2 files changed, 38 insertions, 13 deletions
diff --git a/modules/nix.nix b/modules/nix.nix
index 8396739..37c9fe5 100644
--- a/modules/nix.nix
+++ b/modules/nix.nix
@@ -1,8 +1,5 @@
 { config, lib, ... }:
 
-let
-  allowed = config.nix.allowedUnfree;
-in
 {
   options.nix = {
     experimentalFeatures = lib.mkOption {
@@ -12,19 +9,13 @@ in
         Enables experimental features
       '';
     };
-
-    allowedUnfree = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      description = ''
-        Allows for  unfree packages by their name.
-      '';
-    };
   };
 
   config = lib.mkMerge [
-    (lib.mkIf (config.nix.experimentalFeatures != "") { nix.extraOptions = "experimental-features = ${config.nix.experimentalFeatures}"; })
-    (lib.mkIf (allowed != [ ]) { nixpkgs.config.allowUnfreePredicate = (pkg: __elem (lib.getName pkg) allowed); })
+    (lib.mkIf
+      (config.nix.experimentalFeatures != "")
+      { nix.extraOptions = "experimental-features = ${config.nix.experimentalFeatures}"; })
+
     { nix.settings.auto-optimise-store = lib.mkDefault true; }
     {
       nix.gc.automatic = lib.mkDefault true;
diff --git a/modules/nixpkgs.nix b/modules/nixpkgs.nix
new file mode 100644
index 0000000..1e55876
--- /dev/null
+++ b/modules/nixpkgs.nix
@@ -0,0 +1,34 @@
+{ config, lib, ... }:
+
+let
+  allowedUnf = config.nixpkgs.allowedUnfree;
+  allowedIns = config.nixpkgs.allowedInsecure;
+in
+{
+  options.nixpkgs = {
+    allowedUnfree = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = ''
+        Allows for unfree packages by their name.
+      '';
+    };
+
+    allowedInsecure = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = ''
+        Allows for insecure packages by their name.
+      '';
+    };
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf
+      (allowedUnf != [ ])
+      { nixpkgs.config.allowUnfreePredicate = (pkg: __elem (lib.getName pkg) allowedUnf); })
+    (lib.mkIf
+      (allowedIns != [ ])
+      { nixpkgs.config.allowInsecurePredicate = (pkg: __elem (lib.getName pkg) allowedIns); })
+  ];
+}