feat(nixos): migrate system configuration

configs/nixos/.sops.yaml

@@ -0,0 +1,34 @@
+# Recipients for the encrypted files under configs/nixos/secrets/.
+keys:
+  # A recipient of every file.
+  # One readable only by machines becomes unrecoverable once they are wiped.
+  # Adding a recipient requires decrypting first.
+  # No private half here, only in the operator's password manager.
+  - &admin age1m0pk94ysjlw3lmf6pyuv5l5pepvdjss8w0vxjv90dq6ndp02tdgsdwdvue
+  # Generated on the machine it names.
+  - &neogaia age14a04vphzjq74epfrz9a09wjw8lzchtru84awzuq2n45d8f42ychqjs89qe
+  - &pikachu age1wf5s0n0tgt6ld2ysgu9dc67mj8ylwecgl4utzg7hqwy3kut9zyms7aglmh
+
+creation_rules:
+  # Material belonging to one machine.
+  # No machine other than the one named is a recipient, so a host that is
+  # compromised cannot decrypt another's material.
+  - path_regex: configs/nixos/secrets/neogaia\.yaml$
+    key_groups:
+      - age:
+          - *admin
+          - *neogaia
+
+  - path_regex: configs/nixos/secrets/pikachu\.yaml$
+    key_groups:
+      - age:
+          - *admin
+          - *pikachu
+
+  # Material common to every machine, so it is stored once rather than per host.
+  - path_regex: configs/nixos/secrets/shared\.yaml$
+    key_groups:
+      - age:
+          - *admin
+          - *neogaia
+          - *pikachu