add work host

modules/work.nix

@@ -0,0 +1,68 @@
+{ den, inputs, lib, config, ... }: {
+  den.aspects.work-specific.nixos = { pkgs, config, ... }: {
+    imports = [
+      ./_hardware/work-hardware.nix
+      ./_hardware/notebook-disko.nix
+      inputs.disko.nixosModules.disko
+    ];
+
+    hardware.graphics = {
+      enable      = true;
+      enable32Bit = true;
+    };
+
+    hardware.nvidia = {
+      modesetting.enable          = true;
+      open                        = false;
+      nvidiaSettings              = true;
+      # Fine-grained power management is required for PRIME offload mode.
+      powerManagement.enable      = true;
+      powerManagement.finegrained = true;
+      package = config.boot.kernelPackages.nvidiaPackages.stable;
+    };
+
+    # amdgpu drives the display; nvidia is available for offloaded rendering.
+    services.xserver.videoDrivers = [ "amdgpu" "nvidia" ];
+
+    environment.sessionVariables = {
+      GBM_BACKEND               = "nvidia-drm";
+      __GLX_VENDOR_LIBRARY_NAME = "nvidia";
+    };
+
+    security.sudo.wheelNeedsPassword = lib.mkForce true;
+
+    networking.firewall = {
+      enable          = true;
+      allowedTCPPorts = [];
+      allowedUDPPorts = [];
+    };
+
+    services.thermald.enable = true;
+    powerManagement.enable   = true;
+
+    services.tlp = {
+      enable   = true;
+      settings = {
+        CPU_SCALING_GOVERNOR_ON_AC  = "performance";
+        CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
+      };
+    };
+
+    boot = {
+      initrd.kernelModules = [ "dm-crypt" "amdgpu" ];
+      initrd.compressor    = "zstd";
+      kernelParams         = [ "nvidia.NVreg_PreserveVideoMemoryAllocations=1" ];
+
+      loader = {
+        grub = {
+          enable             = true;
+          device             = "nodev";
+          efiSupport         = true;
+          configurationLimit = 2;
+          enableCryptodisk   = true;
+        };
+        efi.canTouchEfiVariables = true;
+      };
+    };
+  };
+}