Extract ports, docker host, and remote-builder keys into variables.nix

Pulls the beszel hub / PVE / PBS ports, the docker-compose host's LAN
name, and the remote-builder client SSH keys out of scattered inline
literals across modules/hosts and into variables.nix as the single
source of truth, matching the existing pattern for other cross-host
references (nixCacheHost, nfsServerHost).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

variables.nix

@@ -10,13 +10,30 @@
   # Cross-host references (LAN hostnames/users other hosts reach over the network)
   nixCacheHost = "nix-cache"; # substituter/remote-builder hostname
   nfsServerHost = "server"; # NFS export source hostname
+  dockerHost = "docker"; # docker-compose stack host
 
   remoteBuilderUser = "nixremote"; # remote builder SSH user
 
+  # Public keys authorized to SSH in as remoteBuilderUser on the nix-cache
+  # host (modules/nix-cache/server.nix) — one per client host that's allowed
+  # to use it as a distributed builder.
+  remoteBuilderAuthorizedKeys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAYIT9ormlmxZ0SziyDQaUntnKI8HK9/s3Qac1ZKjP2 root@docker"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server"
+  ];
+
   # System
   timeZone = "Australia/Brisbane";
   primaryUser = "nixos"; # main interactive user on every host
 
   # Storage
   storageRoot = "/tank"; # ZFS pool root on `server`
+
+  # Well-known ports for LAN services referenced from multiple hosts
+  beszelHubPort = 8090;
+  pveWebPort = 8006;
+  pbsWebPort = 8007;
 }