livekit_key_file.path;
+    lk-jwt-service = {
+      enable = true;
+      livekitUrl = "wss://cyperpunk.de/livekit/sfu";
+      keyFile = config.sops.secrets."matrix/livekit_key_file".path;
+    };
   };
 
   systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = "cyperpunk.de";
diff --git a/nixos/roles/matrix/meta-bridge.nix b/nixos/roles/matrix/meta-bridge.nix
index 7f8f70e..0c2f0e6 100644
--- a/nixos/roles/matrix/meta-bridge.nix
+++ b/nixos/roles/matrix/meta-bridge.nix
@@ -1,19 +1,19 @@
 { config, lib, ... }:
 {
   sops.secrets = {
-    meta_as_token = {
+    "matrix/bridges/meta/as_token" = {
       owner = "mautrix-meta-facebook";
       group = "mautrix-meta";
     };
-    meta_hs_token = {
+    "matrix/bridges/meta/hs_token" = {
       owner = "mautrix-meta-facebook";
       group = "mautrix-meta";
     };
-    instagram_as_token = {
+    "matrix/bridges/instagram/as_token" = {
       owner = "mautrix-meta-instagram";
       group = "mautrix-meta";
     };
-    instagram_hs_token = {
+    "matrix/bridges/instagram/hs_token" = {
       owner = "mautrix-meta-instagram";
       group = "mautrix-meta";
     };
@@ -44,8 +44,12 @@
       };
       script = ''
         mkdir -p /run/mautrix-meta-facebook
-        echo "META_AS_TOKEN=$(cat ${config.sops.secrets.meta_as_token.path})" > /run/mautrix-meta-facebook/env
-        echo "META_HS_TOKEN=$(cat ${config.sops.secrets.meta_hs_token.path})" >> /run/mautrix-meta-facebook/env
+        echo "META_AS_TOKEN=$(cat ${
+          config.sops.secrets."matrix/bridges/meta/as_token".path
+        })" > /run/mautrix-meta-facebook/env
+        echo "META_HS_TOKEN=$(cat ${
+          config.sops.secrets."matrix/bridges/meta/hs_token".path
+        })" >> /run/mautrix-meta-facebook/env
         chmod 600 /run/mautrix-meta-facebook/env
         chown mautrix-meta-facebook:mautrix-meta /run/mautrix-meta-facebook/env
       '';
@@ -60,8 +64,12 @@
       };
       script = ''
         mkdir -p /run/mautrix-meta-instagram
-        echo "INSTAGRAM_AS_TOKEN=$(cat ${config.sops.secrets.instagram_as_token.path})" > /run/mautrix-meta-instagram/env
-        echo "INSTAGRAM_HS_TOKEN=$(cat ${config.sops.secrets.instagram_hs_token.path})" >> /run/mautrix-meta-instagram/env
+        echo "INSTAGRAM_AS_TOKEN=$(cat ${
+          config.sops.secrets."matrix/bridges/instagram/as_token".path
+        })" > /run/mautrix-meta-instagram/env
+        echo "INSTAGRAM_HS_TOKEN=$(cat ${
+          config.sops.secrets."matrix/bridges/instagram/hs_token".path
+        })" >> /run/mautrix-meta-instagram/env
         chmod 600 /run/mautrix-meta-instagram/env
         chown mautrix-meta-instagram:mautrix-meta /run/mautrix-meta-instagram/env
       '';
diff --git a/nixos/roles/matrix/postgres-backup.nix b/nixos/roles/matrix/postgres-backup.nix
index 96677ad..745f816 100644
--- a/nixos/roles/matrix/postgres-backup.nix
+++ b/nixos/roles/matrix/postgres-backup.nix
@@ -5,7 +5,7 @@
 }:
 {
   sops.secrets = {
-    pg_replication_password = {
+    "postgres/replication_password" = {
       owner = "root";
       group = "root";
     };
@@ -17,12 +17,10 @@
     description = "PostgreSQL WAL streaming replica (Docker)";
     requires = [
       "docker.service"
-      "tailscaled.service"
       "network-online.target"
     ];
     after = [
       "docker.service"
-      "tailscaled.service"
       "network-online.target"
     ];
     wantedBy = [ "multi-user.target" ];
@@ -35,61 +33,49 @@
     };
 
     preStart = ''
-            DATADIR="/storage/backup/postgresql-replica"
-            PG_PASS=$(cat ${config.sops.secrets.pg_replication_password.path})
-
-            ${pkgs.docker}/bin/docker pull postgres:17
-
-            if [ ! -f "$DATADIR/PG_VERSION" ]; then
-              echo "No data dir found — running pg_basebackup..."
-              rm -rf "$DATADIR"
-
-              ${pkgs.docker}/bin/docker run --rm \
-                -e PGPASSWORD="$PG_PASS" \
-                -v "/storage/backup:/out" \
-                --network host \
-                postgres:17 \
-                pg_basebackup \
-                  --host=10.10.0.1 \
-                  --port=5432 \
-                  --username=replicator \
-                  --pgdata=/out/postgresql-replica \
-                  --wal-method=stream \
-                  --checkpoint=fast \
-                  --progress \
-                  --verbose
-
-              # standby signal
-              touch "$DATADIR/standby.signal"
-
-              # primary conninfo
-              cat > "$DATADIR/postgresql.auto.conf" <<EOF
+      DATADIR="/storage/backup/postgresql-replica"
+      PG_PASS=$(cat ${config.sops.secrets."postgres/replication_password".path})
+      ${pkgs.docker}/bin/docker pull postgres:17
+      if [ ! -f "$DATADIR/PG_VERSION" ]; then
+        echo "No data dir found — running pg_basebackup..."
+        rm -rf "$DATADIR"
+        ${pkgs.docker}/bin/docker run --rm \
+          -e PGPASSWORD="$PG_PASS" \
+          -v "/storage/backup:/out" \
+          --network host \
+          postgres:17 \
+          pg_basebackup \
+            --host=10.10.0.1 \
+            --port=5432 \
+            --username=replicator \
+            --pgdata=/out/postgresql-replica \
+            --wal-method=stream \
+            --checkpoint=fast \
+            --progress \
+            --verbose
+        touch "$DATADIR/standby.signal"
+        cat > "$DATADIR/postgresql.auto.conf" <<EOF
       primary_conninfo = 'host=10.10.0.1 port=5432 user=replicator password=$PG_PASS application_name=cyper-controller sslmode=disable'
       EOF
-
-              # minimal postgresql.conf
-              cat > "$DATADIR/postgresql.conf" <<EOF
+        cat > "$DATADIR/postgresql.conf" <<EOF
       hot_standby = on
       hot_standby_feedback = on
       wal_receiver_timeout = '60s'
       port = 5434
       listen_addresses = '*'
       EOF
-
-              chown -R 999:999 "$DATADIR"
-            fi
-
-            # ensure postgresql.conf exists on subsequent starts
-            if [ ! -f "$DATADIR/postgresql.conf" ]; then
-              cat > "$DATADIR/postgresql.conf" <<EOF
+        chown -R 999:999 "$DATADIR"
+      fi
+      if [ ! -f "$DATADIR/postgresql.conf" ]; then
+        cat > "$DATADIR/postgresql.conf" <<EOF
       hot_standby = on
       hot_standby_feedback = on
       wal_receiver_timeout = '60s'
       port = 5434
       listen_addresses = '*'
       EOF
-              chown 999:999 "$DATADIR/postgresql.conf"
-            fi
+        chown 999:999 "$DATADIR/postgresql.conf"
+      fi
     '';
 
     script = ''
diff --git a/nixos/roles/matrix/synapse.nix b/nixos/roles/matrix/synapse.nix
index 8860773..faf9b18 100644
--- a/nixos/roles/matrix/synapse.nix
+++ b/nixos/roles/matrix/synapse.nix
@@ -34,16 +34,16 @@ let
 in
 {
   sops.secrets = {
-    matrix_macaroon_secret = { };
-    matrix_registration_secret = {
+    "matrix/macaroon_secret" = { };
+    "matrix/registration_secret" = {
       owner = "matrix-synapse";
       group = "matrix-synapse";
     };
-    pg_replication_password = {
+    "postgres/replication_password" = {
       owner = "postgres";
       group = "postgres";
     };
-    kanidm_synapse_secret = {
+    "kanidm/synapse_secret" = {
       owner = "matrix-synapse";
       group = "matrix-synapse";
     };
@@ -95,8 +95,8 @@ in
         enable_registration = false;
         trusted_key_servers = [ { server_name = "matrix.org"; } ];
         suppress_key_server_warning = true;
-        registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path;
-        macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}";
+        registration_shared_secret_path = config.sops.secrets."matrix/registration_secret".path;
+        macaroon_secret_key = "$__file{${config.sops.secrets."matrix/macaroon_secret".path}}";
         matrix_rtc = {
           enabled = true;
           transports = [
@@ -162,7 +162,7 @@ in
             idp_name = "Kanidm";
             issuer = "https://auth.cyperpunk.de/oauth2/openid/synapse";
             client_id = "synapse";
-            client_secret_path = config.sops.secrets.kanidm_synapse_secret.path;
+            client_secret_path = config.sops.secrets."kanidm/synapse_secret".path;
             scopes = [
               "openid"
               "profile"
@@ -254,7 +254,7 @@ in
         ssl = true;
       };
       authentication = lib.mkAfter ''
-        hostssl replication replicator 100.0.0.0/8 scram-sha-256
+        hostssl replication replicator 10.10.0.2/32 scram-sha-256
       '';
     };
 
@@ -273,7 +273,7 @@ in
         "/var/lib/mautrix-whatsapp"
       ];
       postgresql.postStart = lib.mkAfter ''
-        PG_PASS=$(cat ${config.sops.secrets.pg_replication_password.path})
+        PG_PASS=$(cat ${config.sops.secrets."postgres/replication_password".path})
         ${config.services.postgresql.package}/bin/psql -U postgres -c \
           "ALTER ROLE replicator WITH PASSWORD '$PG_PASS';"
       '';
diff --git a/nixos/roles/monitoring.nix b/nixos/roles/monitoring.nix
index 555d479..54c200b 100644
--- a/nixos/roles/monitoring.nix
+++ b/nixos/roles/monitoring.nix
@@ -27,15 +27,15 @@ in
   imports = [ ./gs-exporter.nix ];
 
   sops.secrets = {
-    grafana_secret_key = {
+    "services/grafana/secret_key" = {
       owner = "grafana";
       group = "grafana";
     };
-    kanidm_grafana_secret = {
+    "kanidm/grafana_secret" = {
       owner = "grafana";
       group = "grafana";
     };
-    zyxel_pass = {
+    "network/zyxel_pass" = {
       group = "gs1200-exporter";
       mode = "0440";
     };
@@ -78,7 +78,7 @@ in
           serve_from_sub_path = true;
         };
         security = {
-          secret_key = "$__file{${config.sops.secrets.grafana_secret_key.path}}";
+          secret_key = "$__file{${config.sops.secrets."services/grafana/secret_key".path}}";
           allow_embedding = true;
           cookie_samesite = "none";
           cookie_secure = true;
@@ -91,7 +91,7 @@ in
           enabled = true;
           name = "Kanidm";
           client_id = "grafana";
-          client_secret = "$__file{${config.sops.secrets.kanidm_grafana_secret.path}}";
+          client_secret = "$__file{${config.sops.secrets."kanidm/grafana_secret".path}}";
           scopes = "openid profile email";
           auth_url = "https://auth.cyperpunk.de/ui/oauth2";
           token_url = "https://auth.cyperpunk.de/oauth2/token";
@@ -181,13 +181,13 @@ in
       zyxel1 = {
         address = "192.168.2.3";
         port = 9934;
-        passwordFile = config.sops.secrets.zyxel_pass.path;
+        passwordFile = config.sops.secrets."network/zyxel_pass".path;
         group = "gs1200-exporter";
       };
       zyxel2 = {
         address = "192.168.2.4";
         port = 9935;
-        passwordFile = config.sops.secrets.zyxel_pass.path;
+        passwordFile = config.sops.secrets."network/zyxel_pass".path;
         group = "gs1200-exporter";
       };
     };
diff --git a/nixos/roles/paperless-ngx.nix b/nixos/roles/paperless-ngx.nix
index 184d974..df5179f 100644
--- a/nixos/roles/paperless-ngx.nix
+++ b/nixos/roles/paperless-ngx.nix
@@ -1,11 +1,10 @@
 { config, ... }:
 {
-
   sops.secrets = {
-    paperless_admin = {
+    "services/paperless/admin" = {
       owner = "paperless";
     };
-    paperless_oidc_secret = {
+    "services/paperless/oidc_secret" = {
       owner = "paperless";
     };
   };
@@ -18,7 +17,7 @@
     consumptionDir = "/storage/fast/paperless/consume";
     dataDir = "/storage/fast/paperless";
     configureTika = true;
-    passwordFile = config.sops.secrets.paperless_admin.path;
+    passwordFile = config.sops.secrets."services/paperless/admin".path;
     settings = {
       PAPERLESS_USE_X_FORWARDED_HOST = true;
       PAPERLESS_USE_X_FORWARDED_PORT = true;
@@ -54,7 +53,7 @@
         requires = [ "systemd-tmpfiles-setup.service" ];
       };
       paperless-web = {
-        serviceConfig.EnvironmentFiles = [ config.sops.secrets.paperless_oidc_secret.path ];
+        serviceConfig.EnvironmentFiles = [ config.sops.secrets."services/paperless/oidc_secret".path ];
       };
     };
   };
diff --git a/nixos/roles/vaultwarden.nix b/nixos/roles/vaultwarden.nix
index 3564791..c902d4f 100644
--- a/nixos/roles/vaultwarden.nix
+++ b/nixos/roles/vaultwarden.nix
@@ -8,7 +8,8 @@ let
   userScss = builtins.readFile ./user.vaultwarden.scss.hbs;
 in
 {
-  sops.secrets.vaultwarden_env = {
+
+  sops.secrets."services/vaultwarden/env" = {
     owner = "vaultwarden";
     group = "vaultwarden";
   };
@@ -25,7 +26,7 @@ in
   services.vaultwarden = {
     enable = true;
     package = pkgs.oidcwarden;
-    environmentFile = config.sops.secrets.vaultwarden_env.path;
+    environmentFile = config.sops.secrets."services/vaultwarden/env".path;
     backupDir = "/var/local/vaultwarden/backup";
     config = {
       DOMAIN = "https://vault.cyperpunk.de";
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
index 114bf46..820ebae 100644
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
@@ -1,46 +1,62 @@
-zyxel_pass: ENC[AES256_GCM,data:yEqvWjeII7Uk7w==,iv:j7Lj2HCzlPRnVlvd1c0dTd41gdJAGRi+U6jrH0Vm71U=,tag:AvcPhHJVTCubu/YD9RBivg==,type:str]
-cachix_auth_token: ENC[AES256_GCM,data:nR7e2ZOA3q5DmkrqFEzINpKFEHVD5nyzc3DQ3QgD42fdyABV+r1Ela3iEcbU8SWj5JMRq8T1r7QxqcYW+VSMsT2cjQV2e4ZrpUmkX2QnhfmLqQBdJLhgNKBnu+x8QGJpQ3j7mG23atJ3BDTYBEKlI8y6wLEgpTX8GIVzHJVwfbqewTX4EfFyh3mVMtxAK9II/w==,iv:CSMcUdsqC97fmu1Po3cRrUj9h51Wv+KaUPfEToE7qVs=,tag:s1XHG2eyZYJJ5xd9CZb+Pw==,type:str]
-GROQ_API_KEY: ENC[AES256_GCM,data:OyuC4jfw67sCDa0XBGr78S6pzPV1ruy7KiIqPMgWWcOCVm3Y/khXEYPMjUTGrq9YLOw1MLso0OE=,iv:0y9klMYVtGsqAaLc2JidjZYSLhhbcbWbnBf8sZiC3rM=,tag:r6G2pzZn2d9JIaS+ozKnmg==,type:str]
-OPENWEATHER_API_KEY: ENC[AES256_GCM,data:bcuLz70u40nZfNgPTaeNRXdR/zjx0SQjwMbMNNFqROI=,iv:VCzse1a1/k1ZDIpFPL1QhjuS6YaDyohWi61JZaoc0Ws=,tag:UJSNyniNNLfGGRY/uiJcRA==,type:str]
-smb_passwd: ENC[AES256_GCM,data:+9RYomcnCZSME5DzuJWTLbS3IGJHhIYWZ5SmsgOn6YQ=,iv:VRPVR7DD+swjeUZKe54XYm3wn/KB4RqvQAyYXQbS+A8=,tag:NnA89efo6HVL0scHgyTZMQ==,type:str]
-grafana_secret_key: ENC[AES256_GCM,data:d6tu4kL7flfbdeOYk21zkSRmVe+NvVwd14jgr9Ds0adfgYetN852G25Z8/g=,iv:uWuwGBZVK1syhEfO9nLZUWwa801759tNJx+Pmnz3xeg=,tag:X6/NcdGZHAdIlOwxNPo/Ew==,type:str]
-kanidm_grafana_secret: ENC[AES256_GCM,data:rqK3hkpvtg24P4UVV0pFuabUhxoTgtZvK+h8EiSfVyOSrnRy6jtyGvOMMlIOAQDr,iv:I6e++KrpxAFhM8VDQkx8YsrQSvT4brc+Fh1cY5PlwKY=,tag:sEq91Yucb2pUTDbRir+NyA==,type:str]
-matrix_macaroon_secret: ENC[AES256_GCM,data:a9nMar+p+FXIsxxSqO/to2OJOvD1erfwLwwBeKOcWBu7xykHxqD+pCmrGhg=,iv:rp4ZDVIlZ7SN1RFHB2CfSV5ISPMl9pC4U8Jgqpz48Qs=,tag:LxmWUZE3mG4acagQmlieag==,type:str]
-matrix_registration_secret: ENC[AES256_GCM,data:KhKkJZqwE8xk4/tuQ7NYTv/Ot1qCAiy8yUbDyVvRa0H5BT4amCBIdATfR4Q=,iv:HBN+GorT1VpWCVkDugk4UxYLEYKJIoDZh2d+oUDLc8g=,tag:hHus458yVnH0qaQ4u37IZg==,type:str]
-kanidm_synapse_secret: ENC[AES256_GCM,data:F770siYcYLm3RAQ+3epfVTyp5mv0OJfiOdFiHD8CudjceNkkSuXIX7pxQYkhS3VY,iv:hqYMKLS5m+o3leFE0gBS05Npjy9uyqgSe7yJpPzxvQY=,tag:lLjVZ7/iYoIZh06VyF8zSw==,type:str]
-vaultwarden_env: ENC[AES256_GCM,data:tGAphb8y+9sdo29z1/zRe4IKKKAsKfJZIiRGSDe1Vbpn24ucjnvrDpbuI8AIf145mVckCZ6nsdB88q+XNr4jrywx3b5gGdacZn/wLx6rVpa24VdJOI685nu++CtJjUiPCOiNVRza7MGFStCWTekRGosVWwwjmu8IRHEtywO/+qkVa2tFx9SGxB9ayVHWJVJNI0V3EoWgXp0Sf+gYZvMww0Ew05xeeCdICe9Tz6ExVsI/2feq2QPBgcR4M+g47UrixWf0HmR+WU/HQygSYZ0vxau+88PyfrlOUWBZY0WtETNd0pymVHnvHyFIuBjwa8zg,iv:Oytbdz/9KS21sy2tWAws2DTKTmW8IOJcSso1K1tYm3M=,tag:iWphR6xUegNrCEsqL2o0yQ==,type:str]
-flame_phil_password: ENC[AES256_GCM,data:Xy2ixMeRlnzC2gjKGrjfSbz/ee4=,iv:WFuBS8jn7WYRxEDG3XBzCMnm4eNkHQpSs5+GUwq/dcg=,tag:1zzj0eB9/4KrmYAqcxJMlg==,type:str]
-flame_calvin_password: ENC[AES256_GCM,data:P5ppyqTjAJ1TL4hXtx5WyoS9a+g=,iv:sq98P3Oqud2FXfqsD76YS/p5NEF2xlN0MfG+ukCB9B0=,tag:AeKnu4Hg4xQ3tII0y6oNpQ==,type:str]
-paperless_admin: ENC[AES256_GCM,data:sVvlMQ3dDE2XsDfpwpCTbzPCEKdUMNTFtRXDIuBbgyf1gd6oiJzE23Ytc57plNUGg5h5aEtgxZ7NXeuK5vrhQw==,iv:x+QNAzY9k9t23UYlM9GcAke0urEA5jlV0VzHaBQkm7M=,tag:D/bMtjuwrX6pquZfJLwdkQ==,type:str]
-paperless_oidc_secret: ENC[AES256_GCM,data:+oCeHlky5FgUR8Toue1iQiTaqVX3ZgenEv74S5Cg6XHBObyDLUgUkZNYKj7p88nR,iv:29CBYlOjpyegGwEl5lSlAirkCWtG0+4oOupOTfeI1yM=,tag:KckKGdFa9tNwigWEukLN3w==,type:str]
-livekit_key_file: ENC[AES256_GCM,data:wOtJhwDtZNEY+QjHyLL1FTOtkmzkNA5BoTsx0+ZMij9uUaKC28uFIkMAq2ZzIU7Nyvk8+4YjbK/Rrsoy,iv:UTDuItr0XsG+/4HFkEHDpxXy41QiVgPCisHeMMY2dQo=,tag:SkoeLWClO9I/V2sn27Y2uw==,type:str]
-draupnir_access_token: ENC[AES256_GCM,data:ZZUc3a5UfjUe/6HG/EWUNAw2ND0FDNZobOwMW0uktsv8dfieZxL1Agjt,iv:bsLbGsXJfnRPScxmzdUXxgIS7QNol6HgimHBDJXivsU=,tag:P/BqC/KioVj0V+82lLNiZw==,type:str]
-coturn_static_auth_secret: ENC[AES256_GCM,data:7AI0E8Hu4WxI5q4j1GqBMSQ+evE006uPMtwIfGn4eFz+XB2JA6fhhiGMPPxSkqOyK+3eZJ5ahiG05JpmBmmAbw==,iv:hQJQQDVo43U7lvV754PC1THeFCpZZEyag+BslXyoDos=,tag:Vkm+IXr1h8ZNpah6UYaKng==,type:str]
-discord_bot_token: ENC[AES256_GCM,data:j37Qo3FCyRwNFqWSWpnQKCs+AxH5HlQ8U5If7ylHilQoORp8Pb3TtNETTJSjZyvUXllldevAbHrbAEEKnNfoUJx1U8/wl6H0,iv:WQqxFXTE+0LIB2lSvVcnr4LNXPE7uzNc0Kk8NU6Z/aE=,tag:fNeQLhoThEgfa4sSGKLZCw==,type:str]
-discord_client_id: ENC[AES256_GCM,data:U/iUKXT6Nsl6LRN9lPh1xaIaqw==,iv:k7kQ8rJBrMs3YwD9aDfZ6qhd7H3aVsSPTOwEIxVTw2Y=,tag:2wKhxGbf+P+h3BYeWUSczA==,type:str]
-discord_pickle_key: ENC[AES256_GCM,data:6j1pBQxmK8kFELSBBeJ0FwzAHz1GTGhxQwrvhlLtiU9+HICBBJqmFra1veZSO4yLchye/yPZ9Ha7oau+SgOI6w==,iv:YcTQQFcfLK33CpZnhEiKkt71e4ziarGKPyt7mmdQ+NA=,tag:AJRD4xYvYOZ0L1Xo+O+aGg==,type:str]
-meta_as_token: ENC[AES256_GCM,data:WNkfHIRl9bGdzGRgjE2C9fymA0nX/ginNqRldyygaWw=,iv:BTVB+sf46mEQ/+FXCe4SRgmkfpnO2wnWlpKr/4uQbe0=,tag:qP42MN2qm1Tn6physjLK5g==,type:str]
-meta_hs_token: ENC[AES256_GCM,data:BG7sSy0dIxf8EwjIA3rXxRZ+6IRPc2sJKSFXw+aldvY=,iv:gjk3pl/iV6rivxxrnR0jjEiSkmj0Jl5ojsudepKpxtY=,tag:n+BGaHRD+CqfXCbRPtFmfw==,type:str]
-instagram_as_token: ENC[AES256_GCM,data:zKAv60IezEYqDEZNOFS5aKgNztBL9JUM9sfTZCD+vkg=,iv:3xCkVfT0S947LzpDzC0N1kuHOBhVaveK3m0cay0DlGc=,tag:NgJq8YN2r6NKj8pwlsgkXA==,type:str]
-instagram_hs_token: ENC[AES256_GCM,data:+Lp9PQLUxyn/xS+L/hFcsufF0UxQJTiEd/7su8NmobI=,iv:ad9Urc8CwTfLWWRpUL6/TxfTB7LU8XoPq3kp8ifhfr0=,tag:0KkcdDAB/9rcuIgbLBZAkQ==,type:str]
-pg_replication_password: ENC[AES256_GCM,data:w2h07D+j3LNkcbvoKQ2Qp3HSvC2Wf5HRAPAo/HNhmUkHBOaDyILNxo7IDjqajv0jytpG7q4joCJQhS7tEUlA9Q==,iv:26ZurAq61IDqGdAl0yPpoTJElo93hJJIEUlza4DGDNc=,tag:a46FOKgeqEEZE+rC+H9NbQ==,type:str]
-kanidm_gitea_secret: ENC[AES256_GCM,data:RavtSb5BaJGwwLB/oGzG/KK2AyV+IzEjihVxnD3/dVnxmxcG+CITIYPLvFUJjmvY,iv:Cg8dAhtJXDvRGULIkpWAyuhhlLEdvN+4lyjHPR/740I=,tag:8kMGrOjXEA4GWSLlP7oIkA==,type:str]
-gitea:
-    dbPassword: ENC[AES256_GCM,data:S6VvRgkdYk1AzXljyQEEq68UJ9zrFy6+INBMIAspXNcqcM6o+es19o0mcXA=,iv:/pHYpkZZq+9Md+75uSCb2YXfSvaDzUh6mMfH53wb7eg=,tag:ZnbyCQwrK2JnbO5HFqgJYw==,type:str]
-    internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str]
-    lfsJwtSecret: ENC[AES256_GCM,data:L20mFZ6zwsF3ZUoodarTJV+vhUdLlBrUbHz7FpEzJ2/C6AdFc1ZZcioN3g==,iv:E2C3gg1OYQ46Ae2bGnhF+3uw+q77l+yph3Kd2fxwW9M=,tag:VQkQ4R9S8Dr39rSLhL/X1w==,type:str]
-    mailerPassword: ""
-    runnerToken: ENC[AES256_GCM,data:giY3e3oHqWytgIWfnuKxOfrp8R+u7I0lMzEGnLWXnZWL9aQkVsM1kiF1FNKn/A==,iv:YsQrAKU8pncPeSSosOFn9BjU676KCh956FGC2hnCuac=,tag:+eZ1y6P/85XNPD9gVVNMgA==,type:str]
-ssh_private_key: ENC[AES256_GCM,data:R511mVFVk1ogAd5CKk/2P6rtT4NnHIFfKyqeCen545QgcvDqDFmW0rFBmPJyipaya2srJNoWvKJbnvxWtTYeJh2tPAybRMoUicStIFMUn3FPNfjx/WuQFLhKLoU3UOHHPJnkFqkQ9MBqLq2k5K7MVsNNFTxIDCKS1jPgkTmAWjRZ0EFiRXLa+Gvnz3GP5ltgfjDwdPeb5xp0/AqKPD8jea9w5ClR6ckrRHCLsfXhL2e9IaF4B96JlIv4rICLX3HmeIgM2PKl2MnSt8we5z39bBoLSA0yWG6BvpiMBaFqbo7jeHf1SxI6R404/emHhwW3pwSCDrq2ZE1ATG2UmA5NssFcVuaBPBoQer+n5haVYMNpNUp6rtKZeAIbf5JEOXJ6CJqiInfnnzOMNGhGFkGUYkhsy3p6Ti/lmNMPX/xtY+8ZqMwXf5drssm5KgnQ5nDbVqnTWAhoT/D3t+cJVAaXGTGw88fU0X95dZr8vaL/5nBCj1uUdv5cRBJ8PGhqbBX8PoiXrtGooBGhxf6nHbxIneSzG1++MZGo3e1G,iv:D1lgCnZKm3Gyv6cZpQ7zGW7JXN5RCwoaas+LroTkhPc=,tag:WI6Nr1cX8gm5pjFpu/Ok0w==,type:str]
-ssh_github_key: ENC[AES256_GCM,data:vZAH4cRDsgGXLAppQKOyUPOvmBJZ27bujMGz4hQ8tt0xhGFUP28llwGZz/VRuU02Yv4alLgVWBAIPuyhZT9f35KnjIR1Mmb7HXk/6oaNM59/lBiISLrnOpC10WmJ9O5krKdxwP8ZDvHA34B0s+oYNkTNXiU0S8AVg3icploax7ylKH5Dorj53kjdYSTjd8KN6ZsgCKmcz97+GnP0IgdmauyNL7e+kv9WIfE8Xx1kGvC8WVnidX2YhSxm6vt8l60eUj9etRigU88oFYTDZ+mIf4lucSpzaLZutz2fM/16D/o9SS7mmTrEllj2S+IXc9ZZTRKKDLbW+yv0XUi0XZi+OHAdZScjS54NZKyT9uWrc/IDJHammGsoHRQpHZtbGhkeFi/KdJsYBsWItslXjM0xJVtFIM2tMnd10kv9UGuXsSl9J4NC0rpz3aXnQqG4ZAhMjN9D/DTJpB4K0pcFyd2FDWdrbKq5iPfnU/V6ecnHPML6wCt6gua/LdK1MWoG3l2SqwMLYj1r7UW5fQZqSw1EK0BAtp9cQMLBL/2w8ykMfWpLekE=,iv:gcinU7xOoXQkFVkLNB3sQYHAcZy3pZN+bDRIq4sspys=,tag:yawgAHBKIkGpnKPHsRId4g==,type:str]
-nix_cache_priv_key: ENC[AES256_GCM,data:FbRHM4n7BDMDgZYtTOdpS0SQx80afxMC3uw6PtdKb1zcAjyQRYwJe0esTDLklLDh8Kx6dgZOJbrf2sYIzF5xVv09U1Uz0C1UnF4M6yhbg+Nqg0HfVj55L3Z6ulrxNlgq7gY=,iv:F9DZUsyzZocKoB0yByeBcrCw9Ytcp+Xk6y8+ZH4OV7k=,tag:mSf1zVciPkifzr3kVFAt0g==,type:str]
-wireguard:
-    cyper-proxy: ENC[AES256_GCM,data:ohe1JLavTPpEcQl+EGPcmJodBn6KaLf7S7aCLrHEgROklcX28Yjm1m4uW0Q=,iv:4iEO3ay0sqaRUxsqR3P7XFpbD6mnnq73yNsZbT22iGU=,tag:HwQaId/xi6OF99z9bZf6ew==,type:str]
-    cyper-desktop: ENC[AES256_GCM,data:pABywoxw/BURnpwCfsvXD7jmN+fa6NyHmJIKpR6pkTUNHE2h1xsD64M54JE=,iv:UcDWk1ULbbxBDad/MDD94Iaj2bB/xlpLWtsuPTP6E7c=,tag:La/PWVzumCusn9IaAFkxwQ==,type:str]
-    cyper-controller: ENC[AES256_GCM,data:q85Tw7GGuoMlsRPDlPJ0n3aUw3cOejmjDwxSBr6Jkw+L7ZAU9yz7vthIpho=,iv:CdHhEqAOBMqsa3ZWD2RIoTlyObBpnUQhdZncmq8u7W0=,tag:tCYXugIb7rQDkgwRsY023Q==,type:str]
-    cyper-node-1: ENC[AES256_GCM,data:+Des2tr8Fja0IarMmn6xc2bjYIlwfoVmdXMRC8yyenIrke+SS09/VV8ed/A=,iv:xL6gxjur1FNDtziNP/bEGyUXZ9VD9wmxHmWb6BR3xig=,tag:RGLuXGMAJSaREE9b9RnnfA==,type:str]
-    cyper-node-2: ENC[AES256_GCM,data:0vjNM8xgHXQtKDeKD6NBYjn3jpt9NMsLgaxZOzb9wgg1HTeLjwhK7Xw12Co=,iv:CETgdC0nKP5n8XMZj++bXWUY/harcJu+wj3S3ksLE0U=,tag:6EHF7DWi0ruKjJht1ndWcA==,type:str]
-    cyper-mac: ENC[AES256_GCM,data:8MSy7ALUwYyk42CpIuiym4L3VIn0MSyxr0M1Gz+t/hAwzNdvWQkYUZirZ+Q=,iv:eUbXRhhR3/ZQGJE/Uf0bISWx1YeOuPqhhMBo4CwF23w=,tag:mgfXWrEWyS3AsvlA6EJq8g==,type:str]
+ssh:
+    private_key: ENC[AES256_GCM,data:a7N6GC9OwOavo0NOQsOMZA2hzl8IO1tEbs97IFckukgj6nrdjw/Nr0CsdkOROYrz2VBgQNlQ95xSgQEssscuKq5sOlQMCaaEHeZ6QkRp7eBu0AMN+y1VGeAcAoXtyF41wZhkLHGTvePGGVpMtO6fOKwKd9rLMJeaR4gEHOwH2mihe3pmcHhc69hte9fVMTziHpDQqET+1tBt5mpf1b0zQqUYzLnVZB01u/TUz7FWPqaZrEnCItoBi/C+728bCW4Z/XUSpY0g1A5sAHevhFRsE93vbXWRF0AoZfwgImLMtjlLPxm7/6DG8NXnIg3PBsDZg/TP0xiNUCiewRlw413xStEqtM3zqQpTxFAGHC4zcRsrZ9bUwJf/jIzaxm8/EWrVKK1oGftkbxloWPzmZ744K9TXZvBDYW0kDAFm6Gygw4EhZUrHhTYeAWRmdzSNL7y0ybJ4hIE7sgixAFQ+Qdh1VMeh5KRgeFQVGkQIkSddwZunmEH2HUgG/BZ+KYsSAfEiQ+AtWwNzQCJ/YOoEa7JI5G9RZYvZ6v5m4s2R,iv:TKK3a3HcnBCe3TV0zYtnDKPkAfXUGRhPEcaBFkwXX1g=,tag:GyT2OjwNVBkUV+Cs59Q6mw==,type:str]
+    github_key: ENC[AES256_GCM,data:7/fHXvyZ4YtQPAyfgd5RK/JYW2JsvFh8XkI7SCkTLqSEFfH0aKjGQKiy2R0P0OCpsZbWNiczDI467IbGYox43fqRE6gcWZSp55yKCqlLKPkklsvXhyAlPFoionQQefRW36JMsDzq0QsdgRb3IvvKY2oPSMSZDWykNJqSPChe/h/3oujaIZ1ZjRmrDzRrsukqxdMzh/+75vFPC7OADH7q/NT248zlcmrcVTw9HlJMn9G1oz5ufmoNSHoSv/LsOpzLGWffknCiKi17ewEhatWaC6DhL9NgScMFcRHEVkAvoS6ivsXgoqQeh0t5Z80MJYUCIYnqZxu/e/TWG3tXi3EStVmN8gyoJfvmLxgjC2dzjKCClJwgrFUa7Eul5jZeSJHymG/ZVEliH+aPxscu2P3kb3TJCThCctiBr0+WNCz219fE5bt8uePm38t1HYYGcD837ExUACFFtfz772IGgSmaw0scOGBpUxo3YBz4Bki6d65MgTKf13aaV6JM/97+NB5a5REERH2lBt9lAqCWSqs8JtTNlwQq0Zfk64eduZ3qgNMfj3E=,iv:KvYUjVbvb70OVC8dTk02jjONHP1boZ3NOnfZFbhkxoo=,tag:dRNvvVY/MB75yEA/x6YrmA==,type:str]
+nix:
+    cache_priv_key: ENC[AES256_GCM,data:+7PvIbHb8oRb9fEWjaO9n3XxTIpkHzpB7zwRx3sYhoHsDXkYZRtan9fVIp+FUC+Uv6ZYgvZJ2SWU6W4dgajHL4W8quS/RdAwYi5F5UhAFKh/Y8faTpayOgWr8BIrNtPp17Q=,iv:JGmwCg1jaVyHowfSOaQ5KryRo9EkP3GzwMK0fkz99eM=,tag:2l3SsoIBSeiMXxCIUq9iUg==,type:str]
+    cachix_auth_token: ENC[AES256_GCM,data:SG8fiyHEepsTzts0gB4p0VR/QcOvNACkI+kBRR/Oq91D190F84eupC2an1m2OYoXEwsvprFEOkn6cstdVJj/0jmcN5vM9SFSp+NjGB9xEh4RiehBaiteXKF0MY8YT2k3NUF1H11ZdA+XE6yxmyb7r0CksPtwXsEwiKiRfPNcXPNlHQNF9mARS4nyGqeNUe2FAA==,iv:33RAKxf6mmWh4a3cKuiKFXgPqUpq0Yrpe4ug/rOzolY=,tag:jmbvNR59GGUXqbQg0hWc/g==,type:str]
+network:
+    zyxel_pass: ENC[AES256_GCM,data:4ES+Hqh9q0CeBQ==,iv:UaMBQXlj7Lp1ITLwdmnxNja4948nh0S3d2SrzIZ7Fcw=,tag:NC8uUCrheyuDK7a6SX3mmQ==,type:str]
+    smb_passwd: ENC[AES256_GCM,data:rDJxLyjttog6lBMQtJMJrAwzqdi5d9MHa/lLmYc7Y/k=,iv:+RnqzatLGPmbuxxdXt5FEQPSAFw5vyT7FP/ljoB8OrY=,tag:yrBjjYPgfvgW1vF0uUdEpA==,type:str]
+    wireguard:
+        cyper-proxy: ENC[AES256_GCM,data:46/HuqzAQUqfqOL8cbW4KGELEqaL5rJy5ih++8k1E2xWA64DxQ+fHYR9ERw=,iv:b80GAAqqQITDN476TwR5pWTwBxZZ6bdhBs+VBKRcrUk=,tag:tb1yS1fxo/eTeEWqe6yXQQ==,type:str]
+        cyper-desktop: ENC[AES256_GCM,data:SefZogukK+BlsggykL3G741rz23wS5/7lx3F4Ckk/sqfxiFJzMbMoCIlIdE=,iv:0m2ZIU87dwtspoMkxoAKFSvu7yLwX6un7luzb1J/d+0=,tag:HrTtoN5pkdYvyNbq+9yLEw==,type:str]
+        cyper-controller: ENC[AES256_GCM,data:FtBLNj73V36/mXFAfWlpiejKjvEeZYaIeILVun3KLNOkhy9RHP4bTdfKc6Q=,iv:iX71amlKbMxTkF0vFZ1KNtxsdRQyD4QhHSQyYv5er80=,tag:LtXApRvoNWooFLU+df1OXA==,type:str]
+        cyper-node-1: ENC[AES256_GCM,data:O7Ivb3v+FlpqUEAuQV6rYZLifKxbBWiiNhwMHeY0swrSseinFtS6vNE5BmU=,iv:LIxniCFkX1mRj0bLPsz4XLX93Mhz2NEN9NRjxKzuakY=,tag:hPp077sdjFpxFIxjXME7yQ==,type:str]
+        cyper-node-2: ENC[AES256_GCM,data:RKGrJBsfRTErZglS142uWqWofS8hlFW4y19Hddv+RV1/FTrD/pt1ATYmo0E=,iv:R4j7Cx3juTyzTeewPiPfyFzDtNySH9UH5/vZXRDM/sE=,tag:Dxfne48Mtvzi6qqgb+MpOw==,type:str]
+        cyper-mac: ENC[AES256_GCM,data:xutA7q3Sp72OiRqDWHToYV0kLM3h2lG4DXd3oH4sglGwMS/OS+D8Dwwuetk=,iv:Zb4LPRrWPfICOUSiVtBbdh+YqqL62wteU8DkAOXRy2s=,tag:6w1V0QhKmbyV6yjY+BXNNA==,type:str]
+api_keys:
+    groq: ENC[AES256_GCM,data:pU+FKpJWRi2z1W7GDQbHqlVzVfS6Dd7CypGokvNcWFRU2N28vdHM1oD+DegGaxJSR0rmG2rWYjw=,iv:Ob+h75nGfda+UKAYWDaNzyxZ4v4219Rtxvih17mBd4E=,tag:1njBY8WypB2cAxWSQFxi3g==,type:str]
+    openweather: ENC[AES256_GCM,data:YTF/zgp6nBnhv3HosrgJeLYSeLObVaUpRST/k/M6C5c=,iv:AjsnpY0sneoNvr/TcQ5LkSJbmFpc1JUQ0GCYGwMt6ow=,tag:rMiwtOoLdwmHltT7Zw9Htw==,type:str]
+matrix:
+    macaroon_secret: ENC[AES256_GCM,data:1KuJEOEuk8UZbu2drFBqmhn42SB3NfJWeOCcbaf3jV8WIW7P3YyjVdY1j4E=,iv:3STA/kOqKZ/+ViouC7vtGAot1iwhjHGybw9lGF/Uf7Y=,tag:fHv1GQw+OS+/wLELkmB/Xw==,type:str]
+    registration_secret: ENC[AES256_GCM,data:B7kgV+atIlf+8dF25i9K0PtjVBqef3z/Ot8Zu1mwitdtBTH/ZkSotnByRxo=,iv:e9R2N0LRVMPBwPW2rCUSnoOgRhIY1nly23jVx23f+mc=,tag:2xD7F/KS2MC9n2RafcTuQw==,type:str]
+    livekit_key_file: ENC[AES256_GCM,data:LZjTDUtd4MTLZcqG3AhtqSKgcjnXaK5UPDa6ZKrextdBpTVbgX526+qkpIYYdbErbwHR3Ly6nIglMUqY,iv:MnVr/wWL5ef8/yqwU8eqLK8a+LV8ekgFhvpViAR5v1s=,tag:9AI4ZOX5pCqY2Ap9Gs3UJA==,type:str]
+    coturn_static_auth_secret: ENC[AES256_GCM,data:ohYLtZxw7vV0ciFmgytslPUrPSJlKIg88U44jY2iqHzm1LocL50kR1rEDTytakpKGD4klbJoldUnv8t9fCPmcQ==,iv:p6jRjaRXwwMMpC+nBsZ85Znoyk/Skd4zP9HaeeyZ5Nk=,tag:VR0hqAURe11MMVFVy1inKQ==,type:str]
+    draupnir_access_token: ENC[AES256_GCM,data:x6om7MeVn9dbgV4w7gyOtAn5fiqgZkMVdYmas610NPSgIj1zQhOG4led,iv:3ZsVnxnNGfOmTnjAMPxknvleM4BLRkFY8oPcFZo2/Vs=,tag:DTej5tK2WKWCvXCMsnbVZw==,type:str]
+    bridges:
+        discord:
+            bot_token: ENC[AES256_GCM,data:5PvPk9yyh2+e+0jqPvCgh9LmdsH5SPEJvDDvVome/Di2a9S5xHwjTqy/wlEnTYIsVjkV99YvB3MIgJQ5yfY+o6ugWLA2Dn+Q,iv:ijBkSVxOHtkw9R5kcKI33oF8LrzVjNmA06HAH39qTps=,tag:Pqmv2TdSw5mZWL6li4e3tg==,type:str]
+            client_id: ENC[AES256_GCM,data:5+ccIw6oZJgnFCbM0qSz12ZjHg==,iv:BPuxfnNRECzLClujH7fLKGLExlnxZZZ8/8hmnykZagA=,tag:LeLabHo5VOakp95FlGI6kg==,type:str]
+            pickle_key: ENC[AES256_GCM,data:9MDfp6+GYqdp32Ax5+D9UrgRzftaodfAjrcAqnqM0CPF5mgMljjkipJkSyrd0hgSaTx+lhidaK2h9qo255HNxQ==,iv:eSqKbs4tS9av1mxM6A41igsMH+YcLX805YUYkCqf77A=,tag:OxUrgiO8IdUoQ3G/hgEf0w==,type:str]
+        meta:
+            as_token: ENC[AES256_GCM,data:jJ+wsrl7ZYRDStqBdOqmkBAmrUn5jQHuKnZaTR8szzI=,iv:tcLCsDRn4W78txhtxTtegyugNX6Q+3TrC5Mufdn/gvY=,tag:tL9iSw70lVJjWO7IXUeCOg==,type:str]
+            hs_token: ENC[AES256_GCM,data:rZg+4pbo6OCQUQLfU8k8ZH1WAD/+rozsPJBXbWBSj/k=,iv:oTDcvQf27nl9WRbNUnUcTvTaB5V8yqPp5hRJ3ahGdog=,tag:OC8yjihe/1LG4BuRAcswng==,type:str]
+        instagram:
+            as_token: ENC[AES256_GCM,data:yHlEGjW1BUNP7RpPgbzlspVbEV0BKRjs5kfCaSOK/hM=,iv:rWGIoRCV53ZDrm0NCQyuxlwlpgdZ5Eh2szhWYa3hYIM=,tag:HFSekpiQ+Lic4Tn8cJOxWw==,type:str]
+            hs_token: ENC[AES256_GCM,data:7RYeehkMI8/f/c8A5xC2V4gyt9ouFOc3gNWpawNH7UI=,iv:kHPVNI3GdUicxyCwwx3724HXK4KdQC6v9BV2iFJ2du8=,tag:ftbtp/nEEdXp87WHceErjg==,type:str]
+kanidm:
+    grafana_secret: ENC[AES256_GCM,data:qStEzFKZd+A8vKRVbi+2mRF2j7E19AwHJmYWLd7k8S3Q8rlRBy1dKETX1N6D2T/m,iv:Gbz/dIp0wUK/i01jpSJ5LDS63l3/h9L4ccF+Ie1IwHw=,tag:GawIF/czOqwlfdl2kha0zw==,type:str]
+    synapse_secret: ENC[AES256_GCM,data:JBgAv/dWDRaK/KxnxFS5RlreU1Thgmsaro6PAliYOVDb/xm0pyv/Vn0aqkXMosee,iv:GqXwP2ReZdtyYomkoCMiMWJDym/xZ3+9aMpJpM/wnOU=,tag:5AoAgkMdH1mnyFAPlJOcpw==,type:str]
+    gitea_secret: ENC[AES256_GCM,data:ATgMYYfQUreliHXiQnyBfpdRomPgUuWJroRS+qknzrHg67z/6c+8zF0ojU7t1nJY,iv:s53AiQ/6SqfNGLYGdNhuyLxYY+wzeG+vJvCbVZrstyA=,tag:AqOH2QKC2CGjFy4Iyy8x+w==,type:str]
+services:
+    grafana:
+        secret_key: ENC[AES256_GCM,data:aIxWzr885wkJusnS1mBfLIG9mrqbKQh/63pQqu+cqnj7w/IHb84OmGtcgi4=,iv:aSeH6gB23KtqXKsN3YJBojUUsUERCZh7vwwu+Y40dUY=,tag:ng/nIb8qhxM8xAtLXXYEJQ==,type:str]
+    gitea:
+        db_password: ENC[AES256_GCM,data:dvnhkFXULTxzJvJwjx2sIEKxJYAanfHSBbajKlEiOjbblYqlNr8yz8k/PWs=,iv:1lPmzHe2P8V8VFZSsfXBAegaZk7esQ7fa8Jh6TzAZRM=,tag:c1zIRReEvJ05hKxS8izUNA==,type:str]
+        internal_token: ENC[AES256_GCM,data:/vIuj0hFsiXO68fUGuG2JvcGlpK4euZ/fr2xJgi0il4V61N2Y7ybKmjHYgHxelw7FB2zsmLgSu/7bY4S2ZMw0dg+qQbsBdc63ouOg6QMXFDXECHrEMmrXztUU27jkRAvI3GEiiP9gXSo,iv:X7VvcfV1bXw7ly76fypmfE746llrPNrGVEDW5JZkP+M=,tag:r+6zqFIRKZJ8nTfme0bdag==,type:str]
+        lfs_jwt_secret: ENC[AES256_GCM,data:CpsMCJSfYM/Q+lJ9igre5farr6eLO9d1ZPcwRFzEGFDVO1p2s0REYs+aig==,iv:3ywMoT8eNt2xAzumWg3e2Ju+gu62DWnfaa/cEYv09is=,tag:TLNC1cp0wBVQGkrWBHvw/g==,type:str]
+        mailer_password: ""
+        runner_token: ENC[AES256_GCM,data:mSdpjIMTI8XtlKSYziBfjZ8788CshKJjYQQin0IIkSBTauQqFkLd/i7M6XL92w==,iv:gO1Ffjx2cduQ+AdDnrAn5y3x6AVkynffGrGGfHG15ts=,tag:mHe6b+M31f3ZaKzEfpZM3g==,type:str]
+    vaultwarden:
+        env: ENC[AES256_GCM,data:UbSnqF1yDBxqIuuEO9l2wJgrVRrzHI8ddO0M2LF2q2ASUod9PYEIfKCbjjHQGjWdb5pR1OuM3j9e7MO73/1wsv10FZ9qMPgvYG/bzzy440RFs8eTMuwG4GYUCZiADhvQsF8EcoyAoAGMkDfdhxIYENaNVSUNwwuTD8Jq5jdbu2ZFBvFMrmN4tb8XY55/rPwuIoNJlE3+fmlanJcRNxND9sHUVsuHCGl8M7/VEDyJCX7Ind8jKE//91+QBw/aHAQJ3S2i1bQ4QGSLZdgKiWxds4ewdTfdCD7nHMIoNvbHYQiYaTBCB3j1jG4nGSC2OLAd,iv:EkHy13U0I7dMaZjRy3KHbiEjSGPgSgOlgutgLOtE3tQ=,tag:AlRneGte17JbHXHjET3pDw==,type:str]
+    paperless:
+        admin: ENC[AES256_GCM,data:nqSwbqc0BfSTFlWK98J33avzH+lAT2/GiD9h5l+DgAJI5pfIJ3KPdNjuLpNKzWt+PI41Yy7iOjWWbdKLDXFEGA==,iv:2WXUWqrV9hL5UcqXnJyRDENqdrSmu7Xwd7u3EeBJqWo=,tag:jobIJb3SNM1wAN+6DLNtnA==,type:str]
+        oidc_secret: ENC[AES256_GCM,data:n8d52WTA6BnhIuagg7kT+qMl7eyKwdXdtJFWEtD8FYgAb2dQ09GKSXnL/5bnb807,iv:k3MMXL2q9qewY0LMUjXuOB0h9GU0nCdmURIiUH0ZWYY=,tag:K0AxU+hBYAolVYeK3s1iMg==,type:str]
+    flame:
+        phil_password: ENC[AES256_GCM,data:ZommCiuOgVsgMsj3Z9mlc2Obq6I=,iv:Jnrw1ykDXtzd5i1DSBuHYv/DtuzEBTF1d6Uu7yw/u/U=,tag:FrNzcrACzwh4TdeZYqKFsQ==,type:str]
+        calvin_password: ENC[AES256_GCM,data:DZph6YVI3WxvyKvUGUm12btm3ss=,iv:BZUiR8Ti4IjsC7PcTtvM4H9K2BxNvCNx3Y7i3qA1EAY=,tag:P6E9bBUKtb/CuV1lTfcmEw==,type:str]
+postgres:
+    replication_password: ENC[AES256_GCM,data:FwHkM5TYpbgjgb5qTeX0LgYIrZ2JOGINjri4VtlANai5d+687T/4Wx1EFgrwS9TC14TR5h29PfRyQmsUOt5aFw==,iv:lIWEMpq5TLa4xd0s/y88y+ror754z9x/9J4cQH+d5Aw=,tag:NXX0iFHakXgrDx9meXO9SA==,type:str]
 sops:
     age:
         - enc: |
@@ -52,7 +68,7 @@ sops:
             6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w==
             -----END AGE ENCRYPTED FILE-----
           recipient: age10pyhca0jy75wtqv5hrn0gf0jcam5272zx9h73a8xwwaxyfq89c0qs5dr9t
-    lastmodified: "2026-06-29T09:28:59Z"
-    mac: ENC[AES256_GCM,data:61grzRKB5rRaVat0sIko5B/V5+avtSEoyRwOH3jkWSgcsmVyjigIxfWSWFoMWTEkv1VmxbXA02WXZmMTqUQGsBwHD2chkUV63lTQOQql9yweRk0lLq1kUheDTuRTPwwnerA/1z1ANeUwHknvDzPF1dTisYhlRdH7p8oBRfISmp4=,iv:JxWfbEja2TLBvN/tg6Ub1pFZSJURUeSEkSHnivOGxfo=,tag:eLN5OjHarcQ9u7BYPsO4AA==,type:str]
+    lastmodified: "2026-06-29T09:50:17Z"
+    mac: ENC[AES256_GCM,data:Lf0EhcsyGIWuY3b3DWyynHcCtxOG56Qi3052DUSjHFM4pjDBzOqsy4xk1oEoI3fEAxYYVsGPrWzb4wrqNWWHH1eY10BSwgyyUimyOZuCPQ3SoX0Kr+LgInecwpzafPcDCUallLQ0FHnEyPqMb7j3CyJmRK4NbibGxhggFJONDiA=,iv:REF37EoncGdUx6IilOP6BZ4Vior5PejOkAuoU6vSabQ=,tag:KNvPfPclocJPmSVfKOOuJw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1