feat(nixos): add control center host with hypervisor gitops service

nixos/hosts/izanagi/default.nix

@@ -0,0 +1,52 @@
+{ config, pkgs, ... }:
+
+{
+  networking.hostName = "izanagi";
+
+  homelab = {
+    # Enable the standard guest VM configuration
+    virtualisation.guest.enable = true;
+
+    # Enable standard GitOps for the Control Center itself
+    common.gitops.enable = true;
+    # We might pull from our Forgejo instance eventually, but for bootstrap
+    # it might need to pull from Github or the local Gitea if it's up.
+    # common.gitops.repoUrl = "https://git.depeuter.dev/Bos55/nix-config.git";
+
+    services = {
+      openssh.enable = true;
+
+      # Enable the Hypervisor GitOps service to provision OTHER VMs
+      hypervisor-gitops = {
+        enable = true;
+        repoUrl = "https://git.depeuter.dev/Bos55/nix-config.git";
+        pollInterval = "hourly";
+      };
+    };
+  };
+
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+    defaultSopsFormat = "yaml";
+    age.keyFile = "/var/lib/sops-age/keys.txt"; # Injected via Cloud-Init during Phase 4
+
+    secrets = {
+      proxmox_api_token.owner = "root";
+      forgejo_token.owner = "root";
+    };
+
+    templates."hypervisor-gitops.env".content = ''
+      PROXMOX_VE_API_TOKEN=${config.sops.placeholder.proxmox_api_token}
+      FORGEJO_TOKEN=${config.sops.placeholder.forgejo_token}
+      PROXMOX_VE_ENDPOINT=https://mikoshi:8006/
+      PROXMOX_VE_INSECURE=true
+    '';
+  };
+
+  # Make the secrets available to the hypervisor-gitops service via EnvironmentFile
+  systemd.services.hypervisor-gitops.serviceConfig.EnvironmentFile = [
+    config.sops.templates."hypervisor-gitops.env".path
+  ];
+
+  system.stateVersion = "24.05";
+}

nixos/hosts/izanagi/secrets.yaml

@@ -0,0 +1,5 @@
+# This is a placeholder SOPS file.
+# You must encrypt it with sops using your age key before deploying.
+# sops -e -i secrets.yaml
+proxmox_api_token: "PLACEHOLDER_TOKEN"
+forgejo_token: "PLACEHOLDER_TOKEN"