nixos: describe asxpio-services as a NixOS system

asxpio-services is to move from Debian with Docker to NixOS with
Podman. This is the target system; nothing is switched over yet.

One flake holds what was spread over cloud-init, Ansible roles and
hand-made units: network and WireGuard, users and SSH restrictions,
firewall, the weekly image prune, and the four container stacks
(Paper and Fossils Minecraft, SillyTavern, the Forgejo runner), each
as a systemd unit under Podman. The runner keeps running as a
container and starts jobs through Podman's Docker-compatible socket.

Secrets (WireGuard keys, RCON and CurseForge keys) are encrypted with
sops for the admin's age key and the server's SSH host key, so the
repository holds no plaintext secret and CI needs none of them.

Containers that own data wait for /opt/.restored. On a freshly
installed disk a game server would otherwise generate a new world
exactly where the restore is about to land.

Tried on a throwaway server (.#rehearsal): install with nixos-anywhere
keeping a given host key, secret decryption, all stacks, a real Paper
server stopping with a full save, what CI jobs need from the engine
(short image names, the nix-store volume, service containers by name,
a kaniko build, the socket inside a job), an update over SSH and a
reboot.

migration/ has the scripts that move the data through object storage,
and a workflow builds the system on every push and switches the host
on main.

Assisted-by: Claude:fable-5-2

.forgejo/workflows/nixos.yaml

@@ -0,0 +1,65 @@
+name: nixos
+
+# every push: build the system, so a broken config never reaches main
+# main:       then switch asxpio-services to it
+#
+# Secret: SSH_DEPLOY_KEY (user deploy). Service secrets are decrypted on
+# the server by sops-nix, so CI holds none of them.
+
+on:
+  push:
+    paths:
+      - 'nixos/**'
+      - '.forgejo/workflows/nixos.yaml'
+  workflow_dispatch:
+
+jobs:
+  asxpio-services:
+    runs-on: nix-latest
+    env:
+      NIX_CONFIG: |
+        experimental-features = nix-command flakes
+        build-users-group =
+        sandbox = false
+      NIXPKGS: github:NixOS/nixpkgs/0bb2eedc20e4739f29e8045034f2828ad7054f8f
+    steps:
+      - name: Prepare container for actions
+        run: nix-env -iA nixpkgs.nodejs_22
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build
+        working-directory: nixos
+        run: nix build .#nixosConfigurations.asxpio-services.config.system.build.toplevel --no-link --print-out-paths
+
+      - name: Set up SSH
+        if: github.ref == 'refs/heads/main'
+        env:
+          SSH_DEPLOY_KEY: ${{ secrets.SSH_DEPLOY_KEY }}
+        run: |
+          umask 077
+          mkdir -p ~/.ssh
+          printf '%s\n' "$SSH_DEPLOY_KEY" > ~/.ssh/id_ed25519
+          cp ansible/known_hosts ~/.ssh/known_hosts
+          # The runner's own host is reached through asxpio-ops: a job
+          # container connecting to its host arrives from a bridge
+          # address that sshd and the firewall refuse.
+          cat > ~/.ssh/config <<'EOF'
+          Host asxpio-services
+            HostName 10.10.0.20
+            User deploy
+            ProxyJump deploy@10.10.0.10
+          EOF
+
+      - name: Deploy
+        if: github.ref == 'refs/heads/main'
+        working-directory: nixos
+        run: >
+          nix shell "$NIXPKGS#nixos-rebuild" "$NIXPKGS#openssh" -c
+          nixos-rebuild switch --flake .#asxpio-services
+          --target-host asxpio-services --sudo
+
+      - name: Remove credentials
+        if: always()
+        run: rm -f ~/.ssh/id_ed25519