nixos/portcullis: Add initial config

New bare-metal box headed for Nikhef, intended to take over most of
estuary's colony edge routing. This is the bootstrap config only: the
hardware, the single-NVMe ESP + LVM layout, and enough networking to
boot and be reachable.

It is being staged at home before it is racked, so it has no colony
assignments yet. Every 2.5G port takes DHCP and whichever one is
patched in brings the box up; kea registers the DHCP hostname, so the
deploy node points at portcullis.dyn.h.nul.ie until there is a real
colony FQDN for it.

The host key was adopted from the installer session and seeded onto
the persist volume before first boot, so my.secrets.key could be set
up front -- which makes portcullis a recipient of the user-passwd
secret that my.user declares for every box.

Documented with a box page, a row in the colony site index, and a note
in the colony section of networking.md that the topology is expected
to change once portcullis takes over from estuary.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/README.md

@@ -53,6 +53,8 @@ colony (physical VM host, ams1)
 ├── git ────── Gitea + Gitea Actions runner
 ├── mail ───── Debian VM running mailcow (not NixOS)
 └── darts ──── third-party/customer VM (opaque, not NixOS)
+
+portcullis (bare-metal edge box for Nikhef — staged, not yet in service)
 ```
 
 ## Site: home

docs/networking.md

@@ -266,6 +266,10 @@ On top of that: `p2pTunnels` (`10.100.5.0/24`) holds point-to-point tunnel /30s
 public blocks and the per-customer `mail` / `darts` / `jam` prefixes carry customer-facing
 services with their own public addresses (announced by BGP, routed via the host).
 
+This layout is expected to change: [`portcullis`](sites/colony/portcullis.md) is bare-metal edge
+hardware headed for Nikhef that will take over most of `estuary`'s routing. It has no assignments
+yet and the replacement topology is still being designed.
+
 ## home
 
 The home site prefixes (`lib.my.c.home.prefixes`) come from `192.168.64.0/18` and

docs/sites/colony/README.md

@@ -24,9 +24,13 @@ prefixes and routing overview are in the [`colony` section of networking.md](../
 | [`git`](git.md) | Gitea + Gitea Actions runner |
 | [`mail`](mail.md) | Debian VM running mailcow (not NixOS) |
 | [`darts`](darts.md) | Third-party/customer VM (not NixOS) |
+| [`portcullis`](portcullis.md) | Bare-metal edge box for Nikhef; being staged, not yet in service |
 
 The applications running on `shill` are listed on its own page — see
 [shill/README.md](shill/README.md#containers).
 
 `mail` and `darts` are host-defined VMs whose guest operating systems are managed out of band; their
 pages document only what this repository controls.
+
+`portcullis` is new hardware headed for Nikhef that will take over most of `estuary`'s edge routing.
+It is not deployed yet and the resulting topology is still being worked out.

docs/sites/colony/portcullis.md

@@ -0,0 +1,60 @@
+# portcullis
+
+A bare-metal box destined for Nikhef, intended to take over most of the colony edge
+routing currently done by the [`estuary`](estuary.md) VM.
+
+- **Source:** [`nixos/boxes/colony/portcullis/`](../../../nixos/boxes/colony/portcullis)
+- **Host:** bare metal
+- **nixpkgs:** `mine-stable`
+
+## Hardware
+
+| Component | Inventory |
+|---|---|
+| Platform | Mini PC (no vendor DMI strings) |
+| CPU | Intel N150 (4 cores / 4 threads) |
+| Memory | 8 GiB |
+| Storage | One 128 GB NVMe SSD (`nvme0n1`), partitioned as a 2 GiB ESP plus an LVM PV holding the `nix` and `persist` volumes |
+| Network | Four Intel I226-V 2.5 GbE ports (`et2g5-0`…`et2g5-3`) and one dual-port Intel 82599ES 10 GbE SFP+ card (`et10g-0`, `et10g-1`) |
+| Management | JetKVM (HDMI/USB KVM with virtual media) |
+
+## Role
+
+Not yet in service. The eventual job is to be the physical edge for the colony site at Nikhef,
+taking over most of what `estuary` does today — WAN termination, firewalling and NAT, BGP for
+AS211024 and DNS. Some of that functionality stays on `estuary`, and the surrounding network
+topology will change with the move, so the split is not settled yet. Until it is, the config in
+this repository covers only what is needed to boot and reach the box.
+
+## Network assignments
+
+`portcullis` has no static assignments yet. It is being staged at home before it is racked, so it
+takes DHCP on the home `lo` VLAN; the colony assignments land alongside the routing config once the
+topology is decided.
+
+## Networking
+
+- The four I226-V ports are named `et2g5-0`…`et2g5-3` and the 82599ES SFP+ ports `et10g-0` /
+  `et10g-1`, pinned by permanent MAC address in `.link` files.
+- Bootstrap only: a single `.network` matches every `et2g5-*` port and takes DHCP, so whichever
+  port happens to be patched in brings the box up. `wait-online.anyInterface` keeps boot from
+  blocking on the unpatched ports.
+- kea registers the DHCP hostname, so while staged the box answers to `portcullis.dyn.h.nul.ie` —
+  which is also what `my.deploy.node.hostname` points at, since there is no colony FQDN for it yet.
+
+## Storage
+
+A single NVMe SSD, following the usual tmpfs-root layout: a 2 GiB ESP at `/boot`, then one LVM PV
+in volume group `main` carrying `portcullis-nix` (48 GiB, `/nix`) and `portcullis-persist` (the
+remainder, `/persist`).
+
+## Secrets
+
+`my.secrets.key` is the SSH host key adopted from the installer session at install time (seeded onto
+the persist volume before first boot), so secrets could be encrypted for the box without waiting for
+it to come up. The box declares nothing of its own yet — only the default `user-passwd.txt` that
+`my.user` brings in.
+
+## Notable config files
+
+- [`nixos/boxes/colony/portcullis/default.nix`](../../../nixos/boxes/colony/portcullis/default.nix) — hardware, filesystems and bootstrap networking.