Standardize system disk on LVM-on-LUKS for snapshot support.

Add dedicated parity disk and correct data disk mountpoints.
Resolve various Nix syntax errors in disk templates.
Set data disk filesystem to XFS for better large-file performance.

config-files/sops-nix/.sops.yaml

@@ -0,0 +1,9 @@
+# .sops.yaml
+
+keys:
+  - &primary $SOPS_PUBLIC_KEY
+creation_rules:
+  - path_regex: secrets/secrets.yaml$
+    key_groups:
+    - age:
+      - *primary

config-files/sops-nix/secrets.yaml

@@ -0,0 +1,35 @@
+ssh-public-keys: $SSH_PUBLIC_KEY
+
+docker:
+  nextcloud: |
+    DOMAIN_NAME=$DOMAIN_NAME
+    NEXTCLOUD_ENABLE_DRI_DEVICE=$TARGET_GRAPHICS
+  frigate: |
+    DOMAIN_NAME=$DOMAIN_NAME
+    FRIGATE_MQTT_USER=$HOME_ASSISTANT_MQTT_USER
+    FRIGATE_MQTT_PASSWORD=$HOME_ASSISTANT_MQTT_PASSWORD
+  traefik: |
+    DOMAIN_NAME=$DOMAIN_NAME
+    CF_DNS_API_TOKEN=$CF_DNS_API_TOKEN
+  hass: |
+    DOMAIN_NAME=$DOMAIN_NAME
+    HOME_ASSISTANT_MQTT_USER=$HOME_ASSISTANT_MQTT_USER
+    HOME_ASSISTANT_MQTT_PASSWORD=$HOME_ASSISTANT_MQTT_PASSWORD
+  passbolt: |
+    DOMAIN_NAME=$DOMAIN_NAME
+    TZ="Europe/Paris"
+    PASSBOLT_MYSQL_DATABASE=$PASSBOLT_MYSQL_DATABASE
+    PASSBOLT_MYSQL_USER=$PASSBOLT_MYSQL_USER
+    PASSBOLT_MYSQL_PASSWORD=$PASSBOLT_MYSQL_PASSWORD
+    SENDER_EMAIL_ADDRESS=$SENDER_EMAIL_ADDRESS
+    SENDER_EMAIL_ADDRESS_PASSWORD=$SENDER_EMAIL_ADDRESS_PASSWORD
+    SENDER_EMAIL_DOMAIN=$SENDER_EMAIL_DOMAIN
+    SENDER_EMAIL_PORT=$SENDER_EMAIL_PORT
+    EMAIL_ADDRESS=$EMAIL_ADDRESS
+  pihole: |
+    DOMAIN_NAME=$DOMAIN_NAME
+    TZ="Europe/Paris"
+    HOME_ROUTER_SUBNET=$HOME_ROUTER_SUBNET
+    HOME_ROUTER_IP=$HOME_ROUTER_IP
+    HOME_SERVER_IP=$HOME_SERVER_IP
+    FTLCONF_webserver_api_password=$FTLCONF_WEBSERVER_PASSWORD