diff --git a/flake.nix b/flake.nix
index 4489215..edfd1fb 100644
--- a/flake.nix
+++ b/flake.nix
@@ -81,6 +81,11 @@
               modules = [ ./hosts/vm/peertube ] ++ baseModules;
             };
 
+            peertube-runner-1 = nixosSystem {
+              specialArgs = inputs;
+              modules = [ ./hosts/vm/peertube-runner-1 ] ++ baseModules;
+            };
+
             periodique = nixosSystem {
               specialArgs = inputs;
               modules = [ ./hosts/vm/periodique ] ++ baseModules;
diff --git a/hosts/vm/peertube-runner-1/default.nix b/hosts/vm/peertube-runner-1/default.nix
new file mode 100644
index 0000000..f6d0cce
--- /dev/null
+++ b/hosts/vm/peertube-runner-1/default.nix
@@ -0,0 +1,24 @@
+{ ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./peertube-runner.nix
+  ];
+
+  networking.hostName = "peertube-runner-1";
+  boot.loader.grub.devices = [ "/dev/sda" ];
+
+  crans = {
+    enable = true;
+
+    networking = {
+      id = "152";
+      srvNat.enable = true;
+    };
+
+    resticClient.enable = false;
+  };
+
+  system.stateVersion = "25.05";
+}
diff --git a/hosts/vm/peertube-runner-1/hardware-configuration.nix b/hosts/vm/peertube-runner-1/hardware-configuration.nix
new file mode 100644
index 0000000..3b6eb6b
--- /dev/null
+++ b/hosts/vm/peertube-runner-1/hardware-configuration.nix
@@ -0,0 +1,46 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/63952795-439b-4ce8-95be-4e45368d4c82";
+    fsType = "ext4";
+  };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens19.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens20.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
diff --git a/hosts/vm/peertube-runner-1/peertube-runner.nix b/hosts/vm/peertube-runner-1/peertube-runner.nix
new file mode 100644
index 0000000..a06a1ed
--- /dev/null
+++ b/hosts/vm/peertube-runner-1/peertube-runner.nix
@@ -0,0 +1,32 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    ../../../modules/services/peertube-runner.nix
+  ];
+
+  age.secrets = {
+    peertube-token = {
+      file = ../../../secrets/peertube-runner-1/peertube_token_file.age;
+    };
+  };
+
+  services.peertube-runner = {
+    enable = true;
+
+    package = pkgs.crans.peertube.runner;
+
+    settings = {
+      jobs.concurrency = 2;
+      ffmpeg = {
+        threads = 0; # Let ffmpeg automatically choose.
+        nice = 5;
+      };
+    };
+
+    instancesToRegister."CransTube" = {
+      url = "peertube.crans.org";
+      runnerName = "peertube-runner-1";
+      registrationTokenFile = config.age.secrets.peertube-token.path;
+    };
+  };
+}
diff --git a/modules/services/peertube-runner.nix b/modules/services/peertube-runner.nix
new file mode 100644
index 0000000..749a1d7
--- /dev/null
+++ b/modules/services/peertube-runner.nix
@@ -0,0 +1,256 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+let
+  cfg = config.services.peertube-runner;
+
+  settingsFormat = pkgs.formats.toml { };
+  configFile = settingsFormat.generate "config.toml" cfg.settings;
+
+  env = {
+    NODE_ENV = "production";
+    XDG_CONFIG_HOME = "/var/lib/peertube-runner";
+    XDG_CACHE_HOME = "/var/cache/peertube-runner";
+    # peertube-runner makes its IPC socket in $XDG_DATA_HOME.
+    XDG_DATA_HOME = "/run/peertube-runner";
+  };
+in
+{
+  options.services.peertube-runner = {
+    enable = lib.mkEnableOption "peertube-runner";
+    package = lib.mkPackageOption pkgs [ "peertube" "runner" ] { };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "prunner";
+      example = "peertube-runner";
+      description = "User account under which peertube-runner runs.";
+    };
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "prunner";
+      example = "peertube-runner";
+      description = "Group under which peertube-runner runs.";
+    };
+
+    settings = lib.mkOption {
+      type = settingsFormat.type;
+      default = { };
+      example = lib.literalExpression ''
+        {
+          jobs.concurrency = 4;
+          ffmpeg = {
+            threads = 0; # Let ffmpeg automatically choose.
+            nice = 5;
+          };
+          transcription.model = "large-v3";
+        }
+      '';
+      description = ''
+        Configuration for peertube-runner.
+
+        See available configuration options at https://docs.joinpeertube.org/maintain/tools#configuration.
+      '';
+    };
+    instancesToRegister = lib.mkOption {
+      type =
+        with lib.types;
+        attrsOf (submodule {
+          options = {
+            url = lib.mkOption {
+              type = lib.types.str;
+              example = "https://mypeertubeinstance.com";
+              description = "URL of the PeerTube instance.";
+            };
+            registrationTokenFile = lib.mkOption {
+              type = lib.types.path;
+              example = "/run/secrets/my-peertube-instance-registration-token";
+              description = ''
+                Path to a file containing a registration token for the PeerTube instance.
+
+                See how to generate registration tokens at https://docs.joinpeertube.org/admin/remote-runners#manage-remote-runners.
+              '';
+            };
+            runnerName = lib.mkOption {
+              type = lib.types.str;
+              example = "Transcription";
+              description = "Runner name declared to the PeerTube instance.";
+            };
+            runnerDescription = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = null;
+              example = "Runner for video transcription";
+              description = "Runner description declared to the PeerTube instance.";
+            };
+          };
+        });
+      default = { };
+      example = {
+        personal = {
+          url = "https://mypeertubeinstance.com";
+          registrationTokenFile = "/run/secrets/my-peertube-instance-registration-token";
+          runnerName = "Transcription";
+          runnerDescription = "Runner for video transcription";
+        };
+      };
+      description = "PeerTube instances to register this runner with.";
+    };
+
+    enabledJobTypes = lib.mkOption {
+      type = with lib.types; nonEmptyListOf str;
+      default = [
+        "vod-web-video-transcoding"
+        "vod-hls-transcoding"
+        "vod-audio-merge-transcoding"
+        "live-rtmp-hls-transcoding"
+        "video-studio-transcoding"
+        "video-transcription"
+      ];
+      example = [ "video-transcription" ];
+      description = "Job types that this runner will execute.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !(cfg.settings ? registeredInstances);
+        message = ''
+          `services.peertube-runner.settings.registeredInstances` cannot be used.
+          Instead, registered instances can be configured with `services.peertube-runner.instancesToRegister`.
+        '';
+      }
+    ];
+    warnings = lib.optional (cfg.instancesToRegister == { }) ''
+      `services.peertube-runner.instancesToRegister` is empty.
+      Instances cannot be manually registered using the command line.
+    '';
+
+    services.peertube-runner.settings = {
+      transcription = lib.mkIf (lib.elem "video-transcription" cfg.enabledJobTypes) {
+        engine = lib.mkDefault "whisper-ctranslate2";
+        enginePath = lib.mkDefault (lib.getExe pkgs.whisper-ctranslate2);
+      };
+    };
+
+    environment.systemPackages = [
+      (pkgs.writeShellScriptBin "peertube-runner" ''
+        ${lib.concatMapAttrsStringSep "\n" (name: value: ''export ${name}="${toString value}"'') env}
+
+        if [[ "$USER" == ${cfg.user} ]]; then
+          exec ${lib.getExe' cfg.package "peertube-runner"} "$@"
+        else
+          echo "This has to be run with the \`${cfg.user}\` user. Ex: \`sudo -u ${cfg.user} peertube-runner\`"
+        fi
+      '')
+    ];
+
+    systemd.services.peertube-runner = {
+      description = "peertube-runner daemon";
+      after = [
+        "network.target"
+        (lib.mkIf config.services.peertube.enable "peertube.service")
+      ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment = env;
+      path = [ pkgs.ffmpeg-headless ];
+
+      script = ''
+        config_dir=$XDG_CONFIG_HOME/peertube-runner-nodejs/default
+        mkdir -p $config_dir
+        config_file=$config_dir/config.toml
+        cp -f --no-preserve=mode,ownership ${configFile} $config_file
+
+        ${lib.optionalString ((lib.length (lib.attrNames cfg.instancesToRegister)) > 0) ''
+          # Temp config directory for registration commands
+          temp_dir=$(mktemp --directory)
+          temp_config_dir=$temp_dir/peertube-runner-nodejs/default
+          mkdir -p $temp_config_dir
+          temp_config_file=$temp_config_dir/config.toml
+
+          mkdir -p $STATE_DIRECTORY/runner_tokens
+          ${lib.concatMapAttrsStringSep "\n" (instanceName: instance: ''
+            runner_token_file=$STATE_DIRECTORY/runner_tokens/${instanceName}
+
+            # Register any currenctly unregistered instances.
+            if [ ! -f $runner_token_file ] || [[ $(cat $runner_token_file) != ptrt-* ]]; then
+              # Server has to be running for registration.
+              XDG_CONFIG_HOME=$temp_dir ${lib.getExe' cfg.package "peertube-runner"} server &
+
+              XDG_CONFIG_HOME=$temp_dir ${lib.getExe' cfg.package "peertube-runner"} register \
+                --url ${lib.escapeShellArg instance.url} \
+                --registration-token "$(cat ${instance.registrationTokenFile})" \
+                --runner-name ${lib.escapeShellArg instance.runnerName} \
+                ${lib.optionalString (
+                  instance.runnerDescription != null
+                ) ''--runner-description ${lib.escapeShellArg instance.runnerDescription}''}
+
+              # Kill the server
+              kill $!
+
+              ${lib.getExe pkgs.yq-go} -e ".registeredInstances[0].runnerToken" \
+                $temp_config_file > $runner_token_file
+              rm $temp_config_file
+            fi
+
+            echo "
+
+            [[registeredInstances]]
+            url = \"${instance.url}\"
+            runnerToken = \"$(cat $runner_token_file)\"
+            runnerName = \"${instance.runnerName}\"
+            ${lib.optionalString (
+              instance.runnerDescription != null
+            ) ''runnerDescription = \"${instance.runnerDescription}\"''}
+            " >> $config_file
+          '') cfg.instancesToRegister}
+        ''}
+
+        # Don't allow changes that won't persist.
+        chmod 440 $config_file
+
+        systemd-notify --ready
+        exec ${lib.getExe' cfg.package "peertube-runner"} server ${
+          lib.concatMapStringsSep " " (jobType: "--enable-job ${jobType}") cfg.enabledJobTypes
+        }
+      '';
+      serviceConfig = {
+        Type = "notify";
+        NotifyAccess = "all"; # for systemd-notify
+        Restart = "always";
+        RestartSec = 5;
+        SyslogIdentifier = "prunner";
+        User = cfg.user;
+        Group = cfg.group;
+        StateDirectory = "peertube-runner";
+        StateDirectoryMode = "0700";
+        CacheDirectory = "peertube-runner";
+        CacheDirectoryMode = "0700";
+        RuntimeDirectory = "peertube-runner";
+        RuntimeDirectoryMode = "0700";
+
+        ProtectSystem = "full";
+        NoNewPrivileges = true;
+        ProtectHome = true;
+        CapabilityBoundingSet = "~CAP_SYS_ADMIN";
+      };
+    };
+
+    users.users = lib.mkIf (cfg.user == "prunner") {
+      ${cfg.user} = {
+        isSystemUser = true;
+        group = cfg.group;
+      };
+    };
+    users.groups = lib.mkIf (cfg.group == "prunner") {
+      ${cfg.group} = { };
+    };
+  };
+
+  meta.maintainers = lib.teams.ngi.members;
+}
diff --git a/secrets.nix b/secrets.nix
index 935d3c7..e46a4f9 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -36,6 +36,7 @@ let
     livre = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEVfKNokHG6ig32hhQxTep+fKFmKahlDClPrX/dP4/gb root@livre";
     neo = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMGfSvxqC2PJYRrxJaivVDujwlwCZ6AwH8hOSA9ktZ1V root@neo";
     peertube = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFueG7GPSBiDrJQS4U20qtIhIQO4fuhFhINPCgGBWCvm root@peertube";
+    peertube-runner-1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFqMQpwWCIag9dHqkhnwN27KxwGFDqbB3RrlreKV/zxZ root@crans-iso";
     periodique = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTdfSIL3AWIv0mjRDam6E/qsjoqwJ8QSm1Cb0xqs1s1 root@periodique";
     redite = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOwfVmR3NjZf6qkDlTSiyo39Up5nSNUVW7jYDWXrY8Xr root@redite";
     reverseproxy = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOx/lUQE6naP3EBy81sr93X8ktZmivU09ACx6T43Odhb root@reverseproxy";
diff --git a/secrets/acme/env.age b/secrets/acme/env.age
index a303152..a0785ef 100644
Binary files a/secrets/acme/env.age and b/secrets/acme/env.age differ
diff --git a/secrets/apprentix/root.age b/secrets/apprentix/root.age
index 9b37b53..a4d824b 100644
Binary files a/secrets/apprentix/root.age and b/secrets/apprentix/root.age differ
diff --git a/secrets/common/root.age b/secrets/common/root.age
index 657576b..99f7e22 100644
--- a/secrets/common/root.age
+++ b/secrets/common/root.age
@@ -1,39 +1,41 @@
 age-encryption.org/v1
--> ssh-ed25519 2k5NOg Ls6cNwYRruGRJEVNnZb0MA5XaOixa3g6HKRBTHdTdFs
-rHSAleRyP1goW9RSdLCrczpDgTBVNskvLVVWvfv4q3w
--> ssh-ed25519 iTd7eA 6zgvxtryDls/BkJUxjy/zjn7qLeNPYXIohIcOmNAM00
-hF3NsZUjrudX1uHsOU50dr8OLWVkFRytGYLbvhr0fzE
--> ssh-ed25519 h5sWQA x3PVkYqEmnjfbeh5wYeFWftQxhqzVfJCntcK83MY/Tg
-/vAmY1GAPFGDawQd+GMv6ElQZiz/mktz+gO7tMOpREg
--> ssh-ed25519 /Gpyew u/MkL/UyIH9GgY/3aPFi45gA0shOeOxa9c5dF9c6LAw
-C8mWDAQ18WoVha7jSoF3muyDYr3Zykymx03BA/h7fY0
--> ssh-ed25519 aZuauA C9tYb5A2KTi49u7Y9hmWkopnOAcOcQDVqD3UDHZofnY
-TpMeJKSjtSocSlTcHU8DudIe/4m4Uh648wk+Gvscu/I
--> ssh-ed25519 FtI9pg 1koRa+X+41YWRBSmJV0gr070Wp/UsyT1jM5YY4iDXX0
-mQ+Y+F6TXenBZhZOcY7KFBeydIrv/Qk6hwGO6LIZVUw
--> ssh-ed25519 hTlmJA RbeyYApE/PZDRt+Ip15GYXEHda36aPwKl2RSOhzifyw
-5AIb0tDjKH9349XPxppZ/PWxu5yqEzmUIuCdbUDU2hg
--> ssh-ed25519 GCcVXA fmpdl9CwCYzkUSCQf7OZj8Dnrbqz0bNR+WgXo1X0S1s
-e1aTVBnzPn/EUhUgakb2edoSOyZDIW5Y7HvcZsvCPLw
--> ssh-ed25519 LAIH1A qTG4JaMrmvCDxv77k0fxvXxdvqyayjr8cR01N1abuFY
-qFwXSNQ+B3mYrvh8sAUJ05CbnQXII2Yk3NLrcENheeI
--> ssh-ed25519 qeMkwQ 4srsEOAGQyUAk+Zr6M4jFTcJbK3mD6zJGpAmcv6uIyQ
-0htfyrA5HAkq0CUp4G7ge14Z5itzEStVMlGGLYhDKbg
--> ssh-ed25519 TqxOLw pcQG9czDCBvh+IzSuzf0JtSRL3Mn8/+fYfOyN3VfvSw
-GvSIFYt25CG39BQvEVf6SJWzbrx/hHoAjIQm2P1AAjQ
--> piv-p256 ewCc3w AineM/toY6576YYU6Jp5u6nBvnEE7FuIuz25RKFK9PSJ
-OM+OQDwCEbgNnLMSk1mBdiTuBkJeyMhxuQ3eJrj8YNg
--> piv-p256 6CL/Pw AxiwRQIDqDE50l8Dx57NLrFEU8jvTmKPyiKqgvVYhg47
-wqSbFJDE5O2d/SGgjGYYOZytP+hrTlTBOGmX0JA1Pew
--> ssh-ed25519 I2EdxQ Z0vi5hwpPA+AJ94AEW0llSx19X0YDBGT+XR7wPAwMgg
-pDWPkYvDAM63RuzMelASlP6Hu1PDY8hCzloS+onwC+g
--> ssh-ed25519 J/iReg OMW6A0EIxda81rKS13Qdznm/5sbD3j1DhUjacAzNeC0
-sIzihIb+3Mgie5nmVeaZdqMJveRI2fcdX9cC2Qy+7A0
--> ssh-ed25519 GNhSGw FBCafmgiSRS7butZaUQ0vNo7n6xUCQJpRkglwpEzRy0
-TwqauAy2lPLIBlmpEbvqmmmRWoP2x1YOvYM4crM+kKQ
--> ssh-ed25519 eXMAtA vuW/14TVFWRGPTLyXd4+7ni3CymYAllZJVGPu2lpO1M
-zfeWezscYZ9NaKAJZQ5SI53+hNfO+AUUbnm5aKa0u9k
--> ssh-ed25519 5hXocQ 7RJ7vJnL0kgzFzSRAnPpvZXZ7/dXwQh2MZL03p/1Gkw
-kcUU9ICvHh0pce9bruk2XnkEwbkhv9v3ooFSe+FxCn8
---- SAn48c3+pGqnaQO8NI9u8gMndUGbji7Kk9vpewtg1y4
-�d���e{�ٝaC��|w_�[�{�
��lI1�#dO���G�����j�б�\�/:��)0k�S�Q
\ No newline at end of file
+-> ssh-ed25519 2k5NOg lkpjAhpmYfgXM+pmk6pMrmdBr/tw1pUgXDXFlo8J4R0
+a4GqhtLMYsmw2mjSU5FhOin7iHvEHir3zUqdXThlmD4
+-> ssh-ed25519 iTd7eA dGZlmVstiBThyRfUBQ/roZCLzLsVFMAr4TmE/Qe8Cig
+o+30HSpBrcR2tgy+RR+cMxbNZOd3X7M4vYcl9muX9kw
+-> ssh-ed25519 h5sWQA iw3BKMZlcbut6b2Ofx4g06EXxzHpoBbq0YekH3PMqi0
+iPWxG1C92kloIQ/SvdKwIkuNRaEM6YiJGKsv/LtwlnM
+-> ssh-ed25519 /Gpyew oE3Cwp8JEhqOWpSJ58gYTyVQB/Kba4lpPqbA/0ZkKWg
+OmjjvSyAJimLwXd1aUuT5B/FM0HGqwJEi6UdMC/OIuM
+-> ssh-ed25519 aZuauA Io5qtlCAXugD136ef2uTDOsM7ETuEejni16Fs/QSFHs
+9mdCRwQ9G4SXFjhMusjJHMsQpfPICd4SMB7zh29il9k
+-> ssh-ed25519 LTFojQ PpKQ+/7h1O+iE+n4E6Sk9QK0Zl8A7fX0Jts9wAQdmFw
+DXlZi3sFxlfdyNsNiCEBLmwiqQbalC1+gZQMtvScn9Y
+-> ssh-ed25519 FtI9pg 8Rzjf4wGDpcABlJOVVirE3JwlCvN5Aufyl8iS+/X01E
+HmR8F+/NxIk0UkasqlcZNtnYy4QzGdziYaLT+8k+n/w
+-> ssh-ed25519 hTlmJA rykAjYHi2hbq124A2SUjSQx0tsyPf784EA01c3o7MhU
+sKSvPSHRH1uDxzCPfXxfL//AP1TqOsyQTXVUCVj4Y14
+-> ssh-ed25519 GCcVXA yHclytphUvAiIwFYH5jfvHzPmV+FVM6npMcs0y0COSo
+Jl3SyhNnM+QOSw1Hrv66PCAHsMlOTXHKf8VWnLlaXqM
+-> ssh-ed25519 LAIH1A HS0p051wpH0KqQH+VQLLsYvOL7kBB+CfTY9QPBcd/j0
+ETSGseAxI2Lss4gFwjnKOihcJ3J38STW0vkW3JXUx3s
+-> ssh-ed25519 qeMkwQ MEvh4z8ZJAVXXqGkKdJpVKzuzj0HyNdIHQFd3Xiszm4
+Kls38I+KaHc57BeTeB/ZiAAintUjVsT/ChjcTslDx7M
+-> ssh-ed25519 TqxOLw Iab8Gcg5Nu0rYPLA5vKvXGURCB9OIhLLoTfOByeAVB4
+8FuwnFSZsF6EYwFF9FVVw15vfQERNLRutsMGCpXNeeo
+-> piv-p256 ewCc3w A42jd4X/VHqNjhIi21e697OVIr5Xm1aJPiedth0qekhy
+EshP51vKg8KiWMWCdQFPljPcMzng+ZHl5M9ZtgFxgoU
+-> piv-p256 6CL/Pw A3zYYNnmfyTHxURtgx2fDKx7H3bHFkXGY/uWz4XhNvk7
+NVQqZudpn6CTElnIiWB2akG4A+EnIO/T9QpisKjyBY0
+-> ssh-ed25519 I2EdxQ BqSDEEZnVoHVBcy3nSxQEAm7iJUUpWEK1K85sIpT/xE
+O9tnz6/BsE/kqku6yyx6pQ0p3nM30sWuI+/cp/6Cenw
+-> ssh-ed25519 J/iReg k6a3dp2AUChprntD1fxt3i3GHXbpMBwH0E1DGVS81jg
+xb58xiTbf2zn0rjiqKUyVQakrPnkUY8ucfpvMfX9fGE
+-> ssh-ed25519 GNhSGw dXYb1zhS9uOC9Z6zi5ees0HIumeNM3JBJWcQzYqndCs
+n0qRg3mHEm8MGq6LJtDQukWktFvhOVOeNYCdC5kJs7M
+-> ssh-ed25519 eXMAtA AyMqxm60N7YsuBM/VpFo2Uxt43M4g6EPagjrIRvrTHQ
+5Go02uqLMcG8XIC6VYpGqka8sGD1SV28GO1VeCGeG9g
+-> ssh-ed25519 5hXocQ TNA/Sj9YuFvmIkuM7uk53jKOhjW1rhQn7Qa4aV9pr2o
+9AhsTcY6JTBz99pdILmMab4s+Y2tAdFkDxovGcGPqjs
+--- 4J9IW5hCcGdwUvrc2gfSSdY/bYliaEiHgrw55oaQHHk
+;�O+3��ox0�L���CL2]貞��nJ������:)��$�i)��?3��H��ν�K
\ No newline at end of file
diff --git a/secrets/neo/appservice_irc_db_env.age b/secrets/neo/appservice_irc_db_env.age
index 4a41c3d..b1b8404 100644
Binary files a/secrets/neo/appservice_irc_db_env.age and b/secrets/neo/appservice_irc_db_env.age differ
diff --git a/secrets/neo/coturn_auth_secret.age b/secrets/neo/coturn_auth_secret.age
index 010e623..e58dc3b 100644
--- a/secrets/neo/coturn_auth_secret.age
+++ b/secrets/neo/coturn_auth_secret.age
@@ -1,19 +1,19 @@
 age-encryption.org/v1
--> ssh-ed25519 /Gpyew G/xDbmNRXF02e0ronEPJAh2SFCJSUIRG405SSolprQc
-9h1xrfNqBGLRD0PlS4vev3BJX1YTwTQ9r+WHgEvtGgg
--> piv-p256 ewCc3w AzoT4YnJgAeEOVn34ychVaM/3HZu3GuetRkSIuUJMr8S
-zcGeA0UEujxSIZ7MXBWY7YyGCxqkLGNBBMEalAZoDDo
--> piv-p256 6CL/Pw AnG+DTHtC4M9ChUQYIeK1D7iVgdEJnenwuXZdxTa/8Wv
-bS3qrukGQ8BKt8qnD/e4eMOv07+eunBNhVs67M/8qH8
--> ssh-ed25519 I2EdxQ jELAz4Irde2aKaqz8GgbwWhBsGliB4Qj3Gpu6s3rHmc
-pP+vpDTfdMEEoziSAHWTFpWlHVegV6Fkme3MEdf2DNk
--> ssh-ed25519 J/iReg 3odARLJ7WGMkvZOCxeFkHoq6zASenSs5bSXGDf8vGA4
-FViBqEoiXvuiV/eQn/xPA+81M7HwS9wQv7lgFX/hLP0
--> ssh-ed25519 GNhSGw 5XpmLJ8GT/4vTKl5Trdzg70D65+9G6itkiWgywmNk2A
-0yk0oAmL7gbSs4gLjUSyHHh2UAOo8fZ+6DI1mtTwctA
--> ssh-ed25519 eXMAtA 0om42JUeM0gx5whCOkcMuwFj8rWdUwQEOmR53SS9hH0
-M2vyKbsTAQZlGDkta2nnV1GGtRL7HHEoY7UvC1qZykc
--> ssh-ed25519 5hXocQ 7JGYvQXUr+xsF3YSnrewu8WTzQjyoMEGGkT2SZuevjo
-NpwuNcpN/ZmN2v6owQd/fYC6wof6itfNzef8DnmOTrc
---- hRLXJQmHfSLoAPYqf99fENV9+g3E42fIOJQiMa2RHUI
-RY�	�S�w",�Җ���!�ˀ2��G{�Ϗ��U%ml��\s�Ƚ&��#�(@{q�&^�"�"��P�t��Ɍ���!�*�D�`��3�DS��2'˺�J1�H����H�P�r�e,�oH���`e	p�k>
\ No newline at end of file
+-> ssh-ed25519 /Gpyew 1Q9yMGomVgFPNDDRw9bBXefM4eQiL1Za3YfblvN5xh8
+y3IZzQ7Q6o39btKDWVjeAqyl127TL4RsS11rnB0K3Xg
+-> piv-p256 ewCc3w A+aGXc+lNqGpFGKH3eLLdqyB5gbxfpWL6Wrzf28AUclY
+s4Jwi3+/avHsnMsn0KNl+/5MVGR//yZrpQ7XgcNM5rU
+-> piv-p256 6CL/Pw Al4jlWQ42L42GJe5DiXL7+LbgUFkV4s5Bw+V7kUmFPkm
+bnjvrAyAi4apOG9tDZcQxeUerwDPi+6mmSy3qW3Cq80
+-> ssh-ed25519 I2EdxQ PbhoL7oNeNs1B1EYBF5+zYyJO3Nj79R5eN+8IhY/ZiQ
+5xkfRXSiy6F2n8qdNdEyW2K2X+kJLP/jPMg8j0BkKr0
+-> ssh-ed25519 J/iReg e5gZulub/oSDY28bu4EW8gc0y4X8g1uN5LYi0G2ILDQ
+5p6Szjlp699+uQwOG+w0GjEyZHRAba+oPLVGaevHBDc
+-> ssh-ed25519 GNhSGw b3n6sUEryXsH537EWL5agg0ouRN7a2VSxx5ZmHOdpjs
+ViRwcmF6GQ0ZqJ+BWnAbzTu8Drdo9YnfSdLuTe1qGpY
+-> ssh-ed25519 eXMAtA Y1Aw5ilmuB74ibO5+djM5/UkLBKeZMOpf4KZvnAQSTc
+YWYbb2gqhIqffuEew1Dbxju8bB/eDhmUIeo3r5USbi0
+-> ssh-ed25519 5hXocQ ZPLHmTli02RVupFiqoQw895PovMjf/mwBNeWTpKnczg
+PGrL76fDNdj2rpQecBNyl3dGZWQgKItSdVGQUXandno
+--- dJjDwozRTmMZsxiFepHJNxZYB4k+lJIU78Susb0D+Mw
+���MJ|��.��'�N@XG�z���Z�y��Az^�m�|E�t��'���	��H,�y��f�8+L�m��i�o2q���}�q����f�.ۤ�"o4w��_���b_�h-�S�^C���K:��i����ù��O�7
\ No newline at end of file
diff --git a/secrets/neo/database_extra_config.age b/secrets/neo/database_extra_config.age
index ec6b290..55d1987 100644
Binary files a/secrets/neo/database_extra_config.age and b/secrets/neo/database_extra_config.age differ
diff --git a/secrets/neo/ldap_synapse_password.age b/secrets/neo/ldap_synapse_password.age
index 09310f6..c65cfa9 100644
--- a/secrets/neo/ldap_synapse_password.age
+++ b/secrets/neo/ldap_synapse_password.age
@@ -1,19 +1,20 @@
 age-encryption.org/v1
--> ssh-ed25519 /Gpyew ivgpgwghthrgCJwb7CGDNz6flwxOI5j/A6KDTeBrmjI
-Zm+gUzPpf1q/hiVblXlAxEoV6je1S2B7nkrxiBIUaXQ
--> piv-p256 ewCc3w AgwJYnbP8Zzg/qAiZ0mafg/fms8vd/5mwD3uxsJ4nQMC
-FgJ0UWYKoLZ1JRg3EQlvxb+bA9dhaLmziDIPiXehzuY
--> piv-p256 6CL/Pw AxPRYON4mNjDCOf/z+6fm998KuDNaiuLwd7WrxwXdD5X
-/FNWDnpsmrKfcVqzVqamJE+wEX0dLgLpFOyukxmCuA8
--> ssh-ed25519 I2EdxQ sxvYGM62jjoCucWjcaDV8zhSGFn+LJC+AZsJ8Go+CSg
-WE4pWhXYGKFPgQv/XACozu61QsblX+VMW7nDTzWo2vM
--> ssh-ed25519 J/iReg JZdCEta1UZLJ9qZ870cYEi9Kh32AOwk9YgOFIw84VyI
-ZFwhJte/HrkiYNCspImxsgP96sR8Y62ZSt2p+n7u9Zg
--> ssh-ed25519 GNhSGw SYY2tvqx189H4ckQ9LT9vFLpTBqmEf40QH3IprPCAhw
-D1I/K4Eg6TH9BpCkZIApWZnRhihMT9PNPo/J7R+yLBY
--> ssh-ed25519 eXMAtA KvtXSjSDLOFUIjhQ69iawq2Fv5Y+V8stZmYx7OhJEX0
-gmIqm2Vd8CZ/WMyj6LUnQA4rg5YAuo6EqJWtQQVMi5w
--> ssh-ed25519 5hXocQ vV4quzkg8nOP9i+QC7mtImsYIwWZ0yJWF6Hsyz1yOgw
-N5LyTpQ4vE/MhiC+bI7gY29lF0uV8R6Q8WBW9k0Tss8
---- h2ZkB5XhDiubKFnP78mhPrjpOlL2m0zBjyOPT9sVj04
-��>�L[B��)ߺͮL�Tw�(���m�4-4m����X�P���4����'$�&
\ No newline at end of file
+-> ssh-ed25519 /Gpyew u29jaQ5Q8iSBl2Hx9KiRRPtBxVah4BpyMVRjx8P9/Gk
+eHUWqTb+9EGpUVc2CYfPswa5Wx0GuxfxcN9NQKDP4Z4
+-> piv-p256 ewCc3w A1pGmPgrGKgJC3XYtsI8oegLVuSypondcZV2RmNvV/LY
+8WgOxLCSQyt3QMBkUyyWOxO7ZKNxDycHiRtysHho3Yo
+-> piv-p256 6CL/Pw AsLVqUd3O7hMaMgoe1nbKsYWywt4BJu/nXZBB2nnp1yn
+ujnfu/5/CoohAuLJ7xljllAkU5hB6l/tQytUJfkkVOE
+-> ssh-ed25519 I2EdxQ PSQRsH2LCePcG6T8l48Gw8ri+ITwSiiNXJXi8myUekg
+azZBWHgQQuw6dfwnQ4a+RBbYKy3xQ3RRVtFIUsz1mlQ
+-> ssh-ed25519 J/iReg c7GG/+faTIzRAR6Lby+94wHX8EQdQXwiQHPK7MrZTkQ
+FOAdcVGCbvMjooBrvJaXM3r9wVHKuzJoXO3XcIkdoUQ
+-> ssh-ed25519 GNhSGw +h6ws1UBN0DI8fgwWRMa/TnxVYPmxdCR7QjObrcFjQQ
+8WOzKEqtr3xHb8yr99EubqwEQD8hpw5qNgrUn2XtA1I
+-> ssh-ed25519 eXMAtA BCws1ICF5bP+X9V1kJcUPWIqe84m/pgrUA2X03mLShg
+g/mQ+Sy9v7dE+isrkY1WEcAQ7ThgvIj/Ek1DEUjjRa0
+-> ssh-ed25519 5hXocQ H4soYo1IiRyRsehVqG5/mmQC4+Ki3NNo4Zhk4W48oAI
+5W9t5OgcYnqfnjFM/d9hU2PZvOmmGp4fPfzqe62xRfM
+--- L2cxy7s8xvkIPiqj3Z21+r6lD9iyupD3T3p2WDqil1Q
+�G����Y��z�N�]J"N`5
+��D��b������tI���i�a��%��3�U0����
\ No newline at end of file
diff --git a/secrets/neo/note_oidc_extra_config.age b/secrets/neo/note_oidc_extra_config.age
index d4cb594..a69a40e 100644
Binary files a/secrets/neo/note_oidc_extra_config.age and b/secrets/neo/note_oidc_extra_config.age differ
diff --git a/secrets/peertube-runner-1/peertube_token_file.age b/secrets/peertube-runner-1/peertube_token_file.age
new file mode 100644
index 0000000..6345801
Binary files /dev/null and b/secrets/peertube-runner-1/peertube_token_file.age differ
diff --git a/secrets/peertube/database_secret.age b/secrets/peertube/database_secret.age
index 91948d2..9d39f78 100644
--- a/secrets/peertube/database_secret.age
+++ b/secrets/peertube/database_secret.age
@@ -1,19 +1,20 @@
 age-encryption.org/v1
--> ssh-ed25519 aZuauA 5cuNnty1hf1407Vs+DI8MklEEwWR8P+lKLNhquAcM0g
-EEaziRrRXMkQPkU83HwLivrX3wd1ZxJzpPSptfpStnc
--> piv-p256 ewCc3w A9P2HkYgO5Q9p1QaDKeT9ls6za60v69zhh2FHwZd0n9n
-ZjIy1N/CMgP5qMDsXGWeLJKZh1cjq2SAlvPY1RY/lfk
--> piv-p256 6CL/Pw Az3rPpFmio4G1EfexfD2Cd7gypePwybW0lQ8WMAJ4Ax0
-Mu/41R/WQGMxvaIShbfVcKGRU669Hp8rNvwCfNgeCGc
--> ssh-ed25519 I2EdxQ HH5oCG0lJ6Q3ydgP4XOnl20FUi/ukGogw4VieG1Jk2E
-hlUJLC+sNjzQzaY03haTt1UfHP8VfdtQ6xTjmE2IRwI
--> ssh-ed25519 J/iReg TgvvOcqejXke3NvXfrvmkDryhvpXzxxKVBN3i161ChU
-dUcrvs9j+DOia/i1zi4GVCbmzY92JFySD3mxsYk99IE
--> ssh-ed25519 GNhSGw 8rNR1VEBPOL4vtuTAIqsB1YLxqFafwlVllWchBb1/wo
-ekbEPWDtVEwGcZwTrQPUmtOAeU7RpYU/VKZwW8HelPg
--> ssh-ed25519 eXMAtA w2f28YKHPKeFl2lFv1I4vO9QUl27h4cdMj5PpzODVXg
-zFGXCQGpXL45BNEBIdTZ3KK4Zm98DxggIIt2WDhTCnc
--> ssh-ed25519 5hXocQ +HsLdizG4UZiVBVZ+A7cbGlC8YJAT67QiT9Bvz0Kx3s
-9xszfLqlwwKfPxxF+u/KdQXtWZCjkyhwAmaxO+bTtEA
---- BusTK0HTLQe2MH6yBl5FaO8v62WlDE0QttxyUnob3QI
-�yhr�k��pR�ZO���Vڜ�i�m';<�jո��A�_�.G����ĸ�Dq�`ӡ��JVÚ�*�i�Cg�%o�-��ė�魓�XKP�
\ No newline at end of file
+-> ssh-ed25519 aZuauA rw/6S98mNyZUn/zBL2eRyVLamhw2Vd/fco3gDpG8G0w
+NOWvEXOs1z47u+PBnpxrPdvFZwEixfChICOwyhVQVew
+-> piv-p256 ewCc3w AxNgFA8OdnT5O/IXxLwPAvQAc3ZE0zsOree+ZXEO/blt
+VGIhU+PDFoMZ2PnJ91ZRtnhEpP0WjbwGspBkJ19EjaY
+-> piv-p256 6CL/Pw A0E/V65Eu7QhpbkB8RQawUDx1pivFQC7c2km6diZbJCe
+7biPxoFUwG/I1YqytGknOxmCVtz2OpECAbyd6EEAeNw
+-> ssh-ed25519 I2EdxQ laJzcWPUHaYeYOAIyhTyGCe5CUfCUUbltk//vkxn+z8
+hwXNo2NqhBVCaOn/KMxKb8xVG3pY7fje8O0LyMwMgds
+-> ssh-ed25519 J/iReg a0Q1J4AVBaLh8f7/Y4AtsJ0Ie62b62zbooDV/sA3hy8
+C0sYnr5pJ1hnqfMqGSyjtLzP3oJvb+7yxcNOs7aj5DY
+-> ssh-ed25519 GNhSGw mn+80Q/7nu2Sy3Auzyei/sDakLJX/Rf4kP16K9T5IBQ
+up0TsfNoTtgVJJ+jACixAU2r6BWM6oupiQVSd+T2nQU
+-> ssh-ed25519 eXMAtA O+HD6GrfraFSLjF+yRmnEuVwNCFDQSq5OoiemvFqC3s
+CPeAHv9+fsDMuGCS56zo33NTEotlRaOBweGdH/3ThLA
+-> ssh-ed25519 5hXocQ 8LsLW/r4nRmrzqN+HhRxznTGUhTGFsrDS28h7rsfOz0
+J4GP05GC/iYO7OKioniXBZN81eWcQgRuNxpfPc3/3e8
+--- BBXmDYQYIu+dfOQyut+IX53JLomQZ4dD96rQFIro3S8
+v�
r�4N��'_}|l�ʥEM�����R>|������8$��	wE��E���}�R���
+֐β�y�����d�…�eR�C�cU��{zv-�
\ No newline at end of file
diff --git a/secrets/peertube/peertube_secret.age b/secrets/peertube/peertube_secret.age
index d264c79..a39d587 100644
--- a/secrets/peertube/peertube_secret.age
+++ b/secrets/peertube/peertube_secret.age
@@ -1,19 +1,19 @@
 age-encryption.org/v1
--> ssh-ed25519 aZuauA bev/+fG+BKZ5c49odMRYhpSolxOSczhM+yS8KiJpwV4
-q68aV6Ee0OS/mXhSKT+NQEdSJ4X4I1CeKmnpynqAsbE
--> piv-p256 ewCc3w Arx3wiCUw9Xw+vJalIvI2ldMkcqWhYkl76A/c+zkgMhx
-m81h56hOvfDCjda+45nY6U3Orr3/oeibWRsubjzcwGY
--> piv-p256 6CL/Pw AhbCXvjcywLZ31j0qKLK0IMcXXpLXnVkj6qOz031zBgX
-Kg28pEs6slhKJT3i7tFXMxWnpIrs2lca1rOBrMIwZzk
--> ssh-ed25519 I2EdxQ As7L/BdQ+1TkdhgAguS5wfzbAQ70bD5TBaskXa9rLDE
-IMjmX7RTrNJ6zF6IlG1zTMoYbwTTzD1whD1S/LTlsws
--> ssh-ed25519 J/iReg 24dst9PFCFoeWT6TGyldxiWZNR6S0uGw2DUIdUiMLQ0
-p0uVE4322vkjqjs7l5mJiCxMtG2zAinCX6kH1OcaWOc
--> ssh-ed25519 GNhSGw 6rrGEtQGLrN0l4NsVw9b/swEn9xL1PrboQB2RZgTinM
-L32NGDeLsgrWWs2okVhKuZO/5KBC/J/IhAby4B51ixM
--> ssh-ed25519 eXMAtA A9Ckrw/Qs8NmKadrjMy6ESHL4J2Jn8Mu2QXcFZRQvQI
-7Nl+V3UKM5oEAFIPkOytspVoaAaelasvWdDhBkH01Do
--> ssh-ed25519 5hXocQ BqXSpKIRjdkCcFu2shX/f6hQIkzuIPwWF95nWduUHSk
-/2YLAiqteayhq34Zf/cIxKOCEEM9GJ7NRASOH1IRXdk
---- gcFBwYU3JJSuka6NhM8SWudm8+hlGZPgZdpiSgCxaOk
-�Ϊ�i��s��\;ԽռnDA�8�|Y�cW�A�	�Z�c�)C
�-@�6�\Լ������s��W3�;���>���aMذI���X�j�	�^
\ No newline at end of file
+-> ssh-ed25519 aZuauA TvWGNtfUFcbUD37YTJbqEyVP4r2TKNF5rzAJsrJlPgg
+5UX2EbN0Gn9V/N7lghuvm83y5DdPK3uuv9GPYp5xQa0
+-> piv-p256 ewCc3w ApQdikfcgua9kWnhl51VT4lsLUcteroKkaBBTzP2AV1g
+/7Z7KEFxE/mISvkC147dFHC2W7s2YQLFvanqm5tMF4o
+-> piv-p256 6CL/Pw A3FzTQ7BqFtFAvAbtwihAvnBytsVdwZyl2rfVlW5o3nV
+40PHO8f/ixitW9xJDvgjplXqod8qTjJX7UI2jJ6Xqh0
+-> ssh-ed25519 I2EdxQ YADpSsLADLFCZGJY4zv22UvuUdKM/Z7/tjwK1pVj71A
+5UFtheGka/HRz9puNk9QrTuc0LsbeWEBgulI88e2Wjc
+-> ssh-ed25519 J/iReg 9JrfLsHcMJG4KG+1t77+0t3p1cJoD6cwCGgfJPXPYxk
+2QW2K911TMJtAkJsBbXOzY/a7vjWwdDW5E5Ohd1z9+A
+-> ssh-ed25519 GNhSGw u2LR6naCoD+NJ6gFinxfrVHAsPWQWBDo6CAHPoohqGQ
+sdAqCfhjAnawulLF3b19Y97ZecPfBEnxulE7DOJjf5I
+-> ssh-ed25519 eXMAtA fbp7elYogbwFQei7gbL65RsT+insYyb4y6CWXIPBzGE
+hN0CaO5vTa5xll2YELZx3XtbPn8hfdWfPMFrCdwpH7E
+-> ssh-ed25519 5hXocQ D5NZK7nFdKqRiuis7Vj1KXQC39RolSRea1SvB2HT8QY
+ZSohA4y1MhjwteNt68WCY1bDsBaSGqB3N2gnNy9fVoA
+--- U/3wweeF6xQag0k/wdM0ZDSTpFEvvuwdVVipHzXW1EQ
+�yJc�����d")pa��u��5��M]�މ�/ݝ�����1B� _W��"�.0m�&��'�o�v��?K�M����o������p�\d�
\ No newline at end of file
diff --git a/secrets/restic/apprentix/base-password.age b/secrets/restic/apprentix/base-password.age
index b0e9576..fe47637 100644
Binary files a/secrets/restic/apprentix/base-password.age and b/secrets/restic/apprentix/base-password.age differ
diff --git a/secrets/restic/apprentix/base-repo.age b/secrets/restic/apprentix/base-repo.age
index 1c13110..8450335 100644
Binary files a/secrets/restic/apprentix/base-repo.age and b/secrets/restic/apprentix/base-repo.age differ
diff --git a/secrets/restic/client_env.age b/secrets/restic/client_env.age
index a52f861..7314d0c 100644
Binary files a/secrets/restic/client_env.age and b/secrets/restic/client_env.age differ
diff --git a/secrets/restic/jitsi/base-password.age b/secrets/restic/jitsi/base-password.age
index 62d3eb5..4e986c1 100644
Binary files a/secrets/restic/jitsi/base-password.age and b/secrets/restic/jitsi/base-password.age differ
diff --git a/secrets/restic/jitsi/base-repo.age b/secrets/restic/jitsi/base-repo.age
index 029ebcf..83aad77 100644
--- a/secrets/restic/jitsi/base-repo.age
+++ b/secrets/restic/jitsi/base-repo.age
@@ -1,20 +1,20 @@
 age-encryption.org/v1
--> ssh-ed25519 iTd7eA xVZIw7AcU3kTnQ6y6pKnwN8gwO+MlWImo14emwzTWm0
-vQpe1lm+JkahnlN0CBAebaP1YpHqH9Gnv/iGGw+w/io
--> piv-p256 ewCc3w A0cbIBNhAhHtNDmfCM6YYpD4Vts29tYcP336XHmmNCO8
-Qzi6zB96leNBikwyaytjvCS7j3KbQTg87qctauJwW30
--> piv-p256 6CL/Pw A40DSc1UI7669Ys/4wjmbjfG3sWAHpEk4B/TLoFkRBCx
-dIRfu9gI9CImuKmsm+Ey9H34+Vc9ewmPBsysrRBht+M
--> ssh-ed25519 I2EdxQ A0PeU6QhiZHts0Ye/WfHWKW9T0qqxSZsyb+VBa9RWXw
-F8JnJKakMESna17itjjdFOCH/c+cFvBW4w6MgNRCaLw
--> ssh-ed25519 J/iReg 0t+7Ibsc69XhH0t+4VT7b2A13IazLK7SAxIoib7tbSI
-41eiH16fQSqkzBbVPgmfovcO+5tX08F3hCH/ttbzi9U
--> ssh-ed25519 GNhSGw X6ouZ+jPK+Z1CAJDFbgaE3aoqOAz2L85jgqPM73GnDs
-rLEQYqusGTmMz6EZyLcLGI7Hj5j/uDurNFrEW2WYhE0
--> ssh-ed25519 eXMAtA 9tXtsZ8RAe6spaHSz9s2/DcJdVaqcBwVYhCKLCbOzwc
-CPX5C/vFOdDeG24A6xQDKb/3EVEhvAjIoiALclHX+vA
--> ssh-ed25519 5hXocQ XMi7Zmfets2zQ5XVchFp1veIwehSIGSUQbRcgw8wZRc
-Zsi5Whqn8sc5KHgIxCZ/Qox+wD5rgCFGH499X/fi/nk
---- 3FrniSobbGK8KnstgAgWuzjEbgtrXulN196qLjr0VBI
-�պ^3��8:�7_A�P�A�DE-%c�5��7.y��'~���W	2��c�������t��`�P����H*����\Ӂ��^E�ɓ�Vw��*=��{
-�(�v{%`�1�XV���"��)K#�)�n�hc�/$Ӏ
\ No newline at end of file
+-> ssh-ed25519 iTd7eA EEwWoGOgu20q8Mo5v5kiZwNJPR8URII4ApTJkFyZ0CU
+63xSR2G6WbC1nXg6090sMACjJuoyt6Hp9dbdvW/X/tY
+-> piv-p256 ewCc3w AlB7xxur0keJZ8WWABetEtibed2NesZ3LzEIb1NwAN5B
+AGB8IfwBwzjW1IyQ0UfFfNX4Z2bVbQZokZ227qUufc8
+-> piv-p256 6CL/Pw AmXDilV812wuDU3wSQFuoxWfr9wT6lrKWSe1YoVgPRxN
+SVk5AMKUlKNRM6C8fCNNggXjTAlkXd07M8e6u5x/6Kg
+-> ssh-ed25519 I2EdxQ TzNZqNvvGXo72dga+0g3s4HdKH7euQexuM3dhPTdrDU
+MhhsZfdQR1BSyg8+Ub7ayK/RDzxQ59PaIhjeLut1ttE
+-> ssh-ed25519 J/iReg MaT52BSTu5JCkANhh10u/2vhMz68rtnMhCUXY5sFFH8
+D8u4OkGmB4w1BukQ+2GBU0mnMYJVgqBkhsRnQXm0+nY
+-> ssh-ed25519 GNhSGw 34OLzBAK0pVDmIPvuwci0LEkvvmPb/j18wABA/dWcRU
+01uwA0Rh/+/rgmwiVwCzns5HXvAK50Y2cR4hgjKVYTM
+-> ssh-ed25519 eXMAtA GLI2QZaRR8HSdeHNWhtXz7hX+shwrD72+jkmyyMctDI
+aNyJCi1ixFP2sRW9jWk8W5guIbQjYuDihK5F4Tz7Gps
+-> ssh-ed25519 5hXocQ fk1lK+ftWlQ0zlU5djH7kxEuOgFK9S3wawQqOwB3LkU
+t9Qo74LD8toeg4YFqHQNYTSF9fKWr+6op+ja8Q2U8Is
+--- vRmqXQqz50x0x6+XAHcqmhg3doMXGZwwfz//ak99LUY
+@�
+�J�@���0e,�s��(iF��Gd��H2c&�7���++��ɾ�Lj�����
��զp�#�����pQ7%7{�D�M�S�nDx��b
�<{\�h�o&�s'[4���<��v��kof)��Kd
\ No newline at end of file
diff --git a/secrets/restic/livre/base-password.age b/secrets/restic/livre/base-password.age
index 5e4f6a6..e4599a3 100644
Binary files a/secrets/restic/livre/base-password.age and b/secrets/restic/livre/base-password.age differ
diff --git a/secrets/restic/livre/base-repo.age b/secrets/restic/livre/base-repo.age
index 750d392..b90a3a5 100644
Binary files a/secrets/restic/livre/base-repo.age and b/secrets/restic/livre/base-repo.age differ
diff --git a/secrets/restic/neo/base-password.age b/secrets/restic/neo/base-password.age
index f5f8c17..6d5bab5 100644
Binary files a/secrets/restic/neo/base-password.age and b/secrets/restic/neo/base-password.age differ
diff --git a/secrets/restic/neo/base-repo.age b/secrets/restic/neo/base-repo.age
index f3ad55a..9e71f8d 100644
Binary files a/secrets/restic/neo/base-repo.age and b/secrets/restic/neo/base-repo.age differ
diff --git a/secrets/restic/peertube/base-password.age b/secrets/restic/peertube/base-password.age
index 62df7b8..55a9e65 100644
Binary files a/secrets/restic/peertube/base-password.age and b/secrets/restic/peertube/base-password.age differ
diff --git a/secrets/restic/peertube/base-repo.age b/secrets/restic/peertube/base-repo.age
index 3a81cba..dcf51ea 100644
Binary files a/secrets/restic/peertube/base-repo.age and b/secrets/restic/peertube/base-repo.age differ
diff --git a/secrets/restic/periodique/base-password.age b/secrets/restic/periodique/base-password.age
index fa0e3a9..f372803 100644
--- a/secrets/restic/periodique/base-password.age
+++ b/secrets/restic/periodique/base-password.age
@@ -1,19 +1,20 @@
 age-encryption.org/v1
--> ssh-ed25519 FtI9pg y18yJk9aUych2e4944bK0OSnh/TpdtgLO4BlJ+QyQmk
-OhCDIdqi9puUxyMeGcyI+C2YFGZ40A59WwUhXpsMlgA
--> piv-p256 ewCc3w AzORIreQMDLXkBBt9zwRljU/siewK7pb/3UkG/eCMho/
-ModWYiOOhI2ZVHMYGOqovWfu73TKzwWlQAzs5M20Q2s
--> piv-p256 6CL/Pw A38mLaGoGTlrgNDPY1F1Ae1hyNZqFkaowdv/DJQMpId7
-iO/Lk+tGeKpHkh2m46mRPRgVU0up0udQuj6Dbl6bMg4
--> ssh-ed25519 I2EdxQ 1AsZpFg9gTh1kS7ENBRYJIT9RXHFwj9W9j5NzwwGiRA
-ZRagLvtrp9+ZBlM+hHTDm0w+wI2YJ5y+z4AhR5KaZ68
--> ssh-ed25519 J/iReg eMLyVy4cpgWSsN2YRShlw+X6mCY4pMf+WeKaEjI8NAY
-4PUXg5tzpus4XM39mdNlznql/zBxdKlf0SgccjRZZgc
--> ssh-ed25519 GNhSGw AhaFV8+LjWYd+ou9QMR1uKR20r38ONBPGnCCMDK1hgk
-B41ADE/XG5pQ0h+JQ08eFbVLawYD74MMTWm8HiAB8os
--> ssh-ed25519 eXMAtA y/sKL9vvZsjL5me/ZdWm4mvossllv4Jxf6kUjqj8lEo
-BKOcXeys/XrKCnbOAACsjs2Tke0wYpTwyEGXLBfQeDo
--> ssh-ed25519 5hXocQ oW4vIl5Pk23kn0B6tCXJJ5+LozL4Uq7riX7pZ/Xe6Tg
-rn9hOw2IX4mhD+zCns8Xix/iiNlTyXW3buPzpPfcQEQ
---- iaKsGMVaJWCIRNMhw5+eaB7jHr2VxY82kpSr2nc2p3M
-TJ2���K��vޮB�<�,�����yQ)��O��7'�	NБ�T�gp"/�h8�:<���ûP0&2�m^�P]�25Jf�W|�n�B�v���ZO��:|�����
S7�r������Q#��o��ˈBW��	w=����.�����sb^���o��G���D�ۃ�fQ���yq���.B����0�H����.8ځ�l��"�'��J>����ߨ����Yetj`�-��}9t�����:�+|v"�pϛ"�*�Jn=4�7���U��B�W���W2hR�
\ No newline at end of file
+-> ssh-ed25519 FtI9pg CKal/BfhSM91inlv9pzQZsL1GTEOxizPszvshlM7pnw
+lxUh8zLg2mCCUwwrhwyK+Yx6qpF2UGG6MHMI0l+PgBw
+-> piv-p256 ewCc3w AwHaYjcrMkamx529e0ur/mZay56si+7YL0VUCU0wSN/P
+GYzdrr6JdCvvQroeE2aTyp/Si3jBnZDNBOH3CHleozk
+-> piv-p256 6CL/Pw AsGatFsXOOD9LkgQPMUmiJxrtFEYPe9x39lJaYR0HlqY
+jeDPjbRyKK1FEuvlwEoBnTOdnqn3LoVi9YVooZHGz/c
+-> ssh-ed25519 I2EdxQ 0Rut6qj2RmDt8wtyBvsFlZx1NGy1sUFGBQqtyiwzllQ
+onaXIfk11m6w0I0/MJDWsZPAFcUcrk0PGOnU7sMbWTs
+-> ssh-ed25519 J/iReg dktMuabbmNx0jwfxvO+Sn4J30Z2itUywtZi9SrLnyXQ
+6GBr8wRFUkxKXyZXMbdoqRTeQsD0qveI08WIZJZgZZQ
+-> ssh-ed25519 GNhSGw 4SV7nNfEWyn/4PZNaOp3M+g/Fbmo3rSY9CvaXb3MBQo
+wCxHfy+7mBktNQUvh8LB84T2BU+PowZ3ZD4XiTg4Cwg
+-> ssh-ed25519 eXMAtA q9ssfci9S0vDFfZR0qKN3ikJ+KgPkuHOth2IfRxcRHs
+qYb0C1eOEPKD/vpSJxvtrMotrQ/QZnrNvMIGQhHmij8
+-> ssh-ed25519 5hXocQ v4ivKKA5E2dglNqzdi7+8FB98XNRZjg5yIxSubR7Xyg
+j/9yTav8PI9Dwl1iM8aVX12AOOzS1u6G1i0hhrGdeqM
+--- ZWJvOlCVPDtazx1CfnqI30P5Y+eGZybd1qNker+/EmQ
+Hp&�HB�D�g��_�JЄ�Π�ؕ��S�i��[�LE�P�����S���[6�;Njl2�\������	�5+	co��W�<�I�6)e\5�+v<����DV��o�L�A�g�J��)A��
/^�YYep'���^��̽і�Ƈ�g�a3[��DC�ǣ�
\�y���>���Ťq����
���d��Λ�b��d�d���Yy�?���� �˹�&R�aٸ��$�阅�����3�/��t��'W�N
+��+�P@n����A�_�"���wuĿ߆xK�S
\ No newline at end of file
diff --git a/secrets/restic/periodique/base-repo.age b/secrets/restic/periodique/base-repo.age
index 8e2070e..cf232de 100644
Binary files a/secrets/restic/periodique/base-repo.age and b/secrets/restic/periodique/base-repo.age differ
diff --git a/secrets/restic/redite/base-password.age b/secrets/restic/redite/base-password.age
index 1437f4f..b407c5a 100644
Binary files a/secrets/restic/redite/base-password.age and b/secrets/restic/redite/base-password.age differ
diff --git a/secrets/restic/redite/base-repo.age b/secrets/restic/redite/base-repo.age
index ca74bc7..558dfe7 100644
--- a/secrets/restic/redite/base-repo.age
+++ b/secrets/restic/redite/base-repo.age
@@ -1,19 +1,19 @@
 age-encryption.org/v1
--> ssh-ed25519 hTlmJA RIDxhyOPSNjHS/kUGjM7L6njJWys4qbod5Ktb2VkUHQ
-0INt7toXjgJbXpdM3WnFUWkjYStDTHfT+jTPoXtmtR8
--> piv-p256 ewCc3w A3G2/PLgVtPWG+S8e6dc+mU4Uy9WTzFr3UROrFxayroz
-k4EFqlm0+GltpW9CkG2jZ95W3KkgXWc50lAbdO0BJCY
--> piv-p256 6CL/Pw AjhU5zsmr41tbT+jTQ9V4C5EUefcr373yXmlZMKwxJL0
-uGrKcMhfteqGG8HTG0AQ7PVjDQTk5/imKwVKNrhOAfY
--> ssh-ed25519 I2EdxQ xL1tvpT5b27R/CDzzoYVIIAez0lS8JT4QIvVPiLpHn4
-ceWvqKo4O705rHfPK5iZYijg4NSJVGp+RznQYGarmPM
--> ssh-ed25519 J/iReg 4hJKcRNAvbVIjVJL6fMU5sziFvOQChiWb4jmNcWzig0
-PZ2ES7MczxAYZF9+tjIXhrlEV+WPgT3EfsJ4zlLgWx8
--> ssh-ed25519 GNhSGw mIQjf/JhVfDCVFDlM8Nrk83+ZS32bAkrEE4ThYWbQBU
-J8ULnApZNBVDmwVsG8+LpKja85tUi4w/R6DweMMKS68
--> ssh-ed25519 eXMAtA CwmsYcVpLrADbG8xaAN4uUZ+OIHtwdLNsLHBoODlzV0
-lI6mU5NqJyef5wELr9XJbGN7psJLAheSJ/KGKjDKZe4
--> ssh-ed25519 5hXocQ xP9mQtj9ys5nPp7cmE8TvxAVDi01cn6CPIjJMX0EIXU
-BmuZJmkKAIScdp0XZ6bDKE648H3z+WkAn+cniM2iuLg
---- q/Yj/Tn2VXH/Orsmoq14ltmUDXE8BAFFgAnuSjRZ9Ws
-,vC�`����]g���L��X!��L�v��E�'?/~��:|��i6�Z(���[ΔH���g&��XfH��`�
�Fa�,g���5
����*��O\�����T��
|��b���L)�5`W�R��&5�7���
\ No newline at end of file
+-> ssh-ed25519 hTlmJA N8nJbEe1yeNYf2XMOWvHoRp6g69JI1peDWpS74IZ6zM
+RgB9Pj67N3SLz1PyvTm+MyIVQ+iEjt4NEiuWz5RJTsk
+-> piv-p256 ewCc3w AlavujiiqVTvav1mRtVlPU0n07QcvtXrd+4GpA3SHFiC
+E+w4eirJluQ/HI2dvWDPPK/8tfxCMPSrAaKmUQqG1y0
+-> piv-p256 6CL/Pw AuW9l7z0ZNOKzZ+3753glJEeiIW2pTEEKGNVQ4RQKyn0
+PJPqprZC+Vt4AxBtCwRudHwb84NIT+3+vV7je8yc9Zk
+-> ssh-ed25519 I2EdxQ r5K80pHspP8d1Fkvs9uUR+hDFRZGiQi2Fz2JFAmIWXs
+s4Owu2ofyHirwbsDJ/0Q7gxWsWEIySYZJ2dO1DV6Ga8
+-> ssh-ed25519 J/iReg If78XSdNfhN9UBNNH/DIJCygEgWhrVb3nOicykxlDwY
+G5EBl2R8Euy9x5K0lGvP29O4EEDNgkS3jEcJb9lqfiE
+-> ssh-ed25519 GNhSGw y00/G2Z4q7535utdgx58XNxj7IVtiILO1A0mm8pgrQ0
+s3XPJh3F4gGyNJePDZx4zgQTqcUf2TXkCOHCS9TYnJg
+-> ssh-ed25519 eXMAtA kDi5kmwcQdCkfRgtxQktHM1jIjY4gu3i47iJU9tT32o
+OL9+XX/b1EEDh1LO9CdrdNR81sfupPxaXzZZ05rNnJo
+-> ssh-ed25519 5hXocQ 8woQ9isdXm+lb8dM1aU5qTksbbMCgD4iGKc31W0u2jM
+UWUEkXrO5xtz341hkEwz/aDDPK3MWJPgxPZhPgrcFfs
+--- MHa2CWL8b7hV0LkotgTGdL/5f/E7qn1Ex/SH++Nq5LM
+�T2���H �y��-��ҹ���Hx�!1}���2F8j���f��L��<��t*bx��m=��+tW����a}�B���-����J�S��*Rh/��:�TL��#`S�]m�"N�P�+1,֭w�����c��1�8�B[
\ No newline at end of file
diff --git a/secrets/restic/reverseproxy/base-password.age b/secrets/restic/reverseproxy/base-password.age
index 9703de4..3b31d59 100644
Binary files a/secrets/restic/reverseproxy/base-password.age and b/secrets/restic/reverseproxy/base-password.age differ
diff --git a/secrets/restic/reverseproxy/base-repo.age b/secrets/restic/reverseproxy/base-repo.age
index 0ae4774..ca973d9 100644
Binary files a/secrets/restic/reverseproxy/base-repo.age and b/secrets/restic/reverseproxy/base-repo.age differ
diff --git a/secrets/restic/two/base-password.age b/secrets/restic/two/base-password.age
index 753c04e..b9cc5f8 100644
Binary files a/secrets/restic/two/base-password.age and b/secrets/restic/two/base-password.age differ
diff --git a/secrets/restic/two/base-repo.age b/secrets/restic/two/base-repo.age
index 29240e0..e6d9058 100644
Binary files a/secrets/restic/two/base-repo.age and b/secrets/restic/two/base-repo.age differ
diff --git a/secrets/restic/vaultwarden/base-password.age b/secrets/restic/vaultwarden/base-password.age
index b031cc3..089c249 100644
Binary files a/secrets/restic/vaultwarden/base-password.age and b/secrets/restic/vaultwarden/base-password.age differ
diff --git a/secrets/restic/vaultwarden/base-repo.age b/secrets/restic/vaultwarden/base-repo.age
index e893127..44a7f18 100644
--- a/secrets/restic/vaultwarden/base-repo.age
+++ b/secrets/restic/vaultwarden/base-repo.age
@@ -1,19 +1,21 @@
 age-encryption.org/v1
--> ssh-ed25519 TqxOLw 9m3sdx3pHcHrC+SMw+6oqfRBSh56CNqu5wOjn2AW324
-lnZtxlR0nEpaLByBFbMoL/Hh/GGs3jXW29fhX2yG8/U
--> piv-p256 ewCc3w A4bZPJE3db+J0jvOjtOw8Yt3u5Ro54aiXvJm34Rp82fC
-0vc770GnlS4HHy/l7owBDfoIyq8Lh6a/CeuOELWwWwg
--> piv-p256 6CL/Pw A/JcrpxS2p6nIucCRJURPxTwYveCfIn8wyBIJmrLVuQO
-NzP45wR1tnT0Jyn8H++ZI296qmUgWmq8a0kQFbs++qY
--> ssh-ed25519 I2EdxQ HOMEadLASXc8oNHOw4ZH5hdNcZQK+5xPsKCpMwfikEs
-VfI2Wrmq+wDoe/9iYgbb/mOetaSLu8wjvwGhhuz0CSc
--> ssh-ed25519 J/iReg bA3sLMjRjB+sXx4vdfLT3aWs6lS1riewTAwKCHFmKxE
-kd3cixJy1OqSXxO4gKQjkHtgdo9TT6SY4fnXNv6rMyU
--> ssh-ed25519 GNhSGw 4GxJbPLgP5+ZRqRFvxA7GcLl29YWISlyPTf8/rMi80k
-KviBFW+rZXvOo8iFNJhUk6/xSNggDKa6Uk9z/3MemC0
--> ssh-ed25519 eXMAtA h/ZFuCPUYQhTMHkiI5h4+qpDuiLxfQ1N6lOIcfmehic
-zl0WxcydivtL6DFz/BsYI/OX0Shx7Mb2258nCWOE9p4
--> ssh-ed25519 5hXocQ qdIHWNADT4B5+kOLmRu66OaF+OMN7HrQGJe6XF9mMkI
-uEu0W345sRgSk3mQURpoZGN3eAT0WKGAdV9mQ2P6W5E
---- iGzf0MXSwet+X4BkEMZ9r4vBZUuyFRv/u7mRFf0vr3E
-ݭ�UE?�=�@_�%�0s�B�w�j��V�~ٱ�ʲ��F\�rj9`����l�Ӟ�>Q]6��5TOB�3-���W+�t�]Y��S�.��A�W��׹�]��b
!�B1TK���"N��N:������.��d'�^s:�#��6c��
\ No newline at end of file
+-> ssh-ed25519 TqxOLw MSGLFTL4jNqyReVTMpdHPkqjO1mZN1ftRa1kTv4rgXE
+r7vxfFU+DdvuB85Va8WcOzp9eMLCzPKRgitbtGLoJ6s
+-> piv-p256 ewCc3w ArfjtMThbtGOwv3GN8/xAEE781PMI9G/uNdLPj4yQa1d
+FHIMj5RdgDlIUeAsJBrFvRjyq5LwfKuF08ghGa2BrKI
+-> piv-p256 6CL/Pw Ayg56CBqFZMipIJCq8NXvCDCQIQpbCrxSAaPWQ2q7BDA
+LsVaUDREKkrLwIgQiBv0PD+kB6uiC25VXIMAura4gUg
+-> ssh-ed25519 I2EdxQ 8vfUIrlZ4e/HzP3rAkE3TIY1tH2u850MwgPQqeCPojA
+y4991Pjf+9rApsL2MoK2l0I0yydQyPym2g8Zo5EG50U
+-> ssh-ed25519 J/iReg 8aJ2MDGKZEqBAnvGvNcRDde0XczjYiS4aBnFCLehsBM
+yJoApClOJ0Mpqgv5Ihjy1KsRBEGeP8sHai1kharpOwM
+-> ssh-ed25519 GNhSGw DPBFDTY8UjUEDnvzfJgsd3Hcv2FSwPWSOa3UI17jqDw
+EIZJAChKMbFqwIvWTevLkp7R07APHgGmDpakFrumX/A
+-> ssh-ed25519 eXMAtA 4xW8qx6kNq3ddoZFug5Agpm+u9yvaDYdAU/9AFl9NWU
+gOCOoS8Ji9O/JkVc1a7RMwtPRH50bxzfCD95cDJa+MQ
+-> ssh-ed25519 5hXocQ FdFkeqE5VZiIVXuxq/1paUNSHpJDjH6NzD4xxGjbvE8
+V3WJhTTGZGgZLWwdRQ4FvqOPrWTvLvKr1wzEhdMWTNM
+--- NDLdqsCLFEeJuhtmXbwCjRsO1vyrzRE3BkFs4N6eVkE
+�]�l�'
+��������-����%�,���6GDPY ��
+Qt^�;��!%o�b�����������q�U���V3Ɨ�݊�J��v�?�qATT?x��=`aE
]���4�%7Q��٦��.I�7a*��"�M�����`M���P�
\ No newline at end of file
diff --git a/secrets/vaultwarden/env.age b/secrets/vaultwarden/env.age
index 9153b3c..fffc8da 100644
Binary files a/secrets/vaultwarden/env.age and b/secrets/vaultwarden/env.age differ