Add NixOS host modules and runners

nixos/modules/base.nix

@@ -1,10 +1,19 @@
 { pkgs, ... }:
 
 {
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
+  nix = {
+    settings = {
+      experimental-features = [ "nix-command" "flakes" ];
+      auto-optimise-store = true;
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+  };
+
+  boot.tmp.cleanOnBoot = true;
 
   time.timeZone = "Europe/Moscow";
 
@@ -20,7 +29,6 @@
     extraGroups = [
       "wheel"
       "docker"
-      "libvirtd"
     ];
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWNsUQmppB6cQccXX1ZaBbFIcmM6RmghsTVbG9TgoZB ada@ada-x1"

nixos/modules/firewall-mini-pc.nix

@@ -2,13 +2,13 @@
   networking.firewall = {
     enable = true;
     allowedTCPPorts = [
-      22
-      53
-      80
-      443
-      784
-      853
-      3001
+      22 # SSH
+      53 # DNS (AdGuard)
+      80 # HTTP
+      443 # HTTPS
+      784 # DNS-over-QUIC
+      853 # DNS-over-TLS
+      3001 # Uptime Kuma
       3015
       4438
       5443
@@ -16,10 +16,10 @@
       10380
     ];
     allowedUDPPorts = [
-      53
-      443
-      784
-      9993
+      53 # DNS
+      443 # QUIC
+      784 # DNS-over-QUIC
+      9993 # ZeroTier
       5443
     ];
   };

nixos/modules/firewall.nix

@@ -2,24 +2,24 @@
   networking.firewall = {
     enable = true;
     allowedTCPPorts = [
-      22
-      139
-      445
-      2222
+      22 # SSH
+      139 # Samba (NetBIOS session)
+      445 # Samba (SMB)
+      2222 # Gitea SSH
       3002
       4567
-      5432
+      5432 # PostgreSQL
       7080
       8081
-      8384
-      22000
+      8384 # Syncthing web UI
+      22000 # Syncthing data transfer
     ];
     allowedUDPPorts = [
-      137
-      138
-      9993
-      21027
-      22000
+      137 # Samba (NetBIOS name)
+      138 # Samba (NetBIOS datagram)
+      9993 # ZeroTier
+      21027 # Syncthing discovery
+      22000 # Syncthing data transfer
     ];
   };
 }

nixos/modules/libvirtd.nix

@@ -0,0 +1,10 @@
+{ pkgs, ... }:
+
+{
+  virtualisation.libvirtd = {
+    enable = true;
+    qemu.package = pkgs.qemu_kvm;
+  };
+
+  users.users.ada.extraGroups = [ "libvirtd" ];
+}