Assisted-by: GLM-5.3 via pi

diff --git a/docs/secrets.md b/docs/secrets.md
index 4452080..0b07861 100644
--- a/docs/secrets.md
+++ b/docs/secrets.md
@@ -42,13 +42,22 @@ plaintext `host_vars` files stop loading.
 ## What's in git
 
 `host_vars/.gitignore` ignores everything except the `.sops.yml` files and
-`lotus-land-story.yml`. Today the tracked files are the following:
+the whitelisted plaintext files. Today the tracked files are the following:
 
+- `legacy-of-lunatic-kingdom.sops.yml`
+- `legacy-of-lunatic-kingdom.yml`
 - `lotus-land-story.sops.yml`
 - `lotus-land-story.yml`
 - `mountain-of-faith.sops.yml`
 
-`legacy-of-lunatic-kingdom.yml` is untracked and hasn't moved to sops.
+## What loads which file
+
+`host_vars/<host>.sops.yml` is only read by the sops plugin and
+`host_vars/<host>.yml` only by `host_group_vars`, which matches exact
+`<host>.yml`/`.yaml`/`.json` names and never parses a `.sops.yml` as
+plaintext. If the same key appears in both files, the plugins' results
+deep-merge with the sops values winning — that's plugin load order, not
+documented precedence, so keep each key in exactly one file.
 
 ## Edit a secret
 
diff --git a/host_vars/.gitignore b/host_vars/.gitignore
index cffc98e..9b3699a 100644
--- a/host_vars/.gitignore
+++ b/host_vars/.gitignore
@@ -1,4 +1,5 @@
 *
 !.gitignore
 !*.sops.yml
+!legacy-of-lunatic-kingdom.yml
 !lotus-land-story.yml
diff --git a/host_vars/legacy-of-lunatic-kingdom.sops.yml b/host_vars/legacy-of-lunatic-kingdom.sops.yml
new file mode 100644
index 0000000..d7c50b4
--- /dev/null
+++ b/host_vars/legacy-of-lunatic-kingdom.sops.yml
@@ -0,0 +1,20 @@
+tailscale:
+    auth_key: ENC[AES256_GCM,data:kVdwCrpvg2vgy+ALz/1jDJ5DgeBI0IJmOylriwEyEK2eePyXq0V9wkmldY5Kl2SsC7477NoBLSDwRCU+Gw==,iv:HqBtMDqjPtkEcPnaItGlwbxT8wsVmIeQlieE6I1JR38=,tag:83OcVO9EQpoKh/8UwB+H8g==,type:str]
+syncthing:
+    user: ENC[AES256_GCM,data:zdNz0nI=,iv:7nx5Ruma/6iws2hpl472LGJukB+CqX4BbGh8XkLF4bg=,tag:DsJCZpdJJUMwh+Exqngdlg==,type:str]
+    password: ENC[AES256_GCM,data:mmGTgJO5UzVcgcFET51IzcIuP/sJ2/1LicLgNTBtE7A=,iv:vUrVGC+QS8/ueMEL5J4IS/4buUpDVXvdS+hPomTh284=,tag:wcEC9dATVr4eVbJuUzhQ/Q==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMVQ1ekFxMGwvSE5LSDF6
+            NXhYOUJxcXVrQk9nbUt5OEtjNGVvbFFwakV3CkhzYkNUb3huS2M2WFlpclZDcEJh
+            R3FJTnBKTFN4RHYybFAvSlRwV2toek0KLS0tIFdXTS83RGt3WFRpV1Z0b0hLQzlt
+            Y3MxOXhYWEtPSWJtcEtWMzU5R3hQdzAKdht0kwUDhzR5qI9MFIlIj36nN0EKZNl7
+            pgrieSNnAmw8lCeVdxB4McOSflJZgnkbjZNB2YA31vIh84WCJoTntQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age15ars55ulrp9hz6r0utvluayrglt40wv0t997njez0y9l3e43cersn6kgh7
+    lastmodified: "2026-10-15T14:10:30Z"
+    mac: ENC[AES256_GCM,data:zlYf2Y03qgl2mf3oevrmt7hhlmtj38g/UWnX0LJApdy1x5Ra3ppxJjs/RVVSktwXAR7/cslP/Aui4lbc8syqjRJkk/bEDrAzVUWKqUjooPayk0cCcHAEKshg4OnWjnX+5+7FcZIyYoSo/SjHguPGpCDB4gLR471vpkuzpUXWlv0=,iv:mzl4FRVuRNQBGHTRHpokNiLe0WGrvldfeEjZCpD3tIw=,tag:z3wf+isERu0UAsVSS2LOnQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3
diff --git a/host_vars/legacy-of-lunatic-kingdom.yml b/host_vars/legacy-of-lunatic-kingdom.yml
new file mode 100644
index 0000000..ec8af94
--- /dev/null
+++ b/host_vars/legacy-of-lunatic-kingdom.yml
@@ -0,0 +1,2 @@
+versions:
+  caddy: 2.11.7-2026.10.07 # don't forget to update caddy-kejadlen first!