finally system boots with new config

need to add all my stuff btw

modules/core/config.nix

@@ -0,0 +1,103 @@
+{
+  config,
+  pkgs,
+  shared,
+  ...
+}:
+let
+  cfg = config.workstation.core;
+  allowRootSSH = if cfg.ssh.permitRootLogin then "yes" else "no";
+in
+{
+  config = {
+    networking.hostName = cfg.hostname;
+
+    boot = {
+      kernelPackages = shared.kernelOptions.${cfg.kernel};
+      loader = {
+        systemd-boot = {
+          enable = true;
+          editor = true;
+        };
+        efi.canTouchEfiVariables = true;
+      };
+    };
+
+    time.timeZone = "America/Chicago";
+
+    programs.${cfg.user.shell}.enable = true;
+
+    users.users.${cfg.user.name} = with cfg.user; {
+      isNormalUser = true;
+      description = fullName;
+      extraGroups = [
+        "wheel"
+        "networkmanager"
+        "input"
+      ];
+
+      shell = pkgs.${shell};
+    };
+
+    nixpkgs.config.allowUnfree = true;
+
+    environment.systemPackages = with pkgs; [
+      gitFull
+      neovim
+      git-credential-manager
+      gnupg
+    ];
+
+    nix = {
+      gc = {
+        automatic = true;
+        dates = "weekly";
+        options = "--delete-older-than 7d";
+      };
+      settings = {
+        trusted-users = [
+          "root"
+          cfg.user.name
+        ];
+        experimental-features = [
+          "nix-command"
+          "flakes"
+        ];
+        auto-optimise-store = true;
+      };
+    };
+
+    programs.nix-ld.enable = true;
+
+    i18n = {
+      defaultLocale = "en_US.UTF-8";
+
+      extraLocaleSettings = {
+        LC_ADDRESS = "en_US.UTF-8";
+        LC_IDENTIFICATION = "en_US.UTF-8";
+        LC_MEASUREMENT = "en_US.UTF-8";
+        LC_MONETARY = "en_US.UTF-8";
+        LC_NAME = "en_US.UTF-8";
+        LC_NUMERIC = "en_US.UTF-8";
+        LC_PAPER = "en_US.UTF-8";
+        LC_TELEPHONE = "en_US.UTF-8";
+        LC_TIME = "en_US.UTF-8";
+      };
+    };
+
+    security.rtkit.enable = true;
+
+    services = {
+      xserver.xkb = {
+        layout = "us";
+        variant = "";
+      };
+
+      openssh = {
+        enable = true;
+        settings.PermitRootLogin = allowRootSSH;
+      };
+    };
+    system.stateVersion = "26.11";
+  };
+}

modules/core/default.nix

@@ -1,107 +1,13 @@
-{ pkgs, inputs, ... }:
+{ pkgs, ... }:
+
 let
-  system = pkgs.stdenv.hostPlatform.system;
+  shared = import ./shared.nix { inherit pkgs; };
 in
 {
-  boot.kernelPackages = pkgs.linuxPackages_latest;
-
-  time.timeZone = "America/Chicago";
-
-  programs.fish.enable = true;
-
-  users.users.river = {
-    isNormalUser = true;
-    description = "Maaz Khokhar";
-    extraGroups = [
-      "wheel"
-      "networkmanager"
-      "input"
-    ];
-
-    shell = pkgs.fish;
-  };
-
-  nixpkgs.config.allowUnfree = true;
-
-  environment.systemPackages = with pkgs; [
-    gitFull
-    neovim
-    btop
-    unzip
-    mpv
-    wl-clipboard
-    wireplumber
-    brightnessctl
-    pulseaudio
-    pavucontrol
-    ghostty
-    git-credential-manager
-    gnupg
-    yazi
-    jujutsu
-    glow
-
-    inputs.silicate.packages.${system}.default
-    inputs.herdr.packages.${system}.default
+  imports = [
+    ./options.nix
+    ./config.nix
   ];
 
-  nix = {
-    gc = {
-      automatic = true;
-      dates = "weekly";
-      options = "--delete-older-than 7d";
-    };
-    settings = {
-      trusted-users = [
-        "root"
-        "river"
-      ];
-      experimental-features = [
-        "nix-command"
-        "flakes"
-      ];
-      auto-optimise-store = true;
-    };
-  };
-
-  programs.nix-ld.enable = true;
-
-  i18n = {
-    defaultLocale = "en_US.UTF-8";
-
-    extraLocaleSettings = {
-      LC_ADDRESS = "en_US.UTF-8";
-      LC_IDENTIFICATION = "en_US.UTF-8";
-      LC_MEASUREMENT = "en_US.UTF-8";
-      LC_MONETARY = "en_US.UTF-8";
-      LC_NAME = "en_US.UTF-8";
-      LC_NUMERIC = "en_US.UTF-8";
-      LC_PAPER = "en_US.UTF-8";
-      LC_TELEPHONE = "en_US.UTF-8";
-      LC_TIME = "en_US.UTF-8";
-    };
-  };
-
-  security.rtkit.enable = true;
-
-  services = {
-    xserver.xkb = {
-      layout = "us";
-      variant = "";
-    };
-
-    pipewire = {
-      enable = true;
-      alsa.enable = true;
-      alsa.support32Bit = true;
-      pulse.enable = true;
-    };
-
-    openssh = {
-      enable = true;
-      settings.PermitRootLogin = "no";
-    };
-
-    printing.enable = true;
-  };
+  _module.args.shared = shared;
 }

modules/core/options.nix

@@ -0,0 +1,48 @@
+{
+  lib,
+  shared,
+  ...
+}:
+{
+  options.workstation.core = {
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      default = "nixos";
+      description = "Hostname of the machine";
+    };
+
+    kernel = lib.mkOption {
+      type = with lib.types; enum (builtins.attrNames shared.kernelOptions);
+      default = "lts";
+      description = "The kernel of the machine";
+    };
+
+    user = {
+      name = lib.mkOption {
+        type = lib.types.str;
+        default = "river";
+        description = "The username of the primary user";
+      };
+
+      fullName = lib.mkOption {
+        type = lib.types.str;
+        default = "Maaz Khokhar";
+        description = "The full name of the user";
+      };
+
+      shell = lib.mkOption {
+        type = lib.types.str;
+        default = "fish";
+        description = "The shell the primary user uses";
+      };
+    };
+
+    allowUnfree = lib.mkEnableOption "unfree packages" // {
+      default = true;
+    };
+
+    ssh = {
+      permitRootLogin = lib.mkEnableOption "root SSH login";
+    };
+  };
+}

modules/core/shared.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+
+{
+  kernelOptions = {
+    stable = pkgs.linuxPackages;
+    lts = pkgs.linuxPackages_6_12;
+    latest = pkgs.linuxPackages_latest;
+  };
+}

modules/networking/core/default.nix

@@ -1,38 +1,38 @@
-{ ... }:
-
+{ config, lib, ... }:
+let
+  cfg = config.workstation.networking.core;
+in
 {
   imports = [
     ./firewall.nix
   ];
 
-  networking = {
-    networkmanager = {
+  config = {
+    networking = {
+      networkmanager = {
+        enable = true;
+        dns = "systemd-resolved";
+      };
+
+      extraHosts = lib.concatMapStringsSep "\n" (
+        host: "${host.ip_address} ${host.hostname}"
+      ) cfg.extraHosts;
+
+      nftables.enable = true;
+
+      nameservers = cfg.nameservers;
+    };
+
+    services.resolved = {
       enable = true;
-      dns = "systemd-resolved";
+
+      settings.Resolve = {
+        dnssec = "true";
+        DNSOverTLS = "true";
+        domains = [ "~." ];
+        fallbackDns = cfg.nameservers;
+      };
+
     };
-    extraHosts = "192.168.1.60 laptop";
-    nftables.enable = true;
-
-    nameservers = [
-      "192.168.1.193" # Pi-hole
-      "1.1.1.1" # Cloudflare
-      "1.0.0.1" # Cloudflare (Secondary)
-    ];
-  };
-
-  services.resolved = {
-    enable = true;
-
-    settings.Resolve = {
-      dnssec = "true";
-      DNSOverTLS = "true";
-      domains = [ "~." ];
-      fallbackDns = [
-        "192.168.1.193" # Pi-hole
-        "1.1.1.1" # Cloudflare
-        "1.0.0.1" # Cloudflare (Secondary)
-      ];
-    };
-
   };
 }

modules/networking/core/firewall.nix

@@ -1,17 +1,14 @@
-{ ... }:
-
+{ config, ... }:
+let
+  cfg = config.workstation.networking.core.firewall;
+in
 {
   networking.firewall = {
     enable = true;
 
-    allowPing = true;
+    allowPing = cfg.allowPing;
 
-    allowedTCPPorts = [
-      22
-      80
-    ];
-    allowedUDPPorts = [
-      53
-    ];
+    allowedTCPPorts = cfg.ports.tcp;
+    allowedUDPPorts = cfg.ports.udp;
   };
 }

modules/networking/default.nix

@@ -1,8 +1,8 @@
-{ ... }:
-
 {
   imports = [
+    ./options.nix
     ./core
+    ./wireguard.nix
     ./tailscale.nix
   ];
 }

modules/networking/options.nix

@@ -0,0 +1,122 @@
+{
+  lib,
+  ...
+}:
+{
+  options.workstation.networking = {
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "river";
+      description = "The user to run tailscale's services as.";
+    };
+
+    # core
+    core = {
+      firewall = {
+        allowPing = lib.mkEnableOption "ICMP pinging" // {
+          default = true;
+        };
+
+        ports = {
+          tcp = lib.mkOption {
+            type = with lib.types; listOf number;
+            default = [
+              22
+              80
+            ];
+          };
+          udp = lib.mkOption {
+            type = with lib.types; listOf number;
+            default = [ 53 ];
+          };
+        };
+      };
+
+      extraHosts = lib.mkOption {
+        type =
+          with lib.types;
+          listOf (
+            submodule (
+              { ... }: {
+                options = {
+                  ip_address = lib.mkOption {
+                    type = str;
+                  };
+
+                  hostname = lib.mkOption {
+                    type = str;
+                  };
+                };
+              }
+            )
+          );
+
+        default = [ ];
+        description = "Additional hosts to add.";
+      };
+
+      nameservers = lib.mkOption {
+        type = with lib.types; listOf str;
+
+        default = [
+          "192.168.1.193"
+          "1.1.1.1"
+          "1.0.0.1"
+        ];
+        description = "DNS Resolvers for System";
+      };
+    };
+
+    # wireguard
+    wireguard = {
+      enable = lib.mkEnableOption "Wireguard support";
+
+      interfaces = lib.mkOption {
+        type = lib.types.attrsOf (
+          lib.types.submodule {
+            options = {
+              enable = lib.mkEnableOption "Enable this WG interface";
+
+              address = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
+                default = [ ];
+              };
+
+              privateKeyFile = lib.mkOption {
+                type = lib.types.str;
+              };
+
+              peers = lib.mkOption {
+                type = lib.types.listOf (
+                  lib.types.submodule {
+                    options = {
+                      publicKey = lib.mkOption { type = lib.types.str; };
+                      allowedIPs = lib.mkOption {
+                        type = lib.types.listOf lib.types.str;
+                        default = [ ];
+                      };
+                      endpoint = lib.mkOption {
+                        type = lib.types.str;
+                        default = "";
+                      };
+                      persistentKeepalive = lib.mkOption {
+                        type = lib.types.nullOr lib.types.int;
+                        default = null;
+                      };
+                    };
+                  }
+                );
+                default = [ ];
+              };
+            };
+          }
+        );
+      };
+    };
+
+    # tailscale
+    tailscale = {
+      enable = lib.mkEnableOption "Tailscale mesh VPN";
+    };
+  };
+}

modules/networking/tailscale.nix

@@ -1,25 +1,30 @@
-{ config, ... }:
-
+{ config, lib, ... }:
+let
+  cfg = config.workstation.networking.tailscale;
+  user = config.workstation.networking.user;
+in
 {
-  services.tailscale = {
-    enable = true;
-    openFirewall = true;
-    extraSetFlags = [ "--operator=river" ];
+  config = lib.mkIf cfg.enable {
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+      extraSetFlags = [ "--operator=${user}" ];
+    };
+
+    networking.firewall = {
+      trustedInterfaces = [ config.services.tailscale.interfaceName ];
+      allowedUDPPorts = [ config.services.tailscale.port ];
+    };
+
+    systemd.services.tailscaled.serviceConfig.Environment = [
+      "TS_DEBUG_FIREWALL_MODE=nftables"
+    ];
+
+    systemd.network.wait-online.enable = false;
+    boot.initrd.systemd.network.wait-online.enable = false;
+
+    users.users.${user}.extraGroups = [
+      "tailscale"
+    ];
   };
-
-  networking.firewall = {
-    trustedInterfaces = [ config.services.tailscale.interfaceName ];
-    allowedUDPPorts = [ config.services.tailscale.port ];
-  };
-
-  systemd.services.tailscaled.serviceConfig.Environment = [
-    "TS_DEBUG_FIREWALL_MODE=nftables"
-  ];
-
-  systemd.network.wait-online.enable = false;
-  boot.initrd.systemd.network.wait-online.enable = false;
-
-  users.users.river.extraGroups = [
-    "tailscale"
-  ];
 }

modules/networking/wireguard.nix

@@ -1,22 +1,21 @@
-{ ... }:
-
+{ config, lib, ... }:
+let
+  cfg = config.workstation.networking.wireguard;
+in
 {
-  networking.wireguard.interfaces = {
-    wg0 = {
-      ips = [ "10.0.0.2/24" ];
-      privateKeyFile = "/etc/wireguard/private.key"; # Keep secrets out of the nix store!
+  config = lib.mkIf cfg.enable {
+    networking.wg-quick.interfaces = lib.mapAttrs (name: iface: {
+      address = iface.address;
+      privateKeyFile = iface.privateKeyFile;
+      peers = map (p: {
+        publicKey = p.publicKey;
+        allowedIPs = p.allowedIPs;
+        endpoint = p.endpoint;
 
-      peers = [
-        {
-          publicKey = "vUUL4CD+1Sa2U2SZYa2P9IoFC2HxEr+PYNmYfRE8wwY=";
-          allowedIPs = [ "0.0.0.0/0" ];
-          endpoint = "server.maariz.org:51820";
-          persistentKeepalive = 25;
-        }
-      ];
-    };
+        persistentKeepalive = if p.persistentKeepalive != null then p.persistentKeepalive else null;
+      }) iface.peers;
+    }) (lib.filterAttrs (_: v: v.enable) cfg.interfaces);
+
+    networking.firewall.allowedUDPPorts = [ 51820 ];
   };
-
-  # Ensure the Wireguard UDP port is open if you are hosting the server
-  networking.firewall.allowedUDPPorts = [ 51820 ];
 }

modules/virtualization/default.nix

@@ -3,6 +3,6 @@
   imports = [
     ./podman.nix
     ./qemu.nix
-    ./lima.nix
+    ./options.nix
   ];
 }

modules/virtualization/lima.nix

@@ -1,7 +1,15 @@
-{ pkgs, ... }:
-
 {
-  environment.systemPackages = with pkgs; [
-    lima
-  ];
+  config,
+  lib,
+  pkgs,
+}:
+let
+  cfg = config.workstation.virtualization.lima;
+in
+{
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      lima
+    ];
+  };
 }

modules/virtualization/options.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  ...
+}:
+{
+  options.workstation.virtualization = {
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "river";
+      description = "The user to run virtualization services as.";
+    };
+
+    # podman
+    podman = {
+      enable = lib.mkEnableOption "Podman support";
+
+      packages = {
+        enable = lib.mkEnableOption "relevant Podman packages";
+      };
+    };
+
+    # qemu
+    qemu = {
+      enable = lib.mkEnableOption "QEMU support";
+
+      containers = lib.mkEnableOption "container support for QEMU";
+
+      spiceUSBRedirection = lib.mkEnableOption "spice USB redirection support for QEMU";
+
+      virtManager = lib.mkEnableOption "virt-manager support for QEMU";
+
+      bootModules = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [
+          "kvm-intel"
+          "kvm-amd"
+        ];
+        description = "The kernel modules to load for QEMU support.";
+      };
+    };
+
+    lima = {
+      enable = lib.mkEnableOption "Lima lite VM";
+    };
+  };
+}

modules/virtualization/podman.nix

@@ -1,42 +1,55 @@
-{ pkgs, ... }:
-
 {
-  virtualisation = {
-    oci-containers.backend = "podman";
-    containers.registries.search = [ "docker.io" ];
-    podman = {
-      enable = true;
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.workstation.virtualization;
+in
+{
+  config = lib.mkMerge [
+    (lib.mkIf cfg.podman.enable {
+      virtualisation = {
+        oci-containers.backend = "podman";
+        podman = {
 
-      dockerCompat = true;
-      defaultNetwork.settings.dns_enabled = true;
-    };
-  };
+          enable = true;
 
-  # For rootless containers
-  security.unprivilegedUsernsClone = true;
+          dockerCompat = true;
+          defaultNetwork.settings.dns_enabled = true;
+        };
+      };
 
-  users.users.river = {
-    subUidRanges = [
-      {
-        startUid = 100000;
-        count = 65536;
-      }
-    ];
-    subGidRanges = [
-      {
-        startGid = 100000;
-        count = 65536;
-      }
-    ];
+      # For rootless containers
+      security.unprivilegedUsernsClone = true;
 
-    extraGroups = [
-      "podman"
-    ];
-  };
+      users.users.${cfg.user} = {
+        subUidRanges = [
+          {
+            startUid = 100000;
+            count = 65536;
+          }
+        ];
+        subGidRanges = [
+          {
+            startGid = 100000;
+            count = 65536;
+          }
+        ];
 
-  environment.systemPackages = with pkgs; [
-    podman
-    podman-compose
-    podman-desktop
+        extraGroups = [
+          "podman"
+        ];
+      };
+    })
+
+    (lib.mkIf cfg.podman.packages.enable {
+      environment.systemPackages = with pkgs; [
+        podman
+        podman-compose
+        podman-desktop
+      ];
+    })
   ];
 }

modules/virtualization/qemu.nix

@@ -1,30 +1,44 @@
-{ pkgs, ... }:
-
 {
-  virtualisation.spiceUSBRedirection.enable = true;
-
-  virtualisation = {
-    containers.enable = true;
-    libvirtd = {
-      enable = true;
-      qemu = {
-        package = pkgs.qemu_kvm;
-        swtpm.enable = true;
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.workstation.virtualization;
+in
+{
+  config = lib.mkMerge [
+    (lib.mkIf cfg.qemu.enable {
+      virtualisation = {
+        libvirtd = {
+          enable = true;
+          qemu = {
+            package = pkgs.qemu_kvm;
+            swtpm.enable = true;
+          };
+        };
       };
-    };
-  };
+      users.users.${cfg.user}.extraGroups = [
+        "libvirtd"
+        "kvm"
+      ];
+    })
 
-  networking.firewall.trustedInterfaces = [ "virbr0" ];
+    (lib.mkIf cfg.qemu.spiceUSBRedirection {
+      virtualisation.spiceUSBRedirection.enable = true;
+    })
 
-  programs.virt-manager.enable = true;
+    (lib.mkIf cfg.qemu.virtManager {
+      programs.virt-manager.enable = true;
+    })
 
-  users.users.river.extraGroups = [
-    "libvirtd"
-    "kvm"
-  ];
+    (lib.mkIf (cfg.qemu.enable && cfg.qemu.containers) {
+      virtualisation.containers.enable = true;
+    })
 
-  boot.kernelModules = [
-    "kvm-intel"
-    "kvm-amd"
+    (lib.mkIf cfg.qemu.enable {
+      boot.kernelModules = cfg.qemu.bootModules;
+    })
   ];
 }