Add the step-agent NixOS module, and align with the upstream NUR layout

[tashian]

Pairs with smallstep/agent#1200, which is where the module is maintained. Merge that one first or together — its mirror workflow targets nixos-modules/step-agent.nix, the path this PR creates.

Why

Installing pkgs.step-agent gets you the binary and nothing that runs it — no service, no system user, no PKCS#11 socket, no polkit rules. Customers have been getting that from files.smallstep.com/step-agent.nix, an object uploaded to S3 by hand on 2026-07-30 with no copy in any repo and no review on changes. It belongs beside the systemd units it translates, so smallstep/agent owns it as extra/step-agent.nix; this repository is where it becomes public and importable.

What's here

• nixos-modules/step-agent.nix — the module, reconciled against the agent's current units (it now includes the PKCS#11 socket, and no longer orders the service after network-online.target, which was an EAP-TLS boot deadlock).
• modules/ → nixos-modules/, modules → nixosModules — modules/default.nix was still the untouched NUR template stub (one commit, "Initial commit"), and upstream nur-packages-template has since made this rename. Taking it now, while nothing depends on the old name, is cheaper than after we publish a URL.
• ci.nix / overlay.nix — both carry isReserved = n: n == "lib" || n == "overlays" || n == "modules". Without moving these, ci.nix would treat nixosModules as a package and try to build it, and overlay.nix would splice it into the overlay as one.
• flake.nix — exports nixosModules directly instead of only through legacyPackages.<system>. A NixOS module is the same expression on every platform and importing one shouldn't instantiate nixpkgs; this is what makes the import read imports = [ inputs.smallstep.nixosModules.step-agent ];.
• README.md — a NixOS module section. The existing walkthrough installs the package and stops, so it left users with a binary and no running agent.

Verification

Evaluated against nixos-unstable in a nixos/nix container:

nixos-modules attrs:              [ "step-agent" ]
default.nix:                      { hasNixosModules = true; hasOldModules = false; }
ci.nix buildPkgs:                 32          # nixosModules filtered, not built
module via eval-config.nix:       renders step-agent.service + step-agent-pkcs11.socket

Note

This repository has no LICENSE — it's public, unlicensed, and about to be the canonical place we point NixOS customers at. Worth settling separately; upstream's template ships MIT, but that's a call for someone else to make.

[tashian]

Follow-up from review: smallstep/agent#1202 fixes the module (package option so hosts can pin this repo's package, explicit bin/step-agent ExecStart since these derivations have pname step-agent-plugin and no meta.mainProgram, and list-merged allowUnfreePackages in place of the clobber-prone predicate). The last commit here syncs the mirrored copy byte-identically and documents the option in the README — merge order with the agent PR no longer matters for the module file.