feat: zrepl replication

auricom · Jun 22, 2024 · 3e65cdb · 3e65cdb
1 parent f97d221
commit 3e65cdb
Show file tree

Hide file tree

Showing 16 changed files with 171 additions and 62 deletions.
diff --git a/.sops.yaml b/.sops.yaml
@@ -5,7 +5,7 @@ creation_rules:
     key_groups:
       - age:
           - age1c8cqpw6gnlrf82ewm2vj0yalzszvtzd0mmk5yzr4nfpqqseynq7q86f3sq
-  - path_regex: \.sops\.conf$
+  - path_regex: \.sops\.(conf|crt|key)$
     key_groups:
       - age:
           - age1c8cqpw6gnlrf82ewm2vj0yalzszvtzd0mmk5yzr4nfpqqseynq7q86f3sq

diff --git a/Containerfile.storage b/Containerfile.storage
@@ -43,8 +43,8 @@ COPY apps/traefik/config.sops.env /usr/share/traefik/config.sops.env
 COPY apps/traefik/config/storage.yaml /usr/etc/traefik/traefik.yaml
 
 # Apps - Zrepl
-COPY apps/zrepl/storage.yml /usr/etc/zrepl/zrepl.yml
-
+COPY apps/zrepl /tmp/apps/zrepl
+COPY systemd/zrepl-secrets.service /etc/systemd/system/
 
 COPY systemd/ucore-update* /etc/systemd/system/
 COPY systemd/ucore-firewalld-setup-storage.service /etc/systemd/system/

diff --git a/Containerfile.storage-remote b/Containerfile.storage-remote
@@ -11,16 +11,17 @@ COPY apps/scrutiny-collector/storage-remote.sops.env /usr/share/scrutiny-collect
 
 # Apps - Wireguard
 COPY apps/wireguard/wg0-client.sops.conf /usr/share/wireguard/wg0-client.sops.conf
+COPY systemd/wg0-client.service /etc/systemd/system/
 
 # Apps - Zrepl
-COPY apps/zrepl/storage-remote.yml /usr/etc/zrepl/zrepl.yml
+COPY apps/zrepl /tmp/apps/zrepl
+COPY systemd/zrepl-secrets.service /etc/systemd/system/
 
 
 COPY systemd/ucore-update* /etc/systemd/system/
 COPY systemd/ucore-firewalld-setup-storage-remote.service /etc/systemd/system/
 COPY systemd/ucore-zfs-kernel.service /etc/systemd/system/
 COPY systemd/brew* /etc/systemd/system/
-COPY systemd/wg0-client.service /etc/systemd/system/
 
 COPY scripts /tmp/
 

diff --git a/README.md b/README.md
@@ -40,3 +40,11 @@ sudo passwd core
 ```
 
 3. Deploy [dotfiles](https://github.com/auricom/dotfiles/tree/main)
+
+```bash
+set -U fish_user_paths /home/linuxbrew/.linuxbrew/bin/ $fish_user_paths
+brew install chezmoi
+mkdir -p /home/core/.config/sops/age
+nano /home/core/.config/sops/age/chezmoi.txt
+chezmoi init --apply auricom
+```
diff --git a/apps/zrepl/storage-remote.sops.crt b/apps/zrepl/storage-remote.sops.crt
@@ -0,0 +1,20 @@
+{
+	"data": "ENC[AES256_GCM,data:hCG6dNTX61aRdILkfScz031Kk7uN9NOZOmaHxXANfS+oHjHEY7nkDIyxYqBP6s4fPAA3p5pYqhZtxmYZAflgO+BpXaCHcve5AFY3oQHtFROZh8BdthGNwUqA5TTIRBZ4G5iv5x8UOoRW6lrxzubPM5LiK6lj6HD/o830PfGQnuRQP2HVqnr/1/Q0fM5755KkfvRETR5hVpEDELW2G4UhHdgABSmxrNRpP2ODLEDC832yMWbh0HsKqABswH2BucVGhzR0Q7Q0BoKf5bqH7aMSMtvRlwhBMegnz3XH85vQE2PUBMIDBoKkjr6fpwKf3B1H4hGThbKjy1OwzgHtMH2CaesCE/5yXUlciLd9ydgaR7SUgFj1+wyNEl1NJ1sBxwwjxxG/4SyrM17I6wjY9Hrl0U/BAGylUh8CfzrCymK2zVP/IKWmdfkqS5Vptogs4ECA85/lCOB3/1YXl71EHfveaBwkhXR/DcE6yUuWC4b2SVDna1bkhXSLNnBgLVIFp9VBKHBOtvn0fy1zQ3/nKDa8op+53qG/rb1YeUNowAkMqKMa9DQ8AOEyb5S2ZdXXjMyG8Xwc7E2/CLwi5PjbV4xe+7/xd5THyMpoTcvvRWOyfebdJWKmEQ99NBIV0wwKaSgoCDNE0ffWoYAmJMyHpjfeSBgl2gNfc+4l7ls2x1tk7T3FPl2DuJHu54KuTTw/0hYiqcx5Nh/qOXB26aFOl2w180Dh1dwngF4jJSXVljggczOLE1gimiMWArLQZmEjvFMY/t7y6xz82Q2rnl015SmXjeKJL4mm5nPkd3HemAfzYa3og3zvL0CvlufZGno54jroKqi8sh08w+AvzehpDh+xC7/uH0PGaMIHn66fZc8N2B2K/tjH+BbUhcDU0NsToPHmtdxUx88iMWDhzRmzb9/McmuTVrXNyClOrws0OfhuYIVrI1kDL1hI/pVXNNHxIUqfYSewcHE8gdoLUdd6nwwScn+pIp+J9V6tgccykswu/Uwg0dNNx1BJZ1gPH7N5p18CxwCBNlPoH2rgY9C9zjz+wurGRb8tmdZALc3K4AH+XyiwEeX/m4xWrfNGWYO4bphaG1OWoJVfnDb0WXQl66eIhp350enQcVPTGq4sot9yo+qafctub/yuXfhyc6DxfineuD4+WZQyY88F47ykQMfoNmlWz2U8j4Q1iRq7uZ+fPlt5daD1EJjC0N8JZf7ywJEXfrlMh5I13o+W6ukdg5S7HmqRJWtI6sZI9P/0+lM48egojVHpp1Kjt9vRZ5Fbf/fvtxB3xWl/6VvWAcBbcNL5mNCnsOhlSdkfj0JG0/k2fqqIN8EnVf71Jm5MyYRSgpTFFLaDzC/2dlz9CBl+f2vGm6Gc5+8WtsgyZFz3JpS2PWgnuJ85Krzb4lB9/m2eDS8Qi7nSevXfkDIy4y6x7uYjMahUpo+pyBx4QvKCa3FMvOzANdJQBA4ODg0+5VqXwYq0Ooy7SDCJ+m9HLrRz2UqGNa92lFt3tmc+LLUycxbuLDejbf6i9KAW5aJsDhH8Rjqc2zo3yfu9roPXhRWghHjspI9j5IbePzlFdWWki10xA78qjMqCBoQcRMtpdXdscrfpyOXJ88GHGnHwKoy70mpB+FYVbQN+4ByHVIP8an4VlWQK4MTz4HHTyNSv0pp9f9OD/P78XkfmTUteQEvJvbs7Zc7BXUFHVzPKLVgnoZ9jpdK+I/oEuAeeOc+qqqX4ezw7ambG4661CKP3OKIL98GtWJaLnEJ+P+2C7G/G3uLZXsHSjwBqZdtgsrbJyFs3F9CuvrRJ0XDe+7EztZvYo4dscyNpdocFnVpiL+zhkQ+jVr03Tz+Nm+lMRTltWIvnlREmzz2WA27JZwYQ9gMsNTSJBhcHbA+w5s9BNvveWDfyRTGyTtqSwbF7gSQvN//SSGQ64Oh6NHYqE1V/tY3gg3+lT7h0kdTtGVxM5iGhmAiCgpC4Xf7hL1Tw0HYKEmu9VPC+gad+ujvfE6GkWjm/a4AANVkjfz2KwDIywd4oBjjVYZCUgFTCAb2wWLsT7X6EUipVHHV57kzeyeCQwj4kjwDD0hydminnd0B1JfSQbrl4f6Zf1VPxv0tegKK4xWq4UegYNejj9CbTGjK1vC6D8aSNdrbO08Zzf/dJgrkIXIdF7Y0XIBeteKC0zfZqrZvQ64gVhG6ESDz8d8cNAR6hcWbIr98GjVhnXYAE0dPMFqvLCCy7zMrJqaFXyxMX92pfWXNqDOP8cEAOJ64swgTm2yS6+xnEIRESmgX9yL0oKU5QNyj9ZS1q6sA68FMdcXEjYsS0XTMXfgsQjY4cDvwCFeuK1wDLLV9PIyU/yNCTnO8wT7Aj292miNp+WXJh3LrK/fN7G2dXK4P9r9ntTWOx3wvaDsbmcnzKfHbiFGEo88F02tcORGJ/adZcQi464iqb7dd5qHWq17glvS7Y7ZYhxas/9Dlqs+h3bBXtQL+BnMsSViK/nw==,iv:QPt92L47poXKjCEqx5gF2etXysIKUsz8VIxVyOjoncI=,tag:oHjKnLoZhlJS8CD1/H4IEw==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1c8cqpw6gnlrf82ewm2vj0yalzszvtzd0mmk5yzr4nfpqqseynq7q86f3sq",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4aHlET3RZbEZ5anQ5RURm\nZldVMHpGRkhCVUlpRk9BUFlETGVJY0xONXh3CnpmN2MwMTgzOHpsUE9ka0hydFha\nNG81VDFhMVIzd1hwOS9CRU5Lalh6SWcKLS0tIE8vTFdBSkJ3VHJoQnhyOHVxMlFu\nem56UEhyaGExeHJvS244TDBtVUpqVlkKlkPhQL/XCQhKr74RCQQ0ARMnFv2E8RBk\ng3hXBWYK+/kaDjpBCqWOyqHbfWU0oaowTPPQKnV0N3B7E3HJNuFs7g==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-06-22T12:04:47Z",
+		"mac": "ENC[AES256_GCM,data:WP/KujDP1d1YZzMXfBzWarr5IL5NoTjYQkiGzwEcF/TayvH4UCLEZWFv/S13Xuq5IeEXqikkss7GQsJW+EEEVHldJHyyquK0ylIn/op+fPpGDKCsEAFpKYUOHMJPGFTFhp0JSnvGm2c2qgrFc5GEVayGuckUuCu+Z4FPv+v6pvA=,iv:5Ts2NAkQVgVIxCdj+P47rg8z7tmiCreFKzENTiE0KaY=,tag:wzAlKEufgEl6SZXuhQXeqw==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.8.1"
+	}
+}
diff --git a/apps/zrepl/storage-remote.sops.key b/apps/zrepl/storage-remote.sops.key
@@ -0,0 +1,20 @@
+{
+	"data": "ENC[AES256_GCM,data:y9TLuaj8JPtCeqm4VkfE7rm03Y6vHapz7KjXuRKTfdMCZkKB7uXepsCljqcpZJgX+kn5SLm6maS4Y2z4Rkb2F2TyfS4bX28Hztn3BNFlYDiIvysTfzlI3j/kV2B4wWZUG7MT1EUzlmRS3cj//By2AVoNXCVV0YEljZqVnEcidEra5AmckSo6S0eP6MZJp3Qscf6TdRF72TqhsPMcVz7G8JVwnvslS/Ycii1OjOxrHrN84Fb427pjtJ8PODKhn8by0dPFnaXUao0L0OnsTL+4x5EnqGS41EPbz3zZfH7IFa6SV5+0e6HvG2+B8KI1pF4dOwRu5XC8lw9Rq/GE0FHyafGLDToea2rQ9OcxMwxHz2zxBKeIcpGb19uNFWTH4j34f68wiGNnvMIgRxDAzD9CZgu/QfD3rH5N9S2/FeD7pvwQOzYO00JnJRjPknhPnGRKTefgXYb4YiYNKj93d8gAnC989tCQU1a3UAQ9CzhzK1lASj92MxZM3jt/bIh1pczHcF8r8UKF7N3Ig/ylBMp+qOPwgSPlVFTQ/2MrwBojw0l1qG+K6vy5p++dY+qknGKYhZbgrVlQeKvq88S1JCNvnITDSgt0LjY5+/S5UgV/qB7txq10pUDYH6sCBoEjiQJt/QnLeXvs1NSwLuYMoWM3a2oYyXj/dmqujos92iLObW6FOCxFdzROfUZ3+RrPwQJ7MhOl9tOazUW/iTx2QCpqrTzPhD3YivGqy8mTy/lKoiw0OghFzPWOjlOEKLXiubF+Fbs+5E2ZVGcTR8NIdS217Mi1J3H0tqTYg2tpJB8awfxOwIR9n4y7AX4Jmgc/61qj8yoxG88yBKBSUsNkfpSHLoPa19EDEnTfn7JRH4+ndNhYwof46B7DYK4uNSTz6KRHoJ1S+BJ4jaJJw5xnvWpttrNFwOHYsGRt3zH6Knsb1MyRQqOYWBgec8zYv2s13GpYMC+TaDadkhTqUsm5xNgES6F5Pp8rF/DfI7a4CxNfaUCpxSFz+pe2QjIGNcaw5Aso/UmWgIFXwmLhtg0PdjF/ggB7cumUNg6o0Tvb2EcH3TE1xOVaFquOT2oGSyJkDvLzGao0lyduhJaRXZeda0ojexjO/uIL/bqIlx4pg6K8o7TvkcF6ZQn51UJZEFn0LMHJeb3BGt25wDOGJG0U9WS1ZMwnfDaQ7K4bFuUpiYzpIOtY99l2FeYD7AgkANTZuy8xTAPz99fKP18I4zXdIA7ru1aHOTqW84tW06y03mlyN1xX2uIejxibZR8dRfYHesrdfY8RYgHsiIAdnFzot/shDhSwjQ9TZlxXQQkUpMs0K1w2UDJSzMEvg95QDDsG5Vt8Dq9vkuv+DHcbRfFBtcqWv9Nt985jW0CPN0kzjLXXftmGuUOGo2DqNSshNULCarGOYYxNDfEjGeHSM9IY+Me7YqqO1+8vdcQLx17ail+ReLxIotm4LNK2CTTM9acT3NIjhFSxLl+B03Mcg/MmWVxKiiXVilZQ1gVXDjaIKopZk9o7/rSLmb65tm/nJAogR/xEVqf/dW84eES+hkp8AqlpZMjgCez9DRliq/c5cXnDIs/YWU+hd4VVAgD91EVtzr3ZjVchpwQEumATUcyFGYDeXHrX0uR3n6vPyEv98txvLLcFVX8J200Gur1aC4sGRgQySMfg2+3pd08ayvB7ryY9yCQtvhTU129N2K8RxRwAVRkZ67EISCQPLmxXZC8wHQjWHRwtkKGtR5uYxcfXYn9aHTS7Jvg/6ZxnVRCRRWMuY38wOrV3btUIOq2SRASKGFaSADZODCIZ7r1c6mYrU0jhu0FfNVY+WwiiVdJLlxuy80b0nY5aISiSVOQ0C5WHI/Qz+rSJOrpSwmNHwAtZE4RTJ5NZ5RZy53zgoVhPCTHXK5wHagNvQK3qXmFxDttkdPIJUs3uxHFGnArcb3XAC0EaPPXfVzXYfNIfHTJdre99lr9cAvb8NGTxEwvrFuZ5PLsfzfVokYYIcoymeeJl20bVcn4XXZV5GEWhzY+cFwipbW/nolle4EyTwI694guH+4gLw9xfaIdMc/3Wsr6w4BvGRXxldoS8309Tt8Ps/Y9cO38+Q7tfNoPHm5AEGBKQYmSPHwAyXYkfzgJwO4zRyZZ/4XmlX3gMNFmHblJnpGfsTZHLsw58Fgyz6cKPaUepD1FAhKoV7DUQAZqaB6ELUqzFg6vwPvtwJioELklKgKu6CvG2MAEaoRykkEHgDZQMLUtnlBVtycXjV2G/0sP79fg7AG/CzCXnVR+XAwVG1YpARO18VSIVMCeOdh61Uzf++cx5ahwAsxnpn3ARtb/ncLJ7kPW4ulVyPGkj623CZmfdiV0bSAy4YTgLvDjOkqF/I9LQzirsubQZwTUZkHpWouQHzLhcuG5VccykM2wUjd8I8eRilteu6yGgz+WOt5JDFD1E72P6bxeVpGkPsPPLiZykPtvL0Q6FEMOPR5uUEMLoBMrqc9lkIdG63p4J0HUeoalIYPigSdrSY8g7UGEYc5399gTdyM/1GmH+Twf2rEBj6TMbYVt0mMzR5Z6H9SPccr3mN3G1WIhS6BRTqZ0ghj1uX2y3Lcv/ZzvjoNkoJiX4rnai5U+Frdo4z5lgtNqfej3dqtRGm8mIV0pfs1G+MgM/871oXVhnoHVU7faZqMIR7wo5AloPZ8tCWTeBsMvgTkN+FfNU2qGLAifz7bbZaOBa/lsF/kVrpNk6CWaQDMO74xbuB/Juuvmaqx9AR8ytSled4m8qggF7N908D4JH5wPW8VRD+bJ6E2Yo1CBnSBoHBQIY+GUNptlJOswjFhdUAQOAF0zH9yWVylFFSnlXECk2XmJR54+HdUsr2bL0p9VMzAKr+05DF64lT/8/VonUcom9GnoRhP29npfupF1WWIFEV1xUWxE+zBr6VOFBHbmiQmsKz30M42awIN0KENIDP++BBojQ5Exlab6FOGplMmLfaLBHoN6Iw2EXyb3RbcYkQ9TwXBfYzQ4h5DlvMVAkvV9VG9TWLbru7ugRjNAOvjI88aWnfn6xy1UskkJ2j0mI9gr7YTVxL7Yo4estnL4AFPL9f8yRqGs0RYsHG068QG62LdUySCqkpSCK51TI2PtwCHuM94GQkOYls5wIQzBVslqWuwstpjMoFf2gklH012yVYv01CQ96gg4KHlLESwsVB1F+vyYUQyjogBMrRzRmziAMyRn4168+B0vB6WbUx4erpLFNC7OfYylJnu/x7XfYequutdnG5aztcWgsln3DCuGokCB6wp3LYSHt68mnHu5S+BIsEQj72OCiXgE7AAEmDDwGkuzVW47aEKk7FfzPLu9lzVdAWeNXV63XJUB5LsD2PloVcI3Vvgpzqf29+m8NbZPr0itTL/BUMosCWIexCWpmxraASBoOFPXKEMQT1ILPwkA6DeZewsqhJ3Vcsd7BPs2pju0AsGFRm5sR3QtKKGfmP/1v/0mePInqUQyAS+CC18DdmYyksvnQWDEvjbI581tLLaozMnlAZ2V/zPTWBQBSRmAulS9NGifK3I2MBrTLUBIG1cFAPBqGI4QdbqDd974L1nG2iytl845giMNtJmyVpwomTGFd9bXsrUcB8n9UQ+LBhI5aaDbRPElqm0HCM+2fCvDMN1LF8KaVO3RhnN+7iRVStwjcP3k3ldUrrRr5eegb/vfwg2pKCRoGoe/GKJB4lgQ03O4u+F456IM0k6v0M50H7ioFA5uHHDKvOt/J1nT7+sqR8H101ksDToWyxSipRVYka2Ov8+8cm3Cz8Q9yRQ1a1aaJL4C1LBwQAFxvrxREB9CIuVAWJel61JBd/yJEnEO6Os0jkXmeimVVtDMgEPYIE975vvtQGOfxZBs3HLgfH7M59GVICVNR9eeYzbilDa4oV/RFfsS4nBRLDtvH5Cxff2nTuuewnztdOHCL+gsWuBQ6UHVDChS3DEf4FkxsNWI1O6zTtNMtxt8G4fgPJQo2pQ4CN3Q0oQRhMayofvmJF/bZr2foVsYVf7wEqSG1f6VKGN5AFcQnDHE43DvDr1yCXFKh1B3iHOIlkKeZ+0n5Vgu7yZ5an9nOiKWJAZ1+DjjzLLlhq5wJXGbfJNB/UlZPNBLbMc0pH7zDdcdFiDwKKU5tdoHWo+zLxFX8pq0T8tQYLLpxOPrpF9CLjNxnPOxh8ZcN3tOdUENSYJ+Ctcm4MxYqRVeElRLjm9OQJPs5KwcTGAtxARHO77SWMxoSnNEOv71FEv2146S/b9RbKbwRCB5jwTxMIOG7PR+IZcJiADn9nVu2ETLlBfTfOflG3dRC8eY1wOyouZY+LmbXHk17+AYCHUQVpMNDrroG/ihrQ3Pl/s3j06WZxe7GsVkUJfPjUmVClb4=,iv:fRlJbhR8kduE7+xS0idgo2mpQ1cAQFAxS1tNTbiCcpA=,tag:2Yijo0TpcBLuxS/+EvVgMA==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1c8cqpw6gnlrf82ewm2vj0yalzszvtzd0mmk5yzr4nfpqqseynq7q86f3sq",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVKzV5eE1UUU00QXZuSi96\nb242Z1htamdNcXJxVnlsWFF3dzc3cE40WlFNCkRNQ2FmckZGMy9mbVNLaXVEYnhP\nS1EreE9rZ0VQak03TkpsWktWSUhTOVUKLS0tIDFDZ2lUbDhmVXFMZkJMTzg1Q2My\nblBhaUpza1l5cm55N1ZqSkVBbk5ZSG8KzS+IvpyaEeKIEcDl2sW+JrzyXTjGrhBc\naTbFfCikjCQBUdaZgZ9WgxK3XSXYewmXD5CAVo3nK1ORKLroRryU8g==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-06-22T12:04:44Z",
+		"mac": "ENC[AES256_GCM,data:DFxoxKbxckZ/g/hol2jzp1VT0K/jNOEs8UNtdpkNKgTgycMpdKCILr/4krqsVXLJNbDxu7eQbXmV2qqimiBE4diFXmnTL1yuUqgmQvvGWtvyfRG0SLvar9nkWp1fLdekS/A/DC4odgcngnI/n1wMjc+Kswrno1F1yakWtyOPY8E=,iv:fczX+fsh/hJL982ONWhqK6ZadVx2db66e9I/6DNSQ9E=,tag:kH30ex/v9fY3817LcXHheA==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.8.1"
+	}
+}
diff --git a/apps/zrepl/storage-remote.yml b/apps/zrepl/storage-remote.yml
@@ -7,36 +7,14 @@ global:
     - type: prometheus
       listen: :9811
 jobs:
-- name: snap_default
-  type: snap
-  filesystems: {
-    "vol1<": true,
-    "vol1/apps/minio<": false,
-    "vol1/video<": false,
-  }
-  snapshotting:
-    type: periodic
-    interval: 720m
-    prefix: zrepl_snap_default_
-    timestamp_format: dense
-  pruning:
-    keep:
-      - type: grid
-        regex: ^zrepl_.*
-        grid: 1x1h(keep=all) | 24x1h | 35x1d | 6x30d
-- name: snap_14d
-  type: snap
-  filesystems: {
-    "vol1/apps/minio<": true,
-    "vol1/video<": true,
-  }
-  snapshotting:
-    type: periodic
-    interval: 720m
-    prefix: zrepl_snap_14d_
-    timestamp_format: dense
-  pruning:
-    keep:
-      - type: grid
-        regex: ^zrepl_snap_14d_.*
-        grid: 1x1h(keep=all) | 24x1h | 17x1d
+- name: sink_storage
+  type: sink
+  serve:
+      type: tls
+      listen: :8888
+      ca: /etc/zrepl/storage.crt
+      cert: /etc/zrepl/storage-remote.crt
+      key: /etc/zrepl/storage-remote.key
+      client_cns:
+        - storage
+  root_fs: vol1/storage
diff --git a/apps/zrepl/storage.sops.crt b/apps/zrepl/storage.sops.crt
@@ -0,0 +1,20 @@
+{
+	"data": "ENC[AES256_GCM,data:/RehgZ/AIyNyKqdqhmIiheQysGQ54Xy4wgUizwXwnBU7i1FLNyUOKLg5vZeOtVXLdpoqnoz0IiFUB51bLNREZ3iqeElHO4hH/VpxxsdQXVizPWv67piwsb6/HCdWc8IgFENNfNga6eN7PZBcY5UsruIHP5MGgG37fMYPR3OPCYfWX4EARxtlfgDHiN+MSkbdci6e/3S9J+PuxemdDmTTfPJK5k8zYN37kwPNAYum8n9C0dPn07GqHRJo6kR41ZtL45vRwa0cLz3iBgeNiQHEghXHSyfIF3B0Ukx0Tc41Z0GvFroM69lY8wveodMUGif/4XA1X6Ar/JISon477+VKLvUPjD2PLygVmexC8aaAoUei+WGoj88SSmYw9AeCzUCyyydRQ8ERaOSqsvmO5cazkwTY2+geIHXhrQlZN2slQwA01kmarKupbV3JxmUMTnZEDX/Z7qZeWSTrwzxPtYDoTsJGWacGDH6+PKyemtjouwThCp9OVOueN4UNKY9EFsmZtc1rolIGTWArUcgTW3lGJDQ8VmA+E258jjRsuH6+r4ZlhFM/d3P1/snm8ZKjeKjDlWb3S8DW0VVWDufwNm8LlX8WJw6zwuHg3D+A/GOIovK+OJeU+MWJvABWfL60UKZUVbcucvKFwtGVo92TsqUCifMg0otFpIpxdP2ZD3WFSz/uPN1IDJkOgabjLqE95fT6rEJIHpWEQIwdQ1Y790d63oXEbo7DZSBhUdEb/3ylyxhJOgAA/3KLG4uvxTVhnBO3e0BkpU64aBYFdQRKuJUWDuFHWb+eYdYp6cGcojdZaWjiwqQm6IaYxSnu9BgIs7feXbdgckHehIUoRW6PiltSaSsE0vrf28k4fvaMARpkTvdLEnl/DrkAKLuAVFqmi4X+pMyAV4i3YIjgTh7bNVD12KWwNtlXGWxR4VaI/hCzUIpyYmee9LEBX32eWiLMCQcWs7VBLkEuoNP+I3pPpdPNAWZb4HIyKqgDw2pccUuwb785r7/CTdAwGW/kwDgXPiSmbmZpI/s3sZAAfm4rLfwUnewgTwY42vPktfhBXdg9PcSYT3ELCh3XcSoqFMQugKzihhFU2Cga8wcbcgR54kbqHnGqcctBDToUAG4uQLNtn4Xmb7rMEgw5PZVtMbXcheX6tGEubyTLtrd9P7qbrcA8FIDarMrgkygmqeemwCHUXDuZMkwMCaDoQ86uGPAC6iQNNJ2wMpvCZbkM+QjwRgKZLABMK0PE5S0012Ic9IRKIewVJHdeXp++2vNZVhZ9AUFLs9unp89FYnHDNSHc8QnAHIzPsrjWFERTOTsHNuSO0S8jdSl1wSSNSWN28bMhAbb1FmzqET3CGT/ON6APKxOLESOlYW78l/hduBBaMOqec3tWFIH0XtDVpJF2VTl60tWx4hLCDX/iuv98kRZ0Ee8TvaAQcRHkoSkzpEjaBrOpLoJ10KnBnNzPEWH84iDLXqq0C487wfEEDPsW1hKS/vgxgIwlMqFjhDFNgOeo7VlMraW2szHpkSnSYSWwa+nl+6ennlPZgvUuuu1FC9pPaIrHXuFZVmrUihZF48LGD5l07sxL9t8BQyIQ3cn5EETIfHRocrScDUu2skiuESkayVuvD3MLdw+MJFkX08fEXUvDDrFMRlZ6Kc3ZUvCCwF+R6Rmsy56+2hqT6tyVnWeCyVbsd9v6y4AqfcxzRTNH3d46+DDJbsHRMA+qkdhbKtyRSzXJltfkDdSxPAilyDkL03i8ZS8F0l05JQ5ahhMSOl0CT8ksBsl6edgH6HfeDYbHVjfZpzUD1FRhvG/LsAjv9DnRTKjN4EgMXnhMU4Y6IR9XT6bA5R9XX5ueB/itn5ghXDF1hZ481SbY3cwG79ex6fsAgRuR8GnVL+asWw32V4tdtfHUcmmL756qmxGssWwNeqI7yL1+Y69D5TcsYH3Bl5aeXX7WE4L+jfZeCHio2Uyit1Gcnl95rvKAT5Zi3QC3t+fDyMS+i7ZZjYUqAYZctbl585QmjOf890d96j9KKfSoKbfRzUWsMgc64rvSA+kZiRpmQ6GKDkcrEAt1r/Vls2Ef6dvjXl+26T8vL4WkJ8G1d46Ut6oZ2NgAk6W1gwytQYIQx7MS52ykfCuO6B7kfvORzDFeL0+DSE9aZVjpCSG23JgndyELPzYqlWUpLPr1TtwlLTdMSCVczH/mchx++rC3Z6qU88JVcYQ3mLFrf9pdnokmly+3CCoXFfoKP8myjqJy/1mLHdCJ0ENUg4RDotjLpZvgm26hWs/+Ak6oGxG/WoFsMfSrvOP7h1dtzWwpt/HfBEzxP62CyRzlr4fQaPMz0qJN92Bx53Nyf17995axhd/uKo7VkBYyWRU3p8skKozPwFsOzw5efPWLMqzkimZitLarGbqrtXBvvu0XQ4/mw1LkTR8oZK6Ry/biO786+8SqMLOrH526,iv:FZVCi6DYDBqfCHCaq8re9TzzEuIuh3VLc4tMehf+Ae8=,tag:iHP51NmyaCzG7xEV8ylEdg==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1c8cqpw6gnlrf82ewm2vj0yalzszvtzd0mmk5yzr4nfpqqseynq7q86f3sq",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVcUlJekxMQmhQUy9oUDdw\nUGl4TkltdXhYY3pHZzhCSmpuaW51dWErQlRZCkozSEFiVUUyaERJTHByaER0NHJU\nT0xkbFVPT2FwOE5LWTYxa2QweDM1YUUKLS0tIEhNNE4xS3VRM0duTjN6dFZhN05h\ncXBnc21MS1VReitidFpYem16N2tBUjQKshCv6aZ/HMMusfvx/tX2vwgfsxgpmOmX\nrFhIib4Sb0GnF9ZrbGS/EeYb6WOprDAIbKUChMZDd+nI8KNXQE8qcA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-06-22T12:04:32Z",
+		"mac": "ENC[AES256_GCM,data:5Pj3FEBFwxOPSshUgWuZ0yNjee+4AtIcdXTYwp9qJenQjbd51N5lXEXf5V1D9s2oaiSAqiRK52DXfGBDdZ7oZUC0UHUAed7ra+uJNHzySCe1TwoaBQeED281SDqH1j0MgmUUCmnhSK5vqU6LQsSHtBaHETuxawLMAglfBY2wNY8=,iv:vLqtJQLzEySzcENDyBGAOukffmQTljlV2vqJdfZbQw8=,tag:yXNHtAeEKxaArpjUrUUq+w==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.8.1"
+	}
+}