feat(nixos): integrate agent VM into host configurations

modules/agent/default.nix

@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./nix.nix
+    ./network.nix
+  ];
+}

modules/agent/network.nix

@@ -0,0 +1,29 @@
+{ pkgs, ... }:
+
+{
+  services.openssh.enable = true;
+
+  services.mihomo = {
+    enable = true;
+    tunMode = true;
+    configFile = "/etc/mihomo-config.yaml";
+  };
+
+  systemd.services.mihomo = {
+    after = [ "ssh-direct-route.service" ];
+    requires = [ "ssh-direct-route.service" ];
+  };
+
+  # Keep SSH replies outside the transparent proxy before Mihomo starts.
+  systemd.services.ssh-direct-route = {
+    description = "Keep SSH replies on the unmodified main routing table";
+    wantedBy = [ "multi-user.target" ];
+    before = [ "mihomo.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = "${pkgs.iproute2}/bin/ip rule add pref 8000 ipproto tcp sport 22 lookup main";
+      ExecStop = "${pkgs.iproute2}/bin/ip rule del pref 8000 ipproto tcp sport 22 lookup main";
+    };
+  };
+}

modules/agent/nix.nix

@@ -0,0 +1,13 @@
+{
+  nix.settings = {
+    experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+    substituters = [
+      "https://mirrors.cernet.edu.cn/nix-channels/store?priority=10"
+    ];
+  };
+
+  nixpkgs.config.allowUnfree = true;
+}