Reorganize scripts/ into secrets/, proxmox/, and lib/ subfolders

scripts/ had grown to 10 top-level scripts covering three distinct
concerns (sops/age + SSH host-key management, Proxmox deployment, and
repo-wide bootstrap/CI) with no grouping. Move the key-management scripts
(backup-admin-key.sh, rotate-admin-key.sh, prepare-host-key.sh,
sync-host-keys.sh) into scripts/secrets/, and the Proxmox scripts
(create-proxmox-resource.sh, configure-nix-cache-client.sh) into
scripts/proxmox/; leave env.sh, codex-setup.sh, codex-maintenance.sh, and
bump-nixpkgs-release.sh at the top level (frequently hand-typed or pure
shared config) and scripts/lib/ as-is.

Updates every cross-reference: each moved script's repo_root computation
(now one directory deeper), shellcheck source= directives, inter-script
paths (create-proxmox-resource.sh's call into sync-host-keys.sh and its
remote bootstrap of configure-nix-cache-client.sh on the Proxmox node),
and every doc/module mention (CLAUDE.md's Scripts section reorganized to
match, README.md, docs/auto-installer.md, docs/proxmox-images.md,
modules/installer/common.nix, modules/platforms/lxc.nix). CI workflows
need no change -- they only invoke codex-maintenance.sh, which didn't
move. Verified via bash -n, shellcheck (no new warnings beyond the
pre-existing SC1091/SC2029/SC2095 baseline), and live dry-runs of
sync-host-keys.sh --all and create-proxmox-resource.sh --list from their
new paths.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/check-nixos.yml

@@ -17,13 +17,5 @@ jobs:
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@v19
 
-      - name: Evaluate all NixOS hosts
-        run: |
-          set -euo pipefail
-          hosts="$(nix --extra-experimental-features 'nix-command flakes' eval --json \
-            .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]')"
-          for host in $hosts; do
-            echo "Evaluating ${host}"
-            nix --extra-experimental-features 'nix-command flakes' eval \
-              ".#nixosConfigurations.${host}.config.system.build.toplevel.drvPath" --raw
-          done
+      - name: Run maintenance checks (secrets, fmt, lint, eval)
+        run: bash scripts/codex-maintenance.sh

.github/workflows/check-nixos.yml

@@ -17,13 +17,5 @@ jobs:
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@v19
 
-      - name: Evaluate all NixOS hosts
-        run: |
-          set -euo pipefail
-          hosts="$(nix --extra-experimental-features 'nix-command flakes' eval --json \
-            .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]')"
-          for host in $hosts; do
-            echo "Evaluating ${host}"
-            nix --extra-experimental-features 'nix-command flakes' eval \
-              ".#nixosConfigurations.${host}.config.system.build.toplevel.drvPath" --raw
-          done
+      - name: Run maintenance checks (secrets, fmt, lint, eval)
+        run: bash scripts/codex-maintenance.sh

.gitignore

@@ -3,12 +3,22 @@
 result
 result-*
 
+# Disko's proxmox-* image-builder writes the finished .raw disk image
+# directly into the current directory, not into a result-* symlink (see
+# docs/proxmox-images.md, scripts/create-proxmox-resource.sh) — several GB
+# each, never meant to be committed.
+*.raw
+
 # Ignore automatically generated direnv output
 .direnv
 
-auto-installer/flake.lock
-auto-installer/result
-auto-installer/nixos-auto.iso
+# Python bytecode cache (scripts/lib/*.py)
+__pycache__/
+*.pyc
+
+# Locally-generated SSH host keys staged for transfer to a new machine
+# during install (see scripts/prepare-host-key.sh) — never commit these.
+host-keys/
 
 # Temporary Milestone 1 audit checklist (remove-sensetive-info-refactor.md)
 # - working notes only, never committed, deleted once every row is rotated.

.sops.yaml

@@ -1,8 +1,13 @@
 keys:
-  - &admin age10nd382a9klsn2mrs60emdtsxe43pht3a0m9p29phfrhy0wfyt3vsq9r667
+  - &admin age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad
   - &docker age19gfn2yedg76dmztm4hncr7vf3r3c9j0qpt4rap7y7gersjk4m3ks2lhd0e
   - &server age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
   - &nix-cache age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
+  - &lxc-minimal age1qz9d4ka4xgexujyd247s7lp737sulp5fhxl5d65fj2ykvc4j4edqrsdks8
+  - &nix-minimal age120whqj96g26lsgy4udvgsn8dc9lumh8jeu3a564fx79rjr5lxffqmrljuu
+  - &proxmox-minimal age10at8862478urh0eeuwh8hzln6ck78jgwtztgxatwqlzwagg77y5snm4xzg
+  - &lxc-nix-cache age1xjst4frdh0th6q8m7p7u9g5af7ty5jqeum0p6z8a52a9q7st7ewqw8yl9j
+  - &lxc-docker age1ezk9x53zt8kcnscdm80jcyf0xq97vndv7jsn3rl8cc0cwm2jmpmq372dzs
 
 creation_rules:
   # Shared across every currently-deployed host: root/nixos password hash,
@@ -16,12 +21,18 @@ creation_rules:
           - *docker
           - *server
           - *nix-cache
+          - *lxc-minimal
+          - *nix-minimal
+          - *lxc-nix-cache
+          - *proxmox-minimal
+          - *lxc-docker
 
   - path_regex: secrets/nix-cache\.yaml$
     key_groups:
       - age:
           - *admin
           - *nix-cache
+          - *lxc-nix-cache
 
   - path_regex: secrets/server\.yaml$
     key_groups:

AGENTS.md

@@ -7,7 +7,7 @@ servers and workstation.
 
 The flake exposes NixOS configurations named `<platform>-<buildtype>`
 (platforms: `linode`, `proxmox`, `lxc`; build types: `minimal`, `nix-cache`,
-`server`, `docker`, `gui`, `pxe-boot`), generated from `modules/platforms/*`
+`server`, `docker`, `gui`, `pxe-boot`, `tailscale-exit-node`, `tor-relay`), generated from `modules/platforms/*`
 and `modules/build-types/*` by the `mkTarget` function in `flake.nix`. Not
 every combination is built — `pxe-boot` has no `linode` variant. See
 `README.md` for the full current target list; treat `flake.nix` as the

CLAUDE.md

@@ -17,11 +17,19 @@ machines when deployed.
 - Validation is limited to evaluation, linting, formatting checks, and
   `nix build --dry-run --no-link`.
 - Do not add secrets, tokens, private keys, or new password hashes to the repo.
-- This repo currently contains **committed password hashes** (e.g.
-  `prepare.sh`, `hosts/nixos/configuration.nix`) and SSH public keys (e.g.
-  `modules/nix-cache/server.nix`). The hashes are known tech debt — do not use
-  them as a template for new hosts, and flag any *new* secret-like string you
-  encounter instead of committing it.
+- This repo currently contains **committed password hashes** in
+  `modules/installer/common.nix` (the auto-installer's own root/nixos login —
+  a deliberate, documented choice, see `docs/auto-installer.md`, not
+  accidental tech debt) and **SSH public keys** in `variables.nix`
+  (`vars.adminSshKey`, `vars.remoteBuilderAuthorizedKeys`) plus a couple of
+  per-host `KEY` values for beszel-agent auth (`hosts/server/host.nix`,
+  `hosts/nix-cache/host.nix`). Don't use the installer's hardcoded hash as a
+  template for a *real* host — every other host uses sops-nix
+  (`hashedPasswordFile`, see "Security Notes" in `README.md`). Flag any *new*
+  secret-like string you encounter instead of committing it.
+- `host-keys/` is gitignored — locally-generated *private* SSH host keys for
+  the auto-installer (see `docs/auto-installer.md`). Never commit its
+  contents; if `git status` ever shows it as trackable, something is wrong.
 
 ## Commands
 
@@ -50,58 +58,241 @@ maintenance script pulls them via `nix run github:NixOS/nixpkgs/nixos-25.11#<too
 There is no test suite — "correctness" here means the flake evaluates and
 `nixpkgs-fmt`/`statix` are clean.
 
+**In an interactive agent session**, prefer targeted checks over full-repo
+sweeps: after editing one or two hosts/modules, evaluate just the
+`nixosConfigurations.<host>` you touched (plus any `config.system.build.tarball`
+/`diskoImagesScript`/package output affected) rather than looping over every
+host — `codex-maintenance.sh` evaluates every `nixosConfigurations` host plus
+every package/tarball/image variant and is slow to run after each small
+change. Reserve a full
+`codex-maintenance.sh` run for changes that plausibly affect every host
+(`modules/common/*`, `flake.nix`, `variables.nix`) or as a final check before
+committing. This is a session-workflow preference only — it does not apply to
+CI, which should keep running the full script on every push/PR regardless of
+diff size; that's the point of it.
+
+## Scripts
+
+Beyond `codex-setup.sh`/`codex-maintenance.sh` above, `scripts/` is
+organized by purpose: `scripts/secrets/` (sops/age + SSH host-key
+management), `scripts/proxmox/` (Proxmox deployment), `scripts/lib/`
+(shared helpers, sourced by the scripts below — not run directly), and a
+handful of repo-wide scripts left at the top level (`env.sh`,
+`bump-nixpkgs-release.sh`, plus `codex-setup.sh`/`codex-maintenance.sh`
+above). When adding a new script, put it in the matching subfolder rather
+than the top level, and if it duplicates logic another script already has,
+lift the shared part into `scripts/lib/` instead of copying it.
+
+### `scripts/secrets/`
+
+- `scripts/secrets/sync-host-keys.sh` — generates/registers SSH host keys
+  and their `.sops.yaml`/`secrets/*.yaml` recipients for flake targets,
+  idempotently (`--all`, `<target>`, `--remove`, `--regenerate-all-keys`,
+  all with `--dry-run`). The primary tool for provisioning a new host's
+  secrets access — see "Creating a new machine" in `docs/auto-installer.md`.
+- `scripts/secrets/prepare-host-key.sh` — narrower predecessor: generates a
+  key by an arbitrary name without touching `.sops.yaml`. Still useful to
+  pre-generate a key before its flake target exists yet, since
+  `sync-host-keys.sh` can only act on targets `nixosConfigurations` already
+  has.
+- `scripts/secrets/rotate-admin-key.sh <backup-admin-key> [--new-key-file
+  <path>] [--dry-run]` — rotates `.sops.yaml`'s `&admin` age key: decrypts
+  with a backed-up copy of the key currently trusted as `&admin` (verified
+  by deriving its public key and comparing, not taken on faith), replaces
+  the `&admin` line with a new key already present in the environment
+  (defaults to wherever sops/age itself would look), and runs
+  `sops updatekeys` on every `secrets/*.yaml`. One-way: the old key can no
+  longer decrypt anything re-encrypted this way. This is the automation
+  for the manual steps `sync-host-keys.sh`/`create-proxmox-resource.sh`
+  print when they bootstrap a brand-new, not-yet-trusted key on a machine
+  with no prior admin access.
+- `scripts/secrets/backup-admin-key.sh <dest-path> [--key-file <path>]
+  [--force] [--dry-run]` — copies the local sops age key (source
+  resolution matches sops/age itself: `$SOPS_AGE_KEY` inline, then
+  `--key-file`, then `$SOPS_AGE_KEY_FILE`, then the XDG default) to an
+  arbitrary destination path with `0600` permissions, validating it's a
+  real age identity and round-tripping the public key before and after the
+  write. Refuses to overwrite an existing `<dest-path>` without `--force`.
+  Purely a local filesystem copy — never touches `.sops.yaml`/
+  `secrets/*.yaml` or the repo at all. The resulting file is exactly what
+  `rotate-admin-key.sh` expects as its backup-key argument.
+
+### `scripts/proxmox/`
+
+- `scripts/proxmox/create-proxmox-resource.sh` — builds a `lxc-*`/
+  `proxmox-*` target's tarball/disk image and creates it on a real Proxmox
+  node (`pct create` against the tarball as a CT template / `qm create`+
+  `importdisk`), or reconfigures an existing resource's cores/memory/disk
+  size (`--modify`, always requires typing the VMID back to confirm).
+  Checks for an already-uploaded image on the node before building
+  (`--force-rebuild` to skip that and always rebuild), and probes
+  nix-cache's substituter/remote-builder reachability once up front rather
+  than letting every `nix build` call retry against it individually.
+  Refuses to create a target whose host identity already exists live on
+  the node (checked directly via `qm`/`pct`, not any file in this repo)
+  unless `--allow-duplicate-host` is passed. `--dry-run` throughout both
+  modes. The first time it has to bootstrap build tooling on a node (i.e.
+  `nix` wasn't already on its `PATH`), it also runs
+  `scripts/proxmox/configure-nix-cache-client.sh` there (non-fatally — a
+  failure just falls back to building from source / `cache.nixos.org`) so
+  the node substitutes from and can offload builds to nix-cache on every
+  subsequent run, not just this one.
+- `scripts/proxmox/configure-nix-cache-client.sh [--dry-run]
+  [--no-remote-builder] [--no-restart]` — the non-NixOS equivalent of
+  `modules/nix-cache/client.nix`/`remote-builder-client.nix`, for a plain
+  Debian machine with the Nix package manager (not NixOS) already
+  installed: run as root *on that machine* to add nix-cache as a
+  substituter in `/etc/nix/nix.conf` (`https://cache.nixos.org/` kept as
+  fallback) via `extra-substituters`/`extra-trusted-public-keys` so it
+  layers on top of whatever's already there instead of clobbering it, and,
+  if `/root/.ssh/nixremote` is already present (see docs/nix-cache.md
+  "Remote builder SSH keys"), configures it as a distributed-build
+  machine too and trusts nix-cache's SSH host key in
+  `/etc/ssh/ssh_known_hosts`. Idempotent (re-running replaces its own
+  marked block rather than duplicating it); restarts `nix-daemon` by
+  default so the change takes effect immediately.
+
+### `scripts/lib/`
+
+Sourced by the scripts above, never run directly:
+
+- `nix-bootstrap.sh` — `NIX_CONFIG`/`ensure_nix_profile`, shared by
+  `codex-setup.sh`/`codex-maintenance.sh` and the remote build commands
+  `create-proxmox-resource.sh` runs over SSH.
+- `nix-eval.sh` — `NIX_EVAL_FLAGS` plus `list_flake_targets`/
+  `flake_target_hostname` flake-introspection helpers.
+- `ssh-host-keys.sh` — `generate_host_ed25519_key`/`ssh_pubkey_to_age`,
+  shared by `sync-host-keys.sh` and `prepare-host-key.sh`.
+- `sops-age.sh` — `age_pubkey_from_identity_file`/`sops_yaml_admin_pubkey`/
+  `sops_updatekeys` plus the shared sops/age default key-file resolution,
+  shared by `backup-admin-key.sh`, `rotate-admin-key.sh`, and
+  `sync-host-keys.sh`.
+- `confirm.sh` — `confirm_typed`, the "type X back to confirm" destructive-
+  action prompt shared by `create-proxmox-resource.sh` and
+  `sync-host-keys.sh`.
+- `sync-host-keys-edit-sops.py` — the `.sops.yaml` anchor/key_groups editor
+  `sync-host-keys.sh` shells out to (see that script for why: precise,
+  idempotent YAML edits are impractical in bash).
+
+### Top level
+
+- `scripts/env.sh` — shared config (`PROXMOX_HOST`, storage pool, bridge,
+  default cores/memory) sourced by `create-proxmox-resource.sh`. Add new
+  cross-script config here instead of duplicating it per-script.
+- `scripts/bump-nixpkgs-release.sh` — bumps `flake.nix`'s `nixpkgs.url`/
+  `home-manager.url` in place. Exists because flake input URLs can't
+  reference `variables.nix` (confirmed empirically — `nix flake metadata`
+  errors on it), so this is the closest equivalent to a single source of
+  truth for the tracked release.
+
+`sync-host-keys.sh`, `create-proxmox-resource.sh`, and
+`rotate-admin-key.sh` genuinely mutate real state when run for real (not
+`--dry-run`): real `secrets/*.yaml` recipients, real Proxmox VMs/
+containers, real revocation of decrypt access. They require the
+operator's own SSH/sops access, which an agent session doesn't have — but
+don't suggest running any of them non-dry-run without the operator's
+explicit go-ahead even if it becomes technically reachable.
+`backup-admin-key.sh` only writes a key copy to a path the operator gives
+it — lower-stakes than the others, but it still handles a real private
+key, so treat its destination path choice as the operator's call too.
+
 ## Architecture
 
-`flake.nix` is the single entry point. It defines one `nixosConfigurations.<host>`
-attribute per machine, each built the same way:
+`flake.nix` is the single entry point. It generates one
+`nixosConfigurations.<platform>-<buildtype>` attribute per target via the
+`mkTarget` function, composed from:
 
 ```
 nixosSystem {
   modules = [
     disko.nixosModules.disko
-    ./hosts/<host>/configuration.nix        # host-specific config
-    ./modules/hardware-configuration/vm/<proxmox|linode>.nix
+    sops-nix.nixosModules.sops
+    ./modules/common/configuration.nix
+    ./modules/platforms/${platform}.nix        # what it runs on
+    ./modules/build-types/${buildType}.nix     # what it's for
+    hostPath                                   # hosts/<name>/host.nix — per-machine identity
     home-manager.nixosModules.home-manager { ... }
-  ];
+  ] ++ (client-only modules, for every buildType except "nix-cache" itself)
 }
 ```
 
-Hosts currently defined in `flake.nix`: `nixos`, `docker`, `server`,
-`nix-cache`, `nix-minimal`, `pxe-boot`, `linode-minimal`. Treat `flake.nix` as
-the source of truth for which hosts exist — `README.md`, `AGENTS.md`,
+Platforms: `linode`, `proxmox`, `lxc`. Build types: `minimal`, `nix-cache`,
+`server`, `docker`, `gui`, `pxe-boot`, `tailscale-exit-node`, `tor-relay`. Not
+every combination is built — e.g. `pxe-boot` has no `linode` variant
+(PXE/DHCP/TFTP need LAN L2 adjacency a Linode VPS doesn't have), and
+`tor-relay` currently only exists as `lxc-tor-relay`. Treat `flake.nix`'s
+`generatedTargets` as the source
+of truth for which hosts exist — `README.md`, `AGENTS.md`,
 `docs/flake-lock-automation.md`, and the CI eval workflows
 (`.github/workflows/check-nixos.yml`, `.gitea/workflows/check-nixos.yml`) list
-hosts by hand and can drift from it, so re-check them against `flake.nix` when
-adding or removing a host.
+hosts by hand (or, for the CI workflows, evaluate the flake dynamically) and
+can drift from it, so re-check them against `flake.nix` when adding or
+removing a host.
 
 ### Composition pattern
 
-Every host's real configuration lives in `hosts/<host>/configuration.nix`,
-which is a thin list of `imports` pulling in reusable pieces from `modules/`:
-
-- `modules/common/configuration.nix` — base NixOS config imported by (almost)
-  every host: locale, users, nix settings, git. Nearly always the first import.
-- `modules/common/home.nix` / `hosts/<host>/home.nix` — Home Manager config for
-  the `nixos` user; the `nixos` workstation has its own, other hosts share
-  `modules/common/home.nix`.
+- `hosts/<name>/host.nix` — per-machine identity **only**: hostname, hostId,
+  per-machine secrets, `system.stateVersion`. These files carry no `imports`
+  of their own beyond narrow parameterized helpers (see
+  `modules/beszel/host-token.nix` below) — all shared behavior comes from the
+  platform/build-type modules composed in `flake.nix`, not from the host file.
+- `modules/platforms/{linode,proxmox,lxc}.nix` — platform-specific config:
+  boot method, guest tooling, and (for linode/proxmox) the hypervisor-specific
+  hardware config, imported directly by the platform module itself
+  (`../hardware-configuration/vm/{proxmox,linode}.nix`) — **not** wired in
+  from `flake.nix`. `lxc.nix` has no hardware-configuration counterpart since
+  containers share the host kernel; instead it imports nixpkgs' own
+  `virtualisation/proxmox-lxc.nix`, which gives every `lxc-*` host a
+  `config.system.build.tarball` output — a plain rootfs tarball, used as a
+  `pct create ... vztmpl` CT template (**not** `pct restore`, which expects
+  `vzdump` backup-archive metadata this doesn't have), no install step —
+  see `docs/auto-installer.md`.
+- `modules/build-types/*.nix` — what a system is for:
+  minimal/server/docker/gui/pxe-boot/nix-cache/tailscale-exit-node/tor-relay.
+- `modules/common/configuration.nix` — base NixOS config imported by every
+  host: locale, users, nix settings, git.
+- `modules/common/home.nix` / `hosts/nixos/home.nix` — Home Manager config for
+  the `nixos` user; the `nixos` workstation (`gui` build type) has its own,
+  other hosts share `modules/common/home.nix`.
 - `modules/disko/proxmox.nix` — declarative disk layout (GPT: ESP + swap +
-  ext4 root) via disko, used by all Proxmox-VM hosts.
+  ext4 root) via disko, used by all Proxmox-VM hosts (`proxmox-*`, not
+  `lxc-*`). Also carries `imageSize`/`imageName`, letting every `proxmox-*`
+  host be built as a standalone, `qm importdisk`-ready `.raw` image with no
+  install step — see `docs/proxmox-images.md`.
+- `modules/disko/linode.nix` — `linode-*`'s disko config, deliberately
+  different in kind from the Proxmox one: Linode provisions and sizes
+  `/dev/sda`/`/dev/sdb` itself as whole, unpartitioned devices before the OS
+  boots, so this declares them with `destroy = false` (disko never wipes
+  them) and a bare `filesystem`/`swap` content type instead of a partition
+  table — idempotent against an already-provisioned disk, never destructive.
 - `modules/boot/efi.nix` — systemd-boot + EFI vars, paired with the disko module.
-- `modules/hardware-configuration/vm/{proxmox,linode}.nix` — hypervisor-specific
-  hardware config, wired in from `flake.nix` (not from the host file).
-- `modules/nix-cache/{client,server}.nix` + `modules/remote-builder-client.nix` —
-  binary cache substituter + SSH remote-builder wiring; see `docs/nix-cache.md`
-  for the full design (per-host local stores, no shared `/nix/store`, and how
-  the `nixremote` signing/SSH keys fit together).
-- `modules/tailscale/`, `modules/docker/`, `modules/beszel/`,
-  `modules/services/*` — single-purpose, single-host feature modules (e.g.
-  `docker/enable-service.nix`, `services/zfs/enable-service.nix`,
-  `beszel/enable-agent.nix` for monitoring). Grep `hosts/*/configuration.nix`
-  for the `imports` list to see which modules apply to a given host.
+- `modules/installer/` — the auto-installer environment (ISO, also served as
+  PXE netboot): `common.nix` (shared config + the generated
+  `auto-install.sh`), `iso.nix`, `host-keys.nix` (optionally bakes
+  `host-keys/` into the image under `--impure`). See
+  `docs/auto-installer.md`.
+- `modules/pxe-boot/stage-installer-artifacts.nix` — builds the installer's
+  netboot image and stages it on the `pxe-boot` host so its iPXE menu can
+  chain straight to it. See `docs/pxe-boot.md`.
+- `modules/nix-cache/{client,server,remote-builder-client}.nix` — binary cache
+  substituter + SSH remote-builder wiring; see `docs/nix-cache.md` for the
+  full design (per-host local stores, no shared `/nix/store`, and how the
+  `nixremote` signing/SSH keys fit together).
+- `modules/beszel/host-token.nix` — parameterized helper module
+  (`{ name, sopsFile }`) that wires a host's beszel-agent sops secret/template
+  and `environmentFile`; used by `hosts/server/host.nix` and
+  `hosts/nix-cache/host.nix` to avoid duplicating that boilerplate.
+- `modules/tailscale/`, `modules/docker/`, `modules/networking/`,
+  `modules/traefik/`, `modules/tor/`, `modules/services/*` — single-purpose,
+  single-host
+  feature modules (e.g. `docker/enable-service.nix`,
+  `services/zfs/enable-service.nix`). Grep `modules/build-types/*.nix` for
+  each build type's `imports` list to see which modules apply where.
 
-New host = new `hosts/<name>/configuration.nix` + a matching block added to
-`flake.nix`'s `nixosConfigurations`, composed from existing `modules/*` pieces
-rather than duplicating config.
+New host = new `hosts/<name>/host.nix` + a matching
+`mkTarget { platform; buildType; hostPath; }` entry added to `flake.nix`'s
+`generatedTargets`, composed from existing `modules/*` pieces rather than
+duplicating config.
 
 ### Other docs worth reading before touching these areas
 
@@ -109,6 +300,12 @@ rather than duplicating config.
   handling.
 - `docs/pxe-boot.md` — the `pxe-boot` host's iPXE/TFTP/HTTP boot chain and
   directory layout under `/srv/pxe`.
+- `docs/auto-installer.md` — the installer environment (ISO/netboot/Proxmox
+  LXC), `host-keys/` and the sops-nix pre-seeding problem it solves, and why
+  `lxc-*` hosts are deliberately excluded from its menu.
+- `docs/proxmox-images.md` — building `proxmox-*` hosts as standalone `.raw`
+  disk images (disko's image builder) instead of installing, and deploying
+  the result to Proxmox.
 - `docs/flake-lock-automation.md` — how `flake.lock` updates flow through CI
   (scheduled `nix flake update` PR + host-eval-on-PR workflow) and why hosts
   should track the committed lock file rather than `nixos-rebuild --upgrade-all`.

README.md

@@ -10,22 +10,32 @@ pieces composed in `flake.nix`:
 
 - **Platforms** (what it runs on): `linode`, `proxmox`, `lxc`
 - **Build types** (what it's for): `minimal`, `nix-cache`, `server`, `docker`,
-  `gui`, `pxe-boot`
+  `gui`, `pxe-boot`, `tailscale-exit-node`, `tor-relay`
 
 Not every combination exists — `pxe-boot` has no `linode` variant, since
-PXE/DHCP/TFTP need LAN L2 adjacency that a Linode VPS doesn't have. The full
-list:
+PXE/DHCP/TFTP need LAN L2 adjacency that a Linode VPS doesn't have, and
+`tor-relay` currently only exists as `lxc-tor-relay`. The full list:
 
 | Target | Purpose |
 | --- | --- |
-| `linode-minimal` | Minimal NixOS host profile on a Linode VPS (real, deployed) |
-| `proxmox-minimal` | Minimal NixOS host profile on Proxmox (real, deployed — previously the flat `nix-minimal` target) |
+| `linode-minimal` | Minimal NixOS host profile on a Linode VPS |
+| `proxmox-minimal` | Minimal NixOS host profile on Proxmox — previously the flat `nix-minimal` target |
 | `lxc-minimal` | Minimal NixOS host profile in a Proxmox LXC container |
-| `linode-nix-cache` / `proxmox-nix-cache` / `lxc-nix-cache` | Local Nix binary cache and remote builder (`proxmox-nix-cache` is the real, deployed one — previously the flat `nix-cache` target) |
-| `linode-server` / `proxmox-server` / `lxc-server` | Storage, NFS, backup, and monitoring exporter host (`proxmox-server` is the real, deployed one — previously the flat `server` target) |
-| `linode-docker` / `proxmox-docker` / `lxc-docker` | Docker host for the main container stack (`proxmox-docker` is the real, deployed one — previously the flat `docker` target) |
-| `linode-gui` / `proxmox-gui` / `lxc-gui` | Cinnamon desktop workstation (`proxmox-gui` is the real, deployed one — previously the flat `nixos` target) |
-| `proxmox-pxe-boot` / `lxc-pxe-boot` | HTTP/iPXE boot asset host (`proxmox-pxe-boot` is the real, deployed one — previously the flat `pxe-boot` target) |
+| `linode-nix-cache` / `proxmox-nix-cache` / `lxc-nix-cache` | Local Nix binary cache and remote builder — previously the flat `nix-cache` target |
+| `linode-server` / `proxmox-server` / `lxc-server` | Storage, NFS, backup, and monitoring exporter host — previously the flat `server` target |
+| `linode-docker` / `proxmox-docker` / `lxc-docker` | Docker host for the main container stack — previously the flat `docker` target |
+| `linode-gui` / `proxmox-gui` / `lxc-gui` | Cinnamon desktop workstation — previously the flat `nixos` target |
+| `proxmox-pxe-boot` / `lxc-pxe-boot` | HTTP/iPXE boot asset host — previously the flat `pxe-boot` target |
+| `linode-tailscale-exit-node` / `proxmox-tailscale-exit-node` / `lxc-tailscale-exit-node` | Tailscale exit node |
+| `lxc-tor-relay` | Tor middle relay |
+
+Which variant of a given buildtype is actually deployed isn't tracked
+anywhere in this repo — that's live infrastructure state, not something a
+committed file can keep accurate, and it changes independently of the code.
+Check the Proxmox node itself, or `/etc/flake-target` on a running host (see
+below), if you need to know what's really out there right now.
+`scripts/proxmox/create-proxmox-resource.sh`'s duplicate-host guard works the same
+way: it checks the Proxmox node directly rather than any file here.
 
 Each buildtype's `hosts/<name>/host.nix` carries the per-machine identity
 (hostname, hostId, per-machine secrets, `system.stateVersion`) that must stay
@@ -46,14 +56,17 @@ nix eval --json .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]'
 | Path | Purpose |
 | --- | --- |
 | `flake.nix` | Flake inputs, the `mkTarget` platform × build-type generator, and `nixosConfigurations` outputs |
+| `variables.nix` | Single source of truth for shared values (LAN domain/CIDR, hostnames, timezone, primary username, storage root, NFS share subpaths/mountpoints, service ports, ...) — passed to every module and Home Manager config as the `vars` argument via `specialArgs`/`extraSpecialArgs` |
 | `hosts/<name>/host.nix` | Per-machine identity: hostname, hostId, per-machine secrets, `system.stateVersion` |
 | `hosts/nixos/home.nix` | Workstation-specific Home Manager config (used by the `gui` build type) |
 | `modules/platforms/` | Platform-specific config: virtualisation guest tools, boot method, hardware config (`linode.nix`, `proxmox.nix`, `lxc.nix`) |
 | `modules/build-types/` | Build-type-specific config: what makes a system minimal/server/docker/gui/pxe-boot/nix-cache |
 | `modules/common/` | Shared NixOS config, Home Manager, aliases imported by every host |
 | `modules/nix-cache/` | Binary cache and remote builder client/server modules |
-| `docs/` | Operational notes for cache, builders, lock updates, and boot services |
-| `scripts/` | Codex setup and validation helpers |
+| `modules/installer/` | Auto-installer environment (ISO, also served as PXE netboot) — see `docs/auto-installer.md` |
+| `host-keys/` | Gitignored, locally-generated SSH host keys for the auto-installer — see `docs/auto-installer.md` |
+| `docs/` | Operational notes for cache, builders, lock updates, boot services, the auto-installer, and Proxmox image builds |
+| `scripts/` | Codex setup, validation, host-key, release-bump, and Proxmox resource helpers |
 
 ## Validation
 
@@ -84,6 +97,29 @@ review sessions.
   client hosts.
 - `pxe-boot` serves iPXE boot files over HTTP from `/srv/pxe`.
 
+### Deploying a new host
+
+Three different paths depending on target, none of them involving a manual
+`nixos-rebuild switch` from this repo:
+
+- Most hosts: boot the auto-installer, pick the target from its menu — see
+  `docs/auto-installer.md`. Every menu target has a Disko config the
+  installer formats unconditionally (`docs/auto-installer.md`'s "Storage"
+  section covers how this stays non-destructive for `linode-*`, whose disks
+  Linode itself provisions ahead of time).
+- `lxc-*` targets: not installed at all — build a ready-to-run container
+  tarball and `pct create` it as a CT template directly. `docs/auto-installer.md`
+  covers why (and the installer's menu excludes them for the same reason).
+- `proxmox-*` targets: can alternatively be built as a standalone `.raw`
+  disk image and attached to a new VM with no install step — see
+  `docs/proxmox-images.md`.
+
+`scripts/proxmox/create-proxmox-resource.sh --type lxc|vm --host <name>` automates
+either of the last two end to end (host-key registration, building the
+image directly on the Proxmox node itself, `pct create`/`qm create`), with
+`--dry-run` and a guard against duplicating an already-deployed host's
+identity. See its `--help`.
+
 ## Security Notes
 
 Do not commit tokens, private keys, live credentials, or new password hashes
@@ -104,6 +140,13 @@ enabled via `git config core.hooksPath .githooks`, done automatically by
 `scripts/codex-setup.sh`) runs `gitleaks protect --staged` to catch mistakes
 before they're committed.
 
+The auto-installer environment is the one deliberate exception to
+sops-nix-everywhere: it has a hardcoded login password instead (no stable
+per-boot host key for sops-nix to derive from on ephemeral media) — see
+"Host keys" in `docs/auto-installer.md` for why, and how the private keys it
+*does* pre-seed for target hosts stay out of git via the gitignored
+`host-keys/` directory.
+
 This repository's git *history* still contains secrets committed before this
 migration (see `remove-sensetive-info-refactor.md`) — those are being
 scrubbed and rotated separately; don't treat the repo as safe to make public

docs/auto-installer.md

@@ -0,0 +1,286 @@
+# Auto-installer
+
+This flake builds a self-contained NixOS installer environment that can
+install any host exposed by its own `nixosConfigurations`. It was migrated
+from a formerly-separate `nix-auto-installer` repo — everything it did now
+lives here.
+
+The installer provides a small NixOS install environment (ISO, or the same
+image netbooted via PXE) with SSH access, Git support, and an interactive
+installation script.
+Logging in as any user (root or `nixos`) runs `/etc/auto-install.sh`,
+discovers available hosts from this same flake, lets the operator choose a
+target, applies that host's Disko storage configuration, installs NixOS, and
+reboots.
+
+**This applies to every `nixosConfigurations` target except `lxc-*` hosts —
+see "LXC hosts" immediately below for why those are different.**
+
+## LXC hosts
+
+`lxc-*` targets (`lxc-minimal`, `lxc-nix-cache`, `lxc-server`, `lxc-docker`,
+`lxc-gui`, `lxc-pxe-boot`, `lxc-tailscale-exit-node`, `lxc-tor-relay`) are **not** installed via `auto-install.sh` — the
+interactive menu deliberately excludes them. Don't try to select one there;
+`nixos-install` would bind-mount `/` onto `/mnt` (LXC containers have no raw
+disk to partition) and then refuse to touch the filesystem it's currently
+running on — it's designed to protect exactly this case, so it just fails.
+
+`modules/platforms/lxc.nix` imports nixpkgs' own
+`virtualisation/proxmox-lxc.nix` module, which gives every `lxc-*` host a
+`config.system.build.tarball` output — a complete, directly Proxmox-importable
+container image, no install step at all:
+
+```sh
+nix build .#nixosConfigurations.lxc-minimal.config.system.build.tarball
+```
+
+This is a plain rootfs tarball, not a `vzdump` backup archive — restoring it
+with `pct restore` fails ("archive contains no configuration file"), since
+that command expects backup-archive metadata this tarball doesn't have. Use
+it as a CT *template* instead: drop it under Proxmox's template storage
+(conventionally `/var/lib/vz/template/cache/` for the `local` storage, or
+the GUI's "Create CT" → upload-as-template flow) and create a container
+from it, supplying all config on the command line since a template has none
+of its own:
+
+```sh
+pct create <vmid> local:vztmpl/<file>.tar.xz \
+  --unprivileged 1 --features nesting=1,keyctl=1 \
+  --rootfs local-lvm:8 --hostname <name> --cores 2 --memory 2048 --swap 2048 \
+  --net0 name=eth0,bridge=vmbr0,ip=dhcp
+pct start <vmid>
+```
+
+Every one of those extra flags is load-bearing, confirmed by actually
+booting one:
+
+- `--unprivileged 1` — `modules/platforms/lxc.nix` sets
+  `proxmoxLXC.privileged = false`, so the image assumes it's running
+  unprivileged. `pct create`'s own CLI default for this flag is
+  privileged (unlike the web UI, whose checkbox defaults the other way)
+  — omit it and you get a privileged container running a NixOS config
+  that assumes unprivileged, a real mismatch.
+- `--features nesting=1,keyctl=1` — required for a modern (v247+)
+  systemd guest to boot unprivileged at all. Without it, AppArmor denies
+  the nested user namespaces and credential mounts systemd routinely
+  uses (even plain getty units) — every getty crash-loops on a denied
+  `/run/credentials/*` mount every ~3s (this is what garbage on the
+  console turns out to be) while core services like `nsncd` fail the
+  same way, and the system never finishes activating.
+- `--swap 2048` — `--memory` doesn't touch swap; it silently stays at
+  Proxmox's own 512M default otherwise. Match it to `--memory` unless
+  you deliberately want otherwise.
+
+First boot runs `boot.postBootCommands` (registers the Nix store DB and
+system profile) — there's no separate activation step to run yourself.
+`scripts/proxmox/create-proxmox-resource.sh --type lxc --host <name>` automates all
+of this (host-key handling, building the tarball directly on the Proxmox
+node itself, `pct create` with the flags above) — see its `--help`.
+
+Host keys still need pre-seeding the same way as any other host — the
+sops-nix activation-vs-first-boot race is identical regardless of how the
+image reaches the machine. Unlike the ISO/PXE installer (where
+`modules/installer/host-keys.nix` bakes *every* `host-keys/` entry into
+`/etc/host-keys/` for `auto-install.sh` to pick from and copy at install
+time — see "Host keys" below), an `lxc-*` tarball has no install step to
+copy anything during, so `modules/platforms/lxc.nix` bakes this *one*
+target's key straight into `/etc/ssh/ssh_host_ed25519_key(.pub)` directly,
+keyed by its own exact flake target name (`config.environment.etc` can't
+be read back from within a module still contributing to it, so this comes
+in via `specialArgs.flakeTarget`, set by `flake.nix`'s `mkTarget`):
+
+```sh
+NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" \
+  nix build .#nixosConfigurations.lxc-nix-cache.config.system.build.tarball --impure
+```
+
+Confirmed the hard way: without this, the tarball's own built-in system
+just generates a fresh host key at first boot like any host would, which
+can never match whatever `.sops.yaml` actually trusts for that target —
+`sops-install-secrets` fails with `Error getting data key: 0 successful
+groups required, got 0`, and *every* secret (including this host's own
+login) permanently fails to decrypt, silently — no error in the boot log
+at all, since the activation step that would install secrets only runs on
+a from-scratch first activation and skips silently once `/run/current-system`
+already exists. `scripts/proxmox/create-proxmox-resource.sh` always builds with
+`NIXOS_HOST_KEYS_DIR` set for this reason.
+
+## Layout
+
+- `modules/installer/common.nix` — shared by every installer target: SSH
+  access, users, the generated `/etc/auto-install.sh` script, and the
+  `programs.bash.loginShellInit` hook that runs it on login.
+- `modules/installer/iso.nix` — ISO/netboot-specific: imports the stock
+  `installation-cd-minimal.nix` module plus `common.nix`. Also used, paired
+  with `netboot-minimal.nix`, to build the PXE netboot variant (see
+  `docs/pxe-boot.md`).
+- `modules/installer/host-keys.nix` — optionally bakes pre-generated SSH
+  host keys into the image; see "Host keys" below.
+- `scripts/secrets/sync-host-keys.sh` — admin-workstation tool that generates,
+  registers, and (via `--remove`/`--regenerate-all-keys`) retires host
+  keys; see "Creating a New Machine" below.
+- `scripts/secrets/prepare-host-key.sh` — narrower predecessor: generates a single
+  key by an arbitrary name without touching `.sops.yaml`. Still useful for
+  pre-generating a key *before* its flake target exists (`sync-host-keys.sh`
+  can only act on targets `nixosConfigurations` already has); otherwise
+  `sync-host-keys.sh` does the same thing and more.
+
+Flake outputs:
+
+```nix
+nixosConfigurations.installer   # ISO/netboot installer image
+
+packages.x86_64-linux.iso   # installer ISO/netboot image
+packages.x86_64-linux.pxe   # netboot-ipxe + netboot-initrd + netboot-kernel, bundled
+```
+
+```sh
+nix build .#iso
+nix build .#pxe
+```
+
+There's no `nixosConfigurations.proxmox-lxc` (installer-boots-as-an-LXC-
+container) or `packages.x86_64-linux.lxc`/`.all` anymore. Both existed only
+to let the installer itself run as an LXC container so you could
+`nixos-install` some *other* host from within it — but LXC targets are
+excluded from the install menu (same bind-mount problem as any LXC
+`nixos-install`), and now have their own direct tarball path anyway (see
+"LXC hosts" above), which left the installer's own LXC form with no real
+use case.
+
+The `pxe` variant is also built automatically as part of the `pxe-boot` host
+itself (`modules/pxe-boot/stage-installer-artifacts.nix`) and served over
+iPXE — see `docs/pxe-boot.md`.
+
+## Host keys
+
+`sops-nix` derives each host's decryption key from its own
+`/etc/ssh/ssh_host_ed25519_key`, generated at **activation** time — before
+systemd would otherwise generate one on first boot. Without pre-seeding this
+key, secrets (including the root/nixos login password) fail to decrypt on a
+genuinely fresh install.
+
+Generated host keys live in `host-keys/` at the repo root (`ssh_host_ed25519_key`
++ `.pub` pairs per hostname). This directory is **gitignored on purpose** —
+private key material must never be committed — which also means flakes can't
+see it through a normal relative path. `modules/installer/host-keys.nix`
+reads it through `builtins.getEnv`, which Nix silently returns as an empty
+string under normal (non-`--impure`) evaluation, so the module is a no-op —
+safe by default, including in CI — unless explicitly opted into:
+
+```sh
+NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build .#iso --impure
+```
+
+When built this way, every key currently in `host-keys/` is baked into the
+image at `/etc/host-keys/<hostname>_ssh_host_ed25519_key(.pub)`, and
+`auto-install.sh` automatically installs whichever one matches the flake
+target selected at install time — no manual per-host scp step needed.
+
+**Trade-off, accepted deliberately for this LAN-only setup:** baking keys in
+means every key present in `host-keys/` at build time becomes readable by
+anyone who can reach the built image — including, for the PXE variant, anyone
+who can reach the `pxe-boot` host's unauthenticated HTTP server. This is
+considered acceptable here because `pxe-boot` sits behind LAN-only network
+infrastructure, not the open internet. If that ever changes, reconsider this
+default.
+
+`auto-install.sh` still supports the older manual path as a fallback: if a
+host's key isn't baked in (`/etc/host-keys`), it checks `/root/host-keys`
+next, where you can `scp` a key in after boot, same as before this migration.
+
+## Storage
+
+Disk partitioning is handled by Disko — the installer has no hardcoded
+`parted`/`mkfs`/`mkswap`/`mount` commands, and `auto-install.sh` runs
+`disko --mode destroy,format,mount` unconditionally, no branching on whether
+the target has a Disko config. Every host reachable through this menu has
+one:
+
+- `proxmox-*` (`modules/disko/proxmox.nix`): a real GPT partition table
+  (ESP + swap + root) on `/dev/sda`.
+- `linode-*` (`modules/disko/linode.nix`): Linode provisions and sizes
+  `/dev/sda`/`/dev/sdb` itself as whole, unpartitioned block devices before
+  the OS ever boots, so this declares them with `destroy = false` (skips
+  disko's wipe stage for these disks entirely — see the option's own docs)
+  and a bare `filesystem`/`swap` content type with no partition table, and
+  the format step it does run only calls `mkfs`/`mkswap` if `blkid` shows
+  the device isn't already formatted — a re-run against an
+  already-provisioned Linode disk is a no-op, not a wipe.
+
+`lxc-*` is the only category without one — it's excluded from this menu
+entirely (see "LXC hosts" above), so it never reaches this code path.
+
+## Installer process
+
+`/etc/auto-install.sh`:
+
+1. Queries `nixosConfigurations` from this flake over the network (`git+https://<lanDomain>/beatzaplenty/nixos.git`) — this happens at *install* time, not build time, so a generic installer image always sees whatever hosts are currently committed, without needing a rebuild.
+2. Presents them as a menu; confirms the choice.
+3. Skips the `nix-cache` substituter when installing a `nix-cache` host itself (consistent with that host's own runtime config).
+4. Runs `disko --mode destroy,format,mount` (see "Storage" above — every host reachable through this menu has a Disko config, so this is unconditional).
+5. Installs the target's SSH host key from `/etc/host-keys` or `/root/host-keys` (see "Host keys" above).
+6. Runs `nixos-install --flake <url>#<choice> --no-root-password`.
+7. Cleans up and reboots.
+
+## Creating a new machine
+
+Do this instead of jumping straight to a plain install whenever the target
+host consumes any sops-nix secret — as of this writing, that's every host
+(`modules/common/configuration.nix` puts the root/nixos password hash and the
+GitHub token behind sops-nix for all of them).
+
+1. **Add the flake target** — `hosts/<name>/host.nix` plus the matching
+   `mkTarget { ... }` entry in `flake.nix`'s `generatedTargets` (see
+   "Composition pattern" in `CLAUDE.md`). No secrets involved yet, so this
+   is safe to commit on its own if you want a clean history.
+
+2. **On your admin workstation, generate and register its host key:**
+
+   ```sh
+   ./scripts/secrets/sync-host-keys.sh <flake-target>
+   ```
+
+   This generates `host-keys/<flake-target>_ssh_host_ed25519_key(.pub)`,
+   adds it as a new `.sops.yaml` anchor, works out which `secrets/*.yaml`
+   files this specific host actually references (from its own
+   `config.sops.secrets`, not guessed), adds it to each one's
+   `key_groups`, and re-encrypts them with `sops updatekeys` — no manual
+   YAML editing. Safe to re-run; it only fills in what's missing.
+
+   Doing this for every host that needs one at once — after adding several
+   new targets, or just to catch up any that were missed — is
+   `./scripts/secrets/sync-host-keys.sh --all`. See `scripts/secrets/sync-host-keys.sh --help`
+   for its other modes (`--remove`, `--regenerate-all-keys`).
+
+3. **Commit and push.** The flake build the installer uses has to see the
+   new recipient before you install, or decryption fails on first boot
+   regardless of the next step.
+
+4. **Build the installer image with keys baked in** (or reuse an already-serving `pxe-boot` host, which does this automatically once redeployed):
+
+   ```sh
+   NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build .#iso --impure
+   ```
+
+5. **Boot it on the target machine**, log in, select the new host's flake
+   target from the menu, confirm. `auto-install.sh` finds the baked-in key,
+   runs Disko + `nixos-install`, and reboots.
+
+6. **Verify after reboot:**
+
+   ```sh
+   ssh <new-host> ls /run/secrets/
+   ```
+
+   If that's empty or login fails, the host's age key most likely wasn't in
+   `.sops.yaml` (or wasn't re-encrypted into the secrets file it needs) when
+   `nixos-install` ran — fix `.sops.yaml`/`secrets/*.yaml`, push, then re-run
+   `nixos-install --flake .#<hostname> --no-root-password` from a rescue
+   environment against the existing `/mnt`, or just redo the install.
+
+## Safety
+
+This installer is destructive: `disko --mode destroy,format,mount` erases
+any disk defined by the selected host's Disko configuration. Always verify
+the selected host profile and target machine before confirming.

docs/nix-cache.md

@@ -8,22 +8,41 @@ This repository configures `nix-cache` as a **binary cache server** and a **remo
 - Every machine still keeps and uses its own local `/nix/store`.
 - Clients prefer `http://nix-cache` for substitutes and keep `https://cache.nixos.org/` as fallback.
 - Clients can offload builds to `nix-cache` through SSH (`nix.distributedBuilds`).
-- Client hosts import `modules/nix/cache-client.nix` and, when remote building is enabled, `modules/nix/remote-builder-client.nix`.
-- The `nix-cache` host imports `modules/nix/cache-server.nix`.
+- Client hosts import `modules/nix-cache/client.nix` and, when remote building is enabled, `modules/nix-cache/remote-builder-client.nix`.
+- The `nix-cache` host imports `modules/nix-cache/server.nix`.
 
-## Binary cache signing keys (on nix-cache)
+## Binary cache signing key
+
+`modules/nix-cache/client.nix` hardcodes every client's trust in one
+specific public key (`cache.local-1:usoWYanY3Kpq2+kDIS2nhWoLZiRxanmdysdzqCFBHW4=`).
+That means whichever host is currently playing the `nix-cache` role has to
+use that *exact* keypair — not a freshly generated one — or no client will
+accept substitutes from it (they'd just silently fall back to building
+from source). So unlike most per-host secrets, this one can't be
+self-generated on first boot; it's managed via sops-nix like every other
+secret in this repo, sourced from `secrets/nix-cache.yaml`'s
+`cache-priv-key` entry (`modules/nix-cache/server.nix`).
+
+**Adding or rotating the value:**
 
 ```bash
-sudo install -d -m 0700 /etc/nix
-sudo nix-store --generate-binary-cache-key nix-cache-1   /etc/nix/cache-priv.pem   /etc/nix/cache-pub.pem
-sudo chmod 0600 /etc/nix/cache-priv.pem
-sudo chmod 0644 /etc/nix/cache-pub.pem
-cat /etc/nix/cache-pub.pem
+nix-shell -p sops --run 'sops secrets/nix-cache.yaml'
 ```
 
-Do not commit private keys.
-Do not commit new password hashes or live credentials. Existing committed hashes
-should be rotated and moved to host-local secret management.
+Add (or replace) a `cache-priv-key` entry with the private key file's exact
+contents. If you don't have it yet, generate a keypair once:
+
+```bash
+nix-store --generate-binary-cache-key nix-cache-1 cache-priv.pem cache-pub.pem
+```
+
+— paste `cache-priv.pem`'s contents into the `cache-priv-key` entry above,
+delete both local files afterward, and update
+`trusted-public-keys` in `modules/nix-cache/client.nix` (and every already-built
+client) to match `cache-pub.pem` if this is a genuine rotation rather than
+a first-time bootstrap. Any `nixos-configurations.*-nix-cache` host picks
+the new key up automatically on next activation — no more manual
+`/etc/nix/cache-priv.pem` install step.
 
 ## Remote builder SSH keys
 
@@ -40,6 +59,15 @@ On `nix-cache`, install the matching public key used by `nixremote` authorized k
 The committed `nixremote` authorized keys are public SSH keys only. Keep the
 matching private keys on client hosts and out of the repository.
 
+nix-cache's own SSH *host* key is trusted declaratively via
+`programs.ssh.knownHosts` in `modules/nix-cache/remote-builder-client.nix`,
+sourced from `vars.nixCacheHostKey` (`variables.nix`) — every client rebuild
+picks it up automatically, so distributed builds don't fail with "Host key
+verification failed" on a client that has never manually SSH'd to nix-cache
+before. If nix-cache's host key is ever rotated or the host rebuilt from
+scratch, update `vars.nixCacheHostKey` to match its new
+`/etc/ssh/ssh_host_ed25519_key.pub`.
+
 ## Manual verification
 
 After deployment:

docs/proxmox-images.md

@@ -0,0 +1,116 @@
+# Proxmox VM disk images
+
+`proxmox-*` hosts (VM platform, not `lxc-*`) can be built as standalone,
+ready-to-attach `.raw` disk images via disko's own image-builder — no
+`nixos-install`, no live installer boot. This uses the same `disko.devices`
+config (`modules/disko/proxmox.nix`) already used to format a real disk on
+install, so there's nothing host-specific to write; it's available for every
+`proxmox-*` target automatically.
+
+`scripts/proxmox/create-proxmox-resource.sh --type vm --host <name>` automates the
+whole walkthrough below (and the equivalent LXC one) end to end, including
+host-key handling and building the image directly on the Proxmox node
+itself (no local build, no image transfer) — see its `--help`. The steps
+here are what it runs under the hood, useful for doing any of it by hand
+or understanding what it does before you trust it against real
+infrastructure.
+
+## Building
+
+```sh
+nix build .#nixosConfigurations.proxmox-server.config.system.build.diskoImagesScript
+sudo ./result --build-memory 2048
+```
+
+This produces `<hostname>.raw` in the current directory (e.g. `server.raw`
+for `proxmox-server`, matching `networking.hostName`, not the flake attribute
+name — every `proxmox-*` host gets a distinctly named image instead of all
+of them producing an identical `main.raw`). The script builds inside a
+temporary QEMU VM and moves the finished image out to the working directory
+when done; `--build-memory` controls how much RAM that build VM gets.
+
+`disko.devices.disk.main.imageSize` (currently `20G`, in
+`modules/disko/proxmox.nix`) sets the image's total size — disko doesn't
+support auto-resizing, so this needs to comfortably fit ESP + swap + root at
+build time. Grow the virtual disk (and resize the filesystem) in Proxmox
+after attaching if a host needs more than that; this is the normal way to
+size these images, not a one-time decision to get exactly right up front.
+
+## Host keys
+
+The disko image script runs a real activation pass inside its temporary
+build VM while constructing the image — the same sops-nix
+activation-before-first-boot problem the installer and LXC tarball workflows
+have (see `docs/auto-installer.md`) applies here too, unmodified. Disko has
+a native mechanism for it:
+
+```sh
+sudo ./result \
+  --pre-format-files host-keys/server_ssh_host_ed25519_key /etc/ssh/ssh_host_ed25519_key \
+  --pre-format-files host-keys/server_ssh_host_ed25519_key.pub /etc/ssh/ssh_host_ed25519_key.pub \
+  --build-memory 2048
+```
+
+Generate the key first with `scripts/secrets/sync-host-keys.sh <hostname>`, same
+as any other host — see `docs/auto-installer.md` for the full walkthrough
+(it registers the new key in `.sops.yaml` and re-encrypts the affected
+`secrets/*.yaml` files too, no manual editing needed).
+
+## Deploying to Proxmox
+
+The image needs **UEFI (OVMF)**, not Proxmox's default SeaBIOS —
+`modules/boot/efi.nix` uses `systemd-boot`, which only works with UEFI
+firmware. `virtio-scsi` is safe to use as the disk bus:
+`hardware-configuration/vm/proxmox.nix` already includes `virtio_scsi` in
+its initrd kernel modules.
+
+1. Copy the image to the Proxmox host:
+
+   ```sh
+   scp server.raw root@<proxmox-host>:/var/lib/vz/import/
+   ```
+
+2. Create an empty VM shell (no disk yet) — replace `<vmid>` with a free ID
+   and `<storage>` with your storage pool's name (`pvesm status` or
+   Datacenter → Storage in the web UI):
+
+   ```sh
+   qm create <vmid> --name proxmox-server --memory 2048 --cores 2 \
+     --net0 virtio,bridge=vmbr0 \
+     --bios ovmf --machine q35 \
+     --scsihw virtio-scsi-pci \
+     --efidisk0 <storage>:1,efitype=4m,pre-enrolled-keys=0
+   ```
+
+   (`--efidisk0` is required for UEFI — it's where OVMF persists boot-entry
+   NVRAM; without it, systemd-boot's boot entry may not survive a reboot.)
+
+3. Import the raw disk into storage:
+
+   ```sh
+   qm importdisk <vmid> /var/lib/vz/import/server.raw <storage>
+   ```
+
+   This prints the resulting disk identifier (e.g. `vm-<vmid>-disk-1`).
+
+4. Attach it and set it as the boot disk:
+
+   ```sh
+   qm set <vmid> --scsi0 <storage>:vm-<vmid>-disk-1
+   qm set <vmid> --boot order=scsi0
+   ```
+
+5. Boot it:
+
+   ```sh
+   qm start <vmid>
+   ```
+
+No install step — it boots straight into the already-activated system.
+
+## Why not `nix build .#nixosConfigurations.<host>.config.system.build.vm`?
+
+That's a different, unrelated feature — `system.build.vm` (`nixos-rebuild
+build-vm`) produces an ephemeral QEMU script for locally testing a
+configuration, not a distributable disk image. It's not part of this
+workflow.

docs/pxe-boot.md

@@ -1,6 +1,9 @@
 # pxe-boot
 
-The `pxe-boot` host serves HTTP boot assets for iPXE clients.
+The `pxe-boot` host serves HTTP boot assets for iPXE clients — including a
+self-staged copy of this flake's own auto-installer netboot image, see
+`docs/auto-installer.md` for what that image actually is and does once
+booted.
 
 ## Host Role
 
@@ -52,8 +55,15 @@ The generated menu currently exposes entries for:
 - iPXE shell
 - Reboot
 
-Kernel and initrd artifacts for the NixOS installer entry must be placed under
-`/srv/pxe/http/nixos` by an operator or a separate build process.
+The NixOS installer entry chain-loads `/srv/pxe/http/nixos/netboot.ipxe`,
+which is nixpkgs' own generated netboot iPXE script (correct `init=`/`initrd=`
+kernel parameters included) rather than a hand-rolled boot line — that script
+in turn expects its kernel/initrd siblings in the same directory. All three
+files (`bzImage`, `initrd`, `netboot.ipxe`) are built from this flake's own
+`modules/installer/iso.nix` netboot image (the same one `nix build .#pxe`
+produces) and staged automatically by
+`modules/pxe-boot/stage-installer-artifacts.nix` via `systemd.tmpfiles.rules`
+— no manual operator step required.
 
 The SystemRescue entry expects the source ISO at:
 
@@ -76,7 +86,7 @@ uses `archiso_http_srv` to fetch the squashfs payload over HTTP.
 Safe evaluation check:
 
 ```bash
-nix eval .#nixosConfigurations.pxe-boot.config.system.build.toplevel.drvPath --raw
+nix eval .#nixosConfigurations.proxmox-pxe-boot.config.system.build.toplevel.drvPath --raw
 ```
 
 After deployment by an operator, basic service checks are:

flake-target-refactor-spec.md

@@ -1,143 +0,0 @@
-# Spec: Refactor Flake Targets into Platform × Build-Type Matrix
-
-## Context
-
-The flake at `~/nixos` currently defines these output targets (flat, ad-hoc naming):
-
-- `docker`
-- `linode-minimal`
-- `nix-cache`
-- `nix-minimal`
-- `nixos`
-- `server`
-- `pxe-boot`
-
-Some already follow a `platform-buildtype` convention (`linode-minimal`), most don't.
-`~/nix-auto-installer` is a related repo and should be checked for any coupling to
-these target names (scripts, docs, CI, or install automation that reference them by
-name) before renaming anything.
-
-## Goal
-
-Restructure the flake so targets are generated from two orthogonal concepts:
-
-**Build types** (what the system is for):
-- `minimal`
-- `nix-cache`
-- `server`
-- `docker`
-- `pxe-boot`
-- `gui`
-
-**Platforms** (what it's deployed on):
-- `linode` (Linode VM)
-- `proxmox` (Proxmox VM)
-- `lxc` (Proxmox LXC container)
-
-Final targets should be named consistently as `<platform>-<buildtype>`, e.g.:
-
-```
-linode-minimal    proxmox-minimal    lxc-minimal
-linode-nix-cache  proxmox-nix-cache  lxc-nix-cache
-linode-server     proxmox-server     lxc-server
-linode-docker     proxmox-docker     lxc-docker
-linode-pxe-boot   proxmox-pxe-boot   lxc-pxe-boot
-linode-gui        proxmox-gui        lxc-gui
-```
-
-That's the full matrix (18 targets) if every build type applies to every platform.
-See **Open Questions** below — some combinations may not make sense and should be
-confirmed with me before being built out, not silently included or dropped.
-
-## Migration mapping (old → new)
-
-| Old target        | New target                                          | Notes |
-|--------------------|------------------------------------------------------|-------|
-| `linode-minimal`   | `linode-minimal`                                      | Already correct, keep as-is |
-| `nix-minimal`      | likely `proxmox-minimal` or a platform-less base module | Ambiguous — see Open Questions |
-| `nix-cache`        | base module consumed by `linode-nix-cache`, `proxmox-nix-cache`, `lxc-nix-cache` | Currently platform-less; needs to become a build-type module, not a standalone target |
-| `server`           | base module consumed by `linode-server`, `proxmox-server`, `lxc-server` | Same as above |
-| `docker`           | base module consumed by `linode-docker`, `proxmox-docker`, `lxc-docker` | Confirm docker actually makes sense as an LXC/VM guest build vs. a standalone container image — see Open Questions |
-| `pxe-boot`         | TBD — may stay a single target rather than a per-platform one | See Open Questions |
-| `nixos`            | TBD — unclear what this maps to in the new scheme | See Open Questions |
-
-## Open Questions (Claude Code: raise these with me before implementing, don't guess)
-
-1. **`nixos` target** — what is this currently used for (bare metal install, dev
-   shell, template)? It doesn't obviously map to any of the six build types.
-2. **`nix-minimal` vs `linode-minimal`** — are these two different things, or is
-   `nix-minimal` a leftover/duplicate?
-3. **`pxe-boot` and `gui` across all three platforms** — does PXE boot make sense
-   for an LXC container or a cloud VM (Linode), or is it inherently bare-metal/
-   network-boot only and should remain a single non-platform target? Does `gui`
-   make sense inside an LXC container?
-4. **`docker` as a build type** — is this "a NixOS host configured to run Docker"
-   (which would sensibly have linode/proxmox/lxc variants), or "a Docker container
-   image built by the flake" (which wouldn't take a platform prefix at all, since
-   it doesn't run on Linode/Proxmox/LXC as a guest OS)? These are structurally
-   different and change how it should be wired in.
-5. Confirm whether all 18 combinations should actually exist, or whether this is
-   meant to produce only the combinations that are genuinely useful (e.g. maybe no
-   one needs `lxc-pxe-boot`).
-
-## Implementation approach
-
-1. **Inventory first.** Read the current `flake.nix` and any `nixosConfigurations`/
-   `modules` structure. Map every existing target to what module(s) it actually
-   pulls in. Don't assume — confirm against the real file contents.
-2. **Separate build-type and platform into their own module directories**, e.g.:
-   ```
-   modules/build-types/minimal.nix
-   modules/build-types/nix-cache.nix
-   modules/build-types/server.nix
-   modules/build-types/docker.nix
-   modules/build-types/pxe-boot.nix
-   modules/build-types/gui.nix
-
-   modules/platforms/linode.nix
-   modules/platforms/proxmox.nix
-   modules/platforms/lxc.nix
-   ```
-   Build-type modules should contain only what makes a system "minimal" vs
-   "server" vs "gui", etc. Platform modules should contain only what's specific
-   to running as a Linode VM vs Proxmox VM vs LXC container (virtualisation
-   guest tools, boot method, filesystem/image format, LXC-specific constraints
-   like no kernel modules, etc).
-3. **Generate the target matrix programmatically** in `flake.nix` rather than
-   hand-writing 18 near-identical `nixosConfigurations` entries — e.g. a small
-   function that takes a platform name and build-type name, composes the two
-   modules plus any shared base module, and produces the named output. This
-   keeps future build types/platforms a one-line addition rather than a copy-paste
-   job.
-4. **Only build combinations we've confirmed make sense** (see Open Questions) —
-   don't emit all 18 by default if some are structurally invalid.
-5. **Preserve existing working configs during the transition.** Don't delete the
-   old target names until their replacements build successfully — rename/alias
-   at the end, not the start, so there's no window where the flake is broken.
-
-## Verification
-
-For every new target produced:
-```bash
-nix flake check
-nix build .#nixosConfigurations.<target>.config.system.build.toplevel
-```
-Confirm each builds without evaluation errors before considering it done. If a
-target fails to build, report which one and why rather than silently skipping it.
-
-## Deliverables
-
-- Refactored `flake.nix` using the composed module + generated-matrix approach.
-- New `modules/build-types/*.nix` and `modules/platforms/*.nix` files.
-- Old flat target names removed only after their replacements are verified.
-- A short `README.md` (or section in existing docs) listing the final target
-  names and what each one is for.
-- A summary at the end of what changed, what was removed, and any of the Open
-  Questions above that got resolved differently than expected.
-
-## Out of scope
-
-- Don't touch `~/nix-auto-installer` contents beyond checking it for references
-  to the old target names — if changes there are needed, flag them, don't make
-  them without confirming.
-- Don't add new build types or platforms beyond the ones listed here.

flake.nix

@@ -23,6 +23,8 @@
     let
       system = "x86_64-linux";
       inherit (nixpkgs) lib;
+      pkgs = nixpkgs.legacyPackages.${system};
+      vars = import ./variables.nix;
 
       # Generates a nixosConfiguration from a platform (what it runs on) and
       # a build type (what it's for), plus the per-identity host.nix that
@@ -31,6 +33,9 @@
       # nix-cache itself consumes the nix-cache substituter and remote
       # builder.
       mkTarget = { platform, buildType, hostPath, homeFile ? ./modules/common/home.nix }:
+        let
+          flakeTarget = "${platform}-${buildType}";
+        in
         nixpkgs.lib.nixosSystem {
           inherit system;
           modules = [
@@ -40,29 +45,36 @@
             ./modules/platforms/${platform}.nix
             ./modules/build-types/${buildType}.nix
             hostPath
-            { environment.etc."flake-target".text = "${platform}-${buildType}"; }
+            { environment.etc."flake-target".text = flakeTarget; }
             home-manager.nixosModules.home-manager
             {
               home-manager = {
                 useGlobalPkgs = true;
                 useUserPackages = true;
+                extraSpecialArgs = { inherit vars; };
                 users.nixos = import homeFile;
               };
             }
           ] ++ lib.optionals (buildType != "nix-cache") [
             ./modules/nix-cache/client.nix
-            ./modules/remote-builder-client.nix
+            ./modules/nix-cache/remote-builder-client.nix
           ];
-          specialArgs = { inherit inputs; };
+          # flakeTarget is passed via specialArgs (not read back from
+          # config.environment.etc."flake-target" above) specifically so
+          # modules/platforms/lxc.nix can use it to select its own host key
+          # file without a same-option circular dependency (a module
+          # contributing to environment.etc can't read the merged
+          # environment.etc it's itself contributing to).
+          specialArgs = { inherit inputs vars netbootSystem flakeTarget; };
         };
 
       # Generated platform x build-type matrix. pxe-boot has no linode
       # variant (PXE/DHCP/TFTP need LAN L2 adjacency, which a Linode VPS
       # doesn't have).
       generatedTargets = {
-        linode-minimal = mkTarget { platform = "linode"; buildType = "minimal"; hostPath = ./hosts/linode-minimal/host.nix; };
-        proxmox-minimal = mkTarget { platform = "proxmox"; buildType = "minimal"; hostPath = ./hosts/proxmox-minimal/host.nix; };
-        lxc-minimal = mkTarget { platform = "lxc"; buildType = "minimal"; hostPath = ./hosts/lxc-minimal/host.nix; };
+        linode-minimal = mkTarget { platform = "linode"; buildType = "minimal"; hostPath = ./hosts/nix-minimal/host.nix; };
+        proxmox-minimal = mkTarget { platform = "proxmox"; buildType = "minimal"; hostPath = ./hosts/nix-minimal/host.nix; };
+        lxc-minimal = mkTarget { platform = "lxc"; buildType = "minimal"; hostPath = ./hosts/nix-minimal/host.nix; };
 
         linode-nix-cache = mkTarget { platform = "linode"; buildType = "nix-cache"; hostPath = ./hosts/nix-cache/host.nix; };
         proxmox-nix-cache = mkTarget { platform = "proxmox"; buildType = "nix-cache"; hostPath = ./hosts/nix-cache/host.nix; };
@@ -82,11 +94,65 @@
 
         proxmox-pxe-boot = mkTarget { platform = "proxmox"; buildType = "pxe-boot"; hostPath = ./hosts/pxe-boot/host.nix; };
         lxc-pxe-boot = mkTarget { platform = "lxc"; buildType = "pxe-boot"; hostPath = ./hosts/pxe-boot/host.nix; };
+
+        linode-tailscale-exit-node = mkTarget { platform = "linode"; buildType = "tailscale-exit-node"; hostPath = ./hosts/tailscale-exit-node/host.nix; };
+        proxmox-tailscale-exit-node = mkTarget { platform = "proxmox"; buildType = "tailscale-exit-node"; hostPath = ./hosts/tailscale-exit-node/host.nix; };
+        lxc-tailscale-exit-node = mkTarget { platform = "lxc"; buildType = "tailscale-exit-node"; hostPath = ./hosts/tailscale-exit-node/host.nix; };
+
+        lxc-tor-relay = mkTarget { platform = "lxc"; buildType = "tor-relay"; hostPath = ./hosts/tor-relay/host.nix; };
+      };
+
+      # Auto-install environments (migrated from the former nix-auto-installer
+      # flake): a self-contained NixOS installer that boots, discovers this
+      # flake's own nixosConfigurations over the network, and runs
+      # nixos-install against whichever one the operator picks. These are
+      # deliberately not part of the platform x build-type matrix above —
+      # they're throwaway boot media, not persistent hosts, so they skip
+      # disko/sops-nix/home-manager and just need `vars`.
+      installerTargets = {
+        installer = nixpkgs.lib.nixosSystem {
+          inherit system;
+          modules = [ ./modules/installer/iso.nix ];
+          specialArgs = { inherit vars; };
+        };
+      };
+
+      # Same installer environment, built as netboot (kernel + initrd +
+      # iPXE script) instead of an ISO — this is what packages.pxe bundles.
+      netbootSystem = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [
+          ./modules/installer/iso.nix
+          ({ modulesPath, ... }: {
+            imports = [
+              (modulesPath + "/installer/netboot/netboot-minimal.nix")
+            ];
+          })
+        ];
+        specialArgs = { inherit vars; };
       };
 
     in
     {
 
-      nixosConfigurations = generatedTargets;
+      nixosConfigurations = generatedTargets // installerTargets;
+
+      # Buildable auto-installer artifacts (`nix build .#<name>`). No `lxc`
+      # variant (installer-boots-as-an-LXC-container) or `all` bundle
+      # anymore — lxc-* and proxmox-* hosts deploy via their own tarball/
+      # disk-image outputs instead (see docs/auto-installer.md and
+      # docs/proxmox-images.md), which left the installer's own LXC form
+      # with no real use case: it's excluded from the install menu (same
+      # bind-mount problem as any LXC nixos-install target) and nothing
+      # else needed booting the installer itself as a container.
+      packages.${system} = {
+        iso = installerTargets.installer.config.system.build.isoImage;
+
+        pxe = pkgs.linkFarm "pxe" [
+          { name = "netboot.ipxe"; path = netbootSystem.config.system.build.netbootIpxeScript; }
+          { name = "initrd"; path = netbootSystem.config.system.build.netbootRamdisk; }
+          { name = "kernel"; path = netbootSystem.config.system.build.kernel; }
+        ];
+      };
     };
 }

hosts/docker/host.nix

@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   networking.hostName = "docker";

hosts/linode-minimal/host.nix

@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-  networking.hostName = "linode-minimal";
-
-  # Preserved from the pre-refactor `linode-minimal` target — stateVersion
-  # must never be bumped on an already-installed machine.
-  system.stateVersion = "26.05";
-}

hosts/lxc-minimal/host.nix

@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-  networking.hostName = "lxc-minimal";
-
-  # No pre-existing deployed machine to preserve — pin explicitly to the
-  # current release rather than let it silently default.
-  system.stateVersion = "26.05";
-}

hosts/nix-cache/host.nix

@@ -1,19 +1,19 @@
-{ config, ... }:
+{ vars, ... }:
 
 {
-  networking.hostName = "nix-cache";
+  imports = [
+    (import ../../modules/beszel/host-token.nix {
+      name = "nix-cache";
+      sopsFile = ../../secrets/nix-cache.yaml;
+    })
+  ];
 
-  sops.secrets."beszel-token".sopsFile = ../../secrets/nix-cache.yaml;
-  sops.templates."nix-cache-beszel.env".content = ''
-    TOKEN=${config.sops.placeholder."beszel-token"}
-  '';
+  networking.hostName = vars.nixCacheHost;
 
   services.beszel.agent.environment = {
     #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-    #HUB_URL = "http://docker.sweet.home:8090";
     KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
   };
-  services.beszel.agent.environmentFile = config.sops.templates."nix-cache-beszel.env".path;
 
   # Preserved from the pre-refactor `nix-cache` target — stateVersion must
   # never be bumped on an already-installed machine.

hosts/nix-minimal/host.nix

@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   # Preserves the hostname of the existing, already-deployed machine

hosts/nixos/home.nix

@@ -1,79 +1,82 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, vars, ... }:
 
 {
 
-    imports = [
+  imports = [
     ../../modules/common/aliases.nix
   ];
 
-  home.username = "nixos";         # your actual username
-  home.homeDirectory = "/home/nixos";
-  home.stateVersion = "25.05";        # match your NixOS stateVersion
+  home = {
+    username = vars.primaryUser;
+    homeDirectory = "/home/${vars.primaryUser}";
+    stateVersion = "25.05"; # match your NixOS stateVersion
 
-  programs.home-manager.enable = true;  # mandatory to activate HM
+    # Optional: packages
+    packages = with pkgs; [
+      git
+      vim
+      tmux
+      nextcloud-client
+      #    vscode
+      chromium
+    ];
 
-  # Optional: packages
-  home.packages = with pkgs; [
-    git
-    vim
-    tmux
-    nextcloud-client
-#    vscode
-    chromium
-  ];
+    # Optional: set environment vars
+    sessionVariables = {
+      EDITOR = "vim";
+    };
 
-  # Optional: set environment vars
-  home.sessionVariables = {
-    EDITOR = "vim";
+    file = {
+      ".local/share/applications/proxmox-chromium-app.desktop".text = ''
+        [Desktop Entry]
+        Type=Application
+        Name=Proxmox (Chromium)
+        Exec=chromium --app=https://pve.${vars.homeDomain}:${toString vars.ports.pveWeb} --window-size=1920,1080 --window-position=0,0
+        Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png
+        Terminal=false
+        Categories=Hypervisor;
+        StartupWMClass=PVE
+      '';
+      ".local/share/applications/pbs-chromium-app.desktop".text = ''
+        [Desktop Entry]
+        Type=Application
+        Name=Proxmox Backup Server (Chromium)
+        Exec=chromium --app=https://${vars.pbsIp}:${toString vars.ports.pbsWeb} --window-size=1920,1080 --window-position=0,0
+        Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png
+        Terminal=false
+        Categories=backup;
+
+      '';
+      ".local/share/applications/proxmox-firefox-app.desktop".text = ''
+        [Desktop Entry]
+        Type=Application
+        Name=Proxmox (Firefox)
+        Exec=firefox --new-instance https://pve.${vars.homeDomain}:${toString vars.ports.pveWeb} --profile ProxmoxWebApp --window-size=1920,1080 --class ProxmoxWebApp
+        Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png
+        Terminal=false
+        Categories=Hypervisor;
+        StartupWMClass=PVE
+      '';
+      ".local/share/applications/pbs-firefox-app.desktop".text = ''
+        [Desktop Entry]
+        Type=Application
+        Name=Proxmox Backup Server (Firefox)
+        Exec=firefox --new-window https://${vars.pbsIp}:${toString vars.ports.pbsWeb} --profile PbsWebApp --window-size=1920,1080 --class PbsWebApp
+        Icon=${config.home.homeDirectory}/.local/share/icons/proxmox.png
+        Terminal=false
+        Categories=backup;
+        StartupWMClass=PBS
+      '';
+    };
   };
 
+  programs.home-manager.enable = true; # mandatory to activate HM
+
   # Optional: enable bash (or zsh, fish...)
   programs.bash.enable = true;
-    services.nextcloud-client = {
+  services.nextcloud-client = {
     enable = true;
     # Optionally start in background directly
     startInBackground = true;
   };
-home.file = {
-  ".local/share/applications/proxmox-chromium-app.desktop".text = ''
-    [Desktop Entry]
-    Type=Application
-    Name=Proxmox (Chromium)
-    Exec=chromium --app=https://pve.sweet.home:8006 --window-size=1920,1080 --window-position=0,0
-    Icon=/home/nixos/.local/share/icons/proxmox.png
-    Terminal=false
-    Categories=Hypervisor;
-    StartupWMClass=PVE
-  '';
-  ".local/share/applications/pbs-chromium-app.desktop".text = ''
-    [Desktop Entry]
-    Type=Application
-    Name=Proxmox Backup Server (Chromium)
-    Exec=chromium --app=https://192.168.2.108:8007 --window-size=1920,1080 --window-position=0,0
-    Icon=/home/nixos/.local/share/icons/proxmox.png
-    Terminal=false
-    Categories=backup;
-
-  '';
-  ".local/share/applications/proxmox-firefox-app.desktop".text = ''
-    [Desktop Entry]
-    Type=Application
-    Name=Proxmox (Firefox)
-    Exec=firefox --new-instance https://pve.sweet.home:8006 --profile ProxmoxWebApp --window-size=1920,1080 --class ProxmoxWebApp
-    Icon=/home/nixos/.local/share/icons/proxmox.png
-    Terminal=false
-    Categories=Hypervisor;
-    StartupWMClass=PVE
-  '';
-  ".local/share/applications/pbs-firefox-app.desktop".text = ''
-    [Desktop Entry]
-    Type=Application
-    Name=Proxmox Backup Server (Firefox)
-    Exec=firefox --new-window https://192.168.2.108:8007 --profile PbsWebApp --window-size=1920,1080 --class PbsWebApp
-    Icon=/home/nixos/.local/share/icons/proxmox.png
-    Terminal=false
-    Categories=backup;
-    StartupWMClass=PBS
-  '';
-};
-}
+}

hosts/nixos/host.nix

@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   networking.hostName = "nixos";

hosts/pxe-boot/host.nix

@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   networking.hostName = "pxe-boot";

hosts/server/host.nix

@@ -1,22 +1,22 @@
-{ config, ... }:
+{ vars, ... }:
 
 {
-  networking.hostName = "server";
-  networking.hostId = "6689f93e";
+  imports = [
+    (import ../../modules/beszel/host-token.nix {
+      name = "server";
+      sopsFile = ../../secrets/server.yaml;
+    })
+  ];
 
-  sops.secrets."beszel-token".sopsFile = ../../secrets/server.yaml;
-  sops.templates."server-beszel.env".content = ''
-    TOKEN=${config.sops.placeholder."beszel-token"}
-  '';
+  networking.hostName = vars.nfsServerHost;
+  networking.hostId = "6689f93e";
 
   services.beszel.agent.environment = {
     #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-    #HUB_URL = "http://docker.sweet.home:8090";
     KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
-    EXTRA_FILESYSTEMS = "/tank/docker/volumes";
+    EXTRA_FILESYSTEMS = "${vars.storageRoot}/${vars.nfsShares.dockerVolumes.subpath}";
     LOG_LEVEL = "debug";
   };
-  services.beszel.agent.environmentFile = config.sops.templates."server-beszel.env".path;
 
   # Preserved from the pre-refactor `server` target — stateVersion must never
   # be bumped on an already-installed machine.

hosts/tailscale-exit-node/host.nix

@@ -0,0 +1,12 @@
+_:
+
+{
+  networking.hostName = "exit-node";
+
+  # No networking.hostId: only ZFS-touching hosts (server, docker) need one
+  # for pool-import safety, and this host does neither.
+
+  # A genuinely new host (not a pre-refactor carry-over), so it tracks the
+  # flake's current nixpkgs release rather than being pinned to an older one.
+  system.stateVersion = "26.05";
+}

hosts/tor-relay/host.nix

@@ -0,0 +1,12 @@
+_:
+
+{
+  networking.hostName = "tor-relay";
+
+  # No networking.hostId: only ZFS-touching hosts (server, docker) need one
+  # for pool-import safety, and this host does neither.
+
+  # A genuinely new host (not a pre-refactor carry-over), so it tracks the
+  # flake's current nixpkgs release rather than being pinned to an older one.
+  system.stateVersion = "26.05";
+}

modules/beszel/enable-agent.nix

@@ -1,9 +1,18 @@
-{ ... }:
+{ vars, ... }:
 
 {
-services.beszel.agent.enable = true;
-services.beszel.agent.environment = {
-#DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-HUB_URL = "http://docker.sweet.home:8090";
-};
+  services.beszel.agent.enable = true;
+  services.beszel.agent.environment = {
+    #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
+    HUB_URL = "http://${vars.dockerHost}.${vars.homeDomain}:${toString vars.ports.beszelHub}";
+  };
+
+  # The upstream module runs beszel-agent under DynamicUser with
+  # ProtectSystem = "strict" and no StateDirectory, so /var/lib/beszel-agent
+  # (where the agent persists its hub-pairing fingerprint, per
+  # https://github.com/henrygd/beszel/discussions/1542) isn't writable --
+  # every restart silently fails to save it and regenerates a fresh one in
+  # memory, permanently desyncing from whatever the hub has on record after
+  # the very first successful pairing. Give it real persistent storage.
+  systemd.services.beszel-agent.serviceConfig.StateDirectory = "beszel-agent";
 }

modules/beszel/host-token.nix

@@ -0,0 +1,11 @@
+{ name, sopsFile }:
+
+{ config, ... }:
+
+{
+  sops.secrets."beszel-token".sopsFile = sopsFile;
+  sops.templates."${name}-beszel.env".content = ''
+    TOKEN=${config.sops.placeholder."beszel-token"}
+  '';
+  services.beszel.agent.environmentFile = config.sops.templates."${name}-beszel.env".path;
+}

modules/boot/efi.nix

@@ -1,6 +1,6 @@
-{ ... }:
+_:
 
 {
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
-}
+}

modules/build-types/docker.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, vars, ... }:
 
 {
   # Pins the Docker Engine version, carried forward from the pre-refactor
@@ -13,11 +13,11 @@
   imports = [
     ../docker/mount-data.nix
     ../docker/enable-service.nix
+    ../docker/nextcloud-cron-job.nix
+    ../docker/docker-health-to-gotify.nix
     ../tailscale/enable-service.nix
-    ../rotate-traefik-logs.nix
+    ../traefik/rotate-logs.nix
     ../raspi/mount-data.nix
-    ../services/nextcloud-cron-job.nix
-    ../services/docker-health-to-gotify.nix
     ../services/enable-rpcbind.nix
   ];
 
@@ -28,13 +28,18 @@
   boot.supportedFilesystems = [ "nfs" ];
 
   systemd.tmpfiles.rules = [
-    "L+ /home/nixos/docker - - - - /mnt/docker/config"
-    "d /mnt/docker 0755 nixos users -"
-    "d /mnt/raspi-backup 0755 nixos users -"
+    "L+ /home/${vars.primaryUser}/docker - - - - ${vars.nfsShares.dockerConfig.mountpoint}"
+    "d /mnt/docker 0755 ${vars.primaryUser} users -"
+    "d ${vars.nfsShares.raspiVolumes.mountpoint} 0755 ${vars.primaryUser} users -"
   ];
 
-  users.users.nixos.extraGroups = [ "docker" ];
+  users.users.${vars.primaryUser}.extraGroups = [ "docker" ];
   services.openssh.settings.PermitRootLogin = "yes";
 
-  networking.firewall.allowedTCPPorts = [ 80 8080 443 8090 ];
+  networking.firewall.allowedTCPPorts = [
+    vars.ports.dockerHttp
+    vars.ports.dockerExtra
+    vars.ports.dockerHttps
+    vars.ports.beszelHub
+  ];
 }

modules/build-types/gui.nix

@@ -1,8 +1,8 @@
-{ config, pkgs, lib, inputs, ... }:
+{ config, pkgs, lib, inputs, vars, ... }:
 
 {
   environment.systemPackages = with pkgs; [
-    inputs.nixos-conf-editor.packages.${pkgs.system}.nixos-conf-editor
+    inputs.nixos-conf-editor.packages.${pkgs.stdenv.hostPlatform.system}.nixos-conf-editor
     nodejs
     appimage-run
     seahorse
@@ -19,39 +19,55 @@
 
   boot.loader.grub.useOSProber = true;
 
-  services.xserver.enable = true;
-  services.xserver.displayManager.lightdm.enable = true;
-  services.xserver.desktopManager.cinnamon.enable = true;
+  services = {
+    xserver = {
+      enable = true;
 
-  services.xserver.xkb = {
-    layout = "au";
-    variant = "";
+      displayManager = {
+        lightdm.enable = true;
+        sessionCommands = ''
+          eval $(gnome-keyring-daemon --start --components=secrets,ssh)
+          export SSH_AUTH_SOCK
+        '';
+      };
+
+      desktopManager.cinnamon.enable = true;
+
+      xkb = {
+        layout = "au";
+        variant = "";
+      };
+    };
+
+    printing.enable = true;
+
+    pipewire = {
+      enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+    };
+
+    xrdp = {
+      enable = true;
+      defaultWindowManager = "cinnamon-session";
+      openFirewall = true;
+    };
+
+    gnome.gnome-keyring.enable = true;
   };
 
-  services.printing.enable = true;
-
-  security.rtkit.enable = true;
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    alsa.support32Bit = true;
-    pulse.enable = true;
+  security = {
+    rtkit.enable = true;
+    pam.services.login.enableGnomeKeyring = true;
   };
 
-  users.users.nixos.extraGroups = [ "networkmanager" ];
+  # The networkmanager group only exists when NM is actually enabled — the
+  # lxc platform module force-disables it, so don't add the user to a group
+  # that won't exist there.
+  users.users.${vars.primaryUser}.extraGroups = lib.mkIf config.networking.networkmanager.enable [ "networkmanager" ];
 
   programs.firefox.enable = true;
 
-  services.xrdp.enable = true;
-  services.xrdp.defaultWindowManager = "cinnamon-session";
-  services.xrdp.openFirewall = true;
   nixpkgs.config.allowUnfree = true;
-
-  services.gnome.gnome-keyring.enable = true;
-  security.pam.services.login.enableGnomeKeyring = true;
-
-  services.xserver.displayManager.sessionCommands = ''
-    eval $(gnome-keyring-daemon --start --components=secrets,ssh)
-    export SSH_AUTH_SOCK
-  '';
 }

modules/build-types/minimal.nix

@@ -1,9 +1,12 @@
-{ pkgs, ... }:
+{ lib, pkgs, config, vars, ... }:
 
 {
   networking.networkmanager.enable = true;
 
-  users.users.nixos.extraGroups = [ "networkmanager" ];
+  # The networkmanager group only exists when NM is actually enabled — the
+  # lxc platform module force-disables it, so don't add the user to a group
+  # that won't exist there.
+  users.users.${vars.primaryUser}.extraGroups = lib.mkIf config.networking.networkmanager.enable [ "networkmanager" ];
 
   environment.systemPackages = with pkgs; [
     inetutils

modules/build-types/pxe-boot.nix

@@ -1,10 +1,10 @@
-{ config, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, vars, ... }:
 
 let
   pxeRoot = "/srv/pxe";
   httpRoot = "${pxeRoot}/http";
   tftpRoot = "${pxeRoot}/tftp";
-  pxeBaseUrl = "http://192.168.2.247";
+  pxeBaseUrl = "http://${vars.pxeServerIp}";
 
   bootIpxe = pkgs.writeText "boot.ipxe" ''
     #!ipxe
@@ -76,9 +76,7 @@ let
     choose target && goto ''${target}
 
     :nixos
-    kernel ''${base}/nixos/bzImage ip=dhcp
-    initrd ''${base}/nixos/initrd
-    boot
+    chain ''${base}/nixos/netboot.ipxe
 
     :rescue
     chain ''${base}/systemrescue.ipxe
@@ -91,32 +89,40 @@ let
   '';
 in
 {
+  imports = [
+    ../pxe-boot/stage-installer-artifacts.nix
+  ];
+
   environment.systemPackages = with pkgs; [
     ipxe
   ];
 
-  services.nginx = {
-    enable = true;
+  services = {
+    nginx = {
+      enable = true;
 
-    virtualHosts."pxe-boot" = {
-      default = true;
-      root = httpRoot;
-      locations."/" = {
-        extraConfig = ''
-          autoindex on;
-        '';
+      virtualHosts."pxe-boot" = {
+        default = true;
+        root = httpRoot;
+        locations."/" = {
+          extraConfig = ''
+            autoindex on;
+          '';
+        };
       };
     };
-  };
 
-  # TFTP is only used to deliver the initial iPXE bootloader. After iPXE
-  # starts, all further assets are fetched via nginx over HTTP.
-  services.atftpd = {
-    enable = true;
-    root = tftpRoot;
-    extraOptions = [
-      "--verbose=5"
-    ];
+    # TFTP is only used to deliver the initial iPXE bootloader. After iPXE
+    # starts, all further assets are fetched via nginx over HTTP.
+    atftpd = {
+      enable = true;
+      root = tftpRoot;
+      extraOptions = [
+        "--verbose=5"
+      ];
+    };
+
+    openssh.settings.PermitRootLogin = "yes";
   };
 
   systemd.tmpfiles.rules = [
@@ -149,8 +155,6 @@ in
     };
   };
 
-  services.openssh.settings.PermitRootLogin = "yes";
-
-  networking.firewall.allowedTCPPorts = [ 80 ];
-  networking.firewall.allowedUDPPorts = [ 69 ];
+  networking.firewall.allowedTCPPorts = [ vars.ports.pxeBootHttp ];
+  networking.firewall.allowedUDPPorts = [ vars.ports.pxeBootTftp ];
 }

modules/build-types/server.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ vars, lib, ... }:
 
 {
   imports = [
@@ -6,7 +6,7 @@
     ../services/zfs/enable-service.nix
   ];
 
-  boot.zfs.extraPools = [ "tank" ];
+  boot.zfs.extraPools = [ (lib.removePrefix "/" vars.storageRoot) ];
 
   systemd.services.nfs-server = {
     after = [ "zfs-mount.service" ];
@@ -16,13 +16,13 @@
   services.nfs.server = {
     enable = true;
     exports = ''
-      /tank/docker/config 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
-      /tank/docker/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
-      /tank/docker/databases 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
-      /tank/docker/nextcloud-data 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
-      /tank/raspi/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/${vars.nfsShares.dockerConfig.subpath} ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/${vars.nfsShares.dockerVolumes.subpath} ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/${vars.nfsShares.dockerDatabases.subpath} ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/${vars.nfsShares.nextcloudData.subpath} ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/${vars.nfsShares.raspiVolumes.subpath} ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
     '';
   };
 
-  networking.firewall.allowedTCPPorts = [ 111 2049 ];
+  networking.firewall.allowedTCPPorts = [ vars.ports.nfsRpcbind vars.ports.nfsd ];
 }

modules/build-types/tailscale-exit-node.nix

@@ -0,0 +1,21 @@
+{ ... }:
+
+{
+  imports = [
+    ../tailscale/exit-node.nix
+  ];
+
+  # "server", not "both": this build type only ever advertises itself as an
+  # exit node (see ../tailscale/exit-node.nix) -- it doesn't advertise LAN
+  # subnet routes, so it doesn't need the "client"-side loose reverse-path
+  # filtering that "both" would also turn on. Deliberately left unbundled
+  # from LAN-subnet-route advertisement so this build type stays valid on
+  # every platform, including linode (a remote VPS with no network path to
+  # the home LAN at all).
+  services.tailscale.useRoutingFeatures = "server";
+
+  # Forwarded exit-node traffic arrives on tailscale0 already
+  # tailscale-authenticated -- the firewall's normal per-port allow-list
+  # would otherwise drop it. Standard NixOS/Tailscale exit-node guidance.
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
+}

modules/build-types/tor-relay.nix

@@ -0,0 +1,7 @@
+{ ... }:
+
+{
+  imports = [
+    ../tor/enable-relay.nix
+  ];
+}

modules/common/aliases.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, vars, ... }:
 
 let
   # Flake attribute names are now <platform>-<buildtype> (e.g. proxmox-docker)
@@ -9,13 +9,33 @@ let
     sudo nixos-rebuild switch \
       --no-write-lock-file \
       --refresh \
-      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target)
+      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
   '';
   myTestCmd = ''
     sudo nixos-rebuild test \
       --no-write-lock-file \
       --refresh \
-      --flake git+https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git#$(cat /etc/flake-target)
+      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
+  '';
+
+  # lxc-* hosts pre-seed their SSH host key at build time (see
+  # modules/platforms/lxc.nix) so sops-nix's .sops.yaml recipient matches on
+  # first boot -- without it, secrets permanently fail to decrypt (see that
+  # file's comment for the confirmed failure). That requires --impure plus
+  # NIXOS_HOST_KEYS_DIR pointing at the repo's host-keys/ dir, same pattern
+  # docs/auto-installer.md uses for the installer ISO. A function, not a
+  # shellAlias, since the target name has to interpolate into the middle of
+  # the flake attribute path, not just append after it. Must be run from the
+  # repo root, same as every other host-keys/ command in this repo.
+  buildImageFn = ''
+    buildImage() {
+      if [ -z "$1" ]; then
+        echo "usage: buildImage <flake-target>  (e.g. lxc-docker)" >&2
+        return 1
+      fi
+      NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build --impure \
+        ".#nixosConfigurations.$1.config.system.build.tarball"
+    }
   '';
 in
 {
@@ -25,5 +45,6 @@ in
       "Switch-nix" = mySwitchCmd;
       "Test-nix" = myTestCmd;
     };
+    initExtra = buildImageFn;
   };
 }

modules/common/configuration.nix

@@ -1,29 +1,36 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, vars, ... }:
 
 {
-    imports =
-    [ # Include the results of the hardware scan.
-#      ./hardware-configuration.nix
-      ../set-locale.nix
+  imports =
+    [
+      # Include the results of the hardware scan.
+      #      ./hardware-configuration.nix
+      ./set-locale.nix
     ];
   # Use the GRUB 2 boot loader.
   # boot.loader.grub.enable = true;
   #boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
 
-  networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
+  networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
+
+  # Recommended over the true default (bypasses ZFS's own import safeguards)
+  # per the option's own docs; matches hosts/docker/host.nix and
+  # modules/services/zfs/enable-service.nix, which already set this
+  # explicitly. Harmless no-op on hosts that don't use ZFS at all.
+  boot.zfs.forceImportRoot = false;
 
   # Set your time zone.
-  time.timeZone = "Australia/Brisbane";
+  time.timeZone = vars.timeZone;
 
   # Enable QEMU agent
   services.qemuGuest.enable = true;
 
-    # Enable docker-compose
+  # Enable docker-compose
   environment.systemPackages = with pkgs; [
-  vim
-  btop
-  git
-  gcr
+    vim
+    btop
+    git
+    gcr
   ];
 
   # Secrets shared by every host, decrypted at activation via each host's
@@ -32,28 +39,34 @@
   # or docs/ for the sops workflow). hashedPassword/hashedPasswordFile need
   # neededForUsers so they're available before the normal secret-activation
   # step, since user creation happens very early in boot.
-  sops.defaultSopsFile = ../../secrets/common.yaml;
-  sops.secrets."root-hashedPassword".neededForUsers = true;
-  sops.secrets."nixos-hashedPassword".neededForUsers = true;
-  sops.secrets."nix-github-token" = { };
+  sops = {
+    defaultSopsFile = ../../secrets/common.yaml;
+
+    secrets = {
+      "root-hashedPassword".neededForUsers = true;
+      "nixos-hashedPassword".neededForUsers = true;
+      "nix-github-token" = { };
+    };
+
+    # nix.conf doesn't support a *File-style option for access-tokens, so the
+    # token is rendered into a runtime-only file (never touches the Nix store)
+    # and pulled in via nix.conf's native !include directive.
+    templates."nix-github-token.conf".content = ''
+      access-tokens = github.com=${config.sops.placeholder."nix-github-token"}
+    '';
+  };
 
-  # nix.conf doesn't support a *File-style option for access-tokens, so the
-  # token is rendered into a runtime-only file (never touches the Nix store)
-  # and pulled in via nix.conf's native !include directive.
-  sops.templates."nix-github-token.conf".content = ''
-    access-tokens = github.com=${config.sops.placeholder."nix-github-token"}
-  '';
   nix.extraOptions = ''
     !include ${config.sops.templates."nix-github-token.conf".path}
   '';
 
-#Set root password
-users.users.root = {
-  hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
-};
+  #Set root password
+  users.users.root = {
+    hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
+  };
 
   # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.nixos = {
+  users.users.${vars.primaryUser} = {
     isNormalUser = true;
     extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
     packages = with pkgs; [
@@ -61,8 +74,8 @@ users.users.root = {
     ];
     hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
     openssh.authorizedKeys.keys = [
-    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq/Q5LvIXlZwO2kdeAN5nLGZ59nZB7JHYMEszHxmNtGMzv1lM31jiPNsr0z2EKVZhE7OOfa2IF9rhWYD7JUA9G0yzdZ4WTXFNGVVOJoOVH6vAF3XCxoVilOEwTc7h2Wiy+rzd0B28/3spffzQQWJhY6GRQVa8j+6xAGF60Fcvl1vLosYT9Bn2ZbK4TCWOwAn2jqXIieGpZdn/UNZbGOeKRiCvhktDfMAzuQzN/9jMu/oF4pkPn2X1UrsQdNlvp0Ci8md612MozIpncQJyAF1ADhunr3sMx0isUXiqD29R5DS4TftpekqLNLak+zcxFa8N7DcRNp3DcKfJvyTkwQrR4r+b7lFLYOLHLagSso9CzeW/paAS2q9I5SBm/2DtE1diLLg2jZikYcstsu/G5RgvbzbKqjiaMwTdXC3AMvDxQrs7U5pDRZFzoofG3cpODbTm+uy3m0kP70z0M1K45UbDG0p+itnTu9x40JbQEgefbx38AItNvAIx1A8HO4I1VX28= wayne@stream"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
+      vars.adminSshKey
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
     ];
   };
 
@@ -88,4 +101,4 @@ users.users.root = {
 
 
 
-}
+}

modules/common/home.nix

@@ -1,65 +1,69 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, vars, ... }:
 
 let
   remote = "root@proxmox-ip:/var/lib/vz/template/iso";
   localMount = "${config.home.homeDirectory}/proxmox-iso";
-in {
+in
+{
 
   imports = [
     ./aliases.nix
   ];
 
-  home.username = "nixos";         # your actual username
-  home.homeDirectory = "/home/nixos";
-  home.stateVersion = "25.11";        # match your NixOS stateVersion
+  home = {
+    username = vars.primaryUser;
+    homeDirectory = "/home/${vars.primaryUser}";
+    stateVersion = "25.11"; # match your NixOS stateVersion
+
+    # Optional: packages
+    packages = with pkgs; [
+      git
+      vim
+      tmux
+      nano
+      sshfs
+    ];
+
+    # Optional: set environment vars
+    sessionVariables = {
+      EDITOR = "nano";
+    };
+  };
+
+  programs.home-manager.enable = true; # mandatory to activate HM
+
+  programs.bash.enable = true;
 
-  programs.home-manager.enable = true;  # mandatory to activate HM
-  
-programs.bash.enable = true;
-  
   # GitHub access-tokens setting used to live here in plaintext; it's now
   # rendered system-wide from a sops-nix secret via nix.extraOptions in
   # modules/common/configuration.nix instead (covers the daemon for every
   # user, not just this one).
 
-  # Optional: packages
-  home.packages = with pkgs; [
-    git
-    vim
-    tmux
-    nano
-    sshfs
-  ];
+  #  systemd.user.services.mount-proxmox-iso = {
+  #    Unit = {
+  #      Description = "Mount Proxmox ISO dir via SSHFS";
+  #      After = [ "network-online.target" ];
+  #      Wants = [ "network-online.target" ];
+  #    };
 
-  # Optional: set environment vars
-  home.sessionVariables = {
-    EDITOR = "nano";
-  };
-#  systemd.user.services.mount-proxmox-iso = {
-#    Unit = {
-#      Description = "Mount Proxmox ISO dir via SSHFS";
-#      After = [ "network-online.target" ];
-#      Wants = [ "network-online.target" ];
-#    };
+  #    Service = {
+  #      Type = "simple";
+  #      ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${localMount}";
+  #      ExecStart = "${pkgs.sshfs}/bin/sshfs -o IdentityFile=${config.home.homeDirectory}/.ssh/id_ed25519,allow_other,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3 root@proxmox-ip:/var/lib/vz/template/iso ${localMount}";
+  #      ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u ${localMount}";
+  #      Restart = "on-failure";
+  #    };
 
-#    Service = {
-#      Type = "simple";
-#      ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${localMount}";
-#      ExecStart = "${pkgs.sshfs}/bin/sshfs -o IdentityFile=${config.home.homeDirectory}/.ssh/id_ed25519,allow_other,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3 root@proxmox-ip:/var/lib/vz/template/iso ${localMount}";
-#      ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u ${localMount}";
-#      Restart = "on-failure";
-#    };
-
-#    Install = {
-#      WantedBy = [ "default.target" ];
-#    };
-#  };
+  #    Install = {
+  #      WantedBy = [ "default.target" ];
+  #    };
+  #  };
   # Optional: enable bash (or zsh, fish...)
-#  programs.bash.enable = true;
+  #  programs.bash.enable = true;
 
   # Optional: manage dotfiles via symlinks
-#  home.file = {
-#    ".tmux.conf".source = ./dotfiles/tmux.conf;
-#    ".config/nvim/init.vim".source = ./dotfiles/init.vim;
-#  };
+  #  home.file = {
+  #    ".tmux.conf".source = ./dotfiles/tmux.conf;
+  #    ".config/nvim/init.vim".source = ./dotfiles/init.vim;
+  #  };
 }

modules/common/set-locale.nix

@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   i18n.defaultLocale = "en_AU.UTF-8";
@@ -15,4 +15,4 @@
     LC_TIME = "en_AU.UTF-8";
   };
 
-}
+}

modules/disko/linode.nix

@@ -0,0 +1,35 @@
+_:
+
+{
+  # Linode provisions and sizes these disks itself (via the Linode
+  # dashboard/API) before the OS ever boots, and presents them as whole,
+  # unpartitioned block devices — /dev/sda is the root filesystem directly,
+  # /dev/sdb is swap directly, no partition table on either. Nothing here
+  # should ever repartition or resize them:
+  #   - `destroy = false` skips each disk entirely during disko's destroy
+  #     stage (see disko's disk.destroy option) — no wipefs, ever.
+  #   - the filesystem content type's own create step only runs mkfs if the
+  #     device isn't already formatted (checked via `blkid`), so re-running
+  #     this against an already-provisioned Linode disk is a no-op.
+  disko.devices.disk = {
+    main = {
+      device = "/dev/sda";
+      destroy = false;
+
+      content = {
+        type = "filesystem";
+        format = "ext4";
+        mountpoint = "/";
+      };
+    };
+
+    swap = {
+      device = "/dev/sdb";
+      destroy = false;
+
+      content = {
+        type = "swap";
+      };
+    };
+  };
+}

modules/disko/proxmox.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ config, vars, ... }:
 
 {
   disko.devices = {
@@ -6,6 +6,16 @@
       type = "disk";
       device = "/dev/sda";
 
+      # Only used when building a standalone disk image directly (`nix build
+      # .#nixosConfigurations.<host>.config.system.build.diskoImagesScript`)
+      # rather than formatting a real device — see docs/proxmox-images.md.
+      # imageSize sets the .raw file's total size (root's "100%" below fills
+      # whatever's left after ESP + swap within it); imageName keeps each
+      # host's image distinctly named instead of every proxmox-* host
+      # producing an identical "main.raw".
+      imageSize = vars.proxmoxImageSize;
+      imageName = config.networking.hostName;
+
       content = {
         type = "gpt";
 
@@ -57,4 +67,4 @@
       };
     };
   };
-}
+}

modules/docker/docker-health-to-gotify.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, vars, ... }:
 
 {
   systemd.services.docker-health-to-gotify = {
@@ -7,9 +7,9 @@
     serviceConfig = {
       Type = "oneshot";
       # Run as root so it can read /etc/secrets and access docker socket
-     # User = "root";
+      # User = "root";
       #EnvironmentFile = "-/etc/secrets/docker-health-alert.env";
-      ExecStart = "${pkgs.bash}/bin/bash /home/nixos/docker/monitoring/gotify/docker-health-to-gotify.sh";
+      ExecStart = "${pkgs.bash}/bin/bash /home/${vars.primaryUser}/docker/monitoring/gotify/docker-health-to-gotify.sh";
       StandardOutput = "journal";
       StandardError = "journal";
     };
@@ -25,4 +25,4 @@
       Persistent = true;
     };
   };
-}
+}

modules/docker/enable-service.nix

@@ -1,23 +1,23 @@
 { pkgs, ... }:
 
 {
-    #  virtualisation.docker.enable = true;
+  #  virtualisation.docker.enable = true;
   virtualisation.docker = {
-  enable = true;
-  package = pkgs.docker;
-#  listenOptions = [
-#  "unix:///var/run/docker.sock"
-#  "tcp://0.0.0.0:2375"
-#];
+    enable = true;
+    package = pkgs.docker;
+    #  listenOptions = [
+    #  "unix:///var/run/docker.sock"
+    #  "tcp://0.0.0.0:2375"
+    #];
 
-#  daemon.settings = {
-#    metrics-addr = "0.0.0.0:9323";
-#    experimental = true;
-#  };
-};
+    #  daemon.settings = {
+    #    metrics-addr = "0.0.0.0:9323";
+    #    experimental = true;
+    #  };
+  };
 
-environment.systemPackages = with pkgs; [
-  docker-compose
-  docker-buildx
-];
-}
+  environment.systemPackages = with pkgs; [
+    docker-compose
+    docker-buildx
+  ];
+}

modules/docker/mount-data.nix

@@ -1,63 +1,70 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, vars, ... }:
 
+let
+  # `x-systemd.automount` never works inside a Linux container (LXC
+  # included, regardless of privilege) -- confirmed live on lxc-docker:
+  # systemd logs "Starting of <unit>.automount unsupported" for every
+  # share and never mounts them. Mount eagerly there instead, with
+  # `nofail` so a boot with the NFS server unreachable doesn't hang
+  # (the VM platforms rely on automount itself to get that same
+  # non-blocking behavior, so they don't need `nofail` too).
+  automountOpts = if config.boot.isContainer then [ "nofail" ] else [ "x-systemd.automount" ];
+in
 {
-  fileSystems."/mnt/docker/config" = {
-    device = "server:/tank/docker/config";
-    fsType = "nfs";
+  fileSystems = {
+    ${vars.nfsShares.dockerConfig.mountpoint} = {
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.dockerConfig.subpath}";
+      fsType = "nfs";
 
-    options = [
-      "nfsvers=4.2"
-      "_netdev"
-      "x-systemd.automount"
-      "noatime"
-    ];
-  };
+      options = [
+        "nfsvers=4.2"
+        "_netdev"
+        "noatime"
+      ] ++ automountOpts;
+    };
 
-  fileSystems."/mnt/docker/databases" = {
-    device = "server:/tank/docker/databases";
-    fsType = "nfs";
+    ${vars.nfsShares.dockerDatabases.mountpoint} = {
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.dockerDatabases.subpath}";
+      fsType = "nfs";
 
-    options = [
-      "nfsvers=4.2"
-      "_netdev"
-      "x-systemd.automount"
-      "noatime"
-    ];
-  };
+      options = [
+        "nfsvers=4.2"
+        "_netdev"
+        "noatime"
+      ] ++ automountOpts;
+    };
 
-  fileSystems."/mnt/docker/volumes" = {
-    device = "server:/tank/docker/volumes";
-    fsType = "nfs";
+    ${vars.nfsShares.dockerVolumes.mountpoint} = {
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.dockerVolumes.subpath}";
+      fsType = "nfs";
 
-    options = [
-      "nfsvers=4.2"
-      "_netdev"
-      "x-systemd.automount"
-      "noatime"
-    ];
-  };
+      options = [
+        "nfsvers=4.2"
+        "_netdev"
+        "noatime"
+      ] ++ automountOpts;
+    };
 
- fileSystems."/mnt/nextcloud-data" = {
-    device = "server:/tank/docker/nextcloud-data";
-    fsType = "nfs";
+    ${vars.nfsShares.nextcloudData.mountpoint} = {
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.nextcloudData.subpath}";
+      fsType = "nfs";
 
-    options = [
-      "nfsvers=4.2"
-      "_netdev"
-      "x-systemd.automount"
-      "noatime"
-    ];
-  };
+      options = [
+        "nfsvers=4.2"
+        "_netdev"
+        "noatime"
+      ] ++ automountOpts;
+    };
 
- fileSystems."/mnt/raspi-backup" = {
-    device = "server:/tank/raspi/volumes";
-    fsType = "nfs";
+    ${vars.nfsShares.raspiVolumes.mountpoint} = {
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.raspiVolumes.subpath}";
+      fsType = "nfs";
 
-    options = [
-      "nfsvers=4.2"
-      "_netdev"
-      "x-systemd.automount"
-      "noatime"
-    ];
+      options = [
+        "nfsvers=4.2"
+        "_netdev"
+        "noatime"
+      ] ++ automountOpts;
+    };
   };
 }

modules/docker/nextcloud-cron-job.nix

@@ -0,0 +1,22 @@
+{ pkgs, vars, ... }:
+
+{
+  # Create nextcloud cron scheduled task
+  systemd.services.nextcloud = {
+    description = "Nextcloud scheduled task";
+    script = ''${pkgs.bash}/bin/bash ~/docker/services-up.sh --profile nextcloud exec -u 33 nextcloud-webapp php ./cron.php'';
+    serviceConfig = {
+      Type = "oneshot";
+      User = vars.primaryUser;
+    };
+    path = with pkgs; [ docker docker-compose ];
+  };
+
+  systemd.timers.nextcloud = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "*:0/5";
+      Persistent = true;
+    };
+  };
+}

modules/hardware-configuration/vm/linode.nix

@@ -5,36 +5,39 @@
 
 {
   imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-  boot.loader.grub.device = "/dev/sda";
+  boot = {
+    initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ ];
+    extraModulePackages = [ ];
 
-  fileSystems."/" =
-    { device = "/dev/sda";
-      fsType = "ext4";
+    # Enable LISH
+    kernelParams = [ "console=ttyS0,19200n8" ];
+
+    loader = {
+      grub = {
+        device = "/dev/sda";
+        extraConfig = ''
+          serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
+          terminal_input serial;
+          terminal_output serial;
+        '';
+        forceInstall = true;
+        # device = "nodev";
+      };
+      timeout = 10;
     };
+  };
 
-  swapDevices =
-    [ { device = "/dev/sdb"; }
-    ];
-
-# Enable LISH
-boot.kernelParams = [ "console=ttyS0,19200n8" ];
-boot.loader.grub.extraConfig = ''
-  serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
-  terminal_input serial;
-  terminal_output serial;
-'';
-
-boot.loader.grub.forceInstall = true;
-# boot.loader.grub.device = "nodev";
-boot.loader.timeout = 10;
-
+  # fileSystems."/" and swapDevices are now owned by disko
+  # (../disko/linode.nix, imported from ../platforms/linode.nix) — same
+  # /dev/sda root + /dev/sdb swap layout, declared there instead so disko's
+  # (idempotent, non-destructive — see that file) format/mount scripts stay
+  # in sync with what NixOS actually mounts.
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

modules/hardware-configuration/vm/proxmox.nix

@@ -5,13 +5,16 @@
 
 {
   imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
+  boot = {
+    initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ "kvm-amd" ];
+    extraModulePackages = [ ];
+  };
   # boot.loader.grub.device = "/dev/sda2"; # or "nodev" for efi only
 
   # fileSystems."/" =

modules/installer/common.nix

@@ -0,0 +1,240 @@
+{ pkgs, lib, vars, ... }:
+
+{
+  imports = [
+    ./host-keys.nix
+  ];
+
+  networking.useDHCP = lib.mkDefault true;
+
+  # Recommended over the true default (bypasses ZFS's own import safeguards)
+  # per the option's own docs. This installer environment has no ZFS pools
+  # of its own to import, so this is a no-op here — just silences the
+  # eval-time warning, matching modules/common/configuration.nix.
+  boot.zfs.forceImportRoot = false;
+
+  time.timeZone = vars.timeZone;
+
+  # Without this, the installer only ever sees cache.nixos.org, which
+  # doesn't carry sops-install-secrets (it's built straight from the
+  # sops-nix flake's own Go source, not part of nixpkgs) — every install
+  # would otherwise compile it from scratch, which is what ran an 8GB LXC
+  # container's disk out of space. Push a built copy to nix-cache once
+  # (from a machine with real disk headroom) and every future install,
+  # of any type, fetches instead of rebuilding.
+  nix.settings = {
+    substituters = [
+      "http://nix-cache"
+      "https://cache.nixos.org/"
+    ];
+    trusted-public-keys = [
+      "cache.local-1:usoWYanY3Kpq2+kDIS2nhWoLZiRxanmdysdzqCFBHW4="
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+    ];
+  };
+
+  environment = {
+    systemPackages = with pkgs; [
+      git
+      curl
+      jq
+      parted
+      e2fsprogs
+      btrfs-progs
+      util-linux
+      disko
+    ];
+
+    # Write auto-install script to /root
+    etc."auto-install.sh" = {
+      text = ''
+            #!/run/current-system/sw/bin/bash
+            set -eux
+
+            set -euo pipefail
+
+        export FLAKE_BASE_URL="git+https://${vars.lanDomain}/beatzaplenty/nixos.git"
+
+        echo "Fetching available NixOS hosts from flake..."
+        # Two categories deliberately excluded from the menu:
+        #   lxc-*     — these build a config.system.build.tarball meant for
+        #               `pct restore` on Proxmox directly, not an install.
+        #               Running nixos-install against one here would
+        #               bind-mount / onto /mnt and then refuse to touch the
+        #               filesystem it's currently running on — see
+        #               docs/auto-installer.md.
+        #   installer — this *is* the installer image's own flake target,
+        #               not a deployable host; "installing" it means
+        #               nixos-install-ing a copy of the installer into
+        #               itself.
+        mapfile -t options < <(
+          nix eval --json --no-use-registries --no-accept-flake-config --extra-experimental-features "flakes nix-command" \
+            "''${FLAKE_BASE_URL}#nixosConfigurations" \
+            --apply builtins.attrNames \
+          | jq -r '.[]
+              | select(startswith("lxc-") | not)
+              | select(. != "installer")'
+        )
+
+        if [[ ''${#options[@]} -eq 0 ]]; then
+          echo "ERROR: No NixOS hosts found in ''${FLAKE_BASE_URL}#nixosConfigurations" >&2
+          exit 1
+        fi
+
+        echo "Note: lxc-* targets aren't installed this way — build them with"
+        echo "  nix build .#nixosConfigurations.<name>.config.system.build.tarball"
+        echo "and 'pct restore' the result on Proxmox directly. See docs/auto-installer.md."
+
+        echo "Choose the flake profile to install:"
+        select choice in "''${options[@]}"; do
+          if [[ -n "$choice" ]]; then
+            echo "You selected: $choice"
+            break
+          else
+            echo "Invalid selection. Try again."
+          fi
+        done
+
+        echo "Starting install with flake: ''${FLAKE_BASE_URL}#''${choice}"
+
+        # Optional: confirm before proceeding
+        read -rp "Proceed with installation? (y/N): " confirm
+        if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
+          echo "Aborted."
+          exit 1
+        fi
+
+        # A nix-cache host is *the* substituter/remote-builder for every other
+        # host once installed (its own config explicitly excludes itself from
+        # using either — see buildType != "nix-cache" in the nixos flake.nix).
+        # Installing one shouldn't depend on a nix-cache substituter either,
+        # for the same reason — plus in practice "nix-cache" only resolves over
+        # Tailscale, which a fresh installer environment was never connected to
+        # anyway, so it's dead weight even for non-nix-cache installs until
+        # that's sorted out. Override it away here specifically for nix-cache
+        # targets to keep install-time behaviour consistent with run-time.
+        nix_extra_opts=()
+        if [[ "''${choice}" == *-nix-cache ]]; then
+            echo "Installing a nix-cache host — skipping the nix-cache substituter."
+            nix_extra_opts+=(--option substituters "https://cache.nixos.org/")
+        fi
+
+        # Every host reachable through this menu has a Disko config (lxc-*
+        # is filtered out above, and is the only category that doesn't —
+        # see docs/auto-installer.md), so this can run unconditionally: no
+        # need to probe the flake first and branch on whether Disko applies.
+        disko --mode destroy,format,mount \
+            --flake "''${FLAKE_BASE_URL}#''${choice}" "''${nix_extra_opts[@]}" --yes-wipe-all-disks
+
+        # sops-nix derives this host's decryption key from its own SSH host key
+        # at *activation* time, which runs before systemd would otherwise
+        # generate one on first boot. Without pre-seeding it here, secrets
+        # (including the login password) fail to decrypt on first boot.
+        # Generate the key with scripts/secrets/prepare-host-key.sh first.
+        #
+        # Two places a key can come from, checked in order:
+        #   /etc/host-keys  — baked into this image at build time (see
+        #                      modules/installer/host-keys.nix; only present
+        #                      if built with NIXOS_HOST_KEYS_DIR set)
+        #   /root/host-keys — scp'd in manually after boot (older fallback,
+        #                      still supported for images built without keys)
+        mkdir -p /root/host-keys
+        if [[ -f "/etc/host-keys/''${choice}_ssh_host_ed25519_key" ]]; then
+            echo "Found baked-in SSH host key for ''${choice}, installing to target..."
+            install -D -m 0600 "/etc/host-keys/''${choice}_ssh_host_ed25519_key" /mnt/etc/ssh/ssh_host_ed25519_key
+            install -D -m 0644 "/etc/host-keys/''${choice}_ssh_host_ed25519_key.pub" /mnt/etc/ssh/ssh_host_ed25519_key.pub
+        elif [[ -f "/root/host-keys/''${choice}_ssh_host_ed25519_key" ]]; then
+            echo "Found pre-seeded SSH host key for ''${choice}, installing to target..."
+            install -D -m 0600 "/root/host-keys/''${choice}_ssh_host_ed25519_key" /mnt/etc/ssh/ssh_host_ed25519_key
+            install -D -m 0644 "/root/host-keys/''${choice}_ssh_host_ed25519_key.pub" /mnt/etc/ssh/ssh_host_ed25519_key.pub
+        else
+            echo "WARNING: no SSH host key found for ''${choice} (checked /etc/host-keys and /root/host-keys)"
+            echo "sops-nix secrets (including the login password) will NOT decrypt on first boot."
+            echo "Run scripts/secrets/prepare-host-key.sh for host ''${choice} on your admin workstation first,"
+            echo "then either rebuild this image with NIXOS_HOST_KEYS_DIR set, or scp the result to"
+            echo "/root/host-keys/ on this machine."
+            read -rp "Continue without a pre-seeded key anyway? (y/N): " skip_key
+            if [[ ! "$skip_key" =~ ^[Yy]$ ]]; then
+                echo "Aborted."
+                exit 1
+            fi
+        fi
+
+        mkdir -p /mnt/install-tmp
+        export TMPDIR=/mnt/install-tmp
+
+        nixos-install \
+            --flake "''${FLAKE_BASE_URL}#''${choice}" \
+            "''${nix_extra_opts[@]}" \
+            --no-root-password
+
+
+            rm -rf /mnt/install-tmp
+            # Redundant copy of the host's private key — the real one is now at
+            # /etc/ssh/ssh_host_ed25519_key. Nothing NixOS-managed ever cleans this
+            # up on its own since it was written imperatively, not declaratively.
+            rm -rf /root/host-keys
+            sleep 10
+            reboot
+      '';
+
+      mode = "0755";
+    };
+  };
+
+  programs.git.enable = true;
+
+  # Run the installer on first login. Previously this copied an /etc file
+  # into the nixos user's ~/.bash_profile via an activation script that
+  # got dropped in a refactor (and only ever worked for that one user
+  # anyway) — loginShellInit is NixOS's native hook for this, applies to
+  # any user's login shell (root included), and needs no home-directory
+  # file-copying/chown.
+  programs.bash.loginShellInit = ''
+    if [ -n "$PS1" ] && [ ! -e "$HOME/.auto_install_ran" ]; then
+      sudo /etc/auto-install.sh
+      touch "$HOME/.auto_install_ran"
+    fi
+  '';
+
+  services.openssh.enable = true;
+
+  services.openssh.settings = {
+    PermitRootLogin = "yes";
+    PasswordAuthentication = true;
+  };
+
+  # nixpkgs' own installer profile (profiles/installation-device.nix, pulled
+  # in via installation-cd-minimal.nix) sets initialHashedPassword = "" for
+  # both users — its own passwordless-login convention for install media.
+  # That's a second, non-null password option alongside our hashedPassword
+  # below, which NixOS warns about as ambiguous precedence. Force it null
+  # rather than adopting passwordless login: this image now also boots over
+  # LAN PXE with PasswordAuthentication enabled, so passwordless root SSH
+  # would be reachable by anyone on the LAN, not just local console.
+  users.users.root = {
+    hashedPassword =
+      "$6$Kwv9KAyvcurAViQF$H4.u3feqGE7lVoNgkFXhE3n2Pmo//9JYDTCz8ifrVHBxPjwa1xMby7tEZ8Bpt5MXs9Rkx6/YbZWxs5CpH0s/70";
+    initialHashedPassword = lib.mkForce null;
+  };
+
+  users.users.${vars.primaryUser} = {
+    isNormalUser = true;
+
+    extraGroups = [
+      "wheel"
+    ];
+
+    shell = pkgs.bashInteractive;
+
+    hashedPassword =
+      "$6$Kwv9KAyvcurAViQF$H4.u3feqGE7lVoNgkFXhE3n2Pmo//9JYDTCz8ifrVHBxPjwa1xMby7tEZ8Bpt5MXs9Rkx6/YbZWxs5CpH0s/70";
+    initialHashedPassword = lib.mkForce null;
+
+    openssh.authorizedKeys.keys = [
+      vars.adminSshKey
+    ];
+  };
+
+  system.stateVersion = "26.05";
+}

modules/installer/host-keys.nix

@@ -0,0 +1,37 @@
+{ lib, ... }:
+
+let
+  # host-keys/ is gitignored (private key material must never be committed),
+  # which means flakes' git-filtered source tree can never see it via a
+  # normal relative path — referencing it at all requires stepping outside
+  # pure evaluation. builtins.getEnv is neutered to "" under normal
+  # `nix build`/`nix eval` (no error, just empty), so this whole module is a
+  # silent no-op unless the operator explicitly opts in with --impure and
+  # the env var set — safe by default, including in CI.
+  #
+  #   NIXOS_HOST_KEYS_DIR=$(pwd)/host-keys nix build .#iso --impure
+  #
+  # See docs/auto-installer.md.
+  hostKeysDirStr = builtins.getEnv "NIXOS_HOST_KEYS_DIR";
+  hasHostKeysDir = hostKeysDirStr != "" && builtins.pathExists hostKeysDirStr;
+  hostKeysDir = /. + hostKeysDirStr;
+
+  keyFileNames =
+    if hasHostKeysDir
+    then
+      lib.filter
+        (name: lib.hasSuffix "_ssh_host_ed25519_key" name || lib.hasSuffix "_ssh_host_ed25519_key.pub" name)
+        (lib.attrNames (builtins.readDir hostKeysDir))
+    else [ ];
+in
+{
+  environment.etc = lib.listToAttrs (map
+    (name: {
+      name = "host-keys/${name}";
+      value = {
+        source = hostKeysDir + "/${name}";
+        mode = "0400";
+      };
+    })
+    keyFileNames);
+}

modules/installer/iso.nix

@@ -0,0 +1,8 @@
+{ modulesPath, ... }:
+
+{
+  imports = [
+    "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix"
+    ./common.nix
+  ];
+}

modules/nix-cache/client.nix

@@ -1,9 +1,9 @@
-{ ... }:
+{ vars, ... }:
 
 {
   nix.settings = {
     substituters = [
-      "http://nix-cache"
+      "http://${vars.nixCacheHost}"
       "https://cache.nixos.org/"
     ];
     trusted-public-keys = [

modules/nix-cache/remote-builder-client.nix

@@ -0,0 +1,36 @@
+{ pkgs, vars, ... }:
+
+{
+  # Install the remote builder key on each client host (do not commit private keys):
+  #   sudo install -d -m 0700 /root/.ssh
+  #   sudo install -m 0600 ./nixremote /root/.ssh/nixremote
+  #   sudo ssh -i /root/.ssh/nixremote nixremote@nix-cache nix-store --version
+  # Trust nix-cache's SSH host key declaratively so the nix-daemon (root)
+  # can connect the first time without a manual ssh-keyscan/known_hosts
+  # step on every new client.
+  programs.ssh.knownHosts.${vars.nixCacheHost} = {
+    hostNames = [ vars.nixCacheHost ];
+    publicKey = vars.nixCacheHostKey;
+  };
+
+  nix = {
+    distributedBuilds = true;
+
+    buildMachines = [
+      {
+        hostName = vars.nixCacheHost;
+        sshUser = vars.remoteBuilderUser;
+        sshKey = "/root/.ssh/${vars.remoteBuilderUser}";
+        inherit (pkgs.stdenv.hostPlatform) system;
+        maxJobs = 4;
+        speedFactor = 2;
+        supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
+      }
+    ];
+
+    settings = {
+      builders-use-substitutes = true;
+      max-jobs = "auto";
+    };
+  };
+}

modules/nix-cache/server.nix

@@ -1,54 +1,53 @@
-{ config, pkgs, ... }:
+{ config, pkgs, vars, ... }:
 
 {
-  # Generate the binary cache key pair on the nix-cache host:
-  #   sudo install -d -m 0700 /etc/nix
-  #   sudo nix-store --generate-binary-cache-key nix-cache-1 \
-  #     /etc/nix/cache-priv.pem \
-  #     /etc/nix/cache-pub.pem
-  #   sudo chmod 0600 /etc/nix/cache-priv.pem
-  #   sudo chmod 0644 /etc/nix/cache-pub.pem
-  #   cat /etc/nix/cache-pub.pem
-  services.nix-serve = {
-    enable = true;
-    secretKeyFile = "/etc/nix/cache-priv.pem";
-  };
+  # nix-serve's signing key has to be the *same* key on every host that
+  # ever plays the nix-cache role -- modules/nix-cache/client.nix hardcodes
+  # every client's trust in one specific public key ("cache.local-1:..."),
+  # so a freshly self-generated key here wouldn't be trusted by anyone.
+  # Managed via sops-nix like every other secret in this repo instead of
+  # the old manual `nix-store --generate-binary-cache-key` step -- see
+  # "Binary cache signing key" in docs/nix-cache.md for how to add/rotate
+  # the value in secrets/nix-cache.yaml.
+  sops.secrets."cache-priv-key".sopsFile = ../../secrets/nix-cache.yaml;
 
-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    virtualHosts."nix-cache" = {
-      locations."/" = {
-        proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
+  services = {
+    nix-serve = {
+      enable = true;
+      secretKeyFile = config.sops.secrets."cache-priv-key".path;
+    };
+
+    nginx = {
+      enable = true;
+      recommendedProxySettings = true;
+      virtualHosts.${vars.nixCacheHost} = {
+        locations."/" = {
+          proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
+        };
       };
     };
+
+    openssh.enable = true;
   };
 
-  networking.firewall.allowedTCPPorts = [ 80 ];
+  networking.firewall.allowedTCPPorts = [ vars.ports.nixCacheHttp ];
 
-  users.groups.nixremote = {};
+  users.groups.${vars.remoteBuilderUser} = { };
 
-  users.users.nixremote = {
+  users.users.${vars.remoteBuilderUser} = {
     isSystemUser = true;
-    group = "nixremote";
+    group = vars.remoteBuilderUser;
     createHome = true;
     home = "/var/lib/nixremote";
     shell = pkgs.bashInteractive;
-    # Provide remote builder public keys here (safe to commit public keys only):
-    # openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAA... client@host" ];
-    #
-    # Avoid absolute keyFiles paths here because they break pure flake evaluation.
-    openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server"
-					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAYIT9ormlmxZ0SziyDQaUntnKI8HK9/s3Qac1ZKjP2 root@docker" 
-					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos"
-					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos"
-					"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server"];
+    # Client public keys allowed to use this host as a remote builder —
+    # single source of truth is vars.remoteBuilderAuthorizedKeys (safe to
+    # commit public keys only).
+    openssh.authorizedKeys.keys = vars.remoteBuilderAuthorizedKeys;
   };
 
-  services.openssh.enable = true;
-
   nix.settings = {
-    trusted-users = [ "root" "nixremote" ];
+    trusted-users = [ "root" vars.remoteBuilderUser ];
     experimental-features = [ "nix-command" "flakes" ];
     auto-optimise-store = true;
     builders-use-substitutes = true;
@@ -57,6 +56,6 @@
   nix.gc = {
     automatic = true;
     dates = "weekly";
-    options = "--delete-older-than 30d";
+    options = "--delete-older-than ${vars.nixCacheGcMaxAge}";
   };
 }

modules/platforms/linode.nix

@@ -3,6 +3,7 @@
 {
   imports = [
     ../hardware-configuration/vm/linode.nix
+    ../disko/linode.nix
   ];
 
   networking = {

modules/platforms/lxc.nix

@@ -1,8 +1,148 @@
-{ ... }:
+{ lib, modulesPath, flakeTarget, ... }:
 
+let
+  # Bakes this exact flake target's pre-generated SSH host key straight
+  # into /etc/ssh/ -- mirrors modules/installer/host-keys.nix's
+  # builtins.getEnv pattern (impure and empty under normal `nix
+  # build`/`nix eval`, so this is a no-op unless explicitly opted into
+  # with NIXOS_HOST_KEYS_DIR=... --impure), but places the key directly
+  # rather than staging it under /etc/host-keys/ for a later manual copy
+  # -- this is the whole system for a `lxc-*` host, built straight to a
+  # pct-restorable tarball with no install step, so there's no later copy
+  # step to stage for.
+  #
+  # Without this, config.system.build.tarball's built-in system just
+  # generates a fresh host key at first boot like any other host would --
+  # but sops-nix derives its decryption key from *this* file, and
+  # .sops.yaml only trusts whatever key scripts/secrets/sync-host-keys.sh already
+  # registered for this exact target name. A freshly-generated key can
+  # never match that, so every secret (including this host's own login)
+  # permanently fails to decrypt. Confirmed live: sops-install-secrets
+  # errored with "Error getting data key: 0 successful groups required,
+  # got 0" -- the container's actual host key's age fingerprint didn't
+  # match the one registered in .sops.yaml at all.
+  hostKeysDirStr = builtins.getEnv "NIXOS_HOST_KEYS_DIR";
+  hasHostKeysDir = hostKeysDirStr != "" && builtins.pathExists hostKeysDirStr;
+  hostKeysDir = /. + hostKeysDirStr;
+
+  # flakeTarget ("${platform}-${buildType}") comes in via specialArgs from
+  # flake.nix's mkTarget -- exactly the name scripts/secrets/sync-host-keys.sh
+  # registers keys under. Deliberately not read back from
+  # config.environment.etc."flake-target" (which is set to the same value)
+  # -- this module also *contributes* to environment.etc below, and a
+  # module reading the merged value of an option it's still defining is a
+  # circular dependency (confirmed: "infinite recursion encountered").
+  privKeyFile = hostKeysDir + "/${flakeTarget}_ssh_host_ed25519_key";
+  pubKeyFile = hostKeysDir + "/${flakeTarget}_ssh_host_ed25519_key.pub";
+  hasKeyForThisTarget =
+    hasHostKeysDir
+    && builtins.pathExists privKeyFile
+    && builtins.pathExists pubKeyFile;
+in
 {
-  boot.isContainer = true;
+  # LXC containers share the host kernel — Proxmox starts them by exec'ing
+  # /sbin/init directly, no bootloader/initrd involved — and Proxmox has its
+  # own container hostname/network provisioning outside Nix. nixpkgs' own
+  # virtualisation/proxmox-lxc.nix module already handles all of this
+  # correctly (boot.isContainer, loader.initScript, systemd-networkd) and,
+  # critically, provides config.system.build.tarball — a directly
+  # `pct restore`-able container image, no nixos-install/bind-mount needed
+  # (nixos-install refuses to touch the filesystem it's currently running
+  # on, which is exactly what bind-mounting / onto /mnt for an installer
+  # LXC container does).
+  imports = [
+    (modulesPath + "/virtualisation/proxmox-lxc.nix")
+  ];
 
-  boot.loader.grub.enable = false;
-  boot.loader.systemd-boot.enable = false;
+  proxmoxLXC = {
+    # host.nix declares each host's real hostname (networking.hostName);
+    # keep that instead of letting Proxmox's ambient container config win.
+    manageHostName = true;
+    # Unprivileged matches how these containers are actually created.
+    privileged = false;
+  };
+
+  boot.loader = {
+    grub.enable = false;
+    systemd-boot.enable = false;
+  };
+
+  # NetworkManager depends on a running udevd to enumerate/classify devices,
+  # which boot.isContainer disables (see nixpkgs' container-config.nix) —
+  # that's what broke DHCP-hostname registration in Pi-hole. The imported
+  # proxmox-lxc.nix module already switches networking to systemd-networkd
+  # for the same reason; it just doesn't disable NetworkManager itself,
+  # which modules/common/configuration.nix enables for every host.
+  networking.networkmanager.enable = lib.mkForce false;
+
+  environment.etc = lib.mkIf hasKeyForThisTarget {
+    "ssh/ssh_host_ed25519_key" = {
+      source = privKeyFile;
+      mode = "0600";
+    };
+    "ssh/ssh_host_ed25519_key.pub" = {
+      source = pubKeyFile;
+      mode = "0644";
+    };
+  };
+
+  # virtualisation/proxmox-lxc.nix (imported above) registers the Nix
+  # store DB via a systemd service (register-nix-paths) -- it never runs
+  # an activation script at all. Confirmed live this means neither
+  # sops-nix's "for users" secrets (password hashes -- installed by the
+  # activation script itself, not a systemd service, since they need to
+  # exist *before* user creation) nor the user-creation step that
+  # consumes them ever run on a real lxc-* boot. Regular secrets
+  # (nix-serve's key, beszel's token, etc.) work anyway because sops-nix
+  # provides its own systemd service for those.
+  #
+  # A systemd service, not boot.postBootCommands: tried that first (it's
+  # a genuine, generally-invoked hook -- nixos/modules/system/boot/stage-2-init.sh,
+  # which becomes this container's actual /sbin/init, unconditionally
+  # runs it) but switch-to-configuration behaves differently that early in
+  # boot (raw stage-2-init.sh, before systemd itself has even started) --
+  # confirmed live it silently failed to rewrite /etc/shadow from there
+  # even in "test" mode, despite the exact same command working reliably
+  # every time when run post-boot (i.e. as a normal systemd service, which
+  # is what this is). Not fully root-caused why the early context
+  # specifically breaks it; a real systemd service sidesteps needing to.
+  #
+  # /etc/shadow already has PLACEHOLDER entries for every declared user
+  # baked in at build time (part of constructing the system closure).
+  # update-users-groups.pl deliberately never overwrites an *existing*
+  # shadow entry -- a correct safety property in general (don't clobber a
+  # real user's real password on a config rebuild) -- but on a genuine
+  # first boot that only means the real hashedPasswordFile-derived hash
+  # never gets the chance to be applied either, since the placeholder is
+  # already "seen". Safe to clear here specifically: there is no real
+  # password yet to protect on a first boot.
+  #
+  # "test" mode, not "boot": confirmed live "boot" mode aborts partway
+  # through (before rewriting /etc/shadow) on a warning that "/boot" is on
+  # a different filesystem -- a real check for a host with a bootloader to
+  # update, meaningless for a container that has none
+  # (boot.loader.{grub,systemd-boot}.enable are both false above), but it
+  # still aborts the script. "test" runs every activation step without
+  # touching boot-loader state at all.
+  #
+  # ConditionPathExists (systemd-native, not a bash-level check) means
+  # this only ever runs once, on the genuine first boot -- systemd itself
+  # skips even starting it on every later boot once the marker exists.
+  # switch-to-configuration is otherwise the operator's call per this
+  # repo's own safety rules, not something to run on every boot.
+  systemd.services.nixos-lxc-first-boot-activate = {
+    description = "Complete first-boot NixOS activation (users, secrets) for this LXC container";
+    wantedBy = [ "multi-user.target" ];
+    unitConfig.ConditionPathExists = "!/var/lib/nixos-lxc-first-boot-activated";
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      rm -f /etc/shadow
+      /run/current-system/bin/switch-to-configuration test
+      mkdir -p /var/lib
+      touch /var/lib/nixos-lxc-first-boot-activated
+    '';
+  };
 }

modules/pxe-boot/stage-installer-artifacts.nix

@@ -0,0 +1,23 @@
+{ netbootSystem, ... }:
+
+let
+  # config.system.build.kernel and .netbootRamdisk are directories, not the
+  # files themselves — nixpkgs' own system.build.kexecTree does the same
+  # ${...}/<file> dereference for the same reason.
+  inherit (netbootSystem.config.system.boot.loader) kernelFile;
+in
+{
+  # Builds this flake's own installer netboot image (the same one
+  # `nix build .#pxe` produces) and stages it where menu.ipxe's :nixos
+  # entry expects it, so the pxe-boot host is self-contained — no manual
+  # operator step to populate /srv/pxe/http/nixos after deploy.
+  systemd.tmpfiles.rules = [
+    # Declared here too (not just in build-types/pxe-boot.nix) so this
+    # module's C+ rules don't depend on cross-module list-merge ordering —
+    # tmpfiles' C type needs the target directory to already exist.
+    "d /srv/pxe/http/nixos 0755 root root -"
+    "C+ /srv/pxe/http/nixos/${kernelFile} 0644 root root - ${netbootSystem.config.system.build.kernel}/${kernelFile}"
+    "C+ /srv/pxe/http/nixos/initrd 0644 root root - ${netbootSystem.config.system.build.netbootRamdisk}/initrd"
+    "C+ /srv/pxe/http/nixos/netboot.ipxe 0644 root root - ${netbootSystem.config.system.build.netbootIpxeScript}/netboot.ipxe"
+  ];
+}

modules/raspi/mount-data.nix

@@ -1,26 +1,32 @@
-{ ... }:
+{ config, lib, vars, ... }:
 
 {
-fileSystems."/mnt/raspi" = {
-  device = "raspberrypi.tail13f623.ts.net:/home/raspi/raspi";
-  fsType = "nfs4";
-  options = [
-    "nofail"
-    "_netdev"
-    "noatime"
+  fileSystems.${vars.raspiMountpoint} = {
+    device = "${vars.raspberryPiHost}.${vars.tailnetDomain}:${vars.raspiNfsPath}";
+    fsType = "nfs4";
+    options = [
+      "nofail"
+      "_netdev"
+      "noatime"
 
-    # Don't mount until first access
-    "x-systemd.automount"
+      # Explicitly use NFSv4.2 if supported
+      "nfsvers=4.2"
+    ] ++ lib.optionals (!config.boot.isContainer) [
+      # `x-systemd.automount` never works inside a Linux container (LXC
+      # included) -- confirmed live on lxc-docker: systemd logs "Starting
+      # of <unit>.automount unsupported" and never mounts it. `nofail`
+      # above already keeps boot non-blocking there, so plain eager
+      # mounting is fine.
 
-    # Unmount after 10 min idle
-    "x-systemd.idle-timeout=600"
+      # Don't mount until first access
+      "x-systemd.automount"
 
-    # Give the Pi/Tailscale a little time to appear
-    "x-systemd.device-timeout=10s"
+      # Unmount after 10 min idle
+      "x-systemd.idle-timeout=600"
 
-    # Explicitly use NFSv4.2 if supported
-    "nfsvers=4.2"
-  ];
-};
+      # Give the Pi/Tailscale a little time to appear
+      "x-systemd.device-timeout=10s"
+    ];
+  };
 
-}
+}

modules/remote-builder-client.nix

@@ -1,26 +0,0 @@
-{ pkgs, ... }:
-
-{
-  # Install the remote builder key on each client host (do not commit private keys):
-  #   sudo install -d -m 0700 /root/.ssh
-  #   sudo install -m 0600 ./nixremote /root/.ssh/nixremote
-  #   sudo ssh -i /root/.ssh/nixremote nixremote@nix-cache nix-store --version
-  nix.distributedBuilds = true;
-
-  nix.buildMachines = [
-    {
-      hostName = "nix-cache";
-      sshUser = "nixremote";
-      sshKey = "/root/.ssh/nixremote";
-      system = pkgs.stdenv.hostPlatform.system;
-      maxJobs = 4;
-      speedFactor = 2;
-      supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
-    }
-  ];
-
-  nix.settings = {
-    builders-use-substitutes = true;
-    max-jobs = "auto";
-  };
-}

modules/rotate-traefik-logs.nix

@@ -1,20 +0,0 @@
-{ ... }:
-
-{
-      services.logrotate = {
-    enable = true;
-
-    settings = {
-      "/mnt/docker/volumes/traefik-data/logs/*.log" = {
-        daily = true;
-        size = "100M";
-        rotate = 20;
-        compress = true;
-        missingok = true;
-        notifempty = true;
-        copytruncate = true;
-      };
-
-     };
-  };
-}

modules/services/enable-rpcbind.nix

@@ -1,5 +1,5 @@
- { ... }:
- 
- {
- services.rpcbind.enable = true;
- }
+_:
+
+{
+  services.rpcbind.enable = true;
+}

modules/services/nextcloud-cron-job.nix

@@ -1,22 +0,0 @@
-{ pkgs, ... }:
-
-{
-# Create nextcloud cron scheduled task
-systemd.services.nextcloud = {
-  description = "Nextcloud scheduled task";
-  script = ''${pkgs.bash}/bin/bash ~/docker/services-up.sh --profile nextcloud exec -u 33 nextcloud-webapp php ./cron.php'';
-  serviceConfig = {
-    Type = "oneshot";
-    User = "nixos";
-  };
-  path = with pkgs; [ docker docker-compose ];
-};
-
-systemd.timers.nextcloud = {
-  wantedBy = [ "timers.target" ];
-  timerConfig = {
-    OnCalendar = "*:0/5";
-    Persistent = true;
-  };
-};
-}

modules/services/zfs/auto-mount-volumes.nix

@@ -1,12 +1,12 @@
 { pkgs, boot, ... }:
 
 {
-boot.postBootCommands = ''
-  echo "=== STARTING ZPOOL IMPORT ==="
-  ${pkgs.zfs_unstable}/bin/zpool import -a -N -d /dev/disk/by-path
-  ${pkgs.zfs_unstable}/bin/zpool status
-  ${pkgs.zfs_unstable}/bin/zfs mount -a
-  ${pkgs.zfs_unstable}/bin/zfs list
-    echo "=== ZPOOL IMPORT COMPLETE ==="
-'';
- }
+  boot.postBootCommands = ''
+    echo "=== STARTING ZPOOL IMPORT ==="
+    ${pkgs.zfs_unstable}/bin/zpool import -a -N -d /dev/disk/by-path
+    ${pkgs.zfs_unstable}/bin/zpool status
+    ${pkgs.zfs_unstable}/bin/zfs mount -a
+    ${pkgs.zfs_unstable}/bin/zfs list
+      echo "=== ZPOOL IMPORT COMPLETE ==="
+  '';
+}

modules/services/zfs/enable-service.nix

@@ -1,16 +1,21 @@
 { pkgs, ... }:
 
- {
-boot.supportedFilesystems = [ "zfs" ];
-  boot.zfs.forceImportRoot = false;
-  boot.zfs.package = pkgs.zfs_unstable;
-      services.zfs = {
+{
+  boot = {
+    supportedFilesystems = [ "zfs" ];
+    zfs = {
+      forceImportRoot = false;
+      package = pkgs.zfs_unstable;
+      devNodes = "/dev/disk/by-id";
+    };
+  };
+
+  services.zfs = {
     autoScrub.enable = true;
     autoSnapshot.enable = true;
     trim.enable = true;
   };
 
-#systemd.services.zfs-import-cache.enable = true;
-systemd.services.zfs-mount.enable = true;
-boot.zfs.devNodes = "/dev/disk/by-id";
- }
+  #systemd.services.zfs-import-cache.enable = true;
+  systemd.services.zfs-mount.enable = true;
+}

modules/tailscale/enable-service.nix

@@ -1,5 +1,5 @@
-{ ... }:
+_:
 
 {
-    services.tailscale.enable = true;
-}
+  services.tailscale.enable = true;
+}

modules/tailscale/exit-node.nix

@@ -1,12 +1,27 @@
-{ ... }:
+_:
 
 {
-  services.tailscale = {
-    enable = true;
+  imports = [ ./enable-service.nix ];
 
-    extraUpFlags = [
+  services.tailscale = {
+    # Enables the sysctl forwarding settings exit nodes/subnet routers need;
+    # without this, --advertise-exit-node has no effect.
+    useRoutingFeatures = "server";
+
+    # Lets peers reach this node directly over the tailscale UDP port
+    # instead of relaying through DERP.
+    openFirewall = true;
+
+    # extraSetFlags (tailscale set, via the always-on tailscaled-set
+    # service), not extraUpFlags -- extraUpFlags is only ever applied by
+    # tailscaled-autoconnect, which itself only runs when
+    # services.tailscale.authKeyFile is set (nothing in this repo sets one,
+    # so tailscale up is a manual, one-time operator step on every host that
+    # uses this service). extraSetFlags has no such gate, so
+    # --advertise-exit-node self-reapplies on every boot once the operator
+    # has authenticated the node once.
+    extraSetFlags = [
       "--advertise-exit-node"
-      "--advertise-routes=192.168.2.0/24"
     ];
   };
 }

modules/tor/enable-relay.nix

@@ -0,0 +1,35 @@
+{ pkgs, vars, ... }:
+
+{
+  services.tor = {
+    enable = true;
+
+    # Opens settings.ORPort (and DirPort, unset here) in the firewall —
+    # see the nixpkgs tor module's own networking.firewall.mkIf block.
+    openFirewall = true;
+
+    relay = {
+      enable = true;
+      # Plain middle/guard relay, not "exit" — relays onion traffic between
+      # other Tor nodes without ever making requests to the public internet
+      # on a user's behalf, avoiding the abuse complaints and legal exposure
+      # an exit node invites.
+      role = "relay";
+    };
+
+    settings.ORPort = vars.ports.torRelayOrPort;
+
+    # Unix control socket at /run/tor/control (GroupWritable, group "tor")
+    # -- what nyx below actually monitors the relay through. Nyx's own
+    # default control-socket path (/var/run/tor/control) resolves to the
+    # same place, so no extra nyx config is needed.
+    controlSocket.enable = true;
+  };
+
+  # Lets the primary user's shell session read/write the control socket
+  # above without being root -- otherwise nyx fails to authenticate against
+  # it at all.
+  users.users.${vars.primaryUser}.extraGroups = [ "tor" ];
+
+  environment.systemPackages = [ pkgs.nyx ];
+}

modules/traefik/rotate-logs.nix

@@ -0,0 +1,20 @@
+{ vars, ... }:
+
+{
+  services.logrotate = {
+    enable = true;
+
+    settings = {
+      "${vars.nfsShares.dockerVolumes.mountpoint}/traefik-data/logs/*.log" = {
+        daily = true;
+        size = vars.traefikLogRotate.maxSize;
+        rotate = vars.traefikLogRotate.keep;
+        compress = true;
+        missingok = true;
+        notifempty = true;
+        copytruncate = true;
+      };
+
+    };
+  };
+}

prepare.sh

@@ -1,30 +0,0 @@
-#create MBR table
-parted /dev/sda -- mklabel msdos
-#create nixos partition
-parted /dev/sda -- mkpart primary 1MB -8GB
-#set nixos partition to bootable
-parted /dev/sda -- set 1 boot on
-# create swap partition
-parted /dev/sda -- mkpart primary linux-swap -8GB 100%
-
-#format OS partition
-mkfs.ext4 -L nixos /dev/sda1
-#format swap
-mkswap -L swap /dev/sda2
-
-#activate swap
-swapon /dev/sda2
-
-#mount nixos partition
-mount /dev/disk/by-label/nixos /mnt
-export TMPDIR=/mnt/install-tmp
-mkdir -p /mnt/install-tmp
-#Generate config
-#nixos-generate-config --root /mnt/
-
-#copy customised configuration over
-#cp configuration.nix /mnt/etc/nixos/configuration.nix
-
-#nixos-install --no-root-passwd
-
-#reboot

remove-sensetive-info-refactor.md

@@ -1,134 +0,0 @@
-# Spec: Remove Sensitive Information from NixOS Flake
-
-## Goal
-
-Every secret currently readable in plaintext anywhere in this repo (working tree *and* git history) gets removed, replaced with `sops-nix`-managed encrypted references, and rotated. When this is done, the repo should be safe to make public without exposing anything about the systems it configures.
-
-Treat this as three sequential milestones. Do not start git history rewriting (Milestone 3) until Milestones 1 and 2 are fully verified and the flake still builds. This should be its own branch (`refactor/secrets`) until fully verified, then merged.
-
----
-
-## Milestone 1 — Audit
-
-Before touching anything, produce a complete inventory. Do not guess at scope — grep the whole tree and the whole history.
-
-1. Run a secret scanner across the working tree and full history. Use both, since they catch different things:
-   - `gitleaks detect --source . -v --log-opts="--all"` (scans history too)
-   - `trufflehog git file://. --since-commit=$(git rev-list --max-parents=0 HEAD) --only-verified=false`
-   If neither is installed, add them via a temporary `nix-shell -p gitleaks trufflehog` — don't install anything globally on the host.
-
-2. Manually grep for the categories below, since scanners miss config-specific patterns:
-   - `hashedPassword`, `password`, `initialPassword`, `initialHashedPassword` in any `users.users.*` block
-   - `age.secrets`, `sops.secrets` (if any partial secrets work already exists — check for it)
-   - PSK / `preSharedKey`, `privateKeyFile` inline values (vs. file references) for WireGuard
-   - `authKey`, `apiToken`, `api_key`, `token =`, `secret =` in service modules (Tailscale, Cloudflare, backup tools, etc.)
-   - SSH private key material: search for `BEGIN OPENSSH PRIVATE KEY` / `BEGIN RSA PRIVATE KEY` literals
-   - TLS cert/key pairs committed under e.g. `secrets/`, `certs/`, `pki/`
-   - Real name, personal email, home address, or anything in comments/hostnames that maps a machine to your physical identity or network layout (e.g. hostnames like `wayne-desktop`, static LAN IPs, ISP-identifying info)
-   - `.env` files, `secrets.nix`, `secrets.yaml`, or any file that looks like it was meant to be gitignored but wasn't
-
-3. Produce `secrets-inventory.md` (temporary, delete before finishing) listing: file path, line, secret type, and which host/service it belongs to. This becomes the checklist for Milestone 2 — every row must be either migrated to sops or deleted, with nothing left unaccounted for.
-
----
-
-## Milestone 2 — Migrate to sops-nix
-
-### 2.1 Set up sops-nix
-
-1. Add the flake input:
-   ```nix
-   sops-nix.url = "github:Mic92/sops-nix";
-   sops-nix.inputs.nixpkgs.follows = "nixpkgs";
-   ```
-2. Import `sops-nix.nixosModules.sops` into each host's module list (or into a shared `common.nix` if all hosts use it).
-3. Generate an age keypair **per host** (not one shared key for everything — a compromised host shouldn't decrypt every other host's secrets):
-   ```
-   nix-shell -p age --run "age-keygen -o /var/lib/sops-nix/key.txt"
-   ```
-   Print the public key (`age-keygen -y`) for each host — you'll need it for `.sops.yaml`.
-4. Also generate one age key for yourself (your admin workstation) so you can edit secrets without needing to SSH into a host: store it at `~/.config/sops/age/keys.txt`, back it up somewhere outside this repo (password manager, offline). **If this key is lost, every secret encrypted with it is unrecoverable — losing the age key is equivalent to losing the secrets.**
-5. Create `.sops.yaml` at the repo root defining creation rules: which age public keys can decrypt which secrets files, keyed by path regex, so e.g. `secrets/hostA.yaml` is decryptable by your admin key + hostA's key, `secrets/hostB.yaml` by your admin key + hostB's key.
-
-### 2.2 Migrate each secret category from the inventory
-
-For each row in `secrets-inventory.md`:
-
-- **Password hashes**: generate hash with `mkpasswd -m sha-512` (or `bcrypt` if your setup wants that), store under `sops.secrets."<name>/hashedPassword"`, reference via `users.users.<name>.hashedPasswordFile = config.sops.secrets."<name>/hashedPassword".path;`. Do not put the *plaintext* password anywhere, only the hash, and only the hash goes into the encrypted sops file.
-- **API tokens / auth keys**: move the raw value into the per-host sops YAML, reference in the module via `config.sops.secrets."<service>/token".path` — most NixOS service modules that take a token also accept a `*File` variant (e.g. `environmentFile`, `tokenFile`); use that instead of passing the value directly.
-- **Private keys / certs**: move the PEM/key content wholesale into a sops secret, output as a file with appropriate `sops.secrets.<name>.path`, `owner`, `mode`, `restartUnits` so the depending service (sshd, wireguard, nginx) reloads when the secret changes.
-- **Personal/identifying info**: this doesn't belong in sops (it's not "secret," it's just information you don't want public). Replace real names/emails with placeholders or move to a small untracked `local.nix` that's `.gitignore`'d and imported conditionally, with a documented template (`local.nix.example`) committed instead.
-
-### 2.3 Verify before moving on
-
-- `nixos-rebuild dry-build --flake .#<host>` succeeds for every host.
-- `sudo nixos-rebuild switch --flake .#<host>` on at least one real machine (or a VM) confirms secrets decrypt and services start.
-- Confirm decrypted secrets land under `/run/secrets/` (not the Nix store — anything placed in `/nix/store` is world-readable by design, so sops-nix's runtime-only placement is the whole point; double check no module accidentally pulls a secret path into a store-built config file).
-- Re-run the grep/scanner sweep from Milestone 1 against the *working tree only* (not history yet) — it should now come back clean.
-
----
-
-## Milestone 3 — Scrub git history
-
-Do this only after Milestone 2 is merged to your main branch and confirmed working, since it rewrites every commit SHA from the point of the earliest offending commit onward.
-
-**This is destructive and irreversible on your local clone. Back up first:**
-```
-cp -r /path/to/nixos-repo /path/to/nixos-repo-backup-$(date +%F)
-```
-
-1. Install `git-filter-repo` (not the older `git filter-branch` / BFG — filter-repo is the currently maintained, faster, safer tool):
-   ```
-   nix-shell -p git-filter-repo
-   ```
-2. Use the `secrets-inventory.md` list to build a list of literal strings/paths to strip. Two approaches, use both:
-   - Path-based: if whole files were secret (e.g. `secrets.nix`, a `.env`, a private key file), remove them entirely from history:
-     ```
-     git filter-repo --path secrets.nix --path .env --invert-paths
-     ```
-   - Value-based: for secrets embedded inline in files you're keeping (not deleting the whole file), use `--replace-text` with a file listing each literal secret string to replace with `***REMOVED***`:
-     ```
-     git filter-repo --replace-text expressions.txt
-     ```
-3. After filtering, verify: run the Milestone 1 scanners again against full history (`--log-opts="--all"`). They must come back clean.
-4. Force-push the rewritten history:
-   ```
-   git push origin --force --all
-   git push origin --force --tags
-   ```
-5. **Every other clone of this repo (other machines, WSL instances, CI) must be deleted and re-cloned fresh** — a `git pull` against rewritten history will not work cleanly and risks resurrecting the old commits. Don't try to reconcile old clones; throw them away and re-clone.
-6. If this repo has ever been pushed to a public host (GitHub, etc.) or a fork/mirror exists, treat every secret that was ever in history as **permanently compromised regardless of the rewrite** — caches, forks, and Wayback-style archives can retain old commits indefinitely. History scrubbing prevents *future* exposure via `git clone`; it does not undo past exposure.
-
----
-
-## Milestone 4 — Rotate everything
-
-Because the secrets were exposed in history (even briefly, even in a private repo), the migration is not complete until every credential in the inventory has been **rotated**, not just re-encrypted. Re-encrypting an already-leaked value protects it going forward but doesn't undo the leak.
-
-For each row in the original inventory:
-- Password hashes → change the actual account password, regenerate the hash, update the sops file.
-- API tokens/auth keys → revoke the old token in the issuing service's dashboard (Cloudflare, Tailscale, backup provider, etc.) and generate a new one.
-- SSH/WireGuard private keys → generate new keypairs, update the corresponding public key wherever it's trusted (authorized_keys, peer configs, etc.), retire the old ones.
-- TLS certs → reissue if the private key was exposed.
-
-Keep `secrets-inventory.md` open during this step and check off each row as rotated. Delete the file only once every row is checked off — it should not be committed.
-
----
-
-## Ongoing prevention
-
-Add a pre-commit hook (or a `nix flake check` step) running `gitleaks protect --staged` so a secret can't be committed again by accident. Document in the repo README (briefly) that new secrets go through `sops <file>` to edit, never as plaintext in a tracked file.
-
----
-
-## Definition of done
-
-- [ ] Milestone 1 inventory complete and reviewed
-- [ ] All hosts have per-host age keys; admin key backed up outside the repo
-- [ ] Every inventoried secret migrated to sops-nix, referenced via `*File`/`sops.secrets.*.path`, nothing plaintext in the working tree
-- [ ] `nixos-rebuild dry-build` and at least one real `switch` verified per host
-- [ ] Working-tree scanner sweep clean
-- [ ] History rewritten with `git-filter-repo`, force-pushed, full-history scanner sweep clean
-- [ ] All other clones deleted and re-cloned from the rewritten history
-- [ ] Every credential in the original inventory rotated (not just re-encrypted)
-- [ ] Pre-commit secret scanning hook added
-- [ ] `secrets-inventory.md` deleted from the working directory (never committed)

scripts/bump-nixpkgs-release.sh

@@ -0,0 +1,133 @@
+#!/usr/bin/env bash
+# Bumps the NixOS release branch this flake tracks — flake.nix's
+# `nixpkgs.url` and `home-manager.url` — in one place, via targeted
+# substitution of just those two lines. Deliberately does NOT touch any
+# `system.stateVersion` anywhere in the repo: per NixOS's own docs, that
+# value must stay fixed at whatever it was on a host's first install (it
+# pins on-disk data-format defaults, not "which nixpkgs release am I on"),
+# so it's never something a channel bump should follow.
+#
+# scripts/codex-maintenance.sh's own `nixos-25.11` pin (used only to fetch
+# nixpkgs-fmt/statix — see CLAUDE.md) is a separate, independently-versioned
+# reference on purpose: it doesn't have to track the flake's own nixpkgs
+# input, since the tooling just needs to build, not match. Bump it with
+# --tooling if you want it moved too; the default run leaves it alone.
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "$0")/.." && pwd)"
+flake_nix="${repo_root}/flake.nix"
+maintenance_sh="${repo_root}/scripts/codex-maintenance.sh"
+claude_md="${repo_root}/CLAUDE.md"
+
+usage() {
+  cat <<EOF
+Usage: $0 <release> [--tooling <release>]
+
+  <release>            New NixOS release for flake.nix's nixpkgs.url and
+                        home-manager.url, e.g. 26.11
+  --tooling <release>  Also bump scripts/codex-maintenance.sh's separate
+                        nixpkgs-fmt/statix pin (and its mention in
+                        CLAUDE.md) to this release. Independent of the
+                        first argument — pass the same value if you want
+                        both in sync, a different one if you don't.
+
+Examples:
+  $0 26.11
+  $0 26.11 --tooling 26.11
+EOF
+}
+
+release_re='^[0-9]{2}\.(05|11)$'
+
+if [[ $# -eq 0 || "$1" == "-h" || "$1" == "--help" ]]; then
+  usage
+  exit 0
+fi
+
+new_release="$1"
+shift
+
+tooling_release=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+  --tooling)
+    tooling_release="${2:?--tooling requires a release argument}"
+    shift 2
+    ;;
+  *)
+    echo "Unknown argument: $1" >&2
+    usage >&2
+    exit 1
+    ;;
+  esac
+done
+
+check_release_format() {
+  local release="$1"
+  if [[ ! "$release" =~ $release_re ]]; then
+    echo "ERROR: '$release' doesn't look like a NixOS release (expected e.g. 26.11)" >&2
+    exit 1
+  fi
+}
+
+check_branch_exists() {
+  local repo_url="$1" branch="$2"
+  echo "Checking '$branch' exists on $repo_url..."
+  if ! git ls-remote --exit-code --heads "$repo_url" "$branch" >/dev/null; then
+    echo "ERROR: branch '$branch' not found on $repo_url. Typo, or not cut yet?" >&2
+    exit 1
+  fi
+}
+
+check_release_format "$new_release"
+
+current_release="$(grep -oE 'nixos-[0-9]{2}\.[0-9]{2}' "$flake_nix" | head -1 | sed 's/^nixos-//')"
+if [[ -z "$current_release" ]]; then
+  echo "ERROR: couldn't find flake.nix's current nixpkgs release" >&2
+  exit 1
+fi
+
+if [[ "$current_release" == "$new_release" ]]; then
+  echo "flake.nix is already on $new_release."
+else
+  echo "Bumping flake.nix's nixpkgs/home-manager release: $current_release -> $new_release"
+  check_branch_exists "https://github.com/NixOS/nixpkgs.git" "nixos-$new_release"
+  check_branch_exists "https://github.com/nix-community/home-manager.git" "release-$new_release"
+
+  sed -i \
+    -e "s|github:NixOS/nixpkgs/nixos-${current_release}|github:NixOS/nixpkgs/nixos-${new_release}|" \
+    -e "s|github:nix-community/home-manager/release-${current_release}|github:nix-community/home-manager/release-${new_release}|" \
+    "$flake_nix"
+
+  echo "Updated:"
+  grep -n "nixos-${new_release}\|release-${new_release}" "$flake_nix"
+fi
+
+if [[ -n "$tooling_release" ]]; then
+  check_release_format "$tooling_release"
+
+  current_tooling_release="$(grep -oE 'nixos-[0-9]{2}\.[0-9]{2}' "$maintenance_sh" | head -1 | sed 's/^nixos-//')"
+
+  if [[ "$current_tooling_release" == "$tooling_release" ]]; then
+    echo "codex-maintenance.sh's tooling pin is already on $tooling_release."
+  else
+    echo "Bumping codex-maintenance.sh's nixpkgs-fmt/statix pin: $current_tooling_release -> $tooling_release"
+    check_branch_exists "https://github.com/NixOS/nixpkgs.git" "nixos-$tooling_release"
+
+    sed -i "s|github:NixOS/nixpkgs/nixos-${current_tooling_release}|github:NixOS/nixpkgs/nixos-${tooling_release}|g" \
+      "$maintenance_sh"
+    sed -i "s|nixos-${current_tooling_release}|nixos-${tooling_release}|g" \
+      "$claude_md"
+
+    echo "Updated:"
+    grep -n "nixos-${tooling_release}" "$maintenance_sh" "$claude_md"
+  fi
+fi
+
+echo
+echo "flake.lock still points at the old input revisions until refreshed. Either:"
+echo "  nix flake update nixpkgs home-manager   # just these two inputs"
+echo "  nix flake update                        # everything — see docs/flake-lock-automation.md"
+echo
+echo "Then run 'bash scripts/codex-maintenance.sh dry-run' before committing —"
+echo "a channel bump can shift option defaults across every host."

scripts/codex-maintenance.sh

@@ -1,22 +1,14 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-export NIX_CONFIG="${NIX_CONFIG:-}
-experimental-features = nix-command flakes
-accept-flake-config = false
-warn-dirty = false
-"
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/nix-bootstrap.sh
+source "${script_dir}/lib/nix-bootstrap.sh"
+# shellcheck source=lib/nix-eval.sh
+source "${script_dir}/lib/nix-eval.sh"
 
 MODE="${1:-validate}"
 
-ensure_nix_profile() {
-  if [ -f /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh ]; then
-    . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-  elif [ -f "$HOME/.nix-profile/etc/profile.d/nix.sh" ]; then
-    . "$HOME/.nix-profile/etc/profile.d/nix.sh"
-  fi
-}
-
 ensure_nix_profile
 
 if ! command -v nix >/dev/null 2>&1; then
@@ -24,8 +16,7 @@ if ! command -v nix >/dev/null 2>&1; then
   exit 127
 fi
 
-hosts_json="$(nix eval --json --no-use-registries --no-accept-flake-config .#nixosConfigurations --apply builtins.attrNames)"
-hosts="$(echo "$hosts_json" | jq -r '.[]')"
+hosts="$(list_flake_targets .)"
 
 echo "Hosts:"
 echo "$hosts"
@@ -44,17 +35,41 @@ fi
 
 echo
 echo "Checking Nix formatting with nixpkgs-fmt..."
-nix run --no-use-registries --no-accept-flake-config github:NixOS/nixpkgs/nixos-25.11#nixpkgs-fmt -- --check .
+nix run "${NIX_EVAL_FLAGS[@]}" github:NixOS/nixpkgs/nixos-25.11#nixpkgs-fmt -- --check .
 
 echo
 echo "Running statix lint..."
-nix run --no-use-registries --no-accept-flake-config github:NixOS/nixpkgs/nixos-25.11#statix -- check .
+nix run "${NIX_EVAL_FLAGS[@]}" github:NixOS/nixpkgs/nixos-25.11#statix -- check .
 
 echo
 echo "Evaluating host toplevel derivations..."
 for host in $hosts; do
   echo "==> $host"
-  nix eval --raw --no-use-registries --no-accept-flake-config ".#nixosConfigurations.${host}.config.system.build.toplevel.drvPath"
+  nix eval --raw "${NIX_EVAL_FLAGS[@]}" ".#nixosConfigurations.${host}.config.system.build.toplevel.drvPath"
+
+  # lxc-* hosts deploy via a directly pct-restore-able tarball instead of
+  # nixos-install (see docs/auto-installer.md); proxmox-* hosts can
+  # alternatively be built as a standalone disk image (see
+  # docs/proxmox-images.md). Both are otherwise-unvalidated buildable
+  # surface, easy to silently break without this.
+  case "$host" in
+    lxc-*)
+      echo "==> $host (tarball)"
+      nix eval --raw "${NIX_EVAL_FLAGS[@]}" ".#nixosConfigurations.${host}.config.system.build.tarball.drvPath"
+      ;;
+    proxmox-*)
+      echo "==> $host (diskoImagesScript)"
+      nix eval --raw "${NIX_EVAL_FLAGS[@]}" ".#nixosConfigurations.${host}.config.system.build.diskoImagesScript.drvPath"
+      ;;
+  esac
+done
+
+echo
+echo "Evaluating buildable packages..."
+packages="$(nix eval --json "${NIX_EVAL_FLAGS[@]}" .#packages.x86_64-linux --apply builtins.attrNames | jq -r '.[]')"
+for pkg in $packages; do
+  echo "==> packages.x86_64-linux.${pkg}"
+  nix eval --raw "${NIX_EVAL_FLAGS[@]}" ".#packages.x86_64-linux.${pkg}"
 done
 
 if [[ "$MODE" == "dry-run" ]]; then
@@ -62,7 +77,25 @@ if [[ "$MODE" == "dry-run" ]]; then
   echo "Running dry-run builds for all hosts. This will not create result symlinks."
   for host in $hosts; do
     echo "==> Dry-run build: $host"
-    nix build --dry-run --no-link --no-use-registries --no-accept-flake-config ".#nixosConfigurations.${host}.config.system.build.toplevel"
+    nix build --dry-run --no-link "${NIX_EVAL_FLAGS[@]}" ".#nixosConfigurations.${host}.config.system.build.toplevel"
+
+    case "$host" in
+      lxc-*)
+        echo "==> Dry-run build: $host (tarball)"
+        nix build --dry-run --no-link "${NIX_EVAL_FLAGS[@]}" ".#nixosConfigurations.${host}.config.system.build.tarball"
+        ;;
+      proxmox-*)
+        echo "==> Dry-run build: $host (diskoImagesScript)"
+        nix build --dry-run --no-link "${NIX_EVAL_FLAGS[@]}" ".#nixosConfigurations.${host}.config.system.build.diskoImagesScript"
+        ;;
+    esac
+  done
+
+  echo
+  echo "Running dry-run builds for all packages."
+  for pkg in $packages; do
+    echo "==> Dry-run build: packages.x86_64-linux.${pkg}"
+    nix build --dry-run --no-link "${NIX_EVAL_FLAGS[@]}" ".#packages.x86_64-linux.${pkg}"
   done
 fi
 

scripts/codex-setup.sh

@@ -1,19 +1,11 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-export NIX_CONFIG="${NIX_CONFIG:-}
-experimental-features = nix-command flakes
-accept-flake-config = false
-warn-dirty = false
-"
-
-ensure_nix_profile() {
-  if [ -f /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh ]; then
-    . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-  elif [ -f "$HOME/.nix-profile/etc/profile.d/nix.sh" ]; then
-    . "$HOME/.nix-profile/etc/profile.d/nix.sh"
-  fi
-}
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/nix-bootstrap.sh
+source "${script_dir}/lib/nix-bootstrap.sh"
+# shellcheck source=lib/nix-eval.sh
+source "${script_dir}/lib/nix-eval.sh"
 
 install_nix_if_missing() {
   if command -v nix >/dev/null 2>&1; then
@@ -49,6 +41,17 @@ warn-dirty = false
 build-users-group = nixbld
 EOF
 
+    # The official installer's single-user root path still shells out to
+    # `sudo` to create /nix even though it already knows it's running as
+    # root -- confirmed live against a sudo-less minimal Debian/Proxmox
+    # node, where it fails with "sudo: not found" and prints this exact
+    # mkdir/chown as the manual fix. Pre-create it so that branch of the
+    # installer is skipped entirely.
+    if [ ! -d /nix ]; then
+      mkdir -m 0755 /nix
+      chown root /nix
+    fi
+
     sh <(curl -L https://nixos.org/nix/install) --no-daemon
   else
     sh <(curl -L https://nixos.org/nix/install) --no-daemon
@@ -79,13 +82,13 @@ if ! command -v jq >/dev/null 2>&1; then
 fi
 
 echo "Available NixOS hosts:"
-hosts="$(nix eval --json --no-use-registries --no-accept-flake-config .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]')"
+hosts="$(list_flake_targets .)"
 echo "$hosts"
 
 echo "Evaluating all host toplevel derivations..."
 for host in $hosts; do
   echo "==> Evaluating $host"
-  nix eval --raw --no-use-registries --no-accept-flake-config ".#nixosConfigurations.${host}.config.system.build.toplevel.drvPath"
+  nix eval --raw "${NIX_EVAL_FLAGS[@]}" ".#nixosConfigurations.${host}.config.system.build.toplevel.drvPath"
 done
 
 echo "Codex setup complete."

scripts/create-linode-installer-disk.sh

@@ -1,9 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-#boot to rescue mode
-# set root password
-scp $RESULT_ISO root@$LINODE_IP:/tmp/nixos-auto.iso
-
-#in LISH or ssh to rescue mode
-dd if=/tmp/nixos.iso of=/dev/sda bs=4M status=progress conv=fsync

scripts/env.sh

@@ -0,0 +1,164 @@
+#!/usr/bin/env bash
+# Shared config for scripts/*.sh. Source this instead of hardcoding a
+# second copy of these values in every script:
+#   source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/env.sh"
+# Every variable can still be overridden per-invocation via the
+# environment (e.g. PROXMOX_STORAGE=tank-nvme ./scripts/proxmox/create-proxmox-resource.sh ...)
+# since each one only sets a default if unset.
+
+# SSH-reachable Proxmox node that scripts/proxmox/create-proxmox-resource.sh runs
+# pct/qm on. Matches the Proxmox web UI hostname already used in
+# hosts/nixos/home.nix's desktop shortcuts (pve.<homeDomain> from
+# variables.nix) -- change this if that's not actually reachable over SSH,
+# or if you're targeting a different node in a multi-node cluster.
+: "${PROXMOX_HOST:=pve.sweet.home}"
+: "${PROXMOX_SSH_USER:=root}"
+
+# Where this flake repo lives on the Proxmox node itself.
+# scripts/proxmox/create-proxmox-resource.sh builds images directly on the node
+# instead of transferring them over the network -- it clones the repo here
+# (from this checkout's own `origin` remote) the first time it doesn't
+# find it, installing build tooling via scripts/codex-setup.sh, then
+# `git pull`s it before every subsequent build.
+: "${PROXMOX_REMOTE_REPO_DIR:=/root/nixos}"
+
+# Storage pool names -- Proxmox's own stock-install defaults, but this
+# varies a lot by setup (ZFS pool name, custom LVM-thin volume, etc.).
+# Verify with `pvesm status` on the node and correct these if wrong.
+: "${PROXMOX_STORAGE:=local-lvm}"     # VM disks / CT rootfs
+: "${PROXMOX_ISO_STORAGE:=local}"     # uploaded images/ISOs/CT templates
+
+: "${PROXMOX_BRIDGE:=vmbr0}"
+
+# Fallback resource sizing when a script doesn't get --cores/--memory.
+: "${PROXMOX_DEFAULT_CORES:=2}"
+: "${PROXMOX_DEFAULT_MEMORY_MB:=2048}"
+
+# `pct create` (unlike `pct restore`) requires an explicit rootfs size --
+# no backup metadata to infer it from. Matches Proxmox's own GUI default.
+: "${PROXMOX_DEFAULT_LXC_DISK_GB:=8}"
+
+# `pct create --memory` only sets RAM -- swap is a wholly separate
+# parameter that otherwise silently stays at Proxmox's own 512M default
+# regardless of --memory (confirmed: creating with --memory 2048 left
+# swap at 512). create-proxmox-resource.sh defaults --swap to whatever
+# --memory resolves to at runtime rather than a static value here, so it
+# tracks a --memory picked at the CLI too, not just the default above.
+
+# Required for a modern (v247+) systemd guest to actually boot as an
+# unprivileged container: systemd's routine use of nested user namespaces
+# and credential mounts (LoadCredential=, DynamicUser=, etc. -- used even
+# by plain getty units) gets denied by AppArmor's default LXC confinement
+# without these. Confirmed live: without them, every getty unit
+# crash-loops on a denied `/run/credentials/*` mount every ~3s (visible
+# as garbage on the console) and core services like nsncd fail the same
+# way on userns_create; system.build.tarball never finishes activating.
+#
+# mount=nfs;nfs4: without it, AppArmor blanket-denies the `nfs`/
+# `rpc_pipefs` mount syscalls any NFS client share needs -- confirmed
+# live on lxc-docker (which mounts several, see modules/docker/mount-data.nix
+# and modules/raspi/mount-data.nix): `mount: /var/lib/nfs/rpc_pipefs:
+# permission denied`. Harmless to grant on lxc targets that don't mount
+# NFS at all -- it only widens what the container is *allowed* to mount,
+# nothing here forces a mount to happen.
+: "${PROXMOX_DEFAULT_LXC_FEATURES:=nesting=1,keyctl=1,mount=nfs;nfs4}"
+
+export PROXMOX_HOST PROXMOX_SSH_USER PROXMOX_STORAGE PROXMOX_ISO_STORAGE \
+  PROXMOX_BRIDGE PROXMOX_DEFAULT_CORES PROXMOX_DEFAULT_MEMORY_MB \
+  PROXMOX_DEFAULT_LXC_DISK_GB PROXMOX_DEFAULT_LXC_FEATURES \
+  PROXMOX_REMOTE_REPO_DIR
+
+# Matches variables.nix's nixCacheHost -- update both if it ever changes.
+: "${NIX_CACHE_HOST:=nix-cache}"
+export NIX_CACHE_HOST
+
+# nix_extra_opts: call as a plain statement (NOT inside $(...)/<(...) --
+# that forks a subshell, and the whole point is exporting a decision back
+# into *this* shell) to populate the global NIX_OPTS array with whatever
+# extra `nix`/`nix-shell` CLI options are needed to avoid nix-cache when
+# it's unreachable:
+#   nix_extra_opts
+#   nix build "${NIX_OPTS[@]}" ...
+#
+# Without this, every single `nix eval`/`nix build` call retries each
+# store path against a dead substituter up to 5 times with backoff
+# (confirmed: ~15s+ per lookup even with a short connect-timeout, because
+# nix's own retry count isn't controllable that way), and separately
+# tries it as a remote builder too -- both fail independently, so both
+# are checked.
+#
+# Checked with a single fast `curl`/TCP probe (bypassing nix's retry logic
+# entirely) the first time this is called in a given process, and the
+# result is exported as NIX_EXTRA_OPTS so a script that shells out to
+# another script in this repo (e.g. create-proxmox-resource.sh calling
+# sync-host-keys.sh) reuses the same decision instead of probing twice.
+declare -a NIX_OPTS=()
+
+nix_extra_opts() {
+  if [[ -n "${NIX_EXTRA_OPTS_DECIDED:-}" ]]; then
+    if [[ -n "${NIX_EXTRA_OPTS:-}" ]]; then
+      eval "NIX_OPTS=(${NIX_EXTRA_OPTS})"
+    else
+      NIX_OPTS=()
+    fi
+    return
+  fi
+  export NIX_EXTRA_OPTS_DECIDED=1
+  NIX_OPTS=()
+
+  # Retry a couple of times, 1s apart, before believing either check --
+  # belt-and-suspenders against a genuine multi-second blip (nix-cache
+  # restarting), on top of the fix below. Worst case (~11s total, host
+  # genuinely gone) is still nowhere near the 15s+ *per lookup* nix's own
+  # substituter retries would cost if this check didn't exist at all.
+  local attempt cache_up=0 builder_up=0
+  for attempt in 1 2 3; do
+    if curl --silent --fail --max-time 3 "http://${NIX_CACHE_HOST}/nix-cache-info" >/dev/null 2>&1; then
+      cache_up=1
+      break
+    fi
+    [[ "$attempt" -lt 3 ]] && sleep 1
+  done
+
+  if [[ "$cache_up" -eq 0 ]]; then
+    echo "nix-cache (http://${NIX_CACHE_HOST}) is unreachable -- skipping it (substituter + remote builder) for the rest of this run." >&2
+    NIX_OPTS=(--option substituters "https://cache.nixos.org/" --builders "")
+  else
+    for attempt in 1 2 3; do
+      # `exec 3<>/dev/tcp/...` just opens the fd and returns -- it does NOT
+      # read from it. Confirmed live this is load-bearing, not stylistic:
+      # the previous `cat < /dev/tcp/.../22` blocked forever and always hit
+      # the timeout even against a perfectly healthy nix-cache, because
+      # sshd sends its banner and then holds the connection open waiting
+      # for the client to speak next -- `cat` never sees EOF, so this
+      # check reported "unreachable" unconditionally, 100% of the time,
+      # regardless of whether the remote builder was actually up.
+      if timeout 3 bash -c "exec 3<>/dev/tcp/${NIX_CACHE_HOST}/22" 2>/dev/null; then
+        builder_up=1
+        break
+      fi
+      [[ "$attempt" -lt 3 ]] && sleep 1
+    done
+    if [[ "$builder_up" -eq 0 ]]; then
+      echo "nix-cache's SSH remote builder (nixremote@${NIX_CACHE_HOST}:22) is unreachable -- disabling remote builds for the rest of this run." >&2
+      NIX_OPTS=(--builders "")
+    fi
+  fi
+
+  # `printf '%q '` with a genuinely empty NIX_OPTS still runs one format
+  # pass over a missing argument and yields the literal `'' ` rather than
+  # an empty string (confirmed live) -- a subprocess that later does
+  # `eval "NIX_OPTS=(${NIX_EXTRA_OPTS})"` (the branch above, for e.g.
+  # sync-host-keys.sh reusing this process's decision) would then rebuild
+  # a 1-element array holding an empty string instead of a 0-element
+  # array, and `nix-shell "${NIX_OPTS[@]}" -p <pkg>` chokes on that stray
+  # element as a bogus positional argument. Guard the empty case
+  # explicitly so nix-cache being reachable (NIX_OPTS legitimately empty)
+  # round-trips as truly empty instead.
+  if [[ ${#NIX_OPTS[@]} -gt 0 ]]; then
+    printf -v NIX_EXTRA_OPTS '%q ' "${NIX_OPTS[@]}"
+  else
+    NIX_EXTRA_OPTS=""
+  fi
+  export NIX_EXTRA_OPTS
+}

scripts/lib/confirm.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Shared "type X to confirm" prompt for scripts/proxmox/create-proxmox-resource.sh
+# (--modify, and replacing an existing --allow-duplicate-host resource) and
+# scripts/secrets/sync-host-keys.sh (--regenerate-all-keys) -- three destructive
+# confirmations that all work the same way (echo the expected value back
+# exactly), kept in one place so the prompt/comparison logic can't drift.
+# Source alongside env.sh:
+#   source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/confirm.sh"
+#
+# Deliberately does NOT print anything on mismatch or decide exit-vs-return
+# -- callers vary on both (a top-level script exits, a subcommand function
+# returns; wording differs too), so that stays at the call site.
+
+# confirm_typed <expected> <prompt>
+# Prints <prompt> via `read -rp`, then reports (via exit status) whether the
+# typed input matched <expected> exactly.
+confirm_typed() {
+  local expected="$1" prompt="$2" input
+  read -rp "$prompt" input
+  [[ "$input" == "$expected" ]]
+}

scripts/lib/nix-bootstrap.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Shared Nix bootstrap for scripts/codex-setup.sh and
+# scripts/codex-maintenance.sh: the nix.conf settings both need in effect
+# before a single `nix` command runs (flakes enabled, never honor a flake
+# input's own nixConfig, no "dirty tree" warning spam), plus a helper to
+# pull an already-installed Nix's daemon/profile script onto PATH if it
+# isn't there yet. Source this instead of copying it -- see CLAUDE.md.
+export NIX_CONFIG="${NIX_CONFIG:-}
+experimental-features = nix-command flakes
+accept-flake-config = false
+warn-dirty = false
+"
+
+ensure_nix_profile() {
+  if [ -f /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh ]; then
+    . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+  elif [ -f "$HOME/.nix-profile/etc/profile.d/nix.sh" ]; then
+    . "$HOME/.nix-profile/etc/profile.d/nix.sh"
+  fi
+}

scripts/lib/nix-eval.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Shared flake-introspection helpers for scripts/*.sh. Source alongside
+# env.sh:
+#   source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/nix-eval.sh"
+#
+# NIX_EVAL_FLAGS: --no-use-registries so a call here never resolves through
+# the user's global flake registry (every call targets this repo's own
+# flake, or an explicit github: ref, not a registry alias); --no-accept-flake-config
+# so a flake input's own nixConfig (e.g. a dependency's substituters) is
+# never honored -- matches accept-flake-config = false already set repo-wide
+# (see lib/nix-bootstrap.sh / CLAUDE.md). Reuse this array rather than
+# retyping the two flags at each call site.
+declare -a NIX_EVAL_FLAGS=(--no-use-registries --no-accept-flake-config)
+
+# list_flake_targets <flake_ref>
+# Prints the attribute names under <flake_ref>#nixosConfigurations, one per
+# line, e.g.:
+#   list_flake_targets .            # from inside the repo
+#   list_flake_targets "$repo_root" # from anywhere
+list_flake_targets() {
+  local flake_ref="$1"
+  nix eval --json "${NIX_EVAL_FLAGS[@]}" \
+    "${flake_ref}#nixosConfigurations" --apply builtins.attrNames \
+  | jq -r '.[]'
+}
+
+# flake_target_hostname <flake_ref> <target>
+# Prints one nixosConfigurations target's config.networking.hostName.
+# Empty (not an error under set -e) if the target doesn't exist or the
+# eval otherwise fails -- callers that need to distinguish "empty" from
+# "eval failed" should check $? themselves instead of relying on this.
+flake_target_hostname() {
+  local flake_ref="$1" target="$2"
+  nix eval --raw "${NIX_EVAL_FLAGS[@]}" \
+    "${flake_ref}#nixosConfigurations.${target}.config.networking.hostName" 2>/dev/null
+}

scripts/lib/sops-age.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# Shared sops/age helpers for scripts/secrets/backup-admin-key.sh,
+# scripts/secrets/rotate-admin-key.sh, and scripts/secrets/sync-host-keys.sh -- all three
+# derive an age public key from a private identity file the same way, two
+# of them resolve the same sops/age default key-file path, and two of them
+# run `sops updatekeys` the same way. Kept in one place so they can't drift
+# apart. Source alongside env.sh:
+#   source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/sops-age.sh"
+#
+# Uses NIX_OPTS (an array of extra `nix-shell` options -- see env.sh's
+# nix_extra_opts) if the caller has already set it, same convention as
+# lib/ssh-host-keys.sh. Falls back to no extra options if the caller never
+# sourced env.sh.
+if ! declare -p NIX_OPTS >/dev/null 2>&1; then
+  declare -a NIX_OPTS=()
+fi
+
+# sops/age's own default identity-file resolution order, minus $SOPS_AGE_KEY
+# itself (an inline identity, not a path -- callers that accept it check it
+# separately, before falling back to this).
+: "${DEFAULT_SOPS_AGE_KEY_FILE:=${SOPS_AGE_KEY_FILE:-${XDG_CONFIG_HOME:-$HOME/.config}/sops/age/keys.txt}}"
+
+# age_pubkey_from_identity_file <identity-file>
+# Prints the age public key for a private identity file (age-keygen -y).
+age_pubkey_from_identity_file() {
+  local identity_file="$1"
+  nix-shell "${NIX_OPTS[@]}" -p age --run "age-keygen -y '${identity_file}'"
+}
+
+# sops_yaml_admin_pubkey <sops-yaml-path>
+# Prints .sops.yaml's current &admin age public key, or empty (not an error
+# under set -e) if no such anchor line exists -- callers that need to treat
+# "missing" as fatal check for an empty result themselves.
+sops_yaml_admin_pubkey() {
+  local sops_yaml="$1"
+  grep -E '^  - &admin age1' "$sops_yaml" 2>/dev/null | awk '{print $NF}' || true
+}
+
+# sops_updatekeys <secrets-file> [key-file]
+# Re-encrypts <secrets-file> for .sops.yaml's current recipient set. If
+# <key-file> is given, decrypts with that identity (SOPS_AGE_KEY_FILE)
+# instead of whatever's ambient -- needed when the ambient default key
+# doesn't match yet (e.g. mid-rotation, decrypting with the outgoing key).
+sops_updatekeys() {
+  local secrets_file="$1" key_file="${2:-}"
+  if [[ -n "$key_file" ]]; then
+    SOPS_AGE_KEY_FILE="$key_file" nix-shell "${NIX_OPTS[@]}" -p sops --run \
+      "sops updatekeys --yes '${secrets_file}'"
+  else
+    nix-shell "${NIX_OPTS[@]}" -p sops --run "sops updatekeys --yes '${secrets_file}'"
+  fi
+}

scripts/lib/ssh-host-keys.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Shared SSH-host-key / age-conversion helpers for scripts/secrets/sync-host-keys.sh
+# and scripts/secrets/prepare-host-key.sh -- both generate the same kind of key
+# (ed25519, no passphrase, the sops-nix age-derivation input) and convert it
+# to an age recipient the same way; kept in one place so the two can't
+# drift apart.
+#
+# Uses NIX_OPTS (an array of extra `nix-shell` options -- see env.sh's
+# nix_extra_opts) if the caller has already set it, so a decision to avoid
+# an unreachable nix-cache is reused here instead of probed again. Falls
+# back to no extra options if the caller never sourced env.sh.
+if ! declare -p NIX_OPTS >/dev/null 2>&1; then
+  declare -a NIX_OPTS=()
+fi
+
+# generate_host_ed25519_key <hostname> <keyfile>
+# Writes <keyfile> and <keyfile>.pub. Caller is responsible for refusing to
+# overwrite an existing keyfile -- this always runs ssh-keygen fresh.
+generate_host_ed25519_key() {
+  local hostname="$1" keyfile="$2"
+  nix-shell "${NIX_OPTS[@]}" -p openssh --run \
+    "ssh-keygen -t ed25519 -N '' -C '${hostname}' -f '${keyfile}'" >/dev/null
+}
+
+# ssh_pubkey_to_age <pubkeyfile>
+# Prints the age public key derived from an ed25519 SSH public key file.
+ssh_pubkey_to_age() {
+  local pubkeyfile="$1"
+  nix-shell "${NIX_OPTS[@]}" -p ssh-to-age --run "ssh-to-age -i '${pubkeyfile}'"
+}

scripts/lib/sync-host-keys-edit-sops.py

@@ -0,0 +1,180 @@
+#!/usr/bin/env python3
+# Companion to scripts/sync-host-keys.sh. Applies a set of additive edits
+# to .sops.yaml via targeted line insertion -- not a full YAML parse and
+# re-serialize -- so every untouched byte of the file is guaranteed to stay
+# exactly as it was (a full round-trip through a generic YAML library was
+# tested and silently reformatted the whole file's indentation style).
+#
+# Reads a JSON edit plan from stdin:
+#   {
+#     "add_keys": [{"host": "lxc-server", "age_key": "age1..."}],
+#     "add_aliases": [{"host": "lxc-server", "basename": "common.yaml"}],
+#     "remove_keys": ["lxc-server"],
+#     "remove_aliases_for_hosts": ["lxc-server"]
+#   }
+# Idempotent: an anchor or alias that's already present/absent is left
+# alone -- adding what's already there, or removing what's already gone,
+# is a no-op rather than an error.
+# Prints a JSON summary of what actually changed to stdout, so the caller
+# knows which secrets/*.yaml files need `sops updatekeys` and which don't.
+import json
+import re
+import sys
+
+KEY_LINE_RE = re.compile(r"^  - &\S+ age1")
+
+
+def add_keys(lines, add_keys):
+    existing_anchors = set()
+    for line in lines:
+        m = re.match(r"^  - &(\S+) age1", line)
+        if m:
+            existing_anchors.add(m.group(1))
+
+    new = [e for e in add_keys if e["host"] not in existing_anchors]
+    if not new:
+        return lines, []
+
+    last_idx = None
+    for i, line in enumerate(lines):
+        if KEY_LINE_RE.match(line):
+            last_idx = i
+    if last_idx is None:
+        print("ERROR: no '  - &<name> age1...' line found under keys: in .sops.yaml", file=sys.stderr)
+        sys.exit(1)
+
+    insert = [f"  - &{e['host']} {e['age_key']}\n" for e in new]
+    lines = lines[: last_idx + 1] + insert + lines[last_idx + 1 :]
+    return lines, [e["host"] for e in new]
+
+
+def add_aliases(lines, add_aliases):
+    changed_files = []
+    for e in add_aliases:
+        host = e["host"]
+        basename = e["basename"]
+        target = "path_regex: secrets/" + basename.replace(".", r"\.") + "$"
+
+        rule_start = None
+        for i, line in enumerate(lines):
+            if target in line:
+                rule_start = i
+                break
+        if rule_start is None:
+            print(
+                f"WARNING: no creation_rule for secrets/{basename} in .sops.yaml "
+                f"(needed by {host}) -- add one manually, then re-run.",
+                file=sys.stderr,
+            )
+            continue
+
+        rule_end = len(lines)
+        for i in range(rule_start + 1, len(lines)):
+            if re.match(r"^  - path_regex:", lines[i]):
+                rule_end = i
+                break
+
+        block = lines[rule_start:rule_end]
+        if any(re.search(r"\*" + re.escape(host) + r"\s*$", line) for line in block):
+            continue  # already present
+
+        last_alias_idx = None
+        last_alias_indent = None
+        for i in range(rule_start, rule_end):
+            m = re.match(r"^(\s*)- \*\S+\s*$", lines[i])
+            if m:
+                last_alias_idx = i
+                last_alias_indent = m.group(1)
+        if last_alias_idx is None:
+            print(
+                f"WARNING: creation_rule for secrets/{basename} has no existing "
+                f"'- *alias' line to anchor the insertion point -- add {host} manually.",
+                file=sys.stderr,
+            )
+            continue
+
+        new_line = f"{last_alias_indent}- *{host}\n"
+        lines = lines[: last_alias_idx + 1] + [new_line] + lines[last_alias_idx + 1 :]
+        changed_files.append(basename)
+    return lines, changed_files
+
+
+def remove_keys(lines, hosts):
+    hosts = set(hosts)
+    removed = []
+    kept = []
+    for line in lines:
+        m = re.match(r"^  - &(\S+) age1", line)
+        if m and m.group(1) in hosts:
+            removed.append(m.group(1))
+            continue
+        kept.append(line)
+    return kept, removed
+
+
+def remove_aliases_for_hosts(lines, hosts):
+    hosts = set(hosts)
+    if not hosts:
+        return lines, []
+
+    changed_files = []
+    result = []
+    current_basename = None
+    current_block_changed = False
+
+    def flush():
+        if current_block_changed and current_basename:
+            changed_files.append(current_basename)
+
+    for line in lines:
+        if re.match(r"^  - path_regex:", line):
+            flush()
+            current_block_changed = False
+            m = re.search(r"path_regex: secrets/(.+)\$", line)
+            current_basename = m.group(1).replace(r"\.", ".") if m else None
+            result.append(line)
+            continue
+
+        if current_basename is not None and any(
+            re.search(r"\*" + re.escape(h) + r"\s*$", line) for h in hosts
+        ):
+            current_block_changed = True
+            continue  # drop this alias line
+
+        result.append(line)
+
+    flush()
+    return result, changed_files
+
+
+def main():
+    sops_path = sys.argv[1]
+    edits = json.load(sys.stdin)
+
+    with open(sops_path) as f:
+        lines = f.readlines()
+
+    lines, added_keys = add_keys(lines, edits.get("add_keys", []))
+    lines, added_alias_files = add_aliases(lines, edits.get("add_aliases", []))
+    lines, removed_keys = remove_keys(lines, edits.get("remove_keys", []))
+    lines, removed_alias_files = remove_aliases_for_hosts(
+        lines, edits.get("remove_aliases_for_hosts", [])
+    )
+
+    with open(sops_path, "w") as f:
+        f.writelines(lines)
+
+    changed_files = sorted(set(added_alias_files) | set(removed_alias_files))
+    json.dump(
+        {
+            "added_keys": added_keys,
+            "removed_keys": removed_keys,
+            "changed_secrets_files": changed_files,
+        },
+        sys.stdout,
+    )
+    print()
+
+
+if __name__ == "__main__":
+    main()

scripts/proxmox/configure-nix-cache-client.sh

@@ -0,0 +1,172 @@
+#!/usr/bin/env bash
+# Points a non-NixOS Debian machine's Nix install at nix-cache: adds it as
+# a substituter (with cache.nixos.org kept as fallback) and, once the
+# remote-builder private key is installed, as a distributed-build machine
+# too.
+#
+# This is the non-NixOS equivalent of modules/nix-cache/client.nix +
+# modules/nix-cache/remote-builder-client.nix -- those two only apply to
+# hosts built from this flake. A plain Debian box with Nix installed
+# (single- or multi-user install, nix-daemon running) has no NixOS module
+# system to pick that config up, so this edits /etc/nix/nix.conf by hand
+# instead. Run this ON the target Debian machine, as root.
+#
+# The values below mirror variables.nix / modules/nix-cache/client.nix in
+# this repo -- update both if nix-cache is ever rebuilt with a new host
+# key or the cache signing key is rotated (see docs/nix-cache.md).
+#
+# Usage:
+#   sudo ./configure-nix-cache-client.sh [--dry-run] [--no-remote-builder] [--no-restart]
+#
+# Env overrides (defaults match variables.nix):
+#   NIX_CACHE_HOST, NIX_CACHE_HOST_KEY, REMOTE_BUILDER_USER, REMOTE_BUILDER_KEY
+
+set -euo pipefail
+
+: "${NIX_CACHE_HOST:=nix-cache}"
+: "${NIX_CACHE_HOST_KEY:=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHrMKZlIGUd3pH9G3AqbsruqUGjxIXMAZw52u9MwiBCn lxc-nix-cache}"
+: "${REMOTE_BUILDER_USER:=nixremote}"
+: "${REMOTE_BUILDER_KEY:=/root/.ssh/nixremote}"
+
+CACHE_PUB_KEY="cache.local-1:usoWYanY3Kpq2+kDIS2nhWoLZiRxanmdysdzqCFBHW4="
+FALLBACK_URL="https://cache.nixos.org/"
+FALLBACK_PUB_KEY="cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+
+NIX_CONF="/etc/nix/nix.conf"
+KNOWN_HOSTS="/etc/ssh/ssh_known_hosts"
+MARKER_BEGIN="# BEGIN nix-cache client config (configure-nix-cache-client.sh)"
+MARKER_END="# END nix-cache client config"
+
+dry_run=0
+with_remote_builder=1
+restart_daemon=1
+
+for arg in "$@"; do
+  case "$arg" in
+    --dry-run) dry_run=1 ;;
+    --no-remote-builder) with_remote_builder=0 ;;
+    --no-restart) restart_daemon=0 ;;
+    -h|--help)
+      sed -n '2,20p' "$0"
+      exit 0
+      ;;
+    *)
+      echo "ERROR: unknown argument: $arg" >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [[ "$dry_run" -eq 0 && "$EUID" -ne 0 ]]; then
+  echo "ERROR: must run as root (writes $NIX_CONF and, unless --no-remote-builder, $KNOWN_HOSTS)." >&2
+  exit 1
+fi
+
+if ! command -v nix >/dev/null 2>&1; then
+  echo "ERROR: no 'nix' binary on PATH -- install the Nix package manager first." >&2
+  exit 1
+fi
+
+if [[ ! -f "$NIX_CONF" ]]; then
+  echo "ERROR: $NIX_CONF not found -- expected an existing multi-user Nix install." >&2
+  exit 1
+fi
+
+builder_line=""
+if [[ "$with_remote_builder" -eq 1 ]]; then
+  if [[ -f "$REMOTE_BUILDER_KEY" ]]; then
+    case "$(uname -m)" in
+      x86_64) nix_system="x86_64-linux" ;;
+      aarch64) nix_system="aarch64-linux" ;;
+      *)
+        echo "WARNING: unrecognized architecture '$(uname -m)' -- skipping remote builder, keeping substituter config." >&2
+        with_remote_builder=0
+        ;;
+    esac
+    if [[ "$with_remote_builder" -eq 1 ]]; then
+      builder_line="builders = ssh://${REMOTE_BUILDER_USER}@${NIX_CACHE_HOST} ${nix_system} ${REMOTE_BUILDER_KEY} 4 2 big-parallel,kvm,nixos-test,benchmark"
+    fi
+  else
+    echo "WARNING: $REMOTE_BUILDER_KEY not found -- skipping remote builder config (substituter still configured)." >&2
+    echo "  See docs/nix-cache.md 'Remote builder SSH keys' for how to install it, then re-run this script." >&2
+    with_remote_builder=0
+  fi
+fi
+
+block="$(cat <<EOF
+$MARKER_BEGIN
+extra-substituters = http://${NIX_CACHE_HOST} ${FALLBACK_URL}
+extra-trusted-public-keys = ${CACHE_PUB_KEY} ${FALLBACK_PUB_KEY}
+EOF
+)"
+if [[ "$with_remote_builder" -eq 1 ]]; then
+  block="${block}
+builders-use-substitutes = true
+${builder_line}"
+fi
+block="${block}
+$MARKER_END"
+
+echo "== nix.conf block to install =="
+echo "$block"
+echo "================================"
+
+if [[ "$dry_run" -eq 1 ]]; then
+  echo "(--dry-run: not writing $NIX_CONF)"
+else
+  tmp_conf="$(mktemp)"
+  trap 'rm -f "$tmp_conf"' EXIT
+
+  if grep -qF "$MARKER_BEGIN" "$NIX_CONF"; then
+    awk -v begin="$MARKER_BEGIN" -v end="$MARKER_END" -v block="$block" '
+      $0 == begin { print block; skip = 1; next }
+      $0 == end   { skip = 0; next }
+      skip        { next }
+      { print }
+    ' "$NIX_CONF" > "$tmp_conf"
+  else
+    cp "$NIX_CONF" "$tmp_conf"
+    printf '\n%s\n' "$block" >> "$tmp_conf"
+  fi
+
+  cp "$NIX_CONF" "${NIX_CONF}.bak.$(date +%Y%m%d%H%M%S)"
+  install -m 0644 "$tmp_conf" "$NIX_CONF"
+  echo "Updated $NIX_CONF (backup saved alongside it)."
+fi
+
+if [[ "$with_remote_builder" -eq 1 ]]; then
+  known_hosts_line="${NIX_CACHE_HOST} ${NIX_CACHE_HOST_KEY}"
+  if [[ "$dry_run" -eq 1 ]]; then
+    echo "(--dry-run: would ensure this line is present in $KNOWN_HOSTS)"
+    echo "  $known_hosts_line"
+  else
+    mkdir -p "$(dirname "$KNOWN_HOSTS")"
+    touch "$KNOWN_HOSTS"
+    if ! grep -qF "$known_hosts_line" "$KNOWN_HOSTS" 2>/dev/null; then
+      echo "$known_hosts_line" >> "$KNOWN_HOSTS"
+      echo "Added nix-cache's SSH host key to $KNOWN_HOSTS."
+    fi
+  fi
+fi
+
+if [[ "$dry_run" -eq 0 && "$restart_daemon" -eq 1 ]]; then
+  if command -v systemctl >/dev/null 2>&1 && systemctl is-active --quiet nix-daemon 2>/dev/null; then
+    systemctl restart nix-daemon
+    echo "Restarted nix-daemon to pick up the new config."
+  else
+    echo "nix-daemon not managed by systemd (or not running) -- restart it manually to pick up the new config."
+  fi
+fi
+
+cat <<EOF
+
+Done. Verify with:
+  curl http://${NIX_CACHE_HOST}/nix-cache-info
+  nix show-config | grep -E 'substituters|trusted-public-keys|builders'
+EOF
+if [[ "$with_remote_builder" -eq 1 ]]; then
+  cat <<EOF
+  ssh -i ${REMOTE_BUILDER_KEY} ${REMOTE_BUILDER_USER}@${NIX_CACHE_HOST} nix-store --version
+  nix build nixpkgs#hello -L
+EOF
+fi

scripts/proxmox/create-proxmox-resource.sh

@@ -0,0 +1,830 @@
+#!/usr/bin/env bash
+# Creates new Proxmox VMs/LXC containers from this flake, and reconfigures
+# existing ones -- the manual workflows in docs/proxmox-images.md (VM) and
+# docs/auto-installer.md's "LXC hosts" section (container), automated.
+#
+# Images are built directly on the Proxmox node (PROXMOX_REMOTE_REPO_DIR /
+# --remote-repo-dir in scripts/env.sh), not on whatever machine runs this
+# script -- there's no multi-gigabyte image to transfer afterward. The first
+# time a node doesn't have that repo path yet, it's bootstrapped: cloned from
+# this checkout's own `origin` remote, then scripts/codex-setup.sh installs
+# the build tooling (Nix, etc.). Every run after that just `git pull`s it and
+# copies over the locally-managed host-keys/ (gitignored, so a git pull
+# alone wouldn't carry it) before building.
+#
+# Usage:
+#   scripts/proxmox/create-proxmox-resource.sh --type lxc|vm --host <name> [options]
+#   scripts/proxmox/create-proxmox-resource.sh --type lxc|vm --list
+#   scripts/proxmox/create-proxmox-resource.sh --modify --vmid <n> [--cores N] [--memory MB] [--grow-disk GB]
+#
+# SAFETY:
+#   - The default (create) mode only ever creates a NEW resource -- it
+#     refuses to run if the target VMID already exists on the node, or if
+#     a VM/CT identified as --host already exists under any other VMID
+#     (checked live against the node; --allow-duplicate-host overrides).
+#   - --allow-duplicate-host distinguishes an exact match (same --type
+#     *and* --host, e.g. re-running --type lxc --host docker while an
+#     lxc-docker container already exists -- almost always a redeploy of
+#     the same target to pick up a rebuilt image) from a cross-type match
+#     (a different platform sharing the same host identity, e.g. a
+#     proxmox-docker VM coexisting with lxc-docker). Only the exact match
+#     is destroyed and replaced, after typing the hostname back to
+#     confirm (outside --dry-run) -- a cross-type match is always left
+#     untouched, matching-or-not.
+#   - --modify only ever touches a resource you name explicitly via
+#     --vmid, shows exactly what will change first, and (outside
+#     --dry-run) always requires typing that VMID back to confirm before
+#     anything is sent to the node. There is no bulk/implicit modify.
+#   - Outside of --allow-duplicate-host's exact-match replace above,
+#     neither mode can start/stop/delete a resource.
+#
+# See --help for the full option list.
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "$0")/../.." && pwd)"
+# shellcheck source=../env.sh
+source "${repo_root}/scripts/env.sh"
+# shellcheck source=../lib/nix-eval.sh
+source "${repo_root}/scripts/lib/nix-eval.sh"
+# shellcheck source=../lib/confirm.sh
+source "${repo_root}/scripts/lib/confirm.sh"
+
+sync_keys="${repo_root}/scripts/secrets/sync-host-keys.sh"
+
+usage() {
+  cat <<EOF
+Usage: $0 --type lxc|vm --host <name> [options]      (create)
+       $0 --type lxc|vm --list                        (list --host values)
+       $0 --modify --vmid <n> [options]                (reconfigure)
+
+Create mode (default):
+  --type lxc|vm        lxc = container, built as a CT template tarball.
+                        vm  = VM, built as a Disko .raw disk image (UEFI/OVMF).
+  --host <name>         Which host identity to deploy -- matches
+                        config.networking.hostName (server, docker,
+                        nix-cache, nixos, pxe-boot, nix-minimal). Use
+                        --list to see what's available for --type.
+  --name <name>          Proxmox display name/hostname (default: --host's
+                          value, e.g. nix-cache -- for lxc this becomes the
+                          guest's real networking.hostName too, since
+                          proxmoxLXC.manageHostName pulls it from Proxmox's
+                          own container config, so it must match host.nix
+                          regardless of build type)
+  --vmid <n>              Numeric VMID (default: next free, via
+                          \`pvesh get /cluster/nextid\` on the node).
+                          Refuses to run if this ID already exists.
+  --disk-size <GB>           lxc only: rootfs size for \`pct create\`
+                              (default: \$PROXMOX_DEFAULT_LXC_DISK_GB, ${PROXMOX_DEFAULT_LXC_DISK_GB}).
+  --image <path>              Use this local image/tarball (uploaded to the
+                              node via scp) instead of checking the node /
+                              building one there from the flake.
+  --force-rebuild                Skip the "does the node already have this
+                                  image" check -- always build fresh and
+                                  overwrite what's there.
+  --remote-repo-dir <path>       Where this flake repo lives (or gets
+                                  cloned) on the node, and is built from
+                                  (default: \$PROXMOX_REMOTE_REPO_DIR, ${PROXMOX_REMOTE_REPO_DIR}).
+  --allow-duplicate-host        Required if a VM/CT identified as --host
+                                already exists on the node (checked live via
+                                qm/pct, not any file in this repo) --
+                                otherwise refused, since it'd share that
+                                host's hostName/hostId. An existing resource
+                                of this *same* --type (e.g. re-running --type
+                                lxc --host docker over an existing lxc-docker)
+                                is destroyed and replaced, after confirming --
+                                a different --type sharing the same --host
+                                (e.g. a proxmox-docker VM) is always left
+                                untouched.
+
+Modify mode (reconfigure an EXISTING resource -- requires --modify):
+  --modify                Switch to modify mode.
+  --vmid <n>                Required: which existing resource to change.
+                            Type/VM-vs-CT is auto-detected on the node.
+  --grow-disk <GB>            Grow the primary disk by this many GB
+                              (qm/pct resize; Proxmox only supports
+                              growing, never shrinking, an existing disk).
+  At least one of --cores / --memory / --grow-disk is required. Always
+  prints the current -> new values and requires typing the VMID back to
+  confirm, even outside --dry-run.
+
+Shared:
+  --cores <n>              create: default \$PROXMOX_DEFAULT_CORES (${PROXMOX_DEFAULT_CORES}).
+                            modify: omit to leave unchanged.
+  --memory <MB>              create: default \$PROXMOX_DEFAULT_MEMORY_MB (${PROXMOX_DEFAULT_MEMORY_MB}).
+                              modify: omit to leave unchanged.
+  --swap <MB>                 lxc only, create time: \`--memory\` doesn't
+                              touch swap -- it silently stays at Proxmox's
+                              own 512M default otherwise. (default: matches
+                              whatever --memory resolves to)
+  --storage <pool>              (default: \$PROXMOX_STORAGE, ${PROXMOX_STORAGE})
+  --iso-storage <pool>            (default: \$PROXMOX_ISO_STORAGE, ${PROXMOX_ISO_STORAGE})
+  --bridge <bridge>                (default: \$PROXMOX_BRIDGE, ${PROXMOX_BRIDGE})
+  --node <host>                     Proxmox node to SSH into (default:
+                                    \$PROXMOX_HOST, ${PROXMOX_HOST})
+  --dry-run                           Print the full plan; touch nothing
+                                      local or remote, no prompts.
+  -h, --help
+
+Config for --storage/--bridge/--node/etc. lives in scripts/env.sh -- edit
+that instead of passing the same flag every time.
+EOF
+}
+
+dry_run=0
+modify=0
+type=""
+host=""
+name=""
+vmid=""
+cores=""
+memory=""
+swap=""
+disk_size=""
+grow_disk=""
+image=""
+storage="$PROXMOX_STORAGE"
+iso_storage="$PROXMOX_ISO_STORAGE"
+bridge="$PROXMOX_BRIDGE"
+node="$PROXMOX_HOST"
+remote_repo_dir="$PROXMOX_REMOTE_REPO_DIR"
+do_list=0
+allow_duplicate_host=0
+force_rebuild=0
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+  --type) type="$2"; shift 2 ;;
+  --host) host="$2"; shift 2 ;;
+  --name) name="$2"; shift 2 ;;
+  --vmid) vmid="$2"; shift 2 ;;
+  --cores) cores="$2"; shift 2 ;;
+  --memory) memory="$2"; shift 2 ;;
+  --swap) swap="$2"; shift 2 ;;
+  --disk-size) disk_size="$2"; shift 2 ;;
+  --grow-disk) grow_disk="$2"; shift 2 ;;
+  --image) image="$2"; shift 2 ;;
+  --storage) storage="$2"; shift 2 ;;
+  --iso-storage) iso_storage="$2"; shift 2 ;;
+  --bridge) bridge="$2"; shift 2 ;;
+  --node) node="$2"; shift 2 ;;
+  --remote-repo-dir) remote_repo_dir="$2"; shift 2 ;;
+  --list) do_list=1; shift ;;
+  --allow-duplicate-host) allow_duplicate_host=1; shift ;;
+  --force-rebuild) force_rebuild=1; shift ;;
+  --modify) modify=1; shift ;;
+  --dry-run) dry_run=1; shift ;;
+  -h | --help) usage; exit 0 ;;
+  *) echo "Unknown option: $1" >&2; usage >&2; exit 1 ;;
+  esac
+done
+
+ssh_target="${PROXMOX_SSH_USER}@${node}"
+
+remote() {
+  if [[ "$dry_run" -eq 1 ]]; then
+    echo "[dry-run] ssh ${ssh_target} -- $*"
+  else
+    ssh "$ssh_target" "$@"
+  fi
+}
+
+# ============================================================ modify mode
+cmd_modify() {
+  if [[ -z "$vmid" ]]; then
+    echo "ERROR: --modify requires --vmid." >&2
+    exit 1
+  fi
+  if [[ -z "$cores" && -z "$memory" && -z "$grow_disk" ]]; then
+    echo "ERROR: --modify needs at least one of --cores / --memory / --grow-disk." >&2
+    exit 1
+  fi
+
+  echo "Looking up VMID ${vmid} on ${node}..."
+  local kind current_cores current_memory disk_key
+  if ssh "$ssh_target" "qm status ${vmid}" >/dev/null 2>&1; then
+    kind="vm"
+    disk_key="scsi0"
+  elif ssh "$ssh_target" "pct status ${vmid}" >/dev/null 2>&1; then
+    kind="lxc"
+    disk_key="rootfs"
+  else
+    echo "ERROR: VMID ${vmid} doesn't exist on ${node} -- nothing to modify." >&2
+    exit 1
+  fi
+
+  local config_cmd="qm config ${vmid}"
+  [[ "$kind" == "lxc" ]] && config_cmd="pct config ${vmid}"
+  local current_config
+  current_config="$(ssh "$ssh_target" "$config_cmd")"
+  current_cores="$(echo "$current_config" | grep -oP '^cores:\s*\K\S+' || echo '?')"
+  current_memory="$(echo "$current_config" | grep -oP '^memory:\s*\K\S+' || echo '?')"
+
+  echo
+  echo "VMID ${vmid} is a ${kind} on ${node}. Planned changes:"
+  [[ -n "$cores" ]] && echo "  cores:  ${current_cores} -> ${cores}"
+  [[ -n "$memory" ]] && echo "  memory: ${current_memory} MB -> ${memory} MB"
+  [[ -n "$grow_disk" ]] && echo "  ${disk_key}: grow by +${grow_disk}G (Proxmox can only grow, not shrink, an existing disk)"
+
+  if [[ "$dry_run" -eq 1 ]]; then
+    echo
+    echo "[dry-run] Nothing was changed."
+    return
+  fi
+
+  echo
+  if ! confirm_typed "$vmid" "Type the VMID (${vmid}) to confirm these changes: "; then
+    echo "Cancelled -- input didn't match ${vmid}."
+    exit 1
+  fi
+
+  local set_cmd="qm set"
+  local resize_cmd="qm resize"
+  [[ "$kind" == "lxc" ]] && set_cmd="pct set" && resize_cmd="pct resize"
+
+  if [[ -n "$cores" || -n "$memory" ]]; then
+    local args=""
+    [[ -n "$cores" ]] && args="${args} --cores ${cores}"
+    [[ -n "$memory" ]] && args="${args} --memory ${memory}"
+    remote "${set_cmd} ${vmid}${args}"
+  fi
+  if [[ -n "$grow_disk" ]]; then
+    remote "${resize_cmd} ${vmid} ${disk_key} +${grow_disk}G"
+  fi
+
+  echo
+  echo "Done. VMID ${vmid} updated."
+}
+
+if [[ "$modify" -eq 1 ]]; then
+  cmd_modify
+  exit 0
+fi
+
+# ============================================================= create mode
+if [[ "$type" != "lxc" && "$type" != "vm" ]]; then
+  echo "ERROR: --type must be 'lxc' or 'vm'." >&2
+  usage >&2
+  exit 1
+fi
+
+platform_prefix="lxc"
+[[ "$type" == "vm" ]] && platform_prefix="proxmox"
+[[ -z "$cores" ]] && cores="$PROXMOX_DEFAULT_CORES"
+[[ -z "$memory" ]] && memory="$PROXMOX_DEFAULT_MEMORY_MB"
+
+# --- discover / resolve the flake target from --host --------------------
+# Emits "<target>\t<hostName>" pairs for every ${platform_prefix}-* flake
+# target -- the one source both --list and the --host lookup below read
+# from, so they can never see a different set of targets from each other.
+targets_for_platform() {
+  local target
+  for target in $(list_flake_targets "$repo_root" 2>/dev/null | grep -- "^${platform_prefix}-"); do
+    printf '%s\t%s\n' "$target" "$(flake_target_hostname "$repo_root" "$target")"
+  done
+}
+
+list_hosts() {
+  local target hostname
+  while IFS=$'\t' read -r target hostname; do
+    printf '  %-12s -> %s\n' "$hostname" "$target"
+  done < <(targets_for_platform)
+}
+
+if [[ "$do_list" -eq 1 ]]; then
+  echo "Available --host values for --type ${type}:"
+  list_hosts
+  exit 0
+fi
+
+if [[ -z "$host" ]]; then
+  echo "ERROR: --host is required (or use --list to see options)." >&2
+  exit 1
+fi
+
+flake_target=""
+while IFS=$'\t' read -r target hostname; do
+  if [[ "$hostname" == "$host" ]]; then
+    flake_target="$target"
+    break
+  fi
+done < <(targets_for_platform)
+
+if [[ -z "$flake_target" ]]; then
+  echo "ERROR: no ${platform_prefix}-* target has hostName '${host}'." >&2
+  echo "Available:" >&2
+  list_hosts >&2
+  exit 1
+fi
+
+# The container/VM's real identity is --host (e.g. "nix-cache"), validated
+# above against config.networking.hostName -- not the flake target name
+# (e.g. "lxc-nix-cache"), which is build-type-specific and only exists to
+# pick which platform variant to build. Defaulting --name to the flake
+# target would make lxc's --hostname (which proxmoxLXC.manageHostName
+# feeds straight into the guest's real hostname) disagree with host.nix.
+[[ -z "$name" ]] && name="$host"
+
+# --- refuse to duplicate a host that's already live on the node ---------
+# Queries the node itself (qm/pct's own name/hostname config), not any
+# static list in this repo -- a file can't track whether a resource still
+# actually exists, and this used to be checked against variables.nix's
+# deployedTargets, which drifted stale (it kept naming a VM as "the real
+# deployment" well after that VM had been destroyed, blocking its own
+# redeploy) until that list was dropped in favour of this live check. This
+# only catches guests identified with the default --name (== --host, what
+# this script itself always uses unless --name is overridden) -- a guest
+# manually renamed on the node afterwards wouldn't match, but nothing here
+# creates guests that way.
+if [[ "$dry_run" -eq 1 ]]; then
+  echo
+  echo "[dry-run] would check ${node} for an existing VM/CT identified as '${host}'"
+  if [[ "$allow_duplicate_host" -eq 1 ]]; then
+    echo "[dry-run] --allow-duplicate-host: an existing ${type} named '${host}' would be" \
+      "destroyed and replaced; a different-type match would be left untouched"
+  fi
+else
+  echo
+  echo "==> Checking ${node} for an existing VM/CT identified as '${host}'..."
+  ssh_check_status=0
+  existing="$(ssh "$ssh_target" bash -s -- "$host" <<'REMOTE_SCRIPT'
+target="$1"
+for id in $(qm list 2>/dev/null | awk 'NR>1{print $1}'); do
+  n="$(qm config "$id" 2>/dev/null | grep -oP '^name:\s*\K\S+' || true)"
+  [[ "$n" == "$target" ]] && echo "vm ${id} ${n}"
+done
+for id in $(pct list 2>/dev/null | awk 'NR>1{print $1}'); do
+  n="$(pct config "$id" 2>/dev/null | grep -oP '^hostname:\s*\K\S+' || true)"
+  [[ "$n" == "$target" ]] && echo "lxc ${id} ${n}"
+done
+exit 0
+REMOTE_SCRIPT
+  )" || ssh_check_status=$?
+  if [[ "$ssh_check_status" -ne 0 ]]; then
+    echo "ERROR: couldn't reach ${node} (ssh exited ${ssh_check_status}) to check for an" >&2
+    echo "existing '${host}' resource -- refusing to guess. Fix connectivity and retry," >&2
+    echo "or pass --allow-duplicate-host if you're sure none exists (this skips the" >&2
+    echo "check entirely)." >&2
+    exit 1
+  fi
+
+  # Split into "exact" (same resource kind as --type -- i.e. literally this
+  # same host+platform combo already exists, almost always a redeploy of
+  # the same target to test a rebuilt image) vs "cross-type" (a different
+  # platform sharing this host identity, e.g. a stopped proxmox-docker VM
+  # coexisting with an lxc-docker container -- a deliberate, valid setup
+  # this script has never managed and still won't). Read via a herestring
+  # (not a pipe) so the appends below survive outside the loop.
+  this_kind="$type"
+  exact_matches=""
+  cross_matches=""
+  if [[ -n "$existing" ]]; then
+    while read -r kind id n; do
+      [[ -z "$kind" ]] && continue
+      if [[ "$kind" == "$this_kind" ]]; then
+        exact_matches+="${kind} ${id} ${n}"$'\n'
+      else
+        cross_matches+="${kind} ${id} ${n}"$'\n'
+      fi
+    done <<<"$existing"
+  fi
+
+  if [[ -n "$exact_matches" && "$allow_duplicate_host" -ne 1 ]]; then
+    echo "ERROR: '${host}' already exists on ${node} as this same resource type:" >&2
+    echo "$exact_matches" | while read -r kind id n; do
+      [[ -z "$kind" ]] && continue
+      echo "  - ${kind} VMID ${id} (${n})" >&2
+    done
+    echo "Refusing to create a second ${this_kind} sharing this identity. Pass" >&2
+    echo "--allow-duplicate-host to destroy it and create a fresh one in its place" >&2
+    echo "(after confirming), or use --modify to reconfigure the existing one instead." >&2
+    exit 1
+  fi
+
+  if [[ -n "$cross_matches" && "$allow_duplicate_host" -ne 1 ]]; then
+    echo "ERROR: '${host}' already exists on ${node} as a different resource type:" >&2
+    echo "$cross_matches" | while read -r kind id n; do
+      [[ -z "$kind" ]] && continue
+      echo "  - ${kind} VMID ${id} (${n})" >&2
+    done
+    echo "Refusing to create a second resource sharing this identity. Pass" >&2
+    echo "--allow-duplicate-host to create one anyway (it gets its own distinct" >&2
+    echo "sops key and VMID -- the existing resource above is left untouched)," >&2
+    echo "or use --modify to reconfigure the existing one instead." >&2
+    exit 1
+  fi
+
+  if [[ -n "$cross_matches" ]]; then
+    echo "--allow-duplicate-host: '${host}' also exists on ${node} as a different resource" \
+      "type -- leaving it untouched:"
+    echo "$cross_matches" | while read -r kind id n; do
+      [[ -z "$kind" ]] && continue
+      echo "  - ${kind} VMID ${id} (${n})"
+    done
+  fi
+
+  if [[ -n "$exact_matches" ]]; then
+    echo "--allow-duplicate-host: '${host}' already exists on ${node} as this same resource" \
+      "type -- it will be destroyed and replaced:"
+    echo "$exact_matches" | while read -r kind id n; do
+      [[ -z "$kind" ]] && continue
+      echo "  - ${kind} VMID ${id} (${n})"
+    done
+    echo
+    if ! confirm_typed "$host" "Type the hostname (${host}) to confirm destroying the above and replacing it: "; then
+      echo "Cancelled -- input didn't match ${host}." >&2
+      exit 1
+    fi
+    echo "$exact_matches" | while read -r kind id n; do
+      [[ -z "$kind" ]] && continue
+      echo "==> Destroying ${kind} VMID ${id} (${n})..."
+      if [[ "$kind" == "vm" ]]; then
+        # qm destroy has no --force to stop-then-destroy in one call (pct's
+        # does) -- stop explicitly first if it's running.
+        if ssh "$ssh_target" "qm status ${id}" 2>/dev/null | grep -q running; then
+          ssh "$ssh_target" "qm stop ${id}"
+        fi
+        ssh "$ssh_target" "qm destroy ${id} --purge 1"
+      else
+        ssh "$ssh_target" "pct destroy ${id} --force 1 --purge 1"
+      fi
+    done
+  fi
+fi
+
+echo "Target: ${flake_target} (host=${host}, type=${type}) -> Proxmox resource '${name}'"
+
+# Decide on nix-cache once, here -- this is the earliest point that needs
+# it (sync-host-keys.sh below needs nix-shell packages regardless of
+# whether an image ends up getting built later), and the decision is
+# exported so that subprocess -- and this script's own later build step,
+# if it gets there -- both reuse it instead of probing again.
+nix_extra_opts
+
+# --- make sure this target has a registered host key --------------------
+echo
+echo "==> Ensuring host key exists and is registered..."
+sync_args=("$flake_target")
+[[ "$dry_run" -eq 1 ]] && sync_args+=(--dry-run)
+bash "$sync_keys" "${sync_args[@]}"
+
+# --- VMID: pick one, and refuse to touch anything that already exists ---
+echo
+if [[ -z "$vmid" ]]; then
+  if [[ "$dry_run" -eq 1 ]]; then
+    vmid="<next-free-vmid>"
+    echo "[dry-run] would ask ${node} for the next free VMID (pvesh get /cluster/nextid)"
+  else
+    vmid="$(ssh "$ssh_target" "pvesh get /cluster/nextid" | tr -d '[:space:]')"
+    echo "Auto-assigned VMID: ${vmid}"
+  fi
+else
+  echo "Requested VMID: ${vmid}"
+fi
+
+if [[ "$dry_run" -eq 0 ]]; then
+  # qm/pct status exits non-zero (and prints "does not exist") for a free
+  # ID on that resource type -- but a VMID could exist as the OTHER
+  # resource type (e.g. requested a CT id that's actually a VM), so check
+  # both. Any success here means something is already using this ID --
+  # refuse to go anywhere near it. (Reconfiguring an existing resource is
+  # --modify's job, not this one's.)
+  if ssh "$ssh_target" "qm status ${vmid}" >/dev/null 2>&1 \
+    || ssh "$ssh_target" "pct status ${vmid}" >/dev/null 2>&1; then
+    echo "ERROR: VMID ${vmid} already exists on ${node}. Refusing to touch an" >&2
+    echo "existing resource here -- use --modify to reconfigure it, pick a" >&2
+    echo "different --vmid, or omit it to auto-assign." >&2
+    exit 1
+  fi
+fi
+
+# --- resolve the remote path -- fixed naming (not the nix store's own
+# derivation-hash-based filename), so a later run can check for it by name.
+# lxc uploads as a CT *template* (Proxmox's "vztmpl" content type, under
+# iso_storage) -- config.system.build.tarball is a plain rootfs tarball,
+# not a vzdump backup archive, so it's created with `pct create ... vztmpl`,
+# not restored with `pct restore` (that expects backup-archive metadata
+# this tarball doesn't have, and fails with "archive contains no
+# configuration file").
+remote_dir="/var/lib/vz/import"
+remote_filename="${flake_target}.raw"
+if [[ "$type" == "lxc" ]]; then
+  remote_dir="/var/lib/vz/template/cache"
+  remote_filename="${flake_target}.tar.xz"
+fi
+remote_path="${remote_dir}/${remote_filename}"
+
+# --- ensure the flake repo (+ tooling) exists on the node, and is current --
+# Bootstraps once (git clone from this checkout's own `origin`, then
+# scripts/codex-setup.sh installs Nix + friends) if ${remote_repo_dir}
+# doesn't exist yet on the node; otherwise just `git pull`s it, so the image
+# built there reflects what's actually committed and pushed. Only called
+# right before an actual remote build below -- reusing an image already on
+# the node, or an explicit --image, never touch the node's checkout at all.
+ensure_remote_repo() {
+  echo
+  echo "==> Ensuring ${remote_repo_dir} exists and is current on ${node}..."
+  if [[ "$dry_run" -eq 1 ]]; then
+    echo "[dry-run] would ensure ${remote_repo_dir} exists on ${node} (clone if missing, git pull if present), and would verify/bootstrap build tooling there (scripts/codex-setup.sh) if \`nix\` isn't already on PATH -- and if that bootstrap actually ran, would also configure ${node} as a nix-cache client (scripts/proxmox/configure-nix-cache-client.sh)"
+    return
+  fi
+
+  if ssh "$ssh_target" "test -d '${remote_repo_dir}/.git'"; then
+    echo "Repo present -- pulling latest..."
+    ssh "$ssh_target" "cd '${remote_repo_dir}' && git pull --ff-only"
+  else
+    local origin_url
+    origin_url="$(git -C "$repo_root" remote get-url origin 2>/dev/null || true)"
+    if [[ -z "$origin_url" ]]; then
+      echo "ERROR: ${remote_repo_dir} doesn't exist on ${node}, and this checkout has no" >&2
+      echo "'origin' remote to clone from. Set one (git remote add origin <url>) or create" >&2
+      echo "${remote_repo_dir} on ${node} yourself (e.g. git clone), then re-run." >&2
+      exit 1
+    fi
+    echo "Not present -- cloning from ${origin_url}..."
+    ssh "$ssh_target" "git clone '${origin_url}' '${remote_repo_dir}'"
+  fi
+
+  # Trivial check, run every time (not just right after a fresh clone) --
+  # confirmed live: a first bootstrap can clone the repo successfully and
+  # still leave the node without a working `nix` (e.g. the node had no
+  # `sudo`, which the Nix installer's root path depends on -- see the fix
+  # in scripts/codex-setup.sh), and a later run with the repo already
+  # present would otherwise never retry it. Sources
+  # scripts/lib/nix-bootstrap.sh's ensure_nix_profile first -- a
+  # single-user Nix install typically only gets sourced into login shells,
+  # and ssh's non-interactive command execution is neither, so a
+  # freshly-installed `nix` still wouldn't be on PATH here without it.
+  #
+  # Just `nix` today -- the only thing the remote build commands below
+  # actually invoke -- but a list (not a single hardcoded check) so a
+  # future remote step needing another tool can add itself here instead of
+  # growing a parallel check.
+  local remote_required_cmds=(nix)
+  local tooling_check_cmd="cd '${remote_repo_dir}' && . scripts/lib/nix-bootstrap.sh && ensure_nix_profile"
+  local cmd
+  for cmd in "${remote_required_cmds[@]}"; do
+    tooling_check_cmd="${tooling_check_cmd} && command -v ${cmd}"
+  done
+
+  if ssh "$ssh_target" "$tooling_check_cmd" >/dev/null 2>&1; then
+    echo "Build tooling already present on ${node}."
+  else
+    echo "==> Bootstrapping build tooling on ${node} (scripts/codex-setup.sh)..."
+    ssh "$ssh_target" "cd '${remote_repo_dir}' && bash scripts/codex-setup.sh"
+
+    # Only on this first-time bootstrap, not every run -- a node that
+    # already has tooling either already went through this once, or had
+    # it configured some other way, and re-running is harmless but
+    # pointless. Non-fatal: this only makes the node's own builds faster
+    # (substitute from nix-cache instead of building from source) and
+    # offloadable to it as a remote builder -- worth trying, not worth
+    # aborting the image build over if nix-cache happens to be down right
+    # now. Needs ensure_nix_profile first, same as the tooling_check_cmd
+    # above -- ssh's non-interactive command execution won't have picked
+    # up a freshly single-user-installed `nix` otherwise.
+    echo "==> Configuring ${node} as a nix-cache substituter/remote-builder client..."
+    if ! ssh "$ssh_target" "cd '${remote_repo_dir}' && . scripts/lib/nix-bootstrap.sh && ensure_nix_profile && bash scripts/proxmox/configure-nix-cache-client.sh"; then
+      echo "WARNING: configure-nix-cache-client.sh failed on ${node} -- continuing without it (${node} will build from source / against cache.nixos.org only)." >&2
+    fi
+  fi
+}
+
+# --- sync locally-managed host-keys/ to the node ---------------------------
+# Gitignored (see .gitignore), so `git pull` above never carries it -- both
+# build paths need it present as NIXOS_HOST_KEYS_DIR / --pre-format-files
+# input on the node itself now that the build runs there. scp (not rsync,
+# not already a dependency anywhere else in this repo) mirrors how this
+# script already transfers the --image case below.
+sync_remote_host_keys() {
+  echo
+  echo "==> Syncing host-keys/ to ${node}..."
+  if [[ "$dry_run" -eq 1 ]]; then
+    echo "[dry-run] would copy ${repo_root}/host-keys/ to ${ssh_target}:${remote_repo_dir}/host-keys/"
+    return
+  fi
+  ssh "$ssh_target" "mkdir -p '${remote_repo_dir}/host-keys'"
+  scp -pr "${repo_root}/host-keys/." "${ssh_target}:${remote_repo_dir}/host-keys/"
+}
+
+# --- build (or reuse an image already on the node) ------------------------
+echo
+local_image=""
+image_already_remote=0
+
+if [[ -n "$image" ]]; then
+  [[ -f "$image" ]] || { echo "ERROR: --image '${image}' not found." >&2; exit 1; }
+  local_image="$image"
+  echo "Using provided image: ${local_image}"
+elif [[ "$force_rebuild" -eq 1 ]]; then
+  echo "--force-rebuild: skipping the existing-image check on ${node}."
+else
+  echo "==> Checking whether ${node} already has ${remote_path}..."
+  if [[ "$dry_run" -eq 1 ]]; then
+    echo "[dry-run] would check: ssh ${ssh_target} -- test -f ${remote_path}"
+  elif ssh "$ssh_target" "test -f '${remote_path}'" 2>/dev/null; then
+    echo "Found it -- reusing, skipping build (use --force-rebuild to override)."
+    image_already_remote=1
+  else
+    echo "Not found -- will build."
+  fi
+fi
+
+if [[ "$image_already_remote" -eq 0 && -z "$local_image" ]]; then
+  ensure_remote_repo
+  sync_remote_host_keys
+
+  # Relayed into the remote build below exactly as decided by the local
+  # nix_extra_opts call earlier in this script -- that decision (whether
+  # nix-cache is reachable) is made once, locally, same as it always has
+  # been; only *where* the resulting "${NIX_OPTS[@]}" gets used as a `nix
+  # build` flag moves to the node. NIX_EXTRA_OPTS is already a %q-quoted
+  # string built for exactly this eval-based reconstruction (see env.sh).
+  nix_opts_display=""
+  if [[ ${#NIX_OPTS[@]} -gt 0 ]]; then
+    printf -v nix_opts_display '%q ' "${NIX_OPTS[@]}"
+    nix_opts_display=" ${nix_opts_display% }"
+  fi
+
+  if [[ "$type" == "lxc" ]]; then
+    if [[ "$dry_run" -eq 1 ]]; then
+      echo "[dry-run] would build on ${node}: NIXOS_HOST_KEYS_DIR=\$(pwd)/host-keys nix build --impure \\"
+      echo "[dry-run]   --no-use-registries --no-accept-flake-config${nix_opts_display} \\"
+      echo "[dry-run]   .#nixosConfigurations.${flake_target}.config.system.build.tarball"
+      echo "[dry-run] would stage the result at ${remote_path}"
+      local_image="<built-tarball>"
+    else
+      echo "==> Building LXC tarball for ${flake_target} on ${node}..."
+      # Built as a single already-%q-quoted command string, not separate ssh
+      # argv elements -- ssh joins remote command args with plain spaces and
+      # hands the result to the remote shell to re-split, which would
+      # otherwise scatter NIX_EXTRA_OPTS (itself several space-separated,
+      # %q-quoted tokens) across the wrong positional parameters below.
+      printf -v remote_cmd 'bash -s -- %q %q %q %q %q' \
+        "$remote_repo_dir" "$flake_target" "$remote_dir" "$remote_filename" "$NIX_EXTRA_OPTS"
+      ssh "$ssh_target" "$remote_cmd" <<'REMOTE_SCRIPT'
+set -euo pipefail
+repo_dir="$1"; target="$2"; dest_dir="$3"; dest_name="$4"; nix_extra_opts_str="$5"
+declare -a NIX_OPTS=()
+[[ -n "$nix_extra_opts_str" ]] && eval "NIX_OPTS=(${nix_extra_opts_str})"
+cd "$repo_dir"
+# A single-user Nix install only gets sourced into login shells; this ssh
+# session is neither, so `nix` wouldn't otherwise be on PATH here even
+# right after a successful install.
+. scripts/lib/nix-bootstrap.sh
+ensure_nix_profile
+NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build --impure \
+  --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \
+  ".#nixosConfigurations.${target}.config.system.build.tarball" \
+  --out-link "result-${target}"
+built="$(find "result-${target}/tarball" -maxdepth 1 -type f | head -1)"
+if [[ -z "$built" ]]; then
+  echo "ERROR: no tarball found under result-${target}/tarball after build." >&2
+  exit 1
+fi
+mkdir -p "$dest_dir"
+cp "$built" "${dest_dir}/${dest_name}"
+echo "Built and staged: ${dest_dir}/${dest_name}"
+REMOTE_SCRIPT
+      local_image="$remote_path"
+      echo "Built on ${node}: ${remote_path}"
+    fi
+  else
+    # PROXMOX_SSH_USER defaults to root (env.sh), which needs no sudo and
+    # can't assume it's even installed on a minimal node -- only shell out
+    # through sudo when actually running as a non-root SSH user.
+    sudo_prefix="sudo"
+    sudo_display="sudo "
+    if [[ "$PROXMOX_SSH_USER" == "root" ]]; then
+      sudo_prefix=""
+      sudo_display=""
+    fi
+    if [[ "$dry_run" -eq 1 ]]; then
+      echo "[dry-run] would build on ${node}: nix build --no-use-registries --no-accept-flake-config${nix_opts_display} \\"
+      echo "[dry-run]   .#nixosConfigurations.${flake_target}.config.system.build.diskoImagesScript"
+      echo "[dry-run] would run:   ${sudo_display}./result-${flake_target} \\"
+      echo "[dry-run]                --pre-format-files host-keys/${flake_target}_ssh_host_ed25519_key /etc/ssh/ssh_host_ed25519_key \\"
+      echo "[dry-run]                --pre-format-files host-keys/${flake_target}_ssh_host_ed25519_key.pub /etc/ssh/ssh_host_ed25519_key.pub \\"
+      echo "[dry-run]                --build-memory 2048"
+      echo "[dry-run] would stage the result at ${remote_path}"
+      local_image="<built-image>.raw"
+    else
+      echo "==> Building Disko image for ${flake_target} on ${node}..."
+      # See the LXC branch above for why this is one %q-quoted command
+      # string rather than separate ssh argv elements.
+      printf -v remote_cmd 'bash -s -- %q %q %q %q %q %q' \
+        "$remote_repo_dir" "$flake_target" "$remote_dir" "$remote_filename" "$NIX_EXTRA_OPTS" "$sudo_prefix"
+      ssh "$ssh_target" "$remote_cmd" <<'REMOTE_SCRIPT'
+set -euo pipefail
+repo_dir="$1"; target="$2"; dest_dir="$3"; dest_name="$4"; nix_extra_opts_str="$5"; sudo_prefix="$6"
+declare -a NIX_OPTS=()
+[[ -n "$nix_extra_opts_str" ]] && eval "NIX_OPTS=(${nix_extra_opts_str})"
+cd "$repo_dir"
+. scripts/lib/nix-bootstrap.sh
+ensure_nix_profile
+nix build --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \
+  ".#nixosConfigurations.${target}.config.system.build.diskoImagesScript" \
+  --out-link "result-${target}"
+$sudo_prefix "./result-${target}" \
+  --pre-format-files "host-keys/${target}_ssh_host_ed25519_key" /etc/ssh/ssh_host_ed25519_key \
+  --pre-format-files "host-keys/${target}_ssh_host_ed25519_key.pub" /etc/ssh/ssh_host_ed25519_key.pub \
+  --build-memory 2048
+built="$(find . -maxdepth 1 -name '*.raw' -newer "result-${target}" | head -1)"
+if [[ -z "$built" ]]; then
+  echo "ERROR: no .raw image found in ${repo_dir} after build." >&2
+  exit 1
+fi
+mkdir -p "$dest_dir"
+mv "$built" "${dest_dir}/${dest_name}"
+echo "Built and staged: ${dest_dir}/${dest_name}"
+REMOTE_SCRIPT
+      local_image="$remote_path"
+      echo "Built on ${node}: ${remote_path}"
+    fi
+  fi
+fi
+
+# --- upload -- only for an explicit --image; a build above stages its
+# result directly at ${remote_path} on the node already, and reusing an
+# image already on the node needs nothing transferred either. ------------
+echo
+if [[ -n "$image" ]]; then
+  if [[ "$dry_run" -eq 1 ]]; then
+    echo "[dry-run] would upload: scp ${local_image} ${ssh_target}:${remote_path}"
+  else
+    echo "==> Uploading to ${node}:${remote_path}..."
+    ssh "$ssh_target" "mkdir -p ${remote_dir}"
+    scp "$local_image" "${ssh_target}:${remote_path}"
+  fi
+fi
+
+# --- create -----------------------------------------------------------------
+echo
+if [[ "$type" == "lxc" ]]; then
+  echo "==> Creating LXC container ${vmid} (${name})..."
+  local_disk_size="${disk_size:-$PROXMOX_DEFAULT_LXC_DISK_GB}"
+  # --memory doesn't touch swap -- it silently stays at Proxmox's own
+  # 512M default otherwise (confirmed live: --memory 2048 left swap at
+  # 512). Default to matching whatever --memory resolved to above.
+  local_swap="${swap:-$memory}"
+  # --unprivileged 1: modules/platforms/lxc.nix sets proxmoxLXC.privileged
+  # = false, so the NixOS config inside the image assumes it's running as
+  # an unprivileged container (cgroup/capability/mount expectations baked
+  # in at boot). `pct create`'s own CLI default for this flag is
+  # privileged (unlike the web UI, which defaults its checkbox the other
+  # way) -- leaving it unset creates a privileged container running a
+  # NixOS config that assumes unprivileged, a real mismatch.
+  #
+  # --features nesting=1,keyctl=1: required for a modern (v247+) systemd
+  # guest to actually boot unprivileged -- confirmed live: without this,
+  # AppArmor denies the nested user namespaces and credential mounts
+  # systemd routinely uses (even plain getty units), and every getty
+  # crash-loops on a denied mount every ~3s (visible as garbage on the
+  # console) while core services like nsncd fail the same way.
+  #
+  # ...,mount=nfs;nfs4: without it AppArmor blanket-denies the `nfs`/
+  # `rpc_pipefs` mount syscalls any NFS client share needs -- confirmed
+  # live on lxc-docker: `mount: /var/lib/nfs/rpc_pipefs: permission
+  # denied`. The value's `;` (Proxmox's own multi-fstype separator for
+  # this one feature, per PVE::LXC's use of PVE::ParseUtils::split_list)
+  # must stay single-quoted here: create_cmd is sent to `remote()`, which
+  # hands the whole string to `ssh` as a single command for the *remote*
+  # shell to parse -- unquoted, that `;` would be read as a remote
+  # command separator and silently truncate this into two commands.
+  create_cmd="pct create ${vmid} ${iso_storage}:vztmpl/${remote_filename} --unprivileged 1 --features '${PROXMOX_DEFAULT_LXC_FEATURES}' --rootfs ${storage}:${local_disk_size} --hostname ${name} --cores ${cores} --memory ${memory} --swap ${local_swap} --net0 name=eth0,bridge=${bridge},ip=dhcp"
+  remote "$create_cmd"
+  remote "pct start ${vmid}"
+else
+  echo "==> Creating VM ${vmid} (${name})..."
+  # pre-enrolled-keys=0 disables OVMF's Secure Boot key pre-enrollment --
+  # required, or systemd-boot (unsigned) can't be trusted by the firmware.
+  remote "qm create ${vmid} --name ${name} --memory ${memory} --cores ${cores} \
+--net0 virtio,bridge=${bridge} --bios ovmf --machine q35 --scsihw virtio-scsi-pci \
+--efidisk0 ${storage}:1,efitype=4m,pre-enrolled-keys=0"
+
+  if [[ "$dry_run" -eq 1 ]]; then
+    echo "[dry-run] ssh ${ssh_target} -- qm importdisk ${vmid} ${remote_path} ${storage}"
+    echo "[dry-run] (would parse the resulting disk identifier from that output)"
+    echo "[dry-run] ssh ${ssh_target} -- qm set ${vmid} --scsi0 ${storage}:<parsed-disk-id>"
+  else
+    importdisk_output="$(ssh "$ssh_target" "qm importdisk ${vmid} ${remote_path} ${storage}")"
+    echo "$importdisk_output"
+    disk_id="$(echo "$importdisk_output" | grep -oP "(?<=Successfully imported disk as ')[^']+" | sed 's/^unused[0-9]*://')"
+    if [[ -z "$disk_id" ]]; then
+      echo "ERROR: couldn't parse the imported disk identifier from qm importdisk's output above." >&2
+      echo "The VM shell (${vmid}) and imported disk both exist -- finish attaching it by hand:" >&2
+      echo "  ssh ${ssh_target} -- qm set ${vmid} --scsi0 ${storage}:<disk-id-from-output-above>" >&2
+      echo "  ssh ${ssh_target} -- qm set ${vmid} --boot order=scsi0" >&2
+      exit 1
+    fi
+    remote "qm set ${vmid} --scsi0 ${disk_id}"
+  fi
+  remote "qm set ${vmid} --boot order=scsi0"
+  remote "qm start ${vmid}"
+fi
+
+echo
+if [[ "$dry_run" -eq 1 ]]; then
+  echo "[dry-run] Nothing was built, uploaded, or created."
+else
+  echo "Done. ${name} (VMID ${vmid}) should be booting on ${node}."
+fi

scripts/secrets/backup-admin-key.sh

@@ -0,0 +1,150 @@
+#!/usr/bin/env bash
+# Backs up the local sops age key (the private key that decrypts
+# secrets/*.yaml -- normally the one trusted as &admin) to an arbitrary
+# destination path, e.g. a USB drive or other offline storage, so it can
+# later be restored and handed to rotate-admin-key.sh if this machine's
+# copy is ever lost, or to run either script from a different machine.
+#
+# Usage:
+#   scripts/secrets/backup-admin-key.sh <dest-path> [--key-file <path>] [--force] [--dry-run]
+#
+# Source key resolution matches sops/age's own default order:
+#   $SOPS_AGE_KEY (inline identity text) if set, else
+#   --key-file if given, else
+#   $SOPS_AGE_KEY_FILE if set, else
+#   ${XDG_CONFIG_HOME:-$HOME/.config}/sops/age/keys.txt
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "$0")/../.." && pwd)"
+sops_yaml="${repo_root}/.sops.yaml"
+
+# shellcheck source=../env.sh
+source "${repo_root}/scripts/env.sh"
+# shellcheck source=../lib/sops-age.sh
+source "${repo_root}/scripts/lib/sops-age.sh"
+
+# Pin cwd for the same reason rotate-admin-key.sh does: age/sops calls
+# below should never depend on wherever the caller's shell happened to be.
+cd "$repo_root"
+
+usage() {
+  cat <<EOF
+Usage: $0 <dest-path> [--key-file <path>] [--force] [--dry-run]
+
+  <dest-path>        Where to write the backup. Parent directories are
+                     created as needed. Written with 0600 permissions.
+  --key-file <path>  Read the key from here instead of the default
+                     sops/age resolution (\$SOPS_AGE_KEY_FILE, then
+                     \${XDG_CONFIG_HOME:-\$HOME/.config}/sops/age/keys.txt).
+                     Ignored if \$SOPS_AGE_KEY is set (that always wins,
+                     same precedence sops/age itself uses).
+  --force            Overwrite <dest-path> if it already exists.
+  --dry-run          Print what would happen; write nothing.
+EOF
+}
+
+dry_run=0
+force=0
+key_file="$DEFAULT_SOPS_AGE_KEY_FILE"
+args=()
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run)
+      dry_run=1
+      shift
+      ;;
+    --force)
+      force=1
+      shift
+      ;;
+    --key-file)
+      key_file="${2:?--key-file requires a path}"
+      shift 2
+      ;;
+    -h | --help)
+      usage
+      exit 0
+      ;;
+    --*)
+      echo "Unknown option: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+    *)
+      args+=("$1")
+      shift
+      ;;
+  esac
+done
+
+if [[ "${#args[@]}" -ne 1 ]]; then
+  usage >&2
+  exit 1
+fi
+dest="${args[0]}"
+
+nix_extra_opts
+
+if [[ -n "${SOPS_AGE_KEY:-}" ]]; then
+  echo "==> Source: \$SOPS_AGE_KEY (inline identity from the environment)."
+  src_content="$SOPS_AGE_KEY"
+else
+  [[ -s "$key_file" ]] || {
+    echo "ERROR: no key found. \$SOPS_AGE_KEY is unset and ${key_file} doesn't exist or is empty." >&2
+    exit 1
+  }
+  echo "==> Source: ${key_file}"
+  src_content="$(cat "$key_file")"
+fi
+
+# Round-trip through a private scratch file (rather than trusting the
+# source string as-is) so age-keygen -y validates it's a real identity
+# before anything is written to <dest-path>.
+scratch="$(mktemp)"
+trap 'rm -f "$scratch"' EXIT
+( umask 077; printf '%s\n' "$src_content" > "$scratch" )
+
+src_pub="$(age_pubkey_from_identity_file "$scratch")" || {
+  echo "ERROR: source doesn't look like a valid age identity (age-keygen -y failed)." >&2
+  exit 1
+}
+echo "    public key: ${src_pub}"
+
+current_admin_pub="$(sops_yaml_admin_pubkey "$sops_yaml")"
+if [[ -n "$current_admin_pub" && "$current_admin_pub" != "$src_pub" ]]; then
+  echo "NOTE: this key does not match .sops.yaml's current &admin entry (${current_admin_pub})."
+  echo "      Backing it up anyway -- this script doesn't require it to be the admin key."
+fi
+
+if [[ -e "$dest" && "$force" -ne 1 ]]; then
+  echo "ERROR: ${dest} already exists. Pass --force to overwrite." >&2
+  exit 1
+fi
+
+if [[ "$dry_run" -eq 1 ]]; then
+  echo
+  echo "[dry-run] would write $(wc -c <"$scratch" | tr -d ' ') bytes to ${dest} (mode 0600)"
+  [[ -e "$dest" ]] && echo "[dry-run] would overwrite existing file (--force given)"
+  echo "[dry-run] Nothing was written. Re-run without --dry-run to apply this."
+  exit 0
+fi
+
+mkdir -p "$(dirname "$dest")"
+install -m 600 "$scratch" "$dest"
+
+dest_pub="$(age_pubkey_from_identity_file "$dest")"
+if [[ "$dest_pub" != "$src_pub" ]]; then
+  echo "ERROR: ${dest} was written but its public key doesn't match the source -- investigate before relying on this backup." >&2
+  exit 1
+fi
+
+cat <<EOF
+
+Done. Backed up to: ${dest}
+  public key: ${dest_pub}
+
+This is a private key -- store it somewhere offline/secure, not in this
+repo or anywhere it'd get committed. Restore it with:
+  scripts/secrets/rotate-admin-key.sh ${dest}
+EOF

scripts/secrets/prepare-host-key.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+# Generates a new machine's SSH host key by an arbitrary name, before it
+# necessarily has a flake target yet -- prints the .sops.yaml snippet to
+# add by hand. For any host that already has a flake target,
+# scripts/secrets/sync-host-keys.sh <target> does this same job plus the
+# .sops.yaml/key_groups registration and re-encryption automatically; use
+# this script only to pre-generate a key ahead of adding the flake target
+# itself.
+#
+# Why a host key is needed at all: sops-nix derives each host's decryption key from
+# its own /etc/ssh/ssh_host_ed25519_key at *activation* time, but that
+# activation runs before systemd would otherwise generate this key on
+# first boot (sshd-keygen is a normal systemd service gated behind
+# multi-user.target; activation scripts run earlier than that). Without
+# pre-seeding, secrets — including the root/nixos login password — fail
+# to decrypt on the machine's very first boot.
+#
+# This script only touches your admin workstation and this repo's
+# .sops.yaml (it never contacts the target machine). Run it, follow the
+# printed next steps, then use the resulting key with the auto-install.sh
+# prompt (see modules/installer/common.nix) when you actually install the
+# new machine.
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "$0")/../.." && pwd)"
+# shellcheck source=../env.sh
+source "${repo_root}/scripts/env.sh"
+# shellcheck source=../lib/ssh-host-keys.sh
+source "${repo_root}/scripts/lib/ssh-host-keys.sh"
+
+hostname="${1:?usage: scripts/secrets/prepare-host-key.sh <hostname>}"
+sops_yaml="${repo_root}/.sops.yaml"
+
+if [[ ! -f "$sops_yaml" ]]; then
+  echo "ERROR: $sops_yaml not found — is this script still under nixos/scripts/?" >&2
+  exit 1
+fi
+
+keydir="${repo_root}/host-keys"
+mkdir -p "$keydir"
+keyfile="${keydir}/${hostname}_ssh_host_ed25519_key"
+
+if [[ -f "$keyfile" ]]; then
+  echo "ERROR: $keyfile already exists. Remove it first if you want to regenerate." >&2
+  exit 1
+fi
+
+nix_extra_opts
+generate_host_ed25519_key "$hostname" "$keyfile"
+
+age_pub="$(ssh_pubkey_to_age "${keyfile}.pub")"
+
+cat <<EOF
+
+Generated: ${keyfile}(.pub)
+
+=== 1. Add this line under keys: in ${sops_yaml} ===
+  - &${hostname} ${age_pub}
+
+=== 2. Add *${hostname} to whichever creation_rules key_groups this host needs ===
+(e.g. secrets/common.yaml always; add a per-host secrets/${hostname}.yaml
+ block too if this host will get its own secrets, same pattern as
+ nix-cache/server.)
+
+=== 3. Re-encrypt every secrets file you just added it to ===
+  nix-shell -p sops --run 'sops updatekeys ${repo_root}/secrets/common.yaml'
+
+=== 4. Commit + push this repo so the flake build picks up the new recipient ===
+
+=== 5. Get the key onto the installer, one of two ways ===
+  a) Rebuild the installer image with all host-keys/ baked in (see
+     docs/auto-installer.md):
+       NIXOS_HOST_KEYS_DIR="${keydir}" nix build .#iso --impure
+     (or .#pxe — --impure is required since host-keys/ is gitignored and
+     flakes can't see it otherwise)
+
+  b) Or, for an image already built without keys, scp it in after boot:
+       scp ${keyfile}{,.pub} root@<target-ip>:/root/host-keys/
+
+Then continue with /etc/auto-install.sh as normal — it checks
+/etc/host-keys (baked in) before /root/host-keys (scp'd) and installs
+whichever it finds before running nixos-install.
+EOF

scripts/secrets/rotate-admin-key.sh

@@ -0,0 +1,193 @@
+#!/usr/bin/env bash
+# Rotates the &admin sops age key: decrypts with a backed-up copy of the
+# key CURRENTLY trusted as &admin, replaces .sops.yaml's &admin entry with
+# a new key already present in this environment, and re-encrypts every
+# secrets/*.yaml for the new recipient set. After this runs, the old key
+# can no longer decrypt anything -- this is a real, one-way handoff of
+# trust, not a preview.
+#
+# This is the automation for the manual steps create-proxmox-resource.sh /
+# sync-host-keys.sh print when they bootstrap a brand-new, not-yet-trusted
+# age key on a machine that's never had admin access before:
+#
+#   scripts/secrets/rotate-admin-key.sh /path/to/backed-up/admin/keys.txt
+#
+# The backup key's *public* key must match .sops.yaml's current &admin
+# entry -- this script verifies that by deriving it, it doesn't just trust
+# the filename or take it on faith. The new key defaults to wherever sops
+# itself would already look ($SOPS_AGE_KEY_FILE, then the XDG default), so
+# the common case is just pointing this at the restored backup.
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "$0")/../.." && pwd)"
+sops_yaml="${repo_root}/.sops.yaml"
+
+# shellcheck source=../env.sh
+source "${repo_root}/scripts/env.sh"
+# shellcheck source=../lib/sops-age.sh
+source "${repo_root}/scripts/lib/sops-age.sh"
+
+# sops resolves .sops.yaml by walking up from the process's cwd, not from
+# the target file's own path -- if this script were invoked from somewhere
+# other than the repo root (or from inside another checkout/worktree that
+# happens to have its own .sops.yaml), `sops updatekeys` would silently
+# re-encrypt against the WRONG config's recipient list instead of this
+# repo's. Pin cwd here so every sops/age call below is unambiguous
+# regardless of where the caller's shell started out.
+cd "$repo_root"
+
+usage() {
+  cat <<EOF
+Usage: $0 <path-to-backed-up-admin-key> [--new-key-file <path>] [--dry-run]
+
+  <path-to-backed-up-admin-key>  age identity file for the key CURRENTLY
+                                 trusted as &admin. Only ever read -- never
+                                 copied or modified.
+  --new-key-file <path>          age identity file for the key to promote
+                                 to &admin. Defaults to \$SOPS_AGE_KEY_FILE,
+                                 then
+                                 \${XDG_CONFIG_HOME:-\$HOME/.config}/sops/age/keys.txt
+                                 (sops/age's own default resolution order).
+  --dry-run                      Print what would change; touches nothing
+                                  (.sops.yaml untouched, no sops updatekeys
+                                  calls).
+EOF
+}
+
+dry_run=0
+new_key_file="$DEFAULT_SOPS_AGE_KEY_FILE"
+args=()
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run)
+      dry_run=1
+      shift
+      ;;
+    --new-key-file)
+      new_key_file="${2:?--new-key-file requires a path}"
+      shift 2
+      ;;
+    -h | --help)
+      usage
+      exit 0
+      ;;
+    --*)
+      echo "Unknown option: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+    *)
+      args+=("$1")
+      shift
+      ;;
+  esac
+done
+
+if [[ "${#args[@]}" -ne 1 ]]; then
+  usage >&2
+  exit 1
+fi
+backup_key="${args[0]}"
+
+[[ -s "$backup_key" ]] || { echo "ERROR: backup key file not found or empty: ${backup_key}" >&2; exit 1; }
+[[ -s "$new_key_file" ]] || { echo "ERROR: new key file not found or empty: ${new_key_file}" >&2; exit 1; }
+
+nix_extra_opts
+
+echo "==> Deriving public keys..."
+old_pub="$(age_pubkey_from_identity_file "$backup_key")"
+new_pub="$(age_pubkey_from_identity_file "$new_key_file")"
+echo "    backup (old admin) key: ${old_pub}"
+echo "    new admin key:          ${new_pub}"
+
+if [[ "$old_pub" == "$new_pub" ]]; then
+  echo "ERROR: backup key and new key are identical -- nothing to rotate." >&2
+  exit 1
+fi
+
+current_admin_pub="$(sops_yaml_admin_pubkey "$sops_yaml")"
+if [[ -z "$current_admin_pub" ]]; then
+  echo "ERROR: couldn't find a '&admin age1...' line in ${sops_yaml}." >&2
+  exit 1
+fi
+
+if [[ "$current_admin_pub" != "$old_pub" ]]; then
+  echo "ERROR: ${backup_key} doesn't match the current &admin key in .sops.yaml." >&2
+  echo "  .sops.yaml &admin: ${current_admin_pub}" >&2
+  echo "  backup key pubkey: ${old_pub}" >&2
+  echo "Wrong backup file, or .sops.yaml has already moved on -- not touching anything." >&2
+  exit 1
+fi
+
+mapfile -t secrets_files < <(find "${repo_root}/secrets" -maxdepth 1 -name '*.yaml' | sort)
+if [[ "${#secrets_files[@]}" -eq 0 ]]; then
+  echo "ERROR: no secrets/*.yaml files found under ${repo_root}/secrets." >&2
+  exit 1
+fi
+
+# sops_can_decrypt <key-file> <secrets-file>: used both to confirm the
+# backup key still works before touching anything, and again after
+# rotation to confirm the new key does too.
+sops_can_decrypt() {
+  local key_file="$1" secrets_file="$2"
+  SOPS_AGE_KEY_FILE="$key_file" nix-shell "${NIX_OPTS[@]}" -p sops --run \
+    "sops -d '${secrets_file}'" >/dev/null
+}
+
+echo "==> Confirming the backup key can actually decrypt..."
+if ! sops_can_decrypt "$backup_key" "${secrets_files[0]}"; then
+  echo "ERROR: backup key failed to decrypt $(basename "${secrets_files[0]}") -- aborting." >&2
+  exit 1
+fi
+echo "    OK: decrypted $(basename "${secrets_files[0]}")"
+
+if [[ "$dry_run" -eq 1 ]]; then
+  echo
+  echo "[dry-run] would replace .sops.yaml's &admin line:"
+  echo "[dry-run]   - ${current_admin_pub}"
+  echo "[dry-run]   + ${new_pub}"
+  echo "[dry-run] would then re-encrypt (sops updatekeys --yes) for the new recipient set:"
+  for f in "${secrets_files[@]}"; do
+    echo "[dry-run]   secrets/$(basename "$f")"
+  done
+  echo
+  echo "[dry-run] Nothing was changed. Re-run without --dry-run to apply this."
+  exit 0
+fi
+
+echo "==> Rotating .sops.yaml's &admin key..."
+sed -i "s|^  - &admin age1[a-z0-9]*|  - \&admin ${new_pub}|" "$sops_yaml"
+grep -qF "$new_pub" "$sops_yaml" || {
+  echo "ERROR: sed edit didn't take -- .sops.yaml left unchanged, check it by hand." >&2
+  exit 1
+}
+echo "    Updated."
+
+echo "==> Re-encrypting secrets/*.yaml for the new recipient set..."
+for f in "${secrets_files[@]}"; do
+  echo "==> $(basename "$f")"
+  sops_updatekeys "$f" "$backup_key"
+done
+
+echo "==> Verifying the new key can decrypt everything..."
+for f in "${secrets_files[@]}"; do
+  if ! sops_can_decrypt "$new_key_file" "$f"; then
+    echo "ERROR: new key failed to decrypt $(basename "$f") after rotation -- investigate before committing." >&2
+    exit 1
+  fi
+  echo "    OK: $(basename "$f")"
+done
+
+cat <<EOF
+
+Done. .sops.yaml's &admin key is now:
+  ${new_pub}
+
+The old key (${old_pub}) can no longer decrypt any secrets/*.yaml
+re-encrypted above.
+
+Review the diff, then commit:
+  git add .sops.yaml secrets/*.yaml
+  git commit -m "Rotate sops admin age key"
+EOF

scripts/secrets/sync-host-keys.sh

@@ -0,0 +1,446 @@
+#!/usr/bin/env bash
+# Manages host-keys/ + .sops.yaml + secrets/*.yaml recipients together, so
+# a flake target's SSH host key and its sops registration never drift out
+# of sync with each other or with the flake itself.
+#
+#   sync-host-keys.sh --all                Generate/register every flake
+#                                           target missing a key.
+#   sync-host-keys.sh <target>              Same, for just one target.
+#   sync-host-keys.sh --remove              Interactively remove one
+#                                           locally-managed key.
+#   sync-host-keys.sh --regenerate-all-keys Remove and freshly regenerate
+#                                           every locally-managed key.
+#
+# "Generate/register" is idempotent and additive only: an existing
+# host-keys/ file is never touched, and .sops.yaml only ever gains an
+# anchor/alias it doesn't already have -- safe to re-run any time, e.g.
+# right after adding a new host to flake.nix.
+#
+# --remove and --regenerate-all-keys only ever operate on anchors that have
+# a corresponding host-keys/<name>_ssh_host_ed25519_key file. Anchors
+# without one (&admin, and any anchor for an already-deployed host whose
+# real /etc/ssh key was registered by hand, e.g. &docker/&server/&nix-cache
+# today) are never listed, removed, or regenerated -- this tooling only
+# ever touches keys it itself manages.
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "$0")/../.." && pwd)"
+sops_yaml="${repo_root}/.sops.yaml"
+keydir="${repo_root}/host-keys"
+editor="${repo_root}/scripts/lib/sync-host-keys-edit-sops.py"
+
+# shellcheck source=../env.sh
+source "${repo_root}/scripts/env.sh"
+# shellcheck source=../lib/nix-eval.sh
+source "${repo_root}/scripts/lib/nix-eval.sh"
+# shellcheck source=../lib/ssh-host-keys.sh
+source "${repo_root}/scripts/lib/ssh-host-keys.sh"
+# shellcheck source=../lib/sops-age.sh
+source "${repo_root}/scripts/lib/sops-age.sh"
+# shellcheck source=../lib/confirm.sh
+source "${repo_root}/scripts/lib/confirm.sh"
+
+mkdir -p "$keydir"
+
+usage() {
+  cat <<EOF
+Usage: $0 --all [--dry-run]
+       $0 <flake-target> [--dry-run]
+       $0 --remove [--dry-run]
+       $0 --regenerate-all-keys [--dry-run]
+
+  --all                    Generate + register a host key for every flake
+                            target that's missing one.
+  <flake-target>            Same, for just one target (e.g. lxc-server).
+                            Reports if it already has one.
+  --remove                  Interactively pick one locally-managed key to
+                            remove from .sops.yaml and host-keys/.
+  --regenerate-all-keys     Remove every locally-managed key and generate
+                            fresh replacements for every current flake
+                            target. Destructive -- requires typed
+                            confirmation.
+  --dry-run                 Combine with any of the above: print what would
+                            change (host-keys/ files, .sops.yaml anchors and
+                            key_groups, which secrets/*.yaml would be
+                            re-encrypted) without touching anything. No keys
+                            generated, no files written, no sops calls,
+                            no prompts for confirmation.
+EOF
+}
+
+# --- step 0: make sure we can actually decrypt anything at all -------------
+#
+# Registering a host means editing .sops.yaml and then running
+# `sops updatekeys`, which has to decrypt each secrets file with an
+# existing recipient's key before it can re-encrypt it for the new one.
+# Check this before doing anything else, the same order sops/age itself
+# resolves a usable key in: SOPS_AGE_KEY (inline), then SOPS_AGE_KEY_FILE,
+# then the XDG default path.
+ensure_admin_decrypt_key() {
+  if [[ -n "${SOPS_AGE_KEY:-}" ]]; then
+    echo "Using SOPS_AGE_KEY from the environment."
+    return
+  fi
+
+  local key_file="$DEFAULT_SOPS_AGE_KEY_FILE"
+
+  if [[ -s "$key_file" ]]; then
+    echo "Found existing sops age key at ${key_file}."
+    return
+  fi
+
+  if [[ "$dry_run" -eq 1 ]]; then
+    echo "[dry-run] No sops age decryption key found (checked \$SOPS_AGE_KEY, \$SOPS_AGE_KEY_FILE, ${key_file})."
+    echo "[dry-run] Would generate a new one here -- continuing the dry run without one; any"
+    echo "[dry-run] 'would re-encrypt' output below couldn't actually run for real yet."
+    return
+  fi
+
+  echo "No sops age decryption key found (checked \$SOPS_AGE_KEY, \$SOPS_AGE_KEY_FILE, ${key_file})."
+  echo "Generating a new one at ${key_file}..."
+  mkdir -p "$(dirname "$key_file")"
+  nix-shell "${NIX_OPTS[@]}" -p age --run "age-keygen -o '${key_file}'" 2>&1 | grep -v "^Public key:" || true
+  local new_pub
+  new_pub="$(age_pubkey_from_identity_file "$key_file")"
+
+  cat <<EOF
+
+A brand-new age key was just generated -- it cannot decrypt anything that
+already exists in secrets/*.yaml, since nothing was ever encrypted for it.
+That trust can't be bootstrapped automatically (nobody can decrypt a file
+for a recipient that didn't exist when it was last encrypted).
+
+To actually use this key:
+  1. Have someone who currently CAN decrypt replace the &admin entry in
+     .sops.yaml with this public key:
+       ${new_pub}
+  2. They re-encrypt every secrets/*.yaml:
+       sops updatekeys --yes secrets/common.yaml
+       sops updatekeys --yes secrets/nix-cache.yaml
+       sops updatekeys --yes secrets/server.yaml
+  3. Re-run this script.
+
+Exiting without making any other changes.
+EOF
+  exit 1
+}
+
+discover_targets() {
+  # installer is the one nixosConfigurations target that doesn't import
+  # sops-nix at all (see CLAUDE.md's "Security Notes" -- hardcoded login
+  # password instead) -- config.sops.secrets doesn't exist for it.
+  list_flake_targets "$repo_root" | grep -v '^installer$'
+}
+
+locally_managed_hosts() {
+  for f in "$keydir"/*_ssh_host_ed25519_key.pub; do
+    [[ -e "$f" ]] || continue
+    basename "$f" _ssh_host_ed25519_key.pub
+  done
+}
+
+add_keys_json="[]"
+add_aliases_json="[]"
+dry_run=0
+
+queue_host_sync() {
+  local host="$1"
+  local keyfile="${keydir}/${host}_ssh_host_ed25519_key"
+  local has_local_key=0 has_anchor=0
+  [[ -f "$keyfile" ]] && has_local_key=1
+  grep -qE "^  - &${host} age1" "$sops_yaml" && has_anchor=1
+
+  if [[ "$has_local_key" -eq 0 && "$has_anchor" -eq 1 ]]; then
+    echo "SKIP ${host}: .sops.yaml already has an &${host} anchor, but"
+    echo "     host-keys/${host}_ssh_host_ed25519_key is missing locally."
+    echo "     Not generating a replacement -- it wouldn't match whatever's"
+    echo "     already registered (and possibly deployed). Remove the"
+    echo "     &${host} line from .sops.yaml first if you really want a"
+    echo "     fresh key, then re-run."
+    return 1
+  fi
+
+  if [[ "$has_local_key" -eq 0 ]]; then
+    if [[ "$dry_run" -eq 1 ]]; then
+      echo "[dry-run] ${host}: would generate host key"
+    else
+      echo "==> ${host}: generating host key"
+      generate_host_ed25519_key "$host" "$keyfile"
+    fi
+  else
+    echo "==> ${host}: host key already present"
+  fi
+
+  if [[ "$has_anchor" -eq 0 ]]; then
+    local age_pub
+    if [[ "$dry_run" -eq 1 ]]; then
+      age_pub="dry-run-placeholder-not-a-real-key"
+    else
+      age_pub="$(ssh_pubkey_to_age "${keyfile}.pub")"
+    fi
+    add_keys_json="$(jq --arg host "$host" --arg key "$age_pub" \
+      '. + [{host: $host, age_key: $key}]' <<<"$add_keys_json")"
+  fi
+
+  echo "==> ${host}: checking which secrets files it references"
+  local basenames
+  mapfile -t basenames < <(
+    nix eval --json --no-use-registries --no-accept-flake-config \
+      "${repo_root}#nixosConfigurations.${host}.config.sops.secrets" \
+      --apply 'builtins.mapAttrs (n: v: baseNameOf v.sopsFile)' \
+    | jq -r '[.[]] | unique | .[]'
+  )
+  local basename
+  for basename in "${basenames[@]}"; do
+    add_aliases_json="$(jq --arg host "$host" --arg basename "$basename" \
+      '. + [{host: $host, basename: $basename}]' <<<"$add_aliases_json")"
+  done
+}
+
+# In dry-run, this runs the exact same edit logic (so idempotency/what's-
+# actually-new is determined for real, not guessed) but against a scratch
+# copy of .sops.yaml that's discarded afterward -- the real file is never
+# opened for writing, and `sops updatekeys` never runs.
+apply_edit_plan() {
+  local plan="$1"
+  local target="$sops_yaml"
+  local tmpfile=""
+  if [[ "$dry_run" -eq 1 ]]; then
+    tmpfile="$(mktemp)"
+    cp "$sops_yaml" "$tmpfile"
+    target="$tmpfile"
+  fi
+
+  local result
+  result="$(echo "$plan" | nix-shell "${NIX_OPTS[@]}" -p python3 --run "python3 '${editor}' '${target}'")"
+  [[ -n "$tmpfile" ]] && rm -f "$tmpfile"
+
+  local added removed changed
+  added="$(jq -r '.added_keys[]?' <<<"$result")"
+  removed="$(jq -r '.removed_keys[]?' <<<"$result")"
+  changed="$(jq -r '.changed_secrets_files[]?' <<<"$result")"
+
+  if [[ -z "$added" && -z "$removed" && -z "$changed" ]]; then
+    echo "Nothing changed in .sops.yaml."
+    return
+  fi
+
+  local prefix=""
+  [[ "$dry_run" -eq 1 ]] && prefix="[dry-run] would "
+
+  [[ -n "$added" ]] && echo "${prefix}Add .sops.yaml anchors: $(tr '\n' ' ' <<<"$added")"
+  [[ -n "$removed" ]] && echo "${prefix}Remove .sops.yaml anchors: $(tr '\n' ' ' <<<"$removed")"
+
+  if [[ -n "$changed" ]]; then
+    if [[ "$dry_run" -eq 1 ]]; then
+      echo "[dry-run] would re-encrypt:"
+      while IFS= read -r basename; do
+        [[ -z "$basename" ]] && continue
+        echo "  secrets/${basename}"
+      done <<<"$changed"
+    else
+      echo "Re-encrypting affected secrets files..."
+      while IFS= read -r basename; do
+        [[ -z "$basename" ]] && continue
+        echo "==> secrets/${basename}"
+        sops_updatekeys "${repo_root}/secrets/${basename}"
+      done <<<"$changed"
+    fi
+  fi
+}
+
+flush_additions() {
+  if [[ "$add_keys_json" == "[]" && "$add_aliases_json" == "[]" ]]; then
+    echo "Nothing to do -- every requested target already has a fully registered host key."
+    return
+  fi
+  echo
+  echo "Applying .sops.yaml edits..."
+  local plan
+  plan="$(jq -n --argjson add_keys "$add_keys_json" --argjson add_aliases "$add_aliases_json" \
+    '{add_keys: $add_keys, add_aliases: $add_aliases}')"
+  apply_edit_plan "$plan"
+  echo
+  if [[ "$dry_run" -eq 1 ]]; then
+    echo "[dry-run] Nothing was changed. Re-run without --dry-run to apply this."
+  else
+    echo "Done. Review the .sops.yaml / secrets/*.yaml diff, then commit and push --"
+    echo "the flake build the installer uses has to see the new recipient(s) before"
+    echo "any of these hosts can decrypt their secrets on first boot."
+  fi
+}
+
+cmd_all() {
+  echo "Discovering flake targets..."
+  local targets
+  mapfile -t targets < <(discover_targets)
+  local host
+  for host in "${targets[@]}"; do
+    queue_host_sync "$host" || true
+  done
+  flush_additions
+}
+
+cmd_target() {
+  local host="$1"
+  local targets
+  mapfile -t targets < <(discover_targets)
+  if ! printf '%s\n' "${targets[@]}" | grep -qxF "$host"; then
+    echo "ERROR: '${host}' is not a current nixosConfigurations target." >&2
+    echo "Current targets:" >&2
+    printf '  %s\n' "${targets[@]}" >&2
+    exit 1
+  fi
+  queue_host_sync "$host" || exit 1
+  flush_additions
+}
+
+cmd_remove() {
+  local hosts
+  mapfile -t hosts < <(locally_managed_hosts)
+  if [[ "${#hosts[@]}" -eq 0 ]]; then
+    echo "No locally-managed keys in host-keys/ -- nothing to remove."
+    return
+  fi
+
+  echo "Locally-managed keys:"
+  local i=1 host
+  for host in "${hosts[@]}"; do
+    local registered="not registered in .sops.yaml"
+    grep -qE "^  - &${host} age1" "$sops_yaml" && registered="registered in .sops.yaml"
+    printf '  %d) %s (%s)\n' "$i" "$host" "$registered"
+    i=$((i + 1))
+  done
+
+  local choice
+  read -rp "Remove which one? (number, or blank to cancel): " choice
+  if [[ -z "$choice" ]]; then
+    echo "Cancelled."
+    return
+  fi
+  if ! [[ "$choice" =~ ^[0-9]+$ ]] || (( choice < 1 || choice > ${#hosts[@]} )); then
+    echo "ERROR: invalid selection." >&2
+    exit 1
+  fi
+  local target="${hosts[$((choice - 1))]}"
+
+  if [[ "$dry_run" -ne 1 ]]; then
+    read -rp "Really remove '${target}'? Its host-keys/ files will be deleted and it will lose access to every secrets file it can currently decrypt. (y/N): " confirm
+    if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
+      echo "Cancelled."
+      return
+    fi
+  fi
+
+  local plan
+  plan="$(jq -n --arg host "$target" \
+    '{remove_keys: [$host], remove_aliases_for_hosts: [$host]}')"
+  apply_edit_plan "$plan"
+
+  if [[ "$dry_run" -eq 1 ]]; then
+    echo "[dry-run] would delete host-keys/${target}_ssh_host_ed25519_key(.pub)."
+    echo "[dry-run] Nothing was changed. Re-run without --dry-run to apply this."
+  else
+    rm -f "${keydir}/${target}_ssh_host_ed25519_key" "${keydir}/${target}_ssh_host_ed25519_key.pub"
+    echo "Removed host-keys/${target}_ssh_host_ed25519_key(.pub)."
+    echo
+    echo "Review the diff, then commit and push."
+  fi
+}
+
+cmd_regenerate_all() {
+  local hosts
+  mapfile -t hosts < <(locally_managed_hosts)
+  if [[ "${#hosts[@]}" -eq 0 ]]; then
+    echo "No locally-managed keys in host-keys/ -- nothing to regenerate."
+    return
+  fi
+
+  echo "This will remove and freshly regenerate ALL locally-managed keys:"
+  printf '  %s\n' "${hosts[@]}"
+  echo
+  echo "Every host above will need its new key baked into a rebuilt install"
+  echo "image/tarball before it can decrypt secrets again."
+
+  if [[ "$dry_run" -ne 1 ]]; then
+    if ! confirm_typed "REGENERATE" "Type REGENERATE to confirm: "; then
+      echo "Cancelled."
+      return
+    fi
+  fi
+
+  echo
+  local hosts_json
+  hosts_json="$(printf '%s\n' "${hosts[@]}" | jq -R . | jq -s .)"
+  local plan
+  plan="$(jq -n --argjson hosts "$hosts_json" \
+    '{remove_keys: $hosts, remove_aliases_for_hosts: $hosts}')"
+  apply_edit_plan "$plan"
+
+  if [[ "$dry_run" -eq 1 ]]; then
+    echo "[dry-run] would delete ${#hosts[@]} host-keys/ file pair(s)."
+    echo "[dry-run] would then generate fresh replacements for the same hosts"
+    echo "[dry-run] (not simulated further here -- run without --dry-run, or"
+    echo "[dry-run] preview a specific target with: $0 <target> --dry-run)."
+    echo
+    echo "[dry-run] Nothing was changed. Re-run without --dry-run to apply this."
+    return
+  fi
+
+  echo "Removing existing keys..."
+  local host
+  for host in "${hosts[@]}"; do
+    rm -f "${keydir}/${host}_ssh_host_ed25519_key" "${keydir}/${host}_ssh_host_ed25519_key.pub"
+  done
+  echo "Removed ${#hosts[@]} host-keys/ file pair(s)."
+
+  echo
+  echo "Regenerating fresh keys for every current flake target..."
+  cmd_all
+}
+
+main() {
+  local args=()
+  local arg
+  for arg in "$@"; do
+    if [[ "$arg" == "--dry-run" ]]; then
+      dry_run=1
+    else
+      args+=("$arg")
+    fi
+  done
+  set -- "${args[@]+"${args[@]}"}"
+
+  if [[ "$dry_run" -eq 1 ]]; then
+    echo "[dry-run] no changes will be made"
+    echo
+  fi
+
+  nix_extra_opts
+  ensure_admin_decrypt_key
+
+  case "${1:-}" in
+    --all)
+      cmd_all
+      ;;
+    --remove)
+      cmd_remove
+      ;;
+    --regenerate-all-keys)
+      cmd_regenerate_all
+      ;;
+    -h | --help | "")
+      usage
+      ;;
+    --*)
+      echo "Unknown option: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+    *)
+      cmd_target "$1"
+      ;;
+  esac
+}
+
+main "$@"

secrets/common.yaml

@@ -5,40 +5,85 @@ sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6NkpZRzJuMFNuV09WamR0
-            SERDN0VSUlNQbkhSem1EeFlxdlhmdUx0S21JCnY1VkRBQTBqcW9JRHpJWEtJSitN
-            dHkyR0I4ckNkWkpGWHAzZGRaZkhJalEKLS0tIHRrU3RhU3UxN3B4NHdLeStuSXQ4
-            anFkRlpMTHowZzJNdnY0MExQcXd4OUEKgbT7uOSFkfEs6t3X6jmGOiC28lDJWF33
-            50f2fZ771ylhHa6WJMetGZ5cwl9r1RCaDiWyJEaqNGe7NqARlhr3EQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaMUpxYmUzaVY4d1pRY3g3
+            empaVUJSN0JaSlNQQlJtZENwc0VMYVhJSkFvCmJQMkpSd3RoYzlKQjBSZWErQzR2
+            aG5SVndOQWpSRTBDSWJVQkg0c0hiNFUKLS0tIHhiaEdpY3gwZkpCcHl2TW5CNThn
+            aVVUQy9Qd0trb0RNdUpVTXdrdGlrTmcK1uphQAyDV+Gk5+K1YOqw1Z8ynGP5sAPF
+            q5icujja/SGexX18hPYXbkyUtOrBYjW62gCuGJinSBPROoFUJbiP7g==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age10nd382a9klsn2mrs60emdtsxe43pht3a0m9p29phfrhy0wfyt3vsq9r667
+          recipient: age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDamw2ekY0dFZyOGNJelVa
-            ZGlNK2VNOWtWNTRzU3o2aVJvRi9CME5yS1JFCndlamdFMzVRTnoyVE1ZWXZkTjRR
-            eWdSZzZERHE5VElrOGZvcE4vK0g2d0EKLS0tIG15QlVyalZTK2NpVDdWWU4yUU4r
-            SkFncC9rZkNKUS9MSmF6WGQwOENwZTQKs5kLNLdQJoZtcsw3zlUWUUtJs0MJnuvw
-            o5vziOswRnuXENw//xN01nMDC6Ckzvb+q9GFIyxHLE4j3fT5XdZakg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKOWZxcFlhRHhKelhDS29M
+            NGRlTEhJUGUzcFV6QVFCdTNkdEN3MlljWnl3CnI3LzVxSHBwSi9TYlRUcFdyN2py
+            cVZBV0Q3Z3FhRXA0T1NFQzd2R00yeEUKLS0tIHkxL2dHV3RkVFYxZTJNTVZvVFIr
+            TXpJZzdnYlpJaXBmcjdWWUtxNkc4dWMKVsImJiavzUzSFn78pciNJPHaS3KWqJer
+            VkxF6kF3tl2HmW46eVXtsQowdu+zVR9HS35i/HvQ1r1TyP6qT5ofcQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age19gfn2yedg76dmztm4hncr7vf3r3c9j0qpt4rap7y7gersjk4m3ks2lhd0e
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyaWpWTGd4TEVoaHg4b3hm
-            S1o3VXdkYkZCS0QxcW5hUWxyVjFneE5aSmp3ClNsdEZoMHpPUzI4K3B0ZnBYMlEw
-            MkJyd2NPcGJDZzgvc1EyWFBhNVlGUVEKLS0tIEptYXI2bnJHZVZGR3hSSm1sMlN5
-            ay8wdUh6TEowL0ZiUWtqbXl3NzhYOVEKW9l4mr+MLhuXA8sgQndaU8NiFeCMcxhG
-            qjKFn+mu2GFbwfZWAy6y/KUd9Ug4H6y3pNHlJMHupTu8v2wZ+3S4EA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyWjdSanRRaEI4VHFZVkdw
+            NkxMODRuakFJTFNoTHZIRHptZFNxaGZ3K3lnCjJGR1FJalRsYmtLcHFxZW8yNU5W
+            MzBjWmltbzI3MTByUjB6djlEdllHNXMKLS0tIEhEOVhLVjZkRi9vUEtDWUhxT0NX
+            eUZ3bGdEaHdGbXZIYkowYUZuTWJ3d2MKMwgxOqlMH7GfLlseD4J277Dcg0KCD3d5
+            jwJDb82kRWoBMicTJZXoq/5oe5blJNa7dWYoqgkYxMA2O+0igT+I6g==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxVG13RVVweGpRM04vMWxG
-            V2hMMnp2Qk5Ub1BZQWNKNXVya3J4NGpreDJrCktqajVPRXdEL1BMU1dMbDhmU01L
-            UlQvRVQvcEFUZVZ5Umc3Y0hMUWNLVFEKLS0tIFgzRnF1RHdQdktDVjROSURYYTdx
-            NjAydjVuV1VCOGZoVFdTZmw1YmJ0eEEKN9KRGegafu1sjHlhyn4KCMPPAKxsSZLc
-            QJkei1ZQ0AVgC2QfCVEXonMOrs45nCIplG+uyER9khZyyjKObWk1pA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsZzdRMm9zdlJHckFoREVs
+            UkVXL3dCeWRuN2NqcnVsOWVNT1FLUHY3andrCmNFY0ZCby9SdnUyYlV6R05YNDB0
+            em43SjRCNVhYbmpRZUVWT0cxQlhGdmsKLS0tIDZHazNyck5VNHBuNVM5bmRZUlpR
+            QzBSNy84VDdLVkZZbnNlUFYydXlreEEKYZaR2b7tyRAhPdP+ytpP0veUTi7pY9Nw
+            pK0h4hcegLNYJL1AfOYwFQoW7vb256GdmwdcuuBl1YBGXWGraaBnZg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFSnZiOGpsL1BESWVEdUxx
+            dXc5LzBHTlNodGJ1S3hOeHd5Wmgxb3BPSHl3CnBEWDNTc3NDdzN3RHQxUlNLOEs5
+            RU1SS2tVT29XbDJCWVliWnVkekN4L1kKLS0tIGFqY2pNK2h2S2ZWMndrRVN6eUdN
+            M0NLY2EvTTVIYlZvdk9XY0NwNE14ZlEKcOwgCK3g56kId/4tEt+2iCcylisn+Fca
+            5VWamsXdbwxbxmCEEUbgN3aHrdVz3mV4+8FZqA34yXz8pc45/PUcFg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1qz9d4ka4xgexujyd247s7lp737sulp5fhxl5d65fj2ykvc4j4edqrsdks8
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJU1cydFFuRnpCUU5mbjFu
+            TTIxREkxZ1hMalVtNjNjcHVaUXpPNWdib2tzCkRScWRTWHhxN3lhckI4UFpMSFRa
+            RGxWcldlWnd5SVJFNWxQWjB3R0pMb3MKLS0tIGdjLzlhTHgyT2hjTmRTK1RiZmxS
+            OWRWYklBWkoyUG8raFNzd3JlRUtEUEUKw+NdAp1Mz0dEOUGPbqCV8y7029I3Kye0
+            keU2T29JGCN1D6x//1NcMUYSaFZKgv0ZVSjVUCl1EnmlJ0nBdbaDXA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age120whqj96g26lsgy4udvgsn8dc9lumh8jeu3a564fx79rjr5lxffqmrljuu
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnNFlzYVBqaGFDVE9xbmt5
+            OVd4ZlZRdEVJd0JFdkRIYVA5ZUEwYjJjWVJjCnZzTExNbDlYbGN6c1dYU2ZlNEVs
+            ZUo4MXdpc0tzbDI0MHl5eXc3d09VRDQKLS0tIGs4SGMya1RZQ0hpa2NtQk9Wa29C
+            bmxIYWk1VThsaFhxRDlOOGhGQ2tYamsKs+PcOiaeNFujCWwZBr+nq1MzrGohl+ch
+            TASI7eNsiHmSVRzSMHv4mX+8yXDHIRgHbFuUty2gdgGFLRjYXe4gDA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1xjst4frdh0th6q8m7p7u9g5af7ty5jqeum0p6z8a52a9q7st7ewqw8yl9j
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkcmVQYXV1NzRrQ2IxTElt
+            QUJRMkhiUUJqRDdwQW03K0lCTEtkSTU5UDJrCjh6SldpQkF1NzIybTJTdnBlOHdQ
+            VlREMy9hM0ZaL21Pa0VPUzcvb0pQQjQKLS0tIFcrK0I3Z3Nhem45eHpZYmdWeit6
+            eXFtRHVxODhaNTVDdVR1a2tOb1N1U1EKZBdLHq8PRMKX2ndFr3AxFVAZRyvhFa1u
+            72R5tordo4IR3HSxG3Z06rokOITd+KKhaQ8NEWEC8qioAAMxEC9QWw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age10at8862478urh0eeuwh8hzln6ck78jgwtztgxatwqlzwagg77y5snm4xzg
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0WjJPbXhXNTNyQUZzMmxS
+            Rkd3Yk5Ga3pPRXFtMFpXcmpBZ3RJYnJlaHhjClRDbFBHRVZ0SDdrNFdVWmUwalpT
+            WUt5a2RUTnQ4VFBGMlowR3JycDM3aXMKLS0tIERSeFd4cGdSbzRpSmpSQnB1Yng5
+            OHBma3lYeWEwQ2RvelpzZHRkN1JPWFEKLXkJfEkH3lo5Z4mj8PZXTfAfZn6B46To
+            U0G54tUh0U1EeMnI5ZPRGwDxi5K0eD68HjeE9MBvFBysOChP/ANDPQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ezk9x53zt8kcnscdm80jcyf0xq97vndv7jsn3rl8cc0cwm2jmpmq372dzs
     lastmodified: "2026-07-19T02:30:40Z"
     mac: ENC[AES256_GCM,data:UiL3VMDF6rq4Nr87KspcDx434q3tfNXeb5pwH2O+4ssNQ6xzcYDdzXBnhAY3zLBsqPMKrvHBd4Ot/gEMcq3FMIVe7Q6p9yWKpep66KZ/yWEhAlwIVhD79Oj8VS+1CHKjf25zpRdhZorp04oeFQQd9VfjJB4EE/Q1aVbwTGlpIic=,iv:i/0conaFgFia+wzNTdUL6tlSTw35HTK3Ap1Sr5RGHf8=,tag:ULbz5FllShA/JjlSRdxA0g==,type:str]
     unencrypted_suffix: _unencrypted

secrets/nix-cache.yaml

@@ -1,25 +1,35 @@
 beszel-token: ENC[AES256_GCM,data:meuzUP/6wCssJDVTgbC0XwiLZPMGyDl55HEIiON9xOXCD9k6,iv:TDqWcp+8Mxd8wN09r5otQRQXq3XTeQphaTWxvvuLTAs=,tag:cRPZQGlwB/dTguBAheWPQg==,type:str]
+cache-priv-key: ENC[AES256_GCM,data:6vQKIf7eS0WNL2Eptoi4VWr18SRMZfN/H/aFUUtXdMYQY5LLyBp2EHRKqZcGFuh1nZhUdAxUztq/CVXx+QFxKW+ElHxCxUSp0QqI1fdSkBkKZb8hlit5SoX9JtLzZGg0HBNM3nJu,iv:0J+xmrPJhInHhFR/c41ACjuTfaIoMkQFSfbL2KkgFa8=,tag:f4s9Szs5oprVVRSyXaX48A==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkb29VM3haQ0c0WDY0STVn
-            L1ZyOUROSnR6ZjZZZWc1VGFFNVp6bWxCV3hZCnlGTC9CbEtIM3MvSGJQaStEbzJ0
-            eWVhY2l6UHNDRTYxdEpkd003WXFia2MKLS0tIHcxU3FPYTVuZ0RqZTZTT1RvZnN0
-            OGlQM3B2R0l4MHhWNXBBWmpiOEVxK1EK8kxh3ikKL6Fw2am3r7lPGpB0fCqzEukO
-            NU10Cbf38Bd+fybRbBnvRuu9To1FOf+KU3iKbsuWmZn4KJn4Ajcbhw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmOHlPcGZvN3o5aEZCcFdz
+            WlYydFdoQ0ZHbElMdTRkZWljMmoxTHZqNjJZCnE3cmgzKzZya3FROEczbHVveDND
+            VnEzRW12cnRKdzhkZm5uTXpkTEtrNUEKLS0tIHFDbkc4Mk4wVlM2R29zZXYwR2Ri
+            ODBML1p4eUZiZldYUERQTUhTU1llV0UKxjvH6zbW6wKghzR1o34CyKPEa2FqZmo0
+            PxgqyuXkIwas9soXVAkScx7ElaV09Fjaj+mDrKwi4a+DwdoSP7czyA==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age10nd382a9klsn2mrs60emdtsxe43pht3a0m9p29phfrhy0wfyt3vsq9r667
+          recipient: age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCNWRhK2QrV1ZibllqY25Y
-            ZVRPLzZ0TE82TWZ4L0w5ZmFPTDBtT0poODBnCkE5TWhJcXJjNkdva1hYZ3loeVdq
-            UlBXWHZpRUpMSGhPU0FIRi9JMEtTdGMKLS0tIE9yUk5Ebjk2MEFtNEkyR3RDcU51
-            ZVMwNnNRMlBMVVFlamU1U3JQSy9UT00KJZdEpRHuj4Dp1dGwP1z4xi9oddQOrQj2
-            qheEN/IlifVdZDpvlLUc8jgLzd/TO5EeEhVqfbdrlua8FHly29oTNw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0VDBXYUZNbnpEZHlqV05C
+            WWxQZjVYcWlZeXlGc0RiaUpERzR0T21CWWtBCkM0dW5kYlFNK1RGSzRudFZ2Z0t3
+            aVBreElGM1BIT0RzQkxTVTA3S2NhQncKLS0tIERyTU8zWWRTRm95SmRZQ1BhalVV
+            SVdBajN1V1BuM2s4K216S3c0VHczNlkKM5jvsSEfCBA5uZRjBJNbM91lLRQkj+jK
+            rM5uSfGLTvSjPgXIMIq03OXxH1CE7GoKxAPwFrJdAFMMQcutIethhw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
-    lastmodified: "2026-07-19T02:30:40Z"
-    mac: ENC[AES256_GCM,data:7+FeT6aeCGn+JFBXbPO0qP4BJ1nHPSennewv1kWkG+hOTIqs1ymuswUK1Hyfi6Z9h2umFX9HvK+o3qtmYvk6k7BUNe6w6QUHTNwm6lmNqrb7sgAE3iFVI2p9m14NGhgoTfnXx1M4JIZ1iuNYhCukpENI4+svIe+r7x5YeE5Evac=,iv:4AKAPI6upyAvHBr8BLWX7R/NupmJdcXdqiN8e0ZQ3ls=,tag:TkpfpCaLhn+Mx5cQZZuMdA==,type:str]
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvbk9tRE9jYkpxNThQeElH
+            dWpKYThDb1ZkUWtMWlRxc2tYbjhBbEFEcWtVCkNiK0NBRko2TkJQdUVtdGtHNGcv
+            andSaUlKSFA4THRyZXNTYmI0Yk5WbmsKLS0tIHlQTUtpWDdPeTVZL0M1RElRdFNk
+            QWlGdFo5NkZWSmY0YXdpNzNUQnlsK3MKtzC0bM7Ek+K73nMranOA1Mc98RUnYnq1
+            hAt0QEFKWK4QVKubaN/rG3AzE0U7qPKWHTzoxgnAiL3WyV9teLW+iA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age164px2a8e48ptsf9ngtan38aa6jls4jdl26mzrgzf6sn3vcvt49hqjrgr8w
+    lastmodified: "2026-07-19T23:30:21Z"
+    mac: ENC[AES256_GCM,data:kLGE2xawQT7mx+sfw68hmGk5nCEGiEjZrqTEl9B1dtQmTrMwmoVr/1RISi4LfJrwxy31mDgff4lcIL4wIJuM373uk3X8j4RNyYQNTfKEkORT6r8NHeepNs267O77pKGd7OmcM4MT/BqOnB8ELS7Wlf2ect7CAlvUUVyc8icxgZE=,iv:EYLDsHYHZ1XOQXafOTqHHWpk/OBNq/R6IJnOBYV33E4=,tag:thxrCPC5oGvDjhK7Dz87YA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1

secrets/server.yaml

@@ -3,20 +3,20 @@ sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxaFZURjAxMGRJZEJ5MW1x
-            ZjVwWEQrQlkwNmRibVNiL2RpTTFLeUVDQ3hRCkVIamVnZkM1MnlueloxMHVFQnBF
-            RjV2bnUrZUo4WGZJTmR4Y0xITkxRUkUKLS0tIGlJdVQ5MFBubVhxRUVMWW0wSGpP
-            UGdKNUNPYW9nek1UZ0tWbXd3QVNUNDgKIHOiKelITQdH5R4Nc3WF7mzz15D1f9on
-            VaTdr5qkf8LNNvPI0fxsXA9is5cqeg+KbDRHtUumEhNp6Zrf8zWBkw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBURmMzN3hrSlNrUkkvVWNl
+            L3M1dEhWeW14N0RFNVRPci9QK1YyTFdqRVVJCk5WaWswT2NicldkYzZjbVhYU2xu
+            MGFsNmUzeTN2TS9wOEdvRURpVUVYZXMKLS0tIDZ6MEdPTVhCaTQ2UXFWTUFtc0pm
+            MFlJb0c2WXJtMGRLZEZYY0pZWWpFWm8K/mlYZIe8UC0QU+1mq3NtrtTF5b2m5hCK
+            +K0QiZLTKmmDcr4bRhZ32VE7R7GRwtMNnOP/mElZvPAyWyHHhRiOHg==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age10nd382a9klsn2mrs60emdtsxe43pht3a0m9p29phfrhy0wfyt3vsq9r667
+          recipient: age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3N0hvV01naytDSWVwK1B1
-            MXM1ZkdpaVc2Q3FPV2VBcC83WmcvSjdGUGgwClJGSXZ6YW5JeFlValNJbjVhK29u
-            bUFqN2dRQTI4ZkwyeXNWYk5JeWVJRXcKLS0tIDlMMkNBUnNUSTJwVVFmc2dlcEZS
-            VGQ1VHR2dXB0M3RsalppVWxiUUROM0UKZM/4QDTam3LDTzjnDs41Ije50R7Q7GC4
-            IZbUZjs72rBzY8IkJDbN9JidadEc4NAtMOJwXiJbpZGiCBNfc8+SXw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBURHlUL0RNMUtNallEcG5p
+            eG4xby8yVzdQUTBaNkl4ano0YjBMcDd0Wm5NCkZvaXNPZm9wemJkMmNSdGdOaTI4
+            Z1RwUnhiRUpCMWZaeWtlSVBmNW5KOXMKLS0tIDk0R0k3ZHczTFNCWUZxSWF0M0FJ
+            MGlZMmtuSFYrcG1meDNMWDNqSjFxcE0KDu2dAc0gqmmPkpbpBe4YohM7rYmUwEkI
+            V2FUQwjlvh50svtjCVdYbx2xuq4sQLnKelk/q1onLw60FwsVfzD8sQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
     lastmodified: "2026-07-19T02:30:40Z"

variables.nix

@@ -0,0 +1,167 @@
+{
+  # Network / domains
+  lanDomain = "gitea.lan.ddnsgeek.com"; # Gitea/DDNS domain
+  homeDomain = "sweet.home"; # base LAN domain for service subdomains (pve., docker.)
+  tailnetDomain = "tail13f623.ts.net"; # Tailscale MagicDNS suffix
+  lanCidr = "192.168.2.0/24"; # LAN subnet
+  pxeServerIp = "192.168.2.247"; # pxe-boot host's LAN IP
+  pbsIp = "192.168.2.108"; # Proxmox Backup Server LAN IP
+
+  # Cross-host references (LAN hostnames/users other hosts reach over the network)
+  nixCacheHost = "nix-cache"; # substituter/remote-builder hostname
+  nfsServerHost = "server"; # NFS export source hostname
+  dockerHost = "docker"; # docker-compose stack host
+
+  # Raspberry Pi's own Tailscale hostname (not fronted by `server` — it
+  # exports its own NFS share directly). Resolved as
+  # "${raspberryPiHost}.${tailnetDomain}" in modules/raspi/mount-data.nix.
+  raspberryPiHost = "raspberrypi";
+
+  remoteBuilderUser = "nixremote"; # remote builder SSH user
+
+  # nix-cache's own SSH host public key (not a secret — the private half
+  # never leaves the host). Wired into every client's
+  # programs.ssh.knownHosts by modules/nix-cache/remote-builder-client.nix
+  # so distributed builds don't hit "Host key verification failed" on a
+  # fresh client that has never manually ssh'd to nix-cache before. Update
+  # this if nix-cache's host key is ever rotated or the host is rebuilt
+  # from scratch.
+  nixCacheHostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHrMKZlIGUd3pH9G3AqbsruqUGjxIXMAZw52u9MwiBCn lxc-nix-cache";
+
+  # Public keys authorized to SSH in as remoteBuilderUser on the nix-cache
+  # host (modules/nix-cache/server.nix) — one per client host that's allowed
+  # to use it as a distributed builder.
+  remoteBuilderAuthorizedKeys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAYIT9ormlmxZ0SziyDQaUntnKI8HK9/s3Qac1ZKjP2 root@docker"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
+  ];
+
+  # Admin SSH public key, authorized on the primary user of every host and
+  # the installer image's nixos/root users.
+  adminSshKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq/Q5LvIXlZwO2kdeAN5nLGZ59nZB7JHYMEszHxmNtGMzv1lM31jiPNsr0z2EKVZhE7OOfa2IF9rhWYD7JUA9G0yzdZ4WTXFNGVVOJoOVH6vAF3XCxoVilOEwTc7h2Wiy+rzd0B28/3spffzQQWJhY6GRQVa8j+6xAGF60Fcvl1vLosYT9Bn2ZbK4TCWOwAn2jqXIieGpZdn/UNZbGOeKRiCvhktDfMAzuQzN/9jMu/oF4pkPn2X1UrsQdNlvp0Ci8md612MozIpncQJyAF1ADhunr3sMx0isUXiqD29R5DS4TftpekqLNLak+zcxFa8N7DcRNp3DcKfJvyTkwQrR4r+b7lFLYOLHLagSso9CzeW/paAS2q9I5SBm/2DtE1diLLg2jZikYcstsu/G5RgvbzbKqjiaMwTdXC3AMvDxQrs7U5pDRZFzoofG3cpODbTm+uy3m0kP70z0M1K45UbDG0p+itnTu9x40JbQEgefbx38AItNvAIx1A8HO4I1VX28= wayne@stream";
+
+  # System
+  timeZone = "Australia/Brisbane";
+
+  # Main interactive user on every host. Every module that grants this user
+  # a group, a home directory, or tmpfiles ownership should reference
+  # vars.primaryUser rather than the literal "nixos", so renaming it is a
+  # one-line change.
+  primaryUser = "nixos";
+
+  # Storage
+  storageRoot = "/tank"; # ZFS pool root on `server`
+
+  # NFS datasets exported from `storageRoot` on `nfsServerHost` and mounted
+  # by client hosts. `subpath` is relative to `storageRoot` — combined with
+  # it to build both the export line in modules/build-types/server.nix and
+  # the "<nfsServerHost>:<storageRoot>/<subpath>" device string each client
+  # mount uses in modules/docker/mount-data.nix. `mountpoint` is the
+  # absolute local path clients mount it at, referenced by that same file's
+  # fileSystems attribute name plus every other place that needs to know
+  # where the share lives locally (modules/build-types/docker.nix's
+  # tmpfiles rules, modules/traefik/rotate-logs.nix's log path). Renaming a
+  # dataset or moving where it's mounted only needs changing it here — the
+  # export and every client reference follow automatically.
+  nfsShares = {
+    dockerConfig = {
+      subpath = "docker/config";
+      mountpoint = "/mnt/docker/config";
+    };
+    dockerDatabases = {
+      subpath = "docker/databases";
+      mountpoint = "/mnt/docker/databases";
+    };
+    dockerVolumes = {
+      subpath = "docker/volumes";
+      mountpoint = "/mnt/docker/volumes";
+    };
+    nextcloudData = {
+      subpath = "docker/nextcloud-data";
+      mountpoint = "/mnt/nextcloud-data";
+    };
+    raspiVolumes = {
+      subpath = "raspi/volumes";
+      mountpoint = "/mnt/raspi-backup";
+    };
+  };
+
+  # The Raspberry Pi's own NFS export — not under storageRoot/nfsServerHost,
+  # served directly by the Pi itself over Tailscale (see raspberryPiHost
+  # above) and mounted at raspiMountpoint by modules/raspi/mount-data.nix.
+  raspiNfsPath = "/home/raspi/raspi";
+  raspiMountpoint = "/mnt/raspi";
+
+  # Every literal port referenced from modules/ or hosts/, grouped by the
+  # service/host that opens or connects to it — kept as separate entries
+  # even where two happen to share a number today (e.g. nixCacheHttp and
+  # pxeBootHttp are both 80) so changing one service's port can never
+  # silently change an unrelated one.
+  ports = {
+    # nix-cache's nginx reverse proxy in front of nix-serve
+    # (modules/nix-cache/server.nix).
+    nixCacheHttp = 80;
+
+    # pxe-boot's nginx asset server, also used to build pxeBaseUrl
+    # (modules/build-types/pxe-boot.nix).
+    pxeBootHttp = 80;
+
+    # pxe-boot's atftpd TFTP server — UDP, not TCP
+    # (modules/build-types/pxe-boot.nix).
+    pxeBootTftp = 69;
+
+    # `server`'s NFS exports need both the portmapper (rpcbind) and the
+    # NFS data port itself opened (modules/build-types/server.nix).
+    nfsRpcbind = 111;
+    nfsd = 2049;
+
+    # Opened on the docker host's firewall for the Traefik-fronted
+    # container stack (docker-compose config lives in the separate
+    # /home/debian/docker repo, not here): 80/443 are Traefik's own
+    # HTTP/HTTPS listeners; 8080 is an additional exposed service whose
+    # exact backend isn't declared in this repo (modules/build-types/docker.nix).
+    dockerHttp = 80;
+    dockerHttps = 443;
+    dockerExtra = 8080;
+
+    # Beszel monitoring hub, reachable at
+    # http://<dockerHost>.<homeDomain>:<beszelHub> from every agent
+    # (modules/beszel/enable-agent.nix, hosts/nixos/home.nix).
+    beszelHub = 8090;
+
+    # Proxmox VE and Proxmox Backup Server web UIs, opened as desktop
+    # shortcuts on the gui build type (hosts/nixos/home.nix).
+    pveWeb = 8006;
+    pbsWeb = 8007;
+
+    # Tor relay's ORPort — the port other Tor relays connect to for onion
+    # routing traffic (modules/tor/enable-relay.nix). Tor's own conventional
+    # default; opened via services.tor.openFirewall rather than
+    # networking.firewall.allowedTCPPorts directly, but kept here anyway so
+    # it's not a bare literal duplicated between the relay's settings and
+    # anything else that ever needs to reference it.
+    torRelayOrPort = 9001;
+  };
+
+  # .raw disk image size for every proxmox-* host's standalone Disko image
+  # build (modules/disko/proxmox.nix, config.system.build.diskoImagesScript
+  # — see docs/proxmox-images.md). Root fills whatever's left after the ESP
+  # and swap partitions within this total.
+  proxmoxImageSize = "20G";
+
+  # nix-cache's Nix store garbage collection retention
+  # (modules/nix-cache/server.nix).
+  nixCacheGcMaxAge = "30d";
+
+  # Traefik access log rotation, watched on the docker host at
+  # nfsShares.dockerVolumes.mountpoint (modules/traefik/rotate-logs.nix).
+  traefikLogRotate = {
+    maxSize = "100M"; # rotate once a log file exceeds this size
+    keep = 20; # number of rotated logs to retain before deleting the oldest
+  };
+
+}