feat(hosts): add zcode and persist state directories

README.md

@@ -17,7 +17,7 @@
 - [Hosts](#hosts)
 - [Components](#components)
 - [Showcase](#showcase)
-- [Pain](#spent-weeks-on-this-system-configuration-)
+- [Pain](#spent-months-on-this-system-configuration-)
 
 ## Hosts
 
@@ -47,7 +47,7 @@
 ## Showcase
 
 | **Desktop**                                                                                                                 | **Tshell**                                                                                                                |
-| --------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
+| :-------------------------------------------------------------------------------------------------------------------------: | :-----------------------------------------------------------------------------------------------------------------------: |
 | <img src="https://raw.githubusercontent.com/tuxdotrs/nix-config/refs/heads/main/assets/hyprland/desktop.png" width="100%">  | <img src="https://raw.githubusercontent.com/tuxdotrs/nix-config/refs/heads/main/assets/hyprland/tPanel.png" width="100%"> |
 | **Workflow**                                                                                                                | **Neovim**                                                                                                                |
 | <img src="https://raw.githubusercontent.com/tuxdotrs/nix-config/refs/heads/main/assets/hyprland/workflow.png" width="100%"> | <img src="https://github.com/user-attachments/assets/f881c672-8d77-43ec-b637-df5004c7d11f" width="100%">                  |

flake.nix

@@ -1,7 +1,7 @@
 {
   description = "tux's nix configurations";
 
-  outputs = inputs: inputs.flake-parts.lib.mkFlake { inherit inputs; } (inputs.import-tree ./modules);
+  outputs = inputs: inputs.flake-parts.lib.mkFlake {inherit inputs;} (inputs.import-tree ./modules);
 
   inputs = {
     flake-parts = {
@@ -29,6 +29,16 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    trok = {
+      url = "github:tuxdotrs/trok";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    tfolio = {
+      url = "git+ssh://git@github.com/tuxdotrs/tfolio.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     cyber-tux = {
       url = "git+ssh://git@github.com/tuxdotrs/cyber-tux.git";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -84,7 +94,6 @@
     voxtype.url = "github:peteonrails/voxtype/v0.7.5";
     opencode.url = "github:anomalyco/opencode";
     serpantinum.url = "github:ilyamiro/serpantinum";
-    trok.url = "github:tuxdotrs/trok";
+    llm-agents.url = "github:numtide/llm-agents.nix";
-    tfolio.url = "git+ssh://git@github.com/tuxdotrs/tfolio.git";
   };
 }

modules/droid/core/hm.nix

@@ -1,32 +1,33 @@
-{ inputs, config, ... }:
 {
-  flake.modules.nixOnDroid.core =
+  inputs,
-    {
+  config,
-      hostName,
+  ...
-      userName,
+}: {
-      userEmail,
+  flake.modules.nixOnDroid.core = {
-      ...
+    hostName,
-    }:
+    userName,
-    {
+    userEmail,
-      home-manager = {
+    ...
-        backupFileExtension = "bak";
+  }: {
-        useGlobalPkgs = true;
+    home-manager = {
-        useUserPackages = true;
+      backupFileExtension = "bak";
-        extraSpecialArgs = {
+      useGlobalPkgs = true;
-          inherit
+      useUserPackages = true;
-            inputs
+      extraSpecialArgs = {
-            hostName
+        inherit
-            userName
+          inputs
-            userEmail
+          hostName
-            ;
+          userName
-        };
+          userEmail
+          ;
+      };
 
-        config = {
+      config = {
-          imports = [
+        imports = [
-            config.flake.modules.homeManager.shell
+          config.flake.modules.homeManager.shell
-            config.flake.modules.homeManager.${hostName}
+          config.flake.modules.homeManager.${hostName}
-          ];
+        ];
-        };
       };
     };
+  };
 }

modules/droid/networking/ssh.nix

@@ -1,109 +1,106 @@
 {
-  flake.modules.nixOnDroid.networking =
+  flake.modules.nixOnDroid.networking = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    pkgs,
-      pkgs,
+    ...
-      ...
+  }: let
-    }:
+    # utility functions
-    let
+    concatLines = list: builtins.concatStringsSep "\n" list;
-      # utility functions
-      concatLines = list: builtins.concatStringsSep "\n" list;
 
-      prefixLines = mapper: list: concatLines (map mapper list);
+    prefixLines = mapper: list: concatLines (map mapper list);
 
-      # could be put in the config
+    # could be put in the config
-      configPath = "ssh/sshd_config";
+    configPath = "ssh/sshd_config";
 
-      keysFolder = "/etc/ssh";
+    keysFolder = "/etc/ssh";
 
-      authorizedKeysFolder = "/etc/ssh/authorized_keys.d";
+    authorizedKeysFolder = "/etc/ssh/authorized_keys.d";
 
-      supportedKeysTypes = [
+    supportedKeysTypes = [
-        "rsa"
+      "rsa"
-        "ed25519"
+      "ed25519"
-      ];
+    ];
 
-      sshd-start-bin = "sshd-start";
+    sshd-start-bin = "sshd-start";
 
-      # real config
+    # real config
-      cfg = config.tnix.networking.openssh;
+    cfg = config.tnix.networking.openssh;
 
-      pathOfKeyOf = type: "${keysFolder}/ssh_host_${type}_key";
+    pathOfKeyOf = type: "${keysFolder}/ssh_host_${type}_key";
 
-      generateKeyOf = type: ''
+    generateKeyOf = type: ''
-        ${lib.getExe' pkgs.openssh "ssh-keygen"} \
+      ${lib.getExe' pkgs.openssh "ssh-keygen"} \
-          -t "${type}" \
+        -t "${type}" \
-          -f "${pathOfKeyOf type}" \
+        -f "${pathOfKeyOf type}" \
-          -N ""
+        -N ""
+    '';
+
+    generateKeyWhenNeededOf = type: ''
+      if [ ! -f ${pathOfKeyOf type} ]; then
+        mkdir --parents ${keysFolder}
+        ${generateKeyOf type}
+      fi
+    '';
+
+    sshd-start = pkgs.writeScriptBin sshd-start-bin ''
+      #!${pkgs.runtimeShell}
+      ${prefixLines generateKeyWhenNeededOf supportedKeysTypes}
+
+      mkdir --parents "${authorizedKeysFolder}"
+      echo "${lib.concatStringsSep "\n" cfg.authorizedKeys}" > ${authorizedKeysFolder}/${config.user.userName}
+
+      echo "Starting sshd in non-daemonized way on port ${lib.concatMapStrings toString cfg.ports}"
+      ${lib.getExe' pkgs.openssh "sshd"} \
+        -f "/etc/${configPath}" \
+        -D # don't detach into a daemon process
+    '';
+  in {
+    options.tnix.networking.openssh = {
+      enable = lib.mkEnableOption ''
+        Whether to enable the OpenSSH secure shell daemon, which
+        allows secure remote logins.
       '';
 
-      generateKeyWhenNeededOf = type: ''
+      ports = lib.mkOption {
-        if [ ! -f ${pathOfKeyOf type} ]; then
+        type = lib.types.listOf lib.types.port;
-          mkdir --parents ${keysFolder}
+        default = [22];
-          ${generateKeyOf type}
+        description = ''
-        fi
+          Specifies on which ports the SSH daemon listens.
-      '';
-
-      sshd-start = pkgs.writeScriptBin sshd-start-bin ''
-        #!${pkgs.runtimeShell}
-        ${prefixLines generateKeyWhenNeededOf supportedKeysTypes}
-
-        mkdir --parents "${authorizedKeysFolder}"
-        echo "${lib.concatStringsSep "\n" cfg.authorizedKeys}" > ${authorizedKeysFolder}/${config.user.userName}
-
-        echo "Starting sshd in non-daemonized way on port ${lib.concatMapStrings toString cfg.ports}"
-        ${lib.getExe' pkgs.openssh "sshd"} \
-          -f "/etc/${configPath}" \
-          -D # don't detach into a daemon process
-      '';
-    in
-    {
-      options.tnix.networking.openssh = {
-        enable = lib.mkEnableOption ''
-          Whether to enable the OpenSSH secure shell daemon, which
-          allows secure remote logins.
         '';
-
-        ports = lib.mkOption {
-          type = lib.types.listOf lib.types.port;
-          default = [ 22 ];
-          description = ''
-            Specifies on which ports the SSH daemon listens.
-          '';
-        };
-
-        authorizedKeys = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-          description = ''
-            Specify a list of public keys to be added to the authorized_keys file.
-          '';
-        };
       };
 
-      config = lib.mkIf cfg.enable {
+      authorizedKeys = lib.mkOption {
-        environment.etc = {
+        type = lib.types.listOf lib.types.str;
-          "${configPath}".text = ''
+        default = [];
-            ${prefixLines (port: "Port ${toString port}") cfg.ports}
+        description = ''
-
+          Specify a list of public keys to be added to the authorized_keys file.
-            AuthorizedKeysFile ${authorizedKeysFolder}/%u
-
-            LogLevel VERBOSE
-          '';
-        };
-
-        environment.packages = [
-          sshd-start
-          pkgs.openssh
-        ];
-
-        build.activationAfter.sshd = ''
-          SERVER_PID=$(${lib.getExe' pkgs.procps "ps"} -a | ${lib.getExe' pkgs.toybox "grep"} sshd || true)
-          if [ -z "$SERVER_PID" ]; then
-            $DRY_RUN_CMD ${lib.getExe sshd-start}
-          fi
         '';
       };
     };
+
+    config = lib.mkIf cfg.enable {
+      environment.etc = {
+        "${configPath}".text = ''
+          ${prefixLines (port: "Port ${toString port}") cfg.ports}
+
+          AuthorizedKeysFile ${authorizedKeysFolder}/%u
+
+          LogLevel VERBOSE
+        '';
+      };
+
+      environment.packages = [
+        sshd-start
+        pkgs.openssh
+      ];
+
+      build.activationAfter.sshd = ''
+        SERVER_PID=$(${lib.getExe' pkgs.procps "ps"} -a | ${lib.getExe' pkgs.toybox "grep"} sshd || true)
+        if [ -z "$SERVER_PID" ]; then
+          $DRY_RUN_CMD ${lib.getExe sshd-start}
+        fi
+      '';
+    };
+  };
 }

modules/flake/flake-parts.nix

@@ -1,4 +1,3 @@
-{ inputs, ... }:
+{inputs, ...}: {
-{
+  imports = [inputs.flake-parts.flakeModules.modules];
-  imports = [ inputs.flake-parts.flakeModules.modules ];
 }

modules/flake/hosts.nix

@@ -3,19 +3,18 @@
   inputs,
   config,
   ...
-}:
+}: let
-let
+  mkNixOSHost = hostName: {
-  mkNixOSHost =
+    userName ? "tux",
-    hostName:
+    userEmail ? "t@tux.rs",
-    {
+    system ? "x86_64-linux",
-      userName ? "tux",
+    unstable ? true,
-      userEmail ? "t@tux.rs",
+  }: let
-      system ? "x86_64-linux",
+    nixpkgs =
-      unstable ? true,
+      if unstable
-    }:
+      then inputs.nixpkgs
-    let
+      else inputs.nixpkgs-stable;
-      nixpkgs = if unstable then inputs.nixpkgs else inputs.nixpkgs-stable;
+  in
-    in
     nixpkgs.lib.nixosSystem {
       inherit system;
       specialArgs = {
@@ -32,17 +31,17 @@ let
       ];
     };
 
-  mkDroidHost =
+  mkDroidHost = hostName: {
-    hostName:
+    userName ? "nix-on-droid",
-    {
+    userEmail ? "t@tux.rs",
-      userName ? "nix-on-droid",
+    system ? "aarch64-linux",
-      userEmail ? "t@tux.rs",
+    unstable ? true,
-      system ? "aarch64-linux",
+  }: let
-      unstable ? true,
+    nixpkgs =
-    }:
+      if unstable
-    let
+      then inputs.nixpkgs
-      nixpkgs = if unstable then inputs.nixpkgs else inputs.nixpkgs-stable;
+      else inputs.nixpkgs-stable;
-    in
+  in
     inputs.nix-on-droid.lib.nixOnDroidConfiguration {
       pkgs = import nixpkgs {
         inherit system;
@@ -65,66 +64,55 @@ let
       ];
     };
 
-  mkNixOSNode =
+  mkNixOSNode = hostName: {system ? "x86_64-linux"}: {
-    hostName:
+    hostname = hostName;
-    {
+    profiles.system = {
-      system ? "x86_64-linux",
+      user = "root";
-    }:
+      path = inputs.deploy-rs.lib.${system}.activate.nixos self.nixosConfigurations.${hostName};
-    {
-      hostname = hostName;
-      profiles.system = {
-        user = "root";
-        path = inputs.deploy-rs.lib.${system}.activate.nixos self.nixosConfigurations.${hostName};
-      };
     };
+  };
 
-  activateNixOnDroid =
+  activateNixOnDroid = system: configuration:
-    system: configuration:
     inputs.deploy-rs.lib.${system}.activate.custom configuration.activationPackage
-      "${configuration.activationPackage}/activate";
+    "${configuration.activationPackage}/activate";
 
-  mkDroidNode =
+  mkDroidNode = hostName: {system ? "aarch64-linux"}: {
-    hostName:
+    hostname = hostName;
-    {
+    profiles.system = {
-      system ? "aarch64-linux",
+      sshUser = "nix-on-droid";
-    }:
+      user = "nix-on-droid";
-    {
+      magicRollback = true;
-      hostname = hostName;
+      sshOpts = [
-      profiles.system = {
+        "-p"
-        sshUser = "nix-on-droid";
+        "8033"
-        user = "nix-on-droid";
+      ];
-        magicRollback = true;
+      path = activateNixOnDroid system self.nixOnDroidConfigurations.${hostName};
-        sshOpts = [
-          "-p"
-          "8033"
-        ];
-        path = activateNixOnDroid system self.nixOnDroidConfigurations.${hostName};
-      };
     };
-
+  };
-in
+in {
-{
   flake = {
     nixosConfigurations = builtins.mapAttrs mkNixOSHost {
-      sirius = { };
+      sirius = {};
-      canopus = { };
+      canopus = {};
-      arcturus = { };
+      arcturus = {};
-      alpha = { };
+      alpha = {};
-      vps = { };
+      vps = {};
     };
 
     nixOnDroidConfigurations = builtins.mapAttrs mkDroidHost {
-      vega = { };
+      vega = {};
     };
 
     deploy.nodes =
-      builtins.mapAttrs (hostName: _: mkNixOSNode hostName { }) self.nixosConfigurations
+      builtins.mapAttrs (hostName: _: mkNixOSNode hostName {}) self.nixosConfigurations
-      // builtins.mapAttrs (hostName: _: mkDroidNode hostName { }) self.nixOnDroidConfigurations;
+      // builtins.mapAttrs (hostName: _: mkDroidNode hostName {}) self.nixOnDroidConfigurations;
   };
 
   perSystem = {
-    checks = builtins.mapAttrs (
+    checks =
-      _: hostConfig: hostConfig.config.system.build.toplevel
+      builtins.mapAttrs (
-    ) self.nixosConfigurations;
+        _: hostConfig: hostConfig.config.system.build.toplevel
+      )
+      self.nixosConfigurations;
   };
 }

modules/flake/overlays.nix

@@ -1,10 +1,7 @@
-{
+{inputs, ...}: {
-  inputs,
-  ...
-}:
-{
   flake.overlays = {
     modifications = final: prev: {
+      omasnap = prev.callPackage ../../packages/omasnap.nix {};
       tnvim = inputs.tnvim.packages.${prev.stdenv.hostPlatform.system}.default;
       tshell = inputs.tshell.packages.${prev.stdenv.hostPlatform.system}.default;
       trok = inputs.trok.packages.${prev.stdenv.hostPlatform.system}.default;
@@ -18,6 +15,18 @@
       opencode-git = inputs.opencode.packages.${prev.stdenv.hostPlatform.system}.default;
       nix-index-small =
         inputs.nix-index-database.packages.${prev.stdenv.hostPlatform.system}.nix-index-with-small-db;
+
+      davinci-resolve = prev.davinci-resolve.override {
+        runCommandLocal = name: env: cmd:
+          if prev.lib.hasSuffix "-src.zip" name
+          then
+            prev.runCommandLocal name (env
+              // {
+                outputHash = "sha256-+3SB32EHpH9/0hM3h8CrO6f7V4ZAmxUFh3P8m6QDeO0=";
+              })
+            cmd
+          else prev.runCommandLocal name env cmd;
+      };
     };
 
     stable-packages = final: _prev: {
@@ -29,14 +38,17 @@
 
     nur = inputs.nur.overlays.default;
     copyparty = inputs.copyparty.overlays.default;
+    llm-agents = inputs.llm-agents.overlays.shared-nixpkgs;
   };
 
-  perSystem =
+  perSystem = {system, ...}: let
-    { system, ... }:
+    pkgs = import inputs.nixpkgs {
-    {
+      inherit system;
-      _module.args.pkgs = import inputs.nixpkgs {
+      overlays = builtins.attrValues inputs.self.overlays;
-        inherit system;
-        overlays = builtins.attrValues inputs.self.overlays;
-      };
     };
+  in {
+    _module.args.pkgs = pkgs;
+
+    packages.omasnap = pkgs.omasnap;
+  };
 }

modules/flake/treefmt.nix

@@ -1,5 +1,4 @@
-{ inputs, ... }:
+{inputs, ...}: {
-{
   imports = [
     inputs.treefmt-nix.flakeModule
   ];
@@ -9,7 +8,7 @@
       projectRootFile = "flake.nix";
       flakeCheck = true;
       programs = {
-        nixfmt.enable = true;
+        alejandra.enable = true;
       };
     };
   };

modules/hm/core/hm.nix

@@ -1,13 +1,11 @@
 {
-  flake.modules.homeManager.core =
+  flake.modules.homeManager.core = {userName, ...}: {
-    { userName, ... }:
+    programs.home-manager.enable = true;
-    {
+    systemd.user.startServices = "sd-switch";
-      programs.home-manager.enable = true;
-      systemd.user.startServices = "sd-switch";
 
-      home = {
+    home = {
-        username = "${userName}";
+      username = "${userName}";
-        homeDirectory = "/home/${userName}";
+      homeDirectory = "/home/${userName}";
-      };
     };
+  };
 }

modules/hm/core/nixpkgs.nix

@@ -1,18 +1,15 @@
-{ inputs, ... }:
+{inputs, ...}: {
-{
+  flake.modules.homeManager.core = {
-  flake.modules.homeManager.core =
+    lib,
-    {
+    osConfig ? {},
-      lib,
+    ...
-      osConfig ? { },
+  }: {
-      ...
+    nixpkgs = lib.mkIf (!(osConfig.home-manager.useGlobalPkgs or false)) {
-    }:
+      config = {
-    {
+        allowUnfree = true;
-      nixpkgs = lib.mkIf (!(osConfig.home-manager.useGlobalPkgs or false)) {
+        joypixels.acceptLicense = true;
-        config = {
-          allowUnfree = true;
-          joypixels.acceptLicense = true;
-        };
-        overlays = builtins.attrValues inputs.self.overlays;
       };
+      overlays = builtins.attrValues inputs.self.overlays;
     };
+  };
 }

modules/hm/desktop/brave.nix

@@ -1,38 +1,37 @@
 {
-  flake.modules.homeManager.desktop =
+  flake.modules.homeManager.desktop = {
-    {
+    pkgs,
-      pkgs,
+    config,
-      config,
+    ...
-      ...
+  }: let
-    }:
+    configDir = "${config.xdg.configHome}/BraveSoftware/Brave-Origin";
-    let
-      configDir = "${config.xdg.configHome}/BraveSoftware/Brave-Browser";
 
-      extensionJson = ext: {
+    extensionJson = ext: {
-        name = "${configDir}/External Extensions/${ext.id}.json";
+      name = "${configDir}/External Extensions/${ext.id}.json";
-        value.text = builtins.toJSON {
+      value.text = builtins.toJSON {
-          external_update_url = "https://clients2.google.com/service/update2/crx";
+        external_update_url = "https://clients2.google.com/service/update2/crx";
-        };
       };
-
-      extensions = [
-        { id = "nkbihfbeogaeaoehlefnkodbefgpgknn"; } # Metamask
-        { id = "gppongmhjkpfnbhagpmjfkannfbllamg"; } # Wappalyzer
-        { id = "nngceckbapebfimnlniiiahkandclblb"; } # Bitwarden
-        { id = "bfnaelmomeimhlpmgjnjophhpkkoljpa"; } # Phantom
-        { id = "eimadpbcbfnmbkopoojfekhnkhdbieeh"; } # DarkReader
-      ];
-    in
-    {
-      programs.chromium = {
-        enable = true;
-        package = pkgs.brave;
-        commandLineArgs = [
-          "--disable-features=WebRtcAllowInputVolumeAdjustment"
-          "--force-device-scale-factor=1.0"
-        ];
-      };
-
-      home.file = builtins.listToAttrs (map extensionJson extensions);
     };
+
+    extensions = [
+      {id = "nkbihfbeogaeaoehlefnkodbefgpgknn";} # Metamask
+      {id = "gppongmhjkpfnbhagpmjfkannfbllamg";} # Wappalyzer
+      {id = "nngceckbapebfimnlniiiahkandclblb";} # Bitwarden
+      {id = "bfnaelmomeimhlpmgjnjophhpkkoljpa";} # Phantom
+      {id = "eimadpbcbfnmbkopoojfekhnkhdbieeh";} # DarkReader
+    ];
+  in {
+    programs.chromium = {
+      enable = true;
+      package = pkgs.brave-origin;
+      commandLineArgs = [
+        "--disable-features=WebRtcAllowInputVolumeAdjustment"
+        "--force-device-scale-factor=1.0"
+      ];
+    };
+
+    home.packages = [pkgs.brave];
+
+    home.file = builtins.listToAttrs (map extensionJson extensions);
+  };
 }

modules/hm/desktop/discord.nix

@@ -1,56 +1,58 @@
 {
-  flake.modules.homeManager.desktop =
+  flake.modules.homeManager.desktop = {
-    { inputs, userName, ... }:
+    inputs,
-    {
+    userName,
-      imports = [
+    ...
-        inputs.nixcord.homeModules.nixcord
+  }: {
-      ];
+    imports = [
+      inputs.nixcord.homeModules.nixcord
+    ];
 
-      programs.nixcord = {
+    programs.nixcord = {
-        enable = true;
+      enable = true;
-        user = userName;
+      user = userName;
-        discord.enable = false;
+      discord.enable = false;
-        vesktop.enable = true;
+      vesktop.enable = true;
-        config = {
+      config = {
-          themeLinks = [
+        themeLinks = [
-            "https://raw.githubusercontent.com/refact0r/system24/refs/heads/main/archive/flavors/spotify-text.theme.css"
+          "https://raw.githubusercontent.com/refact0r/system24/refs/heads/main/archive/flavors/spotify-text.theme.css"
-          ];
+        ];
-          frameless = true;
+        frameless = true;
-          plugins = {
+        plugins = {
-            hideMedia.enable = true;
+          hideMedia.enable = true;
-            anonymiseFileNames.enable = true;
+          anonymiseFileNames.enable = true;
-            copyFileContents.enable = true;
+          copyFileContents.enable = true;
-            noTypingAnimation.enable = true;
+          noTypingAnimation.enable = true;
-            readAllNotificationsButton.enable = true;
+          readAllNotificationsButton.enable = true;
-            silentTyping.enable = true;
+          silentTyping.enable = true;
-            validUser.enable = true;
+          validUser.enable = true;
-            biggerStreamPreview.enable = true;
+          biggerStreamPreview.enable = true;
-            ignoreActivities = {
+          ignoreActivities = {
-              enable = true;
+            enable = true;
-              ignorePlaying = true;
+            ignorePlaying = true;
-              ignoreWatching = true;
+            ignoreWatching = true;
-            };
+          };
-            sortFriendRequests = {
+          sortFriendRequests = {
-              enable = true;
+            enable = true;
-              showDates = true;
+            showDates = true;
-            };
           };
         };
-        dorion = {
+      };
-          theme = "dark";
+      dorion = {
-          zoom = "1.1";
+        theme = "dark";
-          blur = "acrylic";
+        zoom = "1.1";
-          sysTray = true;
+        blur = "acrylic";
-          openOnStartup = true;
+        sysTray = true;
-          autoClearCache = true;
+        openOnStartup = true;
-          disableHardwareAccel = false;
+        autoClearCache = true;
-          rpcServer = true;
+        disableHardwareAccel = false;
-          rpcProcessScanner = true;
+        rpcServer = true;
-          pushToTalk = true;
+        rpcProcessScanner = true;
-          pushToTalkKeys = [ "RControl" ];
+        pushToTalk = true;
-          desktopNotifications = true;
+        pushToTalkKeys = ["RControl"];
-          unreadBadge = true;
+        desktopNotifications = true;
-        };
+        unreadBadge = true;
       };
     };
+  };
 }

modules/hm/desktop/firefox.nix

@@ -1,75 +1,73 @@
 {
-  flake.modules.homeManager.desktop =
+  flake.modules.homeManager.desktop = {
-    {
+    pkgs,
-      pkgs,
+    userName,
-      userName,
+    ...
-      ...
+  }: {
-    }:
+    programs.firefox = {
-    {
+      enable = true;
-      programs.firefox = {
-        enable = true;
 
-        package = pkgs.firefox.override {
+      package = pkgs.firefox.override {
-          extraPolicies = {
+        extraPolicies = {
-            CaptivePortal = false;
+          CaptivePortal = false;
-            DisableFirefoxStudies = true;
+          DisableFirefoxStudies = true;
-            DisablePocket = true;
+          DisablePocket = true;
-            DisableTelemetry = true;
+          DisableTelemetry = true;
-            DisableFirefoxAccounts = false;
+          DisableFirefoxAccounts = false;
-            NoDefaultBookmarks = true;
+          NoDefaultBookmarks = true;
-            OfferToSaveLogins = false;
+          OfferToSaveLogins = false;
-            OfferToSaveLoginsDefault = false;
+          OfferToSaveLoginsDefault = false;
-            PasswordManagerEnabled = false;
+          PasswordManagerEnabled = false;
-            FirefoxHome = {
+          FirefoxHome = {
-              Search = true;
+            Search = true;
-              Pocket = false;
+            Pocket = false;
-              Snippets = false;
+            Snippets = false;
-              TopSites = false;
+            TopSites = false;
-              Highlights = false;
+            Highlights = false;
-            };
-            UserMessaging = {
-              ExtensionRecommendations = false;
-              SkipOnboarding = true;
-            };
           };
-        };
+          UserMessaging = {
-
+            ExtensionRecommendations = false;
-        profiles = {
+            SkipOnboarding = true;
-          ${userName} = {
-            id = 0;
-            name = "tux";
-            search = {
-              force = true;
-              default = "google";
-            };
-            settings = {
-              "general.smoothScroll" = true;
-              "extensions.activeThemeID" = "firefox-compact-dark@mozilla.org";
-              "layout.css.prefers-color-scheme.content-override" = 0;
-              "browser.compactmode.show" = true;
-              "browser.tabs.firefox-view" = false;
-              "browser.bookmarks.addedImportButton" = false;
-              "extensions.pocket.enabled" = false;
-              "browser.fullscreen.autohide" = false;
-            };
-            extraConfig = ''
-              user_pref("toolkit.legacyUserProfileCustomizations.stylesheets", true);
-              user_pref("full-screen-api.ignore-widgets", true);
-              user_pref("media.ffmpeg.vaapi.enabled", true);
-              user_pref("media.rdd-vpx.enabled", true);
-            '';
-
-            extensions.packages = with pkgs.nur.repos.rycee.firefox-addons; [
-              ublock-origin
-              facebook-container
-              metamask
-              darkreader
-              bitwarden
-              wappalyzer
-              clearurls
-            ];
           };
         };
       };
+
+      profiles = {
+        ${userName} = {
+          id = 0;
+          name = "tux";
+          search = {
+            force = true;
+            default = "google";
+          };
+          settings = {
+            "general.smoothScroll" = true;
+            "extensions.activeThemeID" = "firefox-compact-dark@mozilla.org";
+            "layout.css.prefers-color-scheme.content-override" = 0;
+            "browser.compactmode.show" = true;
+            "browser.tabs.firefox-view" = false;
+            "browser.bookmarks.addedImportButton" = false;
+            "extensions.pocket.enabled" = false;
+            "browser.fullscreen.autohide" = false;
+          };
+          extraConfig = ''
+            user_pref("toolkit.legacyUserProfileCustomizations.stylesheets", true);
+            user_pref("full-screen-api.ignore-widgets", true);
+            user_pref("media.ffmpeg.vaapi.enabled", true);
+            user_pref("media.rdd-vpx.enabled", true);
+          '';
+
+          extensions.packages = with pkgs.nur.repos.rycee.firefox-addons; [
+            ublock-origin
+            facebook-container
+            metamask
+            darkreader
+            bitwarden
+            wappalyzer
+            clearurls
+          ];
+        };
+      };
     };
+  };
 }

modules/hm/desktop/hyprland.nix

@@ -1,40 +1,43 @@
 {
-  flake.modules.homeManager.desktop =
+  flake.modules.homeManager.desktop = {
-    { config, pkgs, ... }:
+    config,
-    {
+    pkgs,
-      # TODO: Hyprland 0.55 switched to Lua-based configuration.
+    ...
-      # HM module is updated but I'm too lazy at this point so we symlink our config instead.
+  }: {
-      wayland.windowManager.hyprland = {
+    # TODO: Hyprland 0.55 switched to Lua-based configuration.
-        enable = true;
+    # HM module is updated but I'm too lazy at this point so we symlink our config instead.
-        package = null;
+    wayland.windowManager.hyprland = {
-        portalPackage = null;
+      enable = true;
-        xwayland.enable = true;
+      package = null;
-        configType = "hyprlang";
+      portalPackage = null;
-        systemd.variables = [ "--all" ];
+      xwayland.enable = true;
-      };
+      configType = "hyprlang";
-
+      systemd.variables = ["--all"];
-      home.file = {
-        ".config/hypr/config".source =
-          config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/Projects/hypr/config";
-        ".config/hypr/hyprland.lua".source =
-          config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/Projects/hypr/hyprland.lua";
-      };
-
-      home.packages = with pkgs; [
-        ags
-        awww
-        grim
-        slurp
-        hyprshot
-        wl-clipboard
-        wl-screenrec
-        (writeShellScriptBin "hypr-screenshot" ''
-          hyprshot -m region -r ppm - | satty --filename -
-        '')
-
-        (writeShellScriptBin "hypr-screenrecord" ''
-          wl-screenrec -g "$(slurp)"
-        '')
-      ];
     };
+
+    home.file = {
+      ".config/hypr/config".source =
+        config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/Projects/hypr/config";
+      ".config/hypr/hyprland.lua".source =
+        config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/Projects/hypr/hyprland.lua";
+    };
+
+    home.packages = with pkgs; [
+      ags
+      awww
+      grim
+      slurp
+      hyprshot
+      wl-clipboard
+      wl-screenrec
+      omasnap
+      (writeShellScriptBin "hypr-screenshot" ''
+        hyprshot -m region -r ppm - | satty --filename -
+      '')
+
+      (writeShellScriptBin "hypr-screenrecord" ''
+        wl-screenrec -g "$(slurp)"
+      '')
+    ];
+  };
 }

modules/hm/desktop/kitty.nix

@@ -0,0 +1,86 @@
+{
+  flake.modules.homeManager.desktop = {pkgs, ...}: {
+    programs.kitty = {
+      enable = true;
+      package = pkgs.kitty;
+
+      font = {
+        name = "JetBrainsMono Nerd Font";
+        size = 12.0;
+      };
+
+      shellIntegration.enableZshIntegration = true;
+
+      settings = {
+        background_opacity = "1.0";
+
+        enable_audio_bell = false;
+        confirm_os_window_close = 0;
+
+        cursor_trail = 3;
+
+        # Window
+        window_padding_width = 10;
+
+        foreground = "#f1f1f1";
+        background = "#0f0f0f";
+
+        # Borders
+        active_border_color = "#3d59a1";
+        inactive_border_color = "#101014";
+        bell_border_color = "#fffac2";
+
+        # Colors
+        color0 = "#0f0f0f";
+        color8 = "#a6accd";
+
+        color1 = "#d0679d";
+        color9 = "#d0679d";
+
+        color2 = "#5de4c7";
+        color10 = "#5de4c7";
+
+        color3 = "#fffac2";
+        color11 = "#fffac2";
+
+        color4 = "#89ddff";
+        color12 = "#add7ff";
+
+        color5 = "#fcc5e9";
+        color13 = "#fae4fc";
+
+        color6 = "#add7ff";
+        color14 = "#89ddff";
+
+        color7 = "#ffffff";
+        color15 = "#ffffff";
+
+        # Cursor
+        cursor = "#ffffff";
+        cursor_text_color = "#0f0f0f";
+
+        # Selection
+        selection_foreground = "none";
+        selection_background = "#28344a";
+
+        # URLs
+        url_color = "#5de4c7";
+
+        # Tab bar
+        tab_bar_edge = "bottom";
+        tab_bar_style = "fade";
+        tab_fade = "1";
+
+        active_tab_foreground = "#3d59a1";
+        active_tab_background = "#16161e";
+        active_tab_font_style = "bold";
+
+        inactive_tab_foreground = "#787c99";
+        inactive_tab_background = "#16161e";
+        inactive_tab_font_style = "bold";
+
+        tab_bar_background = "#101014";
+      };
+    };
+  };
+}

modules/hm/desktop/lan-mouse.nix

@@ -1,25 +1,21 @@
-{ inputs, ... }:
+{inputs, ...}: {
-{
+  flake.modules.homeManager.desktop = {
-  flake.modules.homeManager.desktop =
+    config,
-    {
+    pkgs,
-      config,
+    lib,
-      pkgs,
+    ...
-      lib,
+  }:
-      ...
+    with lib; let
-    }:
-    with lib;
-    let
       cfg = config.tnix.services.lan-mouse;
-    in
+    in {
-    {
+      imports = [inputs.lan-mouse.homeManagerModules.default];
-      imports = [ inputs.lan-mouse.homeManagerModules.default ];
 
       options.tnix.services.lan-mouse = {
         enable = mkEnableOption "Enable Lan-Mouse";
 
         settings = mkOption {
-          type = (pkgs.formats.toml { }).type;
+          type = (pkgs.formats.toml {}).type;
-          default = { };
+          default = {};
           description = ''
             TOML configuration for lan-mouse.
             See <https://github.com/feschber/lan-mouse/> for available options.
@@ -28,7 +24,6 @@
       };
 
       config = mkIf cfg.enable {
-
         programs.lan-mouse = {
           enable = true;
           systemd = true;

modules/hm/desktop/mango.nix

@@ -1,17 +1,13 @@
-{ inputs, ... }:
+{inputs, ...}: {
-{
+  flake.modules.homeManager.desktop = {
-  flake.modules.homeManager.desktop =
+    config,
-    {
+    pkgs,
-      config,
+    lib,
-      pkgs,
+    ...
-      lib,
+  }:
-      ...
+    with lib; let
-    }:
-    with lib;
-    let
       cfg = config.tnix.desktop.mangowm;
-    in
+    in {
-    {
       imports = [
         inputs.mango.hmModules.mango
       ];
@@ -21,12 +17,12 @@
 
         monitorRule = mkOption {
           type = with types; listOf str;
-          default = [ ];
+          default = [];
         };
 
         tagRule = mkOption {
           type = with types; listOf str;
-          default = [ ];
+          default = [];
         };
       };
 

modules/hm/desktop/mpv.nix

@@ -1,24 +1,21 @@
 {
-  flake.modules.homeManager.desktop =
+  flake.modules.homeManager.desktop = {pkgs, ...}: {
-    { pkgs, ... }:
+    programs.mpv = {
-    {
+      enable = true;
-      programs.mpv = {
-        enable = true;
 
-        scripts = (
+      scripts = (
-          with pkgs.mpvScripts;
+        with pkgs.mpvScripts; [
-          [
+          modernz
-            modernz
+          thumbfast
-            thumbfast
+          mpris
-            mpris
+          mpv-image-viewer.image-positioning
-            mpv-image-viewer.image-positioning
+        ]
-          ]
+      );
-        );
 
-        config = {
+      config = {
-          osc = "no";
+        osc = "no";
-          border = "no";
+        border = "no";
-        };
       };
     };
+  };
 }

modules/hm/desktop/serpantinum.nix

@@ -1,5 +1,4 @@
-{ inputs, ... }: {
+{inputs, ...}: {
-
   flake.modules.nixos.desktop = {
     imports = [
       inputs.serpantinum.nixosModules.default
@@ -8,12 +7,12 @@
     programs.serpantinum.enable = true;
   };
 
-  flake.modules.homeManager.desktop = { pkgs, ... }: {
+  flake.modules.homeManager.desktop = {pkgs, ...}: {
     imports = [
       inputs.serpantinum.homeManagerModules.default
     ];
 
-    home.packages = with pkgs; [ pulseaudioFull ];
+    home.packages = with pkgs; [pulseaudioFull];
 
     programs.serpantinum = {
       enable = true;
@@ -26,11 +25,16 @@
           language = "en";
           weatherUnit = "metric";
           weatherInterval = 30;
+          avatarPath = "/home/tux/Wallpapers/tux.png";
+          muteSfx = true;
         };
 
         bar = {
           position = "top";
           style = "modular";
+          time = {
+            format = "hh:mm:ss A";
+          };
           width = 5;
           workspaceCount = 7;
           modules = {
@@ -40,7 +44,7 @@
               "sysmon"
               "wifi"
             ];
-            center = [ "vis" ];
+            center = ["vis"];
             right = [
               "media"
               "vol"
@@ -62,6 +66,11 @@
           position = "top right";
           sound = true;
         };
+
+        idle = {
+          enabled = true;
+          manualInhibit = true;
+        };
       };
     };
   };

modules/hm/desktop/theme.nix

@@ -1,32 +1,30 @@
 {
-  flake.modules.homeManager.desktop =
+  flake.modules.homeManager.desktop = {pkgs, ...}: {
-    { pkgs, ... }:
+    home.pointerCursor = {
-    {
+      enable = true;
-      home.pointerCursor = {
+      package = pkgs.bibata-cursors;
-        enable = true;
+      name = "Bibata-Modern-Ice";
-        package = pkgs.bibata-cursors;
+      size = 24;
-        name = "Bibata-Modern-Ice";
-        size = 28;
-      };
-
-      qt = {
-        enable = true;
-        style.name = "adwaita-dark";
-      };
-
-      gtk = {
-        enable = true;
-        theme = {
-          name = "adw-gtk3-dark";
-          package = pkgs.adw-gtk3;
-        };
-        iconTheme = {
-          package = pkgs.tela-icon-theme;
-          name = "Tela-black";
-        };
-      };
-
-      # Make GTK4/libadwaita apps prefer dark too (they ignore gtk.theme).
-      dconf.settings."org/gnome/desktop/interface".color-scheme = "prefer-dark";
     };
+
+    qt = {
+      enable = true;
+      style.name = "adwaita-dark";
+    };
+
+    gtk = {
+      enable = true;
+      theme = {
+        name = "adw-gtk3-dark";
+        package = pkgs.adw-gtk3;
+      };
+      iconTheme = {
+        package = pkgs.tela-icon-theme;
+        name = "Tela-black";
+      };
+    };
+
+    # Make GTK4/libadwaita apps prefer dark too (they ignore gtk.theme).
+    dconf.settings."org/gnome/desktop/interface".color-scheme = "prefer-dark";
+  };
 }

modules/hm/desktop/vicinae.nix

@@ -1,69 +1,60 @@
 {
-  flake.modules.homeManager.desktop =
+  flake.modules.homeManager.desktop = {pkgs, ...}: {
-    {
+    programs.vicinae = {
-      pkgs,
+      enable = true;
-      ...
+      systemd = {
-    }:
-    {
-      programs.vicinae = {
         enable = true;
-        systemd = {
+        autoStart = true;
-          enable = true;
+      };
-          autoStart = true;
+      useLayerShell = true;
+
+      extensions = with pkgs.vicinae-extensions; [
+        nix
+        ssh
+        awww-switcher
+        process-manager
+        pulseaudio
+        port-killer
+      ];
+
+      settings = {
+        close_on_focus_loss = false;
+        consider_preedit = true;
+        pop_to_root_on_close = true;
+        favicon_service = "twenty";
+        search_files_in_root = true;
+        font = {
+          normal = {
+            size = 10;
+            family = "JetBrainsMono Nerd Font";
+          };
         };
-        useLayerShell = true;
+        theme = {
-
+          light = {
-        extensions = with pkgs.vicinae-extensions; [
+            name = "vicinae-light";
-          # @TODO broken in upstream repo
+            icon_theme = "default";
-          # bluetooth
-          nix
-          ssh
-          awww-switcher
-          process-manager
-          pulseaudio
-          wifi-commander
-          port-killer
-          silverbullet
-        ];
-
-        settings = {
-          close_on_focus_loss = true;
-          consider_preedit = true;
-          pop_to_root_on_close = true;
-          favicon_service = "twenty";
-          search_files_in_root = true;
-          font = {
-            normal = {
-              size = 10;
-              family = "JetBrainsMono Nerd Font";
-            };
           };
-          theme = {
+          dark = {
-            light = {
+            name = "vicinae-dark";
-              name = "vicinae-light";
+            icon_theme = "default";
-              icon_theme = "default";
-            };
-            dark = {
-              name = "vicinae-dark";
-              icon_theme = "default";
-            };
-          };
-          launcher_window = {
-            opacity = 0.98;
           };
+        };
+        launcher_window = {
+          opacity = 0.98;
+        };
 
-          imports = [ "/run/secrets/vicinae.json" ];
+        imports = ["/run/secrets/vicinae.json"];
 
-          providers = {
+        providers = {
-            "@sovereign/vicinae-extension-awww-switcher-0" = {
+          "@sovereign/vicinae-extension-awww-switcher-0" = {
-              "preferences" = {
+            "preferences" = {
-                "transitionDuration" = "1";
+              "transitionDuration" = "1";
-                "transitionType" = "center";
+              "transitionType" = "center";
-                "wallpaperPath" = "/home/tux/Wallpapers/";
+              "wallpaperPath" = "/home/tux/Wallpapers/";
-              };
             };
           };
         };
       };
     };
+  };
 }

modules/hm/desktop/voxtype.nix

@@ -1,5 +1,5 @@
-{ inputs, ... }: {
+{inputs, ...}: {
-  flake.modules.homeManager.desktop = { pkgs, ... }: {
+  flake.modules.homeManager.desktop = {pkgs, ...}: {
     imports = [
       inputs.voxtype.homeManagerModules.default
     ];
@@ -12,7 +12,14 @@
       service.enable = true;
       settings = {
         hotkey.enabled = false;
-        whisper.language = "en";
+        whisper = {
+          language = "en";
+          on_demand_loading = true;
+        };
+
+        parakeet = {
+          on_demand_loading = true;
+        };
       };
     };
   };

modules/hm/desktop/wezterm.nix

@@ -1,33 +1,31 @@
 {
-  flake.modules.homeManager.desktop =
+  flake.modules.homeManager.desktop = {pkgs, ...}: {
-    { pkgs, ... }:
+    programs.wezterm = {
-    {
+      enable = true;
-      programs.wezterm = {
+      package = pkgs.wezterm-git;
-        enable = true;
+      enableZshIntegration = false;
-        package = pkgs.wezterm-git;
-        enableZshIntegration = false;
 
-        extraConfig = ''
+      extraConfig = ''
-          local wezterm = require 'wezterm'
+        local wezterm = require 'wezterm'
-          local config = {}
+        local config = {}
 
-          config.check_for_updates = false
+        config.check_for_updates = false
 
-          config.window_close_confirmation = 'NeverPrompt'
+        config.window_close_confirmation = 'NeverPrompt'
-          config.color_scheme = 'Poimandres'
+        config.color_scheme = 'Poimandres'
-          config.colors = {
+        config.colors = {
-            background = "#0f0f0f"
+          background = "#0f0f0f"
-          }
+        }
-          config.enable_tab_bar = false
+        config.enable_tab_bar = false
-          config.font = wezterm.font_with_fallback {
+        config.font = wezterm.font_with_fallback {
-            'JetBrainsMono Nerd Font',
+          'JetBrainsMono Nerd Font',
-          }
+        }
-          config.font_size = 12.0
+        config.font_size = 12.0
-          config.window_background_opacity = 1
+        config.window_background_opacity = 1
-          config.audible_bell = "Disabled"
+        config.audible_bell = "Disabled"
 
-          return config
+        return config
-        '';
+      '';
-      };
     };
+  };
 }

modules/hm/desktop/zed.nix

@@ -29,6 +29,25 @@
           diagnostics = false;
           metrics = false;
         };
+
+        agent = {
+          dock = "right";
+          favorite_models = [];
+          model_parameters = [];
+        };
+
+        collaboration_panel = {
+          button = false;
+        };
+
+        agent_servers = {
+          opencode = {
+            default_config_options = {
+              model = "opencode-go/deepseek-v4.1-flash";
+            };
+            type = "registry";
+          };
+        };
       };
     };
   };

modules/hm/gaming/lutris.nix

@@ -1,5 +1,5 @@
 {
-  flake.modules.homeManager.desktop = { osConfig, ... }: {
+  flake.modules.homeManager.desktop = {osConfig, ...}: {
     programs.lutris = {
       enable = true;
       steamPackage = osConfig.programs.steam.package;

modules/hm/shell/git.nix

@@ -1,27 +1,25 @@
 {
-  flake.modules.homeManager.shell =
+  flake.modules.homeManager.shell = {
-    {
+    userName,
-      userName,
+    userEmail,
-      userEmail,
+    ...
-      ...
+  }: {
-    }:
+    programs.git = {
-    {
+      enable = true;
-      programs.git = {
+      signing = {
-        enable = true;
+        key = "~/.ssh/id_ed25519.pub";
-        signing = {
+        signByDefault = true;
-          key = "~/.ssh/id_ed25519.pub";
+      };
-          signByDefault = true;
+      lfs.enable = true;
-        };
+      settings = {
-        lfs.enable = true;
+        user = {
-        settings = {
+          name = "${userName}";
-          user = {
+          email = "${userEmail}";
-            name = "${userName}";
-            email = "${userEmail}";
-          };
-          init.defaultBranch = "main";
-          commit.gpgSign = true;
-          gpg.format = "ssh";
         };
+        init.defaultBranch = "main";
+        commit.gpgSign = true;
+        gpg.format = "ssh";
       };
     };
+  };
 }

modules/hm/shell/github.nix

@@ -0,0 +1,7 @@
+{
+  flake.modules.homeManager.shell = {
+    programs.gh = {
+      enable = true;
+    };
+  };
+}

modules/hm/shell/misc.nix

@@ -1,17 +1,86 @@
 {
-  flake.modules.homeManager.shell =
+  flake.modules.homeManager.shell = {pkgs, ...}: {
-    { pkgs, ... }:
+    home.packages = with pkgs; [
-    {
+      systemctl-tui
-      home.packages = with pkgs; [
+      zip
-        systemctl-tui
+      unzip
-        zip
+      pciutils
-        unzip
+      usbutils
-        pciutils
+      jq
-        usbutils
+      dig
-        jq
+      lsof
-        dig
+      trok
-        lsof
+
-        trok
+      (writeShellScriptBin "hm-override" ''
-      ];
+        #!/usr/bin/env bash
-    };
+
+        set -euo pipefail
+
+        usage() {
+          echo "Usage:"
+          echo "  $0 <filename>              Override symlink"
+          echo "  $0 <filename> --restore    Restore symlink"
+          echo "  $0 <filename> -r           Restore symlink"
+          exit 1
+        }
+
+        if [[ $# -lt 1 || $# -gt 2 ]]; then
+          usage
+        fi
+
+        FILE="$1"
+        LINK_BACKUP="''${FILE}.backup-link"
+
+        # Restore
+        if [[ "''${2:-}" == "--restore" || "''${2:-}" == "-r" ]]; then
+          if [[ ! -f "$LINK_BACKUP" ]]; then
+            echo "Error: no backup symlink found: $LINK_BACKUP"
+            exit 1
+          fi
+
+          TARGET="$(cat "$LINK_BACKUP")"
+
+          # Remove the temporary override.
+          rm -f "$FILE"
+
+          # Restore the original symlink.
+          ln -s "$TARGET" "$FILE"
+
+          # Remove the temporary symlink target backup.
+          rm "$LINK_BACKUP"
+
+          echo "Restored: $FILE -> $TARGET"
+          exit 0
+        fi
+
+        # Override mode
+        if [[ ! -L "$FILE" ]]; then
+          echo "Error: $FILE is not a symlink"
+          exit 1
+        fi
+
+        if [[ -e "$LINK_BACKUP" ]]; then
+          echo "Error: backup already exists: $LINK_BACKUP"
+          echo "Restore the existing override before running again."
+          exit 1
+        fi
+
+        # Remember the original symlink target.
+        TARGET="$(readlink "$FILE")"
+        printf '%s\n' "$TARGET" > "$LINK_BACKUP"
+
+        # Copy the contents before removing the symlink.
+        cp "$FILE" "$FILE.tmp"
+
+        # Replace the symlink with a regular writable file.
+        rm "$FILE"
+        mv "$FILE.tmp" "$FILE"
+
+        chmod u+w "$FILE"
+
+        echo "Overridden: $FILE"
+        echo "Original:   $FILE -> $TARGET"
+      '')
+    ];
+  };
 }

modules/hm/shell/neovim.nix

@@ -1,40 +1,38 @@
 {
-  flake.modules.homeManager.shell =
+  flake.modules.homeManager.shell = {pkgs, ...}: {
-    { pkgs, ... }:
+    home.file = {
-    {
+      ".config/nvim" = {
-      home.file = {
+        recursive = true;
-        ".config/nvim" = {
+        source = "${pkgs.tnvim}";
-          recursive = true;
-          source = "${pkgs.tnvim}";
-        };
-      };
-
-      programs = {
-        neovim = {
-          enable = true;
-          defaultEditor = true;
-        };
-      };
-
-      home = {
-        packages = with pkgs; [
-          python3
-          nodejs
-          bun
-          pnpm
-          go
-          rustup
-          typescript
-          neovide
-          nil
-          statix
-          deadnix
-          alejandra
-          luarocks
-          gdu
-          gcc
-          wakatime-cli
-        ];
       };
     };
+
+    programs = {
+      neovim = {
+        enable = true;
+        defaultEditor = true;
+      };
+    };
+
+    home = {
+      packages = with pkgs; [
+        python3
+        nodejs
+        bun
+        pnpm
+        go
+        rustup
+        typescript
+        neovide
+        nil
+        statix
+        deadnix
+        alejandra
+        luarocks
+        gdu
+        gcc
+        wakatime-cli
+      ];
+    };
+  };
 }

modules/hm/shell/opencode.nix

@@ -1,5 +1,5 @@
 {
-  flake.modules.homeManager.shell = { pkgs, ... }: {
+  flake.modules.homeManager.shell = {pkgs, ...}: {
     programs.opencode = {
       enable = true;
       package = pkgs.opencode-git;
@@ -7,7 +7,7 @@
         theme = "system";
       };
       settings = {
-        model = "opencode-go/kimi-k3";
+        model = "opencode-go/deepseek-v4.1-flash";
         provider = {
           google = {
             options = {
@@ -24,8 +24,13 @@
               apiKey = "{file:/run/secrets/opencode-go-api-key}";
             };
           };
+          zai-coding-plan = {
+            options = {
+              apiKey = "{file:/run/secrets/zai-coding-plan-api-key}";
+            };
+          };
         };
-        plugin = [ "@dietrichgebert/ponytail" ];
+        plugin = ["@dietrichgebert/ponytail"];
       };
     };
   };

modules/hm/shell/tmux.nix

@@ -1,155 +1,138 @@
 {
-  flake.modules.homeManager.shell =
+  flake.modules.homeManager.shell = {pkgs, ...}: let
-    { pkgs, ... }:
+    bg = "default";
-    let
+    fg = "default";
-      bg = "default";
+    bg2 = "brightblack";
-      fg = "default";
+    fg2 = "white";
-      bg2 = "brightblack";
+    color = c: "#{@${c}}";
-      fg2 = "white";
-      color = c: "#{@${c}}";
 
-      indicator =
+    indicator = let
-        let
+      accent = color "indicator_color";
-          accent = color "indicator_color";
+      content = "  ";
-          content = "  ";
+    in "#[reverse,fg=${accent}]#{?client_prefix,${content},}";
-        in
-        "#[reverse,fg=${accent}]#{?client_prefix,${content},}";
 
-      current_window =
+    current_window = let
-        let
+      accent = color "main_accent";
-          accent = color "main_accent";
+      index = "#[reverse,fg=${accent},bg=${fg}] #I ";
-          index = "#[reverse,fg=${accent},bg=${fg}] #I ";
+      name = "#[fg=${bg2},bg=${fg2}] #W ";
-          name = "#[fg=${bg2},bg=${fg2}] #W ";
+      # flags = "#{?window_flags,#{window_flags}, }";
-          # flags = "#{?window_flags,#{window_flags}, }";
+    in "${index}${name}";
-        in
-        "${index}${name}";
 
-      window_status =
+    window_status = let
-        let
+      accent = color "window_color";
-          accent = color "window_color";
+      index = "#[reverse,fg=${accent},bg=${fg}] #I ";
-          index = "#[reverse,fg=${accent},bg=${fg}] #I ";
+      name = "#[fg=${bg2},bg=${fg2}] #W ";
-          name = "#[fg=${bg2},bg=${fg2}] #W ";
+      # flags = "#{?window_flags,#{window_flags}, }";
-          # flags = "#{?window_flags,#{window_flags}, }";
+    in "${index}${name}";
-        in
-        "${index}${name}";
 
-      battery =
+    battery = let
-        let
+      percentage = pkgs.writeShellScript "percentage" (
-          percentage = pkgs.writeShellScript "percentage" (
+        if pkgs.stdenv.isDarwin
-            if pkgs.stdenv.isDarwin then
+        then ''
-              ''
+          echo $(pmset -g batt | grep -o "[0-9]\+%" | tr '%' ' ')
-                echo $(pmset -g batt | grep -o "[0-9]\+%" | tr '%' ' ')
+        ''
-              ''
+        else ''
-            else
+          path="/org/freedesktop/UPower/devices/DisplayDevice"
-              ''
+          echo $(${pkgs.upower}/bin/upower -i $path | grep -o "[0-9]\+%" | tr '%' ' ')
-                path="/org/freedesktop/UPower/devices/DisplayDevice"
+        ''
-                echo $(${pkgs.upower}/bin/upower -i $path | grep -o "[0-9]\+%" | tr '%' ' ')
+      );
-              ''
+      state = pkgs.writeShellScript "state" (
-          );
+        if pkgs.stdenv.isDarwin
-          state = pkgs.writeShellScript "state" (
+        then ''
-            if pkgs.stdenv.isDarwin then
+          echo $(pmset -g batt | awk '{print $4}')
-              ''
+        ''
-                echo $(pmset -g batt | awk '{print $4}')
+        else ''
-              ''
+          path="/org/freedesktop/UPower/devices/DisplayDevice"
-            else
+          echo $(${pkgs.upower}/bin/upower -i $path | grep state | awk '{print $2}')
-              ''
+        ''
-                path="/org/freedesktop/UPower/devices/DisplayDevice"
+      );
-                echo $(${pkgs.upower}/bin/upower -i $path | grep state | awk '{print $2}')
+      icon = pkgs.writeShellScript "icon" ''
-              ''
+        percentage=$(${percentage})
-          );
+        state=$(${state})
-          icon = pkgs.writeShellScript "icon" ''
+        if [ "$state" == "charging" ] || [ "$state" == "fully-charged" ]; then echo "󰂄"
-            percentage=$(${percentage})
+        elif [ $percentage -ge 75 ]; then echo "󱊣"
-            state=$(${state})
+        elif [ $percentage -ge 50 ]; then echo "󱊢"
-            if [ "$state" == "charging" ] || [ "$state" == "fully-charged" ]; then echo "󰂄"
+        elif [ $percentage -ge 25 ]; then echo "󱊡"
-            elif [ $percentage -ge 75 ]; then echo "󱊣"
+        elif [ $percentage -ge 0  ]; then echo "󰂎"
-            elif [ $percentage -ge 50 ]; then echo "󱊢"
+        fi
-            elif [ $percentage -ge 25 ]; then echo "󱊡"
+      '';
-            elif [ $percentage -ge 0  ]; then echo "󰂎"
+      color = pkgs.writeShellScript "color" ''
-            fi
+        percentage=$(${percentage})
-          '';
+        state=$(${state})
-          color = pkgs.writeShellScript "color" ''
+        if [ "$state" == "charging" ] || [ "$state" == "fully-charged" ]; then echo "green"
-            percentage=$(${percentage})
+        elif [ $percentage -ge 75 ]; then echo "green"
-            state=$(${state})
+        elif [ $percentage -ge 50 ]; then echo "${fg2}"
-            if [ "$state" == "charging" ] || [ "$state" == "fully-charged" ]; then echo "green"
+        elif [ $percentage -ge 30 ]; then echo "yellow"
-            elif [ $percentage -ge 75 ]; then echo "green"
+        elif [ $percentage -ge 0  ]; then echo "red"
-            elif [ $percentage -ge 50 ]; then echo "${fg2}"
+        fi
-            elif [ $percentage -ge 30 ]; then echo "yellow"
+      '';
-            elif [ $percentage -ge 0  ]; then echo "red"
+    in "#[fg=#(${color})]#(${icon}) #[fg=${fg}]#(${percentage})%";
-            fi
-          '';
-        in
-        "#[fg=#(${color})]#(${icon}) #[fg=${fg}]#(${percentage})%";
 
-      pwd =
+    pwd = let
-        let
+      accent = color "main_accent";
-          accent = color "main_accent";
+      icon = "#[fg=${accent}] ";
-          icon = "#[fg=${accent}] ";
+      format = "#[fg=${fg}]#{b:pane_current_path}";
-          format = "#[fg=${fg}]#{b:pane_current_path}";
+    in "${icon}${format}";
-        in
-        "${icon}${format}";
 
-      git =
+    git = let
-        let
+      icon = pkgs.writeShellScript "branch" ''
-          icon = pkgs.writeShellScript "branch" ''
+        git -C "$1" branch && echo " "
-            git -C "$1" branch && echo " "
+      '';
-          '';
+      branch = pkgs.writeShellScript "branch" ''
-          branch = pkgs.writeShellScript "branch" ''
+        git -C "$1" rev-parse --abbrev-ref HEAD
-            git -C "$1" rev-parse --abbrev-ref HEAD
+      '';
-          '';
+    in "#[fg=magenta]#(${icon} #{pane_current_path})#(${branch} #{pane_current_path})";
-        in
-        "#[fg=magenta]#(${icon} #{pane_current_path})#(${branch} #{pane_current_path})";
 
-      separator = "#[fg=${fg}]|";
+    separator = "#[fg=${fg}]|";
-    in
+  in {
-    {
+    programs.tmux = {
-      programs.tmux = {
+      enable = true;
-        enable = true;
+      baseIndex = 1;
-        baseIndex = 1;
+      escapeTime = 0;
-        escapeTime = 0;
+      mouse = true;
-        mouse = true;
+      extraConfig = ''
-        extraConfig = ''
+        set-option -sa terminal-overrides ",xterm*:Tc"
-          set-option -sa terminal-overrides ",xterm*:Tc"
+        set-option -g status-position top
-          set-option -g status-position top
+        unbind r
-          unbind r
+        bind r source-file ~/.config/tmux/tmux.conf
-          bind r source-file ~/.config/tmux/tmux.conf
 
-          # remap prefix from C-b to C-Space
+        # remap prefix from C-b to C-Space
-          # unbind C-b
+        # unbind C-b
-          # set -g prefix C-Space
+        # set -g prefix C-Space
-          # bind C-Space send-prefix
+        # bind C-Space send-prefix
 
-          # split panes using | and -
+        # split panes using | and -
-          unbind '"'
+        unbind '"'
-          unbind %
+        unbind %
-          bind | split-window -h
+        bind | split-window -h
-          bind - split-window -v
+        bind - split-window -v
 
-          # Start windows and panes at 1, not 0
+        # Start windows and panes at 1, not 0
-          set -g base-index 1
+        set -g base-index 1
-          set -g pane-base-index 1
+        set -g pane-base-index 1
-          set-window-option -g pane-base-index 1
+        set-window-option -g pane-base-index 1
-          set-option -g renumber-windows on
+        set-option -g renumber-windows on
 
-          # switch panes using Alt-arrow without prefix
+        # switch panes using Alt-arrow without prefix
-          bind -n M-Left select-pane -L
+        bind -n M-Left select-pane -L
-          bind -n M-Right select-pane -R
+        bind -n M-Right select-pane -R
-          bind -n M-Up select-pane -U
+        bind -n M-Up select-pane -U
-          bind -n M-Down select-pane -D
+        bind -n M-Down select-pane -D
 
-          set-option -g default-terminal "screen-256color"
+        set-option -g default-terminal "screen-256color"
-          set-option -g status-right-length 100
+        set-option -g status-right-length 100
-          set-option -g @indicator_color "yellow"
+        set-option -g @indicator_color "yellow"
-          set-option -g @window_color "magenta"
+        set-option -g @window_color "magenta"
-          set-option -g @main_accent "blue"
+        set-option -g @main_accent "blue"
-          set-option -g pane-active-border fg=black
+        set-option -g pane-active-border fg=black
-          set-option -g pane-border-style fg=black
+        set-option -g pane-border-style fg=black
-          set-option -g status-style "bg=${bg} fg=${fg}"
+        set-option -g status-style "bg=${bg} fg=${fg}"
-          set-option -g status-left "${indicator}"
+        set-option -g status-left "${indicator}"
-          set-option -g status-right "${git} ${pwd} ${separator} ${battery}"
+        set-option -g status-right "${git} ${pwd} ${separator} ${battery}"
-          set-option -g window-status-current-format "${current_window}"
+        set-option -g window-status-current-format "${current_window}"
-          set-option -g window-status-format "${window_status}"
+        set-option -g window-status-format "${window_status}"
-          set-option -g window-status-separator ""
+        set-option -g window-status-separator ""
-        '';
+      '';
-      };
     };
+  };
 }

modules/hm/shell/zoxide.nix

@@ -2,7 +2,7 @@
   flake.modules.homeManager.shell = {
     programs.zoxide = {
       enable = true;
-      options = [ "--cmd cd" ];
+      options = ["--cmd cd"];
       enableZshIntegration = true;
     };
   };

modules/hm/shell/zsh.nix

@@ -1,31 +1,28 @@
-{ lib, ... }:
+{lib, ...}: {
-{
+  flake.modules.homeManager.shell = {pkgs, ...}: {
-  flake.modules.homeManager.shell =
+    programs.zsh = {
-    { pkgs, ... }:
+      enable = true;
-    {
+      history = {
-      programs.zsh = {
+        append = true;
-        enable = true;
+        share = true;
-        history = {
+        expireDuplicatesFirst = true;
-          append = true;
+        ignoreDups = true;
-          share = true;
+        size = 1000000;
-          expireDuplicatesFirst = true;
+        save = 1000000;
-          ignoreDups = true;
+        path = "$HOME/.local/share/zsh/.zsh_history";
-          size = 1000000;
-          save = 1000000;
-          path = "$HOME/.local/share/zsh/.zsh_history";
-        };
-        fastSyntaxHighlighting.enable = true;
-        autosuggestion.enable = true;
-        initContent = ''
-          ${lib.getExe pkgs.fastfetch}
-          bindkey "^A" vi-beginning-of-line
-          bindkey "^E" vi-end-of-line
-          bindkey '^R' fzf-history-widget
-
-          PATH=$PATH:~/.cargo/bin:~/.local/bin
-          alias stui='systemctl-tui'
-          alias vim='nvim --clean'
-        '';
       };
+      fastSyntaxHighlighting.enable = true;
+      autosuggestion.enable = true;
+      initContent = ''
+        ${lib.getExe pkgs.fastfetch}
+        bindkey "^A" vi-beginning-of-line
+        bindkey "^E" vi-end-of-line
+        bindkey '^R' fzf-history-widget
+
+        PATH=$PATH:~/.cargo/bin:~/.local/bin
+        alias stui='systemctl-tui'
+        alias vim='nvim --clean'
+      '';
     };
+  };
 }

modules/hosts/alpha/config.nix

@@ -1,138 +1,143 @@
-{ inputs, config, ... }:
 {
-  flake.modules.nixos.alpha =
+  inputs,
-    {
+  config,
-      hostName,
+  ...
-      userName,
+}: {
-      ...
+  flake.modules.nixos.alpha = {
-    }@innerArgs:
+    hostName,
-    {
+    userName,
-      imports =
+    ...
-        with config.flake.modules.nixos;
+  } @ innerArgs: {
-        [
+    imports = with config.flake.modules.nixos;
-          boot
+      [
-          networking
+        boot
-          virtualisation
+        networking
-          services
+        virtualisation
-        ]
+        services
-        ++ [
+      ]
-          inputs.trok.nixosModules.default
+      ++ [
-          inputs.tfolio.nixosModules.default
+        inputs.trok.nixosModules.default
-        ];
+        inputs.tfolio.nixosModules.default
+      ];
 
-      tnix = {
+    tnix = {
-        boot = {
+      boot = {
-          legacy.enable = true;
+        legacy.enable = true;
 
-          impermanence = {
+        impermanence = {
-            enable = true;
+          enable = true;
 
-            home = {
+          home = {
-              directories = [
+            directories = [
-                ".local/share/nvim"
+              ".local/share/nvim"
-                ".local/share/zsh"
+              ".local/share/zsh"
-                ".local/share/zoxide"
+              ".local/share/zoxide"
-                ".local/state/lazygit"
+              ".local/state/lazygit"
-                ".local/share/opencode"
+              ".local/share/opencode"
-              ];
-            };
-          };
-        };
-
-        networking = {
-          openssh = {
-            enable = true;
-            ports = [
-              23
             ];
           };
-          netbird-client.enable = true;
-        };
-
-        services = {
-          pangolin = {
-            enable = true;
-            domain = "pangolin.lab.tux.rs";
-            baseDomain = "lab.tux.rs";
-            environmentFile = innerArgs.config.sops.secrets."pangolin".path;
-          };
-
-          uptime-kuma = {
-            enable = true;
-            domain = "status.lab.tux.rs";
-          };
-
-          mediaflow-proxy = {
-            enable = true;
-            environmentFile = innerArgs.config.sops.secrets."mediaflow-proxy".path;
-          };
-
-          trok = {
-            enable = true;
-          };
-        };
-
-        virtualisation = {
-          docker.enable = true;
         };
       };
 
-      sops.secrets = {
+      networking = {
-        tux-password = {
+        openssh = {
-          sopsFile = ./secrets.yaml;
+          enable = true;
-          neededForUsers = true;
+          ports = [
+            23
+          ];
+        };
+        netbird-client.enable = true;
+      };
+
+      services = {
+        pangolin = {
+          enable = true;
+          domain = "pangolin.lab.tux.rs";
+          baseDomain = "lab.tux.rs";
+          environmentFile = innerArgs.config.sops.secrets."pangolin".path;
         };
 
-        gemini-api-key = {
+        uptime-kuma = {
-          sopsFile = ./secrets.yaml;
+          enable = true;
-          owner = userName;
+          domain = "status.lab.tux.rs";
-        };
-
-        openrouter-api-key = {
-          sopsFile = ./secrets.yaml;
-          owner = userName;
-        };
-
-        opencode-go-api-key = {
-          sopsFile = ./secrets.yaml;
-          owner = userName;
-        };
-
-        netbird-key = {
-          sopsFile = ./secrets.yaml;
-          owner = userName;
-        };
-
-        "cloudflare-credentials/email" = {
-          sopsFile = ./secrets.yaml;
-        };
-
-        "cloudflare-credentials/dns-api-token" = {
-          sopsFile = ./secrets.yaml;
-        };
-
-        aiostreams = {
-          sopsFile = ./secrets.yaml;
         };
 
         mediaflow-proxy = {
-          sopsFile = ./secrets.yaml;
+          enable = true;
+          environmentFile = innerArgs.config.sops.secrets."mediaflow-proxy".path;
         };
 
-        pangolin = {
+        trok = {
-          sopsFile = ./secrets.yaml;
+          enable = true;
         };
       };
 
-      # --- Networking ---
+      virtualisation = {
-      networking = {
+        docker.enable = true;
-        hostName = hostName;
-        networkmanager.enable = true;
-        firewall.enable = false;
       };
-
-      services.tfolio.enable = true;
-
-      system.stateVersion = "26.05";
     };
+
+    sops.secrets = {
+      tux-password = {
+        sopsFile = ./secrets.yaml;
+        neededForUsers = true;
+      };
+
+      gemini-api-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      openrouter-api-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      opencode-go-api-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      zai-coding-plan-api-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      netbird-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      "cloudflare-credentials/email" = {
+        sopsFile = ./secrets.yaml;
+      };
+
+      "cloudflare-credentials/dns-api-token" = {
+        sopsFile = ./secrets.yaml;
+      };
+
+      aiostreams = {
+        sopsFile = ./secrets.yaml;
+      };
+
+      mediaflow-proxy = {
+        sopsFile = ./secrets.yaml;
+      };
+
+      pangolin = {
+        sopsFile = ./secrets.yaml;
+      };
+    };
+
+    # --- Networking ---
+    networking = {
+      hostName = hostName;
+      networkmanager.enable = true;
+      firewall.enable = false;
+    };
+
+    services.tfolio.enable = true;
+
+    system.stateVersion = "26.05";
+  };
 }

modules/hosts/alpha/disko.nix

@@ -1,22 +1,23 @@
-{ inputs, ... }:
+{inputs, ...}: {
-{
+  flake.modules.nixos.alpha = {
-  flake.modules.nixos.alpha =
+    config,
-    { config, lib, ... }:
+    lib,
-    let
+    ...
-      hasOptinPersistence = config.tnix.boot.impermanence.enable;
+  }: let
-      isLegacy = config.tnix.boot.legacy.enable;
+    hasOptinPersistence = config.tnix.boot.impermanence.enable;
-    in
+    isLegacy = config.tnix.boot.legacy.enable;
-    {
+  in {
-      imports = [
+    imports = [
-        inputs.disko.nixosModules.disko
+      inputs.disko.nixosModules.disko
-      ];
+    ];
 
-      disko.devices.disk.primary = {
+    disko.devices.disk.primary = {
-        device = "/dev/sda";
+      device = "/dev/sda";
-        type = "disk";
+      type = "disk";
-        content = {
+      content = {
-          type = "gpt";
+        type = "gpt";
-          partitions = {
+        partitions =
+          {
             ESP = {
               size = "1G";
               type = "EF00";
@@ -36,36 +37,37 @@
               content = {
                 type = "btrfs";
                 # Base subvolumes that always exist
-                subvolumes = {
+                subvolumes =
-                  "/root" = {
+                  {
-                    mountOptions = [
+                    "/root" = {
-                      "compress=zstd"
+                      mountOptions = [
-                      "noatime"
+                        "compress=zstd"
-                      "space_cache=v2"
+                        "noatime"
-                    ];
+                        "space_cache=v2"
-                    mountpoint = "/";
+                      ];
+                      mountpoint = "/";
+                    };
+                    "/nix" = {
+                      mountOptions = [
+                        "compress=zstd"
+                        "noatime"
+                        "noacl"
+                        "space_cache=v2"
+                      ];
+                      mountpoint = "/nix";
+                    };
+                  }
+                  # Conditionally merge /persist only when impermanence is enabled
+                  // lib.optionalAttrs hasOptinPersistence {
+                    "/persist" = {
+                      mountOptions = [
+                        "compress=zstd"
+                        "noatime"
+                        "space_cache=v2"
+                      ];
+                      mountpoint = "/persist";
+                    };
                   };
-                  "/nix" = {
-                    mountOptions = [
-                      "compress=zstd"
-                      "noatime"
-                      "noacl"
-                      "space_cache=v2"
-                    ];
-                    mountpoint = "/nix";
-                  };
-                }
-                # Conditionally merge /persist only when impermanence is enabled
-                // lib.optionalAttrs hasOptinPersistence {
-                  "/persist" = {
-                    mountOptions = [
-                      "compress=zstd"
-                      "noatime"
-                      "space_cache=v2"
-                    ];
-                    mountpoint = "/persist";
-                  };
-                };
               };
             };
           }
@@ -76,7 +78,7 @@
               type = "EF02";
             };
           };
-        };
       };
     };
+  };
 }

modules/hosts/alpha/hardware.nix

@@ -1,17 +1,15 @@
 {
-  flake.modules.nixos.alpha =
+  flake.modules.nixos.alpha = {
-    {
+    lib,
-      lib,
+    modulesPath,
-      modulesPath,
+    system,
-      system,
+    ...
-      ...
+  }: {
-    }:
+    imports = [
-    {
+      (modulesPath + "/profiles/qemu-guest.nix")
-      imports = [
+    ];
-        (modulesPath + "/profiles/qemu-guest.nix")
-      ];
 
-      networking.useDHCP = lib.mkDefault true;
+    networking.useDHCP = lib.mkDefault true;
-      nixpkgs.hostPlatform = lib.mkDefault system;
+    nixpkgs.hostPlatform = lib.mkDefault system;
-    };
+  };
 }

modules/hosts/alpha/secrets.yaml

@@ -2,6 +2,7 @@ tux-password: ENC[AES256_GCM,data:tvx3nMoIuQSotxHDWLs7UesnyWY3u3EwkqAIzCw3Z2AJse
 gemini-api-key: ENC[AES256_GCM,data:Bo3Z5Jhce0UOBn77I2AcrXYbBgPLDx0eOjPC8J63E/VWNhMPbbxb,iv:iWOsTACOMcK3oqq848WnJ5Ku3tYy1aadmLB4IMgoyqg=,tag:BPzlXoP8/iJaj8c/YFCWyg==,type:str]
 openrouter-api-key: ENC[AES256_GCM,data:D+/ImUTg7UvBTh0fMlWMZ0O/GsQS/R4Hz+CO4l42R6mn+zk+udvw79BctXdWWyrFf2ZNOTJ/99QTtWOUOvHISWaEJogXyb+93g==,iv:c7OtgBu1Zaf7lA4InIsKOAPbAvTl3gaO7QGCFNx21Bo=,tag:KXiASj/qC1YzK6DUox57ug==,type:str]
 opencode-go-api-key: ENC[AES256_GCM,data:ipKkNcRqBERIQ6f6yFzVm999s+UwJys4elHWhzpL441RfOaG9MmRWMcD+wRLJ7DSWFjYu6uUPF7TKez8J6abWeKDgg==,iv:FDSYE3R8zKVxWiP2S/sCVcwEu3fEXg/hCeqCRSF+c6g=,tag:5RDuMFGMoN6xwAYj0HiyjQ==,type:str]
+zai-coding-plan-api-key: ENC[AES256_GCM,data:HrNfR+Ux/Iyt4qkD1uXzDFQb+l0ltMMrbRahEG3pofFbw98VXfRFbhspcxh9vEyqkw==,iv:lzkLxPV7Q38dn0IEgtchVMrvnVBz4e5q282704x/hmU=,tag:IKzE6Tp6D93nJHoEvCPGBQ==,type:str]
 netbird-key: ENC[AES256_GCM,data:NilfyafnGhFVYD6q4+jJQxlhXNdNC8BQ1CZfu8a5wc693Y1h,iv:Rpl0OpkQdBMPpIJ08t9Z0AjDAW6c97pFZKO1KPu8ipY=,tag:du3d0SQWuqJtJSwhSgJE4g==,type:str]
 cloudflare-credentials:
     email: ENC[AES256_GCM,data:K9L6H4dqNNgbCFg=,iv:jirDJb+Y2sXrup6/doRmOdd8tV7zLnttcgG75r4Fs04=,tag:XeyMVC+Q9TEuTxSfOeR2Uw==,type:str]
@@ -29,7 +30,7 @@ sops:
             4TkObqH8ddGpbd7cX5a/wboTjYuEdAviWxjK2oBPgtcFc1f03X3tmA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1mzxxxzhy3us3rd960ufqv7vlxj5cnug86md6x69llg9ujzw2pqws057llf
-    lastmodified: "2026-08-07T20:02:00Z"
+    lastmodified: "2026-09-16T14:21:00Z"
-    mac: ENC[AES256_GCM,data:VrA2OPCcVvAzYjZTkHPxytclISP24P1FqiIQjSGQItkMLieom80N6933hB0Tdn3BM6600bHt2NweSqHjGx//pn2Gbur4pxeN3TpF9tKXc12IcAThUL9g48fMbk5y+kWWVUF1Pezod0YnzWAlalUXFqvKinfm4RqPNjDjndA/dcI=,iv:xfs9XD5ZIQ6dyMMZ8OE5FEs/hrSr/T2VwC7XvZ7xC2A=,tag:jYWo2kgwwltKB+njiYaPkQ==,type:str]
+    mac: ENC[AES256_GCM,data:Aqg1cboHKW5QrJooVIqgbHTFg9EpTEnfCv/RRSp0efzyXvDrR7eG5WTvJPE9IbrmS190yvOlT0fw1Bhzyr8kiyoO71sbyUessw5IMUGcLP+m2FNtt8osc7fSTGseojv3MXBndOMDEOpT+Clv6hbv/rr5eGbb05oK6rW97/pDDfU=,iv:s/9PAHHQ0mHQJosKGclSnumHqm6CG3fDVKD5eT4Q1Y0=,tag:3pgycAwYUz9aEOy4/aW30Q==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3

modules/hosts/arcturus/config.nix

@@ -1,165 +1,175 @@
-{ config, ... }:
+{config, ...}: {
-{
+  flake.modules.nixos.arcturus = {
-  flake.modules.nixos.arcturus =
+    pkgs,
-    {
+    hostName,
-      pkgs,
+    userName,
-      hostName,
+    ...
-      userName,
+  } @ innerArgs: {
-      ...
+    imports = with config.flake.modules.nixos; [
-    }@innerArgs:
+      boot
-    {
+      networking
-      imports = with config.flake.modules.nixos; [
+      virtualisation
-        boot
+      services
-        networking
+    ];
-        virtualisation
-        services
-      ];
 
-      tnix = {
+    tnix = {
-        boot = {
+      boot = {
-          secure-boot.enable = true;
+        secure-boot.enable = true;
 
-          impermanence = {
+        impermanence = {
-            enable = true;
+          enable = true;
 
-            home = {
+          home = {
-              directories = [
+            directories = [
-                "Distrobox"
+              "Distrobox"
-                ".bun"
+              ".bun"
-                ".config/sops"
+              ".rustup"
-                ".local/share/nvim"
+              ".config/sops"
-                ".local/share/opencode"
+              ".config/nix"
-                ".local/share/zsh"
+              ".local/share/nvim"
-                ".local/share/zoxide"
+              ".local/share/opencode"
-                ".local/state/lazygit"
+              ".local/share/zsh"
-              ];
+              ".local/share/zoxide"
+              ".local/state/lazygit"
+            ];
 
-              files = [
+            files = [
-                ".wakatime.cfg"
+              ".wakatime.cfg"
-              ];
+            ];
-            };
           };
         };
-
-        networking = {
-          openssh.enable = true;
-          netbird-client.enable = true;
-          newt = {
-            enable = true;
-            environmentFile = innerArgs.config.sops.secrets.newt.path;
-          };
-        };
-
-        services = {
-          hermes-agent = {
-            enable = true;
-            environmentFiles = [ innerArgs.config.sops.secrets.hermes.path ];
-          };
-
-          cyber-tux = {
-            enable = true;
-            environmentFile = innerArgs.config.sops.secrets.discord-token.path;
-          };
-
-          vaultwarden = {
-            enable = true;
-            domain = "bw.lab.tux.rs";
-            configurePangolin = true;
-          };
-
-          copyparty = {
-            enable = true;
-            domain = "files.lab.tux.rs";
-            accounts.${userName}.passwordFile = innerArgs.config.sops.secrets.copyparty.path;
-            volumes = {
-              "/" = {
-                path = "/var/lib/copyparty/data";
-                access = {
-                  r = "*";
-                  rwmdgGha = [ userName ];
-                };
-              };
-            };
-            configurePangolin = true;
-          };
-        };
-
-        virtualisation = {
-          docker.enable = true;
-          distrobox.enable = true;
-        };
       };
 
-      sops.secrets = {
+      networking = {
-        tux-password = {
+        openssh.enable = true;
-          sopsFile = ./secrets.yaml;
+        netbird-client.enable = true;
-          neededForUsers = true;
-        };
-
-        discord-token = {
-          sopsFile = ./secrets.yaml;
-        };
-
-        gemini-api-key = {
-          sopsFile = ./secrets.yaml;
-          owner = userName;
-        };
-
-        openrouter-api-key = {
-          sopsFile = ./secrets.yaml;
-          owner = userName;
-        };
-
-        opencode-go-api-key = {
-          sopsFile = ./secrets.yaml;
-          owner = userName;
-        };
-
-        netbird-key = {
-          sopsFile = ./secrets.yaml;
-          owner = userName;
-        };
-
         newt = {
-          sopsFile = ./secrets.yaml;
+          enable = true;
-          owner = userName;
+          environmentFile = innerArgs.config.sops.secrets.newt.path;
+        };
+      };
+
+      services = {
+        hermes-agent = {
+          enable = true;
+          environmentFiles = [innerArgs.config.sops.secrets.hermes.path];
+        };
+
+        cyber-tux = {
+          enable = true;
+          environmentFile = innerArgs.config.sops.secrets.discord-token.path;
+        };
+
+        vaultwarden = {
+          enable = true;
+          domain = "bw.lab.tux.rs";
+          configurePangolin = true;
         };
 
         copyparty = {
-          sopsFile = ./secrets.yaml;
-          owner = innerArgs.config.services.copyparty.user;
-        };
-
-        hermes = {
-          sopsFile = ./secrets.yaml;
-        };
-      };
-
-      # --- Networking ---
-      networking = {
-        hostName = hostName;
-        networkmanager = {
           enable = true;
-          wifi.backend = "iwd";
+          domain = "files.lab.tux.rs";
-        };
+          accounts.${userName}.passwordFile = innerArgs.config.sops.secrets.copyparty.path;
-        wireless.iwd = {
+          volumes = {
-          enable = true;
+            "/" = {
-          settings = {
+              path = "/var/lib/copyparty/data";
-            Network = {
+              access = {
-              EnableIPv6 = true;
+                r = "*";
-            };
+                rwmdgGha = [userName];
-            Settings = {
+              };
-              AutoConnect = true;
             };
           };
+          configurePangolin = true;
+        };
+
+        coder = {
+          enable = true;
+          domain = "coder.lab.tux.rs";
+          configurePangolin = true;
         };
-        firewall.enable = false;
       };
 
-      environment.systemPackages = with pkgs; [
+      virtualisation = {
-        impala
+        docker.enable = true;
-      ];
+        distrobox.enable = true;
-
+      };
-      system.stateVersion = "26.05";
     };
+
+    sops.secrets = {
+      tux-password = {
+        sopsFile = ./secrets.yaml;
+        neededForUsers = true;
+      };
+
+      discord-token = {
+        sopsFile = ./secrets.yaml;
+      };
+
+      gemini-api-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      openrouter-api-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      opencode-go-api-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      zai-coding-plan-api-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      netbird-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      newt = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      copyparty = {
+        sopsFile = ./secrets.yaml;
+        owner = innerArgs.config.services.copyparty.user;
+      };
+
+      hermes = {
+        sopsFile = ./secrets.yaml;
+      };
+    };
+
+    # --- Networking ---
+    networking = {
+      hostName = hostName;
+      networkmanager = {
+        enable = true;
+        wifi.backend = "iwd";
+      };
+      wireless.iwd = {
+        enable = true;
+        settings = {
+          Network = {
+            EnableIPv6 = true;
+          };
+          Settings = {
+            AutoConnect = true;
+          };
+        };
+      };
+      firewall.enable = false;
+    };
+
+    environment.systemPackages = with pkgs; [
+      impala
+    ];
+
+    system.stateVersion = "26.05";
+  };
 }

modules/hosts/arcturus/disko.nix

@@ -1,41 +1,42 @@
-{ inputs, ... }:
+{inputs, ...}: {
-{
+  flake.modules.nixos.arcturus = {
-  flake.modules.nixos.arcturus =
+    config,
-    { config, lib, ... }:
+    lib,
-    let
+    ...
-      hasOptinPersistence = config.tnix.boot.impermanence.enable;
+  }: let
-    in
+    hasOptinPersistence = config.tnix.boot.impermanence.enable;
-    {
+  in {
-      imports = [
+    imports = [
-        inputs.disko.nixosModules.disko
+      inputs.disko.nixosModules.disko
-      ];
+    ];
 
-      disko.devices.disk.primary = {
+    disko.devices.disk.primary = {
-        device = "/dev/nvme0n1";
+      device = "/dev/nvme0n1";
-        type = "disk";
+      type = "disk";
-        content = {
+      content = {
-          type = "gpt";
+        type = "gpt";
-          partitions = {
+        partitions = {
-            ESP = {
+          ESP = {
-              size = "1G";
+            size = "1G";
-              type = "EF00";
+            type = "EF00";
-              content = {
+            content = {
-                type = "filesystem";
+              type = "filesystem";
-                format = "vfat";
+              format = "vfat";
-                mountpoint = "/boot";
+              mountpoint = "/boot";
-                mountOptions = [
+              mountOptions = [
-                  "defaults"
+                "defaults"
-                  "umask=0077"
+                "umask=0077"
-                ];
+              ];
-              };
             };
-            root = {
+          };
-              size = "100%";
+          root = {
-              type = "8300";
+            size = "100%";
-              content = {
+            type = "8300";
-                type = "btrfs";
+            content = {
-                # Base subvolumes that always exist
+              type = "btrfs";
-                subvolumes = {
+              # Base subvolumes that always exist
+              subvolumes =
+                {
                   "/root" = {
                     mountOptions = [
                       "compress=zstd"
@@ -65,10 +66,10 @@
                     mountpoint = "/persist";
                   };
                 };
-              };
             };
           };
         };
       };
     };
+  };
 }

modules/hosts/arcturus/hardware.nix

@@ -1,36 +1,33 @@
-{ config, ... }:
+{config, ...}: {
-{
+  flake.modules.nixos.arcturus = {
-  flake.modules.nixos.arcturus =
+    lib,
-    {
+    pkgs,
-      lib,
+    system,
-      pkgs,
+    ...
-      system,
+  } @ innerArgs: {
-      ...
+    imports = with config.flake.modules.nixos; [
-    }@innerArgs:
+      hardware
-    {
+    ];
-      imports = with config.flake.modules.nixos; [
-        hardware
-      ];
 
-      boot.initrd.availableKernelModules = [
+    boot.initrd.availableKernelModules = [
-        "nvme"
+      "nvme"
-        "xhci_pci"
+      "xhci_pci"
-        "ahci"
+      "ahci"
-        "usbhid"
+      "usbhid"
-        "usb_storage"
+      "usb_storage"
-        "sd_mod"
+      "sd_mod"
-      ];
+    ];
-      boot.initrd.kernelModules = [ ];
+    boot.initrd.kernelModules = [];
-      boot.kernelModules = [ "kvm-amd" ];
+    boot.kernelModules = ["kvm-amd"];
-      boot.extraModulePackages = [ ];
+    boot.extraModulePackages = [];
 
-      hardware.cpu.amd.updateMicrocode = lib.mkDefault innerArgs.config.hardware.enableRedistributableFirmware;
+    hardware.cpu.amd.updateMicrocode = lib.mkDefault innerArgs.config.hardware.enableRedistributableFirmware;
 
-      networking.useDHCP = lib.mkDefault true;
+    networking.useDHCP = lib.mkDefault true;
-      nixpkgs.hostPlatform = lib.mkDefault system;
+    nixpkgs.hostPlatform = lib.mkDefault system;
 
-      environment.systemPackages = with pkgs; [
+    environment.systemPackages = with pkgs; [
-        nvtopPackages.amd
+      nvtopPackages.amd
-      ];
+    ];
-    };
+  };
 }

modules/hosts/arcturus/secrets.yaml

@@ -3,6 +3,7 @@ discord-token: ENC[AES256_GCM,data:uzxkrNRRplL/1MfvPZ/EL+I8UACuZQBHZ95BSHuxW0nBj
 gemini-api-key: ENC[AES256_GCM,data:gLZSoYTdKY+rwIpYiXvN9n9PGkUD6q8Oe7dHnYkjEjwDf5qpjubg,iv:ySoNgQWTu9DjvbashF4ulyYP8fJUl4yrCTeBQ0jrGmw=,tag:FctubsQv50AP78JvTb9bpQ==,type:str]
 openrouter-api-key: ENC[AES256_GCM,data:6xONCl9lqOoO7b4CEyCz9607tICDUAkpglRjGS5nYq2ppg2UKqYTrWD1BGCA5Xfs/CWskniVhoNG3vscjKiYCCh9gbM6aqdmTQ==,iv:7Iwc9t00HOOBjA7URXcUO41badqYyJCkFHM/uPkLFxY=,tag:Cl39kitr2e0//HVwAdsdUQ==,type:str]
 opencode-go-api-key: ENC[AES256_GCM,data:dmeRKn7TWHnqvpyPQpcEG6yHTb2bRby/rh10ytL0jHj5R+lRmNVdmqUF92GTznY9vEaB6ZYCJecWhpm8g4upNfOWBg==,iv:9UMJpAlD8gpcNiN+liu3nawoAZQKapEg7sCp561N9E8=,tag:OZlASpOa5BQaQwFWjoLCRw==,type:str]
+zai-coding-plan-api-key: ENC[AES256_GCM,data:lLegmS/RIo7JoBoAyVdcS++rXS8W62cwz+zVsv4dPnlfjGFO/nVlI5InqC34sPxLRQ==,iv:BRC7eYVmdZuWwb+2k2FrnlJih63HXrcvhVp/K5t5td8=,tag:aP8x+Xcnkz2t0hn7erCkKw==,type:str]
 netbird-key: ENC[AES256_GCM,data:q6eKisca04qn/CvALrvXF79MsToDhvLRLv2JTiUBAZglCC9m,iv:jj0/ZD7IDgopprTVUgSfJmdAJmUP3iqewU3dqssGYbk=,tag:6IPRdCm2FGdlTEIX7jt3qA==,type:str]
 copyparty: ENC[AES256_GCM,data:QXt8IgTekg9rzFyuzpg=,iv:vJYfHqCiheq290K9TGACHNHyOWzIn60j1Kz502SE27w=,tag:ECt7Wavlqw1V6zgXiRZtUg==,type:str]
 newt: ENC[AES256_GCM,data:r5Rd81ZrzrIYbXtFkypbJltoGCOYrW6P4IpwGCtaH7lqCg7wD/WMboMx13HN4Mm0J4qbBpDakpfVv9qUTrisYP1xwpKkmY1kqPlFWRZN8hzuuNS2Tv3qUjavTp5XGotVPLHj1Cg/cwGcf8EAssYTwTy7H0PgdQKwqigQD1f1s/j4iXQ=,iv:1xP38/Ayt1xvn2fJGa5zgOrVNOw2J5taG1Orx6uNgZI=,tag:H9JXu9gzyyvTPWgXaoTsiw==,type:str]
@@ -27,7 +28,7 @@ sops:
             TLKEYsPQgOJ7s8P9gw2uPUY6HRz86CtiC6EbO27u0+8BbI85x1QScg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1huqa3hc7wcxk4dpelrzny437nzrx4fnll3d8g9ahznzk268yju5qufapxy
-    lastmodified: "2026-08-12T13:48:51Z"
+    lastmodified: "2026-09-16T14:20:26Z"
-    mac: ENC[AES256_GCM,data:0GyC8VW0qoPaIcKfGKto8wDF64gDmiIhczok8oiJ0l5B7+ZUCVAKmWkMaXHyrU7kqg06WSiIixsnclEjIMxlyZVBOcfQaXeSO51uom/ax+4CfzxSGxgnpySarWRfCHgkcGUeO/eci5MzmZPgAHy7b8IBcJWzVUCS7XBIMMyYwNs=,iv:yUsltZZ1y4fzi3Kakwt/ji/J+r/P1/3mLEQqZiN2pm4=,tag:6Fwo34LOX+jCXF9DoYUv/A==,type:str]
+    mac: ENC[AES256_GCM,data:I33KZL3u+7jfOFu0qn4LVx2nACiURSd6RcEn0ojfT62yC/TcXlGGu4QeN1Dx4Nta77n/h8RzDTcZtiUJylLhiVBmqyMOoNaBOmLDJ+P1L7weYLoWMoaDP7IWyzttGkNTgvyv2nW5IxbdcTZwrcSlPtdupsJeNy76ATHO+eUsvGQ=,iv:FvQKGH5Vzm36huGDnMr15wQL9vsH2hsAhvu0BE/NfEI=,tag:fzAzzgmv3vjWs1VYhh4GeA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3

modules/hosts/canopus/config.nix

@@ -1,140 +1,161 @@
-{ config, ... }:
+{config, ...}: {
-{
+  flake.modules.nixos.canopus = {
-  flake.modules.nixos.canopus =
+    pkgs,
-    {
+    hostName,
-      pkgs,
+    userName,
-      hostName,
+    ...
-      userName,
+  }: {
-      ...
+    imports = with config.flake.modules.nixos; [
-    }:
+      boot
-    {
+      networking
-      imports = with config.flake.modules.nixos; [
+      desktop
-        boot
+      gaming
-        networking
+      virtualisation
-        desktop
+    ];
-        gaming
-        virtualisation
-      ];
 
-      tnix = {
+    tnix = {
-        boot = {
+      boot = {
-          secure-boot.enable = true;
+        secure-boot.enable = true;
 
-          impermanence = {
+        impermanence = {
-            enable = true;
+          enable = true;
 
-            home = {
+          home = {
-              directories = [
+            directories = [
-                "Distrobox"
+              "Distrobox"
-                ".steam"
+              ".steam"
-                ".bun"
+              ".bun"
-                ".cache/awww"
+              ".rustup"
-                ".config/BraveSoftware"
+              ".cache/awww"
-                ".config/zed"
+              ".cache/serpantinum"
-                ".config/Vencord"
+              ".config/BraveSoftware"
-                ".config/vesktop"
+              ".config/zed"
-                ".config/sops"
+              ".config/Vencord"
-                ".config/obs-studio"
+              ".config/vesktop"
-                ".config/easyeffects"
+              ".config/sops"
-                ".config/DankMaterialShell"
+              ".config/nix"
-                ".local/share/Steam"
+              ".config/coderv2"
-                ".local/share/lutris"
+              ".config/obs-studio"
-                ".local/share/net.lutris.Lutris"
+              ".config/easyeffects"
-                ".local/share/nvim"
+              ".config/DankMaterialShell"
-                ".local/share/opencode"
+              ".local/share/Steam"
-                ".local/share/zsh"
+              ".local/share/lutris"
-                ".local/share/zoxide"
+              ".local/share/net.lutris.Lutris"
-                ".local/share/voxtype"
+              ".local/share/nvim"
-                ".local/state/lazygit"
+              ".local/share/opencode"
-                ".local/share/vicinae"
+              ".local/share/zsh"
-                ".local/share/TelegramDesktop"
+              ".local/share/zoxide"
-                ".local/share/GalaxyBudsClient"
+              ".local/share/voxtype"
-                ".local/state/serpantinum"
+              ".local/state/lazygit"
-              ];
+              ".local/share/vicinae"
+              ".local/share/TelegramDesktop"
+              ".local/share/GalaxyBudsClient"
+              ".local/state/serpantinum"
+              ".local/share/zed"
 
-              files = [
+              ".claude"
-                ".wakatime.cfg"
+              ".orca"
-              ];
+              ".config/orca"
-            };
+              ".zcode"
+              ".config/ZCode"
+            ];
+
+            files = [
+              ".wakatime.cfg"
+              ".claude.json"
+              ".config/gh/hosts.yml"
+            ];
           };
         };
-
-        networking = {
-          openssh.enable = true;
-          netbird-client.enable = true;
-        };
-
-        virtualisation = {
-          docker.enable = true;
-          docker.nvidia.enable = false;
-          qemu.enable = true;
-          waydroid.enable = true;
-          distrobox.enable = true;
-        };
       };
 
-      sops.secrets = {
-        tux-password = {
-          sopsFile = ./secrets.yaml;
-          neededForUsers = true;
-        };
-
-        gemini-api-key = {
-          sopsFile = ./secrets.yaml;
-          owner = userName;
-        };
-
-        openrouter-api-key = {
-          sopsFile = ./secrets.yaml;
-          owner = userName;
-        };
-
-        opencode-go-api-key = {
-          sopsFile = ./secrets.yaml;
-          owner = userName;
-        };
-
-        netbird-key = {
-          sopsFile = ./secrets.yaml;
-          owner = userName;
-        };
-
-        vicinae-json = {
-          sopsFile = ./secrets.yaml;
-          owner = userName;
-        };
-      };
-
-      # --- Networking ---
       networking = {
-        hostName = hostName;
+        openssh.enable = true;
-        networkmanager = {
+        netbird-client.enable = true;
-          enable = true;
-          wifi.backend = "iwd";
-        };
-        wireless.iwd = {
-          enable = true;
-          settings = {
-            Network = {
-              EnableIPv6 = true;
-            };
-            Settings = {
-              AutoConnect = true;
-            };
-          };
-        };
-        firewall.enable = false;
       };
 
-      environment.systemPackages = with pkgs; [
+      virtualisation = {
-        davinci-resolve
+        docker.enable = true;
-        telegram-desktop
+        docker.nvidia.enable = false;
-        galaxy-buds-client
+        qemu.enable = true;
-        impala
+        waydroid.enable = true;
-      ];
+        distrobox.enable = true;
+      };
 
-      # !!! DO NOT CHANGE THIS !!!
+      programs.nix-ld.enable = true;
-      # This should match the version used at initial install.
-      system.stateVersion = "26.05";
     };
+
+    sops.secrets = {
+      tux-password = {
+        sopsFile = ./secrets.yaml;
+        neededForUsers = true;
+      };
+
+      gemini-api-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      openrouter-api-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      opencode-go-api-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      zai-coding-plan-api-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      netbird-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      vicinae-json = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+    };
+
+    # --- Networking ---
+    networking = {
+      hostName = hostName;
+      networkmanager = {
+        enable = true;
+        wifi.backend = "iwd";
+      };
+      wireless.iwd = {
+        enable = true;
+        settings = {
+          Network = {
+            EnableIPv6 = true;
+          };
+          Settings = {
+            AutoConnect = true;
+          };
+        };
+      };
+      firewall.enable = false;
+    };
+
+    environment.systemPackages = with pkgs; [
+      davinci-resolve
+      telegram-desktop
+      galaxy-buds-client
+      impala
+      llm-agents.claude-code
+      llm-agents.orca
+      llm-agents.zcode
+      coder
+    ];
+
+    # !!! DO NOT CHANGE THIS !!!
+    # This should match the version used at initial install.
+    system.stateVersion = "26.05";
+  };
 }

modules/hosts/canopus/disko.nix

@@ -1,49 +1,50 @@
-{ inputs, ... }:
+{inputs, ...}: {
-{
+  flake.modules.nixos.canopus = {
-  flake.modules.nixos.canopus =
+    config,
-    { config, lib, ... }:
+    lib,
-    let
+    ...
-      hasOptinPersistence = config.tnix.boot.impermanence.enable;
+  }: let
-    in
+    hasOptinPersistence = config.tnix.boot.impermanence.enable;
-    {
+  in {
-      imports = [
+    imports = [
-        inputs.disko.nixosModules.disko
+      inputs.disko.nixosModules.disko
-      ];
+    ];
 
-      disko.devices.disk.primary = {
+    disko.devices.disk.primary = {
-        device = "/dev/nvme0n1";
+      device = "/dev/nvme0n1";
-        type = "disk";
+      type = "disk";
-        content = {
+      content = {
-          type = "gpt";
+        type = "gpt";
-          partitions = {
+        partitions = {
-            ESP = {
+          ESP = {
-              size = "1G";
+            size = "1G";
-              type = "EF00";
+            type = "EF00";
-              content = {
+            content = {
-                type = "filesystem";
+              type = "filesystem";
-                format = "vfat";
+              format = "vfat";
-                mountpoint = "/boot";
+              mountpoint = "/boot";
-                mountOptions = [
+              mountOptions = [
-                  "defaults"
+                "defaults"
-                  "umask=0077"
+                "umask=0077"
-                ];
+              ];
-              };
             };
-            swap = {
+          };
-              size = "32G";
+          swap = {
-              content = {
+            size = "32G";
-                type = "swap";
+            content = {
-                discardPolicy = "both";
+              type = "swap";
-                resumeDevice = true;
+              discardPolicy = "both";
-              };
+              resumeDevice = true;
             };
-            root = {
+          };
-              size = "100%";
+          root = {
-              type = "8300";
+            size = "100%";
-              content = {
+            type = "8300";
-                type = "btrfs";
+            content = {
-                # Base subvolumes that always exist
+              type = "btrfs";
-                subvolumes = {
+              # Base subvolumes that always exist
+              subvolumes =
+                {
                   "/root" = {
                     mountOptions = [
                       "compress=zstd"
@@ -73,10 +74,10 @@
                     mountpoint = "/persist";
                   };
                 };
-              };
             };
           };
         };
       };
     };
+  };
 }

modules/hosts/canopus/hardware.nix

@@ -1,150 +1,150 @@
-{ inputs, config, ... }:
 {
-  flake.modules.nixos.canopus =
+  inputs,
-    {
+  config,
-      lib,
+  ...
-      pkgs,
+}: {
-      system,
+  flake.modules.nixos.canopus = {
-      ...
+    lib,
-    }@innerArgs:
+    pkgs,
-    {
+    system,
-      imports =
+    ...
-        with config.flake.modules.nixos;
+  } @ innerArgs: {
-        [
+    imports = with config.flake.modules.nixos;
-          hardware
+      [
-        ]
+        hardware
-        ++ [
+      ]
-          inputs.nixos-hardware.nixosModules.asus-zephyrus-ga503
+      ++ [
-          inputs.cardwire.nixosModules.default
+        inputs.nixos-hardware.nixosModules.asus-zephyrus-ga503
-        ];
+        inputs.cardwire.nixosModules.default
-
-      boot.kernelParams = [ "nvidia-drm.modeset=1" ];
-      boot.initrd.availableKernelModules = [
-        "nvme"
-        "xhci_pci"
-        "ahci"
-        "usbhid"
-        "usb_storage"
-        "sd_mod"
       ];
-      boot.initrd.kernelModules = [ ];
-      boot.kernelModules = [ "kvm-amd" ];
-      boot.extraModulePackages = [ ];
 
-      hardware = {
+    boot.kernelParams = ["nvidia-drm.modeset=1"];
-        nvidia = {
+    boot.initrd.availableKernelModules = [
-          modesetting.enable = true;
+      "nvme"
-          open = false;
+      "xhci_pci"
-          nvidiaSettings = true;
+      "ahci"
-        };
+      "usbhid"
+      "usb_storage"
+      "sd_mod"
+    ];
+    boot.initrd.kernelModules = [];
+    boot.kernelModules = ["kvm-amd"];
+    boot.extraModulePackages = [];
 
-        cpu.amd.updateMicrocode = lib.mkDefault innerArgs.config.hardware.enableRedistributableFirmware;
+    hardware = {
+      nvidia = {
+        modesetting.enable = true;
+        open = false;
+        nvidiaSettings = true;
       };
 
-      services = {
+      cpu.amd.updateMicrocode = lib.mkDefault innerArgs.config.hardware.enableRedistributableFirmware;
-        xserver.videoDrivers = [ "nvidia" ];
-        power-profiles-daemon.enable = true;
-        upower.enable = true;
-
-        cardwire = {
-          enable = true;
-          settings = {
-            auto_apply_gpu_state = true;
-            experimental_nvidia_block = true;
-            battery_auto_switch = true;
-            battery_auto_switch_mode = "hybrid";
-          };
-        };
-
-        asusd = {
-          enable = true;
-          asusdConfig.text = ''
-            (
-              charge_control_end_threshold: 80,
-              disable_nvidia_powerd_on_battery: true,
-              ac_command: "",
-              bat_command: "",
-
-              platform_profile_linked_epp: true,
-              platform_profile_on_battery: Quiet,
-              platform_profile_on_ac: Performance,
-
-              change_platform_profile_on_battery: true,
-              change_platform_profile_on_ac: true,
-
-              profile_quiet_epp: Power,
-              profile_balanced_epp: BalancePower,
-              profile_custom_epp: Performance,
-              profile_performance_epp: Performance,
-
-              ac_profile_tunings: {},
-              dc_profile_tunings: {},
-              armoury_settings: {},
-            )
-          '';
-          profileConfig.text = ''
-            (
-              active_profile: Quiet,
-            )
-          '';
-          fanCurvesConfig.text = ''
-            (
-              profiles: (
-                balanced: [
-                  (
-                    fan: CPU,
-                    pwm: (20, 40, 60, 85, 110, 140, 170, 200),
-                    temp: (45, 55, 62, 68, 74, 80, 86, 92),
-                    enabled: true,
-                  ),
-                  (
-                    fan: GPU,
-                    pwm: (20, 40, 60, 85, 110, 140, 170, 200),
-                    temp: (45, 55, 62, 68, 74, 80, 86, 92),
-                    enabled: true,
-                  ),
-                ],
-                performance: [
-                  (
-                    fan: CPU,
-                    pwm: (35, 60, 90, 120, 150, 180, 220, 255),
-                    temp: (45, 55, 62, 68, 74, 80, 86, 92),
-                    enabled: true,
-                  ),
-                  (
-                    fan: GPU,
-                    pwm: (35, 60, 90, 120, 150, 180, 220, 255),
-                    temp: (45, 55, 62, 68, 74, 80, 86, 92),
-                    enabled: true,
-                  ),
-                ],
-                quiet: [
-                  (
-                    fan: CPU,
-                    pwm: (0, 10, 20, 35, 55, 80, 110, 140),
-                    temp: (45, 55, 62, 68, 74, 80, 86, 92),
-                    enabled: true,
-                  ),
-                  (
-                    fan: GPU,
-                    pwm: (0, 10, 20, 35, 55, 80, 110, 140),
-                    temp: (45, 55, 62, 68, 74, 80, 86, 92),
-                    enabled: true,
-                  ),
-                ],
-                custom: [],
-              ),
-            )
-          '';
-        };
-      };
-
-      networking.useDHCP = lib.mkDefault true;
-      nixpkgs.config.cudaSupport = true;
-      nixpkgs.hostPlatform = lib.mkDefault system;
-
-      environment.systemPackages = with pkgs; [
-        nvtopPackages.full
-      ];
     };
+
+    services = {
+      xserver.videoDrivers = ["nvidia"];
+      power-profiles-daemon.enable = true;
+      upower.enable = true;
+
+      cardwire = {
+        enable = true;
+        settings = {
+          auto_apply_gpu_state = true;
+          experimental_nvidia_block = true;
+          battery_auto_switch = true;
+          battery_auto_switch_mode = "hybrid";
+        };
+      };
+
+      asusd = {
+        enable = true;
+        asusdConfig.text = ''
+          (
+            charge_control_end_threshold: 80,
+            disable_nvidia_powerd_on_battery: true,
+            ac_command: "",
+            bat_command: "",
+
+            platform_profile_linked_epp: true,
+            platform_profile_on_battery: Quiet,
+            platform_profile_on_ac: Performance,
+
+            change_platform_profile_on_battery: true,
+            change_platform_profile_on_ac: true,
+
+            profile_quiet_epp: Power,
+            profile_balanced_epp: BalancePower,
+            profile_custom_epp: Performance,
+            profile_performance_epp: Performance,
+
+            ac_profile_tunings: {},
+            dc_profile_tunings: {},
+            armoury_settings: {},
+          )
+        '';
+        profileConfig.text = ''
+          (
+            active_profile: Quiet,
+          )
+        '';
+        fanCurvesConfig.text = ''
+          (
+            profiles: (
+              balanced: [
+                (
+                  fan: CPU,
+                  pwm: (20, 40, 60, 85, 110, 140, 170, 200),
+                  temp: (45, 55, 62, 68, 74, 80, 86, 92),
+                  enabled: true,
+                ),
+                (
+                  fan: GPU,
+                  pwm: (20, 40, 60, 85, 110, 140, 170, 200),
+                  temp: (45, 55, 62, 68, 74, 80, 86, 92),
+                  enabled: true,
+                ),
+              ],
+              performance: [
+                (
+                  fan: CPU,
+                  pwm: (35, 60, 90, 120, 150, 180, 220, 255),
+                  temp: (45, 55, 62, 68, 74, 80, 86, 92),
+                  enabled: true,
+                ),
+                (
+                  fan: GPU,
+                  pwm: (35, 60, 90, 120, 150, 180, 220, 255),
+                  temp: (45, 55, 62, 68, 74, 80, 86, 92),
+                  enabled: true,
+                ),
+              ],
+              quiet: [
+                (
+                  fan: CPU,
+                  pwm: (0, 10, 20, 35, 55, 80, 110, 140),
+                  temp: (45, 55, 62, 68, 74, 80, 86, 92),
+                  enabled: true,
+                ),
+                (
+                  fan: GPU,
+                  pwm: (0, 10, 20, 35, 55, 80, 110, 140),
+                  temp: (45, 55, 62, 68, 74, 80, 86, 92),
+                  enabled: true,
+                ),
+              ],
+              custom: [],
+            ),
+          )
+        '';
+      };
+    };
+
+    networking.useDHCP = lib.mkDefault true;
+    nixpkgs.config.cudaSupport = true;
+    nixpkgs.hostPlatform = lib.mkDefault system;
+
+    environment.systemPackages = with pkgs; [
+      nvtopPackages.full
+    ];
+  };
 }

modules/hosts/canopus/home.nix

@@ -1,6 +1,5 @@
-{ config, ... }:
+{config, ...}: {
-{
+  flake.modules.homeManager.canopus = {pkgs, ...}: {
-  flake.modules.homeManager.canopus = { pkgs, ... }: {
     imports = with config.flake.modules.homeManager; [
       desktop
     ];
@@ -27,8 +26,7 @@
         enable = true;
         settings = {
           authorized_fingerprints = {
-            "f4:4b:17:61:f7:01:a4:a2:e1:c7:8c:1c:7a:f3:8b:87:14:3d:05:3d:a0:8b:cc:e7:88:d8:d8:d2:a4:c2:75:8b" =
+            "f4:4b:17:61:f7:01:a4:a2:e1:c7:8c:1c:7a:f3:8b:87:14:3d:05:3d:a0:8b:cc:e7:88:d8:d8:d2:a4:c2:75:8b" = "sirius";
-              "sirius";
           };
         };
       };

modules/hosts/canopus/secrets.yaml

@@ -2,12 +2,12 @@ tux-password: ENC[AES256_GCM,data:Xb4/JMAZCBnBheDCJdRRGXLnMJ1ej8HbN+AUqA/+2sdYES
 gemini-api-key: ENC[AES256_GCM,data:Q6+actg0oyUWiUJVy/9yZmea1QyGu2o8LfMsuAVFD6k7kp0dYIrl,iv:ukyouqrHxzVpBBE98KL6PW8P3j+seemm/e0Gl1urUcM=,tag:Z7MM3dJ414CmdxE72cdzNA==,type:str]
 openrouter-api-key: ENC[AES256_GCM,data:SalhWKR6artX/kOVKZGpKSmrgsQDU/heshrdkK3wotOZ3BRn/ZqZRBldvl1JPSenMAMvE2LWUdmBQmwG/id7L7JL1O/+lUHIQw==,iv:hLlHayFJgUkWOirVLfqP0pGRBZAqGKe+EE2yG1ELGNk=,tag:0qoo0tb+xWjjQXr4n1qGmw==,type:str]
 opencode-go-api-key: ENC[AES256_GCM,data:zbeTcaXJZFVfYnM/7sgblJFU9WfeosX/44KsXvrzKwiLPfGLLYYo9AFaCvWzzG6jHuSZC5OYrBWfOZv4+3omfCgglQ==,iv:LscUQE+PNhXGim9PSqc9nZIZichWSgAn/zsNxQ/HM/o=,tag:MaBCobnRM42fopiibibe5Q==,type:str]
+zai-coding-plan-api-key: ENC[AES256_GCM,data:osUoFOvBgu+PtNiTIDIm3JoxsBJnQ9I8zY//9oeTpJxIvMctSWYnT4GYP4oI5mClZg==,iv:z5qxUPomGF1avLyk8PrAS3t+34ZGlQMRjbxVJ4JH9Cc=,tag:Qbz/LYAMXejXU4RS3RUPqA==,type:str]
 netbird-key: ENC[AES256_GCM,data:swmaa+RjxeUmEl8hS2riGrW4lP5jdks9HM3x57/FLpOuqFtR,iv:MrpVjiocrPi+dBGPk7pwgSUNlJ1eryRpMjC8+jkU+T0=,tag:j6sqpQ02apqc6FwkdDvk9g==,type:str]
 vicinae-json: ENC[AES256_GCM,data:FarBf6l8pl3hF7kGKPIWztUhwiKoQXmyTufCuJ120K/bPh1Bfiyi+ETt4DLYOGI6FJXfpVz4BbZOA29bXTLhVPxH0QtyBu/F5uEqA015b/c8VevDJSyy9huR13qO9ksLbMBt8RfWbAd9j26t7A1C8/mMyiJOEXCCTV9CEIW3xWrsYmhwsT8RYM+PwrPSeN1gQXHSMyRUjf/kOdJoda8+iXpLfjo4II4r2ELpbqi8QxhrRdsJsoOfAymFM784NtlTjE+h6S4TMehmoF/9ARif6I5SGQ0WfIKt/8orTGCPllL+NupLziSnpIGRGSybdArD+o5NCw59GOAbVRADxq8rCESwEkq3cF+hm8HabfYbiQ==,iv:Y/hXLFTJT3gNF3B6tgKoAh7njVuneoUzjVTlsCZiySw=,tag:2hfrwph6IccJdRu/yGu3XA==,type:str]
 sops:
     age:
-        - recipient: age14vktfes95f33vuefwnmuvryas7az04u76dsgyhfvsx73czkvmp2q7njkl4
+        - enc: |
-          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqS2RZdVJaNTlRamZPMkll
             MDRVSVl1b2x2LzZpdlBrdmZtdyt3UE15RldRCldXUXE2a1BFeHg5NGNPbW5IMDht
@@ -15,8 +15,8 @@ sops:
             bThQTFdZU29ISm93TWcwVk5ZTkhRWm8KCcprmLGhahgDkXCBpzjctHgao+gc+rKC
             xLIwheUyFJOGK+ixqcdoZ/PC0kY68hVLt1YzLAyxFi4Ur1wltPrNug==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1x36yr8h993srfj29sfpzt4wyz52nztvncpmhgmfs0j26qvfecq3qvcm0an
+          recipient: age14vktfes95f33vuefwnmuvryas7az04u76dsgyhfvsx73czkvmp2q7njkl4
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGVW13WFE1Ylh3Uk1HNU1i
             bU9kRzFqTmhkQlRzMlRkM0VhMlNmMDUyK25NCkZYUStxM2tScGozRXJGekxGa1RX
@@ -24,7 +24,8 @@ sops:
             V1N3eUVjZ0VZRjBZdXRPNng3Y3JoUTAKQau9CG9XfvM+5JZVRwaJr/o/sXMaJiy2
             wo2YcDb+4vfT4Wr+/8J3ccQgbLRZH916X5ZPL+A+nFyVXVKOCl3ENg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-12T06:33:00Z"
+          recipient: age1x36yr8h993srfj29sfpzt4wyz52nztvncpmhgmfs0j26qvfecq3qvcm0an
-    mac: ENC[AES256_GCM,data:htDJdEx34Q5NG8vwbBimnFENZawbLZ4FC0DkyG6J5RYP0BFnycKcKGsYR87SvIjcJZXvfZ0e6fXdtc78dd6I0sQtrQ7aNn4Iktbu/AkPmntsBwpIjVI99X9zUyQB87go/oX15yuyt8loB6ds2RkL/pfFsgLbFc10JHsBy+WcEzI=,iv:HvY+5LYzyHpRm8XCSKrN8ra/LJT9v23TPSsZg/4QVNU=,tag:k+d45+zgBYq4vlWmmc8ZkQ==,type:str]
+    lastmodified: "2026-09-16T14:20:36Z"
+    mac: ENC[AES256_GCM,data:mhJvvn/+VBfNrP1pXRweLSNVlHq9/DLDcKQv8k9ZVsEcd077ifEAqduOXVKXcXDM0VTuBzArw9hmih+kZbCHoUZAQrk8LF7FC4a4FFwXG9p45uKWbUloTuq5w3MCxyU8IoyiAufZcWUlYFQjZ8K4n8N0bVrGQGHogemnrBXTUIo=,iv:H3tKQOuIe/pEIp0pUWCSar8VDompXNZ4BZfD1Wg4pb0=,tag:lyPR4Prlal1bpSRLmGfy7A==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.12.2
+    version: 3.13.3

modules/hosts/sirius/config.nix

@@ -1,139 +1,162 @@
-{ config, ... }:
+{config, ...}: {
-{
+  flake.modules.nixos.sirius = {
-  flake.modules.nixos.sirius =
+    pkgs,
-    {
+    hostName,
-      pkgs,
+    userName,
-      hostName,
+    ...
-      userName,
+  }: {
-      ...
+    imports = with config.flake.modules.nixos; [
-    }:
+      boot
-    {
+      networking
-      imports = with config.flake.modules.nixos; [
+      desktop
-        boot
+      gaming
-        networking
+      virtualisation
-        desktop
+    ];
-        gaming
-        virtualisation
-      ];
 
-      tnix = {
+    tnix = {
-        boot = {
+      boot = {
-          secure-boot.enable = true;
+        secure-boot.enable = true;
 
-          impermanence = {
+        impermanence = {
-            enable = true;
+          enable = true;
 
-            home = {
+          home = {
-              directories = [
+            directories = [
-                "Distrobox"
+              "Distrobox"
-                ".bun"
+              ".steam"
-                ".steam"
+              ".bun"
-                ".cache/awww"
+              ".rustup"
-                ".config/BraveSoftware"
+              ".cache/awww"
-                ".config/zed"
+              ".cache/serpantinum"
-                ".config/Vencord"
+              ".config/BraveSoftware"
-                ".config/vesktop"
+              ".config/zed"
-                ".config/sops"
+              ".config/Vencord"
-                ".config/obs-studio"
+              ".config/vesktop"
-                ".config/easyeffects"
+              ".config/sops"
-                ".config/DankMaterialShell"
+              ".config/nix"
-                ".local/share/Steam"
+              ".config/coderv2"
-                ".local/share/lutris"
+              ".config/obs-studio"
-                ".local/share/net.lutris.Lutris"
+              ".config/easyeffects"
-                ".local/share/nvim"
+              ".config/DankMaterialShell"
-                ".local/share/opencode"
+              ".local/share/Steam"
-                ".local/share/zsh"
+              ".local/share/lutris"
-                ".local/share/zoxide"
+              ".local/share/net.lutris.Lutris"
-                ".local/share/voxtype"
+              ".local/share/nvim"
-                ".local/state/lazygit"
+              ".local/share/opencode"
-                ".local/share/vicinae"
+              ".local/share/zsh"
-                ".local/share/TelegramDesktop"
+              ".local/share/zoxide"
-                ".local/state/serpantinum"
+              ".local/share/voxtype"
-              ];
+              ".local/state/lazygit"
+              ".local/share/vicinae"
+              ".local/share/TelegramDesktop"
+              ".local/share/GalaxyBudsClient"
+              ".local/state/serpantinum"
+              ".local/share/zed"
 
-              files = [
+              ".claude"
-                ".wakatime.cfg"
+              ".orca"
-                ".config/lan-mouse/lan-mouse.pem"
+              ".config/orca"
-              ];
+              ".zcode"
-            };
+              ".config/ZCode"
+            ];
+
+            files = [
+              ".wakatime.cfg"
+              ".config/lan-mouse/lan-mouse.pem"
+              ".claude.json"
+              ".config/gh/hosts.yml"
+            ];
           };
         };
-
-        networking = {
-          openssh.enable = true;
-          netbird-client.enable = true;
-        };
-
-        virtualisation = {
-          docker.enable = true;
-          docker.nvidia.enable = true;
-          qemu.enable = true;
-          waydroid.enable = true;
-          distrobox.enable = true;
-        };
       };
 
-      sops.secrets = {
-        tux-password = {
-          sopsFile = ./secrets.yaml;
-          neededForUsers = true;
-        };
-
-        gemini-api-key = {
-          sopsFile = ./secrets.yaml;
-          owner = userName;
-        };
-
-        openrouter-api-key = {
-          sopsFile = ./secrets.yaml;
-          owner = userName;
-        };
-
-        opencode-go-api-key = {
-          sopsFile = ./secrets.yaml;
-          owner = userName;
-        };
-
-        netbird-key = {
-          sopsFile = ./secrets.yaml;
-          owner = userName;
-        };
-
-        vicinae-json = {
-          sopsFile = ./secrets.yaml;
-          owner = userName;
-        };
-      };
-
-      # --- Networking ---
       networking = {
-        hostName = hostName;
+        openssh.enable = true;
-        networkmanager = {
+        netbird-client.enable = true;
-          enable = true;
-          wifi.backend = "iwd";
-        };
-        wireless.iwd = {
-          enable = true;
-          settings = {
-            Network = {
-              EnableIPv6 = true;
-            };
-            Settings = {
-              AutoConnect = true;
-            };
-          };
-        };
-        firewall.enable = false;
       };
 
-      environment.systemPackages = with pkgs; [
+      virtualisation = {
-        davinci-resolve
+        docker.enable = true;
-        telegram-desktop
+        docker.nvidia.enable = true;
-        impala
+        qemu.enable = true;
-      ];
+        waydroid.enable = true;
+        distrobox.enable = true;
+      };
 
-      # !!! DO NOT CHANGE THIS !!!
+      programs.nix-ld.enable = true;
-      # This should match the version used at initial install.
-      system.stateVersion = "26.05";
     };
+
+    sops.secrets = {
+      tux-password = {
+        sopsFile = ./secrets.yaml;
+        neededForUsers = true;
+      };
+
+      gemini-api-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      openrouter-api-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      opencode-go-api-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      zai-coding-plan-api-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      netbird-key = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+
+      vicinae-json = {
+        sopsFile = ./secrets.yaml;
+        owner = userName;
+      };
+    };
+
+    # --- Networking ---
+    networking = {
+      hostName = hostName;
+      networkmanager = {
+        enable = true;
+        wifi.backend = "iwd";
+      };
+      wireless.iwd = {
+        enable = true;
+        settings = {
+          Network = {
+            EnableIPv6 = true;
+          };
+          Settings = {
+            AutoConnect = true;
+          };
+        };
+      };
+      firewall.enable = false;
+    };
+
+    environment.systemPackages = with pkgs; [
+      davinci-resolve
+      telegram-desktop
+      galaxy-buds-client
+      impala
+      llm-agents.claude-code
+      llm-agents.orca
+      llm-agents.zcode
+      coder
+    ];
+
+    # !!! DO NOT CHANGE THIS !!!
+    # This should match the version used at initial install.
+    system.stateVersion = "26.05";
+  };
 }

modules/hosts/sirius/disko.nix

@@ -1,49 +1,50 @@
-{ inputs, ... }:
+{inputs, ...}: {
-{
+  flake.modules.nixos.sirius = {
-  flake.modules.nixos.sirius =
+    config,
-    { config, lib, ... }:
+    lib,
-    let
+    ...
-      hasOptinPersistence = config.tnix.boot.impermanence.enable;
+  }: let
-    in
+    hasOptinPersistence = config.tnix.boot.impermanence.enable;
-    {
+  in {
-      imports = [
+    imports = [
-        inputs.disko.nixosModules.disko
+      inputs.disko.nixosModules.disko
-      ];
+    ];
 
-      disko.devices.disk.primary = {
+    disko.devices.disk.primary = {
-        device = "/dev/nvme1n1";
+      device = "/dev/nvme1n1";
-        type = "disk";
+      type = "disk";
-        content = {
+      content = {
-          type = "gpt";
+        type = "gpt";
-          partitions = {
+        partitions = {
-            ESP = {
+          ESP = {
-              size = "1G";
+            size = "1G";
-              type = "EF00";
+            type = "EF00";
-              content = {
+            content = {
-                type = "filesystem";
+              type = "filesystem";
-                format = "vfat";
+              format = "vfat";
-                mountpoint = "/boot";
+              mountpoint = "/boot";
-                mountOptions = [
+              mountOptions = [
-                  "defaults"
+                "defaults"
-                  "umask=0077"
+                "umask=0077"
-                ];
+              ];
-              };
             };
-            swap = {
+          };
-              size = "70G";
+          swap = {
-              content = {
+            size = "70G";
-                type = "swap";
+            content = {
-                discardPolicy = "both";
+              type = "swap";
-                resumeDevice = true;
+              discardPolicy = "both";
-              };
+              resumeDevice = true;
             };
-            root = {
+          };
-              size = "100%";
+          root = {
-              type = "8300";
+            size = "100%";
-              content = {
+            type = "8300";
-                type = "btrfs";
+            content = {
-                # Base subvolumes that always exist
+              type = "btrfs";
-                subvolumes = {
+              # Base subvolumes that always exist
+              subvolumes =
+                {
                   "/root" = {
                     mountOptions = [
                       "compress=zstd"
@@ -73,10 +74,10 @@
                     mountpoint = "/persist";
                   };
                 };
-              };
             };
           };
         };
       };
     };
+  };
 }

modules/hosts/sirius/hardware.nix

@@ -1,61 +1,61 @@
-{ inputs, config, ... }:
 {
-  flake.modules.nixos.sirius =
+  inputs,
-    {
+  config,
-      lib,
+  ...
-      pkgs,
+}: {
-      system,
+  flake.modules.nixos.sirius = {
-      ...
+    lib,
-    }@innerArgs:
+    pkgs,
-    {
+    system,
-      imports =
+    ...
-        with config.flake.modules.nixos;
+  } @ innerArgs: {
-        [
+    imports = with config.flake.modules.nixos;
-          hardware
+      [
-        ]
+        hardware
-        ++ [
+      ]
-          inputs.cardwire.nixosModules.default
+      ++ [
-        ];
+        inputs.cardwire.nixosModules.default
-
-      boot.kernelParams = [ "nvidia-drm.modeset=1" ];
-      boot.initrd.availableKernelModules = [
-        "nvme"
-        "xhci_pci"
-        "ahci"
-        "usbhid"
-        "usb_storage"
-        "sd_mod"
       ];
-      boot.initrd.kernelModules = [ ];
-      boot.kernelModules = [ "kvm-amd" ];
-      boot.extraModulePackages = [ ];
 
-      hardware = {
+    boot.kernelParams = ["nvidia-drm.modeset=1"];
-        nvidia = {
+    boot.initrd.availableKernelModules = [
-          modesetting.enable = true;
+      "nvme"
-          open = false;
+      "xhci_pci"
-          nvidiaSettings = true;
+      "ahci"
-        };
+      "usbhid"
+      "usb_storage"
+      "sd_mod"
+    ];
+    boot.initrd.kernelModules = [];
+    boot.kernelModules = ["kvm-amd"];
+    boot.extraModulePackages = [];
 
-        cpu.amd.updateMicrocode = lib.mkDefault innerArgs.config.hardware.enableRedistributableFirmware;
+    hardware = {
+      nvidia = {
+        modesetting.enable = true;
+        open = false;
+        nvidiaSettings = true;
       };
 
-      services = {
+      cpu.amd.updateMicrocode = lib.mkDefault innerArgs.config.hardware.enableRedistributableFirmware;
-        xserver.videoDrivers = [ "nvidia" ];
-        power-profiles-daemon.enable = true;
-
-        cardwire = {
-          enable = true;
-          settings.auto_apply_gpu_state = true;
-        };
-      };
-
-      networking.useDHCP = lib.mkDefault true;
-      nixpkgs.config.cudaSupport = true;
-      nixpkgs.hostPlatform = lib.mkDefault system;
-
-      environment.systemPackages = with pkgs; [
-        nvtopPackages.full
-      ];
     };
+
+    services = {
+      xserver.videoDrivers = ["nvidia"];
+      power-profiles-daemon.enable = true;
+
+      cardwire = {
+        enable = true;
+        settings.auto_apply_gpu_state = true;
+      };
+    };
+
+    networking.useDHCP = lib.mkDefault true;
+    nixpkgs.config.cudaSupport = true;
+    nixpkgs.hostPlatform = lib.mkDefault system;
+
+    environment.systemPackages = with pkgs; [
+      nvtopPackages.full
+    ];
+  };
 }

modules/hosts/sirius/home.nix

@@ -1,5 +1,4 @@
-{ config, ... }:
+{config, ...}: {
-{
   flake.modules.homeManager.sirius = {
     imports = with config.flake.modules.homeManager; [
       desktop
@@ -45,7 +44,7 @@
               position = "bottom";
               hostname = "canopus";
               activate_on_startup = true;
-              ips = [ "192.168.8.2" ];
+              ips = ["192.168.8.2"];
             }
           ];
         };

modules/hosts/sirius/secrets.yaml

@@ -2,12 +2,12 @@ tux-password: ENC[AES256_GCM,data:JWQVd2MYX2U4UP4II62ixG9hWI5MtgHAFhl8aCmyrYPl1H
 gemini-api-key: ENC[AES256_GCM,data:Y9YgXp/tB3Q1Rb5YMsZLgWCq+bdeIjsXAVeO3Yh7nZ8MwDH7d5De,iv:FIXxJCn6JDYsHIoNn8f8Un3z9ZPVbxdjR48Ux88poRg=,tag:bMJ4i69HTspnhzsrsxkbrw==,type:str]
 openrouter-api-key: ENC[AES256_GCM,data:HfZgZz4NyCLLM9woTZp2I6JGOlVcFblw2OMjx8k0TG5ZU2ycBCF6bKqp3wFibUxXcHy+nIfjI82fkLeSyIaGILRLYCJCc8BHKw==,iv:umUcn8MRaj7JXo6IFrGMXOu+jsFSCEikMxsQxfaFS/Q=,tag:l2s61C4EpJoKv8cc9nYGFA==,type:str]
 opencode-go-api-key: ENC[AES256_GCM,data:BGERcZg5Jpnznc4cXeYFMhPk9kKBkd9GvIuQBV9TW3JE1utgrLLYK6mKNCQqrEStRFiO2jUUnBm3opUNL4SuEHFLpw==,iv:fgFAwx6z9yruK27PvAJX/Q2CS9gU+LJ5zMUK/f/rzpo=,tag:BPu3M+jppPB8sLoLmfuY/Q==,type:str]
+zai-coding-plan-api-key: ENC[AES256_GCM,data:u5RHaBq5WHit+GjcKYnr6vN7jkputBtt3G0lCNBciMgBnBzIcZd/JjJcNaKXfbal5w==,iv:x+mG1aoct7yfm4Hvu1mMqBq8MiF8UZbQ8SFjA99qTIw=,tag:9cEIO2tuhqE6df2M2N/R+g==,type:str]
 netbird-key: ENC[AES256_GCM,data:qXAnRnLM2TlzpOvWG4exJv0+pUvpe0FpRN5xOWx3+KNt+yhq,iv:X+yl4o1RSYMCMWdVXo1hpzy+6IdKXUpsKPtYNSiHiCY=,tag:I8HbnD5iw6EJ1TdsNrhvfw==,type:str]
 vicinae-json: ENC[AES256_GCM,data:JjxolEgS6uakqR4eHOx3VyrOO5kaL4dj1jcEiLWsrktCU32UB7OmP1kJEVomA1rZjODpFHL89+FRpcNFspTFrc365WlANE81RLg/M2Ja1MiLYaDFNcBGtqMX9Yc1muor53Xl7t+rTSvDIj1oE1L7xPPcjCLfwC5QDzJjCBWj9FhCxnU5BwvoJNv9vgA6xnkzAOYSPZK/ihULMD0DxyqOUEa5ECGX62OPM9Gbr7jEviaItYzOOxaRs/yQVqizodGGl/BcK6fPqvOYSxip9ABYRVSI9ZvysY7ofAkeX91ardPwVG5VvEYfxZwBvGFjV7ZfTzVkK+BiUUNrvciAETHqwkjHftPpfJjxWsgLr8lbOA==,iv:HjDE/sqVDnxeww7r2upxH57rc1+LpuMKnhhyGXoc1Ms=,tag:d2kZeWkg17eVoNACIQ3Q9A==,type:str]
 sops:
     age:
-        - recipient: age14vktfes95f33vuefwnmuvryas7az04u76dsgyhfvsx73czkvmp2q7njkl4
+        - enc: |
-          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQNGdHcDc4bTFkR0EyZlUr
             eXovR1lyeTZJTDg5R281MFFuMHVwOXZXYzNvCkpIT1g3K05WUUswaEVjVVJWQkJq
@@ -15,8 +15,8 @@ sops:
             Z0JwWWR0STUybjVhSXdDR3NiKzV1eDQK22HmMuyqYaR/eGuALkAPB1Y5bN2KwIt3
             pamM8vbnjB//hXoyrv4vsoDk9WzLGFGjgiw2qsM2HQgzQqtrwF1/1A==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1maxsx5tq2h3d92rfyl8ekcdan5gu5cpch4qs3c56cu7qag02xgvs3h0gqc
+          recipient: age14vktfes95f33vuefwnmuvryas7az04u76dsgyhfvsx73czkvmp2q7njkl4
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1N3ZBd1pHODFtZkZxaHNP
             OXlXUzVFS0ZIam1IWVkxNldOdTEwY0s4aUNZCjVlcnF1aXJxUUlQSXhteXJ6OU1W
@@ -24,7 +24,8 @@ sops:
             M3JocWZJeXFxenhXOENBVWpvNkd3bm8KqhNLzCyEAI643jGWpZF/uTchHmBj8ozU
             HtpOzKsshif66D0XOHeJQfQamJI4TyKsj3Sk3j9rstsLmN2lxTRGHg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-10T00:35:50Z"
+          recipient: age1maxsx5tq2h3d92rfyl8ekcdan5gu5cpch4qs3c56cu7qag02xgvs3h0gqc
-    mac: ENC[AES256_GCM,data:u27zQ1PPnWy5Parbh/1DkVP3ICmHnLZJKaLbN3dZEVONgqOWi32LV3t0iNhtLWwVnzFPBusRWahQiqAkUdnQtrXF0OtjPCpLuIw86xB75QPGbet0GZlLNb8/xPshChZe4v520csdJMWiy3vYeKrk8LxMSViAGhmhYK2a5NbGhzI=,iv:/9vePmvCNqoP0kx24fP3HfCjS2FkjBmI5B+SycvKKW4=,tag:gE1/DnLolwhoyfMJYejGIQ==,type:str]
+    lastmodified: "2026-09-16T14:20:48Z"
+    mac: ENC[AES256_GCM,data:i2I6vo/tKTLq44Tu6vI2Cqp0EqQPbwuuRM2WUflD58UCr7huXIKnKrxmB1Hz/fdmpZPiCZ2dSlmOh733fKFclRmpHJLScYRX4+lFXEzToYExZlybVergxC6Cr4IaiB+A/HZIkW6iKK/ULr2mtXYNCqQgDQw8BgJuV2M/bAMM/V4=,iv:9akzmVH4CMMdDS5aukeLOxncMLKfvQCw2BYl36WAfOM=,tag:4F26bqEI8fEtNugqjHCUOg==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.12.2
+    version: 3.13.3

modules/hosts/vega/config.nix

@@ -1,56 +1,51 @@
-{ config, ... }:
+{config, ...}: {
-{
+  flake.modules.nixOnDroid.vega = {
-  flake.modules.nixOnDroid.vega =
+    pkgs,
-    {
+    userEmail,
-      pkgs,
+    ...
-      userEmail,
+  }: {
-      ...
+    imports = with config.flake.modules.nixOnDroid; [
-    }:
+      networking
-    {
+    ];
-      imports = with config.flake.modules.nixOnDroid; [
+
-        networking
+    # @TODO: Broken currently
+    # android-integration.am.enable = true;
+    # android-integration.termux-open-url.enable = true;
+    # android-integration.xdg-open.enable = true;
+    # android-integration.termux-setup-storage.enable = true;
+    # android-integration.termux-reload-settings.enable = true;
+
+    terminal.font = let
+      firacode = pkgs.nerd-fonts.fira-code;
+      fontPath = "share/fonts/truetype/NerdFonts/FiraCode/FiraCodeNerdFont-Regular.ttf";
+    in "${firacode}/${fontPath}";
+
+    time.timeZone = "Asia/Kolkata";
+
+    tnix.networking.openssh = {
+      enable = true;
+      ports = [8033];
+      authorizedKeys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+OzPUe2ECPC929DqpkM39tl/vdNAXfsRnmrGfR+X3D ${userEmail}"
       ];
-
-      # @TODO: Broken currently
-      # android-integration.am.enable = true;
-      # android-integration.termux-open-url.enable = true;
-      # android-integration.xdg-open.enable = true;
-      # android-integration.termux-setup-storage.enable = true;
-      # android-integration.termux-reload-settings.enable = true;
-
-      terminal.font =
-        let
-          firacode = pkgs.nerd-fonts.fira-code;
-          fontPath = "share/fonts/truetype/NerdFonts/FiraCode/FiraCodeNerdFont-Regular.ttf";
-        in
-        "${firacode}/${fontPath}";
-
-      time.timeZone = "Asia/Kolkata";
-
-      tnix.networking.openssh = {
-        enable = true;
-        ports = [ 8033 ];
-        authorizedKeys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+OzPUe2ECPC929DqpkM39tl/vdNAXfsRnmrGfR+X3D ${userEmail}"
-        ];
-      };
-
-      user = {
-        uid = 10481;
-        gid = 10481;
-        shell = "${pkgs.zsh}/bin/zsh";
-      };
-
-      environment.etcBackupExtension = ".backup";
-      environment.motd = "";
-      environment.packages = with pkgs; [
-        ncurses
-        procps
-        util-linux
-        rsync
-        gnutar
-      ];
-
-      system.stateVersion = "24.05";
     };
+
+    user = {
+      uid = 10481;
+      gid = 10481;
+      shell = "${pkgs.zsh}/bin/zsh";
+    };
+
+    environment.etcBackupExtension = ".backup";
+    environment.motd = "";
+    environment.packages = with pkgs; [
+      ncurses
+      procps
+      util-linux
+      rsync
+      gnutar
+    ];
+
+    system.stateVersion = "24.05";
+  };
 }

modules/hosts/vega/home.nix

@@ -1,5 +1,4 @@
-{ lib, ... }:
+{lib, ...}: {
-{
   flake.modules.homeManager.vega = {
     # @TODO: Broken currently - By default it's enabled by neovim module
     programs.vim.enable = lib.mkForce false;

modules/hosts/vps/config.nix

@@ -1,50 +1,44 @@
-{ config, ... }:
+{config, ...}: {
-{
+  flake.modules.nixos.vps = {hostName, ...}: {
-  flake.modules.nixos.vps =
+    imports = with config.flake.modules.nixos; [
-    {
+      boot
-      hostName,
+      networking
-      ...
+      virtualisation
-    }:
+      services
-    {
+    ];
-      imports = with config.flake.modules.nixos; [
-        boot
-        networking
-        virtualisation
-        services
-      ];
 
-      tnix = {
+    tnix = {
-        boot = {
+      boot = {
-          legacy.enable = true;
+        legacy.enable = true;
 
-          impermanence = {
+        impermanence = {
-            enable = true;
+          enable = true;
 
-            home = {
+          home = {
-              directories = [
+            directories = [
-                ".local/share/nvim"
+              ".local/share/nvim"
-                ".local/share/zsh"
+              ".local/share/zsh"
-                ".local/share/zoxide"
+              ".local/share/zoxide"
-                ".local/state/lazygit"
+              ".local/state/lazygit"
-              ];
+            ];
-            };
           };
         };
-
-        networking.openssh.enable = true;
-
-        virtualisation = {
-          docker.enable = true;
-        };
       };
 
-      # --- Networking ---
+      networking.openssh.enable = true;
-      networking = {
-        hostName = hostName;
-        networkmanager.enable = true;
-        firewall.enable = false;
-      };
 
-      system.stateVersion = "26.05";
+      virtualisation = {
+        docker.enable = true;
+      };
     };
+
+    # --- Networking ---
+    networking = {
+      hostName = hostName;
+      networkmanager.enable = true;
+      firewall.enable = false;
+    };
+
+    system.stateVersion = "26.05";
+  };
 }

modules/hosts/vps/disko.nix

@@ -1,22 +1,23 @@
-{ inputs, ... }:
+{inputs, ...}: {
-{
+  flake.modules.nixos.vps = {
-  flake.modules.nixos.vps =
+    config,
-    { config, lib, ... }:
+    lib,
-    let
+    ...
-      hasOptinPersistence = config.tnix.boot.impermanence.enable;
+  }: let
-      isLegacy = config.tnix.boot.legacy.enable;
+    hasOptinPersistence = config.tnix.boot.impermanence.enable;
-    in
+    isLegacy = config.tnix.boot.legacy.enable;
-    {
+  in {
-      imports = [
+    imports = [
-        inputs.disko.nixosModules.disko
+      inputs.disko.nixosModules.disko
-      ];
+    ];
 
-      disko.devices.disk.primary = {
+    disko.devices.disk.primary = {
-        device = "/dev/sda";
+      device = "/dev/sda";
-        type = "disk";
+      type = "disk";
-        content = {
+      content = {
-          type = "gpt";
+        type = "gpt";
-          partitions = {
+        partitions =
+          {
             ESP = {
               size = "1G";
               type = "EF00";
@@ -36,36 +37,37 @@
               content = {
                 type = "btrfs";
                 # Base subvolumes that always exist
-                subvolumes = {
+                subvolumes =
-                  "/root" = {
+                  {
-                    mountOptions = [
+                    "/root" = {
-                      "compress=zstd"
+                      mountOptions = [
-                      "noatime"
+                        "compress=zstd"
-                      "space_cache=v2"
+                        "noatime"
-                    ];
+                        "space_cache=v2"
-                    mountpoint = "/";
+                      ];
+                      mountpoint = "/";
+                    };
+                    "/nix" = {
+                      mountOptions = [
+                        "compress=zstd"
+                        "noatime"
+                        "noacl"
+                        "space_cache=v2"
+                      ];
+                      mountpoint = "/nix";
+                    };
+                  }
+                  # Conditionally merge /persist only when impermanence is enabled
+                  // lib.optionalAttrs hasOptinPersistence {
+                    "/persist" = {
+                      mountOptions = [
+                        "compress=zstd"
+                        "noatime"
+                        "space_cache=v2"
+                      ];
+                      mountpoint = "/persist";
+                    };
                   };
-                  "/nix" = {
-                    mountOptions = [
-                      "compress=zstd"
-                      "noatime"
-                      "noacl"
-                      "space_cache=v2"
-                    ];
-                    mountpoint = "/nix";
-                  };
-                }
-                # Conditionally merge /persist only when impermanence is enabled
-                // lib.optionalAttrs hasOptinPersistence {
-                  "/persist" = {
-                    mountOptions = [
-                      "compress=zstd"
-                      "noatime"
-                      "space_cache=v2"
-                    ];
-                    mountpoint = "/persist";
-                  };
-                };
               };
             };
           }
@@ -76,7 +78,7 @@
               type = "EF02";
             };
           };
-        };
       };
     };
+  };
 }

modules/hosts/vps/hardware.nix

@@ -1,17 +1,15 @@
 {
-  flake.modules.nixos.vps =
+  flake.modules.nixos.vps = {
-    {
+    lib,
-      lib,
+    modulesPath,
-      modulesPath,
+    system,
-      system,
+    ...
-      ...
+  }: {
-    }:
+    imports = [
-    {
+      (modulesPath + "/profiles/qemu-guest.nix")
-      imports = [
+    ];
-        (modulesPath + "/profiles/qemu-guest.nix")
-      ];
 
-      networking.useDHCP = lib.mkDefault true;
+    networking.useDHCP = lib.mkDefault true;
-      nixpkgs.hostPlatform = lib.mkDefault system;
+    nixpkgs.hostPlatform = lib.mkDefault system;
-    };
+  };
 }

modules/nixos/boot/impermanence.nix

@@ -1,71 +1,71 @@
-{ inputs, ... }:
+{inputs, ...}: {
-{
+  flake.modules.nixos.boot = {
-  flake.modules.nixos.boot =
+    config,
-    {
+    lib,
-      config,
+    userName,
-      lib,
+    ...
-      userName,
+  }: let
-      ...
+    cfg = config.tnix.boot;
-    }:
+  in {
-    let
+    imports = [
-      cfg = config.tnix.boot;
+      inputs.impermanence.nixosModules.impermanence
-    in
+    ];
-    {
-      imports = [
-        inputs.impermanence.nixosModules.impermanence
-      ];
 
-      options.tnix.boot.impermanence = {
+    options.tnix.boot.impermanence = {
-        enable = lib.mkEnableOption "Enable impermanence";
+      enable = lib.mkEnableOption "Enable impermanence";
 
-        directories = lib.mkOption {
+      directories = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
+        type = lib.types.listOf lib.types.str;
-          default = [ ];
+        default = [];
-        };
-
-        files = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-        };
       };
 
-      options.tnix.boot.impermanence.home = {
+      files = lib.mkOption {
-        directories = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
-          type = lib.types.listOf lib.types.str;
+        default = [];
-          default = [ ];
+      };
-        };
+    };
 
-        files = lib.mkOption {
+    options.tnix.boot.impermanence.home = {
-          type = lib.types.listOf lib.types.str;
+      directories = lib.mkOption {
-          default = [ ];
+        type = lib.types.listOf lib.types.str;
-        };
+        default = [];
       };
 
-      config = lib.mkIf cfg.impermanence.enable {
+      files = lib.mkOption {
-        programs.fuse.userAllowOther = true;
+        type = lib.types.listOf lib.types.str;
-        fileSystems."/persist".neededForBoot = true;
+        default = [];
-        environment.persistence."/persist" = {
+      };
-          hideMounts = true;
+    };
-          directories = [
+
+    config = lib.mkIf cfg.impermanence.enable {
+      programs.fuse.userAllowOther = true;
+      fileSystems."/persist".neededForBoot = true;
+      environment.persistence."/persist" = {
+        hideMounts = true;
+        directories =
+          [
             "/var/log"
             "/var/lib"
             "/etc/NetworkManager/system-connections"
           ]
           ++ cfg.impermanence.directories;
 
-          files = [
+        files =
+          [
             "/etc/machine-id"
             "/etc/ssh/ssh_host_ed25519_key"
             "/etc/ssh/ssh_host_ed25519_key.pub"
             "/etc/ssh/ssh_host_rsa_key"
             "/etc/ssh/ssh_host_rsa_key.pub"
+            "/etc/ly/save.txt"
           ]
           ++ cfg.impermanence.files;
-        };
+      };
 
-        home-manager.users.${userName} = {
+      home-manager.users.${userName} = {
-          home.persistence."/persist" = {
+        home.persistence."/persist" = {
-            directories = [
+          directories =
+            [
               "Downloads"
               "Music"
               "Wallpapers"
@@ -77,46 +77,46 @@
             ]
             ++ cfg.impermanence.home.directories;
 
-            files = cfg.impermanence.home.files;
+          files = cfg.impermanence.home.files;
-          };
         };
+      };
 
-        boot.initrd.systemd = {
+      boot.initrd.systemd = {
-          enable = true;
+        enable = true;
 
-          services.wipe-my-fs = {
+        services.wipe-my-fs = {
-            wantedBy = [ "initrd.target" ];
+          wantedBy = ["initrd.target"];
-            after = [ "initrd-root-device.target" ];
+          after = ["initrd-root-device.target"];
-            before = [ "sysroot.mount" ];
+          before = ["sysroot.mount"];
-            unitConfig.DefaultDependencies = "no";
+          unitConfig.DefaultDependencies = "no";
-            serviceConfig.Type = "oneshot";
+          serviceConfig.Type = "oneshot";
-            script = ''
+          script = ''
-              mkdir /btrfs_tmp
+            mkdir /btrfs_tmp
-              mount /dev/disk/by-partlabel/disk-primary-root /btrfs_tmp
+            mount /dev/disk/by-partlabel/disk-primary-root /btrfs_tmp
 
-              if [[ -e /btrfs_tmp/root ]]; then
+            if [[ -e /btrfs_tmp/root ]]; then
-                  mkdir -p /btrfs_tmp/old_roots
+                mkdir -p /btrfs_tmp/old_roots
-                  timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")
+                timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")
-                  mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
+                mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
-              fi
+            fi
 
-              delete_subvolume_recursively() {
+            delete_subvolume_recursively() {
-                  IFS=$'\n'
+                IFS=$'\n'
-                  for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
+                for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
-                      delete_subvolume_recursively "/btrfs_tmp/$i"
+                    delete_subvolume_recursively "/btrfs_tmp/$i"
-                  done
+                done
-                  btrfs subvolume delete "$1"
+                btrfs subvolume delete "$1"
-              }
+            }
 
-              for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
+            for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
-                  delete_subvolume_recursively "$i"
+                delete_subvolume_recursively "$i"
-              done
+            done
 
-              btrfs subvolume create /btrfs_tmp/root
+            btrfs subvolume create /btrfs_tmp/root
-              umount /btrfs_tmp
+            umount /btrfs_tmp
-            '';
+          '';
-          };
         };
       };
     };
+  };
 }

modules/nixos/boot/loader.nix

@@ -1,31 +1,32 @@
 {
-  flake.modules.nixos.boot =
+  flake.modules.nixos.boot = {
-    { config, lib, ... }:
+    config,
-    let
+    lib,
-      cfg = config.tnix.boot;
+    ...
-    in
+  }: let
-    {
+    cfg = config.tnix.boot;
-      options.tnix.boot.legacy = {
+  in {
-        enable = lib.mkEnableOption "legacy boot (GRUB) instead of systemd-boot";
+    options.tnix.boot.legacy = {
-      };
+      enable = lib.mkEnableOption "legacy boot (GRUB) instead of systemd-boot";
-
-      config = lib.mkMerge [
-        {
-          boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-
-          boot.loader = {
-            timeout = 1;
-            efi.canTouchEfiVariables = true;
-          };
-        }
-
-        (lib.mkIf (!cfg.legacy.enable && !cfg.secure-boot.enable) {
-          boot.loader.systemd-boot.enable = true;
-        })
-
-        (lib.mkIf cfg.legacy.enable {
-          boot.loader.grub.enable = true;
-        })
-      ];
     };
+
+    config = lib.mkMerge [
+      {
+        boot.binfmt.emulatedSystems = ["aarch64-linux"];
+
+        boot.loader = {
+          timeout = 1;
+          efi.canTouchEfiVariables = true;
+        };
+      }
+
+      (lib.mkIf (!cfg.legacy.enable && !cfg.secure-boot.enable) {
+        boot.loader.systemd-boot.enable = true;
+      })
+
+      (lib.mkIf cfg.legacy.enable {
+        boot.loader.grub.enable = true;
+      })
+    ];
+  };
 }

modules/nixos/boot/misc.nix

@@ -1,12 +1,10 @@
 {
-  flake.modules.nixos.boot =
+  flake.modules.nixos.boot = {pkgs, ...}: {
-    { pkgs, ... }:
+    boot = {
-    {
+      consoleLogLevel = 0;
-      boot = {
+      initrd.verbose = false;
-        consoleLogLevel = 0;
+      kernelPackages = pkgs.linuxPackages_zen;
-        initrd.verbose = false;
+      supportedFilesystems = ["ntfs"];
-        kernelPackages = pkgs.linuxPackages_zen;
-        supportedFilesystems = [ "ntfs" ];
-      };
     };
+  };
 }

modules/nixos/boot/secure-boot.nix

@@ -1,43 +1,39 @@
-{ inputs, ... }:
+{inputs, ...}: {
-{
+  flake.modules.nixos.boot = {
-  flake.modules.nixos.boot =
+    config,
-    {
+    lib,
-      config,
+    pkgs,
-      lib,
+    ...
-      pkgs,
+  }: let
-      ...
+    cfg = config.tnix.boot;
-    }:
+  in {
-    let
+    imports = [inputs.lanzaboote.nixosModules.lanzaboote];
-      cfg = config.tnix.boot;
-    in
-    {
-      imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
 
-      options.tnix.boot.secure-boot = {
+    options.tnix.boot.secure-boot = {
-        enable = lib.mkEnableOption "Enable secure-boot";
+      enable = lib.mkEnableOption "Enable secure-boot";
-      };
+    };
 
-      config = lib.mkIf cfg.secure-boot.enable {
+    config = lib.mkIf cfg.secure-boot.enable {
-        assertions = [
+      assertions = [
-          {
+        {
-            assertion = !cfg.legacy.enable;
+          assertion = !cfg.legacy.enable;
-            message = "secure-boot and legacy boot (GRUB) cannot be enabled at the same time";
+          message = "secure-boot and legacy boot (GRUB) cannot be enabled at the same time";
-          }
+        }
-        ];
+      ];
 
-        environment.systemPackages = [ pkgs.sbctl ];
+      environment.systemPackages = [pkgs.sbctl];
 
-        # Lanzaboote replaces systemd-boot, so force it off
+      # Lanzaboote replaces systemd-boot, so force it off
-        boot.loader.systemd-boot.enable = lib.mkForce false;
+      boot.loader.systemd-boot.enable = lib.mkForce false;
 
-        boot.lanzaboote = {
+      boot.lanzaboote = {
-          enable = true;
+        enable = true;
-          autoGenerateKeys.enable = true;
+        autoGenerateKeys.enable = true;
-          autoEnrollKeys.enable = true;
+        autoEnrollKeys.enable = true;
 
-          configurationLimit = 10;
+        configurationLimit = 10;
-          pkiBundle = "/var/lib/sbctl";
+        pkiBundle = "/var/lib/sbctl";
-        };
       };
     };
+  };
 }

modules/nixos/core/env.nix

@@ -0,0 +1,5 @@
+{
+  flake.modules.nixos.core = {...}: {
+    environment.enableAllTerminfo = true;
+  };
+}

modules/nixos/core/hm.nix

@@ -1,37 +1,38 @@
-{ inputs, config, ... }:
 {
-  flake.modules.nixos.core =
+  inputs,
-    {
+  config,
-      hostName,
+  ...
-      userName,
+}: {
-      userEmail,
+  flake.modules.nixos.core = {
-      ...
+    hostName,
-    }:
+    userName,
-    {
+    userEmail,
-      imports = [
+    ...
-        inputs.home-manager.nixosModules.home-manager
+  }: {
-      ];
+    imports = [
+      inputs.home-manager.nixosModules.home-manager
+    ];
 
-      home-manager = {
+    home-manager = {
-        backupFileExtension = "bak";
+      backupFileExtension = "bak";
-        useGlobalPkgs = true;
+      useGlobalPkgs = true;
-        useUserPackages = true;
+      useUserPackages = true;
-        extraSpecialArgs = {
+      extraSpecialArgs = {
-          inherit
+        inherit
-            inputs
+          inputs
-            hostName
+          hostName
-            userName
+          userName
-            userEmail
+          userEmail
-            ;
+          ;
-        };
+      };
 
-        users.${userName} = {
+      users.${userName} = {
-          imports = [
+        imports = [
-            config.flake.modules.homeManager.core
+          config.flake.modules.homeManager.core
-            config.flake.modules.homeManager.shell
+          config.flake.modules.homeManager.shell
-            config.flake.modules.homeManager.${hostName}
+          config.flake.modules.homeManager.${hostName}
-          ];
+        ];
-        };
       };
     };
+  };
 }

modules/nixos/core/nh.nix

@@ -1,20 +1,18 @@
 {
-  flake.modules.nixos.core =
+  flake.modules.nixos.core = {
-    {
+    config,
-      config,
+    userName,
-      userName,
+    ...
-      ...
+  }: {
-    }:
+    programs.nh = {
-    {
+      enable = true;
-      programs.nh = {
-        enable = true;
 
-        clean = {
+      clean = {
-          enable = !config.nix.gc.automatic;
+        enable = !config.nix.gc.automatic;
-          dates = "weekly";
+        dates = "weekly";
-        };
-
-        flake = "/home/${userName}/Projects/nixos-config";
       };
+
+      flake = "/home/${userName}/Projects/nixos-config";
     };
+  };
 }

modules/nixos/core/nix-index.nix

@@ -1,6 +1,5 @@
-{ inputs, ... }:
+{inputs, ...}: {
-{
+  flake.modules.nixos.core = {pkgs, ...}: {
-  flake.modules.nixos.core = { pkgs, ... }: {
     imports = [
       inputs.nix-index-database.nixosModules.default
     ];

modules/nixos/core/nix-ld.nix

@@ -0,0 +1,18 @@
+{...}: {
+  flake.modules.nixos.core = {
+    config,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.tnix.programs.nix-ld;
+    in {
+      options.tnix.programs.nix-ld = {
+        enable = mkEnableOption "nix-ld";
+      };
+
+      config = mkIf cfg.enable {
+        programs.nix-ld.enable = true;
+      };
+    };
+}

modules/nixos/core/nix.nix

@@ -1,88 +1,86 @@
 {
-  flake.modules.nixos.core =
+  flake.modules.nixos.core = {userName, ...}: {
-    { userName, ... }:
+    nix = {
-    {
+      channel.enable = false;
-      nix = {
-        channel.enable = false;
 
-        gc = {
+      gc = {
-          automatic = true;
+        automatic = true;
-          options = "--delete-older-than 7d";
+        options = "--delete-older-than 7d";
-          dates = "weekly";
+        dates = "weekly";
-          persistent = true;
+        persistent = true;
-        };
+      };
 
-        optimise.automatic = true;
+      optimise.automatic = true;
 
-        settings = {
+      settings = {
-          extra-platforms = [
+        extra-platforms = [
-            "aarch64-linux"
+          "aarch64-linux"
-            "arm-linux"
+          "arm-linux"
-          ];
+        ];
 
-          experimental-features = [
+        experimental-features = [
-            "nix-command"
+          "nix-command"
-            "flakes"
+          "flakes"
-          ];
+        ];
 
-          max-jobs = "auto";
+        max-jobs = "auto";
 
-          # Make legacy nix commands use the XDG base directories instead of creating directories in $HOME.
+        # Make legacy nix commands use the XDG base directories instead of creating directories in $HOME.
-          use-xdg-base-directories = true;
+        use-xdg-base-directories = true;
 
-          # The maximum number of parallel TCP connections used to fetch files from binary caches and by other downloads.
+        # The maximum number of parallel TCP connections used to fetch files from binary caches and by other downloads.
-          # It defaults to 25. 0 means no limit.
+        # It defaults to 25. 0 means no limit.
-          http-connections = 128;
+        http-connections = 128;
 
-          # This option defines the maximum number of substitution jobs that Nix will try to run in
+        # This option defines the maximum number of substitution jobs that Nix will try to run in
-          # parallel. The default is 16. The minimum value one can choose is 1 and lower values will be
+        # parallel. The default is 16. The minimum value one can choose is 1 and lower values will be
-          # interpreted as 1.
+        # interpreted as 1.
-          max-substitution-jobs = 128;
+        max-substitution-jobs = 128;
 
-          # The number of lines of the tail of the log to show if a build fails.
+        # The number of lines of the tail of the log to show if a build fails.
-          log-lines = 25;
+        log-lines = 25;
 
-          # When free disk space in /nix/store drops below min-free during a build, Nix performs a
+        # When free disk space in /nix/store drops below min-free during a build, Nix performs a
-          # garbage-collection until max-free bytes are available or there is no more garbage.
+        # garbage-collection until max-free bytes are available or there is no more garbage.
-          # A value of 0 (the default) disables this feature.
+        # A value of 0 (the default) disables this feature.
-          min-free = 128000000; # 128 MB
+        min-free = 128000000; # 128 MB
-          max-free = 1000000000; # 1 GB
+        max-free = 1000000000; # 1 GB
 
-          # Prevent garbage collection from altering nix-shells managed by nix-direnv
+        # Prevent garbage collection from altering nix-shells managed by nix-direnv
-          # https://github.com/nix-community/nix-direnv#installation
+        # https://github.com/nix-community/nix-direnv#installation
-          keep-outputs = true;
+        keep-outputs = true;
-          keep-derivations = true;
+        keep-derivations = true;
 
-          # If set to true, Nix will keep building derivations even if some fail. The default is false.
+        # If set to true, Nix will keep building derivations even if some fail. The default is false.
-          keep-going = true;
+        keep-going = true;
 
-          # Automatically detect files in the store that have identical contents, and replaces
+        # Automatically detect files in the store that have identical contents, and replaces
-          # them with hard links to a single copy. This saves disk space.
+        # them with hard links to a single copy. This saves disk space.
-          auto-optimise-store = true;
+        auto-optimise-store = true;
 
-          # Whether to warn about dirty Git/Mercurial trees.
+        # Whether to warn about dirty Git/Mercurial trees.
-          warn-dirty = false;
+        warn-dirty = false;
 
-          # The timeout (in seconds) for establishing connections in the binary cache substituter.
+        # The timeout (in seconds) for establishing connections in the binary cache substituter.
-          # It corresponds to curl’s –connect-timeout option. A value of 0 means no limit.
+        # It corresponds to curl’s –connect-timeout option. A value of 0 means no limit.
-          connect-timeout = 5;
+        connect-timeout = 5;
 
-          # Allow the use of cachix
+        # Allow the use of cachix
-          trusted-users = [
+        trusted-users = [
-            "root"
+          "root"
-            "${userName}"
+          "${userName}"
-          ];
+        ];
-          allowed-users = [
+        allowed-users = [
-            "root"
+          "root"
-            "${userName}"
+          "${userName}"
-          ];
+        ];
 
-          builders-use-substitutes = true;
+        builders-use-substitutes = true;
 
-          # If set to true, Nix will fall back to building from source if a binary substitute
+        # If set to true, Nix will fall back to building from source if a binary substitute
-          # fails. This is equivalent to the –fallback flag. The default is false.
+        # fails. This is equivalent to the –fallback flag. The default is false.
-          fallback = true;
+        fallback = true;
-        };
       };
     };
+  };
 }

modules/nixos/core/nixpkgs.nix

@@ -1,5 +1,4 @@
-{ inputs, ... }:
+{inputs, ...}: {
-{
   flake.modules.nixos.core = {
     nixpkgs = {
       config = {

modules/nixos/core/sops.nix

@@ -1,25 +1,21 @@
-{ inputs, ... }:
+{inputs, ...}: {
-{
+  flake.modules.nixos.core = {
-  flake.modules.nixos.core =
+    config,
-    {
+    pkgs,
-      config,
+    ...
-      pkgs,
+  }: let
-      ...
+    isEd25519 = k: k.type == "ed25519";
-    }:
+    getKeyPath = k: k.path;
-    let
+    keys = builtins.filter isEd25519 config.services.openssh.hostKeys;
-      isEd25519 = k: k.type == "ed25519";
+  in {
-      getKeyPath = k: k.path;
+    imports = [inputs.sops-nix.nixosModules.sops];
-      keys = builtins.filter isEd25519 config.services.openssh.hostKeys;
-    in
-    {
-      imports = [ inputs.sops-nix.nixosModules.sops ];
 
-      sops.age = {
+    sops.age = {
-        sshKeyPaths = map getKeyPath keys;
+      sshKeyPaths = map getKeyPath keys;
-        keyFile = "/var/lib/sops-nix/key.txt";
+      keyFile = "/var/lib/sops-nix/key.txt";
-        generateKey = true;
+      generateKey = true;
-      };
-
-      environment.systemPackages = with pkgs; [ sops ];
     };
+
+    environment.systemPackages = with pkgs; [sops];
+  };
 }

modules/nixos/core/substituters.nix

@@ -33,6 +33,10 @@
         "wezterm.cachix.org-1:kAbhjYUC9qvblTE+s7S+kl5XM1zVa4skO+E/1IDWdH0="
         "cache.nixos-cuda.org:74DUi4Ye579gUqzH4ziL9IyiJBlDpMRn9MBN8oNan9M="
       ];
+      extra-substituters = ["https://cache.numtide.com"];
+      extra-trusted-public-keys = [
+        "niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
+      ];
     };
   };
 }

modules/nixos/core/users.nix

@@ -1,51 +1,48 @@
 {
-  flake.modules.nixos.core =
+  flake.modules.nixos.core = {
-    {
+    pkgs,
-      pkgs,
+    lib,
-      lib,
+    config,
-      config,
+    userName,
-      userName,
+    userEmail,
-      userEmail,
+    ...
-      ...
+  }: let
-    }:
+    hasPasswordSecret = lib.hasAttrByPath ["sops" "secrets" "tux-password"] config;
-    let
+  in {
-      hasPasswordSecret = lib.hasAttrByPath [ "sops" "secrets" "tux-password" ] config;
+    programs.zsh.enable = true;
-    in
-    {
-      programs.zsh.enable = true;
 
-      time.timeZone = "Asia/Kolkata";
+    time.timeZone = "Asia/Kolkata";
-      i18n = {
+    i18n = {
-        defaultLocale = "en_US.UTF-8";
+      defaultLocale = "en_US.UTF-8";
-        extraLocaleSettings = lib.genAttrs [
+      extraLocaleSettings = lib.genAttrs [
-          "LC_ADDRESS"
+        "LC_ADDRESS"
-          "LC_IDENTIFICATION"
+        "LC_IDENTIFICATION"
-          "LC_MEASUREMENT"
+        "LC_MEASUREMENT"
-          "LC_MONETARY"
+        "LC_MONETARY"
-          "LC_NAME"
+        "LC_NAME"
-          "LC_NUMERIC"
+        "LC_NUMERIC"
-          "LC_PAPER"
+        "LC_PAPER"
-          "LC_TELEPHONE"
+        "LC_TELEPHONE"
-          "LC_TIME"
+        "LC_TIME"
-        ] (_: "en_IN");
+      ] (_: "en_IN");
-      };
+    };
 
-      users = {
+    users = {
-        mutableUsers = false;
+      mutableUsers = false;
-        defaultUserShell = pkgs.zsh;
+      defaultUserShell = pkgs.zsh;
-        users.${userName} = {
+      users.${userName} = {
-          hashedPasswordFile = lib.mkIf hasPasswordSecret config.sops.secrets.tux-password.path;
+        hashedPasswordFile = lib.mkIf hasPasswordSecret config.sops.secrets.tux-password.path;
-          initialPassword = lib.mkIf (!hasPasswordSecret) userName;
+        initialPassword = lib.mkIf (!hasPasswordSecret) userName;
-          isNormalUser = true;
+        isNormalUser = true;
-          extraGroups = [
+        extraGroups = [
-            "networkmanager"
+          "networkmanager"
-            "wheel"
+          "wheel"
-            "storage"
+          "storage"
-          ];
+        ];
-          openssh.authorizedKeys.keys = [
+        openssh.authorizedKeys.keys = [
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+OzPUe2ECPC929DqpkM39tl/vdNAXfsRnmrGfR+X3D ${userEmail}"
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+OzPUe2ECPC929DqpkM39tl/vdNAXfsRnmrGfR+X3D ${userEmail}"
-          ];
+        ];
-        };
       };
     };
+  };
 }

modules/nixos/desktop/font.nix

@@ -1,11 +1,9 @@
 {
-  flake.modules.nixos.desktop =
+  flake.modules.nixos.desktop = {pkgs, ...}: {
-    { pkgs, ... }:
+    fonts.packages = with pkgs.nerd-fonts; [
-    {
+      fira-code
-      fonts.packages = with pkgs.nerd-fonts; [
+      jetbrains-mono
-        fira-code
+      bigblue-terminal
-        jetbrains-mono
+    ];
-        bigblue-terminal
+  };
-      ];
-    };
 }

modules/nixos/desktop/gpu-screen-recorder.nix

@@ -1,13 +1,11 @@
 {
-  flake.modules.nixos.desktop =
+  flake.modules.nixos.desktop = {pkgs, ...}: {
-    { pkgs, ... }:
+    programs.gpu-screen-recorder = {
-    {
+      enable = true;
-      programs.gpu-screen-recorder = {
-        enable = true;
-      };
-
-      environment.systemPackages = with pkgs; [
-        gpu-screen-recorder-gtk
-      ];
     };
+
+    environment.systemPackages = with pkgs; [
+      gpu-screen-recorder-gtk
+    ];
+  };
 }

modules/nixos/desktop/hyprland.nix

@@ -1,11 +1,9 @@
 {
-  flake.modules.nixos.desktop =
+  flake.modules.nixos.desktop = {pkgs, ...}: {
-    { pkgs, ... }:
+    programs.hyprland = {
-    {
+      enable = true;
-      programs.hyprland = {
+      package = pkgs.hyprland-git.hyprland;
-        enable = true;
+      portalPackage = pkgs.hyprland-git.xdg-desktop-portal-hyprland;
-        package = pkgs.hyprland-git.hyprland;
-        portalPackage = pkgs.hyprland-git.xdg-desktop-portal-hyprland;
-      };
     };
+  };
 }

modules/nixos/desktop/mango.nix

@@ -1,36 +1,30 @@
-{
+{inputs, ...}: {
-  inputs,
+  flake.modules.nixos.desktop = {
-  ...
+    pkgs,
-}:
+    lib,
-{
+    ...
-  flake.modules.nixos.desktop =
+  }: {
-    {
+    imports = [
-      pkgs,
+      inputs.mango.nixosModules.mango
-      lib,
+    ];
-      ...
+
-    }:
+    programs.mango.enable = true;
-    {
+
-      imports = [
+    xdg.portal = {
-        inputs.mango.nixosModules.mango
+      enable = lib.mkDefault true;
+      extraPortals = with pkgs; [
+        hyprland-git.xdg-desktop-portal-hyprland
+        xdg-desktop-portal-wlr
+        xdg-desktop-portal-gtk
       ];
-
+      config.mango = {
-      programs.mango.enable = true;
+        default = lib.mkForce [
-
+          "hyprland"
-      xdg.portal = {
+          "gtk"
-        enable = lib.mkDefault true;
-        extraPortals = with pkgs; [
-          hyprland-git.xdg-desktop-portal-hyprland
-          xdg-desktop-portal-wlr
-          xdg-desktop-portal-gtk
         ];
-        config.mango = {
+        "org.freedesktop.impl.portal.ScreenCast" = lib.mkForce ["hyprland"];
-          default = lib.mkForce [
+        "org.freedesktop.impl.portal.ScreenShot" = lib.mkForce ["hyprland"];
-            "hyprland"
-            "gtk"
-          ];
-          "org.freedesktop.impl.portal.ScreenCast" = lib.mkForce [ "hyprland" ];
-          "org.freedesktop.impl.portal.ScreenShot" = lib.mkForce [ "hyprland" ];
-        };
       };
     };
+  };
 }

modules/nixos/desktop/misc.nix

@@ -1,7 +1,5 @@
 {
-  flake.modules.nixos.desktop =
+  flake.modules.nixos.desktop = {pkgs, ...}: {
-    { pkgs, ... }:
+    environment.systemPackages = with pkgs; [brightnessctl];
-    {
+  };
-      environment.systemPackages = with pkgs; [ brightnessctl ];
-    };
 }

modules/nixos/desktop/obs-studio.nix

@@ -1,15 +1,14 @@
 {
-  flake.modules.nixos.desktop =
+  flake.modules.nixos.desktop = {pkgs, ...}: {
-    { pkgs, ... }:
+    programs.obs-studio = {
-    {
+      enable = true;
-      programs.obs-studio = {
+      enableVirtualCamera = true;
-        enable = true;
+      plugins = with pkgs.obs-studio-plugins; [
-        enableVirtualCamera = true;
+        obs-vaapi
-        plugins = with pkgs.obs-studio-plugins; [
+        wlrobs
-          obs-vaapi
+        obs-source-record
-          wlrobs
+        obs-advanced-masks
-          obs-source-record
+      ];
-        ];
-      };
     };
+  };
 }

modules/nixos/desktop/thunar.nix

@@ -1,18 +1,16 @@
 {
-  flake.modules.nixos.desktop =
+  flake.modules.nixos.desktop = {pkgs, ...}: {
-    { pkgs, ... }:
+    services = {
-    {
+      gvfs.enable = true;
-      services = {
+      tumbler.enable = true;
-        gvfs.enable = true;
-        tumbler.enable = true;
-      };
-
-      programs.thunar = {
-        enable = true;
-        plugins = with pkgs; [
-          thunar-archive-plugin
-          thunar-volman
-        ];
-      };
     };
+
+    programs.thunar = {
+      enable = true;
+      plugins = with pkgs; [
+        thunar-archive-plugin
+        thunar-volman
+      ];
+    };
+  };
 }

modules/nixos/desktop/tshell.nix

@@ -1,7 +1,5 @@
 {
-  flake.modules.nixos.desktop =
+  flake.modules.nixos.desktop = {pkgs, ...}: {
-    { pkgs, ... }:
+    environment.systemPackages = with pkgs; [tshell];
-    {
+  };
-      environment.systemPackages = with pkgs; [ tshell ];
-    };
 }

modules/nixos/gaming/steam.nix

@@ -1,11 +1,9 @@
 {
-  flake.modules.nixos.gaming =
+  flake.modules.nixos.gaming = {pkgs, ...}: {
-    { pkgs, ... }:
+    programs.steam = {
-    {
+      enable = true;
-      programs.steam = {
+      protontricks.enable = true;
-        enable = true;
+      extraCompatPackages = with pkgs; [proton-ge-bin];
-        protontricks.enable = true;
-        extraCompatPackages = with pkgs; [ proton-ge-bin ];
-      };
     };
+  };
 }

modules/nixos/hardware/audio.nix

@@ -1,5 +1,5 @@
 {
-  flake.modules.nixos.hardware = { pkgs, ... }: {
+  flake.modules.nixos.hardware = {pkgs, ...}: {
     security.rtkit.enable = true;
 
     services.pipewire = {

modules/nixos/hardware/bluetooth.nix

@@ -1,5 +1,5 @@
 {
-  flake.modules.nixos.hardware = { pkgs, ... }: {
+  flake.modules.nixos.hardware = {pkgs, ...}: {
     hardware.bluetooth = {
       enable = true;
     };

modules/nixos/networking/netbird-client.nix

@@ -1,16 +1,13 @@
 {
-  flake.modules.nixos.networking =
+  flake.modules.nixos.networking = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    hostName,
-      hostName,
+    ...
-      ...
+  }:
-    }:
+    with lib; let
-    with lib;
-    let
       cfg = config.tnix.networking.netbird-client;
-    in
+    in {
-    {
       options.tnix.networking.netbird-client = {
         enable = mkEnableOption "Enable netbird client";
       };

modules/nixos/networking/newt.nix

@@ -1,15 +1,12 @@
 {
-  flake.modules.nixos.networking =
+  flake.modules.nixos.networking = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    ...
-      ...
+  }:
-    }:
+    with lib; let
-    with lib;
-    let
       cfg = config.tnix.networking.newt;
-    in
+    in {
-    {
       options.tnix.networking.newt = {
         enable = mkEnableOption "Newt";
 

modules/nixos/networking/ssh.nix

@@ -1,25 +1,22 @@
 {
-  flake.modules.nixos.networking =
+  flake.modules.nixos.networking = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    ...
-      ...
+  }:
-    }:
+    with lib; let
-    with lib;
-    let
       cfg = config.tnix.networking.openssh;
 
       # Sops needs acess to the keys before the persist dirs are even mounted; so
       # just persisting the keys won't work, we must point at /persist
       hasOptinPersistence = config.tnix.boot.impermanence.enable;
-    in
+    in {
-    {
       options.tnix.networking.openssh = {
         enable = mkEnableOption "Enable OpenSSH server";
 
         ports = mkOption {
           type = types.listOf types.port;
-          default = [ 22 ];
+          default = [22];
           description = ''
             Specifies on which ports the SSH daemon listens.
           '';

modules/nixos/services/aiostreams.nix

@@ -1,17 +1,14 @@
 {
-  flake.modules.nixos.services =
+  flake.modules.nixos.services = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    ...
-      ...
+  }:
-    }:
+    with lib; let
-    with lib;
-    let
       cfg = config.tnix.services.aiostreams;
       port = toString cfg.port;
       acmeHost = config.tnix.services.nginx.domain;
-    in
+    in {
-    {
       options.tnix.services.aiostreams = {
         enable = mkEnableOption "AIOStreams";
 

modules/nixos/services/coder.nix

@@ -0,0 +1,95 @@
+{
+  flake.modules.nixos.services = {
+    config,
+    lib,
+    options,
+    ...
+  }:
+    with lib; let
+      cfg = config.tnix.services.coder;
+      port = toString cfg.port;
+    in {
+      options.tnix.services.coder = {
+        enable = mkEnableOption "Coder";
+
+        host = mkOption {
+          type = types.str;
+          default = "127.0.0.1";
+          description = "Host on which Coder listens";
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 1116;
+          description = "Port on which Coder listens";
+        };
+
+        environment = options.services.coder.environment;
+
+        domain = mkOption {
+          type = types.str;
+          default = "";
+          description = "Domain on which Coder is available";
+        };
+
+        configureNginx = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Whether to configure Nginx as a reverse proxy for Coder";
+        };
+
+        configurePangolin = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Whether to configure Pangolin as a reverse proxy for Coder";
+        };
+      };
+
+      config = mkIf cfg.enable {
+        users.users.coder.extraGroups = ["docker"];
+
+        services = {
+          coder = {
+            enable = true;
+            accessUrl = "https://${cfg.domain}";
+            listenAddress = "${cfg.host}:${port}";
+            environment = cfg.environment;
+          };
+
+          nginx.virtualHosts.${cfg.domain} = mkIf cfg.configureNginx {
+            forceSSL = acmeHost != "";
+            useACMEHost = mkIf (acmeHost != "") acmeHost;
+            locations."/" = {
+              proxyPass = "http://${cfg.host}:${port}";
+              proxyWebsockets = true;
+            };
+          };
+
+          newt.blueprint.proxy-resources = mkIf cfg.configurePangolin {
+            gitea = {
+              auth = {
+                sso-enabled = false;
+              };
+              full-domain = cfg.domain;
+              name = "coder";
+              protocol = "http";
+              targets = [
+                {
+                  hostname = "localhost";
+                  method = "http";
+                  port = cfg.port;
+                  healthcheck = {
+                    hostname = "localhost";
+                    port = cfg.port;
+                    scheme = "http";
+                    method = "GET";
+                    path = "/";
+                  };
+                }
+              ];
+            };
+          };
+        };
+      };
+    };
+}

modules/nixos/services/copyparty.nix

@@ -1,19 +1,16 @@
-{ inputs, ... }: {
+{inputs, ...}: {
-  flake.modules.nixos.services =
+  flake.modules.nixos.services = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    pkgs,
-      pkgs,
+    options,
-      options,
+    ...
-      ...
+  }:
-    }:
+    with lib; let
-    with lib;
-    let
       cfg = config.tnix.services.copyparty;
       port = toString cfg.port;
       acmeHost = config.tnix.services.nginx.domain;
-    in
+    in {
-    {
       imports = [
         inputs.copyparty.nixosModules.default
       ];
@@ -75,7 +72,7 @@
             accounts = cfg.accounts;
             volumes = cfg.volumes;
             package = pkgs.copyparty.override {
-              extraPackages = [ pkgs.exiftool ];
+              extraPackages = [pkgs.exiftool];
             };
           };
 

modules/nixos/services/cyber-tux.nix

@@ -1,16 +1,13 @@
 {
-  flake.modules.nixos.services =
+  flake.modules.nixos.services = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    pkgs,
-      pkgs,
+    ...
-      ...
+  }:
-    }:
+    with lib; let
-    with lib;
-    let
       cfg = config.tnix.services.cyber-tux;
-    in
+    in {
-    {
       options.tnix.services.cyber-tux = {
         enable = mkEnableOption "CyberTux Discord bot";
 
@@ -41,9 +38,9 @@
       config = mkIf cfg.enable {
         systemd.services.cyber-tux = {
           description = "CyberTux Discord bot";
-          after = [ "network-online.target" ];
+          after = ["network-online.target"];
-          wants = [ "network-online.target" ];
+          wants = ["network-online.target"];
-          wantedBy = [ "multi-user.target" ];
+          wantedBy = ["multi-user.target"];
 
           serviceConfig = {
             Type = "simple";
@@ -83,7 +80,7 @@
             RestrictRealtime = true;
             RestrictSUIDSGID = true;
             SystemCallArchitectures = "native";
-            SystemCallFilter = [ "@system-service" ];
+            SystemCallFilter = ["@system-service"];
             UMask = "0077";
           };
         };
@@ -99,7 +96,7 @@
         };
 
         users.groups = mkIf (cfg.group == "cyber-tux") {
-          ${cfg.group} = { };
+          ${cfg.group} = {};
         };
       };
     };

modules/nixos/services/gitea.nix

@@ -1,17 +1,14 @@
 {
-  flake.modules.nixos.services =
+  flake.modules.nixos.services = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    ...
-      ...
+  }:
-    }:
+    with lib; let
-    with lib;
-    let
       cfg = config.tnix.services.gitea;
       port = toString cfg.port;
       acmeHost = config.tnix.services.nginx.domain;
-    in
+    in {
-    {
       options.tnix.services.gitea = {
         enable = mkEnableOption "Gitea";
 
@@ -109,7 +106,7 @@
 
           postgresql = {
             enable = true;
-            ensureDatabases = [ "gitea" ];
+            ensureDatabases = ["gitea"];
             ensureUsers = [
               {
                 name = "gitea";

modules/nixos/services/hermes-agent.nix

@@ -1,18 +1,15 @@
-{ inputs, ... }: {
+{inputs, ...}: {
-  flake.modules.nixos.services =
+  flake.modules.nixos.services = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    pkgs,
-      pkgs,
+    options,
-      options,
+    userName,
-      userName,
+    ...
-      ...
+  }:
-    }:
+    with lib; let
-    with lib;
-    let
       cfg = config.tnix.services.hermes-agent;
-    in
+    in {
-    {
       imports = [
         inputs.hermes-agent.nixosModules.default
       ];
@@ -27,7 +24,7 @@
           enable = true;
           settings.model = {
             provider = "opencode-go";
-            default = "deepseek-v4-flash";
+            default = "deepseek-v4.1-flash";
           };
           environmentFiles = cfg.environmentFiles;
           addToSystemPackages = true;
@@ -42,7 +39,7 @@
           ];
         };
 
-        users.users.${userName}.extraGroups = [ "hermes" ];
+        users.users.${userName}.extraGroups = ["hermes"];
       };
     };
 }

modules/nixos/services/mediaflow-proxy.nix

@@ -1,17 +1,14 @@
 {
-  flake.modules.nixos.services =
+  flake.modules.nixos.services = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    ...
-      ...
+  }:
-    }:
+    with lib; let
-    with lib;
-    let
       cfg = config.tnix.services.mediaflow-proxy;
       port = toString cfg.port;
       acmeHost = config.tnix.services.nginx.domain;
-    in
+    in {
-    {
       options.tnix.services.mediaflow-proxy = {
         enable = mkEnableOption "MediaFlow Proxy";
 

modules/nixos/services/nginx.nix

@@ -1,16 +1,13 @@
 {
-  flake.modules.nixos.services =
+  flake.modules.nixos.services = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    userEmail,
-      userEmail,
+    ...
-      ...
+  }:
-    }:
+    with lib; let
-    with lib;
-    let
       cfg = config.tnix.services.nginx;
-    in
+    in {
-    {
       options.tnix.services.nginx = {
         enable = mkEnableOption "Nginx";
 
@@ -30,7 +27,7 @@
               "${cfg.domain}" = {
                 group = "nginx";
                 domain = "*.${cfg.domain}";
-                extraDomainNames = [ "${cfg.domain}" ];
+                extraDomainNames = ["${cfg.domain}"];
                 dnsProvider = "cloudflare";
                 credentialFiles = {
                   CLOUDFLARE_EMAIL_FILE = config.sops.secrets."cloudflare-credentials/email".path;
@@ -41,7 +38,7 @@
           };
         };
 
-        users.users.nginx.extraGroups = [ "acme" ];
+        users.users.nginx.extraGroups = ["acme"];
 
         services.nginx = {
           enable = true;

modules/nixos/services/pangolin.nix

@@ -1,17 +1,14 @@
 {
-  flake.modules.nixos.services =
+  flake.modules.nixos.services = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    userEmail,
-      userEmail,
+    pkgs,
-      pkgs,
+    ...
-      ...
+  }:
-    }:
+    with lib; let
-    with lib;
-    let
       cfg = config.tnix.services.pangolin;
-    in
+    in {
-    {
       options.tnix.services.pangolin = {
         enable = mkEnableOption "Pangolin";
 
@@ -77,7 +74,7 @@
 
           postgresql = {
             enable = true;
-            ensureDatabases = [ "pangolin" ];
+            ensureDatabases = ["pangolin"];
             ensureUsers = [
               {
                 name = "pangolin";

modules/nixos/services/trok.nix

@@ -1,15 +1,12 @@
-{ inputs, ... }: {
+{inputs, ...}: {
-  flake.modules.nixos.services =
+  flake.modules.nixos.services = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    ...
-      ...
+  }:
-    }:
+    with lib; let
-    with lib;
-    let
       cfg = config.tnix.services.trok;
-    in
+    in {
-    {
       imports = [
         inputs.trok.nixosModules.default
       ];

modules/nixos/services/uptime-kuma.nix

@@ -1,17 +1,14 @@
 {
-  flake.modules.nixos.services =
+  flake.modules.nixos.services = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    ...
-      ...
+  }:
-    }:
+    with lib; let
-    with lib;
-    let
       cfg = config.tnix.services.uptime-kuma;
       port = toString cfg.port;
       acmeHost = config.tnix.services.nginx.domain;
-    in
+    in {
-    {
       options.tnix.services.uptime-kuma = {
         enable = mkEnableOption "Uptime Kuma";
 

modules/nixos/services/vaultwarden.nix

@@ -1,17 +1,14 @@
 {
-  flake.modules.nixos.services =
+  flake.modules.nixos.services = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    ...
-      ...
+  }:
-    }:
+    with lib; let
-    with lib;
-    let
       cfg = config.tnix.services.vaultwarden;
       port = toString cfg.port;
       acmeHost = config.tnix.services.nginx.domain;
-    in
+    in {
-    {
       options.tnix.services.vaultwarden = {
         enable = mkEnableOption "Vaultwarden";
 
@@ -106,7 +103,7 @@
 
           postgresql = {
             enable = true;
-            ensureDatabases = [ "vaultwarden" ];
+            ensureDatabases = ["vaultwarden"];
             ensureUsers = [
               {
                 name = "vaultwarden";

modules/nixos/virtualisation/distrobox.nix

@@ -1,118 +1,113 @@
 {
-  flake.modules.nixos.virtualisation =
+  flake.modules.nixos.virtualisation = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    pkgs,
-      pkgs,
+    ...
-      ...
+  }: let
-    }:
+    cfg = config.tnix.virtualisation;
-    let
+  in {
-      cfg = config.tnix.virtualisation;
+    options.tnix.virtualisation.distrobox = {
-    in
+      enable = lib.mkEnableOption "Enable DistroBox";
-    {
-      options.tnix.virtualisation.distrobox = {
-        enable = lib.mkEnableOption "Enable DistroBox";
-      };
-
-      config = lib.mkIf cfg.distrobox.enable {
-        virtualisation.waydroid.enable = true;
-
-        environment.systemPackages = with pkgs; [
-          distrobox
-
-          (writeShellScriptBin "dbox-create" ''
-            #!/usr/bin/env bash
-
-            # 1. Initialize variables
-            IMAGE=""
-            NAME=""
-
-            # Array to hold optional arguments (like volumes)
-            declare -a EXTRA_ARGS
-
-            # 2. Parse arguments
-            while [[ $# -gt 0 ]]; do
-              case $1 in
-                -i|--image)
-                  IMAGE="$2"
-                  shift 2
-                  ;;
-                -n|--name)
-                  NAME="$2"
-                  shift 2
-                  ;;
-                -p|--profile)
-                  echo ":: Profile mode enabled: Mounting Nix store and user profiles (Read-Only)"
-                  # Add volume flags to the array
-                  EXTRA_ARGS+=( "--volume" "/nix/store:/nix/store:ro" )
-                  EXTRA_ARGS+=( "--volume" "/etc/profiles/per-user:/etc/profiles/per-user:ro" )
-                  EXTRA_ARGS+=( "--volume" "/etc/static/profiles/per-user:/etc/static/profiles/per-user:ro" )
-                  shift 1
-                  ;;
-                *)
-                  echo "Unknown option $1"
-                  exit 1
-                  ;;
-              esac
-            done
-
-            if [ -z "$IMAGE" ] || [ -z "$NAME" ]; then
-                echo "Usage: dbox-create -i <image> -n <name> [-p]"
-                exit 1
-            fi
-
-            # 3. Define the custom home path
-            CUSTOM_HOME="$HOME/Distrobox/$NAME"
-
-            echo "------------------------------------------------"
-            echo "Creating Distrobox: $NAME"
-            echo "Location: $CUSTOM_HOME"
-            echo "------------------------------------------------"
-
-            # 4. Run Distrobox Create
-            # We expand "''${EXTRA_ARGS[@]}" to properly pass the volume arguments
-            ${pkgs.distrobox}/bin/distrobox create \
-              --image "$IMAGE" \
-              --name "$NAME" \
-              --home "$CUSTOM_HOME" \
-              "''${EXTRA_ARGS[@]}"
-
-            # Check exit code
-            if [ $? -ne 0 ]; then
-                echo "Error: Distrobox creation failed."
-                exit 1
-            fi
-
-            # 5. Post-Creation: Symlink Config Files
-            echo "--> Linking configurations to $NAME..."
-
-            # Helper function to symlink
-            link_config() {
-                SRC="$1"
-                DEST="$2"
-                DEST_DIR=$(dirname "$DEST")
-
-                # Create parent directory if it doesn't exist
-                mkdir -p "$DEST_DIR"
-
-                if [ -e "$SRC" ]; then
-                    # ln -sf: symbolic link, force overwrite
-                    ln -sf "$SRC" "$DEST"
-                    echo "    [LINK] $DEST -> $SRC"
-                else
-                    echo "    [SKIP] $SRC not found on host"
-                fi
-            }
-
-            # Create Symlinks
-            link_config "$HOME/.zshrc"                "$CUSTOM_HOME/.zshrc"
-            link_config "$HOME/.zshenv"               "$CUSTOM_HOME/.zshenv"
-            link_config "$HOME/.config/fastfetch"     "$CUSTOM_HOME/.config/fastfetch"
-            link_config "$HOME/.config/starship.toml" "$CUSTOM_HOME/.config/starship.toml"
-
-            echo "--> Done! Enter via: distrobox enter $NAME"
-          '')
-        ];
-      };
     };
+
+    config = lib.mkIf cfg.distrobox.enable {
+      environment.systemPackages = with pkgs; [
+        distrobox
+
+        (writeShellScriptBin "dbox-create" ''
+          #!/usr/bin/env bash
+
+          # 1. Initialize variables
+          IMAGE=""
+          NAME=""
+
+          # Array to hold optional arguments (like volumes)
+          declare -a EXTRA_ARGS
+
+          # 2. Parse arguments
+          while [[ $# -gt 0 ]]; do
+            case $1 in
+              -i|--image)
+                IMAGE="$2"
+                shift 2
+                ;;
+              -n|--name)
+                NAME="$2"
+                shift 2
+                ;;
+              -p|--profile)
+                echo ":: Profile mode enabled: Mounting Nix store and user profiles (Read-Only)"
+                # Add volume flags to the array
+                EXTRA_ARGS+=( "--volume" "/nix/store:/nix/store:ro" )
+                EXTRA_ARGS+=( "--volume" "/etc/profiles/per-user:/etc/profiles/per-user:ro" )
+                EXTRA_ARGS+=( "--volume" "/etc/static/profiles/per-user:/etc/static/profiles/per-user:ro" )
+                shift 1
+                ;;
+              *)
+                echo "Unknown option $1"
+                exit 1
+                ;;
+            esac
+          done
+
+          if [ -z "$IMAGE" ] || [ -z "$NAME" ]; then
+              echo "Usage: dbox-create -i <image> -n <name> [-p]"
+              exit 1
+          fi
+
+          # 3. Define the custom home path
+          CUSTOM_HOME="$HOME/Distrobox/$NAME"
+
+          echo "------------------------------------------------"
+          echo "Creating Distrobox: $NAME"
+          echo "Location: $CUSTOM_HOME"
+          echo "------------------------------------------------"
+
+          # 4. Run Distrobox Create
+          # We expand "''${EXTRA_ARGS[@]}" to properly pass the volume arguments
+          ${pkgs.distrobox}/bin/distrobox create \
+            --image "$IMAGE" \
+            --name "$NAME" \
+            --home "$CUSTOM_HOME" \
+            "''${EXTRA_ARGS[@]}"
+
+          # Check exit code
+          if [ $? -ne 0 ]; then
+              echo "Error: Distrobox creation failed."
+              exit 1
+          fi
+
+          # 5. Post-Creation: Symlink Config Files
+          echo "--> Linking configurations to $NAME..."
+
+          # Helper function to symlink
+          link_config() {
+              SRC="$1"
+              DEST="$2"
+              DEST_DIR=$(dirname "$DEST")
+
+              # Create parent directory if it doesn't exist
+              mkdir -p "$DEST_DIR"
+
+              if [ -e "$SRC" ]; then
+                  # ln -sf: symbolic link, force overwrite
+                  ln -sf "$SRC" "$DEST"
+                  echo "    [LINK] $DEST -> $SRC"
+              else
+                  echo "    [SKIP] $SRC not found on host"
+              fi
+          }
+
+          # Create Symlinks
+          link_config "$HOME/.zshrc"                "$CUSTOM_HOME/.zshrc"
+          link_config "$HOME/.zshenv"               "$CUSTOM_HOME/.zshenv"
+          link_config "$HOME/.config/fastfetch"     "$CUSTOM_HOME/.config/fastfetch"
+          link_config "$HOME/.config/starship.toml" "$CUSTOM_HOME/.config/starship.toml"
+
+          echo "--> Done! Enter via: distrobox enter $NAME"
+        '')
+      ];
+    };
+  };
 }

modules/nixos/virtualisation/docker.nix

@@ -1,32 +1,29 @@
 {
-  flake.modules.nixos.virtualisation =
+  flake.modules.nixos.virtualisation = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    pkgs,
-      pkgs,
+    userName,
-      userName,
+    ...
-      ...
+  }: let
-    }:
+    cfg = config.tnix.virtualisation;
-    let
+  in {
-      cfg = config.tnix.virtualisation;
+    options.tnix.virtualisation.docker = {
-    in
+      enable = lib.mkEnableOption "Docker container runtime";
-    {
+      nvidia = {
-      options.tnix.virtualisation.docker = {
+        enable = lib.mkEnableOption "NVIDIA Container Toolkit for Docker";
-        enable = lib.mkEnableOption "Docker container runtime";
-        nvidia = {
-          enable = lib.mkEnableOption "NVIDIA Container Toolkit for Docker";
-        };
-      };
-
-      config = lib.mkIf cfg.docker.enable {
-        virtualisation = {
-          oci-containers.backend = "docker";
-          docker.enable = true;
-        };
-
-        hardware.nvidia-container-toolkit.enable = lib.mkIf cfg.docker.nvidia.enable true;
-        environment.systemPackages = with pkgs; [ lazydocker ];
-        users.users.${userName}.extraGroups = [ "docker" ];
       };
     };
+
+    config = lib.mkIf cfg.docker.enable {
+      virtualisation = {
+        oci-containers.backend = "docker";
+        docker.enable = true;
+      };
+
+      hardware.nvidia-container-toolkit.enable = lib.mkIf cfg.docker.nvidia.enable true;
+      environment.systemPackages = with pkgs; [lazydocker];
+      users.users.${userName}.extraGroups = ["docker"];
+    };
+  };
 }

modules/nixos/virtualisation/qemu.nix

@@ -1,38 +1,34 @@
 {
-  flake.modules.nixos.virtualisation =
+  flake.modules.nixos.virtualisation = {
-    {
+    config,
-      config,
+    lib,
-      lib,
+    pkgs,
-      pkgs,
+    userName,
-      userName,
+    ...
-      ...
+  }: let
-    }:
+    cfg = config.tnix.virtualisation;
-    let
+  in {
-      cfg = config.tnix.virtualisation;
+    options.tnix.virtualisation.qemu = {
-    in
+      enable = lib.mkEnableOption "QEMU/KVM virtualization with libvirtd";
-    {
-      options.tnix.virtualisation.qemu = {
-        enable = lib.mkEnableOption "QEMU/KVM virtualization with libvirtd";
-      };
-
-      config = lib.mkIf cfg.qemu.enable {
-        virtualisation = {
-          libvirtd = {
-            enable = true;
-            qemu = {
-              swtpm.enable = true;
-            };
-          };
-          spiceUSBRedirection.enable = true;
-        };
-
-        users.users.${userName}.extraGroups = [ "libvirtd" ];
-
-        environment.systemPackages = with pkgs; [
-          virt-manager
-          virt-viewer
-        ];
-      };
     };
 
+    config = lib.mkIf cfg.qemu.enable {
+      virtualisation = {
+        libvirtd = {
+          enable = true;
+          qemu = {
+            swtpm.enable = true;
+          };
+        };
+        spiceUSBRedirection.enable = true;
+      };
+
+      users.users.${userName}.extraGroups = ["libvirtd"];
+
+      environment.systemPackages = with pkgs; [
+        virt-manager
+        virt-viewer
+      ];
+    };
+  };
 }