clone and decrypt configuration on boot

kiosk.nix

@@ -38,6 +38,22 @@ in
     pulse.enable = true;
   };
 
+  systemd.services.cage-tty1.requires = [ "network-online.target" ];
+
+  systemd.services.clone-config = {
+    wantedBy = [ "multi-user.target" ];
+    requires = [ "network-online.target" ];
+    path = with pkgs; [ git git-crypt ];
+    script = ''
+      git clone ssh://git@inx.moe:245/Infinidoge/kiosk.git /etc/nixos
+      cd /etc/nixos
+      git-crypt unlock /etc/decryption.key
+    '';
+    serviceConfig.Type = "oneshot";
+  };
+
+  environment.etc."decryption.key".source = ./decryption.key;
+
   services.tailscale = {
     enable = true;
     extraUpFlags = [ "--advertise-tags" "tag:kiosk" ];