refactor: split "real" modules and "config" modules

config/dev/default.nix

@@ -0,0 +1,32 @@
+{
+  pkgs,
+  lib,
+  minimal,
+  ...
+}:
+lib.optionalAttrs (!minimal) {
+  imports = [
+    ./documentation.nix
+    ./embedded.nix
+    ./yubikey.nix
+  ];
+
+  environment.systemPackages = [pkgs.man-pages pkgs.man-pages-posix];
+  environment.enableDebugInfo = true;
+
+  # Add the agenix-rekey sandbox path permanently to avoid adding myself to trusted-users
+  nix.settings.extra-sandbox-paths = ["/var/tmp/agenix-rekey"];
+
+  environment.persistence."/state".directories = [
+    {
+      directory = "/var/tmp/agenix-rekey";
+      mode = "1777";
+    }
+    {
+      directory = "/var/tmp/nix-import-encrypted"; # Decrypted repo-secrets can be kept
+      mode = "1777";
+    }
+  ];
+
+  services.nixseparatedebuginfod.enable = true;
+}

config/dev/documentation.nix

@@ -0,0 +1,12 @@
+{
+  lib,
+  pkgs,
+  ...
+}: {
+  environment.systemPackages = with pkgs; [man-pages];
+  documentation = {
+    dev.enable = true;
+    man.enable = true;
+    info.enable = lib.mkForce false;
+  };
+}

config/dev/embedded.nix

@@ -0,0 +1,3 @@
+{pkgs, ...}: {
+  services.udev.packages = [pkgs.stlink];
+}

config/dev/yubikey.nix

@@ -0,0 +1,5 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [yubikey-manager yubikey-personalization age-plugin-yubikey];
+  services.udev.packages = with pkgs; [yubikey-personalization libu2f-host];
+  services.pcscd.enable = true;
+}