nix-flake-pentesting