Fix everything.

system/services/general/apparmor/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  security.apparmor.enable = true;
+}

system/services/general/default.nix

@@ -0,0 +1,12 @@
+{ ... }:
+{
+  imports = [
+    ./apparmor
+    ./earlyoom
+    ./libvirtd
+    ./snowflake
+    ./ssh
+    ./tlp
+    ./userborn
+  ];
+}

system/services/general/earlyoom/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.earlyoom.enable = true;
+}

system/services/general/libvirtd/default.nix

@@ -0,0 +1,39 @@
+{ config, lib, pkgs, ... }:
+{
+  options.system.libvirtd.enable = lib.mkEnableOption "Enable libvirtd services";
+
+  config = lib.mkIf config.system.libvirtd.enable {
+    virtualisation.libvirtd = {
+      enable = true;
+      onBoot = "ignore";
+      onShutdown = "shutdown";
+      qemu = {
+        ovmf = {
+          enable = true;
+          packages = with pkgs; [ OVMFFull.fd ];
+        };
+        vhostUserPackages = with pkgs; [ virtiofsd ];
+        swtpm.enable = true;
+      };
+    };
+
+    programs.virt-manager.enable = true;
+
+    environment.persistence."/persist".directories = [
+      "/var/lib/libvirt/dnsmasq"
+      "/var/lib/libvirt/nwfilter"
+      "/var/lib/libvirt/qemu"
+      "/var/lib/libvirt/secrets"
+      "/var/lib/libvirt/storage"
+      "/var/lib/libvirt/swtpm"
+    ];
+
+    # Needed to make NAT work
+    networking.firewall.trustedInterfaces = [
+      "virbr0"
+      "virbr1"
+    ];
+
+    systemd.tmpfiles.rules = [ "f /dev/shm/looking-glass 0660 - libvirtd -" ];
+  };
+}

system/services/general/snowflake/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.snowflake-proxy.enable = true;
+}

system/services/general/ssh/default.nix

@@ -0,0 +1,22 @@
+{ lib, ... }:
+{
+  imports = [ ./fail2ban ];
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = lib.mkForce "no";
+      PrintLastLog = "no";
+      PasswordAuthentication = false;
+      UsePAM = false;
+      X11Forwarding = false;
+    };
+  };
+
+  environment.persistence."/persist".files = [
+    "/etc/ssh/ssh_host_ed25519_key"
+    "/etc/ssh/ssh_host_ed25519_key.pub"
+    "/etc/ssh/ssh_host_rsa_key"
+    "/etc/ssh/ssh_host_rsa_key.pub"
+  ];
+}

system/services/general/ssh/fail2ban/default.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  services.fail2ban = {
+    enable = true;
+    maxretry = 5;
+    bantime = "10m";
+  };
+
+  environment.persistence."/persist".directories = [ "/var/lib/fail2ban" ];
+}

system/services/general/tlp/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.tlp.enable = true;
+}

system/services/general/userborn/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  services.userborn.enable = true;
+}