nixos: migrate server services to thegeneralist

Move hosted services and secrets from the retired central hosts, persist USB storage and ownership, harden RTL8822BU Wi-Fi, repair DNS behavior, and order CoreDNS after Tailscale.

hosts/thegeneralist/cache/default.nix

@@ -0,0 +1,28 @@
+{ pkgs, config, ... }: let
+  domain = "cache.thegeneralist01.com";
+
+  ssl = {
+    quic        = true;
+    useACMEHost = "thegeneralist01.com";
+  };
+in {
+  age.secrets.cacheSigningKey.file = ./key.age;
+  services.nix-serve = {
+    enable = true;
+    package = pkgs.nix-serve-ng;
+    secretKeyFile = config.age.secrets.cacheSigningKey.path;
+    port = 1337;
+    openFirewall = false;
+  };
+
+  services.nginx.virtualHosts.${domain} = ssl // {
+    locations."/".proxyPass = "http://127.0.0.1:1337";
+    locations."= /".return = "301 @404";
+    locations."@404".return = "404 https://thegeneralist01.com/404";
+
+    extraConfig = /* nginx */ ''
+      proxy_intercept_errors on;
+      error_page 404 = @404;
+    '';
+  };
+}

hosts/thegeneralist/cache/key.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 pp9qdQ hxgD5olkewZpdkhEmVaGYypGzM403Xa7INBRzt78+kU
+LTj/042NIvyLcDA3VpWO6M+pdl2fhzjyXzA3jWP+III
+--- E7wuA8Hb4tpfvqQtPxexcGGK9ng/NVhI16XcErKVAFE
+-þŒüá8'ß|Ú<>dù²ùÊ#j9•(æ
+MAF+
‹[¼û’eNk_Ñ2\Ëƺ#d"øÅð§‹Òµw<PPU-­	»M¶G.Ôõ«
G/?™¾(qØ#{_C}IìJÚT…Ï»
+NHQãm¨ †^H¶´É¶<C389>ž­ òY±{aÈÙgfŽs“S›šø.À