refactor: simplify apps.colmena

Flake lock file updates:

• Updated input 'firefox-addons':
    'gitlab:rycee/nur-expressions/c7794d3f46304de5234008c31b5b28a9d5709184?dir=pkgs/firefox-addons&narHash=sha256-0iGDl/ct3rW%2Bh6%2BsLq4RZaze/U/aQo2L5sLLuyjuVTk%3D' (2026-02-04)
  → 'gitlab:rycee/nur-expressions/65d59f814068d04e532cad2773d281e4951acd95?dir=pkgs/firefox-addons&narHash=sha256-%2BFHN9EthS%2BkHxnMoSDZEiGLoxwiIuij6ltK3aTmlLMA%3D' (2026-02-07)
• Updated input 'home-manager':
    'github:nix-community/home-manager/04e5203db66417d548ae1ff188a9f591836dfaa7?narHash=sha256-R1WFtIvp38hS9x63dnijdJw1KyIiy30KGea6e6N7LHs%3D' (2026-02-05)
  → 'github:nix-community/home-manager/6cee0821577643e0b34e2c5d9a90d0b1b5cdca70?narHash=sha256-cyxgVsNfHnJ4Zn6G1EOzfTXbjTy7Ds9zMOsZaX7VZWs%3D' (2026-02-07)
• Updated input 'nvim':
    'path:./dots/.config/nvim'
  → 'path:./dots/.config/nvim'

.gitignore

@@ -8,3 +8,5 @@ result
 result-*
 
 nixos-efi-vars.fd
+
+/.pre-commit-config.yaml

README.md

@@ -1,15 +1,27 @@
 # NixOS flake
 
-## Set up virtual machine ([`disko`](https://github.com/nix-community/disko/blob/master/docs/interactive-vm.md))
+## hosts
 
-1. Build the virtual machine
+### NixOS
+
+```
+nixos-rebuild switch --flake .#<hostname>
+```
+
+### home manager
+
+```
+home-manager switch --flake .#work
+```
+
+### virtual machines
 
 ```
 nix build -L '.#nixosConfigurations.vm.config.system.build.vmWithDisko'
-```
-
-2. Run the virtual machine
-
-```
 ./result/bin/disko-vm
 ```
+
+## docs
+
+* [deploy using colmena](./deploy/README.md)
+* [SD installer images](./images/README.md)

deploy/README.md

@@ -0,0 +1,9 @@
+# `colmena` deployments
+
+* tags: `local`, `cloud`
+* deployments can be made from `astyanax` and `andromache` hosts
+
+## References
+
+- [docs: `colmena`](https://colmena.cli.rs/)
+- [repo: `colmena`](https://github.com/zhaofengli/colmena)

deploy/colmena.nix

@@ -0,0 +1,32 @@
+{
+  self,
+  inputs,
+}:
+
+let
+  mkNode = hostname: tags: {
+    imports = [ ../hosts/${hostname} ];
+    deployment = {
+      targetHost = self.nixosConfigurations.${hostname}.config.ssh.publicHostname;
+      targetUser = self.nixosConfigurations.${hostname}.config.ssh.username;
+      buildOnTarget = builtins.any (t: t != "local") tags;
+      inherit tags;
+    };
+  };
+in
+inputs.colmena.lib.makeHive {
+  meta = {
+    nixpkgs = import inputs.nixpkgs {
+      localSystem = "x86_64-linux";
+    };
+
+    nodeNixpkgs = builtins.mapAttrs (_: v: v.pkgs) self.nixosConfigurations;
+    nodeSpecialArgs = builtins.mapAttrs (_: v: v._module.specialArgs or { }) self.nixosConfigurations;
+  };
+
+  astyanax = mkNode "astyanax" [ "local" ];
+  andromache = mkNode "andromache" [ "local" ];
+  vm = mkNode "vm" [ "local" ];
+  hecuba = mkNode "hecuba" [ "cloud" ];
+  eetion = mkNode "eetion" [ "arm" ];
+}

dots/.bashrc

@@ -103,13 +103,6 @@ if [[ -z "${SSH_CONNECTION}" ]]; then
 fi
 # }}}
 
-# pnpm
-export PNPM_HOME="/home/h/.local/share/pnpm"
-case ":$PATH:" in
-  *":$PNPM_HOME:"*) ;;
-  *) export PATH="$PNPM_HOME:$PATH" ;;
-esac
-# pnpm end
 
 # Codi
 # Usage: codi [filetype] [filename]

dots/.bashrc.d/editor

@@ -4,16 +4,3 @@
 # Set NeoVim as default editor
 export EDITOR=nvim
 export SUDO_EDITOR="$EDITOR"
-
-declare -A -r EDITOR_CONFIGS=(
-  ["nvim"]="$HOME/.config/nvim/init.lua"
-  ["vim"]="$HOME/.vimrc"
-)
-
-edit_editor_config() {
-  for editor in "${!EDITOR_CONFIGS[@]}"; do
-    if [ "$EDITOR" = "$editor" ]; then
-      $EDITOR "${EDITOR_CONFIGS[$editor]}"
-    fi
-  done
-}

dots/.bin/bak

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+# back up a file by copying it to a new file with a .bak extension
+# reference: https://askubuntu.com/questions/962489/is-there-any-way-to-create-backup-copy-of-a-file-without-type-its-name-twice
+
+usage() {
+  echo "Usage: bak [-t|--timestamp] <file to back up>"
+  exit 1
+}
+
+timestamp=false
+
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    -t|--timestamp)
+      timestamp=true
+      shift
+      ;;
+    *)
+      break
+      ;;
+  esac
+done
+
+[ $# -eq 1 ] || usage
+
+if $timestamp; then
+  date="$(date +%Y-%m-%d_%H-%M-%S)"
+  cp -vpn "$1"{,."$date".bak}
+else
+  cp -vpn "$1"{,.bak}
+fi

dots/.bin/save-home

@@ -1,26 +0,0 @@
-#!/usr/bin/env bash
-
-# Back up my $HOME folder to OneDrive using `restic`.
-#
-# Adds extra flags needed for using `rclone` with sharepoint WebDav I.e. add
-# `--ignore-size --ignore-checksum --update` to the default `rclone.args`.
-#
-# Select directory in repo using -r rclone:<repo>:<directory>
-#
-# Runs `backup` command on $HOME and ignore what is listed in `.resticexclude`
-#
-# ```/etc/restic-env
-# export B2_ACCOUNT_ID=
-# export B2_ACCOUNT_KEY=
-# ```
-#
-# `restic -r b2:desktop-arch init`
-
-source /etc/restic-env
-restic -r "$RESTIC_REPOSITORY:$HOSTNAME" backup \
-  --tag "hektor" \
-  --one-file-system \
-  --files-from="$HOME/.resticinclude" \
-  --exclude-file="$HOME/.resticexclude" \
-  --exclude-if-present=".nobackup" \
-  --verbose=3

dots/.bin/sb-pomo

@@ -1,3 +1,3 @@
 #!/usr/bin/env bash
 
-[ -f "/tmp/pomo" ] && cat /tmp/pomo || echo ""
+[ -f "/home/h/.local/share/pomo" ] && cat /home/h/.local/share/pomo || echo ""

dots/.bin/setup-gnome

@@ -1,37 +0,0 @@
-#!/usr/bin/env bash
-
-gsettings set org.gnome.desktop.background primary-color "#555555"
-
-gsettings set org.gnome.desktop.wm.preferences workspace-names "['sh', 'www', 'dev', 'info', 'etc']"
-gsettings set org.gnome.desktop.wm.keybindings close "['<Shift><Super>Delete']"
-gsettings set org.gnome.desktop.wm.keybindings switch-applications "['<Super>j']"
-gsettings set org.gnome.desktop.wm.keybindings switch-applications-backward "['<Super>k']"
-gsettings set org.gnome.shell.keybindings toggle-application-view "['<Super>p']"
-gsettings set org.gnome.mutter center-new-windows true
-gsettings set org.gnome.shell.keybindings toggle-quick-settings []
-
-gsettings set org.gnome.desktop.wm.keybindings switch-to-workspace-1 "['<Super>a']"
-gsettings set org.gnome.desktop.wm.keybindings switch-to-workspace-2 "['<Super>s']"
-gsettings set org.gnome.desktop.wm.keybindings switch-to-workspace-3 "['<Super>d']"
-gsettings set org.gnome.desktop.wm.keybindings switch-to-workspace-4 "['<Super>f']"
-gsettings set org.gnome.desktop.wm.keybindings switch-to-workspace-5 "['<Super>g']"
-gsettings set org.gnome.desktop.wm.keybindings move-to-workspace-1 "['<Super><Shift>a']"
-gsettings set org.gnome.desktop.wm.keybindings move-to-workspace-2 "['<Super><Shift>s']"
-gsettings set org.gnome.desktop.wm.keybindings move-to-workspace-3 "['<Super><Shift>d']"
-gsettings set org.gnome.desktop.wm.keybindings move-to-workspace-4 "['<Super><Shift>f']"
-gsettings set org.gnome.desktop.wm.keybindings move-to-workspace-5 "['<Super><Shift>g']"
-
-gsettings set org.gnome.settings-daemon.plugins.media-keys custom-keybindings "['/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1/']"
-gsettings set org.gnome.settings-daemon.plugins.media-keys.custom-keybinding:/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1/ name "Kitty"
-gsettings set org.gnome.settings-daemon.plugins.media-keys.custom-keybinding:/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1/ command "kitty"
-gsettings set org.gnome.settings-daemon.plugins.media-keys.custom-keybinding:/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1/ binding "<Shift><Super>Return"
-
-gsettings set org.gnome.shell.keybindings screenshot "['Print']"
-
-gsettings set org.gnome.desktop.wm.preferences num-workspaces "5"
-gsettings set org.gnome.mutter dynamic-workspaces "false"
-gsettings set org.gnome.shell.extensions.window-list display-all-workspaces "true"
-gsettings set org.gnome.shell.app-switcher current-workspace-only "true"
-
-gsettings set org.gnome.login-screen logo ''
-gsettings set org.gnome.shell favorite-apps "['firefox-developer-edition.desktop']"

dots/.bin/update-vim

@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-
-# Tiny Vim update helper
-
-nvim +PlugUpgrade +PlugUpdate +CocUpdate

dots/.config/kitty/kitty.conf

@@ -163,5 +163,4 @@ map cmd+q
 
 #: }}}
 
-include ./themes/zenwritten_dark.conf
 include ./nvim.conf

dots/.config/kitty/themes/zenwritten_dark.conf

@@ -1,49 +0,0 @@
-# This file is auto-generated by shipwright.nvim
-# vim:ft=kitty
-## name: zenwritten_dark
-## author: Michael Chris Lopez
-## license: MIT
-## upstream: https://github.com/mcchrish/zenbones.nvim/raw/main/extras/kitty/zenwritten_dark.conf
-## blurb: A zenbones variant with zero hue and saturation.
-foreground                      #BBBBBB
-background                      #191919
-selection_foreground            #BBBBBB
-selection_background            #404040
-# Cursor colors
-cursor                          #C9C9C9
-cursor_text_color               #191919
-# URL underline color when hovering with mouse
-# kitty window border colors
-# OS Window titlebar colors
-# Tab bar colors
-active_tab_foreground           #BBBBBB
-active_tab_background           #65435E
-inactive_tab_foreground         #BBBBBB
-inactive_tab_background         #303030
-# Colors for marks (marked text in the terminal)
-# The basic 16 colors
-# black
-color0 #191919
-color8 #3D3839
-# red
-color1 #DE6E7C
-color9 #E8838F
-# green
-color2  #819B69
-color10 #8BAE68
-# yellow
-color3  #B77E64
-color11 #D68C67
-# blue
-color4  #6099C0
-color12 #61ABDA
-# magenta
-color5  #B279A7
-color13 #CF86C1
-# cyan
-color6  #66A5AD
-color14 #65B8C1
-# white
-color7  #BBBBBB
-color15 #8E8E8E
-# You can set the remaining 240 colors as color16 to color255.

dots/.config/kitty/themes/zenwritten_light.conf

@@ -1,49 +0,0 @@
-# This file is auto-generated by shipwright.nvim
-# vim:ft=kitty
-## name: zenwritten_light
-## author: Michael Chris Lopez
-## license: MIT
-## upstream: https://github.com/mcchrish/zenbones.nvim/raw/main/extras/kitty/zenwritten_light.conf
-## blurb: A zenbones variant with zero hue and saturation.
-foreground                      #353535
-background                      #EEEEEE
-selection_foreground            #353535
-selection_background            #D7D7D7
-# Cursor colors
-cursor                          #353535
-cursor_text_color               #EEEEEE
-# URL underline color when hovering with mouse
-# kitty window border colors
-# OS Window titlebar colors
-# Tab bar colors
-active_tab_foreground           #353535
-active_tab_background           #DEB9D6
-inactive_tab_foreground         #353535
-inactive_tab_background         #CFCFCF
-# Colors for marks (marked text in the terminal)
-# The basic 16 colors
-# black
-color0 #EEEEEE
-color8 #C6C3C3
-# red
-color1 #A8334C
-color9 #94253E
-# green
-color2  #4F6C31
-color10 #3F5A22
-# yellow
-color3  #944927
-color11 #803D1C
-# blue
-color4  #286486
-color12 #1D5573
-# magenta
-color5  #88507D
-color13 #7B3B70
-# cyan
-color6  #3B8992
-color14 #2B747C
-# white
-color7  #353535
-color15 #5C5C5C
-# You can set the remaining 240 colors as color16 to color255.

dots/.config/ncspot/config.toml

@@ -1,5 +1,6 @@
 default_keybindings = false
 flip_status_indicators = true
+library_tabs = ["tracks", "albums", "artists", "playlists", "browse"] # remove podcasts tab
 
 [keybindings]
 "Enter" = "play"
@@ -24,11 +25,10 @@ flip_status_indicators = true
 "c" = "clear"
 "=" = "volup 1"
 "-" = "voldown 1"
-"/" = "focus search"
-"Q" = "focus queue"
-"L" = "focus library"
 "1" = "focus queue"
-"2" = "focus library"
+"2" = "focus search"
+"3" = "focus library"
+"4" = "focus cover"
 "h" = "move left 1"
 "j" = "move down 1"
 "k" = "move up 1"
@@ -41,26 +41,5 @@ flip_status_indicators = true
 "Y" = "share selected"
 "U" = "update"
 
-[theme]
-primary="#aaaaaa"
-secondary="#555555"
-background="1a1a1a"
-title="#cccccc"
-title_secondary="#aaaaaa"
-playing="#ffffff"
-playing_bg="1a1a1a"
-playing_selected="#ffffff"
-highlight="#cccccc"
-highlight_bg="#333333"
-error="#ffffff"
-error_bg="#333333"
-statusbar="#cccccc"
-statusbar_bg="#1a1a1a"
-statusbar_progress="#cccccc"
-statusbar_progress_bg="#1a1a1a"
-cmdline="#cccccc"
-cmdline_bg="#1a1a1a"
-search_match="#ffffff"
-
 backend="pipe"
 notify="false"

dots/.config/ncspot/credentials.toml

@@ -1,3 +0,0 @@
-username = 'hektor.misplon@gmail.com'
-auth_type = 0
-auth_data = 'KDEzMzc9PXRydTMpPzo='

dots/.config/nvim/after/plugin/fzf-lua.lua

@@ -11,6 +11,6 @@ vim.keymap.set("n", "<leader>fd", fzf.diagnostics_workspace)
 vim.keymap.set("n", "<leader>fhe", fzf.help_tags)
 vim.keymap.set("n", "<leader>fhi", fzf.search_history)
 vim.keymap.set("n", "<leader>fma", fzf.marks)
-vim.keymap.set("n", "<leader>fma", fzf.man_pages)
+vim.keymap.set("n", "<leader>fmp", fzf.man_pages)
 
 vim.keymap.set("i", "<c-f>", fzf.complete_path)

dots/.config/nvim/after/plugin/lspconfig.lua

@@ -1,8 +1,5 @@
 require("neodev").setup() -- should setup before lspconfig
 
--- vim.g.coq_settings = { auto_start = 'shut-up' }
--- local capabilities = coq.lsp_ensure_capabilities()
-
 local cmp_nvim_lsp = require("cmp_nvim_lsp")
 local capabilities = cmp_nvim_lsp.default_capabilities()
 
@@ -64,8 +61,31 @@ local servers = {
       Lua = {},
     },
   },
-  -- marksman = {},
+  nixd = {
-  nixd = {},
+    settings = {
+      nixd = {
+        nixpkgs = {
+          expr = "import <nixpkgs> { }",
+          expr = 'import (builtins.getFlake ("git+file://" + toString ../../../../../.)).inputs.nixpkgs { }',
+        },
+      },
+      options = {
+        nixos = {
+          expr = '(builtins.getFlake ("git+file://" + toString ../../../../../.)).nixosConfigurations."'
+            .. vim.fn.hostname()
+            .. '".options',
+        },
+        home_manager = {
+          expr = '(builtins.getFlake ("git+file://" + toString ../../../../../.)).homeConfigurations."'
+            .. vim.fn.expand("$USER")
+            .. "@"
+            .. vim.fn.hostname()
+            .. '".options',
+        },
+      },
+    },
+  },
+  openscad_ls = {},
   pyright = {},
   -- tsserver = {},
   svelte = {

dots/.config/nvim/after/plugin/m_taskwarrior_d.nvim.lua

@@ -1,9 +1,9 @@
-require("m_taskwarrior_d").setup()
+-- require("m_taskwarrior_d").setup()
-
+--
-vim.api.nvim_create_autocmd({ "BufEnter", "BufWritePost" }, {
+-- vim.api.nvim_create_autocmd({ "BufEnter", "BufWritePost" }, {
-  group = vim.api.nvim_create_augroup("TWTask", { clear = true }),
+--   group = vim.api.nvim_create_augroup("TWTask", { clear = true }),
-  pattern = "*.md",
+--   pattern = "*.md",
-  callback = function()
+--   callback = function()
-    vim.cmd("TWSyncTasks")
+--     vim.cmd("TWSyncTasks")
-  end,
+--   end,
-})
+-- })

dots/.config/nvim/flake.lock

@@ -42,11 +42,11 @@
     },
     "nixCats": {
       "locked": {
-        "lastModified": 1767604651,
+        "lastModified": 1770584904,
-        "narHash": "sha256-itAnxzTpWpY1s3LA/oNngOuZDXT5U5JUZP5fApwx9gs=",
+        "narHash": "sha256-9Zaz8lbKF2W9pwXZEnbiGsicHdBoU+dHt3Wv3mCJoZ8=",
         "owner": "BirdeeHub",
         "repo": "nixCats-nvim",
-        "rev": "3c9bc4d7123e1b48d92f25ba505b889af541e897",
+        "rev": "538fdde784d2909700d97a8ef307783b33a86fb1",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1768302833,
+        "lastModified": 1770843696,
-        "narHash": "sha256-h5bRFy9bco+8QcK7rGoOiqMxMbmn21moTACofNLRMP4=",
+        "narHash": "sha256-LovWTGDwXhkfCOmbgLVA10bvsi/P8eDDpRudgk68HA8=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "61db79b0c6b838d9894923920b612048e1201926",
+        "rev": "2343bbb58f99267223bc2aac4fc9ea301a155a16",
         "type": "github"
       },
       "original": {
@@ -106,11 +106,11 @@
     "plugins-helm-ls-nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1761915179,
+        "lastModified": 1768584652,
-        "narHash": "sha256-W9NRa84l5Cs62OsDeqb+LMxk8oYjhVBCB3o3UmE9a0I=",
+        "narHash": "sha256-jnMc87OjURNcqsva0npYgVyUrWc5C6L7yHpNvt9eSmg=",
         "owner": "qvalentin",
         "repo": "helm-ls.nvim",
-        "rev": "d6f3a8d4ad59b4f54cd734267dfb5411679ea608",
+        "rev": "f0b9a1723890971a6d84890b50dbf5f40974ea1b",
         "type": "github"
       },
       "original": {
@@ -119,30 +119,14 @@
         "type": "github"
       }
     },
-    "plugins-m-taskwarrior-d-nvim": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1767960157,
-        "narHash": "sha256-ov0qi4LhIlwqrBzSbTJ6APC5qjl2d/vlKWJfW5ZiDrg=",
-        "owner": "huantrinh1802",
-        "repo": "m_taskwarrior_d.nvim",
-        "rev": "107247387cd81823046bc2b8e71150c8edf041d3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "huantrinh1802",
-        "repo": "m_taskwarrior_d.nvim",
-        "type": "github"
-      }
-    },
     "plugins-mcphub-nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1765628564,
+        "lastModified": 1768730387,
-        "narHash": "sha256-nvWqCGRKhbUHsAM/zd+cwFdcoXXxf6EmcCkpN4mElf4=",
+        "narHash": "sha256-g9tPvjThz6EUk7zcY7lL+YH4lrT4x3FJ6jrNMHA8PAE=",
         "owner": "ravitemer",
         "repo": "mcphub.nvim",
-        "rev": "5193329d510a68f1f5bf189960642c925c177a3a",
+        "rev": "7cd5db330f41b7bae02b2d6202218a061c3ebc1f",
         "type": "github"
       },
       "original": {
@@ -206,7 +190,6 @@
         "nixpkgs": "nixpkgs_2",
         "plugins-beancount-nvim": "plugins-beancount-nvim",
         "plugins-helm-ls-nvim": "plugins-helm-ls-nvim",
-        "plugins-m-taskwarrior-d-nvim": "plugins-m-taskwarrior-d-nvim",
         "plugins-mcphub-nvim": "plugins-mcphub-nvim",
         "plugins-nvimkit-nvim": "plugins-nvimkit-nvim",
         "plugins-shipwright-nvim": "plugins-shipwright-nvim",

dots/.config/nvim/flake.nix

@@ -8,10 +8,10 @@
       url = "github:rktjmp/shipwright.nvim";
       flake = false;
     };
-    plugins-m-taskwarrior-d-nvim = {
+    # plugins-m-taskwarrior-d-nvim = {
-      url = "github:huantrinh1802/m_taskwarrior_d.nvim";
+    #   url = "github:huantrinh1802/m_taskwarrior_d.nvim";
-      flake = false;
+    #   flake = false;
-    };
+    # };
     plugins-beancount-nvim = {
       url = "github:polarmutex/beancount.nvim";
       flake = false;
@@ -37,7 +37,6 @@
 
   outputs =
     {
-      self,
       nixpkgs,
       nixCats,
       ...
@@ -50,7 +49,7 @@
 
       mkDependencyOverlays = system: [
         (utils.standardPluginOverlay inputs)
-        (final: prev: {
+        (_final: _prev: {
           mcp-hub = inputs.mcp-hub.packages.${system}.default;
         })
       ];
@@ -67,10 +66,15 @@
               clang
               clang-tools
               delta
+              emmet-language-server
+              eslint_d
               fd
               gawk
               gdtoolkit_4
+              hadolint
+              helm-ls
               isort
+              lua-language-server
               mcp-hub
               nixd
               nixfmt
@@ -78,12 +82,16 @@
               nodePackages.typescript-language-server
               ormolu
               prettierd
+              rust-analyzer
               rustfmt
               shellcheck-minimal
               stylelint
               stylua
               tree-sitter
               vscode-langservers-extracted
+              vtsls
+              yaml-language-server
+              yamllint
             ];
           };
 
@@ -135,7 +143,7 @@
               zenbones-nvim
               nvim-treesitter.withAllGrammars
               nvim-treesitter-textobjects
-              nvim-treesitter-context
+              # nvim-treesitter-context
               nvim-ts-context-commentstring
               treesj
               sniprun
@@ -155,7 +163,7 @@
               kitty-scrollback-nvim
               fidget-nvim
               rustaceanvim
-              pkgs.neovimPlugins.m-taskwarrior-d-nvim
+              # pkgs.neovimPlugins.m-taskwarrior-d-nvim
               claude-code-nvim
             ];
           };
@@ -173,9 +181,7 @@
         };
 
       packageDefinitions = {
-        nvim =
+        nvim = _: {
-          { ... }:
-          {
           settings = {
             suffix-path = true;
             suffix-LD = true;

dots/.config/nvim/init.lua

@@ -1,10 +1,7 @@
 require("nixCatsUtils").setup({ non_nix_value = true }) -- https://github.com/BirdeeHub/nixCats-nvim/blob/77dffad8235eb77684fcb7599487c8e9f23d5b8f/templates/example/init.lua
 
-vim.cmd([[
+vim.opt.termguicolors = true
-set termguicolors
+vim.api.nvim_set_hl(0, "Normal", { ctermbg = "NONE", bg = "NONE" })
-set bg=light
-hi Normal ctermbg=none guibg=NONE
-]])
 
 require("base")
 require("cursor")
@@ -22,7 +19,5 @@ require("utils")
 require("zk")
 require("reload")
 
-require("paq-setup") -- when not on nixCats
-
 vim.opt.background = "dark"
 vim.opt.laststatus = 3

dots/.config/nvim/lua/skeleton/init.lua

@@ -2,10 +2,10 @@ local autocmd = vim.api.nvim_create_autocmd
 
 autocmd("BufNewFile", {
   pattern = "shell.nix",
-  command = "0r ~/.config/nvim/skeletons/shell.nix",
+  command = "0r ~/.config/nvim/skeletons/shell.nix.skeleton",
 })
 
 autocmd("BufNewFile", {
   pattern = "flake.nix",
-  command = "0r ~/.config/nvim/skeletons/flake.nix",
+  command = "0r ~/.config/nvim/skeletons/flake.nix.skeleton",
 })

dots/.config/tmux/hooks/tmux.regular.conf

@@ -1 +0,0 @@
-set  -g status-style bg=default

dots/.config/tmux/hooks/tmux.ssh.conf

@@ -1 +1 @@
-set  -g status-style bg=blue,fg=black;
+set -g status-style bg=colour12,fg=colour0

dots/.config/tmux/themes/zenwritten_dark.tmux

@@ -1,22 +0,0 @@
-# This file is based on the one provided by shipwright.nvim
-set -g @FG '#dddddd'
-set -g @BG '#111111'
-
-set -g status-left ' #[fg=#{@FG},bold]#{s/root//:client_key_table} '
-set -g status-right '#[fg=#{@FG},bold] [#S]#[fg=#{@FG},bold] [%d/%m] #[fg=#{@FG},bold][%I:%M%p] '
-set -g status-style fg='#{@FG}',bg='#{@BG}'
-
-set -g window-status-current-style fg='#{@FG}',bg='#{@BG}',bold
-
-set -g pane-border-style fg='#{@FG}'
-set -g pane-active-border-style fg='#{@FG}'
-
-set -g message-style fg='#{@FG}',bg='#{@FG}'
-
-set -g display-panes-active-colour '#{@FG}'
-set -g display-panes-colour '#{@FG}'
-
-set -g clock-mode-colour '#{@FG}'
-
-set -g mode-style fg='#{@FG}',bg='#{@FG}'
-

dots/.config/tmux/themes/zenwritten_light.tmux

@@ -1,22 +0,0 @@
-# This file is based on the one provided by shipwright.nvim
-set -g @FG '#111111'
-set -g @BG '#dddddd'
-
-set -g status-left ' #[fg=#{@FG},bold]#{s/root//:client_key_table} '
-set -g status-right '#[fg=#{@FG},bold] [#S]#[fg=#{@FG},bold] [%d/%m] #[fg=#{@FG},bold][%I:%M%p] '
-set -g status-style fg='#{@FG}',bg='#{@BG}'
-
-set -g window-status-current-style fg='#{@FG}',bg='#{@BG}',bold
-
-set -g pane-border-style fg='#{@FG}'
-set -g pane-active-border-style fg='#{@FG}'
-
-set -g message-style fg='#{@FG}',bg='#{@FG}'
-
-set -g display-panes-active-colour '#{@FG}'
-set -g display-panes-colour '#{@FG}'
-
-set -g clock-mode-colour '#{@FG}'
-
-set -g mode-style fg='#{@FG}',bg='#{@FG}'
-

dots/.config/tmux/tmux.conf

@@ -39,10 +39,22 @@ bind-key -T root F7 select-window -t 7
 bind-key -T root F8 select-window -t 8
 bind-key -T root F9 select-window -t 9
 
+
+# bind-key j command-prompt -p "join pane from:"  "join-pane -s '%%'"
+# bind-key s command-prompt -p "send pane to:"  "join-pane -t '%%'"
+bind-key -T root S-F1 join-pane -s :1
+bind-key -T root S-F2 join-pane -s :2
+bind-key -T root S-F3 join-pane -s :3
+bind-key -T root S-F4 join-pane -s :4
+bind-key -T root S-F5 join-pane -s :5
+bind-key -T root S-F6 join-pane -s :6
+bind-key -T root S-F7 join-pane -s :7
+bind-key -T root S-F8 join-pane -s :8
+bind-key -T root S-F9 join-pane -s :9
+
 # 1-based indexing makes most sense for keyboard layouts (where number row start at 1)
 set  -g base-index 1
 set  -g pane-base-index 1
-setw -g automatic-rename
 
 # statusbar
 set -g status-position top
@@ -53,21 +65,10 @@ set -g status-left "#[bg=colour235,fg=colour255] #S  #[fg=colour235,bg=default]
 set -g status-right ""
 %else
 set -g status-left '#h '
-set -g status-right '#(uptime | cut -f 4-5 -d " " | cut -f 1 -d ",") %a%l:%M:%S %p %Y-%m-%d'
+set -g status-right '#(uptime | cut -f 4-5 -d " " | cut -f 1 -d ",") %a %l:%M:%S %p %Y-%m-%d'
 %endif
 
-# theming
-%if "#{==:#{host},desktop-arch}"
 set -g default-terminal "tmux-256color"
-setw -g window-status-style fg=colour244,bg=default
-setw -g window-status-current-style fg=colour232,bg=default,bold
-set  -g message-style fg=colour232,bg=default
-setw -g clock-mode-colour colour235
-set  -g status-style bg=default
-set  -g pane-border-style fg=#cccccc
-set  -g pane-active-border-style fg=#555555
-set  -g message-style bg=#cccccc,fg=#000000
-%endif
 
 set-hook -g after-new-session 'if -F "#{==:#{session_name},ssh}" "source ${XDG_CONFIG_HOME}/tmux/hooks/tmux.ssh.conf" "source ${XDG_CONFIG_HOME}/tmux/hooks/tmux.regular.conf"'
 
@@ -75,3 +76,5 @@ set-hook -g after-new-session 'if -F "#{==:#{session_name},ssh}" "source ${XDG_C
 if-shell "test '\( #{$TMUX_VERSION_MAJOR} -eq 2 -a #{$TMUX_VERSION_MINOR} -ge 4 \)'" 'bind-key -Tcopy-mode-vi v send -X begin-selection; bind-key -Tcopy-mode-vi y send -X copy-selection-and-cancel'
 if-shell '\( #{$TMUX_VERSION_MAJOR} -eq 2 -a #{$TMUX_VERSION_MINOR} -lt 4\) -o #{$TMUX_VERSION_MAJOR} -le 1' 'bind-key -t vi-copy v begin-selection; bind-key -t vi-copy y copy-selection'
 if-shell '\( #{$TMUX_VERSION_MAJOR} -eq 2 -a #{$TMUX_VERSION_MINOR} -lt 2\) -o #{$TMUX_VERSION_MAJOR} -le 1' 'set-option -g status-utf8 on'
+
+set -g allow-passthrough on

dots/.config/tmux/tmux.regular.conf

@@ -1 +0,0 @@
-set  -g status-style bg=default

dots/.gitignore

@@ -84,6 +84,9 @@ dkms.conf
 
 # Dotenv
 .env
+.envrc
+.direnv/
+.pre-commit-config.yaml
 
 # Prevent module files from being ignored (e.g. NestJS)
 !*.module*

dots/.local/share/task/hooks/on-add.limit.py

@@ -0,0 +1,29 @@
+#!/usr/bin/env python3
+import sys
+import json
+
+SLOTS_FILE = "/home/h/.local/share/task/add_slots"
+
+def get_slots():
+    try:
+        with open(SLOTS_FILE, "r") as f:
+            return int(f.read().strip())
+    except:
+        return 0
+
+slots = get_slots()
+
+if slots <= 0:
+    print(f"Cannot add task: No slots available (0/{slots}).")
+    print("Delete or complete a task first to earn an add slot.")
+    sys.exit(1)
+
+with open(SLOTS_FILE, "w") as f:
+    f.write(str(slots - 1))
+
+print(f"Task added. Slots remaining: {slots - 1}")
+
+for line in sys.stdin:
+    task = json.loads(line)
+    print(json.dumps(task))
+    sys.exit(0)

dots/.local/share/task/hooks/on-modify.limit.py

@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+import sys
+import json
+
+SLOTS_FILE = "/home/h/.local/share/task/add_slots"
+
+def get_slots():
+    try:
+        with open(SLOTS_FILE, "r") as f:
+            return int(f.read().strip())
+    except:
+        return 0
+
+data = sys.stdin.read().strip().split("\n")
+if len(data) < 2:
+    for line in data:
+        if line:
+            print(line)
+    sys.exit(0)
+
+old_task = json.loads(data[0])
+new_task = json.loads(data[1])
+
+was_pending = old_task.get("status") == "pending"
+is_not_pending = new_task.get("status") in ("completed", "deleted")
+
+if was_pending and is_not_pending:
+    slots = get_slots() + 1
+    with open(SLOTS_FILE, "w") as f:
+        f.write(str(slots))
+    print(f"Slot earned! Total slots: {slots}")
+
+print(json.dumps(new_task))
+sys.exit(0)

dots/.resticexclude

@@ -1,44 +0,0 @@
-# Restic ignore
-
-# General
-.trash
-Trash
-.cache
-cache
-Cache
-CachedData
-CachedExtension
-CacheStorage
-__pycache__
-GPUCache
-ShaderCache
-build
-.git
-node_modules
-venv
-env
-
-# Specifics
-$HOME/.android
-$HOME/.atom
-$HOME/.build
-$HOME/.cabal
-$HOME/.cargo
-$HOME/.conda
-$HOME/.config/BraveSoftware/Brave-Browser/Default/Local Storage
-$HOME/.config/BraveSoftware/Brave-Browser/Default/Local Extension Settings
-$HOME/.config/nvm/versions
-$HOME/.config/devcert
-$HOME/.espressif
-$HOME/.local/share/torbrowser
-$HOME/.mozilla
-$HOME/.nvm
-$HOME/.npm
-$HOME/.nuget
-$HOME/.yarn
-$HOME/.config/yarn
-$HOME/doc/disk-images
-$HOME/.stremio-server
-$HOME/Games
-!$HOME/Games/*/drive_c/users/h/AppData
-!$HOME/Games/rhino

dots/.resticinclude

@@ -1,3 +0,0 @@
-/etc
-/boot
-/home

flake.lock

@@ -1,5 +1,97 @@
 {
   "nodes": {
+    "base16": {
+      "inputs": {
+        "fromYaml": "fromYaml"
+      },
+      "locked": {
+        "lastModified": 1755819240,
+        "narHash": "sha256-qcMhnL7aGAuFuutH4rq9fvAhCpJWVHLcHVZLtPctPlo=",
+        "owner": "SenchoPens",
+        "repo": "base16.nix",
+        "rev": "75ed5e5e3fce37df22e49125181fa37899c3ccd6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "SenchoPens",
+        "repo": "base16.nix",
+        "type": "github"
+      }
+    },
+    "base16-fish": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1765809053,
+        "narHash": "sha256-XCUQLoLfBJ8saWms2HCIj4NEN+xNsWBlU1NrEPcQG4s=",
+        "owner": "tomyun",
+        "repo": "base16-fish",
+        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tomyun",
+        "repo": "base16-fish",
+        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
+        "type": "github"
+      }
+    },
+    "base16-helix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1760703920,
+        "narHash": "sha256-m82fGUYns4uHd+ZTdoLX2vlHikzwzdu2s2rYM2bNwzw=",
+        "owner": "tinted-theming",
+        "repo": "base16-helix",
+        "rev": "d646af9b7d14bff08824538164af99d0c521b185",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-helix",
+        "type": "github"
+      }
+    },
+    "base16-vim": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1732806396,
+        "narHash": "sha256-e0bpPySdJf0F68Ndanwm+KWHgQiZ0s7liLhvJSWDNsA=",
+        "owner": "tinted-theming",
+        "repo": "base16-vim",
+        "rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-vim",
+        "rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
+        "type": "github"
+      }
+    },
+    "colmena": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "flake-utils": "flake-utils",
+        "nix-github-actions": "nix-github-actions",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "stable": "stable"
+      },
+      "locked": {
+        "lastModified": 1762034856,
+        "narHash": "sha256-QVey3iP3UEoiFVXgypyjTvCrsIlA4ecx6Acaz5C8/PQ=",
+        "owner": "zhaofengli",
+        "repo": "colmena",
+        "rev": "349b035a5027f23d88eeb3bc41085d7ee29f18ed",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zhaofengli",
+        "repo": "colmena",
+        "type": "github"
+      }
+    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -7,11 +99,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746728054,
+        "lastModified": 1768920986,
-        "narHash": "sha256-eDoSOhxGEm2PykZFa/x9QG5eTH0MJdiJ9aR00VAofXE=",
+        "narHash": "sha256-CNzzBsRhq7gg4BMBuTDObiWDH/rFYHEuDRVOwCcwXw4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "ff442f5d1425feb86344c028298548024f21256d",
+        "rev": "de5708739256238fb912c62f03988815db89ec9a",
         "type": "github"
       },
       "original": {
@@ -29,11 +121,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1768622624,
+        "lastModified": 1771732978,
-        "narHash": "sha256-Em6PP667PeXbEjidbV2LnNwmUYohbrSFvVPLYLUDHms=",
+        "narHash": "sha256-o7gZh/eXFkEEmzwlBdIbgCJhmdlqQhOhVjudqgsIefg=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "8061c6d9199dc6cc0727d4241959eea28f2fa0a6",
+        "rev": "18226106e18bc40cce99d436ee741a946f1888f6",
         "type": "gitlab"
       },
       "original": {
@@ -43,6 +135,54 @@
         "type": "gitlab"
       }
     },
+    "firefox-gnome-theme": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1764873433,
+        "narHash": "sha256-1XPewtGMi+9wN9Ispoluxunw/RwozuTRVuuQOmxzt+A=",
+        "owner": "rafaelmardojai",
+        "repo": "firefox-gnome-theme",
+        "rev": "f7ffd917ac0d253dbd6a3bf3da06888f57c69f92",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rafaelmardojai",
+        "repo": "firefox-gnome-theme",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1650374568,
+        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
@@ -65,7 +205,43 @@
         "type": "github"
       }
     },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "stylix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1767609335,
+        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "flake-utils": {
+      "locked": {
+        "lastModified": 1659877975,
+        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
       "inputs": {
         "systems": "systems"
       },
@@ -83,6 +259,84 @@
         "type": "github"
       }
     },
+    "fromYaml": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1731966426,
+        "narHash": "sha256-lq95WydhbUTWig/JpqiB7oViTcHFP8Lv41IGtayokA8=",
+        "owner": "SenchoPens",
+        "repo": "fromYaml",
+        "rev": "106af9e2f715e2d828df706c386a685698f3223b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "SenchoPens",
+        "repo": "fromYaml",
+        "type": "github"
+      }
+    },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1771857445,
+        "narHash": "sha256-NCrhxU9wq5+4jQG1fvRbyTnH8GSbH6LovreVoH2fOL4=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "3d7a52f678227930ab089f5d9b384f2d50f7d534",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "gnome-shell": {
+      "flake": false,
+      "locked": {
+        "host": "gitlab.gnome.org",
+        "lastModified": 1767737596,
+        "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
+        "owner": "GNOME",
+        "repo": "gnome-shell",
+        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
+        "type": "gitlab"
+      },
+      "original": {
+        "host": "gitlab.gnome.org",
+        "owner": "GNOME",
+        "ref": "gnome-49",
+        "repo": "gnome-shell",
+        "type": "gitlab"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -90,11 +344,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768598210,
+        "lastModified": 1771851181,
-        "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=",
+        "narHash": "sha256-gFgE6mGUftwseV3DUENMb0k0EiHd739lZexPo5O/sdQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6",
+        "rev": "9a4b494b1aa1b93d8edf167f46dc8e0c0011280c",
         "type": "github"
       },
       "original": {
@@ -122,13 +376,34 @@
         "type": "github"
       }
     },
+    "nix-github-actions": {
+      "inputs": {
+        "nixpkgs": [
+          "colmena",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1729742964,
+        "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
     "nix-secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1768414240,
+        "lastModified": 1770135527,
-        "narHash": "sha256-M/MObXs5oHjUGnKYMwU6Lrl/CfA1RMLGqJYytkfPXjg=",
+        "narHash": "sha256-Fup9LiyL6bDID3x+rAB2nP99Xv2o9Is5NkTDbmIy6o0=",
         "ref": "main",
-        "rev": "601921b44c3794e899bd31c0f302e9a9f5e6c480",
+        "rev": "521d144f8a8ff9fca8ccf492d7fbdd05d9a5fe37",
         "shallow": true,
         "type": "git",
         "url": "ssh://git@github.com/hektor/nix-secrets"
@@ -142,11 +417,11 @@
     },
     "nixCats": {
       "locked": {
-        "lastModified": 1768594882,
+        "lastModified": 1770584904,
-        "narHash": "sha256-KmVXwe4QDkcZlJbICj4FC83J+ZIT1r5t8nP+dCY/NDk=",
+        "narHash": "sha256-9Zaz8lbKF2W9pwXZEnbiGsicHdBoU+dHt3Wv3mCJoZ8=",
         "owner": "BirdeeHub",
         "repo": "nixCats-nvim",
-        "rev": "6a04f1c7d741b1f084324159ab7c15bcedbb1e0a",
+        "rev": "538fdde784d2909700d97a8ef307783b33a86fb1",
         "type": "github"
       },
       "original": {
@@ -157,7 +432,7 @@
     },
     "nixgl": {
       "inputs": {
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
         "nixpkgs": [
           "nixpkgs"
         ]
@@ -178,11 +453,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1768584846,
+        "lastModified": 1771423359,
-        "narHash": "sha256-IRPmIOV2tPwxbhP/I9M5AmwhTC0lMPtoPStC+8T6xl0=",
+        "narHash": "sha256-yRKJ7gpVmXbX2ZcA8nFi6CMPkJXZGjie2unsiMzj3Ig=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "cce68f4a54fa4e3d633358364477f5cc1d782440",
+        "rev": "740a22363033e9f1bb6270fbfb5a9574067af15b",
         "type": "github"
       },
       "original": {
@@ -194,11 +469,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1768564909,
+        "lastModified": 1771369470,
-        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
+        "narHash": "sha256-0NBlEBKkN3lufyvFegY4TYv5mCNHbi5OmBDrzihbBMQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f",
+        "rev": "0182a361324364ae3f436a63005877674cf45efb",
         "type": "github"
       },
       "original": {
@@ -224,6 +499,31 @@
         "type": "github"
       }
     },
+    "nur": {
+      "inputs": {
+        "flake-parts": [
+          "stylix",
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "stylix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1767810917,
+        "narHash": "sha256-ZKqhk772+v/bujjhla9VABwcvz+hB2IaRyeLT6CFnT0=",
+        "owner": "nix-community",
+        "repo": "NUR",
+        "rev": "dead29c804adc928d3a69dfe7f9f12d0eec1f1a4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "NUR",
+        "type": "github"
+      }
+    },
     "nvim": {
       "inputs": {
         "mcp-hub": "mcp-hub",
@@ -233,7 +533,6 @@
         ],
         "plugins-beancount-nvim": "plugins-beancount-nvim",
         "plugins-helm-ls-nvim": "plugins-helm-ls-nvim",
-        "plugins-m-taskwarrior-d-nvim": "plugins-m-taskwarrior-d-nvim",
         "plugins-mcphub-nvim": "plugins-mcphub-nvim",
         "plugins-nvimkit-nvim": "plugins-nvimkit-nvim",
         "plugins-shipwright-nvim": "plugins-shipwright-nvim",
@@ -281,30 +580,14 @@
         "type": "github"
       }
     },
-    "plugins-m-taskwarrior-d-nvim": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1767960157,
-        "narHash": "sha256-ov0qi4LhIlwqrBzSbTJ6APC5qjl2d/vlKWJfW5ZiDrg=",
-        "owner": "huantrinh1802",
-        "repo": "m_taskwarrior_d.nvim",
-        "rev": "107247387cd81823046bc2b8e71150c8edf041d3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "huantrinh1802",
-        "repo": "m_taskwarrior_d.nvim",
-        "type": "github"
-      }
-    },
     "plugins-mcphub-nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1768498135,
+        "lastModified": 1768730387,
-        "narHash": "sha256-FPnN22K98+XtmQT/TxX+uImFjBrLGre2rUHkNyOl2Js=",
+        "narHash": "sha256-g9tPvjThz6EUk7zcY7lL+YH4lrT4x3FJ6jrNMHA8PAE=",
         "owner": "ravitemer",
         "repo": "mcphub.nvim",
-        "rev": "415d9d0ea1db12eafc77c871f1ee07936f3b6e03",
+        "rev": "7cd5db330f41b7bae02b2d6202218a061c3ebc1f",
         "type": "github"
       },
       "original": {
@@ -363,15 +646,18 @@
     },
     "root": {
       "inputs": {
+        "colmena": "colmena",
         "disko": "disko",
         "firefox-addons": "firefox-addons",
+        "git-hooks": "git-hooks",
         "home-manager": "home-manager",
         "nix-secrets": "nix-secrets",
         "nixgl": "nixgl",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
         "nvim": "nvim",
-        "sops-nix": "sops-nix"
+        "sops-nix": "sops-nix",
+        "stylix": "stylix"
       }
     },
     "sops-nix": {
@@ -381,11 +667,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768481291,
+        "lastModified": 1771735105,
-        "narHash": "sha256-NjKtkJraCZEnLHAJxLTI+BfdU//9coAz9p5TqveZwPU=",
+        "narHash": "sha256-MJuVJeszZEziquykEHh/hmgIHYxUcuoG/1aowpLiSeU=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "e085e303dfcce21adcb5fec535d65aacb066f101",
+        "rev": "d7755d820f5fa8acf7f223309c33e25d4f92e74f",
         "type": "github"
       },
       "original": {
@@ -394,6 +680,56 @@
         "type": "github"
       }
     },
+    "stable": {
+      "locked": {
+        "lastModified": 1750133334,
+        "narHash": "sha256-urV51uWH7fVnhIvsZIELIYalMYsyr2FCalvlRTzqWRw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "36ab78dab7da2e4e27911007033713bab534187b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "stylix": {
+      "inputs": {
+        "base16": "base16",
+        "base16-fish": "base16-fish",
+        "base16-helix": "base16-helix",
+        "base16-vim": "base16-vim",
+        "firefox-gnome-theme": "firefox-gnome-theme",
+        "flake-parts": "flake-parts_2",
+        "gnome-shell": "gnome-shell",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "nur": "nur",
+        "systems": "systems_2",
+        "tinted-foot": "tinted-foot",
+        "tinted-kitty": "tinted-kitty",
+        "tinted-schemes": "tinted-schemes",
+        "tinted-tmux": "tinted-tmux",
+        "tinted-zed": "tinted-zed"
+      },
+      "locked": {
+        "lastModified": 1771787992,
+        "narHash": "sha256-Vg4bGwwenNYI8p3nJTl9FRyeIyrjATeZrZr+GyUSDrw=",
+        "owner": "danth",
+        "repo": "stylix",
+        "rev": "30054cca073b49b42a71289edec858f535b27fe9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "danth",
+        "repo": "stylix",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -408,6 +744,102 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "tinted-foot": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1726913040,
+        "narHash": "sha256-+eDZPkw7efMNUf3/Pv0EmsidqdwNJ1TaOum6k7lngDQ=",
+        "owner": "tinted-theming",
+        "repo": "tinted-foot",
+        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "tinted-foot",
+        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
+        "type": "github"
+      }
+    },
+    "tinted-kitty": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1735730497,
+        "narHash": "sha256-4KtB+FiUzIeK/4aHCKce3V9HwRvYaxX+F1edUrfgzb8=",
+        "owner": "tinted-theming",
+        "repo": "tinted-kitty",
+        "rev": "de6f888497f2c6b2279361bfc790f164bfd0f3fa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "tinted-kitty",
+        "type": "github"
+      }
+    },
+    "tinted-schemes": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767710407,
+        "narHash": "sha256-+W1EB79Jl0/gm4JqmO0Nuc5C7hRdp4vfsV/VdzI+des=",
+        "owner": "tinted-theming",
+        "repo": "schemes",
+        "rev": "2800e2b8ac90f678d7e4acebe4fa253f602e05b2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "schemes",
+        "type": "github"
+      }
+    },
+    "tinted-tmux": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767489635,
+        "narHash": "sha256-e6nnFnWXKBCJjCv4QG4bbcouJ6y3yeT70V9MofL32lU=",
+        "owner": "tinted-theming",
+        "repo": "tinted-tmux",
+        "rev": "3c32729ccae99be44fe8a125d20be06f8d7d8184",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "tinted-tmux",
+        "type": "github"
+      }
+    },
+    "tinted-zed": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767488740,
+        "narHash": "sha256-wVOj0qyil8m+ouSsVZcNjl5ZR+1GdOOAooAatQXHbuU=",
+        "owner": "tinted-theming",
+        "repo": "base16-zed",
+        "rev": "11abb0b282ad3786a2aae088d3a01c60916f2e40",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-zed",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -3,6 +3,10 @@
     nixpkgs = {
       url = "github:nixos/nixpkgs/nixos-unstable";
     };
+    stylix = {
+      url = "github:danth/stylix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     nixos-hardware = {
       url = "github:NixOS/nixos-hardware/master";
     };
@@ -34,53 +38,114 @@
       url = "path:./dots/.config/nvim";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    colmena = {
+      url = "github:zhaofengli/colmena";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    git-hooks = {
+      url = "github:cachix/git-hooks.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
     {
       self,
       nixpkgs,
-      nixos-hardware,
-      disko,
-      sops-nix,
-      nix-secrets,
       home-manager,
       nixgl,
-      firefox-addons,
+      git-hooks,
-      nvim,
+      ...
     }@inputs:
     let
       inherit (self) outputs;
-      lib = inputs.nixpkgs.lib;
+      inherit (inputs.nixpkgs) lib;
       utils = import ./utils { inherit lib; };
       hostDirNames = utils.dirNames ./hosts;
       system = "x86_64-linux";
-      pkgs = import nixpkgs {
+      dotsPath = ./dots;
-        inherit system;
+      gitHooks = import ./git-hooks.nix {
-        overlays = [ nixgl.overlay ];
+        inherit nixpkgs git-hooks system;
+        src = ./.;
       };
     in
     {
       nix.nixPath = [
         "nixpkgs=${inputs.nixpkgs}"
       ]; # <https://github.com/nix-community/nixd/blob/main/nixd/docs/configuration.md>
-      nixosConfigurations = lib.genAttrs hostDirNames (
+      nixosConfigurations =
+        (lib.genAttrs hostDirNames (
           host:
           nixpkgs.lib.nixosSystem {
-          modules = [ ./hosts/${host} ];
+            modules = [
+              ./hosts/${host}
+              { nixpkgs.hostPlatform = import ./hosts/${host}/system.nix; }
+            ];
             specialArgs = {
-            inherit inputs outputs;
+              inherit inputs outputs dotsPath;
             };
           }
-      );
+        ))
+        // {
+          sd-image-orange-pi-aarch64 = nixpkgs.lib.nixosSystem {
+            modules = [
+              "${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
+              ./images/sd-image-orange-pi-aarch64.nix
+              {
+                nixpkgs.buildPlatform = "x86_64-linux";
+                nixpkgs.hostPlatform = "aarch64-linux";
+              }
+            ];
+            specialArgs = {
+              inherit inputs outputs dotsPath;
+            };
+          };
+          sd-image-raspberry-pi-aarch64 = nixpkgs.lib.nixosSystem {
+            modules = [
+              "${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
+              ./images/sd-image-raspberry-pi-aarch64.nix
+              {
+                nixpkgs.buildPlatform = "x86_64-linux";
+                nixpkgs.hostPlatform = "aarch64-linux";
+              }
+            ];
+            specialArgs = {
+              inherit inputs outputs dotsPath;
+            };
+          };
+        };
+
       homeConfigurations = {
         work = home-manager.lib.homeManagerConfiguration {
-          inherit pkgs;
+          pkgs = import nixpkgs {
+            inherit system;
+            overlays = [ nixgl.overlay ];
+          };
           modules = [ ./home/hosts/work ];
           extraSpecialArgs = {
-            inherit inputs outputs;
+            inherit inputs outputs dotsPath;
           };
         };
       };
+
+      apps.${system}.colmena = inputs.colmena.apps.${system}.default;
+
+      colmena = import ./deploy/colmena.nix {
+        inherit
+          self
+          inputs
+          ;
+      };
+
+      checks.${system} = gitHooks.checks;
+      formatter.${system} = gitHooks.formatter;
+      devShells.${system} = gitHooks.devShells;
+
+      legacyPackages.${system} = {
+        sd-image-orange-pi-aarch64 =
+          self.nixosConfigurations.sd-image-orange-pi-aarch64.config.system.build.sdImage;
+        sd-image-raspberry-pi-aarch64 =
+          self.nixosConfigurations.sd-image-raspberry-pi-aarch64.config.system.build.sdImage;
+      };
     };
 }

git-hooks.nix

@@ -0,0 +1,47 @@
+{
+  nixpkgs,
+  git-hooks,
+  system,
+  src,
+}:
+let
+  pkgs = nixpkgs.legacyPackages.${system};
+
+  pre-commit-check = git-hooks.lib.${system}.run {
+    inherit src;
+    hooks = {
+      nixfmt = {
+        enable = true;
+        package = pkgs.nixfmt;
+      };
+      statix.enable = true;
+      deadnix.enable = true;
+    };
+  };
+in
+{
+  checks = {
+    inherit pre-commit-check;
+  };
+
+  formatter =
+    let
+      inherit (pre-commit-check) config;
+      inherit (config) package configFile;
+      script = ''
+        ${pkgs.lib.getExe package} run --all-files --config ${configFile}
+      '';
+    in
+    pkgs.writeShellScriptBin "pre-commit-run" script;
+
+  devShells = {
+    default =
+      let
+        inherit (pre-commit-check) shellHook enabledPackages;
+      in
+      pkgs.mkShell {
+        inherit shellHook;
+        buildInputs = enabledPackages;
+      };
+  };
+}

home/hosts/andromache/default.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  inputs,
   config,
   pkgs,
   ...
@@ -11,25 +10,44 @@ let
 in
 {
   imports = [
+    ../../modules
+    ../../modules/ai-tools.nix
+    ../../modules/audio
+    ../../modules/cloud
+    ../../modules/comms
     ../../modules/desktop/niri
-    ../../modules/git.nix
+    ../../modules/direnv
-    ../../modules/k9s.nix
+    ../../modules/3d
+    ../../modules/git
+    ../../modules/k8s/k9s.nix
+    ../../modules/kitty.nix
+    ../../modules/music
+    ../../modules/nvim.nix
+    ../../modules/pandoc.nix
     ../../modules/ssh.nix
     ../../modules/taskwarrior.nix
     ../../modules/keepassxc.nix
     ../../modules/anki.nix
+    ../../modules/photography
     ../../modules/browser
     ../../modules/shell
   ];
 
-  home.stateVersion = "25.05";
+  home = {
-  home.username = username;
+    stateVersion = "25.05";
-  home.homeDirectory = "/home/${username}";
+    inherit username;
+    homeDirectory = "/home/${username}";
+  };
 
   xdg.userDirs.createDirectories = false;
   xdg.userDirs.download = "${config.home.homeDirectory}/dl";
 
+  ai-tools.opencode.enable = true;
   browser.primary = "librewolf";
+  cloud.hetzner.enable = true;
+  comms.signal.enable = true;
+  github.enable = true;
+  pandoc.enable = true;
 
   shell.bash = {
     enable = true;
@@ -41,16 +59,5 @@ in
     taskwarrior.config.recurrence = lib.mkForce "on";
   };
 
-  home.packages = import ../packages.nix {
+  home.packages = import ../packages.nix { inherit pkgs; };
-    inherit pkgs;
-    inherit config;
-  };
-
-  home.file = {
-    ".config/kitty/kitty.conf".source = ../../../dots/.config/kitty/kitty.conf;
-    ".config/kitty/themes/zenwritten_light.conf".source =
-      ../../../dots/.config/kitty/themes/zenwritten_light.conf;
-    ".config/kitty/themes/zenwritten_dark.conf".source =
-      ../../../dots/.config/kitty/themes/zenwritten_dark.conf;
-  };
 }

home/hosts/astyanax/default.nix

@@ -1,5 +1,4 @@
 {
-  inputs,
   config,
   pkgs,
   ...
@@ -10,10 +9,21 @@ let
 in
 {
   imports = [
+    ../../modules
+    ../../modules/ai-tools.nix
+    ../../modules/audio
     ../../modules/anki.nix
+    ../../modules/cloud
+    ../../modules/comms
+    ../../modules/direnv
     ../../modules/desktop/niri
-    ../../modules/git.nix
+    ../../modules/git
-    ../../modules/k9s.nix
+    ../../modules/k8s/k9s.nix
+    ../../modules/kitty.nix
+    ../../modules/music
+    ../../modules/nfc
+    ../../modules/nvim.nix
+    ../../modules/pandoc.nix
     ../../modules/ssh.nix
     ../../modules/taskwarrior.nix
     ../../modules/keepassxc.nix
@@ -21,14 +31,22 @@ in
     ../../modules/shell
   ];
 
-  home.stateVersion = "25.05";
+  home = {
-  home.username = username;
+    stateVersion = "25.05";
-  home.homeDirectory = "/home/${username}";
+    inherit username;
+    homeDirectory = "/home/${username}";
+  };
 
   xdg.userDirs.createDirectories = false;
   xdg.userDirs.download = "${config.home.homeDirectory}/dl";
 
+  ai-tools.opencode.enable = true;
   browser.primary = "librewolf";
+  cloud.hetzner.enable = true;
+  comms.signal.enable = true;
+  github.enable = true;
+  nfc.proxmark3.enable = true;
+  pandoc.enable = true;
 
   shell.bash = {
     enable = true;
@@ -43,12 +61,4 @@ in
     inherit pkgs;
     inherit config;
   };
-
-  home.file = {
-    ".config/kitty/kitty.conf".source = ../../../dots/.config/kitty/kitty.conf;
-    ".config/kitty/themes/zenwritten_light.conf".source =
-      ../../../dots/.config/kitty/themes/zenwritten_light.conf;
-    ".config/kitty/themes/zenwritten_dark.conf".source =
-      ../../../dots/.config/kitty/themes/zenwritten_dark.conf;
-  };
 }

home/hosts/packages.nix

@@ -2,34 +2,21 @@
 
 with pkgs;
 [
-  bash-completion
   bat
   entr
   feh
   fzf
-  gh
-  git
-  haskellPackages.pandoc-crossref
   htop
   jq
-  kitty
-  nixfmt-rfc-style
   nmap
-  nodejs_24
   nvimpager
-  pandoc
   parallel
   pass
-  pnpm
-  python3
   ripgrep
-  signal-desktop
   silver-searcher
   sops
   sshfs
   tldr
-  tmux
-  tmuxp
   tree
   unzip
   vimPlugins.vim-plug

home/hosts/work/default.nix

@@ -11,12 +11,31 @@ in
 {
   imports = [
     inputs.sops-nix.homeManagerModules.sops
+    ../../modules
+    ../../modules/stylix.nix
+    ../../modules/ai-tools.nix
+    ../../modules/cloud
+    ../../modules/comms
+    ../../modules/desktop/niri
     ../../modules/dconf.nix
-    ../../modules/git.nix
+    ../../modules/direnv
-    ../../modules/k9s.nix
+    ../../modules/docker
+    ../../modules/git
+    ../../modules/go
+    ../../modules/k8s
+    ../../modules/k8s/k9s.nix
     ../../modules/keepassxc.nix
+    ../../modules/kitty.nix
+    ../../modules/nvim.nix
+    ../../modules/pandoc.nix
     ../../modules/browser
+    ../../modules/shell
+    ../../modules/music
+    ../../modules/nodejs.nix
     ../../modules/taskwarrior.nix
+    ../../modules/bruno.nix
+    ../../modules/pandoc.nix
+    ../../modules/vscode.nix
   ];
 
   sops = {
@@ -29,37 +48,73 @@ in
       taskwarrior_sync_encryption_secret = { };
       anki_sync_user = { };
       anki_sync_key = { };
+      opencode_api_key = { };
     };
 
-    templates."taskrc.d/sync" = {
+    templates = {
+      "taskrc.d/sync" = {
         content = ''
           sync.server.url=${config.sops.placeholder.taskwarrior_sync_server_url}
           sync.server.client_id=${config.sops.placeholder.taskwarrior_sync_server_client_id}
           sync.encryption_secret=${config.sops.placeholder.taskwarrior_sync_encryption_secret}
         '';
       };
+
+      "opencode/auth.json" = {
+        path = "${config.home.homeDirectory}/.local/share/opencode/auth.json";
+        content = ''
+          {
+            "zai-coding-plan": {
+              "type": "api",
+              "key": "${config.sops.placeholder.opencode_api_key}"
+            }
+          }
+        '';
+      };
+    };
   };
 
   nixpkgs.config.allowUnfree = true;
 
-  home.stateVersion = "25.05";
+  home = {
-  home.username = username;
+    stateVersion = "25.05";
-  home.homeDirectory = "/home/${username}";
+    inherit username;
+    homeDirectory = "/home/${username}";
+  };
 
   targets.genericLinux.nixGL = {
-    packages = inputs.nixgl.packages;
+    inherit (inputs.nixgl) packages;
     defaultWrapper = "mesa";
   };
 
   browser.primary = "firefox";
   browser.secondary = "chromium";
+  cloud.azure.enable = true;
+  comms.signal.enable = true;
+  comms.teams.enable = true;
+  ai-tools = {
+    claude-code.enable = true;
+    opencode.enable = true;
+  };
+  github.enable = true;
+  gitlab.enable = true;
+  pandoc.enable = true;
+
+  shell.bash.enable = true;
+  starship.enable = true;
 
   programs = {
     gh.enable = true;
     kubecolor.enable = true;
   };
 
-  home.packages = import ./packages.nix {
+  home.packages =
+    import ./packages.nix {
+      inherit inputs;
+      inherit config;
+      inherit pkgs;
+    }
+    ++ import ../packages.nix {
       inherit inputs;
       inherit config;
       inherit pkgs;

home/hosts/work/packages.local.nix

@@ -1,124 +0,0 @@
-{
-  inputs,
-  config,
-  pkgs,
-  ...
-}:
-
-with pkgs;
-[
-  (pkgs.stdenv.mkDerivation {
-    name = "ccline";
-    src = pkgs.fetchurl {
-      url = "https://github.com/Haleclipse/CCometixLine/releases/download/v1.0.8/ccline-linux-x64.tar.gz";
-      hash = "sha256-Joe3Dd6uSMGi66QT6xr2oY/Tz8rA5RuKa6ckBVJIzI0=";
-    };
-
-    unpackPhase = ''
-      tar xzf $src
-    '';
-
-    installPhase = ''
-      mkdir -p $out/bin
-      cp ccline $out/bin/
-      chmod +x $out/bin/ccline
-    '';
-
-    meta = with pkgs.lib; {
-      description = "CCometixLine Linux x64 CLI (Claude Code statusline)";
-      homepage = "https://github.com/Haleclipse/CCometixLine";
-      license = licenses.mit;
-      platforms = [ "x86_64-linux" ];
-    };
-  })
-
-  act
-  age
-  aider-chat
-  argocd
-  azure-cli
-  bat
-  biome
-  (config.lib.nixGL.wrap bruno)
-  chromium
-  clang
-  claude-code
-  (config.lib.nixGL.wrap code-cursor)
-  curl
-  dconf2nix
-  dive
-  emmet-language-server
-  eslint_d
-  flameshot
-  fluxcd
-  fzf
-  fzf-git-sh
-  git-machete
-  github-copilot-cli
-  glab
-  go
-  hadolint
-  hello
-  helm-ls
-  htop
-  input-leap
-  jira-cli-go
-  jq
-  k3d
-  (config.lib.nixGL.wrap kitty)
-  kubectl
-  kubernetes
-  kubernetes-helm
-  kustomize
-  lua
-  lua-language-server
-  minikube
-  ncspot
-  nil
-  nixd
-  nixfmt-rfc-style
-  # nodejs
-  nodejs_24
-  nvimpager
-  (config.lib.nixGL.wrap obsidian)
-  pavucontrol
-  # pgadmin4
-  prettierd
-  responder
-  ripgrep
-  rust-analyzer
-  rustlings
-  shellcheck
-  (config.lib.nixGL.wrap signal-desktop)
-  silver-searcher
-  sleuthkit
-  spotify
-  starship
-  stylua
-  taskopen
-  taskwarrior3
-  (config.lib.nixGL.wrap teams-for-linux)
-  opentofu
-  sops
-  tldr
-  tmux
-  tree
-  tree-sitter
-  tsx
-  upbound
-  vault-bin
-  (config.lib.nixGL.wrap vscode)
-  vscode-langservers-extracted
-  vtsls
-  yaml-language-server
-  xclip
-  xmage
-  yamllint
-  yarn
-  (python314.withPackages (ppkgs: [
-    ppkgs.plyer
-    ppkgs.dbus-python
-  ]))
-  # flakes
-  inputs.nvim.packages.x86_64-linux.nvim
-]

home/hosts/work/packages.nix

@@ -13,7 +13,4 @@ let
       [ ];
 in
 
-(with pkgs; [
+localPackages
-  inputs.nvim.packages.x86_64-linux.nvim
-])
-++ localPackages

home/modules/3d/default.nix

@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+
+{
+  home.packages = with pkgs; [
+    bambu-studio
+    blender
+    openscad-lsp
+    openscad-unstable
+    orca-slicer
+  ];
+}

home/modules/ai-tools.nix

@@ -0,0 +1,89 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.ai-tools;
+  rtk-version = "0.18.1";
+in
+{
+  options.ai-tools = {
+    claude-code.enable = lib.mkEnableOption "claude code with rtk and ccline";
+    opencode.enable = lib.mkEnableOption "opencode";
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.claude-code.enable {
+      home.packages = with pkgs; [
+        claude-code
+        (pkgs.stdenv.mkDerivation {
+          name = "ccline";
+          src = pkgs.fetchurl {
+            url = "https://github.com/Haleclipse/CCometixLine/releases/download/v1.0.8/ccline-linux-x64.tar.gz";
+            hash = "sha256-Joe3Dd6uSMGi66QT6xr2oY/Tz8rA5RuKa6ckBVJIzI0=";
+          };
+
+          unpackPhase = ''
+            tar xzf $src
+          '';
+
+          installPhase = ''
+            mkdir -p $out/bin
+            cp ccline $out/bin/
+            chmod +x $out/bin/ccline
+          '';
+
+          meta = with pkgs.lib; {
+            description = "CCometixLine Linux x64 CLI (Claude Code statusline)";
+            homepage = "https://github.com/Haleclipse/CCometixLine";
+            license = licenses.mit;
+            platforms = [ "x86_64-linux" ];
+          };
+        })
+        (pkgs.stdenv.mkDerivation {
+          name = "rtk-${rtk-version}";
+          version = rtk-version;
+          src = pkgs.fetchurl {
+            url = "https://github.com/rtk-ai/rtk/releases/download/v${rtk-version}/rtk-x86_64-unknown-linux-gnu.tar.gz";
+            hash = "sha256-XoTia5K8b00OzcKYCufwx8ApkAS31DxUCpGSU0jFs2Q=";
+          };
+
+          unpackPhase = ''
+            tar xzf $src
+          '';
+
+          installPhase = ''
+            mkdir -p $out/bin
+            cp rtk $out/bin/
+            chmod +x $out/bin/rtk
+          '';
+
+          meta = with pkgs.lib; {
+            description = "RTK - AI coding tool enhancer";
+            homepage = "https://www.rtk-ai.app";
+            license = licenses.mit;
+            platforms = [ "x86_64-linux" ];
+          };
+        })
+        mcp-nixos
+      ];
+    })
+    (lib.mkIf cfg.opencode.enable {
+      home.packages = with pkgs; [
+        opencode
+      ];
+      home.file.".config/opencode/opencode.json".text = builtins.toJSON {
+        "$schema" = "https://opencode.ai/config.json";
+        permission = {
+          external_directory = {
+            "/run/secrets/" = "deny";
+            "~/.config/sops/age/keys.txt" = "deny";
+          };
+        };
+        plugin = [ "@mohak34/opencode-notifier@latest" ];
+      };
+    })
+  ];
+}

home/modules/audio/default.nix

@@ -0,0 +1,5 @@
+{ pkgs, ... }:
+
+{
+  home.packages = with pkgs; [ pulsemixer ];
+}

home/modules/browser/firefox-base.nix

@@ -0,0 +1,89 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  bookmarks = import ./bookmarks.nix;
+in
+
+{
+  nativeMessagingHosts =
+    with pkgs;
+    [
+      tridactyl-native
+    ]
+    ++ lib.optionals config.programs.keepassxc.enable [ keepassxc ];
+  profiles = {
+    default = {
+      settings = {
+        "signon.rememberSignons" = false;
+        "findbar.highlightAll" = true;
+        "extensions.autoDisableScopes" = 0;
+      };
+      extensions = {
+        force = true;
+        packages = with inputs.firefox-addons.packages.${pkgs.stdenv.hostPlatform.system}; [
+          duckduckgo-privacy-essentials
+          firefox-color
+          istilldontcareaboutcookies
+          libredirect
+          keepassxc-browser
+          react-devtools
+          sponsorblock
+          tridactyl
+          ublock-origin
+        ];
+      };
+      bookmarks = {
+        force = true;
+        settings = [
+          {
+            toolbar = true;
+            bookmarks = [
+              bookmarks.nixos
+            ];
+          }
+        ];
+      };
+    };
+  };
+  policies = {
+    DefaultDownloadDirectory = "\${home}/dl";
+    ExtensionSettings = {
+      "jid1-ZAdIEUB7XOzOJw@jetpack" = {
+        default_area = "navbar";
+        private_browsing = true;
+      };
+      "idcac-pub@guus.ninja" = {
+        default_area = "navbar";
+        private_browsing = true;
+      };
+      "7esoorv3@alefvanoon.anonaddy.me" = {
+        default_area = "navbar";
+      };
+      "keepassxc-browser@keepassxc.org" = {
+        default_area = "navbar";
+        private_browsing = true;
+      };
+      "@react-devtools" = {
+        default_area = "navbar";
+        private_browsing = true;
+      };
+      "sponsorBlocker@ajay.app" = {
+        default_area = "navbar";
+        private_browsing = true;
+      };
+      "tridactyl.vim@cmcaine.co.uk".settings = {
+        private_browsing = true;
+      };
+      "uBlock0@raymondhill.net".settings = {
+        default_area = "navbar";
+        private_browsing = true;
+      };
+    };
+  };
+}

home/modules/browser/firefox.nix

@@ -1,89 +1,23 @@
 {
   config,
-  inputs,
   lib,
+  inputs,
   pkgs,
   ...
 }:
 
-let
-  bookmarks = import ./bookmarks.nix;
-in
-
 {
   config = lib.mkIf (config.browser.primary == "firefox" || config.browser.secondary == "firefox") {
     programs.firefox = {
       enable = true;
-      nativeMessagingHosts = with pkgs; [
-        tridactyl-native
-      ];
-      profiles = {
-        default = {
-          settings = {
-            "signon.rememberSignons" = false;
-            "findbar.highlightAll" = true;
-            "extensions.autoDisableScopes" = 0;
-          };
-          extensions = {
-            packages = with inputs.firefox-addons.packages.${pkgs.system}; [
-              duckduckgo-privacy-essentials
-              istilldontcareaboutcookies
-              libredirect
-              keepassxc-browser
-              react-devtools
-              sponsorblock
-              tridactyl
-              ublock-origin
-            ];
-          };
-          bookmarks = {
-            force = true;
-            settings = [
-              {
-                toolbar = true;
-                bookmarks = [
-                  bookmarks.nixos
-                ];
     }
-            ];
+    // (import ./firefox-base.nix {
-          };
+      inherit
-        };
+        config
-      };
+        inputs
-      policies = {
+        lib
-        DefaultDownloadDirectory = "\${home}/dl";
+        pkgs
-        ExtensionSettings = {
+        ;
-          "jid1-ZAdIEUB7XOzOJw@jetpack" = {
+    });
-            default_area = "navbar";
-            private_browsing = true;
-          };
-          "idcac-pub@guus.ninja" = {
-            default_area = "navbar";
-            private_browsing = true;
-          };
-          "7esoorv3@alefvanoon.anonaddy.me" = {
-            default_area = "navbar";
-          };
-          "keepassxc-browser@keepassxc.org" = {
-            default_area = "navbar";
-            private_browsing = true;
-          };
-          "@react-devtools" = {
-            default_area = "navbar";
-            private_browsing = true;
-          };
-          "sponsorBlocker@ajay.app" = {
-            default_area = "navbar";
-            private_browsing = true;
-          };
-          "tridactyl.vim@cmcaine.co.uk".settings = {
-            private_browsing = true;
-          };
-          "uBlock0@raymondhill.net".settings = {
-            default_area = "navbar";
-            private_browsing = true;
-          };
-        };
-      };
-    };
   };
 }

home/modules/browser/librewolf.nix

@@ -1,91 +1,25 @@
 {
   config,
-  inputs,
   lib,
+  inputs,
   pkgs,
   ...
 }:
 
-let
-  bookmarks = import ./bookmarks.nix;
-in
-
 {
   config =
     lib.mkIf (config.browser.primary == "librewolf" || config.browser.secondary == "librewolf")
       {
         programs.librewolf = {
           enable = true;
-          nativeMessagingHosts = with pkgs; [
-            tridactyl-native
-          ];
-          profiles = {
-            default = {
-              settings = {
-                "signon.rememberSignons" = false;
-                "findbar.highlightAll" = true;
-                "extensions.autoDisableScopes" = 0;
-              };
-              extensions = {
-                packages = with inputs.firefox-addons.packages.${pkgs.system}; [
-                  duckduckgo-privacy-essentials
-                  istilldontcareaboutcookies
-                  libredirect
-                  keepassxc-browser
-                  react-devtools
-                  sponsorblock
-                  tridactyl
-                  ublock-origin
-                ];
-              };
-              bookmarks = {
-                force = true;
-                settings = [
-                  {
-                    toolbar = true;
-                    bookmarks = [
-                      bookmarks.nixos
-                    ];
         }
-                ];
+        // (import ./firefox-base.nix {
-              };
+          inherit
-            };
+            config
-          };
+            inputs
-          policies = {
+            lib
-            DefaultDownloadDirectory = "\${home}/dl";
+            pkgs
-            ExtensionSettings = {
+            ;
-              "jid1-ZAdIEUB7XOzOJw@jetpack" = {
+        });
-                default_area = "navbar";
-                private_browsing = true;
-              };
-              "idcac-pub@guus.ninja" = {
-                default_area = "navbar";
-                private_browsing = true;
-              };
-              "7esoorv3@alefvanoon.anonaddy.me" = {
-                default_area = "navbar";
-              };
-              "keepassxc-browser@keepassxc.org" = {
-                default_area = "navbar";
-                private_browsing = true;
-              };
-              "@react-devtools" = {
-                default_area = "navbar";
-                private_browsing = true;
-              };
-              "sponsorBlocker@ajay.app" = {
-                default_area = "navbar";
-                private_browsing = true;
-              };
-              "tridactyl.vim@cmcaine.co.uk".settings = {
-                private_browsing = true;
-              };
-              "uBlock0@raymondhill.net".settings = {
-                default_area = "navbar";
-                private_browsing = true;
-              };
-            };
-          };
-        };
       };
 }

home/modules/bruno.nix

@@ -0,0 +1,7 @@
+{ config, pkgs, ... }:
+
+{
+  config = {
+    home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.bruno "--no-sandbox")) ];
+  };
+}

home/modules/cloud/azure.nix

@@ -0,0 +1,12 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  config = lib.mkIf config.cloud.azure.enable {
+    home.packages = with pkgs; [ azure-cli ];
+  };
+}

home/modules/cloud/default.nix

@@ -0,0 +1,17 @@
+{ lib, ... }:
+
+{
+  options.cloud = {
+    azure = {
+      enable = lib.mkEnableOption "azure CLI";
+    };
+    hetzner = {
+      enable = lib.mkEnableOption "hetzner CLI";
+    };
+  };
+
+  imports = [
+    ./azure.nix
+    ./hetzner.nix
+  ];
+}

home/modules/cloud/hetzner.nix

@@ -0,0 +1,21 @@
+{
+  config,
+  lib,
+  pkgs,
+  osConfig ? null,
+  ...
+}:
+
+let
+  isNixOS = osConfig != null;
+in
+{
+  config = lib.mkIf config.cloud.hetzner.enable {
+    warnings =
+      lib.optional (!isNixOS)
+        "hcloud module requires NixOS host configuration. This module will not work with standalone home-manager.";
+    home = {
+      packages = with pkgs; [ hcloud ];
+    };
+  };
+}

home/modules/comms/default.nix

@@ -0,0 +1,17 @@
+{ lib, ... }:
+
+{
+  options.comms = {
+    signal = {
+      enable = lib.mkEnableOption "signal";
+    };
+    teams = {
+      enable = lib.mkEnableOption "teams";
+    };
+  };
+
+  imports = [
+    ./signal.nix
+    ./teams.nix
+  ];
+}

home/modules/comms/signal.nix

@@ -0,0 +1,12 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  config = lib.mkIf config.comms.signal.enable {
+    home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.signal-desktop "--no-sandbox")) ];
+  };
+}

home/modules/comms/teams.nix

@@ -0,0 +1,12 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  config = lib.mkIf config.comms.teams.enable {
+    home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.teams-for-linux "--no-sandbox")) ];
+  };
+}

home/modules/dconf.nix

@@ -1,21 +1,13 @@
+{ config, pkgs, ... }:
+
+let
+  terminal = "kitty";
+  browser = config.browser.primary;
+in
 {
   dconf.settings = {
-    "org/gnome/settings-daemon/plugins/color" = {
-      night-light-enabled = true;
-      night-light-schedule-automatic = true;
-    };
-    "org/gnome/desktop/interface" = {
-      color-scheme = "prefer-dark";
-    };
-
-    "org/gnome/desktop/applications/terminal" = {
-      exec = "kitty";
-      exec-arg = "";
-    };
-
     "org/gnome/desktop/background" = {
       color-shading-type = "solid";
-      picture-opacity = 100;
       picture-options = "zoom";
       picture-uri = "none";
       picture-uri-dark = "none";
@@ -24,55 +16,54 @@
       show-desktop-icons = false;
     };
 
-    # "org/gnome/desktop/input-sources" = {
+    "org/gnome/desktop/default-applications/office/calendar" = {
-    #   sources = [
+      exec = "${browser} https://calendar.proton.me";
-    #     (mkTuple [
+      needs-term = false;
-    #       "xkb"
+    };
-    #       "us"
+
-    #     ])
+    "org/gnome/desktop/default-applications/office/tasks" = {
-    #   ];
+      exec = "task";
-    #   xkb-options = [ "caps:none" ];
+      needs-term = true;
-    # };
+    };
+
+    "org/gnome/desktop/default-applications/terminal" = {
+      exec = terminal;
+      exec-arg = "";
+    };
+
+    "org/gnome/desktop/input-sources" = {
+      xkb-options = [ "caps:none" ];
+    };
+
+    "org/gnome/desktop/interface" = {
+      clock-format = "24h";
+      clock-show-weekday = true;
+      color-scheme = "prefer-dark";
+      enable-hot-corners = false;
+      font-name = "Iosevka Term SS08 12";
+      locate-pointer = true;
+      monospace-font-name = "Iosevka Term SS08 12";
+    };
 
     "org/gnome/desktop/wm/keybindings" = {
       close = [ "<Shift><Super>Delete" ];
-      cycle-group = [ ];
+      minimize = [ "<Super>h" ];
-      cycle-group-backward = [ ];
+      move-to-monitor-down = [ "<Super><Shift>Down" ];
-      cycle-panels = [ ];
+      move-to-monitor-left = [ "<Super><Shift>Left" ];
-      cycle-panels-backward = [ ];
+      move-to-monitor-right = [ "<Super><Shift>Right" ];
-      cycle-windows = [ ];
+      move-to-monitor-up = [ "<Super><Shift>Up" ];
-      cycle-windows-backward = [ ];
-      maximize = [ "<Super> " ];
-      minimize = [ ];
       move-to-workspace-1 = [ "<Super><Shift>a" ];
       move-to-workspace-2 = [ "<Super><Shift>s" ];
       move-to-workspace-3 = [ "<Super><Shift>d" ];
       move-to-workspace-4 = [ "<Super><Shift>f" ];
       move-to-workspace-5 = [ "<Super><Shift>g" ];
-      move-to-workspace-last = [ ];
-      move-to-workspace-left = [ "<Super><Shift>h" ];
-      move-to-workspace-right = [ "<Super><Shift>l" ];
-      panel-run-dialog = [ ];
       switch-applications = [ "<Super>j" ];
       switch-applications-backward = [ "<Super>k" ];
-      switch-group = [ ];
-      switch-group-backward = [ ];
-      switch-input-source = [ ];
-      switch-input-source-backward = [ ];
-      switch-panels = [ ];
-      switch-panels-backward = [ ];
       switch-to-workspace-1 = [ "<Super>a" ];
       switch-to-workspace-2 = [ "<Super>s" ];
       switch-to-workspace-3 = [ "<Super>d" ];
       switch-to-workspace-4 = [ "<Super>f" ];
       switch-to-workspace-5 = [ "<Super>g" ];
-      switch-to-workspace-last = [ ];
-      switch-to-workspace-left = [ "<Super>h" ];
-      switch-to-workspace-right = [ "<Super>l" ];
-      switch-windows = [ ];
-      switch-windows-backward = [ ];
-      toggle-maximized = [ "<Super>space" ];
-      unmaximize = [ ];
     };
 
     "org/gnome/desktop/wm/preferences" = {
@@ -86,8 +77,19 @@
       ];
     };
 
+    "org/gnome/mutter" = {
+      center-new-windows = true;
+      dynamic-workspaces = false;
+    };
+
+    "org/gnome/settings-daemon/plugins/color" = {
+      night-light-enabled = true;
+      night-light-schedule-automatic = true;
+    };
+
     "org/gnome/settings-daemon/plugins/media-keys" = {
       custom-keybindings = [
+        "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/"
         "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1/"
       ];
     };
@@ -100,14 +102,23 @@
 
     "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1" = {
       binding = "<Super>Return";
-      command = "kitty";
+      command = terminal;
       name = "Kitty";
     };
 
+    "org/gnome/settings-daemon/plugins/power" = {
+      power-button-action = "suspend";
+    };
+
+    "org/gnome/shell/app-switcher" = {
+      current-workspace-only = true;
+    };
+
     "org/gnome/shell/keybindings" = {
-      screenshot = [ "Print" ];
       toggle-application-view = [ "<Super>p" ];
       toggle-quick-settings = [ ];
     };
   };
+
+  home.packages = with pkgs; [ dconf2nix ];
 }

home/modules/default.nix

@@ -0,0 +1,24 @@
+{ config, lib, ... }:
+
+{
+  options.nixgl.wrap = lib.mkOption {
+    type = lib.types.functionTo lib.types.package;
+    default = if config.lib ? nixGL then config.lib.nixGL.wrap else lib.id;
+    readOnly = true;
+  };
+
+  options.wrapApp = lib.mkOption {
+    type = lib.types.raw;
+    default =
+      pkg: flags:
+      if config.lib ? nixGL then
+        pkg.overrideAttrs (old: {
+          postInstall = (old.postInstall or "") + ''
+            wrapProgram $out/bin/${pkg.meta.mainProgram} --add-flags "${flags}"
+          '';
+        })
+      else
+        pkg;
+    readOnly = true;
+  };
+}

home/modules/desktop/niri/config.kdl

@@ -48,8 +48,7 @@ layout {
     }
 }
 
-spawn-at-startup "wlsunset -l 51.05 -L 3.72"
+
-spawn-at-startup "waybar"
 
 hotkey-overlay {
     skip-at-startup

home/modules/desktop/niri/default.nix

@@ -11,8 +11,16 @@
   home = {
     file.".config/niri/config.kdl".source = ./config.kdl;
     packages = with pkgs; [
+      brightnessctl
       wl-clipboard
       wlsunset
     ];
   };
+
+  services.gammastep = {
+    enable = true;
+    provider = "manual";
+    latitude = 51.05;
+    longitude = 3.71667;
+  };
 }

home/modules/direnv/default.nix

@@ -0,0 +1,7 @@
+{
+  programs.direnv = {
+    enable = true;
+    enableBashIntegration = true;
+    nix-direnv.enable = true;
+  };
+}

home/modules/docker/default.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+
+{
+  config = {
+    home.packages = with pkgs; [
+      dive
+    ];
+  };
+}

home/modules/fuzzel/default.nix

@@ -3,22 +3,9 @@
     enable = true;
     settings = {
       main = {
-        font = "Iosevka Term SS08";
         horizontal-pad = 0;
         vertical-pad = 0;
       };
-      colors = {
-        background = "ccccccff";
-        text = "111111ff";
-        prompt = "ccccccff";
-        placeholder = "aaaaaaff";
-        input = "111111ff";
-        selection = "eeeeeeff";
-        selection-text = "111111ff";
-        selection-match = "333333ff";
-        counter = "111111ff";
-        border = "111111ff";
-      };
       border = {
         width = 2;
         radius = 0;

home/modules/git.nix

@@ -1,8 +0,0 @@
-{
-  programs.git.enable = true;
-  home.file = {
-    ".gitconfig".source = ../../dots/.gitconfig;
-    ".gitconfig.work".source = ../../dots/.gitconfig.work;
-    ".gitignore".source = ../../dots/.gitignore;
-  };
-}

home/modules/git/default.nix

@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  pkgs,
+  dotsPath,
+  ...
+}:
+
+{
+  options = {
+    github.enable = lib.mkEnableOption "Github CLI";
+    gitlab.enable = lib.mkEnableOption "Gitlab CLI";
+  };
+
+  config = {
+    programs.git.enable = true;
+    home.file = {
+      ".gitconfig".source = dotsPath + "/.gitconfig";
+      ".gitconfig.work".source = dotsPath + "/.gitconfig.work";
+      ".gitignore".source = dotsPath + "/.gitignore";
+    };
+
+    programs.gh.enable = config.github.enable;
+    home.packages = lib.optionals config.gitlab.enable [ pkgs.glab ];
+  };
+}

home/modules/go/default.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  options.go = {
+    enable = lib.mkEnableOption "go language";
+  };
+
+  config = lib.mkIf config.go.enable {
+    home.packages = with pkgs; [
+      go
+      gopls
+    ];
+  };
+}

home/modules/k8s/default.nix

@@ -0,0 +1,25 @@
+{ pkgs, ... }:
+
+{
+  home.packages = with pkgs; [
+    argocd
+    fluxcd
+    k3d
+    kubectl
+    kubernetes
+    kustomize
+    minikube
+    opentofu
+    upbound
+  ];
+
+  programs.kubecolor = {
+    enable = true;
+    enableAlias = true;
+  };
+
+  imports = [
+    ./helm.nix
+    ./k9s.nix
+  ];
+}

home/modules/k8s/helm.nix

@@ -0,0 +1,15 @@
+{ pkgs, ... }:
+
+{
+  home.packages = with pkgs; [
+    (wrapHelm kubernetes-helm {
+      plugins = with kubernetes-helmPlugins; [
+        helm-diff
+        helm-git
+        helm-schema
+        helm-secrets
+        helm-unittest
+      ];
+    })
+  ];
+}

home/modules/keepassxc.nix

@@ -1,5 +1,3 @@
-{ pkgs, ... }:
-
 {
   programs.keepassxc = {
     enable = true;
@@ -7,5 +5,4 @@
       Browser.Enabled = true;
     };
   };
-  # programs.firefox.nativeMessagingHosts = [ pkgs.keepassxc ]; # FIXME: Resolve 'Access error for config file $HOME/.config/keepassxc/keepassxc.ini' error
 }

home/modules/kitty.nix

@@ -0,0 +1,22 @@
+{
+  pkgs,
+  config,
+  dotsPath,
+  ...
+}:
+
+{
+  config = {
+    programs.bash.shellAliases = {
+      icat = "kitty +kitten icat";
+    };
+
+    programs.kitty = {
+      enable = true;
+      package = config.nixgl.wrap pkgs.kitty;
+      extraConfig = builtins.readFile (dotsPath + "/.config/kitty/kitty.conf");
+    };
+
+    home.file.".config/kitty/nvim.conf".source = dotsPath + "/.config/kitty/nvim.conf";
+  };
+}

home/modules/music/default.nix

@@ -0,0 +1,27 @@
+{
+  dotsPath,
+  pkgs,
+  ...
+}:
+
+let
+  spotifyWithWayland = pkgs.symlinkJoin {
+    name = "spotify";
+    paths = [ pkgs.spotify ];
+    buildInputs = [ pkgs.makeWrapper ];
+    postBuild = ''
+      wrapProgram $out/bin/spotify \
+        --add-flags "--enable-features=UseOzonePlatform --ozone-platform=wayland"
+    '';
+  };
+in
+{
+  home.packages = with pkgs; [
+    spotifyWithWayland
+  ];
+
+  programs.ncspot = {
+    enable = true;
+    settings = builtins.fromTOML (builtins.readFile (dotsPath + "/.config/ncspot/config.toml"));
+  };
+}

home/modules/nfc/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./proxmark3.nix
+  ];
+}

home/modules/nfc/proxmark3.nix

@@ -0,0 +1,21 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.nfc.proxmark3;
+in
+{
+  options.nfc.proxmark3 = {
+    enable = lib.mkEnableOption "proxmark3 (iceman fork)";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = [
+      (pkgs.proxmark3.override { withGeneric = true; })
+    ];
+  };
+}

home/modules/nodejs.nix

@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  options.nodejs = {
+    enable = lib.mkEnableOption "nodejs (and related packages)";
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.nodejs_24;
+    };
+  };
+
+  config = lib.mkIf config.nodejs.enable {
+    home.packages = with pkgs; [
+      config.nodejs.package
+      pnpm
+      yarn
+      biome
+      tsx
+    ];
+  };
+}

home/modules/nvim.nix

@@ -0,0 +1,9 @@
+{ pkgs, inputs, ... }:
+
+{
+  config = {
+    home.packages = [
+      inputs.nvim.packages.${pkgs.stdenv.hostPlatform.system}.nvim
+    ];
+  };
+}

home/modules/pandoc.nix

@@ -0,0 +1,19 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  options.pandoc = {
+    enable = lib.mkEnableOption "pandoc";
+  };
+
+  config = lib.mkIf config.pandoc.enable {
+    home.packages = with pkgs; [
+      haskellPackages.pandoc-crossref
+      pandoc
+      texliveSmall
+    ];
+  };
+}

home/modules/photography/default.nix

@@ -0,0 +1,7 @@
+{ pkgs, ... }:
+
+{
+  home.packages = with pkgs; [
+    darktable
+  ];
+}

home/modules/shell/bash.nix

@@ -1,13 +1,12 @@
 {
   config,
   lib,
-  pkgs,
+  dotsPath,
   ...
 }:
 let
   cfg = config.shell.bash;
-  username = config.home.username;
+  inherit (config.home) username;
-  dotsPath = ../../../dots;
 in
 {
   options.shell.bash = {

home/modules/shell/default.nix

@@ -3,5 +3,6 @@
     ./bash.nix
     ./utils.nix
     ./prompt.nix
+    ../tmux.nix
   ];
 }

home/modules/shell/prompt.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   ...
 }:
 {

home/modules/ssh.nix

@@ -18,8 +18,25 @@ in
     enable = true;
     enableDefaultConfig = false;
 
-    matchBlocks = lib.genAttrs hostsWithKeys (hostname: {
+    matchBlocks =
+      lib.genAttrs hostsWithKeys (
+        hostname:
+        let
+          hostConfig = outputs.nixosConfigurations.${hostname}.config;
+          inherit (hostConfig.ssh) publicHostname username;
+        in
+        {
           host = hostname;
-    });
+          user = username;
+        }
+        // lib.optionalAttrs (publicHostname != "") {
+          hostname = publicHostname;
+        }
+      )
+      // {
+        "*" = {
+          addKeysToAgent = "yes";
+        };
+      };
   };
 }

home/modules/stylix.nix

@@ -0,0 +1,45 @@
+{
+  config,
+  inputs,
+  pkgs,
+  ...
+}:
+
+let
+  theme = import ../../modules/stylix/theme.nix { inherit pkgs; };
+in
+{
+  imports = [ inputs.stylix.homeModules.stylix ];
+
+  stylix = {
+    enable = true;
+    inherit (theme)
+      polarity
+      base16Scheme
+      override
+      image
+      ;
+    fonts = {
+      monospace = theme.monospaceFont;
+      serif = config.stylix.fonts.monospace;
+      sansSerif = config.stylix.fonts.monospace;
+      emoji = config.stylix.fonts.monospace;
+    };
+    targets = {
+      firefox = {
+        profileNames = [ "default" ];
+        colorTheme.enable = true;
+      };
+      librewolf = {
+        profileNames = [ "default" ];
+        colorTheme.enable = true;
+      };
+      gnome.enable = false;
+      gtk.enable = false;
+      kitty = {
+        variant256Colors = true;
+      };
+      nixvim.enable = false;
+    };
+  };
+}

home/modules/taskwarrior.nix

@@ -2,6 +2,7 @@
   config,
   lib,
   pkgs,
+  dotsPath,
   osConfig ? null,
   ...
 }:
@@ -20,24 +21,34 @@ in
 
   home.packages = with pkgs; [
     libnotify
+    taskopen
+    python3
   ];
 
   home.file = {
     ".config/task/taskrc" = {
       force = true; # overwrite when present
-      source = ../../dots/.config/task/taskrc;
+      source = dotsPath + "/.config/task/taskrc";
     };
-    ".config/task/taskrc.d/aliases".source = ../../dots/.config/task/taskrc.d/aliases;
+    ".config/task/taskrc.d/aliases".source = dotsPath + "/.config/task/taskrc.d/aliases";
-    ".config/task/taskrc.d/colors".source = ../../dots/.config/task/taskrc.d/colors;
+    ".config/task/taskrc.d/colors".source = dotsPath + "/.config/task/taskrc.d/colors";
-    ".config/task/taskrc.d/contexts".source = ../../dots/.config/task/taskrc.d/contexts;
+    ".config/task/taskrc.d/contexts".source = dotsPath + "/.config/task/taskrc.d/contexts";
-    ".config/task/taskrc.d/reports".source = ../../dots/.config/task/taskrc.d/reports;
+    ".config/task/taskrc.d/reports".source = dotsPath + "/.config/task/taskrc.d/reports";
-    ".config/task/taskrc.d/udas".source = ../../dots/.config/task/taskrc.d/udas;
+    ".config/task/taskrc.d/udas".source = dotsPath + "/.config/task/taskrc.d/udas";
-    ".config/task/taskrc.d/urgency".source = ../../dots/.config/task/taskrc.d/urgency;
+    ".config/task/taskrc.d/urgency".source = dotsPath + "/.config/task/taskrc.d/urgency";
     ".local/share/task/hooks/on-exit.sync.py" = {
-      source = ../../dots/.local/share/task/hooks/on-exit.sync.py;
+      source = dotsPath + "/.local/share/task/hooks/on-exit.sync.py";
+    };
+    ".local/share/task/hooks/on-add.limit.py" = {
+      source = dotsPath + "/.local/share/task/hooks/on-add.limit.py";
+      executable = true;
+    };
+    ".local/share/task/hooks/on-modify.limit.py" = {
+      source = dotsPath + "/.local/share/task/hooks/on-modify.limit.py";
+      executable = true;
     };
     ".local/share/task/scripts/sync-and-notify.sh" = {
-      source = ../../dots/.local/share/task/scripts/sync-and-notify.sh;
+      source = dotsPath + "/.local/share/task/scripts/sync-and-notify.sh";
       executable = true;
     };
   };

home/modules/tmux.nix

@@ -0,0 +1,19 @@
+{ pkgs, dotsPath, ... }:
+
+{
+  config = {
+    home.packages = with pkgs; [
+      tmuxp
+      reptyr
+    ];
+
+    programs.tmux = {
+      enable = true;
+      extraConfig = builtins.readFile (dotsPath + "/.config/tmux/tmux.conf");
+    };
+
+    home.file = {
+      ".config/tmux/hooks/tmux.ssh.conf".source = dotsPath + "/.config/tmux/hooks/tmux.ssh.conf";
+    };
+  };
+}

home/modules/vscode.nix

@@ -0,0 +1,7 @@
+{ config, pkgs, ... }:
+
+{
+  config = {
+    home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.vscode "--disable-gpu-sandbox")) ];
+  };
+}

home/modules/waybar/config.jsonc

@@ -1,57 +0,0 @@
-[
-  {
-    "height": 16,
-    "spacing": 4,
-    "modules-left": ["niri/workspaces"],
-    "modules-right": [
-      "pulseaudio",
-      "memory",
-      "cpu",
-      "network",
-      "clock",
-      "battery",
-    ],
-    "clock": {
-      "format": "W{:%V %d %b %H:%M}",
-      "tooltip-format": "{calendar}",
-      "format-alt": "{:%Y-%m-%d %H:%M:%S}",
-    },
-    "battery": {
-      "bat": "BAT0",
-      "adapter": "ADP1",
-      "interval": 5,
-      "full-at": 99,
-      "states": {
-        "good": 80,
-        "warning": 20,
-        "critical": 10,
-      },
-      "format": "{capacity}%--",
-      "format-charging": "{capacity}%++",
-      "format-plugged": "{capacity}%",
-      "format-alt": "{time} {power}W",
-    },
-    "pulseaudio": {
-      "format": "VOL {volume}%",
-      "format-muted": "muted",
-      "on-click": "pavucontrol",
-    },
-    "memory": {
-      "interval": 2,
-      "format": "RAM {percentage}%",
-      "format-alt": "RAM {used:0.1f}G/{total:0.1f}G",
-    },
-    "cpu": {
-      "interval": 2,
-      "format": "CPU {usage}%",
-      "format-alt": "CPU {avg_frequency}GHz",
-    },
-    "network": {
-      "interval": 5,
-      "format-wifi": "{ifname} {ipaddr} {essid}",
-      "format-ethernet": "{ifname} {ipaddr}",
-      "format-disconnected": "{ifname} disconnected",
-      "tooltip-format": "{ifname}: {ipaddr}/{cidr}",
-    },
-  },
-]

home/modules/waybar/default.nix

@@ -1,8 +1,68 @@
+{
+  lib,
+  ...
+}:
+
 {
   programs.waybar = {
     enable = true;
+    settings = [
+      {
+        height = 16;
+        spacing = 4;
+        modules-left = [ "niri/workspaces" ];
+        modules-right = [
+          "pulseaudio"
+          "memory"
+          "cpu"
+          "network"
+          "clock"
+          "battery"
+        ];
+        clock = {
+          format = "W{:%V %d %b %H:%M}";
+          tooltip-format = "{calendar}";
+          format-alt = "{:%Y-%m-%d %H:%M:%S}";
+        };
+        battery = {
+          bat = "BAT0";
+          adapter = "ADP1";
+          interval = 5;
+          full-at = 99;
+          states = {
+            good = 80;
+            warning = 20;
+            critical = 10;
+          };
+          format = "{capacity}%--";
+          format-charging = "{capacity}%++";
+          format-plugged = "{capacity}%";
+          format-alt = "{time} {power}W";
+        };
+        pulseaudio = {
+          format = "VOL {volume}%";
+          format-muted = "muted";
+          on-click = "pavucontrol";
+        };
+        memory = {
+          interval = 2;
+          format = "RAM {percentage}%";
+          format-alt = "RAM {used:0.1f}G/{total:0.1f}G";
+        };
+        cpu = {
+          interval = 2;
+          format = "CPU {usage}%";
+          format-alt = "CPU {avg_frequency}GHz";
+        };
+        network = {
+          interval = 5;
+          format-wifi = "{ifname} {ipaddr} {essid}";
+          format-ethernet = "{ifname} {ipaddr}";
+          format-disconnected = "{ifname} disconnected";
+          tooltip-format = "{ifname}: {ipaddr}/{cidr}";
+        };
+      }
+    ];
+    style = lib.readFile ./style.css;
   };
-
-  home.file.".config/waybar/config.jsonc".source = ./config.jsonc;
-  home.file.".config/waybar/style.css".source = ./style.css;
 }

home/modules/waybar/style.css

@@ -1,8 +1,4 @@
 * {
-  font-family:
-    Iosevka Term SS08,
-    monospace;
-  font-size: 12px;
   border-radius: 0px;
 }
 
@@ -22,21 +18,22 @@ window#waybar.hidden {
 }
 
 #workspaces button {
+  color: @base07;
   padding: 0;
   background-color: transparent;
 }
 
 #workspaces button:hover {
-  background: #000000;
+  background: @base00;
 }
 
 #workspaces button.focused,
 #workspaces button.active {
-  background-color: #111111;
+  background-color: @base01;
 }
 
 #workspaces button.urgent {
-  background-color: #eb4d4b;
+  background-color: @base08;
 }
 
 #clock,
@@ -46,8 +43,8 @@ window#waybar.hidden {
 #cpu,
 #network {
   padding: 0 4px;
-  color: #ffffff;
+  color: @base07;
-  background-color: #111111;
+  background-color: @base01;
 }
 
 #window,

hosts/andromache/default.nix

@@ -1,11 +1,11 @@
 {
   lib,
   inputs,
-  outputs,
   config,
   pkgs,
   ...
 }:
+
 let
   username = "h";
   hostName = "andromache";
@@ -13,8 +13,12 @@ let
 in
 {
   imports = [
+    inputs.disko.nixosModules.disko
     ../../modules/common
     ./hard.nix
+    inputs.nixos-hardware.nixosModules.common-cpu-intel
+    inputs.nixos-hardware.nixosModules.common-pc
+    inputs.nixos-hardware.nixosModules.common-pc-ssd
     inputs.sops-nix.nixosModules.sops
     ../../modules/boot/bootloader.nix
     (import ../../modules/disko/zfs-encrypted-root.nix {
@@ -22,16 +26,22 @@ in
       device = "/dev/nvme1n1";
     })
     ../../modules/desktops/niri
+    ../../modules/backups
     ../../modules/bluetooth
+    ../../modules/gaming
     ../../modules/keyboard
-    (import ../../modules/networking { hostName = hostName; })
+    (import ../../modules/networking { inherit hostName; })
     ../../modules/users
     ../../modules/audio
     ../../modules/localization
     ../../modules/fonts
     ../../modules/ssh/hardened-openssh.nix
+    ../../modules/storage
+    ../../modules/stylix
     (import ../../modules/secrets { inherit lib inputs config; })
     ../../modules/docker
+    ../../modules/syncthing
+    ../../modules/nvidia
   ];
 
   home-manager.users.${username} = import ../../home/hosts/andromache {
@@ -51,6 +61,8 @@ in
   secrets.username = username;
   docker.user = username;
 
+  nix.settings.secret-key-files = [ config.sops.secrets.nix_signing_key_andromache.path ];
+
   disko.devices = {
     disk.data = {
       type = "disk";
@@ -71,53 +83,24 @@ in
     };
   };
 
-  hardware = {
+  hardware.cpu.intel.updateMicrocode = true;
-    cpu.intel.updateMicrocode = true;
+
-    graphics.enable = true;
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-    nvidia = {
-      modesetting.enable = true;
-      powerManagement.enable = true;
-      powerManagement.finegrained = false;
-      open = true;
-      nvidiaSettings = true;
-      package = config.boot.kernelPackages.nvidiaPackages.stable;
-    };
-  };
 
   environment.systemPackages = [
-    inputs.nvim.packages.x86_64-linux.nvim
+    inputs.colmena.packages.${pkgs.stdenv.hostPlatform.system}.colmena
   ];
 
-  services.xserver = {
+  services = {
-    videoDrivers = [ "nvidia" ];
+    locate = {
+      enable = true;
+      package = pkgs.plocate;
     };
 
-  services.openssh = {
+    openssh = {
       enable = true;
       harden = true;
     };
-
-  services.syncthing = {
-    enable = true;
-    openDefaultPorts = true;
-    settings = {
-      devices = {
-        # "device1" = {
-        #   id = "DEVICE-ID-GOES-HERE";
-        # };
-      };
-      folders = {
-        "/home/${username}/sync" = {
-          id = "sync";
-          devices = [ ];
-        };
-      };
-    };
-  };
-
-  services.locate = {
-    enable = true;
-    package = pkgs.plocate;
   };
 
   networking = {
@@ -126,7 +109,7 @@ in
     interfaces = {
       eno1 = {
         wakeOnLan.enable = true;
-        macAddress = wolInterfaces.eno1.macAddress;
+        inherit (wolInterfaces.eno1) macAddress;
       };
     };
     firewall = {

hosts/andromache/hard.nix

@@ -4,7 +4,6 @@
 {
   config,
   lib,
-  pkgs,
   modulesPath,
   ...
 }:
@@ -14,7 +13,8 @@
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = [
+  boot = {
+    initrd.availableKernelModules = [
       "vmd"
       "xhci_pci"
       "ahci"
@@ -24,9 +24,10 @@
       "uas"
       "sd_mod"
     ];
-  boot.initrd.kernelModules = [ ];
+    initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
+    kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
+    extraModulePackages = [ ];
+  };
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

hosts/andromache/system.nix

@@ -0,0 +1 @@
+"x86_64-linux"

hosts/astyanax/default.nix

@@ -1,7 +1,6 @@
 {
   lib,
   inputs,
-  outputs,
   config,
   pkgs,
   ...
@@ -13,9 +12,12 @@ let
 in
 {
   imports = [
+    inputs.disko.nixosModules.disko
     ../../modules/common
     ./hard.nix
-    # inputs.nixos-hardware.nixosModules.lenovo-thinkpad-e14-intel
+    inputs.nixos-hardware.nixosModules.common-pc
+    inputs.nixos-hardware.nixosModules.common-pc-ssd
+    # inputs.nixos-hardware.nixosModules.lenovo-thinkpad-e14-intel-gen7 (not available yet?)
     inputs.sops-nix.nixosModules.sops
     ../../modules/boot/bootloader.nix
     (import ../../modules/disko/zfs-encrypted-root.nix {
@@ -23,17 +25,21 @@ in
       device = "/dev/nvme0n1";
     })
     ../../modules/desktops/niri
+    ../../modules/audio
+    ../../modules/audio-automation
+    ../../modules/backups
     ../../modules/bluetooth
     ../../modules/keyboard
-    (import ../../modules/networking { hostName = hostName; })
+    (import ../../modules/networking { inherit hostName; })
     ../../modules/users
-    ../../modules/audio
     ../../modules/localization
     ../../modules/fonts
     ../../modules/ssh/hardened-openssh.nix
-    ../../modules/vpn/wireguard.nix
+    ../../modules/storage
+    ../../modules/stylix
     (import ../../modules/secrets { inherit lib inputs config; })
     ../../modules/docker
+    ../../modules/nfc
   ];
 
   home-manager.users.${username} = import ../../home/hosts/astyanax {
@@ -52,6 +58,10 @@ in
 
   secrets.username = username;
   docker.user = username;
+  nfc.user = username;
+  desktop.ly.enable = true;
+
+  nix.settings.secret-key-files = [ config.sops.secrets.nix_signing_key_astyanax.path ];
 
   hardware = {
     cpu.intel.updateMicrocode = true;
@@ -71,7 +81,7 @@ in
   };
 
   environment.systemPackages = [
-    inputs.nvim.packages.x86_64-linux.nvim
+    inputs.colmena.packages.${pkgs.stdenv.hostPlatform.system}.colmena
     (pkgs.writeShellApplication {
       name = "wol-andromache";
       runtimeInputs = [ pkgs.wakeonlan ];
@@ -86,30 +96,32 @@ in
     hostId = "80eef97e";
   };
 
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+
   services = {
     fwupd.enable = true;
     openssh = {
       enable = true;
       harden = true;
     };
-    syncthing = {
-      enable = true;
-      openDefaultPorts = true;
-      folders = {
-        "/home/h/sync" = {
-          id = "sync";
-          devices = [ ];
-        };
-      };
-      devices = {
-        # "device1" = {
-        #   id = "DEVICE-ID-GOES-HERE";
-        # };
-      };
-    };
     locate = {
       enable = true;
       package = pkgs.plocate;
     };
+    tlp = {
+      enable = true;
+      settings = {
+        CPU_SCALING_GOVERNOR_ON_AC = "performance";
+        CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
+
+        CPU_ENERGY_PERF_POLICY_ON_BAT = "power";
+        CPU_ENERGY_PERF_POLICY_ON_AC = "performance";
+
+        CPU_MIN_PERF_ON_AC = 0;
+        CPU_MAX_PERF_ON_AC = 100;
+        CPU_MIN_PERF_ON_BAT = 0;
+        CPU_MAX_PERF_ON_BAT = 20;
+      };
+    };
   };
 }

hosts/astyanax/hard.nix

@@ -4,7 +4,6 @@
 {
   config,
   lib,
-  pkgs,
   modulesPath,
   ...
 }:
@@ -14,16 +13,18 @@
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = [
+  boot = {
+    initrd.availableKernelModules = [
       "xhci_pci"
       "thunderbolt"
       "nvme"
       "uas"
       "sd_mod"
     ];
-  boot.initrd.kernelModules = [ ];
+    initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
+    kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
+    extraModulePackages = [ ];
+  };
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

hosts/astyanax/system.nix

@@ -0,0 +1 @@
+"x86_64-linux"

hosts/eetion-02/default.nix

@@ -0,0 +1,86 @@
+{ pkgs, ... }:
+
+# Raspberry Pi 3
+# See <https://nixos.wiki/wiki/NixOS_on_ARM/Raspberry_Pi_3>
+
+let
+  username = "h";
+  hostName = "eetion-02";
+in
+{
+  imports = [
+    ./hard.nix
+    ../../modules/ssh/hardened-openssh.nix
+  ];
+
+  ssh = {
+    inherit username;
+    publicHostname = "eetion-02";
+    authorizedHosts = [
+      "andromache"
+      "astyanax"
+    ];
+  };
+
+  boot = {
+    kernelParams = [
+      "console=ttyS1,115200n8"
+    ];
+
+    kernel.sysctl."net.ipv4.ip_forward" = 1;
+
+    loader = {
+      grub.enable = false;
+      generic-extlinux-compatible.enable = true;
+    };
+  };
+
+  hardware.enableRedistributableFirmware = true;
+
+  networking = {
+    inherit hostName;
+    networkmanager.enable = true;
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        80
+        443
+      ];
+    };
+  };
+
+  users.users = {
+    root.hashedPassword = "!";
+    ${username} = {
+      isNormalUser = true;
+      extraGroups = [ "wheel" ];
+    };
+  };
+
+  security.sudo.wheelNeedsPassword = false;
+
+  services = {
+    openssh = {
+      enable = true;
+      harden = true;
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    vim
+    git
+  ];
+
+  nix.settings = {
+    experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+    trusted-users = [
+      "root"
+      "@wheel"
+    ];
+  };
+
+  system.stateVersion = "26.05";
+}

hosts/eetion-02/hard.nix

@@ -0,0 +1,24 @@
+{ lib, modulesPath, ... }:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot = {
+    initrd.availableKernelModules = [ ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ ];
+    extraModulePackages = [ ];
+  };
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/NIXOS_SD";
+    fsType = "ext4";
+    options = [ "noatime" ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+}

hosts/eetion-02/system.nix

@@ -0,0 +1 @@
+"aarch64-linux"