fix: explicitely set 'SYSTEMD_EDITOR' env variable

- Add work-cli path input with nixpkgs follows to flake.nix
- Import modules/work-cli in work host config
- Enable programs.work-cli with gitlab/jira/vault settings (grouped attrset)
- Remove old shell.bash.extraInit completion eval

.envrc

@@ -1 +0,0 @@
-use flake

.gitignore

@@ -9,5 +9,4 @@ result-*
 
 nixos-efi-vars.fd
 
-.direnv/
+/.pre-commit-config.yaml
-.pre-commit-config.yaml

README.md

@@ -1,8 +1,5 @@
 # ❄️ NixOS flake
 
-![nix](https://img.shields.io/badge/nix-blue?logo=nixos&logoColor=%234d6fb7&labelColor=%23fff&color=%234d6fb7&link=https%3A%2F%2Fnixos.org%2F)
-![neovim](https://img.shields.io/badge/neovim-flat?logo=neovim&logoColor=%23408040&labelColor=%23fff&color=%2380C040)
-
 ## hosts
 
 ### NixOS

deploy/colmena.nix

@@ -6,38 +6,31 @@
 let
   inherit (inputs.nixpkgs) lib;
   utils = import ../utils { inherit lib; };
-  hostnames = utils.dirNames ../hosts;
+  hostDirNames = utils.dirNames ../hosts;
 
-  mkNode =
+  mkNode = hostname: tags: {
-    hostname:
+    imports = [ ../hosts/${hostname} ];
-    let
+    deployment = {
-      meta = utils.hostMeta ../hosts/${hostname};
+      targetHost = self.nixosConfigurations.${hostname}.config.ssh.publicHostname;
-      isLocal = builtins.elem "local" meta.tags;
+      targetUser = self.nixosConfigurations.${hostname}.config.ssh.username;
-    in
+      buildOnTarget = builtins.any (t: t != "local") tags;
-    {
+      inherit tags;
-      imports = [ ../hosts/${hostname} ];
-      host.name = hostname;
-      deployment = {
-        inherit (meta) tags;
-        targetUser = meta.host.username;
-        targetHost = if isLocal then "" else hostname;
-        buildOnTarget = builtins.any (t: t != "local" && t != "arm") meta.tags;
-      };
     };
+  };
 
-  nodes = lib.genAttrs hostnames mkNode;
+  nodes = lib.genAttrs hostDirNames (
+    hostname: mkNode hostname (utils.hostMeta ../hosts/${hostname}).deployment.tags
+  );
 in
-inputs.colmena.lib.makeHive (
+inputs.colmena.lib.makeHive {
-  {
+  meta = {
-    meta = {
+    nixpkgs = import inputs.nixpkgs {
-      nixpkgs = import inputs.nixpkgs { localSystem = "x86_64-linux"; };
+      localSystem = "x86_64-linux";
-      specialArgs = {
-        inherit inputs;
-        outputs = self;
-        dotsPath = ../dots;
-        myUtils = utils;
-      };
     };
-  }
+
-  // nodes
+    nodeNixpkgs = builtins.mapAttrs (_: v: v.pkgs) self.nixosConfigurations;
-)
+    nodeSpecialArgs = builtins.mapAttrs (_: v: v._module.specialArgs or { }) self.nixosConfigurations;
+  };
+
+  inherit nodes;
+}

dots/.bash_aliases/all

@@ -27,6 +27,8 @@ alias ipa="ip -brief address"
 alias ipl="ip -brief link"
 alias ipr="ip route"
 
+alias clip="xclip -sel clip"
+
 alias df="df -kTh"
 alias fzfpac="pacman -Slq | fzf -m --preview 'pacman -Si {1}' | xargs -ro sudo pacman -S"
 alias path='echo -e ${PATH//:/\\n}' # Pretty print path variables

dots/.bashrc

@@ -60,7 +60,7 @@ export XDG_DATA_HOME=$HOME/.local/share
 if [ -f "/usr/bin/fzf" ]; then
   # Fuzzy finder setup
   export FZF_COMPLETION_TRIGGER='**'
-  export FZF_DEFAULT_COMMAND='rg --files ""'
+  export FZF_DEFAULT_COMMAND='ag -g ""'
   export FZF_DEFAULT_OPTS="
   --pointer='❭'
   --height 10%

dots/.bin/git-cb

@@ -0,0 +1,221 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+readonly ALLOWED_MAIN_BRANCHES=("main" "master" "develop")
+readonly BRANCH_TYPES=(
+  "feat      For new features"
+  "hotfix    For urgent fixes"
+  "fix       For fixes"
+  "release   For preparing releases"
+  "chore     For non-code tasks"
+)
+
+error() {
+  echo "Error: $1" >&2
+  exit 1
+}
+
+warn() {
+  echo "Warning: $1" >&2
+}
+
+check_dependencies() {
+  local missing=()
+  for cmd in git fzf; do
+    if ! command -v "$cmd" &> /dev/null; then
+      missing+=("$cmd")
+    fi
+  done
+
+  if [[ ${#missing[@]} -gt 0 ]]; then
+    error "Missing required commands: ${missing[*]}"
+  fi
+}
+
+check_git_repo() {
+  if ! git rev-parse --git-dir &> /dev/null; then
+    error "Not in a git repository"
+  fi
+}
+
+check_current_branch() {
+  local current_branch
+  current_branch=$(git branch --show-current)
+
+  local is_main_branch=false
+  for branch in "${ALLOWED_MAIN_BRANCHES[@]}"; do
+    if [[ "$current_branch" == "$branch" ]]; then
+      is_main_branch=true
+      break
+    fi
+  done
+
+  if [[ "$is_main_branch" == false ]]; then
+    warn "Not branching from a main branch (current: $current_branch)"
+    read -rp "Continue anyway? [y/N] " response
+    if [[ ! "$response" =~ ^[Yy]$ ]]; then
+      exit 0
+    fi
+  fi
+}
+
+get_user_email() {
+  local email
+  email=$(git config --get user.email 2>/dev/null)
+
+  if [[ -z "$email" ]]; then
+    error "Git user email not configured. Run: git config user.email 'your@email.com'"
+  fi
+
+  echo "$email"
+}
+
+select_branch_type() {
+  local selected
+  selected=$(printf '%s\n' "${BRANCH_TYPES[@]}" | \
+    fzf --prompt="Select branch type: " \
+        --height=40% \
+        --border \
+        --info=inline) || error "Branch type selection cancelled"
+
+  echo "${selected%% *}"
+}
+
+select_jira_ticket() {
+  local email=$1
+
+  if ! command -v jira &> /dev/null; then
+    warn "Jira CLI not found. Proceeding without ticket ID."
+    return 0
+  fi
+
+  echo "Fetching Jira tickets for $email..." >&2
+  local jira_data
+  jira_data=$(jira issue list --assignee="$email" --order-by=priority --plain --no-headers 2>/dev/null) || {
+    warn "Could not fetch Jira tickets. Proceeding without ticket ID."
+    return 0
+  }
+
+  if [[ -z "$jira_data" ]]; then
+    warn "No Jira tickets found. Proceeding without ticket ID."
+    return 0
+  fi
+
+  echo "$jira_data" >&2
+  echo "" >&2
+
+  local formatted_tickets
+  formatted_tickets=$(echo "$jira_data" | awk '{
+    ticket_id = $2
+    $1 = $2 = ""
+    description = $0
+    gsub(/^[ \t]+/, "", description)
+    if (length(description) > 60) {
+      description = substr(description, 1, 57) "..."
+    }
+    print ticket_id " - " description
+  }')
+
+  if [[ -z "$formatted_tickets" ]]; then
+    warn "No tickets to display. Proceeding without ticket ID."
+    return 0
+  fi
+
+  local selected_ticket
+  selected_ticket=$(echo -e "SKIP - Create branch without ticket ID\n$formatted_tickets" | \
+    fzf --prompt="Select Jira ticket (or skip): " \
+        --height=40% \
+        --border \
+        --info=inline) || error "Ticket selection cancelled"
+
+  if [[ "$selected_ticket" != "SKIP"* ]]; then
+    echo "${selected_ticket%% -*}"
+  fi
+}
+
+get_branch_description() {
+  local ticket_id=$1
+  local editor="${EDITOR:-vi}"
+  local tmpfile
+  tmpfile=$(mktemp)
+
+  trap "rm -f '$tmpfile'" EXIT
+
+  if [[ -n "$ticket_id" ]]; then
+    cat > "$tmpfile" << EOF
+# Selected ticket: $ticket_id
+# Enter your branch description below in kebab-case (e.g., my-description):
+# The ticket ID will be automatically included in the branch name.
+# Lines starting with # will be ignored.
+
+EOF
+  else
+    cat > "$tmpfile" << 'EOF'
+# Enter your branch description below in kebab-case (e.g., my-description):
+# Lines starting with # will be ignored.
+
+EOF
+  fi
+  
+  "$editor" "$tmpfile" < /dev/tty > /dev/tty
+
+  local desc
+  desc=$(grep -v '^#' "$tmpfile" | tr -d '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+
+  echo "$desc"
+}
+
+validate_description() {
+  local desc=$1
+
+  if [[ -z "$desc" ]]; then
+    error "No description provided"
+  fi
+
+  if [[ ! "$desc" =~ ^[a-z0-9]+(-[a-z0-9]+)*$ ]]; then
+    error "Invalid branch description format.\nUse lowercase letters, numbers, and hyphens only.\nNo trailing or consecutive hyphens allowed.\nExample: my-feature-description"
+  fi
+}
+
+create_branch() {
+  local type=$1
+  local ticket_id=$2
+  local desc=$3
+
+  local branch
+  if [[ -n "$ticket_id" ]]; then
+    branch="$type/$ticket_id-$desc"
+  else
+    branch="$type/$desc"
+  fi
+
+  if git show-ref --verify --quiet "refs/heads/$branch"; then
+    error "Branch '$branch' already exists"
+  fi
+
+  echo ""
+  echo "Creating branch: $branch"
+  git checkout -b "$branch"
+}
+
+main() {
+  check_dependencies
+  check_git_repo
+  check_current_branch
+
+  local email
+  email=$(get_user_email)
+
+  local type
+  type=$(select_branch_type)
+
+  echo "About to call select_jira_ticket" >&2
+  local ticket_id=""
+  ticket_id=$(select_jira_ticket "$email")
+  local desc
+  desc=$(get_branch_description "$ticket_id")
+  validate_description "$desc"
+  create_branch "$type" "$ticket_id" "$desc"
+}
+
+main "$@"

dots/.bin/save-zk

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+
+cd "$ZK_PATH" || echo "No zettelkasten directory found"
+git a . && git commit -m "Update" && git push

dots/.bin/setup-zk

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+if [ ! -d ~/.zk ]; then
+    echo "[zk] Setting up zettelkasten"
+    gh repo clone zk ~/.zk
+else
+    echo "[zk] Zettelkasten already set up."
+fi
+
+read -p "Would you like open your zettelkasten? [y/N] " -n 1 -r
+echo
+
+if [[ $REPLY =~ ^[Yy]$ ]]; then
+  if [ -x "$(command -v zk)" ]; then
+    zk
+  else
+    echo "Error: 'zk' command not found or not executable"
+    exit 1
+  fi
+fi

dots/.bin/taskdeps

@@ -1,4 +1,4 @@
-#!/usr/bin/env python3
+#!/usr/bin/python
 
 import argparse
 import json

dots/.bin/zk

@@ -1,6 +1,8 @@
-current_zettel_path="$(cat "$ZK_PATH/current-zettel.txt")"
+#!/usr/bin/env bash
 
-if [ -n "${TMUX:-}" ]; then
+current_zettel_path="$ZK_PATH/$(cat "$ZK_PATH/current-zettel.txt")"
+
+if [ "$TERM_PROGRAM" = tmux ]; then
   cd "$ZK_PATH" && $EDITOR "$current_zettel_path"
 else
   echo 'Not in tmux'
@@ -10,9 +12,13 @@ else
   read -r -p 'Enter your choice: ' choice
   case $choice in
     1)
-      if tmux has-session -t zk 2>/dev/null; then
+      # Check if a tmux session is running with a window named zk
-        tmux attach -t zk
+      if tmux list-windows -F '#{window_name}' | grep -q zk; then
+        # Attach to the session containing the 'zk' window
+        session="$(tmux list-windows -F '#{window_name} #{session_name}' | grep zk | head -n 1 | awk '{ print $2 }')"
+        tmux attach -t "$session"
       else
+        # Create session with a window named 'zk' and start nvim
         tmux new-session -s zk -n zk -d
         tmux send-keys -t zk:zk "cd $ZK_PATH && $EDITOR $current_zettel_path" Enter
         tmux attach -t zk

dots/.config/nvim/after/plugin/hydra.lua

@@ -1,35 +0,0 @@
-local hydra_repl = "hydra-repl"
-
-if not vim.fn.executable(hydra_repl) then
-  return
-end
-
-local function send(lines)
-  vim.system({ hydra_repl, table.concat(lines, "\n") })
-end
-
-local function get_paragraph(buf)
-  local start_ = vim.fn.search("^$", "bnW")
-  local end_ = vim.fn.search("^$", "nW") - 1
-  if end_ < vim.api.nvim_win_get_cursor(0)[1] then
-    end_ = vim.api.nvim_buf_line_count(buf)
-  end
-  return vim.api.nvim_buf_get_lines(buf, start_, end_, false)
-end
-
-local function get_selection(buf)
-  return vim.api.nvim_buf_get_lines(buf, vim.fn.line("'<") - 1, vim.fn.line("'>"), false)
-end
-
-vim.api.nvim_create_autocmd("FileType", {
-  pattern = "javascript",
-  callback = function(e)
-    if vim.fn.fnamemodify(vim.api.nvim_buf_get_name(e.buf), ":e") ~= "hydra" then
-      return
-    end
-
-    local buf = e.buf
-    vim.keymap.set("n", "<CR>", function() send(get_paragraph(buf)) end, { buffer = buf, desc = "hydra: send block" })
-    vim.keymap.set("v", "<CR>", function() send(get_selection(buf)) end, { buffer = buf, desc = "hydra: send selection" })
-  end,
-})

dots/.config/nvim/after/plugin/image.nvim.lua

@@ -1,5 +1,3 @@
-if not vim.env.KITTY_WINDOW_ID then return end
-
 require("image").setup({
   backend = "kitty",
   kitty_method = "normal",

dots/.config/nvim/after/plugin/nvim-cmp.lua

@@ -64,7 +64,7 @@ cmp.setup({
   sources = {
     { name = "copilot",  group_index = 2 },
     { name = "zk" },
-    { name = "nvim_lsp" },
+    { name = "nvim_lsp", keyword_length = 8 },
     { name = "luasnip",  max_item_count = 16 },
     { name = "path" },
     { name = "buffer",   max_item_count = 8 },

dots/.config/nvim/after/plugin/nvim-ts-context-commentstring.lua

@@ -1,8 +0,0 @@
-require("ts_context_commentstring").setup({ enable_autocmd = false })
-
--- https://github.com/JoosepAlviste/nvim-ts-context-commentstring/issues/109
-local get_option = vim.filetype.get_option
-vim.filetype.get_option = function(filetype, option)
-  return option == "commentstring" and require("ts_context_commentstring.internal").calculate_commentstring()
-    or get_option(filetype, option)
-end

dots/.config/nvim/after/plugin/treesitter.lua

@@ -123,7 +123,7 @@ treesitter.setup({
 })
 
 opt.foldmethod = "expr"
-opt.foldexpr = "v:lua.vim.treesitter.foldexpr()"
+opt.foldexpr = "nvim_treesitter#foldexpr()"
 opt.foldenable = false
 
 -- TreeSJ

dots/.config/nvim/after/plugin/wiki.vim.lua

@@ -1,8 +1,6 @@
-require("zk.utils")
-
 vim.cmd([[
 " Change local buffer to directory of current file after the plugin has loaded
-execute 'autocmd BufEnter' g:zk_path . '/*.md' 'silent lcd %:p:h'
+autocmd VimEnter * lcd %:p:h
 
 " " Override wiki index mapping to also cd into the wiki
 nm <leader>ww <plug>(wiki-index)
@@ -13,16 +11,11 @@ nm <leader>ww <plug>(wiki-index)
 " nm <leader>s <plug>(wiki-link-follow-split)
 " nm <leader>v <plug>(wiki-link-follow-vsplit)
 
-function! ZKContextualEcho()
+autocmd BufEnter *.md if expand('%:t') =~ '_' | echo 'hierarchical relation' | endif
-  let l:name = expand('%:t')
+autocmd BufEnter *.md if expand('%:t') =~ '--' | echo 'relation' | endif
-  if l:name =~ '_' | echo 'hierarchical relation'
+autocmd BufEnter *.md if expand('%:t') =~ '<>' | echo 'dichotomy' | endif
-  elseif l:name =~ '--' | echo 'relation'
+autocmd BufEnter *.md if expand('%:t') =~ 'my-' | echo 'personal file' | endif
-  elseif l:name =~ '<>' | echo 'dichotomy'
+autocmd BufEnter *.md if expand('%:t') =~ 'project_' | echo 'project file' | endif
-  elseif l:name =~ 'my-' | echo 'personal file'
-  elseif l:name =~ 'project_' | echo 'project file'
-  endif
-endfunction
-execute 'autocmd BufEnter' g:zk_path . '/*.md' 'call ZKContextualEcho()'
 
 " Only load wiki.vim for zk directory
 let g:wiki_index_name='index'
@@ -83,7 +76,7 @@ let g:wiki_templates = [
 "
 
 let g:wiki_filetypes=['md']
-let g:wiki_root=g:zk_path
+let g:wiki_root='~/.zk'
 let g:wiki_global_load=0
 let g:wiki_link_creation = {
       \ 'md': {

dots/.config/nvim/flake.lock

@@ -42,11 +42,11 @@
     },
     "nixCats": {
       "locked": {
-        "lastModified": 1777273601,
+        "lastModified": 1770584904,
-        "narHash": "sha256-xBUa8Tl9V7IXI+VmLEuDc81La/EhoSn1C3EVSnJ3cfU=",
+        "narHash": "sha256-9Zaz8lbKF2W9pwXZEnbiGsicHdBoU+dHt3Wv3mCJoZ8=",
         "owner": "BirdeeHub",
         "repo": "nixCats-nvim",
-        "rev": "f69ea013e328841a7def7037ed59788a76be8816",
+        "rev": "538fdde784d2909700d97a8ef307783b33a86fb1",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1777270315,
+        "lastModified": 1770843696,
-        "narHash": "sha256-yKB4G6cKsQsWN7M6rZGk6gkJPDNPIzT05y4qzRyCDlI=",
+        "narHash": "sha256-LovWTGDwXhkfCOmbgLVA10bvsi/P8eDDpRudgk68HA8=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "6368eda62c9775c38ef7f714b2555a741c20c72d",
+        "rev": "2343bbb58f99267223bc2aac4fc9ea301a155a16",
         "type": "github"
       },
       "original": {
@@ -106,11 +106,11 @@
     "plugins-helm-ls-nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1773934114,
+        "lastModified": 1768584652,
-        "narHash": "sha256-8trqFsA7nTKSdtkiAL0Sa9bXjh5ONtAqN7XNE/B8ukM=",
+        "narHash": "sha256-jnMc87OjURNcqsva0npYgVyUrWc5C6L7yHpNvt9eSmg=",
         "owner": "qvalentin",
         "repo": "helm-ls.nvim",
-        "rev": "20df43509b02a3ce3c6b3eee254d6e2bffa9a370",
+        "rev": "f0b9a1723890971a6d84890b50dbf5f40974ea1b",
         "type": "github"
       },
       "original": {

dots/.config/nvim/flake.nix

@@ -45,38 +45,13 @@
       inherit (nixCats) utils;
       luaPath = ./.;
       forEachSystem = utils.eachSystem nixpkgs.lib.platforms.all;
-      extra_pkg_config = {
+      extra_pkg_config = { };
-        allowUnfreePredicate =
-          pkg:
-          builtins.elem (nixpkgs.lib.getName pkg) [
-            "vim-sandwich"
-            "jupytext.nvim"
-            "eyeliner.nvim"
-            "context_filetype.vim"
-            "editorconfig-vim"
-            "unicode.vim"
-            "quarto-nvim"
-            "vim-openscad"
-            "lsp_lines.nvim"
-            "nvim-highlight-colors"
-            "nvim-lint"
-          ];
-      };
 
       mkDependencyOverlays = system: [
         (utils.standardPluginOverlay inputs)
         (_final: _prev: {
           mcp-hub = inputs.mcp-hub.packages.${system}.default;
         })
-        (_: prev: {
-          luajitPackages = prev.luajitPackages.overrideScope (
-            _: lprev: {
-              neotest = lprev.neotest.overrideAttrs (_: {
-                doCheck = false;
-              });
-            }
-          );
-        })
       ];
 
       categoryDefinitions =
@@ -87,11 +62,9 @@
         {
           lspsAndRuntimeDeps = with pkgs; {
             general = [
-              nodejs_24
               black
               clang
               clang-tools
-              curl # → plenary-nvim, mcp-hub
               delta
               emmet-language-server
               eslint_d
@@ -105,8 +78,8 @@
               mcp-hub
               nixd
               nixfmt
-              prettier
+              nodePackages.prettier
-              typescript-language-server
+              nodePackages.typescript-language-server
               ormolu
               prettierd
               rust-analyzer
@@ -115,8 +88,6 @@
               stylelint
               stylua
               tree-sitter
-              tailwindcss-language-server
-              typescript-language-server
               vscode-langservers-extracted
               vtsls
               yaml-language-server
@@ -174,7 +145,6 @@
               nvim-treesitter-textobjects
               # nvim-treesitter-context
               nvim-ts-context-commentstring
-              # theHamsta/crazy-node-movement
               treesj
               sniprun
               gitsigns-nvim

dots/.config/nvim/init.lua

@@ -8,9 +8,11 @@ require("cursor")
 require("fold")
 require("netrw")
 require("ftdetect")
+require("plug")
 require("pandoc")
 require("keymaps")
 require("highlight")
+require("paq-setup")
 require("statusline")
 require("diagnostic")
 require("utils")
@@ -18,3 +20,4 @@ require("zk")
 require("reload")
 
 vim.opt.background = "dark"
+vim.opt.laststatus = 3

dots/.config/nvim/lua/ftdetect.lua

@@ -9,6 +9,5 @@ vim.filetype.add({
     ["%.env.*"] = "dotenv",
     ["%.pl$"] = "prolog",
     [".*.containerfile.*"] = "dockerfile",
-    ["%.hydra$"] = "javascript",
   },
 })

dots/.config/nvim/lua/mr.lua

@@ -0,0 +1,44 @@
+local M = {}
+
+local function merge_base()
+  return vim.fn.system("git merge-base origin/main HEAD"):gsub("%s+", "")
+end
+
+function M.files()
+  local base = merge_base()
+  require("fzf-lua").fzf_exec("git diff --name-only " .. base .. "...HEAD", {
+    prompt = "MR files> ",
+    actions = {
+      ["default"] = function(selected)
+        vim.cmd("edit " .. selected[1])
+        require("gitsigns").diffthis(base)
+      end,
+    },
+  })
+end
+
+function M.commits()
+  local base = merge_base()
+  require("fzf-lua").fzf_exec("git log --oneline " .. base .. "..HEAD", {
+    prompt = "MR commits> ",
+    actions = {
+      ["default"] = function(selected)
+        local sha = selected[1]:match("^(%S+)")
+        require("fzf-lua").fzf_exec("git diff --name-only " .. sha .. "~1.." .. sha, {
+          prompt = sha:sub(1, 7) .. " files> ",
+          actions = {
+            ["default"] = function(files)
+              vim.cmd("edit " .. files[1])
+              require("gitsigns").diffthis(sha .. "~1")
+            end,
+          },
+        })
+      end,
+    },
+  })
+end
+
+vim.api.nvim_create_user_command("MRFiles", M.files, {})
+vim.api.nvim_create_user_command("MRCommits", M.commits, {})
+
+return M

dots/.config/nvim/lua/nixCatsUtils/catPacker.lua

@@ -0,0 +1,53 @@
+-- Source: https://github.com/BirdeeHub/nixCats-nvim/blob/main/templates/example/lua/nixCatsUtils/catPacker.lua
+--[[
+  This directory is the luaUtils template.
+  You can choose what things from it that you would like to use.
+  And then delete the rest.
+  Everything in this directory is optional.
+--]]
+
+local M = {}
+-- NOTE: This function is for defining a paq.nvim fallback method of downloading plugins
+-- when nixCats was not used to install your config.
+-- If you only ever load your config using nixCats, you don't need this file.
+
+-- it literally just only runs it when not on nixCats
+-- all neovim package managers that use the regular plugin loading scheme
+-- can be used this way, just do whatever the plugin manager needs to put it in the
+-- opt directory for lazy loading, and add the build steps so that when theres no nix the steps are ran
+function M.setup(v)
+  if not vim.g[ [[nixCats-special-rtp-entry-nixCats]] ] then
+    local function clone_paq()
+      local path = vim.fn.stdpath("data") .. "/site/pack/paqs/start/paq-nvim"
+      local is_installed = vim.fn.empty(vim.fn.glob(path)) == 0
+      if not is_installed then
+        vim.fn.system({ "git", "clone", "--depth=1", "https://github.com/savq/paq-nvim.git", path })
+        return true
+      end
+    end
+    local function bootstrap_paq(packages)
+      local first_install = clone_paq()
+      vim.cmd.packadd("paq-nvim")
+      local paq = require("paq")
+      if first_install then
+        vim.notify("Installing plugins... If prompted, hit Enter to continue.")
+      end
+      paq(packages)
+      paq.install()
+    end
+
+    vim.api.nvim_create_autocmd("VimEnter", {
+      once = true,
+      callback = function()
+        local pkgs_count = #require("paq").query("to_install")
+        if pkgs_count < 1 then
+          return
+        end
+        vim.notify(string.format("There are %d to install", pkgs_count))
+      end,
+    })
+
+    bootstrap_paq(vim.list_extend({ "savq/paq-nvim" }, v))
+  end
+end
+return M

dots/.config/nvim/lua/paq-setup.lua

@@ -0,0 +1,47 @@
+require("nixCatsUtils.catPacker").setup({
+  { "savq/paq-nvim" },
+  { "jinh0/eyeliner.nvim" },
+  { "ibhagwan/fzf-lua" },
+  { "barreiroleo/ltex_extra.nvim" },
+  { "neovim/nvim-lspconfig" },
+  { "https://git.sr.ht/~whynothugo/lsp_lines.nvim" },
+  { "linrongbin16/lsp-progress.nvim" },
+  { "folke/neodev.nvim" }, -- Nvim
+  { "b0o/schemastore.nvim" }, -- JSON Schemas
+  { "mfussenegger/nvim-lint" },
+  { "stevearc/conform.nvim" },
+  { "L3MON4D3/LuaSnip" },
+  { "saadparwaiz1/cmp_luasnip" },
+  { "hrsh7th/nvim-cmp" },
+  { "hrsh7th/cmp-nvim-lsp" },
+  { "hrsh7th/cmp-buffer" },
+  { "hrsh7th/cmp-path" },
+  { "nvim-lua/plenary.nvim" },
+  { "MunifTanjim/nui.nvim" },
+  { "folke/trouble.nvim" },
+  { "rktjmp/shipwright.nvim" }, -- For building themes based on lush (e.g. terminal)
+  { "rktjmp/lush.nvim" },
+  { "mcchrish/zenbones.nvim" }, -- Zenbones themes (contains zenwritten)
+  { "theHamsta/crazy-node-movement" },
+  { "nvim-treesitter/nvim-treesitter", build = ":TSUpdate" },
+  { "nvim-treesitter/nvim-treesitter-textobjects" },
+  -- { "nvim-treesitter/nvim-treesitter-context" },
+  { "JoosepAlviste/nvim-ts-context-commentstring" }, -- commentstring based on cursor position (e.g. for Svelte)
+  { "Wansmer/treesj" },
+  { "michaelb/sniprun", build = "sh install.sh" },
+  { "lewis6991/gitsigns.nvim" },
+  { "brenoprata10/nvim-highlight-colors" },
+  { "razak17/tailwind-fold.nvim" },
+  { "rmagatti/auto-session" },
+  { "kndndrj/nvim-dbee" },
+  { "3rd/image.nvim", build = false },
+  { "polarmutex/beancount.nvim" },
+  { "jamesblckwell/nvimkit.nvim" },
+  { 'olimorris/codecompanion.nvim' },
+  { "ravitemer/mcphub.nvim",                       build = "pnpm install -g mcp-hub@latest" },
+  { "zbirenbaum/copilot.lua" },
+  { "zbirenbaum/copilot-cmp" },
+  { "qvalentin/helm-ls.nvim", ft = "helm" },
+  { "mikesmithgh/kitty-scrollback.nvim" },
+  { "greggh/claude-code.nvim" },
+})

dots/.config/nvim/lua/plug.lua

@@ -0,0 +1,35 @@
+if not vim.g[ [[nixCats-special-rtp-entry-nixCats]] ] then
+  local vim = vim
+  local Plug = vim.fn["plug#"]
+
+  vim.call("plug#begin")
+
+  Plug("machakann/vim-sandwich")
+  Plug("Shougo/context_filetype.vim")
+  Plug("editorconfig/editorconfig-vim")
+  Plug("honza/vim-snippets")
+  Plug("chrisbra/unicode.vim")
+  Plug("ap/vim-css-color")
+  -- Jupyter
+  Plug("quarto-dev/quarto-vim")
+  -- LaTeX
+  Plug("lervag/vimtex")
+  -- Wiki
+  Plug("lervag/wiki.vim")
+  -- Markdown
+  Plug("vim-pandoc/vim-pandoc")
+  Plug("vim-pandoc/vim-pandoc-syntax")
+  Plug("ferrine/md-img-paste.vim")
+  -- TidalCycles
+  Plug("supercollider/scvim")
+  Plug("tidalcycles/vim-tidal")
+  -- GLSL
+  Plug("tikhomirov/vim-glsl")
+  Plug("timtro/glslView-nvim")
+  -- Jupyter notebooks
+  Plug("goerz/jupytext.vim")
+  -- OpenSCAD
+  Plug("sirtaj/vim-openscad")
+
+  vim.call("plug#end")
+end

dots/.config/nvim/lua/statusline.lua

@@ -1,6 +1,5 @@
-vim.opt.laststatus = 3
-
 vim.cmd([[
+se ls=2
 se stl=\ %0*%n
 se stl+=\ %m
 se stl+=\ %y%0*

dots/.config/nvim/lua/zk/cmp.lua

@@ -13,31 +13,28 @@ local function get_markdown_files(base)
   return items
 end
 
-function source:get_keyword_pattern()
-  return "[%w%./%-]*"
-end
-
 function source:complete(params, callback)
   local cursor_before_line = params.context.cursor_before_line
   local cursor_after_line = params.context.cursor_after_line or ""
 
-  if not cursor_before_line:match("%[[^%]]*%]%(") then
+  local trigger = cursor_before_line:match("%[[^%]]*%]%(([^)]*)$")
-    callback({})
-    return
-  end
 
-  local items = get_markdown_files(".")
+  if trigger ~= nil then
-  local next_char = cursor_after_line:sub(1, 1)
+    local items = get_markdown_files(".")
+    local next_char = cursor_after_line:sub(1, 1)
 
-  for _, item in ipairs(items) do
+    for _, item in ipairs(items) do
-    if next_char == ")" then
+      if next_char == ")" then
-      item.insertText = item.label
+        item.insertText = item.label
-    else
+      else
-      item.insertText = item.label .. ")"
+        item.insertText = item.label .. ")"
+      end
     end
-  end
 
-  callback(items)
+    callback(items)
+  else
+    callback({})
+  end
 end
 
 function source:get_trigger_characters()

dots/.config/nvim/lua/zk/init.lua

@@ -1,10 +1,9 @@
 require("zk.cmp")
-require("zk.utils")
 
 vim.cmd([[
 let s:zk_preview_enabled = 0
 let s:live_server_job = -1
-execute 'au BufEnter' g:zk_path . '/*.md' 'silent exe "!echo %" ">" g:zk_path . "/current-zettel.txt"'
+au BufEnter /home/h/.zk/*.md silent exe '!echo "%" > /home/h/.zk/current-zettel.txt'
 function! ToggleZKPreview()
     if s:zk_preview_enabled == 1
         let s:zk_preview_enabled = 0
@@ -12,10 +11,10 @@ function! ToggleZKPreview()
         au! ZKPreview
     else
         let s:zk_preview_enabled = 1
-        let s:live_server_job = jobstart('live-server --watch=' . g:zk_path . '/current-zettel-content.html --open=current-zettel-content.html --port=8080')
+        let s:live_server_job = jobstart('live-server --watch=/home/h/.zk/current-zettel-content.html --open=current-zettel-content.html --port=8080')
         augroup ZKPreview
-          execute 'au BufEnter' g:zk_path . '/*.md' 'silent exe "!cat %:r.html" ">" g:zk_path . "/current-zettel-content.html"'
+          au BufEnter /home/h/.zk/*.md silent exe '!cat "%:r.html" > /home/h/.zk/current-zettel-content.html'
-          execute 'au BufWritePost' g:zk_path . '/*.md' 'silent exe "!make && cat %:r.html" ">" g:zk_path . "/current-zettel-content.html"'
+          au BufWritePost /home/h/.zk/*.md silent exe '!make && cat "%:r.html" > /home/h/.zk/current-zettel-content.html'
         augroup END
     endif
 endfunction

dots/.config/nvim/lua/zk/utils.lua

@@ -1,2 +0,0 @@
-vim.g.zk_path = os.getenv("ZK_PATH") or (os.getenv("HOME") .. "/.zk")
-return vim.g.zk_path

dots/.config/task/taskrc

@@ -1,3 +1,4 @@
+include ./taskrc.d/$HOSTNAME
 include ./taskrc.d/aliases
 include ./taskrc.d/urgency
 include ./taskrc.d/reports
@@ -9,5 +10,6 @@ search.case.sensitive=no
 
 rc.json.array=on
 rc.verbose=nothing
-news.version=3.4.2
+news.version=3.1.0
 
+recurrence=off

dots/.config/tmux/hooks/tmux.ssh.conf

@@ -0,0 +1 @@
+set -g status-style bg=colour12,fg=colour0

dots/.config/tmux/tmux.conf

@@ -70,11 +70,11 @@ set -g status-right '#(uptime | cut -f 4-5 -d " " | cut -f 1 -d ",") %a %l:%M:%S
 
 set -g default-terminal "tmux-256color"
 
+set-hook -g after-new-session 'if -F "#{==:#{session_name},ssh}" "source ${XDG_CONFIG_HOME}/tmux/hooks/tmux.ssh.conf" "source ${XDG_CONFIG_HOME}/tmux/hooks/tmux.regular.conf"'
+
 # Vi copypaste mode
 if-shell "test '\( #{$TMUX_VERSION_MAJOR} -eq 2 -a #{$TMUX_VERSION_MINOR} -ge 4 \)'" 'bind-key -Tcopy-mode-vi v send -X begin-selection; bind-key -Tcopy-mode-vi y send -X copy-selection-and-cancel'
 if-shell '\( #{$TMUX_VERSION_MAJOR} -eq 2 -a #{$TMUX_VERSION_MINOR} -lt 4\) -o #{$TMUX_VERSION_MAJOR} -le 1' 'bind-key -t vi-copy v begin-selection; bind-key -t vi-copy y copy-selection'
 if-shell '\( #{$TMUX_VERSION_MAJOR} -eq 2 -a #{$TMUX_VERSION_MINOR} -lt 2\) -o #{$TMUX_VERSION_MAJOR} -le 1' 'set-option -g status-utf8 on'
 
 set -g allow-passthrough on
-set -s extended-keys on
-set -as terminal-features 'xterm*:extkeys'

dots/.local/share/task/hooks/on-add.limit.py

@@ -0,0 +1,29 @@
+#!/usr/bin/env python3
+import sys
+import json
+
+SLOTS_FILE = "/home/h/.local/share/task/add_slots"
+
+def get_slots():
+    try:
+        with open(SLOTS_FILE, "r") as f:
+            return int(f.read().strip())
+    except:
+        return 0
+
+slots = get_slots()
+
+if slots <= 0:
+    print(f"Cannot add task: No slots available (0/{slots}).")
+    print("Delete or complete a task first to earn an add slot.")
+    sys.exit(1)
+
+with open(SLOTS_FILE, "w") as f:
+    f.write(str(slots - 1))
+
+print(f"Task added. Slots remaining: {slots - 1}")
+
+for line in sys.stdin:
+    task = json.loads(line)
+    print(json.dumps(task))
+    sys.exit(0)

dots/.local/share/task/hooks/on-modify.limit.py

@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+import sys
+import json
+
+SLOTS_FILE = "/home/h/.local/share/task/add_slots"
+
+def get_slots():
+    try:
+        with open(SLOTS_FILE, "r") as f:
+            return int(f.read().strip())
+    except:
+        return 0
+
+data = sys.stdin.read().strip().split("\n")
+if len(data) < 2:
+    for line in data:
+        if line:
+            print(line)
+    sys.exit(0)
+
+old_task = json.loads(data[0])
+new_task = json.loads(data[1])
+
+was_pending = old_task.get("status") == "pending"
+is_not_pending = new_task.get("status") in ("completed", "deleted")
+
+if was_pending and is_not_pending:
+    slots = get_slots() + 1
+    with open(SLOTS_FILE, "w") as f:
+        f.write(str(slots))
+    print(f"Slot earned! Total slots: {slots}")
+
+print(json.dumps(new_task))
+sys.exit(0)

dots/.zotero/bbt.json

@@ -1,11 +1,11 @@
 {
   "config": {
-    "options": {},
     "preferences": {
       "ascii": "",
       "asciiBibLaTeX": false,
       "asciiBibTeX": true,
       "autoAbbrev": false,
+      "autoAbbrevStyle": "",
       "autoExport": "immediate",
       "autoExportDelay": 5,
       "autoExportIdleWait": 10,
@@ -13,22 +13,18 @@
       "autoExportPathReplaceDirSep": "-",
       "autoExportPathReplaceSpace": " ",
       "automaticTags": true,
+      "autoPinDelay": 0,
       "auxImport": false,
       "baseAttachmentPath": "/home/h/doc/books",
       "biblatexExtendedDateFormat": true,
       "biblatexExtendedNameFormat": true,
       "biblatexExtractEprint": true,
-      "biblatexUsePrefix": true,
-      "bibtexEditionOrdinal": false,
       "bibtexParticleNoOp": false,
       "bibtexURL": "off",
       "cache": true,
-      "cacheDelete": false,
+      "cacheFlushInterval": 5,
       "charmap": "",
-      "chinese": false,
-      "chineseSplitName": true,
       "citeCommand": "cite",
-      "citekeyCaseInsensitive": true,
       "citekeyFold": true,
       "citekeyFormat": "zotero.clean",
       "citekeyFormatEditing": "zotero.clean",
@@ -38,35 +34,32 @@
       "DOIandURL": "both",
       "exportBibTeXStrings": "off",
       "exportBraceProtection": true,
-      "exportSort": "citekey",
       "exportTitleCase": true,
       "extraMergeCitekeys": false,
       "extraMergeCSL": false,
       "extraMergeTeX": false,
-      "fillKeyAfter": 1,
       "git": "config",
       "import": true,
       "importBibTeXStrings": true,
       "importCaseProtection": "as-needed",
       "importCitationKey": true,
-      "importDetectURLs": true,
       "importExtra": true,
       "importJabRefAbbreviations": true,
       "importJabRefStrings": true,
       "importNoteToExtra": "",
-      "importPlaceEvent": "inproceedings,conference,presentation,talk",
       "importSentenceCase": "on+guess",
-      "importSentenceCaseQuoted": true,
       "importUnknownTexCommand": "ignore",
       "itemObserverDelay": 5,
       "jabrefFormat": 0,
-      "japanese": false,
+      "jieba": false,
+      "keyConflictPolicy": "keep",
       "keyScope": "global",
+      "kuroshiro": false,
       "language": "langid",
       "logEvents": false,
       "mapMath": "",
       "mapText": "",
-      "packages": "",
+      "mapUnicode": "conservative",
       "parseParticles": true,
       "patchDates": "dateadded=dateAdded, date-added=dateAdded, datemodified=dateModified, date-modified=dateModified",
       "platform": "lin",
@@ -82,8 +75,7 @@
       "rawImports": false,
       "rawLaTag": "#LaTeX",
       "relativeFilePaths": false,
-      "remigrate": false,
+      "retainCache": false,
-      "resetKeyOnChange": false,
       "scrubDatabase": false,
       "separatorList": "and",
       "separatorNames": "and",
@@ -98,4 +90,5 @@
       "warnTitleCased": false
     }
   }
-}
+}
+

flake.lock

@@ -38,11 +38,11 @@
     "base16-helix": {
       "flake": false,
       "locked": {
-        "lastModified": 1776754714,
+        "lastModified": 1760703920,
-        "narHash": "sha256-E3OAK27smtATTmX45uoTSRsVD+Y+ZiVVfgM/tjpbtYg=",
+        "narHash": "sha256-m82fGUYns4uHd+ZTdoLX2vlHikzwzdu2s2rYM2bNwzw=",
         "owner": "tinted-theming",
         "repo": "base16-helix",
-        "rev": "4d508123037e7851ad36ebf7d9c48b0e9e1eb581",
+        "rev": "d646af9b7d14bff08824538164af99d0c521b185",
         "type": "github"
       },
       "original": {
@@ -92,28 +92,6 @@
         "type": "github"
       }
     },
-    "comin": {
-      "inputs": {
-        "flake-compat": "flake-compat_2",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "treefmt-nix": "treefmt-nix"
-      },
-      "locked": {
-        "lastModified": 1780200954,
-        "narHash": "sha256-3476T026t+XSpOvgBGzKSG6J4swuRLnPO9dR+OATtq8=",
-        "owner": "nlewo",
-        "repo": "comin",
-        "rev": "4f14d338d755239c27131cbf6b466be4bbb20f91",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nlewo",
-        "repo": "comin",
-        "type": "github"
-      }
-    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -143,11 +121,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1780200155,
+        "lastModified": 1773806610,
-        "narHash": "sha256-cKpqEvRqxnCbp/2ZVczMHws31Qh4D/HTEuanWuJmySk=",
+        "narHash": "sha256-mh0egzUnzXfHPrOjWI0hChOiyfibEqb8lPtfQaqfTdo=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "d29c0c2692ced897777eca19c9bab1b34be0e0d6",
+        "rev": "df5c2d43f13c73d6bc16f4ccdacd588d8442af3d",
         "type": "gitlab"
       },
       "original": {
@@ -160,11 +138,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1779670703,
+        "lastModified": 1764873433,
-        "narHash": "sha256-UdfMivNMwCCqQsYDg5pSz8X2IOaOrIZLIIy+Bg3CO2o=",
+        "narHash": "sha256-1XPewtGMi+9wN9Ispoluxunw/RwozuTRVuuQOmxzt+A=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "942159e73e40bf785816f7f1f5feed9ef3d7c8f9",
+        "rev": "f7ffd917ac0d253dbd6a3bf3da06888f57c69f92",
         "type": "github"
       },
       "original": {
@@ -190,22 +168,6 @@
       }
     },
     "flake-compat_2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1765121682,
-        "narHash": "sha256-4VBOP18BFeiPkyhy9o4ssBNQEvfvv1kXkasAYd0+rrA=",
-        "owner": "NixOS",
-        "repo": "flake-compat",
-        "rev": "65f23138d8d09a92e30f1e5c87611b23ef451bf3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_3": {
       "flake": false,
       "locked": {
         "lastModified": 1767039857,
@@ -251,11 +213,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778716662,
+        "lastModified": 1767609335,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
         "type": "github"
       },
       "original": {
@@ -315,18 +277,18 @@
     },
     "git-hooks": {
       "inputs": {
-        "flake-compat": "flake-compat_3",
+        "flake-compat": "flake-compat_2",
         "gitignore": "gitignore",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1778507602,
+        "lastModified": 1772893680,
-        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "narHash": "sha256-JDqZMgxUTCq85ObSaFw0HhE+lvdOre1lx9iI6vYyOEs=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
+        "rev": "8baab586afc9c9b57645a734c820e4ac0a604af9",
         "type": "github"
       },
       "original": {
@@ -359,18 +321,20 @@
     "gnome-shell": {
       "flake": false,
       "locked": {
+        "host": "gitlab.gnome.org",
         "lastModified": 1767737596,
         "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
         "owner": "GNOME",
         "repo": "gnome-shell",
         "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
-        "type": "github"
+        "type": "gitlab"
       },
       "original": {
+        "host": "gitlab.gnome.org",
         "owner": "GNOME",
+        "ref": "gnome-49",
         "repo": "gnome-shell",
-        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
+        "type": "gitlab"
-        "type": "github"
       }
     },
     "home-manager": {
@@ -380,11 +344,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780099287,
+        "lastModified": 1773810247,
-        "narHash": "sha256-efIPwVGtIWIjWcznhaop6XN6HxnOL8800hF6CBNvlqQ=",
+        "narHash": "sha256-6Vz1Thy/1s7z+Rq5OfkWOBAdV4eD+OrvDs10yH6xJzQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7d8127d308c3fb9664f7e643eec944be74ebb37d",
+        "rev": "d47357a4c806d18a3e853ad2699eaec3c01622e7",
         "type": "github"
       },
       "original": {
@@ -396,7 +360,7 @@
     "mcp-hub": {
       "inputs": {
         "flake-parts": "flake-parts",
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_2"
       },
       "locked": {
         "lastModified": 1755841689,
@@ -436,10 +400,10 @@
     "nix-secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1778944969,
+        "lastModified": 1773505989,
-        "narHash": "sha256-wT4WiBUqfeajcaOWvSKmHGKXEGmnDVQsRg0v7NoZW5o=",
+        "narHash": "sha256-zmKDguP5ReYfb2LK3gICP0xVZXnkV7Zt+iq6dFGqLPo=",
         "ref": "main",
-        "rev": "aae027d8de9ae66ea29c9e6a5ff6ea0f4b735261",
+        "rev": "e7472aa92a8bce003fccb310191c45948165a8c3",
         "shallow": true,
         "type": "git",
         "url": "ssh://git@github.com/hektor/nix-secrets"
@@ -453,11 +417,11 @@
     },
     "nixCats": {
       "locked": {
-        "lastModified": 1777273601,
+        "lastModified": 1770584904,
-        "narHash": "sha256-xBUa8Tl9V7IXI+VmLEuDc81La/EhoSn1C3EVSnJ3cfU=",
+        "narHash": "sha256-9Zaz8lbKF2W9pwXZEnbiGsicHdBoU+dHt3Wv3mCJoZ8=",
         "owner": "BirdeeHub",
         "repo": "nixCats-nvim",
-        "rev": "f69ea013e328841a7def7037ed59788a76be8816",
+        "rev": "538fdde784d2909700d97a8ef307783b33a86fb1",
         "type": "github"
       },
       "original": {
@@ -488,15 +452,12 @@
       }
     },
     "nixos-hardware": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_2"
-      },
       "locked": {
-        "lastModified": 1780065812,
+        "lastModified": 1773533765,
-        "narHash": "sha256-SCSLUKBmwlSLGQ8Xbr8PjRFtiHNk0l9ktqkcmqdBkfE=",
+        "narHash": "sha256-qonGfS2lzCgCl59Zl63jF6dIRRpvW3AJooBGMaXjHiY=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "b76b5639c0593e0aeb0b5879ad62d4b30596c144",
+        "rev": "f8e82243fd601afb9f59ad230958bd073795cbfe",
         "type": "github"
       },
       "original": {
@@ -508,40 +469,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1770107345,
+        "lastModified": 1773734432,
-        "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=",
+        "narHash": "sha256-IF5ppUWh6gHGHYDbtVUyhwy/i7D261P7fWD1bPefOsw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "4533d9293756b63904b7238acb84ac8fe4c8c2c4",
+        "rev": "cda48547b432e8d3b18b4180ba07473762ec8558",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1767892417,
-        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
-        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
-      }
-    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1779560665,
-        "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
         "type": "github"
       },
       "original": {
@@ -551,7 +483,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_2": {
       "locked": {
         "lastModified": 1743689281,
         "narHash": "sha256-y7Hg5lwWhEOgflEHRfzSH96BOt26LaYfrYWzZ+VoVdg=",
@@ -579,11 +511,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779766384,
+        "lastModified": 1767810917,
-        "narHash": "sha256-P7Ohnlq8b8b2fU+Sgkrej7LBTM60LBTkHleLuYzmLmU=",
+        "narHash": "sha256-ZKqhk772+v/bujjhla9VABwcvz+hB2IaRyeLT6CFnT0=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "57800b7ab648725ccd33551d01484ee14952ad3f",
+        "rev": "dead29c804adc928d3a69dfe7f9f12d0eec1f1a4",
         "type": "github"
       },
       "original": {
@@ -635,11 +567,11 @@
     "plugins-helm-ls-nvim": {
       "flake": false,
       "locked": {
-        "lastModified": 1773934114,
+        "lastModified": 1768584652,
-        "narHash": "sha256-8trqFsA7nTKSdtkiAL0Sa9bXjh5ONtAqN7XNE/B8ukM=",
+        "narHash": "sha256-jnMc87OjURNcqsva0npYgVyUrWc5C6L7yHpNvt9eSmg=",
         "owner": "qvalentin",
         "repo": "helm-ls.nvim",
-        "rev": "20df43509b02a3ce3c6b3eee254d6e2bffa9a370",
+        "rev": "f0b9a1723890971a6d84890b50dbf5f40974ea1b",
         "type": "github"
       },
       "original": {
@@ -715,7 +647,6 @@
     "root": {
       "inputs": {
         "colmena": "colmena",
-        "comin": "comin",
         "disko": "disko",
         "firefox-addons": "firefox-addons",
         "git-hooks": "git-hooks",
@@ -723,7 +654,7 @@
         "nix-secrets": "nix-secrets",
         "nixgl": "nixgl",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs",
         "nvim": "nvim",
         "sops-nix": "sops-nix",
         "stylix": "stylix"
@@ -736,11 +667,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777944972,
+        "lastModified": 1773698643,
-        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
+        "narHash": "sha256-VCiDjE8kNs8uCAK73Ezk1r3fFuc4JepvW07YFqaN968=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
+        "rev": "8237de83e8200d16fe0c4467b02a1c608ff28044",
         "type": "github"
       },
       "original": {
@@ -779,17 +710,18 @@
         ],
         "nur": "nur",
         "systems": "systems_2",
+        "tinted-foot": "tinted-foot",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
         "tinted-tmux": "tinted-tmux",
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1780079634,
+        "lastModified": 1773792048,
-        "narHash": "sha256-VVyCrzwLitvxZGx48FgzvlbLYGQU99GsaQnZmwqZoUo=",
+        "narHash": "sha256-Oy9PCLG3vtflFBWcJd8c/EB3h5RU7ABAIDWn6JrGf6o=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "ca07e0644716a7c13e91c6d92d169fc81889c589",
+        "rev": "3f2f9d307fe58c6abe2a16eb9b62c42d53ef5ee1",
         "type": "github"
       },
       "original": {
@@ -828,6 +760,23 @@
         "type": "github"
       }
     },
+    "tinted-foot": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1726913040,
+        "narHash": "sha256-+eDZPkw7efMNUf3/Pv0EmsidqdwNJ1TaOum6k7lngDQ=",
+        "owner": "tinted-theming",
+        "repo": "tinted-foot",
+        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "tinted-foot",
+        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
+        "type": "github"
+      }
+    },
     "tinted-kitty": {
       "flake": false,
       "locked": {
@@ -847,11 +796,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1777806186,
+        "lastModified": 1767710407,
-        "narHash": "sha256-PDF0/wObw4nIsSBeXVYLsloXOiphXCgIdsrNcVXguKs=",
+        "narHash": "sha256-+W1EB79Jl0/gm4JqmO0Nuc5C7hRdp4vfsV/VdzI+des=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "0c94645546f4f3ddac77a1a5fce54eb95bf50795",
+        "rev": "2800e2b8ac90f678d7e4acebe4fa253f602e05b2",
         "type": "github"
       },
       "original": {
@@ -863,11 +812,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1778379944,
+        "lastModified": 1767489635,
-        "narHash": "sha256-wPDFzMGSlARlw0Sfsn48Q2+jPSfk6N0Ng6BC/d+7Q24=",
+        "narHash": "sha256-e6nnFnWXKBCJjCv4QG4bbcouJ6y3yeT70V9MofL32lU=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "fe0203a198690e71a5ff11e08812a4673de3678d",
+        "rev": "3c32729ccae99be44fe8a125d20be06f8d7d8184",
         "type": "github"
       },
       "original": {
@@ -879,11 +828,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1778378178,
+        "lastModified": 1767488740,
-        "narHash": "sha256-OXPXRIQgGwV77HjYRryOHguh4ALX96jkg+tseLkGgHA=",
+        "narHash": "sha256-wVOj0qyil8m+ouSsVZcNjl5ZR+1GdOOAooAatQXHbuU=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "9cd816033ff969415b190722cddf134e78a5665f",
+        "rev": "11abb0b282ad3786a2aae088d3a01c60916f2e40",
         "type": "github"
       },
       "original": {
@@ -891,24 +840,6 @@
         "repo": "base16-zed",
         "type": "github"
       }
-    },
-    "treefmt-nix": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      },
-      "locked": {
-        "lastModified": 1770228511,
-        "narHash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "337a4fe074be1042a35086f15481d763b8ddc0e7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -3,6 +3,10 @@
     nixpkgs = {
       url = "github:nixos/nixpkgs/nixos-unstable";
     };
+    stylix = {
+      url = "github:danth/stylix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     nixos-hardware = {
       url = "github:NixOS/nixos-hardware/master";
     };
@@ -18,22 +22,6 @@
       url = "git+ssh://git@github.com/hektor/nix-secrets?shallow=1&ref=main";
       flake = false;
     };
-    colmena = {
-      url = "github:zhaofengli/colmena";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    comin = {
-      url = "github:nlewo/comin";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    git-hooks = {
-      url = "github:cachix/git-hooks.nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    stylix = {
-      url = "github:danth/stylix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -50,15 +38,27 @@
       url = "path:./dots/.config/nvim";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    colmena = {
+      url = "github:zhaofengli/colmena";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    git-hooks = {
+      url = "github:cachix/git-hooks.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    work-cli = {
+      url = "path:/home/hektor/test-gsd";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
     {
       self,
       nixpkgs,
-      git-hooks,
       home-manager,
       nixgl,
+      git-hooks,
       ...
     }@inputs:
     let
@@ -74,16 +74,16 @@
       };
     in
     {
+      nix.nixPath = [
+        "nixpkgs=${inputs.nixpkgs}"
+      ]; # <https://github.com/nix-community/nixd/blob/main/nixd/docs/configuration.md>
       nixosConfigurations =
         (lib.genAttrs hostDirNames (
           host:
           nixpkgs.lib.nixosSystem {
             modules = [
               ./hosts/${host}
-              {
+              { nixpkgs.hostPlatform = import ./hosts/${host}/system.nix; }
-                nixpkgs.hostPlatform = (myUtils.hostMeta ./hosts/${host}).system;
-                host.name = host;
-              }
             ];
             specialArgs = {
               inherit
@@ -142,20 +142,18 @@
           };
           modules = [ ./home/hosts/work ];
           extraSpecialArgs = {
-            osConfig = null;
             inherit
               inputs
               outputs
               dotsPath
               myUtils
               ;
+            hasSopsHmModule = false; # TODO: set to true after re-encrypting secrets for work host's age key
           };
         };
       };
 
-      apps.${system}.colmena = inputs.colmena.apps.${system}.default // {
+      apps.${system}.colmena = inputs.colmena.apps.${system}.default;
-        meta.description = "colmena";
-      };
 
       colmenaHive = import ./deploy/colmena.nix {
         inherit

home/hosts/andromache/default.nix

@@ -8,6 +8,26 @@
 {
   imports = [
     ../../modules
+    ../../modules/3d
+    ../../modules/ai-tools
+    ../../modules/anki
+    ../../modules/audio
+    ../../modules/browser
+    ../../modules/cloud
+    ../../modules/comms
+    ../../modules/desktop/niri
+    ../../modules/direnv
+    ../../modules/git
+    ../../modules/k8s/k9s.nix
+    ../../modules/keepassxc
+    ../../modules/music
+    ../../modules/nvim
+    ../../modules/pandoc
+    ../../modules/photography
+    ../../modules/shell
+    ../../modules/ssh
+    ../../modules/taskwarrior
+    ../../modules/terminal
   ];
 
   home = {
@@ -23,39 +43,13 @@
     printing.enable = true;
     modeling.enable = true;
   };
-  ai-tools = {
+  ai-tools.opencode.enable = true;
-    claude-code.enable = true;
-    opencode.enable = true;
-  };
-  desktop.niri.enable = true;
-  browser.enable = true;
   browser.primary = "librewolf";
   cloud.hetzner.enable = true;
   comms.signal.enable = true;
-  git.enable = true;
   git.github.enable = true;
-  shell = {
+  shell.bash.aliases.lang-js = true;
-    enable = true;
+  shell.bash.addBinToPath = true;
-    bash.aliases.lang-js = true;
-    bash.addBinToPath = true;
-  };
-  anki.enable = true;
-  k8s.k9s.enable = true;
-  secrets.enable = true;
-  taskwarrior.enable = true;
-  audio.enable = true;
-  ssh.enable = true;
-  music.enable = true;
-  terminal.enable = true;
-  devenv.enable = true;
-  keepassxc.enable = true;
-  direnv.enable = true;
-  nvim.enable = true;
-  pandoc.enable = true;
-  photography.enable = true;
-  torrenting.enable = true;
-  my.yubikey.enable = true;
-  zk.enable = true;
 
   programs = {
     home-manager.enable = true;

home/hosts/astyanax/default.nix

@@ -7,6 +7,26 @@
 {
   imports = [
     ../../modules
+    ../../modules/3d
+    ../../modules/ai-tools
+    ../../modules/anki
+    ../../modules/audio
+    ../../modules/browser
+    ../../modules/cloud
+    ../../modules/comms
+    ../../modules/desktop/niri
+    ../../modules/direnv
+    ../../modules/git
+    ../../modules/k8s/k9s.nix
+    ../../modules/keepassxc
+    ../../modules/music
+    ../../modules/nfc
+    ../../modules/nvim
+    ../../modules/pandoc
+    ../../modules/shell
+    ../../modules/ssh
+    ../../modules/taskwarrior
+    ../../modules/terminal
   ];
 
   home = {
@@ -15,44 +35,17 @@
     homeDirectory = "/home/${config.host.username}";
   };
 
-  xdg.userDirs = {
+  xdg.userDirs.createDirectories = false;
-    enable = false;
+  xdg.userDirs.download = "${config.home.homeDirectory}/dl";
-    createDirectories = false;
-  };
 
   modules."3d".printing.enable = true;
-  ai-tools = {
+  ai-tools.opencode.enable = true;
-    claude-code.enable = true;
-    opencode.enable = true;
-  };
-  anki.enable = true;
-  audio.enable = true;
-  browser.enable = true;
   browser.primary = "librewolf";
   cloud.hetzner.enable = true;
   comms.signal.enable = true;
-  desktop.niri.enable = true;
-  devenv.enable = true;
-  direnv.enable = true;
-  git.enable = true;
   git.github.enable = true;
-  k8s.k9s.enable = true;
+  shell.bash.aliases.lang-js = true;
-  keepassxc.enable = true;
+  shell.bash.addBinToPath = true;
-  music.enable = true;
-  my.yubikey.enable = true;
-  nfc.enable = true;
-  nvim.enable = true;
-  pandoc.enable = true;
-  secrets.enable = true;
-  shell = {
-    enable = true;
-    bash.aliases.lang-js = true;
-    bash.addBinToPath = true;
-  };
-  ssh.enable = true;
-  taskwarrior.enable = true;
-  terminal.enable = true;
-  reference-manager.enable = true;
 
   programs = {
     home-manager.enable = true;

home/hosts/packages.nix

@@ -3,9 +3,7 @@
 with pkgs;
 [
   bat
-  curl
   entr
-  fd
   feh
   fzf
   htop
@@ -15,6 +13,7 @@ with pkgs;
   parallel
   pass
   ripgrep
+  silver-searcher
   sops
   tldr
   tree

home/hosts/work/default.nix

@@ -5,29 +5,55 @@
   ...
 }:
 
+let
+  username = "hektor";
+in
 {
   imports = [
-    inputs.sops-nix.homeManagerModules.sops
+    # inputs.sops-nix.homeManagerModules.sops # TODO: re-enable after re-encrypting secrets for this host's age key
-    inputs.stylix.homeModules.stylix
     ../../modules
+    ../../modules/ai-tools
+    ../../modules/work-cli
+    ../../modules/anki
+    ../../modules/browser
+    ../../modules/bruno
+    ../../modules/cloud
+    ../../modules/comms
+    ../../modules/database
+    ../../modules/dconf
+    ../../modules/desktop/niri
+    ../../modules/direnv
+    ../../modules/docker
+    ../../modules/git
+    ../../modules/go
+    ../../modules/infra
+    ../../modules/k8s
+    ../../modules/k8s/k9s.nix
+    ../../modules/keepassxc
+    ../../modules/music
+    ../../modules/networking
+    ../../modules/nodejs
+    ../../modules/nvim
+    ../../modules/pandoc
+    ../../modules/secrets
+    ../../modules/shell
+    ../../modules/stylix
+    ../../modules/taskwarrior
+    ../../modules/ticketing
+    ../../modules/terminal
+    ../../modules/vscode
   ];
 
-  sops.age.keyFile = "${config.home.homeDirectory}/.config/sops/age/keys.txt";
+  # sops.age.keyFile = "${config.home.homeDirectory}/.config/sops/age/keys.txt"; # TODO: re-enable with sops module
 
   nixpkgs.config.allowUnfree = true;
 
-  xdg = {
+  xdg.systemDirs.config = [ "/etc/xdg" ];
-    systemDirs.config = [ "/etc/xdg" ];
-    userDirs = {
-      createDirectories = false;
-      download = "${config.home.homeDirectory}/dl";
-    };
-  };
 
   home = {
     stateVersion = "25.05";
-    username = "hektor";
+    inherit username;
-    homeDirectory = "/home/${config.home.username}";
+    homeDirectory = "/home/${username}";
   };
 
   targets.genericLinux.nixGL = {
@@ -35,56 +61,38 @@
     defaultWrapper = "mesa";
   };
 
+  browser.primary = "firefox";
+  browser.secondary = "chromium";
+  cloud.azure.enable = true;
+  comms.signal.enable = true;
+  comms.teams.enable = true;
   ai-tools = {
     claude-code.enable = true;
     tirith.enable = true;
     opencode.enable = true;
   };
-  anki.enable = true;
+  database.mssql.enable = true;
-  browser = {
+  database.postgresql.enable = true;
-    enable = true;
+  git.github.enable = true;
-    primary = "firefox";
+  git.gitlab.enable = true;
-    secondary = "chromium";
-  };
-  bruno.enable = true;
-  cloud.azure.enable = true;
-  comms.signal.enable = true;
-  comms.teams.enable = true;
-  database = {
-    mssql.enable = true;
-    postgresql.enable = true;
-    redis.enable = true;
-  };
-  desktop.niri.enable = true;
-  devenv.enable = true;
-  direnv.enable = true;
-  docker.enable = true;
-  git = {
-    enable = true;
-    github.enable = true;
-    gitlab.enable = true;
-  };
-  go.enable = true;
-  k8s.enable = true;
-  keepassxc.enable = true;
-  music.enable = true;
-  my.dconf.enable = true;
-  my.stylix.enable = true;
-  nvim.enable = true;
-  pandoc.enable = true;
-  shell.enable = true;
-  taskwarrior.enable = true;
-  terminal.enable = true;
-  infra.enable = true;
-  nodejs.enable = true;
-  secrets.enable = true;
   secrets.vault.enable = true;
-  ticketing.enable = true;
-  vscode.enable = true;
 
-  services.home-manager.autoUpgrade = {
+  programs.work-cli = {
     enable = true;
-    frequency = "weekly";
+    gitlab = {
+      url = "https://gitlab.com";
+      project = "";
+      group = "";
+    };
+    jira = {
+      enable = true;
+      url = "";
+      projectKey = "";
+    };
+    vault = {
+      enable = true;
+      url = "";
+    };
   };
 
   programs = {

home/hosts/work/packages.local.nix

@@ -0,0 +1,43 @@
+{ pkgs, ... }:
+
+with pkgs;
+let
+  nodejs = [
+    biome
+    tsx
+  ];
+  oasdiff = buildGoModule rec {
+    pname = "oasdiff";
+    version = "1.11.10";
+    src = fetchFromGitHub {
+      owner = "oasdiff";
+      repo = "oasdiff";
+      rev = "v${version}";
+      hash = "sha256-/Pk2mKzdYKl51RvEkm5yRDMHz2vISgoHlnel+llDJus=";
+    };
+    vendorHash = "sha256-ZKs9Ai8Q9Yj4V9GIufYRh9cl3ZUKnSehwpaodyGXtfg=";
+  };
+  misc = [
+    curl
+    flameshot
+    fzf-git-sh
+    git-machete
+    gitlab-ci-local
+    go
+    lua
+    ngrok
+    oasdiff
+    responder
+    rustlings
+    sleuthkit
+    vault-bin
+    xclip
+    xmage
+    # xwayland-satellite
+    # (python314.withPackages (ppkgs: [
+    #   ppkgs.plyer
+    #   ppkgs.dbus-python
+    # ]))
+  ];
+in
+misc ++ nodejs

home/modules/ai-tools/claude-code.nix

@@ -1,60 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.ai-tools.claude-code;
-  rtk-version = "0.18.1";
-in
-{
-  options.ai-tools.claude-code.enable = lib.mkEnableOption "claude code with rtk and ccline";
-
-  config = lib.mkIf cfg.enable {
-    programs.claude-code.enable = true;
-
-    home.packages = with pkgs; [
-      (stdenv.mkDerivation {
-        name = "ccline";
-        src = fetchurl {
-          url = "https://github.com/Haleclipse/CCometixLine/releases/download/v1.0.8/ccline-linux-x64.tar.gz";
-          hash = "sha256-Joe3Dd6uSMGi66QT6xr2oY/Tz8rA5RuKa6ckBVJIzI0=";
-        };
-        unpackPhase = "tar xzf $src";
-        installPhase = ''
-          mkdir -p $out/bin
-          cp ccline $out/bin/
-          chmod +x $out/bin/ccline
-        '';
-        meta = {
-          description = "CCometixLine Linux x64 CLI (Claude Code statusline)";
-          homepage = "https://github.com/Haleclipse/CCometixLine";
-          license = lib.licenses.mit;
-          platforms = [ "x86_64-linux" ];
-        };
-      })
-      (stdenv.mkDerivation {
-        name = "rtk-${rtk-version}";
-        version = rtk-version;
-        src = fetchurl {
-          url = "https://github.com/rtk-ai/rtk/releases/download/v${rtk-version}/rtk-x86_64-unknown-linux-gnu.tar.gz";
-          hash = "sha256-XoTia5K8b00OzcKYCufwx8ApkAS31DxUCpGSU0jFs2Q=";
-        };
-        unpackPhase = "tar xzf $src";
-        installPhase = ''
-          mkdir -p $out/bin
-          cp rtk $out/bin/
-          chmod +x $out/bin/rtk
-        '';
-        meta = {
-          description = "RTK - AI coding tool enhancer";
-          homepage = "https://www.rtk-ai.app";
-          license = lib.licenses.mit;
-          platforms = [ "x86_64-linux" ];
-        };
-      })
-      mcp-nixos
-    ];
-  };
-}

home/modules/ai-tools/default.nix

@@ -1,8 +1,116 @@
 {
-  imports = [
+  lib,
-    ./claude-code.nix
+  config,
-    ./opencode.nix
+  pkgs,
-    ./skills.nix
+  ...
-    ./tirith.nix
+}:
+let
+  cfg = config.ai-tools;
+  rtk-version = "0.18.1";
+in
+{
+  options.ai-tools = {
+    claude-code.enable = lib.mkEnableOption "claude code with rtk and ccline";
+    tirith.enable = lib.mkEnableOption "tirith shell security guard";
+    opencode.enable = lib.mkEnableOption "opencode";
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.claude-code.enable {
+      home.packages = with pkgs; [
+        claude-code
+        (pkgs.stdenv.mkDerivation {
+          name = "ccline";
+          src = pkgs.fetchurl {
+            url = "https://github.com/Haleclipse/CCometixLine/releases/download/v1.0.8/ccline-linux-x64.tar.gz";
+            hash = "sha256-Joe3Dd6uSMGi66QT6xr2oY/Tz8rA5RuKa6ckBVJIzI0=";
+          };
+
+          unpackPhase = ''
+            tar xzf $src
+          '';
+
+          installPhase = ''
+            mkdir -p $out/bin
+            cp ccline $out/bin/
+            chmod +x $out/bin/ccline
+          '';
+
+          meta = with pkgs.lib; {
+            description = "CCometixLine Linux x64 CLI (Claude Code statusline)";
+            homepage = "https://github.com/Haleclipse/CCometixLine";
+            license = licenses.mit;
+            platforms = [ "x86_64-linux" ];
+          };
+        })
+        (pkgs.stdenv.mkDerivation {
+          name = "rtk-${rtk-version}";
+          version = rtk-version;
+          src = pkgs.fetchurl {
+            url = "https://github.com/rtk-ai/rtk/releases/download/v${rtk-version}/rtk-x86_64-unknown-linux-gnu.tar.gz";
+            hash = "sha256-XoTia5K8b00OzcKYCufwx8ApkAS31DxUCpGSU0jFs2Q=";
+          };
+
+          unpackPhase = ''
+            tar xzf $src
+          '';
+
+          installPhase = ''
+            mkdir -p $out/bin
+            cp rtk $out/bin/
+            chmod +x $out/bin/rtk
+          '';
+
+          meta = with pkgs.lib; {
+            description = "RTK - AI coding tool enhancer";
+            homepage = "https://www.rtk-ai.app";
+            license = licenses.mit;
+            platforms = [ "x86_64-linux" ];
+          };
+        })
+        mcp-nixos
+      ];
+    })
+    (lib.mkIf cfg.tirith.enable {
+      home.packages = with pkgs; [
+        tirith
+      ];
+    })
+    (lib.mkIf (cfg.tirith.enable && cfg.claude-code.enable) {
+      home.file.".claude/hooks/tirith-check.py" = {
+        source = ./tirith-check.py;
+        executable = true;
+      };
+
+      home.activation.tirith-claude-code = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+        ${pkgs.tirith}/bin/tirith setup claude-code --with-mcp --scope user --force 2>/dev/null || true
+      '';
+    })
+    (lib.mkIf cfg.opencode.enable {
+      home.packages = with pkgs; [
+        opencode
+      ];
+      home.file.".config/opencode/opencode.json".text = builtins.toJSON {
+        "$schema" = "https://opencode.ai/config.json";
+        permission = {
+          external_directory = {
+            "/run/secrets/" = "deny";
+            "~/.config/sops/age/keys.txt" = "deny";
+            "~/.ssh/id_rsa" = "deny";
+            "~/.ssh/id_ed25519" = "deny";
+            "~/.ssh/id_ecdsa" = "deny";
+            "~/.ssh/id_dsa" = "deny";
+            "/etc/ssh/ssh_host_rsa_key" = "deny";
+            "/etc/ssh/ssh_host_ed25519_key" = "deny";
+            "/etc/ssh/ssh_host_ecdsa_key" = "deny";
+            "/etc/ssh/ssh_host_dsa_key" = "deny";
+          };
+          command = {
+            sops = "deny";
+          };
+        };
+        plugin = [ "@mohak34/opencode-notifier@latest" ];
+      };
+    })
   ];
 }

home/modules/ai-tools/opencode.nix

@@ -1,40 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.ai-tools.opencode;
-in
-{
-  options.ai-tools.opencode = {
-    enable = lib.mkEnableOption "opencode";
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.packages = [ pkgs.opencode ];
-
-    home.file.".config/opencode/opencode.json".text = builtins.toJSON {
-      "$schema" = "https://opencode.ai/config.json";
-      permission = {
-        external_directory = {
-          "/run/secrets/" = "deny";
-          "~/.config/sops/age/keys.txt" = "deny";
-          "~/.ssh/id_rsa" = "deny";
-          "~/.ssh/id_ed25519" = "deny";
-          "~/.ssh/id_ecdsa" = "deny";
-          "~/.ssh/id_dsa" = "deny";
-          "/etc/ssh/ssh_host_rsa_key" = "deny";
-          "/etc/ssh/ssh_host_ed25519_key" = "deny";
-          "/etc/ssh/ssh_host_ecdsa_key" = "deny";
-          "/etc/ssh/ssh_host_dsa_key" = "deny";
-        };
-        command = {
-          sops = "deny";
-        };
-      };
-      plugin = [ "@mohak34/opencode-notifier@latest" ];
-    };
-  };
-}

home/modules/ai-tools/skills.nix

@@ -1,49 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.ai-tools.claude-code;
-
-  skillType = lib.types.submodule {
-    options = {
-      owner = lib.mkOption { type = lib.types.str; };
-      repo = lib.mkOption { type = lib.types.str; };
-      rev = lib.mkOption { type = lib.types.str; };
-      hash = lib.mkOption { type = lib.types.str; };
-      skill = lib.mkOption { type = lib.types.str; };
-    };
-  };
-
-  fetchSkill =
-    skill:
-    let
-      src = pkgs.fetchFromGitHub {
-        inherit (skill)
-          owner
-          repo
-          rev
-          hash
-          ;
-      };
-    in
-    {
-      name = ".claude/skills/${skill.skill}";
-      value = {
-        source = "${src}/${skill.skill}";
-        recursive = true;
-      };
-    };
-in
-{
-  options.ai-tools.claude-code.skills = lib.mkOption {
-    type = lib.types.listOf skillType;
-    default = [ ];
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.file = builtins.listToAttrs (map fetchSkill cfg.skills);
-  };
-}

home/modules/ai-tools/tirith.nix

@@ -1,30 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.ai-tools.tirith;
-in
-{
-  options.ai-tools.tirith = {
-    enable = lib.mkEnableOption "tirith";
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfg.enable {
-      home.packages = [ pkgs.tirith ];
-    })
-    (lib.mkIf (cfg.enable && config.ai-tools.claude-code.enable) {
-      home.file.".claude/hooks/tirith-check.py" = {
-        source = ./tirith-check.py;
-        executable = true;
-      };
-
-      home.activation.tirith-claude-code = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
-        ${pkgs.tirith}/bin/tirith setup claude-code --with-mcp --scope user --force 2>/dev/null || true
-      '';
-    })
-  ];
-}

home/modules/anki/default.nix

@@ -4,55 +4,28 @@
   pkgs,
   myUtils,
   osConfig ? null,
-  inputs ? null,
   ...
 }:
 
 let
-  cfg = config.anki;
   sops = myUtils.sopsAvailability config osConfig;
-  standalone = osConfig == null;
 in
 {
-  options.anki.enable = lib.mkEnableOption "Anki";
+  warnings = lib.optional (
+    !sops.available && config.programs.anki.enable
+  ) "anki is enabled but sops secrets are not available. anki sync will not be configured.";
 
-  config = lib.mkIf cfg.enable (
+  programs.anki = {
-    lib.optionalAttrs standalone {
+    enable = true;
-      sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" {
+    package = config.nixgl.wrap pkgs.anki;
-        anki = [
+    addons = with pkgs.ankiAddons; [
-          "sync-user"
+      anki-connect
-          "sync-key"
+      puppy-reinforcement
-        ];
+      review-heatmap
-      };
+    ];
-    }
+    profiles."User 1".sync = lib.mkIf sops.available {
-    // {
+      usernameFile = "${sops.secrets."anki-sync-user".path}";
-      warnings = lib.optional (
+      keyFile = "${sops.secrets."anki-sync-key".path}";
-        !sops.available
+    };
-      ) "anki is enabled but sops secrets are not available. anki sync will not be configured.";
+  };
-
-      programs.anki = {
-        enable = true;
-        package = config.nixgl.wrap pkgs.anki;
-        addons = with pkgs.ankiAddons; [
-          (anki-connect.withConfig {
-            # https://git.sr.ht/~foosoft/anki-connect/tree/master/item/plugin/config.json
-            config = {
-              apiKey = null;
-              apiLogPath = null;
-              webBindAddress = "127.0.0.1";
-              webBindPort = 8765;
-              webCorsOriginList = [ "http://localhost" ];
-              ignoreOriginList = [ ];
-            };
-          })
-          puppy-reinforcement
-          review-heatmap
-        ];
-        profiles."User 1".sync = lib.mkIf sops.available {
-          usernameFile = "${sops.secrets."anki/sync-user".path}";
-          keyFile = "${sops.secrets."anki/sync-key".path}";
-        };
-      };
-    }
-  );
 }

home/modules/audio/default.nix

@@ -1,19 +1,7 @@
-{
+{ osConfig, pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  osConfig,
-  ...
-}:
 
-let
-  cfg = config.audio;
-in
 {
-  options.audio.enable = lib.mkEnableOption "audio";
+  home.packages = with pkgs; [ pulsemixer ];
 
-  config = lib.mkIf cfg.enable {
+  services.mpris-proxy.enable = osConfig.hardware.bluetooth.enable or false;
-    home.packages = with pkgs; [ pulsemixer ];
-    services.mpris-proxy.enable = osConfig.hardware.bluetooth.enable or false;
-  };
 }

home/modules/browser/default.nix

@@ -1,19 +1,7 @@
-{
+{ lib, ... }:
-  config,
-  lib,
-  ...
-}:
 
 {
-  imports = [
-    ./firefox.nix
-    ./librewolf.nix
-    ./chromium.nix
-  ];
-
   options.browser = {
-    enable = lib.mkEnableOption "browser";
-
     primary = lib.mkOption {
       type = lib.types.enum [
         "firefox"
@@ -35,7 +23,9 @@
     };
   };
 
-  config = lib.mkIf config.browser.enable {
+  imports = [
-    home.sessionVariables.BROWSER = config.browser.primary;
+    ./firefox.nix
-  };
+    ./librewolf.nix
+    ./chromium.nix
+  ];
 }

home/modules/browser/firefox.nix

@@ -10,7 +10,6 @@
   config = lib.mkIf (config.browser.primary == "firefox" || config.browser.secondary == "firefox") {
     programs.firefox = {
       enable = true;
-      configPath = "${config.xdg.configHome}/mozilla/firefox";
     }
     // (import ./firefox-base.nix {
       inherit

home/modules/bruno/default.nix

@@ -1,19 +1,7 @@
-{
+{ config, pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 
-let
-  cfg = config.bruno;
-in
 {
-  options.bruno = {
+  config = {
-    enable = lib.mkEnableOption "Bruno";
-  };
-
-  config = lib.mkIf cfg.enable {
     home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.bruno "--no-sandbox")) ];
   };
 }

home/modules/clipboard/default.nix

@@ -1,21 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.clipboard;
-in
-{
-  options.clipboard = {
-    enable = lib.mkEnableOption "clipboard";
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.packages = with pkgs; [
-      wl-clipboard
-    ];
-  };
-}

home/modules/cloud/default.nix

@@ -3,10 +3,10 @@
 {
   options.cloud = {
     azure = {
-      enable = lib.mkEnableOption "Azure CLI";
+      enable = lib.mkEnableOption "azure CLI";
     };
     hetzner = {
-      enable = lib.mkEnableOption "Hetzner CLI";
+      enable = lib.mkEnableOption "hetzner CLI";
     };
   };
 

home/modules/database/default.nix

@@ -9,18 +9,14 @@
   options.database = {
     mssql.enable = lib.mkEnableOption "MSSQL";
     postgresql.enable = lib.mkEnableOption "PostgreSQL";
-    redis.enable = lib.mkEnableOption "Redis";
   };
 
   config = lib.mkMerge [
     (lib.mkIf config.database.mssql.enable {
-      home.packages = with pkgs; [ (config.nixgl.wrap dbeaver-bin) ];
+      home.packages = [ (config.nixgl.wrap pkgs.dbeaver-bin) ];
     })
     (lib.mkIf config.database.postgresql.enable {
-      home.packages = with pkgs; [ (config.nixgl.wrap pgadmin4-desktopmode) ];
+      home.packages = [ (config.nixgl.wrap pkgs.pgadmin4-desktopmode) ];
-    })
-    (lib.mkIf config.database.postgresql.enable {
-      home.packages = with pkgs; [ redis ];
     })
   ];
 }

home/modules/dconf/default.nix

@@ -1,137 +1,124 @@
-{
+{ config, pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 
 let
-  cfg = config.my.dconf;
   terminal = "kitty";
   browser = config.browser.primary;
-  font = "${config.stylix.fonts.monospace.name} ${toString config.stylix.fonts.sizes.applications}";
 in
 {
-  options.my.dconf = {
+  dconf.settings = {
-    enable = lib.mkEnableOption "dconf";
+    "org/gnome/desktop/background" = {
-  };
+      color-shading-type = "solid";
-
+      picture-options = "zoom";
-  config = lib.mkIf cfg.enable {
+      picture-uri = "none";
-    dconf.settings = {
+      picture-uri-dark = "none";
-      "org/gnome/desktop/background" = {
+      primary-color = "#555555";
-        color-shading-type = "solid";
+      secondary-color = "#555555";
-        picture-options = "zoom";
+      show-desktop-icons = false;
-        picture-uri = "none";
-        picture-uri-dark = "none";
-        primary-color = "#555555";
-        secondary-color = "#555555";
-        show-desktop-icons = false;
-      };
-
-      "org/gnome/desktop/default-applications/office/calendar" = {
-        exec = "${browser} https://calendar.proton.me";
-        needs-term = false;
-      };
-
-      "org/gnome/desktop/default-applications/office/tasks" = {
-        exec = "task";
-        needs-term = true;
-      };
-
-      "org/gnome/desktop/default-applications/terminal" = {
-        exec = terminal;
-        exec-arg = "";
-      };
-
-      "org/gnome/desktop/input-sources" = {
-        xkb-options = [ "caps:none" ];
-      };
-
-      "org/gnome/desktop/interface" = {
-        clock-format = "24h";
-        clock-show-weekday = true;
-        color-scheme = "prefer-dark";
-        enable-hot-corners = false;
-        # font-name = font;
-        locate-pointer = true;
-        monospace-font-name = font;
-      };
-
-      "org/gnome/desktop/wm/keybindings" = {
-        close = [ "<Shift><Super>Delete" ];
-        minimize = [ "<Super>h" ];
-        move-to-monitor-down = [ "<Super><Shift>Down" ];
-        move-to-monitor-left = [ "<Super><Shift>Left" ];
-        move-to-monitor-right = [ "<Super><Shift>Right" ];
-        move-to-monitor-up = [ "<Super><Shift>Up" ];
-        move-to-workspace-1 = [ "<Super><Shift>a" ];
-        move-to-workspace-2 = [ "<Super><Shift>s" ];
-        move-to-workspace-3 = [ "<Super><Shift>d" ];
-        move-to-workspace-4 = [ "<Super><Shift>f" ];
-        move-to-workspace-5 = [ "<Super><Shift>g" ];
-        switch-applications = [ "<Super>j" ];
-        switch-applications-backward = [ "<Super>k" ];
-        switch-to-workspace-1 = [ "<Super>a" ];
-        switch-to-workspace-2 = [ "<Super>s" ];
-        switch-to-workspace-3 = [ "<Super>d" ];
-        switch-to-workspace-4 = [ "<Super>f" ];
-        switch-to-workspace-5 = [ "<Super>g" ];
-      };
-
-      "org/gnome/desktop/wm/preferences" = {
-        num-workspaces = 5;
-        workspace-names = [
-          "sh"
-          "www"
-          "dev"
-          "info"
-          "etc"
-        ];
-      };
-
-      "org/gnome/mutter" = {
-        center-new-windows = true;
-        dynamic-workspaces = false;
-      };
-
-      "org/gnome/settings-daemon/plugins/color" = {
-        night-light-enabled = true;
-        night-light-schedule-automatic = true;
-      };
-
-      "org/gnome/settings-daemon/plugins/media-keys" = {
-        custom-keybindings = [
-          "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/"
-          "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1/"
-        ];
-      };
-
-      "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0" = {
-        binding = "Print";
-        command = "flameshot gui";
-        name = "flameshot";
-      };
-
-      "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1" = {
-        binding = "<Super>Return";
-        command = terminal;
-        name = "Kitty";
-      };
-
-      "org/gnome/settings-daemon/plugins/power" = {
-        power-button-action = "suspend";
-      };
-
-      "org/gnome/shell/app-switcher" = {
-        current-workspace-only = true;
-      };
-
-      "org/gnome/shell/keybindings" = {
-        toggle-application-view = [ "<Super>p" ];
-        toggle-quick-settings = [ ];
-      };
     };
 
-    home.packages = with pkgs; [ dconf2nix ];
+    "org/gnome/desktop/default-applications/office/calendar" = {
+      exec = "${browser} https://calendar.proton.me";
+      needs-term = false;
+    };
+
+    "org/gnome/desktop/default-applications/office/tasks" = {
+      exec = "task";
+      needs-term = true;
+    };
+
+    "org/gnome/desktop/default-applications/terminal" = {
+      exec = terminal;
+      exec-arg = "";
+    };
+
+    "org/gnome/desktop/input-sources" = {
+      xkb-options = [ "caps:none" ];
+    };
+
+    "org/gnome/desktop/interface" = {
+      clock-format = "24h";
+      clock-show-weekday = true;
+      color-scheme = "prefer-dark";
+      enable-hot-corners = false;
+      font-name = "Iosevka Term SS08 12";
+      locate-pointer = true;
+      monospace-font-name = "Iosevka Term SS08 12";
+    };
+
+    "org/gnome/desktop/wm/keybindings" = {
+      close = [ "<Shift><Super>Delete" ];
+      minimize = [ "<Super>h" ];
+      move-to-monitor-down = [ "<Super><Shift>Down" ];
+      move-to-monitor-left = [ "<Super><Shift>Left" ];
+      move-to-monitor-right = [ "<Super><Shift>Right" ];
+      move-to-monitor-up = [ "<Super><Shift>Up" ];
+      move-to-workspace-1 = [ "<Super><Shift>a" ];
+      move-to-workspace-2 = [ "<Super><Shift>s" ];
+      move-to-workspace-3 = [ "<Super><Shift>d" ];
+      move-to-workspace-4 = [ "<Super><Shift>f" ];
+      move-to-workspace-5 = [ "<Super><Shift>g" ];
+      switch-applications = [ "<Super>j" ];
+      switch-applications-backward = [ "<Super>k" ];
+      switch-to-workspace-1 = [ "<Super>a" ];
+      switch-to-workspace-2 = [ "<Super>s" ];
+      switch-to-workspace-3 = [ "<Super>d" ];
+      switch-to-workspace-4 = [ "<Super>f" ];
+      switch-to-workspace-5 = [ "<Super>g" ];
+    };
+
+    "org/gnome/desktop/wm/preferences" = {
+      num-workspaces = 5;
+      workspace-names = [
+        "sh"
+        "www"
+        "dev"
+        "info"
+        "etc"
+      ];
+    };
+
+    "org/gnome/mutter" = {
+      center-new-windows = true;
+      dynamic-workspaces = false;
+    };
+
+    "org/gnome/settings-daemon/plugins/color" = {
+      night-light-enabled = true;
+      night-light-schedule-automatic = true;
+    };
+
+    "org/gnome/settings-daemon/plugins/media-keys" = {
+      custom-keybindings = [
+        "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/"
+        "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1/"
+      ];
+    };
+
+    "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0" = {
+      binding = "Print";
+      command = "flameshot gui";
+      name = "flameshot";
+    };
+
+    "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1" = {
+      binding = "<Super>Return";
+      command = terminal;
+      name = "Kitty";
+    };
+
+    "org/gnome/settings-daemon/plugins/power" = {
+      power-button-action = "suspend";
+    };
+
+    "org/gnome/shell/app-switcher" = {
+      current-workspace-only = true;
+    };
+
+    "org/gnome/shell/keybindings" = {
+      toggle-application-view = [ "<Super>p" ];
+      toggle-quick-settings = [ ];
+    };
   };
+
+  home.packages = with pkgs; [ dconf2nix ];
 }

home/modules/default.nix

@@ -6,39 +6,25 @@
 }:
 
 {
-  imports =
+  options.nixgl.wrap = lib.mkOption {
-    let
+    type = lib.types.functionTo lib.types.package;
-      dirs = lib.attrNames (lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./.));
+    default = if config.lib ? nixGL then config.lib.nixGL.wrap else lib.id;
-      hasDef = name: builtins.pathExists ./${name}/default.nix;
+    readOnly = true;
-    in
+  };
-    map (name: ./${name}) (builtins.filter hasDef dirs);
 
-  options = {
+  options.wrapApp = lib.mkOption {
-    host.username = lib.mkOption {
+    type = lib.types.raw;
-      type = lib.types.str;
+    default =
-      default = config.home.username;
+      pkg: flags:
-    };
+      if config.lib ? nixGL then
-
+        pkg.overrideAttrs (old: {
-    nixgl.wrap = lib.mkOption {
+          nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.makeWrapper ];
-      type = lib.types.functionTo lib.types.package;
+          postInstall = (old.postInstall or "") + ''
-      default = if config.lib ? nixGL then config.lib.nixGL.wrap else lib.id;
+            wrapProgram $out/bin/${pkg.meta.mainProgram} --add-flags "${flags}"
-      readOnly = true;
+          '';
-    };
+        })
-
+      else
-    wrapApp = lib.mkOption {
+        pkg;
-      type = lib.types.raw;
+    readOnly = true;
-      default =
-        pkg: flags:
-        if config.lib ? nixGL then
-          pkg.overrideAttrs (old: {
-            nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.makeWrapper ];
-            postInstall = (old.postInstall or "") + ''
-              wrapProgram $out/bin/${pkg.meta.mainProgram} --add-flags "${flags}"
-            '';
-          })
-        else
-          pkg;
-      readOnly = true;
-    };
   };
 }

home/modules/desktop/default.nix

@@ -1,5 +0,0 @@
-{ ... }:
-
-{
-  imports = [ ./niri ];
-}

home/modules/desktop/niri/config.kdl

@@ -179,5 +179,4 @@ binds {
     Alt+Print  { screenshot-window; }
 
     Mod+Shift+Delete { quit; }
-
 }

home/modules/desktop/niri/default.nix

@@ -1,71 +1,26 @@
-{
+{ pkgs, ... }:
-  lib,
-  pkgs,
-  config,
-  ...
-}:
 
 {
   imports = [
-    ../../clipboard
     ../../fuzzel
     ../../mako
     ../../shikane
     ../../waybar
   ];
 
-  options.desktop.niri.enable = lib.mkEnableOption "niri desktop";
+  home = {
+    file.".config/niri/config.kdl".source = ./config.kdl;
+    packages = with pkgs; [
+      brightnessctl
+      wl-clipboard
+      wlsunset
+    ];
+  };
 
-  config = lib.mkIf config.desktop.niri.enable {
+  services.gammastep = {
-    clipboard.enable = lib.mkDefault true;
+    enable = true;
-    fuzzel.enable = lib.mkDefault true;
+    provider = "manual";
-    mako.enable = lib.mkDefault true;
+    latitude = 51.05;
-    shikane.enable = lib.mkDefault true;
+    longitude = 3.71667;
-    waybar.enable = lib.mkDefault true;
-
-    home = {
-      file.".config/niri/config.kdl".source = ./config.kdl;
-      packages = with pkgs; [
-        brightnessctl
-        wlsunset
-      ];
-    };
-
-    services.gammastep = {
-      enable = true;
-      provider = "manual";
-      latitude = 51.05;
-      longitude = 3.71667;
-    };
-
-    xdg.configFile."electron-flags.conf".text = ''
-      --enable-features=UseOzonePlatform
-      --ozone-platform=wayland
-    '';
-
-    xdg.portal = {
-      enable = true;
-      config = {
-        niri = {
-          default = [
-            "gnome"
-            "gtk"
-          ];
-          "org.freedesktop.impl.portal.Access" = "gtk";
-          "org.freedesktop.impl.portal.Notification" = "gtk";
-          "org.freedesktop.impl.portal.Secret" = "gnome-keyring";
-          "org.freedesktop.impl.portal.FileChooser" = "gtk";
-          "org.freedesktop.impl.portal.ScreenCast" = [ "gnome" ];
-          "org.freedesktop.impl.portal.Settings" = [
-            "gnome"
-            "gtk"
-          ];
-        };
-      };
-      extraPortals = [
-        pkgs.xdg-desktop-portal-gtk
-        pkgs.xdg-desktop-portal-gnome
-      ];
-    };
   };
 }

home/modules/devenv/default.nix

@@ -1,19 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.devenv;
-in
-{
-  options.devenv = {
-    enable = lib.mkEnableOption "devenv";
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.packages = [ pkgs.devenv ];
-  };
-}

home/modules/direnv/default.nix

@@ -1,20 +1,7 @@
 {
-  config,
+  programs.direnv = {
-  lib,
+    enable = true;
-  ...
+    enableBashIntegration = true;
-}:
+    nix-direnv.enable = true;
-
-let
-  cfg = config.direnv;
-in
-{
-  options.direnv.enable = lib.mkEnableOption "direnv";
-
-  config = lib.mkIf cfg.enable {
-    programs.direnv = {
-      enable = true;
-      enableBashIntegration = true;
-      nix-direnv.enable = true;
-    };
   };
 }

home/modules/docker/default.nix

@@ -1,21 +1,7 @@
-{
+{ pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 
-let
-  cfg = config.docker;
-in
 {
-  options.docker = {
+  home.packages = with pkgs; [
-    enable = lib.mkEnableOption "Docker";
+    dive
-  };
+  ];
-
-  config = lib.mkIf cfg.enable {
-    home.packages = with pkgs; [
-      dive
-    ];
-  };
 }

home/modules/fuzzel/default.nix

@@ -1,27 +1,14 @@
 {
-  config,
+  programs.fuzzel = {
-  lib,
+    enable = true;
-  ...
+    settings = {
-}:
+      main = {
-
+        horizontal-pad = 0;
-let
+        vertical-pad = 0;
-  cfg = config.fuzzel;
+      };
-in
+      border = {
-{
+        width = 2;
-  options.fuzzel.enable = lib.mkEnableOption "fuzzel";
+        radius = 0;
-
-  config = lib.mkIf cfg.enable {
-    programs.fuzzel = {
-      enable = true;
-      settings = {
-        main = {
-          horizontal-pad = 0;
-          vertical-pad = 0;
-        };
-        border = {
-          width = 2;
-          radius = 0;
-        };
       };
     };
   };

home/modules/git/default.nix

@@ -8,12 +8,11 @@
 
 {
   options.git = {
-    enable = lib.mkEnableOption "git";
     github.enable = lib.mkEnableOption "Github CLI";
     gitlab.enable = lib.mkEnableOption "Gitlab CLI";
   };
 
-  config = lib.mkIf config.git.enable {
+  config = {
     programs.git.enable = true;
     home.file = {
       ".gitconfig".source = dotsPath + "/.gitconfig";

home/modules/go/default.nix

@@ -1,22 +1,7 @@
+{ pkgs, ... }:
 {
-  config,
+  home.packages = with pkgs; [
-  lib,
+    go
-  pkgs,
+    gopls
-  ...
+  ];
-}:
-
-let
-  cfg = config.go;
-in
-{
-  options.go = {
-    enable = lib.mkEnableOption "Go";
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.packages = with pkgs; [
-      go
-      gopls
-    ];
-  };
 }

home/modules/infra/default.nix

@@ -1,19 +1,7 @@
-{
+{ pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 
-let
-  cfg = config.infra;
-in
 {
-  options.infra = {
+  config = {
-    enable = lib.mkEnableOption "infrastructure tools";
-  };
-
-  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       opentofu
       upbound

home/modules/k8s/default.nix

@@ -1,44 +1,25 @@
-{
+{ pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 
-let
-  cfg = config.k8s;
-in
 {
+  home.packages = with pkgs; [
+    argocd
+    fluxcd
+    k3d
+    kubectl
+    kubernetes
+    kustomize
+    minikube
+    opentofu
+    upbound
+  ];
+
+  programs.kubecolor = {
+    enable = true;
+    enableAlias = true;
+  };
+
   imports = [
     ./helm.nix
     ./k9s.nix
   ];
-
-  options.k8s.enable = lib.mkEnableOption "k8s";
-
-  config = lib.mkIf cfg.enable {
-    k8s.helm.enable = lib.mkDefault true;
-    k8s.k9s.enable = lib.mkDefault true;
-
-    home.packages = with pkgs; [
-      argocd
-      fluxcd
-      k3d
-      kubectl
-      kubernetes
-      kustomize
-      minikube
-      opentofu
-      upbound
-    ];
-
-    programs.kubecolor = {
-      enable = true;
-      enableAlias = true;
-    };
-
-    home.shellAliases = {
-      k = "kubectl";
-    };
-  };
 }

home/modules/k8s/helm.nix

@@ -1,27 +1,15 @@
-{
+{ pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 
-let
-  cfg = config.k8s.helm;
-in
 {
-  options.k8s.helm.enable = lib.mkEnableOption "helm";
+  home.packages = with pkgs; [
-
+    (wrapHelm kubernetes-helm {
-  config = lib.mkIf cfg.enable {
+      plugins = with kubernetes-helmPlugins; [
-    home.packages = with pkgs; [
+        helm-diff
-      (wrapHelm kubernetes-helm {
+        helm-git
-        plugins = with kubernetes-helmPlugins; [
+        helm-schema
-          helm-diff
+        helm-secrets
-          helm-git
+        helm-unittest
-          helm-schema
+      ];
-          helm-secrets
+    })
-          helm-unittest
+  ];
-        ];
-      })
-    ];
-  };
 }

home/modules/k8s/k9s.nix

@@ -1,23 +1,10 @@
 {
-  config,
+  programs.k9s = {
-  lib,
+    enable = true;
-  ...
+    settings.k9s = {
-}:
+      ui = {
-
+        logoless = true;
-let
+        reactive = true;
-  cfg = config.k8s.k9s;
-in
-{
-  options.k8s.k9s.enable = lib.mkEnableOption "";
-
-  config = lib.mkIf cfg.enable {
-    programs.k9s = {
-      enable = true;
-      settings.k9s = {
-        ui = {
-          logoless = true;
-          reactive = true;
-        };
       };
     };
   };

home/modules/keepassxc/default.nix

@@ -1,21 +1,8 @@
 {
-  config,
+  programs.keepassxc = {
-  lib,
+    enable = true;
-  ...
+    settings = {
-}:
+      Browser.Enabled = true;
-
-let
-  cfg = config.keepassxc;
-in
-{
-  options.keepassxc.enable = lib.mkEnableOption "KeePassXC";
-
-  config = lib.mkIf cfg.enable {
-    programs.keepassxc = {
-      enable = true;
-      settings = {
-        Browser.Enabled = true;
-      };
     };
   };
 }

home/modules/mako/default.nix

@@ -1,16 +1,5 @@
 {
-  config,
+  services.mako = {
-  lib,
+    enable = true;
-  ...
-}:
-
-let
-  cfg = config.mako;
-in
-{
-  options.mako.enable = lib.mkEnableOption "mako";
-
-  config = lib.mkIf cfg.enable {
-    services.mako.enable = true;
   };
 }

home/modules/music/default.nix

@@ -1,13 +1,10 @@
 {
-  config,
-  lib,
-  pkgs,
   dotsPath,
+  pkgs,
   ...
 }:
 
 let
-  cfg = config.music;
   spotifyWithWayland = pkgs.symlinkJoin {
     name = "spotify";
     paths = [ pkgs.spotify ];
@@ -19,14 +16,12 @@ let
   };
 in
 {
-  options.music.enable = lib.mkEnableOption "music";
+  home.packages = with pkgs; [
+    spotifyWithWayland
+  ];
 
-  config = lib.mkIf cfg.enable {
+  programs.ncspot = {
-    home.packages = [ spotifyWithWayland ];
+    enable = true;
-
+    settings = builtins.fromTOML (builtins.readFile (dotsPath + "/.config/ncspot/config.toml"));
-    programs.ncspot = {
-      enable = true;
-      settings = fromTOML (builtins.readFile (dotsPath + "/.config/ncspot/config.toml"));
-    };
   };
 }

home/modules/networking/default.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+
+{
+  config = {
+    home.packages = with pkgs; [
+      wireshark
+    ];
+  };
+}

home/modules/nfc/default.nix

@@ -1,21 +1,5 @@
 {
-  config,
+  imports = [
-  lib,
+    ./proxmark3.nix
-  pkgs,
+  ];
-  ...
-}:
-
-let
-  cfg = config.nfc;
-in
-{
-  options.nfc = {
-    enable = lib.mkEnableOption "NFC tools";
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.packages = [
-      (pkgs.proxmark3.override { withGeneric = true; })
-    ];
-  };
 }

home/modules/nfc/proxmark3.nix

@@ -0,0 +1,6 @@
+{ pkgs, ... }:
+{
+  home.packages = [
+    (pkgs.proxmark3.override { withGeneric = true; })
+  ];
+}

home/modules/nodejs/default.nix

@@ -5,21 +5,15 @@
   ...
 }:
 
-let
-  cfg = config.nodejs;
-in
 {
-  options.nodejs = {
+  options.nodejs.package = lib.mkOption {
-    enable = lib.mkEnableOption "Node.js";
+    type = lib.types.package;
-    package = lib.mkOption {
+    default = pkgs.nodejs_24;
-      type = lib.types.package;
-      default = pkgs.nodejs_24;
-    };
   };
 
-  config = lib.mkIf cfg.enable {
+  config = {
     home.packages = with pkgs; [
-      cfg.package
+      config.nodejs.package
       pnpm
       yarn
       biome

home/modules/nvim/default.nix

@@ -1,20 +1,7 @@
-{
+{ pkgs, inputs, ... }:
-  config,
-  lib,
-  pkgs,
-  inputs,
-  ...
-}:
 
-let
-  cfg = config.nvim;
-in
 {
-  options.nvim.enable = lib.mkEnableOption "nvim";
+  home.packages = [
-
+    inputs.nvim.packages.${pkgs.stdenv.hostPlatform.system}.nvim
-  config = lib.mkIf cfg.enable {
+  ];
-    home.packages = [
-      inputs.nvim.packages.${pkgs.stdenv.hostPlatform.system}.nvim
-    ];
-  };
 }

home/modules/pandoc/default.nix

@@ -1,23 +1,8 @@
+{ pkgs, ... }:
 {
-  config,
+  home.packages = with pkgs; [
-  lib,
+    haskellPackages.pandoc-crossref
-  pkgs,
+    pandoc
-  ...
+    texliveSmall
-}:
+  ];
-
-let
-  cfg = config.pandoc;
-in
-{
-  options.pandoc = {
-    enable = lib.mkEnableOption "pandoc";
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.packages = with pkgs; [
-      haskellPackages.pandoc-crossref
-      pandoc
-      texliveSmall
-    ];
-  };
 }

home/modules/photography/default.nix

@@ -1,21 +1,7 @@
-{
+{ pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 
-let
-  cfg = config.photography;
-in
 {
-  options.photography = {
+  home.packages = with pkgs; [
-    enable = lib.mkEnableOption "photography";
+    darktable
-  };
+  ];
-
-  config = lib.mkIf cfg.enable {
-    home.packages = with pkgs; [
-      darktable
-    ];
-  };
 }

home/modules/reference-manager/default.nix

@@ -1,37 +0,0 @@
-{
-  config,
-  inputs,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.reference-manager;
-
-  hasBrowser =
-    name:
-    lib.elem name [
-      config.browser.primary
-      config.browser.secondary
-    ];
-
-  zoteroConnector =
-    inputs.firefox-addons.packages.${pkgs.stdenv.hostPlatform.system}.zotero-connector;
-  zoteroAddonId = "zotero@chnm.gmu.edu";
-
-  connectorExtension = {
-    profiles.default.extensions.packages = [ zoteroConnector ];
-    policies.ExtensionSettings.${zoteroAddonId}.default_area = "navbar";
-  };
-in
-{
-  options.reference-manager.enable = lib.mkEnableOption "reference manager (Zotero)";
-
-  config = lib.mkIf cfg.enable {
-    home.packages = [ pkgs.zotero ];
-
-    programs.firefox = lib.mkIf (hasBrowser "firefox") connectorExtension;
-    programs.librewolf = lib.mkIf (hasBrowser "librewolf") connectorExtension;
-  };
-}

home/modules/secrets/default.nix

@@ -1,19 +1,12 @@
 {
-  config,
-  lib,
   pkgs,
   ...
 }:
 {
   imports = [ ./vault.nix ];
 
-  options.secrets.enable = lib.mkEnableOption "secrets";
+  home.packages = with pkgs; [
-
+    sops
-  config = lib.mkIf config.secrets.enable {
+    age
-    home.packages = with pkgs; [
+  ];
-      age
-      age-plugin-yubikey
-      sops
-    ];
-  };
 }

home/modules/shell/bash.nix

@@ -4,12 +4,13 @@
   dotsPath,
   ...
 }:
-
 let
   cfg = config.shell.bash;
   inherit (config.home) username;
 in
 {
+  imports = [ ./utils.nix ];
+
   options.shell.bash = {
     aliases = {
       all = lib.mkOption {
@@ -33,7 +34,7 @@ in
     };
   };
 
-  config = lib.mkIf config.shell.enable {
+  config = {
     programs.bash = {
       enable = true;
       enableCompletion = true;

home/modules/shell/default.nix

@@ -1,9 +1,3 @@
-{
-  config,
-  lib,
-  ...
-}:
-
 {
   imports = [
     ./bash.nix
@@ -11,10 +5,4 @@
     ./prompt.nix
     ../tmux
   ];
-
-  options.shell.enable = lib.mkEnableOption "shell";
-
-  config = lib.mkIf config.shell.enable {
-    tmux.enable = lib.mkDefault true;
-  };
 }

home/modules/shell/prompt.nix

@@ -1,18 +1,3 @@
 {
-  config,
+  programs.starship.enable = true;
-  lib,
-  ...
-}:
-
-{
-  config = lib.mkIf config.shell.enable {
-    programs.starship = {
-      enable = true;
-      settings = {
-        git_status = {
-          ahead = "⇡$\{count\}";
-        };
-      };
-    };
-  };
 }

home/modules/shell/utils.nix

@@ -1,23 +1,19 @@
 {
-  config,
   lib,
   pkgs,
   ...
 }:
-
 {
-  config = lib.mkIf config.shell.enable {
+  programs.fzf = {
-    programs.fzf = {
+    enable = true;
-      enable = true;
+    enableBashIntegration = lib.mkDefault true;
-      enableBashIntegration = lib.mkDefault true;
-    };
-
-    home.packages = with pkgs; [
-      ripgrep
-      bat
-      jq
-      entr
-      parallel
-    ];
   };
+
+  home.packages = with pkgs; [
+    ripgrep
+    bat
+    jq
+    entr
+    parallel
+  ];
 }

home/modules/shikane/default.nix

@@ -1,70 +1,6 @@
-{
+{ pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 
 {
-  options.shikane.enable = lib.mkEnableOption "shikane";
+  home.packages = with pkgs; [ wdisplays ];
-
+  services.shikane.enable = true;
-  config = lib.mkIf config.shikane.enable {
-    home.packages = with pkgs; [ (config.nixgl.wrap wdisplays) ];
-    services.shikane.enable = true;
-    home.file.".config/shikane/config.toml" = {
-      force = true;
-      text = ''
-        [[profile]]
-        name = "work"
-
-        [[profile.output]]
-        enable = true
-        search = ["m=Unknown", "s=", "v=Unknown"]
-        mode = "2880x1800@120Hz"
-        position = "288,3240"
-        scale = 1.5
-        transform = "normal"
-        adaptive_sync = false
-
-        [[profile.output]]
-        enable = true
-        search = ["m=Q27P1B", "s=GNXM2HA196769", "v=PNP(AOC)"]
-        mode = "2560x1440@59.951Hz"
-        position = "116,1800"
-        scale = 1.0
-        transform = "normal"
-        adaptive_sync = false
-
-        [[profile.output]]
-        enable = true
-        search = ["m=PHL 243S7", "s=UHB1923012753", "v=Philips Consumer Electronics Company"]
-        mode = "1920x1080@60Hz"
-        position = "2676,1800"
-        scale = 1.0
-        transform = "270"
-        adaptive_sync = false
-
-        [[profile]]
-        name = "home"
-
-        [[profile.output]]
-        enable = true
-        search = ["m=Unknown", "s=Unknown", "v=Unknown"]
-        mode = "2880x1800@60.001Hz"
-        position = "185,1440"
-        scale = 1.75
-        transform = "normal"
-        adaptive_sync = false
-
-        [[profile.output]]
-        enable = true
-        search = ["m=PHL 276E8V", "s=0x0000046D", "v=Philips Consumer Electronics Company"]
-        mode = "3840x2160@59.996Hz"
-        position = "1500,0"
-        scale = 1.5
-        transform = "normal"
-        adaptive_sync = false
-      '';
-    };
-  };
 }

home/modules/ssh/README.md

@@ -1,52 +0,0 @@
-# SSH keys
-
-* primary keys (host-specific, non-resident)
-* backup key (shared, resident)
-
-## generate keys
-
-### YubiKey 01 - `host_01`
-
-```sh
-ssh-keygen -t ed25519-sk \
-  -O verify-required \
-  -f ~/.ssh/id_ed25519_sk \
-  -C "h@host_01"
-```
-
-### YubiKey 01 — `host_02`
-
-```sh
-ssh-keygen -t ed25519-sk \
-  -O verify-required \
-  -f ~/.ssh/id_ed25519_sk \
-  -C "h@host_02"
-```
-
-### YubiKey 02 - `host_*`
-
-```sh
-ssh-keygen -t ed25519-sk \
-  -O resident \
-  -O verify-required \
-  -f ~/.ssh/id_ed25519_sk_bak \
-  -C "backup"
-```
-
-## register keys
-
-when you the primary key (`id_ed25519_sk.pub`), make sure to also register the
-backup key (`id_ed25519_sk_bak.pub`) if needed.
-
-## recovery scenarios
-
-| scenario | recovery |
-|---|---|
-| primary key file lost | generate new primary key on that device, re-register (use backup key) |
-| primary YubiKey lost  | generate new primary keys on all devices using new YubiKey (use backup key) |
-| backup key file lost | regenerate from backup YubiKey resident key (use `ssh-keygen -K`) |
-| backup YubiKey lost | generate resident backup key, distribute across hosts, re-register (use primary key) |
-
-## references
-
-* <https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html>

home/modules/ssh/default.nix

@@ -1,53 +1,45 @@
 {
-  config,
+  outputs,
   lib,
   pkgs,
-  myUtils,
   ...
 }:
-
 let
-  cfg = config.ssh;
+  nixosConfigs = builtins.attrNames outputs.nixosConfigurations;
-  hostDir = ../../hosts;
+  homeConfigs = map (n: lib.last (lib.splitString "@" n)) (
-  hostNames = myUtils.dirNames hostDir;
+    builtins.attrNames outputs.homeConfigurations
+  );
+  allHosts = lib.unique (homeConfigs ++ nixosConfigs);
   hostsWithKeys = lib.filter (
-    hostname: builtins.pathExists (hostDir + "/${hostname}/ssh_host.pub")
+    hostname: builtins.pathExists ../../hosts/${hostname}/ssh_host.pub
-  ) hostNames;
+  ) allHosts;
 in
 {
-  options.ssh.enable = lib.mkEnableOption "ssh";
+  home.packages = with pkgs; [ sshfs ];
 
-  config = lib.mkIf cfg.enable {
+  programs.ssh = {
-    home.packages = with pkgs; [ sshfs ];
+    enable = true;
+    enableDefaultConfig = false;
 
-    programs.ssh = {
+    matchBlocks =
-      enable = true;
+      lib.genAttrs hostsWithKeys (
-      enableDefaultConfig = false;
+        hostname:
-
+        let
-      settings =
+          hostConfig = outputs.nixosConfigurations.${hostname}.config;
-        lib.genAttrs hostsWithKeys (
+          inherit (hostConfig.ssh) publicHostname username;
-          hostname:
+        in
-          let
+        {
-            meta = myUtils.hostMeta (hostDir + "/${hostname}");
+          host = hostname;
-            isLocal = builtins.elem "local" meta.tags;
+          user = username;
-          in
+        }
-          {
+        // lib.optionalAttrs (publicHostname != "") {
-            User = meta.host.username;
+          hostname = publicHostname;
-          }
+        }
-          // lib.optionalAttrs (!isLocal) {
+      )
-            HostName = hostname;
+      // {
-          }
+        "*" = {
-        )
+          addKeysToAgent = "yes";
-        // {
-          "*" = {
-            AddKeysToAgent = "yes";
-            ForwardAgent = false;
-            identityFile = [
-              "~/.ssh/id_ed25519_sk"
-              "~/.ssh/id_ed25519_sk_bak"
-            ];
-          };
         };
-    };
+      };
   };
 }

home/modules/stylix/default.nix

@@ -1,33 +1,45 @@
 {
   config,
-  lib,
+  inputs,
   pkgs,
   ...
 }:
 
 let
-  cfg = config.my.stylix;
   theme = import ../../../modules/stylix/theme.nix { inherit pkgs; };
 in
 {
-  options.my.stylix.enable = lib.mkEnableOption "stylix";
+  imports = [ inputs.stylix.homeModules.stylix ];
 
-  config = lib.mkIf cfg.enable {
+  stylix = {
-    stylix = {
+    enable = true;
-      enable = true;
+    inherit (theme)
-      inherit (theme)
+      polarity
-        polarity
+      base16Scheme
-        base16Scheme
+      override
-        override
+      image
-        image
+      ;
-        ;
+    fonts = {
-      fonts = {
+      monospace = theme.monospaceFont;
-        monospace = theme.monospaceFont;
+      serif = config.stylix.fonts.monospace;
-        serif = config.stylix.fonts.monospace;
+      sansSerif = config.stylix.fonts.monospace;
-        sansSerif = config.stylix.fonts.monospace;
+      emoji = config.stylix.fonts.monospace;
-        emoji = config.stylix.fonts.monospace;
+    };
+    targets = {
+      firefox = {
+        profileNames = [ "default" ];
+        colorTheme.enable = true;
       };
-      targets = import ../../../modules/stylix/targets.nix;
+      librewolf = {
+        profileNames = [ "default" ];
+        colorTheme.enable = true;
+      };
+      gnome.enable = false;
+      gtk.enable = false;
+      kitty = {
+        variant256Colors = true;
+      };
+      nixvim.enable = false;
     };
   };
 }

home/modules/taskwarrior/default.nix

@@ -5,81 +5,60 @@
   dotsPath,
   myUtils,
   osConfig ? null,
-  inputs ? null,
   ...
 }:
 
 let
-  cfg = config.taskwarrior;
   sops = myUtils.sopsAvailability config osConfig;
-  standalone = osConfig == null;
 in
 {
-  options.taskwarrior.enable = lib.mkEnableOption "taskwarrior";
+  warnings =
+    lib.optional (!sops.available && config.programs.taskwarrior.enable)
+      "taskwarrior is enabled, but sops templates are not available. taskwarrior sync will not be configured.";
 
-  config = lib.mkIf cfg.enable (
+  home.packages = with pkgs; [
-    lib.optionalAttrs standalone {
+    libnotify
-      sops = {
+    taskopen
-        secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" {
+    python3
-          taskwarrior = [
+  ];
-            "sync-server-url"
-            "sync-server-client-id"
-            "sync-encryption-secret"
-          ];
-        };
 
-        templates."taskrc.d/sync" = {
+  home.file = {
-          content = ''
+    ".config/task/taskrc" = {
-            sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"}
+      force = true;
-            sync.server.client_id=${config.sops.placeholder."taskwarrior/sync-server-client-id"}
+      source = dotsPath + "/.config/task/taskrc";
-            sync.encryption_secret=${config.sops.placeholder."taskwarrior/sync-encryption-secret"}
+    };
-          '';
+    ".config/task/taskrc.d/aliases".source = dotsPath + "/.config/task/taskrc.d/aliases";
-        };
+    ".config/task/taskrc.d/colors".source = dotsPath + "/.config/task/taskrc.d/colors";
-      };
+    ".config/task/taskrc.d/contexts".source = dotsPath + "/.config/task/taskrc.d/contexts";
-    }
+    ".config/task/taskrc.d/reports".source = dotsPath + "/.config/task/taskrc.d/reports";
-    // {
+    ".config/task/taskrc.d/udas".source = dotsPath + "/.config/task/taskrc.d/udas";
-      warnings =
+    ".config/task/taskrc.d/urgency".source = dotsPath + "/.config/task/taskrc.d/urgency";
-        lib.optional (!sops.available)
+    ".local/share/task/hooks/on-exit.sync.py" = {
-          "taskwarrior is enabled, but sops templates are not available. taskwarrior sync will not be configured.";
+      source = dotsPath + "/.local/share/task/hooks/on-exit.sync.py";
+    };
+    ".local/share/task/hooks/on-add.limit.py" = {
+      source = dotsPath + "/.local/share/task/hooks/on-add.limit.py";
+      executable = true;
+    };
+    ".local/share/task/hooks/on-modify.limit.py" = {
+      source = dotsPath + "/.local/share/task/hooks/on-modify.limit.py";
+      executable = true;
+    };
+    ".local/share/task/scripts/sync-and-notify.sh" = {
+      source = dotsPath + "/.local/share/task/scripts/sync-and-notify.sh";
+      executable = true;
+    };
+  };
 
-      home.packages = with pkgs; [
+  programs.taskwarrior = with pkgs; {
-        libnotify
+    enable = true;
-        taskopen
+    package = taskwarrior3;
-        python3
+    colorTheme = "dark-256";
-      ];
+    config = {
-
+      recurrence = "off";
-      home.file = {
+    };
-        ".config/task/taskrc" = {
+    extraConfig = lib.optionalString sops.available ''
-          force = true;
+      include ${sops.templates."taskrc.d/sync".path}
-          source = dotsPath + "/.config/task/taskrc";
+    '';
-        };
+  };
-        ".config/task/taskrc.d/aliases".source = dotsPath + "/.config/task/taskrc.d/aliases";
-        ".config/task/taskrc.d/colors".source = dotsPath + "/.config/task/taskrc.d/colors";
-        ".config/task/taskrc.d/contexts".source = dotsPath + "/.config/task/taskrc.d/contexts";
-        ".config/task/taskrc.d/reports".source = dotsPath + "/.config/task/taskrc.d/reports";
-        ".config/task/taskrc.d/udas".source = dotsPath + "/.config/task/taskrc.d/udas";
-        ".config/task/taskrc.d/urgency".source = dotsPath + "/.config/task/taskrc.d/urgency";
-        ".local/share/task/hooks/on-exit.sync.py" = {
-          source = dotsPath + "/.local/share/task/hooks/on-exit.sync.py";
-        };
-        ".local/share/task/scripts/sync-and-notify.sh" = {
-          source = dotsPath + "/.local/share/task/scripts/sync-and-notify.sh";
-          executable = true;
-        };
-      };
-
-      programs.taskwarrior = with pkgs; {
-        enable = true;
-        package = taskwarrior3;
-        colorTheme = "dark-256";
-        config = {
-          recurrence = "off";
-          reserved.lines = 3;
-        };
-        extraConfig = lib.optionalString sops.available ''
-          include ${sops.templates."taskrc.d/sync".path}
-        '';
-      };
-    }
-  );
 }

home/modules/terminal/default.nix

@@ -1,18 +1,12 @@
 {
-  config,
-  lib,
   pkgs,
+  config,
   dotsPath,
   ...
 }:
 
-let
-  cfg = config.terminal;
-in
 {
-  options.terminal.enable = lib.mkEnableOption "terminal";
+  config = {
-
-  config = lib.mkIf cfg.enable {
     programs.bash.shellAliases = {
       icat = "kitty +kitten icat";
     };

home/modules/ticketing/default.nix

@@ -1,21 +1,7 @@
-{
+{ pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 
-let
-  cfg = config.ticketing;
-in
 {
-  options.ticketing = {
+  home.packages = with pkgs; [
-    enable = lib.mkEnableOption "ticketing";
+    jira-cli-go
-  };
+  ];
-
-  config = lib.mkIf cfg.enable {
-    home.packages = with pkgs; [
-      jira-cli-go
-    ];
-  };
 }

home/modules/tmux/default.nix

@@ -1,18 +1,7 @@
-{
+{ pkgs, dotsPath, ... }:
-  config,
-  lib,
-  pkgs,
-  dotsPath,
-  ...
-}:
 
-let
-  cfg = config.tmux;
-in
 {
-  options.tmux.enable = lib.mkEnableOption "tmux";
+  config = {
-
-  config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       tmuxp
       reptyr
@@ -22,5 +11,9 @@ in
       enable = true;
       extraConfig = builtins.readFile (dotsPath + "/.config/tmux/tmux.conf");
     };
+
+    home.file = {
+      ".config/tmux/hooks/tmux.ssh.conf".source = dotsPath + "/.config/tmux/hooks/tmux.ssh.conf";
+    };
   };
 }

home/modules/torrenting/default.nix

@@ -1,21 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.torrenting;
-in
-{
-  options.torrenting = {
-    enable = lib.mkEnableOption "torrenting";
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.packages = with pkgs; [
-      transmission_4
-    ];
-  };
-}

home/modules/vscode/default.nix

@@ -1,19 +1,7 @@
-{
+{ config, pkgs, ... }:
-  config,
-  lib,
-  pkgs,
-  ...
-}:
 
-let
-  cfg = config.vscode;
-in
 {
-  options.vscode = {
+  config = {
-    enable = lib.mkEnableOption "Visual Studio Code";
-  };
-
-  config = lib.mkIf cfg.enable {
     home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.vscode "--no-sandbox")) ];
   };
 }

home/modules/waybar/default.nix

@@ -1,24 +1,11 @@
-{
-  config,
-  lib,
-  ...
-}:
-
-let
-  cfg = config.waybar;
-in
 {
   imports = [
     ./settings.nix
     ./style.nix
   ];
 
-  options.waybar.enable = lib.mkEnableOption "waybar";
+  programs.waybar = {
-
+    enable = true;
-  config = lib.mkIf cfg.enable {
+    systemd.enable = true;
-    programs.waybar = {
-      enable = true;
-      systemd.enable = true;
-    };
   };
 }

home/modules/work-cli/default.nix

@@ -0,0 +1,110 @@
+{
+  lib,
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  cfg = config.programs.work-cli;
+  workCliPkg = inputs.work-cli.packages.${pkgs.system}.default;
+in
+{
+  options.programs.work-cli = {
+    enable = lib.mkEnableOption "work-cli unified developer workflow CLI";
+
+    general = {
+      defaultBranch = lib.mkOption {
+        type = lib.types.str;
+        default = "main";
+        description = "Default git branch name";
+      };
+    };
+
+    gitlab = {
+      url = lib.mkOption {
+        type = lib.types.str;
+        default = "https://gitlab.com";
+        description = "GitLab instance URL";
+      };
+
+      project = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = "GitLab project path (namespace/repo)";
+      };
+
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = "GitLab group path";
+      };
+    };
+
+    jira = {
+      enable = lib.mkEnableOption "jira integration";
+
+      url = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = "Jira instance URL";
+      };
+
+      projectKey = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = "Jira project key";
+      };
+    };
+
+    vault = {
+      enable = lib.mkEnableOption "vault integration";
+
+      url = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = "Vault instance URL";
+      };
+    };
+
+    repos = {
+      path = lib.mkOption {
+        type = lib.types.str;
+        default = "~/work";
+        description = "Local path where repos are cloned";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    home.packages = [ workCliPkg ];
+
+    home.file.".config/work/config.toml".text = ''
+      [general]
+      default_branch = "${cfg.general.defaultBranch}"
+
+      [gitlab]
+      url = "${cfg.gitlab.url}"
+      project = "${cfg.gitlab.project}"
+      group = "${cfg.gitlab.group}"
+
+      [repos]
+      path = "${cfg.repos.path}"
+    ''
+    + lib.optionalString cfg.jira.enable ''
+
+      [jira]
+      url = "${cfg.jira.url}"
+      project_key = "${cfg.jira.projectKey}"
+    ''
+    + lib.optionalString cfg.vault.enable ''
+
+      [vault]
+      url = "${cfg.vault.url}"
+    '';
+
+    programs.bash.initExtra = ''
+      eval "$(${workCliPkg}/bin/work --show-completion bash 2>/dev/null)"
+    '';
+  };
+}

home/modules/yubikey/default.nix

@@ -1,19 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-{
-  options.my.yubikey = {
-    enable = lib.mkEnableOption "yubikey";
-  };
-
-  config = lib.mkIf config.my.yubikey.enable {
-    home.packages = with pkgs; [
-      yubikey-manager
-      yubikey-personalization
-    ];
-  };
-}

home/modules/zk/default.nix

@@ -1,45 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.zk;
-in
-{
-  options.zk = {
-    enable = lib.mkEnableOption "zettelkasten";
-    path = lib.mkOption {
-      type = lib.types.str;
-      default = config.home.homeDirectory + "/.zk";
-      description = "Path to the zettelkasten directory";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    home = {
-      sessionVariables.ZK_PATH = cfg.path;
-      packages = [
-        (pkgs.writeShellApplication {
-          name = "zk";
-          runtimeInputs = with pkgs; [ tmux ];
-          text = builtins.readFile ./scripts/zk.sh;
-        })
-
-        (pkgs.writeShellApplication {
-          name = "save-zk";
-          runtimeInputs = with pkgs; [ git ];
-          text = builtins.readFile ./scripts/save-zk.sh;
-        })
-
-        (pkgs.writeShellApplication {
-          name = "setup-zk";
-          runtimeInputs = with pkgs; [ gh ];
-          text = builtins.readFile ./scripts/setup-zk.sh;
-        })
-      ];
-    };
-  };
-}