Migrate live secrets to sops-nix (Milestone 2)

Audited the working tree and full git history for committed secrets (gitleaks + trufflehog + manual grep, see secrets-inventory.md, kept local/gitignored per the spec). Found: a password hash shared by root and the nixos user across every host, two live Beszel monitoring tokens, and a GitHub fine-grained PAT embedded in a home-manager nix.conf. Migrates all of them to sops-nix: - .sops.yaml + secrets/*.yaml, encrypted for admin + the age keys derived (via ssh-to-age) from each live host's existing SSH host key — no new key material transferred to any machine. - users.users.{root,nixos}.hashedPasswordFile replaces the inline hashedPassword shared by every target. - The GitHub PAT moves from a home-manager-managed, store-visible nix.conf to a sops.templates-rendered file included via nix.conf's native !include, system-wide instead of per-user. - Beszel TOKEN moves from `environment` (store-visible) to `environmentFile` (runtime-only via sops.templates); the dead commented-out docker token is removed from the tree entirely. Added a tracked pre-commit hook (gitleaks protect --staged, wired via core.hooksPath) so a secret can't be committed by accident again, and documented the sops workflow in README.md. Structural verification only: all 17 flake targets evaluate, and `nix build --dry-run --no-link` succeeds for the three currently deployed hosts. Per CLAUDE.md, actual `nixos-rebuild switch` — the step that confirms secrets decrypt and services start on a real machine — is left for manual verification. Git history still contains the original plaintext secrets; scrubbing history (Milestone 3) and rotating every credential (Milestone 4) are separate, deliberately gated steps per remove-sensetive-info-refactor.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Refactor flake targets into platform x build-type matrix
2026-07-19 12:46:39 +10:00 · 2026-07-19 12:03:33 +10:00 · 2026-07-19 09:48:05 +10:00 · 2026-07-19 06:27:22 +10:00 · 2026-07-18 08:14:39 +10:00 · 2026-07-18 07:52:30 +10:00
59 changed files with 563 additions and 1425 deletions
@@ -6,9 +6,9 @@ result-*
 # Ignore automatically generated direnv output
 .direnv

-# Locally-generated SSH host keys staged for transfer to a new machine
-# during install (see scripts/prepare-host-key.sh) — never commit these.
-host-keys/
+auto-installer/flake.lock
+auto-installer/result
+auto-installer/nixos-auto.iso

 # Temporary Milestone 1 audit checklist (remove-sensetive-info-refactor.md)
 # - working notes only, never committed, deleted once every row is rotated.
@@ -3,9 +3,6 @@ keys:
  - &docker age19gfn2yedg76dmztm4hncr7vf3r3c9j0qpt4rap7y7gersjk4m3ks2lhd0e
  - &server age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
  - &nix-cache age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
-  - &lxc-minimal age1qz9d4ka4xgexujyd247s7lp737sulp5fhxl5d65fj2ykvc4j4edqrsdks8
-  - &nix-minimal age120whqj96g26lsgy4udvgsn8dc9lumh8jeu3a564fx79rjr5lxffqmrljuu
-  - &lxc-nix-cache age164px2a8e48ptsf9ngtan38aa6jls4jdl26mzrgzf6sn3vcvt49hqjrgr8w

 creation_rules:
  # Shared across every currently-deployed host: root/nixos password hash,
@@ -19,16 +16,12 @@ creation_rules:
          - *docker
          - *server
          - *nix-cache
-          - *lxc-minimal
-          - *nix-minimal
-          - *lxc-nix-cache

  - path_regex: secrets/nix-cache\.yaml$
    key_groups:
      - age:
          - *admin
          - *nix-cache
-          - *lxc-nix-cache

  - path_regex: secrets/server\.yaml$
    key_groups:
@@ -52,76 +52,56 @@ There is no test suite — "correctness" here means the flake evaluates and

 ## Architecture

-`flake.nix` is the single entry point. It generates one
-`nixosConfigurations.<platform>-<buildtype>` attribute per target via the
-`mkTarget` function, composed from:
+`flake.nix` is the single entry point. It defines one `nixosConfigurations.<host>`
+attribute per machine, each built the same way:

 ```
 nixosSystem {
  modules = [
    disko.nixosModules.disko
-    sops-nix.nixosModules.sops
-    ./modules/common/configuration.nix
-    ./modules/platforms/${platform}.nix        # what it runs on
-    ./modules/build-types/${buildType}.nix     # what it's for
-    hostPath                                   # hosts/<name>/host.nix — per-machine identity
+    ./hosts/<host>/configuration.nix        # host-specific config
+    ./modules/hardware-configuration/vm/<proxmox|linode>.nix
    home-manager.nixosModules.home-manager { ... }
-  ] ++ (client-only modules, for every buildType except "nix-cache" itself)
+  ];
 }
 ```

-Platforms: `linode`, `proxmox`, `lxc`. Build types: `minimal`, `nix-cache`,
-`server`, `docker`, `gui`, `pxe-boot`. Not every combination is built — e.g.
-`pxe-boot` has no `linode` variant (PXE/DHCP/TFTP need LAN L2 adjacency a
-Linode VPS doesn't have). Treat `flake.nix`'s `generatedTargets` as the source
-of truth for which hosts exist — `README.md`, `AGENTS.md`,
+Hosts currently defined in `flake.nix`: `nixos`, `docker`, `server`,
+`nix-cache`, `nix-minimal`, `pxe-boot`, `linode-minimal`. Treat `flake.nix` as
+the source of truth for which hosts exist — `README.md`, `AGENTS.md`,
 `docs/flake-lock-automation.md`, and the CI eval workflows
 (`.github/workflows/check-nixos.yml`, `.gitea/workflows/check-nixos.yml`) list
-hosts by hand (or, for the CI workflows, evaluate the flake dynamically) and
-can drift from it, so re-check them against `flake.nix` when adding or
-removing a host.
+hosts by hand and can drift from it, so re-check them against `flake.nix` when
+adding or removing a host.

 ### Composition pattern

- `hosts/<name>/host.nix` — per-machine identity **only**: hostname, hostId,
-  per-machine secrets, `system.stateVersion`. These files carry no `imports`
-  of their own beyond narrow parameterized helpers (see
-  `modules/beszel/host-token.nix` below) — all shared behavior comes from the
-  platform/build-type modules composed in `flake.nix`, not from the host file.
- `modules/platforms/{linode,proxmox,lxc}.nix` — platform-specific config:
-  boot method, guest tooling, and (for linode/proxmox) the hypervisor-specific
-  hardware config, imported directly by the platform module itself
-  (`../hardware-configuration/vm/{proxmox,linode}.nix`) — **not** wired in
-  from `flake.nix`. `lxc.nix` has no hardware-configuration counterpart since
-  containers share the host kernel.
- `modules/build-types/*.nix` — what a system is for:
-  minimal/server/docker/gui/pxe-boot/nix-cache.
- `modules/common/configuration.nix` — base NixOS config imported by every
-  host: locale, users, nix settings, git.
- `modules/common/home.nix` / `hosts/nixos/home.nix` — Home Manager config for
-  the `nixos` user; the `nixos` workstation (`gui` build type) has its own,
-  other hosts share `modules/common/home.nix`.
+Every host's real configuration lives in `hosts/<host>/configuration.nix`,
+which is a thin list of `imports` pulling in reusable pieces from `modules/`:
+
+- `modules/common/configuration.nix` — base NixOS config imported by (almost)
+  every host: locale, users, nix settings, git. Nearly always the first import.
+- `modules/common/home.nix` / `hosts/<host>/home.nix` — Home Manager config for
+  the `nixos` user; the `nixos` workstation has its own, other hosts share
+  `modules/common/home.nix`.
 - `modules/disko/proxmox.nix` — declarative disk layout (GPT: ESP + swap +
  ext4 root) via disko, used by all Proxmox-VM hosts.
 - `modules/boot/efi.nix` — systemd-boot + EFI vars, paired with the disko module.
- `modules/nix-cache/{client,server,remote-builder-client}.nix` — binary cache
-  substituter + SSH remote-builder wiring; see `docs/nix-cache.md` for the
-  full design (per-host local stores, no shared `/nix/store`, and how the
-  `nixremote` signing/SSH keys fit together).
- `modules/beszel/host-token.nix` — parameterized helper module
-  (`{ name, sopsFile }`) that wires a host's beszel-agent sops secret/template
-  and `environmentFile`; used by `hosts/server/host.nix` and
-  `hosts/nix-cache/host.nix` to avoid duplicating that boilerplate.
- `modules/tailscale/`, `modules/docker/`, `modules/networking/`,
-  `modules/traefik/`, `modules/services/*` — single-purpose, single-host
-  feature modules (e.g. `docker/enable-service.nix`,
-  `services/zfs/enable-service.nix`). Grep `modules/build-types/*.nix` for
-  each build type's `imports` list to see which modules apply where.
+- `modules/hardware-configuration/vm/{proxmox,linode}.nix` — hypervisor-specific
+  hardware config, wired in from `flake.nix` (not from the host file).
+- `modules/nix-cache/{client,server}.nix` + `modules/remote-builder-client.nix` —
+  binary cache substituter + SSH remote-builder wiring; see `docs/nix-cache.md`
+  for the full design (per-host local stores, no shared `/nix/store`, and how
+  the `nixremote` signing/SSH keys fit together).
+- `modules/tailscale/`, `modules/docker/`, `modules/beszel/`,
+  `modules/services/*` — single-purpose, single-host feature modules (e.g.
+  `docker/enable-service.nix`, `services/zfs/enable-service.nix`,
+  `beszel/enable-agent.nix` for monitoring). Grep `hosts/*/configuration.nix`
+  for the `imports` list to see which modules apply to a given host.

-New host = new `hosts/<name>/host.nix` + a matching
-`mkTarget { platform; buildType; hostPath; }` entry added to `flake.nix`'s
-`generatedTargets`, composed from existing `modules/*` pieces rather than
-duplicating config.
+New host = new `hosts/<name>/configuration.nix` + a matching block added to
+`flake.nix`'s `nixosConfigurations`, composed from existing `modules/*` pieces
+rather than duplicating config.

 ### Other docs worth reading before touching these areas

@@ -46,17 +46,14 @@ nix eval --json .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]'
 | Path | Purpose |
 | --- | --- |
 | `flake.nix` | Flake inputs, the `mkTarget` platform × build-type generator, and `nixosConfigurations` outputs |
-| `variables.nix` | Single source of truth for shared values (LAN domain/CIDR, hostnames, timezone, primary username, storage root, ...) — passed to every module and Home Manager config as the `vars` argument via `specialArgs`/`extraSpecialArgs` |
 | `hosts/<name>/host.nix` | Per-machine identity: hostname, hostId, per-machine secrets, `system.stateVersion` |
 | `hosts/nixos/home.nix` | Workstation-specific Home Manager config (used by the `gui` build type) |
 | `modules/platforms/` | Platform-specific config: virtualisation guest tools, boot method, hardware config (`linode.nix`, `proxmox.nix`, `lxc.nix`) |
 | `modules/build-types/` | Build-type-specific config: what makes a system minimal/server/docker/gui/pxe-boot/nix-cache |
 | `modules/common/` | Shared NixOS config, Home Manager, aliases imported by every host |
 | `modules/nix-cache/` | Binary cache and remote builder client/server modules |
-| `modules/installer/` | Auto-installer environment (ISO/netboot/Proxmox LXC) — see `docs/auto-installer.md` |
-| `host-keys/` | Gitignored, locally-generated SSH host keys for the auto-installer — see `docs/auto-installer.md` |
-| `docs/` | Operational notes for cache, builders, lock updates, boot services, and the auto-installer |
-| `scripts/` | Codex setup, validation, and host-key-prep helpers |
+| `docs/` | Operational notes for cache, builders, lock updates, and boot services |
+| `scripts/` | Codex setup and validation helpers |

 ## Validation

@@ -1,199 +0,0 @@
-# Auto-installer
-
-This flake builds a self-contained NixOS installer environment that can
-install any host exposed by its own `nixosConfigurations`. It was migrated
-from a formerly-separate `nix-auto-installer` repo — everything it did now
-lives here.
-
-The installer provides a small NixOS install environment (ISO/netboot/Proxmox
-LXC) with SSH access, Git support, and an interactive installation script.
-Logging in as any user (root or `nixos`) runs `/etc/auto-install.sh`,
-discovers available hosts from this same flake, lets the operator choose a
-target, applies that host's Disko storage configuration, installs NixOS, and
-reboots.
-
-**This applies to every `nixosConfigurations` target except `lxc-*` hosts —
-see "LXC hosts" immediately below for why those are different.**
-
-## LXC hosts
-
-`lxc-*` targets (`lxc-minimal`, `lxc-nix-cache`, `lxc-server`, `lxc-docker`,
-`lxc-gui`, `lxc-pxe-boot`) are **not** installed via `auto-install.sh` — the
-interactive menu deliberately excludes them. Don't try to select one there;
-`nixos-install` would bind-mount `/` onto `/mnt` (LXC containers have no raw
-disk to partition) and then refuse to touch the filesystem it's currently
-running on — it's designed to protect exactly this case, so it just fails.
-
-`modules/platforms/lxc.nix` imports nixpkgs' own
-`virtualisation/proxmox-lxc.nix` module, which gives every `lxc-*` host a
-`config.system.build.tarball` output — a complete, directly Proxmox-importable
-container image, no install step at all:
-
-```sh
-nix build .#nixosConfigurations.lxc-minimal.config.system.build.tarball
-```
-
-Then, on the Proxmox host, `pct restore` (or the GUI's "Create CT" → upload
-template flow) that tarball directly as a new container. First boot runs
-`boot.postBootCommands` (registers the Nix store DB and system profile) —
-there's no separate activation step to run yourself.
-
-Host keys still need pre-seeding the same way as any other host (see "Host
-keys" below) — the sops-nix activation-vs-first-boot race is identical
-regardless of how the image reaches the machine. `NIXOS_HOST_KEYS_DIR=...
-nix build ... --impure` bakes the matching key into the tarball the same way
-it does for the ISO/PXE installer images.
-
-## Layout
-
- `modules/installer/common.nix` — shared by every installer target: SSH
-  access, users, the generated `/etc/auto-install.sh` script, and the
-  `programs.bash.loginShellInit` hook that runs it on login.
- `modules/installer/iso.nix` — ISO/netboot-specific: imports the stock
-  `installation-cd-minimal.nix` module plus `common.nix`. Also used, paired
-  with `netboot-minimal.nix`, to build the PXE netboot variant (see
-  `docs/pxe-boot.md`).
- `modules/installer/proxmox-lxc.nix` — Proxmox LXC-specific: disables
-  bootloader options (containers don't need one) plus `common.nix`.
- `modules/installer/host-keys.nix` — optionally bakes pre-generated SSH
-  host keys into the image; see "Host keys" below.
- `scripts/prepare-host-key.sh` — admin-workstation pre-flight tool, see
-  "Creating a New Machine" below.
-
-Flake outputs:
-
-```nix
-nixosConfigurations.installer     # ISO/netboot installer image
-nixosConfigurations.proxmox-lxc   # Proxmox LXC-based installer image
-
-packages.x86_64-linux.iso   # installer ISO/netboot image
-packages.x86_64-linux.lxc   # Proxmox LXC installer tarball
-packages.x86_64-linux.pxe   # netboot-ipxe + netboot-initrd + netboot-kernel, bundled
-packages.x86_64-linux.all   # all three of the above, bundled
-```
-
-```sh
-nix build .#iso
-nix build .#lxc
-nix build .#pxe
-nix build .#all
-```
-
-The `pxe` variant is also built automatically as part of the `pxe-boot` host
-itself (`modules/pxe-boot/stage-installer-artifacts.nix`) and served over
-iPXE — see `docs/pxe-boot.md`.
-
-## Host keys
-
-`sops-nix` derives each host's decryption key from its own
-`/etc/ssh/ssh_host_ed25519_key`, generated at **activation** time — before
-systemd would otherwise generate one on first boot. Without pre-seeding this
-key, secrets (including the root/nixos login password) fail to decrypt on a
-genuinely fresh install.
-
-Generated host keys live in `host-keys/` at the repo root (`ssh_host_ed25519_key`
-+ `.pub` pairs per hostname). This directory is **gitignored on purpose** —
-private key material must never be committed — which also means flakes can't
-see it through a normal relative path. `modules/installer/host-keys.nix`
-reads it through `builtins.getEnv`, which Nix silently returns as an empty
-string under normal (non-`--impure`) evaluation, so the module is a no-op —
-safe by default, including in CI — unless explicitly opted into:
-
-```sh
-NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build .#iso --impure
-```
-
-When built this way, every key currently in `host-keys/` is baked into the
-image at `/etc/host-keys/<hostname>_ssh_host_ed25519_key(.pub)`, and
-`auto-install.sh` automatically installs whichever one matches the flake
-target selected at install time — no manual per-host scp step needed.
-
-**Trade-off, accepted deliberately for this LAN-only setup:** baking keys in
-means every key present in `host-keys/` at build time becomes readable by
-anyone who can reach the built image — including, for the PXE variant, anyone
-who can reach the `pxe-boot` host's unauthenticated HTTP server. This is
-considered acceptable here because `pxe-boot` sits behind LAN-only network
-infrastructure, not the open internet. If that ever changes, reconsider this
-default.
-
-`auto-install.sh` still supports the older manual path as a fallback: if a
-host's key isn't baked in (`/etc/host-keys`), it checks `/root/host-keys`
-next, where you can `scp` a key in after boot, same as before this migration.
-
-## Storage
-
-Disk partitioning is handled by Disko — the installer has no hardcoded
-`parted`/`mkfs`/`mkswap`/`mount` commands. Each host defines its own layout
-via `disko.devices`; a host without one is installed in place via bind-mount
-(this is how every LXC container target works, since they have no raw block
-device to partition).
-
-## Installer process
-
-`/etc/auto-install.sh`:
-
-1. Queries `nixosConfigurations` from this flake over the network (`git+https://<lanDomain>/beatzaplenty/nixos.git`) — this happens at *install* time, not build time, so a generic installer image always sees whatever hosts are currently committed, without needing a rebuild.
-2. Presents them as a menu; confirms the choice.
-3. Skips the `nix-cache` substituter when installing a `nix-cache` host itself (consistent with that host's own runtime config).
-4. Runs `disko --mode destroy,format,mount` if the target has a Disko config, otherwise bind-mounts `/` onto `/mnt`.
-5. Installs the target's SSH host key from `/etc/host-keys` or `/root/host-keys` (see "Host keys" above).
-6. Runs `nixos-install --flake <url>#<choice> --no-root-password`.
-7. Cleans up and reboots.
-
-## Creating a new machine
-
-Do this instead of jumping straight to a plain install whenever the target
-host consumes any sops-nix secret — as of this writing, that's every host
-(`modules/common/configuration.nix` puts the root/nixos password hash and the
-GitHub token behind sops-nix for all of them).
-
-1. **On your admin workstation**, decide the new machine's flake target name
-   (`<platform>-<buildtype>`, e.g. `proxmox-server`) and generate + register
-   its host key:
-
-   ```sh
-   ./scripts/prepare-host-key.sh <hostname>
-   ```
-
-   This generates `host-keys/<hostname>_ssh_host_ed25519_key(.pub)` and
-   prints the `.sops.yaml` snippet to add, which secrets files to
-   re-encrypt it into, and the next steps below.
-
-2. **Edit `.sops.yaml`** with the printed snippet, then re-encrypt every
-   secrets file you added the new host to:
-
-   ```sh
-   nix-shell -p sops --run 'sops updatekeys secrets/common.yaml'
-   ```
-
-3. **Commit and push.** The flake build the installer uses has to see the
-   new recipient before you install, or decryption fails on first boot
-   regardless of the next step.
-
-4. **Build the installer image with keys baked in** (or reuse an already-serving `pxe-boot` host, which does this automatically once redeployed):
-
-   ```sh
-   NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build .#iso --impure
-   ```
-
-5. **Boot it on the target machine**, log in, select the new host's flake
-   target from the menu, confirm. `auto-install.sh` finds the baked-in key,
-   runs Disko + `nixos-install`, and reboots.
-
-6. **Verify after reboot:**
-
-   ```sh
-   ssh <new-host> ls /run/secrets/
-   ```
-
-   If that's empty or login fails, the host's age key most likely wasn't in
-   `.sops.yaml` (or wasn't re-encrypted into the secrets file it needs) when
-   `nixos-install` ran — fix `.sops.yaml`/`secrets/*.yaml`, push, then re-run
-   `nixos-install --flake .#<hostname> --no-root-password` from a rescue
-   environment against the existing `/mnt`, or just redo the install.
-
-## Safety
-
-This installer is destructive: `disko --mode destroy,format,mount` erases
-any disk defined by the selected host's Disko configuration. Always verify
-the selected host profile and target machine before confirming.
@@ -8,8 +8,8 @@ This repository configures `nix-cache` as a **binary cache server** and a **remo
 - Every machine still keeps and uses its own local `/nix/store`.
 - Clients prefer `http://nix-cache` for substitutes and keep `https://cache.nixos.org/` as fallback.
 - Clients can offload builds to `nix-cache` through SSH (`nix.distributedBuilds`).
- Client hosts import `modules/nix-cache/client.nix` and, when remote building is enabled, `modules/nix-cache/remote-builder-client.nix`.
- The `nix-cache` host imports `modules/nix-cache/server.nix`.
+- Client hosts import `modules/nix/cache-client.nix` and, when remote building is enabled, `modules/nix/remote-builder-client.nix`.
+- The `nix-cache` host imports `modules/nix/cache-server.nix`.

 ## Binary cache signing keys (on nix-cache)

@@ -52,15 +52,8 @@ The generated menu currently exposes entries for:
 - iPXE shell
 - Reboot

-The NixOS installer entry chain-loads `/srv/pxe/http/nixos/netboot.ipxe`,
-which is nixpkgs' own generated netboot iPXE script (correct `init=`/`initrd=`
-kernel parameters included) rather than a hand-rolled boot line — that script
-in turn expects its kernel/initrd siblings in the same directory. All three
-files (`bzImage`, `initrd`, `netboot.ipxe`) are built from this flake's own
-`modules/installer/iso.nix` netboot image (the same one `nix build .#pxe`
-produces) and staged automatically by
-`modules/pxe-boot/stage-installer-artifacts.nix` via `systemd.tmpfiles.rules`
-— no manual operator step required.
+Kernel and initrd artifacts for the NixOS installer entry must be placed under
+`/srv/pxe/http/nixos` by an operator or a separate build process.

 The SystemRescue entry expects the source ISO at:

@@ -23,8 +23,6 @@
    let
      system = "x86_64-linux";
      inherit (nixpkgs) lib;
-      pkgs = nixpkgs.legacyPackages.${system};
-      vars = import ./variables.nix;

      # Generates a nixosConfiguration from a platform (what it runs on) and
      # a build type (what it's for), plus the per-identity host.nix that
@@ -48,24 +46,23 @@
              home-manager = {
                useGlobalPkgs = true;
                useUserPackages = true;
-                extraSpecialArgs = { inherit vars; };
                users.nixos = import homeFile;
              };
            }
          ] ++ lib.optionals (buildType != "nix-cache") [
            ./modules/nix-cache/client.nix
-            ./modules/nix-cache/remote-builder-client.nix
+            ./modules/remote-builder-client.nix
          ];
-          specialArgs = { inherit inputs vars netbootSystem; };
+          specialArgs = { inherit inputs; };
        };

      # Generated platform x build-type matrix. pxe-boot has no linode
      # variant (PXE/DHCP/TFTP need LAN L2 adjacency, which a Linode VPS
      # doesn't have).
      generatedTargets = {
-        linode-minimal = mkTarget { platform = "linode"; buildType = "minimal"; hostPath = ./hosts/nix-minimal/host.nix; };
-        proxmox-minimal = mkTarget { platform = "proxmox"; buildType = "minimal"; hostPath = ./hosts/nix-minimal/host.nix; };
-        lxc-minimal = mkTarget { platform = "lxc"; buildType = "minimal"; hostPath = ./hosts/nix-minimal/host.nix; };
+        linode-minimal = mkTarget { platform = "linode"; buildType = "minimal"; hostPath = ./hosts/linode-minimal/host.nix; };
+        proxmox-minimal = mkTarget { platform = "proxmox"; buildType = "minimal"; hostPath = ./hosts/proxmox-minimal/host.nix; };
+        lxc-minimal = mkTarget { platform = "lxc"; buildType = "minimal"; hostPath = ./hosts/lxc-minimal/host.nix; };

        linode-nix-cache = mkTarget { platform = "linode"; buildType = "nix-cache"; hostPath = ./hosts/nix-cache/host.nix; };
        proxmox-nix-cache = mkTarget { platform = "proxmox"; buildType = "nix-cache"; hostPath = ./hosts/nix-cache/host.nix; };
@@ -87,65 +84,9 @@
        lxc-pxe-boot = mkTarget { platform = "lxc"; buildType = "pxe-boot"; hostPath = ./hosts/pxe-boot/host.nix; };
      };

-      # Auto-install environments (migrated from the former nix-auto-installer
-      # flake): a self-contained NixOS installer that boots, discovers this
-      # flake's own nixosConfigurations over the network, and runs
-      # nixos-install against whichever one the operator picks. These are
-      # deliberately not part of the platform x build-type matrix above —
-      # they're throwaway boot media, not persistent hosts, so they skip
-      # disko/sops-nix/home-manager and just need `vars`.
-      installerTargets = {
-        installer = nixpkgs.lib.nixosSystem {
-          inherit system;
-          modules = [ ./modules/installer/iso.nix ];
-          specialArgs = { inherit vars; };
-        };
-
-        proxmox-lxc = nixpkgs.lib.nixosSystem {
-          inherit system;
-          modules = [ ./modules/installer/proxmox-lxc.nix ];
-          specialArgs = { inherit vars; };
-        };
-      };
-
-      # Same installer environment, built as netboot (kernel + initrd +
-      # iPXE script) instead of an ISO — this is what packages.pxe bundles.
-      netbootSystem = nixpkgs.lib.nixosSystem {
-        inherit system;
-        modules = [
-          ./modules/installer/iso.nix
-          ({ modulesPath, ... }: {
-            imports = [
-              (modulesPath + "/installer/netboot/netboot-minimal.nix")
-            ];
-          })
-        ];
-        specialArgs = { inherit vars; };
-      };
-
    in
    {

-      nixosConfigurations = generatedTargets // installerTargets;
-
-      # Buildable auto-installer artifacts (`nix build .#<name>`), migrated
-      # unchanged from nix-auto-installer's interface.
-      packages.${system} = rec {
-        iso = installerTargets.installer.config.system.build.isoImage;
-
-        lxc = installerTargets.proxmox-lxc.config.system.build.tarball;
-
-        pxe = pkgs.linkFarm "pxe" [
-          { name = "netboot.ipxe"; path = netbootSystem.config.system.build.netbootIpxeScript; }
-          { name = "initrd"; path = netbootSystem.config.system.build.netbootRamdisk; }
-          { name = "kernel"; path = netbootSystem.config.system.build.kernel; }
-        ];
-
-        all = pkgs.linkFarm "all" [
-          { name = "iso"; path = iso; }
-          { name = "lxc"; path = lxc; }
-          { name = "pxe"; path = pxe; }
-        ];
-      };
+      nixosConfigurations = generatedTargets;
    };
 }
@@ -1,4 +1,4 @@
-_:
+{ ... }:

 {
  networking.hostName = "docker";
@@ -0,0 +1,9 @@
+{ ... }:
+
+{
+  networking.hostName = "linode-minimal";
+
+  # Preserved from the pre-refactor `linode-minimal` target — stateVersion
+  # must never be bumped on an already-installed machine.
+  system.stateVersion = "26.05";
+}
@@ -0,0 +1,9 @@
+{ ... }:
+
+{
+  networking.hostName = "lxc-minimal";
+
+  # No pre-existing deployed machine to preserve — pin explicitly to the
+  # current release rather than let it silently default.
+  system.stateVersion = "26.05";
+}
@@ -1,19 +1,19 @@
-{ vars, ... }:
+{ config, ... }:

 {
-  imports = [
-    (import ../../modules/beszel/host-token.nix {
-      name = "nix-cache";
-      sopsFile = ../../secrets/nix-cache.yaml;
-    })
-  ];
+  networking.hostName = "nix-cache";

-  networking.hostName = vars.nixCacheHost;
+  sops.secrets."beszel-token".sopsFile = ../../secrets/nix-cache.yaml;
+  sops.templates."nix-cache-beszel.env".content = ''
+    TOKEN=${config.sops.placeholder."beszel-token"}
+  '';

  services.beszel.agent.environment = {
    #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
+    #HUB_URL = "http://docker.sweet.home:8090";
    KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
  };
+  services.beszel.agent.environmentFile = config.sops.templates."nix-cache-beszel.env".path;

  # Preserved from the pre-refactor `nix-cache` target — stateVersion must
  # never be bumped on an already-installed machine.
@@ -1,82 +1,79 @@
-{ config, pkgs, lib, vars, ... }:
+{ config, pkgs, lib, ... }:

 {

-  imports = [
+    imports = [
    ../../modules/common/aliases.nix
  ];

-  home = {
-    username = vars.primaryUser;
-    homeDirectory = "/home/${vars.primaryUser}";
-    stateVersion = "25.05"; # match your NixOS stateVersion
+  home.username = "nixos";         # your actual username
+  home.homeDirectory = "/home/nixos";
+  home.stateVersion = "25.05";        # match your NixOS stateVersion

-    # Optional: packages
-    packages = with pkgs; [
-      git
-      vim
-      tmux
-      nextcloud-client
-      #    vscode
-      chromium
-    ];
+  programs.home-manager.enable = true;  # mandatory to activate HM

-    # Optional: set environment vars
-    sessionVariables = {
-      EDITOR = "vim";
-    };
+  # Optional: packages
+  home.packages = with pkgs; [
+    git
+    vim
+    tmux
+    nextcloud-client
+#    vscode
+    chromium
+  ];

-    file = {
-      ".local/share/applications/proxmox-chromium-app.desktop".text = ''
-        [Desktop Entry]
-        Type=Application
-        Name=Proxmox (Chromium)
-        Exec=chromium --app=https://pve.${vars.homeDomain}:${toString vars.pveWebPort} --window-size=1920,1080 --window-position=0,0
-        Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png
-        Terminal=false
-        Categories=Hypervisor;
-        StartupWMClass=PVE
-      '';
-      ".local/share/applications/pbs-chromium-app.desktop".text = ''
-        [Desktop Entry]
-        Type=Application
-        Name=Proxmox Backup Server (Chromium)
-        Exec=chromium --app=https://${vars.pbsIp}:${toString vars.pbsWebPort} --window-size=1920,1080 --window-position=0,0
-        Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png
-        Terminal=false
-        Categories=backup;
-
-      '';
-      ".local/share/applications/proxmox-firefox-app.desktop".text = ''
-        [Desktop Entry]
-        Type=Application
-        Name=Proxmox (Firefox)
-        Exec=firefox --new-instance https://pve.${vars.homeDomain}:${toString vars.pveWebPort} --profile ProxmoxWebApp --window-size=1920,1080 --class ProxmoxWebApp
-        Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png
-        Terminal=false
-        Categories=Hypervisor;
-        StartupWMClass=PVE
-      '';
-      ".local/share/applications/pbs-firefox-app.desktop".text = ''
-        [Desktop Entry]
-        Type=Application
-        Name=Proxmox Backup Server (Firefox)
-        Exec=firefox --new-window https://${vars.pbsIp}:${toString vars.pbsWebPort} --profile PbsWebApp --window-size=1920,1080 --class PbsWebApp
-        Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png
-        Terminal=false
-        Categories=backup;
-        StartupWMClass=PBS
-      '';
-    };
+  # Optional: set environment vars
+  home.sessionVariables = {
+    EDITOR = "vim";
  };

-  programs.home-manager.enable = true; # mandatory to activate HM
-
  # Optional: enable bash (or zsh, fish...)
  programs.bash.enable = true;
-  services.nextcloud-client = {
+    services.nextcloud-client = {
    enable = true;
    # Optionally start in background directly
    startInBackground = true;
  };
-}
+home.file = {
+  ".local/share/applications/proxmox-chromium-app.desktop".text = ''
+    [Desktop Entry]
+    Type=Application
+    Name=Proxmox (Chromium)
+    Exec=chromium --app=https://pve.sweet.home:8006 --window-size=1920,1080 --window-position=0,0
+    Icon=/home/nixos/.local/share/icons/proxmox.png
+    Terminal=false
+    Categories=Hypervisor;
+    StartupWMClass=PVE
+  '';
+  ".local/share/applications/pbs-chromium-app.desktop".text = ''
+    [Desktop Entry]
+    Type=Application
+    Name=Proxmox Backup Server (Chromium)
+    Exec=chromium --app=https://192.168.2.108:8007 --window-size=1920,1080 --window-position=0,0
+    Icon=/home/nixos/.local/share/icons/proxmox.png
+    Terminal=false
+    Categories=backup;
+
+  '';
+  ".local/share/applications/proxmox-firefox-app.desktop".text = ''
+    [Desktop Entry]
+    Type=Application
+    Name=Proxmox (Firefox)
+    Exec=firefox --new-instance https://pve.sweet.home:8006 --profile ProxmoxWebApp --window-size=1920,1080 --class ProxmoxWebApp
+    Icon=/home/nixos/.local/share/icons/proxmox.png
+    Terminal=false
+    Categories=Hypervisor;
+    StartupWMClass=PVE
+  '';
+  ".local/share/applications/pbs-firefox-app.desktop".text = ''
+    [Desktop Entry]
+    Type=Application
+    Name=Proxmox Backup Server (Firefox)
+    Exec=firefox --new-window https://192.168.2.108:8007 --profile PbsWebApp --window-size=1920,1080 --class PbsWebApp
+    Icon=/home/nixos/.local/share/icons/proxmox.png
+    Terminal=false
+    Categories=backup;
+    StartupWMClass=PBS
+  '';
+};
+}
@@ -1,4 +1,4 @@
-_:
+{ ... }:

 {
  networking.hostName = "nixos";
@@ -1,4 +1,4 @@
-_:
+{ ... }:

 {
  # Preserves the hostname of the existing, already-deployed machine
@@ -1,4 +1,4 @@
-_:
+{ ... }:

 {
  networking.hostName = "pxe-boot";
@@ -1,22 +1,22 @@
-{ vars, ... }:
+{ config, ... }:

 {
-  imports = [
-    (import ../../modules/beszel/host-token.nix {
-      name = "server";
-      sopsFile = ../../secrets/server.yaml;
-    })
-  ];
-
-  networking.hostName = vars.nfsServerHost;
+  networking.hostName = "server";
  networking.hostId = "6689f93e";

+  sops.secrets."beszel-token".sopsFile = ../../secrets/server.yaml;
+  sops.templates."server-beszel.env".content = ''
+    TOKEN=${config.sops.placeholder."beszel-token"}
+  '';
+
  services.beszel.agent.environment = {
    #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
+    #HUB_URL = "http://docker.sweet.home:8090";
    KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
-    EXTRA_FILESYSTEMS = "${vars.storageRoot}/docker/volumes";
+    EXTRA_FILESYSTEMS = "/tank/docker/volumes";
    LOG_LEVEL = "debug";
  };
+  services.beszel.agent.environmentFile = config.sops.templates."server-beszel.env".path;

  # Preserved from the pre-refactor `server` target — stateVersion must never
  # be bumped on an already-installed machine.
@@ -1,9 +1,9 @@
-{ vars, ... }:
+{ ... }:

 {
-  services.beszel.agent.enable = true;
-  services.beszel.agent.environment = {
-    #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-    HUB_URL = "http://${vars.dockerHost}.${vars.homeDomain}:${toString vars.beszelHubPort}";
-  };
+services.beszel.agent.enable = true;
+services.beszel.agent.environment = {
+#DOCKER_HOST = "tcp://docker-socket-proxy:2375";
+HUB_URL = "http://docker.sweet.home:8090";
+};
 }
@@ -1,11 +0,0 @@
-{ name, sopsFile }:
-
-{ config, ... }:
-
-{
-  sops.secrets."beszel-token".sopsFile = sopsFile;
-  sops.templates."${name}-beszel.env".content = ''
-    TOKEN=${config.sops.placeholder."beszel-token"}
-  '';
-  services.beszel.agent.environmentFile = config.sops.templates."${name}-beszel.env".path;
-}
@@ -1,6 +1,6 @@
-_:
+{ ... }:

 {
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
-}
+}
@@ -1,4 +1,4 @@
-{ pkgs, vars, ... }:
+{ pkgs, ... }:

 {
  # Pins the Docker Engine version, carried forward from the pre-refactor
@@ -13,11 +13,11 @@
  imports = [
    ../docker/mount-data.nix
    ../docker/enable-service.nix
-    ../docker/nextcloud-cron-job.nix
-    ../docker/docker-health-to-gotify.nix
    ../tailscale/enable-service.nix
-    ../traefik/rotate-logs.nix
+    ../rotate-traefik-logs.nix
    ../raspi/mount-data.nix
+    ../services/nextcloud-cron-job.nix
+    ../services/docker-health-to-gotify.nix
    ../services/enable-rpcbind.nix
  ];

@@ -36,5 +36,5 @@
  users.users.nixos.extraGroups = [ "docker" ];
  services.openssh.settings.PermitRootLogin = "yes";

-  networking.firewall.allowedTCPPorts = [ 80 8080 443 vars.beszelHubPort ];
+  networking.firewall.allowedTCPPorts = [ 80 8080 443 8090 ];
 }
@@ -2,7 +2,7 @@

 {
  environment.systemPackages = with pkgs; [
-    inputs.nixos-conf-editor.packages.${pkgs.stdenv.hostPlatform.system}.nixos-conf-editor
+    inputs.nixos-conf-editor.packages.${pkgs.system}.nixos-conf-editor
    nodejs
    appimage-run
    seahorse
@@ -19,55 +19,39 @@

  boot.loader.grub.useOSProber = true;

-  services = {
-    xserver = {
-      enable = true;
+  services.xserver.enable = true;
+  services.xserver.displayManager.lightdm.enable = true;
+  services.xserver.desktopManager.cinnamon.enable = true;

-      displayManager = {
-        lightdm.enable = true;
-        sessionCommands = ''
-          eval $(gnome-keyring-daemon --start --components=secrets,ssh)
-          export SSH_AUTH_SOCK
-        '';
-      };
-
-      desktopManager.cinnamon.enable = true;
-
-      xkb = {
-        layout = "au";
-        variant = "";
-      };
-    };
-
-    printing.enable = true;
-
-    pipewire = {
-      enable = true;
-      alsa.enable = true;
-      alsa.support32Bit = true;
-      pulse.enable = true;
-    };
-
-    xrdp = {
-      enable = true;
-      defaultWindowManager = "cinnamon-session";
-      openFirewall = true;
-    };
-
-    gnome.gnome-keyring.enable = true;
+  services.xserver.xkb = {
+    layout = "au";
+    variant = "";
  };

-  security = {
-    rtkit.enable = true;
-    pam.services.login.enableGnomeKeyring = true;
+  services.printing.enable = true;
+
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
  };

-  # The networkmanager group only exists when NM is actually enabled — the
-  # lxc platform module force-disables it, so don't add the user to a group
-  # that won't exist there.
-  users.users.nixos.extraGroups = lib.mkIf config.networking.networkmanager.enable [ "networkmanager" ];
+  users.users.nixos.extraGroups = [ "networkmanager" ];

  programs.firefox.enable = true;

+  services.xrdp.enable = true;
+  services.xrdp.defaultWindowManager = "cinnamon-session";
+  services.xrdp.openFirewall = true;
  nixpkgs.config.allowUnfree = true;
+
+  services.gnome.gnome-keyring.enable = true;
+  security.pam.services.login.enableGnomeKeyring = true;
+
+  services.xserver.displayManager.sessionCommands = ''
+    eval $(gnome-keyring-daemon --start --components=secrets,ssh)
+    export SSH_AUTH_SOCK
+  '';
 }
@@ -1,12 +1,9 @@
-{ lib, pkgs, config, ... }:
+{ pkgs, ... }:

 {
  networking.networkmanager.enable = true;

-  # The networkmanager group only exists when NM is actually enabled — the
-  # lxc platform module force-disables it, so don't add the user to a group
-  # that won't exist there.
-  users.users.nixos.extraGroups = lib.mkIf config.networking.networkmanager.enable [ "networkmanager" ];
+  users.users.nixos.extraGroups = [ "networkmanager" ];

  environment.systemPackages = with pkgs; [
    inetutils
@@ -1,10 +1,10 @@
-{ config, lib, pkgs, inputs, vars, ... }:
+{ config, lib, pkgs, inputs, ... }:

 let
  pxeRoot = "/srv/pxe";
  httpRoot = "${pxeRoot}/http";
  tftpRoot = "${pxeRoot}/tftp";
-  pxeBaseUrl = "http://${vars.pxeServerIp}";
+  pxeBaseUrl = "http://192.168.2.247";

  bootIpxe = pkgs.writeText "boot.ipxe" ''
    #!ipxe
@@ -76,7 +76,9 @@ let
    choose target && goto ''${target}

    :nixos
-    chain ''${base}/nixos/netboot.ipxe
+    kernel ''${base}/nixos/bzImage ip=dhcp
+    initrd ''${base}/nixos/initrd
+    boot

    :rescue
    chain ''${base}/systemrescue.ipxe
@@ -89,40 +91,32 @@ let
  '';
 in
 {
-  imports = [
-    ../pxe-boot/stage-installer-artifacts.nix
-  ];
-
  environment.systemPackages = with pkgs; [
    ipxe
  ];

-  services = {
-    nginx = {
-      enable = true;
+  services.nginx = {
+    enable = true;

-      virtualHosts."pxe-boot" = {
-        default = true;
-        root = httpRoot;
-        locations."/" = {
-          extraConfig = ''
-            autoindex on;
-          '';
-        };
+    virtualHosts."pxe-boot" = {
+      default = true;
+      root = httpRoot;
+      locations."/" = {
+        extraConfig = ''
+          autoindex on;
+        '';
      };
    };
+  };

-    # TFTP is only used to deliver the initial iPXE bootloader. After iPXE
-    # starts, all further assets are fetched via nginx over HTTP.
-    atftpd = {
-      enable = true;
-      root = tftpRoot;
-      extraOptions = [
-        "--verbose=5"
-      ];
-    };
-
-    openssh.settings.PermitRootLogin = "yes";
+  # TFTP is only used to deliver the initial iPXE bootloader. After iPXE
+  # starts, all further assets are fetched via nginx over HTTP.
+  services.atftpd = {
+    enable = true;
+    root = tftpRoot;
+    extraOptions = [
+      "--verbose=5"
+    ];
  };

  systemd.tmpfiles.rules = [
@@ -155,6 +149,8 @@ in
    };
  };

+  services.openssh.settings.PermitRootLogin = "yes";
+
  networking.firewall.allowedTCPPorts = [ 80 ];
  networking.firewall.allowedUDPPorts = [ 69 ];
 }
@@ -1,4 +1,4 @@
-{ vars, lib, ... }:
+{ ... }:

 {
  imports = [
@@ -6,7 +6,7 @@
    ../services/zfs/enable-service.nix
  ];

-  boot.zfs.extraPools = [ (lib.removePrefix "/" vars.storageRoot) ];
+  boot.zfs.extraPools = [ "tank" ];

  systemd.services.nfs-server = {
    after = [ "zfs-mount.service" ];
@@ -16,11 +16,11 @@
  services.nfs.server = {
    enable = true;
    exports = ''
-      ${vars.storageRoot}/docker/config ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
-      ${vars.storageRoot}/docker/volumes ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
-      ${vars.storageRoot}/docker/databases ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
-      ${vars.storageRoot}/docker/nextcloud-data ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
-      ${vars.storageRoot}/raspi/volumes ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      /tank/docker/config 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
+      /tank/docker/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
+      /tank/docker/databases 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
+      /tank/docker/nextcloud-data 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
+      /tank/raspi/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
    '';
  };

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, vars, ... }:
+{ config, pkgs, lib, ... }:

 let
  # Flake attribute names are now <platform>-<buildtype> (e.g. proxmox-docker)
@@ -9,13 +9,13 @@ let
    sudo nixos-rebuild switch \
      --no-write-lock-file \
      --refresh \
-      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
+      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target)
  '';
  myTestCmd = ''
    sudo nixos-rebuild test \
      --no-write-lock-file \
      --refresh \
-      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
+      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target)
  '';
 in
 {
@@ -1,36 +1,29 @@
-{ config, lib, pkgs, vars, ... }:
+{ config, lib, pkgs, ... }:

 {
-  imports =
-    [
-      # Include the results of the hardware scan.
-      #      ./hardware-configuration.nix
-      ./set-locale.nix
+    imports =
+    [ # Include the results of the hardware scan.
+#      ./hardware-configuration.nix
+      ../set-locale.nix
    ];
  # Use the GRUB 2 boot loader.
  # boot.loader.grub.enable = true;
  #boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only

-  networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
-
-  # Recommended over the true default (bypasses ZFS's own import safeguards)
-  # per the option's own docs; matches hosts/docker/host.nix and
-  # modules/services/zfs/enable-service.nix, which already set this
-  # explicitly. Harmless no-op on hosts that don't use ZFS at all.
-  boot.zfs.forceImportRoot = false;
+  networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.

  # Set your time zone.
-  time.timeZone = vars.timeZone;
+  time.timeZone = "Australia/Brisbane";

  # Enable QEMU agent
  services.qemuGuest.enable = true;

-  # Enable docker-compose
+    # Enable docker-compose
  environment.systemPackages = with pkgs; [
-    vim
-    btop
-    git
-    gcr
+  vim
+  btop
+  git
+  gcr
  ];

  # Secrets shared by every host, decrypted at activation via each host's
@@ -39,34 +32,28 @@
  # or docs/ for the sops workflow). hashedPassword/hashedPasswordFile need
  # neededForUsers so they're available before the normal secret-activation
  # step, since user creation happens very early in boot.
-  sops = {
-    defaultSopsFile = ../../secrets/common.yaml;
-
-    secrets = {
-      "root-hashedPassword".neededForUsers = true;
-      "nixos-hashedPassword".neededForUsers = true;
-      "nix-github-token" = { };
-    };
-
-    # nix.conf doesn't support a *File-style option for access-tokens, so the
-    # token is rendered into a runtime-only file (never touches the Nix store)
-    # and pulled in via nix.conf's native !include directive.
-    templates."nix-github-token.conf".content = ''
-      access-tokens = github.com=${config.sops.placeholder."nix-github-token"}
-    '';
-  };
+  sops.defaultSopsFile = ../../secrets/common.yaml;
+  sops.secrets."root-hashedPassword".neededForUsers = true;
+  sops.secrets."nixos-hashedPassword".neededForUsers = true;
+  sops.secrets."nix-github-token" = { };

+  # nix.conf doesn't support a *File-style option for access-tokens, so the
+  # token is rendered into a runtime-only file (never touches the Nix store)
+  # and pulled in via nix.conf's native !include directive.
+  sops.templates."nix-github-token.conf".content = ''
+    access-tokens = github.com=${config.sops.placeholder."nix-github-token"}
+  '';
  nix.extraOptions = ''
    !include ${config.sops.templates."nix-github-token.conf".path}
  '';

-  #Set root password
-  users.users.root = {
-    hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
-  };
+#Set root password
+users.users.root = {
+  hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
+};

  # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.${vars.primaryUser} = {
+  users.users.nixos = {
    isNormalUser = true;
    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
    packages = with pkgs; [
@@ -74,8 +61,8 @@
    ];
    hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
    openssh.authorizedKeys.keys = [
-      vars.adminSshKey
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq/Q5LvIXlZwO2kdeAN5nLGZ59nZB7JHYMEszHxmNtGMzv1lM31jiPNsr0z2EKVZhE7OOfa2IF9rhWYD7JUA9G0yzdZ4WTXFNGVVOJoOVH6vAF3XCxoVilOEwTc7h2Wiy+rzd0B28/3spffzQQWJhY6GRQVa8j+6xAGF60Fcvl1vLosYT9Bn2ZbK4TCWOwAn2jqXIieGpZdn/UNZbGOeKRiCvhktDfMAzuQzN/9jMu/oF4pkPn2X1UrsQdNlvp0Ci8md612MozIpncQJyAF1ADhunr3sMx0isUXiqD29R5DS4TftpekqLNLak+zcxFa8N7DcRNp3DcKfJvyTkwQrR4r+b7lFLYOLHLagSso9CzeW/paAS2q9I5SBm/2DtE1diLLg2jZikYcstsu/G5RgvbzbKqjiaMwTdXC3AMvDxQrs7U5pDRZFzoofG3cpODbTm+uy3m0kP70z0M1K45UbDG0p+itnTu9x40JbQEgefbx38AItNvAIx1A8HO4I1VX28= wayne@stream"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
    ];
  };

@@ -101,4 +88,4 @@



-}
+}
@@ -1,69 +1,65 @@
-{ config, pkgs, lib, vars, ... }:
+{ config, pkgs, lib, ... }:

 let
  remote = "root@proxmox-ip:/var/lib/vz/template/iso";
  localMount = "${config.home.homeDirectory}/proxmox-iso";
-in
-{
+in {

  imports = [
    ./aliases.nix
  ];

-  home = {
-    username = vars.primaryUser;
-    homeDirectory = "/home/${vars.primaryUser}";
-    stateVersion = "25.11"; # match your NixOS stateVersion
-
-    # Optional: packages
-    packages = with pkgs; [
-      git
-      vim
-      tmux
-      nano
-      sshfs
-    ];
-
-    # Optional: set environment vars
-    sessionVariables = {
-      EDITOR = "nano";
-    };
-  };
-
-  programs.home-manager.enable = true; # mandatory to activate HM
-
-  programs.bash.enable = true;
+  home.username = "nixos";         # your actual username
+  home.homeDirectory = "/home/nixos";
+  home.stateVersion = "25.11";        # match your NixOS stateVersion

+  programs.home-manager.enable = true;  # mandatory to activate HM
+  
+programs.bash.enable = true;
+  
  # GitHub access-tokens setting used to live here in plaintext; it's now
  # rendered system-wide from a sops-nix secret via nix.extraOptions in
  # modules/common/configuration.nix instead (covers the daemon for every
  # user, not just this one).

-  #  systemd.user.services.mount-proxmox-iso = {
-  #    Unit = {
-  #      Description = "Mount Proxmox ISO dir via SSHFS";
-  #      After = [ "network-online.target" ];
-  #      Wants = [ "network-online.target" ];
-  #    };
+  # Optional: packages
+  home.packages = with pkgs; [
+    git
+    vim
+    tmux
+    nano
+    sshfs
+  ];

-  #    Service = {
-  #      Type = "simple";
-  #      ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${localMount}";
-  #      ExecStart = "${pkgs.sshfs}/bin/sshfs -o IdentityFile=${config.home.homeDirectory}/.ssh/id_ed25519,allow_other,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3 root@proxmox-ip:/var/lib/vz/template/iso ${localMount}";
-  #      ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u ${localMount}";
-  #      Restart = "on-failure";
-  #    };
+  # Optional: set environment vars
+  home.sessionVariables = {
+    EDITOR = "nano";
+  };
+#  systemd.user.services.mount-proxmox-iso = {
+#    Unit = {
+#      Description = "Mount Proxmox ISO dir via SSHFS";
+#      After = [ "network-online.target" ];
+#      Wants = [ "network-online.target" ];
+#    };

-  #    Install = {
-  #      WantedBy = [ "default.target" ];
-  #    };
-  #  };
+#    Service = {
+#      Type = "simple";
+#      ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${localMount}";
+#      ExecStart = "${pkgs.sshfs}/bin/sshfs -o IdentityFile=${config.home.homeDirectory}/.ssh/id_ed25519,allow_other,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3 root@proxmox-ip:/var/lib/vz/template/iso ${localMount}";
+#      ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u ${localMount}";
+#      Restart = "on-failure";
+#    };
+
+#    Install = {
+#      WantedBy = [ "default.target" ];
+#    };
+#  };
  # Optional: enable bash (or zsh, fish...)
-  #  programs.bash.enable = true;
+#  programs.bash.enable = true;

  # Optional: manage dotfiles via symlinks
-  #  home.file = {
-  #    ".tmux.conf".source = ./dotfiles/tmux.conf;
-  #    ".config/nvim/init.vim".source = ./dotfiles/init.vim;
-  #  };
+#  home.file = {
+#    ".tmux.conf".source = ./dotfiles/tmux.conf;
+#    ".config/nvim/init.vim".source = ./dotfiles/init.vim;
+#  };
 }
@@ -1,4 +1,4 @@
-_:
+{ ... }:

 {
  disko.devices = {
@@ -57,4 +57,4 @@ _:
      };
    };
  };
-}
+}
@@ -1,23 +1,23 @@
 { pkgs, ... }:

 {
-  #  virtualisation.docker.enable = true;
+    #  virtualisation.docker.enable = true;
  virtualisation.docker = {
-    enable = true;
-    package = pkgs.docker;
-    #  listenOptions = [
-    #  "unix:///var/run/docker.sock"
-    #  "tcp://0.0.0.0:2375"
-    #];
+  enable = true;
+  package = pkgs.docker;
+#  listenOptions = [
+#  "unix:///var/run/docker.sock"
+#  "tcp://0.0.0.0:2375"
+#];

-    #  daemon.settings = {
-    #    metrics-addr = "0.0.0.0:9323";
-    #    experimental = true;
-    #  };
-  };
+#  daemon.settings = {
+#    metrics-addr = "0.0.0.0:9323";
+#    experimental = true;
+#  };
+};

-  environment.systemPackages = with pkgs; [
-    docker-compose
-    docker-buildx
-  ];
-}
+environment.systemPackages = with pkgs; [
+  docker-compose
+  docker-buildx
+];
+}
@@ -1,65 +1,63 @@
-{ config, lib, pkgs, vars, ... }:
+{ config, lib, pkgs, ... }:

 {
-  fileSystems = {
-    "/mnt/docker/config" = {
-      device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/config";
-      fsType = "nfs";
+  fileSystems."/mnt/docker/config" = {
+    device = "server:/tank/docker/config";
+    fsType = "nfs";

-      options = [
-        "nfsvers=4.2"
-        "_netdev"
-        "x-systemd.automount"
-        "noatime"
-      ];
-    };
+    options = [
+      "nfsvers=4.2"
+      "_netdev"
+      "x-systemd.automount"
+      "noatime"
+    ];
+  };

-    "/mnt/docker/databases" = {
-      device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/databases";
-      fsType = "nfs";
+  fileSystems."/mnt/docker/databases" = {
+    device = "server:/tank/docker/databases";
+    fsType = "nfs";

-      options = [
-        "nfsvers=4.2"
-        "_netdev"
-        "x-systemd.automount"
-        "noatime"
-      ];
-    };
+    options = [
+      "nfsvers=4.2"
+      "_netdev"
+      "x-systemd.automount"
+      "noatime"
+    ];
+  };

-    "/mnt/docker/volumes" = {
-      device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/volumes";
-      fsType = "nfs";
+  fileSystems."/mnt/docker/volumes" = {
+    device = "server:/tank/docker/volumes";
+    fsType = "nfs";

-      options = [
-        "nfsvers=4.2"
-        "_netdev"
-        "x-systemd.automount"
-        "noatime"
-      ];
-    };
+    options = [
+      "nfsvers=4.2"
+      "_netdev"
+      "x-systemd.automount"
+      "noatime"
+    ];
+  };

-    "/mnt/nextcloud-data" = {
-      device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/nextcloud-data";
-      fsType = "nfs";
+ fileSystems."/mnt/nextcloud-data" = {
+    device = "server:/tank/docker/nextcloud-data";
+    fsType = "nfs";

-      options = [
-        "nfsvers=4.2"
-        "_netdev"
-        "x-systemd.automount"
-        "noatime"
-      ];
-    };
+    options = [
+      "nfsvers=4.2"
+      "_netdev"
+      "x-systemd.automount"
+      "noatime"
+    ];
+  };

-    "/mnt/raspi-backup" = {
-      device = "${vars.nfsServerHost}:${vars.storageRoot}/raspi/volumes";
-      fsType = "nfs";
+ fileSystems."/mnt/raspi-backup" = {
+    device = "server:/tank/raspi/volumes";
+    fsType = "nfs";

-      options = [
-        "nfsvers=4.2"
-        "_netdev"
-        "x-systemd.automount"
-        "noatime"
-      ];
-    };
+    options = [
+      "nfsvers=4.2"
+      "_netdev"
+      "x-systemd.automount"
+      "noatime"
+    ];
  };
 }
@@ -1,22 +0,0 @@
-{ pkgs, vars, ... }:
-
-{
-  # Create nextcloud cron scheduled task
-  systemd.services.nextcloud = {
-    description = "Nextcloud scheduled task";
-    script = ''${pkgs.bash}/bin/bash ~/docker/services-up.sh --profile nextcloud exec -u 33 nextcloud-webapp php ./cron.php'';
-    serviceConfig = {
-      Type = "oneshot";
-      User = vars.primaryUser;
-    };
-    path = with pkgs; [ docker docker-compose ];
-  };
-
-  systemd.timers.nextcloud = {
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnCalendar = "*:0/5";
-      Persistent = true;
-    };
-  };
-}
@@ -5,42 +5,36 @@

 {
  imports =
-    [
-      (modulesPath + "/profiles/qemu-guest.nix")
+    [ (modulesPath + "/profiles/qemu-guest.nix")
    ];

-  boot = {
-    initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
-    initrd.kernelModules = [ ];
-    kernelModules = [ ];
-    extraModulePackages = [ ];
-
-    # Enable LISH
-    kernelParams = [ "console=ttyS0,19200n8" ];
-
-    loader = {
-      grub = {
-        device = "/dev/sda";
-        extraConfig = ''
-          serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
-          terminal_input serial;
-          terminal_output serial;
-        '';
-        forceInstall = true;
-        # device = "nodev";
-      };
-      timeout = 10;
-    };
-  };
+  boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+  boot.loader.grub.device = "/dev/sda";

  fileSystems."/" =
-    {
-      device = "/dev/sda";
+    { device = "/dev/sda";
      fsType = "ext4";
    };

  swapDevices =
-    [{ device = "/dev/sdb"; }];
+    [ { device = "/dev/sdb"; }
+    ];
+
+# Enable LISH
+boot.kernelParams = [ "console=ttyS0,19200n8" ];
+boot.loader.grub.extraConfig = ''
+  serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
+  terminal_input serial;
+  terminal_output serial;
+'';
+
+boot.loader.grub.forceInstall = true;
+# boot.loader.grub.device = "nodev";
+boot.loader.timeout = 10;
+

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }
@@ -5,16 +5,13 @@

 {
  imports =
-    [
-      (modulesPath + "/profiles/qemu-guest.nix")
+    [ (modulesPath + "/profiles/qemu-guest.nix")
    ];

-  boot = {
-    initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
-    initrd.kernelModules = [ ];
-    kernelModules = [ "kvm-amd" ];
-    extraModulePackages = [ ];
-  };
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
  # boot.loader.grub.device = "/dev/sda2"; # or "nodev" for efi only

  # fileSystems."/" =
@@ -1,251 +0,0 @@
-{ pkgs, lib, vars, ... }:
-
-{
-  imports = [
-    ./host-keys.nix
-  ];
-
-  networking.useDHCP = lib.mkDefault true;
-
-  # Recommended over the true default (bypasses ZFS's own import safeguards)
-  # per the option's own docs. This installer environment has no ZFS pools
-  # of its own to import, so this is a no-op here — just silences the
-  # eval-time warning, matching modules/common/configuration.nix.
-  boot.zfs.forceImportRoot = false;
-
-  time.timeZone = vars.timeZone;
-
-  # Without this, the installer only ever sees cache.nixos.org, which
-  # doesn't carry sops-install-secrets (it's built straight from the
-  # sops-nix flake's own Go source, not part of nixpkgs) — every install
-  # would otherwise compile it from scratch, which is what ran an 8GB LXC
-  # container's disk out of space. Push a built copy to nix-cache once
-  # (from a machine with real disk headroom) and every future install,
-  # of any type, fetches instead of rebuilding.
-  nix.settings = {
-    substituters = [
-      "http://nix-cache"
-      "https://cache.nixos.org/"
-    ];
-    trusted-public-keys = [
-      "cache.local-1:usoWYanY3Kpq2+kDIS2nhWoLZiRxanmdysdzqCFBHW4="
-      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-    ];
-  };
-
-  environment = {
-    systemPackages = with pkgs; [
-      git
-      curl
-      jq
-      parted
-      e2fsprogs
-      btrfs-progs
-      util-linux
-      disko
-    ];
-
-    # Write auto-install script to /root
-    etc."auto-install.sh" = {
-      text = ''
-            #!/run/current-system/sw/bin/bash
-            set -eux
-
-            set -euo pipefail
-
-        export FLAKE_BASE_URL="git+https://${vars.lanDomain}/beatzaplenty/nixos.git"
-
-        echo "Fetching available NixOS hosts from flake..."
-        # Two categories deliberately excluded from the menu:
-        #   lxc-*                 — these build a config.system.build.tarball
-        #                           meant for `pct restore` on Proxmox
-        #                           directly, not an install. Running
-        #                           nixos-install against one here would
-        #                           bind-mount / onto /mnt and then refuse to
-        #                           touch the filesystem it's currently
-        #                           running on — see docs/auto-installer.md.
-        #   installer/proxmox-lxc — these *are* the installer image's own
-        #                           flake targets, not deployable hosts;
-        #                           "installing" one means nixos-install-ing
-        #                           a copy of the installer into itself.
-        mapfile -t options < <(
-          nix eval --json --no-use-registries --no-accept-flake-config --extra-experimental-features "flakes nix-command" \
-            "''${FLAKE_BASE_URL}#nixosConfigurations" \
-            --apply builtins.attrNames \
-          | jq -r '.[]
-              | select(startswith("lxc-") | not)
-              | select(. != "installer")
-              | select(. != "proxmox-lxc")'
-        )
-
-        if [[ ''${#options[@]} -eq 0 ]]; then
-          echo "ERROR: No NixOS hosts found in ''${FLAKE_BASE_URL}#nixosConfigurations" >&2
-          exit 1
-        fi
-
-        echo "Note: lxc-* targets aren't installed this way — build them with"
-        echo "  nix build .#nixosConfigurations.<name>.config.system.build.tarball"
-        echo "and 'pct restore' the result on Proxmox directly. See docs/auto-installer.md."
-
-        echo "Choose the flake profile to install:"
-        select choice in "''${options[@]}"; do
-          if [[ -n "$choice" ]]; then
-            echo "You selected: $choice"
-            break
-          else
-            echo "Invalid selection. Try again."
-          fi
-        done
-
-        echo "Starting install with flake: ''${FLAKE_BASE_URL}#''${choice}"
-
-        # Optional: confirm before proceeding
-        read -rp "Proceed with installation? (y/N): " confirm
-        if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
-          echo "Aborted."
-          exit 1
-        fi
-
-        # A nix-cache host is *the* substituter/remote-builder for every other
-        # host once installed (its own config explicitly excludes itself from
-        # using either — see buildType != "nix-cache" in the nixos flake.nix).
-        # Installing one shouldn't depend on a nix-cache substituter either,
-        # for the same reason — plus in practice "nix-cache" only resolves over
-        # Tailscale, which a fresh installer environment was never connected to
-        # anyway, so it's dead weight even for non-nix-cache installs until
-        # that's sorted out. Override it away here specifically for nix-cache
-        # targets to keep install-time behaviour consistent with run-time.
-        nix_extra_opts=()
-        if [[ "''${choice}" == *-nix-cache ]]; then
-            echo "Installing a nix-cache host — skipping the nix-cache substituter."
-            nix_extra_opts+=(--option substituters "https://cache.nixos.org/")
-        fi
-
-        if nix eval --refresh --json  --extra-experimental-features "flakes nix-command" "''${nix_extra_opts[@]}" "''${FLAKE_BASE_URL}#nixosConfigurations.''${choice}.config.disko.devices.disk.main.device" >/dev/null 2>&1; then
-            disko --mode destroy,format,mount \
-                --flake "''${FLAKE_BASE_URL}#''${choice}" "''${nix_extra_opts[@]}" --yes
-        else
-            # No raw disk to partition — true for every LXC container, which has
-            # no block device visible from inside it, only its already-mounted
-            # root filesystem. nixos-install defaults to installing into /mnt; if
-            # nothing points /mnt at the real root, the new system gets built and
-            # written to a disconnected empty directory, never actually becomes
-            # bootable, and the container silently keeps running this installer
-            # environment forever. Bind-mount / onto /mnt so the install actually
-            # lands on the filesystem this container boots from.
-            echo "Selected host has no Disko configuration — installing in place via bind mount."
-            mount --bind / /mnt
-        fi
-
-        # sops-nix derives this host's decryption key from its own SSH host key
-        # at *activation* time, which runs before systemd would otherwise
-        # generate one on first boot. Without pre-seeding it here, secrets
-        # (including the login password) fail to decrypt on first boot.
-        # Generate the key with scripts/prepare-host-key.sh first.
-        #
-        # Two places a key can come from, checked in order:
-        #   /etc/host-keys  — baked into this image at build time (see
-        #                      modules/installer/host-keys.nix; only present
-        #                      if built with NIXOS_HOST_KEYS_DIR set)
-        #   /root/host-keys — scp'd in manually after boot (older fallback,
-        #                      still supported for images built without keys)
-        mkdir -p /root/host-keys
-        if [[ -f "/etc/host-keys/''${choice}_ssh_host_ed25519_key" ]]; then
-            echo "Found baked-in SSH host key for ''${choice}, installing to target..."
-            install -D -m 0600 "/etc/host-keys/''${choice}_ssh_host_ed25519_key" /mnt/etc/ssh/ssh_host_ed25519_key
-            install -D -m 0644 "/etc/host-keys/''${choice}_ssh_host_ed25519_key.pub" /mnt/etc/ssh/ssh_host_ed25519_key.pub
-        elif [[ -f "/root/host-keys/''${choice}_ssh_host_ed25519_key" ]]; then
-            echo "Found pre-seeded SSH host key for ''${choice}, installing to target..."
-            install -D -m 0600 "/root/host-keys/''${choice}_ssh_host_ed25519_key" /mnt/etc/ssh/ssh_host_ed25519_key
-            install -D -m 0644 "/root/host-keys/''${choice}_ssh_host_ed25519_key.pub" /mnt/etc/ssh/ssh_host_ed25519_key.pub
-        else
-            echo "WARNING: no SSH host key found for ''${choice} (checked /etc/host-keys and /root/host-keys)"
-            echo "sops-nix secrets (including the login password) will NOT decrypt on first boot."
-            echo "Run scripts/prepare-host-key.sh for host ''${choice} on your admin workstation first,"
-            echo "then either rebuild this image with NIXOS_HOST_KEYS_DIR set, or scp the result to"
-            echo "/root/host-keys/ on this machine."
-            read -rp "Continue without a pre-seeded key anyway? (y/N): " skip_key
-            if [[ ! "$skip_key" =~ ^[Yy]$ ]]; then
-                echo "Aborted."
-                exit 1
-            fi
-        fi
-
-        mkdir -p /mnt/install-tmp
-        export TMPDIR=/mnt/install-tmp
-
-        nixos-install \
-            --flake "''${FLAKE_BASE_URL}#''${choice}" \
-            "''${nix_extra_opts[@]}" \
-            --no-root-password
-
-
-            rm -rf /mnt/install-tmp
-            # Redundant copy of the host's private key — the real one is now at
-            # /etc/ssh/ssh_host_ed25519_key. Nothing NixOS-managed ever cleans this
-            # up on its own since it was written imperatively, not declaratively.
-            rm -rf /root/host-keys
-            sleep 10
-            reboot
-      '';
-
-      mode = "0755";
-    };
-  };
-
-  programs.git.enable = true;
-
-  # Run the installer on first login. Previously this copied an /etc file
-  # into the nixos user's ~/.bash_profile via an activation script that
-  # got dropped in a refactor (and only ever worked for that one user
-  # anyway) — loginShellInit is NixOS's native hook for this, applies to
-  # any user's login shell (root included), and needs no home-directory
-  # file-copying/chown.
-  programs.bash.loginShellInit = ''
-    if [ -n "$PS1" ] && [ ! -e "$HOME/.auto_install_ran" ]; then
-      sudo /etc/auto-install.sh
-      touch "$HOME/.auto_install_ran"
-    fi
-  '';
-
-  services.openssh.enable = true;
-
-  services.openssh.settings = {
-    PermitRootLogin = "yes";
-    PasswordAuthentication = true;
-  };
-
-  # nixpkgs' own installer profile (profiles/installation-device.nix, pulled
-  # in via installation-cd-minimal.nix) sets initialHashedPassword = "" for
-  # both users — its own passwordless-login convention for install media.
-  # That's a second, non-null password option alongside our hashedPassword
-  # below, which NixOS warns about as ambiguous precedence. Force it null
-  # rather than adopting passwordless login: this image now also boots over
-  # LAN PXE with PasswordAuthentication enabled, so passwordless root SSH
-  # would be reachable by anyone on the LAN, not just local console.
-  users.users.root = {
-    hashedPassword =
-      "$6$Kwv9KAyvcurAViQF$H4.u3feqGE7lVoNgkFXhE3n2Pmo//9JYDTCz8ifrVHBxPjwa1xMby7tEZ8Bpt5MXs9Rkx6/YbZWxs5CpH0s/70";
-    initialHashedPassword = lib.mkForce null;
-  };
-
-  users.users.${vars.primaryUser} = {
-    isNormalUser = true;
-
-    extraGroups = [
-      "wheel"
-    ];
-
-    shell = pkgs.bashInteractive;
-
-    hashedPassword =
-      "$6$Kwv9KAyvcurAViQF$H4.u3feqGE7lVoNgkFXhE3n2Pmo//9JYDTCz8ifrVHBxPjwa1xMby7tEZ8Bpt5MXs9Rkx6/YbZWxs5CpH0s/70";
-    initialHashedPassword = lib.mkForce null;
-
-    openssh.authorizedKeys.keys = [
-      vars.adminSshKey
-    ];
-  };
-
-  system.stateVersion = "26.05";
-}
@@ -1,37 +0,0 @@
-{ lib, ... }:
-
-let
-  # host-keys/ is gitignored (private key material must never be committed),
-  # which means flakes' git-filtered source tree can never see it via a
-  # normal relative path — referencing it at all requires stepping outside
-  # pure evaluation. builtins.getEnv is neutered to "" under normal
-  # `nix build`/`nix eval` (no error, just empty), so this whole module is a
-  # silent no-op unless the operator explicitly opts in with --impure and
-  # the env var set — safe by default, including in CI.
-  #
-  #   NIXOS_HOST_KEYS_DIR=$(pwd)/host-keys nix build .#iso --impure
-  #
-  # See docs/auto-installer.md.
-  hostKeysDirStr = builtins.getEnv "NIXOS_HOST_KEYS_DIR";
-  hasHostKeysDir = hostKeysDirStr != "" && builtins.pathExists hostKeysDirStr;
-  hostKeysDir = /. + hostKeysDirStr;
-
-  keyFileNames =
-    if hasHostKeysDir
-    then
-      lib.filter
-        (name: lib.hasSuffix "_ssh_host_ed25519_key" name || lib.hasSuffix "_ssh_host_ed25519_key.pub" name)
-        (lib.attrNames (builtins.readDir hostKeysDir))
-    else [ ];
-in
-{
-  environment.etc = lib.listToAttrs (map
-    (name: {
-      name = "host-keys/${name}";
-      value = {
-        source = hostKeysDir + "/${name}";
-        mode = "0400";
-      };
-    })
-    keyFileNames);
-}
@@ -1,8 +0,0 @@
-{ modulesPath, ... }:
-
-{
-  imports = [
-    "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix"
-    ./common.nix
-  ];
-}
@@ -1,12 +0,0 @@
-{ modulesPath, ... }:
-
-{
-  imports = [
-    ./common.nix
-    (modulesPath + "/virtualisation/proxmox-lxc.nix")
-  ];
-
-  # LXC has no bootloader
-  boot.loader.grub.enable = false;
-  boot.loader.systemd-boot.enable = false;
-}
@@ -1,9 +1,9 @@
-{ vars, ... }:
+{ ... }:

 {
  nix.settings = {
    substituters = [
-      "http://${vars.nixCacheHost}"
+      "http://nix-cache"
      "https://cache.nixos.org/"
    ];
    trusted-public-keys = [
@@ -1,28 +0,0 @@
-{ pkgs, vars, ... }:
-
-{
-  # Install the remote builder key on each client host (do not commit private keys):
-  #   sudo install -d -m 0700 /root/.ssh
-  #   sudo install -m 0600 ./nixremote /root/.ssh/nixremote
-  #   sudo ssh -i /root/.ssh/nixremote nixremote@nix-cache nix-store --version
-  nix = {
-    distributedBuilds = true;
-
-    buildMachines = [
-      {
-        hostName = vars.nixCacheHost;
-        sshUser = vars.remoteBuilderUser;
-        sshKey = "/root/.ssh/${vars.remoteBuilderUser}";
-        inherit (pkgs.stdenv.hostPlatform) system;
-        maxJobs = 4;
-        speedFactor = 2;
-        supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
-      }
-    ];
-
-    settings = {
-      builders-use-substitutes = true;
-      max-jobs = "auto";
-    };
-  };
-}
@@ -1,4 +1,4 @@
-{ config, pkgs, vars, ... }:
+{ config, pkgs, ... }:

 {
  # Generate the binary cache key pair on the nix-cache host:
@@ -9,43 +9,46 @@
  #   sudo chmod 0600 /etc/nix/cache-priv.pem
  #   sudo chmod 0644 /etc/nix/cache-pub.pem
  #   cat /etc/nix/cache-pub.pem
-  services = {
-    nix-serve = {
-      enable = true;
-      secretKeyFile = "/etc/nix/cache-priv.pem";
-    };
+  services.nix-serve = {
+    enable = true;
+    secretKeyFile = "/etc/nix/cache-priv.pem";
+  };

-    nginx = {
-      enable = true;
-      recommendedProxySettings = true;
-      virtualHosts.${vars.nixCacheHost} = {
-        locations."/" = {
-          proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
-        };
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    virtualHosts."nix-cache" = {
+      locations."/" = {
+        proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
      };
    };
-
-    openssh.enable = true;
  };

  networking.firewall.allowedTCPPorts = [ 80 ];

-  users.groups.${vars.remoteBuilderUser} = { };
+  users.groups.nixremote = {};

-  users.users.${vars.remoteBuilderUser} = {
+  users.users.nixremote = {
    isSystemUser = true;
-    group = vars.remoteBuilderUser;
+    group = "nixremote";
    createHome = true;
    home = "/var/lib/nixremote";
    shell = pkgs.bashInteractive;
-    # Client public keys allowed to use this host as a remote builder —
-    # single source of truth is vars.remoteBuilderAuthorizedKeys (safe to
-    # commit public keys only).
-    openssh.authorizedKeys.keys = vars.remoteBuilderAuthorizedKeys;
+    # Provide remote builder public keys here (safe to commit public keys only):
+    # openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAA... client@host" ];
+    #
+    # Avoid absolute keyFiles paths here because they break pure flake evaluation.
+    openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server"
+					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAYIT9ormlmxZ0SziyDQaUntnKI8HK9/s3Qac1ZKjP2 root@docker" 
+					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos"
+					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos"
+					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server"];
  };

+  services.openssh.enable = true;
+
  nix.settings = {
-    trusted-users = [ "root" vars.remoteBuilderUser ];
+    trusted-users = [ "root" "nixremote" ];
    experimental-features = [ "nix-command" "flakes" ];
    auto-optimise-store = true;
    builders-use-substitutes = true;
@@ -1,38 +1,8 @@
-{ lib, modulesPath, ... }:
+{ ... }:

 {
-  # LXC containers share the host kernel — Proxmox starts them by exec'ing
-  # /sbin/init directly, no bootloader/initrd involved — and Proxmox has its
-  # own container hostname/network provisioning outside Nix. nixpkgs' own
-  # virtualisation/proxmox-lxc.nix module already handles all of this
-  # correctly (boot.isContainer, loader.initScript, systemd-networkd) and,
-  # critically, provides config.system.build.tarball — a directly
-  # `pct restore`-able container image, no nixos-install/bind-mount needed
-  # (nixos-install refuses to touch the filesystem it's currently running
-  # on, which is exactly what bind-mounting / onto /mnt for an installer
-  # LXC container does).
-  imports = [
-    (modulesPath + "/virtualisation/proxmox-lxc.nix")
-  ];
+  boot.isContainer = true;

-  proxmoxLXC = {
-    # host.nix declares each host's real hostname (networking.hostName);
-    # keep that instead of letting Proxmox's ambient container config win.
-    manageHostName = true;
-    # Unprivileged matches how these containers are actually created.
-    privileged = false;
-  };
-
-  boot.loader = {
-    grub.enable = false;
-    systemd-boot.enable = false;
-  };
-
-  # NetworkManager depends on a running udevd to enumerate/classify devices,
-  # which boot.isContainer disables (see nixpkgs' container-config.nix) —
-  # that's what broke DHCP-hostname registration in Pi-hole. The imported
-  # proxmox-lxc.nix module already switches networking to systemd-networkd
-  # for the same reason; it just doesn't disable NetworkManager itself,
-  # which modules/common/configuration.nix enables for every host.
-  networking.networkmanager.enable = lib.mkForce false;
+  boot.loader.grub.enable = false;
+  boot.loader.systemd-boot.enable = false;
 }
@@ -1,23 +0,0 @@
-{ netbootSystem, ... }:
-
-let
-  # config.system.build.kernel and .netbootRamdisk are directories, not the
-  # files themselves — nixpkgs' own system.build.kexecTree does the same
-  # ${...}/<file> dereference for the same reason.
-  inherit (netbootSystem.config.system.boot.loader) kernelFile;
-in
-{
-  # Builds this flake's own installer netboot image (the same one
-  # `nix build .#pxe` produces) and stages it where menu.ipxe's :nixos
-  # entry expects it, so the pxe-boot host is self-contained — no manual
-  # operator step to populate /srv/pxe/http/nixos after deploy.
-  systemd.tmpfiles.rules = [
-    # Declared here too (not just in build-types/pxe-boot.nix) so this
-    # module's C+ rules don't depend on cross-module list-merge ordering —
-    # tmpfiles' C type needs the target directory to already exist.
-    "d /srv/pxe/http/nixos 0755 root root -"
-    "C+ /srv/pxe/http/nixos/${kernelFile} 0644 root root - ${netbootSystem.config.system.build.kernel}/${kernelFile}"
-    "C+ /srv/pxe/http/nixos/initrd 0644 root root - ${netbootSystem.config.system.build.netbootRamdisk}/initrd"
-    "C+ /srv/pxe/http/nixos/netboot.ipxe 0644 root root - ${netbootSystem.config.system.build.netbootIpxeScript}/netboot.ipxe"
-  ];
-}
@@ -1,26 +1,26 @@
-{ vars, ... }:
+{ ... }:

 {
-  fileSystems."/mnt/raspi" = {
-    device = "raspberrypi.${vars.tailnetDomain}:/home/raspi/raspi";
-    fsType = "nfs4";
-    options = [
-      "nofail"
-      "_netdev"
-      "noatime"
+fileSystems."/mnt/raspi" = {
+  device = "raspberrypi.tail13f623.ts.net:/home/raspi/raspi";
+  fsType = "nfs4";
+  options = [
+    "nofail"
+    "_netdev"
+    "noatime"

-      # Don't mount until first access
-      "x-systemd.automount"
+    # Don't mount until first access
+    "x-systemd.automount"

-      # Unmount after 10 min idle
-      "x-systemd.idle-timeout=600"
+    # Unmount after 10 min idle
+    "x-systemd.idle-timeout=600"

-      # Give the Pi/Tailscale a little time to appear
-      "x-systemd.device-timeout=10s"
+    # Give the Pi/Tailscale a little time to appear
+    "x-systemd.device-timeout=10s"

-      # Explicitly use NFSv4.2 if supported
-      "nfsvers=4.2"
-    ];
-  };
+    # Explicitly use NFSv4.2 if supported
+    "nfsvers=4.2"
+  ];
+};

-}
+}
@@ -0,0 +1,26 @@
+{ pkgs, ... }:
+
+{
+  # Install the remote builder key on each client host (do not commit private keys):
+  #   sudo install -d -m 0700 /root/.ssh
+  #   sudo install -m 0600 ./nixremote /root/.ssh/nixremote
+  #   sudo ssh -i /root/.ssh/nixremote nixremote@nix-cache nix-store --version
+  nix.distributedBuilds = true;
+
+  nix.buildMachines = [
+    {
+      hostName = "nix-cache";
+      sshUser = "nixremote";
+      sshKey = "/root/.ssh/nixremote";
+      system = pkgs.stdenv.hostPlatform.system;
+      maxJobs = 4;
+      speedFactor = 2;
+      supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
+    }
+  ];
+
+  nix.settings = {
+    builders-use-substitutes = true;
+    max-jobs = "auto";
+  };
+}
@@ -1,7 +1,7 @@
-_:
+{ ... }:

 {
-  services.logrotate = {
+      services.logrotate = {
    enable = true;

    settings = {
@@ -15,6 +15,6 @@ _:
        copytruncate = true;
      };

-    };
+     };
  };
-}
+}
@@ -1,4 +1,4 @@
-{ pkgs, vars, ... }:
+{ pkgs, ... }:

 {
  systemd.services.docker-health-to-gotify = {
@@ -7,9 +7,9 @@
    serviceConfig = {
      Type = "oneshot";
      # Run as root so it can read /etc/secrets and access docker socket
-      # User = "root";
+     # User = "root";
      #EnvironmentFile = "-/etc/secrets/docker-health-alert.env";
-      ExecStart = "${pkgs.bash}/bin/bash /home/${vars.primaryUser}/docker/monitoring/gotify/docker-health-to-gotify.sh";
+      ExecStart = "${pkgs.bash}/bin/bash /home/nixos/docker/monitoring/gotify/docker-health-to-gotify.sh";
      StandardOutput = "journal";
      StandardError = "journal";
    };
@@ -25,4 +25,4 @@
      Persistent = true;
    };
  };
-}
+}
@@ -1,5 +1,5 @@
-_:
-
-{
-  services.rpcbind.enable = true;
-}
+ { ... }:
+ 
+ {
+ services.rpcbind.enable = true;
+ }
@@ -0,0 +1,22 @@
+{ pkgs, ... }:
+
+{
+# Create nextcloud cron scheduled task
+systemd.services.nextcloud = {
+  description = "Nextcloud scheduled task";
+  script = ''${pkgs.bash}/bin/bash ~/docker/services-up.sh --profile nextcloud exec -u 33 nextcloud-webapp php ./cron.php'';
+  serviceConfig = {
+    Type = "oneshot";
+    User = "nixos";
+  };
+  path = with pkgs; [ docker docker-compose ];
+};
+
+systemd.timers.nextcloud = {
+  wantedBy = [ "timers.target" ];
+  timerConfig = {
+    OnCalendar = "*:0/5";
+    Persistent = true;
+  };
+};
+}
@@ -1,12 +1,12 @@
 { pkgs, boot, ... }:

 {
-  boot.postBootCommands = ''
-    echo "=== STARTING ZPOOL IMPORT ==="
-    ${pkgs.zfs_unstable}/bin/zpool import -a -N -d /dev/disk/by-path
-    ${pkgs.zfs_unstable}/bin/zpool status
-    ${pkgs.zfs_unstable}/bin/zfs mount -a
-    ${pkgs.zfs_unstable}/bin/zfs list
-      echo "=== ZPOOL IMPORT COMPLETE ==="
-  '';
-}
+boot.postBootCommands = ''
+  echo "=== STARTING ZPOOL IMPORT ==="
+  ${pkgs.zfs_unstable}/bin/zpool import -a -N -d /dev/disk/by-path
+  ${pkgs.zfs_unstable}/bin/zpool status
+  ${pkgs.zfs_unstable}/bin/zfs mount -a
+  ${pkgs.zfs_unstable}/bin/zfs list
+    echo "=== ZPOOL IMPORT COMPLETE ==="
+'';
+ }
@@ -1,21 +1,16 @@
 { pkgs, ... }:

-{
-  boot = {
-    supportedFilesystems = [ "zfs" ];
-    zfs = {
-      forceImportRoot = false;
-      package = pkgs.zfs_unstable;
-      devNodes = "/dev/disk/by-id";
-    };
-  };
-
-  services.zfs = {
+ {
+boot.supportedFilesystems = [ "zfs" ];
+  boot.zfs.forceImportRoot = false;
+  boot.zfs.package = pkgs.zfs_unstable;
+      services.zfs = {
    autoScrub.enable = true;
    autoSnapshot.enable = true;
    trim.enable = true;
  };

-  #systemd.services.zfs-import-cache.enable = true;
-  systemd.services.zfs-mount.enable = true;
-}
+#systemd.services.zfs-import-cache.enable = true;
+systemd.services.zfs-mount.enable = true;
+boot.zfs.devNodes = "/dev/disk/by-id";
+ }
@@ -1,4 +1,4 @@
-_:
+{ ... }:

 {
  i18n.defaultLocale = "en_AU.UTF-8";
@@ -15,4 +15,4 @@ _:
    LC_TIME = "en_AU.UTF-8";
  };

-}
+}
@@ -1,5 +1,5 @@
-_:
+{ ... }:

 {
-  services.tailscale.enable = true;
-}
+    services.tailscale.enable = true;
+}
@@ -1,4 +1,4 @@
-{ vars, ... }:
+{ ... }:

 {
  services.tailscale = {
@@ -6,7 +6,7 @@

    extraUpFlags = [
      "--advertise-exit-node"
-      "--advertise-routes=${vars.lanCidr}"
+      "--advertise-routes=192.168.2.0/24"
    ];
  };
 }
@@ -1,75 +0,0 @@
-#!/usr/bin/env bash
-# Generates a new machine's SSH host key ahead of installing it, so
-# sops-nix has something to derive an age key from before the target
-# ever boots.
-#
-# Why this is needed: sops-nix derives each host's decryption key from
-# its own /etc/ssh/ssh_host_ed25519_key at *activation* time, but that
-# activation runs before systemd would otherwise generate this key on
-# first boot (sshd-keygen is a normal systemd service gated behind
-# multi-user.target; activation scripts run earlier than that). Without
-# pre-seeding, secrets — including the root/nixos login password — fail
-# to decrypt on the machine's very first boot.
-#
-# This script only touches your admin workstation and this repo's
-# .sops.yaml (it never contacts the target machine). Run it, follow the
-# printed next steps, then use the resulting key with the auto-install.sh
-# prompt (see modules/installer/common.nix) when you actually install the
-# new machine.
-set -euo pipefail
-
-repo_root="$(cd "$(dirname "$0")/.." && pwd)"
-
-hostname="${1:?usage: scripts/prepare-host-key.sh <hostname> [path-to-nixos-repo]}"
-nixos_repo="${2:-$repo_root}"
-sops_yaml="${nixos_repo}/.sops.yaml"
-
-if [[ ! -f "$sops_yaml" ]]; then
-  echo "ERROR: $sops_yaml not found. Pass the nixos repo path as the 2nd argument." >&2
-  exit 1
-fi
-
-keydir="${repo_root}/host-keys"
-mkdir -p "$keydir"
-keyfile="${keydir}/${hostname}_ssh_host_ed25519_key"
-
-if [[ -f "$keyfile" ]]; then
-  echo "ERROR: $keyfile already exists. Remove it first if you want to regenerate." >&2
-  exit 1
-fi
-
-nix-shell -p openssh --run "ssh-keygen -t ed25519 -N '' -C '${hostname}' -f '${keyfile}'" >/dev/null
-
-age_pub="$(nix-shell -p ssh-to-age --run "ssh-to-age -i '${keyfile}.pub'")"
-
-cat <<EOF
-
-Generated: ${keyfile}(.pub)
-
-=== 1. Add this line under keys: in ${sops_yaml} ===
-  - &${hostname} ${age_pub}
-
-=== 2. Add *${hostname} to whichever creation_rules key_groups this host needs ===
-(e.g. secrets/common.yaml always; add a per-host secrets/${hostname}.yaml
- block too if this host will get its own secrets, same pattern as
- nix-cache/server.)
-
-=== 3. Re-encrypt every secrets file you just added it to ===
-  nix-shell -p sops --run 'sops updatekeys ${nixos_repo}/secrets/common.yaml'
-
-=== 4. Commit + push this repo so the flake build picks up the new recipient ===
-
-=== 5. Get the key onto the installer, one of two ways ===
-  a) Rebuild the installer image with all host-keys/ baked in (see
-     docs/auto-installer.md):
-       NIXOS_HOST_KEYS_DIR="${keydir}" nix build .#iso --impure
-     (or .#lxc / .#pxe / .#all — --impure is required since host-keys/
-     is gitignored and flakes can't see it otherwise)
-
-  b) Or, for an image already built without keys, scp it in after boot:
-       scp ${keyfile}{,.pub} root@<target-ip>:/root/host-keys/
-
-Then continue with /etc/auto-install.sh as normal — it checks
-/etc/host-keys (baked in) before /root/host-keys (scp'd) and installs
-whichever it finds before running nixos-install.
-EOF
@@ -5,67 +5,40 @@ sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmaFVBeVp3Zk80TG1OU045
-            b204QzFYL1psVm1xdlBVYmVIWFpKVnJWbUdvCnJRVGVUbElPYVczeEdkSDU4WGYz
-            bkliK0dGcitjZnRYUXJQVVpTY2gva0kKLS0tIHBxMDBNYWJrSHAvNlZDWERmbVQ3
-            VDFscTRjdGpLUnk5VVdyTjY5MFNPSW8KX5Or/zoixFulaX8ljY4ke3jdhc3Jaw95
-            4BqrlILGapcOsmWTDkDZBtS81oNvlRnH+xaM2UJSe+nIplNcC+Cl2g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6NkpZRzJuMFNuV09WamR0
+            SERDN0VSUlNQbkhSem1EeFlxdlhmdUx0S21JCnY1VkRBQTBqcW9JRHpJWEtJSitN
+            dHkyR0I4ckNkWkpGWHAzZGRaZkhJalEKLS0tIHRrU3RhU3UxN3B4NHdLeStuSXQ4
+            anFkRlpMTHowZzJNdnY0MExQcXd4OUEKgbT7uOSFkfEs6t3X6jmGOiC28lDJWF33
+            50f2fZ771ylhHa6WJMetGZ5cwl9r1RCaDiWyJEaqNGe7NqARlhr3EQ==
            -----END AGE ENCRYPTED FILE-----
          recipient: age10nd382a9klsn2mrs60emdtsxe43pht3a0m9p29phfrhy0wfyt3vsq9r667
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1ZUZ0bXRGVFMzZzg1TzhE
-            N3kwYjdEV0tmcVdacVJHZUNXRHo1aHhXczFBCm1WcW51K3NSK25uMUFNb3NRbE9J
-            UE00VWNIclhVZHdPUmlNOXI1aGlhck0KLS0tIFphckVmRXZrTmI5K3BUL3NlMTAv
-            OG9RTHNEQXVMcXVWZXZnN2NYZ3hraUUKEXrloIgmADuRpa2YN2GIRYT+YN60pxga
-            bLeVDtBYU+KA+2F8S46o43ZmRTE2MXWlMhnZ35uNR4hgE3auKlIziA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDamw2ekY0dFZyOGNJelVa
+            ZGlNK2VNOWtWNTRzU3o2aVJvRi9CME5yS1JFCndlamdFMzVRTnoyVE1ZWXZkTjRR
+            eWdSZzZERHE5VElrOGZvcE4vK0g2d0EKLS0tIG15QlVyalZTK2NpVDdWWU4yUU4r
+            SkFncC9rZkNKUS9MSmF6WGQwOENwZTQKs5kLNLdQJoZtcsw3zlUWUUtJs0MJnuvw
+            o5vziOswRnuXENw//xN01nMDC6Ckzvb+q9GFIyxHLE4j3fT5XdZakg==
            -----END AGE ENCRYPTED FILE-----
          recipient: age19gfn2yedg76dmztm4hncr7vf3r3c9j0qpt4rap7y7gersjk4m3ks2lhd0e
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZdXBMY2t6U0VBWjRyWUV2
-            WS9oS0tWUnBQMWhPc3VsTVVKSnZSemxvU0FZCmFWbzFEZEZrMzJxTmpJKy9HY2F5
-            RHBjcUNYZ1R5ZHUxVmhPYjJRQkZyMU0KLS0tIGcvZ2hPQURmanJLRjRaNEJtTml3
-            dElTa2hZck1rSG1HcDBVSjZQNjhzT0EKgUylDuQBZkW1Z6AB/EsVbxcippw5XOeY
-            e+NDtqFixYR1u57+fKVl5dY281kspYIQDCUx1lBZiH7iwUPZWNtEfA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyaWpWTGd4TEVoaHg4b3hm
+            S1o3VXdkYkZCS0QxcW5hUWxyVjFneE5aSmp3ClNsdEZoMHpPUzI4K3B0ZnBYMlEw
+            MkJyd2NPcGJDZzgvc1EyWFBhNVlGUVEKLS0tIEptYXI2bnJHZVZGR3hSSm1sMlN5
+            ay8wdUh6TEowL0ZiUWtqbXl3NzhYOVEKW9l4mr+MLhuXA8sgQndaU8NiFeCMcxhG
+            qjKFn+mu2GFbwfZWAy6y/KUd9Ug4H6y3pNHlJMHupTu8v2wZ+3S4EA==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHYWtBYmU2Qk0vQ2dUQjUy
-            RGs1b1BzVm82Z210MGcrbnhiS0pCVnJzbkFVCnhpZUxSVmZTd0VSM0ZvZ01tM2hP
-            QlJ4NUQ0VjBBSXJGR0VScE5zNXhjVjgKLS0tIFZyNVF2a2VPdzhyZ1MzN3dYa0xx
-            U0tqTWZNSDdHU3Z5UHNBbGR6aFZ1MDQK7z0OC0yazekxpLmiKFuqWZm1rWMZqpXb
-            FGnZFMDdEwB5wTeiy4LCXS70zyr5eVT7KPeK25EG6pXQ4qqKZ12CyA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxVG13RVVweGpRM04vMWxG
+            V2hMMnp2Qk5Ub1BZQWNKNXVya3J4NGpreDJrCktqajVPRXdEL1BMU1dMbDhmU01L
+            UlQvRVQvcEFUZVZ5Umc3Y0hMUWNLVFEKLS0tIFgzRnF1RHdQdktDVjROSURYYTdx
+            NjAydjVuV1VCOGZoVFdTZmw1YmJ0eEEKN9KRGegafu1sjHlhyn4KCMPPAKxsSZLc
+            QJkei1ZQ0AVgC2QfCVEXonMOrs45nCIplG+uyER9khZyyjKObWk1pA==
            -----END AGE ENCRYPTED FILE-----
          recipient: age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqSG5NemtzUXlhelpvblFl
-            TldjUGVtZFFXWGM5ei9EN3V5N2ZLY0VRV0RJCnFNN1lVNmhWckFWbUVJd0grR2Ja
-            MmdYazZLUVFpelUyMFhta3dGSEc2Mm8KLS0tIHl4TlhhVFVOcmkxaHpKVWlrdEJx
-            VlBQazd5MG1yc3E0TzQrd3FmWG8wd00K8+cAm4oWVraERb8i8EurAnsR/L085uPR
-            zzIZEYW6hHxf9Ah9vMzM+3KIsnnS0Gr5QT8ATzpd8huXCqPNiveDFQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1qz9d4ka4xgexujyd247s7lp737sulp5fhxl5d65fj2ykvc4j4edqrsdks8
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQdDdQUEh6ejg3UG1LMi8w
-            bTJacGZQY3dUVEtJY3NGeWpxYWRITkZpN2swClVmb2F5N0phYzRXVG1RY1NsUm52
-            OWVLY3FJU0JXcGFVZDJGdVJ0dVhBN0UKLS0tIEl2b3JjV2JaS0crMnRpZElGdDZS
-            MDFyelRvcUsyUDdtai9IYnpHK3g2L2cKlvZloUKACDy9OyRI7ruPUjYqFENXzcVI
-            amFHFTbEGKVWIPwDjEwsMT+S4bHBkNWyny5dD5CrBpk7fiyQ+5U8+Q==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age120whqj96g26lsgy4udvgsn8dc9lumh8jeu3a564fx79rjr5lxffqmrljuu
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTZnZIa2xXM3RIYk1tbitC
-            NlRTeXFib3JDdXdhR01ZdUl6Z09vWmllRGxBCnpPalo4K0JhRlNpQ2d0b2RNcjUx
-            K3FRaXdMVHZud2FKRkw4UDREL1NrMDgKLS0tIE5CZDBHRXNscG9JK1hvWlZPVjJy
-            d0d2VnE4bXd6MGNPVzVUdFdocDYzcHcKW2Hs5oBO5ooc/uqWV/TOjq1xsxFR204s
-            GRtFUOg9tfglk3TcQbgZV0/pYlBJYzgb7iZD0qVe4XYj68q1A1bPwQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age164px2a8e48ptsf9ngtan38aa6jls4jdl26mzrgzf6sn3vcvt49hqjrgr8w
    lastmodified: "2026-07-19T02:30:40Z"
    mac: ENC[AES256_GCM,data:UiL3VMDF6rq4Nr87KspcDx434q3tfNXeb5pwH2O+4ssNQ6xzcYDdzXBnhAY3zLBsqPMKrvHBd4Ot/gEMcq3FMIVe7Q6p9yWKpep66KZ/yWEhAlwIVhD79Oj8VS+1CHKjf25zpRdhZorp04oeFQQd9VfjJB4EE/Q1aVbwTGlpIic=,iv:i/0conaFgFia+wzNTdUL6tlSTw35HTK3Ap1Sr5RGHf8=,tag:ULbz5FllShA/JjlSRdxA0g==,type:str]
    unencrypted_suffix: _unencrypted
@@ -3,31 +3,22 @@ sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDbHd1Y1dpa2ZiQ2E1bXRP
-            SnkrWHI0V2U1eGFKY0RZamZQQjluS0hGeENZCmduUFQyd1Q5RkZGMGFoenJhNmZh
-            VmZ2OStNaFpJejFxQ2JUZXFpNThaMncKLS0tIEhJdGdQeXEzb25Nbk5YZktCWVUz
-            NUJDUWRoTkd5R2pFblZjS0NSbVR5dkkKDYeW+zRpha04/CasFM91K6v1PpkNGHRu
-            qAoKs9KSg9VxS7ya8RuLmylKRdpPkupm/8SXIJvQuCXp5LWmNJ4zkA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkb29VM3haQ0c0WDY0STVn
+            L1ZyOUROSnR6ZjZZZWc1VGFFNVp6bWxCV3hZCnlGTC9CbEtIM3MvSGJQaStEbzJ0
+            eWVhY2l6UHNDRTYxdEpkd003WXFia2MKLS0tIHcxU3FPYTVuZ0RqZTZTT1RvZnN0
+            OGlQM3B2R0l4MHhWNXBBWmpiOEVxK1EK8kxh3ikKL6Fw2am3r7lPGpB0fCqzEukO
+            NU10Cbf38Bd+fybRbBnvRuu9To1FOf+KU3iKbsuWmZn4KJn4Ajcbhw==
            -----END AGE ENCRYPTED FILE-----
          recipient: age10nd382a9klsn2mrs60emdtsxe43pht3a0m9p29phfrhy0wfyt3vsq9r667
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4UktiUUdmd092bnZMdFMz
-            Q05xVlhnNzhPZUY4TjF5bjRCbklacTdJd1RBCnJ4bEVMaWRLZExIUFVEUDBXTnlV
-            MDU4WUk5VlJjdlhVUVpzZXlnWHhqTjQKLS0tIE9iclhGVElPcU9OLzF0bEVjMjVp
-            YzlQTGFYZEhLdTk3N3ZramVjVGRXREUKjOjqO/jX5iEKN43WiJ8qS/1mDfxdj8uO
-            K7Yyc/Yj0qMvGwLNzphjmbT29P7dXk4Ht4TedqCd+8DfhpOgLVIaSA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCNWRhK2QrV1ZibllqY25Y
+            ZVRPLzZ0TE82TWZ4L0w5ZmFPTDBtT0poODBnCkE5TWhJcXJjNkdva1hYZ3loeVdq
+            UlBXWHZpRUpMSGhPU0FIRi9JMEtTdGMKLS0tIE9yUk5Ebjk2MEFtNEkyR3RDcU51
+            ZVMwNnNRMlBMVVFlamU1U3JQSy9UT00KJZdEpRHuj4Dp1dGwP1z4xi9oddQOrQj2
+            qheEN/IlifVdZDpvlLUc8jgLzd/TO5EeEhVqfbdrlua8FHly29oTNw==
            -----END AGE ENCRYPTED FILE-----
          recipient: age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjaXpvQU9yRUc3ektPMmU5
-            Q0xLWU9mYXVOeTVBNGNsZzJPa1lkVlRUZHlvClhoSVV6YjB1Q3pTTzVvNFlNYkU4
-            Y2RrbFk5SUFKSDVjeFU0Wlc2aGFUMFUKLS0tIDlVeXM4WWRUakg4Zk5mcjdJL3VC
-            S1k5eFBpVnREQlZwYllpeTNhWW5GS1EKi2sMwyJJ0D8acjCZmxlcwdU1sglBuxR7
-            2SEMsctdGC+5E3ilPXvPpZ5RONZHbXxn6kQRBlBv6AJERpGDzsfgfA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age164px2a8e48ptsf9ngtan38aa6jls4jdl26mzrgzf6sn3vcvt49hqjrgr8w
    lastmodified: "2026-07-19T02:30:40Z"
    mac: ENC[AES256_GCM,data:7+FeT6aeCGn+JFBXbPO0qP4BJ1nHPSennewv1kWkG+hOTIqs1ymuswUK1Hyfi6Z9h2umFX9HvK+o3qtmYvk6k7BUNe6w6QUHTNwm6lmNqrb7sgAE3iFVI2p9m14NGhgoTfnXx1M4JIZ1iuNYhCukpENI4+svIe+r7x5YeE5Evac=,iv:4AKAPI6upyAvHBr8BLWX7R/NupmJdcXdqiN8e0ZQ3ls=,tag:TkpfpCaLhn+Mx5cQZZuMdA==,type:str]
    unencrypted_suffix: _unencrypted
@@ -1,44 +0,0 @@
-{
-  # Network / domains
-  lanDomain = "gitea.lan.ddnsgeek.com"; # Gitea/DDNS domain
-  homeDomain = "sweet.home"; # base LAN domain for service subdomains (pve., docker.)
-  tailnetDomain = "tail13f623.ts.net"; # Tailscale MagicDNS suffix
-  lanCidr = "192.168.2.0/24"; # LAN subnet
-  pxeServerIp = "192.168.2.247"; # pxe-boot host's LAN IP
-  pbsIp = "192.168.2.108"; # Proxmox Backup Server LAN IP
-
-  # Cross-host references (LAN hostnames/users other hosts reach over the network)
-  nixCacheHost = "nix-cache"; # substituter/remote-builder hostname
-  nfsServerHost = "server"; # NFS export source hostname
-  dockerHost = "docker"; # docker-compose stack host
-
-  remoteBuilderUser = "nixremote"; # remote builder SSH user
-
-  # Public keys authorized to SSH in as remoteBuilderUser on the nix-cache
-  # host (modules/nix-cache/server.nix) — one per client host that's allowed
-  # to use it as a distributed builder.
-  remoteBuilderAuthorizedKeys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAYIT9ormlmxZ0SziyDQaUntnKI8HK9/s3Qac1ZKjP2 root@docker"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
-  ];
-
-  # Admin SSH public key, authorized on the primary user of every host and
-  # the installer image's nixos/root users.
-  adminSshKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq/Q5LvIXlZwO2kdeAN5nLGZ59nZB7JHYMEszHxmNtGMzv1lM31jiPNsr0z2EKVZhE7OOfa2IF9rhWYD7JUA9G0yzdZ4WTXFNGVVOJoOVH6vAF3XCxoVilOEwTc7h2Wiy+rzd0B28/3spffzQQWJhY6GRQVa8j+6xAGF60Fcvl1vLosYT9Bn2ZbK4TCWOwAn2jqXIieGpZdn/UNZbGOeKRiCvhktDfMAzuQzN/9jMu/oF4pkPn2X1UrsQdNlvp0Ci8md612MozIpncQJyAF1ADhunr3sMx0isUXiqD29R5DS4TftpekqLNLak+zcxFa8N7DcRNp3DcKfJvyTkwQrR4r+b7lFLYOLHLagSso9CzeW/paAS2q9I5SBm/2DtE1diLLg2jZikYcstsu/G5RgvbzbKqjiaMwTdXC3AMvDxQrs7U5pDRZFzoofG3cpODbTm+uy3m0kP70z0M1K45UbDG0p+itnTu9x40JbQEgefbx38AItNvAIx1A8HO4I1VX28= wayne@stream";
-
-  # System
-  timeZone = "Australia/Brisbane";
-  primaryUser = "nixos"; # main interactive user on every host
-
-  # Storage
-  storageRoot = "/tank"; # ZFS pool root on `server`
-
-  # Well-known ports for LAN services referenced from multiple hosts
-  beszelHubPort = 8090;
-  pveWebPort = 8006;
-  pbsWebPort = 8007;
-}