site-config: dedupe cross-host values, fix stale dark-reader urls, drop desktop 1g hugepages

new site-config.nix holds values previously duplicated across hosts:
  domain, old_domain, contact_email, timezone, binary_cache (url + pubkey),
  dns_servers, lan (cidr + gateway), hosts.{muffin,yarn} (ip/alias/ssh_host_key),
  ssh_keys.{laptop,desktop,ci_deploy}.

threaded through specialArgs on all three hosts + home-manager extraSpecialArgs +
homeConfigurations.primary + serverLib. service-configs.nix now takes
{ site_config } as a function arg and drops its https namespace; per-service
domains (gitea/matrix/ntfy/mollysocket/livekit/firefox-sync/grafana) are
derived from site_config.domain. ~15 service files and 6 vm tests migrated.

breakage fixes rolled in:
 - home/progs/zen/dark-reader.nix: 5 stale *.gardling.com entries in
   disabledFor rewritten to *.sigkill.computer (caddy 301s the old names so
   these never fired and the new sigkill urls were getting dark-reader applied)
 - modules/desktop-common.nix: drop unused hugepagesz=1G/hugepages=3
   kernelParams (no consumer on mreow or yarn; xmrig on muffin still reserves
   its own via services/monero/xmrig.nix)

verification: muffin toplevel is bit-identical to pre-refactor baseline.
mreow/yarn toplevels differ only in boot.json kernelParams + darkreader
storage.js (nix-diff verified). deployGuardTest and fail2banVaultwardenTest
(latter exercises site_config.domain via bitwarden.nix) pass.

hosts/muffin/default.nix

@@ -5,6 +5,7 @@
   hostname,
   username,
   eth_interface,
+  site_config,
   service_configs,
   options,
   ...
@@ -79,16 +80,22 @@
   ];
 
   # Hosts entries for CI/CD deploy targets
-  networking.hosts."192.168.1.50" = [ "server-public" ];
-  networking.hosts."192.168.1.223" = [ "desktop" ];
+  networking.hosts.${site_config.hosts.muffin.ip} = [ site_config.hosts.muffin.alias ];
+  networking.hosts.${site_config.hosts.yarn.ip} = [ site_config.hosts.yarn.alias ];
 
-  # SSH known_hosts for CI runner (pinned host keys)
-  environment.etc."ci-known-hosts".text = ''
-    server-public ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFMjgaMnE+zS7tL+m5E7gh9Q9U1zurLdmU0qcmEmaucu
-    192.168.1.50 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFMjgaMnE+zS7tL+m5E7gh9Q9U1zurLdmU0qcmEmaucu
-    git.sigkill.computer ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFMjgaMnE+zS7tL+m5E7gh9Q9U1zurLdmU0qcmEmaucu
-    git.gardling.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFMjgaMnE+zS7tL+m5E7gh9Q9U1zurLdmU0qcmEmaucu
-  '';
+  # SSH known_hosts for CI runner (pinned host keys). All four names resolve to
+  # the same muffin host and therefore serve the same host key.
+  environment.etc."ci-known-hosts".text =
+    let
+      key = site_config.hosts.muffin.ssh_host_key;
+      names = [
+        site_config.hosts.muffin.alias
+        site_config.hosts.muffin.ip
+        "git.${site_config.domain}"
+        "git.${site_config.old_domain}"
+      ];
+    in
+    lib.concatMapStrings (n: "${n} ${key}\n") names;
 
   services.deployGuard.enable = true;
 
@@ -149,9 +156,6 @@
     };
   };
 
-  # Set your time zone.
-  time.timeZone = "America/New_York";
-
   hardware.graphics = {
     enable = true;
     extraPackages = with pkgs; [
@@ -183,10 +187,7 @@
   ];
 
   networking = {
-    nameservers = [
-      "1.1.1.1"
-      "9.9.9.9"
-    ];
+    nameservers = site_config.dns_servers;
 
     hostName = hostname;
     hostId = "0f712d56";
@@ -200,8 +201,7 @@
     interfaces.${eth_interface} = {
       ipv4.addresses = [
         {
-          address = "192.168.1.50";
-          # address = "10.1.1.102";
+          address = site_config.hosts.muffin.ip;
           prefixLength = 24;
         }
       ];
@@ -213,8 +213,7 @@
       ];
     };
     defaultGateway = {
-      #address = "10.1.1.1";
-      address = "192.168.1.1";
+      address = site_config.lan.gateway;
       interface = eth_interface;
     };
     # TODO! fix this

hosts/muffin/service-configs.nix

@@ -1,3 +1,4 @@
+{ site_config }:
 rec {
   zpool_ssds = "tank";
   zpool_hdds = "hdds";
@@ -206,15 +207,9 @@ rec {
     };
   };
 
-  https = {
-    certs = services_dir + "/http_certs";
-    domain = "sigkill.computer";
-    old_domain = "gardling.com"; # Redirect traffic from old domain
-  };
-
   gitea = {
     dir = services_dir + "/gitea";
-    domain = "git.${https.domain}";
+    domain = "git.${site_config.domain}";
   };
 
   postgres = {
@@ -278,19 +273,19 @@ rec {
 
   matrix = {
     dataDir = "/var/lib/continuwuity";
-    domain = "matrix.${https.domain}";
+    domain = "matrix.${site_config.domain}";
   };
 
   ntfy = {
-    domain = "ntfy.${https.domain}";
+    domain = "ntfy.${site_config.domain}";
   };
 
   mollysocket = {
-    domain = "mollysocket.${https.domain}";
+    domain = "mollysocket.${site_config.domain}";
   };
 
   livekit = {
-    domain = "livekit.${https.domain}";
+    domain = "livekit.${site_config.domain}";
   };
 
   syncthing = {
@@ -324,12 +319,12 @@ rec {
   };
 
   firefox_syncserver = {
-    domain = "firefox-sync.${https.domain}";
+    domain = "firefox-sync.${site_config.domain}";
   };
 
   grafana = {
     dir = services_dir + "/grafana";
-    domain = "grafana.${https.domain}";
+    domain = "grafana.${site_config.domain}";
   };
 
   trilium = {