feat: scaffold mercury (rpi 3b+ aarch64 SD image) for DNS/DHCP

- nixosConfigurations.mercury: aarch64, sd-image-aarch64, imports common.nix
- static net placeholders (CHANGE-ME), hostname mercury
- DNS service left undecided: commented pihole (services.pihole-ftl) + adguardhome
- no sops yet (add with the service if it needs a secret)

flake.nix

@@ -46,6 +46,19 @@
           ];
         };
 
+        # mercury — Raspberry Pi 3B+ (aarch64), DNS/DHCP. Boots from an SD image:
+        #   nix build .#nixosConfigurations.mercury.config.system.build.sdImage
+        # (aarch64 build — needs binfmt/qemu on this x86 host, or a remote/aarch64
+        # builder; substitutes most paths from cache.nixos.org.)
+        mercury = nixpkgs.lib.nixosSystem {
+          system = "aarch64-linux";
+          specialArgs = { inherit inputs; };
+          modules = [
+            (nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64.nix")
+            ./hosts/mercury/configuration.nix
+          ];
+        };
+
         # VirtualBox test image. Build the OVA with:
         #   nix build .#nixosConfigurations.jupiter-vbox.config.system.build.virtualBoxOVA
         # NOTE: no disko here — the virtualbox-image module supplies the disk.

hosts/mercury/configuration.nix

@@ -0,0 +1,49 @@
+{ config, pkgs, lib, ... }:
+
+# mercury — Raspberry Pi 3B+ (aarch64). Network DNS + DHCP (+ adblock).
+# Boots from an SD image (see flake: nixosConfigurations.mercury), so there is
+# no disko / hardware-configuration here — the sd-image module provides them.
+{
+  imports = [
+    ../../common.nix           # shared base: user / ssh / nix / firewall
+    # ../../services/<dns>.nix  # add once the DNS service is chosen (below)
+  ];
+
+  networking.hostName = "mercury";
+
+  # ---- Static networking ----
+  # A DNS/DHCP server must have a fixed address. Fill in the Pi's real values
+  # (from `ip -brief a` / `ip route` on the running Pi). eth0 = the Pi's NIC.
+  networking.useDHCP = false;
+  networking.usePredictableInterfaceNames = false;   # keep it named eth0
+  networking.interfaces.eth0.ipv4.addresses = [
+    { address = "10.0.0.2"; prefixLength = 24; }      # CHANGE-ME: the Pi's IP
+  ];
+  networking.defaultGateway = { address = "10.0.0.1"; interface = "eth0"; };  # CHANGE-ME
+  # Upstream resolvers for the box itself (the adblock DNS forwards to these).
+  networking.nameservers = [ "1.1.1.1" "9.9.9.9" ];
+
+  # ---- DNS + adblock + DHCP — pick ONE, then open its ports below ----
+  #
+  # Option A: pihole (native module)
+  #   services.pihole-ftl = {
+  #     enable = true;
+  #     # dhcp, lists, upstreams, local records...
+  #   };
+  #
+  # Option B: AdGuard Home (native module, fully declarative)
+  #   services.adguardhome = {
+  #     enable = true;
+  #     settings = {
+  #       dns.upstream_dns = [ "1.1.1.1" "9.9.9.9" ];
+  #       # filters (adlists), rewrites (local DNS), dhcp static leases...
+  #     };
+  #   };
+  #
+  # Then open the ports this service needs:
+  #   networking.firewall.allowedTCPPorts = [ 53 80 ];   # DNS + web UI
+  #   networking.firewall.allowedUDPPorts = [ 53 67 ];   # DNS + DHCP
+
+  # Do not modify after first flash.
+  system.stateVersion = "26.05";
+}