Add new server modules and configurations for various services

- Introduced `default-creds` module for managing default credentials with Umami integration.
- Added `fail2ban` module for brute-force attack protection with configurable ban times.
- Created `firewall` module to enable and configure basic firewall settings.
- Implemented `gitea` module for self-hosted Git service with PostgreSQL backend.
- Developed `glance` module for a customizable dashboard with various widgets and themes.
- Added `iknowyou` module for a self-hosted password manager with production and demo environments.
- Introduced `kernel-hardening` module for enhancing kernel security settings.
- Created `mazanoke` module for a simple web application with Nginx integration.
- Added `mealie` module for a self-hosted meal planning application.
- Implemented `stirling-pdf` module for PDF generation service.
- Developed `umami` module for self-hosted analytics with secret management.
- Added `ssh` module for secure SSH configuration with user restrictions.
- Introduced `nixy` theme for a customized aesthetic experience across services.

hosts/work/configuration.nix

@@ -0,0 +1,41 @@
+{config, ...}: {
+  imports = [
+    # Mostly system related configuration
+    ../../nixos/audio.nix
+    ../../nixos/bluetooth.nix
+    ../../nixos/fonts.nix
+    ../../nixos/home-manager.nix
+    ../../nixos/nix.nix
+    ../../nixos/systemd-boot.nix
+    ../../nixos/tuigreet.nix
+    ../../nixos/usbguard.nix
+    ../../nixos/users.nix
+    ../../nixos/utils.nix
+    ../../nixos/hyprland.nix
+    ../../home/programs/helium/system.nix # I hate browser's configuration..
+
+    # You should let those lines as is
+    ./hardware-configuration.nix
+    ./variables.nix
+  ];
+
+  home-manager.users."${config.var.username}" = import ./home.nix;
+
+  # USBGuard:
+  # Allow all USB devices until a proper policy is configured.
+  # Run `sudo usbguard generate-policy` with your devices plugged in,
+  # then set rules = "<output>" and switch implicitPolicyTarget to "block".
+  # services.usbguard.implicitPolicyTarget = lib.mkForce "allow";
+  services.usbguard.rules = ''
+    allow id 1d6b:0002 serial "0000:00:14.0" name "xHCI Host Controller" hash "jEP/6WzviqdJ5VSeTUY8PatCNBKeaREvo2OqdplND/o=" parent-hash "rV9bfLq7c2eA4tYjVjwO4bxhm+y6GgZpl9J60L0fBkY=" with-interface 09:00:00 with-connect-type ""
+    allow id 1d6b:0003 serial "0000:00:14.0" name "xHCI Host Controller" hash "prM+Jby/bFHCn2lNjQdAMbgc6tse3xVx+hZwjOPHSdQ=" parent-hash "rV9bfLq7c2eA4tYjVjwO4bxhm+y6GgZpl9J60L0fBkY=" with-interface 09:00:00 with-connect-type ""
+    allow id 17ef:608d serial "" name "Lenovo USB Optical Mouse" hash "klpDZuv1jhWGNqZLOl+KXF+75Ir3PfBm6D6ncjoLRBU=" parent-hash "jEP/6WzviqdJ5VSeTUY8PatCNBKeaREvo2OqdplND/o=" via-port "1-7" with-interface 03:01:02 with-connect-type "hotplug"
+    allow id 17ef:6190 serial "" name "Lenovo Calliope USB Keyboard G2" hash "CfZ9R/aoXGm7BN/ojVEzKQwVoxCUtRWMuACrE7BL/5Y=" parent-hash "jEP/6WzviqdJ5VSeTUY8PatCNBKeaREvo2OqdplND/o=" via-port "1-10" with-interface { 03:01:01 03:00:00 } with-connect-type "hotplug"
+    allow id 0781:5581 name " SanDisk 3.2Gen1"
+  '';
+
+  networking.firewall.allowedTCPPorts = [9001];
+
+  # Don't touch this
+  system.stateVersion = "24.05";
+}