refactor: update hosts and feature lists for new architecture

hosts/cube/configuration.nix

@@ -2,9 +2,6 @@
 {
   imports = [ inputs.disko.nixosModules.disko ];
 
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
   disko.devices.disk.main = {
     type = "disk";
     device = "/dev/nvme0n1";
@@ -32,10 +29,5 @@
     };
   };
 
-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
-  };
-
   system.stateVersion = "25.11";
 }

hosts/ephvm/configuration.nix

@@ -5,6 +5,7 @@
   ...
 }:
 {
+  features.nix-settings.towerCache.enable = false;
   # no hardware firmware needed in a VM
   hardware.enableRedistributableFirmware = lib.mkForce false;
   hardware.wirelessRegulatoryDatabase = lib.mkForce false;
@@ -28,18 +29,12 @@
       );
     };
 
-  vm-guest.headless = true;
-
-  vm-9p-automount.user = "matej";
-
-  localisation = {
-    timeZone = "UTC";
-    defaultLocale = "en_US.UTF-8";
-  };
-
-  home-manager.users.matej = {
-    neovim.dotfiles = inputs.nvim;
+  features.vm-guest.headless = true;
+  features.vm-guest.automount = {
+    enable = true;
+    user = "matej";
   };
+  features.neovim.dotfiles = inputs.nvim;
 
   # ensure .config exists with correct ownership before automount
   systemd.tmpfiles.rules = [ "d /home/matej/.config 0755 matej users -" ];

hosts/floo/configuration.nix

@@ -2,6 +2,8 @@
 {
   imports = [ inputs.disko.nixosModules.disko ];
 
+  features.filedrop.sopsFile = ../../secrets/floo.yaml;
+
   boot.loader.grub.enable = true;
 
   disko.devices.disk.main = {
@@ -26,10 +28,5 @@
     };
   };
 
-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
-  };
-
   system.stateVersion = "25.11";
 }

hosts/fortress/configuration.nix

@@ -10,13 +10,11 @@
     inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
   ];
 
-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
+  features.desktop = {
+    apps.enable = false;
+    internalCA.enable = false;
   };
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
+  features.gnupg.yubikey.enable = true;
 
   disko.devices.disk.main = {
     type = "disk";

hosts/fw16/configuration.nix

@@ -1,8 +1,7 @@
 {
   lib,
-  pkgs,
-  inputs,
   options,
+  inputs,
   ...
 }:
 
@@ -11,37 +10,22 @@
     inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
   ];
 
-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
+  features.desktop.bluetooth.enable = true;
+  features.gnupg.yubikey.enable = true;
+  features.udev = {
+    ledger.enable = true;
+    keyboard-zsa.enable = true;
   };
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
+  features.power.resumeDevice = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540";
 
   boot.kernelParams = [ "pcie_aspm.policy=powersupersave" ];
 
-  boot.resumeDevice = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540";
-
-  services.logind.settings.Login = {
-    HandleLidSwitch = "suspend-then-hibernate";
-    HandlePowerKey = "suspend-then-hibernate";
-    IdleAction = "suspend-then-hibernate";
-    IdleActionSec = "15min";
-  };
-
-  systemd.sleep.settings.Sleep = {
-    HibernateDelaySec = "30min";
-  };
-
   programs.nix-ld.libraries = options.programs.nix-ld.libraries.default;
 
   services.gnome.gnome-keyring.enable = true;
   services.teamviewer.enable = true;
 
   services.hardware.bolt.enable = true;
-  hardware.keyboard.zsa.enable = true;
-  hardware.ledger.enable = true;
   hardware.bluetooth.powerOnBoot = true;
   hardware.inputmodule.enable = true;
 

hosts/iso/configuration.nix

@@ -1,15 +1,13 @@
-{ lib, ... }:
+{ lib, userKeys, ... }:
 {
+  features.nix-settings.towerCache.enable = false;
   image.modules.iso-installer = {
     isoImage.squashfsCompression = "zstd -Xcompression-level 6";
   };
 
   # live iso: passwordless login and sudo
   users.users.matej.initialHashedPassword = "";
-  users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
-  ];
+  users.users.root.openssh.authorizedKeys.keys = userKeys.sshAuthorizedKeys;
   services.openssh.settings.PermitRootLogin = lib.mkForce "prohibit-password";
   security.sudo.wheelNeedsPassword = false;
 

hosts/tower/configuration.nix

@@ -1,38 +1,28 @@
 {
   config,
-  lib,
-  inputs,
   userKeys,
   ...
 }:
 
 {
-  imports = [
-    inputs.lanzaboote.nixosModules.lanzaboote
-  ];
+  features.nix-settings.towerCache.enable = false;
+  features.bootloader.mode = "lanzaboote";
+  features.desktop.bluetooth.enable = true;
+  features.gnupg.yubikey.enable = true;
+  features.udev = {
+    ledger.enable = true;
+    keyboard-zsa.enable = true;
+  };
+  features.initrd-ssh = {
+    networkModule = "r8169";
+    authorizedKeys = userKeys.sshAuthorizedKeys;
+  };
 
   # nix store signing
   sops.secrets.nix-signing-key.sopsFile = ../../secrets/tower.yaml;
   nix.settings.secret-key-files = [ config.sops.secrets.nix-signing-key.path ];
 
-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
-  };
-
-  initrd-ssh = {
-    networkModule = "r8169";
-    authorizedKeys = userKeys.sshAuthorizedKeys;
-  };
-
-  # lanzaboote secure boot
   boot.kernelParams = [ "btusb.reset=1" ];
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.loader.systemd-boot.enable = lib.mkForce false;
-  boot.lanzaboote = {
-    enable = true;
-    pkiBundle = "/var/lib/sbctl";
-  };
 
   services.udisks2.enable = true;