WIP: flake: home-manager: export NixOS homes

WIP: this does not take into account the `profiles` which *also* setup
home-manager modules...

And here is what the last few commits were building up to.

This is neat, but won't be useful *very* often.

flake.lock

@@ -8,14 +8,17 @@
         ],
         "nixpkgs": [
           "nixpkgs"
+        ],
+        "systems": [
+          "systems"
         ]
       },
       "locked": {
-        "lastModified": 1701216516,
-        "narHash": "sha256-jKSeJn+7hZ1dZdiH1L+NWUGT2i/BGomKAJ54B9kT06Q=",
+        "lastModified": 1703433843,
+        "narHash": "sha256-nmtA4KqFboWxxoOAA6Y1okHbZh+HsXaMPFkYHsoDRDw=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "13ac9ac6d68b9a0896e3d43a082947233189e247",
+        "rev": "417caa847f9383e111d1397039c9d4337d024bf0",
         "type": "github"
       },
       "original": {
@@ -33,11 +36,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1673295039,
-        "narHash": "sha256-AsdYgE8/GPwcelGgrntlijMg4t3hLFJFCRF3tL5WVjA=",
+        "lastModified": 1700795494,
+        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "87b9d090ad39b25b2400029c64825fc2a8868943",
+        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
         "type": "github"
       },
       "original": {
@@ -70,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1701473968,
-        "narHash": "sha256-YcVE5emp1qQ8ieHUnxt1wCZCC3ZfAS+SRRWZ2TMda7E=",
+        "lastModified": 1704152458,
+        "narHash": "sha256-DS+dGw7SKygIWf9w4eNBUZsK+4Ug27NwEWmn2tnbycg=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "34fed993f1674c8d06d58b37ce1e0fe5eebcb9f5",
+        "rev": "88a2cd8166694ba0b6cb374700799cec53aef527",
         "type": "github"
       },
       "original": {
@@ -86,7 +89,9 @@
     },
     "futils": {
       "inputs": {
-        "systems": "systems"
+        "systems": [
+          "systems"
+        ]
       },
       "locked": {
         "lastModified": 1701680307,
@@ -131,11 +136,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1702538064,
-        "narHash": "sha256-At5GwJPu2tzvS9dllhBoZmqK6lkkh/sOp2YefWRlaL8=",
+        "lastModified": 1704276313,
+        "narHash": "sha256-4eD4RaAKHLj0ztw5pQcNFs3hGpxrsYb0e9Qir+Ute+w=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0e2e443ff24f9d75925e91b89d1da44b863734af",
+        "rev": "4d8f90205c6c90be2e81d94d0e5eedf71c1ba34e",
         "type": "github"
       },
       "original": {
@@ -147,11 +152,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1702312524,
-        "narHash": "sha256-gkZJRDBUCpTPBvQk25G0B7vfbpEYM5s5OZqghkjZsnE=",
+        "lastModified": 1703961334,
+        "narHash": "sha256-M1mV/Cq+pgjk0rt6VxoyyD+O8cOUiai8t9Q6Yyq4noY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a9bf124c46ef298113270b1f84a164865987a91c",
+        "rev": "b0d36bd0a420ecee3bc916c91886caca87c894e9",
         "type": "github"
       },
       "original": {
@@ -163,11 +168,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1702558663,
-        "narHash": "sha256-MHq/DdwsBwsTRqwFg1JuFtcoGArgvaH/XwbxgWQ4Zn0=",
+        "lastModified": 1704289500,
+        "narHash": "sha256-SMoojjdEMgf6GtPh5vzofdeev4nyM+vBi2J6Z/Sufco=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "b839a2bae27c0c14dd99dcc1f6d18f83b0af59bd",
+        "rev": "a18213c74e43dd6e941c41d77382377938c77caf",
         "type": "github"
       },
       "original": {
@@ -192,11 +197,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1702456155,
-        "narHash": "sha256-I2XhXGAecdGlqi6hPWYT83AQtMgL+aa3ulA85RAEgOk=",
+        "lastModified": 1703939133,
+        "narHash": "sha256-Gxe+mfOT6bL7wLC/tuT2F+V+Sb44jNr8YsJ3cyIl4Mo=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "007a45d064c1c32d04e1b8a0de5ef00984c419bc",
+        "rev": "9d3d7e18c6bc4473d7520200d4ddab12f8402d38",
         "type": "github"
       },
       "original": {
@@ -214,7 +219,8 @@
         "home-manager": "home-manager",
         "nixpkgs": "nixpkgs",
         "nur": "nur",
-        "pre-commit-hooks": "pre-commit-hooks"
+        "pre-commit-hooks": "pre-commit-hooks",
+        "systems": "systems"
       }
     },
     "systems": {
@@ -228,6 +234,7 @@
       },
       "original": {
         "owner": "nix-systems",
+        "ref": "main",
         "repo": "default",
         "type": "github"
       }

flake.nix

@@ -9,6 +9,7 @@
       inputs = {
         home-manager.follows = "home-manager";
         nixpkgs.follows = "nixpkgs";
+        systems.follows = "systems";
       };
     };
 
@@ -27,6 +28,9 @@
       owner = "numtide";
       repo = "flake-utils";
       ref = "main";
+      inputs = {
+        systems.follows = "systems";
+      };
     };
 
     home-manager = {
@@ -64,6 +68,13 @@
         nixpkgs-stable.follows = "nixpkgs";
       };
     };
+
+    systems = {
+      type = "github";
+      owner = "nix-systems";
+      repo = "default";
+      ref = "main";
+    };
   };
 
   # Can't eta-reduce a flake outputs...

flake/default.nix

@@ -13,6 +13,7 @@ flake-parts.lib.mkFlake { inherit inputs; } {
     ./checks.nix
     ./dev-shells.nix
     ./home-manager.nix
+    ./hosts.nix
     ./lib.nix
     ./nixos.nix
     ./overlays.nix

flake/home-manager.nix

@@ -1,5 +1,7 @@
-{ self, inputs, lib, ... }:
+{ self, config, inputs, lib, ... }:
 let
+  inherit (config) hosts;
+
   defaultModules = [
     # Include generic settings
     "${self}/modules/home"
@@ -14,9 +16,11 @@ let
       # Enable home-manager
       programs.home-manager.enable = true;
     }
+    # Import common modules
+    "${self}/modules/common"
   ];
 
-  mkHome = name: system: inputs.home-manager.lib.homeManagerConfiguration {
+  mkHomeCommon = mainModules: system: inputs.home-manager.lib.homeManagerConfiguration {
     # Work-around for home-manager
     # * not letting me set `lib` as an extraSpecialArgs
     # * not respecting `nixpkgs.overlays` [1]
@@ -29,34 +33,51 @@ let
       ];
     };
 
-    modules = defaultModules ++ [
-      "${self}/hosts/homes/${name}"
-    ];
+    modules = defaultModules ++ mainModules;
 
     extraSpecialArgs = {
       # Inject inputs to use them in global registry
       inherit inputs;
+      # For consumption by common modules
+      type = "home";
     };
   };
 
-  homes = {
+  mkHome = name: mkHomeCommon [ "${self}/hosts/homes/${name}" ];
+
+  mkNixosHome = name: mkHomeCommon [
+    "${self}/hosts/nixos/${name}/home.nix"
+    "${self}/hosts/nixos/${name}/profiles.nix"
+  ];
+in
+{
+  hosts.homes = {
     "ambroisie@bazin" = "x86_64-linux";
     "ambroisie@mousqueton" = "x86_64-linux";
   };
-in
-{
+
   perSystem = { system, ... }: {
     # Work-around for https://github.com/nix-community/home-manager/issues/3075
     legacyPackages = {
       homeConfigurations =
         let
-          filteredHomes = lib.filterAttrs (_: v: v == system) homes;
+          filteredHomes = lib.filterAttrs (_: v: v == system) hosts.homes;
           allHomes = filteredHomes // {
             # Default configuration
             ambroisie = system;
           };
+          homeManagerHomes = lib.mapAttrs mkHome allHomes;
+
+          filteredNixosHosts = lib.filterAttrs (_: v: v == system) hosts.nixos;
+          nixosHomes' = lib.mapAttrs mkNixosHome filteredNixosHosts;
+          nixosHomeUsername = (host: self.nixosConfigurations.${host}.config.my.user.name);
+          nixosHomes = lib.mapAttrs' (host: lib.nameValuePair "${nixosHomeUsername host}@${host}") nixosHomes';
         in
-        lib.mapAttrs mkHome allHomes;
+        lib.foldl' lib.mergeAttrs { }
+          [
+            homeManagerHomes
+            nixosHomes
+          ];
     };
   };
 }

flake/hosts.nix

@@ -0,0 +1,21 @@
+# Define `hosts.{darwin,home,nixos}` options for consumption in other modules
+{ lib, ... }:
+let
+  mkHostsOption = description: lib.mkOption {
+    inherit description;
+    type = with lib.types; attrsOf str;
+    default = { };
+    example = { name = "x86_64-linux"; };
+  };
+in
+{
+  options = {
+    hosts = {
+      darwin = mkHostsOption "Darwin hosts";
+
+      homes = mkHostsOption "Home Manager hosts";
+
+      nixos = mkHostsOption "NixOS hosts";
+    };
+  };
+}

flake/nixos.nix

@@ -1,4 +1,4 @@
-{ self, inputs, lib, ... }:
+{ self, config, inputs, lib, ... }:
 let
   defaultModules = [
     {
@@ -12,6 +12,8 @@ let
     }
     # Include generic settings
     "${self}/modules/nixos"
+    # Import common modules
+    "${self}/modules/common"
   ];
 
   buildHost = name: system: lib.nixosSystem {
@@ -24,12 +26,18 @@ let
       inherit (self) lib;
       # Inject inputs to use them in global registry
       inherit inputs;
+      # For consumption by common modules
+      type = "nixos";
     };
   };
 in
 {
-  flake.nixosConfigurations = lib.mapAttrs buildHost {
-    aramis = "x86_64-linux";
-    porthos = "x86_64-linux";
+  config = {
+    hosts.nixos = {
+      aramis = "x86_64-linux";
+      porthos = "x86_64-linux";
+    };
+
+    flake.nixosConfigurations = lib.mapAttrs buildHost config.hosts.nixos;
   };
 }

hosts/nixos/aramis/home.nix

@@ -2,7 +2,7 @@
 {
   my.home = {
     # Use graphical pinentry
-    bitwarden.pinentry = "gtk2";
+    bitwarden.pinentry = "qt";
     # Ebook library
     calibre.enable = true;
     # Some amount of social life
@@ -14,7 +14,7 @@
     # Blue light filter
     gammastep.enable = true;
     # Use a small popup to enter passwords
-    gpg.pinentry = "gtk2";
+    gpg.pinentry = "qt";
     # Machine specific packages
     packages.additionalPackages = with pkgs; [
       element-desktop # Matrix client

hosts/nixos/porthos/default.nix

@@ -7,6 +7,7 @@
     ./hardware.nix
     ./home.nix
     ./networking.nix
+    ./profiles.nix
     ./secrets
     ./services.nix
     ./system.nix

hosts/nixos/porthos/profiles.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  # Nothing
+}

modules/common/default.nix

@@ -0,0 +1,35 @@
+# Modules that are common to various module systems
+# Usually with very small differences, if any, between them.
+{ lib, type ? null, ... }:
+let
+  allowedTypes = [
+    "darwin"
+    "home"
+    "nixos"
+  ];
+
+  allowedTypesString = lib.concatStringSep ", " (builtins.map lib.escapeNixString allowedTypes);
+in
+{
+  imports = [
+    ./profiles
+  ];
+
+  config = {
+    assertions = [
+      {
+        assertion = type != null;
+        message = ''
+          You must provide `type` as part of specialArgs to use the common modules.
+          It must be one of ${allowedTypesString}.
+        '';
+      }
+      {
+        assertion = type != null -> builtins.elem type allowedTypes;
+        message = ''
+          `type` specialArgs must be one of ${allowedTypesString}.
+        '';
+      }
+    ];
+  };
+}

modules/common/profiles/bluetooth/default.nix

@@ -0,0 +1,19 @@
+{ config, lib, type, ... }:
+let
+  cfg = config.my.profiles.bluetooth;
+in
+{
+  options.my.profiles.bluetooth = with lib; {
+    enable = mkEnableOption "bluetooth profile";
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    (lib.optionalAttrs (type == "home") {
+      my.home.bluetooth.enable = true;
+    })
+
+    (lib.optionalAttrs (type == "nixos") {
+      my.hardware.bluetooth.enable = true;
+    })
+  ]);
+}

modules/common/profiles/devices/default.nix

@@ -0,0 +1,22 @@
+{ config, lib, type, ... }:
+let
+  cfg = config.my.profiles.devices;
+in
+{
+  options.my.profiles.devices = with lib; {
+    enable = mkEnableOption "devices profile";
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    (lib.optionalAttrs (type == "nixos") {
+      my.hardware = {
+        ergodox.enable = true;
+
+        mx-ergo.enable = true;
+      };
+
+      # MTP devices auto-mount via file explorers
+      services.gvfs.enable = true;
+    })
+  ]);
+}

modules/common/profiles/gtk/default.nix

@@ -0,0 +1,21 @@
+{ config, lib, type, ... }:
+let
+  cfg = config.my.profiles.gtk;
+in
+{
+  options.my.profiles.gtk = with lib; {
+    enable = mkEnableOption "gtk profile";
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    (lib.optionalAttrs (type == "home") {
+      # GTK theme configuration
+      my.home.gtk.enable = true;
+    })
+
+    (lib.optionalAttrs (type == "nixos") {
+      # Allow setting GTK configuration using home-manager
+      programs.dconf.enable = true;
+    })
+  ]);
+}

modules/common/profiles/laptop/default.nix

@@ -0,0 +1,27 @@
+{ config, lib, type, ... }:
+let
+  cfg = config.my.profiles.laptop;
+in
+{
+  options.my.profiles.laptop = with lib; {
+    enable = mkEnableOption "laptop profile";
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    (lib.optionalAttrs (type == "home") {
+      # Enable battery notifications
+      my.home.power-alert.enable = true;
+    })
+
+    (lib.optionalAttrs (type == "nixos") {
+      # Enable touchpad support
+      services.xserver.libinput.enable = true;
+
+      # Enable TLP power management
+      my.services.tlp.enable = true;
+
+      # Enable upower power management
+      my.hardware.upower.enable = true;
+    })
+  ]);
+}

modules/common/profiles/wm/default.nix

@@ -0,0 +1,36 @@
+{ config, lib, type, ... }:
+let
+  cfg = config.my.profiles.wm;
+
+  applyWm = wm: configs: lib.mkIf (cfg.windowManager == wm) (lib.my.merge configs);
+in
+{
+  options.my.profiles.wm = with lib; {
+    windowManager = mkOption {
+      type = with types; nullOr (enum [ "i3" ]);
+      default = null;
+      example = "i3";
+      description = "Which window manager to use";
+    };
+  };
+
+  config = lib.mkMerge [
+    (applyWm "i3" [
+      (lib.optionalAttrs (type == "home") {
+        # i3 settings
+        my.home.wm.windowManager = "i3";
+        # Screenshot tool
+        my.home.flameshot.enable = true;
+        # Auto disk mounter
+        my.home.udiskie.enable = true;
+      })
+
+      (lib.optionalAttrs (type == "nixos") {
+        # Enable i3
+        services.xserver.windowManager.i3.enable = true;
+        # udiskie fails if it can't find this dbus service
+        services.udisks2.enable = true;
+      })
+    ])
+  ];
+}

modules/common/profiles/x/default.nix

@@ -0,0 +1,27 @@
+{ config, lib, pkgs, type, ... }:
+let
+  cfg = config.my.profiles.x;
+in
+{
+  options.my.profiles.x = with lib; {
+    enable = mkEnableOption "X profile";
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    (lib.optionalAttrs (type == "home") {
+      # X configuration
+      my.home.x.enable = true;
+    })
+
+    (lib.optionalAttrs (type == "nixos") {
+      # Enable the X11 windowing system.
+      services.xserver.enable = true;
+      # Nice wallpaper
+      services.xserver.displayManager.lightdm.background =
+        let
+          wallpapers = "${pkgs.plasma5Packages.plasma-workspace-wallpapers}/share/wallpapers";
+        in
+        "${wallpapers}/summer_1am/contents/images/2560x1600.jpg";
+    })
+  ]);
+}

modules/home/default.nix

@@ -23,6 +23,7 @@
     ./gtk
     ./htop
     ./jq
+    ./keyboard
     ./mail
     ./mpv
     ./nix

modules/home/keyboard/default.nix

@@ -1,8 +1,12 @@
 { config, lib, ... }:
 let
-  cfg = config.my.home.x;
+  cfg = config.my.home.keyboard;
 in
 {
+  options.my.home.keyboard = with lib; {
+    enable = my.mkDisableOption "keyboard configuration";
+  };
+
   config = lib.mkIf cfg.enable {
     home.keyboard = {
       layout = "fr";

modules/home/mpv/default.nix

@@ -13,6 +13,7 @@ in
 
       scripts = [
         pkgs.mpvScripts.mpris # Allow controlling using media keys
+        pkgs.mpvScripts.uosc # Nicer UI
       ];
     };
   };

modules/home/wm/i3bar/default.nix

@@ -74,7 +74,7 @@ in
             )
             {
               block = "net";
-              format = " $icon{| $ssid|} $ip{| $signal_strength|} ";
+              format = " $icon{| $ssid|}{| $ip|}{| $signal_strength|} ";
             }
             {
               block = "backlight";

modules/home/x/default.nix

@@ -3,10 +3,6 @@ let
   cfg = config.my.home.x;
 in
 {
-  imports = [
-    ./keyboard
-  ];
-
   options.my.home.x = with lib; {
     enable = mkEnableOption "X server configuration";
   };

modules/nixos/default.nix

@@ -5,7 +5,6 @@
   imports = [
     ./hardware
     ./home
-    ./profiles
     ./programs
     ./secrets
     ./services

modules/nixos/home/default.nix

@@ -14,7 +14,19 @@ in
   config = lib.mkIf cfg.enable {
     home-manager = {
       # Not a fan of out-of-directory imports, but this is a good exception
-      users.${config.my.user.name} = import "${inputs.self}/modules/home";
+      users.${config.my.user.name} = {
+        imports = [
+          "${inputs.self}/modules/common"
+          "${inputs.self}/modules/home"
+        ];
+
+        config = {
+          my = {
+            # Transparently enable home-manager profiles as well
+            inherit (config.my) profiles;
+          };
+        };
+      };
 
       # Nix Flakes compatibility
       useGlobalPkgs = true;
@@ -23,6 +35,8 @@ in
       # Forward inputs to home-manager configuration
       extraSpecialArgs = {
         inherit inputs;
+        # For consumption by common modules
+        type = "home";
       };
     };
   };

modules/nixos/profiles/bluetooth/default.nix

@@ -1,15 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.my.profiles.bluetooth;
-in
-{
-  options.my.profiles.bluetooth = with lib; {
-    enable = mkEnableOption "bluetooth profile";
-  };
-
-  config = lib.mkIf cfg.enable {
-    my.hardware.bluetooth.enable = true;
-
-    my.home.bluetooth.enable = true;
-  };
-}

modules/nixos/profiles/devices/default.nix

@@ -1,20 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.my.profiles.devices;
-in
-{
-  options.my.profiles.devices = with lib; {
-    enable = mkEnableOption "devices profile";
-  };
-
-  config = lib.mkIf cfg.enable {
-    my.hardware = {
-      ergodox.enable = true;
-
-      mx-ergo.enable = true;
-    };
-
-    # MTP devices auto-mount via file explorers
-    services.gvfs.enable = true;
-  };
-}

modules/nixos/profiles/gtk/default.nix

@@ -1,17 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.my.profiles.gtk;
-in
-{
-  options.my.profiles.gtk = with lib; {
-    enable = mkEnableOption "gtk profile";
-  };
-
-  config = lib.mkIf cfg.enable {
-    # Allow setting GTK configuration using home-manager
-    programs.dconf.enable = true;
-
-    # GTK theme configuration
-    my.home.gtk.enable = true;
-  };
-}

modules/nixos/profiles/laptop/default.nix

@@ -1,23 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.my.profiles.laptop;
-in
-{
-  options.my.profiles.laptop = with lib; {
-    enable = mkEnableOption "laptop profile";
-  };
-
-  config = lib.mkIf cfg.enable {
-    # Enable touchpad support
-    services.xserver.libinput.enable = true;
-
-    # Enable TLP power management
-    my.services.tlp.enable = true;
-
-    # Enable upower power management
-    my.hardware.upower.enable = true;
-
-    # Enable battery notifications
-    my.home.power-alert.enable = true;
-  };
-}

modules/nixos/profiles/wm/default.nix

@@ -1,29 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.my.profiles.wm;
-in
-{
-  options.my.profiles.wm = with lib; {
-    windowManager = mkOption {
-      type = with types; nullOr (enum [ "i3" ]);
-      default = null;
-      example = "i3";
-      description = "Which window manager to use";
-    };
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf (cfg.windowManager == "i3") {
-      # Enable i3
-      services.xserver.windowManager.i3.enable = true;
-      # i3 settings
-      my.home.wm.windowManager = "i3";
-      # Screenshot tool
-      my.home.flameshot.enable = true;
-      # Auto disk mounter
-      my.home.udiskie.enable = true;
-      # udiskie fails if it can't find this dbus service
-      services.udisks2.enable = true;
-    })
-  ];
-}

modules/nixos/profiles/x/default.nix

@@ -1,23 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.my.profiles.x;
-in
-{
-  options.my.profiles.x = with lib; {
-    enable = mkEnableOption "X profile";
-  };
-
-  config = lib.mkIf cfg.enable {
-    # Enable the X11 windowing system.
-    services.xserver.enable = true;
-    # Nice wallpaper
-    services.xserver.displayManager.lightdm.background =
-      let
-        wallpapers = "${pkgs.plasma5Packages.plasma-workspace-wallpapers}/share/wallpapers";
-      in
-      "${wallpapers}/summer_1am/contents/images/2560x1600.jpg";
-
-    # X configuration
-    my.home.x.enable = true;
-  };
-}

modules/nixos/services/blog/default.nix

@@ -5,11 +5,10 @@ let
   domain = config.networking.domain;
 
   makeHostInfo = subdomain: {
-    inherit subdomain;
     root = "/var/www/${subdomain}";
   };
 
-  hostsInfo = map makeHostInfo [ "cv" "dev" "key" ];
+  hostsInfo = lib.flip lib.genAttrs makeHostInfo [ "cv" "dev" "key" ];
 in
 {
   options.my.services.blog = {

modules/nixos/services/calibre-web/default.nix

@@ -40,12 +40,11 @@ in
     # Set-up media group
     users.groups.media = { };
 
-    my.services.nginx.virtualHosts = [
-      {
-        subdomain = "library";
+    my.services.nginx.virtualHosts = {
+      library = {
         inherit (cfg) port;
-      }
-    ];
+      };
+    };
 
     my.services.backup = {
       paths = [

modules/nixos/services/drone/server/default.nix

@@ -45,11 +45,10 @@ in
       }];
     };
 
-    my.services.nginx.virtualHosts = [
-      {
-        subdomain = "drone";
+    my.services.nginx.virtualHosts = {
+      drone = {
         inherit (cfg) port;
-      }
-    ];
+      };
+    };
   };
 }

modules/nixos/services/flood/default.nix

@@ -40,11 +40,10 @@ in
       };
     };
 
-    my.services.nginx.virtualHosts = [
-      {
-        subdomain = "flood";
+    my.services.nginx.virtualHosts = {
+      flood = {
         inherit (cfg) port;
-      }
-    ];
+      };
+    };
   };
 }

modules/nixos/services/gitea/default.nix

@@ -116,18 +116,16 @@ in
     };
     users.groups.git = { };
 
-    my.services.nginx.virtualHosts = [
+    my.services.nginx.virtualHosts = {
       # Proxy to Gitea
-      {
-        subdomain = "git";
+      git = {
         inherit (cfg) port;
-      }
+      };
       # Redirect `gitea.` to actual forge subdomain
-      {
-        subdomain = "gitea";
+      gitea = {
         redirect = config.services.gitea.settings.server.ROOT_URL;
-      }
-    ];
+      };
+    };
 
     my.services.backup = {
       paths = [

modules/nixos/services/indexers/default.nix

@@ -28,12 +28,11 @@ in
         };
       };
 
-      my.services.nginx.virtualHosts = [
-        {
-          subdomain = "jackett";
+      my.services.nginx.virtualHosts = {
+        jackett = {
           port = jackettPort;
-        }
-      ];
+        };
+      };
     })
 
     (lib.mkIf cfg.nzbhydra.enable {
@@ -41,12 +40,11 @@ in
         enable = true;
       };
 
-      my.services.nginx.virtualHosts = [
-        {
-          subdomain = "nzbhydra";
+      my.services.nginx.virtualHosts = {
+        nzbhydra = {
           port = nzbhydraPort;
-        }
-      ];
+        };
+      };
     })
 
     (lib.mkIf cfg.prowlarr.enable {
@@ -54,12 +52,11 @@ in
         enable = true;
       };
 
-      my.services.nginx.virtualHosts = [
-        {
-          subdomain = "prowlarr";
+      my.services.nginx.virtualHosts = {
+        prowlarr = {
           port = prowlarrPort;
-        }
-      ];
+        };
+      };
 
       services.fail2ban.jails = {
         prowlarr = ''

modules/nixos/services/jellyfin/default.nix

@@ -17,9 +17,15 @@ in
     # Set-up media group
     users.groups.media = { };
 
-    my.services.nginx.virtualHosts = [
-      {
-        subdomain = "jellyfin";
+    systemd.services.jellyfin = {
+      serviceConfig = {
+        # Loose umask to make Jellyfin metadata more broadly readable
+        UMask = lib.mkForce "0002";
+      };
+    };
+
+    my.services.nginx.virtualHosts = {
+      jellyfin = {
         port = 8096;
         extraConfig = {
           locations."/" = {
@@ -33,7 +39,7 @@ in
             proxyWebsockets = true;
           };
         };
-      }
-    ];
+      };
+    };
   };
 }

modules/nixos/services/lohr/default.nix

@@ -98,11 +98,10 @@ in
     };
     users.groups.lohr = { };
 
-    my.services.nginx.virtualHosts = [
-      {
-        subdomain = "lohr";
+    my.services.nginx.virtualHosts = {
+      lohr = {
         inherit (cfg) port;
-      }
-    ];
+      };
+    };
   };
 }

modules/nixos/services/matrix/default.nix

@@ -117,10 +117,9 @@ in
       };
     };
 
-    my.services.nginx.virtualHosts = [
+    my.services.nginx.virtualHosts = {
       # Element Web app deployment
-      {
-        subdomain = "chat";
+      chat = {
         root = pkgs.element-web.override {
           conf = {
             default_server_config = {
@@ -145,22 +144,19 @@ in
             };
           };
         };
-      }
+      };
       # Dummy VHosts for port collision detection
-      {
-        subdomain = "matrix-federation";
+      matrix-federation = {
         port = federationPort.private;
-      }
-      {
-        subdomain = "matrix-client";
+      };
+      matrix-client = {
         port = clientPort.private;
-      }
+      };
       # Sliding sync
-      {
-        subdomain = "matrix-sync";
+      matrix-sync = {
         inherit (cfg.slidingSync) port;
-      }
-    ];
+      };
+    };
 
     # Those are too complicated to use my wrapper...
     services.nginx.virtualHosts = {

modules/nixos/services/miniflux/default.nix

@@ -43,11 +43,10 @@ in
       };
     };
 
-    my.services.nginx.virtualHosts = [
-      {
-        subdomain = "reader";
+    my.services.nginx.virtualHosts = {
+      reader = {
         inherit (cfg) port;
-      }
-    ];
+      };
+    };
   };
 }

modules/nixos/services/monitoring/default.nix

@@ -125,11 +125,10 @@ in
       ];
     };
 
-    my.services.nginx.virtualHosts = [
-      {
-        subdomain = "monitoring";
+    my.services.nginx.virtualHosts = {
+      monitoring = {
         inherit (cfg.grafana) port;
-      }
-    ];
+      };
+    };
   };
 }

modules/nixos/services/navidrome/default.nix

@@ -47,11 +47,10 @@ in
       };
     };
 
-    my.services.nginx.virtualHosts = [
-      {
-        subdomain = "music";
+    my.services.nginx.virtualHosts = {
+      music = {
         inherit (cfg) port;
-      }
-    ];
+      };
+    };
   };
 }

modules/nixos/services/nginx/default.nix

@@ -5,10 +5,11 @@ let
 
   domain = config.networking.domain;
 
-  virtualHostOption = with lib; types.submodule {
+  virtualHostOption = with lib; types.submodule ({ name, ... }: {
     options = {
       subdomain = mkOption {
         type = types.str;
+        default = name;
         example = "dev";
         description = ''
           Which subdomain, under config.networking.domain, to use
@@ -72,7 +73,7 @@ let
         '';
       };
     };
-  };
+  });
 in
 {
   imports = [
@@ -97,20 +98,18 @@ in
     };
 
     virtualHosts = mkOption {
-      type = types.listOf virtualHostOption;
-      default = [ ];
+      type = types.attrsOf virtualHostOption;
+      default = { };
       example = litteralExample ''
-        [
-          {
-            subdomain = "gitea";
+        {
+          gitea = {
+            subdomain = "git";
             port = 8080;
-          }
-          {
-            subdomain = "dev";
+          };
+          dev = {
             root = "/var/www/dev";
-          }
-          {
-            subdomain = "jellyfin";
+          };
+          jellyfin = {
             port = 8096;
             extraConfig = {
               locations."/socket" = {
@@ -118,8 +117,8 @@ in
                 proxyWebsockets = true;
               };
             };
-          }
-        ]
+          };
+        }
       '';
       description = ''
         List of virtual hosts to set-up using default settings.
@@ -190,7 +189,7 @@ in
 
   config = lib.mkIf cfg.enable {
     assertions = [ ]
-      ++ (lib.flip builtins.map cfg.virtualHosts ({ subdomain, ... } @ args:
+      ++ (lib.flip lib.mapAttrsToList cfg.virtualHosts (_: { subdomain, ... } @ args:
       let
         conflicts = [ "port" "root" "socket" "redirect" ];
         optionsNotNull = builtins.map (v: args.${v} != null) conflicts;
@@ -209,7 +208,7 @@ in
         ports = lib.my.mapFilter
           (v: v != null)
           ({ port, ... }: port)
-          cfg.virtualHosts;
+          (lib.attrValues cfg.virtualHosts);
         portCounts = lib.my.countValues ports;
         nonUniquesCounts = lib.filterAttrs (_: v: v != 1) portCounts;
         nonUniques = builtins.attrNames nonUniquesCounts;
@@ -221,7 +220,7 @@ in
       map mkAssertion nonUniques
     ) ++ (
       let
-        subs = map ({ subdomain, ... }: subdomain) cfg.virtualHosts;
+        subs = lib.mapAttrsToList (_: { subdomain, ... }: subdomain) cfg.virtualHosts;
         subsCounts = lib.my.countValues subs;
         nonUniquesCounts = lib.filterAttrs (_: v: v != 1) subsCounts;
         nonUniques = builtins.attrNames nonUniquesCounts;
@@ -325,7 +324,7 @@ in
             ])
           );
         in
-        lib.my.genAttrs' cfg.virtualHosts mkVHost;
+        lib.my.genAttrs' (lib.attrValues cfg.virtualHosts) mkVHost;
 
       sso = {
         enable = true;
@@ -403,12 +402,11 @@ in
       };
     };
 
-    my.services.nginx.virtualHosts = [
-      {
-        subdomain = "login";
+    my.services.nginx.virtualHosts = {
+      ${cfg.sso.subdomain} = {
         inherit (cfg.sso) port;
-      }
-    ];
+      };
+    };
 
     networking.firewall.allowedTCPPorts = [ 80 443 ];
 

modules/nixos/services/nix-cache/default.nix

@@ -43,11 +43,10 @@ in
       signKeyPath = cfg.secretKeyFile;
     };
 
-    my.services.nginx.virtualHosts = [
-      {
-        subdomain = "cache";
+    my.services.nginx.virtualHosts = {
+      cache = {
         inherit (cfg) port;
-      }
-    ];
+      };
+    };
   };
 }

modules/nixos/services/paperless/default.nix

@@ -143,9 +143,8 @@ in
       extraGroups = [ "media" ];
     };
 
-    my.services.nginx.virtualHosts = [
-      {
-        subdomain = "paperless";
+    my.services.nginx.virtualHosts = {
+      paperless = {
         inherit (cfg) port;
         sso = {
           enable = true;
@@ -155,8 +154,8 @@ in
         extraConfig = {
           locations."/".proxyWebsockets = true;
         };
-      }
-    ];
+      };
+    };
 
     my.services.backup = {
       paths = [

modules/nixos/services/pirate/default.nix

@@ -21,12 +21,11 @@ let
   };
 
   mkRedirection = service: {
-    my.services.nginx.virtualHosts = [
-      {
-        subdomain = service;
+    my.services.nginx.virtualHosts = {
+      ${service} = {
         port = ports.${service};
-      }
-    ];
+      };
+    };
   };
 
   mkFail2Ban = service: lib.mkIf cfg.${service}.enable {

modules/nixos/services/podgrab/default.nix

@@ -31,11 +31,10 @@ in
       inherit (cfg) passwordFile port;
     };
 
-    my.services.nginx.virtualHosts = [
-      {
-        subdomain = "podgrab";
+    my.services.nginx.virtualHosts = {
+      podgrab = {
         inherit (cfg) port;
-      }
-    ];
+      };
+    };
   };
 }

modules/nixos/services/sabnzbd/default.nix

@@ -18,12 +18,11 @@ in
     # Set-up media group
     users.groups.media = { };
 
-    my.services.nginx.virtualHosts = [
-      {
-        subdomain = "sabnzbd";
+    my.services.nginx.virtualHosts = {
+      sabnzbd = {
         inherit port;
-      }
-    ];
+      };
+    };
 
     services.fail2ban.jails = {
       sabnzbd = ''

modules/nixos/services/tandoor-recipes/default.nix

@@ -70,11 +70,10 @@ in
       ];
     };
 
-    my.services.nginx.virtualHosts = [
-      {
-        subdomain = "recipes";
+    my.services.nginx.virtualHosts = {
+      recipes = {
         inherit (cfg) port;
-      }
-    ];
+      };
+    };
   };
 }

modules/nixos/services/transmission/default.nix

@@ -80,12 +80,11 @@ in
 
     # Default transmission webui, I prefer combustion but its development
     # seems to have stalled
-    my.services.nginx.virtualHosts = [
-      {
-        subdomain = "transmission";
+    my.services.nginx.virtualHosts = {
+      transmission = {
         inherit (cfg) port;
-      }
-    ];
+      };
+    };
 
     networking.firewall = {
       allowedTCPPorts = [ cfg.peerPort ];

modules/nixos/services/vikunja/default.nix

@@ -59,9 +59,8 @@ in
     };
 
     # This is a weird setup
-    my.services.nginx.virtualHosts = [
-      {
-        inherit subdomain;
+    my.services.nginx.virtualHosts = {
+      ${subdomain} = {
         # Serve the root for the web-ui
         root = config.services.vikunja.package-frontend;
 
@@ -80,8 +79,8 @@ in
             };
           };
         };
-      }
-    ];
+      };
+    };
 
     systemd.services.vikunja-api = {
       serviceConfig = {

modules/nixos/services/woodpecker/server/default.nix

@@ -52,16 +52,14 @@ in
       }];
     };
 
-    my.services.nginx.virtualHosts = [
-      {
-        subdomain = "woodpecker";
+    my.services.nginx.virtualHosts = {
+      woodpecker = {
         inherit (cfg) port;
-      }
+      };
       # I might want to be able to RPC from other hosts in the future
-      {
-        subdomain = "woodpecker-rpc";
+      woodpecker-rpc = {
         port = cfg.rpcPort;
-      }
-    ];
+      };
+    };
   };
 }

pkgs/default.nix

@@ -28,7 +28,5 @@ pkgs.lib.makeScope pkgs.newScope (pkgs: {
 
   unbound-zones-adblock = pkgs.callPackage ./unbound-zones-adblock { };
 
-  wifi-qr = pkgs.callPackage ./wifi-qr { };
-
   zsh-done = pkgs.callPackage ./zsh-done { };
 })

pkgs/matrix-notifier/default.nix

@@ -1,13 +1,13 @@
 { lib, curl, jq, fetchFromGitHub, makeWrapper, pandoc, stdenvNoCC }:
 stdenvNoCC.mkDerivation rec {
   pname = "matrix-notifier";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "ambroisie";
     repo = "matrix-notifier";
     rev = "v${version}";
-    hash = "sha256-NE9RO0ep2ibrT9EUPGTnUE3ofdNTCHwelxnX9tCflg0=";
+    hash = "sha256-6KHteQx0bHodpNp7cuUIGM7uBRPaj386n2t5yz6umpY=";
   };
 
   nativeBuildInputs = [

pkgs/wifi-qr/default.nix

@@ -1,81 +0,0 @@
-{ lib
-, fetchFromGitHub
-, gnome
-, installShellFiles
-, makeWrapper
-, networkmanager
-, qrencode
-, stdenvNoCC
-, xdg-utils
-, zbar
-}:
-stdenvNoCC.mkDerivation rec {
-  pname = "wifi-qr";
-  version = "unstable-2023-04-19";
-
-  outputs = [ "out" "man" ];
-
-  src = fetchFromGitHub {
-    owner = "kokoye2007";
-    repo = "wifi-qr";
-    rev = "b81d4a44257252f07e745464879aa5618ae3d434";
-    hash = "sha256-oGTAr+raJGpK4PV4GdBxX8fIUE8gcbXw7W0SvQJAee0=";
-  };
-
-  nativeBuildInputs = [
-    installShellFiles
-    makeWrapper
-  ];
-
-  dontBuild = true;
-
-  dontConfigure = true;
-
-  postPatch = ''
-    substituteInPlace wifi-qr.desktop \
-      --replace "Exec=sh -c 'wifi-qr g'" "Exec=$out/bin/wifi-qr g" \
-      --replace "Exec=sh -c 'wifi-qr q'" "Exec=$out/bin/wifi-qr q" \
-      --replace "Exec=sh -c 'wifi-qr p'" "Exec=$out/bin/wifi-qr p" \
-      --replace "Exec=sh -c 'wifi-qr c'" "Exec=$out/bin/wifi-qr c" \
-      --replace "Icon=wifi-qr.svg" "Icon=wifi-qr"
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm755 wifi-qr $out/bin/wifi-qr
-
-    install -Dm644 wifi-qr.desktop $out/share/applications/wifi-qr.desktop
-    install -Dm644 wifi-qr.svg $out/share/icons/hicolor/scalable/apps/wifi-qr.svg
-
-    installManPage wifi-qr.1
-
-    runHook postInstall
-  '';
-
-  wrapperPath = lib.makeBinPath [
-    gnome.zenity
-    networkmanager
-    qrencode
-    xdg-utils
-    zbar
-  ];
-
-  fixupPhase = ''
-    runHook preFixup
-
-    patchShebangs $out/bin/wifi-qr
-    wrapProgram $out/bin/wifi-qr --suffix PATH : "${wrapperPath}"
-
-    runHook postFixup
-  '';
-
-  meta = with lib; {
-    description = "WiFi password sharing via QR codes";
-    homepage = "https://github.com/kokoye2007/wifi-qr";
-    license = with licenses; [ gpl3Plus ];
-    mainProgram = "wifi-qr";
-    maintainers = with maintainers; [ ambroisie ];
-    platforms = platforms.linux;
-  };
-}