diff --git a/ops/secrets/besadii.age b/ops/secrets/besadii.age
index 1b8ef6758..f52f82449 100644
Binary files a/ops/secrets/besadii.age and b/ops/secrets/besadii.age differ
diff --git a/ops/secrets/buildkite-agent-token.age b/ops/secrets/buildkite-agent-token.age
index 48b6d7a16..2dd137e2c 100644
Binary files a/ops/secrets/buildkite-agent-token.age and b/ops/secrets/buildkite-agent-token.age differ
diff --git a/ops/secrets/buildkite-graphql-token.age b/ops/secrets/buildkite-graphql-token.age
index 2b3c2fc43..dc2a9b7de 100644
Binary files a/ops/secrets/buildkite-graphql-token.age and b/ops/secrets/buildkite-graphql-token.age differ
diff --git a/ops/secrets/buildkite-ssh-private-key.age b/ops/secrets/buildkite-ssh-private-key.age
index c8ce1a154..2ebb315ff 100644
Binary files a/ops/secrets/buildkite-ssh-private-key.age and b/ops/secrets/buildkite-ssh-private-key.age differ
diff --git a/ops/secrets/clbot-ssh.age b/ops/secrets/clbot-ssh.age
index c24f8f45d..9c7038972 100644
Binary files a/ops/secrets/clbot-ssh.age and b/ops/secrets/clbot-ssh.age differ
diff --git a/ops/secrets/clbot.age b/ops/secrets/clbot.age
index 2cec1f7f3..f36387192 100644
Binary files a/ops/secrets/clbot.age and b/ops/secrets/clbot.age differ
diff --git a/ops/secrets/depot-inbox-imap.age b/ops/secrets/depot-inbox-imap.age
index 9bce1845c..8104b12d2 100644
--- a/ops/secrets/depot-inbox-imap.age
+++ b/ops/secrets/depot-inbox-imap.age
@@ -1,15 +1,17 @@
 age-encryption.org/v1
--> ssh-ed25519 dcsaLw cpeIOVtFcfaHZpIAp495fkQLJoT++h1v6p0crBeuzFM
-+zomKCg7UVNl/FlfcZflVPbo48C45uGoGoR1tbetEdk
--> ssh-ed25519 zcCuhA loSmQUCnO0EBaGg+wFYYkXOdLBQ6Z+pPl4Y3oGx6xzw
-+RdXNYYtIDDXGr1Z0Mh28psvF9gzg12M3EJTUqmdFtU
--> ssh-ed25519 CpJBgQ 0W0LWu8WW6pQzUhK21CeNDUtW0srwR5gNCRjwTy94B4
-A02F+AyP+DajnVTJakx+0jynYRDix9I/9uZUDPjXpis
--> ssh-ed25519 aXKGcg SVBo2urAYGSYrlj3ieoi9nkrffcZ9ZroCn86pZkn4nI
-xQRrLNeNcI9cpQY+X2xfLDoBqLNQixGjaYtMDWtHio4
--> ssh-ed25519 BXptmQ UKNJPPjIiqPQndZ6/yASSg+5PQIn2N9nUy2hQMREq1Y
-X9zM/ji9R3jLOEDGLpIVESjU13VU0e3cTAR1xEMhY5I
--> B-grease Y
-vUOYknqY0okoUOKZD/8MpnpwkOU31sszuUZfeSVsuVyUMPEbFjWQT74
---- ymKMaoUQXFPRc9U0ZvULBEC0Az0ew2oEyHwH/kR9ETI
-�
Eu��	���x����e_)zP��h��������s��G����BLQ
\ No newline at end of file
+-> ssh-ed25519 BXptmQ Vs02ZiJLNF5EFwROHDRmK6c63B+i34O4iUe5px+ylVI
+oAlTA+SCuWdg9GDRRIAzZ8dzm1CeJ32v40i2uuCUBC4
+-> ssh-ed25519 dcsaLw 60SJdc9bFol7lRKarzH/0SSHTdvOafJw7LM2Ryg9ORs
+nwwIlne48VJ1Pf8fen3Nw4Z39d/4aU0HvlGoCtiKhWk
+-> ssh-ed25519 zcCuhA sZSaSac/2iB2RoNKkD1IRDHW8efafmfWzHg5zp/680E
+HndqDG6ErSmrlpY08HoJ/2O+xeNRTqhdBVP1ZwfokfM
+-> ssh-ed25519 1SxhRA 9AjHrUjAr3O02Hsv0Opx9ge5bx8qA/Kvra95Kz9augo
+GZOL8dR+36ObR+fPAOzp/1jyuVlgcakQhQ7ewbCo3O0
+-> ssh-ed25519 ch/9tw Qjlt8WTWe77gz37/oIK5pwpSL8rOic8vZ5cFFeIaqng
+h7DbM8R/hQzaVgYx+PS7p4RHYtA0GTpF/6/Y7gdS9EM
+-> ssh-ed25519 CpJBgQ RIQKivyWL+MG7E/IgmjOyU4NEWqI6cxD+F1tZ62fcgw
+Lz/XRQ2UHT1RGIZ2HS/IR/rYdR+AynaKIkhml/RPRbA
+-> ssh-ed25519 aXKGcg pMzqW01tUgywYyKTeiI0zmlM961kAf4R4OQdjOlmKA8
+P//iqR6HJ0eQodv4F/4kVDzVUwJztsbfrxqonJa1aQQ
+--- /vmQh4qM0gBaIDcZGNKwsHIKZYJanwpqowpjuke1Q1E
+˧|H$��^8&�z.D
j	���E��/��nA
�2y�l���%<���6�
\ No newline at end of file
diff --git a/ops/secrets/depot-replica-key.age b/ops/secrets/depot-replica-key.age
index 5e8ce94d5..08d0ba3b7 100644
Binary files a/ops/secrets/depot-replica-key.age and b/ops/secrets/depot-replica-key.age differ
diff --git a/ops/secrets/gerrit-autosubmit.age b/ops/secrets/gerrit-autosubmit.age
index 2e04be952..344806035 100644
Binary files a/ops/secrets/gerrit-autosubmit.age and b/ops/secrets/gerrit-autosubmit.age differ
diff --git a/ops/secrets/gerrit-secrets.age b/ops/secrets/gerrit-secrets.age
index 9ad123d57..96434ba3a 100644
Binary files a/ops/secrets/gerrit-secrets.age and b/ops/secrets/gerrit-secrets.age differ
diff --git a/ops/secrets/grafana.age b/ops/secrets/grafana.age
index eef349d64..d69f61ce5 100644
Binary files a/ops/secrets/grafana.age and b/ops/secrets/grafana.age differ
diff --git a/ops/secrets/irccat.age b/ops/secrets/irccat.age
index 2002b15c4..43b73f9b9 100644
Binary files a/ops/secrets/irccat.age and b/ops/secrets/irccat.age differ
diff --git a/ops/secrets/journaldriver.age b/ops/secrets/journaldriver.age
index c58773f36..16f00ed8e 100644
Binary files a/ops/secrets/journaldriver.age and b/ops/secrets/journaldriver.age differ
diff --git a/ops/secrets/keycloak-db.age b/ops/secrets/keycloak-db.age
index 54194df18..a2fe65500 100644
--- a/ops/secrets/keycloak-db.age
+++ b/ops/secrets/keycloak-db.age
@@ -1,15 +1,19 @@
 age-encryption.org/v1
--> ssh-ed25519 dcsaLw tWBrwZf6FNYAHRjoVV9/X6gJCXPqxZSoA01dvIrIOzg
-6W2A3smrrosM3sJgl5CT9vkCWqVKR3SaSxWS2nnwKJU
--> ssh-ed25519 zcCuhA IS0OcHfEfb01xe+FJUe1poruK+uuP0MaJpeoGYyVAFY
-eEzcEYcW4KoKZZUEH/ha1nn9NudeK9HgPRgmrCWMjug
--> ssh-ed25519 CpJBgQ 4mjCHMHfnGu2bhANPBNmcrZQrKBcPgZU+ll8opmvGCk
-0+Vd6pRPovUcKa9i37JVU/DUeYAmJ9D88MR4flA8gY8
--> ssh-ed25519 aXKGcg WGCgCoViKLqndC35OTaExqZlPBDRwXRBJFuS7fw8n3Q
-kUHunOUgIsxXmOzMCwUFF/0dYiae8YZGmgZaz8gXPJo
--> ssh-ed25519 OkGqLg LLIDJkImcqMjwRitnGevcav5YjDwYsQ//elx7fgbCQ4
-EnYTppSr/GKug9T+bFLGxrxUnNiXD5ODhB75OcH/h24
--> j@-grease @:arA
-8EFNz7i8N3gbZEMaQw
---- RkHJIg9pif/R47lgqrZD/XgkTETxXWkwW9QnFFsmfOA
-�o�]�~��6�+j�n]�l�+��K=ʽ	Z�p9����R��zVg u2���_
\ No newline at end of file
+-> ssh-ed25519 OkGqLg 85hbcQ9r29CC95B1CXO+uftm7ywhTeWCpklX4hOc2gU
+7EO8O5/eg1noB8nbl9XL+m8WAvLp6QnA25CiTsp5jfY
+-> ssh-ed25519 xR+E/Q Hefp9fWCq9sWdgyKp3gNEO1p9yWFK4sYX8xMxkyy9G4
+JXofip2LGkJFDBb+6DegoFGDPjk8FGF+AqaAy5FPqwk
+-> ssh-ed25519 dcsaLw IUoPTD1SfnY/wXXFcIc6h47fea6ukWAurUmfqwTQOAs
+G/YeKUk8IQXBQ1q8338HxUg2vXqmh8LOIHSX4Qn1CFo
+-> ssh-ed25519 zcCuhA 2LrAbe+Jpsg6gFzbnx3ppDesbQSWqzHs2uOv9szb80U
+idJNMv6Lf0k2NsfOcm7it8LwPYxjdq7+LS7PUzQ89Qg
+-> ssh-ed25519 1SxhRA idcz/kk9WyIA4I2NwzzPiMX0AmXkV3FTHxoE12n2eWQ
+e+4am77QT0fDv9Xgci4L+VsgFyKT4ZHjB0FWe76hV3g
+-> ssh-ed25519 ch/9tw RNZWeD7W18wpcpBksipmib6vhHmaCP5iQeK4uLHU604
+bH/PJprw6+jEktmPnS3OrGMtJ/XHYVZQoQRdReLkLYM
+-> ssh-ed25519 CpJBgQ w9gTapqMBoJl+C4sWIGIDCZpemRCEu1iDUUWFt2rW0A
+1nYU4UiHYT9vPASYHwunK2Td+acAmjzRpFpLioNneJc
+-> ssh-ed25519 aXKGcg evsnA8cq5xz+0GdKT7cBZWckBpX+w05yLOOaOL4+0BM
+LigkUyewAl+O0KBKuykbwKzFTCY5n6lnCcarl2Vu0NE
+--- KhA9LmsAYYPMrJrsJYZyEq04LvrMZkJaCL5Bt5ruYD0
+V�O�{$���[�n��G7
/�g�0���qCn��9�í�(g�􍨮�b@�
\ No newline at end of file
diff --git a/ops/secrets/litestream-glesys b/ops/secrets/litestream-glesys
new file mode 100644
index 000000000..27483986b
--- /dev/null
+++ b/ops/secrets/litestream-glesys
@@ -0,0 +1,14 @@
+age-encryption.org/v1
+-> ssh-ed25519 dcsaLw 1vQZwlLz6KEyzNB7mtPpw/V3587IfMfyzTbo415W8l4
+eHrGv8UAlPHGrz95qerbeKALKdE3WAsgaG0iApapw2s
+-> ssh-ed25519 CpJBgQ OM8rXUX7/e+OUMzeg5l0/4iDpN83E0bizA0sSEQ1Bik
+Rv1dgo2nWNFp1RtxJzd1Bs/rSVJlQuuRRcfabneW54U
+-> ssh-ed25519 aXKGcg Y5jY0MG1AkE3QnUSbVgpo03ZmjisTEaE092001svumY
+yEfLoBPkq3c8svnRSSRynvePXel3f0ExxWiMlZOQL5E
+-> ssh-ed25519 OkGqLg 1MKnCM9FC54nDkjKvOyrbv5PajZILWMGyZn3etmvHm0
+ZZKJ3B4dVK+zs05o1TWdnG3nvsgWyCncblVq1jB9OsU
+-> tTdCE`G-grease V<"wt`:| V^yWF$>a ]0K Z)k|}v
+ZpwiZsQkV71PhB/NRKrwFxu3HlJkerPtAjB5TintCRjogQlfB1DQTv47jnsui4hJ
+
+--- v9cVC9zi/w4pqGPUtc3jrAg8sMHtlPGuXyDIimEQpok
+O��ϔd�mn��2|�[����u#�I0^�����#\
2��!*�j����ɤC\�)Q�i2å�|ku���(a��0�������"t�=��5���b�������p��U����f�C{j����H����r&�M���/��k8K�pFh:+ 0���ΣA8w���ńD��7����]� p$.5��
\ No newline at end of file
diff --git a/ops/secrets/nix-cache-priv.age b/ops/secrets/nix-cache-priv.age
index 47d185b9f..21e4be4c5 100644
Binary files a/ops/secrets/nix-cache-priv.age and b/ops/secrets/nix-cache-priv.age differ
diff --git a/ops/secrets/nix-cache-pub.age b/ops/secrets/nix-cache-pub.age
index 97a09f1eb..fa63dea94 100644
--- a/ops/secrets/nix-cache-pub.age
+++ b/ops/secrets/nix-cache-pub.age
@@ -1,19 +1,19 @@
 age-encryption.org/v1
--> ssh-ed25519 dcsaLw ZBYqyCd+eJH8b6nuG3Off01ZRz+C8wBlXzXsHtKrPA8
-6xsUZDVJ+gsKW2XdEdRUlQv6enO3lSy7pfydhAhA2UM
--> ssh-ed25519 zcCuhA aYLfg5xvfDAL2fRCd/cKaNAf3nuMUKqkqtLQyPN6elE
-vfVIu+7QKOzrmZ08drUdBYTksaT+kHbj7kVxl5QPb9U
--> ssh-ed25519 1SxhRA x9YVX3XS0BNy6uWPACM+Q6dNY2/Grn4gBAZt7ZCc5GQ
-m7KFpWpsM/5tNeFgPQb6VosYJv/IJES79H3E5epvvgE
--> ssh-ed25519 ch/9tw MtZL+fIC9PeF4j4mJY+oF3KurgBtIrjP2Cnga6VV/Uk
-wGMsl48+SDfskXjtsMRheWvelDON6pMR288GAKhY2PU
--> ssh-ed25519 CpJBgQ ICy5pQo+1pEXDvvvCHJahEnt8P0Ws/KSLg5eruNNS1Y
-JBds2McxDga23lojtVlm3QFav9D/SnfO14RCkz/vy3o
--> ssh-ed25519 aXKGcg sO0sT+XRpZ05yn49HlPYHQi3/wrJ7dpy+S7L5HJjCVY
-ZDMWrcYhie2tzad5qPuAU1E978LVLTkQGb1rrjWsxeo
--> ssh-ed25519 OkGqLg rl4dVxI+gUNyjdrQpRpAV/7HHrcY6sT8a/mxBWidmCM
-HCF9eR6GstX9FOHkTpTU8oulphwu+LCbsr1NyWktWPQ
--> ssh-ed25519 xR+E/Q lhTKIL2kGhR/de7kRShGCHMRsZVPlXfGxaMX3Q1Op1M
-fYiPRboq/bAsbtZQfbS1zlV7HjxeOKwFcafZSDETpdI
---- /UN5QN0v3yyH0Vh9tv1u8GXnBX9j8nTkzezYVIXK+ds
-���L���tYS�̰�۲�2�Eqn�H��`�-��(�0}۱ʬ��&ٯC���L���#.yM�yw��y�9mF����Qh�L�u
\ No newline at end of file
+-> ssh-ed25519 OkGqLg +GawUpoCoveZOVr8oFF5Cx87JrHB/DLk8+ctBYy3mGs
+14pGg24B55KpO0m0Y8h7WaXswuXN3fYOklYJpUNlO+Q
+-> ssh-ed25519 xR+E/Q PamJ1jmdaXA69yen2yaiEYBSOzemjMK7CJtvqHIF+l8
+4fm0atyNq7lGXKBJBe+qj04hDZyMv0aLAYB5do04p9Y
+-> ssh-ed25519 dcsaLw 2spxBNvNgrfRRFmw4+3qOXJRyOSpqIM5LjWwxw3nKXQ
+bkUj+mwZIGH8ollRJ4Fo0m/d2SjYHvtJ+XQZ1UyYoJM
+-> ssh-ed25519 zcCuhA b0thXNRODt5ex8V8nhnsRkTV0tJIKYLTOstdla4hLSI
+BRqHrvCRVua/GeAm//7lTCcvUd5rnfUjp3y7rlVYlck
+-> ssh-ed25519 1SxhRA JMqW8QVkIYI3EtOacMpdgVJ6bLyy6OmVCsTpN3DlpyY
+GbIpKf+cISO6oOVEZPvv1pcvHWsEb/N1Xi+Ir4EGDJc
+-> ssh-ed25519 ch/9tw +ysMVMAXfw1cL0a5JQMEoKA0qc3YvAnk+/OzL4ObCiw
+eBpIZy1M2jvxfZQcxiQj3xUSd2xRISjp/EX5v2Opoac
+-> ssh-ed25519 CpJBgQ oII0q9KXaP2qbQ4uvDHCwNURojZVV9XTuR/oh33pPT8
+lv5XPdZ6Jrk2+RQKgq585fLN88Fy5daslIzrLX74VR8
+-> ssh-ed25519 aXKGcg fkMoxXoGVVBb9Hw1hpq42cgEimgitgdm2MeLu4zPlFA
+KV3ZcS87HMYikFsDZMLYfZn3oANuhziTB/WQOS7BZZo
+--- yQHOSIohfnwePFQjAJjRAPetIbhhdHlGEdfVZ1TKmso
+A��y~}��}�F\�?�Qo슴<)��
�/����O\��5}��`�C��"��O�ʺN.(�=o���EP�p�������>�сm�w�r
\ No newline at end of file
diff --git a/ops/secrets/owothia.age b/ops/secrets/owothia.age
index 177ee6138..409b5a042 100644
--- a/ops/secrets/owothia.age
+++ b/ops/secrets/owothia.age
@@ -1,16 +1,20 @@
 age-encryption.org/v1
--> ssh-ed25519 dcsaLw 8XtdgZ++/ZqmK4j8CO8oiuskTxjvKhWDK7fet5hbqiM
-Fs4O1vFtQL1JamnuCMPLzfzRPb90nxfXB6OXkyCMoHo
--> ssh-ed25519 zcCuhA 6PNsPMdRXM77ci+mBQNRxr1oMGDNdlQilpUB0Q5es28
-APw2L/0htM9U0fJ1IUthdkoem/UTM/6NNQrgn4Vmpcs
--> ssh-ed25519 CpJBgQ ed00il0q23M+3KH6hf5fFPaXGUKcz03Bn01jSoKiB1U
-jEN0Dk2edJBQreAlNE11sx0cI5u1mfFDT11Ev0KJ+gs
--> ssh-ed25519 aXKGcg NocBhG6QGlWDZhjsA6Sxvjv9Gs+3Pq5gcOqnVdiefBg
-HYnqBv0pdPz8bqgZ98VDfYFeKcFNeuJrlOsyWt551Sg
--> ssh-ed25519 OkGqLg e0081m/IkQafXh1gAWUZ2glYG7bklCG/LaUy63rK6gc
-G2RNMxCxRnqocYhiq142T8EPZQD8cRHHs7AHKFrMLaU
--> +J}@hPk-grease
-406BMfqUt/KjayTopj4dNa4owPZphR6AsBXPurJwU/zV9ipirfW3oEeaprdh4uLg
-RHO0bSZQV1uu1YmbXkuwMaVj1cVn2vsDPEv3xG2SRzMoEpAAKaFCBba8
---- 5ncLI9pS25vz5CebIZjPPDQ5cHISlyRFF55rGgFQnnM
-�$"�PK�&C�\�(�G�[��(
���D��lǺ�8��4��P��)�������B���Լ���c\�U:���(�
\ No newline at end of file
+-> ssh-ed25519 OkGqLg V7q6p9/JpvhDiSZelm6WUm7K8k1JPiG881M/CcD61j0
+CyWBMz5f2rOS3nyASYoNfRUyGdk4z+azqWca5Sm+Rn8
+-> ssh-ed25519 xR+E/Q m5zf52PK6k9d1slMbFi1kLHzjcwPTvS/pxpLxFkWEh8
+hgBAxWxRSoVfL5+RUcMW3+H09HpZRK9UYKexgwqCJVM
+-> ssh-ed25519 dcsaLw eoA43fKH9hP/rdX7G3Kk4nBeqZsqIZK5WJ8fOFz93Hc
+NaxeAjxHL7UnoWEYpCWnroe0VQVz+TdYxFhzgEJvCO8
+-> ssh-ed25519 zcCuhA WKauLNBLl2IazpVCfYSIdR7IHouKrUUPRNbso0f5dG0
+ixod/zrotKIrVKTWAvo0bebJRuIeKbAkrjM2sF14R2c
+-> ssh-ed25519 1SxhRA uhklukoJL+Un1OLTjzu4/tW5FlnI5PxHmqkPEjqqbBg
+DPiA5zqTUlTdagC6gaz/vlEWP71DCEVWB5DWw1s61GE
+-> ssh-ed25519 ch/9tw Oml7do+MW+p8DYOyEazBjbdKNSSUUTAMPsr44xr5Zyk
+CrIGkD6qJYKcYLaV2yOqaTzlPjGUZ5dTjOQRyeDJ+C8
+-> ssh-ed25519 CpJBgQ fVac72oIPKjTYdnWD+g0AmpioPwtCo7AH94DNroyB38
+1Y1CBtJGgqYhXWRst0vUlcUhV3wQ8ONgJd8P3JbcOLU
+-> ssh-ed25519 aXKGcg G6ic4O1dPsnWSntXoK/85BdyMkeRb9sp9eJwuBShJAc
+AyXRzW7Mn3zB96SiUpaX/gnnbbO/2AszySviul96xNg
+--- gMS+evsP3XoJC1Zo8AWqNoThdm6KQ2ZiU/+/DWfB5/w
+/��b�U���N��y��݃)��`�a9s�D��#t�Ы]��	7���k���1C��"=��7�\
+C%��$a
\ No newline at end of file
diff --git a/ops/secrets/panettone.age b/ops/secrets/panettone.age
index 0be42dc0a..7fa47bf39 100644
--- a/ops/secrets/panettone.age
+++ b/ops/secrets/panettone.age
@@ -1,15 +1,19 @@
 age-encryption.org/v1
--> ssh-ed25519 dcsaLw zzUe0JqhICtd/kgZnXFpwaQ1Ma6nqy/hMWaOJpRHmDs
-4cR+OnWShG6MpB/u0yfsSxplEch7x7DbygfBiJGxOOs
--> ssh-ed25519 zcCuhA 0RZEYC9IuazO9fROalwoOCIgc0j+rNBP3gw7SKG0yEw
-mPRhN0hvccEr1A9ihWAFMH4/24vpBKpxBVq4BKBMmYM
--> ssh-ed25519 CpJBgQ VrmfTtTVxuQmpUxMxtXtCnr8pFyqwtdyLHdbzYrlKlM
-kHgEdPmoIOLnGuMF5F5Ol1yZWcactSE4OZI0BSmDN+g
--> ssh-ed25519 aXKGcg On4jwgsH504ZjYRwfw5oAfIDk3wU0+xgd43ryAn9H0I
-fayzht1ZPPiFCjuYTdwVtJu2nOUg4wtp5IipOR4oJm8
--> ssh-ed25519 OkGqLg mubp0xI0fvsKOAUaNaftFkHJ+bxgFHbgjn+A7sR8XVs
-X68Zr8HvC4/XPC0AFIA5f1SKu7NSR/23oeX8cW1qfis
--> ?`-grease
-hOy2Rwvk6+vXpHWWA49Wp10wKbw9TfsLXw
---- 9MLGx6BVm40C0CSV3bq6dnXrpy3QunBlh2/uO5OisUU
-dzG�<����Y�A�Vs��/-%�g��.�e@�,Z���F�W收&���<O�q@�>w�̛Q�>�-gǓ'���`
���X�ҟ�P8��x<RNv�9�#'/)��g�����m2���v��<,�7����邢��q���v���Q��AO�-�ژ�+g�c�#޵����*����e� -��)� �;
\ No newline at end of file
+-> ssh-ed25519 OkGqLg BEro34+d66EFK/Pt2zxpaT51YTaLeOPw6lhNIIZagz8
+Bx6cUI3Ga45MvZtTCSbpoXAaQL/gi7zQp/4vyTtToFk
+-> ssh-ed25519 xR+E/Q 7/gSLPTDl4F3LINdadlCa5b8MQC4y+p3ZYNlflxrdDw
+VK3WOVkKjola4munAfp0JMKYmnoLLIv9OHfZh9ysbkE
+-> ssh-ed25519 dcsaLw Ln1sLkvM+qcEkEhO7u+lYahwmNA31wb8/uxJJ9AVWDc
+aYTOrKKROC3giyyK+3oB2weL1OU0fognHy3KEMKv1Q0
+-> ssh-ed25519 zcCuhA c8s6YX+iduL0LROMQzOrIlyyMVB0glpO9fadGtnBtRM
+xKS+rami2JqtA3358i9ZmUald/l6RfZO3oYCXMGsaQs
+-> ssh-ed25519 1SxhRA QQhuhBCDNNRDjMwLXmdENnyQ8FLMGPPslz/n8HJskwg
+UFYbOrYp4Iv5bFGva60DoDnili4pu3ddQwkc6D7McWI
+-> ssh-ed25519 ch/9tw qbpidc793ukjbneLp9APflMGwUv1uz396OQHWDo7Ezs
+vqWqCraCcf7JfVUHXipXF4MIsWZJ8ctdIqlMQWTFVbw
+-> ssh-ed25519 CpJBgQ KUTLbnm2fGlMTBReyTkZ4vH+17rBbJEvNKMXEeKGcy4
+LyAz0fKXJwBleg078S4SX445hG9s/Wpowecm/dMVG24
+-> ssh-ed25519 aXKGcg /e2fcowJ2RNt70e2RuwSe0aTCTR7zX2m6EGWyizdvEk
+JWkvonXii+mquOF88RLyYTf/E/UDfvHrc8B6gptWkzo
+--- VJw7GLwGofsvJj+nlHgWDOnCud/Qjmjy9oeN15npnpw
+w�����{L�x���-]d�
X�@,��.1Ν�%�I�Ep��2:R�XN�U<>nl���?@*�Cߩ����h����
�4U��@���I�n�ā��J���%�-IH��뇊�.��������^I]����=����Pg�:�xS��с�K�ņ�I�(�5<%H�bhE�{�8�6N</%#���g`	[Y���������
\ No newline at end of file
diff --git a/ops/secrets/secrets.nix b/ops/secrets/secrets.nix
index bbebb17d3..cae95ce5e 100644
--- a/ops/secrets/secrets.nix
+++ b/ops/secrets/secrets.nix
@@ -1,8 +1,4 @@
 let
-  flokli = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTVTXOutUZZjXLB0lUSgeKcSY/8mxKkC0ingGK1whD2 flokli"
-  ];
-
   tazjin = [
     # tverskoy
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM1fGWz/gsq+ZeZXjvUrV+pBlanw1c3zJ9kLTax9FWQy"
@@ -25,45 +21,44 @@ let
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJk+KvgvI2oJTppMASNUfMcMkA2G5ZNt+HnWDzaXKLlo"
   ];
 
+  flokli = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTVTXOutUZZjXLB0lUSgeKcSY/8mxKkC0ingGK1whD2 flokli";
+
   sanduny = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOag0XhylaTVhmT6HB8EN2Fv5Ymrc4ZfypOXONUkykTX";
   whitby = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILNh/w4BSKov0jdz3gKBc98tpoLta5bb87fQXWBhAl2I";
   nevsky = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHQe7M+G8Id3ZD7j+I07TCUV1o12q1vpsOXHRlcPSEfa";
   bugry = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqG6sITyJ/UsQ/RtYqmmMvTT4r4sppadoQIz5SvA+5J";
 
   admins = tazjin ++ aspen ++ sterni;
-  terraform.publicKeys = tazjin ++ aspen ++ sterni ++ flokli;
-  whitbyDefault.publicKeys = admins ++ [ whitby ];
-  allDefault.publicKeys = admins ++ [ sanduny whitby ];
-  sandunyDefault.publicKeys = admins ++ [ sanduny ];
-  bugryDefault.publicKeys = admins ++ [ bugry ];
-  nevskyDefault.publicKeys = admins ++ [ nevsky ];
-  cacheDefault.publicKeys = whitbyDefault.publicKeys ++ [ nevsky ];
+  allHosts = [ whitby sanduny nevsky bugry ];
+  for = hosts: {
+    publicKeys = hosts ++ admins;
+  };
 in
 {
-  "besadii.age" = cacheDefault;
-  "buildkite-agent-token.age" = cacheDefault;
-  "buildkite-graphql-token.age" = cacheDefault;
-  "buildkite-ssh-private-key.age" = cacheDefault;
-  "clbot-ssh.age" = whitbyDefault;
-  "clbot.age" = whitbyDefault;
-  "depot-inbox-imap.age" = sandunyDefault;
-  "depot-replica-key.age" = whitbyDefault;
-  "gerrit-autosubmit.age" = whitbyDefault;
-  "gerrit-secrets.age" = whitbyDefault;
-  "grafana.age" = whitbyDefault;
-  "irccat.age" = whitbyDefault;
-  "journaldriver.age" = allDefault;
-  "keycloak-db.age" = whitbyDefault;
-  "nix-cache-priv.age" = cacheDefault;
-  "nix-cache-pub.age" = cacheDefault;
-  "owothia.age" = whitbyDefault;
-  "panettone.age" = whitbyDefault;
-  "smtprelay.age" = whitbyDefault;
-  "teleirc.age" = whitbyDefault;
-  "tf-buildkite.age" = terraform;
-  "tf-glesys.age" = terraform;
-  "tf-keycloak.age" = terraform;
-  "tvl-alerts-bot-telegram-token.age" = whitbyDefault;
-  "wg-bugry.age" = bugryDefault;
-  "wg-nevsky.age" = nevskyDefault;
+  "besadii.age" = for [ whitby nevsky ];
+  "buildkite-agent-token.age" = for [ whitby nevsky ];
+  "buildkite-graphql-token.age" = for [ whitby nevsky ];
+  "buildkite-ssh-private-key.age" = for [ whitby nevsky ];
+  "clbot-ssh.age" = for [ whitby nevsky ];
+  "clbot.age" = for [ whitby nevsky ];
+  "depot-inbox-imap.age" = for [ sanduny ];
+  "depot-replica-key.age" = for [ whitby nevsky ];
+  "gerrit-autosubmit.age" = for [ whitby nevsky ];
+  "gerrit-secrets.age" = for [ whitby nevsky ];
+  "grafana.age" = for [ whitby nevsky ];
+  "irccat.age" = for [ whitby nevsky ];
+  "journaldriver.age" = for allHosts;
+  "keycloak-db.age" = for [ whitby nevsky ];
+  "nix-cache-priv.age" = for [ whitby nevsky ];
+  "nix-cache-pub.age" = for [ whitby nevsky ];
+  "owothia.age" = for [ whitby nevsky ];
+  "panettone.age" = for [ whitby nevsky ];
+  "smtprelay.age" = for [ whitby nevsky ];
+  "teleirc.age" = for [ whitby nevsky ];
+  "tf-buildkite.age" = for [ /* humans only */ ];
+  "tf-glesys.age" = for [ /* humans only */ ];
+  "tf-keycloak.age" = for [ flokli ];
+  "tvl-alerts-bot-telegram-token.age" = for [ whitby nevsky ];
+  "wg-bugry.age" = for [ bugry ];
+  "wg-nevsky.age" = for [ nevsky ];
 }
diff --git a/ops/secrets/smtprelay.age b/ops/secrets/smtprelay.age
index 62fbaffad..d183b7633 100644
--- a/ops/secrets/smtprelay.age
+++ b/ops/secrets/smtprelay.age
@@ -1,16 +1,20 @@
 age-encryption.org/v1
--> ssh-ed25519 dcsaLw CW2Lgm0tSWUDwKSNSX/aLkVzQ/QeEeQgU3NITpz2D0M
-F7dA+zWdCz21s443bj9zCz6lBsRlFIxiG+l8CdbuPFk
--> ssh-ed25519 zcCuhA l8rsBoYDwhUB5stbeGXYTQ4Fz745ywXFCOQZn2cMBW0
-TycVcUZjR2TDv5DPC54+RwoU6Fj4QpRUJj1j0HM/JCE
--> ssh-ed25519 CpJBgQ CbwZO5LmSxd0HRYkf+lV+ymFcXSn/49GAPHG4l1I7gw
-xSmab5+BnAZF/B0n32xX1qZPdHgfoEMGIuZqlpnISjc
--> ssh-ed25519 aXKGcg Tr+odf9p1RBrQK1guR6ToeN4wG1KLA3jwiPIkgyEjws
-TaeCnjiRp8VZoMS5qs+OfVbBc6zudayD693h/eGvVOo
--> ssh-ed25519 OkGqLg Dmnsqz6PKzMd6w4t+l6+EWuia+stPwSEtu00KVuAojo
-rZ/i1WJhrCM/ZQTAroRRSjzUVJw2UJlPUe1uHYqSscw
--> w!^Z-grease i86O2 i0.Rch
-/zsRadAGYzAY6F/J5m6lMjmojkN7NbY3TbfQbA
---- /rQgwuY9SVGLKeUzY5P6c+sGQ1I1aw5cQxmO46QKDSQ
-��(`���U ����,��c��|ґP�畠�9�@&	��gMߒ
-CH�3ik���3#|���g��M���A���g�A��nZ��Y��t�����2����K2ޘ�Y�
\ No newline at end of file
+-> ssh-ed25519 OkGqLg 7zaZRWxX/e7RaqYsQkiG8tm2V8rIZi1bpuYj+ZF+ix8
+H3etDuPK8PPghves5bnasQ01WTqvBnqnvVDGAd2SpO0
+-> ssh-ed25519 xR+E/Q MGbPr/UpqvzxoCsfyXrWhpiB+IGk2qaprlDnvQAdHiE
+n9ikSISxTS3etvJxudA2sNgGkm0ZH8SuyuDxjc0ts2Q
+-> ssh-ed25519 dcsaLw bHbnaG2LHkdARhDRUqCZD0FCoB6TakuSFDrXskAz0wg
+hav1GWBSzhXPvOQN7Ta3nJhPe4LU1arrZmhFGnDhQek
+-> ssh-ed25519 zcCuhA wV0ejBHKzTn1kQTm6apJy9GmiycPxiW+OO7VM5zjnGY
+lBpcnbmSeqgAolJ8LWlr+ZuUEM7Pn8yLbptahmuSWRg
+-> ssh-ed25519 1SxhRA Yz9ewxHm0cAc7t5Htm5eoYjXaGeYE35PPIWL5d1awgA
+5jbHeDlD1ttxzts1+7ZFczHo/Jc1gxZ6/j2IauPFV0g
+-> ssh-ed25519 ch/9tw tE5DuYHdqoiHrQlEfMcql1EXa6IWS9OSb3YE/hJaYCo
+ovcxm/RHfY5JMQ4Gy7sjLWw3kPNo9roLeaZKGe7GYLQ
+-> ssh-ed25519 CpJBgQ 6YQWpxreZnaZQzB5nnE6BIY3mzKh/jyGfo4d1DIZMW4
+ZAkw1azFo06HCc4kr6tETekIYde8fZmqTB50EpxYqFY
+-> ssh-ed25519 aXKGcg uPId6FHvRb0G//LQsZydlL8V5qaVVyR3uMa4NtUtqwI
+165tSBFCGp6kQSXtmtT61r5v6v4zDzNGEh8hXNPu250
+--- A5ibslMc4EiRcYPX2he5YSB/u6BrHF7+2Eh+yQzv5BU
+���#˄��֨�
+P�f�|�H+ ��
Vk�A�e$��F�bY�?�A�(�~n*N�?����I#\����.���P"�½�����b���)�I���%e6>��t�e
�g �
\ No newline at end of file
diff --git a/ops/secrets/teleirc.age b/ops/secrets/teleirc.age
index ebc88fc9e..1bcf3b94b 100644
Binary files a/ops/secrets/teleirc.age and b/ops/secrets/teleirc.age differ
diff --git a/ops/secrets/tf-buildkite.age b/ops/secrets/tf-buildkite.age
index 0cf6066fa..6f7ed8c90 100644
Binary files a/ops/secrets/tf-buildkite.age and b/ops/secrets/tf-buildkite.age differ
diff --git a/ops/secrets/tf-glesys.age b/ops/secrets/tf-glesys.age
index 4e50454b6..82895a62b 100644
Binary files a/ops/secrets/tf-glesys.age and b/ops/secrets/tf-glesys.age differ
diff --git a/ops/secrets/tf-keycloak.age b/ops/secrets/tf-keycloak.age
index 7d470a6a3..87a1d14f5 100644
Binary files a/ops/secrets/tf-keycloak.age and b/ops/secrets/tf-keycloak.age differ
diff --git a/ops/secrets/tf-yandex.age b/ops/secrets/tf-yandex.age
new file mode 100644
index 000000000..465297c0d
--- /dev/null
+++ b/ops/secrets/tf-yandex.age
@@ -0,0 +1,17 @@
+age-encryption.org/v1
+-> ssh-ed25519 dcsaLw M/Q/SPfYHbP1Fu58r9+YzPemEVwycadHiwpsT0EgG0A
+YRwnS7LID5jRppBKONHTnYAG9yL7iGzqE5Kb5We/YVA
+-> ssh-ed25519 zcCuhA 2E4mTf1KRjknhvfNQsvJ3n2PxI0H8PwJ42yAJd15BCw
+sunGwSgkNJUBjqgouuCfbC2jVgRLCxah1pyJBsnxs20
+-> ssh-ed25519 CpJBgQ hxMK7R7fcZhy2JAKjIgVVoCDFOyJcRT9EVPD5HQ7/W8
+dS3dwz9nyfGKbmG/MxKN5yhtsoFjhxu4ODUQBd2SnXE
+-> ssh-ed25519 aXKGcg XX5nMPWQvaazgGpuRyCpdnUit0EwYUc5ZfU/Y4PfzDA
+Avqf9E83/z5RTJy85IP5gFuw+HYdNCzGlvfUaQyU4c0
+-> ssh-ed25519 C2zWnA JwQkckkpIBznH8d+xqbH/BQ542lJfhOEeC2Zy35lmlU
+unCT8sZn9es9lZb9NzXZvk4gu/kM2dlmeGzYfvA6Plo
+-> Jg6zP>5r-grease xyn
+HbAOtgdTIPa25802PNNPfTvtpiZSTzonaFO87U/KV+1LTRhI560rGjckMLaf2MzC
+xWW7qwSg0gA8uVec99KugA596W8x
+--- W60cYV6jeVgGngYnbG8jLUUQ5O/UTgjdpqYFGZxxDyY
+=^���4+��nL�o=�M�e�2W�/}i�$�+�[�e��o��A�M��Ny5��!t)�w 4�U�M��'@�F���m� A��
��\
+���w)�iaz�zb���;����ᶷ�^��s^,n�Q4��
��{V@l��ӣ�Ri����JPV
/k|w�
\ No newline at end of file
diff --git a/ops/secrets/tvl-alerts-bot-telegram-token.age b/ops/secrets/tvl-alerts-bot-telegram-token.age
index e897fedc0..c3c29bea3 100644
--- a/ops/secrets/tvl-alerts-bot-telegram-token.age
+++ b/ops/secrets/tvl-alerts-bot-telegram-token.age
@@ -1,15 +1,19 @@
 age-encryption.org/v1
--> ssh-ed25519 dcsaLw JGXCnhez0LnlUV8eOitxizmxw/gV+1taBRhNvwvVcms
-qsRTOpifnoc0eorFjd4UlP7O3hkRR3KjDUcImASK0jY
--> ssh-ed25519 zcCuhA KUcyaHcmuqCGtJBzvc2UK17gRrjzuzIxll+TS9Q4nWs
-CAJ19ClA9Tqj1fcYySq+K9gdZe6Uv0toZLnhlovr3tM
--> ssh-ed25519 CpJBgQ OAE+u9JuC6KoefjCOTj4NkQElZRe6/EEIAGBN/XelnU
-M9MHlKxbEBJ+gACo2FiYqmm1cAoYW31+nP16qnVZ7Zw
--> ssh-ed25519 aXKGcg Ll6v6v5HpUIEuOzjpVsPMmPQMnNkmyB4fz/YwNXfCHU
-MmFQy2WkKn5SM0bhe4NNe/lMnneKoOF+Ufq0t0QjNbw
--> ssh-ed25519 OkGqLg PS6KLwat1z2BSQ9sIKDaryVU39EJR+iiAaKSP/KSPk0
-qUQP2f4MFk83zQ9edlSNC8jwpJvmp2xhOysd8rnYzW4
--> >NI-grease @mOcHT z|%,s- mw^c *
-zu0M2pS6v3zehnLg
---- jltBYy9brAtpkEIqPoGmIVe3s5XnWtpa9EmuXlAf91c
-�t�dX2-�"��#�1��n'��\��'{Dlw;Pִ�@�����{��B	!y�+�x��
��W���B:wt�qph
\ No newline at end of file
+-> ssh-ed25519 OkGqLg FOAaUDj6nO1t5hnf0aGzWpmQkhqU9VP+SRUompxV9GE
+JK4da9hBvI7NN3gnCUI/tmhUFEtt5KUuBoLfRCoFhqw
+-> ssh-ed25519 xR+E/Q wJGkb4gj0iz3E+W5mIbTAeGFVdlznevKH4EEibecDF8
+WUAFLhSrjQgUTkZ3xzVuT7HHwAc2N1HKrIdGRIEutD8
+-> ssh-ed25519 dcsaLw QkXSrs57caaESWsgGx2oIpbZd7eNL5UH6bU0g+hFxEI
+zbNePgbWmX+87aIqGvY0HEpvxxUQB3b4qoGImH28m38
+-> ssh-ed25519 zcCuhA FNZlnMpL4AhOu9PWTDNHbWhOGcJYPAdcZA8YNmgGTR4
+rbE9zXLbKEANF1jc455/2G9wXbvaeRwbw1JdfceQo8Q
+-> ssh-ed25519 1SxhRA rii+s4GOfeBz7n7aRVTkT97vORRvdsR1mX0Bbgri434
+dmMbDxVKk6zBro9hZ53JYZNlUa1et0ZYvvf3ko+QbAQ
+-> ssh-ed25519 ch/9tw ACKJ0RJknUewijCbuOaBv4qNleB3gXYnPo/cnjnoWkk
+GKEZVXPUZkwQ++quIUWxJS1MCo1Bg+naHiEhzMiB3kc
+-> ssh-ed25519 CpJBgQ d8Dewm0HC+bMan6QB8EPL+tQGoem0Vx5af9UehAq7UA
+Dcf4qudBi1z5PAxxhm82nBQFQx9TFeHLfcsV+XcdwQY
+-> ssh-ed25519 aXKGcg Icrf3Vs4SyRWqbnvfAJURuaWEORyGqOxONcdCakWfwg
+wVdLjQuvuTc/f/wDZIv32udqpVNdlLWZ4mpzT6Pur8A
+--- mk6kDLN1EEhHZgUbS/RRqardbjWFBXvQZJV5ikc7vu0
+���'�'c3Q�t������/䰺-���_����[p�څ�t,%�Ѩ�{O�a�Y�����ص��"WʥO���(��0
\ No newline at end of file
diff --git a/ops/secrets/wg-bugry.age b/ops/secrets/wg-bugry.age
index c2b0a68e6..2ce0de6a9 100644
Binary files a/ops/secrets/wg-bugry.age and b/ops/secrets/wg-bugry.age differ
diff --git a/ops/secrets/wg-nevsky.age b/ops/secrets/wg-nevsky.age
index a5011004e..93b133ce3 100644
--- a/ops/secrets/wg-nevsky.age
+++ b/ops/secrets/wg-nevsky.age
@@ -1,17 +1,17 @@
 age-encryption.org/v1
--> ssh-ed25519 dcsaLw fAd2MnJBU3OG7KpHvd6rhRVQuMl5pGUOlx6zQ1HVpTU
-hwoKpHUvpHp/gLFhtwTOyJLBeUyryrZAf8TzDsaoMUg
--> ssh-ed25519 zcCuhA B2ZIcHgTjg69iprbGkKPyGGExK+kP1l6MMYX4czpOVM
-xomAnf6WhEM78GWvtAtCS/yw4UfeCT3Ph3evbLp0yQk
--> ssh-ed25519 1SxhRA uJNHTJFigivTGSKNzd4oqEhEIFF/aWwWQzovxwiVSHo
-VAzriez/W6hZKicze7rOYs7YL8vxPxVoWzMe9yawyqA
--> ssh-ed25519 ch/9tw nBm9P9qvUkZSYI+CKN0kjXzSuD6sg+uMvTux9yTD7V0
-Kt+R1s9tEPk+e5ZeskmZtBzEvm25B33KCQwmjnfuVNM
--> ssh-ed25519 CpJBgQ 6g8GbJ/zZkAb1pBpqA5Jm929aIAJlepe1sPNqhAuAWM
-gYCkgAQw2nF0wcPMZruvhBqkC4a2BxYK8kWo+R9ll44
--> ssh-ed25519 aXKGcg rfGH2EO9/soo/duaZlt4hBic4KxMDR+tw8JJ1Un+u1U
-FzyiK9NT7NUM+oQph/EB26PfuLsLQVYsKwqeBHGaRI8
--> ssh-ed25519 xR+E/Q 3w7vMdS+Iragj8garW5/F0ZL28orsyewbvp4i8szNl4
-zuEEaHd2rTfMYuLvQ19TuHOX5UMmSZABD3grJjEnsG8
---- +e2kcaRvPwsUH/XG+ChROPjyZHLv4mfpSBmmJCr/4UM
->S1	:Ԍu�5ܘ��Nj��@�t)��O�Q7��n^�Y,�FMͤ6�^����>��e�ǔ+~]�����
9��.Z
\ No newline at end of file
+-> ssh-ed25519 xR+E/Q pAv2Rm0oj9HJu8LAIRbT+bvNOufRcDTLlLfanvM84y0
+eTOICFyxEt3b6Kh9NbKMmt9i3+GFsgk4K+jBuR8LjUs
+-> ssh-ed25519 dcsaLw cYYa3+xqONMvU4y4LsWZ5VZBrQoMdoRYbII70H0x7hw
+w7XolSOTiX5WdrnURn/PtAGriMz4n0rBUAulOU4pP3E
+-> ssh-ed25519 zcCuhA xwUsUilN81ZHuqE6gCzmUddjD+gLd6bkDclSb73K+08
+H2uNajL/IDn+hXJyehDG22Zu5k7RZmjWyWtJnzCxAEw
+-> ssh-ed25519 1SxhRA rkPyrom+2W0BWU6S9Vy+h5ggrdjEQdVcFd6onYENNmE
+AuonnG8d2RwpLUR+FAgf4TrWCmB3dxnO3OFLM4+EVH8
+-> ssh-ed25519 ch/9tw DJs3TcbTmAx0HqTWoyvugqfqxdZ13kqerOlaJKADljA
+bxyxi0/J7MBm+Hlq6CUM4s9+j4M3E9f55lUgMKx+ABc
+-> ssh-ed25519 CpJBgQ ralv1E55uSriSrM8X+rOr/h70dbEOVOfux7U20cky0k
+lflA+jocbQn7dricKpH6iBQ3P2K+g8ZDvyuRkyCUL7c
+-> ssh-ed25519 aXKGcg Fb5vBSvT0RaO5yXhd/b/75QdC6IPSDpntUHhtdhhFGw
+UASa/ristknh342EyYO24qAT+rAaWI5ks00mSTjPOQY
+--- e8mOir6/NeozcVmD17lJkrFVIffhOAXR3kKq5OgqbRw
+%���e�̑�lAظ>5.48�}��@���D*u�G�רy|S��-F��*&���La�
��,XY���=�'H
\ No newline at end of file