feat(nixos): deploy RomM guest

configs/nixos/modules/services/romm.nix

@@ -0,0 +1,47 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.modules.services.romm;
+in
+{
+  options.modules.services.romm = {
+    enable = lib.mkEnableOption "RomM";
+
+    environmentFile = lib.mkOption {
+      type = lib.types.path;
+      default = "/run/secrets/romm.env";
+      readOnly = true;
+      description = "Path to RomM's environment file.";
+    };
+  };
+
+  config = lib.mkMerge [
+    {
+      registry."stable-uid".${config.networking.hostName} = {
+        romm = 20005;
+        "redis-romm" = 20006;
+      };
+    }
+
+    (lib.mkIf cfg.enable {
+      networking.firewall.allowedTCPPorts = [ 80 ];
+
+      services.romm = {
+        enable = true;
+        group = "storage";
+        database.createLocally = true;
+        redis.createLocally = true;
+        watcher.enable = true;
+        inherit (cfg) environmentFile;
+      };
+
+      users.users = {
+        romm.uid = config.registry."stable-uid".${config.networking.hostName}.romm;
+        redis-romm.uid = config.registry."stable-uid".${config.networking.hostName}."redis-romm";
+      };
+    })
+  ];
+}