feat(auth): streamline SOPS authentication and network configuration

- Replace age-based key decryption with automatic SSH host key support
- Simplify SSH configuration with consolidated host entries and enhanced security settings
- Upgrade home-manager to himmelblau for Microsoft Entra ID authentication
- Remove legacy agenix inputs and consolidate secrets to essential services only
- Add Cisco Secure Client overlay for enterprise VPN capabilities
- Update secrets.yaml to minimal configuration with gitea/github/hetzner services
- Expand system packages with tun module for VPN connectivity
- Add work directory setup for user development environment

work/cisco.nix

@@ -0,0 +1,92 @@
+{ config, lib, pkgs, self, ... }:
+
+# Cisco Secure Client (proprietary VPN client, successor to AnyConnect)
+#
+# Package: pkgs/cisco-secure-client — fetches the Linux pre-deployment .tgz
+# from archive.org and extracts the bundled .deb.
+#
+# The user can override the source by passing a different package:
+#   work.cisco.package = pkgs.cisco-secure-client.overrideAttrs (_: {
+#     src = /path/to/local/cisco-secure-client-linux64-5.1.17.3394-predeploy-deb-k9.tgz;
+#   });
+#
+# Reference: https://github.com/NixOS/nixpkgs/issues/265443
+
+let
+  cfg = config.work.cisco;
+in {
+  options.work.cisco = {
+    enable = lib.mkEnableOption "Cisco Secure Client" // {
+      default = true;
+    };
+
+    package = lib.mkOption {
+      description = "cisco-secure-client package to use";
+      type = lib.types.package;
+      default = pkgs.cisco-secure-client;
+      defaultText = "pkgs.cisco-secure-client";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      cfg.package
+    ];
+
+    # The vpnagentd binary has /opt/cisco/secureclient/ hardcoded for runtime
+    # config paths (openssl.cnf, ossl-modules/). Create a symlink to the Nix store.
+    systemd.tmpfiles.rules = [
+      "d /opt 0755 root root -"
+      "L+ /opt/cisco/secureclient - - - - ${cfg.package}/cisco/secureclient"
+    ];
+
+    # Load the tun module required by the VPN client
+    boot.kernelModules = [ "tun" ];
+
+    systemd.services.cisco-vpnagentd = {
+      description = "Cisco Secure Client VPN Agent Daemon";
+      # vpnagentd daemonizes itself; tracked via PID file.
+      after = [ "network-online.target" "NetworkManager.service" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "forking";
+        PIDFile = "/run/vpnagentd.pid";
+        # Use the wrapper (sets LD_LIBRARY_PATH) — the raw binary was restored
+        # from backup to preserve its embedded Cisco code signature, so it has
+        # no RPATH and needs the env var to find its bundled .so files.
+        ExecStart = "${cfg.package}/bin/vpnagentd";
+        Restart = "on-failure";
+        RestartSec = "5";
+
+        # Minimal capability set for VPN operation
+        CapabilityBoundingSet = [
+          "CAP_NET_ADMIN"
+          "CAP_NET_RAW"
+          "CAP_NET_BIND_SERVICE"
+          "CAP_DAC_OVERRIDE"
+          "CAP_SETUID"
+          "CAP_SETGID"
+          "CAP_CHOWN"
+          "CAP_FOWNER"
+        ];
+        AmbientCapabilities = [
+          "CAP_NET_ADMIN"
+          "CAP_NET_RAW"
+          "CAP_NET_BIND_SERVICE"
+          "CAP_DAC_OVERRIDE"
+          "CAP_SETUID"
+          "CAP_SETGID"
+          "CAP_CHOWN"
+          "CAP_FOWNER"
+        ];
+        DeviceAllow = [ "/dev/net/tun rw" ];
+        PrivateTmp = true;
+        ProtectSystem = "full";
+        ProtectHome = false;
+        NoNewPrivileges = false;
+      };
+    };
+  };
+}

work/default.nix

@@ -0,0 +1,12 @@
+{ config, lib, ... }: {
+  imports = [
+    ./overlay.nix
+    ./cisco.nix
+    ./himmelblau.nix
+  ];
+
+  # Create the work directory for the user
+  systemd.tmpfiles.rules = [
+    "d /home/someone/work 0755 someone users -"
+  ];
+}

work/himmelblau.nix

@@ -0,0 +1,47 @@
+{ config, lib, pkgs, inputs, ... }:
+
+# Himmelblau: Microsoft Entra ID authentication for Linux
+#
+# Authenticates Linux users against the digistate.nl Entra ID tenant.
+# Users log in with their Entra ID credentials via OIDC Device Authorization
+# Grant flow (browser-based) or the native PAM orchestrator.
+#
+# Requires:
+#   - A working Entra ID tenant with digistate.nl as a verified domain
+#   - An OIDC app registration (Himmelblau client) in the tenant
+#   - Network connectivity to login.microsoftonline.com
+#
+# References:
+#   - https://himmelblau-idm.org/docs/
+#   - https://github.com/himmelblau-idm/himmelblau
+
+let
+  cfg = config.work.himmelblau;
+in {
+  options.work.himmelblau = {
+    enable = lib.mkEnableOption "Himmelblau Entra ID authentication" // {
+      default = true;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.himmelblau = {
+      enable = true;
+      settings = {
+        domain = [ "digistate.nl" ];
+        # Uncomment and set to Entra ID group Object IDs or names to
+        # restrict which users can authenticate:
+        # pam_allow_groups = [ "ENTRA-GROUP-GUID-HERE" ];
+      };
+    };
+
+    # Himmelblau registers an NSS module (system.nssModules) for user/group lookups,
+    # which requires nscd to be enabled. Keep it on.
+    # services.nscd.enable = lib.mkForce false;
+
+    # Expose the aad-tool CLI for diagnostics and enrollment
+    environment.systemPackages = [
+      inputs.himmelblau.packages.${pkgs.system}.aad-tool
+    ];
+  };
+}

work/overlay.nix

@@ -0,0 +1,9 @@
+{ config, lib, pkgs, ... }:
+{
+  # Overlay to add cisco-secure-client to pkgs
+  nixpkgs.overlays = [
+    (self: super: {
+      cisco-secure-client = super.callPackage ./pkgs/cisco-secure-client {};
+    })
+  ];
+}