Initial infra scaffold: watcher live on Infomaniak Public Cloud

- flake.nix exposes a devShell (openstackclient, opentofu, sops, age) plus
  nixosConfigurations.watcher (runtime) and packages.watcher-image (QCOW2
  via nixos-generators / openstack format).
- hosts/watcher/default.nix: SSH-only base, tyro user with key auth, root
  SSH disabled, trusted-users set so laptop closure pushes work.
- modules/website.nix: Caddy serves tyrolize.ch from sites/tyrolize.ch/;
  lize.ch 301-redirects; firewall opens 80/443. Let's Encrypt via HTTP-01.
- terraform/infomaniak/: OpenStack provider, security group (22/80/443),
  keypair, compute instance booted from the uploaded image. Auth via OS_*
  env vars sourced from terraform/infomaniak/.env by the devShell hook.
- scripts/build-image.sh + scripts/deploy.sh.
- dns/{tyrolize,lize}.ch.zone: full BIND zone files for the advanced view
  in Infomaniak DNS Manager; preserves kSuite mail records on lize.ch.

Watcher live at 195.15.203.200 (IPv6 2001:1600:10💯:b4e), NixOS 25.05.
HTTPS confirmed working on both domains.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -0,0 +1,84 @@
+# remote_server
+
+Personal infrastructure on **Infomaniak Public Cloud** (OpenStack), end-to-end
+Swiss. A small always-on **watcher** VM plus, later, on-demand workers using
+the same OpenStack APIs.
+
+## Layout
+
+```
+.
+├── flake.nix                 # NixOS configs + watcher QCOW2 image package
+├── hosts/
+│   └── watcher/
+│       └── default.nix       # services, users, SSH; boot/disk via openstack-* modules
+├── terraform/
+│   └── infomaniak/           # OpenStack provider, security group, instance
+│       ├── main.tf
+│       ├── variables.tf
+│       ├── watcher.tf
+│       ├── outputs.tf
+│       ├── clouds.yaml.example
+│       └── .env.example
+├── scripts/
+│   ├── build-image.sh        # build QCOW2 → upload to Infomaniak Glance
+│   └── deploy.sh             # terraform apply → nixos-rebuild switch
+└── .sops.yaml                # secrets encryption rules
+```
+
+## First-time setup
+
+1. **Infomaniak Public Cloud project** — Manager → Public Cloud → create a
+   project. In the project's API access section, generate an
+   **application credential** and copy the ID + secret.
+2. **Fill `.env`** (gitignored, lives only in the repo — nothing in `~/.config`):
+   ```bash
+   cp terraform/infomaniak/.env.example terraform/infomaniak/.env
+   $EDITOR terraform/infomaniak/.env
+   ```
+   Paste `OS_APPLICATION_CREDENTIAL_ID`, `OS_APPLICATION_CREDENTIAL_SECRET`,
+   and `TF_VAR_ssh_public_key`.
+3. **Enter the dev shell** — brings in `openstack`, `terraform`, `jq`, `sops`
+   and auto-loads `.env`:
+   ```bash
+   nix develop
+   ```
+4. **Smoke-test auth and confirm catalogue defaults match**:
+   ```bash
+   openstack token issue
+   openstack flavor list | grep a2_ram4_disk20_perf1
+   openstack network list | grep ext-net1
+   ```
+5. **Paste your SSH public key** into `hosts/watcher/default.nix`
+   (`users.users.tyro.openssh.authorizedKeys.keys`).
+6. **Build & upload the watcher image** (~5 min the first time):
+   ```bash
+   ./scripts/build-image.sh
+   ```
+7. **Provision and deploy**:
+   ```bash
+   ./scripts/deploy.sh
+   ```
+
+After the script finishes: `ssh tyro@<ipv4>`.
+
+## Routine updates
+
+From inside `nix develop`, edit the flake, then push:
+
+```bash
+nixos-rebuild switch --flake .#watcher --target-host tyro@<ipv4> --use-remote-sudo
+```
+
+You only need to re-run `build-image.sh` if you want **fresh boots** to start
+from a current image (e.g. after a major NixOS bump).
+
+## DNS
+
+Managed at Infomaniak (registrar). After the watcher has IPs:
+
+- `tyrolize.ch` A/AAAA → watcher
+- `*.tyrolize.ch` A/AAAA → watcher (wildcard for subdomains served by Caddy)
+- `lize.ch` A/AAAA → watcher (for the 301 redirect to tyrolize.ch)
+- `lize.ch` MX/SPF/DKIM/DMARC → Infomaniak kSuite (auto-configured)
+- `tyrolize.ch` empty-SPF + DMARC `p=reject` (anti-spoofing on non-mail domain)