more work on hosts/ and modules/config

Signed-off-by: unexplrd <unexplrd@linerds.us>

modules/nixos/config/boot/default.nix

@@ -29,8 +29,8 @@
       # "module.sig_enforce=1"
     ];
     initrd = {
-      systemd.enable = true; # needed for auto-unlocking with TPM
-      systemd.tpm2.enable = config.module.config.tpmDiskUnlock;
+      systemd.enable = true;
+      systemd.tpm2.enable = false;
     };
   };
 }

modules/nixos/config/boot/lanzaboote.nix

@@ -1,7 +1,6 @@
 {
   config,
   inputs,
-  lib,
   ...
 }: {
   imports = with inputs; [
@@ -12,6 +11,5 @@
       enable = config.module.config.secureBoot;
       pkiBundle = "/var/lib/sbctl";
     };
-    loader.systemd-boot.enable = lib.mkDefault (!config.boot.lanzaboote.enable);
   };
 }

modules/nixos/config/boot/loader.nix

@@ -7,7 +7,6 @@
     timeout = 3;
     efi.canTouchEfiVariables = true;
     systemd-boot = {
-      enable = true;
       consoleMode = "auto";
       configurationLimit = lib.mkOverride 1337 10;
     };

modules/nixos/config/default.nix

@@ -1,10 +1,12 @@
 {
   config,
+  inputs,
   lib,
   pkgs,
   ...
 }: let
   inherit (lib) mkDefault mkEnableOption mkIf;
+  inherit (config.networking) hostName;
   cfg = config.module.config;
 in {
   imports = [
@@ -28,12 +30,28 @@ in {
       };
     };
   };
-  config = mkIf (cfg.vaapi
-    == "intel-media-driver") {
-    hardware.graphics.extraPackages = with pkgs; [
-      intel-compute-runtime
-      intel-media-driver
-      vpl-gpu-rt
-    ];
-  };
+  config =
+    mkIf (cfg.vaapi
+      == "intel-media-driver") {
+      hardware.graphics.extraPackages = with pkgs; [
+        intel-compute-runtime
+        intel-media-driver
+        vpl-gpu-rt
+      ];
+    }
+    // mkIf cfg.tpmDiskUnlock {
+      initrd.systemd.tpm2.enable = mkDefault true;
+    }
+    // mkIf cfg.useIwd {
+      networking = {
+        networkmanager.wifi.backend = "iwd";
+        wireless.iwd.enable = true;
+      };
+    }
+    // {
+      boot.loader.systemd-boot.enable =
+        if cfg.secureBoot
+        then false
+        else true;
+    };
 }

modules/nixos/config/networking/default.nix

@@ -1,8 +1,18 @@
 {
-  imports = [
-    ./network-manager
-  ];
   networking = {
     hosts = import ./hosts.nix;
+    networkmanager = {
+      ethernet.macAddress = "stable";
+      wifi = {
+        macAddress = "random";
+        scanRandMacAddress = true;
+      };
+    };
+    wireless.iwd.settings = {
+      settings = {
+        General.AddressRandomization = "network";
+        Settings.AlwaysRandomizeAddress = true;
+      };
+    };
   };
 }

modules/nixos/config/networking/network-manager/default.nix

@@ -1,15 +0,0 @@
-{
-  imports = [
-    ./wireless-iwd.nix
-  ];
-  networking = {
-    networkmanager = {
-      enable = true;
-      ethernet.macAddress = "stable";
-      wifi = {
-        macAddress = "random";
-        scanRandMacAddress = true;
-      };
-    };
-  };
-}

modules/nixos/config/networking/network-manager/wireless-iwd.nix

@@ -1,15 +0,0 @@
-{config, ...}: {
-  networking = {
-    networkmanager.wifi.backend =
-      if config.module.config.useIwd
-      then "iwd"
-      else "wpa_supplicant";
-    wireless.iwd = {
-      enable = config.module.config.useIwd;
-      settings = {
-        General.AddressRandomization = "network";
-        Settings.AlwaysRandomizeAddress = true;
-      };
-    };
-  };
-}

modules/nixos/config/users.nix

@@ -8,6 +8,7 @@
   inherit (inputs) mysecrets;
   sshKeys = f: "${mysecrets}/ssh/user/id_${f}_ed25519.pub";
 in {
+  nix.settings.trusted-users = ["user"];
   users.mutableUsers = false;
   users.users = {
     user = {

modules/nixos/system/wireless/default.nix

@@ -1,6 +1,5 @@
 {
   imports = [
     ./bluetooth.nix
-    ./wifi.nix
   ];
 }

modules/nixos/system/wireless/wifi.nix

@@ -1,29 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-with lib; let
-  cfg = config.wireless.wifi;
-in {
-  options = {
-    wireless.wifi.enable =
-      mkEnableOption "enables wifi with iwd and MAC address randomisation";
-  };
-  config = mkIf cfg.enable {
-    networking = {
-      networkmanager.wifi = {
-        backend = "iwd";
-        macAddress = "random";
-        scanRandMacAddress = true;
-      };
-      wireless.iwd = {
-        enable = true;
-        settings = {
-          General.AddressRandomization = "network";
-          Settings.AlwaysRandomizeAddress = true;
-        };
-      };
-    };
-  };
-}