move more stuf out of flake.nix

nixosModules/global-settings-desktop.nix

@@ -0,0 +1,57 @@
+{
+  home-manager-users,
+  self,
+  home-manager,
+  servicepoint-cli,
+  servicepoint-simulator,
+  servicepoint-tanks,
+  stylix,
+  specialArgs,
+  ...
+}:
+{
+  imports = [
+    {
+      home-manager = {
+        extraSpecialArgs = specialArgs;
+        useGlobalPkgs = true;
+        useUserPackages = true;
+      };
+
+      time.timeZone = "Europe/Berlin";
+
+      home-manager.sharedModules = [
+        { home.stateVersion = "22.11"; }
+        # keep-sorted start
+        self.homeModules.git
+        self.homeModules.gnome-extensions
+        self.homeModules.nano
+        self.homeModules.templates
+        self.homeModules.zsh-basics
+        self.homeModules.zsh-powerlevel10k
+        # keep-sorted end
+      ];
+
+      home-manager.users = home-manager-users;
+    }
+
+    # keep-sorted start
+    home-manager.nixosModules.home-manager
+    self.nixosModules.en-de
+    self.nixosModules.firmware-updates
+    self.nixosModules.gnome
+    self.nixosModules.kdeconnect
+    self.nixosModules.modern-desktop
+    self.nixosModules.niri
+    self.nixosModules.nix-ld
+    self.nixosModules.pkgs-unstable
+    self.nixosModules.pkgs-vscode-extensions
+    self.nixosModules.quiet-boot
+    self.nixosModules.stylix
+    servicepoint-cli.nixosModules.default
+    servicepoint-simulator.nixosModules.default
+    servicepoint-tanks.nixosModules.default
+    stylix.nixosModules.stylix
+    # keep-sorted end
+  ];
+}

nixosModules/global-settings.nix

@@ -0,0 +1,47 @@
+{
+  device,
+  self,
+  lanzaboote,
+  zerforschen-plus,
+  ...
+}:
+{
+  imports = [
+    # keep-sorted start
+    lanzaboote.nixosModules.lanzaboote
+    self.nixosModules.allowed-unfree-list
+    self.nixosModules.autoupdate
+    self.nixosModules.default
+    self.nixosModules.extra-caches
+    self.nixosModules.globalinstalls
+    self.nixosModules.lix-is-nix
+    self.nixosModules.openssh
+    self.nixosModules.prometheus-node
+    self.nixosModules.systemd-boot
+    self.nixosModules.tailscale
+    zerforschen-plus.nixosModules.default
+    # keep-sorted end
+  ];
+
+  config = {
+    networking.hostName = device;
+    system = {
+      stateVersion = "22.11";
+      autoUpgrade.flake = "git+https://git.berlin.ccc.de/vinzenz/nixos-configuration.git";
+    };
+
+    nixpkgs.overlays = [
+      self.overlays.unstable-packages
+    ];
+
+    nix.settings.experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+
+    documentation = {
+      info.enable = false; # info pages and the info command
+      doc.enable = false; # documentation distributed in packages' /share/doc
+    };
+  };
+}

nixosModules/openssh.nix

@@ -3,7 +3,7 @@
     enable = true;
     openFirewall = true;
     settings = {
-      PermitRootLogin = "without-password";
+      PermitRootLogin = "prohibit-password";
       PasswordAuthentication = false;
       KbdInteractiveAuthentication = false;
     };

nixosModules/pxvirt-guest.nix

@@ -0,0 +1,26 @@
+{ modulesPath, lib, ... }:
+{
+  imports = [ (modulesPath + "/virtualisation/proxmox-lxc.nix") ];
+
+  config = {
+    # TODO is this needed?
+    # nix.settings.sandbox = false;
+
+    proxmoxLXC = {
+      manageNetwork = false;
+      privileged = false;
+    };
+
+    # Let Proxmox host handle fstrim
+    services.fstrim.enable = false;
+
+    # TODO is this needed
+    # Cache DNS lookups to improve performance
+    services.resolved.extraConfig = ''
+      Cache=true
+      CacheFromLocalhost=true
+    '';
+
+    boot.loader.systemd-boot.enable = lib.mkForce false;
+  };
+}