Move Forgejo NSC runtime into agenix

flake.nix

@@ -4,6 +4,10 @@
   inputs = {
     nixpkgs.url = "tarball+https://codeload.github.com/NixOS/nixpkgs/tar.gz/nixos-unstable";
     flake-utils.url = "tarball+https://codeload.github.com/numtide/flake-utils/tar.gz/main";
+    agenix = {
+      url = "tarball+https://codeload.github.com/ryantm/agenix/tar.gz/main";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     disko = {
       url = "tarball+https://codeload.github.com/nix-community/disko/tar.gz/master";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -14,7 +18,7 @@
     };
   };
 
-  outputs = { self, nixpkgs, flake-utils, disko, hcloud-upload-image-src }:
+  outputs = { self, nixpkgs, flake-utils, agenix, disko, hcloud-upload-image-src }:
     let
       supportedSystems = [
         "x86_64-linux"
@@ -29,6 +33,7 @@
           inherit system;
         };
         lib = pkgs.lib;
+        agenixPkg = agenix.packages.${system}.agenix;
         commonPackages = with pkgs; [
           cargo
           rustc
@@ -141,6 +146,7 @@
           packages =
             commonPackages
             ++ [
+              agenixPkg
               hcloudUploadImagePkg
               forgejoNscDispatcher
               forgejoNscAutoscaler
@@ -152,6 +158,7 @@
           packages =
             commonPackages
             ++ [
+              agenixPkg
               hcloudUploadImagePkg
             ]
             ++ lib.optionals (nscPkg != null) [ nscPkg ];
@@ -161,6 +168,7 @@
 
         packages =
           {
+            agenix = agenixPkg;
             hcloud-upload-image = hcloudUploadImagePkg;
             forgejo-nsc-dispatcher = forgejoNscDispatcher;
             forgejo-nsc-autoscaler = forgejoNscAutoscaler;
@@ -176,8 +184,10 @@
         system = "x86_64-linux";
         specialArgs = {
           inherit self;
+          agenixPackage = agenix.packages.x86_64-linux.agenix;
         };
         modules = [
+          agenix.nixosModules.default
           disko.nixosModules.disko
           ./nixos/hosts/burrow-forge/default.nix
         ];