split up modules differently

flake.nix

@@ -22,38 +22,23 @@
         lix-module.nixosModules.default
         ./common
       ];
+      desktop-modules = [
+        home-manager.nixosModules.home-manager
+        ./home
+        ./modules/desktop-environment.nix
+        ./modules/desktop-hardware.nix
+      ];
+      host-params = {
+        inherit nixpkgs;
+        inherit home-manager;
+        inherit lix-module;
+        common-modules = common-modules;
+        desktop-modules = desktop-modules;
+      };
     in {
-      vinzenz-lpt2 = nixpkgs.lib.nixosSystem {
+      vinzenz-lpt2 = import ./hosts/vinzenz-lpt2 host-params;
-        system = "x86_64-linux";
+      vinzenz-pc2 = import ./hosts/vinzenz-pc2 host-params;
-        modules =
+      hetzner-vpn1 = import ./hosts/hetzner-vpn1 host-params;
-          common-modules
-          ++ [
-            home-manager.nixosModules.home-manager
-            ./hosts/vinzenz-lpt2
-          ];
-      };
-      vinzenz-pc2 = nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules =
-          common-modules
-          ++ [
-            home-manager.nixosModules.home-manager
-            ./hosts/vinzenz-pc2
-          ];
-      };
-      hetzner-vpn1 = nixpkgs.lib.nixosSystem {
-        system = "aarch64-linux";
-        modules =
-          common-modules
-          ++ [
-            ./hosts/hetzner-vpn1
-
-            {
-              # uncomment for build check on non arm system (requires --impure)
-              # nixpkgs.buildPlatform = builtins.currentSystem;
-            }
-          ];
-      };
     };
   };
 }

hosts/hetzner-vpn1/default.nix

@@ -1,9 +1,95 @@
-{...}: {
+{
-  imports = [
+  nixpkgs,
+  common-modules,
+  desktop-modules,
+  ...
+}:
+nixpkgs.lib.nixosSystem {
+  system = "aarch64-linux";
+  modules =
+    common-modules
+    ++ [
       ./hardware.nix
-    ./environment.nix
+      ../../users/vinzenz.nix
-  ];
+      ../../users/ronja.nix
-  config = {
+      {
         networking.hostName = "hetzner-vpn1";
+      }
+      {
+        # uncomment for build check on non arm system (requires --impure)
+        # nixpkgs.buildPlatform = builtins.currentSystem;
+      }
+
+      {
+        users.users = {
+          root.openssh.authorizedKeys.keys = [
+            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICdYqY3Y1/f1bsAi5Qfyr/UWuX9ixu96IeAlhoQaJkbf''
+            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
+            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv vinzenz-pc2 home roaming''
+            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC vinzenz-lpt2-roaming''
+          ];
+          vinzenz.openssh.authorizedKeys.keys = [
+            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICdYqY3Y1/f1bsAi5Qfyr/UWuX9ixu96IeAlhoQaJkbf''
+            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
+            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv vinzenz-pc2 home roaming''
+            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC vinzenz-lpt2-roaming''
+          ];
+          ronja.openssh.authorizedKeys.keys = [
+            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALWKm+d6KL6Vl3grPOcGouiNTkvdhXuWJmcrdEBY2nw ronja-ssh-host-key''
+          ];
         };
       }
+      {
+        security.acme = {
+          acceptTerms = true;
+          defaults.email = "acme@zerforschen.plus";
+        };
+
+        security.pam.services.nginx.setEnvironment = false;
+        systemd.services.nginx.serviceConfig = {
+          SupplementaryGroups = ["shadow"];
+        };
+
+        services.nginx = {
+          enable = true;
+          additionalModules = [pkgs.nginxModules.pam];
+
+          recommendedProxySettings = true;
+          recommendedTlsSettings = true;
+          recommendedGzipSettings = true;
+          recommendedOptimisation = true;
+
+          virtualHosts = let
+            servicesDomain = "services.zerforschen.plus";
+            mkServiceConfig = host: port: {
+              addSSL = true;
+              enableACME = true;
+              locations."/" = {
+                proxyPass = "http://${host}:${toString port}/";
+                extraConfig = ''
+                  # bind to tailscale ip
+                  proxy_bind 100.88.118.60;
+                  # pam auth
+                  limit_except OPTIONS {
+                    auth_pam  "Password Required";
+                    auth_pam_service_name "nginx";
+                  }
+                '';
+              };
+            };
+            lpt2 = "vinzenz-lpt2.donkey-pentatonic.ts.net";
+            pc2 = "vinzenz-pc2.donkey-pentatonic.ts.net";
+          in {
+            "vscode.${servicesDomain}" = lib.mkMerge [
+              (mkServiceConfig pc2 8542)
+              {locations."/" .proxyWebsockets = true;}
+            ];
+            "preon-app.${servicesDomain}" = mkServiceConfig pc2 8543;
+            "preon-api.${servicesDomain}" = mkServiceConfig pc2 8544;
+          };
+        };
+
+        networking.firewall.allowedTCPPorts = [80 443];
+      }
+    ];
+}

hosts/hetzner-vpn1/environment.nix

@@ -1,81 +0,0 @@
-{
-  pkgs,
-  lib,
-  ...
-}: {
-  imports = [
-    ../../users/vinzenz.nix
-    ../../users/ronja.nix
-  ];
-
-  config = {
-    users.users = {
-      root.openssh.authorizedKeys.keys = [
-        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICdYqY3Y1/f1bsAi5Qfyr/UWuX9ixu96IeAlhoQaJkbf''
-        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
-        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv vinzenz-pc2 home roaming''
-        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC vinzenz-lpt2-roaming''
-      ];
-      vinzenz.openssh.authorizedKeys.keys = [
-        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICdYqY3Y1/f1bsAi5Qfyr/UWuX9ixu96IeAlhoQaJkbf''
-        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
-        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv vinzenz-pc2 home roaming''
-        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC vinzenz-lpt2-roaming''
-      ];
-      ronja.openssh.authorizedKeys.keys = [
-        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALWKm+d6KL6Vl3grPOcGouiNTkvdhXuWJmcrdEBY2nw ronja-ssh-host-key''
-      ];
-    };
-
-    security.acme = {
-      acceptTerms = true;
-      defaults.email = "acme@zerforschen.plus";
-    };
-
-    security.pam.services.nginx.setEnvironment = false;
-    systemd.services.nginx.serviceConfig = {
-      SupplementaryGroups = ["shadow"];
-    };
-
-    services.nginx = {
-      enable = true;
-      additionalModules = [pkgs.nginxModules.pam];
-
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-      recommendedGzipSettings = true;
-      recommendedOptimisation = true;
-
-      virtualHosts = let
-        servicesDomain = "services.zerforschen.plus";
-        mkServiceConfig = host: port: {
-          addSSL = true;
-          enableACME = true;
-          locations."/" = {
-            proxyPass = "http://${host}:${toString port}/";
-            extraConfig = ''
-              # bind to tailscale ip
-              proxy_bind 100.88.118.60;
-              # pam auth
-              limit_except OPTIONS {
-                auth_pam  "Password Required";
-                auth_pam_service_name "nginx";
-              }
-            '';
-          };
-        };
-        lpt2 = "vinzenz-lpt2.donkey-pentatonic.ts.net";
-        pc2 = "vinzenz-pc2.donkey-pentatonic.ts.net";
-      in {
-        "vscode.${servicesDomain}" = lib.mkMerge [
-          (mkServiceConfig pc2 8542)
-          {locations."/" .proxyWebsockets = true;}
-        ];
-        "preon-app.${servicesDomain}" = mkServiceConfig pc2 8543;
-        "preon-api.${servicesDomain}" = mkServiceConfig pc2 8544;
-      };
-    };
-
-    networking.firewall.allowedTCPPorts = [80 443];
-  };
-}

hosts/vinzenz-lpt2/default.nix

@@ -1,11 +1,79 @@
-{...}: {
+{
-  imports = [
+  nixpkgs,
+  common-modules,
+  desktop-modules,
+  ...
+}:
+nixpkgs.lib.nixosSystem {
+  system = "x86_64-linux";
+  modules =
+    common-modules
+    ++ desktop-modules
+    ++ [
       ./hardware.nix
-    ./environment.nix
-  ];
-  config = {
-    networking.hostName = "vinzenz-lpt2";
 
+      ../../home/gnome.nix
+      ../../users/vinzenz.nix
+      ../../modules/gnome.nix
+      ../../modules/gaming.nix
+      ../../modules/printing.nix
+      ../../modules/latex.nix
+
+      {
+        networking.hostName = "vinzenz-lpt2";
         nix.settings.extra-platforms = ["aarch64-linux"];
+      }
+
+      {
+        home-manager.users.vinzenz = import ../../home/vinzenz;
+
+        users.users.vinzenz.openssh.authorizedKeys.keys = [
+          ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
+          ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv vinzenz-pc2 home roaming''
+        ];
+
+        #users.users.ronja.openssh.authorizedKeys.keys = [
+        #  ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALWKm+d6KL6Vl3grPOcGouiNTkvdhXuWJmcrdEBY2nw ronja-ssh-host-key''
+        #];
+      }
+
+      {
+        virtualisation = {
+          containers.enable = true;
+          podman = {
+            enable = true;
+            dockerCompat = true;
+            dockerSocket.enable = true;
+            autoPrune.enable = true;
+          };
         };
       }
+
+      {
+        services.nginx = {
+          enable = true;
+
+          recommendedProxySettings = true;
+          recommendedTlsSettings = true;
+          recommendedGzipSettings = true;
+          recommendedOptimisation = true;
+
+          virtualHosts = {
+            "vinzenz-lpt2" = {
+              locations."/" = {
+                proxyPass = "http://127.0.0.1:3000/";
+                proxyWebsockets = true;
+              };
+
+              serverAliases = ["172.23.42.96"];
+            };
+          };
+        };
+
+        networking.firewall = {
+          allowedTCPPorts = [80 8001 3000];
+          allowedUDPPorts = [2342];
+        };
+      }
+    ];
+}

hosts/vinzenz-lpt2/environment.nix

@@ -1,60 +0,0 @@
-{pkgs, ...}: {
-  imports = [
-    ../../home
-    ../../home/gnome.nix
-    ../../users/vinzenz.nix
-    ../../modules/desktop-environment.nix
-    ../../modules/gnome.nix
-    ../../modules/gaming.nix
-    ../../modules/printing.nix
-    ../../modules/latex.nix
-  ];
-
-  config = {
-    home-manager.users.vinzenz = import ../../home/vinzenz;
-
-    virtualisation = {
-      containers.enable = true;
-      podman = {
-        enable = true;
-        dockerCompat = true;
-        dockerSocket.enable = true;
-        autoPrune.enable = true;
-      };
-    };
-
-    users.users.vinzenz.openssh.authorizedKeys.keys = [
-      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
-      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv vinzenz-pc2 home roaming''
-    ];
-
-    #users.users.ronja.openssh.authorizedKeys.keys = [
-    #  ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALWKm+d6KL6Vl3grPOcGouiNTkvdhXuWJmcrdEBY2nw ronja-ssh-host-key''
-    #];
-
-    services.nginx = {
-      enable = true;
-
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-      recommendedGzipSettings = true;
-      recommendedOptimisation = true;
-
-      virtualHosts = {
-        "vinzenz-lpt2" = {
-          locations."/" = {
-            proxyPass = "http://127.0.0.1:3000/";
-            proxyWebsockets = true;
-          };
-
-          serverAliases = ["172.23.42.96"];
-        };
-      };
-    };
-
-    networking.firewall = {
-      allowedTCPPorts = [80 8001 3000];
-      allowedUDPPorts = [2342];
-    };
-  };
-}

hosts/vinzenz-lpt2/hardware.nix

@@ -4,7 +4,6 @@
   ...
 }: {
   imports = [
-    ../../modules/desktop-hardware.nix
     ../../modules/intel-graphics.nix
   ];
   config = {

hosts/vinzenz-pc2/default.nix

@@ -1,9 +1,60 @@
-{...}: {
+{
-  imports = [
+  nixpkgs,
+  common-modules,
+  desktop-modules,
+  ...
+}:
+nixpkgs.lib.nixosSystem {
+  system = "x86_64-linux";
+  modules =
+    common-modules
+    ++ desktop-modules
+    ++ [
       ./hardware.nix
-    ./environment.nix
+      ../../home/gnome.nix
-  ];
+      ../../users/vinzenz.nix
-  config = {
+      ../../users/ronja.nix
+      ../../modules/gnome.nix
+      ../../modules/gaming.nix
+      ../../modules/printing.nix
+      {
         networking.hostName = "vinzenz-pc2";
+      }
+      {
+        home-manager.users = {
+          vinzenz = import ../../home/vinzenz;
+          ronja = import ../../home/ronja.nix;
+        };
+
+        users.users.vinzenz.openssh.authorizedKeys.keys = [
+          ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrY6tcgnoC/xbgL7vxSjddEY9MBxRXe9n2cAHt88/TT home roaming''
+          ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
+          ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC vinzenz-lpt2-roaming''
+        ];
+
+        users.users.ronja.openssh.authorizedKeys.keys = [
+          ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALWKm+d6KL6Vl3grPOcGouiNTkvdhXuWJmcrdEBY2nw ssh-host-key''
+        ];
+      }
+      {
+        services.openvscode-server = {
+          enable = true;
+          telemetryLevel = "off";
+          port = 8542;
+          host = "100.125.93.127"; # tailscale
+          withoutConnectionToken = true;
+          extraPackages = with pkgs; [nodejs git gh direnv];
+        };
+
+        virtualisation.podman = {
+          enable = true;
+        };
+
+        networking = {
+          firewall = {
+            allowedTCPPorts = [8542 8543 8544 80];
+          };
         };
       }
+    ];
+}

hosts/vinzenz-pc2/environment.nix

@@ -1,50 +0,0 @@
-{pkgs, ...}: {
-  imports = [
-    ../../home
-    ../../home/gnome.nix
-    ../../users/vinzenz.nix
-    ../../users/ronja.nix
-    ../../modules/desktop-environment.nix
-    ../../modules/gnome.nix
-    ../../modules/gaming.nix
-    ../../modules/printing.nix
-  ];
-
-  config = {
-    home-manager.users = {
-      vinzenz = import ../../home/vinzenz;
-      ronja = import ../../home/ronja.nix;
-    };
-
-    users.users.vinzenz.openssh.authorizedKeys.keys = [
-      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrY6tcgnoC/xbgL7vxSjddEY9MBxRXe9n2cAHt88/TT home roaming''
-      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
-      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC vinzenz-lpt2-roaming''
-    ];
-
-    users.users.ronja.openssh.authorizedKeys.keys = [
-      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALWKm+d6KL6Vl3grPOcGouiNTkvdhXuWJmcrdEBY2nw ssh-host-key''
-    ];
-
-    services.openvscode-server = {
-      enable = true;
-      telemetryLevel = "off";
-      port = 8542;
-      host = "100.125.93.127"; # tailscale
-      withoutConnectionToken = true;
-      extraPackages = with pkgs; [nodejs git gh direnv];
-    };
-
-    virtualisation.podman = {
-      enable = true;
-    };
-
-    networking = {
-      firewall = {
-        allowedTCPPorts = [8542 8543 8544 80];
-      };
-
-      interfaces.eno1.wakeOnLan.enable = true;
-    };
-  };
-}

hosts/vinzenz-pc2/fstab.nix

@@ -0,0 +1,37 @@
+{
+  "/" = {
+    device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
+    fsType = "btrfs";
+    options = ["subvol=@"];
+  };
+
+  "/home" = {
+    device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
+    fsType = "btrfs";
+    options = ["subvol=@home"];
+  };
+
+  "/games" = {
+    device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
+    fsType = "btrfs";
+    options = ["subvol=@games"];
+  };
+
+  "/boot" = {
+    device = "/dev/disk/by-uuid/AF67-8F16";
+    fsType = "vfat";
+  };
+
+  "/mnt/nixos_btrfs_root" = {
+    # subvolume with id 5 is always the root volume
+    # this is convenient for managing the flat subvolume hierarchy
+    device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
+    fsType = "btrfs";
+    options = ["subvolid=5"];
+  };
+
+  "/mnt/ssd2" = {
+    device = "/dev/disk/by-uuid/6b2a647d-c68e-4c07-85bf-c9bfc5db7e8a";
+    fsType = "ext4";
+  };
+}

hosts/vinzenz-pc2/hardware.nix

@@ -1,6 +1,5 @@
 {...}: {
   imports = [
-    ../../modules/desktop-hardware.nix
     ../../modules/amd-graphics.nix
   ];
   config = {
@@ -13,44 +12,9 @@
       loader.efi.efiSysMountPoint = "/boot";
     };
 
-    fileSystems = {
+    fileSystems = import ./fstab.nix;
-      "/" = {
-        device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
-        fsType = "btrfs";
-        options = ["subvol=@"];
-      };
-
-      "/home" = {
-        device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
-        fsType = "btrfs";
-        options = ["subvol=@home"];
-      };
-
-      "/games" = {
-        device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
-        fsType = "btrfs";
-        options = ["subvol=@games"];
-      };
-
-      "/boot" = {
-        device = "/dev/disk/by-uuid/AF67-8F16";
-        fsType = "vfat";
-      };
-
-      "/mnt/nixos_btrfs_root" = {
-        # subvolume with id 5 is always the root volume
-        # this is convenient for managing the flat subvolume hierarchy
-        device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
-        fsType = "btrfs";
-        options = ["subvolid=5"];
-      };
-
-      "/mnt/ssd2" = {
-        device = "/dev/disk/by-uuid/6b2a647d-c68e-4c07-85bf-c9bfc5db7e8a";
-        fsType = "ext4";
-      };
-    };
-
     swapDevices = [];
+
+    interfaces.eno1.wakeOnLan.enable = true;
   };
 }