diff --git a/home/.chezmoitemplates/secrets/ghorg b/home/.chezmoitemplates/secrets/ghorg
new file mode 100644
index 00000000..e69de29b
diff --git a/home/.chezmoitemplates/secrets/ghorg-fallback b/home/.chezmoitemplates/secrets/ghorg-fallback
new file mode 100644
index 00000000..71594f4b
--- /dev/null
+++ b/home/.chezmoitemplates/secrets/ghorg-fallback
@@ -0,0 +1,219 @@
+---
+# +-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+
+# |G|E|N|E|R|A|L| |C|O|N|F|I|G|U|R|A|T|I|O|N|
+# +-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+# Which provider to clone from (github, gitlab, gitea or bitbucket)
+# default: github
+# flag (--scm, -s) eg: --scm=gitlab
+GHORG_SCM_TYPE: gitlab
+
+# How you'd like to clone the repos (https or ssh)
+# default: https
+# flag (--protocol) eg: --protocol=https
+GHORG_CLONE_PROTOCOL: https
+
+# This is where your ghorg directory will be created, use absolute pathing, shell expansions will not work.
+# The ghorg directory is the home for all ghorg clones
+# See https://github.com/gabrie30/ghorg#changing-clone-directories for example
+# default: YOUR_HOME_DIR/ghorg
+# flag (--path, -p) eg: --path=/tmp/ghorg
+GHORG_ABSOLUTE_PATH_TO_CLONE_TO: /srv/repos
+
+# Folder ghorg will clone all repos into. Cloning will result in: GHORG_ABSOLUTE_PATH_TO_CLONE_TO/GHORG_OUTPUT_DIR/repo
+# See https://github.com/gabrie30/ghorg#changing-clone-directories for example
+# default: org/user you are cloning, e.g. 'ghorg clone kubernetes' would create a kubernetes directory inside your ghorg directory
+# flag (--output-dir) eg: --output-dir=testing
+# GHORG_OUTPUT_DIR: 
+
+# Type of entity to clone (user or org)
+# flag (--clone-type, -c) eg: --clone-type=user
+GHORG_CLONE_TYPE: org
+
+# Change SCM api base url, this is for on self hosted scm instances only
+# For http gitlab instances see GHORG_INSECURE_GITLAB_CLIENT
+# default: github/gitlab/bitbucket public apis
+# flag (--base-url) eg: --base-url=https://my.self.hosted.scm.instance.com
+GHORG_SCM_BASE_URL:
+
+# Include submodules in all clone and pull operations.
+# flag (--include-submodules)
+GHORG_INCLUDE_SUBMODULES: true
+
+# Allows you to pass arguments to git's filter flag e.g. git clone --filter=<args> this requires git version 2.19 or greater.
+# Useful for filtering out binary objects from repos
+# Few caveats, only works on inital clones, however if done on inital clone all subsequent clones will also honor the settings.
+# More info at https://stackoverflow.com/questions/49917616/what-is-the-git-clone-filter-options-syntax
+# flag (--git-filter) eg: --git-filter=blob:none
+# GHORG_GIT_FILTER:
+
+# Deletes all files/directories found in your local clone directory that are not found on the remote (e.g., after remote deletion).  With GHORG_SKIP_ARCHIVED set, archived repositories will also be pruned from your local clone.
+# Will prompt before deleting any files unless used in combination with --prune-no-confirm
+# flag (--prune)
+GHORG_PRUNE: true
+
+# Skip interactive y/n prompt when pruning clones (can only be used in combination with --prune).
+# flag (--prune-no-confirm)
+GHORG_PRUNE_NO_CONFIRM: true
+
+# Color output (enabled, disabled)
+# flag (--color) eg: --color=disabled
+GHORG_COLOR: enabled
+
+# Skip archived repos, currently github/gitlab/gitea only
+# flag (--skip-archived)
+GHORG_SKIP_ARCHIVED: true
+
+# Skip repos that are forks, currently github/gitlab/gitea only
+# flag (--skip-forks)
+GHORG_SKIP_FORKS: false
+
+# Backup mode, clone as mirror, no working copy (ignores branch parameter)
+# flag (--backup)
+GHORG_BACKUP: true
+
+# Max goroutines created while cloning
+# flag (--concurrency)
+GHORG_CONCURRENCY: 25
+
+# A comma separated list of topics to filter by, currently github/gitlab/gitea only
+# flag (--topics) eg: --topics=frontend
+# If any topics exist here, ghorg will only clone repos that match at least one of these topics
+# GHORG_TOPICS:
+
+# Only clone repos with matching prefix, can be a comma separated list
+# flag (--match-prefix) eg: --match-prefix=backend
+# GHORG_MATCH_PREFIX:
+
+# Exclude cloning repos with matching prefix, can be a comma separated list
+# flag (--exclude-match-prefix) eg: --exclude-match-prefix=backend
+# GHORG_EXCLUDE_MATCH_PREFIX:
+
+# Only clone repos that match name to regex provided
+# flag (--match-regex) eg: --match-regex=^foo
+# GHORG_MATCH_REGEX:
+
+# Exclude cloning repos that match name to regex provided
+# flag (--exclude-match-regex) eg: --exclude-match-regex=^foo
+# GHORG_EXCLUDE_MATCH_REGEX:
+
+# Only clones new repos and does not perform a git clean on existing repos. Useful if you don't want to lose changes made to repos in the org/user directory.
+# flag (--no-clean)
+GHORG_NO_CLEAN: false
+
+# Additionally clone the wiki page for repo
+# flag (--clone-wiki)
+GHORG_CLONE_WIKI: false
+
+# Fetches all remote branches for each repo by running a git fetch --all
+# flag (--fetch-all)
+GHORG_FETCH_ALL: false
+
+# If you want to set a path other than $HOME/.config/ghorg/ghorgignore for your ghorgignore
+# flag (--ghorgignore-path)
+# GHORG_IGNORE_PATH:
+
+# Only emit critical output.
+# flag (--quiet)
+GHORG_QUIET: false
+
+# Perform a dry run of the clone; fetches repos but does not clone them.
+# flag (--dry-run)
+GHORG_DRY_RUN: false
+
+# Branch ghorg resets and leaves checked out
+# default: default branch
+# NOTE: if no default branch is found on the repo, will fallback to using master
+# flag (--branch, -b) eg: --branch=develop
+# GHORG_BRANCH:
+
+# Allows you to control the exit code when ghorg runs into a problem (info level message) cloning a repo from the remote.
+# Info messages will appear after a clone is complete, similar to success messages
+# flag (--exit-code-on-clone-infos)
+GHORG_EXIT_CODE_ON_CLONE_INFOS: 0
+
+# Allows you to control the exit code when ghorg runs into a problem (issue level message) cloning a repo from the remote.
+# Issue messages will appear after a clone is complete, similar to success messages.
+# flag (--exit-code-on-clone-issues)
+GHORG_EXIT_CODE_ON_CLONE_ISSUES: 1
+
+# Specifies the location of your ghorg conf.yaml, allowing you to have many configuration files, or none at all
+# default: ghorg looks in $HOME/.config/ghorg/conf.yaml, if not set in that location nor as a commandline flag, ghorg will use all default values
+# NOTE: this cannot be set in the configuration file. Its supported through CLI flag and ENV var only.
+# flag (--config)
+# GHORG_CONFIG:
+
+# +-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
+# |G|I|T|H|U|B| |S|P|E|C|I|F|I|C|
+# +-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
+
+# Add your GitHub token
+# flag (--token, -t) eg: --token=bGVhdmUgYSBjb21tZW50IG9uIGlzc3VlIDY2
+GHORG_GITHUB_TOKEN: {{ .user.GITHUB_READ_TOKEN }}
+
+# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+# |G|I|T|L|A|B| |S|P|E|C|I|F|I|C|
+# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+# Add your GitLab token
+# flag (--token, -t) eg: --token=bGVhdmUgYSBjb21tZW50IG9uIGlzc3VlIDY2
+GHORG_GITLAB_TOKEN: {{ .user.GITLAB_READ_TOKEN }}
+
+# clones repos in a directory structure that matches gitlab namespaces eg company/unit/subunit/app would clone into ghorg/org/unit/subunit/app
+# flag (--preserve-dir)
+GHORG_PRESERVE_DIRECTORY_STRUCTURE: true
+
+# Skip TLS certificate verification for hosted gitlab instances
+# flag (--insecure-gitlab-client)
+GHORG_INSECURE_GITLAB_CLIENT:
+
+# Exclude gitlab groups by regex
+# flag (--gitlab-group-exclude-match-regex)
+GHORG_GITLAB_GROUP_EXCLUDE_MATCH_REGEX:
+
+# +-+-+-+-+-+ +-+-+-+-+-+-+-+-+
+# |G|I|T|E|A| |S|P|E|C|I|F|I|C|
+# +-+-+-+-+-+ +-+-+-+-+-+-+-+-+
+
+# Add your Gitea token
+# Settings -> Applications -> Generate Token
+# flag (--token, -t) eg: --token=bGVhdmUgYSBjb21tZW50IG9uIGlzc3VlIDY2
+GHORG_GITEA_TOKEN:
+
+# +-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
+# |B|I|T|B|U|C|K|E|T| |S|P|E|C|I|F|I|C|
+# +-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
+
+# When using this OAuth/PAT token, do not set the bitbucket username flag. Do not set both this value and the GHORG_BITBUCKET_APP_PASSWORD
+# https://confluence.atlassian.com/bitbucketserver/personal-access-tokens-939515499.html
+# flag (--token, -t) eg: --token=bGVhdmUgYSBjb21tZW50IG9uIGlzc3VlIDY2
+GHORG_BITBUCKET_OAUTH_TOKEN:
+
+# Add your Bitbucket app password. Do not set both this value and the GHORG_BITBUCKET_OAUTH_TOKEN
+# https://confluence.atlassian.com/bitbucket/app-passwords-828781300.html
+# flag (--token, -t) eg: --token=bGVhdmUgYSBjb21tZW50IG9uIGlzc3VlIDY2
+GHORG_BITBUCKET_APP_PASSWORD:
+
+# Used with GHORG_BITBUCKET_APP_PASSWORD. Should not be set when using GHORG_BITBUCKET_OAUTH_TOKEN
+# flag (--bitbucket-username) eg: --bitbucket-username=user123
+GHORG_BITBUCKET_USERNAME:
+
+# +-+-+-+-+-+ +-+-+-+-+-+-+-+
+# |G|H|O|R|G| |R|E|C|L|O|N|E|
+# +-+-+-+-+-+ +-+-+-+-+-+-+-+
+
+# Configuration for ghorg reclone command
+# See https://github.com/gabrie30/ghorg#reclone-command for more information on how to setup and use
+
+# If set allows you to specify the location of your reclone.yaml
+# Defaults to $HOME/.config/ghorg/reclone.yaml
+# flag (--reclone-path)
+GHORG_RECLONE_PATH:
+
+# Get more verbose logging with reclone command
+# flag (--verbose)
+GHORG_RECLONE_VERBOSE: false
+
+# Quiet logging output with reclone command
+# flag (--quiet)
+GHORG_RECLONE_QUIET: false
diff --git a/home/.chezmoitemplates/secrets/ngrok b/home/.chezmoitemplates/secrets/ngrok
new file mode 100644
index 00000000..e69de29b
diff --git a/home/.chezmoitemplates/secrets/ngrok-fallback b/home/.chezmoitemplates/secrets/ngrok-fallback
new file mode 100644
index 00000000..00a1c38c
--- /dev/null
+++ b/home/.chezmoitemplates/secrets/ngrok-fallback
@@ -0,0 +1,2 @@
+---
+authtoken: '{{ .user.NGROK_AUTH_TOKEN }}'
diff --git a/home/.chezmoitemplates/secrets/tabby b/home/.chezmoitemplates/secrets/tabby
new file mode 100644
index 00000000..76bebace
--- /dev/null
+++ b/home/.chezmoitemplates/secrets/tabby
@@ -0,0 +1,100 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFaHB6eGNBbXRIa3NMWnRw
+RFR1TXpwYU5jZFlPMGxVb1l4dWVZWGJTMVNNCkhXelYvTTN1VlVCUUI0Y0JzMFRq
+V3RmRm1LQkJ4eTJZSSt0bFpZSzh5Y2sKLS0tIHlsSlk4SWZnQy90SHhIa3hJREp4
+QTF3cHpWMXp1ZThxOUJFZHFVK3ZyMk0Kzua8rWDOM0wJKoBpbKr2a+3p79+0x9jV
+509utGwdKhCR+V44PJOz28/zLgQvGwSi0rLJFZ05JR785XTqBD3J9LeksYX1eUHr
+ET+lW79K3bUQxTz4tqPwpVkyYk72pJ32DVWOPHa/WXBUVNaMBu9mxOOsDcjCqiL9
+LVTH/AXP0fLopCobvss9SMPNJobG9uR9/htObHxOkDaMxRjNlnqdv19iATxybvyM
+1azxKC+Xx18Bp3Tn8AYPbhOwCz1M0aphVWtdMR+bHn+8fhMEakbBijfKWcjikop9
+anZywz4ChTjKv3N9yh9hsM5mqCz7BQeupcPzsqhqLe06XxCNE5C/atoRKS5YCkF/
+IO9OW9mfLC9YfyaI8x80pINB9EaGj6NshjN/k73tNZqwmyWhRPPAFHw1kbwe/Cg9
+kY1efUyRTrTXzLS4LO031BecmMzm5JyoXf4FONDFfdR3ayNOlYFQF7qCp04DCkNM
+0lMJkV8tP5qX2avT5o3qPWIEXNfe4dc1RtuL6QesKETTxqESEUKtgiKbgyuYj6Kz
+GovoIgX/7Rgg8+Z/sr2P5oj+qZGYTUZe6DJ9WOAnoYYfgpPgieMdl/ODJz/vgjIU
+VvA7qNWHV3vLOj16Qy/cD+tmlwZzsOxtovGfDuaiUS2eRCvia+0PP1sQC2ReoAAi
+4zq1zHkTlwAeaII9mY08dwaaQHudnVB/GpgJsyytKGpGTF+YzJfJAgudsuGmy/ep
+pTrzaaMkTeCmjyZwwBDm8t/x/hNkGEmqBXMbSCgMomTJaIfkXAVOmVue9Gi5IvTQ
+NSvLopP3FB85g9+gPOW/FQtV/x75GGM6Hh3Jbu47ijZvd/eseMk3TskwedD/ZI6l
+tfN6tZ6wYirU4Si+frY9g2nBE0A2e+UTJpC5YVVK5h2XMOjbaKDBeVZ6IyqPyufB
+8s4UUtB+s+OW9BB/S+oj/B2cDr9b+8Frgm2ea5L9fztuflUQxjh76XaJq7QViH2s
+5J3flwZoHPixJ4OyWslMrXaY2QSLDSiznrTAf104bwh+4VBNisFTdy2rGCAKlTCy
+Vnbx6GesEw5cmKB02PpsGtLTto7H0DEc73140JmEDaA7UZhrmsCk4tC+E1FlYjtp
+zvFtRMUn3ZPY13QigGE4V/GPkTtmdaT8a1myOOEaDvQV6jVpl6/92ncXvXIg3D4z
+mSxHeeVXB7LLRDLuyovfdF6LzlA8eZigoYwgCUL4LCTvdHjJMpXO59t6WWYsBaxc
+qw3KrWNbG6CSkQh5G2FEz/OX4+TQshp3IF9Xk9T8TploTzgu8fYGvcWiOGcWyhm6
+rpuU3Mc77pD4eJQEgTQMsahPpYqNiOYk5n3o+ry40PWikmaENBxHY/8ity2J0ihl
+GGPQWnO0/SWDV5NVL+HD+x958ioXe5XqiiU5ABss5H5puk82pG6lvyjlCd95xa4+
+aYInTD6T8I49cZ++E/QCqInkpoCr6HpEGkLyozG2RJe/8ikAQk3mIoawwnjziNii
+EQ8tx8Kn/Q0fIav+JdQb2rWQTOINFJ+Y26QhqlIEfWWfEiHhT5YnH88v+co3KbGw
+OpUjfsUoTWGcFuAyMTuC/xajRmNSRBUseUQTzVcGkpL4MV6vGx/kzL7Cm0J3MEPV
+dvpSAYyW+8p4CNj9DVuysYd4hlwJN4O3rIhJQSszGmMuOzc74l1xwDIGHC060tIH
+ZLkCYUfTUUmQpb3VqgThb0rmHxhHkzWDQGb+7sIBKfTfqJ4i513/7B4LzQJrmUQq
+KPK5WEkY3qm/JkyN1CeNedYt5S4pvrKA9XBIUKkB/Us2aRP2K2Y14xYEkFuGPocJ
+xTQQ7zxaKah18ENnCEA6HvVyS+ZUnCU+kk4nXdL1kce9qpFQhIGFVrLh24FQ94xJ
+114EyNrY6Xm/Az5M7Mly74nWKFK8I9jmbsYLKLFvzRYU0zgMBn/KJxqpfGZKHsTw
+DRS02kc9biaiKbuErl7ACanaWvj/Bq0Co2vC/QUkfO2PSNtmPl3STYV9eVtERF4s
+v7bijtwKP6znbiDMJN2kWz7UNXk0TlSAgIwl+Ofo+rseOFeAI46xTa9ararAAZCf
+LbSj4ShxoBNYC/qhLdejAdo1TkiZECVAmSnx50hmnZbcVW0LCw3kyw8TJnBaLOcz
+qZjsgZZh7bWh7Z07e6qEAcG5yl5iUVmaM8sP3AZomTCwPFfKt3H98q241zOC0ZU7
+0W6kSLNVLZOZvkEZcCkWZwZZIi9xidojhCtqChOkIVPRqskEu1i6VJZJep8X1RB+
+Y9PyCtoZcr8VLWm8Q7pS40u+MQkZGjvuYC4IgblunJxgCCjdJrDEdHOGC2ddNggT
+tAloeVkvX+vIBoV+vS21YvWrXGo5WR8UmCo5V70DD/Xfy01utN2M/mL9Hd/qHhi1
+yIrYCIplj3KY9C5hTPh7exNJpuS2vyo6qllOc1xC4AvJP4QsG7nsbIzv6wXbv+aw
+YH6IJOeZOLdgbbZQt1tPdboeqMK7nx9yZ4z+8QYo1i6beo+ASx0pBU1FKoOAU/su
+cGHwfMfFht+qdpKm82OhLUsUuV3uXnwwXHfm2Pql0kCs7+8JPsMujcg+/HkV3O8E
+CnhhlQVy0tKOEqHgmvaYsLU+Fg//onsw/rVV61YV+VKGqVeBLHkLn+G6shZridJC
+zGOlMzvkL3ScR0DM1XTE+Fhx3XctRg8t0IFcthmOfl5vUfFGJAby0xU+mHLKSdbw
+ecC1pb3Q7odRX41avD37uaoWggJAeUvOr7OiSDEBByvJ8cy4sUpkJMmqcT5CCBhH
+dCJ5mLr+HspwzqQBvHZRjQUPDCaVgz+v0aScxlrY/GdKtHIyQGonjRVtRmDF9G9O
+XfCIoSGoHZDDR6ZKsE2kcKkw+vUSHVakx9omDlB8vh4/wp43M9rSZMsBLHe2HjUC
+MgZZBM2KfqqYmvNlW343kfIk0Tz5cBBs+4NO9Ty5EteLDGrv4KY9Icc47h5rRtwB
+s5ifYAS62ytbuAoxhawfNsgZOBX29WTT6AKWvJd93xX54QClc++nGApKtO+6R5jT
+k+lP4Y0oWUtUrcZ6A8Dgz2UAaxTxCj4coWTDDs3vBFsXQhBn+VeQ+ZihoJFHjxeT
+NQJ0ipRk3JDLKZg7eur9uZdKJ/hL6cdc0rkGhxHIjHN6Kvd2G8KsyG6Cv7EQSkwe
+TkAKeGayFzpHjh3kjGrxYDNsm9MKZ3rdB51KRdxsUjPop0IyG+FrJWUkLHrEY9NB
++dxIIuBEuobeFj3omE2Lg8blLnCqOOrb53p9x5dJQNCCzeUUpXJzKmyHH3YGcpmd
+gX4RBdDaUvTyaimUEqgYDkr1gCqOttKAplfGOP1hSYid7p+ohblGeKTWh9fjRuAi
+60OWXHberenUswwGeuWmJh0PaiGsz14gp9zZ7d7Ko2H37S0+WdmYcaAmYFxzaM0O
+NLm/D9zsNXzORAmWWQuS/H3gyeqBAElSCroWwHXwYc6W3BUlTOqJcVTBI9s/jup9
+EWRmd58GSFMpOy9BxDzCG6FCbbruKdAMh8Mj7PL5R9NYN6iUxIPZe1vpZfbgahxF
+odxxxRwDmD6NZQ0Aeku+/tGDu7ke67tt6fAia91MXXvFZv2f+oVGc7eb8rhEXT2I
+wQx9i3ugbm6TUaSXSL8gdSQCRRSmBChKee9Sfd7uxP0Cg18ivS8XMhXAI1ZOHGvw
+w5x8AZUB5e8Rx6Vs1oVzSiMuF5G9+pMTRPVmsZ6nLxwcskrPx/1FJUUexNGdRWKf
+af+pHmw/tkoFrQ6HVi8DnMN9C5VXFzNmBJ99ZHVVG6Mm651UWIg6A7cZsDwDQeyA
+260exIVIYwuJyFY9fDxFwOMIBnexwFkk78hrMgfZscY80l2mlIMA05CCX+HHddrn
+bfzoM2XCq5u5hVk74SJz1SHIpnEMNxe8UpdlPXAKUyqZbxKtpHD7q+7cinBzmVfN
+QsfmyMbwloNDUnoK3gKsZMYogJqcI2lGCSzW/3VbUkB9vtwIUVsFado7EErwSL9F
+LUzWjg1fXNBNKzdcFOpQWp431WP28vH/fhUNAQz0XFnfffL04YShFQuRW62U2SiS
+XWTqQuJ73UyasCQbPVxPURVHL8Qk+4JCtLVQeNk9O4EJnTNKasC3ovvXv6a+yJJu
+9Ov6foMJQ0pGMKPDVoCLF7hqjCANAYmTq71ldsb2N5C1CQe00PoSjeaVX6Ekap7v
+vlUSnV/yla4mlzCJVldw2UprftRhlXga6dNO6b/YtsJIl0O0SPEWRLaJ+C8YPaut
+wnq1CTgKhzSryKh1v9Fp11s1abMQFzMCEVZcm0J/2jbSbftYJVWHganZBryvJKAA
+05KJ4S9yth+drE/4/NhE/gIhO1TjiQF9u3n2QZ3ypbkjiCEYPMTU891mwCVHdnPf
+Gq7e/Et6onJgwMCH8leqw9lXIZpC3E+SyxnIV1o28t3X23Q6/zQcqLnS9M9HPcPK
+ZmSmSvt9RsbWcwAWKe+ClO9lbqwkQaX9lIJnmvGNKoyx9rRw5aMPXYD8AonUjnxb
+ECv1piqc3Wi8gBwGQXUaeFKhM3ifLKlNADxLJQV9mPsflLJbq5j7XqbcYS2yxH3b
+VjkEi3ex/xkqlSMwPLoe5T+5gOCnWWiTtlN5s7L4cRYBLOSpWxoohaTodonqlxXy
+sibJ+3DGMgNnp6aFY3EdsNl26nHwyscOEL+xFwEpxq+dsRuVTYdP9c5CZmlcqInG
+ZUf8KGSKoQGQTd3AiBIRe9ISgZbPYJCnX9jjXDX8sK0LrTHTMCNd5zEShxHHxV1D
+N46BLdBkUgJCp8wxHJQxmOq7F16agHtszI93OD/v8t1Q3YNQW6o6A7Yma2lFcd2Y
+9PneDYq4u3t5TraZOMqA227IPwXJIFGrh1exMoySyyfMNGDtKMh3poXqniMFS1QL
+lWPKvzXc31k3170xovj0geDtnZe7nmDrw47Ax40jWQzrK7d0IIn0CD0seaFfI/xN
+lFuQOJY3Y0AK4Ciwy3ZiuLPOoz0o4Z1hhrvI0pUtWpCkZfQxzgrw2qCBKHhqJcj8
+6evUnsw9qiJaujYGwIPpgiNqsCPa4f3fLzC5dUWbABkCmhK7zPpUXgL+WIQIVSkD
+86k/mQ2QtZZSmkzeVmSyVW4hQqz5lvHftek/i3p7tmZRe6wwEVq+QgdpEuSRG/qY
+U7HCl9si2kyOBL+0+IIrW5i7FiGLH2PLKi7ZwHb6LBAFnKVAn86xvBpkoDFPTR4Y
+142dJrrKh7YJuBJIbgVpugAWz5LBSzKNOpxVJ2vAUUBJQ2xN3tt4iJJLFgsSnuO6
+Qu3QsArBtG2nBpewDm2KcyDI3LYW5i7n2bWKr8a0Liq/R6lmYpdbV69oxIfC5RVY
+F6NRRHuxCUv3Nvihm6maakQ+oMxfKl/8bXKKv79mxFQJxrSvGUWVQXahyXN7TAs4
+2YkXKLYdKbrxElBy7ugghrVEIQpaDjoS43IRNT7WEjDVcdBetnS7fBxUmlBW+ekG
+kHkQ7OCbILUwPTAx5PvqEGI66VgQFx9c71S8sg6TDbsFDu1l0qQxgoha0sGrz7vA
+pxmeDcN9I+/MPkgKi7cdzQjYX+Z1wMqgCRHqLKfDKSBJ3bk7fMP34YaHx4zAXdIO
+1NysycqUBd3PxqBGUmSJqQvvLqUqSbkXWWEFhpviHZ7ooPVhWn2Y3quIKMI0/qBH
+ktCbVLIuPUtoRTsR7sAGBRTlMqfYg4OoA/i8iSm1QuKIKzYfg7C3+osHw6KELt4Z
+0yE29X2EzSoOPFSjgzp7gigU73H6L1b2MybdCVcm3wBCrutoZJz8yNGnuanuzZeK
+Qqsw3ZGDHSe3nknNKy9d6ZXZW/jTd3/swpdzI+ZOBHpZQeOVdajZ4j7T2sHEEA2K
+kPp4xaWkifhEr7PgPUuDKQEBBJsZyaX1QGyy85sWU4GTFVnvM8YKDYTy0iUgtOT6
+kwGDfjiwB6J0mPdLK6oTruPYeenGauhxbCUgRPHLEZlg1CRi/U317HlrtpAidp57
+3owgAJc76Q==
+-----END AGE ENCRYPTED FILE-----
\ No newline at end of file
diff --git a/home/dot_config/tabby/encrypted-fallback_config.yaml b/home/.chezmoitemplates/secrets/tabby-fallback
similarity index 100%
rename from home/dot_config/tabby/encrypted-fallback_config.yaml
rename to home/.chezmoitemplates/secrets/tabby-fallback
diff --git a/home/dot_config/Google Assistant/client-secret.json.tmpl b/home/dot_config/Google Assistant/client-secret.json.tmpl
index 60be3a22..b4b7d2c5 100644
--- a/home/dot_config/Google Assistant/client-secret.json.tmpl	
+++ b/home/dot_config/Google Assistant/client-secret.json.tmpl	
@@ -1,3 +1,3 @@
-{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "google-assistant-client-secret") -}}
+{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "google-assistant-client-secret")) -}}
 {{   includeTemplate "secrets/google-assistant-client-secret" | decrypt -}}
 {{ end -}}
diff --git a/home/dot_config/Google Assistant/tokens.json.tmpl b/home/dot_config/Google Assistant/tokens.json.tmpl
index 19616692..1f21067b 100644
--- a/home/dot_config/Google Assistant/tokens.json.tmpl	
+++ b/home/dot_config/Google Assistant/tokens.json.tmpl	
@@ -1,3 +1,3 @@
-{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "google-assistant-tokens") -}}
+{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "google-assistant-tokens")) -}}
 {{   includeTemplate "secrets/google-assistant-tokens" | decrypt -}}
 {{ end -}}
diff --git a/home/dot_config/ghorg/conf.yaml.tmpl b/home/dot_config/ghorg/conf.yaml.tmpl
index 71594f4b..deae1748 100644
--- a/home/dot_config/ghorg/conf.yaml.tmpl
+++ b/home/dot_config/ghorg/conf.yaml.tmpl
@@ -1,219 +1,5 @@
----
-# +-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+
-# |G|E|N|E|R|A|L| |C|O|N|F|I|G|U|R|A|T|I|O|N|
-# +-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-# Which provider to clone from (github, gitlab, gitea or bitbucket)
-# default: github
-# flag (--scm, -s) eg: --scm=gitlab
-GHORG_SCM_TYPE: gitlab
-
-# How you'd like to clone the repos (https or ssh)
-# default: https
-# flag (--protocol) eg: --protocol=https
-GHORG_CLONE_PROTOCOL: https
-
-# This is where your ghorg directory will be created, use absolute pathing, shell expansions will not work.
-# The ghorg directory is the home for all ghorg clones
-# See https://github.com/gabrie30/ghorg#changing-clone-directories for example
-# default: YOUR_HOME_DIR/ghorg
-# flag (--path, -p) eg: --path=/tmp/ghorg
-GHORG_ABSOLUTE_PATH_TO_CLONE_TO: /srv/repos
-
-# Folder ghorg will clone all repos into. Cloning will result in: GHORG_ABSOLUTE_PATH_TO_CLONE_TO/GHORG_OUTPUT_DIR/repo
-# See https://github.com/gabrie30/ghorg#changing-clone-directories for example
-# default: org/user you are cloning, e.g. 'ghorg clone kubernetes' would create a kubernetes directory inside your ghorg directory
-# flag (--output-dir) eg: --output-dir=testing
-# GHORG_OUTPUT_DIR: 
-
-# Type of entity to clone (user or org)
-# flag (--clone-type, -c) eg: --clone-type=user
-GHORG_CLONE_TYPE: org
-
-# Change SCM api base url, this is for on self hosted scm instances only
-# For http gitlab instances see GHORG_INSECURE_GITLAB_CLIENT
-# default: github/gitlab/bitbucket public apis
-# flag (--base-url) eg: --base-url=https://my.self.hosted.scm.instance.com
-GHORG_SCM_BASE_URL:
-
-# Include submodules in all clone and pull operations.
-# flag (--include-submodules)
-GHORG_INCLUDE_SUBMODULES: true
-
-# Allows you to pass arguments to git's filter flag e.g. git clone --filter=<args> this requires git version 2.19 or greater.
-# Useful for filtering out binary objects from repos
-# Few caveats, only works on inital clones, however if done on inital clone all subsequent clones will also honor the settings.
-# More info at https://stackoverflow.com/questions/49917616/what-is-the-git-clone-filter-options-syntax
-# flag (--git-filter) eg: --git-filter=blob:none
-# GHORG_GIT_FILTER:
-
-# Deletes all files/directories found in your local clone directory that are not found on the remote (e.g., after remote deletion).  With GHORG_SKIP_ARCHIVED set, archived repositories will also be pruned from your local clone.
-# Will prompt before deleting any files unless used in combination with --prune-no-confirm
-# flag (--prune)
-GHORG_PRUNE: true
-
-# Skip interactive y/n prompt when pruning clones (can only be used in combination with --prune).
-# flag (--prune-no-confirm)
-GHORG_PRUNE_NO_CONFIRM: true
-
-# Color output (enabled, disabled)
-# flag (--color) eg: --color=disabled
-GHORG_COLOR: enabled
-
-# Skip archived repos, currently github/gitlab/gitea only
-# flag (--skip-archived)
-GHORG_SKIP_ARCHIVED: true
-
-# Skip repos that are forks, currently github/gitlab/gitea only
-# flag (--skip-forks)
-GHORG_SKIP_FORKS: false
-
-# Backup mode, clone as mirror, no working copy (ignores branch parameter)
-# flag (--backup)
-GHORG_BACKUP: true
-
-# Max goroutines created while cloning
-# flag (--concurrency)
-GHORG_CONCURRENCY: 25
-
-# A comma separated list of topics to filter by, currently github/gitlab/gitea only
-# flag (--topics) eg: --topics=frontend
-# If any topics exist here, ghorg will only clone repos that match at least one of these topics
-# GHORG_TOPICS:
-
-# Only clone repos with matching prefix, can be a comma separated list
-# flag (--match-prefix) eg: --match-prefix=backend
-# GHORG_MATCH_PREFIX:
-
-# Exclude cloning repos with matching prefix, can be a comma separated list
-# flag (--exclude-match-prefix) eg: --exclude-match-prefix=backend
-# GHORG_EXCLUDE_MATCH_PREFIX:
-
-# Only clone repos that match name to regex provided
-# flag (--match-regex) eg: --match-regex=^foo
-# GHORG_MATCH_REGEX:
-
-# Exclude cloning repos that match name to regex provided
-# flag (--exclude-match-regex) eg: --exclude-match-regex=^foo
-# GHORG_EXCLUDE_MATCH_REGEX:
-
-# Only clones new repos and does not perform a git clean on existing repos. Useful if you don't want to lose changes made to repos in the org/user directory.
-# flag (--no-clean)
-GHORG_NO_CLEAN: false
-
-# Additionally clone the wiki page for repo
-# flag (--clone-wiki)
-GHORG_CLONE_WIKI: false
-
-# Fetches all remote branches for each repo by running a git fetch --all
-# flag (--fetch-all)
-GHORG_FETCH_ALL: false
-
-# If you want to set a path other than $HOME/.config/ghorg/ghorgignore for your ghorgignore
-# flag (--ghorgignore-path)
-# GHORG_IGNORE_PATH:
-
-# Only emit critical output.
-# flag (--quiet)
-GHORG_QUIET: false
-
-# Perform a dry run of the clone; fetches repos but does not clone them.
-# flag (--dry-run)
-GHORG_DRY_RUN: false
-
-# Branch ghorg resets and leaves checked out
-# default: default branch
-# NOTE: if no default branch is found on the repo, will fallback to using master
-# flag (--branch, -b) eg: --branch=develop
-# GHORG_BRANCH:
-
-# Allows you to control the exit code when ghorg runs into a problem (info level message) cloning a repo from the remote.
-# Info messages will appear after a clone is complete, similar to success messages
-# flag (--exit-code-on-clone-infos)
-GHORG_EXIT_CODE_ON_CLONE_INFOS: 0
-
-# Allows you to control the exit code when ghorg runs into a problem (issue level message) cloning a repo from the remote.
-# Issue messages will appear after a clone is complete, similar to success messages.
-# flag (--exit-code-on-clone-issues)
-GHORG_EXIT_CODE_ON_CLONE_ISSUES: 1
-
-# Specifies the location of your ghorg conf.yaml, allowing you to have many configuration files, or none at all
-# default: ghorg looks in $HOME/.config/ghorg/conf.yaml, if not set in that location nor as a commandline flag, ghorg will use all default values
-# NOTE: this cannot be set in the configuration file. Its supported through CLI flag and ENV var only.
-# flag (--config)
-# GHORG_CONFIG:
-
-# +-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
-# |G|I|T|H|U|B| |S|P|E|C|I|F|I|C|
-# +-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
-
-# Add your GitHub token
-# flag (--token, -t) eg: --token=bGVhdmUgYSBjb21tZW50IG9uIGlzc3VlIDY2
-GHORG_GITHUB_TOKEN: {{ .user.GITHUB_READ_TOKEN }}
-
-# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-# |G|I|T|L|A|B| |S|P|E|C|I|F|I|C|
-# +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-# Add your GitLab token
-# flag (--token, -t) eg: --token=bGVhdmUgYSBjb21tZW50IG9uIGlzc3VlIDY2
-GHORG_GITLAB_TOKEN: {{ .user.GITLAB_READ_TOKEN }}
-
-# clones repos in a directory structure that matches gitlab namespaces eg company/unit/subunit/app would clone into ghorg/org/unit/subunit/app
-# flag (--preserve-dir)
-GHORG_PRESERVE_DIRECTORY_STRUCTURE: true
-
-# Skip TLS certificate verification for hosted gitlab instances
-# flag (--insecure-gitlab-client)
-GHORG_INSECURE_GITLAB_CLIENT:
-
-# Exclude gitlab groups by regex
-# flag (--gitlab-group-exclude-match-regex)
-GHORG_GITLAB_GROUP_EXCLUDE_MATCH_REGEX:
-
-# +-+-+-+-+-+ +-+-+-+-+-+-+-+-+
-# |G|I|T|E|A| |S|P|E|C|I|F|I|C|
-# +-+-+-+-+-+ +-+-+-+-+-+-+-+-+
-
-# Add your Gitea token
-# Settings -> Applications -> Generate Token
-# flag (--token, -t) eg: --token=bGVhdmUgYSBjb21tZW50IG9uIGlzc3VlIDY2
-GHORG_GITEA_TOKEN:
-
-# +-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
-# |B|I|T|B|U|C|K|E|T| |S|P|E|C|I|F|I|C|
-# +-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
-
-# When using this OAuth/PAT token, do not set the bitbucket username flag. Do not set both this value and the GHORG_BITBUCKET_APP_PASSWORD
-# https://confluence.atlassian.com/bitbucketserver/personal-access-tokens-939515499.html
-# flag (--token, -t) eg: --token=bGVhdmUgYSBjb21tZW50IG9uIGlzc3VlIDY2
-GHORG_BITBUCKET_OAUTH_TOKEN:
-
-# Add your Bitbucket app password. Do not set both this value and the GHORG_BITBUCKET_OAUTH_TOKEN
-# https://confluence.atlassian.com/bitbucket/app-passwords-828781300.html
-# flag (--token, -t) eg: --token=bGVhdmUgYSBjb21tZW50IG9uIGlzc3VlIDY2
-GHORG_BITBUCKET_APP_PASSWORD:
-
-# Used with GHORG_BITBUCKET_APP_PASSWORD. Should not be set when using GHORG_BITBUCKET_OAUTH_TOKEN
-# flag (--bitbucket-username) eg: --bitbucket-username=user123
-GHORG_BITBUCKET_USERNAME:
-
-# +-+-+-+-+-+ +-+-+-+-+-+-+-+
-# |G|H|O|R|G| |R|E|C|L|O|N|E|
-# +-+-+-+-+-+ +-+-+-+-+-+-+-+
-
-# Configuration for ghorg reclone command
-# See https://github.com/gabrie30/ghorg#reclone-command for more information on how to setup and use
-
-# If set allows you to specify the location of your reclone.yaml
-# Defaults to $HOME/.config/ghorg/reclone.yaml
-# flag (--reclone-path)
-GHORG_RECLONE_PATH:
-
-# Get more verbose logging with reclone command
-# flag (--verbose)
-GHORG_RECLONE_VERBOSE: false
-
-# Quiet logging output with reclone command
-# flag (--quiet)
-GHORG_RECLONE_QUIET: false
+{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ghorg")) -}}
+{{   includeTemplate "secrets/ghorg" | decrypt -}}
+{{ else if (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ghorg-fallback")) -}}
+{{   includeTemplate "secrets/ghorg-fallback" }}
+{{- end -}}
\ No newline at end of file
diff --git a/home/dot_config/gphotos-sync/client_secret.json.tmpl b/home/dot_config/gphotos-sync/client_secret.json.tmpl
index 1cfaf5aa..530ffa10 100644
--- a/home/dot_config/gphotos-sync/client_secret.json.tmpl
+++ b/home/dot_config/gphotos-sync/client_secret.json.tmpl
@@ -1,3 +1,3 @@
-{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "gphotos-sync") -}}
+{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "gphotos-sync")) -}}
 {{   includeTemplate "secrets/gphotos-sync" | decrypt -}}
 {{ end -}}
diff --git a/home/dot_config/ngrok/ngrok.yml.tmpl b/home/dot_config/ngrok/ngrok.yml.tmpl
index 00a1c38c..767d51b0 100644
--- a/home/dot_config/ngrok/ngrok.yml.tmpl
+++ b/home/dot_config/ngrok/ngrok.yml.tmpl
@@ -1,2 +1,5 @@
----
-authtoken: '{{ .user.NGROK_AUTH_TOKEN }}'
+{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ngrok")) -}}
+{{   includeTemplate "secrets/ngrok" | decrypt -}}
+{{ else if (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ngrok-fallback")) -}}
+{{   includeTemplate "secrets/ngrok-fallback" }}
+{{- end -}}
\ No newline at end of file
diff --git a/home/dot_config/tabby/config.yaml.tmpl b/home/dot_config/tabby/config.yaml.tmpl
new file mode 100644
index 00000000..573b9b6a
--- /dev/null
+++ b/home/dot_config/tabby/config.yaml.tmpl
@@ -0,0 +1,5 @@
+{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "tabby")) -}}
+{{   includeTemplate "secrets/tabby" | decrypt -}}
+{{ else if (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "tabby-fallback")) -}}
+{{   includeTemplate "secrets/tabby-fallback" }}
+{{- end -}}
\ No newline at end of file
diff --git a/home/dot_config/tabby/encrypted_config.yaml b/home/dot_config/tabby/encrypted_config.yaml
deleted file mode 100644
index f8bc04f7..00000000
--- a/home/dot_config/tabby/encrypted_config.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-vault:
-  version: 1
-  contents: >-
-    SKyIYiwTrtQRoOeam2ggqnNo4xc2yqzfDQKU5nuGSOM/mWLrt9kh7RAolMI2bx25tYpE53II2vAGJ6bdub/Jg4HDCG7h/X93+BCsS+xvAC+w14uslKkIlWJKKSRqaHJC5EJEkkoyhw5qmoIQ2x4gOoXGq06te8aJYq+g7mFNsBxVw+Qx17iifjx9ThlRczzyd+mTp/Upbe4pwbYdhTfpvqNZBOWCcK5sWqTsBNQu99LuzM5YZQFAnMqLk9z6iNTvUJOPc0i02zHYujj7Jz7Vg/kH9ThJrCnUoXuF/TzWp6Z0fUNVSOuHUoKd72FFjuBBN6XuPatKwPaTZ4+fNV8ZMg1pr1Q7jOwZcNI/oMYY7FLD596E0Y2q7SrtIDr9283CmwsJe55E00TVr5eEx1uc+kY7yuPTNZzJvZxNTcIz2HvAQxSSy/qPksR3xyvMrDsnUkimj89fsnYplUx54dsBnQrMYpIX2Agt1zWg5fyFkIiktxnjvz4UAHbWCpWBPFu81Zih/ndXMLqTsbCM7mdPbiAMHpqpmN8mGWg41xztCPKb/6SIdYP8XZob+fic+wDCoIbUgT5eiGjqV1Tcmw8u05r4le5rx9dKX8IkOZ4ijLU6ZzKwrx1K7gdnDFHkXhM4ZK2W4Y49nbygXrvYtspNakO9nigxY5oMtnbrRFpVI5K3ocHGrEPhqTfKen4wqLx5JeRGjoClY0X18WsLQsG6HqmS4vBGUPUmYY45YmlJCodgVH3BfHDWsrLJ2U92AYw+LKhf3IrC+hXuKaPebcDlkeDvi8h+G4mL5Zj8w8G6ub3ulYRpEdztl7bvn9gHI6IpUx7BZtgm8RWSqQyalo8aXXl6LP2U6gkTu5b8a6tbrTAnmUUhC7y/MN8XRqtxWaYgpugEj6sTu9zzypRHLBFVvG2OG3FotDHLXTnwJ0fMownyx3ZPVYrPyKi4A7soBHioH01IaTdNT9CZho4r7mvA/9z1hE6VrLgx0gziLOhvhktdjzaJeUihGV7iBvXwrUKpIpvl759CPxVmpCJMLUAlBJ184rvxJVRMk7LQ5QgePnG5mLa5mjpNgwLSYkIxSWoLggoWikLoLfSWn6cFslMV5Zhr7MlsRJUmZjfYR82n9vIZqwLfkV9YMv5Y7ZjgMVR5/sy/SoYTf64kISPxmWUgJCaH+Ay9Xe0/L4BMrAiNAhAFf06raLchdqNR/XVFp8dJFtpfSsyBlG3OhD1OVyRwrVerB1SxKQW/6gqxG7FzjJ8LVrXPPmJTUAFSMdxCOe9mFemeBi1Bk2L6ifARX32BG6BJO0bYcyg66uN/VQnS94jgz+fjDUrdWc8DvCTf13g3+wuI+MA+kdrtWbDHNWerbJit2C17VQpTPZl6FZIF5+YXFTVEeRlB0zSa0/nuWDf++Iudk2sQCZNZsX757V6H/o2w4d/VOkoqaJHkefSeqbfT+K2Fah/2vvCPq5FSHzUdIbxOoLgJ9vtucjjTKGgz8B+JqHQvKC0qWrKLedNw3poB2r71QM/V/S2xQck+qqZTRBujleblY8lCveWLCrjNK1smQv5n9/ZazCZ7mLJw9DVc3CAnf6nMbNCQghIiAnN6b0CmK5DnTYvnpnYNKOIkFuO94hrGbcCdT/US5TDBU3awWCXJpo9qn1KhQzF5rsGMOEIPNUrv/fxJk7jXUhkvGD4zK2hY1KDw5HQC8UCoC7HsPCnF3oM5s1GT+jtwX3HWwRpMfwjWhjMhg7XaW/bXy/p8wRYhO2tpnn+3iZD0KmatXALxvuWpdC29hnEQgWyxZmRE5f+KM43KLhqTc0f7DOzeMioS4/X7a7VrXUQkB6TOqmuHIXg6B+CWDgTACY9FG5S0NGeokLLfTUhCv0ufZ/mbHXcjo71s+8+jXQG4cQlviNip9o5JApH/aHkG0rBg4/25ogRp+rh+qJZw9lJLppM2mJBhNXuulQHFVd7eUXM66IDUh3z+yI/3a/i96R9/3xEepbQU5ozNkOcex7bp5AP9y6l0wYtTYESd9IPdf1Vr5Bx5bKBRPCultfLHHFRqCpFdfhqMd108N43E/g1cO27wXkLxMrZcSccZA1j+hx3nO7HOhYrkE7+PjWjCL8C+HJyf5/OxsWJwL7usv3qdMjNBs99tFiL6UVAUEcj1sD2TfR910AdXwwvCbU7JR7p7c7bQm0rX8soejDm2Jg3bUOaXPmAqMwmQKDVjrCq07WC5/H102QoCItl+xBBWXztBitt7gJlHl3jTGs586NDmGZZbMymI5TLnAo6xLi+ejQckSs0NoUwtTlq7NKWNyYwpJ7geAWRezwhSmm4qtTJnPuSa3KQ7KKnyPMW9B2P3nqk8VBB6JQ31ku1eRne1Q/sKatPPZ2EhFrpjrrUPqcSp8uy8ogsqGdgtaLBhpU6JFdYRQrckABvulQXbWeRrriqOrwJ3e4DJIX2si5vvTgd0KBYZok6LAiY3mD+YT5lIljAzlTH1aMiUmBFV9KZInbO49aNGfnV7H9s3lJevcy1Xtb7YTdZKxzCfvTmHn2dZ50rEeVN9HHZ2eRUm9kHGVQBGc6Ki8SRpN/WNZ2qvWptlt39btjgxrq1n8FXMjuZObsZ7qeXi2/E1YGd9t4ez5BkutuN3+A3DpVXDcS9UT5BoBgWzg+iXegob2kFeCzaOSXsryzlGG3qeF6gEJFvVam1qOqUhkTo/zkcUl8Npv3dq8s4dy8ZUGhrGY1V/HdYeo/2zIJf/FySmhoavLG588zra37rAhKnuSd0aOZUPDuzJCWeBYnVHb/pX8l6xk43zEDZ7i9wFtPHoQ0j98WmoxEtfzS8JWJb2aiCJtdl9ySRzKUwja/LJlbPjTUTMz8ShyaClgFS2vuk2qGEGT8lhGdQbkcaH3a3nKXw10q2JQNndIr+fonojO6EUtGt3qb7s98HpbVOXr4q1ysCNLtQl7PSI3oUTshrhjniNayd3rSJk69HmUtiFt5ZwcpF7U3JJAtX0ukbaa9ko/a2jg7tEtZZPDq/4ZOdu5shWiOj9OSU4IO5uM6ymVTeNPMibhpqbZYGA2CgupRHKRQwzhicEiXSGU8S4gLvtFBic+ExdUa0H+DzvTQ/NYN54/ynbfRcy47CZWtA/8UJWu+ufRQFUkzNTS/QRQOovagEk6cETxa8QaUblVijh9FBGS0sZyzwGtLanjwi2Wq8h5oEJiUC9WjKFukw/YMZcKp4iCA6BOeCWS2uotFzW0kRrq1LOLHaJbQuTXefA19fbcHUeFNHsG4ie2nzqrBdNf+mY2bh+UebFJPn+jcy+AA/j6KSMzzMbzVQlBWf18IR2Y/gXcRGn1OnaAHjQru/0FkdKJAsimlw0RC8livp7NkH6rai+gjndXOWxwVdhLMM9Tef5MCmzW4HUPnihoXsosamv3sniZh77lvyewctrCQyUJ6fuOlH6qKZGbwBJfX9j4ELfvbPd8BNH9Tv3Ga6YED6q/4KTqYXQfZW8lXTUnV1HXpHp7yr08ajeljqhVw2xpuJvL6qPJ+AgVxvnOYPFu5hKbgk6INYeN1Hu50bkPd0MBuGD2qVxOS7Ms2mI5OJIpyNpt1IsGulqpNcYKmeBvWi9gkycbKwvHue0tE2LAPIP/v3Eh8DMU9CClr2zuEA/QsT7HxU5TavKC4NcY4EddBl6/nturuHlwZp5R49D/D25998BYPL6dioFJZF1TkvQzCb56hEmdaVF8LycoKKpwdHO4SZXjQcihYcM7toLp2G+XXz+J4mDPFXRf+t3Jd0vZw0HQU2qfs6w9ifOff6CztSR/q/EsR4EXfls/4iIi/ExDSgsP4CZHv0+c6eqcmxDyD5b9XwMYS9wPZOPjs0Mt/EI6qkT0yPRqiuVSSq6e3bqGtmAgcSlxi0wuoLDFeh+zpEZBaA9PHS+soVg0QUAPpvxtPJGKXsMG1oAnhzoWG1P9rUUfiBsyP7K5RLFladcuxUevdBNTIqHoT7Y4uouBBSUmbL3PAHRLiDIUTALHpnePkCGZy4Sh9h/m6FbVQ7Tj1fvACRhutNwBPHlQHYbKLbzjkt+BoqF+dncQCm4j2FebtLCcVkRSpa1r6GoI/lrDHIpA4jAsyef+f3PYFIOAJzR3T42OnbQkMmYwEMcWshcDPHuu20JhUE=
-  keySalt: d0cea2204ada6bc2
-  iv: 0fde1281b25fc859a92e61fa356d9e5c
-encrypted: true
-configSync:
-  parts: {}
-  token: >-
-    196a3118cc7be31cd13d2862d7e33c122357fd9fa36c2f149e8b018b82c260ab6b72169f4c411a6bedd2b8b4124c3540daa57778f20a28cfe2c797776f9a616c
-  configID: 15899
-  auto: true
diff --git a/home/dot_config/tabby/plugins/run_onchange_after_install-tabby-plugins.tmpl b/home/dot_config/tabby/plugins/run_onchange_after_install-tabby-plugins.tmpl
index 4fe1af4e..bbccaae7 100644
--- a/home/dot_config/tabby/plugins/run_onchange_after_install-tabby-plugins.tmpl
+++ b/home/dot_config/tabby/plugins/run_onchange_after_install-tabby-plugins.tmpl
@@ -7,8 +7,8 @@ if [ -f "${XDG_CONFIG_HOME:-$HOME/.config}/tabby/plugins/package-lock.json" ]; t
     if [ -d "${XDG_CONFIG_HOME:-$HOME/.config}/tabby/plugins/node_modules" ]; then
         logg info 'Skipping Tabby plugin installation because it looks like the plugins were already installed since `node_modules` is present in ~/.config/tabby/plugins'
     else
-        logg info 'Installing Tabby plugins defined in `'"${XDG_CONFIG_HOME:-$HOME/.config}/tabby/plugins/package-lock.json"'`'
-        cd "${XDG_CONFIG_HOME:-$HOME/.config}/tabby/plugins/package-lock.json"
+        logg info 'Installing Tabby plugins defined in `'"${XDG_CONFIG_HOME:-$HOME/.config}/tabby/plugins/package.json"'`'
+        cd "${XDG_CONFIG_HOME:-$HOME/.config}/tabby/plugins"
         npm install
         logg success 'Finished installing Tabby plugins'
     fi
diff --git a/home/dot_ssh/ssh-audi b/home/dot_ssh/ssh-audi
index 2bb598b2..26e58422 100644
--- a/home/dot_ssh/ssh-audi
+++ b/home/dot_ssh/ssh-audi
@@ -1,3 +1,3 @@
-{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-audi") -}}
+{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-audi")) -}}
 {{   includeTemplate "secrets/ssh-audi" | decrypt -}}
 {{ end -}}
diff --git a/home/dot_ssh/ssh-authorized_keys.yubikey b/home/dot_ssh/ssh-authorized_keys.yubikey
index eb681f66..149a4e73 100644
--- a/home/dot_ssh/ssh-authorized_keys.yubikey
+++ b/home/dot_ssh/ssh-authorized_keys.yubikey
@@ -1,3 +1,3 @@
-{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-authorized_keys.yubikey") -}}
+{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-authorized_keys.yubikey")) -}}
 {{   includeTemplate "secrets/ssh-authorized_keys.yubikey" | decrypt -}}
 {{ end -}}
diff --git a/home/dot_ssh/ssh-blue b/home/dot_ssh/ssh-blue
index 86398c1e..afc35483 100644
--- a/home/dot_ssh/ssh-blue
+++ b/home/dot_ssh/ssh-blue
@@ -1,3 +1,3 @@
-{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-blue") -}}
+{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-blue")) -}}
 {{   includeTemplate "secrets/ssh-blue" | decrypt -}}
 {{ end -}}
diff --git a/home/dot_ssh/ssh-fiat b/home/dot_ssh/ssh-fiat
index d4400f96..f201ebb3 100644
--- a/home/dot_ssh/ssh-fiat
+++ b/home/dot_ssh/ssh-fiat
@@ -1,3 +1,3 @@
-{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-fiat") -}}
+{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-fiat")) -}}
 {{   includeTemplate "secrets/ssh-fiat" | decrypt -}}
 {{ end -}}
diff --git a/home/dot_ssh/ssh-honda b/home/dot_ssh/ssh-honda
index d7cf8559..844a7e03 100644
--- a/home/dot_ssh/ssh-honda
+++ b/home/dot_ssh/ssh-honda
@@ -1,3 +1,3 @@
-{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-honda") -}}
+{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-honda")) -}}
 {{   includeTemplate "secrets/ssh-honda" | decrypt -}}
 {{ end -}}
diff --git a/home/dot_ssh/ssh-lab b/home/dot_ssh/ssh-lab
index 7668e250..530d1177 100644
--- a/home/dot_ssh/ssh-lab
+++ b/home/dot_ssh/ssh-lab
@@ -1,3 +1,3 @@
-{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-lab") -}}
+{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-lab")) -}}
 {{   includeTemplate "secrets/ssh-lab" | decrypt -}}
 {{ end -}}
diff --git a/home/dot_ssh/ssh-lab.pub b/home/dot_ssh/ssh-lab.pub
index 2e39af97..7ae24f6a 100644
--- a/home/dot_ssh/ssh-lab.pub
+++ b/home/dot_ssh/ssh-lab.pub
@@ -1,3 +1,3 @@
-{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-lab.pub") -}}
+{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-lab.pub")) -}}
 {{   includeTemplate "secrets/ssh-lab.pub" | decrypt -}}
 {{ end -}}
diff --git a/home/dot_ssh/ssh-mini.tmpl b/home/dot_ssh/ssh-mini.tmpl
index cc6382d5..09bd0c3c 100644
--- a/home/dot_ssh/ssh-mini.tmpl
+++ b/home/dot_ssh/ssh-mini.tmpl
@@ -1,3 +1,3 @@
-{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-mini") -}}
+{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-mini")) -}}
 {{   includeTemplate "secrets/ssh-mini" | decrypt -}}
 {{ end -}}
diff --git a/home/dot_ssh/ssh-red.tmpl b/home/dot_ssh/ssh-red.tmpl
index 63c5c054..316025cb 100644
--- a/home/dot_ssh/ssh-red.tmpl
+++ b/home/dot_ssh/ssh-red.tmpl
@@ -1,3 +1,3 @@
-{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-red") -}}
+{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-red")) -}}
 {{   includeTemplate "secrets/ssh-red" | decrypt -}}
 {{ end -}}
diff --git a/home/dot_ssh/ssh-yellow.tmpl b/home/dot_ssh/ssh-yellow.tmpl
index 5e6b1e73..e96ff8bb 100644
--- a/home/dot_ssh/ssh-yellow.tmpl
+++ b/home/dot_ssh/ssh-yellow.tmpl
@@ -1,3 +1,3 @@
-{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-yellow") -}}
+{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ssh-yellow")) -}}
 {{   includeTemplate "secrets/ssh-yellow" | decrypt -}}
 {{ end -}}