[ns1] encrypt secrets with pubkey

also remove my previous comit

machines/.sops.yaml

@@ -17,7 +17,7 @@ keys:
   - &machine_vaultwarden age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an
   - &machine_pretalx age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
   - &machine_albert age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn
-  - &machine_ns1 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+  - &machine_ns1 age1mam7y7x4my6g8yt8leze3pvlq0fr48hdsqz62gs7l9rstf9hh3fs03xf7n
   #this dummy key is used for testing.
   - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
@@ -130,6 +130,7 @@ creation_rules:
       - *admin_kalipso
       - *admin_kalipso_dsktp
       age:
+      - *machine_ns1
       - *admin_atlan
   - path_regex: .*/secrets/.*
     key_groups:

machines/ns1/configuration.nix

@@ -21,12 +21,10 @@ in
 
   networking.firewall = {
     enable = true;
-    allowedTCPPorts = [ 53 22 ];
+    allowedTCPPorts = [ 53 ];
     allowedUDPPorts = [ 53 ];
   };
 
-  malobeo.users.admin = true;
-
   services.bind = {
     enable = true;
     forwarders = [

machines/ns1/secrets.yaml

@@ -3,52 +3,61 @@ sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBadURpbnpJWVl0cG5PMWlt
-            dUFGTWp0Q0Naamh0NmI1bTdDc2JGVjYrZmcwCmc4aXU4SHpmMlZtUklhODl2eDBj
-            THErS0JubEFxQlhxdVBOVGNuanNCUE0KLS0tIFpwU0NqRU9DRTc2dnhpQ3J4S2Yr
-            MXpoUHpEcng0TWNGVEphNEliMitJUEUK4nkg0jviVZR6As/xdWBysJyQuU2uDzgC
-            Zsq1QVSdb7EZPcxb12Xb6GvazsKZGxztn5jgzaGDb1HjA2UgIo8lgQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZa0ticWhrdXRNa094MEoz
+            ZmJiYTJoSTFHUnFpakJuc1NCTjZlN2kzazBzClRYb3B6YUozMUxFY09wdHNsK3No
+            eWVBSUU2bUd5M2Z5WjVjWnpxcjFBTHcKLS0tIDBESUtRQVkzRVp5MGYwVER1aDFE
+            dGl4bXlDTkhNVWM3R1Y4aDVabnYrd2cKCuLUw7SP/pyDJbmq/ADRvH7EfDVlYItW
+            rU2b1KTyI4JpVK6/OLN2leSioYzqiE3ONewC9CMMrluCWwNEKmLiUg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1mam7y7x4my6g8yt8leze3pvlq0fr48hdsqz62gs7l9rstf9hh3fs03xf7n
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGaEV0WkI4Y2JoV0IzTlNj
+            SkFGVTQ1ZG1VNzdtK0xTWFZRS0FTY1Y1MlZvCjdhYk9UWWtUWC9MNUwybVhZSzhI
+            bjhydVVkK01zcmZZampEVW16L0dWRzAKLS0tIDhpK2YrTEtPYmVsUHExdnA4WHRa
+            Y1JUT1VQMmdRUnl1b0NGOEFsNlR1VGcKOR35LVxYuGw8HOWwQ+ODN9y4I9FHq3lg
+            1vDrSI3JBfRuU2G/OXbkV6bNPH9KnzgXxUEOWkZmamrcwtIGldfh9Q==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
     lastmodified: "2026-09-10T15:02:04Z"
     mac: ENC[AES256_GCM,data:Ykr0571wJjFij/4j6aIBXVOpkyU6jCbAdnjvxLQfwrxB25CgqaposamrFJVWMKXTHhjD9cyERuApAglIcDmgfDAE7udeE5UaQDTPzTgxSteDwr8t1Ln7D5nQ2euPZXqSEdEUYTvQZSufr47x1jHBdgpcsm2xjBQijRh5UtsuCzc=,iv:H3PuuKbdEoEq2Xrw1NuYEZty99MHCcHRZHAhRFgmrYw=,tag:s4vBcEvL4A39PLNInXknvg==,type:str]
     pgp:
-        - created_at: "2026-09-10T15:01:43Z"
+        - created_at: "2026-09-11T18:55:59Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQGMA5HdvEwzh/H7AQv9HboIa8736BJypvKq+kj4wIoqAC4cihodE1xbF5lVrN7l
-            pYXGmAH9fbfK2vTz2kdiBhcFOMgIJ2VEzefDwxtOG+vp+YMHPnFJwsj/D1iwPPoj
-            TPUWLhRXVw5HO1bNBqHoOZJPoZszdRQxkQ4OoiBRO5G+o8f3hIUjriyVym7N+Eu3
-            IGzMU8/RBqJKIqft+jnp3uEZqXGWwALisyFZiQmjZqifaGo3YwOGMGHcjvs3bZws
-            jSkvMHLoJQuwBeWmIJ9mCnI0AQ4kLsLqmgtuJGxWW/I+1kZ9lY//STkzxBzTESwd
-            IOdlP0LWybzSia52A7OLgpYZuLLD+lDvunzN/gqm9YKJcwTxTHnp2wLmoJU6KyL1
-            KnXyLWuQi5xaPXjVvhVYWjkqZr+1/nGMDSZJRxdCSvipCkJF2L62pzqmuz731AA+
-            cMyoPXGTH/fz4P1c/hRQNG7tGax6IgSJMuU3OZxm22ZDAfQbVKIDk35WxP7qotbI
-            IgDqArGJ1qEhFj+OAvUn0lYBxmbDTEFkjjOGhl0YoDQhxbtLasYykdC0pkAOQbN9
-            Mclk2TXYXbr6mdB2uzrtSTojV76birSH29F7Fp+D+EShA4hbZix41Y2oEZBWGZd5
-            Po3yVsfOvQ==
-            =wSya
+            hQGMA5HdvEwzh/H7AQv/cD7baU+5Ujkrf5jUdn4HSPtVW/KkeW0Mw7uQmd7bI5sp
+            n3iekWWTOpCv98lNdCMXn+iV1BL37ILPOYSXsjxw2vfKjGfgWkkwpFdcLUiS7Qnm
+            ymGVIPyqHDJRqhxxhiR5B1aC7AhR+otkULNzKSSgYZa+Rj8DlFwW07aknJDSeZM0
+            yy70RTxCGgH/4amYZN+QLOJapjGX4FMvJeG+y0vv65GinMmjkQ7B5z3rKUiKbud8
+            mjPgMIfxcBo5o5vepld315atoZQX+kCIgJPU3rQshTobgwQD+uVZo/ocGHVdZWra
+            eVOpKZYO4ecQJ8xRvSMNSrXRmeW/a6h7NhHN2kD74Ms1xB8cuhYklCz8gWd50yyo
+            7kTG8wBPnvvkx4SSgFwvnj1hnppUweFUM64JBHXrjQWeDof1FPC18kiNTAQGwAOL
+            UiI4Yka0d1zLl1vpdBN8E17jBqfi2CSLB9wL3IbD5CTYAprzzvptfXI2Ubqq82c1
+            Np71LvSaBYA4SPNJ2EZB0lYBtkjGzUw8L9Kuod5UwXTeJQ2vbhpYpqHzjWrmWvK/
+            VlCzVV+AYfOQUVvmbYf+DtowO/wCS8n2gVepyOoMCcEnRT9lqm7ndC/ozt+iZove
+            vDcSGqKuUg==
+            =oEsA
             -----END PGP MESSAGE-----
           fp: c4639370c41133a738f643a591ddbc4c3387f1fb
-        - created_at: "2026-09-10T15:01:43Z"
+        - created_at: "2026-09-11T18:55:59Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA98TrrsQEbXUAQ/9ECDAkME8/ey+CfxVm3DynkSzy0nLAXVaR1cT3FPoxM/O
-            XJK1gDooVdd/zqvLCRAHIpOdRYcqifnfTRUg7RQo4wo5u6XNnWstf5Qh3ECSunkP
-            s8axVBrYKTwUN2fa7Kil57wSARGIyguufkW5l/Ur5pAJPAEG+q156o/vNNG99XQ9
-            PMffjfBV5Hdm2jljsUndz/Y8Qo3ES412AtpokjiK/6r/JLM7s0yNktyApiOqg2Co
-            RiMKrxTaBucRXMy9IZgqNetc5Syg/y7ZWhtnSvznGN3o6lWq7aqi8PsEzpkb7DyO
-            hhOs5KSvR1+LomOHQvNaSgwKgy8IfMQAde5U0thcavYLvmxXnuN3z3u9mBF1WHqm
-            6laktFM5u9FMLuQUrlYnU9LXakD5ycVEnxEf3+BHRkabatv/OkT+NzocCbydFBEP
-            zuenjVUxb+tJWb/GDIXj8sa6/VCNPwZ04DR6TLRgY9CLSBZ1WtqNjOCi47NL9we/
-            If5/JtBf0B9nWsVNc0XaVqKxHcOLAg6rdnhYl9+QUZtQfVjZXFNGQQhCFhVOCnD9
-            h7vNysHZeOpVT2kV28DhmpO5t5IBTPAhiflGlQJT9UYaLQQf4TroxI/YGFa34qsc
-            Ot8KxvVyw0FtALa/AitdQc7DKv9LBLHVPeJXwOZvzni55Uj8dDs54aHIvqLYA9nS
-            VgFL5a9vroRpmtWYK6laLfhIViYr163GEBIPKlyeN3Ze+Djw8mbf++K7gHrF1KF/
-            7Ycgco/LP3/jrJVrcLxkVRbS4ICIJkg9JvhqAcEjDuE2nUn+orag
-            =qHPq
+            hQIMA98TrrsQEbXUAQ//fciJkmAmvlAHzZxO2CTCFkNNn+aSpkH/IoNRKfEIJDtf
+            wAChdactP8yq6qKxSqv3Ks90K+hQRQr6tXpF652NDFYkP2CHsEo0wbOAgcqFzGtY
+            92MenPwOKP6B9UTvm0ZqVFet7/jmQBatXMzFWsSkUCBqWXAg/UUrJVf/zbGoHwB7
+            efskMTrkArlxhoY/3+/0bMeEqZJlhm9UmlAST1/xNlI4DUYhlBxnzA2vgi8QWBFT
+            6+QkZ2YiM0IlDCUbe920c1ad0/McV8Bj6jccW1ZBISXk9KYQq41PBjQKhyKoC/Xc
+            xJLcxy1NeUZWlPSFF05TTWaRUkBH8YZm7vum5xWdT1lz6FrHB+aNHr9XxKj5c7pp
+            bLAQ2PfG0kK/kemNBKd9/Q5r2SfEUbmI+cGLbqkaZwbhD0ThMmEkMxdGwzzrf2Wq
+            Lhpkj+2zx37r6GI8UlBp9jhUbhj1N9HetyjBhKzEcxqCEg4DXNiKRiXvMvCg6sCz
+            kIKsmNDhbmt0jKNL8NJio10lo4+S2gPi8jg6mcj4RDkS8zC95P/EHkNZl2aQwBRU
+            /GLzzpODa41ZZB9+WC68vMZudSQwHK0c7SNoEc5putlbUjKDSpJHY4manF6O4rG2
+            FZNG8TA8VeEg6wjBPkBw5ardM//E5r0iFfx2IjrCjhNoaknc5aPRZ96XqY/5TqbS
+            VgGRpWs5jaQv4CbRA0yAHqFrGgSRFY0wCFT5Hkwi7wyGyxR5Y30jISsn+kU8ysHV
+            OGZFCDl7tRvL9ICJheXWS61k5LNd4H8rAMqXoPbSvtU/KC/hfRMk
+            =ZdHS
             -----END PGP MESSAGE-----
           fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
     unencrypted_suffix: _unencrypted