Do some restructuring and cleanup

.gitattributes

@@ -1,2 +1,3 @@
 *.yaml diff=sopsdiffer
+.pre-commit-config.yaml diff=default
 

.github/workflows/validate.yml

@@ -0,0 +1,27 @@
+name: Validate
+
+on:
+  pull_request:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: cachix/install-nix-action@v26
+        with:
+          extra_nix_config: |
+            trusted-users = root @runner
+
+      - name: Validate flake
+        run: nix flake show
+
+      - name: Check formatting
+        run: nix fmt -- --ci .
+
+      - name: Run deadnix
+        run: nix run nixpkgs#deadnix ./modules ./lib
+
+      - name: Run statix
+        run: nix run nixpkgs#statix check -- .

.pre-commit-config.yaml

@@ -0,0 +1,26 @@
+repos:
+  - repo: local
+    hooks:
+      - id: nixfmt
+        name: nixfmt
+        entry: nix
+        language: system
+        types: [nix]
+        pass_filenames: false
+        args: ["fmt"]
+
+      - id: deadnix
+        name: deadnix
+        entry: deadnix
+        language: system
+        types: [nix]
+        args: ["./modules", "./lib"]
+
+      - id: statix
+        name: statix
+        entry: statix
+        language: system
+        types: [nix]
+        pass_filenames: false
+        args: ["check", "."]
+

.sops.yaml

@@ -60,7 +60,7 @@ creation_rules:
     key_groups:
       - age:
           - *system_rainbow_planet
-  - path_regex: modules/hosts/common/secrets.yaml$
+  - path_regex: modules/shared/secrets.yaml$
     key_groups:
       - age:
           - *system_bigboy