Image building take 2

We want verity protected partitions as well as encrypted state/data along with verified boot.
This PR integrates Peter Marshall's awesome little Nixlet project as a starting point, especially the nice testing scaffolding will be super helpful! ✨

https://github.com/petm5/nixlet/

modules/profiles/base.nix

@@ -0,0 +1,86 @@
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+{
+  imports = [
+    (modulesPath + "/profiles/image-based-appliance.nix")
+    (modulesPath + "/profiles/perlless.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  # system.forbiddenDependenciesRegexes = lib.mkForce [ ];
+
+  nixpkgs.flake.setNixPath = false;
+  nixpkgs.flake.setFlakeRegistry = false;
+
+  networking.hostName = "patos";
+
+  boot.kernelModules = [
+    "zram"
+    "usb_storage"
+    "uas"
+    "sd_mod"
+    "r8169"
+    "ehci-hcd"
+    "ehci-pci"
+    "xhci-hcd"
+    "xhci-pci"
+    "xhci-pci-renesas"
+    "nvme"
+    "virtio_net"
+  ];
+
+  system.etc.overlay.mutable = lib.mkDefault false;
+  users.mutableUsers = lib.mkDefault false;
+
+
+  systemd.watchdog = lib.mkDefault {
+    runtimeTime = "10s";
+    rebootTime = "30s";
+  };
+
+  zramSwap.enable = true;
+
+  services.openssh.settings.PasswordAuthentication = lib.mkDefault false;
+
+  users.allowNoPasswordLogin = true;
+  security.sudo.enable = lib.mkDefault false;
+
+  security.polkit = {
+    enable = true;
+    extraConfig =''
+      polkit.addRule(function(action, subject) {
+        if (subject.isInGroup("wheel")) {
+          return polkit.Result.YES;
+        }
+      });
+    '';
+  };
+
+  i18n.supportedLocales = [ "en_US.UTF-8/UTF-8" ];
+
+  systemd.enableEmergencyMode = false;
+  console.enable = false;
+  systemd.services."getty@tty1".enable = lib.mkDefault false;
+  systemd.services."autovt@".enable = lib.mkDefault false;
+
+  boot.tmp.useTmpfs = true;
+  boot.consoleLogLevel = lib.mkDefault 1;
+  boot.kernelParams = [
+    "panic=1"
+    "boot.panic_on_fail"
+    "nomodeset"
+  ];
+
+  # This is vi country
+  programs.nano.enable = false;
+  programs.vim.enable = true;
+  programs.vim.defaultEditor = lib.mkDefault true;
+
+  # Logging
+  services.journald.storage = "volatile";
+}

modules/profiles/network.nix

@@ -0,0 +1,56 @@
+{ lib, ... }:
+{
+  # Use TCP BBR
+  boot.kernel.sysctl = {
+    "net.core.default_qdisc" = "fq";
+    "net.ipv4.tcp_congestion_control" = "bbr";
+  };
+
+  services.resolved.extraConfig = ''
+    DNSStubListener=no
+  '';
+
+  networking.firewall.enable = false;
+
+  networking.nftables.enable = lib.mkDefault true;
+
+  networking.useNetworkd = true;
+  systemd.network.wait-online.enable = true;
+
+  # Explicitly load networking modules
+  boot.kernelModules = [
+    "ip_tables"
+    "x_tables"
+    "nf_tables"
+    "nft_ct"
+    "nft_log"
+    "nf_log_syslog"
+    "nft_fib"
+    "nft_fib_inet"
+    "nft_compat"
+    "nft_nat"
+    "nft_chain_nat"
+    "nft_masq"
+    "nfnetlink"
+    "xt_conntrack"
+    "nf_conntrack"
+    "nf_log_syslog"
+    "nf_nat"
+    "af_packet"
+    "bridge"
+    "veth"
+    "tcp_bbr"
+    "sch_fq_codel"
+    "ipt_rpfilter"
+    "ip6t_rpfilter"
+    "sch_fq"
+    "tun"
+    "tap"
+    "xt_MASQUERADE"
+    "xt_mark"
+    "xt_comment"
+    "xt_multiport"
+    "xt_addrtype"
+  ];
+
+}

modules/profiles/server.nix

@@ -0,0 +1,43 @@
+{
+  modulesPath,
+  ...
+}:
+{
+
+  imports = [
+    (modulesPath + "/profiles/minimal.nix")
+    ./network.nix
+  ];
+
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_unprivileged_port_start" = 0;
+  };
+
+  users.users."admin" = {
+    isNormalUser = true;
+    linger = true;
+    extraGroups = [ "wheel" ];
+  };
+
+  environment.etc = {
+    subuid = {
+      text = "admin:100000:65536";
+      mode = "0644";
+    };
+
+    subgid = {
+      text = "admin:100000:65536";
+      mode = "0644";
+    };
+  };
+
+  services.openssh.enable = true;
+  system.image.sshKeys.enable = true;
+  system.image.sshKeys.keys = [
+    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIIHMAEZx02kbHrEygyPQYStiXlrIe6EIqBCv7anIkL0pAAAABHNzaDo= dln1"
+    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIJNOBFoU7Cdsgi4KpYRcv7EhR/8kD4DYjEZnwk6urRx7AAAABHNzaDo= dln2"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKDx+7ZEJi7lUCAtoHRRIduJzH3hrpx4YS1f0ZxrJ+uW dln3"
+  ];
+
+  virtualisation.podman.enable = true;
+}