feat: extract some config into modules

modules/nixos/desktop.nix

@@ -0,0 +1,51 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+{
+  options = {
+    desktop = {
+      enable = lib.mkEnableOption "base desktop environment";
+    };
+  };
+
+  config = lib.mkIf config.desktop.enable {
+    # Audio
+    services.pipewire = {
+      enable = true;
+      pulse.enable = true;
+    };
+
+    # Bluetooth
+    hardware.bluetooth.enable = true;
+    services.blueman.enable = true;
+
+    # Security
+    security.polkit.enable = true;
+
+    # D-Bus
+    services.dbus.enable = true;
+
+    # Player control
+    services.playerctld.enable = true;
+
+    # XDG Portals
+    xdg.portal = {
+      enable = true;
+      xdgOpenUsePortal = true;
+      extraPortals = [
+        pkgs.xdg-desktop-portal-wlr
+        pkgs.xdg-desktop-portal-gtk
+      ];
+    };
+
+    # Fonts
+    fonts.packages = with pkgs; [
+      font-awesome
+      nerd-fonts.jetbrains-mono
+      maple-mono.NF
+    ];
+  };
+}

modules/nixos/openssh.nix

@@ -0,0 +1,30 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+  options = {
+    openssh = {
+      enable = lib.mkEnableOption "hardened SSH server";
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 22;
+        description = "SSH server port";
+      };
+    };
+  };
+
+  config = lib.mkIf config.openssh.enable {
+    services.openssh = {
+      enable = true;
+      ports = [ config.openssh.port ];
+      settings = {
+        PasswordAuthentication = false;
+        AllowUsers = null;
+        PermitRootLogin = "no";
+        StreamLocalBindUnlink = "yes";
+      };
+    };
+  };
+}

modules/nixos/printing.nix

@@ -0,0 +1,21 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+  options = {
+    printing = {
+      enable = lib.mkEnableOption "CUPS printing with Avahi discovery";
+    };
+  };
+
+  config = lib.mkIf config.printing.enable {
+    services.printing.enable = true;
+    services.avahi = {
+      enable = true;
+      nssmdns4 = true;
+      openFirewall = true;
+    };
+  };
+}