explicitly list allowed unfree packages

modules/base/system.nix

@@ -27,7 +27,6 @@
       nixpkgs-unstable.flake = nixpkgs-unstable;
     };
   };
-  nixpkgs.config.allowUnfree = true;
 
   # Enable all firmware with a license allowing redistribution
   hardware.enableRedistributableFirmware = true;

modules/desktop/programs.nix

@@ -1,4 +1,4 @@
-{ home-manager, nixpkgs, pkgs, ... }: {
+{ home-manager, lib, nixpkgs, pkgs, ... }: {
   # Packages useful on a desktop computer which don't require their own module
 
   environment.systemPackages = with pkgs; [
@@ -18,6 +18,11 @@
     webcord # discord
   ];
 
+  nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
+    "pycharm-professional"
+    "spotify"
+  ];
+
   nixpkgs.config.permittedInsecurePackages = [
     "electron-24.8.6" # for webcord
   ];