refactor(modules): separate nixos/home-manager modules, use standard option conventions

3 files changed, 72 insertions, 259 deletions

diff --git a/hosts/adam/configuration.nix b/hosts/adam/configuration.nix
index 99e2726..491ab90 100644
--- a/hosts/adam/configuration.nix
+++ b/hosts/adam/configuration.nix
@@ -1,18 +1,17 @@
 {
   pkgs,
   username,
+  inputs,
   ...
 }:
 
 {
   imports = [
     ./hardware-configuration.nix
-    ../../modules/desktop
-    ../../modules/programs
-    ../../modules/system
-    ../../modules/services
   ];
 
+  home-manager.extraSpecialArgs = { inherit inputs; };
+
   boot = {
     kernelPackages = pkgs.linuxPackages_latest;
     kernelParams = [
@@ -70,26 +69,48 @@
   home-manager.users.${username} = {
     home.username = username;
     home.homeDirectory = "/home/${username}";
+    imports = [ ../../modules/users ];
 
     programs.home-manager.enable = true;
-
     home.packages = with pkgs; [
-      firefox
-      blender
-      godot
       imv
       mpv
+      firefox
 
       zoxide
-
-      noto-fonts-cjk-sans
-      noto-fonts-color-emoji
     ];
 
     programs.zsh.shellAliases = {
       open = "xdg-open";
     };
 
+    nx = {
+      #browsers.firefox.enable = true;
+      editors = {
+        neovim = {
+          enable = true;
+          langs = {
+            python = true;
+            go = true;
+            java = true;
+            latex = true;
+          };
+        };
+      };
+      git.enable = true;
+      cli = {
+        opencode.enable = true;
+      };
+      media = {
+        spicetify.enable = true;
+        nixcord.enable = true;
+      };
+      productivity = {
+        obsidian.enable = true;
+        latex.enable = true;
+      };
+    };
+
     home.stateVersion = "25.11";
   };
 
@@ -97,29 +118,6 @@
     desktop = {
       kde.enable = true;
     };
-    programs = {
-      kitty.enable = true;
-      git.enable = true;
-      gh.enable = true;
-      gpg.enable = true;
-      neovim.enable = true;
-      tmux.enable = true;
-      zsh.enable = true;
-      spicetify.enable = true;
-      obsidian.enable = true;
-      gemini-cli.enable = true;
-      opencode.enable = true;
-      nixcord.enable = true;
-    };
-    services = {
-      openssh.enable = true;
-      printer.enable = true;
-      pipewire.enable = true;
-      polkit.enable = true;
-      wooting.enable = true;
-      mullvad.enable = true;
-      nextcloud-client.enable = true;
-    };
   };
 
   system.stateVersion = "25.11";
diff --git a/hosts/lilith/configuration.nix b/hosts/lilith/configuration.nix
index a3c138f..f3962d8 100644
--- a/hosts/lilith/configuration.nix
+++ b/hosts/lilith/configuration.nix
@@ -2,14 +2,11 @@
   pkgs,
   host,
   username,
+  inputs,
   ...
 }:
 
 {
-  imports = [
-    ../../modules/programs
-  ];
-
   users.users.${username}.home = "/Users/${username}";
 
   networking.hostName = host;
@@ -19,6 +16,12 @@
     home.homeDirectory = "/Users/${username}";
     programs.home-manager.enable = true;
 
+    imports = [
+      ../../modules/users
+      inputs.nixcord.homeModules.nixcord
+      inputs.spicetify-nix.homeManagerModules.spicetify
+    ];
+
     home.packages = with pkgs; [
       htop
       ffmpeg
@@ -30,7 +33,7 @@
       rectangle
       slack
       podman
-			jetbrains.idea-community
+      jetbrains.idea-community
 
       nerd-fonts.symbols-only
     ];
@@ -38,6 +41,32 @@
     home.sessionVariables = {
       PATH = "/opt/homebrew/opt/openjdk@21/bin:$PATH";
     };
+
+    nx = {
+      editors = {
+        neovim = {
+          enable = true;
+          langs = {
+            python = true;
+            go = true;
+            java = true;
+            latex = true;
+          };
+        };
+      };
+      git.enable = true;
+      cli = {
+        opencode.enable = true;
+      };
+      media = {
+        spicetify.enable = true;
+        nixcord.enable = true;
+      };
+      productivity = {
+        obsidian.enable = true;
+        latex.enable = true;
+      };
+    };
   };
 
   system.primaryUser = username;
@@ -79,18 +108,6 @@
     onActivation.upgrade = true;
   };
 
-  nx = {
-    programs = {
-      neovim.enable = true;
-      zsh.enable = true;
-      anki.enable = true;
-      spicetify.enable = true;
-      zed-editor.enable = true;
-      obsidian.enable = true;
-			opencode.enable = true;
-    };
-  };
-
   nix.enable = false;
 
   system.stateVersion = 5;
diff --git a/hosts/sachiel/configuration.nix b/hosts/sachiel/configuration.nix
index 0537569..3944006 100644
--- a/hosts/sachiel/configuration.nix
+++ b/hosts/sachiel/configuration.nix
@@ -1,8 +1,6 @@
 {
   pkgs,
   host,
-  lib,
-  config,
   username,
   ...
 }:
@@ -66,212 +64,12 @@
     };
   };
 
-  services.fail2ban = {
-    enable = true;
-    bantime = "1h";
-    jails = {
-      sshd = {
-        enabled = true;
-        settings = {
-          port = 8693;
-          backend = "systemd";
-          maxretry = 4;
-          findtime = "10m";
-          bantime = "1h";
-        };
-      };
-      nextcloud = {
-        enabled = true;
-        settings = {
-          # START modification to work with syslog instead of logile
-          backend = "systemd";
-          journalmatch = "SYSLOG_IDENTIFIER=Nextcloud";
-          # END modification to work with syslog instead of logile
-          port = 443;
-          protocol = "tcp";
-          filter = "nextcloud";
-          maxretry = 3;
-          bantime = 86400;
-          findtime = 43200;
-        };
-      };
-    };
-  };
-
-  environment.etc = {
-    # Adapted failregex for syslogs
-    "fail2ban/filter.d/nextcloud.local".text = pkgs.lib.mkDefault (
-      pkgs.lib.mkAfter ''
-        [Definition]
-        _groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
-        failregex = ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
-                      ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
-        datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
-      ''
-    );
-  };
-
-  services.openssh = {
-    enable = true;
-    ports = [ 8693 ];
-    settings = {
-      PasswordAuthentication = false;
-      AllowUsers = [ username ];
-      X11Forwarding = false;
-      PermitRootLogin = "no";
-    };
-  };
-
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "leander@schererleander.de";
-  };
-
-  services.nginx = {
-    enable = true;
-    recommendedGzipSettings = true;
-    recommendedOptimisation = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-    appendHttpConfig = ''
-      map $scheme $hsts_header {
-          https   "max-age=31536000; includeSubdomains; preload";
-      }
-      add_header Strict-Transport-Security $hsts_header;
-      #add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self';" always;
-      add_header 'Referrer-Policy' 'same-origin';
-      add_header X-Frame-Options DENY;
-      add_header X-Content-Type-Options nosniff;
-    '';
-
-    #virtualHosts."bitwarden.schererleander.de" = {
-    #  forceSSL = true;
-    #  sslCertificate = "/etc/ssl/schererleander.de/fullchain.pem";
-    #  sslCertificateKey = "/etc/ssl/schererleander.de/privkey.key";
-    #  locations."/" = {
-    #    proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";
-    #  };
-    #};
-
-    virtualHosts."cloud.schererleander.de" = {
-      forceSSL = true;
-      sslCertificate = "/etc/ssl/schererleander.de/fullchain.pem";
-      sslCertificateKey = "/etc/ssl/schererleander.de/privkey.key";
-    };
-  };
-
-  services.site = {
-    enable = true;
-    domain = "schererleander.de";
-    sslCertificate = "/etc/ssl/schererleander.de/fullchain.pem";
-    sslCertificateKey = "/etc/ssl/schererleander.de/privkey.key";
-  };
-
-  # services.vaultwarden = {
-  #   enable = true;
-  #   environmentFile = "/var/lib/vaultwarden.env";
-  #   backupDir = "/var/backup/vaultwarden";
-  #   config = {
-  #     DOMAIN = "https://bitwarden.schererleander.de";
-  #     SIGNUPS_ALLOWED = true;
-  #     ROCKET_ADDRESS = "127.0.0.1";
-  #     ROCKET_PORT = 8222;
-  #     ROCKET_LOG = "critical";
-  #     KDF = "PBKDF2";
-  #     KDFIterations = 600000;
-  #   };
-  # };
-  #
-  # services.borgbackup.jobs.vaultwarden = {
-  #   paths = [ "/var/backup/vaultwarden" ];
-  #   repo = "t7e4d4f9@t7e4d4f9.repo.borgbase.com:repo";
-  #   encryption.mode = "none";
-  #   environment.BORG_RSH = "ssh -i /home/${username}/.ssh/borgbase-vaultwarden -o StrictHostKeyChecking=accept-new";
-  #   compression = "auto,lzma";
-  #   startAt = "daily";
-  # };
-
-  services.nextcloud = {
-    enable = true;
-    package = pkgs.nextcloud32;
-    hostName = "cloud.schererleander.de";
-    https = true;
-    database.createLocally = true;
-    maxUploadSize = "16G";
-    config = {
-      dbtype = "mysql";
-      adminuser = "schererleander";
-      adminpassFile = "/etc/nextcloud-admin-pass";
-    };
-    settings = {
-      maintenance_window_start = 2; # 02:00
-      default_phone_region = "de";
-      overwriteProtocol = "https";
-      trusted_domains = [ "cloud.schererleander.de" ];
-      logtimezone = "Europe/Berlin";
-      log_type = "file";
-    };
-    phpOptions."opcache.interned_strings_buffer" = "64";
-  };
-
-  services.borgbackup.jobs.nextcloud = {
-    paths = [
-      "/var/lib/nextcloud"
-      "/var/lib/backup/nextcloud/db"
-    ];
-    repo = "h8xn8qvo@h8xn8qvo.repo.borgbase.com:repo";
-    encryption.mode = "none";
-    environment = {
-      BORG_RSH = "ssh -i /home/${username}/.ssh/borgbase-nextcloud -o StrictHostKeyChecking=accept-new";
-      TMPDIR = "/var/tmp";
-    };
-    compression = "auto,lzma";
-    startAt = "daily";
-    readWritePaths = [
-      "/var/lib/backup"
-      "/var/lib/nextcloud"
-    ];
-    preHook = ''
-      set -euo pipefail
-      INSTALL="${pkgs.coreutils}/bin/install"
-      FIND="${pkgs.findutils}/bin/find"
-      MYSQLDUMP="${pkgs.mariadb.client}/bin/mysql-dump"
-      GZIP="${pkgs.gzip}/bin/gzip"
-      OCC="${lib.getExe config.services.nextcloud.occ}"
-
-      # This command requires write access to /var/lib/backup.
-      $INSTALL -d -m 0750 -o root -g root /var/lib/backup/nextcloud/db
-
-      trap "$OCC maintenance:mode --off >/dev/null 2>&1 || true" EXIT
-
-      $OCC maintenance:mode --on
-
-      # Make a consistent database dump without locking the site.
-      $MYSQLDUMP --single-transaction --quick --lock-tables=false --databases nextcloud \
-        | $GZIP -c > /var/lib/backup/nextcloud/db/nextcloud-$(date +%F-%H%M%S).sql.gz
-
-      # Delete local dump files older than 14 days.
-      $FIND /var/lib/backup/nextcloud/db -type f -name "*.sql.gz" -mtime +14 -delete || true
-    '';
-    postHook = ''
-      set -euo pipefail
-      ${lib.getExe config.services.nextcloud.occ} maintenance:mode --off || true
-    '';
-  };
-
-  security.auditd.enable = true;
-  security.audit = {
-    enable = true;
-    rules = [ "-a exit,always -F arch=b64 -S execve" ];
-  };
-
-  networking.firewall = {
-    allowPing = false;
-    allowedTCPPorts = [
-      80
-      443
-      8693
-    ];
+  nx.server = {
+    openssh.enable = true;
+    fail2ban.enable = true;
+    nginx.enable = true;
+    nextcloud.enable = true;
+    site.enable = true;
   };
 
   nixpkgs.config.allowUnfree = true;