refactor(nix): extract common system configs into reusable modules

Create 6 new NixOS modules to reduce duplication across system configs:
- hardware/wooting: Wooting keyboard udev rules and Bluetooth compat
- services/nginx-base: Common nginx server settings
- services/acme-base: ACME certificate defaults
- services/xremap: Key remapping with sensible defaults
- system/no-sleep: Disable sleep/suspend/hibernate targets
- system/kernel-tweaks: PM freeze timeout and zram configuration

Update system configuration files to use these new modules.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

systems/x86_64-linux/x1/default.nix

@@ -20,8 +20,6 @@ with lib.metacfg;
   programs.ccache.enable = true;
   nix.settings.extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
 
-  services.tailscale.enable = true;
-
   services.cratedocs-mcp.enable = true;
 
   sops.age.sshKeyPaths = [ "/var/lib/secrets/ssh_host_ed25519_key" ];
@@ -45,13 +43,11 @@ with lib.metacfg;
     ];
   };
 
-  hardware.bluetooth.input.General.ClassicBondedOnly = false;
-  services.udev.extraRules = ''
-    KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="342d", ATTRS{idProduct}=="e4c5", MODE="0660", GROUP="users", TAG+="uaccess", TAG+="udev-acl"
-    KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="342d", ATTRS{idProduct}=="e489", MODE="0660", GROUP="users", TAG+="uaccess", TAG+="udev-acl"
-  '';
+  services.tailscale.enable = true;
+  services.resolved.enable = true;
 
   metacfg = {
+    hardware.wooting.enable = true;
     base.enable = true;
     gui.enable = true;
     nix-ld.enable = true;
@@ -77,17 +73,19 @@ with lib.metacfg;
       "dialout"
       "tss"
     ];
+    system.kernelTweaks.enable = true;
+  };
+
+  system.autoUpgrade = {
+    enable = true;
+    operation = "boot";
+    allowReboot = false;
   };
 
   nixpkgs.config.permittedInsecurePackages = [
     "electron-27.3.11"
   ];
 
-  # increase freezing timeout
-  boot.kernel.sysctl = {
-    "power.pm_freeze_timeout" = 30000;
-  };
-
   environment.systemPackages = with pkgs; [
     attic-client
     azure-cli
@@ -112,26 +110,12 @@ with lib.metacfg;
     vscode
   ];
 
-  zramSwap.enable = true;
-
   services.ratbagd.enable = true;
 
-  services.resolved.enable = true;
-  #services.resolved.dnssec = "allow-downgrade";
-  #services.resolved.extraConfig = ''
-  #  ResolveUnicastSingleLabel=yes
-  #'';
-
   virtualisation = {
     libvirtd.enable = true;
   };
 
-  system.autoUpgrade = {
-    enable = true;
-    operation = "boot";
-    allowReboot = false;
-  };
-
   services.trezord.enable = true;
 
   services.ollama = {

systems/x86_64-linux/x1/xremap.nix

@@ -1,33 +1,21 @@
-# In /etc/nixos/configuration.nix
 { ... }:
 {
-  users.users.harald.extraGroups = [ "input" ];
-
-  # Enable the xremap service
-  services.xremap.enable = true;
-  services.xremap.userName = "harald"; # Replace with your username
-  services.xremap.serviceMode = "user"; # Run as user service, not system-wide
-  services.xremap.withGnome = true;
-
-  # Add a specific configuration block to select your keyboard(s) by name
-  services.xremap.deviceNames = [
-    # Use the name found in the log output: "Hangsheng MonsGeek Keyboard System Control"
-    "Hangsheng MonsGeek Keyboard"
-    "HS Galaxy100 Keyboard"
-    # You can usually shorten the name slightly to match the device you want
-  ];
-
-  # Define your remapping configuration using Nix's attribute set format
-  services.xremap.config = {
-    keymap = [
-      {
-        remap = {
-          # Map Alt+C (LeftAlt-C) to Ctrl+C (LeftControl-C)
-          LeftAlt-C = "COPY";
-          LeftAlt-V = "PASTE";
-          LeftAlt-X = "CUT";
-        };
-      }
+  metacfg.services.xremap = {
+    enable = true;
+    deviceNames = [
+      "Hangsheng MonsGeek Keyboard"
+      "HS Galaxy100 Keyboard"
     ];
+    config = {
+      keymap = [
+        {
+          remap = {
+            LeftAlt-C = "COPY";
+            LeftAlt-V = "PASTE";
+            LeftAlt-X = "CUT";
+          };
+        }
+      ];
+    };
   };
 }