refactor(flake): split host guest and module assembly

guests/actualbudget.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  my,
   ...
 }:
 let
@@ -9,18 +8,6 @@ let
   dataDir = "/data";
 in
 {
-  imports = [
-    (my.guest {
-      name = "actualbudget";
-      interior = {
-        modules.services.actualbudget = {
-          enable = true;
-          inherit dataDir;
-        };
-      };
-    })
-  ];
-
   options.guests.actualbudget = {
     dataPath = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
@@ -39,7 +26,13 @@ in
     ];
 
     guests.actualbudget = {
-      mounts.${dataDir}.hostPath = cfg.dataPath;
+      interior = {
+        modules.services.actualbudget = {
+          enable = true;
+          inherit dataDir;
+        };
+      };
+      mounts.${dataDir}.directory = cfg.dataPath;
       limits = {
         memory = lib.mkDefault "2G";
         cpu = lib.mkDefault "200%";

guests/copyparty.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  my,
   ...
 }:
 let
@@ -34,26 +33,6 @@ let
   };
 in
 {
-  imports = [
-    (my.guest {
-      name = "copyparty";
-      interior = {
-        modules.services.copyparty = {
-          enable = true;
-          inherit (cfg) accountName stateDir;
-          passwordFile = "/run/secrets/${cfg.passwordSecret}";
-          reverseProxy = {
-            enable = cfg.reverseProxy.enable;
-            inherit (cfg.reverseProxy) trustedSources;
-          };
-          volumes = lib.mapAttrs (_urlPath: volume: {
-            inherit (volume) path access flags;
-          }) cfg.volumes;
-        };
-      };
-    })
-  ];
-
   options.guests.copyparty = {
     accountName = lib.mkOption {
       type = lib.types.str;
@@ -106,19 +85,33 @@ in
     ];
 
     guests.copyparty = {
-      secrets = [ cfg.passwordSecret ];
+      interior.modules.services.copyparty = {
+        enable = true;
+        inherit (cfg) accountName stateDir;
+        passwordFile = "/run/secrets/${cfg.passwordSecret}";
+        reverseProxy = {
+          enable = cfg.reverseProxy.enable;
+          inherit (cfg.reverseProxy) trustedSources;
+        };
+        volumes = lib.mapAttrs (_urlPath: volume: {
+          inherit (volume) path access flags;
+        }) cfg.volumes;
+      };
+
       mounts =
         {
           ${cfg.stateDir} = {
-            hostPath = cfg.statePath;
-            create = {
-              owner = config.registry."stable-uid".${config.networking.hostName}.copyparty;
-              group = "storage";
-              mode = "0770";
-            };
+            directory = cfg.statePath;
+            owner = config.registry."stable-uid".${config.networking.hostName}.copyparty;
+            group = "storage";
+            mode = "0770";
+          };
+          ${"/run/secrets/${cfg.passwordSecret}"} = {
+            file = config.sops.secrets.${cfg.passwordSecret}.path;
+            readOnly = true;
           };
         }
-        // lib.mapAttrs' (_urlPath: volume: lib.nameValuePair volume.path { inherit (volume) hostPath; }) cfg.volumes;
+        // lib.mapAttrs' (_urlPath: volume: lib.nameValuePair volume.path { directory = volume.hostPath; }) cfg.volumes;
       limits = {
         memory = lib.mkDefault "2G";
         cpu = lib.mkDefault "200%";

guests/nesting-sample.nix

@@ -1,11 +0,0 @@
-args@{ my, ... }:
-# A sample guest whose interior runs an OCI container on Podman.
-# The image is pulled at runtime, so the guest builds with no build-time fetch.
-my.guest {
-  name = "nesting-sample";
-  interior = {
-    virtualisation.oci-containers.containers.hello = {
-      image = "docker.io/library/hello-world";
-    };
-  };
-} args

guests/reverse-proxy.nix

@@ -1,16 +1,14 @@
 {
   config,
   lib,
-  my,
   ...
 }:
 let
   giteaSshBackend = "10.23.20.45:2022";
 in
 {
-  imports = [
-    (my.guest {
-      name = "reverse-proxy";
+  config = lib.mkIf config.guests.reverse-proxy.enable {
+    guests.reverse-proxy = {
       interior = {
         modules.services.reverse-proxy.enable = true;
 
@@ -66,11 +64,7 @@ in
           }
         '';
       };
-    })
-  ];
 
-  config = lib.mkIf config.guests.reverse-proxy.enable {
-    guests.reverse-proxy = {
       limits = {
         memory = lib.mkDefault "1G";
         cpu = lib.mkDefault "100%";

guests/sample.nix

@@ -1,5 +0,0 @@
-args@{ my, ... }:
-# The tracer-bullet guest: the thinnest complete path from discovery to a
-# running nested container. Its interior is just the guest-base — the baseline
-# toolset and SSH access — so it proves the concept without carrying a service.
-my.guest { name = "sample"; } args