From ad7d1cdf4967af7ad55e1db3e31bf072fe244faa Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Sat, 31 Oct 2026 11:19:21 +0100
Subject: [PATCH] NK-WP-0056-T04 done: svc-privacyidea written through from
 OpenBao; all four binds in platform custody

Founder-run under CCR-2026-0055: setup, verify and realm_bootstrap.py
--rotate-bind --from-openbao with the admin MFA proof. The first apply's check
got a code that was not admin's, so both MFA prompts now name the user.
Custody re-sealed after setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
---
 WORK-RECORDS.md                               |   2 +-
 .../01-setup.json                             |  14 +++++++++++++
 .../02-verify.json                            |  14 +++++++++++++
 .../03-rotate-bind.json                       |   1 +
 .../README.md                                 |  19 ++++++++++++++++++
 .../secrets.enc/authelia/secrets.env.age      | Bin 1531 -> 1531 bytes
 .../secrets.enc/breakglass/secrets.env.age    | Bin 491 -> 491 bytes
 .../bootstrap/secrets.enc/keycape/key.pem.age | Bin 1904 -> 1904 bytes
 .../secrets.enc/keycape/pi_admin_token.age    | Bin 4036 -> 4036 bytes
 .../secrets.enc/keycape/secrets.env.age       |  10 ++++-----
 .../secrets.enc/lldap/secrets.env.age         | Bin 1143 -> 1143 bytes
 .../secrets.enc/postgres/secrets.env.age      | Bin 594 -> 594 bytes
 .../secrets.enc/privacyidea/pi.enc.age        | Bin 296 -> 296 bytes
 .../secrets.enc/privacyidea/private.pem.age   | Bin 1875 -> 1875 bytes
 .../secrets.enc/privacyidea/public.pem.age    | Bin 651 -> 651 bytes
 .../secrets.enc/privacyidea/secrets.env.age   | Bin 1143 -> 1143 bytes
 sso-mfa/k8s/privacyidea/realm_bootstrap.py    |   2 +-
 sso-mfa/k8s/privacyidea/verify_mfa.py         |   4 +++-
 workplans/NK-WP-0056-bounded-executor-path.md |  10 ++++++++-
 19 files changed, 67 insertions(+), 9 deletions(-)
 create mode 100644 docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/01-setup.json
 create mode 100644 docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/02-verify.json
 create mode 100644 docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/03-rotate-bind.json
 create mode 100644 docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/README.md

diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index ead8037..ae6e3f7 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -338,7 +338,7 @@
 | task | NK-WP-0056-T01 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T02 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T03 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
-| task | NK-WP-0056-T04 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
+| task | NK-WP-0056-T04 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T05 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T06 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T07 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
diff --git a/docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/01-setup.json b/docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/01-setup.json
new file mode 100644
index 0000000..72e39af
--- /dev/null
+++ b/docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/01-setup.json
@@ -0,0 +1,14 @@
+{
+  "action": "setup",
+  "ccr_sha256": "97e8e4b17e12d6bcbffe5acd4f8fbd68f52fe340333968bb175e8da18ecb6513",
+  "coding_agents_denied": true,
+  "custody_is_current": true,
+  "kv_version": 1,
+  "lane": "svc-privacyidea",
+  "phase": "done",
+  "source_ccr": "CCR-2026-0055",
+  "source_sha256": "5b31b3567af07bba09530c6d3b0ed8b5c947df22bd13ac0442dc33c0d9b420c0",
+  "status": "custody_prepared",
+  "values_recorded": false,
+  "workload_access": false
+}
diff --git a/docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/02-verify.json b/docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/02-verify.json
new file mode 100644
index 0000000..2ccb87e
--- /dev/null
+++ b/docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/02-verify.json
@@ -0,0 +1,14 @@
+{
+  "action": "verify",
+  "ccr_sha256": "97e8e4b17e12d6bcbffe5acd4f8fbd68f52fe340333968bb175e8da18ecb6513",
+  "coding_agents_denied": true,
+  "kv_is_current": true,
+  "kv_version": 1,
+  "lane": "svc-privacyidea",
+  "phase": "done",
+  "source_ccr": "CCR-2026-0055",
+  "source_sha256": "5b31b3567af07bba09530c6d3b0ed8b5c947df22bd13ac0442dc33c0d9b420c0",
+  "status": "custody_verified",
+  "values_recorded": false,
+  "workload_access": false
+}
diff --git a/docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/03-rotate-bind.json b/docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/03-rotate-bind.json
new file mode 100644
index 0000000..b890c62
--- /dev/null
+++ b/docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/03-rotate-bind.json
@@ -0,0 +1 @@
+{"actions": ["rotate-bind"], "configuration_writes": 1, "mfa_verified": true, "onboarding_policy": "owner-managed", "policies_changed": false, "result": "configured"}
diff --git a/docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/README.md b/docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/README.md
new file mode 100644
index 0000000..c7500cf
--- /dev/null
+++ b/docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/README.md
@@ -0,0 +1,19 @@
+# NK-WP-0056-T04 — svc-privacyidea bind in platform custody (2026-10-31)
+
+Founder-run in the founder's terminal under railiance-platform CCR-2026-0055 (request type
+`attended-service-credential-delivery`, approved by platform-owner and net-kingdom-owner, `04d9dc8`; sha256
+`97e8e4b1…6513`). privacyIDEA keeps the resolver `BINDPW` encrypted in its own database and accepts it only through
+the `pi-admin` API, so there is no ESO or workload reader: the value is held in OpenBao and written through by an
+attended procedure. Receipts are value-free.
+
+| Step | Result | Receipt |
+| --- | --- | --- |
+| setup (attended platform-admin, custody decrypted, re-sealed and shredded after) | custody value signs in to LLDAP as `svc-privacyidea` (current); coding agents fenced; KV version 1 (CAS=0); no policy or role | `01-setup.json` |
+| verify | KV value signs in to LLDAP as `svc-privacyidea`; fence present; no workload role | `02-verify.json` |
+| `realm_bootstrap.py --attended --rotate-bind --from-openbao` (preview) | `actions: ["rotate-bind"]`, no write | operator output |
+| apply, attempt 1 (not counted) | one `BINDPW` write (same value), then the `--verify-user admin` check failed: the code entered was not `admin`'s (the prompt did not name the account; prompts now name the user) | operator output |
+| apply, attempt 2 | one `BINDPW` write (same value from OpenBao); `admin` resolved through `lldap-coulomb` and passed token-backed MFA | `03-rotate-bind.json` |
+
+The resolver bind is now written from OpenBao (`platform/workloads/net-kingdom/directory-binds/svc-privacyidea`); the
+founder's custody copy holds the same value as a fallback. Rotation: change the password in LLDAP, write the next KV
+version with CAS, run `realm_bootstrap.py --attended --rotate-bind --from-openbao --apply --verify-user admin`.
diff --git a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age
index 4c5f910569d12a67ba6cd57d2a385da7d8ffafed..fe6ce4e8b83adf1a7865866992b1316da90c89b4 100644
GIT binary patch
delta 1517
zcmV<J1rqxE3;PR@Ab&(kMs8zbSZGLXG;J_?F=k0vY;83{HBmK0Vr45=Nir)`bTv*y
zHZwU^Gzw*BW>s`%XjfHNZ&xr+czQ!QaC9~=Sw?73ax^h8V^=gQL`YC%b7^69RSGRF
zEg*77Yja0LZcA%KNk(aCZ$x)&bZ1s!S#fzaOGsgGP%vU;Xn#s<LU49wWp@fxr8_z9
z(ZS8!K_UGwdik4vu~vUBjl0My;j7dg^#t@`8Vob`-<o25;pYD-6x2crNhA$X%yiFh
zq7#^_q_D~3V>W&CJF56Ih=S^tVR6aECF{v=+*ZK^uT-j#+xO=D!X#5eqKYn8Xv}E4
zLmAk=@5uJz6n|L>68?ZDmF>{KJkkeSd-AW%Rtw3h6?0>?0p9DyC3L+C#;D&)CU{z*
zJ*ZVG$I}XDw8Ok?ZM+hAba|31?OHpTdk&fwaQZRJ`GB9)lQ*YXudhKN9XMa~6?JQm
zttHuXm#e#21vj%oaku;ti*~u#@SN??yTA(Odi@;Qcz;90l^B`=V7B{^bXbixdNurY
zPBhdU+_Nz&B0sK6wqdo?C<@&F-JT)M`VC$1=Nn9xFOp@rEbX|Ei`^LzAb2oN_})%i
zMBz%PfvI8>yLKtDtA+p>jw{atx0r==xNb4rca}iE(t2#kU+{c^icgTMcJiQNoJAEd
z+Tl1DaDQjP-j)t?S^%hWl}z5p3{kXQQtP4D1X^j-?so4#uua;>aNL240!TIuM!|)`
zdgKV2UY@s9?88(&(nO6SvK{SpprSsq*l0p#zf|H<C>=DPKOd?y7hp}8gr$xm(pKQx
zaWuB~|2v9{)n@LzGaMCKL+U#5C~`)f-yTDYnSX2ZS!8)aRAE3_K&YtYUGmBr7}38(
zPg$Cu+;}dn<2yUZFt&X@f~PLdMebQCoXB$PA%^v<6~+)&s)%^^)i7Q-H-TmghZ%~?
zYHGHkR5`@Da!*01J&l+WYJ6ugL{#|L##5A_YHYGBwp7i<cT$Y*uy8XBLd%DDCTf1_
zB7bV+KLwV1-e`Y9V?L<ZtpnC!=sRW_MKN9INqj3YRXle)siZJ4dIhpgu4c6Q0Y`Bv
zNr||?KVZy?C8tmYQ@MJl2gu?(C7_m=GaK=bZ@1(qpr0u?{M&fIcxvT{qp*;4C8{uf
zIZ@Bk4IUD3RbDrLMIOIQMjfjsWMpCFPJg>F=y3f3jN-nfGn(}ELfrRIhnmgE)AEu-
zLV*ABwJ<xMU=u91wJptp+LJlBQ+%l1d~5>e7H1G<ShbuTyZ#3Pi8M4?EK@_Tu}h^c
z9Vp=4e{`iJz+cNXXX74qaNb+c#q}5L3v9AJYEY1+VVZlKtru5nv0-8LR!k?;<A2ym
zgDx*C8uu?i=Jssbi=&CuX(oikYIvB1GEDIo9k?2rg@dDQ<*BU|dbRm<0}#TGqsImc
zLNzIEk31uF5UaEO@f}mQ7d?KgmhfUov$(6Uu;`A~vsID-ID#Qxe;XP6Wg8^G``|SA
zb>}E$qHXn(=HVaie|TU`rxj3cx_=#DWB`9LZla@xab#wF1Vu_6YXVR3UmL6RLt{io
z8r(yQ{<H8$-&cGvh4Gxmx(pB?L%d_HijT2GNV8nVcc^;;diMP36DC*#KzBHcc5`3E
z8)H*SerIw5QYNkRC;)8Fy}Ch>C>?7j-jhfaUk%(ovZj$V?4rWr!Y)(*dVguiC0dRB
zu=y7=XY=AYsIC$oW$6g?;mK%KTdc|V#AgawXfosTRn_TLw8*YNOSO%nF%N$6TQtaP
z`c3iZOXMa34=r<s`mDZo#lAmd)W-A1DQLhj+&*@I^_hp}!>C$UL??QHy34=;H&5U#
zQkI6=E1}|KpRZ+5jG0?Uw`M&vDmXX42Qfe|c++TxIy1#o6=wQano@6RLe*$!4s~t7
z(Hz$XJ^bxu4mHobbQAN$S|uOniitD*&SOmSaZ9RAZ+%ItArQ?3z|CvbA5fFx1Q#4g
TEHinGwQRm#LR=YQmwcfEkc!b8

delta 1517
zcmV<J1rqxE3;PR@Ab(3oZb(%tL^e=abV_+<XH!LYZ!0r&QDSXtQ&BQOYdBSKcULi3
zQcZMKO$vE6XK`9obUAW$NJC9bad~TUa#MA5Q(1R&YfemgV?$|JbZvGsHh5uSFbXX#
zEg(c%X*F7SX>D>%V^~iyMtEyDS8+#HQ8-L?QF=CPVN7smQGaYpVq!sLZ!`);4&(49
zr(0LCEBV{+;bR6zhLvxAj7Fjroy=qu@wwVHV?S%^`jM2--75)kCAWD2o+1yXqSov5
zp_2z~-j9ZpQy}flhTCH%jcjd~?QUPW8AY-?tI|*OydRRCR_Hq^8im+&X>?CUgJqr`
zk=-1&Tc9X-0e>8PO&dayXuXg8mE{0h6vplImZ;l%nJ+NnCueOOle?ox+XGd0-$T-p
zKbQuThWx0YyDa^7!^7{o3kLF+C7_`;`mfZYyn%PXjpfi}W~aFokZ40b1Y;-GJX&GP
zLf>KQMlq0Xm!(9}*iX2v)P)6CHTLBf42sqEDf>VR)PMewGUcMFbR9|(6&!!6s)P9_
z^n9S`+(6u0+lHbJ&k@N2N2yA=!4Sze*ULNOS($WQ<t^FZKcDENHE7Clm7j!H8NCoX
zL^Q+<$z6vN%8O#3Miq&?Rt5A>8IvEc5LsoD^{j_Zb307fe#3yy6i(q|2SpyA<Ya^&
zd4_@)8-G!vP$d3F!eD(5=q%l~`=C{s^kqwr$%!g{C<bQto=BM9*kd_dpM@ItHDHzn
z<-ZWY9YHs&ZJm>rxWj|jw-9Mo(eQz}B<I_YQDa;IKB+DH3g4AwD)T+7lPMz48tH!V
zp=K@Y6;H+3MVnpxmAqJ9N!d-<MAG!E^GMHnvVUgFd(2JBto#c<zVt}2=3FW=Y*~%|
zuv-32evtfdkkxwHu398FcNx=q@_s+sAj_|PxR+k_`$`3plejQ1Gk4Zk95=uF<eE4;
z<S77Jw#NM2mF3iIrTdIS^9!&hcC|&ag*<ciV4Tapgk$!-Myqv^*+FZR7fpK#u3B5>
zb$_IDnr<c6bWGs*I=y5)y#`$CKb~Sab<B1~^oOHzb^mL3QZvW$$CTL2%?Fq^DIk~(
z$#4^k4jg=(o7D%X2L@94Vtp@ytbZ2dEWW^Z2Q%{oCu>AGn_e{2lr$Z8=z?UvFNceg
zuyxnzMJsF}&$rnNzxRBxDSPoNv;2$(3V(xABjpKE4lwJrhZ51vi5PL3dlQ*p)cVux
zRtI@<#EX`?7>?LrPe=eWUSym>q=K6XFm?bUwTn3P@e}g~6)wQXC(?C4&rKcGT@h+(
zD%y(nAR(;Q)lq#Lv%r7d*>fWM6N}$%bY7)>Slv5pu2>Z{s7O_+#kiEC3*xn$fPep$
z{WEk=*NxgajTmupL;p&Dy72B$e~}W=kFET>e76DfH7P^TQpV3+17;nV%C=kw8x69V
zki7867F1^5%^BJC;GklMYA+nUXWO}TpYKW9QNI_$IMA(TA2<ne$E!+7Je3_%<s|=!
zJO+GBj$_ci8$czeWjec12piwKF@G`n_M8>Bm>K<)Z#fYqp`Yx&e=^jeUe*D?zzJg8
z&oH%cRr~$NmICs#fNmZYTZ_F_28}}T*AcIfWc~Yv(qJ1R#I(v_?lht?xYLtT5(9Q~
z;~}2BK#Qjfg%3i4(ONpZ&Jh%lJv3Lm=g>!@L(uW43K3~TW^KB0w>)5m3xDuJ{b9cb
z1{x|dymP8fb$)3iu&w95%^p%*hNR$!W;I+>JL}UesvP-b`)f-ntXMtn#|d)(v9o;f
z=d*BnT-k{c9^&R!?+XEWm4mKyzI87GlDv6+&Nlv`a2WP$yt*eOy=@<A@2~&rjFK0_
zi!tZ}3YRy7%`(a}N#YxfIA&wb`O6ch<0Cg&R%*41TSY6-R>sNmu7~2i|6;AmFQGY`
z*HPvKu_xIK^d#w^_$Dw$a*5K1h`@`d>oCXWZ>7d)6;64vqnjWvB34h8?q#XIkvwxq
TOsN}XvbRVDG-Gnu0A&?8@M7U}

diff --git a/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age
index bf2087241b29770383a1955de4e7047f94614b7a..f0c80c1d1c49bdf22ba7c38b0b94f770e454f799 100644
GIT binary patch
delta 469
zcmV;`0V@9M1M35jAb)8^a5gJ4PcT?bW;Sd}Woc?PdNxmSQ8ji-P&0QnS29CxR7oo|
zMMP#+O$skCaB_JwYIk~bb!uaDab!4HYEEZxL`5<;LNGT}S!!lCT6SzNW@Az?O$se7
zEg(=wS}|vMQ%^H(WHE4QSYuEtQ!_6!OmkXQPD5yDD@A8dSATC!NKZLLdUFao?TAtg
z?Sq3e%a~8eHaETol!UuGo$D^z;;^GH)G4#+1E7*K-S7H{g1+yB8i>%NN`-B>Q-%%+
z2Yz=m@hob_1OOuz9btu>92aU+2Z6lNf02;p(^F+T9zJ5H8Oc4@-=e?lSmIs$@WNB~
zRF(PX##GdCnSVOR5GGqE6O!QG0CLRDQz}>6D&N%)QN174N-TkmOOnQyNR1gOQTL@u
z!#I19z9~c9rL6!+e0g`)jVm^a`RfG5`#jbJpALSOcKX18<7Njzk%p$bkR<Cq^MCsT
z?sUwNN6I%6O9KLJmniJ6k$({)NLi$JV!iS_t-7|odQPTHli=2(8)jY;8g;tml16v=
zx_m>3I0dYl9~x+RE}>d)y`tIlpWFSbk>fzf#B~x<aB@DGgmE3Z;5`zZ(o9)INaL4w
LMo#KiPkQpA+{@4?

delta 469
zcmV;`0V@9M1M35jAb(9-Fi1;8Nm@g7V{}6_Y->tEWmsiPY(jZvZ9+#dGD%8OOnFgs
za8hG=YYJ&-NkVc~N=I2jOf@uRa${L_HcfakO+#vJOIT`DbaqfdH&twEOEXSuFbXX#
zEg(oYcu!_FdP-SJd2d=$FK0DcFGo*xL25NCMm1P*MlVHTaDP#Hc5pdoR9On5aguZs
zTUzIhmH=h5NKpL=$|=qXeAPJTa2~ZSZK0NGDrYiQ?L?zr(}B}BNU;cU_WN%DMDB~2
zR&)Xy?oUj#d$nJM6cPCBpc#tHuwUFBEXjw?+^oC31c!7OnezWbnAy=@slZ7M^8p#y
zPAl%%TB9+}dw*Rq;@}Vb?91Zf?c5RFMn+Q)cTp^E&>5-=>~s_78P|i1@Yn&4b}p?Z
zG}l0GJ7qr3r)>``JgN|ZU)2}8z&L_e+#B#@s1#Y_(8^K_6ZgM**YkTtqFI!C7a^$8
zCAk`4O;9Y1&S9Klky)+_7#97$T+Q}Em3wl;MNq*W6HcquMx7%}&&BD_5&Tz$Vnhl*
zU0|(!t&d%c_j#9-_?;$lNpghO%A<v%7`J`?vLTtjRCg>`&<Ka6NGz4E*=Y-N8ZLTA
L0?Y>6pd<1TY$MIj

diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age b/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age
index 823e66e8fba305befb2d3db0d463b9e41ff93bdc..8cc97d73663d84e67d2f26af4acc7501fe259369 100644
GIT binary patch
delta 1893
zcmV-r2b%cs4)6|;Ab(axRzguqPI*y8H$g#TS~+@BLugr9L3w0WRa8@GQBNy&MNLpy
zWo0#0ZwfU{MPg%YGHGZzIXHP)T1hi7Qf+W|Z*gNoNJcbLQE@{zGf-nMXKPb!NeV43
zEg(frPen{Zd2DS}N=-^@QgJnJFivSsN^eYMad~u9a#LbgNq=uaYD8H=FKY_3((B2y
zP<Me2a*X40mfJDZ_BI`ltF{VEUlo1Wy~~VCqgT|zpf|-0cM6lor_m~laurC^QcDl=
zCPS8p84&d}5gCq<Q(A<Z%Cr9qw{gr?M1+fcsUhi-zCeh)PL_FuG^1Jj3mP{*%0znu
z*5soymQ3=9sefE;Wtj3FRENs6{)Tw9Q4zcL9pD(B$se>M>iD;{3UgZRpUag}b^@@G
zIr>Nli9|y#r}>Z()@O!U{xvQp@;9YUgIvDiTj-xM6n5T&d8M-|iOfY?hD3yCU)uWi
z@hrsg`M5sp5i&rjA#I<==SeH^miQ#qJEy%Ax0hlQ>3_BM+;`k!{u`iK>)6cr62!1<
zFw5UE`N|h%*}f9SNn;JqcVq#=@P#H*5Cu#Pp6#tNqxut={t9dWve;lWv;ZlQ8hW^r
zsL^Z@m&c{=fAn){^VDKsW3EuByrM7A4D4{fR(`@soq$STt!>mB`|B5(>ef-UK!5H=
z(Ct0Yq<=$zT-ItYe&oagQWrm@r!ZaR>kV<iVt}za0f<r<*A_6^D;O-Z;>sguUwDqi
zz;vwK^R_!#4v_O0rvztIGGa2tde&_fy|HnDw;S~P27-^7RxZoZkAQ}e%JbOr#zXvK
zzpZO@_?sBEP3u(j$%O=_V7V64OojcpOl-T!ZGX~g8fJgZ$gT|BiM+pDy8ZxOFXn`d
z*f`L}Rx<-XT7{R~o$EY0H@X#4o{WRFMO145nf88CUUvka?V3wpc<Vs~AKtIVMuyE9
zu0bXB6L~@laSJ(N`SKCRWR@4pQu92tnLC|IEaF-BFTi%rBHQS3GH^DHFrgqpA_XDZ
z7k|6$V78iyNCqvy0ZCm)sAx@EaKf6*7di^tT}LOblG5!CCS6_aQBV4S$W`>rv4FkZ
z&`&4TUsVN2|8Xi^*S4u}pU#CB4(jaivBDJ@+_kk-jz}<RDeARV8;@p#P<WKoyYIE=
z_1QUq40`;Oq0OP@CJr^MVrr{iWT9=taeuv;X1N#Q#%UL^RHDdcF-Em@zv$aA2GYKs
z5#?4U(Np$Z3$7lg7#-CA@C7NZ<B5+ZaFKb#uV~>8%wZlbs=z6|hJ;OsnS_AmDs6n!
zO&YOi?|V&(#cW}Q4$Yd)zyb<wlrGsNmd}U{3C<n<&@nl&#mWWXRw$2ZFU!e|HGkTL
zKV{})n6E1bXn)|;5*6VlppO>j)BNH(IITiwlW0WzbQ?OVdumn+N&!X<iX=7^sMdFm
zKy#>$W7n%bQx{w2P;7bZ296{Didd&rw$u@>9f{~)tBR>^@KXPFNkNHNJ@Q*^L?xHo
zB;J3WoDpP%WzroGSD1D}qBrfw0e^l;V(}1%i$woQw`I-frPQMcgT2oaAo!(p>DRL?
z8#Oal@~j%ca_UC?sV^az7%Vz@Id8S<rL*6%z4<U_r7LMBn(I4pXDC}a+|mx31zrJW
z_}P>BNWQg4y#Ut&pnlqfG+rSVQ*p7i2s9?My11iSe%;FLO4rZ4#xH2j`+uj{foBXj
zH3M+h<%2W&drK&+4=r`WfexGuhyKeC9MEHt@N2q$_@ra#7*{G{`{1jvJOdG9UdLlk
z47=r@c2JIb9oH{p$oG_$4+idj0z8qtIGG{BoaNPcJQgGbidE4gjKg?3gS+gnrZqF~
z;7Kl|iZ?R?Rk$phl~7huntxYA#un&TmSgM`dc2JfCGK7_q>KC1w`Z|_UK|b4_3?`#
zar$^Izg_M^cjo=wV|?9B!8MJtjS2=J6nCJ$+H~2_hfh0e5V+Q;57vR~yMh4Bw9cOp
zC2mE59V9{sf4QItkzGaikjdTu^8gYeClpapD1cZ{=p_Ji-iLAb%YQP?L>Q550=Dso
z=q!gn(YouQj+a;g3sH8!<2Pl9myGQ9x%hP^xf>$cJN1j-h0}k=BN*g=N+u}F6Z_W<
zBQ3<cWH}lGG&Xz)9fGOW$~!W)8L~1*3H0R)-5p+{B!gD5po;os32@)w)q@dSx@>;h
zzM1$0Aj!uV6xsY$&3_PGOgLv|fuy74aXn3R^cQiZB`dCt2y;Xqi%`?jWBU5w|J2Sv
zzG=HqYk)Ig&n=4!(0uw6x<4v~Ut;PlH4hg%q;_(hMRl{ggPSsmI%RpzDA{Q4$dku7
zfy3r(Kel!9kU0Ns5_Jj-rr6vt`6HX<l0pf$(r*NQj$hz34_*!yg_{O+a9T>Z4fxA|
z$N9i7LRVQBa!(KbrdTR;-(8};1dR3s?7lDIH~!k!xe0Z(x%)5CSEUD3Kw7Qw_M|$f
f#*%!imOz1!8SUyHELl`>dWDUf(?Gg1S0yTOJc*To

delta 1893
zcmV-r2b%cs4)6|;Ab(P3MPV^?Qc+Yyb}vd=Sw%BOH8M#vX=X!CZ!}|bLS!_0WOOo1
zK{ZuJNeV(SMsrm%Fhh29Ok_@XWmI!QYFTS!Wk*zaa4~s!F*HpyHFa=gWl2*>a|$gj
zEg)7aGk0%zO)qnLP)uz%NMvJiI8SA7P%}AnM>$JrO-MO)Y=1>fNJ%tTS~LpTj%KIG
z+}F4;gRV7UWy%@hPn-X!w|hK0s8xyGO9k#tQ|YK(IA6_mk~eWk<3Q#<p@bV~!ZH?}
zFC_w|nAFgB%yj;jlWlJR^ya>ksYd_vmtw||uS~{IuPD7;<>uIHL|YUhm^lurh!WN(
z`K{#@8GCni1Ai<-;L>FWHxO(UUeM7oYr|e^_7!e>**oY1Tgu_5S#u_8(D}zm*&?Pj
zd5+r<a|~u9<K1)qI=|6z7N)mVIpeSkjzki;q#vhNK=2=9+4Ys!%a|-SCXBhHb-r5S
zK))3=)r7*tGbfA_7Sj#1gsX50K4y7tZA+t9k>G!>-G55>wV626KZ0&aZs6QkCnfBG
zRwrb5fNHOFkc}N&<N@H*ye%@pr_DH#a~Wk0{JPR3FO3NArB~#CD;SBNAuq8D<h`U*
zm9GqO6uDzLo+R|R{4LfR)s9U~>A%DlQf7B&2oAw&hQHF-j6=ZD2w$^2=+K7*cc(W9
zA$r0TM1RL_gphf1u4LH0TqU%P<IUAi%)}dPjC8tX2*@M9e<sn6T0m`u#OW8hKo$yO
z@7QD`v9|T11-n<4$O9|omjW<=2dsnzAfXp~hKQ-n%oRXrA>pJ;GE~i>Tvug9^y3t|
z8Qv>{5~M9Nth}w<A{kFiW@67*+hv;_PcQ6<_<!8Kcdb6OAc*adsLvlKYc>V52V-*K
zX^>q(Mt=nfrzorR>Qa?&i4#(9d}~KVn{1X4z%=Nmvk00J=6X5Bg<F*MZ_GwBLo^z>
z8bB`k;gl{0^pmcxQ^|6=2b6%!N`WQTeoCfCJPGXh+yoKt=3AFfAs!~_HE*V0d($4%
zv45&m^5IGVPbr|NAU5;_o!P)3uDb{ToOyII03@AC#FKD+9?+hlpDV7fv*jR;sMjhG
zrhcZtqT4i;c;dt#xpkd8JHdLccDHm`2qgOPa^i74C|xsUgwBQviMHraA4p1Dm2oo)
zpo&KSJRY1>;lpDh{n?iMEL4@R)jCyHL4T5lE%haKaxH2Xs1Y&oPBqDAmnY<HfMZ_<
zt_S&+VTJt#W7VV#33~(Od=Jm+`NL{IXdAi?L@pa>9-wP0Tl*T9D#ua5#&!6fRU|ga
z(9^8nnSXdA1x@Aiz%6S6v@R@`lD3%6MNaqA9Kf(?|9|<^=;fxe7M`^F;!?Bj=zoH<
zuOSM`!?(M2buHbP#{zd-{mx;(`C)T4`b4^N0c52H$KueMM&74gx;lFT_K0SiM;70+
zD36*uWUm+7sRGx$3^qx1c}Hw0?#bl(YyAx6G7v!n3a+{qkU09HUgCII!$Q2;a2u`5
zl&%}4rG-?Wou%-;rhu&cGw9#MIe!*m0Y#R%^`2RX5X>1aNDf?bL-G1M+FJJ2P1{GB
zEqh`aUjYk1jzi2>V!5U!ASjNoIM;1GOaqhrFWp#=m552h;=hMZWtglhCt7EKb6q}o
z{p(4uVeE#k4E1<;PhvP)iKPiJ^)3qzl=ml7sT;BYAE)f~sK{32s(GN?Sbsg<eV3dB
zGLN^3MOHF{5IBPeO+xZvHxD0+24t%VH*=G}7SEudHMmVp?|-Wh<?6Sy`e=1^9sKK8
zfo%g_o58RjBz_wc^z-wI(0(qo>Tb$c<LI9@agvahb|$#XT?=%#+%6BrsKI6Cj15lU
zgtqaVh>(7LfPX9My+@+~9Dn|Q=2f=>6Sb4`a2g%R$Ci@mnRhFr10u5$uFK@L2jwZ&
z{zybyRpC8?fxJpPCj?cnb~NF%l#RM<Jd@Pr;_fsRt3(O)qV^=ylwQB|<X5}Li$7j-
zTsKw13uc#0TpfRt9QJ9(^4!NG@Y*T|q;?jRN&$~#g-7v<Ere#ifPbDqIuog@_%0gy
zTB-EG32qkmSGVw`X+S7*-O1Zb1qDEPf{}h%4&CuHIIB*)(>?6Zwfd)}UZK)Xt=Ofv
zp1sPZzO(6bvq=Aw#%i4TbNOdj_GEC+wDM*AEImosCCVE~2xZH)_~sWlQqnt0v7c&4
zd-*l0)4?3XLOMl7fqyR3+js7tER=Os;BWh|g2P%mzgO2$plyXJph+2*ZV2tj@mgMP
z-?j$tqwLRV68FfU+9vQI6W~v>5>mq+x(d)x`ATr$4-b<QYbE0hvWloF#&&I5!2eI~
z+hK7%pr(&?H#XHD+!yGjM)QV*ZuV;hF;`<DsB78*!e3jDdtM?$gg6Xnt#&z`{jVZ&
z9Qm5iOzygWjbjm|wC(@N^Sg(HX2dl1+^rnwFAYSeiJ)3-AO<V5>466(+iXfO()MH<
fz4^$wa9}li_Cr=XC=#}`qa1qbg{GF4j*s}Yx674+

diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age b/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age
index efa233da3ee5f4e7220b8dd59ee62e5945b16bdc..2dff9eecb3d8357b0d79b482638b5c45a7966f8a 100644
GIT binary patch
literal 4036
zcmV;#4?FN-XJsvAZewzJaCB*JZZ2<fXD@a!3N1b$STZ#=F*zV)G)YHBWOpkxP+@vZ
zcuhB9FL`rWWmPyuFI99}Sx;<NYf?8xMQB%QZEFfdZ8l0TZ!l6)b7@F2G*V$$WHK;P
zId?K|P(w#cOF2h!YB?`ZaWqy=OK%D-EiE8JPeoH|Y&BU@aX4X2PDM#{V_JDRW>!~i
zGAndBH%DS-FjhfwRB<?PWp4`b*Fv?vw=7ol5I8Er!lq?lLl@jR6=@2!mog-w8y(e}
z!sQI#8OXn>mJ;c#7Ni>B2AdHIntF@78h^Av`9hKfyzVvHj`@)Q$6SC-6Xcti$Y^4i
z`g$Va;~hnZo^G<^S0P)D<lNHA)rs9nqcDV5Wo{d$t;XD@=a(dWyfHL(xgxcp_+r*S
zsHfPm<ydMSB-s43vIG^!N<^0SWMX@5IACsDPK-P6?~7v28N4be7yJ>`ygfegAk7Vf
z8gya`)#uff^U^r#U9rgIpx7HQ^^H~?Ia~SdJ~)H-E*+Q@z5`7|>Yc|-H$>=wo2tJ&
zqbo+fT)#d<v@y+hmuYKKTNPBi1#eY>x-~1Uz;V4xViKOe?{rHXkGUGBfKcau0P-rw
zMwd#5FXAz#_Ix?p<i{gyV&Z%=VyXb(MSCnggX~9b++xc1qzyu-fAKGGmnn8e!fVX^
z%(EHp*@n_0`ezDA6h;-In8dZ_gIxn>z4HX5O{Z_QTaHJq@rk~hX&By`6yAZUg63;Y
z230@qst)GSU((uu_)5fDu(JV0x0dYp)xuhw?d$?l+VJ@Pdi+AHNr<ac9Hja{0~<N1
zp^ikP*i=9ftOT~eZD|>qtChD^&((2X8VePyE;H^cfq%9ni+tYB7m5?BEKZr{jw%xZ
za)uomv+!g?B9`I2k;uVwI{*=>gh~mBo6<EK;EGU?<vy}(T=T>@n~XoRA~dIcg1QP7
z#WFz^6{clr4BmjBBZ9f<ou5zU^oW1^r{otWdsAL8Vkue#Erh?WNRL#z;+G2NyBBjW
z`fT;_s4yz}XOk-d6$2H<dck0qLZFV__&Ty$?0>=%lLPd%)ai^DPfy8)sF<hR;k@zO
z&g})#ocmWeLoEG;-)PUqg=PI+ea>Q(EkHW@M*AI=&!4HN>g5Pe1RfFhGz$aoJNpCg
zO0-*@@o~N0jCufp5K}p!3m<<J6<<Lb=tv|Ph6}Vw&H>FF+Fx^oiqdWmCq?H*xC~KE
z_7M!j*KlmjuOkbE75*dZE@c}uA+)p4g-<ou%ww%=LwW~iE#e)E&BYyg?)9EsT?vct
z3p3<Jx#8;MGzaoY)@+!04X%%8uj(-0S2}U@q|=*Rg<&D--j9p_n2hDkq1!I)X3mTd
z<~~7&tp5;%(ux@ilAOM;Q$7KdKS@(p<IL}$&b0<PU}X^#NURXiMzSY&@-nZ3+@ds%
z4(pknPPU!S;_K_yVsUzMMYg8n&qmJrN4G30$*amC_6!-YmkJGr5ZRXux`nD~gO#{<
zjwZf!MKh(K_Ho~S6T0Zc!lEpZb%8=*>}Gil(k0<xQW~zZBTl^11q*oOZ%91;KoX>a
zLhXqDN{J(mYwXX`M`g|>^BVMCg1DPu8(LQ`p{+lATgocmz(xI<kR$CV&Wu>9QQB6m
zvqcCPISi*e=ke@Sw0mKy?%Tn3W4MB4)nUcLcFENEOQycUlD630A8!-^&rEghOwego
z&r!W;Y}J%Iqqjos^X6?cenJ05A@pG+(k)>N(AcvtfO9%tRur{1pXzP_lP#-eGpE$g
zY6udl*!;$NPn*nYzk;-v7t7WR2cwp)RN1ardO}2tUso3X#h@(gZP+554-8mX{*x3h
zAav)LC)zPKx4)bMgXui6e`)@&*c2!Voy%*=0S4jT3?dhfH34lxP^kvzskw}i7f{^2
zdXrh21;0nz@$PtNV2DX+ZN`FleE9ED{G>=9;O4{NOcRWw>xJTnuAmK|U+npx-r-QN
zbjfURrC())1IW@`e*DnmjFGyYsc-UPWvxGuY!n?@7dE?^j;`sA9U~IWVdgu}z^sKN
zI0A8ar<E`Uev_+)_8Z#_3C|nuH&V>v#i@P)n{k|&BZ~i`(DGWRowsDs=PT7@(rYzn
z+er-RS{DY+u9#xCJ5^qUCNgGsk5Qn7CwBl)4^8I&w^7EHUaY}m=8}k0N(J;0a157b
zH1BCgbst+eN<;ltb63R4IsJnPKvWT{a9ZmME!O#IxM|*lPp0ION;aYh*}@$l$z<l3
zX?aTZ@U^InU{gM)m1+XBnAF|if~J8_d^~052w4q>S^s`Zjx#u8f3%r<e<b=JDV)w-
z*`gi&#I+#UA}3qK_T)A{l#+04i%AY&f$H|np<6SJZZBy1bik^qrggrClKD7I8S&OD
z@BbZe$sipQ(e%aLP%(Ij6~!2N7sujf@H?RWUG#!q>0`Q6b#ZGe=s7E(<@sK?#U|X(
zaq5T5;cp8ne=>FWHqhOxd9b(~A#StlY7dv$I<{sfR|OthUm1jf36EFAh}hs(tg$EA
z2})oIL<N7f2FavKQI3gA?(R@Vscx7JDuyUk{<guGI^6x#SWJ!;t`wXsA#{{Xj!w@d
zQBAsYe1Jx`OetiQ;epaw@Re1wXA%BOV&X;KOdV10Iy#3<m#5jv%942|X<m<LKlOyc
z2SX-(VLZzctK30XY1ag68Mg-RTpXQ@^yVYG3S$qRHcu(Mc_wu|$JV`N2N}SNk!s9x
zqKk4Hgy@79MV;{KMY}f11Jl&Ni$r6xb%zG`nGP!+gpw5@Pi;oVjX?fk<(z55yE_+b
zms<BAj2b3McVm{SBHJ#BHF%w`Z)X_B3x^|O+WTvpr|h5?0*W?#$hKHiw(c7UHt53Q
zkZ%1D>~Z3wuQR-f^Mplzkeoo)Rz60p;aA;0HGi>VR6u9T7Hal)VAWg6RCRTqGwD+{
zoj>0*Wcn&ZBb#?iW_w!&_{=4Q(z4foZvlV%VV}(tkSQs?-Nd@_Q@qqT|APC}pfEt-
zKCNd=5^8z}6)LBd?H$QsFScWqj#8=XWZvK4R$W&seo?XJujy1qY@FRtJDP2S-2>xF
zPBe+K)EbS75G$aJ9%L!jNq;+a8tclW9tmY!FTeD_2&#A%MHcj>gPU$6Yp{W6e-#-b
zJGkb?>|UEWNU3mMVQcNlpkxTZGT3Ak*BD!o!c`L%^N8O%n$7FWI8aY|63HFG^fECr
zd&!7g9b8I|Nbi&SP!A}#e@WVji>2K$lOkI?NHDZgO`&KK`Sp0y-HeTZTOHJjKQKDl
zoK$2*ZwPk=eWfZ?By9z2m<%m$PdQr4PDaO<Yk<yKUoJy?bv<*ocB{8oziY129U<MN
zpPgwHRyjht+}D$oQ{RaTiQW@ikH)Hjb>wcy&)0j0q-D6RE@HMidN((5UrnFqZC}gl
zVj@?|;w4;7LM*lJ=(P-@X0T1DGsYt4B)@Z`E(hBeQi`bl(LW*T{^s$uIGk{$+K4GL
zelE1#@6@LgX%E<<!(D6JGjT%PSFD*@p(iydW0?l;GApLuhvZP98FL0a=S1KVgY;l8
zuyW@vDV>uTd~z=zh-_E6qU!Zu($PuKh|G@s<nXrM;qfyAT1;`$aSXnmI0c`WG{i0;
zB97qY`W<RRHZ~3PVb)`isq&CiviU+IAYq&tL6kc*xZYh8-tVPBfLUfv(qMX{>_cTA
zn;+06e(#nTh#Ht9e_guT?)5nwX*uJxA;`x5(!3zYk8wqHOh=BE0hwlby5l>lLa+mu
z6O502sp@tui1{~3I=nyc+UKu%bHX*-i5a31(u5NSm~LjpvvdzScGMnsop>e9ZUg02
zr~A#VA7mXonwCuUuPAAw=+V~}k=1{#Q#ddt)J*CZ_v?1fjM9fEJE9O}69*&owRy&Z
zn_Po8mE%6!p9Zad-|AH*_||xczC&k$H!qx?xFT<$VCyjZWebeyHk;@_HNKogHmzcb
zL|Eyh5_A4lPmmq{S8J6?m~v+a32#2G#dlTn6=RTS@qd6J++Ln7ycFSDg3fK}=e^hh
z{e+d8G0Yd1$MY9oZWf2gVV#mkd7O=5hXp^3Lx>mfx=|qYnOXM;+ylL5EKOurlnI71
zIju}A1rZ@#Ctnl?rudFRFU_#808USS6zq&Czzh3ecZ_=NATMgKrdH^U9`~%i?z-V-
zxGGsbZWu~5I>jgW#fYp1CETmjJRltQLe~c;o?b{0C3QIEdA){h{8|=QWXmkDf7`<B
zKBB(iD+);p!`m3dH1F*hE>@OA*%v`uynfDA&}NvHNvk?>4Lpw^mRQ7<bv}0yOq}Hl
zLg<hC?G)f+)E}bwx;GkuAHT?sbN0Bvt*@92DU$qtQz06Rtj6qC0LxLJa)TbrI7yv1
zW&;P)4|y+n;O!h#x&M<(ndz#3hbRA&)270QVPA;kBO^xBO!MOjKlpM=GAj7_ci<=9
zv+NcFRy9Y3Mte+wi!N@@>8de&TwgjrR=KW@+Hcc=bUaFVa_TN8`yG2YQwBY}t88G-
zWSs-xY?4WUL^igFsECk`cu8YFMqttu%jw8!;!C*b39M+fC?s&j*3a2rIRR!;L!iQp
z_~4$_TmdE3p6s6i-P$_Pmg0;LR)8)01$hD12r@x^Ihki6apxPjQPw2#%%Fwm|E0&r
z`Fnqqt)IuMwU204;djQvEFb;l*qGk4m|A=mJ@KycW(k<%Sv3%K1zkDPB_O3K@?lg7
z%T341W<U!=sHEC^PJ{?@zweD<;tA@39bU-zl)hdK9oAHhB+TaW>gol;X+(~@XEE|l
zRTob#OusCeV0}X`A)bqq-~IIRBrFjK22)XSjcQJEQdfYGj^vN;fm)c6mbYzCn)H%l
z!PZu=Y6~(0$p<xn2)TkTT!qEGD&+ua>WrRu^WI})KeImNqg<@9{?SzBXD+0(<PBv3
zKh-uqk1Oo=(3N%Q8s&K!P<>g?@(?mmO0pDWa@i(bSJY{wOv@vz*+L6?CYa&Mxo3>%
z3<>i!`gFEN-EP+Kc(6m3UwuC5YFiVX64dG-neK{BJX&bPk7=v6Hlsa>Z@MAx_ovpM
zCkzBl+`^nFL>#E)Z3yHDJ5Z&CjwP_Q&6-Y)9oF)iB2uIJ*k8z%45a+i^3!PF=z?Fk
zGTSB$n`|$-tpKInZg^8WZJ1?*DJ>R|&kx6L<XLjSD~4w_zKd;ksdv{8L*rr~q)08e
z`0KGGJf}$mb}`oUA~JwO1VjjSGv&6g#W;;S+;jt}c{Q4xYhXxCss=@DpL(KglNXs5
q>#VhBx+x5^1lVTr7oU4l$M{F+q^yez6cCum)i3W{BzJ~{R{`ZVF0yj~

literal 4036
zcmV;#4?FN-XJsvAZewzJaCB*JZZ2<fXD@a!3N1b$STZ#=F*zVGMKoqgYD-CGR6=b*
zD|mD=Of^PSVRdItY;;6Ka7a*5b2CvxV>WSEQ!olda(78Ha7$=zPIO8zM>lwKI6+5d
zabs<Gc|~zEYeZvbIW%!eNn}%bF*FJ-EiE88QekRUFltC*Z*^jNbx%b@NmyfAPf>7Y
zNHchJVNy_dacpNVXL?6wX+a7^p>ar}3sK=RSC-qoAo`}T^M}|EO}I!uv(lFxAkI88
zC>6f=Y3Xfo%{JL9{#F4mB@lqDi6@;JQD{fo;WK7=sE9a_$2pexx@>;RInX6nkF@Cu
zF9*zZqvt?R9tM|Z=SZp4WSlc|a<Wcm|Ct_xN8@n#m5u<eWhb*l*83n#e(m+Yd9Rvu
z$}{Ka4j@h7FB>(GfATk&1@y&<9XkNL77$r46W8}@vYF`Cv(JVho>FwEtIlsN>eE_5
z7n?MSHO<Q9olNWCE7FW%-Suay*x~=d{g9|0MsFwM@ir{4#y+kuYX%(d8_q|2Bnv0s
zP;Enm_s96Nf;31a?E)71ki6Lr5Cvct^nG9Hs$MsxY69h7@emTOo7)TN;!xxD!t%f5
z$eOXu`rA4hOn^HB)m<|kxEFwq1wOThN0w-#ETj++A$Xb`>X=Q}EV2R%pNO9_AwGdM
zIJ5SNml54m-}==389aDZ_;)BZ19vlN*x?QuzC5NXDY{FZ9y|K3`pI{+g`iK2)Pnwo
zGEf8kN{(oRUw=d!5UmI?&{m2+KTW;NQ+?PV;r%ZFr!<ZS;s}sg(kz@`84d*3m$~!M
zeWLsT2sW!_y4veT(9fPP(GrfRBr}`V0GEtmC^UozsA~~UO;1W{rLWrl&uRe7=-uU_
z8Iu#HeJyg^EyItWJW@aPrPtGZOJ++;esawC?t8iQR|-O1b&+jGTQP`MXs^GOZ>l%$
zg)imMCe+&hKAPE(!8e(M*i)R7t7zl7p`P?Nfe+n}9f2Er3Y>bm(-^L(#@`#2VXG>!
zCT27>Z)WU`<Om)~I^O@?E;8U^`8<w8#c0>IC@e8aGc$&J0_;K%+HZCv?7Z6-Qq0Dy
z-fVnRZpzfebAL=Vv_(>C+s->sJGm`-{P9DptVf=S`*n}3%Fu${19dF^mGM@s32pDY
zCZ8GnQjck}#+nJU%eW}KCAT?Z_e2Uhe?>;y*Hi>p2QYsUtbk)8&0Kv2;sY$v8#jJX
zbRJKqk|=Hkw~=f96MFXD#T8BUC;Jh1P=P|IUAZAYsqI?OgyD6?{3dP7mMXVfh`4?D
z3f{Rwr10n4tb{!oNvJSEn-AQ;g<vC7ku;fi&In^uGc@)W@W<meyP!_8S3d1~Yx#zN
z`n?DHwyelaHOYQeiRZ-`u}Q)?fM(FVxx%mc*&s^Kv@wD|Fz!I!8LLMeY`O?Zyq7%S
zukNINTiQIEh5O1i=7Mx6>e&y2MXvE^KtO;CI~a*aBE1PAeg&rIuDA?67*h~GSy{gZ
zmGkXL=e}G13!(m&bBbD%l0sXuFU+~aOd6YX-NX)W-9MT-($GcN_=<fD2u+O5uJ7D<
zBmQvRZs1q3g0~ZSFy(~c34jnU`9E(k1+dj^j36KYRTeBYm$u_@=|5@C7!zp&WM5(G
z7UG;zpYClGlq7=8-FP4XQxEk~KXoRKi8J>^qeqFqfPcuL6R-Pm#gaSp|E%1*?)8_c
zgM#S3Q0;!)Yxjg<TXc8|xkyL@mLY`-v5<*&$lZZ(ONLpkFONX^0ZSVuYZ9>tjqo4K
z-6fL_FxY(6MsY+W{iI_-{|>JCbjBlH*mF+z0qlhWu$Wkl0oT#pbwy4N?H5zYR0>22
zQt?;{vK!hL&5Pn&a!}r`*lN4%-elYGJ|xbqQ8hI+ifFM9+8XRAA8lo{21pSM3kpZn
zfAvs~&_%*_2CqFbzj}0v&6HO&^AM3CeB?(yEDkoh{Yy28TEcMDL1$Z3|70G2c<kzC
zU}ej~5H4|c41*$}h)>UKGx)`NL9Lv`;K*P<jgZ9O_fyK;wDBNk3A>JxpaD7EBp=s8
zsIAyE0f`cJK*CoK3$7&$hU)<K_*<$ONEQMEfV;PCen^A!kB><pn-X*l-A^|&jJsnU
zBsQ4@6&!YJx#6G>@xDu5!Vc$;LN(Bhs20NIc3I)QDEI3<Dkf#!H9D#OGjYB=A0YE>
zUDgn=Z{3XNj^$b~q4rq$biSzJo0kOz3^Sb0d|S#rG=&zg&X4R{`0V)6$%{&Th0XJ)
zOm_8OGxaPY2J5>EgpG7BsD4%W&rtkw>Q-m4^^62WyN=_Kd_<tLv0aBGFDkb(sOAPd
z4X?456P<j&@(*wRSZN?@l6BoqNh83(Ttvmveo?Yy{zli?vNDL`=Hfc<1-1TuX0f!z
zl9cx`f<|^2A`Lock5e>*1zj!IO7wG+|1sO*$F673h_ohQh98+jXh*w)8xpN&D-B2n
zfurMTiUu*6XNt16+7ie``?P1i<sh7;r-*G(@puH8X6?FGDIxy}_e9-FuF9P%w(1Ca
z$N%)&EwGsCA+Oq>P>PR4Cm~r+cVm29)^&5}Y^=~;18~T&R#EU8u@ENYN@XbCyQ8t8
ziTAMG4}WGIN?k^b-6jB@-hAs4)j6j&n|j}FQ<D}UN&^;v3g-tWn=$Gb431o?Rtn7_
zU?Z&mEi01R+3SjHtGOTmjGu#8&X3Bw@RFd|9~G)ob+$xn&y>xZ)e7`{TX%m}xF6cO
ze^KsH>CY9LM*B7$g@d#r7_B}aSH;c1I@q>WPV3Bvp@~uULAeOTmL}E0zTd?i(sy@B
z&w_imu@{6Gpk7wyQ%Q6@DaM&Cxd%u~zy4a~&r>1$Mg~&ZlH4$jV*5H_)2)0OPAz4#
z)9o&vLKPSs%2W#z{cHRkrP=qViBH&Npb311T1dwK$UKceW>^C;ASGAa{(`6bO!iD+
zcf-E7w_ZjDPB-<?@>zg!D}RWnkLH}zGE|<17Au;A4h{k@>c4UzLynpu|BDa0U??6c
z%4;8XAJU*q8nq#%b~|%%p2p3}mIPQ^rOIEHnPpngX%_gOhw!hySxa}&pufz;K>f2}
zM|bRukE$B%$3h!6)b~undJ#bS+e#$80_;Bxmm|~&?Rj^;FqYw;%Lbpfi#7YwXJb<G
zi;y_?+>~o?n|<*h_LCUs?J_v(TPR67Hy*WNCW?bUmHH`m;R!eS=oZQghTP#BNRO$A
zXFRY}+LnSel+M3c=HUudpe#0Wq4~}u28E#i1++sv3l@+baE~&y*nv&ZWe*jTaMiy~
zCvg&xN+Ood9pbwgy508vFgz&|l*!%fi(BUHd^y`kB#U5@wdX~uG84INqCVR}e3vKe
zvGqgdJa<)1|7NIuN7Q1N=yJUd-`N%*jDwY?$>~!kPvi1LJZ%8SM?^lr(=YL$e7?3Z
z;ckzhx`;8ZvXgHNo4_Po1W6%*uUB3ep6__NEnW!+)DJBo+;1Tke>L-={D-<VX5pZ|
zUES}Ubp=PH^}s``o?_kORo7i5E(7R+_kh$zf1~3NR<fXe1)#hA(5dSh;gb=F?CSp)
ze(lf}gC8EldoVdQDOd2*b)ZPcmQ$WTxkv_HuMDZvGXbsgH5JSQhs~PJR#n|>qwHFA
zBGE2=56)ep4&x8?VztKqLzrx}RjJ)@O)uh36kjldLh$##2T8JC55vZ!z~Lr(Sng|^
z2M*tw;96xw8hDcgOo0VrS|TC|huaVDEqG#3FzBpA=gp2_)_CkEIt2_{wuJ}-y_RzX
z9`@&EtJ{1mvJdnAVRZ^8VqjMJW*az(0WC$}BH55iVy_^5Xd3xo5Qv{Jg#Pn1TLGLj
z!3-u3ME6IC<w!k+^DWD6%HtMiK{JsCe|3q(+_cF74S@aL&Gh{ErZq@)QpdB&47G>h
zV4F$(6;ZElTKh?C6u7EHri|)~y=x-VN+G<f=&aDMm6xZ@>F-o25=6AvjHd3Mv@B!O
zRdcn3>VUs;fW6g-N(}w_3)kpixUMn-)5#Mf8Ax#3b5OP<OBpM0iWS03<`!(#ubfw)
zh<R#JCrtmw?Ea`RGdA{dGt%fnzDVUQIse?J7dOJ$?`F#jQ{V5VY56xwlkfxJQ=MRf
zipx3D3a^RD*y8QQaMheJqA!_r8)7g2Cmdb2b~hl89GNb*C1%j2S$M8IUpnU|j!oDN
zW>eci&H>+DKar_g&VA+<0c@pRB@hj02gCc&x%{fnIydoU=+*+>zp&h>V4G=6PtwrH
zEA#8*Yy<cLpwOJ-RpQ~kO0_4p4%89zy$+Q0J*Sw;`Vd-;Rk+1?x9_IAht^nJ;h|?$
z!kOqqb+{O)f6SHC3z(SeiR43L#&4*Q+}~sXePcoYx)F-&$!v=71zN>+I&KV9UctI}
z7mi=ovM$UGcMP{3tlnzu&|W(21MkQq_1Wm9)H|$y7qMQEms^5JP1lgoCtUwnY`Z9V
zNP6Fip0Sasrp()92O6Cp2bF|i%Mhgp>$gLYMrD3ZYL<J!vIT5Mam;z~pP?li27VJN
zD_K;BLBa_JU{0#t50+3z_1CAh$w}>%ua+aF0OqDSu?R%4n#m=tUzy}Yrd}EQcc;FH
zT^eQ_GPB5-1bWlaLU!DP8>g#FuTFW&!xR$?EhhUY@vl4-sE}R>Fq151tG`h#?CBV~
z5OppYGgckN4#Kh$TCkju{>NBPb3(oA{7xXU=m!JV=<N}dw~q?(r@Az#?rTtB<%_e~
z>*=8%BXi?f8{qG(RsXk4yjb{R0LFas3JFN2G*1($N^LDNHg%Ffxu7oYJ`(<G7lh}D
z2@px?m-wp{EGG(7Qwpe3WlvCaA0wKc)KL?_(SI}*Q#BZyd+OswdZ8j2#q*QZz@#y@
ztT^krC8TqLjWzud`0tpk3JCt`Fuh!uEw*<(W=<4Fn!|AiP1qW%wW1Gk3Uu58Y<-1#
znB<_b?B+6`bvlR|abp6AS-gmS4R|Gb&HrntNf^ZPS<uz^DSn>I##=aTPAD4OjGFPm
zI%*Q^`8vhWB-8&`Ztft55QBM(FjEq>8nnpKDJh$s8W3jImPj$~SiLHt7<EvFIWu5c
zrFB$wpidpb8E-;0k*alUsx<Du&B9FawGK^hR3^<8b-f{q8#qFF<|ZxPw6OH2wFz<r
z&m&MGD-{5%@%%-LNvG2hCs+jc7!DVO0foTN<{CYe$U0JmN7q?v5q4967Y=EEG<9ju
z-T>5+d>^bMAGZQDOt<lOT$PjaG_LL$;@M}=UiRD-s10iX;gIG7kWr9hW1WzgA{}2`
qLMxs-{<Nkui?eXfU&MVD<O11fcr_4<t7+<Ua3Y}I5WWWys>?VQsI9aB

diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age
index 2fa3340..e9c0073 100644
--- a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age
+++ b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age
@@ -1,6 +1,6 @@
 age-encryption.org/v1
--> X25519 un+UWbG5oXAsm5dXauwEzU41cpG5+blwU2gbAkEmVXw
-j7kyOG6iU3FlO8Vcc0p8LklEjMlPw5kC8GP9g3mffx0
---- JmF8vLxSsPTLu5qhvDscgD2EwKpppCW+ELfpdjFsdvg
-#��╊�\]� R�kHG0�[O
�7��3Q�U0t����6���2���4��؊�l�%q�'}߬��)q�Y��o�֠G��=�����^9�„nJ�_}��P"�ùO����y5a�v��牗4n�)b�ċ���|�2]��tg!�� 8�|;��!Ǝ���Qm�l�[ʯ5���5W�_4+�
-j���8�S��"Ĵ����º��~vz�D��;Ύ�n�yf��sl��-�G��Cb{��k�lw~f5}��H������������
q~��x|��0f�{a,D��^����t�`�vN��sc�%���#�F|X�M�zK�l��ve2\�h쭦�����2�_M����(͏3�fլ�m"+��cNY���:}�����0�D8�~���h�LPZ�0�������ZX�?�q"��
\ No newline at end of file
+-> X25519 QLBViIVzS9+rvilFUi/3fTJYoWmfLFnatUUgeSeLWkM
+CPWJ3Dn1NY/Uo2+8rzQcwaIeaz9HD6jmCm34zPw4X94
+--- iHAsNfMnCuzehlSl+WmGOY7TORSrlB/xpV606yXPkcE
+�B]M����2�=�=e̮ײ�;�`�<q�B�A<�f����COC�{K��aB$�l�]��А�������扰'�t���V��6�|a.�ޥϡ$�Ц�V��I���;�fS)N?���	rc��A�W�t�?�Y�x?��h6 6����7-/�4�Wx�0ζ��p
�b�����I�[�8�����J�V��#"\a2M���f�o�gg�[n����9U���P�Ԝ))�˚�cJ	H=
E����yX-�E�)�9�ͮ9A0��h�iw��ui��*!�v��0��L�RYp��^�Sj�����N�}>��5_6
+���:H�f:W�:�ո�p��]!��w�^�O���*�
�ʬ�Z]U>�Z���	FJ�⌻ݶ���̩�{Ѱe9�2�׶7[��S�\�ͪ4�iz�\��m���K1
\ No newline at end of file
diff --git a/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age
index ba01232d7ae81c4f3c1509bb5d7ae814d1e78bfd..9e8934d70d7af965a038d9b1b8fd1eb6fa9c39b5 100644
GIT binary patch
delta 1126
zcmV-s1eyEy2=@q(Ab(X?ayCsvLTgP`H8gs5b7xXYL}F87WNcA%Pjy-{b!c;TNk~Oi
zPgrbeSqe31ctSQxR5Dabc4}=<QdCK9NHIxAMQ}E8G%+|zMsY}5YAbIrLPkSNI0`K-
zEg)lfVq`H!OHO7pF*I&&b~P(DMsZ|tV@7jOZ#7|cMNVQfLVravN?0^_N^c6wq;Tv`
z>U;3x9jY!<B8NP7qJ#l&5vexaHFoFZjkK6X!=rpdBI`aAf=BK1{N6YYvvGPv&DcFB
zl&(^!Gd9UvN0pCbG%NKR9hXbdC5ud192_@_<cE?wC1W)v_4fKEC0S3lwS4BuW$KhI
z+8Z7|_sQq$@P97|0=BJ+)BW}cy6}-{cyQYsFYx*9k8i%p-G@6OGM9e#5M(rYi(U8c
z-dnd3#3DWaeI)yEb5|4S$uu4{TDSMDFX!9z1EQC1vY6HEB9P;iq<82l!^+YU(iYcn
zPjImYjx*<!+RvtuHkC2k(Z}Ckx{L{>V>*N>4wD~6et)f0`7M$;g?`sG`tNmw)lfH;
z6>7R@uybIqz=N3N@xQ=5uqoXbA0_)tfC=|Qc{3f(?iZY_u<9op;9RAf8&xlL2Kd3L
zdN5R&?OVj$)m%gYFm+G*O9^b>Z1Mjj9KlsqZ_ca^xzxX-^2E69>r5kwoLdU?sbSXB
z#!h^m#edn*j+KEeIz;wAbbo2%!HayZ$|qdV@Jv?Wi<EhFPSj&*>UAT-k%4e#OCvvb
zPXAk5uTF6R(R1O28rW65Q9`-tP}5>!-p{;1dMd<`c9LLkQ8i(`gcy2f7nv4X&dV~7
zp{HvOfyC{tF56tSUld>eK8k#y7T@FDD0^3<&VQ57ESDd&9RQX{W)T&ix~1CT;NfF<
z`|QEXgJ7CH+Le)M`iz723&*zg@H|)(F;4Vt<+vEYLiCuXFnvAq@2`M}UqMRHFOXQI
z{4czv?G$i*7F0-bMwt|gs>2*T1b4?~YuAuebBSa_#c=-{CXf8X_Vqe15sl?r)(1BK
z*niYNi|*Lg%noyZJc{hyp2NHZbu9(pa^Yd4vp6ZG5IlZH0>Oa_5eRSk!MokFn|)^&
zV(msa8~(!*UclaSX+*%Y1bvnXWfr)fZPFSWqOm}9M7?oNUvLR-qp~e?A}RZgVE%NY
z(AwDWQpQGc$2gcRs(l0-qOuq=nWyu{o`0WR4+X1u*KTQv$abiyo?EL7n!R(PthU51
zK?I=Nt;%O?cRiPKk!=j%gp0f88M<+4lNdgWETt~oKZI{Q5~$YyBR!)EwHwe;hdY{Y
zRT_!RRScs6vF{8V9)tLxbM_=TLW5aNw^(ytByf0q(9f;pne=oEfc&I?;Co_OE?;Fx
zJf`GPuWNuoOC1)!OQmP=`@HJ(tJJTTA4m6=3Cve#3ZgF$h9l(l$g?fII3-}VG3Jni
sJD&rPF)69^IiS|Y?^z2dd)ea=gVee2aib*=Fa-%A&z<*R*dliCp`j=tGynhq

delta 1126
zcmV-s1eyEy2=@q(Ab(>kVK7)rZ8AkhPcc|bL~TuTbY@m+bu)27bTKP1Ha162Nj79{
zHb_J=MG9J4D==;|ZdN!~dTdN9Vna|-Fk*UAG;ld+T6t9~GA}t~ZB9-~YI99wQ3@?B
zEg(`tHds$sa#J}gH(^C*a(ZoSa%V<PbZk&oYkEm9O*J`rZ+~%dG+0Mka7_v_Qdx?a
zO%*YD&8@V+o7CYj(CmrUo4(6nKcb(30y9Ka8ZpYOF?$R)0Wdpr-RG)AJBjt0MKBI`
zZmi*=qiE|2%5qt-z%1(+0b4ORMsO&v!1fGdK3+!YFlnh&_PB2GQxKVkgS2R5ANC}U
z5J-M=<~&Almw!yHey{MvE_1>0Bt&vTA@egMMOGEnR;|gesB#I51xrijOGSO{`yIp@
zN8At`&z^18nWlZWznvrFbSl84v2A)EG?v!>Kud|((UL-i!MXf@JH#h{N>)P0G$pN7
zYhSw{QhOBJwVrGh`SOJsVI1R~?IH55&XQ5YM~IKU%71y@LvLLP+3l*jvVnbw!^=Qh
z--moUdE8@MmQeqiBLTt?h7iBwr~3(+3p3wn>wZM8%y-oon3iP6wJ2Z`OzV22O74`s
zN>L)CQyXk>!Kk4Y^k?BY?jDe?Cb+yQtk#R~;vY0iZ^iM1b;`l+b$rIdKhwTDiPd0E
zgou-cYJa}fu}UqDzVsz99+#b0A234NML3gGpH%Z=s~~vJmfrR?Mj7X9@#G&<69(tA
z*8+P3S?t@rn`37K1g795VWKCGx(!3y?}%<9Kx(hmW}^>R&c&9Jcd-D;<yAuZm!l@8
z;zP$*-9~pVQ~;852RkM~LYpW6`939NDl3!>cYm>#=1)Bvr8usnxY%Sai;GgAxlGQ(
z|E1r<v8DH`CC<R1h2tWUgHYpwO_G}WuWPMzF*4O+&MBifc`={CRo;__@go^n{@BnY
z`c}yAz_v&PpP-#T08Uaf^?(b?{4D*Z14Q`+;ivCOcC48lrc0xtCQT{TS1z|`q;jl!
zd4Chg@4;xL<%~h5%_hQ2_^N#p+5FKJd`O~cBvQCf_azyBaQs9uo{V#5eS9uyczBx*
zMi-#G?`@L}ayE}pf%v9@YY1XlAVZMd27{4b6<9!9=a?M=T8yJQvG8&NTxRB)xRd91
zsLT6al+Ua90H}VRx$$|_Bb;`-jUftz@_zt0!LW9J!{<=<;qavE6~^9IgMt?Oja>Jr
znXwkmUsk%%aFN>NWo-4%P~xSoEzc#9MdXe|x&Ns5-1YN2VSfd{`TnhdIw^mGJoY6w
zvXG(iqL~Mb7#10HRfL7KM&-Bk283_HWUoCsn5kZGtCx3zLccY4>cfA{1rD!^_Fu4V
z7`X1^;ML(b0o{*<iNj+MO+^pU_q(wpF&0qnA?qIyX4j2eAnl(nQUG)_7{U|_^h(e1
so1xO>r$#^IB;F60nl6R6LQ`097R10j*Nb{N(anp2n#CEv$ZqpL(+W5sQUCw|

diff --git a/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age
index 06768e8b4f48a3b16921f67fdf8c02d7997575d6..f22d5ceef387b5f07042bb7097b21b45809024dd 100644
GIT binary patch
delta 573
zcmV-D0>b^$1kwbMAb)v7cT-|$dTeP$N>floQAJ{IXlX@bGB7xKMngzOI5u%acX2~+
zGh|nJSqgPmMMh;qO*SxVGd5vWb5ucSId58VZg+G@P-1RvG(~Ykb5Jl@c}_@ZV+t)T
zEg(*GdRQ-YIB8>0NODD5V{~j+W_4O;aY;8ZZBTA9GEj15d4DrOV`EijLNE$a>KGtH
zvvoN%#7i{FMP$f3#`=7eI*94vF~Pr~V&kg<i6xcG_Sd^~rQpd92>jH>R&_ayVmgiS
zAuil%nOKF7J(0Jm={uDC@NJJyN1d()6k3T|xr#7HO0fW$MMUW4Ku45D3_*=bPG1cc
z;kgcI^4j_HFn{mCCyvwFXtj&GF?TD#k5nM3eM`wOdnU{t+JcP)ji$UeHAq%Z9ez^(
zIz8W6EO5y78+>atB%x>zvAv_)ChS}&8d+*~&$rJGnH5_-oM&VfI?S^`LC=H*hA9pR
z;(3jQ9Ieq`Ntk5XbMcMB+uoG0M`YBA@U_0-Mc59K>VIS-ReLA|re*EZ&?}PIYqxRC
zwCxC)rf$U4NC}vET;g!1KnahusK9S7QJn5j0?={)DK@r2-+kB2=ychhmC@pbLl@)s
zwclb%7)LEJVZv(vF3S=d{J~5X>&}l~KS4jGjrN0HoEesNwU9p!7RJ0@3P{e?gBc%)
zEpBuH|2E5{p3{{8rWlG{i^>oS^3lu3Lg|Y`WvT<1Az7Ltp1C;vT5oVq!RvN+cBN7L
LX>jG|{!V?Rq@4!y

delta 573
zcmV-D0>b^$1kwbMAb(R+LTOA_RcTUbSxZiMaCJ;^QBh1sMRQJBS!F?WRC8f8R7E&*
zF=bO}a|%;)FmOb0Hg7UTb#i%Td3abaF*s;5HBC}hZ!mf*XjEcJIZ-uPST#;JI0`K-
zEg()(L2@%wX);7uQhH)IPj`7}MmJ7cdP;I-LsVHtPdREubAM87Yi4+MMpX)EUL4Oz
z^x8lwr#aBD6hgt?XHWn>g(;DO?#+NVdeP4pntWuE12G*QfmTmW>Lv#nLy0fS<_j={
zxl9Dp<1<R(dzQOQu3Baz_b=%9)rk6ZZ6k%^aF)oCbrurAEopRPre&$tA1=>~Jv&Qk
z4h{BYdKNTm;(tR-9YG*crCnre8-?Ve_N2TM)X8N|62X0MES;EY>TeeNU@iL6mi^ZO
zG)4iw3<1C;Eb(fE`#7{w%zRo`3$4ZY#w79SOE&|hBf6wLAIZKgVW=_Lm_+~A+tTWa
z0i5H&M`5}bgc`knn6bYkNIzPWcfvZ+JNgE5&T<c7*?(*SgQ}zKNl^cCKF*}P)u^M7
z!hV;A?_$9>D7fx;YzlX{bB#OF!lIKUOOY9JEezv8zVq19+Py-4j|MH+&ql;mX|!Ty
zZ}+~1%P#}oTO!s=7o=@ax5B9BvhRc;K=T{DyxO|bu(j1eZiNo*({}cc&AV>#OPw3=
z@K|je$2Roar%r|luGU|IU`;>O_2R^#c_a%4ENtX$cIRc(w2Z4SS!FfZ6RL5Xi;3;*
L8O?~ds1d<F7A6PH

diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age
index f52b5eec87ab00a849f0f27340a8582e0232103a..242d0c78df8394811fc781758c2585e21d0394cf 100644
GIT binary patch
delta 273
zcmV+s0q*{&0;mFzAb)mdadBBxVtHD5Y&cMKMQS;4D|kj@c3CT9b}>#kc2-(RHAiw<
zR5&&>NeX#qaBWn0cyxL>NJLszOk#0iIciLAdTwx6NjWt$cw$E{Y;kK@S#D25YYHtb
zEg)1^Ic!mMa7uD7M`lx4MlVN9HB?M6a9KiiO>HYrZc}7aYJXRFVo73pcufj;26!6o
zzIf2=cvKeJ{acsq@3nYAQxbxn>ugyS)rSN3shQUt;uke!?i{-;?MVco=sghP`yiI)
zP^p6gjkX!{yv|6mNBPLn-55M=F#gdNa*3fLU;bQYLonD|L6SKk^y@>SBlm;YlG~<B
X=aIfgBqaO6f(j{A1mMoc#RV@Si6e4~

delta 273
zcmV+s0q*{&0;mFzAb&YAZg4MZNGn-)S~qNIHZW^-OL#|0Q&2QkQEqK_RWf31Xk}4Q
zFhNsPMG9tOQf6&WOEye!Qc_k!W@bc0GfzQJX?JF5a8YkHS1(y>cuZ7CWMXi5RSGRF
zEg&#$Q!;H-crr+7OLtUAY*A2ZHcB~5Ha2QbM`cn%LTp%VIe&M0LUBS<Qg;dv|57!t
z6xgt+j%RKL0P(09s1?U-45qr8C2~S1Zo%*PKp#QMEOW;av~Pb@!L%}}%bK+Tj;~&t
zX1hbzQ9URXtp2UHTjQ#kwk;)pjTGD)COnI@9V+kEKzKB%zVoE!2E-czw@Bj=YcCCr
XW7#ykVRN0Vi3)U~g#)#{B7H#gg`;c-

diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age
index 598585f42c7abc716d87d37ef81baeb217f3bd14..bc9dde57eaa7b531a74fc0f999c77912e2ec77e0 100644
GIT binary patch
delta 1864
zcmV-O2e<gs4$}^hAb)x|GgL!LL1A=NY)40NW_49IV^voxX-RHZcvyL9QF%sASZg(7
zY-w?7FbYv{G+|{mczR-VOlomgZEbpWGj=gSG%tE=SV=c<Y*AS@Gd5OhOLsVMa|$gj
zEg&&ba%4<URA^UbYgsl>WHNbkWOHsYQA}qwZC83scu!+VYkx0jaxXY!M@0(SxCQ{>
zVP0@5bX|qDw&{;smlGE1&zx={x^;2ow5DC2nC>6>LTRh{Z_c((%luXNkaqXzKF<u{
zuCKubqudV4$$qh}I*<x;)*%YA676|>lic-v4LVTu6#KPMwufh2HXIx?e(rfX^mbjt
z#h12d6-JMOe1C6T91_la?iO!}eq?H~%;>~GTz;S>DJAD)orjk^!mUPjUo10hbZagI
zG~M^8KAt~XzpQQ9yEN*{H<>lf=&SK=!fb}Poq;=(Rz*#I$`zl6<6VB%6grlUY}HDx
z9@N&2hQ?__xF&qUc;(IcU`H5Xmh2}6QFL3<6EmDbnSX2sB3zx$hMdAJvITFdUG&mq
z8Cx9yK2z0LZ|aS^-?XdKDxkLnV6qPgdGwpK#XN50?VN^IJ*P%q2f7liqWf{$8|*ZZ
z63>#<Ge6w@WgR~v=Z1Oa*7Ta#i~Nz(-kgH`54|6`!=zkNu$YR+Kk+&7+(kWkKH2wi
zXplLc;D3=GZsC&NuvM<FkqVY=2WU{>-Ry>@e)7mnGtOcV{Snt@#VgqFIszN<G(56M
z9>46)q4G|4lBhC_EUH%N!~(8^{t{3^)f5Tq&q)a&4sD=WJXqOK(tswels{H>%c_00
z%Ti_|S6?@4t`~657Lfc-{CxbM{sx<$(Hyew%YPsO&{4MVTns?HC{{-G*f)#TtS(|z
z32P5P!k=CLZ1#9q+9BZZRi%m+yb9G!Tk1k_vzM8E9H7DLl4~md>aNw-13<WrV+rgQ
zn+lpcCN4B^28;IwvcaHFx{Xcg(}<qNp69k9f$QkWeGZVXr{}4s=G6yEs8&*O9jW_|
z$A1=n;S_j^;}K^(AK|I?e!Odu|Nl9t7X{_fbW=R}Dpfe?tz*OEc$IYdoCQY~_+^+W
zgs&d3tJ2(k;PBC2HXDd$^vVY{_Hw`Z!VR2@I#zQ!GZyaD@Rqhu-s+x%x3AopxcVX8
zab--=3q!yv08$QlK2RjuNa0tYd&LM;?th&_L5;`-158f*h)8Ob^lxO{>8d%#RX&tu
zk4{t0=^p8$Gh?6LQSx8EL~3&uVIx`GtaE0g8|;0n(m>@Ijemcx-VGGHPNl-4=#IZY
zS+&{PjGVfed7E}-kpEO9$9KnEOJzZ^z%c7qr<n4d)3!l<9$pGyh(BTto9t~mI)Bsz
zEC~zXDY9f3pq=_Y54Q50eZi-$JpIhX$s@xnhae93i)6=Jxk4TkaI-2~zQUN+lS+JI
zmXVn{xa!(ELH{3)lne*O+QTJO;lWJg()QL1h>2v8K!U)OQ79?>3%Zq`y_YJDW)-bU
z71z+QZBEz2niC>T8;VgbvBwcJzkjXgak62O{t7c>{fdA<-nv=%GoL>Sj6G2huz==R
ztGZ*qO-2W2Wo(KpTRNf)wmrr%ER^G49|3YoY)XJlt!js;`(a6GN=pvf;?;B>27bcC
z?l;G%8OKF<tJJ&C9;M%cQnrOj0GbFV(_RtBot^Xvx_+SkAq^h9?{|7(V1G3OVYB-G
z$^|woyqahKGHx+3KucbG6^q_+ZP&_k<D$iJ^Csa}Df1j=27o3)N-3QKOPOLzZcHl@
z!UkY$yu;mpC9-oCty(kilJci*XDOh*C(omCce42G^nZsfPIepqWoV&~H_bCd_A5d4
zYBlDAQ{3q!fwX#|ir%f*a)0Pj07syI7|s;mjP=lnI{pz<CY~P8>ZnRD2N{~U3GF@y
z6k!l4L|D=_us<M>{9p9JQXJ4Wl&%wQ+m0m?Hm+JALiC@Q2#?9ydS~|~ZWmp|1`xKf
z+(CkZ#{izxrL9@27V4Lfo!TQ%c>P!|;r7V5q&N?OIoEY^gVKk4O@HY<k`mGyK9H6+
zmY;nnq&y?=k#)qd>>~&u9H6DI6(#gNDl1*Ai=u;G8eJ~jcbu6mA|toS*duUwr|_|L
z%lT(E1kJyT8jV?-%2ipmE9-M;Umc$2a61s9exB(VDKc@Ei*Q~^H9c9oIvpeP;dTzd
zY?+`%K4iBqPgUQ2R(}yo*l-DnpRI*9->wJnqiO4qDfwiK?%Dwk!PY|dvHWCCrWFua
zSTq-_RdJNzr4+7!o1x#34o%~iA5tKO8eFhfM2J{dm@-eGE+q5{ODR9CMJOgMaB_ym
zdWq*K0^%2(@+RLHFeqUFwS5t`?jB&KHeE3a-P+f1-i@NMzCn|-UH-im7w93hv=t)s
zFa2!iYU#w@iikk23Z~G!F*axT`W8-0asf{VC4)}aeP4|TDsYZL`R0IH-F2tG&Aozd
C#fh{4

delta 1864
zcmV-O2e<gs4$}^hAb&$ub~8;>D=}4SN>5czRbxt5cTzb?d2MTOZ&plkNO)mwM_ET|
zc1$*SO$thBWkps|LT6YxN<>C_dSZA|NJ&mnMqyG-LpfJ+O+hnfOk`C{b$2gSYYHtb
zEg&{nc1cS}cQZ3=WNkB3dU!!;GHEYSbYgW$bWb!gH%4SDSASANFKtvoMQaLVA_;U&
z|9CMWlFZpa^=jTfRSTLa&V|_{4w_d8cPwz=tgpQq`mO=0rI17!7b-Lcz8{+?Bg?ad
zxj}ZxRaTL4GtKl54JW)DseZFmh-9P<dtZ?^3jTQqHdNUiFv!eLP4(WLL^5XTf{<gZ
zQu~fPVujfFGJmAMOL%hp*-WsOKxGG=;|j2d*T;mDd5wS7JXiV4owf=Dea8TxoNc8}
zjZ&ns+pxcwCx#hNfpP117-+2kyL&JvD^RqU`tk_(pVb%L!qTI?$jyt&&sb{DsU((v
z`Z~<C+D~zSVD(hj2*`mnuUk_68=+dfeswrzg81!sQh&z}TmWu*ETW=@Qu7E#q+y|3
zWnejS-2NC0#Sr=&SuRVai6H-lUdP>pLe(k)Cx1!zZd&@h5~E5@$4m+A1`j#Z!4SF;
zhD2LRmoQ1IvI+8U-FIw)!)3l}4($3wb;p#P@l8Kl_~m&UFr<O3T5a$D$+sg9P@bQa
zt30!i`hSh61yf4{Lvt3El)eBU*US#)Z$xAYbX&8Q+r9)poro6@4UtHNb4Ia5%%h`S
z34NxlBT_2Qcl!<SRW@?pbAKDES4@$yRpIfvXQ%z)HDsIJ?)BT+er!&(FI5F?^o+^S
zd`FQT+F*>Z+#}?4cJUn<KiVbNZ}APNWjM3~7Jop0@E1XEFQ-e#fJk_%-Pv14GK=kc
za=bk+2phd%c*QJC^5lq-dbKs8)<GzBQo~!xI~RdGmdHY{V>hUlUn~=`YR@x)>w{bs
z0u+=jO!0s>D!2EIzZ*nVqD9MNf?I{=q#iTht7|L221U#N`gGy&h|-dRA85})a_g<{
z-+wI1XI_D1%L6M6>o%@A$Dx|UWBHoh^vff-$8hS7bG`o`QoX8culT)sjmdS?EmOwj
zgQq)Qv`*6?3k?7dpnF&L<vBzZjEV1l#2MwmRu~qOK!UbHx!q&955nC4dIdMHd+uk4
zg@<FX@kd|Zxa0bw;z$8A#N}gzZcGdK7JohfY-Q89XLesz7`RS~9~fnR0F1M0A?t5U
z`iyg}@%FVGm|?Z469#Q#Z%`?fxmRk{hVjzGBuh@<S0S#(@|%{nqGqWa<k_*=;YBoR
z;KoPA;9p<)Zz!_3TZ%{I7$?(^D(I1Kw}=rG{uF$3%1sx=h(ed+oyGp|bm&2OW`9=!
z`kG^a?AN_+yM1-_6$+SXw!4jK_=h&xbE{%>?)W3w2Sb}>p?>dEZX<C?oMl=0Aq>lP
zPgQwI*3;~?H?;EZwvqw5)}8cHf&NH(f76!lrB`QDYk0I@FrRApvV-Z670DgC&AmQM
zT16Ts8csWnJh)=|D^@A$2r>Ln%6}*a5mL$P9)KEjZSXjk9nkA4%xsUetPonvzv5Y8
zCG_Pia%aAy9a+CT*JObX#;JCZRdqU%A;(JF@TFp`AbMKRvQ-+qYO@V;qnxmw3VR>`
zWN#>>^wGW07KmQ%Lif(SSd=CHa)y9$(UK5s+GWL2P$%3*;m;!Y{+RIchJR2d+&vck
z#fH$xjqcXmsMOe%iO4LK*D7~yIT9k}g9%Cb`a?aac*)U0OaufXOl7kGi|tbHfF2%<
zO4u_*L`+Eur)Qd-LxZVI9XKkH;DF#1FfRDaC<NR@E+yV!8>BzxLAc007F>|&6dfJH
zIOp0OYu4(Gy?53}W$mhe2Y==0bcKfS3O{c@!frszXP+)Pf)6P`>$1--i)8x2J4;(W
zQ!#nb<a4>c$ZX~R++TBXiv!Yjcqk)5V@B%rT13^-e%zc~8qvJ+gU+>Sv;m(_UH_q|
z92JuigjKIQD<HWNtq*VpJM_BtqDBFKT_&`A@V9@4$zLodB7pEma(_uvb2?Bzh~%Z&
z11nvqP+s$(>`$Y+hCD5fjw62hh~5}LNk_N^t7~gLIDCr5z5#n(^4j-*_cfUiKsBGv
zgl3>-C^;8(#EleO#iV)gkR1b!Yr{n?2IFz$$TH5$C$*|%+*1KLF=xgS!9mAr7Va*6
z^HZUu46rUS3<j}TQGe9aTzKlj;4*qFtODD&<+?`uL}17tJr5H#JvqGPc>J$&Rn5Q^
zV=-6qUS*$`9t)ql$hAO}9+^OB`>U%(qH^e{D-<U696Hc#$W~p&d^=-Tpd9laQ1H}P
z7cZ8eBPgBoKKomzFM}|}nXMv84y>&Q6UTOKr>hTOv;WeX;6bYhyl=1`5nlKj+HE($
zpWjUDUJo?p_kW9%GbW&3d?Yfe{_N>O@1uVOc$Y;8i<!L7pilDGJw}}%A!%Ls93Oqs
CpM-P(

diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age
index f56887b527928aa0918fa347c21f9020a2dc00b6..87d33fef3d08398e65cbb9be10f6c3ed3484ac0b 100644
GIT binary patch
delta 630
zcmV-+0*U>L1&alcAb&7fFnBU`aWqj?PfklVayV&Ma9DMBdT}*$Vp>LFSTt>6Qglst
zO>$ULQ3`A?X?b-qa(Yo>a!pn-Pf&VIRcCr`OfxH5Pg65gRCi@XQ!+zROiM{*MG7q~
zEg)%PS#>sYR#<CCaBEslPjy&SLTqVQbump&aza;HOKNm?P=9k{cvLlVICBc0t&<yq
zvH^Zz;rR&pPVofmAro6UOI?f!|J_C2d@ghPD^F!$@z<2M?eguwA*oYq7{$bU07Mt<
z73BR(Zn(0&zo%dC`HbASQty^qh!_IDI_K=t0{zD{pq)F1(znRJt(j-sqb}%@csr8&
z^kGUdSfs$0^nYOkb^?&G#_-;m_HSDo6s~8|*yVFWTf87xTQR9Uq3Nnv-vlJ621BGW
zKe>&qGd{780HG%XfxdC`*@&R)Y7b51*vQySAjOn$t;|ylh?`J8oP)ZW>tQG1NBom?
zAvz4b*1pqt<{>(NIaZPmLfoE6%eX9~CKGKda|{SJ3xDql<BHhD(^q&#fFy650llC*
zkQYc?a(dQ;p75LLA~?}u3}#L;PU=PU-%LD$ZR$Y|9;-t8`rJW!4s`gShmX>I50#}{
zb8pT*L5qz1Dxhcs7P?U7RzxyHD3E05>{{2@ZS|2r#Nx1oh_mke@m8Woq7&abD*PFZ
zby*nh0dGq7opB<)6OQTatPz-*5I8;RB3?m^4jq;jIp$lAH$|)B{;XR(w4+^20n^WD
z_C<;S!m)I5TICi;Aw~Obyrn78U^T*){Z|6hXw}@=1zA`qScim}yz0vntM?mJ)~mfn
Q&s_kjC%6_rhiJzpK?@iq5&!@I

delta 630
zcmV-+0*U>L1&alcAb(+IQ8h7cSTk`;PdR0AN=ZgyLN-lLGfj3mSvD(3Z)h=MGC4|V
zIZt&~X9`AdQfEwNFh@gbZ)G`RPg-SbSW!txI5jglVNgzTD@I95VQ^<-V@_&0a|$gj
zEg)J_I8$**VN`TTZ)P-kR550DI5BQYHgiUKL3c-Vc1UJKFMnrsP%lSiMRN*3PuW`o
z5Sr!!@~gpZV3#1xxqiaFnViv;m7rIzCKmOK*cXSmzm)e+J)A^>RG&wCJrs7LK7=t7
zZUC4AHvm{NYQ_lGjX7;tcq8j{+6{(vJ&;ap0`FPS?X6Y#iwnKbV|0bcFDU?rtW!_x
z9zRbaNu8*uq<;al&9bLE)8K_XoLCBNxTFl`)t`YUIc19KMfpGP2HkLtsQr^r1q}_8
zrLK<)w57*ICfsAZXtS_UQ{Ytb=}V#<b-4V+`kw!%Dd_ZPKW7EmkyH4YEgxcY*uM!m
z+&0-UYv~upbdOT{paGgzOAY&>c%n)-JxU7(p1A_laDV7I`bU^(QY&nZ!!Q(8BLhsN
z5s`sdlnc1F6?OgQ8Ef&!@8M+O6TH||`GQ`QgZn}ZAILmM5S2#UpXrivOJ@T&0rpEQ
z?C?gK)>x0@0#9NM1Lzhq(uT4~vvlp|sAGlzHO~}PHYe|HGM^oSN1fSN(G5$9M{d&~
z7IwIwEN|5S_RKnmN}^hJLlboen{eHEpQz5QY7mvETLcKSxu(O;y;tq5OLx~KcCwaq
zaoVoJs~1}H;l5^g8fwi2P^%^*;92TBjh$6eNcz(wQ#rwUw&a*gB;GfwMCq&MLTB9X
QdH4Jhc$!(K%Va9G6QJfA`Tzg`

diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age
index b8a7e68deeaec9fc7bff2cc94c468c3210c24e4e..f28cbd59168c3a007660afb6e85f0a26a92f50ba 100644
GIT binary patch
delta 1126
zcmV-s1eyEy2=@q(Ab(3wLQ!pQZ#Z>CIcG0Kd30GrLNHA<OHp$+ICnBaL3&zkGeT}o
zMQAj5X9`zqFf&9<Ge}uaVq-ICL3cqbYff`&Xk>MGQdC7_Za6|yX=-*WR5D30Q3@?B
zEg(oZPex^KM=xq-P+Bl!MR#LkV{~UQPDn?3Z)0+JR&#7hXn$vNHEB|5c5e!rg}$<t
zjsE(bC%8HGy_#>u;A37_VJcf5yDFkd?A4WhoQX%Y@lr=zdk*~^-OqGdIt?$i^F_^w
zFiez)QTH4`BWeP3M>-N>YG${R8Js)0r1Wa5jZ~}K{-Qm~cq=PF^5#2}#J}?=#enF7
z?9MK+{(6o|{(mm9)K6R0n)2Mxs)boQiEHe91oj#I5{5+~`X>{NJSYB`8^r?Z;|at~
zdV#IxmWz`9A5*JXzkq*2v&Ea4#e!2DEFdu(xG4^c31a0MgZ+7Xf=Dr;Q|o23=K;4r
z7dyyc=Dk5}i)l-W_s_~Mzo|J|E=gv0C}EK;P}Z0Uyni3YkCw~YbG!Yw-sjA}v4=9D
z`4{j0(sNO2VbF0gvVYOk)Lg!diaf_{cJbK!uOH)G{&8b)Gx8)Hx8|+j$x=A)58LT_
z^6TCWNywGd4*t#*KWGLoIz|#QX=#wmqTUS0r2;#^DOAe{E2<a6sl}ltizHQwH2!)~
zW*YtWB!9?5QCY`Lgw`DK5}N9%hvVv<8NM@e-8Jvrrsu~#fBAWv={8Lfc1N!0XU(FH
z$dIk!-W<IWz<c`wK#Y1<$jw4Y5|R?NQd;|yPF}HXc-VKo)rvyHh74hS`c`+lHPX6g
z){7&<i?<aBFS(9}E$cC5LQ1vWbFD$xwqZ}II)4!#2KhhtsP69^MbR^ZK@)J*v3^R8
zKibWgPqth7ZxsN1WO_eHQ>=N9ldK_xkzSqxt-JCLwJTf>3+b$4r;27Z&7QRk2%?Aa
zr5`-qilEuF1tzlJ6O)<1+|c!A^MRwH?=Q;NNizNT$RP#yhA%i@x4hU-@(~5$oVF#2
z(SO=So2{V9SlZz`W7M|m#47K4atpYfQvg29Hka#%d`uPCq7bnp`VYv6z{8r~*p#zn
z3+I4+btceg=O|Rz#IK^j7-8$Ttc2DVruZ@VEdY2npg12%YtZx|d1L%Fl=bLyiE-E$
zx=*K?pxWQZvk;|8Dv*-%6R-OP;KEYa?te4(E|?@*a|mn@ymn#5quqSR*<PTu<YB&>
z)(Hgf%@zmG;pQ%+0N}F)<bW#9*mk?bA*V-NLIk@rOl#=eu7FXlvd^<7J-V)^MF{bV
z5>KASi_MY+GYg6QKiJTCxXmv`+hl}*ah!MiWYTM{?*vF49RV|3mb~ZSnTQProL@KO
zPr%suYWiK6cpelqnjF?t9Pl&_0$PN&N>jHnt3<@j5@P43%?}Sy>IY7=Ah(p!7~==$
sE9(;!-WelOe;X;eJIVFXlb22Tgb4fF!nUrQzhy4*y(97$LF?2%qia1Y)c^nh

delta 1126
zcmV-s1eyEy2=@q(Ab(a$L`*_5ML{t%SZQ}<GDuEMMNCU-Qe-htNkwLNV`*?oOjLC=
zRc$s$MG8S-S!-5xa$`|ea85RPZe%z$FG*@vb2&#cH)k|6S9W<tL`q{uada_bV+t)T
zEg)lZMr>D2Hf(xSGk9WRFE?#wGc$EWFmFO~MrveOYDG~?HGg7Ob#r)ed2<Sy>u0#i
znA)IZ=2}dBBW<R*8T^|z-*XhpLl2q#@U3gc^8jCsgO6B?0f46}SA1PF)d?RfABVem
zLgcey%}opA&a1FGY(^U=b%G=BOlIj^LHgK3r%B6at&yxGWL4yAXVFymUW7B4QuNCI
z(AD$DRwJXOY=8P8AQ%n*DEP-`4XNJ0BjS_@w-$B4--i>YL5}KJ`xXq~Q9&RrZ+?&=
zGR0x4G{_qk{Ucdzcbo3A++z6`1R#7`6uyS_6+qYWZs+=Z^hwC_iOhreqBQxVYJHc*
ztW!nWSMR6u+9Y*gj(`oXM*2(Qx{Kcm_){{o+zP&CaDO6$Q=5s1KudxD=T#GQu3yST
z)S(aY6zq0-<&oK~J^gU2!23dv)bWaD{xWYQt6F3dBB2mp=!p%U&f&yw(kX&JL$_DD
zSOmR3ulH`Xf+fN_h5&2J9M~AhO760M2>yM_bBbY`@vKyQit_yUKv)BNr1-F_5^Zmk
z%?f9~tAE|7>@>mhjtt-_%pm{3;yM##>o$Z99$R4480WpCSlh^PwFR%!Q^gYU39AE}
zykw(v$4jpttmJ6Hc+gs>04v7MVPeR5xiq$Q1pwtltq;9wmFHN>{4sK*z!P{6T6W(J
ze9O2a^6Sj-_k<<inqQk`2V4u$a}ceZ1xHo6H-Fsp)In##G&!iNJ5;^Hl}ntTC$}6<
zN8t(}bbQ8k{1Ya}dC8621JJK0LKq8T?MfiC;}MdZrz?vqS-W5s%uUdy3`PJoJ6CV&
z$5<v@ljwTB+UNCft``UGqDVG>Z!kSH)gG0Zf(4dZCr}p5a??O9p4?u|XLw{joli*w
ziht03n*&IC>N>}q+kR5N)Rwh|kWsQ+_=N1W^fN1FQbO{$YsU<`m!^LEbVipYt@uWj
z|9fWhx#uZtVUL|5oADury-}~C8JYS@klY_Oio_mR)mlb)yvY(HZ*lm(*ie?wvg3;1
z|Hnq6STy!{ZB8n}$zmj<)NPrHe4Ti6wSSTSn->wl7j#_cPrwnao4BpiLbI*7yE1Pt
zW%rkvwH{#DzS4R+xC?XSYOJ4@cUCsZ(o&)#I44Y+>XHLunr|o{>oG7`f8^oXn{BC$
z!a*6&2E`6m@`nHW0ISscl2Ie~^4So~^-tu6un<TQJ7`H*bPjJ9X!eWk=Ht@}zh5gG
zPOAw**sf6)lU6x01}t3LrbsOB(kWo;8TFX1(Jz<OVy^!Vdr=jo482+n^vXWt4a?lR
sIfOX@_o_7x`V@+PTZS$k6$c?XX3@d?3%l5U44ct*#j4TjP@WxGgCBY$tpET3

diff --git a/sso-mfa/k8s/privacyidea/realm_bootstrap.py b/sso-mfa/k8s/privacyidea/realm_bootstrap.py
index 960f9b5..ca13d4b 100644
--- a/sso-mfa/k8s/privacyidea/realm_bootstrap.py
+++ b/sso-mfa/k8s/privacyidea/realm_bootstrap.py
@@ -233,7 +233,7 @@ def main():
             phase = 'functional-verification'
             from verify_mfa import verify
             proof = verify(base, args.verify_user, REALM, RESOLVER, admin,
-                           lambda:getpass.getpass('Fresh MFA code (include token PIN if required): '))
+                           lambda:getpass.getpass('Fresh MFA code of %s (realm %s; token PIN first if set; not pi-admin): ' % (args.verify_user, REALM)))
             if proof['result'] != 'PASS': raise Refused()
             report['mfa_verified'] = True
         print(json.dumps(report, sort_keys=True))
diff --git a/sso-mfa/k8s/privacyidea/verify_mfa.py b/sso-mfa/k8s/privacyidea/verify_mfa.py
index e5ff337..dcf0c19 100644
--- a/sso-mfa/k8s/privacyidea/verify_mfa.py
+++ b/sso-mfa/k8s/privacyidea/verify_mfa.py
@@ -116,7 +116,9 @@ def main(argv=None):
             args.realm,
             args.resolver,
             password,
-            lambda: getpass.getpass("Fresh MFA code (include token PIN if required): "),
+            lambda: getpass.getpass(
+                f"Fresh MFA code of {args.user} (realm {args.realm}; token PIN first if set; not pi-admin): "
+            ),
         )
     except (EOFError, KeyboardInterrupt, ValueError):
         report = {"result": "FAIL", "phase": "protected-input"}
diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md
index 49872de..ac54629 100644
--- a/workplans/NK-WP-0056-bounded-executor-path.md
+++ b/workplans/NK-WP-0056-bounded-executor-path.md
@@ -117,7 +117,7 @@ it.
 
 ```task
 id: NK-WP-0056-T04
-status: todo
+status: done
 priority: high
 assignee: claude-code
 needs_human: true
@@ -227,6 +227,14 @@ agents and writes KV v1 (CAS=0); verify proves the KV value current the same way
 role. `realm_bootstrap.py --rotate-bind --from-openbao` rewrites only `BINDPW` on the service bind from OpenBao
 (attended platform-admin) and requires `--verify-user`. Correction: `pi-admin` signs in with a password; the MFA
 proof is the `--verify-user` login through the resolver.
+
+**Done 2026-10-31.** `svc-privacyidea` live: CCR-2026-0055 approved; founder-run setup and verify passed (KV v1, value
+proven current by LLDAP sign-in, no workload role) and `realm_bootstrap.py --rotate-bind --from-openbao` wrote the
+resolver from OpenBao with an `admin` MFA proof ([evidence](../docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/README.md);
+a first apply wrote the same value but its check got a code that was not `admin`'s; both MFA prompts now name the user).
+All four service binds are held in OpenBao: `svc-provisioner`, `svc-authelia` and `svc-keycape` ESO-delivered,
+`svc-privacyidea` by attended write-through (founder decision 2026-10-31 amends the done criterion accordingly).
+No bind rotation needs the custody copy decrypted. The custody copy keeps the current values as a fallback.
    the env.
 
 ## Synthetic verification instead of a founder sign-in