nixos-anywhere to create, deploy-rs to deploy. sops-nix for secrets. Works great.