flake: rewrite to use flake-parts

modules/devos/nix.nix

@@ -24,7 +24,17 @@ with lib;
 
     optimise.automatic = true;
 
+    registry =
+      let
+        flakes = filterAttrs (n: v: v ? outputs) inputs;
+      in
+      builtins.mapAttrs (_n: v: { flake = v; }) flakes;
+
     extraOptions = ''
+      extra-experimental-features = flakes nix-command
+      extra-substituters = https://nrdxp.cachix.org https://nix-community.cachix.org
+      extra-trusted-public-keys = nrdxp.cachix.org-1:Fc5PSqY2Jm1TrWfm88l6cvGWwz3s93c6IOifQWnhNW4= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
+
       min-free = 536870912
       keep-outputs = true
       keep-derivations = true

modules/global/packages.nix

@@ -10,6 +10,7 @@
   environment.systemPackages = with pkgs; [
     universe-cli
 
+    agenix
     bat
     binutils
     btrfs-progs

modules/global/security.nix

@@ -19,6 +19,8 @@ with lib;
     cpu.amd.updateMicrocode = mkDefault config.hardware.enableRedistributableFirmware;
   };
 
+  users.mutableUsers = false;
+
   boot = {
     # Make tmp volatile, using tmpfs is speedy on SSD systems
     # Redundant on opt-in state systems