This repository has no description
0

Configure Feed

Select the types of activity you want to include in your feed.

2configs.rad: shared per-machine radicle identity and node

One radicle-node serves one keypair, so each machine that does radicle
work gets its own identity (vars generator `rad`) and a node running
as the `rad` system user over /var/lib/rad. The profile is group-shared
(setgid dirs, umask-002 wrappers for rad/git-remote-rad, pre-created
group-writable sqlite files) so any account in group `rad` signs with
the machine identity; mainUser is a member. RAD_HOME points there for
login shells. Imported explicitly on coaxmetal, neoprism, ignavia,
icarus and shodan.

Rename the public seed module to 2configs/radicle.lassul.us.nix and
switch its retired seed.radicle.garden entry to iris.radicle.network.

+246 -121
-3
2configs/default.nix
··· 211 211 #stuff for dl 212 212 aria2 213 213 214 - # decentralized git hosting 215 - radicle-node 216 - 217 214 #neat utils 218 215 file 219 216 xkcdpass
+153
2configs/rad.nix
··· 1 + { 2 + config, 3 + pkgs, 4 + ... 5 + }: 6 + # Per-machine Radicle identity and node for day-to-day development 7 + # (rad clone/push/patch), as opposed to the public seed in ./radicle.lassul.us.nix. 8 + # 9 + # One radicle-node = one keypair = one Node ID; a node cannot serve several 10 + # identities. So every machine gets its own key (generator `rad`) and hence 11 + # its own DID, and repos that should accept pushes from all machines list each 12 + # machine's DID as a delegate (`rad id update --delegate did:key:<nid>`). 13 + # 14 + # Radicle has no multi-user mode: the `rad` CLI and git-remote-rad write into 15 + # the profile's storage themselves, signing with the key in keys/radicle. To 16 + # make one identity usable by several accounts the profile lives outside any 17 + # home, in /var/lib/rad, group-shared: the node runs as the `rad` system user, 18 + # everything is setgid `rad` with group rwx, and the CLI/remote-helper wrappers 19 + # below force umask 002 so files one side creates stay writable for the other. 20 + # RAD_HOME points there for login shells; membership in `rad` is what grants 21 + # use of the identity (mainUser is a member, add others per machine). 22 + # Keys and config.json are symlinks into the clan vars secret dir / nix store, 23 + # maintained by tmpfiles; storage and the control socket are ordinary state. 24 + # 25 + # The node only dials out (no listen address): the laptops sit behind NAT and 26 + # the public seed neoprism relays for them, so nothing needs a port opened. 27 + let 28 + generator = config.clan.core.vars.generators.rad; 29 + radHome = "/var/lib/rad"; 30 + 31 + settings = { 32 + publicExplorer = "https://app.radicle.xyz/nodes/$host/$rid$path"; 33 + preferredSeeds = [ 34 + # our own seed (2configs/radicle.lassul.us.nix on neoprism) 35 + "z6MkhTe9WWbqNdRAnWLHxL23gedRQWdhjajRbNAt5fCpae6o@radicle.lassul.us:8776" 36 + "z6MkrLMMsiPWUcNPHcRajuMi9mDfYckSoJyPwwnknocNYPm7@seed.radicle.xyz:8776" 37 + "z6Mkmqogy2qEM2ummccUthFEaaHvyYmYBYh3dbe9W4ebScxo@iris.radicle.network:8776" 38 + ]; 39 + cli.hints = true; 40 + node = { 41 + alias = config.networking.hostName; 42 + listen = [ ]; 43 + network = "main"; 44 + log = "INFO"; 45 + relay = "auto"; 46 + # Only seed what this machine explicitly initialised, cloned or `rad seed`ed. 47 + seedingPolicy.default = "block"; 48 + }; 49 + }; 50 + 51 + # Validate with `rad config` at build time (same trick as the nixpkgs seed 52 + # module) so a typo does not leave every machine's node crash-looping. 53 + configFile = 54 + pkgs.runCommand "rad-config.json" 55 + { 56 + nativeBuildInputs = [ pkgs.buildPackages.radicle-node ]; 57 + json = builtins.toJSON settings; 58 + passAsFile = [ "json" ]; 59 + preferLocalBuild = true; 60 + } 61 + '' 62 + install -D -m 644 "$jsonPath" $out 63 + ln -s $out config.json 64 + install -D -m 644 /dev/stdin keys/radicle.pub <<<"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBgFMhajUng+Rjj/sCFXI9PzG8BQjru2n7JgUVF1Kbv5 snakeoil" 65 + RAD_HOME=$PWD rad config >/dev/null 66 + ''; 67 + 68 + # `rad` and `git-remote-rad` (what git runs for rad:// remotes) forced to 69 + # umask 002; first in the join so they shadow the plain radicle-node ones. 70 + wrap = 71 + bin: 72 + pkgs.writeShellScriptBin bin '' 73 + # ${radHome} is shared with the rad-node service via group rad. 74 + umask 002 75 + exec ${pkgs.radicle-node}/bin/${bin} "$@" 76 + ''; 77 + radicle-shared = pkgs.symlinkJoin { 78 + name = "radicle-shared"; 79 + paths = [ 80 + (wrap "rad") 81 + (wrap "git-remote-rad") 82 + pkgs.radicle-node 83 + ]; 84 + }; 85 + in 86 + { 87 + clan.core.vars.generators.rad = { 88 + files."radicle.key" = { 89 + owner = "rad"; 90 + group = "rad"; 91 + mode = "0440"; 92 + }; 93 + files."radicle.pub".secret = false; 94 + runtimeInputs = [ pkgs.openssh ]; 95 + script = '' 96 + ssh-keygen -t ed25519 -N "" -C "radicle ${config.networking.hostName}" -f "$out/radicle.key" 97 + mv "$out/radicle.key.pub" "$out/radicle.pub" 98 + ''; 99 + }; 100 + 101 + users.users.rad = { 102 + isSystemUser = true; 103 + group = "rad"; 104 + home = radHome; 105 + }; 106 + users.groups.rad = { }; 107 + users.users.mainUser.extraGroups = [ "rad" ]; 108 + 109 + environment.systemPackages = [ radicle-shared ]; 110 + environment.variables.RAD_HOME = radHome; 111 + 112 + systemd.tmpfiles.rules = [ 113 + "d ${radHome} 2770 rad rad -" 114 + "d ${radHome}/cobs 2770 rad rad -" 115 + "d ${radHome}/keys 2770 rad rad -" 116 + "d ${radHome}/node 2770 rad rad -" 117 + "d ${radHome}/storage 2770 rad rad -" 118 + "L+ ${radHome}/keys/radicle - - - - ${generator.files."radicle.key".path}" 119 + "L+ ${radHome}/keys/radicle.pub - - - - ${generator.files."radicle.pub".path}" 120 + "L+ ${radHome}/config.json - - - - ${configFile}" 121 + # SQLite creates databases 0644 regardless of umask, which would lock the 122 + # second party out ("attempt to write a readonly database"). Pre-create 123 + # them empty and group-writable (an empty file is a valid empty database; 124 + # -wal/-shm copy the main file's mode). Adjusts mode on every boot too. 125 + "f ${radHome}/cobs/cache.db 0664 rad rad -" 126 + "f ${radHome}/node/node.db 0664 rad rad -" 127 + "f ${radHome}/node/notifications.db 0664 rad rad -" 128 + "f ${radHome}/node/policies.db 0664 rad rad -" 129 + ]; 130 + 131 + systemd.services.rad-node = { 132 + description = "Radicle node (machine identity, ${radHome})"; 133 + documentation = [ "man:radicle-node(1)" ]; 134 + wantedBy = [ "multi-user.target" ]; 135 + wants = [ "network-online.target" ]; 136 + after = [ "network-online.target" ]; 137 + environment = { 138 + # rad stats $HOME/.gitconfig 139 + HOME = radHome; 140 + RAD_HOME = radHome; 141 + }; 142 + path = [ pkgs.gitMinimal ]; 143 + serviceConfig = { 144 + User = "rad"; 145 + Group = "rad"; 146 + UMask = "0002"; 147 + # --force: reclaim a control socket left behind by an unclean shutdown. 148 + ExecStart = "${pkgs.radicle-node}/bin/radicle-node --force"; 149 + Restart = "on-failure"; 150 + RestartSec = 5; 151 + }; 152 + }; 153 + }
+86
2configs/radicle.lassul.us.nix
··· 1 + { 2 + config, 3 + pkgs, 4 + ... 5 + }: 6 + { 7 + # Generate Radicle identity keys using clan vars 8 + clan.core.vars.generators.radicle = { 9 + files."radicle.key" = { }; 10 + files."radicle.pub".secret = false; 11 + runtimeInputs = [ pkgs.openssh ]; 12 + script = '' 13 + ssh-keygen -t ed25519 -N "" -C "radicle" -f "$out/radicle.key" 14 + mv "$out/radicle.key.pub" "$out/radicle.pub" 15 + ''; 16 + }; 17 + 18 + services.radicle = { 19 + enable = true; 20 + privateKey = config.clan.core.vars.generators.radicle.files."radicle.key".path; 21 + publicKey = config.clan.core.vars.generators.radicle.files."radicle.pub".path; 22 + 23 + node.openFirewall = true; 24 + 25 + httpd = { 26 + enable = true; 27 + # The default 8080 is taken on neoprism by jitsi-videobridge's REST 28 + # API (Jetty, 127.0.0.1:8080): radicle-httpd died with "Address 29 + # already in use" on every restart and nginx proxied 30 + # radicle.lassul.us to Jetty's 404 page instead. 31 + listenPort = 8778; 32 + nginx = { 33 + serverName = "radicle.lassul.us"; 34 + enableACME = true; 35 + forceSSL = true; 36 + }; 37 + }; 38 + 39 + settings = { 40 + publicExplorer = "https://app.radicle.xyz/nodes/$host/$rid$path"; 41 + preferredSeeds = [ 42 + "z6MkrLMMsiPWUcNPHcRajuMi9mDfYckSoJyPwwnknocNYPm7@seed.radicle.xyz:8776" 43 + "z6Mkmqogy2qEM2ummccUthFEaaHvyYmYBYh3dbe9W4ebScxo@iris.radicle.network:8776" 44 + ]; 45 + web.pinned.repositories = [ ]; 46 + cli.hints = true; 47 + node = { 48 + alias = config.networking.hostName; 49 + listen = [ "0.0.0.0:8776" ]; 50 + peers.type = "dynamic"; 51 + connect = [ ]; 52 + externalAddresses = [ "radicle.lassul.us:8776" ]; 53 + network = "main"; 54 + log = "INFO"; 55 + relay = "auto"; 56 + limits = { 57 + routingMaxSize = 1000; 58 + routingMaxAge = 604800; 59 + gossipMaxAge = 1209600; 60 + fetchConcurrency = 1; 61 + maxOpenFiles = 4096; 62 + rate = { 63 + inbound = { 64 + fillRate = 5.0; 65 + capacity = 1024; 66 + }; 67 + outbound = { 68 + fillRate = 10.0; 69 + capacity = 2048; 70 + }; 71 + }; 72 + connection = { 73 + inbound = 128; 74 + outbound = 16; 75 + }; 76 + fetchPackReceive = "500.0 MiB"; 77 + }; 78 + workers = 8; 79 + seedingPolicy = { 80 + default = "allow"; 81 + scope = "all"; 82 + }; 83 + }; 84 + }; 85 + }; 86 + }
-86
2configs/radicle.nix
··· 1 - { 2 - config, 3 - pkgs, 4 - ... 5 - }: 6 - { 7 - # Generate Radicle identity keys using clan vars 8 - clan.core.vars.generators.radicle = { 9 - files."radicle.key" = { }; 10 - files."radicle.pub".secret = false; 11 - runtimeInputs = [ pkgs.openssh ]; 12 - script = '' 13 - ssh-keygen -t ed25519 -N "" -C "radicle" -f "$out/radicle.key" 14 - mv "$out/radicle.key.pub" "$out/radicle.pub" 15 - ''; 16 - }; 17 - 18 - services.radicle = { 19 - enable = true; 20 - privateKey = config.clan.core.vars.generators.radicle.files."radicle.key".path; 21 - publicKey = config.clan.core.vars.generators.radicle.files."radicle.pub".path; 22 - 23 - node.openFirewall = true; 24 - 25 - httpd = { 26 - enable = true; 27 - # The default 8080 is taken on neoprism by jitsi-videobridge's REST 28 - # API (Jetty, 127.0.0.1:8080): radicle-httpd died with "Address 29 - # already in use" on every restart and nginx proxied 30 - # radicle.lassul.us to Jetty's 404 page instead. 31 - listenPort = 8778; 32 - nginx = { 33 - serverName = "radicle.lassul.us"; 34 - enableACME = true; 35 - forceSSL = true; 36 - }; 37 - }; 38 - 39 - settings = { 40 - publicExplorer = "https://app.radicle.xyz/nodes/$host/$rid$path"; 41 - preferredSeeds = [ 42 - "z6MkrLMMsiPWUcNPHcRajuMi9mDfYckSoJyPwwnknocNYPm7@seed.radicle.xyz:8776" 43 - "z6Mkmqogy2qEM2ummccUthFEaaHvyYmYBYh3dbe9W4ebScxo@seed.radicle.garden:8776" 44 - ]; 45 - web.pinned.repositories = [ ]; 46 - cli.hints = true; 47 - node = { 48 - alias = config.networking.hostName; 49 - listen = [ "0.0.0.0:8776" ]; 50 - peers.type = "dynamic"; 51 - connect = [ ]; 52 - externalAddresses = [ "radicle.lassul.us:8776" ]; 53 - network = "main"; 54 - log = "INFO"; 55 - relay = "auto"; 56 - limits = { 57 - routingMaxSize = 1000; 58 - routingMaxAge = 604800; 59 - gossipMaxAge = 1209600; 60 - fetchConcurrency = 1; 61 - maxOpenFiles = 4096; 62 - rate = { 63 - inbound = { 64 - fillRate = 5.0; 65 - capacity = 1024; 66 - }; 67 - outbound = { 68 - fillRate = 10.0; 69 - capacity = 2048; 70 - }; 71 - }; 72 - connection = { 73 - inbound = 128; 74 - outbound = 16; 75 - }; 76 - fetchPackReceive = "500.0 MiB"; 77 - }; 78 - workers = 8; 79 - seedingPolicy = { 80 - default = "allow"; 81 - scope = "all"; 82 - }; 83 - }; 84 - }; 85 - }; 86 - }
+1
machines/coaxmetal/config.nix
··· 18 18 ../../2configs/yellow-mounts/samba.nix 19 19 ../../2configs/review.nix 20 20 ../../2configs/sigexec/executor.nix 21 + ../../2configs/rad.nix 21 22 ./strom.nix 22 23 ./hermes.nix 23 24 ];
+1
machines/icarus/config.nix
··· 13 13 ../../2configs/consul.nix 14 14 ../../2configs/autoupdate.nix 15 15 ../../2configs/sigexec/executor.nix 16 + ../../2configs/rad.nix 16 17 ]; 17 18 18 19 krebs.build.host = config.krebs.hosts.icarus;
+1
machines/ignavia/config.nix
··· 34 34 ../../2configs/dunst.nix 35 35 ../../2configs/yggdrasil.nix 36 36 ../../2configs/container-tests.nix 37 + ../../2configs/rad.nix 37 38 # ../../2configs/sunshine.nix 38 39 # ../../2configs/br.nix 39 40 # ../../2configs/c-base.nix
+3 -1
machines/neoprism/config.nix
··· 116 116 ../../2configs/omnigent.nix 117 117 118 118 # radicle public seed (radicle.lassul.us) 119 - ../../2configs/radicle.nix 119 + ../../2configs/radicle.lassul.us.nix 120 + # radicle identity + node for this machine (/var/lib/rad) 121 + ../../2configs/rad.nix 120 122 121 123 # self-hosted iroh relay (relay.lassul.us) 122 124 ../../2configs/iroh-relay
+1
machines/shodan/config.nix
··· 11 11 ../../2configs/consul.nix 12 12 ../../2configs/snapclient.nix 13 13 ../../2configs/sigexec/executor.nix 14 + ../../2configs/rad.nix 14 15 ]; 15 16 16 17 krebs.build.host = config.krebs.hosts.shodan;
-1
vars/per-machine/aergia/rad/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMBRNxUoSy+hQvFVDxQSiOO5VEP2hBSCmKVY3ayo4kPa radicle aergia
-1
vars/per-machine/aergia/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIeMx56Gw60DPV211wK3LkcfbKOB85D0vLsYIyj5b4Di radicle lass@aergia
-1
vars/per-machine/coaxmetal/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL6ngy3IEPt/sVoqMNWCb/vAfyWuSLLj5XzVTj7MV0+b radicle lass@coaxmetal
-1
vars/per-machine/daedalus/rad/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEe1ZSp23dR+XvwJKzq+bA4zz/akrHc6pLGwiRnoVQMT radicle daedalus
-1
vars/per-machine/daedalus/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAg651pA5lYJN20CYxdOztw55giGCMFjiMzgozZVbYcy radicle lass@daedalus
-1
vars/per-machine/green/rad/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEP/bQDn8in2SvQps6uI59A/+AkjCRTijY4iDjHwjWGq radicle green
-1
vars/per-machine/green/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnUREimb+bCXGJjFEp2hoZer/HMHk1GSs0FWWhESe0c radicle lass@green
-1
vars/per-machine/hilum/rad/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEyxAQblJxndHVx0K5SMNEHSgMeUCjokp4tNpCJgPxQf radicle hilum
-1
vars/per-machine/hilum/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINWtt5S1YGBpdkXgnPpNb8MF45DR4cJiTA+WWSjPjPFt radicle lass@hilum
-1
vars/per-machine/icarus/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEIcIu5keLRKSdRmgYyzpnXY+wOvRFoX9buGrEyhJLzc radicle lass@icarus
-1
vars/per-machine/ignavia/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGKtXC03ER4obw1fBLNWfornQuWpYQt0SUV1C86o8T8H radicle lass@ignavia
-1
vars/per-machine/mors/rad/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJjU6BaqvadbX2+cQGP7myo1vgeZ3tnks9szjdu8jWCk radicle mors
-1
vars/per-machine/mors/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK92m6MJb/6Sr+c4z77B65DLHERXz+ADmUPZoFdxGPpg radicle lass@mors
-1
vars/per-machine/neoprism/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH6kV7z+90vreAezXbjamYnUdCBhEyLlvAfD7jl+hFDJ radicle lass@neoprism
-1
vars/per-machine/orange/rad/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIlcDmb77UY1o5yRKeqXBzb7RQ7fLYXXCPOS1DUf5VTa radicle orange
-1
vars/per-machine/orange/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINKetdqEEs4fQQyLeQ7CDYgoDO+/Td2j78TYC7s51tLK radicle lass@orange
-1
vars/per-machine/prism/rad/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIENPoZ0ql1izJPBYId6Us8mdGIN6NnsOv+gFvDuisQBj radicle prism
-1
vars/per-machine/prism/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJhSU4ewW0SV+7C5SYRxcszJfjRCCBkylXWKVn54fLdS radicle lass@prism
-1
vars/per-machine/radio/rad/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAGyiNFwSUl0kffBGkKVLdoCdPyeNZbXOirPL3eun+Fh radicle radio
-1
vars/per-machine/radio/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICAEuz6T20S3IaNPP4yH2LPX+h2CGpKnfxFIYR5/+GJN radicle lass@radio
-1
vars/per-machine/shodan/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICq6oGNq7Sf1A8etM0QJYmBEKnr8LLocKzmOlghVhUYk radicle lass@shodan
-1
vars/per-machine/starkstrom/rad/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINO/TdynPyNTwF8/ED0nn+2eKRsF29oX9icYRbsRZyag radicle starkstrom
-1
vars/per-machine/starkstrom/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOEnbMwm6I36P/UtZn+/6YHEM92NrOs1ucgMs+f7O38K radicle lass@starkstrom
-1
vars/per-machine/styx/rad/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMaqYDoYa24tve3/sKYT/EcJhgl6HkrP/1rRlgGvnQCS radicle styx
-1
vars/per-machine/styx/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICijHpMpETrlr23FyyMQwjHsAjqFEJa7h5kx081T8uIp radicle lass@styx
-1
vars/per-machine/virtulus/rad/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKFLxg3/wPW0jptbiOazZTujXdqXrk4rgSWfN/aYH+GW radicle virtulus
-1
vars/per-machine/virtulus/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPZgAzh738xtd4fY9kCHRcjSGaaeiQNcoe9+2AHdO5Cf radicle lass@virtulus
-1
vars/per-machine/xerxes/rad/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGpLLcJ9OPnSOTKywBCfhqSVFz1jvUVAx6IgxpTNhC2j radicle xerxes
-1
vars/per-machine/xerxes/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGbyO4pKKKI6cyQAPaIm2/Qvh0xiZK+BLiyr714/wu4E radicle lass@xerxes
-1
vars/per-machine/yellow/rad/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICqDWzuuLNWDozhc6/gFdZtShfFWKVEjzAGlD+Zjdqs2 radicle yellow
-1
vars/per-machine/yellow/radicle-lass/radicle.pub/value
··· 1 - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILfhGVkVDHx/AbKMryb9tKzstb0v8AAJ/fpfxBOfM9Vt radicle lass@yellow