sops: introduce sops-nix (age), ssh keys from encrypted tarball, .example secrets

secrets/network.yaml.example

@@ -0,0 +1,14 @@
+# Encrypt with: sops -e -i secrets/network.yaml
+# xray-endpoint: xray server IP (spliced into sing-box route rules at runtime)
+# route-exclude: JSON array of CIDRs excluded from the TUN (sing-box quote=false splice)
+# ssh-hosts:     ssh_config fragment, pulled in via Include /run/secrets/ssh-hosts
+xray-endpoint: 203.0.113.1
+route-exclude: '["203.0.113.1/32","198.51.100.7/32","10.20.0.0/24","fd69:69:69::/64"]'
+ssh-hosts: |
+  Host jump
+    HostName 10.20.0.10
+    AddressFamily inet
+
+  Host myserver.example.com myserver
+    HostName myserver.example.com
+    ProxyJump jump

secrets/wg0.conf.example

@@ -0,0 +1,12 @@
+# wg-quick config, sops-encrypted whole-file (format = "binary").
+# Same format for wg2.conf. Encrypt with: sops -e -i secrets/wg0.conf
+[Interface]
+PrivateKey = <client-private-key>
+Address = 10.20.0.2/24
+DNS = 10.20.0.1
+
+[Peer]
+PublicKey = <server-public-key>
+AllowedIPs = 10.20.0.0/24
+Endpoint = 198.51.100.7:51820
+PersistentKeepalive = 25

secrets/xray-config.json.example

@@ -0,0 +1,46 @@
+{
+  "inbounds": [
+    {
+      "port": 10808,
+      "protocol": "socks",
+      "settings": {
+        "udp": true
+      }
+    },
+    {
+      "port": 10809,
+      "protocol": "http"
+    }
+  ],
+  "outbounds": [
+    {
+      "protocol": "vless",
+      "settings": {
+        "vnext": [
+          {
+            "address": "203.0.113.1",
+            "port": 443,
+            "users": [
+              {
+                "id": "00000000-0000-0000-0000-000000000000",
+                "encryption": "mlkem768x25519plus.native.0rtt.<base64-client-key>",
+                "flow": "xtls-rprx-vision"
+              }
+            ]
+          }
+        ]
+      },
+      "streamSettings": {
+        "network": "tcp",
+        "security": "reality",
+        "realitySettings": {
+          "fingerprint": "chrome",
+          "serverName": "www.example.com",
+          "publicKey": "<reality-public-key>",
+          "shortId": "<short-id>",
+          "spiderX": "/"
+        }
+      }
+    }
+  ]
+}