hardware: Add microcode updates

modules/hardware/amd.nix

@@ -0,0 +1,5 @@
+{ ... }:
+
+{
+  hardware.cpu.amd.updateMicrocode = true;
+}

modules/hardware/intel.nix

@@ -3,7 +3,11 @@
 }:
 
 {
-  hardware.opengl.extraPackages = with pkgs; [ vaapiIntel intel-media-driver ];
+  hardware = {
+    cpu.intel.updateMicrocode = true;
+    # NOTE: Assuming each Intel CPU has integrated graphics
+    opengl.extraPackages = with pkgs; [ vaapiIntel intel-media-driver ];
+  };
   # TODO: Remove?
   services.xserver.videoDrivers = [ "modesetting" "fbdev" ];
 }

modules/host.nix

@@ -86,7 +86,7 @@ let
 
     # We don't tolerate non-free software, except for Steam and Linux firmware
     nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
-      "firmwareLinuxNonfree"
+      "firmwareLinuxNonfree" "microcodeAmd" "microcodeIntel"
       "steam" "steam-original" "steam-runtime"
       "discord"
     ];