refactor: complete overhaul

systems/desktop/config/boot.nix

@@ -0,0 +1,29 @@
+{
+  pkgs,
+  config,
+  ...
+}: {
+  boot = {
+    extraModulePackages = [
+      config.boot.kernelPackages.v4l2loopback.out
+    ];
+    supportedFilesystems = ["ntfs"];
+    initrd = {
+      network.openvpn.enable = true;
+      availableKernelModules = ["nvme" "ahci" "xhci_pci" "usb_storage" "usbhid" "sd_mod"];
+      kernelModules = [];
+    };
+
+    kernelModules = ["kvm-amd" "vfio-pci" "v4l2loopback"];
+
+    kernelPackages = pkgs.linuxPackages_latest;
+
+    loader = {
+      efi = {
+        canTouchEfiVariables = true;
+        efiSysMountPoint = "/boot";
+      };
+      systemd-boot.enable = true;
+    };
+  };
+}

systems/desktop/config/filesystem.nix

@@ -0,0 +1,87 @@
+{
+  flake,
+  config,
+  ...
+}: let
+  inherit (flake.config.people) user0 user1;
+  inherit (flake.config.machines.devices) desktop server synology;
+  inherit (flake.config.services.instances) samba;
+
+  synologySecrets = config.sops.secrets."network/synology".path;
+  serverSecrets = config.sops.secrets."network/server".path;
+in {
+  fileSystems = let
+    synologyDrives = [
+      "folder0"
+      "folder1"
+      "folder2"
+    ];
+
+    storageDrives = [
+      "storage0"
+      "storage1"
+    ];
+
+    sambaDrives = [
+      "samba0"
+    ];
+
+    synologyMounts = synologyDrive: {
+      name = "${synology.${synologyDrive}.mount}";
+      value = {
+        device = synology.${synologyDrive}.device;
+        fsType = "cifs";
+        options =
+          synology.${synologyDrive}.options
+          ++ ["credentials=${synologySecrets}"];
+      };
+    };
+
+    storageMounts = storageDrive: {
+      name = "${desktop.${storageDrive}.mount}";
+      value = {
+        device = desktop.${storageDrive}.device;
+        fsType = "ext4";
+        options = desktop.${storageDrive}.options;
+      };
+    };
+
+    sambaMounts = sambaDrive: {
+      name = "${server.${sambaDrive}.mount}/${samba.paths.path1}";
+      value = {
+        device = "${server.${sambaDrive}.device}/${samba.paths.path1}";
+        fsType = "cifs";
+        options =
+          server.${sambaDrive}.options
+          ++ ["credentials=${serverSecrets}"];
+      };
+    };
+  in
+    {
+      "/" = {
+        device = "/dev/disk/by-uuid/a465cd69-1cdc-47f8-93ca-cfdfee28adfe";
+        fsType = "ext4";
+      };
+      "/boot" = {
+        device = "/dev/disk/by-uuid/AEB2-681E";
+        fsType = "vfat";
+        options = desktop.boot.options;
+      };
+    }
+    // (builtins.listToAttrs (map synologyMounts synologyDrives))
+    // (builtins.listToAttrs (map storageMounts storageDrives))
+    // (builtins.listToAttrs (map sambaMounts sambaDrives));
+
+  swapDevices = [
+    {device = "/dev/disk/by-uuid/1c787018-5bea-48b5-973c-dafd54159ee1";}
+  ];
+
+  systemd.tmpfiles.rules = [
+    "Z ${config.home-manager.users.${user0}.home.homeDirectory} 0755 ${user0} users -"
+    "Z ${config.home-manager.users.${user1}.home.homeDirectory} 0755 ${user1} users -"
+    "Z ${desktop.storage0.mount} 0755 ${user0} users -"
+    "Z ${desktop.storage1.mount} 0755 ${user0} users -"
+  ];
+
+  services.udisks2.enable = true;
+}

systems/desktop/config/graphics.nix

@@ -0,0 +1,24 @@
+{pkgs, ...}: {
+  hardware = {
+    graphics = {
+      enable = true;
+      extraPackages = builtins.attrValues {
+        inherit
+          (pkgs)
+          amdvlk
+          ;
+        inherit
+          (pkgs.rocmPackages.clr)
+          icd
+          ;
+      };
+      extraPackages32 = builtins.attrValues {
+        inherit
+          (pkgs.driversi686Linux)
+          amdvlk
+          ;
+      };
+    };
+  };
+  boot.initrd.kernelModules = ["amdgpu"];
+}

systems/desktop/config/hardware.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  hardware = {
+    firmware = builtins.attrValues {
+      inherit
+        (pkgs)
+        rtl8761b-firmware
+        ;
+    };
+    enableAllFirmware = true;
+    ledger.enable = true;
+    cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  };
+}

systems/desktop/config/networking.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  flake,
+  ...
+}: let
+  inherit (flake.config.machines.devices) desktop;
+in {
+  networking = {
+    hostName = desktop.name;
+    networkmanager.enable = true;
+    nftables.enable = true;
+    useDHCP = lib.mkDefault true;
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        22 # SSH
+        4333 # Feishin
+        2234 # Soulseek
+        3131 # Deskreen
+      ];
+    };
+  };
+  services = {
+    avahi = {
+      enable = true;
+      openFirewall = true;
+      nssmdns4 = true;
+    };
+    sshd.enable = true;
+    openssh = {
+      enable = true;
+      settings.PasswordAuthentication = false;
+    };
+  };
+}

systems/desktop/config/sops.nix

@@ -0,0 +1,23 @@
+{flake, ...}: let
+  inherit (flake.config.people) user0;
+  inherit (flake.config.people.users.${user0}) paths;
+in {
+  sops = {
+    secrets = {
+      "network/synology" = {
+        path = "/var/lib/secrets/synology";
+        owner = "root";
+        mode = "600";
+      };
+      "network/server" = {
+        path = "/var/lib/secrets/server";
+        owner = "root";
+        mode = "600";
+      };
+      "discord-token" = {
+        path = "${paths.path0}/zookeeper/.env";
+        owner = user0;
+      };
+    };
+  };
+}