remove "parts" directory and restructure modules

modules/flake-module.nix

@@ -1,3 +1,4 @@
+{ lib, ... }:
 {
   flake.nixosModules = {
     gitea.imports = [
@@ -7,5 +8,16 @@
     desktop.imports = [
       ./desktop.nix
     ];
+
+    nix-defaults.imports = [ ./nix-defaults.nix ];
+    tailscale.imports = [ ./tailscale.nix ];
+    user-rpqt.imports = [ ./user-rpqt.nix ];
+    hardened-ssh-server.imports = [ ./hardened-ssh-server.nix ];
+
+    common.imports = [
+      {
+        users.mutableUsers = lib.mkDefault false;
+      }
+    ];
   };
 }

modules/hardened-ssh-server.nix

@@ -0,0 +1,14 @@
+{
+  services.openssh = {
+    enable = true;
+    settings = {
+      # PermitRootLogin = "no";
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+      AuthenticationMethods = "publickey";
+      PubkeyAuthentication = "yes";
+      ChallengeResponseAuthentication = "no";
+      X11Forwarding = false;
+    };
+  };
+}

modules/nix-defaults.nix

@@ -0,0 +1,19 @@
+{ pkgs, ... }:
+{
+  # for flakes
+  environment.systemPackages = [ pkgs.git ];
+
+  nix.settings = {
+    auto-optimise-store = true;
+    builders-use-substitutes = true;
+    experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+
+    trusted-users = [
+      "root"
+      "@wheel"
+    ];
+  };
+}

modules/tailscale.nix

@@ -0,0 +1,11 @@
+{ config, ... }:
+{
+  networking.firewall = {
+    trustedInterfaces = [ config.services.tailscale.interfaceName ];
+  };
+
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;
+  };
+}

modules/user-rpqt.nix

@@ -0,0 +1,21 @@
+{ lib, pkgs, ... }:
+{
+  users.users.rpqt = {
+    isNormalUser = true;
+
+    createHome = lib.mkDefault true;
+    home = lib.mkDefault "/home/rpqt";
+
+    description = "Romain Paquet";
+
+    shell = pkgs.zsh;
+
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGa8R8obgptefcp27Cdp9bc2fiyc9x0oTfMsTPFp2ktE rpqt@haze"
+    ];
+
+    extraGroups = [ "wheel" ];
+  };
+
+  programs.zsh.enable = true;
+}