Currently, a charon network spec is an ad-hoc system on top of the nixpkgs module library: each machine is a NixOS module, resources are modules with their own options, and some aspects (such as machine/resource names and the 'network' attribute) are not managed by the module system at all. It would probably be cleaner to have the spec itself simply be a module, where machines is an option whose type is attrsOf optionSet, resources.s3Buckets is an option whose type is attrs.Of optionSet, network.description is an option whose type is string, etc. We'd have to set the options attribute of the machines option to contain any options defined in NixOS modules that we care about, but since options is merged when an option is defined in multiple places, it should be possible to do this modularly.