chore: bump lockfile

features/bootloader.nix

@@ -0,0 +1,40 @@
+{
+  nixos =
+    { config, lib, inputs, ... }:
+    let
+      cfg = config.features.bootloader;
+    in
+    {
+      imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
+
+      options.features.bootloader = {
+        enable = lib.mkEnableOption "bootloader";
+
+        mode = lib.mkOption {
+          type = lib.types.enum [
+            "systemd-boot"
+            "lanzaboote"
+          ];
+          default = "systemd-boot";
+        };
+      };
+
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        {
+          boot.loader.efi.canTouchEfiVariables = true;
+        }
+
+        (lib.mkIf (cfg.mode == "systemd-boot") {
+          boot.loader.systemd-boot.enable = true;
+        })
+
+        (lib.mkIf (cfg.mode == "lanzaboote") {
+          boot.loader.systemd-boot.enable = lib.mkForce false;
+          boot.lanzaboote = {
+            enable = true;
+            pkiBundle = "/var/lib/sbctl";
+          };
+        })
+      ]);
+    };
+}

features/calibre.nix

@@ -1,22 +0,0 @@
-{
-  nixos =
-    { pkgs, ... }:
-    {
-      environment.systemPackages = [ pkgs.calibre ];
-
-      # udev rules for kindle and mtp device access
-      # NOTE:(@janezicmatej) uses services.udev.packages instead of extraRules
-      # because extraRules writes to 99-local.rules which is too late for uaccess
-      # see https://github.com/NixOS/nixpkgs/issues/308681
-      services.udev.packages = [
-        pkgs.libmtp
-        (pkgs.writeTextFile {
-          name = "kindle-udev-rules";
-          text = ''
-            ACTION!="remove", SUBSYSTEM=="usb", ATTRS{idVendor}=="1949", TAG+="uaccess"
-          '';
-          destination = "/etc/udev/rules.d/70-kindle.rules";
-        })
-      ];
-    };
-}

features/claude.nix

@@ -1,10 +1,21 @@
 {
+  nixos =
+    { lib, ... }:
+    {
+      options.features.claude.enable = lib.mkEnableOption "claude";
+    };
+
   home =
-    { pkgs, ... }:
+    { pkgs, lib, osConfig, ... }:
+    let
+      cfg = osConfig.features.claude;
+    in
     {
+      config = lib.mkIf cfg.enable {
         home.packages = [
           pkgs.claude-code
           pkgs.mcp-nixos
         ];
       };
+    };
 }

features/desktop-minimal.nix

@@ -1,45 +0,0 @@
-{
-  nixos =
-    { pkgs, inputs, ... }:
-    {
-      imports = [ inputs.stylix.nixosModules.stylix ];
-
-      # audio
-      services.pipewire = {
-        enable = true;
-        pulse.enable = true;
-      };
-
-      security.polkit.enable = true;
-      services.dbus.enable = true;
-      services.playerctld.enable = true;
-
-      xdg.portal = {
-        enable = true;
-        xdgOpenUsePortal = true;
-        extraPortals = [
-          pkgs.xdg-desktop-portal-wlr
-          pkgs.xdg-desktop-portal-gtk
-        ];
-      };
-
-      fonts.packages = with pkgs; [
-        font-awesome
-        nerd-fonts.jetbrains-mono
-      ];
-
-      # theming
-      stylix = {
-        enable = true;
-        polarity = "dark";
-        image = "${inputs.assets}/wallpaper.png";
-        base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
-      };
-    };
-
-  home =
-    { inputs, ... }:
-    {
-      home.file.".assets".source = inputs.assets;
-    };
-}

features/desktop.nix

@@ -1,19 +1,57 @@
 {
   nixos =
-    { pkgs, inputs, ... }:
+    { config, lib, pkgs, inputs, ... }:
+    let
+      cfg = config.features.desktop;
+    in
     {
-      imports = [ inputs.stylix.nixosModules.stylix ];
+      options.features.desktop = {
+        enable = lib.mkEnableOption "desktop environment";
 
-      # audio
+        audio.enable = lib.mkOption {
-      services.pipewire = {
+          type = lib.types.bool;
-        enable = true;
+          default = true;
-        pulse.enable = true;
         };
 
-      # bluetooth
+        bluetooth.enable = lib.mkOption {
-      hardware.bluetooth.enable = true;
+          type = lib.types.bool;
-      services.blueman.enable = true;
+          default = false;
+        };
 
+        apps.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+
+        theme = {
+          wallpaper = lib.mkOption {
+            type = lib.types.path;
+            default = "${inputs.assets}/wallpaper.png";
+          };
+
+          scheme = lib.mkOption {
+            type = lib.types.str;
+            default = "gruvbox-material-dark-medium";
+          };
+
+          polarity = lib.mkOption {
+            type = lib.types.enum [
+              "dark"
+              "light"
+            ];
+            default = "dark";
+          };
+        };
+
+        internalCA.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        # base desktop
+        {
           security.polkit.enable = true;
           services.dbus.enable = true;
           services.playerctld.enable = true;
@@ -21,9 +59,9 @@
           xdg.portal = {
             enable = true;
             xdgOpenUsePortal = true;
-        extraPortals = [
+            extraPortals = with pkgs; [
-          pkgs.xdg-desktop-portal-wlr
+              xdg-desktop-portal-wlr
-          pkgs.xdg-desktop-portal-gtk
+              xdg-desktop-portal-gtk
             ];
           };
 
@@ -32,24 +70,41 @@
             nerd-fonts.jetbrains-mono
           ];
 
-      # theming
           stylix = {
             enable = true;
-        polarity = "dark";
+            polarity = cfg.theme.polarity;
-        image = "${inputs.assets}/wallpaper.png";
+            image = cfg.theme.wallpaper;
-        base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
+            base16Scheme = "${pkgs.base16-schemes}/share/themes/${cfg.theme.scheme}.yaml";
           };
+        }
 
+        # audio
+        (lib.mkIf cfg.audio.enable {
+          services.pipewire = {
+            enable = true;
+            pulse.enable = true;
+          };
+          environment.systemPackages = with pkgs; [
+            pavucontrol
+            easyeffects
+          ];
+        })
+
+        # bluetooth
+        (lib.mkIf cfg.bluetooth.enable {
+          hardware.bluetooth.enable = true;
+          services.blueman.enable = true;
+        })
+
+        # apps
+        (lib.mkIf cfg.apps.enable {
           programs.thunderbird.enable = true;
-      programs._1password.enable = true;
-      programs._1password-gui.enable = true;
 
           environment.systemPackages = with pkgs; [
-        easyeffects
             ghostty
             google-chrome
             zathura
-        pavucontrol
+            calibre
             bolt-launcher
             libnotify
             bibata-cursors
@@ -67,19 +122,31 @@
             ledger-live-desktop
           ];
 
-      # internal CA
-      security.pki.certificateFiles = [
-        inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system}.ca-matheo-si
-      ];
-
           xdg.mime.defaultApplications = {
             "application/pdf" = "org.pwmt.zathura.desktop";
           };
+
+          # kindle udev rules for calibre
+          features.udev.kindle.enable = lib.mkDefault true;
+        })
+
+        # internal CA
+        (lib.mkIf cfg.internalCA.enable {
+          security.pki.certificateFiles = [
+            inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system}.ca-matheo-si
+          ];
+        })
+      ]);
     };
 
   home =
-    { inputs, ... }:
+    { lib, inputs, osConfig, ... }:
+    let
+      cfg = osConfig.features.desktop;
+    in
     {
+      config = lib.mkIf cfg.enable {
         home.file.".assets".source = inputs.assets;
       };
+    };
 }

features/dev.nix

@@ -1,15 +1,19 @@
 {
+  nixos =
+    { lib, ... }:
+    {
+      options.features.dev.enable = lib.mkEnableOption "development tools";
+    };
+
   home =
-    { pkgs, inputs, ... }:
+    { pkgs, lib, inputs, osConfig, ... }:
     let
+      cfg = osConfig.features.dev;
       packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
     in
     {
+      config = lib.mkIf cfg.enable {
         home.packages = [
-        pkgs.git
-        packages.git-linearize
-        packages.ggman
-
           pkgs.python3
           pkgs.osc
 
@@ -20,6 +24,6 @@
           pkgs.just
           pkgs.presenterm
         ];
-
+      };
     };
 }

features/direnv/default.nix

@@ -1,7 +1,13 @@
 {
   nixos =
-    { inputs, ... }:
+    { config, lib, inputs, ... }:
+    let
+      cfg = config.features.direnv;
+    in
     {
+      options.features.direnv.enable = lib.mkEnableOption "direnv";
+
+      config = lib.mkIf cfg.enable {
         nix.registry.dev = {
           from = {
             type = "indirect";
@@ -13,8 +19,15 @@
           };
         };
       };
+    };
 
-  home = _: {
+  home =
+    { lib, osConfig, ... }:
+    let
+      cfg = osConfig.features.direnv;
+    in
+    {
+      config = lib.mkIf cfg.enable {
         programs.direnv = {
           enable = true;
           nix-direnv.enable = true;
@@ -23,4 +36,5 @@
 
         xdg.configFile."direnv/lib/use_dev.sh".source = ./use_dev.sh;
       };
+    };
 }

features/docker.nix

@@ -1,7 +1,13 @@
 {
   nixos =
-    { user, ... }:
+    { config, lib, user, ... }:
+    let
+      cfg = config.features.docker;
+    in
     {
+      options.features.docker.enable = lib.mkEnableOption "docker";
+
+      config = lib.mkIf cfg.enable {
         virtualisation.docker = {
           enable = true;
           logDriver = "json-file";
@@ -9,4 +15,5 @@
 
         users.users.${user}.extraGroups = [ "docker" ];
       };
+    };
 }

features/filedrop.nix

@@ -1,9 +1,22 @@
 {
   nixos =
-    { config, userKeys, ... }:
+    { config, lib, userKeys, ... }:
+    let
+      cfg = config.features.filedrop;
+    in
     {
+      options.features.filedrop = {
+        enable = lib.mkEnableOption "filedrop sftp service";
+
+        sopsFile = lib.mkOption {
+          type = lib.types.path;
+
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
         sops.secrets.filedrop-authorized-keys = {
-        sopsFile = ../secrets/floo.yaml;
+          inherit (cfg) sopsFile;
           mode = "0444";
         };
 
@@ -39,4 +52,5 @@
             X11Forwarding no
         '';
       };
+    };
 }

features/gaming.nix

@@ -1,7 +1,13 @@
 {
   nixos =
-    { pkgs, ... }:
+    { config, lib, pkgs, ... }:
+    let
+      cfg = config.features.gaming;
+    in
     {
+      options.features.gaming.enable = lib.mkEnableOption "gaming";
+
+      config = lib.mkIf cfg.enable {
         programs.steam = {
           enable = true;
           remotePlay.openFirewall = true;
@@ -11,4 +17,5 @@
 
         environment.systemPackages = [ pkgs.prismlauncher ];
       };
+    };
 }

features/git.nix

@@ -0,0 +1,23 @@
+{
+  nixos =
+    { lib, ... }:
+    {
+      options.features.git.enable = lib.mkEnableOption "git";
+    };
+
+  home =
+    { pkgs, lib, inputs, osConfig, ... }:
+    let
+      cfg = osConfig.features.git;
+      packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
+    in
+    {
+      config = lib.mkIf cfg.enable {
+        home.packages = [
+          pkgs.git
+          packages.git-linearize
+          packages.ggman
+        ];
+      };
+    };
+}

features/gnupg.nix

@@ -1,9 +1,36 @@
 {
-  nixos = _: {
+  nixos =
+    { config, lib, pkgs, ... }:
+    let
+      cfg = config.features.gnupg;
+    in
+    {
+      options.features.gnupg = {
+        enable = lib.mkEnableOption "gnupg";
+
+        yubikey.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        {
           programs.gnupg.agent = {
             enable = true;
             enableSSHSupport = true;
             enableExtraSocket = true;
           };
+        }
+
+        (lib.mkIf cfg.yubikey.enable {
+          environment.systemPackages = with pkgs; [
+            yubikey-personalization
+            yubikey-manager
+          ];
+
+          services.pcscd.enable = true;
+        })
+      ]);
     };
 }

features/greeter.nix

@@ -1,28 +0,0 @@
-{
-  nixos =
-    { lib, inputs, ... }:
-    {
-      programs.regreet = {
-        enable = true;
-        # single output to avoid stretching across monitors
-        cageArgs = [
-          "-s"
-          "-m"
-          "last"
-        ];
-        font = {
-          name = lib.mkForce "JetBrainsMono Nerd Font";
-          size = lib.mkForce 14;
-        };
-        settings = {
-          background = {
-            path = lib.mkForce "${inputs.assets}/wallpaper.png";
-            fit = lib.mkForce "Cover";
-          };
-          GTK = {
-            application_prefer_dark_theme = lib.mkForce true;
-          };
-        };
-      };
-    };
-}

features/harmonia/default.nix

@@ -1,12 +1,14 @@
 {
   nixos =
     {
-      pkgs,
       config,
+      lib,
+      pkgs,
       inputs,
       ...
     }:
     let
+      cfg = config.features.harmonia;
       hosts = [
         "fw16"
         "tower"
@@ -17,6 +19,9 @@
       flakeRef = inputs.self.outPath;
     in
     {
+      options.features.harmonia.enable = lib.mkEnableOption "harmonia";
+
+      config = lib.mkIf cfg.enable {
         services.harmonia.cache = {
           enable = true;
           signKeyPaths = [ config.sops.secrets.nix-signing-key.path ];
@@ -48,4 +53,5 @@
           };
         };
       };
+    };
 }

features/initrd-ssh.nix

@@ -2,6 +2,7 @@
   nixos =
     { lib, config, ... }:
     let
+      cfg = config.features.initrd-ssh;
       keyDir = "/etc/secrets/initrd";
 
       mkIpString =
@@ -15,8 +16,9 @@
         "${address}::${gateway}:${netmask}::${interface}:none";
     in
     {
-      options = {
+      options.features.initrd-ssh = {
-        initrd-ssh = {
+        enable = lib.mkEnableOption "initrd ssh";
+
         ip = {
           enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";
 
@@ -47,16 +49,17 @@
           type = lib.types.str;
         };
       };
-      };
 
-      config = {
+      config = lib.mkIf cfg.enable {
-        boot.initrd.kernelModules = [ config.initrd-ssh.networkModule ];
+        boot.initrd.availableKernelModules = [ cfg.networkModule ];
-        boot.kernelParams = lib.mkIf config.initrd-ssh.ip.enable [
+        boot.initrd.kernelModules = [ cfg.networkModule ];
-          "ip=${mkIpString config.initrd-ssh.ip}"
+        boot.kernelParams = lib.mkIf cfg.ip.enable [
+          "ip=${mkIpString cfg.ip}"
         ];
 
         boot.initrd.network = {
           enable = true;
+          udhcpc.enable = !cfg.ip.enable;
           ssh = {
             enable = true;
             port = 22;
@@ -64,7 +67,7 @@
               "${keyDir}/ssh_host_rsa_key"
               "${keyDir}/ssh_host_ed25519_key"
             ];
-            inherit (config.initrd-ssh) authorizedKeys;
+            inherit (cfg) authorizedKeys;
           };
           postCommands = ''
             echo 'cryptsetup-askpass' >> /root/.profile

features/localisation.nix

@@ -1,25 +1,30 @@
 {
   nixos =
     { lib, config, ... }:
+    let
+      cfg = config.features.localisation;
+    in
     {
-      options = {
+      options.features.localisation = {
-        localisation = {
+        enable = lib.mkEnableOption "localisation";
+
         timeZone = lib.mkOption {
           type = lib.types.str;
+          default = "Europe/Ljubljana";
         };
 
         defaultLocale = lib.mkOption {
           type = lib.types.str;
-          };
+          default = "en_US.UTF-8";
         };
       };
 
-      config = {
+      config = lib.mkIf cfg.enable {
-        time.timeZone = config.localisation.timeZone;
+        time.timeZone = cfg.timeZone;
-        i18n.defaultLocale = config.localisation.defaultLocale;
+        i18n.defaultLocale = cfg.defaultLocale;
 
         # NOTE:(@janezicmatej) some apps (e.g. java) need TZ env var explicitly
-        environment.variables.TZ = config.localisation.timeZone;
+        environment.variables.TZ = cfg.timeZone;
       };
     };
 }

features/neovim.nix

@@ -1,4 +1,17 @@
 {
+  nixos =
+    { lib, ... }:
+    {
+      options.features.neovim = {
+        enable = lib.mkEnableOption "neovim";
+
+        dotfiles = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+        };
+      };
+    };
+
   home =
     {
       config,
@@ -6,24 +19,21 @@
       lib,
       pkgs,
       inputs,
+      osConfig,
       ...
     }:
+    let
+      cfg = osConfig.features.neovim;
+    in
     {
-      options = {
+      config = lib.mkIf cfg.enable (lib.mkMerge [
-        neovim.dotfiles = lib.mkOption {
-          type = lib.types.nullOr lib.types.path;
-          default = null;
-        };
-      };
-
-      config = lib.mkMerge [
         (lib.optionalAttrs (options ? stylix) {
-          # disable stylix neovim target when stylix is present (loaded by desktop feature)
+          # disable stylix neovim target when stylix is present
           stylix.targets.neovim.enable = false;
         })
         {
-          xdg.configFile."nvim" = lib.mkIf (config.neovim.dotfiles != null) {
+          xdg.configFile."nvim" = lib.mkIf (cfg.dotfiles != null) {
-            source = config.neovim.dotfiles;
+            source = cfg.dotfiles;
           };
 
           programs.neovim = {
@@ -64,6 +74,6 @@
             ];
           };
         }
-      ];
+      ]);
     };
 }

features/networkmanager.nix

@@ -1,9 +1,18 @@
 {
-  nixos = _: {
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.networkmanager;
+    in
+    {
+      options.features.networkmanager.enable = lib.mkEnableOption "networkmanager";
+
+      config = lib.mkIf cfg.enable {
         networking.networkmanager.enable = true;
         networking.nameservers = [
           "1.1.1.1"
           "8.8.8.8"
         ];
       };
+    };
 }

features/nix-ld.nix

@@ -1,5 +1,14 @@
 {
-  nixos = _: {
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.nix-ld;
+    in
+    {
+      options.features.nix-ld.enable = lib.mkEnableOption "nix-ld";
+
+      config = lib.mkIf cfg.enable {
         programs.nix-ld.enable = true;
       };
+    };
 }

features/nix-settings.nix

@@ -0,0 +1,71 @@
+{
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.nix-settings;
+    in
+    {
+      options.features.nix-settings = {
+        enable = lib.mkEnableOption "nix settings";
+
+        towerCache.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+
+        };
+
+        gc = {
+          dates = lib.mkOption {
+            type = lib.types.str;
+            default = "monthly";
+          };
+
+          olderThan = lib.mkOption {
+            type = lib.types.str;
+            default = "30d";
+          };
+        };
+
+        optimise.dates = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ "monthly" ];
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        nix = {
+          settings = {
+            experimental-features = [
+              "nix-command"
+              "flakes"
+            ];
+            download-buffer-size = 2 * 1024 * 1024 * 1024;
+            warn-dirty = false;
+            substituters =
+              [
+                "https://cache.nixos.org"
+                "https://nix-community.cachix.org?priority=45"
+              ]
+              ++ lib.optional cfg.towerCache.enable "http://tower:5000?priority=50";
+            trusted-public-keys =
+              [
+                "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+                "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+              ]
+              ++ lib.optional cfg.towerCache.enable "matej.nix-1:TdbemLVYblvAxqJcwb3mVKmmr3cfzXbMcZHE5ILnZDE=";
+          };
+
+          gc = {
+            automatic = true;
+            dates = cfg.gc.dates;
+            options = "--delete-older-than ${cfg.gc.olderThan}";
+          };
+
+          optimise = {
+            automatic = true;
+            dates = cfg.optimise.dates;
+          };
+        };
+      };
+    };
+}

features/onepassword.nix

@@ -0,0 +1,18 @@
+{
+  nixos =
+    { config, lib, user, ... }:
+    let
+      cfg = config.features.onepassword;
+    in
+    {
+      options.features.onepassword.enable = lib.mkEnableOption "1password";
+
+      config = lib.mkIf cfg.enable {
+        programs._1password.enable = true;
+        programs._1password-gui = {
+          enable = true;
+          polkitPolicyOwners = [ user ];
+        };
+      };
+    };
+}

features/openssh.nix

@@ -1,18 +1,23 @@
 {
   nixos =
     { lib, config, ... }:
+    let
+      cfg = config.features.openssh;
+    in
     {
-      options = {
+      options.features.openssh = {
-        openssh.port = lib.mkOption {
+        enable = lib.mkEnableOption "openssh";
+
+        port = lib.mkOption {
           type = lib.types.port;
           default = 22;
         };
       };
 
-      config = {
+      config = lib.mkIf cfg.enable {
         services.openssh = {
           enable = true;
-          ports = [ config.openssh.port ];
+          ports = [ cfg.port ];
           settings = {
             PasswordAuthentication = false;
             AllowUsers = null;

features/power.nix

@@ -0,0 +1,57 @@
+{
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.power;
+    in
+    {
+      options.features.power = {
+        enable = lib.mkEnableOption "laptop power management";
+
+        resumeDevice = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+
+        lidSwitch = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        powerKey = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        idleAction = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        idleActionSec = lib.mkOption {
+          type = lib.types.str;
+          default = "15min";
+        };
+
+        hibernateDelaySec = lib.mkOption {
+          type = lib.types.str;
+          default = "30min";
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        boot.resumeDevice = lib.mkIf (cfg.resumeDevice != null) cfg.resumeDevice;
+
+        services.logind.settings.Login = {
+          HandleLidSwitch = cfg.lidSwitch;
+          HandlePowerKey = cfg.powerKey;
+          IdleAction = cfg.idleAction;
+          IdleActionSec = cfg.idleActionSec;
+        };
+
+        systemd.sleep.settings.Sleep = {
+          HibernateDelaySec = cfg.hibernateDelaySec;
+        };
+      };
+    };
+}

features/printing.nix

@@ -1,5 +1,13 @@
 {
-  nixos = _: {
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.printing;
+    in
+    {
+      options.features.printing.enable = lib.mkEnableOption "printing";
+
+      config = lib.mkIf cfg.enable {
         services.printing.enable = true;
         services.avahi = {
           enable = true;
@@ -7,4 +15,5 @@
           openFirewall = true;
         };
       };
+    };
 }

features/remote-base.nix

@@ -1,7 +1,13 @@
 {
   nixos =
-    { config, user, ... }:
+    { config, lib, user, ... }:
+    let
+      cfg = config.features.remote-base;
+    in
     {
+      options.features.remote-base.enable = lib.mkEnableOption "remote-base";
+
+      config = lib.mkIf cfg.enable {
         sops.secrets.user-password = {
           sopsFile = ../secrets/common.yaml;
           neededForUsers = true;
@@ -10,4 +16,5 @@
         users.mutableUsers = false;
         users.users.${user}.hashedPasswordFile = config.sops.secrets.user-password.path;
       };
+    };
 }

features/shell-minimal.nix

@@ -1,16 +0,0 @@
-{
-  nixos = _: {
-    programs.zsh.enable = true;
-    environment.etc."zshenv".text = ''
-      export ZDOTDIR=$HOME/.config/zsh
-    '';
-  };
-
-  home =
-    { pkgs, ... }:
-    {
-      home.packages = with pkgs; [
-        starship
-      ];
-    };
-}

features/shell.nix

@@ -1,16 +1,18 @@
 {
-  nixos = _: {
+  nixos =
-    programs.zsh.enable = true;
+    { lib, ... }:
-    environment.etc."zshenv".text = ''
+    {
-      export ZDOTDIR=$HOME/.config/zsh
+      options.features.shell.enable = lib.mkEnableOption "shell extras";
-    '';
     };
 
   home =
-    { pkgs, ... }:
+    { pkgs, lib, osConfig, ... }:
+    let
+      cfg = osConfig.features.shell;
+    in
     {
+      config = lib.mkIf cfg.enable {
         home.packages = with pkgs; [
-        starship
           fzf
           htop
           jc
@@ -22,4 +24,5 @@
           tmux
         ];
       };
+    };
 }

features/sway.nix

@@ -1,7 +1,33 @@
 {
   nixos =
-    { pkgs, ... }:
+    { config, lib, pkgs, ... }:
+    let
+      cfg = config.features.sway;
+      desktopCfg = config.features.desktop;
+    in
     {
+      options.features.sway = {
+        enable = lib.mkEnableOption "sway window manager";
+
+        greeter.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        {
+          # soft dependency
+          features.desktop.enable = lib.mkDefault true;
+
+          # hard dependency
+          assertions = [
+            {
+              assertion = desktopCfg.enable;
+              message = "features.sway requires features.desktop";
+            }
+          ];
+
           programs.sway = {
             enable = true;
             package = pkgs.swayfx;
@@ -34,5 +60,32 @@
             cliphist
             zenity
           ];
+        }
+
+        # greeter
+        (lib.mkIf cfg.greeter.enable {
+          programs.regreet = {
+            enable = true;
+            cageArgs = [
+              "-s"
+              "-m"
+              "last"
+            ];
+            font = {
+              name = lib.mkForce "JetBrainsMono Nerd Font";
+              size = lib.mkForce 14;
+            };
+            settings = {
+              background = {
+                path = lib.mkForce (toString desktopCfg.theme.wallpaper);
+                fit = lib.mkForce "Cover";
+              };
+              GTK = {
+                application_prefer_dark_theme = lib.mkForce true;
+              };
+            };
+          };
+        })
+      ]);
     };
 }

features/tailscale.nix

@@ -1,8 +1,17 @@
 {
-  nixos = _: {
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.tailscale;
+    in
+    {
+      options.features.tailscale.enable = lib.mkEnableOption "tailscale";
+
+      config = lib.mkIf cfg.enable {
         services.tailscale = {
           enable = true;
           useRoutingFeatures = "both";
         };
       };
+    };
 }

features/udev.nix

@@ -0,0 +1,52 @@
+{
+  nixos =
+    { config, lib, pkgs, ... }:
+    let
+      cfg = config.features.udev;
+    in
+    {
+      options.features.udev = {
+        enable = lib.mkEnableOption "custom udev rules";
+
+        kindle.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+
+        ledger.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+
+        keyboard-zsa.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        (lib.mkIf cfg.kindle.enable {
+          # NOTE:(@janezicmatej) uses services.udev.packages instead of extraRules
+          # because extraRules writes to 99-local.rules which is too late for uaccess
+          services.udev.packages = [
+            pkgs.libmtp
+            (pkgs.writeTextFile {
+              name = "kindle-udev-rules";
+              text = ''
+                ACTION!="remove", SUBSYSTEM=="usb", ATTRS{idVendor}=="1949", TAG+="uaccess"
+              '';
+              destination = "/etc/udev/rules.d/70-kindle.rules";
+            })
+          ];
+        })
+
+        (lib.mkIf cfg.ledger.enable {
+          hardware.ledger.enable = true;
+        })
+
+        (lib.mkIf cfg.keyboard-zsa.enable {
+          hardware.keyboard.zsa.enable = true;
+        })
+      ]);
+    };
+}

features/user-matej.nix

@@ -10,15 +10,12 @@ in
   };
 
   nixos =
-    { pkgs, ... }:
+    { ... }:
     {
-      programs.zsh.enable = true;
-
       users.users.matej = {
         uid = 1000;
         isNormalUser = true;
         home = "/home/matej";
-        shell = pkgs.zsh;
         extraGroups = [ "wheel" ];
         openssh.authorizedKeys.keys = sshKeys;
       };

features/vm-9p-automount.nix

@@ -1,72 +0,0 @@
-{
-  nixos =
-    {
-      pkgs,
-      lib,
-      config,
-      ...
-    }:
-    let
-      inherit (config.vm-9p-automount) user;
-      inherit (config.users.users.${user}) home group;
-    in
-    {
-      options = {
-        vm-9p-automount = {
-          user = lib.mkOption {
-            type = lib.types.str;
-          };
-
-          prefix = lib.mkOption {
-            type = lib.types.str;
-            default = "m_";
-          };
-
-          basePath = lib.mkOption {
-            type = lib.types.str;
-            default = "${home}/mnt";
-          };
-        };
-      };
-
-      config = {
-        systemd.services.vm-9p-automount = {
-          description = "Auto-discover and mount 9p shares";
-          after = [
-            "local-fs.target"
-            "nss-user-lookup.target"
-            "systemd-modules-load.service"
-          ];
-          wants = [ "systemd-modules-load.service" ];
-          wantedBy = [ "multi-user.target" ];
-          serviceConfig = {
-            Type = "oneshot";
-            RemainAfterExit = true;
-            ExecStart = pkgs.writeShellScript "vm-9p-automount" ''
-              BASE="${config.vm-9p-automount.basePath}"
-              PREFIX="${config.vm-9p-automount.prefix}"
-              mkdir -p "$BASE"
-              chown ${user}:${group} "$BASE"
-
-              for tagfile in $(find /sys/devices -name mount_tag 2>/dev/null); do
-                [ -f "$tagfile" ] || continue
-                tag=$(tr -d '\0' < "$tagfile")
-
-                case "$tag" in
-                  "$PREFIX"*) ;;
-                  *) continue ;;
-                esac
-
-                name="''${tag#"$PREFIX"}"
-                target="$BASE/$name"
-
-                mkdir -p "$target"
-                ${pkgs.util-linux}/bin/mount -t 9p "$tag" "$target" \
-                  -o trans=virtio,version=9p2000.L || continue
-              done
-            '';
-          };
-        };
-      };
-    };
-}

features/vm-guest.nix

@@ -6,19 +6,46 @@
       config,
       ...
     }:
+    let
+      cfg = config.features.vm-guest;
+      autoUser = cfg.automount.user;
+      autoHome = config.users.users.${autoUser}.home;
+      autoGroup = config.users.users.${autoUser}.group;
+    in
     {
-      options = {
+      options.features.vm-guest = {
-        vm-guest.headless = lib.mkOption {
+        enable = lib.mkEnableOption "qemu vm guest";
+
+        headless = lib.mkOption {
           type = lib.types.bool;
           default = false;
         };
+
+        automount = {
+          enable = lib.mkEnableOption "9p share automount";
+
+          user = lib.mkOption {
+            type = lib.types.str;
           };
 
-      config = {
+          prefix = lib.mkOption {
-        services.qemuGuest.enable = true;
+            type = lib.types.str;
-        services.spice-vdagentd.enable = lib.mkIf (!config.vm-guest.headless) true;
+            default = "m_";
+          };
 
-        boot.kernelParams = lib.mkIf config.vm-guest.headless [ "console=ttyS0,115200" ];
+          basePath = lib.mkOption {
+            type = lib.types.str;
+            default = "${autoHome}/mnt";
+          };
+        };
+      };
+
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        {
+          services.qemuGuest.enable = true;
+          services.spice-vdagentd.enable = lib.mkIf (!cfg.headless) true;
+
+          boot.kernelParams = lib.mkIf cfg.headless [ "console=ttyS0,115200" ];
 
           boot.initrd.availableKernelModules = [
             "9p"
@@ -42,6 +69,47 @@
             htop
             sshfs
           ];
+        }
+
+        (lib.mkIf cfg.automount.enable {
+          systemd.services.vm-9p-automount = {
+            description = "Auto-discover and mount 9p shares";
+            after = [
+              "local-fs.target"
+              "nss-user-lookup.target"
+              "systemd-modules-load.service"
+            ];
+            wants = [ "systemd-modules-load.service" ];
+            wantedBy = [ "multi-user.target" ];
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+              ExecStart = pkgs.writeShellScript "vm-9p-automount" ''
+                BASE="${cfg.automount.basePath}"
+                PREFIX="${cfg.automount.prefix}"
+                mkdir -p "$BASE"
+                chown ${autoUser}:${autoGroup} "$BASE"
+
+                for tagfile in $(find /sys/devices -name mount_tag 2>/dev/null); do
+                  [ -f "$tagfile" ] || continue
+                  tag=$(tr -d '\0' < "$tagfile")
+
+                  case "$tag" in
+                    "$PREFIX"*) ;;
+                    *) continue ;;
+                  esac
+
+                  name="''${tag#"$PREFIX"}"
+                  target="$BASE/$name"
+
+                  mkdir -p "$target"
+                  ${pkgs.util-linux}/bin/mount -t 9p "$tag" "$target" \
+                    -o trans=virtio,version=9p2000.L || continue
+                done
+              '';
             };
           };
+        })
+      ]);
+    };
 }

features/yubikey.nix

@@ -1,12 +0,0 @@
-{
-  nixos =
-    { pkgs, ... }:
-    {
-      environment.systemPackages = with pkgs; [
-        yubikey-personalization
-        yubikey-manager
-      ];
-
-      services.pcscd.enable = true;
-    };
-}

features/zsh.nix

@@ -0,0 +1,42 @@
+{
+  nixos =
+    { config, lib, pkgs, user, ... }:
+    let
+      cfg = config.features.zsh;
+    in
+    {
+      options.features.zsh = {
+        enable = lib.mkEnableOption "zsh";
+
+        loginShell.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+
+        };
+      };
+
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        {
+          programs.zsh.enable = true;
+          environment.etc."zshenv".text = ''
+            export ZDOTDIR=$HOME/.config/zsh
+          '';
+        }
+
+        (lib.mkIf cfg.loginShell.enable {
+          users.users.${user}.shell = pkgs.zsh;
+        })
+      ]);
+    };
+
+  home =
+    { pkgs, lib, osConfig, ... }:
+    let
+      cfg = osConfig.features.zsh;
+    in
+    {
+      config = lib.mkIf cfg.enable {
+        home.packages = [ pkgs.starship ];
+      };
+    };
+}

flake.lock

@@ -273,11 +273,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775556024,
+        "lastModified": 1776030105,
-        "narHash": "sha256-j1u/859OVS54rGlsvFqJdwKPEnFYCI+4pyfTiSfv1Xc=",
+        "narHash": "sha256-b4cNpWPDSH+/CTTiw8++yGh1UYG2kQNrbIehV2iGoeo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "4bdfeff1d9b7473e6e58f73f5809576e8a69e406",
+        "rev": "49088dc2e7a876e338e510c5f5f60f659819c650",
         "type": "github"
       },
       "original": {
@@ -317,11 +317,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1775520277,
+        "lastModified": 1775952282,
-        "narHash": "sha256-dUI8/Mc6CfA+EmfrYByt+oNIEvdRLtSSDVS54O0YpBM=",
+        "narHash": "sha256-iJcGy0pW0wX7q6HAQuKx8sskTyu8an0l0gI3TBgzk3E=",
         "owner": "nix-community",
         "repo": "neovim-nightly-overlay",
-        "rev": "b63186e453b0ad340760648293aa1ccf75528c46",
+        "rev": "f719e136a8e0cd91e70515e590385356abce1341",
         "type": "github"
       },
       "original": {
@@ -333,11 +333,11 @@
     "neovim-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1775514165,
+        "lastModified": 1775949028,
-        "narHash": "sha256-mAUtXA5BfCH5SRInzfJdaHY9egHrVLED0DsQzgBW4Fk=",
+        "narHash": "sha256-JXrr9lxKfTIm/VW4jvaB1RU9r+7pAoaXeDsy24TGPiw=",
         "owner": "neovim",
         "repo": "neovim",
-        "rev": "b36eafd5dafae561763e5dc2ba73b3f0b74c63fe",
+        "rev": "4a289bfce3e71bf00d1eced168a6a7bbb270b95b",
         "type": "github"
       },
       "original": {
@@ -364,11 +364,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1775464765,
+        "lastModified": 1775888245,
-        "narHash": "sha256-nex6TL2x1/sVHCyDWcvl1t/dbTedb9bAGC4DLf/pmYk=",
+        "narHash": "sha256-nwASzrRDD1JBEu/o8ekKYEXm/oJW6EMCzCRdrwcLe90=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "83e29f2b8791f6dec20804382fcd9a666d744c07",
+        "rev": "13043924aaa7375ce482ebe2494338e058282925",
         "type": "github"
       },
       "original": {
@@ -395,11 +395,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1775560693,
+        "lastModified": 1776031281,
-        "narHash": "sha256-V1y4hd0R0XYG5GMpdj0W9h6976r6kZV5vcmKysclmfE=",
+        "narHash": "sha256-MCXhNHfTvsvbdkn9WV3Rv5Z0tUig1CtINZV+jaWh04k=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "987687fd632e29817fc9c9d96eddba7d264510c0",
+        "rev": "4ee46f65286df51761a238bb0f024f8d696ac683",
         "type": "github"
       },
       "original": {
@@ -411,11 +411,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1775305101,
+        "lastModified": 1775811116,
-        "narHash": "sha256-/74n1oQPtKG52Yw41cbToxspxHbYz6O3vi+XEw16Qe8=",
+        "narHash": "sha256-t+HZK42pB6N+i5RGbuy7Xluez/VvWbembBdvzsc23Ss=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "36a601196c4ebf49e035270e10b2d103fe39076b",
+        "rev": "54170c54449ea4d6725efd30d719c5e505f1c10e",
         "type": "github"
       },
       "original": {
@@ -427,11 +427,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1775423009,
+        "lastModified": 1775710090,
-        "narHash": "sha256-vPKLpjhIVWdDrfiUM8atW6YkIggCEKdSAlJPzzhkQlw=",
+        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "68d8aa3d661f0e6bd5862291b5bb263b2a6595c9",
+        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
         "type": "github"
       },
       "original": {
@@ -550,11 +550,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775365543,
+        "lastModified": 1775971308,
-        "narHash": "sha256-f50qrK0WwZ9z5EdaMGWOTtALgSF7yb7XwuE7LjCuDmw=",
+        "narHash": "sha256-VKp9bhVSm0bT6JWctFy06ocqxGGnWHi1NfoE90IgIcY=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "a4ee2de76efb759fe8d4868c33dec9937897916f",
+        "rev": "31ac5fe5d015f76b54058c69fcaebb66a55871a4",
         "type": "github"
       },
       "original": {
@@ -583,11 +583,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1775429060,
+        "lastModified": 1775936757,
-        "narHash": "sha256-wbFF5cRxQOCzL/wHOKYm21t5AHPH2Lfp0mVPCOAvEoc=",
+        "narHash": "sha256-KJO/7qoxJ+hlsb3WlFSl6IGrExBIf1GvKdrhOlnGdKY=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "d27951a6539951d87f75cf0a7cda8a3a24016019",
+        "rev": "d3e447786b74d62c75f665e17cb3e681c66e90c7",
         "type": "github"
       },
       "original": {

flake/hosts.nix

@@ -15,25 +15,29 @@ in
       system = "x86_64-linux";
       user = "matej";
       features = [
-        "openssh"
+        "bootloader"
-        "localisation"
-        "gnupg"
-        "shell"
-        "desktop"
-        "sway"
-        "greeter"
-        "printing"
-        "networkmanager"
-        "docker"
-        "tailscale"
-        "nix-ld"
-        "yubikey"
-        "calibre"
-        "gaming"
-        "direnv"
-        "neovim"
-        "dev"
         "claude"
+        "desktop"
+        "dev"
+        "direnv"
+        "docker"
+        "gaming"
+        "git"
+        "gnupg"
+        "localisation"
+        "neovim"
+        "networkmanager"
+        "nix-ld"
+        "nix-settings"
+        "onepassword"
+        "openssh"
+        "power"
+        "printing"
+        "shell"
+        "sway"
+        "tailscale"
+        "udev"
+        "zsh"
       ];
     };
 
@@ -41,27 +45,30 @@ in
       system = "x86_64-linux";
       user = "matej";
       features = [
-        "openssh"
+        "bootloader"
-        "localisation"
-        "gnupg"
-        "shell"
-        "desktop"
-        "sway"
-        "greeter"
-        "printing"
-        "networkmanager"
-        "docker"
-        "tailscale"
-        "nix-ld"
-        "yubikey"
-        "calibre"
-        "gaming"
-        "initrd-ssh"
-        "direnv"
-        "neovim"
-        "dev"
         "claude"
+        "desktop"
+        "dev"
+        "direnv"
+        "docker"
+        "gaming"
+        "git"
+        "gnupg"
         "harmonia"
+        "initrd-ssh"
+        "localisation"
+        "neovim"
+        "networkmanager"
+        "nix-ld"
+        "nix-settings"
+        "onepassword"
+        "openssh"
+        "printing"
+        "shell"
+        "sway"
+        "tailscale"
+        "udev"
+        "zsh"
       ];
     };
 
@@ -70,7 +77,9 @@ in
       system = "x86_64-linux";
       user = "matej";
       features = [
+        "nix-settings"
         "openssh"
+        "zsh"
       ];
     };
 
@@ -78,11 +87,14 @@ in
       system = "x86_64-linux";
       user = "matej";
       features = [
-        "openssh"
+        "bootloader"
         "localisation"
+        "nix-settings"
+        "openssh"
+        "remote-base"
         "shell"
         "tailscale"
-        "remote-base"
+        "zsh"
       ];
     };
 
@@ -91,12 +103,14 @@ in
       system = "x86_64-linux";
       user = "matej";
       features = [
-        "openssh"
+        "filedrop"
         "localisation"
+        "nix-settings"
+        "openssh"
+        "remote-base"
         "shell"
         "tailscale"
-        "remote-base"
+        "zsh"
-        "filedrop"
       ];
     };
 
@@ -104,14 +118,15 @@ in
       system = "x86_64-linux";
       user = "matej";
       features = [
-        "localisation"
+        "bootloader"
+        "desktop"
         "gnupg"
-        "shell-minimal"
+        "localisation"
-        "desktop-minimal"
-        "sway"
-        "greeter"
         "networkmanager"
-        "yubikey"
+        "nix-settings"
+        "sway"
+        "udev"
+        "zsh"
       ];
     };
 
@@ -119,16 +134,18 @@ in
       system = "x86_64-linux";
       user = "matej";
       features = [
-        "openssh"
-        "localisation"
-        "gnupg"
-        "shell"
-        "vm-guest"
-        "vm-9p-automount"
-        "docker"
-        "neovim"
         "claude"
         "dev"
+        "docker"
+        "git"
+        "gnupg"
+        "localisation"
+        "neovim"
+        "nix-settings"
+        "openssh"
+        "shell"
+        "vm-guest"
+        "zsh"
       ];
     };
   };

hosts/cube/configuration.nix

@@ -2,9 +2,6 @@
 {
   imports = [ inputs.disko.nixosModules.disko ];
 
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
   disko.devices.disk.main = {
     type = "disk";
     device = "/dev/nvme0n1";
@@ -32,10 +29,5 @@
     };
   };
 
-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
-  };
-
   system.stateVersion = "25.11";
 }

hosts/ephvm/configuration.nix

@@ -5,6 +5,7 @@
   ...
 }:
 {
+  features.nix-settings.towerCache.enable = false;
   # no hardware firmware needed in a VM
   hardware.enableRedistributableFirmware = lib.mkForce false;
   hardware.wirelessRegulatoryDatabase = lib.mkForce false;
@@ -28,18 +29,12 @@
       );
     };
 
-  vm-guest.headless = true;
+  features.vm-guest.headless = true;
-
+  features.vm-guest.automount = {
-  vm-9p-automount.user = "matej";
+    enable = true;
-
+    user = "matej";
-  localisation = {
-    timeZone = "UTC";
-    defaultLocale = "en_US.UTF-8";
-  };
-
-  home-manager.users.matej = {
-    neovim.dotfiles = inputs.nvim;
   };
+  features.neovim.dotfiles = inputs.nvim;
 
   # ensure .config exists with correct ownership before automount
   systemd.tmpfiles.rules = [ "d /home/matej/.config 0755 matej users -" ];

hosts/floo/configuration.nix

@@ -2,6 +2,8 @@
 {
   imports = [ inputs.disko.nixosModules.disko ];
 
+  features.filedrop.sopsFile = ../../secrets/floo.yaml;
+
   boot.loader.grub.enable = true;
 
   disko.devices.disk.main = {
@@ -26,10 +28,5 @@
     };
   };
 
-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
-  };
-
   system.stateVersion = "25.11";
 }

hosts/fortress/configuration.nix

@@ -10,13 +10,11 @@
     inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
   ];
 
-  localisation = {
+  features.desktop = {
-    timeZone = "Europe/Ljubljana";
+    apps.enable = false;
-    defaultLocale = "en_US.UTF-8";
+    internalCA.enable = false;
   };
-
+  features.gnupg.yubikey.enable = true;
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
 
   disko.devices.disk.main = {
     type = "disk";

hosts/fw16/configuration.nix

@@ -1,8 +1,7 @@
 {
   lib,
-  pkgs,
-  inputs,
   options,
+  inputs,
   ...
 }:
 
@@ -11,37 +10,22 @@
     inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
   ];
 
-  localisation = {
+  features.desktop.bluetooth.enable = true;
-    timeZone = "Europe/Ljubljana";
+  features.gnupg.yubikey.enable = true;
-    defaultLocale = "en_US.UTF-8";
+  features.udev = {
+    ledger.enable = true;
+    keyboard-zsa.enable = true;
   };
-
+  features.power.resumeDevice = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540";
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
 
   boot.kernelParams = [ "pcie_aspm.policy=powersupersave" ];
 
-  boot.resumeDevice = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540";
-
-  services.logind.settings.Login = {
-    HandleLidSwitch = "suspend-then-hibernate";
-    HandlePowerKey = "suspend-then-hibernate";
-    IdleAction = "suspend-then-hibernate";
-    IdleActionSec = "15min";
-  };
-
-  systemd.sleep.settings.Sleep = {
-    HibernateDelaySec = "30min";
-  };
-
   programs.nix-ld.libraries = options.programs.nix-ld.libraries.default;
 
   services.gnome.gnome-keyring.enable = true;
   services.teamviewer.enable = true;
 
   services.hardware.bolt.enable = true;
-  hardware.keyboard.zsa.enable = true;
-  hardware.ledger.enable = true;
   hardware.bluetooth.powerOnBoot = true;
   hardware.inputmodule.enable = true;
 

hosts/iso/configuration.nix

@@ -1,15 +1,13 @@
-{ lib, ... }:
+{ lib, userKeys, ... }:
 {
+  features.nix-settings.towerCache.enable = false;
   image.modules.iso-installer = {
     isoImage.squashfsCompression = "zstd -Xcompression-level 6";
   };
 
   # live iso: passwordless login and sudo
   users.users.matej.initialHashedPassword = "";
-  users.users.root.openssh.authorizedKeys.keys = [
+  users.users.root.openssh.authorizedKeys.keys = userKeys.sshAuthorizedKeys;
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
-  ];
   services.openssh.settings.PermitRootLogin = lib.mkForce "prohibit-password";
   security.sudo.wheelNeedsPassword = false;
 

hosts/tower/configuration.nix

@@ -1,38 +1,28 @@
 {
   config,
-  lib,
-  inputs,
   userKeys,
   ...
 }:
 
 {
-  imports = [
+  features.nix-settings.towerCache.enable = false;
-    inputs.lanzaboote.nixosModules.lanzaboote
+  features.bootloader.mode = "lanzaboote";
-  ];
+  features.desktop.bluetooth.enable = true;
+  features.gnupg.yubikey.enable = true;
+  features.udev = {
+    ledger.enable = true;
+    keyboard-zsa.enable = true;
+  };
+  features.initrd-ssh = {
+    networkModule = "r8169";
+    authorizedKeys = userKeys.sshAuthorizedKeys;
+  };
 
   # nix store signing
   sops.secrets.nix-signing-key.sopsFile = ../../secrets/tower.yaml;
   nix.settings.secret-key-files = [ config.sops.secrets.nix-signing-key.path ];
 
-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
-  };
-
-  initrd-ssh = {
-    networkModule = "r8169";
-    authorizedKeys = userKeys.sshAuthorizedKeys;
-  };
-
-  # lanzaboote secure boot
   boot.kernelParams = [ "btusb.reset=1" ];
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.loader.systemd-boot.enable = lib.mkForce false;
-  boot.lanzaboote = {
-    enable = true;
-    pkiBundle = "/var/lib/sbctl";
-  };
 
   services.udisks2.enable = true;
 

lib/mkHost.nix

@@ -27,7 +27,19 @@ let
   hostConfig = ../hosts/${name}/configuration.nix;
   hostHWConfig = ../hosts/${name}/hardware-configuration.nix;
 
-  # load feature with path check
+  # auto-discover all features, excluding user-* and default.nix
+  featureDir = builtins.readDir ../features;
+  allFeatureNames = lib.pipe featureDir [
+    (lib.filterAttrs (
+      n: t:
+      (t == "regular" && lib.hasSuffix ".nix" n && n != "default.nix" && !lib.hasPrefix "user-" n)
+      || (t == "directory" && builtins.pathExists ../features/${n}/default.nix)
+    ))
+    builtins.attrNames
+    (map (n: lib.removeSuffix ".nix" n))
+  ];
+
+  # load all features unconditionally
   loadFeature =
     f:
     assert
@@ -35,7 +47,7 @@ let
       || throw "feature '${f}' not found at ${toString (featurePath f)}";
     import (featurePath f);
 
-  loadedFeatures = map loadFeature features;
+  loadedFeatures = map loadFeature allFeatureNames;
 
   # load user feature with path check
   userFeature =
@@ -55,17 +67,28 @@ let
   # collect nixos and home modules from all features
   nixosMods = map (f: f.nixos) (builtins.filter (f: f ? nixos) allFeatures);
   homeMods = map (f: f.home) (builtins.filter (f: f ? home) allFeatures);
+
+  # translate features list to enable flags
+  featureEnableModule =
+    { lib, ... }:
+    {
+      config.features = lib.genAttrs features (_: {
+        enable = true;
+      });
+    };
 in
 nixpkgs.lib.nixosSystem {
   inherit system;
-  modules = [
+  modules =
-    ../nix.nix
+    [
       inputs.sops-nix.nixosModules.sops
+      inputs.stylix.nixosModules.stylix
 
       { nixpkgs.overlays = overlays; }
       { nixpkgs.config.allowUnfree = true; }
       { networking.hostName = name; }
 
+      featureEnableModule
       hostConfig
     ]
     ++ lib.optional (builtins.pathExists hostHWConfig) hostHWConfig