home/packages/cli/desktop.nix

@@ -1,15 +1,26 @@
-{pkgs, ...}: {
-  # TODO: Only apply this to workstations
-  home.packages = with pkgs; [
-    libnotify # send desktop notifications
-    imagemagick # create/edit images
-    trash-cli # interface to freedesktop trashcan
-    bitwarden-cli # pw manager
-    slides # terminal based presentation tool
-    brightnessctl # brightness control
-    pulsemixer # manage audio (TUI)
-    nix-tree # interactively browse nix store
-    glow # render markdown
-    ffmpeg # record, convert and stream audio and video
-  ];
+{
+  osConfig,
+  lib,
+  pkgs,
+  ...
+}: let
+  inherit (lib) mkIf;
+
+  devType = osConfig.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
+in {
+  config = mkIf (builtins.elem devType acceptedTypes) {
+    home.packages = with pkgs; [
+      libnotify # send desktop notifications
+      imagemagick # create/edit images
+      trash-cli # interface to freedesktop trashcan
+      bitwarden-cli # pw manager
+      slides # terminal based presentation tool
+      brightnessctl # brightness control
+      pulsemixer # manage audio (TUI)
+      nix-tree # interactively browse nix store
+      glow # render markdown
+      ffmpeg # record, convert and stream audio and video
+    ];
+  };
 }

home/programs/terminal/coding/cpp.nix

@@ -1,3 +0,0 @@
-{pkgs, ...}: {
-  home.packages = with pkgs; [ninja];
-}

home/programs/terminal/coding/default.nix

@@ -1,6 +1,5 @@
 {
   imports = [
     ./python
-    ./cpp.nix
   ];
 }

home/programs/terminal/editors/neovim/default.nix

@@ -33,7 +33,6 @@
       nixd
       emmet-language-server
       vscode-langservers-extracted
-      kotlin-language-server
 
       # Linters / formatters
       stylua
@@ -50,7 +49,6 @@
       alejandra
       deadnix
       statix
-      ktlint
 
       # Other tools / utilities
       ripgrep

hosts/default.nix

@@ -4,14 +4,10 @@
 
   # A list of shared modules that ALL systems need
   shared = [
-    ../system/shared
+    ../system
     ../home
     ../options
   ];
-
-  workstationRole = ../system/roles/workstation;
-  laptopRole = ../system/roles/laptop;
-  uniRole = ../system/roles/uni;
 in {
   herugrim = lib.nixosSystem {
     system = "x86_64-linux";
@@ -22,8 +18,6 @@ in {
         inputs.home-manager.nixosModules.home-manager
         inputs.impermanence.nixosModules.impermanence
         inputs.lanzaboote.nixosModules.lanzaboote
-        workstationRole
-        laptopRole
       ]
       ++ shared;
   };
@@ -37,9 +31,6 @@ in {
         inputs.home-manager.nixosModules.home-manager
         inputs.impermanence.nixosModules.impermanence
         inputs.lanzaboote.nixosModules.lanzaboote
-        workstationRole
-        laptopRole
-        uniRole
       ]
       ++ shared;
   };

hosts/voyager/default.nix

@@ -98,11 +98,6 @@
             ".local/share/cargo"
             ".local/share/go"
             ".config/rye"
-
-            # University crap
-            "Android/Sdk"
-            "AndroidStudioProjects"
-            ".android"
           ];
           extraFiles = [
             ".config/gtk-3.0/bookmarks"
@@ -143,7 +138,10 @@
     };
 
     device = {
-      roles.virtual-machine = false;
+      roles = {
+        type = "laptop";
+        virtual-machine = false;
+      };
       cpu.type = "amd";
       gpu.type = "amd";
       hasTPM = true;
@@ -184,10 +182,10 @@
           "eDP-1, 1920x1200@60, 0x1080, 1"
 
           # HDMI-A-1 above primary
-          #"HDMI-A-1, 1920x1080@60, 0x0, 1"
+          "HDMI-A-1, 1920x1080@60, 0x0, 1"
 
           # HDMI-A-1 left to primary
-          "HDMI-A-1, 1920x1080@60, 1920x1080, 1"
+          #"HDMI-A-1, 1920x1080@60, 1920x1080, 1"
 
           # Mirror the primary (laptop) monitor on externals
           ", preferred, auto, 1, mirror, eDP-1"

options/device/roles.nix

@@ -1,11 +1,39 @@
-{lib, ...}: let
-  inherit (lib) mkOption;
+{
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkOption types;
+
+  cfg = config.myOptions.device.roles;
 in {
   options.myOptions.device.roles = {
+    type = mkOption {
+      type = types.enum ["laptop" "desktop" "server"];
+      default = "";
+      description = ''
+        The type/purpoes of the device that will be used within the rest of the configuration.
+          - laptop: portable devices with battery optimizations
+          - desktop: stationary devices configured for maximum performance
+          - server: server and infrastructure
+      '';
+    };
+
     virtual-machine = mkOption {
       type = lib.types.bool;
       default = false;
       description = "Is this system a virtual machine?";
     };
+
+    isWorkstation = mkOption {
+      type = lib.types.bool;
+      default = builtins.elem cfg.type ["laptop" "desktop"];
+      readOnly = true;
+      description = ''
+        Is this machine a workstation?
+
+        Workstation machines are meant for regular day-to-day use.
+      '';
+    };
   };
 }

system/roles/default.nix

@@ -0,0 +1,11 @@
+{
+  # We import all of the roles here, with the type checks being handled
+  # in the individual files each time. This is a bit ugly, but necessary
+  # as NixOS doesn't support optional imports, due to circual imports
+  # (there might be a change of the config value inside one of the
+  # imported files).
+  imports = [
+    ./workstation
+    ./laptop
+  ];
+}

system/roles/laptop/power/acpi.nix

@@ -1,20 +1,27 @@
 {
   pkgs,
+  lib,
   config,
   ...
-}: {
-  hardware.acpilight.enable = true;
+}: let
+  inherit (lib) mkIf;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop"];
+in {
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    hardware.acpilight.enable = true;
 
-  environment.systemPackages = with pkgs; [acpi];
+    environment.systemPackages = with pkgs; [acpi];
 
-  # handle ACPI events
-  services.acpid.enable = true;
+    # handle ACPI events
+    services.acpid.enable = true;
 
-  boot = {
-    kernelModules = ["acpi_call"];
-    extraModulePackages = with config.boot.kernelPackages; [
-      acpi_call
-      cpupower
-    ];
+    boot = {
+      kernelModules = ["acpi_call"];
+      extraModulePackages = with config.boot.kernelPackages; [
+        acpi_call
+        cpupower
+      ];
+    };
   };
 }

system/roles/laptop/power/default.nix

@@ -1,4 +1,13 @@
-{pkgs, ...}: {
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkIf;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop"];
+in {
   imports = [
     ./power-profiles-daemon
     ./upower.nix
@@ -6,7 +15,7 @@
     ./systemd.nix
   ];
 
-  config = {
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
     environment.systemPackages = with pkgs; [powertop];
   };
 }

system/roles/laptop/power/power-profiles-daemon/default.nix

@@ -1,37 +1,43 @@
 {
   pkgs,
   lib,
+  config,
   ...
 }: let
+  inherit (lib) mkIf;
   inherit (lib.modules) mkForce;
   inherit (lib.strings) makeBinPath;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop"];
 in {
-  # allows changing system behavior based upon user-selected power profiles
-  # (with `powerprofilesctl` command)
-  services.power-profiles-daemon.enable = true;
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    # allows changing system behavior based upon user-selected power profiles
+    # (with `powerprofilesctl` command)
+    services.power-profiles-daemon.enable = true;
 
-  # Power state monitor. Switches power profiles based on charging state.
-  # Plugged in - performance (if available, falls back to balance)
-  # Unplugged - balanced, until below 50%, then power-saver
-  systemd.services."power-monitor" = let
-    dependencies = with pkgs; [
-      coreutils
-      gnugrep
-      power-profiles-daemon
-      inotify-tools
-      jaq
-    ];
-  in {
-    description = "Power Monitoring Service";
-    environment.PATH = mkForce "/run/wrappers/bin:${makeBinPath dependencies}";
-    script = builtins.readFile ./power_monitor.sh;
+    # Power state monitor. Switches power profiles based on charging state.
+    # Plugged in - performance (if available, falls back to balance)
+    # Unplugged - balanced, until below 50%, then power-saver
+    systemd.services."power-monitor" = let
+      dependencies = with pkgs; [
+        coreutils
+        gnugrep
+        power-profiles-daemon
+        inotify-tools
+        jaq
+      ];
+    in {
+      description = "Power Monitoring Service";
+      environment.PATH = mkForce "/run/wrappers/bin:${makeBinPath dependencies}";
+      script = builtins.readFile ./power_monitor.sh;
 
-    serviceConfig = {
-      Type = "simple";
-      Restart = "on-failure";
+      serviceConfig = {
+        Type = "simple";
+        Restart = "on-failure";
+      };
+
+      wants = ["power-profiles-daemon.service"];
+      wantedBy = ["default.target"];
     };
-
-    wants = ["power-profiles-daemon.service"];
-    wantedBy = ["default.target"];
   };
 }

system/roles/laptop/power/upower.nix

@@ -1,12 +1,23 @@
 {
-  services = {
-    # DBus service that provides power management support to applications
-    upower = {
-      enable = true;
-      percentageLow = 15;
-      percentageCritical = 5;
-      percentageAction = 3;
-      criticalPowerAction = "Hibernate";
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkIf;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop"];
+in {
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    services = {
+      # DBus service that provides power management support to applications
+      upower = {
+        enable = true;
+        percentageLow = 15;
+        percentageCritical = 5;
+        percentageAction = 3;
+        criticalPowerAction = "Hibernate";
+      };
     };
   };
 }

system/roles/laptop/touchpad.nix

@@ -1,22 +1,32 @@
 {
-  services.libinput = {
-    # enable libinput
-    enable = true;
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkIf;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop"];
+in {
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    services.libinput = {
+      # enable libinput
+      enable = true;
 
-    # disable mouse acceleration
-    mouse = {
-      accelProfile = "flat";
-      accelSpeed = "0";
-      middleEmulation = false;
-    };
+      # disable mouse acceleration
+      mouse = {
+        accelProfile = "flat";
+        accelSpeed = "0";
+        middleEmulation = false;
+      };
 
-    # touchpad settings
-    touchpad = {
-      naturalScrolling = false; # I'm not natural
-      tapping = true;
-      clickMethod = "clickfinger";
-      horizontalScrolling = true;
-      disableWhileTyping = true;
+      # touchpad settings
+      touchpad = {
+        naturalScrolling = false; # I'm not natural
+        tapping = true;
+        clickMethod = "clickfinger";
+        horizontalScrolling = true;
+        disableWhileTyping = true;
+      };
     };
   };
 }

system/roles/uni/android.nix

@@ -1,3 +0,0 @@
-{pkgs, ...}: {
-  environment.systemPackages = [pkgs.android-studio];
-}

system/roles/uni/default.nix

@@ -1,5 +0,0 @@
-{
-  imports = [
-    ./android.nix
-  ];
-}

system/roles/workstation/display/login/greetd.nix

@@ -4,9 +4,12 @@
   lib,
   ...
 }: let
-  inherit (lib) getExe;
+  inherit (lib) mkIf getExe;
   inherit (lib.strings) concatStringsSep;
 
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
+
   greetingMsg = "'Access is restricted to authorized personnel only.'";
   tuiGreetTheme = "'border=magenta;text=cyan;prompt=green;time=red;action=white;button=yellow;container=black;input=gray'";
 
@@ -43,31 +46,33 @@
     ];
   };
 in {
-  services.greetd = {
-    enable = true;
-    vt = 1;
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    services.greetd = {
+      enable = true;
+      vt = 1;
 
-    # <https://man.sr.ht/~kennylevinsen/greetd/>
-    settings = {
-      # default session is what will be used if no session is selected
-      # in this case it'll be a TUI greeter
-      default_session = defaultSession;
+      # <https://man.sr.ht/~kennylevinsen/greetd/>
+      settings = {
+        # default session is what will be used if no session is selected
+        # in this case it'll be a TUI greeter
+        default_session = defaultSession;
+      };
     };
-  };
 
-  # Suppress error messages on tuigreet. They sometimes obscure the TUI
-  # boundaries of the greeter.
-  # See: https://github.com/apognu/tuigreet/issues/68#issuecomment-1586359960
-  systemd.services.greetd.serviceConfig = {
-    Type = "idle";
-    StandardInput = "tty";
-    StandardOutput = "tty";
-    StandardError = "journal";
-    TTYReset = true;
-    TTYVHangup = true;
-    TTYVTDisallocate = true;
-  };
+    # Suppress error messages on tuigreet. They sometimes obscure the TUI
+    # boundaries of the greeter.
+    # See: https://github.com/apognu/tuigreet/issues/68#issuecomment-1586359960
+    systemd.services.greetd.serviceConfig = {
+      Type = "idle";
+      StandardInput = "tty";
+      StandardOutput = "tty";
+      StandardError = "journal";
+      TTYReset = true;
+      TTYVHangup = true;
+      TTYVTDisallocate = true;
+    };
 
-  # Persist info about previous session & user
-  myOptions.system.impermanence.root.extraDirectories = ["/var/cache/tuigreet"];
+    # Persist info about previous session & user
+    myOptions.system.impermanence.root.extraDirectories = ["/var/cache/tuigreet"];
+  };
 }

system/roles/workstation/display/login/pam.nix

@@ -1,25 +1,35 @@
 {
-  # unlock GPG keyring on login
-  security.pam.services = let
-    gnupg = {
-      enable = true;
-      noAutostart = true;
-      storeOnly = true;
-    };
-  in {
-    login = {
-      enableGnomeKeyring = true;
-      inherit gnupg;
-    };
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkIf;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
+in {
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    # unlock GPG keyring on login
+    security.pam.services = let
+      gnupg = {
+        enable = true;
+        noAutostart = true;
+        storeOnly = true;
+      };
+    in {
+      login = {
+        enableGnomeKeyring = true;
+        inherit gnupg;
+      };
 
-    greetd = {
-      enableGnomeKeyring = true;
-      inherit gnupg;
-    };
+      greetd = {
+        enableGnomeKeyring = true;
+        inherit gnupg;
+      };
 
-    tuigreet = {
-      enableGnomeKeyring = true;
-      inherit gnupg;
+      tuigreet = {
+        enableGnomeKeyring = true;
+        inherit gnupg;
+      };
     };
   };
 }

system/roles/workstation/fonts.nix

@@ -1,109 +1,120 @@
-{pkgs, ...}: {
-  fonts = {
-    enableDefaultPackages = false;
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkIf;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
+in {
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    fonts = {
+      enableDefaultPackages = false;
 
-    fontconfig = {
-      defaultFonts = let
-        common = [
-          "Iosevka Nerd Font"
-          "Symbols Nerd Font"
-          "Noto Color Emoji"
-        ];
-      in {
-        monospace =
-          [
-            "Monaspace Krypton"
-            "Source Code Pro Medium"
-            "Source Han Mono"
-          ]
-          ++ common;
-
-        sansSerif =
-          [
-            "Noto Sans"
-            "Jost"
-            "Lexend"
-          ]
-          ++ common;
-
-        serif =
-          [
-            "Noto Serif"
-          ]
-          ++ common;
-
-        emoji =
-          [
+      fontconfig = {
+        defaultFonts = let
+          common = [
+            "Iosevka Nerd Font"
+            "Symbols Nerd Font"
             "Noto Color Emoji"
-          ]
-          ++ common;
+          ];
+        in {
+          monospace =
+            [
+              "Monaspace Krypton"
+              "Source Code Pro Medium"
+              "Source Han Mono"
+            ]
+            ++ common;
+
+          sansSerif =
+            [
+              "Noto Sans"
+              "Jost"
+              "Lexend"
+            ]
+            ++ common;
+
+          serif =
+            [
+              "Noto Serif"
+            ]
+            ++ common;
+
+          emoji =
+            [
+              "Noto Color Emoji"
+            ]
+            ++ common;
+        };
       };
+
+      fontDir = {
+        enable = true;
+        decompressFonts = true;
+      };
+
+      packages = with pkgs; [
+        # programming fonts
+        sarasa-gothic
+        source-code-pro
+        monaspace
+
+        # desktop fonts
+        corefonts # MS fonts
+        b612 # high legibility
+        material-icons
+        material-design-icons
+        roboto
+        work-sans
+        comic-neue
+        source-sans
+        inter
+        lato
+        lexend
+        jost
+        dejavu_fonts
+        noto-fonts
+        noto-fonts-cjk
+
+        # emojis
+        noto-fonts-color-emoji
+        twemoji-color-font
+        openmoji-color
+        openmoji-black
+        font-awesome
+        material-symbols
+
+        # defaults worth keeping
+        dejavu_fonts
+        freefont_ttf
+        gyre-fonts
+        liberation_ttf
+        unifont
+
+        # specific nerd fonts only
+        # (installing all nerd fonts is slow and takes gigabytes)
+        # see: <https://github.com/NixOS/nixpkgs/blob/master/pkgs/data/fonts/nerdfonts/shas.nix>
+        # for all available fonts
+        (nerdfonts.override {
+          fonts = [
+            "JetBrainsMono"
+            "Iosevka"
+            "NerdFontsSymbolsOnly"
+            "FiraCode"
+            "FiraMono"
+            "Hack"
+            "HeavyData"
+            "Gohu"
+          ];
+        })
+      ];
     };
 
-    fontDir = {
-      enable = true;
-      decompressFonts = true;
-    };
-
-    packages = with pkgs; [
-      # programming fonts
-      sarasa-gothic
-      source-code-pro
-      monaspace
-
-      # desktop fonts
-      corefonts # MS fonts
-      b612 # high legibility
-      material-icons
-      material-design-icons
-      roboto
-      work-sans
-      comic-neue
-      source-sans
-      inter
-      lato
-      lexend
-      jost
-      dejavu_fonts
-      noto-fonts
-      noto-fonts-cjk
-
-      # emojis
-      noto-fonts-color-emoji
-      twemoji-color-font
-      openmoji-color
-      openmoji-black
-      font-awesome
-      material-symbols
-
-      # defaults worth keeping
-      dejavu_fonts
-      freefont_ttf
-      gyre-fonts
-      liberation_ttf
-      unifont
-
-      # specific nerd fonts only
-      # (installing all nerd fonts is slow and takes gigabytes)
-      # see: <https://github.com/NixOS/nixpkgs/blob/master/pkgs/data/fonts/nerdfonts/shas.nix>
-      # for all available fonts
-      (nerdfonts.override {
-        fonts = [
-          "JetBrainsMono"
-          "Iosevka"
-          "NerdFontsSymbolsOnly"
-          "FiraCode"
-          "FiraMono"
-          "Hack"
-          "HeavyData"
-          "Gohu"
-        ];
-      })
+    environment.systemPackages = with pkgs; [
+      # Tool for searching and previewing installed fonts
+      font-manager
     ];
   };
-
-  environment.systemPackages = with pkgs; [
-    # Tool for searching and previewing installed fonts
-    font-manager
-  ];
 }

system/roles/workstation/programs/misc.nix

@@ -1,18 +1,28 @@
 {
-  programs = {
-    # allow non-root users to mount fuse filesystems with allow_other
-    fuse.userAllowOther = true;
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkIf;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
+in {
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    programs = {
+      # allow non-root users to mount fuse filesystems with allow_other
+      fuse.userAllowOther = true;
 
-    # show network usage
-    bandwhich.enable = true;
+      # show network usage
+      bandwhich.enable = true;
 
-    # network inspection utility
-    wireshark.enable = true;
+      # network inspection utility
+      wireshark.enable = true;
 
-    # gnome's keyring manager
-    seahorse.enable = true;
+      # gnome's keyring manager
+      seahorse.enable = true;
 
-    # registry for linux (thanks to Gnome)
-    dconf.enable = true;
+      # registry for linux (thanks to Gnome)
+      dconf.enable = true;
+    };
   };
 }

system/roles/workstation/programs/physlock.nix

@@ -1,17 +1,27 @@
 {
-  # Screen locker which works across all virtual terminals
-  # Use `systemctl start physlock` to securely lock the screen
-  services.physlock = {
-    enable = true;
-    lockMessage = "System is locked...";
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkIf;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
+in {
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    # Screen locker which works across all virtual terminals
+    # Use `systemctl start physlock` to securely lock the screen
+    services.physlock = {
+      enable = true;
+      lockMessage = "System is locked...";
 
-    # I only use physlock manually in some circumstances
-    lockOn = {
-      # Don't auto-lock the system with physlock on suspend, I prefer other (gui) lockers
-      suspend = false;
-      # Do use physlock on resuming from hibernation though, as this just restored RAM,
-      # potentially bypassing the login screen and even initial disk encryption password
-      hibernate = true;
+      # I only use physlock manually in some circumstances
+      lockOn = {
+        # Don't auto-lock the system with physlock on suspend, I prefer other (gui) lockers
+        suspend = false;
+        # Do use physlock on resuming from hibernation though, as this just restored RAM,
+        # potentially bypassing the login screen and even initial disk encryption password
+        hibernate = true;
+      };
     };
   };
 }

system/roles/workstation/programs/steam.nix

@@ -5,8 +5,10 @@
 }: let
   inherit (lib) mkIf;
   cfg = config.myOptions.home-manager.programs.games.steam;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
 in {
-  config = mkIf cfg.enable {
+  config = mkIf ((builtins.elem deviceType acceptedTypes) && cfg.enable) {
     programs.steam = {
       enable = true;
       remotePlay.openFirewall = false;

system/roles/workstation/programs/thunar.nix

@@ -1,25 +1,36 @@
-{pkgs, ...}: {
-  # Unconditionally enable thunar file manager here as a relatively
-  # lightweight fallback option for my default file manager.
-  programs.thunar = {
-    enable = true;
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}: let
+  inherit (lib) mkIf;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
+in {
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    # Unconditionally enable thunar file manager here as a relatively
+    # lightweight fallback option for my default file manager.
+    programs.thunar = {
+      enable = true;
 
-    plugins = with pkgs.xfce; [
-      thunar-archive-plugin
-      thunar-media-tags-plugin
-    ];
+      plugins = with pkgs.xfce; [
+        thunar-archive-plugin
+        thunar-media-tags-plugin
+      ];
+    };
+
+    environment = {
+      systemPackages = with pkgs; [
+        # packages necessery for thunar thumbnails
+        xfce.tumbler
+        libgsf # odf files
+        ffmpegthumbnailer
+        ark # GUI archiver for thunar archive plugin
+      ];
+    };
+
+    # thumbnail support on thunar
+    services.tumbler.enable = true;
   };
-
-  environment = {
-    systemPackages = with pkgs; [
-      # packages necessery for thunar thumbnails
-      xfce.tumbler
-      libgsf # odf files
-      ffmpegthumbnailer
-      ark # GUI archiver for thunar archive plugin
-    ];
-  };
-
-  # thumbnail support on thunar
-  services.tumbler.enable = true;
 }

system/roles/workstation/programs/virtualbox.nix

@@ -6,8 +6,10 @@
   inherit (lib) mkIf;
   cfgUser = config.myOptions.system.username;
   cfg = config.myOptions.home-manager.programs.applications.virtualbox;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
 in {
-  config = mkIf cfg.enable {
+  config = mkIf ((builtins.elem deviceType acceptedTypes) && cfg.enable) {
     virtualisation.virtualbox.host = {
       enable = true;
 

system/roles/workstation/programs/wireshark.nix

@@ -7,8 +7,10 @@
   inherit (lib) mkIf;
   cfgUser = config.myOptions.system.username;
   cfg = config.myOptions.home-manager.programs.applications.wireshark;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
 in {
-  config = mkIf cfg.enable {
+  config = mkIf ((builtins.elem deviceType acceptedTypes) && cfg.enable) {
     programs.wireshark = {
       enable = true;
       package = pkgs.wireshark;

system/roles/workstation/runners.nix

@@ -1,49 +1,57 @@
 {
+  config,
   pkgs,
   lib,
   ...
-}: {
-  environment.systemPackages = [pkgs.appimage-run];
+}: let
+  inherit (lib) mkIf;
 
-  # run appimages with appimage-run
-  boot.binfmt.registrations = lib.genAttrs ["appimage" "AppImage"] (_: {
-    wrapInterpreterInShell = false;
-    interpreter = "${pkgs.appimage-run}/bin/appimage-run";
-    recognitionType = "magic";
-    offset = 0;
-    mask = "\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xff\\xff\\xff";
-    magicOrExtension = "\\x7fELF....AI\\x02";
-  });
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
+in {
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    environment.systemPackages = [pkgs.appimage-run];
 
-  # run unpatched linux binaries with nix-ld
-  programs.nix-ld = {
-    enable = true;
-    libraries = with pkgs; [
-      stdenv.cc.cc
-      openssl
-      curl
-      glib
-      util-linux
-      glibc
-      icu
-      libunwind
-      libuuid
-      zlib
-      libsecret
-      # graphical
-      freetype
-      libglvnd
-      libnotify
-      SDL2
-      vulkan-loader
-      gdk-pixbuf
-      xorg.libX11
-    ];
+    # run appimages with appimage-run
+    boot.binfmt.registrations = lib.genAttrs ["appimage" "AppImage"] (_: {
+      wrapInterpreterInShell = false;
+      interpreter = "${pkgs.appimage-run}/bin/appimage-run";
+      recognitionType = "magic";
+      offset = 0;
+      mask = "\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xff\\xff\\xff";
+      magicOrExtension = "\\x7fELF....AI\\x02";
+    });
+
+    # run unpatched linux binaries with nix-ld
+    programs.nix-ld = {
+      enable = true;
+      libraries = with pkgs; [
+        stdenv.cc.cc
+        openssl
+        curl
+        glib
+        util-linux
+        glibc
+        icu
+        libunwind
+        libuuid
+        zlib
+        libsecret
+        # graphical
+        freetype
+        libglvnd
+        libnotify
+        SDL2
+        vulkan-loader
+        gdk-pixbuf
+        xorg.libX11
+      ];
+    };
+
+    # Some pre-compiled binaries hard-code ssl cert file to /etc/ssl/cert.pem
+    # instead of what NixOS uses (/etc/ssl/certs/ca-certificates.crt). Make a
+    # symlink there for compatibility.
+    # - For example the rye installed python binaries look there
+    environment.etc."ssl/cert.pem".source = "/etc/ssl/certs/ca-certificates.crt";
   };
-
-  # Some pre-compiled binaries hard-code ssl cert file to /etc/ssl/cert.pem
-  # instead of what NixOS uses (/etc/ssl/certs/ca-certificates.crt). Make a
-  # symlink there for compatibility.
-  # - For example the rye installed python binaries look there
-  environment.etc."ssl/cert.pem".source = "/etc/ssl/certs/ca-certificates.crt";
 }

system/roles/workstation/services/default.nix

@@ -6,6 +6,5 @@
     ./misc.nix
     ./logind.nix
     ./gnome-keyring.nix
-    ./flatpak.nix
   ];
 }

system/roles/workstation/services/earlyoom.nix

@@ -1,22 +1,33 @@
-{pkgs, ...}: {
-  # https://dataswamp.org/~solene/2022-09-28-earlyoom.html
-  # avoid the linux kernel locking itself when we're putting too much strain on the memory
-  # this helps avoid having to shut down forcefully when we OOM
-  services.earlyoom = {
-    enable = true;
-    enableNotifications = true; # annoying, but we want to know what's killed
-    freeSwapThreshold = 2;
-    freeMemThreshold = 2;
-    extraArgs = [
-      "-g" # kill all processes within a process group
-      "--avoid 'Hyprland|soffice|soffice.bin|firefox|thunderbird)$'" # things we want to not kill
-      "--prefer '^(electron|.*.exe)$'" # I wish we could kill electron permanently
-    ];
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkIf;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
+in {
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    # https://dataswamp.org/~solene/2022-09-28-earlyoom.html
+    # avoid the linux kernel locking itself when we're putting too much strain on the memory
+    # this helps avoid having to shut down forcefully when we OOM
+    services.earlyoom = {
+      enable = true;
+      enableNotifications = true; # annoying, but we want to know what's killed
+      freeSwapThreshold = 2;
+      freeMemThreshold = 2;
+      extraArgs = [
+        "-g" # kill all processes within a process group
+        "--avoid 'Hyprland|soffice|soffice.bin|firefox|thunderbird)$'" # things we want to not kill
+        "--prefer '^(electron|.*.exe)$'" # I wish we could kill electron permanently
+      ];
 
-    # we should ideally write the logs into a designated log file; or even better, to the journal
-    # for now we can hope this echo sends the log to somewhere we can observe later
-    killHook = pkgs.writeShellScript "earlyoom-kill-hook" ''
-      echo "Process $EARLYOOM_NAME ($EARLYOOM_PID) was killed"
-    '';
+      # we should ideally write the logs into a designated log file; or even better, to the journal
+      # for now we can hope this echo sends the log to somewhere we can observe later
+      killHook = pkgs.writeShellScript "earlyoom-kill-hook" ''
+        echo "Process $EARLYOOM_NAME ($EARLYOOM_PID) was killed"
+      '';
+    };
   };
 }

system/roles/workstation/services/flatpak.nix

@@ -1,3 +0,0 @@
-{
-  services.flatpak.enable = true;
-}

system/roles/workstation/services/gnome-keyring.nix

@@ -1,14 +1,25 @@
-{pkgs, ...}: {
-  services = {
-    udev.packages = with pkgs; [gnome.gnome-settings-daemon];
-    gnome.gnome-keyring.enable = true;
-  };
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkIf;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
+in {
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    services = {
+      udev.packages = with pkgs; [gnome.gnome-settings-daemon];
+      gnome.gnome-keyring.enable = true;
+    };
 
-  # seahorse is an application for managing encryption keys
-  # and passwords in the gnome keyring
-  programs.seahorse.enable = true;
+    # seahorse is an application for managing encryption keys
+    # and passwords in the gnome keyring
+    programs.seahorse.enable = true;
 
-  xdg.portal.config.common = {
-    "org.freedesktop.impl.portal.Secret" = ["gnome-keyring"];
+    xdg.portal.config.common = {
+      "org.freedesktop.impl.portal.Secret" = ["gnome-keyring"];
+    };
   };
 }

system/roles/workstation/services/logind.nix

@@ -1,12 +1,22 @@
 {
-  # despite being under logind, this has nothing to do with login
-  # it's about power management
-  services.logind = {
-    lidSwitch = "suspend";
-    lidSwitchExternalPower = "suspend";
-    extraConfig = ''
-      HandlePowerKey=suspend
-      HibernateDelaySec=3600
-    '';
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkIf;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
+in {
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    # despite being under logind, this has nothing to do with login
+    # it's about power management
+    services.logind = {
+      lidSwitch = "suspend";
+      lidSwitchExternalPower = "suspend";
+      extraConfig = ''
+        HandlePowerKey=suspend
+        HibernateDelaySec=3600
+      '';
+    };
   };
 }

system/roles/workstation/services/misc.nix

@@ -1,9 +1,20 @@
 {
-  services = {
-    # enable GVfs - a userspace virtual filesystem
-    gvfs.enable = true;
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf;
 
-    # storage daemon required for udiskie auto-mount
-    udisks2.enable = true;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
+in {
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    services = {
+      # enable GVfs - a userspace virtual filesystem
+      gvfs.enable = true;
+
+      # storage daemon required for udiskie auto-mount
+      udisks2.enable = true;
+    };
   };
 }

system/roles/workstation/services/mount.nix

@@ -1,10 +1,20 @@
-{config, ...}: {
-  services = {
-    # enable GVfs, a userspace virtual filesystem
-    # (allows viewing ftp,sftp,... directly from the file manager)
-    gvfs.enable = true;
+{
+  lib,
+  config,
+  ...
+}: let
+  inherit (lib) mkIf;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
+in {
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    services = {
+      # enable GVfs, a userspace virtual filesystem
+      # (allows viewing ftp,sftp,... directly from the file manager)
+      gvfs.enable = true;
 
-    # Storage daemon required for udiskie auto-mount
-    udisks2.enable = !config.boot.isContainer;
+      # Storage daemon required for udiskie auto-mount
+      udisks2.enable = !config.boot.isContainer;
+    };
   };
 }

system/roles/workstation/services/printing.nix

@@ -5,11 +5,13 @@
   ...
 }: let
   inherit (lib) mkIf optional;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
 
   cfg = config.myOptions.workstation.printing;
   cfgUser = config.myOptions.system.username;
 in {
-  config = mkIf cfg.enable {
+  config = mkIf (builtins.elem deviceType acceptedTypes && cfg.enable) {
     # enable cups and add some drivers for common printers
     services = {
       printing = {