Fix LXC deployment path and clean up remaining eval warnings

LXC hosts (device busy fix): modules/platforms/lxc.nix now imports nixpkgs' own virtualisation/proxmox-lxc.nix, giving every lxc-* host a real config.system.build.tarball output — a directly `pct restore`-able Proxmox container image. This is the actual bug fix behind the "cannot remove real root directory: device busy or in use" error: lxc-* targets were only reachable through nixos-install, which bind-mounts / onto /mnt for containers (no raw disk to partition) and then correctly refuses to modify the filesystem it's currently running on. auto-install.sh's menu now excludes lxc-* targets entirely (they deploy via nix build + pct restore instead, see docs/auto-installer.md) — and, on the same reasoning, also excludes `installer`/`proxmox-lxc`, which are the installer image's own flake targets, not deployable hosts. manageHostName = true keeps host.nix's declared hostnames (upstream's default would let Proxmox's ambient container config win instead); privileged = false matches how these containers are actually created. Eval warnings, now zero across all 19 nixosConfigurations + 4 packages: - Multiple password options (root/nixos in the installer): nixpkgs' own installer profile sets initialHashedPassword = "" for passwordless login, conflicting with our explicit hashedPassword. Force-nulled the upstream option rather than adopting passwordless login, since this image now also boots over LAN PXE with PasswordAuthentication enabled. - boot.zfs.forceImportRoot default value: set explicitly to false (matching the two places that already did) in modules/common/configuration.nix and modules/installer/common.nix, covering every host and the installer alike. - Deprecated pkgs.system in modules/build-types/gui.nix: switched to pkgs.stdenv.hostPlatform.system. All confirmed non-behavioral where it matters: unrelated hosts' drvPaths are byte-identical to their pre-existing baselines throughout. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot
Migrate host-key tooling from nix-auto-installer, bake keys into images
2026-07-20 05:58:56 +10:00 · 2026-07-20 04:41:34 +10:00 · 2026-07-20 04:08:19 +10:00 · 2026-07-20 03:47:42 +10:00 · 2026-07-20 03:47:19 +10:00 · 2026-07-20 02:58:25 +10:00
59 changed files with 1425 additions and 563 deletions
@@ -6,9 +6,9 @@ result-*
 # Ignore automatically generated direnv output
 .direnv

-auto-installer/flake.lock
-auto-installer/result
-auto-installer/nixos-auto.iso
+# Locally-generated SSH host keys staged for transfer to a new machine
+# during install (see scripts/prepare-host-key.sh) — never commit these.
+host-keys/

 # Temporary Milestone 1 audit checklist (remove-sensetive-info-refactor.md)
 # - working notes only, never committed, deleted once every row is rotated.
@@ -3,6 +3,9 @@ keys:
  - &docker age19gfn2yedg76dmztm4hncr7vf3r3c9j0qpt4rap7y7gersjk4m3ks2lhd0e
  - &server age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
  - &nix-cache age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
+  - &lxc-minimal age1qz9d4ka4xgexujyd247s7lp737sulp5fhxl5d65fj2ykvc4j4edqrsdks8
+  - &nix-minimal age120whqj96g26lsgy4udvgsn8dc9lumh8jeu3a564fx79rjr5lxffqmrljuu
+  - &lxc-nix-cache age164px2a8e48ptsf9ngtan38aa6jls4jdl26mzrgzf6sn3vcvt49hqjrgr8w

 creation_rules:
  # Shared across every currently-deployed host: root/nixos password hash,
@@ -16,12 +19,16 @@ creation_rules:
          - *docker
          - *server
          - *nix-cache
+          - *lxc-minimal
+          - *nix-minimal
+          - *lxc-nix-cache

  - path_regex: secrets/nix-cache\.yaml$
    key_groups:
      - age:
          - *admin
          - *nix-cache
+          - *lxc-nix-cache

  - path_regex: secrets/server\.yaml$
    key_groups:
@@ -52,56 +52,76 @@ There is no test suite — "correctness" here means the flake evaluates and

 ## Architecture

-`flake.nix` is the single entry point. It defines one `nixosConfigurations.<host>`
-attribute per machine, each built the same way:
+`flake.nix` is the single entry point. It generates one
+`nixosConfigurations.<platform>-<buildtype>` attribute per target via the
+`mkTarget` function, composed from:

 ```
 nixosSystem {
  modules = [
    disko.nixosModules.disko
-    ./hosts/<host>/configuration.nix        # host-specific config
-    ./modules/hardware-configuration/vm/<proxmox|linode>.nix
+    sops-nix.nixosModules.sops
+    ./modules/common/configuration.nix
+    ./modules/platforms/${platform}.nix        # what it runs on
+    ./modules/build-types/${buildType}.nix     # what it's for
+    hostPath                                   # hosts/<name>/host.nix — per-machine identity
    home-manager.nixosModules.home-manager { ... }
-  ];
+  ] ++ (client-only modules, for every buildType except "nix-cache" itself)
 }
 ```

-Hosts currently defined in `flake.nix`: `nixos`, `docker`, `server`,
-`nix-cache`, `nix-minimal`, `pxe-boot`, `linode-minimal`. Treat `flake.nix` as
-the source of truth for which hosts exist — `README.md`, `AGENTS.md`,
+Platforms: `linode`, `proxmox`, `lxc`. Build types: `minimal`, `nix-cache`,
+`server`, `docker`, `gui`, `pxe-boot`. Not every combination is built — e.g.
+`pxe-boot` has no `linode` variant (PXE/DHCP/TFTP need LAN L2 adjacency a
+Linode VPS doesn't have). Treat `flake.nix`'s `generatedTargets` as the source
+of truth for which hosts exist — `README.md`, `AGENTS.md`,
 `docs/flake-lock-automation.md`, and the CI eval workflows
 (`.github/workflows/check-nixos.yml`, `.gitea/workflows/check-nixos.yml`) list
-hosts by hand and can drift from it, so re-check them against `flake.nix` when
-adding or removing a host.
+hosts by hand (or, for the CI workflows, evaluate the flake dynamically) and
+can drift from it, so re-check them against `flake.nix` when adding or
+removing a host.

 ### Composition pattern

-Every host's real configuration lives in `hosts/<host>/configuration.nix`,
-which is a thin list of `imports` pulling in reusable pieces from `modules/`:
-
- `modules/common/configuration.nix` — base NixOS config imported by (almost)
-  every host: locale, users, nix settings, git. Nearly always the first import.
- `modules/common/home.nix` / `hosts/<host>/home.nix` — Home Manager config for
-  the `nixos` user; the `nixos` workstation has its own, other hosts share
-  `modules/common/home.nix`.
+- `hosts/<name>/host.nix` — per-machine identity **only**: hostname, hostId,
+  per-machine secrets, `system.stateVersion`. These files carry no `imports`
+  of their own beyond narrow parameterized helpers (see
+  `modules/beszel/host-token.nix` below) — all shared behavior comes from the
+  platform/build-type modules composed in `flake.nix`, not from the host file.
+- `modules/platforms/{linode,proxmox,lxc}.nix` — platform-specific config:
+  boot method, guest tooling, and (for linode/proxmox) the hypervisor-specific
+  hardware config, imported directly by the platform module itself
+  (`../hardware-configuration/vm/{proxmox,linode}.nix`) — **not** wired in
+  from `flake.nix`. `lxc.nix` has no hardware-configuration counterpart since
+  containers share the host kernel.
+- `modules/build-types/*.nix` — what a system is for:
+  minimal/server/docker/gui/pxe-boot/nix-cache.
+- `modules/common/configuration.nix` — base NixOS config imported by every
+  host: locale, users, nix settings, git.
+- `modules/common/home.nix` / `hosts/nixos/home.nix` — Home Manager config for
+  the `nixos` user; the `nixos` workstation (`gui` build type) has its own,
+  other hosts share `modules/common/home.nix`.
 - `modules/disko/proxmox.nix` — declarative disk layout (GPT: ESP + swap +
  ext4 root) via disko, used by all Proxmox-VM hosts.
 - `modules/boot/efi.nix` — systemd-boot + EFI vars, paired with the disko module.
- `modules/hardware-configuration/vm/{proxmox,linode}.nix` — hypervisor-specific
-  hardware config, wired in from `flake.nix` (not from the host file).
- `modules/nix-cache/{client,server}.nix` + `modules/remote-builder-client.nix` —
-  binary cache substituter + SSH remote-builder wiring; see `docs/nix-cache.md`
-  for the full design (per-host local stores, no shared `/nix/store`, and how
-  the `nixremote` signing/SSH keys fit together).
- `modules/tailscale/`, `modules/docker/`, `modules/beszel/`,
-  `modules/services/*` — single-purpose, single-host feature modules (e.g.
-  `docker/enable-service.nix`, `services/zfs/enable-service.nix`,
-  `beszel/enable-agent.nix` for monitoring). Grep `hosts/*/configuration.nix`
-  for the `imports` list to see which modules apply to a given host.
+- `modules/nix-cache/{client,server,remote-builder-client}.nix` — binary cache
+  substituter + SSH remote-builder wiring; see `docs/nix-cache.md` for the
+  full design (per-host local stores, no shared `/nix/store`, and how the
+  `nixremote` signing/SSH keys fit together).
+- `modules/beszel/host-token.nix` — parameterized helper module
+  (`{ name, sopsFile }`) that wires a host's beszel-agent sops secret/template
+  and `environmentFile`; used by `hosts/server/host.nix` and
+  `hosts/nix-cache/host.nix` to avoid duplicating that boilerplate.
+- `modules/tailscale/`, `modules/docker/`, `modules/networking/`,
+  `modules/traefik/`, `modules/services/*` — single-purpose, single-host
+  feature modules (e.g. `docker/enable-service.nix`,
+  `services/zfs/enable-service.nix`). Grep `modules/build-types/*.nix` for
+  each build type's `imports` list to see which modules apply where.

-New host = new `hosts/<name>/configuration.nix` + a matching block added to
-`flake.nix`'s `nixosConfigurations`, composed from existing `modules/*` pieces
-rather than duplicating config.
+New host = new `hosts/<name>/host.nix` + a matching
+`mkTarget { platform; buildType; hostPath; }` entry added to `flake.nix`'s
+`generatedTargets`, composed from existing `modules/*` pieces rather than
+duplicating config.

 ### Other docs worth reading before touching these areas

@@ -46,14 +46,17 @@ nix eval --json .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]'
 | Path | Purpose |
 | --- | --- |
 | `flake.nix` | Flake inputs, the `mkTarget` platform × build-type generator, and `nixosConfigurations` outputs |
+| `variables.nix` | Single source of truth for shared values (LAN domain/CIDR, hostnames, timezone, primary username, storage root, ...) — passed to every module and Home Manager config as the `vars` argument via `specialArgs`/`extraSpecialArgs` |
 | `hosts/<name>/host.nix` | Per-machine identity: hostname, hostId, per-machine secrets, `system.stateVersion` |
 | `hosts/nixos/home.nix` | Workstation-specific Home Manager config (used by the `gui` build type) |
 | `modules/platforms/` | Platform-specific config: virtualisation guest tools, boot method, hardware config (`linode.nix`, `proxmox.nix`, `lxc.nix`) |
 | `modules/build-types/` | Build-type-specific config: what makes a system minimal/server/docker/gui/pxe-boot/nix-cache |
 | `modules/common/` | Shared NixOS config, Home Manager, aliases imported by every host |
 | `modules/nix-cache/` | Binary cache and remote builder client/server modules |
-| `docs/` | Operational notes for cache, builders, lock updates, and boot services |
-| `scripts/` | Codex setup and validation helpers |
+| `modules/installer/` | Auto-installer environment (ISO/netboot/Proxmox LXC) — see `docs/auto-installer.md` |
+| `host-keys/` | Gitignored, locally-generated SSH host keys for the auto-installer — see `docs/auto-installer.md` |
+| `docs/` | Operational notes for cache, builders, lock updates, boot services, and the auto-installer |
+| `scripts/` | Codex setup, validation, and host-key-prep helpers |

 ## Validation

@@ -0,0 +1,199 @@
+# Auto-installer
+
+This flake builds a self-contained NixOS installer environment that can
+install any host exposed by its own `nixosConfigurations`. It was migrated
+from a formerly-separate `nix-auto-installer` repo — everything it did now
+lives here.
+
+The installer provides a small NixOS install environment (ISO/netboot/Proxmox
+LXC) with SSH access, Git support, and an interactive installation script.
+Logging in as any user (root or `nixos`) runs `/etc/auto-install.sh`,
+discovers available hosts from this same flake, lets the operator choose a
+target, applies that host's Disko storage configuration, installs NixOS, and
+reboots.
+
+**This applies to every `nixosConfigurations` target except `lxc-*` hosts —
+see "LXC hosts" immediately below for why those are different.**
+
+## LXC hosts
+
+`lxc-*` targets (`lxc-minimal`, `lxc-nix-cache`, `lxc-server`, `lxc-docker`,
+`lxc-gui`, `lxc-pxe-boot`) are **not** installed via `auto-install.sh` — the
+interactive menu deliberately excludes them. Don't try to select one there;
+`nixos-install` would bind-mount `/` onto `/mnt` (LXC containers have no raw
+disk to partition) and then refuse to touch the filesystem it's currently
+running on — it's designed to protect exactly this case, so it just fails.
+
+`modules/platforms/lxc.nix` imports nixpkgs' own
+`virtualisation/proxmox-lxc.nix` module, which gives every `lxc-*` host a
+`config.system.build.tarball` output — a complete, directly Proxmox-importable
+container image, no install step at all:
+
+```sh
+nix build .#nixosConfigurations.lxc-minimal.config.system.build.tarball
+```
+
+Then, on the Proxmox host, `pct restore` (or the GUI's "Create CT" → upload
+template flow) that tarball directly as a new container. First boot runs
+`boot.postBootCommands` (registers the Nix store DB and system profile) —
+there's no separate activation step to run yourself.
+
+Host keys still need pre-seeding the same way as any other host (see "Host
+keys" below) — the sops-nix activation-vs-first-boot race is identical
+regardless of how the image reaches the machine. `NIXOS_HOST_KEYS_DIR=...
+nix build ... --impure` bakes the matching key into the tarball the same way
+it does for the ISO/PXE installer images.
+
+## Layout
+
+- `modules/installer/common.nix` — shared by every installer target: SSH
+  access, users, the generated `/etc/auto-install.sh` script, and the
+  `programs.bash.loginShellInit` hook that runs it on login.
+- `modules/installer/iso.nix` — ISO/netboot-specific: imports the stock
+  `installation-cd-minimal.nix` module plus `common.nix`. Also used, paired
+  with `netboot-minimal.nix`, to build the PXE netboot variant (see
+  `docs/pxe-boot.md`).
+- `modules/installer/proxmox-lxc.nix` — Proxmox LXC-specific: disables
+  bootloader options (containers don't need one) plus `common.nix`.
+- `modules/installer/host-keys.nix` — optionally bakes pre-generated SSH
+  host keys into the image; see "Host keys" below.
+- `scripts/prepare-host-key.sh` — admin-workstation pre-flight tool, see
+  "Creating a New Machine" below.
+
+Flake outputs:
+
+```nix
+nixosConfigurations.installer     # ISO/netboot installer image
+nixosConfigurations.proxmox-lxc   # Proxmox LXC-based installer image
+
+packages.x86_64-linux.iso   # installer ISO/netboot image
+packages.x86_64-linux.lxc   # Proxmox LXC installer tarball
+packages.x86_64-linux.pxe   # netboot-ipxe + netboot-initrd + netboot-kernel, bundled
+packages.x86_64-linux.all   # all three of the above, bundled
+```
+
+```sh
+nix build .#iso
+nix build .#lxc
+nix build .#pxe
+nix build .#all
+```
+
+The `pxe` variant is also built automatically as part of the `pxe-boot` host
+itself (`modules/pxe-boot/stage-installer-artifacts.nix`) and served over
+iPXE — see `docs/pxe-boot.md`.
+
+## Host keys
+
+`sops-nix` derives each host's decryption key from its own
+`/etc/ssh/ssh_host_ed25519_key`, generated at **activation** time — before
+systemd would otherwise generate one on first boot. Without pre-seeding this
+key, secrets (including the root/nixos login password) fail to decrypt on a
+genuinely fresh install.
+
+Generated host keys live in `host-keys/` at the repo root (`ssh_host_ed25519_key`
+ `.pub` pairs per hostname). This directory is **gitignored on purpose** —
+private key material must never be committed — which also means flakes can't
+see it through a normal relative path. `modules/installer/host-keys.nix`
+reads it through `builtins.getEnv`, which Nix silently returns as an empty
+string under normal (non-`--impure`) evaluation, so the module is a no-op —
+safe by default, including in CI — unless explicitly opted into:
+
+```sh
+NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build .#iso --impure
+```
+
+When built this way, every key currently in `host-keys/` is baked into the
+image at `/etc/host-keys/<hostname>_ssh_host_ed25519_key(.pub)`, and
+`auto-install.sh` automatically installs whichever one matches the flake
+target selected at install time — no manual per-host scp step needed.
+
+**Trade-off, accepted deliberately for this LAN-only setup:** baking keys in
+means every key present in `host-keys/` at build time becomes readable by
+anyone who can reach the built image — including, for the PXE variant, anyone
+who can reach the `pxe-boot` host's unauthenticated HTTP server. This is
+considered acceptable here because `pxe-boot` sits behind LAN-only network
+infrastructure, not the open internet. If that ever changes, reconsider this
+default.
+
+`auto-install.sh` still supports the older manual path as a fallback: if a
+host's key isn't baked in (`/etc/host-keys`), it checks `/root/host-keys`
+next, where you can `scp` a key in after boot, same as before this migration.
+
+## Storage
+
+Disk partitioning is handled by Disko — the installer has no hardcoded
+`parted`/`mkfs`/`mkswap`/`mount` commands. Each host defines its own layout
+via `disko.devices`; a host without one is installed in place via bind-mount
+(this is how every LXC container target works, since they have no raw block
+device to partition).
+
+## Installer process
+
+`/etc/auto-install.sh`:
+
+1. Queries `nixosConfigurations` from this flake over the network (`git+https://<lanDomain>/beatzaplenty/nixos.git`) — this happens at *install* time, not build time, so a generic installer image always sees whatever hosts are currently committed, without needing a rebuild.
+2. Presents them as a menu; confirms the choice.
+3. Skips the `nix-cache` substituter when installing a `nix-cache` host itself (consistent with that host's own runtime config).
+4. Runs `disko --mode destroy,format,mount` if the target has a Disko config, otherwise bind-mounts `/` onto `/mnt`.
+5. Installs the target's SSH host key from `/etc/host-keys` or `/root/host-keys` (see "Host keys" above).
+6. Runs `nixos-install --flake <url>#<choice> --no-root-password`.
+7. Cleans up and reboots.
+
+## Creating a new machine
+
+Do this instead of jumping straight to a plain install whenever the target
+host consumes any sops-nix secret — as of this writing, that's every host
+(`modules/common/configuration.nix` puts the root/nixos password hash and the
+GitHub token behind sops-nix for all of them).
+
+1. **On your admin workstation**, decide the new machine's flake target name
+   (`<platform>-<buildtype>`, e.g. `proxmox-server`) and generate + register
+   its host key:
+
+   ```sh
+   ./scripts/prepare-host-key.sh <hostname>
+   ```
+
+   This generates `host-keys/<hostname>_ssh_host_ed25519_key(.pub)` and
+   prints the `.sops.yaml` snippet to add, which secrets files to
+   re-encrypt it into, and the next steps below.
+
+2. **Edit `.sops.yaml`** with the printed snippet, then re-encrypt every
+   secrets file you added the new host to:
+
+   ```sh
+   nix-shell -p sops --run 'sops updatekeys secrets/common.yaml'
+   ```
+
+3. **Commit and push.** The flake build the installer uses has to see the
+   new recipient before you install, or decryption fails on first boot
+   regardless of the next step.
+
+4. **Build the installer image with keys baked in** (or reuse an already-serving `pxe-boot` host, which does this automatically once redeployed):
+
+   ```sh
+   NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build .#iso --impure
+   ```
+
+5. **Boot it on the target machine**, log in, select the new host's flake
+   target from the menu, confirm. `auto-install.sh` finds the baked-in key,
+   runs Disko + `nixos-install`, and reboots.
+
+6. **Verify after reboot:**
+
+   ```sh
+   ssh <new-host> ls /run/secrets/
+   ```
+
+   If that's empty or login fails, the host's age key most likely wasn't in
+   `.sops.yaml` (or wasn't re-encrypted into the secrets file it needs) when
+   `nixos-install` ran — fix `.sops.yaml`/`secrets/*.yaml`, push, then re-run
+   `nixos-install --flake .#<hostname> --no-root-password` from a rescue
+   environment against the existing `/mnt`, or just redo the install.
+
+## Safety
+
+This installer is destructive: `disko --mode destroy,format,mount` erases
+any disk defined by the selected host's Disko configuration. Always verify
+the selected host profile and target machine before confirming.
@@ -8,8 +8,8 @@ This repository configures `nix-cache` as a **binary cache server** and a **remo
 - Every machine still keeps and uses its own local `/nix/store`.
 - Clients prefer `http://nix-cache` for substitutes and keep `https://cache.nixos.org/` as fallback.
 - Clients can offload builds to `nix-cache` through SSH (`nix.distributedBuilds`).
- Client hosts import `modules/nix/cache-client.nix` and, when remote building is enabled, `modules/nix/remote-builder-client.nix`.
- The `nix-cache` host imports `modules/nix/cache-server.nix`.
+- Client hosts import `modules/nix-cache/client.nix` and, when remote building is enabled, `modules/nix-cache/remote-builder-client.nix`.
+- The `nix-cache` host imports `modules/nix-cache/server.nix`.

 ## Binary cache signing keys (on nix-cache)

@@ -52,8 +52,15 @@ The generated menu currently exposes entries for:
 - iPXE shell
 - Reboot

-Kernel and initrd artifacts for the NixOS installer entry must be placed under
-`/srv/pxe/http/nixos` by an operator or a separate build process.
+The NixOS installer entry chain-loads `/srv/pxe/http/nixos/netboot.ipxe`,
+which is nixpkgs' own generated netboot iPXE script (correct `init=`/`initrd=`
+kernel parameters included) rather than a hand-rolled boot line — that script
+in turn expects its kernel/initrd siblings in the same directory. All three
+files (`bzImage`, `initrd`, `netboot.ipxe`) are built from this flake's own
+`modules/installer/iso.nix` netboot image (the same one `nix build .#pxe`
+produces) and staged automatically by
+`modules/pxe-boot/stage-installer-artifacts.nix` via `systemd.tmpfiles.rules`
+— no manual operator step required.

 The SystemRescue entry expects the source ISO at:

@@ -23,6 +23,8 @@
    let
      system = "x86_64-linux";
      inherit (nixpkgs) lib;
+      pkgs = nixpkgs.legacyPackages.${system};
+      vars = import ./variables.nix;

      # Generates a nixosConfiguration from a platform (what it runs on) and
      # a build type (what it's for), plus the per-identity host.nix that
@@ -46,23 +48,24 @@
              home-manager = {
                useGlobalPkgs = true;
                useUserPackages = true;
+                extraSpecialArgs = { inherit vars; };
                users.nixos = import homeFile;
              };
            }
          ] ++ lib.optionals (buildType != "nix-cache") [
            ./modules/nix-cache/client.nix
-            ./modules/remote-builder-client.nix
+            ./modules/nix-cache/remote-builder-client.nix
          ];
-          specialArgs = { inherit inputs; };
+          specialArgs = { inherit inputs vars netbootSystem; };
        };

      # Generated platform x build-type matrix. pxe-boot has no linode
      # variant (PXE/DHCP/TFTP need LAN L2 adjacency, which a Linode VPS
      # doesn't have).
      generatedTargets = {
-        linode-minimal = mkTarget { platform = "linode"; buildType = "minimal"; hostPath = ./hosts/linode-minimal/host.nix; };
-        proxmox-minimal = mkTarget { platform = "proxmox"; buildType = "minimal"; hostPath = ./hosts/proxmox-minimal/host.nix; };
-        lxc-minimal = mkTarget { platform = "lxc"; buildType = "minimal"; hostPath = ./hosts/lxc-minimal/host.nix; };
+        linode-minimal = mkTarget { platform = "linode"; buildType = "minimal"; hostPath = ./hosts/nix-minimal/host.nix; };
+        proxmox-minimal = mkTarget { platform = "proxmox"; buildType = "minimal"; hostPath = ./hosts/nix-minimal/host.nix; };
+        lxc-minimal = mkTarget { platform = "lxc"; buildType = "minimal"; hostPath = ./hosts/nix-minimal/host.nix; };

        linode-nix-cache = mkTarget { platform = "linode"; buildType = "nix-cache"; hostPath = ./hosts/nix-cache/host.nix; };
        proxmox-nix-cache = mkTarget { platform = "proxmox"; buildType = "nix-cache"; hostPath = ./hosts/nix-cache/host.nix; };
@@ -84,9 +87,65 @@
        lxc-pxe-boot = mkTarget { platform = "lxc"; buildType = "pxe-boot"; hostPath = ./hosts/pxe-boot/host.nix; };
      };

+      # Auto-install environments (migrated from the former nix-auto-installer
+      # flake): a self-contained NixOS installer that boots, discovers this
+      # flake's own nixosConfigurations over the network, and runs
+      # nixos-install against whichever one the operator picks. These are
+      # deliberately not part of the platform x build-type matrix above —
+      # they're throwaway boot media, not persistent hosts, so they skip
+      # disko/sops-nix/home-manager and just need `vars`.
+      installerTargets = {
+        installer = nixpkgs.lib.nixosSystem {
+          inherit system;
+          modules = [ ./modules/installer/iso.nix ];
+          specialArgs = { inherit vars; };
+        };
+
+        proxmox-lxc = nixpkgs.lib.nixosSystem {
+          inherit system;
+          modules = [ ./modules/installer/proxmox-lxc.nix ];
+          specialArgs = { inherit vars; };
+        };
+      };
+
+      # Same installer environment, built as netboot (kernel + initrd +
+      # iPXE script) instead of an ISO — this is what packages.pxe bundles.
+      netbootSystem = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [
+          ./modules/installer/iso.nix
+          ({ modulesPath, ... }: {
+            imports = [
+              (modulesPath + "/installer/netboot/netboot-minimal.nix")
+            ];
+          })
+        ];
+        specialArgs = { inherit vars; };
+      };
+
    in
    {

-      nixosConfigurations = generatedTargets;
+      nixosConfigurations = generatedTargets // installerTargets;
+
+      # Buildable auto-installer artifacts (`nix build .#<name>`), migrated
+      # unchanged from nix-auto-installer's interface.
+      packages.${system} = rec {
+        iso = installerTargets.installer.config.system.build.isoImage;
+
+        lxc = installerTargets.proxmox-lxc.config.system.build.tarball;
+
+        pxe = pkgs.linkFarm "pxe" [
+          { name = "netboot.ipxe"; path = netbootSystem.config.system.build.netbootIpxeScript; }
+          { name = "initrd"; path = netbootSystem.config.system.build.netbootRamdisk; }
+          { name = "kernel"; path = netbootSystem.config.system.build.kernel; }
+        ];
+
+        all = pkgs.linkFarm "all" [
+          { name = "iso"; path = iso; }
+          { name = "lxc"; path = lxc; }
+          { name = "pxe"; path = pxe; }
+        ];
+      };
    };
 }
@@ -1,4 +1,4 @@
-{ ... }:
+_:

 {
  networking.hostName = "docker";
@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-  networking.hostName = "linode-minimal";
-
-  # Preserved from the pre-refactor `linode-minimal` target — stateVersion
-  # must never be bumped on an already-installed machine.
-  system.stateVersion = "26.05";
-}
@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-  networking.hostName = "lxc-minimal";
-
-  # No pre-existing deployed machine to preserve — pin explicitly to the
-  # current release rather than let it silently default.
-  system.stateVersion = "26.05";
-}
@@ -1,19 +1,19 @@
-{ config, ... }:
+{ vars, ... }:

 {
-  networking.hostName = "nix-cache";
+  imports = [
+    (import ../../modules/beszel/host-token.nix {
+      name = "nix-cache";
+      sopsFile = ../../secrets/nix-cache.yaml;
+    })
+  ];

-  sops.secrets."beszel-token".sopsFile = ../../secrets/nix-cache.yaml;
-  sops.templates."nix-cache-beszel.env".content = ''
-    TOKEN=${config.sops.placeholder."beszel-token"}
-  '';
+  networking.hostName = vars.nixCacheHost;

  services.beszel.agent.environment = {
    #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-    #HUB_URL = "http://docker.sweet.home:8090";
    KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
  };
-  services.beszel.agent.environmentFile = config.sops.templates."nix-cache-beszel.env".path;

  # Preserved from the pre-refactor `nix-cache` target — stateVersion must
  # never be bumped on an already-installed machine.
@@ -1,4 +1,4 @@
-{ ... }:
+_:

 {
  # Preserves the hostname of the existing, already-deployed machine
@@ -1,79 +1,82 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, vars, ... }:

 {

-    imports = [
+  imports = [
    ../../modules/common/aliases.nix
  ];

-  home.username = "nixos";         # your actual username
-  home.homeDirectory = "/home/nixos";
-  home.stateVersion = "25.05";        # match your NixOS stateVersion
+  home = {
+    username = vars.primaryUser;
+    homeDirectory = "/home/${vars.primaryUser}";
+    stateVersion = "25.05"; # match your NixOS stateVersion

-  programs.home-manager.enable = true;  # mandatory to activate HM
+    # Optional: packages
+    packages = with pkgs; [
+      git
+      vim
+      tmux
+      nextcloud-client
+      #    vscode
+      chromium
+    ];

-  # Optional: packages
-  home.packages = with pkgs; [
-    git
-    vim
-    tmux
-    nextcloud-client
-#    vscode
-    chromium
-  ];
+    # Optional: set environment vars
+    sessionVariables = {
+      EDITOR = "vim";
+    };

-  # Optional: set environment vars
-  home.sessionVariables = {
-    EDITOR = "vim";
+    file = {
+      ".local/share/applications/proxmox-chromium-app.desktop".text = ''
+        [Desktop Entry]
+        Type=Application
+        Name=Proxmox (Chromium)
+        Exec=chromium --app=https://pve.${vars.homeDomain}:${toString vars.pveWebPort} --window-size=1920,1080 --window-position=0,0
+        Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png
+        Terminal=false
+        Categories=Hypervisor;
+        StartupWMClass=PVE
+      '';
+      ".local/share/applications/pbs-chromium-app.desktop".text = ''
+        [Desktop Entry]
+        Type=Application
+        Name=Proxmox Backup Server (Chromium)
+        Exec=chromium --app=https://${vars.pbsIp}:${toString vars.pbsWebPort} --window-size=1920,1080 --window-position=0,0
+        Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png
+        Terminal=false
+        Categories=backup;
+
+      '';
+      ".local/share/applications/proxmox-firefox-app.desktop".text = ''
+        [Desktop Entry]
+        Type=Application
+        Name=Proxmox (Firefox)
+        Exec=firefox --new-instance https://pve.${vars.homeDomain}:${toString vars.pveWebPort} --profile ProxmoxWebApp --window-size=1920,1080 --class ProxmoxWebApp
+        Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png
+        Terminal=false
+        Categories=Hypervisor;
+        StartupWMClass=PVE
+      '';
+      ".local/share/applications/pbs-firefox-app.desktop".text = ''
+        [Desktop Entry]
+        Type=Application
+        Name=Proxmox Backup Server (Firefox)
+        Exec=firefox --new-window https://${vars.pbsIp}:${toString vars.pbsWebPort} --profile PbsWebApp --window-size=1920,1080 --class PbsWebApp
+        Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png
+        Terminal=false
+        Categories=backup;
+        StartupWMClass=PBS
+      '';
+    };
  };

+  programs.home-manager.enable = true; # mandatory to activate HM
+
  # Optional: enable bash (or zsh, fish...)
  programs.bash.enable = true;
-    services.nextcloud-client = {
+  services.nextcloud-client = {
    enable = true;
    # Optionally start in background directly
    startInBackground = true;
  };
-home.file = {
-  ".local/share/applications/proxmox-chromium-app.desktop".text = ''
-    [Desktop Entry]
-    Type=Application
-    Name=Proxmox (Chromium)
-    Exec=chromium --app=https://pve.sweet.home:8006 --window-size=1920,1080 --window-position=0,0
-    Icon=/home/nixos/.local/share/icons/proxmox.png
-    Terminal=false
-    Categories=Hypervisor;
-    StartupWMClass=PVE
-  '';
-  ".local/share/applications/pbs-chromium-app.desktop".text = ''
-    [Desktop Entry]
-    Type=Application
-    Name=Proxmox Backup Server (Chromium)
-    Exec=chromium --app=https://192.168.2.108:8007 --window-size=1920,1080 --window-position=0,0
-    Icon=/home/nixos/.local/share/icons/proxmox.png
-    Terminal=false
-    Categories=backup;
-
-  '';
-  ".local/share/applications/proxmox-firefox-app.desktop".text = ''
-    [Desktop Entry]
-    Type=Application
-    Name=Proxmox (Firefox)
-    Exec=firefox --new-instance https://pve.sweet.home:8006 --profile ProxmoxWebApp --window-size=1920,1080 --class ProxmoxWebApp
-    Icon=/home/nixos/.local/share/icons/proxmox.png
-    Terminal=false
-    Categories=Hypervisor;
-    StartupWMClass=PVE
-  '';
-  ".local/share/applications/pbs-firefox-app.desktop".text = ''
-    [Desktop Entry]
-    Type=Application
-    Name=Proxmox Backup Server (Firefox)
-    Exec=firefox --new-window https://192.168.2.108:8007 --profile PbsWebApp --window-size=1920,1080 --class PbsWebApp
-    Icon=/home/nixos/.local/share/icons/proxmox.png
-    Terminal=false
-    Categories=backup;
-    StartupWMClass=PBS
-  '';
-};
-}
+}
@@ -1,4 +1,4 @@
-{ ... }:
+_:

 {
  networking.hostName = "nixos";
@@ -1,4 +1,4 @@
-{ ... }:
+_:

 {
  networking.hostName = "pxe-boot";
@@ -1,22 +1,22 @@
-{ config, ... }:
+{ vars, ... }:

 {
-  networking.hostName = "server";
-  networking.hostId = "6689f93e";
+  imports = [
+    (import ../../modules/beszel/host-token.nix {
+      name = "server";
+      sopsFile = ../../secrets/server.yaml;
+    })
+  ];

-  sops.secrets."beszel-token".sopsFile = ../../secrets/server.yaml;
-  sops.templates."server-beszel.env".content = ''
-    TOKEN=${config.sops.placeholder."beszel-token"}
-  '';
+  networking.hostName = vars.nfsServerHost;
+  networking.hostId = "6689f93e";

  services.beszel.agent.environment = {
    #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-    #HUB_URL = "http://docker.sweet.home:8090";
    KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
-    EXTRA_FILESYSTEMS = "/tank/docker/volumes";
+    EXTRA_FILESYSTEMS = "${vars.storageRoot}/docker/volumes";
    LOG_LEVEL = "debug";
  };
-  services.beszel.agent.environmentFile = config.sops.templates."server-beszel.env".path;

  # Preserved from the pre-refactor `server` target — stateVersion must never
  # be bumped on an already-installed machine.
@@ -1,9 +1,9 @@
-{ ... }:
+{ vars, ... }:

 {
-services.beszel.agent.enable = true;
-services.beszel.agent.environment = {
-#DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-HUB_URL = "http://docker.sweet.home:8090";
-};
+  services.beszel.agent.enable = true;
+  services.beszel.agent.environment = {
+    #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
+    HUB_URL = "http://${vars.dockerHost}.${vars.homeDomain}:${toString vars.beszelHubPort}";
+  };
 }
@@ -0,0 +1,11 @@
+{ name, sopsFile }:
+
+{ config, ... }:
+
+{
+  sops.secrets."beszel-token".sopsFile = sopsFile;
+  sops.templates."${name}-beszel.env".content = ''
+    TOKEN=${config.sops.placeholder."beszel-token"}
+  '';
+  services.beszel.agent.environmentFile = config.sops.templates."${name}-beszel.env".path;
+}
@@ -1,6 +1,6 @@
-{ ... }:
+_:

 {
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
-}
+}
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, vars, ... }:

 {
  # Pins the Docker Engine version, carried forward from the pre-refactor
@@ -13,11 +13,11 @@
  imports = [
    ../docker/mount-data.nix
    ../docker/enable-service.nix
+    ../docker/nextcloud-cron-job.nix
+    ../docker/docker-health-to-gotify.nix
    ../tailscale/enable-service.nix
-    ../rotate-traefik-logs.nix
+    ../traefik/rotate-logs.nix
    ../raspi/mount-data.nix
-    ../services/nextcloud-cron-job.nix
-    ../services/docker-health-to-gotify.nix
    ../services/enable-rpcbind.nix
  ];

@@ -36,5 +36,5 @@
  users.users.nixos.extraGroups = [ "docker" ];
  services.openssh.settings.PermitRootLogin = "yes";

-  networking.firewall.allowedTCPPorts = [ 80 8080 443 8090 ];
+  networking.firewall.allowedTCPPorts = [ 80 8080 443 vars.beszelHubPort ];
 }
@@ -2,7 +2,7 @@

 {
  environment.systemPackages = with pkgs; [
-    inputs.nixos-conf-editor.packages.${pkgs.system}.nixos-conf-editor
+    inputs.nixos-conf-editor.packages.${pkgs.stdenv.hostPlatform.system}.nixos-conf-editor
    nodejs
    appimage-run
    seahorse
@@ -19,39 +19,55 @@

  boot.loader.grub.useOSProber = true;

-  services.xserver.enable = true;
-  services.xserver.displayManager.lightdm.enable = true;
-  services.xserver.desktopManager.cinnamon.enable = true;
+  services = {
+    xserver = {
+      enable = true;

-  services.xserver.xkb = {
-    layout = "au";
-    variant = "";
+      displayManager = {
+        lightdm.enable = true;
+        sessionCommands = ''
+          eval $(gnome-keyring-daemon --start --components=secrets,ssh)
+          export SSH_AUTH_SOCK
+        '';
+      };
+
+      desktopManager.cinnamon.enable = true;
+
+      xkb = {
+        layout = "au";
+        variant = "";
+      };
+    };
+
+    printing.enable = true;
+
+    pipewire = {
+      enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+    };
+
+    xrdp = {
+      enable = true;
+      defaultWindowManager = "cinnamon-session";
+      openFirewall = true;
+    };
+
+    gnome.gnome-keyring.enable = true;
  };

-  services.printing.enable = true;
-
-  security.rtkit.enable = true;
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    alsa.support32Bit = true;
-    pulse.enable = true;
+  security = {
+    rtkit.enable = true;
+    pam.services.login.enableGnomeKeyring = true;
  };

-  users.users.nixos.extraGroups = [ "networkmanager" ];
+  # The networkmanager group only exists when NM is actually enabled — the
+  # lxc platform module force-disables it, so don't add the user to a group
+  # that won't exist there.
+  users.users.nixos.extraGroups = lib.mkIf config.networking.networkmanager.enable [ "networkmanager" ];

  programs.firefox.enable = true;

-  services.xrdp.enable = true;
-  services.xrdp.defaultWindowManager = "cinnamon-session";
-  services.xrdp.openFirewall = true;
  nixpkgs.config.allowUnfree = true;
-
-  services.gnome.gnome-keyring.enable = true;
-  security.pam.services.login.enableGnomeKeyring = true;
-
-  services.xserver.displayManager.sessionCommands = ''
-    eval $(gnome-keyring-daemon --start --components=secrets,ssh)
-    export SSH_AUTH_SOCK
-  '';
 }
@@ -1,9 +1,12 @@
-{ pkgs, ... }:
+{ lib, pkgs, config, ... }:

 {
  networking.networkmanager.enable = true;

-  users.users.nixos.extraGroups = [ "networkmanager" ];
+  # The networkmanager group only exists when NM is actually enabled — the
+  # lxc platform module force-disables it, so don't add the user to a group
+  # that won't exist there.
+  users.users.nixos.extraGroups = lib.mkIf config.networking.networkmanager.enable [ "networkmanager" ];

  environment.systemPackages = with pkgs; [
    inetutils
@@ -1,10 +1,10 @@
-{ config, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, vars, ... }:

 let
  pxeRoot = "/srv/pxe";
  httpRoot = "${pxeRoot}/http";
  tftpRoot = "${pxeRoot}/tftp";
-  pxeBaseUrl = "http://192.168.2.247";
+  pxeBaseUrl = "http://${vars.pxeServerIp}";

  bootIpxe = pkgs.writeText "boot.ipxe" ''
    #!ipxe
@@ -76,9 +76,7 @@ let
    choose target && goto ''${target}

    :nixos
-    kernel ''${base}/nixos/bzImage ip=dhcp
-    initrd ''${base}/nixos/initrd
-    boot
+    chain ''${base}/nixos/netboot.ipxe

    :rescue
    chain ''${base}/systemrescue.ipxe
@@ -91,32 +89,40 @@ let
  '';
 in
 {
+  imports = [
+    ../pxe-boot/stage-installer-artifacts.nix
+  ];
+
  environment.systemPackages = with pkgs; [
    ipxe
  ];

-  services.nginx = {
-    enable = true;
+  services = {
+    nginx = {
+      enable = true;

-    virtualHosts."pxe-boot" = {
-      default = true;
-      root = httpRoot;
-      locations."/" = {
-        extraConfig = ''
-          autoindex on;
-        '';
+      virtualHosts."pxe-boot" = {
+        default = true;
+        root = httpRoot;
+        locations."/" = {
+          extraConfig = ''
+            autoindex on;
+          '';
+        };
      };
    };
-  };

-  # TFTP is only used to deliver the initial iPXE bootloader. After iPXE
-  # starts, all further assets are fetched via nginx over HTTP.
-  services.atftpd = {
-    enable = true;
-    root = tftpRoot;
-    extraOptions = [
-      "--verbose=5"
-    ];
+    # TFTP is only used to deliver the initial iPXE bootloader. After iPXE
+    # starts, all further assets are fetched via nginx over HTTP.
+    atftpd = {
+      enable = true;
+      root = tftpRoot;
+      extraOptions = [
+        "--verbose=5"
+      ];
+    };
+
+    openssh.settings.PermitRootLogin = "yes";
  };

  systemd.tmpfiles.rules = [
@@ -149,8 +155,6 @@ in
    };
  };

-  services.openssh.settings.PermitRootLogin = "yes";
-
  networking.firewall.allowedTCPPorts = [ 80 ];
  networking.firewall.allowedUDPPorts = [ 69 ];
 }
@@ -1,4 +1,4 @@
-{ ... }:
+{ vars, lib, ... }:

 {
  imports = [
@@ -6,7 +6,7 @@
    ../services/zfs/enable-service.nix
  ];

-  boot.zfs.extraPools = [ "tank" ];
+  boot.zfs.extraPools = [ (lib.removePrefix "/" vars.storageRoot) ];

  systemd.services.nfs-server = {
    after = [ "zfs-mount.service" ];
@@ -16,11 +16,11 @@
  services.nfs.server = {
    enable = true;
    exports = ''
-      /tank/docker/config 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
-      /tank/docker/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
-      /tank/docker/databases 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
-      /tank/docker/nextcloud-data 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
-      /tank/raspi/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/docker/config ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/docker/volumes ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/docker/databases ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/docker/nextcloud-data ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/raspi/volumes ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
    '';
  };

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, vars, ... }:

 let
  # Flake attribute names are now <platform>-<buildtype> (e.g. proxmox-docker)
@@ -9,13 +9,13 @@ let
    sudo nixos-rebuild switch \
      --no-write-lock-file \
      --refresh \
-      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target)
+      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
  '';
  myTestCmd = ''
    sudo nixos-rebuild test \
      --no-write-lock-file \
      --refresh \
-      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target)
+      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
  '';
 in
 {
@@ -1,29 +1,36 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, vars, ... }:

 {
-    imports =
-    [ # Include the results of the hardware scan.
-#      ./hardware-configuration.nix
-      ../set-locale.nix
+  imports =
+    [
+      # Include the results of the hardware scan.
+      #      ./hardware-configuration.nix
+      ./set-locale.nix
    ];
  # Use the GRUB 2 boot loader.
  # boot.loader.grub.enable = true;
  #boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only

-  networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
+  networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
+
+  # Recommended over the true default (bypasses ZFS's own import safeguards)
+  # per the option's own docs; matches hosts/docker/host.nix and
+  # modules/services/zfs/enable-service.nix, which already set this
+  # explicitly. Harmless no-op on hosts that don't use ZFS at all.
+  boot.zfs.forceImportRoot = false;

  # Set your time zone.
-  time.timeZone = "Australia/Brisbane";
+  time.timeZone = vars.timeZone;

  # Enable QEMU agent
  services.qemuGuest.enable = true;

-    # Enable docker-compose
+  # Enable docker-compose
  environment.systemPackages = with pkgs; [
-  vim
-  btop
-  git
-  gcr
+    vim
+    btop
+    git
+    gcr
  ];

  # Secrets shared by every host, decrypted at activation via each host's
@@ -32,28 +39,34 @@
  # or docs/ for the sops workflow). hashedPassword/hashedPasswordFile need
  # neededForUsers so they're available before the normal secret-activation
  # step, since user creation happens very early in boot.
-  sops.defaultSopsFile = ../../secrets/common.yaml;
-  sops.secrets."root-hashedPassword".neededForUsers = true;
-  sops.secrets."nixos-hashedPassword".neededForUsers = true;
-  sops.secrets."nix-github-token" = { };
+  sops = {
+    defaultSopsFile = ../../secrets/common.yaml;
+
+    secrets = {
+      "root-hashedPassword".neededForUsers = true;
+      "nixos-hashedPassword".neededForUsers = true;
+      "nix-github-token" = { };
+    };
+
+    # nix.conf doesn't support a *File-style option for access-tokens, so the
+    # token is rendered into a runtime-only file (never touches the Nix store)
+    # and pulled in via nix.conf's native !include directive.
+    templates."nix-github-token.conf".content = ''
+      access-tokens = github.com=${config.sops.placeholder."nix-github-token"}
+    '';
+  };

-  # nix.conf doesn't support a *File-style option for access-tokens, so the
-  # token is rendered into a runtime-only file (never touches the Nix store)
-  # and pulled in via nix.conf's native !include directive.
-  sops.templates."nix-github-token.conf".content = ''
-    access-tokens = github.com=${config.sops.placeholder."nix-github-token"}
-  '';
  nix.extraOptions = ''
    !include ${config.sops.templates."nix-github-token.conf".path}
  '';

-#Set root password
-users.users.root = {
-  hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
-};
+  #Set root password
+  users.users.root = {
+    hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
+  };

  # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.nixos = {
+  users.users.${vars.primaryUser} = {
    isNormalUser = true;
    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
    packages = with pkgs; [
@@ -61,8 +74,8 @@ users.users.root = {
    ];
    hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
    openssh.authorizedKeys.keys = [
-    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq/Q5LvIXlZwO2kdeAN5nLGZ59nZB7JHYMEszHxmNtGMzv1lM31jiPNsr0z2EKVZhE7OOfa2IF9rhWYD7JUA9G0yzdZ4WTXFNGVVOJoOVH6vAF3XCxoVilOEwTc7h2Wiy+rzd0B28/3spffzQQWJhY6GRQVa8j+6xAGF60Fcvl1vLosYT9Bn2ZbK4TCWOwAn2jqXIieGpZdn/UNZbGOeKRiCvhktDfMAzuQzN/9jMu/oF4pkPn2X1UrsQdNlvp0Ci8md612MozIpncQJyAF1ADhunr3sMx0isUXiqD29R5DS4TftpekqLNLak+zcxFa8N7DcRNp3DcKfJvyTkwQrR4r+b7lFLYOLHLagSso9CzeW/paAS2q9I5SBm/2DtE1diLLg2jZikYcstsu/G5RgvbzbKqjiaMwTdXC3AMvDxQrs7U5pDRZFzoofG3cpODbTm+uy3m0kP70z0M1K45UbDG0p+itnTu9x40JbQEgefbx38AItNvAIx1A8HO4I1VX28= wayne@stream"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
+      vars.adminSshKey
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
    ];
  };

@@ -88,4 +101,4 @@ users.users.root = {



-}
+}
@@ -1,65 +1,69 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, vars, ... }:

 let
  remote = "root@proxmox-ip:/var/lib/vz/template/iso";
  localMount = "${config.home.homeDirectory}/proxmox-iso";
-in {
+in
+{

  imports = [
    ./aliases.nix
  ];

-  home.username = "nixos";         # your actual username
-  home.homeDirectory = "/home/nixos";
-  home.stateVersion = "25.11";        # match your NixOS stateVersion
+  home = {
+    username = vars.primaryUser;
+    homeDirectory = "/home/${vars.primaryUser}";
+    stateVersion = "25.11"; # match your NixOS stateVersion
+
+    # Optional: packages
+    packages = with pkgs; [
+      git
+      vim
+      tmux
+      nano
+      sshfs
+    ];
+
+    # Optional: set environment vars
+    sessionVariables = {
+      EDITOR = "nano";
+    };
+  };
+
+  programs.home-manager.enable = true; # mandatory to activate HM
+
+  programs.bash.enable = true;

-  programs.home-manager.enable = true;  # mandatory to activate HM
-  
-programs.bash.enable = true;
-  
  # GitHub access-tokens setting used to live here in plaintext; it's now
  # rendered system-wide from a sops-nix secret via nix.extraOptions in
  # modules/common/configuration.nix instead (covers the daemon for every
  # user, not just this one).

-  # Optional: packages
-  home.packages = with pkgs; [
-    git
-    vim
-    tmux
-    nano
-    sshfs
-  ];
+  #  systemd.user.services.mount-proxmox-iso = {
+  #    Unit = {
+  #      Description = "Mount Proxmox ISO dir via SSHFS";
+  #      After = [ "network-online.target" ];
+  #      Wants = [ "network-online.target" ];
+  #    };

-  # Optional: set environment vars
-  home.sessionVariables = {
-    EDITOR = "nano";
-  };
-#  systemd.user.services.mount-proxmox-iso = {
-#    Unit = {
-#      Description = "Mount Proxmox ISO dir via SSHFS";
-#      After = [ "network-online.target" ];
-#      Wants = [ "network-online.target" ];
-#    };
+  #    Service = {
+  #      Type = "simple";
+  #      ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${localMount}";
+  #      ExecStart = "${pkgs.sshfs}/bin/sshfs -o IdentityFile=${config.home.homeDirectory}/.ssh/id_ed25519,allow_other,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3 root@proxmox-ip:/var/lib/vz/template/iso ${localMount}";
+  #      ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u ${localMount}";
+  #      Restart = "on-failure";
+  #    };

-#    Service = {
-#      Type = "simple";
-#      ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${localMount}";
-#      ExecStart = "${pkgs.sshfs}/bin/sshfs -o IdentityFile=${config.home.homeDirectory}/.ssh/id_ed25519,allow_other,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3 root@proxmox-ip:/var/lib/vz/template/iso ${localMount}";
-#      ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u ${localMount}";
-#      Restart = "on-failure";
-#    };
-
-#    Install = {
-#      WantedBy = [ "default.target" ];
-#    };
-#  };
+  #    Install = {
+  #      WantedBy = [ "default.target" ];
+  #    };
+  #  };
  # Optional: enable bash (or zsh, fish...)
-#  programs.bash.enable = true;
+  #  programs.bash.enable = true;

  # Optional: manage dotfiles via symlinks
-#  home.file = {
-#    ".tmux.conf".source = ./dotfiles/tmux.conf;
-#    ".config/nvim/init.vim".source = ./dotfiles/init.vim;
-#  };
+  #  home.file = {
+  #    ".tmux.conf".source = ./dotfiles/tmux.conf;
+  #    ".config/nvim/init.vim".source = ./dotfiles/init.vim;
+  #  };
 }
@@ -1,4 +1,4 @@
-{ ... }:
+_:

 {
  i18n.defaultLocale = "en_AU.UTF-8";
@@ -15,4 +15,4 @@
    LC_TIME = "en_AU.UTF-8";
  };

-}
+}
@@ -1,4 +1,4 @@
-{ ... }:
+_:

 {
  disko.devices = {
@@ -57,4 +57,4 @@
      };
    };
  };
-}
+}
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, vars, ... }:

 {
  systemd.services.docker-health-to-gotify = {
@@ -7,9 +7,9 @@
    serviceConfig = {
      Type = "oneshot";
      # Run as root so it can read /etc/secrets and access docker socket
-     # User = "root";
+      # User = "root";
      #EnvironmentFile = "-/etc/secrets/docker-health-alert.env";
-      ExecStart = "${pkgs.bash}/bin/bash /home/nixos/docker/monitoring/gotify/docker-health-to-gotify.sh";
+      ExecStart = "${pkgs.bash}/bin/bash /home/${vars.primaryUser}/docker/monitoring/gotify/docker-health-to-gotify.sh";
      StandardOutput = "journal";
      StandardError = "journal";
    };
@@ -25,4 +25,4 @@
      Persistent = true;
    };
  };
-}
+}
@@ -1,23 +1,23 @@
 { pkgs, ... }:

 {
-    #  virtualisation.docker.enable = true;
+  #  virtualisation.docker.enable = true;
  virtualisation.docker = {
-  enable = true;
-  package = pkgs.docker;
-#  listenOptions = [
-#  "unix:///var/run/docker.sock"
-#  "tcp://0.0.0.0:2375"
-#];
+    enable = true;
+    package = pkgs.docker;
+    #  listenOptions = [
+    #  "unix:///var/run/docker.sock"
+    #  "tcp://0.0.0.0:2375"
+    #];

-#  daemon.settings = {
-#    metrics-addr = "0.0.0.0:9323";
-#    experimental = true;
-#  };
-};
+    #  daemon.settings = {
+    #    metrics-addr = "0.0.0.0:9323";
+    #    experimental = true;
+    #  };
+  };

-environment.systemPackages = with pkgs; [
-  docker-compose
-  docker-buildx
-];
-}
+  environment.systemPackages = with pkgs; [
+    docker-compose
+    docker-buildx
+  ];
+}
@@ -1,63 +1,65 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, vars, ... }:

 {
-  fileSystems."/mnt/docker/config" = {
-    device = "server:/tank/docker/config";
-    fsType = "nfs";
+  fileSystems = {
+    "/mnt/docker/config" = {
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/config";
+      fsType = "nfs";

-    options = [
-      "nfsvers=4.2"
-      "_netdev"
-      "x-systemd.automount"
-      "noatime"
-    ];
-  };
+      options = [
+        "nfsvers=4.2"
+        "_netdev"
+        "x-systemd.automount"
+        "noatime"
+      ];
+    };

-  fileSystems."/mnt/docker/databases" = {
-    device = "server:/tank/docker/databases";
-    fsType = "nfs";
+    "/mnt/docker/databases" = {
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/databases";
+      fsType = "nfs";

-    options = [
-      "nfsvers=4.2"
-      "_netdev"
-      "x-systemd.automount"
-      "noatime"
-    ];
-  };
+      options = [
+        "nfsvers=4.2"
+        "_netdev"
+        "x-systemd.automount"
+        "noatime"
+      ];
+    };

-  fileSystems."/mnt/docker/volumes" = {
-    device = "server:/tank/docker/volumes";
-    fsType = "nfs";
+    "/mnt/docker/volumes" = {
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/volumes";
+      fsType = "nfs";

-    options = [
-      "nfsvers=4.2"
-      "_netdev"
-      "x-systemd.automount"
-      "noatime"
-    ];
-  };
+      options = [
+        "nfsvers=4.2"
+        "_netdev"
+        "x-systemd.automount"
+        "noatime"
+      ];
+    };

- fileSystems."/mnt/nextcloud-data" = {
-    device = "server:/tank/docker/nextcloud-data";
-    fsType = "nfs";
+    "/mnt/nextcloud-data" = {
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/nextcloud-data";
+      fsType = "nfs";

-    options = [
-      "nfsvers=4.2"
-      "_netdev"
-      "x-systemd.automount"
-      "noatime"
-    ];
-  };
+      options = [
+        "nfsvers=4.2"
+        "_netdev"
+        "x-systemd.automount"
+        "noatime"
+      ];
+    };

- fileSystems."/mnt/raspi-backup" = {
-    device = "server:/tank/raspi/volumes";
-    fsType = "nfs";
+    "/mnt/raspi-backup" = {
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/raspi/volumes";
+      fsType = "nfs";

-    options = [
-      "nfsvers=4.2"
-      "_netdev"
-      "x-systemd.automount"
-      "noatime"
-    ];
+      options = [
+        "nfsvers=4.2"
+        "_netdev"
+        "x-systemd.automount"
+        "noatime"
+      ];
+    };
  };
 }
@@ -0,0 +1,22 @@
+{ pkgs, vars, ... }:
+
+{
+  # Create nextcloud cron scheduled task
+  systemd.services.nextcloud = {
+    description = "Nextcloud scheduled task";
+    script = ''${pkgs.bash}/bin/bash ~/docker/services-up.sh --profile nextcloud exec -u 33 nextcloud-webapp php ./cron.php'';
+    serviceConfig = {
+      Type = "oneshot";
+      User = vars.primaryUser;
+    };
+    path = with pkgs; [ docker docker-compose ];
+  };
+
+  systemd.timers.nextcloud = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "*:0/5";
+      Persistent = true;
+    };
+  };
+}
@@ -5,36 +5,42 @@

 {
  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
    ];

-  boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-  boot.loader.grub.device = "/dev/sda";
+  boot = {
+    initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ ];
+    extraModulePackages = [ ];
+
+    # Enable LISH
+    kernelParams = [ "console=ttyS0,19200n8" ];
+
+    loader = {
+      grub = {
+        device = "/dev/sda";
+        extraConfig = ''
+          serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
+          terminal_input serial;
+          terminal_output serial;
+        '';
+        forceInstall = true;
+        # device = "nodev";
+      };
+      timeout = 10;
+    };
+  };

  fileSystems."/" =
-    { device = "/dev/sda";
+    {
+      device = "/dev/sda";
      fsType = "ext4";
    };

  swapDevices =
-    [ { device = "/dev/sdb"; }
-    ];
-
-# Enable LISH
-boot.kernelParams = [ "console=ttyS0,19200n8" ];
-boot.loader.grub.extraConfig = ''
-  serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
-  terminal_input serial;
-  terminal_output serial;
-'';
-
-boot.loader.grub.forceInstall = true;
-# boot.loader.grub.device = "nodev";
-boot.loader.timeout = 10;
-
+    [{ device = "/dev/sdb"; }];

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }
@@ -5,13 +5,16 @@

 {
  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
    ];

-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
+  boot = {
+    initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ "kvm-amd" ];
+    extraModulePackages = [ ];
+  };
  # boot.loader.grub.device = "/dev/sda2"; # or "nodev" for efi only

  # fileSystems."/" =
@@ -0,0 +1,251 @@
+{ pkgs, lib, vars, ... }:
+
+{
+  imports = [
+    ./host-keys.nix
+  ];
+
+  networking.useDHCP = lib.mkDefault true;
+
+  # Recommended over the true default (bypasses ZFS's own import safeguards)
+  # per the option's own docs. This installer environment has no ZFS pools
+  # of its own to import, so this is a no-op here — just silences the
+  # eval-time warning, matching modules/common/configuration.nix.
+  boot.zfs.forceImportRoot = false;
+
+  time.timeZone = vars.timeZone;
+
+  # Without this, the installer only ever sees cache.nixos.org, which
+  # doesn't carry sops-install-secrets (it's built straight from the
+  # sops-nix flake's own Go source, not part of nixpkgs) — every install
+  # would otherwise compile it from scratch, which is what ran an 8GB LXC
+  # container's disk out of space. Push a built copy to nix-cache once
+  # (from a machine with real disk headroom) and every future install,
+  # of any type, fetches instead of rebuilding.
+  nix.settings = {
+    substituters = [
+      "http://nix-cache"
+      "https://cache.nixos.org/"
+    ];
+    trusted-public-keys = [
+      "cache.local-1:usoWYanY3Kpq2+kDIS2nhWoLZiRxanmdysdzqCFBHW4="
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+    ];
+  };
+
+  environment = {
+    systemPackages = with pkgs; [
+      git
+      curl
+      jq
+      parted
+      e2fsprogs
+      btrfs-progs
+      util-linux
+      disko
+    ];
+
+    # Write auto-install script to /root
+    etc."auto-install.sh" = {
+      text = ''
+            #!/run/current-system/sw/bin/bash
+            set -eux
+
+            set -euo pipefail
+
+        export FLAKE_BASE_URL="git+https://${vars.lanDomain}/beatzaplenty/nixos.git"
+
+        echo "Fetching available NixOS hosts from flake..."
+        # Two categories deliberately excluded from the menu:
+        #   lxc-*                 — these build a config.system.build.tarball
+        #                           meant for `pct restore` on Proxmox
+        #                           directly, not an install. Running
+        #                           nixos-install against one here would
+        #                           bind-mount / onto /mnt and then refuse to
+        #                           touch the filesystem it's currently
+        #                           running on — see docs/auto-installer.md.
+        #   installer/proxmox-lxc — these *are* the installer image's own
+        #                           flake targets, not deployable hosts;
+        #                           "installing" one means nixos-install-ing
+        #                           a copy of the installer into itself.
+        mapfile -t options < <(
+          nix eval --json --no-use-registries --no-accept-flake-config --extra-experimental-features "flakes nix-command" \
+            "''${FLAKE_BASE_URL}#nixosConfigurations" \
+            --apply builtins.attrNames \
+          | jq -r '.[]
+              | select(startswith("lxc-") | not)
+              | select(. != "installer")
+              | select(. != "proxmox-lxc")'
+        )
+
+        if [[ ''${#options[@]} -eq 0 ]]; then
+          echo "ERROR: No NixOS hosts found in ''${FLAKE_BASE_URL}#nixosConfigurations" >&2
+          exit 1
+        fi
+
+        echo "Note: lxc-* targets aren't installed this way — build them with"
+        echo "  nix build .#nixosConfigurations.<name>.config.system.build.tarball"
+        echo "and 'pct restore' the result on Proxmox directly. See docs/auto-installer.md."
+
+        echo "Choose the flake profile to install:"
+        select choice in "''${options[@]}"; do
+          if [[ -n "$choice" ]]; then
+            echo "You selected: $choice"
+            break
+          else
+            echo "Invalid selection. Try again."
+          fi
+        done
+
+        echo "Starting install with flake: ''${FLAKE_BASE_URL}#''${choice}"
+
+        # Optional: confirm before proceeding
+        read -rp "Proceed with installation? (y/N): " confirm
+        if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
+          echo "Aborted."
+          exit 1
+        fi
+
+        # A nix-cache host is *the* substituter/remote-builder for every other
+        # host once installed (its own config explicitly excludes itself from
+        # using either — see buildType != "nix-cache" in the nixos flake.nix).
+        # Installing one shouldn't depend on a nix-cache substituter either,
+        # for the same reason — plus in practice "nix-cache" only resolves over
+        # Tailscale, which a fresh installer environment was never connected to
+        # anyway, so it's dead weight even for non-nix-cache installs until
+        # that's sorted out. Override it away here specifically for nix-cache
+        # targets to keep install-time behaviour consistent with run-time.
+        nix_extra_opts=()
+        if [[ "''${choice}" == *-nix-cache ]]; then
+            echo "Installing a nix-cache host — skipping the nix-cache substituter."
+            nix_extra_opts+=(--option substituters "https://cache.nixos.org/")
+        fi
+
+        if nix eval --refresh --json  --extra-experimental-features "flakes nix-command" "''${nix_extra_opts[@]}" "''${FLAKE_BASE_URL}#nixosConfigurations.''${choice}.config.disko.devices.disk.main.device" >/dev/null 2>&1; then
+            disko --mode destroy,format,mount \
+                --flake "''${FLAKE_BASE_URL}#''${choice}" "''${nix_extra_opts[@]}" --yes
+        else
+            # No raw disk to partition — true for every LXC container, which has
+            # no block device visible from inside it, only its already-mounted
+            # root filesystem. nixos-install defaults to installing into /mnt; if
+            # nothing points /mnt at the real root, the new system gets built and
+            # written to a disconnected empty directory, never actually becomes
+            # bootable, and the container silently keeps running this installer
+            # environment forever. Bind-mount / onto /mnt so the install actually
+            # lands on the filesystem this container boots from.
+            echo "Selected host has no Disko configuration — installing in place via bind mount."
+            mount --bind / /mnt
+        fi
+
+        # sops-nix derives this host's decryption key from its own SSH host key
+        # at *activation* time, which runs before systemd would otherwise
+        # generate one on first boot. Without pre-seeding it here, secrets
+        # (including the login password) fail to decrypt on first boot.
+        # Generate the key with scripts/prepare-host-key.sh first.
+        #
+        # Two places a key can come from, checked in order:
+        #   /etc/host-keys  — baked into this image at build time (see
+        #                      modules/installer/host-keys.nix; only present
+        #                      if built with NIXOS_HOST_KEYS_DIR set)
+        #   /root/host-keys — scp'd in manually after boot (older fallback,
+        #                      still supported for images built without keys)
+        mkdir -p /root/host-keys
+        if [[ -f "/etc/host-keys/''${choice}_ssh_host_ed25519_key" ]]; then
+            echo "Found baked-in SSH host key for ''${choice}, installing to target..."
+            install -D -m 0600 "/etc/host-keys/''${choice}_ssh_host_ed25519_key" /mnt/etc/ssh/ssh_host_ed25519_key
+            install -D -m 0644 "/etc/host-keys/''${choice}_ssh_host_ed25519_key.pub" /mnt/etc/ssh/ssh_host_ed25519_key.pub
+        elif [[ -f "/root/host-keys/''${choice}_ssh_host_ed25519_key" ]]; then
+            echo "Found pre-seeded SSH host key for ''${choice}, installing to target..."
+            install -D -m 0600 "/root/host-keys/''${choice}_ssh_host_ed25519_key" /mnt/etc/ssh/ssh_host_ed25519_key
+            install -D -m 0644 "/root/host-keys/''${choice}_ssh_host_ed25519_key.pub" /mnt/etc/ssh/ssh_host_ed25519_key.pub
+        else
+            echo "WARNING: no SSH host key found for ''${choice} (checked /etc/host-keys and /root/host-keys)"
+            echo "sops-nix secrets (including the login password) will NOT decrypt on first boot."
+            echo "Run scripts/prepare-host-key.sh for host ''${choice} on your admin workstation first,"
+            echo "then either rebuild this image with NIXOS_HOST_KEYS_DIR set, or scp the result to"
+            echo "/root/host-keys/ on this machine."
+            read -rp "Continue without a pre-seeded key anyway? (y/N): " skip_key
+            if [[ ! "$skip_key" =~ ^[Yy]$ ]]; then
+                echo "Aborted."
+                exit 1
+            fi
+        fi
+
+        mkdir -p /mnt/install-tmp
+        export TMPDIR=/mnt/install-tmp
+
+        nixos-install \
+            --flake "''${FLAKE_BASE_URL}#''${choice}" \
+            "''${nix_extra_opts[@]}" \
+            --no-root-password
+
+
+            rm -rf /mnt/install-tmp
+            # Redundant copy of the host's private key — the real one is now at
+            # /etc/ssh/ssh_host_ed25519_key. Nothing NixOS-managed ever cleans this
+            # up on its own since it was written imperatively, not declaratively.
+            rm -rf /root/host-keys
+            sleep 10
+            reboot
+      '';
+
+      mode = "0755";
+    };
+  };
+
+  programs.git.enable = true;
+
+  # Run the installer on first login. Previously this copied an /etc file
+  # into the nixos user's ~/.bash_profile via an activation script that
+  # got dropped in a refactor (and only ever worked for that one user
+  # anyway) — loginShellInit is NixOS's native hook for this, applies to
+  # any user's login shell (root included), and needs no home-directory
+  # file-copying/chown.
+  programs.bash.loginShellInit = ''
+    if [ -n "$PS1" ] && [ ! -e "$HOME/.auto_install_ran" ]; then
+      sudo /etc/auto-install.sh
+      touch "$HOME/.auto_install_ran"
+    fi
+  '';
+
+  services.openssh.enable = true;
+
+  services.openssh.settings = {
+    PermitRootLogin = "yes";
+    PasswordAuthentication = true;
+  };
+
+  # nixpkgs' own installer profile (profiles/installation-device.nix, pulled
+  # in via installation-cd-minimal.nix) sets initialHashedPassword = "" for
+  # both users — its own passwordless-login convention for install media.
+  # That's a second, non-null password option alongside our hashedPassword
+  # below, which NixOS warns about as ambiguous precedence. Force it null
+  # rather than adopting passwordless login: this image now also boots over
+  # LAN PXE with PasswordAuthentication enabled, so passwordless root SSH
+  # would be reachable by anyone on the LAN, not just local console.
+  users.users.root = {
+    hashedPassword =
+      "$6$Kwv9KAyvcurAViQF$H4.u3feqGE7lVoNgkFXhE3n2Pmo//9JYDTCz8ifrVHBxPjwa1xMby7tEZ8Bpt5MXs9Rkx6/YbZWxs5CpH0s/70";
+    initialHashedPassword = lib.mkForce null;
+  };
+
+  users.users.${vars.primaryUser} = {
+    isNormalUser = true;
+
+    extraGroups = [
+      "wheel"
+    ];
+
+    shell = pkgs.bashInteractive;
+
+    hashedPassword =
+      "$6$Kwv9KAyvcurAViQF$H4.u3feqGE7lVoNgkFXhE3n2Pmo//9JYDTCz8ifrVHBxPjwa1xMby7tEZ8Bpt5MXs9Rkx6/YbZWxs5CpH0s/70";
+    initialHashedPassword = lib.mkForce null;
+
+    openssh.authorizedKeys.keys = [
+      vars.adminSshKey
+    ];
+  };
+
+  system.stateVersion = "26.05";
+}
@@ -0,0 +1,37 @@
+{ lib, ... }:
+
+let
+  # host-keys/ is gitignored (private key material must never be committed),
+  # which means flakes' git-filtered source tree can never see it via a
+  # normal relative path — referencing it at all requires stepping outside
+  # pure evaluation. builtins.getEnv is neutered to "" under normal
+  # `nix build`/`nix eval` (no error, just empty), so this whole module is a
+  # silent no-op unless the operator explicitly opts in with --impure and
+  # the env var set — safe by default, including in CI.
+  #
+  #   NIXOS_HOST_KEYS_DIR=$(pwd)/host-keys nix build .#iso --impure
+  #
+  # See docs/auto-installer.md.
+  hostKeysDirStr = builtins.getEnv "NIXOS_HOST_KEYS_DIR";
+  hasHostKeysDir = hostKeysDirStr != "" && builtins.pathExists hostKeysDirStr;
+  hostKeysDir = /. + hostKeysDirStr;
+
+  keyFileNames =
+    if hasHostKeysDir
+    then
+      lib.filter
+        (name: lib.hasSuffix "_ssh_host_ed25519_key" name || lib.hasSuffix "_ssh_host_ed25519_key.pub" name)
+        (lib.attrNames (builtins.readDir hostKeysDir))
+    else [ ];
+in
+{
+  environment.etc = lib.listToAttrs (map
+    (name: {
+      name = "host-keys/${name}";
+      value = {
+        source = hostKeysDir + "/${name}";
+        mode = "0400";
+      };
+    })
+    keyFileNames);
+}
@@ -0,0 +1,8 @@
+{ modulesPath, ... }:
+
+{
+  imports = [
+    "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix"
+    ./common.nix
+  ];
+}
@@ -0,0 +1,12 @@
+{ modulesPath, ... }:
+
+{
+  imports = [
+    ./common.nix
+    (modulesPath + "/virtualisation/proxmox-lxc.nix")
+  ];
+
+  # LXC has no bootloader
+  boot.loader.grub.enable = false;
+  boot.loader.systemd-boot.enable = false;
+}
@@ -1,9 +1,9 @@
-{ ... }:
+{ vars, ... }:

 {
  nix.settings = {
    substituters = [
-      "http://nix-cache"
+      "http://${vars.nixCacheHost}"
      "https://cache.nixos.org/"
    ];
    trusted-public-keys = [
@@ -0,0 +1,28 @@
+{ pkgs, vars, ... }:
+
+{
+  # Install the remote builder key on each client host (do not commit private keys):
+  #   sudo install -d -m 0700 /root/.ssh
+  #   sudo install -m 0600 ./nixremote /root/.ssh/nixremote
+  #   sudo ssh -i /root/.ssh/nixremote nixremote@nix-cache nix-store --version
+  nix = {
+    distributedBuilds = true;
+
+    buildMachines = [
+      {
+        hostName = vars.nixCacheHost;
+        sshUser = vars.remoteBuilderUser;
+        sshKey = "/root/.ssh/${vars.remoteBuilderUser}";
+        inherit (pkgs.stdenv.hostPlatform) system;
+        maxJobs = 4;
+        speedFactor = 2;
+        supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
+      }
+    ];
+
+    settings = {
+      builders-use-substitutes = true;
+      max-jobs = "auto";
+    };
+  };
+}
@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, vars, ... }:

 {
  # Generate the binary cache key pair on the nix-cache host:
@@ -9,46 +9,43 @@
  #   sudo chmod 0600 /etc/nix/cache-priv.pem
  #   sudo chmod 0644 /etc/nix/cache-pub.pem
  #   cat /etc/nix/cache-pub.pem
-  services.nix-serve = {
-    enable = true;
-    secretKeyFile = "/etc/nix/cache-priv.pem";
-  };
+  services = {
+    nix-serve = {
+      enable = true;
+      secretKeyFile = "/etc/nix/cache-priv.pem";
+    };

-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    virtualHosts."nix-cache" = {
-      locations."/" = {
-        proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
+    nginx = {
+      enable = true;
+      recommendedProxySettings = true;
+      virtualHosts.${vars.nixCacheHost} = {
+        locations."/" = {
+          proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
+        };
      };
    };
+
+    openssh.enable = true;
  };

  networking.firewall.allowedTCPPorts = [ 80 ];

-  users.groups.nixremote = {};
+  users.groups.${vars.remoteBuilderUser} = { };

-  users.users.nixremote = {
+  users.users.${vars.remoteBuilderUser} = {
    isSystemUser = true;
-    group = "nixremote";
+    group = vars.remoteBuilderUser;
    createHome = true;
    home = "/var/lib/nixremote";
    shell = pkgs.bashInteractive;
-    # Provide remote builder public keys here (safe to commit public keys only):
-    # openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAA... client@host" ];
-    #
-    # Avoid absolute keyFiles paths here because they break pure flake evaluation.
-    openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server"
-					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAYIT9ormlmxZ0SziyDQaUntnKI8HK9/s3Qac1ZKjP2 root@docker" 
-					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos"
-					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos"
-					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server"];
+    # Client public keys allowed to use this host as a remote builder —
+    # single source of truth is vars.remoteBuilderAuthorizedKeys (safe to
+    # commit public keys only).
+    openssh.authorizedKeys.keys = vars.remoteBuilderAuthorizedKeys;
  };

-  services.openssh.enable = true;
-
  nix.settings = {
-    trusted-users = [ "root" "nixremote" ];
+    trusted-users = [ "root" vars.remoteBuilderUser ];
    experimental-features = [ "nix-command" "flakes" ];
    auto-optimise-store = true;
    builders-use-substitutes = true;
@@ -1,8 +1,38 @@
-{ ... }:
+{ lib, modulesPath, ... }:

 {
-  boot.isContainer = true;
+  # LXC containers share the host kernel — Proxmox starts them by exec'ing
+  # /sbin/init directly, no bootloader/initrd involved — and Proxmox has its
+  # own container hostname/network provisioning outside Nix. nixpkgs' own
+  # virtualisation/proxmox-lxc.nix module already handles all of this
+  # correctly (boot.isContainer, loader.initScript, systemd-networkd) and,
+  # critically, provides config.system.build.tarball — a directly
+  # `pct restore`-able container image, no nixos-install/bind-mount needed
+  # (nixos-install refuses to touch the filesystem it's currently running
+  # on, which is exactly what bind-mounting / onto /mnt for an installer
+  # LXC container does).
+  imports = [
+    (modulesPath + "/virtualisation/proxmox-lxc.nix")
+  ];

-  boot.loader.grub.enable = false;
-  boot.loader.systemd-boot.enable = false;
+  proxmoxLXC = {
+    # host.nix declares each host's real hostname (networking.hostName);
+    # keep that instead of letting Proxmox's ambient container config win.
+    manageHostName = true;
+    # Unprivileged matches how these containers are actually created.
+    privileged = false;
+  };
+
+  boot.loader = {
+    grub.enable = false;
+    systemd-boot.enable = false;
+  };
+
+  # NetworkManager depends on a running udevd to enumerate/classify devices,
+  # which boot.isContainer disables (see nixpkgs' container-config.nix) —
+  # that's what broke DHCP-hostname registration in Pi-hole. The imported
+  # proxmox-lxc.nix module already switches networking to systemd-networkd
+  # for the same reason; it just doesn't disable NetworkManager itself,
+  # which modules/common/configuration.nix enables for every host.
+  networking.networkmanager.enable = lib.mkForce false;
 }
@@ -0,0 +1,23 @@
+{ netbootSystem, ... }:
+
+let
+  # config.system.build.kernel and .netbootRamdisk are directories, not the
+  # files themselves — nixpkgs' own system.build.kexecTree does the same
+  # ${...}/<file> dereference for the same reason.
+  inherit (netbootSystem.config.system.boot.loader) kernelFile;
+in
+{
+  # Builds this flake's own installer netboot image (the same one
+  # `nix build .#pxe` produces) and stages it where menu.ipxe's :nixos
+  # entry expects it, so the pxe-boot host is self-contained — no manual
+  # operator step to populate /srv/pxe/http/nixos after deploy.
+  systemd.tmpfiles.rules = [
+    # Declared here too (not just in build-types/pxe-boot.nix) so this
+    # module's C+ rules don't depend on cross-module list-merge ordering —
+    # tmpfiles' C type needs the target directory to already exist.
+    "d /srv/pxe/http/nixos 0755 root root -"
+    "C+ /srv/pxe/http/nixos/${kernelFile} 0644 root root - ${netbootSystem.config.system.build.kernel}/${kernelFile}"
+    "C+ /srv/pxe/http/nixos/initrd 0644 root root - ${netbootSystem.config.system.build.netbootRamdisk}/initrd"
+    "C+ /srv/pxe/http/nixos/netboot.ipxe 0644 root root - ${netbootSystem.config.system.build.netbootIpxeScript}/netboot.ipxe"
+  ];
+}
@@ -1,26 +1,26 @@
-{ ... }:
+{ vars, ... }:

 {
-fileSystems."/mnt/raspi" = {
-  device = "raspberrypi.tail13f623.ts.net:/home/raspi/raspi";
-  fsType = "nfs4";
-  options = [
-    "nofail"
-    "_netdev"
-    "noatime"
+  fileSystems."/mnt/raspi" = {
+    device = "raspberrypi.${vars.tailnetDomain}:/home/raspi/raspi";
+    fsType = "nfs4";
+    options = [
+      "nofail"
+      "_netdev"
+      "noatime"

-    # Don't mount until first access
-    "x-systemd.automount"
+      # Don't mount until first access
+      "x-systemd.automount"

-    # Unmount after 10 min idle
-    "x-systemd.idle-timeout=600"
+      # Unmount after 10 min idle
+      "x-systemd.idle-timeout=600"

-    # Give the Pi/Tailscale a little time to appear
-    "x-systemd.device-timeout=10s"
+      # Give the Pi/Tailscale a little time to appear
+      "x-systemd.device-timeout=10s"

-    # Explicitly use NFSv4.2 if supported
-    "nfsvers=4.2"
-  ];
-};
+      # Explicitly use NFSv4.2 if supported
+      "nfsvers=4.2"
+    ];
+  };

-}
+}
@@ -1,26 +0,0 @@
-{ pkgs, ... }:
-
-{
-  # Install the remote builder key on each client host (do not commit private keys):
-  #   sudo install -d -m 0700 /root/.ssh
-  #   sudo install -m 0600 ./nixremote /root/.ssh/nixremote
-  #   sudo ssh -i /root/.ssh/nixremote nixremote@nix-cache nix-store --version
-  nix.distributedBuilds = true;
-
-  nix.buildMachines = [
-    {
-      hostName = "nix-cache";
-      sshUser = "nixremote";
-      sshKey = "/root/.ssh/nixremote";
-      system = pkgs.stdenv.hostPlatform.system;
-      maxJobs = 4;
-      speedFactor = 2;
-      supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
-    }
-  ];
-
-  nix.settings = {
-    builders-use-substitutes = true;
-    max-jobs = "auto";
-  };
-}
@@ -1,5 +1,5 @@
- { ... }:
- 
- {
- services.rpcbind.enable = true;
- }
+_:
+
+{
+  services.rpcbind.enable = true;
+}
@@ -1,22 +0,0 @@
-{ pkgs, ... }:
-
-{
-# Create nextcloud cron scheduled task
-systemd.services.nextcloud = {
-  description = "Nextcloud scheduled task";
-  script = ''${pkgs.bash}/bin/bash ~/docker/services-up.sh --profile nextcloud exec -u 33 nextcloud-webapp php ./cron.php'';
-  serviceConfig = {
-    Type = "oneshot";
-    User = "nixos";
-  };
-  path = with pkgs; [ docker docker-compose ];
-};
-
-systemd.timers.nextcloud = {
-  wantedBy = [ "timers.target" ];
-  timerConfig = {
-    OnCalendar = "*:0/5";
-    Persistent = true;
-  };
-};
-}
@@ -1,12 +1,12 @@
 { pkgs, boot, ... }:

 {
-boot.postBootCommands = ''
-  echo "=== STARTING ZPOOL IMPORT ==="
-  ${pkgs.zfs_unstable}/bin/zpool import -a -N -d /dev/disk/by-path
-  ${pkgs.zfs_unstable}/bin/zpool status
-  ${pkgs.zfs_unstable}/bin/zfs mount -a
-  ${pkgs.zfs_unstable}/bin/zfs list
-    echo "=== ZPOOL IMPORT COMPLETE ==="
-'';
- }
+  boot.postBootCommands = ''
+    echo "=== STARTING ZPOOL IMPORT ==="
+    ${pkgs.zfs_unstable}/bin/zpool import -a -N -d /dev/disk/by-path
+    ${pkgs.zfs_unstable}/bin/zpool status
+    ${pkgs.zfs_unstable}/bin/zfs mount -a
+    ${pkgs.zfs_unstable}/bin/zfs list
+      echo "=== ZPOOL IMPORT COMPLETE ==="
+  '';
+}
@@ -1,16 +1,21 @@
 { pkgs, ... }:

- {
-boot.supportedFilesystems = [ "zfs" ];
-  boot.zfs.forceImportRoot = false;
-  boot.zfs.package = pkgs.zfs_unstable;
-      services.zfs = {
+{
+  boot = {
+    supportedFilesystems = [ "zfs" ];
+    zfs = {
+      forceImportRoot = false;
+      package = pkgs.zfs_unstable;
+      devNodes = "/dev/disk/by-id";
+    };
+  };
+
+  services.zfs = {
    autoScrub.enable = true;
    autoSnapshot.enable = true;
    trim.enable = true;
  };

-#systemd.services.zfs-import-cache.enable = true;
-systemd.services.zfs-mount.enable = true;
-boot.zfs.devNodes = "/dev/disk/by-id";
- }
+  #systemd.services.zfs-import-cache.enable = true;
+  systemd.services.zfs-mount.enable = true;
+}
@@ -1,5 +1,5 @@
-{ ... }:
+_:

 {
-    services.tailscale.enable = true;
-}
+  services.tailscale.enable = true;
+}
@@ -1,4 +1,4 @@
-{ ... }:
+{ vars, ... }:

 {
  services.tailscale = {
@@ -6,7 +6,7 @@

    extraUpFlags = [
      "--advertise-exit-node"
-      "--advertise-routes=192.168.2.0/24"
+      "--advertise-routes=${vars.lanCidr}"
    ];
  };
 }
@@ -1,7 +1,7 @@
-{ ... }:
+_:

 {
-      services.logrotate = {
+  services.logrotate = {
    enable = true;

    settings = {
@@ -15,6 +15,6 @@
        copytruncate = true;
      };

-     };
+    };
  };
-}
+}
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Generates a new machine's SSH host key ahead of installing it, so
+# sops-nix has something to derive an age key from before the target
+# ever boots.
+#
+# Why this is needed: sops-nix derives each host's decryption key from
+# its own /etc/ssh/ssh_host_ed25519_key at *activation* time, but that
+# activation runs before systemd would otherwise generate this key on
+# first boot (sshd-keygen is a normal systemd service gated behind
+# multi-user.target; activation scripts run earlier than that). Without
+# pre-seeding, secrets — including the root/nixos login password — fail
+# to decrypt on the machine's very first boot.
+#
+# This script only touches your admin workstation and this repo's
+# .sops.yaml (it never contacts the target machine). Run it, follow the
+# printed next steps, then use the resulting key with the auto-install.sh
+# prompt (see modules/installer/common.nix) when you actually install the
+# new machine.
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "$0")/.." && pwd)"
+
+hostname="${1:?usage: scripts/prepare-host-key.sh <hostname> [path-to-nixos-repo]}"
+nixos_repo="${2:-$repo_root}"
+sops_yaml="${nixos_repo}/.sops.yaml"
+
+if [[ ! -f "$sops_yaml" ]]; then
+  echo "ERROR: $sops_yaml not found. Pass the nixos repo path as the 2nd argument." >&2
+  exit 1
+fi
+
+keydir="${repo_root}/host-keys"
+mkdir -p "$keydir"
+keyfile="${keydir}/${hostname}_ssh_host_ed25519_key"
+
+if [[ -f "$keyfile" ]]; then
+  echo "ERROR: $keyfile already exists. Remove it first if you want to regenerate." >&2
+  exit 1
+fi
+
+nix-shell -p openssh --run "ssh-keygen -t ed25519 -N '' -C '${hostname}' -f '${keyfile}'" >/dev/null
+
+age_pub="$(nix-shell -p ssh-to-age --run "ssh-to-age -i '${keyfile}.pub'")"
+
+cat <<EOF
+
+Generated: ${keyfile}(.pub)
+
+=== 1. Add this line under keys: in ${sops_yaml} ===
+  - &${hostname} ${age_pub}
+
+=== 2. Add *${hostname} to whichever creation_rules key_groups this host needs ===
+(e.g. secrets/common.yaml always; add a per-host secrets/${hostname}.yaml
+ block too if this host will get its own secrets, same pattern as
+ nix-cache/server.)
+
+=== 3. Re-encrypt every secrets file you just added it to ===
+  nix-shell -p sops --run 'sops updatekeys ${nixos_repo}/secrets/common.yaml'
+
+=== 4. Commit + push this repo so the flake build picks up the new recipient ===
+
+=== 5. Get the key onto the installer, one of two ways ===
+  a) Rebuild the installer image with all host-keys/ baked in (see
+     docs/auto-installer.md):
+       NIXOS_HOST_KEYS_DIR="${keydir}" nix build .#iso --impure
+     (or .#lxc / .#pxe / .#all — --impure is required since host-keys/
+     is gitignored and flakes can't see it otherwise)
+
+  b) Or, for an image already built without keys, scp it in after boot:
+       scp ${keyfile}{,.pub} root@<target-ip>:/root/host-keys/
+
+Then continue with /etc/auto-install.sh as normal — it checks
+/etc/host-keys (baked in) before /root/host-keys (scp'd) and installs
+whichever it finds before running nixos-install.
+EOF
@@ -5,40 +5,67 @@ sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6NkpZRzJuMFNuV09WamR0
-            SERDN0VSUlNQbkhSem1EeFlxdlhmdUx0S21JCnY1VkRBQTBqcW9JRHpJWEtJSitN
-            dHkyR0I4ckNkWkpGWHAzZGRaZkhJalEKLS0tIHRrU3RhU3UxN3B4NHdLeStuSXQ4
-            anFkRlpMTHowZzJNdnY0MExQcXd4OUEKgbT7uOSFkfEs6t3X6jmGOiC28lDJWF33
-            50f2fZ771ylhHa6WJMetGZ5cwl9r1RCaDiWyJEaqNGe7NqARlhr3EQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmaFVBeVp3Zk80TG1OU045
+            b204QzFYL1psVm1xdlBVYmVIWFpKVnJWbUdvCnJRVGVUbElPYVczeEdkSDU4WGYz
+            bkliK0dGcitjZnRYUXJQVVpTY2gva0kKLS0tIHBxMDBNYWJrSHAvNlZDWERmbVQ3
+            VDFscTRjdGpLUnk5VVdyTjY5MFNPSW8KX5Or/zoixFulaX8ljY4ke3jdhc3Jaw95
+            4BqrlILGapcOsmWTDkDZBtS81oNvlRnH+xaM2UJSe+nIplNcC+Cl2g==
            -----END AGE ENCRYPTED FILE-----
          recipient: age10nd382a9klsn2mrs60emdtsxe43pht3a0m9p29phfrhy0wfyt3vsq9r667
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDamw2ekY0dFZyOGNJelVa
-            ZGlNK2VNOWtWNTRzU3o2aVJvRi9CME5yS1JFCndlamdFMzVRTnoyVE1ZWXZkTjRR
-            eWdSZzZERHE5VElrOGZvcE4vK0g2d0EKLS0tIG15QlVyalZTK2NpVDdWWU4yUU4r
-            SkFncC9rZkNKUS9MSmF6WGQwOENwZTQKs5kLNLdQJoZtcsw3zlUWUUtJs0MJnuvw
-            o5vziOswRnuXENw//xN01nMDC6Ckzvb+q9GFIyxHLE4j3fT5XdZakg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1ZUZ0bXRGVFMzZzg1TzhE
+            N3kwYjdEV0tmcVdacVJHZUNXRHo1aHhXczFBCm1WcW51K3NSK25uMUFNb3NRbE9J
+            UE00VWNIclhVZHdPUmlNOXI1aGlhck0KLS0tIFphckVmRXZrTmI5K3BUL3NlMTAv
+            OG9RTHNEQXVMcXVWZXZnN2NYZ3hraUUKEXrloIgmADuRpa2YN2GIRYT+YN60pxga
+            bLeVDtBYU+KA+2F8S46o43ZmRTE2MXWlMhnZ35uNR4hgE3auKlIziA==
            -----END AGE ENCRYPTED FILE-----
          recipient: age19gfn2yedg76dmztm4hncr7vf3r3c9j0qpt4rap7y7gersjk4m3ks2lhd0e
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyaWpWTGd4TEVoaHg4b3hm
-            S1o3VXdkYkZCS0QxcW5hUWxyVjFneE5aSmp3ClNsdEZoMHpPUzI4K3B0ZnBYMlEw
-            MkJyd2NPcGJDZzgvc1EyWFBhNVlGUVEKLS0tIEptYXI2bnJHZVZGR3hSSm1sMlN5
-            ay8wdUh6TEowL0ZiUWtqbXl3NzhYOVEKW9l4mr+MLhuXA8sgQndaU8NiFeCMcxhG
-            qjKFn+mu2GFbwfZWAy6y/KUd9Ug4H6y3pNHlJMHupTu8v2wZ+3S4EA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZdXBMY2t6U0VBWjRyWUV2
+            WS9oS0tWUnBQMWhPc3VsTVVKSnZSemxvU0FZCmFWbzFEZEZrMzJxTmpJKy9HY2F5
+            RHBjcUNYZ1R5ZHUxVmhPYjJRQkZyMU0KLS0tIGcvZ2hPQURmanJLRjRaNEJtTml3
+            dElTa2hZck1rSG1HcDBVSjZQNjhzT0EKgUylDuQBZkW1Z6AB/EsVbxcippw5XOeY
+            e+NDtqFixYR1u57+fKVl5dY281kspYIQDCUx1lBZiH7iwUPZWNtEfA==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxVG13RVVweGpRM04vMWxG
-            V2hMMnp2Qk5Ub1BZQWNKNXVya3J4NGpreDJrCktqajVPRXdEL1BMU1dMbDhmU01L
-            UlQvRVQvcEFUZVZ5Umc3Y0hMUWNLVFEKLS0tIFgzRnF1RHdQdktDVjROSURYYTdx
-            NjAydjVuV1VCOGZoVFdTZmw1YmJ0eEEKN9KRGegafu1sjHlhyn4KCMPPAKxsSZLc
-            QJkei1ZQ0AVgC2QfCVEXonMOrs45nCIplG+uyER9khZyyjKObWk1pA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHYWtBYmU2Qk0vQ2dUQjUy
+            RGs1b1BzVm82Z210MGcrbnhiS0pCVnJzbkFVCnhpZUxSVmZTd0VSM0ZvZ01tM2hP
+            QlJ4NUQ0VjBBSXJGR0VScE5zNXhjVjgKLS0tIFZyNVF2a2VPdzhyZ1MzN3dYa0xx
+            U0tqTWZNSDdHU3Z5UHNBbGR6aFZ1MDQK7z0OC0yazekxpLmiKFuqWZm1rWMZqpXb
+            FGnZFMDdEwB5wTeiy4LCXS70zyr5eVT7KPeK25EG6pXQ4qqKZ12CyA==
            -----END AGE ENCRYPTED FILE-----
          recipient: age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqSG5NemtzUXlhelpvblFl
+            TldjUGVtZFFXWGM5ei9EN3V5N2ZLY0VRV0RJCnFNN1lVNmhWckFWbUVJd0grR2Ja
+            MmdYazZLUVFpelUyMFhta3dGSEc2Mm8KLS0tIHl4TlhhVFVOcmkxaHpKVWlrdEJx
+            VlBQazd5MG1yc3E0TzQrd3FmWG8wd00K8+cAm4oWVraERb8i8EurAnsR/L085uPR
+            zzIZEYW6hHxf9Ah9vMzM+3KIsnnS0Gr5QT8ATzpd8huXCqPNiveDFQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1qz9d4ka4xgexujyd247s7lp737sulp5fhxl5d65fj2ykvc4j4edqrsdks8
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQdDdQUEh6ejg3UG1LMi8w
+            bTJacGZQY3dUVEtJY3NGeWpxYWRITkZpN2swClVmb2F5N0phYzRXVG1RY1NsUm52
+            OWVLY3FJU0JXcGFVZDJGdVJ0dVhBN0UKLS0tIEl2b3JjV2JaS0crMnRpZElGdDZS
+            MDFyelRvcUsyUDdtai9IYnpHK3g2L2cKlvZloUKACDy9OyRI7ruPUjYqFENXzcVI
+            amFHFTbEGKVWIPwDjEwsMT+S4bHBkNWyny5dD5CrBpk7fiyQ+5U8+Q==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age120whqj96g26lsgy4udvgsn8dc9lumh8jeu3a564fx79rjr5lxffqmrljuu
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTZnZIa2xXM3RIYk1tbitC
+            NlRTeXFib3JDdXdhR01ZdUl6Z09vWmllRGxBCnpPalo4K0JhRlNpQ2d0b2RNcjUx
+            K3FRaXdMVHZud2FKRkw4UDREL1NrMDgKLS0tIE5CZDBHRXNscG9JK1hvWlZPVjJy
+            d0d2VnE4bXd6MGNPVzVUdFdocDYzcHcKW2Hs5oBO5ooc/uqWV/TOjq1xsxFR204s
+            GRtFUOg9tfglk3TcQbgZV0/pYlBJYzgb7iZD0qVe4XYj68q1A1bPwQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age164px2a8e48ptsf9ngtan38aa6jls4jdl26mzrgzf6sn3vcvt49hqjrgr8w
    lastmodified: "2026-07-19T02:30:40Z"
    mac: ENC[AES256_GCM,data:UiL3VMDF6rq4Nr87KspcDx434q3tfNXeb5pwH2O+4ssNQ6xzcYDdzXBnhAY3zLBsqPMKrvHBd4Ot/gEMcq3FMIVe7Q6p9yWKpep66KZ/yWEhAlwIVhD79Oj8VS+1CHKjf25zpRdhZorp04oeFQQd9VfjJB4EE/Q1aVbwTGlpIic=,iv:i/0conaFgFia+wzNTdUL6tlSTw35HTK3Ap1Sr5RGHf8=,tag:ULbz5FllShA/JjlSRdxA0g==,type:str]
    unencrypted_suffix: _unencrypted
@@ -3,22 +3,31 @@ sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkb29VM3haQ0c0WDY0STVn
-            L1ZyOUROSnR6ZjZZZWc1VGFFNVp6bWxCV3hZCnlGTC9CbEtIM3MvSGJQaStEbzJ0
-            eWVhY2l6UHNDRTYxdEpkd003WXFia2MKLS0tIHcxU3FPYTVuZ0RqZTZTT1RvZnN0
-            OGlQM3B2R0l4MHhWNXBBWmpiOEVxK1EK8kxh3ikKL6Fw2am3r7lPGpB0fCqzEukO
-            NU10Cbf38Bd+fybRbBnvRuu9To1FOf+KU3iKbsuWmZn4KJn4Ajcbhw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDbHd1Y1dpa2ZiQ2E1bXRP
+            SnkrWHI0V2U1eGFKY0RZamZQQjluS0hGeENZCmduUFQyd1Q5RkZGMGFoenJhNmZh
+            VmZ2OStNaFpJejFxQ2JUZXFpNThaMncKLS0tIEhJdGdQeXEzb25Nbk5YZktCWVUz
+            NUJDUWRoTkd5R2pFblZjS0NSbVR5dkkKDYeW+zRpha04/CasFM91K6v1PpkNGHRu
+            qAoKs9KSg9VxS7ya8RuLmylKRdpPkupm/8SXIJvQuCXp5LWmNJ4zkA==
            -----END AGE ENCRYPTED FILE-----
          recipient: age10nd382a9klsn2mrs60emdtsxe43pht3a0m9p29phfrhy0wfyt3vsq9r667
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCNWRhK2QrV1ZibllqY25Y
-            ZVRPLzZ0TE82TWZ4L0w5ZmFPTDBtT0poODBnCkE5TWhJcXJjNkdva1hYZ3loeVdq
-            UlBXWHZpRUpMSGhPU0FIRi9JMEtTdGMKLS0tIE9yUk5Ebjk2MEFtNEkyR3RDcU51
-            ZVMwNnNRMlBMVVFlamU1U3JQSy9UT00KJZdEpRHuj4Dp1dGwP1z4xi9oddQOrQj2
-            qheEN/IlifVdZDpvlLUc8jgLzd/TO5EeEhVqfbdrlua8FHly29oTNw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4UktiUUdmd092bnZMdFMz
+            Q05xVlhnNzhPZUY4TjF5bjRCbklacTdJd1RBCnJ4bEVMaWRLZExIUFVEUDBXTnlV
+            MDU4WUk5VlJjdlhVUVpzZXlnWHhqTjQKLS0tIE9iclhGVElPcU9OLzF0bEVjMjVp
+            YzlQTGFYZEhLdTk3N3ZramVjVGRXREUKjOjqO/jX5iEKN43WiJ8qS/1mDfxdj8uO
+            K7Yyc/Yj0qMvGwLNzphjmbT29P7dXk4Ht4TedqCd+8DfhpOgLVIaSA==
            -----END AGE ENCRYPTED FILE-----
          recipient: age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjaXpvQU9yRUc3ektPMmU5
+            Q0xLWU9mYXVOeTVBNGNsZzJPa1lkVlRUZHlvClhoSVV6YjB1Q3pTTzVvNFlNYkU4
+            Y2RrbFk5SUFKSDVjeFU0Wlc2aGFUMFUKLS0tIDlVeXM4WWRUakg4Zk5mcjdJL3VC
+            S1k5eFBpVnREQlZwYllpeTNhWW5GS1EKi2sMwyJJ0D8acjCZmxlcwdU1sglBuxR7
+            2SEMsctdGC+5E3ilPXvPpZ5RONZHbXxn6kQRBlBv6AJERpGDzsfgfA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age164px2a8e48ptsf9ngtan38aa6jls4jdl26mzrgzf6sn3vcvt49hqjrgr8w
    lastmodified: "2026-07-19T02:30:40Z"
    mac: ENC[AES256_GCM,data:7+FeT6aeCGn+JFBXbPO0qP4BJ1nHPSennewv1kWkG+hOTIqs1ymuswUK1Hyfi6Z9h2umFX9HvK+o3qtmYvk6k7BUNe6w6QUHTNwm6lmNqrb7sgAE3iFVI2p9m14NGhgoTfnXx1M4JIZ1iuNYhCukpENI4+svIe+r7x5YeE5Evac=,iv:4AKAPI6upyAvHBr8BLWX7R/NupmJdcXdqiN8e0ZQ3ls=,tag:TkpfpCaLhn+Mx5cQZZuMdA==,type:str]
    unencrypted_suffix: _unencrypted
@@ -0,0 +1,44 @@
+{
+  # Network / domains
+  lanDomain = "gitea.lan.ddnsgeek.com"; # Gitea/DDNS domain
+  homeDomain = "sweet.home"; # base LAN domain for service subdomains (pve., docker.)
+  tailnetDomain = "tail13f623.ts.net"; # Tailscale MagicDNS suffix
+  lanCidr = "192.168.2.0/24"; # LAN subnet
+  pxeServerIp = "192.168.2.247"; # pxe-boot host's LAN IP
+  pbsIp = "192.168.2.108"; # Proxmox Backup Server LAN IP
+
+  # Cross-host references (LAN hostnames/users other hosts reach over the network)
+  nixCacheHost = "nix-cache"; # substituter/remote-builder hostname
+  nfsServerHost = "server"; # NFS export source hostname
+  dockerHost = "docker"; # docker-compose stack host
+
+  remoteBuilderUser = "nixremote"; # remote builder SSH user
+
+  # Public keys authorized to SSH in as remoteBuilderUser on the nix-cache
+  # host (modules/nix-cache/server.nix) — one per client host that's allowed
+  # to use it as a distributed builder.
+  remoteBuilderAuthorizedKeys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAYIT9ormlmxZ0SziyDQaUntnKI8HK9/s3Qac1ZKjP2 root@docker"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
+  ];
+
+  # Admin SSH public key, authorized on the primary user of every host and
+  # the installer image's nixos/root users.
+  adminSshKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq/Q5LvIXlZwO2kdeAN5nLGZ59nZB7JHYMEszHxmNtGMzv1lM31jiPNsr0z2EKVZhE7OOfa2IF9rhWYD7JUA9G0yzdZ4WTXFNGVVOJoOVH6vAF3XCxoVilOEwTc7h2Wiy+rzd0B28/3spffzQQWJhY6GRQVa8j+6xAGF60Fcvl1vLosYT9Bn2ZbK4TCWOwAn2jqXIieGpZdn/UNZbGOeKRiCvhktDfMAzuQzN/9jMu/oF4pkPn2X1UrsQdNlvp0Ci8md612MozIpncQJyAF1ADhunr3sMx0isUXiqD29R5DS4TftpekqLNLak+zcxFa8N7DcRNp3DcKfJvyTkwQrR4r+b7lFLYOLHLagSso9CzeW/paAS2q9I5SBm/2DtE1diLLg2jZikYcstsu/G5RgvbzbKqjiaMwTdXC3AMvDxQrs7U5pDRZFzoofG3cpODbTm+uy3m0kP70z0M1K45UbDG0p+itnTu9x40JbQEgefbx38AItNvAIx1A8HO4I1VX28= wayne@stream";
+
+  # System
+  timeZone = "Australia/Brisbane";
+  primaryUser = "nixos"; # main interactive user on every host
+
+  # Storage
+  storageRoot = "/tank"; # ZFS pool root on `server`
+
+  # Well-known ports for LAN services referenced from multiple hosts
+  beszelHubPort = 8090;
+  pveWebPort = 8006;
+  pbsWebPort = 8007;
+}