Yeah, but no dark magic involved.
- build image
- copy to proxmox ISO store
- import, resize disk
- start, wait to come online
- read ssh pubkey, save it
- rekey secrets
- rebuild VM
The only "magic" parts are two nix modules for handling proper networking and hardware setup, and exposing required attributes to the script.
Works really well, zero manual config (beyond the services you want to run...) required on nix or proxmox side.
Can't believe noone mentioned this yet:
Any good password manager encrypts and decrypts your password file client side. The server should not even have the ability to read your passwords.
Even in the case of a leak of all of the server's data, as long as your password for the manager was good, you've got nothing to worry about.
I'd say pick a PW manager where both client and server are open source. Pick a strong passphrase. Enjoy.