Production-grade, fully reproducible multi-host fleet (NAS, workstations, cloud endpoints) managed with Nix Flakes. Features a custom SSH Certificate Authority with automated rotation, age/SOPS secret encryption, automated self-upgrades, and a Taskfile control plane.
• Short-lived SSH certificates instead of authorized_keys clutter
• ZFS/Btrfs storage, ZRAM tmpfs IO diet, and hermetic CI/CD automation