t-266
Pull-based deployment system with S3 binary cache, manifest-driven systemd services, and Caddy reverse proxy. Enables deploying services without full NixOS rebuilds.