You can do secrets management with agenix or sops-nix, but this should probably come way after setting up SSH.

I would also try to do a parallel modularization along with adding a second host. Try creating your own custom modules and learn a little about the Nix syntax.