move public/private wifi logic into its own module

systems/artemision/private-wifi.nix

@@ -0,0 +1,19 @@
+{ ... }:
+{
+  networking.nameservers = [
+    "9.9.9.9"
+    "1.1.1.1"
+    "192.168.76.1"
+  ];
+
+  services.resolved = {
+    enable = true;
+    dnssec = "false";
+    domains = [ "~." ];
+    fallbackDns = [
+      "1.1.1.1#one.one.one.one"
+      "1.0.0.1#one.one.one.one"
+    ];
+    dnsovertls = "true";
+  };
+}

systems/artemision/wifi.nix

@@ -5,6 +5,9 @@ let
   public_wifi = false;
 in
 {
+  imports = lib.optionals (!public_wifi) [
+    ./private-wifi.nix
+  ];
   networking.wireless = {
     enable = true;
     secretsFile = config.sops.secrets."wifi-env".path;
@@ -42,24 +45,3 @@ in
     };
   };
 }
-//
-
-  lib.mkIf (!public_wifi) {
-
-    networking.nameservers = [
-      "9.9.9.9"
-      "1.1.1.1"
-      "192.168.76.1"
-    ];
-
-    services.resolved = {
-      enable = true;
-      dnssec = "false";
-      domains = [ "~." ];
-      fallbackDns = [
-        "1.1.1.1#one.one.one.one"
-        "1.0.0.1#one.one.one.one"
-      ];
-      dnsovertls = "true";
-    };
-  }