feat(packs): opt-in package packs — media/office/dev/gaming/containers/compat

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/packs/default.nix

@@ -0,0 +1,33 @@
+# omni packs — opt-in bundles of (packages + services + config).
+#
+# Every pack module is ALWAYS imported but inert until
+# `omni.packs.<name>.enable = true` (hlissner-style enable-gate), so
+# the option namespace is always declared and discoverable while nothing
+# is built unless asked for. This aggregator is wired into the build at a
+# single point — lib/mksystem.nix — so the ISO path (a direct nixosSystem
+# call that bypasses mksystem) stays pack-free.
+#
+# The lnbits / aiolabs / bitcoin packs are standalone-importable: they
+# declare their own option namespace and touch only standard NixOS
+# options + their own bundled modules, so a third party can import e.g.
+# `nixosModules.lnbits` on their own NixOS without enabling omni core.
+{ ... }:
+{
+  imports = [
+    ./compat.nix
+    ./media.nix
+    ./development.nix
+    ./gaming.nix
+    ./office.nix
+    ./containers.nix
+    ./lnbits.nix
+    ./aiolabs.nix
+    # bitcoin.nix is deliberately NOT in this always-loaded aggregator:
+    # nix-bitcoin's default module fires a secrets assertion just from
+    # being imported (even with no services enabled), so importing it
+    # inert on every host breaks eval. It's exposed as
+    # `nixosModules.bitcoin` instead — a host that wants a node imports it
+    # explicitly and sets omni.packs.bitcoin.enable. (inputs.nix-bitcoin
+    # is provided to such hosts via mksystem specialArgs.)
+  ];
+}