Progress rewrite further

modules/nixos/core/default.nix

@@ -0,0 +1,6 @@
+{ lib }:
+
+{
+  imports = lib.getModuleImports;
+}
+

modules/nixos/core/fonts.nix

@@ -0,0 +1,27 @@
+{ pkgs, ... }:
+
+{
+  fonts = {
+    packages = with pkgs; [
+      (nerdfonts.override {
+        fonts = [
+          "GoMono"
+        ];
+      })
+      ipafont
+      noto-fonts-emoji
+      cantarell-fonts
+      newcomputermodern
+    ];
+
+    fontconfig = {
+      enable = true;
+      cache32Bit = true;
+      subpixel.rgba = "rgb";
+      defaultFonts = {
+        monospace = [ "Go Mono Nerd Font" ];
+      };
+    };
+  };
+}
+

modules/nixos/core/impermanence.nix

@@ -0,0 +1,28 @@
+{ config, lib, ... }:
+
+{
+  boot.initrd.postDeviceCommands = lib.mkAfter ''
+    mkdir /btrfs_tmp
+    mount ${config.fileSystems."/".device} /btrfs_tmp
+    if [[ -e /btrfs_tmp/root ]]; then
+        mkdir -p /btrfs_tmp/old_roots
+        timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")
+        mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
+    fi
+
+    delete_subvolume_recursively() {
+        IFS=$'\n'
+        for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
+            delete_subvolume_recursively "/btrfs_tmp/$i"
+        done
+        btrfs subvolume delete "$1"
+    }
+
+    for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
+        delete_subvolume_recursively "$i"
+    done
+
+    btrfs subvolume create /btrfs_tmp/root
+    umount /btrfs_tmp
+  '';
+}

modules/nixos/core/nix.nix

@@ -0,0 +1,19 @@
+{ lib, ... }:
+
+{
+  nix = {
+    settings = {
+      auto-optimise-store = true;
+      use-xdg-base-directories = true;
+      trusted-users = [ "@wheel" ];
+      allowed-users = [ "@wheel" ];
+    };
+  };
+
+  nixpkgs = {
+    config = {
+      allowUnfree = true;
+    };
+    hostPlatform = lib.mkDefault "x86_64-linux";
+  };
+}

modules/nixos/core/security.nix

@@ -0,0 +1,32 @@
+{ ... }:
+
+{
+  programs.gnupg = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  /*
+   * Sudo is scheduled to be replaced by systemd's run0.
+   * The blocker for this is persistent authentication support.
+   *
+   * https://github.com/systemd/systemd/issues/33366
+   * https://github.com/polkit-org/polkit/issues/472
+   */
+  security.sudo = {
+    enable = true;
+    execWheelOnly = true;
+    extraConfig = ''
+      Defaults  lecture="never"
+    '';
+  };
+
+  security.apparmor.enable = true;
+  networking.firewall.enable = true;
+
+  /* Disable the root user */
+  users = {
+    users.root.hashedPassword = "!";
+    mutableUsers = false;
+  };
+}

modules/nixos/core/zsh.nix

@@ -0,0 +1,10 @@
+{ ... }:
+
+{
+  programs.zsh = {
+    enable = true;
+    shellInit = ''
+      export ZDOTDIR=$HOME/.local/share/zsh
+    '';
+  };
+}