declared network.nix

docs/playbooks/add-secret.md

@@ -8,7 +8,8 @@
   1. Choose the correct secrets file from the map in `docs/constitution.md` and add the entry there (YAML, encrypted via sops-nix).
   2. If a private key or file path is required, specify `owner`, `group`, and target path consistent with the consuming module.
   3. In the consuming module, reference the secret under `config.sops.secrets.<name>` and guard with `lib.mkIf config.my.secureHost`.
-  4. For WireGuard entries, update `secrets/wireguard.yaml` and corresponding interface configuration under the target host.
+  4. For WireGuard entries, update `secrets/wireguard.yaml` and the
+     corresponding host-local network configuration under the target host.
   5. Avoid adding secrets for hosts with `secureHost = false`; instead route the workload to a secure host or skip enablement.
 - Validation:
   - Secret lives in the correct file and encrypts with SOPS; file ownership matches service user where applicable.