Initial infra scaffold: watcher live on Infomaniak Public Cloud

- flake.nix exposes a devShell (openstackclient, opentofu, sops, age) plus
  nixosConfigurations.watcher (runtime) and packages.watcher-image (QCOW2
  via nixos-generators / openstack format).
- hosts/watcher/default.nix: SSH-only base, tyro user with key auth, root
  SSH disabled, trusted-users set so laptop closure pushes work.
- modules/website.nix: Caddy serves tyrolize.ch from sites/tyrolize.ch/;
  lize.ch 301-redirects; firewall opens 80/443. Let's Encrypt via HTTP-01.
- terraform/infomaniak/: OpenStack provider, security group (22/80/443),
  keypair, compute instance booted from the uploaded image. Auth via OS_*
  env vars sourced from terraform/infomaniak/.env by the devShell hook.
- scripts/build-image.sh + scripts/deploy.sh.
- dns/{tyrolize,lize}.ch.zone: full BIND zone files for the advanced view
  in Infomaniak DNS Manager; preserves kSuite mail records on lize.ch.

Watcher live at 195.15.203.200 (IPv6 2001:1600:10💯:b4e), NixOS 25.05.
HTTPS confirmed working on both domains.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

flake.nix

@@ -0,0 +1,64 @@
+{
+  description = "Personal infra on Infomaniak Public Cloud (OpenStack)";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+
+    sops-nix.url = "github:Mic92/sops-nix";
+    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
+
+    nixos-generators.url = "github:nix-community/nixos-generators";
+    nixos-generators.inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  outputs = { self, nixpkgs, sops-nix, nixos-generators, ... }:
+    let
+      system = "x86_64-linux";
+      pkgs = nixpkgs.legacyPackages.${system};
+    in {
+      # `nix develop` to enter a shell with every tool this repo needs.
+      devShells.${system}.default = pkgs.mkShell {
+        packages = with pkgs; [
+          openstackclient   # `openstack` CLI
+          opentofu          # `tofu` — drop-in for terraform, OSS license
+          jq
+          age
+          sops              # for sops-nix secrets
+        ];
+        shellHook = ''
+          if [ -f "$PWD/terraform/infomaniak/.env" ]; then
+            set -a; . "$PWD/terraform/infomaniak/.env"; set +a
+            echo "loaded terraform/infomaniak/.env"
+          fi
+        '';
+      };
+
+      # Runtime config — what the watcher box actually IS.
+      # Push updates with:
+      #   nixos-rebuild switch --flake .#watcher --target-host tyro@<ip> --use-remote-sudo
+      nixosConfigurations.watcher = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [
+          ({ modulesPath, ... }: {
+            imports = [
+              "${modulesPath}/virtualisation/openstack-config.nix"
+            ];
+          })
+          sops-nix.nixosModules.sops
+          ./hosts/watcher
+        ];
+      };
+
+      # Build a QCOW2 image of the watcher to upload to Infomaniak Glance:
+      #   nix build .#watcher-image
+      #   ls -lh result/nixos.qcow2
+      packages.${system}.watcher-image = nixos-generators.nixosGenerate {
+        inherit system pkgs;
+        format = "openstack";
+        modules = [
+          sops-nix.nixosModules.sops
+          ./hosts/watcher
+        ];
+      };
+    };
+}