feat: custom kexec installer for headless install on read-only-root (ZimaOS)

- add nixos-images input; nixosConfigurations.kexec bakes in the ssh login key
- build via config.system.build.kexecInstallerTarball
- deploy: ./deploy kexec <host> streams the installer to /tmp and kexecs
- works around ZimaOS RO root where nixos-anywhere ssh-copy-id fails

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

flake.nix

@@ -11,9 +11,13 @@
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    nixos-images = {
+      url = "github:nix-community/nixos-images";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
-  outputs = { self, nixpkgs, disko, sops-nix, ... }@inputs:
+  outputs = { self, nixpkgs, disko, sops-nix, nixos-images, ... }@inputs:
     let
       system = "x86_64-linux";
     in
@@ -39,6 +43,23 @@
           specialArgs = { inherit inputs; };
           modules = [ ./jupiter/vm.nix ];
         };
+
+        # Custom kexec installer with our SSH key baked in, for headless install
+        # onto a box with a read-only root (ZimaOS) where nixos-anywhere can't
+        # ssh-copy-id. Build the tarball:
+        #   nix build .#nixosConfigurations.kexec.config.system.build.kexecInstallerTarball
+        # then scp it to the target's writable /tmp and run kexec/run (see README).
+        kexec = nixpkgs.lib.nixosSystem {
+          inherit system;
+          modules = [
+            nixos-images.nixosModules.kexec-installer
+            ({ ... }: {
+              users.users.root.openssh.authorizedKeys.keys = [
+                "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZpkPVhzi1zG5JI9hWyUgdyvNIQbp4ts4jw3idpMhhN erik@laptop"
+              ];
+            })
+          ];
+        };
       };
     };
 }