feat: add minimal config support (WIP)

files/scripts/swarsel-bootstrap.sh

@@ -218,7 +218,7 @@ $scp_cmd root@"$target_destination":/mnt/etc/nixos/hardware-configuration.nix "$
 # ------------------------
 
 green "Deploying minimal NixOS installation on $target_destination"
-SHELL=/bin/sh nix run github:nix-community/nixos-anywhere -- --ssh-port "$ssh_port" --extra-files "$temp" --flake .#"$target_hostname" root@"$target_destination"
+SHELL=/bin/sh nix run github:nix-community/nixos-anywhere -- --ssh-port "$ssh_port" --extra-files "$temp" --flake ./install#"$target_hostname" root@"$target_destination"
 
 echo "Updating ssh host fingerprint at $target_destination to ~/.ssh/known_hosts"
 ssh-keyscan -p "$ssh_port" "$target_destination" >> ~/.ssh/known_hosts || true

files/templates/hosts/nixos/default.nix

@@ -1,10 +1,10 @@
-{ self, inputs, pkgs, lib, globals, ... }:
+{ self, config, inputs, pkgs, lib, ... }:
 let
+  primaryUser = config.swarselsystems.mainUser;
   modulesPath = "${self}/modules";
   sharedOptions = {
     isBtrfs = true;
   };
-  primaryUser = globals.user.name;
 in
 {
 

hosts/nixos/moonside/default.nix

@@ -1,6 +1,6 @@
 { lib, config, globals, ... }:
 let
-  primaryUser = globals.user.name;
+  primaryUser = config.swarselsystems.mainUser;
   inherit (config.repo.secrets.common) workHostName;
   inherit (config.repo.secrets.local.syncthing) dev1 dev2 dev3 loc1;
   serviceDomain = config.repo.secrets.common.services.domains.syncthing3;

hosts/nixos/nbl-imba-2/default.nix

@@ -1,14 +1,15 @@
-{ self, config, inputs, lib, globals, ... }:
+{ self, config, inputs, lib, ... }:
 let
-  primaryUser = globals.user.name;
+  primaryUser = config.swarselsystems.mainUser;
   sharedOptions = {
     isBtrfs = true;
     isLinux = true;
     sharescreen = "eDP-2";
     profiles = {
-      personal = true;
+      personal = lib.mkIf (!minimal) true;
-      work = true;
+      minimal = lib.mkIf minimal true;
-      framework = true;
+      work = lib.mkIf (!minimal) true;
+      framework = lib.mkIf (!minimal) true;
     };
   };
 in

hosts/nixos/sync/default.nix

@@ -1,6 +1,6 @@
 { lib, config, globals, ... }:
 let
-  primaryUser = globals.user.name;
+  primaryUser = config.swarselsystems.mainUser;
   sharedOptions = {
     isBtrfs = false;
     isLinux = true;

hosts/nixos/toto/default.nix

@@ -1,11 +1,12 @@
-{ self, inputs, pkgs, lib, ... }:
+{ self, lib, minimal, ... }:
 let
-  modulesPath = "${self}/modules";
   sharedOptions = {
     isBtrfs = true;
     isLinux = true;
     profiles = {
-      toto = true;
+      toto = lib.mkIf (!minimal) true;
+      minimal = lib.mkIf minimal true;
+      btrfs = lib.mkIf minimal true;
     };
   };
 in
@@ -14,41 +15,9 @@ in
   imports = [
     ./disk-config.nix
     ./hardware-configuration.nix
-
-    "${modulesPath}/nixos/common/sharedsetup.nix"
-    "${modulesPath}/home/common/sharedsetup.nix"
-    "${self}/profiles/nixos"
-
-    inputs.home-manager.nixosModules.home-manager
-    {
-      home-manager.users."setup".imports = [
-        inputs.sops-nix.homeManagerModules.sops
-        "${modulesPath}/home/common/sharedsetup.nix"
-        "${self}/profiles/home"
-      ];
-    }
   ];
 
 
-  environment.systemPackages = with pkgs; [
-    curl
-    git
-    gnupg
-    rsync
-    ssh-to-age
-    sops
-    vim
-    just
-    sbctl
-  ];
-
-  system.stateVersion = lib.mkForce "23.05";
-
-  boot = {
-    supportedFilesystems = [ "btrfs" ];
-    kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;
-  };
-
 
   networking = {
     hostName = "toto";
@@ -60,10 +29,10 @@ in
       info = "~SwarselSystems~ remote install helper";
       wallpaper = self + /files/wallpaper/lenovowp.png;
       isImpermanence = true;
-      isCrypted = false;
+      isCrypted = true;
       isSecureBoot = false;
-      isSwap = false;
+      isSwap = true;
-      swapSize = "8G";
+      swapSize = "2G";
       # rootDisk = "/dev/nvme0n1";
       rootDisk = "/dev/sda";
       # rootDisk = "/dev/vda";

hosts/nixos/winters/default.nix

@@ -1,6 +1,6 @@
-{ lib, config, globals, ... }:
+{ lib, config, ... }:
 let
-  primaryUser = globals.user.name;
+  primaryUser = config.swarselsystems.mainUser;
   sharedOptions = {
     isBtrfs = false;
     isLinux = true;

install/flake.nix

@@ -0,0 +1,7 @@
+{
+  description = "Minimal installer flake - not to be used manually";
+
+  inputs.swarsel.url = "github:Swarsel/.dotfiles";
+
+  outputs = { swarsel, ... }: { nixosConfigurations = swarsel.nixosConfigurationsMinimal; };
+}

install/installer-config.nix

@@ -1,6 +1,5 @@
 { pkgs, lib, ... }:
 {
-
   config = {
     home-manager.users.root.home = {
       stateVersion = "23.05";
@@ -55,10 +54,10 @@
 
     environment.etc."issue".text = ''
       ~SwarselSystems~
-                               IP of primary interface: \4
+      IP of primary interface: \4
-                                                                   The Password for all users & root is 'setup'.
+      The Password for all users & root is 'setup'.
-                                                                   Install the system remotely by running 'bootstrap -n <CONFIGURATION_NAME> -d <IP_FROM_ABOVE> ' on a machine with deployed secrets.
+      Install the system remotely by running 'bootstrap -n <CONFIGURATION_NAME> -d <IP_FROM_ABOVE> ' on a machine with deployed secrets.
-                                                                   Alternatively, run 'swarsel-install -n <CONFIGURATION_NAME>' for a local install. For your convenience, an example call is in the bash history (press up on the keyboard to access).
+      Alternatively, run 'swarsel-install -n <CONFIGURATION_NAME>' for a local install. For your convenience, an example call is in the bash history (press up on the keyboard to access).
     '';
 
     networking = {
@@ -87,7 +86,7 @@
 
     system.activationScripts.cache = {
       text = ''
-          mkdir -p -m=0777 /home/setup/.local/state/nix/profiles
+        mkdir -p -m=0777 /home/setup/.local/state/nix/profiles
         mkdir -p -m=0777 /home/setup/.local/state/home-manager/gcroots
         mkdir -p -m=0777 /home/setup/.local/share/nix/
         printf '{\"extra-substituters\":{\"https://nix-community.cachix.org\":true,\"https://nix-community.cachix.org https://cache.ngi0.nixos.org/\":true},\"extra-trusted-public-keys\":{\"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=\":true,\"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs= cache.ngi0.nixos.org-1:KqH5CBLNSyX184S9BKZJo1LxrxJ9ltnY2uAs5c/f1MA=\":true}}' | tee /home/setup/.local/share/nix/trusted-settings.json > /dev/null

modules/home/common/mail.nix

@@ -2,10 +2,19 @@
 let
   inherit (nixosConfig.repo.secrets.common.mail) address1 address2 add2Name address3 add3Name address4;
   inherit (nixosConfig.repo.secrets.common) fullName;
+  inherit (config.swarselsystems) xdgDir;
 in
 {
   options.swarselsystems.modules.mail = lib.mkEnableOption "mail settings";
   config = lib.mkIf config.swarselsystems.modules.mail {
+
+    sops.secrets = lib.mkIf (!config.swarselsystems.isPublic) {
+      mrswarsel = { path = "${xdgDir}/secrets/mrswarsel"; };
+      nautilus = { path = "${xdgDir}/secrets/nautilus"; };
+      leon = { path = "${xdgDir}/secrets/leon"; };
+      swarselmail = { path = "${xdgDir}/secrets/swarselmail"; };
+    };
+
     programs = {
       mbsync = {
         enable = true;

modules/home/common/sharedsetup.nix

@@ -1,4 +1,4 @@
-{ self, lib, pkgs, ... }:
+{ self, lib, pkgs, globals, minimal, ... }:
 {
   options.swarselsystems = {
     isLaptop = lib.mkEnableOption "laptop host";
@@ -9,7 +9,7 @@
     isBtrfs = lib.mkEnableOption "use btrfs filesystem";
     mainUser = lib.mkOption {
       type = lib.types.str;
-      default = "swarsel";
+      default = if (!minimal) then globals.user.name else "setup";
     };
     homeDir = lib.mkOption {
       type = lib.types.str;

modules/home/common/sops.nix

@@ -1,23 +1,15 @@
 { config, lib, ... }:
 let
-  inherit (config.swarselsystems) homeDir xdgDir;
+  inherit (config.swarselsystems) homeDir;
 in
 {
   options.swarselsystems.modules.sops = lib.mkEnableOption "sops settings";
   config = lib.mkIf config.swarselsystems.modules.sops {
     sops = {
       age.sshKeyPaths = [ "${homeDir}/.ssh/sops" "${homeDir}/.ssh/ssh_host_ed25519_key" ];
-      defaultSopsFile = lib.swarselsystems.mkIfElseList config.swarselsystems.isBtrfs "/persist/.dotfiles/secrets/general/secrets.yaml" "${homeDir}/.dotfiles/secrets/general/secrets.yaml";
+      defaultSopsFile = "${homeDir}/.dotfiles/secrets/general/secrets.yaml";
 
       validateSopsFiles = false;
-      secrets = lib.mkIf (!config.swarselsystems.isPublic) {
-        mrswarsel = { path = "${xdgDir}/secrets/mrswarsel"; };
-        nautilus = { path = "${xdgDir}/secrets/nautilus"; };
-        leon = { path = "${xdgDir}/secrets/leon"; };
-        swarselmail = { path = "${xdgDir}/secrets/swarselmail"; };
-        github_notif = { path = "${xdgDir}/secrets/github_notif"; };
-        u2f_keys = { path = "${homeDir}/.config/Yubico/u2f_keys"; };
-      };
     };
   };
 }

modules/home/common/waybar.nix

@@ -1,5 +1,6 @@
 { self, config, lib, pkgs, ... }:
 let
+  inherit (config.swarselsystems) xdgDir;
   generateIcons = n: lib.concatStringsSep " " (builtins.map (x: "{icon" + toString x + "}") (lib.range 0 (n - 1)));
   modulesLeft = [
     "custom/outer-left-arrow-dark"
@@ -52,11 +53,17 @@ in
     };
   };
   config = lib.mkIf config.swarselsystems.modules.waybar {
+
     swarselsystems = {
       waybarModules = lib.mkIf config.swarselsystems.isLaptop (modulesLeft ++ [
         "battery"
       ] ++ modulesRight);
     };
+
+    sops.secrets = lib.mkIf (!config.swarselsystems.isPublic) {
+      github_notif = { path = "${xdgDir}/secrets/github_notif"; };
+    };
+
     programs.waybar = {
       enable = true;
       systemd = {

modules/home/common/yubikey.nix

@@ -1,8 +1,16 @@
 { lib, config, nixosConfig, ... }:
+let
+  inherit (config.swarselsystems) homeDir;
+in
 {
   options.swarselsystems.modules.yubikey = lib.mkEnableOption "yubikey settings";
 
   config = lib.mkIf config.swarselsystems.modules.yubikey {
+
+    sops.secrets = lib.mkIf (!config.swarselsystems.isPublic) {
+      u2f_keys = { path = "${homeDir}/.config/Yubico/u2f_keys"; };
+    };
+
     pam.yubico.authorizedYubiKeys = lib.mkIf (config.swarselsystems.isNixos && !config.swarselsystems.isPublic) {
       ids = [
         nixosConfig.repo.secrets.common.yubikeys.dev1

modules/home/common/zsh.nix

@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, lib, minimal, ... }:
 let
   inherit (config.swarselsystems) flakePath;
 in
@@ -10,115 +10,118 @@ in
       default = { };
     };
   };
-  config = lib.mkIf config.swarselsystems.modules.zsh {
+  config = lib.mkIf config.swarselsystems.modules.zsh
+    {
 
-    sops.secrets = {
+      sops.secrets = {
-      croc-password = { };
+        croc-password = { };
-    };
+      };
 
-    programs.zsh = {
+      programs.zsh = {
-      enable = true;
-      shellAliases = lib.recursiveUpdate
-        {
-          hg = "history | grep";
-          hmswitch = "home-manager --flake ${flakePath}#$(whoami)@$(hostname) switch |& nom";
-          # nswitch = "sudo nixos-rebuild --flake ${flakePath}#$(hostname) --show-trace --log-format internal-json -v switch |& nom --json";
-          nswitch = "swarsel-deploy $(hostname) switch";
-          # nboot = "sudo nixos-rebuild --flake ${flakePath}#$(hostname) --show-trace --log-format internal-json -v boot |& nom --json";
-          nboot = "swarsel-deploy $(hostname) boot";
-          magit = "emacsclient -nc -e \"(magit-status)\"";
-          config = "git --git-dir=$HOME/.cfg/ --work-tree=$HOME";
-          g = "git";
-          c = "git --git-dir=$FLAKE/.git --work-tree=$FLAKE/";
-          passpush = "cd ~/.local/share/password-store; git add .; git commit -m 'pass file changes'; git push; cd -;";
-          passpull = "cd ~/.local/share/password-store; git pull; cd -;";
-          hotspot = "nmcli connection up local; nmcli device wifi hotspot;";
-          youtube-dl = "yt-dlp";
-          cat-orig = "cat";
-          cdr = "cd \"$( (find $DOCUMENT_DIR_WORK $DOCUMENT_DIR_PRIV -maxdepth 1 && echo $FLAKE) | fzf )\"";
-          nix-ldd-ldd = "LD_LIBRARY_PATH=$NIX_LD_LIBRARY_PATH ldd";
-          nix-ldd = "LD_LIBRARY_PATH=$NIX_LD_LIBRARY_PATH ldd";
-          nix-ldd-locate = "nix-locate --minimal --top-level -w ";
-          nix-store-search = "ls /nix/store | grep";
-          fs-diff = "sudo mount -o subvol=/ /dev/mapper/cryptroot /mnt ; fs-diff";
-          lt = "eza -las modified --total-size";
-          boot-diff = "nix store diff-closures /run/*-system";
-          gen-diff = "nix profile diff-closures --profile /nix/var/nix/profiles/system";
-          cc = "wl-copy";
-        }
-        config.swarselsystems.shellAliases;
-      autosuggestion.enable = true;
-      enableCompletion = true;
-      syntaxHighlighting.enable = true;
-      autocd = false;
-      cdpath = [
-        "~/.dotfiles"
-        # "~/Documents/GitHub"
-      ];
-      defaultKeymap = "emacs";
-      dirHashes = {
-        dl = "$HOME/Downloads";
-        gh = "$HOME/Documents/GitHub";
-      };
-      history = {
-        expireDuplicatesFirst = true;
-        path = "$HOME/.histfile";
-        save = 100000;
-        size = 100000;
-      };
-      historySubstringSearch = {
         enable = true;
-        searchDownKey = "^[OB";
+      }
-        searchUpKey = "^[OA";
+      // lib.optionalAttrs (!minimal) {
+        shellAliases = lib.recursiveUpdate
+          {
+            hg = "history | grep";
+            hmswitch = "home-manager --flake ${flakePath}#$(whoami)@$(hostname) switch |& nom";
+            # nswitch = "sudo nixos-rebuild --flake ${flakePath}#$(hostname) --show-trace --log-format internal-json -v switch |& nom --json";
+            nswitch = "swarsel-deploy $(hostname) switch";
+            # nboot = "sudo nixos-rebuild --flake ${flakePath}#$(hostname) --show-trace --log-format internal-json -v boot |& nom --json";
+            nboot = "swarsel-deploy $(hostname) boot";
+            magit = "emacsclient -nc -e \"(magit-status)\"";
+            config = "git --git-dir=$HOME/.cfg/ --work-tree=$HOME";
+            g = "git";
+            c = "git --git-dir=$FLAKE/.git --work-tree=$FLAKE/";
+            passpush = "cd ~/.local/share/password-store; git add .; git commit -m 'pass file changes'; git push; cd -;";
+            passpull = "cd ~/.local/share/password-store; git pull; cd -;";
+            hotspot = "nmcli connection up local; nmcli device wifi hotspot;";
+            youtube-dl = "yt-dlp";
+            cat-orig = "cat";
+            cdr = "cd \"$( (find $DOCUMENT_DIR_WORK $DOCUMENT_DIR_PRIV -maxdepth 1 && echo $FLAKE) | fzf )\"";
+            nix-ldd-ldd = "LD_LIBRARY_PATH=$NIX_LD_LIBRARY_PATH ldd";
+            nix-ldd = "LD_LIBRARY_PATH=$NIX_LD_LIBRARY_PATH ldd";
+            nix-ldd-locate = "nix-locate --minimal --top-level -w ";
+            nix-store-search = "ls /nix/store | grep";
+            fs-diff = "sudo mount -o subvol=/ /dev/mapper/cryptroot /mnt ; fs-diff";
+            lt = "eza -las modified --total-size";
+            boot-diff = "nix store diff-closures /run/*-system";
+            gen-diff = "nix profile diff-closures --profile /nix/var/nix/profiles/system";
+            cc = "wl-copy";
+          }
+          config.swarselsystems.shellAliases;
+        autosuggestion.enable = true;
+        enableCompletion = true;
+        syntaxHighlighting.enable = true;
+        autocd = false;
+        cdpath = [
+          "~/.dotfiles"
+          # "~/Documents/GitHub"
+        ];
+        defaultKeymap = "emacs";
+        dirHashes = {
+          dl = "$HOME/Downloads";
+          gh = "$HOME/Documents/GitHub";
+        };
+        history = {
+          expireDuplicatesFirst = true;
+          path = "$HOME/.histfile";
+          save = 100000;
+          size = 100000;
+        };
+        historySubstringSearch = {
+          enable = true;
+          searchDownKey = "^[OB";
+          searchUpKey = "^[OA";
+        };
+        plugins = [
+          # {
+          #   name = "fzf-tab";
+          #   src = pkgs.zsh-fzf-tab;
+          # }
+        ];
+        initContent = lib.mkIf (!config.swarselsystems.isPublic) ''
+          my-forward-word() {
+            local WORDCHARS=$WORDCHARS
+            WORDCHARS="''${WORDCHARS//:}"
+            WORDCHARS="''${WORDCHARS//\/}"
+            WORDCHARS="''${WORDCHARS//.}"
+            zle forward-word
+          }
+          zle -N my-forward-word
+          # ctrl + right
+          bindkey "^[[1;5C" my-forward-word
+
+          # shift + right
+          bindkey "^[[1;2C" forward-word
+
+          my-backward-word() {
+            local WORDCHARS=$WORDCHARS
+            WORDCHARS="''${WORDCHARS//:}"
+            WORDCHARS="''${WORDCHARS//\/}"
+            WORDCHARS="''${WORDCHARS//.}"
+            zle backward-word
+          }
+          zle -N my-backward-word
+          # ctrl + left
+          bindkey "^[[1;5D" my-backward-word
+
+          # shift + left
+          bindkey "^[[1;2D" backward-word
+
+          my-backward-delete-word() {
+            local WORDCHARS=$WORDCHARS
+            WORDCHARS="''${WORDCHARS//:}"
+            WORDCHARS="''${WORDCHARS//\/}"
+            WORDCHARS="''${WORDCHARS//.}"
+            zle backward-delete-word
+          }
+          zle -N my-backward-delete-word
+          # ctrl + del
+          bindkey '^H' my-backward-delete-word
+
+          export CROC_PASS="$(cat ${config.sops.secrets.croc-password.path})"
+        '';
       };
-      plugins = [
-        # {
-        #   name = "fzf-tab";
-        #   src = pkgs.zsh-fzf-tab;
-        # }
-      ];
-      initContent = lib.mkIf (!config.swarselsystems.isPublic) ''
-        my-forward-word() {
-          local WORDCHARS=$WORDCHARS
-          WORDCHARS="''${WORDCHARS//:}"
-          WORDCHARS="''${WORDCHARS//\/}"
-          WORDCHARS="''${WORDCHARS//.}"
-          zle forward-word
-        }
-        zle -N my-forward-word
-        # ctrl + right
-        bindkey "^[[1;5C" my-forward-word
-
-        # shift + right
-        bindkey "^[[1;2C" forward-word
-
-        my-backward-word() {
-          local WORDCHARS=$WORDCHARS
-          WORDCHARS="''${WORDCHARS//:}"
-          WORDCHARS="''${WORDCHARS//\/}"
-          WORDCHARS="''${WORDCHARS//.}"
-          zle backward-word
-        }
-        zle -N my-backward-word
-        # ctrl + left
-        bindkey "^[[1;5D" my-backward-word
-
-        # shift + left
-        bindkey "^[[1;2D" backward-word
-
-        my-backward-delete-word() {
-          local WORDCHARS=$WORDCHARS
-          WORDCHARS="''${WORDCHARS//:}"
-          WORDCHARS="''${WORDCHARS//\/}"
-          WORDCHARS="''${WORDCHARS//.}"
-          zle backward-delete-word
-        }
-        zle -N my-backward-delete-word
-        # ctrl + del
-        bindkey '^H' my-backward-delete-word
-
-        export CROC_PASS="$(cat ${config.sops.secrets.croc-password.path})"
-      '';
     };
-  };
 }

modules/nixos/client/packages.nix

@@ -1,8 +1,9 @@
-{ lib, config, pkgs, ... }:
+{ lib, config, pkgs, minimal, ... }:
 {
   options.swarselsystems.modules.packages = lib.mkEnableOption "install packages";
   config = lib.mkIf config.swarselsystems.modules.packages {
-    environment.systemPackages = with pkgs; [
+
+    environment.systemPackages = with pkgs; lib.optionals (!minimal) [
       # yubikey packages
       gnupg
       yubikey-personalization
@@ -73,9 +74,19 @@
 
       elk-to-svg
 
+    ] ++ lib.optionals minimal [
+      curl
+      git
+      gnupg
+      rsync
+      ssh-to-age
+      sops
+      vim
+      just
+      sbctl
     ];
 
-    nixpkgs.config.permittedInsecurePackages = [
+    nixpkgs.config.permittedInsecurePackages = lib.mkIf (!minimal) [
       "jitsi-meet-1.0.8043"
       "electron-29.4.6"
       "SDL_ttf-2.0.11"

modules/nixos/client/polkit.nix

@@ -1,19 +1,20 @@
-{ lib, config, ... }:
+{ lib, config, minimal, ... }:
 {
   options.swarselsystems.modules.security = lib.mkEnableOption "security config";
   config = lib.mkIf config.swarselsystems.modules.security {
 
     security = {
-      pam.services = {
+      pam.services = lib.mkIf (!minimal) {
         login.u2fAuth = true;
         sudo.u2fAuth = true;
         swaylock.u2fAuth = true;
         swaylock.fprintAuth = false;
       };
-      polkit.enable = true;
+      polkit.enable = lib.mkIf (!minimal) true;
 
       sudo.extraConfig = ''
         Defaults    env_keep+=SSH_AUTH_SOCK
+      '' + lib.optionalString (!minimal) ''
         Defaults    env_keep+=XDG_RUNTIME_DIR
         Defaults    env_keep+=WAYLAND_DISPLAY
       '';

modules/nixos/common/home-manager.nix

@@ -1,6 +1,6 @@
-{ self, inputs, config, lib, outputs, globals, nodes, ... }:
+{ self, inputs, config, lib, outputs, globals, nodes, minimal, ... }:
 let
-  mainUser = globals.user.name;
+  inherit (config.swarselsystems) mainUser;
 in
 {
   options.swarselsystems.modules.home-manager = lib.mkEnableOption "home-manager";
@@ -20,7 +20,7 @@ in
           home.stateVersion = lib.mkDefault config.system.stateVersion;
         }
       ];
-      extraSpecialArgs = { inherit (inputs) self nixgl; inherit inputs outputs globals nodes; };
+      extraSpecialArgs = { inherit (inputs) self nixgl; inherit inputs outputs globals nodes minimal; };
     };
   };
 }

modules/nixos/common/lanzaboote.nix

@@ -1,13 +1,13 @@
-{ lib, config, ... }:
+{ lib, config, minimal, ... }:
 {
   options.swarselsystems.modules.lanzaboote = lib.mkEnableOption "lanzaboote config";
   config = lib.mkIf config.swarselsystems.modules.lanzaboote {
     boot = {
       loader = {
         efi.canTouchEfiVariables = true;
-        systemd-boot.enable = lib.swarselsystems.mkIfElse (config.swarselsystems.initialSetup || !config.swarselsystems.isSecureBoot) (lib.mkForce true) (lib.mkForce false);
+        systemd-boot.enable = lib.swarselsystems.mkIfElse (config.swarselsystems.initialSetup || minimal || !config.swarselsystems.isSecureBoot) (lib.mkForce true) (lib.mkForce false);
       };
-      lanzaboote = lib.mkIf (!config.swarselsystems.initialSetup && config.swarselsystems.isSecureBoot) {
+      lanzaboote = lib.mkIf (!config.swarselsystems.initialSetup && !minimal && config.swarselsystems.isSecureBoot) {
         enable = true;
         pkiBundle = "/var/lib/sbctl";
         configurationLimit = 6;

modules/nixos/common/settings.nix

@@ -1,68 +1,74 @@
-{ lib, pkgs, config, outputs, inputs, ... }:
+{ lib, pkgs, config, outputs, inputs, minimal, ... }:
 {
   options.swarselsystems.modules.general = lib.mkEnableOption "general nix settings";
-  config = lib.mkIf config.swarselsystems.modules.general {
+  config = lib.mkIf config.swarselsystems.modules.general
-    nixpkgs = {
+    ({
-      overlays = [ outputs.overlays.default ];
-      config = {
-        allowUnfree = true;
-      };
-    };
 
-    environment.etc."nixos/configuration.nix".source = pkgs.writeText "configuration.nix" ''
+      system.stateVersion = lib.mkDefault "23.05";
-      assert builtins.trace "This location is not used. The config is found in ${config.swarselsystems.flakePath}!" false;
-      { }
-    '';
 
-    nix =
+      nixpkgs = {
-      let
+        overlays = [ outputs.overlays.default ];
-        flakeInputs = lib.filterAttrs (_: lib.isType "flake") inputs;
+        config = {
-      in
+          allowUnfree = true;
-      {
-        settings = {
-          experimental-features = [
-            "nix-command"
-            "flakes"
-            "ca-derivations"
-            "cgroups"
-            "pipe-operators"
-          ];
-          trusted-users = [ "@wheel" "${config.swarselsystems.mainUser}" ];
-          connect-timeout = 5;
-          bash-prompt-prefix = "$SHLVL:\\w ";
-          bash-prompt = "$(if [[ $? -gt 0 ]]; then printf \"\"; else printf \"\"; fi)\[\e[1m\]λ\[\e[0m\] ";
-          fallback = true;
-          min-free = 128000000;
-          max-free = 1000000000;
-          flake-registry = "";
-          auto-optimise-store = true;
-          warn-dirty = false;
-          max-jobs = 1;
-          use-cgroups = lib.mkIf config.swarselsystems.isLinux true;
         };
-        gc = {
-          automatic = true;
-          dates = "weekly";
-          options = "--delete-older-than 10d";
-        };
-        optimise = {
-          automatic = true;
-          dates = "weekly";
-        };
-        channel.enable = false;
-        registry = rec {
-          nixpkgs.flake = inputs.nixpkgs;
-          p = nixpkgs;
-        };
-        nixPath = lib.mapAttrsToList (n: _: "${n}=flake:${n}") flakeInputs;
       };
 
-    services.dbus.implementation = "broker";
+    }
+    // lib.optionalAttrs (!minimal) {
 
-    systemd.services.nix-daemon = {
+      environment.etc."nixos/configuration.nix".source = pkgs.writeText "configuration.nix" ''
-      environment.TMPDIR = "/var/tmp";
+        assert builtins.trace "This location is not used. The config is found in ${config.swarselsystems.flakePath}!" false;
-    };
+        { }
+      '';
 
-    system.stateVersion = lib.mkDefault "23.05";
+      nix =
-  };
+        let
+          flakeInputs = lib.filterAttrs (_: lib.isType "flake") inputs;
+        in
+        {
+          settings = {
+            experimental-features = [
+              "nix-command"
+              "flakes"
+              "ca-derivations"
+              "cgroups"
+              "pipe-operators"
+            ];
+            trusted-users = [ "@wheel" "${config.swarselsystems.mainUser}" ];
+            connect-timeout = 5;
+            bash-prompt-prefix = "$SHLVL:\\w ";
+            bash-prompt = "$(if [[ $? -gt 0 ]]; then printf \"\"; else printf \"\"; fi)λ ";
+            fallback = true;
+            min-free = 128000000;
+            max-free = 1000000000;
+            flake-registry = "";
+            auto-optimise-store = true;
+            warn-dirty = false;
+            max-jobs = 1;
+            use-cgroups = lib.mkIf config.swarselsystems.isLinux true;
+          };
+          gc = {
+            automatic = true;
+            dates = "weekly";
+            options = "--delete-older-than 10d";
+          };
+          optimise = {
+            automatic = true;
+            dates = "weekly";
+          };
+          channel.enable = false;
+          registry = rec {
+            nixpkgs.flake = inputs.nixpkgs;
+            p = nixpkgs;
+          };
+          nixPath = lib.mapAttrsToList (n: _: "${n}=flake:${n}") flakeInputs;
+        };
+
+      services.dbus.implementation = "broker";
+
+      systemd.services.nix-daemon = {
+        environment.TMPDIR = "/var/tmp";
+      };
+
+    });
 }

modules/nixos/common/users.nix

@@ -1,4 +1,4 @@
-{ self, pkgs, config, lib, ... }:
+{ self, pkgs, config, lib, minimal, ... }:
 let
   sopsFile = self + /secrets/general/secrets.yaml;
 in
@@ -12,9 +12,9 @@ in
       users."${config.swarselsystems.mainUser}" = {
         isNormalUser = true;
         description = "Leon S";
-        password = lib.mkIf config.swarselsystems.initialSetup "setup";
+        password = lib.mkIf (config.swarselsystems.initialSetup || minimal) "setup";
-        hashedPasswordFile = lib.mkIf (!config.swarselsystems.initialSetup) config.sops.secrets.swarseluser.path;
+        hashedPasswordFile = lib.mkIf (!config.swarselsystems.initialSetup && !minimal) config.sops.secrets.swarseluser.path;
-        extraGroups = [ "networkmanager" "syncthing" "docker" "wheel" "lp" "audio" "video" "vboxusers" "libvirtd" "scanner" ];
+        extraGroups = lib.mkIf (!minimal) [ "networkmanager" "syncthing" "docker" "wheel" "lp" "audio" "video" "vboxusers" "libvirtd" "scanner" ];
         packages = with pkgs; [ ];
       };
     };

nix/iso.nix

@@ -1,4 +1,4 @@
-{ inputs, ... }:
+{ self, inputs, ... }:
 {
   perSystem = { pkgs, system, ... }:
     {
@@ -7,7 +7,7 @@
         inherit pkgs;
         modules = [
           inputs.home-manager.nixosModules.home-manager
-          ./installer-config.nix
+          "${self}/install/installer-config.nix"
         ];
         format =
           {

profiles/home/minimal/default.nix

@@ -0,0 +1,13 @@
+{ lib, config, ... }:
+{
+  options.swarselsystems.profiles.minimal = lib.mkEnableOption "is this a personal host";
+  config = lib.mkIf config.swarselsystems.profiles.minimal {
+    swarselsystems.modules = {
+      general = lib.mkDefault true;
+      sops = lib.mkDefault true;
+      kitty = lib.mkDefault true;
+      zsh = lib.mkDefault true;
+    };
+  };
+
+}

profiles/nixos/minimal/default.nix

@@ -0,0 +1,27 @@
+{ lib, config, ... }:
+{
+  options.swarselsystems.profiles.minimal = lib.mkEnableOption "declare this a minimal host";
+  config = lib.mkIf config.swarselsystems.profiles.minimal {
+    swarselsystems.modules = {
+      general = lib.mkDefault true;
+      home-manager = lib.mkDefault true;
+      xserver = lib.mkDefault true;
+      lanzaboote = lib.mkDefault true;
+      time = lib.mkDefault true;
+      users = lib.mkDefault true;
+      impermanence = lib.mkDefault true;
+      security = lib.mkDefault true;
+      sops = lib.mkDefault true;
+      pii = lib.mkDefault true;
+      zsh = lib.mkDefault true;
+      yubikey = lib.mkDefault true;
+      autologin = lib.mkDefault true;
+
+      server = {
+        ssh = lib.mkDefault true;
+      };
+    };
+
+  };
+
+}

profiles/nixos/toto/default.nix

@@ -4,6 +4,7 @@
   config = lib.mkIf config.swarselsystems.profiles.toto {
     swarselsystems.modules = {
       general = lib.mkDefault true;
+      packages = lib.mkDefault true;
       home-manager = lib.mkDefault true;
       xserver = lib.mkDefault true;
       users = lib.mkDefault true;