feat(netbird): setup netbird client

.sops.yaml

@@ -5,6 +5,7 @@ keys:
   - &hosts
     - &sirius age1maxsx5tq2h3d92rfyl8ekcdan5gu5cpch4qs3c56cu7qag02xgvs3h0gqc
     - &arcturus age1huqa3hc7wcxk4dpelrzny437nzrx4fnll3d8g9ahznzk268yju5qufapxy
+    - &alpha age1mzxxxzhy3us3rd960ufqv7vlxj5cnug86md6x69llg9ujzw2pqws057llf
 
 creation_rules:
   - path_regex: hosts/sirius/secrets.yaml$
@@ -17,3 +18,8 @@ creation_rules:
       - age:
           - *tux
           - *arcturus
+  - path_regex: hosts/alpha/secrets.yaml$
+    key_groups:
+      - age:
+          - *tux
+          - *alpha

modules/hm/shell/neovim.nix

@@ -13,8 +13,9 @@
         neovim = {
           enable = true;
           defaultEditor = true;
-          vimAlias = true;
         };
+
+        vim.enable = true;
       };
 
       home = {

modules/hm/shell/opencode.nix

@@ -1,34 +1,29 @@
 {
-  flake.modules.homeManager.shell =
+  flake.modules.homeManager.shell = {
-    {
+    programs.opencode = {
-      osConfig ? { },
+      enable = true;
-      ...
+      tui = {
-    }:
+        theme = "system";
-    {
+      };
-      programs.opencode = {
+      settings = {
-        enable = true;
+        provider = {
-        tui = {
+          google = {
-          theme = "system";
+            options = {
-        };
+              apiKey = "{file:/run/secrets/gemini-api-key}";
-        settings = {
-          provider = {
-            google = {
-              options = {
-                apiKey = "{file:${osConfig.sops.secrets.gemini-api-key.path}}";
-              };
             };
-            openrouter = {
+          };
-              options = {
+          openrouter = {
-                apiKey = "{file:${osConfig.sops.secrets.openrouter-api-key.path}}";
+            options = {
-              };
+              apiKey = "{file:/run/secrets/openrouter-api-key}";
             };
-            opencode-go = {
+          };
-              options = {
+          opencode-go = {
-                apiKey = "{file:${osConfig.sops.secrets.opencode-go-api-key.path}}";
+            options = {
-              };
+              apiKey = "{file:/run/secrets/opencode-go-api-key}";
             };
           };
         };
       };
     };
+  };
 }

modules/hosts/alpha/config.nix

@@ -0,0 +1,89 @@
+{ config, ... }:
+{
+  flake.modules.nixos.alpha =
+    {
+      hostName,
+      userName,
+      modulesPath,
+      ...
+    }:
+    {
+      imports =
+        with config.flake.modules.nixos;
+        [
+          boot
+          hardware
+          networking
+          virtualisation
+          services
+        ]
+        ++ [
+          (modulesPath + "/profiles/qemu-guest.nix")
+        ];
+
+      tnix = {
+        boot = {
+          legacy.enable = true;
+
+          impermanence = {
+            enable = true;
+
+            home = {
+              directories = [
+                ".local/share/nvim"
+                ".local/share/zsh"
+                ".local/share/zoxide"
+                ".local/state/lazygit"
+                ".local/share/opencode"
+              ];
+            };
+          };
+        };
+
+        networking = {
+          openssh.enable = true;
+          netbird-client.enable = true;
+        };
+
+        virtualisation = {
+          docker.enable = true;
+        };
+      };
+
+      sops.secrets = {
+        tux-password = {
+          sopsFile = ./secrets.yaml;
+          neededForUsers = true;
+        };
+
+        gemini-api-key = {
+          sopsFile = ./secrets.yaml;
+          owner = userName;
+        };
+
+        openrouter-api-key = {
+          sopsFile = ./secrets.yaml;
+          owner = userName;
+        };
+
+        opencode-go-api-key = {
+          sopsFile = ./secrets.yaml;
+          owner = userName;
+        };
+
+        netbird-key = {
+          sopsFile = ./secrets.yaml;
+          owner = userName;
+        };
+      };
+
+      # --- Networking ---
+      networking = {
+        hostName = hostName;
+        networkmanager.enable = true;
+        firewall.enable = false;
+      };
+
+      system.stateVersion = "26.05";
+    };
+}

modules/hosts/alpha/default.nix

@@ -0,0 +1,23 @@
+{
+  inputs,
+  config,
+  ...
+}:
+let
+  hostName = "alpha";
+  userName = "tux";
+  userEmail = "t@tux.rs";
+  system = "x86_64-linux";
+  unstable = true;
+  nixpkgs = if unstable then inputs.nixpkgs else inputs.nixpkgs-stable;
+in
+{
+  flake.nixosConfigurations."${hostName}" = nixpkgs.lib.nixosSystem {
+    inherit system;
+    specialArgs = { inherit hostName userName userEmail; };
+    modules = [
+      config.flake.modules.nixos.core
+      config.flake.modules.nixos.${hostName}
+    ];
+  };
+}

modules/hosts/alpha/disko.nix

@@ -0,0 +1,82 @@
+{ inputs, ... }:
+{
+  flake.modules.nixos.alpha =
+    { config, lib, ... }:
+    let
+      hasOptinPersistence = config.tnix.boot.impermanence.enable;
+      isLegacy = config.tnix.boot.legacy.enable;
+    in
+    {
+      imports = [
+        inputs.disko.nixosModules.disko
+      ];
+
+      disko.devices.disk.primary = {
+        device = "/dev/sda";
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [
+                  "defaults"
+                  "umask=0077"
+                ];
+              };
+            };
+            root = {
+              size = "100%";
+              type = "8300";
+              content = {
+                type = "btrfs";
+                # Base subvolumes that always exist
+                subvolumes = {
+                  "/root" = {
+                    mountOptions = [
+                      "compress=zstd"
+                      "noatime"
+                      "space_cache=v2"
+                    ];
+                    mountpoint = "/";
+                  };
+                  "/nix" = {
+                    mountOptions = [
+                      "compress=zstd"
+                      "noatime"
+                      "noacl"
+                      "space_cache=v2"
+                    ];
+                    mountpoint = "/nix";
+                  };
+                }
+                # Conditionally merge /persist only when impermanence is enabled
+                // lib.optionalAttrs hasOptinPersistence {
+                  "/persist" = {
+                    mountOptions = [
+                      "compress=zstd"
+                      "noatime"
+                      "space_cache=v2"
+                    ];
+                    mountpoint = "/persist";
+                  };
+                };
+              };
+            };
+          }
+          // lib.optionalAttrs isLegacy {
+            boot = {
+              name = "boot";
+              size = "1M";
+              type = "EF02";
+            };
+          };
+        };
+      };
+    };
+}

modules/hosts/alpha/home.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  flake.modules.homeManager.alpha = {
+    home.stateVersion = "26.05";
+  };
+}

modules/hosts/alpha/secrets.yaml

@@ -0,0 +1,29 @@
+tux-password: ENC[AES256_GCM,data:tvx3nMoIuQSotxHDWLs7UesnyWY3u3EwkqAIzCw3Z2AJseaiqnt/xeSKAeUXPVSs85rVdIJ6Ys5+6r+NONEG7ujuNevpjJRNkQ==,iv:CB0BIrMfdiWiMCvmRdtsafh3dCAD5Qb3mOuE7eq4nA4=,tag:p/3AESwNCEL4EoU9rJjUPw==,type:str]
+gemini-api-key: ENC[AES256_GCM,data:Bo3Z5Jhce0UOBn77I2AcrXYbBgPLDx0eOjPC8J63E/VWNhMPbbxb,iv:iWOsTACOMcK3oqq848WnJ5Ku3tYy1aadmLB4IMgoyqg=,tag:BPzlXoP8/iJaj8c/YFCWyg==,type:str]
+openrouter-api-key: ENC[AES256_GCM,data:D+/ImUTg7UvBTh0fMlWMZ0O/GsQS/R4Hz+CO4l42R6mn+zk+udvw79BctXdWWyrFf2ZNOTJ/99QTtWOUOvHISWaEJogXyb+93g==,iv:c7OtgBu1Zaf7lA4InIsKOAPbAvTl3gaO7QGCFNx21Bo=,tag:KXiASj/qC1YzK6DUox57ug==,type:str]
+opencode-go-api-key: ENC[AES256_GCM,data:ipKkNcRqBERIQ6f6yFzVm999s+UwJys4elHWhzpL441RfOaG9MmRWMcD+wRLJ7DSWFjYu6uUPF7TKez8J6abWeKDgg==,iv:FDSYE3R8zKVxWiP2S/sCVcwEu3fEXg/hCeqCRSF+c6g=,tag:5RDuMFGMoN6xwAYj0HiyjQ==,type:str]
+netbird-key: ENC[AES256_GCM,data:NilfyafnGhFVYD6q4+jJQxlhXNdNC8BQ1CZfu8a5wc693Y1h,iv:Rpl0OpkQdBMPpIJ08t9Z0AjDAW6c97pFZKO1KPu8ipY=,tag:du3d0SQWuqJtJSwhSgJE4g==,type:str]
+sops:
+    age:
+        - recipient: age14vktfes95f33vuefwnmuvryas7az04u76dsgyhfvsx73czkvmp2q7njkl4
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaR0kzRXBGRjJaVldDRk90
+            KzYwSzJBeXBnNVZ0T2VaU2oyLzdRWmo5ZzNVCk9HTDVtMk8xL1cwL2FSRUR5UGdS
+            bXJnOXhTbWozWm5rd2pnaFNoWk0rWncKLS0tIGFWWmY2WU9YanJ5UElab3lqaXNo
+            QUhYUWs4bitJaGpXL200b0s0SmVIeVUKevQ1IVqmqGIYf014iL47C02+peSYJyeE
+            PNluZUA6VzrL2WpdJzDqxAwSWtcgXG0/JADIg+DssnhftiHMHzn3NQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1mzxxxzhy3us3rd960ufqv7vlxj5cnug86md6x69llg9ujzw2pqws057llf
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnL1VPODRnNEs2bXlUVjB5
+            Z0pBUzBnRDQ0WWcvL2IvUHdmQXUxNjRpTVN3Ck9VLzd2QWpMMlFJck1EQXBVanl0
+            SC91bDFqNFlJZ2E0UXVZa3BKRjh3TlkKLS0tIENuc1dUZ1dDUTg2VXBueU1ETG9S
+            c095blJheHhVT0E4bjdGUWlYN0N4MVUKK42sChX4V37HK1SRKQxldLpft2jVfeiG
+            4TkObqH8ddGpbd7cX5a/wboTjYuEdAviWxjK2oBPgtcFc1f03X3tmA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-10T01:11:29Z"
+    mac: ENC[AES256_GCM,data:E+ZcNRFEPtJK02gWooRs7f20BHIYf8Ot4GjB1ab1KZwhI+3pUI6r654iO8+tiimQSeLWLgD43Szq4/7CpS+8NVjSI5uvXSxQQubXQfI0LmulT5XAVueOuSMgvetSFg8yN6+njBmr/MauixSSs2jjpQxtfsSSBgZ9RO7B7qLpMe4=,iv:kdCcTLb3bDmCfcjQQ8fH5ipkTQ5YlVDlhEVw5MzsH6s=,tag:ojub2y6b+jMbW/5i39xH5w==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2

modules/hosts/arcturus/config.nix

@@ -40,7 +40,10 @@
           };
         };
 
-        networking.openssh.enable = true;
+        networking = {
+          openssh.enable = true;
+          netbird-client.enable = true;
+        };
 
         services = {
           cyber-tux = {
@@ -78,6 +81,11 @@
           sopsFile = ./secrets.yaml;
           owner = userName;
         };
+
+        netbird-key = {
+          sopsFile = ./secrets.yaml;
+          owner = userName;
+        };
       };
 
       # --- Networking ---

modules/hosts/arcturus/secrets.yaml

@@ -3,6 +3,7 @@ discord-token: ENC[AES256_GCM,data:uzxkrNRRplL/1MfvPZ/EL+I8UACuZQBHZ95BSHuxW0nBj
 gemini-api-key: ENC[AES256_GCM,data:gLZSoYTdKY+rwIpYiXvN9n9PGkUD6q8Oe7dHnYkjEjwDf5qpjubg,iv:ySoNgQWTu9DjvbashF4ulyYP8fJUl4yrCTeBQ0jrGmw=,tag:FctubsQv50AP78JvTb9bpQ==,type:str]
 openrouter-api-key: ENC[AES256_GCM,data:6xONCl9lqOoO7b4CEyCz9607tICDUAkpglRjGS5nYq2ppg2UKqYTrWD1BGCA5Xfs/CWskniVhoNG3vscjKiYCCh9gbM6aqdmTQ==,iv:7Iwc9t00HOOBjA7URXcUO41badqYyJCkFHM/uPkLFxY=,tag:Cl39kitr2e0//HVwAdsdUQ==,type:str]
 opencode-go-api-key: ENC[AES256_GCM,data:dmeRKn7TWHnqvpyPQpcEG6yHTb2bRby/rh10ytL0jHj5R+lRmNVdmqUF92GTznY9vEaB6ZYCJecWhpm8g4upNfOWBg==,iv:9UMJpAlD8gpcNiN+liu3nawoAZQKapEg7sCp561N9E8=,tag:OZlASpOa5BQaQwFWjoLCRw==,type:str]
+netbird-key: ENC[AES256_GCM,data:q6eKisca04qn/CvALrvXF79MsToDhvLRLv2JTiUBAZglCC9m,iv:jj0/ZD7IDgopprTVUgSfJmdAJmUP3iqewU3dqssGYbk=,tag:6IPRdCm2FGdlTEIX7jt3qA==,type:str]
 sops:
     age:
         - recipient: age14vktfes95f33vuefwnmuvryas7az04u76dsgyhfvsx73czkvmp2q7njkl4
@@ -23,7 +24,7 @@ sops:
             V3h4dUZLcktrTUZvUm44eVZOWEl4VmMKMTvajoWcktb4jVIP4HyzQiR41Wg8Gdqi
             TLKEYsPQgOJ7s8P9gw2uPUY6HRz86CtiC6EbO27u0+8BbI85x1QScg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-08T19:38:01Z"
+    lastmodified: "2026-05-10T00:36:06Z"
-    mac: ENC[AES256_GCM,data:G6Klq53VRWgDZDM4aDi0vbs87nvM90eH4e9XZNDMtSdrlf/60Lo2/0qp8kAsuKjf6OC5ThEMSP6h0nWrCZryVGP32b6BCMSUcecFm1rdCP3s64iPUlx/5UeT1dbPG1MPfV+mjO2/43dM9Nkmov7WiFrQ7NNJluvwu/7z6v6hEsQ=,iv:qbesEfb/9hqdwzSvNI0p6/QuGoQQ14ZPwK2S6op9o3g=,tag:5B2cnkWiEeg+GOrtK4H82A==,type:str]
+    mac: ENC[AES256_GCM,data:nD0exblrbheP1C5lK8V17V/gkHJO6s6yVjXtQWcUOLVGrzkPSxkymYBHUFMTLVyYQNLCVMc8AHkuHVuJ1tBfXNll1f6/SGtfaBQcOLct70U7nFxd/XybTUlscNp2KafJWy/n4ZUfNDbfrWN1R463CN/M50jGqJPDWYuP9ah2JcI=,iv:izQUT/+HQqJZ48X5bXobFSaWcdcXQ/7eh+SCd9i4YYo=,tag:FJlR2wI4rWQ/SDfQGtQ7AQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.2

modules/hosts/sirius/config.nix

@@ -54,7 +54,10 @@
           };
         };
 
-        networking.openssh.enable = true;
+        networking = {
+          openssh.enable = true;
+          netbird-client.enable = true;
+        };
 
         virtualisation = {
           docker.enable = true;
@@ -86,6 +89,11 @@
           owner = userName;
         };
 
+        netbird-key = {
+          sopsFile = ./secrets.yaml;
+          owner = userName;
+        };
+
         vicinae-json = {
           sopsFile = ./secrets.yaml;
           owner = userName;

modules/hosts/sirius/secrets.yaml

@@ -2,6 +2,7 @@ tux-password: ENC[AES256_GCM,data:JWQVd2MYX2U4UP4II62ixG9hWI5MtgHAFhl8aCmyrYPl1H
 gemini-api-key: ENC[AES256_GCM,data:Y9YgXp/tB3Q1Rb5YMsZLgWCq+bdeIjsXAVeO3Yh7nZ8MwDH7d5De,iv:FIXxJCn6JDYsHIoNn8f8Un3z9ZPVbxdjR48Ux88poRg=,tag:bMJ4i69HTspnhzsrsxkbrw==,type:str]
 openrouter-api-key: ENC[AES256_GCM,data:HfZgZz4NyCLLM9woTZp2I6JGOlVcFblw2OMjx8k0TG5ZU2ycBCF6bKqp3wFibUxXcHy+nIfjI82fkLeSyIaGILRLYCJCc8BHKw==,iv:umUcn8MRaj7JXo6IFrGMXOu+jsFSCEikMxsQxfaFS/Q=,tag:l2s61C4EpJoKv8cc9nYGFA==,type:str]
 opencode-go-api-key: ENC[AES256_GCM,data:BGERcZg5Jpnznc4cXeYFMhPk9kKBkd9GvIuQBV9TW3JE1utgrLLYK6mKNCQqrEStRFiO2jUUnBm3opUNL4SuEHFLpw==,iv:fgFAwx6z9yruK27PvAJX/Q2CS9gU+LJ5zMUK/f/rzpo=,tag:BPu3M+jppPB8sLoLmfuY/Q==,type:str]
+netbird-key: ENC[AES256_GCM,data:qXAnRnLM2TlzpOvWG4exJv0+pUvpe0FpRN5xOWx3+KNt+yhq,iv:X+yl4o1RSYMCMWdVXo1hpzy+6IdKXUpsKPtYNSiHiCY=,tag:I8HbnD5iw6EJ1TdsNrhvfw==,type:str]
 vicinae-json: ENC[AES256_GCM,data:JjxolEgS6uakqR4eHOx3VyrOO5kaL4dj1jcEiLWsrktCU32UB7OmP1kJEVomA1rZjODpFHL89+FRpcNFspTFrc365WlANE81RLg/M2Ja1MiLYaDFNcBGtqMX9Yc1muor53Xl7t+rTSvDIj1oE1L7xPPcjCLfwC5QDzJjCBWj9FhCxnU5BwvoJNv9vgA6xnkzAOYSPZK/ihULMD0DxyqOUEa5ECGX62OPM9Gbr7jEviaItYzOOxaRs/yQVqizodGGl/BcK6fPqvOYSxip9ABYRVSI9ZvysY7ofAkeX91ardPwVG5VvEYfxZwBvGFjV7ZfTzVkK+BiUUNrvciAETHqwkjHftPpfJjxWsgLr8lbOA==,iv:HjDE/sqVDnxeww7r2upxH57rc1+LpuMKnhhyGXoc1Ms=,tag:d2kZeWkg17eVoNACIQ3Q9A==,type:str]
 sops:
     age:
@@ -23,7 +24,7 @@ sops:
             M3JocWZJeXFxenhXOENBVWpvNkd3bm8KqhNLzCyEAI643jGWpZF/uTchHmBj8ozU
             HtpOzKsshif66D0XOHeJQfQamJI4TyKsj3Sk3j9rstsLmN2lxTRGHg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-09T08:43:42Z"
+    lastmodified: "2026-05-10T00:35:50Z"
-    mac: ENC[AES256_GCM,data:kvavZmpCHF2A4tjPAwbb9lD0y0WtoYi6Ci7vAhcgWRq4fG8nSyJMd9vXItGp5Cc+120R3bWiQmaJpINYLMi2KJF8gIy7aZqXMZgHuQEdxMWR6XhdIGvjSAd31z5leLEXT2/lHwKYhVd0dZmIA2wRbvj9qF6lW9EnuRYUltROdMg=,iv:qRs2VELIa4rszmeJUCbDvpHr7N6iMhr1r2Ddxktot2k=,tag:4Q/utZ06K3E9at+cIVkcwQ==,type:str]
+    mac: ENC[AES256_GCM,data:u27zQ1PPnWy5Parbh/1DkVP3ICmHnLZJKaLbN3dZEVONgqOWi32LV3t0iNhtLWwVnzFPBusRWahQiqAkUdnQtrXF0OtjPCpLuIw86xB75QPGbet0GZlLNb8/xPshChZe4v520csdJMWiy3vYeKrk8LxMSViAGhmhYK2a5NbGhzI=,iv:/9vePmvCNqoP0kx24fP3HfCjS2FkjBmI5B+SycvKKW4=,tag:gE1/DnLolwhoyfMJYejGIQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.2

modules/hosts/vps/config.nix

@@ -0,0 +1,57 @@
+{ config, ... }:
+{
+  flake.modules.nixos.vps =
+    {
+      hostName,
+      modulesPath,
+      ...
+    }:
+    {
+      imports =
+        with config.flake.modules.nixos;
+        [
+          boot
+          hardware
+          networking
+          virtualisation
+          services
+        ]
+        ++ [
+          (modulesPath + "/profiles/qemu-guest.nix")
+        ];
+
+      tnix = {
+        boot = {
+          legacy.enable = true;
+
+          impermanence = {
+            enable = true;
+
+            home = {
+              directories = [
+                ".local/share/nvim"
+                ".local/share/zsh"
+                ".local/share/zoxide"
+                ".local/state/lazygit"
+              ];
+            };
+          };
+        };
+
+        networking.openssh.enable = true;
+
+        virtualisation = {
+          docker.enable = true;
+        };
+      };
+
+      # --- Networking ---
+      networking = {
+        hostName = hostName;
+        networkmanager.enable = true;
+        firewall.enable = false;
+      };
+
+      system.stateVersion = "26.05";
+    };
+}

modules/hosts/vps/default.nix

@@ -0,0 +1,23 @@
+{
+  inputs,
+  config,
+  ...
+}:
+let
+  hostName = "vps";
+  userName = "tux";
+  userEmail = "t@tux.rs";
+  system = "x86_64-linux";
+  unstable = true;
+  nixpkgs = if unstable then inputs.nixpkgs else inputs.nixpkgs-stable;
+in
+{
+  flake.nixosConfigurations."${hostName}" = nixpkgs.lib.nixosSystem {
+    inherit system;
+    specialArgs = { inherit hostName userName userEmail; };
+    modules = [
+      config.flake.modules.nixos.core
+      config.flake.modules.nixos.${hostName}
+    ];
+  };
+}

modules/hosts/vps/disko.nix

@@ -0,0 +1,82 @@
+{ inputs, ... }:
+{
+  flake.modules.nixos.vps =
+    { config, lib, ... }:
+    let
+      hasOptinPersistence = config.tnix.boot.impermanence.enable;
+      isLegacy = config.tnix.boot.legacy.enable;
+    in
+    {
+      imports = [
+        inputs.disko.nixosModules.disko
+      ];
+
+      disko.devices.disk.primary = {
+        device = "/dev/sda";
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [
+                  "defaults"
+                  "umask=0077"
+                ];
+              };
+            };
+            root = {
+              size = "100%";
+              type = "8300";
+              content = {
+                type = "btrfs";
+                # Base subvolumes that always exist
+                subvolumes = {
+                  "/root" = {
+                    mountOptions = [
+                      "compress=zstd"
+                      "noatime"
+                      "space_cache=v2"
+                    ];
+                    mountpoint = "/";
+                  };
+                  "/nix" = {
+                    mountOptions = [
+                      "compress=zstd"
+                      "noatime"
+                      "noacl"
+                      "space_cache=v2"
+                    ];
+                    mountpoint = "/nix";
+                  };
+                }
+                # Conditionally merge /persist only when impermanence is enabled
+                // lib.optionalAttrs hasOptinPersistence {
+                  "/persist" = {
+                    mountOptions = [
+                      "compress=zstd"
+                      "noatime"
+                      "space_cache=v2"
+                    ];
+                    mountpoint = "/persist";
+                  };
+                };
+              };
+            };
+          }
+          // lib.optionalAttrs isLegacy {
+            boot = {
+              name = "boot";
+              size = "1M";
+              type = "EF02";
+            };
+          };
+        };
+      };
+    };
+}

modules/hosts/vps/home.nix

@@ -0,0 +1,6 @@
+{ ... }:
+{
+  flake.modules.homeManager.vps = {
+    home.stateVersion = "26.05";
+  };
+}

modules/nixos/boot/loader.nix

@@ -1,8 +1,29 @@
 {
-  flake.modules.nixos.boot = {
+  flake.modules.nixos.boot =
-    boot.loader = {
+    { config, lib, ... }:
-      timeout = 1;
+    let
-      efi.canTouchEfiVariables = true;
+      cfg = config.tnix.boot;
+    in
+    {
+      options.tnix.boot.legacy = {
+        enable = lib.mkEnableOption "legacy boot (GRUB) instead of systemd-boot";
+      };
+
+      config = lib.mkMerge [
+        {
+          boot.loader = {
+            timeout = 1;
+            efi.canTouchEfiVariables = true;
+          };
+        }
+
+        (lib.mkIf (!cfg.legacy.enable && !cfg.secure-boot.enable) {
+          boot.loader.systemd-boot.enable = true;
+        })
+
+        (lib.mkIf cfg.legacy.enable {
+          boot.loader.grub.enable = true;
+        })
+      ];
     };
-  };
 }

modules/nixos/boot/secure-boot.nix

@@ -18,11 +18,16 @@
       };
 
       config = lib.mkIf cfg.secure-boot.enable {
-        environment.systemPackages = [
+        assertions = [
-          pkgs.sbctl
+          {
+            assertion = !cfg.legacy.enable;
+            message = "secure-boot and legacy boot (GRUB) cannot be enabled at the same time";
+          }
         ];
 
-        # Lanzaboote currently replaces the systemd-boot module.
+        environment.systemPackages = [ pkgs.sbctl ];
+
+        # Lanzaboote replaces systemd-boot, so force it off
         boot.loader.systemd-boot.enable = lib.mkForce false;
 
         boot.lanzaboote = {

modules/nixos/core/users.nix

@@ -8,6 +8,9 @@
       userEmail,
       ...
     }:
+    let
+      hasPasswordSecret = lib.hasAttrByPath [ "sops" "secrets" "tux-password" ] config;
+    in
     {
       programs.zsh.enable = true;
 
@@ -31,7 +34,8 @@
         mutableUsers = false;
         defaultUserShell = pkgs.zsh;
         users.${userName} = {
-          hashedPasswordFile = config.sops.secrets.tux-password.path;
+          hashedPasswordFile = lib.mkIf hasPasswordSecret config.sops.secrets.tux-password.path;
+          initialPassword = lib.mkIf (!hasPasswordSecret) userName;
           isNormalUser = true;
           extraGroups = [
             "networkmanager"

modules/nixos/networking/netbird-client.nix

@@ -0,0 +1,31 @@
+{
+  flake.modules.nixos.networking =
+    {
+      config,
+      lib,
+      hostName,
+      ...
+    }:
+    with lib;
+    let
+      cfg = config.tnix.networking.netbird-client;
+    in
+    {
+      options.tnix.networking.netbird-client = {
+        enable = mkEnableOption "Enable netbird client";
+      };
+
+      config = mkIf cfg.enable {
+        services.netbird.clients = {
+          ${hostName} = {
+            port = 51820;
+            login = {
+              enable = true;
+              setupKeyFile = config.sops.secrets.netbird-key.path;
+            };
+            bin.suffix = "";
+          };
+        };
+      };
+    };
+}