Nix-Base private

Foundation flake for the peterlodri-sec fleet.

• services.toml — all 73 services mapped
• SECRETS.md — secret normalization map
• vaked-infra — Cloudflare + DNS provisioning docs

• Hetzner — Linux control-plane + ephemeral runners
• dev-cx53 — remote dev workstation
• M3 MacBook — nix-darwin host
• Vaultwarden Pi — Debian artifacts

• modules/ — reusable NixOS modules
• crabcc-godfather, crabcc-mcp, benchmark,
• tailscale, builders, attic, sops-nix

• secrets/ — encrypted YAML per service
• Listmonk, Mastodon, Vaultwarden, OpenBao,
• Umami, Cap, OpenObserve, Uptime Kuma, Langfuse

• SWE Agent — E2B sandbox runner
• GitHub App Broker — token minting
• PR Dashboard — Tailscale/Bark triage

• ci/ — OVH throwaway-VM + reaper
• Cloud Build — browser-pool, dev-cx53, private-pool