Reorganize imports

Signed-off-by: Nikolaos Karaolidis <nick@karaolidis.com>

hosts/common/configs/system/bluetooth/default.nix

@@ -0,0 +1,16 @@
+{ config, ... }:
+{
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+    settings = {
+      General.Experimental = true;
+    };
+  };
+
+  environment.persistence."/persist"."/var/lib/bluetooth" = { };
+
+  systemd.services.bluetooth.after = [
+    config.environment.persistence."/persist"."/var/lib/bluetooth".mount
+  ];
+}

hosts/common/configs/system/boot/default.nix

@@ -0,0 +1,20 @@
+{ pkgs, ... }:
+{
+  boot = {
+    loader = {
+      systemd-boot = {
+        enable = true;
+        editor = false;
+      };
+
+      timeout = 1;
+      efi.canTouchEfiVariables = true;
+    };
+    initrd.systemd.enable = true;
+    kernelPackages = pkgs.linuxPackages_latest;
+    supportedFilesystems = [
+      "btrfs"
+      "ntfs"
+    ];
+  };
+}

hosts/common/configs/system/brightnessctl/default.nix

@@ -0,0 +1,16 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [ brightnessctl ];
+
+  services.udev.extraRules =
+    let
+      chgrp = "${pkgs.coreutils}/bin/chgrp";
+      chmod = "${pkgs.coreutils}/bin/chmod";
+    in
+    ''
+      ACTION=="add", SUBSYSTEM=="backlight", RUN+="${chgrp} video /sys/class/backlight/%k/brightness"
+      ACTION=="add", SUBSYSTEM=="backlight", RUN+="${chmod} g+w   /sys/class/backlight/%k/brightness"
+      ACTION=="add", SUBSYSTEM=="leds",      RUN+="${chgrp} input /sys/class/leds/%k/brightness"
+      ACTION=="add", SUBSYSTEM=="leds",      RUN+="${chmod} g+w   /sys/class/leds/%k/brightness"
+    '';
+}

hosts/common/configs/system/btop/default.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [ btop ];
+}

hosts/common/configs/system/btrfs/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  services.btrfs.autoScrub = {
+    enable = true;
+    interval = "weekly";
+  };
+}

hosts/common/configs/system/cpu/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  imports = [ ./options.nix ];
+}

hosts/common/configs/system/cpu/options.nix

@@ -0,0 +1,17 @@
+{ lib, ... }:
+{
+  options.hardware.cpu =
+    with lib;
+    with types;
+    {
+      cores = mkOption {
+        type = ints.positive;
+        description = "The number of cpu cores.";
+      };
+
+      threads = mkOption {
+        type = ints.positive;
+        description = "The number of cpu threads.";
+      };
+    };
+}

hosts/common/configs/system/docker/default.nix

@@ -0,0 +1,29 @@
+{ config, pkgs, ... }:
+{
+  virtualisation.docker = {
+    enable = true;
+    enableOnBoot = false;
+    storageDriver = "btrfs";
+
+    daemon.settings = {
+      experimental = true;
+      ipv6 = true;
+      fixed-cidr-v6 = "fd00::/80";
+    };
+
+    autoPrune = {
+      enable = true;
+      flags = [ "--all" ];
+    };
+  };
+
+  environment = {
+    persistence."/persist"."/var/lib/docker" = { };
+    systemPackages = with pkgs; [ docker-compose ];
+  };
+
+  systemd = {
+    services.docker.after = [ config.environment.persistence."/persist"."/var/lib/docker".mount ];
+    sockets.docker.after = [ config.environment.persistence."/persist"."/var/lib/docker".mount ];
+  };
+}

hosts/common/configs/system/fastfetch/default.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [ fastfetch ];
+}

hosts/common/configs/system/getty/default.nix

@@ -0,0 +1,9 @@
+{ config, lib, ... }:
+{
+  services.getty.extraArgs = lib.mkIf (config.services.getty.autologinUser != null) [
+    "--skip-login"
+    "--noissue"
+    "--nohints"
+    "--nohostname"
+  ];
+}

hosts/common/configs/system/git/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  programs.git = {
+    enable = true;
+    lfs.enable = true;
+  };
+}

hosts/common/configs/system/gpg-agent/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  programs.gnupg.agent.enable = true;
+}

hosts/common/configs/system/impermanence/default.nix

@@ -0,0 +1,45 @@
+{ config, pkgs, ... }:
+{
+  imports = [ ./options.nix ];
+
+  boot.initrd.systemd = {
+    enable = true;
+
+    initrdBin = with pkgs; [
+      coreutils
+      util-linux
+      findutils
+      btrfs-progs
+    ];
+
+    services.impermanence = {
+      description = "Rollback BTRFS subvolumes to a pristine state";
+      wantedBy = [ "initrd.target" ];
+      before = [ "sysroot.mount" ];
+      after = [ "cryptsetup.target" ];
+      unitConfig.DefaultDependencies = false;
+      serviceConfig.Type = "oneshot";
+      environment.DEVICE = config.environment.impermanence.device;
+      script = builtins.readFile ./scripts/wipe.sh;
+    };
+  };
+
+  # uuidgen -r | tr -d -
+  # https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/administration/systemd-state.section.md
+  # https://github.com/NixOS/nixpkgs/pull/286140/files
+  # https://git.eisfunke.com/config/nixos/-/blob/e65e1dc21d06d07b454005762b177ef151f8bfb6/nixos/machine-id.nix
+  sops.secrets."machineId".mode = "0444";
+
+  environment = {
+    etc."machine-id".source = pkgs.runCommandLocal "machine-id-link" { } ''
+      ln -s ${config.sops.secrets."machineId".path} $out
+    '';
+
+    persistence."/persist" = {
+      "/etc/nixos" = { };
+      "/var/lib/nixos" = { };
+      "/var/lib/systemd" = { };
+      "/var/log" = { };
+    };
+  };
+}

hosts/common/configs/system/impermanence/options.nix

@@ -0,0 +1,258 @@
+{
+  config,
+  lib,
+  utils,
+  ...
+}:
+let
+  cfg = config.environment.persistence;
+
+  # ["/home/user/" "/.screenrc"] -> ["home" "user" ".screenrc"]
+  splitPath =
+    paths:
+    (builtins.filter (s: builtins.typeOf s == "string" && s != "") (
+      builtins.concatMap (builtins.split "/") paths
+    ));
+
+  # ["/home/user/" "/.screenrc"] -> "/home/user/.screenrc"
+  mergePaths =
+    paths:
+    let
+      prefix = lib.strings.optionalString (lib.strings.hasPrefix "/" (builtins.head paths)) "/";
+      path = lib.strings.concatStringsSep "/" (splitPath paths);
+    in
+    prefix + path;
+
+  # "/home/user/.screenrc" -> ["/home", "/home/user"]
+  parentsOf =
+    path:
+    let
+      prefix = lib.strings.optionalString (lib.strings.hasPrefix "/" path) "/";
+      split = splitPath [ path ];
+      parents = lib.lists.take ((lib.lists.length split) - 1) split;
+    in
+    lib.lists.foldl' (
+      state: item:
+      state
+      ++ [
+        (mergePaths [
+          (if state != [ ] then lib.lists.last state else prefix)
+          item
+        ])
+      ]
+    ) [ ] parents;
+in
+{
+  options.environment =
+    with lib;
+    with types;
+    {
+      impermanence.device = mkOption {
+        type = str;
+        default = config.disko.devices.disk.main.content.partitions.root.content.name;
+        description = ''
+          LUKS BTRFS partition to wipe on boot.
+        '';
+      };
+
+      persistence =
+        let
+          isPathLike = strings.hasPrefix "/";
+        in
+        mkOption {
+          type = (
+            addCheck (attrsOf (
+              attrsOf (
+                submodule (
+                  { name, config, ... }:
+                  {
+                    options = {
+                      enable = mkOption {
+                        type = bool;
+                        default = true;
+                        description = "Whether to enable the item.";
+                      };
+
+                      service = mkOption {
+                        type = str;
+                        readOnly = true;
+                        description = ''
+                          Systemd service that prepares and syncs the item.
+                          Can be used as a dependency in other units.
+                        '';
+                      };
+
+                      mount = mkOption {
+                        type = str;
+                        readOnly = true;
+                        description = ''
+                          Systemd mount that binds the item.
+                          Can be used as a dependency in other units.
+                        '';
+                      };
+
+                      _path = mkOption {
+                        type = str;
+                        internal = true;
+                        default = name;
+                      };
+
+                      _sourceRoot = mkOption {
+                        type = str;
+                        internal = true;
+                      };
+
+                      _source = mkOption {
+                        type = str;
+                        internal = true;
+                      };
+
+                      _targetRoot = mkOption {
+                        type = str;
+                        internal = true;
+                      };
+
+                      _target = mkOption {
+                        type = str;
+                        internal = true;
+                      };
+                    };
+                  }
+                )
+              )
+            )) (attrs: lists.all isPathLike (builtins.attrNames attrs))
+          );
+          apply =
+            ps:
+            builtins.mapAttrs (
+              persistence: items:
+              builtins.mapAttrs (
+                _: config:
+                let
+                  _path = config._path;
+
+                  _sourceRoot = persistence;
+
+                  _source = mergePaths [
+                    _sourceRoot
+                    _path
+                  ];
+
+                  _targetRoot =
+                    let
+                      parents = lists.reverseList (parentsOf _path);
+                    in
+                    lists.foldl' (
+                      acc: parent:
+                      if acc == "/" then
+                        lists.findFirst (
+                          otherPersistence: lists.any (other: parent == other) (builtins.attrNames ps.${otherPersistence})
+                        ) "/" (builtins.attrNames ps)
+                      else
+                        acc
+                    ) "/" parents;
+
+                  _target = mergePaths [
+                    _targetRoot
+                    _path
+                  ];
+                in
+                config
+                // {
+                  inherit
+                    _sourceRoot
+                    _source
+                    _targetRoot
+                    _target
+                    ;
+                  service = "${utils.escapeSystemdPath _target}.service";
+                  mount = "${utils.escapeSystemdPath _target}.mount";
+                }
+              ) items
+            ) ps;
+          default = { };
+          description = "Persistence config.";
+        };
+    };
+
+  config =
+    let
+      all = lib.lists.flatten (builtins.concatMap builtins.attrValues (builtins.attrValues cfg));
+    in
+    {
+      fileSystems = builtins.mapAttrs (_: _: { neededForBoot = true; }) cfg;
+
+      systemd = {
+        mounts = builtins.map (c: {
+          description = c._path;
+          requiredBy = [ "local-fs.target" ];
+          requires = [ c.service ];
+          bindsTo = [ c.service ];
+          after = [ c.service ];
+          unitConfig.ConditionPathExists = [ (lib.strings.escape [ " " ] c._source) ];
+          what = c._source;
+          where = c._target;
+          options = lib.strings.concatStringsSep "," ([
+            "bind"
+            "X-fstrim.notrim"
+            "x-gvfs-hide"
+          ]);
+        }) all;
+
+        services = builtins.listToAttrs (
+          builtins.map (c: {
+            name = utils.escapeSystemdPath c._target;
+            value = {
+              description = c._path;
+              after = [ "local-fs-pre.target" ];
+              requiredBy = [
+                "local-fs.target"
+                c.mount
+              ];
+              before = [
+                "local-fs.target"
+                c.mount
+                "umount.target"
+              ];
+              conflicts = [ "umount.target" ];
+              unitConfig = {
+                DefaultDependencies = false;
+                RefuseManualStart = true;
+                RefuseManualStop = true;
+              };
+              serviceConfig = {
+                Type = "oneshot";
+                RemainAfterExit = true;
+              };
+              script = ''
+                source=${lib.strings.escapeShellArg c._sourceRoot}
+                target=${lib.strings.escapeShellArg c._targetRoot}
+                path=${lib.strings.escapeShellArg c._path}
+
+                ${builtins.readFile ./scripts/start.sh}
+              '';
+              preStop = ''
+                source=${lib.strings.escapeShellArg c._sourceRoot}
+                target=${lib.strings.escapeShellArg c._targetRoot}
+                path=${lib.strings.escapeShellArg c._path}
+
+                ${builtins.readFile ./scripts/stop.sh}
+              '';
+            };
+          }) all
+        );
+      };
+
+      assertions =
+        let
+          paths = builtins.map (c: c._path) all;
+          duplicates = lib.lists.filter (t: lib.lists.count (o: o == t) paths > 1) (lib.lists.unique paths);
+        in
+        [
+          {
+            assertion = lib.lists.length duplicates == 0;
+            message = "Each target must be defined under a single persistence. Duplicate targets found: ${lib.concatStringsSep ", " duplicates}";
+          }
+        ];
+    };
+}

hosts/common/configs/system/impermanence/scripts/start.sh

@@ -0,0 +1,19 @@
+echo "Starting impermanence mount with source: ${source}, target: ${target}, path: ${path}."
+
+source_current="${source}"
+target_current="${target}"
+
+IFS='/' read -ra path_parts <<< "${path}"
+unset "path_parts[-1]"
+
+for part in "${path_parts[@]}"; do
+  source_current="${source_current}/${part}"
+  target_current="${target_current}/${part}"
+
+  if [[ ! -d "${source_current}" ]]; then
+    break
+  fi
+
+  read -r mode owner group <<< "$(stat -c '%a %u %g' "${source_current}")"
+  install -d -m "${mode}" -o "${owner}" -g "${group}" "${target_current}"
+done

hosts/common/configs/system/impermanence/scripts/stop.sh

@@ -0,0 +1,38 @@
+echo "Stopping impermanence mount with source: ${source}, target: ${target}, path: ${path}."
+
+source_current="${source}"
+target_current="${target}"
+
+IFS='/' read -ra path_parts <<< "${path}"
+unset "path_parts[-1]"
+
+for part in "${path_parts[@]}"; do
+  source_current="${source_current}/${part}"
+  target_current="${target_current}/${part}"
+
+  if [[ ! -d "${target_current}" ]]; then
+    break
+  fi
+
+  if [[ -d "${source_current}" ]]; then
+    continue
+  fi
+
+  read -r mode owner group <<< "$(stat -c '%a %u %g' "${target_current}")"
+  install -d -m "${mode}" -o "${owner}" -g "${group}" "${source_current}"
+done
+
+source=$(realpath -m "${source}/${path}")
+target=$(realpath -m "${target}/${path}")
+
+if [[ ! -e "${target}" ]] || { [[ -d "${target}" ]] && [[ -z "$(ls -A "${target}")" ]]; } || { [[ -f "${target}" ]] && [[ ! -s "${target}" ]]; }; then
+  exit 0
+fi
+
+if [[ -e "${source}" ]]; then
+  >&2 echo "Error: Source ${source} already exists. Cannot move ${target} to ${source}."
+  exit 1
+fi
+
+echo "Moving target ${target} to source ${source}."
+mv "${target}" "${source}"

hosts/common/configs/system/impermanence/scripts/wipe.sh

@@ -0,0 +1,30 @@
+delete_subvolume_recursively() {
+  IFS=$'\n'
+  for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
+    delete_subvolume_recursively "/mnt/btrfs/${i}"
+  done
+  btrfs subvolume delete "$1"
+}
+
+if [[ -z "$DEVICE" ]]; then
+  echo "Error: DEVICE variable is not set."
+  exit 1
+fi
+
+mkdir -p /mnt/btrfs
+mount "/dev/mapper/$DEVICE" /mnt/btrfs
+
+if [[ -e /mnt/btrfs/@ ]]; then
+  mkdir -p /mnt/btrfs/@.bak
+  timestamp=$(date --date="@$(stat -c %Y /mnt/btrfs/@)" "+%Y-%m-%d_%H:%M:%S")
+  mv /mnt/btrfs/@ "/mnt/btrfs/@.bak/${timestamp}"
+fi
+
+find /mnt/btrfs/@.bak/ -maxdepth 1 -mtime +14 | while IFS= read -r i; do
+  delete_subvolume_recursively "${i}"
+done
+
+btrfs subvolume create /mnt/btrfs/@
+
+umount /mnt/btrfs
+rmdir /mnt/btrfs

hosts/common/configs/system/libvirt/default.nix

@@ -0,0 +1,39 @@
+{ config, pkgs, ... }:
+{
+  virtualisation = {
+    libvirtd = {
+      enable = true;
+      qemu = {
+        swtpm.enable = true;
+        ovmf.packages = [ pkgs.OVMFFull.fd ];
+      };
+    };
+
+    spiceUSBRedirection.enable = true;
+  };
+
+  systemd.services.libvirtd-network-default = {
+    description = "Start Default Virtual Network for Libvirt";
+    script = "${config.virtualisation.libvirtd.package}/bin/virsh net-start default";
+    preStop = "${config.virtualisation.libvirtd.package}/bin/virsh net-destroy default";
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    wantedBy = [ "libvirtd.service" ];
+    after = [ "libvirtd.service" ];
+  };
+
+  environment = {
+    systemPackages = [ config.virtualisation.libvirtd.qemu.swtpm.package ];
+    etc = {
+      "ovmf/edk2-x86_64-secure-code.fd".source =
+        "${config.virtualisation.libvirtd.qemu.package}/share/qemu/edk2-x86_64-secure-code.fd";
+      "ovmf/edk2-i386-vars.fd".source =
+        "${config.virtualisation.libvirtd.qemu.package}/share/qemu/edk2-i386-vars.fd";
+    };
+    persistence."/persist"."/var/lib/libvirt" = { };
+  };
+
+  programs.virt-manager.enable = true;
+}

hosts/common/configs/system/lsof/default.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [ lsof ];
+}

hosts/common/configs/system/ncdu/default.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+{
+  environment = {
+    systemPackages = with pkgs; [ ncdu ];
+
+    etc."ncdu.conf".text = ''
+      -1
+      -e
+      -t 0
+      --confirm-quit
+    '';
+  };
+}

hosts/common/configs/system/neovim/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  programs.neovim = {
+    enable = true;
+    defaultEditor = true;
+    viAlias = true;
+    vimAlias = true;
+  };
+}

hosts/common/configs/system/networking/default.nix

@@ -0,0 +1,10 @@
+{ config, ... }:
+{
+  networking.networkmanager.enable = true;
+
+  environment.persistence."/persist"."/etc/NetworkManager/system-connections" = { };
+
+  systemd.services.NetworkManager.after = [
+    config.environment.persistence."/persist"."/etc/NetworkManager/system-connections".mount
+  ];
+}

hosts/common/configs/system/nix-cleanup/cleanup.sh

@@ -0,0 +1,41 @@
+if [[ "${EUID}" -ne 0 ]]; then
+  echo "Please run the script as root."
+  exit 1
+fi
+
+delete_subvolume_recursively() {
+  IFS=$'\n'
+  for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
+    delete_subvolume_recursively "/mnt/btrfs/${i}"
+  done
+  btrfs subvolume delete "$1"
+}
+
+if [[ -e /mnt/btrfs && -n $(mountpoint -q /mnt/btrfs) ]]; then
+  echo "/mnt/btrfs is already mounted. Exiting."
+  exit 1
+fi
+
+if [[ -z "$DEVICE" ]]; then
+  echo "Error: DEVICE variable is not set."
+  exit 1
+fi
+
+mkdir -p /mnt/btrfs
+mount "/dev/mapper/$DEVICE" /mnt/btrfs
+
+if [[ -e /mnt/btrfs/@.bak ]]; then
+  if [[ -n "$(ls -A /mnt/btrfs/@.bak)" ]]; then
+    for i in /mnt/btrfs/@.bak/*; do
+      delete_subvolume_recursively "${i}"
+    done
+  else
+    echo "/mnt/btrfs/@.bak is empty. Nothing to delete."
+  fi
+fi
+
+umount /mnt/btrfs
+rmdir /mnt/btrfs
+
+nix-collect-garbage -d
+nix-store --gc -v

hosts/common/configs/system/nix-cleanup/default.nix

@@ -0,0 +1,17 @@
+{ config, pkgs, ... }:
+{
+  environment.systemPackages = [
+    (pkgs.writeShellApplication {
+      name = "nix-cleanup";
+      runtimeInputs = with pkgs; [
+        coreutils
+        util-linux
+        findutils
+        btrfs-progs
+        nix
+      ];
+      runtimeEnv.DEVICE = config.environment.impermanence.device;
+      text = builtins.readFile ./cleanup.sh;
+    })
+  ];
+}

hosts/common/configs/system/nix-ld/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  programs.nix-ld = {
+    enable = true;
+    libraries = [ ];
+  };
+}

hosts/common/configs/system/nix/default.nix

@@ -0,0 +1,25 @@
+{ config, inputs, ... }:
+{
+  sops.secrets."nix/accessTokens/github" = {
+    sopsFile = ../../../../../secrets/personal/secrets.yaml;
+    group = "users";
+  };
+
+  nix = {
+    settings = {
+      use-xdg-base-directories = true;
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+    };
+
+    registry.self.flake = inputs.self;
+    gc.automatic = true;
+    optimise.automatic = true;
+
+    extraOptions = ''
+      !include ${config.sops.secrets."nix/accessTokens/github".path}
+    '';
+  };
+}

hosts/common/configs/system/nixpkgs/default.nix

@@ -0,0 +1,6 @@
+{ inputs, ... }:
+{
+  imports = [ inputs.nur.modules.nixos.default ];
+
+  nixpkgs.config.allowUnfree = true;
+}

hosts/common/configs/system/ntp/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.ntp.enable = true;
+}

hosts/common/configs/system/pipewire/default.nix

@@ -0,0 +1,20 @@
+{ ... }:
+{
+  services.pipewire = {
+    enable = true;
+    alsa = {
+      enable = true;
+      support32Bit = true;
+    };
+    pulse.enable = true;
+    jack.enable = true;
+    extraConfig.pipewire-pulse = {
+      pulse.cmd = [
+        {
+          cmd = "load-module";
+          args = "module-switch-on-connect";
+        }
+      ];
+    };
+  };
+}

hosts/common/configs/system/plymouth/default.nix

@@ -0,0 +1,27 @@
+{ pkgs, ... }:
+{
+  boot = {
+    plymouth =
+      let
+        theme = "connect";
+      in
+      {
+        enable = true;
+        inherit theme;
+        themePackages = with pkgs; [ (adi1090x-plymouth-themes.override { selected_themes = [ theme ]; }) ];
+      };
+
+    initrd.verbose = false;
+    consoleLogLevel = 0;
+
+    kernelParams = [
+      "quiet"
+      "loglevel=3"
+      "splash"
+      "boot.shell_on_fail"
+      "rd.systemd.show_status=false"
+      "rd.udev.log_level=3"
+      "udev.log_priority=3"
+    ];
+  };
+}

hosts/common/configs/system/powertop/default.nix

@@ -0,0 +1,5 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [ powertop ];
+  powerManagement.powertop.enable = true;
+}

hosts/common/configs/system/printing/default.nix

@@ -0,0 +1,36 @@
+{ pkgs, config, ... }:
+{
+  services = {
+    printing = {
+      enable = true;
+      openFirewall = true;
+      drivers = with pkgs; [
+        epson-escpr # Greece, Athens, Home
+      ];
+    };
+
+    avahi = {
+      enable = true;
+      nssmdns4 = true;
+      ipv6 = true;
+      nssmdns6 = true;
+      openFirewall = true;
+    };
+  };
+
+  environment.persistence."/persist" = {
+    "/var/lib/cups/ppd" = { };
+    "/var/lib/cups/printers.conf" = { };
+  };
+
+  systemd = {
+    services.cups.after = [
+      config.environment.persistence."/persist"."/var/lib/cups/ppd".mount
+      config.environment.persistence."/persist"."/var/lib/cups/printers.conf".mount
+    ];
+    sockets.cups.after = [
+      config.environment.persistence."/persist"."/var/lib/cups/ppd".mount
+      config.environment.persistence."/persist"."/var/lib/cups/printers.conf".mount
+    ];
+  };
+}

hosts/common/configs/system/ranger/default.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [ ranger ];
+}

hosts/common/configs/system/sops/default.nix

@@ -0,0 +1,15 @@
+{ inputs, pkgs, ... }:
+{
+  imports = [ inputs.sops-nix.nixosModules.sops ];
+
+  environment = {
+    persistence."/persist"."/etc/ssh/ssh_host_ed25519_key" = { };
+    systemPackages = with pkgs; [ sops ];
+  };
+
+  sops.age = {
+    generateKey = true;
+    sshKeyPaths = [ "/persist/etc/ssh/ssh_host_ed25519_key" ];
+    keyFile = "/var/lib/sops-nix/key.txt";
+  };
+}

hosts/common/configs/system/ssh/default.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  programs.ssh = {
+    knownHosts = {
+      installer.publicKeyFile = ../../../../installer/secrets/ssh_host_ed25519_key.pub;
+      eirene.publicKeyFile = ../../../../eirene/secrets/ssh_host_ed25519_key.pub;
+      elara.publicKeyFile = ../../../../elara/secrets/ssh_host_ed25519_key.pub;
+    };
+  };
+}

hosts/common/configs/system/system/default.nix

@@ -0,0 +1,17 @@
+{ inputs, ... }:
+{
+  system = {
+    autoUpgrade = {
+      enable = true;
+      flake = inputs.self.outPath;
+      flags = [
+        "--update-input"
+        "nixpkgs"
+        "-L"
+      ];
+      dates = "02:00";
+    };
+
+    stateVersion = "24.11";
+  };
+}

hosts/common/configs/system/timezone/default.nix

@@ -0,0 +1,14 @@
+{ lib, pkgs, ... }:
+{
+  networking.networkmanager.dispatcherScripts = [
+    {
+      source = lib.meta.getExe (
+        pkgs.writeShellApplication {
+          name = "timezone-sync";
+          runtimeInputs = with pkgs; [ curl ];
+          text = builtins.readFile ./timezone.sh;
+        }
+      );
+    }
+  ];
+}

hosts/common/configs/system/timezone/timezone.sh

@@ -0,0 +1,7 @@
+case "$2" in
+  connectivity-change)
+    if timezone=$(curl --fail https://ipapi.co/timezone); then
+      timedatectl set-timezone "${timezone}"
+    fi
+    ;;
+esac

hosts/common/configs/system/tlp/default.nix

@@ -0,0 +1,12 @@
+{ ... }:
+{
+  services.tlp = {
+    enable = true;
+    settings = {
+      CPU_SCALING_GOVERNOR_ON_AC = "performance";
+      CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
+      CPU_ENERGY_PERF_POLICY_ON_AC = "performance";
+      CPU_ENERGY_PERF_POLICY_ON_BAT = "power";
+    };
+  };
+}

hosts/common/configs/system/tmux/default.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  programs.tmux = {
+    enable = true;
+    clock24 = true;
+    historyLimit = 10000;
+    keyMode = "vi";
+    newSession = true;
+  };
+}

hosts/common/configs/system/tree/default.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [ tree ];
+}

hosts/common/configs/system/users/default.nix

@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+{
+  users = {
+    mutableUsers = false;
+    defaultUserShell = pkgs.zsh;
+  };
+
+  security.sudo.extraConfig = ''
+    Defaults lecture = never
+  '';
+}

hosts/common/configs/system/wget/default.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [ wget ];
+}

hosts/common/configs/system/zsh/default.nix

@@ -0,0 +1,12 @@
+{ ... }:
+{
+  programs.zsh = {
+    enable = true;
+    histFile = "/var/lib/zsh/history";
+  };
+
+  environment = {
+    persistence."/persist"."/var/lib/zsh" = { };
+    pathsToLink = [ "/share/zsh" ];
+  };
+}