fix(secrets): default to non-user secrets

README.md

@@ -1,5 +1,8 @@
 # ❄️ NixOS flake
 
+![nix](https://img.shields.io/badge/nix-blue?logo=nixos&logoColor=%234d6fb7&labelColor=%23fff&color=%234d6fb7&link=https%3A%2F%2Fnixos.org%2F)
+![neovim](https://img.shields.io/badge/neovim-flat?logo=neovim&logoColor=%23408040&labelColor=%23fff&color=%2380C040)
+
 ## hosts
 
 ### NixOS

deploy/colmena.nix

@@ -6,17 +6,26 @@
 let
   inherit (inputs.nixpkgs) lib;
   utils = import ../utils { inherit lib; };
-  hostDirNames = utils.dirNames ../hosts;
+  hostnames = utils.dirNames ../hosts;
 
-  mkNode = hostname: meta: {
-    imports = [ ../hosts/${hostname} ];
-    deployment = {
-      inherit (meta.deployment) targetHost targetUser tags;
-      buildOnTarget = builtins.any (t: t != "local" && t != "arm") meta.deployment.tags;
+  mkNode =
+    hostname:
+    let
+      meta = utils.hostMeta ../hosts/${hostname};
+      isLocal = builtins.elem "local" meta.tags;
+    in
+    {
+      imports = [ ../hosts/${hostname} ];
+      host.name = hostname;
+      deployment = {
+        inherit (meta) tags;
+        targetUser = meta.host.username;
+        targetHost = if isLocal then "" else hostname;
+        buildOnTarget = builtins.any (t: t != "local" && t != "arm") meta.tags;
+      };
     };
-  };
 
-  nodes = lib.genAttrs hostDirNames (hostname: mkNode hostname (utils.hostMeta ../hosts/${hostname}));
+  nodes = lib.genAttrs hostnames mkNode;
 in
 inputs.colmena.lib.makeHive (
   {

dots/.bashrc

@@ -60,7 +60,7 @@ export XDG_DATA_HOME=$HOME/.local/share
 if [ -f "/usr/bin/fzf" ]; then
   # Fuzzy finder setup
   export FZF_COMPLETION_TRIGGER='**'
-  export FZF_DEFAULT_COMMAND='ag -g ""'
+  export FZF_DEFAULT_COMMAND='rg --files ""'
   export FZF_DEFAULT_OPTS="
   --pointer='❭'
   --height 10%

dots/.bin/taskdeps

@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
 
 import argparse
 import json

dots/.config/nvim/after/plugin/image.nvim.lua

@@ -1,3 +1,5 @@
+if not vim.env.KITTY_WINDOW_ID then return end
+
 require("image").setup({
   backend = "kitty",
   kitty_method = "normal",

dots/.config/nvim/after/plugin/nvim-cmp.lua

@@ -64,7 +64,7 @@ cmp.setup({
   sources = {
     { name = "copilot",  group_index = 2 },
     { name = "zk" },
-    { name = "nvim_lsp", keyword_length = 8 },
+    { name = "nvim_lsp" },
     { name = "luasnip",  max_item_count = 16 },
     { name = "path" },
     { name = "buffer",   max_item_count = 8 },

dots/.config/nvim/after/plugin/nvim-ts-context-commentstring.lua

@@ -0,0 +1,8 @@
+require("ts_context_commentstring").setup({ enable_autocmd = false })
+
+-- https://github.com/JoosepAlviste/nvim-ts-context-commentstring/issues/109
+local get_option = vim.filetype.get_option
+vim.filetype.get_option = function(filetype, option)
+  return option == "commentstring" and require("ts_context_commentstring.internal").calculate_commentstring()
+    or get_option(filetype, option)
+end

dots/.config/nvim/after/plugin/treesitter.lua

@@ -123,7 +123,7 @@ treesitter.setup({
 })
 
 opt.foldmethod = "expr"
-opt.foldexpr = "nvim_treesitter#foldexpr()"
+opt.foldexpr = "v:lua.vim.treesitter.foldexpr()"
 opt.foldenable = false
 
 -- TreeSJ

dots/.config/nvim/flake.nix

@@ -174,6 +174,7 @@
               nvim-treesitter-textobjects
               # nvim-treesitter-context
               nvim-ts-context-commentstring
+              # theHamsta/crazy-node-movement
               treesj
               sniprun
               gitsigns-nvim

dots/.config/nvim/init.lua

@@ -8,11 +8,9 @@ require("cursor")
 require("fold")
 require("netrw")
 require("ftdetect")
-require("plug")
 require("pandoc")
 require("keymaps")
 require("highlight")
-require("paq-setup")
 require("statusline")
 require("diagnostic")
 require("utils")
@@ -20,4 +18,3 @@ require("zk")
 require("reload")
 
 vim.opt.background = "dark"
-vim.opt.laststatus = 3

dots/.config/nvim/lua/nixCatsUtils/catPacker.lua

@@ -1,53 +0,0 @@
--- Source: https://github.com/BirdeeHub/nixCats-nvim/blob/main/templates/example/lua/nixCatsUtils/catPacker.lua
---[[
-  This directory is the luaUtils template.
-  You can choose what things from it that you would like to use.
-  And then delete the rest.
-  Everything in this directory is optional.
---]]
-
-local M = {}
--- NOTE: This function is for defining a paq.nvim fallback method of downloading plugins
--- when nixCats was not used to install your config.
--- If you only ever load your config using nixCats, you don't need this file.
-
--- it literally just only runs it when not on nixCats
--- all neovim package managers that use the regular plugin loading scheme
--- can be used this way, just do whatever the plugin manager needs to put it in the
--- opt directory for lazy loading, and add the build steps so that when theres no nix the steps are ran
-function M.setup(v)
-  if not vim.g[ [[nixCats-special-rtp-entry-nixCats]] ] then
-    local function clone_paq()
-      local path = vim.fn.stdpath("data") .. "/site/pack/paqs/start/paq-nvim"
-      local is_installed = vim.fn.empty(vim.fn.glob(path)) == 0
-      if not is_installed then
-        vim.fn.system({ "git", "clone", "--depth=1", "https://github.com/savq/paq-nvim.git", path })
-        return true
-      end
-    end
-    local function bootstrap_paq(packages)
-      local first_install = clone_paq()
-      vim.cmd.packadd("paq-nvim")
-      local paq = require("paq")
-      if first_install then
-        vim.notify("Installing plugins... If prompted, hit Enter to continue.")
-      end
-      paq(packages)
-      paq.install()
-    end
-
-    vim.api.nvim_create_autocmd("VimEnter", {
-      once = true,
-      callback = function()
-        local pkgs_count = #require("paq").query("to_install")
-        if pkgs_count < 1 then
-          return
-        end
-        vim.notify(string.format("There are %d to install", pkgs_count))
-      end,
-    })
-
-    bootstrap_paq(vim.list_extend({ "savq/paq-nvim" }, v))
-  end
-end
-return M

dots/.config/nvim/lua/paq-setup.lua

@@ -1,47 +0,0 @@
-require("nixCatsUtils.catPacker").setup({
-  { "savq/paq-nvim" },
-  { "jinh0/eyeliner.nvim" },
-  { "ibhagwan/fzf-lua" },
-  { "barreiroleo/ltex_extra.nvim" },
-  { "neovim/nvim-lspconfig" },
-  { "https://git.sr.ht/~whynothugo/lsp_lines.nvim" },
-  { "linrongbin16/lsp-progress.nvim" },
-  { "folke/neodev.nvim" }, -- Nvim
-  { "b0o/schemastore.nvim" }, -- JSON Schemas
-  { "mfussenegger/nvim-lint" },
-  { "stevearc/conform.nvim" },
-  { "L3MON4D3/LuaSnip" },
-  { "saadparwaiz1/cmp_luasnip" },
-  { "hrsh7th/nvim-cmp" },
-  { "hrsh7th/cmp-nvim-lsp" },
-  { "hrsh7th/cmp-buffer" },
-  { "hrsh7th/cmp-path" },
-  { "nvim-lua/plenary.nvim" },
-  { "MunifTanjim/nui.nvim" },
-  { "folke/trouble.nvim" },
-  { "rktjmp/shipwright.nvim" }, -- For building themes based on lush (e.g. terminal)
-  { "rktjmp/lush.nvim" },
-  { "mcchrish/zenbones.nvim" }, -- Zenbones themes (contains zenwritten)
-  { "theHamsta/crazy-node-movement" },
-  { "nvim-treesitter/nvim-treesitter", build = ":TSUpdate" },
-  { "nvim-treesitter/nvim-treesitter-textobjects" },
-  -- { "nvim-treesitter/nvim-treesitter-context" },
-  { "JoosepAlviste/nvim-ts-context-commentstring" }, -- commentstring based on cursor position (e.g. for Svelte)
-  { "Wansmer/treesj" },
-  { "michaelb/sniprun", build = "sh install.sh" },
-  { "lewis6991/gitsigns.nvim" },
-  { "brenoprata10/nvim-highlight-colors" },
-  { "razak17/tailwind-fold.nvim" },
-  { "rmagatti/auto-session" },
-  { "kndndrj/nvim-dbee" },
-  { "3rd/image.nvim", build = false },
-  { "polarmutex/beancount.nvim" },
-  { "jamesblckwell/nvimkit.nvim" },
-  { 'olimorris/codecompanion.nvim' },
-  { "ravitemer/mcphub.nvim",                       build = "pnpm install -g mcp-hub@latest" },
-  { "zbirenbaum/copilot.lua" },
-  { "zbirenbaum/copilot-cmp" },
-  { "qvalentin/helm-ls.nvim", ft = "helm" },
-  { "mikesmithgh/kitty-scrollback.nvim" },
-  { "greggh/claude-code.nvim" },
-})

dots/.config/nvim/lua/plug.lua

@@ -1,35 +0,0 @@
-if not vim.g[ [[nixCats-special-rtp-entry-nixCats]] ] then
-  local vim = vim
-  local Plug = vim.fn["plug#"]
-
-  vim.call("plug#begin")
-
-  Plug("machakann/vim-sandwich")
-  Plug("Shougo/context_filetype.vim")
-  Plug("editorconfig/editorconfig-vim")
-  Plug("honza/vim-snippets")
-  Plug("chrisbra/unicode.vim")
-  Plug("ap/vim-css-color")
-  -- Jupyter
-  Plug("quarto-dev/quarto-vim")
-  -- LaTeX
-  Plug("lervag/vimtex")
-  -- Wiki
-  Plug("lervag/wiki.vim")
-  -- Markdown
-  Plug("vim-pandoc/vim-pandoc")
-  Plug("vim-pandoc/vim-pandoc-syntax")
-  Plug("ferrine/md-img-paste.vim")
-  -- TidalCycles
-  Plug("supercollider/scvim")
-  Plug("tidalcycles/vim-tidal")
-  -- GLSL
-  Plug("tikhomirov/vim-glsl")
-  Plug("timtro/glslView-nvim")
-  -- Jupyter notebooks
-  Plug("goerz/jupytext.vim")
-  -- OpenSCAD
-  Plug("sirtaj/vim-openscad")
-
-  vim.call("plug#end")
-end

dots/.config/nvim/lua/statusline.lua

@@ -1,5 +1,6 @@
+vim.opt.laststatus = 3
+
 vim.cmd([[
-se ls=2
 se stl=\ %0*%n
 se stl+=\ %m
 se stl+=\ %y%0*

dots/.config/task/taskrc

@@ -9,5 +9,5 @@ search.case.sensitive=no
 
 rc.json.array=on
 rc.verbose=nothing
-news.version=3.1.0
+news.version=3.4.2
 

dots/.config/tmux/tmux.conf

@@ -76,3 +76,5 @@ if-shell '\( #{$TMUX_VERSION_MAJOR} -eq 2 -a #{$TMUX_VERSION_MINOR} -lt 4\) -o #
 if-shell '\( #{$TMUX_VERSION_MAJOR} -eq 2 -a #{$TMUX_VERSION_MINOR} -lt 2\) -o #{$TMUX_VERSION_MAJOR} -le 1' 'set-option -g status-utf8 on'
 
 set -g allow-passthrough on
+set -s extended-keys on
+set -as terminal-features 'xterm*:extkeys'

dots/.zotero/bbt.json

@@ -1,11 +1,11 @@
 {
   "config": {
+    "options": {},
     "preferences": {
       "ascii": "",
       "asciiBibLaTeX": false,
       "asciiBibTeX": true,
       "autoAbbrev": false,
-      "autoAbbrevStyle": "",
       "autoExport": "immediate",
       "autoExportDelay": 5,
       "autoExportIdleWait": 10,
@@ -13,18 +13,22 @@
       "autoExportPathReplaceDirSep": "-",
       "autoExportPathReplaceSpace": " ",
       "automaticTags": true,
-      "autoPinDelay": 0,
       "auxImport": false,
       "baseAttachmentPath": "/home/h/doc/books",
       "biblatexExtendedDateFormat": true,
       "biblatexExtendedNameFormat": true,
       "biblatexExtractEprint": true,
+      "biblatexUsePrefix": true,
+      "bibtexEditionOrdinal": false,
       "bibtexParticleNoOp": false,
       "bibtexURL": "off",
       "cache": true,
-      "cacheFlushInterval": 5,
+      "cacheDelete": false,
       "charmap": "",
+      "chinese": false,
+      "chineseSplitName": true,
       "citeCommand": "cite",
+      "citekeyCaseInsensitive": true,
       "citekeyFold": true,
       "citekeyFormat": "zotero.clean",
       "citekeyFormatEditing": "zotero.clean",
@@ -34,32 +38,35 @@
       "DOIandURL": "both",
       "exportBibTeXStrings": "off",
       "exportBraceProtection": true,
+      "exportSort": "citekey",
       "exportTitleCase": true,
       "extraMergeCitekeys": false,
       "extraMergeCSL": false,
       "extraMergeTeX": false,
+      "fillKeyAfter": 1,
       "git": "config",
       "import": true,
       "importBibTeXStrings": true,
       "importCaseProtection": "as-needed",
       "importCitationKey": true,
+      "importDetectURLs": true,
       "importExtra": true,
       "importJabRefAbbreviations": true,
       "importJabRefStrings": true,
       "importNoteToExtra": "",
+      "importPlaceEvent": "inproceedings,conference,presentation,talk",
       "importSentenceCase": "on+guess",
+      "importSentenceCaseQuoted": true,
       "importUnknownTexCommand": "ignore",
       "itemObserverDelay": 5,
       "jabrefFormat": 0,
-      "jieba": false,
-      "keyConflictPolicy": "keep",
+      "japanese": false,
       "keyScope": "global",
-      "kuroshiro": false,
       "language": "langid",
       "logEvents": false,
       "mapMath": "",
       "mapText": "",
-      "mapUnicode": "conservative",
+      "packages": "",
       "parseParticles": true,
       "patchDates": "dateadded=dateAdded, date-added=dateAdded, datemodified=dateModified, date-modified=dateModified",
       "platform": "lin",
@@ -75,7 +82,8 @@
       "rawImports": false,
       "rawLaTag": "#LaTeX",
       "relativeFilePaths": false,
-      "retainCache": false,
+      "remigrate": false,
+      "resetKeyOnChange": false,
       "scrubDatabase": false,
       "separatorList": "and",
       "separatorNames": "and",
@@ -90,5 +98,4 @@
       "warnTitleCased": false
     }
   }
-}
-
+}

flake.lock

@@ -92,6 +92,28 @@
         "type": "github"
       }
     },
+    "comin": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "treefmt-nix": "treefmt-nix"
+      },
+      "locked": {
+        "lastModified": 1780200954,
+        "narHash": "sha256-3476T026t+XSpOvgBGzKSG6J4swuRLnPO9dR+OATtq8=",
+        "owner": "nlewo",
+        "repo": "comin",
+        "rev": "4f14d338d755239c27131cbf6b466be4bbb20f91",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nlewo",
+        "repo": "comin",
+        "type": "github"
+      }
+    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -121,11 +143,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1778904158,
-        "narHash": "sha256-xZ/zdpu9X8OI1jGqd4z6W1hKa+DQh8A9k3TH6w9tNbo=",
+        "lastModified": 1780200155,
+        "narHash": "sha256-cKpqEvRqxnCbp/2ZVczMHws31Qh4D/HTEuanWuJmySk=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "c31bafebd7e30517ead27149ad790802b998e98f",
+        "rev": "d29c0c2692ced897777eca19c9bab1b34be0e0d6",
         "type": "gitlab"
       },
       "original": {
@@ -138,11 +160,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1776136500,
-        "narHash": "sha256-r0gN2brVWA351zwMV0Flmlcd6SGMvYqFbvC3DfKFM8Y=",
+        "lastModified": 1779670703,
+        "narHash": "sha256-UdfMivNMwCCqQsYDg5pSz8X2IOaOrIZLIIy+Bg3CO2o=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "0f8ba203d475587f477e7ae12661bd8459e225b7",
+        "rev": "942159e73e40bf785816f7f1f5feed9ef3d7c8f9",
         "type": "github"
       },
       "original": {
@@ -168,6 +190,22 @@
       }
     },
     "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1765121682,
+        "narHash": "sha256-4VBOP18BFeiPkyhy9o4ssBNQEvfvv1kXkasAYd0+rrA=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "65f23138d8d09a92e30f1e5c87611b23ef451bf3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_3": {
       "flake": false,
       "locked": {
         "lastModified": 1767039857,
@@ -213,11 +251,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "lastModified": 1778716662,
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
         "type": "github"
       },
       "original": {
@@ -277,7 +315,7 @@
     },
     "git-hooks": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
         "gitignore": "gitignore",
         "nixpkgs": [
           "nixpkgs"
@@ -342,11 +380,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778921576,
-        "narHash": "sha256-jgIbBcGgKTtkp+lBas29hNFUU1t5O/2+GFvUjbiG0vM=",
+        "lastModified": 1780099287,
+        "narHash": "sha256-efIPwVGtIWIjWcznhaop6XN6HxnOL8800hF6CBNvlqQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "32b42d71b4b22c4465963285bb6e462d7c93d45e",
+        "rev": "7d8127d308c3fb9664f7e643eec944be74ebb37d",
         "type": "github"
       },
       "original": {
@@ -358,7 +396,7 @@
     "mcp-hub": {
       "inputs": {
         "flake-parts": "flake-parts",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs_4"
       },
       "locked": {
         "lastModified": 1755841689,
@@ -398,10 +436,10 @@
     "nix-secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1776723456,
-        "narHash": "sha256-GBbbm05oXYqSZ2EgxQPsNpTKl16wNhvrlUxdmv0FbSU=",
+        "lastModified": 1778944969,
+        "narHash": "sha256-wT4WiBUqfeajcaOWvSKmHGKXEGmnDVQsRg0v7NoZW5o=",
         "ref": "main",
-        "rev": "135b681d24af6ee4508bbf7c657982d7be8743d4",
+        "rev": "aae027d8de9ae66ea29c9e6a5ff6ea0f4b735261",
         "shallow": true,
         "type": "git",
         "url": "ssh://git@github.com/hektor/nix-secrets"
@@ -450,12 +488,15 @@
       }
     },
     "nixos-hardware": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
       "locked": {
-        "lastModified": 1778924461,
-        "narHash": "sha256-pDGhSCz+QxjHzP9gqYpK59k4Z1ZpVyYjzBgoXLFXh9s=",
+        "lastModified": 1780065812,
+        "narHash": "sha256-SCSLUKBmwlSLGQ8Xbr8PjRFtiHNk0l9ktqkcmqdBkfE=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "65a5c8f9c19d5f9d1b06d8942b04d790414ccfdd",
+        "rev": "b76b5639c0593e0aeb0b5879ad62d4b30596c144",
         "type": "github"
       },
       "original": {
@@ -467,11 +508,40 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1778443072,
-        "narHash": "sha256-zi7/fsqM/kFdNuED//4WOCUtezGtKKqRNORjMvfwjnA=",
+        "lastModified": 1770107345,
+        "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "da5ad661ba4e5ef59ba743f0d112cbc30e474f32",
+        "rev": "4533d9293756b63904b7238acb84ac8fe4c8c2c4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1767892417,
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1779560665,
+        "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
         "type": "github"
       },
       "original": {
@@ -481,7 +551,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_2": {
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1743689281,
         "narHash": "sha256-y7Hg5lwWhEOgflEHRfzSH96BOt26LaYfrYWzZ+VoVdg=",
@@ -509,11 +579,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777598946,
-        "narHash": "sha256-X239dAGaU1+gfDj8jKH8GzlqKMcxaVfXOio+uzBOkeE=",
+        "lastModified": 1779766384,
+        "narHash": "sha256-P7Ohnlq8b8b2fU+Sgkrej7LBTM60LBTkHleLuYzmLmU=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "5d55af01c0f86be583931fe99207fc56c14134b3",
+        "rev": "57800b7ab648725ccd33551d01484ee14952ad3f",
         "type": "github"
       },
       "original": {
@@ -645,6 +715,7 @@
     "root": {
       "inputs": {
         "colmena": "colmena",
+        "comin": "comin",
         "disko": "disko",
         "firefox-addons": "firefox-addons",
         "git-hooks": "git-hooks",
@@ -652,7 +723,7 @@
         "nix-secrets": "nix-secrets",
         "nixgl": "nixgl",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_3",
         "nvim": "nvim",
         "sops-nix": "sops-nix",
         "stylix": "stylix"
@@ -714,11 +785,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1778776709,
-        "narHash": "sha256-YhnEcpiY6+l3RFA+cPmdTaeODGvNRuqE8B7VBjPVIxo=",
+        "lastModified": 1780079634,
+        "narHash": "sha256-VVyCrzwLitvxZGx48FgzvlbLYGQU99GsaQnZmwqZoUo=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "e8ea85b4f7dddda9603e0f1ac86cd92cee3b2819",
+        "rev": "ca07e0644716a7c13e91c6d92d169fc81889c589",
         "type": "github"
       },
       "original": {
@@ -776,11 +847,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1777041405,
-        "narHash": "sha256-BAGZ7ObFV/9Z61OJZun7ifPyhkuHqNuW1QIhQ8LuzCo=",
+        "lastModified": 1777806186,
+        "narHash": "sha256-PDF0/wObw4nIsSBeXVYLsloXOiphXCgIdsrNcVXguKs=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "5f868b3a338b6904c47f3833b9c411be641983a8",
+        "rev": "0c94645546f4f3ddac77a1a5fce54eb95bf50795",
         "type": "github"
       },
       "original": {
@@ -792,11 +863,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1777169200,
-        "narHash": "sha256-h7dDbIzP5hDr9v97w9PL6jdAgXawmj6krcH+959rqpU=",
+        "lastModified": 1778379944,
+        "narHash": "sha256-wPDFzMGSlARlw0Sfsn48Q2+jPSfk6N0Ng6BC/d+7Q24=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "f798c2dce44ef815bb6b8f05a82135c7942d35ac",
+        "rev": "fe0203a198690e71a5ff11e08812a4673de3678d",
         "type": "github"
       },
       "original": {
@@ -808,11 +879,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1777463218,
-        "narHash": "sha256-Bhkozqtq3BKLqWTlmKm8uAptfX4aRGI8QX3eEL54Vpc=",
+        "lastModified": 1778378178,
+        "narHash": "sha256-OXPXRIQgGwV77HjYRryOHguh4ALX96jkg+tseLkGgHA=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "5768d08ed2e7944a26a958868cdb073cb8856dae",
+        "rev": "9cd816033ff969415b190722cddf134e78a5665f",
         "type": "github"
       },
       "original": {
@@ -820,6 +891,24 @@
         "repo": "base16-zed",
         "type": "github"
       }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1770228511,
+        "narHash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "337a4fe074be1042a35086f15481d763b8ddc0e7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -3,10 +3,6 @@
     nixpkgs = {
       url = "github:nixos/nixpkgs/nixos-unstable";
     };
-    stylix = {
-      url = "github:danth/stylix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     nixos-hardware = {
       url = "github:NixOS/nixos-hardware/master";
     };
@@ -22,6 +18,22 @@
       url = "git+ssh://git@github.com/hektor/nix-secrets?shallow=1&ref=main";
       flake = false;
     };
+    colmena = {
+      url = "github:zhaofengli/colmena";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    comin = {
+      url = "github:nlewo/comin";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    git-hooks = {
+      url = "github:cachix/git-hooks.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    stylix = {
+      url = "github:danth/stylix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -38,23 +50,15 @@
       url = "path:./dots/.config/nvim";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    colmena = {
-      url = "github:zhaofengli/colmena";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    git-hooks = {
-      url = "github:cachix/git-hooks.nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
   };
 
   outputs =
     {
       self,
       nixpkgs,
+      git-hooks,
       home-manager,
       nixgl,
-      git-hooks,
       ...
     }@inputs:
     let
@@ -138,6 +142,7 @@
           };
           modules = [ ./home/hosts/work ];
           extraSpecialArgs = {
+            osConfig = null;
             inherit
               inputs
               outputs
@@ -148,7 +153,9 @@
         };
       };
 
-      apps.${system}.colmena = inputs.colmena.apps.${system}.default;
+      apps.${system}.colmena = inputs.colmena.apps.${system}.default // {
+        meta.description = "colmena";
+      };
 
       colmenaHive = import ./deploy/colmena.nix {
         inherit

home/hosts/andromache/default.nix

@@ -8,31 +8,6 @@
 {
   imports = [
     ../../modules
-    ../../modules/3d
-    ../../modules/ai-tools
-    ../../modules/anki
-    ../../modules/audio
-    ../../modules/browser
-    ../../modules/cloud
-    ../../modules/comms
-    ../../modules/desktop/niri
-    ../../modules/devenv
-    ../../modules/direnv
-    ../../modules/git
-    ../../modules/k8s/k9s.nix
-    ../../modules/keepassxc
-    ../../modules/music
-    ../../modules/nvim
-    ../../modules/pandoc
-    ../../modules/photography
-    ../../modules/secrets
-    ../../modules/shell
-    ../../modules/ssh
-    ../../modules/taskwarrior
-    ../../modules/terminal
-    ../../modules/torrenting
-    ../../modules/yubikey
-    ../../modules/zk
   ];
 
   home = {
@@ -52,12 +27,32 @@
     claude-code.enable = true;
     opencode.enable = true;
   };
+  desktop.niri.enable = true;
+  browser.enable = true;
   browser.primary = "librewolf";
   cloud.hetzner.enable = true;
   comms.signal.enable = true;
+  git.enable = true;
   git.github.enable = true;
-  shell.bash.aliases.lang-js = true;
-  shell.bash.addBinToPath = true;
+  shell = {
+    enable = true;
+    bash.aliases.lang-js = true;
+    bash.addBinToPath = true;
+  };
+  anki.enable = true;
+  k8s.k9s.enable = true;
+  secrets.enable = true;
+  taskwarrior.enable = true;
+  audio.enable = true;
+  ssh.enable = true;
+  music.enable = true;
+  terminal.enable = true;
+  devenv.enable = true;
+  keepassxc.enable = true;
+  direnv.enable = true;
+  nvim.enable = true;
+  pandoc.enable = true;
+  photography.enable = true;
   torrenting.enable = true;
   my.yubikey.enable = true;
   zk.enable = true;

home/hosts/astyanax/default.nix

@@ -7,29 +7,6 @@
 {
   imports = [
     ../../modules
-    ../../modules/3d
-    ../../modules/ai-tools
-    ../../modules/anki
-    ../../modules/audio
-    ../../modules/browser
-    ../../modules/cloud
-    ../../modules/comms
-    ../../modules/desktop/niri
-    ../../modules/devenv
-    ../../modules/direnv
-    ../../modules/git
-    ../../modules/k8s/k9s.nix
-    ../../modules/keepassxc
-    ../../modules/music
-    ../../modules/nfc
-    ../../modules/nvim
-    ../../modules/pandoc
-    ../../modules/secrets
-    ../../modules/shell
-    ../../modules/ssh
-    ../../modules/taskwarrior
-    ../../modules/terminal
-    ../../modules/yubikey
   ];
 
   home = {
@@ -48,13 +25,34 @@
     claude-code.enable = true;
     opencode.enable = true;
   };
+  anki.enable = true;
+  audio.enable = true;
+  browser.enable = true;
   browser.primary = "librewolf";
   cloud.hetzner.enable = true;
   comms.signal.enable = true;
+  desktop.niri.enable = true;
+  devenv.enable = true;
+  direnv.enable = true;
+  git.enable = true;
   git.github.enable = true;
-  shell.bash.aliases.lang-js = true;
-  shell.bash.addBinToPath = true;
+  k8s.k9s.enable = true;
+  keepassxc.enable = true;
+  music.enable = true;
   my.yubikey.enable = true;
+  nfc.enable = true;
+  nvim.enable = true;
+  pandoc.enable = true;
+  secrets.enable = true;
+  shell = {
+    enable = true;
+    bash.aliases.lang-js = true;
+    bash.addBinToPath = true;
+  };
+  ssh.enable = true;
+  taskwarrior.enable = true;
+  terminal.enable = true;
+  reference-manager.enable = true;
 
   programs = {
     home-manager.enable = true;

home/hosts/packages.nix

@@ -3,7 +3,9 @@
 with pkgs;
 [
   bat
+  curl
   entr
+  fd
   feh
   fzf
   htop
@@ -13,7 +15,6 @@ with pkgs;
   parallel
   pass
   ripgrep
-  silver-searcher
   sops
   tldr
   tree

home/hosts/work/default.nix

@@ -8,36 +8,8 @@
 {
   imports = [
     inputs.sops-nix.homeManagerModules.sops
+    inputs.stylix.homeModules.stylix
     ../../modules
-    ../../modules/ai-tools
-    ../../modules/anki
-    ../../modules/browser
-    ../../modules/bruno
-    ../../modules/cloud
-    ../../modules/comms
-    ../../modules/database
-    ../../modules/dconf
-    ../../modules/desktop/niri
-    ../../modules/devenv
-    ../../modules/direnv
-    ../../modules/docker
-    ../../modules/git
-    ../../modules/go
-    ../../modules/infra
-    ../../modules/k8s
-    ../../modules/k8s/k9s.nix
-    ../../modules/keepassxc
-    ../../modules/music
-    ../../modules/nodejs
-    ../../modules/nvim
-    ../../modules/pandoc
-    ../../modules/secrets
-    ../../modules/shell
-    ../../modules/stylix
-    ../../modules/taskwarrior
-    ../../modules/ticketing
-    ../../modules/terminal
-    ../../modules/vscode
   ];
 
   sops.age.keyFile = "${config.home.homeDirectory}/.config/sops/age/keys.txt";
@@ -63,24 +35,57 @@
     defaultWrapper = "mesa";
   };
 
-  browser.primary = "firefox";
-  browser.secondary = "chromium";
-  cloud.azure.enable = true;
-  comms.signal.enable = true;
-  comms.teams.enable = true;
   ai-tools = {
     claude-code.enable = true;
     tirith.enable = true;
     opencode.enable = true;
   };
+  anki.enable = true;
+  browser = {
+    enable = true;
+    primary = "firefox";
+    secondary = "chromium";
+  };
+  bruno.enable = true;
+  cloud.azure.enable = true;
+  comms.signal.enable = true;
+  comms.teams.enable = true;
   database = {
     mssql.enable = true;
     postgresql.enable = true;
     redis.enable = true;
   };
-  git.github.enable = true;
-  git.gitlab.enable = true;
+  desktop.niri.enable = true;
+  devenv.enable = true;
+  direnv.enable = true;
+  docker.enable = true;
+  git = {
+    enable = true;
+    github.enable = true;
+    gitlab.enable = true;
+  };
+  go.enable = true;
+  k8s.enable = true;
+  keepassxc.enable = true;
+  music.enable = true;
+  my.dconf.enable = true;
+  my.stylix.enable = true;
+  nvim.enable = true;
+  pandoc.enable = true;
+  shell.enable = true;
+  taskwarrior.enable = true;
+  terminal.enable = true;
+  infra.enable = true;
+  nodejs.enable = true;
+  secrets.enable = true;
   secrets.vault.enable = true;
+  ticketing.enable = true;
+  vscode.enable = true;
+
+  services.home-manager.autoUpgrade = {
+    enable = true;
+    frequency = "weekly";
+  };
 
   programs = {
     gh.enable = true;

home/modules/ai-tools/tirith.nix

@@ -9,7 +9,7 @@ let
 in
 {
   options.ai-tools.tirith = {
-    enable = lib.mkEnableOption "tirith shell security guard";
+    enable = lib.mkEnableOption "tirith";
   };
 
   config = lib.mkMerge [

home/modules/anki/default.nix

@@ -9,33 +9,50 @@
 }:
 
 let
+  cfg = config.anki;
   sops = myUtils.sopsAvailability config osConfig;
   standalone = osConfig == null;
 in
-lib.optionalAttrs standalone {
-  sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
-    anki = [
-      "sync-user"
-      "sync-key"
-    ];
-  };
-}
-// {
-  warnings = lib.optional (
-    !sops.available && config.programs.anki.enable
-  ) "anki is enabled but sops secrets are not available. anki sync will not be configured.";
+{
+  options.anki.enable = lib.mkEnableOption "Anki";
 
-  programs.anki = {
-    enable = true;
-    package = config.nixgl.wrap pkgs.anki;
-    addons = with pkgs.ankiAddons; [
-      anki-connect
-      puppy-reinforcement
-      review-heatmap
-    ];
-    profiles."User 1".sync = lib.mkIf sops.available {
-      usernameFile = "${sops.secrets."anki/sync-user".path}";
-      keyFile = "${sops.secrets."anki/sync-key".path}";
-    };
-  };
+  config = lib.mkIf cfg.enable (
+    lib.optionalAttrs standalone {
+      sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" {
+        anki = [
+          "sync-user"
+          "sync-key"
+        ];
+      };
+    }
+    // {
+      warnings = lib.optional (
+        !sops.available
+      ) "anki is enabled but sops secrets are not available. anki sync will not be configured.";
+
+      programs.anki = {
+        enable = true;
+        package = config.nixgl.wrap pkgs.anki;
+        addons = with pkgs.ankiAddons; [
+          (anki-connect.withConfig {
+            # https://git.sr.ht/~foosoft/anki-connect/tree/master/item/plugin/config.json
+            config = {
+              apiKey = null;
+              apiLogPath = null;
+              webBindAddress = "127.0.0.1";
+              webBindPort = 8765;
+              webCorsOriginList = [ "http://localhost" ];
+              ignoreOriginList = [ ];
+            };
+          })
+          puppy-reinforcement
+          review-heatmap
+        ];
+        profiles."User 1".sync = lib.mkIf sops.available {
+          usernameFile = "${sops.secrets."anki/sync-user".path}";
+          keyFile = "${sops.secrets."anki/sync-key".path}";
+        };
+      };
+    }
+  );
 }

home/modules/audio/default.nix

@@ -1,7 +1,19 @@
-{ osConfig, pkgs, ... }:
-
 {
-  home.packages = with pkgs; [ pulsemixer ];
+  config,
+  lib,
+  pkgs,
+  osConfig,
+  ...
+}:
 
-  services.mpris-proxy.enable = osConfig.hardware.bluetooth.enable or false;
+let
+  cfg = config.audio;
+in
+{
+  options.audio.enable = lib.mkEnableOption "audio";
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [ pulsemixer ];
+    services.mpris-proxy.enable = osConfig.hardware.bluetooth.enable or false;
+  };
 }

home/modules/browser/default.nix

@@ -1,7 +1,19 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 
 {
+  imports = [
+    ./firefox.nix
+    ./librewolf.nix
+    ./chromium.nix
+  ];
+
   options.browser = {
+    enable = lib.mkEnableOption "browser";
+
     primary = lib.mkOption {
       type = lib.types.enum [
         "firefox"
@@ -23,11 +35,7 @@
     };
   };
 
-  config.home.sessionVariables.BROWSER = config.browser.primary;
-
-  imports = [
-    ./firefox.nix
-    ./librewolf.nix
-    ./chromium.nix
-  ];
+  config = lib.mkIf config.browser.enable {
+    home.sessionVariables.BROWSER = config.browser.primary;
+  };
 }

home/modules/browser/firefox.nix

@@ -10,6 +10,7 @@
   config = lib.mkIf (config.browser.primary == "firefox" || config.browser.secondary == "firefox") {
     programs.firefox = {
       enable = true;
+      configPath = "${config.xdg.configHome}/mozilla/firefox";
     }
     // (import ./firefox-base.nix {
       inherit

home/modules/bruno/default.nix

@@ -1,7 +1,19 @@
-{ config, pkgs, ... }:
-
 {
-  config = {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.bruno;
+in
+{
+  options.bruno = {
+    enable = lib.mkEnableOption "Bruno";
+  };
+
+  config = lib.mkIf cfg.enable {
     home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.bruno "--no-sandbox")) ];
   };
 }

home/modules/clipboard/default.nix

@@ -1,7 +1,21 @@
-{ pkgs, ... }:
-
 {
-  home.packages = with pkgs; [
-    wl-clipboard
-  ];
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.clipboard;
+in
+{
+  options.clipboard = {
+    enable = lib.mkEnableOption "clipboard";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      wl-clipboard
+    ];
+  };
 }

home/modules/cloud/default.nix

@@ -3,10 +3,10 @@
 {
   options.cloud = {
     azure = {
-      enable = lib.mkEnableOption "azure CLI";
+      enable = lib.mkEnableOption "Azure CLI";
     };
     hetzner = {
-      enable = lib.mkEnableOption "hetzner CLI";
+      enable = lib.mkEnableOption "Hetzner CLI";
     };
   };
 

home/modules/dconf/default.nix

@@ -1,125 +1,137 @@
-{ config, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
+  cfg = config.my.dconf;
   terminal = "kitty";
   browser = config.browser.primary;
   font = "${config.stylix.fonts.monospace.name} ${toString config.stylix.fonts.sizes.applications}";
 in
 {
-  dconf.settings = {
-    "org/gnome/desktop/background" = {
-      color-shading-type = "solid";
-      picture-options = "zoom";
-      picture-uri = "none";
-      picture-uri-dark = "none";
-      primary-color = "#555555";
-      secondary-color = "#555555";
-      show-desktop-icons = false;
-    };
-
-    "org/gnome/desktop/default-applications/office/calendar" = {
-      exec = "${browser} https://calendar.proton.me";
-      needs-term = false;
-    };
-
-    "org/gnome/desktop/default-applications/office/tasks" = {
-      exec = "task";
-      needs-term = true;
-    };
-
-    "org/gnome/desktop/default-applications/terminal" = {
-      exec = terminal;
-      exec-arg = "";
-    };
-
-    "org/gnome/desktop/input-sources" = {
-      xkb-options = [ "caps:none" ];
-    };
-
-    "org/gnome/desktop/interface" = {
-      clock-format = "24h";
-      clock-show-weekday = true;
-      color-scheme = "prefer-dark";
-      enable-hot-corners = false;
-      # font-name = font;
-      locate-pointer = true;
-      monospace-font-name = font;
-    };
-
-    "org/gnome/desktop/wm/keybindings" = {
-      close = [ "<Shift><Super>Delete" ];
-      minimize = [ "<Super>h" ];
-      move-to-monitor-down = [ "<Super><Shift>Down" ];
-      move-to-monitor-left = [ "<Super><Shift>Left" ];
-      move-to-monitor-right = [ "<Super><Shift>Right" ];
-      move-to-monitor-up = [ "<Super><Shift>Up" ];
-      move-to-workspace-1 = [ "<Super><Shift>a" ];
-      move-to-workspace-2 = [ "<Super><Shift>s" ];
-      move-to-workspace-3 = [ "<Super><Shift>d" ];
-      move-to-workspace-4 = [ "<Super><Shift>f" ];
-      move-to-workspace-5 = [ "<Super><Shift>g" ];
-      switch-applications = [ "<Super>j" ];
-      switch-applications-backward = [ "<Super>k" ];
-      switch-to-workspace-1 = [ "<Super>a" ];
-      switch-to-workspace-2 = [ "<Super>s" ];
-      switch-to-workspace-3 = [ "<Super>d" ];
-      switch-to-workspace-4 = [ "<Super>f" ];
-      switch-to-workspace-5 = [ "<Super>g" ];
-    };
-
-    "org/gnome/desktop/wm/preferences" = {
-      num-workspaces = 5;
-      workspace-names = [
-        "sh"
-        "www"
-        "dev"
-        "info"
-        "etc"
-      ];
-    };
-
-    "org/gnome/mutter" = {
-      center-new-windows = true;
-      dynamic-workspaces = false;
-    };
-
-    "org/gnome/settings-daemon/plugins/color" = {
-      night-light-enabled = true;
-      night-light-schedule-automatic = true;
-    };
-
-    "org/gnome/settings-daemon/plugins/media-keys" = {
-      custom-keybindings = [
-        "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/"
-        "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1/"
-      ];
-    };
-
-    "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0" = {
-      binding = "Print";
-      command = "flameshot gui";
-      name = "flameshot";
-    };
-
-    "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1" = {
-      binding = "<Super>Return";
-      command = terminal;
-      name = "Kitty";
-    };
-
-    "org/gnome/settings-daemon/plugins/power" = {
-      power-button-action = "suspend";
-    };
-
-    "org/gnome/shell/app-switcher" = {
-      current-workspace-only = true;
-    };
-
-    "org/gnome/shell/keybindings" = {
-      toggle-application-view = [ "<Super>p" ];
-      toggle-quick-settings = [ ];
-    };
+  options.my.dconf = {
+    enable = lib.mkEnableOption "dconf";
   };
 
-  home.packages = with pkgs; [ dconf2nix ];
+  config = lib.mkIf cfg.enable {
+    dconf.settings = {
+      "org/gnome/desktop/background" = {
+        color-shading-type = "solid";
+        picture-options = "zoom";
+        picture-uri = "none";
+        picture-uri-dark = "none";
+        primary-color = "#555555";
+        secondary-color = "#555555";
+        show-desktop-icons = false;
+      };
+
+      "org/gnome/desktop/default-applications/office/calendar" = {
+        exec = "${browser} https://calendar.proton.me";
+        needs-term = false;
+      };
+
+      "org/gnome/desktop/default-applications/office/tasks" = {
+        exec = "task";
+        needs-term = true;
+      };
+
+      "org/gnome/desktop/default-applications/terminal" = {
+        exec = terminal;
+        exec-arg = "";
+      };
+
+      "org/gnome/desktop/input-sources" = {
+        xkb-options = [ "caps:none" ];
+      };
+
+      "org/gnome/desktop/interface" = {
+        clock-format = "24h";
+        clock-show-weekday = true;
+        color-scheme = "prefer-dark";
+        enable-hot-corners = false;
+        # font-name = font;
+        locate-pointer = true;
+        monospace-font-name = font;
+      };
+
+      "org/gnome/desktop/wm/keybindings" = {
+        close = [ "<Shift><Super>Delete" ];
+        minimize = [ "<Super>h" ];
+        move-to-monitor-down = [ "<Super><Shift>Down" ];
+        move-to-monitor-left = [ "<Super><Shift>Left" ];
+        move-to-monitor-right = [ "<Super><Shift>Right" ];
+        move-to-monitor-up = [ "<Super><Shift>Up" ];
+        move-to-workspace-1 = [ "<Super><Shift>a" ];
+        move-to-workspace-2 = [ "<Super><Shift>s" ];
+        move-to-workspace-3 = [ "<Super><Shift>d" ];
+        move-to-workspace-4 = [ "<Super><Shift>f" ];
+        move-to-workspace-5 = [ "<Super><Shift>g" ];
+        switch-applications = [ "<Super>j" ];
+        switch-applications-backward = [ "<Super>k" ];
+        switch-to-workspace-1 = [ "<Super>a" ];
+        switch-to-workspace-2 = [ "<Super>s" ];
+        switch-to-workspace-3 = [ "<Super>d" ];
+        switch-to-workspace-4 = [ "<Super>f" ];
+        switch-to-workspace-5 = [ "<Super>g" ];
+      };
+
+      "org/gnome/desktop/wm/preferences" = {
+        num-workspaces = 5;
+        workspace-names = [
+          "sh"
+          "www"
+          "dev"
+          "info"
+          "etc"
+        ];
+      };
+
+      "org/gnome/mutter" = {
+        center-new-windows = true;
+        dynamic-workspaces = false;
+      };
+
+      "org/gnome/settings-daemon/plugins/color" = {
+        night-light-enabled = true;
+        night-light-schedule-automatic = true;
+      };
+
+      "org/gnome/settings-daemon/plugins/media-keys" = {
+        custom-keybindings = [
+          "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/"
+          "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1/"
+        ];
+      };
+
+      "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0" = {
+        binding = "Print";
+        command = "flameshot gui";
+        name = "flameshot";
+      };
+
+      "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1" = {
+        binding = "<Super>Return";
+        command = terminal;
+        name = "Kitty";
+      };
+
+      "org/gnome/settings-daemon/plugins/power" = {
+        power-button-action = "suspend";
+      };
+
+      "org/gnome/shell/app-switcher" = {
+        current-workspace-only = true;
+      };
+
+      "org/gnome/shell/keybindings" = {
+        toggle-application-view = [ "<Super>p" ];
+        toggle-quick-settings = [ ];
+      };
+    };
+
+    home.packages = with pkgs; [ dconf2nix ];
+  };
 }

home/modules/default.nix

@@ -6,6 +6,13 @@
 }:
 
 {
+  imports =
+    let
+      dirs = lib.attrNames (lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./.));
+      hasDef = name: builtins.pathExists ./${name}/default.nix;
+    in
+    map (name: ./${name}) (builtins.filter hasDef dirs);
+
   options = {
     host.username = lib.mkOption {
       type = lib.types.str;

home/modules/desktop/default.nix

@@ -0,0 +1,5 @@
+{ ... }:
+
+{
+  imports = [ ./niri ];
+}

home/modules/desktop/niri/config.kdl

@@ -179,4 +179,5 @@ binds {
     Alt+Print  { screenshot-window; }
 
     Mod+Shift+Delete { quit; }
+
 }

home/modules/desktop/niri/default.nix

@@ -1,4 +1,9 @@
-{ pkgs, ... }:
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
 
 {
   imports = [
@@ -9,18 +14,58 @@
     ../../waybar
   ];
 
-  home = {
-    file.".config/niri/config.kdl".source = ./config.kdl;
-    packages = with pkgs; [
-      brightnessctl
-      wlsunset
-    ];
-  };
+  options.desktop.niri.enable = lib.mkEnableOption "niri desktop";
 
-  services.gammastep = {
-    enable = true;
-    provider = "manual";
-    latitude = 51.05;
-    longitude = 3.71667;
+  config = lib.mkIf config.desktop.niri.enable {
+    clipboard.enable = lib.mkDefault true;
+    fuzzel.enable = lib.mkDefault true;
+    mako.enable = lib.mkDefault true;
+    shikane.enable = lib.mkDefault true;
+    waybar.enable = lib.mkDefault true;
+
+    home = {
+      file.".config/niri/config.kdl".source = ./config.kdl;
+      packages = with pkgs; [
+        brightnessctl
+        wlsunset
+      ];
+    };
+
+    services.gammastep = {
+      enable = true;
+      provider = "manual";
+      latitude = 51.05;
+      longitude = 3.71667;
+    };
+
+    xdg.configFile."electron-flags.conf".text = ''
+      --enable-features=UseOzonePlatform
+      --ozone-platform=wayland
+    '';
+
+    xdg.portal = {
+      enable = true;
+      config = {
+        niri = {
+          default = [
+            "gnome"
+            "gtk"
+          ];
+          "org.freedesktop.impl.portal.Access" = "gtk";
+          "org.freedesktop.impl.portal.Notification" = "gtk";
+          "org.freedesktop.impl.portal.Secret" = "gnome-keyring";
+          "org.freedesktop.impl.portal.FileChooser" = "gtk";
+          "org.freedesktop.impl.portal.ScreenCast" = [ "gnome" ];
+          "org.freedesktop.impl.portal.Settings" = [
+            "gnome"
+            "gtk"
+          ];
+        };
+      };
+      extraPortals = [
+        pkgs.xdg-desktop-portal-gtk
+        pkgs.xdg-desktop-portal-gnome
+      ];
+    };
   };
 }

home/modules/devenv/default.nix

@@ -1,4 +1,19 @@
-{ pkgs, ... }:
 {
-  home.packages = [ pkgs.devenv ];
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.devenv;
+in
+{
+  options.devenv = {
+    enable = lib.mkEnableOption "devenv";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = [ pkgs.devenv ];
+  };
 }

home/modules/direnv/default.nix

@@ -1,7 +1,20 @@
 {
-  programs.direnv = {
-    enable = true;
-    enableBashIntegration = true;
-    nix-direnv.enable = true;
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.direnv;
+in
+{
+  options.direnv.enable = lib.mkEnableOption "direnv";
+
+  config = lib.mkIf cfg.enable {
+    programs.direnv = {
+      enable = true;
+      enableBashIntegration = true;
+      nix-direnv.enable = true;
+    };
   };
 }

home/modules/docker/default.nix

@@ -1,7 +1,21 @@
-{ pkgs, ... }:
-
 {
-  home.packages = with pkgs; [
-    dive
-  ];
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.docker;
+in
+{
+  options.docker = {
+    enable = lib.mkEnableOption "Docker";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      dive
+    ];
+  };
 }

home/modules/fuzzel/default.nix

@@ -1,14 +1,27 @@
 {
-  programs.fuzzel = {
-    enable = true;
-    settings = {
-      main = {
-        horizontal-pad = 0;
-        vertical-pad = 0;
-      };
-      border = {
-        width = 2;
-        radius = 0;
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.fuzzel;
+in
+{
+  options.fuzzel.enable = lib.mkEnableOption "fuzzel";
+
+  config = lib.mkIf cfg.enable {
+    programs.fuzzel = {
+      enable = true;
+      settings = {
+        main = {
+          horizontal-pad = 0;
+          vertical-pad = 0;
+        };
+        border = {
+          width = 2;
+          radius = 0;
+        };
       };
     };
   };

home/modules/git/default.nix

@@ -8,11 +8,12 @@
 
 {
   options.git = {
+    enable = lib.mkEnableOption "git";
     github.enable = lib.mkEnableOption "Github CLI";
     gitlab.enable = lib.mkEnableOption "Gitlab CLI";
   };
 
-  config = {
+  config = lib.mkIf config.git.enable {
     programs.git.enable = true;
     home.file = {
       ".gitconfig".source = dotsPath + "/.gitconfig";

home/modules/go/default.nix

@@ -1,7 +1,22 @@
-{ pkgs, ... }:
 {
-  home.packages = with pkgs; [
-    go
-    gopls
-  ];
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.go;
+in
+{
+  options.go = {
+    enable = lib.mkEnableOption "Go";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      go
+      gopls
+    ];
+  };
 }

home/modules/infra/default.nix

@@ -1,7 +1,19 @@
-{ pkgs, ... }:
-
 {
-  config = {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.infra;
+in
+{
+  options.infra = {
+    enable = lib.mkEnableOption "infrastructure tools";
+  };
+
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       opentofu
       upbound

home/modules/k8s/default.nix

@@ -1,29 +1,44 @@
-{ pkgs, ... }:
-
 {
-  home.packages = with pkgs; [
-    argocd
-    fluxcd
-    k3d
-    kubectl
-    kubernetes
-    kustomize
-    minikube
-    opentofu
-    upbound
-  ];
-
-  programs.kubecolor = {
-    enable = true;
-    enableAlias = true;
-  };
-
-  home.shellAliases = {
-    k = "kubectl";
-  };
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
+let
+  cfg = config.k8s;
+in
+{
   imports = [
     ./helm.nix
     ./k9s.nix
   ];
+
+  options.k8s.enable = lib.mkEnableOption "k8s";
+
+  config = lib.mkIf cfg.enable {
+    k8s.helm.enable = lib.mkDefault true;
+    k8s.k9s.enable = lib.mkDefault true;
+
+    home.packages = with pkgs; [
+      argocd
+      fluxcd
+      k3d
+      kubectl
+      kubernetes
+      kustomize
+      minikube
+      opentofu
+      upbound
+    ];
+
+    programs.kubecolor = {
+      enable = true;
+      enableAlias = true;
+    };
+
+    home.shellAliases = {
+      k = "kubectl";
+    };
+  };
 }

home/modules/k8s/helm.nix

@@ -1,15 +1,27 @@
-{ pkgs, ... }:
-
 {
-  home.packages = with pkgs; [
-    (wrapHelm kubernetes-helm {
-      plugins = with kubernetes-helmPlugins; [
-        helm-diff
-        helm-git
-        helm-schema
-        helm-secrets
-        helm-unittest
-      ];
-    })
-  ];
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.k8s.helm;
+in
+{
+  options.k8s.helm.enable = lib.mkEnableOption "helm";
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      (wrapHelm kubernetes-helm {
+        plugins = with kubernetes-helmPlugins; [
+          helm-diff
+          helm-git
+          helm-schema
+          helm-secrets
+          helm-unittest
+        ];
+      })
+    ];
+  };
 }

home/modules/k8s/k9s.nix

@@ -1,10 +1,23 @@
 {
-  programs.k9s = {
-    enable = true;
-    settings.k9s = {
-      ui = {
-        logoless = true;
-        reactive = true;
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.k8s.k9s;
+in
+{
+  options.k8s.k9s.enable = lib.mkEnableOption "";
+
+  config = lib.mkIf cfg.enable {
+    programs.k9s = {
+      enable = true;
+      settings.k9s = {
+        ui = {
+          logoless = true;
+          reactive = true;
+        };
       };
     };
   };

home/modules/keepassxc/default.nix

@@ -1,8 +1,21 @@
 {
-  programs.keepassxc = {
-    enable = true;
-    settings = {
-      Browser.Enabled = true;
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.keepassxc;
+in
+{
+  options.keepassxc.enable = lib.mkEnableOption "KeePassXC";
+
+  config = lib.mkIf cfg.enable {
+    programs.keepassxc = {
+      enable = true;
+      settings = {
+        Browser.Enabled = true;
+      };
     };
   };
 }

home/modules/mako/default.nix

@@ -1,5 +1,16 @@
 {
-  services.mako = {
-    enable = true;
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.mako;
+in
+{
+  options.mako.enable = lib.mkEnableOption "mako";
+
+  config = lib.mkIf cfg.enable {
+    services.mako.enable = true;
   };
 }

home/modules/music/default.nix

@@ -1,10 +1,13 @@
 {
-  dotsPath,
+  config,
+  lib,
   pkgs,
+  dotsPath,
   ...
 }:
 
 let
+  cfg = config.music;
   spotifyWithWayland = pkgs.symlinkJoin {
     name = "spotify";
     paths = [ pkgs.spotify ];
@@ -16,12 +19,14 @@ let
   };
 in
 {
-  home.packages = with pkgs; [
-    spotifyWithWayland
-  ];
+  options.music.enable = lib.mkEnableOption "music";
 
-  programs.ncspot = {
-    enable = true;
-    settings = builtins.fromTOML (builtins.readFile (dotsPath + "/.config/ncspot/config.toml"));
+  config = lib.mkIf cfg.enable {
+    home.packages = [ spotifyWithWayland ];
+
+    programs.ncspot = {
+      enable = true;
+      settings = fromTOML (builtins.readFile (dotsPath + "/.config/ncspot/config.toml"));
+    };
   };
 }

home/modules/nfc/default.nix

@@ -1,5 +1,21 @@
 {
-  imports = [
-    ./proxmark3.nix
-  ];
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.nfc;
+in
+{
+  options.nfc = {
+    enable = lib.mkEnableOption "NFC tools";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = [
+      (pkgs.proxmark3.override { withGeneric = true; })
+    ];
+  };
 }

home/modules/nfc/proxmark3.nix

@@ -1,6 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [
-    (pkgs.proxmark3.override { withGeneric = true; })
-  ];
-}

home/modules/nodejs/default.nix

@@ -5,15 +5,21 @@
   ...
 }:
 
+let
+  cfg = config.nodejs;
+in
 {
-  options.nodejs.package = lib.mkOption {
-    type = lib.types.package;
-    default = pkgs.nodejs_24;
+  options.nodejs = {
+    enable = lib.mkEnableOption "Node.js";
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.nodejs_24;
+    };
   };
 
-  config = {
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
-      config.nodejs.package
+      cfg.package
       pnpm
       yarn
       biome

home/modules/nvim/default.nix

@@ -1,7 +1,20 @@
-{ pkgs, inputs, ... }:
-
 {
-  home.packages = [
-    inputs.nvim.packages.${pkgs.stdenv.hostPlatform.system}.nvim
-  ];
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
+
+let
+  cfg = config.nvim;
+in
+{
+  options.nvim.enable = lib.mkEnableOption "nvim";
+
+  config = lib.mkIf cfg.enable {
+    home.packages = [
+      inputs.nvim.packages.${pkgs.stdenv.hostPlatform.system}.nvim
+    ];
+  };
 }

home/modules/pandoc/default.nix

@@ -1,8 +1,23 @@
-{ pkgs, ... }:
 {
-  home.packages = with pkgs; [
-    haskellPackages.pandoc-crossref
-    pandoc
-    texliveSmall
-  ];
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.pandoc;
+in
+{
+  options.pandoc = {
+    enable = lib.mkEnableOption "pandoc";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      haskellPackages.pandoc-crossref
+      pandoc
+      texliveSmall
+    ];
+  };
 }

home/modules/photography/default.nix

@@ -1,7 +1,21 @@
-{ pkgs, ... }:
-
 {
-  home.packages = with pkgs; [
-    darktable
-  ];
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.photography;
+in
+{
+  options.photography = {
+    enable = lib.mkEnableOption "photography";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      darktable
+    ];
+  };
 }

home/modules/reference-manager/default.nix

@@ -0,0 +1,37 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.reference-manager;
+
+  hasBrowser =
+    name:
+    lib.elem name [
+      config.browser.primary
+      config.browser.secondary
+    ];
+
+  zoteroConnector =
+    inputs.firefox-addons.packages.${pkgs.stdenv.hostPlatform.system}.zotero-connector;
+  zoteroAddonId = "zotero@chnm.gmu.edu";
+
+  connectorExtension = {
+    profiles.default.extensions.packages = [ zoteroConnector ];
+    policies.ExtensionSettings.${zoteroAddonId}.default_area = "navbar";
+  };
+in
+{
+  options.reference-manager.enable = lib.mkEnableOption "reference manager (Zotero)";
+
+  config = lib.mkIf cfg.enable {
+    home.packages = [ pkgs.zotero ];
+
+    programs.firefox = lib.mkIf (hasBrowser "firefox") connectorExtension;
+    programs.librewolf = lib.mkIf (hasBrowser "librewolf") connectorExtension;
+  };
+}

home/modules/secrets/default.nix

@@ -1,13 +1,19 @@
 {
+  config,
+  lib,
   pkgs,
   ...
 }:
 {
   imports = [ ./vault.nix ];
 
-  home.packages = with pkgs; [
-    age
-    age-plugin-yubikey # TODO: only needed when using Yubikey
-    sops
-  ];
+  options.secrets.enable = lib.mkEnableOption "secrets";
+
+  config = lib.mkIf config.secrets.enable {
+    home.packages = with pkgs; [
+      age
+      age-plugin-yubikey
+      sops
+    ];
+  };
 }

home/modules/shell/bash.nix

@@ -4,13 +4,12 @@
   dotsPath,
   ...
 }:
+
 let
   cfg = config.shell.bash;
   inherit (config.home) username;
 in
 {
-  imports = [ ./utils.nix ];
-
   options.shell.bash = {
     aliases = {
       all = lib.mkOption {
@@ -34,7 +33,7 @@ in
     };
   };
 
-  config = {
+  config = lib.mkIf config.shell.enable {
     programs.bash = {
       enable = true;
       enableCompletion = true;

home/modules/shell/default.nix

@@ -1,3 +1,9 @@
+{
+  config,
+  lib,
+  ...
+}:
+
 {
   imports = [
     ./bash.nix
@@ -5,4 +11,10 @@
     ./prompt.nix
     ../tmux
   ];
+
+  options.shell.enable = lib.mkEnableOption "shell";
+
+  config = lib.mkIf config.shell.enable {
+    tmux.enable = lib.mkDefault true;
+  };
 }

home/modules/shell/prompt.nix

@@ -1,3 +1,18 @@
 {
-  programs.starship.enable = true;
+  config,
+  lib,
+  ...
+}:
+
+{
+  config = lib.mkIf config.shell.enable {
+    programs.starship = {
+      enable = true;
+      settings = {
+        git_status = {
+          ahead = "⇡$\{count\}";
+        };
+      };
+    };
+  };
 }

home/modules/shell/utils.nix

@@ -1,19 +1,23 @@
 {
+  config,
   lib,
   pkgs,
   ...
 }:
-{
-  programs.fzf = {
-    enable = true;
-    enableBashIntegration = lib.mkDefault true;
-  };
 
-  home.packages = with pkgs; [
-    ripgrep
-    bat
-    jq
-    entr
-    parallel
-  ];
+{
+  config = lib.mkIf config.shell.enable {
+    programs.fzf = {
+      enable = true;
+      enableBashIntegration = lib.mkDefault true;
+    };
+
+    home.packages = with pkgs; [
+      ripgrep
+      bat
+      jq
+      entr
+      parallel
+    ];
+  };
 }

home/modules/shikane/default.nix

@@ -1,6 +1,70 @@
-{ pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
-  home.packages = with pkgs; [ wdisplays ];
-  services.shikane.enable = true;
+  options.shikane.enable = lib.mkEnableOption "shikane";
+
+  config = lib.mkIf config.shikane.enable {
+    home.packages = with pkgs; [ (config.nixgl.wrap wdisplays) ];
+    services.shikane.enable = true;
+    home.file.".config/shikane/config.toml" = {
+      force = true;
+      text = ''
+        [[profile]]
+        name = "work"
+
+        [[profile.output]]
+        enable = true
+        search = ["m=Unknown", "s=", "v=Unknown"]
+        mode = "2880x1800@120Hz"
+        position = "288,3240"
+        scale = 1.5
+        transform = "normal"
+        adaptive_sync = false
+
+        [[profile.output]]
+        enable = true
+        search = ["m=Q27P1B", "s=GNXM2HA196769", "v=PNP(AOC)"]
+        mode = "2560x1440@59.951Hz"
+        position = "116,1800"
+        scale = 1.0
+        transform = "normal"
+        adaptive_sync = false
+
+        [[profile.output]]
+        enable = true
+        search = ["m=PHL 243S7", "s=UHB1923012753", "v=Philips Consumer Electronics Company"]
+        mode = "1920x1080@60Hz"
+        position = "2676,1800"
+        scale = 1.0
+        transform = "270"
+        adaptive_sync = false
+
+        [[profile]]
+        name = "home"
+
+        [[profile.output]]
+        enable = true
+        search = ["m=Unknown", "s=Unknown", "v=Unknown"]
+        mode = "2880x1800@60.001Hz"
+        position = "185,1440"
+        scale = 1.75
+        transform = "normal"
+        adaptive_sync = false
+
+        [[profile.output]]
+        enable = true
+        search = ["m=PHL 276E8V", "s=0x0000046D", "v=Philips Consumer Electronics Company"]
+        mode = "3840x2160@59.996Hz"
+        position = "1500,0"
+        scale = 1.5
+        transform = "normal"
+        adaptive_sync = false
+      '';
+    };
+  };
 }

home/modules/ssh/README.md

@@ -47,15 +47,6 @@ backup key (`id_ed25519_sk_bak.pub`) if needed.
 | backup key file lost | regenerate from backup YubiKey resident key (use `ssh-keygen -K`) |
 | backup YubiKey lost | generate resident backup key, distribute across hosts, re-register (use primary key) |
 
-## notes / to do
-
-TODO: automate distributing `id_ed25519_sk_bak`, `id_ed25519_sk_bak.pub` to all devices
-TODO: declare setup scripts (use e.g. `$HOSTNAME`)
-TODO: register backup key with hosts (add to authorized hosts for each host)
-TODO: register backup key with services (e.g. Gitea)
-TODO: make sure to fall back to backup key when host-specific primary key is not present
-TODO: see if / how `-O application=ssh:<name>` could be used
-
 ## references
 
 * <https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html>

home/modules/ssh/default.nix

@@ -1,10 +1,13 @@
 {
-  myUtils,
+  config,
   lib,
   pkgs,
+  myUtils,
   ...
 }:
+
 let
+  cfg = config.ssh;
   hostDir = ../../hosts;
   hostNames = myUtils.dirNames hostDir;
   hostsWithKeys = lib.filter (
@@ -12,31 +15,39 @@ let
   ) hostNames;
 in
 {
-  home.packages = with pkgs; [ sshfs ];
+  options.ssh.enable = lib.mkEnableOption "ssh";
 
-  programs.ssh = {
-    enable = true;
-    enableDefaultConfig = false;
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [ sshfs ];
 
-    matchBlocks =
-      lib.genAttrs hostsWithKeys (
-        hostname:
-        let
-          meta = myUtils.hostMeta (hostDir + "/${hostname}");
-        in
-        {
-          host = hostname;
-          user = meta.deployment.targetUser;
-        }
-        // lib.optionalAttrs (meta.deployment.targetHost != "") {
-          hostname = meta.deployment.targetHost;
-        }
-      )
-      // {
-        "*" = {
-          addKeysToAgent = "yes";
-          forwardAgent = false;
+    programs.ssh = {
+      enable = true;
+      enableDefaultConfig = false;
+
+      settings =
+        lib.genAttrs hostsWithKeys (
+          hostname:
+          let
+            meta = myUtils.hostMeta (hostDir + "/${hostname}");
+            isLocal = builtins.elem "local" meta.tags;
+          in
+          {
+            User = meta.host.username;
+          }
+          // lib.optionalAttrs (!isLocal) {
+            HostName = hostname;
+          }
+        )
+        // {
+          "*" = {
+            AddKeysToAgent = "yes";
+            ForwardAgent = false;
+            identityFile = [
+              "~/.ssh/id_ed25519_sk"
+              "~/.ssh/id_ed25519_sk_bak"
+            ];
+          };
         };
-      };
+    };
   };
 }

home/modules/stylix/default.nix

@@ -1,30 +1,33 @@
 {
   config,
-  inputs,
+  lib,
   pkgs,
   ...
 }:
 
 let
+  cfg = config.my.stylix;
   theme = import ../../../modules/stylix/theme.nix { inherit pkgs; };
 in
 {
-  imports = [ inputs.stylix.homeModules.stylix ];
+  options.my.stylix.enable = lib.mkEnableOption "stylix";
 
-  stylix = {
-    enable = true;
-    inherit (theme)
-      polarity
-      base16Scheme
-      override
-      image
-      ;
-    fonts = {
-      monospace = theme.monospaceFont;
-      serif = config.stylix.fonts.monospace;
-      sansSerif = config.stylix.fonts.monospace;
-      emoji = config.stylix.fonts.monospace;
+  config = lib.mkIf cfg.enable {
+    stylix = {
+      enable = true;
+      inherit (theme)
+        polarity
+        base16Scheme
+        override
+        image
+        ;
+      fonts = {
+        monospace = theme.monospaceFont;
+        serif = config.stylix.fonts.monospace;
+        sansSerif = config.stylix.fonts.monospace;
+        emoji = config.stylix.fonts.monospace;
+      };
+      targets = import ../../../modules/stylix/targets.nix;
     };
-    targets = import ../../../modules/stylix/targets.nix;
   };
 }

home/modules/taskwarrior/default.nix

@@ -10,70 +10,76 @@
 }:
 
 let
+  cfg = config.taskwarrior;
   sops = myUtils.sopsAvailability config osConfig;
   standalone = osConfig == null;
 in
-lib.optionalAttrs standalone {
-  sops = {
-    secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
-      taskwarrior = [
-        "sync-server-url"
-        "sync-server-client-id"
-        "sync-encryption-secret"
+{
+  options.taskwarrior.enable = lib.mkEnableOption "taskwarrior";
+
+  config = lib.mkIf cfg.enable (
+    lib.optionalAttrs standalone {
+      sops = {
+        secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" {
+          taskwarrior = [
+            "sync-server-url"
+            "sync-server-client-id"
+            "sync-encryption-secret"
+          ];
+        };
+
+        templates."taskrc.d/sync" = {
+          content = ''
+            sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"}
+            sync.server.client_id=${config.sops.placeholder."taskwarrior/sync-server-client-id"}
+            sync.encryption_secret=${config.sops.placeholder."taskwarrior/sync-encryption-secret"}
+          '';
+        };
+      };
+    }
+    // {
+      warnings =
+        lib.optional (!sops.available)
+          "taskwarrior is enabled, but sops templates are not available. taskwarrior sync will not be configured.";
+
+      home.packages = with pkgs; [
+        libnotify
+        taskopen
+        python3
       ];
-    };
 
-    templates."taskrc.d/sync" = {
-      content = ''
-        sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"}
-        sync.server.client_id=${config.sops.placeholder."taskwarrior/sync-server-client-id"}
-        sync.encryption_secret=${config.sops.placeholder."taskwarrior/sync-encryption-secret"}
-      '';
-    };
-  };
-}
-// {
-
-  warnings =
-    lib.optional (!sops.available && config.programs.taskwarrior.enable)
-      "taskwarrior is enabled, but sops templates are not available. taskwarrior sync will not be configured.";
-
-  home.packages = with pkgs; [
-    libnotify
-    taskopen
-    python3
-  ];
-
-  home.file = {
-    ".config/task/taskrc" = {
-      force = true;
-      source = dotsPath + "/.config/task/taskrc";
-    };
-    ".config/task/taskrc.d/aliases".source = dotsPath + "/.config/task/taskrc.d/aliases";
-    ".config/task/taskrc.d/colors".source = dotsPath + "/.config/task/taskrc.d/colors";
-    ".config/task/taskrc.d/contexts".source = dotsPath + "/.config/task/taskrc.d/contexts";
-    ".config/task/taskrc.d/reports".source = dotsPath + "/.config/task/taskrc.d/reports";
-    ".config/task/taskrc.d/udas".source = dotsPath + "/.config/task/taskrc.d/udas";
-    ".config/task/taskrc.d/urgency".source = dotsPath + "/.config/task/taskrc.d/urgency";
-    ".local/share/task/hooks/on-exit.sync.py" = {
-      source = dotsPath + "/.local/share/task/hooks/on-exit.sync.py";
-    };
-    ".local/share/task/scripts/sync-and-notify.sh" = {
-      source = dotsPath + "/.local/share/task/scripts/sync-and-notify.sh";
-      executable = true;
-    };
-  };
-
-  programs.taskwarrior = with pkgs; {
-    enable = true;
-    package = taskwarrior3;
-    colorTheme = "dark-256";
-    config = {
-      recurrence = "off";
-      reserved.lines = 3; # without this I would have to scroll up 3 lines
-    };
-    extraConfig = lib.optionalString sops.available ''
-      include ${sops.templates."taskrc.d/sync".path}
-    '';
-  };
+      home.file = {
+        ".config/task/taskrc" = {
+          force = true;
+          source = dotsPath + "/.config/task/taskrc";
+        };
+        ".config/task/taskrc.d/aliases".source = dotsPath + "/.config/task/taskrc.d/aliases";
+        ".config/task/taskrc.d/colors".source = dotsPath + "/.config/task/taskrc.d/colors";
+        ".config/task/taskrc.d/contexts".source = dotsPath + "/.config/task/taskrc.d/contexts";
+        ".config/task/taskrc.d/reports".source = dotsPath + "/.config/task/taskrc.d/reports";
+        ".config/task/taskrc.d/udas".source = dotsPath + "/.config/task/taskrc.d/udas";
+        ".config/task/taskrc.d/urgency".source = dotsPath + "/.config/task/taskrc.d/urgency";
+        ".local/share/task/hooks/on-exit.sync.py" = {
+          source = dotsPath + "/.local/share/task/hooks/on-exit.sync.py";
+        };
+        ".local/share/task/scripts/sync-and-notify.sh" = {
+          source = dotsPath + "/.local/share/task/scripts/sync-and-notify.sh";
+          executable = true;
+        };
+      };
+
+      programs.taskwarrior = with pkgs; {
+        enable = true;
+        package = taskwarrior3;
+        colorTheme = "dark-256";
+        config = {
+          recurrence = "off";
+          reserved.lines = 3;
+        };
+        extraConfig = lib.optionalString sops.available ''
+          include ${sops.templates."taskrc.d/sync".path}
+        '';
+      };
+    }
+  );
 }

home/modules/terminal/default.nix

@@ -1,12 +1,18 @@
 {
-  pkgs,
   config,
+  lib,
+  pkgs,
   dotsPath,
   ...
 }:
 
+let
+  cfg = config.terminal;
+in
 {
-  config = {
+  options.terminal.enable = lib.mkEnableOption "terminal";
+
+  config = lib.mkIf cfg.enable {
     programs.bash.shellAliases = {
       icat = "kitty +kitten icat";
     };

home/modules/ticketing/default.nix

@@ -1,7 +1,21 @@
-{ pkgs, ... }:
-
 {
-  home.packages = with pkgs; [
-    jira-cli-go
-  ];
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.ticketing;
+in
+{
+  options.ticketing = {
+    enable = lib.mkEnableOption "ticketing";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = with pkgs; [
+      jira-cli-go
+    ];
+  };
 }

home/modules/tmux/default.nix

@@ -1,7 +1,18 @@
-{ pkgs, dotsPath, ... }:
-
 {
-  config = {
+  config,
+  lib,
+  pkgs,
+  dotsPath,
+  ...
+}:
+
+let
+  cfg = config.tmux;
+in
+{
+  options.tmux.enable = lib.mkEnableOption "tmux";
+
+  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       tmuxp
       reptyr

home/modules/torrenting/default.nix

@@ -10,7 +10,7 @@ let
 in
 {
   options.torrenting = {
-    enable = lib.mkEnableOption "transmission torrent client";
+    enable = lib.mkEnableOption "torrenting";
   };
 
   config = lib.mkIf cfg.enable {

home/modules/vscode/default.nix

@@ -1,7 +1,19 @@
-{ config, pkgs, ... }:
-
 {
-  config = {
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.vscode;
+in
+{
+  options.vscode = {
+    enable = lib.mkEnableOption "Visual Studio Code";
+  };
+
+  config = lib.mkIf cfg.enable {
     home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.vscode "--no-sandbox")) ];
   };
 }

home/modules/waybar/default.nix

@@ -1,11 +1,24 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.waybar;
+in
 {
   imports = [
     ./settings.nix
     ./style.nix
   ];
 
-  programs.waybar = {
-    enable = true;
-    systemd.enable = true;
+  options.waybar.enable = lib.mkEnableOption "waybar";
+
+  config = lib.mkIf cfg.enable {
+    programs.waybar = {
+      enable = true;
+      systemd.enable = true;
+    };
   };
 }

hosts/andromache/default.nix

@@ -7,61 +7,73 @@
 }:
 
 let
+  meta = import ./meta.nix;
   wolInterfaces = import ./wol-interfaces.nix;
 in
 {
   imports = [
     inputs.disko.nixosModules.disko
-    ./hard.nix
-    ./host.nix
     inputs.nixos-hardware.nixosModules.common-cpu-intel
     inputs.nixos-hardware.nixosModules.common-pc
     inputs.nixos-hardware.nixosModules.common-pc-ssd
-    ../../modules/common
-    ../../modules/boot/bootloader.nix
+    ../../modules
     (import ../../modules/disko/zfs-encrypted-root.nix {
       inherit lib config;
       device = "/dev/nvme1n1";
     })
-    ../../modules/ai-tools
-    ../../modules/anki
-    ../../modules/audio
-    ../../modules/backups
-    ../../modules/bluetooth
-    ../../modules/desktops/niri
-    ../../modules/docker
-    ../../modules/firewall
-    ../../modules/fonts
-    ../../modules/gaming
-    ../../modules/git
-    ../../modules/hcloud
-    ../../modules/keyboard
-    ../../modules/localization
-    ../../modules/networking
-    ../../modules/nvidia
-    ../../modules/secrets
-    ../../modules/ssh
-    ../../modules/storage
-    ../../modules/stylix
-    ../../modules/syncthing
-    ../../modules/tailscale
-    ../../modules/taskwarrior
-    ../../modules/users
-    ../../modules/wol
-    ../../modules/yubikey
   ];
 
+  inherit (meta) host;
+
+  hardware.facter.reportPath = ./facter.json;
   home-manager.users.${config.host.username} = import ../../home/hosts/${config.host.name};
 
-  secrets.nixSigningKey.enable = true;
-
-  restic-backup.enable = true;
-  tailscale.enable = true;
+  "ai-tools".enable = true;
+  anki.enable = true;
+  audio.enable = true;
+  bluetooth.enable = true;
+  bootloader.enable = true;
+  desktop.niri.enable = true;
+  firewall = {
+    enable = true;
+    allowedTCPPorts = [ 22 ];
+  };
+  gaming.enable = true;
+  git.enable = true;
+  keyboard.enable = true;
+  localization.enable = true;
+  my = {
+    fonts.enable = true;
+    stylix.enable = true;
+    users.enable = true;
+    yubikey = {
+      enable = true;
+      pam.enable = false;
+    };
+  };
   desktop.ly.enable = true;
-
   docker.enable = true;
-
   hcloud.enable = true;
+  networking = {
+    enable = true;
+    hostId = "80eef97e";
+    useDHCP = lib.mkDefault true;
+  };
+  nvidia.enable = true;
+  restic-backup.enable = true;
+  secrets = {
+    enable = true;
+    nixSigningKey.enable = true;
+  };
+  ssh.enable = true;
+  storage.enable = true;
+  syncthing.enable = true;
+  tailscale.enable = true;
+  taskwarrior.enable = true;
+  wol = {
+    enable = true;
+    interfaces.eno1 = { inherit (wolInterfaces.eno1) macAddress; };
+  };
 
   disko.devices = {
     disk.data = {
@@ -91,25 +103,8 @@ in
     inputs.colmena.packages.${pkgs.stdenv.hostPlatform.system}.colmena
   ];
 
-  my.yubikey = {
-    enable = true;
-    pam.enable = false;
-  };
-
   services.locate = {
     enable = true;
     package = pkgs.plocate;
   };
-
-  networking.hostId = "80eef97e";
-
-  wol = {
-    enable = true;
-    interfaces.eno1 = { inherit (wolInterfaces.eno1) macAddress; };
-  };
-
-  firewall = {
-    enable = true;
-    allowedTCPPorts = [ 22 ];
-  };
 }

hosts/andromache/hard.nix

@@ -1,42 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot = {
-    initrd.availableKernelModules = [
-      "vmd"
-      "xhci_pci"
-      "ahci"
-      "nvme"
-      "usbhid"
-      "usb_storage"
-      "uas"
-      "sd_mod"
-    ];
-    initrd.kernelModules = [ ];
-    kernelModules = [ "kvm-intel" ];
-    extraModulePackages = [ ];
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp0s20f3.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/andromache/host.nix

@@ -1,7 +0,0 @@
-{
-  host = {
-    username = "h";
-    highRam = true;
-    admin = true;
-  };
-}

hosts/andromache/meta.nix

@@ -1,9 +1,10 @@
 {
   system = "x86_64-linux";
-  deployment = {
-    tags = [ "local" ];
-    targetHost = "";
-    targetUser = "h";
-  };
   role = "desktop";
+  tags = [ "local" ];
+  host = {
+    username = "h";
+    highRam = true;
+    admin = true;
+  };
 }

hosts/astyanax/default.nix

@@ -5,58 +5,63 @@
   pkgs,
   ...
 }:
+
 let
-  wolInterfaces = import ../andromache/wol-interfaces.nix;
+  meta = import ./meta.nix;
 in
 {
   imports = [
     inputs.disko.nixosModules.disko
-    ./hard.nix
-    ./host.nix
     inputs.nixos-hardware.nixosModules.common-pc
     inputs.nixos-hardware.nixosModules.common-pc-ssd
     # inputs.nixos-hardware.nixosModules.lenovo-thinkpad-e14-intel-gen7 (not available yet?)
-    inputs.sops-nix.nixosModules.sops
-    ../../modules/common
-    ../../modules/boot/bootloader.nix
+    ../../modules
     (import ../../modules/disko/zfs-encrypted-root.nix {
       inherit lib config;
       device = "/dev/nvme0n1";
     })
-    ../../modules/ai-tools
-    ../../modules/anki
-    ../../modules/audio
-    ../../modules/backups
-    ../../modules/bluetooth
-    ../../modules/desktops/niri
-    ../../modules/docker
-    ../../modules/firewall
-    ../../modules/fonts
-    ../../modules/git
-    ../../modules/keyboard
-    ../../modules/localization
-    ../../modules/networking
-    ../../modules/nfc
-    ../../modules/secrets
-    ../../modules/ssh
-    ../../modules/storage
-    ../../modules/stylix
-    ../../modules/tailscale
-    ../../modules/taskwarrior
-    ../../modules/users
-    ../../modules/yubikey
   ];
 
+  inherit (meta) host;
+
+  hardware.facter.reportPath = ./facter.json;
   home-manager.users.${config.host.username} = import ../../home/hosts/${config.host.name};
 
-  secrets.nixSigningKey.enable = true;
+  "ai-tools".enable = true;
+  anki.enable = true;
+  audio.enable = true;
+  bluetooth.enable = true;
+  bootloader.enable = true;
+  desktop.niri.enable = true;
+  git.enable = true;
+  keyboard.enable = true;
+  localization.enable = true;
+  my = {
+    fonts.enable = true;
+    stylix.enable = true;
+    users.enable = true;
+    yubikey = {
+      enable = true;
+      pam.enable = false;
+    };
+  };
+  networking.enable = true;
+  secrets.enable = true;
+  ssh.enable = true;
+  storage.enable = true;
+  taskwarrior.enable = true;
 
+  secrets.nixSigningKey.enable = true;
   restic-backup.enable = true;
   tailscale.enable = true;
+  desktop.ly.enable = true;
   docker.enable = true;
   nfc.enable = true;
-  desktop.ly.enable = true;
-  audio.automation.enable = true;
+
+  firewall = {
+    enable = true;
+    allowedTCPPorts = [ 22 ];
+  };
 
   hardware = {
     cpu.intel.updateMicrocode = true;
@@ -66,6 +71,7 @@ in
       extraPackages = with pkgs; [
         intel-media-driver
         vpl-gpu-rt
+        intel-compute-runtime
       ];
     };
   };
@@ -81,27 +87,24 @@ in
       name = "wol-andromache";
       runtimeInputs = [ pkgs.wakeonlan ];
       text = ''
-        wakeonlan ${wolInterfaces.eno1.macAddress}
+        wakeonlan ${(import ../andromache/wol-interfaces.nix).eno1.macAddress}
       '';
     })
   ];
 
   networking = {
     hostId = "80eef97e";
+    useDHCP = false;
+    useNetworkd = true;
   };
 
-  firewall = {
-    enable = true;
-    allowedTCPPorts = [ 22 ];
+  systemd.network.networks."40-wlan0" = {
+    matchConfig.Name = "wlan0";
+    networkConfig.DHCP = "yes";
   };
 
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 
-  my.yubikey = {
-    enable = true;
-    pam.enable = false;
-  };
-
   services = {
     fwupd.enable = true;
     locate = {

hosts/astyanax/hard.nix

@@ -1,39 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot = {
-    initrd.availableKernelModules = [
-      "xhci_pci"
-      "thunderbolt"
-      "nvme"
-      "uas"
-      "sd_mod"
-    ];
-    initrd.kernelModules = [ ];
-    kernelModules = [ "kvm-intel" ];
-    extraModulePackages = [ ];
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/astyanax/host.nix

@@ -1,7 +0,0 @@
-{
-  host = {
-    username = "h";
-    highRam = true;
-    admin = true;
-  };
-}

hosts/astyanax/meta.nix

@@ -1,9 +1,10 @@
 {
   system = "x86_64-linux";
-  deployment = {
-    tags = [ "local" ];
-    targetHost = "";
-    targetUser = "h";
-  };
   role = "laptop";
+  tags = [ "local" ];
+  host = {
+    username = "h";
+    highRam = true;
+    admin = true;
+  };
 }

hosts/eetion-02/default.nix

@@ -3,14 +3,19 @@
 # Raspberry Pi 3
 # See <https://nixos.wiki/wiki/NixOS_on_ARM/Raspberry_Pi_3>
 
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     ./hard.nix
-    ./host.nix
-    ../../modules/common
-    ../../modules/ssh
+    ../../modules
   ];
 
+  inherit (meta) host;
+
+  ssh.enable = true;
+
   boot = {
     kernelParams = [
       "console=ttyS1,115200n8"

hosts/eetion-02/host.nix

@@ -1,5 +0,0 @@
-{
-  host = {
-    username = "h";
-  };
-}

hosts/eetion-02/meta.nix

@@ -1,9 +1,8 @@
 {
   system = "aarch64-linux";
-  deployment = {
-    tags = [ "arm" ];
-    targetHost = "eetion-02";
-    targetUser = "h";
-  };
   role = "embedded";
+  tags = [ "arm" ];
+  host = {
+    username = "h";
+  };
 }

hosts/eetion/default.nix

@@ -3,16 +3,18 @@
 # Orange Pi Zero2 H616
 # See <https://nixos.wiki/wiki/NixOS_on_ARM/Orange_Pi_Zero2_H616>
 
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     ./hard.nix
-    ./host.nix
-    ../../modules/common
-    ../../modules/ssh
-    ../../modules/tailscale
-    # ../../modules/uptime-kuma
+    ../../modules
   ];
 
+  inherit (meta) host;
+
+  ssh.enable = true;
   tailscale.enable = true;
 
   boot.loader = {

hosts/eetion/host.nix

@@ -1,5 +0,0 @@
-{
-  host = {
-    username = "h";
-  };
-}

hosts/eetion/meta.nix

@@ -1,9 +1,8 @@
 {
   system = "aarch64-linux";
-  deployment = {
-    tags = [ "arm" ];
-    targetHost = "eetion";
-    targetUser = "h";
-  };
   role = "embedded";
+  tags = [ "arm" ];
+  host = {
+    username = "h";
+  };
 }

hosts/hecuba/default.nix

@@ -5,20 +5,28 @@
   ...
 }:
 
-# Also see <https://wiki.nixos.org/wiki/Install_NixOS_on_Hetzner_Cloud>
+# also see <https://wiki.nixos.org/wiki/Install_NixOS_on_Hetzner_Cloud>
 
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     inputs.disko.nixosModules.disko
-    ./hard.nix
-    ./host.nix
-    ../../modules/common
-    ../../modules/ssh
-    ../../modules/docker
+    "${inputs.nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
+    inputs.comin.nixosModules.comin
+    ../../modules
   ];
 
-  networking.hostName = config.host.name;
+  inherit (meta) host;
+
+  hardware.facter.reportPath = ./facter.json;
+
   docker.enable = true;
+  ssh.enable = true;
+  tailscale.enable = true;
+
+  networking.hostName = config.host.name;
 
   fileSystems."/" = {
     device = "/dev/disk/by-label/nixos";
@@ -61,8 +69,21 @@
     kitty.terminfo
   ];
 
-  services.fail2ban = {
-    enable = true;
-    maxretry = 5;
+  services = {
+    comin = {
+      enable = false;
+      machineId = "4c0a7f7726a845859ce9375e88b87642";
+      remotes = [
+        {
+          name = "origin";
+          url = "https://git.hektormisplon.xyz/hektor/nix";
+          branches.main.name = "main";
+        }
+      ];
+    };
+    fail2ban = {
+      enable = true;
+      maxretry = 5;
+    };
   };
 }

hosts/hecuba/hard.nix

@@ -1,39 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  boot = {
-    initrd = {
-      availableKernelModules = [
-        "ahci"
-        "xhci_pci"
-        "virtio_pci"
-        "virtio_scsi"
-        "sd_mod"
-        "sr_mod"
-      ];
-      kernelModules = [ ];
-    };
-    kernelModules = [ ];
-    extraModulePackages = [ ];
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

hosts/hecuba/host.nix

@@ -1,5 +0,0 @@
-{
-  host = {
-    username = "username";
-  };
-}

hosts/hecuba/meta.nix

@@ -1,9 +1,8 @@
 {
   system = "x86_64-linux";
-  deployment = {
-    tags = [ "cloud" ];
-    targetHost = "server.hektormisplon.xyz";
-    targetUser = "username";
-  };
   role = "server";
+  tags = [ "cloud" ];
+  host = {
+    username = "username";
+  };
 }

hosts/vm/default.nix

@@ -3,33 +3,41 @@
   config,
   ...
 }:
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     inputs.disko.nixosModules.disko
-    ./hard.nix
-    ./host.nix
+    "${inputs.nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
     ./disk.nix
-    ../../modules/common
-    ../../modules/anki
-    ../../modules/audio
-    ../../modules/boot/bootloader.nix
-    ../../modules/fonts
-    ../../modules/git
-    ../../modules/keyboard
-    ../../modules/localization
-    ../../modules/networking
-    ../../modules/ai-tools
-    ../../modules/ssh
-    ../../modules/storage
-    ../../modules/stylix
-    ../../modules/secrets
-    ../../modules/taskwarrior
-    ../../modules/users
-    ../../modules/x
+    ../../modules
   ];
 
+  inherit (meta) host;
+
+  hardware.facter.reportPath = ./facter.json;
   home-manager.users.${config.host.username} = import ../../home/hosts/vm;
 
+  "ai-tools".enable = true;
+  anki.enable = true;
+  audio.enable = true;
+  bootloader.enable = true;
+  desktop.x.enable = true;
+  git.enable = true;
+  keyboard.enable = true;
+  localization.enable = true;
+  my = {
+    fonts.enable = true;
+    stylix.enable = true;
+    users.enable = true;
+  };
+  networking.enable = true;
+  secrets.enable = true;
+  ssh.enable = true;
+  storage.enable = true;
+  taskwarrior.enable = true;
+
   disko = {
     devices.disk.main = {
       device = "/dev/vda";

hosts/vm/hard.nix

@@ -1,38 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  boot = {
-    initrd = {
-      availableKernelModules = [
-        "ahci"
-        "xhci_pci"
-        "virtio_pci"
-        "sr_mod"
-        "virtio_blk"
-      ];
-      kernelModules = [ ];
-    };
-    kernelModules = [ "kvm-intel" ];
-    extraModulePackages = [ ];
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

hosts/vm/host.nix

@@ -1,5 +0,0 @@
-{
-  host = {
-    username = "h";
-  };
-}

hosts/vm/meta.nix

@@ -1,9 +1,8 @@
 {
   system = "x86_64-linux";
-  deployment = {
-    tags = [ "local" ];
-    targetHost = "";
-    targetUser = "h";
-  };
   role = "vm";
+  tags = [ "local" ];
+  host = {
+    username = "h";
+  };
 }

images/sd-image-orange-pi-aarch64.nix

@@ -37,5 +37,6 @@ in
 
   security.sudo.wheelNeedsPassword = false;
 
+  boot.zfs.forceImportRoot = false;
   system.stateVersion = "26.05";
 }

images/sd-image-raspberry-pi-aarch64.nix

@@ -21,13 +21,11 @@ in
     name = "raspberry-pi";
   };
 
-  boot.kernelParams = [
-    "console=ttyS1,115200n8"
-  ];
-
-  boot.kernelModules = [
-    "bcm2835-v4l2"
-  ];
+  boot = {
+    kernelParams = [ "console=ttyS1,115200n8" ];
+    kernelModules = [ "bcm2835-v4l2" ];
+    zfs.forceImportRoot = false;
+  };
 
   hardware.enableRedistributableFirmware = true;