feat: add agenix-rekey + remote-builder module for distributed builds

flake.nix

@@ -8,6 +8,10 @@
       inputs.darwin.follows = "";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    agenix-rekey = {
+      url = "github:oddlama/agenix-rekey";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     lix = {
       url = "git+https://git.lix.systems/lix-project/lix?ref=main";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -28,7 +32,7 @@
     };
   };
 
-  outputs = { self, nixpkgs, agenix, lix
+  outputs = { self, nixpkgs, agenix, agenix-rekey, lix
             , nixpkgs-uconsole, nixos-uconsole, nixos-raspberrypi
             , home-manager
             , ... }@inputs:
@@ -69,7 +73,6 @@
           mesonFlags = (old.mesonFlags or []) ++ [ "-Dskip_gtk_tests=true" ];
         });
         hyprland = prev.hyprland.override { wrapRuntimeDeps = false; };
-        # Boost MPI cannot cross-compile for aarch64 (no b2 alternatives)
         boost = prev.boost.override { useMpi = false; };
         xdg-desktop-portal-hyprland = prev.xdg-desktop-portal-hyprland.overrideAttrs (old: {
           preConfigure = (old.preConfigure or "") + ''
@@ -79,7 +82,6 @@
         });
       };
 
-      # RPI-specific pipewire libcamera fix (separate nixpkgs instance)
       uconsoleRpiPipewireOverlay = final: prev: {
         pipewire = prev.pipewire.overrideAttrs (old: {
           buildInputs = builtins.filter
@@ -91,7 +93,6 @@
         });
       };
 
-      # Shared uConsole CM5 module set — used by both toplevel and SD image
       uconsoleBaseModules = [
         {
           nixpkgs.buildPlatform = "x86_64-linux";
@@ -109,7 +110,6 @@
         nixos-raspberrypi.lib.inject-overlays-global
         nixos-uconsole.nixosModules.uconsole-cm5
         ./modules/nixos/hardware/uconsole-cm5-aio-v2.nix
-        # Cross-compiled Lix for uConsole
         ({ config, lib, pkgs, inputs, ... }: let
           lixCross = import inputs.nixpkgs-uconsole {
             localSystem = { system = "x86_64-linux"; };
@@ -119,8 +119,10 @@
         in { nix.package = lixCross.lix; })
         inputs.home-manager.nixosModules.home-manager
         agenix.nixosModules.default
+        agenix-rekey.nixosModules.default
         ./hosts/uconsole-cm5/configuration.nix
         ./hosts/uconsole-cm5/hardware-configuration.nix
+        ./modules/nixos/services/remote-builder.nix
         ./modules/nixos/services/wireguard-client.nix
         ./modules/nixos/security/ai-worker-restricted.nix
         ./users/gortium/gortium.nix
@@ -138,7 +140,7 @@
               nixpkgs.config.permittedInsecurePackages = [ "openclaw-2026.3.12" ];
               nix.package = lix.packages.${system}.default;
             }
-        inputs.home-manager.nixosModules.home-manager
+            inputs.home-manager.nixosModules.home-manager
             agenix.nixosModules.default
             ./hosts/lazyworkhorse/configuration.nix
             ./hosts/lazyworkhorse/hardware-configuration.nix
@@ -164,6 +166,7 @@
             }
             ./hosts/cyt-pi/configuration.nix
             ./hosts/cyt-pi/hardware-configuration.nix
+            ./modules/nixos/services/remote-builder.nix
             ./modules/nixos/services/wireguard-client.nix
             ./users/gortium/gortium.nix
           ];
@@ -180,6 +183,11 @@
         };
       };
 
+      agenix-rekey = agenix-rekey.configure {
+        userFlake = self;
+        nixosConfigurations = self.nixosConfigurations;
+      };
+
       devShells.${system}.default = devShell;
 
       packages.${system} = {