gensokyo-zone/infrastructure
1
0
Fork 0
mirror of https://github.com/gensokyo-zone/infrastructure.git synced 2026-02-09 12:29:19 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions

chore(idp): sys accounts

Browse source
This commit is contained in:
arcnmx 2024-04-02 13:52:06 -07:00
parent db2f7d27b3
commit 34d1b400e1
10 changed files with 561 additions and 81 deletions
Download patch file Download diff file Expand all files Collapse all files

1
nixos/ipa.nix
View file

@ -31,6 +31,7 @@ in {
roleDnSuffix = mkDefault "cn=roles,cn=accounts,";
serviceDnSuffix = mkDefault "cn=services,cn=accounts,";
hostDnSuffix = mkDefault "cn=computers,cn=accounts,";
hostGroupDnSuffix = mkDefault "cn=hostgroups,cn=accounts,";
sysAccountDnSuffix = mkDefault "cn=sysaccounts,cn=etc,";
domainDnSuffix = mkDefault "cn=ad,cn=etc,";
};

81
nixos/ldap/permissions.nix
View file

@ -2,7 +2,6 @@
inherit (lib.modules) mkDefault;
inherit (config.users) ldap;
inherit (ldap.management) permissions;
adminPriv = "cn=Custom Management Admin,${ldap.privilegeDnSuffix}";
in {
config.users.ldap.management = {
enable = mkDefault true;
@ -16,7 +15,6 @@ in {
location = ldap.permissionDnSuffix;
target = "cn=*";
rights = "all";
members = [ adminPriv ];
attrs = [
"member" "cn" "o" "ou" "owner" "description" "objectclass" "seealso" "businesscategory"
"ipapermtarget" "ipapermright" "ipapermincludedattr" "ipapermbindruletype" "ipapermexcludedattr" "ipapermtargetto" "ipapermissiontype" "ipapermlocation" "ipapermdefaultattr" "ipapermtargetfrom" "ipapermtargetfilter"
@ -26,7 +24,6 @@ in {
location = ldap.privilegeDnSuffix;
target = "cn=*";
rights = "all";
members = [ adminPriv ];
attrs = [
"member" "memberof" "cn" "o" "ou" "owner" "description" "objectclass" "seealso" "businesscategory"
];
@ -35,52 +32,82 @@ in {
location = ldap.roleDnSuffix;
target = "cn=*";
rights = "all";
members = [ adminPriv ];
attrs = [
"member" "memberof" "cn" "o" "ou" "owner" "description" "objectclass" "seealso" "businesscategory"
];
};
"Custom Role Modify" = {
targetType = "role";
rights = [ "write" ];
members = [ adminPriv ];
rights = [ "write" "add" ];
attrs = permissions."Custom Role Admin".attrs;
};
"Custom Host Permission" = {
targetType = "host";
rights = [ "write" ];
members = [ adminPriv ];
attrs = [
"memberof"
];
};
"Custom SysAccount Permission" = {
targetType = "sysaccount";
rights = [ "write" ];
members = [ adminPriv ];
rights = "all";
attrs = [
"memberof"
"member" "memberof" "uid" "o" "ou" "description" "objectclass" "seealso" "businesscategory"
"passwordExpirationTime" "nsIdleTimeout"
];
};
"Custom SysAccount Admin" = {
location = ldap.sysAccountDnSuffix;
target = "uid=*";
rights = [ "add" "write" "delete" ];
attrs = permissions."Custom SysAccount Permission".attrs ++ [
"userPassword"
];
};
"Custom Service Permission" = {
targetType = "service";
rights = [ "write" ];
members = [ adminPriv ];
attrs = [
"memberof"
];
};
};
objects = {
${adminPriv} = {
changeType = "add";
settings = {
objectClass = [ "top" "nestedgroup" "groupofnames" ];
member = map config.lib.ldap.withBaseDn [
"cn=Security Architect,${ldap.roleDnSuffix}"
];
};
privileges = {
"Custom Management Admin" = {
permissions = [
"Custom Permission Admin"
"Custom Privilege Admin"
"Custom Role Admin"
"Custom Role Modify"
"Custom Host Permission"
"Custom SysAccount Permission"
"Custom SysAccount Admin"
"Custom Service Permission"
];
};
};
roles = {
"Security Architect" = {
privileges = [
"Custom Management Admin"
# you can't manage roles if you can't see them .-.
"RBAC Readers"
];
# allow reimu to actually make these changes...
members = [
"fqdn=reimu.${config.networking.domain},${ldap.hostDnSuffix}"
];
};
};
sysAccounts = {
peep = {
passwordFile = config.sops.secrets.ldap-peep-password.path;
};
keycloak = {
passwordFile = config.sops.secrets.ldap-keycloak-password.path;
};
};
objects = {
# change default public access
"cn=System: Read User Compat Tree,${ldap.permissionDnSuffix}" = {
settings.ipaPermBindRuleType = "all";
@ -91,10 +118,16 @@ in {
"cn=System: Read User Standard Attributes,${ldap.permissionDnSuffix}" = {
settings.ipaPermBindRuleType = "all";
};
# allow reimu to actually make these changes...
"cn=Security Architect,${ldap.roleDnSuffix}" = {
settings.member = [ "fqdn=reimu.${config.networking.domain},${ldap.hostDnSuffix}${ldap.base}" ];
};
};
};
config.sops.secrets = let
sopsFile = mkDefault ../secrets/ldap.yaml;
in {
ldap-peep-password = {
inherit sopsFile;
};
ldap-keycloak-password = {
inherit sopsFile;
};
};
}

101
nixos/ldap/samba.nix
View file

@ -1,10 +1,6 @@
{config, lib, ...}: let
inherit (lib.modules) mkDefault;
inherit (config.users) ldap;
inherit (ldap.management) permissions;
adminPriv = "cn=Custom Management Admin,${ldap.privilegeDnSuffix}";
smbPriv = "cn=Samba smbd,${ldap.privilegeDnSuffix}";
smbRole = "cn=Samba smbd,${ldap.roleDnSuffix}";
smbAccountAttrs = [ "sambasid" "sambapwdlastset" "sambaacctflags" "sambapasswordhistory" "sambantpassword" ];
smbGroupAttrs = [ "sambasid" "sambagrouptype" ];
smbDomainAttrs = [ "sambasid" "sambaRefuseMachinePwdChange" "sambaMinPwdLength" "sambaAlgorithmicRidBase" "sambaPwdHistoryLength" "sambaDomainName" "sambaMinPwdAge" "sambaMaxPwdAge" "sambaLockoutThreshold" "sambaForceLogoff" "sambaLogonToChgPwd" "sambaLockoutObservationWindow" "sambaNextUserRid" "sambaLockoutDuration" ];
@ -15,70 +11,58 @@ in {
"Custom Samba User Read" = {
targetType = "user";
attrs = [ "ipanthash" "ipanthomedirectory" "ipanthomedirectorydrive" "ipantlogonscript" "ipantprofilepath" "ipantsecurityidentifier" ] ++ smbAccountAttrs;
members = [ smbPriv ];
};
"Custom Samba User Modify" = {
targetType = "user";
rights = [ "write" ];
attrs = smbAccountAttrs;
members = permissions."Custom Samba User Admin".members;
};
"Custom Samba User Admin" = {
targetType = "user";
rights = [ "write" "add" ];
attrs = [ "objectclass" ];
members = [ adminPriv ];
rights = [ "write" ];
attrs = smbAccountAttrs ++ [ "objectclass" ];
};
"Custom Samba Group Read" = {
targetType = "user-group";
attrs = [ "ipantsecurityidentifier" "gidnumber" ] ++ smbGroupAttrs;
members = [ smbPriv ];
};
"Custom Samba Group Modify" = {
targetType = "user-group";
rights = [ "write" ];
attrs = smbGroupAttrs;
members = permissions."Custom Samba Group Admin".members;
};
"Custom Samba Group Admin" = {
targetType = "user-group";
rights = [ "write" "add" ];
attrs = [ "objectclass" ];
members = [ adminPriv ];
rights = [ "write" ];
attrs = smbGroupAttrs ++ [ "objectclass" ];
};
"Custom Samba Domain Read" = {
targetType = "samba-domain";
attrs = [ "objectClass" ] ++ smbDomainAttrs;
members = [ smbPriv ];
};
"Custom Samba Domain Modify" = {
targetType = "samba-domain";
rights = [ "write" ];
rights = [ "write" "add" ];
attrs = smbDomainAttrs;
members = permissions."Custom Samba Domain Admin".members;
};
"Custom Samba Domain Admin" = {
targetType = "domain";
rights = [ "write" "add" ];
attrs = [ "objectclass" ];
members = [ adminPriv ];
rights = [ "write" ];
attrs = smbDomainAttrs ++ [ "objectclass" ];
};
"Custom Samba Realm Read" = {
targetType = "domain";
attrs = [ "objectClass" "ipaNTSecurityIdentifier" "ipaNTFlatName" "ipaNTDomainGUID" "ipaNTFallbackPrimaryGroup" ] ++ smbDomainAttrs;
members = [ smbPriv ];
};
"Custom Samba Realm Modify" = {
targetType = "domain";
rights = [ "write" ];
attrs = smbDomainAttrs;
members = permissions."Custom Samba Realm Admin".members;
};
"Custom Samba Realm Admin" = {
targetType = "user-group";
rights = [ "write" "add" ];
attrs = [ "objectclass" ];
members = [ adminPriv ];
targetType = "domain";
rights = [ "write" ];
attrs = smbDomainAttrs ++ [ "objectclass" ];
};
};
users = {
@ -149,27 +133,45 @@ in {
};
};
};
sysAccounts = {
samba = {
passwordFile = config.sops.secrets.ldap-samba-password.path;
};
};
privileges = {
"Samba smbd" = {
permissions = [
"Custom Samba User Read"
"Custom Samba Group Read"
"Custom Samba Domain Read"
"Custom Samba Realm Read"
];
};
"Custom Management Admin" = {
permissions = [
"Custom Samba User Admin"
"Custom Samba Group Admin"
"Custom Samba Domain Admin"
"Custom Samba Realm Admin"
"Custom Samba User Modify"
"Custom Samba Group Modify"
"Custom Samba Domain Modify"
"Custom Samba Realm Modify"
];
};
};
roles = {
"Samba smbd" = {
privileges = [
"Samba smbd"
];
members = [
"krbprincipalname=cifs/hakurei.${config.networking.domain}@${config.security.ipa.realm},${ldap.serviceDnSuffix}"
ldap.management.sysAccounts.samba.object.dn
];
};
};
objects = {
${smbPriv} = {
changeType = "add";
settings = {
objectClass = [ "top" "nestedgroup" "groupofnames" ];
member = map config.lib.ldap.withBaseDn [
"cn=Security Architect,${ldap.roleDnSuffix}"
"uid=samba,${ldap.sysAccountDnSuffix}"
smbRole
];
};
};
${smbRole} = {
changeType = "add";
settings = {
objectClass = [ "top" "nestedgroup" "groupofnames" ];
member = map config.lib.ldap.withBaseDn [
"krbprincipalname=cifs/hakurei.${config.networking.domain}@${config.security.ipa.realm},${ldap.serviceDnSuffix}"
];
};
};
"cn=${config.networking.domain},${ldap.domainDnSuffix}" = {
objectClasses = [ "sambaDomain" ];
settings = {
@ -179,4 +181,11 @@ in {
};
};
};
config.sops.secrets = let
sopsFile = mkDefault ../secrets/ldap.yaml;
in {
ldap-samba-password = {
inherit sopsFile;
};
};
}

122
nixos/secrets/ldap.yaml Normal file
View file

@ -0,0 +1,122 @@
ldap-samba-password: ENC[AES256_GCM,data:2EnURacB0d6VXikBM39XzHG0evJRaWEmPC6pFRwTuLQ=,iv:YuFq8+vgN5UKJNgYgZleYT8GbM5LVgUeyvWXWXNLq/M=,tag:pUiD6975QkBn8ceQbFuDuA==,type:str]
ldap-peep-password: ENC[AES256_GCM,data:RtEE7EbmS70jqRt8HeUSoYJoUfcWGvLNoNeSBGb6mwk=,iv:/4zlBSlhsPuE9isT3K1qchAL/cEKVgTVXSHzrOYF6Ag=,tag:NoP6XouQVwvL/FNuAbzCKA==,type:str]
ldap-keycloak-password: ENC[AES256_GCM,data:pt//mcGuc90gG6PSx81nBHpZ1b+0zOPMb8ffIVWF4ng=,iv:8jYaVf/R1Me5DApeaSDFzG21PGVLM4CJboEg8ZSb+mo=,tag:UDMBTSziG088eGvXQ0jUxg==,type:str]
sops:
shamir_threshold: 1
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age12ze362pu5mza6ef9akrptr7hfe4auaqul4rkta7kyy2tnrstqensgmujeq
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOZjZBbStJdU5VeGNXUG92
OE5udnNJVUh0cjJEUFBuRllLaCt0MnZpcm1RCkduQTc5QU5EVE5GdUFlNU5zdFJs
N3J6MTJweUQrbFZJdE9xbTh4REJvM00KLS0tIEhCWXBjQWJvYmFnb0trUTlhQk1o
bUhUOFRoanZacXBKOTJaempzelVwbzQK6tsNplwqkrjwiUwxxaMguD1q7SeKKKsa
yB7S3XMBNFdX5eJ2+aGw6+omivu2426QZIW98gc0KgbVptY272mX6w==
-----END AGE ENCRYPTED FILE-----
- recipient: age176uyyyk7veqnzmm8xzwfhf0u23m6hm02cldlfkldunqe6std0gcq6lg057
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyNC9rL0dHQUE5RU1tUFFX
dWphQzJSRS9zdWZLKzdlRFJEVXI4OGJzNWxFCkRRTzMyY1NWYm5vNUthUG53bzg3
U2loZzdYZWZ1TEVxR0xiNldUeXU5ZW8KLS0tIGFYWXlkaFhtdVpvajBhbjIvOE4x
UjBFcDEyeTIvekU5VG9VNnlXQXVzcWsKt00QmEPogo7/wWKhMEHfgkXnwfcb1V9+
YafYEH30j3Kk0gVBZDJiNypDZub+aeL7zosass/lURsmZwFdDOvKFQ==
-----END AGE ENCRYPTED FILE-----
- recipient: age15hmlkd9p5rladsjzpmvrh6u34xvggu9mzdsdxdj3ms43tltxeuhq4g7g9k
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5N1B4c0srYVVNNFlPWkYz
QUNXdFBNUllJTTBvcjRJNGMyUGRuWWIzRzBrCndOS1pPMzA5Qk1rc29LS25QL2ZP
dkV0U0tJU0xOSzFBcjRvQUxmSVZJZjAKLS0tIE8wSGlPcHd3SHJCUHFKQkhpQ1Bv
WXNZNTcwK2toNDJiUWsyNDlPb1FhNUEKlbd6VF324AYaW6tFDo4WYgwRq3p3qex7
Hqa9QPSqgrbJFLKeONwBx/BlDqhKxuNKDTUQpCX1YyxEFhrbnLZ4zQ==
-----END AGE ENCRYPTED FILE-----
- recipient: age10t6kc5069cyky929vvxk8aznqyxpkx3k5h5rmlyz83xtjmr22ahqe8mzes
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuQTZCOUl3cmVYYk1ueHA5
RlhpRlF2OFppc0c0NXgzY2k1NGMwWFRkSGpnCjEzQnR5TndVWVJFRW9ETzFJbFhK
R1hzTGlycWlzbEplc1ZVb2xiV1pMTGcKLS0tIGhyNlVKUHFqYm1QbDZ6TzJKekE2
TmtxM1dubG1mVFBzTHdHdGZiaGRFVWcKiUM/aB7G4dp/j/GGxkRVRUwE5FTo9Z0r
ukFy8RpFm3Ctvl1MIZ30M0NNMTppu/CTOmoSo0OSxKE9Vltw/WtFLA==
-----END AGE ENCRYPTED FILE-----
- recipient: age1a2quf2ekkj94ygu7wgvhrvh44fwn32c0l2cwvgvjh23wst90s54szdsvgr
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjRit6SlJVVWR1TGZxZ3Ni
MGlINjZCVkZqVTdSNWhpZFNLNXFqVEZBd1JFCmtyR2lJQmJNNGM1djRZZk9aYnRC
a3hFMzcvV3Z2TnZ6clNRdU10MEJnam8KLS0tIGFobXUvNHFPN1pNNm9QMXZhR3ZK
M3ZvQXptWksrdVhHMjE0SXZNWW9hRW8KbMZ2iWMsV+rLfSgJHwyd7OW9Dvf6EFWf
ldeW837x2uZCCR7Es7HShjC8Q7rXOsPsbnyuybTvj4zvh0qPAl/Fpw==
-----END AGE ENCRYPTED FILE-----
- recipient: age16klpkaut5759dut8mdm3jn0rnp8w6kxyvs9n6ntqrdsayjtd7upqlvw489
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLaWhrdHhYaEhPN3MySWM2
MWhpUE5FZnEzRW54bEF2eWk1S3pYL2ppeWdVCnRUSWdMQys2aElQTDA3eFpueVVP
SG4vZlQzWE5XVWdRVUlhNWhNQTZUVXMKLS0tIFVnaXRsbTArM0pJZ1N6cndYbXJY
YTRNd2N2ajVGU3FJWTk1cVdvbmM1VWsKING/3HcLu3Yp3n4LtEPB677jdPMPC63r
MwnHsBJx5CBZEou1D91WUXOFy6tVGyoouUb7XDOKrKx9FEx8/qbTPQ==
-----END AGE ENCRYPTED FILE-----
- recipient: age13qgddr326g5je0fpq2r3k940vsr3fh9nlvl9xtcxk3xg2x0k3vsq7pvzaj
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqWkVXMlNlc3BqSXh0eklK
TzZIQXN5am9scXFzc05GaTNQR1YwMXBBUWxjCm9XbHlvckhvbmxaKzBnVENwZHR4
a2wyVEFOZHB5TXhZQ1JvZ0crL21ZbTQKLS0tIHZlSVVycUFidVBWREhsVFVHUklH
Q3c1NWJTcnZJc3dvVldRdDRiblAydUEKZ1Mtn+PQxyCg8OZ2lAB+rEfVAPk14pH1
eub12LarVz5nqgW+XhMb6ztJ5ks9xle9reIeHhILFtpvW8wahXTYVQ==
-----END AGE ENCRYPTED FILE-----
- recipient: age1ktmx2szedfnpe5xumnzs8vkk0ffqgga6ved3drtksg9pye6ndsnsnqq488
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4bVVvSnoxUitRd3NGR0N0
Zlhvc00yNzNDMURDZlFwdm9mOWpGa1hCeVFvClZhYVdoM2lNUGRwK3hGTk83Rjhn
YkRsTTM1ODBrWXpSTWx6Y1RpdnBTNlUKLS0tIGlOVVpIaUlQbzk0azFqT2JOL2pE
WFdaN0lEWDRxVGErWFIyRFFTcDBqRHcKfnvyeArVg/pTTBRoX5buAMK0egwZfY5M
LAQmTRAddbycMiHYAk2S2PRPW+mE/Bwg3Khi3G+LqTAX/1XrrXENWg==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-04-03T19:02:13Z"
mac: ENC[AES256_GCM,data:Cak6rkD3J3tU6ADwlnFiNVN9qAuAnywE0mzZMAiT5sXCgV7QPzD21D57kxwNMKon8dUaYVtIrQ/01xzruiYNGrk2mzMqZ6W7Mf0U9yjp3AkJ88K1RlZyGUby/4TdjgSg9bNDSg17rai8EpnMwe6mqpPcQbnLmUwg1iaN0gLhEj4=,iv:Fx3u7GvTaVp1cyBRkei2RL6IqPttTTZKNQOAM0CRaNM=,tag:LfewOWvxfdPC4ArN9ufLAw==,type:str]
pgp:
- created_at: "2024-04-02T17:59:55Z"
enc: |-
-----BEGIN PGP MESSAGE-----
hQIMA82M54yws73UARAAuEh+cW6lgZ0jigOUDH1kkoVLNlUEch4GKMFafvFlk40h
feVlHi/wOFsaKsUynMDN6IkoFEdjevv1TJ7Eh5xY7S0Ua9OppyFetszxDVkaXxiv
XZNow/fFSiBnjMAMnPEz/jqs3OSoKkrH8C6CbIt0K2pWMxFz7EW64nH1ZkboTrde
JP9w1Kpl0GAGlOJrNI6cGiOyP4LxhoVJq494kBLkLNgP9KFWrd4kA2Qof9fNAo24
b5Wmnvfa1mNhQH5xzSQEHBH6gVTGtcq0Pt0UYROZuo/DwJTOh3oXmOWkLb9YIE0i
ctDoKNtBW3+jpJI7nKSxp3Ys0BcZmowcpaByp9nW3/EaveqeWDgWnn0NNwrcHloi
z5xURx59rT/rRm4vztYp9WUyyeXIA7SmoDJ1/JhqeMNhd0VcCrqsG8dmO6+kwx8w
MXHVcNnisM5Jx0Wg/6becT6p3Ej1dHAEKSNoUNrWcVo/hThT1HvvBY9HvnMDsBp4
at6bYIl+F3JT3bBIbVFNpNynPQGzKxdOp+GmCtTsauECgBNivqpGabo5CTR7Shih
KqgpUuBJsM2rPUQiOro/eZOLlTtSRwHFZ0l/q1Mwm4ZhKbiqC/urMcsfZZUZyNh0
8wgFUncvJDiAbOrlrSB3Zij92DDlZqYlFiO07tF3YxPL5s386S/qpTUOAscLlnPS
XAGW1p93RF0qwdScAA01nQnA2RMyYW8tMeBV96y0OW8QrJua8b2rozqCP6Uesyze
Xz0XVMNcw2S7hQAedQIF6BAPG4rnzgyDVjOMVGDNzcwuSzJnEaL2DiPK6JoE
=+wSd
-----END PGP MESSAGE-----
fp: CD8CE78CB0B3BDD4
- created_at: "2024-04-02T17:59:55Z"
enc: |-
-----BEGIN PGP MESSAGE-----
hQEMA2W9MER3HLb7AQf/e0yDYqiD6lYq5lRUKGX7ILpCIix1qrHzml3hLSoXvlsj
CbYyP/M18chVJ40LkJrD5fLKkTH/qOuBU5mKR2DY7mhmMYVTGp91KR8kJYExbszr
gveKzmHczrTbCzpuoVUCzoKu68HQ+s8Cvj/puxrwy8AiiRk0g4Visr9q9yhrDy50
KQtb8vZysLA90mquMu4QOodoTn5zQMuVCqChPj3xJnGfBg5B4DM7kd3A6lAWXxC4
vFsMDPvT/lSJbDIu8DIigRgYNYXygG2vW93NS0zgRvm0YdjmbJeWrjbpBy9kDqRm
/zLZHybVPKRhuu3rIAMXZjsfpfS8Ap/tBRPDvP29o9JcAQXecjL0ZSMdeNWZImj3
pIBAlVzUcgMX2U0NvSm8GZgd9cR+AAQSpF80jFdZEFGG3l/0c0UOOeBO7+WmMBtr
qezAj3MfzsOfFuydY4BM8IogcqQ4n46u+rf43ms=
=ld0s
-----END PGP MESSAGE-----
fp: 65BD3044771CB6FB
unencrypted_suffix: _unencrypted
version: 3.8.1