Add parameterized beszel host-token helper module

hosts/server/host.nix and hosts/nix-cache/host.nix each hand-rolled the
same sops secret/template/environmentFile wiring for the beszel agent
token, differing only in the sops file path and template name. Factor
it into modules/beszel/host-token.nix ({ name, sopsFile }) so a third
host can adopt it without copy-pasting the boilerplate again. Also
drops two dead, stale commented-out HUB_URL lines left over from
before variables.nix grew a homeDomain var.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

hosts/nix-cache/host.nix

@@ -1,19 +1,19 @@
-{ config, vars, ... }:
+{ vars, ... }:
 
 {
-  networking.hostName = vars.nixCacheHost;
+  imports = [
+    (import ../../modules/beszel/host-token.nix {
+      name = "nix-cache";
+      sopsFile = ../../secrets/nix-cache.yaml;
+    })
+  ];
 
-  sops.secrets."beszel-token".sopsFile = ../../secrets/nix-cache.yaml;
+  networking.hostName = vars.nixCacheHost;
-  sops.templates."nix-cache-beszel.env".content = ''
-    TOKEN=${config.sops.placeholder."beszel-token"}
-  '';
 
   services.beszel.agent.environment = {
     #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-    #HUB_URL = "http://docker.sweet.home:8090";
     KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
   };
-  services.beszel.agent.environmentFile = config.sops.templates."nix-cache-beszel.env".path;
 
   # Preserved from the pre-refactor `nix-cache` target — stateVersion must
   # never be bumped on an already-installed machine.

hosts/server/host.nix

@@ -1,22 +1,22 @@
-{ config, vars, ... }:
+{ vars, ... }:
 
 {
+  imports = [
+    (import ../../modules/beszel/host-token.nix {
+      name = "server";
+      sopsFile = ../../secrets/server.yaml;
+    })
+  ];
+
   networking.hostName = vars.nfsServerHost;
   networking.hostId = "6689f93e";
 
-  sops.secrets."beszel-token".sopsFile = ../../secrets/server.yaml;
-  sops.templates."server-beszel.env".content = ''
-    TOKEN=${config.sops.placeholder."beszel-token"}
-  '';
-
   services.beszel.agent.environment = {
     #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-    #HUB_URL = "http://docker.sweet.home:8090";
     KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
     EXTRA_FILESYSTEMS = "${vars.storageRoot}/docker/volumes";
     LOG_LEVEL = "debug";
   };
-  services.beszel.agent.environmentFile = config.sops.templates."server-beszel.env".path;
 
   # Preserved from the pre-refactor `server` target — stateVersion must never
   # be bumped on an already-installed machine.

modules/beszel/host-token.nix

@@ -0,0 +1,11 @@
+{ name, sopsFile }:
+
+{ config, ... }:
+
+{
+  sops.secrets."beszel-token".sopsFile = sopsFile;
+  sops.templates."${name}-beszel.env".content = ''
+    TOKEN=${config.sops.placeholder."beszel-token"}
+  '';
+  services.beszel.agent.environmentFile = config.sops.templates."${name}-beszel.env".path;
+}