In reply to @accelbread:matrix.org
Yes, on last part.
For package key, assuming using ./nix, if ./nix/package.nix exists it is imported, else if ./nix/package/default.nix exists, it is imported, else if ./nix/package/ is a directory its nix files are loaded as an attrset

In reply to @accelbread:matrix.org
for shadowfang:
./nix/nixos/shadowfang/default.nix imports ./nix/nixos/shadowfang/configuration.nix: https://github.com/accelbread/config-flake/blob/11360f5278e8972c4f1978392028e8a595291a1c/nix/nixos/shadowfang/default.nix#L4
Then that imports the desktop module which is common dev machine setup (./nix/nixosModules/desktop.nix): https://github.com/accelbread/config-flake/blob/11360f5278e8972c4f1978392028e8a595291a1c/nix/nixos/shadowfang/configuration.nix#L5
And that configures home-manager: https://github.com/accelbread/config-flake/blob/11360f5278e8972c4f1978392028e8a595291a1c/nix/nixosModules/desktop.nix#L86-L91

Sorry to bother accelbread, but I'm trying to grasp how you managed to make options in openssh show up where they did

TrustedUserCAKeys = "${self + /misc/ssh_ca_user_key.pub}";
HostCertificate = "/persist/state/sshd/ssh_host_ed25519_key-cert.pub";

in your config in ../nix/nixosModules/common.nix

having looked at other peoples' configs I notice it is in
openssh.extraconfig = '' HostCertificate = blah/path''

Or declared in the file sshd_config.. how did you get it to be declarable as an option in openssh.settings ?