fix: allow specific unfree packages in 'audio' module

flake.nix

@@ -55,7 +55,6 @@
       home-manager,
       nixgl,
       git-hooks,
-      colmena,
       ...
     }@inputs:
     let

home/modules/ai-tools.nix

@@ -74,6 +74,15 @@ in
       home.packages = with pkgs; [
         opencode
       ];
+      home.file.".config/opencode/opencode.json".text = builtins.toJSON {
+        "$schema" = "https://opencode.ai/config.json";
+        permission = {
+          external_directory = {
+            "/run/secrets/" = "deny";
+            "~/.config/sops/age/keys.txt" = "deny";
+          };
+        };
+      };
     })
   ];
 }

hosts/andromache/default.nix

@@ -27,6 +27,7 @@ in
     ../../modules/desktops/niri
     ../../modules/backups
     ../../modules/bluetooth
+    ../../modules/gaming
     ../../modules/keyboard
     (import ../../modules/networking { inherit hostName; })
     ../../modules/users
@@ -38,6 +39,7 @@ in
     (import ../../modules/secrets { inherit lib inputs config; })
     ../../modules/docker
     ../../modules/syncthing
+    ../../modules/nvidia
   ];
 
   home-manager.users.${username} = import ../../home/hosts/andromache {
@@ -79,18 +81,7 @@ in
     };
   };
 
-  hardware = {
+  hardware.cpu.intel.updateMicrocode = true;
-    cpu.intel.updateMicrocode = true;
-    graphics.enable = true;
-    nvidia = {
-      modesetting.enable = true;
-      powerManagement.enable = true;
-      powerManagement.finegrained = false;
-      open = true;
-      nvidiaSettings = true;
-      package = config.boot.kernelPackages.nvidiaPackages.stable;
-    };
-  };
 
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 
@@ -99,19 +90,15 @@ in
   ];
 
   services = {
-    xserver = {
+    locate = {
-      videoDrivers = [ "nvidia" ];
+      enable = true;
+      package = pkgs.plocate;
     };
 
     openssh = {
       enable = true;
       harden = true;
     };
-    locate = {
-      enable = true;
-      package = pkgs.plocate;
-    };
-  };
 
   my.syncthing.enable = true;
 

hosts/astyanax/default.nix

@@ -59,6 +59,7 @@ in
   secrets.username = username;
   docker.user = username;
   nfc.user = username;
+  desktop.ly.enable = true;
 
   nix.settings.secret-key-files = [ config.sops.secrets.nix_signing_key_astyanax.path ];
 

modules/audio/default.nix

@@ -1,6 +1,9 @@
-_:
-
 {
+  nixpkgs.allowedUnfree = [
+    "spotify"
+    "spotify-unwrapped"
+  ];
+
   security.rtkit.enable = true;
   services = {
     pulseaudio.enable = false;

modules/desktops/niri/default.nix

@@ -1,16 +1,32 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.desktop;
+in
 {
-  programs.niri.enable = true;
+  options.desktop = {
-
+    ly = {
-  services = {
+      enable = lib.mkOption {
-    dbus.enable = true;
+        type = lib.types.bool;
-    logind.settings.Login = {
+        default = false;
-      HandleLidSwitch = "suspend";
+      };
-      IdleAction = "suspend";
-      IdleActionSec = 1800;
     };
+  };
 
-    displayManager.ly = {
+  config = {
-      enable = true;
+    programs.niri.enable = true;
+
+    services = {
+      dbus.enable = true;
+      logind.settings.Login = {
+        HandleLidSwitch = "suspend";
+        IdleAction = "suspend";
+        IdleActionSec = 1800;
+      };
+
+      displayManager.ly = lib.mkIf cfg.ly.enable {
+        enable = true;
+      };
     };
   };
 }

modules/gaming/default.nix

@@ -0,0 +1,12 @@
+{
+  nixpkgs.allowedUnfree = [
+    "steam"
+    "steam-unwrapped"
+  ];
+
+  programs.steam = {
+    enable = true;
+    remotePlay.openFirewall = false;
+    dedicatedServer.openFirewall = false;
+  };
+}

modules/nvidia/default.nix

@@ -0,0 +1,22 @@
+{ config, ... }:
+
+{
+  nixpkgs.allowedUnfree = [
+    "nvidia-x11"
+    "nvidia-persistenced"
+    "nvidia-settings"
+  ];
+
+  hardware.graphics.enable = true;
+
+  hardware.nvidia = {
+    modesetting.enable = true;
+    powerManagement.enable = true;
+    powerManagement.finegrained = false;
+    open = true;
+    nvidiaSettings = true;
+    package = config.boot.kernelPackages.nvidiaPackages.stable;
+  };
+
+  services.xserver.videoDrivers = [ "nvidia" ];
+}