hosts/common: move /var/lib/private defn into fs.nix

hosts/common/default.nix

@@ -23,9 +23,6 @@
   sane.programs.sysadminUtils.enableFor.system = lib.mkDefault true;
   sane.programs.consoleUtils.enableFor.user.colin = lib.mkDefault true;
 
-  # some services which use private directories error if the parent (/var/lib/private) isn't 700.
-  sane.fs."/var/lib/private".dir.acl.mode = "0700";
-
   nixpkgs.config.allowUnfree = true;
   nixpkgs.config.allowBroken = true;  # NIXPKGS_ALLOW_BROKEN
 

hosts/common/fs.nix

@@ -57,6 +57,9 @@ let fsOpts = rec {
 };
 in
 {
+  # some services which use private directories error if the parent (/var/lib/private) isn't 700.
+  sane.fs."/var/lib/private".dir.acl.mode = "0700";
+
   # fileSystems."/mnt/servo-nfs" = {
   #   device = "servo-hn:/";
   #   noCheck = true;