diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..2f50746
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+private.nix  filter=crypt diff=crypt merge=crypt
diff --git a/hosts/Yura-PC/default.nix b/hosts/Yura-PC/default.nix
index 9e9d8be..c9ddc19 100644
--- a/hosts/Yura-PC/default.nix
+++ b/hosts/Yura-PC/default.nix
@@ -177,6 +177,7 @@
     fd
     helix
     micro
+    openssl
     ripgrep
     starship
     tealdeer
diff --git a/hosts/router/default.nix b/hosts/router/default.nix
index ffcc5b7..33492ae 100644
--- a/hosts/router/default.nix
+++ b/hosts/router/default.nix
@@ -72,10 +72,12 @@ in
     lsof
     micro
     mpv
+    openssl
     ripgrep
     rustscan
     starship
     tealdeer
+    transcrypt
     waypipe
     whois
   ];
diff --git a/hosts/router/private.nix b/hosts/router/private.nix
new file mode 100644
index 0000000..0e12302
--- /dev/null
+++ b/hosts/router/private.nix
@@ -0,0 +1,2 @@
+U2FsdGVkX1/98w32OE1ppwT0I5A3UOTKCLJfvk+TQdrbf0TLfYNZ9TC9n8cH2hC9
+ObKVuFlOLwHlzeBy7MXaLg==
diff --git a/hosts/router/vars.nix b/hosts/router/vars.nix
index 10b4237..cf6e7ec 100644
--- a/hosts/router/vars.nix
+++ b/hosts/router/vars.nix
@@ -1,4 +1,6 @@
 let
+  private = import ./private.nix;
+
   mkIfConfig = {
     name_,
     domain_,
@@ -43,7 +45,7 @@ rec {
   };
 
   p4 = "10.17";                      # .0.0/16
-  pdFromWan = "";  # ::/60
+  pdFromWan = private.pdFromWan;  # ::/60
   ulaPrefix = "fdab:07d3:581d";      # ::/48
   ifs = rec {
     wan = rec {
diff --git a/hosts/vm/default.nix b/hosts/vm/default.nix
index 26d642f..653ad22 100644
--- a/hosts/vm/default.nix
+++ b/hosts/vm/default.nix
@@ -95,9 +95,11 @@
     ldns
     micro
     mpv
+    openssl
     ripgrep
     starship
     tealdeer
+    transcrypt
     waypipe
     whois
     zfs