system: move all to defaults

defaults/lix.nix

@@ -0,0 +1,33 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+
+let
+  name = "lix";
+  cfg = config.nixowos.system.${name};
+in
+{
+  options.nixowos.system.${name} = {
+    enable = lib.mkEnableOption name;
+  };
+
+  config = lib.mkIf cfg.enable {
+    # use lix, a fork of nix
+    # see: https://lix.systems/about
+    nix.package = pkgs.lixPackageSets.stable.lix;
+    # overlays so that all nix tools use lix
+    nixpkgs.overlays = [
+      (final: prev: {
+        inherit (prev.lixPackageSets.stable)
+          nixpkgs-review
+          nix-eval-jobs
+          nix-fast-build
+          colmena
+          ;
+      })
+    ];
+  };
+}

defaults/luks.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  config,
+  ...
+}:
+
+let
+  name = "luks";
+  cfg = config.nixowos.system.${name};
+in
+{
+  options.nixowos.system.${name} = {
+    enable = lib.mkEnableOption name;
+  };
+
+  options.boot.initrd.luks.devices = lib.mkOption {
+    type = lib.types.attrsOf (
+      lib.types.submodule {
+        config = lib.mkIf cfg.enable (
+          lib.mkDefault {
+            # Setting "true" here is a major performance improvement to LUKS at least on SSDs
+            # Without this, you're likely to face freezes when the (much slower) queue is full
+            #
+            # wiki source: https://wiki.archlinux.org/title/Dm-crypt/Specialties#Disable_workqueue_for_increased_solid_state_drive_(SSD)_performance
+            # origin blog: https://blog.cloudflare.com/speeding-up-linux-disk-encryption/
+            bypassWorkqueues = true;
+
+            # Setting "true" here can also improve SSD performance, plus maybe lifetime
+            # assuming regular fstrim usage (like with the default services.fstrim)
+            # but can cause problems for plausable deniability.
+            #
+            # This is set because I believe performance should take precedence over that by default.
+            #
+            # wiki source: https://wiki.archlinux.org/title/Dm-crypt/Specialties#Discard/TRIM_support_for_solid_state_drives_(SSD)
+            # illustration/discussion: https://asalor.blogspot.com/2011/08/trim-dm-crypt-problems.html
+            allowDiscards = true;
+          }
+        );
+      }
+    );
+  };
+}

defaults/nix.nix

@@ -0,0 +1,33 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+
+let
+  name = "nix";
+  cfg = config.nixowos.system.${name};
+in
+{
+  options.nixowos.system.${name} = {
+    enable = lib.mkEnableOption name;
+  };
+
+  config = lib.mkIf cfg.enable {
+    # enable useful nix tools, and the flakes system
+    nix.settings.experimental-features = "nix-command flakes";
+    # you (should) never need this
+    nix.channel.enable = false;
+
+    # reduces disk usage of the nix store
+    # It does this by performing `nix store optimize` incrementally for each new path
+    # source: https://nix.dev/manual/nix/2.26/command-ref/new-cli/nix3-store-optimise
+    nix.settings.auto-optimise-store = true;
+
+    environment.systemPackages = with pkgs; [
+      nixd
+      nixfmt
+    ];
+  };
+}

defaults/system.nix

@@ -0,0 +1,100 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+
+let
+  name = "system";
+  cfg = config.nixowos.${name};
+in
+{
+  imports = [
+    ./lix.nix
+    ./nix.nix
+    ./luks.nix
+  ];
+
+  options.nixowos.${name} = {
+    enable = lib.mkEnableOption name;
+
+    extraPackages = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      default = with pkgs; [
+        sshfs
+      ];
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    nixowos.${name} = lib.mkDefault {
+      lix.enable = true;
+      nix.enable = true;
+      luks.enable = true;
+    };
+
+    environment.systemPackages = cfg.extraPackages;
+
+    boot.loader.grub = lib.mkDefault {
+      # modern installation
+      device = "nodev";
+      efiSupport = true;
+
+      # if your /boot partition is encrypted, this is needed
+      # grub takes a long time to unlock a partition though, so this is undesirable
+      # and you might also need to embed the key into initramfs to avoid needing to enter the password twice
+      # enableCryptodisk = true;
+
+      # keep the grub background black
+      splashImage = null;
+
+      # look for other efi entries and add them to the boot menu
+      # useOSProber = true;
+
+      # extra grub entry for memory testing
+      # memtest86.enable = true;
+    };
+
+    # use tmpfs for /tmp to minimize disk wear
+    # consider disabling if you have very limited memory
+    boot.tmp = lib.mkDefault {
+      useTmpfs = true;
+      tmpfsHugeMemoryPages = "within_size";
+    };
+
+    fileSystems."/home/tmp" = lib.mkDefault {
+      fsType = "tmpfs";
+
+      # inherit options created by boot.tmp.useTmpfs if avaliable
+      options =
+        let
+          tmpMount = lib.findFirst (mount: mount.where == "/tmp") null config.systemd.mounts;
+        in
+        lib.mkIf (tmpMount != null) (lib.splitStringBy (p: c: c == ",") false tmpMount.mountConfig.Options);
+    };
+
+    # run fstrim monthly instead of weekly
+    # weekly is unecessary for preventing long-term performance degredation
+    # https://unix.stackexchange.com/questions/218076/ssd-how-often-should-i-do-fstrim
+    services.fstrim.interval = lib.mkDefault "monthly";
+
+    # extra memory if you can spare the CPU cycles
+    zramSwap = lib.mkDefault {
+      enable = true;
+      # this is the amount of uncompressed data that can be swapped out
+      # practical maximum is 150%
+      memoryPercent = 100;
+    };
+
+    security.sudo-rs.enable = lib.mkDefault true;
+
+    services.openssh = {
+      enable = lib.mkDefault true;
+
+      # only accept key authentication, for security
+      settings.PasswordAuthentication = false;
+    };
+
+  };
+}