update: switch Terraform to NixOS template workflow

- Point clone_template to nixos-template and trim cloud-init to Nix-safe hostname/DNS only
- Remove SSH/Tailscale cloud-init variables and workflow secret dependencies
- Add reusable NixOS template-base config with bootloader, Tailscale, fish, and utility packages

nixos/template-base/README.md

@@ -0,0 +1,27 @@
+# NixOS Proxmox Template Base
+
+This folder contains a minimal NixOS base config you can copy into a new
+template VM build.
+
+## Files
+
+- `flake.nix`: pins `nixos-24.11` and exposes one host config.
+- `configuration.nix`: base settings for Proxmox guest use.
+
+## Before first apply
+
+1. Replace `REPLACE_WITH_YOUR_SSH_PUBLIC_KEY` in `configuration.nix`.
+2. Add `hardware-configuration.nix` from the VM install:
+   - `nixos-generate-config --root /`
+   - copy `/etc/nixos/hardware-configuration.nix` next to `configuration.nix`
+
+## Build/apply example inside the VM
+
+```bash
+sudo nixos-rebuild switch --flake .#template
+```
+
+## Notes
+
+- This is intentionally minimal and avoids cloud-init assumptions.
+- If you want host-specific settings, create additional modules and import them.

nixos/template-base/configuration.nix

@@ -0,0 +1,60 @@
+{ lib, pkgs, ... }:
+
+{
+  imports =
+    lib.optional (builtins.pathExists ./hardware-configuration.nix)
+      ./hardware-configuration.nix;
+
+  networking.hostName = "nixos-template";
+  networking.useDHCP = lib.mkDefault true;
+  networking.nameservers = [ "1.1.1.1" "8.8.8.8" ];
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/sda";
+  };
+
+  services.qemuGuest.enable = true;
+  services.openssh.enable = true;
+  services.tailscale.enable = true;
+  services.openssh.settings = {
+    PasswordAuthentication = false;
+    KbdInteractiveAuthentication = false;
+    PermitRootLogin = "prohibit-password";
+  };
+
+  programs.fish.enable = true;
+
+  users.users.micqdf = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    shell = pkgs.fish;
+    openssh.authorizedKeys.keys = [
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDyfhho9WSqK2OWxizt45Q5KHgox3uVWDnbvMBJaDnRph6CZeKmzaS60/+HN/o7MtIm+q86TfdYeWJVt4erPEvrYN8AWfvCWi+hP2Y0l18wS8GEA+efEXyQ5CLCefraXvIneORObKetzO73bq0HytDRXDowc4J0NcbEFB7ncf2RqVTC6QRlNPRD3jHLkUeKXVmyteNgTtGdMz4MFHCC7xtzgL7kEuuHDEWuVhPkK+dkeGBejq+RzkYcd8v37L7NjFZCK91jANBVcQnTLQVUVVlMovVPyoaROn4N8KpIhb85SYZIJGUEKMhmCowb2NnZLJNC07qn8sz1dmNZO635aquuWMhZTevCySJjvIuMxDSffhBaAjkK1aVixMCW3jyzbpFIEG6FOj27TpcMnen6a0j0AecdCKgXI/Ezb08pj9qmVppAvJPyYoqN4OwHNHGWb8U2X3GghFesei8ZmBgch12RkIaXYxVzkNqv3FG4kAMFMEnGe4e6aqAAuDzUIkcjsPl2XrNJp+pxnPWDc7EMTKPUuKIcteXVDgCVgufQjPBO5/DgUyygLTzt8py9sZyyFDsqRAZ6E3IzBpxyWfUOoN81mUL6G31pZ/1b3YKpNs7DuqvP/aXIvb94o8KsLPQeoG7L2ulcOWX7I0yhlAgd8QUjhNoNq3mK/sQylq9Zy63GhQ=="
+    ];
+    # optional while testing noVNC login:
+    # initialPassword = "changeme123";
+  };
+
+  security.sudo.wheelNeedsPassword = false;
+
+  environment.systemPackages = with pkgs; [
+    btop
+    curl
+    dig
+    eza
+    fd
+    fzf
+    git
+    htop
+    jq
+    ripgrep
+    tree
+    unzip
+    vim
+    wget
+  ];
+
+  system.stateVersion = "24.11";
+}

nixos/template-base/flake.nix

@@ -0,0 +1,14 @@
+{
+  description = "Base NixOS config for Proxmox template";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+  };
+
+  outputs = { nixpkgs, ... }: {
+    nixosConfigurations.template = nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
+      modules = [ ./configuration.nix ];
+    };
+  };
+}