chore: bump lockfile

fix: enable dhcp in initrd if no static ip
merge: feature improvements
2026-04-13 00:22:51 +02:00 · 2026-04-13 00:20:36 +02:00 · 2026-04-12 23:33:33 +02:00 · 2026-04-12 23:33:14 +02:00 · 2026-04-12 23:33:07 +02:00 · 2026-04-12 23:33:01 +02:00
45 changed files with 1175 additions and 729 deletions
--- a/features/bootloader.nix
+++ b/features/bootloader.nix
@@ -0,0 +1,40 @@
+{
+  nixos =
+    { config, lib, inputs, ... }:
+    let
+      cfg = config.features.bootloader;
+    in
+    {
+      imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
+
+      options.features.bootloader = {
+        enable = lib.mkEnableOption "bootloader";
+
+        mode = lib.mkOption {
+          type = lib.types.enum [
+            "systemd-boot"
+            "lanzaboote"
+          ];
+          default = "systemd-boot";
+        };
+      };
+
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        {
+          boot.loader.efi.canTouchEfiVariables = true;
+        }
+
+        (lib.mkIf (cfg.mode == "systemd-boot") {
+          boot.loader.systemd-boot.enable = true;
+        })
+
+        (lib.mkIf (cfg.mode == "lanzaboote") {
+          boot.loader.systemd-boot.enable = lib.mkForce false;
+          boot.lanzaboote = {
+            enable = true;
+            pkiBundle = "/var/lib/sbctl";
+          };
+        })
+      ]);
+    };
+}
--- a/features/calibre.nix
+++ b/features/calibre.nix
@@ -1,22 +0,0 @@
-{
-  nixos =
-    { pkgs, ... }:
-    {
-      environment.systemPackages = [ pkgs.calibre ];
-
-      # udev rules for kindle and mtp device access
-      # NOTE:(@janezicmatej) uses services.udev.packages instead of extraRules
-      # because extraRules writes to 99-local.rules which is too late for uaccess
-      # see https://github.com/NixOS/nixpkgs/issues/308681
-      services.udev.packages = [
-        pkgs.libmtp
-        (pkgs.writeTextFile {
-          name = "kindle-udev-rules";
-          text = ''
-            ACTION!="remove", SUBSYSTEM=="usb", ATTRS{idVendor}=="1949", TAG+="uaccess"
-          '';
-          destination = "/etc/udev/rules.d/70-kindle.rules";
-        })
-      ];
-    };
-}
--- a/features/claude.nix
+++ b/features/claude.nix
@@ -1,10 +1,21 @@
 {
+  nixos =
+    { lib, ... }:
+    {
+      options.features.claude.enable = lib.mkEnableOption "claude";
+    };
+
  home =
-    { pkgs, ... }:
+    { pkgs, lib, osConfig, ... }:
+    let
+      cfg = osConfig.features.claude;
+    in
    {
+      config = lib.mkIf cfg.enable {
        home.packages = [
          pkgs.claude-code
          pkgs.mcp-nixos
        ];
      };
+    };
 }
--- a/features/desktop-minimal.nix
+++ b/features/desktop-minimal.nix
@@ -1,45 +0,0 @@
-{
-  nixos =
-    { pkgs, inputs, ... }:
-    {
-      imports = [ inputs.stylix.nixosModules.stylix ];
-
-      # audio
-      services.pipewire = {
-        enable = true;
-        pulse.enable = true;
-      };
-
-      security.polkit.enable = true;
-      services.dbus.enable = true;
-      services.playerctld.enable = true;
-
-      xdg.portal = {
-        enable = true;
-        xdgOpenUsePortal = true;
-        extraPortals = [
-          pkgs.xdg-desktop-portal-wlr
-          pkgs.xdg-desktop-portal-gtk
-        ];
-      };
-
-      fonts.packages = with pkgs; [
-        font-awesome
-        nerd-fonts.jetbrains-mono
-      ];
-
-      # theming
-      stylix = {
-        enable = true;
-        polarity = "dark";
-        image = "${inputs.assets}/wallpaper.png";
-        base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
-      };
-    };
-
-  home =
-    { inputs, ... }:
-    {
-      home.file.".assets".source = inputs.assets;
-    };
-}
--- a/features/desktop.nix
+++ b/features/desktop.nix
@@ -1,19 +1,57 @@
 {
  nixos =
-    { pkgs, inputs, ... }:
+    { config, lib, pkgs, inputs, ... }:
+    let
+      cfg = config.features.desktop;
+    in
    {
-      imports = [ inputs.stylix.nixosModules.stylix ];
+      options.features.desktop = {
+        enable = lib.mkEnableOption "desktop environment";

-      # audio
-      services.pipewire = {
-        enable = true;
-        pulse.enable = true;
+        audio.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
        };

-      # bluetooth
-      hardware.bluetooth.enable = true;
-      services.blueman.enable = true;
+        bluetooth.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };

+        apps.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+
+        theme = {
+          wallpaper = lib.mkOption {
+            type = lib.types.path;
+            default = "${inputs.assets}/wallpaper.png";
+          };
+
+          scheme = lib.mkOption {
+            type = lib.types.str;
+            default = "gruvbox-material-dark-medium";
+          };
+
+          polarity = lib.mkOption {
+            type = lib.types.enum [
+              "dark"
+              "light"
+            ];
+            default = "dark";
+          };
+        };
+
+        internalCA.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        # base desktop
+        {
          security.polkit.enable = true;
          services.dbus.enable = true;
          services.playerctld.enable = true;
@@ -21,9 +59,9 @@
          xdg.portal = {
            enable = true;
            xdgOpenUsePortal = true;
-        extraPortals = [
-          pkgs.xdg-desktop-portal-wlr
-          pkgs.xdg-desktop-portal-gtk
+            extraPortals = with pkgs; [
+              xdg-desktop-portal-wlr
+              xdg-desktop-portal-gtk
            ];
          };

@@ -32,24 +70,41 @@
            nerd-fonts.jetbrains-mono
          ];

-      # theming
          stylix = {
            enable = true;
-        polarity = "dark";
-        image = "${inputs.assets}/wallpaper.png";
-        base16Scheme = "${pkgs.base16-schemes}/share/themes/gruvbox-material-dark-medium.yaml";
+            polarity = cfg.theme.polarity;
+            image = cfg.theme.wallpaper;
+            base16Scheme = "${pkgs.base16-schemes}/share/themes/${cfg.theme.scheme}.yaml";
          };
+        }

+        # audio
+        (lib.mkIf cfg.audio.enable {
+          services.pipewire = {
+            enable = true;
+            pulse.enable = true;
+          };
+          environment.systemPackages = with pkgs; [
+            pavucontrol
+            easyeffects
+          ];
+        })
+
+        # bluetooth
+        (lib.mkIf cfg.bluetooth.enable {
+          hardware.bluetooth.enable = true;
+          services.blueman.enable = true;
+        })
+
+        # apps
+        (lib.mkIf cfg.apps.enable {
          programs.thunderbird.enable = true;
-      programs._1password.enable = true;
-      programs._1password-gui.enable = true;

          environment.systemPackages = with pkgs; [
-        easyeffects
            ghostty
            google-chrome
            zathura
-        pavucontrol
+            calibre
            bolt-launcher
            libnotify
            bibata-cursors
@@ -67,19 +122,31 @@
            ledger-live-desktop
          ];

-      # internal CA
-      security.pki.certificateFiles = [
-        inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system}.ca-matheo-si
-      ];
-
          xdg.mime.defaultApplications = {
            "application/pdf" = "org.pwmt.zathura.desktop";
          };
+
+          # kindle udev rules for calibre
+          features.udev.kindle.enable = lib.mkDefault true;
+        })
+
+        # internal CA
+        (lib.mkIf cfg.internalCA.enable {
+          security.pki.certificateFiles = [
+            inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system}.ca-matheo-si
+          ];
+        })
+      ]);
    };

  home =
-    { inputs, ... }:
+    { lib, inputs, osConfig, ... }:
+    let
+      cfg = osConfig.features.desktop;
+    in
    {
+      config = lib.mkIf cfg.enable {
        home.file.".assets".source = inputs.assets;
      };
+    };
 }
--- a/features/dev.nix
+++ b/features/dev.nix
@@ -1,15 +1,19 @@
 {
+  nixos =
+    { lib, ... }:
+    {
+      options.features.dev.enable = lib.mkEnableOption "development tools";
+    };
+
  home =
-    { pkgs, inputs, ... }:
+    { pkgs, lib, inputs, osConfig, ... }:
    let
+      cfg = osConfig.features.dev;
      packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
    in
    {
+      config = lib.mkIf cfg.enable {
        home.packages = [
-        pkgs.git
-        packages.git-linearize
-        packages.ggman
-
          pkgs.python3
          pkgs.osc

@@ -20,6 +24,6 @@
          pkgs.just
          pkgs.presenterm
        ];
-
+      };
    };
 }
--- a/features/direnv/default.nix
+++ b/features/direnv/default.nix
@@ -1,7 +1,13 @@
 {
  nixos =
-    { inputs, ... }:
+    { config, lib, inputs, ... }:
+    let
+      cfg = config.features.direnv;
+    in
    {
+      options.features.direnv.enable = lib.mkEnableOption "direnv";
+
+      config = lib.mkIf cfg.enable {
        nix.registry.dev = {
          from = {
            type = "indirect";
@@ -13,8 +19,15 @@
          };
        };
      };
+    };

-  home = _: {
+  home =
+    { lib, osConfig, ... }:
+    let
+      cfg = osConfig.features.direnv;
+    in
+    {
+      config = lib.mkIf cfg.enable {
        programs.direnv = {
          enable = true;
          nix-direnv.enable = true;
@@ -23,4 +36,5 @@

        xdg.configFile."direnv/lib/use_dev.sh".source = ./use_dev.sh;
      };
+    };
 }
--- a/features/docker.nix
+++ b/features/docker.nix
@@ -1,7 +1,13 @@
 {
  nixos =
-    { user, ... }:
+    { config, lib, user, ... }:
+    let
+      cfg = config.features.docker;
+    in
    {
+      options.features.docker.enable = lib.mkEnableOption "docker";
+
+      config = lib.mkIf cfg.enable {
        virtualisation.docker = {
          enable = true;
          logDriver = "json-file";
@@ -9,4 +15,5 @@

        users.users.${user}.extraGroups = [ "docker" ];
      };
+    };
 }
--- a/features/filedrop.nix
+++ b/features/filedrop.nix
@@ -1,9 +1,22 @@
 {
  nixos =
-    { config, userKeys, ... }:
+    { config, lib, userKeys, ... }:
+    let
+      cfg = config.features.filedrop;
+    in
    {
+      options.features.filedrop = {
+        enable = lib.mkEnableOption "filedrop sftp service";
+
+        sopsFile = lib.mkOption {
+          type = lib.types.path;
+
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
        sops.secrets.filedrop-authorized-keys = {
-        sopsFile = ../secrets/floo.yaml;
+          inherit (cfg) sopsFile;
          mode = "0444";
        };

@@ -39,4 +52,5 @@
            X11Forwarding no
        '';
      };
+    };
 }
--- a/features/gaming.nix
+++ b/features/gaming.nix
@@ -1,7 +1,13 @@
 {
  nixos =
-    { pkgs, ... }:
+    { config, lib, pkgs, ... }:
+    let
+      cfg = config.features.gaming;
+    in
    {
+      options.features.gaming.enable = lib.mkEnableOption "gaming";
+
+      config = lib.mkIf cfg.enable {
        programs.steam = {
          enable = true;
          remotePlay.openFirewall = true;
@@ -11,4 +17,5 @@

        environment.systemPackages = [ pkgs.prismlauncher ];
      };
+    };
 }
--- a/features/git.nix
+++ b/features/git.nix
@@ -0,0 +1,23 @@
+{
+  nixos =
+    { lib, ... }:
+    {
+      options.features.git.enable = lib.mkEnableOption "git";
+    };
+
+  home =
+    { pkgs, lib, inputs, osConfig, ... }:
+    let
+      cfg = osConfig.features.git;
+      packages = inputs.self.outputs.packages.${pkgs.stdenv.hostPlatform.system};
+    in
+    {
+      config = lib.mkIf cfg.enable {
+        home.packages = [
+          pkgs.git
+          packages.git-linearize
+          packages.ggman
+        ];
+      };
+    };
+}
--- a/features/gnupg.nix
+++ b/features/gnupg.nix
@@ -1,9 +1,36 @@
 {
-  nixos = _: {
+  nixos =
+    { config, lib, pkgs, ... }:
+    let
+      cfg = config.features.gnupg;
+    in
+    {
+      options.features.gnupg = {
+        enable = lib.mkEnableOption "gnupg";
+
+        yubikey.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        {
          programs.gnupg.agent = {
            enable = true;
            enableSSHSupport = true;
            enableExtraSocket = true;
          };
+        }
+
+        (lib.mkIf cfg.yubikey.enable {
+          environment.systemPackages = with pkgs; [
+            yubikey-personalization
+            yubikey-manager
+          ];
+
+          services.pcscd.enable = true;
+        })
+      ]);
    };
 }
--- a/features/greeter.nix
+++ b/features/greeter.nix
@@ -1,28 +0,0 @@
-{
-  nixos =
-    { lib, inputs, ... }:
-    {
-      programs.regreet = {
-        enable = true;
-        # single output to avoid stretching across monitors
-        cageArgs = [
-          "-s"
-          "-m"
-          "last"
-        ];
-        font = {
-          name = lib.mkForce "JetBrainsMono Nerd Font";
-          size = lib.mkForce 14;
-        };
-        settings = {
-          background = {
-            path = lib.mkForce "${inputs.assets}/wallpaper.png";
-            fit = lib.mkForce "Cover";
-          };
-          GTK = {
-            application_prefer_dark_theme = lib.mkForce true;
-          };
-        };
-      };
-    };
-}
--- a/features/harmonia/default.nix
+++ b/features/harmonia/default.nix
@@ -1,12 +1,14 @@
 {
  nixos =
    {
-      pkgs,
      config,
+      lib,
+      pkgs,
      inputs,
      ...
    }:
    let
+      cfg = config.features.harmonia;
      hosts = [
        "fw16"
        "tower"
@@ -17,6 +19,9 @@
      flakeRef = inputs.self.outPath;
    in
    {
+      options.features.harmonia.enable = lib.mkEnableOption "harmonia";
+
+      config = lib.mkIf cfg.enable {
        services.harmonia.cache = {
          enable = true;
          signKeyPaths = [ config.sops.secrets.nix-signing-key.path ];
@@ -48,4 +53,5 @@
          };
        };
      };
+    };
 }
--- a/features/initrd-ssh.nix
+++ b/features/initrd-ssh.nix
@@ -2,6 +2,7 @@
  nixos =
    { lib, config, ... }:
    let
+      cfg = config.features.initrd-ssh;
      keyDir = "/etc/secrets/initrd";

      mkIpString =
@@ -15,8 +16,9 @@
        "${address}::${gateway}:${netmask}::${interface}:none";
    in
    {
-      options = {
-        initrd-ssh = {
+      options.features.initrd-ssh = {
+        enable = lib.mkEnableOption "initrd ssh";
+
        ip = {
          enable = lib.mkEnableOption "static IP for initrd (otherwise DHCP)";

@@ -47,16 +49,17 @@
          type = lib.types.str;
        };
      };
-      };

-      config = {
-        boot.initrd.kernelModules = [ config.initrd-ssh.networkModule ];
-        boot.kernelParams = lib.mkIf config.initrd-ssh.ip.enable [
-          "ip=${mkIpString config.initrd-ssh.ip}"
+      config = lib.mkIf cfg.enable {
+        boot.initrd.availableKernelModules = [ cfg.networkModule ];
+        boot.initrd.kernelModules = [ cfg.networkModule ];
+        boot.kernelParams = lib.mkIf cfg.ip.enable [
+          "ip=${mkIpString cfg.ip}"
        ];

        boot.initrd.network = {
          enable = true;
+          udhcpc.enable = !cfg.ip.enable;
          ssh = {
            enable = true;
            port = 22;
@@ -64,7 +67,7 @@
              "${keyDir}/ssh_host_rsa_key"
              "${keyDir}/ssh_host_ed25519_key"
            ];
-            inherit (config.initrd-ssh) authorizedKeys;
+            inherit (cfg) authorizedKeys;
          };
          postCommands = ''
            echo 'cryptsetup-askpass' >> /root/.profile
--- a/features/localisation.nix
+++ b/features/localisation.nix
@@ -1,25 +1,30 @@
 {
  nixos =
    { lib, config, ... }:
+    let
+      cfg = config.features.localisation;
+    in
    {
-      options = {
-        localisation = {
+      options.features.localisation = {
+        enable = lib.mkEnableOption "localisation";
+
        timeZone = lib.mkOption {
          type = lib.types.str;
+          default = "Europe/Ljubljana";
        };

        defaultLocale = lib.mkOption {
          type = lib.types.str;
-          };
+          default = "en_US.UTF-8";
        };
      };

-      config = {
-        time.timeZone = config.localisation.timeZone;
-        i18n.defaultLocale = config.localisation.defaultLocale;
+      config = lib.mkIf cfg.enable {
+        time.timeZone = cfg.timeZone;
+        i18n.defaultLocale = cfg.defaultLocale;

        # NOTE:(@janezicmatej) some apps (e.g. java) need TZ env var explicitly
-        environment.variables.TZ = config.localisation.timeZone;
+        environment.variables.TZ = cfg.timeZone;
      };
    };
 }
--- a/features/neovim.nix
+++ b/features/neovim.nix
@@ -1,4 +1,17 @@
 {
+  nixos =
+    { lib, ... }:
+    {
+      options.features.neovim = {
+        enable = lib.mkEnableOption "neovim";
+
+        dotfiles = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+        };
+      };
+    };
+
  home =
    {
      config,
@@ -6,24 +19,21 @@
      lib,
      pkgs,
      inputs,
+      osConfig,
      ...
    }:
+    let
+      cfg = osConfig.features.neovim;
+    in
    {
-      options = {
-        neovim.dotfiles = lib.mkOption {
-          type = lib.types.nullOr lib.types.path;
-          default = null;
-        };
-      };
-
-      config = lib.mkMerge [
+      config = lib.mkIf cfg.enable (lib.mkMerge [
        (lib.optionalAttrs (options ? stylix) {
-          # disable stylix neovim target when stylix is present (loaded by desktop feature)
+          # disable stylix neovim target when stylix is present
          stylix.targets.neovim.enable = false;
        })
        {
-          xdg.configFile."nvim" = lib.mkIf (config.neovim.dotfiles != null) {
-            source = config.neovim.dotfiles;
+          xdg.configFile."nvim" = lib.mkIf (cfg.dotfiles != null) {
+            source = cfg.dotfiles;
          };

          programs.neovim = {
@@ -64,6 +74,6 @@
            ];
          };
        }
-      ];
+      ]);
    };
 }
--- a/features/networkmanager.nix
+++ b/features/networkmanager.nix
@@ -1,9 +1,18 @@
 {
-  nixos = _: {
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.networkmanager;
+    in
+    {
+      options.features.networkmanager.enable = lib.mkEnableOption "networkmanager";
+
+      config = lib.mkIf cfg.enable {
        networking.networkmanager.enable = true;
        networking.nameservers = [
          "1.1.1.1"
          "8.8.8.8"
        ];
      };
+    };
 }
--- a/features/nix-ld.nix
+++ b/features/nix-ld.nix
@@ -1,5 +1,14 @@
 {
-  nixos = _: {
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.nix-ld;
+    in
+    {
+      options.features.nix-ld.enable = lib.mkEnableOption "nix-ld";
+
+      config = lib.mkIf cfg.enable {
        programs.nix-ld.enable = true;
      };
+    };
 }
--- a/features/nix-settings.nix
+++ b/features/nix-settings.nix
@@ -0,0 +1,71 @@
+{
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.nix-settings;
+    in
+    {
+      options.features.nix-settings = {
+        enable = lib.mkEnableOption "nix settings";
+
+        towerCache.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+
+        };
+
+        gc = {
+          dates = lib.mkOption {
+            type = lib.types.str;
+            default = "monthly";
+          };
+
+          olderThan = lib.mkOption {
+            type = lib.types.str;
+            default = "30d";
+          };
+        };
+
+        optimise.dates = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ "monthly" ];
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        nix = {
+          settings = {
+            experimental-features = [
+              "nix-command"
+              "flakes"
+            ];
+            download-buffer-size = 2 * 1024 * 1024 * 1024;
+            warn-dirty = false;
+            substituters =
+              [
+                "https://cache.nixos.org"
+                "https://nix-community.cachix.org?priority=45"
+              ]
+              ++ lib.optional cfg.towerCache.enable "http://tower:5000?priority=50";
+            trusted-public-keys =
+              [
+                "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+                "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+              ]
+              ++ lib.optional cfg.towerCache.enable "matej.nix-1:TdbemLVYblvAxqJcwb3mVKmmr3cfzXbMcZHE5ILnZDE=";
+          };
+
+          gc = {
+            automatic = true;
+            dates = cfg.gc.dates;
+            options = "--delete-older-than ${cfg.gc.olderThan}";
+          };
+
+          optimise = {
+            automatic = true;
+            dates = cfg.optimise.dates;
+          };
+        };
+      };
+    };
+}
--- a/features/onepassword.nix
+++ b/features/onepassword.nix
@@ -0,0 +1,18 @@
+{
+  nixos =
+    { config, lib, user, ... }:
+    let
+      cfg = config.features.onepassword;
+    in
+    {
+      options.features.onepassword.enable = lib.mkEnableOption "1password";
+
+      config = lib.mkIf cfg.enable {
+        programs._1password.enable = true;
+        programs._1password-gui = {
+          enable = true;
+          polkitPolicyOwners = [ user ];
+        };
+      };
+    };
+}
--- a/features/openssh.nix
+++ b/features/openssh.nix
@@ -1,18 +1,23 @@
 {
  nixos =
    { lib, config, ... }:
+    let
+      cfg = config.features.openssh;
+    in
    {
-      options = {
-        openssh.port = lib.mkOption {
+      options.features.openssh = {
+        enable = lib.mkEnableOption "openssh";
+
+        port = lib.mkOption {
          type = lib.types.port;
          default = 22;
        };
      };

-      config = {
+      config = lib.mkIf cfg.enable {
        services.openssh = {
          enable = true;
-          ports = [ config.openssh.port ];
+          ports = [ cfg.port ];
          settings = {
            PasswordAuthentication = false;
            AllowUsers = null;
--- a/features/power.nix
+++ b/features/power.nix
@@ -0,0 +1,57 @@
+{
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.power;
+    in
+    {
+      options.features.power = {
+        enable = lib.mkEnableOption "laptop power management";
+
+        resumeDevice = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+
+        lidSwitch = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        powerKey = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        idleAction = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        idleActionSec = lib.mkOption {
+          type = lib.types.str;
+          default = "15min";
+        };
+
+        hibernateDelaySec = lib.mkOption {
+          type = lib.types.str;
+          default = "30min";
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        boot.resumeDevice = lib.mkIf (cfg.resumeDevice != null) cfg.resumeDevice;
+
+        services.logind.settings.Login = {
+          HandleLidSwitch = cfg.lidSwitch;
+          HandlePowerKey = cfg.powerKey;
+          IdleAction = cfg.idleAction;
+          IdleActionSec = cfg.idleActionSec;
+        };
+
+        systemd.sleep.settings.Sleep = {
+          HibernateDelaySec = cfg.hibernateDelaySec;
+        };
+      };
+    };
+}
--- a/features/printing.nix
+++ b/features/printing.nix
@@ -1,5 +1,13 @@
 {
-  nixos = _: {
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.printing;
+    in
+    {
+      options.features.printing.enable = lib.mkEnableOption "printing";
+
+      config = lib.mkIf cfg.enable {
        services.printing.enable = true;
        services.avahi = {
          enable = true;
@@ -7,4 +15,5 @@
          openFirewall = true;
        };
      };
+    };
 }
--- a/features/remote-base.nix
+++ b/features/remote-base.nix
@@ -1,7 +1,13 @@
 {
  nixos =
-    { config, user, ... }:
+    { config, lib, user, ... }:
+    let
+      cfg = config.features.remote-base;
+    in
    {
+      options.features.remote-base.enable = lib.mkEnableOption "remote-base";
+
+      config = lib.mkIf cfg.enable {
        sops.secrets.user-password = {
          sopsFile = ../secrets/common.yaml;
          neededForUsers = true;
@@ -10,4 +16,5 @@
        users.mutableUsers = false;
        users.users.${user}.hashedPasswordFile = config.sops.secrets.user-password.path;
      };
+    };
 }
--- a/features/shell-minimal.nix
+++ b/features/shell-minimal.nix
@@ -1,16 +0,0 @@
-{
-  nixos = _: {
-    programs.zsh.enable = true;
-    environment.etc."zshenv".text = ''
-      export ZDOTDIR=$HOME/.config/zsh
-    '';
-  };
-
-  home =
-    { pkgs, ... }:
-    {
-      home.packages = with pkgs; [
-        starship
-      ];
-    };
-}
--- a/features/shell.nix
+++ b/features/shell.nix
@@ -1,16 +1,18 @@
 {
-  nixos = _: {
-    programs.zsh.enable = true;
-    environment.etc."zshenv".text = ''
-      export ZDOTDIR=$HOME/.config/zsh
-    '';
+  nixos =
+    { lib, ... }:
+    {
+      options.features.shell.enable = lib.mkEnableOption "shell extras";
    };

  home =
-    { pkgs, ... }:
+    { pkgs, lib, osConfig, ... }:
+    let
+      cfg = osConfig.features.shell;
+    in
    {
+      config = lib.mkIf cfg.enable {
        home.packages = with pkgs; [
-        starship
          fzf
          htop
          jc
@@ -22,4 +24,5 @@
          tmux
        ];
      };
+    };
 }
--- a/features/sway.nix
+++ b/features/sway.nix
@@ -1,7 +1,33 @@
 {
  nixos =
-    { pkgs, ... }:
+    { config, lib, pkgs, ... }:
+    let
+      cfg = config.features.sway;
+      desktopCfg = config.features.desktop;
+    in
    {
+      options.features.sway = {
+        enable = lib.mkEnableOption "sway window manager";
+
+        greeter.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        {
+          # soft dependency
+          features.desktop.enable = lib.mkDefault true;
+
+          # hard dependency
+          assertions = [
+            {
+              assertion = desktopCfg.enable;
+              message = "features.sway requires features.desktop";
+            }
+          ];
+
          programs.sway = {
            enable = true;
            package = pkgs.swayfx;
@@ -34,5 +60,32 @@
            cliphist
            zenity
          ];
+        }
+
+        # greeter
+        (lib.mkIf cfg.greeter.enable {
+          programs.regreet = {
+            enable = true;
+            cageArgs = [
+              "-s"
+              "-m"
+              "last"
+            ];
+            font = {
+              name = lib.mkForce "JetBrainsMono Nerd Font";
+              size = lib.mkForce 14;
+            };
+            settings = {
+              background = {
+                path = lib.mkForce (toString desktopCfg.theme.wallpaper);
+                fit = lib.mkForce "Cover";
+              };
+              GTK = {
+                application_prefer_dark_theme = lib.mkForce true;
+              };
+            };
+          };
+        })
+      ]);
    };
 }
--- a/features/tailscale.nix
+++ b/features/tailscale.nix
@@ -1,8 +1,17 @@
 {
-  nixos = _: {
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.tailscale;
+    in
+    {
+      options.features.tailscale.enable = lib.mkEnableOption "tailscale";
+
+      config = lib.mkIf cfg.enable {
        services.tailscale = {
          enable = true;
          useRoutingFeatures = "both";
        };
      };
+    };
 }
--- a/features/udev.nix
+++ b/features/udev.nix
@@ -0,0 +1,52 @@
+{
+  nixos =
+    { config, lib, pkgs, ... }:
+    let
+      cfg = config.features.udev;
+    in
+    {
+      options.features.udev = {
+        enable = lib.mkEnableOption "custom udev rules";
+
+        kindle.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+
+        ledger.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+
+        keyboard-zsa.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        (lib.mkIf cfg.kindle.enable {
+          # NOTE:(@janezicmatej) uses services.udev.packages instead of extraRules
+          # because extraRules writes to 99-local.rules which is too late for uaccess
+          services.udev.packages = [
+            pkgs.libmtp
+            (pkgs.writeTextFile {
+              name = "kindle-udev-rules";
+              text = ''
+                ACTION!="remove", SUBSYSTEM=="usb", ATTRS{idVendor}=="1949", TAG+="uaccess"
+              '';
+              destination = "/etc/udev/rules.d/70-kindle.rules";
+            })
+          ];
+        })
+
+        (lib.mkIf cfg.ledger.enable {
+          hardware.ledger.enable = true;
+        })
+
+        (lib.mkIf cfg.keyboard-zsa.enable {
+          hardware.keyboard.zsa.enable = true;
+        })
+      ]);
+    };
+}
--- a/features/user-matej.nix
+++ b/features/user-matej.nix
@@ -10,15 +10,12 @@ in
  };

  nixos =
-    { pkgs, ... }:
+    { ... }:
    {
-      programs.zsh.enable = true;
-
      users.users.matej = {
        uid = 1000;
        isNormalUser = true;
        home = "/home/matej";
-        shell = pkgs.zsh;
        extraGroups = [ "wheel" ];
        openssh.authorizedKeys.keys = sshKeys;
      };
--- a/features/vm-9p-automount.nix
+++ b/features/vm-9p-automount.nix
@@ -1,72 +0,0 @@
-{
-  nixos =
-    {
-      pkgs,
-      lib,
-      config,
-      ...
-    }:
-    let
-      inherit (config.vm-9p-automount) user;
-      inherit (config.users.users.${user}) home group;
-    in
-    {
-      options = {
-        vm-9p-automount = {
-          user = lib.mkOption {
-            type = lib.types.str;
-          };
-
-          prefix = lib.mkOption {
-            type = lib.types.str;
-            default = "m_";
-          };
-
-          basePath = lib.mkOption {
-            type = lib.types.str;
-            default = "${home}/mnt";
-          };
-        };
-      };
-
-      config = {
-        systemd.services.vm-9p-automount = {
-          description = "Auto-discover and mount 9p shares";
-          after = [
-            "local-fs.target"
-            "nss-user-lookup.target"
-            "systemd-modules-load.service"
-          ];
-          wants = [ "systemd-modules-load.service" ];
-          wantedBy = [ "multi-user.target" ];
-          serviceConfig = {
-            Type = "oneshot";
-            RemainAfterExit = true;
-            ExecStart = pkgs.writeShellScript "vm-9p-automount" ''
-              BASE="${config.vm-9p-automount.basePath}"
-              PREFIX="${config.vm-9p-automount.prefix}"
-              mkdir -p "$BASE"
-              chown ${user}:${group} "$BASE"
-
-              for tagfile in $(find /sys/devices -name mount_tag 2>/dev/null); do
-                [ -f "$tagfile" ] || continue
-                tag=$(tr -d '\0' < "$tagfile")
-
-                case "$tag" in
-                  "$PREFIX"*) ;;
-                  *) continue ;;
-                esac
-
-                name="''${tag#"$PREFIX"}"
-                target="$BASE/$name"
-
-                mkdir -p "$target"
-                ${pkgs.util-linux}/bin/mount -t 9p "$tag" "$target" \
-                  -o trans=virtio,version=9p2000.L || continue
-              done
-            '';
-          };
-        };
-      };
-    };
-}
--- a/features/vm-guest.nix
+++ b/features/vm-guest.nix
@@ -6,19 +6,46 @@
      config,
      ...
    }:
+    let
+      cfg = config.features.vm-guest;
+      autoUser = cfg.automount.user;
+      autoHome = config.users.users.${autoUser}.home;
+      autoGroup = config.users.users.${autoUser}.group;
+    in
    {
-      options = {
-        vm-guest.headless = lib.mkOption {
+      options.features.vm-guest = {
+        enable = lib.mkEnableOption "qemu vm guest";
+
+        headless = lib.mkOption {
          type = lib.types.bool;
          default = false;
        };
+
+        automount = {
+          enable = lib.mkEnableOption "9p share automount";
+
+          user = lib.mkOption {
+            type = lib.types.str;
          };

-      config = {
-        services.qemuGuest.enable = true;
-        services.spice-vdagentd.enable = lib.mkIf (!config.vm-guest.headless) true;
+          prefix = lib.mkOption {
+            type = lib.types.str;
+            default = "m_";
+          };

-        boot.kernelParams = lib.mkIf config.vm-guest.headless [ "console=ttyS0,115200" ];
+          basePath = lib.mkOption {
+            type = lib.types.str;
+            default = "${autoHome}/mnt";
+          };
+        };
+      };
+
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        {
+          services.qemuGuest.enable = true;
+          services.spice-vdagentd.enable = lib.mkIf (!cfg.headless) true;
+
+          boot.kernelParams = lib.mkIf cfg.headless [ "console=ttyS0,115200" ];

          boot.initrd.availableKernelModules = [
            "9p"
@@ -42,6 +69,47 @@
            htop
            sshfs
          ];
+        }
+
+        (lib.mkIf cfg.automount.enable {
+          systemd.services.vm-9p-automount = {
+            description = "Auto-discover and mount 9p shares";
+            after = [
+              "local-fs.target"
+              "nss-user-lookup.target"
+              "systemd-modules-load.service"
+            ];
+            wants = [ "systemd-modules-load.service" ];
+            wantedBy = [ "multi-user.target" ];
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+              ExecStart = pkgs.writeShellScript "vm-9p-automount" ''
+                BASE="${cfg.automount.basePath}"
+                PREFIX="${cfg.automount.prefix}"
+                mkdir -p "$BASE"
+                chown ${autoUser}:${autoGroup} "$BASE"
+
+                for tagfile in $(find /sys/devices -name mount_tag 2>/dev/null); do
+                  [ -f "$tagfile" ] || continue
+                  tag=$(tr -d '\0' < "$tagfile")
+
+                  case "$tag" in
+                    "$PREFIX"*) ;;
+                    *) continue ;;
+                  esac
+
+                  name="''${tag#"$PREFIX"}"
+                  target="$BASE/$name"
+
+                  mkdir -p "$target"
+                  ${pkgs.util-linux}/bin/mount -t 9p "$tag" "$target" \
+                    -o trans=virtio,version=9p2000.L || continue
+                done
+              '';
            };
          };
+        })
+      ]);
+    };
 }
--- a/features/yubikey.nix
+++ b/features/yubikey.nix
@@ -1,12 +0,0 @@
-{
-  nixos =
-    { pkgs, ... }:
-    {
-      environment.systemPackages = with pkgs; [
-        yubikey-personalization
-        yubikey-manager
-      ];
-
-      services.pcscd.enable = true;
-    };
-}
--- a/features/zsh.nix
+++ b/features/zsh.nix
@@ -0,0 +1,42 @@
+{
+  nixos =
+    { config, lib, pkgs, user, ... }:
+    let
+      cfg = config.features.zsh;
+    in
+    {
+      options.features.zsh = {
+        enable = lib.mkEnableOption "zsh";
+
+        loginShell.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+
+        };
+      };
+
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        {
+          programs.zsh.enable = true;
+          environment.etc."zshenv".text = ''
+            export ZDOTDIR=$HOME/.config/zsh
+          '';
+        }
+
+        (lib.mkIf cfg.loginShell.enable {
+          users.users.${user}.shell = pkgs.zsh;
+        })
+      ]);
+    };
+
+  home =
+    { pkgs, lib, osConfig, ... }:
+    let
+      cfg = osConfig.features.zsh;
+    in
+    {
+      config = lib.mkIf cfg.enable {
+        home.packages = [ pkgs.starship ];
+      };
+    };
+}
--- a/flake.lock
+++ b/flake.lock
@@ -273,11 +273,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775556024,
-        "narHash": "sha256-j1u/859OVS54rGlsvFqJdwKPEnFYCI+4pyfTiSfv1Xc=",
+        "lastModified": 1776030105,
+        "narHash": "sha256-b4cNpWPDSH+/CTTiw8++yGh1UYG2kQNrbIehV2iGoeo=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "4bdfeff1d9b7473e6e58f73f5809576e8a69e406",
+        "rev": "49088dc2e7a876e338e510c5f5f60f659819c650",
        "type": "github"
      },
      "original": {
@@ -317,11 +317,11 @@
        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1775520277,
-        "narHash": "sha256-dUI8/Mc6CfA+EmfrYByt+oNIEvdRLtSSDVS54O0YpBM=",
+        "lastModified": 1775952282,
+        "narHash": "sha256-iJcGy0pW0wX7q6HAQuKx8sskTyu8an0l0gI3TBgzk3E=",
        "owner": "nix-community",
        "repo": "neovim-nightly-overlay",
-        "rev": "b63186e453b0ad340760648293aa1ccf75528c46",
+        "rev": "f719e136a8e0cd91e70515e590385356abce1341",
        "type": "github"
      },
      "original": {
@@ -333,11 +333,11 @@
    "neovim-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1775514165,
-        "narHash": "sha256-mAUtXA5BfCH5SRInzfJdaHY9egHrVLED0DsQzgBW4Fk=",
+        "lastModified": 1775949028,
+        "narHash": "sha256-JXrr9lxKfTIm/VW4jvaB1RU9r+7pAoaXeDsy24TGPiw=",
        "owner": "neovim",
        "repo": "neovim",
-        "rev": "b36eafd5dafae561763e5dc2ba73b3f0b74c63fe",
+        "rev": "4a289bfce3e71bf00d1eced168a6a7bbb270b95b",
        "type": "github"
      },
      "original": {
@@ -364,11 +364,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1775464765,
-        "narHash": "sha256-nex6TL2x1/sVHCyDWcvl1t/dbTedb9bAGC4DLf/pmYk=",
+        "lastModified": 1775888245,
+        "narHash": "sha256-nwASzrRDD1JBEu/o8ekKYEXm/oJW6EMCzCRdrwcLe90=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "83e29f2b8791f6dec20804382fcd9a666d744c07",
+        "rev": "13043924aaa7375ce482ebe2494338e058282925",
        "type": "github"
      },
      "original": {
@@ -395,11 +395,11 @@
    },
    "nixpkgs-master": {
      "locked": {
-        "lastModified": 1775560693,
-        "narHash": "sha256-V1y4hd0R0XYG5GMpdj0W9h6976r6kZV5vcmKysclmfE=",
+        "lastModified": 1776031281,
+        "narHash": "sha256-MCXhNHfTvsvbdkn9WV3Rv5Z0tUig1CtINZV+jaWh04k=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "987687fd632e29817fc9c9d96eddba7d264510c0",
+        "rev": "4ee46f65286df51761a238bb0f024f8d696ac683",
        "type": "github"
      },
      "original": {
@@ -411,11 +411,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1775305101,
-        "narHash": "sha256-/74n1oQPtKG52Yw41cbToxspxHbYz6O3vi+XEw16Qe8=",
+        "lastModified": 1775811116,
+        "narHash": "sha256-t+HZK42pB6N+i5RGbuy7Xluez/VvWbembBdvzsc23Ss=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "36a601196c4ebf49e035270e10b2d103fe39076b",
+        "rev": "54170c54449ea4d6725efd30d719c5e505f1c10e",
        "type": "github"
      },
      "original": {
@@ -427,11 +427,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1775423009,
-        "narHash": "sha256-vPKLpjhIVWdDrfiUM8atW6YkIggCEKdSAlJPzzhkQlw=",
+        "lastModified": 1775710090,
+        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "68d8aa3d661f0e6bd5862291b5bb263b2a6595c9",
+        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
        "type": "github"
      },
      "original": {
@@ -550,11 +550,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775365543,
-        "narHash": "sha256-f50qrK0WwZ9z5EdaMGWOTtALgSF7yb7XwuE7LjCuDmw=",
+        "lastModified": 1775971308,
+        "narHash": "sha256-VKp9bhVSm0bT6JWctFy06ocqxGGnWHi1NfoE90IgIcY=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "a4ee2de76efb759fe8d4868c33dec9937897916f",
+        "rev": "31ac5fe5d015f76b54058c69fcaebb66a55871a4",
        "type": "github"
      },
      "original": {
@@ -583,11 +583,11 @@
        "tinted-zed": "tinted-zed"
      },
      "locked": {
-        "lastModified": 1775429060,
-        "narHash": "sha256-wbFF5cRxQOCzL/wHOKYm21t5AHPH2Lfp0mVPCOAvEoc=",
+        "lastModified": 1775936757,
+        "narHash": "sha256-KJO/7qoxJ+hlsb3WlFSl6IGrExBIf1GvKdrhOlnGdKY=",
        "owner": "danth",
        "repo": "stylix",
-        "rev": "d27951a6539951d87f75cf0a7cda8a3a24016019",
+        "rev": "d3e447786b74d62c75f665e17cb3e681c66e90c7",
        "type": "github"
      },
      "original": {
--- a/flake/hosts.nix
+++ b/flake/hosts.nix
@@ -15,25 +15,29 @@ in
      system = "x86_64-linux";
      user = "matej";
      features = [
-        "openssh"
-        "localisation"
-        "gnupg"
-        "shell"
-        "desktop"
-        "sway"
-        "greeter"
-        "printing"
-        "networkmanager"
-        "docker"
-        "tailscale"
-        "nix-ld"
-        "yubikey"
-        "calibre"
-        "gaming"
-        "direnv"
-        "neovim"
-        "dev"
+        "bootloader"
        "claude"
+        "desktop"
+        "dev"
+        "direnv"
+        "docker"
+        "gaming"
+        "git"
+        "gnupg"
+        "localisation"
+        "neovim"
+        "networkmanager"
+        "nix-ld"
+        "nix-settings"
+        "onepassword"
+        "openssh"
+        "power"
+        "printing"
+        "shell"
+        "sway"
+        "tailscale"
+        "udev"
+        "zsh"
      ];
    };

@@ -41,27 +45,30 @@ in
      system = "x86_64-linux";
      user = "matej";
      features = [
-        "openssh"
-        "localisation"
-        "gnupg"
-        "shell"
-        "desktop"
-        "sway"
-        "greeter"
-        "printing"
-        "networkmanager"
-        "docker"
-        "tailscale"
-        "nix-ld"
-        "yubikey"
-        "calibre"
-        "gaming"
-        "initrd-ssh"
-        "direnv"
-        "neovim"
-        "dev"
+        "bootloader"
        "claude"
+        "desktop"
+        "dev"
+        "direnv"
+        "docker"
+        "gaming"
+        "git"
+        "gnupg"
        "harmonia"
+        "initrd-ssh"
+        "localisation"
+        "neovim"
+        "networkmanager"
+        "nix-ld"
+        "nix-settings"
+        "onepassword"
+        "openssh"
+        "printing"
+        "shell"
+        "sway"
+        "tailscale"
+        "udev"
+        "zsh"
      ];
    };

@@ -70,7 +77,9 @@ in
      system = "x86_64-linux";
      user = "matej";
      features = [
+        "nix-settings"
        "openssh"
+        "zsh"
      ];
    };

@@ -78,11 +87,14 @@ in
      system = "x86_64-linux";
      user = "matej";
      features = [
-        "openssh"
+        "bootloader"
        "localisation"
+        "nix-settings"
+        "openssh"
+        "remote-base"
        "shell"
        "tailscale"
-        "remote-base"
+        "zsh"
      ];
    };

@@ -91,12 +103,14 @@ in
      system = "x86_64-linux";
      user = "matej";
      features = [
-        "openssh"
+        "filedrop"
        "localisation"
+        "nix-settings"
+        "openssh"
+        "remote-base"
        "shell"
        "tailscale"
-        "remote-base"
-        "filedrop"
+        "zsh"
      ];
    };

@@ -104,14 +118,15 @@ in
      system = "x86_64-linux";
      user = "matej";
      features = [
-        "localisation"
+        "bootloader"
+        "desktop"
        "gnupg"
-        "shell-minimal"
-        "desktop-minimal"
-        "sway"
-        "greeter"
+        "localisation"
        "networkmanager"
-        "yubikey"
+        "nix-settings"
+        "sway"
+        "udev"
+        "zsh"
      ];
    };

@@ -119,16 +134,18 @@ in
      system = "x86_64-linux";
      user = "matej";
      features = [
-        "openssh"
-        "localisation"
-        "gnupg"
-        "shell"
-        "vm-guest"
-        "vm-9p-automount"
-        "docker"
-        "neovim"
        "claude"
        "dev"
+        "docker"
+        "git"
+        "gnupg"
+        "localisation"
+        "neovim"
+        "nix-settings"
+        "openssh"
+        "shell"
+        "vm-guest"
+        "zsh"
      ];
    };
  };
--- a/hosts/cube/configuration.nix
+++ b/hosts/cube/configuration.nix
@@ -2,9 +2,6 @@
 {
  imports = [ inputs.disko.nixosModules.disko ];

-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
  disko.devices.disk.main = {
    type = "disk";
    device = "/dev/nvme0n1";
@@ -32,10 +29,5 @@
    };
  };

-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
-  };
-
  system.stateVersion = "25.11";
 }
--- a/hosts/ephvm/configuration.nix
+++ b/hosts/ephvm/configuration.nix
@@ -5,6 +5,7 @@
  ...
 }:
 {
+  features.nix-settings.towerCache.enable = false;
  # no hardware firmware needed in a VM
  hardware.enableRedistributableFirmware = lib.mkForce false;
  hardware.wirelessRegulatoryDatabase = lib.mkForce false;
@@ -28,18 +29,12 @@
      );
    };

-  vm-guest.headless = true;
-
-  vm-9p-automount.user = "matej";
-
-  localisation = {
-    timeZone = "UTC";
-    defaultLocale = "en_US.UTF-8";
-  };
-
-  home-manager.users.matej = {
-    neovim.dotfiles = inputs.nvim;
+  features.vm-guest.headless = true;
+  features.vm-guest.automount = {
+    enable = true;
+    user = "matej";
  };
+  features.neovim.dotfiles = inputs.nvim;

  # ensure .config exists with correct ownership before automount
  systemd.tmpfiles.rules = [ "d /home/matej/.config 0755 matej users -" ];
--- a/hosts/floo/configuration.nix
+++ b/hosts/floo/configuration.nix
@@ -2,6 +2,8 @@
 {
  imports = [ inputs.disko.nixosModules.disko ];

+  features.filedrop.sopsFile = ../../secrets/floo.yaml;
+
  boot.loader.grub.enable = true;

  disko.devices.disk.main = {
@@ -26,10 +28,5 @@
    };
  };

-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
-  };
-
  system.stateVersion = "25.11";
 }
--- a/hosts/fortress/configuration.nix
+++ b/hosts/fortress/configuration.nix
@@ -10,13 +10,11 @@
    inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
  ];

-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
+  features.desktop = {
+    apps.enable = false;
+    internalCA.enable = false;
  };
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
+  features.gnupg.yubikey.enable = true;

  disko.devices.disk.main = {
    type = "disk";
--- a/hosts/fw16/configuration.nix
+++ b/hosts/fw16/configuration.nix
@@ -1,8 +1,7 @@
 {
  lib,
-  pkgs,
-  inputs,
  options,
+  inputs,
  ...
 }:

@@ -11,37 +10,22 @@
    inputs.nixos-hardware.nixosModules.framework-16-amd-ai-300-series
  ];

-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
+  features.desktop.bluetooth.enable = true;
+  features.gnupg.yubikey.enable = true;
+  features.udev = {
+    ledger.enable = true;
+    keyboard-zsa.enable = true;
  };
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
+  features.power.resumeDevice = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540";

  boot.kernelParams = [ "pcie_aspm.policy=powersupersave" ];

-  boot.resumeDevice = "/dev/disk/by-uuid/ff4750e7-3a9f-42c2-bb68-c458a6560540";
-
-  services.logind.settings.Login = {
-    HandleLidSwitch = "suspend-then-hibernate";
-    HandlePowerKey = "suspend-then-hibernate";
-    IdleAction = "suspend-then-hibernate";
-    IdleActionSec = "15min";
-  };
-
-  systemd.sleep.settings.Sleep = {
-    HibernateDelaySec = "30min";
-  };
-
  programs.nix-ld.libraries = options.programs.nix-ld.libraries.default;

  services.gnome.gnome-keyring.enable = true;
  services.teamviewer.enable = true;

  services.hardware.bolt.enable = true;
-  hardware.keyboard.zsa.enable = true;
-  hardware.ledger.enable = true;
  hardware.bluetooth.powerOnBoot = true;
  hardware.inputmodule.enable = true;

--- a/hosts/iso/configuration.nix
+++ b/hosts/iso/configuration.nix
@@ -1,15 +1,13 @@
-{ lib, ... }:
+{ lib, userKeys, ... }:
 {
+  features.nix-settings.towerCache.enable = false;
  image.modules.iso-installer = {
    isoImage.squashfsCompression = "zstd -Xcompression-level 6";
  };

  # live iso: passwordless login and sudo
  users.users.matej.initialHashedPassword = "";
-  users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQGLdINKzs+sEy62Pefng0bcedgU396+OryFgeH99/c janezicmatej"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDk00+Km03epQXQs+xEwwH3zcurACzkEH+kDOPBw6RQe openpgp:0xB095D449"
-  ];
+  users.users.root.openssh.authorizedKeys.keys = userKeys.sshAuthorizedKeys;
  services.openssh.settings.PermitRootLogin = lib.mkForce "prohibit-password";
  security.sudo.wheelNeedsPassword = false;

--- a/hosts/tower/configuration.nix
+++ b/hosts/tower/configuration.nix
@@ -1,38 +1,28 @@
 {
  config,
-  lib,
-  inputs,
  userKeys,
  ...
 }:

 {
-  imports = [
-    inputs.lanzaboote.nixosModules.lanzaboote
-  ];
+  features.nix-settings.towerCache.enable = false;
+  features.bootloader.mode = "lanzaboote";
+  features.desktop.bluetooth.enable = true;
+  features.gnupg.yubikey.enable = true;
+  features.udev = {
+    ledger.enable = true;
+    keyboard-zsa.enable = true;
+  };
+  features.initrd-ssh = {
+    networkModule = "r8169";
+    authorizedKeys = userKeys.sshAuthorizedKeys;
+  };

  # nix store signing
  sops.secrets.nix-signing-key.sopsFile = ../../secrets/tower.yaml;
  nix.settings.secret-key-files = [ config.sops.secrets.nix-signing-key.path ];

-  localisation = {
-    timeZone = "Europe/Ljubljana";
-    defaultLocale = "en_US.UTF-8";
-  };
-
-  initrd-ssh = {
-    networkModule = "r8169";
-    authorizedKeys = userKeys.sshAuthorizedKeys;
-  };
-
-  # lanzaboote secure boot
  boot.kernelParams = [ "btusb.reset=1" ];
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.loader.systemd-boot.enable = lib.mkForce false;
-  boot.lanzaboote = {
-    enable = true;
-    pkiBundle = "/var/lib/sbctl";
-  };

  services.udisks2.enable = true;

--- a/lib/mkHost.nix
+++ b/lib/mkHost.nix
@@ -27,7 +27,19 @@ let
  hostConfig = ../hosts/${name}/configuration.nix;
  hostHWConfig = ../hosts/${name}/hardware-configuration.nix;

-  # load feature with path check
+  # auto-discover all features, excluding user-* and default.nix
+  featureDir = builtins.readDir ../features;
+  allFeatureNames = lib.pipe featureDir [
+    (lib.filterAttrs (
+      n: t:
+      (t == "regular" && lib.hasSuffix ".nix" n && n != "default.nix" && !lib.hasPrefix "user-" n)
+      || (t == "directory" && builtins.pathExists ../features/${n}/default.nix)
+    ))
+    builtins.attrNames
+    (map (n: lib.removeSuffix ".nix" n))
+  ];
+
+  # load all features unconditionally
  loadFeature =
    f:
    assert
@@ -35,7 +47,7 @@ let
      || throw "feature '${f}' not found at ${toString (featurePath f)}";
    import (featurePath f);

-  loadedFeatures = map loadFeature features;
+  loadedFeatures = map loadFeature allFeatureNames;

  # load user feature with path check
  userFeature =
@@ -55,17 +67,28 @@ let
  # collect nixos and home modules from all features
  nixosMods = map (f: f.nixos) (builtins.filter (f: f ? nixos) allFeatures);
  homeMods = map (f: f.home) (builtins.filter (f: f ? home) allFeatures);
+
+  # translate features list to enable flags
+  featureEnableModule =
+    { lib, ... }:
+    {
+      config.features = lib.genAttrs features (_: {
+        enable = true;
+      });
+    };
 in
 nixpkgs.lib.nixosSystem {
  inherit system;
-  modules = [
-    ../nix.nix
+  modules =
+    [
      inputs.sops-nix.nixosModules.sops
+      inputs.stylix.nixosModules.stylix

      { nixpkgs.overlays = overlays; }
      { nixpkgs.config.allowUnfree = true; }
      { networking.hostName = name; }

+      featureEnableModule
      hostConfig
    ]
    ++ lib.optional (builtins.pathExists hostHWConfig) hostHWConfig
Author	SHA1	Message	Date
Matej Janežič	2e5eb92e32	chore: bump lockfile	2026-04-13 00:22:51 +02:00
Matej Janežič	f30b03cc04	fix: enable dhcp in initrd if no static ip	2026-04-13 00:20:36 +02:00
Matej Janežič	c7fb218511	merge: feature improvements	2026-04-12 23:33:33 +02:00
Matej Janežič	3caace87d3	refactor: update hosts and feature lists for new architecture	2026-04-12 23:33:14 +02:00
Matej Janežič	8793f97a04	feat: add udev, onepassword, bootloader, power features	2026-04-12 23:33:07 +02:00
Matej Janežič	b8509196d5	feat: merge greeter into sway, yubikey into gnupg, automount into vm-guest	2026-04-12 23:33:01 +02:00
Matej Janežič	e1d136bd2f	feat: merge desktop + desktop-minimal + calibre with sub-options	2026-04-12 23:32:55 +02:00
Matej Janežič	898751576d	feat: add zsh + git features, redesign shell	2026-04-12 23:32:47 +02:00
Matej Janežič	6770bc76a2	refactor: mkHost load-all infrastructure and convert simple features	2026-04-12 23:32:28 +02:00