cleanup common configs + disable CONFIG_VT if kmscon is enabled

modules/common.nix

@@ -0,0 +1,57 @@
+{
+  config,
+  lib,
+  pkgs,
+  username,
+  ...
+}:
+{
+  # Common Nix daemon settings. Host-specific overrides (binary cache substituters,
+  # gc retention) live in the host's default.nix.
+  nix = {
+    optimise.automatic = true;
+
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      # Default retention: override per-host via lib.mkForce if different.
+      options = lib.mkDefault "--delete-older-than 30d";
+    };
+
+    settings = {
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+    };
+  };
+
+  # doas replaces sudo on every host
+  security = {
+    doas.enable = true;
+    sudo.enable = false;
+    doas.extraRules = [
+      {
+        users = [ username ];
+        keepEnv = true;
+        persist = true;
+      }
+    ];
+  };
+
+  # https://nixos.wiki/wiki/Fish#Setting_fish_as_your_shell
+  # Login shells stay bash but immediately `exec fish` so fish is the effective shell
+  # without breaking scripts that hardcode #!/bin/bash.
+  programs.fish.enable = true;
+  programs.bash = {
+    interactiveShellInit = ''
+      if [[ $(${pkgs.procps}/bin/ps --no-header --pid=$PPID --format=comm) != "fish" && -z ''${BASH_EXECUTION_STRING} ]]
+      then
+        shopt -q login_shell && LOGIN_OPTION='--login' || LOGIN_OPTION=""
+        exec ${lib.getExe pkgs.fish} $LOGIN_OPTION
+      fi
+    '';
+  };
+
+  services.kmscon.enable = true;
+}