refactor: simplify apps.colmena

Flake lock file updates:

• Updated input 'firefox-addons':
    'gitlab:rycee/nur-expressions/c7794d3f46304de5234008c31b5b28a9d5709184?dir=pkgs/firefox-addons&narHash=sha256-0iGDl/ct3rW%2Bh6%2BsLq4RZaze/U/aQo2L5sLLuyjuVTk%3D' (2026-02-04)
  → 'gitlab:rycee/nur-expressions/65d59f814068d04e532cad2773d281e4951acd95?dir=pkgs/firefox-addons&narHash=sha256-%2BFHN9EthS%2BkHxnMoSDZEiGLoxwiIuij6ltK3aTmlLMA%3D' (2026-02-07)
• Updated input 'home-manager':
    'github:nix-community/home-manager/04e5203db66417d548ae1ff188a9f591836dfaa7?narHash=sha256-R1WFtIvp38hS9x63dnijdJw1KyIiy30KGea6e6N7LHs%3D' (2026-02-05)
  → 'github:nix-community/home-manager/6cee0821577643e0b34e2c5d9a90d0b1b5cdca70?narHash=sha256-cyxgVsNfHnJ4Zn6G1EOzfTXbjTy7Ds9zMOsZaX7VZWs%3D' (2026-02-07)
• Updated input 'nvim':
    'path:./dots/.config/nvim'
  → 'path:./dots/.config/nvim'

README.md

@@ -1,15 +1,27 @@
 # NixOS flake
 
-## Set up virtual machine ([`disko`](https://github.com/nix-community/disko/blob/master/docs/interactive-vm.md))
+## hosts
 
-1. Build the virtual machine
+### NixOS
+
+```
+nixos-rebuild switch --flake .#<hostname>
+```
+
+### home manager
+
+```
+home-manager switch --flake .#work
+```
+
+### virtual machines
 
 ```
 nix build -L '.#nixosConfigurations.vm.config.system.build.vmWithDisko'
-```
-
-2. Run the virtual machine
-
-```
 ./result/bin/disko-vm
 ```
+
+## docs
+
+* [deploy using colmena](./deploy/README.md)
+* [SD installer images](./images/README.md)

deploy/colmena.nix

@@ -17,7 +17,7 @@ in
 inputs.colmena.lib.makeHive {
   meta = {
     nixpkgs = import inputs.nixpkgs {
-      system = "x86_64-linux";
+      localSystem = "x86_64-linux";
     };
 
     nodeNixpkgs = builtins.mapAttrs (_: v: v.pkgs) self.nixosConfigurations;

dots/.bashrc

@@ -103,13 +103,6 @@ if [[ -z "${SSH_CONNECTION}" ]]; then
 fi
 # }}}
 
-# pnpm
-export PNPM_HOME="/home/h/.local/share/pnpm"
-case ":$PATH:" in
-  *":$PNPM_HOME:"*) ;;
-  *) export PATH="$PNPM_HOME:$PATH" ;;
-esac
-# pnpm end
 
 # Codi
 # Usage: codi [filetype] [filename]

dots/.bin/sb-pomo

@@ -1,3 +1,3 @@
 #!/usr/bin/env bash
 
-[ -f "/tmp/pomo" ] && cat /tmp/pomo || echo ""
+[ -f "/home/h/.local/share/pomo" ] && cat /home/h/.local/share/pomo || echo ""

dots/.bin/update-vim

@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-
-# Tiny Vim update helper
-
-nvim +PlugUpgrade +PlugUpdate +CocUpdate

dots/.config/ncspot/config.toml

@@ -1,5 +1,6 @@
 default_keybindings = false
 flip_status_indicators = true
+library_tabs = ["tracks", "albums", "artists", "playlists", "browse"] # remove podcasts tab
 
 [keybindings]
 "Enter" = "play"
@@ -24,11 +25,10 @@ flip_status_indicators = true
 "c" = "clear"
 "=" = "volup 1"
 "-" = "voldown 1"
-"/" = "focus search"
-"Q" = "focus queue"
-# "L" = "focus library"
 "1" = "focus queue"
-"2" = "focus library"
+"2" = "focus search"
+"3" = "focus library"
+"4" = "focus cover"
 "h" = "move left 1"
 "j" = "move down 1"
 "k" = "move up 1"

dots/.config/nvim/after/plugin/lspconfig.lua

@@ -85,6 +85,7 @@ local servers = {
       },
     },
   },
+  openscad_ls = {},
   pyright = {},
   -- tsserver = {},
   svelte = {

dots/.config/nvim/flake.nix

@@ -37,7 +37,6 @@
 
   outputs =
     {
-      self,
       nixpkgs,
       nixCats,
       ...
@@ -50,7 +49,7 @@
 
       mkDependencyOverlays = system: [
         (utils.standardPluginOverlay inputs)
-        (final: prev: {
+        (_final: _prev: {
           mcp-hub = inputs.mcp-hub.packages.${system}.default;
         })
       ];

dots/.config/nvim/lua/skeleton/init.lua

@@ -2,10 +2,10 @@ local autocmd = vim.api.nvim_create_autocmd
 
 autocmd("BufNewFile", {
   pattern = "shell.nix",
-  command = "0r ~/.config/nvim/skeletons/shell.nix",
+  command = "0r ~/.config/nvim/skeletons/shell.nix.skeleton",
 })
 
 autocmd("BufNewFile", {
   pattern = "flake.nix",
-  command = "0r ~/.config/nvim/skeletons/flake.nix",
+  command = "0r ~/.config/nvim/skeletons/flake.nix.skeleton",
 })

dots/.config/tmux/tmux.regular.conf

@@ -1 +0,0 @@
-set  -g status-style bg=default

flake.lock

@@ -121,11 +121,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1771041825,
-        "narHash": "sha256-O+wN3O4yXWsNZBS7qG32fg0UnecVzDAr3aQNz/nT38s=",
+        "lastModified": 1771732978,
+        "narHash": "sha256-o7gZh/eXFkEEmzwlBdIbgCJhmdlqQhOhVjudqgsIefg=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "03e6c3789a1952bd68837ff1d358375b953d35e8",
+        "rev": "18226106e18bc40cce99d436ee741a946f1888f6",
         "type": "gitlab"
       },
       "original": {
@@ -284,11 +284,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770726378,
-        "narHash": "sha256-kck+vIbGOaM/dHea7aTBxdFYpeUl/jHOy5W3eyRvVx8=",
+        "lastModified": 1771857445,
+        "narHash": "sha256-NCrhxU9wq5+4jQG1fvRbyTnH8GSbH6LovreVoH2fOL4=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "5eaaedde414f6eb1aea8b8525c466dc37bba95ae",
+        "rev": "3d7a52f678227930ab089f5d9b384f2d50f7d534",
         "type": "github"
       },
       "original": {
@@ -344,11 +344,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1771037579,
-        "narHash": "sha256-NX5XuhGcsmk0oEII2PEtMRgvh2KaAv3/WWQsOpxAgR4=",
+        "lastModified": 1771851181,
+        "narHash": "sha256-gFgE6mGUftwseV3DUENMb0k0EiHd739lZexPo5O/sdQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "05e6dc0f6ed936f918cb6f0f21f1dad1e4c53150",
+        "rev": "9a4b494b1aa1b93d8edf167f46dc8e0c0011280c",
         "type": "github"
       },
       "original": {
@@ -376,29 +376,6 @@
         "type": "github"
       }
     },
-    "nix-formatter-pack": {
-      "inputs": {
-        "nixpkgs": [
-          "nix-on-droid",
-          "nixpkgs"
-        ],
-        "nmd": "nmd",
-        "nmt": "nmt"
-      },
-      "locked": {
-        "lastModified": 1705252799,
-        "narHash": "sha256-HgSTREh7VoXjGgNDwKQUYcYo13rPkltW7IitHrTPA5c=",
-        "owner": "Gerschtli",
-        "repo": "nix-formatter-pack",
-        "rev": "2de39dedd79aab14c01b9e2934842051a160ffa5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Gerschtli",
-        "repo": "nix-formatter-pack",
-        "type": "github"
-      }
-    },
     "nix-github-actions": {
       "inputs": {
         "nixpkgs": [
@@ -420,34 +397,6 @@
         "type": "github"
       }
     },
-    "nix-on-droid": {
-      "inputs": {
-        "home-manager": [
-          "home-manager"
-        ],
-        "nix-formatter-pack": "nix-formatter-pack",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "nixpkgs-docs": "nixpkgs-docs",
-        "nixpkgs-for-bootstrap": "nixpkgs-for-bootstrap",
-        "nmd": "nmd_2"
-      },
-      "locked": {
-        "lastModified": 1720396533,
-        "narHash": "sha256-UFzk/hZWO1VkciIO5UPaSpJN8s765wsngUSvtJM6d5Q=",
-        "owner": "nix-community",
-        "repo": "nix-on-droid",
-        "rev": "f3d3b8294039f2f9a8fb7ea82c320f29c6b0fe25",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "release-24.05",
-        "repo": "nix-on-droid",
-        "type": "github"
-      }
-    },
     "nix-secrets": {
       "flake": false,
       "locked": {
@@ -468,11 +417,11 @@
     },
     "nixCats": {
       "locked": {
-        "lastModified": 1769578476,
-        "narHash": "sha256-4+KbiBcC6hQ3sh0UbPXjy6TOfLh9yhskRlfPzyZ2FH4=",
+        "lastModified": 1770584904,
+        "narHash": "sha256-9Zaz8lbKF2W9pwXZEnbiGsicHdBoU+dHt3Wv3mCJoZ8=",
         "owner": "BirdeeHub",
         "repo": "nixCats-nvim",
-        "rev": "48f8be4bdafccfa19ceaaf08071a15eca36fdb1d",
+        "rev": "538fdde784d2909700d97a8ef307783b33a86fb1",
         "type": "github"
       },
       "original": {
@@ -504,11 +453,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1770882871,
-        "narHash": "sha256-nw5g+xl3veea+maxJ2/81tMEA/rPq9aF1H5XF35X+OE=",
+        "lastModified": 1771423359,
+        "narHash": "sha256-yRKJ7gpVmXbX2ZcA8nFi6CMPkJXZGjie2unsiMzj3Ig=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "af04cb78aa85b2a4d1c15fc7270347e0d0eda97b",
+        "rev": "740a22363033e9f1bb6270fbfb5a9574067af15b",
         "type": "github"
       },
       "original": {
@@ -520,11 +469,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771008912,
-        "narHash": "sha256-gf2AmWVTs8lEq7z/3ZAsgnZDhWIckkb+ZnAo5RzSxJg=",
+        "lastModified": 1771369470,
+        "narHash": "sha256-0NBlEBKkN3lufyvFegY4TYv5mCNHbi5OmBDrzihbBMQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "a82ccc39b39b621151d6732718e3e250109076fa",
+        "rev": "0182a361324364ae3f436a63005877674cf45efb",
         "type": "github"
       },
       "original": {
@@ -534,38 +483,6 @@
         "type": "github"
       }
     },
-    "nixpkgs-docs": {
-      "locked": {
-        "lastModified": 1705957679,
-        "narHash": "sha256-Q8LJaVZGJ9wo33wBafvZSzapYsjOaNjP/pOnSiKVGHY=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "9a333eaa80901efe01df07eade2c16d183761fa3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "release-23.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-for-bootstrap": {
-      "locked": {
-        "lastModified": 1720244366,
-        "narHash": "sha256-WrDV0FPMVd2Sq9hkR5LNHudS3OSMmUrs90JUTN+MXpA=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "49ee0e94463abada1de470c9c07bfc12b36dcf40",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "49ee0e94463abada1de470c9c07bfc12b36dcf40",
-        "type": "github"
-      }
-    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1743689281,
@@ -582,60 +499,6 @@
         "type": "github"
       }
     },
-    "nmd": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1666190571,
-        "narHash": "sha256-Z1hc7M9X6L+H83o9vOprijpzhTfOBjd0KmUTnpHAVjA=",
-        "owner": "rycee",
-        "repo": "nmd",
-        "rev": "b75d312b4f33bd3294cd8ae5c2ca8c6da2afc169",
-        "type": "gitlab"
-      },
-      "original": {
-        "owner": "rycee",
-        "repo": "nmd",
-        "type": "gitlab"
-      }
-    },
-    "nmd_2": {
-      "inputs": {
-        "nixpkgs": [
-          "nix-on-droid",
-          "nixpkgs-docs"
-        ],
-        "scss-reset": "scss-reset"
-      },
-      "locked": {
-        "lastModified": 1705050560,
-        "narHash": "sha256-x3zzcdvhJpodsmdjqB4t5mkVW22V3wqHLOun0KRBzUI=",
-        "owner": "~rycee",
-        "repo": "nmd",
-        "rev": "66d9334933119c36f91a78d565c152a4fdc8d3d3",
-        "type": "sourcehut"
-      },
-      "original": {
-        "owner": "~rycee",
-        "repo": "nmd",
-        "type": "sourcehut"
-      }
-    },
-    "nmt": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1648075362,
-        "narHash": "sha256-u36WgzoA84dMVsGXzml4wZ5ckGgfnvS0ryzo/3zn/Pc=",
-        "owner": "rycee",
-        "repo": "nmt",
-        "rev": "d83601002c99b78c89ea80e5e6ba21addcfe12ae",
-        "type": "gitlab"
-      },
-      "original": {
-        "owner": "rycee",
-        "repo": "nmt",
-        "type": "gitlab"
-      }
-    },
     "nur": {
       "inputs": {
         "flake-parts": [
@@ -670,7 +533,6 @@
         ],
         "plugins-beancount-nvim": "plugins-beancount-nvim",
         "plugins-helm-ls-nvim": "plugins-helm-ls-nvim",
-        "plugins-m-taskwarrior-d-nvim": "plugins-m-taskwarrior-d-nvim",
         "plugins-mcphub-nvim": "plugins-mcphub-nvim",
         "plugins-nvimkit-nvim": "plugins-nvimkit-nvim",
         "plugins-shipwright-nvim": "plugins-shipwright-nvim",
@@ -718,22 +580,6 @@
         "type": "github"
       }
     },
-    "plugins-m-taskwarrior-d-nvim": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1767960157,
-        "narHash": "sha256-ov0qi4LhIlwqrBzSbTJ6APC5qjl2d/vlKWJfW5ZiDrg=",
-        "owner": "huantrinh1802",
-        "repo": "m_taskwarrior_d.nvim",
-        "rev": "107247387cd81823046bc2b8e71150c8edf041d3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "huantrinh1802",
-        "repo": "m_taskwarrior_d.nvim",
-        "type": "github"
-      }
-    },
     "plugins-mcphub-nvim": {
       "flake": false,
       "locked": {
@@ -805,7 +651,6 @@
         "firefox-addons": "firefox-addons",
         "git-hooks": "git-hooks",
         "home-manager": "home-manager",
-        "nix-on-droid": "nix-on-droid",
         "nix-secrets": "nix-secrets",
         "nixgl": "nixgl",
         "nixos-hardware": "nixos-hardware",
@@ -815,22 +660,6 @@
         "stylix": "stylix"
       }
     },
-    "scss-reset": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1631450058,
-        "narHash": "sha256-muDlZJPtXDIGevSEWkicPP0HQ6VtucbkMNygpGlBEUM=",
-        "owner": "andreymatin",
-        "repo": "scss-reset",
-        "rev": "0cf50e27a4e95e9bb5b1715eedf9c54dee1a5a91",
-        "type": "github"
-      },
-      "original": {
-        "owner": "andreymatin",
-        "repo": "scss-reset",
-        "type": "github"
-      }
-    },
     "sops-nix": {
       "inputs": {
         "nixpkgs": [
@@ -838,11 +667,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770683991,
-        "narHash": "sha256-xVfPvXDf9QN3Eh9dV+Lw6IkWG42KSuQ1u2260HKvpnc=",
+        "lastModified": 1771735105,
+        "narHash": "sha256-MJuVJeszZEziquykEHh/hmgIHYxUcuoG/1aowpLiSeU=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "8b89f44c2cc4581e402111d928869fe7ba9f7033",
+        "rev": "d7755d820f5fa8acf7f223309c33e25d4f92e74f",
         "type": "github"
       },
       "original": {
@@ -888,11 +717,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1770914701,
-        "narHash": "sha256-QHFYyngohNhih4w+3IqQty5DV+p1txsx1kkk6XJWar8=",
+        "lastModified": 1771787992,
+        "narHash": "sha256-Vg4bGwwenNYI8p3nJTl9FRyeIyrjATeZrZr+GyUSDrw=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "db03fed72e5ca02be34e1d24789345a943329738",
+        "rev": "30054cca073b49b42a71289edec858f535b27fe9",
         "type": "github"
       },
       "original": {

flake.nix

@@ -26,11 +26,6 @@
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    nix-on-droid = {
-      url = "github:nix-community/nix-on-droid/release-24.05";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.home-manager.follows = "home-manager";
-    };
     nixgl = {
       url = "github:nix-community/nixGL";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -58,10 +53,8 @@
       self,
       nixpkgs,
       home-manager,
-      nix-on-droid,
       nixgl,
       git-hooks,
-      colmena,
       ...
     }@inputs:
     let
@@ -84,23 +77,36 @@
         (lib.genAttrs hostDirNames (
           host:
           nixpkgs.lib.nixosSystem {
-            system = import ./hosts/${host}/system.nix;
-            modules = [ ./hosts/${host} ];
+            modules = [
+              ./hosts/${host}
+              { nixpkgs.hostPlatform = import ./hosts/${host}/system.nix; }
+            ];
             specialArgs = {
               inherit inputs outputs dotsPath;
             };
           }
         ))
         // {
-          sd-image-aarch64 = nixpkgs.lib.nixosSystem {
-            system = "x86_64-linux";
+          sd-image-orange-pi-aarch64 = nixpkgs.lib.nixosSystem {
             modules = [
               "${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
-              ./images/sd-image-aarch64.nix
+              ./images/sd-image-orange-pi-aarch64.nix
               {
-                nixpkgs.crossSystem = {
-                  system = "aarch64-linux";
-                };
+                nixpkgs.buildPlatform = "x86_64-linux";
+                nixpkgs.hostPlatform = "aarch64-linux";
+              }
+            ];
+            specialArgs = {
+              inherit inputs outputs dotsPath;
+            };
+          };
+          sd-image-raspberry-pi-aarch64 = nixpkgs.lib.nixosSystem {
+            modules = [
+              "${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
+              ./images/sd-image-raspberry-pi-aarch64.nix
+              {
+                nixpkgs.buildPlatform = "x86_64-linux";
+                nixpkgs.hostPlatform = "aarch64-linux";
               }
             ];
             specialArgs = {
@@ -108,6 +114,7 @@
             };
           };
         };
+
       homeConfigurations = {
         work = home-manager.lib.homeManagerConfiguration {
           pkgs = import nixpkgs {
@@ -120,23 +127,10 @@
           };
         };
       };
-      # https://github.com/nix-community/nix-on-droid/blob/master/templates/advanced/flake.nix
-      nixOnDroidConfigurations = {
-        pixel = nix-on-droid.lib.nixOnDroidConfiguration {
-          modules = [ ./phone ];
-          extraSpecialArgs = {
-            inherit inputs outputs dotsPath;
-          };
-          pkgs = import nixpkgs {
-            system = "aarch64-linux";
-            overlays = [ nix-on-droid.overlays.default ];
-          };
-          home-manager-path = home-manager.outPath;
-        };
-      };
 
       apps.${system}.colmena = inputs.colmena.apps.${system}.default;
-      colmenaHive = import ./deploy/colmena.nix {
+
+      colmena = import ./deploy/colmena.nix {
         inherit
           self
           inputs
@@ -147,6 +141,11 @@
       formatter.${system} = gitHooks.formatter;
       devShells.${system} = gitHooks.devShells;
 
-      images.sd-image-aarch64 = self.nixosConfigurations.sd-image-aarch64.config.system.build.sdImage;
+      legacyPackages.${system} = {
+        sd-image-orange-pi-aarch64 =
+          self.nixosConfigurations.sd-image-orange-pi-aarch64.config.system.build.sdImage;
+        sd-image-raspberry-pi-aarch64 =
+          self.nixosConfigurations.sd-image-raspberry-pi-aarch64.config.system.build.sdImage;
+      };
     };
 }

git-hooks.nix

@@ -10,7 +10,10 @@ let
   pre-commit-check = git-hooks.lib.${system}.run {
     inherit src;
     hooks = {
-      nixfmt.enable = true;
+      nixfmt = {
+        enable = true;
+        package = pkgs.nixfmt;
+      };
       statix.enable = true;
       deadnix.enable = true;
     };

home/hosts/andromache/default.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  inputs,
   config,
   pkgs,
   ...
@@ -11,7 +10,9 @@ let
 in
 {
   imports = [
+    ../../modules
     ../../modules/ai-tools.nix
+    ../../modules/audio
     ../../modules/cloud
     ../../modules/comms
     ../../modules/desktop/niri
@@ -22,6 +23,7 @@ in
     ../../modules/kitty.nix
     ../../modules/music
     ../../modules/nvim.nix
+    ../../modules/pandoc.nix
     ../../modules/ssh.nix
     ../../modules/taskwarrior.nix
     ../../modules/keepassxc.nix
@@ -45,6 +47,7 @@ in
   cloud.hetzner.enable = true;
   comms.signal.enable = true;
   github.enable = true;
+  pandoc.enable = true;
 
   shell.bash = {
     enable = true;

home/hosts/astyanax/default.nix

@@ -9,7 +9,9 @@ let
 in
 {
   imports = [
+    ../../modules
     ../../modules/ai-tools.nix
+    ../../modules/audio
     ../../modules/anki.nix
     ../../modules/cloud
     ../../modules/comms
@@ -21,6 +23,7 @@ in
     ../../modules/music
     ../../modules/nfc
     ../../modules/nvim.nix
+    ../../modules/pandoc.nix
     ../../modules/ssh.nix
     ../../modules/taskwarrior.nix
     ../../modules/keepassxc.nix
@@ -43,6 +46,7 @@ in
   comms.signal.enable = true;
   github.enable = true;
   nfc.proxmark3.enable = true;
+  pandoc.enable = true;
 
   shell.bash = {
     enable = true;

home/hosts/packages.nix

@@ -6,17 +6,12 @@ with pkgs;
   entr
   feh
   fzf
-  haskellPackages.pandoc-crossref
   htop
   jq
-  nixfmt-rfc-style
   nmap
-  nodejs_24
   nvimpager
-  pandoc
   parallel
   pass
-  pnpm
   ripgrep
   silver-searcher
   sops

home/hosts/work/default.nix

@@ -11,25 +11,31 @@ in
 {
   imports = [
     inputs.sops-nix.homeManagerModules.sops
+    ../../modules
     ../../modules/stylix.nix
-    ../../modules/lib.nix
     ../../modules/ai-tools.nix
     ../../modules/cloud
     ../../modules/comms
+    ../../modules/desktop/niri
     ../../modules/dconf.nix
     ../../modules/direnv
     ../../modules/docker
     ../../modules/git
+    ../../modules/go
     ../../modules/k8s
     ../../modules/k8s/k9s.nix
     ../../modules/keepassxc.nix
     ../../modules/kitty.nix
     ../../modules/nvim.nix
+    ../../modules/pandoc.nix
     ../../modules/browser
     ../../modules/shell
     ../../modules/music
+    ../../modules/nodejs.nix
     ../../modules/taskwarrior.nix
     ../../modules/bruno.nix
+    ../../modules/pandoc.nix
+    ../../modules/vscode.nix
   ];
 
   sops = {
@@ -42,14 +48,29 @@ in
       taskwarrior_sync_encryption_secret = { };
       anki_sync_user = { };
       anki_sync_key = { };
+      opencode_api_key = { };
     };
 
-    templates."taskrc.d/sync" = {
-      content = ''
-        sync.server.url=${config.sops.placeholder.taskwarrior_sync_server_url}
-        sync.server.client_id=${config.sops.placeholder.taskwarrior_sync_server_client_id}
-        sync.encryption_secret=${config.sops.placeholder.taskwarrior_sync_encryption_secret}
-      '';
+    templates = {
+      "taskrc.d/sync" = {
+        content = ''
+          sync.server.url=${config.sops.placeholder.taskwarrior_sync_server_url}
+          sync.server.client_id=${config.sops.placeholder.taskwarrior_sync_server_client_id}
+          sync.encryption_secret=${config.sops.placeholder.taskwarrior_sync_encryption_secret}
+        '';
+      };
+
+      "opencode/auth.json" = {
+        path = "${config.home.homeDirectory}/.local/share/opencode/auth.json";
+        content = ''
+          {
+            "zai-coding-plan": {
+              "type": "api",
+              "key": "${config.sops.placeholder.opencode_api_key}"
+            }
+          }
+        '';
+      };
     };
   };
 
@@ -71,9 +92,13 @@ in
   cloud.azure.enable = true;
   comms.signal.enable = true;
   comms.teams.enable = true;
-  ai-tools.claude-code.enable = true;
+  ai-tools = {
+    claude-code.enable = true;
+    opencode.enable = true;
+  };
   github.enable = true;
   gitlab.enable = true;
+  pandoc.enable = true;
 
   shell.bash.enable = true;
   starship.enable = true;

home/modules/ai-tools.nix

@@ -74,6 +74,16 @@ in
       home.packages = with pkgs; [
         opencode
       ];
+      home.file.".config/opencode/opencode.json".text = builtins.toJSON {
+        "$schema" = "https://opencode.ai/config.json";
+        permission = {
+          external_directory = {
+            "/run/secrets/" = "deny";
+            "~/.config/sops/age/keys.txt" = "deny";
+          };
+        };
+        plugin = [ "@mohak34/opencode-notifier@latest" ];
+      };
     })
   ];
 }

home/modules/audio/default.nix

@@ -0,0 +1,5 @@
+{ pkgs, ... }:
+
+{
+  home.packages = with pkgs; [ pulsemixer ];
+}

home/modules/browser/firefox-base.nix

@@ -1,7 +1,9 @@
 {
   config,
   inputs,
+  lib,
   pkgs,
+  ...
 }:
 
 let
@@ -24,7 +26,7 @@ in
       };
       extensions = {
         force = true;
-        packages = with inputs.firefox-addons.packages.${pkgs.system}; [
+        packages = with inputs.firefox-addons.packages.${pkgs.stdenv.hostPlatform.system}; [
           duckduckgo-privacy-essentials
           firefox-color
           istilldontcareaboutcookies

home/modules/browser/firefox.nix

@@ -11,6 +11,13 @@
     programs.firefox = {
       enable = true;
     }
-    // (import ./firefox-base.nix { inherit config inputs pkgs; });
+    // (import ./firefox-base.nix {
+      inherit
+        config
+        inputs
+        lib
+        pkgs
+        ;
+    });
   };
 }

home/modules/browser/librewolf.nix

@@ -13,6 +13,13 @@
         programs.librewolf = {
           enable = true;
         }
-        // (import ./firefox-base.nix { inherit config inputs pkgs; });
+        // (import ./firefox-base.nix {
+          inherit
+            config
+            inputs
+            lib
+            pkgs
+            ;
+        });
       };
 }

home/modules/bruno.nix

@@ -1,19 +1,7 @@
 { config, pkgs, ... }:
 
-let
-  needsNixGL = config.lib ? nixGL;
-  bruno =
-    if needsNixGL then
-      pkgs.bruno.overrideAttrs (old: {
-        postInstall = (old.postInstall or "") + ''
-          wrapProgram $out/bin/bruno --add-flags "--no-sandbox"
-        '';
-      })
-    else
-      pkgs.bruno;
-in
 {
   config = {
-    home.packages = [ (config.nixgl.wrap bruno) ];
+    home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.bruno "--no-sandbox")) ];
   };
 }

home/modules/comms/signal.nix

@@ -4,8 +4,9 @@
   pkgs,
   ...
 }:
+
 {
   config = lib.mkIf config.comms.signal.enable {
-    home.packages = [ (config.nixgl.wrap pkgs.signal-desktop) ];
+    home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.signal-desktop "--no-sandbox")) ];
   };
 }

home/modules/comms/teams.nix

@@ -7,6 +7,6 @@
 
 {
   config = lib.mkIf config.comms.teams.enable {
-    home.packages = [ (config.nixgl.wrap pkgs.teams-for-linux) ];
+    home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.teams-for-linux "--no-sandbox")) ];
   };
 }

home/modules/default.nix

@@ -0,0 +1,24 @@
+{ config, lib, ... }:
+
+{
+  options.nixgl.wrap = lib.mkOption {
+    type = lib.types.functionTo lib.types.package;
+    default = if config.lib ? nixGL then config.lib.nixGL.wrap else lib.id;
+    readOnly = true;
+  };
+
+  options.wrapApp = lib.mkOption {
+    type = lib.types.raw;
+    default =
+      pkg: flags:
+      if config.lib ? nixGL then
+        pkg.overrideAttrs (old: {
+          postInstall = (old.postInstall or "") + ''
+            wrapProgram $out/bin/${pkg.meta.mainProgram} --add-flags "${flags}"
+          '';
+        })
+      else
+        pkg;
+    readOnly = true;
+  };
+}

home/modules/go/default.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  options.go = {
+    enable = lib.mkEnableOption "go language";
+  };
+
+  config = lib.mkIf config.go.enable {
+    home.packages = with pkgs; [
+      go
+      gopls
+    ];
+  };
+}

home/modules/keepassxc.nix

@@ -1,5 +1,3 @@
-{ pkgs, ... }:
-
 {
   programs.keepassxc = {
     enable = true;

home/modules/lib.nix

@@ -1,9 +0,0 @@
-{ config, lib, ... }:
-
-{
-  options.nixgl.wrap = lib.mkOption {
-    type = lib.types.functionTo lib.types.package;
-    default = if config.lib ? nixGL then config.lib.nixGL.wrap else lib.id;
-    readOnly = true;
-  };
-}

home/modules/mako/default.nix

@@ -1,10 +1,5 @@
-{ lib, ... }:
-
 {
   services.mako = {
     enable = true;
-    settings = {
-      border-color = lib.mkForce "#bbbbbb";
-    };
   };
 }

home/modules/nodejs.nix

@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  options.nodejs = {
+    enable = lib.mkEnableOption "nodejs (and related packages)";
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.nodejs_24;
+    };
+  };
+
+  config = lib.mkIf config.nodejs.enable {
+    home.packages = with pkgs; [
+      config.nodejs.package
+      pnpm
+      yarn
+      biome
+      tsx
+    ];
+  };
+}

home/modules/nvim.nix

@@ -3,7 +3,7 @@
 {
   config = {
     home.packages = [
-      inputs.nvim.packages.${pkgs.system}.nvim
+      inputs.nvim.packages.${pkgs.stdenv.hostPlatform.system}.nvim
     ];
   };
 }

home/modules/pandoc.nix

@@ -0,0 +1,19 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  options.pandoc = {
+    enable = lib.mkEnableOption "pandoc";
+  };
+
+  config = lib.mkIf config.pandoc.enable {
+    home.packages = with pkgs; [
+      haskellPackages.pandoc-crossref
+      pandoc
+      texliveSmall
+    ];
+  };
+}

home/modules/shell/bash.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   dotsPath,
   ...
 }:

home/modules/shell/prompt.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   ...
 }:
 {

home/modules/stylix.nix

@@ -5,24 +5,22 @@
   ...
 }:
 
+let
+  theme = import ../../modules/stylix/theme.nix { inherit pkgs; };
+in
 {
   imports = [ inputs.stylix.homeModules.stylix ];
 
   stylix = {
     enable = true;
-    polarity = "dark";
-    base16Scheme = ../../modules/stylix/zenwritten-dark.yaml;
-    override = {
-      base04 = "8E8E8E"; # improved contrast
-    };
-    image = pkgs.runCommand "solid-bg.png" { nativeBuildInputs = [ pkgs.imagemagick ]; } ''
-      magick -size 1x1 xc:#191919 $out
-    '';
+    inherit (theme)
+      polarity
+      base16Scheme
+      override
+      image
+      ;
     fonts = {
-      monospace = {
-        package = pkgs.iosevka-bin.override { variant = "SS08"; };
-        name = "Iosevka Term SS08";
-      };
+      monospace = theme.monospaceFont;
       serif = config.stylix.fonts.monospace;
       sansSerif = config.stylix.fonts.monospace;
       emoji = config.stylix.fonts.monospace;
@@ -32,6 +30,10 @@
         profileNames = [ "default" ];
         colorTheme.enable = true;
       };
+      librewolf = {
+        profileNames = [ "default" ];
+        colorTheme.enable = true;
+      };
       gnome.enable = false;
       gtk.enable = false;
       kitty = {

home/modules/tmux.nix

@@ -1,8 +1,5 @@
-{
-  pkgs,
-  dotsPath,
-  ...
-}:
+{ pkgs, dotsPath, ... }:
+
 {
   config = {
     home.packages = with pkgs; [
@@ -16,9 +13,7 @@
     };
 
     home.file = {
-      ".config/tmux/tmux.regular.conf".source = dotsPath + "/.config/tmux/tmux.regular.conf";
       ".config/tmux/hooks/tmux.ssh.conf".source = dotsPath + "/.config/tmux/hooks/tmux.ssh.conf";
-      ".config/tmux/hooks/tmux.regular.conf".source = dotsPath + "/.config/tmux/hooks/tmux.regular.conf";
     };
   };
 }

home/modules/vscode.nix

@@ -0,0 +1,7 @@
+{ config, pkgs, ... }:
+
+{
+  config = {
+    home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.vscode "--disable-gpu-sandbox")) ];
+  };
+}

home/modules/waybar/style.css

@@ -18,6 +18,7 @@ window#waybar.hidden {
 }
 
 #workspaces button {
+  color: @base07;
   padding: 0;
   background-color: transparent;
 }

hosts/andromache/default.nix

@@ -1,11 +1,11 @@
 {
   lib,
   inputs,
-  outputs,
   config,
   pkgs,
   ...
 }:
+
 let
   username = "h";
   hostName = "andromache";
@@ -28,6 +28,7 @@ in
     ../../modules/desktops/niri
     ../../modules/backups
     ../../modules/bluetooth
+    ../../modules/gaming
     ../../modules/keyboard
     (import ../../modules/networking { inherit hostName; })
     ../../modules/users
@@ -35,10 +36,12 @@ in
     ../../modules/localization
     ../../modules/fonts
     ../../modules/ssh/hardened-openssh.nix
+    ../../modules/storage
     ../../modules/stylix
     (import ../../modules/secrets { inherit lib inputs config; })
     ../../modules/docker
     ../../modules/syncthing
+    ../../modules/nvidia
   ];
 
   home-manager.users.${username} = import ../../home/hosts/andromache {
@@ -80,59 +83,24 @@ in
     };
   };
 
-  hardware = {
-    cpu.intel.updateMicrocode = true;
-    graphics.enable = true;
-    nvidia = {
-      modesetting.enable = true;
-      powerManagement.enable = true;
-      powerManagement.finegrained = false;
-      open = true;
-      nvidiaSettings = true;
-      package = config.boot.kernelPackages.nvidiaPackages.stable;
-    };
-  };
+  hardware.cpu.intel.updateMicrocode = true;
 
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 
   environment.systemPackages = [
-    inputs.colmena.packages.${pkgs.system}.colmena
+    inputs.colmena.packages.${pkgs.stdenv.hostPlatform.system}.colmena
   ];
 
   services = {
-    xserver = {
-      videoDrivers = [ "nvidia" ];
+    locate = {
+      enable = true;
+      package = pkgs.plocate;
     };
 
     openssh = {
       enable = true;
       harden = true;
     };
-    locate = {
-      enable = true;
-      package = pkgs.plocate;
-    };
-  };
-
-  my.syncthing = {
-    enable = true;
-    deviceNames = [
-      "boox"
-      "astyanax"
-    ];
-    folders = {
-      readings = {
-        path = "/home/h/doc/readings";
-        id = "readings";
-        devices = [
-          {
-            device = "boox";
-            type = "receiveonly";
-          }
-          "astyanax"
-        ];
-      };
-    };
   };
 
   networking = {

hosts/andromache/hard.nix

@@ -4,7 +4,6 @@
 {
   config,
   lib,
-  pkgs,
   modulesPath,
   ...
 }:

hosts/astyanax/default.nix

@@ -1,7 +1,6 @@
 {
   lib,
   inputs,
-  outputs,
   config,
   pkgs,
   ...
@@ -36,11 +35,10 @@ in
     ../../modules/localization
     ../../modules/fonts
     ../../modules/ssh/hardened-openssh.nix
+    ../../modules/storage
     ../../modules/stylix
-    # ../../modules/vpn/wireguard.nix
     (import ../../modules/secrets { inherit lib inputs config; })
     ../../modules/docker
-    ../../modules/syncthing
     ../../modules/nfc
   ];
 
@@ -61,6 +59,7 @@ in
   secrets.username = username;
   docker.user = username;
   nfc.user = username;
+  desktop.ly.enable = true;
 
   nix.settings.secret-key-files = [ config.sops.secrets.nix_signing_key_astyanax.path ];
 
@@ -82,7 +81,7 @@ in
   };
 
   environment.systemPackages = [
-    inputs.colmena.packages.${pkgs.system}.colmena
+    inputs.colmena.packages.${pkgs.stdenv.hostPlatform.system}.colmena
     (pkgs.writeShellApplication {
       name = "wol-andromache";
       runtimeInputs = [ pkgs.wakeonlan ];
@@ -105,33 +104,24 @@ in
       enable = true;
       harden = true;
     };
-  };
-
-  my.syncthing = {
-    enable = true;
-    deviceNames = [
-      "boox"
-      "andromache"
-    ];
-    folders = {
-      readings = {
-        path = "/home/h/doc/readings";
-        id = "readings";
-        devices = [
-          {
-            device = "boox";
-            type = "receiveonly";
-          }
-          "andromache"
-        ];
-      };
-    };
-  };
-
-  services = {
     locate = {
       enable = true;
       package = pkgs.plocate;
     };
+    tlp = {
+      enable = true;
+      settings = {
+        CPU_SCALING_GOVERNOR_ON_AC = "performance";
+        CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
+
+        CPU_ENERGY_PERF_POLICY_ON_BAT = "power";
+        CPU_ENERGY_PERF_POLICY_ON_AC = "performance";
+
+        CPU_MIN_PERF_ON_AC = 0;
+        CPU_MAX_PERF_ON_AC = 100;
+        CPU_MIN_PERF_ON_BAT = 0;
+        CPU_MAX_PERF_ON_BAT = 20;
+      };
+    };
   };
 }

hosts/astyanax/hard.nix

@@ -4,7 +4,6 @@
 {
   config,
   lib,
-  pkgs,
   modulesPath,
   ...
 }:

hosts/eetion-02/default.nix

@@ -0,0 +1,86 @@
+{ pkgs, ... }:
+
+# Raspberry Pi 3
+# See <https://nixos.wiki/wiki/NixOS_on_ARM/Raspberry_Pi_3>
+
+let
+  username = "h";
+  hostName = "eetion-02";
+in
+{
+  imports = [
+    ./hard.nix
+    ../../modules/ssh/hardened-openssh.nix
+  ];
+
+  ssh = {
+    inherit username;
+    publicHostname = "eetion-02";
+    authorizedHosts = [
+      "andromache"
+      "astyanax"
+    ];
+  };
+
+  boot = {
+    kernelParams = [
+      "console=ttyS1,115200n8"
+    ];
+
+    kernel.sysctl."net.ipv4.ip_forward" = 1;
+
+    loader = {
+      grub.enable = false;
+      generic-extlinux-compatible.enable = true;
+    };
+  };
+
+  hardware.enableRedistributableFirmware = true;
+
+  networking = {
+    inherit hostName;
+    networkmanager.enable = true;
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        80
+        443
+      ];
+    };
+  };
+
+  users.users = {
+    root.hashedPassword = "!";
+    ${username} = {
+      isNormalUser = true;
+      extraGroups = [ "wheel" ];
+    };
+  };
+
+  security.sudo.wheelNeedsPassword = false;
+
+  services = {
+    openssh = {
+      enable = true;
+      harden = true;
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    vim
+    git
+  ];
+
+  nix.settings = {
+    experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+    trusted-users = [
+      "root"
+      "@wheel"
+    ];
+  };
+
+  system.stateVersion = "26.05";
+}

hosts/eetion-02/hard.nix

@@ -0,0 +1,24 @@
+{ lib, modulesPath, ... }:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot = {
+    initrd.availableKernelModules = [ ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ ];
+    extraModulePackages = [ ];
+  };
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/NIXOS_SD";
+    fsType = "ext4";
+    options = [ "noatime" ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+}

hosts/eetion-02/system.nix

@@ -0,0 +1 @@
+"aarch64-linux"

hosts/hecuba/default.nix

@@ -17,6 +17,7 @@ in
     ./hard.nix
     ../../modules/ssh/hardened-openssh.nix
     ../../modules/docker
+    ../../modules/uptime-kuma
   ];
 
   networking.hostName = hostName;
@@ -31,6 +32,8 @@ in
 
   docker.user = username;
 
+  my.uptime-kuma.enable = false;
+
   fileSystems."/" = {
     device = "/dev/disk/by-label/nixos";
     fsType = "ext4";
@@ -80,15 +83,4 @@ in
     enable = true;
     harden = true;
   };
-
-  nix.settings = {
-    trusted-public-keys = [
-      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-      "astyanax:JY2qJkZUFSax47R3c1nq53AZ8GnLfNqz6mSnJ60cLZ4="
-      "andromache:XM4VLrEw63RB/3v/56OxzH/Yw+kKXKMBLKCb7UGAXzo="
-    ];
-    auto-optimise-store = true;
-    keep-derivations = false;
-    keep-outputs = false;
-  };
 }

hosts/hecuba/hard.nix

@@ -2,9 +2,7 @@
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 {
-  config,
   lib,
-  pkgs,
   modulesPath,
   ...
 }:

hosts/vm/default.nix

@@ -1,7 +1,6 @@
 {
   lib,
   inputs,
-  outputs,
   config,
   pkgs,
   ...
@@ -26,6 +25,7 @@ in
     ../../modules/x
     ../../modules/fonts
     ../../modules/ssh/hardened-openssh.nix
+    ../../modules/storage
     (import ../../modules/secrets {
       inherit lib inputs config;
     })

hosts/vm/hard.nix

@@ -2,9 +2,7 @@
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 {
-  config,
   lib,
-  pkgs,
   modulesPath,
   ...
 }:

images/README.md

@@ -0,0 +1,15 @@
+# building SD Images
+
+## Raspberry Pi 3B+
+
+```bash
+nix build .#images.sd-image-raspberry-pi-aarch64
+nix-shell -p zstd --run "zstdcat result/sd-image/*.img.zst | sudo dd of=/dev/sdX bs=4M status=progress conv=fsync"
+```
+
+## Orange Pi Zero2 H616
+```bash
+nix build .#images.sd-image-orange-pi-aarch64
+nix-shell -p zstd --run "zstdcat result/sd-image/*.img.zst | sudo dd of=/dev/sdX bs=4M status=progress conv=fsync"
+sudo dd if=~/dl/u-boot-sunxi-with-spl.bin of=/dev/sdX bs=1024 seek=8
+```

images/sd-image-raspberry-pi-aarch64.nix

@@ -0,0 +1,73 @@
+# see <https://nixos.wiki/wiki/NixOS_on_ARM#Build_your_own_image_natively>
+# see <https://nixos.wiki/wiki/NixOS_on_ARM/Raspberry_Pi_3>
+# ```
+# nix build .#images.sd-image-raspberry-pi-aarch64
+# nix-shell -p zstd --run "zstdcat result/sd-image/*.img.zst | sudo dd of=/dev/sdX bs=4M status=progress conv=fsync"
+# ```
+
+{ pkgs, ... }:
+
+let
+  username = "h";
+in
+{
+  imports = [
+    ../modules/ssh/hardened-openssh.nix
+  ];
+
+  ssh.username = username;
+  ssh.authorizedHosts = [
+    "andromache"
+    "astyanax"
+  ];
+
+  boot.kernelParams = [
+    "console=ttyS1,115200n8"
+  ];
+
+  boot.kernelModules = [
+    "bcm2835-v4l2"
+  ];
+
+  hardware.enableRedistributableFirmware = true;
+
+  services.pulseaudio.enable = true;
+
+  networking.wireless.enable = true;
+
+  systemd.services.btattach = {
+    before = [ "bluetooth.service" ];
+    after = [ "dev-ttyAMA0.device" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      ExecStart = "${pkgs.bluez}/bin/btattach -B /dev/ttyAMA0 -P bcm -S 3000000";
+    };
+  };
+
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+
+  users.users = {
+    root.initialPassword = "nixos";
+    ${username} = {
+      isNormalUser = true;
+      extraGroups = [ "wheel" ];
+      initialPassword = "nixos";
+    };
+  };
+
+  security.sudo.wheelNeedsPassword = false;
+
+  services.openssh = {
+    enable = true;
+    harden = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+    libraspberrypi
+  ];
+
+  system.stateVersion = "26.05";
+}

modules/audio/default.nix

@@ -1,6 +1,9 @@
-_:
-
 {
+  nixpkgs.allowedUnfree = [
+    "spotify"
+    "spotify-unwrapped"
+  ];
+
   security.rtkit.enable = true;
   services = {
     pulseaudio.enable = false;

modules/common/default.nix

@@ -1,58 +1,67 @@
-let
-  flakePath = "/home/h/nix";
-in
 {
   inputs,
   outputs,
   dotsPath,
+  config,
   ...
 }:
 
+let
+  inherit (inputs.nixpkgs) lib;
+in
 {
   imports = [
     inputs.home-manager.nixosModules.default
   ];
 
-  system.stateVersion = "25.05";
-
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-
-  nixpkgs.config.allowUnfree = true;
-
-  home-manager = {
-    useGlobalPkgs = true;
-    useUserPackages = true;
-    extraSpecialArgs = {
-      inherit inputs outputs dotsPath;
-    };
+  options.nixpkgs.allowedUnfree = lib.mkOption {
+    type = lib.types.listOf lib.types.str;
+    default = [ ];
   };
 
-  nix = {
-    optimise = {
-      automatic = true;
-      dates = [ "05:00" ];
-    };
-    gc = {
-      automatic = true;
-      dates = "weekly";
-      options = "--delete-older-than 30d";
-    };
-  };
+  config = {
+    system.stateVersion = "25.05";
 
-  system.autoUpgrade = {
-    enable = true;
-    flake = flakePath;
-    flags = [
-      "--recreate-lock-file"
-      "--commit-lock-file"
-      "--print-build-logs"
-      "--refresh"
-    ];
-    dates = "05:00";
-    randomizedDelaySec = "45min";
-    allowReboot = false;
+    nix = {
+      optimise = {
+        automatic = true;
+        dates = [ "05:00" ];
+      };
+      gc = {
+        automatic = true;
+        dates = "weekly";
+        options = "--delete-older-than 30d";
+      };
+      settings.experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+    };
+
+    system.autoUpgrade = {
+      enable = true;
+      flags = [
+        "--recreate-lock-file"
+        "--commit-lock-file"
+        "--print-build-logs"
+        "--refresh"
+      ];
+      dates = "05:00";
+      randomizedDelaySec = "45min";
+      allowReboot = false;
+    };
+
+    nixpkgs.config.allowUnfreePredicate =
+      pkg: builtins.elem (lib.getName pkg) config.nixpkgs.allowedUnfree;
+
+    environment.defaultPackages = lib.mkForce [ ];
+
+    home-manager = {
+      useGlobalPkgs = true;
+      useUserPackages = true;
+      extraSpecialArgs = {
+        inherit inputs outputs dotsPath;
+      };
+    };
   };
 }

modules/desktops/gnome.nix

@@ -1,5 +1,3 @@
-{ config, pkgs, ... }:
-
 {
   services.xserver = {
     displayManager.gdm.enable = true;

modules/desktops/niri/default.nix

@@ -1,16 +1,32 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.desktop;
+in
 {
-  programs.niri.enable = true;
-
-  services = {
-    dbus.enable = true;
-    logind.settings.Login = {
-      HandleLidSwitch = "suspend";
-      IdleAction = "suspend";
-      IdleActionSec = 1800;
+  options.desktop = {
+    ly = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+      };
     };
+  };
 
-    displayManager.ly = {
-      enable = true;
+  config = {
+    programs.niri.enable = true;
+
+    services = {
+      dbus.enable = true;
+      logind.settings.Login = {
+        HandleLidSwitch = "suspend";
+        IdleAction = "suspend";
+        IdleActionSec = 1800;
+      };
+
+      displayManager.ly = lib.mkIf cfg.ly.enable {
+        enable = true;
+      };
     };
   };
 }

modules/gaming/default.nix

@@ -0,0 +1,12 @@
+{
+  nixpkgs.allowedUnfree = [
+    "steam"
+    "steam-unwrapped"
+  ];
+
+  programs.steam = {
+    enable = true;
+    remotePlay.openFirewall = false;
+    dedicatedServer.openFirewall = false;
+  };
+}

modules/keyboard/default.nix

@@ -3,7 +3,7 @@
 with pkgs;
 let
   tools = interception-tools;
-  caps2esc = interception-tools-plugins.caps2esc;
+  inherit (interception-tools-plugins) caps2esc;
 in
 {
   services.interception-tools = {

modules/nvidia/default.nix

@@ -0,0 +1,22 @@
+{ config, ... }:
+
+{
+  nixpkgs.allowedUnfree = [
+    "nvidia-x11"
+    "nvidia-persistenced"
+    "nvidia-settings"
+  ];
+
+  hardware.graphics.enable = true;
+
+  hardware.nvidia = {
+    modesetting.enable = true;
+    powerManagement.enable = true;
+    powerManagement.finegrained = false;
+    open = true;
+    nvidiaSettings = true;
+    package = config.boot.kernelPackages.nvidiaPackages.stable;
+  };
+
+  services.xserver.videoDrivers = [ "nvidia" ];
+}

modules/printing/default.nix

@@ -1,5 +1,3 @@
-{ pkgs, ... }:
-
 {
   # services.avahi = {
   #   enable = true;

modules/storage/default.nix

@@ -0,0 +1,3 @@
+{
+  services.udisks2.enable = true;
+}

modules/stylix/default.nix

@@ -5,21 +5,22 @@
   ...
 }:
 
+let
+  theme = import ./theme.nix { inherit pkgs; };
+in
 {
   imports = [ inputs.stylix.nixosModules.stylix ];
 
   stylix = {
     enable = true;
-    polarity = "dark";
-    base16Scheme = ../stylix/zenwritten-dark.yaml;
-    image = pkgs.runCommand "solid-bg.png" { nativeBuildInputs = [ pkgs.imagemagick ]; } ''
-      magick -size 1x1 xc:#191919 $out
-    '';
+    inherit (theme)
+      polarity
+      base16Scheme
+      override
+      image
+      ;
     fonts = {
-      monospace = {
-        package = pkgs.iosevka-bin.override { variant = "SS08"; };
-        name = "Iosevka Term SS08";
-      };
+      monospace = theme.monospaceFont;
       serif = config.stylix.fonts.monospace;
       sansSerif = config.stylix.fonts.monospace;
       emoji = config.stylix.fonts.monospace;
@@ -30,7 +31,18 @@
   home-manager.sharedModules = [
     {
       stylix.targets = {
-        firefox.profileNames = [ "default" ];
+        firefox = {
+          profileNames = [ "default" ];
+          colorTheme.enable = true;
+        };
+        librewolf = {
+          profileNames = [ "default" ];
+          colorTheme.enable = true;
+        };
+        kitty.variant256Colors = true;
+        gnome.enable = false;
+        gtk.enable = false;
+        nixvim.enable = false;
       };
     }
   ];

modules/stylix/theme.nix

@@ -0,0 +1,16 @@
+{ pkgs }:
+
+{
+  polarity = "dark";
+  base16Scheme = ./zenwritten-dark.yaml;
+  override = {
+    base04 = "8E8E8E";
+  };
+  image = pkgs.runCommand "solid-bg.png" { nativeBuildInputs = [ pkgs.imagemagick ]; } ''
+    magick -size 1x1 xc:#191919 $out
+  '';
+  monospaceFont = {
+    package = pkgs.iosevka-bin.override { variant = "SS08"; };
+    name = "Iosevka Term SS08";
+  };
+}

modules/syncthing/default.nix

@@ -8,7 +8,6 @@ with lib;
 
 let
   cfg = config.my.syncthing;
-  allDevices = import ./devices.nix;
 in
 {
   options.my.syncthing = {
@@ -17,41 +16,11 @@ in
       type = types.str;
       default = "h";
     };
-    deviceNames = mkOption {
-      type = types.listOf types.str;
-      default = [ ];
-    };
-    folders = mkOption {
-      type = types.attrsOf (
-        types.submodule {
-          options = {
-            path = mkOption { type = types.path; };
-            id = mkOption { type = types.str; };
-            devices = mkOption {
-              type = types.listOf (
-                types.either types.str (
-                  types.submodule {
-                    options = {
-                      device = mkOption { type = types.str; };
-                      type = mkOption {
-                        type = types.str;
-                        default = "sendreceive";
-                      };
-                    };
-                  }
-                )
-              );
-              default = cfg.deviceNames;
-            };
-          };
-        }
-      );
-      default = { };
-    };
   };
 
   config = mkIf cfg.enable {
     users.groups.${cfg.username} = { };
+    users.users.${cfg.username}.extraGroups = [ cfg.username ];
 
     services.syncthing = {
       enable = true;
@@ -59,27 +28,6 @@ in
       group = cfg.username;
       configDir = "/home/${cfg.username}/.local/state/syncthing";
       openDefaultPorts = true;
-      settings = {
-        options = {
-          localAnnounceEnabled = true;
-          globalAnnounceEnabled = true;
-          relaysEnabled = true;
-          urAccepted = -1;
-        };
-        devices = mapAttrs (name: id: { inherit id; }) (
-          filterAttrs (name: _: elem name cfg.deviceNames) allDevices
-        );
-        folders = mapAttrs (name: folder: {
-          inherit (folder) id path;
-          devices = map (
-            device:
-            if isString device then
-              allDevices.${device}
-            else
-              device // { deviceID = allDevices.${device.device}; }
-          ) folder.devices;
-        }) cfg.folders;
-      };
     };
   };
 }

modules/uptime-kuma/default.nix

@@ -0,0 +1,39 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.my.uptime-kuma;
+in
+{
+  options.my.uptime-kuma.enable = lib.mkEnableOption "Uptime Kuma monitoring service (Docker container)";
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.oci-containers = {
+      backend = "docker";
+      containers.uptime-kuma = {
+        image = "louislam/uptime-kuma:latest";
+        ports = [ "127.0.0.1:3001:3001" ];
+        volumes = [ "/var/lib/uptime-kuma:/app/data" ];
+        environment = {
+          TZ = "UTC";
+          UMASK = "0022";
+        };
+        extraOptions = [
+          "--network=proxiable"
+        ];
+      };
+    };
+
+    systemd.tmpfiles.settings."uptime-kuma" = {
+      "/var/lib/uptime-kuma".d = {
+        mode = "0755";
+      };
+    };
+
+    environment.systemPackages = with pkgs; [ docker-compose ];
+  };
+}

modules/users/default.nix

@@ -1,5 +1,3 @@
-{ pkgs, ... }:
-
 {
   users.users.h = {
     isNormalUser = true;

phone/default.nix

@@ -1,26 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-
-{
-  environment.packages = with pkgs; [
-    neovim
-  ];
-
-  environment.etcBackupExtension = ".bak";
-
-  system.stateVersion = "24.05";
-
-  nix.extraOptions = ''
-    experimental-features = nix-command flakes
-  '';
-
-  time.timeZone = "Europe/Brussels";
-
-  home-manager = {
-    config = ./home.nix;
-    backupFileExtension = "hm-bak";
-    useGlobalPkgs = true;
-  };
-}

phone/home.nix

@@ -1,3 +0,0 @@
-{
-  home.stateVersion = "24.05";
-}

utils/default.nix

@@ -2,6 +2,5 @@
 
 {
   dirNames =
-    path:
-    builtins.attrNames (lib.filterAttrs (name: type: type == "directory") (builtins.readDir path));
+    path: builtins.attrNames (lib.filterAttrs (_: type: type == "directory") (builtins.readDir path));
 }