Split system config into tons of modules!

system/security/blocklist.nix

@@ -0,0 +1,9 @@
+{ config, blocklist-hosts, pkgs, ... }:
+
+let blocklist = builtins.readFile "${blocklist-hosts}/alternates/gambling-porn/hosts";
+in
+{
+  networking.extraHosts = ''
+    "${blocklist}"
+  '';
+}

system/security/doas.nix

@@ -0,0 +1,16 @@
+{ config, myName, pkgs, ... }:
+
+{
+  # Doas instead of sudo
+  security.doas.enable = true;
+  security.sudo.enable = false;
+  security.doas.extraRules = [{
+    users = [ "${myName}" ];
+    keepEnv = true;
+    persist = true;
+  }];
+
+  environment.systemPackages = [
+    (pkgs.writeScriptBin "sudo" ''exec doas "$@"'')
+  ];
+}

system/security/firewall.nix

@@ -0,0 +1,11 @@
+{ config, pkgs, ... }:
+
+{
+  # Firewall
+  networking.firewall.enable = true;
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+}

system/security/gpg.nix

@@ -0,0 +1,11 @@
+{ config, pkgs, ... }:
+
+{
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+}

system/security/openvpn.nix

@@ -0,0 +1,6 @@
+{ config, pkgs, ... }:
+
+{
+  environment.systemPackages = [ pkgs.openvpn ];
+  environment.etc.openvpn.source = "${pkgs.update-resolv-conf}/libexec/openvpn";
+}

system/security/sshd.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, ... }:
+
+{
+  # Enable incoming ssh
+  services.openssh = {
+    enable = true;
+    openFirewall = true;
+    # TODO authorizedKeysFiles = "";
+  };
+}