refactor(mx): extract disk check services into disk-check.nix

Share the check script via a parameterized mkDiskCheck function over
{ name, mountPoint, label } and iterate an attrset to emit the boot
and root services plus their daily timers.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

systems/x86_64-linux/mx/disk-check.nix

@@ -0,0 +1,59 @@
+{ pkgs, config, ... }:
+let
+  mkDiskCheck =
+    {
+      name,
+      mountPoint,
+      label,
+    }:
+    {
+      serviceConfig = {
+        Type = "oneshot";
+        Environment = "PATH=/run/current-system/sw/bin";
+        ExecStart = toString (
+          pkgs.writeShellScript "${name}.sh" ''
+            CURRENT=$(df ${mountPoint} | awk 'NR==2 { print $5 }' | sed 's/%//g')
+            THRESHOLD=85
+
+            if [ "$CURRENT" -gt "$THRESHOLD" ] ; then
+                ${pkgs.mailutils}/bin/mail -s '${mountPoint} Disk Space Alert' harald << EOF
+            Your ${label} partition remaining free space is critically low. Used: $CURRENT%
+            EOF
+                TOKEN=$(cat ${config.sops.secrets.ntfy.path})
+                ${pkgs.curl}/bin/curl -s -H "Authorization: Bearer $TOKEN" \
+                  -H "Title: ${mountPoint} Disk Space Alert" \
+                  -H "Priority: high" \
+                  -d "${label} partition at $CURRENT%" \
+                  http://127.0.0.1:2586/alerts
+            fi
+          ''
+        );
+      };
+      wantedBy = [ "default.target" ];
+    };
+
+  checks = {
+    check_boot = {
+      mountPoint = "/boot";
+      label = "Boot";
+    };
+    check_root = {
+      mountPoint = "/";
+      label = "Root";
+    };
+  };
+in
+{
+  systemd.services = builtins.mapAttrs (
+    name: cfg:
+    mkDiskCheck {
+      inherit name;
+      inherit (cfg) mountPoint label;
+    }
+  ) checks;
+
+  systemd.timers = builtins.mapAttrs (_: _: {
+    timerConfig.OnCalendar = "daily";
+    wantedBy = [ "timers.target" ];
+  }) checks;
+}