Consolidated and moved modules/{nixos,darwin} to modules/system

modules/system/common/default.nix

@@ -0,0 +1,56 @@
+{isLinux}: {
+  config,
+  configurationName,
+  lib,
+  pkgs,
+  ...
+}: let
+  sharedConfig = {
+    settei.user.config = {
+      programs.git = {
+        enable = true;
+        difftastic.enable = true;
+        lfs.enable = true;
+        userName = "Nikodem Rabuliński";
+        userEmail = lib.mkDefault "nikodem@rabulinski.com";
+        signing = {
+          key = config.settei.sane-defaults.allSshKeys.${configurationName};
+          signByDefault = true;
+        };
+        extraConfig = {
+          gpg.format = "ssh";
+          push.followTags = true;
+        };
+      };
+    };
+  };
+
+  linuxConfig = lib.optionalAttrs isLinux {
+    system.stateVersion = "22.05";
+
+    # https://github.com/NixOS/nixpkgs/issues/254807
+    boot.swraid.enable = false;
+
+    i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
+
+    settei.user.config = {
+      services.ssh-agent.enable = true;
+    };
+  };
+
+  darwinConfig = lib.optionalAttrs (!isLinux) {
+    system.stateVersion = 4;
+  };
+in {
+  _file = ./default.nix;
+
+  imports = [
+    (import ./hercules.nix {inherit isLinux;})
+  ];
+
+  config = lib.mkMerge [
+    sharedConfig
+    linuxConfig
+    darwinConfig
+  ];
+}

modules/system/common/hercules.nix

@@ -0,0 +1,40 @@
+{isLinux}: {
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  options = {
+    common.hercules.enable = lib.mkEnableOption "Enables hercules-ci-agent with my configuration";
+  };
+
+  herculesUser =
+    if isLinux
+    then config.systemd.services.hercules-ci-agent.serviceConfig.User
+    else config.launchd.daemons.hercules-ci-agent.serviceConfig.UserName;
+in {
+  _file = ./hercules.nix;
+
+  inherit options;
+
+  config = lib.mkIf config.common.hercules.enable {
+    age.secrets.hercules-token = {
+      file = ../../../secrets/hercules-token.age;
+      owner = herculesUser;
+    };
+    age.secrets.hercules-cache = {
+      file = ../../../secrets/hercules-cache.age;
+      owner = herculesUser;
+    };
+
+    services.hercules-ci-agent = {
+      enable = true;
+      settings = {
+        clusterJoinTokenPath = config.age.secrets.hercules-token.path;
+        concurrentTasks = lib.mkDefault 4;
+        binaryCachesPath = config.age.secrets.hercules-cache.path;
+        secretsJsonPath = pkgs.writeText "secrets.json" "{}";
+      };
+    };
+  };
+}

modules/system/default.nix

@@ -0,0 +1,17 @@
+{
+  config,
+  lib,
+  ...
+}: {
+  flake = lib.genAttrs ["nixosModules" "darwinModules"] (attr: let
+    isLinux = lib.hasPrefix "nixos" attr;
+  in {
+    settei = import ./settei {
+      inherit (config) perInput;
+      inherit isLinux;
+    };
+    common = import ./common {
+      inherit isLinux;
+    };
+  });
+}

modules/system/settei/default.nix

@@ -0,0 +1,25 @@
+{
+  perInput,
+  # TODO: Figure out a nicer way of doing this without infrec?
+  isLinux,
+}: {
+  lib,
+  pkgs,
+  config,
+  options,
+  ...
+}: {
+  _file = ./default.nix;
+
+  imports = [
+    (import ./sane-defaults.nix {inherit isLinux;})
+    (import ./flake-qol.nix {inherit perInput;})
+    ./user.nix
+  ];
+
+  options.settei = with lib; {
+    username = mkOption {
+      type = types.str;
+    };
+  };
+}

modules/system/settei/flake-qol.nix

@@ -0,0 +1,49 @@
+{perInput}: {
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.settei.flake-qol;
+in {
+  _file = ./flake-qol.nix;
+
+  options.settei.flake-qol = with lib; {
+    enable = mkEnableOption "QoL defaults when using flakes";
+    reexportAsArgs = mkOption {
+      type = types.bool;
+      default = true;
+    };
+    inputs = mkOption {
+      type = types.unspecified;
+    };
+    inputs-flakes = mkOption {
+      type = types.attrs;
+      readOnly = true;
+    };
+    inputs' = mkOption {
+      type = types.attrs;
+      readOnly = true;
+    };
+  };
+
+  config = let
+    reexportedArgs = lib.mkIf cfg.reexportAsArgs {
+      inherit (cfg) inputs inputs-flakes inputs';
+    };
+  in
+    lib.mkIf cfg.enable {
+      settei.flake-qol = {
+        inputs-flakes = lib.filterAttrs (_: input: input ? flake -> input.flake) cfg.inputs;
+        inputs' = lib.mapAttrs (_: perInput pkgs.stdenv.system) cfg.inputs-flakes;
+      };
+
+      _module.args = reexportedArgs;
+      settei.user.extraArgs = reexportedArgs;
+
+      nix = {
+        registry = lib.mapAttrs (_: flake: {inherit flake;}) cfg.inputs-flakes;
+        nixPath = lib.mapAttrsToList (name: _: "${name}=flake:${name}") cfg.inputs-flakes;
+      };
+    };
+}

modules/system/settei/sane-defaults.nix

@@ -0,0 +1,130 @@
+{isLinux}: {
+  config,
+  lib,
+  username,
+  ...
+} @ args: let
+  options = {
+    settei.sane-defaults = with lib; {
+      enable = mkEnableOption "Personal sane defaults (but they should make sense for anyone)";
+      allSshKeys = mkOption {
+        type = types.attrsOf types.singleLineStr;
+        default = {};
+      };
+      tailnet = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+      };
+    };
+  };
+
+  sharedConfig = let
+    cfg = config.settei;
+    inherit (cfg) username;
+    adminNeedsPassword = isLinux -> config.security.sudo.wheelNeedsPassword;
+  in {
+    _module.args = {
+      username = lib.mkDefault username;
+    };
+
+    # FIXME: Move to common
+    services.tailscale.enable = true;
+
+    networking.hostName = lib.mkDefault (
+      args.configurationName
+      or (throw "pass configurationName to module arguments or set networking.hostName yourself")
+    );
+
+    # Flakes are unusable without git present so pull it into the environment by default
+    settei.user.config.programs.git.enable = lib.mkDefault true;
+
+    nix = {
+      settings = {
+        experimental-features = ["nix-command" "flakes" "repl-flake" "auto-allocate-uids"];
+        trusted-users = lib.optionals (!adminNeedsPassword) [username];
+        auto-allocate-uids = true;
+        extra-substituters = [
+          "https://hyprland.cachix.org"
+          "https://cache.garnix.io"
+          "https://nix-community.cachix.org"
+          "https://hercules-ci.cachix.org"
+          "https://nrabulinski.cachix.org"
+        ];
+        trusted-public-keys = [
+          "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
+          "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+          "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+          "hercules-ci.cachix.org-1:ZZeDl9Va+xe9j+KqdzoBZMFJHVQ42Uu/c/1/KMC5Lw0="
+          "nrabulinski.cachix.org-1:Q5FD7+1c68uH74CQK66UWNzxhanZW8xcg1LFXxGK8ic="
+        ];
+      };
+    };
+  };
+
+  linuxConfig = lib.optionalAttrs isLinux (let
+    cfg = config.settei.sane-defaults;
+    nmEnabled = config.networking.networkmanager.enable;
+  in {
+    hardware.enableRedistributableFirmware = true;
+
+    services.openssh.enable = true;
+    programs.mosh.enable = lib.mkDefault true;
+
+    users = {
+      mutableUsers = false;
+      users.${username} = {
+        isNormalUser = true;
+        home = "/home/${username}";
+        group = username;
+        extraGroups = ["wheel"];
+        # FIXME: Move to common
+        openssh.authorizedKeys.keys = let
+          configName' =
+            args.configurationName
+            or (throw "pass configurationName to module arguments or set users.users.${username}.openssh.authorizedKeys yourself");
+          filteredKeys = lib.filterAttrs (name: _: name != configName') cfg.allSshKeys;
+        in
+          lib.mkDefault (lib.attrValues filteredKeys);
+      };
+      groups.${username} = {};
+    };
+
+    # TODO: Actually this should be extraRules which makes wheel users without any password set
+    #       be able to use sudo with no password
+    security.sudo.wheelNeedsPassword = false;
+
+    # When NetworkManager isn't in use, add tailscale DNS address manually
+    # FIXME: Move to common
+    networking = lib.mkIf (!nmEnabled && config.services.tailscale.enable && cfg.tailnet != null) {
+      nameservers = [
+        "100.100.100.100"
+        "1.1.1.1"
+        "1.0.0.1"
+      ];
+      search = [cfg.tailnet];
+    };
+
+    # NetworkManager probably means desktop system so we don't want to slow down boot times
+    systemd.services = lib.mkIf nmEnabled {
+      NetworkManager-wait-online.enable = false;
+    };
+  });
+
+  darwinConfig = lib.optionalAttrs (!isLinux) {
+    services.nix-daemon.enable = true;
+
+    security.pam.enableSudoTouchIdAuth = true;
+
+    users.users.${username}.home = "/Users/${username}";
+  };
+in {
+  _file = ./sane-defaults.nix;
+
+  inherit options;
+
+  config = lib.mkIf config.settei.sane-defaults.enable (lib.mkMerge [
+    sharedConfig
+    linuxConfig
+    darwinConfig
+  ]);
+}

modules/system/settei/user.nix

@@ -0,0 +1,57 @@
+{
+  config,
+  options,
+  lib,
+  ...
+}: let
+  hasHomeManager = options ? home-manager;
+  cfg = config.settei.user;
+  inherit (config.settei) username;
+in {
+  _file = ./user.nix;
+
+  options.settei.user = with lib; {
+    enable = mkEnableOption "User-specific configuration";
+    config = mkOption {
+      type = types.deferredModule;
+      default = {};
+    };
+    extraArgs = mkOption {
+      type = types.attrs;
+      default = {};
+    };
+  };
+
+  config = let
+    hmConfig = lib.optionalAttrs hasHomeManager {
+      home-manager.useGlobalPkgs = true;
+      home-manager.useUserPackages = true;
+      home-manager.extraSpecialArgs = cfg.extraArgs;
+
+      home-manager.users.${username} = {
+        _file = ./user.nix;
+
+        imports = [cfg.config];
+
+        home = {
+          inherit username;
+          homeDirectory = config.users.users.${username}.home;
+          stateVersion = "22.05";
+        };
+
+        programs.home-manager.enable = true;
+      };
+    };
+  in
+    lib.mkIf cfg.enable (lib.mkMerge [
+      {
+        assertions = [
+          {
+            assertion = hasHomeManager;
+            message = "Home-manager module has to be imported before enabling settei.user";
+          }
+        ];
+      }
+      hmConfig
+    ]);
+}