Rename nixos-server to sunken-ship

- Rename hosts/nixos-server.nix -> sunken-ship.nix, nixos-server-hardware.nix -> sunken-ship-hardware.nix
- Flake: nixos-server -> sunken-ship, update module path
- Set networking.hostName = sunken-ship in server configs
- Update AGENTS.md, nixos/readme.md, docs/ssh-and-secrets.md, TODO.md

Made-with: Cursor

nixos/hosts/sunken-ship.nix

@@ -0,0 +1,73 @@
+# NixOS server: hostname, user, SSH, auto-rebuild from dotfiles repo.
+#
+# One-time on server: clone repo to /etc/dotfiles (root needs git access).
+# If private repo: use SSH (ssh:// or git@) and add root's key to GitHub, or use HTTPS + token.
+# Then: sudo nixos-rebuild switch --flake /etc/dotfiles/nixos#sunken-ship
+# If sudo git is not found: sudo nix run nixpkgs#git -- -C /etc/dotfiles pull origin main
+# Timer runs every 15 min: git fetch, pull if origin/main changed, rebuild.
+{ config, lib, pkgs, ... }:
+
+let
+  dotfilesDir = "/etc/dotfiles";
+  flakeRef = "${dotfilesDir}/nixos#sunken-ship";
+in
+{
+  imports = [ ./sunken-ship-hardware.nix ];
+
+  networking.hostName = "sunken-ship";
+  time.timeZone = "Europe/Copenhagen";
+
+  boot.kernelParams = [ "consoleblank=60" ];  # blank TTY after 60s to reduce burn-in
+
+  # Turn off panel backlight after boot so the screen actually dims (consoleblank only blanks framebuffer).
+  # At the console, run: light -S 100  (or any 0–100) to restore brightness.
+  programs.light.enable = true;
+  systemd.services.server-backlight-off = {
+    description = "Turn off panel backlight after console idle (reduce burn-in)";
+    after = [ "multi-user.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig.Type = "oneshot";
+    script = ''
+      ${pkgs.coreutils}/bin/sleep 65
+      for d in /sys/class/backlight/*; do
+        [ -f "$d/brightness" ] && echo 0 > "$d/brightness" 2>/dev/null || true
+      done
+    '';
+  };
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  system.stateVersion = "24.11";
+
+  users.users.danny = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" "video" ];  # video: backlight control via light(1)
+    # SSH keys: push via scp, don't commit. NixOS does not manage authorized_keys so scp'd keys persist.
+    # Example: scp ~/.ssh/id_*_github.pub danny@server:/tmp/ then on server: mkdir -p ~/.ssh; cat /tmp/*.pub >> ~/.ssh/authorized_keys
+  };
+
+  services.openssh.enable = true;
+  environment.systemPackages = [ pkgs.git ];  # for clone/bootstrap and timer
+
+  # Pull dotfiles and rebuild if the repo has new commits.
+  systemd.services.dotfiles-rebuild = {
+    description = "Pull dotfiles and run nixos-rebuild if repo changed";
+    path = with pkgs; [ git nix ];
+    script = ''
+      set -euo pipefail
+      cd ${dotfilesDir}
+      git fetch origin
+      if [ "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" ]; then
+        exit 0
+      fi
+      git pull origin main
+      exec nixos-rebuild switch --flake ${flakeRef}
+    '';
+    serviceConfig.Type = "oneshot";
+  };
+
+  systemd.timers.dotfiles-rebuild = {
+    wantedBy = [ "timers.target" ];
+    timerConfig.OnCalendar = "*-*-* *:00/15:00";  # every 15 minutes
+    timerConfig.RandomizedDelaySec = "2min";
+  };
+}