Rewrite modules to options.

Readme.md

@@ -20,7 +20,7 @@
 <a href="https://i.imgur.com/H943DFl.jpeg">Wallpaper link</a>
 </details>
 
-[My current wallpaper](https://git.voronind.com/voronind/nixos/src/branch/main/part/Wallpaper.nix#L2)
+[My current wallpaper](https://git.voronind.com/voronind/nixos/src/branch/main/module/common/Wallpaper.nix#L2)
 
 Color theming based on wallpaper thanks to [Stylix](https://github.com/danth/stylix).
 

android/Termux.nix

@@ -1,11 +1,11 @@
-{ pkgs, style, util, ... }: {
+{ pkgs, config, util, ... }: {
 	font = pkgs.runCommandNoCC "font" {} ''
 		cp ${pkgs.nerdfonts.override { fonts = [ "Terminus" ]; }}/share/fonts/truetype/NerdFonts/TerminessNerdFontMono-Regular.ttf $out
 	'';
 
 	colors = util.trimTabs ''
-		background=#${style.color.bg.dark}
+		background=#${config.module.style.color.bg.dark}
-		foreground=#${style.color.fg.light}
+		foreground=#${config.module.style.color.fg.light}
 	'';
 
 	initScript = util.trimTabs ''

container/Change.nix

@@ -1,6 +1,29 @@
-{ container, ... } @args: let
+{ container, lib, config, ... } @args: with lib; let
-	cfg = container.config.change;
+	cfg = config.container.module.change;
 in {
+	options = {
+		container.module.change = {
+			enable = mkEnableOption "Change detection service";
+			address = mkOption {
+				default = "10.1.0.41";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 5000;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "change.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/change";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 		];
@@ -22,4 +45,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/Cloud.nix

@@ -1,6 +1,32 @@
-{ container, pkgs, ... } @args: let
+{ container, pkgs, lib, config, ... } @args: with lib; let
-	cfg = container.config.cloud;
+	cfg = config.container.module.cloud;
+
+	postgres = config.container.module.postgres;
+	proxy    = config.container.module.proxy;
 in {
+	options = {
+		container.module.cloud = {
+			enable = mkEnableOption "File cloud service";
+			address = mkOption {
+				default = "10.1.0.13";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 80;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "cloud.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/cloud";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 		];
@@ -26,7 +52,7 @@ in {
 						adminuser     = "root";
 						adminpassFile = "${pkgs.writeText "NextcloudPassword" "root"}";
 
-					dbhost     = container.config.postgres.address;
+						dbhost     = postgres.address;
 						dbname     = "nextcloud";
 						dbpassFile = "${pkgs.writeText "NextcloudDbPassword" "nextcloud"}";
 						dbtype     = "pgsql";
@@ -38,10 +64,11 @@ in {
 					extraAppsEnable = true;
 					settings = {
 						trusted_domains = [ cfg.address cfg.domain ];
-					trusted_proxies = [ container.config.proxy.address ];
+						trusted_proxies = [ proxy.address ];
 						allow_local_remote_servers = true;
 					};
 				};
 			};
 		};
+	};
 }

container/Ddns.nix

@@ -1,6 +1,21 @@
-{ container, domain, ... } @args: let
+{ container, lib, config, ... } @args: with lib; let
-	cfg = container.config.ddns;
+	cfg = config.container.module.ddns;
 in {
+	options = {
+		container.module.ddns = {
+			enable = mkEnableOption "Dynamic dns client.";
+			address = mkOption {
+				default = "10.1.0.31";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/ddns";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 		];
@@ -21,7 +36,9 @@ in {
 					ipv4          = true;
 					ipv6          = false;
 					proxied       = false;
-				domains = [ domain ] ++ map (sub: "${sub}.${domain}") [
+					domains = let
+						domain = config.container.domain;
+						in [ domain ] ++ map (sub: "${sub}.${domain}") [
 						"cloud"
 						"git"
 						"mail"
@@ -33,4 +50,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/Dns.nix

@@ -1,20 +1,35 @@
-{ container, pkgs, ... } @args: let
+{ container, pkgs, lib, config, ... } @args: with lib; let
-	cfg = container.config.dns;
+	cfg = config.container.module.dns;
 in {
+	options = {
+		container.module.dns = {
+			enable = mkEnableOption "Dns server.";
+			address = mkOption {
+				default = "10.1.0.6";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 53;
+				type    = types.int;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		containers.dns = container.mkContainer cfg {
 			forwardPorts = [
 				{
-				containerPort = 53;
+					containerPort = cfg.port;
-				hostPort      = 53;
+					hostPort      = cfg.port;
 					protocol      = "udp";
 				} {
-				containerPort = 53;
+					containerPort = cfg.port;
-				hostPort      = 53;
+					hostPort      = cfg.port;
 					protocol      = "tcp";
 				}
 			];
 
-		config = { lib, ... }: container.mkContainerConfig cfg {
+			config = { ... }: container.mkContainerConfig cfg {
 				environment.systemPackages = [
 					pkgs.cloudflared
 				];
@@ -25,7 +40,7 @@ in {
 					wantedBy    = [ "multi-user.target" ];
 					serviceConfig = {
 						Type = "simple";
-					ExecStart = "${lib.getExe pkgs.cloudflared} proxy-dns --port 5054";
+						ExecStart = "${getExe pkgs.cloudflared} proxy-dns --port 5054";
 					};
 				};
 
@@ -102,11 +117,13 @@ in {
 						};
 						customDNS = {
 							mapping = {
-							"voronind.com" = "192.168.1.2";
+								# All subdomains to current host.
+								${config.container.domain} = config.container.host;
 							};
 						};
-					port = "53";
+						port = cfg.port;
-					httpPort = "80";
+						# httpPort = "80";
+					};
 				};
 			};
 		};

container/Download.nix

@@ -1,7 +1,33 @@
-{ container, lib, ... } @args: let
+{ container, lib, config, ... }: with lib; let
-	cfg = container.config.download;
+	cfg = config.container.module.download;
-	memLimit = "4G";
 in {
+	options = {
+		container.module.download = {
+			enable = mkEnableOption "Downloader.";
+			address = mkOption {
+				default = "10.1.0.12";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 8112;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "download.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/download";
+				type    = types.str;
+			};
+			memLimit = mkOption {
+				default = "4G";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 		];
@@ -14,7 +40,7 @@ in {
 					hostPath   = "${cfg.storage}/data";
 					isReadOnly = false;
 				};
-		} // container.attachMedia "download" cfg.download false;
+			} // container.attachMedia "download" false;
 
 			config = { ... }: container.mkContainerConfig cfg {
 				services.deluge = {
@@ -23,7 +49,8 @@ in {
 					web.enable = true;
 				};
 
-			systemd.services.deluged.serviceConfig.MemoryLimit = memLimit;
+				systemd.services.deluged.serviceConfig.MemoryLimit = cfg.memLimit;
+			};
 		};
 	};
 }

container/Git.nix

@@ -1,6 +1,29 @@
-{ container, pkgs, ... } @args: let
+{ container, pkgs, config, lib, ... }: with lib; let
-	cfg = container.config.git;
+	cfg = config.container.module.git;
 in {
+	options = {
+		container.module.git = {
+			enable = mkEnableOption "Git server.";
+			address = mkOption {
+				default = "10.1.0.8";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 3000;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "git.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/git";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 		];
@@ -21,7 +44,7 @@ in {
 					stateDir = "/var/lib/gitea";
 
 					database = let
-					postgre = container.config.postgres;
+						postgre = config.container.module.postgres;
 					in {
 						type = "postgres";
 						host = postgre.address;
@@ -72,4 +95,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/Hdd.nix

@@ -1,7 +1,30 @@
 # ISSUE: Broken, can't read/write sda device.
-{ container, pkgs, ... } @args: let
+{ container, pkgs, config, lib, ... }: with lib; let
-	cfg = container.config.hdd;
+	cfg = config.container.module.hdd;
 in {
+	options = {
+		container.module.hdd = {
+			enable = mkEnableOption "Hdd health monitor.";
+			address = mkOption {
+				default = "10.1.0.10";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 8080;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "hdd.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/hdd";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 		];
@@ -43,4 +66,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/Home.nix

@@ -1,7 +1,26 @@
-{ container, pkgs, util, ... } @args: let
+{ container, pkgs, util, lib, config, ... } @args: with lib; let
-	cfg = container.config.home;
+	cfg = config.container.module.home;
 	package = (pkgs.callPackage ./homer args);
 in {
+	options = {
+		container.module.home = {
+			enable = mkEnableOption "Dashboard.";
+			address = mkOption {
+				default = "10.1.0.18";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 80;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "home.${config.container.domain}";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		containers.home = container.mkContainer cfg {
 			config = { ... }: container.mkContainerConfig cfg {
 				environment.systemPackages = [ package ];
@@ -22,4 +41,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/Iot.nix

@@ -1,6 +1,29 @@
-{ container, ... } @args: let
+{ container, lib, config, ... }: with lib; let
-	cfg = container.config.iot;
+	cfg = config.container.module.iot;
 in {
+	options = {
+		container.module.iot = {
+			enable = mkEnableOption "IoT service.";
+			address = mkOption {
+				default = "10.1.0.27";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 8123;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "iot.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/iot";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 		];
@@ -19,7 +42,7 @@ in {
 					hostPath   = "/dev/serial/by-id";
 					isReadOnly = false;
 				};
-		} // container.attachMedia "photo" cfg.photo true;
+			} // container.attachMedia "photo" true;
 
 			allowedDevices = [
 				{
@@ -67,4 +90,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/Jobber.nix

@@ -1,7 +1,22 @@
-{ container, pkgsJobber, poetry2nixJobber, lib, ... } @args: let
+{ container, pkgsJobber, poetry2nixJobber, lib, config, ... }: with lib; let
-	cfg    = container.config.jobber;
+	cfg    = config.container.module.jobber;
 	script = import ./jobber { poetry2nix = poetry2nixJobber; pkgs = pkgsJobber; };
 in {
+	options = {
+		container.module.jobber = {
+			enable = mkEnableOption "Button pusher Stanley.";
+			address = mkOption {
+				default = "10.1.0.32";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/jobber";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 		];
@@ -47,4 +62,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/Mail.nix

@@ -1,6 +1,31 @@
 # Guide: https://nixos-mailserver.readthedocs.io/en/latest/setup-guide.html
-{ container, domain, pkgs, util, const, ... } @args: let cfg = container.config.mail;
+{ container, pkgs, util, const, lib, config, ... }: with lib; let
+	cfg = config.container.module.mail;
+	domain = config.container.domain;
 in {
+	options = {
+		container.module.mail = {
+			enable = mkEnableOption "Email server.";
+			address = mkOption {
+				default = "10.1.0.5";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 80;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "mail.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/mail";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 			# "data/indices"
@@ -44,7 +69,7 @@ in {
 					isReadOnly = false;
 				};
 				"/acme" = {
-				hostPath   = "${container.config.proxy.storage}/letsencrypt";
+					hostPath   = "${config.container.module.proxy.storage}/letsencrypt";
 					isReadOnly = true;
 				};
 			};
@@ -59,8 +84,8 @@ in {
 
 				mailserver = {
 					enable      = true;
-				fqdn = cfg.domain;
 					domains     = [ domain ];
+					fqdn        = cfg.domain;
 					sendingFqdn = domain;
 
 					# Use `mkpasswd -sm bcrypt`.
@@ -176,4 +201,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/Office.nix

@@ -2,9 +2,32 @@
 # 1. You need to change PSQL tables owner from root to onlyoffice, too. They don't do that automatically for some reason.
 # 2. TODO: Generate JWT secret at /var/lib/onlyoffice/jwt, i.e. 9wLfMGha1YrfvWpb5hyYjZf8pvJQ3swS
 # See https://git.voronind.com/voronind/nixos/issues/74
-{ container, pkgs, util, lib, ... } @args: let
+{ container, pkgs, util, lib, config, ... }: with lib; let
-	cfg = container.config.office;
+	cfg = config.container.module.office;
 in {
+	options = {
+		container.module.office = {
+			enable = mkEnableOption "Office web suite.";
+			address = mkOption {
+				default = "10.1.0.21";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 8000;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "office.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/office";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 		];
@@ -25,17 +48,18 @@ in {
 					hostname = cfg.domain;
 
 					postgresName = dbName;
-				postgresHost = container.config.postgres.address;
+					postgresHost = config.container.module.postgres.address;
 					postgresUser = dbName;
 					postgresPasswordFile = "${pkgs.writeText "OfficeDbPassword" dbName}";
 
 					jwtSecretFile = "/var/lib/onlyoffice/jwt";
 
-				rabbitmqUrl = "amqp://guest:guest@${container.config.rabbitmq.address}:${toString container.config.rabbitmq.port}";
+					rabbitmqUrl = "amqp://guest:guest@${config.container.module.rabbitmq.address}:${toString config.container.module.rabbitmq.port}";
 
 					examplePort = cfg.port;
 					enableExampleServer = true;
 				};
 			};
 		};
+	};
 }

container/Paper.nix

@@ -1,6 +1,29 @@
-{ container, pkgs, util, lib, ... } @args: let
+{ container, pkgs, util, lib, config, ... }: with lib; let
-	cfg = container.config.paper;
+	cfg = config.container.module.paper;
 in {
+	options = {
+		container.module.paper = {
+			enable = mkEnableOption "Paper scans manager.";
+			address = mkOption {
+				default = "10.1.0.40";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 28981;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "paper.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/paper";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 		];
@@ -12,7 +35,7 @@ in {
 					isReadOnly = false;
 				};
 				"/var/lib/paperless/media" = {
-				hostPath   = "${lib.elemAt cfg.paper 0}";
+					hostPath   = "${elemAt config.container.media.paper 0}";
 					isReadOnly = false;
 				};
 			};
@@ -30,14 +53,14 @@ in {
 					settings = {
 						PAPERLESS_URL          = "https://${cfg.domain}";
 						PAPERLESS_ADMIN_USER   = "root";
-					PAPERLESS_DBHOST       = container.config.postgres.address;
+						PAPERLESS_DBHOST       = config.container.module.postgres.address;
 						PAPERLESS_DBENGINE     = "postgresql";
 						PAPERLESS_DBNAME       = "paperless";
 						PAPERLESS_DBPASS       = "paperless";
-					PAPERLESS_DBPORT       = container.config.postgres.port;
+						PAPERLESS_DBPORT       = config.container.module.postgres.port;
 						PAPERLESS_DBUSER       = "paperless";
 						PAPERLESS_OCR_LANGUAGE = "rus";
-					PAPERLESS_REDIS        = "redis://${container.config.redis.address}:${toString container.config.redis.port}";
+						PAPERLESS_REDIS        = "redis://${config.container.module.redis.address}:${toString config.container.module.redis.port}";
 					};
 				};
 
@@ -50,4 +73,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/Pass.nix

@@ -1,6 +1,29 @@
-{ container, ... } @args: let
+{ container, lib, config, ... }: with lib; let
-	cfg = container.config.pass;
+	cfg = config.container.module.pass;
 in {
+	options = {
+		container.module.pass = {
+			enable = mkEnableOption "Password manager";
+			address = mkOption {
+				default = "10.1.0.9";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 8000;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "pass.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/pass";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 		];
@@ -30,4 +53,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/Paste.nix

@@ -1,7 +1,30 @@
-{ pkgs, util, container, ... } @args: let
+{ pkgs, util, container, lib, config, ... } @args: with lib; let
-	cfg = container.config.paste;
+	cfg = config.container.module.paste;
 	package = (pkgs.callPackage ./pastebin args);
 in {
+	options = {
+		container.module.paste = {
+			enable = mkEnableOption "Pastebin.";
+			address = mkOption {
+				default = "10.1.0.14";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 80;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "paste.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/paste";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 			"tmp"
@@ -99,4 +122,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/Postgres.nix

@@ -1,6 +1,25 @@
-{ container, lib, pkgs, ... } @args: let
+{ container, lib, pkgs, config, ... }: with lib; let
-	cfg = container.config.postgres;
+	cfg = config.container.module.postgres;
 in {
+	options = {
+		container.module.postgres = {
+			enable = mkEnableOption "Postgresql server.";
+			address = mkOption {
+				default = "10.1.0.3";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 5432;
+				type    = types.int;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/postgres";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 		];
@@ -16,7 +35,7 @@ in {
 			config = { ... }: container.mkContainerConfig cfg {
 				services.postgresql = let
 					# Populate with services here.
-				configurations = with container.config; {
+					configurations = with config.container.module; {
 						gitea       = git;
 						nextcloud   = cloud;
 						privatebin  = paste;
@@ -26,14 +45,14 @@ in {
 					};
 
 					access = configurations // {
-					all = { address = container.host; };
+						all = { address = config.container.host; };
 					};
 
 					authentication = builtins.foldl' (acc: item: acc + "${item}\n") "" (
-					lib.mapAttrsToList (db: cfg: "host ${db} ${db} ${cfg.address}/32 trust") access
+						mapAttrsToList (db: cfg: "host ${db} ${db} ${cfg.address}/32 trust") access
 					);
 
-				ensureDatabases = [ "root" ] ++ lib.mapAttrsToList (name: _: name) configurations;
+					ensureDatabases = [ "root" ] ++ mapAttrsToList (name: _: name) configurations;
 
 					ensureUsers = map (name: {
 						inherit name;
@@ -54,4 +73,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/Print.nix

@@ -2,10 +2,33 @@
 
 # ipp://192.168.2.237
 # Pantum M6500W-Series
-{ container, pkgs, ... } @args: let
+{ container, pkgs, lib, config, ... }: with lib; let
-	cfg     = container.config.print;
+	cfg     = config.container.module.print;
 	package = pkgs.callPackage ./print args;
 in {
+	options = {
+		container.module.print = {
+			enable = mkEnableOption "Printing server.";
+			address = mkOption {
+				default = "10.1.0.46";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 631;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "print.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/print";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 		];
@@ -32,5 +55,6 @@ in {
 				};
 			};
 		};
+	};
 }
 

container/Proxy.nix

@@ -9,10 +9,29 @@
 # ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
 # ```
 # For certbot to generate new keys: `certbot certonly --manual --manual-public-ip-logging-ok --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory -d "*.voronind.com" -d voronind.com`
-{ domain, util, container, pkgs, ... } @args: let
+{ util, container, pkgs, lib, config, ... } @args: with lib; let
-	cfg = container.config.proxy;
+	cfg = config.container.module.proxy;
 	virtualHosts = util.catSet (util.ls ./proxy/host) args;
 in {
+	options = {
+		container.module.proxy = {
+			enable = mkEnableOption "Proxy server.";
+			address = mkOption {
+				default = "10.1.0.2";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 443;
+				type    = types.int;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/proxy";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"challenge"
 			"letsencrypt"
@@ -70,16 +89,16 @@ in {
 						}
 
 						map $http_accept_language $resume {
-						default https://git.${domain}/voronind/resume/releases/download/latest/voronind_en.pdf;
+							default https://git.${config.container.domain}/voronind/resume/releases/download/latest/voronind_en.pdf;
-						~ru     https://git.${domain}/voronind/resume/releases/download/latest/voronind_ru.pdf;
+							~ru     https://git.${config.container.domain}/voronind/resume/releases/download/latest/voronind_ru.pdf;
 						}
 
 						server {
-						server_name ${domain};
+							server_name ${config.container.domain};
 							listen 443 ssl;
 
-						ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+							ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-						ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+							ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 							include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 							ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 
@@ -90,8 +109,8 @@ in {
 							listen 443 ssl default_server;
 							server_name _;
 
-						ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+							ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-						ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+							ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 							include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 							ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 
@@ -101,4 +120,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/Rabbitmq.nix

@@ -1,6 +1,25 @@
-{ container, pkgs, util, ... } @args: let
+{ container, pkgs, util, lib, config, ... }: with lib; let
-	cfg = container.config.rabbitmq;
+	cfg = config.container.module.rabbitmq;
 in {
+	options = {
+		container.module.rabbitmq = {
+			enable = mkEnableOption "Mqtt server.";
+			address = mkOption {
+				default = "10.1.0.28";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 5672;
+				type    = types.int;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/rabbitmq";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 		];
@@ -25,4 +44,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/Read.nix

@@ -1,6 +1,29 @@
-{ container, lib, pkgs, ... } @args: let
+{ container, lib, pkgs, config, ... }: with lib; let
-	cfg = container.config.read;
+	cfg = config.container.module.read;
 in {
+	options = {
+		container.module.read = {
+			enable = mkEnableOption "Reading server.";
+			address = mkOption {
+				default = "10.1.0.39";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 5000;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "read.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/read";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 		];
@@ -12,8 +35,8 @@ in {
 					isReadOnly = false;
 				};
 			}
-		// container.attachMedia "book"  cfg.book  true
+			// container.attachMedia "book"  true
-		// container.attachMedia "manga" cfg.manga true
+			// container.attachMedia "manga" true
 			;
 
 			config = { ... }: container.mkContainerConfig cfg {
@@ -28,4 +51,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/Redis.nix

@@ -1,6 +1,21 @@
-{ container, pkgs, util, ... } @args: let
+{ container, pkgs, util, lib, config, ... }: with lib; let
-	cfg = container.config.redis;
+	cfg = config.container.module.redis;
 in {
+	options = {
+		container.module.redis = {
+			enable = mkEnableOption "Redis server.";
+			address = mkOption {
+				default = "10.1.0.38";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 6379;
+				type    = types.int;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		containers.redis = container.mkContainer cfg {
 			config = { ... }: container.mkContainerConfig cfg {
 				services.redis.servers.main = {
@@ -11,5 +26,6 @@ in {
 				};
 			};
 		};
+	};
 }
 

container/Search.nix

@@ -1,6 +1,29 @@
-{ container, pkgs, ... } @args: let
+{ container, pkgs, lib, config, ... }: with lib; let
-	cfg = container.config.search;
+	cfg = config.container.module.search;
 in {
+	options = {
+		container.module.search = {
+			enable = mkEnableOption "Search frontend.";
+			address = mkOption {
+				default = "10.1.0.26";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 8080;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "search.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/search";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		containers.search = container.mkContainer cfg {
 			config = { ... }: container.mkContainerConfig cfg {
 				services.searx = {
@@ -16,4 +39,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/Status.nix

@@ -1,6 +1,29 @@
-{ container, ... } @args: let
+{ container, lib, config, ... }: with lib; let
-	cfg = container.config.status;
+	cfg = config.container.module.status;
 in {
+	options = {
+		container.module.status = {
+			enable = mkEnableOption "Status monitor.";
+			address = mkOption {
+				default = "10.1.0.22";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 3001;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "status.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/status";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 		];
@@ -15,8 +38,8 @@ in {
 
 			config = { lib, ... }: container.mkContainerConfig cfg {
 				networking = {
-				nameservers = lib.mkForce [
+					nameservers = mkForce [
-					container.config.dns.address
+						config.container.module.dns.address
 					];
 				};
 
@@ -30,7 +53,8 @@ in {
 				};
 
 				systemd.services.uptime-kuma = {
-				serviceConfig.DynamicUser = lib.mkForce false;
+					serviceConfig.DynamicUser = mkForce false;
+				};
 			};
 		};
 	};

container/Stock.nix

@@ -1,6 +1,29 @@
-{ container, ... } @args: let
+{ container, lib, config, ... }: with lib; let
-	cfg = container.config.stock;
+	cfg = config.container.module.stock;
 in {
+	options = {
+		container.module.stock = {
+			enable = mkEnableOption "Stock management.";
+			address = mkOption {
+				default = "10.1.0.45";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 80;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "stock.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/stock";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 		];
@@ -30,4 +53,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/Vpn.nix

@@ -1,6 +1,39 @@
-{ container, pkgs, ... } @args: let
+{ container, pkgs, lib, config, ... }: with lib; let
-	cfg = container.config.vpn;
+	cfg = config.container.module.vpn;
+
+	wireguardPeers = let
+		mkPeer = name: ip: PublicKey: {
+			inherit PublicKey;
+			PresharedKeyFile = "/var/lib/wireguard/preshared/${name}";
+			AllowedIPs = [ "${ip}/32" ];
+		};
+	in [
+		(mkPeer "dashaphone" "10.1.1.3" "O/3y8+QKEY8UoLVlmbc8xdhs248L4wtQcl1MsBBfoQo=")
+		(mkPeer "laptop"     "10.1.1.9" "xxoCNPSB86zs8L8p+wXhqaIwpNDkiZu1Yjv8sj8XhgY=")
+		(mkPeer "phone"      "10.1.1.5" "bFmFisMqbDpIrAg3o/GiRl9XhceZEVnZtkegZDTL4yg=")
+		(mkPeer "tablet"     "10.1.1.6" "BdslswVc9OgUpEhJd0sugDBmYw44DiS0FbUPT5EjOG0=")
+		(mkPeer "work"       "10.1.1.2" "Pk0AASSInKO9O8RaQEmm1uNrl0cwWTJDcT8rLn7PSA0=")
+	];
 in {
+	options = {
+		container.module.vpn = {
+			enable = mkEnableOption "Vpn server.";
+			address = mkOption {
+				default = "10.1.0.23";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 51820;
+				type    = types.int;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/vpn";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 			"data/preshared"
@@ -41,19 +74,7 @@ in {
 								PrivateKeyFile = "/var/lib/wireguard/privkey";
 								ListenPort     = cfg.port;
 							};
-						wireguardPeers = let
+							inherit wireguardPeers;
-							mkPeer = name: ip: PublicKey: {
-								inherit PublicKey;
-								PresharedKeyFile = "/var/lib/wireguard/preshared/${name}";
-								AllowedIPs = [ "${ip}/32" ];
-							};
-						in [
-							(mkPeer "dashaphone" "10.1.1.3" "O/3y8+QKEY8UoLVlmbc8xdhs248L4wtQcl1MsBBfoQo=")
-							(mkPeer "laptop"     "10.1.1.9" "xxoCNPSB86zs8L8p+wXhqaIwpNDkiZu1Yjv8sj8XhgY=")
-							(mkPeer "phone"      "10.1.1.5" "bFmFisMqbDpIrAg3o/GiRl9XhceZEVnZtkegZDTL4yg=")
-							(mkPeer "tablet"     "10.1.1.6" "BdslswVc9OgUpEhJd0sugDBmYw44DiS0FbUPT5EjOG0=")
-							(mkPeer "work"       "10.1.1.2" "Pk0AASSInKO9O8RaQEmm1uNrl0cwWTJDcT8rLn7PSA0=")
-						];
 						};
 					};
 
@@ -68,5 +89,6 @@ in {
 				};
 			};
 		};
+	};
 }
 

container/Watch.nix

@@ -1,7 +1,33 @@
-{ container, lib, ... } @args: let
+{ container, lib, config, ... }: with lib; let
-	cfg = container.config.watch;
+	cfg = config.container.module.watch;
-	memLimit = "8G";
 in {
+	options = {
+		container.module.watch = {
+			enable = mkEnableOption "Media server.";
+			address = mkOption {
+				default = "10.1.0.11";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 8096;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "watch.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/watch";
+				type    = types.str;
+			};
+			memLimit = mkOption {
+				default = "8G";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.tmpfiles.rules = container.mkContainerDir cfg [
 			"data"
 			"cache"
@@ -22,16 +48,16 @@ in {
 					isReadOnly = false;
 				};
 			}
-		// container.attachMedia "anime"    cfg.anime    true
+			// container.attachMedia "anime"    true
-		// container.attachMedia "download" cfg.download true
+			// container.attachMedia "download" true
-		// container.attachMedia "movie"    cfg.movie    true
+			// container.attachMedia "movie"    true
-		// container.attachMedia "music"    cfg.music    true
+			// container.attachMedia "music"    true
-		// container.attachMedia "photo"    cfg.photo    true
+			// container.attachMedia "photo"    true
-		// container.attachMedia "porn"     cfg.porn     true
+			// container.attachMedia "porn"     true
-		// container.attachMedia "show"     cfg.show     true
+			// container.attachMedia "show"     true
-		// container.attachMedia "study"    cfg.study    true
+			// container.attachMedia "study"    true
-		// container.attachMedia "work"     cfg.work     true
+			// container.attachMedia "work"     true
-		// container.attachMedia "youtube"  cfg.youtube  true
+			// container.attachMedia "youtube"  true
 			;
 
 			allowedDevices = [
@@ -48,7 +74,8 @@ in {
 					dataDir  = "/var/lib/jellyfin";
 				};
 
-			systemd.services.jellyfin.serviceConfig.MemoryLimit = memLimit;
+				systemd.services.jellyfin.serviceConfig.MemoryLimit = cfg.memLimit;
+			};
 		};
 	};
 }

container/Yt.nix

@@ -1,6 +1,29 @@
-{ container, pkgs, ... } @args: let
+{ container, pkgs, lib, config, ... }: with lib; let
-	cfg = container.config.yt;
+	cfg = config.container.module.yt;
 in {
+	options = {
+		container.module.yt = {
+			enable = mkEnableOption "YouTube frontend.";
+			address = mkOption {
+				default = "10.1.0.19";
+				type    = types.str;
+			};
+			port = mkOption {
+				default = 3000;
+				type    = types.int;
+			};
+			domain = mkOption {
+				default = "yt.${config.container.domain}";
+				type    = types.str;
+			};
+			storage = mkOption {
+				default = "${config.container.storage}/yt";
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		containers.yt = container.mkContainer cfg {
 			config = { ... }: container.mkContainerConfig cfg {
 				services.invidious = {
@@ -9,8 +32,8 @@ in {
 					port   = cfg.port;
 					nginx.enable = false;
 					database = {
-					port = container.config.postgres.port;
+						port = config.container.module.postgres.port;
-					host = container.config.postgres.address;
+						host = config.container.module.postgres.address;
 						createLocally = false;
 						passwordFile = "${pkgs.writeText "InvidiousDbPassword" "invidious"}";
 					};
@@ -25,4 +48,5 @@ in {
 				};
 			};
 		};
+	};
 }

container/default.nix

@@ -1,246 +1,55 @@
-{ lib
+{ lib, config, ... }: with lib; let
-, const
+	cfg = config.container;
-, host
+in {
-, storage
+	options = {
-, domain
+		container = {
-, media
+			enable = mkEnableOption "Containers!!";
-, pkgs
-, ... }: {
-	inherit host;
 
-	# Common configuration for all the containers.
+			autoStart = mkOption {
-	mkContainer = config: cfg: lib.recursiveUpdate {
+				default = true;
-		# Start containers with the system by default.
+				type    = types.bool;
-		autoStart = true;
+			};
 
-		# IP Address of the host. This is required for container to have access to the Internet.
+			host = mkOption {
-		hostAddress = host;
+				default = "0.0.0.0";
+				type    = types.str;
+			};
 
-		# Container's IP address.
+			localAccess = mkOption {
-		localAddress = config.address;
+				default = "0.0.0.0";
+				type    = types.str;
+			};
 
-		# Isolate container from other hosts.
+			storage = mkOption {
-		privateNetwork = true;
+				default = "/tmp/container";
-	} cfg;
+				type    = types.str;
+			};
 
-	# Common configuration for the system inside the container.
+			domain = mkOption {
-	mkContainerConfig = config: cfg: lib.recursiveUpdate {
+				default = "local";
-		# HACK: Do not evaluate nixpkgs inside the container. Use host's instead.
+				type    = types.str;
-		nixpkgs.pkgs = lib.mkForce pkgs;
+			};
 
-		# Release version.
+			interface = mkOption {
-		system.stateVersion = const.stateVersion;
+				default = "lo";
+				type    = types.str;
+			};
 
-		# Allow passwordless login as root.
+			media = mkOption {
-		users.users.root.password = "";
+				default = {};
-		users.mutableUsers = false;
+				type    = types.attrs;
+			};
+		};
+	};
 
-		networking = {
+	config = mkIf cfg.enable {
-			# Default DNS servers.
+		# This is the network for all the containers.
-			nameservers = [
+		# They are not available to the external interface by default,
-				"1.1.1.1"
+		# instead they all expose specific ports in their configuration.
-			];
+		networking.nat = {
-
+			enable = true;
-			# HACK: Fix for upstream issue: https://github.com/NixOS/nixpkgs/issues/162686
+			internalInterfaces = [ "ve-+" ];
-			useHostResolvConf = lib.mkForce false;
+			externalInterface = config.container.interface;
-
-			# Disable firewall.
-			firewall.enable = false;
-		};
-	} cfg;
-
-	# Create a directory on the host for container use.
-	mkContainerDir = cfg: dirs: map (path: "d '${cfg.storage}/${path}' 1777 root root - -") dirs;
-
-	# Common configuration for Nginx server.
-	mkServer = cfg: lib.recursiveUpdate {
-		forceSSL = false;
-	} cfg;
-
-	# Attach the host media directory to container.
-	# They will be added to /type/{0..9}
-	attachMedia = type: paths: ro: builtins.listToAttrs (lib.imap0 (i: path:
-		{
-			name = "/${type}/${toString i}";
-			value = {
-				hostPath   = path;
-				isReadOnly = ro;
-			};
-		}
-	) paths);
-
-	# Range of local addresses who have access to sensitive paths like admin panels.
-	# Other addresses will get 403.
-	localAccess = "192.168.1.0/24";
-
-	# Per-container configurations.
-	config = {
-		camera = {
-			address = "192.168.2.249";
-			domain  = "camera.${domain}";
-			port    = "554";
-		};
-		change = {
-			address = "10.1.0.41";
-			port    = 5000;
-			domain  = "change.${domain}";
-			storage = "${storage}/change";
-		};
-		cloud = {
-			address = "10.1.0.13";
-			port    = 80;
-			domain  = "cloud.${domain}";
-			storage = "${storage}/cloud";
-		};
-		ddns = {
-			address = "10.1.0.31";
-			port    = 53;
-			storage = "${storage}/ddns";
-		};
-		dns = {
-			address = "10.1.0.6";
-		};
-		download = {
-			inherit (media) download;
-			address = "10.1.0.12";
-			port    = 8112;
-			domain  = "download.${domain}";
-			storage = "${storage}/download";
-		};
-		git = {
-			address = "10.1.0.8";
-			port    = 3000;
-			domain  = "git.${domain}";
-			storage = "${storage}/git";
-		};
-		hdd = {
-			address = "10.1.0.10";
-			port    = 8080;
-			domain  = "hdd.${domain}";
-			storage = "${storage}/hdd";
-		};
-		home = {
-			address = "10.1.0.18";
-			port    = 80;
-			domain  = "home.${domain}";
-		};
-		iot = {
-			inherit (media) photo;
-			address = "10.1.0.27";
-			domain  = "iot.${domain}";
-			port    = 8123;
-			storage = "${storage}/iot";
-		};
-		jobber = {
-			address = "10.1.0.32";
-			storage = "${storage}/jobber";
-		};
-		mail = {
-			address = "10.1.0.5";
-			domain  = "mail.${domain}";
-			port    = 80;
-			storage = "${storage}/mail";
-		};
-		office = {
-			address = "10.1.0.21";
-			domain  = "office.${domain}";
-			port    = 8000;
-			storage = "${storage}/office";
-		};
-		paper = {
-			inherit (media) paper;
-			address = "10.1.0.40";
-			domain  = "paper.${domain}";
-			port    = 28981;
-			storage = "${storage}/paper";
-		};
-		pass = {
-			address = "10.1.0.9";
-			domain  = "pass.${domain}";
-			port    = 8000;
-			storage = "${storage}/pass";
-		};
-		paste = {
-			address = "10.1.0.14";
-			domain  = "paste.${domain}";
-			port    = 80;
-			storage = "${storage}/paste";
-		};
-		print = {
-			domain  = "print.${domain}";
-			address = "10.1.0.46";
-			port    = 631;
-			storage = "${storage}/print";
-		};
-		printer = {
-			address = "192.168.2.237";
-			domain  = "printer.${domain}";
-			port    = 80;
-		};
-		proxy = {
-			address = "10.1.0.2";
-			port    = 443;
-			storage = "${storage}/proxy";
-		};
-		postgres = {
-			address = "10.1.0.3";
-			port    = 5432;
-			storage = "${storage}/postgres";
-		};
-		rabbitmq = {
-			address = "10.1.0.28";
-			port    = 5672;
-			storage = "${storage}/rabbitmq";
-		};
-		read = {
-			inherit (media) book manga;
-			address = "10.1.0.39";
-			domain  = "read.${domain}";
-			port    = 5000;
-			storage = "${storage}/read";
-		};
-		redis = {
-			address = "10.1.0.38";
-			port    = 6379;
-		};
-		router = {
-			address = "192.168.1.1";
-			domain  = "router.${domain}";
-			port    = 80;
-		};
-		search = {
-			address = "10.1.0.26";
-			domain  = "search.${domain}";
-			port    = 8080;
-		};
-		status = {
-			address = "10.1.0.22";
-			domain  = "status.${domain}";
-			port    = 3001;
-			storage = "${storage}/status";
-		};
-		stock = {
-			address = "10.1.0.45";
-			domain  = "stock.${domain}";
-			port    = 80;
-			storage = "${storage}/stock";
-		};
-		vpn = {
-			address = "10.1.0.23";
-			port    = 51820;
-			storage = "${storage}/vpn";
-		};
-		watch = {
-			inherit (media) anime download movie music photo porn show study work youtube;
-			address = "10.1.0.11";
-			domain  = "watch.${domain}";
-			port    = 8096;
-			storage = "${storage}/watch";
-		};
-		yt = {
-			address = "10.1.0.19";
-			domain  = "yt.${domain}";
-			port    = 3000;
 		};
 	};
 }

container/homer/Config.nix

@@ -1,4 +1,4 @@
-{ pkgs, container, ... }: let
+{ pkgs, config, ... }: let
 	iconTheme = "fa-solid";
 
 	mkGroup = name: icon: items: {
@@ -12,7 +12,7 @@
 		target = "_blank";
 	};
 
-	config = {
+	cfg = {
 		title    = "Dashboard";
 		subtitle = "Home";
 		header = false;
@@ -41,33 +41,32 @@
 		};
 
 		links = [
-			(mkLink "Status" "fa-heartbeat" "https://status.voronind.com")
+			(mkLink "Status" "fa-heartbeat" "https://${config.container.module.status.domain}")
 		];
 
 		services = [
 			(mkGroup "App" "fa-server" [
-				(mkLink "Change"   "fa-user-secret"   "https://${container.config.change.domain}")
+				(mkLink "Change"   "fa-user-secret"   "https://${config.container.module.change.domain}")
-				(mkLink "Cloud"    "fa-cloud"         "https://${container.config.cloud.domain}")
+				(mkLink "Cloud"    "fa-cloud"         "https://${config.container.module.cloud.domain}")
-				(mkLink "Download" "fa-download"      "https://${container.config.download.domain}")
+				(mkLink "Download" "fa-download"      "https://${config.container.module.download.domain}")
-				(mkLink "Git"      "fab fa-git-alt"   "https://${container.config.download.domain}")
+				(mkLink "Git"      "fab fa-git-alt"   "https://${config.container.module.download.domain}")
-				(mkLink "Iot"      "fa-home"          "https://${container.config.iot.domain}")
+				(mkLink "Iot"      "fa-home"          "https://${config.container.module.iot.domain}")
-				(mkLink "Mail"     "fa-envelope"      "https://${container.config.mail.domain}")
+				(mkLink "Mail"     "fa-envelope"      "https://${config.container.module.mail.domain}")
-				(mkLink "Paper"    "fa-paperclip"     "https://${container.config.paper.domain}")
+				(mkLink "Paper"    "fa-paperclip"     "https://${config.container.module.paper.domain}")
-				(mkLink "Pass"     "fa-key"           "https://${container.config.pass.domain}")
+				(mkLink "Pass"     "fa-key"           "https://${config.container.module.pass.domain}")
-				(mkLink "Paste"    "fa-paste"         "https://${container.config.paste.domain}/s")
+				(mkLink "Paste"    "fa-paste"         "https://${config.container.module.paste.domain}/s")
-				(mkLink "Print"    "fa-print"         "https://${container.config.print.domain}")
+				(mkLink "Print"    "fa-print"         "https://${config.container.module.print.domain}")
-				(mkLink "Read"     "fa-book"          "https://${container.config.read.domain}")
+				(mkLink "Read"     "fa-book"          "https://${config.container.module.read.domain}")
-				(mkLink "Search"   "fa-search"        "https://${container.config.search.domain}")
+				(mkLink "Search"   "fa-search"        "https://${config.container.module.search.domain}")
-				(mkLink "Stock"    "fa-boxes-stacked" "https://${container.config.stock.domain}")
+				(mkLink "Stock"    "fa-boxes-stacked" "https://${config.container.module.stock.domain}")
-				(mkLink "Watch"    "fa-film"          "https://${container.config.watch.domain}")
+				(mkLink "Watch"    "fa-film"          "https://${config.container.module.watch.domain}")
-				(mkLink "YouTube"  "fab fa-youtube"   "https://${container.config.yt.domain}")
+				(mkLink "YouTube"  "fab fa-youtube"   "https://${config.container.module.yt.domain}")
 			])
 			(mkGroup "System" "fa-shield" [
-				(mkLink "Camera"       "fa-camera"      "https://${container.config.camera.domain}")
+				(mkLink "Camera"       "fa-camera"     "https://camera.${config.container.domain}")
-				# (mkLink "Hdd"          "fa-hard-drive" "https://${container.config.hdd.domain}")
 				(mkLink "NixOS Search" "fa-snowflake"  "https://search.nixos.org")
-				(mkLink "Printer"      "fa-print"      "https://${container.config.printer.domain}")
+				(mkLink "Printer"      "fa-print"      "https://printer.${config.container.domain}")
-				(mkLink "Router"       "fa-route"      "https://${container.config.router.domain}")
+				(mkLink "Router"       "fa-route"      "https://router.${config.container.domain}")
 			])
 			(mkGroup "Bookmark" "fa-bookmark" [
 				(mkLink "2gis"        "fa-map-location-dot" "https://2gis.ru")
@@ -96,5 +95,5 @@
 		];
 	};
 in {
-	file = (pkgs.formats.yaml {}).generate "HomerConfig" config;
+	file = (pkgs.formats.yaml {}).generate "HomerConfig" cfg;
 }

container/homer/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, pkgs, ... } @args: let
+{ stdenv, pkgs, config, ... } @args: let
 	cfg = (import ./Config.nix args).file;
 in stdenv.mkDerivation (finalAttrs:  {
 	pname   = "Homer";

container/pastebin/Config.nix

@@ -1,4 +1,4 @@
-{ util, container, ... }: {
+{ util, config, ... }: {
 	text = util.trimTabs ''
 		;<?php http_response_code(403); /*
 		; config file for PrivateBin
@@ -220,7 +220,7 @@
 		; example of DB configuration for PostgreSQL
 		class = Database
 		[model_options]
-		dsn = "pgsql:host=${container.config.postgres.address};dbname=privatebin"
+		dsn = "pgsql:host=${config.container.module.postgres.address};dbname=privatebin"
 		tbl = "privatebin_"     ; table prefix
 		usr = "privatebin"
 		pwd = "privatebin"

container/pastebin/default.nix

@@ -1,4 +1,4 @@
-{ php, pkgs, util, ... } @args: let
+{ php, pkgs, util, config, ... } @args: let
 	cfg = pkgs.writeText "PrivateBinConfig" (import ./Config.nix args).text;
 in php.buildComposerProject (finalAttrs:  {
 	pname   = "PrivateBin";

container/proxy/host/Camera.nix

@@ -1,20 +1,22 @@
-{ domain, util, container, ... }: let
+{ util, config, lib, container, ... }: let
-	cfg = container.config.camera;
+	domain  = "camera.${config.container.domain}";
+	address = "192.168.2.249";
+	port    = 554;
 in {
-	${cfg.domain} = container.mkServer {
+	${domain} = container.mkServer {
 		extraConfig = util.trimTabs ''
 			listen 443 ssl;
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
-				return 301 rtsp://${cfg.address}:${cfg.port}/live/main;
+				return 301 rtsp://${address}:${toString port}/live/main;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Change.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, config, container, ... }: let
-	cfg  = container.config.change;
+	cfg  = config.container.module.change;
 	name = "change";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,9 +8,9 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 
 				proxy_pass http://''$${name}$request_uri;
@@ -18,8 +18,8 @@ in {
 				add_header Referrer-Policy 'origin';
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Cloud.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, config, container, ... }: let
-	cfg  = container.config.cloud;
+	cfg  = config.container.module.cloud;
 	name = "cloud";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,9 +8,9 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location ~ ^/(settings/admin|settings/users|settings/apps|login|api) {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
@@ -19,8 +19,8 @@ in {
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Download.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, config, container, ... }: let
-	cfg  = container.config.download;
+	cfg  = config.container.module.download;
 	name = "download";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,15 +8,15 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Git.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, container, config, ... }: let
-	cfg  = container.config.git;
+	cfg  = config.container.module.git;
 	name = "git";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,15 +8,15 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location ~ ^/(admin|api|user) {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
 
 			location /markdown {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 
 				proxy_set_header Content-Type "application/json";
@@ -29,15 +29,15 @@ in {
 			}
 
 			location / {
-				# allow ${container.localAccess};
+				# allow ${config.container.localAccess};
-				# allow ${container.config.status.address};
+				# allow ${config.container.module.status.address};
-				# allow ${container.config.vpn.address};
+				# allow ${config.container.module.vpn.address};
 				# deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Hdd.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, container, config, ... }: let
-	cfg  = container.config.hdd;
+	cfg  = config.container.module.hdd;
 	name = "hdd";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,15 +8,15 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Home.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, config, container, ... }: let
-	cfg  = container.config.home;
+	cfg  = config.container.module.home;
 	name = "home";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,15 +8,15 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Iot.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, container, config, ... }: let
-	cfg  = container.config.iot;
+	cfg  = config.container.module.iot;
 	name = "iot";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,9 +8,9 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 
 				# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -22,8 +22,8 @@ in {
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Mail.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, container, config, ... }: let
-	cfg  = container.config.mail;
+	cfg  = config.container.module.mail;
 	name = "mail";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,15 +8,15 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Office.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, container, config, ... }: let
-	cfg  = container.config.office;
+	cfg  = config.container.module.office;
 	name = "office";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,16 +8,16 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location / {
-				# allow ${container.localAccess};
+				# allow ${config.container.localAccess};
-				# allow ${container.config.status.address};
+				# allow ${config.container.module.status.address};
-				# allow ${container.config.vpn.address};
+				# allow ${config.container.module.vpn.address};
 				# deny all;
 				add_header X-Forwarded-Proto https;
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Paper.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, container, config, ... }: let
-	cfg  = container.config.paper;
+	cfg  = config.container.module.paper;
 	name = "paper";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,15 +8,15 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Pass.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, container, config, ... }: let
-	cfg  = container.config.pass;
+	cfg  = config.container.module.pass;
 	name = "pass";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,15 +8,15 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Paste.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, container, config, ... }: let
-	cfg  = container.config.paste;
+	cfg  = config.container.module.paste;
 	name = "paste";
 in {
 	${cfg.domain} = container.mkServer {
@@ -15,8 +15,8 @@ in {
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Print.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, container, config, ... }: let
-	cfg  = container.config.print;
+	cfg  = config.container.module.print;
 	name = "print";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,9 +8,9 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 
 				proxy_pass http://''$${name}$request_uri;
@@ -20,8 +20,8 @@ in {
 				proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Printer.nix

@@ -1,22 +1,24 @@
-{ domain, util, container, ... }: let
+{ util, container, config, ... }: let
-	cfg  = container.config.printer;
+	address = "192.168.2.237";
+	domain  = "printer.${config.container.domain}";
+	port    = 80;
 	name    = "printer";
 in {
-	${cfg.domain} = container.mkServer {
+	${domain} = container.mkServer {
 		extraConfig = util.trimTabs ''
 			listen 443 ssl;
-			set ''$${name} ${cfg.address}:${toString cfg.port};
+			set ''$${name} ${address}:${toString port};
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Read.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, container, config, ... }: let
-	cfg  = container.config.read;
+	cfg  = config.container.module.read;
 	name = "read";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,15 +8,15 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Router.nix

@@ -1,22 +1,24 @@
-{ domain, util, container, ... }: let
+{ util, container, config, ... }: let
-	cfg  = container.config.router;
+	address = "192.168.1.1";
+	domain  = "router.${config.container.domain}";
+	port    = 80;
 	name    = "router";
 in {
-	${cfg.domain} = container.mkServer {
+	${domain} = container.mkServer {
 		extraConfig = util.trimTabs ''
 			listen 443 ssl;
-			set ''$${name} ${cfg.address}:${toString cfg.port};
+			set ''$${name} ${address}:${toString port};
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Search.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, container, config, ... }: let
-	cfg  = container.config.search;
+	cfg  = config.container.module.search;
 	name = "search";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,15 +8,15 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Status.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, container, config, ... }: let
-	cfg  = container.config.status;
+	cfg  = config.container.module.status;
 	name = "sstatus";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,21 +8,21 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location ~ ^/(dashboard|settings) {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Stock.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, container, config, ... }: let
-	cfg  = container.config.stock;
+	cfg  = config.container.module.stock;
 	name = "stock";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,15 +8,15 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Watch.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, container, config, ... }: let
-	cfg  = container.config.watch;
+	cfg  = config.container.module.watch;
 	name = "watch";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,15 +8,15 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 				proxy_pass http://''$${name}$request_uri;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

container/proxy/host/Yt.nix

@@ -1,5 +1,5 @@
-{ domain, util, container, ... }: let
+{ util, container, config, ... }: let
-	cfg  = container.config.yt;
+	cfg  = config.container.module.yt;
 	name = "yt";
 in {
 	${cfg.domain} = container.mkServer {
@@ -8,9 +8,9 @@ in {
 			set ''$${name} ${cfg.address}:${toString cfg.port};
 
 			location / {
-				allow ${container.localAccess};
+				allow ${config.container.localAccess};
-				allow ${container.config.status.address};
+				allow ${config.container.module.status.address};
-				allow ${container.config.vpn.address};
+				allow ${config.container.module.vpn.address};
 				deny all;
 
 				proxy_pass http://''$${name}$request_uri;
@@ -25,8 +25,8 @@ in {
 				proxy_hide_header X-Content-Type-Options;
 			}
 
-			ssl_certificate /etc/letsencrypt/live/${domain}/fullchain.pem;
+			ssl_certificate /etc/letsencrypt/live/${config.container.domain}/fullchain.pem;
-			ssl_certificate_key /etc/letsencrypt/live/${domain}/privkey.pem;
+			ssl_certificate_key /etc/letsencrypt/live/${config.container.domain}/privkey.pem;
 			include /etc/letsencrypt/conf/options-ssl-nginx.conf;
 			ssl_dhparam /etc/letsencrypt/conf/ssl-dhparams.pem;
 		'';

flake.nix

@@ -137,22 +137,13 @@
 			url = "https://git.voronind.com/voronind/nixos.git";
 		};
 
-		# Common modules used across all the hosts.
+		nixosConfigurations = let
-		nixosModules.common = let
+			# List all files in a dir.
-			# This function allows me to get the list of all the files from the directories I need.
-			# It differs from the util.ls function because it also filters out all the directories.
 			lsFiles = path: map (f: "${path}/${f}") (
 				builtins.filter (i: builtins.readFileType "${path}/${i}" == "regular") (
 					builtins.attrNames (builtins.readDir path)
 				)
 			);
-		in {
-			# Here I import everything from those directories.
-			imports = (lsFiles ./module/common) ++ (lsFiles ./overlay) ++ [
-				./part/Setting.nix
-				./user/Root.nix
-			];
-		};
 
 			# Function to create a host. It does basic setup, like adding common modules.
 			mkHost = { system, hostname, modules } @args: nixpkgs.lib.nixosSystem {
@@ -161,7 +152,7 @@
 				inherit system;
 
 				# List of modules to use by defualt for all the hosts.
-			modules = [
+				modules = modules ++ [
 					# There I put host-specific configurations.
 					./host/${hostname}
 
@@ -171,17 +162,22 @@
 					# Specify current release version.
 					{ system.stateVersion = self.const.stateVersion; }
 
-				# Add common modules.
+					# Add modules.
-				inputs.self.nixosModules.common
+					{ imports =
+						(lsFiles ./container) ++
+						(lsFiles ./module) ++
+						(lsFiles ./module/common) ++
+						(lsFiles ./module/desktop) ++
+						(lsFiles ./overlay) ++
+						(lsFiles ./user);
+					}
 
 					# Add Home Manager module.
 					home-manager.nixosModules.home-manager
 
 					# Add Stylix module.
 					stylix.nixosModules.stylix
-			]
+				];
-			# Also add host-specific modules from mkHost args.
-			++ modules;
 
 				# SpecialArgs allows you to pass objects down to other NixOS modules.
 				specialArgs = let
@@ -192,14 +188,15 @@
 					pkgsJobber = nixpkgsJobber.legacyPackages.${system}.pkgs;
 					pkgsStable = nixpkgsJobber.legacyPackages.${system}.pkgs;
 					pkgsMaster = nixpkgsJobber.legacyPackages.${system}.pkgs;
+
+					secret    = import ./secret {}; # Secrets (public keys).
+					container = import ./lib/Container.nix { inherit lib pkgs config; inherit (self) const; }; # Container utils.
+					util      = import ./lib/Util.nix { inherit pkgs lib; }; # Util functions.
 				in {
-				const     = self.const; # Constant values.
+					flake = self;
-				flake     = self;       # This Flake itself.
+
-				inputs    = inputs;     # Our dependencies.
+					inherit secret container util inputs;
-				secret    = import ./part/Secret.nix    {}; # Secrets (public keys).
+					inherit (self) const;
-				style     = import ./part/Style.nix     { inherit config;   }; # Style abstraction.
-				util      = import ./part/Util.nix      { inherit pkgs lib; }; # Util functions.
-				wallpaper = import ./part/Wallpaper.nix { inherit pkgs;     }; # Wallpaper.
 
 					# Stable and Master pkgs.
 					inherit pkgsStable pkgsMaster;
@@ -209,110 +206,16 @@
 				};
 			};
 
-		# Bellow is the list of all the hosts I currently use.
+			mkSystem = hostname: system: modules: {
-		# They call the `mkHost` function that I defined above
+				"${hostname}" = mkHost {
-		# with their specific parameters.
+					inherit hostname system modules;
-		# You might be interested in `live` and `nixOnDroidConfiguration`
+				};
-		# for Live ISO and Android configurations respectively.
-		nixosConfigurations.basic = self.mkHost {
-			hostname = "basic";        # Hostname to use.
-			system   = "x86_64-linux"; # System architecture.
-
-			# Host-specific modules.
-			modules = [
-				# Force LTS kernel.
-				({ pkgs, ... }: { boot.kernelPackages = nixpkgs.lib.mkForce pkgs.linuxPackages; })
-			];
 			};
 
-		nixosConfigurations.dasha = self.mkHost {
+			liveModules = [
-			hostname = "dasha";
-			system   = "x86_64-linux";
-			modules = [
-				./module/AmdGpu.nix
-				./module/CapsToggle.nix
-				# ./module/Gnome.nix
-				./module/IntelCpu.nix
-				./module/PowersaveIntel.nix
-				./module/Print.nix
-				./module/RemoteBuild.nix
-				./module/StrongSwan.nix
-				./module/Sway.nix
-				./module/Tablet.nix
-				./user/Dasha.nix
-			];
-		};
-
-		nixosConfigurations.desktop = self.mkHost {
-			hostname = "desktop";
-			system   = "x86_64-linux";
-			modules = [
-				./module/AmdCompute.nix
-				./module/AmdCpu.nix
-				./module/AmdGpu.nix
-				./module/Docker.nix
-				./module/Ollama.nix
-				./module/PowersaveAmd.nix
-				./module/Print.nix
-				./module/RemoteBuild.nix
-				./module/Sway.nix
-				./module/VirtManager.nix
-				./user/Voronind.nix
-			];
-		};
-
-		nixosConfigurations.fsight = self.mkHost {
-			hostname = "fsight";
-			system   = "x86_64-linux";
-			modules = [
-				./module/Docker.nix
-			];
-		};
-
-		nixosConfigurations.home = self.mkHost {
-			hostname = "home";
-			system   = "x86_64-linux";
-			modules = [
-				./module/AmdCpu.nix
-				./module/AmdGpu.nix
-				./module/Ftpd.nix
-				./module/RemoteBuilder.nix
-				./module/Sway.nix
-				./user/Voronind.nix
-			];
-		};
-
-		nixosConfigurations.laptop = self.mkHost {
-			hostname = "laptop";
-			system   = "x86_64-linux";
-			modules = [
-				./module/AmdCpu.nix
-				./module/AmdGpu.nix
-				./module/CapsToggle.nix
-				./module/Gnome.nix
-				./module/PowersaveAmd.nix
-				./module/Print.nix
-				./module/RemoteBuild.nix
-				./module/StrongSwan.nix
-				./module/Tablet.nix
-				./user/Dasha.nix
-				./user/Voronind.nix
-			];
-		};
-
-		# Live ISO configuration.
-		nixosConfigurations.live = self.mkHost {
-			hostname = "live";
-			system   = "x86_64-linux";
-			modules = [
-				# Those are basic modules for Live ISO image.
-				# You can discover other possible base images here:
-				# https://github.com/NixOS/nixpkgs/tree/master/nixos/modules/installer/cd-dvd
 				"${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
 				"${nixpkgs}/nixos/modules/installer/cd-dvd/channel.nix"
 
-				# This is required for Live ISO in my case because I use NetworkManager,
-				# but base Live images require this.
 				{ networking.wireless.enable = nixpkgs.lib.mkForce false; }
 
 				# Override my settings to allow SSH logins using root password.
@@ -320,27 +223,29 @@
 				{ services.openssh.settings.PermitRootLogin        = nixpkgs.lib.mkForce "yes"; }
 
 				# Disable auto-updates as they are not possible for Live ISO.
-				{ systemd.services.autoupdate.enable = nixpkgs.lib.mkForce false; }
+				{ module.common.autoupdate.enable = false; }
-				{ systemd.timers.autoupdate.enable   = nixpkgs.lib.mkForce false; }
 
 				# Base Live images also require the LTS kernel.
-				({ pkgs, ... }: { boot.kernelPackages = nixpkgs.lib.mkForce pkgs.linuxPackages; })
+				{ module.common.kernel.latest = false; }
 			];
-		};
 
-		nixosConfigurations.work = self.mkHost {
+			x86System = hostname: mkSystem hostname "x86_64-linux" [];
-			hostname = "work";
+
-			system   = "x86_64-linux";
+			x86LiveSystem = hostname: mkSystem hostname "x86_64-linux" liveModules;
-			modules = [
+		in
-				./module/IntelCpu.nix
+			# Bellow is the list of all the hosts I currently use.
-				./module/PowerlimitThinkpad.nix
+			# They call the `mkSystem` function that I defined above
-				./module/PowersaveIntel.nix
+			# with their specific parameters.
-				./module/Print.nix
+			# You might be interested in `live` and `nixOnDroidConfiguration`
-				./module/RemoteBuild.nix
+			# for Live ISO and Android configurations respectively.
-				./module/Sway.nix
+			(x86System "dasha")   //
-				./user/Voronind.nix
+			(x86System "desktop") //
-			];
+			(x86System "fsight")  //
-		};
+			(x86System "home")    //
+			(x86System "laptop")  //
+			(x86System "work")    //
+			(x86LiveSystem "live")
+			;
 
 		# Android.
 		nixOnDroidConfigurations.default = nix-on-droid.lib.nixOnDroidConfiguration {
@@ -348,9 +253,6 @@
 				# Android release version.
 				{ system.stateVersion = inputs.self.const.droidStateVersion; }
 
-				# Common settings.
-				./part/Setting.nix
-
 				# I put all my Android configuration there.
 				./android
 			];
@@ -364,9 +266,8 @@
 				const   = self.const; # Constant values.
 				flake   = self;       # This Flake itself.
 				inputs  = inputs;     # Our dependencies.
-				secret  = import ./part/Secret.nix  {}; # Secrets (public keys).
+				secret  = import ./lib/Secret.nix  {}; # Secrets (public keys).
-				style   = import ./part/Style.nix   { config = import ./part/style/Gruvbox.nix {}; }; # Style abstraction. Stylix is not available for Android so I provide static Gruvbox style.
+				util    = import ./lib/Util.nix    { inherit pkgs lib; }; # Util functions.
-				util    = import ./part/Util.nix    { inherit pkgs lib; }; # Util functions.
 			};
 		};
 	};

host/basic/default.nix

@@ -1,5 +0,0 @@
-# Basic host is a dummy and has no specific configuration.
-# I don't really need it, this is just a failsafe that I can definitely install and run.
-{ ... }: {
-	imports = [ ];
-}

host/dasha/default.nix

@@ -3,7 +3,15 @@
 		./Filesystem.nix
 	];
 
-	# Disable keyd.
+	user.dasha.enable = true;
-	# services.keyd.enable = lib.mkForce false;
+
-	# systemd.services.keyd-application-mapper.enable = lib.mkForce false;
+	module = {
+		amd.gpu.enable        = true;
+		builder.client.enable = true;
+		desktop.sway.enable   = true;
+		intel.cpu.enable      = true;
+		print.enable          = true;
+		strongswan.enable     = true;
+		tablet.enable         = true;
+	};
 }

host/desktop/default.nix

@@ -3,8 +3,29 @@
 		./Filesystem.nix
 	];
 
-	# Disable docker service.
+	user.voronind.enable = true;
-	systemd.services.docker-prune.enable = lib.mkForce false;
+
-	systemd.services.docker.enable       = lib.mkForce false;
+	module = {
-	systemd.sockets.docker.enable        = lib.mkForce false;
+		builder.client.enable = true;
+		desktop.sway.enable   = true;
+		print.enable          = true;
+		virtmanager.enable    = true;
+		amd = {
+			compute.enable = true;
+			cpu.enable     = true;
+			gpu.enable     = true;
+		};
+		docker = {
+			enable    = true;
+			autostart = false;
+			rootless  = false;
+		};
+		ollama = {
+			enable = true;
+			models = [
+				"llama3"
+				"llama3:70b"
+			];
+		};
+	};
 }

host/fsight/default.nix

@@ -3,4 +3,6 @@
 		./Grub.nix
 		./Root.nix
 	];
+
+	module.docker.enable = true;
 }

host/home/Container.nix

@@ -1,27 +1,40 @@
-{ pkgs
+{ ... }: {
-, const
+	container = {
-, lib
+		enable = true;
-, config
+
-, util
+		module = {
-, poetry2nixJobber
+			change.enable   = true;
-, pkgsJobber
+			cloud.enable    = true;
-, pkgsMaster
+			ddns.enable     = true;
-, pkgsStable
+			dns.enable      = true;
-, ... }: let
+			download.enable = true;
-	args = let
+			git.enable      = true;
-		# Path where all the container data will be stored.
+			# ISSUE: hdd.enable      = true;
+			home.enable     = true;
+			iot.enable      = true;
+			jobber.enable   = true;
+			mail.enable     = true;
+			# ISSUE: office.enable   = true;
+			paper.enable    = true;
+			pass.enable     = true;
+			paste.enable    = true;
+			postgres.enable = true;
+			proxy.enable    = true;
+			rabbitmq.enable = true;
+			read.enable     = true;
+			redis.enable    = true;
+			search.enable   = true;
+			status.enable   = true;
+			stock.enable    = true;
+			vpn.enable      = true;
+			watch.enable    = true;
+			yt.enable       = true;
+		};
+
 		storage   = "/storage/hot/container";
-
-		# Domain used to host stuff. All the services will be like `service.${domain}`.
 		domain    = "voronind.com";
-
-		# External IP address of the host, where all the services will listen to.
 		host      = "192.168.1.2";
-
+		interface = "enp7s0";
-		# External interface where all the services will listen on.
-		externalInterface = "enp7s0";
-
-		# Paths to media content. Later they can be plugged to the containers using the `attachMedia "photo"` function.
 		media = {
 			anime    = [ "/storage/cold_1/media/anime" "/storage/cold_2/media/anime" ];
 			book     = [ "/storage/hot/media/book" ];
@@ -31,59 +44,11 @@
 			music    = [ "/storage/cold_2/media/music" ];
 			paper    = [ "/storage/hot/media/paper" ];
 			porn     = [ "/storage/cold_2/media/porn" ];
-			photo    = [ "${storage}/cloud/data/data/cakee/files/media/photo" "/storage/cold_1/backup/tmp/photo" ];
+			photo    = [ "/storage/hot/container/cloud/data/data/cakee/files/media/photo" "/storage/cold_1/backup/tmp/photo" ];
 			show     = [ "/storage/cold_1/media/show" "/storage/cold_2/media/show" ];
 			study    = [ "/storage/cold_1/media/study" "/storage/cold_2/media/study" ];
 			work     = [ "/storage/cold_2/media/work" ];
 			youtube  = [ "/storage/cold_1/media/youtube" "/storage/cold_2/media/youtube" ];
 		};
-	in {
-		# Pass all the arguments further.
-		inherit storage domain host pkgs const lib config util media externalInterface;
-		inherit poetry2nixJobber pkgsJobber;
-		inherit pkgsMaster pkgsStable;
-
-		# Pass the global container configuration.
-		container = import ../../container args;
-	};
-in {
-	# List of containers enabled on this host.
-	imports = [
-		(import ../../container/Change.nix args)
-		(import ../../container/Cloud.nix args)
-		(import ../../container/Ddns.nix args)
-		(import ../../container/Dns.nix args)
-		(import ../../container/Download.nix args)
-		(import ../../container/Git.nix args)
-		# (import ../../container/Hdd.nix args)
-		(import ../../container/Home.nix args)
-		(import ../../container/Iot.nix args)
-		(import ../../container/Jobber.nix args)
-		(import ../../container/Mail.nix args)
-		(import ../../container/Office.nix args)
-		(import ../../container/Paper.nix args)
-		(import ../../container/Pass.nix args)
-		(import ../../container/Paste.nix args)
-		(import ../../container/Postgres.nix args)
-		(import ../../container/Print.nix args)
-		(import ../../container/Proxy.nix args)
-		(import ../../container/Rabbitmq.nix args)
-		(import ../../container/Read.nix args)
-		(import ../../container/Redis.nix args)
-		(import ../../container/Search.nix args)
-		(import ../../container/Status.nix args)
-		(import ../../container/Stock.nix args)
-		(import ../../container/Vpn.nix args)
-		(import ../../container/Watch.nix args)
-		(import ../../container/Yt.nix args)
-	];
-
-	# This is the network for all the containers.
-	# They are not available to the external interface by default,
-	# instead they all expose specific ports in their configuration.
-	networking.nat = {
-		enable = true;
-		internalInterfaces = [ "ve-+" ];
-		inherit (args) externalInterface;
 	};
 }

host/home/default.nix

@@ -1,4 +1,4 @@
-{ lib, ... }: {
+{ ... }: {
 	imports = [
 		./Backup.nix
 		./Container.nix
@@ -7,7 +7,21 @@
 		./Photoprocess.nix
 	];
 
+	user.voronind.enable = true;
+
+	module = {
+		builder.server.enable = true;
+		desktop.sway.enable   = true;
+		ftpd = {
+			enable  = true;
+			storage = "/storage/hot/ftp";
+		};
+		amd = {
+			cpu.enable = true;
+			gpu.enable = true;
+		};
+	};
+
 	# Disable auto-switch.
-	systemd.services.autoupdate.enable = lib.mkForce false;
+	module.common.autoupdate.enable = false;
-	systemd.timers.autoupdate.enable   = lib.mkForce false;
 }

host/laptop/default.nix

@@ -2,4 +2,21 @@
 	imports = [
 		./Filesystem.nix
 	];
+
+	user = {
+		dasha.enable    = true;
+		voronind.enable = true;
+	};
+
+	module = {
+		builder.client.enable = true;
+		print.enable          = true;
+		strongswan.enable     = true;
+		tablet.enable         = true;
+		amd = {
+			compute.enable = true;
+			cpu.enable     = true;
+			gpu.enable     = true;
+		};
+	};
 }

host/live/default.nix

@@ -1,3 +1 @@
-{ ... }: {
+{ ... }: { }
-	imports = [ ];
-}

host/work/default.nix

@@ -5,4 +5,14 @@
 
 	# Keyd Print to Macro remap.
 	services.keyd.keyboards.default.settings.main.print = "layer(layer_macro)";
+
+	user.voronind.enable = true;
+
+	module = {
+		builder.client.enable      = true;
+		desktop.sway.enable        = true;
+		intel.cpu.enable           = true;
+		powerlimit.thinkpad.enable = true;
+		print.enable               = true;
+	};
 }

lib/Container.nix

@@ -0,0 +1,63 @@
+{ lib, pkgs, const, config, ... }: {
+	mkContainer = cfg: extra: lib.recursiveUpdate {
+		# Start containers with the system by default.
+		autoStart = config.container.autoStart;
+
+		# IP Address of the host. This is required for container to have access to the Internet.
+		hostAddress = config.container.host;
+
+		# Container's IP address.
+		localAddress = cfg.address;
+
+		# Isolate container from other hosts.
+		privateNetwork = true;
+	} extra;
+
+	# Common configuration for the system inside the container.
+	mkContainerConfig = cfg: extra: lib.recursiveUpdate {
+		# HACK: Do not evaluate nixpkgs inside the container. Use host's instead.
+		nixpkgs.pkgs = lib.mkForce pkgs;
+
+		# Release version.
+		system.stateVersion = const.stateVersion;
+
+		# Allow passwordless login as root.
+		users = {
+			users.root.password = "";
+			mutableUsers = false;
+		};
+
+		networking = {
+			# Default DNS servers.
+			nameservers = [
+				"1.1.1.1"
+			];
+
+			# HACK: Fix for upstream issue: https://github.com/NixOS/nixpkgs/issues/162686
+			useHostResolvConf = lib.mkForce false;
+
+			# Disable firewall.
+			firewall.enable = false;
+		};
+	} extra;
+
+	# Create a directory on the host for container use.
+	mkContainerDir = cfg: dirs: map (path: "d '${cfg.storage}/${path}' 1777 root root - -") dirs;
+
+	# Common configuration for Nginx server.
+	mkServer = cfg: lib.recursiveUpdate {
+		forceSSL = false;
+	} cfg;
+
+	# Attach the host media directory to container.
+	# They will be added to /type/{0..9}
+	attachMedia = type: ro: builtins.listToAttrs (lib.imap0 (i: path:
+		{
+			name = "/${type}/${toString i}";
+			value = {
+				hostPath   = path;
+				isReadOnly = ro;
+			};
+		}
+	) config.container.media.${type});
+}

lib/Util.nix

@@ -30,4 +30,6 @@
 		stopIfChanged    = false;
 		unitConfig.X-StopOnRemoval = false;
 	};
+
+
 }

module/AmdCompute.nix

@@ -1,5 +1,11 @@
-# AMD Rocm support (for Blender).
+{ pkgs, lib, config, ... }: with lib; let
-{ nixpkgs, pkgs, ... }: {
+	cfg = config.module.amd.compute;
+in {
+	options = {
+		module.amd.compute.enable = mkEnableOption "Enable AMD Rocm support i.e. for Blender.";
+	};
+
+	config = mkIf cfg.enable {
 		nixpkgs.config.rocmSupport = true;
 		systemd.tmpfiles.rules = [
 			"L+    /opt/rocm/hip   -    -    -     -    ${pkgs.rocmPackages.clr}"
@@ -7,4 +13,5 @@
 		hardware.opengl.extraPackages = with pkgs; [
 			rocmPackages.clr.icd
 		];
+	};
 }

module/AmdCpu.nix

@@ -1,5 +1,27 @@
-# AMD CPU specific configuration.
+{ pkgs, lib, config, ... }: with lib; let
-{ lib, config, ... }: {
+	cfg = config.module.amd.cpu;
+
+	controlFile = "/sys/devices/system/cpu/cpufreq/boost";
+	enableCmd   = "0";
+	disableCmd  = "1";
+in {
+	options = {
+		module.amd.cpu = {
+			enable = mkEnableOption "Enable AMD Cpu support.";
+			powersave.enable = mkEnableOption "Enable AMD Cpu powersave." // { default = true; };
+		};
+	};
+
+	config = mkIf cfg.enable (mkMerge [
+		{
 			boot.kernelModules = [ "kvm-amd" ];
-	hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+			hardware.cpu.amd.updateMicrocode = mkDefault config.hardware.enableRedistributableFirmware;
+		}
+		(mkIf cfg.powersave.enable {
+			module.powersave = {
+				enable = true;
+				cpu.boost = { inherit controlFile enableCmd disableCmd; };
+			};
+		})
+	]);
 }

module/AmdGpu.nix

@@ -1,6 +1,11 @@
-# AMD GPU specific configuration.
+{ pkgs, lib, config, ... }: with lib; let
-# No, I do not own any Nvidia/Intel GPUs, so I have no configuration for them.
+	cfg = config.module.amd.gpu;
-{ nixpkgs, pkgs, ... }: {
+in {
+	options = {
+		module.amd.gpu.enable = mkEnableOption "Enable AMD Gpu support.";
+	};
+
+	config = mkIf cfg.enable {
 		boot.initrd.kernelModules     = [ "amdgpu" ];
 		services.xserver.videoDrivers = [ "amdgpu" ];
 		hardware.opengl.driSupport      = true;
@@ -14,4 +19,5 @@
 		# hardware.opengl.extraPackages32 = with pkgs; [
 		# 	driversi686Linux.amdvlk
 		# ];
+	};
 }

module/CapsToggle.nix

@@ -1,6 +0,0 @@
-# Toggle language with CapsLock. My wife prefers this.
-{ lib, ... }: {
-	services.xserver.xkb = {
-		options = lib.mkForce "grp:caps_toggle";
-	};
-}

module/Docker.nix

@@ -1,3 +1,41 @@
-{ ... }: {
+{ pkgs, lib, config, ... }: with lib; let
+	cfg = config.module.docker;
+in {
+	options = {
+		module.docker = {
+			enable = mkEnableOption "Enable Cocker";
+			rootless = mkOption {
+				default = false;
+				type    = types.bool;
+			};
+			autostart = mkOption {
+				default = true;
+				type    = types.bool;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		virtualisation.docker.enable = true;
+
+		virtualisation.docker.rootless = mkIf cfg.rootless {
+			enable = true;
+			setSocketVariable = true;
+		};
+
+		systemd.services.docker-prune.enable = mkForce cfg.autostart;
+		systemd.services.docker.enable       = mkForce cfg.autostart;
+		systemd.sockets.docker.enable        = mkForce cfg.autostart;
+	};
+
+	# NOTE: mkMerge example.
+	# config = mkIf cfg.enable (mkMerge [
+	# 	{ virtualisation.docker.enable = true; }
+	# 	(mkIf cfg.rootless {
+	# 		virtualisation.docker.rootless = {
+	# 			enable = true;
+	# 			setSocketVariable = true;
+	# 		};
+	# 	})
+	# ]);
 }

module/DockerRootless.nix

@@ -1,7 +0,0 @@
-{ ... }: {
-	virtualisation.docker.enable = true;
-	virtualisation.docker.rootless = {
-		enable = true;
-		setSocketVariable = true;
-	};
-}

module/Ftpd.nix

@@ -1,4 +1,17 @@
-{ ... }: {
+{ pkgs, lib, config, ... }: with lib; let
+	cfg = config.module.ftpd;
+in {
+	options = {
+		module.ftpd = {
+			enable = mkEnableOption "Enable FTP server";
+			storage = mkOption {
+				default = null;
+				type    = types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		services.vsftpd = {
 			enable                  = true;
 			anonymousUser           = true;
@@ -6,7 +19,7 @@
 			anonymousUploadEnable   = true;
 			anonymousMkdirEnable    = true;
 			anonymousUmask          = "000";
-		anonymousUserHome       = "/storage/hot/ftp";
+			anonymousUserHome       = cfg.storage;
 			allowWriteableChroot    = true;
 			writeEnable             = true;
 			localUsers              = false;
@@ -14,4 +27,5 @@
 				anon_other_write_enable=YES
 			'';
 		};
+	};
 }

module/Gnome.nix

@@ -1,48 +0,0 @@
-{ pkgs, lib, ... }: {
-	imports = [
-		./desktop/App.nix
-		./desktop/Dconf.nix
-		./desktop/DisplayManager.nix
-		./desktop/Sound.nix
-		./desktop/Wayland.nix
-	];
-
-	services.xserver.displayManager.gdm.enable   = true;
-	services.xserver.desktopManager.gnome.enable = true;
-
-	environment.systemPackages = with pkgs; [
-		gnome.gnome-tweaks # Gnome "hidden" settings.
-		openssl # It was needed for something, can't remember.
-	];
-
-	# Disable some Gnome apps.
-	services.gnome.gnome-keyring.enable = lib.mkForce false;
-	environment.gnome.excludePackages = with pkgs.gnome; [
-		# baobab      # Disk usage analyzer.
-		# cheese      # Photo booth.
-		# epiphany    # Web browser.
-		# simple-scan # Document scanner.
-		# totem       # Video player.
-		# yelp        # Help viewer.
-		# file-roller # Archive manager.
-		# geary       # Email client.
-		# seahorse    # Password manager.
-
-		# gnome-calculator
-		# gnome-calendar
-		# gnome-characters
-		# gnome-clocks
-		# gnome-contacts
-		# gnome-font-viewer
-		# gnome-keyring
-		# gnome-logs
-		# gnome-maps
-		# gnome-music
-		# gnome-shell-extensions
-		gnome-software
-		# gnome-system-monitor
-		# gnome-weather
-		# gnome-disk-utility
-		# pkgs.gnome-text-editor
-	];
-}

module/IntelCpu.nix

@@ -1,4 +1,27 @@
 # Intel CPU specific configuration.
-{ ... }: {
+{ pkgs, lib, config, ... }: with lib; let
+	cfg = config.module.intel.cpu;
+
+	controlFile = "/sys/devices/system/cpu/intel_pstate/no_turbo";
+	enableCmd  = "1";
+	disableCmd = "0";
+in {
+	options = {
+		module.intel.cpu = {
+			enable = mkEnableOption "Support for Shintel CPUs";
+			powersave.enable = mkEnableOption "Enable Shintel Cpu powersave." // { default = true; };
+		};
+	};
+
+	config = mkIf cfg.enable (mkMerge [
+		{
 			boot.kernelModules = [ "kvm-intel" ];
+		}
+		(mkIf cfg.powersave.enable {
+			module.powersave = {
+				enable = true;
+				cpu.boost = { inherit controlFile enableCmd disableCmd; };
+			};
+		})
+	]);
 }

module/Ollama.nix

@@ -1,13 +1,29 @@
 # https://github.com/ollama/ollama
-{ pkgsStable, lib, config, ... }: let
+{ pkgsStable, lib, config, ... }: with lib; let
 	pkgs = pkgsStable;
+	cfg  = config.module.ollama;
 in {
+	options = {
+		module.ollama = {
+			enable = mkEnableOption "Local LLM server";
+			primaryModel = mkOption {
+				default = "llama3";
+				type    = types.str;
+			};
+			models = mkOption {
+				default = [ cfg.primaryModel ];
+				type    = types.listOf types.str;
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
 		environment = {
 			# Add Ollama CLI app.
 			systemPackages = with pkgs; [ ollama ];
 
 			# Specify default model.
-		variables.OLLAMA_MODEL = config.setting.ollama.primaryModel;
+			variables.OLLAMA_MODEL = cfg.primaryModel;
 		};
 
 		# Enable Ollama server.
@@ -18,7 +34,7 @@ in {
 			after       = [ "NetworkManager-wait-online.service" ];
 			serviceConfig.Type = "simple";
 			script = ''
-			HOME=/root ${lib.getExe pkgs.ollama} serve
+				HOME=/root ${getExe pkgs.ollama} serve
 			'';
 		};
 
@@ -31,7 +47,8 @@ in {
 			serviceConfig.Type = "simple";
 			script = ''
 				sleep 5
-			${lib.getExe pkgs.ollama} pull ${config.setting.ollama.primaryModel}
+				${getExe pkgs.ollama} pull ${concatStringsSep " " cfg.models}
 			'';
 		};
+	};
 }

module/Podman.nix

@@ -0,0 +1,24 @@
+{ lib, config, ... }: with lib; let
+	cfg = config.module.podman;
+in {
+	options = {
+		module.podman = {
+			enable = mkEnableOption "OCI Podman.";
+		};
+	};
+
+	config = mkIf cfg.enable {
+		virtualisation = {
+			podman = {
+				enable = true;
+
+				# Free the 53 port ffs.
+				defaultNetwork.settings.dns_enabled = false;
+
+				# Do not interfere with Docker so we can have both installed at the same time.
+				# Podman can't replace Docker anyway.
+				dockerCompat = false;
+			};
+		};
+	};
+}

module/PowerlimitThinkpad.nix

@@ -1,22 +1,79 @@
 # ThinkPad charge limits.
-{ pkgs, lib, ... } @args: let
+{ pkgs, lib, config, ... } @args: with lib; let
+	cfg = config.module.powerlimit.thinkpad;
+
 	controlFileMin = "/sys/class/power_supply/BAT0/charge_control_start_threshold";
 	controlFileMax = "/sys/class/power_supply/BAT0/charge_control_end_threshold";
 
-	onMin  = "40";
+	script = pkgs.writeShellScriptBin "powerlimit" ''
-	onMax  = "80";
+		function toggle() {
-	offMin = "90";
+			if status; then
-	offMax = "95";
+				echo ${toString cfg.offMax} > ${controlFileMax}
+				echo ${toString cfg.offMin} > ${controlFileMin}
+			else
+				echo ${toString cfg.onMin} > ${controlFileMin}
+				echo ${toString cfg.onMax} > ${controlFileMax}
+			fi
 
-	script = pkgs.writeShellScriptBin "powerlimit" (import ./powerlimit/Script.nix {
+			true
-		inherit controlFileMax controlFileMin onMin onMax offMin offMax;
+		}
-	}).script;
+
+		function waybar() {
+			status || echo -n ""
+		}
+
+		function status() {
+			local current=$(cat ${controlFileMax})
+			local enabled="${toString cfg.onMax}"
+
+			[[ "''${current}" = "''${enabled}" ]]
+		}
+
+		''${@}
+	'';
 in {
-	imports = [
+	options = {
-		(import ./powerlimit ({
+		module.powerlimit.thinkpad = {
-			inherit controlFileMax controlFileMin onMin onMax offMin offMax;
+			enable = mkEnableOption "Powerlimit Service";
-		} // args))
+			onMin = mkOption {
-	];
+				default = 40;
+				type    = types.int;
+			};
+			onMax = mkOption {
+				default = 80;
+				type    = types.int;
+			};
+			offMin = mkOption {
+				default = 90;
+				type    = types.int;
+			};
+			offMax = mkOption {
+				default = 95;
+				type    = types.int;
+			};
+		};
+	};
 
+	config = mkIf cfg.enable {
 		environment.systemPackages = [ script ];
+		systemd = {
+			services.powerlimit = {
+				description = "Limit battery charge.";
+				enable      = true;
+				wantedBy    = [ "multi-user.target" ];
+				serviceConfig = {
+					Type = "simple";
+					RemainAfterExit = "yes";
+					ExecStart = "${getExe pkgs.bash} -c 'echo ${toString cfg.onMin} > ${controlFileMin}; echo ${toString cfg.onMax} > ${controlFileMax};'";
+					ExecStop  = "${getExe pkgs.bash} -c 'echo ${toString cfg.offMax} > ${controlFileMax}; echo ${toString cfg.offMin} > ${controlFileMin};'";
+				};
+			};
+
+			# HACK: Allow user access.
+			tmpfiles.rules = [
+				"z ${controlFileMax} 0777 - - - -"
+				"z ${controlFileMin} 0777 - - - -"
+			];
+		};
+	};
 }

module/Powersave.nix

@@ -0,0 +1,73 @@
+{ lib, config, pkgs, ... }: with lib; let
+	cfg = config.module.powersave;
+
+	script = pkgs.writeShellScriptBin "powersave" ''
+		function toggle() {
+			if status; then
+				echo ${cfg.cpu.boost.disableCmd} > ${cfg.cpu.boost.controlFile}
+			else
+				echo ${cfg.cpu.boost.enableCmd} > ${cfg.cpu.boost.controlFile}
+			fi
+
+			true
+		}
+
+		function waybar() {
+			status || echo -n "󰓅"
+		}
+
+		function status() {
+			local current=$(cat ${cfg.cpu.boost.controlFile})
+			local enabled="${cfg.cpu.boost.enableCmd}"
+
+			[[ "''${current}" = "''${enabled}" ]]
+		}
+
+		''${@}
+	'';
+in {
+	options = {
+		module.powersave = {
+			enable = mkEnableOption "Powersave";
+			cpu.boost = mkOption {
+				default = {};
+				type = types.submodule {
+					options = {
+						disableCmd = mkOption {
+							default = null;
+							type    = types.str;
+						};
+						enableCmd = mkOption {
+							default = null;
+							type    = types.str;
+						};
+						controlFile = mkOption {
+							default = null;
+							type    = types.str;
+						};
+					};
+				};
+			};
+		};
+	};
+
+	config = mkIf cfg.enable {
+		environment.systemPackages = [ script ];
+		systemd = {
+			services.powersave-cpu = {
+				description = "Disable CPU Boost";
+				enable      = true;
+				wantedBy    = [ "multi-user.target" ];
+				serviceConfig = {
+					Type = "simple";
+					RemainAfterExit = "yes";
+					ExecStart = "${getExe pkgs.bash} -c 'echo ${cfg.cpu.boost.enableCmd} > ${cfg.cpu.boost.controlFile}'";
+					ExecStop  = "${getExe pkgs.bash} -c 'echo ${cfg.cpu.boost.disableCmd} > ${cfg.cpu.boost.controlFile}'";
+				};
+			};
+
+			# HACK: Allow user access.
+			tmpfiles.rules = [ "z ${cfg.cpu.boost.controlFile} 0777 - - - -" ];
+		};
+	};
+}

module/PowersaveAmd.nix

@@ -1,21 +0,0 @@
-# AMD CPU boost control.
-{ pkgs, ... } @args: let
-	controlFile = "/sys/devices/system/cpu/cpufreq/boost";
-	enable      = "0";
-	disable     = "1";
-
-	script = pkgs.writeShellScriptBin "powersave" (import ./powersave/Script.nix {
-		inherit controlFile enable disable;
-	}).script;
-in {
-	# Requirements:
-	# CPPC (Collaborative Power Control) - Disabled.
-	# PSS  (Cool and Quiet)              - Enabled.
-	imports = [
-		(import ./powersave ({
-			inherit controlFile enable disable;
-		} // args))
-	];
-
-	environment.systemPackages = [ script ];
-}

module/PowersaveIntel.nix

@@ -1,18 +0,0 @@
-# Intel CPU boost control.
-{ pkgs, ... } @args: let
-	controlFile = "/sys/devices/system/cpu/intel_pstate/no_turbo";
-	enable      = "1";
-	disable     = "0";
-
-	script = pkgs.writeShellScriptBin "powersave" (import ./powersave/Script.nix {
-		inherit controlFile enable disable;
-	}).script;
-in {
-	imports = [
-		(import ./powersave ({
-			inherit controlFile enable disable;
-		} // args))
-	];
-
-	environment.systemPackages = [ script ];
-}

module/Print.nix

@@ -1,4 +1,11 @@
-{ ... }: {
+{ pkgs, lib, config, ... }: with lib; let
+	cfg = config.module.print;
+in {
+	options = {
+		module.print.enable = mkEnableOption "Add support for printers.";
+	};
+
+	config = mkIf cfg.enable {
 		services.printing = {
 			enable = true;
 			clientConf = ''
@@ -6,4 +13,5 @@
 				ServerName 192.168.1.2
 			'';
 		};
+	};
 }

module/RemoteBuild.nix

@@ -1,5 +1,53 @@
 # Module that enables remote builds. This is a client configuration.
-{ lib, secret, ... }: {
+{ pkgs, lib, config, secret, ... }: with lib; let
+	cfg = config.module.builder;
+
+	serverKeyPath = "/root/.nixbuilder";
+in {
+	options = {
+		module.builder = {
+			server.enable = mkEnableOption "This is a builder server.";
+			client.enable = mkEnableOption "This is a builder client.";
+		};
+	};
+
+	config = mkMerge [
+		(mkIf cfg.server.enable {
+			# Service that generates new key on boot if not present.
+			# Don't forget to add new key to secret.ssh.buildKeys.
+			systemd.services.generate-nix-cache-key = {
+				wantedBy = [ "multi-user.target" ];
+				serviceConfig.Type = "oneshot";
+				path = [ pkgs.nix ];
+				script = ''
+					[[ -f "${serverKeyPath}/private-key" ]] && exit
+					mkdir ${serverKeyPath} || true
+					nix-store --generate-binary-cache-key "nixbuilder-1" "${serverKeyPath}/private-key" "${serverKeyPath}/public-key"
+					nix store sign --all -k "${serverKeyPath}/private-key"
+				'';
+			};
+
+			# Add `nixbuilder` restricted user.
+			users.groups.nixbuilder = {};
+			users.users.nixbuilder = {
+				openssh.authorizedKeys.keys = secret.ssh.buildKeys;
+				description  = "Nix Remote Builder";
+				isNormalUser = true;
+				createHome   = lib.mkForce false;
+				uid          = 1234;
+				home         = "/";
+				group        = "nixbuilder";
+			};
+
+			# Sign store automatically.
+			# Sign existing store with: nix store sign --all -k /path/to/secret-key-file
+			nix.settings = {
+				trusted-users    = [ "nixbuilder" ];
+				secret-key-files = [ "${serverKeyPath}/private-key" ];
+			};
+		})
+
+		(mkIf cfg.client.enable {
 			# NOTE: Requires host private key to be present in secret.ssh.builderKeys.
 			nix.buildMachines = [{
 				hostName = "nixbuilder";
@@ -18,7 +66,7 @@
 			nix.settings = let
 				substituters = [ "ssh-ng://nixbuilder" ];
 			in {
-		substituters = lib.mkForce substituters;
+				substituters = mkForce substituters;
 				trusted-substituters = substituters;
 				builders-use-substitutes = true;
 				max-jobs = 0;
@@ -26,4 +74,6 @@
 				# require-sigs = false;
 				# substitute = false;
 			};
+		})
+	];
 }

module/RemoteBuilder.nix

@@ -1,37 +0,0 @@
-# Module that enables remote builds. This is a server configuration.
-{ pkgs, secret, lib, ... }: let
-	keyPath = "/root/.nixbuilder";
-in {
-	# Service that generates new key on boot if not present.
-	# Don't forget to add new key to secret.ssh.buildKeys.
-	systemd.services.generate-nix-cache-key = {
-		wantedBy = [ "multi-user.target" ];
-		serviceConfig.Type = "oneshot";
-		path = [ pkgs.nix ];
-		script = ''
-			[[ -f "${keyPath}/private-key" ]] && exit
-			mkdir ${keyPath} || true
-			nix-store --generate-binary-cache-key "nixbuilder-1" "${keyPath}/private-key" "${keyPath}/public-key"
-			nix store sign --all -k "${keyPath}/private-key"
-		'';
-	};
-
-	# Add `nixbuilder` restricted user.
-	users.groups.nixbuilder = {};
-	users.users.nixbuilder = {
-		openssh.authorizedKeys.keys = secret.ssh.buildKeys;
-		description  = "Nix Remote Builder";
-		isNormalUser = true;
-		createHome   = lib.mkForce false;
-		uid          = 1234;
-		home         = "/";
-		group        = "nixbuilder";
-	};
-
-	# Sign store automatically.
-	# Sign existing store with: nix store sign --all -k /path/to/secret-key-file
-	nix.settings = {
-		trusted-users    = [ "nixbuilder" ];
-		secret-key-files = [ "${keyPath}/private-key" ];
-	};
-}

module/Setting.nix

@@ -5,6 +5,8 @@
 ,lib
 , ... }: {
 	options.setting = with lib; {
+		# Ollama settings.
+		# I use the best light model by default.
 		ollama = mkOption {
 			default = { };
 			type = types.submodule {
@@ -18,6 +20,7 @@
 			};
 		};
 
+		# Default browser settings.
 		browser = mkOption {
 			default = { };
 			type = types.submodule {
@@ -30,6 +33,7 @@
 			};
 		};
 
+		# Terminal settings.
 		terminal = mkOption {
 			default = { };
 			type = types.submodule {
@@ -42,16 +46,19 @@
 			};
 		};
 
+		# Whether to use Dpi-aware setting in supported apps.
 		dpiAware = mkOption {
 			default = false;
 			type    = types.bool;
 		};
 
+		# The key used for system-related shortcuts.
 		sysctrl = mkOption {
 			default = "print";
 			type    = types.str;
 		};
 
+		# Keyboard options.
 		keyboard = mkOption {
 			default = { };
 			type = types.submodule {
@@ -68,6 +75,7 @@
 			};
 		};
 
+		# Settings related to different refreshes, like top apps.
 		refresh = mkOption {
 			default = { };
 			type = types.submodule {
@@ -80,6 +88,7 @@
 			};
 		};
 
+		# Configure steps for different actions.
 		step = mkOption {
 			default = { };
 			type = types.submodule {
@@ -100,6 +109,7 @@
 			};
 		};
 
+		# Specify timeouts.
 		timeout = mkOption {
 			default = { };
 			type = types.submodule {

module/StrongSwan.nix

@@ -1,4 +1,11 @@
-{ pkgs, ... }: {
+{ pkgs, lib, config, ... }: with lib; let
+	cfg = config.module.strongswan;
+in {
+	options = {
+		module.strongswan.enable = mkEnableOption "StrongSwan Vpn support.";
+	};
+
+	config = mkIf cfg.enable {
 		environment.systemPackages = with pkgs; [
 			networkmanager-l2tp
 			gnome.networkmanager-l2tp
@@ -18,4 +25,5 @@
 		# systemd.tmpfiles.rules = [
 		# 	"L /etc/ipsec.secrets - - - - /etc/ipsec.d/ipsec.nm-l2tp.secrets"
 		# ];
+	};
 }

module/Style.nix

@@ -0,0 +1,91 @@
+{ pkgs, lib, config, ... }: with lib; let
+	cfg = config.module.style;
+in {
+	options = let
+		mkTypeOption  = default: type: mkOption { inherit default type; };
+		mkStrOption   = default: mkTypeOption default types.str;
+		mkIntOption   = default: mkTypeOption default types.int;
+		mkFloatOption = default: mkTypeOption default types.float;
+	in {
+		module.style = {
+			color = {
+				bg = {
+					dark    = mkStrOption config.lib.stylix.colors.base00;
+					light   = mkStrOption config.lib.stylix.colors.base07;
+					regular = mkStrOption config.lib.stylix.colors.base01;
+				};
+				fg = {
+					dark    = mkStrOption config.lib.stylix.colors.base04;
+					light   = mkStrOption config.lib.stylix.colors.base06;
+					regular = mkStrOption config.lib.stylix.colors.base05;
+				};
+				accent      = mkStrOption config.lib.stylix.colors.base0A;
+				heading     = mkStrOption config.lib.stylix.colors.base0D;
+				hl          = mkStrOption config.lib.stylix.colors.base03;
+				keyword     = mkStrOption config.lib.stylix.colors.base0E;
+				link        = mkStrOption config.lib.stylix.colors.base09;
+				misc        = mkStrOption config.lib.stylix.colors.base0F;
+				negative    = mkStrOption config.lib.stylix.colors.base08;
+				neutral     = mkStrOption config.lib.stylix.colors.base0C;
+				positive    = mkStrOption config.lib.stylix.colors.base0B;
+				selection   = mkStrOption config.lib.stylix.colors.base02;
+				transparent = mkStrOption "ffffff00";
+
+				accent-b   = mkStrOption config.lib.stylix.colors.base0A-rgb-b;
+				accent-g   = mkStrOption config.lib.stylix.colors.base0A-rgb-g;
+				accent-r   = mkStrOption config.lib.stylix.colors.base0A-rgb-r;
+
+				negative-b = mkStrOption config.lib.stylix.colors.base08-rgb-b;
+				negative-g = mkStrOption config.lib.stylix.colors.base08-rgb-g;
+				negative-r = mkStrOption config.lib.stylix.colors.base08-rgb-r;
+
+				neutral-b  = mkStrOption config.lib.stylix.colors.base0C-rgb-b;
+				neutral-g  = mkStrOption config.lib.stylix.colors.base0C-rgb-g;
+				neutral-r  = mkStrOption config.lib.stylix.colors.base0C-rgb-r;
+
+				positive-b = mkStrOption config.lib.stylix.colors.base0B-rgb-b;
+				positive-g = mkStrOption config.lib.stylix.colors.base0B-rgb-g;
+				positive-r = mkStrOption config.lib.stylix.colors.base0B-rgb-r;
+
+				bg-b = mkStrOption config.lib.stylix.colors.base00-rgb-b;
+				bg-g = mkStrOption config.lib.stylix.colors.base00-rgb-g;
+				bg-r = mkStrOption config.lib.stylix.colors.base00-rgb-r;
+
+				fg-b = mkStrOption config.lib.stylix.colors.base06-rgb-b;
+				fg-g = mkStrOption config.lib.stylix.colors.base06-rgb-g;
+				fg-r = mkStrOption config.lib.stylix.colors.base06-rgb-r;
+
+				border   = mkStrOption config.lib.stylix.colors.base01;
+				border-b = mkStrOption config.lib.stylix.colors.base01-rgb-b;
+				border-g = mkStrOption config.lib.stylix.colors.base01-rgb-g;
+				border-r = mkStrOption config.lib.stylix.colors.base01-rgb-r;
+			};
+
+			font = {
+				emoji.name     = mkStrOption config.stylix.fonts.emoji.name;
+				monospace.name = mkStrOption config.stylix.fonts.monospace.name;
+				sansSerif.name = mkStrOption config.stylix.fonts.sansSerif.name;
+				serif.name     = mkStrOption config.stylix.fonts.serif.name;
+				size = {
+					terminal    = mkIntOption config.stylix.fonts.sizes.terminal;
+					popup       = mkIntOption config.stylix.fonts.sizes.popups;
+					application = mkIntOption config.stylix.fonts.sizes.applications;
+					desktop     = mkIntOption config.stylix.fonts.sizes.desktop;
+				};
+			};
+
+			opacity = {
+				application = mkFloatOption config.stylix.opacity.applications;
+				desktop     = mkFloatOption config.stylix.opacity.desktop;
+				popup       = mkFloatOption config.stylix.opacity.popups;
+				terminal    = mkFloatOption config.stylix.opacity.terminal;
+				hex = mkStrOption "D9";
+			};
+
+			window = {
+				gap    = mkIntOption 8;
+				border = mkIntOption 4;
+			};
+		};
+	};
+}

module/Sway.nix

@@ -1,43 +0,0 @@
-{ pkgs, lib, ... } @args: let
-	sway   = import ./desktop/sway args;
-	config = pkgs.writeText "swayConfig" sway.config;
-	script = pkgs.writeShellScriptBin "swayscript" sway.script;
-in {
-	imports = [
-		./desktop/App.nix
-		./desktop/Bluetooth.nix
-		./desktop/Brightness.nix
-		./desktop/Dconf.nix
-		./desktop/Portal.nix
-		./desktop/Realtime.nix
-		./desktop/Sound.nix
-		./desktop/Waybar.nix
-		./desktop/Wayland.nix
-	];
-
-	services.gnome.gnome-keyring.enable = lib.mkForce false;
-	environment = {
-		systemPackages = with pkgs; [
-			fuzzel                         # Application launcher.
-			grim slurp                     # Screenshot.
-			mako                           # Notification system.
-			networkmanagerapplet           # Internet configuration.
-			pamixer pavucontrol pulseaudio # Audio.
-			playerctl                      # Multimedia controls.
-			script                         # My custom Sway shell scripts.
-		];
-
-		variables.XDG_CURRENT_DESKTOP = "sway";
-	};
-
-	programs.sway = {
-		enable = true;
-		wrapperFeatures = {
-			base = true;
-			gtk  = true;
-		};
-		extraOptions = [
-			"--config=${config}"
-		];
-	};
-}

module/Tablet.nix

@@ -1,6 +1,14 @@
-{ pkgs, ... }: {
+{ pkgs, lib, config, ... }: with lib; let
+	cfg = config.module.tablet;
+in {
+	options = {
+		module.tablet.enable = mkEnableOption "Support for tables.";
+	};
+
+	config = mkIf cfg.enable {
 		hardware.opentabletdriver.enable = true;
 		environment.systemPackages = with pkgs; [
 			krita
 		];
+	};
 }

module/VirtManager.nix

@@ -1,4 +1,11 @@
-{ pkgs, ... }: {
+{ pkgs, lib, config, ... }: with lib; let
+	cfg = config.module.virtmanager;
+in {
+	options = {
+		module.virtmanager.enable = mkEnableOption "VM support.";
+	};
+
+	config = mkIf cfg.enable {
 		virtualisation.libvirtd.enable = true;
 		programs.virt-manager.enable   = true;
 
@@ -8,4 +15,5 @@
 			# glib
 			gnome3.adwaita-icon-theme # default gnome cursors,
 		];
+	};
 }

module/common/Apks.nix

@@ -1,8 +1,17 @@
 # I want to pull all the Apk files in their current state
 # so that I always have an access to clients that match
 # my service versions.
-{ pkgs, ... } @args: let
+{ pkgs, lib, config, ... } @args: with lib; let
+	cfg = config.module.common.apks;
 	package = (pkgs.callPackage ./apks args);
 in {
+	options = {
+		module.common.apks = {
+			enable = mkEnableOption "Android Apps Apk" // { default = true; };
+		};
+	};
+
+	config = mkIf cfg.enable {
 		environment.etc.apks.source = package;
+	};
 }

module/common/AutoUpdateSigned.nix

@@ -2,7 +2,16 @@
 # This is a systemd service that pulls updates every hour.
 # Unlike system.autoUpgrade, this script also verifies my git signature
 # to prevent unathorized changes to hosts.
-{ const, pkgs, lib, secret, util, ... }: {
+{ const, pkgs, lib, util, config, ... }: with lib; let
+	cfg = config.module.common.autoupdate;
+in {
+	options = {
+		module.common.autoupdate = {
+			enable = mkEnableOption "System auto-updates." // { default = true; };
+		};
+	};
+
+	config = mkIf cfg.enable {
 		systemd.services.autoupdate = util.mkStaticSystemdService {
 			enable      = true;
 			description = "Signed system auto-update.";
@@ -17,13 +26,13 @@
 			script = ''
 				pushd /tmp
 				rm -rf ./nixos
-			${lib.getExe pkgs.git} clone --depth=1 --single-branch --branch=main ${const.url} ./nixos
+				${getExe pkgs.git} clone --depth=1 --single-branch --branch=main ${const.url} ./nixos
 				pushd ./nixos
-			${lib.getExe pkgs.git} verify-commit HEAD || {
+				${getExe pkgs.git} verify-commit HEAD || {
 					echo "Verification failed."
 					exit 1
 				};
-			${lib.getExe pkgs.gnumake} switch
+				${getExe pkgs.gnumake} switch
 			'';
 			after = [ "network-online.target" ];
 			wants = [ "network-online.target" ];
@@ -39,4 +48,5 @@
 			};
 			wantedBy = [ "timers.target" ];
 		};
+	};
 }

module/common/Bash.nix

@@ -1,4 +1,4 @@
-{ lib, style, util, pkgs, ... } @args: let
+{ lib, util, pkgs, ... } @args: let
 	bash = import ./bash args;
 in {
 	# Add my bash configuration to all *interactive* shells.

module/common/Distrobox.nix

@@ -1,8 +1,16 @@
-{ pkgs, ... }: {
+{ pkgs, lib, config, ... }: with lib; let
-	# Distrobox works best with Podman, so enable it here.
+	cfg = config.module.common.distrobox;
-	imports = [ ./Podman.nix ];
+in {
+	options = {
+		module.common.distrobox = {
+			enable = mkEnableOption "Distrobox." // { default = true; };
+		};
+	};
 
-	environment.systemPackages = with pkgs; [
+	config = mkIf cfg.enable {
-		distrobox
+		# Distrobox works best with Podman, so enable it here.
-	];
+		module.podman.enable = true;
+
+		environment.systemPackages = with pkgs; [ distrobox ];
+	};
 }

module/common/Filesystem.nix

@@ -13,6 +13,7 @@
 	};
 
 	# /etc overlay.
+	# ISSUE: Should be fixed when you read this. Try it!
 	# boot.initrd.systemd.enable = true;
 	# systemd.sysusers.enable    = true;
 	# system.etc.overlay = {

module/common/Kernel.nix

@@ -1,7 +1,22 @@
-{ pkgs, ... }: {
+{ pkgs, config, lib, ... }: with lib; let
+	cfg = config.module.common.kernel;
+in {
+	options = {
+		module.common.kernel = {
+			latest = mkOption {
+				default = true;
+				type    = types.bool;
+			};
+		};
+	};
+
+	config = mkMerge [
+		(mkIf cfg.latest {
 			# Use latest kernel.
 			boot.kernelPackages = pkgs.linuxPackages_latest;
+		})
 
+		{
 			boot.kernel.sysctl = {
 			# 	# Spoof protection.
 			# 	"net.ipv4.conf.default.rp_filter" = 1;
@@ -56,4 +71,6 @@
 			# 	"net.ipv6.conf.lo.disable_ipv6"      = 1;
 			# 	"net.ipv6.conf.eth0.disable_ipv6"    = 1;
 			};
+		}
+	];
 }

module/common/Keyd.nix

@@ -1,4 +1,13 @@
-{ pkgs, config, ... }: {
+{ pkgs, config, lib, ... }: with lib; let
+	cfg = config.module.common.keyd;
+in {
+	options = {
+		module.common.keyd = {
+			enable = mkEnableOption "Keyboard remaps." // { default = true; };
+		};
+	};
+
+	config = mkIf cfg.enable {
 		environment.systemPackages = with pkgs; [ keyd ];
 
 		services.keyd = {
@@ -85,4 +94,5 @@
 
 		# Debug toggle just in case I need it again.
 		# systemd.services.keyd.environment.KEYD_DEBUG = "1";
+	};
 }