From 601e410ecf8f496280ce953483644f8c3abdb608 Mon Sep 17 00:00:00 2001
From: ltadeu6 <ltadeu6@protonmail.com>
Date: Mon, 25 May 2026 15:34:11 -0300
Subject: [PATCH 1/7] Add Forgejo API token secret wiring

---
 AGENTS.md                     |  4 +++-
 hosts/Nixos/configuration.nix | 16 ++++++++++++++++
 secrets/secrets.nix           |  1 +
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index 8fb2c9b..23396c3 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -553,6 +553,7 @@ Estado atual:
 
 - `secrets/openai_api_key.age`
 - `secrets/openclaw_gateway_token.age`
+- `secrets/forgejo_api_token.age`
 - `secrets/minecraft_rcon_password.age`
 - `secrets/wireguard_private_key.age`
 
@@ -567,7 +568,8 @@ Estado atual:
 - `fish.shellInit` exporta:
   - `OPENAI_API_KEY`
   - `OPENCLAW_GATEWAY_TOKEN`
-- `/etc/profile.d/openai.sh` e `/etc/profile.d/openclaw.sh` fazem o mesmo para shells de login.
+  - `FORGEJO_API_TOKEN`
+- `/etc/profile.d/openai.sh`, `/etc/profile.d/openclaw.sh` e `/etc/profile.d/forgejo.sh` fazem o mesmo para shells de login.
 - O token do Home Assistant do Waybar AC NAO esta sob agenix neste repo; ele e lido diretamente de `~/.config/secrets/ha_token`.
 
 ## Dependencias implicitas e pontos de atencao
diff --git a/hosts/Nixos/configuration.nix b/hosts/Nixos/configuration.nix
index 5dd6ea2..f321736 100644
--- a/hosts/Nixos/configuration.nix
+++ b/hosts/Nixos/configuration.nix
@@ -173,6 +173,14 @@ in {
           mode = "0400";
         };
       } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/forgejo_api_token.age) {
+        forgejo_api_token = {
+          file = ../../secrets/forgejo_api_token.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
       (builtins.pathExists ../../secrets/minecraft_rcon_password.age) {
         minecraft_rcon_password.file =
           ../../secrets/minecraft_rcon_password.age;
@@ -292,6 +300,9 @@ in {
         if test -r /run/agenix/openclaw_gateway_token
           set -gx OPENCLAW_GATEWAY_TOKEN (cat /run/agenix/openclaw_gateway_token)
         end
+        if test -r /run/agenix/forgejo_api_token
+          set -gx FORGEJO_API_TOKEN (cat /run/agenix/forgejo_api_token)
+        end
       '';
       shellAliases = {
         la = "exa --icons --git";
@@ -1154,6 +1165,11 @@ in {
       export OPENCLAW_GATEWAY_TOKEN="$(cat /run/agenix/openclaw_gateway_token)"
     fi
   '';
+  environment.etc."profile.d/forgejo.sh".text = ''
+    if [ -r /run/agenix/forgejo_api_token ]; then
+      export FORGEJO_API_TOKEN="$(cat /run/agenix/forgejo_api_token)"
+    fi
+  '';
 
   users.groups.libvirtd.members = [ username ];
 
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index cbbb84e..6f93c25 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -9,6 +9,7 @@ let
 in {
   "secrets/openai_api_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/openclaw_gateway_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/forgejo_api_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/minecraft_rcon_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/wireguard_private_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
 

From 10d79fbc5994f157d31425dbcaf43ceac27efb7d Mon Sep 17 00:00:00 2001
From: ltadeu6 <ltadeu6@protonmail.com>
Date: Mon, 25 May 2026 15:37:18 -0300
Subject: [PATCH 2/7] Add Forgejo API token secret

---
 secrets/forgejo_api_token.age | Bin 0 -> 363 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 secrets/forgejo_api_token.age

diff --git a/secrets/forgejo_api_token.age b/secrets/forgejo_api_token.age
new file mode 100644
index 0000000000000000000000000000000000000000..cea8e495c930130493f99b63e50d1e850a7ba4cb
GIT binary patch
literal 363
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+@F{k2E?3CbPD?Rz
z4k>pH&U5w1G0e#J2`mo@&n%1b4NNu-j4C%Oc6ZISh$yhkG~qJ#wQx@lHp?;!_cV8N
zFEBH*uuP9Asr2#osj!SFD-RD24~fX|%MLekFUMh<bD3XeS#o|<k)xTvYhj36K}D2{
zMUsnKkf&*Cl~HDRWvFwqPkB^@NoFLMcUo><Rk>@PlbfGGNm!0wzN>q_Nu+UQk*T(u
zr+bBAl3!#=m4{JPRFnmmuCA_vt9D^TVR2=sNkL+kZ$(C8v0;XVbC9u%qn}G;q<dMu
zYeA-mWr#&cKvgo=i6`l0X}dLMtx8d3dv5+cb=E9(owmOWPYyU_UePVu>YO91wt2nv
pzkNRK`&(2O&wqJdigSKi#<svu%yVwCUl7)Lua(TU;_~hFHURV8fkXfR

literal 0
HcmV?d00001


From 8c4993cae28cba38710bdcc7c7321641b9d73e26 Mon Sep 17 00:00:00 2001
From: ltadeu6 <ltadeu6@protonmail.com>
Date: Mon, 25 May 2026 15:53:22 -0300
Subject: [PATCH 3/7] Add Android release signing secrets

---
 AGENTS.md                                  |  11 +++++
 hosts/Nixos/configuration.nix              |  54 +++++++++++++++++++++
 secrets/android_release_key_password.age   | Bin 0 -> 410 bytes
 secrets/android_release_keystore.age       | Bin 0 -> 4652 bytes
 secrets/android_release_store_password.age |   7 +++
 secrets/secrets.nix                        |   3 ++
 6 files changed, 75 insertions(+)
 create mode 100644 secrets/android_release_key_password.age
 create mode 100644 secrets/android_release_keystore.age
 create mode 100644 secrets/android_release_store_password.age

diff --git a/AGENTS.md b/AGENTS.md
index 23396c3..303a1b5 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -554,6 +554,9 @@ Estado atual:
 - `secrets/openai_api_key.age`
 - `secrets/openclaw_gateway_token.age`
 - `secrets/forgejo_api_token.age`
+- `secrets/android_release_keystore.age`
+- `secrets/android_release_store_password.age`
+- `secrets/android_release_key_password.age`
 - `secrets/minecraft_rcon_password.age`
 - `secrets/wireguard_private_key.age`
 
@@ -572,6 +575,14 @@ Estado atual:
 - `/etc/profile.d/openai.sh`, `/etc/profile.d/openclaw.sh` e `/etc/profile.d/forgejo.sh` fazem o mesmo para shells de login.
 - O token do Home Assistant do Waybar AC NAO esta sob agenix neste repo; ele e lido diretamente de `~/.config/secrets/ha_token`.
 
+### Android signing
+
+- A chave de assinatura Android para distribuicao fora da Play Store fica em `secrets/android_release_keystore.age`.
+- As senhas ficam em `secrets/android_release_store_password.age` e `secrets/android_release_key_password.age`.
+- O alias padrao da chave e `release`.
+- O helper `android-signing-env` exporta `ANDROID_KEYSTORE_PATH`, `ANDROID_KEYSTORE_TYPE`, `ANDROID_KEY_ALIAS`, `ANDROID_KEYSTORE_PASSWORD` e `ANDROID_KEY_PASSWORD` apenas para o comando filho.
+- Use `android-signing-env ./gradlew assembleRelease` ou `android-signing-env ./gradlew bundleRelease`; nao exporte essas senhas globalmente.
+
 ## Dependencias implicitas e pontos de atencao
 
 Itens que um agente deve verificar antes de mexer:
diff --git a/hosts/Nixos/configuration.nix b/hosts/Nixos/configuration.nix
index f321736..e4a141a 100644
--- a/hosts/Nixos/configuration.nix
+++ b/hosts/Nixos/configuration.nix
@@ -9,6 +9,35 @@ let
   repoDir = "${homeDir}/Projetos/Sistemas/nixos-config";
   codexStatusPath = "/var/lib/hass/codex_status.json";
   claudeUsagePath = "/var/lib/hass/claude_usage.json";
+  androidSigningEnv = pkgs.writeShellScriptBin "android-signing-env" ''
+    set -eu
+
+    secret_dir=/run/agenix
+    for secret in \
+      android_release_keystore \
+      android_release_store_password \
+      android_release_key_password
+    do
+      if [ ! -r "$secret_dir/$secret" ]; then
+        echo "Missing readable Android signing secret: $secret_dir/$secret" >&2
+        exit 1
+      fi
+    done
+
+    export ANDROID_KEYSTORE_PATH="$secret_dir/android_release_keystore"
+    export ANDROID_KEYSTORE_TYPE=PKCS12
+    export ANDROID_KEY_ALIAS=release
+    export ANDROID_KEYSTORE_PASSWORD="$(${pkgs.coreutils}/bin/cat "$secret_dir/android_release_store_password")"
+    export ANDROID_KEY_PASSWORD="$(${pkgs.coreutils}/bin/cat "$secret_dir/android_release_key_password")"
+
+    if [ "$#" -eq 0 ]; then
+      echo "Android signing environment is ready."
+      echo "Run: android-signing-env ./gradlew assembleRelease"
+      exit 0
+    fi
+
+    exec "$@"
+  '';
   haAirConditioner = "climate.ar";
   haLaundryDryingToggle = "input_boolean.secar_roupas";
   haClimateAction = action: data: {
@@ -181,6 +210,30 @@ in {
           mode = "0400";
         };
       } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/android_release_keystore.age) {
+        android_release_keystore = {
+          file = ../../secrets/android_release_keystore.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/android_release_store_password.age) {
+        android_release_store_password = {
+          file = ../../secrets/android_release_store_password.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/android_release_key_password.age) {
+        android_release_key_password = {
+          file = ../../secrets/android_release_key_password.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
       (builtins.pathExists ../../secrets/minecraft_rcon_password.age) {
         minecraft_rcon_password.file =
           ../../secrets/minecraft_rcon_password.age;
@@ -1381,6 +1434,7 @@ in {
     nodePackages.prettier
     nodePackages.pnpm
     fishPlugins.z
+    androidSigningEnv
   ];
 
   # environment.loginShellInit = ''
diff --git a/secrets/android_release_key_password.age b/secrets/android_release_key_password.age
new file mode 100644
index 0000000000000000000000000000000000000000..73871afe1f064004741d5c5cec1ed9a9ca32ef5f
GIT binary patch
literal 410
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+@F{k2E?0=K2#;_L
z$WHcls!B7>FU*NBsY=V!F7>l?4)yXd4k*paDAz9uNC{4JDd)=d^)@#wFiz30%nl2z
zayHe@H_q@6&+`k((=RC04{|I>&Ps7lF%Hg7%*SC{aCU}aW{9bOW>Tqhsb_#`ae<?L
zsbOKBQ)NJ*yJvVoQND3jWx1<im|HSepjm;1M@WcgR=Jz6r*nmSc!oitSCxyWr?G3L
zZ(3P;xK~biUQ&6nN0kMauCA_vqoYYlR8*Q<mU)g-K}mjifSHSXNpQYVT8Wc?VP399
zlAn97fxmfnly5rMlJeAYqX4HnOY8VpFTRkUaQgY*XTq|E6|9q*?Tyxbd;Iih`0H7B
z9@ePjW;M$!_#gAzJF|haRQZt2+e(4xSPj9<dc*WcDTn>iUSeMj_GAjMz4xtU*m3T8
lTldQ3tGVB$vO2pP56TqwKD@U_InuI3eDS@;#J&yH4gj*5m+k-n

literal 0
HcmV?d00001

diff --git a/secrets/android_release_keystore.age b/secrets/android_release_keystore.age
new file mode 100644
index 0000000000000000000000000000000000000000..9f9f3d64a075bf28c0436cfa4b9b8ff879f85a3b
GIT binary patch
literal 4652
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+@F{k2E?4j=a`W`g
z4h>B*HnXrODJ@Jj&GXjJ@hmCG3^58fP4RP%D$UI_4mT=Ex8TY%D=A5;2n@{&(YGkd
zs0cK)(5`SU%Sx@POiK%K*Eh?naEsIq)VDM*HNat;X^>Y`VUTA~zHgR$Np@mYrkPv5
zv0s3ZnXiXmVY-`-rAcI^SEW%%R$ww$SY$z-VXjkUPI$VrabZeDaA0O+PPw^>TXs%h
zkzrM2cv(@hg>jT+YEmSZuCA_vZ>VQ#czTXYke7?IX+dB_VrEIciI={&zj;Y+Mvj4x
ziIZoDZ@7PUfmbmX+t%Z!TeY9Q$%wujc~;R{N@%XmjPwq!NSWnR6neH#`Ecc*MeczT
zS$o+#^KK>VY%xv!^Zm)4$J5dp%@QMitbTP}ssEc*6kqFYM;pyk2@2c?ADl9fP$)fi
zWxk+LPu}lW%i5AJPpVMYo_8btulAFJA0k)A7Ci2qvt$dqf4v*W%%69sJIoS3V|j8d
zXCsfJL6Tb5_6Kf0E7%-AM8D_~3KS^iD4u+Cdy9>Rw_N2V##1k+xnJG!ODf^&$M~mn
zc=8`RPf%@Oj&*SRs=a$__X?HChC7ZV-nRdLJ!GE?TmR?Pfp(k^d>9+AZqn0||Fk*e
zj?r#QA<M(o;j=m}eED)TZ&K>7#W%9&tPCrgp}H&O<G#PT?=P{m&tGZiW^<=y_b-z>
zyu24WwiPI?`4Fab$*r*J$P(%77oXmkE!aFkk;#r#yTEN*rQ(IZ-(Q=YHE+!R&spw#
zb>{NJKlEGFC$&YK4)~L<@cfg-^~EjI!X=caiEpd_(_P`M`~Kxd>w<6Z^>00WoWj($
z;iF8zJvXQAA=&5IC8fSMJ$aV(rQt+K>Z`XrhW>_!Gyf`v>=%81H|?jr#YSG=e;2|h
zoVLtd-FDe$dGSIqjrFDb*Q?20t+F#zDP3|iD_~#V^NKuAag8he+rQYYI<h)MRX6X}
zZaddwtG@C4>RKFSYWBI?q`mjjmzR7eXV;!x{^_^-y@L;;dsgaPJ!-C%yzt1zcRJC5
zTaWCi>S(*=W2xfy<=x(OB4!V+7INChth=~|cUFCy_^-4lFEST7d0!F<FkiM!fosmL
zPgM_X8OvO`H|#c(=)cgx!2SIDiRqK0E}nd__37)pJ^ODSZ$A~bvha1#{MDN8Sgw{a
zuj{fAJF*~d8EbQXb3DHt|1^_d+t&DgD)N58%5c51<f5bTGNJH|{IT(iR^7VWB<v<B
z%+|C=e%W$U8;j#!@7EsrYTG+MK6AbM%j^F%UhbCr<KPwJ^{G+%!@sST5?AaaROUaw
z<uBzNY}e?^Z@u){*0L<+*-u}(e|GjQdurysZ>8ARqv`+n*GI?}nST&g4w(NhSIgXz
z`{AU|+fpYoYW}%;OjvibS=-$B?Fk=eE_VG=#Ok}`ST6H_3rDxdi<~89NiA}g^FICa
z#f7!szPq=sRyJ+Xj!6sDn*Va2$_kYe4i9d6pQ)d>S!#vwA~n<IC6e70;s(v3hjb)w
zuddMe)pc&w60Wdc@m0T<oo@__y%~LzK`HUfgqE1TC)*EqoXbmF?*6ZcCpYfVZ)qh>
zqea`_3#?w@Z6rA5$KP+>d^113;rIPsww15+2-nWJISqU&|4R?;;wu(&eYBo?`MNr}
zxgp`2D;|^|iJA9xQ<g(S{F?NvZ{BlWnO~?{Ej{mDn_c_T|A)VY`SJQ)IQAvu<|Ov-
z-$E@`m~Up=SaM3lqICXgZK3_UR$DEOR*y`GnEHIhnWnbws@(d_3odqVaE%F^eD~to
zr+NZ!1CF|On$=aPWRyJ>%s+XDd$+vQANxfT`flf+&d{~?vZ%fjAQ_)x_BhV`3dgRj
z*ewe*CTwA3d)%QLzF0PNilT7e*|q8q3~y&IGMV(Z_)m4g{WR4@@p`lPr|y-Kki0VK
z+x15|b@Pt1x=wsJX^-vuS<(A`ZP^ffTWwCy?;kBD3_E^#$g9O|m~{PIP_pDdvj_9u
z?_B0{WQNJ&e`k$c9&NinshZ_dp`*(Q<B8hAw?9r|NSL-_$MyLeb{ikamECe+p{WPM
zrYLo%I>zo<!8wW_8=O|nWn?P-qk5{}N&Q2>i~fUIIj&23cFTTyV;WY*vuK5qoU^lT
zft>9R%ZnXp_e%cWRoI~8dDDtv>Jvewsj{*kOcQi>XDf1kdiKYAZp%A|hYKHSSHB3H
z`0a*ao9TlCryC8}CWi1`*rMkC&%%DeyGxTcD4sV^y|UKnsrH^3-k&$EoujZLwYTd>
z<*MT^g3G6USu}sD@4TEZj^edNs)_q<*Bo6{ID68Ujc1Ri&saL`vABn##tr93-*b$Q
zef=$%T;l%pcz2CI*H10AL(@9<t(DzrymK{oP^3sr+rJaqb;jQWSX*9io-@yobB5Y!
z_iu}Sh5F83ZxI-4VRUPYBiC=0*DH1W%D43$HOWh7-L_liZbTXL3;D&ahBI2*Z$<`u
zcUSt7^ek}I)zf>qUf%ScY|^rFVY28??XymGVMfdS+^RM#+<E8i<WqZ|-4?jAZe!i?
zCmF`<mcPnx&dK|oEH|g{h10z+l6vztDK^X3tv}7{zxv=K*CXm?VYZ8-)SGr`FumP;
zr{v$(Pj*ZRT9M*B{wcEs*e7wnUvX1cdR3a8v9JF8fUby(-|jp(v%P8M$0dQ?&-Zm5
z=S`iv=;gNGMH8pY@|t&WWnZSI&MY2{oJ)5iW)#g||AF&hiT24ezE7FAR@B-Ta2)EW
zy!d>QQk{Zfvi|wGM+DAt&+4$*^kYHCr_Va~PQKZ$wxaDsYx;%X${%*Srv*&(`%=Z8
zxot<<B8RB?GWRa$EEjuz^7@1F`EG0e3fXnsU+A~x$xHbwXKwy;{@CzTyyjl>)FhF$
z+h6BLa29_#9=iF#nUJfteL6oUDkw;`aNp<P=}!t@b-(e(y}y}qyGyPpFs%Kc@uk~k
zPKHvojdbG;?w<F*k1S^X^R;tHt?sJeqLYfdmdoj^VVY>PCe%c)Y5OzPYr04N?dAVq
z5O25X;ntnvOLv~%5_hzP)w?6#ZqnMY2N#yge^S`1s&`dtS-ObZeWm_|O+N(77cS&{
zc6MgNdLOM-C*B;1kkU365mr8BmGh=2<Hv-HMjkOnB~2fHSEzhaId;#PW7cV|qn4bz
zG`Y==GOg^~JZ;NFcgBXz?Iq%mRrVjcH)nbN9nlh(Jg!QkFI=I%FRm|~AD*skvLZ9f
z-sdyZs_9cyCK+8>D(7uA@i52!xm(QFM>!XCZaWirCa<jD@zuUB5v}tUxdt!aHRJU5
zr+f@KDdBd0UmqO3sjb<T+`ao_N6usS;|Fbfem&&9d-aT~eDlhi4Qn~KaKAZsWYeLP
zy0io5LyGuaco+U^l+btDD_Bv=(zgG;x{v?w>4y$f+AkAvVLkQU{h~hqi~|qS3pr+O
zQ0#xK7<qSA$k*QL;~ilSo=#SnQ1o=c>*MEMUadXem^@GYVAQ;ZjeAn!_T|2o?>Lk^
zsqy9Pxs9xjnhTiZS!A!={crY|nO*ePNp*R*OZrt)wa+jqe-hdvD6U<`Ydrs(z<CwZ
zzWEEhwy4c}zv9jIFS3WGUYoV!>x>V=f?<)LEjCz){GI$)J62_up~%LauHCl}?3#Pz
z_7B@A$ICY-S8g`ibs>+@M3A{H@wdrAjX)-r&r%aiH_UIm)AsLReUJ0**;SlzoIa0c
ze_uUCAWUl8Zk>sLKE9Z~!k=r#mq)w3(r)e3JJJ0tt0aEz+13BoS8U68(Df!`sce)}
zr}zDJ)x6WWd89v`o3B>ZBz`?rrMma0T+>A+xw*E17pHZ5?yP;86e#e%?)#Km?B5ji
z+9DoYlC~(}T`@N-IkCEm=Y_UQ+_6ul=2qqt#FaHAre2kQ!LlOb;bBGl?Y_xxZ>=~t
z=Rw&%_Qe%yPKygPl)E$UPFXA))xX9e&r7yBe#Z9WbB{l8*=2dGFjlHMRdx5N!XVe$
zy*Yd8qpnDm*4}#c#iCRyT9R+)*?Nut#cz`Bj`N<`*?nSDu6Vo#Q|yHapRH?+_*UBX
zeA%J3YWlD3E8FK=IQrf)-Ldk@Mzz^DSmxV5_{CS1TF>PXmweKme^T&*n!3rK0(t|~
zV?5I2PmA?0dOy!>TZO1yedWvT@}`D@3p2l;X>&`Tb5ZxCtFq73y7C3hjt0EZ`}}S?
zw(!4PX+G!eqxFWHb=?X%V(;+QEf=2X8Y(Mqo0C5^JHYR5e)j&WyY_Y8vc8sm?)E{(
z&zi-Dw!TX**D-v#FoI{#tLe`owyn3n)47d%Ud3Dk+h?Z#l!a_!(m&<Mzh7=VP5R=g
zBa2n+?AVX|Q0(7wGvSd=wRu?%$80CZl2o;~NlOkHd}FY5+!IqQd+4^w$z8T(0)lV9
zd|Bez6P9l|(RpgFZFbW0MGJb^UL9T{>Jw^o#VYTarj^LL+uMR%A74J5S3A|p);+LB
zU-)?R-op<LY)oZ%R=u;Qcj2v9{_ShN95?0Y*((;dMO&@npyC4=(|g+wnN76mxwLqa
zd6&_=S9KlN&u3-IJY9KCzvA{%pYy#_I5w>Ne6+oH!>_<pv9+6y3+o1jo$Sfnx%u$p
zMw!XlTl#<dy9BOh+}0!d|C8$GSDW6eWlmiD=J=|K1u-0rM;c$=d)cb|yun3bZFAVK
z$sFujPyH7k(ReSs)pyt3=U<ZLX0io}Jj@T;eWA{@gI(BR*43987dJ4Zayo7QB(T;c
zv9rx2JgVGIX{Mjt4J#3E-|QmWr{$t`_YI~SJ>juC?Y7j8f8MiyQai=hPPrP8k>aSd
zqAz^+ud_!5>NiFo(GfdavVHTx&H9ZO8$Ook7ngJ#3R>`c?x9#GbGw!wuf#2%>V7&>
zUCr?R&AcLOyHD8`^Ya6Q=at;_EI;y&rT6yYr>Ea>-nRB`Rabjr_vh0d$-^G&kNs0i
zU$EBq>b+b1*5bRR&%4|HJCrEC{(8?@(N*<Jr^J4o`RRH4ma7eGpQt}sqqWYEd)v+>
z9-dQnRryyM9@&={eQpKATcO3;QU4a6-RtkZ_D8hoH<u@B?tf<2J^lB4g171J-_d^)
z#Xr}~I2PSK#oTDkOF7BwnlTd7uM0oA&e40|lfx;UbIHkPTd(^)GqBiaakcGRmZV{E
z!oRuAcY63wJ2;;zNvr!jjhX#M@}lPwmonUUn}}`R5Fu+O<sSKh<snNvZ_r&O$F=Qc
zifbG9O}zC<ziiqH7vbuPt9^Yvf3w2-lfEd%KR7cbEF<!`a6Qj%@1!t^JzQ(t+szl6
z8+-n4+oh~=XLjsgW&O?j@_Du9m#o}-eRbTz<JyNdpAWpne}%(-ZsX<O=QNEkE%AKS
zsO!fPEAo_A;h<Yvr(eU(*Z+Ri7M!2%aQx`z*r3OWGrwQizM$Svf@e!oT)DNBd}c`2
zg&W%r9G8AO;oI!TkHmF~>x?$LZBbY?@o@2zz>@j$>xu(6CZE#EWIVR1K7rTrrQPxl
zGqr%axUwZ>{p*4z`<`FceQMpr$#a}fD$M?(YPdakM)!s0(&TMFqmLJu7gcFbS6fo%
z5?X%bNyGbfs-G9=8R#_kt8(6!m!Gk3=Z1By+Ou|Tl$sgPB$~}%l<(bLvClYq`-TXS
z7vD{e`@IZ5B>&+`>hV|YJD2}jl=0gvc;EAhw$(;&?u0)3>hWarncn_Q$7EkS-(ll*
z_2}A>f8py5?&ROWzU%b!{-^$pyq*>iq%88izxg$T)4lzdu9{r@b=xgo>-tfFlo`ev
zQR;t~tC@UeetkN%B9iHm%6`5>FNA|N{u)U}Of9-=>DD!EN8@=J1`h3X<%I&W_DqLP
zFDd%@ra53^>}J+$ylbwSJMK`mDR|s2b=F6+wCeqgKlw9EkKE&HJ*Q?TCU!LD2g3>$
z7hbnRPZ>NT&C}CMXYBZVf8YF^t4(tEmEt)L)ri-=bB(M>ET~Y?ubnJ*M`!D+9}@TG
zS{ge0Zg?nR%vRQCv2z-)%4SK1XM6K*`-`O9QOrA|%wf)a;BT-x$J1=V{lOFVJxNkL
zvwvPh0gvL(^m`9}l)e#VTmI$Jfk#1?etdklI`?~jMX1NEDGRt}xb0<dH0V_Nv)f{4
zt>jBVvtM0)yT6|1N;-1G+UiSK33JzRCfDGSRTf9io#)iaS>5LHa#ih{$drn`M}yug
zHCHfr?p6_NsgHdkb~Myj->_?E!B>-Fv5xOn(nXRcN}Dy6CK=E1NVG9$$rtKthzquQ
z?zg4(z=g)+GuDgk?|Z}JXlu+HvvS4p%X^pB95?@b#5}7=zhjBVQl~Hcf2y{28D7$p
wo^HdEyY#!tBDTIWyX>nfRl+~@|5gt1+kD!HL#J@9@Gs%l2i4|xT(dk60D4RBssI20

literal 0
HcmV?d00001

diff --git a/secrets/android_release_store_password.age b/secrets/android_release_store_password.age
new file mode 100644
index 0000000..42760e7
--- /dev/null
+++ b/secrets/android_release_store_password.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 PLsDCw gBKNuM+9I8jE0FR2MQBQIqkLvwb3zq0LKf0bwB8yIXk
+spy1+Ok6fFoEGsVrnPHrWeNL49cpyBc+RxDjfmk3r6E
+-> ssh-ed25519 PLsDCw b982WTJWcZfyQ0yu1NFYzOsE761V3AbciXYN4TngL3U
+b3hXtIY24EPP4mcCGn4BPtsHk46YLGQr7ZOheghyS6w
+--- viMGGTPm8ItU7jb1OK7045U0o1BM2SbDwVJ7qXVp9E4
+b�.q`��io9�~�����+78-�!	�@LEWf§������Y����wx(`z�8p����K~3�����OtKX{�c�W�ЉY}�4Pdz�d��f!,��죫W��
\ No newline at end of file
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 6f93c25..245f60b 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -10,6 +10,9 @@ in {
   "secrets/openai_api_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/openclaw_gateway_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/forgejo_api_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/android_release_keystore.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/android_release_store_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/android_release_key_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/minecraft_rcon_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/wireguard_private_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
 

From 923caba7f1ff179aff1dd762193e38ff490395ba Mon Sep 17 00:00:00 2001
From: ltadeu6 <ltadeu6@protonmail.com>
Date: Mon, 25 May 2026 16:25:34 -0300
Subject: [PATCH 4/7] Add matrix Android project secrets

---
 AGENTS.md                                     |   9 +++
 hosts/Nixos/configuration.nix                 |  63 ++++++++++++++++++
 .../matrix_android_commander_credentials.age  | Bin 0 -> 531 bytes
 ...atrix_android_firebase_service_account.age | Bin 0 -> 2698 bytes
 secrets/matrix_android_google_services.age    | Bin 0 -> 992 bytes
 secrets/secrets.nix                           |   3 +
 6 files changed, 75 insertions(+)
 create mode 100644 secrets/matrix_android_commander_credentials.age
 create mode 100644 secrets/matrix_android_firebase_service_account.age
 create mode 100644 secrets/matrix_android_google_services.age

diff --git a/AGENTS.md b/AGENTS.md
index 303a1b5..8986675 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -557,6 +557,9 @@ Estado atual:
 - `secrets/android_release_keystore.age`
 - `secrets/android_release_store_password.age`
 - `secrets/android_release_key_password.age`
+- `secrets/matrix_android_firebase_service_account.age`
+- `secrets/matrix_android_google_services.age`
+- `secrets/matrix_android_commander_credentials.age`
 - `secrets/minecraft_rcon_password.age`
 - `secrets/wireguard_private_key.age`
 
@@ -582,6 +585,12 @@ Estado atual:
 - O alias padrao da chave e `release`.
 - O helper `android-signing-env` exporta `ANDROID_KEYSTORE_PATH`, `ANDROID_KEYSTORE_TYPE`, `ANDROID_KEY_ALIAS`, `ANDROID_KEYSTORE_PASSWORD` e `ANDROID_KEY_PASSWORD` apenas para o comando filho.
 - Use `android-signing-env ./gradlew assembleRelease` ou `android-signing-env ./gradlew bundleRelease`; nao exporte essas senhas globalmente.
+- Secrets locais do projeto `matrix-android` tambem ficam sob agenix:
+  - `matrix_android_firebase_service_account` materializa `.secrets/firebase-service-account.json`.
+  - `matrix_android_google_services` materializa `app/google-services.json`.
+  - `matrix_android_commander_credentials` materializa `.mc/credentials.json`.
+- O helper `matrix-android-secrets [project-dir]` cria symlinks desses tres arquivos para `/run/agenix`; por default usa o diretorio atual.
+- Nao migre `local.properties`, debug keystores, `.gradle`, `.wrangler` ou caches locais do `matrix-android` para este repo sem um motivo explicito.
 
 ## Dependencias implicitas e pontos de atencao
 
diff --git a/hosts/Nixos/configuration.nix b/hosts/Nixos/configuration.nix
index e4a141a..33e1c42 100644
--- a/hosts/Nixos/configuration.nix
+++ b/hosts/Nixos/configuration.nix
@@ -38,6 +38,44 @@ let
 
     exec "$@"
   '';
+  matrixAndroidSecrets = pkgs.writeShellScriptBin "matrix-android-secrets" ''
+    set -eu
+
+    project_dir=''${1:-"$PWD"}
+    if [ ! -f "$project_dir/app/build.gradle.kts" ]; then
+      echo "Usage: matrix-android-secrets [matrix-android-project-dir]" >&2
+      echo "Could not find app/build.gradle.kts in: $project_dir" >&2
+      exit 1
+    fi
+
+    link_secret() {
+      source_path=$1
+      target_path=$2
+
+      if [ ! -r "$source_path" ]; then
+        echo "Missing readable secret: $source_path" >&2
+        exit 1
+      fi
+
+      target_dir=$(${pkgs.coreutils}/bin/dirname "$target_path")
+      ${pkgs.coreutils}/bin/mkdir -p "$target_dir"
+
+      if [ -e "$target_path" ] || [ -L "$target_path" ]; then
+        current_target=$(${pkgs.coreutils}/bin/readlink "$target_path" || true)
+        if [ "$current_target" = "$source_path" ]; then
+          return
+        fi
+        echo "Refusing to replace existing file: $target_path" >&2
+        exit 1
+      fi
+
+      ${pkgs.coreutils}/bin/ln -s "$source_path" "$target_path"
+    }
+
+    link_secret /run/agenix/matrix_android_firebase_service_account "$project_dir/.secrets/firebase-service-account.json"
+    link_secret /run/agenix/matrix_android_google_services "$project_dir/app/google-services.json"
+    link_secret /run/agenix/matrix_android_commander_credentials "$project_dir/.mc/credentials.json"
+  '';
   haAirConditioner = "climate.ar";
   haLaundryDryingToggle = "input_boolean.secar_roupas";
   haClimateAction = action: data: {
@@ -234,6 +272,30 @@ in {
           mode = "0400";
         };
       } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/matrix_android_firebase_service_account.age) {
+        matrix_android_firebase_service_account = {
+          file = ../../secrets/matrix_android_firebase_service_account.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/matrix_android_google_services.age) {
+        matrix_android_google_services = {
+          file = ../../secrets/matrix_android_google_services.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/matrix_android_commander_credentials.age) {
+        matrix_android_commander_credentials = {
+          file = ../../secrets/matrix_android_commander_credentials.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
       (builtins.pathExists ../../secrets/minecraft_rcon_password.age) {
         minecraft_rcon_password.file =
           ../../secrets/minecraft_rcon_password.age;
@@ -1435,6 +1497,7 @@ in {
     nodePackages.pnpm
     fishPlugins.z
     androidSigningEnv
+    matrixAndroidSecrets
   ];
 
   # environment.loginShellInit = ''
diff --git a/secrets/matrix_android_commander_credentials.age b/secrets/matrix_android_commander_credentials.age
new file mode 100644
index 0000000000000000000000000000000000000000..bd35b1cc65230fef02ab65d9e7649993a37d1cde
GIT binary patch
literal 531
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+@F{k2E>{Rh%{59Z
zGDr*7caO;QHFxzj$&Jj+EBEkrHL3^?Ps?@7s0b|y*3NScG2rqnF|<et42(*QEVJ+k
z35g0R_byLQwx|rvOHE46EA}u;Hq7$O$Tsmza>Zerd8u<mL6mElm%n#*N~XR^fm@kr
zfKNbnRjPMHl%-!uMt-nMh;c+wSd}A}p;1w4N>xFAv6o9;RB%OJs85AkP-$AIw`I9U
zh_OdOv2(DAv1_75m3AnXuCA_vzGaA`PnvH|n45`9XppyWak-ygp@~PSXSipYPk>=m
zp1Dg&XtsM<kcT4|-<D^Up*iuoGr13bX=36&)|A<hvDrc=@I;GD^qL4=@4zqlSv==C
zG!CdPbeLhpHKX%}WVDt3k#3IFOiA3|R~7BAuQs`J-R79ib4S51JqH;7zg+veafOn{
zo0j8-{(q%HmCo;2kWlg5Vd0}Q`oe3t{?zi{`?l?>DVs&juIP4lsYe0tCtkI0-QuS3
z*LLQzm{;Ccm>4!LvNE$?ICniGSII1;c?HRC%zr#P|K%E9X|P(c{8s&<#b3>>14TB+
zo^7binUJ}aMd40jlvnNVjf&iQHb0pk2d#dv_=xMKhC}Hw#r^8}`;8pUbuR9y&pZ@#
J*5#!rCjf2r&inuX

literal 0
HcmV?d00001

diff --git a/secrets/matrix_android_firebase_service_account.age b/secrets/matrix_android_firebase_service_account.age
new file mode 100644
index 0000000000000000000000000000000000000000..a6c811da9f6cc5665126379357cc29d1a6af2fd6
GIT binary patch
literal 2698
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+@F{k2E>|$N%rZ-M
zsY<m>G7kxHFO1Afbqe*3%J5DN%}%uNObQAu%@3#yaxpckEaob;^eD~`wv0#*&Z}~*
zEDb0wGD$U$Di1434>K@GHOa9EF)p{XsMIcVx4>arU_p?3l6$ggNUBk;hi_H6zoUV-
zQ+lYsb4gM_ly7Nph_`vZV`V^)L1r;mzHhQ+k%zC5k5_<aK$<~heq~0Yr<1vPnyFiq
zTV`savA&OqMQNFtk9Q!KuCA^^Qm~s*P<mp%vyp*CP>8=#rlW_Yae0A%no~)sYmR<$
zcDjo}ut$MoPNWG}<gynY(<T1CQ28mA=*2Yir%01l@bi{64h?1ICoayJEtvQ=tf^o{
zQh4ITmD+o6=DsS|{WZnot<A=ks0ptbvl(~ui2eJsZU3`uwfC=!KF!_!fqU}I?Yfp+
z^W^sbi140#L|w}Bwqx6*12R9S=luT6p>?~6#ok3x*@AU>{;zx6rxhj5Sj!P}@WhdY
ze_Ts1JE`?@Fus#5E_bPLSu$<*!r9N*m<$gWM$SL!GR^UA&jPEnr`mfw>T7ER56xMU
zzU1xuyx$T6YKd=E^42-+i@5mrqy1E|me=RvKkRvY>?^}Ol_0a|KPz)Z%Q>dlZ)BYI
z==UMB#2>HQ-|c#?v16M`^0IF$KB`yCc-)99)U<hdXtBtaNB=if?>H!zx8vO1&&|H_
zQnzM5_6s;FF<&$3qs-RC`#e6X?~13gAGjs#{WxVZ?_8;0z6w`vs$8*1&HnT*C^#W(
z(z7pf%BFm1wbNNH-_TsXB%pOu_`Et9pX<r3cLP&Cr)t;<m2U2jO^MNX9_eyOgU?)d
z*`9xLRzjKncf*!Sg{dz1=gxTHlD$Y_LVa&%=#&NT^EOEzXB3KZv~ay~Tln{WA5Oy)
z-5*VOR`gD4ic8~omfyKi>wO~A?2Bu@o9|j*+_b^s!mn$8Cfxqc9GR66XZh${yF4?C
z)UoFw1!u0h*k35wd}sSZ-6oH~7tK#!R{Qiu{q$R|?<KQzGiz%bv(r40IR*z#Cq7-3
zSrugDyIn*x?v1Btl7Vvmjo>Sy-wHSk?0zcrRc+Af%>L_nWahHE{3Zj*2^xEpxW515
zydK8FyXxe(<jZ<xDSM6|>9CMEsc0^@Og@xhS1-GI>N~A>vb%SFOX9r4*%&Quw=pMO
zH2<#H%R3tXnpPf9^h;w6|GAHq*F;y&d|TP9r3>fZ)@V<N6FmCs(%c%OvKo2$lzVQU
zrg!@lp61<Ubk8bq^)#2mXK#hRJ}J1T@BGKUW4pg@=$$k-a2waTze)bnmPOS{&diw{
z=zeEQ&Y7o4OIJNwFQ3x1{f+xdw?M|+8T+^VJ>=>!>BjezJ7q@&`_%V3CaNg$ZwtBN
zI%E1Ifoh?%k0iF*p5>C;Rj_w$heGD!uxpcS%jJ(0eB8byXQkAVSASdh8rbD64_I2X
zNb<bg6?ihuH!JG(mSbzS|LSeDV=FqxFYs@7Q=dr5!pSYd`-}_pwjJ>~Y9{Y-D|5<@
zpW34R_Nf(zHZR-dv9_ag#gY%#pRIQdH=3_@)iBAu%%iD;<<~;nwuR>pWoqBvB)n@*
zOLuC)ucFUO-2Xq2(ml6PPdlz?R{fqsliby=GN}}L#HPzH+;e2xueb{~3tHNXJIqff
zbr)E@i!L=`5Dj!bC49GKcI;~(<$~7M<4?<uajwn&p)lJ&%%Mm4)t75W&RHJ_{1NUt
z-`w)qxwG!wucQ1Qrs&+XxO;}ZN>FZ|uy}I9mIW!Ptj|I}+ZN8ba_PzcO^-VdP5dvl
z^wP)4it{FZ(U`5DkvMUx1Lv~shHSeSZ=XDHBw*6x#VwK_?@rW<`_uBO?z*J-v~&aQ
z=wuUS>(J-=T1Gwsp^K-^TNbVO`q+Q3@7JC!$TYpZTBrQjmsgA${=Pq-{`quI@if!a
z_4NsdEkC|sIeO`Z-poZmt|gyuxm0Ix^1vPC{cAgnmOOkH_y3pPrrX6qGSgVj_<Y^{
z+bfRw&QjH%z2Qf6FGkeYC~o7twXuaiWsA<t{TJ_><dk30pTaB8tYWbvPq)Lx)XB)`
zKXb#%jT`nHoZ+{6Q(xJUIqqGD9Y3y%aoij9V9V4slVZ&dy3RjxrGeoH-z0@qvxL6|
znYWzWk+y1&pwdo*(v6<cKHnBx+a5o?p(FAr>)F8P%}4l!?9PAc{U#H>ZT3-b?!@Ky
zYAqk0>-N8Q+4SmeC+ptdtW_>+0+$9pZeYA?9@f>pk+=2pLat-MZf0-ooOzZhSRcx>
zc<|a_N5jc>wSOmd!u6~7${cT;_byiH$F-QyHvVmi7q*9$K5T4T(o)=2U>7zg%4T6#
zu+3E|7O7u#dHK`AyrMSci+xpI_F!^Jg~!7smtMY(dbKGcde5_$GTRT|em!yJziW5$
zWo%uv4t{OYN&0v8;-?E%1v~c3M@O*y&G#{@kla)l(f0YMYW&k#SsTi<lHUBdxbM|J
zo9F9fg}m4qyYmitZ1!Dpd5s5Cg5EU4y%W0hZ<Pm6mYI}sFhS<zqVN+1&s(iC5840W
zOK@Fz(4Rxk+4+II)ZPGHeQ$q>XTAUZ@96~#l`pv!<+4gZV#)H1wMz<Km~@Cmen~by
z9kBm|SmuS~xQzLnbs5ITUtM&GJU>bPUg*Jt_h%g{)cm!T<FIjl{=NC<ZmBE&4twy$
z)1%Jh&-_+(hoV;uKHSlB3hr$TJzBEm;BGY@zh@$?j>@zCtaP6Ldj2P=mm%6$%Iuhw
z))X@sCd{um#aoy7O~k;HP5+#A#fb@5PHmbmE!w4~{$h!8#-Z<_f}$@hI=oV1F9-;B
z*K@sKsQ#G!bK=TJ`G=x(kDu=IeJ}gCZn1oS$d?tD&o0XM>Fm5@saR2^yWFbof_g^c
zYx~=KR|<rAnX6r%cgShq*(?*Q8(oukTk~BA(&s-K+Pon3>tU9SVs`VpYGVE>%y6IT
zcKWu?db^w1-?Uuw%iO}dzgxY&*|u?B*ftxXgR3s|Ck8A(c3W(xgzi`WAFatcnc_O)
z?5!VO-aPbd(Uj~ZW&2XMaU97=JbLN+Gxi1}!}OhIZ+w%Yi=u4zM@HVXalhO9*ULHY
z>joB!9V=@bcVz_?UR|5`D|eUoVZ*Dhnu1R*JvVdxyp*u0jpvMY*1oV{yLfwT^Jlq@
zi#=`YZcnPua(Dl{V*<|&36;$bDjUzQUcOk-w=O;Kk<GlLHMzkv>kb|_a5woYq~-t6
z%JY0iD{H8`K@hK&JKL03o{se|m+WidI9fP+_n)atOqJ!9EuFADdRmdu43YUUrz*sA
z^Z(0cs;2#tyWSM``&<0?cBSJvTUz~|*sF2fGTr;);M+4EpJ&Av9lz0ivwDhw(eKNi
zHPI>0L}pDpe6ZtB^S6NS?{n<_I=aT}Px+Fh!EkBf&afK}igWZ9Ji0D_^5gT}Prs#9
zUZ3iA<yEU{j%7woZCG1PNq@}g|CWc?)ow&^846B$753+DMW3Ap+xpt|HF0g1?_K45
zleA=p^|FJveec{AH28jSt?Z$BVf?G^^=z!^uQ5^O7vpx*i{v)YJ|Slm;t}U~@QVGM
z*^KLJJHGJQtMXZIzwq+b+gtTbdl$Owv==yc_mpHpt;zjKja!{{Qx?uo$;o_BH#_Fw
Jwr(N!SOBjM7n%S7

literal 0
HcmV?d00001

diff --git a/secrets/matrix_android_google_services.age b/secrets/matrix_android_google_services.age
new file mode 100644
index 0000000000000000000000000000000000000000..bdc337c02e30c563aba8eda4c6063c42455f838c
GIT binary patch
literal 992
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+@F{k2E>{Tl@-PWB
z^Yig5aZPbIvMevo4D&2?DJ(S(2#NBoF!M;w^N4bCOb*u%DdutyG)gTf3ot7%jMNXy
zPcq9l$xYG@jc|@CFbpekbPI5{a5b-R3d;&jj>KVGcu;v>RF-zKZ)!?qWO0>cRG7PA
zWNEHPet2M+hlQbWc!XhOepFDtrK<r~W_ntLVPK}AtEXpqXr@bgNp^9Lv3aOpzL#l;
zTUvpuYqDjsk3mwnk%0-9uCA^^xO+soM?r~8xwB<vq^FaKMX{TSTamlJv2VF{q(!bp
zcxFVnxubT8g;6BewdpPA=I;M?_;cW-Wdb2hChhxgzBie*Cen3B=XW*cOHbbj*l*g$
z6&tiXfw{RP=FrL+QED4&(?lD8pF4RfQ#Eqg`TI9g!<_CGEPUZwc3A0%r^}0$mlcy&
zJfH9Q!C(!OcDwDJs{hkVxc-%=>}OG*8#<wu)9%OWJ+~89yqH+|xGc}C&%#-qdv=R~
zcqfOWz&4enCB_Z^{!3JCURSPl^oe*`*|noqswra4+t$}^iEa0?ez9P-ztrma4l~z;
zbZnAax18@`!V~AtQx1w(TOV6&+$O5+ar0<aj?Zlq?v*9x6EE;ei@B^j7gxJ;t=-8L
zc26!f&iO6bFaM_G+@bH^Po8)XmfdK~{Pe83$uyH)?{?hv5j}Y*^!@bdKW7O24@`R_
zR_^*oX6EHyVSZ8jBmP&vf62AeXF6c4&tSLl?TN=skE%26CVGACEZFd|&^ddWa9{b_
zRGDoz{Vw>X&CA@p>;59%i;lk{1a|A4@&3{#;iz-VqG#7lVQ1k7o03~DzS0kudc*Ef
zB`xsM^M>HpC%d=4Pi?v;`E$ypFDg#yDGP7v1m15~zUyCAcSmBck-&l-6|;`Dm5JYa
zkZY;!G3oHxtyb%PecGwx@!59`hlgjA*R;YJJFlugC~t{-@bT8^j9t8+#2cGM1(b!Z
z>TkVLU}K$|wqRBI?$7O;J$-Gyx;37^B+|7Zx#Q|#ktf~@XRTvi@{h}0z1gbZ#FZ6+
z_V-M+V-&bf+P~vmeeD&ijMjs66WNpp7thz(mll~^F50=xwb-(!N>uu2NW9uEhn3BD
zozEv`w;x)ioP5Ie(?+kaUp6Z>)<o)kzVzV-OUcU50gCFpyJyw;s`t&BB$W_;?aJ4O
z+un3`cTQXL>Cq=wkC{7W3S4!a^JOhleOOT$-_yQ-ft?X5-+mm*TxR}UH*BlbQIl^|
ekGO2m?#kHKH)XN@(=GioBi=d9c%T@xc?SUEv%>2D

literal 0
HcmV?d00001

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 245f60b..46781e4 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -13,6 +13,9 @@ in {
   "secrets/android_release_keystore.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/android_release_store_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/android_release_key_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/matrix_android_firebase_service_account.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/matrix_android_google_services.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/matrix_android_commander_credentials.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/minecraft_rcon_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/wireguard_private_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
 

From 9b39b7076459376f78b9ec06b650c1f863c42ca8 Mon Sep 17 00:00:00 2001
From: ltadeu6 <ltadeu6@protonmail.com>
Date: Mon, 25 May 2026 16:39:39 -0300
Subject: [PATCH 5/7] Set Android push gateway URL

---
 AGENTS.md                     | 3 ++-
 hosts/Nixos/configuration.nix | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index 8986675..1942fcd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -583,7 +583,8 @@ Estado atual:
 - A chave de assinatura Android para distribuicao fora da Play Store fica em `secrets/android_release_keystore.age`.
 - As senhas ficam em `secrets/android_release_store_password.age` e `secrets/android_release_key_password.age`.
 - O alias padrao da chave e `release`.
-- O helper `android-signing-env` exporta `ANDROID_KEYSTORE_PATH`, `ANDROID_KEYSTORE_TYPE`, `ANDROID_KEY_ALIAS`, `ANDROID_KEYSTORE_PASSWORD` e `ANDROID_KEY_PASSWORD` apenas para o comando filho.
+- O helper `android-signing-env` exporta `ANDROID_KEYSTORE_PATH`, `ANDROID_KEYSTORE_TYPE`, `ANDROID_KEY_ALIAS`, `ANDROID_KEYSTORE_PASSWORD`, `ANDROID_KEY_PASSWORD` e `PUSH_GATEWAY_URL` apenas para o comando filho.
+- `PUSH_GATEWAY_URL` aponta para `https://matrix-push-gateway.ltadeu6.workers.dev`.
 - Use `android-signing-env ./gradlew assembleRelease` ou `android-signing-env ./gradlew bundleRelease`; nao exporte essas senhas globalmente.
 - Secrets locais do projeto `matrix-android` tambem ficam sob agenix:
   - `matrix_android_firebase_service_account` materializa `.secrets/firebase-service-account.json`.
diff --git a/hosts/Nixos/configuration.nix b/hosts/Nixos/configuration.nix
index 33e1c42..77fc2d1 100644
--- a/hosts/Nixos/configuration.nix
+++ b/hosts/Nixos/configuration.nix
@@ -29,6 +29,7 @@ let
     export ANDROID_KEY_ALIAS=release
     export ANDROID_KEYSTORE_PASSWORD="$(${pkgs.coreutils}/bin/cat "$secret_dir/android_release_store_password")"
     export ANDROID_KEY_PASSWORD="$(${pkgs.coreutils}/bin/cat "$secret_dir/android_release_key_password")"
+    export PUSH_GATEWAY_URL="https://matrix-push-gateway.ltadeu6.workers.dev"
 
     if [ "$#" -eq 0 ]; then
       echo "Android signing environment is ready."

From abceabd0660a10f8d3ad33e9e474f127860717e9 Mon Sep 17 00:00:00 2001
From: ltadeu6 <ltadeu6@protonmail.com>
Date: Mon, 25 May 2026 16:54:49 -0300
Subject: [PATCH 6/7] Register Cloudflare bootstrap token secret

---
 secrets/secrets.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 46781e4..cd93163 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -16,6 +16,7 @@ in {
   "secrets/matrix_android_firebase_service_account.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/matrix_android_google_services.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/matrix_android_commander_credentials.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/cloudflare_bootstrap_api_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/minecraft_rcon_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/wireguard_private_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
 

From ebc21a4add2145b6a3e680fc5ebc7c9ac451cc91 Mon Sep 17 00:00:00 2001
From: ltadeu6 <ltadeu6@protonmail.com>
Date: Mon, 25 May 2026 17:00:03 -0300
Subject: [PATCH 7/7] Add Cloudflare API token helpers

---
 AGENTS.md                               |  10 ++++++
 hosts/Nixos/configuration.nix           |  39 ++++++++++++++++++++++++
 secrets/cloudflare_dns_api_token.age    | Bin 0 -> 376 bytes
 secrets/cloudflare_worker_api_token.age | Bin 0 -> 376 bytes
 secrets/secrets.nix                     |   3 +-
 5 files changed, 51 insertions(+), 1 deletion(-)
 create mode 100644 secrets/cloudflare_dns_api_token.age
 create mode 100644 secrets/cloudflare_worker_api_token.age

diff --git a/AGENTS.md b/AGENTS.md
index 1942fcd..7131cae 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -560,6 +560,8 @@ Estado atual:
 - `secrets/matrix_android_firebase_service_account.age`
 - `secrets/matrix_android_google_services.age`
 - `secrets/matrix_android_commander_credentials.age`
+- `secrets/cloudflare_worker_api_token.age`
+- `secrets/cloudflare_dns_api_token.age`
 - `secrets/minecraft_rcon_password.age`
 - `secrets/wireguard_private_key.age`
 
@@ -593,6 +595,14 @@ Estado atual:
 - O helper `matrix-android-secrets [project-dir]` cria symlinks desses tres arquivos para `/run/agenix`; por default usa o diretorio atual.
 - Nao migre `local.properties`, debug keystores, `.gradle`, `.wrangler` ou caches locais do `matrix-android` para este repo sem um motivo explicito.
 
+### Cloudflare
+
+- `secrets/cloudflare_worker_api_token.age` contem um token para deploy de Workers no account local.
+- `secrets/cloudflare_dns_api_token.age` contem um token para DNS/Zone Read.
+- `cloudflare-worker-env <comando>` exporta `CLOUDFLARE_API_TOKEN` apenas para o comando filho usando o token de Workers.
+- `cloudflare-dns-env <comando>` exporta `CLOUDFLARE_API_TOKEN` apenas para o comando filho usando o token de DNS.
+- O token bootstrap usado para criar outros tokens e temporario; nao mantenha `cloudflare_bootstrap_api_token.age` no repo depois de revogar o token na Cloudflare.
+
 ## Dependencias implicitas e pontos de atencao
 
 Itens que um agente deve verificar antes de mexer:
diff --git a/hosts/Nixos/configuration.nix b/hosts/Nixos/configuration.nix
index 77fc2d1..fd912ec 100644
--- a/hosts/Nixos/configuration.nix
+++ b/hosts/Nixos/configuration.nix
@@ -77,6 +77,27 @@ let
     link_secret /run/agenix/matrix_android_google_services "$project_dir/app/google-services.json"
     link_secret /run/agenix/matrix_android_commander_credentials "$project_dir/.mc/credentials.json"
   '';
+  cloudflareEnv = name: secret: pkgs.writeShellScriptBin name ''
+    set -eu
+
+    secret_path=/run/agenix/${secret}
+    if [ ! -r "$secret_path" ]; then
+      echo "Missing readable Cloudflare token: $secret_path" >&2
+      exit 1
+    fi
+
+    export CLOUDFLARE_API_TOKEN="$(${pkgs.coreutils}/bin/cat "$secret_path")"
+
+    if [ "$#" -eq 0 ]; then
+      echo "Cloudflare API token environment is ready."
+      exit 0
+    fi
+
+    exec "$@"
+  '';
+  cloudflareWorkerEnv =
+    cloudflareEnv "cloudflare-worker-env" "cloudflare_worker_api_token";
+  cloudflareDnsEnv = cloudflareEnv "cloudflare-dns-env" "cloudflare_dns_api_token";
   haAirConditioner = "climate.ar";
   haLaundryDryingToggle = "input_boolean.secar_roupas";
   haClimateAction = action: data: {
@@ -297,6 +318,22 @@ in {
           mode = "0400";
         };
       } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/cloudflare_worker_api_token.age) {
+        cloudflare_worker_api_token = {
+          file = ../../secrets/cloudflare_worker_api_token.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/cloudflare_dns_api_token.age) {
+        cloudflare_dns_api_token = {
+          file = ../../secrets/cloudflare_dns_api_token.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
       (builtins.pathExists ../../secrets/minecraft_rcon_password.age) {
         minecraft_rcon_password.file =
           ../../secrets/minecraft_rcon_password.age;
@@ -1499,6 +1536,8 @@ in {
     fishPlugins.z
     androidSigningEnv
     matrixAndroidSecrets
+    cloudflareWorkerEnv
+    cloudflareDnsEnv
   ];
 
   # environment.loginShellInit = ''
diff --git a/secrets/cloudflare_dns_api_token.age b/secrets/cloudflare_dns_api_token.age
new file mode 100644
index 0000000000000000000000000000000000000000..bae587781e66410003c243825467d3b6a7567db5
GIT binary patch
literal 376
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+@F{k2E?20CiZb@K
zG;s+kOYsOZuE;LVGj{R{F3BqharMx4&92Pz&U7(~3d}QbcI0wQNeVYGHZnE!&NWFX
z$u!C+%*gWh4=OD2aQDe^4oGt~E!H=VsxmeAb;MztNls!>m3gL9YEY(Iicg4fV0l`3
zMOaFyVOgemcAll1pSf9}vsu1-mVqOeN2FJBVwPE9M!1=eXMVZ1S8=|3kbk+ekw=Dh
zMu~oYpr4m(sijGAWx6YuuCA_vcTQnxNlvi0M@X@@p@&;YVy0J_MPyh`p;L%auCb+C
zVsc)xM_N^(X^9D!-r9{<xV2{r>AZZgVutYPqbs;}J#snu@@r9x^oG9Q7Ja@?D=q{W
z?fSXrRqxeL7H5OpP9J4F`mFIo{iOt@^QD<-DqMMLEVF-4Q{gnPw(jFdWYGQ}^_~>~
DZ=#3!

literal 0
HcmV?d00001

diff --git a/secrets/cloudflare_worker_api_token.age b/secrets/cloudflare_worker_api_token.age
new file mode 100644
index 0000000000000000000000000000000000000000..cdd3f98894536d772fa85e4cc58f573b67bb4d59
GIT binary patch
literal 376
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+@F{k2E?00$&vlOS
zjxaJX_bboLF7`8yNVY8XHp}u)4X~`r%FfIzOH3;W)h|vfPv^?ePV)&V&q}E<4GOj_
z$#BXqFf0rY@h}aEjL0-E&4~=l_cbm}^D_^2NycHDL8P}?c#xl=VPQalTb6l&NqL1|
zSb0>rleUScg??IMrgmYrX<$j9YehPjONe85YO%R%xVDjVRYXxzM!08sh>5vJZiaq|
zNq)FRpmtbla;j0NkwG?>uCA_vTaJOgb4IX5NN7k{N@{RYgpq|$g}Gynzd@D1OHfg%
zagv{*cS(l6p}q;1a*^tZZA_06?r+^B;&_|$$T9QBEK>{H=Qc#IvGvHV>0bJ1w$QG{
zyMA!@?R}umU|u0tu(*IL`4RV@b=SL}E54ui&FIc{A!nx3TKqcy=ifV;6>wLv`e+aU
Dc~FL`

literal 0
HcmV?d00001

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index cd93163..c3ae664 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -16,7 +16,8 @@ in {
   "secrets/matrix_android_firebase_service_account.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/matrix_android_google_services.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/matrix_android_commander_credentials.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
-  "secrets/cloudflare_bootstrap_api_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/cloudflare_worker_api_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/cloudflare_dns_api_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/minecraft_rcon_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/wireguard_private_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ];