3 files changed, 19 insertions, 5 deletions
diff --git a/machines/nixos/x86_64-linux/rivendell/default.nix b/machines/nixos/x86_64-linux/rivendell/default.nix
index 7c94470..787f090 100644
--- a/machines/nixos/x86_64-linux/rivendell/default.nix
+++ b/machines/nixos/x86_64-linux/rivendell/default.nix
@@ -12,9 +12,6 @@
     ./disks.nix
   ];
 
-  services.fwupd.enable = true;
-  hardware.enableRedistributableFirmware = true;
-
   boot.initrd.availableKernelModules = [
     "nvme"
     "xhci_pci"
@@ -27,8 +24,6 @@
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.loader.systemd-boot.enable = true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
@@ -50,6 +45,7 @@
 
   nix.settings.trusted-users = [ "builder" ];
 
+  my.modules.hardware.baremetal.enable = true;
   my.modules.remote-unlock.enable = true;
 
   system.stateVersion = "23.11"; # Did you read the comment?
diff --git a/modules/nixos/hardware/baremetal.nix b/modules/nixos/hardware/baremetal.nix
new file mode 100644
index 0000000..884fa00
--- /dev/null
+++ b/modules/nixos/hardware/baremetal.nix
@@ -0,0 +1,17 @@
+{ lib, config, ... }:
+let
+  cfg = config.my.modules.hardware.baremetal;
+in
+{
+  options.my.modules.hardware.baremetal = {
+    enable = lib.mkEnableOption "Baremetal hardware defaults";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.fwupd.enable = true;
+    hardware.enableRedistributableFirmware = true;
+
+    boot.loader.efi.canTouchEfiVariables = true;
+    boot.loader.systemd-boot.enable = true;
+  };
+}
diff --git a/modules/nixos/hardware/default.nix b/modules/nixos/hardware/default.nix
index f6ea0d9..66ed2ee 100644
--- a/modules/nixos/hardware/default.nix
+++ b/modules/nixos/hardware/default.nix
@@ -1,6 +1,7 @@
 { ... }:
 {
   imports = [
+    ./baremetal.nix
     ./do-droplet.nix
   ];
 }