refactor: retire the aquamarine VM host

Aquamarine's services now run directly on kubevirt-youko, so the guest
definition is no longer needed:

- move its service modules to hosts/k8s/kubevirt-youko/aquamarine/ and
  drop the explicit import list, leaving aquamarine-services.nix with
  just its IP and secret groups
- delete the guest base, journald override, output entry and home config
- repoint the eval tests that read the guest's config to kubevirt-youko
- drop the now-dead 'aqua' colmena recipe and its image upload

The aqua KubeVirt VM itself is deleted separately; the name is kept in
the docs for a possible later test microvm/qemu-vm on idols-ai.

Justfile

@@ -230,15 +230,9 @@ youko mode="switch":
 upload-idols verbosity="normal":
   #!/usr/bin/env nu
   use {{utils_nu}} *; 
-  upload-vm aquamarine 80Gi {{verbosity}}
   upload-vm ruby 100Gi {{verbosity}}
   upload-vm kana 100Gi {{verbosity}}
 
-[linux]
-[group('homelab')]
-aqua mode="switch":
-  colmena apply {{mode}} --on '@aqua' --verbose --show-trace
-
 [linux]
 [group('homelab')]
 ruby mode="switch":

home/hosts/linux/idols-aquamarine.nix

@@ -1,3 +0,0 @@
-{
-  imports = [ ../../linux/core.nix ];
-}

hosts/idols-aquamarine/default.nix

@@ -1,88 +0,0 @@
-{
-  lib,
-  mylib,
-  myvars,
-  pkgs,
-  disko,
-  ...
-}:
-#############################################################
-#
-#  Aquamarine - A NixOS VM running on Proxmox/KubeVirt
-#
-#############################################################
-let
-  hostName = "aquamarine"; # Define your hostname.
-
-  inherit (myvars.networking) proxyGateway proxyGateway6 nameservers;
-  inherit (myvars.networking.hostsAddr.${hostName}) iface ipv4;
-  ipv4WithMask = "${ipv4}/24";
-in
-{
-  imports = (mylib.scanPaths ./.) ++ [
-    disko.nixosModules.default
-  ];
-
-  # supported file systems, so we can mount any removable disks with these filesystems
-  boot.supportedFilesystems = [
-    "ext4"
-    "btrfs"
-    "xfs"
-    #"zfs"
-    "ntfs"
-    "fat"
-    "vfat"
-    "exfat"
-  ];
-
-  # Maximum total amount of memory that can be stored in the zram swap devices (as a percentage of your total memory).
-  # Defaults to 1/2 of your total RAM. Run zramctl to check how good memory is compressed.
-  # This doesn’t define how much memory will be used by the zram swap devices.
-  zramSwap.memoryPercent = lib.mkForce 100;
-
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModprobeConfig = "options kvm_amd nested=1"; # for amd cpu
-
-  networking = {
-    inherit hostName;
-
-    # we use networkd instead
-    networkmanager.enable = false;
-    useDHCP = false;
-  };
-
-  networking.useNetworkd = true;
-  systemd.network.enable = true;
-
-  systemd.network.networks."10-${iface}" = {
-    matchConfig.Name = [ iface ];
-    networkConfig = {
-      Address = [ ipv4WithMask ];
-      # DNS = nameservers;
-      DNS = [ proxyGateway ];
-      DHCP = "ipv6"; # enable DHCPv6 only, so we can get a GUA.
-      IPv6AcceptRA = true; # for Stateless IPv6 Autoconfiguraton (SLAAC)
-      LinkLocalAddressing = "ipv6";
-    };
-    routes = [
-      {
-        Destination = "0.0.0.0/0";
-        Gateway = proxyGateway;
-      }
-      {
-        Destination = "::/0";
-        Gateway = proxyGateway6;
-        GatewayOnLink = true; # it's a gateway on local link.
-      }
-    ];
-    linkConfig.RequiredForOnline = "routable";
-  };
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "24.11"; # Did you read the comment?
-}

hosts/idols-aquamarine/journald.nix

@@ -1,8 +0,0 @@
-{
-  # systemd-journal - reduce disk usage
-  # https://www.freedesktop.org/software/systemd/man/latest/journald.conf.html
-  services.journald.settings.Journal = {
-    SystemMaxUse = "2G";
-    RuntimeMaxUse = "256M";
-  };
-}

hosts/k8s/kubevirt-youko/aquamarine-services.nix

@@ -1,27 +1,12 @@
+{ ... }:
 {
-  mylib,
-  ...
-}:
-{
-  # aquamarine's services now run directly on this host, migrated off the
-  # KubeVirt VM. Its HDD disko config only defines the two data disks (no root
-  # disk), so it can be imported here as-is -- disko's NixOS module only
-  # generates the fileSystems/mounts, it never reformats.
-  imports = map mylib.relativeToRoot [
-    "hosts/idols-aquamarine/caddy.nix"
-    "hosts/idols-aquamarine/disko-fs.nix"
-    "hosts/idols-aquamarine/exporters"
-    "hosts/idols-aquamarine/gitea.nix"
-    "hosts/idols-aquamarine/grafana"
-    "hosts/idols-aquamarine/monitoring"
-    "hosts/idols-aquamarine/oci-containers"
-    "hosts/idols-aquamarine/postgresql.nix"
-    "hosts/idols-aquamarine/proxy.nix"
-    "hosts/idols-aquamarine/restic.nix"
-    "hosts/idols-aquamarine/sftpgo.nix"
-    "hosts/idols-aquamarine/transmission.nix"
-  ];
-
+  # aquamarine's service modules (caddy, gitea, grafana, monitoring, oci
+  # containers, postgresql, restic, sftpgo, transmission, and the HDD disko
+  # config) live in ./aquamarine/ and are auto-imported by this host's
+  # scanPaths. Its HDD disko config only defines the two data disks (no root
+  # disk), so it is imported as-is -- disko's NixOS module only generates the
+  # fileSystems/mounts, it never reformats.
+  #
   # keep aquamarine's IP on this host's bridge so its services and DNS keep
   # resolving after the migration (the NixOS list option merges with the .183)
   systemd.network.networks."10-br0".networkConfig.Address = [ "192.168.5.101/24" ];

hosts/k8s/kubevirt-youko/aquamarine/default.nix

@@ -0,0 +1,6 @@
+{ mylib, ... }:
+{
+  # aquamarine's service modules, moved here from the retired `hosts/idols-aquamarine`
+  # guest now that its services run directly on this host.
+  imports = mylib.scanPaths ./.;
+}

hosts/k8s/kubevirt-youko/aquamarine/disko-fs.nix

@@ -1,7 +1,7 @@
 # Auto disk partitioning (from repo root: nix-config):
-#   nix run github:nix-community/disko -- --mode destroy,format,mount hosts/idols-aquamarine/disko-fs.nix
+#   nix run github:nix-community/disko -- --mode destroy,format,mount hosts/k8s/kubevirt-youko/aquamarine/disko-fs.nix
 # Mount only (after first format):
-#   nix run github:nix-community/disko -- --mode mount hosts/idols-aquamarine/disko-fs.nix
+#   nix run github:nix-community/disko -- --mode mount hosts/k8s/kubevirt-youko/aquamarine/disko-fs.nix
 let
   cryptKeyFile = "/etc/agenix/hdd-luks-crypt-key";
   unlockDisk = "data-encrypted";

outputs/x86_64-linux/src/idols-aquamarine.nix

@@ -1,51 +0,0 @@
-{
-  # NOTE: the args not used in this file CAN NOT be removed!
-  # because haumea pass argument lazily,
-  # and these arguments are used in the functions like `mylib.nixosSystem`, `mylib.colmenaSystem`, etc.
-  inputs,
-  lib,
-  mylib,
-  myvars,
-  system,
-  genSpecialArgs,
-  ...
-}@args:
-let
-  # 星野 愛久愛海, Hoshino Akuamarin
-  name = "aquamarine";
-  tags = [
-    "aqua"
-    "homelab-network"
-  ];
-  ssh-user = "root";
-
-  modules = {
-    nixos-modules =
-      (map mylib.relativeToRoot [
-        # common
-        "secrets/nixos.nix"
-        "modules/nixos/server/server.nix"
-        "modules/nixos/server/kubevirt-hardware-configuration.nix"
-        # host specific
-        "hosts/idols-${name}"
-      ])
-      ++ [
-        { modules.secrets.server.application.enable = true; }
-        { modules.secrets.server.operation.enable = true; }
-        { modules.secrets.server.webserver.enable = true; }
-        { modules.secrets.server.storage.enable = true; }
-      ];
-    home-modules = map mylib.relativeToRoot [
-      "home/hosts/linux/idols-${name}.nix"
-    ];
-  };
-
-  systemArgs = modules // args;
-in
-{
-  nixosConfigurations.${name} = mylib.nixosSystem systemArgs;
-
-  colmena.${name} = mylib.colmenaSystem (systemArgs // { inherit tags ssh-user; });
-
-  packages.${name} = inputs.self.nixosConfigurations.${name}.config.system.build.images.kubevirt;
-}

outputs/x86_64-linux/tests/home-manager-xdg/expected.nix

@@ -5,7 +5,6 @@ in
 lib.genAttrs
   [
     "ai-niri"
-    "aquamarine"
     "ruby"
   ]
   (_: {

outputs/x86_64-linux/tests/home-manager-xdg/expr.nix

@@ -7,7 +7,6 @@ let
   username = myvars.username;
   hosts = [
     "ai-niri"
-    "aquamarine"
     "ruby"
   ];
 in

outputs/x86_64-linux/tests/security-aquamarine-metrics/expr.nix

@@ -3,7 +3,7 @@
   outputs,
 }:
 let
-  aqua = outputs.nixosConfigurations.aquamarine.config;
+  aqua = outputs.nixosConfigurations.kubevirt-youko.config;
 in
 {
   v2rayExporter = aqua.services.prometheus.exporters.v2ray.listenAddress;

outputs/x86_64-linux/tests/ups-metrics/expr.nix

@@ -5,7 +5,7 @@
 }:
 let
   shushou = outputs.nixosConfigurations.kubevirt-shushou.config;
-  aquamarine = outputs.nixosConfigurations.aquamarine.config;
+  aquamarine = outputs.nixosConfigurations.kubevirt-youko.config;
   ups = shushou.power.ups.ups.homelab or { };
   exporter = shushou.services.prometheus.exporters.nut;
   exporterService =