feat(nixos): encapsulate CachyOS kernel configuration

configs/nixos/AGENTS.md

@@ -61,3 +61,5 @@
   Do not describe NixOS route choices as public-DNS management.
 - Do not hand-author `hardware-configuration.nix` for a host that has not been generated on that machine.
   Generate it on the target system or live ISO, then stage it before evaluating the flake.
+- Configure the Chaotic Nyx cache only on hosts that select `linuxPackages_cachyos` (currently Neogaia
+  and Zeus), not in the generic host module.

configs/nixos/hosts/neogaia/default.nix

@@ -1,6 +1,5 @@
 {
   inputs,
-  pkgs,
   ...
 }:
 # neogaia — Dell XPS 13 9380 laptop.
@@ -13,7 +12,7 @@
     ./disk.nix
   ];
 
-  boot.kernelPackages = pkgs.linuxPackages_cachyos;
+  modules.kernel.cachyos.enable = true;
 
   # So wifi can be joined from the console.
   networking.networkmanager.enable = true;

configs/nixos/hosts/zeus/default.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   ...
 }:
 # zeus — Ryzen desktop with AMD graphics.
@@ -15,7 +14,7 @@
 
   nixpkgs.hostPlatform = "x86_64-linux";
 
-  boot.kernelPackages = pkgs.linuxPackages_cachyos;
+  modules.kernel.cachyos.enable = true;
 
   hardware.graphics = {
     enable = true;

configs/nixos/modules/host.nix

@@ -5,20 +5,12 @@
   ...
 }:
 let
-  cfg = config.modules.host; # NOLINT(let_order)
-  inherit (config) user;
   hostSecrets = ../secrets + "/${config.networking.hostName}.yaml";
-  passwordSecret = "${user.name}-password";
 in
 {
   options.modules.host.enable = lib.mkEnableOption "physical-host base configuration";
 
-  config = lib.mkIf cfg.enable {
-    nix.settings.extra-substituters = [ "https://nyx-cache.chaotic.cx/" ];
-    nix.settings.extra-trusted-public-keys = [
-      "nyx-cache.chaotic.cx:dJxTrgMC3V3cFfyIiBQDQorG6k1LsqurH/srpMSq7qk="
-    ];
-
+  config = lib.mkIf config.modules.host.enable {
     nix.gc.automatic = true;
     nix.gc.dates = "Mon 03:15";
     nix.gc.options = "--delete-older-than 30d";
@@ -47,8 +39,9 @@ in
     sops.gnupg.sshKeyPaths = [ ];
 
     users.mutableUsers = false;
-    sops.secrets.${passwordSecret}.neededForUsers = true;
-    users.users.${user.name}.hashedPasswordFile = config.sops.secrets.${passwordSecret}.path;
+    sops.secrets."${config.user.name}-password".neededForUsers = true;
+    users.users.${config.user.name}.hashedPasswordFile =
+      config.sops.secrets."${config.user.name}-password".path;
 
     security.sudo.extraConfig = ''
       Defaults env_keep += "EDITOR VISUAL"
@@ -57,9 +50,9 @@ in
     home-manager = {
       useGlobalPkgs = true;
       useUserPackages = true;
-      users.${user.name} = {
-        home.username = user.name;
-        home.homeDirectory = "/home/${user.name}";
+      users.${config.user.name} = {
+        home.username = config.user.name;
+        home.homeDirectory = "/home/${config.user.name}";
         home.stateVersion = config.system.stateVersion;
         home.packages = with pkgs; [
           eza

configs/nixos/modules/kernel/cachyos.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  options.modules.kernel.cachyos.enable = lib.mkEnableOption "CachyOS kernel";
+
+  config = lib.mkIf config.modules.kernel.cachyos.enable {
+    boot.kernelPackages = pkgs.linuxPackages_cachyos;
+
+    nix.settings.extra-substituters = [ "https://nyx-cache.chaotic.cx/" ];
+    nix.settings.extra-trusted-public-keys = [
+      "nyx-cache.chaotic.cx:dJxTrgMC3V3cFfyIiBQDQorG6k1LsqurH/srpMSq7qk="
+    ];
+  };
+}