Move implementation into a let definition

modules/os.nix

@@ -4,6 +4,48 @@ let
   cfg = config.cluster;
 
   pki = import ./pki.nix { inherit pkgs; ca = cfg.initca; };
+
+  common = {
+    users.extraUsers.admin.openssh.authorizedKeys.keys =
+      cfg.adminAuthorizedKeys;
+
+    users.extraUsers.root.openssh.authorizedKeys.keys =
+      cfg.adminAuthorizedKeys;
+
+    networking = {
+      domain = cfg.domain;
+      search = cfg.searchDomains;
+      extraHosts = cfg.extraHosts;
+      firewall.allowedTCPPortRanges = [ { from = 5000; to = 50000; } ];
+      firewall.allowedTCPPorts = [ 80 443 111 ];
+      firewall.allowedUDPPorts = [ 111 24007 24008 ];
+    } // (
+      if cfg.externalInterface == null then
+        { hostName = cfg.hostName; }
+      else {
+        hostName = cfg.hostName;
+        interfaces."${cfg.externalInterface}" = {
+          useDHCP = false;
+          ipv4.addresses = [ {
+            address = cfg.address;
+            prefixLength = 24;
+          } ];
+        };
+        defaultGateway = cfg.defaultGateway;
+        nameservers = cfg.nameservers;
+      }
+    );
+
+    security.pki.certificateFiles = [ pki.ca.cert ];
+    boot.kernel.sysctl = {
+      "kernel.mm.transparent_hugepage.enabled" = "never";
+      "net.core.somaxconn" = "512";
+    };
+
+    environment.systemPackages = with pkgs; [
+      nfs-utils
+    ];
+  };
 in
 {
   options.cluster = {
@@ -67,47 +109,7 @@ in
     };
   };
 
-  config = {
-    users.extraUsers.admin.openssh.authorizedKeys.keys =
-      cfg.adminAuthorizedKeys;
-
-    users.extraUsers.root.openssh.authorizedKeys.keys =
-      cfg.adminAuthorizedKeys;
-
-    networking = {
-      domain = cfg.domain;
-      search = cfg.searchDomains;
-      extraHosts = cfg.extraHosts;
-      firewall.allowedTCPPortRanges = [ { from = 5000; to = 50000; } ];
-      firewall.allowedTCPPorts = [ 80 443 111 ];
-      firewall.allowedUDPPorts = [ 111 24007 24008 ];
-    } // (
-      if cfg.externalInterface == null then
-        { hostName = cfg.hostName; }
-      else {
-        hostName = cfg.hostName;
-        interfaces."${cfg.externalInterface}" = {
-          useDHCP = false;
-          ipv4.addresses = [ {
-            address = cfg.address;
-            prefixLength = 24;
-          } ];
-        };
-        defaultGateway = cfg.defaultGateway;
-        nameservers = cfg.nameservers;
-      }
-   );
-
-   security.pki.certificateFiles = [ pki.ca.cert ];
-    boot.kernel.sysctl = {
-      "kernel.mm.transparent_hugepage.enabled" = "never";
-      "net.core.somaxconn" = "512";
-    };
-
-    environment.systemPackages = with pkgs; [
-      nfs-utils
-    ];
-  };
+  config = common;
 
   imports = [
     ../nixos/configuration.nix