From 3a3c612a833a8954d368a5cf7e5c954927cf4929 Mon Sep 17 00:00:00 2001
From: alexion <contact@alexion.dev>
Date: Tue, 8 Sep 2026 16:58:20 -0400
Subject: [PATCH] refactor(nixos): centralize physical host defaults

---
 configs/nixos/hosts/neogaia/default.nix | 18 ------------------
 configs/nixos/hosts/pikachu/default.nix | 10 ----------
 configs/nixos/hosts/zeus/default.nix    | 12 ------------
 configs/nixos/modules/host.nix          | 10 ++++++++++
 4 files changed, 10 insertions(+), 40 deletions(-)

diff --git a/configs/nixos/hosts/neogaia/default.nix b/configs/nixos/hosts/neogaia/default.nix
index 48a2411..8dba7a4 100644
--- a/configs/nixos/hosts/neogaia/default.nix
+++ b/configs/nixos/hosts/neogaia/default.nix
@@ -13,19 +13,8 @@
     ./disk.nix
   ];
 
-  # systemd-boot on the EFI system partition.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
   boot.kernelPackages = pkgs.linuxPackages_cachyos;
 
-  # Redistributable firmware for the QCA6174 wifi (ath10k blobs).
-  # Intel microcode updates follow from this, so none is declared here.
-  hardware.enableRedistributableFirmware = true;
-
-  # RAM-backed swap, no on-disk swap partition.
-  zramSwap.enable = true;
-
   # So wifi can be joined from the console.
   networking.networkmanager.enable = true;
 
@@ -48,13 +37,6 @@
     vpn-off = ''sudo systemctl stop 'wireguard-wg-home*.service' wireguard-wg-home.target'';
   };
 
-  # So setup can be driven over the network.
-  # The matching host public keys sit beside this file in plaintext, since
-  # publishing them is their purpose.
-  modules.network.ssh.enable = true;
-  modules.network.ssh.hostKeys.sopsFile = ../../secrets/neogaia.yaml;
-  modules.network.ssh.userKey.sopsFile = ../../secrets/neogaia.yaml;
-
   modules.monorepo.enable = true;
   modules.shell.herdr.enable = true;
   modules.shell.gitea-axi.enable = true;
diff --git a/configs/nixos/hosts/pikachu/default.nix b/configs/nixos/hosts/pikachu/default.nix
index 55a629a..9172899 100644
--- a/configs/nixos/hosts/pikachu/default.nix
+++ b/configs/nixos/hosts/pikachu/default.nix
@@ -13,13 +13,7 @@
     ./disk.nix
   ];
 
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
   hardware.cpu.intel.updateMicrocode = true;
-  hardware.enableRedistributableFirmware = true;
-
-  zramSwap.enable = true;
 
   systemd.network = {
     enable = true;
@@ -72,10 +66,6 @@
 
   registry.address.pikachu.self = "10.23.10.102";
 
-  modules.network.ssh.enable = true;
-  modules.network.ssh.hostKeys.sopsFile = ../../secrets/pikachu.yaml;
-  modules.network.ssh.userKey.sopsFile = ../../secrets/pikachu.yaml;
-
   guests.actualbudget = {
     enable = true;
     vlan = 20;
diff --git a/configs/nixos/hosts/zeus/default.nix b/configs/nixos/hosts/zeus/default.nix
index dea8b88..c98f695 100644
--- a/configs/nixos/hosts/zeus/default.nix
+++ b/configs/nixos/hosts/zeus/default.nix
@@ -12,29 +12,17 @@
 
   nixpkgs.hostPlatform = "x86_64-linux";
 
-  # systemd-boot on the EFI system partition.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
   boot.kernelPackages = pkgs.linuxPackages_cachyos;
 
-  hardware.enableRedistributableFirmware = true;
   hardware.graphics = {
     enable = true;
     enable32Bit = true;
   };
 
-  # RAM-backed swap, no on-disk swap partition.
-  zramSwap.enable = true;
-
   networking.networkmanager.enable = true;
 
   registry.address.zeus.self = "10.23.50.221";
 
-  modules.network.ssh.enable = true;
-  modules.network.ssh.hostKeys.sopsFile = ../../secrets/zeus.yaml;
-  modules.network.ssh.userKey.sopsFile = ../../secrets/zeus.yaml;
-
   hardware.bluetooth = {
     enable = true;
     powerOnBoot = true;
diff --git a/configs/nixos/modules/host.nix b/configs/nixos/modules/host.nix
index 993702c..db47d4d 100644
--- a/configs/nixos/modules/host.nix
+++ b/configs/nixos/modules/host.nix
@@ -6,6 +6,7 @@
 let
   cfg = config.modules.host;
   user = config.user;
+  hostSecrets = ../secrets + "/${config.networking.hostName}.yaml";
   passwordSecret = "${user.name}-password";
 in
 {
@@ -24,7 +25,16 @@ in
     nix.optimise.automatic = true;
     nix.optimise.dates = [ "Thu 03:45" ];
 
+    boot.loader.systemd-boot.enable = true;
     boot.loader.systemd-boot.configurationLimit = 15;
+    boot.loader.efi.canTouchEfiVariables = true;
+
+    hardware.enableRedistributableFirmware = true;
+    zramSwap.enable = true;
+
+    modules.network.ssh.enable = true;
+    modules.network.ssh.hostKeys.sopsFile = hostSecrets;
+    modules.network.ssh.userKey.sopsFile = hostSecrets;
 
     services.xserver.xkb.layout = "us";
     services.xserver.xkb.options = "caps:escape_shifted_capslock";
-- 
2.47.3