rename tree to modules

modules/boot.nix

@@ -0,0 +1,24 @@
+{ ... }:
+{
+  flake.nixosModules.boot = {
+    boot = {
+      loader = {
+        efi.canTouchEfiVariables = true;
+        systemd-boot.enable = true;
+      };
+      plymouth.enable = false;
+      # consoleLogLevel = 0;
+      # initrd.verbose = false;
+      # kernelParams = [
+      #   "quiet"
+      #   "splash"
+      #   "boot.shell_on_fail"
+      #   "loglevel=3"
+      #   "rd.systemd.show_status=false"
+      #   "rd.udev.log_level=3"
+      #   "udev.log_priority=3"
+      # ];
+    };
+    system.stateVersion = "24.05";
+  };
+}

modules/deploy.nix

@@ -0,0 +1,87 @@
+{ ... }:
+{
+  flake.nixosModules.deploy =
+    {
+      config,
+      pkgs,
+      lib,
+      ...
+    }:
+    with lib;
+    let
+      cfg = config.c.services.remote-deploy;
+    in
+    {
+      options.c.services.remote-deploy = {
+        enable = mkEnableOption "Enable remote deployment with nixinate.";
+        host = mkOption {
+          type = types.str;
+          description = "Hostname to connect to.";
+        };
+        user = mkOption {
+          type = types.str;
+          default = "deploy";
+          description = "Username for deploy account.";
+        };
+        group = mkOption {
+          type = types.str;
+          default = "deploy";
+          description = "Group for deploy account.";
+        };
+        keys = mkOption {
+          type = types.listOf types.str;
+          description = "Authorised SSH keys for deployment";
+        };
+        port = mkOption {
+          type = types.port;
+          default = 22;
+          description = "SSH port to use.";
+        };
+        buildOn = mkOption {
+          type = types.enum [
+            "local"
+            "remote"
+          ];
+          default = "local";
+          description = "Where to build the config.";
+        };
+        substituteOnTarget = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Substitute closures and paths from remote";
+        };
+      };
+      config = mkIf cfg.enable {
+        _module.args = {
+          nixinate = {
+            inherit (cfg)
+              host
+              buildOn
+              port
+              substituteOnTarget
+              ;
+            sshUser = cfg.user;
+          };
+        };
+        users.groups."${cfg.group}" = { };
+        users.users."${cfg.user}" = {
+          isSystemUser = true;
+          shell = pkgs.bash;
+          inherit (cfg) group;
+          openssh.authorizedKeys.keys = cfg.keys;
+        };
+        nix.settings.trusted-users = [ cfg.user ];
+        security.sudo.extraRules = [
+          {
+            groups = [ cfg.group ];
+            commands = [
+              {
+                command = "ALL";
+                options = [ "NOPASSWD" ];
+              }
+            ];
+          }
+        ];
+      };
+    };
+}

modules/gpg-pinentry-wayland.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  flake.nixosModules.gpg-pinentry-wayland =
+    { pkgs, ... }:
+    {
+      services.dbus.packages = [ pkgs.gcr ];
+    };
+}

modules/hm.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  flake.nixosModules.hm =
+    { ... }:
+    {
+      home-manager.useGlobalPkgs = true;
+      home-manager.useUserPackages = true;
+    };
+}

modules/keys.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  flake.nixosModules.keys =
+    { lib, ... }:
+    {
+      options.keys = lib.mkOption {
+        default = import ../lib/keys.nix;
+      };
+    };
+}

modules/nix.nix

@@ -0,0 +1,32 @@
+{ inputs, ... }:
+{
+  flake.nixosModules.nix-config = {
+    nix = {
+      registry.nixpkgs.flake = inputs.nixpkgs;
+      registry.unstable.flake = inputs.unstable;
+      gc = {
+        automatic = true;
+        dates = "weekly";
+        options = "--delete-older-than 7d";
+      };
+      extraOptions = "gc-keep-outputs = true";
+      settings = {
+        experimental-features = [
+          "nix-command"
+          "flakes"
+          "auto-allocate-uids"
+        ];
+        auto-optimise-store = true;
+        auto-allocate-uids = true;
+        substituters = [
+          "https://nix-community.cachix.org"
+          "https://callumio-public.cachix.org"
+        ];
+        trusted-public-keys = [
+          "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+          "callumio-public.cachix.org-1:VucOSl7vh44GdqcILwMIeHlI0ufuAnHAl8cO1U/7yhg="
+        ];
+      };
+    };
+  };
+}

modules/secrets.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  flake.nixosModules.secrets =
+    { ... }:
+    {
+      imports = [ ../secrets/secrets-configuration.nix ];
+    };
+}

modules/tailscale.nix

@@ -0,0 +1,42 @@
+{ ... }:
+{
+  flake.nixosModules.tailscale =
+    {
+      config,
+      lib,
+      ...
+    }:
+    with lib;
+    let
+      cfg = config.c.services.mesh;
+    in
+    {
+      options.c.services.mesh = {
+        enable = mkEnableOption "Enable tailscale daemon.";
+        exitNode = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable advertising as an exit node.";
+        };
+        keyFile = mkOption {
+          type = types.path;
+          description = "Path to key file.";
+        };
+      };
+      config = mkIf cfg.enable {
+        services.tailscale = {
+          enable = true;
+          openFirewall = true;
+          authKeyFile = cfg.keyFile;
+          extraUpFlags = [
+            "--login-server"
+            "https://mesh.cleslie.uk"
+          ];
+          extraSetFlags = [ (mkIf cfg.exitNode "--advertise-exit-node") ];
+        };
+        networking.firewall = {
+          trustedInterfaces = [ config.services.tailscale.interfaceName ];
+        };
+      };
+    };
+}