feat(auth): streamline SOPS authentication and network configuration

- Replace age-based key decryption with automatic SSH host key support
- Simplify SSH configuration with consolidated host entries and enhanced security settings
- Upgrade home-manager to himmelblau for Microsoft Entra ID authentication
- Remove legacy agenix inputs and consolidate secrets to essential services only
- Add Cisco Secure Client overlay for enterprise VPN capabilities
- Update secrets.yaml to minimal configuration with gitea/github/hetzner services
- Expand system packages with tun module for VPN connectivity
- Add work directory setup for user development environment

hosts/aesthetic/default.nix

@@ -168,40 +168,23 @@
 
   boot.loader.limine.bootMode = lib.mkDefault "bios";
 
-  # sops-nix configuration
+  # sops-nix configuration — uses SSH host keys automatically, no age key file needed
   sops = {
     defaultSopsFile = ./../../secrets/secrets.yaml;
-    age.keyFile = "/etc/age/keys.txt";
-    # Explicitly define secrets to ensure they're generated
     secrets = {
-      discordo = { owner = "someone"; group = "users"; mode = "0440"; };
-      openrouter = { owner = "someone"; group = "users"; mode = "0440"; };
-      github = { owner = "someone"; group = "users"; mode = "0440"; };
-      twt = { owner = "someone"; group = "users"; mode = "0440"; };
-      gemini = { owner = "someone"; group = "users"; mode = "0440"; };
-      context7 = { owner = "someone"; group = "users"; mode = "0440"; };
-      exa = { owner = "someone"; group = "users"; mode = "0440"; };
-      ssh_config = { owner = "someone"; group = "users"; mode = "0440"; };
       gitea_laptop = { owner = "someone"; group = "users"; mode = "0400"; };
+      github_laptop = { owner = "someone"; group = "users"; mode = "0400"; };
       hetzner_server = { owner = "someone"; group = "users"; mode = "0400"; };
     };
   };
 
-  environment.systemPackages = [pkgs.cryptsetup pkgs.age pkgs.nixd pkgs.apparmor-parser pkgs.xdg-desktop-portal-wlr];
+  nixpkgs.config.allowUnfree = true;
 
-  # Provide age private key for sops decryption at activation time
-  systemd.tmpfiles.rules = [
-    "d /etc/age 0700 root root -"
-    "w /etc/age/keys.txt 0600 root root - # created by activation script"
+  nixpkgs.overlays = [
+    (self: super: {
+      cisco-secure-client = super.callPackage ../../pkgs/cisco-secure-client {};
+    })
   ];
 
-  # Activation script to write age key
-  system.activationScripts.write-age-key = ''
-        cat > /etc/age/keys.txt << 'AGEEOF'
-    # created: 2026-07-12T10:20:38+02:00
-    # public key: age1n2kvnwdzrd5vw70wwmm90a4lg6wj3665egzpnz72r98epr0rhc0q3yp356
-    AGE-SECRET-KEY-1A49GYAG5AJWGW0XM7HWC8QFE6UUF0S3Z99T252SKX2JHW6NM0HDQESWAQC
-    AGEEOF
-        chmod 600 /etc/age/keys.txt
-  '';
+  environment.systemPackages = [pkgs.cryptsetup pkgs.age pkgs.nixd pkgs.apparmor-parser pkgs.xdg-desktop-portal-wlr];
 }

hosts/default.nix

@@ -24,7 +24,9 @@
     "${mod}/services/gnome-services.nix"
     "${mod}/core/limine.nix"
     "${home}"
+    "${self}/work"
     inputs.sops-nix.nixosModules.sops
+    inputs.himmelblau.nixosModules.himmelblau
   ];
 in {
   flake.nixosConfigurations = {