Moving to modules. Structural changes.

config/profiles/common/access.nix

@@ -0,0 +1,16 @@
+{ config, lib, pkgs, ... }:
+
+{
+  security.sudo.wheelNeedsPassword = lib.mkForce false;
+
+  users.users.root = {
+    openssh.authorizedKeys.keys = with pkgs.lib;
+      concatLists (mapAttrsToList
+        (name: user:
+          if elem "wheel" user.extraGroups then
+            user.openssh.authorizedKeys.keys
+          else
+            [ ])
+        config.users.users);
+  };
+}

config/profiles/common/base16.nix

@@ -0,0 +1,10 @@
+{ config, ... }:
+
+{
+  base16 = {
+    console = {
+      enable = true;
+      scheme = "rebecca.rebecca";
+    };
+  };
+}

config/profiles/common/default.nix

@@ -0,0 +1,19 @@
+{ config, users, lib, pkgs, ... }:
+
+{
+  imports = [
+    users.kat.base
+    users.kairi.base
+    users.arc
+    users.hexchen
+    ./system.nix
+    ./base16.nix
+    ./net.nix
+    ./access.nix
+    ./locale.nix
+    ./nix.nix
+    ./ssh.nix
+    ./packages.nix
+    ./secrets.nix
+  ];
+}

config/profiles/common/locale.nix

@@ -0,0 +1,13 @@
+{ config, pkgs, ... }:
+
+{
+  fonts.fonts = [
+    pkgs.tamzen
+  ];
+  i18n.defaultLocale = "en_GB.UTF-8";
+  time.timeZone = "Europe/London";
+  console = {
+    packages = [ pkgs.tamzen ];
+    keyMap = "uk";
+  };
+}

config/profiles/common/net.nix

@@ -0,0 +1,5 @@
+{ config, lib, ... }:
+
+{
+  kw.nftables.enable = lib.mkDefault true;
+}

config/profiles/common/nix.nix

@@ -0,0 +1,21 @@
+{ config, lib, pkgs, sources, ... }:
+
+{
+  boot.loader.grub.configurationLimit = 8;
+  boot.loader.systemd-boot.configurationLimit = 8;
+
+  nix = {
+    nixPath = [
+      "nixpkgs=${sources.nixpkgs}"
+      "nur=${sources.nur}"
+      "arc=${sources.nixexprs}"
+      "ci=${sources.ci}"
+    ];
+    binaryCaches = [ "https://arc.cachix.org" "https://kittywitch.cachix.org" ];
+    binaryCachePublicKeys =
+      [ "arc.cachix.org-1:DZmhclLkB6UO0rc0rBzNpwFbbaeLfyn+fYccuAy7YVY=" "kittywitch.cachix.org-1:KIzX/G5cuPw5WgrXad6UnrRZ8UDr7jhXzRTK/lmqyK0=" ];
+    gc.automatic = lib.mkDefault true;
+    gc.options = lib.mkDefault "--delete-older-than 1w";
+    trustedUsers = [ "root" "@wheel" ];
+  };
+}

config/profiles/common/packages.nix

@@ -0,0 +1,14 @@
+{ config, lib, pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    smartmontools
+    hddtemp
+    lm_sensors
+    cachix
+    pinentry-curses
+    wezterm-terminfo
+    kitty.terminfo
+    gnupg
+  ];
+}

config/profiles/common/secrets.nix

@@ -0,0 +1,9 @@
+{ config, lib, pkgs, ... }:
+
+{
+  secrets = {
+    root = "/var/lib/kat/secrets";
+    persistentRoot = "/var/lib/kat/secrets";
+    external = true;
+  };
+}

config/profiles/common/ssh.nix

@@ -0,0 +1,26 @@
+{ config, lib, pkgs, ... }:
+
+{
+  kw.fw.public.udp.ranges = [{
+    from = 60000;
+    to = 61000;
+  }];
+  kw.fw.private.udp.ranges = [{
+    from = 60000;
+    to = 61000;
+  }];
+
+  services.openssh = {
+    enable = true;
+    ports = lib.mkDefault [ 62954 ];
+    passwordAuthentication = false;
+    challengeResponseAuthentication = false;
+    permitRootLogin = lib.mkDefault "prohibit-password";
+    kexAlgorithms = [ "curve25519-sha256@libssh.org" ];
+    extraConfig = ''
+      StreamLocalBindUnlink yes
+      LogLevel VERBOSE 
+    '';
+  };
+  programs.mosh.enable = true;
+}

config/profiles/common/system.nix

@@ -0,0 +1,9 @@
+{ config, lib, pkgs, ... }:
+
+{
+  boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
+  boot.tmpOnTmpfs = true;
+  boot.zfs.enableUnstable = true;
+  services.journald.extraConfig = "SystemMaxUse=512M";
+  users.mutableUsers = false;
+}