move modules into subdir

modules/hidden-ssh-announce.nix

@@ -0,0 +1,55 @@
+{ config
+, lib
+, pkgs
+, ...
+}: {
+  options.hidden-ssh-announce = {
+    enable = lib.mkEnableOption "hidden-ssh-announce";
+    script = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.writers.writeDash "test-output" "echo $1";
+      description = ''
+        script to run when the hidden tor service was started and they hostname is known.
+        takes the hostname as $1
+      '';
+    };
+  };
+
+  config = lib.mkIf config.hidden-ssh-announce.enable {
+    services.openssh.enable = true;
+    services.tor = {
+      enable = true;
+      relay.onionServices.hidden-ssh = {
+        version = 3;
+        map = [
+          {
+            port = 22;
+            target.port = 22;
+          }
+        ];
+      };
+      client.enable = true;
+    };
+    systemd.services.hidden-ssh-announce = {
+      description = "irc announce hidden ssh";
+      after = [ "tor.service" "network-online.target" ];
+      wants = [ "tor.service" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        # ${pkgs.tor}/bin/torify
+        ExecStart = pkgs.writers.writeDash "announce-hidden-service" ''
+          set -efu
+          until test -e ${config.services.tor.settings.DataDirectory}/onion/hidden-ssh/hostname; do
+            echo "still waiting for ${config.services.tor.settings.DataDirectory}/onion/hidden-ssh/hostname"
+            sleep 1
+          done
+
+          ${config.hidden-ssh-announce.script} "$(cat ${config.services.tor.settings.DataDirectory}/onion/hidden-ssh/hostname)"
+        '';
+        PrivateTmp = "true";
+        User = "tor";
+        Type = "oneshot";
+      };
+    };
+  };
+}

modules/installer.nix

@@ -0,0 +1,40 @@
+{ lib
+, pkgs
+, ...
+}: {
+  systemd.tmpfiles.rules = [
+    "d /var/shared 0777 root root - -"
+  ];
+  services.openssh.settings.PermitRootLogin = "yes";
+  system.activationScripts.root-password = ''
+    mkdir -p /var/shared
+    ${pkgs.pwgen}/bin/pwgen -s 16 1 > /var/shared/root-password
+    echo "root:$(cat /var/shared/root-password)" | chpasswd
+  '';
+  hidden-ssh-announce = {
+    enable = true;
+    script = pkgs.writers.writeDash "write-hostname" ''
+      mkdir -p /var/shared
+      echo "$1" > /var/shared/onion-hostname
+      ${pkgs.jq}/bin/jq -nc \
+        --arg password "$(cat /var/shared/root-password)" \
+        --arg address "$(cat /var/shared/onion-hostname)" '{
+          password: $password, address: $address
+        }' > /var/shared/login.info
+      cat /var/shared/login.info |
+        ${pkgs.qrencode}/bin/qrencode -t utf8 > /var/shared/qrcode.utf8
+      cat /var/shared/login.info |
+        ${pkgs.qrencode}/bin/qrencode -t png > /var/shared/qrcode.png
+    '';
+  };
+  services.getty.autologinUser = lib.mkForce "root";
+  programs.bash.interactiveShellInit = ''
+    if [ "$(tty)" = "/dev/tty1" ]; then
+      until test -e /var/shared/qrcode.utf8; do sleep 1; done
+      cat /var/shared/qrcode.utf8
+    fi
+  '';
+  formatConfigs.install-iso = {
+    isoImage.squashfsCompression = "zstd -Xcompression-level 1";
+  };
+}