Start migrating config to NixOS modules

modules/backup-job.nix

@@ -1,10 +1,12 @@
 { config, lib, pkgs, ... }:
 with lib;
 let
-  cfg = config.services.custom-backup-job;
+  cfg = config.custom.services.backup-job;
 in
 {
-  options.services.custom-backup-job = {
+  options.custom.services.backup-job = {
+    enable = mkEnableOption "backup-job";
+
     additionalPaths = mkOption {
       type = with types; listOf path;
       default = [ ];
@@ -35,7 +37,7 @@ in
     };
   };
 
-  config = {
+  config = mkIf cfg.enable {
 
     sops.secrets = {
       borgPassphrase = {
@@ -43,6 +45,7 @@ in
         key = "borg/passphrase";
       };
     };
+
     services.borgbackup.jobs.data = {
       paths = [ "/nix/var/data" cfg.sshKey ] ++ cfg.additionalPaths;
       doInit = false;

modules/binary-cache.nix

@@ -1,32 +1,40 @@
-{ config, ... }:
+{ config, lib, ... }:
+with lib;
+let
+  cfg = config.custom.services.binary-cache;
+in
 {
+  options.custom.services.binary-cache = {
 
-  sops.secrets = {
-    nixCacheKey = {
-      key = "nix/cache_secret_key";
+    enable = mkEnableOption "binary-cache";
+
+    secretKeyFile = mkOption {
+      type = types.path;
     };
   };
 
 
-  services.nix-serve = {
-    enable = true;
-    port = 1500;
-    secretKeyFile = config.sops.secrets.nixCacheKey.path;
-  };
+  config = mkIf cfg.enable {
+    services.nix-serve = {
+      enable = true;
+      port = 1500;
+      secretKeyFile = config.sops.secrets.nixCacheKey.path;
+    };
 
-  services.nginx = {
-    virtualHosts = {
-      "cache.${config.networking.domain}" = {
+    services.nginx = {
+      virtualHosts = {
+        "cache.${config.networking.domain}" = {
 
-        enableACME = true;
-        forceSSL = true;
+          enableACME = true;
+          forceSSL = true;
 
-        locations."/".extraConfig = ''
-          proxy_pass http://localhost:${toString config.services.nix-serve.port};
-          proxy_set_header Host $host;
-          proxy_set_header X-Real-IP $remote_addr;
-          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        '';
+          locations."/".extraConfig = ''
+            proxy_pass http://localhost:${toString config.services.nix-serve.port};
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          '';
+        };
       };
     };
   };

modules/default.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    ./backup-job.nix
+    ./monit.nix
+    ./gitlab-runner.nix
+    ./openssh.nix
+    ./murmur.nix
+  ];
+}

modules/dokuwiki.nix

@@ -1,5 +1,8 @@
 { config, lib, pkgs, ... }:
+with lib;
 let
+  cfg = config.custom.services.dokuwiki;
+
   configureWiki = name: {
 
     sops.secrets."usersFile-${name}" = {
@@ -25,7 +28,20 @@ let
     };
   };
 in
-lib.mkMerge [
-  (configureWiki "anderia")
-  (configureWiki "arkadia")
-]
+{
+  options.custom.services.dokuwiki = {
+
+    enable = mkEnableOption "dokuwiki";
+
+    secretKeyFile = mkOption {
+      type = types.path;
+    };
+  };
+
+
+  config = mkIf cfg.enable
+    (lib.mkMerge [
+      (configureWiki "anderia")
+      (configureWiki "arkadia")
+    ]);
+}

modules/gitlab-runner.nix

@@ -1,82 +1,92 @@
 { config, lib, pkgs, ... }:
+with lib;
+let
+  cfg = config.custom.services.gitlab-runner;
+in
 {
-  sops.secrets = {
-    runnerRegistrationConfig = {
-      owner = config.users.users.gitlab-runner.name;
-      key = "gitlab/runner_registration_config";
-    };
+  options.custom.services.gitlab-runner = {
+    enable = mkEnableOption "gitlab-runner";
   };
 
-  users.groups.gitlab-runner = { };
-  users.users.gitlab-runner = {
-    isSystemUser = true;
-    group = config.users.groups.gitlab-runner.name;
-  };
-
-  containers.gitlab-runner = {
-    autoStart = true;
-
-    privateNetwork = true;
-    hostAddress = "192.168.100.1";
-    localAddress = "192.168.100.2";
-
-    bindMounts = {
-      "${config.sops.secrets.runnerRegistrationConfig.path}" = {
-        hostPath = config.sops.secrets.runnerRegistrationConfig.path;
+  config = mkIf cfg.enable {
+    sops.secrets = {
+      runnerRegistrationConfig = {
+        owner = config.users.users.gitlab-runner.name;
+        key = "gitlab/runner_registration_config";
       };
     };
 
-    config =
-      let
-        hostConfig = config;
-      in
-      args@{ config, ... }: {
+    users.groups.gitlab-runner = { };
+    users.users.gitlab-runner = {
+      isSystemUser = true;
+      group = config.users.groups.gitlab-runner.name;
+    };
 
-        nix = {
-          package = pkgs.nixUnstable;
-          extraOptions = ''
-            experimental-features = nix-command flakes
+    containers.gitlab-runner = {
+      autoStart = true;
+
+      privateNetwork = true;
+      hostAddress = "192.168.100.1";
+      localAddress = "192.168.100.2";
+
+      bindMounts = {
+        "${config.sops.secrets.runnerRegistrationConfig.path}" = {
+          hostPath = config.sops.secrets.runnerRegistrationConfig.path;
+        };
+      };
+
+      config =
+        let
+          hostConfig = config;
+        in
+        args@{ config, ... }: {
+
+          nix = {
+            package = pkgs.nixUnstable;
+            extraOptions = ''
+              experimental-features = nix-command flakes
+            '';
+          };
+
+          environment.systemPackages = with pkgs; [
+            git
+            htop
+            nload
+          ];
+
+          users.groups.gitlab-runner = { };
+          users.users.gitlab-runner = {
+            isSystemUser = true;
+            group = config.users.groups.gitlab-runner.name;
+          };
+
+          programs.ssh.extraConfig = ''
+            StrictHostKeyChecking=no
+            UserKnownHostsFile=/dev/null
           '';
-        };
 
-        environment.systemPackages = with pkgs; [
-          git
-          htop
-          nload
-        ];
-
-        users.groups.gitlab-runner = { };
-        users.users.gitlab-runner = {
-          isSystemUser = true;
-          group = config.users.groups.gitlab-runner.name;
-        };
-
-        programs.ssh.extraConfig = ''
-          StrictHostKeyChecking=no
-          UserKnownHostsFile=/dev/null
-        '';
-
-        services = {
-          openssh.enable = true;
-          gitlab-runner = {
-            enable = true;
-            services = {
-              shell = {
-                registrationConfigFile = hostConfig.sops.secrets.runnerRegistrationConfig.path;
-                executor = "shell";
-                tagList = [ "nix" ];
+          services = {
+            openssh.enable = true;
+            gitlab-runner = {
+              enable = true;
+              services = {
+                shell = {
+                  registrationConfigFile = hostConfig.sops.secrets.runnerRegistrationConfig.path;
+                  executor = "shell";
+                  tagList = [ "nix" ];
+                };
               };
             };
           };
-        };
 
-        systemd.services.gitlab-runner.serviceConfig = {
-          DynamicUser = lib.mkForce false;
-          User = config.users.users.gitlab-runner.name;
-          Group = config.users.groups.gitlab-runner.name;
-        };
+          systemd.services.gitlab-runner.serviceConfig = {
+            DynamicUser = lib.mkForce false;
+            User = config.users.users.gitlab-runner.name;
+            Group = config.users.groups.gitlab-runner.name;
+          };
 
-        system.stateVersion = "22.05";
-      };
+          system.stateVersion = "22.05";
+        };
+    };
   };
 }

modules/monit.nix

@@ -1,10 +1,12 @@
 { config, lib, pkgs, ... }:
 with lib;
 let
-  cfg = config.services.custom-monit;
+  cfg = config.custom.services.monit;
 in
 {
-  options.services.custom-monit = {
+  options.custom.services.monit = {
+    enable = mkEnableOption "monit";
+
     additionalConfig = mkOption {
       type = types.lines;
       default = "";

modules/murmur.nix

@@ -1,16 +1,27 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:
+with lib;
+let
+  cfg = config.custom.services.murmur;
+in
 {
-  sops.secrets.murmurEnvFile = {
-    owner = config.systemd.services.murmur.serviceConfig.User;
-    key = "murmur.env";
-    restartUnits = [ "murmur.service" ];
+  options.custom.services.murmur = {
+    enable = mkEnableOption "murmur";
   };
 
-  services.murmur = {
-    enable = true;
-    bandwidth = 128000;
-    password = "$MURMURD_PASSWORD";
-    environmentFile = config.sops.secrets.murmurEnvFile.path;
-    imgMsgLength = 13107200;
+
+  config = mkIf cfg.enable {
+    sops.secrets.murmurEnvFile = {
+      owner = config.systemd.services.murmur.serviceConfig.User;
+      key = "murmur.env";
+      restartUnits = [ "murmur.service" ];
+    };
+
+    services.murmur = {
+      enable = true;
+      bandwidth = 128000;
+      password = "$MURMURD_PASSWORD";
+      environmentFile = config.sops.secrets.murmurEnvFile.path;
+      imgMsgLength = 13107200;
+    };
   };
 }

modules/openssh.nix

@@ -1,9 +1,20 @@
-{ pkgs, lib, config, ... }:
+{ config, lib, ... }:
+with lib;
+let
+  cfg = config.custom.services.openssh;
+in
 {
-  services.openssh.enable = true;
-  services.openssh.permitRootLogin = "prohibit-password";
-  users.users.root.openssh.authorizedKeys.keyFiles = [
-    ../ssh_keys/phfroidmont-desktop.pub
-    ../ssh_keys/froidmpa-laptop.pub
-  ];
+  options.custom.services.openssh = {
+    enable = mkEnableOption "openssh";
+  };
+
+
+  config = mkIf cfg.enable {
+    services.openssh.enable = true;
+    services.openssh.permitRootLogin = "prohibit-password";
+    users.users.root.openssh.authorizedKeys.keyFiles = [
+      ../ssh_keys/phfroidmont-desktop.pub
+      ../ssh_keys/froidmpa-laptop.pub
+    ];
+  };
 }