The closing section still described key derivation from each machine's SSH
host key, a mechanism that was superseded because it forces new host keys
on every reimage and makes storing those keys as secrets circular.
Record the two-tier identity model that replaced it, and warn that the
hand-set bootstrap password stops working once the password becomes a
secret: hashedPasswordFile outranks every other password option, so a
machine installed after that must have its identity provisioned before
first boot rather than a password set afterwards.
The clone step named a repository that does not exist, so following the
procedure verbatim failed before reaching the install. The remote is
alexion/dotfiles.
Add docs/install.md, the operator runbook that turns the completed
neogaia Host into a running encrypted laptop from the NixOS live ISO:
push the flake to its remote, join wifi, clone the repo locally,
disko-install against neogaia with the chaotic substituter handed to the
install-time daemon, set the bootstrap login password by hand via
nixos-enter, and reboot.
