feat(hecuba): switch to UEFI (and modularize)

hosts/hecuba/default.nix

@@ -9,6 +9,8 @@
 
 let
   meta = import ./meta.nix;
+  bios = config.bootloader.firmware == "bios";
+  uefi = config.bootloader.firmware == "uefi";
 in
 {
   imports = [
@@ -23,6 +25,11 @@ in
 
   hardware.facter.reportPath = ./facter.json;
 
+  bootloader = {
+    enable = true;
+    firmware = "uefi";
+  };
+  comin.enable = true;
   docker.enable = true;
   hardening = {
     enable = true;
@@ -61,22 +68,56 @@ in
 
   networking.hostName = config.host.name;
 
-  fileSystems."/" = {
+  boot.loader.grub.device = lib.mkIf bios "/dev/sda";
-    device = "/dev/disk/by-label/nixos";
+  boot.loader.systemd-boot.bootCounting.enable = lib.mkIf uefi true;
-    fsType = "ext4";
+
+  fileSystems = lib.mkIf bios {
+    "/" = {
+      device = "/dev/disk/by-label/nixos";
+      fsType = "ext4";
+    };
+    "/boot" = {
+      device = "/dev/disk/by-label/boot";
+      fsType = "ext4";
+    };
   };
-  fileSystems."/boot" = {
+  swapDevices = lib.mkIf bios [
-    device = "/dev/disk/by-label/boot";
-    fsType = "ext4";
-  };
-  swapDevices = [
     {
       device = "/dev/disk/by-label/swap";
     }
   ];
 
-  boot.loader.grub.enable = true;
+  disko.devices.disk.main = lib.mkIf uefi {
-  boot.loader.grub.device = "/dev/sda";
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [ "umask=0077" ];
+          };
+        };
+        swap = {
+          size = "4G";
+          content.type = "swap";
+        };
+        root = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/";
+          };
+        };
+      };
+    };
+  };
 
   users.users = {
     root.hashedPassword = "!";
@@ -88,11 +129,7 @@ in
 
   security.sudo.wheelNeedsPassword = false;
 
-  nix.gc = {
+  nix.gc.options = "--delete-older-than 14d";
-    automatic = true;
-    dates = "weekly";
-    options = "-d";
-  };
 
   virtualisation.docker.autoPrune = {
     enable = true;

modules/bootloader/default.nix

@@ -1,17 +1,31 @@
 { lib, config, ... }:
 
 {
-  options.bootloader.enable = lib.mkOption {
+  options.bootloader = {
-    default = false;
+    enable = lib.mkOption {
-    type = lib.types.bool;
+      default = false;
-  };
+      type = lib.types.bool;
-
+    };
-  config = lib.mkIf config.bootloader.enable {
+    firmware = lib.mkOption {
-    boot = {
+      default = "uefi";
-      loader = {
+      type = lib.types.enum [
-        systemd-boot.enable = true;
+        "bios"
-        efi.canTouchEfiVariables = true;
+        "uefi"
-      };
+      ];
     };
   };
+
+  config = lib.mkIf config.bootloader.enable (
+    lib.mkMerge [
+      (lib.mkIf (config.bootloader.firmware == "uefi") {
+        boot.loader = {
+          systemd-boot.enable = true;
+          efi.canTouchEfiVariables = true;
+        };
+      })
+      (lib.mkIf (config.bootloader.firmware == "bios") {
+        boot.loader.grub.enable = true;
+      })
+    ]
+  );
 }