Nix-Vibe public snapshot (squashed history)

.gitignore

@@ -0,0 +1,22 @@
+# Nix build results
+result*
+
+# Tailscale authkey (unencrypted, should NOT be committed)
+hosts/richmond-server/tailscale_authkey.txt
+hosts/richmond-server/mcf-notices.env
+hosts/richmond-server/castopod-container.env
+hosts/richmond-server/castopod-api.env
+hosts/richmond-server/pihole.env
+
+# Local sops age keys (generated per-machine at deploy time)
+# The public key goes in .sops.yaml, encrypted secrets go in secrets.yaml
+/root/.config/sops/age/
+/var/lib/sops-nix/
+
+# Decrypted temporary sops files
+.*decrypted*
+
+extra-files/
+extra-files/**
+extra-files/
+extra-files/**