Design and page updates

.env.prod.enc

@@ -1,38 +1,38 @@
-#ENC[AES256_GCM,data:TS4j3twMFoZh,iv:67VeU7kyhgPK0TptCh60HYxLTe56pK2862zEboOr26M=,tag:4JiTyCGuL3fqU7LlqtYzkA==,type:comment]
-DATABASE_URL=ENC[AES256_GCM,data:9c2V8Ezkdb4sXC+mrz6BhrtesdQ7pnA5PjrffBIRBHNfPSkZft1HrIGAEvgde25jFeXt1Ck=,iv:LSzvRX/PSto7ROQ5TXCM3G5pg/Qm2RiQnX1ZOw2Gc3Y=,tag:OkYD9v2+pZpQBNQay1Cxyg==,type:str]
-SESSION_SECRET=ENC[AES256_GCM,data:W2tBSuCsF69dFbX+uYYa/5H6KKnVWYl3Bibez0btM8g=,iv:DE3NdgXvRJbd6Xvnu9ZVCmOhzbANvvw9X/DkcZAGGHw=,tag:gs+2u6AmFGISNW+3mCjSLQ==,type:str]
-PORT=ENC[AES256_GCM,data:ZbjWrQ==,iv:LNymntIzDLZO3Y4+ROk0StHRoD73LP5ympAFIeihC9s=,tag:PiiFCezINAJjqOAyOFM8Rg==,type:str]
-#ENC[AES256_GCM,data:T5oV,iv:rsC4Pk0F4XQ2lVXl+mKL+hrnBYQAMuWuaJPgvfleXPg=,tag:eC85ejuc/0YgfrrtIxCXSA==,type:comment]
-S3_BUCKET=ENC[AES256_GCM,data:uguPyh8NpEh5UQtgeBBd,iv:trAHyJZ0JDG4d4G2mudHLcvsq3Mimlw+GnGvf4DrbmU=,tag:Cs1RVRextKulmyknzr6qYg==,type:str]
-S3_ENDPOINT=ENC[AES256_GCM,data:XmbQiGK/QP7SEazjUrAZWX0daHnXNWNmWqzbSzh5goFBkR62aKB9IefC8wtQ9NTySQlNv+kuisVOHQJ8/SFvVx4=,iv:AIur7LSlRhHwcPYnuasW89dt/Zr6I/qtmwVJfy3gHdE=,tag:IuTmLbTUmIw8fKm2xCKXiQ==,type:str]
-S3_ACCESS_KEY=ENC[AES256_GCM,data:3pnGOvtCorluqErK6kZtUz7cYJQaUsJgl2X7mqZDgg0=,iv:L2D4WRE45Q2L7S6WY0tffaS9KRqNTvXZLtwJMU6tHSw=,tag:ZOpEFvpihR0tcsQ4WVSDsg==,type:str]
-S3_SECRET_KEY=ENC[AES256_GCM,data:e+wGR1nZbyDZ8J/inqOooffPYlFHxa7mS1XujmP45LZx704GIs6RLZ4v1WPkjuoq1NoGV3HPe3gk5u2vU3vz5w==,iv:6TtKzHjhQG5xCnhLFPmp/CEIlBGB6sZIEkDjeIU+OWE=,tag:O0biF8VDHRYz7YBy2OgDAg==,type:str]
-CF_ACCOUNT_ID=ENC[AES256_GCM,data:OO7KrYgpLwbj/VWx+6bSCL4qo7LhjcjNPFQfl0Gg0KA=,iv:h1vVwXbxdRBbU+FbGpdZrbFarKdYzDn+aUS8fvLhyyc=,tag:y80M9a7h45UIrCFDO8h/Ow==,type:str]
-CF_API_TOKEN=ENC[AES256_GCM,data:iJdQyRQScMxcrcU4CEQgW7+qKWmb7s93QRcYgh291Qzf3NC59ExxnOpBU++ZV6LFWjUDdUU=,iv:xztI5eMbEk1WNw3o9zrjbi8jJ8NtAuMJl9FbWTUsaTE=,tag:1lOSYrww6hZ/WjWzSTW04Q==,type:str]
-ARK_DEFAULT_NAAN=ENC[AES256_GCM,data:8xsRwK8=,iv:tCaPuOCVI5aoxnwxTKa7OMqGFQD+W8ll76Q8Srw9gt4=,tag:C03OWlm2jOOcSrCGNn2whA==,type:str]
-#ENC[AES256_GCM,data:+BWEFM6L6aD1rMG+g/Fypx73,iv:7ez6bhjdrh4suF7FnzeqbV9YaGWQjdzHwrg5C12POdA=,tag:lPwrgKv9U94oei4l9wnPsg==,type:comment]
-UNDERLAY_UPSTREAM_API_KEY=ENC[AES256_GCM,data:gg8Fm3ngcXfMSqnravyzd4F7nVaOfjF0kLq6akC4c41pqoc=,iv:3tjfQSU3RoapeTpZ/26b/cRyXEET1/plU/zAAZqBUek=,tag:SchlwcyYhcStKabyhHXHsA==,type:str]
-DEPLOY_HOST=ENC[AES256_GCM,data:R3wMJvEgnZLS2sUzJQ==,iv:ILujgHggz/XnjDQajRC5UPSdiKWGPqDtpG7MxbfycBI=,tag:gjmxSKYwdxKt0PZzoxE5Uw==,type:str]
-#ENC[AES256_GCM,data:kYe5O3MvtkE=,iv:SsygxrvIPlPYGwdmgghhWQEmhYXfHTqjYEcqQBwdBn8=,tag:c7IPDL4NUvHDY/HvALw4Qg==,type:comment]
-OIDC_ISSUER_URL=ENC[AES256_GCM,data:6EoGyzM6mMjE7gkG2VHCmf7wjfoUAebL2xNX2b4AlohZ,iv:J9UCzieBnS67x1SF99LQxNXRFtXnzAsx/nKgHZAsEtg=,tag:aXKXAXOhWUiqts1j/85y1A==,type:str]
-OIDC_CLIENT_ID=ENC[AES256_GCM,data:YJZQDDDbW3SCUsw=,iv:i02lGIh0O1Ni0pnQzFQwdA4yGW7DMaGBern62zEurdc=,tag:HyQbPDlIRPkodn9mMixrgw==,type:str]
-OIDC_CLIENT_SECRET=ENC[AES256_GCM,data:CKbYqzPEHYnffkosxGMzbaUQrjmAr1mbpkEObM/COucG+nr35sJ0eZCVUgq9rh4fSXh7XX8R5MUGrjSamTZBtg==,iv:2JwORSKnfi+7apoQKkxYAxwBK0WjWLSADDowRExcRik=,tag:AYwc/V95qREMocDAo7cMSA==,type:str]
-AUTH_INTERNAL_API_KEY=ENC[AES256_GCM,data:T80WuhiPSGm1FMNsvrM+4wRINOSvxhxoVMXeybBOjiNrKb4V6PxX54R3rweyqe2AJNdYlv2zaiQVYX3C3cvQ9Q==,iv:ycYFuwUGrSJGXw9gwxWQrG4Xj1DZfBW0SoUaBRopBAo=,tag:+FZQLFaWnwQSBZQUynAwxw==,type:str]
-OIDC_ACCOUNT_URL=ENC[AES256_GCM,data:bqv5vgziTgy55XFOdtYm+qPzmFNrs7Xn4kTxCPzcHy7ikbSJ,iv:+9jMnI8mQgZm9c2+5BQCpO8fkOdDoXj/4WifPjH8LHE=,tag:1fHxiv8ST6DOYCnw2kWn3g==,type:str]
-APP_URL=ENC[AES256_GCM,data:GgfRNwfNJ7O3mCanfl+EyvDT8bqH/qE=,iv:4soW9wM1vyXRMWSSU9ZuGKwwXWr0/BNQt9eU+K7Ahjc=,tag:PfFGv8qnIOufUXfORF5D3w==,type:str]
-sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGN01qQVdQTHlHcWJHbHNI\nUXVnaE1EcEUxRG12UGx4YTU3SmdBUmhuYmwwClkvaUZHelB6a1FTQ1YrbzJia2dR\nRkRaQUJJejhMeUJLMnpqUmRTTVBBbm8KLS0tIFZmNkcrTWVZUnpaMGU2N3VsOVc2\nNTYxemxzQmxxbDhDeTQybnRxd0NrQzgK6AwczPTgFWItfLq6+jc3d8AwHBJ6UfOo\nnJoEcNu1hjcXWxb3PLeEVer9ICR1VcYBZEtyOZ1dPKgb3OLOjTym7g==\n-----END AGE ENCRYPTED FILE-----\n
+#ENC[AES256_GCM,data:O+nchjkaQ9wK,iv:c0fbl/PM6wnYbj+HDT4d8mOuHCq9VngfpJsxQqYrmt4=,tag:mGQWYUJh0wZFcUcWS57f+Q==,type:comment]
+DATABASE_URL=ENC[AES256_GCM,data:nC9pqB4zDScCNkW/QdgTcvF19uhmuZm8WtrmQ0AtGO2vHaevdDx8EUAAuLF5hQWmGfW6LFQ=,iv:xo5W+yttEazn8AckWFnc9IoALdQ8uRM6TS/GFLrVNiQ=,tag:sjmfGbyejGCZDGxOxz+oBg==,type:str]
+SESSION_SECRET=ENC[AES256_GCM,data:AfAiynfkB7KFNpcs13IwUULNR4uJNvSA1sRcimBdXxe+k7rcozMk83fD/lMgNLclv8wv2qQ3EIKs/+Ar6UlB3g==,iv:CUtywxHxGTANbpPsoebYLWoWaUMnuuHThxxQdUnEaEY=,tag:Kpm2rU+4BmKCy6h05bPq5A==,type:str]
+PORT=ENC[AES256_GCM,data:EVfPrw==,iv:YI4epRUkR0+1ejKcBIja+CrPu/HuCjgeg8mN4djU4+0=,tag:JVlgeXZ4x6gSOWAdjO8/lQ==,type:str]
+#ENC[AES256_GCM,data:+sXw,iv:jL1yf95M/jAyYcPcJagLa7gAURDw3HdhPQ8lAmY5AN4=,tag:5D9nLPujVjks9fCqieYbZg==,type:comment]
+S3_BUCKET=ENC[AES256_GCM,data:4vG/sXkvLEKbq88Sd9/K,iv:T7tyAHgcMeFP7BvW9Xbq5nRUtw4imj4+qZLWDe6QhuM=,tag:P3dlKD6FMP0MBQTUz1HwIQ==,type:str]
+S3_ENDPOINT=ENC[AES256_GCM,data:mbSEK3wkiUuxg3ETQtVIg8fLfODrc0QFjl1WX0x1YFHu9md1T5/Yn7ibq1QaOI1db3okrwnBTBn6tEmgU5QSWjg=,iv:4j9Q1fquwwcCeCC6kyOf7ZkfRDxanBrDnC7CVVlavrU=,tag:Tt8fsgbzn/DBaoA9Vn/IYw==,type:str]
+S3_ACCESS_KEY=ENC[AES256_GCM,data:A+prb2tXs2GMeIDYRY3+bcSdn12JoSZ77QHeXQIXKYI=,iv:7Nix4bEZh/uSRNJDiDE0oiYJFZ/tGTBSi0Nn7+ZL6NU=,tag:E1RpsL61fnXaC5C02KZbZQ==,type:str]
+S3_SECRET_KEY=ENC[AES256_GCM,data:cyRoknQkJi5xabRdE1NovpibJJFpIb0JQsX00Jrd/2m7kRrbu056KqWdW+QXcVNdokXunbz1wTP+3dyP8DgwhQ==,iv:wXh6W76thveWGu0Iq2Fe9cxJJrMRzrpg/4cGWGC/8ro=,tag:kXn7sCPU04LYuOSWz78+rg==,type:str]
+CF_ACCOUNT_ID=ENC[AES256_GCM,data:FHIDA3WRC7/t+NHQgGqULG6a5xI+A+e4pPeMz5ZvbMs=,iv:1Vk0BSWIqZGhA5og0nVGxZDFI4ylEm+XuzxbGltwpLA=,tag:kAUpABomnLzd3VKWR7/R4g==,type:str]
+CF_API_TOKEN=ENC[AES256_GCM,data:bB4adE2h8VyRDzv6kXpBa0IoCiRY3aMWYAMtHeWYxjZbyMuvyeGfeoX4symD05H4BCm1oDs=,iv:hVwnSPZjjIDbOnaUN8ggbWuQ7PqrxzzpSiaTospY5Qc=,tag:HwoZBW1cehaPDcHwzVKAXw==,type:str]
+ARK_DEFAULT_NAAN=ENC[AES256_GCM,data:TzSzgMI=,iv:aue3Wv7kPd7d1U745YalEjV//rTq0BtzYXzPOJPfync=,tag:sgbJapnwMSaNaxlXXmPBEA==,type:str]
+#ENC[AES256_GCM,data:bm0c2TWxwFykuTIMW/2YLesr,iv:H1vQLauzzMMGndOsh2AHIhNAlH2VV+FlN0l7bOjv5SY=,tag:8hvh877Rl0zh1FeL0kDxDQ==,type:comment]
+UNDERLAY_UPSTREAM_API_KEY=ENC[AES256_GCM,data:gHG8XChBFKsZwySUsIsmbwmRqPCOj5dJ4Rj0mu1i1Iuz0Cw=,iv:WCPG3HIUrraUdaLUZ/EotGbpcXTtkncWYA4KBck/QqU=,tag:CknwtSknBCNmQIrzdjQaVw==,type:str]
+DEPLOY_HOST=ENC[AES256_GCM,data:LAyqgvv86wbjaZfI1w==,iv:Bo647hzSqyvJDQ+r1zWjWEWY5PQ1yXd396rIaZzLC+g=,tag:qCiRHP9gUpn3bf4AWYs/Og==,type:str]
+#ENC[AES256_GCM,data:YQpq1XCNqmk=,iv:mhg6Kldq246GC5Qh0peXp7xOOa7LjCpaGauBkzIrP3A=,tag:rmMCKHxrEX3SByAnBJh+UA==,type:comment]
+OIDC_ISSUER_URL=ENC[AES256_GCM,data:Wi31C6exKWScoJpohcQ9FVnNIB0RwPczf6XNt+5skQaO,iv:ZFRHNXVBuNBJkrLoePKPpQB+awzWvKPrujcuF9uc0lY=,tag:hAikIZJTvfRriZ3JecVaew==,type:str]
+OIDC_CLIENT_ID=ENC[AES256_GCM,data:8tjJVzF7aH796rw=,iv:od+vi7jOtMjBe8oFZqtuODNeQS7QISxMJMUd/X9yrJA=,tag:upZ0nyb1pNTYEsy1lNEOjQ==,type:str]
+OIDC_CLIENT_SECRET=ENC[AES256_GCM,data:51ggvZnGCb568LUFmXvp15pRo52yKUwxc8VVoaM2AYUdikxsinkUvL1FsESfO9j4a6cTaxMIZUkUhQ6nNNQAXQ==,iv:8wVy9lJZhe+3u9rPf6lcDIS1JnkyNxUGt6bq17TIhyY=,tag:gtBQie5BFm2sgPlbYpBvCQ==,type:str]
+AUTH_INTERNAL_API_KEY=ENC[AES256_GCM,data:Eqt1KQyxlZ4JEMN1RBdcwzogqQ6eyUEljj6FFIULjQ1wV5tE1ZgxrOKp4inyx1Mfdz6kpKhf8nH/vX3S4P9xJg==,iv:L4VBSArsYDoPmQHDi7Mo4qjItJlV8AdfTaP097y4laQ=,tag:oEuGjoPRE5BUNxmO+lpjqA==,type:str]
+OIDC_ACCOUNT_URL=ENC[AES256_GCM,data:joXmwqCkLkvlF/2tDN0i03R1vzcseoskA+eznd9PGzKiwnyI,iv:ibZJXcxCKIm185jIg42p8sk0q2Y0GvCJi4FKfrICYK4=,tag:i6ny1ZdCRsaqNil+CX76Lg==,type:str]
+APP_URL=ENC[AES256_GCM,data:0Cc7cFdS5esZGYQXPISblLRNuvIvBe1r,iv:nmjOnMgLcojCOElb7ZT97NZO4YAOWoQB2fxOzwm8Vgw=,tag:IqFinV59tu8kaTfR0Tj5DA==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOVmpOUHpjV1AvbDY0eVpZ\nV3htMzB6SU43eHRtNDlmUW92NjR0Yk5CWVdFCmxzRDNZQXFLY3hMVXQ4WkFwNWtD\nYmx0STY5QjgzeUlYL0xpcnlKRmk2UXMKLS0tIGpuQ29QaVdPSFM1bktBb3VnbHI0\naVBSeGViSWRFcHE5VHF3UVFoK2E4WGMKo0o66lKkVKBrw5QAvZRjplj4ySIdn021\nS494v7X+emlBKfDCD4XHnSfyktgitSu5KTDVaeViix+EeiXLfsDeAQ==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_0__map_recipient=age1wravpjmed26772xfjhawmnsnc4933htapg6y5xseqml0jdv8z9hqemzhcr
-sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjWEN5L1BtRloyWHNzZklN\nL05uazJLTWRGS0pXQVMvQU5kd1p6K0RDQVM0ClJBd0lsQ1N4bmp0OTMwRmpNQXAr\ndTd1ZEZqaFhoYzU2RzRYN1Y0aHNXSEkKLS0tIG1uMDZvRWF3VnN3ZXZwb1VwVGNm\nMmd6TmxxeUkxdi9CQkQ4Wm5qQVVya2MK9TRB9XCAtavdWC+rQnGd9MAfn4KenAQI\nludEN39eo296ZzAUE6WJ5/7y4U4CcpCyKBPILKdCjpeNRYQ6pmR8wg==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHZGI0NnpoY3VrelFrZjZw\nWStqK2VIU0NPMGs3Mk8ySU5uQS9saVFmQ0JFCnkvZjczWkQvKzdFdG5lTThyNTJr\nbGd0dzVsZlp5U0M4ZG92TUtteXFSR00KLS0tIGY0OGJteHBjN1A3MkV0aGpUS3M3\nRXZYbng1MVVITXJEQ0lpY1lJdllLa2MKHzX1gXYmdiMyid18xDUtdk8jej7DYG4W\nwbum7nH+/KmJbCS0NZDIpPkAUmDth1AZUUnFujMqtkLZ7YNChWmIAg==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_1__map_recipient=age1ysddqggsx3h8zkv7xn3z26sjak5pqms6pyqhnky9ukrvpk7es5jsayz8w7
-sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCcCtkYTNvUm51TmV2YWZ1\nRitKQkw2RUJwdkltYlhvUWpNazI5TUJwcnpjCjNrTms3ZFVXUGhlaXBlamRETXBE\nN0Vud20wbU1FUXNmQVp5YnFVZncwalkKLS0tIDdPQk5KbUo4ZmRpa1AzWk9pRlFB\nNU8zN3lLRnNpQ3RMRnBXWGlOTTBWQzQKXtQDtLS0TNZiW46EsrW6tnbxXc773oMW\nH8BWDxRavEpiRyqkH1EKjEBzTA3xKfwaG3RT6d6tUY6g9PnuL0BkoA==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDSkl2eVJXV3FGMkZ2S1c4\nOGlneUdERTFCTkJpTE92WVBXWW5qR2RLTkRRCmFxTkVlMVJ3RDk3N0VQb2ZuV0Qy\nYmlvcDdNei9mdUQxcnhjdXgxYWtBem8KLS0tIFJ0WkRDM25nL04wNFpCOTVMZFpN\ncWNlTTdFNXEvQzE4b1VaY3IyUVIyTmcKtk/miVOnklKdwunwSK3teaU2zVQzFOjW\n0e5FEBfMfs4Th840y62f594v6z8/rRnYeH6vYEk4Tj0Rjr2ISIqXGQ==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_2__map_recipient=age1pgxk292zq30wafwg03gge7hu5dlu3h7yfldp2y8kqekfaljjky7s752uwy
-sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvbU9wVnlZUjBDQTVQT21i\ndU01TTEvUzlPTzZGMFVwc0M1bkkvNUU0YkNvCm91NHdGWTVvU1JaOWRmQVJ3cHBo\nMXdmc0syVncvZzNKMlBCbHJDdm5ZblEKLS0tIE5lOWJvMDhyM01VbU0wbGNEc2xI\nVkZrbER1LzhWQ2swS0ZTV1FiWGx3K0EKIoezkGxEUfWDjlkeAnKH20UxsDFQJ+1b\nzdcghmt6gnzIxR3FWSCFHHKAzfi3rL8QlkW3Ro5UBoAEEDWy7nvz2w==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQQUNGd0daLzFsYVFiMGhk\nY1dJMHZQcjBqTTVpM29XS1NnbmdEMnUzNUZvCnh0bDFIcWtWWGdvRGhOV0RTdkY2\nTkVPTENGeUdjb0d2TjRxVXVxd04wbVUKLS0tIGdWRGFZTU5tWU1nbEd5Zkl5anVr\naUhuWTRhRURCZDYySkczSUJaRFozUkkKzkr5HK5nmEsLcCLmSEILCAlE/773tboY\nS8ZuKoHds2NmWrZGDbodwVD7kYQ9l89rQa4WTjrgFwprOayp7e/P1g==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_3__map_recipient=age1qn0x93jhqjpqwvx5tgxnrwq5e3vuzur9whrkdnrvapd58esm45rqfkuxqh
-sops_age__list_4__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWU1drSWRUbEVYSVNUTzFy\nM1JJbSthM3VpU1Y0ejgzbjNUSEhYMENGRUNZCmowZE13TUtYclVmMS9VenBVQXp0\nd09hM0lsa01Cd0lzTDlCRDduOWd0aFEKLS0tIHI0M0xOSFhndW5XdUJJV3cwV09X\nWUx4T05INWRvU01OU3UwSUFxcC9nM00Keb2AeDtqamChWI3PAYxLDT3qZhmCf8Q9\nZi8Qe6LJ6a8C6wsFN+auPy7bIJdmVYcfoHFgsRVdyEXx9bcj1+hIGg==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_4__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwbnFuZ2JKbFpZalRWeUQ0\nbkJKZk1IVkovOW5jLzdUSzNkRmVQeHpNeGs0ClcwcnZFWGpiQWpIT0N6bnRkQXlx\nWDVPUUJ6cDRyckNxL3J0UXAxVUdnL1kKLS0tIHFVN0pzVXVUUUREOW0ycndoUVV5\nWUJNblhoa2ZOU0VoTGFoZzZGRlZwVW8K30qpBsvJHwWeLiiNTb0Yn41mkr2GZo58\nlSn9w97P9+vsK98izcZhSEp5CSJDQEH67ltCcR1LUuGNc2ILRphX6g==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_4__map_recipient=age1h86dek80u5t677tsparz395uk3zvz4yuj9m5t2v2nsdfsvyjmafsra5yt7
-sops_age__list_5__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSclNPdDJGeWlCSzJtQi92\nYVlaVFhGd2krM2J1VEVqVSt0REJwRnI2ZmlJClBzTCtSZFBvMWdBcU1IeXFzaThz\nMFRCazJmTFQ4WkNPRU5xU0VqOEJZbkUKLS0tIFF5eitRekJUSDBhZmhsZHpMdHpi\nK0N4L1FqazJOVUNYaUIxL0dMMm9kZjgKr3PaMpDWqnt0J3yMZxuD0hvCVDnSuX+G\nhSSLmO0gaXuiw2/m7ehzkTtcl8BlN6o8iVPfdbA09lOAl0U9vOPSaA==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_5__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYUVN1OFRMQlFuT05IbnVx\nZitFblpoenNEQ1lBSjUrbWhqVXN4TVU5SXhFClh1WnptaUNiQjVNMXdRVkVvS09m\nbkoxRkI4MHNGajRxNnpwZ1FCV3ZXb28KLS0tIHBnaTBXUUcyQlB5WWpBaDY0MVA5\na0Jjd2xpMDhOeG9EVzUxRUl5KythOUEKENX9NZo03ACFxom+yNFyf3Ywzvxc92w9\nwSodCz2+yJiTbFlInSj8bmNy2tsTI5KKfTEl2Qh58uTQXDTMCotWRg==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_5__map_recipient=age1vfhyk6wmt993dezz5wjf6n3ynkd6xptv2dr0qdl6kmttev9lh5dsfjfs3h
-sops_lastmodified=2026-05-20T17:24:41Z
-sops_mac=ENC[AES256_GCM,data:JUtXxPbs16EWlzLgiPArQMZWlIhixP9KQyBnHSW9vAbApSzop+MCAhVcBXrbBsozhn+EPej+br3r3zfAjR9gof+lSh1WBqSKkAw9sR1gMcfV8T4eOKVk7nCUZRuKVhoSHyDvAv6gJZF0LKhvwBc1TR0A4msZaecDDG5jNSaMsDw=,iv:RbmNhPgiPozA3WGpZAqk5xTMhuFtSOk2bsbollKT174=,tag:UTGqsTB8uMcMV7esNHQS3w==,type:str]
+sops_lastmodified=2026-06-12T03:40:05Z
+sops_mac=ENC[AES256_GCM,data:z6RsG4cEMF0LmGGRCYgrMTYn0plJMbSitgTqOKY5xumVOagyWpzH1RF8rTknRj/91QdecWmso0fISkHnDyFO/vPYixKY54eaYMPVTlLCrUH3Ywqyd00z5KxKIQqQWtQR/z/PFP+K65Wl4i/NmP2Mx5WCGIjszT2T+SwkfxZcjJQ=,iv:c16LMsP/cf09kzz9e6WFZ3PCA3DHlGfqPze0ojqMZew=,tag:5aR1cM6kOR8X0ebv2ebHXA==,type:str]
 sops_unencrypted_suffix=_unencrypted
 sops_version=3.11.0

README.md

@@ -207,11 +207,11 @@ tools/
 
 The protocol and the platform are documented together:
 
-| Resource      | URL                                                            | Purpose                                                             |
-| ------------- | -------------------------------------------------------------- | ------------------------------------------------------------------- |
-| Protocol spec | [/protocol](https://underlay.org/protocol)                     | Full protocol: data model, hashing, push, pull, provenance, privacy |
-| User docs     | [/docs](https://underlay.org/docs)                             | Concepts, integration guide, API reference, quickstart              |
-| llms.txt      | [/llms.txt](https://underlay.org/llms.txt)                     | Machine-readable API docs for LLMs and bots                         |
+| Resource      | URL                                        | Purpose                                                             |
+| ------------- | ------------------------------------------ | ------------------------------------------------------------------- |
+| Protocol spec | [/protocol](https://underlay.org/protocol) | Full protocol: data model, hashing, push, pull, provenance, privacy |
+| User docs     | [/docs](https://underlay.org/docs)         | Concepts, integration guide, API reference, quickstart              |
+| llms.txt      | [/llms.txt](https://underlay.org/llms.txt) | Machine-readable API docs for LLMs and bots                         |
 
 ### Key API endpoints
 
@@ -329,19 +329,28 @@ Required GitHub secrets: `SSH_PRIVATE_KEY`, `SSH_USER`, `GHCR_USER`, `GHCR_TOKEN
 | ----------------------------- | ---------------------------------------------- |
 | `docker-compose.yml`          | Deployed stacks (prod & dev via Swarm)         |
 | `docker-compose.local.yml`    | Local development (source-mounted, hot reload) |
-| `docker-compose.withauth.yml` | Self-hosted: app + bundled KF Auth stack       |
+| `docker-compose.withauth.yml` | Self-hosted: app + KF Auth + MinIO + Caddy     |
 
 ### Self-Hosting
 
 Run the Underlay with a bundled auth server (no external auth provider needed):
 
 ```bash
-DOMAIN=https://my-instance.com docker compose -f docker-compose.withauth.yml up
+DOMAIN=https://my-instance.com docker compose -f docker-compose.withauth.yml up -d
 ```
 
-This starts Postgres, KF Auth (auth + account), the Underlay app, and Caddy with TLS. On first boot, secrets are auto-generated. Set `SMTP_*` vars for email delivery.
+This starts Postgres, KF Auth (auth + account), MinIO (S3-compatible storage), the Underlay app, and Caddy with automatic TLS. On first boot, an init container auto-generates all secrets (session keys, OAuth client credentials, S3 credentials).
 
-Supporting files live in `selfhost/` (Caddyfile, Postgres init script).
+Optional configuration (via environment variables or `.env` file):
+
+- `SMTP_*` vars for email delivery (password resets, invitations)
+- `GITHUB_CLIENT_ID`/`GITHUB_CLIENT_SECRET` for GitHub login
+- `GOOGLE_CLIENT_ID`/`GOOGLE_CLIENT_SECRET` for Google login
+- `ORCID_CLIENT_ID`/`ORCID_CLIENT_SECRET` for ORCID login
+
+To use external S3 (AWS, Cloudflare R2, etc.) instead of bundled MinIO, remove the `minio` and `minio-init` services and set `S3_BUCKET`, `S3_REGION`, `S3_ENDPOINT`, `S3_ACCESS_KEY`, `S3_SECRET_KEY` in the app environment.
+
+Supporting files live in `selfhost/` (Caddyfile, Postgres init script). See [/docs/self-host](https://underlay.org/docs/self-host) for full details.
 
 ## Environment Variables