Re-categorize some system modules that pertain to hardware

Also includes hardening for secureboot (splitting from the systemd-boot
configuration), only enabling OOM management on certain hosts, don't
enable wifi on all laptops, and making NFS support optional

hardware/laptop.nix

···
 {
-  imports = [
-    ../modules/common/network/wifi.nix
-  ];
+  # TODO: Power management, mostly
 }

hardware/memory/oom.nix

···
+{
+  boot.kernel.sysctl."kernel.sysrq" = 1;
+
+  systemd.oomd = {
+    enable = true;
+  };
+}

hosts/decryption/default.nix

···
     ./disks.nix
     (flakeRoot + /hardware/cpu/amd.nix)
     (flakeRoot + /hardware/gpu/nvidia.nix)
+    (flakeRoot + /hardware/memory/oom.nix)
+    (flakeRoot + /hardware/audio/pipewire.nix)
+    (flakeRoot + /hardware/network/wifi.nix)
+    (flakeRoot + /hardware/network/bluetooth.nix)
 
     (flakeRoot + /modules/common)
     (flakeRoot + /modules/common/boot/secureboot.nix)
-    (flakeRoot + /modules/common/system/audio.nix)
 
     (flakeRoot + /modules/desktop/environments/gnome.nix)
 

hosts/encryption/default.nix

···
     ./hardware-configuration.nix
     (flakeRoot + /hardware/cpu/amd.nix)
     (flakeRoot + /hardware/gpu/amd.nix)
-    (flakeRoot + /hardware/xr1.nix)
+    (flakeRoot + /hardware/audio/pipewire.nix)
+    (flakeRoot + /hardware/audio/noise-cancellation.nix)
+    (flakeRoot + /hardware/peripherals/xr1.nix)
 
     (flakeRoot + /modules/common)
     (flakeRoot + /modules/common/boot/secureboot.nix)
-    (flakeRoot + /modules/common/system/audio.nix)
     (flakeRoot + /modules/common/virtualization.nix)
 
+    (flakeRoot + /modules/desktop)
     (flakeRoot + /modules/desktop/environments/gnome.nix)
-    (flakeRoot + /modules/desktop/system/noise-cancellation.nix)
 
     ./users
   ];

hosts/index/config/nfs.nix

···
 
 {
   imports = [
-    (flakeRoot + /modules/server/nfs.nix)
+    (flakeRoot + /modules/server/filesystem/nfs.nix)
   ];
 
   services.nfs.server = {

hosts/index/config/zfs.nix

···
 
 {
   imports = [
-    (flakeRoot + /modules/server/zfs.nix)
+    (flakeRoot + /modules/server/filesystem/zfs.nix)
   ];
 
   networking.hostId = "c864ff4e";

hosts/prospect/default.nix

···
     ./disks.nix
     (flakeRoot + /hardware/cpu/amd.nix)
     (flakeRoot + /hardware/gpu/amd.nix)
+    (flakeRoot + /hardware/audio/pipewire.nix)
+    (flakeRoot + /hardware/network/bluetooth.nix)
+    (flakeRoot + /hardware/peripherals/rgb.nix)
 
     (flakeRoot + /modules/common)
     (flakeRoot + /modules/common/boot/systemd-boot.nix)
-    (flakeRoot + /modules/common/system/audio.nix)
-    (flakeRoot + /modules/common/system/rgb.nix)
 
     (flakeRoot + /modules/desktop/environments/gnome.nix)
 

modules/common/boot/common.nix

···
 {
-  boot = {
-    kernelParams = [ "boot.shell_on_fail" ];
+  boot.loader.systemd-boot = {
+    editor = false;
 
-    kernel.sysctl."kernel.sysrq" = 1;
+    configurationLimit = 6;
   };
 }

modules/common/boot/secureboot.nix

···
 
 {
   imports = [
-    ./systemd-boot.nix
     lanzaboote.nixosModules.lanzaboote
+
+    ./common.nix
   ];
 
-  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot = {
+    loader.systemd-boot.enable = lib.mkForce false;
 
-  boot.lanzaboote = {
-    enable = true;
+    lanzaboote = {
+      enable = true;
 
-    pkiBundle = "/var/lib/sbctl";
+      pkiBundle = "/var/lib/sbctl";
+    };
   };
 
   environment.systemPackages = with pkgs; [

modules/common/boot/systemd-boot.nix

···
     ./common.nix
   ];
 
-  boot.loader.systemd-boot = {
-    enable = true;
+  boot = {
+    kernelParams = [ "boot.shell_on_fail" ];
 
-    editor = false;
-    configurationLimit = 6;
+    loader.systemd-boot.enable = true;
   };
-
-  boot.loader.timeout = 0;
 }

modules/common/default.nix

···
 {
   imports = [
-    ./nfs.nix
-
     ./locale/en_US.nix
 
     ./network/firewall.nix
···
 
     ./system/coreutils.nix
     ./system/firmware.nix
-    ./system/memory.nix
     ./system/sudo.nix
 
     ./home-manager.nix

modules/common/system/memory.nix

···
-{
-  systemd.oomd = {
-    enable = true;
-  };
-}

modules/desktop/default.nix

···
+{
+  imports = [
+    ../common/filesystem/nfs.nix
+  ];
+}

modules/desktop/filesystem/nfs.nix

···
+{
+  boot.supportedFilesystems = [ "nfs" ];
+}

modules/desktop/system/noise-cancellation.nix hardware/audio/noise-cancellation.nix

···
 
 {
   imports = [
-    ../../common/system/audio.nix
+    ./pipewire.nix
   ];
 
   services.pipewire.extraConfig.pipewire."99-deepfilter-mono-source" = {

modules/server/nfs.nix modules/server/filesystem/nfs.nix

···
   ];
 in
 {
-  imports = [
-    ../common/nfs.nix
-  ];
-
   services.rpcbind.enable = true;
 
   services.nfs.server = {