chore: update lockfile

dots/.config/tmux/tmux.conf

@@ -76,3 +76,5 @@ if-shell '\( #{$TMUX_VERSION_MAJOR} -eq 2 -a #{$TMUX_VERSION_MINOR} -lt 4\) -o #
 if-shell '\( #{$TMUX_VERSION_MAJOR} -eq 2 -a #{$TMUX_VERSION_MINOR} -lt 2\) -o #{$TMUX_VERSION_MAJOR} -le 1' 'set-option -g status-utf8 on'
 
 set -g allow-passthrough on
+set -s extended-keys on
+set -as terminal-features 'xterm*:extkeys'

flake.lock

@@ -121,11 +121,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1778904158,
+        "lastModified": 1779595358,
-        "narHash": "sha256-xZ/zdpu9X8OI1jGqd4z6W1hKa+DQh8A9k3TH6w9tNbo=",
+        "narHash": "sha256-wYTO3i1Xe1oh9lWP8cAcgtD4tJyWFQRcN1uxYpdcL1Q=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "c31bafebd7e30517ead27149ad790802b998e98f",
+        "rev": "3028f7f65d02928083359f8701507a8b35d8bf42",
         "type": "gitlab"
       },
       "original": {
@@ -342,11 +342,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778921576,
+        "lastModified": 1779627636,
-        "narHash": "sha256-jgIbBcGgKTtkp+lBas29hNFUU1t5O/2+GFvUjbiG0vM=",
+        "narHash": "sha256-J6JGf42zNzLo/CrRdKb5dNznpLI+eGxN/5KTLG1Mo5s=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "32b42d71b4b22c4465963285bb6e462d7c93d45e",
+        "rev": "044c30c19550c0557997dece4ce9e54d2fa77ba1",
         "type": "github"
       },
       "original": {
@@ -398,10 +398,10 @@
     "nix-secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1776723456,
+        "lastModified": 1778944969,
-        "narHash": "sha256-GBbbm05oXYqSZ2EgxQPsNpTKl16wNhvrlUxdmv0FbSU=",
+        "narHash": "sha256-wT4WiBUqfeajcaOWvSKmHGKXEGmnDVQsRg0v7NoZW5o=",
         "ref": "main",
-        "rev": "135b681d24af6ee4508bbf7c657982d7be8743d4",
+        "rev": "aae027d8de9ae66ea29c9e6a5ff6ea0f4b735261",
         "shallow": true,
         "type": "git",
         "url": "ssh://git@github.com/hektor/nix-secrets"
@@ -451,11 +451,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1778924461,
+        "lastModified": 1779258371,
-        "narHash": "sha256-pDGhSCz+QxjHzP9gqYpK59k4Z1ZpVyYjzBgoXLFXh9s=",
+        "narHash": "sha256-j1iZsLy6oFApqR1oiDmHhvkwxXqcNi0aoSJj643LuwU=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "65a5c8f9c19d5f9d1b06d8942b04d790414ccfdd",
+        "rev": "c97bc4d15bd3473dd095e8e8ba57330ab1943a77",
         "type": "github"
       },
       "original": {
@@ -467,11 +467,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1778443072,
+        "lastModified": 1779508470,
-        "narHash": "sha256-zi7/fsqM/kFdNuED//4WOCUtezGtKKqRNORjMvfwjnA=",
+        "narHash": "sha256-Ap9KJX+5xHIn3bPIpfNgT6MEXdAECECwo4/rmlQD74M=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "da5ad661ba4e5ef59ba743f0d112cbc30e474f32",
+        "rev": "29916453413845e54a65b8a1cf996842300cd299",
         "type": "github"
       },
       "original": {
@@ -714,11 +714,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1778776709,
+        "lastModified": 1779378391,
-        "narHash": "sha256-YhnEcpiY6+l3RFA+cPmdTaeODGvNRuqE8B7VBjPVIxo=",
+        "narHash": "sha256-IsDb9erotvx9npI94UDosvMeYQK17p7/vmU2v9batrY=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "e8ea85b4f7dddda9603e0f1ac86cd92cee3b2819",
+        "rev": "c1456cc4ba3c9485e7b4158c909eeca5a752cd59",
         "type": "github"
       },
       "original": {

flake.nix

@@ -138,6 +138,7 @@
           };
           modules = [ ./home/hosts/work ];
           extraSpecialArgs = {
+            osConfig = null;
             inherit
               inputs
               outputs
@@ -148,7 +149,9 @@
         };
       };
 
-      apps.${system}.colmena = inputs.colmena.apps.${system}.default;
+      apps.${system}.colmena = inputs.colmena.apps.${system}.default // {
+        meta.description = "colmena";
+      };
 
       colmenaHive = import ./deploy/colmena.nix {
         inherit

home/hosts/andromache/default.nix

@@ -8,31 +8,6 @@
 {
   imports = [
     ../../modules
-    ../../modules/3d
-    ../../modules/ai-tools
-    ../../modules/anki
-    ../../modules/audio
-    ../../modules/browser
-    ../../modules/cloud
-    ../../modules/comms
-    ../../modules/desktop/niri
-    ../../modules/devenv
-    ../../modules/direnv
-    ../../modules/git
-    ../../modules/k8s/k9s.nix
-    ../../modules/keepassxc
-    ../../modules/music
-    ../../modules/nvim
-    ../../modules/pandoc
-    ../../modules/photography
-    ../../modules/secrets
-    ../../modules/shell
-    ../../modules/ssh
-    ../../modules/taskwarrior
-    ../../modules/terminal
-    ../../modules/torrenting
-    ../../modules/yubikey
-    ../../modules/zk
   ];
 
   home = {
@@ -52,12 +27,32 @@
     claude-code.enable = true;
     opencode.enable = true;
   };
+  desktop.niri.enable = true;
+  browser.enable = true;
   browser.primary = "librewolf";
   cloud.hetzner.enable = true;
   comms.signal.enable = true;
+  git.enable = true;
   git.github.enable = true;
-  shell.bash.aliases.lang-js = true;
+  shell = {
-  shell.bash.addBinToPath = true;
+    enable = true;
+    bash.aliases.lang-js = true;
+    bash.addBinToPath = true;
+  };
+  anki.enable = true;
+  k8s.k9s.enable = true;
+  secrets.enable = true;
+  taskwarrior.enable = true;
+  audio.enable = true;
+  ssh.enable = true;
+  music.enable = true;
+  terminal.enable = true;
+  devenv.enable = true;
+  keepassxc.enable = true;
+  direnv.enable = true;
+  nvim.enable = true;
+  pandoc.enable = true;
+  photography.enable = true;
   torrenting.enable = true;
   my.yubikey.enable = true;
   zk.enable = true;

home/hosts/astyanax/default.nix

@@ -7,29 +7,6 @@
 {
   imports = [
     ../../modules
-    ../../modules/3d
-    ../../modules/ai-tools
-    ../../modules/anki
-    ../../modules/audio
-    ../../modules/browser
-    ../../modules/cloud
-    ../../modules/comms
-    ../../modules/desktop/niri
-    ../../modules/devenv
-    ../../modules/direnv
-    ../../modules/git
-    ../../modules/k8s/k9s.nix
-    ../../modules/keepassxc
-    ../../modules/music
-    ../../modules/nfc
-    ../../modules/nvim
-    ../../modules/pandoc
-    ../../modules/secrets
-    ../../modules/shell
-    ../../modules/ssh
-    ../../modules/taskwarrior
-    ../../modules/terminal
-    ../../modules/yubikey
   ];
 
   home = {
@@ -48,13 +25,33 @@
     claude-code.enable = true;
     opencode.enable = true;
   };
+  anki.enable = true;
+  audio.enable = true;
+  browser.enable = true;
   browser.primary = "librewolf";
   cloud.hetzner.enable = true;
   comms.signal.enable = true;
+  desktop.niri.enable = true;
+  devenv.enable = true;
+  direnv.enable = true;
+  git.enable = true;
   git.github.enable = true;
-  shell.bash.aliases.lang-js = true;
+  k8s.k9s.enable = true;
-  shell.bash.addBinToPath = true;
+  keepassxc.enable = true;
+  music.enable = true;
   my.yubikey.enable = true;
+  nfc.enable = true;
+  nvim.enable = true;
+  pandoc.enable = true;
+  secrets.enable = true;
+  shell = {
+    enable = true;
+    bash.aliases.lang-js = true;
+    bash.addBinToPath = true;
+  };
+  ssh.enable = true;
+  taskwarrior.enable = true;
+  terminal.enable = true;
 
   programs = {
     home-manager.enable = true;

home/hosts/packages.nix

@@ -3,7 +3,9 @@
 with pkgs;
 [
   bat
+  curl
   entr
+  fd
   feh
   fzf
   htop

home/hosts/work/default.nix

@@ -8,36 +8,8 @@
 {
   imports = [
     inputs.sops-nix.homeManagerModules.sops
+    inputs.stylix.homeModules.stylix
     ../../modules
-    ../../modules/ai-tools
-    ../../modules/anki
-    ../../modules/browser
-    ../../modules/bruno
-    ../../modules/cloud
-    ../../modules/comms
-    ../../modules/database
-    ../../modules/dconf
-    ../../modules/desktop/niri
-    ../../modules/devenv
-    ../../modules/direnv
-    ../../modules/docker
-    ../../modules/git
-    ../../modules/go
-    ../../modules/infra
-    ../../modules/k8s
-    ../../modules/k8s/k9s.nix
-    ../../modules/keepassxc
-    ../../modules/music
-    ../../modules/nodejs
-    ../../modules/nvim
-    ../../modules/pandoc
-    ../../modules/secrets
-    ../../modules/shell
-    ../../modules/stylix
-    ../../modules/taskwarrior
-    ../../modules/ticketing
-    ../../modules/terminal
-    ../../modules/vscode
   ];
 
   sops.age.keyFile = "${config.home.homeDirectory}/.config/sops/age/keys.txt";
@@ -63,24 +35,57 @@
     defaultWrapper = "mesa";
   };
 
-  browser.primary = "firefox";
-  browser.secondary = "chromium";
-  cloud.azure.enable = true;
-  comms.signal.enable = true;
-  comms.teams.enable = true;
   ai-tools = {
     claude-code.enable = true;
     tirith.enable = true;
     opencode.enable = true;
   };
+  anki.enable = true;
+  browser = {
+    enable = true;
+    primary = "firefox";
+    secondary = "chromium";
+  };
+  bruno.enable = true;
+  cloud.azure.enable = true;
+  comms.signal.enable = true;
+  comms.teams.enable = true;
   database = {
     mssql.enable = true;
     postgresql.enable = true;
     redis.enable = true;
   };
-  git.github.enable = true;
+  desktop.niri.enable = true;
-  git.gitlab.enable = true;
+  devenv.enable = true;
+  direnv.enable = true;
+  docker.enable = true;
+  git = {
+    enable = true;
+    github.enable = true;
+    gitlab.enable = true;
+  };
+  go.enable = true;
+  k8s.enable = true;
+  keepassxc.enable = true;
+  music.enable = true;
+  my.dconf.enable = true;
+  my.stylix.enable = true;
+  nvim.enable = true;
+  pandoc.enable = true;
+  shell.enable = true;
+  taskwarrior.enable = true;
+  terminal.enable = true;
+  infra.enable = true;
+  nodejs.enable = true;
+  secrets.enable = true;
   secrets.vault.enable = true;
+  ticketing.enable = true;
+  vscode.enable = true;
+
+  services.home-manager.autoUpgrade = {
+    enable = true;
+    frequency = "weekly";
+  };
 
   programs = {
     gh.enable = true;

home/modules/ai-tools/tirith.nix

@@ -9,7 +9,7 @@ let
 in
 {
   options.ai-tools.tirith = {
-    enable = lib.mkEnableOption "tirith shell security guard";
+    enable = lib.mkEnableOption "tirith";
   };
 
   config = lib.mkMerge [

home/modules/anki/default.nix

@@ -9,9 +9,14 @@
 }:
 
 let
+  cfg = config.anki;
   sops = myUtils.sopsAvailability config osConfig;
   standalone = osConfig == null;
 in
+{
+  options.anki.enable = lib.mkEnableOption "Anki";
+
+  config = lib.mkIf cfg.enable (
     lib.optionalAttrs standalone {
       sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
         anki = [
@@ -22,7 +27,7 @@ lib.optionalAttrs standalone {
     }
     // {
       warnings = lib.optional (
-    !sops.available && config.programs.anki.enable
+        !sops.available
       ) "anki is enabled but sops secrets are not available. anki sync will not be configured.";
 
       programs.anki = {
@@ -39,3 +44,5 @@ lib.optionalAttrs standalone {
         };
       };
     }
+  );
+}

home/modules/audio/default.nix

@@ -1,7 +1,19 @@
-{ osConfig, pkgs, ... }:
-
 {
-  home.packages = with pkgs; [ pulsemixer ];
+  config,
+  lib,
+  pkgs,
+  osConfig,
+  ...
+}:
 
+let
+  cfg = config.audio;
+in
+{
+  options.audio.enable = lib.mkEnableOption "audio";
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [ pulsemixer ];
     services.mpris-proxy.enable = osConfig.hardware.bluetooth.enable or false;
+  };
 }

home/modules/browser/default.nix

@@ -1,7 +1,19 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 
 {
+  imports = [
+    ./firefox.nix
+    ./librewolf.nix
+    ./chromium.nix
+  ];
+
   options.browser = {
+    enable = lib.mkEnableOption "browser";
+
     primary = lib.mkOption {
       type = lib.types.enum [
         "firefox"
@@ -23,11 +35,7 @@
     };
   };
 
-  config.home.sessionVariables.BROWSER = config.browser.primary;
+  config = lib.mkIf config.browser.enable {
-
+    home.sessionVariables.BROWSER = config.browser.primary;
-  imports = [
+  };
-    ./firefox.nix
-    ./librewolf.nix
-    ./chromium.nix
-  ];
 }

home/modules/browser/firefox.nix

@@ -10,6 +10,7 @@
   config = lib.mkIf (config.browser.primary == "firefox" || config.browser.secondary == "firefox") {
     programs.firefox = {
       enable = true;
+      configPath = "${config.xdg.configHome}/mozilla/firefox";
     }
     // (import ./firefox-base.nix {
       inherit

home/modules/bruno/default.nix

@@ -1,7 +1,19 @@
-{ config, pkgs, ... }:
-
 {
-  config = {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.bruno;
+in
+{
+  options.bruno = {
+    enable = lib.mkEnableOption "Bruno";
+  };
+
+  config = lib.mkIf cfg.enable {
     home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.bruno "--no-sandbox")) ];
   };
 }

home/modules/clipboard/default.nix

@@ -1,7 +1,21 @@
-{ pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.clipboard;
+in
+{
+  options.clipboard = {
+    enable = lib.mkEnableOption "clipboard";
+  };
+
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       wl-clipboard
     ];
+  };
 }

home/modules/cloud/default.nix

@@ -3,10 +3,10 @@
 {
   options.cloud = {
     azure = {
-      enable = lib.mkEnableOption "azure CLI";
+      enable = lib.mkEnableOption "Azure CLI";
     };
     hetzner = {
-      enable = lib.mkEnableOption "hetzner CLI";
+      enable = lib.mkEnableOption "Hetzner CLI";
     };
   };
 

home/modules/dconf/default.nix

@@ -1,11 +1,22 @@
-{ config, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
+  cfg = config.my.dconf;
   terminal = "kitty";
   browser = config.browser.primary;
   font = "${config.stylix.fonts.monospace.name} ${toString config.stylix.fonts.sizes.applications}";
 in
 {
+  options.my.dconf = {
+    enable = lib.mkEnableOption "dconf";
+  };
+
+  config = lib.mkIf cfg.enable {
     dconf.settings = {
       "org/gnome/desktop/background" = {
         color-shading-type = "solid";
@@ -122,4 +133,5 @@ in
     };
 
     home.packages = with pkgs; [ dconf2nix ];
+  };
 }

home/modules/default.nix

@@ -6,6 +6,13 @@
 }:
 
 {
+  imports =
+    let
+      dirs = lib.attrNames (lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./.));
+      hasDef = name: builtins.pathExists ./${name}/default.nix;
+    in
+    map (name: ./${name}) (builtins.filter hasDef dirs);
+
   options = {
     host.username = lib.mkOption {
       type = lib.types.str;

home/modules/desktop/default.nix

@@ -0,0 +1,5 @@
+{ ... }:
+
+{
+  imports = [ ./niri ];
+}

home/modules/desktop/niri/config.kdl

@@ -179,4 +179,5 @@ binds {
     Alt+Print  { screenshot-window; }
 
     Mod+Shift+Delete { quit; }
+
 }

home/modules/desktop/niri/default.nix

@@ -1,4 +1,9 @@
-{ pkgs, ... }:
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
 
 {
   imports = [
@@ -9,11 +14,20 @@
     ../../waybar
   ];
 
+  options.desktop.niri.enable = lib.mkEnableOption "niri desktop";
+
+  config = lib.mkIf config.desktop.niri.enable {
+    clipboard.enable = lib.mkDefault true;
+    fuzzel.enable = lib.mkDefault true;
+    mako.enable = lib.mkDefault true;
+    shikane.enable = lib.mkDefault true;
+    waybar.enable = lib.mkDefault true;
+
     home = {
       file.".config/niri/config.kdl".source = ./config.kdl;
       packages = with pkgs; [
         brightnessctl
-      wlsunset
+        xwayland-satellite
       ];
     };
 
@@ -23,4 +37,35 @@
       latitude = 51.05;
       longitude = 3.71667;
     };
+
+    xdg.configFile."electron-flags.conf".text = ''
+      --enable-features=UseOzonePlatform
+      --ozone-platform=wayland
+    '';
+
+    xdg.portal = {
+      enable = true;
+      config = {
+        niri = {
+          default = [
+            "gnome"
+            "gtk"
+          ];
+          "org.freedesktop.impl.portal.Access" = "gtk";
+          "org.freedesktop.impl.portal.Notification" = "gtk";
+          "org.freedesktop.impl.portal.Secret" = "gnome-keyring";
+          "org.freedesktop.impl.portal.FileChooser" = "gtk";
+          "org.freedesktop.impl.portal.ScreenCast" = [ "gnome" ];
+          "org.freedesktop.impl.portal.Settings" = [
+            "gnome"
+            "gtk"
+          ];
+        };
+      };
+      extraPortals = [
+        pkgs.xdg-desktop-portal-gtk
+        pkgs.xdg-desktop-portal-gnome
+      ];
+    };
+  };
 }

home/modules/devenv/default.nix

@@ -1,4 +1,19 @@
-{ pkgs, ... }:
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.devenv;
+in
+{
+  options.devenv = {
+    enable = lib.mkEnableOption "devenv";
+  };
+
+  config = lib.mkIf cfg.enable {
     home.packages = [ pkgs.devenv ];
+  };
 }

home/modules/direnv/default.nix

@@ -1,7 +1,20 @@
 {
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.direnv;
+in
+{
+  options.direnv.enable = lib.mkEnableOption "direnv";
+
+  config = lib.mkIf cfg.enable {
     programs.direnv = {
       enable = true;
       enableBashIntegration = true;
       nix-direnv.enable = true;
     };
+  };
 }

home/modules/docker/default.nix

@@ -1,7 +1,21 @@
-{ pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.docker;
+in
+{
+  options.docker = {
+    enable = lib.mkEnableOption "Docker";
+  };
+
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       dive
     ];
+  };
 }

home/modules/fuzzel/default.nix

@@ -1,4 +1,16 @@
 {
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.fuzzel;
+in
+{
+  options.fuzzel.enable = lib.mkEnableOption "fuzzel";
+
+  config = lib.mkIf cfg.enable {
     programs.fuzzel = {
       enable = true;
       settings = {
@@ -12,4 +24,5 @@
         };
       };
     };
+  };
 }

home/modules/git/default.nix

@@ -8,11 +8,12 @@
 
 {
   options.git = {
+    enable = lib.mkEnableOption "git";
     github.enable = lib.mkEnableOption "Github CLI";
     gitlab.enable = lib.mkEnableOption "Gitlab CLI";
   };
 
-  config = {
+  config = lib.mkIf config.git.enable {
     programs.git.enable = true;
     home.file = {
       ".gitconfig".source = dotsPath + "/.gitconfig";

home/modules/go/default.nix

@@ -1,7 +1,22 @@
-{ pkgs, ... }:
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.go;
+in
+{
+  options.go = {
+    enable = lib.mkEnableOption "Go";
+  };
+
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       go
       gopls
     ];
+  };
 }

home/modules/infra/default.nix

@@ -1,7 +1,19 @@
-{ pkgs, ... }:
-
 {
-  config = {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.infra;
+in
+{
+  options.infra = {
+    enable = lib.mkEnableOption "infrastructure tools";
+  };
+
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       opentofu
       upbound

home/modules/k8s/default.nix

@@ -1,6 +1,25 @@
-{ pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.k8s;
+in
+{
+  imports = [
+    ./helm.nix
+    ./k9s.nix
+  ];
+
+  options.k8s.enable = lib.mkEnableOption "k8s";
+
+  config = lib.mkIf cfg.enable {
+    k8s.helm.enable = lib.mkDefault true;
+    k8s.k9s.enable = lib.mkDefault true;
+
     home.packages = with pkgs; [
       argocd
       fluxcd
@@ -21,9 +40,5 @@
     home.shellAliases = {
       k = "kubectl";
     };
-
+  };
-  imports = [
-    ./helm.nix
-    ./k9s.nix
-  ];
 }

home/modules/k8s/helm.nix

@@ -1,6 +1,17 @@
-{ pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.k8s.helm;
+in
+{
+  options.k8s.helm.enable = lib.mkEnableOption "helm";
+
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       (wrapHelm kubernetes-helm {
         plugins = with kubernetes-helmPlugins; [
@@ -12,4 +23,5 @@
         ];
       })
     ];
+  };
 }

home/modules/k8s/k9s.nix

@@ -1,4 +1,16 @@
 {
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.k8s.k9s;
+in
+{
+  options.k8s.k9s.enable = lib.mkEnableOption "";
+
+  config = lib.mkIf cfg.enable {
     programs.k9s = {
       enable = true;
       settings.k9s = {
@@ -8,4 +20,5 @@
         };
       };
     };
+  };
 }

home/modules/keepassxc/default.nix

@@ -1,8 +1,21 @@
 {
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.keepassxc;
+in
+{
+  options.keepassxc.enable = lib.mkEnableOption "KeePassXC";
+
+  config = lib.mkIf cfg.enable {
     programs.keepassxc = {
       enable = true;
       settings = {
         Browser.Enabled = true;
       };
     };
+  };
 }

home/modules/mako/default.nix

@@ -1,5 +1,16 @@
 {
-  services.mako = {
+  config,
-    enable = true;
+  lib,
+  ...
+}:
+
+let
+  cfg = config.mako;
+in
+{
+  options.mako.enable = lib.mkEnableOption "mako";
+
+  config = lib.mkIf cfg.enable {
+    services.mako.enable = true;
   };
 }

home/modules/music/default.nix

@@ -1,10 +1,13 @@
 {
-  dotsPath,
+  config,
+  lib,
   pkgs,
+  dotsPath,
   ...
 }:
 
 let
+  cfg = config.music;
   spotifyWithWayland = pkgs.symlinkJoin {
     name = "spotify";
     paths = [ pkgs.spotify ];
@@ -16,12 +19,14 @@ let
   };
 in
 {
-  home.packages = with pkgs; [
+  options.music.enable = lib.mkEnableOption "music";
-    spotifyWithWayland
+
-  ];
+  config = lib.mkIf cfg.enable {
+    home.packages = [ spotifyWithWayland ];
 
     programs.ncspot = {
       enable = true;
-    settings = builtins.fromTOML (builtins.readFile (dotsPath + "/.config/ncspot/config.toml"));
+      settings = fromTOML (builtins.readFile (dotsPath + "/.config/ncspot/config.toml"));
+    };
   };
 }

home/modules/nfc/default.nix

@@ -1,5 +1,21 @@
 {
-  imports = [
+  config,
-    ./proxmark3.nix
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.nfc;
+in
+{
+  options.nfc = {
+    enable = lib.mkEnableOption "NFC tools";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = [
+      (pkgs.proxmark3.override { withGeneric = true; })
     ];
+  };
 }

home/modules/nfc/proxmark3.nix

@@ -1,6 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [
-    (pkgs.proxmark3.override { withGeneric = true; })
-  ];
-}

home/modules/nodejs/default.nix

@@ -5,15 +5,21 @@
   ...
 }:
 
+let
+  cfg = config.nodejs;
+in
 {
-  options.nodejs.package = lib.mkOption {
+  options.nodejs = {
+    enable = lib.mkEnableOption "Node.js";
+    package = lib.mkOption {
       type = lib.types.package;
       default = pkgs.nodejs_24;
     };
+  };
 
-  config = {
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
-      config.nodejs.package
+      cfg.package
       pnpm
       yarn
       biome

home/modules/nvim/default.nix

@@ -1,7 +1,20 @@
-{ pkgs, inputs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
+
+let
+  cfg = config.nvim;
+in
+{
+  options.nvim.enable = lib.mkEnableOption "nvim";
+
+  config = lib.mkIf cfg.enable {
     home.packages = [
       inputs.nvim.packages.${pkgs.stdenv.hostPlatform.system}.nvim
     ];
+  };
 }

home/modules/pandoc/default.nix

@@ -1,8 +1,23 @@
-{ pkgs, ... }:
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.pandoc;
+in
+{
+  options.pandoc = {
+    enable = lib.mkEnableOption "pandoc";
+  };
+
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       haskellPackages.pandoc-crossref
       pandoc
       texliveSmall
     ];
+  };
 }

home/modules/photography/default.nix

@@ -1,7 +1,21 @@
-{ pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.photography;
+in
+{
+  options.photography = {
+    enable = lib.mkEnableOption "photography";
+  };
+
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       darktable
     ];
+  };
 }

home/modules/secrets/default.nix

@@ -1,13 +1,19 @@
 {
+  config,
+  lib,
   pkgs,
   ...
 }:
 {
   imports = [ ./vault.nix ];
 
+  options.secrets.enable = lib.mkEnableOption "secrets";
+
+  config = lib.mkIf config.secrets.enable {
     home.packages = with pkgs; [
       age
-    age-plugin-yubikey # TODO: only needed when using Yubikey
+      age-plugin-yubikey
       sops
     ];
+  };
 }

home/modules/shell/bash.nix

@@ -4,13 +4,12 @@
   dotsPath,
   ...
 }:
+
 let
   cfg = config.shell.bash;
   inherit (config.home) username;
 in
 {
-  imports = [ ./utils.nix ];
-
   options.shell.bash = {
     aliases = {
       all = lib.mkOption {
@@ -34,7 +33,7 @@ in
     };
   };
 
-  config = {
+  config = lib.mkIf config.shell.enable {
     programs.bash = {
       enable = true;
       enableCompletion = true;

home/modules/shell/default.nix

@@ -1,3 +1,9 @@
+{
+  config,
+  lib,
+  ...
+}:
+
 {
   imports = [
     ./bash.nix
@@ -5,4 +11,10 @@
     ./prompt.nix
     ../tmux
   ];
+
+  options.shell.enable = lib.mkEnableOption "shell";
+
+  config = lib.mkIf config.shell.enable {
+    tmux.enable = lib.mkDefault true;
+  };
 }

home/modules/shell/prompt.nix

@@ -1,3 +1,11 @@
 {
+  config,
+  lib,
+  ...
+}:
+
+{
+  config = lib.mkIf config.shell.enable {
     programs.starship.enable = true;
+  };
 }

home/modules/shell/utils.nix

@@ -1,9 +1,12 @@
 {
+  config,
   lib,
   pkgs,
   ...
 }:
+
 {
+  config = lib.mkIf config.shell.enable {
     programs.fzf = {
       enable = true;
       enableBashIntegration = lib.mkDefault true;
@@ -16,4 +19,5 @@
       entr
       parallel
     ];
+  };
 }

home/modules/shikane/default.nix

@@ -1,6 +1,67 @@
-{ pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
-  home.packages = with pkgs; [ wdisplays ];
+  options.shikane.enable = lib.mkEnableOption "shikane";
+
+  config = lib.mkIf config.shikane.enable {
+    home.packages = with pkgs; [ (config.nixgl.wrap wdisplays) ];
     services.shikane.enable = true;
+    home.file.".config/shikane/config.toml".text = ''
+      [[profile]]
+      name = "work"
+
+      [[profile.output]]
+      enable = true
+      search = ["m=Unknown", "s=", "v=Unknown"]
+      mode = "2880x1800@120Hz"
+      position = "288,3240"
+      scale = 1.5
+      transform = "normal"
+      adaptive_sync = false
+
+      [[profile.output]]
+      enable = true
+      search = ["m=Q27P1B", "s=GNXM2HA196769", "v=PNP(AOC)"]
+      mode = "2560x1440@59.951Hz"
+      position = "116,1800"
+      scale = 1.0
+      transform = "normal"
+      adaptive_sync = false
+
+      [[profile.output]]
+      enable = true
+      search = ["m=PHL 243S7", "s=UHB1923012753", "v=Philips Consumer Electronics Company"]
+      mode = "1920x1080@60Hz"
+      position = "2676,1800"
+      scale = 1.0
+      transform = "270"
+      adaptive_sync = false
+
+      [[profile]]
+      name = "home"
+
+      [[profile.output]]
+      enable = true
+      search = ["m=Unknown", "s=Unknown", "v=Unknown"]
+      mode = "2880x1800@60.001Hz"
+      position = "185,1440"
+      scale = 1.75
+      transform = "normal"
+      adaptive_sync = false
+
+      [[profile.output]]
+      enable = true
+      search = ["m=PHL 276E8V", "s=0x0000046D", "v=Philips Consumer Electronics Company"]
+      mode = "3840x2160@59.996Hz"
+      position = "1500,0"
+      scale = 1.5
+      transform = "normal"
+      adaptive_sync = false
+    '';
+  };
 }

home/modules/ssh/default.nix

@@ -1,10 +1,13 @@
 {
-  myUtils,
+  config,
   lib,
   pkgs,
+  myUtils,
   ...
 }:
+
 let
+  cfg = config.ssh;
   hostDir = ../../hosts;
   hostNames = myUtils.dirNames hostDir;
   hostsWithKeys = lib.filter (
@@ -12,30 +15,33 @@ let
   ) hostNames;
 in
 {
+  options.ssh.enable = lib.mkEnableOption "ssh";
+
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [ sshfs ];
 
     programs.ssh = {
       enable = true;
       enableDefaultConfig = false;
 
-    matchBlocks =
+      settings =
         lib.genAttrs hostsWithKeys (
           hostname:
           let
             meta = myUtils.hostMeta (hostDir + "/${hostname}");
           in
           {
-          host = hostname;
+            User = meta.deployment.targetUser;
-          user = meta.deployment.targetUser;
           }
           // lib.optionalAttrs (meta.deployment.targetHost != "") {
-          hostname = meta.deployment.targetHost;
+            HostName = meta.deployment.targetHost;
           }
         )
         // {
           "*" = {
-          addKeysToAgent = "yes";
+            AddKeysToAgent = "yes";
-          forwardAgent = false;
+            ForwardAgent = false;
+          };
         };
     };
   };

home/modules/stylix/default.nix

@@ -1,16 +1,18 @@
 {
   config,
-  inputs,
+  lib,
   pkgs,
   ...
 }:
 
 let
+  cfg = config.my.stylix;
   theme = import ../../../modules/stylix/theme.nix { inherit pkgs; };
 in
 {
-  imports = [ inputs.stylix.homeModules.stylix ];
+  options.my.stylix.enable = lib.mkEnableOption "stylix";
 
+  config = lib.mkIf cfg.enable {
     stylix = {
       enable = true;
       inherit (theme)
@@ -27,4 +29,5 @@ in
       };
       targets = import ../../../modules/stylix/targets.nix;
     };
+  };
 }

home/modules/taskwarrior/default.nix

@@ -10,9 +10,14 @@
 }:
 
 let
+  cfg = config.taskwarrior;
   sops = myUtils.sopsAvailability config osConfig;
   standalone = osConfig == null;
 in
+{
+  options.taskwarrior.enable = lib.mkEnableOption "taskwarrior";
+
+  config = lib.mkIf cfg.enable (
     lib.optionalAttrs standalone {
       sops = {
         secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
@@ -33,9 +38,8 @@ lib.optionalAttrs standalone {
       };
     }
     // {
-
       warnings =
-    lib.optional (!sops.available && config.programs.taskwarrior.enable)
+        lib.optional (!sops.available)
           "taskwarrior is enabled, but sops templates are not available. taskwarrior sync will not be configured.";
 
       home.packages = with pkgs; [
@@ -70,10 +74,12 @@ lib.optionalAttrs standalone {
         colorTheme = "dark-256";
         config = {
           recurrence = "off";
-      reserved.lines = 3; # without this I would have to scroll up 3 lines
+          reserved.lines = 3;
         };
         extraConfig = lib.optionalString sops.available ''
           include ${sops.templates."taskrc.d/sync".path}
         '';
       };
     }
+  );
+}

home/modules/terminal/default.nix

@@ -1,12 +1,18 @@
 {
-  pkgs,
   config,
+  lib,
+  pkgs,
   dotsPath,
   ...
 }:
 
+let
+  cfg = config.terminal;
+in
 {
-  config = {
+  options.terminal.enable = lib.mkEnableOption "terminal";
+
+  config = lib.mkIf cfg.enable {
     programs.bash.shellAliases = {
       icat = "kitty +kitten icat";
     };

home/modules/ticketing/default.nix

@@ -1,7 +1,21 @@
-{ pkgs, ... }:
-
 {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.ticketing;
+in
+{
+  options.ticketing = {
+    enable = lib.mkEnableOption "ticketing";
+  };
+
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       jira-cli-go
     ];
+  };
 }

home/modules/tmux/default.nix

@@ -1,7 +1,18 @@
-{ pkgs, dotsPath, ... }:
-
 {
-  config = {
+  config,
+  lib,
+  pkgs,
+  dotsPath,
+  ...
+}:
+
+let
+  cfg = config.tmux;
+in
+{
+  options.tmux.enable = lib.mkEnableOption "tmux";
+
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       tmuxp
       reptyr

home/modules/torrenting/default.nix

@@ -10,7 +10,7 @@ let
 in
 {
   options.torrenting = {
-    enable = lib.mkEnableOption "transmission torrent client";
+    enable = lib.mkEnableOption "torrenting";
   };
 
   config = lib.mkIf cfg.enable {

home/modules/vscode/default.nix

@@ -1,7 +1,19 @@
-{ config, pkgs, ... }:
-
 {
-  config = {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.vscode;
+in
+{
+  options.vscode = {
+    enable = lib.mkEnableOption "Visual Studio Code";
+  };
+
+  config = lib.mkIf cfg.enable {
     home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.vscode "--no-sandbox")) ];
   };
 }

home/modules/waybar/default.nix

@@ -1,11 +1,24 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.waybar;
+in
 {
   imports = [
     ./settings.nix
     ./style.nix
   ];
 
+  options.waybar.enable = lib.mkEnableOption "waybar";
+
+  config = lib.mkIf cfg.enable {
     programs.waybar = {
       enable = true;
       systemd.enable = true;
     };
+  };
 }

hosts/andromache/default.nix

@@ -17,51 +17,57 @@ in
     inputs.nixos-hardware.nixosModules.common-cpu-intel
     inputs.nixos-hardware.nixosModules.common-pc
     inputs.nixos-hardware.nixosModules.common-pc-ssd
-    ../../modules/common
+    ../../modules
-    ../../modules/boot/bootloader.nix
     (import ../../modules/disko/zfs-encrypted-root.nix {
       inherit lib config;
       device = "/dev/nvme1n1";
     })
-    ../../modules/ai-tools
-    ../../modules/anki
-    ../../modules/audio
-    ../../modules/backups
-    ../../modules/bluetooth
-    ../../modules/desktops/niri
-    ../../modules/docker
-    ../../modules/firewall
-    ../../modules/fonts
-    ../../modules/gaming
-    ../../modules/git
-    ../../modules/hcloud
-    ../../modules/keyboard
-    ../../modules/localization
-    ../../modules/networking
-    ../../modules/nvidia
-    ../../modules/secrets
-    ../../modules/ssh
-    ../../modules/storage
-    ../../modules/stylix
-    ../../modules/syncthing
-    ../../modules/tailscale
-    ../../modules/taskwarrior
-    ../../modules/users
-    ../../modules/wol
-    ../../modules/yubikey
   ];
 
   home-manager.users.${config.host.username} = import ../../home/hosts/${config.host.name};
 
-  secrets.nixSigningKey.enable = true;
+  "ai-tools".enable = true;
-
+  anki.enable = true;
-  restic-backup.enable = true;
+  audio.enable = true;
-  tailscale.enable = true;
+  bluetooth.enable = true;
+  bootloader.enable = true;
+  desktop.niri.enable = true;
+  firewall = {
+    enable = true;
+    allowedTCPPorts = [ 22 ];
+  };
+  gaming.enable = true;
+  git.enable = true;
+  keyboard.enable = true;
+  localization.enable = true;
+  my = {
+    fonts.enable = true;
+    stylix.enable = true;
+    users.enable = true;
+    yubikey = {
+      enable = true;
+      pam.enable = false;
+    };
+  };
   desktop.ly.enable = true;
-
   docker.enable = true;
-
   hcloud.enable = true;
+  networking.enable = true;
+  nvidia.enable = true;
+  restic-backup.enable = true;
+  secrets = {
+    enable = true;
+    nixSigningKey.enable = true;
+  };
+  ssh.enable = true;
+  storage.enable = true;
+  syncthing.enable = true;
+  tailscale.enable = true;
+  taskwarrior.enable = true;
+  wol = {
+    enable = true;
+    interfaces.eno1 = { inherit (wolInterfaces.eno1) macAddress; };
+  };
 
   disko.devices = {
     disk.data = {
@@ -91,25 +97,10 @@ in
     inputs.colmena.packages.${pkgs.stdenv.hostPlatform.system}.colmena
   ];
 
-  my.yubikey = {
-    enable = true;
-    pam.enable = false;
-  };
-
   services.locate = {
     enable = true;
     package = pkgs.plocate;
   };
 
   networking.hostId = "80eef97e";
-
-  wol = {
-    enable = true;
-    interfaces.eno1 = { inherit (wolInterfaces.eno1) macAddress; };
-  };
-
-  firewall = {
-    enable = true;
-    allowedTCPPorts = [ 22 ];
-  };
 }

hosts/astyanax/default.nix

@@ -5,9 +5,7 @@
   pkgs,
   ...
 }:
-let
+
-  wolInterfaces = import ../andromache/wol-interfaces.nix;
-in
 {
   imports = [
     inputs.disko.nixosModules.disko
@@ -16,47 +14,50 @@ in
     inputs.nixos-hardware.nixosModules.common-pc
     inputs.nixos-hardware.nixosModules.common-pc-ssd
     # inputs.nixos-hardware.nixosModules.lenovo-thinkpad-e14-intel-gen7 (not available yet?)
-    inputs.sops-nix.nixosModules.sops
+    ../../modules
-    ../../modules/common
-    ../../modules/boot/bootloader.nix
     (import ../../modules/disko/zfs-encrypted-root.nix {
       inherit lib config;
       device = "/dev/nvme0n1";
     })
-    ../../modules/ai-tools
-    ../../modules/anki
-    ../../modules/audio
-    ../../modules/backups
-    ../../modules/bluetooth
-    ../../modules/desktops/niri
-    ../../modules/docker
-    ../../modules/firewall
-    ../../modules/fonts
-    ../../modules/git
-    ../../modules/keyboard
-    ../../modules/localization
-    ../../modules/networking
-    ../../modules/nfc
-    ../../modules/secrets
-    ../../modules/ssh
-    ../../modules/storage
-    ../../modules/stylix
-    ../../modules/tailscale
-    ../../modules/taskwarrior
-    ../../modules/users
-    ../../modules/yubikey
   ];
 
   home-manager.users.${config.host.username} = import ../../home/hosts/${config.host.name};
 
-  secrets.nixSigningKey.enable = true;
+  "ai-tools".enable = true;
+  anki.enable = true;
+  audio.enable = true;
+  bluetooth.enable = true;
+  bootloader.enable = true;
+  desktop.niri.enable = true;
+  git.enable = true;
+  keyboard.enable = true;
+  localization.enable = true;
+  my = {
+    fonts.enable = true;
+    stylix.enable = true;
+    users.enable = true;
+    yubikey = {
+      enable = true;
+      pam.enable = false;
+    };
+  };
+  networking.enable = true;
+  secrets.enable = true;
+  ssh.enable = true;
+  storage.enable = true;
+  taskwarrior.enable = true;
 
+  secrets.nixSigningKey.enable = true;
   restic-backup.enable = true;
   tailscale.enable = true;
+  desktop.ly.enable = true;
   docker.enable = true;
   nfc.enable = true;
-  desktop.ly.enable = true;
+
-  audio.automation.enable = true;
+  firewall = {
+    enable = true;
+    allowedTCPPorts = [ 22 ];
+  };
 
   hardware = {
     cpu.intel.updateMicrocode = true;
@@ -66,6 +67,7 @@ in
       extraPackages = with pkgs; [
         intel-media-driver
         vpl-gpu-rt
+        intel-compute-runtime
       ];
     };
   };
@@ -81,7 +83,7 @@ in
       name = "wol-andromache";
       runtimeInputs = [ pkgs.wakeonlan ];
       text = ''
-        wakeonlan ${wolInterfaces.eno1.macAddress}
+        wakeonlan ${(import ../andromache/wol-interfaces.nix).eno1.macAddress}
       '';
     })
   ];
@@ -90,18 +92,8 @@ in
     hostId = "80eef97e";
   };
 
-  firewall = {
-    enable = true;
-    allowedTCPPorts = [ 22 ];
-  };
-
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 
-  my.yubikey = {
-    enable = true;
-    pam.enable = false;
-  };
-
   services = {
     fwupd.enable = true;
     locate = {

hosts/eetion-02/default.nix

@@ -7,10 +7,11 @@
   imports = [
     ./hard.nix
     ./host.nix
-    ../../modules/common
+    ../../modules
-    ../../modules/ssh
   ];
 
+  ssh.enable = true;
+
   boot = {
     kernelParams = [
       "console=ttyS1,115200n8"

hosts/eetion/default.nix

@@ -7,12 +7,10 @@
   imports = [
     ./hard.nix
     ./host.nix
-    ../../modules/common
+    ../../modules
-    ../../modules/ssh
-    ../../modules/tailscale
-    # ../../modules/uptime-kuma
   ];
 
+  ssh.enable = true;
   tailscale.enable = true;
 
   boot.loader = {

hosts/hecuba/default.nix

@@ -12,14 +12,14 @@
     inputs.disko.nixosModules.disko
     ./hard.nix
     ./host.nix
-    ../../modules/common
+    ../../modules
-    ../../modules/ssh
-    ../../modules/docker
   ];
 
-  networking.hostName = config.host.name;
+  ssh.enable = true;
   docker.enable = true;
 
+  networking.hostName = config.host.name;
+
   fileSystems."/" = {
     device = "/dev/disk/by-label/nixos";
     fsType = "ext4";

hosts/vm/default.nix

@@ -9,27 +9,30 @@
     ./hard.nix
     ./host.nix
     ./disk.nix
-    ../../modules/common
+    ../../modules
-    ../../modules/anki
-    ../../modules/audio
-    ../../modules/boot/bootloader.nix
-    ../../modules/fonts
-    ../../modules/git
-    ../../modules/keyboard
-    ../../modules/localization
-    ../../modules/networking
-    ../../modules/ai-tools
-    ../../modules/ssh
-    ../../modules/storage
-    ../../modules/stylix
-    ../../modules/secrets
-    ../../modules/taskwarrior
-    ../../modules/users
-    ../../modules/x
   ];
 
   home-manager.users.${config.host.username} = import ../../home/hosts/vm;
 
+  "ai-tools".enable = true;
+  anki.enable = true;
+  audio.enable = true;
+  bootloader.enable = true;
+  desktop.x.enable = true;
+  git.enable = true;
+  keyboard.enable = true;
+  localization.enable = true;
+  my = {
+    fonts.enable = true;
+    stylix.enable = true;
+    users.enable = true;
+  };
+  networking.enable = true;
+  secrets.enable = true;
+  ssh.enable = true;
+  storage.enable = true;
+  taskwarrior.enable = true;
+
   disko = {
     devices.disk.main = {
       device = "/dev/vda";

images/sd-image-orange-pi-aarch64.nix

@@ -37,5 +37,6 @@ in
 
   security.sudo.wheelNeedsPassword = false;
 
+  boot.zfs.forceImportRoot = false;
   system.stateVersion = "26.05";
 }

images/sd-image-raspberry-pi-aarch64.nix

@@ -21,13 +21,11 @@ in
     name = "raspberry-pi";
   };
 
-  boot.kernelParams = [
+  boot = {
-    "console=ttyS1,115200n8"
+    kernelParams = [ "console=ttyS1,115200n8" ];
-  ];
+    kernelModules = [ "bcm2835-v4l2" ];
-
+    zfs.forceImportRoot = false;
-  boot.kernelModules = [
+  };
-    "bcm2835-v4l2"
-  ];
 
   hardware.enableRedistributableFirmware = true;
 

modules/ai-tools/default.nix

@@ -1,11 +1,14 @@
-{ config, ... }:
+{ lib, config, ... }:
 
 let
+  cfg = config."ai-tools";
   inherit (config.host) username;
   inherit (config.secrets) owner;
 in
 {
-  config = {
+  options."ai-tools".enable = lib.mkEnableOption "AI tools";
+
+  config = lib.mkIf cfg.enable {
     nixpkgs.allowedUnfree = [ "claude-code" ];
     secrets.groups.opencode = [ "api-key" ];
 

modules/anki/default.nix

@@ -1,6 +1,15 @@
+{ lib, config, ... }:
+
+let
+  cfg = config.anki;
+in
 {
-  config.secrets.groups.anki = [
+  options.anki.enable = lib.mkEnableOption "anki";
+
+  config = lib.mkIf cfg.enable {
+    secrets.groups.anki = [
       "sync-user"
       "sync-key"
     ];
+  };
 }

modules/audio/default.nix

@@ -1,17 +1,21 @@
-{ ... }:
+{ lib, config, ... }:
 
+let
+  cfg = config.audio;
+in
 {
-  imports = [
+  imports = [ ./audio-automation.nix ];
-    ./audio-automation.nix
-  ];
 
-  config = {
+  options.audio.enable = lib.mkEnableOption "audio";
+
+  config = lib.mkIf cfg.enable {
     nixpkgs.allowedUnfree = [
       "spotify"
       "spotify-unwrapped"
     ];
 
     security.rtkit.enable = true;
+
     services = {
       pulseaudio.enable = false;
       pipewire = {

modules/bluetooth/default.nix

@@ -1,4 +1,12 @@
+{ lib, config, ... }:
+
+let
+  cfg = config.bluetooth;
+in
 {
+  options.bluetooth.enable = lib.mkEnableOption "bluetooth";
+
+  config = lib.mkIf cfg.enable {
     hardware.bluetooth = {
       enable = true;
       powerOnBoot = true;
@@ -12,4 +20,5 @@
         };
       };
     };
+  };
 }

modules/boot/default.nix

@@ -0,0 +1,18 @@
+{ lib, config, ... }:
+
+let
+  cfg = config.bootloader;
+in
+{
+  options.bootloader.enable = lib.mkEnableOption "system bootloader";
+
+  config = lib.mkIf cfg.enable {
+    boot = {
+      loader = {
+        systemd-boot.enable = true;
+        efi.canTouchEfiVariables = true;
+      };
+      tmp.useTmpfs = config.host.highRam;
+    };
+  };
+}

modules/common/default.nix

@@ -23,6 +23,7 @@ in
 
   config = {
     system.stateVersion = lib.mkDefault "25.05";
+    boot.zfs.forceImportRoot = lib.mkDefault false;
 
     nix = {
       nixPath = [ "nixpkgs=${inputs.nixpkgs}" ]; # https://github.com/nix-community/nixd/blob/main/nixd/docs/configuration.md
@@ -61,6 +62,10 @@ in
       pkg: builtins.elem (lib.getName pkg) config.nixpkgs.allowedUnfree;
 
     environment.defaultPackages = lib.mkForce [ ];
+    environment.pathsToLink = [
+      "/share/applications"
+      "/share/xdg-desktop-portal"
+    ];
 
     home-manager = {
       useGlobalPkgs = true;

modules/default.nix

@@ -0,0 +1,10 @@
+{ lib, ... }:
+
+{
+  imports =
+    let
+      dirs = lib.attrNames (lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./.));
+      hasDef = name: builtins.pathExists ./${name}/default.nix;
+    in
+    map (name: ./${name}) (builtins.filter hasDef dirs);
+}

modules/desktops/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+
+{
+  imports = [
+    ./gnome
+    ./niri
+  ];
+}

modules/desktops/gnome/default.nix

@@ -1,9 +1,13 @@
+{ lib, config, ... }:
+
 {
+  options.desktop.gnome.enable = lib.mkEnableOption "GNOME desktop";
+
+  config = lib.mkIf config.desktop.gnome.enable {
     services.xserver = {
       displayManager.gdm.enable = true;
       displayManager.gdm.wayland = true;
       desktopManager.gnome.enable = true;
     };
-
+  };
-  # TODO: Declare monitors.xml
 }

modules/desktops/logind.nix

@@ -1,7 +1,13 @@
+{ lib, config, ... }:
+
 {
+  options.desktop.logind.enable = lib.mkEnableOption "logind desktop settings";
+
+  config = lib.mkIf config.desktop.logind.enable {
     services.logind.settings.Login = {
       HandleLidSwitch = "suspend";
       IdleAction = "suspend";
       IdleActionSec = 1800;
     };
+  };
 }

modules/desktops/niri/default.nix

@@ -12,6 +12,9 @@ in
   imports = [ ../logind.nix ];
 
   options.desktop = {
+    niri = {
+      enable = lib.mkEnableOption "niri desktop";
+    };
     ly = {
       enable = lib.mkOption {
         type = lib.types.bool;
@@ -20,7 +23,8 @@ in
     };
   };
 
-  config = {
+  config = lib.mkIf cfg.niri.enable {
+    desktop.logind.enable = lib.mkDefault true;
     programs.niri = {
       enable = true;
       useNautilus = false;
@@ -44,15 +48,6 @@ in
       ];
     };
 
-    #  error:
-    #  Failed assertions:
-    #  - h profile: xdg.portal: since you installed Home Manager via its NixOS module and
-    #  'home-manager.useUserPackages' is enabled, you need to add
-    #
-    #  environment.pathsToLink = [ `/share/applications` `/share/xdg-desktop-portal` ];
-    #
-    #  to your NixOS configuration so that the portal definitions and DE
-    #  provided configurations get linked.
     environment.pathsToLink = [
       "/share/applications"
       "/share/xdg-desktop-portal"

modules/fonts/default.nix

@@ -1,12 +1,20 @@
-{ pkgs, ... }:
-
 {
-  imports = [
+  lib,
-    ./iosevka.nix
+  config,
-  ];
+  pkgs,
+  ...
+}:
 
+let
+  cfg = config.my.fonts;
+in
+{
+  imports = [ ./iosevka.nix ];
+
+  options.my.fonts.enable = lib.mkEnableOption "fonts";
+
+  config = lib.mkIf cfg.enable {
     fonts = {
-    # disable default font packages (see https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/config/fonts/packages.nix)
       enableDefaultPackages = false;
       packages = with pkgs; [
         dejavu_fonts
@@ -14,4 +22,5 @@
         noto-fonts-color-emoji
       ];
     };
+  };
 }

modules/fonts/iosevka.nix

@@ -1,6 +1,12 @@
-{ pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 
 {
+  config = lib.mkIf config.my.fonts.enable {
     fonts = {
       packages = with pkgs; [
         (iosevka-bin.override { variant = "SGr-IosevkaTermSS08"; })
@@ -11,4 +17,5 @@
         };
       };
     };
+  };
 }

modules/gaming/default.nix

@@ -1,11 +1,17 @@
 {
-  config,
   lib,
+  config,
   pkgs,
   ...
 }:
 
+let
+  cfg = config.gaming;
+in
 {
+  options.gaming.enable = lib.mkEnableOption "gaming";
+
+  config = lib.mkIf cfg.enable {
     nixpkgs.allowedUnfree = [
       "steam"
       "steam-unwrapped"
@@ -29,7 +35,6 @@
     programs.gamemode.enable = true;
 
     environment.systemPackages = with pkgs; [
-    # lutris
       mangohud
     ];
 
@@ -47,4 +52,5 @@
         value = "524288";
       }
     ];
+  };
 }

modules/git/default.nix

@@ -1,14 +1,15 @@
-{
+{ lib, config, ... }:
-  config,
-  ...
-}:
 
 let
+  cfg = config.git;
   inherit (config.host) username;
   owner = config.users.users.${username}.name;
 in
 {
-  config.sops.templates = {
+  options.git.enable = lib.mkEnableOption "git";
+
+  config = lib.mkIf cfg.enable {
+    sops.templates = {
       ".gitconfig.email" = {
         inherit owner;
         path = "/home/${username}/.gitconfig.email";
@@ -26,4 +27,5 @@ in
         '';
       };
     };
+  };
 }

modules/k3s/default.nix

@@ -1,27 +1,26 @@
-{ pkgs, ... }:
-
 {
-  # TODO: see if this works with podman
+  lib,
-  # TODO: check if docker/podman is enabled
+  config,
+  pkgs,
+  ...
+}:
 
-  # Rootless K3S
+let
+  cfg = config.k3s;
+in
+{
+  options.k3s.enable = lib.mkEnableOption "k3s rootless";
 
-  # FIXME
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = with pkgs; [
       k3s
       rootlesskit
       slirp4netns
     ];
 
-  # running K3S on rootless docker was causing the following error: "failed to find cpuset cgroup (v2)" (in `docker logs k3d-lab-server-0` output)
-  #
-  # see <https://docs.k3s.io/advanced#known-issues-with-rootless-mode>
-  # see <https://rootlesscontaine.rs/getting-started/common/cgroup2/>
-  # see <https://discourse.nixos.org/t/declarative-rootless-k3s/49839>
     systemd.services."user@".serviceConfig.Delegate = "cpu cpuset io memory pids";
 
-  # taken from <https://github.com/k3s-io/k3s/blob/main/k3s-rootless.service> as described in <https://docs.k3s.io/advanced#known-issues-with-rootless-mode#Rootless>
+    systemd.user.services."k3s-rootless" = {
-  systemd.user.services."k3s-rootless" = with pkgs; {
       path = with pkgs; [
         "${rootlesskit}"
         "${slirp4netns}"
@@ -29,32 +28,10 @@
         "${fuse3}"
         "/run/wrappers"
       ];
-    # systemd unit file for k3s (rootless)
-    #
-    # Usage:
-    # - [Optional] Enable cgroup v2 delegation, see https://rootlesscontaine.rs/getting-started/common/cgroup2/ .
-    #   This step is optional, but highly recommended for enabling CPU and memory resource limtitation.
-    #
-    # - Copy this file as `~/.config/systemd/user/k3s-rootless.service`.
-    #   Installing this file as a system-wide service (`/etc/systemd/...`) is not supported.
-    #   Depending on the path of `k3s` binary, you might need to modify the `ExecStart=/usr/local/bin/k3s ...` line of this file.
-    #
-    # - Run `systemctl --user daemon-reload`
-    #
-    # - Run `systemctl --user enable --now k3s-rootless`
-    #
-    # - Run `KUBECONFIG=~/.kube/k3s.yaml kubectl get pods -A`, and make sure the pods are running.
-    #
-    # Troubleshooting:
-    # - See `systemctl --user status k3s-rootless` to check the daemon status
-    # - See `journalctl --user -f -u k3s-rootless` to see the daemon log
-    # - See also https://rootlesscontaine.rs/
       enable = true;
       description = "k3s (Rootless)";
       serviceConfig = {
-      # NOTE: Don't try to run `k3s server --rootless` on a terminal, as it doesn't enable cgroup v2 delegation.
+        ExecStart = "${pkgs.k3s}/bin/k3s server --rootless --snapshotter=fuse-overlayfs";
-      # If you really need to try it on a terminal, prepend `systemd-run --user -p Delegate=yes --tty` to create a systemd scope.
-      ExecStart = "${k3s}/bin/k3s server --rootless --snapshotter=fuse-overlayfs";
         ExecReload = "/run/current-system/sw/bin/kill -s HUP $MAINPID";
         TimeoutSec = 0;
         RestartSec = 2;
@@ -69,11 +46,11 @@
         Type = "simple";
         KillMode = "mixed";
       };
-
       wantedBy = [ "default.target" ];
     };
 
     boot.kernel.sysctl = {
       "net.ipv4.ip_forward" = 1;
     };
+  };
 }

modules/keyboard/default.nix

@@ -1,11 +1,19 @@
-{ pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 
-with pkgs;
 let
-  tools = interception-tools;
+  cfg = config.keyboard;
-  inherit (interception-tools-plugins) caps2esc;
+  tools = pkgs.interception-tools;
+  inherit (pkgs.interception-tools-plugins) caps2esc;
 in
 {
+  options.keyboard.enable = lib.mkEnableOption "keyboard remapping";
+
+  config = lib.mkIf cfg.enable {
     services.interception-tools = {
       enable = true;
       plugins = [ caps2esc ];
@@ -16,4 +24,5 @@ in
               EV_KEY: [KEY_CAPSLOCK]
       '';
     };
+  };
 }

modules/localization/default.nix

@@ -1,6 +1,13 @@
-{ config, ... }:
+{ lib, config, ... }:
 
+let
+  cfg = config.localization;
+in
 {
+  options.localization.enable = lib.mkEnableOption "localization";
+
+  config = lib.mkIf cfg.enable {
     time.timeZone = config.host.timezone;
     i18n.defaultLocale = config.host.locale;
+  };
 }

modules/networking/default.nix

@@ -1,6 +1,9 @@
-{ config, ... }:
+{ lib, config, ... }:
 
 {
+  options.networking.enable = lib.mkEnableOption "network configuration";
+
+  config = lib.mkIf config.networking.enable {
     networking = {
       hostName = config.host.name;
       wireless.iwd.enable = true;
@@ -8,4 +11,5 @@
       nftables.enable = true;
       firewall.enable = true;
     };
+  };
 }

modules/nfc/default.nix

@@ -6,7 +6,7 @@ let
 in
 {
   options.nfc = {
-    enable = lib.mkEnableOption "NFC device access";
+    enable = lib.mkEnableOption "NFC";
   };
   config = lib.mkIf cfg.enable {
     users.users.${username}.extraGroups = [ "dialout" ];

modules/nvidia/default.nix

@@ -1,6 +1,9 @@
-{ config, ... }:
+{ lib, config, ... }:
 
 {
+  options.nvidia.enable = lib.mkEnableOption "NVIDIA graphics";
+
+  config = lib.mkIf config.nvidia.enable {
     nixpkgs.allowedUnfree = [
       "nvidia-x11"
       "nvidia-persistenced"
@@ -19,4 +22,5 @@
     };
 
     services.xserver.videoDrivers = [ "nvidia" ];
+  };
 }

modules/printing/default.nix

@@ -1,15 +1,9 @@
-{
+{ lib, config, ... }:
-  # services.avahi = {
-  #   enable = true;
-  #   nssmdns4 = true;
-  #   openFirewall = true;
-  # };
 
-  services.printing = {
+{
-    enable = true;
+  options.printing.enable = lib.mkEnableOption "printing";
-    # drivers = with pkgs; [
+
-    #   cups-filters
+  config = lib.mkIf config.printing.enable {
-    #   cups-browsed
+    services.printing.enable = true;
-    # ];
   };
 }

modules/secrets/default.nix

@@ -18,6 +18,8 @@ in
 
   options = {
     secrets = {
+      enable = lib.mkEnableOption "secrets management";
+
       sopsDir = lib.mkOption {
         type = lib.types.str;
         default = "${toString inputs.nix-secrets}/secrets";
@@ -42,7 +44,7 @@ in
     };
   };
 
-  config = {
+  config = lib.mkIf cfg.enable {
     secrets = {
       inherit owner;
       groups = {
@@ -55,10 +57,6 @@ in
     };
 
     sops = {
-      # for yubikey, generate as follows:
-      # ```
-      # age-plugin-yubikey --identity > <keyfile-path>
-      # ```
       age.keyFile = "/home/${username}/.config/sops/age/keys.txt";
       secrets = myUtils.mkSopsSecrets sopsDir owner cfg.groups;
     };
@@ -68,7 +66,7 @@ in
     ];
 
     services = {
-      pcscd.enable = true; # needed for age-plugin-yubikey?
+      pcscd.enable = true;
       udev.packages = lib.mkIf cfg.yubikey.enable [
         pkgs.yubikey-personalization
         pkgs.libfido2

modules/ssh/authorized-keys.nix

@@ -16,8 +16,8 @@ in
     };
   };
 
-  # auto generate authorized_keys from `authorizedHosts`
+  config = lib.mkIf config.ssh.enable {
-  config.users.users.${username}.openssh.authorizedKeys.keys =
+    users.users.${username}.openssh.authorizedKeys.keys =
       lib.flatten (
         map (
           hostname:
@@ -28,4 +28,5 @@ in
         ) ((builtins.filter (h: h != config.host.name) adminHosts) ++ config.ssh.authorizedHosts)
       )
       ++ lib.splitString "\n" (builtins.readFile ./ssh_bak.pub);
+  };
 }

modules/ssh/default.nix

@@ -1,10 +1,17 @@
-{ lib, ... }:
+{ lib, config, ... }:
 
+let
+  cfg = config.ssh;
+in
 {
   imports = [ ./hardened-openssh.nix ];
 
-  config.services.openssh = {
+  options.ssh.enable = lib.mkEnableOption "SSH server";
+
+  config = lib.mkIf cfg.enable {
+    services.openssh = {
       enable = lib.mkDefault true;
       harden = lib.mkDefault true;
     };
+  };
 }

modules/ssh/extract-keys.nix

@@ -1,9 +1,10 @@
 { lib, config, ... }:
+
 let
   inherit (config.host) username;
 in
 {
-  # auto extract SSH keys
+  config = lib.mkIf config.ssh.enable {
     system.activationScripts.extractSshKeys = lib.stringAfter [ "etc" ] ''
       HOST_KEY="/etc/ssh/ssh_host_ed25519_key.pub"
       HOST_DIR="/home/${username}/nix/hosts/${config.networking.hostName}"
@@ -29,4 +30,5 @@ in
         chmod 644 "$HOST_DIR/ssh_user.pub"
       fi
     '';
+  };
 }

modules/ssh/hardened-openssh.nix

@@ -1,5 +1,7 @@
 { lib, config, ... }:
+
 with lib;
+
 let
   cfg = config.services.openssh;
 in
@@ -13,7 +15,7 @@ in
   options.services.openssh.harden = mkEnableOption "harden ssh server configuration";
 
   config = {
-    networking.firewall.allowedTCPPorts = [ 22 ];
+    networking.firewall.allowedTCPPorts = lib.mkIf config.ssh.enable [ 22 ];
 
     services.openssh.settings = optionalAttrs cfg.harden {
       PermitRootLogin = "no";

modules/ssh/known-hosts.nix

@@ -4,6 +4,7 @@
   outputs,
   ...
 }:
+
 let
   hosts = lib.attrNames outputs.nixosConfigurations;
   hostsWithKeys = lib.filter (
@@ -11,9 +12,10 @@ let
   ) hosts;
 in
 {
-  # auto generate known_hosts for all hosts in flake
+  config = lib.mkIf config.ssh.enable {
     programs.ssh.knownHosts = lib.genAttrs hostsWithKeys (hostname: {
       publicKeyFile = ../../hosts/${hostname}/ssh_host.pub;
       extraHostNames = lib.optional (hostname == config.networking.hostName) "localhost";
     });
+  };
 }

modules/storage/default.nix

@@ -1,4 +1,10 @@
+{ lib, config, ... }:
+
 {
+  options.storage.enable = lib.mkEnableOption "storage";
+
+  config = lib.mkIf config.storage.enable {
     services.udisks2.enable = true;
     boot.zfs.forceImportRoot = false;
+  };
 }

modules/stylix/default.nix

@@ -1,16 +1,21 @@
 {
   config,
   inputs,
+  lib,
   pkgs,
   ...
 }:
 
 let
+  cfg = config.my.stylix;
   theme = import ./theme.nix { inherit pkgs; };
 in
 {
   imports = [ inputs.stylix.nixosModules.stylix ];
 
+  options.my.stylix.enable = lib.mkEnableOption "stylix theming";
+
+  config = lib.mkIf cfg.enable {
     stylix = {
       enable = true;
       inherit (theme)
@@ -33,4 +38,5 @@ in
         stylix.targets = import ./targets.nix;
       }
     ];
+  };
 }

modules/syncthing/default.nix

@@ -1,16 +1,13 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
-
-with lib;
 
 let
+  cfg = config.syncthing;
   inherit (config.host) username;
 in
 {
-  config = {
+  options.syncthing.enable = lib.mkEnableOption "syncthing";
+
+  config = lib.mkIf cfg.enable {
     users.groups.${username} = { };
     users.users.${username}.extraGroups = [ username ];
 

modules/taskwarrior/default.nix

@@ -1,10 +1,13 @@
-{ config, ... }:
+{ lib, config, ... }:
 
 let
+  cfg = config.taskwarrior;
   inherit (config.secrets) owner;
 in
 {
-  config = {
+  options.taskwarrior.enable = lib.mkEnableOption "taskwarrior";
+
+  config = lib.mkIf cfg.enable {
     secrets.groups.taskwarrior = [
       "sync-server-url"
       "sync-server-client-id"

modules/uptime-kuma/default.nix

@@ -1,9 +1,14 @@
 {
+  lib,
+  config,
   pkgs,
   ...
 }:
 
 {
+  options."uptime-kuma".enable = lib.mkEnableOption "uptime-kuma";
+
+  config = lib.mkIf config."uptime-kuma".enable {
     virtualisation.oci-containers = {
       backend = "docker";
       containers.uptime-kuma = {
@@ -27,4 +32,5 @@
     };
 
     environment.systemPackages = with pkgs; [ docker-compose ];
+  };
 }

modules/users/default.nix

@@ -1,10 +1,18 @@
-{ config, ... }:
+{ lib, config, ... }:
 
 {
+  options.my.users.enable = lib.mkEnableOption "user account";
+
+  config = lib.mkIf config.my.users.enable {
     users.users.${config.host.username} = {
       isNormalUser = true;
       description = config.host.username;
-    extraGroups = [ "wheel" ];
+      extraGroups = [
+        "wheel"
+        "render"
+        "video"
+      ];
       initialPassword = "h";
     };
+  };
 }

modules/x/default.nix

@@ -1,4 +1,9 @@
+{ lib, config, ... }:
+
 {
+  options.desktop.x.enable = lib.mkEnableOption "xmonad desktop";
+
+  config = lib.mkIf config.desktop.x.enable {
     services.xserver.windowManager.xmonad = {
       enable = true;
       enableContribAndExtras = true;
@@ -10,4 +15,5 @@
       xkb.layout = "us";
       xkb.variant = "";
     };
+  };
 }