diff --git a/flake.lock b/flake.lock
index 6f4b37c..70d9ad0 100644
--- a/flake.lock
+++ b/flake.lock
@@ -545,6 +545,19 @@
         "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
       }
     },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1778672786,
+        "narHash": "sha256-Tf7q8/0aIwg4Btd/GUMNHXDTqlrWTr5o/vZ8euFUAQY=",
+        "rev": "eef00dfd8a712b34af845f9350bac681b1228bd1",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre997230.eef00dfd8a71/nixexprs.tar.xz?lastModified=1778672786&rev=eef00dfd8a712b34af845f9350bac681b1228bd1"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
+      }
+    },
     "nixvim": {
       "inputs": {
         "flake-parts": "flake-parts_2",
@@ -601,6 +614,7 @@
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_2",
         "nixvim": "nixvim",
+        "tranquil-pds": "tranquil-pds",
         "zen-browser": "zen-browser"
       }
     },
@@ -635,6 +649,24 @@
         "type": "github"
       }
     },
+    "tranquil-pds": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_3"
+      },
+      "locked": {
+        "lastModified": 1782711090,
+        "narHash": "sha256-eIGDmhmqjpzxspXhd5qbMsTdBeVvpD67Fl80kgLtY6E=",
+        "ref": "refs/heads/main",
+        "rev": "6ec4484cadf60188a09726c697fc7ad221e275dc",
+        "revCount": 443,
+        "type": "git",
+        "url": "https://tangled.org/tranquil.farm/tranquil-pds"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://tangled.org/tranquil.farm/tranquil-pds"
+      }
+    },
     "xdph": {
       "inputs": {
         "hyprland-protocols": [
diff --git a/flake.nix b/flake.nix
index 237e6b4..309015e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -25,6 +25,7 @@
       url = "github:nix-community/nixvim";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    tranquil-pds.url = "git+https://tangled.org/tranquil.farm/tranquil-pds";
     zen-browser = {
       url = "github:youwen5/zen-browser-flake";
       inputs.nixpkgs.follows = "nixpkgs";
diff --git a/modules/hosts/roost/roost.nix b/modules/hosts/roost/roost.nix
index 41afe17..d371006 100644
--- a/modules/hosts/roost/roost.nix
+++ b/modules/hosts/roost/roost.nix
@@ -7,6 +7,7 @@
       den.batteries.hostname
 
       grub
+      tranquil
     ];
 
     nixos = {
diff --git a/modules/tranquil.nix b/modules/tranquil.nix
new file mode 100644
index 0000000..f0262f8
--- /dev/null
+++ b/modules/tranquil.nix
@@ -0,0 +1,21 @@
+{ inputs, ... }: {
+  flake-file.inputs.tranquil-pds = {
+    url = "git+https://tangled.org/tranquil.farm/tranquil-pds";
+  };
+
+  den.aspects.tranquil = {
+    nixos = {
+      imports = [ inputs.tranquil-pds.nixosModules.default ];
+
+      services.tranquil-pds = {
+        enable = false;
+        database.createLocally = true;
+        settings = {
+          server.hostname = "pds.alexvds.com";
+        };
+
+        environmentFiles = [ "/etc/secrets/tranquil.env.production" ];
+      };
+    };
+  };
+}
-- 
2.51.2


From e2ec40a9560c49df15dcfb33e7bbce3a00082f3b Mon Sep 17 00:00:00 2001
From: Alex van de Sandt <me@alexvds.com>
Date: Wed, 1 Jul 2026 16:37:57 -0500
Subject: [PATCH 02/17] Add secrets via sops

---
 .sops.yaml                         | 14 +++++++++++
 flake.lock                         | 38 +++++++++++++++++++-----------
 flake.nix                          |  9 ++++++-
 modules/atproto/sops.nix           | 28 ++++++++++++++++++++++
 modules/{ => atproto}/tranquil.nix | 11 +++++++--
 modules/hosts/roost/roost.nix      |  2 ++
 modules/users/igneous.nix          |  1 +
 secrets/pds.yaml                   | 27 +++++++++++++++++++++
 8 files changed, 113 insertions(+), 17 deletions(-)
 create mode 100644 .sops.yaml
 create mode 100644 modules/atproto/sops.nix
 rename modules/{ => atproto}/tranquil.nix (65%)
 create mode 100644 secrets/pds.yaml

diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..d8d595a
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,14 @@
+keys:
+  - &pds age1j0jft6cd5h7g0lq8hxkuq3ysrj6wzkq0gw5yxlh5aklsqdth644qapy6tg
+  - &server_roost age1t94dyp6exjjex0tx5rhznfg7ua6jfgte597ke4wtl2hm2a472dqqpdf9z8
+creation_rules:
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+    - age:
+      - *pds
+      - *server_roost
+  - path_regex: secrets/igneous/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+    - age:
+      - *pds
+      - *server_roost
diff --git a/flake.lock b/flake.lock
index 70d9ad0..915f384 100644
--- a/flake.lock
+++ b/flake.lock
@@ -545,19 +545,6 @@
         "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
       }
     },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1778672786,
-        "narHash": "sha256-Tf7q8/0aIwg4Btd/GUMNHXDTqlrWTr5o/vZ8euFUAQY=",
-        "rev": "eef00dfd8a712b34af845f9350bac681b1228bd1",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre997230.eef00dfd8a71/nixexprs.tar.xz?lastModified=1778672786&rev=eef00dfd8a712b34af845f9350bac681b1228bd1"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
-      }
-    },
     "nixvim": {
       "inputs": {
         "flake-parts": "flake-parts_2",
@@ -614,10 +601,31 @@
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_2",
         "nixvim": "nixvim",
+        "sops-nix": "sops-nix",
         "tranquil-pds": "tranquil-pds",
         "zen-browser": "zen-browser"
       }
     },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1782165805,
+        "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1689347949,
@@ -651,7 +659,9 @@
     },
     "tranquil-pds": {
       "inputs": {
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
         "lastModified": 1782711090,
diff --git a/flake.nix b/flake.nix
index 309015e..27b5097 100644
--- a/flake.nix
+++ b/flake.nix
@@ -25,7 +25,14 @@
       url = "github:nix-community/nixvim";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    tranquil-pds.url = "git+https://tangled.org/tranquil.farm/tranquil-pds";
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    tranquil-pds = {
+      url = "git+https://tangled.org/tranquil.farm/tranquil-pds";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     zen-browser = {
       url = "github:youwen5/zen-browser-flake";
       inputs.nixpkgs.follows = "nixpkgs";
diff --git a/modules/atproto/sops.nix b/modules/atproto/sops.nix
new file mode 100644
index 0000000..687428e
--- /dev/null
+++ b/modules/atproto/sops.nix
@@ -0,0 +1,28 @@
+{ inputs, ... }: {
+  flake-file.inputs.sops-nix = {
+    url = "github:Mic92/sops-nix";
+    inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  den.aspects.sops = {
+    nixos = { pkgs, ... }: {
+      environment.systemPackages = with pkgs; [
+        age
+        sops
+      ];
+    };
+
+    recipient = {
+      nixos = {
+        imports = [ inputs.sops-nix.nixosModules.sops ];
+
+        sops = {
+          defaultSopsFile = ./secrets/pds.yaml;
+          age = {
+            sshKeyPaths = [ "/etc/ssh/ssh_host/ed25519_key" ];
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/modules/tranquil.nix b/modules/atproto/tranquil.nix
similarity index 65%
rename from modules/tranquil.nix
rename to modules/atproto/tranquil.nix
index f0262f8..4094e31 100644
--- a/modules/tranquil.nix
+++ b/modules/atproto/tranquil.nix
@@ -1,10 +1,11 @@
 { inputs, ... }: {
   flake-file.inputs.tranquil-pds = {
     url = "git+https://tangled.org/tranquil.farm/tranquil-pds";
+    inputs.nixpkgs.follows = "nixpkgs";
   };
 
   den.aspects.tranquil = {
-    nixos = {
+    nixos = { config, ... }: {
       imports = [ inputs.tranquil-pds.nixosModules.default ];
 
       services.tranquil-pds = {
@@ -14,7 +15,13 @@
           server.hostname = "pds.alexvds.com";
         };
 
-        environmentFiles = [ "/etc/secrets/tranquil.env.production" ];
+        environmentFiles = [ ];
+      };
+
+      sops.secrets = {
+        jwt_secret = { };
+        dpop_secret = { };
+        master_key = { };
       };
     };
   };
diff --git a/modules/hosts/roost/roost.nix b/modules/hosts/roost/roost.nix
index d371006..994fd1e 100644
--- a/modules/hosts/roost/roost.nix
+++ b/modules/hosts/roost/roost.nix
@@ -7,6 +7,8 @@
       den.batteries.hostname
 
       grub
+      sops
+      sops.recipient
       tranquil
     ];
 
diff --git a/modules/users/igneous.nix b/modules/users/igneous.nix
index 314c9b9..78bd487 100644
--- a/modules/users/igneous.nix
+++ b/modules/users/igneous.nix
@@ -19,6 +19,7 @@
       shell
       shell.bash
       shell.zsh
+      sops
       spotify
       steam
       zen
diff --git a/secrets/pds.yaml b/secrets/pds.yaml
new file mode 100644
index 0000000..75d7fe7
--- /dev/null
+++ b/secrets/pds.yaml
@@ -0,0 +1,27 @@
+jwt_secret: ENC[AES256_GCM,data:TchgnA9lmRxmxqVSVNybPr20zyruo+qErokHzxANcgXSkD8oaE9Ldi9R6LKTTOi9gjLEX3yp0L08ZyAQ8imPXQ==,iv:+9+K0+xoy0+qND2YBQ73PaYMkRd1Htshmyih6SveM+E=,tag:fk0brk8CmyxENH4y0+aq6g==,type:str]
+dpop_secret: ENC[AES256_GCM,data:BH9XEwwAykLL56tz2UWX8J3WEvM+tkQm43PW8sdv8J/JJkxGkqVIIsXDG1nUcZErjA2hs0J0ebgG6qVVDKvsCg==,iv:GQdzzoB/FY8bK5U0yBInKPof1uAoU9PqoRP4Ixjol10=,tag:iOFiYDQtv83DWVzAkv1M1A==,type:str]
+master_key: ENC[AES256_GCM,data:bQ42PHnWX39jZHp462HldzgkYcvmOTs6SDciwJr3wxg2Z2R3rDfeE0jfv5C1IfKi4oeYTI1xzx2quqFRfw6NxQ==,iv:no8pQGbnXFjrcY9pqakBxnJwkKbyhTJ3NNcOcHJqftU=,tag:ZqFjMckQdqiNQ3js1ggkRw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpeTFEMjlkaEV5UWw3TFVC
+            MW5ZWWZUUEkrT1hmTUMxOWtzUmVHWHI1MkNjClE4QmMrSjRaSEVIL3BQK05zazJi
+            NlRmYU92Vng5b3FEeGx4U0o0S09FcjAKLS0tIE1FSEpCNElxVllwVS9EdlY1OEM0
+            bkw2YkJWRTlYK3g3akI5SlM4Q0NXWUEKirJB9sdcQJtylWQNK72Y4iWXkxEsPTZU
+            2WY+bX9NhsdM+iE3dqIrna9LYD/2lRxc9OnriF4sVVQO88aWxmKlIg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1j0jft6cd5h7g0lq8hxkuq3ysrj6wzkq0gw5yxlh5aklsqdth644qapy6tg
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzOENtUVIwaWFsZEJLQkZz
+            YXF5ZWRQQ3QwYUwrTmRZRFRTRjduS3IvTDE0CnFJYjBoemtHY3c3dGZqMUNLUWlY
+            S0xZcXkvR2dMZnUzdStDTDQzUmlDbmcKLS0tIGUvT3ZUMk40ZW9DYkI3RHZFU3BO
+            QVJWME43Rk00cXFxdHY0RUU3TkhiZjQKtZBCmk+C1Xt1zBBAOmCAk12W1Vx80Mh5
+            VG1CjmQgkOA/0CZ3bpLFH/ZvYvIDLHzrE35QlDkstdTeTndqh5nC8w==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1t94dyp6exjjex0tx5rhznfg7ua6jfgte597ke4wtl2hm2a472dqqpdf9z8
+    lastmodified: "2026-07-01T21:30:04Z"
+    mac: ENC[AES256_GCM,data:bKARPmIg0KWcP4VpuPucMmxZLO00WWQZmO0tHZU/vPYXaGCyHJ/Oz0S6egG57E6AiniylFBLM1fBPwYnE8svXTZvRbfSSM8+4YhheXWZ5ziQ5l8N79CqhPKU5G4GotQ6REL+Rv0oYNjHnDCxgjg7eE4NMmPsbLKby9a1kj+FPBo=,iv:swkPSQ2M6O33ToX7kWEXDE2fDGVyyozmw0ae6uUYYy4=,tag:3s0deQ6dHcvpqJQTE+zQlg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1
-- 
2.51.2


From 255264641c1e9574b304135a34659b8c9f39b455 Mon Sep 17 00:00:00 2001
From: Alex van de Sandt <me@alexvds.com>
Date: Wed, 1 Jul 2026 16:46:47 -0500
Subject: [PATCH 03/17] Fix ssh key path

---
 modules/atproto/sops.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/atproto/sops.nix b/modules/atproto/sops.nix
index 687428e..87709ea 100644
--- a/modules/atproto/sops.nix
+++ b/modules/atproto/sops.nix
@@ -17,9 +17,9 @@
         imports = [ inputs.sops-nix.nixosModules.sops ];
 
         sops = {
-          defaultSopsFile = ./secrets/pds.yaml;
+          defaultSopsFile = ../../secrets/pds.yaml;
           age = {
-            sshKeyPaths = [ "/etc/ssh/ssh_host/ed25519_key" ];
+            sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
           };
         };
       };
-- 
2.51.2


From 601ae0f9c4cda91b3c894420cb13825a0807a3e0 Mon Sep 17 00:00:00 2001
From: Alex van de Sandt <me@alexvds.com>
Date: Wed, 1 Jul 2026 17:03:37 -0500
Subject: [PATCH 04/17] Use dotenv and nest secrets under one file

---
 .sops.yaml                   |  5 -----
 modules/atproto/sops.nix     |  7 +------
 modules/atproto/tranquil.nix | 12 ++++++++----
 secrets/pds.env              | 11 +++++++++++
 secrets/pds.yaml             | 27 ---------------------------
 5 files changed, 20 insertions(+), 42 deletions(-)
 create mode 100644 secrets/pds.env
 delete mode 100644 secrets/pds.yaml

diff --git a/.sops.yaml b/.sops.yaml
index d8d595a..da78eb3 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -7,8 +7,3 @@ creation_rules:
     - age:
       - *pds
       - *server_roost
-  - path_regex: secrets/igneous/[^/]+\.(yaml|json|env|ini)$
-    key_groups:
-    - age:
-      - *pds
-      - *server_roost
diff --git a/modules/atproto/sops.nix b/modules/atproto/sops.nix
index 87709ea..280c56e 100644
--- a/modules/atproto/sops.nix
+++ b/modules/atproto/sops.nix
@@ -16,12 +16,7 @@
       nixos = {
         imports = [ inputs.sops-nix.nixosModules.sops ];
 
-        sops = {
-          defaultSopsFile = ../../secrets/pds.yaml;
-          age = {
-            sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-          };
-        };
+        sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
       };
     };
   };
diff --git a/modules/atproto/tranquil.nix b/modules/atproto/tranquil.nix
index 4094e31..732f8e8 100644
--- a/modules/atproto/tranquil.nix
+++ b/modules/atproto/tranquil.nix
@@ -18,10 +18,14 @@
         environmentFiles = [ ];
       };
 
-      sops.secrets = {
-        jwt_secret = { };
-        dpop_secret = { };
-        master_key = { };
+      sops = {
+        defaultSopsFile = ../../secrets/pds.yaml;
+        secrets = {
+          tranquil-pds = {
+            format = "dotenv";
+            key = "";
+          };
+        };
       };
     };
   };
diff --git a/secrets/pds.env b/secrets/pds.env
new file mode 100644
index 0000000..8c1815a
--- /dev/null
+++ b/secrets/pds.env
@@ -0,0 +1,11 @@
+jwt_secret=ENC[AES256_GCM,data:/Cqqn7PU84r9vfbxjoZ+nf3hrSpZdMHOJzFVlYjlGUB0kLLPFDtTyMobwkM7yGu1iydsz+nNCbntHQjOJ0baVw==,iv:Fsh3owArkyQvPeN+mOFpxAlR1mK7yRc8D5DrAvt0D/k=,tag:dNt0Iz/vfsFJwW3y0ILQLQ==,type:str]
+dpop_secret=ENC[AES256_GCM,data:haDxLHR53s7ZEV1RkjUS1XSr+ROm5ZslRBqha9cAoV2TWy4uTunBx3ESAF7icaNC4aGPDwkCxA1TfeMjTFgTqQ==,iv:9c9WelMmppNEJUeWkf4t8WeqajIwyQ5nenJ2ZhAQeDk=,tag:8eRFwctBge8mW35VgNPxrw==,type:str]
+master_key=ENC[AES256_GCM,data:ERGeEFzjfObcBOJZNrlEjoAlGINTHivAyCBcw12hRTVnASikIH02lWwOmH4ibGgwUFDBT2vDMTc4s3bb/7g+KA==,iv:vfSBI+3yug8WMnq+tsO/vy9VIIlKMcg8oWORys9Sgmc=,tag:I5J08hmMHGomdFb01qRBjQ==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOaHczeW5wdUVVRlM5dCtV\nTVZXWFRLak1UREYzYklVTVgxWGRYS0xYQ3dJCk1zdmRLb0xNN2xzRlVSaDREb2p2\nRFZ3YlgvSHphM3NtYXZBRGVUVS9zKzQKLS0tIFQzeG92Vkc1NWdGTTE0RVkxNXFN\nZlJFMWN2RndWaGYzaS8ybkVJd3ZOY0EKqHHPmqzrGg4MKRzYmD2NLmGt+r9FvQwg\nkUu4W7a12qHXdsujt1730OmlL6jJUp9sRnw6kPRPaE2Hj5Fzj81Cgg==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age1j0jft6cd5h7g0lq8hxkuq3ysrj6wzkq0gw5yxlh5aklsqdth644qapy6tg
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUQUxWYkVRd1NSRHJ5YVY2\nRi91RUhObmkwQ0lXcmEwdUU5OTNTdG1IOFY0Ck0vTTRSRkVKVXBIcDMyVFFRQWJY\nVXFFdzZ1RHF2clZqdXJ3R0U1YlFWZ1kKLS0tIGJvWkVjbFZsRFNTbmxwY0JqOVF5\nclB0SmNKM1ZTa0p1ck9IZEV3RkpKSE0Ksofkn3w5RCkBHhmb5ZmzX4e6CZDed98V\nM9l8YcxlemR+jj9ebcQvKEZRWcAHmV6Bsh+BV1jWin2mMoOx11wiRw==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_recipient=age1t94dyp6exjjex0tx5rhznfg7ua6jfgte597ke4wtl2hm2a472dqqpdf9z8
+sops_lastmodified=2026-07-01T22:00:59Z
+sops_mac=ENC[AES256_GCM,data:F3Fz+bB0G3LHw6+xy6+Lyo7gwmfjRxc8zgKUnqtHVHnGBGaePJCIwrnW0m7a719dVqeoaX20zJkm5mP36vFvGmuSkOapfa/vSNcMJUG6txURV5l/0Aydg872X2lyQ85371ENM4GQhQnMqDzUZlBex6R0Sfh5DGMPhH3uPdSPf7c=,iv:ljWM/oAHw3188gRl15h66BPsL5j9KNFtdep5LIWVtlw=,tag:O57Ir0qV4Q9qspDxxJYWBg==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.13.1
diff --git a/secrets/pds.yaml b/secrets/pds.yaml
deleted file mode 100644
index 75d7fe7..0000000
--- a/secrets/pds.yaml
+++ /dev/null
@@ -1,27 +0,0 @@
-jwt_secret: ENC[AES256_GCM,data:TchgnA9lmRxmxqVSVNybPr20zyruo+qErokHzxANcgXSkD8oaE9Ldi9R6LKTTOi9gjLEX3yp0L08ZyAQ8imPXQ==,iv:+9+K0+xoy0+qND2YBQ73PaYMkRd1Htshmyih6SveM+E=,tag:fk0brk8CmyxENH4y0+aq6g==,type:str]
-dpop_secret: ENC[AES256_GCM,data:BH9XEwwAykLL56tz2UWX8J3WEvM+tkQm43PW8sdv8J/JJkxGkqVIIsXDG1nUcZErjA2hs0J0ebgG6qVVDKvsCg==,iv:GQdzzoB/FY8bK5U0yBInKPof1uAoU9PqoRP4Ixjol10=,tag:iOFiYDQtv83DWVzAkv1M1A==,type:str]
-master_key: ENC[AES256_GCM,data:bQ42PHnWX39jZHp462HldzgkYcvmOTs6SDciwJr3wxg2Z2R3rDfeE0jfv5C1IfKi4oeYTI1xzx2quqFRfw6NxQ==,iv:no8pQGbnXFjrcY9pqakBxnJwkKbyhTJ3NNcOcHJqftU=,tag:ZqFjMckQdqiNQ3js1ggkRw==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpeTFEMjlkaEV5UWw3TFVC
-            MW5ZWWZUUEkrT1hmTUMxOWtzUmVHWHI1MkNjClE4QmMrSjRaSEVIL3BQK05zazJi
-            NlRmYU92Vng5b3FEeGx4U0o0S09FcjAKLS0tIE1FSEpCNElxVllwVS9EdlY1OEM0
-            bkw2YkJWRTlYK3g3akI5SlM4Q0NXWUEKirJB9sdcQJtylWQNK72Y4iWXkxEsPTZU
-            2WY+bX9NhsdM+iE3dqIrna9LYD/2lRxc9OnriF4sVVQO88aWxmKlIg==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1j0jft6cd5h7g0lq8hxkuq3ysrj6wzkq0gw5yxlh5aklsqdth644qapy6tg
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzOENtUVIwaWFsZEJLQkZz
-            YXF5ZWRQQ3QwYUwrTmRZRFRTRjduS3IvTDE0CnFJYjBoemtHY3c3dGZqMUNLUWlY
-            S0xZcXkvR2dMZnUzdStDTDQzUmlDbmcKLS0tIGUvT3ZUMk40ZW9DYkI3RHZFU3BO
-            QVJWME43Rk00cXFxdHY0RUU3TkhiZjQKtZBCmk+C1Xt1zBBAOmCAk12W1Vx80Mh5
-            VG1CjmQgkOA/0CZ3bpLFH/ZvYvIDLHzrE35QlDkstdTeTndqh5nC8w==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1t94dyp6exjjex0tx5rhznfg7ua6jfgte597ke4wtl2hm2a472dqqpdf9z8
-    lastmodified: "2026-07-01T21:30:04Z"
-    mac: ENC[AES256_GCM,data:bKARPmIg0KWcP4VpuPucMmxZLO00WWQZmO0tHZU/vPYXaGCyHJ/Oz0S6egG57E6AiniylFBLM1fBPwYnE8svXTZvRbfSSM8+4YhheXWZ5ziQ5l8N79CqhPKU5G4GotQ6REL+Rv0oYNjHnDCxgjg7eE4NMmPsbLKby9a1kj+FPBo=,iv:swkPSQ2M6O33ToX7kWEXDE2fDGVyyozmw0ae6uUYYy4=,tag:3s0deQ6dHcvpqJQTE+zQlg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.1
-- 
2.51.2


From 181a041593f24c2a8162ccc851073c708759cc4c Mon Sep 17 00:00:00 2001
From: Alex van de Sandt <me@alexvds.com>
Date: Wed, 1 Jul 2026 18:03:42 -0500
Subject: [PATCH 05/17] Harden sshd

---
 modules/hosts/roost/roost.nix |  2 +-
 modules/sshd.nix              | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 modules/sshd.nix

diff --git a/modules/hosts/roost/roost.nix b/modules/hosts/roost/roost.nix
index 994fd1e..c7fbd0b 100644
--- a/modules/hosts/roost/roost.nix
+++ b/modules/hosts/roost/roost.nix
@@ -10,6 +10,7 @@
       sops
       sops.recipient
       tranquil
+      sshd
     ];
 
     nixos = {
@@ -25,7 +26,6 @@
       boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
 
       # todo: openssh aspect
-      services.openssh.enable = true;
       users.users.root.openssh.authorizedKeys.keys = [
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINjHG2fiK7Ip1YlPdH/eyT1qIrtOJlHUeMZ13GZvWyGI"
       ];
diff --git a/modules/sshd.nix b/modules/sshd.nix
new file mode 100644
index 0000000..8a3dad2
--- /dev/null
+++ b/modules/sshd.nix
@@ -0,0 +1,18 @@
+{
+  den.aspects.sshd = {
+    nixos = {
+      services.openssh = {
+        enable = true;
+        openFirewall = true;
+        settings = {
+          PasswordAuthentication = false;
+          KbdInteractiveAuthentication = false;
+          PermitRootLogin = "no";
+          AllowUsers = [ "catbird" ];
+          MaxAuthTries = 3;
+          PerSourcePenalties = "crash:3600s authfail:3600s max:86400s";
+        };
+      };
+    };
+  };
+}
-- 
2.51.2


From c9155a6c7b5de8ab944059f857cc805b803bb4c8 Mon Sep 17 00:00:00 2001
From: Alex van de Sandt <me@alexvds.com>
Date: Wed, 1 Jul 2026 18:04:29 -0500
Subject: [PATCH 06/17] Ensure secrets are wired correctly

---
 flake.lock                    | 17 ++++++++++++++---
 flake.nix                     |  5 +----
 modules/atproto/tranquil.nix  | 12 +++++++-----
 modules/hosts/roost/roost.nix |  1 -
 modules/users/catbird.nix     |  2 ++
 5 files changed, 24 insertions(+), 13 deletions(-)

diff --git a/flake.lock b/flake.lock
index 915f384..12ae7bf 100644
--- a/flake.lock
+++ b/flake.lock
@@ -545,6 +545,19 @@
         "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
       }
     },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1782821651,
+        "narHash": "sha256-OBddwHNJ+qxOHaKih0bE2PXJeZHlzUC8WOHZrUcnFwY=",
+        "rev": "e52c192be9d7b2c4bd4aed326c8731b35f8bb75c",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1025128.e52c192be9d7/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
+      }
+    },
     "nixvim": {
       "inputs": {
         "flake-parts": "flake-parts_2",
@@ -659,9 +672,7 @@
     },
     "tranquil-pds": {
       "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
+        "nixpkgs": "nixpkgs_3"
       },
       "locked": {
         "lastModified": 1782711090,
diff --git a/flake.nix b/flake.nix
index 27b5097..2645f92 100644
--- a/flake.nix
+++ b/flake.nix
@@ -29,10 +29,7 @@
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    tranquil-pds = {
-      url = "git+https://tangled.org/tranquil.farm/tranquil-pds";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    tranquil-pds.url = "git+https://tangled.org/tranquil.farm/tranquil-pds";
     zen-browser = {
       url = "github:youwen5/zen-browser-flake";
       inputs.nixpkgs.follows = "nixpkgs";
diff --git a/modules/atproto/tranquil.nix b/modules/atproto/tranquil.nix
index 732f8e8..7e93fbd 100644
--- a/modules/atproto/tranquil.nix
+++ b/modules/atproto/tranquil.nix
@@ -1,29 +1,31 @@
 { inputs, ... }: {
   flake-file.inputs.tranquil-pds = {
     url = "git+https://tangled.org/tranquil.farm/tranquil-pds";
-    inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  den.aspects.tranquil = {
+  den.aspects.tranquil = { user, ... }: {
     nixos = { config, ... }: {
       imports = [ inputs.tranquil-pds.nixosModules.default ];
 
       services.tranquil-pds = {
-        enable = false;
+        enable = true;
         database.createLocally = true;
         settings = {
           server.hostname = "pds.alexvds.com";
         };
 
-        environmentFiles = [ ];
+        environmentFiles = [ config.sops.secrets.tranquil-pds.path ];
       };
 
       sops = {
-        defaultSopsFile = ../../secrets/pds.yaml;
+        defaultSopsFile = ../../secrets/pds.env;
         secrets = {
           tranquil-pds = {
             format = "dotenv";
             key = "";
+
+            owner = user.name;
+            group = "wheel";
           };
         };
       };
diff --git a/modules/hosts/roost/roost.nix b/modules/hosts/roost/roost.nix
index c7fbd0b..0ab3aa6 100644
--- a/modules/hosts/roost/roost.nix
+++ b/modules/hosts/roost/roost.nix
@@ -9,7 +9,6 @@
       grub
       sops
       sops.recipient
-      tranquil
       sshd
     ];
 
diff --git a/modules/users/catbird.nix b/modules/users/catbird.nix
index 57c5c60..fe94e7d 100644
--- a/modules/users/catbird.nix
+++ b/modules/users/catbird.nix
@@ -10,6 +10,8 @@
       shell
       shell.bash
       shell.zsh
+
+      tranquil
     ];
 
     homeManager =
-- 
2.51.2


From 37318f3aea3f41486e95956c5def4e8e8176363b Mon Sep 17 00:00:00 2001
From: Alex van de Sandt <me@alexvds.com>
Date: Wed, 1 Jul 2026 18:04:56 -0500
Subject: [PATCH 07/17] Capitalize secret names

---
 secrets/pds.env | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/secrets/pds.env b/secrets/pds.env
index 8c1815a..98a8d98 100644
--- a/secrets/pds.env
+++ b/secrets/pds.env
@@ -1,11 +1,11 @@
-jwt_secret=ENC[AES256_GCM,data:/Cqqn7PU84r9vfbxjoZ+nf3hrSpZdMHOJzFVlYjlGUB0kLLPFDtTyMobwkM7yGu1iydsz+nNCbntHQjOJ0baVw==,iv:Fsh3owArkyQvPeN+mOFpxAlR1mK7yRc8D5DrAvt0D/k=,tag:dNt0Iz/vfsFJwW3y0ILQLQ==,type:str]
-dpop_secret=ENC[AES256_GCM,data:haDxLHR53s7ZEV1RkjUS1XSr+ROm5ZslRBqha9cAoV2TWy4uTunBx3ESAF7icaNC4aGPDwkCxA1TfeMjTFgTqQ==,iv:9c9WelMmppNEJUeWkf4t8WeqajIwyQ5nenJ2ZhAQeDk=,tag:8eRFwctBge8mW35VgNPxrw==,type:str]
-master_key=ENC[AES256_GCM,data:ERGeEFzjfObcBOJZNrlEjoAlGINTHivAyCBcw12hRTVnASikIH02lWwOmH4ibGgwUFDBT2vDMTc4s3bb/7g+KA==,iv:vfSBI+3yug8WMnq+tsO/vy9VIIlKMcg8oWORys9Sgmc=,tag:I5J08hmMHGomdFb01qRBjQ==,type:str]
+JWT_SECRET=ENC[AES256_GCM,data:gXh+LEbzaYxWg+Au9kNY/ouyJHQlQkvR2rDNuhz+Z53DYZu7EikMzdV+olXKPCpAl8fIcej4zEFs67bAash24w==,iv:0EpwfrRKGjYUDJpwcwoa5ELgAErUT8U1bJBycTMeA9w=,tag:ytdpLJEE9wq86SG8rU0LwQ==,type:str]
+DPOP_SECRET=ENC[AES256_GCM,data:wQrUNdEYr/UvV48vcXclKTrPSXP7P5Q/+U2Ezyo90568C1h8fJqFCq9ps4/TNkVP/3g9alS6dvmyUYWt/WkQtg==,iv:itIJPsilwejoLUHT5eCUok3Hn4IILyBnysOw1YpgATk=,tag:IMGCArMKX9oxsXxqgy5Rpw==,type:str]
+MASTER_KEY=ENC[AES256_GCM,data:Ye7Sh70TpA/MLs3b02UG6APhbGk/dzk6p4NNy0+L7xrWKGYFnLLxldBcazwBrkapjNHNCOZfAEyXhRDFhlb9gQ==,iv:GktPwk+z0QDk3T0cUwHpa5mU/Y6I4Id1pCE40iTywVU=,tag:tSnmaGEz6abl5Chfp6BBOA==,type:str]
 sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOaHczeW5wdUVVRlM5dCtV\nTVZXWFRLak1UREYzYklVTVgxWGRYS0xYQ3dJCk1zdmRLb0xNN2xzRlVSaDREb2p2\nRFZ3YlgvSHphM3NtYXZBRGVUVS9zKzQKLS0tIFQzeG92Vkc1NWdGTTE0RVkxNXFN\nZlJFMWN2RndWaGYzaS8ybkVJd3ZOY0EKqHHPmqzrGg4MKRzYmD2NLmGt+r9FvQwg\nkUu4W7a12qHXdsujt1730OmlL6jJUp9sRnw6kPRPaE2Hj5Fzj81Cgg==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_0__map_recipient=age1j0jft6cd5h7g0lq8hxkuq3ysrj6wzkq0gw5yxlh5aklsqdth644qapy6tg
 sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUQUxWYkVRd1NSRHJ5YVY2\nRi91RUhObmkwQ0lXcmEwdUU5OTNTdG1IOFY0Ck0vTTRSRkVKVXBIcDMyVFFRQWJY\nVXFFdzZ1RHF2clZqdXJ3R0U1YlFWZ1kKLS0tIGJvWkVjbFZsRFNTbmxwY0JqOVF5\nclB0SmNKM1ZTa0p1ck9IZEV3RkpKSE0Ksofkn3w5RCkBHhmb5ZmzX4e6CZDed98V\nM9l8YcxlemR+jj9ebcQvKEZRWcAHmV6Bsh+BV1jWin2mMoOx11wiRw==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_1__map_recipient=age1t94dyp6exjjex0tx5rhznfg7ua6jfgte597ke4wtl2hm2a472dqqpdf9z8
-sops_lastmodified=2026-07-01T22:00:59Z
-sops_mac=ENC[AES256_GCM,data:F3Fz+bB0G3LHw6+xy6+Lyo7gwmfjRxc8zgKUnqtHVHnGBGaePJCIwrnW0m7a719dVqeoaX20zJkm5mP36vFvGmuSkOapfa/vSNcMJUG6txURV5l/0Aydg872X2lyQ85371ENM4GQhQnMqDzUZlBex6R0Sfh5DGMPhH3uPdSPf7c=,iv:ljWM/oAHw3188gRl15h66BPsL5j9KNFtdep5LIWVtlw=,tag:O57Ir0qV4Q9qspDxxJYWBg==,type:str]
+sops_lastmodified=2026-07-01T23:04:49Z
+sops_mac=ENC[AES256_GCM,data:MvCqlf1RTRc3cJ1SfZ7Fu66JCASWuxzKxTIpzt7ag4sdsfX7UlNDZ8v/SGJOcIp2qqlyCbcASI/k9MUUJtTyj0EEx0AdxikmC4C2qNzqSluaDW+GbhdrTM5Iv6py16lM/HTwFlvS+qGftQTub0IaDIwLek3kz3NnHWQlGGrXchY=,iv:KBI8IWoBYscN0uLDK5aF3xFtlcrux3MqBUAfEioR3BE=,tag:9h6+ADQnm3US1wgX4EyX+w==,type:str]
 sops_unencrypted_suffix=_unencrypted
 sops_version=3.13.1
-- 
2.51.2


From b0b14fab13f9fb8e56ca1c5d8bc21a7206e9eb15 Mon Sep 17 00:00:00 2001
From: Alex van de Sandt <me@alexvds.com>
Date: Wed, 1 Jul 2026 18:29:18 -0500
Subject: [PATCH 08/17] Harden sshd further

---
 modules/1password.nix | 1 +
 modules/sshd.nix      | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/modules/1password.nix b/modules/1password.nix
index 4491930..4aaca8f 100644
--- a/modules/1password.nix
+++ b/modules/1password.nix
@@ -49,6 +49,7 @@
           };
           "15.204.234.43" = {
             forwardAgent = true;
+            port = 6767;
           };
         };
       };
diff --git a/modules/sshd.nix b/modules/sshd.nix
index 8a3dad2..1198eb8 100644
--- a/modules/sshd.nix
+++ b/modules/sshd.nix
@@ -4,13 +4,20 @@
       services.openssh = {
         enable = true;
         openFirewall = true;
+        ports = [ 6767 ];
         settings = {
           PasswordAuthentication = false;
           KbdInteractiveAuthentication = false;
           PermitRootLogin = "no";
           AllowUsers = [ "catbird" ];
+          LoginGraceTime = 30;
           MaxAuthTries = 3;
+          AllowTcpForwarding = "no";
+          ClientAliveInterval = 300;
+          ClientAliveCountMax = 2;
           PerSourcePenalties = "crash:3600s authfail:3600s max:86400s";
+          PermitEmptyPasswords = "no";
+          X11Forwarding = false;
         };
       };
     };
-- 
2.51.2


From 7fd608b0402ab82fd718bd8297316b09a0031077 Mon Sep 17 00:00:00 2001
From: Alex van de Sandt <me@alexvds.com>
Date: Wed, 1 Jul 2026 19:00:12 -0500
Subject: [PATCH 09/17] Add a few more tranquil settings

---
 modules/atproto/tranquil.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/modules/atproto/tranquil.nix b/modules/atproto/tranquil.nix
index 7e93fbd..ed0c65f 100644
--- a/modules/atproto/tranquil.nix
+++ b/modules/atproto/tranquil.nix
@@ -11,7 +11,12 @@
         enable = true;
         database.createLocally = true;
         settings = {
-          server.hostname = "pds.alexvds.com";
+          server = {
+            hostname = "pds.alexvds.com";
+            age_assurance_override = true;
+            contact_email = "me@alexvds.com";
+            max_blob_size = 1024 * 1014 * 1; # 1 GiB
+          };
         };
 
         environmentFiles = [ config.sops.secrets.tranquil-pds.path ];
-- 
2.51.2


From d521d74b169e8593c33d2a5066f08c0e1c0a7930 Mon Sep 17 00:00:00 2001
From: Alex van de Sandt <me@alexvds.com>
Date: Wed, 1 Jul 2026 18:39:17 -0500
Subject: [PATCH 10/17] Add script for secrets editing

---
 justfile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/justfile b/justfile
index ac65952..252886a 100644
--- a/justfile
+++ b/justfile
@@ -17,3 +17,6 @@ flake:
 
 update: flake
     nix flake update
+
+pds-secrets:
+    sops secrets/pds.env
-- 
2.51.2


From 8f665c599106fee1d7571dc26f91c854ccac65f1 Mon Sep 17 00:00:00 2001
From: Alex van de Sandt <me@alexvds.com>
Date: Wed, 1 Jul 2026 19:05:45 -0500
Subject: [PATCH 11/17] Add discord bot token

---
 secrets/pds.env | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/secrets/pds.env b/secrets/pds.env
index 98a8d98..57a7b77 100644
--- a/secrets/pds.env
+++ b/secrets/pds.env
@@ -1,11 +1,12 @@
 JWT_SECRET=ENC[AES256_GCM,data:gXh+LEbzaYxWg+Au9kNY/ouyJHQlQkvR2rDNuhz+Z53DYZu7EikMzdV+olXKPCpAl8fIcej4zEFs67bAash24w==,iv:0EpwfrRKGjYUDJpwcwoa5ELgAErUT8U1bJBycTMeA9w=,tag:ytdpLJEE9wq86SG8rU0LwQ==,type:str]
 DPOP_SECRET=ENC[AES256_GCM,data:wQrUNdEYr/UvV48vcXclKTrPSXP7P5Q/+U2Ezyo90568C1h8fJqFCq9ps4/TNkVP/3g9alS6dvmyUYWt/WkQtg==,iv:itIJPsilwejoLUHT5eCUok3Hn4IILyBnysOw1YpgATk=,tag:IMGCArMKX9oxsXxqgy5Rpw==,type:str]
 MASTER_KEY=ENC[AES256_GCM,data:Ye7Sh70TpA/MLs3b02UG6APhbGk/dzk6p4NNy0+L7xrWKGYFnLLxldBcazwBrkapjNHNCOZfAEyXhRDFhlb9gQ==,iv:GktPwk+z0QDk3T0cUwHpa5mU/Y6I4Id1pCE40iTywVU=,tag:tSnmaGEz6abl5Chfp6BBOA==,type:str]
+DISCORD_BOT_TOKEN=ENC[AES256_GCM,data:u1lP40yQsUK8K8KHA0NiUGxz3t6DBIOARAAzLOoalTO6//fgjeUxoLiDpjQR8BZfQG2hfP+qMi98/1YHfbVk31jzujswkk0c,iv:MHdpFAK/LJNYTnee21dZofBMgue/Qhub6TRjzJO3CLw=,tag:2x2Qi+gWBoZ4Aep/9sZyFw==,type:str]
 sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOaHczeW5wdUVVRlM5dCtV\nTVZXWFRLak1UREYzYklVTVgxWGRYS0xYQ3dJCk1zdmRLb0xNN2xzRlVSaDREb2p2\nRFZ3YlgvSHphM3NtYXZBRGVUVS9zKzQKLS0tIFQzeG92Vkc1NWdGTTE0RVkxNXFN\nZlJFMWN2RndWaGYzaS8ybkVJd3ZOY0EKqHHPmqzrGg4MKRzYmD2NLmGt+r9FvQwg\nkUu4W7a12qHXdsujt1730OmlL6jJUp9sRnw6kPRPaE2Hj5Fzj81Cgg==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_0__map_recipient=age1j0jft6cd5h7g0lq8hxkuq3ysrj6wzkq0gw5yxlh5aklsqdth644qapy6tg
 sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUQUxWYkVRd1NSRHJ5YVY2\nRi91RUhObmkwQ0lXcmEwdUU5OTNTdG1IOFY0Ck0vTTRSRkVKVXBIcDMyVFFRQWJY\nVXFFdzZ1RHF2clZqdXJ3R0U1YlFWZ1kKLS0tIGJvWkVjbFZsRFNTbmxwY0JqOVF5\nclB0SmNKM1ZTa0p1ck9IZEV3RkpKSE0Ksofkn3w5RCkBHhmb5ZmzX4e6CZDed98V\nM9l8YcxlemR+jj9ebcQvKEZRWcAHmV6Bsh+BV1jWin2mMoOx11wiRw==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_1__map_recipient=age1t94dyp6exjjex0tx5rhznfg7ua6jfgte597ke4wtl2hm2a472dqqpdf9z8
-sops_lastmodified=2026-07-01T23:04:49Z
-sops_mac=ENC[AES256_GCM,data:MvCqlf1RTRc3cJ1SfZ7Fu66JCASWuxzKxTIpzt7ag4sdsfX7UlNDZ8v/SGJOcIp2qqlyCbcASI/k9MUUJtTyj0EEx0AdxikmC4C2qNzqSluaDW+GbhdrTM5Iv6py16lM/HTwFlvS+qGftQTub0IaDIwLek3kz3NnHWQlGGrXchY=,iv:KBI8IWoBYscN0uLDK5aF3xFtlcrux3MqBUAfEioR3BE=,tag:9h6+ADQnm3US1wgX4EyX+w==,type:str]
+sops_lastmodified=2026-07-02T00:05:17Z
+sops_mac=ENC[AES256_GCM,data:yv+1cBuPEdGFjBLWbiCo0pSID3ABODtUtdbqKaOnF1xFj5HAtTem/4Y0J0h2EUZzQ82jcDbHwJnnGxhepbPQRR75zZaiKGSl+sZHobpkCAdKOeekhZtgxNLaTyriRzAS4yny4iXcTXjcjUvis2/rNrDbiLrh+v1imtUo/IyDDfc=,iv:LWyV3ORR2vyfsnEEeoEwaSBi6kZhmLuu83lxYPoRrlU=,tag:zxksCiPcKJz+GOpFy/Dg2Q==,type:str]
 sops_unencrypted_suffix=_unencrypted
 sops_version=3.13.1
-- 
2.51.2


From dfdfcb073b738b038043a4eaf05195cd3a46ca02 Mon Sep 17 00:00:00 2001
From: Alex van de Sandt <me@alexvds.com>
Date: Wed, 1 Jul 2026 19:52:00 -0500
Subject: [PATCH 12/17] Enable reverse proxy and expose PDS

---
 modules/atproto/tranquil.nix | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/modules/atproto/tranquil.nix b/modules/atproto/tranquil.nix
index ed0c65f..c318bce 100644
--- a/modules/atproto/tranquil.nix
+++ b/modules/atproto/tranquil.nix
@@ -14,7 +14,7 @@
           server = {
             hostname = "pds.alexvds.com";
             age_assurance_override = true;
-            contact_email = "me@alexvds.com";
+            contact_email = "pds@alexvds.com";
             max_blob_size = 1024 * 1014 * 1; # 1 GiB
           };
         };
@@ -22,6 +22,28 @@
         environmentFiles = [ config.sops.secrets.tranquil-pds.path ];
       };
 
+      networking.firewall = {
+        enable = true;
+        allowedTCPPorts = [
+          80
+          443
+        ];
+      };
+
+      services.caddy = {
+        enable = true;
+
+        virtualHosts = {
+          "pds.alexvds.com" = {
+            # by default, tranquil runs on port 3000.
+            # You can change this with the tranquil-pds.settings.server.port option in the service config.
+            extraConfig = ''
+              reverse_proxy localhost:3000
+            '';
+          };
+        };
+      };
+
       sops = {
         defaultSopsFile = ../../secrets/pds.env;
         secrets = {
-- 
2.51.2


From 005ab09f55579a8ab6288a459938ee56737bef26 Mon Sep 17 00:00:00 2001
From: Alex van de Sandt <me@alexvds.com>
Date: Wed, 1 Jul 2026 20:21:33 -0500
Subject: [PATCH 13/17] Use variables in tranquil config

---
 modules/atproto/tranquil.nix | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/modules/atproto/tranquil.nix b/modules/atproto/tranquil.nix
index c318bce..797613a 100644
--- a/modules/atproto/tranquil.nix
+++ b/modules/atproto/tranquil.nix
@@ -1,4 +1,9 @@
-{ inputs, ... }: {
+{ inputs, ... }:
+let
+  hostname = "pds.alexvds.com";
+  email = "pds@alexvds.com";
+in
+{
   flake-file.inputs.tranquil-pds = {
     url = "git+https://tangled.org/tranquil.farm/tranquil-pds";
   };
@@ -9,12 +14,14 @@
 
       services.tranquil-pds = {
         enable = true;
+
         database.createLocally = true;
+
         settings = {
           server = {
-            hostname = "pds.alexvds.com";
+            inherit hostname;
             age_assurance_override = true;
-            contact_email = "pds@alexvds.com";
+            contact_email = email;
             max_blob_size = 1024 * 1014 * 1; # 1 GiB
           };
         };
@@ -34,7 +41,7 @@
         enable = true;
 
         virtualHosts = {
-          "pds.alexvds.com" = {
+          ${hostname} = {
             # by default, tranquil runs on port 3000.
             # You can change this with the tranquil-pds.settings.server.port option in the service config.
             extraConfig = ''
-- 
2.51.2


From 55b977e426100aa72d6c6e521d3fbfefefc5a939 Mon Sep 17 00:00:00 2001
From: Alex van de Sandt <me@alexvds.com>
Date: Wed, 1 Jul 2026 20:44:47 -0500
Subject: [PATCH 14/17] Add initial email config

---
 modules/atproto/tranquil.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/modules/atproto/tranquil.nix b/modules/atproto/tranquil.nix
index 797613a..26efeb4 100644
--- a/modules/atproto/tranquil.nix
+++ b/modules/atproto/tranquil.nix
@@ -24,6 +24,17 @@ in
             contact_email = email;
             max_blob_size = 1024 * 1014 * 1; # 1 GiB
           };
+
+          email = {
+            # from_address = email;
+
+            smarthost = {
+              host = "smtp.fastmail.com";
+              port = "587";
+              username = "igneous_flock@fastmail.com";
+              # password in env
+            };
+          };
         };
 
         environmentFiles = [ config.sops.secrets.tranquil-pds.path ];
-- 
2.51.2


From d24cd40d57170a1525d2bfaaf8b7714834b45bb6 Mon Sep 17 00:00:00 2001
From: Alex van de Sandt <me@alexvds.com>
Date: Wed, 1 Jul 2026 20:45:38 -0500
Subject: [PATCH 15/17] Add email relay username and password to secrets

---
 modules/atproto/tranquil.nix | 2 --
 secrets/pds.env              | 6 ++++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/modules/atproto/tranquil.nix b/modules/atproto/tranquil.nix
index 26efeb4..cd994f4 100644
--- a/modules/atproto/tranquil.nix
+++ b/modules/atproto/tranquil.nix
@@ -31,8 +31,6 @@ in
             smarthost = {
               host = "smtp.fastmail.com";
               port = "587";
-              username = "igneous_flock@fastmail.com";
-              # password in env
             };
           };
         };
diff --git a/secrets/pds.env b/secrets/pds.env
index 57a7b77..c7d4362 100644
--- a/secrets/pds.env
+++ b/secrets/pds.env
@@ -2,11 +2,13 @@ JWT_SECRET=ENC[AES256_GCM,data:gXh+LEbzaYxWg+Au9kNY/ouyJHQlQkvR2rDNuhz+Z53DYZu7E
 DPOP_SECRET=ENC[AES256_GCM,data:wQrUNdEYr/UvV48vcXclKTrPSXP7P5Q/+U2Ezyo90568C1h8fJqFCq9ps4/TNkVP/3g9alS6dvmyUYWt/WkQtg==,iv:itIJPsilwejoLUHT5eCUok3Hn4IILyBnysOw1YpgATk=,tag:IMGCArMKX9oxsXxqgy5Rpw==,type:str]
 MASTER_KEY=ENC[AES256_GCM,data:Ye7Sh70TpA/MLs3b02UG6APhbGk/dzk6p4NNy0+L7xrWKGYFnLLxldBcazwBrkapjNHNCOZfAEyXhRDFhlb9gQ==,iv:GktPwk+z0QDk3T0cUwHpa5mU/Y6I4Id1pCE40iTywVU=,tag:tSnmaGEz6abl5Chfp6BBOA==,type:str]
 DISCORD_BOT_TOKEN=ENC[AES256_GCM,data:u1lP40yQsUK8K8KHA0NiUGxz3t6DBIOARAAzLOoalTO6//fgjeUxoLiDpjQR8BZfQG2hfP+qMi98/1YHfbVk31jzujswkk0c,iv:MHdpFAK/LJNYTnee21dZofBMgue/Qhub6TRjzJO3CLw=,tag:2x2Qi+gWBoZ4Aep/9sZyFw==,type:str]
+MAIL_SMARTHOST_USERNAME=ENC[AES256_GCM,data:7wVgmUrqi7PkHb/Vj12IdAaGEbYAI4yiNdY=,iv:ojk/SfnY5e25uxkgNHHt2LblhuMwYCl5nBMHu8TLgJU=,tag:cRQAVcAR7uwIC2pQv0d9XQ==,type:str]
+MAIL_SMARTHOST_PASSWORD=ENC[AES256_GCM,data:tlP/qH2i35Uhkibbul9fKg==,iv:Pte4puV9M5IjcoDPM0fOxfspq9XzeH6z+ebQ1P5P5Qk=,tag:uWP6gg8t+gByrfqCmew89A==,type:str]
 sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOaHczeW5wdUVVRlM5dCtV\nTVZXWFRLak1UREYzYklVTVgxWGRYS0xYQ3dJCk1zdmRLb0xNN2xzRlVSaDREb2p2\nRFZ3YlgvSHphM3NtYXZBRGVUVS9zKzQKLS0tIFQzeG92Vkc1NWdGTTE0RVkxNXFN\nZlJFMWN2RndWaGYzaS8ybkVJd3ZOY0EKqHHPmqzrGg4MKRzYmD2NLmGt+r9FvQwg\nkUu4W7a12qHXdsujt1730OmlL6jJUp9sRnw6kPRPaE2Hj5Fzj81Cgg==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_0__map_recipient=age1j0jft6cd5h7g0lq8hxkuq3ysrj6wzkq0gw5yxlh5aklsqdth644qapy6tg
 sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUQUxWYkVRd1NSRHJ5YVY2\nRi91RUhObmkwQ0lXcmEwdUU5OTNTdG1IOFY0Ck0vTTRSRkVKVXBIcDMyVFFRQWJY\nVXFFdzZ1RHF2clZqdXJ3R0U1YlFWZ1kKLS0tIGJvWkVjbFZsRFNTbmxwY0JqOVF5\nclB0SmNKM1ZTa0p1ck9IZEV3RkpKSE0Ksofkn3w5RCkBHhmb5ZmzX4e6CZDed98V\nM9l8YcxlemR+jj9ebcQvKEZRWcAHmV6Bsh+BV1jWin2mMoOx11wiRw==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_1__map_recipient=age1t94dyp6exjjex0tx5rhznfg7ua6jfgte597ke4wtl2hm2a472dqqpdf9z8
-sops_lastmodified=2026-07-02T00:05:17Z
-sops_mac=ENC[AES256_GCM,data:yv+1cBuPEdGFjBLWbiCo0pSID3ABODtUtdbqKaOnF1xFj5HAtTem/4Y0J0h2EUZzQ82jcDbHwJnnGxhepbPQRR75zZaiKGSl+sZHobpkCAdKOeekhZtgxNLaTyriRzAS4yny4iXcTXjcjUvis2/rNrDbiLrh+v1imtUo/IyDDfc=,iv:LWyV3ORR2vyfsnEEeoEwaSBi6kZhmLuu83lxYPoRrlU=,tag:zxksCiPcKJz+GOpFy/Dg2Q==,type:str]
+sops_lastmodified=2026-07-02T01:49:13Z
+sops_mac=ENC[AES256_GCM,data:cgVI40zRXnaJj9owNnaioJqWd9mX6bY+BH3nsrc2oSCiEzooeG6iduqVIHiBC2fmPY7ykAh+oqeEvhbqHV98fOs2pze4Qe45nyegsPp4IrxmTRIRlz577I3dgMT9MYpA781uO5Wuc56Mg90omtEZthyC4RFcA946PBQ2mk/PZ0g=,iv:+aVZkFFlthJq+ZjGlaEeRqaIkcdyr2sJiIBmHWuDTHg=,tag:y2gu8l5OECSZ+Ml1HdCKLg==,type:str]
 sops_unencrypted_suffix=_unencrypted
 sops_version=3.13.1
-- 
2.51.2


From d1d952d37a1852147f0b5ae65089ef009f19413f Mon Sep 17 00:00:00 2001
From: Alex van de Sandt <me@alexvds.com>
Date: Wed, 1 Jul 2026 20:46:05 -0500
Subject: [PATCH 16/17] Enable email in PDS

---
 modules/atproto/tranquil.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/atproto/tranquil.nix b/modules/atproto/tranquil.nix
index cd994f4..712d2c6 100644
--- a/modules/atproto/tranquil.nix
+++ b/modules/atproto/tranquil.nix
@@ -26,11 +26,11 @@ in
           };
 
           email = {
-            # from_address = email;
+            from_address = email;
 
             smarthost = {
               host = "smtp.fastmail.com";
-              port = "587";
+              port = 587;
             };
           };
         };
-- 
2.51.2


From 175535ad2ede5a6941c507dbb10bcac3ab90dbe5 Mon Sep 17 00:00:00 2001
From: Alex van de Sandt <me@alexvds.com>
Date: Wed, 1 Jul 2026 21:07:11 -0500
Subject: [PATCH 17/17] Enable passwordless sudo

---
 modules/hosts/roost/roost.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/modules/hosts/roost/roost.nix b/modules/hosts/roost/roost.nix
index 0ab3aa6..a3cbaad 100644
--- a/modules/hosts/roost/roost.nix
+++ b/modules/hosts/roost/roost.nix
@@ -28,6 +28,21 @@
       users.users.root.openssh.authorizedKeys.keys = [
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINjHG2fiK7Ip1YlPdH/eyT1qIrtOJlHUeMZ13GZvWyGI"
       ];
+
+      security.sudo = {
+        enable = true;
+        extraRules = [
+          {
+            commands = [
+              {
+                command = "ALL";
+                options = [ "NOPASSWD" ];
+              }
+            ];
+            groups = [ "wheel" ];
+          }
+        ];
+      };
     };
 
     provides.to-users.homeManager =