chore: disable 'lutris' temporarily (failed openldap test)

README.md

@@ -1,8 +1,5 @@
 # ❄️ NixOS flake
 
-![nix](https://img.shields.io/badge/nix-blue?logo=nixos&logoColor=%234d6fb7&labelColor=%23fff&color=%234d6fb7&link=https%3A%2F%2Fnixos.org%2F)
-![neovim](https://img.shields.io/badge/neovim-flat?logo=neovim&logoColor=%23408040&labelColor=%23fff&color=%2380C040)
-
 ## hosts
 
 ### NixOS

deploy/colmena.nix

@@ -6,26 +6,17 @@
 let
   inherit (inputs.nixpkgs) lib;
   utils = import ../utils { inherit lib; };
-  hostnames = utils.dirNames ../hosts;
+  hostDirNames = utils.dirNames ../hosts;
 
-  mkNode =
-    hostname:
-    let
-      meta = utils.hostMeta ../hosts/${hostname};
-      isLocal = builtins.elem "local" meta.tags;
-    in
-    {
+  mkNode = hostname: meta: {
     imports = [ ../hosts/${hostname} ];
-      host.name = hostname;
     deployment = {
-        inherit (meta) tags;
-        targetUser = meta.host.username;
-        targetHost = if isLocal then "" else hostname;
-        buildOnTarget = builtins.any (t: t != "local" && t != "arm") meta.tags;
+      inherit (meta.deployment) targetHost targetUser tags;
+      buildOnTarget = builtins.any (t: t != "local" && t != "arm") meta.deployment.tags;
     };
   };
 
-  nodes = lib.genAttrs hostnames mkNode;
+  nodes = lib.genAttrs hostDirNames (hostname: mkNode hostname (utils.hostMeta ../hosts/${hostname}));
 in
 inputs.colmena.lib.makeHive (
   {

dots/.bashrc

@@ -60,7 +60,7 @@ export XDG_DATA_HOME=$HOME/.local/share
 if [ -f "/usr/bin/fzf" ]; then
   # Fuzzy finder setup
   export FZF_COMPLETION_TRIGGER='**'
-  export FZF_DEFAULT_COMMAND='rg --files ""'
+  export FZF_DEFAULT_COMMAND='ag -g ""'
   export FZF_DEFAULT_OPTS="
   --pointer='❭'
   --height 10%

dots/.bin/taskdeps

@@ -1,4 +1,4 @@
-#!/usr/bin/env python3
+#!/usr/bin/python
 
 import argparse
 import json

dots/.config/nvim/after/plugin/hydra.lua

@@ -1,35 +0,0 @@
-local hydra_repl = "hydra-repl"
-
-if not vim.fn.executable(hydra_repl) then
-  return
-end
-
-local function send(lines)
-  vim.system({ hydra_repl, table.concat(lines, "\n") })
-end
-
-local function get_paragraph(buf)
-  local start_ = vim.fn.search("^$", "bnW")
-  local end_ = vim.fn.search("^$", "nW") - 1
-  if end_ < vim.api.nvim_win_get_cursor(0)[1] then
-    end_ = vim.api.nvim_buf_line_count(buf)
-  end
-  return vim.api.nvim_buf_get_lines(buf, start_, end_, false)
-end
-
-local function get_selection(buf)
-  return vim.api.nvim_buf_get_lines(buf, vim.fn.line("'<") - 1, vim.fn.line("'>"), false)
-end
-
-vim.api.nvim_create_autocmd("FileType", {
-  pattern = "javascript",
-  callback = function(e)
-    if vim.fn.fnamemodify(vim.api.nvim_buf_get_name(e.buf), ":e") ~= "hydra" then
-      return
-    end
-
-    local buf = e.buf
-    vim.keymap.set("n", "<CR>", function() send(get_paragraph(buf)) end, { buffer = buf, desc = "hydra: send block" })
-    vim.keymap.set("v", "<CR>", function() send(get_selection(buf)) end, { buffer = buf, desc = "hydra: send selection" })
-  end,
-})

dots/.config/nvim/after/plugin/image.nvim.lua

@@ -1,5 +1,3 @@
-if not vim.env.KITTY_WINDOW_ID then return end
-
 require("image").setup({
   backend = "kitty",
   kitty_method = "normal",

dots/.config/nvim/after/plugin/nvim-cmp.lua

@@ -64,7 +64,7 @@ cmp.setup({
   sources = {
     { name = "copilot",  group_index = 2 },
     { name = "zk" },
-    { name = "nvim_lsp" },
+    { name = "nvim_lsp", keyword_length = 8 },
     { name = "luasnip",  max_item_count = 16 },
     { name = "path" },
     { name = "buffer",   max_item_count = 8 },

dots/.config/nvim/after/plugin/nvim-ts-context-commentstring.lua

@@ -1,8 +0,0 @@
-require("ts_context_commentstring").setup({ enable_autocmd = false })
-
--- https://github.com/JoosepAlviste/nvim-ts-context-commentstring/issues/109
-local get_option = vim.filetype.get_option
-vim.filetype.get_option = function(filetype, option)
-  return option == "commentstring" and require("ts_context_commentstring.internal").calculate_commentstring()
-    or get_option(filetype, option)
-end

dots/.config/nvim/after/plugin/treesitter.lua

@@ -123,7 +123,7 @@ treesitter.setup({
 })
 
 opt.foldmethod = "expr"
-opt.foldexpr = "v:lua.vim.treesitter.foldexpr()"
+opt.foldexpr = "nvim_treesitter#foldexpr()"
 opt.foldenable = false
 
 -- TreeSJ

dots/.config/nvim/after/plugin/wiki.vim.lua

@@ -13,16 +13,11 @@ nm <leader>ww <plug>(wiki-index)
 " nm <leader>s <plug>(wiki-link-follow-split)
 " nm <leader>v <plug>(wiki-link-follow-vsplit)
 
-function! ZKContextualEcho()
-  let l:name = expand('%:t')
-  if l:name =~ '_' | echo 'hierarchical relation'
-  elseif l:name =~ '--' | echo 'relation'
-  elseif l:name =~ '<>' | echo 'dichotomy'
-  elseif l:name =~ 'my-' | echo 'personal file'
-  elseif l:name =~ 'project_' | echo 'project file'
-  endif
-endfunction
-execute 'autocmd BufEnter' g:zk_path . '/*.md' 'call ZKContextualEcho()'
+autocmd BufEnter *.md if expand('%:t') =~ '_' | echo 'hierarchical relation' | endif
+autocmd BufEnter *.md if expand('%:t') =~ '--' | echo 'relation' | endif
+autocmd BufEnter *.md if expand('%:t') =~ '<>' | echo 'dichotomy' | endif
+autocmd BufEnter *.md if expand('%:t') =~ 'my-' | echo 'personal file' | endif
+autocmd BufEnter *.md if expand('%:t') =~ 'project_' | echo 'project file' | endif
 
 " Only load wiki.vim for zk directory
 let g:wiki_index_name='index'

dots/.config/nvim/flake.lock

@@ -42,11 +42,11 @@
     },
     "nixCats": {
       "locked": {
-        "lastModified": 1777273601,
-        "narHash": "sha256-xBUa8Tl9V7IXI+VmLEuDc81La/EhoSn1C3EVSnJ3cfU=",
+        "lastModified": 1774835836,
+        "narHash": "sha256-6ok7iv/9R82vl6MYe3Lwyyb6S5bmW2PxEZtmjzlqyPs=",
         "owner": "BirdeeHub",
         "repo": "nixCats-nvim",
-        "rev": "f69ea013e328841a7def7037ed59788a76be8816",
+        "rev": "ebb9f279a55ca60ff4e37e4accf6518dc627aa8d",
         "type": "github"
       },
       "original": {
@@ -73,11 +73,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1777270315,
-        "narHash": "sha256-yKB4G6cKsQsWN7M6rZGk6gkJPDNPIzT05y4qzRyCDlI=",
+        "lastModified": 1775608838,
+        "narHash": "sha256-2ySoGH+SAi34U0PeuQgABC0WiH9LQ3tkyHTiE93KUeg=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "6368eda62c9775c38ef7f714b2555a741c20c72d",
+        "rev": "9a01fad67a57e44e1b3e1d905c6881bcfb209e8a",
         "type": "github"
       },
       "original": {

dots/.config/nvim/flake.nix

@@ -45,23 +45,7 @@
       inherit (nixCats) utils;
       luaPath = ./.;
       forEachSystem = utils.eachSystem nixpkgs.lib.platforms.all;
-      extra_pkg_config = {
-        allowUnfreePredicate =
-          pkg:
-          builtins.elem (nixpkgs.lib.getName pkg) [
-            "vim-sandwich"
-            "jupytext.nvim"
-            "eyeliner.nvim"
-            "context_filetype.vim"
-            "editorconfig-vim"
-            "unicode.vim"
-            "quarto-nvim"
-            "vim-openscad"
-            "lsp_lines.nvim"
-            "nvim-highlight-colors"
-            "nvim-lint"
-          ];
-      };
+      extra_pkg_config = { };
 
       mkDependencyOverlays = system: [
         (utils.standardPluginOverlay inputs)
@@ -87,11 +71,9 @@
         {
           lspsAndRuntimeDeps = with pkgs; {
             general = [
-              nodejs_24
               black
               clang
               clang-tools
-              curl # → plenary-nvim, mcp-hub
               delta
               emmet-language-server
               eslint_d
@@ -105,8 +87,6 @@
               mcp-hub
               nixd
               nixfmt
-              prettier
-              typescript-language-server
               ormolu
               prettierd
               rust-analyzer
@@ -115,7 +95,6 @@
               stylelint
               stylua
               tree-sitter
-              tailwindcss-language-server
               typescript-language-server
               vscode-langservers-extracted
               vtsls
@@ -174,7 +153,6 @@
               nvim-treesitter-textobjects
               # nvim-treesitter-context
               nvim-ts-context-commentstring
-              # theHamsta/crazy-node-movement
               treesj
               sniprun
               gitsigns-nvim

dots/.config/nvim/init.lua

@@ -8,9 +8,11 @@ require("cursor")
 require("fold")
 require("netrw")
 require("ftdetect")
+require("plug")
 require("pandoc")
 require("keymaps")
 require("highlight")
+require("paq-setup")
 require("statusline")
 require("diagnostic")
 require("utils")
@@ -18,3 +20,4 @@ require("zk")
 require("reload")
 
 vim.opt.background = "dark"
+vim.opt.laststatus = 3

dots/.config/nvim/lua/ftdetect.lua

@@ -9,6 +9,5 @@ vim.filetype.add({
     ["%.env.*"] = "dotenv",
     ["%.pl$"] = "prolog",
     [".*.containerfile.*"] = "dockerfile",
-    ["%.hydra$"] = "javascript",
   },
 })

dots/.config/nvim/lua/nixCatsUtils/catPacker.lua

@@ -0,0 +1,53 @@
+-- Source: https://github.com/BirdeeHub/nixCats-nvim/blob/main/templates/example/lua/nixCatsUtils/catPacker.lua
+--[[
+  This directory is the luaUtils template.
+  You can choose what things from it that you would like to use.
+  And then delete the rest.
+  Everything in this directory is optional.
+--]]
+
+local M = {}
+-- NOTE: This function is for defining a paq.nvim fallback method of downloading plugins
+-- when nixCats was not used to install your config.
+-- If you only ever load your config using nixCats, you don't need this file.
+
+-- it literally just only runs it when not on nixCats
+-- all neovim package managers that use the regular plugin loading scheme
+-- can be used this way, just do whatever the plugin manager needs to put it in the
+-- opt directory for lazy loading, and add the build steps so that when theres no nix the steps are ran
+function M.setup(v)
+  if not vim.g[ [[nixCats-special-rtp-entry-nixCats]] ] then
+    local function clone_paq()
+      local path = vim.fn.stdpath("data") .. "/site/pack/paqs/start/paq-nvim"
+      local is_installed = vim.fn.empty(vim.fn.glob(path)) == 0
+      if not is_installed then
+        vim.fn.system({ "git", "clone", "--depth=1", "https://github.com/savq/paq-nvim.git", path })
+        return true
+      end
+    end
+    local function bootstrap_paq(packages)
+      local first_install = clone_paq()
+      vim.cmd.packadd("paq-nvim")
+      local paq = require("paq")
+      if first_install then
+        vim.notify("Installing plugins... If prompted, hit Enter to continue.")
+      end
+      paq(packages)
+      paq.install()
+    end
+
+    vim.api.nvim_create_autocmd("VimEnter", {
+      once = true,
+      callback = function()
+        local pkgs_count = #require("paq").query("to_install")
+        if pkgs_count < 1 then
+          return
+        end
+        vim.notify(string.format("There are %d to install", pkgs_count))
+      end,
+    })
+
+    bootstrap_paq(vim.list_extend({ "savq/paq-nvim" }, v))
+  end
+end
+return M

dots/.config/nvim/lua/paq-setup.lua

@@ -0,0 +1,47 @@
+require("nixCatsUtils.catPacker").setup({
+  { "savq/paq-nvim" },
+  { "jinh0/eyeliner.nvim" },
+  { "ibhagwan/fzf-lua" },
+  { "barreiroleo/ltex_extra.nvim" },
+  { "neovim/nvim-lspconfig" },
+  { "https://git.sr.ht/~whynothugo/lsp_lines.nvim" },
+  { "linrongbin16/lsp-progress.nvim" },
+  { "folke/neodev.nvim" }, -- Nvim
+  { "b0o/schemastore.nvim" }, -- JSON Schemas
+  { "mfussenegger/nvim-lint" },
+  { "stevearc/conform.nvim" },
+  { "L3MON4D3/LuaSnip" },
+  { "saadparwaiz1/cmp_luasnip" },
+  { "hrsh7th/nvim-cmp" },
+  { "hrsh7th/cmp-nvim-lsp" },
+  { "hrsh7th/cmp-buffer" },
+  { "hrsh7th/cmp-path" },
+  { "nvim-lua/plenary.nvim" },
+  { "MunifTanjim/nui.nvim" },
+  { "folke/trouble.nvim" },
+  { "rktjmp/shipwright.nvim" }, -- For building themes based on lush (e.g. terminal)
+  { "rktjmp/lush.nvim" },
+  { "mcchrish/zenbones.nvim" }, -- Zenbones themes (contains zenwritten)
+  { "theHamsta/crazy-node-movement" },
+  { "nvim-treesitter/nvim-treesitter", build = ":TSUpdate" },
+  { "nvim-treesitter/nvim-treesitter-textobjects" },
+  -- { "nvim-treesitter/nvim-treesitter-context" },
+  { "JoosepAlviste/nvim-ts-context-commentstring" }, -- commentstring based on cursor position (e.g. for Svelte)
+  { "Wansmer/treesj" },
+  { "michaelb/sniprun", build = "sh install.sh" },
+  { "lewis6991/gitsigns.nvim" },
+  { "brenoprata10/nvim-highlight-colors" },
+  { "razak17/tailwind-fold.nvim" },
+  { "rmagatti/auto-session" },
+  { "kndndrj/nvim-dbee" },
+  { "3rd/image.nvim", build = false },
+  { "polarmutex/beancount.nvim" },
+  { "jamesblckwell/nvimkit.nvim" },
+  { 'olimorris/codecompanion.nvim' },
+  { "ravitemer/mcphub.nvim",                       build = "pnpm install -g mcp-hub@latest" },
+  { "zbirenbaum/copilot.lua" },
+  { "zbirenbaum/copilot-cmp" },
+  { "qvalentin/helm-ls.nvim", ft = "helm" },
+  { "mikesmithgh/kitty-scrollback.nvim" },
+  { "greggh/claude-code.nvim" },
+})

dots/.config/nvim/lua/plug.lua

@@ -0,0 +1,35 @@
+if not vim.g[ [[nixCats-special-rtp-entry-nixCats]] ] then
+  local vim = vim
+  local Plug = vim.fn["plug#"]
+
+  vim.call("plug#begin")
+
+  Plug("machakann/vim-sandwich")
+  Plug("Shougo/context_filetype.vim")
+  Plug("editorconfig/editorconfig-vim")
+  Plug("honza/vim-snippets")
+  Plug("chrisbra/unicode.vim")
+  Plug("ap/vim-css-color")
+  -- Jupyter
+  Plug("quarto-dev/quarto-vim")
+  -- LaTeX
+  Plug("lervag/vimtex")
+  -- Wiki
+  Plug("lervag/wiki.vim")
+  -- Markdown
+  Plug("vim-pandoc/vim-pandoc")
+  Plug("vim-pandoc/vim-pandoc-syntax")
+  Plug("ferrine/md-img-paste.vim")
+  -- TidalCycles
+  Plug("supercollider/scvim")
+  Plug("tidalcycles/vim-tidal")
+  -- GLSL
+  Plug("tikhomirov/vim-glsl")
+  Plug("timtro/glslView-nvim")
+  -- Jupyter notebooks
+  Plug("goerz/jupytext.vim")
+  -- OpenSCAD
+  Plug("sirtaj/vim-openscad")
+
+  vim.call("plug#end")
+end

dots/.config/nvim/lua/statusline.lua

@@ -1,6 +1,5 @@
-vim.opt.laststatus = 3
-
 vim.cmd([[
+se ls=2
 se stl=\ %0*%n
 se stl+=\ %m
 se stl+=\ %y%0*

dots/.config/nvim/lua/zk/cmp.lua

@@ -13,19 +13,13 @@ local function get_markdown_files(base)
   return items
 end
 
-function source:get_keyword_pattern()
-  return "[%w%./%-]*"
-end
-
 function source:complete(params, callback)
   local cursor_before_line = params.context.cursor_before_line
   local cursor_after_line = params.context.cursor_after_line or ""
 
-  if not cursor_before_line:match("%[[^%]]*%]%(") then
-    callback({})
-    return
-  end
+  local trigger = cursor_before_line:match("%[[^%]]*%]%(([^)]*)$")
 
+  if trigger ~= nil then
     local items = get_markdown_files(".")
     local next_char = cursor_after_line:sub(1, 1)
 
@@ -38,6 +32,9 @@ function source:complete(params, callback)
     end
 
     callback(items)
+  else
+    callback({})
+  end
 end
 
 function source:get_trigger_characters()

dots/.config/task/taskrc

@@ -1,3 +1,4 @@
+include ./taskrc.d/$HOSTNAME
 include ./taskrc.d/aliases
 include ./taskrc.d/urgency
 include ./taskrc.d/reports
@@ -9,5 +10,6 @@ search.case.sensitive=no
 
 rc.json.array=on
 rc.verbose=nothing
-news.version=3.4.2
+news.version=3.1.0
 
+recurrence=off

dots/.config/tmux/hooks/tmux.ssh.conf

@@ -0,0 +1 @@
+set -g status-style bg=colour12,fg=colour0

dots/.config/tmux/tmux.conf

@@ -70,11 +70,11 @@ set -g status-right '#(uptime | cut -f 4-5 -d " " | cut -f 1 -d ",") %a %l:%M:%S
 
 set -g default-terminal "tmux-256color"
 
+set-hook -g after-new-session 'if -F "#{==:#{session_name},ssh}" "source ${XDG_CONFIG_HOME}/tmux/hooks/tmux.ssh.conf" "source ${XDG_CONFIG_HOME}/tmux/hooks/tmux.regular.conf"'
+
 # Vi copypaste mode
 if-shell "test '\( #{$TMUX_VERSION_MAJOR} -eq 2 -a #{$TMUX_VERSION_MINOR} -ge 4 \)'" 'bind-key -Tcopy-mode-vi v send -X begin-selection; bind-key -Tcopy-mode-vi y send -X copy-selection-and-cancel'
 if-shell '\( #{$TMUX_VERSION_MAJOR} -eq 2 -a #{$TMUX_VERSION_MINOR} -lt 4\) -o #{$TMUX_VERSION_MAJOR} -le 1' 'bind-key -t vi-copy v begin-selection; bind-key -t vi-copy y copy-selection'
 if-shell '\( #{$TMUX_VERSION_MAJOR} -eq 2 -a #{$TMUX_VERSION_MINOR} -lt 2\) -o #{$TMUX_VERSION_MAJOR} -le 1' 'set-option -g status-utf8 on'
 
 set -g allow-passthrough on
-set -s extended-keys on
-set -as terminal-features 'xterm*:extkeys'

dots/.zotero/bbt.json

@@ -1,11 +1,11 @@
 {
   "config": {
-    "options": {},
     "preferences": {
       "ascii": "",
       "asciiBibLaTeX": false,
       "asciiBibTeX": true,
       "autoAbbrev": false,
+      "autoAbbrevStyle": "",
       "autoExport": "immediate",
       "autoExportDelay": 5,
       "autoExportIdleWait": 10,
@@ -13,22 +13,18 @@
       "autoExportPathReplaceDirSep": "-",
       "autoExportPathReplaceSpace": " ",
       "automaticTags": true,
+      "autoPinDelay": 0,
       "auxImport": false,
       "baseAttachmentPath": "/home/h/doc/books",
       "biblatexExtendedDateFormat": true,
       "biblatexExtendedNameFormat": true,
       "biblatexExtractEprint": true,
-      "biblatexUsePrefix": true,
-      "bibtexEditionOrdinal": false,
       "bibtexParticleNoOp": false,
       "bibtexURL": "off",
       "cache": true,
-      "cacheDelete": false,
+      "cacheFlushInterval": 5,
       "charmap": "",
-      "chinese": false,
-      "chineseSplitName": true,
       "citeCommand": "cite",
-      "citekeyCaseInsensitive": true,
       "citekeyFold": true,
       "citekeyFormat": "zotero.clean",
       "citekeyFormatEditing": "zotero.clean",
@@ -38,35 +34,32 @@
       "DOIandURL": "both",
       "exportBibTeXStrings": "off",
       "exportBraceProtection": true,
-      "exportSort": "citekey",
       "exportTitleCase": true,
       "extraMergeCitekeys": false,
       "extraMergeCSL": false,
       "extraMergeTeX": false,
-      "fillKeyAfter": 1,
       "git": "config",
       "import": true,
       "importBibTeXStrings": true,
       "importCaseProtection": "as-needed",
       "importCitationKey": true,
-      "importDetectURLs": true,
       "importExtra": true,
       "importJabRefAbbreviations": true,
       "importJabRefStrings": true,
       "importNoteToExtra": "",
-      "importPlaceEvent": "inproceedings,conference,presentation,talk",
       "importSentenceCase": "on+guess",
-      "importSentenceCaseQuoted": true,
       "importUnknownTexCommand": "ignore",
       "itemObserverDelay": 5,
       "jabrefFormat": 0,
-      "japanese": false,
+      "jieba": false,
+      "keyConflictPolicy": "keep",
       "keyScope": "global",
+      "kuroshiro": false,
       "language": "langid",
       "logEvents": false,
       "mapMath": "",
       "mapText": "",
-      "packages": "",
+      "mapUnicode": "conservative",
       "parseParticles": true,
       "patchDates": "dateadded=dateAdded, date-added=dateAdded, datemodified=dateModified, date-modified=dateModified",
       "platform": "lin",
@@ -82,8 +75,7 @@
       "rawImports": false,
       "rawLaTag": "#LaTeX",
       "relativeFilePaths": false,
-      "remigrate": false,
-      "resetKeyOnChange": false,
+      "retainCache": false,
       "scrubDatabase": false,
       "separatorList": "and",
       "separatorNames": "and",
@@ -99,3 +91,4 @@
     }
   }
 }
+

flake.lock

@@ -38,11 +38,11 @@
     "base16-helix": {
       "flake": false,
       "locked": {
-        "lastModified": 1776754714,
-        "narHash": "sha256-E3OAK27smtATTmX45uoTSRsVD+Y+ZiVVfgM/tjpbtYg=",
+        "lastModified": 1760703920,
+        "narHash": "sha256-m82fGUYns4uHd+ZTdoLX2vlHikzwzdu2s2rYM2bNwzw=",
         "owner": "tinted-theming",
         "repo": "base16-helix",
-        "rev": "4d508123037e7851ad36ebf7d9c48b0e9e1eb581",
+        "rev": "d646af9b7d14bff08824538164af99d0c521b185",
         "type": "github"
       },
       "original": {
@@ -92,28 +92,6 @@
         "type": "github"
       }
     },
-    "comin": {
-      "inputs": {
-        "flake-compat": "flake-compat_2",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "treefmt-nix": "treefmt-nix"
-      },
-      "locked": {
-        "lastModified": 1780200954,
-        "narHash": "sha256-3476T026t+XSpOvgBGzKSG6J4swuRLnPO9dR+OATtq8=",
-        "owner": "nlewo",
-        "repo": "comin",
-        "rev": "4f14d338d755239c27131cbf6b466be4bbb20f91",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nlewo",
-        "repo": "comin",
-        "type": "github"
-      }
-    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -143,11 +121,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1780200155,
-        "narHash": "sha256-cKpqEvRqxnCbp/2ZVczMHws31Qh4D/HTEuanWuJmySk=",
+        "lastModified": 1777176175,
+        "narHash": "sha256-l/0TJCLEarrsyHIKNhAjI4+7lkyGsFqojyx1X1h64Ks=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "d29c0c2692ced897777eca19c9bab1b34be0e0d6",
+        "rev": "515c8c1296021efe49ba1b1318ff27a43e93442b",
         "type": "gitlab"
       },
       "original": {
@@ -160,11 +138,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1779670703,
-        "narHash": "sha256-UdfMivNMwCCqQsYDg5pSz8X2IOaOrIZLIIy+Bg3CO2o=",
+        "lastModified": 1775176642,
+        "narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "942159e73e40bf785816f7f1f5feed9ef3d7c8f9",
+        "rev": "179704030c5286c729b5b0522037d1d51341022c",
         "type": "github"
       },
       "original": {
@@ -190,22 +168,6 @@
       }
     },
     "flake-compat_2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1765121682,
-        "narHash": "sha256-4VBOP18BFeiPkyhy9o4ssBNQEvfvv1kXkasAYd0+rrA=",
-        "owner": "NixOS",
-        "repo": "flake-compat",
-        "rev": "65f23138d8d09a92e30f1e5c87611b23ef451bf3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_3": {
       "flake": false,
       "locked": {
         "lastModified": 1767039857,
@@ -251,11 +213,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778716662,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "lastModified": 1775087534,
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
         "type": "github"
       },
       "original": {
@@ -315,18 +277,18 @@
     },
     "git-hooks": {
       "inputs": {
-        "flake-compat": "flake-compat_3",
+        "flake-compat": "flake-compat_2",
         "gitignore": "gitignore",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1778507602,
-        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "lastModified": 1776796298,
+        "narHash": "sha256-PcRvlWayisPSjd0UcRQbhG8Oqw78AcPE6x872cPRHN8=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
+        "rev": "3cfd774b0a530725a077e17354fbdb87ea1c4aad",
         "type": "github"
       },
       "original": {
@@ -380,11 +342,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780099287,
-        "narHash": "sha256-efIPwVGtIWIjWcznhaop6XN6HxnOL8800hF6CBNvlqQ=",
+        "lastModified": 1777196875,
+        "narHash": "sha256-6M/rTHxFRdKJ6WZYxrCl68qIyh3BvjWBmYC7Vufolbg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7d8127d308c3fb9664f7e643eec944be74ebb37d",
+        "rev": "38bf0202cae280174cbb80fc24a63978f16333f7",
         "type": "github"
       },
       "original": {
@@ -396,7 +358,7 @@
     "mcp-hub": {
       "inputs": {
         "flake-parts": "flake-parts",
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_2"
       },
       "locked": {
         "lastModified": 1755841689,
@@ -436,10 +398,10 @@
     "nix-secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1778944969,
-        "narHash": "sha256-wT4WiBUqfeajcaOWvSKmHGKXEGmnDVQsRg0v7NoZW5o=",
+        "lastModified": 1776723456,
+        "narHash": "sha256-GBbbm05oXYqSZ2EgxQPsNpTKl16wNhvrlUxdmv0FbSU=",
         "ref": "main",
-        "rev": "aae027d8de9ae66ea29c9e6a5ff6ea0f4b735261",
+        "rev": "135b681d24af6ee4508bbf7c657982d7be8743d4",
         "shallow": true,
         "type": "git",
         "url": "ssh://git@github.com/hektor/nix-secrets"
@@ -453,11 +415,11 @@
     },
     "nixCats": {
       "locked": {
-        "lastModified": 1777273601,
-        "narHash": "sha256-xBUa8Tl9V7IXI+VmLEuDc81La/EhoSn1C3EVSnJ3cfU=",
+        "lastModified": 1774835836,
+        "narHash": "sha256-6ok7iv/9R82vl6MYe3Lwyyb6S5bmW2PxEZtmjzlqyPs=",
         "owner": "BirdeeHub",
         "repo": "nixCats-nvim",
-        "rev": "f69ea013e328841a7def7037ed59788a76be8816",
+        "rev": "ebb9f279a55ca60ff4e37e4accf6518dc627aa8d",
         "type": "github"
       },
       "original": {
@@ -488,15 +450,12 @@
       }
     },
     "nixos-hardware": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_2"
-      },
       "locked": {
-        "lastModified": 1780065812,
-        "narHash": "sha256-SCSLUKBmwlSLGQ8Xbr8PjRFtiHNk0l9ktqkcmqdBkfE=",
+        "lastModified": 1776983936,
+        "narHash": "sha256-ZOQyNqSvJ8UdrrqU1p7vaFcdL53idK+LOM8oRWEWh6o=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "b76b5639c0593e0aeb0b5879ad62d4b30596c144",
+        "rev": "2096f3f411ce46e88a79ae4eafcfc9df8ed41c61",
         "type": "github"
       },
       "original": {
@@ -508,40 +467,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1770107345,
-        "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=",
+        "lastModified": 1776877367,
+        "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "4533d9293756b63904b7238acb84ac8fe4c8c2c4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1767892417,
-        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
-        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
-      }
-    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1779560665,
-        "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
+        "rev": "0726a0ecb6d4e08f6adced58726b95db924cef57",
         "type": "github"
       },
       "original": {
@@ -551,7 +481,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_2": {
       "locked": {
         "lastModified": 1743689281,
         "narHash": "sha256-y7Hg5lwWhEOgflEHRfzSH96BOt26LaYfrYWzZ+VoVdg=",
@@ -579,11 +509,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779766384,
-        "narHash": "sha256-P7Ohnlq8b8b2fU+Sgkrej7LBTM60LBTkHleLuYzmLmU=",
+        "lastModified": 1775228139,
+        "narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "57800b7ab648725ccd33551d01484ee14952ad3f",
+        "rev": "601971b9c89e0304561977f2c28fa25e73aa7132",
         "type": "github"
       },
       "original": {
@@ -715,7 +645,6 @@
     "root": {
       "inputs": {
         "colmena": "colmena",
-        "comin": "comin",
         "disko": "disko",
         "firefox-addons": "firefox-addons",
         "git-hooks": "git-hooks",
@@ -723,7 +652,7 @@
         "nix-secrets": "nix-secrets",
         "nixgl": "nixgl",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs",
         "nvim": "nvim",
         "sops-nix": "sops-nix",
         "stylix": "stylix"
@@ -736,11 +665,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777944972,
-        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
+        "lastModified": 1776771786,
+        "narHash": "sha256-DRFGPfFV6hbrfO9a1PH1FkCi7qR5FgjSqsQGGvk1rdI=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
+        "rev": "bef289e2248991f7afeb95965c82fbcd8ff72598",
         "type": "github"
       },
       "original": {
@@ -785,11 +714,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1780079634,
-        "narHash": "sha256-VVyCrzwLitvxZGx48FgzvlbLYGQU99GsaQnZmwqZoUo=",
+        "lastModified": 1776893932,
+        "narHash": "sha256-AFD5cf9eNqXq1brHS63xeZy2xKZMgG9J86XJ9I2eLn8=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "ca07e0644716a7c13e91c6d92d169fc81889c589",
+        "rev": "84971726c7ef0bb3669a5443e151cc226e65c518",
         "type": "github"
       },
       "original": {
@@ -847,11 +776,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1777806186,
-        "narHash": "sha256-PDF0/wObw4nIsSBeXVYLsloXOiphXCgIdsrNcVXguKs=",
+        "lastModified": 1772661346,
+        "narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "0c94645546f4f3ddac77a1a5fce54eb95bf50795",
+        "rev": "13b5b0c299982bb361039601e2d72587d6846294",
         "type": "github"
       },
       "original": {
@@ -863,11 +792,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1778379944,
-        "narHash": "sha256-wPDFzMGSlARlw0Sfsn48Q2+jPSfk6N0Ng6BC/d+7Q24=",
+        "lastModified": 1772934010,
+        "narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "fe0203a198690e71a5ff11e08812a4673de3678d",
+        "rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d",
         "type": "github"
       },
       "original": {
@@ -879,11 +808,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1778378178,
-        "narHash": "sha256-OXPXRIQgGwV77HjYRryOHguh4ALX96jkg+tseLkGgHA=",
+        "lastModified": 1772909925,
+        "narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "9cd816033ff969415b190722cddf134e78a5665f",
+        "rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df",
         "type": "github"
       },
       "original": {
@@ -891,24 +820,6 @@
         "repo": "base16-zed",
         "type": "github"
       }
-    },
-    "treefmt-nix": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      },
-      "locked": {
-        "lastModified": 1770228511,
-        "narHash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "337a4fe074be1042a35086f15481d763b8ddc0e7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -3,6 +3,10 @@
     nixpkgs = {
       url = "github:nixos/nixpkgs/nixos-unstable";
     };
+    stylix = {
+      url = "github:danth/stylix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     nixos-hardware = {
       url = "github:NixOS/nixos-hardware/master";
     };
@@ -18,22 +22,6 @@
       url = "git+ssh://git@github.com/hektor/nix-secrets?shallow=1&ref=main";
       flake = false;
     };
-    colmena = {
-      url = "github:zhaofengli/colmena";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    comin = {
-      url = "github:nlewo/comin";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    git-hooks = {
-      url = "github:cachix/git-hooks.nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    stylix = {
-      url = "github:danth/stylix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -50,15 +38,23 @@
       url = "path:./dots/.config/nvim";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    colmena = {
+      url = "github:zhaofengli/colmena";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    git-hooks = {
+      url = "github:cachix/git-hooks.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
     {
       self,
       nixpkgs,
-      git-hooks,
       home-manager,
       nixgl,
+      git-hooks,
       ...
     }@inputs:
     let
@@ -80,10 +76,7 @@
           nixpkgs.lib.nixosSystem {
             modules = [
               ./hosts/${host}
-              {
-                nixpkgs.hostPlatform = (myUtils.hostMeta ./hosts/${host}).system;
-                host.name = host;
-              }
+              { nixpkgs.hostPlatform = (myUtils.hostMeta ./hosts/${host}).system; }
             ];
             specialArgs = {
               inherit
@@ -142,7 +135,6 @@
           };
           modules = [ ./home/hosts/work ];
           extraSpecialArgs = {
-            osConfig = null;
             inherit
               inputs
               outputs
@@ -153,9 +145,7 @@
         };
       };
 
-      apps.${system}.colmena = inputs.colmena.apps.${system}.default // {
-        meta.description = "colmena";
-      };
+      apps.${system}.colmena = inputs.colmena.apps.${system}.default;
 
       colmenaHive = import ./deploy/colmena.nix {
         inherit

home/hosts/andromache/default.nix

@@ -8,6 +8,30 @@
 {
   imports = [
     ../../modules
+    ../../modules/3d
+    ../../modules/ai-tools
+    ../../modules/anki
+    ../../modules/audio
+    ../../modules/browser
+    ../../modules/cloud
+    ../../modules/comms
+    ../../modules/desktop/niri
+    ../../modules/devenv
+    ../../modules/direnv
+    ../../modules/git
+    ../../modules/k8s/k9s.nix
+    ../../modules/keepassxc
+    ../../modules/music
+    ../../modules/nvim
+    ../../modules/pandoc
+    ../../modules/photography
+    ../../modules/secrets
+    ../../modules/shell
+    ../../modules/ssh
+    ../../modules/taskwarrior
+    ../../modules/terminal
+    ../../modules/zk
+    ../../modules/torrenting
   ];
 
   home = {
@@ -23,38 +47,14 @@
     printing.enable = true;
     modeling.enable = true;
   };
-  ai-tools = {
-    claude-code.enable = true;
-    opencode.enable = true;
-  };
-  desktop.niri.enable = true;
-  browser.enable = true;
+  ai-tools.opencode.enable = true;
   browser.primary = "librewolf";
   cloud.hetzner.enable = true;
   comms.signal.enable = true;
-  git.enable = true;
   git.github.enable = true;
-  shell = {
-    enable = true;
-    bash.aliases.lang-js = true;
-    bash.addBinToPath = true;
-  };
-  anki.enable = true;
-  k8s.k9s.enable = true;
-  secrets.enable = true;
-  taskwarrior.enable = true;
-  audio.enable = true;
-  ssh.enable = true;
-  music.enable = true;
-  terminal.enable = true;
-  devenv.enable = true;
-  keepassxc.enable = true;
-  direnv.enable = true;
-  nvim.enable = true;
-  pandoc.enable = true;
-  photography.enable = true;
+  shell.bash.aliases.lang-js = true;
+  shell.bash.addBinToPath = true;
   torrenting.enable = true;
-  my.yubikey.enable = true;
   zk.enable = true;
 
   programs = {

home/hosts/astyanax/default.nix

@@ -7,6 +7,28 @@
 {
   imports = [
     ../../modules
+    ../../modules/3d
+    ../../modules/ai-tools
+    ../../modules/anki
+    ../../modules/audio
+    ../../modules/browser
+    ../../modules/cloud
+    ../../modules/comms
+    ../../modules/desktop/niri
+    ../../modules/devenv
+    ../../modules/direnv
+    ../../modules/git
+    ../../modules/k8s/k9s.nix
+    ../../modules/keepassxc
+    ../../modules/music
+    ../../modules/nfc
+    ../../modules/nvim
+    ../../modules/pandoc
+    ../../modules/secrets
+    ../../modules/shell
+    ../../modules/ssh
+    ../../modules/taskwarrior
+    ../../modules/terminal
   ];
 
   home = {
@@ -21,38 +43,13 @@
   };
 
   modules."3d".printing.enable = true;
-  ai-tools = {
-    claude-code.enable = true;
-    opencode.enable = true;
-  };
-  anki.enable = true;
-  audio.enable = true;
-  browser.enable = true;
+  ai-tools.opencode.enable = true;
   browser.primary = "librewolf";
   cloud.hetzner.enable = true;
   comms.signal.enable = true;
-  desktop.niri.enable = true;
-  devenv.enable = true;
-  direnv.enable = true;
-  git.enable = true;
   git.github.enable = true;
-  k8s.k9s.enable = true;
-  keepassxc.enable = true;
-  music.enable = true;
-  my.yubikey.enable = true;
-  nfc.enable = true;
-  nvim.enable = true;
-  pandoc.enable = true;
-  secrets.enable = true;
-  shell = {
-    enable = true;
-    bash.aliases.lang-js = true;
-    bash.addBinToPath = true;
-  };
-  ssh.enable = true;
-  taskwarrior.enable = true;
-  terminal.enable = true;
-  reference-manager.enable = true;
+  shell.bash.aliases.lang-js = true;
+  shell.bash.addBinToPath = true;
 
   programs = {
     home-manager.enable = true;

home/hosts/packages.nix

@@ -3,9 +3,7 @@
 with pkgs;
 [
   bat
-  curl
   entr
-  fd
   feh
   fzf
   htop
@@ -15,6 +13,7 @@ with pkgs;
   parallel
   pass
   ripgrep
+  silver-searcher
   sops
   tldr
   tree

home/hosts/work/default.nix

@@ -8,8 +8,36 @@
 {
   imports = [
     inputs.sops-nix.homeManagerModules.sops
-    inputs.stylix.homeModules.stylix
     ../../modules
+    ../../modules/ai-tools
+    ../../modules/anki
+    ../../modules/browser
+    ../../modules/bruno
+    ../../modules/cloud
+    ../../modules/comms
+    ../../modules/database
+    ../../modules/dconf
+    ../../modules/desktop/niri
+    ../../modules/devenv
+    ../../modules/direnv
+    ../../modules/docker
+    ../../modules/git
+    ../../modules/go
+    ../../modules/infra
+    ../../modules/k8s
+    ../../modules/k8s/k9s.nix
+    ../../modules/keepassxc
+    ../../modules/music
+    ../../modules/nodejs
+    ../../modules/nvim
+    ../../modules/pandoc
+    ../../modules/secrets
+    ../../modules/shell
+    ../../modules/stylix
+    ../../modules/taskwarrior
+    ../../modules/ticketing
+    ../../modules/terminal
+    ../../modules/vscode
   ];
 
   sops.age.keyFile = "${config.home.homeDirectory}/.config/sops/age/keys.txt";
@@ -35,57 +63,21 @@
     defaultWrapper = "mesa";
   };
 
+  browser.primary = "firefox";
+  browser.secondary = "chromium";
+  cloud.azure.enable = true;
+  comms.signal.enable = true;
+  comms.teams.enable = true;
   ai-tools = {
     claude-code.enable = true;
     tirith.enable = true;
     opencode.enable = true;
   };
-  anki.enable = true;
-  browser = {
-    enable = true;
-    primary = "firefox";
-    secondary = "chromium";
-  };
-  bruno.enable = true;
-  cloud.azure.enable = true;
-  comms.signal.enable = true;
-  comms.teams.enable = true;
-  database = {
-    mssql.enable = true;
-    postgresql.enable = true;
-    redis.enable = true;
-  };
-  desktop.niri.enable = true;
-  devenv.enable = true;
-  direnv.enable = true;
-  docker.enable = true;
-  git = {
-    enable = true;
-    github.enable = true;
-    gitlab.enable = true;
-  };
-  go.enable = true;
-  k8s.enable = true;
-  keepassxc.enable = true;
-  music.enable = true;
-  my.dconf.enable = true;
-  my.stylix.enable = true;
-  nvim.enable = true;
-  pandoc.enable = true;
-  shell.enable = true;
-  taskwarrior.enable = true;
-  terminal.enable = true;
-  infra.enable = true;
-  nodejs.enable = true;
-  secrets.enable = true;
+  database.mssql.enable = true;
+  database.postgresql.enable = true;
+  git.github.enable = true;
+  git.gitlab.enable = true;
   secrets.vault.enable = true;
-  ticketing.enable = true;
-  vscode.enable = true;
-
-  services.home-manager.autoUpgrade = {
-    enable = true;
-    frequency = "weekly";
-  };
 
   programs = {
     gh.enable = true;

home/modules/ai-tools/claude-code.nix

@@ -1,60 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.ai-tools.claude-code;
-  rtk-version = "0.18.1";
-in
-{
-  options.ai-tools.claude-code.enable = lib.mkEnableOption "claude code with rtk and ccline";
-
-  config = lib.mkIf cfg.enable {
-    programs.claude-code.enable = true;
-
-    home.packages = with pkgs; [
-      (stdenv.mkDerivation {
-        name = "ccline";
-        src = fetchurl {
-          url = "https://github.com/Haleclipse/CCometixLine/releases/download/v1.0.8/ccline-linux-x64.tar.gz";
-          hash = "sha256-Joe3Dd6uSMGi66QT6xr2oY/Tz8rA5RuKa6ckBVJIzI0=";
-        };
-        unpackPhase = "tar xzf $src";
-        installPhase = ''
-          mkdir -p $out/bin
-          cp ccline $out/bin/
-          chmod +x $out/bin/ccline
-        '';
-        meta = {
-          description = "CCometixLine Linux x64 CLI (Claude Code statusline)";
-          homepage = "https://github.com/Haleclipse/CCometixLine";
-          license = lib.licenses.mit;
-          platforms = [ "x86_64-linux" ];
-        };
-      })
-      (stdenv.mkDerivation {
-        name = "rtk-${rtk-version}";
-        version = rtk-version;
-        src = fetchurl {
-          url = "https://github.com/rtk-ai/rtk/releases/download/v${rtk-version}/rtk-x86_64-unknown-linux-gnu.tar.gz";
-          hash = "sha256-XoTia5K8b00OzcKYCufwx8ApkAS31DxUCpGSU0jFs2Q=";
-        };
-        unpackPhase = "tar xzf $src";
-        installPhase = ''
-          mkdir -p $out/bin
-          cp rtk $out/bin/
-          chmod +x $out/bin/rtk
-        '';
-        meta = {
-          description = "RTK - AI coding tool enhancer";
-          homepage = "https://www.rtk-ai.app";
-          license = lib.licenses.mit;
-          platforms = [ "x86_64-linux" ];
-        };
-      })
-      mcp-nixos
-    ];
-  };
-}

home/modules/ai-tools/default.nix

@@ -1,8 +1,116 @@
 {
-  imports = [
-    ./claude-code.nix
-    ./opencode.nix
-    ./skills.nix
-    ./tirith.nix
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.ai-tools;
+  rtk-version = "0.18.1";
+in
+{
+  options.ai-tools = {
+    claude-code.enable = lib.mkEnableOption "claude code with rtk and ccline";
+    tirith.enable = lib.mkEnableOption "tirith shell security guard";
+    opencode.enable = lib.mkEnableOption "opencode";
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.claude-code.enable {
+      home.packages = with pkgs; [
+        claude-code
+        (pkgs.stdenv.mkDerivation {
+          name = "ccline";
+          src = pkgs.fetchurl {
+            url = "https://github.com/Haleclipse/CCometixLine/releases/download/v1.0.8/ccline-linux-x64.tar.gz";
+            hash = "sha256-Joe3Dd6uSMGi66QT6xr2oY/Tz8rA5RuKa6ckBVJIzI0=";
+          };
+
+          unpackPhase = ''
+            tar xzf $src
+          '';
+
+          installPhase = ''
+            mkdir -p $out/bin
+            cp ccline $out/bin/
+            chmod +x $out/bin/ccline
+          '';
+
+          meta = with pkgs.lib; {
+            description = "CCometixLine Linux x64 CLI (Claude Code statusline)";
+            homepage = "https://github.com/Haleclipse/CCometixLine";
+            license = licenses.mit;
+            platforms = [ "x86_64-linux" ];
+          };
+        })
+        (pkgs.stdenv.mkDerivation {
+          name = "rtk-${rtk-version}";
+          version = rtk-version;
+          src = pkgs.fetchurl {
+            url = "https://github.com/rtk-ai/rtk/releases/download/v${rtk-version}/rtk-x86_64-unknown-linux-gnu.tar.gz";
+            hash = "sha256-XoTia5K8b00OzcKYCufwx8ApkAS31DxUCpGSU0jFs2Q=";
+          };
+
+          unpackPhase = ''
+            tar xzf $src
+          '';
+
+          installPhase = ''
+            mkdir -p $out/bin
+            cp rtk $out/bin/
+            chmod +x $out/bin/rtk
+          '';
+
+          meta = with pkgs.lib; {
+            description = "RTK - AI coding tool enhancer";
+            homepage = "https://www.rtk-ai.app";
+            license = licenses.mit;
+            platforms = [ "x86_64-linux" ];
+          };
+        })
+        mcp-nixos
+      ];
+    })
+    (lib.mkIf cfg.tirith.enable {
+      home.packages = with pkgs; [
+        tirith
+      ];
+    })
+    (lib.mkIf (cfg.tirith.enable && cfg.claude-code.enable) {
+      home.file.".claude/hooks/tirith-check.py" = {
+        source = ./tirith-check.py;
+        executable = true;
+      };
+
+      home.activation.tirith-claude-code = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+        ${pkgs.tirith}/bin/tirith setup claude-code --with-mcp --scope user --force 2>/dev/null || true
+      '';
+    })
+    (lib.mkIf cfg.opencode.enable {
+      home.packages = with pkgs; [
+        opencode
+      ];
+      home.file.".config/opencode/opencode.json".text = builtins.toJSON {
+        "$schema" = "https://opencode.ai/config.json";
+        permission = {
+          external_directory = {
+            "/run/secrets/" = "deny";
+            "~/.config/sops/age/keys.txt" = "deny";
+            "~/.ssh/id_rsa" = "deny";
+            "~/.ssh/id_ed25519" = "deny";
+            "~/.ssh/id_ecdsa" = "deny";
+            "~/.ssh/id_dsa" = "deny";
+            "/etc/ssh/ssh_host_rsa_key" = "deny";
+            "/etc/ssh/ssh_host_ed25519_key" = "deny";
+            "/etc/ssh/ssh_host_ecdsa_key" = "deny";
+            "/etc/ssh/ssh_host_dsa_key" = "deny";
+          };
+          command = {
+            sops = "deny";
+          };
+        };
+        plugin = [ "@mohak34/opencode-notifier@latest" ];
+      };
+    })
   ];
 }

home/modules/ai-tools/opencode.nix

@@ -1,40 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.ai-tools.opencode;
-in
-{
-  options.ai-tools.opencode = {
-    enable = lib.mkEnableOption "opencode";
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.packages = [ pkgs.opencode ];
-
-    home.file.".config/opencode/opencode.json".text = builtins.toJSON {
-      "$schema" = "https://opencode.ai/config.json";
-      permission = {
-        external_directory = {
-          "/run/secrets/" = "deny";
-          "~/.config/sops/age/keys.txt" = "deny";
-          "~/.ssh/id_rsa" = "deny";
-          "~/.ssh/id_ed25519" = "deny";
-          "~/.ssh/id_ecdsa" = "deny";
-          "~/.ssh/id_dsa" = "deny";
-          "/etc/ssh/ssh_host_rsa_key" = "deny";
-          "/etc/ssh/ssh_host_ed25519_key" = "deny";
-          "/etc/ssh/ssh_host_ecdsa_key" = "deny";
-          "/etc/ssh/ssh_host_dsa_key" = "deny";
-        };
-        command = {
-          sops = "deny";
-        };
-      };
-      plugin = [ "@mohak34/opencode-notifier@latest" ];
-    };
-  };
-}

home/modules/ai-tools/skills.nix

@@ -1,49 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.ai-tools.claude-code;
-
-  skillType = lib.types.submodule {
-    options = {
-      owner = lib.mkOption { type = lib.types.str; };
-      repo = lib.mkOption { type = lib.types.str; };
-      rev = lib.mkOption { type = lib.types.str; };
-      hash = lib.mkOption { type = lib.types.str; };
-      skill = lib.mkOption { type = lib.types.str; };
-    };
-  };
-
-  fetchSkill =
-    skill:
-    let
-      src = pkgs.fetchFromGitHub {
-        inherit (skill)
-          owner
-          repo
-          rev
-          hash
-          ;
-      };
-    in
-    {
-      name = ".claude/skills/${skill.skill}";
-      value = {
-        source = "${src}/${skill.skill}";
-        recursive = true;
-      };
-    };
-in
-{
-  options.ai-tools.claude-code.skills = lib.mkOption {
-    type = lib.types.listOf skillType;
-    default = [ ];
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.file = builtins.listToAttrs (map fetchSkill cfg.skills);
-  };
-}

home/modules/ai-tools/tirith.nix

@@ -1,30 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.ai-tools.tirith;
-in
-{
-  options.ai-tools.tirith = {
-    enable = lib.mkEnableOption "tirith";
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfg.enable {
-      home.packages = [ pkgs.tirith ];
-    })
-    (lib.mkIf (cfg.enable && config.ai-tools.claude-code.enable) {
-      home.file.".claude/hooks/tirith-check.py" = {
-        source = ./tirith-check.py;
-        executable = true;
-      };
-
-      home.activation.tirith-claude-code = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
-        ${pkgs.tirith}/bin/tirith setup claude-code --with-mcp --scope user --force 2>/dev/null || true
-      '';
-    })
-  ];
-}

home/modules/anki/default.nix

@@ -9,16 +9,11 @@
 }:
 
 let
-  cfg = config.anki;
   sops = myUtils.sopsAvailability config osConfig;
   standalone = osConfig == null;
 in
-{
-  options.anki.enable = lib.mkEnableOption "Anki";
-
-  config = lib.mkIf cfg.enable (
 lib.optionalAttrs standalone {
-      sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" {
+  sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
     anki = [
       "sync-user"
       "sync-key"
@@ -27,24 +22,14 @@ in
 }
 // {
   warnings = lib.optional (
-        !sops.available
+    !sops.available && config.programs.anki.enable
   ) "anki is enabled but sops secrets are not available. anki sync will not be configured.";
 
   programs.anki = {
     enable = true;
     package = config.nixgl.wrap pkgs.anki;
     addons = with pkgs.ankiAddons; [
-          (anki-connect.withConfig {
-            # https://git.sr.ht/~foosoft/anki-connect/tree/master/item/plugin/config.json
-            config = {
-              apiKey = null;
-              apiLogPath = null;
-              webBindAddress = "127.0.0.1";
-              webBindPort = 8765;
-              webCorsOriginList = [ "http://localhost" ];
-              ignoreOriginList = [ ];
-            };
-          })
+      anki-connect
       puppy-reinforcement
       review-heatmap
     ];
@@ -54,5 +39,3 @@ in
     };
   };
 }
-  );
-}

home/modules/audio/default.nix

@@ -1,19 +1,7 @@
-{
-  config,
-  lib,
-  pkgs,
-  osConfig,
-  ...
-}:
+{ osConfig, pkgs, ... }:
 
-let
-  cfg = config.audio;
-in
 {
-  options.audio.enable = lib.mkEnableOption "audio";
-
-  config = lib.mkIf cfg.enable {
   home.packages = with pkgs; [ pulsemixer ];
+
   services.mpris-proxy.enable = osConfig.hardware.bluetooth.enable or false;
-  };
 }

home/modules/browser/default.nix

@@ -1,19 +1,7 @@
-{
-  config,
-  lib,
-  ...
-}:
+{ config, lib, ... }:
 
 {
-  imports = [
-    ./firefox.nix
-    ./librewolf.nix
-    ./chromium.nix
-  ];
-
   options.browser = {
-    enable = lib.mkEnableOption "browser";
-
     primary = lib.mkOption {
       type = lib.types.enum [
         "firefox"
@@ -35,7 +23,11 @@
     };
   };
 
-  config = lib.mkIf config.browser.enable {
-    home.sessionVariables.BROWSER = config.browser.primary;
-  };
+  config.home.sessionVariables.BROWSER = config.browser.primary;
+
+  imports = [
+    ./firefox.nix
+    ./librewolf.nix
+    ./chromium.nix
+  ];
 }

home/modules/browser/firefox.nix

@@ -10,7 +10,6 @@
   config = lib.mkIf (config.browser.primary == "firefox" || config.browser.secondary == "firefox") {
     programs.firefox = {
       enable = true;
-      configPath = "${config.xdg.configHome}/mozilla/firefox";
     }
     // (import ./firefox-base.nix {
       inherit

home/modules/bruno/default.nix

@@ -1,19 +1,7 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ config, pkgs, ... }:
 
-let
-  cfg = config.bruno;
-in
 {
-  options.bruno = {
-    enable = lib.mkEnableOption "Bruno";
-  };
-
-  config = lib.mkIf cfg.enable {
+  config = {
     home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.bruno "--no-sandbox")) ];
   };
 }

home/modules/clipboard/default.nix

@@ -1,21 +1,7 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ pkgs, ... }:
 
-let
-  cfg = config.clipboard;
-in
 {
-  options.clipboard = {
-    enable = lib.mkEnableOption "clipboard";
-  };
-
-  config = lib.mkIf cfg.enable {
   home.packages = with pkgs; [
     wl-clipboard
   ];
-  };
 }

home/modules/cloud/default.nix

@@ -3,10 +3,10 @@
 {
   options.cloud = {
     azure = {
-      enable = lib.mkEnableOption "Azure CLI";
+      enable = lib.mkEnableOption "azure CLI";
     };
     hetzner = {
-      enable = lib.mkEnableOption "Hetzner CLI";
+      enable = lib.mkEnableOption "hetzner CLI";
     };
   };
 

home/modules/database/default.nix

@@ -9,18 +9,14 @@
   options.database = {
     mssql.enable = lib.mkEnableOption "MSSQL";
     postgresql.enable = lib.mkEnableOption "PostgreSQL";
-    redis.enable = lib.mkEnableOption "Redis";
   };
 
   config = lib.mkMerge [
     (lib.mkIf config.database.mssql.enable {
-      home.packages = with pkgs; [ (config.nixgl.wrap dbeaver-bin) ];
+      home.packages = [ (config.nixgl.wrap pkgs.dbeaver-bin) ];
     })
     (lib.mkIf config.database.postgresql.enable {
-      home.packages = with pkgs; [ (config.nixgl.wrap pgadmin4-desktopmode) ];
-    })
-    (lib.mkIf config.database.postgresql.enable {
-      home.packages = with pkgs; [ redis ];
+      home.packages = [ (config.nixgl.wrap pkgs.pgadmin4-desktopmode) ];
     })
   ];
 }

home/modules/dconf/default.nix

@@ -1,22 +1,11 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ config, pkgs, ... }:
 
 let
-  cfg = config.my.dconf;
   terminal = "kitty";
   browser = config.browser.primary;
   font = "${config.stylix.fonts.monospace.name} ${toString config.stylix.fonts.sizes.applications}";
 in
 {
-  options.my.dconf = {
-    enable = lib.mkEnableOption "dconf";
-  };
-
-  config = lib.mkIf cfg.enable {
   dconf.settings = {
     "org/gnome/desktop/background" = {
       color-shading-type = "solid";
@@ -52,7 +41,7 @@ in
       clock-show-weekday = true;
       color-scheme = "prefer-dark";
       enable-hot-corners = false;
-        # font-name = font;
+      font-name = font;
       locate-pointer = true;
       monospace-font-name = font;
     };
@@ -133,5 +122,4 @@ in
   };
 
   home.packages = with pkgs; [ dconf2nix ];
-  };
 }

home/modules/default.nix

@@ -6,13 +6,6 @@
 }:
 
 {
-  imports =
-    let
-      dirs = lib.attrNames (lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./.));
-      hasDef = name: builtins.pathExists ./${name}/default.nix;
-    in
-    map (name: ./${name}) (builtins.filter hasDef dirs);
-
   options = {
     host.username = lib.mkOption {
       type = lib.types.str;

home/modules/desktop/default.nix

@@ -1,5 +0,0 @@
-{ ... }:
-
-{
-  imports = [ ./niri ];
-}

home/modules/desktop/niri/config.kdl

@@ -179,5 +179,4 @@ binds {
     Alt+Print  { screenshot-window; }
 
     Mod+Shift+Delete { quit; }
-
 }

home/modules/desktop/niri/default.nix

@@ -1,9 +1,4 @@
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
+{ pkgs, ... }:
 
 {
   imports = [
@@ -14,15 +9,6 @@
     ../../waybar
   ];
 
-  options.desktop.niri.enable = lib.mkEnableOption "niri desktop";
-
-  config = lib.mkIf config.desktop.niri.enable {
-    clipboard.enable = lib.mkDefault true;
-    fuzzel.enable = lib.mkDefault true;
-    mako.enable = lib.mkDefault true;
-    shikane.enable = lib.mkDefault true;
-    waybar.enable = lib.mkDefault true;
-
   home = {
     file.".config/niri/config.kdl".source = ./config.kdl;
     packages = with pkgs; [
@@ -37,35 +23,4 @@
     latitude = 51.05;
     longitude = 3.71667;
   };
-
-    xdg.configFile."electron-flags.conf".text = ''
-      --enable-features=UseOzonePlatform
-      --ozone-platform=wayland
-    '';
-
-    xdg.portal = {
-      enable = true;
-      config = {
-        niri = {
-          default = [
-            "gnome"
-            "gtk"
-          ];
-          "org.freedesktop.impl.portal.Access" = "gtk";
-          "org.freedesktop.impl.portal.Notification" = "gtk";
-          "org.freedesktop.impl.portal.Secret" = "gnome-keyring";
-          "org.freedesktop.impl.portal.FileChooser" = "gtk";
-          "org.freedesktop.impl.portal.ScreenCast" = [ "gnome" ];
-          "org.freedesktop.impl.portal.Settings" = [
-            "gnome"
-            "gtk"
-          ];
-        };
-      };
-      extraPortals = [
-        pkgs.xdg-desktop-portal-gtk
-        pkgs.xdg-desktop-portal-gnome
-      ];
-    };
-  };
 }

home/modules/devenv/default.nix

@@ -1,19 +1,4 @@
+{ pkgs, ... }:
 {
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.devenv;
-in
-{
-  options.devenv = {
-    enable = lib.mkEnableOption "devenv";
-  };
-
-  config = lib.mkIf cfg.enable {
   home.packages = [ pkgs.devenv ];
-  };
 }

home/modules/direnv/default.nix

@@ -1,20 +1,7 @@
 {
-  config,
-  lib,
-  ...
-}:
-
-let
-  cfg = config.direnv;
-in
-{
-  options.direnv.enable = lib.mkEnableOption "direnv";
-
-  config = lib.mkIf cfg.enable {
   programs.direnv = {
     enable = true;
     enableBashIntegration = true;
     nix-direnv.enable = true;
   };
-  };
 }

home/modules/docker/default.nix

@@ -1,21 +1,7 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ pkgs, ... }:
 
-let
-  cfg = config.docker;
-in
 {
-  options.docker = {
-    enable = lib.mkEnableOption "Docker";
-  };
-
-  config = lib.mkIf cfg.enable {
   home.packages = with pkgs; [
     dive
   ];
-  };
 }

home/modules/fuzzel/default.nix

@@ -1,16 +1,4 @@
 {
-  config,
-  lib,
-  ...
-}:
-
-let
-  cfg = config.fuzzel;
-in
-{
-  options.fuzzel.enable = lib.mkEnableOption "fuzzel";
-
-  config = lib.mkIf cfg.enable {
   programs.fuzzel = {
     enable = true;
     settings = {
@@ -24,5 +12,4 @@ in
       };
     };
   };
-  };
 }

home/modules/git/default.nix

@@ -8,12 +8,11 @@
 
 {
   options.git = {
-    enable = lib.mkEnableOption "git";
     github.enable = lib.mkEnableOption "Github CLI";
     gitlab.enable = lib.mkEnableOption "Gitlab CLI";
   };
 
-  config = lib.mkIf config.git.enable {
+  config = {
     programs.git.enable = true;
     home.file = {
       ".gitconfig".source = dotsPath + "/.gitconfig";

home/modules/go/default.nix

@@ -1,22 +1,7 @@
+{ pkgs, ... }:
 {
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.go;
-in
-{
-  options.go = {
-    enable = lib.mkEnableOption "Go";
-  };
-
-  config = lib.mkIf cfg.enable {
   home.packages = with pkgs; [
     go
     gopls
   ];
-  };
 }

home/modules/infra/default.nix

@@ -1,19 +1,7 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ pkgs, ... }:
 
-let
-  cfg = config.infra;
-in
 {
-  options.infra = {
-    enable = lib.mkEnableOption "infrastructure tools";
-  };
-
-  config = lib.mkIf cfg.enable {
+  config = {
     home.packages = with pkgs; [
       opentofu
       upbound

home/modules/k8s/default.nix

@@ -1,25 +1,6 @@
+{ pkgs, ... }:
+
 {
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.k8s;
-in
-{
-  imports = [
-    ./helm.nix
-    ./k9s.nix
-  ];
-
-  options.k8s.enable = lib.mkEnableOption "k8s";
-
-  config = lib.mkIf cfg.enable {
-    k8s.helm.enable = lib.mkDefault true;
-    k8s.k9s.enable = lib.mkDefault true;
-
   home.packages = with pkgs; [
     argocd
     fluxcd
@@ -40,5 +21,9 @@ in
   home.shellAliases = {
     k = "kubectl";
   };
-  };
+
+  imports = [
+    ./helm.nix
+    ./k9s.nix
+  ];
 }

home/modules/k8s/helm.nix

@@ -1,17 +1,6 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ pkgs, ... }:
 
-let
-  cfg = config.k8s.helm;
-in
 {
-  options.k8s.helm.enable = lib.mkEnableOption "helm";
-
-  config = lib.mkIf cfg.enable {
   home.packages = with pkgs; [
     (wrapHelm kubernetes-helm {
       plugins = with kubernetes-helmPlugins; [
@@ -23,5 +12,4 @@ in
       ];
     })
   ];
-  };
 }

home/modules/k8s/k9s.nix

@@ -1,16 +1,4 @@
 {
-  config,
-  lib,
-  ...
-}:
-
-let
-  cfg = config.k8s.k9s;
-in
-{
-  options.k8s.k9s.enable = lib.mkEnableOption "";
-
-  config = lib.mkIf cfg.enable {
   programs.k9s = {
     enable = true;
     settings.k9s = {
@@ -20,5 +8,4 @@ in
       };
     };
   };
-  };
 }

home/modules/keepassxc/default.nix

@@ -1,21 +1,8 @@
 {
-  config,
-  lib,
-  ...
-}:
-
-let
-  cfg = config.keepassxc;
-in
-{
-  options.keepassxc.enable = lib.mkEnableOption "KeePassXC";
-
-  config = lib.mkIf cfg.enable {
   programs.keepassxc = {
     enable = true;
     settings = {
       Browser.Enabled = true;
     };
   };
-  };
 }

home/modules/mako/default.nix

@@ -1,16 +1,5 @@
 {
-  config,
-  lib,
-  ...
-}:
-
-let
-  cfg = config.mako;
-in
-{
-  options.mako.enable = lib.mkEnableOption "mako";
-
-  config = lib.mkIf cfg.enable {
-    services.mako.enable = true;
+  services.mako = {
+    enable = true;
   };
 }

home/modules/music/default.nix

@@ -1,13 +1,10 @@
 {
-  config,
-  lib,
-  pkgs,
   dotsPath,
+  pkgs,
   ...
 }:
 
 let
-  cfg = config.music;
   spotifyWithWayland = pkgs.symlinkJoin {
     name = "spotify";
     paths = [ pkgs.spotify ];
@@ -19,14 +16,12 @@ let
   };
 in
 {
-  options.music.enable = lib.mkEnableOption "music";
-
-  config = lib.mkIf cfg.enable {
-    home.packages = [ spotifyWithWayland ];
+  home.packages = with pkgs; [
+    spotifyWithWayland
+  ];
 
   programs.ncspot = {
     enable = true;
-      settings = fromTOML (builtins.readFile (dotsPath + "/.config/ncspot/config.toml"));
-    };
+    settings = builtins.fromTOML (builtins.readFile (dotsPath + "/.config/ncspot/config.toml"));
   };
 }

home/modules/nfc/default.nix

@@ -1,21 +1,5 @@
 {
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.nfc;
-in
-{
-  options.nfc = {
-    enable = lib.mkEnableOption "NFC tools";
-  };
-
-  config = lib.mkIf cfg.enable {
-    home.packages = [
-      (pkgs.proxmark3.override { withGeneric = true; })
+  imports = [
+    ./proxmark3.nix
   ];
-  };
 }

home/modules/nfc/proxmark3.nix

@@ -0,0 +1,6 @@
+{ pkgs, ... }:
+{
+  home.packages = [
+    (pkgs.proxmark3.override { withGeneric = true; })
+  ];
+}

home/modules/nodejs/default.nix

@@ -5,21 +5,15 @@
   ...
 }:
 
-let
-  cfg = config.nodejs;
-in
 {
-  options.nodejs = {
-    enable = lib.mkEnableOption "Node.js";
-    package = lib.mkOption {
+  options.nodejs.package = lib.mkOption {
     type = lib.types.package;
     default = pkgs.nodejs_24;
   };
-  };
 
-  config = lib.mkIf cfg.enable {
+  config = {
     home.packages = with pkgs; [
-      cfg.package
+      config.nodejs.package
       pnpm
       yarn
       biome

home/modules/nvim/default.nix

@@ -1,20 +1,7 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  ...
-}:
+{ pkgs, inputs, ... }:
 
-let
-  cfg = config.nvim;
-in
 {
-  options.nvim.enable = lib.mkEnableOption "nvim";
-
-  config = lib.mkIf cfg.enable {
   home.packages = [
     inputs.nvim.packages.${pkgs.stdenv.hostPlatform.system}.nvim
   ];
-  };
 }

home/modules/pandoc/default.nix

@@ -1,23 +1,8 @@
+{ pkgs, ... }:
 {
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.pandoc;
-in
-{
-  options.pandoc = {
-    enable = lib.mkEnableOption "pandoc";
-  };
-
-  config = lib.mkIf cfg.enable {
   home.packages = with pkgs; [
     haskellPackages.pandoc-crossref
     pandoc
     texliveSmall
   ];
-  };
 }

home/modules/photography/default.nix

@@ -1,21 +1,7 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ pkgs, ... }:
 
-let
-  cfg = config.photography;
-in
 {
-  options.photography = {
-    enable = lib.mkEnableOption "photography";
-  };
-
-  config = lib.mkIf cfg.enable {
   home.packages = with pkgs; [
     darktable
   ];
-  };
 }

home/modules/reference-manager/default.nix

@@ -1,37 +0,0 @@
-{
-  config,
-  inputs,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.reference-manager;
-
-  hasBrowser =
-    name:
-    lib.elem name [
-      config.browser.primary
-      config.browser.secondary
-    ];
-
-  zoteroConnector =
-    inputs.firefox-addons.packages.${pkgs.stdenv.hostPlatform.system}.zotero-connector;
-  zoteroAddonId = "zotero@chnm.gmu.edu";
-
-  connectorExtension = {
-    profiles.default.extensions.packages = [ zoteroConnector ];
-    policies.ExtensionSettings.${zoteroAddonId}.default_area = "navbar";
-  };
-in
-{
-  options.reference-manager.enable = lib.mkEnableOption "reference manager (Zotero)";
-
-  config = lib.mkIf cfg.enable {
-    home.packages = [ pkgs.zotero ];
-
-    programs.firefox = lib.mkIf (hasBrowser "firefox") connectorExtension;
-    programs.librewolf = lib.mkIf (hasBrowser "librewolf") connectorExtension;
-  };
-}

home/modules/secrets/default.nix

@@ -1,19 +1,13 @@
 {
-  config,
-  lib,
   pkgs,
   ...
 }:
 {
   imports = [ ./vault.nix ];
 
-  options.secrets.enable = lib.mkEnableOption "secrets";
-
-  config = lib.mkIf config.secrets.enable {
   home.packages = with pkgs; [
     age
-      age-plugin-yubikey
+    age-plugin-yubikey # TODO: only needed when using Yubikey
     sops
   ];
-  };
 }

home/modules/shell/bash.nix

@@ -4,12 +4,13 @@
   dotsPath,
   ...
 }:
-
 let
   cfg = config.shell.bash;
   inherit (config.home) username;
 in
 {
+  imports = [ ./utils.nix ];
+
   options.shell.bash = {
     aliases = {
       all = lib.mkOption {
@@ -33,7 +34,7 @@ in
     };
   };
 
-  config = lib.mkIf config.shell.enable {
+  config = {
     programs.bash = {
       enable = true;
       enableCompletion = true;

home/modules/shell/default.nix

@@ -1,9 +1,3 @@
-{
-  config,
-  lib,
-  ...
-}:
-
 {
   imports = [
     ./bash.nix
@@ -11,10 +5,4 @@
     ./prompt.nix
     ../tmux
   ];
-
-  options.shell.enable = lib.mkEnableOption "shell";
-
-  config = lib.mkIf config.shell.enable {
-    tmux.enable = lib.mkDefault true;
-  };
 }

home/modules/shell/prompt.nix

@@ -1,18 +1,3 @@
 {
-  config,
-  lib,
-  ...
-}:
-
-{
-  config = lib.mkIf config.shell.enable {
-    programs.starship = {
-      enable = true;
-      settings = {
-        git_status = {
-          ahead = "⇡$\{count\}";
-        };
-      };
-    };
-  };
+  programs.starship.enable = true;
 }

home/modules/shell/utils.nix

@@ -1,12 +1,9 @@
 {
-  config,
   lib,
   pkgs,
   ...
 }:
-
 {
-  config = lib.mkIf config.shell.enable {
   programs.fzf = {
     enable = true;
     enableBashIntegration = lib.mkDefault true;
@@ -19,5 +16,4 @@
     entr
     parallel
   ];
-  };
 }

home/modules/shikane/default.nix

@@ -1,70 +1,6 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ pkgs, ... }:
 
 {
-  options.shikane.enable = lib.mkEnableOption "shikane";
-
-  config = lib.mkIf config.shikane.enable {
-    home.packages = with pkgs; [ (config.nixgl.wrap wdisplays) ];
+  home.packages = with pkgs; [ wdisplays ];
   services.shikane.enable = true;
-    home.file.".config/shikane/config.toml" = {
-      force = true;
-      text = ''
-        [[profile]]
-        name = "work"
-
-        [[profile.output]]
-        enable = true
-        search = ["m=Unknown", "s=", "v=Unknown"]
-        mode = "2880x1800@120Hz"
-        position = "288,3240"
-        scale = 1.5
-        transform = "normal"
-        adaptive_sync = false
-
-        [[profile.output]]
-        enable = true
-        search = ["m=Q27P1B", "s=GNXM2HA196769", "v=PNP(AOC)"]
-        mode = "2560x1440@59.951Hz"
-        position = "116,1800"
-        scale = 1.0
-        transform = "normal"
-        adaptive_sync = false
-
-        [[profile.output]]
-        enable = true
-        search = ["m=PHL 243S7", "s=UHB1923012753", "v=Philips Consumer Electronics Company"]
-        mode = "1920x1080@60Hz"
-        position = "2676,1800"
-        scale = 1.0
-        transform = "270"
-        adaptive_sync = false
-
-        [[profile]]
-        name = "home"
-
-        [[profile.output]]
-        enable = true
-        search = ["m=Unknown", "s=Unknown", "v=Unknown"]
-        mode = "2880x1800@60.001Hz"
-        position = "185,1440"
-        scale = 1.75
-        transform = "normal"
-        adaptive_sync = false
-
-        [[profile.output]]
-        enable = true
-        search = ["m=PHL 276E8V", "s=0x0000046D", "v=Philips Consumer Electronics Company"]
-        mode = "3840x2160@59.996Hz"
-        position = "1500,0"
-        scale = 1.5
-        transform = "normal"
-        adaptive_sync = false
-      '';
-    };
-  };
 }

home/modules/ssh/README.md

@@ -1,52 +0,0 @@
-# SSH keys
-
-* primary keys (host-specific, non-resident)
-* backup key (shared, resident)
-
-## generate keys
-
-### YubiKey 01 - `host_01`
-
-```sh
-ssh-keygen -t ed25519-sk \
-  -O verify-required \
-  -f ~/.ssh/id_ed25519_sk \
-  -C "h@host_01"
-```
-
-### YubiKey 01 — `host_02`
-
-```sh
-ssh-keygen -t ed25519-sk \
-  -O verify-required \
-  -f ~/.ssh/id_ed25519_sk \
-  -C "h@host_02"
-```
-
-### YubiKey 02 - `host_*`
-
-```sh
-ssh-keygen -t ed25519-sk \
-  -O resident \
-  -O verify-required \
-  -f ~/.ssh/id_ed25519_sk_bak \
-  -C "backup"
-```
-
-## register keys
-
-when you the primary key (`id_ed25519_sk.pub`), make sure to also register the
-backup key (`id_ed25519_sk_bak.pub`) if needed.
-
-## recovery scenarios
-
-| scenario | recovery |
-|---|---|
-| primary key file lost | generate new primary key on that device, re-register (use backup key) |
-| primary YubiKey lost  | generate new primary keys on all devices using new YubiKey (use backup key) |
-| backup key file lost | regenerate from backup YubiKey resident key (use `ssh-keygen -K`) |
-| backup YubiKey lost | generate resident backup key, distribute across hosts, re-register (use primary key) |
-
-## references
-
-* <https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html>

home/modules/ssh/default.nix

@@ -1,13 +1,10 @@
 {
-  config,
+  myUtils,
   lib,
   pkgs,
-  myUtils,
   ...
 }:
-
 let
-  cfg = config.ssh;
   hostDir = ../../hosts;
   hostNames = myUtils.dirNames hostDir;
   hostsWithKeys = lib.filter (
@@ -15,38 +12,29 @@ let
   ) hostNames;
 in
 {
-  options.ssh.enable = lib.mkEnableOption "ssh";
-
-  config = lib.mkIf cfg.enable {
   home.packages = with pkgs; [ sshfs ];
 
   programs.ssh = {
     enable = true;
     enableDefaultConfig = false;
 
-      settings =
+    matchBlocks =
       lib.genAttrs hostsWithKeys (
         hostname:
         let
           meta = myUtils.hostMeta (hostDir + "/${hostname}");
-            isLocal = builtins.elem "local" meta.tags;
         in
         {
-            User = meta.host.username;
+          host = hostname;
+          user = meta.deployment.targetUser;
         }
-          // lib.optionalAttrs (!isLocal) {
-            HostName = hostname;
+        // lib.optionalAttrs (meta.deployment.targetHost != "") {
+          hostname = meta.deployment.targetHost;
         }
       )
       // {
         "*" = {
-            AddKeysToAgent = "yes";
-            ForwardAgent = false;
-            identityFile = [
-              "~/.ssh/id_ed25519_sk"
-              "~/.ssh/id_ed25519_sk_bak"
-            ];
-          };
+          addKeysToAgent = "yes";
         };
       };
   };

home/modules/stylix/default.nix

@@ -1,18 +1,16 @@
 {
   config,
-  lib,
+  inputs,
   pkgs,
   ...
 }:
 
 let
-  cfg = config.my.stylix;
   theme = import ../../../modules/stylix/theme.nix { inherit pkgs; };
 in
 {
-  options.my.stylix.enable = lib.mkEnableOption "stylix";
+  imports = [ inputs.stylix.homeModules.stylix ];
 
-  config = lib.mkIf cfg.enable {
   stylix = {
     enable = true;
     inherit (theme)
@@ -29,5 +27,4 @@ in
     };
     targets = import ../../../modules/stylix/targets.nix;
   };
-  };
 }

home/modules/taskwarrior/default.nix

@@ -10,17 +10,12 @@
 }:
 
 let
-  cfg = config.taskwarrior;
   sops = myUtils.sopsAvailability config osConfig;
   standalone = osConfig == null;
 in
-{
-  options.taskwarrior.enable = lib.mkEnableOption "taskwarrior";
-
-  config = lib.mkIf cfg.enable (
 lib.optionalAttrs standalone {
   sops = {
-        secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" {
+    secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
       taskwarrior = [
         "sync-server-url"
         "sync-server-client-id"
@@ -38,8 +33,9 @@ in
   };
 }
 // {
+
   warnings =
-        lib.optional (!sops.available)
+    lib.optional (!sops.available && config.programs.taskwarrior.enable)
       "taskwarrior is enabled, but sops templates are not available. taskwarrior sync will not be configured.";
 
   home.packages = with pkgs; [
@@ -74,12 +70,10 @@ in
     colorTheme = "dark-256";
     config = {
       recurrence = "off";
-          reserved.lines = 3;
+      reserved.lines = 3; # without this I would have to scroll up 3 lines
     };
     extraConfig = lib.optionalString sops.available ''
       include ${sops.templates."taskrc.d/sync".path}
     '';
   };
 }
-  );
-}

home/modules/terminal/default.nix

@@ -1,18 +1,12 @@
 {
-  config,
-  lib,
   pkgs,
+  config,
   dotsPath,
   ...
 }:
 
-let
-  cfg = config.terminal;
-in
 {
-  options.terminal.enable = lib.mkEnableOption "terminal";
-
-  config = lib.mkIf cfg.enable {
+  config = {
     programs.bash.shellAliases = {
       icat = "kitty +kitten icat";
     };

home/modules/ticketing/default.nix

@@ -1,21 +1,7 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ pkgs, ... }:
 
-let
-  cfg = config.ticketing;
-in
 {
-  options.ticketing = {
-    enable = lib.mkEnableOption "ticketing";
-  };
-
-  config = lib.mkIf cfg.enable {
   home.packages = with pkgs; [
     jira-cli-go
   ];
-  };
 }

home/modules/tmux/default.nix

@@ -1,18 +1,7 @@
-{
-  config,
-  lib,
-  pkgs,
-  dotsPath,
-  ...
-}:
+{ pkgs, dotsPath, ... }:
 
-let
-  cfg = config.tmux;
-in
 {
-  options.tmux.enable = lib.mkEnableOption "tmux";
-
-  config = lib.mkIf cfg.enable {
+  config = {
     home.packages = with pkgs; [
       tmuxp
       reptyr
@@ -22,5 +11,9 @@ in
       enable = true;
       extraConfig = builtins.readFile (dotsPath + "/.config/tmux/tmux.conf");
     };
+
+    home.file = {
+      ".config/tmux/hooks/tmux.ssh.conf".source = dotsPath + "/.config/tmux/hooks/tmux.ssh.conf";
+    };
   };
 }

home/modules/torrenting/default.nix

@@ -10,7 +10,7 @@ let
 in
 {
   options.torrenting = {
-    enable = lib.mkEnableOption "torrenting";
+    enable = lib.mkEnableOption "transmission torrent client";
   };
 
   config = lib.mkIf cfg.enable {

home/modules/vscode/default.nix

@@ -1,19 +1,7 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ config, pkgs, ... }:
 
-let
-  cfg = config.vscode;
-in
 {
-  options.vscode = {
-    enable = lib.mkEnableOption "Visual Studio Code";
-  };
-
-  config = lib.mkIf cfg.enable {
+  config = {
     home.packages = [ (config.nixgl.wrap (config.wrapApp pkgs.vscode "--no-sandbox")) ];
   };
 }

home/modules/waybar/default.nix

@@ -1,24 +1,11 @@
-{
-  config,
-  lib,
-  ...
-}:
-
-let
-  cfg = config.waybar;
-in
 {
   imports = [
     ./settings.nix
     ./style.nix
   ];
 
-  options.waybar.enable = lib.mkEnableOption "waybar";
-
-  config = lib.mkIf cfg.enable {
   programs.waybar = {
     enable = true;
     systemd.enable = true;
   };
-  };
 }

home/modules/yubikey/default.nix

@@ -1,19 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-{
-  options.my.yubikey = {
-    enable = lib.mkEnableOption "yubikey";
-  };
-
-  config = lib.mkIf config.my.yubikey.enable {
-    home.packages = with pkgs; [
-      yubikey-manager
-      yubikey-personalization
-    ];
-  };
-}

home/modules/zk/scripts/zk.sh

@@ -1,6 +1,6 @@
-current_zettel_path="$(cat "$ZK_PATH/current-zettel.txt")"
+current_zettel_path="$ZK_PATH/$(cat "$ZK_PATH/current-zettel.txt")"
 
-if [ -n "${TMUX:-}" ]; then
+if [ -n "$TMUX" ]; then
   cd "$ZK_PATH" && $EDITOR "$current_zettel_path"
 else
   echo 'Not in tmux'
@@ -10,9 +10,13 @@ else
   read -r -p 'Enter your choice: ' choice
   case $choice in
     1)
-      if tmux has-session -t zk 2>/dev/null; then
-        tmux attach -t zk
+      # Check if a tmux session is running with a window named zk
+      if tmux list-windows -F '#{window_name}' | grep -q zk; then
+        # Attach to the session containing the 'zk' window
+        session="$(tmux list-windows -F '#{window_name} #{session_name}' | grep zk | head -n 1 | awk '{ print $2 }')"
+        tmux attach -t "$session"
       else
+        # Create session with a window named 'zk' and start nvim
         tmux new-session -s zk -n zk -d
         tmux send-keys -t zk:zk "cd $ZK_PATH && $EDITOR $current_zettel_path" Enter
         tmux attach -t zk

hosts/andromache/default.nix

@@ -7,73 +7,62 @@
 }:
 
 let
-  meta = import ./meta.nix;
   wolInterfaces = import ./wol-interfaces.nix;
 in
 {
   imports = [
     inputs.disko.nixosModules.disko
+    ./hard.nix
+    ./host.nix
     inputs.nixos-hardware.nixosModules.common-cpu-intel
     inputs.nixos-hardware.nixosModules.common-pc
     inputs.nixos-hardware.nixosModules.common-pc-ssd
-    ../../modules
+    ../../modules/common
+    ../../modules/boot/bootloader.nix
     (import ../../modules/disko/zfs-encrypted-root.nix {
       inherit lib config;
       device = "/dev/nvme1n1";
     })
+    ../../modules/ai-tools
+    ../../modules/anki
+    ../../modules/audio
+    ../../modules/backups
+    ../../modules/bluetooth
+    ../../modules/desktops/niri
+    ../../modules/docker
+    ../../modules/firewall
+    ../../modules/fonts
+    ../../modules/gaming
+    ../../modules/git
+    ../../modules/hcloud
+    ../../modules/keyboard
+    ../../modules/localization
+    ../../modules/networking
+    ../../modules/nvidia
+    ../../modules/secrets
+    ../../modules/ssh
+    ../../modules/storage
+    ../../modules/stylix
+    ../../modules/syncthing
+    ../../modules/tailscale
+    ../../modules/taskwarrior
+    ../../modules/users
+    ../../modules/wol
+    ../../modules/yubikey
   ];
 
-  inherit (meta) host;
+  home-manager.users.${config.host.username} = import ../../home/hosts/andromache;
 
-  hardware.facter.reportPath = ./facter.json;
-  home-manager.users.${config.host.username} = import ../../home/hosts/${config.host.name};
+  ssh.authorizedHosts = [ "astyanax" ];
+
+  secrets.nixSigningKey.enable = true;
 
-  "ai-tools".enable = true;
-  anki.enable = true;
-  audio.enable = true;
-  bluetooth.enable = true;
-  bootloader.enable = true;
-  desktop.niri.enable = true;
-  firewall = {
-    enable = true;
-    allowedTCPPorts = [ 22 ];
-  };
-  gaming.enable = true;
-  git.enable = true;
-  keyboard.enable = true;
-  localization.enable = true;
-  my = {
-    fonts.enable = true;
-    stylix.enable = true;
-    users.enable = true;
-    yubikey = {
-      enable = true;
-      pam.enable = false;
-    };
-  };
-  desktop.ly.enable = true;
-  docker.enable = true;
-  hcloud.enable = true;
-  networking = {
-    enable = true;
-    hostId = "80eef97e";
-    useDHCP = lib.mkDefault true;
-  };
-  nvidia.enable = true;
   restic-backup.enable = true;
-  secrets = {
-    enable = true;
-    nixSigningKey.enable = true;
-  };
-  ssh.enable = true;
-  storage.enable = true;
-  syncthing.enable = true;
   tailscale.enable = true;
-  taskwarrior.enable = true;
-  wol = {
-    enable = true;
-    interfaces.eno1 = { inherit (wolInterfaces.eno1) macAddress; };
-  };
+
+  docker.enable = true;
+
+  hcloud.enable = true;
 
   disko.devices = {
     disk.data = {
@@ -103,8 +92,38 @@ in
     inputs.colmena.packages.${pkgs.stdenv.hostPlatform.system}.colmena
   ];
 
+  my.yubikey = {
+    enable = false;
+    keys = [
+      {
+        handle = "<KeyHandle1>";
+        userKey = "<UserKey1>";
+        coseType = "<CoseType1>";
+        options = "<Options1>";
+      }
+      {
+        handle = "<KeyHandle2>";
+        userKey = "<UserKey2>";
+        coseType = "<CoseType2>";
+        options = "<Options2>";
+      }
+    ];
+  };
+
   services.locate = {
     enable = true;
     package = pkgs.plocate;
   };
+
+  networking.hostId = "80eef97e";
+
+  wol = {
+    enable = true;
+    interfaces.eno1 = { inherit (wolInterfaces.eno1) macAddress; };
+  };
+
+  firewall = {
+    enable = true;
+    allowedTCPPorts = [ 22 ];
+  };
 }

hosts/andromache/hard.nix

@@ -0,0 +1,42 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot = {
+    initrd.availableKernelModules = [
+      "vmd"
+      "xhci_pci"
+      "ahci"
+      "nvme"
+      "usbhid"
+      "usb_storage"
+      "uas"
+      "sd_mod"
+    ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ "kvm-intel" ];
+    extraModulePackages = [ ];
+  };
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp0s20f3.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/andromache/host.nix

@@ -0,0 +1,6 @@
+{
+  host = {
+    username = "h";
+    name = "andromache";
+  };
+}

hosts/andromache/meta.nix

@@ -1,10 +1,9 @@
 {
   system = "x86_64-linux";
-  role = "desktop";
+  deployment = {
     tags = [ "local" ];
-  host = {
-    username = "h";
-    highRam = true;
-    admin = true;
+    targetHost = "";
+    targetUser = "h";
   };
+  role = "desktop";
 }

hosts/andromache/ssh_user.pub

@@ -1 +1 @@
-sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIIj+isTFg+W3v68HL28a9p9nX7ldAxu+ht9uUfKLvqcwAAAABHNzaDo= h@andromache
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOOXPEhdKOVnb6mkeLLUcFGt+mnUR5pMie17JtjrxwgO h@andromache

hosts/astyanax/default.nix

@@ -5,63 +5,60 @@
   pkgs,
   ...
 }:
-
 let
-  meta = import ./meta.nix;
+  wolInterfaces = import ../andromache/wol-interfaces.nix;
 in
 {
   imports = [
     inputs.disko.nixosModules.disko
+    ./hard.nix
+    ./host.nix
     inputs.nixos-hardware.nixosModules.common-pc
     inputs.nixos-hardware.nixosModules.common-pc-ssd
     # inputs.nixos-hardware.nixosModules.lenovo-thinkpad-e14-intel-gen7 (not available yet?)
-    ../../modules
+    inputs.sops-nix.nixosModules.sops
+    ../../modules/common
+    ../../modules/boot/bootloader.nix
     (import ../../modules/disko/zfs-encrypted-root.nix {
       inherit lib config;
       device = "/dev/nvme0n1";
     })
+    ../../modules/ai-tools
+    ../../modules/anki
+    ../../modules/audio
+    ../../modules/backups
+    ../../modules/bluetooth
+    ../../modules/desktops/niri
+    ../../modules/docker
+    ../../modules/firewall
+    ../../modules/fonts
+    ../../modules/git
+    ../../modules/keyboard
+    ../../modules/localization
+    ../../modules/networking
+    ../../modules/nfc
+    ../../modules/secrets
+    ../../modules/ssh
+    ../../modules/storage
+    ../../modules/stylix
+    ../../modules/tailscale
+    ../../modules/taskwarrior
+    ../../modules/users
+    ../../modules/yubikey
   ];
 
-  inherit (meta) host;
+  home-manager.users.${config.host.username} = import ../../home/hosts/astyanax;
 
-  hardware.facter.reportPath = ./facter.json;
-  home-manager.users.${config.host.username} = import ../../home/hosts/${config.host.name};
-
-  "ai-tools".enable = true;
-  anki.enable = true;
-  audio.enable = true;
-  bluetooth.enable = true;
-  bootloader.enable = true;
-  desktop.niri.enable = true;
-  git.enable = true;
-  keyboard.enable = true;
-  localization.enable = true;
-  my = {
-    fonts.enable = true;
-    stylix.enable = true;
-    users.enable = true;
-    yubikey = {
-      enable = true;
-      pam.enable = false;
-    };
-  };
-  networking.enable = true;
-  secrets.enable = true;
-  ssh.enable = true;
-  storage.enable = true;
-  taskwarrior.enable = true;
+  ssh.authorizedHosts = [ "andromache" ];
 
   secrets.nixSigningKey.enable = true;
+
   restic-backup.enable = true;
   tailscale.enable = true;
-  desktop.ly.enable = true;
   docker.enable = true;
   nfc.enable = true;
-
-  firewall = {
-    enable = true;
-    allowedTCPPorts = [ 22 ];
-  };
+  desktop.ly.enable = true;
+  audio.automation.enable = true;
 
   hardware = {
     cpu.intel.updateMicrocode = true;
@@ -71,7 +68,6 @@ in
       extraPackages = with pkgs; [
         intel-media-driver
         vpl-gpu-rt
-        intel-compute-runtime
       ];
     };
   };
@@ -87,24 +83,41 @@ in
       name = "wol-andromache";
       runtimeInputs = [ pkgs.wakeonlan ];
       text = ''
-        wakeonlan ${(import ../andromache/wol-interfaces.nix).eno1.macAddress}
+        wakeonlan ${wolInterfaces.eno1.macAddress}
       '';
     })
   ];
 
   networking = {
     hostId = "80eef97e";
-    useDHCP = false;
-    useNetworkd = true;
   };
 
-  systemd.network.networks."40-wlan0" = {
-    matchConfig.Name = "wlan0";
-    networkConfig.DHCP = "yes";
+  firewall = {
+    enable = true;
+    allowedTCPPorts = [ 22 ];
   };
 
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 
+  my.yubikey = {
+    enable = true;
+    # inherit (config.host) username;
+    # keys = [
+    #   {
+    #     handle = "<KeyHandle1>";
+    #     userKey = "<UserKey1>";
+    #     coseType = "<CoseType1>";
+    #     options = "<Options1>";
+    #   }
+    #   {
+    #     handle = "<KeyHandle2>";
+    #     userKey = "<UserKey2>";
+    #     coseType = "<CoseType2>";
+    #     options = "<Options2>";
+    #   }
+    # ];
+  };
+
   services = {
     fwupd.enable = true;
     locate = {

hosts/astyanax/hard.nix

@@ -0,0 +1,39 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot = {
+    initrd.availableKernelModules = [
+      "xhci_pci"
+      "thunderbolt"
+      "nvme"
+      "uas"
+      "sd_mod"
+    ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ "kvm-intel" ];
+    extraModulePackages = [ ];
+  };
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/astyanax/host.nix

@@ -0,0 +1,6 @@
+{
+  host = {
+    username = "h";
+    name = "astyanax";
+  };
+}

hosts/astyanax/meta.nix

@@ -1,10 +1,9 @@
 {
   system = "x86_64-linux";
-  role = "laptop";
+  deployment = {
     tags = [ "local" ];
-  host = {
-    username = "h";
-    highRam = true;
-    admin = true;
+    targetHost = "";
+    targetUser = "h";
   };
+  role = "laptop";
 }

hosts/astyanax/ssh_user.pub

@@ -1 +1 @@
-sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAILcvxabi0d+Yjdk+Kss8aOTcSJyZ06RPT7Skv5MmfxxKAAAABHNzaDo= h@astyanax
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIJApgl/+QaAtrg0OK5ihXasdcnDwzFo6qtHbgnqGFl25AAAABHNzaDo= h@astyanax

hosts/eetion-02/default.nix

@@ -3,18 +3,20 @@
 # Raspberry Pi 3
 # See <https://nixos.wiki/wiki/NixOS_on_ARM/Raspberry_Pi_3>
 
-let
-  meta = import ./meta.nix;
-in
 {
   imports = [
     ./hard.nix
-    ../../modules
+    ./host.nix
+    ../../modules/common
+    ../../modules/ssh
   ];
 
-  inherit (meta) host;
-
-  ssh.enable = true;
+  ssh = {
+    authorizedHosts = [
+      "andromache"
+      "astyanax"
+    ];
+  };
 
   boot = {
     kernelParams = [

hosts/eetion-02/host.nix

@@ -0,0 +1,6 @@
+{
+  host = {
+    username = "h";
+    name = "eetion-02";
+  };
+}

hosts/eetion-02/meta.nix

@@ -1,8 +1,9 @@
 {
   system = "aarch64-linux";
-  role = "embedded";
+  deployment = {
     tags = [ "arm" ];
-  host = {
-    username = "h";
+    targetHost = "eetion-02";
+    targetUser = "h";
   };
+  role = "embedded";
 }