refactor: explicitly allow unfree packages

hosts/common/default.nix

@@ -64,21 +64,13 @@
     users."${username}" = import ./home.nix;
   };
 
-  nixpkgs = {
-    config = {
-      allowUnfree = true;
+  nixpkgs.overlays = [
+    inputs.nur.overlays.default
 
-      permittedInsecurePackages = [ "electron-27.3.11" ];
-    };
-
-    overlays = [
-      inputs.nur.overlays.default
-
-      outputs.overlays.additions
-      outputs.overlays.modifications
-      outputs.overlays.stable-packages
-    ];
-  };
+    outputs.overlays.additions
+    outputs.overlays.modifications
+    outputs.overlays.stable-packages
+  ];
 
   nix.extraOptions = ''
     trusted-users = root ${username}

hosts/common/home.nix

@@ -9,8 +9,6 @@ let
   pkgs = import inputs.nixpkgs {
     inherit system;
 
-    config.allowUnfree = true;
-
     overlays = [
       outputs.overlays.additions
       outputs.overlays.stable-packages

hosts/t480/configuration.nix

@@ -89,7 +89,6 @@
     peek
     pmutils
     shotwell
-    slack
     stable.gscan2pdf
     sxiv
     tailscale
@@ -97,6 +96,5 @@
     xcape
     xsel
     yt-dlp
-    zoom-us
   ];
 }

modules2/browsers/librewolf/extensions.nix

@@ -7,7 +7,6 @@
           awesome-rss
           bitwarden
           darkreader
-          onetab
           tree-style-tab
           ublock-origin
           videospeed

modules2/games/steam.nix

@@ -1,3 +1,8 @@
 {
+  nixpkgs.allowedUnfreePackages = [
+    "steam"
+    "steam-unwrapped"
+  ];
+
   flake.modules.nixos.pc.programs.steam.enable = true;
 }

modules2/hosts/t480/open-webui.nix

@@ -1,3 +1,5 @@
 {
+  nixpkgs.allowedUnfreePackages = [ "open-webui" ];
+
   flake.modules.nixos.pc.services.open-webui.enable = true;
 }

modules2/hosts/t480/slack.nix

@@ -0,0 +1,11 @@
+{ config, ... }:
+
+{
+  nixpkgs.allowedUnfreePackages = [ "slack" ];
+
+  flake.modules.nixos."nixosConfigurations/t480" =
+    { pkgs, ... }:
+    {
+      users.users."${config.flake.meta.owner.username}".packages = [ pkgs.slack ];
+    };
+}

modules2/hosts/t480/zoom.nix

@@ -0,0 +1,11 @@
+{ config, ... }:
+
+{
+  nixpkgs.allowedUnfreePackages = [ "zoom" ];
+
+  flake.modules.nixos."nixosConfigurations/t480" =
+    { pkgs, ... }:
+    {
+      users.users."${config.flake.meta.owner.username}".packages = [ pkgs.zoom-us ];
+    };
+}

modules2/makemkv.nix

@@ -1,6 +1,8 @@
 { config, ... }:
 
 {
+  nixpkgs.allowedUnfreePackages = [ "makemkv" ];
+
   flake.modules.nixos.pc =
     { pkgs, ... }:
     {

modules2/meta-output.nix

@@ -0,0 +1,7 @@
+{ lib, ... }:
+
+{
+  options.flake.meta = lib.mkOption {
+    type = lib.types.anything;
+  };
+}

modules2/unfree-packages.nix

@@ -0,0 +1,26 @@
+{ config, lib, ... }:
+
+{
+  options.nixpkgs.allowedUnfreePackages = lib.mkOption {
+    type = lib.types.listOf lib.types.str;
+    default = [ ];
+  };
+
+  config.flake = {
+    modules =
+      let
+        predicate = pkg: builtins.elem (lib.getName pkg) config.nixpkgs.allowedUnfreePackages;
+      in
+      {
+        nixos.workstation.nixpkgs.config.allowUnfreePredicate = predicate;
+
+        homeManager.base = args: {
+          nixpkgs.config = lib.mkIf (!(args.hasGlobalPkgs or false)) {
+            allowUnfreePredicate = predicate;
+          };
+        };
+      };
+
+    meta.nixpkgs.allowedUnfreePackages = config.nixpkgs.allowedUnfreePackages;
+  };
+}

modules2/zsh/abbreviations/abbreviations.nix

@@ -1,4 +1,8 @@
 {
+  nixpkgs.allowedUnfreePackages = [
+    "zsh-abbr"
+  ];
+
   flake.modules.homeManager.base.programs.zsh.zsh-abbr.abbreviations = {
     cl = "clear";
     cs = "create-script";