chore: update lockfile

.envrc

@@ -0,0 +1 @@
+use flake

.gitignore

@@ -9,4 +9,5 @@ result-*
 
 nixos-efi-vars.fd
 
-/.pre-commit-config.yaml
+.direnv/
+.pre-commit-config.yaml

deploy/colmena.nix

@@ -21,11 +21,7 @@ in
 inputs.colmena.lib.makeHive (
   {
     meta = {
-      nixpkgs = import inputs.nixpkgs {
-        localSystem = "x86_64-linux";
-      };
-
-      nodeNixpkgs = builtins.mapAttrs (_: v: v.pkgs) self.nixosConfigurations;
+      nixpkgs = import inputs.nixpkgs { localSystem = "x86_64-linux"; };
       specialArgs = {
         inherit inputs;
         outputs = self;

dots/.bin/save-zk

@@ -1,4 +0,0 @@
-#!/usr/bin/env bash
-
-cd "$ZK_PATH" || echo "No zettelkasten directory found"
-git a . && git commit -m "Update" && git push

dots/.bin/setup-zk

@@ -1,20 +0,0 @@
-#!/bin/bash
-
-if [ ! -d ~/.zk ]; then
-    echo "[zk] Setting up zettelkasten"
-    gh repo clone zk ~/.zk
-else
-    echo "[zk] Zettelkasten already set up."
-fi
-
-read -p "Would you like open your zettelkasten? [y/N] " -n 1 -r
-echo
-
-if [[ $REPLY =~ ^[Yy]$ ]]; then
-  if [ -x "$(command -v zk)" ]; then
-    zk
-  else
-    echo "Error: 'zk' command not found or not executable"
-    exit 1
-  fi
-fi

dots/.config/nvim/after/plugin/hydra.lua

@@ -0,0 +1,35 @@
+local hydra_repl = "hydra-repl"
+
+if not vim.fn.executable(hydra_repl) then
+  return
+end
+
+local function send(lines)
+  vim.system({ hydra_repl, table.concat(lines, "\n") })
+end
+
+local function get_paragraph(buf)
+  local start_ = vim.fn.search("^$", "bnW")
+  local end_ = vim.fn.search("^$", "nW") - 1
+  if end_ < vim.api.nvim_win_get_cursor(0)[1] then
+    end_ = vim.api.nvim_buf_line_count(buf)
+  end
+  return vim.api.nvim_buf_get_lines(buf, start_, end_, false)
+end
+
+local function get_selection(buf)
+  return vim.api.nvim_buf_get_lines(buf, vim.fn.line("'<") - 1, vim.fn.line("'>"), false)
+end
+
+vim.api.nvim_create_autocmd("FileType", {
+  pattern = "javascript",
+  callback = function(e)
+    if vim.fn.fnamemodify(vim.api.nvim_buf_get_name(e.buf), ":e") ~= "hydra" then
+      return
+    end
+
+    local buf = e.buf
+    vim.keymap.set("n", "<CR>", function() send(get_paragraph(buf)) end, { buffer = buf, desc = "hydra: send block" })
+    vim.keymap.set("v", "<CR>", function() send(get_selection(buf)) end, { buffer = buf, desc = "hydra: send selection" })
+  end,
+})

dots/.config/nvim/after/plugin/wiki.vim.lua

@@ -1,6 +1,8 @@
+require("zk.utils")
+
 vim.cmd([[
 " Change local buffer to directory of current file after the plugin has loaded
-autocmd VimEnter * lcd %:p:h
+execute 'autocmd BufEnter' g:zk_path . '/*.md' 'silent lcd %:p:h'
 
 " " Override wiki index mapping to also cd into the wiki
 nm <leader>ww <plug>(wiki-index)
@@ -11,11 +13,16 @@ nm <leader>ww <plug>(wiki-index)
 " nm <leader>s <plug>(wiki-link-follow-split)
 " nm <leader>v <plug>(wiki-link-follow-vsplit)
 
-autocmd BufEnter *.md if expand('%:t') =~ '_' | echo 'hierarchical relation' | endif
-autocmd BufEnter *.md if expand('%:t') =~ '--' | echo 'relation' | endif
-autocmd BufEnter *.md if expand('%:t') =~ '<>' | echo 'dichotomy' | endif
-autocmd BufEnter *.md if expand('%:t') =~ 'my-' | echo 'personal file' | endif
-autocmd BufEnter *.md if expand('%:t') =~ 'project_' | echo 'project file' | endif
+function! ZKContextualEcho()
+  let l:name = expand('%:t')
+  if l:name =~ '_' | echo 'hierarchical relation'
+  elseif l:name =~ '--' | echo 'relation'
+  elseif l:name =~ '<>' | echo 'dichotomy'
+  elseif l:name =~ 'my-' | echo 'personal file'
+  elseif l:name =~ 'project_' | echo 'project file'
+  endif
+endfunction
+execute 'autocmd BufEnter' g:zk_path . '/*.md' 'call ZKContextualEcho()'
 
 " Only load wiki.vim for zk directory
 let g:wiki_index_name='index'
@@ -76,7 +83,7 @@ let g:wiki_templates = [
 "
 
 let g:wiki_filetypes=['md']
-let g:wiki_root='~/.zk'
+let g:wiki_root=g:zk_path
 let g:wiki_global_load=0
 let g:wiki_link_creation = {
       \ 'md': {

dots/.config/nvim/flake.lock

@@ -42,11 +42,11 @@
     },
     "nixCats": {
       "locked": {
-        "lastModified": 1774835836,
-        "narHash": "sha256-6ok7iv/9R82vl6MYe3Lwyyb6S5bmW2PxEZtmjzlqyPs=",
+        "lastModified": 1777273601,
+        "narHash": "sha256-xBUa8Tl9V7IXI+VmLEuDc81La/EhoSn1C3EVSnJ3cfU=",
         "owner": "BirdeeHub",
         "repo": "nixCats-nvim",
-        "rev": "ebb9f279a55ca60ff4e37e4accf6518dc627aa8d",
+        "rev": "f69ea013e328841a7def7037ed59788a76be8816",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1775608838,
-        "narHash": "sha256-2ySoGH+SAi34U0PeuQgABC0WiH9LQ3tkyHTiE93KUeg=",
+        "lastModified": 1777270315,
+        "narHash": "sha256-yKB4G6cKsQsWN7M6rZGk6gkJPDNPIzT05y4qzRyCDlI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9a01fad67a57e44e1b3e1d905c6881bcfb209e8a",
+        "rev": "6368eda62c9775c38ef7f714b2555a741c20c72d",
         "type": "github"
       },
       "original": {

dots/.config/nvim/flake.nix

@@ -45,13 +45,38 @@
       inherit (nixCats) utils;
       luaPath = ./.;
       forEachSystem = utils.eachSystem nixpkgs.lib.platforms.all;
-      extra_pkg_config = { };
+      extra_pkg_config = {
+        allowUnfreePredicate =
+          pkg:
+          builtins.elem (nixpkgs.lib.getName pkg) [
+            "vim-sandwich"
+            "jupytext.nvim"
+            "eyeliner.nvim"
+            "context_filetype.vim"
+            "editorconfig-vim"
+            "unicode.vim"
+            "quarto-nvim"
+            "vim-openscad"
+            "lsp_lines.nvim"
+            "nvim-highlight-colors"
+            "nvim-lint"
+          ];
+      };
 
       mkDependencyOverlays = system: [
         (utils.standardPluginOverlay inputs)
         (_final: _prev: {
           mcp-hub = inputs.mcp-hub.packages.${system}.default;
         })
+        (_: prev: {
+          luajitPackages = prev.luajitPackages.overrideScope (
+            _: lprev: {
+              neotest = lprev.neotest.overrideAttrs (_: {
+                doCheck = false;
+              });
+            }
+          );
+        })
       ];
 
       categoryDefinitions =
@@ -62,9 +87,11 @@
         {
           lspsAndRuntimeDeps = with pkgs; {
             general = [
+              nodejs_24
               black
               clang
               clang-tools
+              curl # → plenary-nvim, mcp-hub
               delta
               emmet-language-server
               eslint_d
@@ -78,6 +105,8 @@
               mcp-hub
               nixd
               nixfmt
+              prettier
+              typescript-language-server
               ormolu
               prettierd
               rust-analyzer
@@ -86,6 +115,7 @@
               stylelint
               stylua
               tree-sitter
+              tailwindcss-language-server
               typescript-language-server
               vscode-langservers-extracted
               vtsls

dots/.config/nvim/lua/ftdetect.lua

@@ -9,5 +9,6 @@ vim.filetype.add({
     ["%.env.*"] = "dotenv",
     ["%.pl$"] = "prolog",
     [".*.containerfile.*"] = "dockerfile",
+    ["%.hydra$"] = "javascript",
   },
 })

dots/.config/nvim/lua/zk/cmp.lua

@@ -13,28 +13,31 @@ local function get_markdown_files(base)
   return items
 end
 
+function source:get_keyword_pattern()
+  return "[%w%./%-]*"
+end
+
 function source:complete(params, callback)
   local cursor_before_line = params.context.cursor_before_line
   local cursor_after_line = params.context.cursor_after_line or ""
 
-  local trigger = cursor_before_line:match("%[[^%]]*%]%(([^)]*)$")
-
-  if trigger ~= nil then
-    local items = get_markdown_files(".")
-    local next_char = cursor_after_line:sub(1, 1)
-
-    for _, item in ipairs(items) do
-      if next_char == ")" then
-        item.insertText = item.label
-      else
-        item.insertText = item.label .. ")"
-      end
-    end
-
-    callback(items)
-  else
+  if not cursor_before_line:match("%[[^%]]*%]%(") then
     callback({})
+    return
   end
+
+  local items = get_markdown_files(".")
+  local next_char = cursor_after_line:sub(1, 1)
+
+  for _, item in ipairs(items) do
+    if next_char == ")" then
+      item.insertText = item.label
+    else
+      item.insertText = item.label .. ")"
+    end
+  end
+
+  callback(items)
 end
 
 function source:get_trigger_characters()

dots/.config/nvim/lua/zk/init.lua

@@ -1,9 +1,10 @@
 require("zk.cmp")
+require("zk.utils")
 
 vim.cmd([[
 let s:zk_preview_enabled = 0
 let s:live_server_job = -1
-au BufEnter /home/h/.zk/*.md silent exe '!echo "%" > /home/h/.zk/current-zettel.txt'
+execute 'au BufEnter' g:zk_path . '/*.md' 'silent exe "!echo %" ">" g:zk_path . "/current-zettel.txt"'
 function! ToggleZKPreview()
     if s:zk_preview_enabled == 1
         let s:zk_preview_enabled = 0
@@ -11,10 +12,10 @@ function! ToggleZKPreview()
         au! ZKPreview
     else
         let s:zk_preview_enabled = 1
-        let s:live_server_job = jobstart('live-server --watch=/home/h/.zk/current-zettel-content.html --open=current-zettel-content.html --port=8080')
+        let s:live_server_job = jobstart('live-server --watch=' . g:zk_path . '/current-zettel-content.html --open=current-zettel-content.html --port=8080')
         augroup ZKPreview
-          au BufEnter /home/h/.zk/*.md silent exe '!cat "%:r.html" > /home/h/.zk/current-zettel-content.html'
-          au BufWritePost /home/h/.zk/*.md silent exe '!make && cat "%:r.html" > /home/h/.zk/current-zettel-content.html'
+          execute 'au BufEnter' g:zk_path . '/*.md' 'silent exe "!cat %:r.html" ">" g:zk_path . "/current-zettel-content.html"'
+          execute 'au BufWritePost' g:zk_path . '/*.md' 'silent exe "!make && cat %:r.html" ">" g:zk_path . "/current-zettel-content.html"'
         augroup END
     endif
 endfunction

dots/.config/nvim/lua/zk/utils.lua

@@ -0,0 +1,2 @@
+vim.g.zk_path = os.getenv("ZK_PATH") or (os.getenv("HOME") .. "/.zk")
+return vim.g.zk_path

dots/.config/tmux/hooks/tmux.ssh.conf

@@ -1 +0,0 @@
-set -g status-style bg=colour12,fg=colour0

dots/.config/tmux/tmux.conf

@@ -70,8 +70,6 @@ set -g status-right '#(uptime | cut -f 4-5 -d " " | cut -f 1 -d ",") %a %l:%M:%S
 
 set -g default-terminal "tmux-256color"
 
-set-hook -g after-new-session 'if -F "#{==:#{session_name},ssh}" "source ${XDG_CONFIG_HOME}/tmux/hooks/tmux.ssh.conf" "source ${XDG_CONFIG_HOME}/tmux/hooks/tmux.regular.conf"'
-
 # Vi copypaste mode
 if-shell "test '\( #{$TMUX_VERSION_MAJOR} -eq 2 -a #{$TMUX_VERSION_MINOR} -ge 4 \)'" 'bind-key -Tcopy-mode-vi v send -X begin-selection; bind-key -Tcopy-mode-vi y send -X copy-selection-and-cancel'
 if-shell '\( #{$TMUX_VERSION_MAJOR} -eq 2 -a #{$TMUX_VERSION_MINOR} -lt 4\) -o #{$TMUX_VERSION_MAJOR} -le 1' 'bind-key -t vi-copy v begin-selection; bind-key -t vi-copy y copy-selection'

flake.lock

@@ -38,11 +38,11 @@
     "base16-helix": {
       "flake": false,
       "locked": {
-        "lastModified": 1760703920,
-        "narHash": "sha256-m82fGUYns4uHd+ZTdoLX2vlHikzwzdu2s2rYM2bNwzw=",
+        "lastModified": 1776754714,
+        "narHash": "sha256-E3OAK27smtATTmX45uoTSRsVD+Y+ZiVVfgM/tjpbtYg=",
         "owner": "tinted-theming",
         "repo": "base16-helix",
-        "rev": "d646af9b7d14bff08824538164af99d0c521b185",
+        "rev": "4d508123037e7851ad36ebf7d9c48b0e9e1eb581",
         "type": "github"
       },
       "original": {
@@ -121,11 +121,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1776744173,
-        "narHash": "sha256-9pZQWypgc0H1lgyuGmLqEL5IKVdHMw/NoO/iFcoSrW0=",
+        "lastModified": 1778040175,
+        "narHash": "sha256-SSXJp3BMjO2LrW/VLjNdGGcjd3RFEyV4FemYA6OGrYw=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "a803876f3cfc65f8858d413cef2b7d10d50a81d7",
+        "rev": "3bd76b0f41e65661866bddcac57ebe83aeadb581",
         "type": "gitlab"
       },
       "original": {
@@ -138,11 +138,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1775176642,
-        "narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=",
+        "lastModified": 1776136500,
+        "narHash": "sha256-r0gN2brVWA351zwMV0Flmlcd6SGMvYqFbvC3DfKFM8Y=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "179704030c5286c729b5b0522037d1d51341022c",
+        "rev": "0f8ba203d475587f477e7ae12661bd8459e225b7",
         "type": "github"
       },
       "original": {
@@ -284,11 +284,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775585728,
-        "narHash": "sha256-8Psjt+TWvE4thRKktJsXfR6PA/fWWsZ04DVaY6PUhr4=",
+        "lastModified": 1776796298,
+        "narHash": "sha256-PcRvlWayisPSjd0UcRQbhG8Oqw78AcPE6x872cPRHN8=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "580633fa3fe5fc0379905986543fd7495481913d",
+        "rev": "3cfd774b0a530725a077e17354fbdb87ea1c4aad",
         "type": "github"
       },
       "original": {
@@ -342,11 +342,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776777932,
-        "narHash": "sha256-0R3Yow/NzSeVGUke5tL7CCkqmss4Vmi6BbV6idHzq/8=",
+        "lastModified": 1778009629,
+        "narHash": "sha256-nUoQtf4Zq7DRYJrfv904hjrxjAlWVP6a1pNNFKx3FCg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "5d5640599a0050b994330328b9fd45709c909720",
+        "rev": "00ed86e58bb6979a7921859fd1615d19382eac5c",
         "type": "github"
       },
       "original": {
@@ -398,10 +398,10 @@
     "nix-secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1776422417,
-        "narHash": "sha256-9R4MePj/UT0tqkWEq4Afg7Lp/zdfYHkW+qmpVGchKIs=",
+        "lastModified": 1776723456,
+        "narHash": "sha256-GBbbm05oXYqSZ2EgxQPsNpTKl16wNhvrlUxdmv0FbSU=",
         "ref": "main",
-        "rev": "75759a14e8d46421fca4306393a38b5ad5240f09",
+        "rev": "135b681d24af6ee4508bbf7c657982d7be8743d4",
         "shallow": true,
         "type": "git",
         "url": "ssh://git@github.com/hektor/nix-secrets"
@@ -415,11 +415,11 @@
     },
     "nixCats": {
       "locked": {
-        "lastModified": 1774835836,
-        "narHash": "sha256-6ok7iv/9R82vl6MYe3Lwyyb6S5bmW2PxEZtmjzlqyPs=",
+        "lastModified": 1777273601,
+        "narHash": "sha256-xBUa8Tl9V7IXI+VmLEuDc81La/EhoSn1C3EVSnJ3cfU=",
         "owner": "BirdeeHub",
         "repo": "nixCats-nvim",
-        "rev": "ebb9f279a55ca60ff4e37e4accf6518dc627aa8d",
+        "rev": "f69ea013e328841a7def7037ed59788a76be8816",
         "type": "github"
       },
       "original": {
@@ -451,11 +451,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1775490113,
-        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
+        "lastModified": 1777917524,
+        "narHash": "sha256-k+LVe9YaO2BEPB9AaCtTtOMCeGi4dxDo6gt4Un3qoPY=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
+        "rev": "df7783100babf59001340a7a874ba3824e441ecb",
         "type": "github"
       },
       "original": {
@@ -467,11 +467,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1776548001,
-        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
+        "lastModified": 1777954456,
+        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
+        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
         "type": "github"
       },
       "original": {
@@ -509,11 +509,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775228139,
-        "narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=",
+        "lastModified": 1777598946,
+        "narHash": "sha256-X239dAGaU1+gfDj8jKH8GzlqKMcxaVfXOio+uzBOkeE=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "601971b9c89e0304561977f2c28fa25e73aa7132",
+        "rev": "5d55af01c0f86be583931fe99207fc56c14134b3",
         "type": "github"
       },
       "original": {
@@ -665,11 +665,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776771786,
-        "narHash": "sha256-DRFGPfFV6hbrfO9a1PH1FkCi7qR5FgjSqsQGGvk1rdI=",
+        "lastModified": 1777944972,
+        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "bef289e2248991f7afeb95965c82fbcd8ff72598",
+        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
         "type": "github"
       },
       "original": {
@@ -714,11 +714,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1776170745,
-        "narHash": "sha256-Tl1aZVP5EIlT+k0+iAKH018GLHJpLz3hhJ0LNQOWxCc=",
+        "lastModified": 1777835090,
+        "narHash": "sha256-VLH8zPweblCOvpnQXp4fVs7f6Q79YhXF5XFKlOrvIFk=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "e3861617645a43c9bbefde1aa6ac54dd0a44bfa9",
+        "rev": "7989a1054b01153212dede6005abfd1576b8328c",
         "type": "github"
       },
       "original": {
@@ -776,11 +776,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1772661346,
-        "narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=",
+        "lastModified": 1777041405,
+        "narHash": "sha256-BAGZ7ObFV/9Z61OJZun7ifPyhkuHqNuW1QIhQ8LuzCo=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "13b5b0c299982bb361039601e2d72587d6846294",
+        "rev": "5f868b3a338b6904c47f3833b9c411be641983a8",
         "type": "github"
       },
       "original": {
@@ -792,11 +792,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1772934010,
-        "narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=",
+        "lastModified": 1777169200,
+        "narHash": "sha256-h7dDbIzP5hDr9v97w9PL6jdAgXawmj6krcH+959rqpU=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d",
+        "rev": "f798c2dce44ef815bb6b8f05a82135c7942d35ac",
         "type": "github"
       },
       "original": {
@@ -808,11 +808,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1772909925,
-        "narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=",
+        "lastModified": 1777463218,
+        "narHash": "sha256-Bhkozqtq3BKLqWTlmKm8uAptfX4aRGI8QX3eEL54Vpc=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df",
+        "rev": "5768d08ed2e7944a26a958868cdb073cb8856dae",
         "type": "github"
       },
       "original": {

flake.nix

@@ -76,7 +76,10 @@
           nixpkgs.lib.nixosSystem {
             modules = [
               ./hosts/${host}
-              { nixpkgs.hostPlatform = (myUtils.hostMeta ./hosts/${host}).system; }
+              {
+                nixpkgs.hostPlatform = (myUtils.hostMeta ./hosts/${host}).system;
+                host.name = host;
+              }
             ];
             specialArgs = {
               inherit

home/hosts/andromache/default.nix

@@ -25,10 +25,12 @@
     ../../modules/nvim
     ../../modules/pandoc
     ../../modules/photography
+    ../../modules/secrets
     ../../modules/shell
     ../../modules/ssh
     ../../modules/taskwarrior
     ../../modules/terminal
+    ../../modules/zk
     ../../modules/torrenting
   ];
 
@@ -45,7 +47,10 @@
     printing.enable = true;
     modeling.enable = true;
   };
-  ai-tools.opencode.enable = true;
+  ai-tools = {
+    claude-code.enable = true;
+    opencode.enable = true;
+  };
   browser.primary = "librewolf";
   cloud.hetzner.enable = true;
   comms.signal.enable = true;
@@ -53,6 +58,7 @@
   shell.bash.aliases.lang-js = true;
   shell.bash.addBinToPath = true;
   torrenting.enable = true;
+  zk.enable = true;
 
   programs = {
     home-manager.enable = true;

home/hosts/astyanax/default.nix

@@ -43,7 +43,10 @@
   };
 
   modules."3d".printing.enable = true;
-  ai-tools.opencode.enable = true;
+  ai-tools = {
+    claude-code.enable = true;
+    opencode.enable = true;
+  };
   browser.primary = "librewolf";
   cloud.hetzner.enable = true;
   comms.signal.enable = true;

home/hosts/work/default.nix

@@ -73,8 +73,11 @@
     tirith.enable = true;
     opencode.enable = true;
   };
-  database.mssql.enable = true;
-  database.postgresql.enable = true;
+  database = {
+    mssql.enable = true;
+    postgresql.enable = true;
+    redis.enable = true;
+  };
   git.github.enable = true;
   git.gitlab.enable = true;
   secrets.vault.enable = true;

home/modules/ai-tools/claude-code.nix

@@ -0,0 +1,60 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.ai-tools.claude-code;
+  rtk-version = "0.18.1";
+in
+{
+  options.ai-tools.claude-code.enable = lib.mkEnableOption "claude code with rtk and ccline";
+
+  config = lib.mkIf cfg.enable {
+    programs.claude-code.enable = true;
+
+    home.packages = with pkgs; [
+      (stdenv.mkDerivation {
+        name = "ccline";
+        src = fetchurl {
+          url = "https://github.com/Haleclipse/CCometixLine/releases/download/v1.0.8/ccline-linux-x64.tar.gz";
+          hash = "sha256-Joe3Dd6uSMGi66QT6xr2oY/Tz8rA5RuKa6ckBVJIzI0=";
+        };
+        unpackPhase = "tar xzf $src";
+        installPhase = ''
+          mkdir -p $out/bin
+          cp ccline $out/bin/
+          chmod +x $out/bin/ccline
+        '';
+        meta = {
+          description = "CCometixLine Linux x64 CLI (Claude Code statusline)";
+          homepage = "https://github.com/Haleclipse/CCometixLine";
+          license = lib.licenses.mit;
+          platforms = [ "x86_64-linux" ];
+        };
+      })
+      (stdenv.mkDerivation {
+        name = "rtk-${rtk-version}";
+        version = rtk-version;
+        src = fetchurl {
+          url = "https://github.com/rtk-ai/rtk/releases/download/v${rtk-version}/rtk-x86_64-unknown-linux-gnu.tar.gz";
+          hash = "sha256-XoTia5K8b00OzcKYCufwx8ApkAS31DxUCpGSU0jFs2Q=";
+        };
+        unpackPhase = "tar xzf $src";
+        installPhase = ''
+          mkdir -p $out/bin
+          cp rtk $out/bin/
+          chmod +x $out/bin/rtk
+        '';
+        meta = {
+          description = "RTK - AI coding tool enhancer";
+          homepage = "https://www.rtk-ai.app";
+          license = lib.licenses.mit;
+          platforms = [ "x86_64-linux" ];
+        };
+      })
+      mcp-nixos
+    ];
+  };
+}

home/modules/ai-tools/default.nix

@@ -1,116 +1,8 @@
 {
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.ai-tools;
-  rtk-version = "0.18.1";
-in
-{
-  options.ai-tools = {
-    claude-code.enable = lib.mkEnableOption "claude code with rtk and ccline";
-    tirith.enable = lib.mkEnableOption "tirith shell security guard";
-    opencode.enable = lib.mkEnableOption "opencode";
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfg.claude-code.enable {
-      home.packages = with pkgs; [
-        claude-code
-        (pkgs.stdenv.mkDerivation {
-          name = "ccline";
-          src = pkgs.fetchurl {
-            url = "https://github.com/Haleclipse/CCometixLine/releases/download/v1.0.8/ccline-linux-x64.tar.gz";
-            hash = "sha256-Joe3Dd6uSMGi66QT6xr2oY/Tz8rA5RuKa6ckBVJIzI0=";
-          };
-
-          unpackPhase = ''
-            tar xzf $src
-          '';
-
-          installPhase = ''
-            mkdir -p $out/bin
-            cp ccline $out/bin/
-            chmod +x $out/bin/ccline
-          '';
-
-          meta = with pkgs.lib; {
-            description = "CCometixLine Linux x64 CLI (Claude Code statusline)";
-            homepage = "https://github.com/Haleclipse/CCometixLine";
-            license = licenses.mit;
-            platforms = [ "x86_64-linux" ];
-          };
-        })
-        (pkgs.stdenv.mkDerivation {
-          name = "rtk-${rtk-version}";
-          version = rtk-version;
-          src = pkgs.fetchurl {
-            url = "https://github.com/rtk-ai/rtk/releases/download/v${rtk-version}/rtk-x86_64-unknown-linux-gnu.tar.gz";
-            hash = "sha256-XoTia5K8b00OzcKYCufwx8ApkAS31DxUCpGSU0jFs2Q=";
-          };
-
-          unpackPhase = ''
-            tar xzf $src
-          '';
-
-          installPhase = ''
-            mkdir -p $out/bin
-            cp rtk $out/bin/
-            chmod +x $out/bin/rtk
-          '';
-
-          meta = with pkgs.lib; {
-            description = "RTK - AI coding tool enhancer";
-            homepage = "https://www.rtk-ai.app";
-            license = licenses.mit;
-            platforms = [ "x86_64-linux" ];
-          };
-        })
-        mcp-nixos
-      ];
-    })
-    (lib.mkIf cfg.tirith.enable {
-      home.packages = with pkgs; [
-        tirith
-      ];
-    })
-    (lib.mkIf (cfg.tirith.enable && cfg.claude-code.enable) {
-      home.file.".claude/hooks/tirith-check.py" = {
-        source = ./tirith-check.py;
-        executable = true;
-      };
-
-      home.activation.tirith-claude-code = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
-        ${pkgs.tirith}/bin/tirith setup claude-code --with-mcp --scope user --force 2>/dev/null || true
-      '';
-    })
-    (lib.mkIf cfg.opencode.enable {
-      home.packages = with pkgs; [
-        opencode
-      ];
-      home.file.".config/opencode/opencode.json".text = builtins.toJSON {
-        "$schema" = "https://opencode.ai/config.json";
-        permission = {
-          external_directory = {
-            "/run/secrets/" = "deny";
-            "~/.config/sops/age/keys.txt" = "deny";
-            "~/.ssh/id_rsa" = "deny";
-            "~/.ssh/id_ed25519" = "deny";
-            "~/.ssh/id_ecdsa" = "deny";
-            "~/.ssh/id_dsa" = "deny";
-            "/etc/ssh/ssh_host_rsa_key" = "deny";
-            "/etc/ssh/ssh_host_ed25519_key" = "deny";
-            "/etc/ssh/ssh_host_ecdsa_key" = "deny";
-            "/etc/ssh/ssh_host_dsa_key" = "deny";
-          };
-          command = {
-            sops = "deny";
-          };
-        };
-        plugin = [ "@mohak34/opencode-notifier@latest" ];
-      };
-    })
+  imports = [
+    ./claude-code.nix
+    ./opencode.nix
+    ./skills.nix
+    ./tirith.nix
   ];
 }

home/modules/ai-tools/opencode.nix

@@ -0,0 +1,40 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.ai-tools.opencode;
+in
+{
+  options.ai-tools.opencode = {
+    enable = lib.mkEnableOption "opencode";
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = [ pkgs.opencode ];
+
+    home.file.".config/opencode/opencode.json".text = builtins.toJSON {
+      "$schema" = "https://opencode.ai/config.json";
+      permission = {
+        external_directory = {
+          "/run/secrets/" = "deny";
+          "~/.config/sops/age/keys.txt" = "deny";
+          "~/.ssh/id_rsa" = "deny";
+          "~/.ssh/id_ed25519" = "deny";
+          "~/.ssh/id_ecdsa" = "deny";
+          "~/.ssh/id_dsa" = "deny";
+          "/etc/ssh/ssh_host_rsa_key" = "deny";
+          "/etc/ssh/ssh_host_ed25519_key" = "deny";
+          "/etc/ssh/ssh_host_ecdsa_key" = "deny";
+          "/etc/ssh/ssh_host_dsa_key" = "deny";
+        };
+        command = {
+          sops = "deny";
+        };
+      };
+      plugin = [ "@mohak34/opencode-notifier@latest" ];
+    };
+  };
+}

home/modules/ai-tools/skills.nix

@@ -0,0 +1,49 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.ai-tools.claude-code;
+
+  skillType = lib.types.submodule {
+    options = {
+      owner = lib.mkOption { type = lib.types.str; };
+      repo = lib.mkOption { type = lib.types.str; };
+      rev = lib.mkOption { type = lib.types.str; };
+      hash = lib.mkOption { type = lib.types.str; };
+      skill = lib.mkOption { type = lib.types.str; };
+    };
+  };
+
+  fetchSkill =
+    skill:
+    let
+      src = pkgs.fetchFromGitHub {
+        inherit (skill)
+          owner
+          repo
+          rev
+          hash
+          ;
+      };
+    in
+    {
+      name = ".claude/skills/${skill.skill}";
+      value = {
+        source = "${src}/${skill.skill}";
+        recursive = true;
+      };
+    };
+in
+{
+  options.ai-tools.claude-code.skills = lib.mkOption {
+    type = lib.types.listOf skillType;
+    default = [ ];
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.file = builtins.listToAttrs (map fetchSkill cfg.skills);
+  };
+}

home/modules/ai-tools/tirith.nix

@@ -0,0 +1,30 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.ai-tools.tirith;
+in
+{
+  options.ai-tools.tirith = {
+    enable = lib.mkEnableOption "tirith shell security guard";
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      home.packages = [ pkgs.tirith ];
+    })
+    (lib.mkIf (cfg.enable && config.ai-tools.claude-code.enable) {
+      home.file.".claude/hooks/tirith-check.py" = {
+        source = ./tirith-check.py;
+        executable = true;
+      };
+
+      home.activation.tirith-claude-code = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+        ${pkgs.tirith}/bin/tirith setup claude-code --with-mcp --scope user --force 2>/dev/null || true
+      '';
+    })
+  ];
+}

home/modules/anki/default.nix

@@ -13,10 +13,12 @@ let
   standalone = osConfig == null;
 in
 lib.optionalAttrs standalone {
-  sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" "anki" [
-    "sync-user"
-    "sync-key"
-  ] { };
+  sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
+    anki = [
+      "sync-user"
+      "sync-key"
+    ];
+  };
 }
 // {
   warnings = lib.optional (

home/modules/database/default.nix

@@ -9,14 +9,18 @@
   options.database = {
     mssql.enable = lib.mkEnableOption "MSSQL";
     postgresql.enable = lib.mkEnableOption "PostgreSQL";
+    redis.enable = lib.mkEnableOption "Redis";
   };
 
   config = lib.mkMerge [
     (lib.mkIf config.database.mssql.enable {
-      home.packages = [ (config.nixgl.wrap pkgs.dbeaver-bin) ];
+      home.packages = with pkgs; [ (config.nixgl.wrap dbeaver-bin) ];
     })
     (lib.mkIf config.database.postgresql.enable {
-      home.packages = [ (config.nixgl.wrap pkgs.pgadmin4-desktopmode) ];
+      home.packages = with pkgs; [ (config.nixgl.wrap pgadmin4-desktopmode) ];
+    })
+    (lib.mkIf config.database.postgresql.enable {
+      home.packages = with pkgs; [ redis ];
     })
   ];
 }

home/modules/dconf/default.nix

@@ -41,7 +41,7 @@ in
       clock-show-weekday = true;
       color-scheme = "prefer-dark";
       enable-hot-corners = false;
-      font-name = font;
+      # font-name = font;
       locate-pointer = true;
       monospace-font-name = font;
     };

home/modules/taskwarrior/default.nix

@@ -15,11 +15,13 @@ let
 in
 lib.optionalAttrs standalone {
   sops = {
-    secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" "taskwarrior" [
-      "sync-server-url"
-      "sync-server-client-id"
-      "sync-encryption-secret"
-    ] { };
+    secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
+      taskwarrior = [
+        "sync-server-url"
+        "sync-server-client-id"
+        "sync-encryption-secret"
+      ];
+    };
 
     templates."taskrc.d/sync" = {
       content = ''

home/modules/tmux/default.nix

@@ -11,9 +11,5 @@
       enable = true;
       extraConfig = builtins.readFile (dotsPath + "/.config/tmux/tmux.conf");
     };
-
-    home.file = {
-      ".config/tmux/hooks/tmux.ssh.conf".source = dotsPath + "/.config/tmux/hooks/tmux.ssh.conf";
-    };
   };
 }

home/modules/zk/default.nix

@@ -0,0 +1,45 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.zk;
+in
+{
+  options.zk = {
+    enable = lib.mkEnableOption "zettelkasten";
+    path = lib.mkOption {
+      type = lib.types.str;
+      default = config.home.homeDirectory + "/.zk";
+      description = "Path to the zettelkasten directory";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    home = {
+      sessionVariables.ZK_PATH = cfg.path;
+      packages = [
+        (pkgs.writeShellApplication {
+          name = "zk";
+          runtimeInputs = with pkgs; [ tmux ];
+          text = builtins.readFile ./scripts/zk.sh;
+        })
+
+        (pkgs.writeShellApplication {
+          name = "save-zk";
+          runtimeInputs = with pkgs; [ git ];
+          text = builtins.readFile ./scripts/save-zk.sh;
+        })
+
+        (pkgs.writeShellApplication {
+          name = "setup-zk";
+          runtimeInputs = with pkgs; [ gh ];
+          text = builtins.readFile ./scripts/setup-zk.sh;
+        })
+      ];
+    };
+  };
+}

home/modules/zk/scripts/save-zk.sh

@@ -0,0 +1,2 @@
+cd "$ZK_PATH" || { echo "No zettelkasten directory found"; exit 1; }
+git add . && git commit -m "Update" && git push

home/modules/zk/scripts/setup-zk.sh

@@ -0,0 +1,13 @@
+if [ ! -d "$ZK_PATH" ]; then
+  echo "[zk] Setting up zettelkasten"
+  gh repo clone zk "$ZK_PATH"
+else
+  echo "[zk] Zettelkasten already set up."
+fi
+
+read -p "Would you like open your zettelkasten? [y/N] " -n 1 -r
+echo
+
+if [[ $REPLY =~ ^[Yy]$ ]]; then
+  $EDITOR "$ZK_PATH"
+fi

home/modules/zk/scripts/zk.sh

@@ -1,8 +1,6 @@
-#!/usr/bin/env bash
+current_zettel_path="$(cat "$ZK_PATH/current-zettel.txt")"
 
-current_zettel_path="$ZK_PATH/$(cat "$ZK_PATH/current-zettel.txt")"
-
-if [ "$TERM_PROGRAM" = tmux ]; then
+if [ -n "${TMUX:-}" ]; then
   cd "$ZK_PATH" && $EDITOR "$current_zettel_path"
 else
   echo 'Not in tmux'
@@ -12,13 +10,9 @@ else
   read -r -p 'Enter your choice: ' choice
   case $choice in
     1)
-      # Check if a tmux session is running with a window named zk
-      if tmux list-windows -F '#{window_name}' | grep -q zk; then
-        # Attach to the session containing the 'zk' window
-        session="$(tmux list-windows -F '#{window_name} #{session_name}' | grep zk | head -n 1 | awk '{ print $2 }')"
-        tmux attach -t "$session"
+      if tmux has-session -t zk 2>/dev/null; then
+        tmux attach -t zk
       else
-        # Create session with a window named 'zk' and start nvim
         tmux new-session -s zk -n zk -d
         tmux send-keys -t zk:zk "cd $ZK_PATH && $EDITOR $current_zettel_path" Enter
         tmux attach -t zk

hosts/andromache/default.nix

@@ -51,12 +51,11 @@ in
     ../../modules/yubikey
   ];
 
-  home-manager.users.${config.host.username} = import ../../home/hosts/andromache;
-
-  ssh.authorizedHosts = [ "astyanax" ];
+  home-manager.users.${config.host.username} = import ../../home/hosts/${config.host.name};
 
   secrets.nixSigningKey.enable = true;
 
+  restic-backup.enable = true;
   tailscale.enable = true;
 
   docker.enable = true;

hosts/andromache/host.nix

@@ -1,6 +1,7 @@
 {
   host = {
     username = "h";
-    name = "andromache";
+    highRam = true;
+    admin = true;
   };
 }

hosts/astyanax/default.nix

@@ -47,12 +47,11 @@ in
     ../../modules/yubikey
   ];
 
-  home-manager.users.${config.host.username} = import ../../home/hosts/astyanax;
-
-  ssh.authorizedHosts = [ "andromache" ];
+  home-manager.users.${config.host.username} = import ../../home/hosts/${config.host.name};
 
   secrets.nixSigningKey.enable = true;
 
+  restic-backup.enable = true;
   tailscale.enable = true;
   docker.enable = true;
   nfc.enable = true;

hosts/astyanax/host.nix

@@ -1,6 +1,7 @@
 {
   host = {
     username = "h";
-    name = "astyanax";
+    highRam = true;
+    admin = true;
   };
 }

hosts/eetion-02/default.nix

@@ -11,13 +11,6 @@
     ../../modules/ssh
   ];
 
-  ssh = {
-    authorizedHosts = [
-      "andromache"
-      "astyanax"
-    ];
-  };
-
   boot = {
     kernelParams = [
       "console=ttyS1,115200n8"

hosts/eetion-02/host.nix

@@ -1,6 +1,5 @@
 {
   host = {
     username = "h";
-    name = "eetion-02";
   };
 }

hosts/eetion/default.nix

@@ -9,15 +9,11 @@
     ./host.nix
     ../../modules/common
     ../../modules/ssh
+    ../../modules/tailscale
     # ../../modules/uptime-kuma
   ];
 
-  ssh = {
-    authorizedHosts = [
-      "andromache"
-      "astyanax"
-    ];
-  };
+  tailscale.enable = true;
 
   boot.loader = {
     grub.enable = false;

hosts/eetion/host.nix

@@ -1,6 +1,5 @@
 {
   host = {
     username = "h";
-    name = "eetion";
   };
 }

hosts/hecuba/default.nix

@@ -18,13 +18,6 @@
   ];
 
   networking.hostName = config.host.name;
-  ssh = {
-    authorizedHosts = [
-      "andromache"
-      "astyanax"
-    ];
-  };
-
   docker.enable = true;
 
   fileSystems."/" = {

hosts/hecuba/host.nix

@@ -1,6 +1,5 @@
 {
   host = {
     username = "username";
-    name = "hecuba";
   };
 }

hosts/vm/host.nix

@@ -1,6 +1,5 @@
 {
   host = {
     username = "h";
-    name = "vm";
   };
 }

images/sd-image-orange-pi-aarch64.nix

@@ -21,11 +21,6 @@ in
     name = "orange-pi";
   };
 
-  ssh.authorizedHosts = [
-    "andromache"
-    "astyanax"
-  ];
-
   nix.settings.experimental-features = [
     "nix-command"
     "flakes"

images/sd-image-raspberry-pi-aarch64.nix

@@ -21,11 +21,6 @@ in
     name = "raspberry-pi";
   };
 
-  ssh.authorizedHosts = [
-    "andromache"
-    "astyanax"
-  ];
-
   boot.kernelParams = [
     "console=ttyS1,115200n8"
   ];

modules/ai-tools/default.nix

@@ -1,15 +1,15 @@
-{ config, myUtils, ... }:
+{ config, ... }:
 
 let
-  inherit (config.secrets) sopsDir;
   inherit (config.host) username;
-  owner = config.users.users.${username}.name;
+  inherit (config.secrets) owner;
 in
 {
-  config.sops = {
-    secrets = myUtils.mkSopsSecrets sopsDir "opencode" [ "api-key" ] { inherit owner; };
+  config = {
+    nixpkgs.allowedUnfree = [ "claude-code" ];
+    secrets.groups.opencode = [ "api-key" ];
 
-    templates."opencode/auth.json" = {
+    sops.templates."opencode/auth.json" = {
       inherit owner;
       path = "/home/${username}/.local/share/opencode/auth.json";
       content = ''

modules/anki/default.nix

@@ -1,12 +1,6 @@
-{ config, myUtils, ... }:
-
-let
-  inherit (config.secrets) sopsDir;
-  inherit (config.host) username;
-  owner = config.users.users.${username}.name;
-in
 {
-  config.sops = {
-    secrets = myUtils.mkSopsSecrets sopsDir "anki" [ "sync-user" "sync-key" ] { inherit owner; };
-  };
+  config.secrets.groups.anki = [
+    "sync-user"
+    "sync-key"
+  ];
 }

modules/backups/default.nix

@@ -1,57 +1,53 @@
 {
   lib,
   config,
-  myUtils,
   ...
 }:
 
 let
   cfg = config.restic-backup;
-  inherit (config.secrets) sopsDir;
+  host = config.networking.hostName;
 in
 {
-  options = {
-    restic-backup = {
-      repository = lib.mkOption {
-        type = lib.types.str;
-        default = "b2:${config.sops.placeholder."backblaze-b2/bucket-name"}:${config.networking.hostName}";
-      };
+  options.restic-backup = {
+    enable = lib.mkEnableOption "restic backups";
 
-      passwordFile = lib.mkOption {
-        type = lib.types.str;
-        default = config.sops.secrets."restic/password".path;
-      };
+    passwordFile = lib.mkOption {
+      type = lib.types.str;
+      default = config.sops.secrets."restic/password".path;
+    };
 
-      paths = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ "/home" ];
-      };
+    paths = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ "/home" ];
     };
   };
 
-  config = {
-    sops = {
-      secrets = lib.mkMerge [
-        (myUtils.mkSopsSecrets sopsDir "restic" [ "password" ] { })
-        (myUtils.mkSopsSecrets sopsDir "backblaze-b2" [ "bucket-name" "account-id" "account-key" ] { })
+  config = lib.mkIf cfg.enable {
+    secrets.groups = {
+      restic = [ "password" ];
+      backblaze-b2 = [
+        "bucket-name"
+        "account-id"
+        "account-key"
       ];
-      templates = {
-        "restic/repo-${config.networking.hostName}" = {
-          content = "b2:${config.sops.placeholder."backblaze-b2/bucket-name"}:${config.networking.hostName}";
-        };
-        "restic/b2-env-${config.networking.hostName}" = {
-          content = ''
-            B2_ACCOUNT_ID=${config.sops.placeholder."backblaze-b2/account-id"}
-            B2_ACCOUNT_KEY=${config.sops.placeholder."backblaze-b2/account-key"}
-          '';
-        };
+    };
+
+    sops.templates = {
+      "restic/repo-${host}" = {
+        content = "b2:${config.sops.placeholder."backblaze-b2/bucket-name"}:${host}";
+      };
+      "restic/b2-env-${host}" = {
+        content = ''
+          B2_ACCOUNT_ID=${config.sops.placeholder."backblaze-b2/account-id"}
+          B2_ACCOUNT_KEY=${config.sops.placeholder."backblaze-b2/account-key"}
+        '';
       };
     };
 
     services.restic.backups.home = {
-      repositoryFile = config.sops.templates."restic/repo-${config.networking.hostName}".path;
-      inherit (cfg) passwordFile;
-      inherit (cfg) paths;
+      repositoryFile = config.sops.templates."restic/repo-${host}".path;
+      inherit (cfg) passwordFile paths;
       timerConfig = {
         OnCalendar = "daily";
         Persistent = true;
@@ -64,7 +60,7 @@ in
         "--keep-monthly 6"
         "--keep-yearly 1"
       ];
-      environmentFile = config.sops.templates."restic/b2-env-${config.networking.hostName}".path;
+      environmentFile = config.sops.templates."restic/b2-env-${host}".path;
     };
   };
 }

modules/boot/bootloader.nix

@@ -1,4 +1,11 @@
+{ config, ... }:
+
 {
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
+  boot = {
+    loader = {
+      systemd-boot.enable = true;
+      efi.canTouchEfiVariables = true;
+    };
+    tmp.useTmpfs = config.host.highRam;
+  };
 }

modules/common/host.nix

@@ -19,5 +19,15 @@
       type = lib.types.str;
       default = "en_US.UTF-8";
     };
+
+    highRam = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+    };
+
+    admin = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+    };
   };
 }

modules/desktops/logind.nix

@@ -0,0 +1,7 @@
+{
+  services.logind.settings.Login = {
+    HandleLidSwitch = "suspend";
+    IdleAction = "suspend";
+    IdleActionSec = 1800;
+  };
+}

modules/desktops/niri/default.nix

@@ -9,6 +9,8 @@ let
   cfg = config.desktop;
 in
 {
+  imports = [ ../logind.nix ];
+
   options.desktop = {
     ly = {
       enable = lib.mkOption {
@@ -35,15 +37,23 @@ in
       ];
     };
 
+    #  error:
+    #  Failed assertions:
+    #  - h profile: xdg.portal: since you installed Home Manager via its NixOS module and
+    #  'home-manager.useUserPackages' is enabled, you need to add
+    #
+    #  environment.pathsToLink = [ `/share/applications` `/share/xdg-desktop-portal` ];
+    #
+    #  to your NixOS configuration so that the portal definitions and DE
+    #  provided configurations get linked.
+    environment.pathsToLink = [
+      "/share/applications"
+      "/share/xdg-desktop-portal"
+    ];
+
     services = {
       gnome.gnome-keyring.enable = false;
       dbus.enable = true;
-      logind.settings.Login = {
-        HandleLidSwitch = "suspend";
-        IdleAction = "suspend";
-        IdleActionSec = 1800;
-      };
-
       displayManager.ly = lib.mkIf cfg.ly.enable {
         enable = true;
       };

modules/gaming/default.nix

@@ -29,7 +29,7 @@
   programs.gamemode.enable = true;
 
   environment.systemPackages = with pkgs; [
-    lutris
+    # lutris
     mangohud
   ];
 

modules/hcloud/default.nix

@@ -1,14 +1,13 @@
 {
   lib,
   config,
-  myUtils,
   ...
 }:
 
 let
   cfg = config.hcloud;
   inherit (config.host) username;
-  inherit (config.secrets) sopsDir;
+  inherit (config.secrets) owner;
 in
 {
   options.hcloud = {
@@ -16,12 +15,10 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    sops.secrets = myUtils.mkSopsSecrets sopsDir "hcloud" [ "api-token" ] {
-      owner = config.users.users.${username}.name;
-    };
+    secrets.groups.hcloud = [ "api-token" ];
 
     sops.templates."hcloud/cli.toml" = {
-      owner = config.users.users.${username}.name;
+      inherit owner;
       path = "/home/${username}/.config/hcloud/cli.toml";
       content = ''
         active_context = "server"

modules/secrets/default.nix

@@ -12,7 +12,6 @@ let
   inherit (config.host) username;
   inherit (cfg) sopsDir;
   owner = config.users.users.${username}.name;
-  mkSopsSecrets = myUtils.mkSopsSecrets sopsDir;
 in
 {
   imports = [ inputs.sops-nix.nixosModules.sops ];
@@ -24,6 +23,15 @@ in
         default = "${toString inputs.nix-secrets}/secrets";
       };
 
+      groups = lib.mkOption {
+        type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+        default = { };
+      };
+
+      owner = lib.mkOption {
+        type = lib.types.unspecified;
+      };
+
       nixSigningKey = {
         enable = lib.mkEnableOption "nix signing key configuration";
       };
@@ -35,27 +43,28 @@ in
   };
 
   config = {
+    secrets = {
+      inherit owner;
+      groups = {
+        email = [
+          "personal"
+          "work"
+        ];
+        nix = lib.optional cfg.nixSigningKey.enable "signing-key";
+      };
+    };
+
     sops = {
       # for yubikey, generate as follows:
       # ```
       # age-plugin-yubikey --identity > <keyfile-path>
       # ```
       age.keyFile = "/home/${username}/.config/sops/age/keys.txt";
-
-      secrets = lib.mkMerge [
-        (mkSopsSecrets "email" [ "personal" "work" ] { inherit owner; })
-        (lib.mkIf cfg.nixSigningKey.enable {
-          nix-signing-key = {
-            sopsFile = "${sopsDir}/nix.yaml";
-            key = "signing-key";
-            inherit owner;
-          };
-        })
-      ];
+      secrets = myUtils.mkSopsSecrets sopsDir owner cfg.groups;
     };
 
     nix.settings.secret-key-files = lib.mkIf cfg.nixSigningKey.enable [
-      config.sops.secrets.nix-signing-key.path
+      config.sops.secrets."nix/signing-key".path
     ];
 
     services = {

modules/ssh/authorized-keys.nix

@@ -1,7 +1,12 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  ...
+}:
 
 let
   inherit (config.host) username;
+  adminHosts = (import ../../utils { inherit lib; }).adminHosts ../../hosts;
 in
 {
   options.ssh = {
@@ -19,6 +24,6 @@ in
         keyFile = ../../hosts/${hostname}/ssh_user.pub;
       in
       lib.optionals (builtins.pathExists keyFile) (lib.splitString "\n" (builtins.readFile keyFile))
-    ) config.ssh.authorizedHosts
+    ) ((builtins.filter (h: h != config.host.name) adminHosts) ++ config.ssh.authorizedHosts)
   );
 }

modules/taskwarrior/default.nix

@@ -1,19 +1,17 @@
-{ config, myUtils, ... }:
+{ config, ... }:
 
 let
-  inherit (config.secrets) sopsDir;
-  inherit (config.host) username;
-  owner = config.users.users.${username}.name;
+  inherit (config.secrets) owner;
 in
 {
-  config.sops = {
-    secrets = myUtils.mkSopsSecrets sopsDir "taskwarrior" [
+  config = {
+    secrets.groups.taskwarrior = [
       "sync-server-url"
       "sync-server-client-id"
       "sync-encryption-secret"
-    ] { inherit owner; };
+    ];
 
-    templates."taskrc.d/sync" = {
+    sops.templates."taskrc.d/sync" = {
       inherit owner;
       content = ''
         sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"}

utils/default.nix

@@ -1,41 +1,8 @@
 { lib }:
 
-{
-  dirNames =
-    path: builtins.attrNames (lib.filterAttrs (_: type: type == "directory") (builtins.readDir path));
-
-  hostMeta =
-    hostDir:
-    if builtins.pathExists (hostDir + "/meta.nix") then
-      import (hostDir + "/meta.nix")
-    else
-      throw "meta.nix required in ${hostDir}";
-
-  mkSopsSecrets =
-    sopsDir: group: names: extraOpts:
-    let
-      file = "${group}.yaml";
-    in
-    lib.foldl' lib.mergeAttrs { } (
-      map (name: {
-        "${group}/${name}" = {
-          sopsFile = "${sopsDir}/${file}";
-          key = name;
-        }
-        // extraOpts;
-      }) names
-    );
-
-  sopsAvailability =
-    config: osConfig:
-    let
-      osSopsAvailable = osConfig != null && osConfig ? sops && osConfig.sops ? secrets;
-      hmSopsAvailable = config ? sops && config.sops ? secrets;
-      preferOs = osSopsAvailable;
-    in
-    {
-      available = osSopsAvailable || hmSopsAvailable;
-      secrets = if preferOs then osConfig.sops.secrets else config.sops.secrets;
-      templates = if preferOs then osConfig.sops.templates else config.sops.templates;
-    };
-}
+let
+  fs = import ./fs.nix { inherit lib; };
+  hosts = import ./hosts.nix { inherit lib; };
+  secrets = import ./secrets.nix { inherit lib; };
+in
+fs // hosts // secrets

utils/fs.nix

@@ -0,0 +1,6 @@
+{ lib }:
+
+{
+  dirNames =
+    path: builtins.attrNames (lib.filterAttrs (_: t: t == "directory") (builtins.readDir path));
+}

utils/hosts.nix

@@ -0,0 +1,19 @@
+{ lib }:
+
+let
+  fs = import ./fs.nix { inherit lib; };
+in
+{
+  hostMeta =
+    hostDir:
+    if builtins.pathExists (hostDir + "/meta.nix") then
+      import (hostDir + "/meta.nix")
+    else
+      throw "meta.nix required in ${hostDir}";
+
+  adminHosts =
+    hostsPath:
+    builtins.filter (host: ((import (hostsPath + "/${host}/host.nix")).host.admin or false)) (
+      fs.dirNames hostsPath
+    );
+}

utils/secrets.nix

@@ -0,0 +1,37 @@
+{ lib }:
+
+{
+  mkSopsSecrets =
+    sopsDir: owner: groups:
+    let
+      opts = lib.optionalAttrs (owner != null) { inherit owner; };
+      mkGroup =
+        group: names:
+        let
+          file = "${group}.yaml";
+        in
+        lib.foldl' lib.mergeAttrs { } (
+          map (name: {
+            "${group}/${name}" = {
+              sopsFile = "${sopsDir}/${file}";
+              key = name;
+            }
+            // opts;
+          }) names
+        );
+    in
+    lib.foldl' lib.mergeAttrs { } (lib.mapAttrsToList mkGroup groups);
+
+  sopsAvailability =
+    config: osConfig:
+    let
+      osSopsAvailable = osConfig != null && osConfig ? sops && osConfig.sops ? secrets;
+      hmSopsAvailable = config ? sops && config.sops ? secrets;
+      preferOs = osSopsAvailable;
+    in
+    {
+      available = osSopsAvailable || hmSopsAvailable;
+      secrets = if preferOs then osConfig.sops.secrets else config.sops.secrets;
+      templates = if preferOs then osConfig.sops.templates else config.sops.templates;
+    };
+}