Add shell for nix

.envrc

@@ -1 +1,2 @@
 export SOPS_AGE_KEY_FILE="$(expand_path ./age.key)"
+use nix

.gitignore

@@ -1,3 +1,7 @@
 result*
 /secrets
-age.key
+age.key
+**/*.tmp.sops.yaml
+**/*.sops.tmp.yaml
+result
+.direnv

shell.nix

@@ -0,0 +1,34 @@
+# Shell for bootstrapping flake-enabled nix and home-manager
+{ pkgs ? let
+    # If pkgs is not defined, instantiate nixpkgs from locked commit
+    lock = (builtins.fromJSON (builtins.readFile ./flake.lock)).nodes.nixpkgs.locked;
+    nixpkgs = fetchTarball {
+      url = "https://github.com/nixos/nixpkgs/archive/${lock.rev}.tar.gz";
+      sha256 = lock.narHash;
+    };
+    system = builtins.currentSystem;
+    overlays = [ ]; # Explicit blank overlay to avoid interference
+  in
+  import nixpkgs { inherit system overlays; }
+, ...
+}:
+let
+in
+pkgs.mkShell {
+  # Enable experimental features without having to specify the argument
+  NIX_CONFIG = "experimental-features = nix-command flakes";
+
+  nativeBuildInputs = with pkgs; [
+    nix
+    home-manager
+    git
+    nil
+    nixpkgs-fmt
+    go-task
+    sops
+    pre-commit
+    gitleaks
+    mkdocs
+    mqttui
+  ];
+}