initial

system/default.nix

@@ -0,0 +1,87 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+
+let
+  name = "system";
+  cfg = config.nixowos.${name};
+in
+{
+  imports = [
+    ./lix.nix
+    ./nix.nix
+  ];
+
+  options.nixowos.${name} = {
+    enable = lib.mkEnableOption name;
+
+    extraPackages = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      default = with pkgs; [
+        sshfs
+      ];
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    nixowos.${name} = {
+      lix.enable = true;
+      nix.enable = true;
+    };
+
+    environment.systemPackages = cfg.extraPackages;
+
+    boot.loader.grub = lib.mkDefault {
+      # modern installation
+      device = "nodev";
+      efiSupport = true;
+
+      # if your /boot partition is encrypted, this is needed
+      # grub takes a long time to unlock a partition though, so this is undesirable
+      # and you might also need to embed the key into initramfs to avoid needing to enter the password twice
+      # enableCryptodisk = true;
+
+      # keep the grub background black
+      splashImage = null;
+
+      # look for other efi entries and add them to the boot menu
+      # useOSProber = true;
+
+      # extra grub entry for memory testing
+      memtest86.enable = true;
+    };
+
+    # use tmpfs for /tmp to minimize disk wear
+    # consider disabling if you have very limited memory
+    boot.tmp = lib.mkDefault {
+      useTmpfs = true;
+      tmpfsSize = "70%";
+    };
+
+    # run fstrim monthly instead of weekly
+    # weekly is unecessary for preventing long-term performance degredation
+    # https://unix.stackexchange.com/questions/218076/ssd-how-often-should-i-do-fstrim
+    services.fstrim.interval = lib.mkDefault "monthly";
+
+    # extra memory if you can spare the CPU cycles
+    zramSwap = lib.mkDefault {
+      enable = true;
+      # this is the amount of uncompressed data that can be swapped out
+      # practical maximum is 150%
+      memoryPercent = 100;
+    };
+
+    security.sudo-rs.enable = lib.mkDefault true;
+
+    services.openssh = lib.mkDefault {
+      enable = true;
+
+      # only accept key authentication, for security
+      settings.PasswordAuthentication = false;
+    };
+
+  };
+}