chore: update lockfile

dots/.config/tmux/tmux.conf

@@ -76,3 +76,5 @@ if-shell '\( #{$TMUX_VERSION_MAJOR} -eq 2 -a #{$TMUX_VERSION_MINOR} -lt 4\) -o #
 if-shell '\( #{$TMUX_VERSION_MAJOR} -eq 2 -a #{$TMUX_VERSION_MINOR} -lt 2\) -o #{$TMUX_VERSION_MAJOR} -le 1' 'set-option -g status-utf8 on'
 
 set -g allow-passthrough on
+set -s extended-keys on
+set -as terminal-features 'xterm*:extkeys'

flake.lock

@@ -121,11 +121,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1778904158,
+        "lastModified": 1779595358,
-        "narHash": "sha256-xZ/zdpu9X8OI1jGqd4z6W1hKa+DQh8A9k3TH6w9tNbo=",
+        "narHash": "sha256-wYTO3i1Xe1oh9lWP8cAcgtD4tJyWFQRcN1uxYpdcL1Q=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "c31bafebd7e30517ead27149ad790802b998e98f",
+        "rev": "3028f7f65d02928083359f8701507a8b35d8bf42",
         "type": "gitlab"
       },
       "original": {
@@ -342,11 +342,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778921576,
+        "lastModified": 1779627636,
-        "narHash": "sha256-jgIbBcGgKTtkp+lBas29hNFUU1t5O/2+GFvUjbiG0vM=",
+        "narHash": "sha256-J6JGf42zNzLo/CrRdKb5dNznpLI+eGxN/5KTLG1Mo5s=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "32b42d71b4b22c4465963285bb6e462d7c93d45e",
+        "rev": "044c30c19550c0557997dece4ce9e54d2fa77ba1",
         "type": "github"
       },
       "original": {
@@ -398,10 +398,10 @@
     "nix-secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1776723456,
+        "lastModified": 1778944969,
-        "narHash": "sha256-GBbbm05oXYqSZ2EgxQPsNpTKl16wNhvrlUxdmv0FbSU=",
+        "narHash": "sha256-wT4WiBUqfeajcaOWvSKmHGKXEGmnDVQsRg0v7NoZW5o=",
         "ref": "main",
-        "rev": "135b681d24af6ee4508bbf7c657982d7be8743d4",
+        "rev": "aae027d8de9ae66ea29c9e6a5ff6ea0f4b735261",
         "shallow": true,
         "type": "git",
         "url": "ssh://git@github.com/hektor/nix-secrets"
@@ -451,11 +451,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1778924461,
+        "lastModified": 1779258371,
-        "narHash": "sha256-pDGhSCz+QxjHzP9gqYpK59k4Z1ZpVyYjzBgoXLFXh9s=",
+        "narHash": "sha256-j1iZsLy6oFApqR1oiDmHhvkwxXqcNi0aoSJj643LuwU=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "65a5c8f9c19d5f9d1b06d8942b04d790414ccfdd",
+        "rev": "c97bc4d15bd3473dd095e8e8ba57330ab1943a77",
         "type": "github"
       },
       "original": {
@@ -467,11 +467,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1778443072,
+        "lastModified": 1779508470,
-        "narHash": "sha256-zi7/fsqM/kFdNuED//4WOCUtezGtKKqRNORjMvfwjnA=",
+        "narHash": "sha256-Ap9KJX+5xHIn3bPIpfNgT6MEXdAECECwo4/rmlQD74M=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "da5ad661ba4e5ef59ba743f0d112cbc30e474f32",
+        "rev": "29916453413845e54a65b8a1cf996842300cd299",
         "type": "github"
       },
       "original": {
@@ -714,11 +714,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1778776709,
+        "lastModified": 1779378391,
-        "narHash": "sha256-YhnEcpiY6+l3RFA+cPmdTaeODGvNRuqE8B7VBjPVIxo=",
+        "narHash": "sha256-IsDb9erotvx9npI94UDosvMeYQK17p7/vmU2v9batrY=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "e8ea85b4f7dddda9603e0f1ac86cd92cee3b2819",
+        "rev": "c1456cc4ba3c9485e7b4158c909eeca5a752cd59",
         "type": "github"
       },
       "original": {

flake.nix

@@ -138,6 +138,7 @@
           };
           modules = [ ./home/hosts/work ];
           extraSpecialArgs = {
+            osConfig = null;
             inherit
               inputs
               outputs
@@ -148,7 +149,9 @@
         };
       };
 
-      apps.${system}.colmena = inputs.colmena.apps.${system}.default;
+      apps.${system}.colmena = inputs.colmena.apps.${system}.default // {
+        meta.description = "colmena";
+      };
 
       colmenaHive = import ./deploy/colmena.nix {
         inherit

home/hosts/andromache/default.nix

@@ -8,31 +8,6 @@
 {
   imports = [
     ../../modules
-    ../../modules/3d
-    ../../modules/ai-tools
-    ../../modules/anki
-    ../../modules/audio
-    ../../modules/browser
-    ../../modules/cloud
-    ../../modules/comms
-    ../../modules/desktop/niri
-    ../../modules/devenv
-    ../../modules/direnv
-    ../../modules/git
-    ../../modules/k8s/k9s.nix
-    ../../modules/keepassxc
-    ../../modules/music
-    ../../modules/nvim
-    ../../modules/pandoc
-    ../../modules/photography
-    ../../modules/secrets
-    ../../modules/shell
-    ../../modules/ssh
-    ../../modules/taskwarrior
-    ../../modules/terminal
-    ../../modules/torrenting
-    ../../modules/yubikey
-    ../../modules/zk
   ];
 
   home = {
@@ -52,12 +27,32 @@
     claude-code.enable = true;
     opencode.enable = true;
   };
+  desktop.niri.enable = true;
+  browser.enable = true;
   browser.primary = "librewolf";
   cloud.hetzner.enable = true;
   comms.signal.enable = true;
+  git.enable = true;
   git.github.enable = true;
-  shell.bash.aliases.lang-js = true;
+  shell = {
-  shell.bash.addBinToPath = true;
+    enable = true;
+    bash.aliases.lang-js = true;
+    bash.addBinToPath = true;
+  };
+  anki.enable = true;
+  k8s.k9s.enable = true;
+  secrets.enable = true;
+  taskwarrior.enable = true;
+  audio.enable = true;
+  ssh.enable = true;
+  music.enable = true;
+  terminal.enable = true;
+  devenv.enable = true;
+  keepassxc.enable = true;
+  direnv.enable = true;
+  nvim.enable = true;
+  pandoc.enable = true;
+  photography.enable = true;
   torrenting.enable = true;
   my.yubikey.enable = true;
   zk.enable = true;

home/hosts/astyanax/default.nix

@@ -7,29 +7,6 @@
 {
   imports = [
     ../../modules
-    ../../modules/3d
-    ../../modules/ai-tools
-    ../../modules/anki
-    ../../modules/audio
-    ../../modules/browser
-    ../../modules/cloud
-    ../../modules/comms
-    ../../modules/desktop/niri
-    ../../modules/devenv
-    ../../modules/direnv
-    ../../modules/git
-    ../../modules/k8s/k9s.nix
-    ../../modules/keepassxc
-    ../../modules/music
-    ../../modules/nfc
-    ../../modules/nvim
-    ../../modules/pandoc
-    ../../modules/secrets
-    ../../modules/shell
-    ../../modules/ssh
-    ../../modules/taskwarrior
-    ../../modules/terminal
-    ../../modules/yubikey
   ];
 
   home = {
@@ -48,13 +25,33 @@
     claude-code.enable = true;
     opencode.enable = true;
   };
+  anki.enable = true;
+  audio.enable = true;
+  browser.enable = true;
   browser.primary = "librewolf";
   cloud.hetzner.enable = true;
   comms.signal.enable = true;
+  desktop.niri.enable = true;
+  devenv.enable = true;
+  direnv.enable = true;
+  git.enable = true;
   git.github.enable = true;
-  shell.bash.aliases.lang-js = true;
+  k8s.k9s.enable = true;
-  shell.bash.addBinToPath = true;
+  keepassxc.enable = true;
+  music.enable = true;
   my.yubikey.enable = true;
+  nfc.enable = true;
+  nvim.enable = true;
+  pandoc.enable = true;
+  secrets.enable = true;
+  shell = {
+    enable = true;
+    bash.aliases.lang-js = true;
+    bash.addBinToPath = true;
+  };
+  ssh.enable = true;
+  taskwarrior.enable = true;
+  terminal.enable = true;
 
   programs = {
     home-manager.enable = true;

home/hosts/packages.nix

@@ -3,7 +3,9 @@
 with pkgs;
 [
   bat
+  curl
   entr
+  fd
   feh
   fzf
   htop

home/hosts/work/default.nix

@@ -8,36 +8,8 @@
 {
   imports = [
     inputs.sops-nix.homeManagerModules.sops
+    inputs.stylix.homeModules.stylix
     ../../modules
-    ../../modules/ai-tools
-    ../../modules/anki
-    ../../modules/browser
-    ../../modules/bruno
-    ../../modules/cloud
-    ../../modules/comms
-    ../../modules/database
-    ../../modules/dconf
-    ../../modules/desktop/niri
-    ../../modules/devenv
-    ../../modules/direnv
-    ../../modules/docker
-    ../../modules/git
-    ../../modules/go
-    ../../modules/infra
-    ../../modules/k8s
-    ../../modules/k8s/k9s.nix
-    ../../modules/keepassxc
-    ../../modules/music
-    ../../modules/nodejs
-    ../../modules/nvim
-    ../../modules/pandoc
-    ../../modules/secrets
-    ../../modules/shell
-    ../../modules/stylix
-    ../../modules/taskwarrior
-    ../../modules/ticketing
-    ../../modules/terminal
-    ../../modules/vscode
   ];
 
   sops.age.keyFile = "${config.home.homeDirectory}/.config/sops/age/keys.txt";
@@ -63,24 +35,57 @@
     defaultWrapper = "mesa";
   };
 
-  browser.primary = "firefox";
-  browser.secondary = "chromium";
-  cloud.azure.enable = true;
-  comms.signal.enable = true;
-  comms.teams.enable = true;
   ai-tools = {
     claude-code.enable = true;
     tirith.enable = true;
     opencode.enable = true;
   };
+  anki.enable = true;
+  browser = {
+    enable = true;
+    primary = "firefox";
+    secondary = "chromium";
+  };
+  bruno.enable = true;
+  cloud.azure.enable = true;
+  comms.signal.enable = true;
+  comms.teams.enable = true;
   database = {
     mssql.enable = true;
     postgresql.enable = true;
     redis.enable = true;
   };
-  git.github.enable = true;
+  desktop.niri.enable = true;
-  git.gitlab.enable = true;
+  devenv.enable = true;
+  direnv.enable = true;
+  docker.enable = true;
+  git = {
+    enable = true;
+    github.enable = true;
+    gitlab.enable = true;
+  };
+  go.enable = true;
+  k8s.enable = true;
+  keepassxc.enable = true;
+  music.enable = true;
+  my.dconf.enable = true;
+  my.stylix.enable = true;
+  nvim.enable = true;
+  pandoc.enable = true;
+  shell.enable = true;
+  taskwarrior.enable = true;
+  terminal.enable = true;
+  infra.enable = true;
+  nodejs.enable = true;
+  secrets.enable = true;
   secrets.vault.enable = true;
+  ticketing.enable = true;
+  vscode.enable = true;
+
+  services.home-manager.autoUpgrade = {
+    enable = true;
+    frequency = "weekly";
+  };
 
   programs = {
     gh.enable = true;

home/modules/ai-tools/tirith.nix

@@ -9,7 +9,7 @@ let
 in
 {
   options.ai-tools.tirith = {
-    enable = lib.mkEnableOption "tirith shell security guard";
+    enable = lib.mkEnableOption "tirith";
   };
 
   config = lib.mkMerge [

home/modules/anki/default.nix

@@ -9,33 +9,40 @@
 }:
 
 let
+  cfg = config.anki;
   sops = myUtils.sopsAvailability config osConfig;
   standalone = osConfig == null;
 in
-lib.optionalAttrs standalone {
+{
-  sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
+  options.anki.enable = lib.mkEnableOption "Anki";
-    anki = [
-      "sync-user"
-      "sync-key"
-    ];
-  };
-}
-// {
-  warnings = lib.optional (
-    !sops.available && config.programs.anki.enable
-  ) "anki is enabled but sops secrets are not available. anki sync will not be configured.";
 
-  programs.anki = {
+  config = lib.mkIf cfg.enable (
-    enable = true;
+    lib.optionalAttrs standalone {
-    package = config.nixgl.wrap pkgs.anki;
+      sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
-    addons = with pkgs.ankiAddons; [
+        anki = [
-      anki-connect
+          "sync-user"
-      puppy-reinforcement
+          "sync-key"
-      review-heatmap
+        ];
-    ];
+      };
-    profiles."User 1".sync = lib.mkIf sops.available {
+    }
-      usernameFile = "${sops.secrets."anki/sync-user".path}";
+    // {
-      keyFile = "${sops.secrets."anki/sync-key".path}";
+      warnings = lib.optional (
-    };
+        !sops.available
-  };
+      ) "anki is enabled but sops secrets are not available. anki sync will not be configured.";
+
+      programs.anki = {
+        enable = true;
+        package = config.nixgl.wrap pkgs.anki;
+        addons = with pkgs.ankiAddons; [
+          anki-connect
+          puppy-reinforcement
+          review-heatmap
+        ];
+        profiles."User 1".sync = lib.mkIf sops.available {
+          usernameFile = "${sops.secrets."anki/sync-user".path}";
+          keyFile = "${sops.secrets."anki/sync-key".path}";
+        };
+      };
+    }
+  );
 }

home/modules/audio/default.nix

@@ -1,7 +1,19 @@
-{ osConfig, pkgs, ... }:
-
 {
-  home.packages = with pkgs; [ pulsemixer ];
+  config,
+  lib,
+  pkgs,
+  osConfig,
+  ...
+}:
 
-  services.mpris-proxy.enable = osConfig.hardware.bluetooth.enable or false;
+let
+  cfg = config.audio;
+in
+{
+  options.audio.enable = lib.mkEnableOption "audio";
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [ pulsemixer ];
+    services.mpris-proxy.enable = osConfig.hardware.bluetooth.enable or false;
+  };
 }

home/modules/browser/default.nix

@@ -1,7 +1,19 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 
 {
+  imports = [
+    ./firefox.nix
+    ./librewolf.nix
+    ./chromium.nix
+  ];
+
   options.browser = {
+    enable = lib.mkEnableOption "browser";
+
     primary = lib.mkOption {
       type = lib.types.enum [
         "firefox"
@@ -23,11 +35,7 @@
     };
   };
 
-  config.home.sessionVariables.BROWSER = config.browser.primary;
+  config = lib.mkIf config.browser.enable {
-
+    home.sessionVariables.BROWSER = config.browser.primary;
-  imports = [
+  };
-    ./firefox.nix
-    ./librewolf.nix
-    ./chromium.nix
-  ];
 }

home/modules/browser/firefox.nix

@@ -10,6 +10,7 @@
   config = lib.mkIf (config.browser.primary == "firefox" || config.browser.secondary == "firefox") {
     programs.firefox = {
       enable = true;
+      configPath = "${config.xdg.configHome}/mozilla/firefox";
     }
     // (import ./firefox-base.nix {
       inherit

home/modules/bruno/default.nix

@@ -1,7 +1,19 @@
-{ config, pkgs, ... }:
-
 {
-  config = {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.bruno;
+in
+{
+  options.bruno = {
+    enable = lib.mkEnableOption "Bruno";
+  };
+
+  config = lib.mkIf cfg.enable {
     home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.bruno "--no-sandbox")) ];
   };
 }

home/modules/clipboard/default.nix

@@ -1,7 +1,21 @@
-{ pkgs, ... }:
-
 {
-  home.packages = with pkgs; [
+  config,
-    wl-clipboard
+  lib,
-  ];
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.clipboard;
+in
+{
+  options.clipboard = {
+    enable = lib.mkEnableOption "clipboard";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      wl-clipboard
+    ];
+  };
 }

home/modules/cloud/default.nix

@@ -3,10 +3,10 @@
 {
   options.cloud = {
     azure = {
-      enable = lib.mkEnableOption "azure CLI";
+      enable = lib.mkEnableOption "Azure CLI";
     };
     hetzner = {
-      enable = lib.mkEnableOption "hetzner CLI";
+      enable = lib.mkEnableOption "Hetzner CLI";
     };
   };
 

home/modules/dconf/default.nix

@@ -1,125 +1,137 @@
-{ config, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
+  cfg = config.my.dconf;
   terminal = "kitty";
   browser = config.browser.primary;
   font = "${config.stylix.fonts.monospace.name} ${toString config.stylix.fonts.sizes.applications}";
 in
 {
-  dconf.settings = {
+  options.my.dconf = {
-    "org/gnome/desktop/background" = {
+    enable = lib.mkEnableOption "dconf";
-      color-shading-type = "solid";
-      picture-options = "zoom";
-      picture-uri = "none";
-      picture-uri-dark = "none";
-      primary-color = "#555555";
-      secondary-color = "#555555";
-      show-desktop-icons = false;
-    };
-
-    "org/gnome/desktop/default-applications/office/calendar" = {
-      exec = "${browser} https://calendar.proton.me";
-      needs-term = false;
-    };
-
-    "org/gnome/desktop/default-applications/office/tasks" = {
-      exec = "task";
-      needs-term = true;
-    };
-
-    "org/gnome/desktop/default-applications/terminal" = {
-      exec = terminal;
-      exec-arg = "";
-    };
-
-    "org/gnome/desktop/input-sources" = {
-      xkb-options = [ "caps:none" ];
-    };
-
-    "org/gnome/desktop/interface" = {
-      clock-format = "24h";
-      clock-show-weekday = true;
-      color-scheme = "prefer-dark";
-      enable-hot-corners = false;
-      # font-name = font;
-      locate-pointer = true;
-      monospace-font-name = font;
-    };
-
-    "org/gnome/desktop/wm/keybindings" = {
-      close = [ "<Shift><Super>Delete" ];
-      minimize = [ "<Super>h" ];
-      move-to-monitor-down = [ "<Super><Shift>Down" ];
-      move-to-monitor-left = [ "<Super><Shift>Left" ];
-      move-to-monitor-right = [ "<Super><Shift>Right" ];
-      move-to-monitor-up = [ "<Super><Shift>Up" ];
-      move-to-workspace-1 = [ "<Super><Shift>a" ];
-      move-to-workspace-2 = [ "<Super><Shift>s" ];
-      move-to-workspace-3 = [ "<Super><Shift>d" ];
-      move-to-workspace-4 = [ "<Super><Shift>f" ];
-      move-to-workspace-5 = [ "<Super><Shift>g" ];
-      switch-applications = [ "<Super>j" ];
-      switch-applications-backward = [ "<Super>k" ];
-      switch-to-workspace-1 = [ "<Super>a" ];
-      switch-to-workspace-2 = [ "<Super>s" ];
-      switch-to-workspace-3 = [ "<Super>d" ];
-      switch-to-workspace-4 = [ "<Super>f" ];
-      switch-to-workspace-5 = [ "<Super>g" ];
-    };
-
-    "org/gnome/desktop/wm/preferences" = {
-      num-workspaces = 5;
-      workspace-names = [
-        "sh"
-        "www"
-        "dev"
-        "info"
-        "etc"
-      ];
-    };
-
-    "org/gnome/mutter" = {
-      center-new-windows = true;
-      dynamic-workspaces = false;
-    };
-
-    "org/gnome/settings-daemon/plugins/color" = {
-      night-light-enabled = true;
-      night-light-schedule-automatic = true;
-    };
-
-    "org/gnome/settings-daemon/plugins/media-keys" = {
-      custom-keybindings = [
-        "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/"
-        "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1/"
-      ];
-    };
-
-    "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0" = {
-      binding = "Print";
-      command = "flameshot gui";
-      name = "flameshot";
-    };
-
-    "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1" = {
-      binding = "<Super>Return";
-      command = terminal;
-      name = "Kitty";
-    };
-
-    "org/gnome/settings-daemon/plugins/power" = {
-      power-button-action = "suspend";
-    };
-
-    "org/gnome/shell/app-switcher" = {
-      current-workspace-only = true;
-    };
-
-    "org/gnome/shell/keybindings" = {
-      toggle-application-view = [ "<Super>p" ];
-      toggle-quick-settings = [ ];
-    };
   };
 
-  home.packages = with pkgs; [ dconf2nix ];
+  config = lib.mkIf cfg.enable {
+    dconf.settings = {
+      "org/gnome/desktop/background" = {
+        color-shading-type = "solid";
+        picture-options = "zoom";
+        picture-uri = "none";
+        picture-uri-dark = "none";
+        primary-color = "#555555";
+        secondary-color = "#555555";
+        show-desktop-icons = false;
+      };
+
+      "org/gnome/desktop/default-applications/office/calendar" = {
+        exec = "${browser} https://calendar.proton.me";
+        needs-term = false;
+      };
+
+      "org/gnome/desktop/default-applications/office/tasks" = {
+        exec = "task";
+        needs-term = true;
+      };
+
+      "org/gnome/desktop/default-applications/terminal" = {
+        exec = terminal;
+        exec-arg = "";
+      };
+
+      "org/gnome/desktop/input-sources" = {
+        xkb-options = [ "caps:none" ];
+      };
+
+      "org/gnome/desktop/interface" = {
+        clock-format = "24h";
+        clock-show-weekday = true;
+        color-scheme = "prefer-dark";
+        enable-hot-corners = false;
+        # font-name = font;
+        locate-pointer = true;
+        monospace-font-name = font;
+      };
+
+      "org/gnome/desktop/wm/keybindings" = {
+        close = [ "<Shift><Super>Delete" ];
+        minimize = [ "<Super>h" ];
+        move-to-monitor-down = [ "<Super><Shift>Down" ];
+        move-to-monitor-left = [ "<Super><Shift>Left" ];
+        move-to-monitor-right = [ "<Super><Shift>Right" ];
+        move-to-monitor-up = [ "<Super><Shift>Up" ];
+        move-to-workspace-1 = [ "<Super><Shift>a" ];
+        move-to-workspace-2 = [ "<Super><Shift>s" ];
+        move-to-workspace-3 = [ "<Super><Shift>d" ];
+        move-to-workspace-4 = [ "<Super><Shift>f" ];
+        move-to-workspace-5 = [ "<Super><Shift>g" ];
+        switch-applications = [ "<Super>j" ];
+        switch-applications-backward = [ "<Super>k" ];
+        switch-to-workspace-1 = [ "<Super>a" ];
+        switch-to-workspace-2 = [ "<Super>s" ];
+        switch-to-workspace-3 = [ "<Super>d" ];
+        switch-to-workspace-4 = [ "<Super>f" ];
+        switch-to-workspace-5 = [ "<Super>g" ];
+      };
+
+      "org/gnome/desktop/wm/preferences" = {
+        num-workspaces = 5;
+        workspace-names = [
+          "sh"
+          "www"
+          "dev"
+          "info"
+          "etc"
+        ];
+      };
+
+      "org/gnome/mutter" = {
+        center-new-windows = true;
+        dynamic-workspaces = false;
+      };
+
+      "org/gnome/settings-daemon/plugins/color" = {
+        night-light-enabled = true;
+        night-light-schedule-automatic = true;
+      };
+
+      "org/gnome/settings-daemon/plugins/media-keys" = {
+        custom-keybindings = [
+          "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/"
+          "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1/"
+        ];
+      };
+
+      "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0" = {
+        binding = "Print";
+        command = "flameshot gui";
+        name = "flameshot";
+      };
+
+      "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1" = {
+        binding = "<Super>Return";
+        command = terminal;
+        name = "Kitty";
+      };
+
+      "org/gnome/settings-daemon/plugins/power" = {
+        power-button-action = "suspend";
+      };
+
+      "org/gnome/shell/app-switcher" = {
+        current-workspace-only = true;
+      };
+
+      "org/gnome/shell/keybindings" = {
+        toggle-application-view = [ "<Super>p" ];
+        toggle-quick-settings = [ ];
+      };
+    };
+
+    home.packages = with pkgs; [ dconf2nix ];
+  };
 }

home/modules/default.nix

@@ -6,6 +6,13 @@
 }:
 
 {
+  imports =
+    let
+      dirs = lib.attrNames (lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./.));
+      hasDef = name: builtins.pathExists ./${name}/default.nix;
+    in
+    map (name: ./${name}) (builtins.filter hasDef dirs);
+
   options = {
     host.username = lib.mkOption {
       type = lib.types.str;

home/modules/desktop/default.nix

@@ -0,0 +1,5 @@
+{ ... }:
+
+{
+  imports = [ ./niri ];
+}

home/modules/desktop/niri/config.kdl

@@ -179,4 +179,5 @@ binds {
     Alt+Print  { screenshot-window; }
 
     Mod+Shift+Delete { quit; }
+
 }

home/modules/desktop/niri/default.nix

@@ -1,4 +1,9 @@
-{ pkgs, ... }:
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
 
 {
   imports = [
@@ -9,18 +14,58 @@
     ../../waybar
   ];
 
-  home = {
+  options.desktop.niri.enable = lib.mkEnableOption "niri desktop";
-    file.".config/niri/config.kdl".source = ./config.kdl;
-    packages = with pkgs; [
-      brightnessctl
-      wlsunset
-    ];
-  };
 
-  services.gammastep = {
+  config = lib.mkIf config.desktop.niri.enable {
-    enable = true;
+    clipboard.enable = lib.mkDefault true;
-    provider = "manual";
+    fuzzel.enable = lib.mkDefault true;
-    latitude = 51.05;
+    mako.enable = lib.mkDefault true;
-    longitude = 3.71667;
+    shikane.enable = lib.mkDefault true;
+    waybar.enable = lib.mkDefault true;
+
+    home = {
+      file.".config/niri/config.kdl".source = ./config.kdl;
+      packages = with pkgs; [
+        brightnessctl
+        xwayland-satellite
+      ];
+    };
+
+    services.gammastep = {
+      enable = true;
+      provider = "manual";
+      latitude = 51.05;
+      longitude = 3.71667;
+    };
+
+    xdg.configFile."electron-flags.conf".text = ''
+      --enable-features=UseOzonePlatform
+      --ozone-platform=wayland
+    '';
+
+    xdg.portal = {
+      enable = true;
+      config = {
+        niri = {
+          default = [
+            "gnome"
+            "gtk"
+          ];
+          "org.freedesktop.impl.portal.Access" = "gtk";
+          "org.freedesktop.impl.portal.Notification" = "gtk";
+          "org.freedesktop.impl.portal.Secret" = "gnome-keyring";
+          "org.freedesktop.impl.portal.FileChooser" = "gtk";
+          "org.freedesktop.impl.portal.ScreenCast" = [ "gnome" ];
+          "org.freedesktop.impl.portal.Settings" = [
+            "gnome"
+            "gtk"
+          ];
+        };
+      };
+      extraPortals = [
+        pkgs.xdg-desktop-portal-gtk
+        pkgs.xdg-desktop-portal-gnome
+      ];
+    };
   };
 }

home/modules/devenv/default.nix

@@ -1,4 +1,19 @@
-{ pkgs, ... }:
 {
-  home.packages = [ pkgs.devenv ];
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.devenv;
+in
+{
+  options.devenv = {
+    enable = lib.mkEnableOption "devenv";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = [ pkgs.devenv ];
+  };
 }

home/modules/direnv/default.nix

@@ -1,7 +1,20 @@
 {
-  programs.direnv = {
+  config,
-    enable = true;
+  lib,
-    enableBashIntegration = true;
+  ...
-    nix-direnv.enable = true;
+}:
+
+let
+  cfg = config.direnv;
+in
+{
+  options.direnv.enable = lib.mkEnableOption "direnv";
+
+  config = lib.mkIf cfg.enable {
+    programs.direnv = {
+      enable = true;
+      enableBashIntegration = true;
+      nix-direnv.enable = true;
+    };
   };
 }

home/modules/docker/default.nix

@@ -1,7 +1,21 @@
-{ pkgs, ... }:
-
 {
-  home.packages = with pkgs; [
+  config,
-    dive
+  lib,
-  ];
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.docker;
+in
+{
+  options.docker = {
+    enable = lib.mkEnableOption "Docker";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      dive
+    ];
+  };
 }

home/modules/fuzzel/default.nix

@@ -1,14 +1,27 @@
 {
-  programs.fuzzel = {
+  config,
-    enable = true;
+  lib,
-    settings = {
+  ...
-      main = {
+}:
-        horizontal-pad = 0;
+
-        vertical-pad = 0;
+let
-      };
+  cfg = config.fuzzel;
-      border = {
+in
-        width = 2;
+{
-        radius = 0;
+  options.fuzzel.enable = lib.mkEnableOption "fuzzel";
+
+  config = lib.mkIf cfg.enable {
+    programs.fuzzel = {
+      enable = true;
+      settings = {
+        main = {
+          horizontal-pad = 0;
+          vertical-pad = 0;
+        };
+        border = {
+          width = 2;
+          radius = 0;
+        };
       };
     };
   };

home/modules/git/default.nix

@@ -8,11 +8,12 @@
 
 {
   options.git = {
+    enable = lib.mkEnableOption "git";
     github.enable = lib.mkEnableOption "Github CLI";
     gitlab.enable = lib.mkEnableOption "Gitlab CLI";
   };
 
-  config = {
+  config = lib.mkIf config.git.enable {
     programs.git.enable = true;
     home.file = {
       ".gitconfig".source = dotsPath + "/.gitconfig";

home/modules/go/default.nix

@@ -1,7 +1,22 @@
-{ pkgs, ... }:
 {
-  home.packages = with pkgs; [
+  config,
-    go
+  lib,
-    gopls
+  pkgs,
-  ];
+  ...
+}:
+
+let
+  cfg = config.go;
+in
+{
+  options.go = {
+    enable = lib.mkEnableOption "Go";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      go
+      gopls
+    ];
+  };
 }

home/modules/infra/default.nix

@@ -1,7 +1,19 @@
-{ pkgs, ... }:
-
 {
-  config = {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.infra;
+in
+{
+  options.infra = {
+    enable = lib.mkEnableOption "infrastructure tools";
+  };
+
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       opentofu
       upbound

home/modules/k8s/default.nix

@@ -1,29 +1,44 @@
-{ pkgs, ... }:
-
 {
-  home.packages = with pkgs; [
+  config,
-    argocd
+  lib,
-    fluxcd
+  pkgs,
-    k3d
+  ...
-    kubectl
+}:
-    kubernetes
-    kustomize
-    minikube
-    opentofu
-    upbound
-  ];
-
-  programs.kubecolor = {
-    enable = true;
-    enableAlias = true;
-  };
-
-  home.shellAliases = {
-    k = "kubectl";
-  };
 
+let
+  cfg = config.k8s;
+in
+{
   imports = [
     ./helm.nix
     ./k9s.nix
   ];
+
+  options.k8s.enable = lib.mkEnableOption "k8s";
+
+  config = lib.mkIf cfg.enable {
+    k8s.helm.enable = lib.mkDefault true;
+    k8s.k9s.enable = lib.mkDefault true;
+
+    home.packages = with pkgs; [
+      argocd
+      fluxcd
+      k3d
+      kubectl
+      kubernetes
+      kustomize
+      minikube
+      opentofu
+      upbound
+    ];
+
+    programs.kubecolor = {
+      enable = true;
+      enableAlias = true;
+    };
+
+    home.shellAliases = {
+      k = "kubectl";
+    };
+  };
 }

home/modules/k8s/helm.nix

@@ -1,15 +1,27 @@
-{ pkgs, ... }:
-
 {
-  home.packages = with pkgs; [
+  config,
-    (wrapHelm kubernetes-helm {
+  lib,
-      plugins = with kubernetes-helmPlugins; [
+  pkgs,
-        helm-diff
+  ...
-        helm-git
+}:
-        helm-schema
+
-        helm-secrets
+let
-        helm-unittest
+  cfg = config.k8s.helm;
-      ];
+in
-    })
+{
-  ];
+  options.k8s.helm.enable = lib.mkEnableOption "helm";
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      (wrapHelm kubernetes-helm {
+        plugins = with kubernetes-helmPlugins; [
+          helm-diff
+          helm-git
+          helm-schema
+          helm-secrets
+          helm-unittest
+        ];
+      })
+    ];
+  };
 }

home/modules/k8s/k9s.nix

@@ -1,10 +1,23 @@
 {
-  programs.k9s = {
+  config,
-    enable = true;
+  lib,
-    settings.k9s = {
+  ...
-      ui = {
+}:
-        logoless = true;
+
-        reactive = true;
+let
+  cfg = config.k8s.k9s;
+in
+{
+  options.k8s.k9s.enable = lib.mkEnableOption "";
+
+  config = lib.mkIf cfg.enable {
+    programs.k9s = {
+      enable = true;
+      settings.k9s = {
+        ui = {
+          logoless = true;
+          reactive = true;
+        };
       };
     };
   };

home/modules/keepassxc/default.nix

@@ -1,8 +1,21 @@
 {
-  programs.keepassxc = {
+  config,
-    enable = true;
+  lib,
-    settings = {
+  ...
-      Browser.Enabled = true;
+}:
+
+let
+  cfg = config.keepassxc;
+in
+{
+  options.keepassxc.enable = lib.mkEnableOption "KeePassXC";
+
+  config = lib.mkIf cfg.enable {
+    programs.keepassxc = {
+      enable = true;
+      settings = {
+        Browser.Enabled = true;
+      };
     };
   };
 }

home/modules/mako/default.nix

@@ -1,5 +1,16 @@
 {
-  services.mako = {
+  config,
-    enable = true;
+  lib,
+  ...
+}:
+
+let
+  cfg = config.mako;
+in
+{
+  options.mako.enable = lib.mkEnableOption "mako";
+
+  config = lib.mkIf cfg.enable {
+    services.mako.enable = true;
   };
 }

home/modules/music/default.nix

@@ -1,10 +1,13 @@
 {
-  dotsPath,
+  config,
+  lib,
   pkgs,
+  dotsPath,
   ...
 }:
 
 let
+  cfg = config.music;
   spotifyWithWayland = pkgs.symlinkJoin {
     name = "spotify";
     paths = [ pkgs.spotify ];
@@ -16,12 +19,14 @@ let
   };
 in
 {
-  home.packages = with pkgs; [
+  options.music.enable = lib.mkEnableOption "music";
-    spotifyWithWayland
-  ];
 
-  programs.ncspot = {
+  config = lib.mkIf cfg.enable {
-    enable = true;
+    home.packages = [ spotifyWithWayland ];
-    settings = builtins.fromTOML (builtins.readFile (dotsPath + "/.config/ncspot/config.toml"));
+
+    programs.ncspot = {
+      enable = true;
+      settings = fromTOML (builtins.readFile (dotsPath + "/.config/ncspot/config.toml"));
+    };
   };
 }

home/modules/nfc/default.nix

@@ -1,5 +1,21 @@
 {
-  imports = [
+  config,
-    ./proxmark3.nix
+  lib,
-  ];
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.nfc;
+in
+{
+  options.nfc = {
+    enable = lib.mkEnableOption "NFC tools";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = [
+      (pkgs.proxmark3.override { withGeneric = true; })
+    ];
+  };
 }

home/modules/nfc/proxmark3.nix

@@ -1,6 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [
-    (pkgs.proxmark3.override { withGeneric = true; })
-  ];
-}

home/modules/nodejs/default.nix

@@ -5,15 +5,21 @@
   ...
 }:
 
+let
+  cfg = config.nodejs;
+in
 {
-  options.nodejs.package = lib.mkOption {
+  options.nodejs = {
-    type = lib.types.package;
+    enable = lib.mkEnableOption "Node.js";
-    default = pkgs.nodejs_24;
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.nodejs_24;
+    };
   };
 
-  config = {
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
-      config.nodejs.package
+      cfg.package
       pnpm
       yarn
       biome

home/modules/nvim/default.nix

@@ -1,7 +1,20 @@
-{ pkgs, inputs, ... }:
-
 {
-  home.packages = [
+  config,
-    inputs.nvim.packages.${pkgs.stdenv.hostPlatform.system}.nvim
+  lib,
-  ];
+  pkgs,
+  inputs,
+  ...
+}:
+
+let
+  cfg = config.nvim;
+in
+{
+  options.nvim.enable = lib.mkEnableOption "nvim";
+
+  config = lib.mkIf cfg.enable {
+    home.packages = [
+      inputs.nvim.packages.${pkgs.stdenv.hostPlatform.system}.nvim
+    ];
+  };
 }

home/modules/pandoc/default.nix

@@ -1,8 +1,23 @@
-{ pkgs, ... }:
 {
-  home.packages = with pkgs; [
+  config,
-    haskellPackages.pandoc-crossref
+  lib,
-    pandoc
+  pkgs,
-    texliveSmall
+  ...
-  ];
+}:
+
+let
+  cfg = config.pandoc;
+in
+{
+  options.pandoc = {
+    enable = lib.mkEnableOption "pandoc";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      haskellPackages.pandoc-crossref
+      pandoc
+      texliveSmall
+    ];
+  };
 }

home/modules/photography/default.nix

@@ -1,7 +1,21 @@
-{ pkgs, ... }:
-
 {
-  home.packages = with pkgs; [
+  config,
-    darktable
+  lib,
-  ];
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.photography;
+in
+{
+  options.photography = {
+    enable = lib.mkEnableOption "photography";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      darktable
+    ];
+  };
 }

home/modules/secrets/default.nix

@@ -1,13 +1,19 @@
 {
+  config,
+  lib,
   pkgs,
   ...
 }:
 {
   imports = [ ./vault.nix ];
 
-  home.packages = with pkgs; [
+  options.secrets.enable = lib.mkEnableOption "secrets";
-    age
+
-    age-plugin-yubikey # TODO: only needed when using Yubikey
+  config = lib.mkIf config.secrets.enable {
-    sops
+    home.packages = with pkgs; [
-  ];
+      age
+      age-plugin-yubikey
+      sops
+    ];
+  };
 }

home/modules/shell/bash.nix

@@ -4,13 +4,12 @@
   dotsPath,
   ...
 }:
+
 let
   cfg = config.shell.bash;
   inherit (config.home) username;
 in
 {
-  imports = [ ./utils.nix ];
-
   options.shell.bash = {
     aliases = {
       all = lib.mkOption {
@@ -34,7 +33,7 @@ in
     };
   };
 
-  config = {
+  config = lib.mkIf config.shell.enable {
     programs.bash = {
       enable = true;
       enableCompletion = true;

home/modules/shell/default.nix

@@ -1,3 +1,9 @@
+{
+  config,
+  lib,
+  ...
+}:
+
 {
   imports = [
     ./bash.nix
@@ -5,4 +11,10 @@
     ./prompt.nix
     ../tmux
   ];
+
+  options.shell.enable = lib.mkEnableOption "shell";
+
+  config = lib.mkIf config.shell.enable {
+    tmux.enable = lib.mkDefault true;
+  };
 }

home/modules/shell/prompt.nix

@@ -1,3 +1,11 @@
 {
-  programs.starship.enable = true;
+  config,
+  lib,
+  ...
+}:
+
+{
+  config = lib.mkIf config.shell.enable {
+    programs.starship.enable = true;
+  };
 }

home/modules/shell/utils.nix

@@ -1,19 +1,23 @@
 {
+  config,
   lib,
   pkgs,
   ...
 }:
-{
-  programs.fzf = {
-    enable = true;
-    enableBashIntegration = lib.mkDefault true;
-  };
 
-  home.packages = with pkgs; [
+{
-    ripgrep
+  config = lib.mkIf config.shell.enable {
-    bat
+    programs.fzf = {
-    jq
+      enable = true;
-    entr
+      enableBashIntegration = lib.mkDefault true;
-    parallel
+    };
-  ];
+
+    home.packages = with pkgs; [
+      ripgrep
+      bat
+      jq
+      entr
+      parallel
+    ];
+  };
 }

home/modules/shikane/default.nix

@@ -1,6 +1,67 @@
-{ pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
-  home.packages = with pkgs; [ wdisplays ];
+  options.shikane.enable = lib.mkEnableOption "shikane";
-  services.shikane.enable = true;
+
+  config = lib.mkIf config.shikane.enable {
+    home.packages = with pkgs; [ (config.nixgl.wrap wdisplays) ];
+    services.shikane.enable = true;
+    home.file.".config/shikane/config.toml".text = ''
+      [[profile]]
+      name = "work"
+
+      [[profile.output]]
+      enable = true
+      search = ["m=Unknown", "s=", "v=Unknown"]
+      mode = "2880x1800@120Hz"
+      position = "288,3240"
+      scale = 1.5
+      transform = "normal"
+      adaptive_sync = false
+
+      [[profile.output]]
+      enable = true
+      search = ["m=Q27P1B", "s=GNXM2HA196769", "v=PNP(AOC)"]
+      mode = "2560x1440@59.951Hz"
+      position = "116,1800"
+      scale = 1.0
+      transform = "normal"
+      adaptive_sync = false
+
+      [[profile.output]]
+      enable = true
+      search = ["m=PHL 243S7", "s=UHB1923012753", "v=Philips Consumer Electronics Company"]
+      mode = "1920x1080@60Hz"
+      position = "2676,1800"
+      scale = 1.0
+      transform = "270"
+      adaptive_sync = false
+
+      [[profile]]
+      name = "home"
+
+      [[profile.output]]
+      enable = true
+      search = ["m=Unknown", "s=Unknown", "v=Unknown"]
+      mode = "2880x1800@60.001Hz"
+      position = "185,1440"
+      scale = 1.75
+      transform = "normal"
+      adaptive_sync = false
+
+      [[profile.output]]
+      enable = true
+      search = ["m=PHL 276E8V", "s=0x0000046D", "v=Philips Consumer Electronics Company"]
+      mode = "3840x2160@59.996Hz"
+      position = "1500,0"
+      scale = 1.5
+      transform = "normal"
+      adaptive_sync = false
+    '';
+  };
 }

home/modules/ssh/default.nix

@@ -1,10 +1,13 @@
 {
-  myUtils,
+  config,
   lib,
   pkgs,
+  myUtils,
   ...
 }:
+
 let
+  cfg = config.ssh;
   hostDir = ../../hosts;
   hostNames = myUtils.dirNames hostDir;
   hostsWithKeys = lib.filter (
@@ -12,31 +15,34 @@ let
   ) hostNames;
 in
 {
-  home.packages = with pkgs; [ sshfs ];
+  options.ssh.enable = lib.mkEnableOption "ssh";
 
-  programs.ssh = {
+  config = lib.mkIf cfg.enable {
-    enable = true;
+    home.packages = with pkgs; [ sshfs ];
-    enableDefaultConfig = false;
 
-    matchBlocks =
+    programs.ssh = {
-      lib.genAttrs hostsWithKeys (
+      enable = true;
-        hostname:
+      enableDefaultConfig = false;
-        let
+
-          meta = myUtils.hostMeta (hostDir + "/${hostname}");
+      settings =
-        in
+        lib.genAttrs hostsWithKeys (
-        {
+          hostname:
-          host = hostname;
+          let
-          user = meta.deployment.targetUser;
+            meta = myUtils.hostMeta (hostDir + "/${hostname}");
-        }
+          in
-        // lib.optionalAttrs (meta.deployment.targetHost != "") {
+          {
-          hostname = meta.deployment.targetHost;
+            User = meta.deployment.targetUser;
-        }
+          }
-      )
+          // lib.optionalAttrs (meta.deployment.targetHost != "") {
-      // {
+            HostName = meta.deployment.targetHost;
-        "*" = {
+          }
-          addKeysToAgent = "yes";
+        )
-          forwardAgent = false;
+        // {
+          "*" = {
+            AddKeysToAgent = "yes";
+            ForwardAgent = false;
+          };
         };
-      };
+    };
   };
 }

home/modules/stylix/default.nix

@@ -1,30 +1,33 @@
 {
   config,
-  inputs,
+  lib,
   pkgs,
   ...
 }:
 
 let
+  cfg = config.my.stylix;
   theme = import ../../../modules/stylix/theme.nix { inherit pkgs; };
 in
 {
-  imports = [ inputs.stylix.homeModules.stylix ];
+  options.my.stylix.enable = lib.mkEnableOption "stylix";
 
-  stylix = {
+  config = lib.mkIf cfg.enable {
-    enable = true;
+    stylix = {
-    inherit (theme)
+      enable = true;
-      polarity
+      inherit (theme)
-      base16Scheme
+        polarity
-      override
+        base16Scheme
-      image
+        override
-      ;
+        image
-    fonts = {
+        ;
-      monospace = theme.monospaceFont;
+      fonts = {
-      serif = config.stylix.fonts.monospace;
+        monospace = theme.monospaceFont;
-      sansSerif = config.stylix.fonts.monospace;
+        serif = config.stylix.fonts.monospace;
-      emoji = config.stylix.fonts.monospace;
+        sansSerif = config.stylix.fonts.monospace;
+        emoji = config.stylix.fonts.monospace;
+      };
+      targets = import ../../../modules/stylix/targets.nix;
     };
-    targets = import ../../../modules/stylix/targets.nix;
   };
 }

home/modules/taskwarrior/default.nix

@@ -10,70 +10,76 @@
 }:
 
 let
+  cfg = config.taskwarrior;
   sops = myUtils.sopsAvailability config osConfig;
   standalone = osConfig == null;
 in
-lib.optionalAttrs standalone {
+{
-  sops = {
+  options.taskwarrior.enable = lib.mkEnableOption "taskwarrior";
-    secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
+
-      taskwarrior = [
+  config = lib.mkIf cfg.enable (
-        "sync-server-url"
+    lib.optionalAttrs standalone {
-        "sync-server-client-id"
+      sops = {
-        "sync-encryption-secret"
+        secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
+          taskwarrior = [
+            "sync-server-url"
+            "sync-server-client-id"
+            "sync-encryption-secret"
+          ];
+        };
+
+        templates."taskrc.d/sync" = {
+          content = ''
+            sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"}
+            sync.server.client_id=${config.sops.placeholder."taskwarrior/sync-server-client-id"}
+            sync.encryption_secret=${config.sops.placeholder."taskwarrior/sync-encryption-secret"}
+          '';
+        };
+      };
+    }
+    // {
+      warnings =
+        lib.optional (!sops.available)
+          "taskwarrior is enabled, but sops templates are not available. taskwarrior sync will not be configured.";
+
+      home.packages = with pkgs; [
+        libnotify
+        taskopen
+        python3
       ];
-    };
 
-    templates."taskrc.d/sync" = {
+      home.file = {
-      content = ''
+        ".config/task/taskrc" = {
-        sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"}
+          force = true;
-        sync.server.client_id=${config.sops.placeholder."taskwarrior/sync-server-client-id"}
+          source = dotsPath + "/.config/task/taskrc";
-        sync.encryption_secret=${config.sops.placeholder."taskwarrior/sync-encryption-secret"}
+        };
-      '';
+        ".config/task/taskrc.d/aliases".source = dotsPath + "/.config/task/taskrc.d/aliases";
-    };
+        ".config/task/taskrc.d/colors".source = dotsPath + "/.config/task/taskrc.d/colors";
-  };
+        ".config/task/taskrc.d/contexts".source = dotsPath + "/.config/task/taskrc.d/contexts";
-}
+        ".config/task/taskrc.d/reports".source = dotsPath + "/.config/task/taskrc.d/reports";
-// {
+        ".config/task/taskrc.d/udas".source = dotsPath + "/.config/task/taskrc.d/udas";
-
+        ".config/task/taskrc.d/urgency".source = dotsPath + "/.config/task/taskrc.d/urgency";
-  warnings =
+        ".local/share/task/hooks/on-exit.sync.py" = {
-    lib.optional (!sops.available && config.programs.taskwarrior.enable)
+          source = dotsPath + "/.local/share/task/hooks/on-exit.sync.py";
-      "taskwarrior is enabled, but sops templates are not available. taskwarrior sync will not be configured.";
+        };
-
+        ".local/share/task/scripts/sync-and-notify.sh" = {
-  home.packages = with pkgs; [
+          source = dotsPath + "/.local/share/task/scripts/sync-and-notify.sh";
-    libnotify
+          executable = true;
-    taskopen
+        };
-    python3
+      };
-  ];
+
-
+      programs.taskwarrior = with pkgs; {
-  home.file = {
+        enable = true;
-    ".config/task/taskrc" = {
+        package = taskwarrior3;
-      force = true;
+        colorTheme = "dark-256";
-      source = dotsPath + "/.config/task/taskrc";
+        config = {
-    };
+          recurrence = "off";
-    ".config/task/taskrc.d/aliases".source = dotsPath + "/.config/task/taskrc.d/aliases";
+          reserved.lines = 3;
-    ".config/task/taskrc.d/colors".source = dotsPath + "/.config/task/taskrc.d/colors";
+        };
-    ".config/task/taskrc.d/contexts".source = dotsPath + "/.config/task/taskrc.d/contexts";
+        extraConfig = lib.optionalString sops.available ''
-    ".config/task/taskrc.d/reports".source = dotsPath + "/.config/task/taskrc.d/reports";
+          include ${sops.templates."taskrc.d/sync".path}
-    ".config/task/taskrc.d/udas".source = dotsPath + "/.config/task/taskrc.d/udas";
+        '';
-    ".config/task/taskrc.d/urgency".source = dotsPath + "/.config/task/taskrc.d/urgency";
+      };
-    ".local/share/task/hooks/on-exit.sync.py" = {
+    }
-      source = dotsPath + "/.local/share/task/hooks/on-exit.sync.py";
+  );
-    };
-    ".local/share/task/scripts/sync-and-notify.sh" = {
-      source = dotsPath + "/.local/share/task/scripts/sync-and-notify.sh";
-      executable = true;
-    };
-  };
-
-  programs.taskwarrior = with pkgs; {
-    enable = true;
-    package = taskwarrior3;
-    colorTheme = "dark-256";
-    config = {
-      recurrence = "off";
-      reserved.lines = 3; # without this I would have to scroll up 3 lines
-    };
-    extraConfig = lib.optionalString sops.available ''
-      include ${sops.templates."taskrc.d/sync".path}
-    '';
-  };
 }

home/modules/terminal/default.nix

@@ -1,12 +1,18 @@
 {
-  pkgs,
   config,
+  lib,
+  pkgs,
   dotsPath,
   ...
 }:
 
+let
+  cfg = config.terminal;
+in
 {
-  config = {
+  options.terminal.enable = lib.mkEnableOption "terminal";
+
+  config = lib.mkIf cfg.enable {
     programs.bash.shellAliases = {
       icat = "kitty +kitten icat";
     };

home/modules/ticketing/default.nix

@@ -1,7 +1,21 @@
-{ pkgs, ... }:
-
 {
-  home.packages = with pkgs; [
+  config,
-    jira-cli-go
+  lib,
-  ];
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.ticketing;
+in
+{
+  options.ticketing = {
+    enable = lib.mkEnableOption "ticketing";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      jira-cli-go
+    ];
+  };
 }

home/modules/tmux/default.nix

@@ -1,7 +1,18 @@
-{ pkgs, dotsPath, ... }:
-
 {
-  config = {
+  config,
+  lib,
+  pkgs,
+  dotsPath,
+  ...
+}:
+
+let
+  cfg = config.tmux;
+in
+{
+  options.tmux.enable = lib.mkEnableOption "tmux";
+
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       tmuxp
       reptyr

home/modules/torrenting/default.nix

@@ -10,7 +10,7 @@ let
 in
 {
   options.torrenting = {
-    enable = lib.mkEnableOption "transmission torrent client";
+    enable = lib.mkEnableOption "torrenting";
   };
 
   config = lib.mkIf cfg.enable {

home/modules/vscode/default.nix

@@ -1,7 +1,19 @@
-{ config, pkgs, ... }:
-
 {
-  config = {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.vscode;
+in
+{
+  options.vscode = {
+    enable = lib.mkEnableOption "Visual Studio Code";
+  };
+
+  config = lib.mkIf cfg.enable {
     home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.vscode "--no-sandbox")) ];
   };
 }

home/modules/waybar/default.nix

@@ -1,11 +1,24 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.waybar;
+in
 {
   imports = [
     ./settings.nix
     ./style.nix
   ];
 
-  programs.waybar = {
+  options.waybar.enable = lib.mkEnableOption "waybar";
-    enable = true;
+
-    systemd.enable = true;
+  config = lib.mkIf cfg.enable {
+    programs.waybar = {
+      enable = true;
+      systemd.enable = true;
+    };
   };
 }

hosts/andromache/default.nix

@@ -17,51 +17,57 @@ in
     inputs.nixos-hardware.nixosModules.common-cpu-intel
     inputs.nixos-hardware.nixosModules.common-pc
     inputs.nixos-hardware.nixosModules.common-pc-ssd
-    ../../modules/common
+    ../../modules
-    ../../modules/boot/bootloader.nix
     (import ../../modules/disko/zfs-encrypted-root.nix {
       inherit lib config;
       device = "/dev/nvme1n1";
     })
-    ../../modules/ai-tools
-    ../../modules/anki
-    ../../modules/audio
-    ../../modules/backups
-    ../../modules/bluetooth
-    ../../modules/desktops/niri
-    ../../modules/docker
-    ../../modules/firewall
-    ../../modules/fonts
-    ../../modules/gaming
-    ../../modules/git
-    ../../modules/hcloud
-    ../../modules/keyboard
-    ../../modules/localization
-    ../../modules/networking
-    ../../modules/nvidia
-    ../../modules/secrets
-    ../../modules/ssh
-    ../../modules/storage
-    ../../modules/stylix
-    ../../modules/syncthing
-    ../../modules/tailscale
-    ../../modules/taskwarrior
-    ../../modules/users
-    ../../modules/wol
-    ../../modules/yubikey
   ];
 
   home-manager.users.${config.host.username} = import ../../home/hosts/${config.host.name};
 
-  secrets.nixSigningKey.enable = true;
+  "ai-tools".enable = true;
-
+  anki.enable = true;
-  restic-backup.enable = true;
+  audio.enable = true;
-  tailscale.enable = true;
+  bluetooth.enable = true;
+  bootloader.enable = true;
+  desktop.niri.enable = true;
+  firewall = {
+    enable = true;
+    allowedTCPPorts = [ 22 ];
+  };
+  gaming.enable = true;
+  git.enable = true;
+  keyboard.enable = true;
+  localization.enable = true;
+  my = {
+    fonts.enable = true;
+    stylix.enable = true;
+    users.enable = true;
+    yubikey = {
+      enable = true;
+      pam.enable = false;
+    };
+  };
   desktop.ly.enable = true;
-
   docker.enable = true;
-
   hcloud.enable = true;
+  networking.enable = true;
+  nvidia.enable = true;
+  restic-backup.enable = true;
+  secrets = {
+    enable = true;
+    nixSigningKey.enable = true;
+  };
+  ssh.enable = true;
+  storage.enable = true;
+  syncthing.enable = true;
+  tailscale.enable = true;
+  taskwarrior.enable = true;
+  wol = {
+    enable = true;
+    interfaces.eno1 = { inherit (wolInterfaces.eno1) macAddress; };
+  };
 
   disko.devices = {
     disk.data = {
@@ -91,25 +97,10 @@ in
     inputs.colmena.packages.${pkgs.stdenv.hostPlatform.system}.colmena
   ];
 
-  my.yubikey = {
-    enable = true;
-    pam.enable = false;
-  };
-
   services.locate = {
     enable = true;
     package = pkgs.plocate;
   };
 
   networking.hostId = "80eef97e";
-
-  wol = {
-    enable = true;
-    interfaces.eno1 = { inherit (wolInterfaces.eno1) macAddress; };
-  };
-
-  firewall = {
-    enable = true;
-    allowedTCPPorts = [ 22 ];
-  };
 }

hosts/astyanax/default.nix

@@ -5,9 +5,7 @@
   pkgs,
   ...
 }:
-let
+
-  wolInterfaces = import ../andromache/wol-interfaces.nix;
-in
 {
   imports = [
     inputs.disko.nixosModules.disko
@@ -16,47 +14,50 @@ in
     inputs.nixos-hardware.nixosModules.common-pc
     inputs.nixos-hardware.nixosModules.common-pc-ssd
     # inputs.nixos-hardware.nixosModules.lenovo-thinkpad-e14-intel-gen7 (not available yet?)
-    inputs.sops-nix.nixosModules.sops
+    ../../modules
-    ../../modules/common
-    ../../modules/boot/bootloader.nix
     (import ../../modules/disko/zfs-encrypted-root.nix {
       inherit lib config;
       device = "/dev/nvme0n1";
     })
-    ../../modules/ai-tools
-    ../../modules/anki
-    ../../modules/audio
-    ../../modules/backups
-    ../../modules/bluetooth
-    ../../modules/desktops/niri
-    ../../modules/docker
-    ../../modules/firewall
-    ../../modules/fonts
-    ../../modules/git
-    ../../modules/keyboard
-    ../../modules/localization
-    ../../modules/networking
-    ../../modules/nfc
-    ../../modules/secrets
-    ../../modules/ssh
-    ../../modules/storage
-    ../../modules/stylix
-    ../../modules/tailscale
-    ../../modules/taskwarrior
-    ../../modules/users
-    ../../modules/yubikey
   ];
 
   home-manager.users.${config.host.username} = import ../../home/hosts/${config.host.name};
 
-  secrets.nixSigningKey.enable = true;
+  "ai-tools".enable = true;
+  anki.enable = true;
+  audio.enable = true;
+  bluetooth.enable = true;
+  bootloader.enable = true;
+  desktop.niri.enable = true;
+  git.enable = true;
+  keyboard.enable = true;
+  localization.enable = true;
+  my = {
+    fonts.enable = true;
+    stylix.enable = true;
+    users.enable = true;
+    yubikey = {
+      enable = true;
+      pam.enable = false;
+    };
+  };
+  networking.enable = true;
+  secrets.enable = true;
+  ssh.enable = true;
+  storage.enable = true;
+  taskwarrior.enable = true;
 
+  secrets.nixSigningKey.enable = true;
   restic-backup.enable = true;
   tailscale.enable = true;
+  desktop.ly.enable = true;
   docker.enable = true;
   nfc.enable = true;
-  desktop.ly.enable = true;
+
-  audio.automation.enable = true;
+  firewall = {
+    enable = true;
+    allowedTCPPorts = [ 22 ];
+  };
 
   hardware = {
     cpu.intel.updateMicrocode = true;
@@ -66,6 +67,7 @@ in
       extraPackages = with pkgs; [
         intel-media-driver
         vpl-gpu-rt
+        intel-compute-runtime
       ];
     };
   };
@@ -81,7 +83,7 @@ in
       name = "wol-andromache";
       runtimeInputs = [ pkgs.wakeonlan ];
       text = ''
-        wakeonlan ${wolInterfaces.eno1.macAddress}
+        wakeonlan ${(import ../andromache/wol-interfaces.nix).eno1.macAddress}
       '';
     })
   ];
@@ -90,18 +92,8 @@ in
     hostId = "80eef97e";
   };
 
-  firewall = {
-    enable = true;
-    allowedTCPPorts = [ 22 ];
-  };
-
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 
-  my.yubikey = {
-    enable = true;
-    pam.enable = false;
-  };
-
   services = {
     fwupd.enable = true;
     locate = {

hosts/eetion-02/default.nix

@@ -7,10 +7,11 @@
   imports = [
     ./hard.nix
     ./host.nix
-    ../../modules/common
+    ../../modules
-    ../../modules/ssh
   ];
 
+  ssh.enable = true;
+
   boot = {
     kernelParams = [
       "console=ttyS1,115200n8"

hosts/eetion/default.nix

@@ -7,12 +7,10 @@
   imports = [
     ./hard.nix
     ./host.nix
-    ../../modules/common
+    ../../modules
-    ../../modules/ssh
-    ../../modules/tailscale
-    # ../../modules/uptime-kuma
   ];
 
+  ssh.enable = true;
   tailscale.enable = true;
 
   boot.loader = {

hosts/hecuba/default.nix

@@ -12,14 +12,14 @@
     inputs.disko.nixosModules.disko
     ./hard.nix
     ./host.nix
-    ../../modules/common
+    ../../modules
-    ../../modules/ssh
-    ../../modules/docker
   ];
 
-  networking.hostName = config.host.name;
+  ssh.enable = true;
   docker.enable = true;
 
+  networking.hostName = config.host.name;
+
   fileSystems."/" = {
     device = "/dev/disk/by-label/nixos";
     fsType = "ext4";

hosts/vm/default.nix

@@ -9,27 +9,30 @@
     ./hard.nix
     ./host.nix
     ./disk.nix
-    ../../modules/common
+    ../../modules
-    ../../modules/anki
-    ../../modules/audio
-    ../../modules/boot/bootloader.nix
-    ../../modules/fonts
-    ../../modules/git
-    ../../modules/keyboard
-    ../../modules/localization
-    ../../modules/networking
-    ../../modules/ai-tools
-    ../../modules/ssh
-    ../../modules/storage
-    ../../modules/stylix
-    ../../modules/secrets
-    ../../modules/taskwarrior
-    ../../modules/users
-    ../../modules/x
   ];
 
   home-manager.users.${config.host.username} = import ../../home/hosts/vm;
 
+  "ai-tools".enable = true;
+  anki.enable = true;
+  audio.enable = true;
+  bootloader.enable = true;
+  desktop.x.enable = true;
+  git.enable = true;
+  keyboard.enable = true;
+  localization.enable = true;
+  my = {
+    fonts.enable = true;
+    stylix.enable = true;
+    users.enable = true;
+  };
+  networking.enable = true;
+  secrets.enable = true;
+  ssh.enable = true;
+  storage.enable = true;
+  taskwarrior.enable = true;
+
   disko = {
     devices.disk.main = {
       device = "/dev/vda";

images/sd-image-orange-pi-aarch64.nix

@@ -37,5 +37,6 @@ in
 
   security.sudo.wheelNeedsPassword = false;
 
+  boot.zfs.forceImportRoot = false;
   system.stateVersion = "26.05";
 }

images/sd-image-raspberry-pi-aarch64.nix

@@ -21,13 +21,11 @@ in
     name = "raspberry-pi";
   };
 
-  boot.kernelParams = [
+  boot = {
-    "console=ttyS1,115200n8"
+    kernelParams = [ "console=ttyS1,115200n8" ];
-  ];
+    kernelModules = [ "bcm2835-v4l2" ];
-
+    zfs.forceImportRoot = false;
-  boot.kernelModules = [
+  };
-    "bcm2835-v4l2"
-  ];
 
   hardware.enableRedistributableFirmware = true;
 

modules/ai-tools/default.nix

@@ -1,11 +1,14 @@
-{ config, ... }:
+{ lib, config, ... }:
 
 let
+  cfg = config."ai-tools";
   inherit (config.host) username;
   inherit (config.secrets) owner;
 in
 {
-  config = {
+  options."ai-tools".enable = lib.mkEnableOption "AI tools";
+
+  config = lib.mkIf cfg.enable {
     nixpkgs.allowedUnfree = [ "claude-code" ];
     secrets.groups.opencode = [ "api-key" ];
 

modules/anki/default.nix

@@ -1,6 +1,15 @@
+{ lib, config, ... }:
+
+let
+  cfg = config.anki;
+in
 {
-  config.secrets.groups.anki = [
+  options.anki.enable = lib.mkEnableOption "anki";
-    "sync-user"
+
-    "sync-key"
+  config = lib.mkIf cfg.enable {
-  ];
+    secrets.groups.anki = [
+      "sync-user"
+      "sync-key"
+    ];
+  };
 }

modules/audio/default.nix

@@ -1,17 +1,21 @@
-{ ... }:
+{ lib, config, ... }:
 
+let
+  cfg = config.audio;
+in
 {
-  imports = [
+  imports = [ ./audio-automation.nix ];
-    ./audio-automation.nix
-  ];
 
-  config = {
+  options.audio.enable = lib.mkEnableOption "audio";
+
+  config = lib.mkIf cfg.enable {
     nixpkgs.allowedUnfree = [
       "spotify"
       "spotify-unwrapped"
     ];
 
     security.rtkit.enable = true;
+
     services = {
       pulseaudio.enable = false;
       pipewire = {

modules/bluetooth/default.nix

@@ -1,14 +1,23 @@
+{ lib, config, ... }:
+
+let
+  cfg = config.bluetooth;
+in
 {
-  hardware.bluetooth = {
+  options.bluetooth.enable = lib.mkEnableOption "bluetooth";
-    enable = true;
+
-    powerOnBoot = true;
+  config = lib.mkIf cfg.enable {
-    settings = {
+    hardware.bluetooth = {
-      General = {
+      enable = true;
-        Experimental = true;
+      powerOnBoot = true;
-        FastConnectable = true;
+      settings = {
-      };
+        General = {
-      Policy = {
+          Experimental = true;
-        AutoEnable = true;
+          FastConnectable = true;
+        };
+        Policy = {
+          AutoEnable = true;
+        };
       };
     };
   };

modules/boot/default.nix

@@ -0,0 +1,18 @@
+{ lib, config, ... }:
+
+let
+  cfg = config.bootloader;
+in
+{
+  options.bootloader.enable = lib.mkEnableOption "system bootloader";
+
+  config = lib.mkIf cfg.enable {
+    boot = {
+      loader = {
+        systemd-boot.enable = true;
+        efi.canTouchEfiVariables = true;
+      };
+      tmp.useTmpfs = config.host.highRam;
+    };
+  };
+}

modules/common/default.nix

@@ -23,6 +23,7 @@ in
 
   config = {
     system.stateVersion = lib.mkDefault "25.05";
+    boot.zfs.forceImportRoot = lib.mkDefault false;
 
     nix = {
       nixPath = [ "nixpkgs=${inputs.nixpkgs}" ]; # https://github.com/nix-community/nixd/blob/main/nixd/docs/configuration.md
@@ -61,6 +62,10 @@ in
       pkg: builtins.elem (lib.getName pkg) config.nixpkgs.allowedUnfree;
 
     environment.defaultPackages = lib.mkForce [ ];
+    environment.pathsToLink = [
+      "/share/applications"
+      "/share/xdg-desktop-portal"
+    ];
 
     home-manager = {
       useGlobalPkgs = true;

modules/default.nix

@@ -0,0 +1,10 @@
+{ lib, ... }:
+
+{
+  imports =
+    let
+      dirs = lib.attrNames (lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./.));
+      hasDef = name: builtins.pathExists ./${name}/default.nix;
+    in
+    map (name: ./${name}) (builtins.filter hasDef dirs);
+}

modules/desktops/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+
+{
+  imports = [
+    ./gnome
+    ./niri
+  ];
+}

modules/desktops/gnome/default.nix

@@ -1,9 +1,13 @@
-{
+{ lib, config, ... }:
-  services.xserver = {
-    displayManager.gdm.enable = true;
-    displayManager.gdm.wayland = true;
-    desktopManager.gnome.enable = true;
-  };
 
-  # TODO: Declare monitors.xml
+{
+  options.desktop.gnome.enable = lib.mkEnableOption "GNOME desktop";
+
+  config = lib.mkIf config.desktop.gnome.enable {
+    services.xserver = {
+      displayManager.gdm.enable = true;
+      displayManager.gdm.wayland = true;
+      desktopManager.gnome.enable = true;
+    };
+  };
 }

modules/desktops/logind.nix

@@ -1,7 +1,13 @@
+{ lib, config, ... }:
+
 {
-  services.logind.settings.Login = {
+  options.desktop.logind.enable = lib.mkEnableOption "logind desktop settings";
-    HandleLidSwitch = "suspend";
+
-    IdleAction = "suspend";
+  config = lib.mkIf config.desktop.logind.enable {
-    IdleActionSec = 1800;
+    services.logind.settings.Login = {
+      HandleLidSwitch = "suspend";
+      IdleAction = "suspend";
+      IdleActionSec = 1800;
+    };
   };
 }

modules/desktops/niri/default.nix

@@ -12,6 +12,9 @@ in
   imports = [ ../logind.nix ];
 
   options.desktop = {
+    niri = {
+      enable = lib.mkEnableOption "niri desktop";
+    };
     ly = {
       enable = lib.mkOption {
         type = lib.types.bool;
@@ -20,7 +23,8 @@ in
     };
   };
 
-  config = {
+  config = lib.mkIf cfg.niri.enable {
+    desktop.logind.enable = lib.mkDefault true;
     programs.niri = {
       enable = true;
       useNautilus = false;
@@ -44,15 +48,6 @@ in
       ];
     };
 
-    #  error:
-    #  Failed assertions:
-    #  - h profile: xdg.portal: since you installed Home Manager via its NixOS module and
-    #  'home-manager.useUserPackages' is enabled, you need to add
-    #
-    #  environment.pathsToLink = [ `/share/applications` `/share/xdg-desktop-portal` ];
-    #
-    #  to your NixOS configuration so that the portal definitions and DE
-    #  provided configurations get linked.
     environment.pathsToLink = [
       "/share/applications"
       "/share/xdg-desktop-portal"

modules/fonts/default.nix

@@ -1,17 +1,26 @@
-{ pkgs, ... }:
-
 {
-  imports = [
+  lib,
-    ./iosevka.nix
+  config,
-  ];
+  pkgs,
+  ...
+}:
 
-  fonts = {
+let
-    # disable default font packages (see https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/config/fonts/packages.nix)
+  cfg = config.my.fonts;
-    enableDefaultPackages = false;
+in
-    packages = with pkgs; [
+{
-      dejavu_fonts
+  imports = [ ./iosevka.nix ];
-      liberation_ttf
+
-      noto-fonts-color-emoji
+  options.my.fonts.enable = lib.mkEnableOption "fonts";
-    ];
+
+  config = lib.mkIf cfg.enable {
+    fonts = {
+      enableDefaultPackages = false;
+      packages = with pkgs; [
+        dejavu_fonts
+        liberation_ttf
+        noto-fonts-color-emoji
+      ];
+    };
   };
 }

modules/fonts/iosevka.nix

@@ -1,13 +1,20 @@
-{ pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 
 {
-  fonts = {
+  config = lib.mkIf config.my.fonts.enable {
-    packages = with pkgs; [
+    fonts = {
-      (iosevka-bin.override { variant = "SGr-IosevkaTermSS08"; })
+      packages = with pkgs; [
-    ];
+        (iosevka-bin.override { variant = "SGr-IosevkaTermSS08"; })
-    fontconfig = {
+      ];
-      defaultFonts = {
+      fontconfig = {
-        monospace = [ "Iosevka Term SS08" ];
+        defaultFonts = {
+          monospace = [ "Iosevka Term SS08" ];
+        };
       };
     };
   };

modules/gaming/default.nix

@@ -1,50 +1,56 @@
 {
-  config,
   lib,
+  config,
   pkgs,
   ...
 }:
 
+let
+  cfg = config.gaming;
+in
 {
-  nixpkgs.allowedUnfree = [
+  options.gaming.enable = lib.mkEnableOption "gaming";
-    "steam"
-    "steam-unwrapped"
-    "lutris"
-  ];
 
-  hardware.graphics = {
+  config = lib.mkIf cfg.enable {
-    enable32Bit = true;
+    nixpkgs.allowedUnfree = [
-    extraPackages = with pkgs; [
+      "steam"
-      dxvk
+      "steam-unwrapped"
-      vkd3d-proton
+      "lutris"
+    ];
+
+    hardware.graphics = {
+      enable32Bit = true;
+      extraPackages = with pkgs; [
+        dxvk
+        vkd3d-proton
+      ];
+    };
+
+    programs.steam = {
+      enable = true;
+      remotePlay.openFirewall = false;
+      dedicatedServer.openFirewall = false;
+    };
+
+    programs.gamemode.enable = true;
+
+    environment.systemPackages = with pkgs; [
+      mangohud
+    ];
+
+    home-manager.users.${config.host.username} = {
+      xdg.configFile."lutris/system.yml".text = lib.generators.toJSON { } {
+        system.game_path = "/home/${config.host.username}/games";
+      };
+    };
+
+    security.pam.loginLimits = [
+      {
+        domain = config.host.username;
+        type = "hard";
+        item = "nofile";
+        value = "524288";
+      }
     ];
   };
-
-  programs.steam = {
-    enable = true;
-    remotePlay.openFirewall = false;
-    dedicatedServer.openFirewall = false;
-  };
-
-  programs.gamemode.enable = true;
-
-  environment.systemPackages = with pkgs; [
-    # lutris
-    mangohud
-  ];
-
-  home-manager.users.${config.host.username} = {
-    xdg.configFile."lutris/system.yml".text = lib.generators.toJSON { } {
-      system.game_path = "/home/${config.host.username}/games";
-    };
-  };
-
-  security.pam.loginLimits = [
-    {
-      domain = config.host.username;
-      type = "hard";
-      item = "nofile";
-      value = "524288";
-    }
-  ];
 }

modules/git/default.nix

@@ -1,29 +1,31 @@
-{
+{ lib, config, ... }:
-  config,
-  ...
-}:
 
 let
+  cfg = config.git;
   inherit (config.host) username;
   owner = config.users.users.${username}.name;
 in
 {
-  config.sops.templates = {
+  options.git.enable = lib.mkEnableOption "git";
-    ".gitconfig.email" = {
+
-      inherit owner;
+  config = lib.mkIf cfg.enable {
-      path = "/home/${username}/.gitconfig.email";
+    sops.templates = {
-      content = ''
+      ".gitconfig.email" = {
-        [user]
+        inherit owner;
-          email = ${config.sops.placeholder."email/personal"}
+        path = "/home/${username}/.gitconfig.email";
-      '';
+        content = ''
-    };
+          [user]
-    ".gitconfig.work.email" = {
+            email = ${config.sops.placeholder."email/personal"}
-      inherit owner;
+        '';
-      path = "/home/${username}/.gitconfig.work.email";
+      };
-      content = ''
+      ".gitconfig.work.email" = {
-        [user]
+        inherit owner;
-          email = ${config.sops.placeholder."email/work"}
+        path = "/home/${username}/.gitconfig.work.email";
-      '';
+        content = ''
+          [user]
+            email = ${config.sops.placeholder."email/work"}
+        '';
+      };
     };
   };
 }

modules/k3s/default.nix

@@ -1,79 +1,56 @@
-{ pkgs, ... }:
-
 {
-  # TODO: see if this works with podman
+  lib,
-  # TODO: check if docker/podman is enabled
+  config,
+  pkgs,
+  ...
+}:
 
-  # Rootless K3S
+let
+  cfg = config.k3s;
+in
+{
+  options.k3s.enable = lib.mkEnableOption "k3s rootless";
 
-  # FIXME
+  config = lib.mkIf cfg.enable {
-  environment.systemPackages = with pkgs; [
+    environment.systemPackages = with pkgs; [
-    k3s
+      k3s
-    rootlesskit
+      rootlesskit
-    slirp4netns
+      slirp4netns
-  ];
-
-  # running K3S on rootless docker was causing the following error: "failed to find cpuset cgroup (v2)" (in `docker logs k3d-lab-server-0` output)
-  #
-  # see <https://docs.k3s.io/advanced#known-issues-with-rootless-mode>
-  # see <https://rootlesscontaine.rs/getting-started/common/cgroup2/>
-  # see <https://discourse.nixos.org/t/declarative-rootless-k3s/49839>
-  systemd.services."user@".serviceConfig.Delegate = "cpu cpuset io memory pids";
-
-  # taken from <https://github.com/k3s-io/k3s/blob/main/k3s-rootless.service> as described in <https://docs.k3s.io/advanced#known-issues-with-rootless-mode#Rootless>
-  systemd.user.services."k3s-rootless" = with pkgs; {
-    path = with pkgs; [
-      "${rootlesskit}"
-      "${slirp4netns}"
-      "${fuse-overlayfs}"
-      "${fuse3}"
-      "/run/wrappers"
     ];
-    # systemd unit file for k3s (rootless)
+
-    #
+    systemd.services."user@".serviceConfig.Delegate = "cpu cpuset io memory pids";
-    # Usage:
+
-    # - [Optional] Enable cgroup v2 delegation, see https://rootlesscontaine.rs/getting-started/common/cgroup2/ .
+    systemd.user.services."k3s-rootless" = {
-    #   This step is optional, but highly recommended for enabling CPU and memory resource limtitation.
+      path = with pkgs; [
-    #
+        "${rootlesskit}"
-    # - Copy this file as `~/.config/systemd/user/k3s-rootless.service`.
+        "${slirp4netns}"
-    #   Installing this file as a system-wide service (`/etc/systemd/...`) is not supported.
+        "${fuse-overlayfs}"
-    #   Depending on the path of `k3s` binary, you might need to modify the `ExecStart=/usr/local/bin/k3s ...` line of this file.
+        "${fuse3}"
-    #
+        "/run/wrappers"
-    # - Run `systemctl --user daemon-reload`
+      ];
-    #
+      enable = true;
-    # - Run `systemctl --user enable --now k3s-rootless`
+      description = "k3s (Rootless)";
-    #
+      serviceConfig = {
-    # - Run `KUBECONFIG=~/.kube/k3s.yaml kubectl get pods -A`, and make sure the pods are running.
+        ExecStart = "${pkgs.k3s}/bin/k3s server --rootless --snapshotter=fuse-overlayfs";
-    #
+        ExecReload = "/run/current-system/sw/bin/kill -s HUP $MAINPID";
-    # Troubleshooting:
+        TimeoutSec = 0;
-    # - See `systemctl --user status k3s-rootless` to check the daemon status
+        RestartSec = 2;
-    # - See `journalctl --user -f -u k3s-rootless` to see the daemon log
+        Restart = "always";
-    # - See also https://rootlesscontaine.rs/
+        StartLimitBurst = 3;
-    enable = true;
+        StartLimitInterval = "60s";
-    description = "k3s (Rootless)";
+        LimitNOFILE = "infinity";
-    serviceConfig = {
+        LimitNPROC = "infinity";
-      # NOTE: Don't try to run `k3s server --rootless` on a terminal, as it doesn't enable cgroup v2 delegation.
+        LimitCORE = "infinity";
-      # If you really need to try it on a terminal, prepend `systemd-run --user -p Delegate=yes --tty` to create a systemd scope.
+        TasksMax = "infinity";
-      ExecStart = "${k3s}/bin/k3s server --rootless --snapshotter=fuse-overlayfs";
+        Delegate = "yes";
-      ExecReload = "/run/current-system/sw/bin/kill -s HUP $MAINPID";
+        Type = "simple";
-      TimeoutSec = 0;
+        KillMode = "mixed";
-      RestartSec = 2;
+      };
-      Restart = "always";
+      wantedBy = [ "default.target" ];
-      StartLimitBurst = 3;
-      StartLimitInterval = "60s";
-      LimitNOFILE = "infinity";
-      LimitNPROC = "infinity";
-      LimitCORE = "infinity";
-      TasksMax = "infinity";
-      Delegate = "yes";
-      Type = "simple";
-      KillMode = "mixed";
     };
 
-    wantedBy = [ "default.target" ];
+    boot.kernel.sysctl = {
-  };
+      "net.ipv4.ip_forward" = 1;
-
+    };
-  boot.kernel.sysctl = {
-    "net.ipv4.ip_forward" = 1;
   };
 }

modules/keyboard/default.nix

@@ -1,19 +1,28 @@
-{ pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 
-with pkgs;
 let
-  tools = interception-tools;
+  cfg = config.keyboard;
-  inherit (interception-tools-plugins) caps2esc;
+  tools = pkgs.interception-tools;
+  inherit (pkgs.interception-tools-plugins) caps2esc;
 in
 {
-  services.interception-tools = {
+  options.keyboard.enable = lib.mkEnableOption "keyboard remapping";
-    enable = true;
+
-    plugins = [ caps2esc ];
+  config = lib.mkIf cfg.enable {
-    udevmonConfig = ''
+    services.interception-tools = {
-      - JOB: ${tools}/bin/intercept -g $DEVNODE | ${caps2esc}/bin/caps2esc -m 1 | ${tools}/bin/uinput -d $DEVNODE
+      enable = true;
-        DEVICE:
+      plugins = [ caps2esc ];
-          EVENTS:
+      udevmonConfig = ''
-            EV_KEY: [KEY_CAPSLOCK]
+        - JOB: ${tools}/bin/intercept -g $DEVNODE | ${caps2esc}/bin/caps2esc -m 1 | ${tools}/bin/uinput -d $DEVNODE
-    '';
+          DEVICE:
+            EVENTS:
+              EV_KEY: [KEY_CAPSLOCK]
+      '';
+    };
   };
 }

modules/localization/default.nix

@@ -1,6 +1,13 @@
-{ config, ... }:
+{ lib, config, ... }:
 
+let
+  cfg = config.localization;
+in
 {
-  time.timeZone = config.host.timezone;
+  options.localization.enable = lib.mkEnableOption "localization";
-  i18n.defaultLocale = config.host.locale;
+
+  config = lib.mkIf cfg.enable {
+    time.timeZone = config.host.timezone;
+    i18n.defaultLocale = config.host.locale;
+  };
 }

modules/networking/default.nix

@@ -1,11 +1,15 @@
-{ config, ... }:
+{ lib, config, ... }:
 
 {
-  networking = {
+  options.networking.enable = lib.mkEnableOption "network configuration";
-    hostName = config.host.name;
+
-    wireless.iwd.enable = true;
+  config = lib.mkIf config.networking.enable {
-    networkmanager.wifi.backend = "iwd";
+    networking = {
-    nftables.enable = true;
+      hostName = config.host.name;
-    firewall.enable = true;
+      wireless.iwd.enable = true;
+      networkmanager.wifi.backend = "iwd";
+      nftables.enable = true;
+      firewall.enable = true;
+    };
   };
 }

modules/nfc/default.nix

@@ -6,7 +6,7 @@ let
 in
 {
   options.nfc = {
-    enable = lib.mkEnableOption "NFC device access";
+    enable = lib.mkEnableOption "NFC";
   };
   config = lib.mkIf cfg.enable {
     users.users.${username}.extraGroups = [ "dialout" ];

modules/nvidia/default.nix

@@ -1,22 +1,26 @@
-{ config, ... }:
+{ lib, config, ... }:
 
 {
-  nixpkgs.allowedUnfree = [
+  options.nvidia.enable = lib.mkEnableOption "NVIDIA graphics";
-    "nvidia-x11"
-    "nvidia-persistenced"
-    "nvidia-settings"
-  ];
 
-  hardware.graphics.enable = true;
+  config = lib.mkIf config.nvidia.enable {
+    nixpkgs.allowedUnfree = [
+      "nvidia-x11"
+      "nvidia-persistenced"
+      "nvidia-settings"
+    ];
 
-  hardware.nvidia = {
+    hardware.graphics.enable = true;
-    modesetting.enable = true;
+
-    powerManagement.enable = true;
+    hardware.nvidia = {
-    powerManagement.finegrained = false;
+      modesetting.enable = true;
-    open = true;
+      powerManagement.enable = true;
-    nvidiaSettings = true;
+      powerManagement.finegrained = false;
-    package = config.boot.kernelPackages.nvidiaPackages.stable;
+      open = true;
+      nvidiaSettings = true;
+      package = config.boot.kernelPackages.nvidiaPackages.stable;
+    };
+
+    services.xserver.videoDrivers = [ "nvidia" ];
   };
-
-  services.xserver.videoDrivers = [ "nvidia" ];
 }

modules/printing/default.nix

@@ -1,15 +1,9 @@
-{
+{ lib, config, ... }:
-  # services.avahi = {
-  #   enable = true;
-  #   nssmdns4 = true;
-  #   openFirewall = true;
-  # };
 
-  services.printing = {
+{
-    enable = true;
+  options.printing.enable = lib.mkEnableOption "printing";
-    # drivers = with pkgs; [
+
-    #   cups-filters
+  config = lib.mkIf config.printing.enable {
-    #   cups-browsed
+    services.printing.enable = true;
-    # ];
   };
 }

modules/secrets/default.nix

@@ -18,6 +18,8 @@ in
 
   options = {
     secrets = {
+      enable = lib.mkEnableOption "secrets management";
+
       sopsDir = lib.mkOption {
         type = lib.types.str;
         default = "${toString inputs.nix-secrets}/secrets";
@@ -42,7 +44,7 @@ in
     };
   };
 
-  config = {
+  config = lib.mkIf cfg.enable {
     secrets = {
       inherit owner;
       groups = {
@@ -55,10 +57,6 @@ in
     };
 
     sops = {
-      # for yubikey, generate as follows:
-      # ```
-      # age-plugin-yubikey --identity > <keyfile-path>
-      # ```
       age.keyFile = "/home/${username}/.config/sops/age/keys.txt";
       secrets = myUtils.mkSopsSecrets sopsDir owner cfg.groups;
     };
@@ -68,7 +66,7 @@ in
     ];
 
     services = {
-      pcscd.enable = true; # needed for age-plugin-yubikey?
+      pcscd.enable = true;
       udev.packages = lib.mkIf cfg.yubikey.enable [
         pkgs.yubikey-personalization
         pkgs.libfido2

modules/ssh/authorized-keys.nix

@@ -16,16 +16,17 @@ in
     };
   };
 
-  # auto generate authorized_keys from `authorizedHosts`
+  config = lib.mkIf config.ssh.enable {
-  config.users.users.${username}.openssh.authorizedKeys.keys =
+    users.users.${username}.openssh.authorizedKeys.keys =
-    lib.flatten (
+      lib.flatten (
-      map (
+        map (
-        hostname:
+          hostname:
-        let
+          let
-          keyFile = ../../hosts/${hostname}/ssh_user.pub;
+            keyFile = ../../hosts/${hostname}/ssh_user.pub;
-        in
+          in
-        lib.optionals (builtins.pathExists keyFile) (lib.splitString "\n" (builtins.readFile keyFile))
+          lib.optionals (builtins.pathExists keyFile) (lib.splitString "\n" (builtins.readFile keyFile))
-      ) ((builtins.filter (h: h != config.host.name) adminHosts) ++ config.ssh.authorizedHosts)
+        ) ((builtins.filter (h: h != config.host.name) adminHosts) ++ config.ssh.authorizedHosts)
-    )
+      )
-    ++ lib.splitString "\n" (builtins.readFile ./ssh_bak.pub);
+      ++ lib.splitString "\n" (builtins.readFile ./ssh_bak.pub);
+  };
 }

modules/ssh/default.nix

@@ -1,10 +1,17 @@
-{ lib, ... }:
+{ lib, config, ... }:
 
+let
+  cfg = config.ssh;
+in
 {
   imports = [ ./hardened-openssh.nix ];
 
-  config.services.openssh = {
+  options.ssh.enable = lib.mkEnableOption "SSH server";
-    enable = lib.mkDefault true;
+
-    harden = lib.mkDefault true;
+  config = lib.mkIf cfg.enable {
+    services.openssh = {
+      enable = lib.mkDefault true;
+      harden = lib.mkDefault true;
+    };
   };
 }

modules/ssh/extract-keys.nix

@@ -1,32 +1,34 @@
 { lib, config, ... }:
+
 let
   inherit (config.host) username;
 in
 {
-  # auto extract SSH keys
+  config = lib.mkIf config.ssh.enable {
-  system.activationScripts.extractSshKeys = lib.stringAfter [ "etc" ] ''
+    system.activationScripts.extractSshKeys = lib.stringAfter [ "etc" ] ''
-    HOST_KEY="/etc/ssh/ssh_host_ed25519_key.pub"
+      HOST_KEY="/etc/ssh/ssh_host_ed25519_key.pub"
-    HOST_DIR="/home/${username}/nix/hosts/${config.networking.hostName}"
+      HOST_DIR="/home/${username}/nix/hosts/${config.networking.hostName}"
 
-    if [ -f "$HOST_KEY" ] && [ -d "$HOST_DIR" ]; then
+      if [ -f "$HOST_KEY" ] && [ -d "$HOST_DIR" ]; then
-      cp "$HOST_KEY" "$HOST_DIR/ssh_host.pub"
+        cp "$HOST_KEY" "$HOST_DIR/ssh_host.pub"
-      chown ${username}:users "$HOST_DIR/ssh_host.pub"
+        chown ${username}:users "$HOST_DIR/ssh_host.pub"
-      chmod 644 "$HOST_DIR/ssh_host.pub"
+        chmod 644 "$HOST_DIR/ssh_host.pub"
-    fi
-
-    USER_KEY=""
-    for candidate in \
-        "/home/${username}/.ssh/id_ed25519_sk.pub" \
-        "/home/${username}/.ssh/id_ed25519.pub"; do
-      if [ -f "$candidate" ]; then
-        USER_KEY="$candidate"
-        break
       fi
-    done
+
-    if [ -n "$USER_KEY" ] && [ -d "$HOST_DIR" ]; then
+      USER_KEY=""
-      cp "$USER_KEY" "$HOST_DIR/ssh_user.pub"
+      for candidate in \
-      chown ${username}:users "$HOST_DIR/ssh_user.pub"
+          "/home/${username}/.ssh/id_ed25519_sk.pub" \
-      chmod 644 "$HOST_DIR/ssh_user.pub"
+          "/home/${username}/.ssh/id_ed25519.pub"; do
-    fi
+        if [ -f "$candidate" ]; then
-  '';
+          USER_KEY="$candidate"
+          break
+        fi
+      done
+      if [ -n "$USER_KEY" ] && [ -d "$HOST_DIR" ]; then
+        cp "$USER_KEY" "$HOST_DIR/ssh_user.pub"
+        chown ${username}:users "$HOST_DIR/ssh_user.pub"
+        chmod 644 "$HOST_DIR/ssh_user.pub"
+      fi
+    '';
+  };
 }

modules/ssh/hardened-openssh.nix

@@ -1,5 +1,7 @@
 { lib, config, ... }:
+
 with lib;
+
 let
   cfg = config.services.openssh;
 in
@@ -13,7 +15,7 @@ in
   options.services.openssh.harden = mkEnableOption "harden ssh server configuration";
 
   config = {
-    networking.firewall.allowedTCPPorts = [ 22 ];
+    networking.firewall.allowedTCPPorts = lib.mkIf config.ssh.enable [ 22 ];
 
     services.openssh.settings = optionalAttrs cfg.harden {
       PermitRootLogin = "no";

modules/ssh/known-hosts.nix

@@ -4,6 +4,7 @@
   outputs,
   ...
 }:
+
 let
   hosts = lib.attrNames outputs.nixosConfigurations;
   hostsWithKeys = lib.filter (
@@ -11,9 +12,10 @@ let
   ) hosts;
 in
 {
-  # auto generate known_hosts for all hosts in flake
+  config = lib.mkIf config.ssh.enable {
-  programs.ssh.knownHosts = lib.genAttrs hostsWithKeys (hostname: {
+    programs.ssh.knownHosts = lib.genAttrs hostsWithKeys (hostname: {
-    publicKeyFile = ../../hosts/${hostname}/ssh_host.pub;
+      publicKeyFile = ../../hosts/${hostname}/ssh_host.pub;
-    extraHostNames = lib.optional (hostname == config.networking.hostName) "localhost";
+      extraHostNames = lib.optional (hostname == config.networking.hostName) "localhost";
-  });
+    });
+  };
 }

modules/storage/default.nix

@@ -1,4 +1,10 @@
+{ lib, config, ... }:
+
 {
-  services.udisks2.enable = true;
+  options.storage.enable = lib.mkEnableOption "storage";
-  boot.zfs.forceImportRoot = false;
+
+  config = lib.mkIf config.storage.enable {
+    services.udisks2.enable = true;
+    boot.zfs.forceImportRoot = false;
+  };
 }

modules/stylix/default.nix

@@ -1,36 +1,42 @@
 {
   config,
   inputs,
+  lib,
   pkgs,
   ...
 }:
 
 let
+  cfg = config.my.stylix;
   theme = import ./theme.nix { inherit pkgs; };
 in
 {
   imports = [ inputs.stylix.nixosModules.stylix ];
 
-  stylix = {
+  options.my.stylix.enable = lib.mkEnableOption "stylix theming";
-    enable = true;
-    inherit (theme)
-      polarity
-      base16Scheme
-      override
-      image
-      ;
-    fonts = {
-      monospace = theme.monospaceFont;
-      serif = config.stylix.fonts.monospace;
-      sansSerif = config.stylix.fonts.monospace;
-      emoji = config.stylix.fonts.monospace;
-    };
-    autoEnable = true;
-  };
 
-  home-manager.sharedModules = [
+  config = lib.mkIf cfg.enable {
-    {
+    stylix = {
-      stylix.targets = import ./targets.nix;
+      enable = true;
-    }
+      inherit (theme)
-  ];
+        polarity
+        base16Scheme
+        override
+        image
+        ;
+      fonts = {
+        monospace = theme.monospaceFont;
+        serif = config.stylix.fonts.monospace;
+        sansSerif = config.stylix.fonts.monospace;
+        emoji = config.stylix.fonts.monospace;
+      };
+      autoEnable = true;
+    };
+
+    home-manager.sharedModules = [
+      {
+        stylix.targets = import ./targets.nix;
+      }
+    ];
+  };
 }

modules/syncthing/default.nix

@@ -1,16 +1,13 @@
-{
+{ lib, config, ... }:
-  lib,
-  config,
-  ...
-}:
-
-with lib;
 
 let
+  cfg = config.syncthing;
   inherit (config.host) username;
 in
 {
-  config = {
+  options.syncthing.enable = lib.mkEnableOption "syncthing";
+
+  config = lib.mkIf cfg.enable {
     users.groups.${username} = { };
     users.users.${username}.extraGroups = [ username ];
 

modules/taskwarrior/default.nix

@@ -1,10 +1,13 @@
-{ config, ... }:
+{ lib, config, ... }:
 
 let
+  cfg = config.taskwarrior;
   inherit (config.secrets) owner;
 in
 {
-  config = {
+  options.taskwarrior.enable = lib.mkEnableOption "taskwarrior";
+
+  config = lib.mkIf cfg.enable {
     secrets.groups.taskwarrior = [
       "sync-server-url"
       "sync-server-client-id"

modules/uptime-kuma/default.nix

@@ -1,30 +1,36 @@
 {
+  lib,
+  config,
   pkgs,
   ...
 }:
 
 {
-  virtualisation.oci-containers = {
+  options."uptime-kuma".enable = lib.mkEnableOption "uptime-kuma";
-    backend = "docker";
+
-    containers.uptime-kuma = {
+  config = lib.mkIf config."uptime-kuma".enable {
-      image = "louislam/uptime-kuma:latest";
+    virtualisation.oci-containers = {
-      ports = [ "127.0.0.1:3001:3001" ];
+      backend = "docker";
-      volumes = [ "/var/lib/uptime-kuma:/app/data" ];
+      containers.uptime-kuma = {
-      environment = {
+        image = "louislam/uptime-kuma:latest";
-        TZ = "UTC";
+        ports = [ "127.0.0.1:3001:3001" ];
-        UMASK = "0022";
+        volumes = [ "/var/lib/uptime-kuma:/app/data" ];
+        environment = {
+          TZ = "UTC";
+          UMASK = "0022";
+        };
+        extraOptions = [
+          "--network=proxiable"
+        ];
       };
-      extraOptions = [
-        "--network=proxiable"
-      ];
     };
-  };
 
-  systemd.tmpfiles.settings."uptime-kuma" = {
+    systemd.tmpfiles.settings."uptime-kuma" = {
-    "/var/lib/uptime-kuma".d = {
+      "/var/lib/uptime-kuma".d = {
-      mode = "0755";
+        mode = "0755";
+      };
     };
-  };
 
-  environment.systemPackages = with pkgs; [ docker-compose ];
+    environment.systemPackages = with pkgs; [ docker-compose ];
+  };
 }

modules/users/default.nix

@@ -1,10 +1,18 @@
-{ config, ... }:
+{ lib, config, ... }:
 
 {
-  users.users.${config.host.username} = {
+  options.my.users.enable = lib.mkEnableOption "user account";
-    isNormalUser = true;
+
-    description = config.host.username;
+  config = lib.mkIf config.my.users.enable {
-    extraGroups = [ "wheel" ];
+    users.users.${config.host.username} = {
-    initialPassword = "h";
+      isNormalUser = true;
+      description = config.host.username;
+      extraGroups = [
+        "wheel"
+        "render"
+        "video"
+      ];
+      initialPassword = "h";
+    };
   };
 }

modules/x/default.nix

@@ -1,13 +1,19 @@
-{
+{ lib, config, ... }:
-  services.xserver.windowManager.xmonad = {
-    enable = true;
-    enableContribAndExtras = true;
-    config = builtins.readFile ../../dots/.xmonad/xmonad.hs;
-  };
 
-  services.xserver = {
+{
-    enable = true;
+  options.desktop.x.enable = lib.mkEnableOption "xmonad desktop";
-    xkb.layout = "us";
+
-    xkb.variant = "";
+  config = lib.mkIf config.desktop.x.enable {
+    services.xserver.windowManager.xmonad = {
+      enable = true;
+      enableContribAndExtras = true;
+      config = builtins.readFile ../../dots/.xmonad/xmonad.hs;
+    };
+
+    services.xserver = {
+      enable = true;
+      xkb.layout = "us";
+      xkb.variant = "";
+    };
   };
 }