refactor: finish initial move to modules-only [WIP]

modules/nixos/server/nfs.nix

@@ -1,49 +1,52 @@
-{ pkgs, ... }:
+{ lib, config, pkgs, ... }:
 {
-  services = {
-    # add a user with sudo smbpasswd -a <user>
-    samba = {
-      package = pkgs.samba4Full;
-      # extraConfig = ''
-      #   workgroup = WORKGROUP
-      #   server role = standalone server
-      #   dns proxy = no
+  options.swarselsystems.server.nfs = lib.mkEnableOption "enable nfs on server";
+  config = lib.mkIf config.swarselsystems.server.nfs {
+    services = {
+      # add a user with sudo smbpasswd -a <user>
+      samba = {
+        package = pkgs.samba4Full;
+        # extraConfig = ''
+        #   workgroup = WORKGROUP
+        #   server role = standalone server
+        #   dns proxy = no
 
-      #   pam password change = yes
-      #   map to guest = bad user
-      #   create mask = 0664
-      #   force create mode = 0664
-      #   directory mask = 0775
-      #   force directory mode = 0775
-      #   follow symlinks = yes
-      # '';
+        #   pam password change = yes
+        #   map to guest = bad user
+        #   create mask = 0664
+        #   force create mode = 0664
+        #   directory mask = 0775
+        #   force directory mode = 0775
+        #   follow symlinks = yes
+        # '';
 
-      enable = true;
-      openFirewall = true;
-      settings.Eternor = {
-        browseable = "yes";
-        "read only" = "no";
-        "guest ok" = "no";
-        path = "/Vault/Eternor";
-        writable = "true";
-        comment = "Eternor";
-        "valid users" = "Swarsel";
+        enable = true;
+        openFirewall = true;
+        settings.Eternor = {
+          browseable = "yes";
+          "read only" = "no";
+          "guest ok" = "no";
+          path = "/Vault/Eternor";
+          writable = "true";
+          comment = "Eternor";
+          "valid users" = "Swarsel";
+        };
       };
-    };
 
 
-    avahi = {
-      publish.enable = true;
-      publish.userServices = true; # Needed to allow samba to automatically register mDNS records without the need for an `extraServiceFile`
-      nssmdns4 = true;
-      enable = true;
-      openFirewall = true;
-    };
+      avahi = {
+        publish.enable = true;
+        publish.userServices = true; # Needed to allow samba to automatically register mDNS records without the need for an `extraServiceFile`
+        nssmdns4 = true;
+        enable = true;
+        openFirewall = true;
+      };
 
-    # This enables autodiscovery on windows since SMB1 (and thus netbios) support was discontinued
-    samba-wsdd = {
-      enable = true;
-      openFirewall = true;
+      # This enables autodiscovery on windows since SMB1 (and thus netbios) support was discontinued
+      samba-wsdd = {
+        enable = true;
+        openFirewall = true;
+      };
     };
   };
 }

modules/nixos/server/nginx.nix

@@ -1,37 +1,39 @@
-{ pkgs, config, ... }:
+{ pkgs, lib, config, ... }:
 {
-  environment.systemPackages = with pkgs; [
-    lego
-  ];
+  options.swarselsystems.server.nginx = lib.mkEnableOption "enable nginx on server";
+  config = lib.mkIf config.swarselsystems.server.nginx {
+    environment.systemPackages = with pkgs; [
+      lego
+    ];
 
-  # users.users.acme = {};
+    # users.users.acme = {};
 
-  sops = {
-    # secrets.dnstokenfull = { owner = "acme"; };
-    secrets.dnstokenfull = { };
-    templates."certs.secret".content = ''
-      CF_DNS_API_TOKEN=${config.sops.placeholder.dnstokenfull}
-    '';
-  };
+    sops = {
+      # secrets.dnstokenfull = { owner = "acme"; };
+      secrets.dnstokenfull = { };
+      templates."certs.secret".content = ''
+        CF_DNS_API_TOKEN=${config.sops.placeholder.dnstokenfull}
+      '';
+    };
 
-  security.acme = {
-    acceptTerms = true;
-    preliminarySelfsigned = false;
-    defaults = {
-      email = "mrswarsel@gmail.com";
-      dnsProvider = "cloudflare";
-      environmentFile = "${config.sops.templates."certs.secret".path}";
+    security.acme = {
+      acceptTerms = true;
+      preliminarySelfsigned = false;
+      defaults = {
+        email = "mrswarsel@gmail.com";
+        dnsProvider = "cloudflare";
+        environmentFile = "${config.sops.templates."certs.secret".path}";
+      };
+    };
+
+    services.nginx = {
+      enable = true;
+      statusPage = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      # virtualHosts are defined in the respective sections
     };
   };
-
-  services.nginx = {
-    enable = true;
-    statusPage = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-    # virtualHosts are defined in the respective sections
-  };
-
 }

modules/nixos/server/packages.nix

@@ -1,11 +1,14 @@
-{ pkgs, ... }:
+{ lib, config, pkgs, ... }:
 {
-  environment.systemPackages = with pkgs; [
-    gnupg
-    nix-index
-    ssh-to-age
-    git
-    emacs
-    vim
-  ];
+  options.swarselsystems.server.packages = lib.mkEnableOption "enable packages on server";
+  config = lib.mkIf config.swarselsystems.server.packages {
+    environment.systemPackages = with pkgs; [
+      gnupg
+      nix-index
+      ssh-to-age
+      git
+      emacs
+      vim
+    ];
+  };
 }

modules/nixos/server/settings.nix

@@ -4,12 +4,13 @@ let
 in
 {
   options.swarselsystems = {
+    server.general = lib.mkEnableOption "general setting on server";
     shellAliases = lib.mkOption {
       type = lib.types.attrsOf lib.types.str;
       default = { };
     };
   };
-  config = {
+  config = lib.mkIf config.swarselsystems.server.general {
     environment.shellAliases = lib.recursiveUpdate
       {
         npswitch = "cd ${flakePath}; git pull; sudo nixos-rebuild --flake .#$(hostname) switch; cd -;";

modules/nixos/server/sops.nix

@@ -1,9 +1,11 @@
 { config, lib, ... }:
 {
-  sops = {
-    age.sshKeyPaths = lib.mkDefault [ "/etc/ssh/sops" ];
-    defaultSopsFile = lib.mkDefault "${config.swarselsystems.flakePath}/secrets/winters/secrets.yaml";
-    validateSopsFiles = false;
+  options.swarselsystems.server.sops = lib.mkEnableOption "enable sops on server";
+  config = lib.mkIf config.swarselsystems.server.sops {
+    sops = {
+      age.sshKeyPaths = lib.mkDefault [ "/etc/ssh/sops" ];
+      defaultSopsFile = lib.mkDefault "${config.swarselsystems.flakePath}/secrets/winters/secrets.yaml";
+      validateSopsFiles = false;
+    };
   };
-
 }

modules/nixos/server/ssh.nix

@@ -1,18 +1,20 @@
-{ self, config, ... }:
+{ self, lib, config, ... }:
 {
-  services.openssh = {
-    enable = true;
+  options.swarselsystems.server.ssh = lib.mkEnableOption "enable ssh on server";
+  config = lib.mkIf config.swarselsystems.server.ssh {
+    services.openssh = {
+      enable = true;
+    };
+    users.users."${config.swarselsystems.mainUser}".openssh.authorizedKeys.keyFiles = [
+      (self + /secrets/keys/ssh/yubikey.pub)
+      (self + /secrets/keys/ssh/magicant.pub)
+    ];
+    users.users.root.openssh.authorizedKeys.keyFiles = [
+      (self + /secrets/keys/ssh/yubikey.pub)
+      (self + /secrets/keys/ssh/magicant.pub)
+    ];
+    security.sudo.extraConfig = ''
+      Defaults    env_keep+=SSH_AUTH_SOCK
+    '';
   };
-  users.users."${config.swarselsystems.mainUser}".openssh.authorizedKeys.keyFiles = [
-    (self + /secrets/keys/ssh/yubikey.pub)
-    (self + /secrets/keys/ssh/magicant.pub)
-  ];
-  users.users.root.openssh.authorizedKeys.keyFiles = [
-    (self + /secrets/keys/ssh/yubikey.pub)
-    (self + /secrets/keys/ssh/magicant.pub)
-  ];
-  security.sudo.extraConfig = ''
-    Defaults    env_keep+=SSH_AUTH_SOCK
-  '';
-
 }