Bunch of stuff to get this ready for a two user system

system/settings/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  imports = [
+    ./minimal
+    ./nix
+    ./security
+    ./timezone
+  ];
+}

system/settings/minimal/default.nix

@@ -0,0 +1,21 @@
+{ ... }:
+{
+  environment = {
+    defaultPackages = [ ];
+    stub-ld.enable = false;
+  };
+
+  documentation = {
+    doc.enable = false;
+    info.enable = false;
+    nixos.enable = false;
+  };
+
+  programs = {
+    nano.enable = false;
+    less.lessopen = null;
+    command-not-found.enable = false;
+  };
+
+  services.logrotate.enable = false;
+}

system/settings/nix/default.nix

@@ -0,0 +1,23 @@
+{ config, lib, pkgs, unstable, ... }:
+{
+  imports = [ ./gc ];
+
+  options.nixpkgs.allowUnfreePackages = lib.mkOption {
+    type = with lib.types; listOf str;
+  };
+
+  config = {
+    nix.settings = {
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      auto-optimise-store = true;
+    };
+
+    _module.args.pkgsUnstable = import unstable {
+      inherit (pkgs.stdenv.hostPlatform) system;
+      inherit (config.nixpkgs) config;
+    };
+  };
+}

system/settings/nix/gc/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 7d";
+  };
+}

system/settings/security/apparmor/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  security.apparmor.enable = true;
+}

system/settings/security/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./apparmor
+    ./doas
+  ];
+}

system/settings/security/doas/default.nix

@@ -0,0 +1,18 @@
+{ pkgs, ... }:
+{
+  security = {
+    sudo.enable = false;
+    doas = {
+      enable = true;
+      extraRules = [
+        { # Give wheel root access
+          groups = [ "wheel" ];
+          keepEnv = true;
+          persist = true;
+        }
+      ];
+    };
+  };
+
+  environment.systemPackages = with pkgs; [ doas-sudo-shim ];
+}

system/settings/timezone/default.nix

@@ -0,0 +1,4 @@
+{ ... }:
+{
+  time.timeZone = "America/Toronto";
+}