refactor: get rid of config folder

profiles/hardware/aarch64-darwin.nix

@@ -0,0 +1,3 @@
+{ config, lib, ... }: with lib; {
+  nixpkgs.system = "aarch64-darwin";
+}

profiles/hardware/aarch64-linux.nix

@@ -0,0 +1,5 @@
+{ config, lib, ... }: with lib; {
+  nixpkgs.localSystem = systems.examples.aarch64-multiplatform // {
+    system = "aarch64-linux";
+  };
+}

profiles/hardware/amdgpu.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+{
+  deploy.profile.hardware.amdgpu = true;
+
+  boot.initrd.availableKernelModules = [ "amdgpu" ];
+  hardware.opengl.extraPackages = with pkgs; [ libvdpau-va-gl vaapiVdpau ];
+}

profiles/hardware/bamboo.nix

@@ -0,0 +1,30 @@
+{ config, lib, ... }: with lib; {
+  options = {
+    hardware.bamboo.display = mkOption {
+      type = types.str;
+    };
+    home-manager.users = let
+        userBambooExtend = { config, nixos, ... }: {
+          config = mkIf config.wayland.windowManager.sway.enable {
+            wayland.windowManager.sway.config.input = {
+              "1386:215:Wacom_BambooPT_2FG_Small_Pen" = {
+                map_to_output = nixos.hardware.bamboo.display;
+              };
+              "1386:215:Wacom_BambooPT_2FG_Small_Finger" = {
+                natural_scroll = "enabled";
+                middle_emulation = "enabled";
+                tap = "enabled";
+                dwt = "enabled";
+                accel_profile = "flat";
+                pointer_accel = "0.05";
+              };
+            };
+          };
+        };
+      in mkOption {
+      type = types.attrsOf (types.submoduleWith {
+        modules = singleton userBambooExtend;
+      });
+    };
+  };
+}

profiles/hardware/default.nix

@@ -0,0 +1,44 @@
+{ lib, tree, ... }: with lib; let
+  profiles = tree.prev;
+  appendedProfiles = with profiles; {
+    ms-7b86 = {
+      imports = [
+        ms-7b86
+        ryzen
+        amdgpu
+      ];
+    };
+    rm-310 = {
+      imports = [
+        rm-310
+        intel
+      ];
+    };
+    v330-14arr = {
+      imports = [
+        v330-14arr
+        ryzen
+        amdgpu
+        laptop
+        networkmanager
+      ];
+    };
+    x270 = {
+      imports = [
+        x270
+        intel
+        laptop
+        networkmanager
+        intel-gpu
+      ];
+    };
+    eeepc-1015pem = {
+      imports = [
+        eeepc-1015pem
+        intel
+        laptop
+      ];
+    };
+  };
+in
+profiles // appendedProfiles

profiles/hardware/eeepc-1015pem.nix

@@ -0,0 +1,19 @@
+{ config, ... }:
+
+{
+  deploy.profile.hardware.eeepc-1015pem = true;
+
+  boot = {
+    initrd = {
+      availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "usb_storage" "sd_mod" ];
+      kernelModules = [ ];
+    };
+    kernelModules = [ ];
+    extraModulePackages = [ ];
+    kernelParams = [
+      "usbcore.autosuspend=-1"
+      "acpi_osi=Linux"
+      "acpi_enforce_resources=lax"
+    ];
+  };
+}

profiles/hardware/hcloud-imperative.nix

@@ -0,0 +1,14 @@
+{ config, lib, inputs, ... }:
+
+/*
+  This hardware profile corresponds with the imperatively provisioned hetzner cloud box.
+*/
+
+with lib;
+
+{
+  deploy.profile.hardware.hcloud-imperative = true;
+
+  imports = [ (inputs.nixpkgs + "/nixos/modules/profiles/qemu-guest.nix") ];
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
+}

profiles/hardware/intel-gpu.nix

@@ -0,0 +1,11 @@
+{ config, pkgs, ... }: {
+  hardware.opengl = {
+    enable = true;
+    extraPackages = with pkgs; [
+      intel-media-driver
+      vaapiIntel
+      vaapiVdpau
+      libvdpau-va-gl
+    ];
+  };
+}

profiles/hardware/intel.nix

@@ -0,0 +1,15 @@
+{ config, ... }:
+
+/*
+  This hardware profile corresponds to any machine which has an Intel processor.
+*/
+
+{
+  deploy.profile.hardware.intel = true;
+
+  hardware.cpu.intel.updateMicrocode = true;
+
+  boot = {
+    kernelModules = [ "kvm-intel" ];
+  };
+}

profiles/hardware/laptop/default.nix

@@ -0,0 +1,11 @@
+{ ... }: {
+  imports = [
+    ({ config, ... }: {
+      deploy.profile.hardware.laptop = true;
+
+      imports = [
+        ./light.nix
+      ];
+    })
+  ];
+}

profiles/hardware/laptop/light.nix

@@ -0,0 +1,5 @@
+{ config, lib, pkgs, ... }:
+
+{
+  programs.light.enable = true;
+}

profiles/hardware/ms-7b86.nix

@@ -0,0 +1,14 @@
+{ config, lib, ... }:
+
+/*
+  This hardware profile corresponds to the MSI B450-A PRO MAX system.
+*/
+
+with lib;
+
+{
+  deploy.profile.hardware.ms-7b86 = true;
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
+  boot.kernelModules = [ "nct6775" ];
+}

profiles/hardware/networkmanager.nix

@@ -0,0 +1,59 @@
+{ config, lib, pkgs, ... }: with lib; {
+  options = {
+    home-manager.users = let
+      applets = { config, nixos, ... }: {
+        xsession.preferStatusNotifierItems = true;
+        services = {
+          network-manager-applet.enable = true;
+          blueman-applet.enable = true;
+        };
+      };
+    in mkOption {
+      type = types.attrsOf (types.submoduleWith {
+        modules = singleton applets;
+      });
+    };
+  };
+  config = {
+    systemd.services.NetworkManager-wait-online = {
+      serviceConfig.ExecStart = [ "" "${pkgs.networkmanager}/bin/nm-online -q" ];
+    };
+    hardware.bluetooth = {
+      enable = true;
+      settings = {
+        General = {
+          Enable = "Source,Sink,Media,Socket";
+        };
+      };
+    };
+    services.blueman.enable = true;
+    services.pipewire.media-session.config.bluez-monitor = {
+      properties = { };
+      rules = [
+        {
+          actions = {
+            update-props = {
+              "bluez5.a2dp-source-role" = "input";
+              "bluez5.auto-connect"  = [ "hfp_hf" "hsp_hs" "a2dp_sink" "a2dp_source" "hsp_ag" "hfp_ag" ];
+            };
+          };
+          matches = [ { "device.name" = "~bluez_card.*"; } ];
+        }
+        {
+          actions = {
+            update-props = { "node.pause-on-idle" = false; };
+          };
+          matches = [ { "node.name" = "~bluez_input.*"; } { "node.name" = "~bluez_output.*"; } ];
+        }
+      ];
+    };
+    networking = {
+      networkmanager = {
+        enable = true;
+        connectionConfig = {
+           "ipv6.ip6-privacy" = mkForce 0;
+        };
+      };
+    };
+  };
+}

profiles/hardware/oracle/common.nix

@@ -0,0 +1,287 @@
+{ config, tf, meta, kw, pkgs, lib, inputs, ... }: with lib; let
+  oci-root = meta.deploy.targets.oci-root.tf;
+  cfg = config.kw.oci;
+in
+{
+  options.kw.oci = {
+    base = mkOption {
+      description = ''
+        Canonical Ubuntu provides an EXT4 root filesystem.
+        Oracle Linux provides an XFS root filesystem.
+      '';
+      type = with types; enum [
+        "Canonical Ubuntu"
+        "Oracle Linux"
+      ];
+      default = "Canonical Ubuntu";
+    };
+    specs = {
+      shape = mkOption {
+        type = with types; nullOr str;
+        default = null;
+      };
+      cores = mkOption {
+        type = with types; nullOr int;
+        default = null;
+      };
+      ram = mkOption {
+        type = with types; nullOr int;
+        default = null;
+      };
+      space = mkOption {
+        type = with types; nullOr int;
+        default = null;
+      };
+    };
+    network = {
+      privateV4 = mkOption {
+        type = with types; nullOr int;
+        default = null;
+      };
+      publicV6 = mkOption {
+        type = with types; nullOr int;
+        default = null;
+      };
+    };
+    ad = mkOption {
+      description = ''
+        Availability Domain.
+        Important because, for example: EPYC instances can only be provisioned on AD2 in London.
+      '';
+      type = with types; nullOr int;
+      default = null;
+    };
+  };
+  imports = with import (inputs.tf-nix + "/modules"); [
+    nixos.oracle
+  ];
+  config =
+    let
+      interface = attrByPath [ cfg.specs.shape ] (throw "Unsupported shape") {
+        "VM.Standard.A1.Flex" = "enp0s3";
+        "VM.Standard.E2.1.Micro" = "ens3";
+      };
+    in
+    {
+      networking.interfaces =
+        {
+          ${interface} = {
+            useDHCP = true;
+            ipv6 = {
+              addresses = mkIf (config.network.addresses.public.nixos.ipv6.enable) [{
+                address = config.network.addresses.public.nixos.ipv6.address;
+                prefixLength = 64;
+              }];
+              routes = [{
+                address = "::";
+                prefixLength = 0;
+              }];
+            };
+          };
+        };
+
+      network = {
+        addresses = {
+          public =
+            let
+              addr_ipv6_nix =
+                let
+                  prefix = head (splitString "/" (oci-root.resources.oci_kw_subnet.importAttr "ipv6cidr_block"));
+                in
+                assert hasSuffix "::" prefix; prefix + toString config.kw.oci.network.publicV6;
+            in
+            {
+              enable = true;
+              nixos.ipv6.address = mkIf tf.state.enable addr_ipv6_nix;
+              nixos.ipv6.selfaddress = mkIf tf.state.enable addr_ipv6_nix;
+              tf.ipv6.address = tf.resources."${config.networking.hostName}_ipv6".refAttr "ip_address";
+            };
+        };
+        firewall.public.interfaces = singleton interface;
+        tf = {
+          enable = true;
+          ipv4_attr = "public_ip";
+        };
+      };
+
+      deploy.tf =
+        let
+          compartment_id = oci-root.resources.oci_kw_compartment.importAttr "id";
+          inherit (tf.lib.tf) terraformExpr;
+        in
+        {
+          deploy.systems."${config.networking.hostName}" = {
+            lustrate = {
+              enable = true;
+              connection = tf.resources."${config.networking.hostName}".connection.set;
+            };
+            connection = {
+              port = head config.services.openssh.ports;
+            };
+          };
+          providers.oci = {
+            inputs = {
+              tenancy_ocid = oci-root.outputs.oci_tenancy.import;
+              user_ocid = oci-root.resources.oci_kw_user.importAttr "id";
+              fingerprint = oci-root.resources.oci_kw_apikey.importAttr "fingerprint";
+              region = oci-root.outputs.oci_region.import;
+              private_key_path = oci-root.resources.oci_kw_key_file.importAttr "filename";
+            };
+          };
+          resources = mkMerge [{
+            cloudinit = {
+              provider = "cloudinit";
+              type = "config";
+              dataSource = true;
+              inputs = {
+                part = singleton {
+                  content_type = "text/cloud-config";
+                  content = "#cloud-config\n" + builtins.toJSON {
+                    disable_root = false;
+                  };
+                };
+              };
+            };
+            availability_domain = {
+              provider = "oci";
+              type = "identity_availability_domain";
+              dataSource = true;
+              inputs = {
+                inherit compartment_id;
+                ad_number = cfg.ad;
+              };
+            };
+            generic_image = {
+              provider = "oci";
+              type = "core_images";
+              dataSource = true;
+              inputs = {
+                inherit compartment_id;
+                inherit (tf.resources."${config.networking.hostName}".inputs) shape;
+                operating_system = cfg.base;
+                sort_by = "TIMECREATED";
+                sort_order = "DESC";
+              };
+            };
+            "${config.networking.hostName}_vnic" = {
+              provider = "oci";
+              type = "core_vnic_attachments";
+              dataSource = true;
+              inputs = {
+                inherit compartment_id;
+                instance_id = tf.resources."${config.networking.hostName}".refAttr "id";
+              };
+            };
+            "${config.networking.hostName}_ipv6" = {
+              provider = "oci";
+              type = "core_ipv6";
+              inputs = {
+                vnic_id = tf.resources."${config.networking.hostName}_vnic".refAttr "vnic_attachments[0].vnic_id";
+                display_name = config.networking.hostName;
+                ip_address = terraformExpr ''cidrhost("${oci-root.resources.oci_kw_subnet.importAttr "ipv6cidr_block"}", ${toString cfg.network.publicV6})'';
+              };
+            };
+            "${config.networking.hostName}" = {
+              provider = "oci";
+              type = "core_instance";
+              inputs = {
+                inherit compartment_id;
+                extended_metadata = { };
+                metadata = {
+                  ssh_authorized_keys = concatStringsSep "\n" config.users.users.root.openssh.authorizedKeys.keys;
+                  user_data = tf.resources.cloudinit.refAttr "rendered";
+                };
+                shape = cfg.specs.shape;
+                shape_config = {
+                  ocpus = cfg.specs.cores;
+                  memory_in_gbs = cfg.specs.ram;
+                };
+                source_details = {
+                  source_type = "image";
+                  source_id = tf.resources.generic_image.refAttr "images[0].id";
+                  boot_volume_size_in_gbs = cfg.specs.space; # min 50GB, up to 200GB free
+                };
+                create_vnic_details = [
+                  {
+                    assign_public_ip = true;
+                    subnet_id = oci-root.resources.oci_kw_subnet.importAttr "id";
+                    private_ip = terraformExpr ''cidrhost("${oci-root.resources.oci_kw_subnet.importAttr "cidr_block"}", ${toString cfg.network.privateV4})'';
+                    nsg_ids = [
+                      (tf.resources.firewall_group.refAttr "id")
+                    ];
+                  }
+                ];
+                availability_domain = tf.resources.availability_domain.refAttr "name";
+              };
+              lifecycle.ignoreChanges = [
+                "source_details[0].source_id"
+                "create_vnic_details[0].defined_tags"
+                "defined_tags"
+                "metadata"
+              ];
+              connection = {
+                type = "ssh";
+                user = "root";
+                host = tf.lib.tf.terraformSelf "public_ip";
+                timeout = "5m";
+              };
+            };
+            firewall_group = {
+              provider = "oci";
+              type = "core_network_security_group";
+              inputs = {
+                display_name = "${config.networking.hostName} firewall group";
+                inherit compartment_id;
+                vcn_id = oci-root.resources.oci_vcn.importAttr "id";
+              };
+            };
+          }
+            (
+              let
+                protoValues = {
+                  TCP = 6;
+                  UDP = 17;
+                };
+                inherit (config.networking) firewall;
+                ipv4 = "0.0.0.0/0";
+                ipv6 = "::/0";
+                mapPort = source: protocol: port: {
+                  provider = "oci";
+                  type = "core_network_security_group_security_rule";
+                  inputs = {
+                    network_security_group_id = tf.resources.firewall_group.refAttr "id";
+                    inherit protocol source;
+                    direction = "INGRESS";
+                    ${if protocol == protoValues.TCP then "tcp_options" else "udp_options"} = {
+                      destination_port_range =
+                        if isAttrs port then {
+                          min = port.from;
+                          max = port.to;
+                        } else {
+                          min = port;
+                          max = port;
+                        };
+                    };
+                  };
+                };
+                sourceProtos = cartesianProductOfSets {
+                  source = [ ipv4 ipv6 ];
+                  protocol = [ protoValues.TCP protoValues.UDP ];
+                };
+                mapPortswheeee = port: map ({ source, protocol }: mapPort source protocol port) sourceProtos;
+                rules = mapPortswheeee { from = 1; to = 65535; };
+                /*mapAll = protocol: port: [ (mapPort ipv4 protocol port) (mapPort ipv6 protocol port) ];
+                mapAllForInterface =
+                  let
+                    protos = [ "TCP" "UDP" ];
+                    types = [ "Ports" "PortRanges" ];
+                  in
+                  interface: concatMap (type: concatMap (proto: (concatMap (port: (mapAll protoValues.${proto}) port) interface."allowed${proto}${type}")) protos) types;
+                rules = concatMap mapAllForInterface ([ firewall ] ++ map (interface: firewall.interfaces.${interface}) config.network.firewall.public.interfaces);*/
+                # TODO: use `count` and index into a fancy json or something?
+              in
+              listToAttrs (imap0 (i: rule: nameValuePair "firewall${toString i}" rule) rules)
+            )];
+        };
+    };
+}

profiles/hardware/oracle/default.nix

@@ -0,0 +1,28 @@
+{ lib, inputs, tree, ... }: with lib; let
+  profiles = tree.prev;
+  appendedProfiles = with profiles; {
+    ubuntu = { config, ... }: {
+      deploy.profile.hardware.oracle = {
+        ubuntu = true;
+        common = true;
+      };
+      kw.oci.base = "Canonical Ubuntu";
+      imports = with import (inputs.tf-nix + "/modules"); [
+        nixos.ubuntu-linux
+        common
+      ];
+    };
+    oracle = { config, ... }: {
+      deploy.profile.hardware.oracle = {
+        oracle = true;
+        common = true;
+      };
+      kw.oci.base = "Oracle Linux";
+      imports = with import (inputs.tf-nix + "/modules"); [
+        nixos.oracle-linux
+        common
+      ];
+    };
+  };
+in
+profiles // appendedProfiles

profiles/hardware/raspi.nix

@@ -0,0 +1,68 @@
+{ config, lib, pkgs, ... }: with lib; {
+  deploy.profile.hardware.raspi = true;
+
+  nixpkgs.crossOverlays = [
+    (import ../../../overlays/pi)
+  ];
+
+  boot = {
+    loader = {
+      grub.enable = false;
+      generic-extlinux-compatible.enable = true;
+    };
+    consoleLogLevel = lib.mkDefault 7;
+    kernelModules = mkForce [ "loop" "atkbd" ];
+    initrd = {
+      includeDefaultModules = false;
+      availableKernelModules = mkForce [
+        "mmc_block"
+        "usbhid"
+        "ext4"
+        "hid_generic"
+        "hid_lenovo"
+        "hid_apple"
+        "hid_roccat"
+        "hid_logitech_hidpp"
+        "hid_logitech_dj"
+        "hid_microsoft"
+      ];
+    };
+  };
+
+  services.udev.extraRules = ''
+        SUBSYSTEM=="bcm2835-gpiomem", KERNEL=="gpiomem", GROUP="gpio", MODE="0660"
+        SUBSYSTEM=="gpio", KERNEL=="gpiochip*", ACTION=="add", PROGRAM="${pkgs.runtimeShell} -c 'chown root:gpio /sys/class/gpio/export /sys/class/gpio/unexport ; chmod 220 /sys/class/gpio/export /sys/class/gpio/unexport'"
+        SUBSYSTEM=="gpio", KERNEL=="gpio*", ACTION=="add", PROGRAM="${pkgs.runtimeShell} -c 'chown root:gpio /sys%p/active_low /sys%p/direction /sys%p/edge /sys%p/value ; chmod 660 /sys%p/active_low /sys%p/direction /sys%p/edge /sys%p/value'"
+
+    T
+  '';
+
+  users.groups.gpio = { };
+
+  environment.noXlibs = true;
+  documentation.info.enable = false;
+  documentation.man.enable = false;
+  programs.command-not-found.enable = false;
+  security.polkit.enable = false;
+  security.audit.enable = false;
+  services.udisks2.enable = false;
+  boot.enableContainers = false;
+
+  home-manager.users.kat.manual = {
+    json.enable = false;
+    manpages.enable = false;
+  };
+
+  services.logrotate.enable = false;
+
+  nixpkgs.crossSystem = systems.examples.raspberryPi // {
+    system = "armv6l-linux";
+  };
+
+  fileSystems = {
+    "/" = {
+      device = "/dev/disk/by-label/NIXOS_SD";
+      fsType = "ext4";
+    };
+  };
+}

profiles/hardware/razer.nix

@@ -0,0 +1,20 @@
+{ config, lib, ... }: with lib; {
+  options = {
+    home-manager.users = let
+        userRazerExtend = { config, nixos, ... }: {
+          config = mkIf (config.wayland.windowManager.sway.enable && nixos.hardware.openrazer.enable) {
+            wayland.windowManager.sway.config.input = {
+              "5426:103:Razer_Razer_Naga_Trinity" = {
+                accel_profile = "adaptive";
+                pointer_accel = "-0.5";
+              };
+            };
+          };
+        };
+      in mkOption {
+      type = types.attrsOf (types.submoduleWith {
+        modules = singleton userRazerExtend;
+      });
+    };
+  };
+}

profiles/hardware/rm-310.nix

@@ -0,0 +1,14 @@
+{ config, ... }:
+
+/*
+  This hardware profile corresponds with the RM DESKTOP 310 system, which is actually just an Intel DQ67OW motherboard.
+*/
+
+{
+  deploy.profile.hardware.rm-310 = true;
+
+  boot.initrd.availableKernelModules = [ "ata_generic" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+}

profiles/hardware/ryzen.nix

@@ -0,0 +1,56 @@
+{ config, pkgs, lib, ... }: with lib; {
+/*
+  This hardware profile corresponds to any machine which has an AMD Ryzen processor.
+*/
+
+  options.home-manager.users = let
+    waybarExtend = { config, ... }: {
+      options = {
+        programs.waybar.settings = mkOption {
+          type = with types; listOf (submodule waybarExtend2);
+        };
+      };
+    };
+    waybarExtend2 = { config, ... }: {
+      config = {
+        modules."temperature#icon".hwmon-path = "/sys/devices/pci0000:00/0000:00:18.3/hwmon/hwmon2/temp2_input";
+        modules.temperature.hwmon-path = "/sys/devices/pci0000:00/0000:00:18.3/hwmon/hwmon2/temp2_input";
+      };
+    };
+    polybarExtend = { config, ... }: {
+      services.polybar.settings."module/temp".hwmon-path = "/sys/devices/pci0000:00/0000:00:18.3/hwmon/hwmon2/temp1_input";
+    };
+    /*
+    polybarExtend2 = { config, ... }: {
+      config = {
+        modules."temperature#icon".hwmon-path = "/sys/devices/pci0000:00/0000:00:18.3/hwmon/hwmon2/temp2_input";
+        modules.temperature.hwmon-path = "/sys/devices/pci0000:00/0000:00:18.3/hwmon/hwmon2/temp2_input";
+      };
+    };*/
+  in mkOption {
+    type = types.attrsOf (types.submoduleWith {
+      modules = [ waybarExtend polybarExtend ];
+    });
+  };
+
+  config = {
+    deploy.profile.hardware.ryzen = true;
+
+    boot = {
+      kernelModules = [
+        "msr"
+        "ryzen_smu"
+        "kvm-amd"
+      ];
+      kernelParams = [ "amd_iommu=on" ];
+    };
+
+    hardware.cpu.amd.updateMicrocode = true;
+
+    environment.systemPackages = with pkgs; [
+      lm_sensors
+      ryzen-smu-monitor_cpu
+      ryzen-monitor
+    ];
+  };
+}

profiles/hardware/v330-14arr.nix

@@ -0,0 +1,33 @@
+{ config, lib, ... }: with lib;
+
+/*
+  This hardware profile corresponds to the Lenovo IdeaPad v330-14ARR.
+*/
+
+{
+  options.home-manager.users = let
+    userTouchpadExtend = { config, nixos, ... }: {
+      wayland.windowManager.sway.config.input."1739:33362:Synaptics_TM3336-002" = {
+        dwt = "enabled";
+        tap = "enabled";
+        natural_scroll = "enabled";
+        middle_emulation = "enabled";
+        click_method = "clickfinger";
+      };
+    };
+  in mkOption {
+    type = types.attrsOf (types.submoduleWith {
+      modules = singleton userTouchpadExtend;
+    });
+  };
+
+  config = {
+    deploy.profile.hardware.v330-14arr = true;
+
+    boot.initrd.availableKernelModules =
+      [ "xhci_pci" "ahci" "usb_storage" "sd_mod" ];
+    boot.initrd.kernelModules = [ ];
+    boot.kernelModules = [ ];
+    boot.extraModulePackages = [ ];
+  };
+}

profiles/hardware/wifi.nix

@@ -0,0 +1,32 @@
+{ config, tf, lib, ... }: with lib;
+
+{
+  kw.secrets.variables = mapListToAttrs
+    (field:
+      nameValuePair "wireless-${field}" {
+        path = "secrets/wifi";
+        inherit field;
+      }) [ "ssid" "psk" ];
+
+  deploy.tf.resources = {
+    wireless-credentials = {
+      provider = "null";
+      type = "data_source";
+      dataSource = true;
+      inputs.inputs = {
+        ssid = tf.variables.wireless-ssid.ref;
+        psk = tf.variables.wireless-psk.ref;
+      };
+    };
+  };
+
+  deploy.profile.hardware.wifi = true;
+  networking.wireless = {
+    enable = true;
+    networks = mkIf (builtins.getEnv "TF_IN_AUTOMATION" != "" || tf.state.enable) {
+      ${builtins.unsafeDiscardStringContext (tf.resources.wireless-credentials.getAttr "outputs.ssid")} = {
+        pskRaw = tf.resources.wireless-credentials.getAttr "outputs.psk";
+      };
+    };
+  };
+}

profiles/hardware/x270.nix

@@ -0,0 +1,45 @@
+{ config, lib, ... }: with lib;
+
+/*
+  This hardware profile corresponds to the Lenovo Thinkpad x270.
+*/
+
+{
+  options.home-manager.users = let
+    userTouchpadExtend = { config, nixos, ... }: {
+      wayland.windowManager.sway.config.input."2:7:SynPS/2_Synaptics_TouchPad" = {
+        dwt = "enabled";
+        tap = "enabled";
+        natural_scroll = "enabled";
+        middle_emulation = "enabled";
+        click_method = "clickfinger";
+      };
+    };
+    waybarExtend = { config, ... }: {
+      options = {
+        programs.waybar.settings = mkOption {
+          type = with types; either (listOf (submodule waybarExtend2)) (attrsOf (submodule waybarExtend2));
+        };
+      };
+    };
+    waybarExtend2 = { config, ... }: {
+      config = {
+        modules.temperature.hwmon-path = "/sys/devices/pci0000:00/0000:00:18.3/hwmon/hwmon2/temp2_input";
+      };
+    };
+  in mkOption {
+    type = types.attrsOf (types.submoduleWith {
+      modules = [ userTouchpadExtend waybarExtend ];
+    });
+  };
+
+  config = {
+    deploy.profile.hardware.x270 = true;
+
+    boot = {
+      initrd.availableKernelModules =
+      [ "xhci_pci" "nvme" "usb_storage" "sd_mod" "sr_mod" "rtsx_usb_sdmmc" ];
+      kernelModules = [ "kvm-intel" ];
+    };
+  };
+}