rearranged modules/

modules/system/services/docker.nix

@@ -0,0 +1,11 @@
+{ config, pkgs, lib, ... }:
+{
+    virtualisation.docker = {
+        enable = true;
+        liveRestore = false;
+        autoPrune.enable = true;
+    };
+    
+    # But allow docker containers to access the local machine
+    networking.firewall.trustedInterfaces = [ "docker0" ];
+}

modules/system/services/openssh.nix

@@ -0,0 +1,17 @@
+{ config, pkgs, lib, ... }:
+
+{
+    services.openssh = lib.mkDefault {
+        enable = true;
+        openFirewall = true;
+        passwordAuthentication = false;
+        permitRootLogin = "no";
+        kbdInteractiveAuthentication = false;
+        startWhenNeeded = true;
+        kexAlgorithms = [ "curve25519-sha256@libssh.org" ];
+    };
+    security.pam = lib.mkDefault {
+        enableSSHAgentAuth = true;
+        services.sudo.sshAgentAuth = true;
+    };
+}

modules/system/services/pipewire.nix

@@ -0,0 +1,15 @@
+# https://nixos.wiki/wiki/PipeWire
+{ config, pkgs, lib, ... }:
+{
+    # rtkit is optional but recommended
+    security.rtkit.enable = true;
+    services.pipewire = {
+      enable = true;
+      alsa = {
+        enable = true;
+        support32Bit = true;
+      };
+      pulse.enable = true;
+      jack.enable = true;
+    };
+}