chore: update lockfile

deploy/colmena.nix

@@ -8,19 +8,15 @@ let
   utils = import ../utils { inherit lib; };
   hostDirNames = utils.dirNames ../hosts;
 
-  mkNode = hostname: tags: {
+  mkNode = hostname: meta: {
     imports = [ ../hosts/${hostname} ];
     deployment = {
-      targetHost = self.nixosConfigurations.${hostname}.config.ssh.publicHostname;
+      inherit (meta.deployment) targetHost targetUser tags;
-      targetUser = self.nixosConfigurations.${hostname}.config.ssh.username;
+      buildOnTarget = builtins.any (t: t != "local" && t != "arm") meta.deployment.tags;
-      buildOnTarget = builtins.any (t: t != "local" && t != "arm") tags;
-      inherit tags;
     };
   };
 
-  nodes = lib.genAttrs hostDirNames (
+  nodes = lib.genAttrs hostDirNames (hostname: mkNode hostname (utils.hostMeta ../hosts/${hostname}));
-    hostname: mkNode hostname (utils.hostMeta ../hosts/${hostname}).deployment.tags
-  );
 in
 inputs.colmena.lib.makeHive (
   {

dots/.local/share/task/hooks/on-add.limit.py

@@ -1,29 +0,0 @@
-#!/usr/bin/env python3
-import sys
-import json
-
-SLOTS_FILE = "/home/h/.local/share/task/add_slots"
-
-def get_slots():
-    try:
-        with open(SLOTS_FILE, "r") as f:
-            return int(f.read().strip())
-    except:
-        return 0
-
-slots = get_slots()
-
-if slots <= 0:
-    print(f"Cannot add task: No slots available (0/{slots}).")
-    print("Delete or complete a task first to earn an add slot.")
-    sys.exit(1)
-
-with open(SLOTS_FILE, "w") as f:
-    f.write(str(slots - 1))
-
-print(f"Task added. Slots remaining: {slots - 1}")
-
-for line in sys.stdin:
-    task = json.loads(line)
-    print(json.dumps(task))
-    sys.exit(0)

dots/.local/share/task/hooks/on-modify.limit.py

@@ -1,34 +0,0 @@
-#!/usr/bin/env python3
-import sys
-import json
-
-SLOTS_FILE = "/home/h/.local/share/task/add_slots"
-
-def get_slots():
-    try:
-        with open(SLOTS_FILE, "r") as f:
-            return int(f.read().strip())
-    except:
-        return 0
-
-data = sys.stdin.read().strip().split("\n")
-if len(data) < 2:
-    for line in data:
-        if line:
-            print(line)
-    sys.exit(0)
-
-old_task = json.loads(data[0])
-new_task = json.loads(data[1])
-
-was_pending = old_task.get("status") == "pending"
-is_not_pending = new_task.get("status") in ("completed", "deleted")
-
-if was_pending and is_not_pending:
-    slots = get_slots() + 1
-    with open(SLOTS_FILE, "w") as f:
-        f.write(str(slots))
-    print(f"Slot earned! Total slots: {slots}")
-
-print(json.dumps(new_task))
-sys.exit(0)

flake.lock

@@ -121,11 +121,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1776398575,
+        "lastModified": 1776744173,
-        "narHash": "sha256-WArU6WOdWxzbzGqYk4w1Mucg+bw/SCl6MoSp+/cZMio=",
+        "narHash": "sha256-9pZQWypgc0H1lgyuGmLqEL5IKVdHMw/NoO/iFcoSrW0=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "05815686caf4e3678f5aeb5fd36e567886ab0d30",
+        "rev": "a803876f3cfc65f8858d413cef2b7d10d50a81d7",
         "type": "gitlab"
       },
       "original": {
@@ -342,11 +342,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776373306,
+        "lastModified": 1776777932,
-        "narHash": "sha256-iAJIzHngGZeLIkjzuuWI6VBsYJ1n89a/Esq0m8R1vjs=",
+        "narHash": "sha256-0R3Yow/NzSeVGUke5tL7CCkqmss4Vmi6BbV6idHzq/8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d401492e2acd4fea42f7705a3c266cea739c9c36",
+        "rev": "5d5640599a0050b994330328b9fd45709c909720",
         "type": "github"
       },
       "original": {
@@ -467,11 +467,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1776169885,
+        "lastModified": 1776548001,
-        "narHash": "sha256-l/iNYDZ4bGOAFQY2q8y5OAfBBtrDAaPuRQqWaFHVRXM=",
+        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "4bd9165a9165d7b5e33ae57f3eecbcb28fb231c9",
+        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
         "type": "github"
       },
       "original": {
@@ -665,11 +665,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776119890,
+        "lastModified": 1776771786,
-        "narHash": "sha256-Zm6bxLNnEOYuS/SzrAGsYuXSwk3cbkRQZY0fJnk8a5M=",
+        "narHash": "sha256-DRFGPfFV6hbrfO9a1PH1FkCi7qR5FgjSqsQGGvk1rdI=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "d4971dd58c6627bfee52a1ad4237637c0a2fb0cd",
+        "rev": "bef289e2248991f7afeb95965c82fbcd8ff72598",
         "type": "github"
       },
       "original": {

flake.nix

@@ -76,7 +76,7 @@
           nixpkgs.lib.nixosSystem {
             modules = [
               ./hosts/${host}
-              { nixpkgs.hostPlatform = import ./hosts/${host}/system.nix; }
+              { nixpkgs.hostPlatform = (myUtils.hostMeta ./hosts/${host}).system; }
             ];
             specialArgs = {
               inherit

home/hosts/astyanax/default.nix

@@ -15,6 +15,7 @@
     ../../modules/cloud
     ../../modules/comms
     ../../modules/desktop/niri
+    ../../modules/devenv
     ../../modules/direnv
     ../../modules/git
     ../../modules/k8s/k9s.nix

home/hosts/work/default.nix

@@ -5,9 +5,6 @@
   ...
 }:
 
-let
-  username = "hektor";
-in
 {
   imports = [
     inputs.sops-nix.homeManagerModules.sops
@@ -21,6 +18,7 @@ in
     ../../modules/database
     ../../modules/dconf
     ../../modules/desktop/niri
+    ../../modules/devenv
     ../../modules/direnv
     ../../modules/docker
     ../../modules/git
@@ -56,8 +54,8 @@ in
 
   home = {
     stateVersion = "25.05";
-    inherit username;
+    username = "hektor";
-    homeDirectory = "/home/${username}";
+    homeDirectory = "/home/${config.home.username}";
   };
 
   targets.genericLinux.nixGL = {

home/modules/dconf/default.nix

@@ -3,6 +3,7 @@
 let
   terminal = "kitty";
   browser = config.browser.primary;
+  font = "${config.stylix.fonts.monospace.name} ${toString config.stylix.fonts.sizes.applications}";
 in
 {
   dconf.settings = {
@@ -40,9 +41,9 @@ in
       clock-show-weekday = true;
       color-scheme = "prefer-dark";
       enable-hot-corners = false;
-      font-name = "Iosevka Term SS08 12";
+      font-name = font;
       locate-pointer = true;
-      monospace-font-name = "Iosevka Term SS08 12";
+      monospace-font-name = font;
     };
 
     "org/gnome/desktop/wm/keybindings" = {

home/modules/default.nix

@@ -6,25 +6,32 @@
 }:
 
 {
-  options.nixgl.wrap = lib.mkOption {
+  options = {
-    type = lib.types.functionTo lib.types.package;
+    host.username = lib.mkOption {
-    default = if config.lib ? nixGL then config.lib.nixGL.wrap else lib.id;
+      type = lib.types.str;
-    readOnly = true;
+      default = config.home.username;
-  };
+    };
 
-  options.wrapApp = lib.mkOption {
+    nixgl.wrap = lib.mkOption {
-    type = lib.types.raw;
+      type = lib.types.functionTo lib.types.package;
-    default =
+      default = if config.lib ? nixGL then config.lib.nixGL.wrap else lib.id;
-      pkg: flags:
+      readOnly = true;
-      if config.lib ? nixGL then
+    };
-        pkg.overrideAttrs (old: {
+
-          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.makeWrapper ];
+    wrapApp = lib.mkOption {
-          postInstall = (old.postInstall or "") + ''
+      type = lib.types.raw;
-            wrapProgram $out/bin/${pkg.meta.mainProgram} --add-flags "${flags}"
+      default =
-          '';
+        pkg: flags:
-        })
+        if config.lib ? nixGL then
-      else
+          pkg.overrideAttrs (old: {
-        pkg;
+            nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.makeWrapper ];
-    readOnly = true;
+            postInstall = (old.postInstall or "") + ''
+              wrapProgram $out/bin/${pkg.meta.mainProgram} --add-flags "${flags}"
+            '';
+          })
+        else
+          pkg;
+      readOnly = true;
+    };
   };
 }

home/modules/k8s/default.nix

@@ -18,6 +18,10 @@
     enableAlias = true;
   };
 
+  home.shellAliases = {
+    k = "kubectl";
+  };
+
   imports = [
     ./helm.nix
     ./k9s.nix

home/modules/ssh/default.nix

@@ -1,18 +1,15 @@
 {
-  outputs,
+  myUtils,
   lib,
   pkgs,
   ...
 }:
 let
-  nixosConfigs = builtins.attrNames outputs.nixosConfigurations;
+  hostDir = ../../hosts;
-  homeConfigs = map (n: lib.last (lib.splitString "@" n)) (
+  hostNames = myUtils.dirNames hostDir;
-    builtins.attrNames outputs.homeConfigurations
-  );
-  allHosts = lib.unique (homeConfigs ++ nixosConfigs);
   hostsWithKeys = lib.filter (
-    hostname: builtins.pathExists ../../hosts/${hostname}/ssh_host.pub
+    hostname: builtins.pathExists (hostDir + "/${hostname}/ssh_host.pub")
-  ) allHosts;
+  ) hostNames;
 in
 {
   home.packages = with pkgs; [ sshfs ];
@@ -25,15 +22,14 @@ in
       lib.genAttrs hostsWithKeys (
         hostname:
         let
-          hostConfig = outputs.nixosConfigurations.${hostname}.config;
+          meta = myUtils.hostMeta (hostDir + "/${hostname}");
-          inherit (hostConfig.ssh) publicHostname username;
         in
         {
           host = hostname;
-          user = username;
+          user = meta.deployment.targetUser;
         }
-        // lib.optionalAttrs (publicHostname != "") {
+        // lib.optionalAttrs (meta.deployment.targetHost != "") {
-          hostname = publicHostname;
+          hostname = meta.deployment.targetHost;
         }
       )
       // {

home/modules/stylix/default.nix

@@ -25,21 +25,6 @@ in
       sansSerif = config.stylix.fonts.monospace;
       emoji = config.stylix.fonts.monospace;
     };
-    targets = {
+    targets = import ../../../modules/stylix/targets.nix;
-      firefox = {
-        profileNames = [ "default" ];
-        colorTheme.enable = true;
-      };
-      librewolf = {
-        profileNames = [ "default" ];
-        colorTheme.enable = true;
-      };
-      gnome.enable = false;
-      gtk.enable = false;
-      kitty = {
-        variant256Colors = true;
-      };
-      nixvim.enable = false;
-    };
   };
 }

home/modules/taskwarrior/default.nix

@@ -56,14 +56,6 @@ lib.optionalAttrs standalone {
     ".local/share/task/hooks/on-exit.sync.py" = {
       source = dotsPath + "/.local/share/task/hooks/on-exit.sync.py";
     };
-    ".local/share/task/hooks/on-add.limit.py" = {
-      source = dotsPath + "/.local/share/task/hooks/on-add.limit.py";
-      executable = true;
-    };
-    ".local/share/task/hooks/on-modify.limit.py" = {
-      source = dotsPath + "/.local/share/task/hooks/on-modify.limit.py";
-      executable = true;
-    };
     ".local/share/task/scripts/sync-and-notify.sh" = {
       source = dotsPath + "/.local/share/task/scripts/sync-and-notify.sh";
       executable = true;

hosts/andromache/default.nix

@@ -51,31 +51,17 @@ in
     ../../modules/yubikey
   ];
 
-  home-manager.users.${config.host.username} = import ../../home/hosts/andromache {
+  home-manager.users.${config.host.username} = import ../../home/hosts/andromache;
-    inherit
-      inputs
-      config
-      pkgs
-      lib
-      ;
-  };
 
-  ssh.username = config.host.username;
   ssh.authorizedHosts = [ "astyanax" ];
 
-  secrets = {
+  secrets.nixSigningKey.enable = true;
-    inherit (config.host) username;
-    nixSigningKey.enable = true;
-  };
 
   tailscale.enable = true;
 
-  docker.user = config.host.username;
+  docker.enable = true;
 
-  hcloud = {
+  hcloud.enable = true;
-    enable = true;
-    inherit (config.host) username;
-  };
 
   disko.devices = {
     disk.data = {
@@ -107,7 +93,6 @@ in
 
   my.yubikey = {
     enable = false;
-    inherit (config.host) username;
     keys = [
       {
         handle = "<KeyHandle1>";

hosts/andromache/meta.nix

@@ -1,4 +1,9 @@
 {
-  deployment.tags = [ "local" ];
+  system = "x86_64-linux";
+  deployment = {
+    tags = [ "local" ];
+    targetHost = "";
+    targetUser = "h";
+  };
   role = "desktop";
 }

hosts/andromache/system.nix

@@ -1 +0,0 @@
-"x86_64-linux"

hosts/astyanax/default.nix

@@ -47,26 +47,15 @@ in
     ../../modules/yubikey
   ];
 
-  home-manager.users.${config.host.username} = import ../../home/hosts/astyanax {
+  home-manager.users.${config.host.username} = import ../../home/hosts/astyanax;
-    inherit
-      inputs
-      config
-      pkgs
-      lib
-      ;
-  };
 
-  ssh.username = config.host.username;
   ssh.authorizedHosts = [ "andromache" ];
 
-  secrets = {
+  secrets.nixSigningKey.enable = true;
-    inherit (config.host) username;
-    nixSigningKey.enable = true;
-  };
 
   tailscale.enable = true;
-  docker.user = config.host.username;
+  docker.enable = true;
-  nfc.user = config.host.username;
+  nfc.enable = true;
   desktop.ly.enable = true;
   audio.automation.enable = true;
 

hosts/astyanax/meta.nix

@@ -1,4 +1,9 @@
 {
-  deployment.tags = [ "local" ];
+  system = "x86_64-linux";
+  deployment = {
+    tags = [ "local" ];
+    targetHost = "";
+    targetUser = "h";
+  };
   role = "laptop";
 }

hosts/astyanax/system.nix

@@ -1 +0,0 @@
-"x86_64-linux"

hosts/eetion-02/default.nix

@@ -12,8 +12,6 @@
   ];
 
   ssh = {
-    inherit (config.host) username;
-    publicHostname = config.host.name;
     authorizedHosts = [
       "andromache"
       "astyanax"

hosts/eetion-02/meta.nix

@@ -1,4 +1,9 @@
 {
-  deployment.tags = [ "arm" ];
+  system = "aarch64-linux";
+  deployment = {
+    tags = [ "arm" ];
+    targetHost = "eetion-02";
+    targetUser = "h";
+  };
   role = "embedded";
 }

hosts/eetion-02/system.nix

@@ -1 +0,0 @@
-"aarch64-linux"

hosts/eetion/default.nix

@@ -13,8 +13,6 @@
   ];
 
   ssh = {
-    inherit (config.host) username;
-    publicHostname = config.host.name;
     authorizedHosts = [
       "andromache"
       "astyanax"

hosts/eetion/meta.nix

@@ -1,4 +1,9 @@
 {
-  deployment.tags = [ "arm" ];
+  system = "aarch64-linux";
+  deployment = {
+    tags = [ "arm" ];
+    targetHost = "eetion";
+    targetUser = "h";
+  };
   role = "embedded";
 }

hosts/eetion/system.nix

@@ -1 +0,0 @@
-"aarch64-linux"

hosts/hecuba/default.nix

@@ -19,15 +19,13 @@
 
   networking.hostName = config.host.name;
   ssh = {
-    inherit (config.host) username;
-    publicHostname = "server.hektormisplon.xyz";
     authorizedHosts = [
       "andromache"
       "astyanax"
     ];
   };
 
-  docker.user = config.host.username;
+  docker.enable = true;
 
   fileSystems."/" = {
     device = "/dev/disk/by-label/nixos";

hosts/hecuba/meta.nix

@@ -1,4 +1,9 @@
 {
-  deployment.tags = [ "cloud" ];
+  system = "x86_64-linux";
+  deployment = {
+    tags = [ "cloud" ];
+    targetHost = "server.hektormisplon.xyz";
+    targetUser = "username";
+  };
   role = "server";
 }

hosts/hecuba/system.nix

@@ -1 +0,0 @@
-"x86_64-linux"

hosts/vm/default.nix

@@ -1,7 +1,6 @@
 {
   inputs,
   config,
-  pkgs,
   ...
 }:
 {
@@ -29,13 +28,7 @@
     ../../modules/x
   ];
 
-  home-manager.users.${config.host.username} = import ../../home/hosts/vm {
+  home-manager.users.${config.host.username} = import ../../home/hosts/vm;
-    inherit inputs config pkgs;
-  };
-
-  ssh.username = config.host.username;
-
-  secrets.username = config.host.username;
 
   disko = {
     devices.disk.main = {

hosts/vm/meta.nix

@@ -1,4 +1,9 @@
 {
-  deployment.tags = [ "local" ];
+  system = "x86_64-linux";
+  deployment = {
+    tags = [ "local" ];
+    targetHost = "";
+    targetUser = "h";
+  };
   role = "vm";
 }

hosts/vm/system.nix

@@ -1 +0,0 @@
-"x86_64-linux"

images/sd-image-orange-pi-aarch64.nix

@@ -12,10 +12,15 @@ let
 in
 {
   imports = [
+    ../modules/common/host.nix
     ../modules/ssh
   ];
 
-  ssh.username = username;
+  host = {
+    inherit username;
+    name = "orange-pi";
+  };
+
   ssh.authorizedHosts = [
     "andromache"
     "astyanax"

images/sd-image-raspberry-pi-aarch64.nix

@@ -12,10 +12,15 @@ let
 in
 {
   imports = [
+    ../modules/common/host.nix
     ../modules/ssh
   ];
 
-  ssh.username = username;
+  host = {
+    inherit username;
+    name = "raspberry-pi";
+  };
+
   ssh.authorizedHosts = [
     "andromache"
     "astyanax"

modules/ai-tools/default.nix

@@ -1,7 +1,8 @@
 { config, myUtils, ... }:
 
 let
-  inherit (config.secrets) sopsDir username;
+  inherit (config.secrets) sopsDir;
+  inherit (config.host) username;
   owner = config.users.users.${username}.name;
 in
 {

modules/anki/default.nix

@@ -1,7 +1,8 @@
 { config, myUtils, ... }:
 
 let
-  inherit (config.secrets) sopsDir username;
+  inherit (config.secrets) sopsDir;
+  inherit (config.host) username;
   owner = config.users.users.${username}.name;
 in
 {

modules/common/default.nix

@@ -73,6 +73,11 @@ in
           myUtils
           ;
       };
+      sharedModules = [
+        {
+          host.username = lib.mkDefault config.host.username;
+        }
+      ];
     };
   };
 }

modules/docker/default.nix

@@ -2,29 +2,17 @@
 
 let
   cfg = config.docker;
+  inherit (config.host) username;
 in
 {
   options.docker = {
+    enable = lib.mkEnableOption "docker";
     rootless = lib.mkOption {
       type = lib.types.bool;
       default = false;
     };
-    user = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-    };
   };
   config = lib.mkMerge [
-    {
-      warnings = lib.flatten [
-        (lib.optional (
-          cfg.rootless && cfg.user != null
-        ) "'virtualisation.docker.user' is ignored when rootless mode is enabled")
-        (lib.optional (
-          !cfg.rootless && cfg.user == null
-        ) "'virtualisation.docker.user' is not set (no user is added to the docker group)")
-      ];
-    }
     (lib.mkIf cfg.rootless {
       virtualisation.docker = {
         enable = false;
@@ -34,11 +22,9 @@ in
         };
       };
     })
-    (lib.mkIf (!cfg.rootless && cfg.user != null) {
+    (lib.mkIf (cfg.enable && !cfg.rootless) {
-      virtualisation.docker = {
+      virtualisation.docker.enable = true;
-        enable = true;
+      users.users.${username}.extraGroups = [ "docker" ];
-      };
-      users.users.${cfg.user}.extraGroups = [ "docker" ];
     })
   ];
 }

modules/git/default.nix

@@ -4,7 +4,7 @@
 }:
 
 let
-  inherit (config.secrets) username;
+  inherit (config.host) username;
   owner = config.users.users.${username}.name;
 in
 {

modules/hcloud/default.nix

@@ -7,25 +7,22 @@
 
 let
   cfg = config.hcloud;
+  inherit (config.host) username;
   inherit (config.secrets) sopsDir;
 in
 {
   options.hcloud = {
     enable = lib.mkEnableOption "hcloud CLI configuration";
-    username = lib.mkOption {
-      type = lib.types.str;
-      description = "Username for hcloud CLI configuration";
-    };
   };
 
   config = lib.mkIf cfg.enable {
     sops.secrets = myUtils.mkSopsSecrets sopsDir "hcloud" [ "api-token" ] {
-      owner = config.users.users.${cfg.username}.name;
+      owner = config.users.users.${username}.name;
     };
 
     sops.templates."hcloud/cli.toml" = {
-      owner = config.users.users.${cfg.username}.name;
+      owner = config.users.users.${username}.name;
-      path = "/home/${cfg.username}/.config/hcloud/cli.toml";
+      path = "/home/${username}/.config/hcloud/cli.toml";
       content = ''
         active_context = "server"
 

modules/nfc/default.nix

@@ -2,15 +2,13 @@
 
 let
   cfg = config.nfc;
+  inherit (config.host) username;
 in
 {
   options.nfc = {
-    user = lib.mkOption {
+    enable = lib.mkEnableOption "NFC device access";
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-    };
   };
-  config = lib.mkIf (cfg.user != null) {
+  config = lib.mkIf cfg.enable {
-    users.users.${cfg.user}.extraGroups = [ "dialout" ];
+    users.users.${username}.extraGroups = [ "dialout" ];
   };
 }

modules/secrets/default.nix

@@ -9,8 +9,9 @@
 
 let
   cfg = config.secrets;
+  inherit (config.host) username;
   inherit (cfg) sopsDir;
-  owner = config.users.users.${cfg.username}.name;
+  owner = config.users.users.${username}.name;
   mkSopsSecrets = myUtils.mkSopsSecrets sopsDir;
 in
 {
@@ -18,10 +19,6 @@ in
 
   options = {
     secrets = {
-      username = lib.mkOption {
-        type = lib.types.str;
-      };
-
       sopsDir = lib.mkOption {
         type = lib.types.str;
         default = "${toString inputs.nix-secrets}/secrets";
@@ -43,7 +40,7 @@ in
       # ```
       # age-plugin-yubikey --identity > <keyfile-path>
       # ```
-      age.keyFile = "/home/${cfg.username}/.config/sops/age/keys.txt";
+      age.keyFile = "/home/${username}/.config/sops/age/keys.txt";
 
       secrets = lib.mkMerge [
         (mkSopsSecrets "email" [ "personal" "work" ] { inherit owner; })

modules/ssh/authorized-keys.nix

@@ -1,22 +1,18 @@
 { lib, config, ... }:
+
+let
+  inherit (config.host) username;
+in
 {
   options.ssh = {
     authorizedHosts = lib.mkOption {
       type = lib.types.listOf lib.types.str;
       default = [ ];
     };
-    username = lib.mkOption {
-      type = lib.types.str;
-      default = "h";
-    };
-    publicHostname = lib.mkOption {
-      type = lib.types.str;
-      default = "";
-    };
   };
 
   # auto generate authorized_keys from `authorizedHosts`
-  config.users.users.${config.ssh.username}.openssh.authorizedKeys.keys = lib.flatten (
+  config.users.users.${username}.openssh.authorizedKeys.keys = lib.flatten (
     map (
       hostname:
       let

modules/ssh/extract-keys.nix

@@ -1,6 +1,6 @@
 { lib, config, ... }:
 let
-  inherit (config.ssh) username;
+  inherit (config.host) username;
 in
 {
   # auto extract SSH keys

modules/stylix/default.nix

@@ -30,20 +30,7 @@ in
 
   home-manager.sharedModules = [
     {
-      stylix.targets = {
+      stylix.targets = import ./targets.nix;
-        firefox = {
-          profileNames = [ "default" ];
-          colorTheme.enable = true;
-        };
-        librewolf = {
-          profileNames = [ "default" ];
-          colorTheme.enable = true;
-        };
-        kitty.variant256Colors = true;
-        gnome.enable = false;
-        gtk.enable = false;
-        nixvim.enable = false;
-      };
     }
   ];
 }

modules/stylix/targets.nix

@@ -0,0 +1,14 @@
+{
+  firefox = {
+    profileNames = [ "default" ];
+    colorTheme.enable = true;
+  };
+  librewolf = {
+    profileNames = [ "default" ];
+    colorTheme.enable = true;
+  };
+  kitty.variant256Colors = true;
+  gnome.enable = false;
+  gtk.enable = false;
+  nixvim.enable = false;
+}

modules/syncthing/default.nix

@@ -7,23 +7,18 @@
 with lib;
 
 let
-  cfg = config.my.syncthing;
+  inherit (config.host) username;
 in
 {
-  options.my.syncthing.username = mkOption {
-    type = types.str;
-    default = "h";
-  };
-
   config = {
-    users.groups.${cfg.username} = { };
+    users.groups.${username} = { };
-    users.users.${cfg.username}.extraGroups = [ cfg.username ];
+    users.users.${username}.extraGroups = [ username ];
 
     services.syncthing = {
       enable = true;
-      user = cfg.username;
+      user = username;
-      group = cfg.username;
+      group = username;
-      configDir = "/home/${cfg.username}/.local/state/syncthing";
+      configDir = "/home/${username}/.local/state/syncthing";
       openDefaultPorts = true;
     };
   };

modules/taskwarrior/default.nix

@@ -1,7 +1,8 @@
 { config, myUtils, ... }:
 
 let
-  inherit (config.secrets) sopsDir username;
+  inherit (config.secrets) sopsDir;
+  inherit (config.host) username;
   owner = config.users.users.${username}.name;
 in
 {

modules/yubikey/default.nix

@@ -9,18 +9,14 @@ with lib;
 
 let
   cfg = config.my.yubikey;
+  inherit (config.host) username;
   formatKey = key: ":${key.handle},${key.userKey},${key.coseType},${key.options}";
-  authfileContent = username: keys: username + lib.concatMapStrings formatKey keys;
+  authfileContent = u: keys: u + lib.concatMapStrings formatKey keys;
 in
 {
   options.my.yubikey = {
     enable = mkEnableOption "yubiKey U2F authentication";
 
-    username = mkOption {
-      type = types.str;
-      default = "h";
-    };
-
     origin = mkOption {
       type = types.str;
       default = "pam://yubi";
@@ -61,7 +57,7 @@ in
           interactive = true;
           cue = true;
           inherit (cfg) origin;
-          authfile = pkgs.writeText "u2f-mappings" (authfileContent cfg.username cfg.keys);
+          authfile = pkgs.writeText "u2f-mappings" (authfileContent username cfg.keys);
         };
       };
       services = {