init

system/modules/docker/default.nix

@@ -0,0 +1,27 @@
+{ pkgs, lib, config, ... }:
+
+with lib;
+let
+  cfg = config.modules.system.docker;
+
+in
+{
+  options.modules.system.docker = { enable = mkEnableOption "Enable Docker"; };
+  config = mkIf cfg.enable {
+    virtualisation.docker = {
+      enable = true;
+
+      # Explicit storage driver for ext4/xfs filesystems
+      storageDriver = "overlay2";
+    };
+
+    # Add docker package to system packages
+    environment.systemPackages = with pkgs; [
+      docker
+      docker-compose
+    ];
+
+    # Add user to docker group
+    users.users.${config.user.name}.extraGroups = [ "docker" ];
+  };
+}

system/modules/sops/default.nix

@@ -0,0 +1,30 @@
+{ pkgs, lib, config, ... }:
+
+with lib;
+let
+  cfg = config.modules.system.sops;
+
+in
+{
+  options.modules.system.sops = { enable = mkEnableOption "Enable sops-nix"; };
+  config = mkIf cfg.enable {
+    # Smartcard daemon for Yubikey (GPG, etc.)
+    services.pcscd.enable = true;
+    services.udev.packages = [ pkgs.yubikey-personalization ];
+
+    environment.systemPackages = with pkgs; [
+      age
+      sops
+    ];
+
+    # Per-machine age key for system secrets (boot-time, unattended)
+    # This is the sops-nix default path
+    sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+
+    # Symlink for root so `sudo sops` finds the key automatically
+    systemd.tmpfiles.rules = [
+      "d /root/.config/sops/age 0700 root root -"
+      "L+ /root/.config/sops/age/keys.txt - - - - /var/lib/sops-nix/key.txt"
+    ];
+  };
+}