linode builds both image and host

hosts/vps/configuration.nix

@@ -48,7 +48,11 @@ in
     ./nginx-nextcloud.nix
     ../../config/base.nix
   ];
-  my = import ./toggles.nix { inherit config inputs; } // {
+  my =
+    import ./toggles.nix {
+      inherit config inputs lib;
+    }
+    // {
       secureHost = true;
       users.nixremote = {
         enable = true;
@@ -151,7 +155,12 @@ in
       www-data = { };
     };
     users = {
-      nginx.extraGroups = [ "www-data" ];
+      nginx = lib.mkIf config.my.secureHost {
+        extraGroups = [
+          "www-data"
+          "lidarr-reports"
+        ];
+      };
       deploy = {
         isSystemUser = true;
         group = "deploy";

hosts/vps/hardware-configuration.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  config,
   modulesPath,
   ...
 }:
@@ -33,11 +34,17 @@
     };
   };
   fileSystems."/" = {
-    device = "/dev/disk/by-uuid/f222513b-ded1-49fa-b591-20ce86a2fe7f";
+    device = lib.mkForce (
+      if config.my.build.baseImage then
+        "/dev/sda"
+      else
+        "/dev/disk/by-uuid/f222513b-ded1-49fa-b591-20ce86a2fe7f"
+    );
     fsType = "ext4";
   };
-  swapDevices = [
+  swapDevices = lib.mkMerge [
-    { device = "/dev/disk/by-uuid/f1408ea6-59a0-11ed-bc9d-525400000001"; }
+    [ { device = "/dev/disk/by-uuid/f1408ea6-59a0-11ed-bc9d-525400000001"; } ]
+    (lib.mkIf config.my.build.baseImage [ { device = "/dev/sdb"; } ])
   ];
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

hosts/vps/nginx-nextcloud.nix

@@ -3,7 +3,7 @@ let
   cfg = config.my.servers.nextcloud;
 in
 {
-  config = lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
+  config = lib.mkIf (cfg.enableProxy && config.my.enableProxy && config.my.secureHost) {
     services.nginx.virtualHosts.${cfg.host} = {
       forceSSL = true;
       enableACME = true;

hosts/vps/toggles.nix

@@ -1,4 +1,8 @@
-{ config, inputs }:
+{
+  config,
+  inputs,
+  lib,
+}:
 let
   inherit (inputs.self.lib)
     enableList
@@ -16,12 +20,7 @@ let
       ip = wgServerIp;
     };
   };
-in
+  baseToggles = {
-{
-  enableProxy = true;
-  enableContainers = true;
-  apps.dictionaries.enable = true;
-  apps.dictionaries.users = "jawz";
     services = enableList mkEnabled [
       "network"
       "wireguard"
@@ -34,6 +33,14 @@ in
       "nix"
       "sh"
     ];
+    apps.dictionaries = {
+      enable = true;
+      users = "jawz";
+    };
+  };
+  secureToggles = {
+    enableProxy = true;
+    enableContainers = true;
     websites = {
       portfolio.enableProxy = true;
       lidarrMbReport.enableProxy = true;
@@ -71,4 +78,9 @@ in
         "vaultwarden"
         "yamtrack"
       ];
-}
+  };
+in
+lib.mkMerge [
+  baseToggles
+  (lib.mkIf config.my.secureHost secureToggles)
+]

modules/modules.nix

@@ -130,6 +130,11 @@ in
     };
     enableContainers = lib.mkEnableOption "container services (Docker/Podman)";
     enableProxy = lib.mkEnableOption "nginx reverse proxy for services";
+    build.baseImage = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Whether to enable base image settings for this host build.";
+    };
     toggleUsers = lib.mkOption {
       type = lib.types.attrsOf (lib.types.either lib.types.str (lib.types.listOf lib.types.str));
       default = {

parts/packages.nix

@@ -26,6 +26,17 @@
           exec ${mcpPython}/bin/python -m mcp_server.server
         '';
       };
+      vpsLinodeConfig = inputs.self.nixosConfigurations.vps.extendModules {
+        modules = [
+          (
+            { lib, ... }:
+            {
+              my.secureHost = lib.mkForce false;
+              my.build.baseImage = true;
+            }
+          )
+        ];
+      };
       mcpTests = pkgs.writeShellApplication {
         name = "mcp-tests";
         runtimeInputs = with pkgs.python3Packages; [
@@ -43,7 +54,7 @@
     {
       packages = (inputs.jawz-scripts.packages.${system} or { }) // {
         emacs-vm = inputs.self.nixosConfigurations.emacs.config.system.build.vm;
-        vps-linode = inputs.self.nixosConfigurations.vps.config.system.build.images.linode;
+        vps-linode = vpsLinodeConfig.config.system.build.images.linode;
         mcp-tests = mcpTests;
         nixos-mcp = nixosMcp;
         nixos-mcp-server = mcpServerPkg;