retire.nix

End-to-end bootstrap of a NixOS host via nixos-anywhere over Tailscale, covering Proxmox VM preparation (UEFI/OVMF), host config creation (disko, boot, network, users, sops, k3s), building a Tailscale-aware kexec image with static binaries for nixpkgs-unstable, sops secrets management, age key injection, remote building on a fast builder, and post-boot verification. Works when the target is only reachable over the tailnet.

**REQUIRED** - Always activate on any VCS operations. This repo uses Jujutsu (jj) — raw git commands can corrupt data. Essential jj workflow instructions inside. DO NOT IGNORE.

Use nh (not nixos-rebuild/darwin-rebuild/home-manager) for all Nix system switches, builds, and activations. Also governs terminal output rules — never truncate logs from builds or deploys.

Safely deploy NixOS config changes to this repo's k3s cluster nodes (chopper, c3po, kenobi) with deploy-rs, without wedging activation or breaking the HA control plane. Use whenever running `just deploy <host>` / `nix run .#deploy-rs` for chopper, c3po, or kenobi, or when a deploy got stuck ("Could not acquire lock", magic-rollback timeout, k3s/etcd unhealthy after a deploy).