diff --git a/hosts.toml b/hosts.toml
index d575643..f6a1926 100644
--- a/hosts.toml
+++ b/hosts.toml
@@ -1,3 +1,5 @@
+# Desktops
+
 [kroma]
 type = "nixos"
 system = "x86_64-linux"
@@ -6,18 +8,26 @@ system = "x86_64-linux"
 type = "nixos"
 system = "x86_64-linux"
 
+# Cloud Server
+
+[envoy]
+type = "nixos"
+system = "x86_64-linux"
+
 [sentinel]
 type = "nixos"
 system = "x86_64-linux"
 
+# Home Server
+
+[sire]
+type = "nixos"
+system = "x86_64-linux"
+
 [ward]
 type = "nixos"
 system = "x86_64-linux"
 
-[sire]
-type = "nixos"
-system = "x86_64-linux"
-
 [zackbiene]
 type = "nixos"
 system = "aarch64-linux"
diff --git a/hosts/envoy/acme.nix b/hosts/envoy/acme.nix
new file mode 100644
index 0000000..c257605
--- /dev/null
+++ b/hosts/envoy/acme.nix
@@ -0,0 +1,30 @@
+{config, ...}: let
+  inherit (config.repo.secrets.local) acme;
+in {
+  age.secrets.acme-cloudflare-dns-token = {
+    rekeyFile = ./secrets/acme-cloudflare-dns-token.age;
+    mode = "440";
+    group = "acme";
+  };
+
+  age.secrets.acme-cloudflare-zone-token = {
+    rekeyFile = ./secrets/acme-cloudflare-zone-token.age;
+    mode = "440";
+    group = "acme";
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      inherit (acme) email;
+      credentialFiles = {
+        CF_DNS_API_TOKEN_FILE = config.age.secrets.acme-cloudflare-dns-token.path;
+        CF_ZONE_API_TOKEN_FILE = config.age.secrets.acme-cloudflare-zone-token.path;
+      };
+      dnsProvider = "cloudflare";
+      dnsPropagationCheck = true;
+      reloadServices = ["nginx"];
+    };
+    wildcardDomains = acme.domains;
+  };
+}
diff --git a/hosts/envoy/default.nix b/hosts/envoy/default.nix
new file mode 100644
index 0000000..25d91a0
--- /dev/null
+++ b/hosts/envoy/default.nix
@@ -0,0 +1,42 @@
+{
+  config,
+  nodes,
+  ...
+}: {
+  imports = [
+    ../../modules/optional/hardware/hetzner-cloud.nix
+
+    ../../modules
+    ../../modules/optional/initrd-ssh.nix
+    ../../modules/optional/zfs.nix
+
+    ./acme.nix
+    ./fs.nix
+    ./net.nix
+  ];
+
+  boot.mode = "bios";
+
+  users.groups.acme.members = ["nginx"];
+  wireguard.proxy-sentinel.firewallRuleForAll.allowedTCPPorts = [80 443];
+  services.nginx.enable = true;
+  services.nginx.recommendedSetup = true;
+
+  meta.promtail = {
+    enable = true;
+    proxy = "sentinel";
+  };
+
+  # Connect safely via wireguard to skip authentication
+  networking.hosts.${nodes.sentinel.config.wireguard.proxy-sentinel.ipv4} = [nodes.sentinel.config.networking.providedDomains.influxdb];
+  meta.telegraf = {
+    enable = true;
+    scrapeSensors = false;
+    influxdb2 = {
+      domain = config.networking.providedDomains.influxdb;
+      organization = "machines";
+      bucket = "telegraf";
+      node = "sire-influxdb";
+    };
+  };
+}
diff --git a/hosts/envoy/fs.nix b/hosts/envoy/fs.nix
new file mode 100644
index 0000000..5b26a6d
--- /dev/null
+++ b/hosts/envoy/fs.nix
@@ -0,0 +1,29 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (config.repo.secrets.local) disks;
+in {
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/disk/by-id/${disks.main}";
+        content = with lib.disko.gpt; {
+          type = "gpt";
+          partitions = {
+            grub = partGrub;
+            bios = partBoot "512M";
+            rpool = partLuksZfs disks.main "rpool" "100%";
+          };
+        };
+      };
+    };
+    zpool = with lib.disko.zfs; {
+      rpool = mkZpool {datasets = impermanenceZfsDatasets;};
+    };
+  };
+
+  boot.loader.grub.devices = ["/dev/disk/by-id/${disks.main}"];
+}
diff --git a/hosts/envoy/net.nix b/hosts/envoy/net.nix
new file mode 100644
index 0000000..e09dd5d
--- /dev/null
+++ b/hosts/envoy/net.nix
@@ -0,0 +1,38 @@
+{config, ...}: {
+  networking.hostId = config.repo.secrets.local.networking.hostId;
+  networking.domain = config.repo.secrets.global.domains.me;
+
+  boot.initrd.systemd.network = {
+    enable = true;
+    networks = {inherit (config.systemd.network.networks) "10-wan";};
+  };
+
+  systemd.network.networks = {
+    "10-wan" = let
+      icfg = config.repo.secrets.local.networking.interfaces.wan;
+    in {
+      address = [
+        icfg.hostCidrv4
+        icfg.hostCidrv6
+      ];
+      gateway = ["fe80::1"];
+      routes = [
+        {routeConfig = {Destination = "172.31.1.1";};}
+        {
+          routeConfig = {
+            Gateway = "172.31.1.1";
+            GatewayOnLink = true;
+          };
+        }
+      ];
+      matchConfig.MACAddress = icfg.mac;
+      networkConfig.IPv6PrivacyExtensions = "yes";
+      linkConfig.RequiredForOnline = "routable";
+    };
+  };
+
+  networking.nftables.firewall.zones.untrusted.interfaces = ["wan"];
+
+  # Allow accessing influx
+  wireguard.proxy-sentinel.client.via = "sentinel";
+}
diff --git a/hosts/envoy/secrets/acme-cloudflare-dns-token.age b/hosts/envoy/secrets/acme-cloudflare-dns-token.age
new file mode 100644
index 0000000..612643b
Binary files /dev/null and b/hosts/envoy/secrets/acme-cloudflare-dns-token.age differ
diff --git a/hosts/envoy/secrets/acme-cloudflare-zone-token.age b/hosts/envoy/secrets/acme-cloudflare-zone-token.age
new file mode 100644
index 0000000..c26ae7a
--- /dev/null
+++ b/hosts/envoy/secrets/acme-cloudflare-zone-token.age
@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> X25519 Y7J0KmGssDwytzJSMTKnb2qVfCBEl4nMiKeg4PDhbhM
+R+FV22jr0XcybGJk8Z2o40O5ptRK3NPgQOxJ7HlORho
+-> piv-p256 xqSe8Q AyC1XlhbGhbfUBn4gV56t48AazKi5Lt9H5BCOZqbTtOp
+s3mrvVrMZ/kTdUSjKyBWa5hUFL2fwL2xRo7UFF0AwP0
+-> Ao-grease vp@ m_b
+oV7D7L5dZtF75bJ6Ms0yZr92rENJmE4xKpdlBp4h40onYWv1Z17R2/bmygv5MD9+
+S7J25g3rxfk00fUOK8cwDcWyRtp4jQqcooJyrQ
+--- J/aXuudcbUAfU06R065fsvPTX2qZr0w0eZ9gI6I+McY
+v��-##��=|ڕ�-I�R����n<�z�f�.\���cU/O�	6��뼱��o���$��8\�6E��e��n
\ No newline at end of file
diff --git a/hosts/envoy/secrets/host.pub b/hosts/envoy/secrets/host.pub
new file mode 100644
index 0000000..c7bc451
--- /dev/null
+++ b/hosts/envoy/secrets/host.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHgdSxSAnqaIqpr7OhyaKXGfQLUWf2bkpyF2mSG01LVv
diff --git a/hosts/envoy/secrets/local.nix.age b/hosts/envoy/secrets/local.nix.age
new file mode 100644
index 0000000..e6ade60
--- /dev/null
+++ b/hosts/envoy/secrets/local.nix.age
@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> X25519 Iz/ZYzOsB5ONZTT2azO8HcfvwEdS8zjYv2a+gdSa6Rw
+3RvSD6jq4IKXOWmgFiLK0OgZkvrbRQZLqlYgiVMixAY
+-> piv-p256 xqSe8Q A4BW1CqEWMOdGkIjIqvXJrzC54BBaEbnhywgd1UA9gQf
+lRdaSMaW/xFvzBYk56T6ld64vrFS4EbQdcJJarOd2hE
+-> Xw[-grease ^u-qoTf JV
+7ht6GO0MH9xXNpmbVpi/NYiy27V0XHtE+qNmMqZSj0/rVtnYWMhm4Ezu+3Y
+--- EYikW64z1mfwwVgFevfGeo4Sp4994H8WnvbJ+RfxMnc
+P�l�b�wq�Z���ޜ�9������:V��l~(ރ�#x��V[�|!��ccVn�%�
k�Y�r�;hS)g�gEL���wZA�JH��j~a���{�*�C8�
+�b�i!
���#�	K4���/3�$I�c7�U���T��j��f��j`LX0f�hO%~���*]�c��񭯛��R�A�0�y�0�v���#{�C�.BqW-�����1W�7/jȔ�}!������/���Eb%Ԡ���t�q��!��e>g��)Λd~����yA
+�Z��N���쟞mo�|���rX�͈�6T$�~5���͂Rj>���zh���K�Ie�d�}�N��zZ����e`e�݁�b~K��]h�1����yF
\ No newline at end of file
diff --git a/hosts/kroma/fs.nix b/hosts/kroma/fs.nix
index 08d8221..d801358 100644
--- a/hosts/kroma/fs.nix
+++ b/hosts/kroma/fs.nix
@@ -7,30 +7,15 @@
 in {
   disko.devices = {
     disk = {
-      ${disks.m2-ssd} = {
+      m2-ssd = {
         type = "disk";
         device = "/dev/disk/by-id/${disks.m2-ssd}";
         content = with lib.disko.gpt; {
           type = "gpt";
           partitions = {
-            efi =
-              partEfi "0%" "1GiB"
-              // {
-                # FIXME: Needed because partlabels are 💩: https://github.com/nix-community/disko/issues/551
-                device = "/dev/disk/by-id/${disks.m2-ssd}-part1";
-              };
-            swap =
-              partSwap "1GiB" "17GiB"
-              // {
-                # FIXME: Needed because partlabels are 💩: https://github.com/nix-community/disko/issues/551
-                device = "/dev/disk/by-id/${disks.m2-ssd}-part2";
-              };
-            "rpool_${disks.m2-ssd}" =
-              partLuksZfs disks.m2-ssd "rpool" "17GiB" "100%"
-              // {
-                # FIXME: Needed because partlabels are 💩: https://github.com/nix-community/disko/issues/551
-                device = "/dev/disk/by-id/${disks.m2-ssd}-part3";
-              };
+            efi = partEfi "1G";
+            swap = partSwap "16G";
+            rpool = partLuksZfs disks.m2-ssd "rpool" "100%";
           };
         };
       };
diff --git a/hosts/nom/fs.nix b/hosts/nom/fs.nix
index e729121..fd6469e 100644
--- a/hosts/nom/fs.nix
+++ b/hosts/nom/fs.nix
@@ -7,39 +7,24 @@
 in {
   disko.devices = {
     disk = {
-      ${disks.m2-ssd} = {
+      m2-ssd = {
         type = "disk";
         device = "/dev/disk/by-id/${disks.m2-ssd}";
         content = with lib.disko.gpt; {
           type = "gpt";
           partitions = {
-            "rpool_${disks.m2-ssd}" =
-              partLuksZfs disks.m2-ssd "rpool" "0%" "100%"
-              // {
-                # FIXME: Needed because partlabels are 💩: https://github.com/nix-community/disko/issues/551
-                device = "/dev/disk/by-id/${disks.m2-ssd}-part1";
-              };
+            rpool = partLuksZfs disks.m2-ssd "rpool" "100%";
           };
         };
       };
-      ${disks.boot-ssd} = {
+      boot-ssd = {
         type = "disk";
         device = "/dev/disk/by-id/${disks.boot-ssd}";
         content = with lib.disko.gpt; {
           type = "gpt";
           partitions = {
-            efi =
-              partEfi "0%" "8GiB"
-              // {
-                # FIXME: Needed because partlabels are 💩: https://github.com/nix-community/disko/issues/551
-                device = "/dev/disk/by-id/${disks.boot-ssd}-part1";
-              };
-            swap =
-              partSwap "8GiB" "100%"
-              // {
-                # FIXME: Needed because partlabels are 💩: https://github.com/nix-community/disko/issues/551
-                device = "/dev/disk/by-id/${disks.boot-ssd}-part2";
-              };
+            efi = partEfi "8G";
+            swap = partSwap "100%";
           };
         };
       };
diff --git a/hosts/sentinel/fs.nix b/hosts/sentinel/fs.nix
index f9fb4ac..5b26a6d 100644
--- a/hosts/sentinel/fs.nix
+++ b/hosts/sentinel/fs.nix
@@ -7,30 +7,15 @@
 in {
   disko.devices = {
     disk = {
-      ${disks.main} = {
+      main = {
         type = "disk";
         device = "/dev/disk/by-id/${disks.main}";
         content = with lib.disko.gpt; {
           type = "gpt";
           partitions = {
-            grub =
-              partGrub "0%" "1MiB"
-              // {
-                # FIXME: Needed because partlabels are 💩: https://github.com/nix-community/disko/issues/551
-                device = "/dev/disk/by-id/${disks.main}-part1";
-              };
-            bios =
-              partEfi "1MiB" "512MiB"
-              // {
-                # FIXME: Needed because partlabels are 💩: https://github.com/nix-community/disko/issues/551
-                device = "/dev/disk/by-id/${disks.main}-part2";
-              };
-            "rpool_${disks.main}" =
-              partLuksZfs disks.main "rpool" "512MiB" "100%"
-              // {
-                # FIXME: Needed because partlabels are 💩: https://github.com/nix-community/disko/issues/551
-                device = "/dev/disk/by-id/${disks.main}-part3";
-              };
+            grub = partGrub;
+            bios = partBoot "512M";
+            rpool = partLuksZfs disks.main "rpool" "100%";
           };
         };
       };
diff --git a/hosts/sire/fs.nix b/hosts/sire/fs.nix
index e45ca72..2063a8b 100644
--- a/hosts/sire/fs.nix
+++ b/hosts/sire/fs.nix
@@ -8,28 +8,18 @@ in {
   disko.devices = {
     disk =
       {
-        ${disks.m2-ssd-1} = {
+        m2-ssd-1 = {
           type = "disk";
           device = "/dev/disk/by-id/${disks.m2-ssd-1}";
           content = with lib.disko.gpt; {
             type = "gpt";
             partitions = {
-              efi =
-                partEfi "0%" "1GiB"
-                // {
-                  # FIXME: Needed because partlabels are 💩: https://github.com/nix-community/disko/issues/551
-                  device = "/dev/disk/by-id/${disks.m2-ssd-1}-part1";
-                };
-              "rpool_${disks.m2-ssd-1}" =
-                partLuksZfs disks.m2-ssd-1 "rpool" "1GiB" "100%"
-                // {
-                  # FIXME: Needed because partlabels are 💩: https://github.com/nix-community/disko/issues/551
-                  device = "/dev/disk/by-id/${disks.m2-ssd-1}-part2";
-                };
+              efi = partEfi "1G";
+              rpool = partLuksZfs disks.m2-ssd-1 "rpool" "100%";
             };
           };
         };
-        ${disks.m2-ssd-2} = {
+        m2-ssd-2 = {
           type = "disk";
           device = "/dev/disk/by-id/${disks.m2-ssd-2}";
           content = lib.disko.content.luksZfs disks.m2-ssd-2 "rpool";
diff --git a/hosts/ward/fs.nix b/hosts/ward/fs.nix
index 3757162..66741e8 100644
--- a/hosts/ward/fs.nix
+++ b/hosts/ward/fs.nix
@@ -7,30 +7,15 @@
 in {
   disko.devices = {
     disk = {
-      ${disks.m2-ssd} = {
+      m2-ssd = {
         type = "disk";
         device = "/dev/disk/by-id/${disks.m2-ssd}";
         content = with lib.disko.gpt; {
           type = "gpt";
           partitions = {
-            efi =
-              partEfi "0%" "1GiB"
-              // {
-                # FIXME: Needed because partlabels are 💩: https://github.com/nix-community/disko/issues/551
-                device = "/dev/disk/by-id/${disks.m2-ssd}-part1";
-              };
-            swap =
-              partSwap "1GiB" "17GiB"
-              // {
-                # FIXME: Needed because partlabels are 💩: https://github.com/nix-community/disko/issues/551
-                device = "/dev/disk/by-id/${disks.m2-ssd}-part2";
-              };
-            "rpool_${disks.m2-ssd}" =
-              partLuksZfs disks.m2-ssd "rpool" "17GiB" "100%"
-              // {
-                # FIXME: Needed because partlabels are 💩: https://github.com/nix-community/disko/issues/551
-                device = "/dev/disk/by-id/${disks.m2-ssd}-part3";
-              };
+            efi = partEfi "1G";
+            swap = partSwap "16G";
+            rpool = partLuksZfs disks.m2-ssd "rpool" "100%";
           };
         };
       };
diff --git a/hosts/zackbiene/fs.nix b/hosts/zackbiene/fs.nix
index 2f4531b..196d97d 100644
--- a/hosts/zackbiene/fs.nix
+++ b/hosts/zackbiene/fs.nix
@@ -7,30 +7,15 @@
 in {
   disko.devices = {
     disk = {
-      ${disks.mmc} = {
+      mmc = {
         type = "disk";
         device = "/dev/disk/by-id/${disks.mmc}";
         content = with lib.disko.gpt; {
           type = "gpt";
           partitions = {
-            efi =
-              partEfi "0%" "1GiB"
-              // {
-                # FIXME: Needed because partlabels are 💩: https://github.com/nix-community/disko/issues/551
-                device = "/dev/disk/by-id/${disks.mmc}-part1";
-              };
-            swap =
-              partSwap "1GiB" "9GiB"
-              // {
-                # FIXME: Needed because partlabels are 💩: https://github.com/nix-community/disko/issues/551
-                device = "/dev/disk/by-id/${disks.mmc}-part2";
-              };
-            "rpool_${disks.mmc}" =
-              partLuksZfs disks.mmc "rpool" "9GiB" "100%"
-              // {
-                # FIXME: Needed because partlabels are 💩: https://github.com/nix-community/disko/issues/551
-                device = "/dev/disk/by-id/${disks.mmc}-part3";
-              };
+            efi = partEfi "1G";
+            swap = partSwap "8G";
+            rpool = partLuksZfs disks.mmc "rpool" "100%";
           };
         };
       };
diff --git a/secrets/generated/envoy/dhparams.pem.age b/secrets/generated/envoy/dhparams.pem.age
new file mode 100644
index 0000000..f60a74b
Binary files /dev/null and b/secrets/generated/envoy/dhparams.pem.age differ
diff --git a/secrets/generated/envoy/initrd_host_ed25519_key.age b/secrets/generated/envoy/initrd_host_ed25519_key.age
new file mode 100644
index 0000000..5f8349b
Binary files /dev/null and b/secrets/generated/envoy/initrd_host_ed25519_key.age differ
diff --git a/secrets/generated/envoy/promtail-loki-basic-auth-password.age b/secrets/generated/envoy/promtail-loki-basic-auth-password.age
new file mode 100644
index 0000000..ccd0615
Binary files /dev/null and b/secrets/generated/envoy/promtail-loki-basic-auth-password.age differ
diff --git a/secrets/generated/envoy/telegraf-influxdb-token.age b/secrets/generated/envoy/telegraf-influxdb-token.age
new file mode 100644
index 0000000..dc0bbc1
--- /dev/null
+++ b/secrets/generated/envoy/telegraf-influxdb-token.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> X25519 V7BwuAWcBb8XH3Eb6tWfyfoCL1shUP1kgWFDDubzPCw
+4FlGy8DMzFpgN+wOEj4yrMgctNibQP6afuv79LlpZig
+-> piv-p256 xqSe8Q A3VKu8wLRa7PX8kdNYS5chPWZgdUOWcR6tbfq0G9QVr7
+b8Z8cCA8BRHjLxAe0o/57ifVOI/xrUChoMCikui0bgY
+-> T-grease }@.z [ ./ %/A8'7
+69b+3UIwlyGj0TrDvVVkCO/+Jvnk
+--- yPe/jQ7/2m7jqcVE1Z/+vrAbPRK9A65DbDbkOrcSnNM
+�ט�oj�T�:E�8�G�ʐ%�#�q=<�a����hI-a�'P�����a���qI�BRe��DW<�+�Q���OQ~�
\ No newline at end of file
diff --git a/secrets/generated/sentinel/loki-basic-auth-hashes.age b/secrets/generated/sentinel/loki-basic-auth-hashes.age
index ad3c77c..ddd2a80 100644
Binary files a/secrets/generated/sentinel/loki-basic-auth-hashes.age and b/secrets/generated/sentinel/loki-basic-auth-hashes.age differ
diff --git a/secrets/global.nix.age b/secrets/global.nix.age
index 73f90c0..5a6978d 100644
Binary files a/secrets/global.nix.age and b/secrets/global.nix.age differ
diff --git a/secrets/rekeyed/envoy/18339a3d1929a51d4e47d2541c123e2c-wireguard-proxy-sentinel-priv-envoy.age b/secrets/rekeyed/envoy/18339a3d1929a51d4e47d2541c123e2c-wireguard-proxy-sentinel-priv-envoy.age
new file mode 100644
index 0000000..18bf3cf
--- /dev/null
+++ b/secrets/rekeyed/envoy/18339a3d1929a51d4e47d2541c123e2c-wireguard-proxy-sentinel-priv-envoy.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 yV7lcA ro8yCQGqIdBBovM2iK7imSP88HGNQwpan0yauSw5qU8
+VbL9PnSeLvQojxZ0qrb7wJ3a6NSCQHqPQyKh70CjVqM
+-> )NZc,-grease EFSDzU\| \uz{0/ NN<#vF{
+1Cu8YWV71eWkHxA7I3dw1+sWIWtUC5sWxRKZiH64h5g
+--- JDjw2+EYI9KJSnfhUinszT2Q5531mDwcrK3kflQDbzA
+��Iɐ9H������"�!��T��K�$[���b|
���0�$���]\�d;9%��������k�>f	@I�c�x��
\ No newline at end of file
diff --git a/secrets/rekeyed/envoy/192d6b442164766c6509bcaedc330592-promtail-loki-basic-auth-password.age b/secrets/rekeyed/envoy/192d6b442164766c6509bcaedc330592-promtail-loki-basic-auth-password.age
new file mode 100644
index 0000000..d39b718
--- /dev/null
+++ b/secrets/rekeyed/envoy/192d6b442164766c6509bcaedc330592-promtail-loki-basic-auth-password.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 yV7lcA I5wScaDWTGX1gasgX1yIrxC/ydftpHQJSCe+D45H+x4
+rL7dK7KvxBi7WjR33Uk8ApLCahQwYaH4lXJSjXfWeio
+-> `l10-grease _, &7 fe-*# /,uA
+enpbx3yatzXTsg
+--- yrSIElR05M59DbLbtVM++07G1jygBtfsD26buadiqBY
+	�;�|��J?����g���
*Q�tA1�>��\҇󤌰m������Ƒ���c�BK��M�&��O7�<�C)�3����.�`>
\ No newline at end of file
diff --git a/secrets/rekeyed/envoy/192d927a0da577d8f0117a747de9ea81-dhparams.pem.age b/secrets/rekeyed/envoy/192d927a0da577d8f0117a747de9ea81-dhparams.pem.age
new file mode 100644
index 0000000..45449a6
Binary files /dev/null and b/secrets/rekeyed/envoy/192d927a0da577d8f0117a747de9ea81-dhparams.pem.age differ
diff --git a/secrets/rekeyed/envoy/2689b787b982e885b1ba3361b7affbe2-wireguard-proxy-sentinel-psks-envoy+sentinel.age b/secrets/rekeyed/envoy/2689b787b982e885b1ba3361b7affbe2-wireguard-proxy-sentinel-psks-envoy+sentinel.age
new file mode 100644
index 0000000..f79843c
--- /dev/null
+++ b/secrets/rekeyed/envoy/2689b787b982e885b1ba3361b7affbe2-wireguard-proxy-sentinel-psks-envoy+sentinel.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 yV7lcA YJsWJO8spPFzaDtGlvw8qccQ1L9RpirgE8TPsc9aNhk
+0PuAaJS7EXN8G4vck0Pm+XOf/nLUylZDH8j53SoAuA4
+-> mh!+A:^-grease <,
++siLvQ+lKp1BU8l7t54
+--- DVzyObFZjySus/P22atP2xYm0+ZDdhgDoon8u5ijZEI
+����^��Ŏ�]s��X�^̛���|J��Ce���:�_I4��Әd��F��R�5A���)�>��	��n���u
\ No newline at end of file
diff --git a/secrets/rekeyed/envoy/2ef9539ec793ecd1fce9cb9b732ca42a-initrd_host_ed25519_key.age b/secrets/rekeyed/envoy/2ef9539ec793ecd1fce9cb9b732ca42a-initrd_host_ed25519_key.age
new file mode 100644
index 0000000..ab509ba
--- /dev/null
+++ b/secrets/rekeyed/envoy/2ef9539ec793ecd1fce9cb9b732ca42a-initrd_host_ed25519_key.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 yV7lcA 24sIrRomFFXsZ57wFq/Alchpea891THmcqcCp8WIaQI
+60isrJZAzhUyQ0WDYzIqwEarHFsJdMKaIoYsubP2sgQ
+-> i{WB:-grease 0mO
+lWfmjDoi
+--- VN5AXCQjnCaaudIcFrKrH/J6iQLeVDDs6lT24YONEws
+>i%h��4b�6Z��7���YȦ��%B:o�܆,?�r�1d�gs�q�](Q����-=^p��z�}
���5��v���d�^n�
���x�ʿ!�2%hy8�K�}�	?	]
�yο��i�0�����9Z�
ӆM-!���֙�0�NV�����U�[�D07�Kf�@tI�U�ֱ�e�|���p%j(�#<�+�-�6F���=c�φamq�,�]☕��m�+��ί5���
ׅ0��&*rѯl�	����hN�uL�\��M]BE���F� �t%��?�.��j�x�*��
+�S�o" ����n�+��V�����n��l#��������>,�����^�^����%�Pi
+�?1n���$�p��0o�l�����l���8k�UފY ��t<龶W�1*h��E����{�rx�3����t+���S�}���ي
\ No newline at end of file
diff --git a/secrets/rekeyed/envoy/5bc09852ae48483fb23647b453988a84-telegraf-influxdb-token.age b/secrets/rekeyed/envoy/5bc09852ae48483fb23647b453988a84-telegraf-influxdb-token.age
new file mode 100644
index 0000000..019b7de
Binary files /dev/null and b/secrets/rekeyed/envoy/5bc09852ae48483fb23647b453988a84-telegraf-influxdb-token.age differ
diff --git a/secrets/rekeyed/envoy/adc68343fd1e82562f7f6fb8666deb22-acme-cloudflare-dns-token.age b/secrets/rekeyed/envoy/adc68343fd1e82562f7f6fb8666deb22-acme-cloudflare-dns-token.age
new file mode 100644
index 0000000..0b09b2b
--- /dev/null
+++ b/secrets/rekeyed/envoy/adc68343fd1e82562f7f6fb8666deb22-acme-cloudflare-dns-token.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 yV7lcA a+d05L2QodqMakVeeKaHaTqUUQjqkZyE0yDW8L4/VkQ
+uzwmBpz1Cyaiuqp/OxQOUY5Kq7LpffGAhS8uvwvTMgw
+-> 2YW09-grease e Cpd|.76
+1gf8alzcxM/al3TN119HGyJdq3ZsGgGL2K60UUSelg
+--- sU+WGjV9XFeGHxh7CmsUWSUNCrJaFFMEQRE56HhZxms
+���Y*�f�t
a=ֱ3��f=Y�h^|�غo�z.��G}����:Z�o+�d����/�s��;�F�",�]���2�
\ No newline at end of file
diff --git a/secrets/rekeyed/envoy/fbe90fea6015be22bc47a2164a0f22f0-acme-cloudflare-zone-token.age b/secrets/rekeyed/envoy/fbe90fea6015be22bc47a2164a0f22f0-acme-cloudflare-zone-token.age
new file mode 100644
index 0000000..40d6d94
--- /dev/null
+++ b/secrets/rekeyed/envoy/fbe90fea6015be22bc47a2164a0f22f0-acme-cloudflare-zone-token.age
@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 yV7lcA Q8NjkvIVBHAbDj0dDmFkiumtDjTBCAEZVrhiklFzzFk
+SDDTiC1fxy5XOVVqyFLuunx1O5qvMWSBdKEsIceKgBQ
+-> _ef4v-grease
+FsmTbPsm7eoAjXgaegyCthI4YvOl7T0ucIwr4lCF9IViwhLaa2Pv47HEZfOgkos+
+2yYSmVj8MFI4nO2epCrLVdtdUe2PhMw+0Brv6IoX4N4S
+--- z9G4Xvmg/WK4y8qyV6aP68AVGONt5nC98Ewj2MVMOCs
+S{+
ta�>���gш0��+n�q\�5�"u�7�s�{���	�Ǝ�a?�Y�{]�O?�Y�>�����������
\ No newline at end of file
diff --git a/secrets/rekeyed/sentinel/2689b787b982e885b1ba3361b7affbe2-wireguard-proxy-sentinel-psks-envoy+sentinel.age b/secrets/rekeyed/sentinel/2689b787b982e885b1ba3361b7affbe2-wireguard-proxy-sentinel-psks-envoy+sentinel.age
new file mode 100644
index 0000000..09e13e7
--- /dev/null
+++ b/secrets/rekeyed/sentinel/2689b787b982e885b1ba3361b7affbe2-wireguard-proxy-sentinel-psks-envoy+sentinel.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 yV7lcA FPyVM8Oy0xNsKf2cJEZ3hBpSbr1hf/hmnM7GFOuE3Q0
+Z50LLBpDRNItinG6u+xaItYW9YezvdSBjE08dtHSjXc
+-> R-grease yC`(= <jE
+f5Lwr1aWSUnQhDaIeN4
+--- Igi4vXPKAP9OqLRCdK0RVoGAGb3NqgSl/BtiDDWSxis
+؂6�� ��q�taO�+�4��Ǻg����������Pg�'�a�Z�6��9 �C�z�����@�_����̀�
\ No newline at end of file
diff --git a/secrets/rekeyed/sentinel/4cff83edc1d2b2ca516f8cb63fb06782-wireguard-proxy-sentinel-psks-sentinel+sire-ai.age b/secrets/rekeyed/sentinel/4cff83edc1d2b2ca516f8cb63fb06782-wireguard-proxy-sentinel-psks-sentinel+sire-ai.age
deleted file mode 100644
index f3224db..0000000
--- a/secrets/rekeyed/sentinel/4cff83edc1d2b2ca516f8cb63fb06782-wireguard-proxy-sentinel-psks-sentinel+sire-ai.age
+++ /dev/null
@@ -1,8 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 yV7lcA /KC8F/lM5E8cNGSk5aDjhxYEQJDZhv4fdZmY8tOd0ic
-dLzqTpJRzwb1jmaQB7MqOcMYoh/1jpm/u8AK+lG3uMI
--> NX-grease mWzYBZ k<&L`D_
-dn3tatoIJ8BZuGlJ
---- Zxr1wrJSf6CGK+EpHNZyobURdv+ISrafHBRrBLhaUZU
-�(�&����7��Qi0�#a:6Y��Z��v�I��k�l=Ϣd���K�
-7vw]q��`��
��!_�s����q~[a9�
\ No newline at end of file
diff --git a/secrets/rekeyed/sentinel/8df8bc7331f1c1b2112f03dbbbfe126c-wireguard-proxy-sentinel-psks-sentinel+sire-samba.age b/secrets/rekeyed/sentinel/8df8bc7331f1c1b2112f03dbbbfe126c-wireguard-proxy-sentinel-psks-sentinel+sire-samba.age
deleted file mode 100644
index 43160f9..0000000
--- a/secrets/rekeyed/sentinel/8df8bc7331f1c1b2112f03dbbbfe126c-wireguard-proxy-sentinel-psks-sentinel+sire-samba.age
+++ /dev/null
@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 yV7lcA PPKZ78iD3jThcf5YkIOC5hKTeDHcT77g11UZ0vc8IjE
-lgkPYZAMzhVZpUSk13rzBJTDW1pNeOyuVAkNpqJb4lg
--> %%JlO}-grease C[7]eK3F KX &_=S \FSSf[^<
-
---- Tww9Yj1LeH6zq/6A7TJo5i9rMUNGV0VN6Yyf44aRnpM
-�jD�A6%߮Z4���
�]�Pq���a!b
-��i�k�K�����
�at螨N7�-s��5�����8@b�
-��.
\ No newline at end of file
diff --git a/secrets/rekeyed/sentinel/b8a185a1607106ef955c392329c27f35-loki-basic-auth-hashes.age b/secrets/rekeyed/sentinel/b8a185a1607106ef955c392329c27f35-loki-basic-auth-hashes.age
new file mode 100644
index 0000000..9800709
Binary files /dev/null and b/secrets/rekeyed/sentinel/b8a185a1607106ef955c392329c27f35-loki-basic-auth-hashes.age differ
diff --git a/secrets/rekeyed/sentinel/dff3a7ca6af4b2bde64b18a2c7fdec70-loki-basic-auth-hashes.age b/secrets/rekeyed/sentinel/dff3a7ca6af4b2bde64b18a2c7fdec70-loki-basic-auth-hashes.age
deleted file mode 100644
index 094cb35..0000000
Binary files a/secrets/rekeyed/sentinel/dff3a7ca6af4b2bde64b18a2c7fdec70-loki-basic-auth-hashes.age and /dev/null differ
diff --git a/secrets/rekeyed/sire-ai/89b98207bb1577a81049b4ce319739bf-wireguard-proxy-sentinel-psks-sentinel+sire-ai.age b/secrets/rekeyed/sire-ai/89b98207bb1577a81049b4ce319739bf-wireguard-proxy-sentinel-psks-sentinel+sire-ai.age
deleted file mode 100644
index 1767b5a..0000000
--- a/secrets/rekeyed/sire-ai/89b98207bb1577a81049b4ce319739bf-wireguard-proxy-sentinel-psks-sentinel+sire-ai.age
+++ /dev/null
@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 vhmDsA nYG2Z2yA03ESRpjgbIDkEoTEH6AJc1v1RUeS+z3cyVY
-vzPGWSTfQwY4kqUjAO/SVJatgcbGd904c/SluNLgpZc
--> Ym-grease
-twk
---- WSBuW7VDmG3ToQrlbccevVe0u0NI/RZYtvcqGSm4Tco
-M�������V1gR'��g1�"�y
[�}�\Ǚ�V��u�����u̢x��$�Ӵw�q��YP�͹���B
\ No newline at end of file
diff --git a/secrets/rekeyed/sire-ai/b106bbbb9f3c987e555b49df7263512d-wireguard-proxy-sentinel-priv-sire-ai.age b/secrets/rekeyed/sire-ai/b106bbbb9f3c987e555b49df7263512d-wireguard-proxy-sentinel-priv-sire-ai.age
deleted file mode 100644
index a5791bd..0000000
Binary files a/secrets/rekeyed/sire-ai/b106bbbb9f3c987e555b49df7263512d-wireguard-proxy-sentinel-priv-sire-ai.age and /dev/null differ
diff --git a/secrets/rekeyed/sire-influxdb/556953d98099cdb7f1274d6e0bd62443-telegraf-influxdb-token-envoy.age b/secrets/rekeyed/sire-influxdb/556953d98099cdb7f1274d6e0bd62443-telegraf-influxdb-token-envoy.age
new file mode 100644
index 0000000..d0c5fec
--- /dev/null
+++ b/secrets/rekeyed/sire-influxdb/556953d98099cdb7f1274d6e0bd62443-telegraf-influxdb-token-envoy.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 1tdZKQ ZNcyXbeW/bii8cBafPVHi45e07DPoXfFFyPWOm6XanY
+9Jeo7X34qcyiKm1LMQdbsDVaOsgZI/lyl0hARfbcakU
+-> }zO<<U-grease ls\.$Cf
+PyKy2zpmpEwLrAikw4XFNAyujvy3dQUsRTsyEq6YRqVXd8QihnxLFVzHiA
+--- ZidPkRsL+u7okLSFiIpAuLUwbRcKj5zo1NGxDnac8oU
+�l]K5k"2��-i�
�r���m��)j�0t��h�4񮸐 3������Wn<
��0q
�	�r;K�
$�C���m$�,�
\ No newline at end of file
diff --git a/secrets/rekeyed/sire-samba/52e0b64f69eb5e84fcccee0f8141cce7-wireguard-proxy-sentinel-priv-sire-samba.age b/secrets/rekeyed/sire-samba/52e0b64f69eb5e84fcccee0f8141cce7-wireguard-proxy-sentinel-priv-sire-samba.age
deleted file mode 100644
index 7b727ca..0000000
--- a/secrets/rekeyed/sire-samba/52e0b64f69eb5e84fcccee0f8141cce7-wireguard-proxy-sentinel-priv-sire-samba.age
+++ /dev/null
@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 rQrJ/w rBq18FEF23qZMQ1L0ZmPwes7YA6c5tcYghl+wMpH4UE
-KsWpipPanBEkM0sJO91aGEUJVLNbKfCGlB8n1AJMe58
--> -iJ@"-grease
-e0JwXaE3AG+cwHCgRoYZamBMyxEd60t3woMN4WAChA2FL1sBJ8F+3BFjZdACZDYy
-02KPJC2pCplo+rsTpMZd/XRw7+icfGcatjM5yEOuJKz3zNdsKtMnwXGR8BKV4w
---- eWHO47OEkFmhlJ+AxIutCfholFzG3SU/M5H4u1wM0Ew
-p����6�S"\��3
-O ���,()a.�De>��>c��I3��R
�o�,)�[�8ml��!9����)+"G��Z�P�
\ No newline at end of file
diff --git a/secrets/rekeyed/sire-samba/9cb014e8ff14329d085de1287ff23802-wireguard-proxy-sentinel-psks-sentinel+sire-samba.age b/secrets/rekeyed/sire-samba/9cb014e8ff14329d085de1287ff23802-wireguard-proxy-sentinel-psks-sentinel+sire-samba.age
deleted file mode 100644
index 736e966..0000000
--- a/secrets/rekeyed/sire-samba/9cb014e8ff14329d085de1287ff23802-wireguard-proxy-sentinel-psks-sentinel+sire-samba.age
+++ /dev/null
@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 rQrJ/w EuoChlYXjzab/J3l8oB5V5NJNtpcr5yAOd6y9m4rjSg
-MAJwhKjR+hBx5AEZx95wZvP6IeYAIiksy+zc5ukkQdg
--> S5c!<-grease qdoe 9a_t1FH
-YuKwOpJ1hoqJl+xYxNW6J88aGGiiceHyHy9RgajmXBsivTDbeaEeXRGdJySGWA
---- F2Mty9Hr43tH1SomwZ2vzgj1zQCdVw5pHcVOFIVjZfQ
-9�eg��o��f�G}gN���i8`(떪33��d^=�׭��׾�-����WX*й���=Li��{�%3s�����o"yl
\ No newline at end of file
diff --git a/secrets/rekeyed/zackbiene/2114c48ad63cd022bc589099aa7ae978-mosquitto-pw-home_assistant.age b/secrets/rekeyed/zackbiene/2114c48ad63cd022bc589099aa7ae978-mosquitto-pw-home_assistant.age
new file mode 100644
index 0000000..41afbf6
--- /dev/null
+++ b/secrets/rekeyed/zackbiene/2114c48ad63cd022bc589099aa7ae978-mosquitto-pw-home_assistant.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 DynNMA 0jbyffbAwO0+WtJmLPgBdQ6o4BQfhtyoR3eC/CisgyY
+nx2vpN/ZWdoG6z0GVA5a4563wiySTlr+BUggqeAxfVU
+-> fHq^-grease $1R? 4g mF
+6Y3otzVbFmwsR3Jqy6G82g9wnKz5JB5tSblkn6O9UoO5
+--- wiu0ndqSrU3ofFPn8WlpLJz3JaMRSGDYcxR8A+QHSbI
+g[�^0�J�I������3}�߽c�m`��-�x��tS'�����9�$��Qb���Ά
\ No newline at end of file
diff --git a/secrets/rekeyed/zackbiene/21fec08806b3194e39c928380133562f-mosquitto-pw-zigbee2mqtt.age b/secrets/rekeyed/zackbiene/21fec08806b3194e39c928380133562f-mosquitto-pw-zigbee2mqtt.age
new file mode 100644
index 0000000..f1c9e58
--- /dev/null
+++ b/secrets/rekeyed/zackbiene/21fec08806b3194e39c928380133562f-mosquitto-pw-zigbee2mqtt.age
@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 DynNMA IKMt3H+qN5Tp+klLYaeKCa0b5brlB8//VAjpAl68GCI
+MTV8wXhkCYulvS6o7Wnq/rMHeYqPxDdSMggMT6+FLyo
+-> |-:8x-grease s O3ZB {Q"
+GscWlHRccebYhiGFelYXa+GLLzprQc+k9iS//LY
+--- FgB9+ChfVo/svSZ9pgcCv+ZG/edwwIs11tNjCpkHLjg
+Ïސ
+ԻW�%�D�ѯ��`��{E[&r�-���זbMM���[ӈ=t�.&����_���
\ No newline at end of file
diff --git a/secrets/rekeyed/zackbiene/47aefe1120e3a32dc5b13dca618bb1ab-mosquitto-pw-zigbee2mqtt.yaml.age b/secrets/rekeyed/zackbiene/47aefe1120e3a32dc5b13dca618bb1ab-mosquitto-pw-zigbee2mqtt.yaml.age
new file mode 100644
index 0000000..da76e81
Binary files /dev/null and b/secrets/rekeyed/zackbiene/47aefe1120e3a32dc5b13dca618bb1ab-mosquitto-pw-zigbee2mqtt.yaml.age differ
diff --git a/secrets/wireguard/proxy-sentinel/keys/envoy.age b/secrets/wireguard/proxy-sentinel/keys/envoy.age
new file mode 100644
index 0000000..62e0377
--- /dev/null
+++ b/secrets/wireguard/proxy-sentinel/keys/envoy.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> X25519 guqR3l3I7Aa0DQ/l2D4MNpLanB4C3PgvwXm/96hPaRc
+c/k+f+fFHVObsCCTi49snWjfidRNuIny2+AefKQ9j70
+-> piv-p256 xqSe8Q AiMovFyBe+XW+kiY84vewtPf6RXoD4yCh8qgZ1jAxke8
+2eg4gF9casDTL/CZ7crqvLulzCBshR0wOaRx7F/BzP0
+-> Zg[dg@o-grease 6qG)H\ 0E
+/OA
+--- nnNkb9JT4yPw0mw6r9NQa/4JfWGjt6ZOi15cQSDmeXE
+���-D�N �+��nH����\�r#�9�����o���4�!
�DՇ��C)� �0K9�ۛ�,����m�L���R<>z�
\ No newline at end of file
diff --git a/secrets/wireguard/proxy-sentinel/keys/envoy.pub b/secrets/wireguard/proxy-sentinel/keys/envoy.pub
new file mode 100644
index 0000000..4a015a9
--- /dev/null
+++ b/secrets/wireguard/proxy-sentinel/keys/envoy.pub
@@ -0,0 +1 @@
+ikABIdsLZyLPhzujmXTxAXfCHs3FTlblv2Xza1W7jz8=
diff --git a/secrets/wireguard/proxy-sentinel/psks/envoy+sentinel.age b/secrets/wireguard/proxy-sentinel/psks/envoy+sentinel.age
new file mode 100644
index 0000000..6e3115d
--- /dev/null
+++ b/secrets/wireguard/proxy-sentinel/psks/envoy+sentinel.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> X25519 Rum6P5225U0CtcafI68tq+QulUYKH7um3wEkahe33Dk
+f6YAiC/0xU3SFywiOnARpR4d4gAgJeGCAEt/TPV3Gyg
+-> piv-p256 xqSe8Q As29vYnLfn5HuZn/ybyzWvMNsDIYbYchIP8qP6f6/ngX
+vDLqOW0V7JlHOcncgkCnXpNWvIaJl8w/rhZpuQyw+v0
+-> b-grease d /|( EP:
+RfUV02LatAx4gm/RsPXq7aWe0nsGIQadTubk/XUZliOqOSMTXuXfCZrZ
+--- 4trrv3Kv3OOujp3K4WZ1buDoJ0BEnLxkr7UWeZHVxrg
+�����������t0TW�jx;�ņ4yO�%�5�C���ɝ��>О��P���R��]��У�K�KI���
\ No newline at end of file